Merge android-4.4.177 (0c3b8c4) into msm-4.4

* refs/heads/tmp-0c3b8c4
  Linux 4.4.177
  KVM: X86: Fix residual mmio emulation request to userspace
  KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
  KVM: nVMX: Sign extend displacements of VMX instr's mem operands
  drm/radeon/evergreen_cs: fix missing break in switch statement
  media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
  rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
  PM / wakeup: Rework wakeup source timer cancellation
  nfsd: fix wrong check in write_v4_end_grace()
  nfsd: fix memory corruption caused by readdir
  NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
  NFS: Fix an I/O request leakage in nfs_do_recoalesce
  md: Fix failed allocation of md_register_thread
  perf intel-pt: Fix overlap calculation for padding
  perf auxtrace: Define auxtrace record alignment
  perf intel-pt: Fix CYC timestamp calculation after OVF
  NFS41: pop some layoutget errors to application
  dm: fix to_sector() for 32bit
  ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
  powerpc/83xx: Also save/restore SPRG4-7 during suspend
  powerpc/powernv: Make opal log only readable by root
  powerpc/wii: properly disable use of BATs when requested.
  powerpc/32: Clear on-stack exception marker upon exception return
  jbd2: fix compile warning when using JBUFFER_TRACE
  jbd2: clear dirty flag when revoking a buffer from an older transaction
  serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
  serial: 8250_pci: Fix number of ports for ACCES serial cards
  perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks
  i2c: tegra: fix maximum transfer size
  parport_pc: fix find_superio io compare code, should use equal test.
  intel_th: Don't reference unassigned outputs
  kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
  mm/vmalloc: fix size check for remap_vmalloc_range_partial()
  dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
  clk: ingenic: Fix round_rate misbehaving with non-integer dividers
  ext2: Fix underflow in ext2_max_size()
  ext4: fix crash during online resizing
  cpufreq: pxa2xx: remove incorrect __init annotation
  cpufreq: tegra124: add missing of_node_put()
  crypto: pcbc - remove bogus memcpy()s with src == dest
  Btrfs: fix corruption reading shared and compressed extents after hole punching
  btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
  m68k: Add -ffreestanding to CFLAGS
  scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
  scsi: virtio_scsi: don't send sc payload with tmfs
  s390/virtio: handle find on invalid queue gracefully
  clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
  clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
  regulator: s2mpa01: Fix step values for some LDOs
  regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
  ACPI / device_sysfs: Avoid OF modalias creation for removed device
  tracing: Do not free iter->trace in fail path of tracing_open_pipe()
  CIFS: Fix read after write for files with read caching
  crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
  stm class: Prevent division by zero
  tmpfs: fix uninitialized return value in shmem_link
  net: set static variable an initial value in atl2_probe()
  mac80211_hwsim: propagate genlmsg_reply return code
  phonet: fix building with clang
  ARC: uacces: remove lp_start, lp_end from clobber list
  tmpfs: fix link accounting when a tmpfile is linked in
  arm64: Relax GIC version check during early boot
  ASoC: topology: free created components in tplg load error
  net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
  pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
  net: systemport: Fix reception of BPDUs
  scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
  assoc_array: Fix shortcut creation
  ARM: 8824/1: fix a migrating irq bug when hotplug cpu
  Input: st-keyscan - fix potential zalloc NULL dereference
  i2c: cadence: Fix the hold bit setting
  Input: matrix_keypad - use flush_delayed_work()
  ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
  s390/dasd: fix using offset into zero size array error
  gpu: ipu-v3: Fix CSI offsets for imx53
  gpu: ipu-v3: Fix i.MX51 CSI control registers offset
  crypto: ahash - fix another early termination in hash walk
  crypto: caam - fixed handling of sg list
  stm class: Fix an endless loop in channel allocation
  ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
  9p/net: fix memory leak in p9_client_create
  9p: use inode->i_lock to protect i_size_write() under 32-bit
  media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
  It's wrong to add len to sector_nr in raid10 reshape twice
  fs/9p: use fscache mutex rather than spinlock
  ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
  tcp/dccp: remove reqsk_put() from inet_child_forget()
  gro_cells: make sure device is up in gro_cells_receive()
  net/hsr: fix possible crash in add_timer()
  vxlan: Fix GRO cells race condition between receive and link delete
  vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
  ipvlan: disallow userns cap_net_admin to change global mode/flags
  missing barriers in some of unix_sock ->addr and ->path accesses
  net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
  mdio_bus: Fix use-after-free on device_register fails
  net/x25: fix a race in x25_bind()
  net/mlx4_core: Fix qp mtt size calculation
  net/mlx4_core: Fix reset flow when in command polling mode
  tcp: handle inet_csk_reqsk_queue_add() failures
  route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
  ravb: Decrease TxFIFO depth of Q3 and Q2 to one
  pptp: dst_release sk_dst_cache in pptp_sock_destruct
  net/x25: reset state in x25_connect()
  net/x25: fix use-after-free in x25_device_event()
  net: sit: fix UBSAN Undefined behaviour in check_6rd
  net: hsr: fix memory leak in hsr_dev_finalize()
  l2tp: fix infoleak in l2tp_ip6_recvmsg()
  KEYS: restrict /proc/keys by credentials at open time
  netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options
  netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters
  netfilter: nfnetlink_log: just returns error for unknown command
  netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES
  udplite: call proper backlog handlers
  ARM: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420
  Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls"
  ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
  futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock()
  iscsi_ibft: Fix missing break in switch statement
  Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
  Input: wacom_serial4 - add support for Wacom ArtPad II tablet
  MIPS: Remove function size check in get_frame_info()
  perf symbols: Filter out hidden symbols from labels
  s390/qeth: fix use-after-free in error path
  dmaengine: dmatest: Abort test in case of mapping error
  dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
  irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
  ARM: pxa: ssp: unneeded to free devm_ allocated data
  autofs: fix error return in autofs_fill_super()
  autofs: drop dentry reference only when it is never used
  fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
  mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
  mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
  x86_64: increase stack size for KASAN_EXTRA
  x86/kexec: Don't setup EFI info if EFI runtime is not enabled
  cifs: fix computation for MAX_SMB2_HDR_SIZE
  platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
  scsi: libfc: free skb when receiving invalid flogi resp
  nfs: Fix NULL pointer dereference of dev_name
  gpio: vf610: Mask all GPIO interrupts
  net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
  net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
  net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
  xtensa: SMP: limit number of possible CPUs by NR_CPUS
  xtensa: SMP: mark each possible CPU as present
  xtensa: smp_lx200_defconfig: fix vectors clash
  xtensa: SMP: fix secondary CPU initialization
  xtensa: SMP: fix ccount_timer_shutdown
  iommu/amd: Fix IOMMU page flush when detach device from a domain
  ipvs: Fix signed integer overflow when setsockopt timeout
  IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
  perf tools: Handle TOPOLOGY headers with no CPU
  vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
  media: uvcvideo: Fix 'type' check leading to overflow
  ip6mr: Do not call __IP6_INC_STATS() from preemptible context
  net: dsa: mv88e6xxx: Fix u64 statistics
  netlabel: fix out-of-bounds memory accesses
  hugetlbfs: fix races and page leaks during migration
  MIPS: irq: Allocate accurate order pages for irq stack
  applicom: Fix potential Spectre v1 vulnerabilities
  x86/CPU/AMD: Set the CPB bit unconditionally on F17h
  net: phy: Micrel KSZ8061: link failure after cable connect
  net: avoid use IPCB in cipso_v4_error
  net: Add __icmp_send helper.
  xen-netback: fix occasional leak of grant ref mappings under memory pressure
  net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
  bnxt_en: Drop oversize TX packets to prevent errors.
  team: Free BPF filter when unregistering netdev
  sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
  net-sysfs: Fix mem leak in netdev_register_kobject
  staging: lustre: fix buffer overflow of string buffer
  isdn: isdn_tty: fix build warning of strncpy
  ncpfs: fix build warning of strncpy
  sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names
  cpufreq: Use struct kobj_attribute instead of struct global_attr
  USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
  USB: serial: cp210x: add ID for Ingenico 3070
  USB: serial: option: add Telit ME910 ECM composition
  x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
  mm: enforce min addr even if capable() in expand_downwards()
  mmc: spi: Fix card detection during probe
  powerpc: Always initialize input array when calling epapr_hypercall()
  KVM: arm/arm64: Fix MMIO emulation data handling
  arm/arm64: KVM: Feed initialized memory to MMIO accesses
  KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
  cfg80211: extend range deviation for DMG
  mac80211: don't initiate TDLS connection if station is not associated to AP
  ibmveth: Do not process frames after calling napi_reschedule
  net: altera_tse: fix connect_local_phy error path
  scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
  serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
  mac80211: fix miscounting of ttl-dropped frames
  ARC: fix __ffs return value to avoid build warnings
  ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
  ASoC: dapm: change snprintf to scnprintf for possible overflow
  usb: gadget: Potential NULL dereference on allocation error
  usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
  thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
  ALSA: compress: prevent potential divide by zero bugs
  ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
  drm/msm: Unblock writer if reader closes file
  scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
  libceph: handle an empty authorize reply
  Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
  ARCv2: Enable unaligned access in early ASM code
  net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
  sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
  team: avoid complex list operations in team_nl_cmd_options_set()
  net/packet: fix 4gb buffer limit due to overflow check
  batman-adv: fix uninit-value in batadv_interface_tx()
  KEYS: always initialize keyring_index_key::desc_len
  KEYS: user: Align the payload buffer
  RDMA/srp: Rework SCSI device reset handling
  isdn: avm: Fix string plus integer warning from Clang
  leds: lp5523: fix a missing check of return value of lp55xx_read
  atm: he: fix sign-extension overflow on large shift
  isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
  MIPS: jazz: fix 64bit build
  scsi: isci: initialize shost fully before calling scsi_add_host()
  scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
  MIPS: ath79: Enable OF serial ports in the default config
  net: hns: Fix use after free identified by SLUB debug
  mfd: mc13xxx: Fix a missing check of a register-read failure
  mfd: wm5110: Add missing ASRC rate register
  mfd: qcom_rpm: write fw_version to CTRL_REG
  mfd: ab8500-core: Return zero in get_register_interruptible()
  mfd: db8500-prcmu: Fix some section annotations
  mfd: twl-core: Fix section annotations on {,un}protect_pm_master
  mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
  KEYS: allow reaching the keys quotas exactly
  numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
  ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
  Revert "ANDROID: arm: process: Add display of memory around registers when displaying regs."
  ANDROID: mnt: Propagate remount correctly
  ANDROID: cuttlefish_defconfig: Add support for AC97 audio
  ANDROID: overlayfs: override_creds=off option bypass creator_cred
  FROMGIT: binder: create node flag to request sender's security context

Conflicts:
	arch/arm/kernel/irq.c
	drivers/media/v4l2-core/videobuf2-v4l2.c
	sound/core/compress_offload.c

Change-Id: I998f8d53b0c5b8a7102816034452b1779a3b69a3
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

1 files changed, 23 insertions, 0 deletions

diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
index 28091457b71a..771bb220449b 100644
--- a/Documentation/filesystems/overlayfs.txt
+++ b/Documentation/filesystems/overlayfs.txt
@@ -82,6 +82,29 @@ Only the lists of names from directories are merged.  Other content
 such as metadata and extended attributes are reported for the upper
 directory only.  These attributes of the lower directory are hidden.
 
+credentials
+-----------
+
+By default, all access to the upper, lower and work directories is the
+recorded mounter's MAC and DAC credentials.  The incoming accesses are
+checked against the caller's credentials.
+
+In the case where caller MAC or DAC credentials do not overlap, a
+use case available in older versions of the driver, the
+override_creds mount flag can be turned off and help when the use
+pattern has caller with legitimate credentials where the mounter
+does not.  Several unintended side effects will occur though.  The
+caller without certain key capabilities or lower privilege will not
+always be able to delete files or directories, create nodes, or
+search some restricted directories.  The ability to search and read
+a directory entry is spotty as a result of the cache mechanism not
+retesting the credentials because of the assumption, a privileged
+caller can fill cache, then a lower privilege can read the directory
+cache.  The uneven security model where cache, upperdir and workdir
+are opened at privilege, but accessed without creating a form of
+privilege escalation, should only be used with strict understanding
+of the side effects and of the security policies.
+
 whiteouts and opaque directories
 --------------------------------