Merge branch 'android-4.4@e76c0fa' into branch 'msm-4.4'

* refs/heads/tmp-e76c0fa
  Linux 4.4.72
  arm64: ensure extension of smp_store_release value
  arm64: armv8_deprecated: ensure extension of addr
  usercopy: Adjust tests to deal with SMAP/PAN
  RDMA/qib,hfi1: Fix MR reference count leak on write with immediate
  arm64: entry: improve data abort handling of tagged pointers
  arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
  Make __xfs_xattr_put_listen preperly report errors.
  NFSv4: Don't perform cached access checks before we've OPENed the file
  NFS: Ensure we revalidate attributes before using execute_ok()
  mm: consider memblock reservations for deferred memory initialization sizing
  net: better skb->sender_cpu and skb->napi_id cohabitation
  serial: sh-sci: Fix panic when serial console and DMA are enabled
  tty: Drop krefs for interrupted tty lock
  drivers: char: mem: Fix wraparound check to allow mappings up to the end
  ASoC: Fix use-after-free at card unregistration
  ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
  ALSA: timer: Fix race between read and ioctl
  drm/nouveau/tmr: fully separate alarm execution/pending lists
  drm/vmwgfx: Make sure backup_handle is always valid
  drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
  drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()
  perf/core: Drop kernel samples even though :u is specified
  powerpc/hotplug-mem: Fix missing endian conversion of aa_index
  powerpc/numa: Fix percpu allocations to be NUMA aware
  powerpc/eeh: Avoid use after free in eeh_handle_special_event()
  scsi: qla2xxx: don't disable a not previously enabled PCI device
  KVM: arm/arm64: Handle possible NULL stage2 pud when ageing pages
  btrfs: fix memory leak in update_space_info failure path
  btrfs: use correct types for page indices in btrfs_page_exists_in_range
  cxl: Fix error path on bad ioctl
  ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
  ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments()
  ufs: set correct ->s_maxsize
  ufs: restore maintaining ->i_blocks
  fix ufs_isblockset()
  ufs: restore proper tail allocation
  fs: add i_blocksize()
  cpuset: consider dying css as offline
  Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled
  drm/msm: Expose our reservation object when exporting a dmabuf.
  target: Re-add check to reject control WRITEs with overflow data
  cpufreq: cpufreq_register_driver() should return -ENODEV if init fails
  stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
  random: properly align get_random_int_hash
  drivers: char: random: add get_random_long()
  iio: proximity: as3935: fix AS3935_INT mask
  iio: light: ltr501 Fix interchanged als/ps register field
  staging/lustre/lov: remove set_fs() call from lov_getstripe()
  usb: chipidea: debug: check before accessing ci_role
  usb: chipidea: udc: fix NULL pointer dereference if udc_start failed
  usb: gadget: f_mass_storage: Serialize wake and sleep execution
  ext4: fix fdatasync(2) after extent manipulation operations
  ext4: keep existing extra fields when inode expands
  ext4: fix SEEK_HOLE
  xen-netfront: cast grant table reference first to type int
  xen-netfront: do not cast grant table reference to signed short
  xen/privcmd: Support correctly 64KB page granularity when mapping memory
  dmaengine: ep93xx: Always start from BASE0
  dmaengine: usb-dmac: Fix DMAOR AE bit definition
  KVM: async_pf: avoid async pf injection when in guest mode
  arm: KVM: Allow unaligned accesses at HYP
  KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation
  kvm: async_pf: fix rcu_irq_enter() with irqs enabled
  nfsd: Fix up the "supattr_exclcreat" attributes
  nfsd4: fix null dereference on replay
  drm/amdgpu/ci: disable mclk switching for high refresh rates (v2)
  crypto: gcm - wait for crypto op not signal safe
  KEYS: fix freeing uninitialized memory in key_update()
  KEYS: fix dereferencing NULL payload with nonzero length
  ptrace: Properly initialize ptracer_cred on fork
  serial: ifx6x60: fix use-after-free on module unload
  arch/sparc: support NR_CPUS = 4096
  sparc64: delete old wrap code
  sparc64: new context wrap
  sparc64: add per-cpu mm of secondary contexts
  sparc64: redefine first version
  sparc64: combine activate_mm and switch_mm
  sparc64: reset mm cpumask after wrap
  sparc: Machine description indices can vary
  sparc64: mm: fix copy_tsb to correctly copy huge page TSBs
  net: bridge: start hello timer only if device is up
  net: ethoc: enable NAPI before poll may be scheduled
  net: ping: do not abuse udp_poll()
  ipv6: Fix leak in ipv6_gso_segment().
  vxlan: fix use-after-free on deletion
  tcp: disallow cwnd undo when switching congestion control
  cxgb4: avoid enabling napi twice to the same queue
  ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()
  bnx2x: Fix Multi-Cos
  ANDROID: uid_sys_stats: check previous uid_entry before call find_or_register_uid
  ANDROID: sdcardfs: d_splice_alias can return error values

Change-Id: I829ebf1a9271dcf0462c537e7bfcbcfde322f336
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

8 files changed, 36 insertions, 10 deletions

diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 57a2e347f04d..0f0094b58d1f 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -893,6 +893,12 @@ static bool ci_dpm_vblank_too_short(struct amdgpu_device *adev)
 	u32 vblank_time = amdgpu_dpm_get_vblank_time(adev);
 	u32 switch_limit = adev->mc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 300;
 
+	/* disable mclk switching if the refresh is >120Hz, even if the
+	 * blanking period would allow it
+	 */
+	if (amdgpu_dpm_get_vrefresh(adev) > 120)
+		return true;
+
 	if (vblank_time < switch_limit)
 		return true;
 	else
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 74f298d7328d..642fee62bdc3 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -1780,6 +1780,7 @@ static struct drm_driver msm_driver = {
 	.prime_fd_to_handle = drm_gem_prime_fd_to_handle,
 	.gem_prime_export   = drm_gem_prime_export,
 	.gem_prime_import   = drm_gem_prime_import,
+	.gem_prime_res_obj  = msm_gem_prime_res_obj,
 	.gem_prime_pin      = msm_gem_prime_pin,
 	.gem_prime_unpin    = msm_gem_prime_unpin,
 	.gem_prime_get_sg_table = msm_gem_prime_get_sg_table,
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 8f56a3126008..f6eaebab0655 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -461,6 +461,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj);
 void *msm_gem_prime_vmap(struct drm_gem_object *obj);
 void msm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 int msm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma);
+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj);
 struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev,
 		struct dma_buf_attachment *attach, struct sg_table *sg);
 int msm_gem_prime_pin(struct drm_gem_object *obj);
diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c
index 678018804f3a..9f3c097d011b 100644
--- a/drivers/gpu/drm/msm/msm_gem_prime.c
+++ b/drivers/gpu/drm/msm/msm_gem_prime.c
@@ -80,3 +80,10 @@ void msm_gem_prime_unpin(struct drm_gem_object *obj)
 	if (!obj->import_attach)
 		msm_gem_put_pages(obj);
 }
+
+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	return msm_obj->resv;
+}
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
index 82d3e28918fd..7e4f24ae7de8 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
@@ -4,6 +4,7 @@
 
 struct nvkm_alarm {
 	struct list_head head;
+	struct list_head exec;
 	u64 timestamp;
 	void (*func)(struct nvkm_alarm *);
 };
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
index 79fcdb43e174..46033909d950 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -50,7 +50,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
 		/* Move to completed list.  We'll drop the lock before
 		 * executing the callback so it can reschedule itself.
 		 */
-		list_move_tail(&alarm->head, &exec);
+		list_del_init(&alarm->head);
+		list_add(&alarm->exec, &exec);
 	}
 
 	/* Shut down interrupt if no more pending alarms. */
@@ -59,8 +60,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
 	spin_unlock_irqrestore(&tmr->lock, flags);
 
 	/* Execute completed callbacks. */
-	list_for_each_entry_safe(alarm, atemp, &exec, head) {
-		list_del_init(&alarm->head);
+	list_for_each_entry_safe(alarm, atemp, &exec, exec) {
+		list_del(&alarm->exec);
 		alarm->func(alarm);
 	}
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index b6a0806b06bf..a1c68e6a689e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -368,6 +368,8 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
 				return fifo_state->static_buffer;
 			else {
 				fifo_state->dynamic_buffer = vmalloc(bytes);
+				if (!fifo_state->dynamic_buffer)
+					goto out_err;
 				return fifo_state->dynamic_buffer;
 			}
 		}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index c9c04ccccdd9..027987023400 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1288,11 +1288,14 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 	int ret;
 	uint32_t size;
-	uint32_t backup_handle;
+	uint32_t backup_handle = 0;
 
 	if (req->multisample_count != 0)
 		return -EINVAL;
 
+	if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS)
+		return -EINVAL;
+
 	if (unlikely(vmw_user_surface_size == 0))
 		vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
 			128;
@@ -1328,12 +1331,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
 		ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
 					     &res->backup,
 					     &user_srf->backup_base);
-		if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <
-		    res->backup_size) {
-			DRM_ERROR("Surface backup buffer is too small.\n");
-			vmw_dmabuf_unreference(&res->backup);
-			ret = -EINVAL;
-			goto out_unlock;
+		if (ret == 0) {
+			if (res->backup->base.num_pages * PAGE_SIZE <
+			    res->backup_size) {
+				DRM_ERROR("Surface backup buffer is too small.\n");
+				vmw_dmabuf_unreference(&res->backup);
+				ret = -EINVAL;
+				goto out_unlock;
+			} else {
+				backup_handle = req->buffer_handle;
+			}
 		}
 	} else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer)
 		ret = vmw_user_dmabuf_alloc(dev_priv, tfile,