* common/android-4.9-q:
ANDROID: android-verity: Prevent double-freeing metadata
Linux 4.9.317
bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
NFSD: Fix possible sleep during nfsd4_release_lockowner()
tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
dm verity: set DM_TARGET_IMMUTABLE feature flag
dm stats: add cond_resched when looping over entries
dm crypt: make printing of the key constant-time
exec: Force single empty string when argv is empty
block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
assoc_array: Fix BUG_ON during garbage collect
drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers
net: af_key: check encryption module availability consistency
Linux 4.9.316
net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe()
ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one()
mac80211: fix rx reordering with non explicit / psmp ack policy
scsi: qla2xxx: Fix missed DMA unmap for aborted commands
perf bench numa: Address compiler error on s390
igb: skip phy status check where unavailable
ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
ARM: 9196/1: spectre-bhb: enable for Cortex-A15
net: af_key: add check for pfkey_broadcast in function pfkey_process
NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
net/qla3xxx: Fix a test in ql_reset_work()
net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
perf: Fix sys_perf_event_open() race against self
ALSA: wavefront: Proper check of get_user() error
mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD
mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
drbd: remove usage of list iterator variable after loop
MIPS: lantiq: check the return value of kzalloc()
Input: add bounds checking to input_set_capability()
um: Cleanup syscall_handler_t definition/cast, fix warning
floppy: use a statically allocated error counter
Linux 4.9.315
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
ping: fix address binding wrt vrf
USB: serial: option: add Fibocom MA510 modem
USB: serial: option: add Fibocom L610 modem
USB: serial: qcserial: add support for Sierra Wireless EM7590
USB: serial: pl2303: add device id for HP LM930 Display
usb: cdc-wdm: fix reading stuck on device close
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
ASoC: max98090: Generate notifications on changes for custom control
ASoC: max98090: Reject invalid values in custom control put()
hwmon: (f71882fg) Fix negative temperature
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
s390/lcs: fix variable dereferenced before check
s390/ctcm: fix potential memory leak
s390/ctcm: fix variable dereferenced before check
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
netlink: do not reset transport header in netlink_recvmsg()
ipv4: drop dst in multicast routing path
net: Fix features skip in for_each_netdev_feature()
Linux 4.9.314
mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()
mmc: rtsx: add 74 Clocks in power on flow
Bluetooth: Fix the creation of hdev->name
can: grcan: only use the NAPI poll budget for RX
can: grcan: grcan_probe(): fix broken system id check for errata workaround needs
block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
MIPS: Use address-of operator on section symbols
Linux 4.9.313
dm: interlock pending dm_io and dm_wait_for_bios_completion
dm: fix mempool NULL pointer race when completing IO
net: ipv6: ensure we call ipv6_mc_down() at most once
net: sched: prevent UAF on tc_ctl_tfilter when temporarily dropping rtnl_lock
kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
btrfs: always log symlinks in full mode
smsc911x: allow using IRQ0
net: emaclite: Add error handling for of_address_to_resource()
ASoC: dmaengine: Restore NULL prepare_slave_config() callback
hwmon: (adt7470) Fix warning on module removal
NFC: netlink: fix sleep in atomic bug when firmware download timeout
nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
nfc: replace improper check device_is_registered() in netlink related functions
can: grcan: use ofdev->dev when allocating DMA memory
can: grcan: grcan_close(): fix deadlock
ASoC: wm8958: Fix change notifications for DSP controls
firewire: core: extend card->lock in fw_core_handle_bus_reset
firewire: remove check of list iterator against head past the loop body
firewire: fix potential uaf in outbound_phy_packet_callback()
Revert "SUNRPC: attempt AF_LOCAL connect on setup"
ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
parisc: Merge model and model name into one line in /proc/cpuinfo
MIPS: Fix CP0 counter erratum detection for R4k CPUs
tty: n_gsm: fix incorrect UA handling
tty: n_gsm: fix wrong command frame length field encoding
tty: n_gsm: fix wrong command retry handling
tty: n_gsm: fix missing explicit ldisc flush
tty: n_gsm: fix insufficient txframe size
tty: n_gsm: fix malformed counter for out of frame data
tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
x86/cpu: Load microcode during restore_processor_state()
drivers: net: hippi: Fix deadlock in rr_close()
ASoC: wm8731: Disable the regulator when probing fails
bnx2x: fix napi API usage sequence
clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource()
bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
ip_gre: Make o_seqno start from 0 in native mode
pinctrl: pistachio: fix use of irq_of_parse_and_map()
mtd: rawnand: Fix return value check of wait_for_completion_timeout
ARM: dts: Fix mmc order for omap3-gta04
ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
phy: samsung: exynos5250-sata: fix missing device put in probe error paths
phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
hex2bin: fix access beyond string end
hex2bin: make the function hex_to_bin constant-time
serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
serial: 8250: Also set sticky MCR bits in console restoration
usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
usb: gadget: uvc: Fix crash when encoding data for usb request
usb: misc: fix improper handling of refcount in uss720_probe()
iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
iio: dac: ad5446: Fix read_raw not returning set value
iio: dac: ad5592r: Fix the missing return value.
xhci: stop polling roothubs after shutdown
USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
USB: quirks: add STRING quirk for VCOM device
USB: quirks: add a Realtek card reader
lightnvm: disable the subsystem
Revert "net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link"
floppy: disable FDRAWCMD by default
Linux 4.9.312
block/compat_ioctl: fix range check in BLKGETSIZE
ext4: force overhead calculation if the s_overhead_cluster makes no sense
ext4: fix overhead calculation to account for the reserved gdt blocks
ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
ARC: entry: fix syscall_trace_exit argument
e1000e: Fix possible overflow in LTR decoding
ASoC: soc-dapm: fix two incorrect uses of list iterator
openvswitch: fix OOB access in reserve_sfa_size()
dma: at_xdmac: fix a missing check on list iterator
ata: pata_marvell: Check the 'bmdma_addr' beforing reading
drm/msm/mdp5: check the return of kzalloc()
brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
cifs: Check the IOCB_DIRECT flag, not O_DIRECT
vxlan: fix error return code in vxlan_fdb_append
ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant
platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
ARM: vexpress/spc: Avoid negative array index when !SMP
netlink: reset network and mac headers in netlink_dump()
net/packet: fix packet_sock xmit return value checking
dmaengine: imx-sdma: Fix error checking in sdma_event_remap
ALSA: usb-audio: Clear MIDI port active flag after draining
gfs2: assign rgrp glock before compute_bitstructs
mm: page_alloc: fix building error on -Werror=array-compare
etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
Linux 4.9.311
gcc-plugins: latent_entropy: use /dev/urandom
i2c: pasemi: Wait for write xfers to finish
smp: Fix offline cpu check in flush_smp_call_function_queue()
ARM: davinci: da850-evm: Avoid NULL pointer dereference
ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
mm, page_alloc: fix build_zonerefs_node()
drivers: net: slip: fix NPD bug in sl_tx_timeout()
scsi: mvsas: Add PCI ID of RocketRaid 2640
gpu: ipu-v3: Fix dev_dbg frequency output
net: micrel: fix KS8851_MLL Kconfig
scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
drm/amdkfd: Check for potential null return of kmalloc_array()
cifs: potential buffer overflow in handling symlinks
nfc: nci: add flush_workqueue to prevent uaf
net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link
veth: Ensure eth header is in skb's linear part
xfrm: policy: match with both mark and mask on user interfaces
arm64: module: remove (NOLOAD) from linker script
mm: don't skip swap entry even if zap_details specified
dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
arm64: patch_text: Fixup last cpu should be master
x86/speculation: Restore speculation related MSRs during S3 resume
x86/pm: Save the MSR validity status at context setup
mm/mempolicy: fix mpol_new leak in shared_policy_replace
mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
drbd: Fix five use after free bugs in get_initial_state
drm/imx: Fix memory leak in imx_pd_connector_get_modes
net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
mm: fix race between MADV_FREE reclaim and blkdev direct IO read
jfs: prevent NULL deref in diFree
virtio_console: eliminate anonymous module_init & module_exit
serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
SUNRPC/call_alloc: async tasks mustn't block waiting for memory
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
init/main.c: return 1 from handled __setup() functions
Bluetooth: Fix use after free in hci_send_acl
xtensa: fix DTC warning unit_address_format
usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
scsi: libfc: Fix use after free in fc_exch_abts_resp()
MIPS: fix fortify panic when copying asm exception handlers
bnxt_en: Eliminate unintended link toggle during FW reset
scsi: aha152x: Fix aha152x_setup() __setup handler return value
scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
dm ioctl: prevent potential spectre v1 gadget
iommu/arm-smmu-v3: fix event handling soft lockup
scsi: bfa: Replace snprintf() with sysfs_emit()
scsi: mvsas: Replace snprintf() with sysfs_emit()
powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
ptp: replace snprintf with sysfs_emit
ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
ARM: 9187/1: JIVE: fix return value of __setup handler
rtc: wm8350: Handle error for wm8350_register_irq
KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
openvswitch: Fixed nd target mask field in the flow dump.
ARM: dts: spear13xx: Update SPI dma properties
ARM: dts: spear1340: Update serial node properties
ASoC: topology: Allow TLV control to be either read or write
ubi: fastmap: Return error code if memory allocation fails in add_aeb()
mm/memcontrol: return 1 from cgroup.memory __setup() handler
mm/mmap: return 1 from stack_guard_gap __setup() handler
ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
pinctrl: pinconf-generic: Print arguments for bias-pull-*
gfs2: Make sure FITRIM minlen is rounded up to fs block size
ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
KVM: Prevent module exit until all VMs are freed
scsi: qla2xxx: Fix incorrect reporting of task management failure
mmc: host: Return an error when ->enable_sdio_irq() ops is missing
media: hdpvr: initialize dev->worker at hdpvr_register_videodev
video: fbdev: sm712fb: Fix crash in smtcfb_write()
ARM: mmp: Fix failure to remove sram device
ARM: tegra: tamonten: Fix I2C3 pad setting
media: cx88-mpeg: clear interrupt status register before streaming video
ASoC: soc-core: skip zero num_dai component in searching dai name
video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()
video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
ARM: dts: bcm2837: Add the missing L1/L2 cache information
ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
video: fbdev: cirrusfb: check pixclock to avoid divide by zero
video: fbdev: w100fb: Reset global state
video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
ntfs: add sanity check on allocation size
ext4: don't BUG if someone dirty pages without asking ext4 first
spi: tegra20: Use of_device_get_match_data()
PM: core: keep irq flags in device_pm_check_callbacks()
ACPI/APEI: Limit printable size of BERT table data
ACPICA: Avoid walking the ACPI Namespace if it is not there
irqchip/nvic: Release nvic_base upon failure
Fix incorrect type in assignment of ipv6 port for audit
loop: use sysfs_emit() in the sysfs xxx show()
selinux: use correct type for context length
net/x25: Fix null-ptr-deref caused by x25_disconnect
qlcnic: dcb: default to returning -EOPNOTSUPP
net: phy: broadcom: Fix brcm_fet_config_init()
netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
jfs: fix divide error in dbNextAG
kgdbts: fix return value of __setup handler
kgdboc: fix return value of __setup handler
tty: hvc: fix return value of __setup handler
pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
NFS: remove unneeded check in decode_devicenotify_args()
clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver
clk: clps711x: Terminate clk_div_table with sentinel element
clk: loongson1: Terminate clk_div_table with sentinel element
remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
clk: qcom: clk-rcg2: Update the frac table for pixel clock
iio: adc: Add check for devm_request_threaded_irq
pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
mxser: fix xmit_buf leak in activate when LSR == 0xff
mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
i2c: mux: demux-pinctrl: do not deactivate a master that is not active
af_netlink: Fix shift out of bounds in group mask calculation
USB: storage: ums-realtek: fix error code in rts51x_read_mem()
MIPS: RB532: fix return value of __setup handler
mfd: mc13xxx: Add check for mc13xxx_irq_request
powerpc/sysdev: fix incorrect use to determine if list is empty
power: supply: wm8350-power: Add missing free in free_charger_irq
power: supply: wm8350-power: Handle error for wm8350_register_irq
i2c: xiic: Make bus names unique
KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor()
KVM: x86: Fix emulation in writing cr8
drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
ext2: correct max file size computing
TOMOYO: fix __setup handlers return values
scsi: pm8001: Fix abort all task initialization
scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
iwlwifi: Fix -EIO error code that is never returned
HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
ray_cs: Check ioremap return value
ath9k_htc: fix uninit value bugs
drm/edid: Don't clear formats if using deep color
mtd: onenand: Check for error irq
ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
ASoC: fsi: Add check for clk_enable
ASoC: wm8350: Handle error for wm8350_register_irq
ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
memory: emif: check the pointer temp in get_device_details()
memory: emif: Add check for setup_interrupts
ASoC: atmel_ssc_dai: Handle errors for clk_enable
ASoC: mxs-saif: Handle errors for clk_enable
printk: fix return value of printk.devkmsg __setup handler
arm64: dts: broadcom: Fix sata nodename
arm64: dts: ns2: Fix spi-cpol and spi-cpha property
ALSA: spi: Add check for clk_enable()
ASoC: ti: davinci-i2s: Add check for clk_enable()
media: usb: go7007: s2250-board: fix leak in probe()
soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
ARM: dts: qcom: ipq4019: fix sleep clock
video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
perf/x86/intel/pt: Fix address filter config for 32-bit kernel
perf/core: Fix address filter parser for multiple filters
sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
clocksource: acpi_pm: fix return value of __setup handler
hwmon: (pmbus) Add Vin unit off handling
crypto: ccp - ccp_dmaengine_unregister release dma channels
crypto: vmx - add missing dependencies
PM: suspend: fix return value of __setup handler
PM: hibernate: fix __setup handler error handling
hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
hwmon: (pmbus) Add mutex to regulator ops
selftests/x86: Add validity check and allow field splitting
spi: tegra114: Add missing IRQ check in tegra_spi_probe
crypto: mxs-dcp - Fix scatterlist processing
crypto: authenc - Fix sleep in atomic context in decrypt_tail
PCI: pciehp: Clear cmd_busy bit in polling mode
brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
brcmfmac: firmware: Allocate space for default boardrev in nvram
media: davinci: vpif: fix unbalanced runtime PM get
DEC: Limit PMAX memory probing to R3k systems
lib/raid6/test: fix multiple definition linking error
thermal: int340x: Increase bitmap size
carl9170: fix missing bit-wise or operator for tx_params
ARM: dts: exynos: add missing HDMI supplies on SMDK5420
ARM: dts: exynos: add missing HDMI supplies on SMDK5250
ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
video: fbdev: sm712fb: Fix crash in smtcfb_read()
drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
ALSA: cs4236: fix an incorrect NULL check on list iterator
Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
mempolicy: mbind_range() set_policy() after vma_merge()
mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
jffs2: fix memory leak in jffs2_scan_medium
jffs2: fix memory leak in jffs2_do_mount_fs
jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
NFSD: prevent underflow in nfssvc_decode_writeargs()
SUNRPC: avoid race between mod_timer() and del_timer_sync()
ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
clk: uniphier: Fix fixed-rate initialization
iio: inkern: make a best effort on offset calculation
iio: inkern: apply consumer scale on IIO_VAL_INT cases
coresight: Fix TRCCONFIGR.QE sysfs interface
USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
virtio-blk: Use blk_validate_block_size() to validate block size
block: Add a helper to validate the block size
af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
ethernet: sun: Free the coherent when failing in probing
virtio_console: break out of buf poll on remove
netdevice: add the case if dev is NULL
USB: serial: simple: add Nokia phone driver
USB: serial: pl2303: add IBM device IDs
Linux 4.9.310
arm64: Use the clearbhb instruction in mitigations
arm64: add ID_AA64ISAR2_EL1 sys register
KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
arm64: Mitigate spectre style branch history side channels
KVM: arm64: Add templates for BHB mitigation sequences
arm64: Add percpu vectors for EL1
arm64: entry: Add macro for reading symbol addresses from the trampoline
arm64: entry: Add vectors that have the bhb mitigation sequences
arm64: Move arm64_update_smccc_conduit() out of SSBD ifdef
arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
arm64: entry: Allow the trampoline text to occupy multiple pages
arm64: entry: Make the kpti trampoline's kpti sequence optional
arm64: entry: Move trampoline macros out of ifdef'd section
arm64: entry: Don't assume tramp_vectors is the start of the vectors
arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
arm64: entry: Move the trampoline data page before the text page
arm64: entry: Free up another register on kpti's tramp_exit path
arm64: entry: Make the trampoline cleanup optional
arm64: entry.S: Add ventry overflow sanity checks
arm64: Add helper to decode register from instruction
arm64: Add Cortex-X2 CPU part definition
arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
arm64: Add part number for Arm Cortex-A77
arm64: Add part number for Neoverse N1
arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT
arm64: Add silicon-errata.txt entry for ARM erratum 1188873
arm64: arch_timer: avoid unused function warning
arm64: arch_timer: Add workaround for ARM erratum 1188873
arm64: arch_timer: Add erratum handler for CPU-specific capability
arm64: arch_timer: Add infrastructure for multiple erratum detection methods
clocksource/drivers/arm_arch_timer: Introduce generic errata handling infrastructure
clocksource/drivers/arm_arch_timer: Remove fsl-a008585 parameter
arm64: capabilities: Add support for checks based on a list of MIDRs
arm64: Add helpers for checking CPU MIDR against a range
arm64: capabilities: Clean up midr range helpers
arm64: capabilities: Add flags to handle the conflicts on late CPU
arm64: capabilities: Prepare for fine grained capabilities
arm64: capabilities: Move errata processing code
arm64: capabilities: Move errata work around check on boot CPU
arm64: capabilities: Update prototype for enable call back
arm64: Add MIDR encoding for Arm Cortex-A55 and Cortex-A35
arm64: Remove useless UAO IPI and describe how this gets enabled
arm64: errata: Provide macro for major and minor cpu revisions
Conflicts:
arch/arm64/include/asm/assembler.h
arch/arm64/include/asm/cputype.h
arch/arm64/kernel/bpi.S
arch/arm64/kernel/cpu_errata.c
drivers/clk/qcom/clk-rcg2.c
drivers/gpu/drm/drm_edid.c
drivers/mmc/core/core.c
drivers/mmc/core/host.c
mm/memory.c
Change-Id: Ibea04b7ed72b8d1fd7c575cbc23dd0e73d321e6c
422 lines
11 KiB
C
422 lines
11 KiB
C
#include <linux/blkdev.h>
|
|
#include <linux/blkpg.h>
|
|
#include <linux/blktrace_api.h>
|
|
#include <linux/cdrom.h>
|
|
#include <linux/compat.h>
|
|
#include <linux/elevator.h>
|
|
#include <linux/hdreg.h>
|
|
#include <linux/pr.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/syscalls.h>
|
|
#include <linux/types.h>
|
|
#include <linux/uaccess.h>
|
|
|
|
static int compat_put_ushort(unsigned long arg, unsigned short val)
|
|
{
|
|
return put_user(val, (unsigned short __user *)compat_ptr(arg));
|
|
}
|
|
|
|
static int compat_put_int(unsigned long arg, int val)
|
|
{
|
|
return put_user(val, (compat_int_t __user *)compat_ptr(arg));
|
|
}
|
|
|
|
static int compat_put_uint(unsigned long arg, unsigned int val)
|
|
{
|
|
return put_user(val, (compat_uint_t __user *)compat_ptr(arg));
|
|
}
|
|
|
|
static int compat_put_long(unsigned long arg, long val)
|
|
{
|
|
return put_user(val, (compat_long_t __user *)compat_ptr(arg));
|
|
}
|
|
|
|
static int compat_put_ulong(unsigned long arg, compat_ulong_t val)
|
|
{
|
|
return put_user(val, (compat_ulong_t __user *)compat_ptr(arg));
|
|
}
|
|
|
|
static int compat_put_u64(unsigned long arg, u64 val)
|
|
{
|
|
return put_user(val, (compat_u64 __user *)compat_ptr(arg));
|
|
}
|
|
|
|
struct compat_hd_geometry {
|
|
unsigned char heads;
|
|
unsigned char sectors;
|
|
unsigned short cylinders;
|
|
u32 start;
|
|
};
|
|
|
|
static int compat_hdio_getgeo(struct gendisk *disk, struct block_device *bdev,
|
|
struct compat_hd_geometry __user *ugeo)
|
|
{
|
|
struct hd_geometry geo;
|
|
int ret;
|
|
|
|
if (!ugeo)
|
|
return -EINVAL;
|
|
if (!disk->fops->getgeo)
|
|
return -ENOTTY;
|
|
|
|
memset(&geo, 0, sizeof(geo));
|
|
/*
|
|
* We need to set the startsect first, the driver may
|
|
* want to override it.
|
|
*/
|
|
geo.start = get_start_sect(bdev);
|
|
ret = disk->fops->getgeo(bdev, &geo);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = copy_to_user(ugeo, &geo, 4);
|
|
ret |= put_user(geo.start, &ugeo->start);
|
|
if (ret)
|
|
ret = -EFAULT;
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int compat_hdio_ioctl(struct block_device *bdev, fmode_t mode,
|
|
unsigned int cmd, unsigned long arg)
|
|
{
|
|
mm_segment_t old_fs = get_fs();
|
|
unsigned long kval;
|
|
unsigned int __user *uvp;
|
|
int error;
|
|
|
|
set_fs(KERNEL_DS);
|
|
error = __blkdev_driver_ioctl(bdev, mode,
|
|
cmd, (unsigned long)(&kval));
|
|
set_fs(old_fs);
|
|
|
|
if (error == 0) {
|
|
uvp = compat_ptr(arg);
|
|
if (put_user(kval, uvp))
|
|
error = -EFAULT;
|
|
}
|
|
return error;
|
|
}
|
|
|
|
struct compat_cdrom_read_audio {
|
|
union cdrom_addr addr;
|
|
u8 addr_format;
|
|
compat_int_t nframes;
|
|
compat_caddr_t buf;
|
|
};
|
|
|
|
struct compat_cdrom_generic_command {
|
|
unsigned char cmd[CDROM_PACKET_SIZE];
|
|
compat_caddr_t buffer;
|
|
compat_uint_t buflen;
|
|
compat_int_t stat;
|
|
compat_caddr_t sense;
|
|
unsigned char data_direction;
|
|
compat_int_t quiet;
|
|
compat_int_t timeout;
|
|
compat_caddr_t reserved[1];
|
|
};
|
|
|
|
static int compat_cdrom_read_audio(struct block_device *bdev, fmode_t mode,
|
|
unsigned int cmd, unsigned long arg)
|
|
{
|
|
struct cdrom_read_audio __user *cdread_audio;
|
|
struct compat_cdrom_read_audio __user *cdread_audio32;
|
|
__u32 data;
|
|
void __user *datap;
|
|
|
|
cdread_audio = compat_alloc_user_space(sizeof(*cdread_audio));
|
|
cdread_audio32 = compat_ptr(arg);
|
|
|
|
if (copy_in_user(&cdread_audio->addr,
|
|
&cdread_audio32->addr,
|
|
(sizeof(*cdread_audio32) -
|
|
sizeof(compat_caddr_t))))
|
|
return -EFAULT;
|
|
|
|
if (get_user(data, &cdread_audio32->buf))
|
|
return -EFAULT;
|
|
datap = compat_ptr(data);
|
|
if (put_user(datap, &cdread_audio->buf))
|
|
return -EFAULT;
|
|
|
|
return __blkdev_driver_ioctl(bdev, mode, cmd,
|
|
(unsigned long)cdread_audio);
|
|
}
|
|
|
|
static int compat_cdrom_generic_command(struct block_device *bdev, fmode_t mode,
|
|
unsigned int cmd, unsigned long arg)
|
|
{
|
|
struct cdrom_generic_command __user *cgc;
|
|
struct compat_cdrom_generic_command __user *cgc32;
|
|
u32 data;
|
|
unsigned char dir;
|
|
int itmp;
|
|
|
|
cgc = compat_alloc_user_space(sizeof(*cgc));
|
|
cgc32 = compat_ptr(arg);
|
|
|
|
if (copy_in_user(&cgc->cmd, &cgc32->cmd, sizeof(cgc->cmd)) ||
|
|
get_user(data, &cgc32->buffer) ||
|
|
put_user(compat_ptr(data), &cgc->buffer) ||
|
|
copy_in_user(&cgc->buflen, &cgc32->buflen,
|
|
(sizeof(unsigned int) + sizeof(int))) ||
|
|
get_user(data, &cgc32->sense) ||
|
|
put_user(compat_ptr(data), &cgc->sense) ||
|
|
get_user(dir, &cgc32->data_direction) ||
|
|
put_user(dir, &cgc->data_direction) ||
|
|
get_user(itmp, &cgc32->quiet) ||
|
|
put_user(itmp, &cgc->quiet) ||
|
|
get_user(itmp, &cgc32->timeout) ||
|
|
put_user(itmp, &cgc->timeout) ||
|
|
get_user(data, &cgc32->reserved[0]) ||
|
|
put_user(compat_ptr(data), &cgc->reserved[0]))
|
|
return -EFAULT;
|
|
|
|
return __blkdev_driver_ioctl(bdev, mode, cmd, (unsigned long)cgc);
|
|
}
|
|
|
|
struct compat_blkpg_ioctl_arg {
|
|
compat_int_t op;
|
|
compat_int_t flags;
|
|
compat_int_t datalen;
|
|
compat_caddr_t data;
|
|
};
|
|
|
|
static int compat_blkpg_ioctl(struct block_device *bdev, fmode_t mode,
|
|
unsigned int cmd, struct compat_blkpg_ioctl_arg __user *ua32)
|
|
{
|
|
struct blkpg_ioctl_arg __user *a = compat_alloc_user_space(sizeof(*a));
|
|
compat_caddr_t udata;
|
|
compat_int_t n;
|
|
int err;
|
|
|
|
err = get_user(n, &ua32->op);
|
|
err |= put_user(n, &a->op);
|
|
err |= get_user(n, &ua32->flags);
|
|
err |= put_user(n, &a->flags);
|
|
err |= get_user(n, &ua32->datalen);
|
|
err |= put_user(n, &a->datalen);
|
|
err |= get_user(udata, &ua32->data);
|
|
err |= put_user(compat_ptr(udata), &a->data);
|
|
if (err)
|
|
return err;
|
|
|
|
return blkdev_ioctl(bdev, mode, cmd, (unsigned long)a);
|
|
}
|
|
|
|
#define BLKBSZGET_32 _IOR(0x12, 112, int)
|
|
#define BLKBSZSET_32 _IOW(0x12, 113, int)
|
|
#define BLKGETSIZE64_32 _IOR(0x12, 114, int)
|
|
|
|
static int compat_blkdev_driver_ioctl(struct block_device *bdev, fmode_t mode,
|
|
unsigned cmd, unsigned long arg)
|
|
{
|
|
switch (cmd) {
|
|
case HDIO_GET_UNMASKINTR:
|
|
case HDIO_GET_MULTCOUNT:
|
|
case HDIO_GET_KEEPSETTINGS:
|
|
case HDIO_GET_32BIT:
|
|
case HDIO_GET_NOWERR:
|
|
case HDIO_GET_DMA:
|
|
case HDIO_GET_NICE:
|
|
case HDIO_GET_WCACHE:
|
|
case HDIO_GET_ACOUSTIC:
|
|
case HDIO_GET_ADDRESS:
|
|
case HDIO_GET_BUSSTATE:
|
|
return compat_hdio_ioctl(bdev, mode, cmd, arg);
|
|
case CDROMREADAUDIO:
|
|
return compat_cdrom_read_audio(bdev, mode, cmd, arg);
|
|
case CDROM_SEND_PACKET:
|
|
return compat_cdrom_generic_command(bdev, mode, cmd, arg);
|
|
|
|
/*
|
|
* No handler required for the ones below, we just need to
|
|
* convert arg to a 64 bit pointer.
|
|
*/
|
|
case BLKSECTSET:
|
|
/*
|
|
* 0x03 -- HD/IDE ioctl's used by hdparm and friends.
|
|
* Some need translations, these do not.
|
|
*/
|
|
case HDIO_GET_IDENTITY:
|
|
case HDIO_DRIVE_TASK:
|
|
case HDIO_DRIVE_CMD:
|
|
/* 0x330 is reserved -- it used to be HDIO_GETGEO_BIG */
|
|
case 0x330:
|
|
/* CDROM stuff */
|
|
case CDROMPAUSE:
|
|
case CDROMRESUME:
|
|
case CDROMPLAYMSF:
|
|
case CDROMPLAYTRKIND:
|
|
case CDROMREADTOCHDR:
|
|
case CDROMREADTOCENTRY:
|
|
case CDROMSTOP:
|
|
case CDROMSTART:
|
|
case CDROMEJECT:
|
|
case CDROMVOLCTRL:
|
|
case CDROMSUBCHNL:
|
|
case CDROMMULTISESSION:
|
|
case CDROM_GET_MCN:
|
|
case CDROMRESET:
|
|
case CDROMVOLREAD:
|
|
case CDROMSEEK:
|
|
case CDROMPLAYBLK:
|
|
case CDROMCLOSETRAY:
|
|
case CDROM_DISC_STATUS:
|
|
case CDROM_CHANGER_NSLOTS:
|
|
case CDROM_GET_CAPABILITY:
|
|
/* Ignore cdrom.h about these next 5 ioctls, they absolutely do
|
|
* not take a struct cdrom_read, instead they take a struct cdrom_msf
|
|
* which is compatible.
|
|
*/
|
|
case CDROMREADMODE2:
|
|
case CDROMREADMODE1:
|
|
case CDROMREADRAW:
|
|
case CDROMREADCOOKED:
|
|
case CDROMREADALL:
|
|
/* DVD ioctls */
|
|
case DVD_READ_STRUCT:
|
|
case DVD_WRITE_STRUCT:
|
|
case DVD_AUTH:
|
|
arg = (unsigned long)compat_ptr(arg);
|
|
/* These intepret arg as an unsigned long, not as a pointer,
|
|
* so we must not do compat_ptr() conversion. */
|
|
case HDIO_SET_MULTCOUNT:
|
|
case HDIO_SET_UNMASKINTR:
|
|
case HDIO_SET_KEEPSETTINGS:
|
|
case HDIO_SET_32BIT:
|
|
case HDIO_SET_NOWERR:
|
|
case HDIO_SET_DMA:
|
|
case HDIO_SET_PIO_MODE:
|
|
case HDIO_SET_NICE:
|
|
case HDIO_SET_WCACHE:
|
|
case HDIO_SET_ACOUSTIC:
|
|
case HDIO_SET_BUSSTATE:
|
|
case HDIO_SET_ADDRESS:
|
|
case CDROMEJECT_SW:
|
|
case CDROM_SET_OPTIONS:
|
|
case CDROM_CLEAR_OPTIONS:
|
|
case CDROM_SELECT_SPEED:
|
|
case CDROM_SELECT_DISC:
|
|
case CDROM_MEDIA_CHANGED:
|
|
case CDROM_DRIVE_STATUS:
|
|
case CDROM_LOCKDOOR:
|
|
case CDROM_DEBUG:
|
|
break;
|
|
default:
|
|
/* unknown ioctl number */
|
|
return -ENOIOCTLCMD;
|
|
}
|
|
|
|
return __blkdev_driver_ioctl(bdev, mode, cmd, arg);
|
|
}
|
|
|
|
/* Most of the generic ioctls are handled in the normal fallback path.
|
|
This assumes the blkdev's low level compat_ioctl always returns
|
|
ENOIOCTLCMD for unknown ioctls. */
|
|
long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
|
|
{
|
|
int ret = -ENOIOCTLCMD;
|
|
struct inode *inode = file->f_mapping->host;
|
|
struct block_device *bdev = inode->i_bdev;
|
|
struct gendisk *disk = bdev->bd_disk;
|
|
fmode_t mode = file->f_mode;
|
|
loff_t size;
|
|
unsigned int max_sectors;
|
|
|
|
/*
|
|
* O_NDELAY can be altered using fcntl(.., F_SETFL, ..), so we have
|
|
* to updated it before every ioctl.
|
|
*/
|
|
if (file->f_flags & O_NDELAY)
|
|
mode |= FMODE_NDELAY;
|
|
else
|
|
mode &= ~FMODE_NDELAY;
|
|
|
|
switch (cmd) {
|
|
case HDIO_GETGEO:
|
|
return compat_hdio_getgeo(disk, bdev, compat_ptr(arg));
|
|
case BLKPBSZGET:
|
|
return compat_put_uint(arg, bdev_physical_block_size(bdev));
|
|
case BLKIOMIN:
|
|
return compat_put_uint(arg, bdev_io_min(bdev));
|
|
case BLKIOOPT:
|
|
return compat_put_uint(arg, bdev_io_opt(bdev));
|
|
case BLKALIGNOFF:
|
|
return compat_put_int(arg, bdev_alignment_offset(bdev));
|
|
case BLKDISCARDZEROES:
|
|
return compat_put_uint(arg, bdev_discard_zeroes_data(bdev));
|
|
case BLKFLSBUF:
|
|
case BLKROSET:
|
|
case BLKDISCARD:
|
|
case BLKSECDISCARD:
|
|
case BLKZEROOUT:
|
|
/*
|
|
* the ones below are implemented in blkdev_locked_ioctl,
|
|
* but we call blkdev_ioctl, which gets the lock for us
|
|
*/
|
|
case BLKRRPART:
|
|
return blkdev_ioctl(bdev, mode, cmd,
|
|
(unsigned long)compat_ptr(arg));
|
|
case BLKBSZSET_32:
|
|
return blkdev_ioctl(bdev, mode, BLKBSZSET,
|
|
(unsigned long)compat_ptr(arg));
|
|
case BLKPG:
|
|
return compat_blkpg_ioctl(bdev, mode, cmd, compat_ptr(arg));
|
|
case BLKRAGET:
|
|
case BLKFRAGET:
|
|
if (!arg)
|
|
return -EINVAL;
|
|
return compat_put_long(arg,
|
|
(bdev->bd_bdi->ra_pages * PAGE_SIZE) / 512);
|
|
case BLKROGET: /* compatible */
|
|
return compat_put_int(arg, bdev_read_only(bdev) != 0);
|
|
case BLKBSZGET_32: /* get the logical block size (cf. BLKSSZGET) */
|
|
return compat_put_int(arg, block_size(bdev));
|
|
case BLKSSZGET: /* get block device hardware sector size */
|
|
return compat_put_int(arg, bdev_logical_block_size(bdev));
|
|
case BLKSECTGET:
|
|
max_sectors = min_t(unsigned int, USHRT_MAX,
|
|
queue_max_sectors(bdev_get_queue(bdev)));
|
|
return compat_put_ushort(arg, max_sectors);
|
|
case BLKROTATIONAL:
|
|
return compat_put_ushort(arg,
|
|
!blk_queue_nonrot(bdev_get_queue(bdev)));
|
|
case BLKRASET: /* compatible, but no compat_ptr (!) */
|
|
case BLKFRASET:
|
|
if (!capable(CAP_SYS_ADMIN))
|
|
return -EACCES;
|
|
bdev->bd_bdi->ra_pages = (arg * 512) / PAGE_SIZE;
|
|
return 0;
|
|
case BLKGETSIZE:
|
|
size = i_size_read(bdev->bd_inode);
|
|
if ((size >> 9) > ~(compat_ulong_t)0)
|
|
return -EFBIG;
|
|
return compat_put_ulong(arg, size >> 9);
|
|
|
|
case BLKGETSIZE64_32:
|
|
return compat_put_u64(arg, i_size_read(bdev->bd_inode));
|
|
|
|
case BLKTRACESETUP32:
|
|
case BLKTRACESTART: /* compatible */
|
|
case BLKTRACESTOP: /* compatible */
|
|
case BLKTRACETEARDOWN: /* compatible */
|
|
ret = blk_trace_ioctl(bdev, cmd, compat_ptr(arg));
|
|
return ret;
|
|
case IOC_PR_REGISTER:
|
|
case IOC_PR_RESERVE:
|
|
case IOC_PR_RELEASE:
|
|
case IOC_PR_PREEMPT:
|
|
case IOC_PR_PREEMPT_ABORT:
|
|
case IOC_PR_CLEAR:
|
|
return blkdev_ioctl(bdev, mode, cmd,
|
|
(unsigned long)compat_ptr(arg));
|
|
default:
|
|
if (disk->fops->compat_ioctl)
|
|
ret = disk->fops->compat_ioctl(bdev, mode, cmd, arg);
|
|
if (ret == -ENOIOCTLCMD)
|
|
ret = compat_blkdev_driver_ioctl(bdev, mode, cmd, arg);
|
|
return ret;
|
|
}
|
|
}
|