Merge remote-tracking branch 'common/android-4.9-q' into lineage-18.1-caf-sdm845

# By Arnd Bergmann (4) and others
# Via Greg Kroah-Hartman
* common/android-4.9-q:
  Linux 4.9.289
  sctp: add vtag check in sctp_sf_violation
  sctp: use init_tag from inithdr for ABORT chunk
  net: nxp: lpc_eth.c: avoid hang when bringing interface down
  nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST
  net: batman-adv: fix error handling
  regmap: Fix possible double-free in regcache_rbtree_exit()
  net: lan78xx: fix division by zero in send path
  mmc: sdhci: Map more voltage level to SDHCI_POWER_330
  mmc: dw_mmc: exynos: fix the finding clock sample value
  mmc: vub300: fix control-message timeouts
  Revert "net: mdiobus: Fix memory leak in __mdiobus_register"
  nfc: port100: fix using -ERRNO as command type mask
  ata: sata_mv: Fix the error handling of mv_chip_id()
  usbnet: fix error return code in usbnet_probe()
  usbnet: sanity check for maxpacket
  ARM: 8819/1: Remove '-p' from LDFLAGS
  powerpc/bpf: Fix BPF_MOD when imm == 1
  ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype
  ARM: 9134/1: remove duplicate memcpy() definition
  ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned
  Linux 4.9.288
  ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
  tracing: Have all levels of checks prevent recursion
  net: mdiobus: Fix memory leak in __mdiobus_register
  ALSA: hda: avoid write to STATESTS if controller is in reset
  platform/x86: intel_scu_ipc: Update timeout value in comment
  isdn: mISDN: Fix sleeping function called from invalid context
  ARM: dts: spear3xx: Fix gmac node
  netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
  isdn: cpai: check ctr->cnr to avoid array index out of bound
  nfc: nci: fix the UAF of rf_conn_info object
  ASoC: DAPM: Fix missing kctl change notifications
  ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
  vfs: check fd has read access in kernel_read_file_from_fd()
  elfcore: correct reference to CONFIG_UML
  ocfs2: mount fails with buffer overflow in strlen
  ocfs2: fix data corruption after conversion from inline format
  can: peak_pci: peak_pci_remove(): fix UAF
  can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
  can: rcar_can: fix suspend/resume
  NIOS2: irqflags: rename a redefined register name
  netfilter: ipvs: make global sysctl readonly in non-init netns
  NFSD: Keep existing listeners on portlist error
  xtensa: xtfpga: Try software restart before simulating CPU reset
  xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
  r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
  drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
  drm/msm: Fix null pointer dereference on pointer edp
  pata_legacy: fix a couple uninitialized variable bugs
  NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
  NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
  nfc: fix error handling of nfc_proto_register()
  ethernet: s2io: fix setting mac address during resume
  net: encx24j600: check error in devm_regmap_init_encx24j600
  net: korina: select CRC32
  net: arc: select CRC32
  iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
  iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
  iio: light: opt3001: Fixed timeout error when 0 lux
  iio: adc128s052: Fix the error handling path of 'adc128_probe()'
  nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
  USB: serial: option: add Telit LE910Cx composition 0x1204
  USB: serial: qcserial: add EM9191 QDL support
  Input: xpad - add support for another USB ID of Nacon GC-100
  efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
  efi/cper: use stack buffer for error record decoding
  cb710: avoid NULL pointer subtraction
  xhci: Enable trust tx length quirk for Fresco FL11 USB controller
  s390: fix strrchr() implementation
  ALSA: seq: Fix a potential UAF by wrong private_free call order

 Conflicts:
	arch/arm/Makefile

Change-Id: Ic21337a30c203ea921852d84db2ecd1e1912c9f6

Makefile

@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 287
+SUBLEVEL = 289
 EXTRAVERSION =
 NAME = Roaring Lionus
 

arch/arm/Makefile

@@ -17,7 +17,7 @@ ifeq ($(CONFIG_BUILD_ARM64_DT_OVERLAY),y)
 export DTC_FLAGS := -@
 endif
 
-LDFLAGS_vmlinux	:=-p --no-undefined -X --pic-veneer
+LDFLAGS_vmlinux	:= --no-undefined -X --pic-veneer
 ifeq ($(CONFIG_CPU_ENDIAN_BE8),y)
 LDFLAGS_vmlinux	+= --be8
 LDFLAGS_MODULE	+= --be8

arch/arm/boot/bootp/Makefile

@@ -7,7 +7,7 @@
 
 GCOV_PROFILE	:= n
 
-LDFLAGS_bootp	:=-p --no-undefined -X \
+LDFLAGS_bootp	:= --no-undefined -X \
 		 --defsym initrd_phys=$(INITRD_PHYS) \
 		 --defsym params_phys=$(PARAMS_PHYS) -T
 AFLAGS_initrd.o :=-DINITRD=\"$(INITRD)\"

arch/arm/boot/compressed/Makefile

@@ -128,8 +128,6 @@ endif
 ifeq ($(CONFIG_CPU_ENDIAN_BE8),y)
 LDFLAGS_vmlinux += --be8
 endif
-# ?
-LDFLAGS_vmlinux += -p
 # Report unresolved symbol references
 LDFLAGS_vmlinux += --no-undefined
 # Delete all temporary local symbols

arch/arm/boot/compressed/decompress.c

@@ -46,7 +46,10 @@ extern char * strstr(const char * s1, const char *s2);
 #endif
 
 #ifdef CONFIG_KERNEL_XZ
+/* Prevent KASAN override of string helpers in decompressor */
+#undef memmove
 #define memmove memmove
+#undef memcpy
 #define memcpy memcpy
 #include "../../../../lib/decompress_unxz.c"
 #endif

arch/arm/boot/dts/spear3xx.dtsi

@@ -53,7 +53,7 @@
 		};
 
 		gmac: eth@e0800000 {
-			compatible = "st,spear600-gmac";
+			compatible = "snps,dwmac-3.40a";
 			reg = <0xe0800000 0x8000>;
 			interrupts = <23 22>;
 			interrupt-names = "macirq", "eth_wake_irq";

arch/arm/mm/proc-macros.S

@@ -345,6 +345,7 @@ ENTRY(\name\()_cache_fns)
 
 .macro define_tlb_functions name:req, flags_up:req, flags_smp
 	.type	\name\()_tlb_fns, #object
+	.align 2
 ENTRY(\name\()_tlb_fns)
 	.long	\name\()_flush_user_tlb_range
 	.long	\name\()_flush_kern_tlb_range

arch/arm/probes/kprobes/core.c

@@ -666,7 +666,7 @@ static struct undef_hook kprobes_arm_break_hook = {
 
 #endif /* !CONFIG_THUMB2_KERNEL */
 
-int __init arch_init_kprobes()
+int __init arch_init_kprobes(void)
 {
 	arm_probes_decode_init();
 #ifdef CONFIG_THUMB2_KERNEL

arch/nios2/include/asm/irqflags.h

@@ -22,7 +22,7 @@
 
 static inline unsigned long arch_local_save_flags(void)
 {
-	return RDCTL(CTL_STATUS);
+	return RDCTL(CTL_FSTATUS);
 }
 
 /*
@@ -31,7 +31,7 @@ static inline unsigned long arch_local_save_flags(void)
  */
 static inline void arch_local_irq_restore(unsigned long flags)
 {
-	WRCTL(CTL_STATUS, flags);
+	WRCTL(CTL_FSTATUS, flags);
 }
 
 static inline void arch_local_irq_disable(void)

arch/nios2/include/asm/registers.h

@@ -24,7 +24,7 @@
 #endif
 
 /* control register numbers */
-#define CTL_STATUS	0
+#define CTL_FSTATUS	0
 #define CTL_ESTATUS	1
 #define CTL_BSTATUS	2
 #define CTL_IENABLE	3

arch/nios2/platform/Kconfig.platform

@@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR
 
 config NIOS2_DTB_SOURCE_BOOL
 	bool "Compile and link device tree into kernel image"
+	depends on !COMPILE_TEST
 	default n
 	help
 	  This allows you to specify a dts (device tree source) file

arch/powerpc/net/bpf_jit_comp64.c

@@ -430,8 +430,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 		case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */
 			if (imm == 0)
 				return -EINVAL;
-			else if (imm == 1)
-				goto bpf_alu32_trunc;
+			if (imm == 1) {
+				if (BPF_OP(code) == BPF_DIV) {
+					goto bpf_alu32_trunc;
+				} else {
+					PPC_LI(dst_reg, 0);
+					break;
+				}
+			}
 
 			PPC_LI32(b2p[TMP_REG_1], imm);
 			switch (BPF_CLASS(code)) {

arch/s390/lib/string.c

@@ -225,14 +225,13 @@ EXPORT_SYMBOL(strcmp);
  */
 char * strrchr(const char * s, int c)
 {
-       size_t len = __strend(s) - s;
+	ssize_t len = __strend(s) - s;
 
-       if (len)
-	       do {
-		       if (s[len] == (char) c)
-			       return (char *) s + len;
-	       } while (--len > 0);
-       return NULL;
+	do {
+		if (s[len] == (char)c)
+			return (char *)s + len;
+	} while (--len >= 0);
+	return NULL;
 }
 EXPORT_SYMBOL(strrchr);
 

arch/xtensa/platforms/xtfpga/setup.c

@@ -54,8 +54,12 @@ void platform_power_off(void)
 
 void platform_restart(void)
 {
-	/* Flush and reset the mmu, simulate a processor reset, and
-	 * jump to the reset vector. */
+	/* Try software reset first. */
+	WRITE_ONCE(*(u32 *)XTFPGA_SWRST_VADDR, 0xdead);
+
+	/* If software reset did not work, flush and reset the mmu,
+	 * simulate a processor reset, and jump to the reset vector.
+	 */
 	cpu_reset();
 	/* control never gets here */
 }
@@ -85,7 +89,7 @@ void __init platform_calibrate_ccount(void)
 
 #endif
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_USE_OF
 
 static void __init xtfpga_clk_setup(struct device_node *np)
 {
@@ -303,4 +307,4 @@ static int __init xtavnet_init(void)
  */
 arch_initcall(xtavnet_init);
 
-#endif /* CONFIG_OF */
+#endif /* CONFIG_USE_OF */

drivers/ata/pata_legacy.c

@@ -328,7 +328,8 @@ static unsigned int pdc_data_xfer_vlb(struct ata_device *dev,
 			iowrite32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
 
 		if (unlikely(slop)) {
-			__le32 pad;
+			__le32 pad = 0;
+
 			if (rw == READ) {
 				pad = cpu_to_le32(ioread32(ap->ioaddr.data_addr));
 				memcpy(buf + buflen - slop, &pad, slop);
@@ -716,7 +717,8 @@ static unsigned int vlb32_data_xfer(struct ata_device *adev, unsigned char *buf,
 			ioread32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
 
 		if (unlikely(slop)) {
-			__le32 pad;
+			__le32 pad = 0;
+
 			if (rw == WRITE) {
 				memcpy(&pad, buf + buflen - slop, slop);
 				iowrite32(le32_to_cpu(pad), ap->ioaddr.data_addr);

drivers/ata/sata_mv.c

@@ -3907,8 +3907,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
 		break;
 
 	default:
-		dev_err(host->dev, "BUG: invalid board index %u\n", board_idx);
-		return 1;
+		dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx);
+		return -EINVAL;
 	}
 
 	hpriv->hp_flags = hp_flags;

drivers/base/regmap/regcache-rbtree.c

@@ -296,14 +296,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
 	if (!blk)
 		return -ENOMEM;
 
+	rbnode->block = blk;
+
 	if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
 		present = krealloc(rbnode->cache_present,
 				   BITS_TO_LONGS(blklen) * sizeof(*present),
 				   GFP_KERNEL);
-		if (!present) {
-			kfree(blk);
+		if (!present)
 			return -ENOMEM;
-		}
 
 		memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
 		       (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
@@ -320,7 +320,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
 	}
 
 	/* update the rbnode block, its size and the base register */
-	rbnode->block = blk;
 	rbnode->blklen = blklen;
 	rbnode->base_reg = base_reg;
 	rbnode->cache_present = present;

drivers/firmware/efi/cper.c

@@ -35,8 +35,6 @@
 
 #define INDENT_SP	" "
 
-static char rcd_decode_str[CPER_REC_LEN];
-
 /*
  * CPER record ID need to be unique even after reboot, because record
  * ID is used as index for ERST storage, while CPER records from
@@ -293,6 +291,7 @@ const char *cper_mem_err_unpack(struct trace_seq *p,
 				struct cper_mem_err_compact *cmem)
 {
 	const char *ret = trace_seq_buffer_ptr(p);
+	char rcd_decode_str[CPER_REC_LEN];
 
 	if (cper_mem_err_location(cmem, rcd_decode_str))
 		trace_seq_printf(p, "%s", rcd_decode_str);
@@ -307,6 +306,7 @@ static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
 	int len)
 {
 	struct cper_mem_err_compact cmem;
+	char rcd_decode_str[CPER_REC_LEN];
 
 	/* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
 	if (len == sizeof(struct cper_sec_mem_err_old) &&

drivers/firmware/efi/runtime-wrappers.c

@@ -259,7 +259,7 @@ static void virt_efi_reset_system(int reset_type,
 				  unsigned long data_size,
 				  efi_char16_t *data)
 {
-	if (down_interruptible(&efi_runtime_lock)) {
+	if (down_trylock(&efi_runtime_lock)) {
 		pr_warn("failed to invoke the reset_system() runtime service:\n"
 			"could not get exclusive access to the firmware\n");
 		return;

drivers/gpu/drm/msm/dsi/dsi_host.c

@@ -439,7 +439,7 @@ static int dsi_bus_clk_enable(struct msm_dsi_host *msm_host)
 
 	return 0;
 err:
-	for (; i > 0; i--)
+	while (--i >= 0)
 		clk_disable_unprepare(msm_host->bus_clks[i]);
 
 	return ret;