Merge remote-tracking branch 'common/android-4.4-p' into lineage-18.1-caf-msm8998

# By Thomas Gleixner (11) and others
# Via Greg Kroah-Hartman
* google/common/android-4.4-p:
  Linux 4.4.283
  Revert "floppy: reintroduce O_NDELAY fix"
  fbmem: add margin check to fb_check_caps()
  vt_kdsetmode: extend console locking
  vringh: Use wiov->used to check for read/write desc order
  virtio: Improve vq->broken access to avoid any compiler optimization
  net: marvell: fix MVNETA_TX_IN_PRGRS bit number
  e1000e: Fix the max snoop/no-snoop latency for 10M
  USB: serial: option: add new VID/PID to support Fibocom FG150
  Revert "USB: serial: ch341: fix character loss at high transfer rates"
  can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
  Linux 4.4.282
  mmc: dw_mmc: Fix occasional hang after tuning on eMMC
  ASoC: intel: atom: Fix breakage for PCM buffer address setup
  ipack: tpci200: fix many double free issues in tpci200_pci_probe
  ALSA: hda - fix the 'Capture Switch' value change notifications
  mmc: dw_mmc: Fix hang on data CRC error
  mmc: dw_mmc: call the dw_mci_prep_stop_abort() by default
  mmc: dw_mmc: Wait for data transfer after response errors.
  net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
  net: 6pack: fix slab-out-of-bounds in decode_data
  dccp: add do-while-0 stubs for dccp_pr_debug macros
  Bluetooth: hidp: use correct wait queue when removing ctrl_wait
  scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
  scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
  dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available
  ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
  dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
  KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
  vmlinux.lds.h: Handle clang's module.{c,d}tor sections
  PCI/MSI: Enforce MSI[X] entry updates to be visible
  PCI/MSI: Enforce that MSI-X table entry is masked for update
  PCI/MSI: Mask all unused MSI-X entries
  PCI/MSI: Protect msi_desc::masked for multi-MSI
  PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
  PCI/MSI: Correct misleading comments
  PCI/MSI: Do not set invalid bits in MSI mask
  PCI/MSI: Enable and mask MSI-X early
  x86/tools: Fix objdump version check again
  xen/events: Fix race in set_evtchn_to_irq
  net: Fix memory leak in ieee802154_raw_deliver
  i2c: dev: zero out array used for i2c reads from userspace
  ASoC: intel: atom: Fix reference to PCM buffer address
  ANDROID: xt_quota2: set usersize in xt_match registration object
  ANDROID: xt_quota2: clear quota2_log message before sending
  ANDROID: xt_quota2: remove trailing junk which might have a digit in it
  UPSTREAM: netfilter: x_tables: fix pointer leaks to userspace
  Linux 4.4.281
  ovl: prevent private clone if bind mount is not allowed
  net: xilinx_emaclite: Do not print real IOMEM pointer
  USB:ehci:fix Kunpeng920 ehci hardware problem
  pipe: increase minimum default pipe size to 2 pages
  net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset
  alpha: Send stop IPI to send to online CPUs
  reiserfs: check directory items on read from disk
  reiserfs: add check for root_inode in reiserfs_fill_super
  pcmcia: i82092: fix a null pointer dereference bug
  MIPS: Malta: Do not byte-swap accesses to the CBUS UART
  serial: 8250: Mask out floating 16/32-bit bus bits
  media: rtl28xxu: fix zero-length control request
  scripts/tracing: fix the bug that can't parse raw_trace_func
  USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
  USB: serial: ch341: fix character loss at high transfer rates
  USB: serial: option: add Telit FD980 composition 0x1056
  Bluetooth: defer cleanup of resources in hci_unregister_dev()
  net: vxge: fix use-after-free in vxge_device_unregister
  net: pegasus: fix uninit-value in get_interrupt_interval
  bnx2x: fix an error code in bnx2x_nic_load()
  mips: Fix non-POSIX regexp
  net: natsemi: Fix missing pci_disable_device() in probe and remove
  media: videobuf2-core: dequeue if start_streaming fails
  scsi: sr: Return correct event when media event code is 3
  ALSA: seq: Fix racy deletion of subscriber
  Linux 4.4.280
  rcu: Update documentation of rcu_read_unlock()
  futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock()
  futex: Avoid freeing an active timer
  futex: Handle transient "ownerless" rtmutex state correctly
  rtmutex: Make wait_lock irq safe
  futex: Futex_unlock_pi() determinism
  futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()
  futex: Pull rt_mutex_futex_unlock() out from under hb->lock
  futex,rt_mutex: Introduce rt_mutex_init_waiter()
  futex: Cleanup refcounting
  futex: Rename free_pi_state() to put_pi_state()
  Linux 4.4.279
  can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled"
  net: Fix zero-copy head len calculation.
  r8152: Fix potential PM refcount imbalance
  regulator: rt5033: Fix n_voltages settings for BUCK and LDO
  btrfs: mark compressed range uptodate only if all bio succeed

 Conflicts:
	net/bluetooth/hci_core.c
	net/netfilter/xt_quota2.c

Change-Id: I66e2384c8cc40448a7bff34bb935c74e6103e924

5 files changed, 78 insertions, 22 deletions

diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index bae05c5c75ba..92601775ec5e 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -290,7 +290,7 @@ static void end_compressed_bio_write(struct bio *bio)
 					 cb->start,
 					 cb->start + cb->len - 1,
 					 NULL,
-					 bio->bi_error ? 0 : 1);
+					 !cb->errors);
 	cb->compressed_pages[0]->mapping = NULL;
 
 	end_compressed_writeback(inode, cb);
diff --git a/fs/namespace.c b/fs/namespace.c
index 796e13b654b8..58c6f27b141d 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1850,6 +1850,20 @@ void drop_collected_mounts(struct vfsmount *mnt)
 	namespace_unlock();
 }
 
+static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
+{
+	struct mount *child;
+
+	list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
+		if (!is_subdir(child->mnt_mountpoint, dentry))
+			continue;
+
+		if (child->mnt.mnt_flags & MNT_LOCKED)
+			return true;
+	}
+	return false;
+}
+
 /**
  * clone_private_mount - create a private clone of a path
  *
@@ -1864,16 +1878,27 @@ struct vfsmount *clone_private_mount(struct path *path)
 	struct mount *old_mnt = real_mount(path->mnt);
 	struct mount *new_mnt;
 
+	down_read(&namespace_sem);
 	if (IS_MNT_UNBINDABLE(old_mnt))
-		return ERR_PTR(-EINVAL);
+		goto invalid;
+
+	if (!check_mnt(old_mnt))
+		goto invalid;
+
+	if (has_locked_children(old_mnt, path->dentry))
+		goto invalid;
 
-	down_read(&namespace_sem);
 	new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
 	up_read(&namespace_sem);
+
 	if (IS_ERR(new_mnt))
 		return ERR_CAST(new_mnt);
 
 	return &new_mnt->mnt;
+
+invalid:
+	up_read(&namespace_sem);
+	return ERR_PTR(-EINVAL);
 }
 EXPORT_SYMBOL_GPL(clone_private_mount);
 
@@ -2189,19 +2214,6 @@ static int do_change_type(struct path *path, int flag)
 	return err;
 }
 
-static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
-{
-	struct mount *child;
-	list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
-		if (!is_subdir(child->mnt_mountpoint, dentry))
-			continue;
-
-		if (child->mnt.mnt_flags & MNT_LOCKED)
-			return true;
-	}
-	return false;
-}
-
 /*
  * do loopback mount.
  */
diff --git a/fs/pipe.c b/fs/pipe.c
index 6534470a6c19..37a003b645ef 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -28,6 +28,21 @@
 #include "internal.h"
 
 /*
+ * New pipe buffers will be restricted to this size while the user is exceeding
+ * their pipe buffer quota. The general pipe use case needs at least two
+ * buffers: one for data yet to be read, and one for new data. If this is less
+ * than two, then a write to a non-empty pipe may block even if the pipe is not
+ * full. This can occur with GNU make jobserver or similar uses of pipes as
+ * semaphores: multiple processes may be waiting to write tokens back to the
+ * pipe before reading tokens: https://lore.kernel.org/lkml/1628086770.5rn8p04n6j.none@localhost/.
+ *
+ * Users can reduce their pipe buffers with F_SETPIPE_SZ below this at their
+ * own risk, namely: pipe writes to non-full pipes may block until the pipe is
+ * emptied.
+ */
+#define PIPE_MIN_DEF_BUFFERS 2
+
+/*
  * The max size that a non-root user is allowed to grow the pipe. Can
  * be set by root in /proc/sys/fs/pipe-max-size
  */
@@ -621,7 +636,7 @@ struct pipe_inode_info *alloc_pipe_info(void)
 
 		if (!too_many_pipe_buffers_hard(user)) {
 			if (too_many_pipe_buffers_soft(user))
-				pipe_bufs = 1;
+				pipe_bufs = PIPE_MIN_DEF_BUFFERS;
 			pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL);
 		}
 
diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index 33b78ee9fb9e..13322c39e6cc 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -386,6 +386,24 @@ void pathrelse(struct treepath *search_path)
 	search_path->path_length = ILLEGAL_PATH_ELEMENT_OFFSET;
 }
 
+static int has_valid_deh_location(struct buffer_head *bh, struct item_head *ih)
+{
+	struct reiserfs_de_head *deh;
+	int i;
+
+	deh = B_I_DEH(bh, ih);
+	for (i = 0; i < ih_entry_count(ih); i++) {
+		if (deh_location(&deh[i]) > ih_item_len(ih)) {
+			reiserfs_warning(NULL, "reiserfs-5094",
+					 "directory entry location seems wrong %h",
+					 &deh[i]);
+			return 0;
+		}
+	}
+
+	return 1;
+}
+
 static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
 {
 	struct block_head *blkh;
@@ -453,11 +471,14 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
 					 "(second one): %h", ih);
 			return 0;
 		}
-		if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) {
-			reiserfs_warning(NULL, "reiserfs-5093",
-					 "item entry count seems wrong %h",
-					 ih);
-			return 0;
+		if (is_direntry_le_ih(ih)) {
+			if (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE)) {
+				reiserfs_warning(NULL, "reiserfs-5093",
+						 "item entry count seems wrong %h",
+						 ih);
+				return 0;
+			}
+			return has_valid_deh_location(bh, ih);
 		}
 		prev_location = ih_location(ih);
 	}
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 503d8c06e0d9..2ffcbe451202 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -2050,6 +2050,14 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
 		unlock_new_inode(root_inode);
 	}
 
+	if (!S_ISDIR(root_inode->i_mode) || !inode_get_bytes(root_inode) ||
+	    !root_inode->i_size) {
+		SWARN(silent, s, "", "corrupt root inode, run fsck");
+		iput(root_inode);
+		errval = -EUCLEAN;
+		goto error;
+	}
+
 	s->s_root = d_make_root(root_inode);
 	if (!s->s_root)
 		goto error;