Merge android-4.4.177 (0c3b8c4) into msm-4.4

* refs/heads/tmp-0c3b8c4
  Linux 4.4.177
  KVM: X86: Fix residual mmio emulation request to userspace
  KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
  KVM: nVMX: Sign extend displacements of VMX instr's mem operands
  drm/radeon/evergreen_cs: fix missing break in switch statement
  media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
  rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
  PM / wakeup: Rework wakeup source timer cancellation
  nfsd: fix wrong check in write_v4_end_grace()
  nfsd: fix memory corruption caused by readdir
  NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
  NFS: Fix an I/O request leakage in nfs_do_recoalesce
  md: Fix failed allocation of md_register_thread
  perf intel-pt: Fix overlap calculation for padding
  perf auxtrace: Define auxtrace record alignment
  perf intel-pt: Fix CYC timestamp calculation after OVF
  NFS41: pop some layoutget errors to application
  dm: fix to_sector() for 32bit
  ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
  powerpc/83xx: Also save/restore SPRG4-7 during suspend
  powerpc/powernv: Make opal log only readable by root
  powerpc/wii: properly disable use of BATs when requested.
  powerpc/32: Clear on-stack exception marker upon exception return
  jbd2: fix compile warning when using JBUFFER_TRACE
  jbd2: clear dirty flag when revoking a buffer from an older transaction
  serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
  serial: 8250_pci: Fix number of ports for ACCES serial cards
  perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks
  i2c: tegra: fix maximum transfer size
  parport_pc: fix find_superio io compare code, should use equal test.
  intel_th: Don't reference unassigned outputs
  kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
  mm/vmalloc: fix size check for remap_vmalloc_range_partial()
  dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
  clk: ingenic: Fix round_rate misbehaving with non-integer dividers
  ext2: Fix underflow in ext2_max_size()
  ext4: fix crash during online resizing
  cpufreq: pxa2xx: remove incorrect __init annotation
  cpufreq: tegra124: add missing of_node_put()
  crypto: pcbc - remove bogus memcpy()s with src == dest
  Btrfs: fix corruption reading shared and compressed extents after hole punching
  btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
  m68k: Add -ffreestanding to CFLAGS
  scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
  scsi: virtio_scsi: don't send sc payload with tmfs
  s390/virtio: handle find on invalid queue gracefully
  clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
  clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
  regulator: s2mpa01: Fix step values for some LDOs
  regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
  ACPI / device_sysfs: Avoid OF modalias creation for removed device
  tracing: Do not free iter->trace in fail path of tracing_open_pipe()
  CIFS: Fix read after write for files with read caching
  crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
  stm class: Prevent division by zero
  tmpfs: fix uninitialized return value in shmem_link
  net: set static variable an initial value in atl2_probe()
  mac80211_hwsim: propagate genlmsg_reply return code
  phonet: fix building with clang
  ARC: uacces: remove lp_start, lp_end from clobber list
  tmpfs: fix link accounting when a tmpfile is linked in
  arm64: Relax GIC version check during early boot
  ASoC: topology: free created components in tplg load error
  net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
  pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
  net: systemport: Fix reception of BPDUs
  scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
  assoc_array: Fix shortcut creation
  ARM: 8824/1: fix a migrating irq bug when hotplug cpu
  Input: st-keyscan - fix potential zalloc NULL dereference
  i2c: cadence: Fix the hold bit setting
  Input: matrix_keypad - use flush_delayed_work()
  ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
  s390/dasd: fix using offset into zero size array error
  gpu: ipu-v3: Fix CSI offsets for imx53
  gpu: ipu-v3: Fix i.MX51 CSI control registers offset
  crypto: ahash - fix another early termination in hash walk
  crypto: caam - fixed handling of sg list
  stm class: Fix an endless loop in channel allocation
  ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
  9p/net: fix memory leak in p9_client_create
  9p: use inode->i_lock to protect i_size_write() under 32-bit
  media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
  It's wrong to add len to sector_nr in raid10 reshape twice
  fs/9p: use fscache mutex rather than spinlock
  ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
  tcp/dccp: remove reqsk_put() from inet_child_forget()
  gro_cells: make sure device is up in gro_cells_receive()
  net/hsr: fix possible crash in add_timer()
  vxlan: Fix GRO cells race condition between receive and link delete
  vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
  ipvlan: disallow userns cap_net_admin to change global mode/flags
  missing barriers in some of unix_sock ->addr and ->path accesses
  net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
  mdio_bus: Fix use-after-free on device_register fails
  net/x25: fix a race in x25_bind()
  net/mlx4_core: Fix qp mtt size calculation
  net/mlx4_core: Fix reset flow when in command polling mode
  tcp: handle inet_csk_reqsk_queue_add() failures
  route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
  ravb: Decrease TxFIFO depth of Q3 and Q2 to one
  pptp: dst_release sk_dst_cache in pptp_sock_destruct
  net/x25: reset state in x25_connect()
  net/x25: fix use-after-free in x25_device_event()
  net: sit: fix UBSAN Undefined behaviour in check_6rd
  net: hsr: fix memory leak in hsr_dev_finalize()
  l2tp: fix infoleak in l2tp_ip6_recvmsg()
  KEYS: restrict /proc/keys by credentials at open time
  netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options
  netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters
  netfilter: nfnetlink_log: just returns error for unknown command
  netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES
  udplite: call proper backlog handlers
  ARM: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420
  Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls"
  ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
  futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock()
  iscsi_ibft: Fix missing break in switch statement
  Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
  Input: wacom_serial4 - add support for Wacom ArtPad II tablet
  MIPS: Remove function size check in get_frame_info()
  perf symbols: Filter out hidden symbols from labels
  s390/qeth: fix use-after-free in error path
  dmaengine: dmatest: Abort test in case of mapping error
  dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
  irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
  ARM: pxa: ssp: unneeded to free devm_ allocated data
  autofs: fix error return in autofs_fill_super()
  autofs: drop dentry reference only when it is never used
  fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
  mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
  mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
  x86_64: increase stack size for KASAN_EXTRA
  x86/kexec: Don't setup EFI info if EFI runtime is not enabled
  cifs: fix computation for MAX_SMB2_HDR_SIZE
  platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
  scsi: libfc: free skb when receiving invalid flogi resp
  nfs: Fix NULL pointer dereference of dev_name
  gpio: vf610: Mask all GPIO interrupts
  net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
  net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
  net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
  xtensa: SMP: limit number of possible CPUs by NR_CPUS
  xtensa: SMP: mark each possible CPU as present
  xtensa: smp_lx200_defconfig: fix vectors clash
  xtensa: SMP: fix secondary CPU initialization
  xtensa: SMP: fix ccount_timer_shutdown
  iommu/amd: Fix IOMMU page flush when detach device from a domain
  ipvs: Fix signed integer overflow when setsockopt timeout
  IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
  perf tools: Handle TOPOLOGY headers with no CPU
  vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
  media: uvcvideo: Fix 'type' check leading to overflow
  ip6mr: Do not call __IP6_INC_STATS() from preemptible context
  net: dsa: mv88e6xxx: Fix u64 statistics
  netlabel: fix out-of-bounds memory accesses
  hugetlbfs: fix races and page leaks during migration
  MIPS: irq: Allocate accurate order pages for irq stack
  applicom: Fix potential Spectre v1 vulnerabilities
  x86/CPU/AMD: Set the CPB bit unconditionally on F17h
  net: phy: Micrel KSZ8061: link failure after cable connect
  net: avoid use IPCB in cipso_v4_error
  net: Add __icmp_send helper.
  xen-netback: fix occasional leak of grant ref mappings under memory pressure
  net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
  bnxt_en: Drop oversize TX packets to prevent errors.
  team: Free BPF filter when unregistering netdev
  sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
  net-sysfs: Fix mem leak in netdev_register_kobject
  staging: lustre: fix buffer overflow of string buffer
  isdn: isdn_tty: fix build warning of strncpy
  ncpfs: fix build warning of strncpy
  sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names
  cpufreq: Use struct kobj_attribute instead of struct global_attr
  USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
  USB: serial: cp210x: add ID for Ingenico 3070
  USB: serial: option: add Telit ME910 ECM composition
  x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
  mm: enforce min addr even if capable() in expand_downwards()
  mmc: spi: Fix card detection during probe
  powerpc: Always initialize input array when calling epapr_hypercall()
  KVM: arm/arm64: Fix MMIO emulation data handling
  arm/arm64: KVM: Feed initialized memory to MMIO accesses
  KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
  cfg80211: extend range deviation for DMG
  mac80211: don't initiate TDLS connection if station is not associated to AP
  ibmveth: Do not process frames after calling napi_reschedule
  net: altera_tse: fix connect_local_phy error path
  scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
  serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
  mac80211: fix miscounting of ttl-dropped frames
  ARC: fix __ffs return value to avoid build warnings
  ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
  ASoC: dapm: change snprintf to scnprintf for possible overflow
  usb: gadget: Potential NULL dereference on allocation error
  usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
  thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
  ALSA: compress: prevent potential divide by zero bugs
  ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
  drm/msm: Unblock writer if reader closes file
  scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
  libceph: handle an empty authorize reply
  Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
  ARCv2: Enable unaligned access in early ASM code
  net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
  sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
  team: avoid complex list operations in team_nl_cmd_options_set()
  net/packet: fix 4gb buffer limit due to overflow check
  batman-adv: fix uninit-value in batadv_interface_tx()
  KEYS: always initialize keyring_index_key::desc_len
  KEYS: user: Align the payload buffer
  RDMA/srp: Rework SCSI device reset handling
  isdn: avm: Fix string plus integer warning from Clang
  leds: lp5523: fix a missing check of return value of lp55xx_read
  atm: he: fix sign-extension overflow on large shift
  isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
  MIPS: jazz: fix 64bit build
  scsi: isci: initialize shost fully before calling scsi_add_host()
  scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
  MIPS: ath79: Enable OF serial ports in the default config
  net: hns: Fix use after free identified by SLUB debug
  mfd: mc13xxx: Fix a missing check of a register-read failure
  mfd: wm5110: Add missing ASRC rate register
  mfd: qcom_rpm: write fw_version to CTRL_REG
  mfd: ab8500-core: Return zero in get_register_interruptible()
  mfd: db8500-prcmu: Fix some section annotations
  mfd: twl-core: Fix section annotations on {,un}protect_pm_master
  mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
  KEYS: allow reaching the keys quotas exactly
  numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
  ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
  Revert "ANDROID: arm: process: Add display of memory around registers when displaying regs."
  ANDROID: mnt: Propagate remount correctly
  ANDROID: cuttlefish_defconfig: Add support for AC97 audio
  ANDROID: overlayfs: override_creds=off option bypass creator_cred
  FROMGIT: binder: create node flag to request sender's security context

Conflicts:
	arch/arm/kernel/irq.c
	drivers/media/v4l2-core/videobuf2-v4l2.c
	sound/core/compress_offload.c

Change-Id: I998f8d53b0c5b8a7102816034452b1779a3b69a3
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

1 files changed, 82 insertions, 23 deletions

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 56bbd494df6a..bff9f44161c2 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -356,6 +356,7 @@ struct binder_error {
  * @min_priority:         minimum scheduling priority
  *                        (invariant after initialized)
  * @inherit_rt:           inherit RT scheduling policy from caller
+ * @txn_security_ctx:     require sender's security context
  *                        (invariant after initialized)
  * @async_todo:           list of async work items
  *                        (protected by @proc->inner_lock)
@@ -395,6 +396,7 @@ struct binder_node {
 		u8 sched_policy:2;
 		u8 inherit_rt:1;
 		u8 accept_fds:1;
+		u8 txn_security_ctx:1;
 		u8 min_priority;
 	};
 	bool has_async_transaction;
@@ -652,6 +654,7 @@ struct binder_transaction {
 	struct binder_priority	saved_priority;
 	bool    set_priority_called;
 	kuid_t	sender_euid;
+	binder_uintptr_t security_ctx;
 	/**
 	 * @lock:  protects @from, @to_proc, and @to_thread
 	 *
@@ -1361,6 +1364,7 @@ static struct binder_node *binder_init_node_ilocked(
 	node->min_priority = to_kernel_prio(node->sched_policy, priority);
 	node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
 	node->inherit_rt = !!(flags & FLAT_BINDER_FLAG_INHERIT_RT);
+	node->txn_security_ctx = !!(flags & FLAT_BINDER_FLAG_TXN_SECURITY_CTX);
 	spin_lock_init(&node->lock);
 	INIT_LIST_HEAD(&node->work.entry);
 	INIT_LIST_HEAD(&node->async_todo);
@@ -2899,6 +2903,8 @@ static void binder_transaction(struct binder_proc *proc,
 	binder_size_t last_fixup_min_off = 0;
 	struct binder_context *context = proc->context;
 	int t_debug_id = atomic_inc_return(&binder_last_id);
+	char *secctx = NULL;
+	u32 secctx_sz = 0;
 
 	e = binder_transaction_log_add(&binder_transaction_log);
 	e->debug_id = t_debug_id;
@@ -3122,6 +3128,20 @@ static void binder_transaction(struct binder_proc *proc,
 		t->priority = target_proc->default_priority;
 	}
 
+	if (target_node && target_node->txn_security_ctx) {
+		u32 secid;
+
+		security_task_getsecid(proc->tsk, &secid);
+		ret = security_secid_to_secctx(secid, &secctx, &secctx_sz);
+		if (ret) {
+			return_error = BR_FAILED_REPLY;
+			return_error_param = ret;
+			return_error_line = __LINE__;
+			goto err_get_secctx_failed;
+		}
+		extra_buffers_size += ALIGN(secctx_sz, sizeof(u64));
+	}
+
 	trace_binder_transaction(reply, t, target_node);
 
 	t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
@@ -3138,6 +3158,19 @@ static void binder_transaction(struct binder_proc *proc,
 		t->buffer = NULL;
 		goto err_binder_alloc_buf_failed;
 	}
+	if (secctx) {
+		size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) +
+				    ALIGN(tr->offsets_size, sizeof(void *)) +
+				    ALIGN(extra_buffers_size, sizeof(void *)) -
+				    ALIGN(secctx_sz, sizeof(u64));
+		char *kptr = t->buffer->data + buf_offset;
+
+		t->security_ctx = (uintptr_t)kptr +
+		    binder_alloc_get_user_buffer_offset(&target_proc->alloc);
+		memcpy(kptr, secctx, secctx_sz);
+		security_release_secctx(secctx, secctx_sz);
+		secctx = NULL;
+	}
 	t->buffer->debug_id = t->debug_id;
 	t->buffer->transaction = t;
 	t->buffer->target_node = target_node;
@@ -3408,6 +3441,9 @@ err_copy_data_failed:
 	t->buffer->transaction = NULL;
 	binder_alloc_free_buf(&target_proc->alloc, t->buffer);
 err_binder_alloc_buf_failed:
+	if (secctx)
+		security_release_secctx(secctx, secctx_sz);
+err_get_secctx_failed:
 	kfree(tcomplete);
 	binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
 err_alloc_tcomplete_failed:
@@ -4054,11 +4090,13 @@ retry:
 
 	while (1) {
 		uint32_t cmd;
-		struct binder_transaction_data tr;
+		struct binder_transaction_data_secctx tr;
+		struct binder_transaction_data *trd = &tr.transaction_data;
 		struct binder_work *w = NULL;
 		struct list_head *list = NULL;
 		struct binder_transaction *t = NULL;
 		struct binder_thread *t_from;
+		size_t trsize = sizeof(*trd);
 
 		binder_inner_proc_lock(proc);
 		if (!binder_worklist_empty_ilocked(&thread->todo))
@@ -4254,41 +4292,47 @@ retry:
 			struct binder_node *target_node = t->buffer->target_node;
 			struct binder_priority node_prio;
 
-			tr.target.ptr = target_node->ptr;
-			tr.cookie =  target_node->cookie;
+			trd->target.ptr = target_node->ptr;
+			trd->cookie =  target_node->cookie;
 			node_prio.sched_policy = target_node->sched_policy;
 			node_prio.prio = target_node->min_priority;
 			binder_transaction_priority(current, t, node_prio,
 						    target_node->inherit_rt);
 			cmd = BR_TRANSACTION;
 		} else {
-			tr.target.ptr = 0;
-			tr.cookie = 0;
+			trd->target.ptr = 0;
+			trd->cookie = 0;
 			cmd = BR_REPLY;
 		}
-		tr.code = t->code;
-		tr.flags = t->flags;
-		tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);
+		trd->code = t->code;
+		trd->flags = t->flags;
+		trd->sender_euid = from_kuid(current_user_ns(), t->sender_euid);
 
 		t_from = binder_get_txn_from(t);
 		if (t_from) {
 			struct task_struct *sender = t_from->proc->tsk;
 
-			tr.sender_pid = task_tgid_nr_ns(sender,
-							task_active_pid_ns(current));
+			trd->sender_pid =
+				task_tgid_nr_ns(sender,
+						task_active_pid_ns(current));
 		} else {
-			tr.sender_pid = 0;
+			trd->sender_pid = 0;
 		}
 
-		tr.data_size = t->buffer->data_size;
-		tr.offsets_size = t->buffer->offsets_size;
-		tr.data.ptr.buffer = (binder_uintptr_t)
+		trd->data_size = t->buffer->data_size;
+		trd->offsets_size = t->buffer->offsets_size;
+		trd->data.ptr.buffer = (binder_uintptr_t)
 			((uintptr_t)t->buffer->data +
 			binder_alloc_get_user_buffer_offset(&proc->alloc));
-		tr.data.ptr.offsets = tr.data.ptr.buffer +
+		trd->data.ptr.offsets = trd->data.ptr.buffer +
 					ALIGN(t->buffer->data_size,
 					    sizeof(void *));
 
+		tr.secctx = t->security_ctx;
+		if (t->security_ctx) {
+			cmd = BR_TRANSACTION_SEC_CTX;
+			trsize = sizeof(tr);
+		}
 		if (put_user(cmd, (uint32_t __user *)ptr)) {
 			if (t_from)
 				binder_thread_dec_tmpref(t_from);
@@ -4299,7 +4343,7 @@ retry:
 			return -EFAULT;
 		}
 		ptr += sizeof(uint32_t);
-		if (copy_to_user(ptr, &tr, sizeof(tr))) {
+		if (copy_to_user(ptr, &tr, trsize)) {
 			if (t_from)
 				binder_thread_dec_tmpref(t_from);
 
@@ -4308,7 +4352,7 @@ retry:
 
 			return -EFAULT;
 		}
-		ptr += sizeof(tr);
+		ptr += trsize;
 
 		trace_binder_transaction_received(t);
 		binder_stat_br(proc, thread, cmd);
@@ -4316,16 +4360,18 @@ retry:
 			     "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n",
 			     proc->pid, thread->pid,
 			     (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
-			     "BR_REPLY",
+				(cmd == BR_TRANSACTION_SEC_CTX) ?
+				     "BR_TRANSACTION_SEC_CTX" : "BR_REPLY",
 			     t->debug_id, t_from ? t_from->proc->pid : 0,
 			     t_from ? t_from->pid : 0, cmd,
 			     t->buffer->data_size, t->buffer->offsets_size,
-			     (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets);
+			     (u64)trd->data.ptr.buffer,
+			     (u64)trd->data.ptr.offsets);
 
 		if (t_from)
 			binder_thread_dec_tmpref(t_from);
 		t->buffer->allow_user_free = 1;
-		if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
+		if (cmd != BR_REPLY && !(t->flags & TF_ONE_WAY)) {
 			binder_inner_proc_lock(thread->proc);
 			t->to_parent = thread->transaction_stack;
 			t->to_thread = thread;
@@ -4670,7 +4716,8 @@ out:
 	return ret;
 }
 
-static int binder_ioctl_set_ctx_mgr(struct file *filp)
+static int binder_ioctl_set_ctx_mgr(struct file *filp,
+				    struct flat_binder_object *fbo)
 {
 	int ret = 0;
 	struct binder_proc *proc = filp->private_data;
@@ -4699,7 +4746,7 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp)
 	} else {
 		context->binder_context_mgr_uid = curr_euid;
 	}
-	new_node = binder_new_node(proc, NULL);
+	new_node = binder_new_node(proc, fbo);
 	if (!new_node) {
 		ret = -ENOMEM;
 		goto out;
@@ -4821,8 +4868,20 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 		binder_inner_proc_unlock(proc);
 		break;
 	}
+	case BINDER_SET_CONTEXT_MGR_EXT: {
+		struct flat_binder_object fbo;
+
+		if (copy_from_user(&fbo, ubuf, sizeof(fbo))) {
+			ret = -EINVAL;
+			goto err;
+		}
+		ret = binder_ioctl_set_ctx_mgr(filp, &fbo);
+		if (ret)
+			goto err;
+		break;
+	}
 	case BINDER_SET_CONTEXT_MGR:
-		ret = binder_ioctl_set_ctx_mgr(filp);
+		ret = binder_ioctl_set_ctx_mgr(filp, NULL);
 		if (ret)
 			goto err;
 		break;