summaryrefslogtreecommitdiff
path: root/security (follow)
Commit message (Collapse)AuthorAge
...
| * | | | | | | | | | | | Merge 4.4.157 into android-4.4-pGreg Kroah-Hartman2018-09-20
| |\ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.157 i2c: xiic: Make the start and the byte count write atomic i2c: i801: fix DNV's SMBCTRL register offset ALSA: hda - Fix cancel_work_sync() stall from jackpoll work cfq: Give a chance for arming slice idle timer in case of group_idle kthread: Fix use-after-free if kthread fork fails kthread: fix boot hang (regression) on MIPS/OpenRISC staging: rt5208: Fix a sleep-in-atomic bug in xd_copy_page staging/rts5208: Fix read overflow in memcpy block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg locking/rwsem-xadd: Fix missed wakeup due to reordering of load selinux: use GFP_NOWAIT in the AVC kmem_caches locking/osq_lock: Fix osq_lock queue corruption ARC: [plat-axs*]: Enable SWAP misc: mic: SCIF Fix scif_get_new_port() error handling ethtool: Remove trailing semicolon for static inline Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV gpio: tegra: Move driver registration to subsys_init level scsi: target: fix __transport_register_session locking md/raid5: fix data corruption of replacements after originals dropped misc: ti-st: Fix memory leak in the error path of probe() uio: potential double frees if __uio_register_device() fails tty: rocket: Fix possible buffer overwrite on register_PCI f2fs: do not set free of current section perf tools: Allow overriding MAX_NR_CPUS at compile time NFSv4.0 fix client reference leak in callback macintosh/via-pmu: Add missing mmio accessors ath10k: prevent active scans on potential unusable channels MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET ata: libahci: Correct setting of DEVSLP register scsi: 3ware: fix return 0 on the error path of probe ath10k: disable bundle mgmt tx completion event support Bluetooth: hidp: Fix handling of strncpy for hid->name information x86/mm: Remove in_nmi() warning from vmalloc_fault() gpio: ml-ioh: Fix buffer underwrite on probe error path net: mvneta: fix mtu change on port without link MIPS: Octeon: add missing of_node_put() net: dcb: For wild-card lookups, use priority -1, not 0 Input: atmel_mxt_ts - only use first T9 instance partitions/aix: append null character to print data from disk partitions/aix: fix usage of uninitialized lv_info and lvname structures iommu/ipmmu-vmsa: Fix allocation in atomic context mfd: ti_am335x_tscadc: Fix struct clk memory leak f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON RDMA/cma: Do not ignore net namespace for unbound cm_id xhci: Fix use-after-free in xhci_free_virt_device vmw_balloon: include asm/io.h netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config net: ethernet: ti: cpsw: fix mdio device reference leak ethernet: ti: davinci_emac: add missing of_node_put after calling of_parse_phandle crypto: vmx - Fix sleep-in-atomic bugs mtd: ubi: wl: Fix error return code in ubi_wl_init() autofs: fix autofs_sbi() does not check super block type x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ mm: get rid of vmacache_flush_all() entirely Linux 4.4.157 Change-Id: I08e4c24c1a22ef0e97f9185bc9da72f4a651ca73 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * \ \ \ \ \ \ \ \ \ \ \ \ Merge 4.4.152 into android-4.4-pGreg Kroah-Hartman2018-08-24
| |\ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.152 ARC: Explicitly add -mmedium-calls to CFLAGS netfilter: ipv6: nf_defrag: reduce struct net memory waste selftests: pstore: return Kselftest Skip code for skipped tests selftests: static_keys: return Kselftest Skip code for skipped tests selftests: user: return Kselftest Skip code for skipped tests selftests: zram: return Kselftest Skip code for skipped tests selftests: sync: add config fragment for testing sync framework ARM: dts: Cygnus: Fix I2C controller interrupt type usb: dwc2: fix isoc split in transfer with no data usb: gadget: composite: fix delayed_status race condition when set_interface usb: gadget: dwc2: fix memory leak in gadget_init() scsi: xen-scsifront: add error handling for xenbus_printf arm64: make secondary_start_kernel() notrace qed: Add sanity check for SIMD fastpath handler. enic: initialize enic->rfs_h.lock in enic_probe net: hamradio: use eth_broadcast_addr net: propagate dev_get_valid_name return code ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP net: davinci_emac: match the mdio device against its compatible if possible locking/lockdep: Do not record IRQ state within lockdep code ipv6: mcast: fix unsolicited report interval after receiving querys Smack: Mark inode instant in smack_task_to_inode cxgb4: when disabling dcb set txq dcb priority to 0 brcmfmac: stop watchdog before detach and free everything ARM: dts: am437x: make edt-ft5x06 a wakeup source usb: xhci: increase CRS timeout value perf test session topology: Fix test on s390 perf report powerpc: Fix crash if callchain is empty selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs ARM: dts: da850: Fix interrups property for gpio dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() md/raid10: fix that replacement cannot complete recovery after reassemble drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes drm/exynos: decon5433: Fix WINCONx reset value bnx2x: Fix receiving tx-timeout in error or recovery state. m68k: fix "bad page state" oops on ColdFire boot HID: wacom: Correct touch maximum XY of 2nd-gen Intuos ARM: imx_v6_v7_defconfig: Select ULPI support ARM: imx_v4_v5_defconfig: Select ULPI support tracing: Use __printf markup to silence compiler kasan: fix shadow_size calculation error in kasan_module_alloc smsc75xx: Add workaround for gigabit link up hardware errata. netfilter: x_tables: set module owner for icmp(6) matches ARM: pxa: irq: fix handling of ICMR registers in suspend/resume ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem ieee802154: at86rf230: use __func__ macro for debug messages ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem drm/armada: fix colorkey mode property bnxt_en: Fix for system hang if request_irq fails perf llvm-utils: Remove bashism from kernel include fetch script ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller ixgbe: Be more careful when modifying MAC filters packet: reset network header if packet shorter than ll reserved space qlogic: check kstrtoul() for errors tcp: remove DELAYED ACK events in DCTCP drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() net/ethernet/freescale/fman: fix cross-build error net: usb: rtl8150: demote allmulti message to dev_dbg() net: qca_spi: Avoid packet drop during initial sync net: qca_spi: Make sure the QCA7000 reset is triggered net: qca_spi: Fix log level if probe fails tcp: identify cryptic messages as TCP seq # bugs staging: android: ion: check for kref overflow KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer ext4: fix spectre gadget in ext4_mb_regular_allocator() parisc: Remove ordered stores from syscall.S xfrm_user: prevent leaking 2 bytes of kernel memory netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state packet: refine ring v3 block size test to hold one frame bridge: Propagate vlan add failure to user parisc: Remove unnecessary barriers from spinlock.h PCI: hotplug: Don't leak pci_slot on registration failure PCI: Skip MPS logic for Virtual Functions (VFs) PCI: pciehp: Fix use-after-free on unplug i2c: imx: Fix race condition in dma read reiserfs: fix broken xattr handling (heap corruption, bad retval) Linux 4.4.152 Change-Id: I73c1d3bcfb25d83fa0985b095a6426c207cd2726 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
* | \ \ \ \ \ \ \ \ \ \ \ \ \ Merge android-4.4.194 (a749771) into msm-4.4Srinivasarao P2019-09-24
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-a749771 Linux 4.4.194 net_sched: let qdisc_put() accept NULL pointer ARC: export "abort" for modules media: technisat-usb2: break out of loop at end of buffer floppy: fix usercopy direction keys: Fix missing null pointer check in request_key_auth_describe() dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe() net: seeq: Fix the function used to release some memory in an error handling path tools/power turbostat: fix buffer overrun sky2: Disable MSI on yet another ASUS boards (P6Xxxx) cifs: Use kzfree() to zero out the password cifs: set domainName when a domain-key is used in multiuser NFSv2: Fix write regression NFSv2: Fix eof handling netfilter: nf_conntrack_ftp: Fix debug output x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines r8152: Set memory to all 0xFFs on failed reg reads ARM: 8874/1: mm: only adjust sections of valid mm structures Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105 NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup NFSv4: Fix return values for nfs4_file_open() s390/bpf: use 32-bit index for tail calls ARM: OMAP2+: Fix omap4 errata warning on other SoCs s390/bpf: fix lcgr instruction encoding mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings tty/serial: atmel: reschedule TX after RX was started serial: sprd: correct the wrong sequence of arguments KVM: coalesced_mmio: add bounds checking xen-netfront: do not assume sk_buff_head list is empty in error handling x86/boot: Add missing bootparam that breaks boot on some platforms media: tm6000: double free if usb disconnect while streaming USB: usbcore: Fix slab-out-of-bounds bug during device reset ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send() x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning crypto: talitos - check data blocksize in ablkcipher. crypto: talitos - check AES key size driver core: Fix use-after-free and double free on glue directory clk: rockchip: Don't yell about bad mmc phases when getting MIPS: VDSO: Use same -m%-float cflag as the kernel proper MIPS: VDSO: Prevent use of smp_processor_id() KVM: nVMX: handle page fault in vmread KVM: x86: work around leak of uninitialized stack contents KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl genirq: Prevent NULL pointer dereference in resend_irqs() Btrfs: fix assertion failure during fsync and use of stale transaction Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur" tun: fix use-after-free when register netdev failed tipc: add NULL pointer check before calling kfree_rcu tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR sctp: use transport pf_retrans in sctp_do_8_2_transport_strike sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()' sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero net: Fix null de-reference of device refcount isdn/capi: check message length in capi_write() ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' cdc_ether: fix rndis support for Mediatek based smartphones bridge/mdb: remove wrong use of NLM_F_MULTI Change-Id: I950778c771159febb721a4ebc2656c57ef40ad83 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * \ \ \ \ \ \ \ \ \ \ \ \ \ \ Merge 4.4.194 into android-4.4Greg Kroah-Hartman2019-09-21
| |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | |_|_|_|_|_|_|_|_|_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.194 bridge/mdb: remove wrong use of NLM_F_MULTI cdc_ether: fix rndis support for Mediatek based smartphones ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' isdn/capi: check message length in capi_write() net: Fix null de-reference of device refcount sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()' sctp: use transport pf_retrans in sctp_do_8_2_transport_strike tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR tipc: add NULL pointer check before calling kfree_rcu tun: fix use-after-free when register netdev failed Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur" Btrfs: fix assertion failure during fsync and use of stale transaction genirq: Prevent NULL pointer dereference in resend_irqs() KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl KVM: x86: work around leak of uninitialized stack contents KVM: nVMX: handle page fault in vmread MIPS: VDSO: Prevent use of smp_processor_id() MIPS: VDSO: Use same -m%-float cflag as the kernel proper clk: rockchip: Don't yell about bad mmc phases when getting driver core: Fix use-after-free and double free on glue directory crypto: talitos - check AES key size crypto: talitos - check data blocksize in ablkcipher. x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send() ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs USB: usbcore: Fix slab-out-of-bounds bug during device reset media: tm6000: double free if usb disconnect while streaming x86/boot: Add missing bootparam that breaks boot on some platforms xen-netfront: do not assume sk_buff_head list is empty in error handling KVM: coalesced_mmio: add bounds checking serial: sprd: correct the wrong sequence of arguments tty/serial: atmel: reschedule TX after RX was started mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings s390/bpf: fix lcgr instruction encoding ARM: OMAP2+: Fix omap4 errata warning on other SoCs s390/bpf: use 32-bit index for tail calls NFSv4: Fix return values for nfs4_file_open() NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105 ARM: 8874/1: mm: only adjust sections of valid mm structures r8152: Set memory to all 0xFFs on failed reg reads x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines netfilter: nf_conntrack_ftp: Fix debug output NFSv2: Fix eof handling NFSv2: Fix write regression cifs: set domainName when a domain-key is used in multiuser cifs: Use kzfree() to zero out the password sky2: Disable MSI on yet another ASUS boards (P6Xxxx) tools/power turbostat: fix buffer overrun net: seeq: Fix the function used to release some memory in an error handling path dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe() keys: Fix missing null pointer check in request_key_auth_describe() floppy: fix usercopy direction media: technisat-usb2: break out of loop at end of buffer ARC: export "abort" for modules net_sched: let qdisc_put() accept NULL pointer Linux 4.4.194 Change-Id: Ia27dd36133c3294c756d2376357572325afcd6fb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | | | | | | | | | keys: Fix missing null pointer check in request_key_auth_describe()Hillf Danton2019-09-21
| | | |_|_|_|_|_|_|_|_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit d41a3effbb53b1bcea41e328d16a4d046a508381 ] If a request_key authentication token key gets revoked, there's a window in which request_key_auth_describe() can see it with a NULL payload - but it makes no check for this and something like the following oops may occur: BUG: Kernel NULL pointer dereference at 0x00000038 Faulting instruction address: 0xc0000000004ddf30 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [...] request_key_auth_describe+0x90/0xd0 LR [...] request_key_auth_describe+0x54/0xd0 Call Trace: [...] request_key_auth_describe+0x54/0xd0 (unreliable) [...] proc_keys_show+0x308/0x4c0 [...] seq_read+0x3d0/0x540 [...] proc_reg_read+0x90/0x110 [...] __vfs_read+0x3c/0x70 [...] vfs_read+0xb4/0x1b0 [...] ksys_read+0x7c/0x130 [...] system_call+0x5c/0x70 Fix this by checking for a NULL pointer when describing such a key. Also make the read routine check for a NULL pointer to be on the safe side. [DH: Modified to not take already-held rcu lock and modified to also check in the read routine] Fixes: 04c567d9313e ("[PATCH] Keys: Fix race between two instantiators of a key") Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com> Signed-off-by: Hillf Danton <hdanton@sina.com> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | | | | | | | | | | | | | Merge android-4.4.188 (886d085) into msm-4.4Srinivasarao P2019-08-07
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-886d085 Linux 4.4.188 xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() s390/dasd: fix endless loop after read unit address configuration selinux: fix memory leak in policydb_init() x86/kvm: Don't call kvm_spurious_fault() from .fixup ipc/mqueue.c: only perform resource calculation if user valid uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers coda: fix build using bare-metal toolchain coda: add error handling for fget mm/cma.c: fail if fixed declaration can't be honored x86: math-emu: Hide clang warnings for 16-bit overflow x86/apic: Silence -Wtype-limits compiler warnings be2net: Signal that the device cannot transmit during reconfiguration ACPI: fix false-positive -Wuninitialized warning scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized ceph: fix improper use of smp_mb__before_atomic() btrfs: fix minimum number of chunk errors for DUP fs/adfs: super: fix use-after-free bug dmaengine: rcar-dmac: Reject zero-length slave DMA requests MIPS: lantiq: Fix bitfield masking kernel/module.c: Only return -EEXIST for modules that have finished loading ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend ARM: riscpc: fix DMA Change-Id: I5117beda77a1297c46e7b105bd70d1d726dd6d2b Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | | | | | | | | | Merge 4.4.188 into android-4.4Greg Kroah-Hartman2019-08-06
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.188 ARM: riscpc: fix DMA ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend kernel/module.c: Only return -EEXIST for modules that have finished loading MIPS: lantiq: Fix bitfield masking dmaengine: rcar-dmac: Reject zero-length slave DMA requests fs/adfs: super: fix use-after-free bug btrfs: fix minimum number of chunk errors for DUP ceph: fix improper use of smp_mb__before_atomic() scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized ACPI: fix false-positive -Wuninitialized warning be2net: Signal that the device cannot transmit during reconfiguration x86/apic: Silence -Wtype-limits compiler warnings x86: math-emu: Hide clang warnings for 16-bit overflow mm/cma.c: fail if fixed declaration can't be honored coda: add error handling for fget coda: fix build using bare-metal toolchain uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers ipc/mqueue.c: only perform resource calculation if user valid x86/kvm: Don't call kvm_spurious_fault() from .fixup selinux: fix memory leak in policydb_init() s390/dasd: fix endless loop after read unit address configuration xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() Linux 4.4.188 Change-Id: Id4d8157fe94d0c6be18731ff0612500394eafec2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | | | | | | | | selinux: fix memory leak in policydb_init()Ondrej Mosnacek2019-08-06
| | | |_|_|_|_|_|_|_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 45385237f65aeee73641f1ef737d7273905a233f upstream. Since roles_init() adds some entries to the role hash table, we need to destroy also its keys/values on error, otherwise we get a memory leak in the error path. Cc: <stable@vger.kernel.org> Reported-by: syzbot+fee3a14d4cdf92646287@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | | | | | | | | | Merge android-4.4.185 (14e1196) into msm-4.4Srinivasarao P2019-07-11
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-14e1196 ANDROID: Communicates LMK events to userland where they can be logged Linux 4.4.185 dmaengine: imx-sdma: remove BD_INTR for channel0 KVM: x86: degrade WARN to pr_warn_ratelimited arm64, vdso: Define vdso_{start,end} as array ARC: handle gcc generated __builtin_trap for older compiler tty: rocket: fix incorrect forward declaration of 'rp_init()' btrfs: Ensure replaced device doesn't have pending chunk allocation lib/mpi: Fix karactx leak in mpi_powm ALSA: usb-audio: fix sign unintended sign extension on left shifts ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages ALSA: seq: fix incorrect order of dest_client/dest_ports arguments crypto: user - prevent operating on larval algorithms ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME MIPS: Workaround GCC __builtin_unreachable reordering bug bug.h: work around GCC PR82365 in BUG() swiotlb: Make linux/swiotlb.h standalone includible mfd: omap-usb-tll: Fix register offsets MIPS: math-emu: do not use bools for arithmetic ARC: fix build warning in elf.h ARC: Assume multiplier is always present scsi: hpsa: correct ioaccel2 chaining usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] ASoC: max98090: remove 24-bit format support if RJ is 0 spi: bitbang: Fix NULL pointer dereference in spi_unregister_master ASoC : cs4265 : readable register too low um: Compile with modern headers Bluetooth: Fix faulty expression for minimum encryption key size check net: check before dereferencing netdev_ops during busy poll bonding: Always enable vlan tx offload ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop team: Always enable vlan tx offload tipc: check msg->req data len in tipc_nl_compat_bearer_disable tipc: change to use register_pernet_device sctp: change to hold sk after auth shkey is created successfully cpu/speculation: Warn on unsupported mitigations= parameter x86/speculation: Allow guests to use SSBD even if host does not ovl: modify ovl_permission() to do checks on two inodes KVM: X86: Fix scan ioapic use-before-initialization net/9p: include trans_common.h to fix missing prototype warning. 9p: p9dirent_read: check network-provided name length 9p/rdma: remove useless check in cm_event_handler 9p: acl: fix uninitialized iattr access 9p/rdma: do not disconnect on down_interruptible EAGAIN perf help: Remove needless use of strncpy() perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul mac80211: drop robust management frames from unknown TA cfg80211: fix memory leak of wiphy device name SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write Bluetooth: Fix regression with minimum encryption key size alignment Bluetooth: Align minimum encryption key size for LE and BR/EDR connections ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX can: purge socket error queue on sock destruct can: flexcan: fix timeout when set small bitrate btrfs: start readahead also in seed devices Btrfs: fix race between readahead and device replace/removal hwmon: (pmbus/core) Treat parameters as paged if on multiple pages s390/qeth: fix VLAN attribute in bridge_hostnotify udev event scsi: ufs: Check that space was properly alloced in copy_query_response scripts/checkstack.pl: Fix arm64 wrong or unknown architecture sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD net: hns: Fix loopback test failed at copper ports MIPS: uprobes: remove set but not used variable 'epc' IB/hfi1: Insure freeze_work work_struct is canceled on shutdown parisc: Fix compiler warnings in float emulation code parport: Fix mem leak in parport_register_dev_model apparmor: enforce nullbyte at end of tag string Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD usb: chipidea: udc: workaround for endpoint conflict issue gcc-9: silence 'address-of-packed-member' warning tracing: Silence GCC 9 array bounds warning scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() mm/page_idle.c: fix oops because end_pfn is larger than max_pfn fs/binfmt_flat.c: make load_flat_shared_library() work ANDROID: Fixes to locking around handle_lmk_event ANDROID: Avoid taking multiple locks in handle_lmk_event Side effects from the commit "ANDROID: Communicates LMK events to userland where they can be logged" is addressed here, so picking this commit which ignored from 4.4.180 merge. Conflicts: drivers/staging/android/lowmemorykiller.c Change-Id: I1156dc21d0f35e74e86d2ad202f99b7bc173b874 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | | | | | | | | Merge 4.4.185 into android-4.4Greg Kroah-Hartman2019-07-10
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.185 fs/binfmt_flat.c: make load_flat_shared_library() work mm/page_idle.c: fix oops because end_pfn is larger than max_pfn scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() tracing: Silence GCC 9 array bounds warning gcc-9: silence 'address-of-packed-member' warning usb: chipidea: udc: workaround for endpoint conflict issue Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD apparmor: enforce nullbyte at end of tag string parport: Fix mem leak in parport_register_dev_model parisc: Fix compiler warnings in float emulation code IB/hfi1: Insure freeze_work work_struct is canceled on shutdown MIPS: uprobes: remove set but not used variable 'epc' net: hns: Fix loopback test failed at copper ports sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD scripts/checkstack.pl: Fix arm64 wrong or unknown architecture scsi: ufs: Check that space was properly alloced in copy_query_response s390/qeth: fix VLAN attribute in bridge_hostnotify udev event hwmon: (pmbus/core) Treat parameters as paged if on multiple pages Btrfs: fix race between readahead and device replace/removal btrfs: start readahead also in seed devices can: flexcan: fix timeout when set small bitrate can: purge socket error queue on sock destruct ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX Bluetooth: Align minimum encryption key size for LE and BR/EDR connections Bluetooth: Fix regression with minimum encryption key size alignment SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write cfg80211: fix memory leak of wiphy device name mac80211: drop robust management frames from unknown TA perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul perf help: Remove needless use of strncpy() 9p/rdma: do not disconnect on down_interruptible EAGAIN 9p: acl: fix uninitialized iattr access 9p/rdma: remove useless check in cm_event_handler 9p: p9dirent_read: check network-provided name length net/9p: include trans_common.h to fix missing prototype warning. KVM: X86: Fix scan ioapic use-before-initialization ovl: modify ovl_permission() to do checks on two inodes x86/speculation: Allow guests to use SSBD even if host does not cpu/speculation: Warn on unsupported mitigations= parameter sctp: change to hold sk after auth shkey is created successfully tipc: change to use register_pernet_device tipc: check msg->req data len in tipc_nl_compat_bearer_disable team: Always enable vlan tx offload ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop bonding: Always enable vlan tx offload net: check before dereferencing netdev_ops during busy poll Bluetooth: Fix faulty expression for minimum encryption key size check um: Compile with modern headers ASoC : cs4265 : readable register too low spi: bitbang: Fix NULL pointer dereference in spi_unregister_master ASoC: max98090: remove 24-bit format support if RJ is 0 usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC scsi: hpsa: correct ioaccel2 chaining ARC: Assume multiplier is always present ARC: fix build warning in elf.h MIPS: math-emu: do not use bools for arithmetic mfd: omap-usb-tll: Fix register offsets swiotlb: Make linux/swiotlb.h standalone includible bug.h: work around GCC PR82365 in BUG() MIPS: Workaround GCC __builtin_unreachable reordering bug ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME crypto: user - prevent operating on larval algorithms ALSA: seq: fix incorrect order of dest_client/dest_ports arguments ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages ALSA: usb-audio: fix sign unintended sign extension on left shifts lib/mpi: Fix karactx leak in mpi_powm btrfs: Ensure replaced device doesn't have pending chunk allocation tty: rocket: fix incorrect forward declaration of 'rp_init()' ARC: handle gcc generated __builtin_trap for older compiler arm64, vdso: Define vdso_{start,end} as array KVM: x86: degrade WARN to pr_warn_ratelimited dmaengine: imx-sdma: remove BD_INTR for channel0 Linux 4.4.185 Change-Id: I222f9f81b9d7fba3cd3ac028b473b1ea2fae7cf0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | | | | | | | apparmor: enforce nullbyte at end of tag stringJann Horn2019-07-10
| | | |_|_|_|_|_|_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 8404d7a674c49278607d19726e0acc0cae299357 upstream. A packed AppArmor policy contains null-terminated tag strings that are read by unpack_nameX(). However, unpack_nameX() uses string functions on them without ensuring that they are actually null-terminated, potentially leading to out-of-bounds accesses. Make sure that the tag string is null-terminated before passing it to strcmp(). Cc: stable@vger.kernel.org Fixes: 736ec752d95e ("AppArmor: policy routines for loading and unpacking policy") Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | | | | | | | | Merge android-4.4.180 (71cb827) into msm-4.4Srinivasarao P2019-05-23
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-71cb827 Linux 4.4.180 powerpc/lib: fix book3s/32 boot failure due to code patching powerpc/booke64: set RI in default MSR drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl bonding: fix arp_validate toggling in active-backup mode ipv4: Fix raw socket lookup for local traffic vrf: sit mtu should not be updated when vrf netdev is the link vlan: disable SIOCSHWTSTAMP in container packet: Fix error path in packet_init net: ucc_geth - fix Oops when changing number of buffers in the ring bridge: Fix error path for kobject_init_and_add() powerpc/64s: Include cpu header USB: serial: fix unthrottle races USB: serial: use variable for status x86/bugs: Change L1TF mitigation string to match upstream x86/speculation/mds: Fix documentation typo Documentation: Correct the possible MDS sysfs values x86/mds: Add MDSUM variant to the MDS documentation x86/speculation/mds: Add 'mitigations=' support for MDS x86/speculation: Support 'mitigations=' cmdline option cpu/speculation: Add 'mitigations=' cmdline option x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off x86/speculation/mds: Fix comment x86/speculation/mds: Add SMT warning message x86/speculation: Move arch_smt_update() call to after mitigation decisions x86/cpu/bugs: Use __initconst for 'const' init data Documentation: Add MDS vulnerability documentation Documentation: Move L1TF to separate directory x86/speculation/mds: Add mitigation mode VMWERV x86/speculation/mds: Add sysfs reporting for MDS x86/speculation/l1tf: Document l1tf in sysfs x86/speculation/mds: Add mitigation control for MDS x86/speculation/mds: Conditionally clear CPU buffers on idle entry x86/speculation/mds: Clear CPU buffers on exit to user x86/speculation/mds: Add mds_clear_cpu_buffers() x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests x86/speculation/mds: Add BUG_MSBDS_ONLY x86/speculation/mds: Add basic bug infrastructure for MDS x86/speculation: Consolidate CPU whitelists x86/msr-index: Cleanup bit defines kvm: x86: Report STIBP on GET_SUPPORTED_CPUID x86/speculation: Provide IBPB always command line options x86/speculation: Add seccomp Spectre v2 user space protection mode x86/speculation: Enable prctl mode for spectre_v2_user x86/speculation: Add prctl() control for indirect branch speculation x86/speculation: Prevent stale SPEC_CTRL msr content x86/speculation: Prepare arch_smt_update() for PRCTL mode x86/speculation: Split out TIF update x86/speculation: Prepare for conditional IBPB in switch_mm() x86/speculation: Avoid __switch_to_xtra() calls x86/process: Consolidate and simplify switch_to_xtra() code x86/speculation: Prepare for per task indirect branch speculation control x86/speculation: Add command line control for indirect branch speculation x86/speculation: Unify conditional spectre v2 print functions x86/speculataion: Mark command line parser data __initdata x86/speculation: Mark string arrays const correctly x86/speculation: Reorder the spec_v2 code x86/speculation: Rework SMT state change sched: Add sched_smt_active() x86/Kconfig: Select SCHED_SMT if SMP enabled x86/speculation: Reorganize speculation control MSRs update x86/speculation: Rename SSBD update functions x86/speculation: Disable STIBP when enhanced IBRS is in use x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() x86/speculation: Remove unnecessary ret variable in cpu_show_common() x86/speculation: Clean up spectre_v2_parse_cmdline() x86/speculation: Update the TIF_SSBD comment x86/speculation: Propagate information about RSB filling mitigation to sysfs x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation x86/speculation: Apply IBPB more strictly to avoid cross-process data leak x86/mm: Use WRITE_ONCE() when setting PTEs KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled x86/cpu: Sanitize FAM6_ATOM naming x86/microcode: Update the new microcode revision unconditionally x86/microcode: Make sure boot_cpu_data.microcode is up-to-date x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features x86/bugs: Add AMD's SPEC_CTRL MSR usage x86/bugs: Add AMD's variant of SSB_NO x86/speculation: Simplify the CPU bug detection logic x86/speculation: Support Enhanced IBRS on future CPUs x86/cpufeatures: Hide AMD-specific speculation flags x86/MCE: Save microcode revision in machine check records x86/microcode/intel: Check microcode revision before updating sibling threads bitops: avoid integer overflow in GENMASK(_ULL) x86: stop exporting msr-index.h to userland x86/microcode/intel: Add a helper which gives the microcode revision locking/static_keys: Provide DECLARE and well as DEFINE macros Don't jump to compute_result state from check_result state x86/vdso: Pass --eh-frame-hdr to the linker cw1200: fix missing unlock on error in cw1200_hw_scan() gpu: ipu-v3: dp: fix CSC handling selftests/net: correct the return value for run_netsocktests s390: ctcm: fix ctcm_new_device error return code ipvs: do not schedule icmp errors from tunnels init: initialize jump labels before command line option parsing tools lib traceevent: Fix missing equality check for strcmp KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing s390/3270: fix lockdep false positive on view->lock s390/dasd: Fix capacity calculation for large volumes libnvdimm/btt: Fix a kmemdup failure check HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys HID: input: add mapping for Expose/Overview key iio: adc: xilinx: fix potential use-after-free on remove platform/x86: sony-laptop: Fix unintentional fall-through netfilter: compat: initialize all fields in xt_init timer/debug: Change /proc/timer_stats from 0644 to 0600 ASoC: Intel: avoid Oops if DMA setup fails ipv6: fix a potential deadlock in do_ipv6_setsockopt() UAS: fix alignment of scatter/gather segments Bluetooth: Align minimum encryption key size for LE and BR/EDR connections Bluetooth: hidp: fix buffer overflow scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines usb: dwc3: Fix default lpm_nyet_threshold value genirq: Prevent use-after-free and work list corruption iommu/amd: Set exclusion range correctly scsi: csiostor: fix missing data copy in csio_scsi_err_handler() perf/x86/intel: Fix handling of wakeup_events for multi-entry PEBS ASoC: tlv320aic32x4: Fix Common Pins ASoC: cs4270: Set auto-increment bit for register writes ASoC:soc-pcm:fix a codec fixup issue in TDM case scsi: libsas: fix a race condition when smp task timeout media: v4l2: i2c: ov7670: Fix PLL bypass register values x86/mce: Improve error message when kernel cannot recover, p2 selinux: never allow relabeling on context mounts Input: snvs_pwrkey - initialize necessary driver data before enabling IRQ staging: iio: adt7316: fix the dac write calculation staging: iio: adt7316: fix the dac read calculation staging: iio: adt7316: allow adt751x to use internal vref for all dacs usb: usbip: fix isoc packet num validation in get_pipe ARM: iop: don't use using 64-bit DMA masks ARM: orion: don't use using 64-bit DMA masks xsysace: Fix error handling in ace_setup hugetlbfs: fix memory leak for resv_map net: hns: Fix WARNING when remove HNS driver with SMMU enabled net: hns: Use NAPI_POLL_WEIGHT for hns driver scsi: storvsc: Fix calculation of sub-channel count vfio/pci: use correct format characters rtc: da9063: set uie_unsupported when relevant debugfs: fix use-after-free on symlink traversal jffs2: fix use-after-free on symlink traversal bonding: show full hw address in sysfs for slave entries igb: Fix WARN_ONCE on runtime suspend rtc: sh: Fix invalid alarm warning for non-enabled alarm HID: debug: fix race condition with between rdesc_show() and device removal USB: core: Fix bug caused by duplicate interface PM usage counter USB: core: Fix unterminated string returned by usb_string() USB: w1 ds2490: Fix bug caused by improper use of altsetting array USB: yurex: Fix protection fault after device removal packet: validate msg_namelen in send directly bnxt_en: Improve multicast address setup logic. ipv6: invert flowlabel sharing check in process and user mode ipv6/flowlabel: wait rcu grace period before put_pid() ipv4: ip_do_fragment: Preserve skb_iif during fragmentation ALSA: line6: use dynamic buffers vfio/type1: Limit DMA mappings per container kconfig/[mn]conf: handle backspace (^H) key libata: fix using DMA buffers on stack scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN ceph: fix use-after-free on symlink traversal usb: u132-hcd: fix resource leak scsi: qla4xxx: fix a potential NULL pointer dereference net: ethernet: ti: fix possible object reference leak net: ibm: fix possible object reference leak net: xilinx: fix possible object reference leak net: ks8851: Set initial carrier state to down net: ks8851: Delay requesting IRQ until opened net: ks8851: Reassert reset pin if chip ID check fails net: ks8851: Dequeue RX packets explicitly ARM: dts: pfla02: increase phy reset duration usb: gadget: net2272: Fix net2272_dequeue() usb: gadget: net2280: Fix net2280_dequeue() usb: gadget: net2280: Fix overrun of OUT messages sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init() netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING qlcnic: Avoid potential NULL pointer dereference usbnet: ipheth: fix potential null pointer dereference in ipheth_carrier_set usbnet: ipheth: prevent TX queue timeouts when device not ready Documentation: Add nospectre_v1 parameter powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup' powerpc/fsl: Sanitize the syscall table for NXP PowerPC 32 bit platforms powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit) powerpc/fsl: Emulate SPRN_BUCSR register powerpc/fsl: Flush branch predictor when entering KVM powerpc/fsl: Enable runtime patching if nospectre_v2 boot arg is used ipv4: set the tcp_min_rtt_wlen range from 0 to one day net: stmmac: move stmmac_check_ether_addr() to driver probe team: fix possible recursive locking when add slaves ipv4: add sanity checks in ipv4_link_failure() Revert "block/loop: Use global lock for ioctl() operation." bpf: reject wrong sized filters earlier tipc: check link name with right length in tipc_nl_compat_link_set tipc: check bearer name with right length in tipc_nl_compat_bearer_enable netfilter: ebtables: CONFIG_COMPAT: drop a bogus WARN_ON NFS: Forbid setting AF_INET6 to "struct sockaddr_in"->sin_family. fs/proc/proc_sysctl.c: Fix a NULL pointer dereference intel_th: gth: Fix an off-by-one in output unassigning slip: make slhc_free() silently accept an error pointer tipc: handle the err returned from cmd header function powerpc/fsl: Fix the flush of branch predictor. powerpc/security: Fix spectre_v2 reporting powerpc/fsl: Update Spectre v2 reporting powerpc/fsl: Flush the branch predictor at each kernel entry (64bit) powerpc/fsl: Add nospectre_v2 command line argument powerpc/fsl: Fix spectre_v2 mitigations reporting powerpc/fsl: Add macro to flush the branch predictor powerpc/fsl: Add infrastructure to fixup branch predictor flush powerpc: Avoid code patching freed init sections powerpc/powernv: Query firmware for count cache flush settings powerpc/pseries: Query hypervisor for count cache flush settings powerpc/64s: Add support for software count cache flush powerpc/64s: Add new security feature flags for count cache flush powerpc/asm: Add a patch_site macro & helpers for patching instructions powerpc/fsl: Add barrier_nospec implementation for NXP PowerPC Book3E powerpc/64: Make meltdown reporting Book3S 64 specific powerpc/64: Call setup_barrier_nospec() from setup_arch() powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC powerpc/64: Make stf barrier PPC_BOOK3S_64 specific. powerpc/64: Disable the speculation barrier from the command line powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 powerpc/64s: Enhance the information in cpu_show_spectre_v1() powerpc: Use barrier_nospec in copy_from_user() powerpc/64: Use barrier_nospec in syscall entry powerpc/64s: Enable barrier_nospec based on firmware settings powerpc/64s: Patch barrier_nospec in modules powerpc/64s: Add support for ori barrier_nospec patching powerpc/64s: Add barrier_nospec powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit powerpc/64s: Fix section mismatch warnings from setup_rfi_flush() powerpc/pseries: Restore default security feature flags on setup powerpc: Move default security feature flags powerpc/pseries: Fix clearing of security feature flags powerpc/64s: Wire up cpu_show_spectre_v2() powerpc/64s: Wire up cpu_show_spectre_v1() powerpc/pseries: Use the security flags in pseries_setup_rfi_flush() powerpc/powernv: Use the security flags in pnv_setup_rfi_flush() powerpc/64s: Enhance the information in cpu_show_meltdown() powerpc/64s: Move cpu_show_meltdown() powerpc/powernv: Set or clear security feature flags powerpc/pseries: Set or clear security feature flags powerpc: Add security feature flags for Spectre/Meltdown powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags powerpc/rfi-flush: Differentiate enabled and patched flush types powerpc/rfi-flush: Always enable fallback flush on pseries powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code powerpc/powernv: Support firmware disable of RFI flush powerpc/pseries: Support firmware disable of RFI flush powerpc/64s: Improve RFI L1-D cache flush fallback powerpc/xmon: Add RFI flush related fields to paca dump USB: Consolidate LPM checks to avoid enabling LPM twice USB: Add new USB LPM helpers sunrpc: don't mark uninitialised items as VALID. nfsd: Don't release the callback slot unless it was actually held ceph: fix ci->i_head_snapc leak ceph: ensure d_name stability in ceph_dentry_hash() sched/numa: Fix a possible divide-by-zero trace: Fix preempt_enable_no_resched() abuse MIPS: scall64-o32: Fix indirect syscall number load cifs: do not attempt cifs operation on smb2+ rename error KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number kbuild: simplify ld-option implementation ANDROID: cuttlefish_defconfig: Disable DEVTMPFS ANDROID: Move from clang r349610 to r353983c. f2fs: fix to avoid accessing xattr across the boundary f2fs: fix to avoid potential race on sbi->unusable_block_count access/update f2fs: add tracepoint for f2fs_filemap_fault() f2fs: introduce DATA_GENERIC_ENHANCE f2fs: fix to handle error in f2fs_disable_checkpoint() f2fs: remove redundant check in f2fs_file_write_iter() f2fs: fix to be aware of readonly device in write_checkpoint() f2fs: fix to skip recovery on readonly device f2fs: fix to consider multiple device for readonly check f2fs: relocate chksum_offset for large_nat_bitmap feature f2fs: allow unfixed f2fs_checkpoint.checksum_offset f2fs: Replace spaces with tab f2fs: insert space before the open parenthesis '(' f2fs: allow address pointer number of dnode aligning to specified size f2fs: introduce f2fs_read_single_page() for cleanup f2fs: mark is_extension_exist() inline f2fs: fix to set FI_UPDATE_WRITE correctly f2fs: fix to avoid panic in f2fs_inplace_write_data() f2fs: fix to do sanity check on valid block count of segment f2fs: fix to do sanity check on valid node/block count f2fs: fix to avoid panic in do_recover_data() f2fs: fix to do sanity check on free nid f2fs: fix to do checksum even if inode page is uptodate f2fs: fix to avoid panic in f2fs_remove_inode_page() f2fs: fix to clear dirty inode in error path of f2fs_iget() f2fs: remove new blank line of f2fs kernel message f2fs: fix wrong __is_meta_io() macro f2fs: fix to avoid panic in dec_valid_node_count() f2fs: fix to avoid panic in dec_valid_block_count() f2fs: fix to use inline space only if inline_xattr is enable f2fs: fix to retrieve inline xattr space f2fs: fix error path of recovery f2fs: fix to avoid deadloop in foreground GC f2fs: data: fix warning Using plain integer as NULL pointer f2fs: add tracepoint for f2fs_file_write_iter() f2fs: add comment for conditional compilation statement f2fs: fix potential recursive call when enabling data_flush f2fs: improve discard handling with multi-device volumes f2fs: Reduce zoned block device memory usage f2fs: Fix use of number of devices Sleepable function handle_lmk_event() is called in atomic context, so ignored the commit "ANDROID: Communicates LMK events to userland where they can be logged" Conflicts: arch/powerpc/include/asm/uaccess.h kernel/cpu.c kernel/irq/manage.c kernel/time/timer_stats.c net/ipv4/sysctl_net_ipv4.c Change-Id: I3e5bd447057b44a28fc5000403198ae0fd644480 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | | | | | | | Merge 4.4.180 into android-4.4Greg Kroah-Hartman2019-05-16
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.180 kbuild: simplify ld-option implementation KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number cifs: do not attempt cifs operation on smb2+ rename error MIPS: scall64-o32: Fix indirect syscall number load trace: Fix preempt_enable_no_resched() abuse sched/numa: Fix a possible divide-by-zero ceph: ensure d_name stability in ceph_dentry_hash() ceph: fix ci->i_head_snapc leak nfsd: Don't release the callback slot unless it was actually held sunrpc: don't mark uninitialised items as VALID. USB: Add new USB LPM helpers USB: Consolidate LPM checks to avoid enabling LPM twice powerpc/xmon: Add RFI flush related fields to paca dump powerpc/64s: Improve RFI L1-D cache flush fallback powerpc/pseries: Support firmware disable of RFI flush powerpc/powernv: Support firmware disable of RFI flush powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again powerpc/rfi-flush: Always enable fallback flush on pseries powerpc/rfi-flush: Differentiate enabled and patched flush types powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration powerpc: Add security feature flags for Spectre/Meltdown powerpc/pseries: Set or clear security feature flags powerpc/powernv: Set or clear security feature flags powerpc/64s: Move cpu_show_meltdown() powerpc/64s: Enhance the information in cpu_show_meltdown() powerpc/powernv: Use the security flags in pnv_setup_rfi_flush() powerpc/pseries: Use the security flags in pseries_setup_rfi_flush() powerpc/64s: Wire up cpu_show_spectre_v1() powerpc/64s: Wire up cpu_show_spectre_v2() powerpc/pseries: Fix clearing of security feature flags powerpc: Move default security feature flags powerpc/pseries: Restore default security feature flags on setup powerpc/64s: Fix section mismatch warnings from setup_rfi_flush() powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit powerpc/64s: Add barrier_nospec powerpc/64s: Add support for ori barrier_nospec patching powerpc/64s: Patch barrier_nospec in modules powerpc/64s: Enable barrier_nospec based on firmware settings powerpc/64: Use barrier_nospec in syscall entry powerpc: Use barrier_nospec in copy_from_user() powerpc/64s: Enhance the information in cpu_show_spectre_v1() powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 powerpc/64: Disable the speculation barrier from the command line powerpc/64: Make stf barrier PPC_BOOK3S_64 specific. powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC powerpc/64: Call setup_barrier_nospec() from setup_arch() powerpc/64: Make meltdown reporting Book3S 64 specific powerpc/fsl: Add barrier_nospec implementation for NXP PowerPC Book3E powerpc/asm: Add a patch_site macro & helpers for patching instructions powerpc/64s: Add new security feature flags for count cache flush powerpc/64s: Add support for software count cache flush powerpc/pseries: Query hypervisor for count cache flush settings powerpc/powernv: Query firmware for count cache flush settings powerpc: Avoid code patching freed init sections powerpc/fsl: Add infrastructure to fixup branch predictor flush powerpc/fsl: Add macro to flush the branch predictor powerpc/fsl: Fix spectre_v2 mitigations reporting powerpc/fsl: Add nospectre_v2 command line argument powerpc/fsl: Flush the branch predictor at each kernel entry (64bit) powerpc/fsl: Update Spectre v2 reporting powerpc/security: Fix spectre_v2 reporting powerpc/fsl: Fix the flush of branch predictor. tipc: handle the err returned from cmd header function slip: make slhc_free() silently accept an error pointer intel_th: gth: Fix an off-by-one in output unassigning fs/proc/proc_sysctl.c: Fix a NULL pointer dereference NFS: Forbid setting AF_INET6 to "struct sockaddr_in"->sin_family. netfilter: ebtables: CONFIG_COMPAT: drop a bogus WARN_ON tipc: check bearer name with right length in tipc_nl_compat_bearer_enable tipc: check link name with right length in tipc_nl_compat_link_set bpf: reject wrong sized filters earlier Revert "block/loop: Use global lock for ioctl() operation." ipv4: add sanity checks in ipv4_link_failure() team: fix possible recursive locking when add slaves net: stmmac: move stmmac_check_ether_addr() to driver probe ipv4: set the tcp_min_rtt_wlen range from 0 to one day powerpc/fsl: Enable runtime patching if nospectre_v2 boot arg is used powerpc/fsl: Flush branch predictor when entering KVM powerpc/fsl: Emulate SPRN_BUCSR register powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit) powerpc/fsl: Sanitize the syscall table for NXP PowerPC 32 bit platforms powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup' powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg Documentation: Add nospectre_v1 parameter usbnet: ipheth: prevent TX queue timeouts when device not ready usbnet: ipheth: fix potential null pointer dereference in ipheth_carrier_set qlcnic: Avoid potential NULL pointer dereference netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init() usb: gadget: net2280: Fix overrun of OUT messages usb: gadget: net2280: Fix net2280_dequeue() usb: gadget: net2272: Fix net2272_dequeue() ARM: dts: pfla02: increase phy reset duration net: ks8851: Dequeue RX packets explicitly net: ks8851: Reassert reset pin if chip ID check fails net: ks8851: Delay requesting IRQ until opened net: ks8851: Set initial carrier state to down net: xilinx: fix possible object reference leak net: ibm: fix possible object reference leak net: ethernet: ti: fix possible object reference leak scsi: qla4xxx: fix a potential NULL pointer dereference usb: u132-hcd: fix resource leak ceph: fix use-after-free on symlink traversal scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN libata: fix using DMA buffers on stack kconfig/[mn]conf: handle backspace (^H) key vfio/type1: Limit DMA mappings per container ALSA: line6: use dynamic buffers ipv4: ip_do_fragment: Preserve skb_iif during fragmentation ipv6/flowlabel: wait rcu grace period before put_pid() ipv6: invert flowlabel sharing check in process and user mode bnxt_en: Improve multicast address setup logic. packet: validate msg_namelen in send directly USB: yurex: Fix protection fault after device removal USB: w1 ds2490: Fix bug caused by improper use of altsetting array USB: core: Fix unterminated string returned by usb_string() USB: core: Fix bug caused by duplicate interface PM usage counter HID: debug: fix race condition with between rdesc_show() and device removal rtc: sh: Fix invalid alarm warning for non-enabled alarm igb: Fix WARN_ONCE on runtime suspend bonding: show full hw address in sysfs for slave entries jffs2: fix use-after-free on symlink traversal debugfs: fix use-after-free on symlink traversal rtc: da9063: set uie_unsupported when relevant vfio/pci: use correct format characters scsi: storvsc: Fix calculation of sub-channel count net: hns: Use NAPI_POLL_WEIGHT for hns driver net: hns: Fix WARNING when remove HNS driver with SMMU enabled hugetlbfs: fix memory leak for resv_map xsysace: Fix error handling in ace_setup ARM: orion: don't use using 64-bit DMA masks ARM: iop: don't use using 64-bit DMA masks usb: usbip: fix isoc packet num validation in get_pipe staging: iio: adt7316: allow adt751x to use internal vref for all dacs staging: iio: adt7316: fix the dac read calculation staging: iio: adt7316: fix the dac write calculation Input: snvs_pwrkey - initialize necessary driver data before enabling IRQ selinux: never allow relabeling on context mounts x86/mce: Improve error message when kernel cannot recover, p2 media: v4l2: i2c: ov7670: Fix PLL bypass register values scsi: libsas: fix a race condition when smp task timeout ASoC:soc-pcm:fix a codec fixup issue in TDM case ASoC: cs4270: Set auto-increment bit for register writes ASoC: tlv320aic32x4: Fix Common Pins perf/x86/intel: Fix handling of wakeup_events for multi-entry PEBS scsi: csiostor: fix missing data copy in csio_scsi_err_handler() iommu/amd: Set exclusion range correctly genirq: Prevent use-after-free and work list corruption usb: dwc3: Fix default lpm_nyet_threshold value scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines Bluetooth: hidp: fix buffer overflow Bluetooth: Align minimum encryption key size for LE and BR/EDR connections UAS: fix alignment of scatter/gather segments ipv6: fix a potential deadlock in do_ipv6_setsockopt() ASoC: Intel: avoid Oops if DMA setup fails timer/debug: Change /proc/timer_stats from 0644 to 0600 netfilter: compat: initialize all fields in xt_init platform/x86: sony-laptop: Fix unintentional fall-through iio: adc: xilinx: fix potential use-after-free on remove HID: input: add mapping for Expose/Overview key HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys libnvdimm/btt: Fix a kmemdup failure check s390/dasd: Fix capacity calculation for large volumes s390/3270: fix lockdep false positive on view->lock KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing tools lib traceevent: Fix missing equality check for strcmp init: initialize jump labels before command line option parsing ipvs: do not schedule icmp errors from tunnels s390: ctcm: fix ctcm_new_device error return code selftests/net: correct the return value for run_netsocktests gpu: ipu-v3: dp: fix CSC handling cw1200: fix missing unlock on error in cw1200_hw_scan() x86/vdso: Pass --eh-frame-hdr to the linker Don't jump to compute_result state from check_result state locking/static_keys: Provide DECLARE and well as DEFINE macros x86/microcode/intel: Add a helper which gives the microcode revision x86: stop exporting msr-index.h to userland bitops: avoid integer overflow in GENMASK(_ULL) x86/microcode/intel: Check microcode revision before updating sibling threads x86/MCE: Save microcode revision in machine check records x86/cpufeatures: Hide AMD-specific speculation flags x86/speculation: Support Enhanced IBRS on future CPUs x86/speculation: Simplify the CPU bug detection logic x86/bugs: Add AMD's variant of SSB_NO x86/bugs: Add AMD's SPEC_CTRL MSR usage x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation x86/microcode: Make sure boot_cpu_data.microcode is up-to-date x86/microcode: Update the new microcode revision unconditionally x86/cpu: Sanitize FAM6_ATOM naming KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled x86/mm: Use WRITE_ONCE() when setting PTEs x86/speculation: Apply IBPB more strictly to avoid cross-process data leak x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation x86/speculation: Propagate information about RSB filling mitigation to sysfs x86/speculation: Update the TIF_SSBD comment x86/speculation: Clean up spectre_v2_parse_cmdline() x86/speculation: Remove unnecessary ret variable in cpu_show_common() x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() x86/speculation: Disable STIBP when enhanced IBRS is in use x86/speculation: Rename SSBD update functions x86/speculation: Reorganize speculation control MSRs update x86/Kconfig: Select SCHED_SMT if SMP enabled sched: Add sched_smt_active() x86/speculation: Rework SMT state change x86/speculation: Reorder the spec_v2 code x86/speculation: Mark string arrays const correctly x86/speculataion: Mark command line parser data __initdata x86/speculation: Unify conditional spectre v2 print functions x86/speculation: Add command line control for indirect branch speculation x86/speculation: Prepare for per task indirect branch speculation control x86/process: Consolidate and simplify switch_to_xtra() code x86/speculation: Avoid __switch_to_xtra() calls x86/speculation: Prepare for conditional IBPB in switch_mm() x86/speculation: Split out TIF update x86/speculation: Prepare arch_smt_update() for PRCTL mode x86/speculation: Prevent stale SPEC_CTRL msr content x86/speculation: Add prctl() control for indirect branch speculation x86/speculation: Enable prctl mode for spectre_v2_user x86/speculation: Add seccomp Spectre v2 user space protection mode x86/speculation: Provide IBPB always command line options kvm: x86: Report STIBP on GET_SUPPORTED_CPUID x86/msr-index: Cleanup bit defines x86/speculation: Consolidate CPU whitelists x86/speculation/mds: Add basic bug infrastructure for MDS x86/speculation/mds: Add BUG_MSBDS_ONLY x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests x86/speculation/mds: Add mds_clear_cpu_buffers() x86/speculation/mds: Clear CPU buffers on exit to user x86/speculation/mds: Conditionally clear CPU buffers on idle entry x86/speculation/mds: Add mitigation control for MDS x86/speculation/l1tf: Document l1tf in sysfs x86/speculation/mds: Add sysfs reporting for MDS x86/speculation/mds: Add mitigation mode VMWERV Documentation: Move L1TF to separate directory Documentation: Add MDS vulnerability documentation x86/cpu/bugs: Use __initconst for 'const' init data x86/speculation: Move arch_smt_update() call to after mitigation decisions x86/speculation/mds: Add SMT warning message x86/speculation/mds: Fix comment x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off cpu/speculation: Add 'mitigations=' cmdline option x86/speculation: Support 'mitigations=' cmdline option x86/speculation/mds: Add 'mitigations=' support for MDS x86/mds: Add MDSUM variant to the MDS documentation Documentation: Correct the possible MDS sysfs values x86/speculation/mds: Fix documentation typo x86/bugs: Change L1TF mitigation string to match upstream USB: serial: use variable for status USB: serial: fix unthrottle races powerpc/64s: Include cpu header bridge: Fix error path for kobject_init_and_add() net: ucc_geth - fix Oops when changing number of buffers in the ring packet: Fix error path in packet_init vlan: disable SIOCSHWTSTAMP in container vrf: sit mtu should not be updated when vrf netdev is the link ipv4: Fix raw socket lookup for local traffic bonding: fix arp_validate toggling in active-backup mode drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl powerpc/booke64: set RI in default MSR powerpc/lib: fix book3s/32 boot failure due to code patching Linux 4.4.180 Change-Id: If2d2fdd451b55c002666b32022b269cec9545607 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | | | | | | selinux: never allow relabeling on context mountsOndrej Mosnacek2019-05-16
| | | |_|_|_|_|_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a83d6ddaebe541570291205cb538e35ad4ff94f9 upstream. In the SECURITY_FS_USE_MNTPOINT case we never want to allow relabeling files/directories, so we should never set the SBLABEL_MNT flag. The 'special handling' in selinux_is_sblabel_mnt() is only intended for when the behavior is set to SECURITY_FS_USE_GENFS. While there, make the logic in selinux_is_sblabel_mnt() more explicit and add a BUILD_BUG_ON() to make sure that introducing a new SECURITY_FS_USE_* forces a review of the logic. Fixes: d5f3a5f6e7e7 ("selinux: add security in-core xattr support for pstore and debugfs") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | | | | | | | Merge android-4.4.179 (aab9adb) into msm-4.4Srinivasarao P2019-05-02
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-aab9adb Linux 4.4.179 kernel/sysctl.c: fix out-of-bounds access when setting file-max Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()" ALSA: info: Fix racy addition/deletion of nodes mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n device_cgroup: fix RCU imbalance in error case sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup Revert "kbuild: use -Oz instead of -Os when using clang" mac80211: do not call driver wake_tx_queue op during reconfig kprobes: Fix error check when reusing optimized probes kprobes: Mark ftrace mcount handler functions nokprobe x86/kprobes: Verify stack frame on kretprobe arm64: futex: Restore oldval initialization to work around buggy compilers crypto: x86/poly1305 - fix overflow during partial reduction ALSA: core: Fix card races between register and disconnect staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf staging: comedi: ni_usb6501: Fix use of uninitialized mutex staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf staging: comedi: vmk80xx: Fix use of uninitialized semaphore io: accel: kxcjk1013: restore the range after resume. iio: adc: at91: disable adc channel interrupt in timeout case iio: ad_sigma_delta: select channel when reading register iio/gyro/bmg160: Use millidegrees for temperature scale KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete modpost: file2alias: check prototype of handler modpost: file2alias: go back to simple devtable lookup crypto: crypto4xx - properly set IV after de- and encrypt ipv4: ensure rcu_read_lock() in ipv4_link_failure() ipv4: recompile ip options in ipv4_link_failure tcp: tcp_grow_window() needs to respect tcp_space() net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv net: bridge: multicast: use rcu to access port list from br_multicast_start_querier net: atm: Fix potential Spectre v1 vulnerabilities bonding: fix event handling for stacked bonds appletalk: Fix compile regression ovl: fix uid/gid when creating over whiteout tpm/tpm_crb: Avoid unaligned reads in crb_recv() include/linux/swap.h: use offsetof() instead of custom __swapoffset macro lib/div64.c: off by one in shift appletalk: Fix use-after-free in atalk_proc_exit ARM: 8839/1: kprobe: make patch_lock a raw_spinlock_t iommu/dmar: Fix buffer overflow during PCI bus notification crypto: sha512/arm - fix crash bug in Thumb2 build crypto: sha256/arm - fix crash bug in Thumb2 build cifs: fallback to older infolevels on findfirst queryinfo retry ACPI / SBS: Fix GPE storm on recent MacBookPro's ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms serial: uartps: console_setup() can't be placed to init section f2fs: fix to do sanity check with current segment number 9p locks: add mount option for lock retry interval 9p: do not trust pdu content for stat item size rsi: improve kernel thread handling to fix kernel panic ext4: prohibit fstrim in norecovery mode fix incorrect error code mapping for OBJECTID_NOT_FOUND x86/hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return an error iommu/vt-d: Check capability before disabling protected memory x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors x86/hpet: Prevent potential NULL pointer dereference perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test() perf tests: Fix a memory leak of cpu_map object in the openat_syscall_event_on_all_cpus test perf evsel: Free evsel->counts in perf_evsel__exit() perf top: Fix error handling in cmd_top() tools/power turbostat: return the exit status of a command thermal/int340x_thermal: fix mode setting thermal/int340x_thermal: Add additional UUIDs ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration mmc: davinci: remove extraneous __init annotation IB/mlx4: Fix race condition between catas error reset and aliasguid flows ALSA: sb8: add a check for request_region ALSA: echoaudio: add a check for ioremap_nocache ext4: report real fs size after failed resize ext4: add missing brelse() in add_new_gdb_meta_bg() perf/core: Restore mmap record type correctly PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller xtensa: fix return_address sched/fair: Do not re-read ->h_load_next during hierarchical load calculation xen: Prevent buffer overflow in privcmd ioctl arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value ARM: dts: at91: Fix typo in ISC_D0 on PC9 genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent() block: do not leak memory in bio_copy_user_iov() ASoC: fsl_esai: fix channel swap issue when stream starts include/linux/bitrev.h: fix constant bitrev ALSA: seq: Fix OOB-reads from strlcpy ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type net: ethtool: not call vzalloc for zero sized memory request netns: provide pure entropy for net_hash_mix() tcp: Ensure DCTCP reacts to losses sctp: initialize _pad of sockaddr_in before copying to user memory qmi_wwan: add Olicard 600 openvswitch: fix flow actions reallocation net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock(). ipv6: sit: reset ip header pointer in ipip6_rcv ipv6: Fix dangling pointer when ipv6 fragment tty: ldisc: add sysctl to prevent autoloading of ldiscs tty: mark Siemens R3964 line discipline as BROKEN lib/string.c: implement a basic bcmp x86/vdso: Drop implicit common-page-size linker flag x86: vdso: Use $LD instead of $CC to link x86/build: Specify elf_i386 linker emulation explicitly for i386 objects kbuild: clang: choose GCC_TOOLCHAIN_DIR not on LD binfmt_elf: switch to new creds when switching to new mm drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers dmaengine: tegra: avoid overflow of byte tracking x86/build: Mark per-CPU symbols as absolute explicitly for LLD wlcore: Fix memory leak in case wl12xx_fetch_firmware failure regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration netfilter: physdev: relax br_netfilter dependency dmaengine: imx-dma: fix warning comparison of distinct pointer types hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable soc/tegra: fuse: Fix illegal free of IO base address hwrng: virtio - Avoid repeated init of completion media: mt9m111: set initial frame size other than 0x0 tty: increase the default flip buffer limit to 2*640K ARM: avoid Cortex-A9 livelock on tight dmb loops mt7601u: bump supported EEPROM version soc: qcom: gsbi: Fix error handling in gsbi_probe() ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe cdrom: Fix race condition in cdrom_sysctl_register fbdev: fbmem: fix memory access if logo is bigger than the screen bcache: improve sysfs_strtoul_clamp() bcache: fix input overflow to sequential_cutoff bcache: fix input overflow to cache set sysfs file io_error_halflife ALSA: PCM: check if ops are defined before suspending PCM ARM: 8833/1: Ensure that NEON code always compiles with Clang kprobes: Prohibit probing on bsearch() leds: lp55xx: fix null deref on firmware load failure media: mx2_emmaprp: Correct return type for mem2mem buffer helpers media: s5p-g2d: Correct return type for mem2mem buffer helpers media: s5p-jpeg: Correct return type for mem2mem buffer helpers media: sh_veu: Correct return type for mem2mem buffer helpers SoC: imx-sgtl5000: add missing put_device() perf test: Fix failure of 'evsel-tp-sched' test on s390 scsi: megaraid_sas: return error when create DMA pool failed IB/mlx4: Increase the timeout for CM cache e1000e: Fix -Wformat-truncation warnings mmc: omap: fix the maximum timeout setting ARM: 8840/1: use a raw_spinlock_t in unwind coresight: etm4x: Add support to enable ETMv4.2 scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c usb: chipidea: Grab the (legacy) USB PHY by phandle first tools lib traceevent: Fix buffer overflow in arg_eval fs: fix guard_bio_eod to check for real EOD errors cifs: Fix NULL pointer dereference of devname dm thin: add sanity checks to thin-pool and external snapshot creation cifs: use correct format characters fs/file.c: initialize init_files.resize_wait f2fs: do not use mutex lock in atomic context ocfs2: fix a panic problem caused by o2cb_ctl mm/slab.c: kmemleak no scan alien caches mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512! mm/page_ext.c: fix an imbalance with kmemleak mm/cma.c: cma_declare_contiguous: correct err handling enic: fix build warning without CONFIG_CPUMASK_OFFSTACK sysctl: handle overflow for file-max gpio: gpio-omap: fix level interrupt idling tracing: kdb: Fix ftdump to not sleep h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux- CIFS: fix POSIX lock leak and invalid ptr deref tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped Bluetooth: Fix decrementing reference count twice in releasing socket i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified tty/serial: atmel: Add is_half_duplex helper lib/int_sqrt: optimize initial value compute ext4: cleanup bh release code in ext4_ind_remove_space() arm64: debug: Ensure debug handlers check triggering exception level arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals Make arm64 serial port config compatible with crosvm Fix merge issue with 4.4.178 Fix merge issue with 4.4.177 ANDROID: cuttlefish_defconfig: Enable CONFIG_OVERLAY_FS Change-Id: I0d6e7b00f0198867803d5fe305ce13e205cc7518 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | | | | | | Merge 4.4.179 into android-4.4Greg Kroah-Hartman2019-04-30
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.179 arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals arm64: debug: Ensure debug handlers check triggering exception level ext4: cleanup bh release code in ext4_ind_remove_space() lib/int_sqrt: optimize initial value compute tty/serial: atmel: Add is_half_duplex helper mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA Bluetooth: Fix decrementing reference count twice in releasing socket tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped CIFS: fix POSIX lock leak and invalid ptr deref h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux- tracing: kdb: Fix ftdump to not sleep gpio: gpio-omap: fix level interrupt idling sysctl: handle overflow for file-max enic: fix build warning without CONFIG_CPUMASK_OFFSTACK mm/cma.c: cma_declare_contiguous: correct err handling mm/page_ext.c: fix an imbalance with kmemleak mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512! mm/slab.c: kmemleak no scan alien caches ocfs2: fix a panic problem caused by o2cb_ctl f2fs: do not use mutex lock in atomic context fs/file.c: initialize init_files.resize_wait cifs: use correct format characters dm thin: add sanity checks to thin-pool and external snapshot creation cifs: Fix NULL pointer dereference of devname fs: fix guard_bio_eod to check for real EOD errors tools lib traceevent: Fix buffer overflow in arg_eval usb: chipidea: Grab the (legacy) USB PHY by phandle first scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c coresight: etm4x: Add support to enable ETMv4.2 ARM: 8840/1: use a raw_spinlock_t in unwind mmc: omap: fix the maximum timeout setting e1000e: Fix -Wformat-truncation warnings IB/mlx4: Increase the timeout for CM cache scsi: megaraid_sas: return error when create DMA pool failed perf test: Fix failure of 'evsel-tp-sched' test on s390 SoC: imx-sgtl5000: add missing put_device() media: sh_veu: Correct return type for mem2mem buffer helpers media: s5p-jpeg: Correct return type for mem2mem buffer helpers media: s5p-g2d: Correct return type for mem2mem buffer helpers media: mx2_emmaprp: Correct return type for mem2mem buffer helpers leds: lp55xx: fix null deref on firmware load failure kprobes: Prohibit probing on bsearch() ARM: 8833/1: Ensure that NEON code always compiles with Clang ALSA: PCM: check if ops are defined before suspending PCM bcache: fix input overflow to cache set sysfs file io_error_halflife bcache: fix input overflow to sequential_cutoff bcache: improve sysfs_strtoul_clamp() fbdev: fbmem: fix memory access if logo is bigger than the screen cdrom: Fix race condition in cdrom_sysctl_register ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe soc: qcom: gsbi: Fix error handling in gsbi_probe() mt7601u: bump supported EEPROM version ARM: avoid Cortex-A9 livelock on tight dmb loops tty: increase the default flip buffer limit to 2*640K media: mt9m111: set initial frame size other than 0x0 hwrng: virtio - Avoid repeated init of completion soc/tegra: fuse: Fix illegal free of IO base address hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable dmaengine: imx-dma: fix warning comparison of distinct pointer types netfilter: physdev: relax br_netfilter dependency media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting wlcore: Fix memory leak in case wl12xx_fetch_firmware failure x86/build: Mark per-CPU symbols as absolute explicitly for LLD dmaengine: tegra: avoid overflow of byte tracking drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers binfmt_elf: switch to new creds when switching to new mm kbuild: clang: choose GCC_TOOLCHAIN_DIR not on LD x86/build: Specify elf_i386 linker emulation explicitly for i386 objects x86: vdso: Use $LD instead of $CC to link x86/vdso: Drop implicit common-page-size linker flag lib/string.c: implement a basic bcmp tty: mark Siemens R3964 line discipline as BROKEN tty: ldisc: add sysctl to prevent autoloading of ldiscs ipv6: Fix dangling pointer when ipv6 fragment ipv6: sit: reset ip header pointer in ipip6_rcv net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock(). openvswitch: fix flow actions reallocation qmi_wwan: add Olicard 600 sctp: initialize _pad of sockaddr_in before copying to user memory tcp: Ensure DCTCP reacts to losses netns: provide pure entropy for net_hash_mix() net: ethtool: not call vzalloc for zero sized memory request ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type ALSA: seq: Fix OOB-reads from strlcpy include/linux/bitrev.h: fix constant bitrev ASoC: fsl_esai: fix channel swap issue when stream starts block: do not leak memory in bio_copy_user_iov() genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent() ARM: dts: at91: Fix typo in ISC_D0 on PC9 arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value xen: Prevent buffer overflow in privcmd ioctl sched/fair: Do not re-read ->h_load_next during hierarchical load calculation xtensa: fix return_address PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller perf/core: Restore mmap record type correctly ext4: add missing brelse() in add_new_gdb_meta_bg() ext4: report real fs size after failed resize ALSA: echoaudio: add a check for ioremap_nocache ALSA: sb8: add a check for request_region IB/mlx4: Fix race condition between catas error reset and aliasguid flows mmc: davinci: remove extraneous __init annotation ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration thermal/int340x_thermal: Add additional UUIDs thermal/int340x_thermal: fix mode setting tools/power turbostat: return the exit status of a command perf top: Fix error handling in cmd_top() perf evsel: Free evsel->counts in perf_evsel__exit() perf tests: Fix a memory leak of cpu_map object in the openat_syscall_event_on_all_cpus test perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test() x86/hpet: Prevent potential NULL pointer dereference x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors iommu/vt-d: Check capability before disabling protected memory x86/hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return an error fix incorrect error code mapping for OBJECTID_NOT_FOUND ext4: prohibit fstrim in norecovery mode rsi: improve kernel thread handling to fix kernel panic 9p: do not trust pdu content for stat item size 9p locks: add mount option for lock retry interval f2fs: fix to do sanity check with current segment number serial: uartps: console_setup() can't be placed to init section ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms ACPI / SBS: Fix GPE storm on recent MacBookPro's cifs: fallback to older infolevels on findfirst queryinfo retry crypto: sha256/arm - fix crash bug in Thumb2 build crypto: sha512/arm - fix crash bug in Thumb2 build iommu/dmar: Fix buffer overflow during PCI bus notification ARM: 8839/1: kprobe: make patch_lock a raw_spinlock_t appletalk: Fix use-after-free in atalk_proc_exit lib/div64.c: off by one in shift include/linux/swap.h: use offsetof() instead of custom __swapoffset macro tpm/tpm_crb: Avoid unaligned reads in crb_recv() ovl: fix uid/gid when creating over whiteout appletalk: Fix compile regression bonding: fix event handling for stacked bonds net: atm: Fix potential Spectre v1 vulnerabilities net: bridge: multicast: use rcu to access port list from br_multicast_start_querier net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv tcp: tcp_grow_window() needs to respect tcp_space() ipv4: recompile ip options in ipv4_link_failure ipv4: ensure rcu_read_lock() in ipv4_link_failure() crypto: crypto4xx - properly set IV after de- and encrypt modpost: file2alias: go back to simple devtable lookup modpost: file2alias: check prototype of handler tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU iio/gyro/bmg160: Use millidegrees for temperature scale iio: ad_sigma_delta: select channel when reading register iio: adc: at91: disable adc channel interrupt in timeout case io: accel: kxcjk1013: restore the range after resume. staging: comedi: vmk80xx: Fix use of uninitialized semaphore staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf staging: comedi: ni_usb6501: Fix use of uninitialized mutex staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf ALSA: core: Fix card races between register and disconnect crypto: x86/poly1305 - fix overflow during partial reduction arm64: futex: Restore oldval initialization to work around buggy compilers x86/kprobes: Verify stack frame on kretprobe kprobes: Mark ftrace mcount handler functions nokprobe kprobes: Fix error check when reusing optimized probes mac80211: do not call driver wake_tx_queue op during reconfig Revert "kbuild: use -Oz instead of -Os when using clang" sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup device_cgroup: fix RCU imbalance in error case mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n ALSA: info: Fix racy addition/deletion of nodes Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()" kernel/sysctl.c: fix out-of-bounds access when setting file-max Linux 4.4.179 Change-Id: Ib81a248d73ba7504649be93bd6882b290e548882 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | | | | | device_cgroup: fix RCU imbalance in error caseJann Horn2019-04-27
| | | |_|_|_|_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 0fcc4c8c044e117ac126ab6df4138ea9a67fa2a9 upstream. When dev_exception_add() returns an error (due to a failed memory allocation), make sure that we move the RCU preemption count back to where it was before we were called. We dropped the RCU read lock inside the loop body, so we can't just "break". sparse complains about this, too: $ make -s C=2 security/device_cgroup.o ./include/linux/rcupdate.h:647:9: warning: context imbalance in 'propagate_exception' - unexpected unlock Fixes: d591fb56618f ("device_cgroup: simplify cgroup tree walk in propagate_exception()") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Michal Hocko <mhocko@suse.com> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | | | | | | Merge android-4.4.177 (0c3b8c4) into msm-4.4Srinivasarao P2019-03-25
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-0c3b8c4 Linux 4.4.177 KVM: X86: Fix residual mmio emulation request to userspace KVM: nVMX: Ignore limit checks on VMX instructions using flat segments KVM: nVMX: Sign extend displacements of VMX instr's mem operands drm/radeon/evergreen_cs: fix missing break in switch statement media: uvcvideo: Avoid NULL pointer dereference at the end of streaming rcu: Do RCU GP kthread self-wakeup from softirq and interrupt PM / wakeup: Rework wakeup source timer cancellation nfsd: fix wrong check in write_v4_end_grace() nfsd: fix memory corruption caused by readdir NFS: Don't recoalesce on error in nfs_pageio_complete_mirror() NFS: Fix an I/O request leakage in nfs_do_recoalesce md: Fix failed allocation of md_register_thread perf intel-pt: Fix overlap calculation for padding perf auxtrace: Define auxtrace record alignment perf intel-pt: Fix CYC timestamp calculation after OVF NFS41: pop some layoutget errors to application dm: fix to_sector() for 32bit ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify powerpc/83xx: Also save/restore SPRG4-7 during suspend powerpc/powernv: Make opal log only readable by root powerpc/wii: properly disable use of BATs when requested. powerpc/32: Clear on-stack exception marker upon exception return jbd2: fix compile warning when using JBUFFER_TRACE jbd2: clear dirty flag when revoking a buffer from an older transaction serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup() serial: 8250_pci: Fix number of ports for ACCES serial cards perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks i2c: tegra: fix maximum transfer size parport_pc: fix find_superio io compare code, should use equal test. intel_th: Don't reference unassigned outputs kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv mm/vmalloc: fix size check for remap_vmalloc_range_partial() dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit clk: ingenic: Fix round_rate misbehaving with non-integer dividers ext2: Fix underflow in ext2_max_size() ext4: fix crash during online resizing cpufreq: pxa2xx: remove incorrect __init annotation cpufreq: tegra124: add missing of_node_put() crypto: pcbc - remove bogus memcpy()s with src == dest Btrfs: fix corruption reading shared and compressed extents after hole punching btrfs: ensure that a DUP or RAID1 block group has exactly two stripes m68k: Add -ffreestanding to CFLAGS scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock scsi: virtio_scsi: don't send sc payload with tmfs s390/virtio: handle find on invalid queue gracefully clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR regulator: s2mpa01: Fix step values for some LDOs regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 ACPI / device_sysfs: Avoid OF modalias creation for removed device tracing: Do not free iter->trace in fail path of tracing_open_pipe() CIFS: Fix read after write for files with read caching crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling stm class: Prevent division by zero tmpfs: fix uninitialized return value in shmem_link net: set static variable an initial value in atl2_probe() mac80211_hwsim: propagate genlmsg_reply return code phonet: fix building with clang ARC: uacces: remove lp_start, lp_end from clobber list tmpfs: fix link accounting when a tmpfile is linked in arm64: Relax GIC version check during early boot ASoC: topology: free created components in tplg load error net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins net: systemport: Fix reception of BPDUs scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task assoc_array: Fix shortcut creation ARM: 8824/1: fix a migrating irq bug when hotplug cpu Input: st-keyscan - fix potential zalloc NULL dereference i2c: cadence: Fix the hold bit setting Input: matrix_keypad - use flush_delayed_work() ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized s390/dasd: fix using offset into zero size array error gpu: ipu-v3: Fix CSI offsets for imx53 gpu: ipu-v3: Fix i.MX51 CSI control registers offset crypto: ahash - fix another early termination in hash walk crypto: caam - fixed handling of sg list stm class: Fix an endless loop in channel allocation ASoC: fsl_esai: fix register setting issue in RIGHT_J mode 9p/net: fix memory leak in p9_client_create 9p: use inode->i_lock to protect i_size_write() under 32-bit media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused() It's wrong to add len to sector_nr in raid10 reshape twice fs/9p: use fscache mutex rather than spinlock ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 tcp/dccp: remove reqsk_put() from inet_child_forget() gro_cells: make sure device is up in gro_cells_receive() net/hsr: fix possible crash in add_timer() vxlan: Fix GRO cells race condition between receive and link delete vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() ipvlan: disallow userns cap_net_admin to change global mode/flags missing barriers in some of unix_sock ->addr and ->path accesses net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 mdio_bus: Fix use-after-free on device_register fails net/x25: fix a race in x25_bind() net/mlx4_core: Fix qp mtt size calculation net/mlx4_core: Fix reset flow when in command polling mode tcp: handle inet_csk_reqsk_queue_add() failures route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race ravb: Decrease TxFIFO depth of Q3 and Q2 to one pptp: dst_release sk_dst_cache in pptp_sock_destruct net/x25: reset state in x25_connect() net/x25: fix use-after-free in x25_device_event() net: sit: fix UBSAN Undefined behaviour in check_6rd net: hsr: fix memory leak in hsr_dev_finalize() l2tp: fix infoleak in l2tp_ip6_recvmsg() KEYS: restrict /proc/keys by credentials at open time netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters netfilter: nfnetlink_log: just returns error for unknown command netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES udplite: call proper backlog handlers ARM: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420 Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls" ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock() iscsi_ibft: Fix missing break in switch statement Input: elan_i2c - add id for touchpad found in Lenovo s21e-20 Input: wacom_serial4 - add support for Wacom ArtPad II tablet MIPS: Remove function size check in get_frame_info() perf symbols: Filter out hidden symbols from labels s390/qeth: fix use-after-free in error path dmaengine: dmatest: Abort test in case of mapping error dmaengine: at_xdmac: Fix wrongfull report of a channel as in use irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable ARM: pxa: ssp: unneeded to free devm_ allocated data autofs: fix error return in autofs_fill_super() autofs: drop dentry reference only when it is never used fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone x86_64: increase stack size for KASAN_EXTRA x86/kexec: Don't setup EFI info if EFI runtime is not enabled cifs: fix computation for MAX_SMB2_HDR_SIZE platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 scsi: libfc: free skb when receiving invalid flogi resp nfs: Fix NULL pointer dereference of dev_name gpio: vf610: Mask all GPIO interrupts net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() net: hns: Fix wrong read accesses via Clause 45 MDIO protocol net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case xtensa: SMP: limit number of possible CPUs by NR_CPUS xtensa: SMP: mark each possible CPU as present xtensa: smp_lx200_defconfig: fix vectors clash xtensa: SMP: fix secondary CPU initialization xtensa: SMP: fix ccount_timer_shutdown iommu/amd: Fix IOMMU page flush when detach device from a domain ipvs: Fix signed integer overflow when setsockopt timeout IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM perf tools: Handle TOPOLOGY headers with no CPU vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel media: uvcvideo: Fix 'type' check leading to overflow ip6mr: Do not call __IP6_INC_STATS() from preemptible context net: dsa: mv88e6xxx: Fix u64 statistics netlabel: fix out-of-bounds memory accesses hugetlbfs: fix races and page leaks during migration MIPS: irq: Allocate accurate order pages for irq stack applicom: Fix potential Spectre v1 vulnerabilities x86/CPU/AMD: Set the CPB bit unconditionally on F17h net: phy: Micrel KSZ8061: link failure after cable connect net: avoid use IPCB in cipso_v4_error net: Add __icmp_send helper. xen-netback: fix occasional leak of grant ref mappings under memory pressure net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails bnxt_en: Drop oversize TX packets to prevent errors. team: Free BPF filter when unregistering netdev sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 net-sysfs: Fix mem leak in netdev_register_kobject staging: lustre: fix buffer overflow of string buffer isdn: isdn_tty: fix build warning of strncpy ncpfs: fix build warning of strncpy sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names cpufreq: Use struct kobj_attribute instead of struct global_attr USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485 USB: serial: cp210x: add ID for Ingenico 3070 USB: serial: option: add Telit ME910 ECM composition x86/uaccess: Don't leak the AC flag into __put_user() value evaluation mm: enforce min addr even if capable() in expand_downwards() mmc: spi: Fix card detection during probe powerpc: Always initialize input array when calling epapr_hypercall() KVM: arm/arm64: Fix MMIO emulation data handling arm/arm64: KVM: Feed initialized memory to MMIO accesses KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1 cfg80211: extend range deviation for DMG mac80211: don't initiate TDLS connection if station is not associated to AP ibmveth: Do not process frames after calling napi_reschedule net: altera_tse: fix connect_local_phy error path scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling mac80211: fix miscounting of ttl-dropped frames ARC: fix __ffs return value to avoid build warnings ASoC: imx-audmux: change snprintf to scnprintf for possible overflow ASoC: dapm: change snprintf to scnprintf for possible overflow usb: gadget: Potential NULL dereference on allocation error usb: dwc3: gadget: Fix the uninitialized link_state when udc starts thermal: int340x_thermal: Fix a NULL vs IS_ERR() check ALSA: compress: prevent potential divide by zero bugs ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field drm/msm: Unblock writer if reader closes file scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached libceph: handle an empty authorize reply Revert "bridge: do not add port to router list when receives query with source 0.0.0.0" ARCv2: Enable unaligned access in early ASM code net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach() team: avoid complex list operations in team_nl_cmd_options_set() net/packet: fix 4gb buffer limit due to overflow check batman-adv: fix uninit-value in batadv_interface_tx() KEYS: always initialize keyring_index_key::desc_len KEYS: user: Align the payload buffer RDMA/srp: Rework SCSI device reset handling isdn: avm: Fix string plus integer warning from Clang leds: lp5523: fix a missing check of return value of lp55xx_read atm: he: fix sign-extension overflow on large shift isdn: i4l: isdn_tty: Fix some concurrency double-free bugs MIPS: jazz: fix 64bit build scsi: isci: initialize shost fully before calling scsi_add_host() scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param MIPS: ath79: Enable OF serial ports in the default config net: hns: Fix use after free identified by SLUB debug mfd: mc13xxx: Fix a missing check of a register-read failure mfd: wm5110: Add missing ASRC rate register mfd: qcom_rpm: write fw_version to CTRL_REG mfd: ab8500-core: Return zero in get_register_interruptible() mfd: db8500-prcmu: Fix some section annotations mfd: twl-core: Fix section annotations on {,un}protect_pm_master mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells KEYS: allow reaching the keys quotas exactly numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES ceph: avoid repeatedly adding inode to mdsc->snap_flush_list Revert "ANDROID: arm: process: Add display of memory around registers when displaying regs." ANDROID: mnt: Propagate remount correctly ANDROID: cuttlefish_defconfig: Add support for AC97 audio ANDROID: overlayfs: override_creds=off option bypass creator_cred FROMGIT: binder: create node flag to request sender's security context Conflicts: arch/arm/kernel/irq.c drivers/media/v4l2-core/videobuf2-v4l2.c sound/core/compress_offload.c Change-Id: I998f8d53b0c5b8a7102816034452b1779a3b69a3 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | | | | | Merge 4.4.177 into android-4.4Greg Kroah-Hartman2019-03-23
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.177 ceph: avoid repeatedly adding inode to mdsc->snap_flush_list numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES KEYS: allow reaching the keys quotas exactly mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells mfd: twl-core: Fix section annotations on {,un}protect_pm_master mfd: db8500-prcmu: Fix some section annotations mfd: ab8500-core: Return zero in get_register_interruptible() mfd: qcom_rpm: write fw_version to CTRL_REG mfd: wm5110: Add missing ASRC rate register mfd: mc13xxx: Fix a missing check of a register-read failure net: hns: Fix use after free identified by SLUB debug MIPS: ath79: Enable OF serial ports in the default config scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param scsi: isci: initialize shost fully before calling scsi_add_host() MIPS: jazz: fix 64bit build isdn: i4l: isdn_tty: Fix some concurrency double-free bugs atm: he: fix sign-extension overflow on large shift leds: lp5523: fix a missing check of return value of lp55xx_read isdn: avm: Fix string plus integer warning from Clang RDMA/srp: Rework SCSI device reset handling KEYS: user: Align the payload buffer KEYS: always initialize keyring_index_key::desc_len batman-adv: fix uninit-value in batadv_interface_tx() net/packet: fix 4gb buffer limit due to overflow check team: avoid complex list operations in team_nl_cmd_options_set() sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach() net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames ARCv2: Enable unaligned access in early ASM code Revert "bridge: do not add port to router list when receives query with source 0.0.0.0" libceph: handle an empty authorize reply scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached drm/msm: Unblock writer if reader closes file ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field ALSA: compress: prevent potential divide by zero bugs thermal: int340x_thermal: Fix a NULL vs IS_ERR() check usb: dwc3: gadget: Fix the uninitialized link_state when udc starts usb: gadget: Potential NULL dereference on allocation error ASoC: dapm: change snprintf to scnprintf for possible overflow ASoC: imx-audmux: change snprintf to scnprintf for possible overflow ARC: fix __ffs return value to avoid build warnings mac80211: fix miscounting of ttl-dropped frames serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() net: altera_tse: fix connect_local_phy error path ibmveth: Do not process frames after calling napi_reschedule mac80211: don't initiate TDLS connection if station is not associated to AP cfg80211: extend range deviation for DMG KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1 arm/arm64: KVM: Feed initialized memory to MMIO accesses KVM: arm/arm64: Fix MMIO emulation data handling powerpc: Always initialize input array when calling epapr_hypercall() mmc: spi: Fix card detection during probe mm: enforce min addr even if capable() in expand_downwards() x86/uaccess: Don't leak the AC flag into __put_user() value evaluation USB: serial: option: add Telit ME910 ECM composition USB: serial: cp210x: add ID for Ingenico 3070 USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485 cpufreq: Use struct kobj_attribute instead of struct global_attr sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names ncpfs: fix build warning of strncpy isdn: isdn_tty: fix build warning of strncpy staging: lustre: fix buffer overflow of string buffer net-sysfs: Fix mem leak in netdev_register_kobject sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 team: Free BPF filter when unregistering netdev bnxt_en: Drop oversize TX packets to prevent errors. net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails xen-netback: fix occasional leak of grant ref mappings under memory pressure net: Add __icmp_send helper. net: avoid use IPCB in cipso_v4_error net: phy: Micrel KSZ8061: link failure after cable connect x86/CPU/AMD: Set the CPB bit unconditionally on F17h applicom: Fix potential Spectre v1 vulnerabilities MIPS: irq: Allocate accurate order pages for irq stack hugetlbfs: fix races and page leaks during migration netlabel: fix out-of-bounds memory accesses net: dsa: mv88e6xxx: Fix u64 statistics ip6mr: Do not call __IP6_INC_STATS() from preemptible context media: uvcvideo: Fix 'type' check leading to overflow vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel perf tools: Handle TOPOLOGY headers with no CPU IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM ipvs: Fix signed integer overflow when setsockopt timeout iommu/amd: Fix IOMMU page flush when detach device from a domain xtensa: SMP: fix ccount_timer_shutdown xtensa: SMP: fix secondary CPU initialization xtensa: smp_lx200_defconfig: fix vectors clash xtensa: SMP: mark each possible CPU as present xtensa: SMP: limit number of possible CPUs by NR_CPUS net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case net: hns: Fix wrong read accesses via Clause 45 MDIO protocol net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() gpio: vf610: Mask all GPIO interrupts nfs: Fix NULL pointer dereference of dev_name scsi: libfc: free skb when receiving invalid flogi resp platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 cifs: fix computation for MAX_SMB2_HDR_SIZE x86/kexec: Don't setup EFI info if EFI runtime is not enabled x86_64: increase stack size for KASAN_EXTRA mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() autofs: drop dentry reference only when it is never used autofs: fix error return in autofs_fill_super() ARM: pxa: ssp: unneeded to free devm_ allocated data irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable dmaengine: at_xdmac: Fix wrongfull report of a channel as in use dmaengine: dmatest: Abort test in case of mapping error s390/qeth: fix use-after-free in error path perf symbols: Filter out hidden symbols from labels MIPS: Remove function size check in get_frame_info() Input: wacom_serial4 - add support for Wacom ArtPad II tablet Input: elan_i2c - add id for touchpad found in Lenovo s21e-20 iscsi_ibft: Fix missing break in switch statement futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock() ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls" ARM: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420 udplite: call proper backlog handlers netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES netfilter: nfnetlink_log: just returns error for unknown command netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options KEYS: restrict /proc/keys by credentials at open time l2tp: fix infoleak in l2tp_ip6_recvmsg() net: hsr: fix memory leak in hsr_dev_finalize() net: sit: fix UBSAN Undefined behaviour in check_6rd net/x25: fix use-after-free in x25_device_event() net/x25: reset state in x25_connect() pptp: dst_release sk_dst_cache in pptp_sock_destruct ravb: Decrease TxFIFO depth of Q3 and Q2 to one route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race tcp: handle inet_csk_reqsk_queue_add() failures net/mlx4_core: Fix reset flow when in command polling mode net/mlx4_core: Fix qp mtt size calculation net/x25: fix a race in x25_bind() mdio_bus: Fix use-after-free on device_register fails net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 missing barriers in some of unix_sock ->addr and ->path accesses ipvlan: disallow userns cap_net_admin to change global mode/flags vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() vxlan: Fix GRO cells race condition between receive and link delete net/hsr: fix possible crash in add_timer() gro_cells: make sure device is up in gro_cells_receive() tcp/dccp: remove reqsk_put() from inet_child_forget() ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 fs/9p: use fscache mutex rather than spinlock It's wrong to add len to sector_nr in raid10 reshape twice media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused() 9p: use inode->i_lock to protect i_size_write() under 32-bit 9p/net: fix memory leak in p9_client_create ASoC: fsl_esai: fix register setting issue in RIGHT_J mode stm class: Fix an endless loop in channel allocation crypto: caam - fixed handling of sg list crypto: ahash - fix another early termination in hash walk gpu: ipu-v3: Fix i.MX51 CSI control registers offset gpu: ipu-v3: Fix CSI offsets for imx53 s390/dasd: fix using offset into zero size array error ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized Input: matrix_keypad - use flush_delayed_work() i2c: cadence: Fix the hold bit setting Input: st-keyscan - fix potential zalloc NULL dereference ARM: 8824/1: fix a migrating irq bug when hotplug cpu assoc_array: Fix shortcut creation scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task net: systemport: Fix reception of BPDUs pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() ASoC: topology: free created components in tplg load error arm64: Relax GIC version check during early boot tmpfs: fix link accounting when a tmpfile is linked in ARC: uacces: remove lp_start, lp_end from clobber list phonet: fix building with clang mac80211_hwsim: propagate genlmsg_reply return code net: set static variable an initial value in atl2_probe() tmpfs: fix uninitialized return value in shmem_link stm class: Prevent division by zero crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling CIFS: Fix read after write for files with read caching tracing: Do not free iter->trace in fail path of tracing_open_pipe() ACPI / device_sysfs: Avoid OF modalias creation for removed device regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 regulator: s2mpa01: Fix step values for some LDOs clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown s390/virtio: handle find on invalid queue gracefully scsi: virtio_scsi: don't send sc payload with tmfs scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock m68k: Add -ffreestanding to CFLAGS btrfs: ensure that a DUP or RAID1 block group has exactly two stripes Btrfs: fix corruption reading shared and compressed extents after hole punching crypto: pcbc - remove bogus memcpy()s with src == dest cpufreq: tegra124: add missing of_node_put() cpufreq: pxa2xx: remove incorrect __init annotation ext4: fix crash during online resizing ext2: Fix underflow in ext2_max_size() clk: ingenic: Fix round_rate misbehaving with non-integer dividers dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit mm/vmalloc: fix size check for remap_vmalloc_range_partial() kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv intel_th: Don't reference unassigned outputs parport_pc: fix find_superio io compare code, should use equal test. i2c: tegra: fix maximum transfer size perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks serial: 8250_pci: Fix number of ports for ACCES serial cards serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup() jbd2: clear dirty flag when revoking a buffer from an older transaction jbd2: fix compile warning when using JBUFFER_TRACE powerpc/32: Clear on-stack exception marker upon exception return powerpc/wii: properly disable use of BATs when requested. powerpc/powernv: Make opal log only readable by root powerpc/83xx: Also save/restore SPRG4-7 during suspend ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify dm: fix to_sector() for 32bit NFS41: pop some layoutget errors to application perf intel-pt: Fix CYC timestamp calculation after OVF perf auxtrace: Define auxtrace record alignment perf intel-pt: Fix overlap calculation for padding md: Fix failed allocation of md_register_thread NFS: Fix an I/O request leakage in nfs_do_recoalesce NFS: Don't recoalesce on error in nfs_pageio_complete_mirror() nfsd: fix memory corruption caused by readdir nfsd: fix wrong check in write_v4_end_grace() PM / wakeup: Rework wakeup source timer cancellation rcu: Do RCU GP kthread self-wakeup from softirq and interrupt media: uvcvideo: Avoid NULL pointer dereference at the end of streaming drm/radeon/evergreen_cs: fix missing break in switch statement KVM: nVMX: Sign extend displacements of VMX instr's mem operands KVM: nVMX: Ignore limit checks on VMX instructions using flat segments KVM: X86: Fix residual mmio emulation request to userspace Linux 4.4.177 Change-Id: Ide9813404248e6d7f9dc4024ac244dc1fbdd21b6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | | | | missing barriers in some of unix_sock ->addr and ->path accessesAl Viro2019-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit ae3b564179bfd06f32d051b9e5d72ce4b2a07c37 ] Several u->addr and u->path users are not holding any locks in common with unix_bind(). unix_state_lock() is useless for those purposes. u->addr is assign-once and *(u->addr) is fully set up by the time we set u->addr (all under unix_table_lock). u->path is also set in the same critical area, also before setting u->addr, and any unix_sock with ->path filled will have non-NULL ->addr. So setting ->addr with smp_store_release() is all we need for those "lockless" users - just have them fetch ->addr with smp_load_acquire() and don't even bother looking at ->path if they see NULL ->addr. Users of ->addr and ->path fall into several classes now: 1) ones that do smp_load_acquire(u->addr) and access *(u->addr) and u->path only if smp_load_acquire() has returned non-NULL. 2) places holding unix_table_lock. These are guaranteed that *(u->addr) is seen fully initialized. If unix_sock is in one of the "bound" chains, so's ->path. 3) unix_sock_destructor() using ->addr is safe. All places that set u->addr are guaranteed to have seen all stores *(u->addr) while holding a reference to u and unix_sock_destructor() is called when (atomic) refcount hits zero. 4) unix_release_sock() using ->path is safe. unix_bind() is serialized wrt unix_release() (normally - by struct file refcount), and for the instances that had ->path set by unix_bind() unix_release_sock() comes from unix_release(), so they are fine. Instances that had it set in unix_stream_connect() either end up attached to a socket (in unix_accept()), in which case the call chain to unix_release_sock() and serialization are the same as in the previous case, or they never get accept'ed and unix_release_sock() is called when the listener is shut down and its queue gets purged. In that case the listener's queue lock provides the barriers needed - unix_stream_connect() shoves our unix_sock into listener's queue under that lock right after having set ->path and eventual unix_release_sock() caller picks them from that queue under the same lock right before calling unix_release_sock(). 5) unix_find_other() use of ->path is pointless, but safe - it happens with successful lookup by (abstract) name, so ->path.dentry is guaranteed to be NULL there. earlier-variant-reviewed-by: "Paul E. McKenney" <paulmck@linux.ibm.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | | | | | | KEYS: restrict /proc/keys by credentials at open timeEric Biggers2019-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4aa68e07d845562561f5e73c04aa521376e95252 upstream. When checking for permission to view keys whilst reading from /proc/keys, we should use the credentials with which the /proc/keys file was opened. This is because, in a classic type of exploit, it can be possible to bypass checks for the *current* credentials by passing the file descriptor to a suid program. Following commit 34dbbcdbf633 ("Make file credentials available to the seqfile interfaces") we can finally fix it. So let's do it. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Zubin Mithra <zsm@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | | | | | | KEYS: always initialize keyring_index_key::desc_lenEric Biggers2019-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ede0fa98a900e657d1fcd80b50920efc896c1a4c upstream. syzbot hit the 'BUG_ON(index_key->desc_len == 0);' in __key_link_begin() called from construct_alloc_key() during sys_request_key(), because the length of the key description was never calculated. The problem is that we rely on ->desc_len being initialized by search_process_keyrings(), specifically by search_nested_keyrings(). But, if the process isn't subscribed to any keyrings that never happens. Fix it by always initializing keyring_index_key::desc_len as soon as the description is set, like we already do in some places. The following program reproduces the BUG_ON() when it's run as root and no session keyring has been installed. If it doesn't work, try removing pam_keyinit.so from /etc/pam.d/login and rebooting. #include <stdlib.h> #include <unistd.h> #include <keyutils.h> int main(void) { int id = add_key("keyring", "syz", NULL, 0, KEY_SPEC_USER_KEYRING); keyctl_setperm(id, KEY_OTH_WRITE); setreuid(5000, 5000); request_key("user", "desc", "", id); } Reported-by: syzbot+ec24e95ea483de0a24da@syzkaller.appspotmail.com Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring") Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | | | | | | KEYS: allow reaching the keys quotas exactlyEric Biggers2019-03-23
| | | |_|_|_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a08bf91ce28ed3ae7b6fef35d843fef8dc8c2cd9 upstream. If the sysctl 'kernel.keys.maxkeys' is set to some number n, then actually users can only add up to 'n - 1' keys. Likewise for 'kernel.keys.maxbytes' and the root_* versions of these sysctls. But these sysctls are apparently supposed to be *maximums*, as per their names and all documentation I could find -- the keyrings(7) man page, Documentation/security/keys/core.rst, and all the mentions of EDQUOT meaning that the key quota was *exceeded* (as opposed to reached). Thus, fix the code to allow reaching the quotas exactly. Fixes: 0b77f5bfb45c ("keys: make the keyring quotas controllable through /proc/sys") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | | | | | Merge android-4.4.175 (08d5867) into msm-4.4Srinivasarao P2019-02-22
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-08d5867 Linux 4.4.175 uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define pinctrl: msm: fix gpio-hog related boot issues usb: dwc2: Remove unnecessary kfree kaweth: use skb_cow_head() to deal with cloned skbs ch9200: use skb_cow_head() to deal with cloned skbs smsc95xx: Use skb_cow_head to deal with cloned skbs dm thin: fix bug where bio that overwrites thin block ignores FUA x86/a.out: Clear the dump structure initially signal: Restore the stop PTRACE_EVENT_EXIT x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls tracing/uprobes: Fix output for multiple string arguments alpha: Fix Eiger NR_IRQS to 128 alpha: fix page fault handling for r16-r18 targets Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 Input: bma150 - register input device after setting private data ALSA: usb-audio: Fix implicit fb endpoint setup by quirk ALSA: hda - Add quirk for HP EliteBook 840 G5 perf/core: Fix impossible ring-buffer sizes warning Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G" Documentation/network: reword kernel version reference cifs: Limit memory used by lock request calls to a page gpio: pl061: handle failed allocations ARM: dts: kirkwood: Fix polarity of GPIO fan lines ARM: dts: da850-evm: Correct the sound card name uapi/if_ether.h: prevent redefinition of struct ethhdr Revert "exec: load_script: don't blindly truncate shebang string" batman-adv: Force mac header to start of data on xmit batman-adv: Avoid WARN on net_device without parent in netns xfrm: refine validation of template and selector families libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() Revert "cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)" NFC: nxp-nci: Include unaligned.h instead of access_ok.h HID: debug: fix the ring buffer implementation drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user drm/vmwgfx: Fix setting of dma masks drm/modes: Prevent division by zero htotal mac80211: ensure that mgmt tx skbs have tailroom for encryption ARM: iop32x/n2100: fix PCI IRQ mapping MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled mips: cm: reprime error cause debugfs: fix debugfs_rename parameter checking misc: vexpress: Off by one in vexpress_syscfg_exec() signal: Better detection of synchronous signals signal: Always notice exiting tasks mtd: rawnand: gpmi: fix MX28 bus master lockup problem perf tests evsel-tp-sched: Fix bitwise operator perf/core: Don't WARN() for impossible ring-buffer sizes x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() perf/x86/intel/uncore: Add Node ID mask KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) usb: gadget: udc: net2272: Fix bitwise and boolean operations usb: phy: am335x: fix race condition in _probe dmaengine: imx-dma: fix wrong callback invoke fuse: handle zero sized retrieve correctly fuse: decrement NR_WRITEBACK_TEMP on the right page fuse: call pipe_buf_release() under pipe lock ALSA: hda - Serialize codec registrations ALSA: compress: Fix stop handling on compressed capture streams net: dsa: slave: Don't propagate flag changes on down slave interfaces net: systemport: Fix WoL with password after deep sleep skge: potential memory corruption in skge_get_regs() net: dp83640: expire old TX-skb enic: fix checksum validation for IPv6 dccp: fool proof ccid_hc_[rt]x_parse_options() string: drop __must_check from strscpy() and restore strscpy() usages in cgroup tipc: use destination length for copy string test_hexdump: use memcpy instead of strncpy thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set exec: load_script: don't blindly truncate shebang string fs/epoll: drop ovflist branch prediction kernel/hung_task.c: break RCU locks based on jiffies HID: lenovo: Add checks to fix of_led_classdev_register block/swim3: Fix -EBUSY error when re-opening device after unmount gdrom: fix a memory leak bug isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() ocfs2: don't clear bh uptodate for block read scripts/decode_stacktrace: only strip base path when a prefix of the path niu: fix missing checks of niu_pci_eeprom_read um: Avoid marking pages with "changed protection" cifs: check ntwrk_buf_start for NULL before dereferencing it crypto: ux500 - Use proper enum in hash_set_dma_transfer crypto: ux500 - Use proper enum in cryp_set_dma_transfer seq_buf: Make seq_buf_puts() null-terminate the buffer hwmon: (lm80) fix a missing check of bus read in lm80 probe hwmon: (lm80) fix a missing check of the status of SMBus read NFS: nfs_compare_mount_options always compare auth flavors. KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported fbdev: fbcon: Fix unregister crash when more than one framebuffer igb: Fix an issue that PME is not enabled during runtime suspend fbdev: fbmem: behave better with small rotated displays and many CPUs video: clps711x-fb: release disp device node in probe() drbd: Avoid Clang warning about pointless switch statment drbd: skip spurious timeout (ping-timeo) when failing promote drbd: disconnect, if the wrong UUIDs are attached on a connected peer drbd: narrow rcu_read_lock in drbd_sync_handshake cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() Bluetooth: Fix unnecessary error message for HCI request completion xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi mac80211: fix radiotap vendor presence bitmap handling powerpc/uaccess: fix warning/error with access_ok() arm64: KVM: Skip MMIO insn after emulation tty: serial: samsung: Properly set flags in autoCTS mode memstick: Prevent memstick host from getting runtime suspended during card detection ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M ARM: pxa: avoid section mismatch warning udf: Fix BUG on corrupted inode i2c-axxia: check for error conditions first cpuidle: big.LITTLE: fix refcount leak clk: imx6sl: ensure MMDC CH0 handshake is bypassed sata_rcar: fix deferred probing iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer mips: bpf: fix encoding bug for mm_srlv32_op ARM: dts: Fix OMAP4430 SDP Ethernet startup timekeeping: Use proper seqcount initializer usb: hub: delay hub autosuspend if USB3 port is still link training smack: fix access permissions for keyring media: DaVinci-VPBE: fix error handling in vpbe_initialize() x86/fpu: Add might_fault() to user_insn() ARM: dts: mmp2: fix TWSI2 arm64: ftrace: don't adjust the LR value nfsd4: fix crash on writing v4_end_grace before nfsd startup sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN f2fs: fix wrong return value of f2fs_acl_create f2fs: move dir data flush to write checkpoint process soc/tegra: Don't leak device tree node reference perf tools: Add Hygon Dhyana support modpost: validate symbol names also in find_elf_symbol ARM: OMAP2+: hwmod: Fix some section annotations staging: iio: ad7780: update voltage on read staging:iio:ad2s90: Make probe handle spi_setup failure ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl serial: fsl_lpuart: clear parity enable bit when disable parity powerpc/pseries: add of_node_put() in dlpar_detach_node() x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) dlm: Don't swamp the CPU with callbacks queued during recovery ARM: 8808/1: kexec:offline panic_smp_self_stop CPU scsi: lpfc: Correct LCB RJT handling ASoC: Intel: mrfld: fix uninitialized variable access staging: iio: adc: ad7280a: handle error from __ad7280_read32() drm/bufs: Fix Spectre v1 vulnerability BACKPORT: userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas ANDROID: cuttlefish_defconfig: Enable DEBUG_SET_MODULE_RONX ANDROID: Move from clang r346389b to r349610. UPSTREAM: virt_wifi: fix error return code in virt_wifi_newlink() ion: Disable ION_HEAP_TYPE_SYSTEM_CONTIG Change-Id: I8456a2f1d229a2d454295d660f749a2b436c6440 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | | | | Merge 4.4.175 into android-4.4Greg Kroah-Hartman2019-02-20
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.175 drm/bufs: Fix Spectre v1 vulnerability staging: iio: adc: ad7280a: handle error from __ad7280_read32() ASoC: Intel: mrfld: fix uninitialized variable access scsi: lpfc: Correct LCB RJT handling ARM: 8808/1: kexec:offline panic_smp_self_stop CPU dlm: Don't swamp the CPU with callbacks queued during recovery x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) powerpc/pseries: add of_node_put() in dlpar_detach_node() serial: fsl_lpuart: clear parity enable bit when disable parity ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl staging:iio:ad2s90: Make probe handle spi_setup failure staging: iio: ad7780: update voltage on read ARM: OMAP2+: hwmod: Fix some section annotations modpost: validate symbol names also in find_elf_symbol perf tools: Add Hygon Dhyana support soc/tegra: Don't leak device tree node reference f2fs: move dir data flush to write checkpoint process f2fs: fix wrong return value of f2fs_acl_create sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN nfsd4: fix crash on writing v4_end_grace before nfsd startup arm64: ftrace: don't adjust the LR value ARM: dts: mmp2: fix TWSI2 x86/fpu: Add might_fault() to user_insn() media: DaVinci-VPBE: fix error handling in vpbe_initialize() smack: fix access permissions for keyring usb: hub: delay hub autosuspend if USB3 port is still link training timekeeping: Use proper seqcount initializer ARM: dts: Fix OMAP4430 SDP Ethernet startup mips: bpf: fix encoding bug for mm_srlv32_op iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer sata_rcar: fix deferred probing clk: imx6sl: ensure MMDC CH0 handshake is bypassed cpuidle: big.LITTLE: fix refcount leak i2c-axxia: check for error conditions first udf: Fix BUG on corrupted inode ARM: pxa: avoid section mismatch warning ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M memstick: Prevent memstick host from getting runtime suspended during card detection tty: serial: samsung: Properly set flags in autoCTS mode arm64: KVM: Skip MMIO insn after emulation powerpc/uaccess: fix warning/error with access_ok() mac80211: fix radiotap vendor presence bitmap handling xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi Bluetooth: Fix unnecessary error message for HCI request completion cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() drbd: narrow rcu_read_lock in drbd_sync_handshake drbd: disconnect, if the wrong UUIDs are attached on a connected peer drbd: skip spurious timeout (ping-timeo) when failing promote drbd: Avoid Clang warning about pointless switch statment video: clps711x-fb: release disp device node in probe() fbdev: fbmem: behave better with small rotated displays and many CPUs igb: Fix an issue that PME is not enabled during runtime suspend fbdev: fbcon: Fix unregister crash when more than one framebuffer KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported NFS: nfs_compare_mount_options always compare auth flavors. hwmon: (lm80) fix a missing check of the status of SMBus read hwmon: (lm80) fix a missing check of bus read in lm80 probe seq_buf: Make seq_buf_puts() null-terminate the buffer crypto: ux500 - Use proper enum in cryp_set_dma_transfer crypto: ux500 - Use proper enum in hash_set_dma_transfer cifs: check ntwrk_buf_start for NULL before dereferencing it um: Avoid marking pages with "changed protection" niu: fix missing checks of niu_pci_eeprom_read scripts/decode_stacktrace: only strip base path when a prefix of the path ocfs2: don't clear bh uptodate for block read isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() gdrom: fix a memory leak bug block/swim3: Fix -EBUSY error when re-opening device after unmount HID: lenovo: Add checks to fix of_led_classdev_register kernel/hung_task.c: break RCU locks based on jiffies fs/epoll: drop ovflist branch prediction exec: load_script: don't blindly truncate shebang string thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set test_hexdump: use memcpy instead of strncpy tipc: use destination length for copy string string: drop __must_check from strscpy() and restore strscpy() usages in cgroup dccp: fool proof ccid_hc_[rt]x_parse_options() enic: fix checksum validation for IPv6 net: dp83640: expire old TX-skb skge: potential memory corruption in skge_get_regs() net: systemport: Fix WoL with password after deep sleep net: dsa: slave: Don't propagate flag changes on down slave interfaces ALSA: compress: Fix stop handling on compressed capture streams ALSA: hda - Serialize codec registrations fuse: call pipe_buf_release() under pipe lock fuse: decrement NR_WRITEBACK_TEMP on the right page fuse: handle zero sized retrieve correctly dmaengine: imx-dma: fix wrong callback invoke usb: phy: am335x: fix race condition in _probe usb: gadget: udc: net2272: Fix bitwise and boolean operations KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) perf/x86/intel/uncore: Add Node ID mask x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() perf/core: Don't WARN() for impossible ring-buffer sizes perf tests evsel-tp-sched: Fix bitwise operator mtd: rawnand: gpmi: fix MX28 bus master lockup problem signal: Always notice exiting tasks signal: Better detection of synchronous signals misc: vexpress: Off by one in vexpress_syscfg_exec() debugfs: fix debugfs_rename parameter checking mips: cm: reprime error cause MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds ARM: iop32x/n2100: fix PCI IRQ mapping mac80211: ensure that mgmt tx skbs have tailroom for encryption drm/modes: Prevent division by zero htotal drm/vmwgfx: Fix setting of dma masks drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user HID: debug: fix the ring buffer implementation NFC: nxp-nci: Include unaligned.h instead of access_ok.h Revert "cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)" libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() xfrm: refine validation of template and selector families batman-adv: Avoid WARN on net_device without parent in netns batman-adv: Force mac header to start of data on xmit Revert "exec: load_script: don't blindly truncate shebang string" uapi/if_ether.h: prevent redefinition of struct ethhdr ARM: dts: da850-evm: Correct the sound card name ARM: dts: kirkwood: Fix polarity of GPIO fan lines gpio: pl061: handle failed allocations cifs: Limit memory used by lock request calls to a page Documentation/network: reword kernel version reference Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G" Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK perf/core: Fix impossible ring-buffer sizes warning ALSA: hda - Add quirk for HP EliteBook 840 G5 ALSA: usb-audio: Fix implicit fb endpoint setup by quirk Input: bma150 - register input device after setting private data Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 alpha: fix page fault handling for r16-r18 targets alpha: Fix Eiger NR_IRQS to 128 tracing/uprobes: Fix output for multiple string arguments x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls signal: Restore the stop PTRACE_EVENT_EXIT x86/a.out: Clear the dump structure initially dm thin: fix bug where bio that overwrites thin block ignores FUA smsc95xx: Use skb_cow_head to deal with cloned skbs ch9200: use skb_cow_head() to deal with cloned skbs kaweth: use skb_cow_head() to deal with cloned skbs usb: dwc2: Remove unnecessary kfree pinctrl: msm: fix gpio-hog related boot issues uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define Linux 4.4.175 Change-Id: I41d95e9717106bcc9342573855fec8f823d9b28c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | | | smack: fix access permissions for keyringZoran Markovic2019-02-20
| | | |_|_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 5b841bfab695e3b8ae793172a9ff7990f99cc3e2 ] Function smack_key_permission() only issues smack requests for the following operations: - KEY_NEED_READ (issues MAY_READ) - KEY_NEED_WRITE (issues MAY_WRITE) - KEY_NEED_LINK (issues MAY_WRITE) - KEY_NEED_SETATTR (issues MAY_WRITE) A blank smack request is issued in all other cases, resulting in smack access being granted if there is any rule defined between subject and object, or denied with -EACCES otherwise. Request MAY_READ access for KEY_NEED_SEARCH and KEY_NEED_VIEW. Fix the logic in the unlikely case when both MAY_READ and MAY_WRITE are needed. Validate access permission field for valid contents. Signed-off-by: Zoran Markovic <zmarkovic@sierrawireless.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Cc: Casey Schaufler <casey@schaufler-ca.com> Cc: James Morris <jmorris@namei.org> Cc: "Serge E. Hallyn" <serge@hallyn.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | | | | | | | Merge android-4.4.172 (b3e9e81) into msm-4.4Srinivasarao P2019-01-29
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-b3e9e81 Linux 4.4.172 ipmi:ssif: Fix handling of multi-part return messages net: speed up skb_rbtree_purge() mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps mm/page-writeback.c: don't break integrity writeback on ->writepage() error ocfs2: fix panic due to unrecovered local alloc scsi: megaraid: fix out-of-bound array accesses sysfs: Disable lockdep for driver bind/unbind files ALSA: bebob: fix model-id of unit for Apogee Ensemble dm snapshot: Fix excessive memory usage and workqueue stalls dm kcopyd: Fix bug causing workqueue stalls perf parse-events: Fix unchecked usage of strncpy() perf svghelper: Fix unchecked usage of strncpy() perf intel-pt: Fix error with config term "pt=0" mmc: atmel-mci: do not assume idle after atmci_request_end kconfig: fix memory leak when EOF is encountered in quotation kconfig: fix file name and line number of warn_ignored_character() clk: imx6q: reset exclusive gates on init scsi: target: use consistent left-aligned ASCII INQUIRY data net: call sk_dst_reset when set SO_DONTROUTE media: firewire: Fix app_info parameter type in avc_ca{,_app}_info powerpc/pseries/cpuidle: Fix preempt warning pstore/ram: Do not treat empty buffers as valid jffs2: Fix use of uninitialized delayed_work, lockdep breakage arm64: perf: set suppress_bind_attrs flag to true MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur writeback: don't decrement wb->refcnt if !wb->bdi e1000e: allow non-monotonic SYSTIM readings platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey xfs: don't fail when converting shortform attr to long form during ATTR_REPLACE ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address r8169: Add support for new Realtek Ethernet media: vb2: be sure to unlock mutex on errors drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl() loop: Get rid of loop_index_mutex loop: Fold __loop_release into loop_release block/loop: Use global lock for ioctl() operation. tipc: fix uninit-value in tipc_nl_compat_doit tipc: fix uninit-value in tipc_nl_compat_name_table_dump tipc: fix uninit-value in tipc_nl_compat_link_set tipc: fix uninit-value in tipc_nl_compat_bearer_enable tipc: fix uninit-value in tipc_nl_compat_link_reset_stats sctp: allocate sctp_sockaddr_entry with kzalloc selinux: fix GPF on invalid policy sunrpc: handle ENOMEM in rpcb_getport_async media: vb2: vb2_mmap: move lock up LSM: Check for NULL cred-security on free media: vivid: set min width/height to a value > 0 media: vivid: fix error handling of kthread_run omap2fb: Fix stack memory disclosure Disable MSI also when pcie-octeon.pcie_disable on mfd: tps6586x: Handle interrupts on suspend mips: fix n32 compat_ipc_parse_version scsi: sd: Fix cache_type_store() Yama: Check for pid death before checking ancestry btrfs: wait on ordered extents on abort cleanup crypto: authenc - fix parsing key with misaligned rta_len crypto: authencesn - Avoid twice completion call in decrypt path ip: on queued skb use skb_header_pointer instead of pskb_may_pull packet: Do not leak dev refcounts on error exit net: bridge: fix a bug on using a neighbour cache entry without checking its state ipv6: fix kernel-infoleak in ipv6_local_error() arm64: Don't trap host pointer auth use to EL2 arm64/kvm: consistently handle host HCR_EL2 flags proc: Remove empty line in /proc/self/status media: em28xx: Fix misplaced reset of dev->v4l::field_count f2fs: fix validation of the block count in sanity_check_raw_super f2fs: fix missing up_read f2fs: fix invalid memory access f2fs: fix to do sanity check with cp_pack_start_sum f2fs: fix to do sanity check with block address in main area v2 f2fs: fix to do sanity check with block address in main area f2fs: fix to do sanity check with reserved blkaddr of inline inode f2fs: fix to do sanity check with node footer and iblocks f2fs: Add sanity_check_inode() function f2fs: fix to do sanity check with user_block_count f2fs: fix to do sanity check with secs_per_zone f2fs: introduce and spread verify_blkaddr f2fs: clean up with is_valid_blkaddr() f2fs: enhance sanity_check_raw_super() to avoid potential overflow f2fs: sanity check on sit entry f2fs: check blkaddr more accuratly before issue a bio f2fs: return error during fill_super f2fs: fix race condition in between free nid allocator/initializer f2fs: free meta pages if sanity check for ckpt is failed f2fs: detect wrong layout f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack f2fs: put directory inodes before checkpoint in roll-forward recovery f2fs: introduce get_checkpoint_version for cleanup f2fs: use crc and cp version to determine roll-forward recovery f2fs: avoid unneeded loop in build_sit_entries f2fs: not allow to write illegal blkaddr f2fs: fix to avoid reading out encrypted data in page cache f2fs: fix inode cache leak f2fs: factor out fsync inode entry operations f2fs: remove an obsolete variable f2fs: give -EINVAL for norecovery and rw mount f2fs: fix to convert inline directory correctly f2fs: move sanity checking of cp into get_valid_checkpoint f2fs: cover more area with nat_tree_lock f2fs: clean up argument of recover_data can: gw: ensure DLC boundaries after CAN frame modification tty/ldsem: Wake up readers after timed out down_write() UPSTREAM: dm: do not allow readahead to limit IO size UPSTREAM: readahead: stricter check for bdi io_pages UPSTREAM: mm: don't cap request size based on read-ahead setting ANDROID: Fix cuttlefish redundant vsock connection. UPSTREAM: loop: drop caches if offset or block_size are changed Conflicts: arch/arm64/kvm/hyp.S Fixed compilation issue due to variable 'backing_dev_info', which got changed to pointer in downstream. Change-Id: I8baa569fe9fc13ed5a7e863e5ad1fb8cf1cd469e Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | | | Merge 4.4.172 into android-4.4Greg Kroah-Hartman2019-01-28
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.172 tty/ldsem: Wake up readers after timed out down_write() can: gw: ensure DLC boundaries after CAN frame modification f2fs: clean up argument of recover_data f2fs: cover more area with nat_tree_lock f2fs: move sanity checking of cp into get_valid_checkpoint f2fs: fix to convert inline directory correctly f2fs: give -EINVAL for norecovery and rw mount f2fs: remove an obsolete variable f2fs: factor out fsync inode entry operations f2fs: fix inode cache leak f2fs: fix to avoid reading out encrypted data in page cache f2fs: not allow to write illegal blkaddr f2fs: avoid unneeded loop in build_sit_entries f2fs: use crc and cp version to determine roll-forward recovery f2fs: introduce get_checkpoint_version for cleanup f2fs: put directory inodes before checkpoint in roll-forward recovery f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack f2fs: detect wrong layout f2fs: free meta pages if sanity check for ckpt is failed f2fs: fix race condition in between free nid allocator/initializer f2fs: return error during fill_super f2fs: check blkaddr more accuratly before issue a bio f2fs: sanity check on sit entry f2fs: enhance sanity_check_raw_super() to avoid potential overflow f2fs: clean up with is_valid_blkaddr() f2fs: introduce and spread verify_blkaddr f2fs: fix to do sanity check with secs_per_zone f2fs: fix to do sanity check with user_block_count f2fs: Add sanity_check_inode() function f2fs: fix to do sanity check with node footer and iblocks f2fs: fix to do sanity check with reserved blkaddr of inline inode f2fs: fix to do sanity check with block address in main area f2fs: fix to do sanity check with block address in main area v2 f2fs: fix to do sanity check with cp_pack_start_sum f2fs: fix invalid memory access f2fs: fix missing up_read f2fs: fix validation of the block count in sanity_check_raw_super media: em28xx: Fix misplaced reset of dev->v4l::field_count proc: Remove empty line in /proc/self/status arm64/kvm: consistently handle host HCR_EL2 flags arm64: Don't trap host pointer auth use to EL2 ipv6: fix kernel-infoleak in ipv6_local_error() net: bridge: fix a bug on using a neighbour cache entry without checking its state packet: Do not leak dev refcounts on error exit ip: on queued skb use skb_header_pointer instead of pskb_may_pull crypto: authencesn - Avoid twice completion call in decrypt path crypto: authenc - fix parsing key with misaligned rta_len btrfs: wait on ordered extents on abort cleanup Yama: Check for pid death before checking ancestry scsi: sd: Fix cache_type_store() mips: fix n32 compat_ipc_parse_version mfd: tps6586x: Handle interrupts on suspend Disable MSI also when pcie-octeon.pcie_disable on omap2fb: Fix stack memory disclosure media: vivid: fix error handling of kthread_run media: vivid: set min width/height to a value > 0 LSM: Check for NULL cred-security on free media: vb2: vb2_mmap: move lock up sunrpc: handle ENOMEM in rpcb_getport_async selinux: fix GPF on invalid policy sctp: allocate sctp_sockaddr_entry with kzalloc tipc: fix uninit-value in tipc_nl_compat_link_reset_stats tipc: fix uninit-value in tipc_nl_compat_bearer_enable tipc: fix uninit-value in tipc_nl_compat_link_set tipc: fix uninit-value in tipc_nl_compat_name_table_dump tipc: fix uninit-value in tipc_nl_compat_doit block/loop: Use global lock for ioctl() operation. loop: Fold __loop_release into loop_release loop: Get rid of loop_index_mutex loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl() drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock media: vb2: be sure to unlock mutex on errors r8169: Add support for new Realtek Ethernet ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses xfs: don't fail when converting shortform attr to long form during ATTR_REPLACE platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey e1000e: allow non-monotonic SYSTIM readings writeback: don't decrement wb->refcnt if !wb->bdi MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur arm64: perf: set suppress_bind_attrs flag to true jffs2: Fix use of uninitialized delayed_work, lockdep breakage pstore/ram: Do not treat empty buffers as valid powerpc/pseries/cpuidle: Fix preempt warning media: firewire: Fix app_info parameter type in avc_ca{,_app}_info net: call sk_dst_reset when set SO_DONTROUTE scsi: target: use consistent left-aligned ASCII INQUIRY data clk: imx6q: reset exclusive gates on init kconfig: fix file name and line number of warn_ignored_character() kconfig: fix memory leak when EOF is encountered in quotation mmc: atmel-mci: do not assume idle after atmci_request_end perf intel-pt: Fix error with config term "pt=0" perf svghelper: Fix unchecked usage of strncpy() perf parse-events: Fix unchecked usage of strncpy() dm kcopyd: Fix bug causing workqueue stalls dm snapshot: Fix excessive memory usage and workqueue stalls ALSA: bebob: fix model-id of unit for Apogee Ensemble sysfs: Disable lockdep for driver bind/unbind files scsi: megaraid: fix out-of-bound array accesses ocfs2: fix panic due to unrecovered local alloc mm/page-writeback.c: don't break integrity writeback on ->writepage() error mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps net: speed up skb_rbtree_purge() ipmi:ssif: Fix handling of multi-part return messages Linux 4.4.172 Change-Id: I02fc31d06efaf5fa116c7db95e7a543757f592ff Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | | selinux: fix GPF on invalid policyStephen Smalley2019-01-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 5b0e7310a2a33c06edc7eb81ffc521af9b2c5610 upstream. levdatum->level can be NULL if we encounter an error while loading the policy during sens_read prior to initializing it. Make sure sens_destroy handles that case correctly. Reported-by: syzbot+6664500f0f18f07a5c0e@syzkaller.appspotmail.com Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | | | | LSM: Check for NULL cred-security on freeJames Morris2019-01-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a5795fd38ee8194451ba3f281f075301a3696ce2 upstream. From: Casey Schaufler <casey@schaufler-ca.com> Check that the cred security blob has been set before trying to clean it up. There is a case during credential initialization that could result in this. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Acked-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.morris@microsoft.com> Reported-by: syzbot+69ca07954461f189e808@syzkaller.appspotmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * | | | | | | Yama: Check for pid death before checking ancestryKees Cook2019-01-26
| | | |_|_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 9474f4e7cd71a633fa1ef93b7daefd44bbdfd482 upstream. It's possible that a pid has died before we take the rcu lock, in which case we can't walk the ancestry list as it may be detached. Instead, check for death first before doing the walk. Reported-by: syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com Fixes: 2d514487faf1 ("security: Yama LSM") Cc: stable@vger.kernel.org Suggested-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | | | Merge android-4.4.168 (66a37fc) into msm-4.4Srinivasarao P2018-12-21
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-66a37fc Linux 4.4.168 selftests: Move networking/timestamping from Documentation rocker: fix rocker_tlv_put_* functions for KASAN staging: speakup: Replace strncpy with memcpy matroxfb: fix size of memcpy media: dvb-frontends: fix i2c access helpers for KASAN proc: do not access cmdline nor environ from file-backed areas proc: don't use FOLL_FORCE for reading cmdline and environment mm: replace access_remote_vm() write parameter with gup_flags mm: replace __access_remote_vm() write parameter with gup_flags mm: replace get_user_pages() write/force parameters with gup_flags mm: replace get_vaddr_frames() write/force parameters with gup_flags mm: replace get_user_pages_locked() write/force parameters with gup_flags mm: replace get_user_pages_unlocked() write/force parameters with gup_flags mm/nommu.c: Switch __get_user_pages_unlocked() to use __get_user_pages() mm: remove write/force parameters from __get_user_pages_unlocked() mm: remove write/force parameters from __get_user_pages_locked() sr: pass down correctly sized SCSI sense buffer swiotlb: clean up reporting hugetlbfs: fix bug in pgoff overflow checking hugetlbfs: check for pgoff value overflow hugetlbfs: fix offset overflow in hugetlbfs mmap mm/hugetlb.c: don't call region_abort if region_chg fails posix-timers: Sanitize overrun handling wil6210: missing length check in wmi_set_ie bpf: Prevent memory disambiguation attack bpf/verifier: Pass instruction index to check_mem_access() and check_xadd() bpf/verifier: Add spi variable to check_stack_write() bpf: support 8-byte metafield access KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL KVM: SVM: Move spec control call after restore of GS x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest x86/bugs, KVM: Support the combination of guest and host IBRS x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end} x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec x86: fix SMAP in 32-bit environments x86: reorganize SMAP handling in user space accesses KVM/x86: Remove indirect MSR op calls from SPEC_CTRL KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES KVM/x86: Add IBPB support KVM: VMX: make MSR bitmaps per-VCPU KVM: VMX: introduce alloc_loaded_vmcs KVM: nVMX: Eliminate vmcs02 pool KVM: nVMX: mark vmcs12 pages dirty on L2 exit KVM: nVMX: fix msr bitmaps to prevent L2 from accessing L0 x2APIC ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command pstore: Convert console write to use ->write_buf ocfs2: fix potential use after free debugobjects: avoid recursive calls with kmemleak hfsplus: do not free node before using hfs: do not free node before using ocfs2: fix deadlock caused by ocfs2_defrag_extent() fscache, cachefiles: remove redundant variable 'cache' fscache: fix race between enablement and dropping of object xen: xlate_mmu: add missing header to fix 'W=1' warning drm/ast: fixed reading monitor EDID not stable issue net: hisilicon: remove unexpected free_netdev ixgbe: recognize 1000BaseLX SFP modules as 1Gbps net: thunderx: fix NULL pointer dereference in nic_remove KVM: x86: fix empty-body warnings USB: omap_udc: fix USB gadget functionality on Palm Tungsten E USB: omap_udc: fix omap_udc_start() on 15xx machines USB: omap_udc: fix crashes on probe error and module removal USB: omap_udc: use devm_request_irq() bpf: fix check of allowed specifiers in bpf_trace_printk exportfs: do not read dentry after free ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE Btrfs: send, fix infinite loop due to directory rename dependencies hwmon: (w83795) temp4_type has writable permission ASoC: dapm: Recalculate audio map forcely when card instantiated hwmon: (ina2xx) Fix current value calculation s390/cpum_cf: Reject request for sampling in event initialization sysv: return 'err' instead of 0 in __sysv_write_inode ARM: OMAP1: ams-delta: Fix possible use of uninitialized field ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup neighbour: Avoid writing before skb->head in neigh_hh_output() tun: forbid iface creation with rtnl ops tcp: fix NULL ref in tail loss probe rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices net: Prevent invalid access to skb->prev in __qdisc_drop_all net: phy: don't allow __set_phy_supported to add unsupported modes net: 8139cp: fix a BUG triggered by changing mtu with network traffic ipv6: Check available headroom in ip6_xmit() even without options ANDROID: uid_sys_stats: Copy task_struct comm field to bigger buffer Conflicts: arch/x86/include/asm/uaccess_32.h sound/core/pcm_native.c Change-Id: I1d20594091279ae84c58669dd8ad5fa5e31989ab [fixed compilation issue in kgsl.c] Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | | Merge 4.4.168 into android-4.4Greg Kroah-Hartman2018-12-19
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.168 ipv6: Check available headroom in ip6_xmit() even without options net: 8139cp: fix a BUG triggered by changing mtu with network traffic net: phy: don't allow __set_phy_supported to add unsupported modes net: Prevent invalid access to skb->prev in __qdisc_drop_all rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices tcp: fix NULL ref in tail loss probe tun: forbid iface creation with rtnl ops neighbour: Avoid writing before skb->head in neigh_hh_output() ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup ARM: OMAP1: ams-delta: Fix possible use of uninitialized field sysv: return 'err' instead of 0 in __sysv_write_inode s390/cpum_cf: Reject request for sampling in event initialization hwmon: (ina2xx) Fix current value calculation ASoC: dapm: Recalculate audio map forcely when card instantiated hwmon: (w83795) temp4_type has writable permission Btrfs: send, fix infinite loop due to directory rename dependencies ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE exportfs: do not read dentry after free bpf: fix check of allowed specifiers in bpf_trace_printk USB: omap_udc: use devm_request_irq() USB: omap_udc: fix crashes on probe error and module removal USB: omap_udc: fix omap_udc_start() on 15xx machines USB: omap_udc: fix USB gadget functionality on Palm Tungsten E KVM: x86: fix empty-body warnings net: thunderx: fix NULL pointer dereference in nic_remove ixgbe: recognize 1000BaseLX SFP modules as 1Gbps net: hisilicon: remove unexpected free_netdev drm/ast: fixed reading monitor EDID not stable issue xen: xlate_mmu: add missing header to fix 'W=1' warning fscache: fix race between enablement and dropping of object fscache, cachefiles: remove redundant variable 'cache' ocfs2: fix deadlock caused by ocfs2_defrag_extent() hfs: do not free node before using hfsplus: do not free node before using debugobjects: avoid recursive calls with kmemleak ocfs2: fix potential use after free pstore: Convert console write to use ->write_buf ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command KVM: nVMX: fix msr bitmaps to prevent L2 from accessing L0 x2APIC KVM: nVMX: mark vmcs12 pages dirty on L2 exit KVM: nVMX: Eliminate vmcs02 pool KVM: VMX: introduce alloc_loaded_vmcs KVM: VMX: make MSR bitmaps per-VCPU KVM/x86: Add IBPB support KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL KVM/x86: Remove indirect MSR op calls from SPEC_CTRL x86: reorganize SMAP handling in user space accesses x86: fix SMAP in 32-bit environments x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end} x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec x86/bugs, KVM: Support the combination of guest and host IBRS x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest KVM: SVM: Move spec control call after restore of GS x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD bpf: support 8-byte metafield access bpf/verifier: Add spi variable to check_stack_write() bpf/verifier: Pass instruction index to check_mem_access() and check_xadd() bpf: Prevent memory disambiguation attack wil6210: missing length check in wmi_set_ie posix-timers: Sanitize overrun handling mm/hugetlb.c: don't call region_abort if region_chg fails hugetlbfs: fix offset overflow in hugetlbfs mmap hugetlbfs: check for pgoff value overflow hugetlbfs: fix bug in pgoff overflow checking swiotlb: clean up reporting sr: pass down correctly sized SCSI sense buffer mm: remove write/force parameters from __get_user_pages_locked() mm: remove write/force parameters from __get_user_pages_unlocked() mm/nommu.c: Switch __get_user_pages_unlocked() to use __get_user_pages() mm: replace get_user_pages_unlocked() write/force parameters with gup_flags mm: replace get_user_pages_locked() write/force parameters with gup_flags mm: replace get_vaddr_frames() write/force parameters with gup_flags mm: replace get_user_pages() write/force parameters with gup_flags mm: replace __access_remote_vm() write parameter with gup_flags mm: replace access_remote_vm() write parameter with gup_flags proc: don't use FOLL_FORCE for reading cmdline and environment proc: do not access cmdline nor environ from file-backed areas media: dvb-frontends: fix i2c access helpers for KASAN matroxfb: fix size of memcpy staging: speakup: Replace strncpy with memcpy rocker: fix rocker_tlv_put_* functions for KASAN selftests: Move networking/timestamping from Documentation Linux 4.4.168 Change-Id: I71a633f645fada4b473abcff660a9ada3103592b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | | mm: replace get_user_pages() write/force parameters with gup_flagsLorenzo Stoakes2018-12-17
| | | |_|_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 768ae309a96103ed02eb1e111e838c87854d8b51 upstream. This removes the 'write' and 'force' from get_user_pages() and replaces them with 'gup_flags' to make the use of FOLL_FORCE explicit in callers as use of this flag can result in surprising behaviour (and hence bugs) within the mm subsystem. Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com> Acked-by: Christian König <christian.koenig@amd.com> Acked-by: Jesper Nilsson <jesper.nilsson@axis.com> Acked-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> [bwh: Backported to 4.4: - Drop changes in rapidio, vchiq, goldfish - Keep the "write" variable in amdgpu_ttm_tt_pin_userptr() as it's still needed - Also update calls from various other places that now use get_user_pages_remote() upstream, which were updated there by commit 9beae1ea8930 "mm: replace get_user_pages_remote() write/force ..." - Also update calls from hfi1 and ipath - Adjust context] Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | | Merge android-4.4.164 (564ce1b) into msm-4.4Srinivasarao P2018-11-21
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-564ce1b Linux 4.4.164 drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values drm/dp_mst: Check if primary mstb is null drm/rockchip: Allow driver to be shutdown on reboot/kexec mm: migration: fix migration of huge PMD shared pages hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! configfs: replace strncpy with memcpy fuse: fix leaked notify reply rtc: hctosys: Add missing range error reporting sunrpc: correct the computation for page_ptr when truncating mount: Prevent MNT_DETACH from disconnecting locked mounts mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts mount: Retest MNT_LOCKED in do_umount ext4: fix buffer leak in __ext4_read_dirblock() on error path ext4: fix buffer leak in ext4_xattr_move_to_block() on error path ext4: release bs.bh before re-using in ext4_xattr_block_find() ext4: fix possible leak of sbi->s_group_desc_leak in error path ext4: avoid possible double brelse() in add_new_gdb() on error path ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing ext4: avoid buffer leak in ext4_orphan_add() after prior errors ext4: fix possible inode leak in the retry loop of ext4_resize_fs() ext4: avoid potential extra brelse in setup_new_flex_group_blocks() ext4: add missing brelse() add_new_gdb_meta_bg()'s error path ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path ext4: add missing brelse() update_backups()'s error path clockevents/drivers/i8253: Add support for PIT shutdown quirk Btrfs: fix data corruption due to cloning of eof block arch/alpha, termios: implement BOTHER, IBSHIFT and termios2 termios, tty/tty_baudrate.c: fix buffer overrun mtd: docg3: don't set conflicting BCH_CONST_PARAMS option mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry vhost/scsi: truncate T10 PI iov_iter to prot_bytes mach64: fix image corruption due to reading accelerator registers mach64: fix display corruption on big endian machines libceph: bump CEPH_MSG_MAX_DATA_LEN clk: s2mps11: Fix matching when built as module and DT node contains compatible xtensa: fix boot parameters address translation xtensa: make sure bFLT stack is 16 byte aligned xtensa: add NOTES section to the linker script MIPS: Loongson-3: Fix BRIDGE irq delivery problem MIPS: Loongson-3: Fix CPU UART irq delivery problem bna: ethtool: Avoid reading past end of buffer e1000: fix race condition between e1000_down() and e1000_watchdog e1000: avoid null pointer dereference on invalid stat type mm: do not bug_on on incorrect length in __mm_populate() fs, elf: make sure to page align bss in load_elf_library mm: refuse wrapped vm_brk requests binfmt_elf: fix calculations for bss padding mm, elf: handle vm_brk error fuse: set FR_SENT while locked fuse: fix blocked_waitq wakeup fuse: Fix use-after-free in fuse_dev_do_write() fuse: Fix use-after-free in fuse_dev_do_read() scsi: qla2xxx: Fix incorrect port speed being set for FC adapters cdrom: fix improper type cast, which can leat to information leak. 9p: clear dangling pointers in p9stat_free 9p locks: fix glock.client_id leak in do_lock media: tvp5150: fix width alignment during set_selection() sc16is7xx: Fix for multi-channel stall powerpc/boot: Ensure _zimage_start is a weak symbol MIPS: kexec: Mark CPU offline before disabling local IRQ media: pci: cx23885: handle adding to list failure drm/omap: fix memory barrier bug in DMM driver powerpc/nohash: fix undefined behaviour when testing page size support tty: check name length in tty_find_polling_driver() MD: fix invalid stored role for a disk - try2 btrfs: set max_extent_size properly Btrfs: fix null pointer dereference on compressed write path error btrfs: qgroup: Dirty all qgroups before rescan Btrfs: fix wrong dentries after fsync of file that got its parent replaced btrfs: make sure we create all new block groups btrfs: reset max_extent_size on clear in a bitmap btrfs: wait on caching when putting the bg cache btrfs: don't attempt to trim devices that don't support it btrfs: iterate all devices during trim, instead of fs_devices::alloc_list btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock btrfs: Handle owner mismatch gracefully when walking up tree soc/tegra: pmc: Fix child-node lookup arm64: dts: stratix10: Correct System Manager register size Cramfs: fix abad comparison when wrap-arounds occur ext4: avoid running out of journal credits when appending to an inline file media: em28xx: make v4l2-compliance happier by starting sequence on zero media: em28xx: fix input name for Terratec AV 350 media: em28xx: use a default format if TRY_FMT fails xen: fix xen_qlock_wait() kgdboc: Passing ekgdboc to command line causes panic TC: Set DMA masks for devices MIPS: OCTEON: fix out of bounds array access on CN68XX powerpc/msi: Fix compile error on mpc83xx dm ioctl: harden copy_params()'s copy_from_user() from malicious users lockd: fix access beyond unterminated strings in prints nfsd: Fix an Oops in free_session() NFSv4.1: Fix the r/wsize checking genirq: Fix race on spurious interrupt detection printk: Fix panic caused by passing log_buf_len to command line smb3: on kerberos mount if server doesn't specify auth type use krb5 smb3: do not attempt cifs operation in smb3 query info error path smb3: allow stats which track session and share reconnects to be reset w1: omap-hdq: fix missing bus unregister at removal iio: adc: at91: fix wrong channel number in triggered buffer mode iio: adc: at91: fix acking DRDY irq on simple conversions kbuild: fix kernel/bounds.c 'W=1' warning hugetlbfs: dirty pages as they are added to pagecache ima: fix showing large 'violations' or 'runtime_measurements_count' crypto: lrw - Fix out-of bounds access on counter overflow signal/GenWQE: Fix sending of SIGKILL PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk HID: hiddev: fix potential Spectre v1 ext4: initialize retries variable in ext4_da_write_inline_data_begin() gfs2_meta: ->mount() can get NULL dev_name jbd2: fix use after free in jbd2_log_do_checkpoint() libnvdimm: Hold reference on parent while scheduling async init net/ipv4: defensive cipso option parsing xen: make xen_qlock_wait() nestable xen: fix race in xen_qlock_wait() tpm: Restore functionality to xen vtpm driver. xen-swiotlb: use actually allocated size on check physical continuous ALSA: hda: Check the non-cached stream buffers more explicitly dmaengine: dma-jz4780: Return error if not probed from DT signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init scsi: lpfc: Correct soft lockup when running mds diagnostics uio: ensure class is registered before devices driver/dma/ioat: Call del_timer_sync() without holding prep_lock usb: chipidea: Prevent unbalanced IRQ disable MD: fix invalid stored role for a disk ext4: fix argument checking in EXT4_IOC_MOVE_EXT tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated scsi: megaraid_sas: fix a missing-check bug scsi: esp_scsi: Track residual for PIO transfers ath10k: schedule hardware restart if WMI command times out pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant pinctrl: qcom: spmi-mpp: Fix drive strength setting ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers kprobes: Return error if we fail to reuse kprobe instead of BUG_ON() pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux x86: boot: Fix EFI stub alignment Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01 perf tools: Cleanup trace-event-info 'tdata' leak perf tools: Free temporary 'sys' string in read_event_files() tun: Consistently configure generic netdev params via rtnetlink swim: fix cleanup on setup error ataflop: fix error handling during setup locking/lockdep: Fix debug_locks off performance problem selftests: ftrace: Add synthetic event syntax testcase net: qla3xxx: Remove overflowing shift statement x86/fpu: Remove second definition of fpu in __fpu__restore_sig() sparc: Fix single-pcr perf event counter management. x86/kconfig: Fall back to ticket spinlocks x86/corruption-check: Fix panic in memory_corruption_check() when boot option without value is provided ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905) parisc: Fix map_pages() to not overwrite existing pte entries parisc: Fix address in HPMC IVA ipmi: Fix timer race with module unload pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges jffs2: free jffs2_sb_info through jffs2_kill_sb() hwmon: (pmbus) Fix page count auto-detection. bcache: fix miss key refill->end in writeback ANDROID: zram: set comp_len to PAGE_SIZE when page is huge Conflicts: drivers/hid/usbhid/hiddev.c Change-Id: I42874613e3b4102ef4ed051e1e8ed25b2d4ae7f2 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | | Merge 4.4.164 into android-4.4Greg Kroah-Hartman2018-11-21
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.164 bcache: fix miss key refill->end in writeback hwmon: (pmbus) Fix page count auto-detection. jffs2: free jffs2_sb_info through jffs2_kill_sb() pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges ipmi: Fix timer race with module unload parisc: Fix address in HPMC IVA parisc: Fix map_pages() to not overwrite existing pte entries ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905) ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops x86/corruption-check: Fix panic in memory_corruption_check() when boot option without value is provided x86/kconfig: Fall back to ticket spinlocks sparc: Fix single-pcr perf event counter management. x86/fpu: Remove second definition of fpu in __fpu__restore_sig() net: qla3xxx: Remove overflowing shift statement selftests: ftrace: Add synthetic event syntax testcase locking/lockdep: Fix debug_locks off performance problem ataflop: fix error handling during setup swim: fix cleanup on setup error tun: Consistently configure generic netdev params via rtnetlink perf tools: Free temporary 'sys' string in read_event_files() perf tools: Cleanup trace-event-info 'tdata' leak mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01 Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth x86: boot: Fix EFI stub alignment pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux kprobes: Return error if we fail to reuse kprobe instead of BUG_ON() ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers pinctrl: qcom: spmi-mpp: Fix drive strength setting pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant ath10k: schedule hardware restart if WMI command times out scsi: esp_scsi: Track residual for PIO transfers scsi: megaraid_sas: fix a missing-check bug tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated ext4: fix argument checking in EXT4_IOC_MOVE_EXT MD: fix invalid stored role for a disk usb: chipidea: Prevent unbalanced IRQ disable driver/dma/ioat: Call del_timer_sync() without holding prep_lock uio: ensure class is registered before devices scsi: lpfc: Correct soft lockup when running mds diagnostics signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init dmaengine: dma-jz4780: Return error if not probed from DT ALSA: hda: Check the non-cached stream buffers more explicitly xen-swiotlb: use actually allocated size on check physical continuous tpm: Restore functionality to xen vtpm driver. xen: fix race in xen_qlock_wait() xen: make xen_qlock_wait() nestable net/ipv4: defensive cipso option parsing libnvdimm: Hold reference on parent while scheduling async init jbd2: fix use after free in jbd2_log_do_checkpoint() gfs2_meta: ->mount() can get NULL dev_name ext4: initialize retries variable in ext4_da_write_inline_data_begin() HID: hiddev: fix potential Spectre v1 PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk signal/GenWQE: Fix sending of SIGKILL crypto: lrw - Fix out-of bounds access on counter overflow ima: fix showing large 'violations' or 'runtime_measurements_count' hugetlbfs: dirty pages as they are added to pagecache kbuild: fix kernel/bounds.c 'W=1' warning iio: adc: at91: fix acking DRDY irq on simple conversions iio: adc: at91: fix wrong channel number in triggered buffer mode w1: omap-hdq: fix missing bus unregister at removal smb3: allow stats which track session and share reconnects to be reset smb3: do not attempt cifs operation in smb3 query info error path smb3: on kerberos mount if server doesn't specify auth type use krb5 printk: Fix panic caused by passing log_buf_len to command line genirq: Fix race on spurious interrupt detection NFSv4.1: Fix the r/wsize checking nfsd: Fix an Oops in free_session() lockd: fix access beyond unterminated strings in prints dm ioctl: harden copy_params()'s copy_from_user() from malicious users powerpc/msi: Fix compile error on mpc83xx MIPS: OCTEON: fix out of bounds array access on CN68XX TC: Set DMA masks for devices kgdboc: Passing ekgdboc to command line causes panic xen: fix xen_qlock_wait() media: em28xx: use a default format if TRY_FMT fails media: em28xx: fix input name for Terratec AV 350 media: em28xx: make v4l2-compliance happier by starting sequence on zero ext4: avoid running out of journal credits when appending to an inline file Cramfs: fix abad comparison when wrap-arounds occur arm64: dts: stratix10: Correct System Manager register size soc/tegra: pmc: Fix child-node lookup btrfs: Handle owner mismatch gracefully when walking up tree btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock btrfs: iterate all devices during trim, instead of fs_devices::alloc_list btrfs: don't attempt to trim devices that don't support it btrfs: wait on caching when putting the bg cache btrfs: reset max_extent_size on clear in a bitmap btrfs: make sure we create all new block groups Btrfs: fix wrong dentries after fsync of file that got its parent replaced btrfs: qgroup: Dirty all qgroups before rescan Btrfs: fix null pointer dereference on compressed write path error btrfs: set max_extent_size properly MD: fix invalid stored role for a disk - try2 tty: check name length in tty_find_polling_driver() powerpc/nohash: fix undefined behaviour when testing page size support drm/omap: fix memory barrier bug in DMM driver media: pci: cx23885: handle adding to list failure MIPS: kexec: Mark CPU offline before disabling local IRQ powerpc/boot: Ensure _zimage_start is a weak symbol sc16is7xx: Fix for multi-channel stall media: tvp5150: fix width alignment during set_selection() 9p locks: fix glock.client_id leak in do_lock 9p: clear dangling pointers in p9stat_free cdrom: fix improper type cast, which can leat to information leak. scsi: qla2xxx: Fix incorrect port speed being set for FC adapters fuse: Fix use-after-free in fuse_dev_do_read() fuse: Fix use-after-free in fuse_dev_do_write() fuse: fix blocked_waitq wakeup fuse: set FR_SENT while locked mm, elf: handle vm_brk error binfmt_elf: fix calculations for bss padding mm: refuse wrapped vm_brk requests fs, elf: make sure to page align bss in load_elf_library mm: do not bug_on on incorrect length in __mm_populate() e1000: avoid null pointer dereference on invalid stat type e1000: fix race condition between e1000_down() and e1000_watchdog bna: ethtool: Avoid reading past end of buffer MIPS: Loongson-3: Fix CPU UART irq delivery problem MIPS: Loongson-3: Fix BRIDGE irq delivery problem xtensa: add NOTES section to the linker script xtensa: make sure bFLT stack is 16 byte aligned xtensa: fix boot parameters address translation clk: s2mps11: Fix matching when built as module and DT node contains compatible libceph: bump CEPH_MSG_MAX_DATA_LEN mach64: fix display corruption on big endian machines mach64: fix image corruption due to reading accelerator registers vhost/scsi: truncate T10 PI iov_iter to prot_bytes ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings mtd: docg3: don't set conflicting BCH_CONST_PARAMS option termios, tty/tty_baudrate.c: fix buffer overrun arch/alpha, termios: implement BOTHER, IBSHIFT and termios2 Btrfs: fix data corruption due to cloning of eof block clockevents/drivers/i8253: Add support for PIT shutdown quirk ext4: add missing brelse() update_backups()'s error path ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path ext4: add missing brelse() add_new_gdb_meta_bg()'s error path ext4: avoid potential extra brelse in setup_new_flex_group_blocks() ext4: fix possible inode leak in the retry loop of ext4_resize_fs() ext4: avoid buffer leak in ext4_orphan_add() after prior errors ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing ext4: avoid possible double brelse() in add_new_gdb() on error path ext4: fix possible leak of sbi->s_group_desc_leak in error path ext4: release bs.bh before re-using in ext4_xattr_block_find() ext4: fix buffer leak in ext4_xattr_move_to_block() on error path ext4: fix buffer leak in __ext4_read_dirblock() on error path mount: Retest MNT_LOCKED in do_umount mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts mount: Prevent MNT_DETACH from disconnecting locked mounts sunrpc: correct the computation for page_ptr when truncating rtc: hctosys: Add missing range error reporting fuse: fix leaked notify reply configfs: replace strncpy with memcpy hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! mm: migration: fix migration of huge PMD shared pages drm/rockchip: Allow driver to be shutdown on reboot/kexec drm/dp_mst: Check if primary mstb is null drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values Linux 4.4.164 Change-Id: I55f9e5e33efd8c8ae2609d2393696c810f49f33e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | | ima: fix showing large 'violations' or 'runtime_measurements_count'Eric Biggers2018-11-21
| | | |_|_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1e4c8dafbb6bf72fb5eca035b861e39c5896c2b7 upstream. The 12 character temporary buffer is not necessarily long enough to hold a 'long' value. Increase it. Signed-off-by: Eric Biggers <ebiggers@google.com> Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | | | Merge android-4.4.163 (0ca3fca) into msm-4.4Srinivasarao P2018-11-15
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-0ca3fca Linux 4.4.163 x86/time: Correct the attribute on jiffies' definition l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE x86/percpu: Fix this_cpu_read() sched/fair: Fix throttle_list starvation with low CFS quota Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM USB: fix the usbfs flag sanitization for control transfers usb: gadget: storage: Fix Spectre v1 vulnerability cdc-acm: correct counting of UART states in serial state notification IB/ucm: Fix Spectre v1 vulnerability RDMA/ucma: Fix Spectre v1 vulnerability ptp: fix Spectre v1 vulnerability cachefiles: fix the race between cachefiles_bury_object() and rmdir(2) ahci: don't ignore result code of ahci_reset_controller() crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned mremap: properly flush TLB before releasing the page rtnetlink: Disallow FDB configuration for non-Ethernet device vhost: Fix Spectre V1 vulnerability net: drop skb on failure in ip_check_defrag() sctp: fix race on sctp_id2asoc r8169: fix NAPI handling under high load net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules net: socket: fix a missing-check bug net: sched: gred: pass the right attribute to gred_change_table_def() net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called ipv6: mcast: fix a use-after-free in inet6_mc_check net: bridge: remove ipv6 zero address check in mcast queries bridge: do not add port to router list when receives query with source 0.0.0.0 perf tools: Disable parallelism for 'make clean' mtd: spi-nor: Add support for is25wp series chips fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters() ARM: dts: imx53-qsb: disable 1.2GHz OPP MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression igb: Remove superfluous reset to PHY and page 0 selection MIPS: microMIPS: Fix decoding of swsp16 instruction scsi: aacraid: Fix typo in blink status bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal PM / devfreq: tegra: fix error return code in tegra_devfreq_probe() ASoC: spear: fix error return code in spdif_in_probe() spi: xlp: fix error return code in xlp_spi_probe() spi/bcm63xx: fix error return code in bcm63xx_spi_probe() MIPS: Handle non word sized instructions when examining frame spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe() usb: dwc3: omap: fix error return code in dwc3_omap_probe() usb: ehci-omap: fix error return code in ehci_hcd_omap_probe() usb: imx21-hcd: fix error return code in imx21_probe() gpio: msic: fix error return code in platform_msic_gpio_probe() sparc64: Fix exception handling in UltraSPARC-III memcpy. gpu: host1x: fix error return code in host1x_probe() sparc64 mm: Fix more TSB sizing issues video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe() tty: serial: sprd: fix error return code in sprd_probe() l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain gro: Allow tunnel stacking in the case of FOU/GUE vti6: flush x-netns xfrm cache when vti interface is removed ALSA: timer: Fix zero-division by continue of uninitialized instance ixgbe: Correct X550EM_x revision check ixgbe: fix RSS limit for X550 net/mlx5e: Correctly handle RSS indirection table when changing number of channels net/mlx5e: Fix LRO modify ixgbevf: Fix handling of NAPI budget when multiple queues are enabled per vector fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio drm/nouveau/fbcon: fix oops without fbdev emulation bpf: generally move prog destruction to RCU deferral usb-storage: fix bogus hardware error messages for ATA pass-thru devices sch_red: update backlog as well sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state xfrm: Clear sk_dst_cache when applying per-socket policy. arm64: Fix potential race with hardware DBM in ptep_set_access_flags() CIFS: handle guest access errors to Windows shares ASoC: wm8940: Enable cache usage to fix crashes on resume ASoC: ak4613: Enable cache usage to fix crashes on resume MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue usbvision: revert commit 588afcc1 perf/core: Don't leak event in the syscall error path aacraid: Start adapter after updating number of MSIX vectors x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs tpm: fix: return rc when devm_add_action() fails thermal: allow u8500-thermal driver to be a module thermal: allow spear-thermal driver to be a module btrfs: don't create or leak aliased root while cleaning up orphans sched/cgroup: Fix cgroup entity load tracking tear-down um: Avoid longjmp/setjmp symbol clashes with libpthread.a ipv6: orphan skbs in reassembly unit net/mlx4_en: Resolve dividing by zero in 32-bit system af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers radix-tree: fix radix_tree_iter_retry() for tagged iterators. x86/mm/pat: Prevent hang during boot when mapping pages ARM: dts: apq8064: add ahci ports-implemented mask tracing: Skip more functions when doing stack tracing of events ser_gigaset: use container_of() instead of detour net: drop write-only stack variable ipv6: suppress sparse warnings in IP6_ECN_set_ce() KEYS: put keyring if install_session_keyring_to_cred() fails net: cxgb3_main: fix a missing-check bug perf/ring_buffer: Prevent concurent ring buffer access smsc95xx: Check for Wake-on-LAN modes smsc75xx: Check for Wake-on-LAN modes r8152: Check for supported Wake-on-LAN Modes sr9800: Check for supported Wake-on-LAN modes lan78xx: Check for supported Wake-on-LAN modes ax88179_178a: Check for supported Wake-on-LAN modes asix: Check for supported Wake-on-LAN modes pxa168fb: prepare the clock Bluetooth: SMP: fix crash in unpairing mac80211_hwsim: do not omit multicast announce of first added radio xfrm: validate template mode ARM: 8799/1: mm: fix pci_ioremap_io() offset check cfg80211: reg: Init wiphy_idx in regulatory_hint_core() mac80211: Always report TX status xfrm6: call kfree_skb when skb is toobig xfrm: Validate address prefix lengths in the xfrm selector. BACKPORT: xfrm: Allow Output Mark to be Updated Using UPDSA ANDROID: sdcardfs: Add option to drop unused dentries f2fs: guarantee journalled quota data by checkpoint f2fs: cleanup dirty pages if recover failed f2fs: fix data corruption issue with hardware encryption f2fs: fix to recover inode->i_flags of inode block during POR f2fs: spread f2fs_set_inode_flags() f2fs: fix to spread clear_cold_data() Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()" f2fs: account read IOs and use IO counts for is_idle f2fs: fix to account IO correctly for cgroup writeback f2fs: fix to account IO correctly f2fs: remove request_list check in is_idle() f2fs: allow to mount, if quota is failed f2fs: update REQ_TIME in f2fs_cross_rename() f2fs: do not update REQ_TIME in case of error conditions f2fs: remove unneeded disable_nat_bits() f2fs: remove unused sbi->trigger_ssr_threshold f2fs: shrink sbi->sb_lock coverage in set_file_temperature() f2fs: fix to recover cold bit of inode block during POR f2fs: submit cached bio to avoid endless PageWriteback f2fs: checkpoint disabling f2fs: clear PageError on the read path f2fs: allow out-place-update for direct IO in LFS mode f2fs: refactor ->page_mkwrite() flow Revert: "f2fs: check last page index in cached bio to decide submission" f2fs: support superblock checksum f2fs: add to account skip count of background GC f2fs: add to account meta IO f2fs: keep lazytime on remount f2fs: fix missing up_read f2fs: return correct errno in f2fs_gc f2fs: avoid f2fs_bug_on if f2fs_get_meta_page_nofail got EIO f2fs: mark inode dirty explicitly in recover_inode() f2fs: fix to recover inode's crtime during POR f2fs: fix to recover inode's i_gc_failures during POR f2fs: fix to recover inode's i_flags during POR f2fs: fix to recover inode's project id during POR f2fs: update i_size after DIO completion f2fs: report ENOENT correctly in f2fs_rename f2fs: fix remount problem of option io_bits f2fs: fix to recover inode's uid/gid during POR f2fs: avoid infinite loop in f2fs_alloc_nid f2fs: add new idle interval timing for discard and gc paths f2fs: split IO error injection according to RW f2fs: add SPDX license identifiers f2fs: surround fault_injection related option parsing using CONFIG_F2FS_FAULT_INJECTION f2fs: avoid sleeping under spin_lock f2fs: plug readahead IO in readdir() f2fs: fix to do sanity check with current segment number f2fs: fix memory leak of percpu counter in fill_super() f2fs: fix memory leak of write_io in fill_super() f2fs: cache NULL when both default_acl and acl are NULL f2fs: fix to flush all dirty inodes recovered in readonly fs f2fs: report error if quota off error during umount f2fs: submit bio after shutdown f2fs: avoid wrong decrypted data from disk Revert "f2fs: use printk_ratelimited for f2fs_msg" f2fs: fix unnecessary periodic wakeup of discard thread when dev is busy f2fs: fix to avoid NULL pointer dereference on se->discard_map f2fs: add additional sanity check in f2fs_acl_from_disk() Revert "BACKPORT, FROMLIST: fscrypt: add Speck128/256 support" Build fix for 076c36fce1ea0. Revert "BACKPORT, FROMGIT: crypto: speck - add support for the Speck block cipher" Revert "FROMGIT: crypto: speck - export common helpers" Revert "BACKPORT, FROMGIT: crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS" Revert "BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck128-XTS" Revert "BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck64-XTS" Revert "BACKPORT, FROMLIST: crypto: arm64/speck - add NEON-accelerated implementation of Speck-XTS" Revert "fscrypt: add Speck128/256 support" UPSTREAM: loop: Add LOOP_SET_BLOCK_SIZE in compat ioctl BACKPORT: block/loop: set hw_sectors UPSTREAM: loop: add ioctl for changing logical block size Conflicts: fs/ext4/crypto.c fs/ext4/ext4.h Change-Id: I8cb2f70b27906879f8e8fdd90e67f438e39701b8 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | | Merge 4.4.163 into android-4.4Greg Kroah-Hartman2018-11-10
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.163 xfrm: Validate address prefix lengths in the xfrm selector. xfrm6: call kfree_skb when skb is toobig mac80211: Always report TX status cfg80211: reg: Init wiphy_idx in regulatory_hint_core() ARM: 8799/1: mm: fix pci_ioremap_io() offset check xfrm: validate template mode mac80211_hwsim: do not omit multicast announce of first added radio Bluetooth: SMP: fix crash in unpairing pxa168fb: prepare the clock asix: Check for supported Wake-on-LAN modes ax88179_178a: Check for supported Wake-on-LAN modes lan78xx: Check for supported Wake-on-LAN modes sr9800: Check for supported Wake-on-LAN modes r8152: Check for supported Wake-on-LAN Modes smsc75xx: Check for Wake-on-LAN modes smsc95xx: Check for Wake-on-LAN modes perf/ring_buffer: Prevent concurent ring buffer access net: cxgb3_main: fix a missing-check bug KEYS: put keyring if install_session_keyring_to_cred() fails ipv6: suppress sparse warnings in IP6_ECN_set_ce() net: drop write-only stack variable ser_gigaset: use container_of() instead of detour tracing: Skip more functions when doing stack tracing of events ARM: dts: apq8064: add ahci ports-implemented mask x86/mm/pat: Prevent hang during boot when mapping pages radix-tree: fix radix_tree_iter_retry() for tagged iterators. af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers net/mlx4_en: Resolve dividing by zero in 32-bit system ipv6: orphan skbs in reassembly unit um: Avoid longjmp/setjmp symbol clashes with libpthread.a sched/cgroup: Fix cgroup entity load tracking tear-down btrfs: don't create or leak aliased root while cleaning up orphans thermal: allow spear-thermal driver to be a module thermal: allow u8500-thermal driver to be a module tpm: fix: return rc when devm_add_action() fails x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs aacraid: Start adapter after updating number of MSIX vectors perf/core: Don't leak event in the syscall error path usbvision: revert commit 588afcc1 MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue ASoC: ak4613: Enable cache usage to fix crashes on resume ASoC: wm8940: Enable cache usage to fix crashes on resume CIFS: handle guest access errors to Windows shares arm64: Fix potential race with hardware DBM in ptep_set_access_flags() xfrm: Clear sk_dst_cache when applying per-socket policy. scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata sch_red: update backlog as well usb-storage: fix bogus hardware error messages for ATA pass-thru devices bpf: generally move prog destruction to RCU deferral drm/nouveau/fbcon: fix oops without fbdev emulation fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio ixgbevf: Fix handling of NAPI budget when multiple queues are enabled per vector net/mlx5e: Fix LRO modify net/mlx5e: Correctly handle RSS indirection table when changing number of channels ixgbe: fix RSS limit for X550 ixgbe: Correct X550EM_x revision check ALSA: timer: Fix zero-division by continue of uninitialized instance vti6: flush x-netns xfrm cache when vti interface is removed gro: Allow tunnel stacking in the case of FOU/GUE brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() tty: serial: sprd: fix error return code in sprd_probe() video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe() sparc64 mm: Fix more TSB sizing issues gpu: host1x: fix error return code in host1x_probe() sparc64: Fix exception handling in UltraSPARC-III memcpy. gpio: msic: fix error return code in platform_msic_gpio_probe() usb: imx21-hcd: fix error return code in imx21_probe() usb: ehci-omap: fix error return code in ehci_hcd_omap_probe() usb: dwc3: omap: fix error return code in dwc3_omap_probe() spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe() MIPS: Handle non word sized instructions when examining frame spi/bcm63xx: fix error return code in bcm63xx_spi_probe() spi: xlp: fix error return code in xlp_spi_probe() ASoC: spear: fix error return code in spdif_in_probe() PM / devfreq: tegra: fix error return code in tegra_devfreq_probe() bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal scsi: aacraid: Fix typo in blink status MIPS: microMIPS: Fix decoding of swsp16 instruction igb: Remove superfluous reset to PHY and page 0 selection MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression ARM: dts: imx53-qsb: disable 1.2GHz OPP fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters() mtd: spi-nor: Add support for is25wp series chips perf tools: Disable parallelism for 'make clean' bridge: do not add port to router list when receives query with source 0.0.0.0 net: bridge: remove ipv6 zero address check in mcast queries ipv6: mcast: fix a use-after-free in inet6_mc_check ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs net: sched: gred: pass the right attribute to gred_change_table_def() net: socket: fix a missing-check bug net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules r8169: fix NAPI handling under high load sctp: fix race on sctp_id2asoc net: drop skb on failure in ip_check_defrag() vhost: Fix Spectre V1 vulnerability rtnetlink: Disallow FDB configuration for non-Ethernet device mremap: properly flush TLB before releasing the page crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned ahci: don't ignore result code of ahci_reset_controller() cachefiles: fix the race between cachefiles_bury_object() and rmdir(2) ptp: fix Spectre v1 vulnerability RDMA/ucma: Fix Spectre v1 vulnerability IB/ucm: Fix Spectre v1 vulnerability cdc-acm: correct counting of UART states in serial state notification usb: gadget: storage: Fix Spectre v1 vulnerability USB: fix the usbfs flag sanitization for control transfers Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM sched/fair: Fix throttle_list starvation with low CFS quota x86/percpu: Fix this_cpu_read() cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 x86/time: Correct the attribute on jiffies' definition Linux 4.4.163 Change-Id: Idb0efd175853886145a1fb7eaaf18797c39e5f6f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | | KEYS: put keyring if install_session_keyring_to_cred() failsEric Biggers2018-11-10
| | | |_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit d636bd9f12a66ea3775c9fabbf3f8e118253467a ] In join_session_keyring(), if install_session_keyring_to_cred() were to fail, we would leak the keyring reference, just like in the bug fixed by commit 23567fd052a9 ("KEYS: Fix keyring ref leak in join_session_keyring()"). Fortunately this cannot happen currently, but we really should be more careful. Do this by adding and using a new error label at which the keyring reference is dropped. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | | | | Merge android-4.4.157 (c139ea66) into msm-4.4Srinivasarao P2018-09-28
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-c139ea66 Linux 4.4.157 mm: get rid of vmacache_flush_all() entirely x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ autofs: fix autofs_sbi() does not check super block type mtd: ubi: wl: Fix error return code in ubi_wl_init() crypto: vmx - Fix sleep-in-atomic bugs ethernet: ti: davinci_emac: add missing of_node_put after calling of_parse_phandle net: ethernet: ti: cpsw: fix mdio device reference leak drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user vmw_balloon: include asm/io.h xhci: Fix use-after-free in xhci_free_virt_device RDMA/cma: Do not ignore net namespace for unbound cm_id MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize mfd: ti_am335x_tscadc: Fix struct clk memory leak iommu/ipmmu-vmsa: Fix allocation in atomic context partitions/aix: fix usage of uninitialized lv_info and lvname structures partitions/aix: append null character to print data from disk Input: atmel_mxt_ts - only use first T9 instance net: dcb: For wild-card lookups, use priority -1, not 0 MIPS: Octeon: add missing of_node_put() net: mvneta: fix mtu change on port without link gpio: ml-ioh: Fix buffer underwrite on probe error path x86/mm: Remove in_nmi() warning from vmalloc_fault() Bluetooth: hidp: Fix handling of strncpy for hid->name information ath10k: disable bundle mgmt tx completion event support scsi: 3ware: fix return 0 on the error path of probe ata: libahci: Correct setting of DEVSLP register MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET ath10k: prevent active scans on potential unusable channels macintosh/via-pmu: Add missing mmio accessors NFSv4.0 fix client reference leak in callback perf tools: Allow overriding MAX_NR_CPUS at compile time f2fs: do not set free of current section tty: rocket: Fix possible buffer overwrite on register_PCI uio: potential double frees if __uio_register_device() fails misc: ti-st: Fix memory leak in the error path of probe() md/raid5: fix data corruption of replacements after originals dropped scsi: target: fix __transport_register_session locking gpio: tegra: Move driver registration to subsys_init level Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV ethtool: Remove trailing semicolon for static inline misc: mic: SCIF Fix scif_get_new_port() error handling ARC: [plat-axs*]: Enable SWAP locking/osq_lock: Fix osq_lock queue corruption selinux: use GFP_NOWAIT in the AVC kmem_caches locking/rwsem-xadd: Fix missed wakeup due to reordering of load block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg staging/rts5208: Fix read overflow in memcpy staging: rt5208: Fix a sleep-in-atomic bug in xd_copy_page kthread: fix boot hang (regression) on MIPS/OpenRISC kthread: Fix use-after-free if kthread fork fails cfq: Give a chance for arming slice idle timer in case of group_idle ALSA: hda - Fix cancel_work_sync() stall from jackpoll work i2c: i801: fix DNV's SMBCTRL register offset i2c: xiic: Make the start and the byte count write atomic Conflicts: block/blk-cgroup.c drivers/net/wireless/ath/ath10k/wmi-tlv.c kernel/locking/rwsem-xadd.c Change-Id: If6c24e0c16e173dc2a22e047200bbd7a4f11f713 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | | Merge 4.4.157 into android-4.4Greg Kroah-Hartman2018-09-20
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.157 i2c: xiic: Make the start and the byte count write atomic i2c: i801: fix DNV's SMBCTRL register offset ALSA: hda - Fix cancel_work_sync() stall from jackpoll work cfq: Give a chance for arming slice idle timer in case of group_idle kthread: Fix use-after-free if kthread fork fails kthread: fix boot hang (regression) on MIPS/OpenRISC staging: rt5208: Fix a sleep-in-atomic bug in xd_copy_page staging/rts5208: Fix read overflow in memcpy block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg locking/rwsem-xadd: Fix missed wakeup due to reordering of load selinux: use GFP_NOWAIT in the AVC kmem_caches locking/osq_lock: Fix osq_lock queue corruption ARC: [plat-axs*]: Enable SWAP misc: mic: SCIF Fix scif_get_new_port() error handling ethtool: Remove trailing semicolon for static inline Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV gpio: tegra: Move driver registration to subsys_init level scsi: target: fix __transport_register_session locking md/raid5: fix data corruption of replacements after originals dropped misc: ti-st: Fix memory leak in the error path of probe() uio: potential double frees if __uio_register_device() fails tty: rocket: Fix possible buffer overwrite on register_PCI f2fs: do not set free of current section perf tools: Allow overriding MAX_NR_CPUS at compile time NFSv4.0 fix client reference leak in callback macintosh/via-pmu: Add missing mmio accessors ath10k: prevent active scans on potential unusable channels MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET ata: libahci: Correct setting of DEVSLP register scsi: 3ware: fix return 0 on the error path of probe ath10k: disable bundle mgmt tx completion event support Bluetooth: hidp: Fix handling of strncpy for hid->name information x86/mm: Remove in_nmi() warning from vmalloc_fault() gpio: ml-ioh: Fix buffer underwrite on probe error path net: mvneta: fix mtu change on port without link MIPS: Octeon: add missing of_node_put() net: dcb: For wild-card lookups, use priority -1, not 0 Input: atmel_mxt_ts - only use first T9 instance partitions/aix: append null character to print data from disk partitions/aix: fix usage of uninitialized lv_info and lvname structures iommu/ipmmu-vmsa: Fix allocation in atomic context mfd: ti_am335x_tscadc: Fix struct clk memory leak f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON RDMA/cma: Do not ignore net namespace for unbound cm_id xhci: Fix use-after-free in xhci_free_virt_device vmw_balloon: include asm/io.h netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config net: ethernet: ti: cpsw: fix mdio device reference leak ethernet: ti: davinci_emac: add missing of_node_put after calling of_parse_phandle crypto: vmx - Fix sleep-in-atomic bugs mtd: ubi: wl: Fix error return code in ubi_wl_init() autofs: fix autofs_sbi() does not check super block type x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ mm: get rid of vmacache_flush_all() entirely Linux 4.4.157 Change-Id: I30fc9e099e9065aff5e53c648d822c405525bb07 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * | | selinux: use GFP_NOWAIT in the AVC kmem_cachesMichal Hocko2018-09-19
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 476accbe2f6ef69caeebe99f52a286e12ac35aee upstream. There is a strange __GFP_NOMEMALLOC usage pattern in SELinux, specifically GFP_ATOMIC | __GFP_NOMEMALLOC which doesn't make much sense. GFP_ATOMIC on its own allows to access memory reserves while __GFP_NOMEMALLOC dictates we cannot use memory reserves. Replace this with the much more sane GFP_NOWAIT in the AVC code as we can tolerate memory allocation failures in that code. Signed-off-by: Michal Hocko <mhocko@kernel.org> Acked-by: Mel Gorman <mgorman@suse.de> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | | Merge android-4.4.153 (5e24b4e) into msm-4.4Srinivasarao P2018-08-28
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-5e24b4e Linux 4.4.153 ovl: warn instead of error if d_type is not supported ovl: Do d_type check only if work dir creation was successful ovl: Ensure upper filesystem supports d_type x86/mm: Fix use-after-free of ldt_struct x86/mm/pat: Fix L1TF stable backport for CPA ANDROID: x86_64_cuttlefish_defconfig: Enable lz4 compression for zram UPSTREAM: drivers/block/zram/zram_drv.c: fix bug storing backing_dev BACKPORT: zram: introduce zram memory tracking BACKPORT: zram: record accessed second BACKPORT: zram: mark incompressible page as ZRAM_HUGE UPSTREAM: zram: correct flag name of ZRAM_ACCESS UPSTREAM: zram: Delete gendisk before cleaning up the request queue UPSTREAM: drivers/block/zram/zram_drv.c: make zram_page_end_io() static BACKPORT: zram: set BDI_CAP_STABLE_WRITES once UPSTREAM: zram: fix null dereference of handle UPSTREAM: zram: add config and doc file for writeback feature BACKPORT: zram: read page from backing device BACKPORT: zram: write incompressible pages to backing device BACKPORT: zram: identify asynchronous IO's return value BACKPORT: zram: add free space management in backing device UPSTREAM: zram: add interface to specif backing device UPSTREAM: zram: rename zram_decompress_page to __zram_bvec_read UPSTREAM: zram: inline zram_compress UPSTREAM: zram: clean up duplicated codes in __zram_bvec_write Linux 4.4.152 reiserfs: fix broken xattr handling (heap corruption, bad retval) i2c: imx: Fix race condition in dma read PCI: pciehp: Fix use-after-free on unplug PCI: Skip MPS logic for Virtual Functions (VFs) PCI: hotplug: Don't leak pci_slot on registration failure parisc: Remove unnecessary barriers from spinlock.h bridge: Propagate vlan add failure to user packet: refine ring v3 block size test to hold one frame netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state xfrm_user: prevent leaking 2 bytes of kernel memory parisc: Remove ordered stores from syscall.S ext4: fix spectre gadget in ext4_mb_regular_allocator() KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer staging: android: ion: check for kref overflow tcp: identify cryptic messages as TCP seq # bugs net: qca_spi: Fix log level if probe fails net: qca_spi: Make sure the QCA7000 reset is triggered net: qca_spi: Avoid packet drop during initial sync net: usb: rtl8150: demote allmulti message to dev_dbg() net/ethernet/freescale/fman: fix cross-build error drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() tcp: remove DELAYED ACK events in DCTCP qlogic: check kstrtoul() for errors packet: reset network header if packet shorter than ll reserved space ixgbe: Be more careful when modifying MAC filters ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot perf llvm-utils: Remove bashism from kernel include fetch script bnxt_en: Fix for system hang if request_irq fails drm/armada: fix colorkey mode property ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem ieee802154: at86rf230: use __func__ macro for debug messages ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem ARM: pxa: irq: fix handling of ICMR registers in suspend/resume netfilter: x_tables: set module owner for icmp(6) matches smsc75xx: Add workaround for gigabit link up hardware errata. kasan: fix shadow_size calculation error in kasan_module_alloc tracing: Use __printf markup to silence compiler ARM: imx_v4_v5_defconfig: Select ULPI support ARM: imx_v6_v7_defconfig: Select ULPI support HID: wacom: Correct touch maximum XY of 2nd-gen Intuos m68k: fix "bad page state" oops on ColdFire boot bnx2x: Fix receiving tx-timeout in error or recovery state. drm/exynos: decon5433: Fix WINCONx reset value drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes md/raid10: fix that replacement cannot complete recovery after reassemble dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() ARM: dts: da850: Fix interrups property for gpio selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs perf report powerpc: Fix crash if callchain is empty perf test session topology: Fix test on s390 usb: xhci: increase CRS timeout value ARM: dts: am437x: make edt-ft5x06 a wakeup source brcmfmac: stop watchdog before detach and free everything cxgb4: when disabling dcb set txq dcb priority to 0 Smack: Mark inode instant in smack_task_to_inode ipv6: mcast: fix unsolicited report interval after receiving querys locking/lockdep: Do not record IRQ state within lockdep code net: davinci_emac: match the mdio device against its compatible if possible ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP net: propagate dev_get_valid_name return code net: hamradio: use eth_broadcast_addr enic: initialize enic->rfs_h.lock in enic_probe qed: Add sanity check for SIMD fastpath handler. arm64: make secondary_start_kernel() notrace scsi: xen-scsifront: add error handling for xenbus_printf usb: gadget: dwc2: fix memory leak in gadget_init() usb: gadget: composite: fix delayed_status race condition when set_interface usb: dwc2: fix isoc split in transfer with no data ARM: dts: Cygnus: Fix I2C controller interrupt type selftests: sync: add config fragment for testing sync framework selftests: zram: return Kselftest Skip code for skipped tests selftests: user: return Kselftest Skip code for skipped tests selftests: static_keys: return Kselftest Skip code for skipped tests selftests: pstore: return Kselftest Skip code for skipped tests netfilter: ipv6: nf_defrag: reduce struct net memory waste ARC: Explicitly add -mmedium-calls to CFLAGS ANDROID: x86_64_cuttlefish_defconfig: Enable zram and zstd BACKPORT: crypto: zstd - Add zstd support UPSTREAM: zram: add zstd to the supported algorithms list UPSTREAM: lib: Add zstd modules UPSTREAM: lib: Add xxhash module UPSTREAM: zram: rework copy of compressor name in comp_algorithm_store() UPSTREAM: zram: constify attribute_group structures. UPSTREAM: zram: count same page write as page_stored UPSTREAM: zram: reduce load operation in page_same_filled UPSTREAM: zram: use zram_free_page instead of open-coded UPSTREAM: zram: introduce zram data accessor UPSTREAM: zram: remove zram_meta structure UPSTREAM: zram: use zram_slot_lock instead of raw bit_spin_lock op BACKPORT: zram: partial IO refactoring BACKPORT: zram: handle multiple pages attached bio's bvec UPSTREAM: zram: fix operator precedence to get offset BACKPORT: zram: extend zero pages to same element pages BACKPORT: zram: remove waitqueue for IO done UPSTREAM: zram: remove obsolete sysfs attrs UPSTREAM: zram: support BDI_CAP_STABLE_WRITES UPSTREAM: zram: revalidate disk under init_lock BACKPORT: mm: support anonymous stable page UPSTREAM: zram: use __GFP_MOVABLE for memory allocation UPSTREAM: zram: drop gfp_t from zcomp_strm_alloc() UPSTREAM: zram: add more compression algorithms UPSTREAM: zram: delete custom lzo/lz4 UPSTREAM: zram: cosmetic: cleanup documentation UPSTREAM: zram: use crypto api to check alg availability BACKPORT: zram: switch to crypto compress API UPSTREAM: zram: rename zstrm find-release functions UPSTREAM: zram: introduce per-device debug_stat sysfs node UPSTREAM: zram: remove max_comp_streams internals UPSTREAM: zram: user per-cpu compression streams BACKPORT: zsmalloc: require GFP in zs_malloc() UPSTREAM: zram/zcomp: do not zero out zcomp private pages UPSTREAM: zram: pass gfp from zcomp frontend to backend UPSTREAM: socket: close race condition between sock_close() and sockfs_setattr() ANDROID: Refresh x86_64_cuttlefish_defconfig Linux 4.4.151 isdn: Disable IIOCDBGVAR Bluetooth: avoid killing an already killed socket x86/mm: Simplify p[g4um]d_page() macros serial: 8250_dw: always set baud rate in dw8250_set_termios ACPI / PM: save NVS memory for ASUS 1025C laptop ACPI: save NVS memory for Lenovo G50-45 USB: option: add support for DW5821e USB: serial: sierra: fix potential deadlock at close ALSA: vxpocket: Fix invalid endian conversions ALSA: memalloc: Don't exceed over the requested size ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry ALSA: cs5535audio: Fix invalid endian conversion ALSA: virmidi: Fix too long output trigger loop ALSA: vx222: Fix invalid endian conversions ALSA: hda - Turn CX8200 into D3 as well upon reboot ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs net_sched: fix NULL pointer dereference when delete tcindex filter vsock: split dwork to avoid reinitializations net_sched: Fix missing res info when create new tc_index filter llc: use refcount_inc_not_zero() for llc_sap_find() l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart() Conflicts: drivers/block/zram/zram_drv.c drivers/staging/android/ion/ion.c include/linux/swap.h mm/zsmalloc.c Change-Id: I1c437ac5133503a939d06d51ec778b65371df6d1 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | | Merge 4.4.152 into android-4.4Greg Kroah-Hartman2018-08-24
| |\| | | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.152 ARC: Explicitly add -mmedium-calls to CFLAGS netfilter: ipv6: nf_defrag: reduce struct net memory waste selftests: pstore: return Kselftest Skip code for skipped tests selftests: static_keys: return Kselftest Skip code for skipped tests selftests: user: return Kselftest Skip code for skipped tests selftests: zram: return Kselftest Skip code for skipped tests selftests: sync: add config fragment for testing sync framework ARM: dts: Cygnus: Fix I2C controller interrupt type usb: dwc2: fix isoc split in transfer with no data usb: gadget: composite: fix delayed_status race condition when set_interface usb: gadget: dwc2: fix memory leak in gadget_init() scsi: xen-scsifront: add error handling for xenbus_printf arm64: make secondary_start_kernel() notrace qed: Add sanity check for SIMD fastpath handler. enic: initialize enic->rfs_h.lock in enic_probe net: hamradio: use eth_broadcast_addr net: propagate dev_get_valid_name return code ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP net: davinci_emac: match the mdio device against its compatible if possible locking/lockdep: Do not record IRQ state within lockdep code ipv6: mcast: fix unsolicited report interval after receiving querys Smack: Mark inode instant in smack_task_to_inode cxgb4: when disabling dcb set txq dcb priority to 0 brcmfmac: stop watchdog before detach and free everything ARM: dts: am437x: make edt-ft5x06 a wakeup source usb: xhci: increase CRS timeout value perf test session topology: Fix test on s390 perf report powerpc: Fix crash if callchain is empty selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs ARM: dts: da850: Fix interrups property for gpio dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() md/raid10: fix that replacement cannot complete recovery after reassemble drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes drm/exynos: decon5433: Fix WINCONx reset value bnx2x: Fix receiving tx-timeout in error or recovery state. m68k: fix "bad page state" oops on ColdFire boot HID: wacom: Correct touch maximum XY of 2nd-gen Intuos ARM: imx_v6_v7_defconfig: Select ULPI support ARM: imx_v4_v5_defconfig: Select ULPI support tracing: Use __printf markup to silence compiler kasan: fix shadow_size calculation error in kasan_module_alloc smsc75xx: Add workaround for gigabit link up hardware errata. netfilter: x_tables: set module owner for icmp(6) matches ARM: pxa: irq: fix handling of ICMR registers in suspend/resume ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem ieee802154: at86rf230: use __func__ macro for debug messages ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem drm/armada: fix colorkey mode property bnxt_en: Fix for system hang if request_irq fails perf llvm-utils: Remove bashism from kernel include fetch script ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller ixgbe: Be more careful when modifying MAC filters packet: reset network header if packet shorter than ll reserved space qlogic: check kstrtoul() for errors tcp: remove DELAYED ACK events in DCTCP drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() net/ethernet/freescale/fman: fix cross-build error net: usb: rtl8150: demote allmulti message to dev_dbg() net: qca_spi: Avoid packet drop during initial sync net: qca_spi: Make sure the QCA7000 reset is triggered net: qca_spi: Fix log level if probe fails tcp: identify cryptic messages as TCP seq # bugs staging: android: ion: check for kref overflow KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer ext4: fix spectre gadget in ext4_mb_regular_allocator() parisc: Remove ordered stores from syscall.S xfrm_user: prevent leaking 2 bytes of kernel memory netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state packet: refine ring v3 block size test to hold one frame bridge: Propagate vlan add failure to user parisc: Remove unnecessary barriers from spinlock.h PCI: hotplug: Don't leak pci_slot on registration failure PCI: Skip MPS logic for Virtual Functions (VFs) PCI: pciehp: Fix use-after-free on unplug i2c: imx: Fix race condition in dma read reiserfs: fix broken xattr handling (heap corruption, bad retval) Linux 4.4.152 Change-Id: I1058813031709d20abd0bc45e9ac5fc68ab3a1d7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * Smack: Mark inode instant in smack_task_to_inodeCasey Schaufler2018-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 7b4e88434c4e7982fb053c49657e1c8bbb8692d9 ] Smack: Mark inode instant in smack_task_to_inode /proc clean-up in commit 1bbc55131e59bd099fdc568d3aa0b42634dbd188 resulted in smack_task_to_inode() being called before smack_d_instantiate. This resulted in the smk_inode value being ignored, even while present for files in /proc/self. Marking the inode as instant here fixes that. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge android-4.4.137 (a2e2217) into msm-4.4Srinivasarao P2018-06-27
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refs/heads/tmp-a2e2217 Linux 4.4.137 net: metrics: add proper netlink validation net: phy: broadcom: Fix bcm_write_exp() rtnetlink: validate attributes in do_setlink() team: use netdev_features_t instead of u32 net/mlx4: Fix irq-unsafe spinlock usage qed: Fix mask for physical address in ILT entry packet: fix reserve calculation net: usb: cdc_mbim: add flag FLAG_SEND_ZLP net/packet: refine check for priv area size netdev-FAQ: clarify DaveM's position for stable backports isdn: eicon: fix a missing-check bug ipv4: remove warning in ip_recv_error ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds enic: set DMA mask to 47 bit dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect() bnx2x: use the right constant brcmfmac: Fix check for ISO3166 code drm: set FMODE_UNSIGNED_OFFSET for drm files xfs: fix incorrect log_flushed on fsync kconfig: Avoid format overflow warning from GCC 8.1 mmap: relax file size limit for regular files mmap: introduce sane default mmap limits tpm: self test failure should not cause suspend to fail tpm: do not suspend/resume if power stays on ANDROID: Update arm64 ranchu64_defconfig Linux 4.4.136 sparc64: Fix build warnings with gcc 7. mm: fix the NULL mapping case in __isolate_lru_page() fix io_destroy()/aio_complete() race Kbuild: change CC_OPTIMIZE_FOR_SIZE definition drm/i915: Disable LVDS on Radiant P845 hwtracing: stm: fix build error on some arches stm class: Use vmalloc for the master map scsi: scsi_transport_srp: Fix shost to rport translation MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs iio:kfifo_buf: check for uint overflow dmaengine: usb-dmac: fix endless loop in usb_dmac_chan_terminate_all() i2c: rcar: revoke START request early i2c: rcar: check master irqs before slave irqs i2c: rcar: don't issue stop when HW does it automatically i2c: rcar: init new messages in irq i2c: rcar: refactor setup of a msg i2c: rcar: remove spinlock i2c: rcar: remove unused IOERROR state i2c: rcar: rework hw init i2c: rcar: make sure clocks are on when doing clock calculation tcp: avoid integer overflows in tcp_rcv_space_adjust() irda: fix overly long udelay() ASoC: Intel: sst: remove redundant variable dma_dev_name rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c cfg80211: further limit wiphy names to 64 bytes selinux: KASAN: slab-out-of-bounds in xattr_getsecurity tracing: Fix crash when freeing instances with event triggers Input: elan_i2c_smbus - fix corrupted stack Revert "ima: limit file hash setting by user to fix and log modes" xfs: detect agfl count corruption and reset agfl sh: New gcc support USB: serial: cp210x: use tcflag_t to fix incompatible pointer type powerpc/64s: Clear PCR on boot arm64: lse: Add early clobbers to some input/output asm operands FROMLIST: f2fs: run fstrim asynchronously if runtime discard is on goldfish: pipe: ANDROID: address must be written as __pa(x), not x goldfish: pipe: ANDROID: add missing check for memory allocated goldfish: pipe: ANDROID: remove redundant blank lines Update arch/x86/configs/x86_64_ranchu_defconfig ANDROID: x86_64_cuttlefish_defconfig: Enable F2FS ANDROID: Update x86_64_cuttlefish_defconfig FROMLIST: f2fs: early updates queued for v4.18-rc1 Change-Id: I314254168cd5ad06a7c6bca2fa68c8a6ae6c257d Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
| * | Merge 4.4.136 into android-4.4Greg Kroah-Hartman2018-06-06
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.136 arm64: lse: Add early clobbers to some input/output asm operands powerpc/64s: Clear PCR on boot USB: serial: cp210x: use tcflag_t to fix incompatible pointer type sh: New gcc support xfs: detect agfl count corruption and reset agfl Revert "ima: limit file hash setting by user to fix and log modes" Input: elan_i2c_smbus - fix corrupted stack tracing: Fix crash when freeing instances with event triggers selinux: KASAN: slab-out-of-bounds in xattr_getsecurity cfg80211: further limit wiphy names to 64 bytes rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c ASoC: Intel: sst: remove redundant variable dma_dev_name irda: fix overly long udelay() tcp: avoid integer overflows in tcp_rcv_space_adjust() i2c: rcar: make sure clocks are on when doing clock calculation i2c: rcar: rework hw init i2c: rcar: remove unused IOERROR state i2c: rcar: remove spinlock i2c: rcar: refactor setup of a msg i2c: rcar: init new messages in irq i2c: rcar: don't issue stop when HW does it automatically i2c: rcar: check master irqs before slave irqs i2c: rcar: revoke START request early dmaengine: usb-dmac: fix endless loop in usb_dmac_chan_terminate_all() iio:kfifo_buf: check for uint overflow MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests scsi: scsi_transport_srp: Fix shost to rport translation stm class: Use vmalloc for the master map hwtracing: stm: fix build error on some arches drm/i915: Disable LVDS on Radiant P845 Kbuild: change CC_OPTIMIZE_FOR_SIZE definition fix io_destroy()/aio_complete() race mm: fix the NULL mapping case in __isolate_lru_page() sparc64: Fix build warnings with gcc 7. Linux 4.4.136 Change-Id: I3457f995cf22c65952271ecd517a46144ac4dc79 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| | * selinux: KASAN: slab-out-of-bounds in xattr_getsecuritySachin Grover2018-06-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit efe3de79e0b52ca281ef6691480c8c68c82a4657 upstream. Call trace: [<ffffff9203a8d7a8>] dump_backtrace+0x0/0x428 [<ffffff9203a8dbf8>] show_stack+0x28/0x38 [<ffffff920409bfb8>] dump_stack+0xd4/0x124 [<ffffff9203d187e8>] print_address_description+0x68/0x258 [<ffffff9203d18c00>] kasan_report.part.2+0x228/0x2f0 [<ffffff9203d1927c>] kasan_report+0x5c/0x70 [<ffffff9203d1776c>] check_memory_region+0x12c/0x1c0 [<ffffff9203d17cdc>] memcpy+0x34/0x68 [<ffffff9203d75348>] xattr_getsecurity+0xe0/0x160 [<ffffff9203d75490>] vfs_getxattr+0xc8/0x120 [<ffffff9203d75d68>] getxattr+0x100/0x2c8 [<ffffff9203d76fb4>] SyS_fgetxattr+0x64/0xa0 [<ffffff9203a83f70>] el0_svc_naked+0x24/0x28 If user get root access and calls security.selinux setxattr() with an embedded NUL on a file and then if some process performs a getxattr() on that file with a length greater than the actual length of the string, it would result in a panic. To fix this, add the actual length of the string to the security context instead of the length passed by the userspace process. Signed-off-by: Sachin Grover <sgrover@codeaurora.org> Cc: stable@vger.kernel.org Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| | * Revert "ima: limit file hash setting by user to fix and log modes"Mimi Zohar2018-06-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f5acb3dcba1ffb7f0b8cbb9dba61500eea5d610b upstream. Userspace applications have been modified to write security xattrs, but they are not context aware. In the case of security.ima, the security xattr can be either a file hash or a file signature. Permitting writing one, but not the other requires the application to be context aware. In addition, userspace applications might write files to a staging area, which might not be in policy, and then change some file metadata (eg. owner) making it in policy. As a result, these files are not labeled properly. This reverts commit c68ed80c97d9720f51ef31fe91560fdd1e121533, which prevents writing file hashes as security.ima xattrs. Requested-by: Patrick Ohly <patrick.ohly@intel.com> Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: Mike Rapoport <rppt@linux.vnet.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>