Commit Graph

2795 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
7f6f94c98c Merge 4.9.113 into android-4.9
Changes in 4.9.113
	nvme: validate admin queue before unquiesce
	MIPS: Call dump_stack() from show_regs()
	MIPS: Fix ioremap() RAM check
	mmc: dw_mmc: fix card threshold control configuration
	ibmasm: don't write out of bounds in read handler
	ata: Fix ZBC_OUT command block check
	ata: Fix ZBC_OUT all bit handling
	vmw_balloon: fix inflation with batching
	ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS
	USB: serial: ch341: fix type promotion bug in ch341_control_in()
	USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick
	USB: serial: keyspan_pda: fix modem-status error handling
	USB: yurex: fix out-of-bounds uaccess in read handler
	USB: serial: mos7840: fix status-register error handling
	usb: quirks: add delay quirks for Corsair Strafe
	xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
	HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter
	Fix up non-directory creation in SGID directories
	ALSA: hda - Handle pm failure during hotplug
	fs, elf: make sure to page align bss in load_elf_library
	tools build: fix # escaping in .cmd files for future Make
	i2c: tegra: Fix NACK error handling
	iw_cxgb4: correctly enforce the max reg_mr depth
	nvme-pci: Remap CMB SQ entries on every controller reset
	uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn()
	netfilter: nf_queue: augment nfqa_cfg_policy
	netfilter: x_tables: initialise match/target check parameter struct
	loop: add recursion validation to LOOP_CHANGE_FD
	PM / hibernate: Fix oops at snapshot_write()
	RDMA/ucm: Mark UCM interface as BROKEN
	loop: remember whether sysfs_create_group() was done
	Linux 4.9.113

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-07-17 12:36:18 +02:00
Nadav Amit
63c003e3ff vmw_balloon: fix inflation with batching
commit 90d72ce079 upstream.

Embarrassingly, the recent fix introduced worse problem than it solved,
causing the balloon not to inflate. The VM informed the hypervisor that
the pages for lock/unlock are sitting in the wrong address, as it used
the page that is used the uninitialized page variable.

Fixes: b23220fe05 ("vmw_balloon: fixing double free when batching mode is off")
Cc: stable@vger.kernel.org
Reviewed-by: Xavier Deguillard <xdeguillard@vmware.com>
Signed-off-by: Nadav Amit <namit@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:37:51 +02:00
Jann Horn
2823345cd4 ibmasm: don't write out of bounds in read handler
commit a0341fc198 upstream.

This read handler had a lot of custom logic and wrote outside the bounds of
the provided buffer. This could lead to kernel and userspace memory
corruption. Just use simple_read_from_buffer() with a stack buffer.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-17 11:37:51 +02:00
Greg Kroah-Hartman
a4230beab3 Merge 4.9.109 into android-4.9
Changes in 4.9.109
	x86/fpu: Hard-disable lazy FPU mode
	bonding: correctly update link status during mii-commit phase
	bonding: fix active-backup transition
	bonding: require speed/duplex only for 802.3ad, alb and tlb
	nvme-pci: initialize queue memory before interrupts
	af_key: Always verify length of provided sadb_key
	x86/crypto, x86/fpu: Remove X86_FEATURE_EAGER_FPU #ifdef from the crc32c code
	nvmet: Move serial number from controller to subsystem
	nvmet: don't report 0-bytes in serial number
	nvmet: don't overwrite identify sn/fr with 0-bytes
	gpio: No NULL owner
	KVM: x86: introduce linear_{read,write}_system
	KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system
	staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
	usbip: vhci_sysfs: fix potential Spectre v1
	usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver
	usb-storage: Add compatibility quirk flags for G-Technologies G-Drive
	usb: gadget: udc: renesas_usb3: disable the controller's irqs for reconnecting
	serial: sh-sci: Stop using printk format %pCr
	tty/serial: atmel: use port->name as name in request_irq()
	serial: samsung: fix maxburst parameter for DMA transactions
	serial: 8250: omap: Fix idling of clocks for unused uarts
	vmw_balloon: fixing double free when batching mode is off
	tty: pl011: Avoid spuriously stuck-off interrupts
	kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access
	Input: goodix - add new ACPI id for GPD Win 2 touch screen
	Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID
	crypto: vmx - Remove overly verbose printk from AES init routines
	crypto: omap-sham - fix memleak
	perf: sync up x86/.../cpufeatures.h
	Linux 4.9.109

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-06-16 11:31:13 +02:00
Gil Kupfer
d9bc59c44d vmw_balloon: fixing double free when batching mode is off
commit b23220fe05 upstream.

The balloon.page field is used for two different purposes if batching is
on or off. If batching is on, the field point to the page which is used
to communicate with with the hypervisor. If it is off, balloon.page
points to the page that is about to be (un)locked.

Unfortunately, this dual-purpose of the field introduced a bug: when the
balloon is popped (e.g., when the machine is reset or the balloon driver
is explicitly removed), the balloon driver frees, unconditionally, the
page that is held in balloon.page.  As a result, if batching is
disabled, this leads to double freeing the last page that is sent to the
hypervisor.

The following error occurs during rmmod when kernel checkers are on, and
the balloon is not empty:

[   42.307653] ------------[ cut here ]------------
[   42.307657] Kernel BUG at ffffffffba1e4b28 [verbose debug info unavailable]
[   42.307720] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
[   42.312512] Modules linked in: vmw_vsock_vmci_transport vsock ppdev joydev vmw_balloon(-) input_leds serio_raw vmw_vmci parport_pc shpchp parport i2c_piix4 nfit mac_hid autofs4 vmwgfx drm_kms_helper hid_generic syscopyarea sysfillrect usbhid sysimgblt fb_sys_fops hid ttm mptspi scsi_transport_spi ahci mptscsih drm psmouse vmxnet3 libahci mptbase pata_acpi
[   42.312766] CPU: 10 PID: 1527 Comm: rmmod Not tainted 4.12.0+ #5
[   42.312803] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 09/30/2016
[   42.313042] task: ffff9bf9680f8000 task.stack: ffffbfefc1638000
[   42.313290] RIP: 0010:__free_pages+0x38/0x40
[   42.313510] RSP: 0018:ffffbfefc163be98 EFLAGS: 00010246
[   42.313731] RAX: 000000000000003e RBX: ffffffffc02b9720 RCX: 0000000000000006
[   42.313972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9bf97e08e0a0
[   42.314201] RBP: ffffbfefc163be98 R08: 0000000000000000 R09: 0000000000000000
[   42.314435] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffc02b97e4
[   42.314505] R13: ffffffffc02b9748 R14: ffffffffc02b9728 R15: 0000000000000200
[   42.314550] FS:  00007f3af5fec700(0000) GS:ffff9bf97e080000(0000) knlGS:0000000000000000
[   42.314599] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   42.314635] CR2: 00007f44f6f4ab24 CR3: 00000003a7d12000 CR4: 00000000000006e0
[   42.314864] Call Trace:
[   42.315774]  vmballoon_pop+0x102/0x130 [vmw_balloon]
[   42.315816]  vmballoon_exit+0x42/0xd64 [vmw_balloon]
[   42.315853]  SyS_delete_module+0x1e2/0x250
[   42.315891]  entry_SYSCALL_64_fastpath+0x23/0xc2
[   42.315924] RIP: 0033:0x7f3af5b0e8e7
[   42.315949] RSP: 002b:00007fffe6ce0148 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[   42.315996] RAX: ffffffffffffffda RBX: 000055be676401e0 RCX: 00007f3af5b0e8e7
[   42.316951] RDX: 000000000000000a RSI: 0000000000000800 RDI: 000055be67640248
[   42.317887] RBP: 0000000000000003 R08: 0000000000000000 R09: 1999999999999999
[   42.318845] R10: 0000000000000883 R11: 0000000000000206 R12: 00007fffe6cdf130
[   42.319755] R13: 0000000000000000 R14: 0000000000000000 R15: 000055be676401e0
[   42.320606] Code: c0 74 1c f0 ff 4f 1c 74 02 5d c3 85 f6 74 07 e8 0f d8 ff ff 5d c3 31 f6 e8 c6 fb ff ff 5d c3 48 c7 c6 c8 0f c5 ba e8 58 be 02 00 <0f> 0b 66 0f 1f 44 00 00 66 66 66 66 90 48 85 ff 75 01 c3 55 48
[   42.323462] RIP: __free_pages+0x38/0x40 RSP: ffffbfefc163be98
[   42.325735] ---[ end trace 872e008e33f81508 ]---

To solve the bug, we eliminate the dual purpose of balloon.page.

Fixes: f220a80f0c ("VMware balloon: add batching to the vmw_balloon.")
Cc: stable@vger.kernel.org
Reported-by: Oleksandr Natalenko <onatalen@redhat.com>
Signed-off-by: Gil Kupfer <gilkup@gmail.com>
Signed-off-by: Nadav Amit <namit@vmware.com>
Reviewed-by: Xavier Deguillard <xdeguillard@vmware.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-16 09:52:34 +02:00
Greg Kroah-Hartman
8683408f8e Merge 4.9.94 into android-4.9
Changes in 4.9.94
	qed: Fix overriding of supported autoneg value.
	cfg80211: make RATE_INFO_BW_20 the default
	md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock
	rtc: snvs: fix an incorrect check of return value
	x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic()
	x86/mm/kaslr: Use the _ASM_MUL macro for multiplication to work around Clang incompatibility
	ovl: persistent inode numbers for upper hardlinks
	NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
	x86/boot: Declare error() as noreturn
	IB/srpt: Fix abort handling
	IB/srpt: Avoid that aborting a command triggers a kernel warning
	af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
	mac80211: bail out from prep_connection() if a reconfig is ongoing
	bna: Avoid reading past end of buffer
	qlge: Avoid reading past end of buffer
	ubi: fastmap: Fix slab corruption
	ipmi_ssif: unlock on allocation failure
	net: cdc_ncm: Fix TX zero padding
	net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
	lockd: fix lockd shutdown race
	drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
	pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
	s390: move _text symbol to address higher than zero
	net/mlx4_en: Avoid adding steering rules with invalid ring
	qed: Correct doorbell configuration for !4Kb pages
	NFSv4.1: Work around a Linux server bug...
	CIFS: silence lockdep splat in cifs_relock_file()
	perf/callchain: Force USER_DS when invoking perf_callchain_user()
	blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op
	net: qca_spi: Fix alignment issues in rx path
	netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
	mdio: mux: Correct mdio_mux_init error path issues
	Input: elan_i2c - check if device is there before really probing
	Input: elantech - force relative mode on a certain module
	KVM: PPC: Book3S PR: Check copy_to/from_user return values
	irqchip/mbigen: Fix the clear register offset calculation
	vmxnet3: ensure that adapter is in proper state during force_close
	mm, vmstat: Remove spurious WARN() during zoneinfo print
	SMB2: Fix share type handling
	bus: brcmstb_gisb: Use register offsets with writes too
	bus: brcmstb_gisb: correct support for 64-bit address output
	PowerCap: Fix an error code in powercap_register_zone()
	iio: pressure: zpa2326: report interrupted case as failure
	ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin
	staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
	clk: renesas: rcar-gen2: Fix PLL0 on R-Car V2H and E2
	x86/tsc: Provide 'tsc=unstable' boot parameter
	powerpc/modules: If mprofile-kernel is enabled add it to vermagic
	ARM: dts: imx6qdl-wandboard: Fix audio channel swap
	i2c: mux: reg: put away the parent i2c adapter on probe failure
	arm64: perf: Ignore exclude_hv when kernel is running in HYP
	mdio: mux: fix device_node_continue.cocci warnings
	ipv6: avoid dad-failures for addresses with NODAD
	async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
	KVM: arm: Restore banked registers and physical timer access on hyp_panic()
	KVM: arm64: Restore host physical timer access on hyp_panic()
	usb: dwc3: keystone: check return value
	btrfs: fix incorrect error return ret being passed to mapping_set_error
	ata: libahci: properly propagate return value of platform_get_irq()
	ipmr: vrf: Find VIFs using the actual device
	uio: fix incorrect memory leak cleanup
	neighbour: update neigh timestamps iff update is effective
	arp: honour gratuitous ARP _replies_
	ARM: dts: rockchip: fix rk322x i2s1 pinctrl error
	usb: chipidea: properly handle host or gadget initialization failure
	pxa_camera: fix module remove codepath for v4l2 clock
	USB: ene_usb6250: fix first command execution
	net: x25: fix one potential use-after-free issue
	USB: ene_usb6250: fix SCSI residue overwriting
	serial: 8250: omap: Disable DMA for console UART
	serial: sh-sci: Fix race condition causing garbage during shutdown
	net/wan/fsl_ucc_hdlc: fix unitialized variable warnings
	net/wan/fsl_ucc_hdlc: fix incorrect memory allocation
	fsl/qe: add bit description for SYNL register for GUMR
	sh_eth: Use platform device for printing before register_netdev()
	mlxsw: spectrum: Avoid possible NULL pointer dereference
	scsi: csiostor: fix use after free in csio_hw_use_fwconfig()
	powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
	ath5k: fix memory leak on buf on failed eeprom read
	selftests/powerpc: Fix TM resched DSCR test with some compilers
	xfrm: fix state migration copy replay sequence numbers
	ASoC: simple-card: fix mic jack initialization
	iio: hi8435: avoid garbage event at first enable
	iio: hi8435: cleanup reset gpio
	iio: light: rpr0521 poweroff for probe fails
	ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
	md-cluster: fix potential lock issue in add_new_disk
	ARM: davinci: da8xx: Create DSP device only when assigned memory
	ray_cs: Avoid reading past end of buffer
	net/wan/fsl_ucc_hdlc: fix muram allocation error
	leds: pca955x: Correct I2C Functionality
	perf/core: Fix error handling in perf_event_alloc()
	sched/numa: Use down_read_trylock() for the mmap_sem
	gpio: crystalcove: Do not write regular gpio registers for virtual GPIOs
	net/mlx5: Tolerate irq_set_affinity_hint() failures
	selinux: do not check open permission on sockets
	block: fix an error code in add_partition()
	mlx5: fix bug reading rss_hash_type from CQE
	net: ieee802154: fix net_device reference release too early
	libceph: NULL deref on crush_decode() error path
	perf report: Fix off-by-one for non-activation frames
	netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
	pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
	ASoC: rsnd: SSI PIO adjust to 24bit mode
	scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
	fix race in drivers/char/random.c:get_reg()
	ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
	ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path
	tcp: better validation of received ack sequences
	net: move somaxconn init from sysctl code
	Input: elan_i2c - clear INT before resetting controller
	bonding: Don't update slave->link until ready to commit
	cpuhotplug: Link lock stacks for hotplug callbacks
	PCI/msi: fix the pci_alloc_irq_vectors_affinity stub
	KVM: X86: Fix preempt the preemption timer cancel
	KVM: nVMX: Fix handling of lmsw instruction
	net: llc: add lock_sock in llc_ui_bind to avoid a race condition
	drm/msm: Take the mutex before calling msm_gem_new_impl
	i40iw: Fix sequence number for the first partial FPDU
	i40iw: Correct Q1/XF object count equation
	ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
	thermal: power_allocator: fix one race condition issue for thermal_instances list
	perf probe: Add warning message if there is unexpected event name
	l2tp: fix missing print session offset info
	rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
	ACPI / video: Default lcd_only to true on Win8-ready and newer machines
	net/mlx4_en: Change default QoS settings
	VFS: close race between getcwd() and d_move()
	PM / devfreq: Fix potential NULL pointer dereference in governor_store
	hwmon: (ina2xx) Make calibration register value fixed
	media: videobuf2-core: don't go out of the buffer range
	ASoC: Intel: Skylake: Disable clock gating during firmware and library download
	ASoC: Intel: cht_bsw_rt5645: Analog Mic support
	scsi: libiscsi: Allow sd_shutdown on bad transport
	scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
	irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry
	ACPI: EC: Fix debugfs_create_*() usage
	mac80211: Fix setting TX power on monitor interfaces
	vfb: fix video mode and line_length being set when loaded
	gpio: label descriptors using the device name
	IB/rdmavt: Allocate CQ memory on the correct node
	blk-mq: fix race between updating nr_hw_queues and switching io sched
	backlight: tdo24m: Fix the SPI CS between transfers
	pinctrl: baytrail: Enable glitch filter for GPIOs used as interrupts
	ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
	rt2x00: do not pause queue unconditionally on error path
	wl1251: check return from call to wl1251_acx_arp_ip_filter
	hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
	x86/efi: Disable runtime services on kexec kernel if booted with efi=old_map
	netfilter: conntrack: don't call iter for non-confirmed conntracks
	HID: i2c: Call acpi_device_fix_up_power for ACPI-enumerated devices
	ovl: filter trusted xattr for non-admin
	powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
	dmaengine: imx-sdma: Handle return value of clk_prepare_enable
	backlight: Report error on failure
	arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
	net/mlx5: avoid build warning for uniprocessor
	cxgb4: FW upgrade fixes
	cxgb4: Fix netdev_features flag
	rtc: m41t80: fix SQW dividers override when setting a date
	i40evf: fix merge error in older patch
	rtc: opal: Handle disabled TPO in opal_get_tpo_time()
	rtc: interface: Validate alarm-time before handling rollover
	SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()
	net: freescale: fix potential null pointer dereference
	clk: at91: fix clk-generated parenting
	drm/sun4i: Ignore the generic connectors for components
	dt-bindings: display: sun4i: Add allwinner,tcon-channel property
	mtd: nand: gpmi: Fix gpmi_nand_init() error path
	mtd: nand: check ecc->total sanity in nand_scan_tail
	KVM: SVM: do not zero out segment attributes if segment is unusable or not present
	clk: scpi: fix return type of __scpi_dvfs_round_rate
	clk: Fix __set_clk_rates error print-string
	powerpc/spufs: Fix coredump of SPU contexts
	drm/amdkfd: NULL dereference involving create_process()
	ath10k: add BMI parameters to fix calibration from DT/pre-cal
	perf trace: Add mmap alias for s390
	qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M
	arm64: kernel: restrict /dev/mem read() calls to linear region
	mISDN: Fix a sleep-in-atomic bug
	net: phy: micrel: Restore led_mode and clk_sel on resume
	RDMA/iw_cxgb4: Avoid touch after free error in ARP failure handlers
	RDMA/hfi1: fix array termination by appending NULL to attr array
	drm/omap: fix tiled buffer stride calculations
	powerpc/8xx: fix mpc8xx_get_irq() return on no irq
	cxgb4: fix incorrect cim_la output for T6
	Fix serial console on SNI RM400 machines
	bio-integrity: Do not allocate integrity context for bio w/o data
	ip6_tunnel: fix traffic class routing for tunnels
	skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
	macsec: check return value of skb_to_sgvec always
	sit: reload iphdr in ipip6_rcv
	net/mlx4: Fix the check in attaching steering rules
	net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport
	perf header: Set proper module name when build-id event found
	perf report: Ensure the perf DSO mapping matches what libdw sees
	iwlwifi: mvm: fix firmware debug restart recording
	watchdog: f71808e_wdt: Add F71868 support
	iwlwifi: mvm: Fix command queue number on d0i3 flow
	iwlwifi: tt: move ucode_loaded check under mutex
	iwlwifi: pcie: only use d0i3 in suspend/resume if system_pm is set to d0i3
	iwlwifi: fix min API version for 7265D, 3168, 8000 and 8265
	tags: honor COMPILED_SOURCE with apart output directory
	ARM: dts: qcom: ipq4019: fix i2c_0 node
	e1000e: fix race condition around skb_tstamp_tx()
	igb: fix race condition with PTP_TX_IN_PROGRESS bits
	cxl: Unlock on error in probe
	cx25840: fix unchecked return values
	mceusb: sporadic RX truncation corruption fix
	net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
	ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
	nvme-pci: fix multiple ctrl removal scheduling
	nvme: fix hang in remove path
	KVM: nVMX: Update vmcs12->guest_linear_address on nested VM-exit
	e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
	perf/core: Correct event creation with PERF_FORMAT_GROUP
	sched/deadline: Use the revised wakeup rule for suspending constrained dl tasks
	MIPS: mm: fixed mappings: correct initialisation
	MIPS: mm: adjust PKMAP location
	MIPS: kprobes: flush_insn_slot should flush only if probe initialised
	ARM: dts: armadillo800eva: Split LCD mux and gpio
	Fix loop device flush before configure v3
	net: emac: fix reset timeout with AR8035 phy
	perf tools: Decompress kernel module when reading DSO data
	perf tests: Decompress kernel module before objdump
	skbuff: only inherit relevant tx_flags
	xen: avoid type warning in xchg_xen_ulong
	X.509: Fix error code in x509_cert_parse()
	pinctrl: meson-gxbb: remove non-existing pin GPIOX_22
	coresight: Fix reference count for software sources
	coresight: tmc: Configure DMA mask appropriately
	stmmac: fix ptp header for GMAC3 hw timestamp
	geneve: add missing rx stats accounting
	crypto: omap-sham - buffer handling fixes for hashing later
	crypto: omap-sham - fix closing of hash with separate finalize call
	bnx2x: Allow vfs to disable txvlan offload
	sctp: fix recursive locking warning in sctp_do_peeloff
	net: fec: Add a fec_enet_clear_ethtool_stats() stub for CONFIG_M5272
	sparc64: ldc abort during vds iso boot
	iio: magnetometer: st_magn_spi: fix spi_device_id table
	net: ena: fix rare uncompleted admin command false alarm
	net: ena: fix race condition between submit and completion admin command
	net: ena: add missing return when ena_com_get_io_handlers() fails
	net: ena: add missing unmap bars on device removal
	net: ena: disable admin msix while working in polling mode
	clk: meson: meson8b: add compatibles for Meson8 and Meson8m2
	Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
	cpuidle: dt: Add missing 'of_node_put()'
	ACPICA: OSL: Add support to exclude stdarg.h
	ACPICA: Events: Add runtime stub support for event APIs
	ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
	s390/dasd: fix hanging safe offline
	vxlan: dont migrate permanent fdb entries during learn
	hsr: fix incorrect warning
	selftests: kselftest_harness: Fix compile warning
	drm/vc4: Fix resource leak in 'vc4_get_hang_state_ioctl()' in error handling path
	bcache: stop writeback thread after detaching
	bcache: segregate flash only volume write streams
	scsi: libsas: fix memory leak in sas_smp_get_phy_events()
	scsi: libsas: fix error when getting phy events
	scsi: libsas: initialize sas_phy status according to response of DISCOVER
	blk-mq: fix kernel oops in blk_mq_tag_idle()
	tty: n_gsm: Allow ADM response in addition to UA for control dlci
	EDAC, mv64x60: Fix an error handling path
	cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
	sdhci: Advertise 2.0v supply on SDIO host controller
	Input: goodix - disable IRQs while suspended
	mtd: mtd_oobtest: Handle bitflips during reads
	perf tools: Fix copyfile_offset update of output offset
	ipsec: check return value of skb_to_sgvec always
	rxrpc: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec in one more location
	random: use lockless method of accessing and updating f->reg_idx
	clk: at91: fix clk-generated compilation
	arp: fix arp_filter on l3slave devices
	ipv6: the entire IPv6 header chain must fit the first fragment
	net: fix possible out-of-bound read in skb_network_protocol()
	net/ipv6: Fix route leaking between VRFs
	net/ipv6: Increment OUTxxx counters after netfilter hook
	netlink: make sure nladdr has correct size in netlink_connect()
	net/sched: fix NULL dereference in the error path of tcf_bpf_init()
	pptp: remove a buggy dst release in pptp_connect()
	r8169: fix setting driver_data after register_netdev
	sctp: do not leak kernel memory to user space
	sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
	sky2: Increase D3 delay to sky2 stops working after suspend
	vhost: correctly remove wait queue during poll failure
	vlan: also check phy_driver ts_info for vlan's real device
	bonding: fix the err path for dev hwaddr sync in bond_enslave
	bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
	bonding: process the err returned by dev_set_allmulti properly in bond_enslave
	net: fool proof dev_valid_name()
	ip_tunnel: better validate user provided tunnel names
	ipv6: sit: better validate user provided tunnel names
	ip6_gre: better validate user provided tunnel names
	ip6_tunnel: better validate user provided tunnel names
	vti6: better validate user provided tunnel names
	net/mlx5e: Sync netdev vxlan ports at open
	net/sched: fix NULL dereference in the error path of tunnel_key_init()
	net/sched: fix NULL dereference on the error path of tcf_skbmod_init()
	net/mlx4_en: Fix mixed PFC and Global pause user control requests
	vhost: validate log when IOTLB is enabled
	route: check sysctl_fib_multipath_use_neigh earlier than hash
	team: move dev_mc_sync after master_upper_dev_link in team_port_add
	vhost_net: add missing lock nesting notation
	net/mlx4_core: Fix memory leak while delete slave's resources
	strparser: Fix sign of err codes
	net sched actions: fix dumping which requires several messages to user space
	vrf: Fix use after free and double free in vrf_finish_output
	Revert "xhci: plat: Register shutdown for xhci_plat"
	Linux 4.9.94

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-04-14 15:40:56 +02:00
Dan Carpenter
20c29d92ce cxl: Unlock on error in probe
[ Upstream commit 58d876fa71 ]

We should unlock if get_cxl_adapter() fails.

Fixes: 594ff7d067 ("cxl: Support to flash a new image on the adapter from a guest")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:48:22 +02:00
Dan Carpenter
a90e9ee704 drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
[ Upstream commit 146180c052 ]

The "DIV_ROUND_UP(size, PAGE_SIZE)" operation can overflow if "size" is
more than ULLONG_MAX - PAGE_SIZE.

Link: http://lkml.kernel.org/r/20170322111950.GA11279@mwanda
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jorgen Hansen <jhansen@vmware.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:47:53 +02:00
Pavankumar Kondeti
71184089b8 ANDROID: uid_sys_stats: Replace tasklist lock with RCU in uid_cputime_show
Tasklist lock is acuquired in uid_cputime_show for updating the stats
for all tasks in the system. This can potentially disable preemption
for several milli seconds. Replace tasklist_lock with RCU read side
primitives.

Change-Id: Ife69cb577bfdceaae6eb21b9bda09a0fe687e140
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
2018-04-10 17:56:50 +00:00
Greg Hackmann
05baf14727 Merge tag 'v4.9.93' into android-4.9
This is the 4.9.93 stable release

Change-Id: I4293d83f45982c6fd479bddbf9b0f811248ddc30
Signed-off-by: Greg Hackmann <ghackmann@google.com>
2018-04-09 11:39:17 -07:00
Colin Ian King
666dc4c837 mei: remove dev_err message on an unsupported ioctl
commit bb0829a741 upstream.

Currently the driver spams the kernel log on unsupported ioctls which is
unnecessary as the ioctl returns -ENOIOCTLCMD to indicate this anyway.
I suspect this was originally for debugging purposes but it really is not
required so remove it.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-08 12:12:57 +02:00
Connor O'Brien
fcb3db160d ANDROID: cpufreq: times: track per-uid time in state
Add /proc/uid_time_in_state showing per uid/frequency/cluster
times. Allow uid removal through /proc/uid_cputime/remove_uid_range.

Signed-off-by: Connor O'Brien <connoro@google.com>
Bug: 72339335
Bug: 70951257
Test: Read /proc/uid_time_in_state
Change-Id: I20ba3546a27c25b7e7991e2a86986e158aafa58c
2018-04-03 11:15:30 -07:00
Greg Kroah-Hartman
960923fdc2 Merge 4.9.89 into android-4.9
Changes in 4.9.89
	blkcg: fix double free of new_blkg in blkcg_init_queue
	Input: tsc2007 - check for presence and power down tsc2007 during probe
	perf stat: Issue a HW watchdog disable hint
	staging: speakup: Replace BUG_ON() with WARN_ON().
	staging: wilc1000: add check for kmalloc allocation failure.
	HID: reject input outside logical range only if null state is set
	drm: qxl: Don't alloc fbdev if emulation is not supported
	ARM: dts: r8a7791: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7792: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7793: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7794: Remove unit-address and reg from integrated cache
	arm64: dts: r8a7796: Remove unit-address and reg from integrated cache
	drm/sun4i: Fix up error path cleanup for master bind function
	drm/sun4i: Set drm_crtc.port to the underlying TCON's output port node
	ath10k: fix a warning during channel switch with multiple vaps
	drm/sun4i: Fix TCON clock and regmap initialization sequence
	PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()
	selinux: check for address length in selinux_socket_bind()
	x86/mm: Make mmap(MAP_32BIT) work correctly
	perf sort: Fix segfault with basic block 'cycles' sort dimension
	x86/mce: Handle broadcasted MCE gracefully with kexec
	eventpoll.h: fix epoll event masks
	i40e: Acquire NVM lock before reads on all devices
	i40e: fix ethtool to get EEPROM data from X722 interface
	perf tools: Make perf_event__synthesize_mmap_events() scale
	ARM: brcmstb: Enable ZONE_DMA for non 64-bit capable peripherals
	drivers: net: xgene: Fix hardware checksum setting
	drivers: net: phy: xgene: Fix mdio write
	drivers: net: xgene: Fix wrong logical operation
	drivers: net: xgene: Fix Rx checksum validation logic
	drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off)
	ath10k: disallow DFS simulation if DFS channel is not enabled
	ath10k: fix fetching channel during potential radar detection
	usb: misc: lvs: fix race condition in disconnect handling
	ARM: bcm2835: Enable missing CMA settings for VC4 driver
	net: ethernet: bgmac: Allow MAC address to be specified in DTB
	netem: apply correct delay when rate throttling
	x86/mce: Init some CPU features early
	omapfb: dss: Handle return errors in dss_init_ports()
	perf probe: Fix concat_probe_trace_events
	perf probe: Return errno when not hitting any event
	HID: clamp input to logical range if no null state
	net/8021q: create device with all possible features in wanted_features
	ARM: dts: Adjust moxart IRQ controller and flags
	qed: Always publish VF link from leading hwfn
	s390/topology: fix typo in early topology code
	zd1211rw: fix NULL-deref at probe
	batman-adv: handle race condition for claims between gateways
	of: fix of_device_get_modalias returned length when truncating buffers
	solo6x10: release vb2 buffers in solo_stop_streaming()
	x86/boot/32: Defer resyncing initial_page_table until per-cpu is set up
	scsi: fnic: Fix for "Number of Active IOs" in fnicstats becoming negative
	scsi: ipr: Fix missed EH wakeup
	media: i2c/soc_camera: fix ov6650 sensor getting wrong clock
	timers, sched_clock: Update timeout for clock wrap
	sysrq: Reset the watchdog timers while displaying high-resolution timers
	Input: qt1070 - add OF device ID table
	sched: act_csum: don't mangle TCP and UDP GSO packets
	PCI: hv: Properly handle PCI bus remove
	PCI: hv: Lock PCI bus on device eject
	ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT
	spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer
	tcp: sysctl: Fix a race to avoid unexpected 0 window from space
	dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped
	usb: dwc3: make sure UX_EXIT_PX is cleared
	ARM: dts: bcm2835: add index to the ethernet alias
	perf annotate: Fix a bug following symbolic link of a build-id file
	perf buildid: Do not assume that readlink() returns a null terminated string
	i40e/i40evf: Fix use after free in Rx cleanup path
	scsi: be2iscsi: Check tag in beiscsi_mccq_compl_wait
	driver: (adm1275) set the m,b and R coefficients correctly for power
	bonding: make speed, duplex setting consistent with link state
	mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()
	ALSA: firewire-lib: add a quirk of packet without valid EOH in CIP format
	ARM: dts: r8a7794: Add DU1 clock to device tree
	ARM: dts: r8a7794: Correct clock of DU1
	ARM: dts: silk: Correct clock of DU1
	blk-throttle: make sure expire time isn't too big
	regulator: core: Limit propagation of parent voltage count and list
	perf trace: Handle unpaired raw_syscalls:sys_exit event
	f2fs: relax node version check for victim data in gc
	drm/ttm: never add BO that failed to validate to the LRU list
	bonding: refine bond_fold_stats() wrap detection
	PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices
	powerpc/mm/hugetlb: Filter out hugepage size not supported by page table layout
	braille-console: Fix value returned by _braille_console_setup
	drm/vmwgfx: Fixes to vmwgfx_fb
	vxlan: vxlan dev should inherit lowerdev's gso_max_size
	NFC: nfcmrvl: Include unaligned.h instead of access_ok.h
	NFC: nfcmrvl: double free on error path
	NFC: pn533: change order of free_irq and dev unregistration
	ARM: dts: r7s72100: fix ethernet clock parent
	ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks
	ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks
	ARM: dts: r8a7793: Correct parent of SSI[0-9] clocks
	powerpc: Avoid taking a data miss on every userspace instruction miss
	net: hns: Correct HNS RSS key set function
	net/faraday: Add missing include of of.h
	qed: Fix TM block ILT allocation
	rtmutex: Fix PI chain order integrity
	printk: Correctly handle preemption in console_unlock()
	drm: rcar-du: Handle event when disabling CRTCs
	ARM: dts: koelsch: Correct clock frequency of X2 DU clock input
	reiserfs: Make cancel_old_flush() reliable
	ASoC: rt5677: Add OF device ID table
	IB/hfi1: Check for QSFP presence before attempting reads
	ALSA: firewire-digi00x: add support for console models of Digi00x series
	ALSA: firewire-digi00x: handle all MIDI messages on streaming packets
	fm10k: correctly check if interface is removed
	EDAC, altera: Fix peripheral warnings for Cyclone5
	scsi: ses: don't get power status of SES device slot on probe
	qed: Correct MSI-x for storage
	apparmor: Make path_max parameter readonly
	iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range
	kvm/svm: Setup MCG_CAP on AMD properly
	kvm: nVMX: Disallow userspace-injected exceptions in guest mode
	video: ARM CLCD: fix dma allocation size
	drm/radeon: Fail fb creation from imported dma-bufs.
	drm/amdgpu: Fail fb creation from imported dma-bufs. (v2)
	drm/rockchip: vop: Enable pm domain before vop_initial
	i40e: only register client on iWarp-capable devices
	coresight: Fixes coresight DT parse to get correct output port ID.
	lkdtm: turn off kcov for lkdtm_rodata_do_nothing:
	tty: amba-pl011: Fix spurious TX interrupts
	serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off
	MIPS: BPF: Quit clobbering callee saved registers in JIT code.
	MIPS: BPF: Fix multiple problems in JIT skb access helpers.
	MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification
	MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters
	v4l: vsp1: Prevent multiple streamon race commencing pipeline early
	v4l: vsp1: Register pipe with output WPF
	regulator: isl9305: fix array size
	md/raid6: Fix anomily when recovering a single device in RAID6.
	md.c:didn't unlock the mddev before return EINVAL in array_size_store
	powerpc/nohash: Fix use of mmu_has_feature() in setup_initial_memory_limit()
	usb: dwc2: Make sure we disconnect the gadget state
	usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control()
	perf evsel: Return exact sub event which failed with EPERM for wildcards
	iwlwifi: mvm: fix RX SKB header size and align it properly
	drivers/perf: arm_pmu: handle no platform_device
	perf inject: Copy events when reordering events in pipe mode
	net: fec: add phy-reset-gpios PROBE_DEFER check
	perf session: Don't rely on evlist in pipe mode
	vfio/powerpc/spapr_tce: Enforce IOMMU type compatibility check
	vfio/spapr_tce: Check kzalloc() return when preregistering memory
	scsi: sg: check for valid direction before starting the request
	scsi: sg: close race condition in sg_remove_sfp_usercontext()
	ALSA: hda: Add Geminilake id to SKL_PLUS
	kprobes/x86: Fix kprobe-booster not to boost far call instructions
	kprobes/x86: Set kprobes pages read-only
	pwm: tegra: Increase precision in PWM rate calculation
	clk: qcom: msm8996: Fix the vfe1 powerdomain name
	Bluetooth: Avoid bt_accept_unlink() double unlinking
	Bluetooth: 6lowpan: fix delay work init in add_peer_chan()
	mac80211_hwsim: use per-interface power level
	ath10k: fix compile time sanity check for CE4 buffer size
	wil6210: fix protection against connections during reset
	wil6210: fix memory access violation in wil_memcpy_from/toio_32
	perf stat: Fix bug in handling events in error state
	mwifiex: Fix invalid port issue
	drm/edid: set ELD connector type in drm_edid_to_eld()
	video/hdmi: Allow "empty" HDMI infoframes
	HID: elo: clear BTN_LEFT mapping
	iwlwifi: mvm: rs: don't override the rate history in the search cycle
	clk: meson: gxbb: fix wrong clock for SARADC/SANA
	ARM: dts: exynos: Correct Trats2 panel reset line
	sched: Stop switched_to_rt() from sending IPIs to offline CPUs
	sched: Stop resched_cpu() from sending IPIs to offline CPUs
	test_firmware: fix setting old custom fw path back on exit
	net: ieee802154: adf7242: Fix bug if defined DEBUG
	net: xfrm: allow clearing socket xfrm policies.
	mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
	net: thunderx: Set max queue count taking XDP_TX into account
	ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
	ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
	mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
	userns: Don't fail follow_automount based on s_user_ns
	leds: pm8058: Silence pointer to integer size warning
	power: supply: ab8500_charger: Fix an error handling path
	power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
	ath10k: update tdls teardown state to target
	scsi: ses: don't ask for diagnostic pages repeatedly during probe
	pwm: stmpe: Fix wrong register offset for hwpwm=2 case
	clk: qcom: msm8916: fix mnd_width for codec_digcodec
	mwifiex: cfg80211: do not change virtual interface during scan processing
	ath10k: fix invalid STS_CAP_OFFSET_MASK
	tools/usbip: fixes build with musl libc toolchain
	spi: sun6i: disable/unprepare clocks on remove
	bnxt_en: Don't print "Link speed -1 no longer supported" messages.
	scsi: core: scsi_get_device_flags_keyed(): Always return device flags
	scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
	scsi: dh: add new rdac devices
	media: vsp1: Prevent suspending and resuming DRM pipelines
	media: cpia2: Fix a couple off by one bugs
	veth: set peer GSO values
	drm/amdkfd: Fix memory leaks in kfd topology
	powerpc/modules: Don't try to restore r2 after a sibling call
	agp/intel: Flush all chipset writes after updating the GGTT
	mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
	mac80211: remove BUG() when interface type is invalid
	ASoC: nuc900: Fix a loop timeout test
	ipvlan: add L2 check for packets arriving via virtual devices
	rcutorture/configinit: Fix build directory error message
	locking/locktorture: Fix num reader/writer corner cases
	ima: relax requiring a file signature for new files with zero length
	net: hns: Some checkpatch.pl script & warning fixes
	x86/boot/32: Fix UP boot on Quark and possibly other platforms
	x86/cpufeatures: Add Intel PCONFIG cpufeature
	selftests/x86/entry_from_vm86: Exit with 1 if we fail
	selftests/x86: Add tests for User-Mode Instruction Prevention
	selftests/x86: Add tests for the STR and SLDT instructions
	selftests/x86/entry_from_vm86: Add test cases for POPF
	x86/vm86/32: Fix POPF emulation
	x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels
	x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist
	x86/mm: Fix vmalloc_fault to use pXd_large
	parisc: Handle case where flush_cache_range is called with no context
	ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
	ALSA: hda - Revert power_save option default value
	ALSA: seq: Fix possible UAF in snd_seq_check_queue()
	ALSA: seq: Clear client entry before deleting else at closing
	drm/amdgpu: fix prime teardown order
	drm/amdgpu/dce: Don't turn off DP sink when disconnected
	fs: Teach path_connected to handle nfs filesystems with multiple roots.
	lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
	fs/aio: Add explicit RCU grace period when freeing kioctx
	fs/aio: Use RCU accessors for kioctx_table->table[]
	irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
	scsi: sg: fix SG_DXFER_FROM_DEV transfers
	scsi: sg: fix static checker warning in sg_is_valid_dxfer
	scsi: sg: only check for dxfer_len greater than 256M
	btrfs: alloc_chunk: fix DUP stripe size handling
	btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
	scsi: qla2xxx: Fix extraneous ref on sp's after adapter break
	USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe()
	usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
	usb: gadget: bdc: 64-bit pointer capability check
	Linux 4.9.89

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-03-22 09:54:47 +01:00
Arnd Bergmann
ad8d41ba59 lkdtm: turn off kcov for lkdtm_rodata_do_nothing:
[ Upstream commit 7064dc7fc1 ]

I ran into a link error on ARM64 for lkdtm_rodata_do_nothing:

drivers/misc/built-in.o: In function `lkdtm_rodata_do_nothing':
:(.rodata+0x68c8): relocation truncated to fit: R_AARCH64_CALL26 against symbol `__sanitizer_cov_trace_pc' defined in .text section in kernel/built-in.o

I did not analyze this further, but my theory is that we would need a trampoline
to call __sanitizer_cov_trace_pc(), but the linker (correctly) only adds trampolines
for callers in executable sections.

Disabling KCOV for this one file avoids the build failure with no
other practical downsides I can think of.

The problem can only happen on kernels that contain both kcov and
lkdtm, so if we want to backport this, it should be in the earliest
version that has both (v4.8).

Fixes: 5c9a8750a6 ("kernel: add kcov code coverage")
Fixes: 9a49a528dc ("lkdtm: add function for testing .rodata section")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-22 09:17:49 +01:00
Mauricio Faria de Oliveira
7cd70b3f8c scsi: ses: don't get power status of SES device slot on probe
[ Upstream commit 75106523f3 ]

The commit 08024885a2 ("ses: Add power_status to SES device slot")
introduced the 'power_status' attribute to enclosure components and
the associated callbacks.

There are 2 callbacks available to get the power status of a device:
1) ses_get_power_status() for 'struct enclosure_component_callbacks'
2) get_component_power_status() for the sysfs device attribute
(these are available for kernel-space and user-space, respectively.)

However, despite both methods being available to get power status
on demand, that commit also introduced a call to get power status
in ses_enclosure_data_process().

This dramatically increased the total probe time for SCSI devices
on larger configurations, because ses_enclosure_data_process() is
called several times during the SCSI devices probe and loops over
the component devices (but that is another problem, another patch).

That results in a tremendous continuous hammering of SCSI Receive
Diagnostics commands to the enclosure-services device, which does
delay the total probe time for the SCSI devices __significantly__:

  Originally, ~34 minutes on a system attached to ~170 disks:

    [ 9214.490703] mpt3sas version 13.100.00.00 loaded
    ...
    [11256.580231] scsi 17:0:177:0: qdepth(16), tagged(1), simple(0),
                   ordered(0), scsi_level(6), cmd_que(1)

  With this patch, it decreased to ~2.5 minutes -- a 13.6x faster

    [ 1002.992533] mpt3sas version 13.100.00.00 loaded
    ...
    [ 1151.978831] scsi 11:0:177:0: qdepth(16), tagged(1), simple(0),
                   ordered(0), scsi_level(6), cmd_que(1)

Back to the commit discussion.. on the ses_get_power_status() call
introduced in ses_enclosure_data_process(): impact of removing it.

That may possibly be in place to initialize the power status value
on device probe.  However, those 2 functions available to retrieve
that value _do_ automatically refresh/update it.  So the potential
benefit would be a direct access of the 'power_status' field which
does not use the callbacks...

But the only reader of 'struct enclosure_component::power_status'
is the get_component_power_status() callback for sysfs attribute,
and it _does_ check for and call the .get_power_status callback,
(which indeed is defined and implemented by that commit), so the
power status value is, again, automatically updated.

So, the remaining potential for a direct/non-callback access to
the power_status attribute would be out-of-tree modules -- well,
for those, if they are for whatever reason interested in values
that are set during device probe and not up-to-date by the time
they need it.. well, that would be curious.

Well, to handle that more properly, set the initial power state
value to '-1' (i.e., uninitialized) instead of '1' (power 'on'),
and check for it in that callback which may do an direct access
to the field value _if_ a callback function is not defined.

Signed-off-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
Fixes: 08024885a2 ("ses: Add power_status to SES device slot")
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-22 09:17:48 +01:00
Kees Cook
24da2c84bd BACKPORT: treewide: Fix function prototypes for module_param_call()
Several function prototypes for the set/get functions defined by
module_param_call() have a slightly wrong argument types. This fixes
those in an effort to clean up the calls when running under type-enforced
compiler instrumentation for CFI. This is the result of running the
following semantic patch:

@match_module_param_call_function@
declarer name module_param_call;
identifier _name, _set_func, _get_func;
expression _arg, _mode;
@@

 module_param_call(_name, _set_func, _get_func, _arg, _mode);

@fix_set_prototype
 depends on match_module_param_call_function@
identifier match_module_param_call_function._set_func;
identifier _val, _param;
type _val_type, _param_type;
@@

 int _set_func(
-_val_type _val
+const char * _val
 ,
-_param_type _param
+const struct kernel_param * _param
 ) { ... }

@fix_get_prototype
 depends on match_module_param_call_function@
identifier match_module_param_call_function._get_func;
identifier _val, _param;
type _val_type, _param_type;
@@

 int _get_func(
-_val_type _val
+char * _val
 ,
-_param_type _param
+const struct kernel_param * _param
 ) { ... }

Two additional by-hand changes are included for places where the above
Coccinelle script didn't notice them:

	drivers/platform/x86/thinkpad_acpi.c
	fs/lockd/svc.c

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jessica Yu <jeyu@kernel.org>

Bug: 67506682
Change-Id: I2c9c0ee8ed28065e63270a52c155e5e7d2791295
(cherry picked from commit e4dca7b7aa)
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2018-02-28 15:09:58 -08:00
Sami Tolvanen
f437c20fc6 drivers/misc: disable LTO for lkdtm_rodata.o
Disable LTO for lkdtm_rodata.o to allow objcopy to be used to
manipulate sections.

Bug: 62093296
Bug: 67506682
Change-Id: Iedd1a3a2a9b06f44e7ceb6ac287ea764eaf5ef0a
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2018-02-28 15:09:58 -08:00
Artem Borisov
f0f6293fd0 ANDROID: uid_sys_stats: fix the comment
It is not uid_cputime.c anymore.

Change-Id: I7effc2a449c1f9cba9d86a7b122a9c05fc266405
Signed-off-by: Artem Borisov <dedsa2002@gmail.com>
2018-01-13 18:21:36 +03:00
Greg Kroah-Hartman
cb7518e616 Merge 4.9.72 into android-4.9
Changes in 4.9.72
	cxl: Check if vphb exists before iterating over AFU devices
	arm64: Initialise high_memory global variable earlier
	ALSA: hda - add support for docking station for HP 820 G2
	ALSA: hda - add support for docking station for HP 840 G3
	kvm: fix usage of uninit spinlock in avic_vm_destroy()
	HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB
	HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair
	arm: kprobes: Fix the return address of multiple kretprobes
	arm: kprobes: Align stack to 8-bytes in test code
	nvme-loop: handle cpu unplug when re-establishing the controller
	cpuidle: Validate cpu_dev in cpuidle_add_sysfs()
	r8152: fix the list rx_done may be used without initialization
	crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex
	vsock: track pkt owner vsock
	vhost-vsock: add pkt cancel capability
	vsock: cancel packets when failing to connect
	sch_dsmark: fix invalid skb_cow() usage
	bna: integer overflow bug in debugfs
	sctp: out_qlen should be updated when pruning unsent queue
	net: qmi_wwan: Add USB IDs for MDM6600 modem on Motorola Droid 4
	hwmon: (max31790) Set correct PWM value
	usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed
	usb: gadget: udc: remove pointer dereference after free
	netfilter: nfnl_cthelper: fix runtime expectation policy updates
	netfilter: nfnl_cthelper: Fix memory leak
	iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5
	r8152: fix the rx early size of RTL8153
	tipc: fix nametbl deadlock at tipc_nametbl_unsubscribe
	inet: frag: release spinlock before calling icmp_send()
	pinctrl: st: add irq_request/release_resources callbacks
	scsi: lpfc: Fix PT2PT PRLI reject
	kvm: vmx: Flush TLB when the APIC-access address changes
	KVM: x86: correct async page present tracepoint
	KVM: VMX: Fix enable VPID conditions
	ARM: dts: ti: fix PCI bus dtc warnings
	hwmon: (asus_atk0110) fix uninitialized data access
	HID: xinmo: fix for out of range for THT 2P arcade controller.
	ASoC: STI: Fix reader substream pointer set
	r8152: prevent the driver from transmitting packets with carrier off
	s390/qeth: size calculation outbound buffers
	s390/qeth: no ETH header for outbound AF_IUCV
	bna: avoid writing uninitialized data into hw registers
	i40iw: Receive netdev events post INET_NOTIFIER state
	IB/core: Protect against self-requeue of a cq work item
	infiniband: Fix alignment of mmap cookies to support VIPT caching
	nbd: set queue timeout properly
	net: Do not allow negative values for busy_read and busy_poll sysctl interfaces
	IB/rxe: double free on error
	IB/rxe: increment msn only when completing a request
	i40e: Do not enable NAPI on q_vectors that have no rings
	RDMA/iser: Fix possible mr leak on device removal event
	irda: vlsi_ir: fix check for DMA mapping errors
	netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table
	netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register
	ARM: dts: am335x-evmsk: adjust mmc2 param to allow suspend
	cpufreq: Fix creation of symbolic links to policy directories
	net: ipconfig: fix ic_close_devs() use-after-free
	KVM: pci-assign: do not map smm memory slot pages in vt-d page tables
	virtio-balloon: use actual number of stats for stats queue buffers
	virtio_balloon: prevent uninitialized variable use
	isdn: kcapi: avoid uninitialized data
	net: moxa: fix TX overrun memory leak
	xhci: plat: Register shutdown for xhci_plat
	netfilter: nfnetlink_queue: fix secctx memory leak
	Btrfs: fix an integer overflow check
	ARM: dma-mapping: disallow dma_get_sgtable() for non-kernel managed memory
	cpuidle: powernv: Pass correct drv->cpumask for registration
	bnxt_en: Fix NULL pointer dereference in reopen failure path
	backlight: pwm_bl: Fix overflow condition
	crypto: crypto4xx - increase context and scatter ring buffer elements
	rtc: pl031: make interrupt optional
	kvm, mm: account kvm related kmem slabs to kmemcg
	net: phy: at803x: Change error to EINVAL for invalid MAC
	PCI: Avoid bus reset if bridge itself is broken
	scsi: cxgb4i: fix Tx skb leak
	scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive
	PCI: Create SR-IOV virtfn/physfn links before attaching driver
	PM / OPP: Move error message to debug level
	igb: check memory allocation failure
	ixgbe: fix use of uninitialized padding
	IB/rxe: check for allocation failure on elem
	PCI/AER: Report non-fatal errors only to the affected endpoint
	tracing: Exclude 'generic fields' from histograms
	ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback
	fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw
	scsi: lpfc: Fix secure firmware updates
	scsi: lpfc: PLOGI failures during NPIV testing
	vfio/pci: Virtualize Maximum Payload Size
	fm10k: ensure we process SM mbx when processing VF mbx
	net: ipv6: send NS for DAD when link operationally up
	staging: greybus: light: Release memory obtained by kasprintf
	clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision
	tcp: fix under-evaluated ssthresh in TCP Vegas
	rtc: set the alarm to the next expiring timer
	cpuidle: fix broadcast control when broadcast can not be entered
	thermal: hisilicon: Handle return value of clk_prepare_enable
	thermal/drivers/hisi: Fix missing interrupt enablement
	thermal/drivers/hisi: Fix kernel panic on alarm interrupt
	thermal/drivers/hisi: Simplify the temperature/step computation
	thermal/drivers/hisi: Fix multiple alarm interrupts firing
	MIPS: math-emu: Fix final emulation phase for certain instructions
	platform/x86: asus-wireless: send an EV_SYN/SYN_REPORT between state changes
	Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
	bpf: adjust insn_aux_data when patching insns
	bpf: fix branch pruning logic
	bpf: reject out-of-bounds stack pointer calculation
	bpf: fix incorrect sign extension in check_alu_op()
	sparc32: Export vac_cache_size to fix build error
	Linux 4.9.72

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-12-27 13:38:06 +01:00
Vaibhav Jain
76fcdc8cbb cxl: Check if vphb exists before iterating over AFU devices
commit 12841f87b7 upstream.

During an eeh a kernel-oops is reported if no vPHB is allocated to the
AFU. This happens as during AFU init, an error in creation of vPHB is
a non-fatal error. Hence afu->phb should always be checked for NULL
before iterating over it for the virtual AFU pci devices.

This patch fixes the kenel-oops by adding a NULL pointer check for
afu->phb before it is dereferenced.

Fixes: 9e8df8a219 ("cxl: EEH support")
Signed-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Acked-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-25 14:23:36 +01:00
Greg Kroah-Hartman
319c8e1bc7 Merge 4.9.71 into android-4.9
Changes in 4.9.71
	mfd: fsl-imx25: Clean up irq settings during removal
	crypto: rsa - fix buffer overread when stripping leading zeroes
	crypto: hmac - require that the underlying hash algorithm is unkeyed
	crypto: salsa20 - fix blkcipher_walk API usage
	autofs: fix careless error in recent commit
	tracing: Allocate mask_str buffer dynamically
	USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
	USB: core: prevent malicious bNumInterfaces overflow
	usbip: fix stub_rx: get_pipe() to validate endpoint number
	usb: add helper to extract bits 12:11 of wMaxPacketSize
	usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
	usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
	ceph: drop negative child dentries before try pruning inode's alias
	usb: xhci: fix TDS for MTK xHCI1.1
	Bluetooth: btusb: driver to enable the usb-wakeup feature
	xhci: Don't add a virt_dev to the devs array before it's fully allocated
	nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
	sched/rt: Do not pull from current CPU if only one CPU to pull
	eeprom: at24: change nvmem stride to 1
	dmaengine: dmatest: move callback wait queue to thread context
	ext4: fix fdatasync(2) after fallocate(2) operation
	ext4: fix crash when a directory's i_size is too small
	mac80211: Fix addition of mesh configuration element
	usb: phy: isp1301: Add OF device ID table
	KVM: nVMX: do not warn when MSR bitmap address is not backed
	usb: xhci-mtk: check hcc_params after adding primary hcd
	md-cluster: free md_cluster_info if node leave cluster
	userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
	userfaultfd: selftest: vm: allow to build in vm/ directory
	net: initialize msg.msg_flags in recvfrom
	bnxt_en: Ignore 0 value in autoneg supported speed from firmware.
	net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
	net: bcmgenet: correct MIB access of UniMAC RUNT counters
	net: bcmgenet: reserved phy revisions must be checked first
	net: bcmgenet: power down internal phy if open or resume fails
	net: bcmgenet: synchronize irq0 status between the isr and task
	net: bcmgenet: Power up the internal PHY before probing the MII
	rxrpc: Wake up the transmitter if Rx window size increases on the peer
	net/mlx5: Fix create autogroup prev initializer
	net/mlx5: Don't save PCI state when PCI error is detected
	iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
	drm/amdgpu: fix parser init error path to avoid crash in parser fini
	NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
	NFSD: fix nfsd_reset_versions for NFSv4.
	Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
	drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
	netfilter: bridge: honor frag_max_size when refragmenting
	ASoC: rsnd: fix sound route path when using SRC6/SRC9
	blk-mq: Fix tagset reinit in the presence of cpu hot-unplug
	writeback: fix memory leak in wb_queue_work()
	net: wimax/i2400m: fix NULL-deref at probe
	dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
	irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN
	net: Resend IGMP memberships upon peer notification.
	mlxsw: reg: Fix SPVM max record count
	mlxsw: reg: Fix SPVMLR max record count
	qed: Align CIDs according to DORQ requirement
	qed: Fix mapping leak on LL2 rx flow
	qed: Fix interrupt flags on Rx LL2
	drm: amd: remove broken include path
	intel_th: pci: Add Gemini Lake support
	openrisc: fix issue handling 8 byte get_user calls
	ASoC: rcar: clear DE bit only in PDMACHCR when it stops
	scsi: hpsa: update check for logical volume status
	scsi: hpsa: limit outstanding rescans
	scsi: hpsa: do not timeout reset operations
	fjes: Fix wrong netdevice feature flags
	drm/radeon/si: add dpm quirk for Oland
	Drivers: hv: util: move waiting for release to hv_utils_transport itself
	iwlwifi: mvm: cleanup pending frames in DQA mode
	sched/deadline: Add missing update_rq_clock() in dl_task_timer()
	sched/deadline: Make sure the replenishment timer fires in the next period
	sched/deadline: Throttle a constrained deadline task activated after the deadline
	sched/deadline: Use deadline instead of period when calculating overflow
	mmc: mediatek: Fixed bug where clock frequency could be set wrong
	drm/radeon: reinstate oland workaround for sclk
	afs: Fix missing put_page()
	afs: Populate group ID from vnode status
	afs: Adjust mode bits processing
	afs: Deal with an empty callback array
	afs: Flush outstanding writes when an fd is closed
	afs: Migrate vlocation fields to 64-bit
	afs: Prevent callback expiry timer overflow
	afs: Fix the maths in afs_fs_store_data()
	afs: Invalid op ID should abort with RXGEN_OPCODE
	afs: Better abort and net error handling
	afs: Populate and use client modification time
	afs: Fix page leak in afs_write_begin()
	afs: Fix afs_kill_pages()
	afs: Fix abort on signal while waiting for call completion
	nvme-loop: fix a possible use-after-free when destroying the admin queue
	nvmet: confirm sq percpu has scheduled and switched to atomic
	nvmet-rdma: Fix a possible uninitialized variable dereference
	net/mlx4_core: Avoid delays during VF driver device shutdown
	net: mpls: Fix nexthop alive tracking on down events
	rxrpc: Ignore BUSY packets on old calls
	tty: don't panic on OOM in tty_set_ldisc()
	tty: fix data race in tty_ldisc_ref_wait()
	perf symbols: Fix symbols__fixup_end heuristic for corner cases
	efi/esrt: Cleanup bad memory map log messages
	NFSv4.1 respect server's max size in CREATE_SESSION
	btrfs: add missing memset while reading compressed inline extents
	target: Use system workqueue for ALUA transitions
	target: fix ALUA transition timeout handling
	target: fix race during implicit transition work flushes
	Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
	HID: cp2112: fix broken gpio_direction_input callback
	sfc: don't warn on successful change of MAC
	fbdev: controlfb: Add missing modes to fix out of bounds access
	video: udlfb: Fix read EDID timeout
	video: fbdev: au1200fb: Release some resources if a memory allocation fails
	video: fbdev: au1200fb: Return an error code if a memory allocation fails
	rtc: pcf8563: fix output clock rate
	ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case
	dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
	PCI/PME: Handle invalid data when reading Root Status
	powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
	PCI: Do not allocate more buses than available in parent
	iommu/mediatek: Fix driver name
	netfilter: ipvs: Fix inappropriate output of procfs
	powerpc/opal: Fix EBUSY bug in acquiring tokens
	powerpc/ipic: Fix status get and status clear
	platform/x86: intel_punit_ipc: Fix resource ioremap warning
	target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
	iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
	target:fix condition return in core_pr_dump_initiator_port()
	target/file: Do not return error for UNMAP if length is zero
	badblocks: fix wrong return value in badblocks_set if badblocks are disabled
	iommu/amd: Limit the IOVA page range to the specified addresses
	xfs: truncate pagecache before writeback in xfs_setattr_size()
	arm-ccn: perf: Prevent module unload while PMU is in use
	crypto: tcrypt - fix buffer lengths in test_aead_speed()
	mm: Handle 0 flags in _calc_vm_trans() macro
	clk: mediatek: add the option for determining PLL source clock
	clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
	clk: hi6220: mark clock cs_atb_syspll as critical
	clk: tegra: Fix cclk_lp divisor register
	ppp: Destroy the mutex when cleanup
	ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod
	thermal/drivers/step_wise: Fix temperature regulation misbehavior
	scsi: scsi_debug: write_same: fix error report
	GFS2: Take inode off order_write list when setting jdata flag
	bcache: explicitly destroy mutex while exiting
	bcache: fix wrong cache_misses statistics
	Ib/hfi1: Return actual operational VLs in port info query
	arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27
	btrfs: tests: Fix a memory leak in error handling path in 'run_test()'
	platform/x86: hp_accel: Add quirk for HP ProBook 440 G4
	nvme: use kref_get_unless_zero in nvme_find_get_ns
	l2tp: cleanup l2tp_tunnel_delete calls
	xfs: fix log block underflow during recovery cycle verification
	xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
	RDMA/cxgb4: Declare stag as __be32
	PCI: Detach driver before procfs & sysfs teardown on device remove
	scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
	scsi: hpsa: destroy sas transport properties before scsi_host
	powerpc/perf/hv-24x7: Fix incorrect comparison in memord
	soc: mediatek: pwrap: fix compiler errors
	tty fix oops when rmmod 8250
	usb: musb: da8xx: fix babble condition handling
	pinctrl: adi2: Fix Kconfig build problem
	raid5: Set R5_Expanded on parity devices as well as data.
	scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
	IB/core: Fix calculation of maximum RoCE MTU
	vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
	rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd
	rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd
	scsi: sd: change manage_start_stop to bool in sysfs interface
	scsi: sd: change allow_restart to bool in sysfs interface
	scsi: bfa: integer overflow in debugfs
	udf: Avoid overflow when session starts at large offset
	macvlan: Only deliver one copy of the frame to the macvlan interface
	RDMA/cma: Avoid triggering undefined behavior
	IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
	icmp: don't fail on fragment reassembly time exceeded
	ath9k: fix tx99 potential info leak
	Linux 4.9.71

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-12-20 10:51:15 +01:00
David Lechner
744cb5ab33 eeprom: at24: change nvmem stride to 1
commit 7f6d2ecd3d upstream.

Trying to read the MAC address from an eeprom that has an offset that
is not a multiple of 4 causes an error currently.

Fix it by changing the nvmem stride to 1.

Signed-off-by: David Lechner <david@lechnology.com>
[Bartosz: tweaked the commit message]
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-20 10:07:17 +01:00
Greg Kroah-Hartman
12cae95a09 Merge 4.9.67 into android-4.9
Changes in 4.9.67
	ARM: dts: LogicPD Torpedo: Fix camera pin mux
	ARM: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio
	mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
	mm/cma: fix alloc_contig_range ret code/potential leak
	mm, hugetlbfs: introduce ->split() to vm_operations_struct
	mm/madvise.c: fix madvise() infinite loop under special circumstances
	btrfs: clear space cache inode generation always
	nfsd: Fix stateid races between OPEN and CLOSE
	nfsd: Fix another OPEN stateid race
	nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
	mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot
	ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
	KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk
	KVM: x86: Exit to user-mode on #UD intercept when emulator requires
	KVM: x86: inject exceptions produced by x86_decode_insn
	KVM: lapic: Split out x2apic ldr calculation
	KVM: lapic: Fixup LDR on load in x2apic
	mmc: core: Do not leave the block driver in a suspended state
	mmc: core: prepend 0x to OCR entry in sysfs
	eeprom: at24: fix reading from 24MAC402/24MAC602
	eeprom: at24: correctly set the size for at24mac402
	eeprom: at24: check at24_read/write arguments
	i2c: i801: Fix Failed to allocate irq -2147483648 error
	bcache: Fix building error on MIPS
	hwmon: (jc42) optionally try to disable the SMBUS timeout
	nvme-pci: add quirk for delay before CHK RDY for WDC SN200
	Revert "drm/radeon: dont switch vt on suspend"
	drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs()
	drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories()
	drm/radeon: fix atombios on big endian
	drm/panel: simple: Add missing panel_simple_unprepare() calls
	drm/hisilicon: Ensure LDI regs are properly configured.
	drm/ttm: once more fix ttm_buffer_object_transfer
	drm/amd/pp: fix typecast error in powerplay.
	Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()"
	NFS: revalidate "." etc correctly on "open".
	drm/i915: Don't try indexed reads to alternate slave addresses
	drm/i915: Prevent zero length "index" write
	Linux 4.9.67

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-12-05 11:34:59 +01:00
Heiner Kallweit
19699abea3 eeprom: at24: check at24_read/write arguments
commit d9bcd462da upstream.

So far we completely rely on the caller to provide valid arguments.
To be on the safe side perform an own sanity check.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-05 11:24:34 +01:00
Bartosz Golaszewski
d3da2efa6d eeprom: at24: correctly set the size for at24mac402
commit 5478e478ee upstream.

There's an ilog2() expansion in AT24_DEVICE_MAGIC() which rounds down
the actual size of EUI-48 byte array in at24mac402 eeproms to 4 from 6,
making it impossible to read it all.

Fix it by manually adjusting the value in probe().

This patch contains a temporary fix that is suitable for stable
branches. Eventually we'll probably remove the call to ilog2() while
converting the magic values to actual structs.

Fixes: 0b813658c1 ("eeprom: at24: add support for at24mac series")
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-05 11:24:33 +01:00
Heiner Kallweit
388d8c9fa3 eeprom: at24: fix reading from 24MAC402/24MAC602
commit 644a1f19c6 upstream.

Chip datasheet mentions that word addresses other than the actual
start position of the MAC delivers undefined results. So fix this.
Current implementation doesn't work due to this wrong offset.

Fixes: 0b813658c1 ("eeprom: at24: add support for at24mac series")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-05 11:24:33 +01:00
Greg Kroah-Hartman
44a3afcce1 Merge 4.9.63 into android-4.9
Changes in 4.9.63
	gso: fix payload length when gso_size is zero
	tun/tap: sanitize TUNSETSNDBUF input
	ipv6: addrconf: increment ifp refcount before ipv6_del_addr()
	netlink: do not set cb_running if dump's start() errs
	net: call cgroup_sk_alloc() earlier in sk_clone_lock()
	tcp: fix tcp_mtu_probe() vs highest_sack
	l2tp: check ps->sock before running pppol2tp_session_ioctl()
	tun: call dev_get_valid_name() before register_netdevice()
	sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect
	tcp/dccp: fix ireq->opt races
	packet: avoid panic in packet_getsockopt()
	soreuseport: fix initialization race
	ipv6: flowlabel: do not leave opt->tot_len with garbage
	sctp: full support for ipv6 ip_nonlocal_bind & IP_FREEBIND
	tcp/dccp: fix lockdep splat in inet_csk_route_req()
	tcp/dccp: fix other lockdep splats accessing ireq_opt
	net/unix: don't show information about sockets from other namespaces
	tap: double-free in error path in tap_open()
	ipip: only increase err_count for some certain type icmp in ipip_err
	ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err
	ip6_gre: update dst pmtu if dev mtu has been updated by toobig in __gre6_xmit
	tun: allow positive return values on dev_get_valid_name() call
	sctp: reset owner sk for data chunks on out queues when migrating a sock
	net_sched: avoid matching qdisc with zero handle
	ppp: fix race in ppp device destruction
	mac80211: accept key reinstall without changing anything
	mac80211: use constant time comparison with keys
	mac80211: don't compare TKIP TX MIC key in reinstall prevention
	usb: usbtest: fix NULL pointer dereference
	Input: ims-psu - check if CDC union descriptor is sane
	ALSA: seq: Cancel pending autoload work at unbinding device
	Revert "ARM: dts: imx53-qsb-common: fix FEC pinmux config"
	netfilter: nat: avoid use of nf_conn_nat extension
	netfilter: nat: Revert "netfilter: nat: convert nat bysrc hash to rhashtable"
	security/keys: add CONFIG_KEYS_COMPAT to Kconfig
	brcmfmac: remove setting IBSS mode when stopping AP
	target/iscsi: Fix iSCSI task reassignment handling
	qla2xxx: Fix incorrect tcm_qla2xxx_free_cmd use during TMR ABORT (v2)
	misc: panel: properly restore atomic counter on error path
	Linux 4.9.63

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-11-18 17:25:57 +01:00
Willy Tarreau
e81b96cab1 misc: panel: properly restore atomic counter on error path
commit 93dc1774d2 upstream.

Commit f4757af ("staging: panel: Fix single-open policy race condition")
introduced in 3.19-rc1 attempted to fix a race condition on the open, but
failed to properly do it and used to exit without restoring the semaphore.

This results in -EBUSY being returned after the first open error until
the module is reloaded or the system restarted (ie: consecutive to a
dual open resulting in -EBUSY or to a permission error).

Fixes: f4757af85 # 3.19-rc1
Cc: Mariusz Gorski <marius.gorski@gmail.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
[wt: driver is in misc/panel in 4.9]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-18 11:22:25 +01:00
Greg Kroah-Hartman
a6d71ba679 Merge 4.9.62 into android-4.9
Changes in 4.9.62
	adv7604: Initialize drive strength to default when using DT
	video: fbdev: pmag-ba-fb: Remove bad `__init' annotation
	PCI: mvebu: Handle changes to the bridge windows while enabled
	sched/core: Add missing update_rq_clock() call in sched_move_task()
	xen/netback: set default upper limit of tx/rx queues to 8
	ARM: dts: imx53-qsb-common: fix FEC pinmux config
	dt-bindings: clockgen: Add compatible string for LS1012A
	EDAC, amd64: Add x86cpuid sanity check during init
	PM / OPP: Error out on failing to add static OPPs for v1 bindings
	clk: samsung: exynos5433: Add IDs for PHYCLK_MIPIDPHY0_* clocks
	drm: drm_minor_register(): Clean up debugfs on failure
	KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter
	iommu/arm-smmu-v3: Clear prior settings when updating STEs
	pinctrl: baytrail: Fix debugfs offset output
	powerpc/corenet: explicitly disable the SDHC controller on kmcoge4
	cxl: Force psl data-cache flush during device shutdown
	ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6
	arm64: dma-mapping: Only swizzle DMA ops for IOMMU_DOMAIN_DMA
	crypto: vmx - disable preemption to enable vsx in aes_ctr.c
	drm: mali-dp: fix Lx_CONTROL register fields clobber
	iio: trigger: free trigger resource correctly
	iio: pressure: ms5611: claim direct mode during oversampling changes
	iio: magnetometer: mag3110: claim direct mode during raw writes
	iio: proximity: sx9500: claim direct mode during raw proximity reads
	dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification
	dt-bindings: Add vendor prefix for LEGO
	phy: increase size of MII_BUS_ID_SIZE and bus_id
	serial: sh-sci: Fix register offsets for the IRDA serial port
	libertas: fix improper return value
	usb: hcd: initialize hcd->flags to 0 when rm hcd
	netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family
	brcmfmac: setup wiphy bands after registering it first
	rt2800usb: mark tx failure on timeout
	apparmor: fix undefined reference to `aa_g_hash_policy'
	IPsec: do not ignore crypto err in ah4 input
	EDAC, amd64: Save and return err code from probe_one_instance()
	s390/topology: make "topology=off" parameter work
	Input: mpr121 - handle multiple bits change of status register
	Input: mpr121 - set missing event capability
	sched/cputime, powerpc32: Fix stale scaled stime on context switch
	IB/ipoib: Change list_del to list_del_init in the tx object
	ARM: dts: STiH410-family: fix wrong parent clock frequency
	s390/qeth: fix retrieval of vipa and proxy-arp addresses
	s390/qeth: issue STARTLAN as first IPA command
	wcn36xx: Don't use the destroyed hal_mutex
	IB/rxe: Fix reference leaks in memory key invalidation code
	clk: mvebu: adjust AP806 CPU clock frequencies to production chip
	net: dsa: select NET_SWITCHDEV
	platform/x86: hp-wmi: Fix detection for dock and tablet mode
	cdc_ncm: Set NTB format again after altsetting switch for Huawei devices
	KEYS: trusted: sanitize all key material
	KEYS: trusted: fix writing past end of buffer in trusted_read()
	platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state
	platform/x86: hp-wmi: Do not shadow error values
	x86/uaccess, sched/preempt: Verify access_ok() context
	workqueue: Fix NULL pointer dereference
	crypto: ccm - preserve the IV buffer
	crypto: x86/sha1-mb - fix panic due to unaligned access
	crypto: x86/sha256-mb - fix panic due to unaligned access
	KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]
	ARM: 8720/1: ensure dump_instr() checks addr_limit
	ALSA: seq: Fix OSS sysex delivery in OSS emulation
	ALSA: seq: Avoid invalid lockdep class warning
	drm/i915: Do not rely on wm preservation for ILK watermarks
	MIPS: microMIPS: Fix incorrect mask in insn_table_MM
	MIPS: Fix CM region target definitions
	MIPS: SMP: Use a completion event to signal CPU up
	MIPS: Fix race on setting and getting cpu_online_mask
	MIPS: SMP: Fix deadlock & online race
	selftests: firmware: send expected errors to /dev/null
	tools: firmware: check for distro fallback udev cancel rule
	ASoC: sun4i-spdif: remove legacy dapm components
	MIPS: BMIPS: Fix missing cbr address
	MIPS: AR7: Defer registration of GPIO
	MIPS: AR7: Ensure that serial ports are properly set up
	Input: elan_i2c - add ELAN060C to the ACPI table
	rbd: use GFP_NOIO for parent stat and data requests
	drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue
	drm/bridge: adv7511: Rework adv7511_power_on/off() so they can be reused internally
	drm/bridge: adv7511: Reuse __adv7511_power_on/off() when probing EDID
	drm/bridge: adv7511: Re-write the i2c address before EDID probing
	can: sun4i: handle overrun in RX FIFO
	can: ifi: Fix transmitter delay calculation
	can: c_can: don't indicate triple sampling support for D_CAN
	x86/smpboot: Make optimization of delay calibration work correctly
	x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context
	Linux 4.9.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-11-15 16:13:49 +01:00
Vaibhav Jain
870b502a02 cxl: Force psl data-cache flush during device shutdown
[ Upstream commit d7b1946c79 ]

This change adds a force psl data cache flush during device shutdown
callback. This should reduce a possibility of psl holding a dirty
cache line while the CAPP is being reinitialized, which may result in
a UE [load/store] machine check error.

Signed-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-15 15:53:13 +01:00
Greg Kroah-Hartman
c4789f87f6 Merge 4.9.61 into android-4.9
Changes in 4.9.61
	ALSA: timer: Add missing mutex lock for compat ioctls
	ALSA: seq: Fix nested rwsem annotation for lockdep splat
	cifs: check MaxPathNameComponentLength != 0 before using it
	KEYS: return full count in keyring_read() if buffer is too small
	KEYS: fix out-of-bounds read during ASN.1 parsing
	ASoC: adau17x1: Workaround for noise bug in ADC
	arm64: ensure __dump_instr() checks addr_limit
	arm/arm64: KVM: set right LR register value for 32 bit guest when inject abort
	arm/arm64: kvm: Disable branch profiling in HYP code
	ARM: 8715/1: add a private asm/unaligned.h
	drm/amdgpu: return -ENOENT from uvd 6.0 early init for harvesting
	ocfs2: fstrim: Fix start offset of first cluster group during fstrim
	drm/i915/edp: read edp display control registers unconditionally
	drm/msm: Fix potential buffer overflow issue
	drm/msm: fix an integer overflow test
	tracing/samples: Fix creation and deletion of simple_thread_fn creation
	Fix tracing sample code warning.
	cpufreq: Do not clear real_cpus mask on policy init
	crypto: ccp - Set the AES size field for all modes
	staging: fsl-mc: Add missing header
	IB/mlx5: Assign DSCP for R-RoCE QPs Address Path
	PM / wakeirq: report a wakeup_event on dedicated wekup irq
	scsi: megaraid_sas: Do not set fp_possible if TM capable for non-RW syspdIO, change fp_possible to bool
	mmc: s3cmci: include linux/interrupt.h for tasklet_struct
	mfd: ab8500-sysctrl: Handle probe deferral
	mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped
	bnxt_en: Added PCI IDs for BCM57452 and BCM57454 ASICs
	staging: rtl8712u: Fix endian settings for structs describing network packets
	PCI/MSI: Return failure when msix_setup_entries() fails
	net: mvneta: fix build errors when linux/phy*.h is removed from net/dsa.h
	ext4: fix stripe-unaligned allocations
	ext4: do not use stripe_width if it is not set
	net/ena: change driver's default timeouts
	i2c: riic: correctly finish transfers
	drm/amdgpu: when dpm disabled, also need to stop/start vce.
	perf tools: Only increase index if perf_evsel__new_idx() succeeds
	iwlwifi: mvm: use the PROBE_RESP_QUEUE to send deauth to unknown station
	drm/fsl-dcu: check for clk_prepare_enable() error
	clocksource/drivers/arm_arch_timer: Add dt binding for hisilicon-161010101 erratum
	net: phy: dp83867: Recover from "port mirroring" N/A MODE4
	cx231xx: Fix I2C on Internal Master 3 Bus
	ath10k: fix reading sram contents for QCA4019
	clk: sunxi-ng: Check kzalloc() for errors and cleanup error path
	mtd: nand: sunxi: Fix the non-polling case in sunxi_nfc_wait_events()
	gpio: mcp23s08: Select REGMAP/REGMAP_I2C to fix build error
	xen/manage: correct return value check on xenbus_scanf()
	scsi: aacraid: Process Error for response I/O
	platform/x86: intel_mid_thermal: Fix module autoload
	staging: lustre: llite: don't invoke direct_IO for the EOF case
	staging: lustre: hsm: stack overrun in hai_dump_data_field
	staging: lustre: ptlrpc: skip lock if export failed
	staging: lustre: lmv: Error not handled for lmv_find_target
	brcmfmac: check brcmf_bus_get_memdump result for error
	vfs: open() with O_CREAT should not create inodes with unknown ids
	ASoC: Intel: boards: remove .pm_ops in all Atom/DPCM machine drivers
	exynos4-is: fimc-is: Unmap region obtained by of_iomap()
	mei: return error on notification request to a disconnected client
	s390/dasd: check for device error pointer within state change interrupts
	s390/prng: Adjust generation of entropy to produce real 256 bits.
	s390/crypto: Extend key length check for AES-XTS in fips mode.
	bt8xx: fix memory leak
	drm/exynos: g2d: prevent integer overflow in
	PCI: Avoid possible deadlock on pci_lock and p->pi_lock
	powerpc/64: Don't try to use radix MMU under a hypervisor
	xen: don't print error message in case of missing Xenstore entry
	staging: r8712u: Fix Sparse warning in rtl871x_xmit.c
	ARM: dts: mvebu: pl310-cache disable double-linefill
	Linux 4.9.61

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-11-08 10:44:28 +01:00
Alexander Usyskin
0b5cdee7df mei: return error on notification request to a disconnected client
[ Upstream commit 7c47d2ca0f ]

Request for a notification from a disconnected client will be ignored
silently by the FW but the caller should know that the operation hasn't
succeeded.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-08 10:08:36 +01:00
Greg Kroah-Hartman
e5eba30388 Merge 4.9.54 into android-4.9
Changes in 4.9.54
	drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define
	drm: bridge: add DT bindings for TI ths8135
	GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
	drm/i915: Fix the overlay frontbuffer tracking
	ARM: dts: exynos: Add CPU OPPs for Exynos4412 Prime
	clk: sunxi-ng: fix PLL_CPUX adjusting on H3
	RDS: RDMA: Fix the composite message user notification
	ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes
	MIPS: Ensure bss section ends on a long-aligned address
	MIPS: ralink: Fix a typo in the pinmux setup.
	MIPS: ralink: Fix incorrect assignment on ralink_soc
	power: supply: axp288_fuel_gauge: Fix fuel_gauge_reg_readb return on error
	scsi: be2iscsi: Add checks to validate CID alloc/free
	ARM: dts: am335x-chilisom: Wakeup from RTC-only state by power on event
	igb: re-assign hw address pointer on reset after PCI error
	extcon: axp288: Use vbus-valid instead of -present to determine cable presence
	reset: ti_syscon: fix a ti_syscon_reset_status issue
	sh_eth: use correct name for ECMR_MPDE bit
	clk/axs10x: Clear init field in driver probe
	usb: make the MTK XHCI driver compile for older MIPS SoCs
	hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
	iio: adc: imx25-gcq: Fix module autoload
	iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications
	iio: adc: hx711: Add DT binding for avia,hx711
	IB/rxe: Add a runtime check in alloc_index()
	IB/rxe: Fix a MR reference leak in check_rkey()
	ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM
	drm/i915/psr: disable psr2 for resolution greater than 32X20
	serial: 8250: moxa: Store num_ports in brd
	tty: goldfish: Fix a parameter of a call to free_irq
	serial: 8250_port: Remove dangerous pr_debug()
	IB/ipoib: Fix deadlock over vlan_mutex
	IB/ipoib: rtnl_unlock can not come after free_netdev
	IB/ipoib: Replace list_del of the neigh->list with list_del_init
	arm: dts: mt2701: Add subsystem clock controller device nodes
	drm/amdkfd: fix improper return value on error
	USB: serial: mos7720: fix control-message error handling
	USB: serial: mos7840: fix control-message error handling
	sfc: get PIO buffer size from the NIC
	partitions/efi: Fix integer overflow in GPT size calculation
	ASoC: dapm: handle probe deferrals
	audit: log 32-bit socketcalls
	ath10k: prevent sta pointer rcu violation
	spi: pxa2xx: Add support for Intel Gemini Lake
	iommu/arm-smmu: Set privileged attribute to 'default' instead of 'unprivileged'
	usb: chipidea: vbus event may exist before starting gadget
	rtl8xxxu: Add additional USB IDs for rtl8192eu devices
	ASoC: dapm: fix some pointer error handling
	drm: mali-dp: Fix destination size handling when rotating
	drm: mali-dp: Fix transposed horizontal/vertical flip
	HID: wacom: release the resources before leaving despite devm
	MIPS: Lantiq: Fix another request_mem_region() return code check
	mips: ath79: clock:- Unmap region obtained by of_iomap
	lkdtm: Fix Oops when unloading the module
	net: core: Prevent from dereferencing null pointer when releasing SKB
	net/packet: check length in getsockopt() called with PACKET_HDRLEN
	team: fix memory leaks
	usb: plusb: Add support for PL-27A1
	udp: disable inner UDP checksum offloads in IPsec case
	net: dsa: b53: Include IMP/CPU port in dumb forwarding mode
	qed: Fix possible system hang in the dcbnl-getdcbx() path.
	mmc: sdio: fix alignment issue in struct sdio_func
	bridge: netlink: register netdevice before executing changelink
	Btrfs: fix segmentation fault when doing dio read
	Btrfs: fix potential use-after-free for cloned bio
	sata_via: Enable hotplug only on VT6421
	hugetlbfs: initialize shared policy as part of inode allocation
	kasan: do not sanitize kexec purgatory
	drivers/rapidio/devices/tsi721.c: make module parameter variable name unique
	netfilter: invoke synchronize_rcu after set the _hook_ to NULL
	MIPS: IRQ Stack: Unwind IRQ stack onto task stack
	iommu/exynos: Block SYSMMU while invalidating FLPD cache
	exynos-gsc: Do not swap cb/cr for semi planar formats
	MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs
	nvme-rdma: handle cpu unplug when re-establishing the controller
	netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
	parisc: perf: Fix potential NULL pointer dereference
	nfs: make nfs4_cb_sv_ops static
	ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs
	cpufreq: intel_pstate: Update pid_params.sample_rate_ns in pid_param_set()
	x86/acpi: Restore the order of CPU IDs
	iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
	mm/cgroup: avoid panic when init with low memory
	rds: ib: add error handle
	md/raid10: submit bio directly to replacement disk
	netfilter: nf_tables: set pktinfo->thoff at AH header if found
	i2c: meson: fix wrong variable usage in meson_i2c_put_data
	xfs: remove kmem_zalloc_greedy
	ASoC: wm_adsp: Return an error on write to a disabled volatile control
	libata: transport: Remove circular dependency at free time
	ARM: dts: BCM5301X: Fix memory start address
	tools/power turbostat: bugfix: GFXMHz column not changing
	IB/qib: fix false-postive maybe-uninitialized warning
	ARM: remove duplicate 'const' annotations'
	ASoC: rt5514: fix gcc-7 warning
	ASoC: rt5659: drop double const
	ASoC: rt5660: remove double const
	ALSA: au88x0: avoid theoretical uninitialized access
	ttpci: address stringop overflow warning
	s390/mm: make pmdp_invalidate() do invalidation only
	Linux 4.9.54

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-10-08 10:49:06 +02:00
Juerg Haefliger
c593091cfc lkdtm: Fix Oops when unloading the module
[ Upstream commit 9ba6057363 ]

No jprobe is registered when the module is loaded without specifying a
crashpoint that uses a jprobe. At the moment, we unconditionally try to
unregister the jprobe on module unload which results in an Oops. Add a
check to fix this.

Signed-off-by: Juerg Haefliger <juerg.haefliger@hpe.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-08 10:26:07 +02:00
Greg Kroah-Hartman
379e3b2a6d Merge 4.9.53 into android-4.9
Changes in 4.9.53
	cifs: release cifs root_cred after exit_cifs
	cifs: release auth_key.response for reconnect.
	fs/proc: Report eip/esp in /prod/PID/stat for coredumping
	mac80211: fix VLAN handling with TXQs
	mac80211_hwsim: Use proper TX power
	mac80211: flush hw_roc_start work before cancelling the ROC
	genirq: Make sparse_irq_lock protect what it should protect
	KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce()
	KVM: PPC: Book3S HV: Protect updates to spapr_tce_tables list
	tracing: Fix trace_pipe behavior for instance traces
	tracing: Erase irqsoff trace with empty write
	md/raid5: fix a race condition in stripe batch
	md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list
	scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly
	drm/radeon: disable hard reset in hibernate for APUs
	crypto: drbg - fix freeing of resources
	crypto: talitos - Don't provide setkey for non hmac hashing algs.
	crypto: talitos - fix sha224
	crypto: talitos - fix hashing
	security/keys: properly zero out sensitive key material in big_key
	security/keys: rewrite all of big_key crypto
	KEYS: fix writing past end of user-supplied buffer in keyring_read()
	KEYS: prevent creating a different user's keyrings
	KEYS: prevent KEYCTL_READ on negative key
	powerpc/pseries: Fix parent_dn reference leak in add_dt_node()
	powerpc/tm: Flush TM only if CPU has TM feature
	powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS
	s390/mm: fix write access check in gup_huge_pmd()
	PM: core: Fix device_pm_check_callbacks()
	Fix SMB3.1.1 guest authentication to Samba
	SMB3: Warn user if trying to sign connection that authenticated as guest
	SMB: Validate negotiate (to protect against downgrade) even if signing off
	SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags
	vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets
	nl80211: check for the required netlink attributes presence
	bsg-lib: don't free job in bsg_prepare_job
	iw_cxgb4: remove the stid on listen create failure
	iw_cxgb4: put ep reference in pass_accept_req()
	selftests/seccomp: Support glibc 2.26 siginfo_t.h
	seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter()
	arm64: Make sure SPsel is always set
	arm64: fault: Route pte translation faults via do_translation_fault
	KVM: VMX: extract __pi_post_block
	KVM: VMX: avoid double list add with VT-d posted interrupts
	KVM: VMX: simplify and fix vmx_vcpu_pi_load
	kvm/x86: Handle async PF in RCU read-side critical sections
	KVM: VMX: Do not BUG() on out-of-bounds guest IRQ
	kvm: nVMX: Don't allow L2 to access the hardware CR8
	xfs: validate bdev support for DAX inode flag
	etnaviv: fix gem object list corruption
	PCI: Fix race condition with driver_override
	btrfs: fix NULL pointer dereference from free_reloc_roots()
	btrfs: propagate error to btrfs_cmp_data_prepare caller
	btrfs: prevent to set invalid default subvolid
	x86/mm: Fix fault error path using unsafe vma pointer
	x86/fpu: Don't let userspace set bogus xcomp_bv
	gfs2: Fix debugfs glocks dump
	timer/sysclt: Restrict timer migration sysctl values to 0 and 1
	KVM: VMX: do not change SN bit in vmx_update_pi_irte()
	KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt
	cxl: Fix driver use count
	KVM: VMX: use cmpxchg64
	video: fbdev: aty: do not leak uninitialized padding in clk to userspace
	swiotlb-xen: implement xen_swiotlb_dma_mmap callback
	Linux 4.9.53

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-10-05 10:37:37 +02:00
Frederic Barrat
cb2da657d3 cxl: Fix driver use count
commit 197267d035 upstream.

cxl keeps a driver use count, which is used with the hash memory model
on p8 to know when to upgrade local TLBIs to global and to trigger
callbacks to manage the MMU for PSL8.

If a process opens a context and closes without attaching or fails the
attachment, the driver use count is never decremented. As a
consequence, TLB invalidations remain global, even if there are no
active cxl contexts.

We should increment the driver use count when the process is attaching
to the cxl adapter, and not on open. It's not needed before the
adapter starts using the context and the use count is decremented on
the detach path, so it makes more sense.

It affects only the user api. The kernel api is already doing The
Right Thing.

Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org # v4.2+
Fixes: 7bb5d91a4d ("cxl: Rework context lifetimes")
Acked-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[ajd: backport to stable v4.9 tree]
Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-05 09:44:04 +02:00
Amit Pundir
0ea205a6a2 ANDROID: uid_sys_stats: Fix implicit declaration of get_cmdline()
Include linux/mm.h for get_cmdline() declaration.

Change-Id: Icad6ef7deef4d93d92d423c96bfa61fb5d66d0b7
Fixes: Change-Id: I30083b757eaef8c61e55a213a883ce8d0c9cf2b1
       ("uid_sys_stats: log task io with a debug flag")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2017-08-17 20:13:57 +05:30
Yang Jin
6e8f1e7fc0 uid_sys_stats: log task io with a debug flag
Add a hashmap inside each uid_entry to keep track of task name and io.
Task full name is a combination of thread and process name.

Bug: 63739275
Change-Id: I30083b757eaef8c61e55a213a883ce8d0c9cf2b1
Signed-off-by: Yang Jin <yajin@google.com>
2017-08-16 22:27:22 +00:00
Greg Kroah-Hartman
9ae2c670d8 Merge 4.9.40 into android-4.9
Changes in 4.9.40
	disable new gcc-7.1.1 warnings for now
	ir-core: fix gcc-7 warning on bool arithmetic
	dm mpath: cleanup -Wbool-operation warning in choose_pgpath()
	s5p-jpeg: don't return a random width/height
	thermal: max77620: fix device-node reference imbalance
	thermal: cpu_cooling: Avoid accessing potentially freed structures
	ath9k: fix tx99 use after free
	ath9k: fix tx99 bus error
	ath9k: fix an invalid pointer dereference in ath9k_rng_stop()
	NFC: fix broken device allocation
	NFC: nfcmrvl_uart: add missing tty-device sanity check
	NFC: nfcmrvl: do not use device-managed resources
	NFC: nfcmrvl: use nfc-device for firmware download
	NFC: nfcmrvl: fix firmware-management initialisation
	nfc: Ensure presence of required attributes in the activate_target handler
	nfc: Fix the sockaddr length sanitization in llcp_sock_connect
	NFC: Add sockaddr length checks before accessing sa_family in bind handlers
	perf intel-pt: Move decoder error setting into one condition
	perf intel-pt: Improve sample timestamp
	perf intel-pt: Fix missing stack clear
	perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
	perf intel-pt: Fix last_ip usage
	perf intel-pt: Ensure never to set 'last_ip' when packet 'count' is zero
	perf intel-pt: Use FUP always when scanning for an IP
	perf intel-pt: Clear FUP flag on error
	Bluetooth: use constant time memory comparison for secret values
	wlcore: fix 64K page support
	btrfs: Don't clear SGID when inheriting ACLs
	igb: Explicitly select page 0 at initialization
	ASoC: compress: Derive substream from stream based on direction
	PM / Domains: Fix unsafe iteration over modified list of device links
	PM / Domains: Fix unsafe iteration over modified list of domain providers
	PM / Domains: Fix unsafe iteration over modified list of domains
	scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
	scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
	iscsi-target: Add login_keys_workaround attribute for non RFC initiators
	xen/scsiback: Fix a TMR related use-after-free
	powerpc/pseries: Fix passing of pp0 in updatepp() and updateboltedpp()
	powerpc/64: Fix atomic64_inc_not_zero() to return an int
	powerpc: Fix emulation of mcrf in emulate_step()
	powerpc: Fix emulation of mfocrf in emulate_step()
	powerpc/asm: Mark cr0 as clobbered in mftb()
	powerpc/mm/radix: Properly clear process table entry
	af_key: Fix sadb_x_ipsecrequest parsing
	PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11
	PCI: rockchip: Use normal register bank for config accessors
	PCI/PM: Restore the status of PCI devices across hibernation
	ipvs: SNAT packet replies only for NATed connections
	xhci: fix 20000ms port resume timeout
	xhci: Fix NULL pointer dereference when cleaning up streams for removed host
	xhci: Bad Ethernet performance plugged in ASM1042A host
	mxl111sf: Fix driver to use heap allocate buffers for USB messages
	usb: storage: return on error to avoid a null pointer dereference
	USB: cdc-acm: add device-id for quirky printer
	usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
	usb: renesas_usbhs: gadget: disable all eps when the driver stops
	md: don't use flush_signals in userspace processes
	x86/xen: allow userspace access during hypercalls
	cx88: Fix regression in initial video standard setting
	libnvdimm, btt: fix btt_rw_page not returning errors
	libnvdimm: fix badblock range handling of ARS range
	ext2: Don't clear SGID when inheriting ACLs
	Raid5 should update rdev->sectors after reshape
	s390/syscalls: Fix out of bounds arguments access
	drm/amd/amdgpu: Return error if initiating read out of range on vram
	drm/radeon/ci: disable mclk switching for high refresh rates (v2)
	drm/radeon: Fix eDP for single-display iMac10,1 (v2)
	ipmi: use rcu lock around call to intf->handlers->sender()
	ipmi:ssif: Add missing unlock in error branch
	xfs: Don't clear SGID when inheriting ACLs
	f2fs: sanity check size of nat and sit cache
	f2fs: Don't clear SGID when inheriting ACLs
	drm/ttm: Fix use-after-free in ttm_bo_clean_mm
	ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials
	vfio: Fix group release deadlock
	vfio: New external user group/file match
	nvme-rdma: remove race conditions from IB signalling
	ftrace: Fix uninitialized variable in match_records()
	MIPS: Fix mips_atomic_set() retry condition
	MIPS: Fix mips_atomic_set() with EVA
	MIPS: Negate error syscall return in trace
	ubifs: Don't leak kernel memory to the MTD
	ACPI / EC: Drop EC noirq hooks to fix a regression
	Revert "ACPI / EC: Enable event freeze mode..." to fix a regression
	x86/acpi: Prevent out of bound access caused by broken ACPI tables
	x86/ioapic: Pass the correct data to unmask_ioapic_irq()
	MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
	MIPS: Save static registers before sysmips
	MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
	MIPS: Fix unaligned PC interpretation in `compute_return_epc'
	MIPS: math-emu: Prevent wrong ISA mode instruction emulation
	MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
	MIPS: Rename `sigill_r6' to `sigill_r2r6' in `__compute_return_epc_for_insn'
	MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn'
	MIPS: Send SIGILL for R6 branches in `__compute_return_epc_for_insn'
	MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
	Input: i8042 - fix crash at boot time
	IB/iser: Fix connection teardown race condition
	IB/core: Namespace is mandatory input for address resolution
	sunrpc: use constant time memory comparison for mac
	NFS: only invalidate dentrys that are clearly invalid.
	udf: Fix deadlock between writeback and udf_setsize()
	target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
	iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
	perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
	Revert "perf/core: Drop kernel samples even though :u is specified"
	staging: rtl8188eu: add TL-WN722N v2 support
	staging: comedi: ni_mio_common: fix AO timer off-by-one regression
	staging: sm750fb: avoid conflicting vesafb
	staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code
	ceph: fix race in concurrent readdir
	RDMA/core: Initialize port_num in qp_attr
	drm/mst: Fix error handling during MST sideband message reception
	drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
	drm/mst: Avoid processing partially received up/down message transactions
	mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array
	hfsplus: Don't clear SGID when inheriting ACLs
	ovl: fix random return value on mount
	acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
	of: device: Export of_device_{get_modalias, uvent_modalias} to modules
	spmi: Include OF based modalias in device uevent
	reiserfs: Don't clear SGID when inheriting ACLs
	PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
	tracing: Fix kmemleak in instance_rmdir
	alarmtimer: don't rate limit one-shot timers
	Linux 4.9.40

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-07-27 15:24:43 -07:00
Maurizio Lombardi
542c097f1c scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
commit 62e62ffd95 upstream.

The enclosure_add_device() function should fail if it can't create the
relevant sysfs links.

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Tested-by: Douglas Miller <dougmill@linux.vnet.ibm.com>
Acked-by: James Bottomley <jejb@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:07:59 -07:00
Greg Kroah-Hartman
7172a93a70 Merge 4.9.34 into android-4.9
Changes in 4.9.34
	fs: pass on flags in compat_writev
	configfs: Fix race between create_link and configfs_rmdir
	can: gs_usb: fix memory leak in gs_cmd_reset()
	ila_xlat: add missing hash secret initialization
	cpufreq: conservative: Allow down_threshold to take values from 1 to 10
	vb2: Fix an off by one error in 'vb2_plane_vaddr'
	mac80211: don't look at the PM bit of BAR frames
	mac80211/wpa: use constant time memory comparison for MACs
	drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions.
	drm/i915: Fix GVT-g PVINFO version compatibility check
	usb: musb: dsps: keep VBUS on for host-only mode
	mac80211: fix CSA in IBSS mode
	mac80211: fix packet statistics for fast-RX
	mac80211: fix IBSS presp allocation size
	mac80211: strictly check mesh address extension mode
	mac80211: fix dropped counter in multiqueue RX
	mac80211: don't send SMPS action frame in AP mode when not needed
	drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake
	drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
	serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
	serial: sh-sci: Fix late enablement of AUTORTS
	x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
	mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
	staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
	staging: iio: tsl2x7x_core: Fix standard deviation calculation
	iio: st_pressure: Fix data sign
	iio: proximity: as3935: recalibrate RCO after resume
	iio: adc: ti_am335x_adc: allocating too much in probe
	IB/mlx5: Fix kernel to user leak prevention logic
	usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling
	usb: gadget: udc: renesas_usb3: fix deadlock by spinlock
	usb: gadget: udc: renesas_usb3: lock for PN_ registers access
	USB: hub: fix SS max number of ports
	usb: core: fix potential memory leak in error path during hcd creation
	USB: usbip: fix nonconforming hub descriptor
	pvrusb2: reduce stack usage pvr2_eeprom_analyze()
	USB: gadget: dummy_hcd: fix hub-descriptor removable fields
	usb: r8a66597-hcd: select a different endpoint on timeout
	usb: r8a66597-hcd: decrease timeout
	ath10k: fix napi crash during rmmod when probe firmware fails
	misc: mic: double free on ioctl error path
	drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
	usb: xhci: Fix USB 3.1 supported protocol parsing
	usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
	USB: gadget: fix GPF in gadgetfs
	USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
	mm/memory-failure.c: use compound_head() flags for huge pages
	swap: cond_resched in swap_cgroup_prepare()
	iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500
	sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()
	genirq: Release resources in __setup_irq() error path
	alarmtimer: Prevent overflow of relative timers
	usb: gadget: composite: Fix function used to free memory
	usb: dwc3: exynos fix axius clock error path to do cleanup
	MIPS: Fix bnezc/jialc return address calculation
	MIPS: .its targets depend on vmlinux
	vTPM: Fix missing NULL check
	crypto: Work around deallocated stack frame reference gcc bug on sparc.
	alarmtimer: Rate limit periodic intervals
	mm: larger stack guard gap, between vmas
	Allow stack to grow up to address space limit
	mm: fix new crash in unmapped_area_topdown()
	Linux 4.9.34

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-06-27 10:43:56 +02:00
Dan Carpenter
2abac4084f drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
commit 8128a31eaa upstream.

c2port_device_register() never returns NULL, it uses error pointers.

Link: http://lkml.kernel.org/r/20170412083321.GC3250@mwanda
Fixes: 65131cd52b ("c2port: add c2port support for Eurotech Duramar 2150")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Rodolfo Giometti <giometti@linux.it>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-24 07:11:16 +02:00
Dan Carpenter
f28ba80c6a misc: mic: double free on ioctl error path
commit 816c9311f1 upstream.

This function only has one caller.  Freeing "vdev" here leads to a use
after free bug.  There are several other error paths in this function
but this is the only one which frees "vdev".  It looks like the kfree()
can be safely removed.

Fixes: 61e9c905df ("misc: mic: Enable VOP host side functionality")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-24 07:11:16 +02:00
Ganesh Mahendran
2b3da4a6ca ANDROID: uid_sys_stats: check previous uid_entry before call find_or_register_uid
Theads in a process are stored in list struct task_struct->thread_group,
so it will be visited continiously in below loop:
do_each_thread(temp, task) {
    ...
} while_each_thread(temp, task);

I add some log in the loop, we can see below information:
[   65.033561] uid 1000, uid_entry ffffffc0f2761600
[   65.033567] uid 1000, uid_entry ffffffc0f2761600
[   65.033574] uid 1000, uid_entry ffffffc0f2761600
[   65.033581] uid 1000, uid_entry ffffffc0f2761600
[   65.033588] uid 1000, uid_entry ffffffc0f2761600
[   65.033595] uid 1000, uid_entry ffffffc0f2761600
[   65.033602] uid 1000, uid_entry ffffffc0f2761600
[   65.033609] uid 1000, uid_entry ffffffc0f2761600
[   65.033615] uid 1000, uid_entry ffffffc0f2761600
[   65.033622] uid 1000, uid_entry ffffffc0f2761600
[   65.033629] uid 1000, uid_entry ffffffc0f2761600
[   65.033637] uid 1000, uid_entry ffffffc0f2761600
[   65.033644] uid 1000, uid_entry ffffffc0f2761600
[   65.033651] uid 1000, uid_entry ffffffc0f2761600
[   65.033658] uid 1000, uid_entry ffffffc0f2761600
[   65.033665] uid 1000, uid_entry ffffffc0f2761600
[   65.033672] uid 1000, uid_entry ffffffc0f2761600
[   65.033680] uid 1000, uid_entry ffffffc0f2761600
[   65.033687] uid 1000, uid_entry ffffffc0f2761600
[   65.033694] uid 1000, uid_entry ffffffc0f2761600
[   65.033701] uid 1000, uid_entry ffffffc0f2761600
[   65.033708] uid 1000, uid_entry ffffffc0f2761600
[   65.033715] uid 1000, uid_entry ffffffc0f2761600
[   65.033722] uid 1000, uid_entry ffffffc0f2761600
[   65.033729] uid 1000, uid_entry ffffffc0f2761600
[   65.033736] uid 1000, uid_entry ffffffc0f2761600
[   65.033743] uid 1000, uid_entry ffffffc0f2761600
[   65.033750] uid 1000, uid_entry ffffffc0f2761600
[   65.033757] uid 1000, uid_entry ffffffc0f2761600
[   65.033763] uid 1000, uid_entry ffffffc0f2761600
[   65.033770] uid 1000, uid_entry ffffffc0f2761600
[   65.033777] uid 1000, uid_entry ffffffc0f2761600
[   65.033784] uid 1000, uid_entry ffffffc0f2761600
[   65.033791] uid 1000, uid_entry ffffffc0f2761600
[   65.033798] uid 1000, uid_entry ffffffc0f2761600

So we can check the previous uid_entry before calling find_or_register_uid
to save time.

Change-Id: I05ec1a1405a80c0a620cb4b4b2f6483dbfde7829
Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
2017-06-15 21:45:30 +00:00
Greg Kroah-Hartman
da3493c028 Merge 4.9.32 into android-4.9
Changes in 4.9.32
	bnx2x: Fix Multi-Cos
	vxlan: eliminate cached dst leak
	ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()
	cxgb4: avoid enabling napi twice to the same queue
	tcp: disallow cwnd undo when switching congestion control
	vxlan: fix use-after-free on deletion
	ipv6: Fix leak in ipv6_gso_segment().
	net: ping: do not abuse udp_poll()
	net/ipv6: Fix CALIPSO causing GPF with datagram support
	net: ethoc: enable NAPI before poll may be scheduled
	net: stmmac: fix completely hung TX when using TSO
	net: bridge: start hello timer only if device is up
	sparc64: Add __multi3 for gcc 7.x and later.
	sparc64: mm: fix copy_tsb to correctly copy huge page TSBs
	sparc: Machine description indices can vary
	sparc64: reset mm cpumask after wrap
	sparc64: combine activate_mm and switch_mm
	sparc64: redefine first version
	sparc64: add per-cpu mm of secondary contexts
	sparc64: new context wrap
	sparc64: delete old wrap code
	arch/sparc: support NR_CPUS = 4096
	serial: ifx6x60: fix use-after-free on module unload
	ptrace: Properly initialize ptracer_cred on fork
	crypto: asymmetric_keys - handle EBUSY due to backlog correctly
	KEYS: fix dereferencing NULL payload with nonzero length
	KEYS: fix freeing uninitialized memory in key_update()
	KEYS: encrypted: avoid encrypting/decrypting stack buffers
	crypto: drbg - wait for crypto op not signal safe
	crypto: gcm - wait for crypto op not signal safe
	drm/amdgpu/ci: disable mclk switching for high refresh rates (v2)
	nfsd4: fix null dereference on replay
	nfsd: Fix up the "supattr_exclcreat" attributes
	efi: Don't issue error message when booted under Xen
	kvm: async_pf: fix rcu_irq_enter() with irqs enabled
	KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation
	arm64: KVM: Preserve RES1 bits in SCTLR_EL2
	arm64: KVM: Allow unaligned accesses at EL2
	arm: KVM: Allow unaligned accesses at HYP
	KVM: async_pf: avoid async pf injection when in guest mode
	KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
	KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
	dmaengine: usb-dmac: Fix DMAOR AE bit definition
	dmaengine: ep93xx: Always start from BASE0
	dmaengine: ep93xx: Don't drain the transfers in terminate_all()
	dmaengine: mv_xor_v2: handle mv_xor_v2_prep_sw_desc() error properly
	dmaengine: mv_xor_v2: properly handle wrapping in the array of HW descriptors
	dmaengine: mv_xor_v2: do not use descriptors not acked by async_tx
	dmaengine: mv_xor_v2: enable XOR engine after its configuration
	dmaengine: mv_xor_v2: fix tx_submit() implementation
	dmaengine: mv_xor_v2: remove interrupt coalescing
	dmaengine: mv_xor_v2: set DMA mask to 40 bits
	cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode
	xen/privcmd: Support correctly 64KB page granularity when mapping memory
	ext4: fix SEEK_HOLE
	ext4: keep existing extra fields when inode expands
	ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO
	ext4: fix fdatasync(2) after extent manipulation operations
	drm: Fix oops + Xserver hang when unplugging USB drm devices
	usb: gadget: f_mass_storage: Serialize wake and sleep execution
	usb: chipidea: udc: fix NULL pointer dereference if udc_start failed
	usb: chipidea: debug: check before accessing ci_role
	staging/lustre/lov: remove set_fs() call from lov_getstripe()
	iio: adc: bcm_iproc_adc: swap primary and secondary isr handler's
	iio: light: ltr501 Fix interchanged als/ps register field
	iio: proximity: as3935: fix AS3935_INT mask
	iio: proximity: as3935: fix iio_trigger_poll issue
	mei: make sysfs modalias format similar as uevent modalias
	cpufreq: cpufreq_register_driver() should return -ENODEV if init fails
	target: Re-add check to reject control WRITEs with overflow data
	drm/msm: Expose our reservation object when exporting a dmabuf.
	ahci: Acer SA5-271 SSD Not Detected Fix
	cgroup: Prevent kill_css() from being called more than once
	Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled
	cpuset: consider dying css as offline
	fs: add i_blocksize()
	ufs: restore proper tail allocation
	fix ufs_isblockset()
	ufs: restore maintaining ->i_blocks
	ufs: set correct ->s_maxsize
	ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments()
	ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
	cxl: Fix error path on bad ioctl
	cxl: Avoid double free_irq() for psl,slice interrupts
	btrfs: use correct types for page indices in btrfs_page_exists_in_range
	btrfs: fix memory leak in update_space_info failure path
	KVM: arm/arm64: Handle possible NULL stage2 pud when ageing pages
	scsi: qla2xxx: don't disable a not previously enabled PCI device
	scsi: qla2xxx: Modify T262 FW dump template to specify same start/end to debug customer issues
	scsi: qla2xxx: Set bit 15 for DIAG_ECHO_TEST MBC
	scsi: qla2xxx: Fix mailbox pointer error in fwdump capture
	powerpc/sysdev/simple_gpio: Fix oops in gpio save_regs function
	powerpc/numa: Fix percpu allocations to be NUMA aware
	powerpc/hotplug-mem: Fix missing endian conversion of aa_index
	powerpc/kernel: Fix FP and vector register restoration
	powerpc/kernel: Initialize load_tm on task creation
	perf/core: Drop kernel samples even though :u is specified
	drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()
	drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
	drm/vmwgfx: Make sure backup_handle is always valid
	drm/nouveau/tmr: fully separate alarm execution/pending lists
	ALSA: timer: Fix race between read and ioctl
	ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
	ASoC: Fix use-after-free at card unregistration
	cpu/hotplug: Drop the device lock on error
	drivers: char: mem: Fix wraparound check to allow mappings up to the end
	serial: sh-sci: Fix panic when serial console and DMA are enabled
	arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
	arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
	arm64: entry: improve data abort handling of tagged pointers
	ARM: 8636/1: Cleanup sanity_check_meminfo
	ARM: 8637/1: Adjust memory boundaries after reservations
	usercopy: Adjust tests to deal with SMAP/PAN
	drm/i915/vbt: don't propagate errors from intel_bios_init()
	drm/i915/vbt: split out defaults that are set when there is no VBT
	cpufreq: schedutil: move cached_raw_freq to struct sugov_policy
	cpufreq: schedutil: Fix per-CPU structure initialization in sugov_start()
	netfilter: nft_set_rbtree: handle element re-addition after deletion
	Linux 4.9.32

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-06-14 16:42:56 +02:00
Vaibhav Jain
3fd1233dab cxl: Avoid double free_irq() for psl,slice interrupts
commit b3aa20ba2b upstream.

During an eeh call to cxl_remove can result in double free_irq of
psl,slice interrupts. This can happen if perst_reloads_same_image == 1
and call to cxl_configure_adapter() fails during slot_reset
callback. In such a case we see a kernel oops with following back-trace:

Oops: Kernel access of bad area, sig: 11 [#1]
Call Trace:
  free_irq+0x88/0xd0 (unreliable)
  cxl_unmap_irq+0x20/0x40 [cxl]
  cxl_native_release_psl_irq+0x78/0xd8 [cxl]
  pci_deconfigure_afu+0xac/0x110 [cxl]
  cxl_remove+0x104/0x210 [cxl]
  pci_device_remove+0x6c/0x110
  device_release_driver_internal+0x204/0x2e0
  pci_stop_bus_device+0xa0/0xd0
  pci_stop_and_remove_bus_device+0x28/0x40
  pci_hp_remove_devices+0xb0/0x150
  pci_hp_remove_devices+0x68/0x150
  eeh_handle_normal_event+0x140/0x580
  eeh_handle_event+0x174/0x360
  eeh_event_handler+0x1e8/0x1f0

This patch fixes the issue of double free_irq by checking that
variables that hold the virqs (err_hwirq, serr_hwirq, psl_virq) are
not '0' before un-mapping and resetting these variables to '0' when
they are un-mapped.

Signed-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-14 15:06:01 +02:00
Frederic Barrat
172c70d1cd cxl: Fix error path on bad ioctl
commit cec422c11c upstream.

Fix error path if we can't copy user structure on CXL_IOCTL_START_WORK
ioctl. We shouldn't unlock the context status mutex as it was not
locked (yet).

Fixes: 0712dc7e73 ("cxl: Fix issues when unmapping contexts")
Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Reviewed-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-14 15:06:01 +02:00
Pratyush Anand
acd8f91739 mei: make sysfs modalias format similar as uevent modalias
commit 6f9193ec04 upstream.

modprobe is not able to resolve sysfs modalias for mei devices.

 # cat
/sys/class/watchdog/watchdog0/device/watchdog/watchdog0/device/modalias
mei::05b79a6f-4628-4d7f-899d-a91514cb32ab:
 # modprobe --set-version 4.9.6-200.fc25.x86_64 -R
mei::05b79a6f-4628-4d7f-899d-a91514cb32ab:
modprobe: FATAL: Module mei::05b79a6f-4628-4d7f-899d-a91514cb32ab: not
found in directory /lib/modules/4.9.6-200.fc25.x86_64
 # cat /lib/modules/4.9.6-200.fc25.x86_64/modules.alias | grep
05b79a6f-4628-4d7f-899d-a91514cb32ab
alias mei:*:05b79a6f-4628-4d7f-899d-a91514cb32ab:*:* mei_wdt

commit b26864cad1 ("mei: bus: add client protocol
version to the device alias"), however sysfs modalias
is still in formmat mei:S:uuid:*.

This patch equates format of uevent and sysfs modalias so that modprobe
is able to resolve the aliases.

Fixes: commit b26864cad1 ("mei: bus: add client protocol version to the device alias")
Signed-off-by: Pratyush Anand <panand@redhat.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-14 15:05:59 +02:00
Ganesh Mahendran
6f115f5b6c ANDROID: Kconfig: add depends for UID_SYS_STATS
uid_io depends on TASK_XACCT and TASK_IO_ACCOUNTING.
So add depends in Kconfig before compiling code.

Change-Id: Ie6bf57ec7c2eceffadf4da0fc2aca001ce10c36e
Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
2017-06-01 19:26:23 -07:00
Greg Kroah-Hartman
951d823c04 Merge 4.9.30 into android-4.9
Changes in 4.9.30
	usb: misc: legousbtower: Fix buffers on stack
	usb: misc: legousbtower: Fix memory leak
	USB: ene_usb6250: fix DMA to the stack
	watchdog: pcwd_usb: fix NULL-deref at probe
	char: lp: fix possible integer overflow in lp_setup()
	USB: core: replace %p with %pK
	tpm_tis_core: Choose appropriate timeout for reading burstcount
	ALSA: hda: Fix cpu lockup when stopping the cmd dmas
	ARM: tegra: paz00: Mark panel regulator as enabled on boot
	fanotify: don't expose EOPENSTALE to userspace
	tpm_tis_spi: Use single function to transfer data
	tpm_tis_spi: Abort transfer when too many wait states are signaled
	tpm_tis_spi: Check correct byte for wait state indicator
	tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes
	tpm_tis_spi: Add small delay after last transfer
	tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
	tpm: add sleep only for retry in i2c_nuvoton_write_status()
	tpm_crb: check for bad response size
	ASoC: cs4271: configure reset GPIO as output
	mlx5: Fix mlx5_ib_map_mr_sg mr length
	infiniband: call ipv6 route lookup via the stub interface
	dm btree: fix for dm_btree_find_lowest_key()
	dm raid: select the Kconfig option CONFIG_MD_RAID0
	dm bufio: avoid a possible ABBA deadlock
	dm bufio: check new buffer allocation watermark every 30 seconds
	dm mpath: split and rename activate_path() to prepare for its expanded use
	dm cache metadata: fail operations if fail_io mode has been established
	dm bufio: make the parameter "retain_bytes" unsigned long
	dm thin metadata: call precommit before saving the roots
	dm space map disk: fix some book keeping in the disk space map
	md: update slab_cache before releasing new stripes when stripes resizing
	md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
	rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
	mwifiex: MAC randomization should not be persistent
	mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
	ima: accept previously set IMA_NEW_FILE
	KVM: x86: Fix load damaged SSEx MXCSR register
	KVM: x86: Fix potential preemption when get the current kvmclock timestamp
	KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
	x86: fix 32-bit case of __get_user_asm_u64()
	regulator: rk808: Fix RK818 LDO2
	regulator: tps65023: Fix inverted core enable logic.
	s390/kdump: Add final note
	s390/cputime: fix incorrect system time
	ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
	ath9k_htc: fix NULL-deref at probe
	drm/amdgpu: Make display watermark calculations more accurate
	drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
	drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
	drm/nouveau/therm: remove ineffective workarounds for alarm bugs
	drm/nouveau/tmr: ack interrupt before processing alarms
	drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
	drm/nouveau/tmr: avoid processing completed alarms when adding a new one
	drm/nouveau/tmr: handle races with hw when updating the next alarm time
	gpio: omap: return error if requested debounce time is not possible
	cdc-acm: fix possible invalid access when processing notification
	ohci-pci: add qemu quirk
	cxl: Force context lock during EEH flow
	cxl: Route eeh events to all drivers in cxl_pci_error_detected()
	proc: Fix unbalanced hard link numbers
	of: fix sparse warning in of_pci_range_parser_one
	of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()
	of: fdt: add missing allocation-failure check
	ibmvscsis: Do not send aborted task response
	iio: dac: ad7303: fix channel description
	IIO: bmp280-core.c: fix error in humidity calculation
	IB/hfi1: Return an error on memory allocation failure
	IB/hfi1: Fix a subcontext memory leak
	pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
	pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
	USB: serial: ftdi_sio: fix setting latency for unprivileged users
	USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
	USB: chaoskey: fix Alea quirk on big-endian hosts
	f2fs: check entire encrypted bigname when finding a dentry
	fscrypt: avoid collisions when presenting long encrypted filenames
	libnvdimm: fix clear length of nvdimm_forget_poison()
	xhci: remove GFP_DMA flag from allocation
	usb: host: xhci-plat: propagate return value of platform_get_irq()
	xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
	usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
	net: irda: irda-usb: fix firmware name on big-endian hosts
	usbvision: fix NULL-deref at probe
	mceusb: fix NULL-deref at probe
	ttusb2: limit messages to buffer size
	dvb-usb-dibusb-mc-common: Add MODULE_LICENSE
	usb: dwc3: gadget: Prevent losing events in event cache
	usb: musb: tusb6010_omap: Do not reset the other direction's packet size
	usb: musb: Fix trying to suspend while active for OTG configurations
	USB: iowarrior: fix info ioctl on big-endian hosts
	usb: serial: option: add Telit ME910 support
	USB: serial: qcserial: add more Lenovo EM74xx device IDs
	USB: serial: mct_u232: fix big-endian baud-rate handling
	USB: serial: io_ti: fix div-by-zero in set_termios
	USB: hub: fix SS hub-descriptor handling
	USB: hub: fix non-SS hub-descriptor handling
	ipx: call ipxitf_put() in ioctl error path
	iio: proximity: as3935: fix as3935_write
	iio: hid-sensor: Store restore poll and hysteresis on S3
	s5p-mfc: Fix race between interrupt routine and device functions
	gspca: konica: add missing endpoint sanity check
	s5p-mfc: Fix unbalanced call to clock management
	dib0700: fix NULL-deref at probe
	zr364xx: enforce minimum size when reading header
	dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
	digitv: limit messages to buffer size
	dw2102: limit messages to buffer size
	cx231xx-audio: fix init error path
	cx231xx-audio: fix NULL-deref at probe
	cx231xx-cards: fix NULL-deref at probe
	powerpc/mm: Ensure IRQs are off in switch_mm()
	powerpc/eeh: Avoid use after free in eeh_handle_special_event()
	powerpc/book3s/mce: Move add_taint() later in virtual mode
	powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
	powerpc/iommu: Do not call PageTransHuge() on tail pages
	powerpc/64e: Fix hang when debugging programs with relocated kernel
	powerpc/tm: Fix FP and VMX register corruption
	arm64: KVM: Do not use stack-protector to compile EL2 code
	arm: KVM: Do not use stack-protector to compile HYP code
	KVM: arm: plug potential guest hardware debug leakage
	ARM: 8662/1: module: split core and init PLT sections
	ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call
	ARM: dts: at91: sama5d3_xplained: fix ADC vref
	ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
	ARM: dts: imx6sx-sdb: Remove OPP override
	arm64: dts: hi6220: Reset the mmc hosts
	arm64: xchg: hazard against entire exchange variable
	arm64: ensure extension of smp_store_release value
	arm64: armv8_deprecated: ensure extension of addr
	arm64: uaccess: ensure extension of access_ok() addr
	arm64: documentation: document tagged pointer stack constraints
	staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
	staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
	staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
	staging: rtl8192e: GetTs Fix invalid TID 7 warning.
	iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
	metag/uaccess: Fix access_ok()
	metag/uaccess: Check access_ok in strncpy_from_user
	stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
	uwb: fix device quirk on big-endian hosts
	genirq: Fix chained interrupt data ordering
	nvme: unmap CMB and remove sysfs file in reset path
	MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6
	osf_wait4(): fix infoleak
	um: Fix to call read_initrd after init_bootmem
	tracing/kprobes: Enforce kprobes teardown after testing
	PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC
	PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs
	PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
	PCI: Fix another sanity check bug in /proc/pci mmap
	PCI: Only allow WC mmap on prefetchable resources
	PCI: Freeze PME scan before suspending devices
	mtd: nand: orion: fix clk handling
	mtd: nand: omap2: Fix partition creation via cmdline mtdparts
	mtd: nand: add ooblayout for old hamming layout
	drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
	NFSv4: Fix a hang in OPEN related to server reboot
	NFS: Fix use after free in write error path
	NFS: Use GFP_NOIO for two allocations in writeback
	nfsd: fix undefined behavior in nfsd4_layout_verify
	nfsd: encoders mustn't use unitialized values in error cases
	drivers: char: mem: Check for address space wraparound with mmap()
	drm/i915/gvt: Disable access to stolen memory as a guest
	Linux 4.9.30

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-05-25 17:32:43 +02:00