summaryrefslogtreecommitdiff
path: root/net/mac80211 (follow)
Commit message (Collapse)AuthorAge
...
| * | | | | | Merge 4.4.161 into android-4.4Greg Kroah-Hartman2018-10-13
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.161 mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly fbdev/omapfb: fix omapfb_memory_read infoleak x86/vdso: Fix asm constraints on vDSO syscall fallbacks x86/vdso: Fix vDSO syscall fallback asm constraint regression PCI: Reprogram bridge prefetch registers on resume mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys PM / core: Clear the direct_complete flag on errors dm cache: fix resize crash if user doesn't reload cache table xhci: Add missing CAS workaround for Intel Sunrise Point xHCI USB: serial: simple: add Motorola Tetra MTP6550 id of: unittest: Disable interrupt node tests for old world MAC systems ext4: always verify the magic number in xattr blocks cgroup: Fix deadlock in cpu hotplug path ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait powerpc/fadump: Return error when fadump registration fails ARC: clone syscall to setp r25 as thread pointer ucma: fix a use-after-free in ucma_resolve_ip() ubifs: Check for name being NULL while mounting tcp: increment sk_drops for dropped rx packets tcp: use an RB tree for ooo receive queue tcp: fix a stale ooo_last_skb after a replace tcp: free batches of packets in tcp_prune_ofo_queue() tcp: call tcp_drop() from tcp_data_queue_ofo() tcp: add tcp_ooo_try_coalesce() helper ath10k: fix scan crash due to incorrect length calculation ebtables: arpreply: Add the standard target sanity check Linux 4.4.161 Change-Id: I4c6607d0be0977857f966b048279590470c854c2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keysFelix Fietkau2018-10-13
| | | |_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 211710ca74adf790b46ab3867fcce8047b573cd1 upstream. key->sta is only valid after ieee80211_key_link, which is called later in this function. Because of that, the IEEE80211_KEY_FLAG_RX_MGMT is never set when management frame protection is enabled. Fixes: e548c49e6dc6b ("mac80211: add key flag for management keys") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | Merge android-4.4.160 (a94efb1) into msm-4.4Srinivasarao P2018-10-15
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-a94efb1 Linux 4.4.160 dm thin metadata: fix __udivdi3 undefined on 32-bit ocfs2: fix locking for res->tracking and dlm->tracking_list proc: restrict kernel stack dumps to root crypto: mxs-dcp - Fix wait logic on chan threads ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760 smb2: fix missing files in root share directory listing xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage xen: avoid crash in disable_hotplug_cpu xen/manage: don't complain about an empty value in control/sysrq node cifs: read overflow in is_valid_oplock_break() s390/qeth: don't dump past end of unknown HW header r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto" hexagon: modify ffs() and fls() to return int arch/hexagon: fix kernel/dma.c build warning dm thin metadata: try to avoid ever aborting transactions fs/cifs: suppress a string overflow warning drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS USB: yurex: Check for truncation in yurex_read() RDMA/ucma: check fd type in ucma_migrate_id() perf probe powerpc: Ignore SyS symbols irrespective of endianness usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] mm: madvise(MADV_DODUMP): allow hugetlbfs pages tools/vm/page-types.c: fix "defined but not used" warning tools/vm/slabinfo.c: fix sign-compare warning mac80211: shorten the IBSS debug messages mac80211: Fix station bandwidth setting after channel switch mac80211: fix a race between restart and CSA flows cfg80211: fix a type issue in ieee80211_chandef_to_operating_class() fs/cifs: don't translate SFM_SLASH (U+F026) to backslash net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx() i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP i2c: uniphier: issue STOP only for last message or I2C_M_STOP RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0 cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE mac80211: mesh: fix HWMP sequence numbering to follow standard gpio: adp5588: Fix sleep-in-atomic-context bug mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function media: v4l: event: Prevent freeing event subscriptions while accessed arm64: KVM: Sanitize PSTATE.M when being set from userspace arm64: cpufeature: Track 32bit EL0 support i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus hwmon: (adt7475) Make adt7475_read_word() return errors hwmon: (ina2xx) fix sysfs shunt resistor read access e1000: ensure to free old tx/rx rings in set_ringparam() e1000: check on netif_running() before calling e1000_up() net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES thermal: of-thermal: disable passive polling when thermal zone is disabled ext4: never move the system.data xattr out of the inode body arm64: KVM: Tighten guest core register access from userspace serial: imx: restore handshaking irq for imx1 scsi: target: iscsi: Use bin2hex instead of a re-implementation IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop Input: elantech - enable middle button of touchpad on ThinkPad P72 USB: remove LPM management from usb_driver_claim_interface() Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: usbdevfs: restore warning for nonsensical flags USB: usbdevfs: sanitize flags more media: uvcvideo: Support realtek's UVC 1.5 device slub: make ->cpu_partial unsigned int USB: handle NULL config in usb_find_alt_setting() USB: fix error handling in usb_driver_claim_interface() spi: rspi: Fix interrupted DMA transfers spi: rspi: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: sh-msiof: Fix invalid SPI use during system suspend spi: tegra20-slink: explicitly enable/disable clock serial: cpm_uart: return immediately from console poll floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl ARM: dts: dra7: fix DCAN node addresses nfsd: fix corrupted reply to badly ordered compound module: exclude SHN_UNDEF symbols from kallsyms api ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs EDAC, i7core: Fix memleaks and use-after-free on probe and remove scsi: bnx2i: add error handling for ioremap_nocache HID: hid-ntrig: add error handling for sysfs_create_group ARM: mvebu: declare asm symbols as character arrays in pmsu.c wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge media: tm6000: add error handling for dvb_register_adapter drivers/tty: add error handling for pcmcia_loop_config staging: android: ashmem: Fix mmap size validation media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data media: soc_camera: ov772x: correct setting of banding filter media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power ALSA: snd-aoa: add of_node_put() in error path s390/extmem: fix gcc 8 stringop-overflow warning alarmtimer: Prevent overflow for relative nanosleep powerpc/powernv/ioda2: Reduce upper limit for DMA window size usb: wusbcore: security: cast sizeof to int for comparison scsi: ibmvscsi: Improve strings handling scsi: klist: Make it safe to use klists in atomic context scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size x86/entry/64: Add two more instruction suffixes x86/tsc: Add missing header to tsc_msr.c media: fsl-viu: fix error handling in viu_of_probe() powerpc/kdump: Handle crashkernel memory reservation failure media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() md-cluster: clear another node's suspend_area after the copy is finished 6lowpan: iphc: reset mac_header after decompress to fix panic USB: serial: kobil_sct: fix modem-status error handling Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 power: vexpress: fix corruption in notifier registration uwb: hwa-rc: fix memory leak at probe staging: rts5208: fix missing error check on call to rtsx_write_register x86/numa_emulation: Fix emulated-to-physical node mapping vmci: type promotion bug in qp_host_get_user_memory() tsl2550: fix lux1_input error in low light crypto: skcipher - Fix -Wstringop-truncation warnings ANDROID: sdcardfs: Change current->fs under lock ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro Revert "f2fs: use timespec64 for inode timestamps" Conflicts: arch/arm64/include/asm/cpufeature.h Change-Id: I661204f2419f634173846d03ed4078b93aa006a1 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | Merge 4.4.160 into android-4.4Greg Kroah-Hartman2018-10-10
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.160 crypto: skcipher - Fix -Wstringop-truncation warnings tsl2550: fix lux1_input error in low light vmci: type promotion bug in qp_host_get_user_memory() x86/numa_emulation: Fix emulated-to-physical node mapping staging: rts5208: fix missing error check on call to rtsx_write_register uwb: hwa-rc: fix memory leak at probe power: vexpress: fix corruption in notifier registration Bluetooth: Add a new Realtek 8723DE ID 0bda:b009 USB: serial: kobil_sct: fix modem-status error handling 6lowpan: iphc: reset mac_header after decompress to fix panic md-cluster: clear another node's suspend_area after the copy is finished media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt() powerpc/kdump: Handle crashkernel memory reservation failure media: fsl-viu: fix error handling in viu_of_probe() x86/tsc: Add missing header to tsc_msr.c x86/entry/64: Add two more instruction suffixes scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size scsi: klist: Make it safe to use klists in atomic context scsi: ibmvscsi: Improve strings handling usb: wusbcore: security: cast sizeof to int for comparison powerpc/powernv/ioda2: Reduce upper limit for DMA window size alarmtimer: Prevent overflow for relative nanosleep s390/extmem: fix gcc 8 stringop-overflow warning ALSA: snd-aoa: add of_node_put() in error path media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power media: soc_camera: ov772x: correct setting of banding filter media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data staging: android: ashmem: Fix mmap size validation drivers/tty: add error handling for pcmcia_loop_config media: tm6000: add error handling for dvb_register_adapter ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication() wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout() ARM: mvebu: declare asm symbols as character arrays in pmsu.c HID: hid-ntrig: add error handling for sysfs_create_group scsi: bnx2i: add error handling for ioremap_nocache EDAC, i7core: Fix memleaks and use-after-free on probe and remove ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs module: exclude SHN_UNDEF symbols from kallsyms api nfsd: fix corrupted reply to badly ordered compound ARM: dts: dra7: fix DCAN node addresses floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl serial: cpm_uart: return immediately from console poll spi: tegra20-slink: explicitly enable/disable clock spi: sh-msiof: Fix invalid SPI use during system suspend spi: sh-msiof: Fix handling of write value for SISTR register spi: rspi: Fix invalid SPI use during system suspend spi: rspi: Fix interrupted DMA transfers USB: fix error handling in usb_driver_claim_interface() USB: handle NULL config in usb_find_alt_setting() slub: make ->cpu_partial unsigned int media: uvcvideo: Support realtek's UVC 1.5 device USB: usbdevfs: sanitize flags more USB: usbdevfs: restore warning for nonsensical flags Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" USB: remove LPM management from usb_driver_claim_interface() Input: elantech - enable middle button of touchpad on ThinkPad P72 IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop scsi: target: iscsi: Use bin2hex instead of a re-implementation serial: imx: restore handshaking irq for imx1 arm64: KVM: Tighten guest core register access from userspace ext4: never move the system.data xattr out of the inode body thermal: of-thermal: disable passive polling when thermal zone is disabled net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES e1000: check on netif_running() before calling e1000_up() e1000: ensure to free old tx/rx rings in set_ringparam() hwmon: (ina2xx) fix sysfs shunt resistor read access hwmon: (adt7475) Make adt7475_read_word() return errors i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus arm64: cpufeature: Track 32bit EL0 support arm64: KVM: Sanitize PSTATE.M when being set from userspace media: v4l: event: Prevent freeing event subscriptions while accessed KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X gpio: adp5588: Fix sleep-in-atomic-context bug mac80211: mesh: fix HWMP sequence numbering to follow standard cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0 i2c: uniphier: issue STOP only for last message or I2C_M_STOP i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx() fs/cifs: don't translate SFM_SLASH (U+F026) to backslash cfg80211: fix a type issue in ieee80211_chandef_to_operating_class() mac80211: fix a race between restart and CSA flows mac80211: Fix station bandwidth setting after channel switch mac80211: shorten the IBSS debug messages tools/vm/slabinfo.c: fix sign-compare warning tools/vm/page-types.c: fix "defined but not used" warning mm: madvise(MADV_DODUMP): allow hugetlbfs pages usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] perf probe powerpc: Ignore SyS symbols irrespective of endianness RDMA/ucma: check fd type in ucma_migrate_id() USB: yurex: Check for truncation in yurex_read() drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS fs/cifs: suppress a string overflow warning dm thin metadata: try to avoid ever aborting transactions arch/hexagon: fix kernel/dma.c build warning hexagon: modify ffs() and fls() to return int arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto" r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED s390/qeth: don't dump past end of unknown HW header cifs: read overflow in is_valid_oplock_break() xen/manage: don't complain about an empty value in control/sysrq node xen: avoid crash in disable_hotplug_cpu xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage smb2: fix missing files in root share directory listing ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760 crypto: mxs-dcp - Fix wait logic on chan threads proc: restrict kernel stack dumps to root ocfs2: fix locking for res->tracking and dlm->tracking_list dm thin metadata: fix __udivdi3 undefined on 32-bit Linux 4.4.160 Change-Id: I54d72945f741d6b4442adcd7bc18cb5417accb0f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | mac80211: shorten the IBSS debug messagesEmmanuel Grumbach2018-10-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit c6e57b3896fc76299913b8cfd82d853bee8a2c84 ] When tracing is enabled, all the debug messages are recorded and must not exceed MAX_MSG_LEN (100) columns. Longer debug messages grant the user with: WARNING: CPU: 3 PID: 32642 at /tmp/wifi-core-20180806094828/src/iwlwifi-stack-dev/net/mac80211/./trace_msg.h:32 trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211] Workqueue: phy1 ieee80211_iface_work [mac80211] RIP: 0010:trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211] Call Trace: __sdata_dbg+0xbd/0x120 [mac80211] ieee80211_ibss_rx_queued_mgmt+0x15f/0x510 [mac80211] ieee80211_iface_work+0x21d/0x320 [mac80211] Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | mac80211: Fix station bandwidth setting after channel switchIlan Peer2018-10-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 0007e94355fdb71a1cf5dba0754155cba08f0666 ] When performing a channel switch flow for a managed interface, the flow did not update the bandwidth of the AP station and the rate scale algorithm. In case of a channel width downgrade, this would result with the rate scale algorithm using a bandwidth that does not match the interface channel configuration. Fix this by updating the AP station bandwidth and rate scaling algorithm before the actual channel change in case of a bandwidth downgrade, or after the actual channel change in case of a bandwidth upgrade. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | mac80211: fix a race between restart and CSA flowsEmmanuel Grumbach2018-10-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit f3ffb6c3a28963657eb8b02a795d75f2ebbd5ef4 ] We hit a problem with iwlwifi that was caused by a bug in mac80211. A bug in iwlwifi caused the firwmare to crash in certain cases in channel switch. Because of that bug, drv_pre_channel_switch would fail and trigger the restart flow. Now we had the hw restart worker which runs on the system's workqueue and the csa_connection_drop_work worker that runs on mac80211's workqueue that can run together. This is obviously problematic since the restart work wants to reconfigure the connection, while the csa_connection_drop_work worker does the exact opposite: it tries to disconnect. Fix this by cancelling the csa_connection_drop_work worker in the restart worker. Note that this can sound racy: we could have: driver iface_work CSA_work restart_work +++++++++++++++++++++++++++++++++++++++++++++ | <--drv_cs ---| <FW CRASH!> -CS FAILED--> | | | cancel_work(CSA) schedule | CSA work | | | Race between those 2 But this is not possible because we flush the workqueue in the restart worker before we cancel the CSA worker. That would be bullet proof if we could guarantee that we schedule the CSA worker only from the iface_work which runs on the workqueue (and not on the system's workqueue), but unfortunately we do have an instance in which we schedule the CSA work outside the context of the workqueue (ieee80211_chswitch_done). Note also that we should probably cancel other workers like beacon_connection_loss_work and possibly others for different types of interfaces, at the very least, IBSS should suffer from the exact same problem, but for now, do the minimum to fix the actual bug that was actually experienced and reproduced. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | mac80211: mesh: fix HWMP sequence numbering to follow standardYuan-Chi Pang2018-10-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 1f631c3201fe5491808df143d8fcba81b3197ffd ] IEEE 802.11-2016 14.10.8.3 HWMP sequence numbering says: If it is a target mesh STA, it shall update its own HWMP SN to maximum (current HWMP SN, target HWMP SN in the PREQ element) + 1 immediately before it generates a PREP element in response to a PREQ element. Signed-off-by: Yuan-Chi Pang <fu3mo6goo@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_XDanek Duvall2018-10-10
| | | |_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 67d1ba8a6dc83d90cd58b89fa6cbf9ae35a0cf7f ] The mod mask for VHT capabilities intends to say that you can override the number of STBC receive streams, and it does, but only by accident. The IEEE80211_VHT_CAP_RXSTBC_X aren't bits to be set, but values (albeit left-shifted). ORing the bits together gets the right answer, but we should use the _MASK macro here instead. Signed-off-by: Danek Duvall <duvall@comfychair.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | Merge android-4.4.158 (f9e4134) into msm-4.4Srinivasarao P2018-09-28
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-f9e4134 Linux 4.4.158 MIPS: VDSO: Match data page cache colouring when D$ aliases drivers: net: cpsw: fix segfault in case of bad phy-handle mei: bus: type promotion bug in mei_nfc_if_version() USB: serial: ti_usb_3410_5052: fix array underflow in completion handler pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant drm/panel: type promotion bug in s6e8aa0_read_mtp_id() selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress ALSA: pcm: Fix snd_interval_refine first/last with open min/max rtc: bq4802: add error handling for devm_ioremap drm/amdkfd: Fix error codes in kfd_get_process gpiolib: Mark gpio_suffixes array with __maybe_unused coresight: tpiu: Fix disabling timeouts coresight: Handle errors in finding input/output ports parport: sunbpp: fix error return code drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping ARM: hisi: check of_iomap and fix missing of_node_put ARM: hisi: fix error handling and missing of_node_put ARM: hisi: handle of_iomap and fix missing of_node_put MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads mtdchar: fix overflows in adjustment of `count` audit: fix use-after-free in audit_add_watch binfmt_elf: Respect error return from `regset->active' CIFS: fix wrapping bugs in num_entries() cifs: prevent integer overflow in nxt_dir_entry() usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt() USB: yurex: Fix buffer over-read in yurex_write() usb: misc: uss720: Fix two sleep-in-atomic-context bugs USB: serial: io_ti: fix array underflow in completion handler USB: net2280: Fix erroneous synchronization change USB: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame() usb: Avoid use-after-free by flushing endpoints early in usb_set_interface() USB: Add quirk to support DJI CineSSD usb: Don't die twice if PCI xhci host is not responding in resume misc: hmc6352: fix potential Spectre v1 Tools: hv: Fix a bug in the key delete code IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler xen/netfront: fix waiting for xenbus state change pstore: Fix incorrect persistent ram buffer mapping RDMA/cma: Protect cma dev list with lock xen-netfront: fix warn message as irq device name has '/' crypto: sharah - Unregister correct algorithms for SAHARA 3 platform/x86: toshiba_acpi: Fix defined but not used build warnings s390/qeth: reset layer2 attribute on layer switch s390/qeth: fix race in used-buffer accounting arm64: dts: qcom: db410c: Fix Bluetooth LED trigger xen-netfront: fix queue name setting mac80211: restrict delayed tailroom needed decrement MIPS: jz4740: Bump zload address powerpc/powernv: opal_put_chars partial write fix perf powerpc: Fix callchain ip filtering ARM: exynos: Clear global variable on init error path fbdev: Distinguish between interlaced and progressive modes perf powerpc: Fix callchain ip filtering when return address is in a register fbdev/via: fix defined but not used warning video: goldfishfb: fix memory leak on driver remove fbdev: omapfb: off by one in omapfb_register_client() mtd/maps: fix solutionengine.c printk format warnings media: videobuf2-core: check for q->error in vb2_core_qbuf() MIPS: ath79: fix system restart dmaengine: pl330: fix irq race with terminate_all kbuild: add .DELETE_ON_ERROR special target clk: imx6ul: fix missing of_node_put() gfs2: Special-case rindex for gfs2_grow xfrm: fix 'passing zero to ERR_PTR()' warning ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro ALSA: msnd: Fix the default sample sizes iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register BACKPORT: arm/syscalls: Optimize address limit check UPSTREAM: syscalls: Use CHECK_DATA_CORRUPTION for addr_limit_user_check BACKPORT: arm64/syscalls: Check address limit on user-mode return BACKPORT: x86/syscalls: Check address limit on user-mode return BACKPORT: lkdtm: add bad USER_DS test UPSTREAM: bug: switch data corruption check to __must_check BACKPORT: lkdtm: Add tests for struct list corruption UPSTREAM: bug: Provide toggle for BUG on data corruption UPSTREAM: list: Split list_del() debug checking into separate function UPSTREAM: rculist: Consolidate DEBUG_LIST for list_add_rcu() BACKPORT: list: Split list_add() debug checking into separate function FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl. Conflicts: include/linux/bug.h lib/Kconfig.debug lib/list_debug.c Change-Id: I9d87b6b133cac5b642e5e0c928e0bcd0eda6fbdb Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | Merge 4.4.158 into android-4.4Greg Kroah-Hartman2018-09-26
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.158 iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register ALSA: msnd: Fix the default sample sizes ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro xfrm: fix 'passing zero to ERR_PTR()' warning gfs2: Special-case rindex for gfs2_grow clk: imx6ul: fix missing of_node_put() kbuild: add .DELETE_ON_ERROR special target dmaengine: pl330: fix irq race with terminate_all MIPS: ath79: fix system restart media: videobuf2-core: check for q->error in vb2_core_qbuf() mtd/maps: fix solutionengine.c printk format warnings fbdev: omapfb: off by one in omapfb_register_client() video: goldfishfb: fix memory leak on driver remove fbdev/via: fix defined but not used warning perf powerpc: Fix callchain ip filtering when return address is in a register fbdev: Distinguish between interlaced and progressive modes ARM: exynos: Clear global variable on init error path perf powerpc: Fix callchain ip filtering powerpc/powernv: opal_put_chars partial write fix MIPS: jz4740: Bump zload address mac80211: restrict delayed tailroom needed decrement xen-netfront: fix queue name setting arm64: dts: qcom: db410c: Fix Bluetooth LED trigger s390/qeth: fix race in used-buffer accounting s390/qeth: reset layer2 attribute on layer switch platform/x86: toshiba_acpi: Fix defined but not used build warnings crypto: sharah - Unregister correct algorithms for SAHARA 3 xen-netfront: fix warn message as irq device name has '/' RDMA/cma: Protect cma dev list with lock pstore: Fix incorrect persistent ram buffer mapping xen/netfront: fix waiting for xenbus state change IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler Tools: hv: Fix a bug in the key delete code misc: hmc6352: fix potential Spectre v1 usb: Don't die twice if PCI xhci host is not responding in resume USB: Add quirk to support DJI CineSSD usb: Avoid use-after-free by flushing endpoints early in usb_set_interface() usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame() USB: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller USB: net2280: Fix erroneous synchronization change USB: serial: io_ti: fix array underflow in completion handler usb: misc: uss720: Fix two sleep-in-atomic-context bugs USB: yurex: Fix buffer over-read in yurex_write() usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt() cifs: prevent integer overflow in nxt_dir_entry() CIFS: fix wrapping bugs in num_entries() binfmt_elf: Respect error return from `regset->active' audit: fix use-after-free in audit_add_watch mtdchar: fix overflows in adjustment of `count` MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads ARM: hisi: handle of_iomap and fix missing of_node_put ARM: hisi: fix error handling and missing of_node_put ARM: hisi: check of_iomap and fix missing of_node_put drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping parport: sunbpp: fix error return code coresight: Handle errors in finding input/output ports coresight: tpiu: Fix disabling timeouts gpiolib: Mark gpio_suffixes array with __maybe_unused drm/amdkfd: Fix error codes in kfd_get_process rtc: bq4802: add error handling for devm_ioremap ALSA: pcm: Fix snd_interval_refine first/last with open min/max selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress drm/panel: type promotion bug in s6e8aa0_read_mtp_id() pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant USB: serial: ti_usb_3410_5052: fix array underflow in completion handler mei: bus: type promotion bug in mei_nfc_if_version() drivers: net: cpsw: fix segfault in case of bad phy-handle MIPS: VDSO: Match data page cache colouring when D$ aliases Linux 4.4.158 Change-Id: I1e31454733d69774fbb97398fd7756438fb8fa17 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | mac80211: restrict delayed tailroom needed decrementManikanta Pubbisetty2018-09-26
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 133bf90dbb8b873286f8ec2e81ba26e863114b8c ] As explained in ieee80211_delayed_tailroom_dec(), during roam, keys of the old AP will be destroyed and new keys will be installed. Deletion of the old key causes crypto_tx_tailroom_needed_cnt to go from 1 to 0 and the new key installation causes a transition from 0 to 1. Whenever crypto_tx_tailroom_needed_cnt transitions from 0 to 1, we invoke synchronize_net(); the reason for doing this is to avoid a race in the TX path as explained in increment_tailroom_need_count(). This synchronize_net() operation can be slow and can affect the station roam time. To avoid this, decrementing the crypto_tx_tailroom_needed_cnt is delayed for a while so that upon installation of new key the transition would be from 1 to 2 instead of 0 to 1 and thereby improving the roam time. This is all correct for a STA iftype, but deferring the tailroom_needed decrement for other iftypes may be unnecessary. For example, let's consider the case of a 4-addr client connecting to an AP for which AP_VLAN interface is also created, let the initial value for tailroom_needed on the AP be 1. * 4-addr client connects to the AP (AP: tailroom_needed = 1) * AP will clear old keys, delay decrement of tailroom_needed count * AP_VLAN is created, it takes the tailroom count from master (AP_VLAN: tailroom_needed = 1, AP: tailroom_needed = 1) * Install new key for the station, assume key is plumbed in the HW, there won't be any change in tailroom_needed count on AP iface * Delayed decrement of tailroom_needed count on AP (AP: tailroom_needed = 0, AP_VLAN: tailroom_needed = 1) Because of the delayed decrement on AP iface, tailroom_needed count goes out of sync between AP(master iface) and AP_VLAN(slave iface) and there would be unnecessary tailroom created for the packets going through AP_VLAN iface. Also, WARN_ONs were observed while trying to bring down the AP_VLAN interface: (warn_slowpath_common) (warn_slowpath_null+0x18/0x20) (warn_slowpath_null) (ieee80211_free_keys+0x114/0x1e4) (ieee80211_free_keys) (ieee80211_del_virtual_monitor+0x51c/0x850) (ieee80211_del_virtual_monitor) (ieee80211_stop+0x30/0x3c) (ieee80211_stop) (__dev_close_many+0x94/0xb8) (__dev_close_many) (dev_close_many+0x5c/0xc8) Restricting delayed decrement to station interface alone fixes the problem and it makes sense to do so because delayed decrement is done to improve roam time which is applicable only for client devices. Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | Merge android-4.4.154 (d762e28) into msm-4.4Srinivasarao P2018-09-12
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-d762e28 Linux 4.4.154 cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status iscsi target: fix session creation failure handling scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock scsi: sysfs: Introduce sysfs_{un,}break_active_protection() MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7 MIPS: Correct the 64-bit DSP accumulator register size kprobes: Make list and blacklist root user read only s390/pci: fix out of bounds access during irq setup s390/qdio: reset old sbal_state flags s390: fix br_r1_trampoline for machines without exrl x86/spectre: Add missing family 6 check to microcode check x86/irqflags: Mark native_restore_fl extern inline pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show() ASoC: sirf: Fix potential NULL pointer dereference ASoC: dpcm: don't merge format from invalid codec dai udl-kms: fix crash due to uninitialized memory udl-kms: handle allocation failure udl-kms: change down_interruptible to down fuse: Add missed unlock_page() to fuse_readpages_fill() fuse: Fix oops at process_init_reply() fuse: umount should wait for all requests fuse: fix unlocked access to processing queue fuse: fix double request_end() fuse: Don't access pipe->buffers without pipe_lock() x86/process: Re-export start_thread() x86/speculation/l1tf: Suggest what to do on systems with too much RAM x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit KVM: arm/arm64: Skip updating PMD entry if no change KVM: arm/arm64: Skip updating PTE entry if no change arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid() ext4: reset error code in ext4_find_entry in fallback ext4: sysfs: print ext4_super_block fields as little-endian ext4: check for NUL characters in extended attribute's name s390/kvm: fix deadlock when killed by oom btrfs: don't leak ret from do_chunk_alloc smb3: don't request leases in symlink creation and query smb3: Do not send SMB3 SET_INFO if nothing changed cifs: check kmalloc before use cifs: add missing debug entries for kconfig options mm/memory.c: check return value of ioremap_prot scsi: vmw_pvscsi: Return DID_RESET for status SAM_STAT_COMMAND_TERMINATED scsi: fcoe: drop frames in ELS LOGO error path drivers: net: lmc: fix case value for target abort error arc: fix type warnings in arc/mm/cache.c arc: fix build errors in arc/include/asm/delay.h enic: handle mtu change for vf properly Revert "MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum" tools/power turbostat: Read extended processor family from CPUID zswap: re-check zswap_is_full() after do zswap_shrink() selftests/ftrace: Add snapshot and tracing_on test case cachefiles: Wait rather than BUG'ing on "Unexpected object collision" cachefiles: Fix refcounting bug in backing-file read monitoring fscache: Allow cancelled operations to be enqueued net: axienet: Fix double deregister of mdio bnx2x: Fix invalid memory access in rss hash config path. media: staging: omap4iss: Include asm/cacheflush.h after generic includes i2c: davinci: Avoid zero value of CLKH can: mpc5xxx_can: check of_iomap return before use net: prevent ISA drivers from building on PPC32 atl1c: reserve min skb headroom qed: Fix possible race for the link state value. net: caif: Add a missing rcu_read_unlock() in caif_flow_cb tools/power turbostat: fix -S on UP systems usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3' tools: usb: ffs-test: Fix build on big endian systems usb/phy: fix PPC64 build errors in phy-fsl-usb.c usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue() usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in init_controller() drm/imx: imx-ldb: check if channel is enabled before printing warning drm/imx: imx-ldb: disable LDB on driver bind scsi: libiscsi: fix possible NULL pointer dereference in case of TMF drm/bridge: adv7511: Reset registers on hotplug nl80211: Add a missing break in parse_station_flags mac80211: add stations tied to AP_VLANs during hw reconfig xfrm: free skb if nlsk pointer is NULL xfrm: fix missing dst_release() after policy blocking lbcast and multicast vti6: fix PMTU caching and reporting on xmit Cipso: cipso_v4_optptr enter infinite loop sched/sysctl: Check user input value of sysctl_sched_time_avg BACKPORT: zram: drop max_zpage_size and use zs_huge_class_size() BACKPORT: zsmalloc: introduce zs_huge_class_size() ANDROID: tracing: fix race condition reading saved tgids Conflicts: mm/zsmalloc.c Change-Id: I1add2f0311c887c135ddc6160963702beeb7bb88 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | Merge 4.4.154 into android-4.4Greg Kroah-Hartman2018-09-05
| |\| | | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.154 sched/sysctl: Check user input value of sysctl_sched_time_avg Cipso: cipso_v4_optptr enter infinite loop vti6: fix PMTU caching and reporting on xmit xfrm: fix missing dst_release() after policy blocking lbcast and multicast xfrm: free skb if nlsk pointer is NULL mac80211: add stations tied to AP_VLANs during hw reconfig nl80211: Add a missing break in parse_station_flags drm/bridge: adv7511: Reset registers on hotplug scsi: libiscsi: fix possible NULL pointer dereference in case of TMF drm/imx: imx-ldb: disable LDB on driver bind drm/imx: imx-ldb: check if channel is enabled before printing warning usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in init_controller() usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue() usb/phy: fix PPC64 build errors in phy-fsl-usb.c tools: usb: ffs-test: Fix build on big endian systems usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3' tools/power turbostat: fix -S on UP systems net: caif: Add a missing rcu_read_unlock() in caif_flow_cb qed: Fix possible race for the link state value. atl1c: reserve min skb headroom net: prevent ISA drivers from building on PPC32 can: mpc5xxx_can: check of_iomap return before use i2c: davinci: Avoid zero value of CLKH media: staging: omap4iss: Include asm/cacheflush.h after generic includes bnx2x: Fix invalid memory access in rss hash config path. net: axienet: Fix double deregister of mdio fscache: Allow cancelled operations to be enqueued cachefiles: Fix refcounting bug in backing-file read monitoring cachefiles: Wait rather than BUG'ing on "Unexpected object collision" selftests/ftrace: Add snapshot and tracing_on test case zswap: re-check zswap_is_full() after do zswap_shrink() tools/power turbostat: Read extended processor family from CPUID Revert "MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum" enic: handle mtu change for vf properly arc: fix build errors in arc/include/asm/delay.h arc: fix type warnings in arc/mm/cache.c drivers: net: lmc: fix case value for target abort error scsi: fcoe: drop frames in ELS LOGO error path scsi: vmw_pvscsi: Return DID_RESET for status SAM_STAT_COMMAND_TERMINATED mm/memory.c: check return value of ioremap_prot cifs: add missing debug entries for kconfig options cifs: check kmalloc before use smb3: Do not send SMB3 SET_INFO if nothing changed smb3: don't request leases in symlink creation and query btrfs: don't leak ret from do_chunk_alloc s390/kvm: fix deadlock when killed by oom ext4: check for NUL characters in extended attribute's name ext4: sysfs: print ext4_super_block fields as little-endian ext4: reset error code in ext4_find_entry in fallback arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid() KVM: arm/arm64: Skip updating PTE entry if no change KVM: arm/arm64: Skip updating PMD entry if no change x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM x86/speculation/l1tf: Suggest what to do on systems with too much RAM x86/process: Re-export start_thread() fuse: Don't access pipe->buffers without pipe_lock() fuse: fix double request_end() fuse: fix unlocked access to processing queue fuse: umount should wait for all requests fuse: Fix oops at process_init_reply() fuse: Add missed unlock_page() to fuse_readpages_fill() udl-kms: change down_interruptible to down udl-kms: handle allocation failure udl-kms: fix crash due to uninitialized memory ASoC: dpcm: don't merge format from invalid codec dai ASoC: sirf: Fix potential NULL pointer dereference pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show() x86/irqflags: Mark native_restore_fl extern inline x86/spectre: Add missing family 6 check to microcode check s390: fix br_r1_trampoline for machines without exrl s390/qdio: reset old sbal_state flags s390/pci: fix out of bounds access during irq setup kprobes: Make list and blacklist root user read only MIPS: Correct the 64-bit DSP accumulator register size MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7 scsi: sysfs: Introduce sysfs_{un,}break_active_protection() scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock iscsi target: fix session creation failure handling cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status Linux 4.4.154 Change-Id: Ia008eef23c91fbd095f7b3343737cb2864875c52 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: add stations tied to AP_VLANs during hw reconfigmpubbise@codeaurora.org2018-09-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 19103a4bfb42f320395daa5616ece3e89e759d63 ] As part of hw reconfig, only stations linked to AP interfaces are added back to the driver ignoring those which are tied to AP_VLAN interfaces. It is true that there could be stations tied to the AP_VLAN interface while serving 4addr clients or when using AP_VLAN for VLAN operations; we should be adding these stations back to the driver as part of hw reconfig, failing to do so can cause functional issues. In the case of ath10k driver, the following errors were observed. ath10k_pci : failed to install key for non-existent peer XX:XX:XX:XX:XX:XX Workqueue: events_freezable ieee80211_restart_work [mac80211] (unwind_backtrace) from (show_stack+0x10/0x14) (show_stack) (dump_stack+0x80/0xa0) (dump_stack) (warn_slowpath_common+0x68/0x8c) (warn_slowpath_common) (warn_slowpath_null+0x18/0x20) (warn_slowpath_null) (ieee80211_enable_keys+0x88/0x154 [mac80211]) (ieee80211_enable_keys) (ieee80211_reconfig+0xc90/0x19c8 [mac80211]) (ieee80211_reconfig]) (ieee80211_restart_work+0x8c/0xa0 [mac80211]) (ieee80211_restart_work) (process_one_work+0x284/0x488) (process_one_work) (worker_thread+0x228/0x360) (worker_thread) (kthread+0xd8/0xec) (kthread) (ret_from_fork+0x14/0x24) Also while bringing down the AP VAP, WARN_ONs and errors related to peer removal were observed. ath10k_pci : failed to clear all peer wep keys for vdev 0: -2 ath10k_pci : failed to disassociate station: 8c:fd:f0:0a:8c:f5 vdev 0: -2 (unwind_backtrace) (show_stack+0x10/0x14) (show_stack) (dump_stack+0x80/0xa0) (dump_stack) (warn_slowpath_common+0x68/0x8c) (warn_slowpath_common) (warn_slowpath_null+0x18/0x20) (warn_slowpath_null) (sta_set_sinfo+0xb98/0xc9c [mac80211]) (sta_set_sinfo [mac80211]) (__sta_info_flush+0xf0/0x134 [mac80211]) (__sta_info_flush [mac80211]) (ieee80211_stop_ap+0xe8/0x390 [mac80211]) (ieee80211_stop_ap [mac80211]) (__cfg80211_stop_ap+0xe0/0x3dc [cfg80211]) (__cfg80211_stop_ap [cfg80211]) (cfg80211_stop_ap+0x30/0x44 [cfg80211]) (cfg80211_stop_ap [cfg80211]) (genl_rcv_msg+0x274/0x30c) (genl_rcv_msg) (netlink_rcv_skb+0x58/0xac) (netlink_rcv_skb) (genl_rcv+0x20/0x34) (genl_rcv) (netlink_unicast+0x11c/0x204) (netlink_unicast) (netlink_sendmsg+0x30c/0x370) (netlink_sendmsg) (sock_sendmsg+0x70/0x84) (sock_sendmsg) (___sys_sendmsg.part.3+0x188/0x228) (___sys_sendmsg.part.3) (__sys_sendmsg+0x4c/0x70) (__sys_sendmsg) (ret_fast_syscall+0x0/0x44) These issues got fixed by adding the stations which are tied to AP_VLANs back to the driver. Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.132 (46155cc) into msm-4.4Srinivasarao P2018-05-22
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-46155cc Linux 4.4.132 perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_* tracing/uprobe_event: Fix strncpy corner case Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174" atm: zatm: Fix potential Spectre v1 net: atm: Fix potential Spectre v1 can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() tracing: Fix regex_match_front() to not over compare the test string libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs rfkill: gpio: fix memory leak in probe error path xfrm_user: fix return value from xfrm_user_rcv_msg f2fs: fix a dead loop in f2fs_fiemap() bdi: Fix oops in wb_workfn() tcp: fix TCP_REPAIR_QUEUE bound checking perf: Remove superfluous allocation error check soreuseport: initialise timewait reuseport field dccp: initialize ireq->ir_mark net: fix uninit-value in __hw_addr_add_ex() net: initialize skb->peeked when cloning net: fix rtnh_ok() netlink: fix uninit-value in netlink_sendmsg crypto: af_alg - fix possible uninit-value in alg_bind() ipvs: fix rtnl_lock lockups caused by start_sync_thread usb: musb: host: fix potential NULL pointer dereference USB: serial: option: adding support for ublox R410M USB: serial: option: reimplement interface masking USB: Accept bulk endpoints with 1024-byte maxpacket USB: serial: visor: handle potential invalid device configuration test_firmware: fix setting old custom fw path back on exit, second try drm/vmwgfx: Fix a buffer object leak IB/mlx5: Use unlimited rate when static rate is not supported NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 RDMA/mlx5: Protect from shift operand overflow RDMA/ucma: Allow resolving address w/o specifying source address xfs: prevent creating negative-sized file via INSERT_RANGE Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro Input: leds - fix out of bound access tracepoint: Do not warn on ENOMEM ALSA: aloop: Add missing cable lock to ctl API callbacks ALSA: aloop: Mark paused device as inactive ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() ALSA: pcm: Check PCM state at xfern compat ioctl USB: serial: option: Add support for Quectel EP06 gpmi-nand: Handle ECC Errors in erased pages ath10k: rebuild crypto header in rx data frames ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode mac80211: Add RX flag to indicate ICV stripped mac80211: allow same PN for AMSDU sub-frames mac80211: allow not sending MIC up from driver for HW crypto percpu: include linux/sched.h for cond_resched() KVM: s390: Enable all facility bits that are known good for passthrough bpf: map_get_next_key to return first key on NULL perf/core: Fix the perf_cpu_time_max_percent check goldfish: pipe: ANDROID: mark local functions static Revert "goldfish: pipe: ANDROID: Allocate memory with GFP_KERNEL." UPSTREAM: ANDROID: binder: prevent transactions into own process. goldfish: pipe: ANDROID: Add DMA support UPSTREAM: f2fs: clear PageError on writepage - part 2 UPSTREAM: f2fs: avoid fsync() failure caused by EAGAIN in writepage() ANDROID: build.config: enforce trace_printk check ANDROID: x86_64_cuttlefish_defconfig: Disable KPTI UPSTREAM: mac80211: ibss: Fix channel type enum in ieee80211_sta_join_ibss() UPSTREAM: mac80211: Fix clang warning about constant operand in logical operation UPSTREAM: nl80211: Fix enum type of variable in nl80211_put_sta_rate() UPSTREAM: sysfs: remove signedness from sysfs_get_dirent UPSTREAM: tracing: Use cpumask_available() to check if cpumask variable may be used BACKPORT: clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK UPSTREAM: netpoll: Fix device name check in netpoll_setup() FROMLIST: staging: Fix sparse warnings in vsoc driver. FROMLIST: staging: vsoc: Fix a i386-randconfig warning. FROMLIST: staging: vsoc: Create wc kernel mapping for region shm. Revert "goldfish: pipe: ANDROID: remove a redundant target" goldfish: pipe: ANDROID: Replace writel with gf_write_ptr goldfish: pipe: ANDROID: Use dev_ logging instead of pr_ goldfish: pipe: ANDROID: fix checkpatch warnings goldfish: pipe: ANDROID: Update module license Conflicts: drivers/net/wireless/ath/ath10k/core.c drivers/net/wireless/ath/ath10k/core.h drivers/net/wireless/ath/ath10k/htt_rx.c Change-Id: If2ede1dea6a07b3fd498724e83071fd547170e1c [spathi@codeaurora.org: resolved compilation errors in ath10k by rebuilding crypto header in rx data frames] Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.132 into android-4.4Greg Kroah-Hartman2018-05-16
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.132 perf/core: Fix the perf_cpu_time_max_percent check bpf: map_get_next_key to return first key on NULL KVM: s390: Enable all facility bits that are known good for passthrough percpu: include linux/sched.h for cond_resched() mac80211: allow not sending MIC up from driver for HW crypto mac80211: allow same PN for AMSDU sub-frames mac80211: Add RX flag to indicate ICV stripped ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode ath10k: rebuild crypto header in rx data frames gpmi-nand: Handle ECC Errors in erased pages USB: serial: option: Add support for Quectel EP06 ALSA: pcm: Check PCM state at xfern compat ioctl ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() ALSA: aloop: Mark paused device as inactive ALSA: aloop: Add missing cable lock to ctl API callbacks tracepoint: Do not warn on ENOMEM Input: leds - fix out of bound access Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro xfs: prevent creating negative-sized file via INSERT_RANGE RDMA/ucma: Allow resolving address w/o specifying source address RDMA/mlx5: Protect from shift operand overflow NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 IB/mlx5: Use unlimited rate when static rate is not supported drm/vmwgfx: Fix a buffer object leak test_firmware: fix setting old custom fw path back on exit, second try USB: serial: visor: handle potential invalid device configuration USB: Accept bulk endpoints with 1024-byte maxpacket USB: serial: option: reimplement interface masking USB: serial: option: adding support for ublox R410M usb: musb: host: fix potential NULL pointer dereference ipvs: fix rtnl_lock lockups caused by start_sync_thread crypto: af_alg - fix possible uninit-value in alg_bind() netlink: fix uninit-value in netlink_sendmsg net: fix rtnh_ok() net: initialize skb->peeked when cloning net: fix uninit-value in __hw_addr_add_ex() dccp: initialize ireq->ir_mark soreuseport: initialise timewait reuseport field perf: Remove superfluous allocation error check tcp: fix TCP_REPAIR_QUEUE bound checking bdi: Fix oops in wb_workfn() f2fs: fix a dead loop in f2fs_fiemap() xfrm_user: fix return value from xfrm_user_rcv_msg rfkill: gpio: fix memory leak in probe error path libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs tracing: Fix regex_match_front() to not over compare the test string can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() net: atm: Fix potential Spectre v1 atm: zatm: Fix potential Spectre v1 Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174" tracing/uprobe_event: Fix strncpy corner case perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_* perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() Linux 4.4.132 Change-Id: I66c21e374dff5a5735f1c5958021612387c635bf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: Add RX flag to indicate ICV strippedDavid Spinadel2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit cef0acd4d7d4811d2d19cd0195031bf0dfe41249 upstream. Add a flag that indicates that the WEP ICV was stripped from an RX packet, allowing the device to not transfer that if it's already checked. Signed-off-by: David Spinadel <david.spinadel@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: Sriram R <srirrama@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * mac80211: allow same PN for AMSDU sub-framesSara Sharon2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f631a77ba920f7153a1094d09cd8f2ebbffd0328 upstream. Some hardware (iwlwifi an example) de-aggregate AMSDUs and copy the IV as is to the generated MPDUs, so the same PN appears in multiple packets without being a replay attack. Allow driver to explicitly indicate that a frame is allowed to have the same PN as the previous frame. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: Sriram R <srirrama@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * mac80211: allow not sending MIC up from driver for HW cryptoSara Sharon2018-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f980ebc058c2fa2a552e495db1de0b330082ab70 upstream. When HW crypto is used, there's no need for the CCMP/GCMP MIC to be available to mac80211, and the hardware might have removed it already after checking. The MIC is also useless to have when the frame is already decrypted, so allow indicating that it's not present. Since we are running out of bits in mac80211_rx_flags, make the flags field a u64. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: Sriram R <srirrama@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | UPSTREAM: mac80211: ibss: Fix channel type enum in ieee80211_sta_join_ibss()Matthias Kaehlcke2018-05-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cfg80211_chandef_create() expects an 'enum nl80211_channel_type' as channel type however in ieee80211_sta_join_ibss() NL80211_CHAN_WIDTH_20_NOHT is passed in two occasions, which is of the enum type 'nl80211_chan_width'. Change the value to NL80211_CHAN_NO_HT (20 MHz, non-HT channel) of the channel type enum. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> (cherry picked from commit a4ac6f2e53e568a77a2eb3710efd99ca08634c0a) Bug: 78886293 Change-Id: Iab3fc750c2cd8b32cf501b9739445a7b5c83e8cd Signed-off-by: Alistair Strachan <astrachan@google.com>
| * | UPSTREAM: mac80211: Fix clang warning about constant operand in logical ↵Matthias Kaehlcke2018-05-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | operation When clang detects a non-boolean constant in a logical operation it generates a 'constant-logical-operand' warning. In ieee80211_try_rate_control_ops_get() the result of strlen(<const str>) is used in a logical operation, clang resolves the expression to an (integer) constant at compile time when clang's builtin strlen function is used. Change the condition to check for strlen() > 0 to make the constant operand boolean and thus avoid the warning. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> (cherry picked from commit 93f56de259376d7e4fff2b2d104082e1fa66e237) Bug: 78886293 Change-Id: Ia819eb188699c1d81047c0dfa143da52c6cb490c Signed-off-by: Alistair Strachan <astrachan@google.com>
* | | Merge android-4.4.128 (89904cc) into msm-4.4Srinivasarao P2018-04-20
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-89904cc ANDROID: Add build server config for cuttlefish. ANDROID: Add defconfig for cuttlefish. FROMLIST: staging: Android: Add 'vsoc' driver for cuttlefish. Revert "proc: make oom adjustment files user read-only" Revert "fixup! proc: make oom adjustment files user read-only" Linux 4.4.128 Revert "xhci: plat: Register shutdown for xhci_plat" vrf: Fix use after free and double free in vrf_finish_output ipv6: the entire IPv6 header chain must fit the first fragment net/ipv6: Increment OUTxxx counters after netfilter hook net sched actions: fix dumping which requires several messages to user space r8169: fix setting driver_data after register_netdev vti6: better validate user provided tunnel names ip6_tunnel: better validate user provided tunnel names ip6_gre: better validate user provided tunnel names ipv6: sit: better validate user provided tunnel names ip_tunnel: better validate user provided tunnel names net: fool proof dev_valid_name() bonding: process the err returned by dev_set_allmulti properly in bond_enslave bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave bonding: fix the err path for dev hwaddr sync in bond_enslave vlan: also check phy_driver ts_info for vlan's real device vhost: correctly remove wait queue during poll failure sky2: Increase D3 delay to sky2 stops working after suspend sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6 sctp: do not leak kernel memory to user space pptp: remove a buggy dst release in pptp_connect() net/sched: fix NULL dereference in the error path of tcf_bpf_init() netlink: make sure nladdr has correct size in netlink_connect() net/ipv6: Fix route leaking between VRFs net: fix possible out-of-bound read in skb_network_protocol() arp: fix arp_filter on l3slave devices Kbuild: provide a __UNIQUE_ID for clang futex: Remove requirement for lock_page() in get_futex_key() random: use lockless method of accessing and updating f->reg_idx virtio_net: check return value of skb_to_sgvec in one more location virtio_net: check return value of skb_to_sgvec always rxrpc: check return value of skb_to_sgvec always ipsec: check return value of skb_to_sgvec always perf tools: Fix copyfile_offset update of output offset cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages EDAC, mv64x60: Fix an error handling path tty: n_gsm: Allow ADM response in addition to UA for control dlci blk-mq: fix kernel oops in blk_mq_tag_idle() scsi: libsas: initialize sas_phy status according to response of DISCOVER scsi: libsas: fix error when getting phy events scsi: libsas: fix memory leak in sas_smp_get_phy_events() bcache: segregate flash only volume write streams bcache: stop writeback thread after detaching vxlan: dont migrate permanent fdb entries during learn s390/dasd: fix hanging safe offline ACPICA: Disassembler: Abort on an invalid/unknown AML opcode ACPICA: Events: Add runtime stub support for event APIs cpuidle: dt: Add missing 'of_node_put()' Bluetooth: Send HCI Set Event Mask Page 2 command only when needed iio: magnetometer: st_magn_spi: fix spi_device_id table sparc64: ldc abort during vds iso boot sctp: fix recursive locking warning in sctp_do_peeloff bnx2x: Allow vfs to disable txvlan offload xen: avoid type warning in xchg_xen_ulong skbuff: only inherit relevant tx_flags perf tests: Decompress kernel module before objdump net: emac: fix reset timeout with AR8035 phy Fix loop device flush before configure v3 MIPS: kprobes: flush_insn_slot should flush only if probe initialised MIPS: mm: adjust PKMAP location MIPS: mm: fixed mappings: correct initialisation perf/core: Correct event creation with PERF_FORMAT_GROUP e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support mceusb: sporadic RX truncation corruption fix cx25840: fix unchecked return values e1000e: fix race condition around skb_tstamp_tx() tags: honor COMPILED_SOURCE with apart output directory perf report: Ensure the perf DSO mapping matches what libdw sees perf header: Set proper module name when build-id event found net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport net/mlx4: Fix the check in attaching steering rules sit: reload iphdr in ipip6_rcv skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow bio-integrity: Do not allocate integrity context for bio w/o data Fix serial console on SNI RM400 machines cxgb4: fix incorrect cim_la output for T6 drm/omap: fix tiled buffer stride calculations mISDN: Fix a sleep-in-atomic bug qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M perf trace: Add mmap alias for s390 powerpc/spufs: Fix coredump of SPU contexts clk: Fix __set_clk_rates error print-string clk: scpi: fix return type of __scpi_dvfs_round_rate KVM: SVM: do not zero out segment attributes if segment is unusable or not present net: freescale: fix potential null pointer dereference SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() rtc: interface: Validate alarm-time before handling rollover rtc: opal: Handle disabled TPO in opal_get_tpo_time() cxgb4: FW upgrade fixes net/mlx5: avoid build warning for uniprocessor arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage dmaengine: imx-sdma: Handle return value of clk_prepare_enable powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE] ovl: filter trusted xattr for non-admin hdlcdrv: Fix divide by zero in hdlcdrv_ioctl wl1251: check return from call to wl1251_acx_arp_ip_filter ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()' gpio: label descriptors using the device name vfb: fix video mode and line_length being set when loaded scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag. scsi: libiscsi: Allow sd_shutdown on bad transport ASoC: Intel: cht_bsw_rt5645: Analog Mic support media: videobuf2-core: don't go out of the buffer range hwmon: (ina2xx) Make calibration register value fixed rds; Reset rs->rs_bound_addr in rds_add_bound() failure path l2tp: fix missing print session offset info perf probe: Add warning message if there is unexpected event name thermal: power_allocator: fix one race condition issue for thermal_instances list ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node net: llc: add lock_sock in llc_ui_bind to avoid a race condition KVM: nVMX: Fix handling of lmsw instruction bonding: Don't update slave->link until ready to commit Input: elan_i2c - clear INT before resetting controller net: move somaxconn init from sysctl code tcp: better validation of received ack sequences ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() fix race in drivers/char/random.c:get_reg() scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() ASoC: rsnd: SSI PIO adjust to 24bit mode pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize libceph: NULL deref on crush_decode() error path net: ieee802154: fix net_device reference release too early mlx5: fix bug reading rss_hash_type from CQE block: fix an error code in add_partition() selinux: do not check open permission on sockets net/mlx5: Tolerate irq_set_affinity_hint() failures sched/numa: Use down_read_trylock() for the mmap_sem leds: pca955x: Correct I2C Functionality ray_cs: Avoid reading past end of buffer ARM: davinci: da8xx: Create DSP device only when assigned memory md-cluster: fix potential lock issue in add_new_disk ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors iio: hi8435: cleanup reset gpio iio: hi8435: avoid garbage event at first enable xfrm: fix state migration copy replay sequence numbers selftests/powerpc: Fix TM resched DSCR test with some compilers ath5k: fix memory leak on buf on failed eeprom read powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash scsi: csiostor: fix use after free in csio_hw_use_fwconfig() sh_eth: Use platform device for printing before register_netdev() serial: sh-sci: Fix race condition causing garbage during shutdown serial: 8250: omap: Disable DMA for console UART USB: ene_usb6250: fix SCSI residue overwriting net: x25: fix one potential use-after-free issue USB: ene_usb6250: fix first command execution usb: chipidea: properly handle host or gadget initialization failure arp: honour gratuitous ARP _replies_ neighbour: update neigh timestamps iff update is effective ata: libahci: properly propagate return value of platform_get_irq() btrfs: fix incorrect error return ret being passed to mapping_set_error usb: dwc3: keystone: check return value async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() ipv6: avoid dad-failures for addresses with NODAD ARM: dts: imx6qdl-wandboard: Fix audio channel swap x86/tsc: Provide 'tsc=unstable' boot parameter staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin PowerCap: Fix an error code in powercap_register_zone() bus: brcmstb_gisb: correct support for 64-bit address output bus: brcmstb_gisb: Use register offsets with writes too SMB2: Fix share type handling vmxnet3: ensure that adapter is in proper state during force_close KVM: PPC: Book3S PR: Check copy_to/from_user return values Input: elantech - force relative mode on a certain module Input: elan_i2c - check if device is there before really probing netxen_nic: set rcode to the return status from the call to netxen_issue_cmd net: qca_spi: Fix alignment issues in rx path blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op CIFS: silence lockdep splat in cifs_relock_file() NFSv4.1: Work around a Linux server bug... net/mlx4_en: Avoid adding steering rules with invalid ring s390: move _text symbol to address higher than zero pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests lockd: fix lockd shutdown race net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control net: cdc_ncm: Fix TX zero padding ipmi_ssif: unlock on allocation failure qlge: Avoid reading past end of buffer bna: Avoid reading past end of buffer mac80211: bail out from prep_connection() if a reconfig is ongoing af_key: Fix slab-out-of-bounds in pfkey_compile_policy. IB/srpt: Fix abort handling NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() rtc: snvs: fix an incorrect check of return value md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock cfg80211: make RATE_INFO_BW_20 the default ANDROID: proc: add null check in proc_uid_init f2fs/fscrypt: updates to v4.17-rc1 Reduce amount of casting in drivers/tty/goldfish.c. Conflicts: drivers/staging/android/Kconfig drivers/staging/android/Makefile Change-Id: Ic7aa3df76a0312b8d6d84f8a8e11e793311a239a Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.128 into android-4.4Greg Kroah-Hartman2018-04-14
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.128 cfg80211: make RATE_INFO_BW_20 the default md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock rtc: snvs: fix an incorrect check of return value x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION IB/srpt: Fix abort handling af_key: Fix slab-out-of-bounds in pfkey_compile_policy. mac80211: bail out from prep_connection() if a reconfig is ongoing bna: Avoid reading past end of buffer qlge: Avoid reading past end of buffer ipmi_ssif: unlock on allocation failure net: cdc_ncm: Fix TX zero padding net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control lockd: fix lockd shutdown race drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() s390: move _text symbol to address higher than zero net/mlx4_en: Avoid adding steering rules with invalid ring NFSv4.1: Work around a Linux server bug... CIFS: silence lockdep splat in cifs_relock_file() blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op net: qca_spi: Fix alignment issues in rx path netxen_nic: set rcode to the return status from the call to netxen_issue_cmd Input: elan_i2c - check if device is there before really probing Input: elantech - force relative mode on a certain module KVM: PPC: Book3S PR: Check copy_to/from_user return values vmxnet3: ensure that adapter is in proper state during force_close SMB2: Fix share type handling bus: brcmstb_gisb: Use register offsets with writes too bus: brcmstb_gisb: correct support for 64-bit address output PowerCap: Fix an error code in powercap_register_zone() ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning x86/tsc: Provide 'tsc=unstable' boot parameter ARM: dts: imx6qdl-wandboard: Fix audio channel swap ipv6: avoid dad-failures for addresses with NODAD async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() usb: dwc3: keystone: check return value btrfs: fix incorrect error return ret being passed to mapping_set_error ata: libahci: properly propagate return value of platform_get_irq() neighbour: update neigh timestamps iff update is effective arp: honour gratuitous ARP _replies_ usb: chipidea: properly handle host or gadget initialization failure USB: ene_usb6250: fix first command execution net: x25: fix one potential use-after-free issue USB: ene_usb6250: fix SCSI residue overwriting serial: 8250: omap: Disable DMA for console UART serial: sh-sci: Fix race condition causing garbage during shutdown sh_eth: Use platform device for printing before register_netdev() scsi: csiostor: fix use after free in csio_hw_use_fwconfig() powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash ath5k: fix memory leak on buf on failed eeprom read selftests/powerpc: Fix TM resched DSCR test with some compilers xfrm: fix state migration copy replay sequence numbers iio: hi8435: avoid garbage event at first enable iio: hi8435: cleanup reset gpio ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors md-cluster: fix potential lock issue in add_new_disk ARM: davinci: da8xx: Create DSP device only when assigned memory ray_cs: Avoid reading past end of buffer leds: pca955x: Correct I2C Functionality sched/numa: Use down_read_trylock() for the mmap_sem net/mlx5: Tolerate irq_set_affinity_hint() failures selinux: do not check open permission on sockets block: fix an error code in add_partition() mlx5: fix bug reading rss_hash_type from CQE net: ieee802154: fix net_device reference release too early libceph: NULL deref on crush_decode() error path netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() ASoC: rsnd: SSI PIO adjust to 24bit mode scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() fix race in drivers/char/random.c:get_reg() ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() tcp: better validation of received ack sequences net: move somaxconn init from sysctl code Input: elan_i2c - clear INT before resetting controller bonding: Don't update slave->link until ready to commit KVM: nVMX: Fix handling of lmsw instruction net: llc: add lock_sock in llc_ui_bind to avoid a race condition ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node thermal: power_allocator: fix one race condition issue for thermal_instances list perf probe: Add warning message if there is unexpected event name l2tp: fix missing print session offset info rds; Reset rs->rs_bound_addr in rds_add_bound() failure path hwmon: (ina2xx) Make calibration register value fixed media: videobuf2-core: don't go out of the buffer range ASoC: Intel: cht_bsw_rt5645: Analog Mic support scsi: libiscsi: Allow sd_shutdown on bad transport scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag. vfb: fix video mode and line_length being set when loaded gpio: label descriptors using the device name ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()' wl1251: check return from call to wl1251_acx_arp_ip_filter hdlcdrv: Fix divide by zero in hdlcdrv_ioctl ovl: filter trusted xattr for non-admin powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE] dmaengine: imx-sdma: Handle return value of clk_prepare_enable arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage net/mlx5: avoid build warning for uniprocessor cxgb4: FW upgrade fixes rtc: opal: Handle disabled TPO in opal_get_tpo_time() rtc: interface: Validate alarm-time before handling rollover SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() net: freescale: fix potential null pointer dereference KVM: SVM: do not zero out segment attributes if segment is unusable or not present clk: scpi: fix return type of __scpi_dvfs_round_rate clk: Fix __set_clk_rates error print-string powerpc/spufs: Fix coredump of SPU contexts perf trace: Add mmap alias for s390 qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M mISDN: Fix a sleep-in-atomic bug drm/omap: fix tiled buffer stride calculations cxgb4: fix incorrect cim_la output for T6 Fix serial console on SNI RM400 machines bio-integrity: Do not allocate integrity context for bio w/o data skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow sit: reload iphdr in ipip6_rcv net/mlx4: Fix the check in attaching steering rules net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport perf header: Set proper module name when build-id event found perf report: Ensure the perf DSO mapping matches what libdw sees tags: honor COMPILED_SOURCE with apart output directory e1000e: fix race condition around skb_tstamp_tx() cx25840: fix unchecked return values mceusb: sporadic RX truncation corruption fix net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails perf/core: Correct event creation with PERF_FORMAT_GROUP MIPS: mm: fixed mappings: correct initialisation MIPS: mm: adjust PKMAP location MIPS: kprobes: flush_insn_slot should flush only if probe initialised Fix loop device flush before configure v3 net: emac: fix reset timeout with AR8035 phy perf tests: Decompress kernel module before objdump skbuff: only inherit relevant tx_flags xen: avoid type warning in xchg_xen_ulong bnx2x: Allow vfs to disable txvlan offload sctp: fix recursive locking warning in sctp_do_peeloff sparc64: ldc abort during vds iso boot iio: magnetometer: st_magn_spi: fix spi_device_id table Bluetooth: Send HCI Set Event Mask Page 2 command only when needed cpuidle: dt: Add missing 'of_node_put()' ACPICA: Events: Add runtime stub support for event APIs ACPICA: Disassembler: Abort on an invalid/unknown AML opcode s390/dasd: fix hanging safe offline vxlan: dont migrate permanent fdb entries during learn bcache: stop writeback thread after detaching bcache: segregate flash only volume write streams scsi: libsas: fix memory leak in sas_smp_get_phy_events() scsi: libsas: fix error when getting phy events scsi: libsas: initialize sas_phy status according to response of DISCOVER blk-mq: fix kernel oops in blk_mq_tag_idle() tty: n_gsm: Allow ADM response in addition to UA for control dlci EDAC, mv64x60: Fix an error handling path cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages perf tools: Fix copyfile_offset update of output offset ipsec: check return value of skb_to_sgvec always rxrpc: check return value of skb_to_sgvec always virtio_net: check return value of skb_to_sgvec always virtio_net: check return value of skb_to_sgvec in one more location random: use lockless method of accessing and updating f->reg_idx futex: Remove requirement for lock_page() in get_futex_key() Kbuild: provide a __UNIQUE_ID for clang arp: fix arp_filter on l3slave devices net: fix possible out-of-bound read in skb_network_protocol() net/ipv6: Fix route leaking between VRFs netlink: make sure nladdr has correct size in netlink_connect() net/sched: fix NULL dereference in the error path of tcf_bpf_init() pptp: remove a buggy dst release in pptp_connect() sctp: do not leak kernel memory to user space sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6 sky2: Increase D3 delay to sky2 stops working after suspend vhost: correctly remove wait queue during poll failure vlan: also check phy_driver ts_info for vlan's real device bonding: fix the err path for dev hwaddr sync in bond_enslave bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave bonding: process the err returned by dev_set_allmulti properly in bond_enslave net: fool proof dev_valid_name() ip_tunnel: better validate user provided tunnel names ipv6: sit: better validate user provided tunnel names ip6_gre: better validate user provided tunnel names ip6_tunnel: better validate user provided tunnel names vti6: better validate user provided tunnel names r8169: fix setting driver_data after register_netdev net sched actions: fix dumping which requires several messages to user space net/ipv6: Increment OUTxxx counters after netfilter hook ipv6: the entire IPv6 header chain must fit the first fragment vrf: Fix use after free and double free in vrf_finish_output Revert "xhci: plat: Register shutdown for xhci_plat" Linux 4.4.128 Change-Id: I9c1e58f634cc18f15a840c9d192c892dfcc5ff73 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: bail out from prep_connection() if a reconfig is ongoingLuca Coelho2018-04-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit f8860ce836f2d502b07ef99559707fe55d90f5bc ] If ieee80211_hw_restart() is called during authentication, the authentication process will continue, causing the driver to be called in a wrong state. This ultimately causes an oops in the iwlwifi driver (at least). This fixes bugzilla 195299 partly. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195299 Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.127 (d6bbe8b) into msm-4.4Srinivasarao P2018-04-20
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-d6bbe8b Linux 4.4.127 Revert "ip6_vti: adjust vti mtu according to mtu of lower device" net: cavium: liquidio: fix up "Avoid dma_unmap_single on uninitialized ndata" spi: davinci: fix up dma_mapping_error() incorrect patch Revert "mtip32xx: use runtime tag to initialize command header" Revert "cpufreq: Fix governor module removal race" Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin" Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin" Revert "PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()" nospec: Kill array_index_nospec_mask_check() nospec: Move array_index_nospec() parameter checking into separate macro net: hns: Fix ethtool private flags md/raid10: reset the 'first' at the end of loop ARM: dts: am57xx-beagle-x15-common: Add overide powerhold property ARM: dts: dra7: Add power hold and power controller properties to palmas Documentation: pinctrl: palmas: Add ti,palmas-powerhold-override property definition vt: change SGR 21 to follow the standards Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list staging: comedi: ni_mio_common: ack ai fifo error interrupts. fs/proc: Stop trying to report thread stacks crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one crypto: ahash - Fix early termination in hash walk parport_pc: Add support for WCH CH382L PCI-E single parallel port card. media: usbtv: prevent double free in error case mei: remove dev_err message on an unsupported ioctl USB: serial: cp210x: add ELDAT Easywave RX09 id USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator USB: serial: ftdi_sio: add RT Systems VX-8 cable usb: dwc2: Improve gadget state disconnection handling scsi: virtio_scsi: always read VPD pages for multiqueue too llist: clang: introduce member_address_is_nonnull() Bluetooth: Fix missing encryption refresh on Security Request netfilter: x_tables: add and use xt_check_proc_name netfilter: bridge: ebt_among: add more missing match size checks xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms() RDMA/ucma: Introduce safer rdma_addr_size() variants RDMA/ucma: Don't allow join attempts for unsupported AF family RDMA/ucma: Check that device exists prior to accessing it RDMA/ucma: Check that device is connected prior to access it RDMA/ucma: Ensure that CM_ID exists prior to access it RDMA/ucma: Fix use-after-free access in ucma_close RDMA/ucma: Check AF family prior resolving address xfrm_user: uncoditionally validate esn replay attribute struct arm64: avoid overflow in VA_START and PAGE_OFFSET selinux: Remove redundant check for unknown labeling behavior netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch tty: provide tty_name() even without CONFIG_TTY audit: add tty field to LOGIN event frv: declare jiffies to be located in the .data section jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp fs: compat: Remove warning from COMPATIBLE_IOCTL selinux: Remove unnecessary check of array base in selinux_set_mapping() cpumask: Add helper cpumask_available() genirq: Use cpumask_available() for check of cpumask variable netfilter: nf_nat_h323: fix logical-not-parentheses warning Input: mousedev - fix implicit conversion warning dm ioctl: remove double parentheses PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant writeback: fix the wrong congested state variable definition ACPI, PCI, irq: remove redundant check for null string pointer kprobes/x86: Fix to set RWX bits correctly before releasing trampoline usb: gadget: f_hid: fix: Prevent accessing released memory usb: gadget: align buffer size when allocating for OUT endpoint usb: gadget: fix usb_ep_align_maybe endianness and new usb_ep_align usb: gadget: change len to size_t on alloc_ep_req() usb: gadget: define free_ep_req as universal function partitions/msdos: Unable to mount UFS 44bsd partitions perf/hwbp: Simplify the perf-hwbp code, fix documentation ALSA: pcm: potential uninitialized return values ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() mtd: jedec_probe: Fix crash in jedec_read_mfr() Replace #define with enum for better compilation errors. Add missing include to drivers/tty/goldfish.c Fix whitespace in drivers/tty/goldfish.c ANDROID: fuse: Add null terminator to path in canonical path to avoid issue ANDROID: sdcardfs: Fix sdcardfs to stop creating cases-sensitive duplicate entries. ANDROID: add missing include to pdev_bus ANDROID: pdev_bus: replace writel with gf_write_ptr ANDROID: Cleanup type casting in goldfish.h ANDROID: Include missing headers in goldfish.h ANDROID: cpufreq: times: skip printing invalid frequencies ANDROID: xt_qtaguid: Remove unnecessary null checks to device's name ANDROID: xt_qtaguid: Remove unnecessary null checks to ifa_label ANDROID: cpufreq: times: allocate enough space for a uid_entry Linux 4.4.126 net: systemport: Rewrite __bcm_sysport_tx_reclaim() net: fec: Fix unbalanced PM runtime calls ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event() s390/qeth: on channel error, reject further cmd requests s390/qeth: lock read device while queueing next buffer s390/qeth: when thread completes, wake up all waiters s390/qeth: free netdevice when removing a card team: Fix double free in error path skbuff: Fix not waking applications when errors are enqueued net: Only honor ifindex in IP_PKTINFO if non-0 netlink: avoid a double skb free in genlmsg_mcast() net/iucv: Free memory obtained by kzalloc net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred l2tp: do not accept arbitrary sockets ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option() dccp: check sk for closed state in dccp_sendmsg() net: Fix hlist corruptions in inet_evict_bucket() Revert "genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs" scsi: sg: don't return bogus Sg_requests Revert "genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs" UPSTREAM: drm: virtio-gpu: set atomic flag UPSTREAM: drm: virtio-gpu: transfer dumb buffers to host on plane update UPSTREAM: drm: virtio-gpu: ensure plane is flushed to host on atomic update UPSTREAM: drm: virtio-gpu: get the fb from the plane state for atomic updates Linux 4.4.125 bpf, x64: increase number of passes bpf: skip unnecessary capability check kbuild: disable clang's default use of -fmerge-all-constants staging: lustre: ptlrpc: kfree used instead of kvfree perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period() x86/entry/64: Don't use IST entry for #BP stack x86/boot/64: Verify alignment of the LOAD segment x86/build/64: Force the linker to use 2MB page size kvm/x86: fix icebp instruction handling tty: vt: fix up tabstops properly can: cc770: Fix use after free in cc770_tx_interrupt() can: cc770: Fix queue stall & dropped RTR reply can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack staging: ncpfs: memory corruption in ncp_read_kernel() mtd: nand: fsl_ifc: Fix nand waitfunc return value tracing: probeevent: Fix to support minus offset from symbol rtlwifi: rtl8723be: Fix loss of signal brcmfmac: fix P2P_DEVICE ethernet address generation acpi, numa: fix pxm to online numa node associations drm: udl: Properly check framebuffer mmap offsets drm/radeon: Don't turn off DP sink when disconnected drm/vmwgfx: Fix a destoy-while-held mutex problem. x86/mm: implement free pmd/pte page interfaces mm/vmalloc: add interfaces to free unmapped page table libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs libata: Enable queued TRIM for Samsung SSD 860 libata: disable LPM for Crucial BX100 SSD 500GB drive libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs libata: remove WARN() for DMA or PIO command without data libata: fix length validation of ATAPI-relayed SCSI commands Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174 clk: bcm2835: Protect sections updating shared registers ahci: Add PCI-id for the Highpoint Rocketraid 644L card PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs ALSA: hda/realtek - Always immediately update mute LED with pin VREF ALSA: aloop: Fix access to not-yet-ready substream via cable ALSA: aloop: Sync stale timer before release ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit iio: st_pressure: st_accel: pass correct platform data to init MIPS: ralink: Remove ralink_halt() ANDROID: cpufreq: times: fix proc_time_in_state_show dtc: turn off dtc unit address warnings by default Linux 4.4.124 RDMA/ucma: Fix access to non-initialized CM_ID object dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63 clk: si5351: Rename internal plls to avoid name collisions nfsd4: permit layoutget of executable-only files RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS ip6_vti: adjust vti mtu according to mtu of lower device iommu/vt-d: clean up pr_irq if request_threaded_irq fails pinctrl: Really force states during suspend/resume coresight: Fix disabling of CoreSight TPIU pty: cancel pty slave port buf's work in tty_release drm/omap: DMM: Check for DMM readiness after successful transaction commit vgacon: Set VGA struct resource types IB/umem: Fix use of npages/nmap fields RDMA/cma: Use correct size when writing netlink stats IB/ipoib: Avoid memory leak if the SA returns a different DGID mmc: avoid removing non-removable hosts during suspend platform/chrome: Use proper protocol transfer function cros_ec: fix nul-termination for firmware build info media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart media: bt8xx: Fix err 'bt878_probe()' rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled. RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo() drm/msm: fix leak in failed get_pages media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt Bluetooth: hci_qca: Avoid setup failure on missing rampatch perf tests kmod-path: Don't fail if compressed modules aren't supported rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks cifs: small underflow in cnvrtDosUnixTm() net: hns: fix ethtool_get_strings overflow in hns driver sm501fb: don't return zero on failure path in sm501fb_start() video: fbdev: udlfb: Fix buffer on stack tcm_fileio: Prevent information leak for short reads ia64: fix module loading for gcc-5.4 md/raid10: skip spare disk as 'first' disk Input: twl4030-pwrbutton - use correct device for irq request power: supply: pda_power: move from timer to delayed_work bnx2x: Align RX buffers drm/nouveau/kms: Increase max retries in scanout position queries. ACPI / PMIC: xpower: Fix power_table addresses ipmi/watchdog: fix wdog hang on panic waiting for ipmi response ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a staging: wilc1000: fix unchecked return value staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y mtip32xx: use runtime tag to initialize command header mfd: palmas: Reset the POWERHOLD mux during power off mac80211: don't parse encrypted management frames in ieee80211_frame_acked Btrfs: send, fix file hole not being preserved due to inline extent rndis_wlan: add return value validation mt7601u: check return value of alloc_skb iio: st_pressure: st_accel: Initialise sensor platform data properly NFS: don't try to cross a mountpount when there isn't one there. infiniband/uverbs: Fix integer overflows scsi: mac_esp: Replace bogus memory barrier with spinlock qlcnic: fix unchecked return value wan: pc300too: abort path on failure mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() openvswitch: Delete conntrack entry clashing with an expectation. netfilter: xt_CT: fix refcnt leak on error path Fix driver usage of 128B WQEs when WQ_CREATE is V1. ASoC: Intel: Skylake: Uninitialized variable in probe_codec() IB/mlx4: Change vma from shared to private IB/mlx4: Take write semaphore when changing the vma struct HSI: ssi_protocol: double free in ssip_pn_xmit() IB/ipoib: Update broadcast object if PKey value was changed in index 0 IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow ALSA: hda - Fix headset microphone detection for ASUS N551 and N751 e1000e: fix timing for 82579 Gigabit Ethernet controller tcp: remove poll() flakes with FastOpen NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete() md/raid10: wait up frozen array in handle_write_completed iommu/omap: Register driver before setting IOMMU ops ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER KVM: PPC: Book3S PR: Exit KVM on failed mapping scsi: virtio_scsi: Always try to read VPD pages clk: ns2: Correct SDIO bits ath: Fix updating radar flags for coutry code India spi: dw: Disable clock after unregistering the host media/dvb-core: Race condition when writing to CAM net: ipv6: send unsolicited NA on admin up i2c: i2c-scmi: add a MS HID genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs cpufreq/sh: Replace racy task affinity logic ACPI/processor: Replace racy task affinity logic ACPI/processor: Fix error handling in __acpi_processor_start() time: Change posix clocks ops interfaces to use timespec64 Input: ar1021_i2c - fix too long name in driver's device table rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs x86: i8259: export legacy_pic symbol regulator: anatop: set default voltage selector for pcie platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA staging: android: ashmem: Fix possible deadlock in ashmem_ioctl CIFS: Enable encryption during session setup phase SMB3: Validate negotiate request must always be signed tpm_tis: fix potential buffer overruns caused by bit glitches on the bus tpm: fix potential buffer overruns caused by bit glitches on the bus BACKPORT, FROMLIST: crypto: arm64/speck - add NEON-accelerated implementation of Speck-XTS Linux 4.4.123 bpf: fix incorrect sign extension in check_alu_op() usb: gadget: bdc: 64-bit pointer capability check USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device btrfs: alloc_chunk: fix DUP stripe size handling ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux scsi: sg: only check for dxfer_len greater than 256M scsi: sg: fix static checker warning in sg_is_valid_dxfer scsi: sg: fix SG_DXFER_FROM_DEV transfers irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis fs/aio: Use RCU accessors for kioctx_table->table[] fs/aio: Add explicit RCU grace period when freeing kioctx lock_parent() needs to recheck if dentry got __dentry_kill'ed under it fs: Teach path_connected to handle nfs filesystems with multiple roots. drm/amdgpu/dce: Don't turn off DP sink when disconnected ALSA: seq: Clear client entry before deleting else at closing ALSA: seq: Fix possible UAF in snd_seq_check_queue() ALSA: hda - Revert power_save option default value ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() x86/mm: Fix vmalloc_fault to use pXd_large x86/vm86/32: Fix POPF emulation selftests/x86/entry_from_vm86: Add test cases for POPF selftests/x86: Add tests for the STR and SLDT instructions selftests/x86: Add tests for User-Mode Instruction Prevention selftests/x86/entry_from_vm86: Exit with 1 if we fail ima: relax requiring a file signature for new files with zero length rcutorture/configinit: Fix build directory error message ipvlan: add L2 check for packets arriving via virtual devices ASoC: nuc900: Fix a loop timeout test mac80211: remove BUG() when interface type is invalid mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED agp/intel: Flush all chipset writes after updating the GGTT drm/amdkfd: Fix memory leaks in kfd topology veth: set peer GSO values media: cpia2: Fix a couple off by one bugs scsi: dh: add new rdac devices scsi: devinfo: apply to HP XP the same flags as Hitachi VSP scsi: core: scsi_get_device_flags_keyed(): Always return device flags spi: sun6i: disable/unprepare clocks on remove tools/usbip: fixes build with musl libc toolchain ath10k: fix invalid STS_CAP_OFFSET_MASK clk: qcom: msm8916: fix mnd_width for codec_digcodec cpufreq: Fix governor module removal race ath10k: update tdls teardown state to target ARM: dts: omap3-n900: Fix the audio CODEC's reset pin ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() net: xfrm: allow clearing socket xfrm policies. test_firmware: fix setting old custom fw path back on exit sched: Stop resched_cpu() from sending IPIs to offline CPUs sched: Stop switched_to_rt() from sending IPIs to offline CPUs ARM: dts: exynos: Correct Trats2 panel reset line HID: elo: clear BTN_LEFT mapping video/hdmi: Allow "empty" HDMI infoframes drm/edid: set ELD connector type in drm_edid_to_eld() wil6210: fix memory access violation in wil_memcpy_from/toio_32 pwm: tegra: Increase precision in PWM rate calculation kprobes/x86: Set kprobes pages read-only kprobes/x86: Fix kprobe-booster not to boost far call instructions scsi: sg: close race condition in sg_remove_sfp_usercontext() scsi: sg: check for valid direction before starting the request perf session: Don't rely on evlist in pipe mode perf inject: Copy events when reordering events in pipe mode drivers/perf: arm_pmu: handle no platform_device usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control() usb: dwc2: Make sure we disconnect the gadget state md/raid6: Fix anomily when recovering a single device in RAID6. regulator: isl9305: fix array size MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification MIPS: BPF: Fix multiple problems in JIT skb access helpers. MIPS: BPF: Quit clobbering callee saved registers in JIT code. coresight: Fixes coresight DT parse to get correct output port ID. drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) drm/radeon: Fail fb creation from imported dma-bufs. video: ARM CLCD: fix dma allocation size iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range apparmor: Make path_max parameter readonly scsi: ses: don't get power status of SES device slot on probe fm10k: correctly check if interface is removed ALSA: firewire-digi00x: handle all MIDI messages on streaming packets reiserfs: Make cancel_old_flush() reliable ARM: dts: koelsch: Correct clock frequency of X2 DU clock input net/faraday: Add missing include of of.h powerpc: Avoid taking a data miss on every userspace instruction miss ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks NFC: nfcmrvl: double free on error path NFC: nfcmrvl: Include unaligned.h instead of access_ok.h vxlan: vxlan dev should inherit lowerdev's gso_max_size drm/vmwgfx: Fixes to vmwgfx_fb braille-console: Fix value returned by _braille_console_setup bonding: refine bond_fold_stats() wrap detection f2fs: relax node version check for victim data in gc blk-throttle: make sure expire time isn't too big mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() driver: (adm1275) set the m,b and R coefficients correctly for power dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped tcp: sysctl: Fix a race to avoid unexpected 0 window from space spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT sched: act_csum: don't mangle TCP and UDP GSO packets Input: qt1070 - add OF device ID table sysrq: Reset the watchdog timers while displaying high-resolution timers timers, sched_clock: Update timeout for clock wrap media: i2c/soc_camera: fix ov6650 sensor getting wrong clock scsi: ipr: Fix missed EH wakeup solo6x10: release vb2 buffers in solo_stop_streaming() of: fix of_device_get_modalias returned length when truncating buffers batman-adv: handle race condition for claims between gateways ARM: dts: Adjust moxart IRQ controller and flags net/8021q: create device with all possible features in wanted_features HID: clamp input to logical range if no null state perf probe: Return errno when not hitting any event ath10k: disallow DFS simulation if DFS channel is not enabled drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off) drivers: net: xgene: Fix hardware checksum setting perf tools: Make perf_event__synthesize_mmap_events() scale i40e: fix ethtool to get EEPROM data from X722 interface i40e: Acquire NVM lock before reads on all devices perf sort: Fix segfault with basic block 'cycles' sort dimension selinux: check for address length in selinux_socket_bind() PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() ath10k: fix a warning during channel switch with multiple vaps drm: qxl: Don't alloc fbdev if emulation is not supported HID: reject input outside logical range only if null state is set staging: wilc1000: add check for kmalloc allocation failure. staging: speakup: Replace BUG_ON() with WARN_ON(). Input: tsc2007 - check for presence and power down tsc2007 during probe blkcg: fix double free of new_blkg in blkcg_init_queue ANDROID: cpufreq: times: avoid prematurely freeing uid_entry ANDROID: Use standard logging functions in goldfish_pipe ANDROID: Fix whitespace in goldfish staging: android: ashmem: Fix possible deadlock in ashmem_ioctl llist: clang: introduce member_address_is_nonnull() Linux 4.4.122 fixup: sctp: verify size of a new chunk in _sctp_make_chunk() serial: 8250_pci: Add Brainboxes UC-260 4 port serial device usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() usb: usbmon: Read text within supplied buffer size USB: usbmon: remove assignment from IS_ERR argument usb: quirks: add control message delay for 1b1c:1b20 USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h staging: android: ashmem: Fix lockdep issue during llseek staging: comedi: fix comedi_nsamples_left. uas: fix comparison for error code tty/serial: atmel: add new version check for usart serial: sh-sci: prevent lockup on full TTY buffers x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 x86/module: Detect and skip invalid relocations Revert "ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux" NFS: Fix an incorrect type in struct nfs_direct_req scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport ubi: Fix race condition between ubi volume creation and udev ext4: inplace xattr block update fails to deduplicate blocks netfilter: x_tables: pack percpu counter allocations netfilter: x_tables: pass xt_counters struct to counter allocator netfilter: x_tables: pass xt_counters struct instead of packet counter netfilter: use skb_to_full_sk in ip_route_me_harder netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt netfilter: bridge: ebt_among: add missing match size checks netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets netfilter: IDLETIMER: be syzkaller friendly netfilter: nat: cope with negative port range netfilter: x_tables: fix missing timer initialization in xt_LED netfilter: add back stackpointer size checks tc358743: fix register i2c_rd/wr function fix Input: tca8418_keypad - remove double read of key event register ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds netfilter: nfnetlink_queue: fix timestamp attribute watchdog: hpwdt: fix unused variable warning watchdog: hpwdt: Check source of NMI watchdog: hpwdt: SMBIOS check nospec: Include <asm/barrier.h> dependency ALSA: hda: add dock and led support for HP ProBook 640 G2 ALSA: hda: add dock and led support for HP EliteBook 820 G3 ALSA: seq: More protection for concurrent write and ioctl races ALSA: seq: Don't allow resizing pool in use ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 x86/MCE: Serialize sysfs changes bcache: don't attach backing with duplicate UUID kbuild: Handle builtin dtb file names containing hyphens loop: Fix lost writes caused by missing flag Input: matrix_keypad - fix race when disabling interrupts MIPS: OCTEON: irq: Check for null return on kzalloc allocation MIPS: ath25: Check for kzalloc allocation failure MIPS: BMIPS: Do not mask IPIs during suspend drm/amdgpu: fix KV harvesting drm/radeon: fix KV harvesting drm/amdgpu: Notify sbios device ready before send request drm/amdgpu: Fix deadlock on runtime suspend drm/radeon: Fix deadlock on runtime suspend drm/nouveau: Fix deadlock on runtime suspend drm: Allow determining if current task is output poll worker workqueue: Allow retrieval of current task's work struct scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS RDMA/mlx5: Fix integer overflow while resizing CQ RDMA/ucma: Check that user doesn't overflow QP state RDMA/ucma: Limit possible option size ANDROID: ranchu: 32 bit framebuffer support ANDROID: Address checkpatch warnings in goldfishfb ANDROID: Address checkpatch.pl warnings in goldfish_pipe ANDROID: sdcardfs: fix lock issue on 32 bit/SMP architectures ANDROID: goldfish: Fix typo in goldfish_cmd_locked() call ANDROID: Address checkpatch.pl warnings in goldfish_pipe_v2 FROMLIST: f2fs: don't put dentry page in pagecache into highmem Linux 4.4.121 btrfs: preserve i_mode if __btrfs_set_acl() fails bpf, x64: implement retpoline for tail call dm io: fix duplicate bio completion due to missing ref count mpls, nospec: Sanitize array index in mpls_label_ok() net: mpls: Pull common label check into helper sctp: verify size of a new chunk in _sctp_make_chunk() s390/qeth: fix IPA command submission race s390/qeth: fix SETIP command handling sctp: fix dst refcnt leak in sctp_v6_get_dst() sctp: fix dst refcnt leak in sctp_v4_get_dst udplite: fix partial checksum initialization ppp: prevent unregistered channels from connecting to PPP units netlink: ensure to loop over all netns in genlmsg_multicast_allns() net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68 net: fix race on decreasing number of TX queues ipv6 sit: work around bogus gcc-8 -Wrestrict warning hdlc_ppp: carrier detect ok, don't turn off negotiation fib_semantics: Don't match route with mismatching tclassid bridge: check brport attr show in brport_show Revert "led: core: Fix brightness setting when setting delay_off=0" x86/spectre: Fix an error message leds: do not overflow sysfs buffer in led_trigger_show x86/apic/vector: Handle legacy irq data correctly ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux btrfs: Don't clear SGID when inheriting ACLs x86/syscall: Sanitize syscall table de-references under speculation fix KVM: mmu: Fix overlap between public and private memslots ARM: mvebu: Fix broken PL310_ERRATA_753970 selects nospec: Allow index argument to have const-qualified type media: m88ds3103: don't call a non-initalized function cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() ALSA: hda: Add a power_save blacklist ALSA: usb-audio: Add a quirck for B&W PX headphones tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus ANDROID: Delete the goldfish_nand driver. ANDROID: Add input support for Android Wear. ANDROID: proc: fix config & includes for /proc/uid FROMLIST: ARM: amba: Don't read past the end of sysfs "driver_override" buffer UPSTREAM: ANDROID: binder: remove WARN() for redundant txn error ANDROID: cpufreq: times: Add missing includes ANDROID: cpufreq: Add time_in_state to /proc/uid directories ANDROID: proc: Add /proc/uid directory ANDROID: cpufreq: times: track per-uid time in state ANDROID: cpufreq: track per-task time in state Conflicts: drivers/gpu/drm/msm/msm_gem.c drivers/net/wireless/ath/regd.c kernel/sched/core.c Change-Id: I9bb7b5a062415da6925a5a56a34e6eb066a53320 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.124 into android-4.4Greg Kroah-Hartman2018-03-25
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.124 tpm: fix potential buffer overruns caused by bit glitches on the bus tpm_tis: fix potential buffer overruns caused by bit glitches on the bus SMB3: Validate negotiate request must always be signed CIFS: Enable encryption during session setup phase staging: android: ashmem: Fix possible deadlock in ashmem_ioctl platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA regulator: anatop: set default voltage selector for pcie x86: i8259: export legacy_pic symbol rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs Input: ar1021_i2c - fix too long name in driver's device table time: Change posix clocks ops interfaces to use timespec64 ACPI/processor: Fix error handling in __acpi_processor_start() ACPI/processor: Replace racy task affinity logic cpufreq/sh: Replace racy task affinity logic genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs i2c: i2c-scmi: add a MS HID net: ipv6: send unsolicited NA on admin up media/dvb-core: Race condition when writing to CAM spi: dw: Disable clock after unregistering the host ath: Fix updating radar flags for coutry code India clk: ns2: Correct SDIO bits scsi: virtio_scsi: Always try to read VPD pages KVM: PPC: Book3S PR: Exit KVM on failed mapping ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER iommu/omap: Register driver before setting IOMMU ops md/raid10: wait up frozen array in handle_write_completed NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete() tcp: remove poll() flakes with FastOpen e1000e: fix timing for 82579 Gigabit Ethernet controller ALSA: hda - Fix headset microphone detection for ASUS N551 and N751 IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow IB/ipoib: Update broadcast object if PKey value was changed in index 0 HSI: ssi_protocol: double free in ssip_pn_xmit() IB/mlx4: Take write semaphore when changing the vma struct IB/mlx4: Change vma from shared to private ASoC: Intel: Skylake: Uninitialized variable in probe_codec() Fix driver usage of 128B WQEs when WQ_CREATE is V1. netfilter: xt_CT: fix refcnt leak on error path openvswitch: Delete conntrack entry clashing with an expectation. mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() wan: pc300too: abort path on failure qlcnic: fix unchecked return value scsi: mac_esp: Replace bogus memory barrier with spinlock infiniband/uverbs: Fix integer overflows NFS: don't try to cross a mountpount when there isn't one there. iio: st_pressure: st_accel: Initialise sensor platform data properly mt7601u: check return value of alloc_skb rndis_wlan: add return value validation Btrfs: send, fix file hole not being preserved due to inline extent mac80211: don't parse encrypted management frames in ieee80211_frame_acked mfd: palmas: Reset the POWERHOLD mux during power off mtip32xx: use runtime tag to initialize command header staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y staging: wilc1000: fix unchecked return value mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP ipmi/watchdog: fix wdog hang on panic waiting for ipmi response ACPI / PMIC: xpower: Fix power_table addresses drm/nouveau/kms: Increase max retries in scanout position queries. bnx2x: Align RX buffers power: supply: pda_power: move from timer to delayed_work Input: twl4030-pwrbutton - use correct device for irq request md/raid10: skip spare disk as 'first' disk ia64: fix module loading for gcc-5.4 tcm_fileio: Prevent information leak for short reads video: fbdev: udlfb: Fix buffer on stack sm501fb: don't return zero on failure path in sm501fb_start() net: hns: fix ethtool_get_strings overflow in hns driver cifs: small underflow in cnvrtDosUnixTm() rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL perf tests kmod-path: Don't fail if compressed modules aren't supported Bluetooth: hci_qca: Avoid setup failure on missing rampatch media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt drm/msm: fix leak in failed get_pages RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo() rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled. media: bt8xx: Fix err 'bt878_probe()' media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart cros_ec: fix nul-termination for firmware build info platform/chrome: Use proper protocol transfer function mmc: avoid removing non-removable hosts during suspend IB/ipoib: Avoid memory leak if the SA returns a different DGID RDMA/cma: Use correct size when writing netlink stats IB/umem: Fix use of npages/nmap fields vgacon: Set VGA struct resource types drm/omap: DMM: Check for DMM readiness after successful transaction commit pty: cancel pty slave port buf's work in tty_release coresight: Fix disabling of CoreSight TPIU pinctrl: Really force states during suspend/resume iommu/vt-d: clean up pr_irq if request_threaded_irq fails ip6_vti: adjust vti mtu according to mtu of lower device RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS nfsd4: permit layoutget of executable-only files clk: si5351: Rename internal plls to avoid name collisions dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63 RDMA/ucma: Fix access to non-initialized CM_ID object Linux 4.4.124 Change-Id: Iac6f5bda7941f032c5b1f58750e084140b0e3f23 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: don't parse encrypted management frames in ieee80211_frame_ackedEmmanuel Grumbach2018-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit cf147085fdda044622973a12e4e06f1c753ab677 ] ieee80211_frame_acked is called when a frame is acked by the peer. In case this is a management frame, we check if this an SMPS frame, in which case we can update our antenna configuration. When we parse the management frame we look at the category in case it is an action frame. That byte sits after the IV in case the frame was encrypted. This means that if the frame was encrypted, we basically look at the IV instead of looking at the category. It is then theorically possible that we think that an SMPS action frame was acked where really we had another frame that was encrypted. Since the only management frame whose ack needs to be tracked is the SMPS action frame, and that frame is not a robust management frame, it will never be encrypted. The easiest way to fix this problem is then to not look at frames that were encrypted. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | Merge 4.4.123 into android-4.4Greg Kroah-Hartman2018-03-22
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.123 blkcg: fix double free of new_blkg in blkcg_init_queue Input: tsc2007 - check for presence and power down tsc2007 during probe staging: speakup: Replace BUG_ON() with WARN_ON(). staging: wilc1000: add check for kmalloc allocation failure. HID: reject input outside logical range only if null state is set drm: qxl: Don't alloc fbdev if emulation is not supported ath10k: fix a warning during channel switch with multiple vaps PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() selinux: check for address length in selinux_socket_bind() perf sort: Fix segfault with basic block 'cycles' sort dimension i40e: Acquire NVM lock before reads on all devices i40e: fix ethtool to get EEPROM data from X722 interface perf tools: Make perf_event__synthesize_mmap_events() scale drivers: net: xgene: Fix hardware checksum setting drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off) ath10k: disallow DFS simulation if DFS channel is not enabled perf probe: Return errno when not hitting any event HID: clamp input to logical range if no null state net/8021q: create device with all possible features in wanted_features ARM: dts: Adjust moxart IRQ controller and flags batman-adv: handle race condition for claims between gateways of: fix of_device_get_modalias returned length when truncating buffers solo6x10: release vb2 buffers in solo_stop_streaming() scsi: ipr: Fix missed EH wakeup media: i2c/soc_camera: fix ov6650 sensor getting wrong clock timers, sched_clock: Update timeout for clock wrap sysrq: Reset the watchdog timers while displaying high-resolution timers Input: qt1070 - add OF device ID table sched: act_csum: don't mangle TCP and UDP GSO packets ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer tcp: sysctl: Fix a race to avoid unexpected 0 window from space dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped driver: (adm1275) set the m,b and R coefficients correctly for power mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() blk-throttle: make sure expire time isn't too big f2fs: relax node version check for victim data in gc bonding: refine bond_fold_stats() wrap detection braille-console: Fix value returned by _braille_console_setup drm/vmwgfx: Fixes to vmwgfx_fb vxlan: vxlan dev should inherit lowerdev's gso_max_size NFC: nfcmrvl: Include unaligned.h instead of access_ok.h NFC: nfcmrvl: double free on error path ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks powerpc: Avoid taking a data miss on every userspace instruction miss net/faraday: Add missing include of of.h ARM: dts: koelsch: Correct clock frequency of X2 DU clock input reiserfs: Make cancel_old_flush() reliable ALSA: firewire-digi00x: handle all MIDI messages on streaming packets fm10k: correctly check if interface is removed scsi: ses: don't get power status of SES device slot on probe apparmor: Make path_max parameter readonly iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range video: ARM CLCD: fix dma allocation size drm/radeon: Fail fb creation from imported dma-bufs. drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) coresight: Fixes coresight DT parse to get correct output port ID. MIPS: BPF: Quit clobbering callee saved registers in JIT code. MIPS: BPF: Fix multiple problems in JIT skb access helpers. MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters regulator: isl9305: fix array size md/raid6: Fix anomily when recovering a single device in RAID6. usb: dwc2: Make sure we disconnect the gadget state usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control() drivers/perf: arm_pmu: handle no platform_device perf inject: Copy events when reordering events in pipe mode perf session: Don't rely on evlist in pipe mode scsi: sg: check for valid direction before starting the request scsi: sg: close race condition in sg_remove_sfp_usercontext() kprobes/x86: Fix kprobe-booster not to boost far call instructions kprobes/x86: Set kprobes pages read-only pwm: tegra: Increase precision in PWM rate calculation wil6210: fix memory access violation in wil_memcpy_from/toio_32 drm/edid: set ELD connector type in drm_edid_to_eld() video/hdmi: Allow "empty" HDMI infoframes HID: elo: clear BTN_LEFT mapping ARM: dts: exynos: Correct Trats2 panel reset line sched: Stop switched_to_rt() from sending IPIs to offline CPUs sched: Stop resched_cpu() from sending IPIs to offline CPUs test_firmware: fix setting old custom fw path back on exit net: xfrm: allow clearing socket xfrm policies. mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin ARM: dts: omap3-n900: Fix the audio CODEC's reset pin ath10k: update tdls teardown state to target cpufreq: Fix governor module removal race clk: qcom: msm8916: fix mnd_width for codec_digcodec ath10k: fix invalid STS_CAP_OFFSET_MASK tools/usbip: fixes build with musl libc toolchain spi: sun6i: disable/unprepare clocks on remove scsi: core: scsi_get_device_flags_keyed(): Always return device flags scsi: devinfo: apply to HP XP the same flags as Hitachi VSP scsi: dh: add new rdac devices media: cpia2: Fix a couple off by one bugs veth: set peer GSO values drm/amdkfd: Fix memory leaks in kfd topology agp/intel: Flush all chipset writes after updating the GGTT mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED mac80211: remove BUG() when interface type is invalid ASoC: nuc900: Fix a loop timeout test ipvlan: add L2 check for packets arriving via virtual devices rcutorture/configinit: Fix build directory error message ima: relax requiring a file signature for new files with zero length selftests/x86/entry_from_vm86: Exit with 1 if we fail selftests/x86: Add tests for User-Mode Instruction Prevention selftests/x86: Add tests for the STR and SLDT instructions selftests/x86/entry_from_vm86: Add test cases for POPF x86/vm86/32: Fix POPF emulation x86/mm: Fix vmalloc_fault to use pXd_large ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() ALSA: hda - Revert power_save option default value ALSA: seq: Fix possible UAF in snd_seq_check_queue() ALSA: seq: Clear client entry before deleting else at closing drm/amdgpu/dce: Don't turn off DP sink when disconnected fs: Teach path_connected to handle nfs filesystems with multiple roots. lock_parent() needs to recheck if dentry got __dentry_kill'ed under it fs/aio: Add explicit RCU grace period when freeing kioctx fs/aio: Use RCU accessors for kioctx_table->table[] irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis scsi: sg: fix SG_DXFER_FROM_DEV transfers scsi: sg: fix static checker warning in sg_is_valid_dxfer scsi: sg: only check for dxfer_len greater than 256M ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux btrfs: alloc_chunk: fix DUP stripe size handling btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() usb: gadget: bdc: 64-bit pointer capability check bpf: fix incorrect sign extension in check_alu_op() Linux 4.4.123 Change-Id: Ieb89411248f93522dde29edb8581f8ece22e33a7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: remove BUG() when interface type is invalidLuca Coelho2018-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit c7976f5272486e4ff406014c4b43e2fa3b70b052 ] In the ieee80211_setup_sdata() we check if the interface type is valid and, if not, call BUG(). This should never happen, but if there is something wrong with the code, it will not be caught until the bug happens when an interface is being set up. Calling BUG() is too extreme for this and a WARN_ON() would be better used instead. Change that. Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.120 (d63fdf6) into msm-4.4Srinivasarao P2018-03-08
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-d63fdf6 Linux 4.4.120 MIPS: Implement __multi3 for GCC7 MIPS64r6 builds net: gianfar_ptp: move set_fipers() to spinlock protecting area sctp: make use of pre-calculated len xen/gntdev: Fix partial gntdev_mmap() cleanup xen/gntdev: Fix off-by-one error when unmapping with holes SolutionEngine771x: fix Ether platform data mdio-sun4i: Fix a memory leak xen-netfront: enable device after manual module load bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine. can: flex_can: Correct the checking for frame length in flexcan_start_xmit() mac80211: mesh: drop frames appearing to be from us drm/ttm: check the return value of kzalloc e1000: fix disabling already-disabled warning xfs: quota: check result of register_shrinker() xfs: quota: fix missed destroy of qi_tree_lock IB/ipoib: Fix race condition in neigh creation IB/mlx4: Fix mlx4_ib_alloc_mr error flow s390/dasd: fix wrongly assigned configuration data led: core: Fix brightness setting when setting delay_off=0 bnx2x: Improve reliability in case of nested PCI errors tg3: Enable PHY reset in MTU change path for 5720 tg3: Add workaround to restrict 5762 MRRS to 2048 lib/mpi: Fix umul_ppmm() for MIPS64r6 ARM: dts: ls1021a: fix incorrect clock references scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error net: arc_emac: fix arc_emac_rx() error paths spi: atmel: fixed spin_lock usage inside atmel_spi_remove drm/nouveau/pci: do a msi rearm on init sget(): handle failures of register_shrinker() ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch ipv6: icmp6: Allow icmp messages to be looped back mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM f2fs: fix a bug caused by NULL extent tree hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers) ANDROID: keychord: Check for write data size Revert "binder: add missing binder_unlock()" Linux 4.4.119 binder: add missing binder_unlock() drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path usb: gadget: f_fs: Process all descriptors during bind usb: ldusb: add PIDs for new CASSY devices supported by this driver usb: dwc3: gadget: Set maxpacket size for ep0 IN drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA Add delay-init quirk for Corsair K70 RGB keyboards arm64: Disable unhandled signal log messages by default usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() iio: adis_lib: Initialize trigger before requesting interrupt iio: buffer: check if a buffer has been set up when poll is called cfg80211: fix cfg80211_beacon_dup scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info ip_tunnel: fix preempt warning in ip tunnel creation/updating ip_tunnel: replace dst_cache with generic implementation PCI: keystone: Fix interrupt-controller-node lookup powerpc/64s: Fix RFI flush dependency on HARDLOCKUP_DETECTOR netfilter: drop outermost socket lock in getsockopt() ANDROID: sdcardfs: Set num in extension_details during make_item Conflicts: drivers/usb/gadget/function/f_fs.c Change-Id: I594b9686fd64d4b62ebef4452d4f1ccca4f5a77b Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.120 into android-4.4Greg Kroah-Hartman2018-03-06
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.120 hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers) f2fs: fix a bug caused by NULL extent tree mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM ipv6: icmp6: Allow icmp messages to be looped back ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch sget(): handle failures of register_shrinker() drm/nouveau/pci: do a msi rearm on init spi: atmel: fixed spin_lock usage inside atmel_spi_remove net: arc_emac: fix arc_emac_rx() error paths scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error ARM: dts: ls1021a: fix incorrect clock references lib/mpi: Fix umul_ppmm() for MIPS64r6 tg3: Add workaround to restrict 5762 MRRS to 2048 tg3: Enable PHY reset in MTU change path for 5720 bnx2x: Improve reliability in case of nested PCI errors led: core: Fix brightness setting when setting delay_off=0 s390/dasd: fix wrongly assigned configuration data IB/mlx4: Fix mlx4_ib_alloc_mr error flow IB/ipoib: Fix race condition in neigh creation xfs: quota: fix missed destroy of qi_tree_lock xfs: quota: check result of register_shrinker() e1000: fix disabling already-disabled warning drm/ttm: check the return value of kzalloc mac80211: mesh: drop frames appearing to be from us can: flex_can: Correct the checking for frame length in flexcan_start_xmit() bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine. xen-netfront: enable device after manual module load mdio-sun4i: Fix a memory leak SolutionEngine771x: fix Ether platform data xen/gntdev: Fix off-by-one error when unmapping with holes xen/gntdev: Fix partial gntdev_mmap() cleanup sctp: make use of pre-calculated len net: gianfar_ptp: move set_fipers() to spinlock protecting area MIPS: Implement __multi3 for GCC7 MIPS64r6 builds Linux 4.4.120 Change-Id: Ie363d2e798f7bbe76e728c995e605af94667dfe5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: mesh: drop frames appearing to be from usJohannes Berg2018-03-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 736a80bbfda709fb3631f5f62056f250a38e5804 ] If there are multiple mesh stations with the same MAC address, they will both get confused and start throwing warnings. Obviously in this case nothing can actually work anyway, so just drop frames that look like they're from ourselves early on. Reported-by: Gui Iribarren <gui@altermundi.net> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | Merge 4.4.119 into android-4.4Greg Kroah-Hartman2018-02-28
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.119 netfilter: drop outermost socket lock in getsockopt() powerpc/64s: Fix RFI flush dependency on HARDLOCKUP_DETECTOR PCI: keystone: Fix interrupt-controller-node lookup ip_tunnel: replace dst_cache with generic implementation ip_tunnel: fix preempt warning in ip tunnel creation/updating scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info cfg80211: fix cfg80211_beacon_dup iio: buffer: check if a buffer has been set up when poll is called iio: adis_lib: Initialize trigger before requesting interrupt x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() arm64: Disable unhandled signal log messages by default Add delay-init quirk for Corsair K70 RGB keyboards drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA usb: dwc3: gadget: Set maxpacket size for ep0 IN usb: ldusb: add PIDs for new CASSY devices supported by this driver usb: gadget: f_fs: Process all descriptors during bind usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) binder: add missing binder_unlock() Linux 4.4.119 Change-Id: Ie2b40ffed3554beef8db7b0e41d2a17d12f1a12c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * cfg80211: fix cfg80211_beacon_dupArnd Bergmann2018-02-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit bee92d06157fc39d5d7836a061c7d41289a55797 upstream. gcc-8 warns about some obviously incorrect code: net/mac80211/cfg.c: In function 'cfg80211_beacon_dup': net/mac80211/cfg.c:2896:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict] From the context, I conclude that we want to copy from beacon into new_beacon, as we do in the rest of the function. Cc: stable@vger.kernel.org Fixes: 73da7d5bab79 ("mac80211: add channel switch command and beacon callbacks") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.115 (aa856bd) into msm-4.4Srinivasarao P2018-02-05
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-aa856bd Linux 4.4.115 spi: imx: do not access registers while clocks disabled serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS selinux: general protection fault in sock_has_perm usb: uas: unconditionally bring back host after reset usb: f_fs: Prevent gadget unbind if it is already unbound USB: serial: simple: add Motorola Tetra driver usbip: list: don't list devices attached to vhci_hcd usbip: prevent bind loops on devices attached to vhci_hcd USB: serial: io_edgeport: fix possible sleep-in-atomic CDC-ACM: apply quirk for card reader USB: cdc-acm: Do not log urb submission errors on disconnect USB: serial: pl2303: new device id for Chilitag usb: option: Add support for FS040U modem staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID usb: gadget: don't dereference g until after it has been null checked media: usbtv: add a new usbid scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path xfs: ubsan fixes drm/omap: Fix error handling path in 'omap_dmm_probe()' kmemleak: add scheduling point to kmemleak_scan() SUNRPC: Allow connect to return EHOSTUNREACH quota: Check for register_shrinker() failure. net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit hwmon: (pmbus) Use 64bit math for DIRECT format values lockd: fix "list_add double add" caused by legacy signal interface nfsd: check for use of the closed special stateid grace: replace BUG_ON by WARN_ONCE in exit_net hook nfsd: Ensure we check stateid validity in the seqid operation checks nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0) xen-netfront: remove warning when unloading module KVM: VMX: Fix rflags cache during vCPU reset btrfs: fix deadlock when writing out space cache mac80211: fix the update of path metric for RANN frame openvswitch: fix the incorrect flow action alloc size drm/amdkfd: Fix SDMA oversubsription handling drm/amdkfd: Fix SDMA ring buffer size calculation drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode bcache: check return value of register_shrinker cpufreq: Add Loongson machine dependencies ACPI / bus: Leave modalias empty for devices which are not present KVM: x86: ioapic: Preserve read-only values in the redirection table KVM: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race KVM: X86: Fix operand/address-size during instruction decoding KVM: x86: Don't re-execute instruction when not passing CR2 value KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure igb: Free IRQs when device is hotplugged mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE crypto: af_alg - whitelist mask and type crypto: aesni - handle zero length dst buffer ALSA: seq: Make ioctls race-free kaiser: fix intel_bts perf crashes x86/pti: Make unpoison of pgd for trusted boot work for real bpf: reject stores into ctx via st and xadd bpf: fix 32-bit divide by zero bpf: fix divides by zero bpf: avoid false sharing of map refcount with max_entries bpf: arsh is not supported in 32 bit alu thus reject it bpf: introduce BPF_JIT_ALWAYS_ON config bpf: fix bpf_tail_call() x64 JIT x86: bpf_jit: small optimization in emit_bpf_tail_call() bpf: fix branch pruning logic loop: fix concurrent lo_open/lo_release ANDROID: sdcardfs: Protect set_top ANDROID: fsnotify: Notify lower fs of open Revert "ANDROID: sdcardfs: notify lower file of opens" ANDROID: sdcardfs: Use lower getattr times/size ANDROID: sched/rt: schedtune: Add boost retention to RT Conflicts: arch/x86/Kconfig kernel/sched/rt.c Change-Id: I91b08e1b8e0a1c6ca9c245597acad0bf197f9527 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.115 into android-4.4Greg Kroah-Hartman2018-02-03
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.115 loop: fix concurrent lo_open/lo_release bpf: fix branch pruning logic x86: bpf_jit: small optimization in emit_bpf_tail_call() bpf: fix bpf_tail_call() x64 JIT bpf: introduce BPF_JIT_ALWAYS_ON config bpf: arsh is not supported in 32 bit alu thus reject it bpf: avoid false sharing of map refcount with max_entries bpf: fix divides by zero bpf: fix 32-bit divide by zero bpf: reject stores into ctx via st and xadd x86/pti: Make unpoison of pgd for trusted boot work for real kaiser: fix intel_bts perf crashes ALSA: seq: Make ioctls race-free crypto: aesni - handle zero length dst buffer crypto: af_alg - whitelist mask and type power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE igb: Free IRQs when device is hotplugged KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure KVM: x86: Don't re-execute instruction when not passing CR2 value KVM: X86: Fix operand/address-size during instruction decoding KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race KVM: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered KVM: x86: ioapic: Preserve read-only values in the redirection table ACPI / bus: Leave modalias empty for devices which are not present cpufreq: Add Loongson machine dependencies bcache: check return value of register_shrinker drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode drm/amdkfd: Fix SDMA ring buffer size calculation drm/amdkfd: Fix SDMA oversubsription handling openvswitch: fix the incorrect flow action alloc size mac80211: fix the update of path metric for RANN frame btrfs: fix deadlock when writing out space cache KVM: VMX: Fix rflags cache during vCPU reset xen-netfront: remove warning when unloading module nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0) nfsd: Ensure we check stateid validity in the seqid operation checks grace: replace BUG_ON by WARN_ONCE in exit_net hook nfsd: check for use of the closed special stateid lockd: fix "list_add double add" caused by legacy signal interface hwmon: (pmbus) Use 64bit math for DIRECT format values net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit quota: Check for register_shrinker() failure. SUNRPC: Allow connect to return EHOSTUNREACH kmemleak: add scheduling point to kmemleak_scan() drm/omap: Fix error handling path in 'omap_dmm_probe()' xfs: ubsan fixes scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg media: usbtv: add a new usbid usb: gadget: don't dereference g until after it has been null checked staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID usb: option: Add support for FS040U modem USB: serial: pl2303: new device id for Chilitag USB: cdc-acm: Do not log urb submission errors on disconnect CDC-ACM: apply quirk for card reader USB: serial: io_edgeport: fix possible sleep-in-atomic usbip: prevent bind loops on devices attached to vhci_hcd usbip: list: don't list devices attached to vhci_hcd USB: serial: simple: add Motorola Tetra driver usb: f_fs: Prevent gadget unbind if it is already unbound usb: uas: unconditionally bring back host after reset selinux: general protection fault in sock_has_perm serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS spi: imx: do not access registers while clocks disabled Linux 4.4.115 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: fix the update of path metric for RANN frameChun-Yeow Yeoh2018-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit fbbdad5edf0bb59786a51b94a9d006bc8c2da9a2 ] The previous path metric update from RANN frame has not considered the own link metric toward the transmitting mesh STA. Fix this. Reported-by: Michael65535 Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.112 (5f6325b) into msm-4.4Srinivasarao P2018-01-24
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-5f6325b Linux 4.4.112 selftests/x86: Add test_vsyscall x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm x86/alternatives: Fix optimize_nops() checking sysfs/cpu: Fix typos in vulnerability documentation x86/cpu: Implement CPU vulnerabilites sysfs functions sysfs/cpu: Add vulnerability folder x86/cpu: Merge bugs.c and bugs_64.c x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN x86/cpufeatures: Add X86_BUG_CPU_INSECURE x86/cpufeatures: Make CPU bugs sticky x86/cpu: Factor out application of forced CPU caps x86/Documentation: Add PTI description e1000e: Fix e1000_check_for_copper_link_ich8lan return value. uas: ignore UAS for Norelsys NS1068(X) chips Bluetooth: Prevent stack info leak from the EFS element. staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl usbip: remove kernel addresses from usb device and urb debug msgs USB: fix usbmon BUG trigger usb: misc: usb3503: make sure reset is low for at least 100us USB: serial: cp210x: add new device ID ELV ALC 8xxx USB: serial: cp210x: add IDs for LifeScan OneTouch Verio IQ target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref bpf, array: fix overflow in max_entries and undefined behavior in index_mask bpf: prevent out-of-bounds speculation bpf: adjust insn_aux_data when patching insns bpf: refactor fixup_bpf_calls() bpf: move fixup_bpf_calls() function bpf: don't (ab)use instructions to store state bpf: add bpf_patch_insn_single helper kaiser: Set _PAGE_NX only if supported drm/vmwgfx: Potential off by one in vmw_view_add() KVM: x86: Add memory barrier on vmcs field lookup x86/microcode/intel: Extend BDW late-loading with a revision check rbd: set max_segments to USHRT_MAX crypto: algapi - fix NULL dereference in crypto_remove_spawns() ipv6: fix possible mem leaks in ipv6_make_skb() net: stmmac: enable EEE in MII, GMII or RGMII only sh_eth: fix SH7757 GEther initialization sh_eth: fix TSU resource handling RDS: null pointer dereference in rds_atomic_free_op RDS: Heap OOB write in rds_message_alloc_sgs() net: core: fix module type in sock_diag_bind ip6_tunnel: disable dst caching if tunnel is dual-stack 8021q: fix a memory leak for VLAN 0 device x86/pti/efi: broken conversion from efi to kernel page table Revert "userfaultfd: selftest: vm: allow to build in vm/ directory" xhci: Fix ring leak in failure path of xhci_alloc_virt_device() sysrq: Fix warning in sysrq generated crash. hwrng: core - sleep interruptible in read x86/mm/pat, /dev/mem: Remove superfluous error message cx82310_eth: use skb_cow_head() to deal with cloned skbs smsc75xx: use skb_cow_head() to deal with cloned skbs sr9700: use skb_cow_head() to deal with cloned skbs lan78xx: use skb_cow_head() to deal with cloned skbs r8152: adjust ALDPS function r8152: use test_and_clear_bit r8152: fix the wake event usb: musb: ux500: Fix NULL pointer dereference at system PM usbvision fix overflow of interfaces array locking/mutex: Allow next waiter lockless wakeup futex: Replace barrier() in unqueue_me() with READ_ONCE() locks: don't check for race with close when setting OFD lock zswap: don't param_set_charp while holding spinlock mm/zswap: use workqueue to destroy pool mm/page-writeback: fix dirty_ratelimit calculation mm/compaction: pass only pageblock aligned range to pageblock_pfn_to_page mm/compaction: fix invalid free_pfn and compact_cached_free_pfn x86/acpi: Reduce code duplication in mp_override_legacy_irq() ALSA: aloop: Fix racy hw constraints adjustment ALSA: aloop: Fix inconsistent format due to incomplete rule ALSA: aloop: Release cable upon open error path ALSA: pcm: Allow aborting mutex lock at OSS read/write loops ALSA: pcm: Abort properly at pending signal in OSS read/write loops ALSA: pcm: Add missing error checks in OSS emulation plugin builder ALSA: pcm: Remove incorrect snd_BUG_ON() usages iommu/arm-smmu-v3: Don't free page table ops twice x86/acpi: Handle SCI interrupts above legacy space gracefully x86/vsdo: Fix build on PARAVIRT_CLOCK=y, KVM_GUEST=n kvm: vmx: Scrub hardware GPRs at VM-exit net/mac80211/debugfs.c: prevent build failure with CONFIG_UBSAN=y MIPS: Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses MIPS: Also verify sizeof `elf_fpreg_t' with PTRACE_SETREGSET MIPS: Fix an FCSR access API regression with NT_PRFPREG and MSA MIPS: Consistently handle buffer counter with PTRACE_SETREGSET MIPS: Guard against any partial write attempt with PTRACE_SETREGSET MIPS: Factor out NT_PRFPREG regset access helpers MIPS: Validate PR_SET_FP_MODE prctl(2) requests against the ABI of the task IB/srpt: Disable RDMA access by the initiator can: gs_usb: fix return value of the "set_bittiming" callback KVM: Fix stack-out-of-bounds read in write_mmio dm bufio: fix shrinker scans when (nr_to_scan < retain_target) fscrypt: updates on 4.15-rc4 ANDROID: uid_sys_stats: fix the comment BACKPORT: optee: fix invalid of_node_put() in optee_driver_init() BACKPORT: tee: optee: sync with new naming of interrupts BACKPORT: tee: indicate privileged dev in gen_caps BACKPORT: tee: optee: interruptible RPC sleep BACKPORT: tee: optee: add const to tee_driver_ops and tee_desc structures BACKPORT: tee: tee_shm: Constify dma_buf_ops structures. BACKPORT: tee: add forward declaration for struct device BACKPORT: tee: optee: fix uninitialized symbol 'parg' BACKPORT: tee.txt: standardize document format BACKPORT: tee: add ARM_SMCCC dependency BACKPORT: selinux: nlmsgtab: add SOCK_DESTROY to the netlink mapping tables Conflicts: security/selinux/nlmsgtab.c Change-Id: I5770a565f39c321f2305f8228e41f822e3cd0625 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.112 into android-4.4Greg Kroah-Hartman2018-01-17
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.112 dm bufio: fix shrinker scans when (nr_to_scan < retain_target) KVM: Fix stack-out-of-bounds read in write_mmio can: gs_usb: fix return value of the "set_bittiming" callback IB/srpt: Disable RDMA access by the initiator MIPS: Validate PR_SET_FP_MODE prctl(2) requests against the ABI of the task MIPS: Factor out NT_PRFPREG regset access helpers MIPS: Guard against any partial write attempt with PTRACE_SETREGSET MIPS: Consistently handle buffer counter with PTRACE_SETREGSET MIPS: Fix an FCSR access API regression with NT_PRFPREG and MSA MIPS: Also verify sizeof `elf_fpreg_t' with PTRACE_SETREGSET MIPS: Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses net/mac80211/debugfs.c: prevent build failure with CONFIG_UBSAN=y kvm: vmx: Scrub hardware GPRs at VM-exit x86/vsdo: Fix build on PARAVIRT_CLOCK=y, KVM_GUEST=n x86/acpi: Handle SCI interrupts above legacy space gracefully iommu/arm-smmu-v3: Don't free page table ops twice ALSA: pcm: Remove incorrect snd_BUG_ON() usages ALSA: pcm: Add missing error checks in OSS emulation plugin builder ALSA: pcm: Abort properly at pending signal in OSS read/write loops ALSA: pcm: Allow aborting mutex lock at OSS read/write loops ALSA: aloop: Release cable upon open error path ALSA: aloop: Fix inconsistent format due to incomplete rule ALSA: aloop: Fix racy hw constraints adjustment x86/acpi: Reduce code duplication in mp_override_legacy_irq() mm/compaction: fix invalid free_pfn and compact_cached_free_pfn mm/compaction: pass only pageblock aligned range to pageblock_pfn_to_page mm/page-writeback: fix dirty_ratelimit calculation mm/zswap: use workqueue to destroy pool zswap: don't param_set_charp while holding spinlock locks: don't check for race with close when setting OFD lock futex: Replace barrier() in unqueue_me() with READ_ONCE() locking/mutex: Allow next waiter lockless wakeup usbvision fix overflow of interfaces array usb: musb: ux500: Fix NULL pointer dereference at system PM r8152: fix the wake event r8152: use test_and_clear_bit r8152: adjust ALDPS function lan78xx: use skb_cow_head() to deal with cloned skbs sr9700: use skb_cow_head() to deal with cloned skbs smsc75xx: use skb_cow_head() to deal with cloned skbs cx82310_eth: use skb_cow_head() to deal with cloned skbs x86/mm/pat, /dev/mem: Remove superfluous error message hwrng: core - sleep interruptible in read sysrq: Fix warning in sysrq generated crash. xhci: Fix ring leak in failure path of xhci_alloc_virt_device() Revert "userfaultfd: selftest: vm: allow to build in vm/ directory" x86/pti/efi: broken conversion from efi to kernel page table 8021q: fix a memory leak for VLAN 0 device ip6_tunnel: disable dst caching if tunnel is dual-stack net: core: fix module type in sock_diag_bind RDS: Heap OOB write in rds_message_alloc_sgs() RDS: null pointer dereference in rds_atomic_free_op sh_eth: fix TSU resource handling sh_eth: fix SH7757 GEther initialization net: stmmac: enable EEE in MII, GMII or RGMII only ipv6: fix possible mem leaks in ipv6_make_skb() crypto: algapi - fix NULL dereference in crypto_remove_spawns() rbd: set max_segments to USHRT_MAX x86/microcode/intel: Extend BDW late-loading with a revision check KVM: x86: Add memory barrier on vmcs field lookup drm/vmwgfx: Potential off by one in vmw_view_add() kaiser: Set _PAGE_NX only if supported bpf: add bpf_patch_insn_single helper bpf: don't (ab)use instructions to store state bpf: move fixup_bpf_calls() function bpf: refactor fixup_bpf_calls() bpf: adjust insn_aux_data when patching insns bpf: prevent out-of-bounds speculation bpf, array: fix overflow in max_entries and undefined behavior in index_mask iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK USB: serial: cp210x: add IDs for LifeScan OneTouch Verio IQ USB: serial: cp210x: add new device ID ELV ALC 8xxx usb: misc: usb3503: make sure reset is low for at least 100us USB: fix usbmon BUG trigger usbip: remove kernel addresses from usb device and urb debug msgs staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl Bluetooth: Prevent stack info leak from the EFS element. uas: ignore UAS for Norelsys NS1068(X) chips e1000e: Fix e1000_check_for_copper_link_ich8lan return value. x86/Documentation: Add PTI description x86/cpu: Factor out application of forced CPU caps x86/cpufeatures: Make CPU bugs sticky x86/cpufeatures: Add X86_BUG_CPU_INSECURE x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] x86/cpu: Merge bugs.c and bugs_64.c sysfs/cpu: Add vulnerability folder x86/cpu: Implement CPU vulnerabilites sysfs functions sysfs/cpu: Fix typos in vulnerability documentation x86/alternatives: Fix optimize_nops() checking x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm selftests/x86: Add test_vsyscall Linux 4.4.112 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * net/mac80211/debugfs.c: prevent build failure with CONFIG_UBSAN=yAndrey Ryabinin2018-01-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 68920c973254c5b71a684645c5f6f82d6732c5d6 upstream. With upcoming CONFIG_UBSAN the following BUILD_BUG_ON in net/mac80211/debugfs.c starts to trigger: BUILD_BUG_ON(hw_flag_names[NUM_IEEE80211_HW_FLAGS] != (void *)0x1); It seems, that compiler instrumentation causes some code deoptimizations. Because of that GCC is not being able to resolve condition in BUILD_BUG_ON() at compile time. We could make size of hw_flag_names array unspecified and replace the condition in BUILD_BUG_ON() with following: ARRAY_SIZE(hw_flag_names) != NUM_IEEE80211_HW_FLAGS That will have the same effect as before (adding new flag without updating array will trigger build failure) except it doesn't fail with CONFIG_UBSAN. As a bonus this patch slightly decreases size of hw_flag_names array. Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> [Daniel: backport to 4.4.] Signed-off-by: Daniel Wagner <daniel.wagner@siemens.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.107 (79f138a) into msm-4.4Srinivasarao P2018-01-18
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-79f138a Linux 4.4.107 ath9k: fix tx99 potential info leak IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop RDMA/cma: Avoid triggering undefined behavior macvlan: Only deliver one copy of the frame to the macvlan interface udf: Avoid overflow when session starts at large offset scsi: bfa: integer overflow in debugfs scsi: sd: change allow_restart to bool in sysfs interface scsi: sd: change manage_start_stop to bool in sysfs interface vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry raid5: Set R5_Expanded on parity devices as well as data. pinctrl: adi2: Fix Kconfig build problem usb: musb: da8xx: fix babble condition handling tty fix oops when rmmod 8250 powerpc/perf/hv-24x7: Fix incorrect comparison in memord scsi: hpsa: destroy sas transport properties before scsi_host scsi: hpsa: cleanup sas_phy structures in sysfs when unloading PCI: Detach driver before procfs & sysfs teardown on device remove xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real xfs: fix log block underflow during recovery cycle verification l2tp: cleanup l2tp_tunnel_delete calls bcache: fix wrong cache_misses statistics bcache: explicitly destroy mutex while exiting GFS2: Take inode off order_write list when setting jdata flag thermal/drivers/step_wise: Fix temperature regulation misbehavior ppp: Destroy the mutex when cleanup clk: tegra: Fix cclk_lp divisor register clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU clk: mediatek: add the option for determining PLL source clock mm: Handle 0 flags in _calc_vm_trans() macro crypto: tcrypt - fix buffer lengths in test_aead_speed() arm-ccn: perf: Prevent module unload while PMU is in use target/file: Do not return error for UNMAP if length is zero target:fix condition return in core_pr_dump_initiator_port() iscsi-target: fix memory leak in lio_target_tiqn_addtpg() target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd() powerpc/ipic: Fix status get and status clear powerpc/opal: Fix EBUSY bug in acquiring tokens netfilter: ipvs: Fix inappropriate output of procfs powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo PCI/PME: Handle invalid data when reading Root Status dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type rtc: pcf8563: fix output clock rate video: fbdev: au1200fb: Return an error code if a memory allocation fails video: fbdev: au1200fb: Release some resources if a memory allocation fails video: udlfb: Fix read EDID timeout fbdev: controlfb: Add missing modes to fix out of bounds access sfc: don't warn on successful change of MAC target: fix race during implicit transition work flushes target: fix ALUA transition timeout handling target: Use system workqueue for ALUA transitions btrfs: add missing memset while reading compressed inline extents NFSv4.1 respect server's max size in CREATE_SESSION efi/esrt: Cleanup bad memory map log messages perf symbols: Fix symbols__fixup_end heuristic for corner cases net/mlx4_core: Avoid delays during VF driver device shutdown afs: Fix afs_kill_pages() afs: Fix page leak in afs_write_begin() afs: Populate and use client modification time afs: Fix the maths in afs_fs_store_data() afs: Prevent callback expiry timer overflow afs: Migrate vlocation fields to 64-bit afs: Flush outstanding writes when an fd is closed afs: Adjust mode bits processing afs: Populate group ID from vnode status afs: Fix missing put_page() drm/radeon: reinstate oland workaround for sclk mmc: mediatek: Fixed bug where clock frequency could be set wrong sched/deadline: Use deadline instead of period when calculating overflow sched/deadline: Throttle a constrained deadline task activated after the deadline sched/deadline: Make sure the replenishment timer fires in the next period drm/radeon/si: add dpm quirk for Oland fjes: Fix wrong netdevice feature flags scsi: hpsa: limit outstanding rescans scsi: hpsa: update check for logical volume status openrisc: fix issue handling 8 byte get_user calls intel_th: pci: Add Gemini Lake support mlxsw: reg: Fix SPVMLR max record count mlxsw: reg: Fix SPVM max record count net: Resend IGMP memberships upon peer notification. dmaengine: Fix array index out of bounds warning in __get_unmap_pool() net: wimax/i2400m: fix NULL-deref at probe writeback: fix memory leak in wb_queue_work() netfilter: bridge: honor frag_max_size when refragmenting drm/omap: fix dmabuf mmap for dma_alloc'ed buffers Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list NFSD: fix nfsd_reset_versions for NFSv4. NFSD: fix nfsd_minorversion(.., NFSD_AVAIL) net: bcmgenet: Power up the internal PHY before probing the MII net: bcmgenet: power down internal phy if open or resume fails net: bcmgenet: reserved phy revisions must be checked first net: bcmgenet: correct MIB access of UniMAC RUNT counters net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values net: initialize msg.msg_flags in recvfrom userfaultfd: selftest: vm: allow to build in vm/ directory userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE md-cluster: free md_cluster_info if node leave cluster usb: phy: isp1301: Add OF device ID table mac80211: Fix addition of mesh configuration element KEYS: add missing permission check for request_key() destination ext4: fix crash when a directory's i_size is too small ext4: fix fdatasync(2) after fallocate(2) operation dmaengine: dmatest: move callback wait queue to thread context sched/rt: Do not pull from current CPU if only one CPU to pull xhci: Don't add a virt_dev to the devs array before it's fully allocated Bluetooth: btusb: driver to enable the usb-wakeup feature ceph: drop negative child dentries before try pruning inode's alias usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer USB: core: prevent malicious bNumInterfaces overflow USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID tracing: Allocate mask_str buffer dynamically autofs: fix careless error in recent commit crypto: salsa20 - fix blkcipher_walk API usage crypto: hmac - require that the underlying hash algorithm is unkeyed UPSTREAM: arm64: setup: introduce kaslr_offset() UPSTREAM: kcov: fix comparison callback signature UPSTREAM: kcov: support comparison operands collection UPSTREAM: kcov: remove pointless current != NULL check UPSTREAM: kcov: support compat processes UPSTREAM: kcov: simplify interrupt check UPSTREAM: kcov: make kcov work properly with KASLR enabled UPSTREAM: kcov: add more missing includes UPSTREAM: kcov: add missing #include <linux/sched.h> UPSTREAM: kcov: properly check if we are in an interrupt UPSTREAM: kcov: don't profile branches in kcov UPSTREAM: kcov: don't trace the code coverage code BACKPORT: kernel: add kcov code coverage Conflicts: Makefile mm/kasan/Makefile scripts/Makefile.lib Change-Id: Ic19953706ea2e700621b0ba94d1c90bbffa4f471 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.107 into android-4.4Greg Kroah-Hartman2017-12-20
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.107 crypto: hmac - require that the underlying hash algorithm is unkeyed crypto: salsa20 - fix blkcipher_walk API usage autofs: fix careless error in recent commit tracing: Allocate mask_str buffer dynamically USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID USB: core: prevent malicious bNumInterfaces overflow usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer ceph: drop negative child dentries before try pruning inode's alias Bluetooth: btusb: driver to enable the usb-wakeup feature xhci: Don't add a virt_dev to the devs array before it's fully allocated sched/rt: Do not pull from current CPU if only one CPU to pull dmaengine: dmatest: move callback wait queue to thread context ext4: fix fdatasync(2) after fallocate(2) operation ext4: fix crash when a directory's i_size is too small KEYS: add missing permission check for request_key() destination mac80211: Fix addition of mesh configuration element usb: phy: isp1301: Add OF device ID table md-cluster: free md_cluster_info if node leave cluster userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE userfaultfd: selftest: vm: allow to build in vm/ directory net: initialize msg.msg_flags in recvfrom net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values net: bcmgenet: correct MIB access of UniMAC RUNT counters net: bcmgenet: reserved phy revisions must be checked first net: bcmgenet: power down internal phy if open or resume fails net: bcmgenet: Power up the internal PHY before probing the MII NFSD: fix nfsd_minorversion(.., NFSD_AVAIL) NFSD: fix nfsd_reset_versions for NFSv4. Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list drm/omap: fix dmabuf mmap for dma_alloc'ed buffers netfilter: bridge: honor frag_max_size when refragmenting writeback: fix memory leak in wb_queue_work() net: wimax/i2400m: fix NULL-deref at probe dmaengine: Fix array index out of bounds warning in __get_unmap_pool() net: Resend IGMP memberships upon peer notification. mlxsw: reg: Fix SPVM max record count mlxsw: reg: Fix SPVMLR max record count intel_th: pci: Add Gemini Lake support openrisc: fix issue handling 8 byte get_user calls scsi: hpsa: update check for logical volume status scsi: hpsa: limit outstanding rescans fjes: Fix wrong netdevice feature flags drm/radeon/si: add dpm quirk for Oland sched/deadline: Make sure the replenishment timer fires in the next period sched/deadline: Throttle a constrained deadline task activated after the deadline sched/deadline: Use deadline instead of period when calculating overflow mmc: mediatek: Fixed bug where clock frequency could be set wrong drm/radeon: reinstate oland workaround for sclk afs: Fix missing put_page() afs: Populate group ID from vnode status afs: Adjust mode bits processing afs: Flush outstanding writes when an fd is closed afs: Migrate vlocation fields to 64-bit afs: Prevent callback expiry timer overflow afs: Fix the maths in afs_fs_store_data() afs: Populate and use client modification time afs: Fix page leak in afs_write_begin() afs: Fix afs_kill_pages() net/mlx4_core: Avoid delays during VF driver device shutdown perf symbols: Fix symbols__fixup_end heuristic for corner cases efi/esrt: Cleanup bad memory map log messages NFSv4.1 respect server's max size in CREATE_SESSION btrfs: add missing memset while reading compressed inline extents target: Use system workqueue for ALUA transitions target: fix ALUA transition timeout handling target: fix race during implicit transition work flushes sfc: don't warn on successful change of MAC fbdev: controlfb: Add missing modes to fix out of bounds access video: udlfb: Fix read EDID timeout video: fbdev: au1200fb: Release some resources if a memory allocation fails video: fbdev: au1200fb: Return an error code if a memory allocation fails rtc: pcf8563: fix output clock rate dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type PCI/PME: Handle invalid data when reading Root Status powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo netfilter: ipvs: Fix inappropriate output of procfs powerpc/opal: Fix EBUSY bug in acquiring tokens powerpc/ipic: Fix status get and status clear target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd() iscsi-target: fix memory leak in lio_target_tiqn_addtpg() target:fix condition return in core_pr_dump_initiator_port() target/file: Do not return error for UNMAP if length is zero arm-ccn: perf: Prevent module unload while PMU is in use crypto: tcrypt - fix buffer lengths in test_aead_speed() mm: Handle 0 flags in _calc_vm_trans() macro clk: mediatek: add the option for determining PLL source clock clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU clk: tegra: Fix cclk_lp divisor register ppp: Destroy the mutex when cleanup thermal/drivers/step_wise: Fix temperature regulation misbehavior GFS2: Take inode off order_write list when setting jdata flag bcache: explicitly destroy mutex while exiting bcache: fix wrong cache_misses statistics l2tp: cleanup l2tp_tunnel_delete calls xfs: fix log block underflow during recovery cycle verification xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real PCI: Detach driver before procfs & sysfs teardown on device remove scsi: hpsa: cleanup sas_phy structures in sysfs when unloading scsi: hpsa: destroy sas transport properties before scsi_host powerpc/perf/hv-24x7: Fix incorrect comparison in memord tty fix oops when rmmod 8250 usb: musb: da8xx: fix babble condition handling pinctrl: adi2: Fix Kconfig build problem raid5: Set R5_Expanded on parity devices as well as data. scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend scsi: sd: change manage_start_stop to bool in sysfs interface scsi: sd: change allow_restart to bool in sysfs interface scsi: bfa: integer overflow in debugfs udf: Avoid overflow when session starts at large offset macvlan: Only deliver one copy of the frame to the macvlan interface RDMA/cma: Avoid triggering undefined behavior IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop ath9k: fix tx99 potential info leak Linux 4.4.107 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: Fix addition of mesh configuration elementIlan peer2017-12-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 57629915d568c522ac1422df7bba4bee5b5c7a7c upstream. The code was setting the capabilities byte to zero, after it was already properly set previously. Fix it. The bug was found while debugging hwsim mesh tests failures that happened since the commit mentioned below. Fixes: 76f43b4c0a93 ("mac80211: Remove invalid flag operations in mesh TSF synchronization") Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Masashi Honma <masashi.honma@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: Richard Schütz <rschuetz@uni-koblenz.de> Cc: Mathias Kretschmer <mathias.kretschmer@fit.fraunhofer.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.103 (9fbf3d7) into msm-4.4Srinivasarao P2018-01-02
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-9fbf3d7 Linux 4.4.103 Revert "sctp: do not peel off an assoc from one netns to another one" xen: xenbus driver must not accept invalid transaction ids s390/kbuild: enable modversions for symbols exported from asm ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data btrfs: return the actual error value from from btrfs_uuid_tree_iterate ASoC: rsnd: don't double free kctrl netfilter: nf_tables: fix oob access netfilter: nft_queue: use raw_smp_processor_id() spi: SPI_FSL_DSPI should depend on HAS_DMA staging: iio: cdc: fix improper return value iio: light: fix improper return value mac80211: Suppress NEW_PEER_CANDIDATE event if no room mac80211: Remove invalid flag operations in mesh TSF synchronization drm: Apply range restriction after color adjustment when allocation ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE ath10k: set CTS protection VDEV param only if VDEV is up ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() ath10k: ignore configuring the incorrect board_id ath10k: fix incorrect txpower set by P2P_DEVICE interface drm/armada: Fix compile fail net: 3com: typhoon: typhoon_init_one: fix incorrect return values net: 3com: typhoon: typhoon_init_one: make return values more specific net: Allow IP_MULTICAST_IF to set index to L3 slave dmaengine: zx: set DMA_CYCLIC cap_mask bit PCI: Apply _HPX settings only to relevant devices RDS: RDMA: return appropriate error on rdma map failures e1000e: Separate signaling for link check/link up e1000e: Fix return value test e1000e: Fix error path in link detection PM / OPP: Add missing of_node_put(np) net/9p: Switch to wait_event_killable() fscrypt: lock mutex before checking for bounce page pool sched/rt: Simplify the IPI based RT balancing logic media: v4l2-ctrl: Fix flags field on Control events cx231xx-cards: fix NULL-deref on missing association descriptor media: rc: check for integer overflow media: Don't do DMA on stack for firmware upload in the AS102 driver powerpc/signal: Properly handle return value from uprobe_deny_signal() parisc: Fix validity check of pointer size argument in new CAS implementation ixgbe: Fix skb list corruption on Power systems fm10k: Use smp_rmb rather than read_barrier_depends i40evf: Use smp_rmb rather than read_barrier_depends ixgbevf: Use smp_rmb rather than read_barrier_depends igbvf: Use smp_rmb rather than read_barrier_depends igb: Use smp_rmb rather than read_barrier_depends i40e: Use smp_rmb rather than read_barrier_depends NFC: fix device-allocation error return IB/srp: Avoid that a cable pull can trigger a kernel crash IB/srpt: Do not accept invalid initiator port names libnvdimm, namespace: make 'resource' attribute only readable by root libnvdimm, namespace: fix label initialization to use valid seq numbers clk: ti: dra7-atl-clock: fix child-node lookups clk: ti: dra7-atl-clock: Fix of_node reference counting SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status KVM: SVM: obey guest PAT KVM: nVMX: set IDTR and GDTR limits when loading L1 host state target: Fix QUEUE_FULL + SCSI task attribute handling iscsi-target: Fix non-immediate TMR reference leak fs/9p: Compare qid.path in v9fs_test_inode fix a page leak in vhost_scsi_iov_to_sgl() error recovery ALSA: hda/realtek - Fix ALC700 family no sound issue ALSA: timer: Remove kernel warning at compat ioctl error paths ALSA: usb-audio: Add sanity checks in v2 clock parsers ALSA: usb-audio: Fix potential out-of-bound access at parsing SU ALSA: usb-audio: Add sanity checks to FE parser ALSA: pcm: update tstamp only if audio_tstamp changed ext4: fix interaction between i_size, fallocate, and delalloc after a crash ata: fixes kernel crash while tracing ata_eh_link_autopsy event rtlwifi: fix uninitialized rtlhal->last_suspend_sec time rtlwifi: rtl8192ee: Fix memory leak when loading firmware nfsd: deal with revoked delegations appropriately nfs: Fix ugly referral attributes NFS: Fix typo in nomigration mount option isofs: fix timestamps beyond 2027 bcache: check ca->alloc_thread initialized before wake up it eCryptfs: use after free in ecryptfs_release_messaging() nilfs2: fix race condition that causes file system corruption autofs: don't fail mount for transient error MIPS: BCM47XX: Fix LED inversion for WRT54GSv1 MIPS: Fix an n32 core file generation regset support regression dm: fix race between dm_get_from_kobject() and __dm_destroy() dm bufio: fix integer overflow when limiting maximum cache size ALSA: hda: Add Raven PCI ID MIPS: ralink: Fix typo in mt7628 pinmux function MIPS: ralink: Fix MT7628 pinmux ARM: 8721/1: mm: dump: check hardware RO bit for LPAE ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE x86/decoder: Add new TEST instruction pattern lib/mpi: call cond_resched() from mpi_powm() loop sched: Make resched_cpu() unconditional vsock: use new wait API for vsock_stream_sendmsg() AF_VSOCK: Shrink the area influenced by prepare_to_wait ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER s390/disassembler: increase show_code buffer size s390/disassembler: add missing end marker for e7 table s390/runtime instrumention: fix possible memory corruption s390: fix transactional execution control register handling BACKPORT: time: Clean up CLOCK_MONOTONIC_RAW time handling BACKPORT: time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting UPSTREAM: arm64: vdso: fix clock_getres for 4GiB-aligned res f2fs: updates on 4.15-rc1 UPSTREAM: android: binder: fix type mismatch warning Linux 4.4.102 mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for all call sites" Conflicts: fs/ext4/crypto_key.c mm/debug-pagealloc.c Change-Id: Ibe35d78bd0397f3ff2049e0a1dda20fcb06f2f75 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.103 into android-4.4Greg Kroah-Hartman2017-11-30
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.103 s390: fix transactional execution control register handling s390/runtime instrumention: fix possible memory corruption s390/disassembler: add missing end marker for e7 table s390/disassembler: increase show_code buffer size ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER AF_VSOCK: Shrink the area influenced by prepare_to_wait vsock: use new wait API for vsock_stream_sendmsg() sched: Make resched_cpu() unconditional lib/mpi: call cond_resched() from mpi_powm() loop x86/decoder: Add new TEST instruction pattern ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE ARM: 8721/1: mm: dump: check hardware RO bit for LPAE MIPS: ralink: Fix MT7628 pinmux MIPS: ralink: Fix typo in mt7628 pinmux function ALSA: hda: Add Raven PCI ID dm bufio: fix integer overflow when limiting maximum cache size dm: fix race between dm_get_from_kobject() and __dm_destroy() MIPS: Fix an n32 core file generation regset support regression MIPS: BCM47XX: Fix LED inversion for WRT54GSv1 autofs: don't fail mount for transient error nilfs2: fix race condition that causes file system corruption eCryptfs: use after free in ecryptfs_release_messaging() bcache: check ca->alloc_thread initialized before wake up it isofs: fix timestamps beyond 2027 NFS: Fix typo in nomigration mount option nfs: Fix ugly referral attributes nfsd: deal with revoked delegations appropriately rtlwifi: rtl8192ee: Fix memory leak when loading firmware rtlwifi: fix uninitialized rtlhal->last_suspend_sec time ata: fixes kernel crash while tracing ata_eh_link_autopsy event ext4: fix interaction between i_size, fallocate, and delalloc after a crash ALSA: pcm: update tstamp only if audio_tstamp changed ALSA: usb-audio: Add sanity checks to FE parser ALSA: usb-audio: Fix potential out-of-bound access at parsing SU ALSA: usb-audio: Add sanity checks in v2 clock parsers ALSA: timer: Remove kernel warning at compat ioctl error paths ALSA: hda/realtek - Fix ALC700 family no sound issue fix a page leak in vhost_scsi_iov_to_sgl() error recovery fs/9p: Compare qid.path in v9fs_test_inode iscsi-target: Fix non-immediate TMR reference leak target: Fix QUEUE_FULL + SCSI task attribute handling KVM: nVMX: set IDTR and GDTR limits when loading L1 host state KVM: SVM: obey guest PAT SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status clk: ti: dra7-atl-clock: Fix of_node reference counting clk: ti: dra7-atl-clock: fix child-node lookups libnvdimm, namespace: fix label initialization to use valid seq numbers libnvdimm, namespace: make 'resource' attribute only readable by root IB/srpt: Do not accept invalid initiator port names IB/srp: Avoid that a cable pull can trigger a kernel crash NFC: fix device-allocation error return i40e: Use smp_rmb rather than read_barrier_depends igb: Use smp_rmb rather than read_barrier_depends igbvf: Use smp_rmb rather than read_barrier_depends ixgbevf: Use smp_rmb rather than read_barrier_depends i40evf: Use smp_rmb rather than read_barrier_depends fm10k: Use smp_rmb rather than read_barrier_depends ixgbe: Fix skb list corruption on Power systems parisc: Fix validity check of pointer size argument in new CAS implementation powerpc/signal: Properly handle return value from uprobe_deny_signal() media: Don't do DMA on stack for firmware upload in the AS102 driver media: rc: check for integer overflow cx231xx-cards: fix NULL-deref on missing association descriptor media: v4l2-ctrl: Fix flags field on Control events sched/rt: Simplify the IPI based RT balancing logic fscrypt: lock mutex before checking for bounce page pool net/9p: Switch to wait_event_killable() PM / OPP: Add missing of_node_put(np) e1000e: Fix error path in link detection e1000e: Fix return value test e1000e: Separate signaling for link check/link up RDS: RDMA: return appropriate error on rdma map failures PCI: Apply _HPX settings only to relevant devices dmaengine: zx: set DMA_CYCLIC cap_mask bit net: Allow IP_MULTICAST_IF to set index to L3 slave net: 3com: typhoon: typhoon_init_one: make return values more specific net: 3com: typhoon: typhoon_init_one: fix incorrect return values drm/armada: Fix compile fail ath10k: fix incorrect txpower set by P2P_DEVICE interface ath10k: ignore configuring the incorrect board_id ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() ath10k: set CTS protection VDEV param only if VDEV is up ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE drm: Apply range restriction after color adjustment when allocation mac80211: Remove invalid flag operations in mesh TSF synchronization mac80211: Suppress NEW_PEER_CANDIDATE event if no room iio: light: fix improper return value staging: iio: cdc: fix improper return value spi: SPI_FSL_DSPI should depend on HAS_DMA netfilter: nft_queue: use raw_smp_processor_id() netfilter: nf_tables: fix oob access ASoC: rsnd: don't double free kctrl btrfs: return the actual error value from from btrfs_uuid_tree_iterate ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data s390/kbuild: enable modversions for symbols exported from asm xen: xenbus driver must not accept invalid transaction ids Revert "sctp: do not peel off an assoc from one netns to another one" Linux 4.4.103 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * mac80211: Suppress NEW_PEER_CANDIDATE event if no roomMasashi Honma2017-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 11197d006bcfabf0173a7820a163fcaac420d10e ] Previously, kernel sends NEW_PEER_CANDIDATE event to user land even if the found peer does not have any room to accept other peer. This causes continuous connection trials. Signed-off-by: Masashi Honma <masashi.honma@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * mac80211: Remove invalid flag operations in mesh TSF synchronizationMasashi Honma2017-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 76f43b4c0a9337af22827d78de4f2b8fd5328489 ] mesh_sync_offset_adjust_tbtt() implements Extensible synchronization framework ([1] 13.13.2 Extensible synchronization framework). It shall not operate the flag "TBTT Adjusting subfield" ([1] 8.4.2.100.8 Mesh Capability), since it is used only for MBCA ([1] 13.13.4 Mesh beacon collision avoidance, see 13.13.4.4.3 TBTT scanning and adjustment procedures for detail). So this patch remove the flag operations. [1] IEEE Std 802.11 2012 Signed-off-by: Masashi Honma <masashi.honma@gmail.com> [remove adjusting_tbtt entirely, since it's now unused] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.99 (7eab308) into msm-4.4Srinivasarao P2017-12-26
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-7eab308 Linux 4.4.99 misc: panel: properly restore atomic counter on error path target: Fix node_acl demo-mode + uncached dynamic shutdown regression target/iscsi: Fix iSCSI task reassignment handling brcmfmac: remove setting IBSS mode when stopping AP tipc: fix link attribute propagation bug security/keys: add CONFIG_KEYS_COMPAT to Kconfig tcp/dccp: fix other lockdep splats accessing ireq_opt tcp/dccp: fix lockdep splat in inet_csk_route_req() tcp/dccp: fix ireq->opt races ipip: only increase err_count for some certain type icmp in ipip_err ppp: fix race in ppp device destruction sctp: reset owner sk for data chunks on out queues when migrating a sock tun: allow positive return values on dev_get_valid_name() call ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err net/unix: don't show information about sockets from other namespaces ipv6: flowlabel: do not leave opt->tot_len with garbage packet: avoid panic in packet_getsockopt() sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect tun: call dev_get_valid_name() before register_netdevice() l2tp: check ps->sock before running pppol2tp_session_ioctl() tcp: fix tcp_mtu_probe() vs highest_sack tun/tap: sanitize TUNSETSNDBUF input ALSA: seq: Cancel pending autoload work at unbinding device Input: ims-psu - check if CDC union descriptor is sane usb: usbtest: fix NULL pointer dereference mac80211: don't compare TKIP TX MIC key in reinstall prevention mac80211: use constant time comparison with keys mac80211: accept key reinstall without changing anything FROMLIST: binder: fix proc->files use-after-free Change-Id: I9aaf4f803a5da1fc983879a214b2fddda7879f41 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.99 into android-4.4Greg Kroah-Hartman2017-11-18
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.99 mac80211: accept key reinstall without changing anything mac80211: use constant time comparison with keys mac80211: don't compare TKIP TX MIC key in reinstall prevention usb: usbtest: fix NULL pointer dereference Input: ims-psu - check if CDC union descriptor is sane ALSA: seq: Cancel pending autoload work at unbinding device tun/tap: sanitize TUNSETSNDBUF input tcp: fix tcp_mtu_probe() vs highest_sack l2tp: check ps->sock before running pppol2tp_session_ioctl() tun: call dev_get_valid_name() before register_netdevice() sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect packet: avoid panic in packet_getsockopt() ipv6: flowlabel: do not leave opt->tot_len with garbage net/unix: don't show information about sockets from other namespaces ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err tun: allow positive return values on dev_get_valid_name() call sctp: reset owner sk for data chunks on out queues when migrating a sock ppp: fix race in ppp device destruction ipip: only increase err_count for some certain type icmp in ipip_err tcp/dccp: fix ireq->opt races tcp/dccp: fix lockdep splat in inet_csk_route_req() tcp/dccp: fix other lockdep splats accessing ireq_opt security/keys: add CONFIG_KEYS_COMPAT to Kconfig tipc: fix link attribute propagation bug brcmfmac: remove setting IBSS mode when stopping AP target/iscsi: Fix iSCSI task reassignment handling target: Fix node_acl demo-mode + uncached dynamic shutdown regression misc: panel: properly restore atomic counter on error path Linux 4.4.99 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>