This is the 4.9.271 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmC4dXsACgkQONu9yGCS
 aT5nww//TIky0PNOwMKSy2hcBon342WcgQtUjupv5akbOYOrXmfXs9ulwAI7u2bk
 madXGlcVLhx3s3WpUE5Ql9nBUCUkrUxCk/B26RcDRpPwk7LQqEOPBsXkYyx5oEhH
 WmucSAf2d8HZ05OLZjOI+DDSmtHB/OHpt66nEy9HzvL4emZYW7/rIWXIj0wOoexe
 46J1Ta+glFx3OFqBqVk1/+o9Q/NZbKHDOYh8240W7u2lWN6dBZLCp6j2tm6HRWbT
 2SP2HS02kNp53UlTN8W+vSJNNGCWfn5Zt9gg7UwZlWlz4Zz5o1okWuVLo13WLvju
 0pxEg0au5wugPuwO6JBsM1fQDLsxsJ67NBapTK3eAFuih12ExXGepuBYQp1ZFhQV
 x2YNV7Rt5dKVJDsnXkeQ0G1l+JZf0i9mDQh0wuWOrQiuw6RsTfI7aSybGjmGXxwW
 GFvzNqXp0k19uO/OJ6tuEcMbJZ/bWUdZFBonguNPX+YXr2VZtGeUWtWLD8NA8qJG
 VPSrqNbNOEKejP1uHTx5O6ChzuUkDFDYHoBswQjAuTl8ij0sPcy1ip/nfm10aYk8
 l2N89ESJvA9L3PfMD0aNjTPg0beoQdXnIySpFNv6egkYCHEgw1M8yAO0am5krdvD
 d0SDO2BdbRdbNfIhiJhbTTe/1mAMor4jQReS/zRWLEu4y65zyCk=
 =bPag
 -----END PGP SIGNATURE-----

Merge 4.9.271 into android-4.9-q

Changes in 4.9.271
	mm, vmstat: drop zone->lock in /proc/pagetypeinfo
	tweewide: Fix most Shebang lines
	scripts: switch explicitly to Python 3
	netfilter: x_tables: Use correct memory barriers.
	NFC: nci: fix memory leak in nci_allocate_device
	NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
	proc: Check /proc/$pid/attr/ writes against file opener
	net: hso: fix control-request directions
	mac80211: assure all fragments are encrypted
	mac80211: prevent mixed key and fragment cache attacks
	mac80211: properly handle A-MSDUs that start with an RFC 1042 header
	cfg80211: mitigate A-MSDU aggregation attacks
	mac80211: drop A-MSDUs on old ciphers
	mac80211: add fragment cache to sta_info
	mac80211: check defrag PN against current frame
	mac80211: prevent attacks on TKIP/WEP as well
	mac80211: do not accept/forward invalid EAPOL frames
	mac80211: extend protection against mixed key and fragment cache attacks
	ath10k: Validate first subframe of A-MSDU before processing the list
	dm snapshot: properly fix a crash when an origin has no snapshots
	kgdb: fix gcc-11 warnings harder
	misc/uss720: fix memory leak in uss720_probe
	mei: request autosuspend after sending rx flow control
	staging: iio: cdc: ad7746: avoid overwrite of num_channels
	iio: adc: ad7793: Add missing error code in ad7793_setup()
	USB: trancevibrator: fix control-request direction
	serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
	USB: serial: ti_usb_3410_5052: add startech.com device id
	USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
	USB: serial: ftdi_sio: add IDs for IDS GmbH Products
	USB: serial: pl2303: add device id for ADLINK ND-6530 GC
	net: usb: fix memory leak in smsc75xx_bind
	spi: Fix use-after-free with devm_spi_alloc_*
	Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
	NFS: fix an incorrect limit in filelayout_decode_layout()
	NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()
	NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
	net/mlx4: Fix EEPROM dump support
	Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
	tipc: skb_linearize the head skb when reassembling msgs
	i2c: s3c2410: fix possible NULL pointer deref on read message after write
	i2c: i801: Don't generate an interrupt on bus reset
	perf jevents: Fix getting maximum number of fds
	platform/x86: hp_accel: Avoid invoking _INI to speed up resume
	serial: max310x: unregister uart driver in case of failure and abort
	net: fujitsu: fix potential null-ptr-deref
	net: caif: remove BUG_ON(dev == NULL) in caif_xmit
	char: hpet: add checks after calling ioremap
	isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
	dmaengine: qcom_hidma: comment platform_driver_register call
	libertas: register sysfs groups properly
	media: dvb: Add check on sp8870_readreg return
	media: gspca: properly check for errors in po1030_probe()
	scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
	openrisc: Define memory barrier mb
	btrfs: do not BUG_ON in link_to_fixup_dir
	platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI
	drm/amdgpu: Fix a use-after-free
	net: netcp: Fix an error message
	net: mdio: thunder: Fix a double free issue in the .remove function
	net: mdio: octeon: Fix some double free issues
	net: bnx2: Fix error return code in bnx2_init_board()
	mld: fix panic in mld_newpack()
	staging: emxx_udc: fix loop in _nbu2ss_nuke()
	ASoC: cs35l33: fix an error code in probe()
	scsi: libsas: Use _safe() loop in sas_resume_port()
	sch_dsmark: fix a NULL deref in qdisc_reset()
	MIPS: alchemy: xxs1500: add gpio-au1000.h header file
	MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c
	hugetlbfs: hugetlb_fault_mutex_hash() cleanup
	usb: core: reduce power-on-good delay time of root hub
	Linux 4.9.271

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6da4427d9ada52cbebbcc4d69e74f9ecebd9ad8b

Documentation/sphinx/parse-headers.pl

@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/bin/env perl
 use strict;
 use Text::Tabs;
 

Documentation/target/tcm_mod_builder.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 # The TCM v4 multi-protocol fabric module generation script for drivers/target/$NEW_MOD
 #
 # Copyright (c) 2010 Rising Tide Systems

Documentation/trace/postprocess/decode_msr.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 # add symbolic names to read_msr / write_msr in trace
 # decode_msr msr-index.h < trace
 import sys

Documentation/trace/postprocess/trace-pagealloc-postprocess.pl

@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/bin/env perl
 # This is a POC (proof of concept or piece of crap, take your pick) for reading the
 # text representation of trace output related to page allocation. It makes an attempt
 # to extract some high-level information on what is going on. The accuracy of the parser

Documentation/trace/postprocess/trace-vmscan-postprocess.pl

@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/bin/env perl
 # This is a POC for reading the text representation of trace output related to
 # page reclaim. It makes an attempt to extract some high-level information on
 # what is going on. The accuracy of the parser may vary

Makefile

@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 270
+SUBLEVEL = 271
 EXTRAVERSION =
 NAME = Roaring Lionus
 

arch/ia64/scripts/unwcheck.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 #
 # Usage: unwcheck.py FILE
 #

arch/mips/alchemy/board-xxs1500.c

@@ -30,6 +30,7 @@
 #include <asm/bootinfo.h>
 #include <asm/reboot.h>
 #include <asm/mach-au1x00/au1000.h>
+#include <asm/mach-au1x00/gpio-au1000.h>
 #include <prom.h>
 
 const char *get_system_type(void)

arch/mips/ralink/of.c

@@ -10,6 +10,7 @@
 
 #include <linux/io.h>
 #include <linux/clk.h>
+#include <linux/export.h>
 #include <linux/init.h>
 #include <linux/sizes.h>
 #include <linux/of_fdt.h>
@@ -27,6 +28,7 @@
 
 __iomem void *rt_sysc_membase;
 __iomem void *rt_memc_membase;
+EXPORT_SYMBOL_GPL(rt_sysc_membase);
 
 __iomem void *plat_of_remap_node(const char *node)
 {

arch/openrisc/include/asm/barrier.h

@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __ASM_BARRIER_H
+#define __ASM_BARRIER_H
+
+#define mb() asm volatile ("l.msync" ::: "memory")
+
+#include <asm-generic/barrier.h>
+
+#endif /* __ASM_BARRIER_H */

drivers/char/hpet.c

@@ -976,6 +976,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
 	if (ACPI_SUCCESS(status)) {
 		hdp->hd_phys_address = addr.address.minimum;
 		hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length);
+		if (!hdp->hd_address)
+			return AE_ERROR;
 
 		if (hpet_is_known(hdp)) {
 			iounmap(hdp->hd_address);
@@ -989,6 +991,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
 		hdp->hd_phys_address = fixmem32->address;
 		hdp->hd_address = ioremap(fixmem32->address,
 						HPET_RANGE_SIZE);
+		if (!hdp->hd_address)
+			return AE_ERROR;
 
 		if (hpet_is_known(hdp)) {
 			iounmap(hdp->hd_address);

drivers/dma/qcom/hidma_mgmt.c

@@ -398,6 +398,20 @@ static int __init hidma_mgmt_init(void)
 		of_node_put(child);
 	}
 #endif
+	/*
+	 * We do not check for return value here, as it is assumed that
+	 * platform_driver_register must not fail. The reason for this is that
+	 * the (potential) hidma_mgmt_of_populate_channels calls above are not
+	 * cleaned up if it does fail, and to do this work is quite
+	 * complicated. In particular, various calls of of_address_to_resource,
+	 * of_irq_to_resource, platform_device_register_full, of_dma_configure,
+	 * and of_msi_configure which then call other functions and so on, must
+	 * be cleaned up - this is not a trivial exercise.
+	 *
+	 * Currently, this module is not intended to be unloaded, and there is
+	 * no module_exit function defined which does the needed cleanup. For
+	 * this reason, we have to assume success here.
+	 */
 	platform_driver_register(&hidma_mgmt_driver);
 
 	return 0;

drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c

@@ -886,6 +886,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm)
 
 	if (gtt && gtt->userptr) {
 		kfree(ttm->sg);
+		ttm->sg = NULL;
 		ttm->page_flags &= ~TTM_PAGE_FLAG_SG;
 		return;
 	}

drivers/i2c/busses/i2c-i801.c

@@ -375,11 +375,9 @@ static int i801_check_post(struct i801_priv *priv, int status)
 		dev_err(&priv->pci_dev->dev, "Transaction timeout\n");
 		/* try to stop the current command */
 		dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n");
-		outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL,
-		       SMBHSTCNT(priv));
+		outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv));
 		usleep_range(1000, 2000);
-		outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL),
-		       SMBHSTCNT(priv));
+		outb_p(0, SMBHSTCNT(priv));
 
 		/* Check if it worked */
 		status = inb_p(SMBHSTSTS(priv));

drivers/i2c/busses/i2c-s3c2410.c

@@ -495,7 +495,10 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat)
 					 * forces us to send a new START
 					 * when we change direction
 					 */
+					dev_dbg(i2c->dev,
+						"missing START before write->read\n");
 					s3c24xx_i2c_stop(i2c, -EINVAL);
+					break;
 				}
 
 				goto retry_write;

drivers/iio/adc/ad7793.c

@@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
 	id &= AD7793_ID_MASK;
 
 	if (id != st->chip_info->id) {
+		ret = -ENODEV;
 		dev_err(&st->sd.spi->dev, "device ID query failed\n");
 		goto out;
 	}

drivers/isdn/hardware/mISDN/mISDNinfineon.c

@@ -645,17 +645,19 @@ static void
 release_io(struct inf_hw *hw)
 {
 	if (hw->cfg.mode) {
-		if (hw->cfg.p) {
+		if (hw->cfg.mode == AM_MEMIO) {
 			release_mem_region(hw->cfg.start, hw->cfg.size);
-			iounmap(hw->cfg.p);
+			if (hw->cfg.p)
+				iounmap(hw->cfg.p);
 		} else
 			release_region(hw->cfg.start, hw->cfg.size);
 		hw->cfg.mode = AM_NONE;
 	}
 	if (hw->addr.mode) {
-		if (hw->addr.p) {
+		if (hw->addr.mode == AM_MEMIO) {
 			release_mem_region(hw->addr.start, hw->addr.size);
-			iounmap(hw->addr.p);
+			if (hw->addr.p)
+				iounmap(hw->addr.p);
 		} else
 			release_region(hw->addr.start, hw->addr.size);
 		hw->addr.mode = AM_NONE;
@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw)
 				(ulong)hw->cfg.start, (ulong)hw->cfg.size);
 			return err;
 		}
-		if (hw->ci->cfg_mode == AM_MEMIO)
-			hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
 		hw->cfg.mode = hw->ci->cfg_mode;
+		if (hw->ci->cfg_mode == AM_MEMIO) {
+			hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
+			if (!hw->cfg.p)
+				return -ENOMEM;
+		}
 		if (debug & DEBUG_HW)
 			pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n",
 				  hw->name, (ulong)hw->cfg.start,
@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw)
 				(ulong)hw->addr.start, (ulong)hw->addr.size);
 			return err;
 		}
-		if (hw->ci->addr_mode == AM_MEMIO)
-			hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
 		hw->addr.mode = hw->ci->addr_mode;
+		if (hw->ci->addr_mode == AM_MEMIO) {
+			hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
+			if (!hw->addr.p)
+				return -ENOMEM;
+		}
 		if (debug & DEBUG_HW)
 			pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n",
 				  hw->name, (ulong)hw->addr.start,

drivers/md/dm-snap.c

@@ -788,7 +788,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
 static uint32_t __minimum_chunk_size(struct origin *o)
 {
 	struct dm_snapshot *snap;
-	unsigned chunk_size = 0;
+	unsigned chunk_size = rounddown_pow_of_two(UINT_MAX);
 
 	if (o)
 		list_for_each_entry(snap, &o->snapshots, list)

drivers/media/dvb-frontends/sp8870.c

@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe)
 	sp8870_writereg(state, 0xc05, reg0xc05);
 
 	// read status reg in order to clear pending irqs
-	sp8870_readreg(state, 0x200);
+	err = sp8870_readreg(state, 0x200);
+	if (err < 0)
+		return err;
 
 	// system controller start
 	sp8870_microcontroller_start(state);

drivers/media/usb/gspca/m5602/m5602_po1030.c

@@ -159,6 +159,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = {
 int po1030_probe(struct sd *sd)
 {
 	u8 dev_id_h = 0, i;
+	int err;
 	struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
 
 	if (force_sensor) {
@@ -177,10 +178,13 @@ int po1030_probe(struct sd *sd)
 	for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) {
 		u8 data = preinit_po1030[i][2];
 		if (preinit_po1030[i][0] == SENSOR)
-			m5602_write_sensor(sd,
-				preinit_po1030[i][1], &data, 1);
+			err = m5602_write_sensor(sd, preinit_po1030[i][1],
+						 &data, 1);
 		else
-			m5602_write_bridge(sd, preinit_po1030[i][1], data);
+			err = m5602_write_bridge(sd, preinit_po1030[i][1],
+						 data);
+		if (err < 0)
+			return err;
 	}
 
 	if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1))