Watch
1
Fork
You've already forked kernel_a52xq
0
mirror of https://github.com/a52xq-dev/kernel.git synced 2026-10-19 06:08:12 +07:00
Commit graph kernel_a52xq/include
Message SHA1
This is the 4.19.74 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl2DKbUACgkQONu9yGCS
 aT6YGg//abjWbd60zh1bErEl/ZlGfqjcKwM6GZ2k+Knhk14JzogJHGtBbuhIcaQB
 c2KH44r1QiNg9nJ2Gtq+mQnH5/GnY1aGlMHrfqb2uO7sKxoOVUZsxKiNjevtrOwI
 6LsiiKE6bBRAP3f8pCiFj84ubWiWzDnb+FA3p2sfh11F9wrxAcNPsvl8jsnwHisr
 sAJn9KgXQRezJdwRk+JgSYdSR6WSnaf4m4rrDGe9a2qxsvH9ttCtiOmf63m184cb
 iMoYs1ceBfUefyJjum077KVBb/ryRDr4VMMPhKDGqgcctXAlPVAUwcUY5HG3YWQg
 HQaHK9AyoAiEDh+iyAMHCYZaNr/lUPNUFbsYU7nf4o058EX1fpLtFmn0T1Dh9hOn
 N0TN1stNDQ8KAZ5iugYBMDKKmHznIo1umxiv68dMIsUSANdBSGENio+4Tkpvmfod
 zagE5aOoYtsh9Qxytz9IExkGYhinfrLT5fpTLrALQwneCquZqynqBFbwYj/VOYC2
 9MKGSeAKyRQqM02Bf4TrMptzO5jNsR+aWG7yyIR/L0fqis4h1fyCUTCdHd1fD1+0
 hEvR+2lkKiRT+B6ArhVOWf61N0RZ4TdkCzST6WoVosonCPFImJmmSkoYQ0KmnqKP
 DhnIp68n4zx8uutDoFuQ5HLJeiubmHOikjnO6F+pYPyzT0PW/wQ=
 =VrIK
 -----END PGP SIGNATURE-----

Merge 4.19.74 into android-4.19

Changes in 4.19.74
	bridge/mdb: remove wrong use of NLM_F_MULTI
	cdc_ether: fix rndis support for Mediatek based smartphones
	ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
	isdn/capi: check message length in capi_write()
	ixgbe: Fix secpath usage for IPsec TX offload.
	net: Fix null de-reference of device refcount
	net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list
	net: phylink: Fix flow control resolution
	net: sched: fix reordering issues
	sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
	sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
	sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
	tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
	tipc: add NULL pointer check before calling kfree_rcu
	tun: fix use-after-free when register netdev failed
	gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist
	gpio: fix line flag validation in linehandle_create
	Btrfs: fix assertion failure during fsync and use of stale transaction
	ixgbe: Prevent u8 wrapping of ITR value to something less than 10us
	genirq: Prevent NULL pointer dereference in resend_irqs()
	KVM: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset()
	KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
	KVM: x86: work around leak of uninitialized stack contents
	KVM: nVMX: handle page fault in vmread
	x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors
	powerpc: Add barrier_nospec to raw_copy_in_user()
	drm/meson: Add support for XBGR8888 & ABGR8888 formats
	clk: rockchip: Don't yell about bad mmc phases when getting
	mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue
	PCI: Always allow probing with driver_override
	gpio: fix line flag validation in lineevent_create
	ubifs: Correctly use tnc_next() in search_dh_cookie()
	driver core: Fix use-after-free and double free on glue directory
	crypto: talitos - check AES key size
	crypto: talitos - fix CTR alg blocksize
	crypto: talitos - check data blocksize in ablkcipher.
	crypto: talitos - fix ECB algs ivsize
	crypto: talitos - Do not modify req->cryptlen on decryption.
	crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking.
	firmware: ti_sci: Always request response from firmware
	drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC
	drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
	Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
	iio: adc: stm32-dfsdm: fix data type
	modules: fix BUG when load module with rodata=n
	modules: fix compile error if don't have strict module rwx
	platform/x86: pmc_atom: Add CB4063 Beckhoff Automation board to critclk_systems DMI table
	rsi: fix a double free bug in rsi_91x_deinit()
	nvmem: Use the same permissions for eeprom as for nvmem
	x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning
	Linux 4.19.74

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6dc03ee31e33b10ad8f7e2a68af42fe102a7743d

Greg Kroah-Hartman   commited 2019-09-19 09:18:49 +02:00
046263fec6
isdn/capi: check message length in capi_write()
[ Upstream commit fe163e534e5eecdfd7b5920b0dfd24c458ee85d6 ]

syzbot reported:

    BUG: KMSAN: uninit-value in capi_write+0x791/0xa90 drivers/isdn/capi/capi.c:700
    CPU: 0 PID: 10025 Comm: syz-executor379 Not tainted 4.20.0-rc7+ #2
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
      __dump_stack lib/dump_stack.c:77 [inline]
      dump_stack+0x173/0x1d0 lib/dump_stack.c:113
      kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
      __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313
      capi_write+0x791/0xa90 drivers/isdn/capi/capi.c:700
      do_loop_readv_writev fs/read_write.c:703 [inline]
      do_iter_write+0x83e/0xd80 fs/read_write.c:961
      vfs_writev fs/read_write.c:1004 [inline]
      do_writev+0x397/0x840 fs/read_write.c:1039
      __do_sys_writev fs/read_write.c:1112 [inline]
      __se_sys_writev+0x9b/0xb0 fs/read_write.c:1109
      __x64_sys_writev+0x4a/0x70 fs/read_write.c:1109
      do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
      entry_SYSCALL_64_after_hwframe+0x63/0xe7
    [...]

The problem is that capi_write() is reading past the end of the message.
Fix it by checking the message's length in the needed places.

Reported-and-tested-by: syzbot+0849c524d9c634f5ae66@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Eric Biggers   authored and   Greg Kroah-Hartman   commited 2019-09-19 09:09:29 +02:00
2354e925e3
Merge remote-tracking branch 'aosp/upstream-f2fs-stable-linux-4.19.y' into android-4.19
* aosp/upstream-f2fs-stable-linux-4.19.y:
  fscrypt: document testing with xfstests
  fscrypt: remove selection of CONFIG_CRYPTO_SHA256
  fscrypt: remove unnecessary includes of ratelimit.h
  fscrypt: don't set policy for a dead directory
  fscrypt: decrypt only the needed blocks in __fscrypt_decrypt_bio()
  fscrypt: support decrypting multiple filesystem blocks per page
  fscrypt: introduce fscrypt_decrypt_block_inplace()
  fscrypt: handle blocksize < PAGE_SIZE in fscrypt_zeroout_range()
  fscrypt: support encrypting multiple filesystem blocks per page
  fscrypt: introduce fscrypt_encrypt_block_inplace()
  fscrypt: clean up some BUG_ON()s in block encryption/decryption
  fscrypt: rename fscrypt_do_page_crypto() to fscrypt_crypt_block()
  fscrypt: remove the "write" part of struct fscrypt_ctx
  fscrypt: simplify bounce page handling

Change-Id: I49d9ee4b5cbb847a5fa0b736e0ff4a406b21bc1b
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>

Jaegeuk Kim   commited 2019-09-18 16:42:43 -07:00
958d8d0436
UPSTREAM: ALSA: pcm: add support for 352.8KHz and 384KHz sample rate
Most of the modern codecs supports 352.8KHz and 384KHz sample rates.
Currenlty HW params fails to set 352.8Kz and 384KHz sample rate
as these are not in known rates list.
Add these new rates to known list to allow them.

This patch also adds defines in pcm.h so that drivers can use it.

Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20190822095653.7200-2-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
(cherry picked from commit 4cc4531c310e592cf624148ae59c64f930f12e39)
Bug: 140827524
Change-Id: I5728853956ca3922ec5a958660067a139916429e
Signed-off-by: Alistair Delva <adelva@google.com>

Vidyakumar Athota   authored and   Alistair Delva   commited 2019-09-18 20:34:13 +00:00
8f451d4f95
This is the 4.19.73 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1/KiEACgkQONu9yGCS
 aT49JBAAy7b3wv1WXAtg9wsyS1JL4HbMXt3YjtokIX+UpkznoqII4B85QftPBbiD
 9zDuTWPjhrqKv1GsMkFRCqBVp5wGVik1MIbjVuKdstFN5W8KQybpbYnSW4T52+wS
 cs6oOPkLydAfWzKeq+ekEeU8yr5dua+Ui3huundZ49wseJWQP3fh9T+ToUx8V/cr
 tsLiRRgI0djj7KQWVuM1j8YGKT/6qk/UL0HMVZyoIdLmsxpLap+LWe0+CRXn8rvs
 eJJlVQTVtYf/ySoHkpnwR12VsjRYjx6pNkm/GrebMCkM7wF/4RMqxk7j9EU0PENH
 VUdRrUd+j/YPp6QzjSFMK0+0eb7Gm3X0FEN0IGZshu1r/CDnoj/7hqnBmOlYIbhv
 pdteYaLqWq7JjAHu7vF+S4aNQRGpAZb05LsbTJ39Eu3FbdVTLXsAuUveZ7Y4/y0X
 ri2M3d/sF/cjc3C+V7Y7h422SM36jSAK6496VAoRyqqjX/3JyROhgfU9NAMzVr83
 4uI904z9lH4TZGOd5YQgX2VuOtBcGwa7+g6fy97u1tp8UxSWFZRGDDLRysF/dIJO
 Wi51UK0Q7EWnqBTe0TFF6TjE5tC7R3ZgzqEQ1MU4eLI5mqokg82DAK4Ub2Wk5Qch
 CGs5/d16OOrLtG2RoaOGz9UdQR7IHUXLSqkKbaEdstc16MXNXns=
 =cmGh
 -----END PGP SIGNATURE-----

Merge 4.19.73 into android-4.19

Changes in 4.19.73
	ALSA: hda - Fix potential endless loop at applying quirks
	ALSA: hda/realtek - Fix overridden device-specific initialization
	ALSA: hda/realtek - Add quirk for HP Pavilion 15
	ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL
	ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre
	sched/fair: Don't assign runtime for throttled cfs_rq
	drm/vmwgfx: Fix double free in vmw_recv_msg()
	vhost/test: fix build for vhost test
	vhost/test: fix build for vhost test - again
	powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
	batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
	batman-adv: Only read OGM tvlv_len after buffer len check
	hv_sock: Fix hang when a connection is closed
	Blk-iolatency: warn on negative inflight IO counter
	blk-iolatency: fix STS_AGAIN handling
	{nl,mac}80211: fix interface combinations on crypto controlled devices
	timekeeping: Use proper ktime_add when adding nsecs in coarse offset
	selftests: fib_rule_tests: use pre-defined DEV_ADDR
	x86/ftrace: Fix warning and considate ftrace_jmp_replace() and ftrace_call_replace()
	powerpc/64: mark start_here_multiplatform as __ref
	media: stm32-dcmi: fix irq = 0 case
	arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64
	scripts/decode_stacktrace: match basepath using shell prefix operator, not regex
	riscv: remove unused variable in ftrace
	nvme-fc: use separate work queue to avoid warning
	clk: s2mps11: Add used attribute to s2mps11_dt_match
	remoteproc: qcom: q6v5: shore up resource probe handling
	modules: always page-align module section allocations
	kernel/module: Fix mem leak in module_add_modinfo_attrs
	drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"
	media: cec/v4l2: move V4L2 specific CEC functions to V4L2
	media: cec: remove cec-edid.c
	scsi: qla2xxx: Move log messages before issuing command to firmware
	keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
	Drivers: hv: kvp: Fix two "this statement may fall through" warnings
	x86, hibernate: Fix nosave_regions setup for hibernation
	remoteproc: qcom: q6v5-mss: add SCM probe dependency
	drm/amdgpu/gfx9: Update gfx9 golden settings.
	drm/amdgpu: Update gc_9_0 golden settings.
	KVM: x86: hyperv: enforce vp_index < KVM_MAX_VCPUS
	KVM: x86: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv' variables
	KVM: x86: hyperv: keep track of mismatched VP indexes
	KVM: hyperv: define VP assist page helpers
	x86/kvm/lapic: preserve gfn_to_hva_cache len on cache reinit
	drm/i915: Fix intel_dp_mst_best_encoder()
	drm/i915: Rename PLANE_CTL_DECOMPRESSION_ENABLE
	drm/i915/gen9+: Fix initial readout for Y tiled framebuffers
	drm/atomic_helper: Disallow new modesets on unregistered connectors
	Drivers: hv: kvp: Fix the indentation of some "break" statements
	Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up
	powerplay: Respect units on max dcfclk watermark
	drm/amd/pp: Fix truncated clock value when set watermark
	drm/amd/dm: Understand why attaching path/tile properties are needed
	ARM: davinci: da8xx: define gpio interrupts as separate resources
	ARM: davinci: dm365: define gpio interrupts as separate resources
	ARM: davinci: dm646x: define gpio interrupts as separate resources
	ARM: davinci: dm355: define gpio interrupts as separate resources
	ARM: davinci: dm644x: define gpio interrupts as separate resources
	s390/zcrypt: reinit ap queue state machine during device probe
	media: vim2m: use workqueue
	media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work
	drm/i915: Restore sane defaults for KMS on GEM error load
	drm/i915: Cleanup gt powerstate from gem
	KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode switch
	Btrfs: clean up scrub is_dev_replace parameter
	Btrfs: fix deadlock with memory reclaim during scrub
	btrfs: Remove extent_io_ops::fill_delalloc
	btrfs: Fix error handling in btrfs_cleanup_ordered_extents
	scsi: megaraid_sas: Fix combined reply queue mode detection
	scsi: megaraid_sas: Add check for reset adapter bit
	scsi: megaraid_sas: Use 63-bit DMA addressing
	powerpc/pkeys: Fix handling of pkey state across fork()
	btrfs: volumes: Make sure no dev extent is beyond device boundary
	btrfs: Use real device structure to verify dev extent
	media: vim2m: only cancel work if it is for right context
	ARC: show_regs: lockdep: re-enable preemption
	ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while handle_mm_fault
	IB/uverbs: Fix OOPs upon device disassociation
	crypto: ccree - fix resume race condition on init
	crypto: ccree - add missing inline qualifier
	drm/vblank: Allow dynamic per-crtc max_vblank_count
	drm/i915/ilk: Fix warning when reading emon_status with no output
	mfd: Kconfig: Fix I2C_DESIGNWARE_PLATFORM dependencies
	tpm: Fix some name collisions with drivers/char/tpm.h
	bcache: replace hard coded number with BUCKET_GC_GEN_MAX
	bcache: treat stale && dirty keys as bad keys
	KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run
	iio: adc: exynos-adc: Add S5PV210 variant
	dt-bindings: iio: adc: exynos-adc: Add S5PV210 variant
	iio: adc: exynos-adc: Use proper number of channels for Exynos4x12
	mt76: fix corrupted software generated tx CCMP PN
	drm/nouveau: Don't WARN_ON VCPI allocation failures
	iwlwifi: fix devices with PCI Device ID 0x34F0 and 11ac RF modules
	iwlwifi: add new card for 9260 series
	x86/kvmclock: set offset for kvm unstable clock
	spi: spi-gpio: fix SPI_CS_HIGH capability
	powerpc/kvm: Save and restore host AMR/IAMR/UAMOR
	mmc: renesas_sdhi: Fix card initialization failure in high speed mode
	btrfs: scrub: pass fs_info to scrub_setup_ctx
	btrfs: scrub: move scrub_setup_ctx allocation out of device_list_mutex
	btrfs: scrub: fix circular locking dependency warning
	btrfs: init csum_list before possible free
	PCI: qcom: Fix error handling in runtime PM support
	PCI: qcom: Don't deassert reset GPIO during probe
	drm: add __user attribute to ptr_to_compat()
	CIFS: Fix error paths in writeback code
	CIFS: Fix leaking locked VFS cache pages in writeback retry
	drm/i915: Handle vm_mmap error during I915_GEM_MMAP ioctl with WC set
	drm/i915: Sanity check mmap length against object size
	usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps
	arm64: dts: stratix10: add the sysmgr-syscon property from the gmac's
	IB/mlx5: Reset access mask when looping inside page fault handler
	kvm: mmu: Fix overflow on kvm mmu page limit calculation
	x86/kvm: move kvm_load/put_guest_xcr0 into atomic context
	KVM: x86: Always use 32-bit SMRAM save state for 32-bit kernels
	cifs: Fix lease buffer length error
	media: i2c: tda1997x: select V4L2_FWNODE
	ext4: protect journal inode's blocks using block_validity
	ARM: dts: qcom: ipq4019: fix PCI range
	ARM: dts: qcom: ipq4019: Fix MSI IRQ type
	ARM: dts: qcom: ipq4019: enlarge PCIe BAR range
	dt-bindings: mmc: Add supports-cqe property
	dt-bindings: mmc: Add disable-cqe-dcmd property.
	PCI: Add macro for Switchtec quirk declarations
	PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary
	dm mpath: fix missing call of path selector type->end_io
	blk-mq: free hw queue's resource in hctx's release handler
	mmc: sdhci-pci: Add support for Intel CML
	PCI: dwc: Use devm_pci_alloc_host_bridge() to simplify code
	cifs: smbd: take an array of reqeusts when sending upper layer data
	dm crypt: move detailed message into debug level
	signal/arc: Use force_sig_fault where appropriate
	ARC: mm: fix uninitialised signal code in do_page_fault
	ARC: mm: SIGSEGV userspace trying to access kernel virtual memory
	drm/amdkfd: Add missing Polaris10 ID
	kvm: Check irqchip mode before assign irqfd
	drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2)
	drm/amdgpu/{uvd,vcn}: fetch ring's read_ptr after alloc
	Btrfs: fix race between block group removal and block group allocation
	cifs: add spinlock for the openFileList to cifsInodeInfo
	clk: tegra: Fix maximum audio sync clock for Tegra124/210
	clk: tegra210: Fix default rates for HDA clocks
	IB/hfi1: Avoid hardlockup with flushlist_lock
	apparmor: reset pos on failure to unpack for various functions
	scsi: target/core: Use the SECTOR_SHIFT constant
	scsi: target/iblock: Fix overrun in WRITE SAME emulation
	staging: wilc1000: fix error path cleanup in wilc_wlan_initialize()
	scsi: zfcp: fix request object use-after-free in send path causing wrong traces
	cifs: Properly handle auto disabling of serverino option
	ALSA: hda - Don't resume forcibly i915 HDMI/DP codec
	ceph: use ceph_evict_inode to cleanup inode's resource
	KVM: x86: optimize check for valid PAT value
	KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad value
	KVM: VMX: Fix handling of #MC that occurs during VM-Entry
	KVM: VMX: check CPUID before allowing read/write of IA32_XSS
	KVM: PPC: Use ccr field in pt_regs struct embedded in vcpu struct
	KVM: PPC: Book3S HV: Fix CR0 setting in TM emulation
	ARM: dts: gemini: Set DIR-685 SPI CS as active low
	RDMA/srp: Document srp_parse_in() arguments
	RDMA/srp: Accept again source addresses that do not have a port number
	btrfs: correctly validate compression type
	resource: Include resource end in walk_*() interfaces
	resource: Fix find_next_iomem_res() iteration issue
	resource: fix locking in find_next_iomem_res()
	pstore: Fix double-free in pstore_mkfile() failure path
	dm thin metadata: check if in fail_io mode when setting needs_check
	drm/panel: Add support for Armadeus ST0700 Adapt
	ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips
	powerpc/mm: Limit rma_size to 1TB when running without HV mode
	iommu/iova: Remove stale cached32_node
	gpio: don't WARN() on NULL descs if gpiolib is disabled
	i2c: at91: disable TXRDY interrupt after sending data
	i2c: at91: fix clk_offset for sama5d2
	mm/migrate.c: initialize pud_entry in migrate_vma()
	iio: adc: gyroadc: fix uninitialized return code
	NFSv4: Fix delegation state recovery
	bcache: only clear BTREE_NODE_dirty bit when it is set
	bcache: add comments for mutex_lock(&b->write_lock)
	bcache: fix race in btree_flush_write()
	drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV
	virtio/s390: fix race on airq_areas[]
	drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors
	ext4: don't perform block validity checks on the journal inode
	ext4: fix block validity checks for journal inodes using indirect blocks
	ext4: unsigned int compared against zero
	PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround
	powerpc/tm: Remove msr_tm_active()
	powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts
	vhost: make sure log_num < in_num
	Linux 4.19.73

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7bc57825aeb36759bb8e8726888da9af06392c09

Greg Kroah-Hartman   commited 2019-09-16 09:35:02 +02:00
8ca5759502
gpio: don't WARN() on NULL descs if gpiolib is disabled
[ Upstream commit ffe0bbabb0cffceceae07484fde1ec2a63b1537c ]

If gpiolib is disabled, we use the inline stubs from gpio/consumer.h
instead of regular definitions of GPIO API. The stubs for 'optional'
variants of gpiod_get routines return NULL in this case as if the
relevant GPIO wasn't found. This is correct so far.

Calling other (non-gpio_get) stubs from this header triggers a warning
because the GPIO descriptor couldn't have been requested. The warning
however is unconditional (WARN_ON(1)) and is emitted even if the passed
descriptor pointer is NULL.

We don't want to force the users of 'optional' gpio_get to check the
returned pointer before calling e.g. gpiod_set_value() so let's only
WARN on non-NULL descriptors.

Cc: stable@vger.kernel.org
Reported-by: Claus H. Stovgaard <cst@phaseone.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Bartosz Golaszewski   authored and   Greg Kroah-Hartman   commited 2019-09-16 08:22:22 +02:00
c9c90711ee
dm mpath: fix missing call of path selector type->end_io
[ Upstream commit 5de719e3d01b4abe0de0d7b857148a880ff2a90b ]

After commit 396eaf21ee ("blk-mq: improve DM's blk-mq IO merging via
blk_insert_cloned_request feedback"), map_request() will requeue the tio
when issued clone request return BLK_STS_RESOURCE or BLK_STS_DEV_RESOURCE.

Thus, if device driver status is error, a tio may be requeued multiple
times until the return value is not DM_MAPIO_REQUEUE.  That means
type->start_io may be called multiple times, while type->end_io is only
called when IO complete.

In fact, even without commit 396eaf21ee, setup_clone() failure can
also cause tio requeue and associated missed call to type->end_io.

The service-time path selector selects path based on in_flight_size,
which is increased by st_start_io() and decreased by st_end_io().
Missed calls to st_end_io() can lead to in_flight_size count error and
will cause the selector to make the wrong choice.  In addition,
queue-length path selector will also be affected.

To fix the problem, call type->end_io in ->release_clone_rq before tio
requeue.  map_info is passed to ->release_clone_rq() for map_request()
error path that result in requeue.

Fixes: 396eaf21ee ("blk-mq: improve DM's blk-mq IO merging via blk_insert_cloned_request feedback")
Cc: stable@vger.kernl.org
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Yufen Yu   authored and   Greg Kroah-Hartman   commited 2019-09-16 08:22:12 +02:00
69409854ba
drm/vblank: Allow dynamic per-crtc max_vblank_count
[ Upstream commit ed20151a7699bb2c77eba3610199789a126940c4 ]

On i965gm we need to adjust max_vblank_count dynamically
depending on whether the TV encoder is used or not. To
that end add a per-crtc max_vblank_count that takes
precedence over its device wide counterpart. The driver
can now call drm_crtc_set_max_vblank_count() to configure
the per-crtc value before calling drm_vblank_on().

Also looks like there was some discussion about exynos needing
similar treatment.

v2: Drop the extra max_vblank_count!=0 check for the
    WARN(last!=current), will take care of it in i915 code (Daniel)
    WARN_ON(!inmodeset) (Daniel)
    WARN_ON(dev->max_vblank_count)
    Pimp up the docs (Daniel)

Cc: stable@vger.kernel.org
Cc: Inki Dae <inki.dae@samsung.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181127182004.28885-1-ville.syrjala@linux.intel.com
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Ville Syrjälä   authored and   Greg Kroah-Hartman   commited 2019-09-16 08:22:04 +02:00
2b4f567912
keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
[ Upstream commit 2ecefa0a15fd0ef88b9cd5d15ceb813008136431 ]

The keyctl_dh_params struct in uapi/linux/keyctl.h contains the symbol
"private" which means that the header file will cause compilation failure
if #included in to a C++ program.  Further, the patch that added the same
struct to the keyutils package named the symbol "priv", not "private".

The previous attempt to fix this (commit 8a2336e549) did so by simply
renaming the kernel's copy of the field to dh_private, but this then breaks
existing userspace and as such has been reverted (commit 8c0f9f5b30).

[And note, to those who think that wrapping the struct in extern "C" {}
 will work: it won't; that only changes how symbol names are presented to
 the assembler and linker.].

Instead, insert an anonymous union around the "private" member and add a
second member in there with the name "priv" to match the one in the
keyutils package.  The "private" member is then wrapped in !__cplusplus
cpp-conditionals to hide it from C++.

Fixes: ddbb411487 ("KEYS: Add KEYCTL_DH_COMPUTE command")
Fixes: 8a2336e549 ("uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Randy Dunlap <rdunlap@infradead.org>
cc: Lubomir Rintel <lkundrak@v3.sk>
cc: James Morris <jmorris@namei.org>
cc: Mat Martineau <mathew.j.martineau@linux.intel.com>
cc: Stephan Mueller <smueller@chronox.de>
cc: Andrew Morton <akpm@linux-foundation.org>
cc: Linus Torvalds <torvalds@linux-foundation.org>
cc: stable@vger.kernel.org
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

David Howells   authored and   Greg Kroah-Hartman   commited 2019-09-16 08:21:47 +02:00
3f3beae228
media: cec/v4l2: move V4L2 specific CEC functions to V4L2
[ Upstream commit 9cfd2753f8f3923f89cbb15f940f3aa0e7202d3e ]

Several CEC functions are actually specific for use with receivers,
i.e. they should be part of the V4L2 subsystem, not CEC.

These functions deal with validating and modifying EDIDs for (HDMI)
receivers, and they do not actually have anything to do with the CEC
subsystem and whether or not CEC is enabled. The problem was that if
the CEC_CORE config option was not set, then these functions would
become stubs, but that's not right: they should always be valid.

So replace the cec_ prefix by v4l2_ and move them to v4l2-dv-timings.c.
Update all drivers that call these accordingly.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: <stable@vger.kernel.org>      # for v4.17 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Hans Verkuil   authored and   Greg Kroah-Hartman   commited 2019-09-16 08:21:46 +02:00
851308450a
{nl,mac}80211: fix interface combinations on crypto controlled devices
[ Upstream commit e6f4051123fd33901e9655a675b22aefcdc5d277 ]

Commit 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on
crypto controlled devices") has introduced a change which allows
4addr operation on crypto controlled devices (ex: ath10k). This
change has inadvertently impacted the interface combinations logic
on such devices.

General rule is that software interfaces like AP/VLAN should not be
listed under supported interface combinations and should not be
considered during validation of these combinations; because of the
aforementioned change, AP/VLAN interfaces(if present) will be checked
against interfaces supported by the device and blocks valid interface
combinations.

Consider a case where an AP and AP/VLAN are up and running; when a
second AP device is brought up on the same physical device, this AP
will be checked against the AP/VLAN interface (which will not be
part of supported interface combinations of the device) and blocks
second AP to come up.

Add a new API cfg80211_iftype_allowed() to fix the problem, this
API works for all devices with/without SW crypto control.

Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
Fixes: 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on crypto controlled devices")
Link: https://lore.kernel.org/r/1563779690-9716-1-git-send-email-mpubbise@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Manikanta Pubbisetty   authored and   Greg Kroah-Hartman   commited 2019-09-16 08:21:42 +02:00
1aa38eceb6
BACKPORT: make 'user_access_begin()' do 'access_ok()'
upstream commit 594cc251fdd0 ("make 'user_access_begin()' do 'access_ok()'")

Originally, the rule used to be that you'd have to do access_ok()
separately, and then user_access_begin() before actually doing the
direct (optimized) user access.

But experience has shown that people then decide not to do access_ok()
at all, and instead rely on it being implied by other operations or
similar.  Which makes it very hard to verify that the access has
actually been range-checked.

If you use the unsafe direct user accesses, hardware features (either
SMAP - Supervisor Mode Access Protection - on x86, or PAN - Privileged
Access Never - on ARM) do force you to use user_access_begin().  But
nothing really forces the range check.

By putting the range check into user_access_begin(), we actually force
people to do the right thing (tm), and the range check vill be visible
near the actual accesses.  We have way too long a history of people
trying to avoid them.

Bug: 135368228
Change-Id: I4ca0e4566ea080fa148c5e768bb1a0b6f7201c01
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Linus Torvalds   authored and   Alistair Delva   commited 2019-09-12 11:28:03 +00:00
ac351de9dd
This is the 4.19.72 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl13bgIACgkQONu9yGCS
 aT5lvg/+KvPsSPQiccNrK/mvPan29KMk7R8Yjr3hzjPxLFPvRz7tR69joU6yj1nw
 S4BNZYiVsT43d9U8FieniAz2ch2qDIQbIIrQTLqcED4vn7ih0cTt4783FNZPApsZ
 I84u6kgbD3x5tPyB/RYE79JCq4JDgV+GvyDK+MXcU8Dh5OHTjJzLrwqghbI/LH6k
 G9yoMSho23i1h+jl/JW+QfknarDaclZUCmL/BdZ3A6mILXpWcwF2j10KHBYTsPRd
 DvrbW9S7e78c80TIWPtCHr1RYY79J4NXvPPThpytvpOjMZYsdT3s7jJLoiV4+3gq
 G04Y2awbfyD8U3WB3q8qX9AMfF5B6uIOqnp3DRV/NX7LJHk3xBTTAY3/6d7xAZr7
 xJ9WSd4gzzpBu6EgcS8F52qrrxol2S8jGRoNh7zGgQe8YvxvW5ktgsOCshzvGGSb
 HgYBar4qiQepG4mwKpJ9FCzBY/H+uuIKOgJpgFGE/Hhmw4yw5REy0i62sf3Rkroa
 db1j+5egc0kvqLUVGp8lS5RPDrhJQ9A4XIUlThZWU2bGVl6wDFHaJyZdM1oEXFZU
 jgONQnM/ys9jAnzc9xzJ4Ck9u03qquDgMmC+bC1z2OlQ/tN+z5Sm4U86DjXd9qBD
 jcb9IaSZ9HEgwIzhJypQHHNjr7OVINmrQW5v74LHNb3u+jIiYiM=
 =59b4
 -----END PGP SIGNATURE-----

Merge 4.19.72 into android-4.19

Changes in 4.19.72
	mld: fix memory leak in mld_del_delrec()
	net: fix skb use after free in netpoll
	net: sched: act_sample: fix psample group handling on overwrite
	net_sched: fix a NULL pointer deref in ipt action
	net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
	tcp: inherit timestamp on mtu probe
	tcp: remove empty skb from write queue in error cases
	net/rds: Fix info leak in rds6_inc_info_copy()
	x86/boot: Preserve boot_params.secure_boot from sanitizing
	spi: bcm2835aux: unifying code between polling and interrupt driven code
	spi: bcm2835aux: remove dangerous uncontrolled read of fifo
	spi: bcm2835aux: fix corruptions for longer spi transfers
	net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
	netfilter: nf_tables: use-after-free in failing rule with bound set
	tools: bpftool: fix error message (prog -> object)
	hv_netvsc: Fix a warning of suspicious RCU usage
	net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
	Bluetooth: btqca: Add a short delay before downloading the NVM
	ibmveth: Convert multicast list size for little-endian system
	gpio: Fix build error of function redefinition
	netfilter: nft_flow_offload: skip tcp rst and fin packets
	drm/mediatek: use correct device to import PRIME buffers
	drm/mediatek: set DMA max segment size
	scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure
	scsi: target: tcmu: avoid use-after-free after command timeout
	cxgb4: fix a memory leak bug
	liquidio: add cleanup in octeon_setup_iq()
	net: myri10ge: fix memory leaks
	lan78xx: Fix memory leaks
	vfs: fix page locking deadlocks when deduping files
	cx82310_eth: fix a memory leak bug
	net: kalmia: fix memory leaks
	ibmvnic: Unmap DMA address of TX descriptor buffers after use
	net: cavium: fix driver name
	wimax/i2400m: fix a memory leak bug
	ravb: Fix use-after-free ravb_tstamp_skb
	kprobes: Fix potential deadlock in kprobe_optimizer()
	HID: cp2112: prevent sleeping function called from invalid context
	x86/boot/compressed/64: Fix boot on machines with broken E820 table
	Input: hyperv-keyboard: Use in-place iterator API in the channel callback
	Tools: hv: kvp: eliminate 'may be used uninitialized' warning
	nvme-multipath: fix possible I/O hang when paths are updated
	IB/mlx4: Fix memory leaks
	infiniband: hfi1: fix a memory leak bug
	infiniband: hfi1: fix memory leaks
	selftests: kvm: fix state save/load on processors without XSAVE
	selftests/kvm: make platform_info_test pass on AMD
	ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
	ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob()
	ceph: fix buffer free while holding i_ceph_lock in fill_inode()
	KVM: arm/arm64: Only skip MMIO insn once
	afs: Fix leak in afs_lookup_cell_rcu()
	KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity
	x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement()
	libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
	Revert "x86/apic: Include the LDR when clearing out APIC registers"
	Linux 4.19.72

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I207e2ba522f98f6e17dacd3a2527fab615155007

Greg Kroah-Hartman   commited 2019-09-10 10:48:21 +01:00
5fc4dfdee6
libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
[ Upstream commit 5c498950f730aa17c5f8a2cdcb903524e4002ed2 ]

Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Luis Henriques   authored and   Greg Kroah-Hartman   commited 2019-09-10 10:33:53 +01:00
0f134f6e72
gpio: Fix build error of function redefinition
[ Upstream commit 68e03b85474a51ec1921b4d13204782594ef7223 ]

when do randbuilding, I got this error:

In file included from drivers/hwmon/pmbus/ucd9000.c:19:0:
./include/linux/gpio/driver.h:576:1: error: redefinition of gpiochip_add_pin_range
 gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
 ^~~~~~~~~~~~~~~~~~~~~~
In file included from drivers/hwmon/pmbus/ucd9000.c:18:0:
./include/linux/gpio.h:245:1: note: previous definition of gpiochip_add_pin_range was here
 gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
 ^~~~~~~~~~~~~~~~~~~~~~

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 964cb34188 ("gpio: move pincontrol calls to <linux/gpio/driver.h>")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20190731123814.46624-1-yuehaibing@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

YueHaibing   authored and   Greg Kroah-Hartman   commited 2019-09-10 10:33:44 +01:00
6052090280
netfilter: nf_tables: use-after-free in failing rule with bound set
[ Upstream commit 6a0a8d10a3661a036b55af695542a714c429ab7c ]

If a rule that has already a bound anonymous set fails to be added, the
preparation phase releases the rule and the bound set. However, the
transaction object from the abort path still has a reference to the set
object that is stale, leading to a use-after-free when checking for the
set->bound field. Add a new field to the transaction that specifies if
the set is bound, so the abort path can skip releasing it since the rule
command owns it and it takes care of releasing it. After this update,
the set->bound field is removed.

[   24.649883] Unable to handle kernel paging request at virtual address 0000000000040434
[   24.657858] Mem abort info:
[   24.660686]   ESR = 0x96000004
[   24.663769]   Exception class = DABT (current EL), IL = 32 bits
[   24.669725]   SET = 0, FnV = 0
[   24.672804]   EA = 0, S1PTW = 0
[   24.675975] Data abort info:
[   24.678880]   ISV = 0, ISS = 0x00000004
[   24.682743]   CM = 0, WnR = 0
[   24.685723] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000428952000
[   24.692207] [0000000000040434] pgd=0000000000000000
[   24.697119] Internal error: Oops: 96000004 [#1] SMP
[...]
[   24.889414] Call trace:
[   24.891870]  __nf_tables_abort+0x3f0/0x7a0
[   24.895984]  nf_tables_abort+0x20/0x40
[   24.899750]  nfnetlink_rcv_batch+0x17c/0x588
[   24.904037]  nfnetlink_rcv+0x13c/0x190
[   24.907803]  netlink_unicast+0x18c/0x208
[   24.911742]  netlink_sendmsg+0x1b0/0x350
[   24.915682]  sock_sendmsg+0x4c/0x68
[   24.919185]  ___sys_sendmsg+0x288/0x2c8
[   24.923037]  __sys_sendmsg+0x7c/0xd0
[   24.926628]  __arm64_sys_sendmsg+0x2c/0x38
[   24.930744]  el0_svc_common.constprop.0+0x94/0x158
[   24.935556]  el0_svc_handler+0x34/0x90
[   24.939322]  el0_svc+0x8/0xc
[   24.942216] Code: 37280300 f9404023 91014262 aa1703e0 (f9401863)
[   24.948336] ---[ end trace cebbb9dcbed3b56f ]---

Fixes: f6ac85858976 ("netfilter: nf_tables: unbind set in rule from commit path")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Pablo Neira Ayuso   authored and   Greg Kroah-Hartman   commited 2019-09-10 10:33:42 +01:00
5776970fb4
net_sched: fix a NULL pointer deref in ipt action
[ Upstream commit 981471bd3abf4d572097645d765391533aac327d ]

The net pointer in struct xt_tgdtor_param is not explicitly
initialized therefore is still NULL when dereferencing it.
So we have to find a way to pass the correct net pointer to
ipt_destroy_target().

The best way I find is just saving the net pointer inside the per
netns struct tcf_idrinfo, which could make this patch smaller.

Fixes: 0c66dc1ea3 ("netfilter: conntrack: register hooks in netns when needed by ruleset")
Reported-and-tested-by: itugrok@yahoo.com
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Cong Wang   authored and   Greg Kroah-Hartman   commited 2019-09-10 10:33:39 +01:00
38166934f8
net: sched: act_sample: fix psample group handling on overwrite
[ Upstream commit dbf47a2a094edf58983265e323ca4bdcdb58b5ee ]

Action sample doesn't properly handle psample_group pointer in overwrite
case. Following issues need to be fixed:

- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
  s->psample_group, even though we neither setting the pointer to NULL, nor
  preventing concurrent readers from accessing the pointer in some way.
  Use rcu_swap_protected() instead to safely reset the pointer.

- Old value of s->psample_group is not released or deallocated in any way,
  which results resource leak. Use psample_group_put() on non-NULL value
  obtained with rcu_swap_protected().

- The function psample_group_put() that released reference to struct
  psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
  grace period when deallocating it. Extend struct psample_group with rcu
  head and use kfree_rcu when freeing it.

Fixes: 5c5670fae4 ("net/sched: Introduce sample tc action")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Vlad Buslov   authored and   Greg Kroah-Hartman   commited 2019-09-10 10:33:38 +01:00
5ff0ab0c66
This is the 4.19.70 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1yF0AACgkQONu9yGCS
 aT64ew/6AzJDRMcmnx1COeRP8tfQ5A8ghjnp6REEca1MYJWjDlqd0X+EMd/7zorZ
 YkBzb1ND1c/9KeGQzdx8lJ5lcNRVJcD7tT6irT5zMnBcyR9uPamAaVgmVHXxuorK
 el4nvX9g/MxBLsuqLHxGr5pNXi7mHu6zfXyQ86TJzlez7yHlPuiJb8bDpHnCRJ1P
 n/MemPq/nQgC5jPBQRhT+IpqC1MTIHNhRaHHg/5Gdrrz+eVumnk+1zbWqtBRuJKS
 qS7RL1pI0Su00i5bY1r76iSkoRkGw9SoeIgz3sycbtAvGo9TI16/hZPvWAsYOAjL
 2DQS0rMPSnM4QV0odbUImFt86f0YJiAL7xYS8EYCc4GX/eLbNRtP8yLq+8rlo4Oa
 36HbiNhGSEjRxenfVRUD/STgBYzfVeQOMEyFJNRtfNDP/l66sLk/pEOEd83j06H4
 G87BJgKFC35dv5QrbCmJO8P1IXLs5QaChD3dL6R9/hbvCU2A/MOqhPL16JCXWA20
 +hOWn8ryrtBa5Dt0avAkrrnUNC8cVWyD44uAm+Hu/49CZpkTasZMB7Z81VSIsuvO
 xoT1Jx0J1W/LtHwCghSkui/fjQjVpkP3xnB7zVGem73Mpcm68g6mLajKaUrLnJHp
 /sz2mppF7gZob43anTtUhSV9OvrzqftkR+iFg3rCKSJyQE1o48o=
 =hMvg
 -----END PGP SIGNATURE-----

Merge 4.19.70 into android-4.19

Changes in 4.19.70
	dmaengine: ste_dma40: fix unneeded variable warning
	nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
	afs: Fix the CB.ProbeUuid service handler to reply correctly
	afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u()
	fs: afs: Fix a possible null-pointer dereference in afs_put_read()
	afs: Only update d_fsdata if different in afs_d_revalidate()
	nvmet-loop: Flush nvme_delete_wq when removing the port
	nvme: fix a possible deadlock when passthru commands sent to a multipath device
	nvme-pci: Fix async probe remove race
	soundwire: cadence_master: fix register definition for SLAVE_STATE
	soundwire: cadence_master: fix definitions for INTSTAT0/1
	auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach
	dmaengine: stm32-mdma: Fix a possible null-pointer dereference in stm32_mdma_irq_handler()
	omap-dma/omap_vout_vrfb: fix off-by-one fi value
	iommu/dma: Handle SG length overflow better
	usb: gadget: composite: Clear "suspended" on reset/disconnect
	usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
	xen/blkback: fix memory leaks
	arm64: cpufeature: Don't treat granule sizes as strict
	i2c: rcar: avoid race when unregistering slave client
	i2c: emev2: avoid race when unregistering slave client
	drm/ast: Fixed reboot test may cause system hanged
	usb: host: fotg2: restart hcd after port reset
	tools: hv: fixed Python pep8/flake8 warnings for lsvmbus
	tools: hv: fix KVP and VSS daemons exit code
	drm/i915: fix broadwell EU computation
	watchdog: bcm2835_wdt: Fix module autoload
	drm/bridge: tfp410: fix memleak in get_modes()
	scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
	drm/tilcdc: Register cpufreq notifier after we have initialized crtc
	net/tls: Fixed return value when tls_complete_pending_work() fails
	net/tls: swap sk_write_space on close
	net: tls, fix sk_write_space NULL write when tx disabled
	ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set
	ipv6: Default fib6_type to RTN_UNICAST when not set
	net/smc: make sure EPOLLOUT is raised
	tcp: make sure EPOLLOUT wont be missed
	ipv4/icmp: fix rt dst dev null pointer dereference
	mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
	ALSA: usb-audio: Check mixer unit bitmap yet more strictly
	ALSA: line6: Fix memory leak at line6_init_pcm() error path
	ALSA: hda - Fixes inverted Conexant GPIO mic mute led
	ALSA: seq: Fix potential concurrent access to the deleted pool
	ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate()
	ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604
	kvm: x86: skip populating logical dest map if apic is not sw enabled
	KVM: x86: Don't update RIP or do single-step on faulting emulation
	uprobes/x86: Fix detection of 32-bit user mode
	x86/apic: Do not initialize LDR and DFR for bigsmp
	x86/apic: Include the LDR when clearing out APIC registers
	ftrace: Fix NULL pointer dereference in t_probe_next()
	ftrace: Check for successful allocation of hash
	ftrace: Check for empty hash and comment the race with registering probes
	usb-storage: Add new JMS567 revision to unusual_devs
	USB: cdc-wdm: fix race between write and disconnect due to flag abuse
	usb: hcd: use managed device resources
	usb: chipidea: udc: don't do hardware access if gadget has stopped
	usb: host: ohci: fix a race condition between shutdown and irq
	usb: host: xhci: rcar: Fix typo in compatible string matching
	USB: storage: ums-realtek: Update module parameter description for auto_delink_en
	USB: storage: ums-realtek: Whitelist auto-delink support
	mei: me: add Tiger Lake point LP device ID
	mmc: sdhci-of-at91: add quirk for broken HS200
	mmc: core: Fix init of SD cards reporting an invalid VDD range
	stm class: Fix a double free of stm_source_device
	intel_th: pci: Add support for another Lewisburg PCH
	intel_th: pci: Add Tiger Lake support
	typec: tcpm: fix a typo in the comparison of pdo_max_voltage
	fsi: scom: Don't abort operations for minor errors
	lib: logic_pio: Fix RCU usage
	lib: logic_pio: Avoid possible overlap for unregistering regions
	lib: logic_pio: Add logic_pio_unregister_range()
	drm/amdgpu: Add APTX quirk for Dell Latitude 5495
	drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
	drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe()
	bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free
	bus: hisi_lpc: Add .remove method to avoid driver unbind crash
	VMCI: Release resource if the work is already queued
	crypto: ccp - Ignore unconfigured CCP device on suspend/resume
	Revert "cfg80211: fix processing world regdomain when non modular"
	mac80211: fix possible sta leak
	mac80211: Don't memset RXCB prior to PAE intercept
	mac80211: Correctly set noencrypt for PAE frames
	KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling
	KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
	KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
	NFS: Clean up list moves of struct nfs_page
	NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
	NFS: Pass error information to the pgio error cleanup routine
	NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
	i2c: piix4: Fix port selection for AMD Family 16h Model 30h
	x86/ptrace: fix up botched merge of spectrev1 fix
	mt76: mt76x0u: do not reset radio on resume
	Revert "ASoC: Fail card instantiation if DAI format setup fails"
	Linux 4.19.70

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I35ff8a403a05a8c66d87cb4b542997e63c422288

Greg Kroah-Hartman   commited 2019-09-06 12:08:42 +02:00
6b1f307bd0
NFS: Pass error information to the pgio error cleanup routine
[ Upstream commit df3accb849607a86278a37c35e6b313635ccc48b ]

Allow the caller to pass error information when cleaning up a failed
I/O request so that we can conditionally take action to cancel the
request altogether if the error turned out to be fatal.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Trond Myklebust   authored and   Greg Kroah-Hartman   commited 2019-09-06 10:22:23 +02:00
b5891b624b
NFS: Clean up list moves of struct nfs_page
[ Upstream commit 078b5fd92c4913dd367361db6c28568386077c89 ]

In several places we're just moving the struct nfs_page from one list to
another by first removing from the existing list, then adding to the new
one.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Trond Myklebust   authored and   Greg Kroah-Hartman   commited 2019-09-06 10:22:22 +02:00
57c491fd84
lib: logic_pio: Add logic_pio_unregister_range()
commit b884e2de2afc68ce30f7093747378ef972dde253 upstream.

Add a function to unregister a logical PIO range.

Logical PIO space can still be leaked when unregistering certain
LOGIC_PIO_CPU_MMIO regions, but this acceptable for now since there are no
callers to unregister LOGIC_PIO_CPU_MMIO regions, and the logical PIO
region allocation scheme would need significant work to improve this.

Cc: stable@vger.kernel.org
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

John Garry   authored and   Greg Kroah-Hartman   commited 2019-09-06 10:22:19 +02:00
c4616a9b3d
This is the 4.19.69 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1ncKwACgkQONu9yGCS
 aT6FPg//RiiJo8O+CUzkP4MFohy8JUuGC1MnnSfSFJn9bzAljWhYtSoJlZ9PbfHq
 qx9oWuQNNVZRn9nWuRbTRfRlz6ztc7whsjhAth4eNCtXvu+xAvFLvFhlbVt6xiZ0
 Wg3jXDtIY3Y8km01uJdzVk/juUqvTU8nioM4s1OWTFRfOfakLMK9CkxOKfZMFnxP
 mVILTcOxZAf0Js2tRMRPvm8c6OhegkXZjWUhGMlvmFKk/pqUouVXH8pKbBoTj8zR
 VoHB6pWs3YG3S15WgkNfKiR9WpeXywC7XN9ilziczaQ8HbsH6Y+5wM9Ncx+3FVxd
 mzygLCtlckYWjiabS/w3tQHrH+LV8MaPYuW/2tlL9sBljlDW5RBW+g7vaBQjIpCK
 gco/z0qmeEIYt8ktLL08i9FQBPp00Fra9x3jZKLz8Tp+W//EBm4ENMm2cxHtRKtd
 3fG70ngJmycksCK/e8N466/1f/aAOxfBZkog3R/4yqNvOX8rkQGRJlhv0AzIdsy8
 RlTDotDwwQFbMWROVs/Jea+9Wwp71jlPOXyMqX2EqUR/WfDWuIZEyzSdbqKPNgHL
 Q9OoUB7kIKGusqQC6ABYKtDn7T046o6ePEB8r2aIvPmw5AiWMefSubHNV6mP3KJb
 0NbQlUelMTvxuwm5NLMY2EWbWi+jvg4OgJvajwcDretTPeBGMZI=
 =945Y
 -----END PGP SIGNATURE-----

Merge 4.19.69 into android-4.19

Changes in 4.19.69
	HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
	MIPS: kernel: only use i8253 clocksource with periodic clockevent
	mips: fix cacheinfo
	netfilter: ebtables: fix a memory leak bug in compat
	ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
	selftests/bpf: fix sendmsg6_prog on s390
	bonding: Force slave speed check after link state recovery for 802.3ad
	net: mvpp2: Don't check for 3 consecutive Idle frames for 10G links
	selftests: forwarding: gre_multipath: Enable IPv4 forwarding
	selftests: forwarding: gre_multipath: Fix flower filters
	can: dev: call netif_carrier_off() in register_candev()
	can: mcp251x: add error check when wq alloc failed
	can: gw: Fix error path of cgw_module_init
	ASoC: Fail card instantiation if DAI format setup fails
	st21nfca_connectivity_event_received: null check the allocation
	st_nci_hci_connectivity_event_received: null check the allocation
	ASoC: rockchip: Fix mono capture
	ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
	net: usb: qmi_wwan: Add the BroadMobi BM818 card
	qed: RDMA - Fix the hw_ver returned in device attributes
	isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain()
	mac80211_hwsim: Fix possible null-pointer dereferences in hwsim_dump_radio_nl()
	netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too
	netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets
	netfilter: ipset: Fix rename concurrency with listing
	rxrpc: Fix potential deadlock
	rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet
	isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
	net: phy: phy_led_triggers: Fix a possible null-pointer dereference in phy_led_trigger_change_speed()
	perf bench numa: Fix cpu0 binding
	can: sja1000: force the string buffer NULL-terminated
	can: peak_usb: force the string buffer NULL-terminated
	net/ethernet/qlogic/qed: force the string buffer NULL-terminated
	NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
	NFS: Fix regression whereby fscache errors are appearing on 'nofsc' mounts
	HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52
	HID: input: fix a4tech horizontal wheel custom usage
	drm/rockchip: Suspend DP late
	SMB3: Fix potential memory leak when processing compound chain
	SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL
	s390: put _stext and _etext into .text section
	net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
	net: stmmac: Fix issues when number of Queues >= 4
	net: stmmac: tc: Do not return a fragment entry
	net: hisilicon: make hip04_tx_reclaim non-reentrant
	net: hisilicon: fix hip04-xmit never return TX_BUSY
	net: hisilicon: Fix dma_map_single failed on arm64
	libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
	libata: add SG safety checks in SFF pio transfers
	x86/lib/cpu: Address missing prototypes warning
	drm/vmwgfx: fix memory leak when too many retries have occurred
	block, bfq: handle NULL return value by bfq_init_rq()
	perf ftrace: Fix failure to set cpumask when only one cpu is present
	perf cpumap: Fix writing to illegal memory in handling cpumap mask
	perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
	KVM: arm64: Don't write junk to sysregs on reset
	KVM: arm: Don't write junk to CP15 registers on reset
	selftests: kvm: Adding config fragments
	HID: wacom: correct misreported EKR ring values
	HID: wacom: Correct distance scale for 2nd-gen Intuos devices
	Revert "dm bufio: fix deadlock with loop device"
	clk: socfpga: stratix10: fix rate caclulationg for cnt_clks
	ceph: clear page dirty before invalidate page
	ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply
	libceph: fix PG split vs OSD (re)connect race
	drm/nouveau: Don't retry infinitely when receiving no data on i2c over AUX
	gpiolib: never report open-drain/source lines as 'input' to user-space
	Drivers: hv: vmbus: Fix virt_to_hvpfn() for X86_PAE
	userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
	x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
	x86/apic: Handle missing global clockevent gracefully
	x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
	x86/boot: Save fields explicitly, zero out everything else
	x86/boot: Fix boot regression caused by bootparam sanitizing
	dm kcopyd: always complete failed jobs
	dm btree: fix order of block initialization in btree_split_beneath
	dm integrity: fix a crash due to BUG_ON in __journal_read_write()
	dm raid: add missing cleanup in raid_ctr()
	dm space map metadata: fix missing store of apply_bops() return value
	dm table: fix invalid memory accesses with too high sector number
	dm zoned: improve error handling in reclaim
	dm zoned: improve error handling in i/o map code
	dm zoned: properly handle backing device failure
	genirq: Properly pair kobject_del() with kobject_add()
	mm, page_owner: handle THP splits correctly
	mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
	mm/zsmalloc.c: fix race condition in zs_destroy_pool
	xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
	xfs: don't trip over uninitialized buffer on extent read of corrupted inode
	xfs: Move fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h
	xfs: Add helper function xfs_attr_try_sf_addname
	xfs: Add attibute set and helper functions
	xfs: Add attibute remove and helper functions
	xfs: always rejoin held resources during defer roll
	dm zoned: fix potential NULL dereference in dmz_do_reclaim()
	powerpc: Allow flush_(inval_)dcache_range to work across ranges >4GB
	rxrpc: Fix local endpoint refcounting
	rxrpc: Fix read-after-free in rxrpc_queue_local()
	rxrpc: Fix local endpoint replacement
	rxrpc: Fix local refcounting
	Linux 4.19.69

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9824a29e0434a6a80e2f32fdb88c0ac1fe8e5af5

Greg Kroah-Hartman   commited 2019-09-02 17:39:29 +02:00
12dc90c620
fscrypt: support decrypting multiple filesystem blocks per page
Rename fscrypt_decrypt_page() to fscrypt_decrypt_pagecache_blocks() and
redefine its behavior to decrypt all filesystem blocks in the given
region of the given page, rather than assuming that the region consists
of just one filesystem block.  Also remove the 'inode' and 'lblk_num'
parameters, since they can be retrieved from the page as it's already
assumed to be a pagecache page.

This is in preparation for allowing encryption on ext4 filesystems with
blocksize != PAGE_SIZE.

This is based on work by Chandan Rajendra.

Reviewed-by: Chandan Rajendra <chandan@linux.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>

Eric Biggers   authored and   Jaegeuk Kim   commited 2019-08-30 09:09:26 -07:00
8780629b7e
fscrypt: introduce fscrypt_decrypt_block_inplace()
Currently fscrypt_decrypt_page() does one of two logically distinct
things depending on whether FS_CFLG_OWN_PAGES is set in the filesystem's
fscrypt_operations: decrypt a pagecache page in-place, or decrypt a
filesystem block in-place in any page.  Currently these happen to share
the same implementation, but this conflates the notion of blocks and
pages.  It also makes it so that all callers have to provide inode and
lblk_num, when fscrypt could determine these itself for pagecache pages.

Therefore, move the FS_CFLG_OWN_PAGES behavior into a new function
fscrypt_decrypt_block_inplace().  This mirrors
fscrypt_encrypt_block_inplace().

This is in preparation for allowing encryption on ext4 filesystems with
blocksize != PAGE_SIZE.

Reviewed-by: Chandan Rajendra <chandan@linux.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>

Eric Biggers   authored and   Jaegeuk Kim   commited 2019-08-30 09:08:56 -07:00
4582236bb4
fscrypt: support encrypting multiple filesystem blocks per page
Rename fscrypt_encrypt_page() to fscrypt_encrypt_pagecache_blocks() and
redefine its behavior to encrypt all filesystem blocks from the given
region of the given page, rather than assuming that the region consists
of just one filesystem block.  Also remove the 'inode' and 'lblk_num'
parameters, since they can be retrieved from the page as it's already
assumed to be a pagecache page.

This is in preparation for allowing encryption on ext4 filesystems with
blocksize != PAGE_SIZE.

This is based on work by Chandan Rajendra.

Reviewed-by: Chandan Rajendra <chandan@linux.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>

Eric Biggers   authored and   Jaegeuk Kim   commited 2019-08-30 09:08:45 -07:00
fd0e18f34d
fscrypt: introduce fscrypt_encrypt_block_inplace()
fscrypt_encrypt_page() behaves very differently depending on whether the
filesystem set FS_CFLG_OWN_PAGES in its fscrypt_operations.  This makes
the function difficult to understand and document.  It also makes it so
that all callers have to provide inode and lblk_num, when fscrypt could
determine these itself for pagecache pages.

Therefore, move the FS_CFLG_OWN_PAGES behavior into a new function
fscrypt_encrypt_block_inplace().

This is in preparation for allowing encryption on ext4 filesystems with
blocksize != PAGE_SIZE.

Reviewed-by: Chandan Rajendra <chandan@linux.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>

Eric Biggers   authored and   Jaegeuk Kim   commited 2019-08-30 09:08:38 -07:00
ce7b7a207b
fscrypt: remove the "write" part of struct fscrypt_ctx
Now that fscrypt_ctx is not used for writes, remove the 'w' fields.

Reviewed-by: Chandan Rajendra <chandan@linux.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>

Eric Biggers   authored and   Jaegeuk Kim   commited 2019-08-30 09:08:20 -07:00
d568cccb4b
fscrypt: simplify bounce page handling
Currently, bounce page handling for writes to encrypted files is
unnecessarily complicated.  A fscrypt_ctx is allocated along with each
bounce page, page_private(bounce_page) points to this fscrypt_ctx, and
fscrypt_ctx::w::control_page points to the original pagecache page.

However, because writes don't use the fscrypt_ctx for anything else,
there's no reason why page_private(bounce_page) can't just point to the
original pagecache page directly.

Therefore, this patch makes this change.  In the process, it also cleans
up the API exposed to filesystems that allows testing whether a page is
a bounce page, getting the pagecache page from a bounce page, and
freeing a bounce page.

Reviewed-by: Chandan Rajendra <chandan@linux.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>

Eric Biggers   authored and   Jaegeuk Kim   commited 2019-08-30 09:08:07 -07:00
2edab9e36a
UPSTREAM: mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options
Upstream commit 6471384af2a6 ("mm: security: introduce init_on_alloc=1
and init_on_free=1 boot options").

Patch series "add init_on_alloc/init_on_free boot options", v10.

Provide init_on_alloc and init_on_free boot options.

These are aimed at preventing possible information leaks and making the
control-flow bugs that depend on uninitialized values more deterministic.

Enabling either of the options guarantees that the memory returned by the
page allocator and SL[AU]B is initialized with zeroes.  SLOB allocator
isn't supported at the moment, as its emulation of kmem caches complicates
handling of SLAB_TYPESAFE_BY_RCU caches correctly.

Enabling init_on_free also guarantees that pages and heap objects are
initialized right after they're freed, so it won't be possible to access
stale data by using a dangling pointer.

As suggested by Michal Hocko, right now we don't let the heap users to
disable initialization for certain allocations.  There's not enough
evidence that doing so can speed up real-life cases, and introducing ways
to opt-out may result in things going out of control.

This patch (of 2):

The new options are needed to prevent possible information leaks and make
control-flow bugs that depend on uninitialized values more deterministic.

This is expected to be on-by-default on Android and Chrome OS.  And it
gives the opportunity for anyone else to use it under distros too via the
boot args.  (The init_on_free feature is regularly requested by folks
where memory forensics is included in their threat models.)

init_on_alloc=1 makes the kernel initialize newly allocated pages and heap
objects with zeroes.  Initialization is done at allocation time at the
places where checks for __GFP_ZERO are performed.

init_on_free=1 makes the kernel initialize freed pages and heap objects
with zeroes upon their deletion.  This helps to ensure sensitive data
doesn't leak via use-after-free accesses.

Both init_on_alloc=1 and init_on_free=1 guarantee that the allocator
returns zeroed memory.  The two exceptions are slab caches with
constructors and SLAB_TYPESAFE_BY_RCU flag.  Those are never
zero-initialized to preserve their semantics.

Both init_on_alloc and init_on_free default to zero, but those defaults
can be overridden with CONFIG_INIT_ON_ALLOC_DEFAULT_ON and
CONFIG_INIT_ON_FREE_DEFAULT_ON.

If either SLUB poisoning or page poisoning is enabled, those options take
precedence over init_on_alloc and init_on_free: initialization is only
applied to unpoisoned allocations.

Slowdown for the new features compared to init_on_free=0, init_on_alloc=0:

hackbench, init_on_free=1:  +7.62% sys time (st.err 0.74%)
hackbench, init_on_alloc=1: +7.75% sys time (st.err 2.14%)

Linux build with -j12, init_on_free=1:  +8.38% wall time (st.err 0.39%)
Linux build with -j12, init_on_free=1:  +24.42% sys time (st.err 0.52%)
Linux build with -j12, init_on_alloc=1: -0.13% wall time (st.err 0.42%)
Linux build with -j12, init_on_alloc=1: +0.57% sys time (st.err 0.40%)

The slowdown for init_on_free=0, init_on_alloc=0 compared to the baseline
is within the standard error.

The new features are also going to pave the way for hardware memory
tagging (e.g.  arm64's MTE), which will require both on_alloc and on_free
hooks to set the tags for heap objects.  With MTE, tagging will have the
same cost as memory initialization.

Although init_on_free is rather costly, there are paranoid use-cases where
in-memory data lifetime is desired to be minimized.  There are various
arguments for/against the realism of the associated threat models, but
given that we'll need the infrastructure for MTE anyway, and there are
people who want wipe-on-free behavior no matter what the performance cost,
it seems reasonable to include it in this series.

[glider@google.com: v8]
  Link: http://lkml.kernel.org/r/20190626121943.131390-2-glider@google.com
[glider@google.com: v9]
  Link: http://lkml.kernel.org/r/20190627130316.254309-2-glider@google.com
[glider@google.com: v10]
  Link: http://lkml.kernel.org/r/20190628093131.199499-2-glider@google.com
Link: http://lkml.kernel.org/r/20190617151050.92663-2-glider@google.com
Signed-off-by: Alexander Potapenko <glider@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Michal Hocko <mhocko@suse.cz>		[page and dmapool parts
Acked-by: James Morris <jamorris@linux.microsoft.com>]
Cc: Christoph Lameter <cl@linux.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Sandeep Patil <sspatil@android.com>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Jann Horn <jannh@google.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Marco Elver <elver@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: If0620a6a8aed34c21e98458c965e94f5a9dfd297
Bug: 138435492
Test: Boot cuttlefish with and without
Test:   CONFIG_INIT_ON_ALLOC_DEFAULT_ON/CONFIG_INIT_ON_FREE_DEFAULT_ON
Signed-off-by: Alexander Potapenko <glider@google.com>

Alexander Potapenko   commited 2019-08-30 11:58:12 +02:00
a5587d8fce
rxrpc: Fix read-after-free in rxrpc_queue_local()
commit 06d9532fa6b34f12a6d75711162d47c17c1add72 upstream.

rxrpc_queue_local() attempts to queue the local endpoint it is given and
then, if successful, prints a trace line.  The trace line includes the
current usage count - but we're not allowed to look at the local endpoint
at this point as we passed our ref on it to the workqueue.

Fix this by reading the usage count before queuing the work item.

Also fix the reading of local->debug_id for trace lines, which must be done
with the same consideration as reading the usage count.

Fixes: 09d2bf595d ("rxrpc: Add a tracepoint to track rxrpc_local refcounting")
Reported-by: syzbot+78e71c5bab4f76a6a719@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

David Howells   authored and   Greg Kroah-Hartman   commited 2019-08-29 08:28:59 +02:00
a05354cbb8
ANDROID: Add a tracepoint for mapping inode to full path
This will be used by eBPF and the iorapd project for high speed
inode/dev numbers to file path lookup. Look at the inodemap CL for more
details about of eBPF and iorapd using the tracepoint.

This is planned to be used by the inodemap BPF program. Also, ART folks
have been using this tracepoint for debugging "unknown inode numer"
issues.

The tracepoint will be out of tree, and not sent upstream, since VFS
developers don't accept tracepoints strictly.

Test: Run "find /" command in emulator and measure completion time
with/without treacepoint. find does a flood of lookups which stresses
the tracepoint. No performance change observed.
Test: eBPF prototypes (wip) successfully read data from the tracepoint.

OOT Bug: 139663736
Bug: 135143784
Bug: 137393447
Change-Id: I657f374659673a9c8853530d73c0622dbdbab146
Signed-off-by: Joel Fernandes <joelaf@google.com>
(cherry picked from commit 987732fcbbe3ea78368c28e5a0d0d236be61420f)

Joel Fernandes   commited 2019-08-27 21:50:14 +00:00
2104283a8d
This is the 4.19.68 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1iS0cACgkQONu9yGCS
 aT7zbhAAyPU6KNVLa1Pj/xQf8puJ3v+FTws0X9Ii9zyWCNNuTXSi8mf4arP8oMjH
 NsYvhCGBHIQO0l3kFJRnOMLp0pPZPPUgHLvFWQljKWRABUOzMLjCWolnjegIPo8E
 cUwYkwx5T5oZtYH7ScxfQLiQUJB28L65+gi+/LBqANcEYL6WaSa2+UIBeVUzbMTt
 tQw6TAmE6f/kGAbmiQFeIdHj6Q9MrQyGBwTdhVSe+OENlZnZq8pxbwy3GXwEBuOP
 rtmUfZrSxdUmWBa7+/oW14TBe/c6j2LT0tVoyZdUFGZNbOUNv4vEImXghd28YSuv
 fppeSkom5di+RDH+B+LCNm+rV5vbfQqGTMuwBT6do2EDuQQ5KqS5kR8tULI4GKVl
 pNejWeK2qcNNloC7imH+4rHIy9AFewKz1ixbGolSaPXyCYfYEBx1xfpw4npng2+X
 aWJuk7/DnEEdzeKu9msdycQpf0aT5vkJqquBZQTzd5HAMlgqAF/sjvKjIsaUPNu1
 wDc+tyyAF0lObR7aswuhvttZ/8yczMW6pOJiM/XAfFn/a+Y7V2FRedGcIsxyeKOw
 YMNoW6VskIunShpbKhxVjPViI27NM0o8vmwCKmRQ6FRpxOX6vViNj+uQOjGQxfez
 N5g9jqxLsq9YGVQfoseS2Taao8JkBrTOW0wiJtE3/nwt/FaeHpU=
 =M37u
 -----END PGP SIGNATURE-----

Merge 4.19.68 into android-4.19

Changes in 4.19.68
	sh: kernel: hw_breakpoint: Fix missing break in switch statement
	seq_file: fix problem when seeking mid-record
	mm/hmm: fix bad subpage pointer in try_to_unmap_one
	mm: mempolicy: make the behavior consistent when MPOL_MF_MOVE* and MPOL_MF_STRICT were specified
	mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind
	mm/memcontrol.c: fix use after free in mem_cgroup_iter()
	mm/usercopy: use memory range to be accessed for wraparound check
	Revert "pwm: Set class for exported channels in sysfs"
	cpufreq: schedutil: Don't skip freq update when limits change
	xtensa: add missing isync to the cpu_reset TLB code
	ALSA: hda/realtek - Add quirk for HP Envy x360
	ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
	ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
	ALSA: hda - Apply workaround for another AMD chip 1022:1487
	ALSA: hda - Fix a memory leak bug
	ALSA: hda - Add a generic reboot_notify
	ALSA: hda - Let all conexant codec enter D3 when rebooting
	HID: holtek: test for sanity of intfdata
	HID: hiddev: avoid opening a disconnected device
	HID: hiddev: do cleanup in failure of opening a device
	Input: kbtab - sanity check for endpoint type
	Input: iforce - add sanity checks
	net: usb: pegasus: fix improper read if get_registers() fail
	netfilter: ebtables: also count base chain policies
	riscv: Make __fstate_clean() work correctly.
	clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1
	clk: sprd: Select REGMAP_MMIO to avoid compile errors
	clk: renesas: cpg-mssr: Fix reset control race condition
	xen/pciback: remove set but not used variable 'old_state'
	irqchip/gic-v3-its: Free unused vpt_page when alloc vpe table fail
	irqchip/irq-imx-gpcv2: Forward irq type to parent
	perf header: Fix divide by zero error if f_header.attr_size==0
	perf header: Fix use of unitialized value warning
	libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
	drm/bridge: lvds-encoder: Fix build error while CONFIG_DRM_KMS_HELPER=m
	Btrfs: fix deadlock between fiemap and transaction commits
	scsi: hpsa: correct scsi command status issue after reset
	scsi: qla2xxx: Fix possible fcport null-pointer dereferences
	drm/amdgpu: fix a potential information leaking bug
	ata: libahci: do not complain in case of deferred probe
	kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules
	kbuild: Check for unknown options with cc-option usage in Kconfig and clang
	arm64/efi: fix variable 'si' set but not used
	arm64: unwind: Prohibit probing on return_address()
	arm64/mm: fix variable 'pud' set but not used
	IB/core: Add mitigation for Spectre V1
	IB/mlx5: Fix MR registration flow to use UMR properly
	IB/mad: Fix use-after-free in ib mad completion handling
	drm: msm: Fix add_gpu_components
	drm/exynos: fix missing decrement of retry counter
	Revert "kmemleak: allow to coexist with fault injection"
	ocfs2: remove set but not used variable 'last_hash'
	asm-generic: fix -Wtype-limits compiler warnings
	arm64: KVM: regmap: Fix unexpected switch fall-through
	KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block
	staging: comedi: dt3000: Fix signed integer overflow 'divider * base'
	staging: comedi: dt3000: Fix rounding up of timer divisor
	iio: adc: max9611: Fix temperature reading in probe
	USB: core: Fix races in character device registration and deregistraion
	usb: gadget: udc: renesas_usb3: Fix sysfs interface of "role"
	usb: cdc-acm: make sure a refcount is taken early enough
	USB: CDC: fix sanity checks in CDC union parser
	USB: serial: option: add D-Link DWM-222 device ID
	USB: serial: option: Add support for ZTE MF871A
	USB: serial: option: add the BroadMobi BM818 card
	USB: serial: option: Add Motorola modem UARTs
	drm/i915/cfl: Add a new CFL PCI ID.
	dm: disable DISCARD if the underlying storage no longer supports it
	arm64: ftrace: Ensure module ftrace trampoline is coherent with I-side
	netfilter: conntrack: Use consistent ct id hash calculation
	Input: psmouse - fix build error of multiple definition
	iommu/amd: Move iommu_init_pci() to .init section
	bnx2x: Fix VF's VLAN reconfiguration in reload.
	bonding: Add vlan tx offload to hw_enc_features
	net: dsa: Check existence of .port_mdb_add callback before calling it
	net/mlx4_en: fix a memory leak bug
	net/packet: fix race in tpacket_snd()
	sctp: fix memleak in sctp_send_reset_streams
	sctp: fix the transport error_count check
	team: Add vlan tx offload to hw_enc_features
	tipc: initialise addr_trail_end when setting node addresses
	xen/netback: Reset nr_frags before freeing skb
	net/mlx5e: Only support tx/rx pause setting for port owner
	net/mlx5e: Use flow keys dissector to parse packets for ARFS
	mmc: sdhci-of-arasan: Do now show error message in case of deffered probe
	Linux 4.19.68

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8d9bb84a852deab3581f6cb37b4cb16e9bfe927c

Greg Kroah-Hartman   commited 2019-08-25 14:19:34 +02:00
bf707e4df1
drm/i915/cfl: Add a new CFL PCI ID.
commit d0e062ebb3a44b56a7e672da568334c76f763552 upstream.

One more CFL ID added to spec.

Cc: José Roberto de Souza <jose.souza@intel.com>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180803232721.20038-1-rodrigo.vivi@intel.com
Signed-off-by: Wan Yusof, Wan Fahim AsqalaniX <wan.fahim.asqalanix.wan.yusof@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Rodrigo Vivi   authored and   Greg Kroah-Hartman   commited 2019-08-25 10:48:01 +02:00
4af28b2f19
KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block
commit 5eeaf10eec394b28fad2c58f1f5c3a5da0e87d1c upstream.

Since commit commit 328e566479 ("KVM: arm/arm64: vgic: Defer
touching GICH_VMCR to vcpu_load/put"), we leave ICH_VMCR_EL2 (or
its GICv2 equivalent) loaded as long as we can, only syncing it
back when we're scheduled out.

There is a small snag with that though: kvm_vgic_vcpu_pending_irq(),
which is indirectly called from kvm_vcpu_check_block(), needs to
evaluate the guest's view of ICC_PMR_EL1. At the point were we
call kvm_vcpu_check_block(), the vcpu is still loaded, and whatever
changes to PMR is not visible in memory until we do a vcpu_put().

Things go really south if the guest does the following:

	mov x0, #0	// or any small value masking interrupts
	msr ICC_PMR_EL1, x0

	[vcpu preempted, then rescheduled, VMCR sampled]

	mov x0, #ff	// allow all interrupts
	msr ICC_PMR_EL1, x0
	wfi		// traps to EL2, so samping of VMCR

	[interrupt arrives just after WFI]

Here, the hypervisor's view of PMR is zero, while the guest has enabled
its interrupts. kvm_vgic_vcpu_pending_irq() will then say that no
interrupts are pending (despite an interrupt being received) and we'll
block for no reason. If the guest doesn't have a periodic interrupt
firing once it has blocked, it will stay there forever.

To avoid this unfortuante situation, let's resync VMCR from
kvm_arch_vcpu_blocking(), ensuring that a following kvm_vcpu_check_block()
will observe the latest value of PMR.

This has been found by booting an arm64 Linux guest with the pseudo NMI
feature, and thus using interrupt priorities to mask interrupts instead
of the usual PSTATE masking.

Cc: stable@vger.kernel.org # 4.12
Fixes: 328e566479 ("KVM: arm/arm64: vgic: Defer touching GICH_VMCR to vcpu_load/put")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Marc Zyngier   authored and   Greg Kroah-Hartman   commited 2019-08-25 10:47:59 +02:00
8c7053d162
asm-generic: fix -Wtype-limits compiler warnings
[ Upstream commit cbedfe11347fe418621bd188d58a206beb676218 ]

Commit d66acc39c7 ("bitops: Optimise get_order()") introduced a
compilation warning because "rx_frag_size" is an "ushort" while
PAGE_SHIFT here is 16.

The commit changed the get_order() to be a multi-line macro where
compilers insist to check all statements in the macro even when
__builtin_constant_p(rx_frag_size) will return false as "rx_frag_size"
is a module parameter.

In file included from ./arch/powerpc/include/asm/page_64.h:107,
                 from ./arch/powerpc/include/asm/page.h:242,
                 from ./arch/powerpc/include/asm/mmu.h:132,
                 from ./arch/powerpc/include/asm/lppaca.h:47,
                 from ./arch/powerpc/include/asm/paca.h:17,
                 from ./arch/powerpc/include/asm/current.h:13,
                 from ./include/linux/thread_info.h:21,
                 from ./arch/powerpc/include/asm/processor.h:39,
                 from ./include/linux/prefetch.h:15,
                 from drivers/net/ethernet/emulex/benet/be_main.c:14:
drivers/net/ethernet/emulex/benet/be_main.c: In function 'be_rx_cqs_create':
./include/asm-generic/getorder.h:54:9: warning: comparison is always
true due to limited range of data type [-Wtype-limits]
   (((n) < (1UL << PAGE_SHIFT)) ? 0 :  \
         ^
drivers/net/ethernet/emulex/benet/be_main.c:3138:33: note: in expansion
of macro 'get_order'
  adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
                                 ^~~~~~~~~

Fix it by moving all of this multi-line macro into a proper function,
and killing __get_order() off.

[akpm@linux-foundation.org: remove __get_order() altogether]
[cai@lca.pw: v2]
  Link: http://lkml.kernel.org/r/1564000166-31428-1-git-send-email-cai@lca.pw
Link: http://lkml.kernel.org/r/1563914986-26502-1-git-send-email-cai@lca.pw
Fixes: d66acc39c7 ("bitops: Optimise get_order()")
Signed-off-by: Qian Cai <cai@lca.pw>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: David Howells <dhowells@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Bill Wendling <morbo@google.com>
Cc: James Y Knight <jyknight@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Qian Cai   authored and   Greg Kroah-Hartman   commited 2019-08-25 10:47:58 +02:00
0755b6b152
UPSTREAM: dma-buf: add DMA_BUF_SET_NAME ioctls
This patch adds complimentary DMA_BUF_SET_NAME  ioctls, which lets
userspace processes attach a free-form name to each buffer.

This information can be extremely helpful for tracking and accounting
shared buffers.  For example, on Android, we know what each buffer will
be used for at allocation time: GL, multimedia, camera, etc.  The
userspace allocator can use DMA_BUF_SET_NAME to associate that
information with the buffer, so we can later give developers a
breakdown of how much memory they're allocating for graphics, camera,
etc.

Signed-off-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Chenbo Feng <fengc@google.com>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190613223408.139221-3-fengc@google.com
(cherry picked from commit bb2bb903042517b8fb17b2bc21e00512f2dcac01)

Bug: 135613055
Test: run dmabufinfo_test.cpp and check the name is showed up in
      /proc/pid/fd

Change-Id: Ib7f227b5e730c7ecfade14ad596ba3889eab1b0b

Greg Hackmann   authored and   Alistair Delva   commited 2019-08-19 23:08:58 +00:00
bf93f26d49
UPSTREAM: dma-buf: give each buffer a full-fledged inode
By traversing /proc/*/fd and /proc/*/map_files, processes with CAP_ADMIN
can get a lot of fine-grained data about how shmem buffers are shared
among processes.  stat(2) on each entry gives the caller a unique
ID (st_ino), the buffer's size (st_size), and even the number of pages
currently charged to the buffer (st_blocks / 512).

In contrast, all dma-bufs share the same anonymous inode.  So while we
can count how many dma-buf fds or mappings a process has, we can't get
the size of the backing buffers or tell if two entries point to the same
dma-buf.  On systems with debugfs, we can get a per-buffer breakdown of
size and reference count, but can't tell which processes are actually
holding the references to each buffer.

Replace the singleton inode with full-fledged inodes allocated by
alloc_anon_inode().  This involves creating and mounting a
mini-pseudo-filesystem for dma-buf, following the example in fs/aio.c.

Signed-off-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Chenbo Feng <fengc@google.com>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190613223408.139221-2-fengc@google.com
(cherry picked from commit ed63bb1d1f8469586006a9ca63c42344401aa2ab)

Bug: 135613055
Test: compile, read proc/pid/map_files to check inode

Change-Id: I7c71a71bba3d4266c77492b81e8b14dcf5b24a06

Greg Hackmann   authored and   Alistair Delva   commited 2019-08-19 23:08:47 +00:00
107a7b1608
UPSTREAM: virtio-gpu: add VIRTIO_GPU_F_EDID feature
The feature allows the guest request an EDID blob (describing monitor
capabilities) for a given scanout (aka virtual monitor connector).

It brings a new command message, which has just a scanout field (beside
the standard virtio-gpu header) and a response message which carries the
EDID data.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20181030063206.19528-2-kraxel@redhat.com
(cherry picked from commit 610c0c2b2813c36dc16838bbdbba4c29f8680dde)
Signed-off-by: Greg Hartman <ghartman@google.com>
BUG: 139386237
Change-Id: I1d4c11844307845b5829f1220b35938823ac7924

Gerd Hoffmann   authored and   Alistair Delva   commited 2019-08-19 11:29:53 -07:00
03f5384082
UPSTREAM: drm/virtio: add in/out fence support for explicit synchronization
When the execbuf call receives an in-fence it will get the dma_fence
related to that fence fd and wait on it before submitting the draw call.

On the out-fence side we get fence returned by the submitted draw call
and attach it to a sync_file and send the sync_file fd to userspace. On
error -1 is returned to userspace.

VIRTGPU_EXECBUF_FENCE_FD_IN & VIRTGPU_EXECBUF_FENCE_FD_OUT
are supported at the simultaneously and can be flagged
for simultaneously.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com>
Signed-off-by: Robert Foss <robert.foss@collabora.com>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20181112165157.32765-4-robert.foss@collabora.com
Suggested-by: Rob Herring <robh@kernel.org>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 2cd7b6f08bc4cf06d1f00f8b42720a8457861ca1)
Signed-off-by: Greg Hartman <ghartman@google.com>
BUG: 139386237
Change-Id: I169ce56d77083a8f7763225cd3e786ac057594c8

Robert Foss   authored and   Alistair Delva   commited 2019-08-19 11:29:52 -07:00
a62554de89
UPSTREAM: drm/virtio: add uapi for in and out explicit fences
Add a new field called fence_fd that will be used by userspace to send
in-fences to the kernel and receive out-fences created by the kernel.

This uapi enables virtio to take advantage of explicit synchronization of
dma-bufs.

There are two new flags:

* VIRTGPU_EXECBUF_FENCE_FD_IN to be used when passing an in-fence fd.
* VIRTGPU_EXECBUF_FENCE_FD_OUT to be used when requesting an out-fence fd

The execbuffer IOCTL is now read-write to allow the userspace to read the
out-fence.

On error -1 should be returned in the fence_fd field.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com>
Signed-off-by: Robert Foss <robert.foss@collabora.com>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20181112165157.32765-3-robert.foss@collabora.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit a56f9c868ccf56f0ab6e3e64693e6a39323bf8d8)
Signed-off-by: Greg Hartman <ghartman@google.com>
BUG: 139386237
Change-Id: Icdf083b865feb4e9b19998bc06ab18e2504608da

Robert Foss   authored and   Alistair Delva   commited 2019-08-19 11:29:52 -07:00
54c534cf51
UPSTREAM: drm: byteorder: add DRM_FORMAT_HOST_*
Add fourcc variants in host byte order.  With these at hand we don't
need #ifdefs in drivers which support framebuffers in cpu endianess.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20180905060445.15008-3-kraxel@redhat.com
(cherry picked from commit ec2fae2558ba6b7b166db20901545cab7e41a050)
Signed-off-by: Greg Hartman <ghartman@google.com>
BUG: 139386237
Change-Id: I2ca0265de54f1a0e5dc49f4c3575d3575f09d25e

Gerd Hoffmann   authored and   Alistair Delva   commited 2019-08-19 11:29:49 -07:00
4fdb8b8630
UPSTREAM: drm: add drm_connector_attach_edid_property()
drm_connector_init doesn't attach the edid property for some connector
types, drm_connector_attach_edid_property() can be used to enable the
edid property in these cases.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20181002111041.17053-2-kraxel@redhat.com
(cherry picked from commit 6b7e2d5c30322e6f30fcffb592615906ce9d3c6a)
Signed-off-by: Greg Hartman <ghartman@google.com>
BUG: 139386237
Change-Id: I876c559cc0ef4fae7e74a42f5d4b0efa18b2fff2

Gerd Hoffmann   authored and   Alistair Delva   commited 2019-08-19 11:29:49 -07:00
fb58ca2898
UPSTREAM: drm/prime: Add drm_gem_prime_mmap()
Add a generic PRIME GEM mmap function.

v2: Fix link in docs (Daniel Vetter)

Suggested-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181110145647.17580-3-noralf@tronnes.org
(cherry picked from commit 7698799f9554deeb0f3abb22857c3deb41c10db8)
Signed-off-by: Greg Hartman <ghartman@google.com>
BUG: 139386237
Change-Id: I0322d5051ce4db5ac3ded3d367c0f261864b1bb1

Noralf Trønnes   authored and   Alistair Delva   commited 2019-08-19 11:29:49 -07:00
8e18525889
This is the 4.19.67 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl1WZYYACgkQONu9yGCS
 aT5VjRAApdD6wuKcKhZ8j010Ni18w6W+3qs6IuIXv94eav0zFSRaO9Zp93lZq2p0
 h+k+ssZ+P8a4EuDquzDydlagno9hojHFAYr+9loPZlZUw578Jzg9JbJK9Z1MyQCo
 BCRElzZG67E+WjLP0wGHnS0oVhIoHlJaVWP3pEYkTJILY65ErLT/fYGs64YUAEKr
 Ct1pKoIHPEC0606IKx12kmV645ME4z6pI7g4kLDhk2BozglbxGlwdHgVuIe/NzDP
 PraR1gqMoOD2skjK673ozsZ65yuiVeqSTsbs49Xao1lAS6etUMbC/ACU/yrhL48H
 mMM/EFTSKb5TjJSxQAXU1ANQrm4X6n1yPkNW/MdthnPAotDY3Nda4NNVE9X2toM7
 XW0HfFdcVD7aJtpC/h6ckndGTaOGkHSPjhJtSlBEjF76BA+KhZ9hhcjNWng92bWL
 d5Nws4b82wvgM6T99mkZfbMc2MOopPMf+I94W0JcMa49+rXhyhJdrC72GpxKLdSq
 +XtZJupFWg0RrPlZfmc4Az8f/uY0UfR9gNSaHJokaZAkMzH2x4MzMnPxwRiXAw4W
 qz1s+sgZlqUQcWvODzaNvG1l7QtjD5rbdJ+FAjN2+16F8rep52Yl/IQffYr04DDD
 wikYmcUoMh8hCoj6Atj2LAAU9ulhl6ja8s0YpmHz/HQETufHAZc=
 =gOG+
 -----END PGP SIGNATURE-----

Merge 4.19.67 into android-4.19

Changes in 4.19.67
	iio: cros_ec_accel_legacy: Fix incorrect channel setting
	iio: adc: max9611: Fix misuse of GENMASK macro
	staging: gasket: apex: fix copy-paste typo
	staging: android: ion: Bail out upon SIGKILL when allocating memory.
	crypto: ccp - Fix oops by properly managing allocated structures
	crypto: ccp - Add support for valid authsize values less than 16
	crypto: ccp - Ignore tag length when decrypting GCM ciphertext
	usb: usbfs: fix double-free of usb memory upon submiturb error
	usb: iowarrior: fix deadlock on disconnect
	sound: fix a memory leak bug
	mmc: cavium: Set the correct dma max segment size for mmc_host
	mmc: cavium: Add the missing dma unmap when the dma has finished.
	loop: set PF_MEMALLOC_NOIO for the worker thread
	Input: usbtouchscreen - initialize PM mutex before using it
	Input: elantech - enable SMBus on new (2018+) systems
	Input: synaptics - enable RMI mode for HP Spectre X360
	x86/mm: Check for pfn instead of page in vmalloc_sync_one()
	x86/mm: Sync also unmappings in vmalloc_sync_all()
	mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
	perf annotate: Fix s390 gap between kernel end and module start
	perf db-export: Fix thread__exec_comm()
	perf record: Fix module size on s390
	x86/purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS
	gfs2: gfs2_walk_metadata fix
	usb: host: xhci-rcar: Fix timeout in xhci_suspend()
	usb: yurex: Fix use-after-free in yurex_delete
	usb: typec: tcpm: free log buf memory when remove debug file
	usb: typec: tcpm: remove tcpm dir if no children
	usb: typec: tcpm: Add NULL check before dereferencing config
	usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests
	can: rcar_canfd: fix possible IRQ storm on high load
	can: peak_usb: fix potential double kfree_skb()
	netfilter: nfnetlink: avoid deadlock due to synchronous request_module
	vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn
	netfilter: Fix rpfilter dropping vrf packets by mistake
	netfilter: conntrack: always store window size un-scaled
	netfilter: nft_hash: fix symhash with modulus one
	scripts/sphinx-pre-install: fix script for RHEL/CentOS
	drm/amd/display: Wait for backlight programming completion in set backlight level
	drm/amd/display: use encoder's engine id to find matched free audio device
	drm/amd/display: Fix dc_create failure handling and 666 color depths
	drm/amd/display: Only enable audio if speaker allocation exists
	drm/amd/display: Increase size of audios array
	iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND
	nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN
	mac80211: don't warn about CW params when not using them
	allocate_flower_entry: should check for null deref
	hwmon: (nct6775) Fix register address and added missed tolerance for nct6106
	drm: silence variable 'conn' set but not used
	cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
	s390/qdio: add sanity checks to the fast-requeue path
	ALSA: compress: Fix regression on compressed capture streams
	ALSA: compress: Prevent bypasses of set_params
	ALSA: compress: Don't allow paritial drain operations on capture streams
	ALSA: compress: Be more restrictive about when a drain is allowed
	perf tools: Fix proper buffer size for feature processing
	perf probe: Avoid calling freeing routine multiple times for same pointer
	drbd: dynamically allocate shash descriptor
	ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id()
	nvme: fix multipath crash when ANA is deactivated
	ARM: davinci: fix sleep.S build error on ARMv4
	ARM: dts: bcm: bcm47094: add missing #cells for mdio-bus-mux
	scsi: megaraid_sas: fix panic on loading firmware crashdump
	scsi: ibmvfc: fix WARN_ON during event pool release
	scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG
	test_firmware: fix a memory leak bug
	tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
	perf/core: Fix creating kernel counters for PMUs that override event->cpu
	s390/dma: provide proper ARCH_ZONE_DMA_BITS value
	HID: sony: Fix race condition between rumble and device remove.
	x86/purgatory: Do not use __builtin_memcpy and __builtin_memset
	ALSA: usb-audio: fix a memory leak bug
	can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
	can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
	hwmon: (nct7802) Fix wrong detection of in4 presence
	drm/i915: Fix wrong escape clock divisor init for GLK
	ALSA: firewire: fix a memory leak bug
	ALSA: hiface: fix multiple memory leak bugs
	ALSA: hda - Don't override global PCM hw info flag
	ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457)
	mac80211: don't WARN on short WMM parameters from AP
	dax: dax_layout_busy_page() should not unmap cow pages
	SMB3: Fix deadlock in validate negotiate hits reconnect
	smb3: send CAP_DFS capability during session setup
	NFSv4: Fix an Oops in nfs4_do_setattr
	KVM: Fix leak vCPU's VMCS value into other pCPU
	mwifiex: fix 802.11n/WPA detection
	iwlwifi: don't unmap as page memory that was mapped as single
	iwlwifi: mvm: fix an out-of-bound access
	iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41
	iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support
	Linux 4.19.67

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5ea813ed5ba6d1eeda51eb4031395ee3e8ba54c3

Greg Kroah-Hartman   commited 2019-08-16 11:27:10 +02:00
b1e96f1650
KVM: Fix leak vCPU's VMCS value into other pCPU
commit 17e433b54393a6269acbcb792da97791fe1592d8 upstream.

After commit d73eb57b80b (KVM: Boost vCPUs that are delivering interrupts), a
five years old bug is exposed. Running ebizzy benchmark in three 80 vCPUs VMs
on one 80 pCPUs Skylake server, a lot of rcu_sched stall warning splatting
in the VMs after stress testing:

 INFO: rcu_sched detected stalls on CPUs/tasks: { 4 41 57 62 77} (detected by 15, t=60004 jiffies, g=899, c=898, q=15073)
 Call Trace:
   flush_tlb_mm_range+0x68/0x140
   tlb_flush_mmu.part.75+0x37/0xe0
   tlb_finish_mmu+0x55/0x60
   zap_page_range+0x142/0x190
   SyS_madvise+0x3cd/0x9c0
   system_call_fastpath+0x1c/0x21

swait_active() sustains to be true before finish_swait() is called in
kvm_vcpu_block(), voluntarily preempted vCPUs are taken into account
by kvm_vcpu_on_spin() loop greatly increases the probability condition
kvm_arch_vcpu_runnable(vcpu) is checked and can be true, when APICv
is enabled the yield-candidate vCPU's VMCS RVI field leaks(by
vmx_sync_pir_to_irr()) into spinning-on-a-taken-lock vCPU's current
VMCS.

This patch fixes it by checking conservatively a subset of events.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Marc Zyngier <Marc.Zyngier@arm.com>
Cc: stable@vger.kernel.org
Fixes: 98f4a1467 (KVM: add kvm_arch_vcpu_runnable() test to kvm_vcpu_on_spin() loop)
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Wanpeng Li   authored and   Greg Kroah-Hartman   commited 2019-08-16 10:12:53 +02:00
2bc73d9141
ALSA: compress: Fix regression on compressed capture streams
[ Upstream commit 4475f8c4ab7b248991a60d9c02808dbb813d6be8 ]

A previous fix to the stop handling on compressed capture streams causes
some knock on issues. The previous fix updated snd_compr_drain_notify to
set the state back to PREPARED for capture streams. This causes some
issues however as the handling for snd_compr_poll differs between the
two states and some user-space applications were relying on the poll
failing after the stream had been stopped.

To correct this regression whilst still fixing the original problem the
patch was addressing, update the capture handling to skip the PREPARED
state rather than skipping the SETUP state as it has done until now.

Fixes: 4f2ab5e1d13d ("ALSA: compress: Fix stop handling on compressed capture streams")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Charles Keepax   authored and   Greg Kroah-Hartman   commited 2019-08-16 10:12:47 +02:00
b9e2fa1e15
nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN
[ Upstream commit 5edaac063bbf1267260ad2a5b9bb803399343e58 ]

NL80211_HE_MAX_CAPABILITY_LEN has changed between D2.0 and D4.0. It is now
MAC (6) + PHY (11) + MCS (12) + PPE (25) = 54.

Signed-off-by: John Crispin <john@phrozen.org>
Link: https://lore.kernel.org/r/20190627095832.19445-1-john@phrozen.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

John Crispin   authored and   Greg Kroah-Hartman   commited 2019-08-16 10:12:45 +02:00
f2fd898172
crypto: ccp - Add support for valid authsize values less than 16
commit 9f00baf74e4b6f79a3a3dfab44fb7bb2e797b551 upstream.

AES GCM encryption allows for authsize values of 4, 8, and 12-16 bytes.
Validate the requested authsize, and retain it to save in the request
context.

Fixes: 36cf515b9b ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Gary R Hook   authored and   Greg Kroah-Hartman   commited 2019-08-16 10:12:38 +02:00
30692edea3
BACKPORT: arch: wire-up pidfd_open()
This wires up the pidfd_open() syscall into all arches at once.

Signed-off-by: Christian Brauner <christian@brauner.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Jann Horn <jannh@google.com>
Cc: Andy Lutomirsky <luto@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Aleksa Sarai <cyphar@cyphar.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-api@vger.kernel.org
Cc: linux-alpha@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-ia64@vger.kernel.org
Cc: linux-m68k@lists.linux-m68k.org
Cc: linux-mips@vger.kernel.org
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-s390@vger.kernel.org
Cc: linux-sh@vger.kernel.org
Cc: sparclinux@vger.kernel.org
Cc: linux-xtensa@linux-xtensa.org
Cc: linux-arch@vger.kernel.org
Cc: x86@kernel.org

(cherry picked from commit 7615d9e1780e26e0178c93c55b73309a5dc093d7)

Conflicts:
        arch/alpha/kernel/syscalls/syscall.tbl
        arch/ia64/kernel/syscalls/syscall.tbl
        arch/m68k/kernel/syscalls/syscall.tbl
        arch/microblaze/kernel/syscalls/syscall.tbl
        arch/mips/kernel/syscalls/syscall_n32.tbl
        arch/mips/kernel/syscalls/syscall_n64.tbl
        arch/mips/kernel/syscalls/syscall_o32.tbl
        arch/parisc/kernel/syscalls/syscall.tbl
        arch/powerpc/kernel/syscalls/syscall.tbl
        arch/sh/kernel/syscalls/syscall.tbl
        arch/sparc/kernel/syscalls/syscall.tbl
        arch/xtensa/kernel/syscalls/syscall.tbl

(1. Skipped syscall.tbl modifications for missing architectures.)

Bug: 135608568
Test: test program using syscall(__NR_sys_pidfd_open,..) and poll()
Change-Id: I74ab09294c648b0de1a2325146938d7495c21975
Signed-off-by: Suren Baghdasaryan <surenb@google.com>

Christian Brauner   authored and   Joel Fernandes (Google)   commited 2019-08-12 13:36:37 -04:00
6c0620339f