Merge 95b4d2a89bf252bfe2bb5d2f7ba6c9ba1ff44ada on remote branch

Change-Id: I6460e3af14269458116edfeb434b72fc0ea9e00d

6 files changed, 135 insertions, 19 deletions

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index a7516e4c8ce8..7bbaeff3c542 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -883,12 +883,14 @@ icmp_ratelimit - INTEGER
 icmp_msgs_per_sec - INTEGER
 	Limit maximal number of ICMP packets sent per second from this host.
 	Only messages whose type matches icmp_ratemask (see below) are
-	controlled by this limit.
+	controlled by this limit. For security reasons, the precise count
+	of messages per second is randomized.
 	Default: 1000
 
 icmp_msgs_burst - INTEGER
 	icmp_msgs_per_sec controls number of ICMP packets sent per second,
 	while icmp_msgs_burst controls the burst size of these packets.
+	For security reasons, the precise burst size is randomized.
 	Default: 50
 
 icmp_ratemask - INTEGER
diff --git a/drivers/video/fbdev/msm/mdss_hdmi_cec.c b/drivers/video/fbdev/msm/mdss_hdmi_cec.c
index 12a9267f3749..5fe3f710c29e 100644
--- a/drivers/video/fbdev/msm/mdss_hdmi_cec.c
+++ b/drivers/video/fbdev/msm/mdss_hdmi_cec.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010-2017, 2020 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2010-2017,2020-2021, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -469,8 +469,12 @@ static int hdmi_cec_enable(void *input, bool enable)
 	}
 
 	if (enable) {
-		/* 19.2Mhz * 0.00005 us = 950 = 0x3B6 */
-		DSS_REG_W(io, HDMI_CEC_REFTIMER, (0x3B6 & 0xFFF) | BIT(16));
+		/*
+		 * 19.2Mhz * 0.00005 us = 960 = 0x3C0
+		 * CEC Rd/Wr logic is properly working with
+		 * finetuned value of 0x3D4 = 51 us.
+		 */
+		DSS_REG_W(io, HDMI_CEC_REFTIMER, (0x3D4 & 0xFFF) | BIT(16));
 
 		hdmi_hw_version = DSS_REG_R(io, HDMI_VERSION);
 		if (hdmi_hw_version >= CEC_SUPPORTED_HW_VERSION) {
diff --git a/drivers/video/fbdev/msm/mdss_hdmi_tx.c b/drivers/video/fbdev/msm/mdss_hdmi_tx.c
index af08edf13d87..e0fcfec614b5 100644
--- a/drivers/video/fbdev/msm/mdss_hdmi_tx.c
+++ b/drivers/video/fbdev/msm/mdss_hdmi_tx.c
@@ -23,6 +23,7 @@
 #include <linux/hdcp_qseecom.h>
 #include <linux/msm_mdp.h>
 #include <linux/msm_ext_display.h>
+#include <linux/hdmi.h>
 
 #define REG_DUMP 0
 
@@ -3038,6 +3039,96 @@ static void hdmi_tx_phy_reset(struct hdmi_tx_ctrl *hdmi_ctrl)
 		DSS_REG_W_ND(io, HDMI_PHY_CTRL, val | SW_RESET_PLL);
 } /* hdmi_tx_phy_reset */
 
+static u8 calc_infoframe_checksum(u8 *ptr, size_t size)
+{
+	u8 csum = 0;
+	size_t i;
+
+	/* compute checksum */
+	for (i = 0; i < size; i++)
+		csum += ptr[i];
+
+	return 256 - csum;
+}
+
+static u8 hdmi_panel_set_hdr_checksum(struct mdp_hdr_stream *hdr_meta)
+{
+	u8 *buff;
+	u8 *ptr;
+	u32 length;
+	u32 size;
+	u32 checksum = 0;
+	u32 const type_code = 0x87;
+	u32 const version = 0x01;
+	u32 const descriptor_id = 0x00;
+
+	/* length of metadata is 26 bytes */
+	length = 0x1a;
+	/* add 4 bytes for the header */
+	size = length + HDMI_INFOFRAME_HEADER_SIZE;
+
+	buff = kzalloc(size, GFP_KERNEL);
+
+	if (!buff) {
+		DEV_ERR("invalid buff\n");
+		goto err_alloc;
+	}
+
+	ptr = buff;
+
+	buff[0] = type_code;
+	buff[1] = version;
+	buff[2] = length;
+	buff[3] = 0;
+	/* start infoframe payload */
+	buff += HDMI_INFOFRAME_HEADER_SIZE;
+
+	buff[0] = hdr_meta->eotf;
+	buff[1] = descriptor_id;
+
+	buff[2] = hdr_meta->display_primaries_x[0] & 0xff;
+	buff[3] = hdr_meta->display_primaries_x[0] >> 8;
+
+	buff[4] = hdr_meta->display_primaries_x[1] & 0xff;
+	buff[5] = hdr_meta->display_primaries_x[1] >> 8;
+
+	buff[6] = hdr_meta->display_primaries_x[2] & 0xff;
+	buff[7] = hdr_meta->display_primaries_x[2] >> 8;
+
+	buff[8] = hdr_meta->display_primaries_y[0] & 0xff;
+	buff[9] = hdr_meta->display_primaries_y[0] >> 8;
+
+	buff[10] = hdr_meta->display_primaries_y[1] & 0xff;
+	buff[11] = hdr_meta->display_primaries_y[1] >> 8;
+
+	buff[12] = hdr_meta->display_primaries_y[2] & 0xff;
+	buff[13] = hdr_meta->display_primaries_y[2] >> 8;
+
+	buff[14] = hdr_meta->white_point_x & 0xff;
+	buff[15] = hdr_meta->white_point_x >> 8;
+	buff[16] = hdr_meta->white_point_y & 0xff;
+	buff[17] = hdr_meta->white_point_y >> 8;
+
+	buff[18] = hdr_meta->max_luminance & 0xff;
+	buff[19] = hdr_meta->max_luminance >> 8;
+
+	buff[20] = hdr_meta->min_luminance & 0xff;
+	buff[21] = hdr_meta->min_luminance >> 8;
+
+	buff[22] = hdr_meta->max_content_light_level & 0xff;
+	buff[23] = hdr_meta->max_content_light_level >> 8;
+
+	buff[24] = hdr_meta->max_average_light_level & 0xff;
+	buff[25] = hdr_meta->max_average_light_level >> 8;
+
+	checksum = calc_infoframe_checksum(ptr, size);
+
+	kfree(ptr);
+
+err_alloc:
+	return checksum;
+}
+
 static void hdmi_panel_set_hdr_infoframe(struct hdmi_tx_ctrl *ctrl)
 {
 	u32 packet_payload = 0;
@@ -3047,8 +3138,10 @@ static void hdmi_panel_set_hdr_infoframe(struct hdmi_tx_ctrl *ctrl)
 	u32 const version = 0x01;
 	u32 const length = 0x1a;
 	u32 const descriptor_id = 0x00;
+	u8 checksum = 0;
 	struct dss_io_data *io = NULL;
 
+
 	if (!ctrl) {
 		pr_err("%s: invalid input\n", __func__);
 		return;
@@ -3069,7 +3162,18 @@ static void hdmi_panel_set_hdr_infoframe(struct hdmi_tx_ctrl *ctrl)
 	packet_header = type_code | (version << 8) | (length << 16);
 	DSS_REG_W(io, HDMI_GENERIC0_HDR, packet_header);
 
-	packet_payload = (ctrl->hdr_ctrl.hdr_stream.eotf << 8);
+	/**
+	 * Checksum is not a mandatory field for
+	 * the HDR infoframe as per CEA-861-3 specification.
+	 * However some HDMI sinks still expect a
+	 * valid checksum to be included as part of
+	 * the infoframe. Hence compute and add
+	 * the checksum to improve sink interoperability
+	 * for our HDR solution on HDMI.
+	 */
+	checksum = hdmi_panel_set_hdr_checksum(&ctrl->hdr_ctrl.hdr_stream);
+
+	packet_payload = ((ctrl->hdr_ctrl.hdr_stream.eotf << 8) | checksum);
 	if (hdmi_tx_metadata_type_one(ctrl)) {
 		packet_payload |=
 			(descriptor_id << 16)
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 43b80ca84d9c..71f332c3e68a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1203,10 +1203,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 	 */
 	if (!for_part) {
 		ret = devcgroup_inode_permission(bdev->bd_inode, perm);
-		if (ret != 0) {
-			bdput(bdev);
+		if (ret != 0)
 			return ret;
-		}
 	}
 
  restart:
@@ -1276,8 +1274,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 				goto out_clear;
 			BUG_ON(for_part);
 			ret = __blkdev_get(whole, mode, 1);
-			if (ret)
+			if (ret) {
+				bdput(whole);
 				goto out_clear;
+			}
 			bdev->bd_contains = whole;
 			bdev->bd_part = disk_get_part(disk, partno);
 			if (!(disk->flags & GENHD_FL_UP) ||
@@ -1337,7 +1337,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 	put_disk(disk);
 	module_put(owner);
  out:
-	bdput(bdev);
 
 	return ret;
 }
@@ -1423,6 +1422,9 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder)
 		bdput(whole);
 	}
 
+	if (res)
+		bdput(bdev);
+
 	return res;
 }
 EXPORT_SYMBOL(blkdev_get);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index a51f0dd6a49e..11bef81c7c97 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -246,7 +246,7 @@ static struct {
 /**
  * icmp_global_allow - Are we allowed to send one more ICMP message ?
  *
- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.
+ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
  * Returns false if we reached the limit and can not send another packet.
  * Note: called with BH disabled
  */
@@ -273,7 +273,10 @@ bool icmp_global_allow(void)
 	}
 	credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
 	if (credit) {
-		credit--;
+		/* We want to use a credit of one in average, but need to randomize
+		 * it for security reasons.
+		 */
+		credit = max_t(int, credit - prandom_u32_max(3), 0);
 		rc = true;
 	}
 	icmp_global.credit = credit;
diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c
index b3b5ebd4d5a2..8e65e2ae3684 100644
--- a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -16253,9 +16253,9 @@ static int msm_routing_put_app_type_cfg_control(struct snd_kcontrol *kcontrol,
 
 	memset(app_type_cfg, 0, MAX_APP_TYPES*
 				sizeof(struct msm_pcm_routing_app_type_data));
-	if (num_app_types > MAX_APP_TYPES) {
-		pr_err("%s: number of app types exceed the max supported\n",
-			__func__);
+	if (num_app_types > MAX_APP_TYPES || num_app_types < 0) {
+		pr_err("%s: number of app types %d is invalid\n",
+			__func__, num_app_types);
 		return -EINVAL;
 	}
 	for (j = 0; j < num_app_types; j++) {
@@ -16290,9 +16290,10 @@ static int msm_routing_put_lsm_app_type_cfg_control(
 	int i = 0, j;
 	int num_app_types;
 
-	if (ucontrol->value.integer.value[0] > MAX_APP_TYPES) {
-		pr_err("%s: number of app types exceed the max supported\n",
-			__func__);
+	if (ucontrol->value.integer.value[0] < 0 ||
+			ucontrol->value.integer.value[0] > MAX_APP_TYPES) {
+		pr_err("%s: number of app types %ld is invalid\n",
+			 __func__, ucontrol->value.integer.value[0]);
 		return -EINVAL;
 	}