Commit Graph

798546 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
1e9ce09d3e ANDROID: GKI: update abi definitions due to recent changes
Leaf changes summary: 23 artifacts changed
Changed leaf types summary: 10 leaf types changed
Removed/Changed/Added functions summary: 3 Removed, 0 Changed, 10 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

3 Removed functions:

  [D] 'function int fb_register_client(notifier_block*)'
  [D] 'function int fb_unregister_client(notifier_block*)'
  [D] 'function int remove_conflicting_framebuffers(apertures_struct*, const char*, bool)'

10 Added functions:

  [A] 'function void arch_timer_mem_get_cval(u32*, u32*)'
  [A] 'function unsigned long int clk_aggregate_rate(clk_hw*, const clk_core*)'
  [A] 'function void clk_debug_print_hw(clk_core*, seq_file*)'
  [A] 'function int clk_set_flags(clk*, unsigned long int)'
  [A] 'function void clk_unvote_rate_vdd(clk_core*, unsigned long int)'
  [A] 'function int clk_unvote_vdd_level(clk_vdd_class*, int)'
  [A] 'function int clk_vote_rate_vdd(clk_core*, unsigned long int)'
  [A] 'function int clk_vote_vdd_level(clk_vdd_class*, int)'
  [A] 'function napi_struct* get_current_napi_context()'
  [A] 'function void regulator_sync_state(device*)'

'struct cfg80211_ap_settings at cfg80211.h:929:1' changed:
  type size hasn't changed
  1 data member insertion:
    'u32 cfg80211_ap_settings::flags', at offset 3232 (in bits) at cfg80211.h:964:1
  one impacted interface:
    function wiphy* wiphy_new_nm(const cfg80211_ops*, int, const char*)

'struct cfg80211_external_auth_params at cfg80211.h:2871:1' changed:
  type size changed from 416 to 512 (in bits)
  1 data member insertion:
    'const u8* cfg80211_external_auth_params::pmkid', at offset 448 (in bits) at cfg80211.h:2891:1
  2 impacted interfaces:
    function int cfg80211_external_auth_request(net_device*, cfg80211_external_auth_params*, gfp_t)
    function wiphy* wiphy_new_nm(const cfg80211_ops*, int, const char*)

'struct clk_init_data at clk-provider.h:262:1' changed:
  type size changed from 320 to 512 (in bits)
  4 data member insertions:
    'clk_vdd_class* clk_init_data::vdd_class', at offset 320 (in bits) at clk-provider.h:297:1
    'unsigned long int* clk_init_data::rate_max', at offset 384 (in bits) at clk-provider.h:298:1
    'int clk_init_data::num_rate_max', at offset 448 (in bits) at clk-provider.h:299:1
    'unsigned int clk_init_data::bus_cl_id', at offset 480 (in bits) at clk-provider.h:300:1
  there are data member changes:
    type 'typedef u8' of 'clk_init_data::num_parents' changed:
      entity changed from 'typedef u8' to compatible type 'unsigned int'
      type size changed from 8 to 32 (in bits)
    and size changed from 8 to 32 (in bits) (by +24 bits)
  18 impacted interfaces:
    function int __clk_determine_rate(clk_hw*, clk_rate_request*)
    function clk_hw* __clk_get_hw(clk*)
    function int __clk_mux_determine_rate_closest(clk_hw*, clk_rate_request*)
    function unsigned long int clk_hw_get_flags(const clk_hw*)
    function const char* clk_hw_get_name(const clk_hw*)
    function unsigned int clk_hw_get_num_parents(const clk_hw*)
    function clk_hw* clk_hw_get_parent(const clk_hw*)
    function clk_hw* clk_hw_get_parent_by_index(const clk_hw*, unsigned int)
    function unsigned long int clk_hw_get_rate(const clk_hw*)
    function bool clk_hw_is_enabled(const clk_hw*)
    function bool clk_hw_is_prepared(const clk_hw*)
    function unsigned long int clk_hw_round_rate(clk_hw*, unsigned long int)
    function int devm_clk_hw_register(device*, clk_hw*)
    function clk* devm_clk_register(device*, clk_hw*)
    function int devm_of_clk_add_hw_provider(device*, void ()*, void*)
    function unsigned long int divider_recalc_rate(clk_hw*, unsigned long int, unsigned int, const clk_div_table*, unsigned long int, unsigned long int)
    function long int divider_ro_round_rate_parent(clk_hw*, clk_hw*, unsigned long int, unsigned long int*, const clk_div_table*, u8, unsigned long int, unsigned int)
    function long int divider_round_rate_parent(clk_hw*, clk_hw*, unsigned long int, unsigned long int*, const clk_div_table*, u8, unsigned long int)

'struct clk_ops at clk-provider.h:218:1' changed:
  type size changed from 1408 to 1664 (in bits)
  4 data member insertions:
    'void ()* clk_ops::set_flags', at offset 1408 (in bits) at clk-provider.h:269:1
    'void ()* clk_ops::list_registers', at offset 1472 (in bits) at clk-provider.h:270:1
    'void ()* clk_ops::list_rate', at offset 1536 (in bits) at clk-provider.h:272:1
    'void ()* clk_ops::bus_vote', at offset 1600 (in bits) at clk-provider.h:274:1
  18 impacted interfaces:
    function int __clk_determine_rate(clk_hw*, clk_rate_request*)
    function clk_hw* __clk_get_hw(clk*)
    function int __clk_mux_determine_rate_closest(clk_hw*, clk_rate_request*)
    function unsigned long int clk_hw_get_flags(const clk_hw*)
    function const char* clk_hw_get_name(const clk_hw*)
    function unsigned int clk_hw_get_num_parents(const clk_hw*)
    function clk_hw* clk_hw_get_parent(const clk_hw*)
    function clk_hw* clk_hw_get_parent_by_index(const clk_hw*, unsigned int)
    function unsigned long int clk_hw_get_rate(const clk_hw*)
    function bool clk_hw_is_enabled(const clk_hw*)
    function bool clk_hw_is_prepared(const clk_hw*)
    function unsigned long int clk_hw_round_rate(clk_hw*, unsigned long int)
    function int devm_clk_hw_register(device*, clk_hw*)
    function clk* devm_clk_register(device*, clk_hw*)
    function int devm_of_clk_add_hw_provider(device*, void ()*, void*)
    function unsigned long int divider_recalc_rate(clk_hw*, unsigned long int, unsigned int, const clk_div_table*, unsigned long int, unsigned long int)
    function long int divider_ro_round_rate_parent(clk_hw*, clk_hw*, unsigned long int, unsigned long int*, const clk_div_table*, u8, unsigned long int, unsigned int)
    function long int divider_round_rate_parent(clk_hw*, clk_hw*, unsigned long int, unsigned long int*, const clk_div_table*, u8, unsigned long int)

'struct edac_device_ctl_info at edac_device.h:151:1' changed:
  type size changed from 3008 to 3072 (in bits)
  2 data member insertions:
    'int edac_device_ctl_info::panic_on_ce', at offset 288 (in bits) at edac_device.h:162:1
    'bool edac_device_ctl_info::defer_work', at offset 448 (in bits) at edac_device.h:166:1
  there are data member changes:
    'int edac_device_ctl_info::panic_on_ue' offset changed from 288 to 320 (in bits) (by +32 bits)
    'unsigned int edac_device_ctl_info::poll_msec' offset changed from 320 to 352 (in bits) (by +32 bits)
    'edac_dev_sysfs_attribute* edac_device_ctl_info::sysfs_attributes' offset changed from 448 to 512 (in bits) (by +64 bits)
    'bus_type* edac_device_ctl_info::edac_subsys' offset changed from 512 to 576 (in bits) (by +64 bits)
    'int edac_device_ctl_info::op_state' offset changed from 576 to 640 (in bits) (by +64 bits)
    'delayed_work edac_device_ctl_info::work' offset changed from 640 to 704 (in bits) (by +64 bits)
    'void ()* edac_device_ctl_info::edac_check' offset changed from 1344 to 1408 (in bits) (by +64 bits)
    'device* edac_device_ctl_info::dev' offset changed from 1408 to 1472 (in bits) (by +64 bits)
    'const char* edac_device_ctl_info::mod_name' offset changed from 1472 to 1536 (in bits) (by +64 bits)
    'const char* edac_device_ctl_info::ctl_name' offset changed from 1536 to 1600 (in bits) (by +64 bits)
    'const char* edac_device_ctl_info::dev_name' offset changed from 1600 to 1664 (in bits) (by +64 bits)
    'void* edac_device_ctl_info::pvt_info' offset changed from 1664 to 1728 (in bits) (by +64 bits)
    'unsigned long int edac_device_ctl_info::start_time' offset changed from 1728 to 1792 (in bits) (by +64 bits)
    'completion edac_device_ctl_info::removal_complete' offset changed from 1792 to 1856 (in bits) (by +64 bits)
    'char edac_device_ctl_info::name[32]' offset changed from 2048 to 2112 (in bits) (by +64 bits)
    'u32 edac_device_ctl_info::nr_instances' offset changed from 2304 to 2368 (in bits) (by +64 bits)
    'edac_device_instance* edac_device_ctl_info::instances' offset changed from 2368 to 2432 (in bits) (by +64 bits)
    'edac_device_counter edac_device_ctl_info::counters' offset changed from 2432 to 2496 (in bits) (by +64 bits)
    'kobject edac_device_ctl_info::kobj' offset changed from 2496 to 2560 (in bits) (by +64 bits)
  6 impacted interfaces:
    function int edac_device_add_device(edac_device_ctl_info*)
    function edac_device_ctl_info* edac_device_alloc_ctl_info(unsigned int, char*, unsigned int, char*, unsigned int, unsigned int, edac_dev_sysfs_block_attribute*, unsigned int, int)
    function edac_device_ctl_info* edac_device_del_device(device*)
    function void edac_device_free_ctl_info(edac_device_ctl_info*)
    function void edac_device_handle_ce(edac_device_ctl_info*, int, int, const char*)
    function void edac_device_handle_ue(edac_device_ctl_info*, int, int, const char*)

'struct fb_info at fb.h:464:1' changed:
  type size changed from 6912 to 6144 (in bits)
  2 data member deletions:
    'delayed_work fb_info::deferred_work', at offset 5376 (in bits) at fb.h:496:1
    'fb_deferred_io* fb_info::fbdefio', at offset 6080 (in bits) at fb.h:497:1
  there are data member changes:
    'fb_ops* fb_info::fbops' offset changed from 6144 to 5376 (in bits) (by -768 bits)
    'device* fb_info::device' offset changed from 6208 to 5440 (in bits) (by -768 bits)
    'device* fb_info::dev' offset changed from 6272 to 5504 (in bits) (by -768 bits)
    'int fb_info::class_flag' offset changed from 6336 to 5568 (in bits) (by -768 bits)
    offset changed from 6400 to 5632 (in bits) (by -768 bits)
    'unsigned long int fb_info::screen_size' offset changed from 6464 to 5696 (in bits) (by -768 bits)
    'void* fb_info::pseudo_palette' offset changed from 6528 to 5760 (in bits) (by -768 bits)
    'u32 fb_info::state' offset changed from 6592 to 5824 (in bits) (by -768 bits)
    'void* fb_info::fbcon_par' offset changed from 6656 to 5888 (in bits) (by -768 bits)
    'void* fb_info::par' offset changed from 6720 to 5952 (in bits) (by -768 bits)
    'apertures_struct* fb_info::apertures' offset changed from 6784 to 6016 (in bits) (by -768 bits)
    'bool fb_info::skip_vt_switch' offset changed from 6848 to 6080 (in bits) (by -768 bits)
  97 impacted interfaces:
    function backlight_device* devm_backlight_device_register(device*, const char*, device*, void*, const backlight_ops*, const backlight_properties*)
    function int drm_atomic_helper_check(drm_device*, drm_atomic_state*)
    function void drm_atomic_helper_cleanup_planes(drm_device*, drm_atomic_state*)
    function int drm_atomic_helper_commit(drm_device*, drm_atomic_state*, bool)
    function void drm_atomic_helper_commit_modeset_disables(drm_device*, drm_atomic_state*)
    function void drm_atomic_helper_commit_modeset_enables(drm_device*, drm_atomic_state*)
    function void drm_atomic_helper_commit_planes(drm_device*, drm_atomic_state*, unsigned int)
    function drm_atomic_state* drm_atomic_helper_duplicate_state(drm_device*, drm_modeset_acquire_ctx*)
    function int drm_atomic_helper_prepare_planes(drm_device*, drm_atomic_state*)
    function void drm_atomic_helper_shutdown(drm_device*)
    function void drm_atomic_helper_update_legacy_modeset_state(drm_device*, drm_atomic_state*)
    function int drm_atomic_helper_wait_for_fences(drm_device*, drm_atomic_state*, bool)
    function void drm_atomic_helper_wait_for_vblanks(drm_device*, drm_atomic_state*)
    function drm_atomic_state* drm_atomic_state_alloc(drm_device*)
    function int drm_atomic_state_init(drm_device*, drm_atomic_state*)
    function int drm_connector_init(drm_device*, drm_connector*, const drm_connector_funcs*, int)
    function void drm_connector_list_iter_begin(drm_device*, drm_connector_list_iter*)
    function void drm_connector_list_iter_end(drm_connector_list_iter*)
    function drm_connector* drm_connector_list_iter_next(drm_connector_list_iter*)
    function int drm_crtc_init_with_planes(drm_device*, drm_crtc*, drm_plane*, drm_plane*, const drm_crtc_funcs*, const char*, ...)
    function drm_display_mode* drm_cvt_mode(drm_device*, int, int, int, bool, bool, bool)
    function drm_device* drm_dev_alloc(drm_driver*, device*)
    function void drm_dev_put(drm_device*)
    function int drm_dev_register(drm_device*, unsigned long int)
    function int drm_dev_set_unique(drm_device*, const char*)
    function void drm_dev_unregister(drm_device*)
    function int drm_dp_atomic_find_vcpi_slots(drm_atomic_state*, drm_dp_mst_topology_mgr*, drm_dp_mst_port*, int)
    function int drm_dp_atomic_release_vcpi_slots(drm_atomic_state*, drm_dp_mst_topology_mgr*, int)
    function int drm_dp_check_act_status(drm_dp_mst_topology_mgr*)
    function int drm_dp_find_vcpi_slots(drm_dp_mst_topology_mgr*, int)
    function bool drm_dp_mst_allocate_vcpi(drm_dp_mst_topology_mgr*, drm_dp_mst_port*, int, int)
    function void drm_dp_mst_deallocate_vcpi(drm_dp_mst_topology_mgr*, drm_dp_mst_port*)
    function drm_connector_status drm_dp_mst_detect_port(drm_connector*, drm_dp_mst_topology_mgr*, drm_dp_mst_port*)
    function edid* drm_dp_mst_get_edid(drm_connector*, drm_dp_mst_topology_mgr*, drm_dp_mst_port*)
    function int drm_dp_mst_hpd_irq(drm_dp_mst_topology_mgr*, u8*, bool*)
    function void drm_dp_mst_reset_vcpi_slots(drm_dp_mst_topology_mgr*, drm_dp_mst_port*)
    function void drm_dp_mst_topology_mgr_destroy(drm_dp_mst_topology_mgr*)
    function int drm_dp_mst_topology_mgr_init(drm_dp_mst_topology_mgr*, drm_device*, drm_dp_aux*, int, int, int)
    function int drm_dp_mst_topology_mgr_set_mst(drm_dp_mst_topology_mgr*, bool)
    function int drm_dp_send_power_updown_phy(drm_dp_mst_topology_mgr*, drm_dp_mst_port*, bool)
    function int drm_dp_update_payload_part1(drm_dp_mst_topology_mgr*)
    function int drm_dp_update_payload_part2(drm_dp_mst_topology_mgr*)
    function int drm_encoder_init(drm_device*, drm_encoder*, const drm_encoder_funcs*, int, const char*, ...)
    function int drm_event_reserve_init_locked(drm_device*, drm_file*, drm_pending_event*, drm_event*)
    function int drm_framebuffer_init(drm_device*, drm_framebuffer*, const drm_framebuffer_funcs*)
    function drm_framebuffer* drm_framebuffer_lookup(drm_device*, drm_file*, unsigned int)
    function int drm_gem_create_mmap_offset(drm_gem_object*)
    function drm_gem_object* drm_gem_fb_get_obj(drm_framebuffer*, unsigned int)
    function void drm_gem_free_mmap_offset(drm_gem_object*)
    function page** drm_gem_get_pages(drm_gem_object*)
    function int drm_gem_handle_create(drm_file*, drm_gem_object*, unsigned int*)
    function int drm_gem_mmap_obj(drm_gem_object*, unsigned long int, vm_area_struct*)
    function int drm_gem_object_init(drm_device*, drm_gem_object*, size_t)
    function drm_gem_object* drm_gem_object_lookup(drm_file*, unsigned int)
    function void drm_gem_object_put(drm_gem_object*)
    function void drm_gem_object_put_unlocked(drm_gem_object*)
    function void drm_gem_object_release(drm_gem_object*)
    function dma_buf* drm_gem_prime_export(drm_device*, drm_gem_object*, int)
    function int drm_gem_prime_fd_to_handle(drm_device*, drm_file*, int, uint32_t*)
    function int drm_gem_prime_handle_to_fd(drm_device*, drm_file*, uint32_t, uint32_t, int*)
    function drm_gem_object* drm_gem_prime_import(drm_device*, dma_buf*)
    function int drm_gem_prime_mmap(drm_gem_object*, vm_area_struct*)
    function void drm_gem_private_object_init(drm_device*, drm_gem_object*, unsigned long int)
    function void drm_gem_put_pages(drm_gem_object*, page**, bool, bool)
    function bool drm_helper_hpd_irq_event(drm_device*)
    function void drm_helper_mode_fill_fb_struct(drm_device*, drm_framebuffer*, const drm_mode_fb_cmd2*)
    function int drm_irq_install(drm_device*, int)
    function int drm_irq_uninstall(drm_device*)
    function void drm_kms_helper_hotplug_event(drm_device*)
    function void drm_kms_helper_poll_disable(drm_device*)
    function void drm_kms_helper_poll_enable(drm_device*)
    function void drm_kms_helper_poll_fini(drm_device*)
    function void drm_kms_helper_poll_init(drm_device*)
    function void drm_mode_config_cleanup(drm_device*)
    function void drm_mode_config_init(drm_device*)
    function void drm_mode_config_reset(drm_device*)
    function int drm_mode_convert_umode(drm_device*, drm_display_mode*, const drm_mode_modeinfo*)
    function drm_display_mode* drm_mode_create(drm_device*)
    function drm_display_mode* drm_mode_duplicate(drm_device*, const drm_display_mode*)
    function drm_mode_object* drm_mode_object_find(drm_device*, drm_file*, unsigned int, unsigned int)
    function void drm_modeset_lock_all(drm_device*)
    function int drm_modeset_lock_all_ctx(drm_device*, drm_modeset_acquire_ctx*)
    function void drm_modeset_unlock_all(drm_device*)
    function void drm_object_attach_property(drm_mode_object*, drm_property*, long long unsigned int)
    function int drm_object_property_set_value(drm_mode_object*, drm_property*, long long unsigned int)
    function void drm_prime_gem_destroy(drm_gem_object*, sg_table*)
    function drm_property* drm_property_create(drm_device*, unsigned int, const char*, int)
    function drm_property* drm_property_create_bitmask(drm_device*, unsigned int, const char*, const drm_prop_enum_list*, int, long long unsigned int)
    function drm_property_blob* drm_property_create_blob(drm_device*, unsigned long int, void*)
    function drm_property* drm_property_create_enum(drm_device*, unsigned int, const char*, const drm_prop_enum_list*, int)
    function drm_property* drm_property_create_range(drm_device*, unsigned int, const char*, long long unsigned int, long long unsigned int)
    function drm_property_blob* drm_property_lookup_blob(drm_device*, unsigned int)
    function void drm_put_dev(drm_device*)
    function void drm_send_event_locked(drm_device*, drm_pending_event*)
    function int drm_universal_plane_init(drm_device*, drm_plane*, unsigned int, const drm_plane_funcs*, const unsigned int*, unsigned int, const long long unsigned int*, drm_plane_type, const char*, ...)
    function int drm_vblank_init(drm_device*, unsigned int)
    function void drm_wait_one_vblank(drm_device*, unsigned int)

'struct pwm_device at pwm.h:76:1' changed:
  type size changed from 512 to 640 (in bits)
  there are data member changes:
    type 'struct pwm_state' of 'pwm_device::state' changed:
      type size changed from 128 to 256 (in bits)
      2 data member insertions:
        'pwm_output_type pwm_state::output_type', at offset 96 (in bits) at pwm.h:85:1
        'pwm_output_pattern* pwm_state::output_pattern', at offset 128 (in bits) at pwm.h:86:1
      there are data member changes:
        'bool pwm_state::enabled' offset changed from 96 to 192 (in bits) (by +96 bits)
      4 impacted interfaces:
        function pwm_device* devm_of_pwm_get(device*, device_node*, const char*)
        function void devm_pwm_put(device*, pwm_device*)
        function int pwmchip_add(pwm_chip*)
        function int pwmchip_remove(pwm_chip*)
    and size changed from 128 to 256 (in bits) (by +128 bits)
  4 impacted interfaces:
    function pwm_device* devm_of_pwm_get(device*, device_node*, const char*)
    function void devm_pwm_put(device*, pwm_device*)
    function int pwmchip_add(pwm_chip*)
    function int pwmchip_remove(pwm_chip*)

'struct pwm_ops at pwm.h:260:1' changed:
  type size changed from 640 to 832 (in bits)
  3 data member insertions:
    'void ()* pwm_ops::get_output_type_supported', at offset 448 (in bits) at pwm.h:319:1
    'void ()* pwm_ops::set_output_type', at offset 512 (in bits) at pwm.h:321:1
    'void ()* pwm_ops::set_output_pattern', at offset 576 (in bits) at pwm.h:323:1
  there are data member changes:
    'void ()* pwm_ops::apply' offset changed from 448 to 640 (in bits) (by +192 bits)
    'void ()* pwm_ops::get_state' offset changed from 512 to 704 (in bits) (by +192 bits)
    'module* pwm_ops::owner' offset changed from 576 to 768 (in bits) (by +192 bits)
  4 impacted interfaces:
    function pwm_device* devm_of_pwm_get(device*, device_node*, const char*)
    function void devm_pwm_put(device*, pwm_device*)
    function int pwmchip_add(pwm_chip*)
    function int pwmchip_remove(pwm_chip*)

'struct pwm_state at pwm.h:58:1' changed:
  details were reported earlier

'struct regulator_dev at driver.h:438:1' changed:
  type size changed from 9280 to 9344 (in bits)
  1 data member insertion:
    'proxy_consumer* regulator_dev::proxy_consumer', at offset 9280 (in bits) at driver.h:479:1
  29 impacted interfaces:
    function int devm_regulator_bulk_get(device*, int, regulator_bulk_data*)
    function regulator* devm_regulator_get(device*, const char*)
    function regulator* devm_regulator_get_optional(device*, const char*)
    function void devm_regulator_put(regulator*)
    function regulator_dev* devm_regulator_register(device*, const regulator_desc*, const regulator_config*)
    function regulator_init_data* of_get_regulator_init_data(device*, device_node*, const regulator_desc*)
    function void* rdev_get_drvdata(regulator_dev*)
    function int rdev_get_id(regulator_dev*)
    function int regulator_bulk_disable(int, regulator_bulk_data*)
    function int regulator_bulk_enable(int, regulator_bulk_data*)
    function int regulator_count_voltages(regulator*)
    function int regulator_disable_deferred(regulator*, int)
    function int regulator_disable_regmap(regulator_dev*)
    function int regulator_enable_regmap(regulator_dev*)
    function regulator* regulator_get(device*, const char*)
    function void* regulator_get_drvdata(regulator*)
    function unsigned int regulator_get_mode(regulator*)
    function int regulator_get_voltage_sel_regmap(regulator_dev*)
    function int regulator_is_enabled(regulator*)
    function int regulator_is_enabled_regmap(regulator_dev*)
    function int regulator_list_voltage_linear(regulator_dev*, unsigned int)
    function int regulator_map_voltage_linear(regulator_dev*, int, int)
    function int regulator_notifier_call_chain(regulator_dev*, unsigned long int, void*)
    function int regulator_register_notifier(regulator*, notifier_block*)
    function int regulator_set_current_limit(regulator*, int, int)
    function int regulator_set_load(regulator*, int)
    function int regulator_set_mode(regulator*, unsigned int)
    function int regulator_set_voltage_sel_regmap(regulator_dev*, unsigned int)
    function int regulator_unregister_notifier(regulator*, notifier_block*)

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I926c10dae8e7acce013c94d4713084de638d64bf
2020-04-03 10:40:08 +02:00
Greg Kroah-Hartman
6ca29140d7 Merge 4.19.114 into android-4.19
Changes in 4.19.114
	mmc: core: Allow host controllers to require R1B for CMD6
	mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard
	mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command
	mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY
	mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY
	Revert "drm/dp_mst: Skip validating ports during destruction, just ref"
	geneve: move debug check after netdev unregister
	hsr: fix general protection fault in hsr_addr_is_self()
	macsec: restrict to ethernet devices
	mlxsw: spectrum_mr: Fix list iteration in error path
	net: cbs: Fix software cbs to consider packet sending time
	net: dsa: Fix duplicate frames flooded by learning
	net: mvneta: Fix the case where the last poll did not process all rx
	net/packet: tpacket_rcv: avoid a producer race condition
	net: qmi_wwan: add support for ASKEY WWHC050
	net_sched: cls_route: remove the right filter from hashtable
	net_sched: keep alloc_hash updated after hash allocation
	net: stmmac: dwmac-rk: fix error path in rk_gmac_probe
	NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()
	slcan: not call free_netdev before rtnl_unlock in slcan_open
	bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets()
	bnxt_en: Reset rings if ring reservation fails during open()
	net: ip_gre: Separate ERSPAN newlink / changelink callbacks
	net: ip_gre: Accept IFLA_INFO_DATA-less configuration
	net: dsa: mt7530: Change the LINK bit to reflect the link status
	net: phy: mdio-mux-bcm-iproc: check clk_prepare_enable() return value
	r8169: re-enable MSI on RTL8168c
	tcp: repair: fix TCP_QUEUE_SEQ implementation
	vxlan: check return value of gro_cells_init()
	hsr: use rcu_read_lock() in hsr_get_node_{list/status}()
	hsr: add restart routine into hsr_get_node_list()
	hsr: set .netnsok flag
	cgroup-v1: cgroup_pidlist_next should update position index
	nfs: add minor version to nfs_server_key for fscache
	cpupower: avoid multiple definition with gcc -fno-common
	drivers/of/of_mdio.c:fix of_mdiobus_register()
	cgroup1: don't call release_agent when it is ""
	dt-bindings: net: FMan erratum A050385
	arm64: dts: ls1043a: FMan erratum A050385
	fsl/fman: detect FMan erratum A050385
	s390/qeth: handle error when backing RX buffer
	scsi: ipr: Fix softlockup when rescanning devices in petitboot
	mac80211: Do not send mesh HWMP PREQ if HWMP is disabled
	dpaa_eth: Remove unnecessary boolean expression in dpaa_get_headroom
	sxgbe: Fix off by one in samsung driver strncpy size arg
	ftrace/x86: Anotate text_mutex split between ftrace_arch_code_modify_post_process() and ftrace_arch_code_modify_prepare()
	i2c: hix5hd2: add missed clk_disable_unprepare in remove
	Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger()
	Input: synaptics - enable RMI on HP Envy 13-ad105ng
	Input: avoid BIT() macro usage in the serio.h UAPI header
	ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL
	ARM: dts: dra7: Add bus_dma_limit for L3 bus
	ARM: dts: omap5: Add bus_dma_limit for L3 bus
	perf probe: Do not depend on dwfl_module_addrsym()
	tools: Let O= makes handle a relative path with -C option
	scripts/dtc: Remove redundant YYLOC global declaration
	scsi: sd: Fix optimal I/O size for devices that change reported values
	nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type
	mac80211: mark station unauthorized before key removal
	gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk
	gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option
	gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model
	RDMA/core: Ensure security pkey modify is not lost
	genirq: Fix reference leaks on irq affinity notifiers
	xfrm: handle NETDEV_UNREGISTER for xfrm device
	vti[6]: fix packet tx through bpf_redirect() in XinY cases
	RDMA/mlx5: Block delay drop to unprivileged users
	xfrm: fix uctx len check in verify_sec_ctx_len
	xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
	xfrm: policy: Fix doulbe free in xfrm_policy_timer
	afs: Fix some tracing details
	netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}
	netfilter: nft_fwd_netdev: validate family and chain type
	bpf/btf: Fix BTF verification of enum members in struct/union
	vti6: Fix memory leak of skb if input policy check fails
	Revert "r8169: check that Realtek PHY driver module is loaded"
	mac80211: add option for setting control flags
	mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX
	USB: serial: option: add support for ASKEY WWHC050
	USB: serial: option: add BroadMobi BM806U
	USB: serial: option: add Wistron Neweb D19Q1
	USB: cdc-acm: restore capability check order
	USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
	usb: musb: fix crash with highmen PIO and usbmon
	media: flexcop-usb: fix endpoint sanity check
	media: usbtv: fix control-message timeouts
	staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
	staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
	staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
	ahci: Add Intel Comet Lake H RAID PCI ID
	libfs: fix infoleak in simple_attr_read()
	media: ov519: add missing endpoint sanity checks
	media: dib0700: fix rc endpoint lookup
	media: stv06xx: add missing descriptor sanity checks
	media: xirlink_cit: add missing descriptor sanity checks
	mac80211: Check port authorization in the ieee80211_tx_dequeue() case
	mac80211: fix authentication with iwlwifi/mvm
	vt: selection, introduce vc_is_sel
	vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines
	vt: switch vt_dont_switch to bool
	vt: vt_ioctl: remove unnecessary console allocation checks
	vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
	vt: vt_ioctl: fix use-after-free in vt_in_use()
	platform/x86: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table
	bpf: Explicitly memset the bpf_attr structure
	bpf: Explicitly memset some bpf info structures declared on the stack
	gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model
	net: ks8851-ml: Fix IO operations, again
	arm64: alternative: fix build with clang integrated assembler
	perf map: Fix off by one in strncpy() size argument
	ARM: dts: oxnas: Fix clear-mask property
	ARM: bcm2835-rpi-zero-w: Add missing pinctrl name
	ARM: dts: imx6: phycore-som: fix arm and soc minimum voltage
	ARM: dts: N900: fix onenand timings
	arm64: dts: ls1043a-rdb: correct RGMII delay mode to rgmii-id
	arm64: dts: ls1046ardb: set RGMII interfaces to RGMII_ID mode
	Linux 4.19.114

Change-Id: Icc165d2e49aba750e1b5a8856d9774c149e59ce7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-04-03 08:17:23 +02:00
Saravana Kannan
2071154513 ANDROID: GKI: clk: Initialize in stack clk_init_data to 0 in all drivers
This allows adding fields to clk_init_data without having to explicitly
set those fields in all the drivers.

Bug: 150506629
Signed-off-by: Saravana Kannan <saravanak@google.com>
Change-Id: I0ff4e5108541b9f6e3e3e3f984a277b6954a629c
2020-04-02 18:04:21 -07:00
Channagoud Kadabi
1f01baa02c ANDROID: GKI: drivers: clksource: Add API to return cval
Sleep driver needs to program the absolute clock value for next expiry
into pdc register for system wake up. Add an API to read the cval low
and high counters.

Signed-off-by: Channagoud Kadabi <ckadabi@codeaurora.org>
Bug: 152635062
Test: build
(cherry picked from commit ee514e9083c5d9f3312a54fd317786da7c9abdb1)
[surenb: replaced out-of-tree readl_relaxed_no_log with functionally
identical in-tree readl_relaxed]
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I1244c31c8a2717a6f2002cac3b26ee3526409058
Merged-In: I1244c31c8a2717a6f2002cac3b26ee3526409058
2020-04-02 23:32:47 +00:00
Saravana Kannan
3179a1a38d ANDROID: GKI: clk: Add support for voltage voting
This change adds support for voltage voting in the clock framework. This
will NOT be carried over to newer kernels.

Bug: 150506629
Signed-off-by: David Collins <collinsd@codeaurora.org>
Signed-off-by: David Dai <daidavid1@codeaurora.org>
Signed-off-by: Deepak Katragadda <dkatraga@codeaurora.org>
Signed-off-by: Shefali Jain <shefjain@codeaurora.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Taniya Das <tdas@codeaurora.org>
[saravanak: Squashed the following commits and dropped some debug code
	    and code whose functionality that's replaced by clk_sync_state()
	ff5ce501ba80 clk: do not vote for vdd_class level with 0 Hz rate_max
	96f0596cc03a clk: provider: cleanup of unused use_max_uV
	83d12e55ba9d clk: Always vote INT_MAX as maximum voltage for a rail
	352850e65775 clk: handle reentrant clk_set_rate() calls from clock supply regulators
	0d8060cd6b63 clk: add bus voting to rate_get, rate_set, enable_set debug functions
	d4c36a3d1038 clk: remove prepare lock and bus voting in clk_debug_print_hw
	813f66628115 clk: add bus voting ops for debug purposes
	7e0561072d82 clk: qcom: Fix return value check for round rate during clock registration
	c4540b8ee30c clk: fix conflicting bit for measure clock flag
	fa9b30447f77 clk: correct vdd_class voting scheme used during clock rate changes
	61dad2894f52 clk: Move VDD voltage voting from core clock to top clock
	0cbef8b6fc58 clk: qcom: Add support to log PLL/RCGR values in case of failure
	bcc43f7a193b clk: qcom: Add support for debugfs measure clock
	1ac9516f7402 clk: Export the clock driver's voltage voting APIs
	c4316254d2f9 clk: add/modify debugfs support for clocks
	d30b895f2155 clk: move check for CLK_ENABLE_HAND_OFF at unused tree
	11032174cac0 clk: Add support to provide OPP tables for clocks
	f349485712d2 clk: Add support to vote to regulator framework from clk framework
	81286aed669c clk: Check for failure at clk_change_rate
	6a4951a8308c clk: qcom: clk-voter: Add support for voter clocks
	b904878a04fb clk: Add support to set custom flags with clk_set_flags ]
Signed-off-by: Saravana Kannan <saravanak@google.com>
Change-Id: I95574f11053e8f3762c8d660183ce5004ff5cc5b
2020-04-02 16:27:12 -07:00
Saravana Kannan
1d887ea976 ANDROID: GKI: kernel: Export task and IRQ affinity symbols
A module uses these symbols. So, export them to allow loading of that
module.

Bug: 149816871
Bug: 149256712
Signed-off-by: Saravana Kannan <saravanak@google.com>
Change-Id: I949da5d091894ea3d79a6c9244bfc2f8426eee71
(cherry picked from commit dc928ba3bdfb4527e0ffca7c491d946a02e5bd11)
[ qperret: made changes to commit message for AOSP compliance ]
Signed-off-by: Quentin Perret <qperret@google.com>
2020-04-02 16:27:12 -07:00
Saravana Kannan
95b8a4b5b1 ANDROID: GKI: regulator: core: Add support for regulator providers with sync state
Regulator providers whose drivers have sync_state() implemented will
disable their regulators once all their consumers have probed. So during
late_initcall_sync(), don't disable unused regulators of these regulator
providers.

Also, provide a regulator_sync_state() API that regulator providers can
use to disable all their unused regulators once the get their
sync_state() callback.

Bug: 144127090
Bug: 150508586
Signed-off-by: Saravana Kannan <saravanak@google.com>
Change-Id: I5cc32730214c8e769c2a55cbe3b702cf6bb9016a
2020-04-02 16:27:12 -07:00
David Collins
4bad67ba2a ANDROID: GKI: regulator: Call proxy-consumer functions for each regulator registered
Add a call to regulator_proxy_consumer_register() at the end of
regulator_register() and a call to
regulator_proxy_consumer_unregister() at the beginning of
regulator_unregister().  These calls ensure that proxy consumer
features may be used by any type of regulator regardless of the
driver supporting it.

Bug: 150508586
Change-Id: Ia70da1df47042fa673c42f389136557f868d19a3
Signed-off-by: David Collins <collinsd@codeaurora.org>
(cherry picked from commit ff753edc6d60e1e1043931409e6d3ac6e01b8108)
[Fixed minor conflicts from dropping an earlier debugfs patch]
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-04-02 16:27:12 -07:00
David Collins
653a867e09 ANDROID: GKI: regulator: Add proxy consumer driver
Add a proxy consumer driver which can be used to ensure that a
given regulator maintains a certain minimum state during bootup.
Enable state, voltage, and current may be forced to specified
levels.

Bug: 150508586
Change-Id: I0ccc63a41684462684ac737fb2f4129a3e6e4aea
Signed-off-by: David Collins <collinsd@codeaurora.org>
(cherry picked from commit cf03466c074e912a8aa3e079e1b7ea1cc17b18ba)
[Also squashed e9a05bb4d3f0 "spdx: Modify spdx tag from GPL-2.0 to GPL-2.0-only"]
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-04-02 16:27:12 -07:00
David Collins
b4270a93c7 ANDROID: GKI: regulator: core: allow long device tree supply regulator property names
The length 32 buffer in of_get_regulator() limits the maximum
possible supply name to 24 characters (32 - 1 [null terminator]
- 7 [strlen("-supply")]).  This causes problems for device
nodes with longer supply property names.

Increase the size of the buffer to remove this artificial
restriction.

Bug: 150508586
Change-Id: Ic28ee290dcd7411ba8325a2b42c12173958a11d8
Signed-off-by: David Collins <collinsd@codeaurora.org>
(cherry picked from commit f6d207a3235617a4acffb246f3817c32bd30ee39)
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-04-02 16:27:12 -07:00
David Collins
fbb4d2d856 ANDROID: GKI: Revert "regulator: Enable supply regulator if child rail is enabled."
This reverts commit b2296bd43e ("regulator: Enable supply
regulator if child rail is enabled.").

The change results in the following incorrect behavior.
If a given regulator has a parent supply and the regulator is
enabled either before or during regulator_register(), then
regulator_enable() is called on the supply.  Unfortunately, there
is no matching regulator_disable() call.  This means that the
parent supply will stay enabled forever even if the child is
disabled later.

The stated goal of the change was to enable the parent of a
regulator which was enabled based on its machine constraints.
However, the only constraints that leads to enable() being called
for a regulator are boot-on or always-on.  If these have been
specified for a child regulator then they should have also been
specified for its parent regulator.  Therefore, there should be
no need to explicitly enable the parent when the child is
registered.

Bug: 150508586
Change-Id: Ib8e6db65dcd44c27ef99509ff0cfd2f8e16e9f65
Signed-off-by: David Collins <collinsd@codeaurora.org>
(cherry picked from commit 7a88f5efeab2059093e2398d57d6cd36220b6bc5)
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-04-02 16:27:11 -07:00
David Collins
59e9e8c8fd ANDROID: GKI: regulator: Remove redundant set_mode call in drms_uA_update
The regulator framework checks if the current mode is the same as the
one being requested inside of regulator_set_mode. However, when
DRMS changing is allowed, regulator_enable calls drms_uA_update.
This function does not check the value of get_mode before calling
set_mode.

Modify drms_uA_update so that set_mode is only called if the requested
mode is different from the current mode returned by get_mode.

Bug: 150508586
Change-Id: Ifb4f3069cf946e8474565ee82508c1ff45b36543
Signed-off-by: David Collins <collinsd@codeaurora.org>
(cherry picked from commit 4c40b0f70455f6207c0c26994a50a640160d2a69)
Signed-off-by: Saravana Kannan <saravanak@google.com>
2020-04-02 16:27:11 -07:00
Subash Abhinov Kasiviswanathan
8ba14953de ANDROID: GKI: net: Add the get current NAPI context API
Commit 69235aa80090 ("net: Remove the get current NAPI context API")
removed the definition of get_current_napi_context() as rmnet_data
was no longer using it. However, the rmnet_data change to use its
NAPI in multiple contexts was prone to race in hotplug scenarios.

Add back get_current_napi_context() and current_napi to the
softnet_data struct.

Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
(cherry picked from commit 05b3252cf566eb04c7c5484c912ae6f8f9fb1dd5)
[surenb cherry-picked from
05b3252cf566 net: Add the get current NAPI context API
to fix ABI diffs caused by get_current_napi_context function]

Bug: 151108843
Test: build
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I4d5b81c734e4a5daa2fae3cb7d6538821d46ff64
Merged-In: I4d5b81c734e4a5daa2fae3cb7d6538821d46ff64
2020-04-02 23:22:33 +00:00
Suren Baghdasaryan
ac236165f2 ANDROID: GKI: remove DRM_KMS_CMA_HELPER from GKI configuration
DRM_KMS_CMA_HELPER config option select FB_DEFERRED_IO config which
in turn causes ABI differences inside struct fb_info. Remove this config
option since it's not required in 4.19 GKI.

Bug: 152530986
Test: build
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I0a569544aecff61805e7398fa81b1409fc50496b
Merged-In: I0a569544aecff61805e7398fa81b1409fc50496b
2020-04-02 23:21:45 +00:00
Suren Baghdasaryan
bc39cf0bc8 ANDROID: GKI: edac: Fix ABI diffs in edac_device_ctl_info struct
Add edac_device_ctl_info struct members causing ABI diffs. This
patch skips sysfs changes and ignores the deferrable flag from the
original patchset.

Bug: 152456530
Test: build and boot
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org>
[surenb: Squashed the following commits and kept only
edac_device_ctl_info struct changes:
	117ab600649a edac: Allow panic on correctable errors (CE).
        1b9a7044541d edac: Allow the option of creating a deferrable work for polling]
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: If301dd0134c819167c81004468082a68735d9bd7
Merged-In: If301dd0134c819167c81004468082a68735d9bd7
2020-04-02 23:21:22 +00:00
Fenglin Wu
0c0baede19 ANDROID: GKI: pwm: Add different PWM output types support
Normally, PWM channel has fixed output until software request to change
its settings. There are some PWM devices which their outputs could be
changed autonomously according to a predefined pattern programmed in
hardware. Add pwm_output_type enum type to identify these two different
PWM types and add relevant helper functions to set and get PWM output
types and pattern.

Signed-off-by: Fenglin Wu <fenglinw@codeaurora.org>
Bug: 152542675
Test: build and boot
(cherry picked from commit 9e880ec791d4b4ad9f9bc257d9e20c59c3c9d90f)
[surenb: removed sysfs changes and fixed checkpatch.pl error in
pwm_get_output_type_supported function from pwm.h]
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I4a457636547e3225d8f10cfb3237765f500d9cc7
Merged-In: I4a457636547e3225d8f10cfb3237765f500d9cc7
2020-04-02 23:19:22 +00:00
Srinivas Dasari
052c2f7381 UPSTREAM: cfg80211: Authentication offload to user space in AP mode
commit 40cbfa9021 ("cfg80211/nl80211: Optional authentication
offload to userspace")' introduced authentication offload to user
space by the host drivers in station mode. This commit extends
the same for the AP mode too.

Extend NL80211_ATTR_EXTERNAL_AUTH_SUPPORT to also claim the
support of external authentication from the user space in AP mode.
A new flag parameter is introduced in cfg80211_ap_settings to
intend the same while "start ap".

Host driver to use NL80211_CMD_FRAME interface to transmit and
receive the authentication frames to / from the user space.

Host driver to indicate the flag NL80211_RXMGMT_FLAG_EXTERNAL_AUTH
while sending the authentication frame to the user space. This
intends to the user space that the driver wishes it to process
the authentication frame for certain protocols, though it had
initially advertised the support for SME functionality.

User space shall accordingly do the authentication and indicate
its final status through the command NL80211_CMD_EXTERNAL_AUTH.
Allow the command even if userspace doesn't include the attribute
NL80211_ATTR_SSID for AP interface.

Host driver shall continue with the association sequence and
indicate the STA connection status through cfg80211_new_sta.

To facilitate the host drivers in AP mode for matching the pmkid
by the stations during the association, NL80211_CMD_EXTERNAL_AUTH
is also enhanced to include the pmkid to drivers after
the authentication.
This pmkid can also be used in the STA mode to include in the
association request.

Also modify nl80211_external_auth to not mandate SSID in AP mode.

Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
[remove useless nla_get_flag() usage]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit fe4943702c)
Bug: 153011874
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: Iecdd38a0b6fa7726938c905c4810b9879bc48530
2020-04-02 12:51:05 -07:00
Paul Lawrence
8794e1ed09 ANDROID: Incremental fs: Fix four resource bugs
Without these, you can't unmount a volume on which incfs was
mounted and the tests run.

Also incfs_tests would fail sporadically without the fix to
test_inode

Test: Run incfs_test and unmount underlying volume 1000 times
Bug: 152636070
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I88f11f5d4269c22d9073e5eb671d0c7cc4629f6c
(cherry picked from commit c062bc8e76)
2020-04-02 16:51:41 +00:00
Will McVicker
a2156f0878 ANDROID: Bulk update the ABI xml based on the referenced bugs.
Leaf changes summary: 27 artifacts changed (1 filtered out)
Changed leaf types summary: 27 (1 filtered out) leaf types changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

Signed-off-by: Will McVicker <willmcvicker@google.com>
Bug: 148872640
Bug: 151792119
Bug: 152659776
Bug: 152917514
Change-Id: I92e377327f32eab5f78058ef5c2c364ef903c881
2020-04-02 15:51:45 +00:00
Greg Kroah-Hartman
dda0e29203 Linux 4.19.114 2020-04-02 15:28:25 +02:00
Madalin Bucur
6ae3ac43ab arm64: dts: ls1046ardb: set RGMII interfaces to RGMII_ID mode
commit d79e9d7c1e upstream.

The correct setting for the RGMII ports on LS1046ARDB is to
enable delay on both Rx and Tx so the interface mode used must
be PHY_INTERFACE_MODE_RGMII_ID.

Since commit 1b3047b520 ("net: phy: realtek: add support for
configuring the RX delay on RTL8211F") the Realtek 8211F PHY driver
has control over the RGMII RX delay and it is disabling it for
RGMII_TXID. The LS1046ARDB uses two such PHYs in RGMII_ID mode but
in the device tree the mode was described as "rgmii".

Changing the phy-connection-type to "rgmii-id" to address the issue.

Fixes: 3fa395d2c4 ("arm64: dts: add LS1046A DPAA FMan nodes")
Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:25 +02:00
Madalin Bucur
66d4ef50b0 arm64: dts: ls1043a-rdb: correct RGMII delay mode to rgmii-id
commit 4022d808c4 upstream.

The correct setting for the RGMII ports on LS1043ARDB is to
enable delay on both Rx and Tx so the interface mode used must
be PHY_INTERFACE_MODE_RGMII_ID.

Since commit 1b3047b520 ("net: phy: realtek: add support for
configuring the RX delay on RTL8211F") the Realtek 8211F PHY driver
has control over the RGMII RX delay and it is disabling it for
RGMII_TXID. The LS1043ARDB uses two such PHYs in RGMII_ID mode but
in the device tree the mode was described as "rgmii_txid".
This issue was not apparent at the time as the PHY driver took the
same action for RGMII_TXID and RGMII_ID back then but it became
visible (RX no longer working) after the above patch.

Changing the phy-connection-type to "rgmii-id" to address the issue.

Fixes: bf02f2ffe5 ("arm64: dts: add LS1043A DPAA FMan support")
Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:24 +02:00
Arthur Demchenkov
31d2ac32ac ARM: dts: N900: fix onenand timings
commit 0c5220a3c1 upstream.

Commit a758f50f10 ("mtd: onenand: omap2: Configure driver from DT")
started using DT specified timings for GPMC, and as a result the
OneNAND stopped working on N900 as we had wrong values in the DT.
Fix by updating the values to bootloader timings that have been tested
to be working on Nokia N900 with OneNAND manufacturers: Samsung,
Numonyx.

Fixes: a758f50f10 ("mtd: onenand: omap2: Configure driver from DT")
Signed-off-by: Arthur Demchenkov <spinal.by@gmail.com>
Tested-by: Merlijn Wajer <merlijn@wizzup.org>
Reviewed-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:24 +02:00
Marco Felsch
5513fac57d ARM: dts: imx6: phycore-som: fix arm and soc minimum voltage
commit 636b45b8ef upstream.

The current set minimum voltage of 730000µV seems to be wrong. I don't
know the document which specifies that but the imx6qdl datasheets says
that the minimum voltage should be 0.925V for VDD_ARM (LDO bypassed,
lowest opp) and 1.15V for VDD_SOC (LDO bypassed, lowest opp).

Fixes: ddec5d1c00 ("ARM: dts: imx6: Add initial support for phyCORE-i.MX 6 SOM")
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:24 +02:00
Nick Hudson
baa4b61553 ARM: bcm2835-rpi-zero-w: Add missing pinctrl name
commit 6687c201fd upstream.

Define the sdhci pinctrl state as "default" so it gets applied
correctly and to match all other RPis.

Fixes: 2c7c040c73 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W")
Signed-off-by: Nick Hudson <skrll@netbsd.org>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:24 +02:00
Sungbo Eo
c99fc06b7a ARM: dts: oxnas: Fix clear-mask property
commit deeabb4c13 upstream.

Disable all rps-irq interrupts during driver initialization to prevent
an accidental interrupt on GIC.

Fixes: 84316f4ef1 ("ARM: boot: dts: Add Oxford Semiconductor OX810SE dtsi")
Fixes: 38d4a53733 ("ARM: dts: Add support for OX820 and Pogoplug V3")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:24 +02:00
disconnect3d
71fc11978c perf map: Fix off by one in strncpy() size argument
commit db2c549407 upstream.

This patch fixes an off-by-one error in strncpy size argument in
tools/perf/util/map.c. The issue is that in:

        strncmp(filename, "/system/lib/", 11)

the passed string literal: "/system/lib/" has 12 bytes (without the NULL
byte) and the passed size argument is 11. As a result, the logic won't
match the ending "/" byte and will pass filepaths that are stored in
other directories e.g. "/system/libmalicious/bin" or just
"/system/libmalicious".

This functionality seems to be present only on Android. I assume the
/system/ directory is only writable by the root user, so I don't think
this bug has much (or any) security impact.

Fixes: eca8183699 ("perf tools: Add automatic remapping of Android libraries")
Signed-off-by: disconnect3d <dominik.b.czarnota@gmail.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Changbin Du <changbin.du@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: John Keeping <john@metanate.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Michael Lentine <mlentine@google.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lore.kernel.org/lkml/20200309104855.3775-1-dominik.b.czarnota@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:24 +02:00
Ilie Halip
49275ad17f arm64: alternative: fix build with clang integrated assembler
commit 6f5459da2b upstream.

Building an arm64 defconfig with clang's integrated assembler, this error
occurs:
    <instantiation>:2:2: error: unrecognized instruction mnemonic
     _ASM_EXTABLE 9999b, 9f
     ^
    arch/arm64/mm/cache.S:50:1: note: while in macro instantiation
    user_alt 9f, "dc cvau, x4", "dc civac, x4", 0
    ^

While GNU as seems fine with case-sensitive macro instantiations, clang
doesn't, so use the actual macro name (_asm_extable) as in the rest of
the file.

Also checked that the generated assembly matches the GCC output.

Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Fixes: 290622efc7 ("arm64: fix "dc cvau" cache operation on errata-affected core")
Link: https://github.com/ClangBuiltLinux/linux/issues/924
Signed-off-by: Ilie Halip <ilie.halip@gmail.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:24 +02:00
Marek Vasut
9b3503810c net: ks8851-ml: Fix IO operations, again
commit 8262e6f9b1 upstream.

This patch reverts 5829210483 ("net: ks8851-ml: Fix 16-bit IO operation")
and edacb098ea ("net: ks8851-ml: Fix 16-bit data access"), because it
turns out these were only necessary due to buggy hardware. This patch adds
a check for such a buggy hardware to prevent any such mistakes again.

While working further on the KS8851 driver, it came to light that the
KS8851-16MLL is capable of switching bus endianness by a hardware strap,
EESK pin. If this strap is incorrect, the IO accesses require such endian
swapping as is being reverted by this patch. Such swapping also impacts
the performance significantly.

Hence, in addition to removing it, detect that the hardware is broken,
report to user, and fail to bind with such hardware.

Fixes: 5829210483 ("net: ks8851-ml: Fix 16-bit IO operation")
Fixes: edacb098ea ("net: ks8851-ml: Fix 16-bit data access")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: David S. Miller <davem@davemloft.net>
Cc: Lukas Wunner <lukas@wunner.de>
Cc: Petr Stetiar <ynezz@true.cz>
Cc: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Hans de Goede
e29629d201 gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model
commit 0c625ccfe6 upstream.

There are at least 3 models of the HP x2 10 models:

Bay Trail SoC + AXP288 PMIC
Cherry Trail SoC + AXP288 PMIC
Cherry Trail SoC + TI PMIC

Like on the other HP x2 10 models we need to ignore wakeup for ACPI GPIO
events on the external embedded-controller pin to avoid spurious wakeups
on the HP x2 10 CHT + AXP288 model too.

This commit adds an extra DMI based quirk for the HP x2 10 CHT + AXP288
model, ignoring wakeups for ACPI GPIO events on the EC interrupt pin
on this model. This fixes spurious wakeups from suspend on this model.

Fixes: aa23ca3d98 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism")
Reported-and-tested-by: Marc Lehmann <schmorp@schmorp.de>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20200302111225.6641-4-hdegoede@redhat.com
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Greg Kroah-Hartman
638d8c748e bpf: Explicitly memset some bpf info structures declared on the stack
commit 5c6f258879 upstream.

Trying to initialize a structure with "= {};" will not always clean out
all padding locations in a structure. So be explicit and call memset to
initialize everything for a number of bpf information structures that
are then copied from userspace, sometimes from smaller memory locations
than the size of the structure.

Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20200320162258.GA794295@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Greg Kroah-Hartman
aca6a9b098 bpf: Explicitly memset the bpf_attr structure
commit 8096f22942 upstream.

For the bpf syscall, we are relying on the compiler to properly zero out
the bpf_attr union that we copy userspace data into. Unfortunately that
doesn't always work properly, padding and other oddities might not be
correctly zeroed, and in some tests odd things have been found when the
stack is pre-initialized to other values.

Fix this by explicitly memsetting the structure to 0 before using it.

Reported-by: Maciej Żenczykowski <maze@google.com>
Reported-by: John Stultz <john.stultz@linaro.org>
Reported-by: Alexander Potapenko <glider@google.com>
Reported-by: Alistair Delva <adelva@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://android-review.googlesource.com/c/kernel/common/+/1235490
Link: https://lore.kernel.org/bpf/20200320094813.GA421650@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Georg Müller
b4026dacf4 platform/x86: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table
commit 95b31e3523 upstream.

The Lex 2I385SW board has two Intel I211 ethernet controllers. Without
this patch, only the first port is usable. The second port fails to
start with the following message:

    igb: probe of 0000:02:00.0 failed with error -2

Fixes: 648e921888 ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
Tested-by: Georg Müller <georgmueller@gmx.net>
Signed-off-by: Georg Müller <georgmueller@gmx.net>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Eric Biggers
2ff2b207f3 vt: vt_ioctl: fix use-after-free in vt_in_use()
commit 7cf64b18b0 upstream.

vt_in_use() dereferences console_driver->ttys[i] without proper locking.
This is broken because the tty can be closed and freed concurrently.

We could fix this by using 'READ_ONCE(console_driver->ttys[i]) != NULL'
and skipping the check of tty_struct::count.  But, looking at
console_driver->ttys[i] isn't really appropriate anyway because even if
it is NULL the tty can still be in the process of being closed.

Instead, fix it by making vt_in_use() require console_lock() and check
whether the vt is allocated and has port refcount > 1.  This works since
following the patch "vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use
virtual console" the port refcount is incremented while the vt is open.

Reproducer (very unreliable, but it worked for me after a few minutes):

	#include <fcntl.h>
	#include <linux/vt.h>

	int main()
	{
		int fd, nproc;
		struct vt_stat state;
		char ttyname[16];

		fd = open("/dev/tty10", O_RDONLY);
		for (nproc = 1; nproc < 8; nproc *= 2)
			fork();
		for (;;) {
			sprintf(ttyname, "/dev/tty%d", rand() % 8);
			close(open(ttyname, O_RDONLY));
			ioctl(fd, VT_GETSTATE, &state);
		}
	}

KASAN report:

	BUG: KASAN: use-after-free in vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline]
	BUG: KASAN: use-after-free in vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657
	Read of size 4 at addr ffff888065722468 by task syz-vt2/132

	CPU: 0 PID: 132 Comm: syz-vt2 Not tainted 5.6.0-rc5-00130-g089b6d3654916 #13
	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014
	Call Trace:
	 [...]
	 vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline]
	 vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657
	 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660
	 [...]

	Allocated by task 136:
	 [...]
	 kzalloc include/linux/slab.h:669 [inline]
	 alloc_tty_struct+0x96/0x8a0 drivers/tty/tty_io.c:2982
	 tty_init_dev+0x23/0x350 drivers/tty/tty_io.c:1334
	 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline]
	 tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035
	 [...]

	Freed by task 41:
	 [...]
	 kfree+0xbf/0x200 mm/slab.c:3757
	 free_tty_struct+0x8d/0xb0 drivers/tty/tty_io.c:177
	 release_one_tty+0x22d/0x2f0 drivers/tty/tty_io.c:1468
	 process_one_work+0x7f1/0x14b0 kernel/workqueue.c:2264
	 worker_thread+0x8b/0xc80 kernel/workqueue.c:2410
	 [...]

Fixes: 4001d7b7fc ("vt: push down the tty lock so we can see what is left to tackle")
Cc: <stable@vger.kernel.org> # v3.4+
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20200322034305.210082-3-ebiggers@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Eric Biggers
54584f7957 vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
commit ca4463bf84 upstream.

The VT_DISALLOCATE ioctl can free a virtual console while tty_release()
is still running, causing a use-after-free in con_shutdown().  This
occurs because VT_DISALLOCATE considers a virtual console's
'struct vc_data' to be unused as soon as the corresponding tty's
refcount hits 0.  But actually it may be still being closed.

Fix this by making vc_data be reference-counted via the embedded
'struct tty_port'.  A newly allocated virtual console has refcount 1.
Opening it for the first time increments the refcount to 2.  Closing it
for the last time decrements the refcount (in tty_operations::cleanup()
so that it happens late enough), as does VT_DISALLOCATE.

Reproducer:
	#include <fcntl.h>
	#include <linux/vt.h>
	#include <sys/ioctl.h>
	#include <unistd.h>

	int main()
	{
		if (fork()) {
			for (;;)
				close(open("/dev/tty5", O_RDWR));
		} else {
			int fd = open("/dev/tty10", O_RDWR);

			for (;;)
				ioctl(fd, VT_DISALLOCATE, 5);
		}
	}

KASAN report:
	BUG: KASAN: use-after-free in con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278
	Write of size 8 at addr ffff88806a4ec108 by task syz_vt/129

	CPU: 0 PID: 129 Comm: syz_vt Not tainted 5.6.0-rc2 #11
	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014
	Call Trace:
	 [...]
	 con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278
	 release_tty+0xa8/0x410 drivers/tty/tty_io.c:1514
	 tty_release_struct+0x34/0x50 drivers/tty/tty_io.c:1629
	 tty_release+0x984/0xed0 drivers/tty/tty_io.c:1789
	 [...]

	Allocated by task 129:
	 [...]
	 kzalloc include/linux/slab.h:669 [inline]
	 vc_allocate drivers/tty/vt/vt.c:1085 [inline]
	 vc_allocate+0x1ac/0x680 drivers/tty/vt/vt.c:1066
	 con_install+0x4d/0x3f0 drivers/tty/vt/vt.c:3229
	 tty_driver_install_tty drivers/tty/tty_io.c:1228 [inline]
	 tty_init_dev+0x94/0x350 drivers/tty/tty_io.c:1341
	 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline]
	 tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035
	 [...]

	Freed by task 130:
	 [...]
	 kfree+0xbf/0x1e0 mm/slab.c:3757
	 vt_disallocate drivers/tty/vt/vt_ioctl.c:300 [inline]
	 vt_ioctl+0x16dc/0x1e30 drivers/tty/vt/vt_ioctl.c:818
	 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660
	 [...]

Fixes: 4001d7b7fc ("vt: push down the tty lock so we can see what is left to tackle")
Cc: <stable@vger.kernel.org> # v3.4+
Reported-by: syzbot+522643ab5729b0421998@syzkaller.appspotmail.com
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20200322034305.210082-2-ebiggers@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Eric Biggers
9fbd55e4f9 vt: vt_ioctl: remove unnecessary console allocation checks
commit 1aa6e058dd upstream.

The vc_cons_allocated() checks in vt_ioctl() and vt_compat_ioctl() are
unnecessary because they can only be reached by calling ioctl() on an
open tty, which implies the corresponding virtual console is allocated.

And even if the virtual console *could* be freed concurrently, then
these checks would be broken since they aren't done under console_lock,
and the vc_data is dereferenced before them anyway.

So, remove these unneeded checks to avoid confusion.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20200224080326.295046-1-ebiggers@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Jiri Slaby
d277cae877 vt: switch vt_dont_switch to bool
commit f400991bf8 upstream.

vt_dont_switch is pure boolean, no need for whole char.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20200219073951.16151-6-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:23 +02:00
Jiri Slaby
7de934f409 vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines
commit e587e8f174 upstream.

These two were macros. Switch them to static inlines, so that it's more
understandable what they are doing.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20200219073951.16151-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:22 +02:00
Jiri Slaby
7062646a82 vt: selection, introduce vc_is_sel
commit dce05aa6ee upstream.

Avoid global variables (namely sel_cons) by introducing vc_is_sel. It
checks whether the parameter is the current selection console. This will
help putting sel_cons to a struct later.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20200219073951.16151-1-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:22 +02:00
Johannes Berg
605c896169 mac80211: fix authentication with iwlwifi/mvm
commit be8c827f50 upstream.

The original patch didn't copy the ieee80211_is_data() condition
because on most drivers the management frames don't go through
this path. However, they do on iwlwifi/mvm, so we do need to keep
the condition here.

Cc: stable@vger.kernel.org
Fixes: ce2e1ca703 ("mac80211: Check port authorization in the ieee80211_tx_dequeue() case")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Woody Suwalski <terraluna977@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:22 +02:00
Jouni Malinen
a4f68ecf73 mac80211: Check port authorization in the ieee80211_tx_dequeue() case
commit ce2e1ca703 upstream.

mac80211 used to check port authorization in the Data frame enqueue case
when going through start_xmit(). However, that authorization status may
change while the frame is waiting in a queue. Add a similar check in the
dequeue case to avoid sending previously accepted frames after
authorization change. This provides additional protection against
potential leaking of frames after a station has been disconnected and
the keys for it are being removed.

Cc: stable@vger.kernel.org
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20200326155133.ced84317ea29.I34d4c47cd8cc8a4042b38a76f16a601fbcbfd9b3@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:22 +02:00
Johan Hovold
5d064d7f03 media: xirlink_cit: add missing descriptor sanity checks
commit a246b4d547 upstream.

Make sure to check that we have two alternate settings and at least one
endpoint before accessing the second altsetting structure and
dereferencing the endpoint arrays.

This specifically avoids dereferencing NULL-pointers or corrupting
memory when a device does not have the expected descriptors.

Note that the sanity check in cit_get_packet_size() is not redundant as
the driver is mixing looking up altsettings by index and by number,
which may not coincide.

Fixes: 659fefa0eb ("V4L/DVB: gspca_xirlink_cit: Add support for camera with a bcd version of 0.01")
Fixes: 59f8b0bf3c ("V4L/DVB: gspca_xirlink_cit: support bandwidth changing for devices with 1 alt setting")
Cc: stable <stable@vger.kernel.org>     # 2.6.37
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:22 +02:00
Johan Hovold
70764334b2 media: stv06xx: add missing descriptor sanity checks
commit 485b06aadb upstream.

Make sure to check that we have two alternate settings and at least one
endpoint before accessing the second altsetting structure and
dereferencing the endpoint arrays.

This specifically avoids dereferencing NULL-pointers or corrupting
memory when a device does not have the expected descriptors.

Note that the sanity checks in stv06xx_start() and pb0100_start() are
not redundant as the driver is mixing looking up altsettings by index
and by number, which may not coincide.

Fixes: 8668d504d7 ("V4L/DVB (12082): gspca_stv06xx: Add support for st6422 bridge and sensor")
Fixes: c0b33bdc5b ("[media] gspca-stv06xx: support bandwidth changing")
Cc: stable <stable@vger.kernel.org>     # 2.6.31
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:22 +02:00
Johan Hovold
21d52891d1 media: dib0700: fix rc endpoint lookup
commit f52981019a upstream.

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid submitting an URB to an invalid endpoint.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: c4018fa2e4 ("[media] dib0700: fix RC support on Hauppauge Nova-TD")
Cc: stable <stable@vger.kernel.org>     # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:22 +02:00
Johan Hovold
747a743166 media: ov519: add missing endpoint sanity checks
commit 998912346c upstream.

Make sure to check that we have at least one endpoint before accessing
the endpoint array to avoid dereferencing a NULL-pointer on stream
start.

Note that these sanity checks are not redundant as the driver is mixing
looking up altsettings by index and by number, which need not coincide.

Fixes: 1876bb923c ("V4L/DVB (12079): gspca_ov519: add support for the ov511 bridge")
Fixes: b282d87332 ("V4L/DVB (12080): gspca_ov519: Fix ov518+ with OV7620AE (Trust spacecam 320)")
Cc: stable <stable@vger.kernel.org>     # 2.6.31
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:22 +02:00
Eric Biggers
bf204158a8 libfs: fix infoleak in simple_attr_read()
commit a65cab7d7f upstream.

Reading from a debugfs file at a nonzero position, without first reading
at position 0, leaks uninitialized memory to userspace.

It's a bit tricky to do this, since lseek() and pread() aren't allowed
on these files, and write() doesn't update the position on them.  But
writing to them with splice() *does* update the position:

	#define _GNU_SOURCE 1
	#include <fcntl.h>
	#include <stdio.h>
	#include <unistd.h>
	int main()
	{
		int pipes[2], fd, n, i;
		char buf[32];

		pipe(pipes);
		write(pipes[1], "0", 1);
		fd = open("/sys/kernel/debug/fault_around_bytes", O_RDWR);
		splice(pipes[0], NULL, fd, NULL, 1, 0);
		n = read(fd, buf, sizeof(buf));
		for (i = 0; i < n; i++)
			printf("%02x", buf[i]);
		printf("\n");
	}

Output:
	5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a30

Fix the infoleak by making simple_attr_read() always fill
simple_attr::get_buf if it hasn't been filled yet.

Reported-by: syzbot+fcab69d1ada3e8d6f06b@syzkaller.appspotmail.com
Reported-by: Alexander Potapenko <glider@google.com>
Fixes: acaefc25d2 ("[PATCH] libfs: add simple attribute files")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20200308023849.988264-1-ebiggers@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:21 +02:00
Kai-Heng Feng
eed7257a5c ahci: Add Intel Comet Lake H RAID PCI ID
commit 32d2545462 upstream.

Add the PCI ID to the driver list to support this new device.

Cc: stable@vger.kernel.org
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:21 +02:00
Qiujun Huang
b2f60325a3 staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
commit 1165dd73e8 upstream.

We can't handle the case length > WLAN_DATA_MAXLEN.
Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't
read more than that.

Thanks-to: Hillf Danton <hdanton@sina.com>
Reported-and-tested-by: syzbot+7d42d68643a35f71ac8a@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200326131850.17711-1-hqjagain@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:21 +02:00
Qiujun Huang
0caed6a57c staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
commit a1f165a6b7 upstream.

We should cancel hw->usb_work before kfree(hw).

Reported-by: syzbot+6d2e7f6fa90e27be9d62@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1585120006-30042-1-git-send-email-hqjagain@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:21 +02:00
Larry Finger
7d0a6f03bb staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
commit 38ef48f7d4 upstream.

The ASUS USB-N10 Nano B1 has been reported as a new RTL8188EU device.
Add it to the device tables.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: kovi <zraetn@gmail.com>
Cc: Stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200321180011.26153-1-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 15:28:21 +02:00