Commit Graph

3963 Commits

Author SHA1 Message Date
Tao Huang
fd0e3eb0c2 Merge remote branch 'android-4.19' of https://android.googlesource.com/kernel/common
* android-4.19: (3557 commits)
  ANDROID: kernel: cgroup: cpuset: Clear cpus_requested for empty buf
  ANDROID: kernel: cgroup: cpuset: Add missing allocation of cpus_requested in alloc_trial_cpuset
  Linux 4.19.53
  rtc: pcf8523: don't return invalid date when battery is low
  drm: add fallback override/firmware EDID modes workaround
  drm/edid: abstract override/firmware EDID retrieval
  x86/resctrl: Prevent NULL pointer dereference when local MBM is disabled
  x86/mm/KASLR: Compute the size of the vmemmap section properly
  x86/kasan: Fix boot with 5-level paging and KASAN
  x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback
  RAS/CEC: Fix binary search function
  RAS/CEC: Convert the timer callback to a workqueue
  timekeeping: Repair ktime_get_coarse*() granularity
  USB: serial: option: add Telit 0x1260 and 0x1261 compositions
  USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
  USB: serial: pl2303: add Allied Telesis VT-Kit3
  USB: usb-storage: Add new ID to ums-realtek
  USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
  usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression)
  usb: dwc2: Fix DMA cache alignment issues
  ...

Conflicts:
	arch/arm/boot/dts/rk3288.dtsi
	drivers/bluetooth/hci_ldisc.c
	drivers/clk/clk-fractional-divider.c
	drivers/clk/rockchip/clk-rk3288.c
	drivers/gpu/drm/rockchip/rockchip_drm_vop.c
	init/main.c
	kernel/sched/fair.c

Change-Id: I8bcf9aad06fe9648fc2621bac8475a47be1212fb
2019-06-22 22:26:14 +08:00
Greg Kroah-Hartman
f613e8938d Merge 4.19.53 into android-4.19
Changes in 4.19.53
	drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
	nouveau: Fix build with CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT disabled
	HID: multitouch: handle faulty Elo touch device
	HID: wacom: Don't set tool type until we're in range
	HID: wacom: Don't report anything prior to the tool entering range
	HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact
	HID: wacom: Correct button numbering 2nd-gen Intuos Pro over Bluetooth
	HID: wacom: Sync INTUOSP2_BT touch state after each frame if necessary
	Revert "ALSA: hda/realtek - Improve the headset mic for Acer Aspire laptops"
	ALSA: oxfw: allow PCM capture for Stanton SCS.1m
	ALSA: hda/realtek - Update headset mode for ALC256
	ALSA: firewire-motu: fix destruction of data for isochronous resources
	libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
	mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
	fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
	mm/vmscan.c: fix trying to reclaim unevictable LRU page
	signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
	ptrace: restore smp_rmb() in __ptrace_may_access()
	iommu/arm-smmu: Avoid constant zero in TLBI writes
	i2c: acorn: fix i2c warning
	bcache: fix stack corruption by PRECEDING_KEY()
	bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached
	cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
	ASoC: cs42xx8: Add regcache mask dirty
	ASoC: fsl_asrc: Fix the issue about unsupported rate
	drm/i915/sdvo: Implement proper HDMI audio support for SDVO
	x86/uaccess, kcov: Disable stack protector
	ALSA: seq: Protect in-kernel ioctl calls with mutex
	ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
	Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
	s390/kasan: fix strncpy_from_user kasan checks
	Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
	f2fs: fix to avoid accessing xattr across the boundary
	scsi: qedi: remove memset/memcpy to nfunc and use func instead
	scsi: qedi: remove set but not used variables 'cdev' and 'udev'
	scsi: lpfc: correct rcu unlock issue in lpfc_nvme_info_show
	scsi: lpfc: add check for loss of ndlp when sending RRQ
	arm64/mm: Inhibit huge-vmap with ptdump
	nvme: fix srcu locking on error return in nvme_get_ns_from_disk
	nvme: remove the ifdef around nvme_nvm_ioctl
	nvme: merge nvme_ns_ioctl into nvme_ioctl
	nvme: release namespace SRCU protection before performing controller ioctls
	nvme: fix memory leak for power latency tolerance
	platform/x86: pmc_atom: Add Lex 3I380D industrial PC to critclk_systems DMI table
	platform/x86: pmc_atom: Add several Beckhoff Automation boards to critclk_systems DMI table
	scsi: bnx2fc: fix incorrect cast to u64 on shift operation
	libnvdimm: Fix compilation warnings with W=1
	selftests: fib_rule_tests: fix local IPv4 address typo
	selftests/timers: Add missing fflush(stdout) calls
	tracing: Prevent hist_field_var_ref() from accessing NULL tracing_map_elts
	usbnet: ipheth: fix racing condition
	KVM: arm/arm64: Move cc/it checks under hyp's Makefile to avoid instrumentation
	KVM: x86/pmu: mask the result of rdpmc according to the width of the counters
	KVM: x86/pmu: do not mask the value that is written to fixed PMUs
	KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION
	tools/kvm_stat: fix fields filter for child events
	drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
	drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
	usb: dwc2: Fix DMA cache alignment issues
	usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression)
	USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
	USB: usb-storage: Add new ID to ums-realtek
	USB: serial: pl2303: add Allied Telesis VT-Kit3
	USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
	USB: serial: option: add Telit 0x1260 and 0x1261 compositions
	timekeeping: Repair ktime_get_coarse*() granularity
	RAS/CEC: Convert the timer callback to a workqueue
	RAS/CEC: Fix binary search function
	x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback
	x86/kasan: Fix boot with 5-level paging and KASAN
	x86/mm/KASLR: Compute the size of the vmemmap section properly
	x86/resctrl: Prevent NULL pointer dereference when local MBM is disabled
	drm/edid: abstract override/firmware EDID retrieval
	drm: add fallback override/firmware EDID modes workaround
	rtc: pcf8523: don't return invalid date when battery is low
	Linux 4.19.53

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-06-19 10:10:24 +02:00
Young Xiao
32f26da4b7 Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
[ Upstream commit b281218ad4 ]

There is an out-of-bounds access to "config[len - 1]" array when the
variable "len" is zero.

See commit dada6a43b0 ("kgdboc: fix KASAN global-out-of-bounds bug
in param_set_kgdboc_var()") for details.

Signed-off-by: Young Xiao <YangX92@hotmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-06-19 08:18:02 +02:00
Greg Kroah-Hartman
d1f7f3be99 Merge 4.19.51 into android-4.19
Changes in 4.19.51
	rapidio: fix a NULL pointer dereference when create_workqueue() fails
	fs/fat/file.c: issue flush after the writeback of FAT
	sysctl: return -EINVAL if val violates minmax
	ipc: prevent lockup on alloc_msg and free_msg
	drm/pl111: Initialize clock spinlock early
	ARM: prevent tracing IPI_CPU_BACKTRACE
	mm/hmm: select mmu notifier when selecting HMM
	hugetlbfs: on restore reserve error path retain subpool reservation
	mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE
	mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
	initramfs: free initrd memory if opening /initrd.image fails
	mm/cma.c: fix the bitmap status to show failed allocation reason
	mm: page_mkclean vs MADV_DONTNEED race
	mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
	mm/slab.c: fix an infinite loop in leaks_show()
	kernel/sys.c: prctl: fix false positive in validate_prctl_map()
	thermal: rcar_gen3_thermal: disable interrupt in .remove
	drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
	mfd: tps65912-spi: Add missing of table registration
	mfd: intel-lpss: Set the device in reset state when init
	drm/nouveau/disp/dp: respect sink limits when selecting failsafe link configuration
	mfd: twl6040: Fix device init errors for ACCCTL register
	perf/x86/intel: Allow PEBS multi-entry in watermark mode
	drm/nouveau/kms/gf119-gp10x: push HeadSetControlOutputResource() mthd when encoders change
	drm/bridge: adv7511: Fix low refresh rate selection
	objtool: Don't use ignore flag for fake jumps
	drm/nouveau/kms/gv100-: fix spurious window immediate interlocks
	bpf: fix undefined behavior in narrow load handling
	EDAC/mpc85xx: Prevent building as a module
	pwm: meson: Use the spin-lock only to protect register modifications
	mailbox: stm32-ipcc: check invalid irq
	ntp: Allow TAI-UTC offset to be set to zero
	f2fs: fix to avoid panic in do_recover_data()
	f2fs: fix to avoid panic in f2fs_inplace_write_data()
	f2fs: fix to avoid panic in f2fs_remove_inode_page()
	f2fs: fix to do sanity check on free nid
	f2fs: fix to clear dirty inode in error path of f2fs_iget()
	f2fs: fix to avoid panic in dec_valid_block_count()
	f2fs: fix to use inline space only if inline_xattr is enable
	f2fs: fix to do sanity check on valid block count of segment
	f2fs: fix to do checksum even if inode page is uptodate
	percpu: remove spurious lock dependency between percpu and sched
	configfs: fix possible use-after-free in configfs_register_group
	uml: fix a boot splat wrt use of cpu_all_mask
	PCI: dwc: Free MSI in dw_pcie_host_init() error path
	PCI: dwc: Free MSI IRQ page in dw_pcie_free_msi()
	ovl: do not generate duplicate fsnotify events for "fake" path
	mmc: mmci: Prevent polling for busy detection in IRQ context
	netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast
	netfilter: nf_conntrack_h323: restore boundary check correctness
	mips: Make sure dt memory regions are valid
	netfilter: nf_tables: fix base chain stat rcu_dereference usage
	watchdog: imx2_wdt: Fix set_timeout for big timeout values
	watchdog: fix compile time error of pretimeout governors
	blk-mq: move cancel of requeue_work into blk_mq_release
	iommu/vt-d: Set intel_iommu_gfx_mapped correctly
	misc: pci_endpoint_test: Fix test_reg_bar to be updated in pci_endpoint_test
	PCI: designware-ep: Use aligned ATU window for raising MSI interrupts
	nvme-pci: unquiesce admin queue on shutdown
	nvme-pci: shutdown on timeout during deletion
	netfilter: nf_flow_table: check ttl value in flow offload data path
	netfilter: nf_flow_table: fix netdev refcnt leak
	ALSA: hda - Register irq handler after the chip initialization
	nvmem: core: fix read buffer in place
	nvmem: sunxi_sid: Support SID on A83T and H5
	fuse: retrieve: cap requested size to negotiated max_write
	nfsd: allow fh_want_write to be called twice
	nfsd: avoid uninitialized variable warning
	vfio: Fix WARNING "do not call blocking ops when !TASK_RUNNING"
	iommu/arm-smmu-v3: Don't disable SMMU in kdump kernel
	switchtec: Fix unintended mask of MRPC event
	net: thunderbolt: Unregister ThunderboltIP protocol handler when suspending
	x86/PCI: Fix PCI IRQ routing table memory leak
	i40e: Queues are reserved despite "Invalid argument" error
	platform/chrome: cros_ec_proto: check for NULL transfer function
	PCI: keystone: Prevent ARM32 specific code to be compiled for ARM64
	soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
	clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
	soc: rockchip: Set the proper PWM for rk3288
	ARM: dts: imx51: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx50: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx53: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx6sll: Specify IMX6SLL_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx7d: Specify IMX7D_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
	PCI: rpadlpar: Fix leaked device_node references in add/remove paths
	drm/amd/display: Use plane->color_space for dpp if specified
	ARM: OMAP2+: pm33xx-core: Do not Turn OFF CEFUSE as PPA may be using it
	platform/x86: intel_pmc_ipc: adding error handling
	power: supply: max14656: fix potential use-before-alloc
	net: hns3: return 0 and print warning when hit duplicate MAC
	PCI: rcar: Fix a potential NULL pointer dereference
	PCI: rcar: Fix 64bit MSI message address handling
	scsi: qla2xxx: Reset the FCF_ASYNC_{SENT|ACTIVE} flags
	video: hgafb: fix potential NULL pointer dereference
	video: imsttfb: fix potential NULL pointer dereferences
	block, bfq: increase idling for weight-raised queues
	PCI: xilinx: Check for __get_free_pages() failure
	gpio: gpio-omap: add check for off wake capable gpios
	ice: Add missing case in print_link_msg for printing flow control
	dmaengine: idma64: Use actual device for DMA transfers
	pwm: tiehrpwm: Update shadow register for disabling PWMs
	ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa
	pwm: Fix deadlock warning when removing PWM device
	ARM: exynos: Fix undefined instruction during Exynos5422 resume
	usb: typec: fusb302: Check vconn is off when we start toggling
	soc: renesas: Identify R-Car M3-W ES1.3
	gpio: vf610: Do not share irq_chip
	percpu: do not search past bitmap when allocating an area
	Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"
	Revert "drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)"
	ovl: check the capability before cred overridden
	ovl: support stacked SEEK_HOLE/SEEK_DATA
	drm/vc4: fix fb references in async update
	ALSA: seq: Cover unsubscribe_port() in list_mutex
	Linux 4.19.51

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-06-15 16:12:59 +02:00
Kishon Vijay Abraham I
a7f27994b2 misc: pci_endpoint_test: Fix test_reg_bar to be updated in pci_endpoint_test
[ Upstream commit 8f22066457 ]

commit 834b905199 ("misc: pci_endpoint_test: Add support for
PCI_ENDPOINT_TEST regs to be mapped to any BAR") while adding
test_reg_bar in order to map PCI_ENDPOINT_TEST regs to be mapped to any
BAR failed to update test_reg_bar in pci_endpoint_test, resulting in
test_reg_bar having invalid value when used outside probe.

Fix it.

Fixes: 834b905199 ("misc: pci_endpoint_test: Add support for PCI_ENDPOINT_TEST regs to be mapped to any BAR")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-06-15 11:54:06 +02:00
Greg Kroah-Hartman
be7c1cbd03 Merge 4.19.50 into android-4.19
Changes in 4.19.50
	ethtool: fix potential userspace buffer overflow
	Fix memory leak in sctp_process_init
	ipv4: not do cache for local delivery if bc_forwarding is enabled
	ipv6: fix the check before getting the cookie in rt6_get_cookie
	neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
	net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set
	net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
	net: mvpp2: Use strscpy to handle stat strings
	net: rds: fix memory leak in rds_ib_flush_mr_pool
	net: sfp: read eeprom in maximum 16 byte increments
	net/tls: replace the sleeping lock around RX resync with a bit lock
	packet: unconditionally free po->rollover
	pktgen: do not sleep with the thread lock held.
	Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied"
	ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
	ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
	mtd: spinand: macronix: Fix ECC Status Read
	rcu: locking and unlocking need to always be at least barriers
	parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
	NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter
	NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled
	fuse: fallocate: fix return with locked inode
	pstore: Remove needless lock during console writes
	pstore: Convert buf_lock to semaphore
	pstore: Set tfm to NULL on free_buf_for_compression
	pstore/ram: Run without kernel crash dump region
	x86/power: Fix 'nosmt' vs hibernation triple fault during resume
	x86/insn-eval: Fix use-after-free access to LDT entry
	i2c: xiic: Add max_read_len quirk
	s390/mm: fix address space detection in exception handling
	xen-blkfront: switch kcalloc to kvcalloc for large array allocation
	MIPS: Bounds check virt_addr_valid
	MIPS: pistachio: Build uImage.gz by default
	Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment"
	genwqe: Prevent an integer overflow in the ioctl
	test_firmware: Use correct snprintf() limit
	drm/gma500/cdv: Check vbt config bits when detecting lvds panels
	drm/msm: fix fb references in async update
	drm: add non-desktop quirk for Valve HMDs
	drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
	drm: add non-desktop quirks to Sensics and OSVR headsets.
	drm/amdgpu/psp: move psp version specific function pointers to early_init
	drm/radeon: prefer lower reference dividers
	drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in
	drm/i915: Fix I915_EXEC_RING_MASK
	drm/i915/fbc: disable framebuffer compression on GeminiLake
	drm/i915: Maintain consistent documentation subsection ordering
	drm: don't block fb changes for async plane updates
	drm/i915/gvt: Initialize intel_gvt_gtt_entry in stack
	TTY: serial_core, add ->install
	ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
	ethtool: check the return value of get_regs_len
	Linux 4.19.50

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-06-11 12:38:58 +02:00
Dan Carpenter
67bdeb0c6f genwqe: Prevent an integer overflow in the ioctl
commit 110080cea0 upstream.

There are a couple potential integer overflows here.

	round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE);

The first thing is that the "m->size + (...)" addition could overflow,
and the second is that round_up() overflows to zero if the result is
within PAGE_SIZE of the type max.

In this code, the "m->size" variable is an u64 but we're saving the
result in "map_size" which is an unsigned long and genwqe_user_vmap()
takes an unsigned long as well.  So I have used ULONG_MAX as the upper
bound.  From a practical perspective unsigned long is fine/better than
trying to change all the types to u64.

Fixes: eaf4722d46 ("GenWQE Character device and DDCB queue")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-06-11 12:20:54 +02:00
Connor O'Brien
305d5c1975 ANDROID: uid_sys_stats: report uid_cputime stats in microseconds
A porting error in commit 0ae8088521 ("ANDROID: uid_cputime: Adds
accounting for the cputimes per uid.") caused
/proc/uid_cputime/show_uid_stat to report times in milliseconds
instead of microseconds. Restore the expected behavior.

Bug: 133273154
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: I203919d1d44b300dab91810b16626a6950b063f8
2019-06-07 17:54:47 +00:00
Sami Tolvanen
acd5c72821 ANDROID: drivers/misc: disable LTO for lkdtm_rodata.o
Disable LTO for lkdtm_rodata.o to allow objcopy to be used to
manipulate sections.

Bug: 62093296
Bug: 67506682
Bug: 133186739
Change-Id: Iedd1a3a2a9b06f44e7ceb6ac287ea764eaf5ef0a
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2019-05-20 17:43:32 -07:00
Greg Kroah-Hartman
10f41ccfc7 Merge 4.19.36 into android-4.19
Changes in 4.19.36
	ARC: u-boot args: check that magic number is correct
	arc: hsdk_defconfig: Enable CONFIG_BLK_DEV_RAM
	inotify: Fix fsnotify_mark refcount leak in inotify_update_existing_watch()
	perf/core: Restore mmap record type correctly
	ext4: avoid panic during forced reboot
	ext4: add missing brelse() in add_new_gdb_meta_bg()
	ext4: report real fs size after failed resize
	ALSA: echoaudio: add a check for ioremap_nocache
	ALSA: sb8: add a check for request_region
	auxdisplay: hd44780: Fix memory leak on ->remove()
	drm/udl: use drm_gem_object_put_unlocked.
	IB/mlx4: Fix race condition between catas error reset and aliasguid flows
	i40iw: Avoid panic when handling the inetdev event
	mmc: davinci: remove extraneous __init annotation
	ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration
	thermal/intel_powerclamp: fix __percpu declaration of worker_data
	thermal: samsung: Fix incorrect check after code merge
	thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs
	thermal/int340x_thermal: Add additional UUIDs
	thermal/int340x_thermal: fix mode setting
	thermal/intel_powerclamp: fix truncated kthread name
	scsi: iscsi: flush running unbind operations when removing a session
	sched/cpufreq: Fix 32-bit math overflow
	sched/core: Fix buffer overflow in cgroup2 property cpu.max
	x86/mm: Don't leak kernel addresses
	tools/power turbostat: return the exit status of a command
	perf list: Don't forget to drop the reference to the allocated thread_map
	perf config: Fix an error in the config template documentation
	perf config: Fix a memory leak in collect_config()
	perf build-id: Fix memory leak in print_sdt_events()
	perf top: Fix error handling in cmd_top()
	perf hist: Add missing map__put() in error case
	perf evsel: Free evsel->counts in perf_evsel__exit()
	perf tests: Fix a memory leak of cpu_map object in the openat_syscall_event_on_all_cpus test
	perf tests: Fix memory leak by expr__find_other() in test__expr()
	perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test()
	ACPI / utils: Drop reference in test for device presence
	PM / Domains: Avoid a potential deadlock
	blk-iolatency: #include "blk.h"
	drm/exynos/mixer: fix MIXER shadow registry synchronisation code
	irqchip/stm32: Don't clear rising/falling config registers at init
	irqchip/mbigen: Don't clear eventid when freeing an MSI
	x86/hpet: Prevent potential NULL pointer dereference
	x86/hyperv: Prevent potential NULL pointer dereference
	x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors
	drm/nouveau/debugfs: Fix check of pm_runtime_get_sync failure
	iommu/vt-d: Check capability before disabling protected memory
	x86/hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return an error
	fix incorrect error code mapping for OBJECTID_NOT_FOUND
	x86/gart: Exclude GART aperture from kcore
	ext4: prohibit fstrim in norecovery mode
	drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up
	gpio: pxa: handle corner case of unprobed device
	rsi: improve kernel thread handling to fix kernel panic
	f2fs: fix to avoid NULL pointer dereference on se->discard_map
	9p: do not trust pdu content for stat item size
	9p locks: add mount option for lock retry interval
	ASoC: Fix UBSAN warning at snd_soc_get/put_volsw_sx()
	f2fs: fix to do sanity check with current segment number
	netfilter: xt_cgroup: shrink size of v2 path
	serial: uartps: console_setup() can't be placed to init section
	powerpc/pseries: Remove prrn_work workqueue
	media: au0828: cannot kfree dev before usb disconnect
	Bluetooth: Fix debugfs NULL pointer dereference
	HID: i2c-hid: override HID descriptors for certain devices
	pinctrl: core: make sure strcmp() doesn't get a null parameter
	ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms
	usbip: fix vhci_hcd controller counting
	ACPI / SBS: Fix GPE storm on recent MacBookPro's
	HID: usbhid: Add quirk for Redragon/Dragonrise Seymur 2
	KVM: nVMX: restore host state in nested_vmx_vmexit for VMFail
	compiler.h: update definition of unreachable()
	netfilter: nf_flow_table: remove flowtable hook flush routine in netns exit routine
	f2fs: cleanup dirty pages if recover failed
	net: stmmac: Set OWN bit for jumbo frames
	cifs: fallback to older infolevels on findfirst queryinfo retry
	kernel: hung_task.c: disable on suspend
	platform/x86: Add Intel AtomISP2 dummy / power-management driver
	drm/ttm: Fix bo_global and mem_global kfree error
	ALSA: hda: fix front speakers on Huawei MBXP
	ACPI: EC / PM: Disable non-wakeup GPEs for suspend-to-idle
	net/rds: fix warn in rds_message_alloc_sgs
	xfrm: destroy xfrm_state synchronously on net exit path
	crypto: sha256/arm - fix crash bug in Thumb2 build
	crypto: sha512/arm - fix crash bug in Thumb2 build
	net: ip6_gre: fix possible NULL pointer dereference in ip6erspan_set_version
	iommu/dmar: Fix buffer overflow during PCI bus notification
	scsi: core: Avoid that system resume triggers a kernel warning
	soc/tegra: pmc: Drop locking from tegra_powergate_is_powered()
	lkdtm: Print real addresses
	lkdtm: Add tests for NULL pointer dereference
	drm/panel: panel-innolux: set display off in innolux_panel_unprepare
	crypto: axis - fix for recursive locking from bottom half
	Revert "ACPI / EC: Remove old CLEAR_ON_RESUME quirk"
	coresight: cpu-debug: Support for CA73 CPUs
	PCI: Blacklist power management of Gigabyte X299 DESIGNARE EX PCIe ports
	drm/nouveau/volt/gf117: fix speedo readout register
	ARM: 8839/1: kprobe: make patch_lock a raw_spinlock_t
	drm/amdkfd: use init_mqd function to allocate object for hid_mqd (CI)
	appletalk: Fix use-after-free in atalk_proc_exit
	lib/div64.c: off by one in shift
	rxrpc: Fix client call connect/disconnect race
	f2fs: fix to dirty inode for i_mode recovery
	include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
	bpf: fix use after free in bpf_evict_inode
	IB/hfi1: Failed to drain send queue when QP is put into error state
	mm: hide incomplete nr_indirectly_reclaimable in /proc/zoneinfo
	mm: hide incomplete nr_indirectly_reclaimable in sysfs
	appletalk: Fix compile regression
	Linux 4.19.36

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-04-20 15:53:36 +02:00
Christophe Leroy
2be8987a07 lkdtm: Add tests for NULL pointer dereference
[ Upstream commit 59a12205d3 ]

Introduce lkdtm tests for NULL pointer dereference: check access or exec
at NULL address, since these errors tend to be reported differently from
the general fault error text. For example from x86:

    pr_alert("BUG: unable to handle kernel %s at %px\n",
        address < PAGE_SIZE ? "NULL pointer dereference" : "paging request",
        (void *)address);

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-04-20 09:16:04 +02:00
Christophe Leroy
55588aebde lkdtm: Print real addresses
[ Upstream commit 4c411157a4 ]

Today, when doing a lkdtm test before the readiness of the
random generator, (ptrval) is printed instead of the address
at which it perform the fault:

[ 1597.337030] lkdtm: Performing direct entry EXEC_USERSPACE
[ 1597.337142] lkdtm: attempting ok execution at (ptrval)
[ 1597.337398] lkdtm: attempting bad execution at (ptrval)
[ 1597.337460] kernel tried to execute user page (77858000) -exploit attempt? (uid: 0)
[ 1597.344769] Unable to handle kernel paging request for instruction fetch
[ 1597.351392] Faulting instruction address: 0x77858000
[ 1597.356312] Oops: Kernel access of bad area, sig: 11 [#1]

If the lkdtm test is done later on, it prints an hashed address.

In both cases this is pointless. The purpose of the test is to
ensure the kernel generates an Oops at the expected address,
so real addresses needs to be printed. This patch fixes that.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-04-20 09:16:03 +02:00
Greg Kroah-Hartman
bb418a146a Merge 4.19.31 into android-4.19
Changes in 4.19.31
	media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
	9p: use inode->i_lock to protect i_size_write() under 32-bit
	9p/net: fix memory leak in p9_client_create
	ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
	ASoC: codecs: pcm186x: fix wrong usage of DECLARE_TLV_DB_SCALE()
	ASoC: codecs: pcm186x: Fix energysense SLEEP bit
	iio: adc: exynos-adc: Fix NULL pointer exception on unbind
	mei: hbm: clean the feature flags on link reset
	mei: bus: move hw module get/put to probe/release
	stm class: Fix an endless loop in channel allocation
	crypto: caam - fix hash context DMA unmap size
	crypto: ccree - fix missing break in switch statement
	crypto: caam - fixed handling of sg list
	crypto: caam - fix DMA mapping of stack memory
	crypto: ccree - fix free of unallocated mlli buffer
	crypto: ccree - unmap buffer before copying IV
	crypto: ccree - don't copy zero size ciphertext
	crypto: cfb - add missing 'chunksize' property
	crypto: cfb - remove bogus memcpy() with src == dest
	crypto: ahash - fix another early termination in hash walk
	crypto: rockchip - fix scatterlist nents error
	crypto: rockchip - update new iv to device in multiple operations
	drm/imx: ignore plane updates on disabled crtcs
	gpu: ipu-v3: Fix i.MX51 CSI control registers offset
	drm/imx: imx-ldb: add missing of_node_puts
	gpu: ipu-v3: Fix CSI offsets for imx53
	ASoC: rt5682: Correct the setting while select ASRC clk for AD/DA filter
	clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck reparenting
	KVM: arm/arm64: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock
	arm64: dts: rockchip: fix graph_port warning on rk3399 bob kevin and excavator
	s390/dasd: fix using offset into zero size array error
	Input: pwm-vibra - prevent unbalanced regulator
	Input: pwm-vibra - stop regulator after disabling pwm, not before
	ARM: dts: Configure clock parent for pwm vibra
	ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
	ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables
	ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check
	KVM: arm/arm64: Reset the VCPU without preemption and vcpu state loaded
	arm/arm64: KVM: Allow a VCPU to fully reset itself
	arm/arm64: KVM: Don't panic on failure to properly reset system registers
	KVM: arm/arm64: vgic: Always initialize the group of private IRQs
	KVM: arm64: Forbid kprobing of the VHE world-switch code
	ASoC: samsung: Prevent clk_get_rate() calls in atomic context
	ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug
	Input: cap11xx - switch to using set_brightness_blocking()
	Input: ps2-gpio - flush TX work when closing port
	Input: matrix_keypad - use flush_delayed_work()
	mac80211: call drv_ibss_join() on restart
	mac80211: Fix Tx aggregation session tear down with ITXQs
	netfilter: compat: initialize all fields in xt_init
	blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue
	ipvs: fix dependency on nf_defrag_ipv6
	floppy: check_events callback should not return a negative number
	xprtrdma: Make sure Send CQ is allocated on an existing compvec
	NFS: Don't use page_file_mapping after removing the page
	mm/gup: fix gup_pmd_range() for dax
	Revert "mm: use early_pfn_to_nid in page_ext_init"
	scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd
	net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend()
	x86/CPU: Add Icelake model number
	mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs
	net: hns: Fix object reference leaks in hns_dsaf_roce_reset()
	i2c: cadence: Fix the hold bit setting
	i2c: bcm2835: Clear current buffer pointers and counts after a transfer
	auxdisplay: ht16k33: fix potential user-after-free on module unload
	Input: st-keyscan - fix potential zalloc NULL dereference
	clk: sunxi-ng: v3s: Fix TCON reset de-assert bit
	kallsyms: Handle too long symbols in kallsyms.c
	clk: sunxi: A31: Fix wrong AHB gate number
	esp: Skip TX bytes accounting when sending from a request socket
	ARM: 8824/1: fix a migrating irq bug when hotplug cpu
	bpf: only adjust gso_size on bytestream protocols
	bpf: fix lockdep false positive in stackmap
	af_key: unconditionally clone on broadcast
	ARM: 8835/1: dma-mapping: Clear DMA ops on teardown
	assoc_array: Fix shortcut creation
	keys: Fix dependency loop between construction record and auth key
	scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
	net: systemport: Fix reception of BPDUs
	net: dsa: bcm_sf2: Do not assume DSA master supports WoL
	pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
	qmi_wwan: apply SET_DTR quirk to Sierra WP7607
	net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
	xfrm: Fix inbound traffic via XFRM interfaces across network namespaces
	mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue
	ASoC: topology: free created components in tplg load error
	qed: Fix iWARP buffer size provided for syn packet processing.
	qed: Fix iWARP syn packet mac address validation.
	ARM: dts: armada-xp: fix Armada XP boards NAND description
	arm64: Relax GIC version check during early boot
	ARM: tegra: Restore DT ABI on Tegra124 Chromebooks
	net: marvell: mvneta: fix DMA debug warning
	mm: handle lru_add_drain_all for UP properly
	tmpfs: fix link accounting when a tmpfile is linked in
	ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN
	ARCv2: lib: memcpy: fix doing prefetchw outside of buffer
	ARC: uacces: remove lp_start, lp_end from clobber list
	ARCv2: support manual regfile save on interrupts
	ARCv2: don't assume core 0x54 has dual issue
	phonet: fix building with clang
	mac80211_hwsim: propagate genlmsg_reply return code
	bpf, lpm: fix lookup bug in map_delete_elem
	net: thunderx: make CFG_DONE message to run through generic send-ack sequence
	net: thunderx: add nicvf_send_msg_to_pf result check for set_rx_mode_task
	nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K
	nfp: bpf: fix ALU32 high bits clearance bug
	bnxt_en: Fix typo in firmware message timeout logic.
	bnxt_en: Wait longer for the firmware message response to complete.
	net: set static variable an initial value in atl2_probe()
	selftests: fib_tests: sleep after changing carrier. again.
	tmpfs: fix uninitialized return value in shmem_link
	stm class: Prevent division by zero
	nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
	acpi/nfit: Fix bus command validation
	nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot
	nfit/ars: Attempt short-ARS even in the no_init_ars case
	libnvdimm/label: Clear 'updating' flag after label-set update
	libnvdimm, pfn: Fix over-trim in trim_pfn_device()
	libnvdimm/pmem: Honor force_raw for legacy pmem regions
	libnvdimm: Fix altmap reservation size calculation
	fix cgroup_do_mount() handling of failure exits
	crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
	crypto: aegis - fix handling chunked inputs
	crypto: arm/crct10dif - revert to C code for short inputs
	crypto: arm64/aes-neonbs - fix returning final keystream block
	crypto: arm64/crct10dif - revert to C code for short inputs
	crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
	crypto: morus - fix handling chunked inputs
	crypto: pcbc - remove bogus memcpy()s with src == dest
	crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
	crypto: testmgr - skip crc32c context test for ahash algorithms
	crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP
	crypto: x86/aesni-gcm - fix crash on empty plaintext
	crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP
	crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
	crypto: arm64/aes-ccm - fix bugs in non-NEON fallback routine
	CIFS: Do not reset lease state to NONE on lease break
	CIFS: Do not skip SMB2 message IDs on send failures
	CIFS: Fix read after write for files with read caching
	tracing: Use strncpy instead of memcpy for string keys in hist triggers
	tracing: Do not free iter->trace in fail path of tracing_open_pipe()
	tracing/perf: Use strndup_user() instead of buggy open-coded version
	xen: fix dom0 boot on huge systems
	ACPI / device_sysfs: Avoid OF modalias creation for removed device
	mmc: sdhci-esdhc-imx: fix HS400 timing issue
	mmc:fix a bug when max_discard is 0
	netfilter: ipt_CLUSTERIP: fix warning unused variable cn
	spi: ti-qspi: Fix mmap read when more than one CS in use
	spi: pxa2xx: Setup maximum supported DMA transfer length
	regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
	regulator: max77620: Initialize values for DT properties
	regulator: s2mpa01: Fix step values for some LDOs
	clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
	clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
	clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer instability
	s390/setup: fix early warning messages
	s390/virtio: handle find on invalid queue gracefully
	scsi: virtio_scsi: don't send sc payload with tmfs
	scsi: aacraid: Fix performance issue on logical drives
	scsi: sd: Optimal I/O size should be a multiple of physical block size
	scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
	scsi: qla2xxx: Fix LUN discovery if loop id is not assigned yet by firmware
	fs/devpts: always delete dcache dentry-s in dput()
	splice: don't merge into linked buffers
	ovl: During copy up, first copy up data and then xattrs
	ovl: Do not lose security.capability xattr over metadata file copy-up
	m68k: Add -ffreestanding to CFLAGS
	Btrfs: setup a nofs context for memory allocation at btrfs_create_tree()
	Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl
	btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
	Btrfs: fix corruption reading shared and compressed extents after hole punching
	soc: qcom: rpmh: Avoid accessing freed memory from batch API
	libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer
	irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table
	irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code
	x86/kprobes: Prohibit probing on optprobe template code
	cpufreq: kryo: Release OPP tables on module removal
	cpufreq: tegra124: add missing of_node_put()
	cpufreq: pxa2xx: remove incorrect __init annotation
	ext4: fix check of inode in swap_inode_boot_loader
	ext4: cleanup pagecache before swap i_data
	ext4: update quota information while swapping boot loader inode
	ext4: add mask of ext4 flags to swap
	ext4: fix crash during online resizing
	PCI/ASPM: Use LTR if already enabled by platform
	PCI/DPC: Fix print AER status in DPC event handling
	PCI: dwc: skip MSI init if MSIs have been explicitly disabled
	IB/hfi1: Close race condition on user context disable and close
	cxl: Wrap iterations over afu slices inside 'afu_list_lock'
	ext2: Fix underflow in ext2_max_size()
	clk: uniphier: Fix update register for CPU-gear
	clk: clk-twl6040: Fix imprecise external abort for pdmclk
	clk: samsung: exynos5: Fix possible NULL pointer exception on platform_device_alloc() failure
	clk: samsung: exynos5: Fix kfree() of const memory on setting driver_override
	clk: ingenic: Fix round_rate misbehaving with non-integer dividers
	clk: ingenic: Fix doc of ingenic_cgu_div_info
	usb: chipidea: tegra: Fix missed ci_hdrc_remove_device()
	usb: typec: tps6598x: handle block writes separately with plain-I2C adapters
	dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
	mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
	mm/vmalloc: fix size check for remap_vmalloc_range_partial()
	mm/memory.c: do_fault: avoid usage of stale vm_area_struct
	kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
	device property: Fix the length used in PROPERTY_ENTRY_STRING()
	intel_th: Don't reference unassigned outputs
	parport_pc: fix find_superio io compare code, should use equal test.
	i2c: tegra: fix maximum transfer size
	media: i2c: ov5640: Fix post-reset delay
	gpio: pca953x: Fix dereference of irq data in shutdown
	can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument
	drm/i915: Relax mmap VMA check
	bpf: only test gso type on gso packets
	serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
	serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
	serial: 8250_pci: Fix number of ports for ACCES serial cards
	serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
	jbd2: clear dirty flag when revoking a buffer from an older transaction
	jbd2: fix compile warning when using JBUFFER_TRACE
	selinux: add the missing walk_size + len check in selinux_sctp_bind_connect
	security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock
	powerpc/32: Clear on-stack exception marker upon exception return
	powerpc/wii: properly disable use of BATs when requested.
	powerpc/powernv: Make opal log only readable by root
	powerpc/83xx: Also save/restore SPRG4-7 during suspend
	powerpc/powernv: Don't reprogram SLW image on every KVM guest entry/exit
	powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
	powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
	powerpc/hugetlb: Don't do runtime allocation of 16G pages in LPAR configuration
	powerpc/traps: fix recoverability of machine check handling on book3s/32
	powerpc/traps: Fix the message printed when stack overflows
	ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
	arm64: Fix HCR.TGE status for NMI contexts
	arm64: debug: Ensure debug handlers check triggering exception level
	arm64: KVM: Fix architecturally invalid reset value for FPEXC32_EL2
	ipmi_si: fix use-after-free of resource->name
	dm: fix to_sector() for 32bit
	dm integrity: limit the rate of error messages
	mfd: sm501: Fix potential NULL pointer dereference
	cpcap-charger: generate events for userspace
	NFS: Fix I/O request leakages
	NFS: Fix an I/O request leakage in nfs_do_recoalesce
	NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
	nfsd: fix performance-limiting session calculation
	nfsd: fix memory corruption caused by readdir
	nfsd: fix wrong check in write_v4_end_grace()
	NFSv4.1: Reinitialise sequence results before retransmitting a request
	svcrpc: fix UDP on servers with lots of threads
	PM / wakeup: Rework wakeup source timer cancellation
	bcache: never writeback a discard operation
	stable-kernel-rules.rst: add link to networking patch queue
	vt: perform safe console erase in the right order
	x86/unwind/orc: Fix ORC unwind table alignment
	perf intel-pt: Fix CYC timestamp calculation after OVF
	perf tools: Fix split_kallsyms_for_kcore() for trampoline symbols
	perf auxtrace: Define auxtrace record alignment
	perf intel-pt: Fix overlap calculation for padding
	perf/x86/intel/uncore: Fix client IMC events return huge result
	perf intel-pt: Fix divide by zero when TSC is not available
	md: Fix failed allocation of md_register_thread
	tpm/tpm_crb: Avoid unaligned reads in crb_recv()
	tpm: Unify the send callback behaviour
	rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
	media: imx: prpencvf: Stop upstream before disabling IDMA channel
	media: lgdt330x: fix lock status reporting
	media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
	media: vimc: Add vimc-streamer for stream control
	media: imx: csi: Disable CSI immediately after last EOF
	media: imx: csi: Stop upstream before disabling IDMA channel
	drm/fb-helper: generic: Fix drm_fbdev_client_restore()
	drm/radeon/evergreen_cs: fix missing break in switch statement
	drm/amd/powerplay: correct power reading on fiji
	drm/amd/display: don't call dm_pp_ function from an fpu block
	KVM: Call kvm_arch_memslots_updated() before updating memslots
	KVM: x86/mmu: Detect MMIO generation wrap in any address space
	KVM: x86/mmu: Do not cache MMIO accesses while memslots are in flux
	KVM: nVMX: Sign extend displacements of VMX instr's mem operands
	KVM: nVMX: Apply addr size mask to effective address for VMX instructions
	KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
	bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata
	s390/setup: fix boot crash for machine without EDAT-1
	Linux 4.19.31

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-03-23 21:13:30 +01:00
Vaibhav Jain
c335b49379 cxl: Wrap iterations over afu slices inside 'afu_list_lock'
commit edeb304f65 upstream.

Within cxl module, iteration over array 'adapter->afu' may be racy
at few points as it might be simultaneously read during an EEH and its
contents being set to NULL while driver is being unloaded or unbound
from the adapter. This might result in a NULL pointer to 'struct afu'
being de-referenced during an EEH thereby causing a kernel oops.

This patch fixes this by making sure that all access to the array
'adapter->afu' is wrapped within the context of spin-lock
'adapter->afu_list_lock'.

Fixes: 9e8df8a219 ("cxl: EEH support")
Cc: stable@vger.kernel.org # v4.3+
Acked-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Frederic Barrat <fbarrat@linux.ibm.com>
Acked-by: Christophe Lombard <clombard@linux.vnet.ibm.com>
Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-23 20:10:03 +01:00
Alexander Usyskin
a253d1f3e4 mei: bus: move hw module get/put to probe/release
commit b5958faa34 upstream.

Fix unbalanced module reference counting during internal reset, which
prevents the drivers unloading.
Tracking mei_me/txe modules on mei client bus via
mei_cldev_enable/disable is error prone due to possible internal
reset flow, where clients are disconnected underneath.
Moving reference counting to probe and release of mei bus client
driver solves this issue in simplest way, as each client provides only
a single connection to a client bus driver.

Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-23 20:09:39 +01:00
Alexander Usyskin
02c0c70fb3 mei: hbm: clean the feature flags on link reset
commit 37fd0b6230 upstream.

The list of supported functions can be altered upon link reset,
clean the flags to allow correct selections of supported
features.

Cc: <stable@vger.kernel.org> v4.19+
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-23 20:09:39 +01:00
Connor O'Brien
6d2b4b4435 ANDROID: cpufreq: times: track per-uid time in state
Add /proc/uid_time_in_state showing per uid/frequency/cluster
times. Allow uid removal through /proc/uid_cputime/remove_uid_range.

Signed-off-by: Connor O'Brien <connoro@google.com>
Bug: 72339335
Bug: 127641090
Test: Read /proc/uid_time_in_state
Change-Id: I20ba3546a27c25b7e7991e2a86986e158aafa58c
2019-03-06 15:57:54 +00:00
Greg Kroah-Hartman
cca7d2df6d Merge 4.19.24 into android-4.19
Changes in 4.19.24
	dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string
	eeprom: at24: add support for 24c2048
	blk-mq: fix a hung issue when fsync
	ARM: 8789/1: signal: copy registers using __copy_to_user()
	ARM: 8790/1: signal: always use __copy_to_user to save iwmmxt context
	ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state
	ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user()
	ARM: 8793/1: signal: replace __put_user_error with __put_user
	ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit
	ARM: 8795/1: spectre-v1.1: use put_user() for __put_user()
	ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
	ARM: 8797/1: spectre-v1.1: harden __copy_to_user
	ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc
	ARM: make lookup_processor_type() non-__init
	ARM: split out processor lookup
	ARM: clean up per-processor check_bugs method call
	ARM: add PROC_VTABLE and PROC_TABLE macros
	ARM: spectre-v2: per-CPU vtables to work around big.Little systems
	ARM: ensure that processor vtables is not lost after boot
	ARM: fix the cockup in the previous patch
	drm/amdgpu/sriov:Correct pfvf exchange logic
	ACPI: NUMA: Use correct type for printing addresses on i386-PAE
	perf report: Fix wrong iteration count in --branch-history
	perf test shell: Use a fallback to get the pathname in vfs_getname
	tools uapi: fix RISC-V 64-bit support
	riscv: fix trace_sys_exit hook
	cpufreq: check if policy is inactive early in __cpufreq_get()
	drm/bridge: tc358767: add bus flags
	drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE
	drm/bridge: tc358767: fix single lane configuration
	drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value
	drm/bridge: tc358767: reject modes which require too much BW
	drm/bridge: tc358767: fix output H/V syncs
	nvme-pci: use the same attributes when freeing host_mem_desc_bufs.
	nvme-pci: fix out of bounds access in nvme_cqe_pending
	nvme-multipath: zero out ANA log buffer
	nvme: pad fake subsys NQN vid and ssvid with zeros
	drm/amdgpu: set WRITE_BURST_LENGTH to 64B to workaround SDMA1 hang
	ARM: dts: da850-evm: Correct the audio codec regulators
	ARM: dts: da850-evm: Correct the sound card name
	ARM: dts: da850-lcdk: Correct the audio codec regulators
	ARM: dts: da850-lcdk: Correct the sound card name
	ARM: dts: kirkwood: Fix polarity of GPIO fan lines
	gpio: pl061: handle failed allocations
	drm/nouveau: Don't disable polling in fallback mode
	drm/nouveau/falcon: avoid touching registers if engine is off
	cifs: Limit memory used by lock request calls to a page
	kvm: sev: Fail KVM_SEV_INIT if already initialized
	CIFS: Do not assume one credit for async responses
	gpio: mxc: move gpio noirq suspend/resume to syscore phase
	Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G"
	Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK
	ARM: OMAP5+: Fix inverted nirq pin interrupts with irq_set_type
	perf/core: Fix impossible ring-buffer sizes warning
	perf/x86: Add check_period PMU callback
	ALSA: hda - Add quirk for HP EliteBook 840 G5
	ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
	ASoC: hdmi-codec: fix oops on re-probe
	tools uapi: fix Alpha support
	riscv: Add pte bit to distinguish swap from invalid
	x86/kvm/nVMX: read from MSR_IA32_VMX_PROCBASED_CTLS2 only when it is available
	kvm: vmx: Fix entry number check for add_atomic_switch_msr()
	mmc: sunxi: Filter out unsupported modes declared in the device tree
	mmc: block: handle complete_work on separate workqueue
	Input: bma150 - register input device after setting private data
	Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
	Revert "nfsd4: return default lease period"
	Revert "mm: don't reclaim inodes with many attached pages"
	Revert "mm: slowly shrink slabs with a relatively small number of objects"
	alpha: fix page fault handling for r16-r18 targets
	alpha: Fix Eiger NR_IRQS to 128
	s390/zcrypt: fix specification exception on z196 during ap probe
	tracing/uprobes: Fix output for multiple string arguments
	x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls
	scsi: sd: fix entropy gathering for most rotational disks
	signal: Restore the stop PTRACE_EVENT_EXIT
	md/raid1: don't clear bitmap bits on interrupted recovery.
	x86/a.out: Clear the dump structure initially
	dm crypt: don't overallocate the integrity tag space
	dm thin: fix bug where bio that overwrites thin block ignores FUA
	drm: Use array_size() when creating lease
	drm/vkms: Fix license inconsistent
	drm/i915: Block fbdev HPD processing during suspend
	drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set
	mm: proc: smaps_rollup: fix pss_locked calculation
	Linux 4.19.24

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-02-20 10:37:09 +01:00
Adrian Bunk
d4aaa45f2d eeprom: at24: add support for 24c2048
[ Upstream commit 37cf28d3b5 ]

Works with ST M24M02.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-02-20 10:25:35 +01:00
Greg Kroah-Hartman
0755dc9375 Merge 4.19.22 into android-4.19
Changes in 4.19.22
	mtd: Make sure mtd->erasesize is valid even if the partition is of size 0
	mtd: spinand: Handle the case where PROGRAM LOAD does not reset the cache
	mtd: spinand: Fix the error/cleanup path in spinand_init()
	mtd: rawnand: gpmi: fix MX28 bus master lockup problem
	libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD
	tools: iio: iio_generic_buffer: make num_loops signed
	iio: adc: axp288: Fix TS-pin handling
	iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius
	iio: ti-ads8688: Update buffer allocation for timestamps
	signal: Always notice exiting tasks
	signal: Better detection of synchronous signals
	misc: vexpress: Off by one in vexpress_syscfg_exec()
	mei: me: add ice lake point device id.
	samples: mei: use /dev/mei0 instead of /dev/mei
	debugfs: fix debugfs_rename parameter checking
	pinctrl: sunxi: Correct number of IRQ banks on H6 main pin controller
	pinctrl: cherryview: fix Strago DMI workaround
	tracing: uprobes: Fix typo in pr_fmt string
	mips: cm: reprime error cause
	MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled
	MIPS: VDSO: Use same -m%-float cflag as the kernel proper
	mips: loongson64: remove unreachable(), fix loongson_poweroff().
	MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds
	ARM: iop32x/n2100: fix PCI IRQ mapping
	ARM: tango: Improve ARCH_MULTIPLATFORM compatibility
	ARM: dts: da850: fix interrupt numbers for clocksource
	firmware: arm_scmi: provide the mandatory device release callback
	powerpc/radix: Fix kernel crash with mremap()
	mic: vop: Fix use-after-free on remove
	mac80211: ensure that mgmt tx skbs have tailroom for encryption
	drm/modes: Prevent division by zero htotal
	drm/amd/powerplay: Fix missing break in switch
	drm/i915: always return something on DDI clock selection
	drm/vmwgfx: Fix setting of dma masks
	drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
	SUNRPC: Always drop the XPRT_LOCK on XPRT_CLOSE_WAIT
	xfrm: Make set-mark default behavior backward compatible
	Revert "ext4: use ext4_write_inode() when fsyncing w/o a journal"
	libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
	xfrm: refine validation of template and selector families
	batman-adv: Avoid WARN on net_device without parent in netns
	batman-adv: Force mac header to start of data on xmit
	svcrdma: Reduce max_send_sges
	svcrdma: Remove max_sge check at connect time
	Linux 4.19.22

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-02-15 09:02:44 +01:00
Vincent Whitchurch
1ce0fcebff mic: vop: Fix use-after-free on remove
commit 70ed7148da upstream.

KASAN detects a use-after-free when vop devices are removed.

This problem was introduced by commit 0063e8bbd2 ("virtio_vop:
don't kfree device on register failure").  That patch moved the freeing
of the struct _vop_vdev to the release function, but failed to ensure
that vop holds a reference to the device when it doesn't want it to go
away.  A kfree() was replaced with a put_device() in the unregistration
path, but the last reference to the device is already dropped in
unregister_virtio_device() so the struct is freed before vop is done
with it.

Fix it by holding a reference until cleanup is done.  This is similar to
the fix in virtio_pci in commit 2989be09a8 ("virtio_pci: fix use
after free on release").

 ==================================================================
 BUG: KASAN: use-after-free in vop_scan_devices+0xc6c/0xe50 [vop]
 Read of size 8 at addr ffff88800da18580 by task kworker/0:1/12

 CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.0.0-rc4+ #53
 Workqueue: events vop_hotplug_devices [vop]
 Call Trace:
  dump_stack+0x74/0xbb
  print_address_description+0x5d/0x2b0
  ? vop_scan_devices+0xc6c/0xe50 [vop]
  kasan_report+0x152/0x1aa
  ? vop_scan_devices+0xc6c/0xe50 [vop]
  ? vop_scan_devices+0xc6c/0xe50 [vop]
  vop_scan_devices+0xc6c/0xe50 [vop]
  ? vop_loopback_free_irq+0x160/0x160 [vop_loopback]
  process_one_work+0x7c0/0x14b0
  ? pwq_dec_nr_in_flight+0x2d0/0x2d0
  ? do_raw_spin_lock+0x120/0x280
  worker_thread+0x8f/0xbf0
  ? __kthread_parkme+0x78/0xf0
  ? process_one_work+0x14b0/0x14b0
  kthread+0x2ae/0x3a0
  ? kthread_park+0x120/0x120
  ret_from_fork+0x3a/0x50

 Allocated by task 12:
  kmem_cache_alloc_trace+0x13a/0x2a0
  vop_scan_devices+0x473/0xe50 [vop]
  process_one_work+0x7c0/0x14b0
  worker_thread+0x8f/0xbf0
  kthread+0x2ae/0x3a0
  ret_from_fork+0x3a/0x50

 Freed by task 12:
  kfree+0x104/0x310
  device_release+0x73/0x1d0
  kobject_put+0x14f/0x420
  unregister_virtio_device+0x32/0x50
  vop_scan_devices+0x19d/0xe50 [vop]
  process_one_work+0x7c0/0x14b0
  worker_thread+0x8f/0xbf0
  kthread+0x2ae/0x3a0
  ret_from_fork+0x3a/0x50

 The buggy address belongs to the object at ffff88800da18008
  which belongs to the cache kmalloc-2k of size 2048
 The buggy address is located 1400 bytes inside of
  2048-byte region [ffff88800da18008, ffff88800da18808)
 The buggy address belongs to the page:
 page:ffffea0000368600 count:1 mapcount:0 mapping:ffff88801440dbc0 index:0x0 compound_mapcount: 0
 flags: 0x4000000000010200(slab|head)
 raw: 4000000000010200 ffffea0000378608 ffffea000037a008 ffff88801440dbc0
 raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffff88800da18480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff88800da18500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 >ffff88800da18580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                    ^
  ffff88800da18600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff88800da18680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ==================================================================

Fixes: 0063e8bbd2 ("virtio_vop: don't kfree device on register failure")
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-15 08:10:12 +01:00
Tomas Winkler
edd8fb55d7 mei: me: add ice lake point device id.
commit efe814e90b upstream.

Add icelake mei device id.

Cc: <stable@vger.kernel.org>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-15 08:10:11 +01:00
Dan Carpenter
db5f65bfc1 misc: vexpress: Off by one in vexpress_syscfg_exec()
commit f8a70d8b88 upstream.

The > comparison should be >= to prevent reading beyond the end of the
func->template[] array.

(The func->template array is allocated in vexpress_syscfg_regmap_init()
and it has func->num_templates elements.)

Fixes: 974cc7b934 ("mfd: vexpress: Define the device as MFD cells")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-15 08:10:11 +01:00
Tao Huang
60a5825e9c Merge remote branch 'android-4.19' of https://android.googlesource.com/kernel/common
* android-4.19: (206154 commits)
  Linux 4.19.20
  cifs: Always resolve hostname before reconnecting
  md/raid5: fix 'out of memory' during raid cache recovery
  of: overlay: do not duplicate properties from overlay for new nodes
  of: overlay: use prop add changeset entry for property in new nodes
  of: overlay: add missing of_node_get() in __of_attach_node_sysfs
  of: overlay: add tests to validate kfrees from overlay removal
  of: Convert to using %pOFn instead of device_node.name
  mm: migrate: don't rely on __PageMovable() of newpage after unlocking it
  mm: hwpoison: use do_send_sig_info() instead of force_sig()
  mm, oom: fix use-after-free in oom_kill_process
  mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages
  oom, oom_reaper: do not enqueue same task twice
  mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT
  kernel/exit.c: release ptraced tasks before zap_pid_ns_processes
  btrfs: On error always free subvol_name in btrfs_mount
  Btrfs: fix deadlock when allocating tree block during leaf/node split
  mmc: sdhci-iproc: handle mmc_of_parse() errors during probe
  platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes
  platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK
  ...

Conflicts:
	Documentation/devicetree/bindings/clock/rockchip,rk3399-cru.txt
	Documentation/devicetree/bindings/devfreq/event/rockchip-dfi.txt
	Documentation/devicetree/bindings/display/bridge/analogix_dp.txt
	Documentation/devicetree/bindings/display/rockchip/analogix_dp-rockchip.txt
	Documentation/devicetree/bindings/display/rockchip/dw_mipi_dsi_rockchip.txt
	Documentation/devicetree/bindings/display/rockchip/inno_hdmi-rockchip.txt
	Documentation/devicetree/bindings/display/rockchip/rockchip-lvds.txt
	Documentation/devicetree/bindings/media/i2c/ov2685.txt
	Documentation/devicetree/bindings/media/i2c/ov5695.txt
	Documentation/devicetree/bindings/media/i2c/ov7251.txt
	Documentation/devicetree/bindings/phy/phy-rockchip-inno-usb2.txt
	Documentation/devicetree/bindings/phy/phy-rockchip-typec.txt
	Documentation/devicetree/bindings/phy/rockchip-dp-phy.txt
	Documentation/devicetree/bindings/phy/rockchip-emmc-phy.txt
	Documentation/devicetree/bindings/soc/rockchip/grf.txt
	Documentation/devicetree/bindings/sound/rockchip,pdm.txt
	Documentation/devicetree/bindings/timer/rockchip,rk-timer.txt
	Documentation/devicetree/bindings/usb/rockchip,dwc3.txt
	arch/arm/boot/dts/rk3036-kylin.dts
	arch/arm/boot/dts/rk3036.dtsi
	arch/arm/boot/dts/rk3228-evb.dts
	arch/arm/boot/dts/rk3229-evb.dts
	arch/arm/boot/dts/rk322x.dtsi
	arch/arm/boot/dts/rk3288-fennec.dts
	arch/arm/boot/dts/rk3288-firefly-reload.dts
	arch/arm/boot/dts/rk3288-miqi.dts
	arch/arm/boot/dts/rk3288-phycore-rdk.dts
	arch/arm/boot/dts/rk3288-phycore-som.dtsi
	arch/arm/boot/dts/rv1108.dtsi
	arch/arm64/boot/dts/rockchip/rk3328-evb.dts
	arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
	arch/arm64/boot/dts/rockchip/rk3328.dtsi
	arch/arm64/boot/dts/rockchip/rk3368-evb.dtsi
	arch/arm64/boot/dts/rockchip/rk3368-geekbox.dts
	arch/arm64/boot/dts/rockchip/rk3368-px5-evb.dts
	arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
	arch/arm64/boot/dts/rockchip/rk3399-opp.dtsi
	arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
	arch/arm64/boot/dts/rockchip/rk3399.dtsi
	drivers/clk/rockchip/clk-ddr.c
	drivers/clk/rockchip/clk-half-divider.c
	drivers/clk/rockchip/clk-px30.c
	drivers/clk/rockchip/clk-rk3036.c
	drivers/clk/rockchip/clk-rk3128.c
	drivers/clk/rockchip/clk-rk3228.c
	drivers/clk/rockchip/clk-rk3328.c
	drivers/clk/rockchip/clk-rk3399.c
	drivers/clk/rockchip/clk-rv1108.c
	drivers/devfreq/event/rockchip-dfi.c
	drivers/gpu/drm/bridge/analogix/Kconfig
	drivers/gpu/drm/bridge/analogix/Makefile
	drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
	drivers/gpu/drm/bridge/analogix/analogix_dp_core.h
	drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
	drivers/gpu/drm/bridge/dumb-vga-dac.c
	drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
	drivers/gpu/drm/rockchip/cdn-dp-core.c
	drivers/gpu/drm/rockchip/cdn-dp-core.h
	drivers/gpu/drm/rockchip/cdn-dp-reg.c
	drivers/gpu/drm/rockchip/cdn-dp-reg.h
	drivers/gpu/drm/rockchip/dw-mipi-dsi.c
	drivers/gpu/drm/rockchip/inno_hdmi.c
	drivers/gpu/drm/rockchip/inno_hdmi.h
	drivers/gpu/drm/rockchip/rockchip_lvds.c
	drivers/gpu/drm/rockchip/rockchip_vop_reg.c
	drivers/gpu/drm/rockchip/rockchip_vop_reg.h
	drivers/hid/hid-alps.c
	drivers/iio/light/vl6180.c
	drivers/leds/leds-is31fl32xx.c
	drivers/media/cec/cec-adap.c
	drivers/media/cec/cec-api.c
	drivers/media/cec/cec-notifier.c
	drivers/media/i2c/ov5647.c
	drivers/media/i2c/ov5695.c
	drivers/media/i2c/ov7251.c
	drivers/media/platform/rockchip/rga/rga.c
	drivers/media/rc/ir-imon-decoder.c
	drivers/media/rc/serial_ir.c
	drivers/media/spi/Kconfig
	drivers/media/spi/Makefile
	drivers/media/v4l2-core/v4l2-fwnode.c
	drivers/net/phy/rockchip.c
	drivers/phy/rockchip/Kconfig
	drivers/phy/rockchip/Makefile
	drivers/phy/rockchip/phy-rockchip-emmc.c
	drivers/phy/rockchip/phy-rockchip-inno-usb2.c
	drivers/phy/rockchip/phy-rockchip-typec.c
	drivers/phy/rockchip/phy-rockchip-usb.c
	drivers/pinctrl/pinctrl-rk805.c
	drivers/power/reset/reboot-mode.c
	drivers/soc/rockchip/grf.c
	drivers/usb/dwc3/dwc3-of-simple.c
	drivers/usb/gadget/udc/core.c
	include/drm/bridge/analogix_dp.h
	include/dt-bindings/clock/px30-cru.h
	include/dt-bindings/clock/rk3036-cru.h
	include/dt-bindings/clock/rk3128-cru.h
	include/dt-bindings/clock/rk3228-cru.h
	include/dt-bindings/clock/rk3328-cru.h
	include/dt-bindings/clock/rk3399-cru.h
	include/dt-bindings/power/px30-power.h
	include/dt-bindings/power/rk3036-power.h
	include/dt-bindings/power/rk3228-power.h
	include/media/cec-notifier.h
	include/soc/rockchip/rockchip_sip.h
	include/sound/hdmi-codec.h
	sound/soc/codecs/hdmi-codec.c
	sound/soc/rockchip/rockchip_pdm.c
	sound/soc/rockchip/rockchip_pdm.h

Signed-off-by: Tao Huang <huangtao@rock-chips.com>
2019-02-14 11:48:20 +08:00
Tao Huang
135b29c75f rk: revert to v4.4
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
2019-02-10 00:33:21 +08:00
Greg Kroah-Hartman
18ba00a34e Merge 4.19.19 into android-4.19
Changes in 4.19.19
	amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs
	net: bridge: Fix ethernet header pointer before check skb forwardable
	net: Fix usage of pskb_trim_rcsum
	net: phy: marvell: Errata for mv88e6390 internal PHYs
	net: phy: mdio_bus: add missing device_del() in mdiobus_register() error handling
	net/sched: act_tunnel_key: fix memory leak in case of action replace
	net_sched: refetch skb protocol for each filter
	openvswitch: Avoid OOB read when parsing flow nlattrs
	vhost: log dirty page correctly
	mlxsw: pci: Increase PCI SW reset timeout
	net: ipv4: Fix memory leak in network namespace dismantle
	mlxsw: spectrum_fid: Update dummy FID index
	mlxsw: pci: Ring CQ's doorbell before RDQ's
	net/sched: cls_flower: allocate mask dynamically in fl_change()
	udp: with udp_segment release on error path
	ip6_gre: fix tunnel list corruption for x-netns
	erspan: build the header with the right proto according to erspan_ver
	net: phy: marvell: Fix deadlock from wrong locking
	ip6_gre: update version related info when changing link
	tcp: allow MSG_ZEROCOPY transmission also in CLOSE_WAIT state
	mei: me: mark LBG devices as having dma support
	mei: me: add denverton innovation engine device IDs
	USB: leds: fix regression in usbport led trigger
	USB: serial: simple: add Motorola Tetra TPG2200 device id
	USB: serial: pl2303: add new PID to support PL2303TB
	ceph: clear inode pointer when snap realm gets dropped by its inode
	ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages
	ASoC: rt5514-spi: Fix potential NULL pointer dereference
	ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode
	clk: socfpga: stratix10: fix rate calculation for pll clocks
	clk: socfpga: stratix10: fix naming convention for the fixed-clocks
	inotify: Fix fd refcount leak in inotify_add_watch().
	ALSA: hda/realtek - Fix typo for ALC225 model
	ALSA: hda - Add mute LED support for HP ProBook 470 G5
	ARCv2: lib: memeset: fix doing prefetchw outside of buffer
	ARC: adjust memblock_reserve of kernel memory
	ARC: perf: map generic branches to correct hardware condition
	s390/mm: always force a load of the primary ASCE on context switch
	s390/early: improve machine detection
	s390/smp: fix CPU hotplug deadlock with CPU rescan
	misc: ibmvsm: Fix potential NULL pointer dereference
	char/mwave: fix potential Spectre v1 vulnerability
	mmc: dw_mmc-bluefield: : Fix the license information
	mmc: meson-gx: Free irq in release() callback
	staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1
	tty: Handle problem if line discipline does not have receive_buf
	uart: Fix crash in uart_write and uart_put_char
	tty/n_hdlc: fix __might_sleep warning
	hv_balloon: avoid touching uninitialized struct page during tail onlining
	Drivers: hv: vmbus: Check for ring when getting debug info
	vgacon: unconfuse vc_origin when using soft scrollback
	CIFS: Fix possible hang during async MTU reads and writes
	CIFS: Fix credits calculations for reads with errors
	CIFS: Fix credit calculation for encrypted reads with errors
	CIFS: Do not reconnect TCP session in add_credits()
	smb3: add credits we receive from oplock/break PDUs
	Input: xpad - add support for SteelSeries Stratus Duo
	Input: input_event - provide override for sparc64
	Input: uinput - fix undefined behavior in uinput_validate_absinfo()
	acpi/nfit: Block function zero DSMs
	acpi/nfit: Fix command-supported detection
	scsi: ufs: Use explicit access size in ufshcd_dump_regs
	dm thin: fix passdown_double_checking_shared_status()
	dm crypt: fix parsing of extended IV arguments
	drm/amdgpu: Add APTX quirk for Lenovo laptop
	KVM: x86: Fix single-step debugging
	KVM: x86: Fix PV IPIs for 32-bit KVM host
	KVM: x86: WARN_ONCE if sending a PV IPI returns a fatal error
	kvm: x86/vmx: Use kzalloc for cached_vmcs12
	KVM/nVMX: Do not validate that posted_intr_desc_addr is page aligned
	x86/pkeys: Properly copy pkey state at fork()
	x86/selftests/pkeys: Fork() to check for state being preserved
	x86/kaslr: Fix incorrect i8254 outb() parameters
	x86/entry/64/compat: Fix stack switching for XEN PV
	posix-cpu-timers: Unbreak timer rearming
	net: sun: cassini: Cleanup license conflict
	irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size
	can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it
	can: bcm: check timer values before ktime conversion
	can: flexcan: fix NULL pointer exception during bringup
	vt: make vt_console_print() compatible with the unicode screen buffer
	vt: always call notifier with the console lock held
	vt: invoke notifier on screen size change
	drm/meson: Fix atomic mode switching regression
	bpf: improve verifier branch analysis
	bpf: add per-insn complexity limit
	bpf: move {prev_,}insn_idx into verifier env
	bpf: move tmp variable into ax register in interpreter
	bpf: enable access to ax register also from verifier rewrite
	bpf: restrict map value pointer arithmetic for unprivileged
	bpf: restrict stack pointer arithmetic for unprivileged
	bpf: restrict unknown scalars of mixed signed bounds for unprivileged
	bpf: fix check_map_access smin_value test when pointer contains offset
	bpf: prevent out of bounds speculation on pointer arithmetic
	bpf: fix sanitation of alu op with pointer / scalar type from different paths
	bpf: fix inner map masking to prevent oob under speculation
	s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU
	nvmet-rdma: Add unlikely for response allocated check
	nvmet-rdma: fix null dereference under heavy load
	Revert "mm, memory_hotplug: initialize struct pages for the full memory section"
	usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup
	ide: fix a typo in the settings proc file name
	Input: input_event - fix the CONFIG_SPARC64 mixup
	Linux 4.19.19

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-01-31 08:29:40 +01:00
Gustavo A. R. Silva
0479bdbf55 misc: ibmvsm: Fix potential NULL pointer dereference
commit e25df7812c upstream.

There is a potential NULL pointer dereference in case kzalloc()
fails and returns NULL.

Fix this by adding a NULL check on *session*

Also, update the function header with information about the
expected return on failure and remove unnecessary variable rc.

This issue was detected with the help of Coccinelle.

Fixes: 0eca353e7a ("misc: IBM Virtual Management Channel Driver (VMC)")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-31 08:14:35 +01:00
Tomas Winkler
f8982204cb mei: me: add denverton innovation engine device IDs
commit f7ee8ead15 upstream.

Add the Denverton innovation engine (IE) device ids.
The IE is an ME-like device which provides HW security
offloading.

Cc: <stable@vger.kernel.org>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-31 08:14:34 +01:00
Alexander Usyskin
adfda26bdf mei: me: mark LBG devices as having dma support
commit 173436ba80 upstream.

The LBG server platform sports DMA support.

Cc: <stable@vger.kernel.org> #v5.0+
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-31 08:14:33 +01:00
Greg Kroah-Hartman
caf54339d3 Merge 4.19.15 into android-4.19
Changes in 4.19.15
	ARM: dts: sun8i: a83t: bananapi-m3: increase vcc-pd voltage to 3.3V
	pinctrl: meson: fix pull enable register calculation
	arm64: dts: mt7622: fix no more console output on rfb1
	powerpc: Fix COFF zImage booting on old powermacs
	powerpc/mm: Fix linux page tables build with some configs
	HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk
	ARM: dts: imx7d-pico: Describe the Wifi clock
	ARM: imx: update the cpu power up timing setting on i.mx6sx
	ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
	IB/mlx5: Block DEVX umem from the non applicable cases
	Input: restore EV_ABS ABS_RESERVED
	powerpc/mm: Fallback to RAM if the altmap is unusable
	drm/amdgpu: Fix DEBUG_LOCKS_WARN_ON(depth <= 0) in amdgpu_ctx.lock
	IB/core: Fix oops in netdev_next_upper_dev_rcu()
	checkstack.pl: fix for aarch64
	xfrm: Fix error return code in xfrm_output_one()
	xfrm: Fix bucket count reported to userspace
	xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.
	ieee802154: hwsim: fix off-by-one in parse nested
	netfilter: nf_tables: fix suspicious RCU usage in nft_chain_stats_replace()
	netfilter: seqadj: re-load tcp header pointer after possible head reallocation
	Revert "scsi: qla2xxx: Fix NVMe Target discovery"
	scsi: bnx2fc: Fix NULL dereference in error handling
	Input: omap-keypad - fix idle configuration to not block SoC idle states
	Input: synaptics - enable RMI on ThinkPad T560
	ibmvnic: Convert reset work item mutex to spin lock
	ibmvnic: Fix non-atomic memory allocation in IRQ context
	ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
	x86/mm: Fix guard hole handling
	x86/dump_pagetables: Fix LDT remap address marker
	i40e: fix mac filter delete when setting mac address
	ixgbe: Fix race when the VF driver does a reset
	netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
	netfilter: nat: can't use dst_hold on noref dst
	netfilter: nf_conncount: use rb_link_node_rcu() instead of rb_link_node()
	bnx2x: Clear fip MAC when fcoe offload support is disabled
	bnx2x: Remove configured vlans as part of unload sequence.
	bnx2x: Send update-svid ramrod with retry/poll flags enabled
	scsi: target: iscsi: cxgbit: fix csk leak
	scsi: target: iscsi: cxgbit: add missing spin_lock_init()
	mt76: fix potential NULL pointer dereference in mt76_stop_tx_queues
	x86, hyperv: remove PCI dependency
	drivers: net: xgene: Remove unnecessary forward declarations
	net/tls: Init routines in create_ctx
	w90p910_ether: remove incorrect __init annotation
	net: hns: Incorrect offset address used for some registers.
	net: hns: All ports can not work when insmod hns ko after rmmod.
	net: hns: Some registers use wrong address according to the datasheet.
	net: hns: Fixed bug that netdev was opened twice
	net: hns: Clean rx fbd when ae stopped.
	net: hns: Free irq when exit from abnormal branch
	net: hns: Avoid net reset caused by pause frames storm
	net: hns: Fix ntuple-filters status error.
	net: hns: Add mac pcs config when enable|disable mac
	net: hns: Fix ping failed when use net bridge and send multicast
	mac80211: fix a kernel panic when TXing after TXQ teardown
	SUNRPC: Fix a race with XPRT_CONNECTING
	qed: Fix an error code qed_ll2_start_xmit()
	net: macb: fix random memory corruption on RX with 64-bit DMA
	net: macb: fix dropped RX frames due to a race
	net: macb: add missing barriers when reading descriptors
	lan743x: Expand phy search for LAN7431
	lan78xx: Resolve issue with changing MAC address
	vxge: ensure data0 is initialized in when fetching firmware version information
	nl80211: fix memory leak if validate_pae_over_nl80211() fails
	mac80211: free skb fraglist before freeing the skb
	kbuild: fix false positive warning/error about missing libelf
	m68k: Fix memblock-related crashes
	virtio: fix test build after uio.h change
	lan743x: Remove MAC Reset from initialization
	gpio: mvebu: only fail on missing clk if pwm is actually to be used
	Input: synaptics - enable SMBus for HP EliteBook 840 G4
	net: netxen: fix a missing check and an uninitialized use
	qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
	serial/sunsu: fix refcount leak
	auxdisplay: charlcd: fix x/y command parsing
	scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
	scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid
	fork: record start_time late
	zram: fix double free backing device
	hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
	mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
	mm, devm_memremap_pages: kill mapping "System RAM" support
	mm, devm_memremap_pages: fix shutdown handling
	mm, devm_memremap_pages: add MEMORY_DEVICE_PRIVATE support
	mm, hmm: use devm semantics for hmm_devmem_{add, remove}
	mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL
	mm, swap: fix swapoff with KSM pages
	memcg, oom: notify on oom killer invocation from the charge path
	sunrpc: fix cache_head leak due to queued request
	sunrpc: use SVC_NET() in svcauth_gss_* functions
	powerpc: remove old GCC version checks
	powerpc: consolidate -mno-sched-epilog into FTRACE flags
	powerpc: avoid -mno-sched-epilog on GCC 4.9 and newer
	powerpc: Disable -Wbuiltin-requires-header when setjmp is used
	kbuild: add -no-integrated-as Clang option unconditionally
	kbuild: consolidate Clang compiler flags
	Makefile: Export clang toolchain variables
	powerpc/boot: Set target when cross-compiling for clang
	raid6/ppc: Fix build for clang
	dma-direct: do not include SME mask in the DMA supported check
	mt76x0: init hw capabilities
	media: cx23885: only reset DMA on problematic CPUs
	ALSA: cs46xx: Potential NULL dereference in probe
	ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
	ALSA: usb-audio: Check mixer unit descriptors more strictly
	ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
	ALSA: usb-audio: Always check descriptor sizes in parser code
	srcu: Lock srcu_data structure in srcu_gp_start()
	driver core: Add missing dev->bus->need_parent_lock checks
	Fix failure path in alloc_pid()
	block: deactivate blk_stat timer in wbt_disable_default()
	block: mq-deadline: Fix write completion handling
	dlm: fixed memory leaks after failed ls_remove_names allocation
	dlm: possible memory leak on error path in create_lkb()
	dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
	dlm: memory leaks on error path in dlm_user_request()
	gfs2: Get rid of potential double-freeing in gfs2_create_inode
	gfs2: Fix loop in gfs2_rbm_find
	b43: Fix error in cordic routine
	selinux: policydb - fix byte order and alignment issues
	PCI / PM: Allow runtime PM without callback functions
	lockd: Show pid of lockd for remote locks
	nfsd4: zero-length WRITE should succeed
	arm64: drop linker script hack to hide __efistub_ symbols
	arm64: relocatable: fix inconsistencies in linker script and options
	leds: pwm: silently error out on EPROBE_DEFER
	Revert "powerpc/tm: Unset MSR[TS] if not recheckpointing"
	powerpc/tm: Set MSR[TS] just prior to recheckpoint
	iio: dac: ad5686: fix bit shift read register
	9p/net: put a lower bound on msize
	rxe: fix error completion wr_id and qp_num
	RDMA/srpt: Fix a use-after-free in the channel release code
	iommu/vt-d: Handle domain agaw being less than iommu agaw
	sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b
	ceph: don't update importing cap's mseq when handing cap export
	video: fbdev: pxafb: Fix "WARNING: invalid free of devm_ allocated data"
	drivers/perf: hisi: Fixup one DDRC PMU register offset
	genwqe: Fix size check
	intel_th: msu: Fix an off-by-one in attribute store
	power: supply: olpc_battery: correct the temperature units
	of: of_node_get()/of_node_put() nodes held in phandle cache
	of: __of_detach_node() - remove node from phandle cache
	lib: fix build failure in CONFIG_DEBUG_VIRTUAL test
	drm/nouveau/drm/nouveau: Check rc from drm_dp_mst_topology_mgr_resume()
	drm/vc4: Set ->is_yuv to false when num_planes == 1
	drm/rockchip: psr: do not dereference encoder before it is null checked.
	drm/amd/display: Fix unintialized max_bpc state values
	bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw
	Linux 4.19.15

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-01-13 10:25:45 +01:00
Christian Borntraeger
998c3537af genwqe: Fix size check
commit fdd6696846 upstream.

Calling the test program genwqe_cksum with the default buffer size of
2MB triggers the following kernel warning on s390:

WARNING: CPU: 30 PID: 9311 at mm/page_alloc.c:3189 __alloc_pages_nodemask+0x45c/0xbe0
CPU: 30 PID: 9311 Comm: genwqe_cksum Kdump: loaded Not tainted 3.10.0-957.el7.s390x #1
task: 00000005e5d13980 ti: 00000005e7c6c000 task.ti: 00000005e7c6c000
Krnl PSW : 0704c00180000000 00000000002780ac (__alloc_pages_nodemask+0x45c/0xbe0)
           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 EA:3
Krnl GPRS: 00000000002932b8 0000000000b73d7c 0000000000000010 0000000000000009
           0000000000000041 00000005e7c6f9b8 0000000000000001 00000000000080d0
           0000000000000000 0000000000b70500 0000000000000001 0000000000000000
           0000000000b70528 00000000007682c0 0000000000277df2 00000005e7c6f9a0
Krnl Code: 000000000027809e: de7195001000	ed	1280(114,%r9),0(%r1)
	   00000000002780a4: a774fead		brc	7,277dfe
	  #00000000002780a8: a7f40001		brc	15,2780aa
	  >00000000002780ac: 92011000		mvi	0(%r1),1
	   00000000002780b0: a7f4fea7		brc	15,277dfe
	   00000000002780b4: 9101c6b6		tm	1718(%r12),1
	   00000000002780b8: a784ff3a		brc	8,277f2c
	   00000000002780bc: a7f4fe2e		brc	15,277d18
Call Trace:
([<0000000000277df2>] __alloc_pages_nodemask+0x1a2/0xbe0)
 [<000000000013afae>] s390_dma_alloc+0xfe/0x310
 [<000003ff8065f362>] __genwqe_alloc_consistent+0xfa/0x148 [genwqe_card]
 [<000003ff80658f7a>] genwqe_mmap+0xca/0x248 [genwqe_card]
 [<00000000002b2712>] mmap_region+0x4e2/0x778
 [<00000000002b2c54>] do_mmap+0x2ac/0x3e0
 [<0000000000292d7e>] vm_mmap_pgoff+0xd6/0x118
 [<00000000002b081c>] SyS_mmap_pgoff+0xdc/0x268
 [<00000000002b0a34>] SyS_old_mmap+0x8c/0xb0
 [<000000000074e518>] sysc_tracego+0x14/0x1e
 [<000003ffacf87dc6>] 0x3ffacf87dc6

turns out the check in __genwqe_alloc_consistent uses "> MAX_ORDER"
while the mm code uses ">= MAX_ORDER". Fix genwqe.

Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Frank Haverkamp <haver@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-13 09:51:10 +01:00
Greg Kroah-Hartman
8735c21738 Merge 4.19.14 into android-4.19
Changes in 4.19.14
	ax25: fix a use-after-free in ax25_fillin_cb()
	gro_cell: add napi_disable in gro_cells_destroy
	ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
	ieee802154: lowpan_header_create check must check daddr
	ip6mr: Fix potential Spectre v1 vulnerability
	ipv4: Fix potential Spectre v1 vulnerability
	ipv6: explicitly initialize udp6_addr in udp_sock_create6()
	ipv6: tunnels: fix two use-after-free
	ip: validate header length on virtual device xmit
	isdn: fix kernel-infoleak in capi_unlocked_ioctl
	net: clear skb->tstamp in forwarding paths
	net/hamradio/6pack: use mod_timer() to rearm timers
	net: ipv4: do not handle duplicate fragments as overlapping
	net: macb: restart tx after tx used bit read
	net: mvpp2: 10G modes aren't supported on all ports
	net: phy: Fix the issue that netif always links up after resuming
	netrom: fix locking in nr_find_socket()
	net/smc: fix TCP fallback socket release
	net: stmmac: Fix an error code in probe()
	net/tls: allocate tls context using GFP_ATOMIC
	net/wan: fix a double free in x25_asy_open_tty()
	packet: validate address length
	packet: validate address length if non-zero
	ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
	qmi_wwan: Added support for Fibocom NL668 series
	qmi_wwan: Added support for Telit LN940 series
	qmi_wwan: Add support for Fibocom NL678 series
	sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
	sock: Make sock->sk_stamp thread-safe
	tcp: fix a race in inet_diag_dump_icsk()
	tipc: check tsk->group in tipc_wait_for_cond()
	tipc: compare remote and local protocols in tipc_udp_enable()
	tipc: fix a double free in tipc_enable_bearer()
	tipc: fix a double kfree_skb()
	tipc: use lock_sock() in tipc_sk_reinit()
	vhost: make sure used idx is seen before log in vhost_add_used_n()
	VSOCK: Send reset control packet when socket is partially bound
	xen/netfront: tolerate frags with no data
	net/mlx5: Typo fix in del_sw_hw_rule
	tipc: check group dests after tipc_wait_for_cond()
	net/mlx5e: Remove the false indication of software timestamping support
	ipv6: frags: Fix bogus skb->sk in reassembled packets
	net/ipv6: Fix a test against 'ipv6_find_idev()' return value
	nfp: flower: ensure TCP flags can be placed in IPv6 frame
	ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error
	mscc: Configured MAC entries should be locked.
	net/mlx5e: Cancel DIM work on close SQ
	net/mlx5e: RX, Verify MPWQE stride size is in range
	net: mvpp2: fix the phylink mode validation
	qed: Fix command number mismatch between driver and the mfw
	mlxsw: core: Increase timeout during firmware flash process
	net/mlx5e: Remove unused UDP GSO remaining counter
	net/mlx5e: RX, Fix wrong early return in receive queue poll
	net: mvneta: fix operation for 64K PAGE_SIZE
	net: Use __kernel_clockid_t in uapi net_stamp.h
	r8169: fix WoL device wakeup enable
	IB/hfi1: Incorrect sizing of sge for PIO will OOPs
	ALSA: rme9652: Fix potential Spectre v1 vulnerability
	ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
	ALSA: pcm: Fix potential Spectre v1 vulnerability
	ALSA: emux: Fix potential Spectre v1 vulnerabilities
	powerpc/fsl: Fix spectre_v2 mitigations reporting
	mtd: atmel-quadspi: disallow building on ebsa110
	mtd: rawnand: marvell: prevent timeouts on a loaded machine
	mtd: rawnand: omap2: Pass the parent of pdev to dma_request_chan()
	ALSA: hda: add mute LED support for HP EliteBook 840 G4
	ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294
	ALSA: fireface: fix for state to fetch PCM frames
	ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet
	ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header' tracepoint
	ALSA: firewire-lib: use the same print format for 'without_header' tracepoints
	ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops
	ALSA: hda/tegra: clear pending irq handlers
	usb: dwc2: host: use hrtimer for NAK retries
	USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
	USB: serial: option: add Fibocom NL678 series
	usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
	usb: dwc2: disable power_down on Amlogic devices
	Revert "usb: dwc3: pci: Use devm functions to get the phy GPIOs"
	usb: roles: Add a description for the class to Kconfig
	media: dvb-usb-v2: Fix incorrect use of transfer_flags URB_FREE_BUFFER
	staging: wilc1000: fix missing read_write setting when reading data
	ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Clapper
	ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Gnawty
	s390/pci: fix sleeping in atomic during hotplug
	Input: atmel_mxt_ts - don't try to free unallocated kernel memory
	Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
	x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
	x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init()
	KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
	arm64: KVM: Make VHE Stage-2 TLB invalidation operations non-interruptible
	KVM: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails
	platform-msi: Free descriptors in platform_msi_domain_free()
	drm/v3d: Skip debugfs dumping GCA on platforms without GCA.
	DRM: UDL: get rid of useless vblank initialization
	clocksource/drivers/arc_timer: Utilize generic sched_clock
	perf machine: Record if a arch has a single user/kernel address space
	perf thread: Add fallback functions for cases where cpumode is insufficient
	perf tools: Use fallback for sample_addr_correlates_sym() cases
	perf script: Use fallbacks for branch stacks
	perf pmu: Suppress potential format-truncation warning
	perf env: Also consider env->arch == NULL as local operation
	ocxl: Fix endiannes bug in ocxl_link_update_pe()
	ocxl: Fix endiannes bug in read_afu_name()
	ext4: add ext4_sb_bread() to disambiguate ENOMEM cases
	ext4: fix possible use after free in ext4_quota_enable
	ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
	ext4: fix EXT4_IOC_GROUP_ADD ioctl
	ext4: include terminating u32 in size of xattr entries when expanding inodes
	ext4: avoid declaring fs inconsistent due to invalid file handles
	ext4: force inode writes when nfsd calls commit_metadata()
	ext4: check for shutdown and r/o file system in ext4_write_inode()
	spi: bcm2835: Fix race on DMA termination
	spi: bcm2835: Fix book-keeping of DMA termination
	spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
	clk: rockchip: fix typo in rk3188 spdif_frac parent
	clk: sunxi-ng: Use u64 for calculation of NM rate
	crypto: cavium/nitrox - fix a DMA pool free failure
	crypto: chcr - small packet Tx stalls the queue
	crypto: testmgr - add AES-CFB tests
	crypto: cfb - fix decryption
	cgroup: fix CSS_TASK_ITER_PROCS
	cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
	btrfs: dev-replace: go back to suspended state if target device is missing
	btrfs: dev-replace: go back to suspend state if another EXCL_OP is running
	btrfs: skip file_extent generation check for free_space_inode in run_delalloc_nocow
	Btrfs: fix fsync of files with multiple hard links in new directories
	btrfs: run delayed items before dropping the snapshot
	Btrfs: send, fix race with transaction commits that create snapshots
	brcmfmac: fix roamoff=1 modparam
	brcmfmac: Fix out of bounds memory access during fw load
	powerpc/tm: Unset MSR[TS] if not recheckpointing
	dax: Don't access a freed inode
	dax: Use non-exclusive wait in wait_entry_unlocked()
	f2fs: read page index before freeing
	f2fs: fix validation of the block count in sanity_check_raw_super
	f2fs: sanity check of xattr entry size
	serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly
	media: cec: keep track of outstanding transmits
	media: cec-pin: fix broken tx_ignore_nack_until_eom error injection
	media: rc: cec devices do not have a lirc chardev
	media: imx274: fix stack corruption in imx274_read_reg
	media: vivid: free bitmap_cap when updating std/timings/etc.
	media: vb2: check memory model for VIDIOC_CREATE_BUFS
	media: v4l2-tpg: array index could become negative
	tools lib traceevent: Fix processing of dereferenced args in bprintk events
	MIPS: math-emu: Write-protect delay slot emulation pages
	MIPS: c-r4k: Add r4k_blast_scache_node for Loongson-3
	MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
	MIPS: Align kernel load address to 64KB
	MIPS: Expand MIPS32 ASIDs to 64 bits
	MIPS: OCTEON: mark RGMII interface disabled on OCTEON III
	MIPS: Fix a R10000_LLSC_WAR logic in atomic.h
	CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
	smb3: fix large reads on encrypted connections
	arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1
	arm/arm64: KVM: vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs
	ARM: dts: exynos: Specify I2S assigned clocks in proper node
	rtc: m41t80: Correct alarm month range with RTC reads
	KVM: arm/arm64: vgic: Do not cond_resched_lock() with IRQs disabled
	KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum
	KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring state
	KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq()
	iommu/arm-smmu-v3: Fix big-endian CMD_SYNC writes
	arm64: compat: Avoid sending SIGILL for unallocated syscall numbers
	tpm: tpm_try_transmit() refactor error flow.
	tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
	spi: bcm2835: Unbreak the build of esoteric configs
	MIPS: Only include mmzone.h when CONFIG_NEED_MULTIPLE_NODES=y
	Linux 4.19.14

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-01-09 18:55:03 +01:00
Greg Kurz
6665481e1c ocxl: Fix endiannes bug in read_afu_name()
commit 2f07229f02 upstream.

The AFU Descriptor Template in the PCI config space has a Name Space
field which is a 24 Byte ASCII character string of descriptive name
space for the AFU. The OCXL driver read the string four characters at
a time with pci_read_config_dword().

This optimization is valid on a little-endian system since this is PCI,
but a big-endian system ends up with each subset of four characters in
reverse order.

This could be fixed by switching to read characters one by one. Another
option is to swap the bytes if we're big-endian.

Go for the latter with le32_to_cpu().

Cc: stable@vger.kernel.org      # v4.16
Signed-off-by: Greg Kurz <groug@kaod.org>
Acked-by: Frederic Barrat <fbarrat@linux.ibm.com>
Acked-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-09 17:38:43 +01:00
Greg Kurz
3fbf78b252 ocxl: Fix endiannes bug in ocxl_link_update_pe()
commit e1e71e2017 upstream.

All fields in the PE are big-endian. Use cpu_to_be32() like everywhere
else something is written to the PE. Otherwise a wrong TID will be used
by the NPU. If this TID happens to point to an existing thread sharing
the same mm, it could be woken up by error. This is highly improbable
though. The likely outcome of this is the NPU not finding the target
thread and forcing the AFU into sending an interrupt, which userspace
is supposed to handle anyway.

Fixes: e948e06fc6 ("ocxl: Expose the thread_id needed for wait on POWER9")
Cc: stable@vger.kernel.org      # v4.18
Signed-off-by: Greg Kurz <groug@kaod.org>
Acked-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-09 17:38:43 +01:00
Tao Huang
04026c23c8 Merge branch 'linux-linaro-lsk-v4.4-android' of git://git.linaro.org/kernel/linux-linaro-stable.git
* linux-linaro-lsk-v4.4-android: (812 commits)
  Linux 4.4.167
  mac80211: ignore NullFunc frames in the duplicate detection
  mac80211: fix reordering of buffered broadcast packets
  mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext
  mac80211: Clear beacon_int in ieee80211_do_stop
  mac80211_hwsim: Timer should be initialized before device registered
  kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()
  tty: serial: 8250_mtk: always resume the device in probe.
  cifs: Fix separator when building path from dentry
  Staging: lustre: remove two build warnings
  xhci: Prevent U1/U2 link pm states if exit latency is too long
  SUNRPC: Fix leak of krb5p encode pages
  virtio/s390: fix race in ccw_io_helper()
  virtio/s390: avoid race on vcdev->config
  ALSA: pcm: Fix interval evaluation with openmin/max
  ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
  ALSA: pcm: Fix starvation on down_write_nonblock()
  ALSA: hda: Add support for AMD Stoney Ridge
  ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
  USB: check usb_get_extra_descriptor for proper size
  ...

Conflicts:
	drivers/gpu/drm/rockchip/rockchip_drm_drv.c
	drivers/usb/host/xhci-ring.c

Change-Id: I4304b0875908403a7d88a0d77da52cea04563c11
2018-12-19 18:46:58 +08:00
Mark Brown
b6b5ee6576 Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android 2018-12-14 11:52:31 +00:00
Mark Brown
5f783fd0a8 Merge tag 'v4.4.167' into linux-linaro-lsk-v4.4
This is the 4.4.167 stable release
2018-12-14 11:11:33 +00:00
YueHaibing
1cbec2e9d2 misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
commit 6484a67729 upstream.

gcc '-Wunused-but-set-variable' warning:

drivers/misc/mic/scif/scif_rma.c: In function 'scif_create_remote_lookup':
drivers/misc/mic/scif/scif_rma.c:373:25: warning:
 variable 'vmalloc_num_pages' set but not used [-Wunused-but-set-variable]

'vmalloc_num_pages' should be used to determine if the address is
within the vmalloc range.

Fixes: ba612aa8b4 ("misc: mic: SCIF memory registration and unregistration")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-13 09:21:27 +01:00
Amit Pundir
770f7163da Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
* linux-linaro-lsk-v4.4: (622 commits)
  Linux 4.4.166
  drm/ast: Remove existing framebuffers before loading driver
  s390/mm: Check for valid vma before zapping in gmap_discard
  namei: allow restricted O_CREAT of FIFOs and regular files
  sched/core: Allow __sched_setscheduler() in interrupts when PI is not used
  btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
  usb: xhci: fix uninitialized completion when USB3 port got wrong status
  tty: wipe buffer if not echoing data
  tty: wipe buffer.
  iwlwifi: mvm: fix regulatory domain update when the firmware starts
  scsi: qla2xxx: do not queue commands when unloading
  scsi: ufshcd: release resources if probe fails
  scsi: ufs: fix race between clock gating and devfreq scaling work
  scsi: ufshcd: Fix race between clk scaling and ungate work
  scsi: ufs: fix bugs related to null pointer access and array size
  netfilter: nf_tables: fix oops when inserting an element into a verdict map
  mwifiex: fix p2p device doesn't find in scan problem
  mwifiex: Fix NULL pointer dereference in skb_dequeue()
  cw1200: Don't leak memory if krealloc failes
  Input: xpad - add support for Xbox1 PDP Camo series gamepad
  ...

  Conflicts:
    Makefile
    arch/x86/Makefile
    drivers/base/power/main.c
    drivers/block/zram/zram_drv.c
    kernel/debug/kdb/kdb_io.c
    net/ipv6/route.c
    scripts/Kbuild.include
      Conflicts in above files are fixed as done in AOSP Change-Id:
      I5bd20327e0c1139c46f74e8d5916fa0530a307d3 ("Merge 4.4.165 into android-4.4").

    arch/arm64/include/asm/cpufeature.h
    arch/arm64/kernel/cpufeature.c
      Conflicts in above files is due to AOSP Change-Id:
      I11cb874d12a7d0921f452c62b0752e0028a8e0a7 ("FROMLIST: arm64: entry: Add
      fake CPU feature for unmapping the kernel at EL0"), which needed a minor
      rebasing.

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2018-12-11 00:07:21 +05:30
Greg Kroah-Hartman
c454ec1e21 Merge 4.19.7 into android-4.19
Changes in 4.19.7
	mm/huge_memory: rename freeze_page() to unmap_page()
	mm/huge_memory: splitting set mapping+index before unfreeze
	mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()
	mm/khugepaged: collapse_shmem() stop if punched or truncated
	mm/khugepaged: fix crashes due to misaccounted holes
	mm/khugepaged: collapse_shmem() remember to clear holes
	mm/khugepaged: minor reorderings in collapse_shmem()
	mm/khugepaged: collapse_shmem() without freezing new_page
	mm/khugepaged: collapse_shmem() do not crash on Compound
	lan743x: Enable driver to work with LAN7431
	lan743x: fix return value for lan743x_tx_napi_poll
	net: don't keep lonely packets forever in the gro hash
	net: gemini: Fix copy/paste error
	net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue
	packet: copy user buffers before orphan or clone
	rapidio/rionet: do not free skb before reading its length
	s390/qeth: fix length check in SNMP processing
	usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
	net: thunderx: set xdp_prog to NULL if bpf_prog_add fails
	net: skb_scrub_packet(): Scrub offload_fwd_mark
	virtio-net: disable guest csum during XDP set
	virtio-net: fail XDP set if guest csum is negotiated
	net/dim: Update DIM start sample after each DIM iteration
	tcp: defer SACK compression after DupThresh
	net: phy: add workaround for issue where PHY driver doesn't bind to the device
	tipc: fix lockdep warning during node delete
	x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
	x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
	x86/speculation: Propagate information about RSB filling mitigation to sysfs
	x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant
	x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
	x86/retpoline: Remove minimal retpoline support
	x86/speculation: Update the TIF_SSBD comment
	x86/speculation: Clean up spectre_v2_parse_cmdline()
	x86/speculation: Remove unnecessary ret variable in cpu_show_common()
	x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common()
	x86/speculation: Disable STIBP when enhanced IBRS is in use
	x86/speculation: Rename SSBD update functions
	x86/speculation: Reorganize speculation control MSRs update
	sched/smt: Make sched_smt_present track topology
	x86/Kconfig: Select SCHED_SMT if SMP enabled
	sched/smt: Expose sched_smt_present static key
	x86/speculation: Rework SMT state change
	x86/l1tf: Show actual SMT state
	x86/speculation: Reorder the spec_v2 code
	x86/speculation: Mark string arrays const correctly
	x86/speculataion: Mark command line parser data __initdata
	x86/speculation: Unify conditional spectre v2 print functions
	x86/speculation: Add command line control for indirect branch speculation
	x86/speculation: Prepare for per task indirect branch speculation control
	x86/process: Consolidate and simplify switch_to_xtra() code
	x86/speculation: Avoid __switch_to_xtra() calls
	x86/speculation: Prepare for conditional IBPB in switch_mm()
	ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS
	x86/speculation: Split out TIF update
	x86/speculation: Prevent stale SPEC_CTRL msr content
	x86/speculation: Prepare arch_smt_update() for PRCTL mode
	x86/speculation: Add prctl() control for indirect branch speculation
	x86/speculation: Enable prctl mode for spectre_v2_user
	x86/speculation: Add seccomp Spectre v2 user space protection mode
	x86/speculation: Provide IBPB always command line options
	userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
	kvm: mmu: Fix race in emulated page table writes
	kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
	KVM: nVMX/nSVM: Fix bug which sets vcpu->arch.tsc_offset to L1 tsc_offset
	KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall
	KVM: LAPIC: Fix pv ipis use-before-initialization
	KVM: X86: Fix scan ioapic use-before-initialization
	KVM: VMX: re-add ple_gap module parameter
	xtensa: enable coprocessors that are being flushed
	xtensa: fix coprocessor context offset definitions
	xtensa: fix coprocessor part of ptrace_{get,set}xregs
	udf: Allow mounting volumes with incorrect identification strings
	btrfs: Always try all copies when reading extent buffers
	Btrfs: ensure path name is null terminated at btrfs_control_ioctl
	Btrfs: fix rare chances for data loss when doing a fast fsync
	Btrfs: fix race between enabling quotas and subvolume creation
	btrfs: relocation: set trans to be NULL after ending transaction
	PCI: layerscape: Fix wrong invocation of outbound window disable accessor
	PCI: dwc: Fix MSI-X EP framework address calculation bug
	PCI: Fix incorrect value returned from pcie_get_speed_cap()
	arm64: dts: rockchip: Fix PCIe reset polarity for rk3399-puma-haikou.
	x86/MCE/AMD: Fix the thresholding machinery initialization order
	x86/fpu: Disable bottom halves while loading FPU registers
	perf/x86/intel: Move branch tracing setup to the Intel-specific source file
	perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts()
	perf/x86/intel: Disallow precise_ip on BTS events
	fs: fix lost error code in dio_complete
	ALSA: wss: Fix invalid snd_free_pages() at error path
	ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
	ALSA: control: Fix race between adding and removing a user element
	ALSA: sparc: Fix invalid snd_free_pages() at error path
	ALSA: hda: Add ASRock N68C-S UCC the power_save blacklist
	ALSA: hda/realtek - Support ALC300
	ALSA: hda/realtek - fix headset mic detection for MSI MS-B171
	ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops
	ALSA: hda/realtek - Add auto-mute quirk for HP Spectre x360 laptop
	function_graph: Create function_graph_enter() to consolidate architecture code
	ARM: function_graph: Simplify with function_graph_enter()
	microblaze: function_graph: Simplify with function_graph_enter()
	x86/function_graph: Simplify with function_graph_enter()
	nds32: function_graph: Simplify with function_graph_enter()
	powerpc/function_graph: Simplify with function_graph_enter()
	sh/function_graph: Simplify with function_graph_enter()
	sparc/function_graph: Simplify with function_graph_enter()
	parisc: function_graph: Simplify with function_graph_enter()
	riscv/function_graph: Simplify with function_graph_enter()
	s390/function_graph: Simplify with function_graph_enter()
	arm64: function_graph: Simplify with function_graph_enter()
	MIPS: function_graph: Simplify with function_graph_enter()
	function_graph: Make ftrace_push_return_trace() static
	function_graph: Use new curr_ret_depth to manage depth instead of curr_ret_stack
	function_graph: Have profiler use curr_ret_stack and not depth
	function_graph: Move return callback before update of curr_ret_stack
	function_graph: Reverse the order of pushing the ret_stack and the callback
	binder: fix race that allows malicious free of live buffer
	ext2: initialize opts.s_mount_opt as zero before using it
	ext2: fix potential use after free
	ASoC: intel: cht_bsw_max98090_ti: Add quirk for boards using pmc_plt_clk_0
	ASoC: pcm186x: Fix device reset-registers trigger value
	ARM: dts: rockchip: Remove @0 from the veyron memory node
	dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
	dmaengine: at_hdmac: fix module unloading
	staging: most: use format specifier "%s" in snprintf
	staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION
	staging: mt7621-dma: fix potentially dereferencing uninitialized 'tx_desc'
	staging: mt7621-pinctrl: fix uninitialized variable ngroups
	staging: rtl8723bs: Fix incorrect sense of ether_addr_equal
	staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station
	USB: usb-storage: Add new IDs to ums-realtek
	usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
	Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
	iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers
	iio:st_magn: Fix enable device after trigger
	lib/test_kmod.c: fix rmmod double free
	mm: cleancache: fix corruption on missed inode invalidation
	mm: use swp_offset as key in shmem_replace_page()
	Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
	misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
	Linux 4.19.7

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-12-06 10:34:09 +01:00
YueHaibing
842c4c22ea misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
commit 6484a67729 upstream.

gcc '-Wunused-but-set-variable' warning:

drivers/misc/mic/scif/scif_rma.c: In function 'scif_create_remote_lookup':
drivers/misc/mic/scif/scif_rma.c:373:25: warning:
 variable 'vmalloc_num_pages' set but not used [-Wunused-but-set-variable]

'vmalloc_num_pages' should be used to determine if the address is
within the vmalloc range.

Fixes: ba612aa8b4 ("misc: mic: SCIF memory registration and unregistration")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-05 19:32:14 +01:00
Jin Qian
3fd220679c ANDROID: taskstats: track fsync syscalls
This adds a counter to the taskstats extended accounting fields, which
tracks the number of times fsync is called, and then plumbs it through
to the uid_sys_stats driver.

Bug: 120442023
Change-Id: I6c138de5b2332eea70f57e098134d1d141247b3f
Signed-off-by: Jin Qian <jinqian@google.com>
[AmitP: Refactored changes to align with changes from upstream commit
        9a07000400 ("sched/headers: Move CONFIG_TASK_XACCT bits from <linux/sched.h> to <linux/sched/xacct.h>")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
[tkjos: Needed for storaged fsync accounting ("storaged --uid" and
        "storaged --task").]
[astrachan: This is modifying a userspace interface and should probably
            be reworked]
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-12-05 09:48:12 -08:00
Jin Qian
f4eeb5d6c6 ANDROID: uid_cputime: add per-uid IO usage accounting
IO usages are accounted in foreground and background buckets.
For each uid, io usage is calculated in two steps.

delta = current total of all uid tasks - previus total
current bucket += delta

Bucket is determined by current uid stat. Userspace writes to
/proc/uid_procstat/set <uid> <stat> when uid stat is updated.

/proc/uid_io/stats shows IO usage in this format.
<uid> <foreground IO> <background IO>

Bug: 34198239
Bug: 120442023
Change-Id: Ib8bebda53e7a56f45ea3eb0ec9a3153d44188102
Signed-off-by: Jin Qian <jinqian@google.com>
[connoro: Used by storaged.]
[astrachan: Note: this version does not track fsync syscalls; this is
            implemented in a follow up due to the fact it depends on
            modifications to the task_xacct feature.]
[astrachan: Folded in the following changes:
            e003a91d8f42 ("ANDROID: uid_sys_stats: allow writing same state")
            89b984bf2efd ("ANDROID: uid_sys_stats: fix negative write bytes.")
            bb5ee21cc4dd ("ANDROID: uid_sys_stats: change to use rt_mutex")
            9297d5a160c7 ("ANDROID: uid_sys_stats: reduce update_io_stats overhead")
            89402d07fe91 ("ANDROID: uid_sys_stats: defer io stats calulation for dead tasks")
            6dc5d8173a8c ("ANDROID: uid_sys_stats: check previous uid_entry before call find_or_register_uid")
            0ca2ece8f7ec ("ANDROID: uid_sys_stats: log task io with a debug flag")
            c9c096ef0e67 ("ANDROID: uid_sys_stats: Copy task_struct comm field to bigger buffer")]
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-12-05 09:48:12 -08:00
Jin Qian
0ae8088521 ANDROID: uid_cputime: Adds accounting for the cputimes per uid.
Adds proc files /proc/uid_cputime/show_uid_stat and
/proc/uid_cputime/remove_uid_range.

show_uid_stat lists the total utime and stime for the active as well as
terminated processes for each of the uids.

Writing a range of uids to remove_uid_range will delete the accounting
for all the uids within that range.

Bug: 120442023
Change-Id: I21d9210379da730b33ddc1a0ea663c8c9d2ac15b
Signed-off-by: Jin Qian <jinqian@google.com>
[AmitP: Refactored the original patch because upstream commit
        605dc2b31a ("tsacct: Convert obsolete cputime type to nsecs")
        made cputime_t type obsolete, so use u64 nanoseconds directly instead.
        Also folded following android-4.9 changes into this patch
        48a9906c0f ("ANDROID: proc: uid_cputime: create uids from kuids")
        453ac31cab ("ANDROID: proc: uid_cputime: fix show_uid_stat permission")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
[connoro: Used by batterystats.]
[astrachan: Folded in the file/kconfig rename and the following changes:
            da3687fbc393 ("ANDROID: uid_cputime: fix cputime overflow")
            71e3eb512d00 ("ANDROID: uid_cputime: Iterates over all the threads instead of processes.")
            c65f0080c300 ("ANDROID: uid_cputime: Check for the range while removing range of UIDs.")
            c8212458e3a5 ("ANDROID: uid_sys_stats: fix access of task_uid(task)")
            bb5ee21cc4dd ("ANDROID: uid_sys_stats: change to use rt_mutex")
            6dc5d8173a8c ("ANDROID: uid_sys_stats: check previous uid_entry before call find_or_register_uid")
            82b9872b3894 ("ANDROID: uid_sys_stats: Replace tasklist lock with RCU in uid_cputime_show")]
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-12-05 09:48:12 -08:00
Mark Brown
684d5e05df Merge tag 'v4.4.166' into linux-linaro-lsk-v4.4
This is the 4.4.166 stable release
2018-12-04 10:49:55 +00:00
Gustavo A. R. Silva
3e31936ba0 drivers/misc/sgi-gru: fix Spectre v1 vulnerability
commit fee05f455c upstream.

req.gid can be indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

vers/misc/sgi-gru/grukdump.c:200 gru_dump_chiplet_request() warn:
potential spectre issue 'gru_base' [w]

Fix this by sanitizing req.gid before calling macro GID_TO_GRU, which
uses it to index gru_base.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-27 16:13:10 +01:00
Nathan Chancellor
e591b9069b misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
commit 7c97301285 upstream.

After building the kernel with Clang, the following section mismatch
warning appears:

WARNING: vmlinux.o(.text+0x3bf19a6): Section mismatch in reference from
the function ssc_probe() to the function
.init.text:atmel_ssc_get_driver_data()
The function ssc_probe() references
the function __init atmel_ssc_get_driver_data().
This is often because ssc_probe lacks a __init
annotation or the annotation of atmel_ssc_get_driver_data is wrong.

Remove __init from atmel_ssc_get_driver_data to get rid of the mismatch.

Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-27 16:13:10 +01:00
Gustavo A. R. Silva
b61865ef9b drivers/misc/sgi-gru: fix Spectre v1 vulnerability
commit fee05f455c upstream.

req.gid can be indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

vers/misc/sgi-gru/grukdump.c:200 gru_dump_chiplet_request() warn:
potential spectre issue 'gru_base' [w]

Fix this by sanitizing req.gid before calling macro GID_TO_GRU, which
uses it to index gru_base.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-27 16:08:02 +01:00
Nathan Chancellor
285745ac5a misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
commit 7c97301285 upstream.

After building the kernel with Clang, the following section mismatch
warning appears:

WARNING: vmlinux.o(.text+0x3bf19a6): Section mismatch in reference from
the function ssc_probe() to the function
.init.text:atmel_ssc_get_driver_data()
The function ssc_probe() references
the function __init atmel_ssc_get_driver_data().
This is often because ssc_probe lacks a __init
annotation or the annotation of atmel_ssc_get_driver_data is wrong.

Remove __init from atmel_ssc_get_driver_data to get rid of the mismatch.

Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-27 16:08:02 +01:00
Mark Brown
375fef4f04 Merge tag 'v4.4.164' into linux-linaro-lsk-v4.4
This is the 4.4.164 stable release
2018-11-22 15:19:34 +00:00