Merge android-4.9.129 (b727d1c) into msm-4.9

* refs/heads/tmp-b727d1c:
  Linux 4.9.129
  e1000e: Fix link check race condition
  Revert "e1000e: Separate signaling for link check/link up"
  e1000e: Avoid missed interrupts following ICR read
  e1000e: Fix queue interrupt re-raising in Other interrupt
  Partial revert "e1000e: Avoid receiver overrun interrupt bursts"
  e1000e: Remove Other from EIAC
  MIPS: VDSO: Match data page cache colouring when D$ aliases
  mei: bus: type promotion bug in mei_nfc_if_version()
  pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant
  drm/panel: type promotion bug in s6e8aa0_read_mtp_id()
  selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress
  ALSA: pcm: Fix snd_interval_refine first/last with open min/max
  rtc: bq4802: add error handling for devm_ioremap
  drm/amdkfd: Fix error codes in kfd_get_process
  input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
  mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
  gpiolib: Mark gpio_suffixes array with __maybe_unused
  gpio: pxa: Fix potential NULL dereference
  coresight: tpiu: Fix disabling timeouts
  coresight: Handle errors in finding input/output ports
  parport: sunbpp: fix error return code
  drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping
  mmc: sdhci: do not try to use 3.3V signaling if not supported
  mmc: tegra: prevent HS200 on Tegra 3
  gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes
  ARM: hisi: check of_iomap and fix missing of_node_put
  ARM: hisi: fix error handling and missing of_node_put
  ARM: hisi: handle of_iomap and fix missing of_node_put
  efi/esrt: Only call efi_mem_reserve() for boot services memory
  configfs: fix registered group removal
  MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads
  evm: Don't deadlock if a crypto algorithm is unavailable
  mtdchar: fix overflows in adjustment of `count`
  audit: fix use-after-free in audit_add_watch
  binfmt_elf: Respect error return from `regset->active'
  NFSv4.1 fix infinite loop on I/O.
  perf/core: Force USER_DS when recording user stack data
  CIFS: fix wrapping bugs in num_entries()
  cifs: prevent integer overflow in nxt_dir_entry()
  Revert "cdc-acm: implement put_char() and flush_chars()"
  usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()
  USB: yurex: Fix buffer over-read in yurex_write()
  USB: serial: ti_usb_3410_5052: fix array underflow in completion handler
  usb: misc: uss720: Fix two sleep-in-atomic-context bugs
  USB: serial: io_ti: fix array underflow in completion handler
  USB: net2280: Fix erroneous synchronization change
  usb: gadget: udc: renesas_usb3: fix maxpacket size of ep0
  USB: add quirk for WORLDE Controller KS49 or Prodipe MIDI 49C USB controller
  usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()
  usb: Avoid use-after-free by flushing endpoints early in usb_set_interface()
  usb: uas: add support for more quirk flags
  USB: Add quirk to support DJI CineSSD
  mei: ignore not found client in the enumeration
  usb: Don't die twice if PCI xhci host is not responding in resume
  misc: hmc6352: fix potential Spectre v1
  Tools: hv: Fix a bug in the key delete code
  mmc: omap_hsmmc: fix wakeirq handling on removal
  IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
  xen/netfront: fix waiting for xenbus state change
  pstore: Fix incorrect persistent ram buffer mapping
  RDMA/cma: Protect cma dev list with lock
  xen-netfront: fix warn message as irq device name has '/'
  crypto: sharah - Unregister correct algorithms for SAHARA 3
  dmaengine: mv_xor_v2: kill the tasklets upon exit
  drivers/base: stop new probing during shutdown
  KVM: arm/arm64: Fix vgic init race
  platform/x86: toshiba_acpi: Fix defined but not used build warnings
  s390/qeth: reset layer2 attribute on layer switch
  s390/qeth: fix race in used-buffer accounting
  ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci
  arm64: dts: qcom: db410c: Fix Bluetooth LED trigger
  xen-netfront: fix queue name setting
  nfp: avoid buffer leak when FW communication fails
  efi/arm: preserve early mapping of UEFI memory map longer for BGRT
  wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc
  Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets
  mac80211: restrict delayed tailroom needed decrement
  MIPS: jz4740: Bump zload address
  powerpc/powernv: opal_put_chars partial write fix
  perf powerpc: Fix callchain ip filtering
  ARM: exynos: Clear global variable on init error path
  fbdev: Distinguish between interlaced and progressive modes
  video: fbdev: pxafb: clear allocated memory for video modes
  perf powerpc: Fix callchain ip filtering when return address is in a register
  fbdev/via: fix defined but not used warning
  video: goldfishfb: fix memory leak on driver remove
  fbdev: omapfb: off by one in omapfb_register_client()
  gfs2: Don't reject a supposedly full bitmap if we have blocks reserved
  perf test: Fix subtest number when showing results
  mtd/maps: fix solutionengine.c printk format warnings
  IB/rxe: Drop QP0 silently
  media: videobuf2-core: check for q->error in vb2_core_qbuf()
  MIPS: ath79: fix system restart
  dmaengine: pl330: fix irq race with terminate_all
  media: tw686x: Fix oops on buffer alloc failure
  kbuild: add .DELETE_ON_ERROR special target
  clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure
  clk: imx6ul: fix missing of_node_put()
  gfs2: Special-case rindex for gfs2_grow
  xfrm: fix 'passing zero to ERR_PTR()' warning
  ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro
  ALSA: msnd: Fix the default sample sizes
  iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register
  net/mlx5: Fix debugfs cleanup in the device init/remove flow
  net/mlx5: Fix use-after-free in self-healing flow
  rds: fix two RCU related problems
  be2net: Fix memory leak in be_cmd_get_profile_config()
  UPSTREAM: arm64/syscalls: Move address limit check in loop
  BACKPORT: arm/syscalls: Optimize address limit check
  UPSTREAM: syscalls: Use CHECK_DATA_CORRUPTION for addr_limit_user_check
  UPSTREAM: arm64/syscalls: Check address limit on user-mode return
  BACKPORT: x86/syscalls: Check address limit on user-mode return
  BACKPORT: lkdtm: add bad USER_DS test
  UPSTREAM: bug: switch data corruption check to __must_check
  UPSTREAM: lkdtm: Add tests for struct list corruption
  UPSTREAM: bug: Provide toggle for BUG on data corruption
  UPSTREAM: list: Split list_del() debug checking into separate function
  UPSTREAM: rculist: Consolidate DEBUG_LIST for list_add_rcu()
  UPSTREAM: list: Split list_add() debug checking into separate function
  FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl.

Conflicts:
	drivers/misc/lkdtm.h
	drivers/misc/lkdtm_bugs.c
	drivers/misc/lkdtm_core.c
	include/linux/bug.h
	lib/Kconfig.debug
	lib/list_debug.c

Change-Id: I599369f47c3695545470d1ae6069f58728cd61f3
Signed-off-by: Minming Qi <mqi@codeaurora.org>
This commit is contained in:
Minming Qi 2018-11-07 13:12:49 +08:00
commit 2e316b4ab1
129 changed files with 837 additions and 418 deletions

View file

@ -1,6 +1,6 @@
VERSION = 4
PATCHLEVEL = 9
SUBLEVEL = 128
SUBLEVEL = 129
EXTRAVERSION =
NAME = Roaring Lionus

View file

@ -188,6 +188,8 @@
regulator-max-microvolt = <2950000>;
regulator-boot-on;
regulator-system-load = <200000>;
regulator-allow-set-load;
};
l21 {

View file

@ -12,6 +12,7 @@
#include <asm/unistd.h>
#include <asm/ftrace.h>
#include <asm/unwind.h>
#include <asm/memory.h>
#ifdef CONFIG_NEED_RET_TO_USER
#include <mach/entry-macro.S>
@ -35,6 +36,9 @@ ret_fast_syscall:
UNWIND(.fnstart )
UNWIND(.cantunwind )
disable_irq_notrace @ disable interrupts
ldr r2, [tsk, #TI_ADDR_LIMIT]
cmp r2, #TASK_SIZE
blne addr_limit_check_failed
ldr r1, [tsk, #TI_FLAGS] @ re-check for syscall tracing
tst r1, #_TIF_SYSCALL_WORK | _TIF_WORK_MASK
bne fast_work_pending
@ -61,6 +65,9 @@ ret_fast_syscall:
UNWIND(.cantunwind )
str r0, [sp, #S_R0 + S_OFF]! @ save returned r0
disable_irq_notrace @ disable interrupts
ldr r2, [tsk, #TI_ADDR_LIMIT]
cmp r2, #TASK_SIZE
blne addr_limit_check_failed
ldr r1, [tsk, #TI_FLAGS] @ re-check for syscall tracing
tst r1, #_TIF_SYSCALL_WORK | _TIF_WORK_MASK
beq no_work_pending
@ -93,6 +100,9 @@ ENTRY(ret_to_user)
ret_slow_syscall:
disable_irq_notrace @ disable interrupts
ENTRY(ret_to_user_from_irq)
ldr r2, [tsk, #TI_ADDR_LIMIT]
cmp r2, #TASK_SIZE
blne addr_limit_check_failed
ldr r1, [tsk, #TI_FLAGS]
tst r1, #_TIF_WORK_MASK
bne slow_work_pending

View file

@ -14,6 +14,7 @@
#include <linux/uaccess.h>
#include <linux/tracehook.h>
#include <linux/uprobes.h>
#include <linux/syscalls.h>
#include <asm/elf.h>
#include <asm/cacheflush.h>
@ -631,3 +632,9 @@ struct page *get_signal_page(void)
return page;
}
/* Defer to generic check */
asmlinkage void addr_limit_check_failed(void)
{
addr_limit_user_check();
}

View file

@ -252,6 +252,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node,
NULL);
if (!domain) {
iounmap(pmu_base_addr);
pmu_base_addr = NULL;
return -ENOMEM;
}

View file

@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void)
struct device_node *node;
node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl");
if (node) {
ctrl_base = of_iomap(node, 0);
id = HI3620_CTRL;
return 0;
if (!node) {
id = ERROR_CTRL;
return -ENOENT;
}
id = ERROR_CTRL;
return -ENOENT;
ctrl_base = of_iomap(node, 0);
of_node_put(node);
if (!ctrl_base) {
id = ERROR_CTRL;
return -ENOMEM;
}
id = HI3620_CTRL;
return 0;
}
void hi3xxx_set_cpu(int cpu, bool enable)
@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void)
struct device_node *np;
np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl");
if (np) {
ctrl_base = of_iomap(np, 0);
return true;
}
return false;
if (!np)
return false;
ctrl_base = of_iomap(np, 0);
of_node_put(np);
if (!ctrl_base)
return false;
return true;
}
void hix5hd2_set_cpu(int cpu, bool enable)
@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable)
if (!ctrl_base) {
np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl");
if (np)
ctrl_base = of_iomap(np, 0);
else
BUG();
BUG_ON(!np);
ctrl_base = of_iomap(np, 0);
of_node_put(np);
BUG_ON(!ctrl_base);
}
if (enable) {

View file

@ -170,7 +170,7 @@
led@6 {
label = "apq8016-sbc:blue:bt";
gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "bt";
linux,default-trigger = "bluetooth-power";
default-state = "off";
};
};

View file

@ -79,6 +79,7 @@ struct thread_info {
#define TIF_NEED_RESCHED 1
#define TIF_NOTIFY_RESUME 2 /* callback before returning to user */
#define TIF_FOREIGN_FPSTATE 3 /* CPU's FP state is not current's */
#define TIF_FSCHECK 4 /* Check FS is USER_DS on return */
#define TIF_NOHZ 7
#define TIF_SYSCALL_TRACE 8
#define TIF_SYSCALL_AUDIT 9
@ -101,10 +102,12 @@ struct thread_info {
#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
#define _TIF_SECCOMP (1 << TIF_SECCOMP)
#define _TIF_FSCHECK (1 << TIF_FSCHECK)
#define _TIF_32BIT (1 << TIF_32BIT)
#define _TIF_WORK_MASK (_TIF_NEED_RESCHED | _TIF_SIGPENDING | \
_TIF_NOTIFY_RESUME | _TIF_FOREIGN_FPSTATE)
_TIF_NOTIFY_RESUME | _TIF_FOREIGN_FPSTATE | \
_TIF_FSCHECK)
#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
_TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | \

View file

@ -73,6 +73,9 @@ static inline void set_fs(mm_segment_t fs)
{
current_thread_info()->addr_limit = fs;
/* On user-mode return, check fs is correct */
set_thread_flag(TIF_FSCHECK);
/*
* Prevent a mispredicted conditional call to set_fs from forwarding
* the wrong address limit to access_ok under speculation.

View file

@ -25,6 +25,7 @@
#include <linux/uaccess.h>
#include <linux/tracehook.h>
#include <linux/ratelimit.h>
#include <linux/syscalls.h>
#include <asm/debug-monitors.h>
#include <asm/elf.h>
@ -408,7 +409,11 @@ asmlinkage void do_notify_resume(struct pt_regs *regs,
* Update the trace code with the current status.
*/
trace_hardirqs_off();
do {
/* Check valid user FS if needed */
addr_limit_user_check();
if (thread_flags & _TIF_NEED_RESCHED) {
schedule();
} else {

View file

@ -40,6 +40,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN];
static void ath79_restart(char *command)
{
local_irq_disable();
ath79_device_reset_set(AR71XX_RESET_FULL_CHIP);
for (;;)
if (cpu_wait)

View file

@ -134,6 +134,7 @@ static inline u32 ath79_pll_rr(unsigned reg)
static inline void ath79_reset_wr(unsigned reg, u32 val)
{
__raw_writel(val, ath79_reset_base + reg);
(void) __raw_readl(ath79_reset_base + reg); /* flush */
}
static inline u32 ath79_reset_rr(unsigned reg)

View file

@ -1,4 +1,4 @@
platform-$(CONFIG_MACH_INGENIC) += jz4740/
cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740
load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000
zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000
zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000

View file

@ -14,12 +14,14 @@
#include <linux/init.h>
#include <linux/ioport.h>
#include <linux/irqchip/mips-gic.h>
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/timekeeper_internal.h>
#include <asm/abi.h>
#include <asm/page.h>
#include <asm/vdso.h>
/* Kernel-provided data used by the VDSO. */
@ -129,12 +131,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
vvar_size = gic_size + PAGE_SIZE;
size = vvar_size + image->size;
/*
* Find a region that's large enough for us to perform the
* colour-matching alignment below.
*/
if (cpu_has_dc_aliases)
size += shm_align_mask + 1;
base = get_unmapped_area(NULL, 0, size, 0, 0);
if (IS_ERR_VALUE(base)) {
ret = base;
goto out;
}
/*
* If we suffer from dcache aliasing, ensure that the VDSO data page
* mapping is coloured the same as the kernel's mapping of that memory.
* This ensures that when the kernel updates the VDSO data userland
* will observe it without requiring cache invalidations.
*/
if (cpu_has_dc_aliases) {
base = __ALIGN_MASK(base, shm_align_mask);
base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask;
}
data_addr = base + gic_size;
vdso_addr = data_addr + PAGE_SIZE;

View file

@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg)
break;
case PCI_OHCI_INT_REG:
_rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo);
if ((lo & 0x00000f00) == CS5536_USB_INTR)
if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR)
conf_data = 1;
break;
default:

View file

@ -369,7 +369,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len)
/* Closed or other error drop */
if (rc != OPAL_SUCCESS && rc != OPAL_BUSY &&
rc != OPAL_BUSY_EVENT) {
written = total_len;
written += total_len;
break;
}
if (rc == OPAL_SUCCESS) {

View file

@ -22,6 +22,7 @@
#include <linux/user-return-notifier.h>
#include <linux/nospec.h>
#include <linux/uprobes.h>
#include <linux/syscalls.h>
#include <asm/desc.h>
#include <asm/traps.h>
@ -180,6 +181,8 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
struct thread_info *ti = current_thread_info();
u32 cached_flags;
addr_limit_user_check();
if (IS_ENABLED(CONFIG_PROVE_LOCKING) && WARN_ON(!irqs_disabled()))
local_irq_disable();

View file

@ -101,6 +101,7 @@ struct thread_info {
#define TIF_SYSCALL_TRACEPOINT 28 /* syscall tracepoint instrumentation */
#define TIF_ADDR32 29 /* 32-bit address space on 64 bits */
#define TIF_X32 30 /* 32-bit native x86-64 binary */
#define TIF_FSCHECK 31 /* Check FS is USER_DS on return */
#define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
@ -124,6 +125,7 @@ struct thread_info {
#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
#define _TIF_ADDR32 (1 << TIF_ADDR32)
#define _TIF_X32 (1 << TIF_X32)
#define _TIF_FSCHECK (1 << TIF_FSCHECK)
/*
* work to do in syscall_trace_enter(). Also includes TIF_NOHZ for
@ -137,7 +139,7 @@ struct thread_info {
/* work to do on any return to user space */
#define _TIF_ALLWORK_MASK \
((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT | \
_TIF_NOHZ)
_TIF_NOHZ | _TIF_FSCHECK)
/* flags to check in __switch_to() */
#define _TIF_WORK_CTXSW \

View file

@ -8,6 +8,7 @@
#include <linux/kasan-checks.h>
#include <linux/thread_info.h>
#include <linux/string.h>
#include <linux/sched.h>
#include <asm/asm.h>
#include <asm/page.h>
#include <asm/smap.h>
@ -31,7 +32,12 @@
#define get_ds() (KERNEL_DS)
#define get_fs() (current->thread.addr_limit)
#define set_fs(x) (current->thread.addr_limit = (x))
static inline void set_fs(mm_segment_t fs)
{
current->thread.addr_limit = fs;
/* On user-mode return, check fs is correct */
set_thread_flag(TIF_FSCHECK);
}
#define segment_eq(a, b) ((a).seg == (b).seg)

View file

@ -216,7 +216,7 @@ struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, u32 mask)
type &= mask;
alg = crypto_alg_lookup(name, type, mask);
if (!alg) {
if (!alg && !(mask & CRYPTO_NOLOAD)) {
request_module("crypto-%s", name);
if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask &

Some files were not shown because too many files have changed in this diff Show more