206 Commits

Author	SHA1	Message	Date
Srinivasarao P	90264576e2	Merge android-4.19-stable.125 (a483478) into msm-4.19 ... * refs/heads/tmp-a483478: UPSTREAM: arm64: vdso: Build vDSO with -ffixed-x18 Revert "drm/dsi: Fix byte order of DCS set/get brightness" Reverting below patches from android-4.19-stable.125 Linux 4.19.125 rxrpc: Fix ack discard rxrpc: Trace discarded ACKs iio: adc: stm32-dfsdm: fix device used to request dma iio: adc: stm32-dfsdm: Use dma_request_chan() instead dma_request_slave_channel() iio: adc: stm32-adc: fix device used to request dma iio: adc: stm32-adc: Use dma_request_chan() instead dma_request_slave_channel() x86/unwind/orc: Fix unwind_get_return_address_ptr() for inactive tasks rxrpc: Fix a memory leak in rxkad_verify_response() rapidio: fix an error in get_user_pages_fast() error handling ipack: tpci200: fix error return code in tpci200_register() mei: release me_cl object reference misc: rtsx: Add short delay after exit from ASPM iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()' iio: sca3000: Remove an erroneous 'get_device()' staging: greybus: Fix uninitialized scalar variable staging: iio: ad2s1210: Fix SPI reading Revert "gfs2: Don't demote a glock until its revokes are written" brcmfmac: abort and release host after error tty: serial: qcom_geni_serial: Fix wrap around of TX buffer cxgb4/cxgb4vf: Fix mac_hlist initialization and free cxgb4: free mac_hlist properly net: bcmgenet: abort suspend on error net: bcmgenet: code movement Revert "net/ibmvnic: Fix EOI when running in XIVE mode" media: fdp1: Fix R-Car M3-N naming in debug message thunderbolt: Drop duplicated get_switch_at_route() staging: most: core: replace strcpy() by strscpy() libnvdimm/btt: Fix LBA masking during 'free list' population libnvdimm/btt: Remove unnecessary code in btt_freelist_init nfit: Add Hyper-V NVDIMM DSM command set to white list powerpc/64s: Disable STRICT_KERNEL_RWX powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE drm/i915/gvt: Init DPLL/DDI vreg for virtual display instead of inheritance. dmaengine: owl: Use correct lock in owl_dma_get_pchan() dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()' apparmor: Fix aa_label refcnt leak in policy_update apparmor: fix potential label refcnt leak in aa_change_profile apparmor: Fix use-after-free in aa_audit_rule_init drm/etnaviv: fix perfmon domain interation ALSA: hda/realtek - Add more fixup entries for Clevo machines ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Xtreme ALSA: pcm: fix incorrect hw_base increase ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio option padata: purge get_cpu and reorder_via_wq from padata_do_serial padata: initialize pd->cpu with effective cpumask padata: Replace delayed timer with immediate workqueue in padata_reorder ARM: futex: Address build warning platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA USB: core: Fix misleading driver bug report stmmac: fix pointer check after utilization in stmmac_interrupt ceph: fix double unlock in handle_cap_export() HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A keyboard-dock gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp() x86/apic: Move TSC deadline timer debug printk HID: i2c-hid: reset Synaptics SYNA2393 on resume scsi: ibmvscsi: Fix WARN_ON during event pool release component: Silence bind error on -EPROBE_DEFER aquantia: Fix the media type of AQC100 ethernet controller in the driver vhost/vsock: fix packet delivery order to monitoring devices configfs: fix config_item refcnt leak in configfs_rmdir() scsi: qla2xxx: Delete all sessions before unregister local nvme port scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead HID: alps: Add AUI1657 device ID HID: multitouch: add eGalaxTouch P80H84 support gcc-common.h: Update for GCC 10 ubi: Fix seq_file usage in detailed_erase_block_info debugfs file i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()' iommu/amd: Fix over-read of ACPI UID from IVRS table ubifs: remove broken lazytime support fix multiplication overflow in copy_fdtable() mtd: spinand: Propagate ECC information to the MTD structure ima: Fix return value of ima_write_policy() evm: Check also if *tfm is an error pointer in init_desc() ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash() riscv: set max_pfn to the PFN of the last page KVM: SVM: Fix potential memory leak in svm_cpu_init() i2c: dev: Fix the race between the release of i2c_dev and cdev ubsan: build ubsan.c more conservatively x86/uaccess, ubsan: Fix UBSAN vs. SMAP ANDROID: scsi: ufs: Handle clocks when lrbp fails ANDROID: fscrypt: handle direct I/O with IV_INO_LBLK_32 BACKPORT: FROMLIST: fscrypt: add support for IV_INO_LBLK_32 policies ANDROID: Update the ABI xml and qcom whitelist ANDROID: Fix build.config.gki-debug Linux 4.19.124 Makefile: disallow data races on gcc-10 as well KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce ARM: dts: r8a7740: Add missing extal2 to CPG node arm64: dts: renesas: r8a77980: Fix IPMMU VIP[01] nodes ARM: dts: r8a73a4: Add missing CMT1 interrupts arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards clk: Unlink clock if failed to prepare or enable Revert "ALSA: hda/realtek: Fix pop noise on ALC225" usb: gadget: legacy: fix error return code in cdc_bind() usb: gadget: legacy: fix error return code in gncm_bind() usb: gadget: audio: Fix a missing error return value in audio_bind() usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()' dwc3: Remove check for HWO flag in dwc3_gadget_ep_reclaim_trb_sg() clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks exec: Move would_dump into flush_old_exec x86/unwind/orc: Fix error handling in __unwind_start() x86: Fix early boot crash on gcc-10, third try cifs: fix leaked reference on requeued write ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries ARM: dts: dra7: Fix bus_dma_limit for PCIe usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list USB: gadget: fix illegal array access in binding with UDC usb: host: xhci-plat: keep runtime active when removing host usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset ALSA: rawmidi: Fix racy buffer resize under concurrent accesses ALSA: hda/realtek - Limit int mic boost for Thinkpad T530 gcc-10: avoid shadowing standard library 'free()' in crypto gcc-10: disable 'restrict' warning for now gcc-10: disable 'stringop-overflow' warning for now gcc-10: disable 'array-bounds' warning for now gcc-10: disable 'zero-length-bounds' warning for now Stop the ad-hoc games with -Wno-maybe-initialized kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig gcc-10 warnings: fix low-hanging fruit pnp: Use list_for_each_entry() instead of open coding hwmon: (da9052) Synchronize access with mfd IB/mlx4: Test return value of calls to ib_get_cached_pkey netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() arm64: fix the flush_icache_range arguments in machine_kexec netfilter: conntrack: avoid gcc-10 zero-length-bounds warning NFSv4: Fix fscache cookie aux_data to ensure change_attr is included nfs: fscache: use timespec64 in inode auxdata NFS: Fix fscache super_cookie index_key from changing after umount mmc: block: Fix request completion in the CQE timeout path mmc: core: Check request type before completing the request i40iw: Fix error handling in i40iw_manage_arp_cache() pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler pinctrl: baytrail: Enable pin configuration setting for GPIO chip gfs2: Another gfs2_walk_metadata fix ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse ipc/util.c: sysvipc_find_ipc() incorrectly updates position index drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() ALSA: hda/hdmi: fix race in monitor detection during probe cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once dmaengine: mmp_tdma: Reset channel error on release dmaengine: pch_dma.c: Avoid data race between probe and irq handler riscv: fix vdso build with lld tcp: fix SO_RCVLOWAT hangs with fat skbs net: tcp: fix rx timestamp behavior for tcp_recvmsg netprio_cgroup: Fix unlimited memory leak of v2 cgroups net: ipv4: really enforce backoff for redirects net: dsa: loop: Add module soft dependency hinic: fix a bug of ndo_stop virtio_net: fix lockdep warning on 32 bit tcp: fix error recovery in tcp_zerocopy_receive() Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu" pppoe: only process PADT targeted at local interfaces net: phy: fix aneg restart in phy_ethtool_set_eee netlabel: cope with NULL catmap net: fix a potential recursive NETDEV_FEAT_CHANGE mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040 scsi: sg: add sg_remove_request in sg_write virtio-blk: handle block_device_operations callbacks after hot unplug drop_monitor: work around gcc-10 stringop-overflow warning net: moxa: Fix a potential double 'free_irq()' net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()' shmem: fix possible deadlocks on shmlock_user_lock net: dsa: Do not make user port errors fatal ANDROID: rtc: class: call hctosys in resource managed registration ANDROID: GKI: Update the ABI xml and whitelist ANDROID: power_supply: Add RTX power-supply property f2fs: flush dirty meta pages when flushing them f2fs: fix checkpoint=disable:%u%% f2fs: rework filename handling f2fs: split f2fs_d_compare() from f2fs_match_name() f2fs: don't leak filename in f2fs_try_convert_inline_dir() ANDROID: clang: update to 11.0.1 FROMLIST: x86_64: fix jiffies ODR violation ANDROID: arm64: vdso: Fix removing SCS flags ANDROID: GKI: Update the ABI xml and whitelist ANDROID: Incremental fs: wake up log pollers less often ANDROID: Incremental fs: Fix scheduling while atomic error ANDROID: Incremental fs: Avoid continually recalculating hashes ANDROID: export: Disable symbol trimming on modules ANDROID: GKI: Update the ABI xml and whitelist ANDROID: fscrypt: set dun_bytes more precisely ANDROID: dm-default-key: set dun_bytes more precisely ANDROID: block: backport the ability to specify max_dun_bytes ANDROID: Revert "ANDROID: GKI: gki_defconfig: CONFIG_DM_DEFAULT_KEY=m" Linux 4.19.123 ipc/mqueue.c: change __do_notify() to bypass check_kill_permission() scripts/decodecode: fix trapping instruction formatting objtool: Fix stack offset tracking for indirect CFAs netfilter: nf_osf: avoid passing pointer to local var netfilter: nat: never update the UDP checksum when it's 0 x86/unwind/orc: Fix premature unwind stoppage due to IRET frames x86/unwind/orc: Fix error path for bad ORC entry type x86/unwind/orc: Prevent unwinding before ORC initialization x86/unwind/orc: Don't skip the first frame for inactive tasks x86/entry/64: Fix unwind hints in rewind_stack_do_exit() x86/entry/64: Fix unwind hints in kernel exit path x86/entry/64: Fix unwind hints in register clearing code batman-adv: Fix refcnt leak in batadv_v_ogm_process batman-adv: Fix refcnt leak in batadv_store_throughput_override batman-adv: Fix refcnt leak in batadv_show_throughput_override batman-adv: fix batadv_nc_random_weight_tq KVM: VMX: Mark RCX, RDX and RSI as clobbered in vmx_vcpu_run()'s asm blob KVM: VMX: Explicitly reference RCX as the vmx_vcpu pointer in asm blobs coredump: fix crash when umh is disabled staging: gasket: Check the return value of gasket_get_bar_index() mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous() arm64: hugetlb: avoid potential NULL dereference KVM: arm64: Fix 32bit PC wrap-around KVM: arm: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER tracing: Add a vmalloc_sync_mappings() for safe measure USB: serial: garmin_gps: add sanity checking for data length USB: uas: add quirk for LaCie 2Big Quadra HID: usbhid: Fix race between usbhid_close() and usbhid_stop() sctp: Fix bundling of SHUTDOWN with COOKIE-ACK HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices net: stricter validation of untrusted gso packets bnxt_en: Fix VF anti-spoof filter setup. bnxt_en: Improve AER slot reset. net/mlx5: Fix command entry leak in Internal Error State net/mlx5: Fix forced completion access non initialized command entry bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features(). tipc: fix partial topology connection closure sch_sfq: validate silly quantum values sch_choke: avoid potential panic in choke_reset() net: usb: qmi_wwan: add support for DW5816e net_sched: sch_skbprio: add message validation to skbprio_change() net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc() net: macsec: preserve ingress frame ordering fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks dp83640: reverse arguments to list_add_tail vt: fix unicode console freeing with a common interface tracing/kprobes: Fix a double initialization typo USB: serial: qcserial: Add DW5816e support ANDROID: usb: gadget: Add missing inline qualifier to stub functions ANDROID: Drop ABI monitoring from KASAN build config ANDROID: Rename build.config.gki.arch_kasan ANDROID: GKI: Enable CONFIG_STATIC_USERMODEHELPER ANDROID: dm-default-key: Update key size for wrapped keys ANDROID: gki_defconfig: enable CONFIG_MMC_CRYPTO ANDROID: mmc: MMC crypto API ANDROID: GKI: Update the ABI xml and whitelist ANDROID: GKI: add missing exports for cam_smmu_api.ko Linux 4.19.122 drm/atomic: Take the atomic toys away from X cgroup, netclassid: remove double cond_resched mac80211: add ieee80211_is_any_nullfunc() platform/x86: GPD pocket fan: Fix error message when temp-limits are out of range ALSA: hda: Match both PCI ID and SSID for driver blacklist hexagon: define ioremap_uc hexagon: clean up ioremap mfd: intel-lpss: Use devm_ioremap_uc for MMIO lib: devres: add a helper function for ioremap_uc drm/amdgpu: Fix oops when pp_funcs is unset in ACPI event sctp: Fix SHUTDOWN CTSN Ack in the peer restart case net: systemport: suppress warnings on failed Rx SKB allocations net: bcmgenet: suppress warnings on failed Rx SKB allocations lib/mpi: Fix building for powerpc with clang scripts/config: allow colons in option strings for sed s390/ftrace: fix potential crashes when switching tracers cifs: protect updating server->dstaddr with a spinlock ASoC: rsnd: Fix "status check failed" spam for multi-SSI ASoC: rsnd: Don't treat master SSI in multi SSI setup as parent net: stmmac: Fix sub-second increment net: stmmac: fix enabling socfpga's ptp_ref_clock wimax/i2400m: Fix potential urb refcnt leak drm/amdgpu: Correctly initialize thermal controller for GPUs with Powerplay table v0 (e.g Hawaii) ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry ASoC: rsnd: Fix HDMI channel mapping for multi-SSI mode ASoC: rsnd: Fix parent SSI start/stop in multi-SSI mode usb: dwc3: gadget: Properly set maxpacket limit ASoC: sgtl5000: Fix VAG power-on handling selftests/ipc: Fix test failure seen after initial test run ASoC: topology: Check return value of pcm_new_ver powerpc/pci/of: Parse unassigned resources vhost: vsock: kick send_pkt worker once device is started ANDROID: GKI: fix build warning on 32bits due to ASoC msm change ANDROID: GKI: fix build error on 32bits due to ASoC msm change ANDROID: GKI: update abi definition due to FAIR_GROUP_SCHED removal ANDROID: GKI: Remove FAIR_GROUP_SCHED ANDROID: GKI: BULK update ABI XML representation and qcom whitelist ANDROID: build.config.gki.aarch64: Enable WHITELIST_STRICT_MODE ANDROID: GKI: Update the ABI xml and qcom whitelist ANDROID: remove unused variable ANDROID: Drop ABI monitoring from KASAN build config Linux 4.19.121 mmc: meson-mx-sdio: remove the broken ->card_busy() op mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY mmc: sdhci-msm: Enable host capabilities pertains to R1b response mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers mmc: sdhci-xenon: fix annoying 1.8V regulator warning mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout loop btrfs: transaction: Avoid deadlock due to bad initialization timing of fs_info::journal_info btrfs: fix partial loss of prealloc extent past i_size after fsync selinux: properly handle multiple messages in selinux_netlink_send() dmaengine: dmatest: Fix iteration non-stop logic nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl ALSA: opti9xx: shut up gcc-10 range warning iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system scsi: target/iblock: fix WRITE SAME zeroing iommu/qcom: Fix local_base status check vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() vfio: avoid possible overflow in vfio_iommu_type1_pin_pages RDMA/core: Fix race between destroy and release FD object RDMA/core: Prevent mixed use of FDs between shared ufiles RDMA/mlx4: Initialize ib_spec on the stack RDMA/mlx5: Set GRH fields in query QP on RoCE scsi: qla2xxx: check UNLOADING before posting async work scsi: qla2xxx: set UNLOADING before waiting for session deletion dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath dm writecache: fix data corruption when reloading the target dm verity fec: fix hash block number in verity_fec_decode PM: hibernate: Freeze kernel threads in software_resume() PM: ACPI: Output correct message on target power state ALSA: pcm: oss: Place the plugin buffer overflow checks correctly ALSA: hda/hdmi: fix without unlocked before return ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter btrfs: fix block group leak when removing fails drm/qxl: qxl_release use after free drm/qxl: qxl_release leak in qxl_hw_surface_alloc() drm/qxl: qxl_release leak in qxl_draw_dirty_fb() drm/edid: Fix off-by-one in DispID DTD pixel clock ANDROID: GKI: Bulk update ABI XML representation ANDROID: GKI: Enable net testing options ANDROID: gki_defconfig: Enable CONFIG_REMOTEPROC ANDROID: Rename build.config.gki.arch_kasan ANDROID: GKI: Update ABI for IOMMU ANDROID: Incremental fs: Fix issues with very large files ANDROID: Correct build.config branch name ANDROID: GKI: Bulk update ABI XML representation and whitelist. UPSTREAM: vdso: Fix clocksource.h macro detection ANDROID: GKI: update abi definition due to added padding ANDROID: GKI: networking: add Android ABI padding to a lot of networking structures ANDROID: GKI: dma-mapping.h: add Android ABI padding to a structure ANDROID: GKI: ioport.h: add Android ABI padding to a structure ANDROID: GKI: iomap.h: add Android ABI padding to a structure ANDROID: GKI: genhd.h: add Android ABI padding to some structures ANDROID: GKI: hrtimer.h: add Android ABI padding to a structure ANDROID: GKI: ethtool.h: add Android ABI padding to a structure ANDROID: GKI: sched: add Android ABI padding to some structures ANDROID: GKI: kernfs.h: add Android ABI padding to some structures ANDROID: GKI: kobject.h: add Android ABI padding to some structures ANDROID: GKI: mm.h: add Android ABI padding to a structure ANDROID: GKI: mmu_notifier.h: add Android ABI padding to some structures ANDROID: GKI: pci: add Android ABI padding to some structures ANDROID: GKI: irqdomain.h: add Android ABI padding to a structure ANDROID: GKI: blk_types.h: add Android ABI padding to a structure ANDROID: GKI: scsi.h: add Android ABI padding to a structure ANDROID: GKI: quota.h: add Android ABI padding to some structures ANDROID: GKI: timer.h: add Android ABI padding to a structure ANDROID: GKI: user_namespace.h: add Android ABI padding to a structure FROMGIT: f2fs: fix missing check for f2fs_unlock_op Linux 4.19.120 propagate_one(): mnt_set_mountpoint() needs mount_lock ext4: check for non-zero journal inum in ext4_calculate_overhead qed: Fix use after free in qed_chain_free bpf, x86_32: Fix clobbering of dst for BPF_JSET hwmon: (jc42) Fix name to have no illegal characters ext4: convert BUG_ON's to WARN_ON's in mballoc.c ext4: increase wait time needed before reuse of deleted inode numbers ext4: use matching invalidatepage in ext4_writepage arm64: Delete the space separator in __emit_inst ALSA: hda: call runtime_allow() for all hda controllers xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status objtool: Support Clang non-section symbols in ORC dump objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN scsi: target: fix PR IN / READ FULL STATUS for FC ALSA: hda: Explicitly permit using autosuspend if runtime PM is supported ALSA: hda: Keep the controller initialization even if no codecs found xfs: fix partially uninitialized structure in xfs_reflink_remap_extent x86: hyperv: report value of misc_features net: fec: set GPR bit on suspend by DT configuration. bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B xfs: clear PF_MEMALLOC before exiting xfsaild thread mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path bpf, x86_32: Fix incorrect encoding in BPF_LDX zero-extension perf/core: fix parent pid/tid in task exit events net/mlx5: Fix failing fw tracer allocation on s390 cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled ARM: dts: bcm283x: Disable dsi0 node PCI: Move Apex Edge TPU class quirk to fix BAR assignment PCI: Avoid ASMedia XHCI USB PME# from D0 defect svcrdma: Fix leak of svc_rdma_recv_ctxt objects svcrdma: Fix trace point use-after-free race xfs: acquire superblock freeze protection on eofblocks scans net/cxgb4: Check the return from t4_query_params properly rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket i2c: altera: use proper variable to hold errno nfsd: memory corruption in nfsd4_lock() ASoC: wm8960: Fix wrong clock after suspend & resume ASoC: tas571x: disable regulators on failed probe ASoC: q6dsp6: q6afe-dai: add missing channels to MI2S DAIs iio:ad7797: Use correct attribute_group usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete usb: dwc3: gadget: Do link recovery for SS and SSP binder: take read mode of mmap_sem in binder_alloc_free_page() include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer remoteproc: Fix wrong rvring index computation FROMLIST: PM / devfreq: Restart previous governor if new governor fails to start ANDROID: GKI: arm64: Enable GZIP and LZ4 kernel compression modes ANDROID: GKI: arm64: gki_defconfig: Set arm_smmu configuration ANDROID: GKI: iommu/arm-smmu: Modularize ARM SMMU driver ANDROID: GKI: iommu: Snapshot of vendor changes ANDROID: GKI: Additions to ARM SMMU register definitions ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor ANDROID: GKI: common: dma-mapping: make dma_common_contiguous_remap more robust ANDROID: GKI: dma-coherent: Expose device base address and size ANDROID: GKI: arm64: add support for NO_KERNEL_MAPPING and STRONGLY_ORDERED ANDROID: GKI: dma-mapping: Add dma_remap functions ANDROID: GKI: arm64: Support early fixup for CMA ANDROID: GKI: iommu: dma-mapping-fast: Fast ARMv7/v8 Long Descriptor Format ANDROID: GKI: arm64: dma-mapping: add support for IOMMU mapper ANDROID: GKI: add ARCH_NR_GPIO for ABI match ANDROID: GKI: kernel: Export symbol of `cpu_do_idle` ANDROID: GKI: kernel: Export symbols needed by msm_minidump.ko and minidump_log.ko (again) ANDROID: GKI: add missing exports for __flush_dcache_area ANDROID: GKI: arm64: Export caching APIs ANDROID: GKI: arm64: provide dma cache routines with same API as 32 bit ANDROID: gki_defconfig: add FORTIFY_SOURCE, remove SPMI_MSM_PMIC_ARB Revert "ANDROID: GKI: spmi: pmic-arb: don't enable SPMI_MSM_PMIC_ARB by default" ANDROID: GKI: update abi definitions after adding padding ANDROID: GKI: elevator: add Android ABI padding to some structures ANDROID: GKI: dentry: add Android ABI padding to some structures ANDROID: GKI: bio: add Android ABI padding to some structures ANDROID: GKI: scsi: add Android ABI padding to some structures ANDROID: GKI: ufs: add Android ABI padding to some structures ANDROID: GKI: workqueue.h: add Android ABI padding to some structures ANDROID: GKI: fs.h: add Android ABI padding to some structures ANDROID: GKI: USB: add Android ABI padding to some structures ANDROID: GKI: mm: add Android ABI padding to some structures ANDROID: GKI: mount.h: add Android ABI padding to some structures ANDROID: GKI: sched.h: add Android ABI padding to some structures ANDROID: GKI: sock.h: add Android ABI padding to some structures ANDROID: GKI: module.h: add Android ABI padding to some structures ANDROID: GKI: device.h: add Android ABI padding to some structures ANDROID: GKI: phy: add Android ABI padding to some structures ANDROID: GKI: add android_kabi.h ANDROID: ABI: update due to previous changes in the tree BACKPORT: sched/core: Fix reset-on-fork from RT with uclamp ANDROID: GKI: Add support for missing V4L2 symbols ANDROID: GKI: Bulk update ABI XML representation ANDROID: GKI: arm64: psci: Support for OS initiated scheme ANDROID: GKI: net: add counter for number of frames coalesced in GRO ANDROID: GKI: cfg80211: Include length of kek in rekey data BACKPORT: loop: change queue block size to match when using DIO ANDROID: Incremental fs: Add setattr call ANDROID: GKI: enable CONFIG_RTC_SYSTOHC ANDROID: GKI: ipv4: add vendor padding to __IPV4_DEVCONF_* enums Revert "ANDROID: GKI: ipv4: increase __IPV4_DEVCONF_MAX to 64" ANDROID: driver: gpu: drm: fix export symbol types ANDROID: SoC: core: fix export symbol type ANDROID: ufshcd-crypto: fix export symbol type ANDROID: GKI: drivers: mailbox: fix race resulting in multiple message submission ANDROID: GKI: arm64: gki_defconfig: Enable a few thermal configs Revert "ANDROID: GKI: add base.h include to match MODULE_VERSIONS" FROMLIST: thermal: Make cooling device trip point writable from sysfs ANDROID: GKI: drivers: thermal: cpu_cooling: Use CPU ID as cooling device ID ANDROID: GKI: PM / devfreq: Allow min freq to be 0 ANDROID: GKI: arm64: gki_defconfig: Enable REGULATOR_PROXY_CONSUMER ANDROID: GKI: Bulk Update ABI XML representation ANDROID: KASAN support for GKI remove CONFIG_CC_WERROR ANDROID: KASAN support for GKI ANDROID: virt_wifi: fix export symbol types ANDROID: vfs: fix export symbol type ANDROID: vfs: fix export symbol types ANDROID: fscrypt: fix export symbol type ANDROID: cfi: fix export symbol types ANDROID: bpf: fix export symbol type Linux 4.19.119 s390/mm: fix page table upgrade vs 2ndary address mode accesses xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT serial: sh-sci: Make sure status register SCxSR is read in correct sequence xhci: prevent bus suspend if a roothub port detected a over-current condition usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() usb: dwc3: gadget: Fix request completion check UAS: fix deadlock in error handling and PM flushing work UAS: no use logging any details in case of ENODEV cdc-acm: introduce a cool down cdc-acm: close race betrween suspend() and acm_softint staging: vt6656: Power save stop wake_up_count wrap around. staging: vt6656: Fix pairwise key entry save. staging: vt6656: Fix drivers TBTT timing counter. staging: vt6656: Fix calling conditions of vnt_set_bss_mode staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default. vt: don't use kmalloc() for the unicode screen buffer vt: don't hardcode the mem allocation upper bound staging: comedi: Fix comedi_device refcnt leak in comedi_open staging: comedi: dt2815: fix writing hi byte of analog output powerpc/setup_64: Set cache-line-size based on cache-block-size ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y iwlwifi: mvm: beacon statistics shouldn't go backwards iwlwifi: pcie: actually release queue memory in TVQM ASoC: dapm: fixup dapm kcontrol widget audit: check the length of userspace generated audit records usb-storage: Add unusual_devs entry for JMicron JMS566 tty: rocket, avoid OOB access tty: hvc: fix buffer overflow during hvc_alloc(). KVM: VMX: Enable machine check support for 32bit targets KVM: Check validity of resolved slot when searching memslots KVM: s390: Return last valid slot if approx index is out-of-bounds tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send() tpm/tpm_tis: Free IRQ if probing fails ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif ALSA: hda/realtek - Add new codec supported for ALC245 ALSA: hda/realtek - Fix unexpected init_amp override ALSA: usx2y: Fix potential NULL dereference tools/vm: fix cross-compile build mm/ksm: fix NULL pointer dereference when KSM zero page is enabled mm/hugetlb: fix a addressing exception caused by huge_pte_offset vmalloc: fix remap_vmalloc_range() bounds checks USB: hub: Fix handling of connect changes during sleep USB: core: Fix free-while-in-use bug in the USB S-Glibrary USB: early: Handle AMD's spec-compliant identifiers, too USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE USB: sisusbvga: Change port variable from signed to unsigned fs/namespace.c: fix mountpoint reference counter race iio: xilinx-xadc: Make sure not exceed maximum samplerate iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode iio: xilinx-xadc: Fix clearing interrupt when enabling trigger iio: xilinx-xadc: Fix ADC-B powerdown iio: adc: stm32-adc: fix sleep in atomic context iio: st_sensors: rely on odr mask to know if odr can be set iio: core: remove extra semi-colon from devm_iio_device_register() macro ALSA: usb-audio: Add connector notifier delegation ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos ALSA: hda: Remove ASUS ROG Zenith from the blacklist KEYS: Avoid false positive ENOMEM error on key read mlxsw: Fix some IS_ERR() vs NULL bugs vrf: Check skb for XFRM_TRANSFORMED flag xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL net: dsa: b53: Rework ARL bin logic net: dsa: b53: Fix ARL register definitions net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled vrf: Fix IPv6 with qdisc and xfrm team: fix hang in team_mode_get() tcp: cache line align MAX_TCP_HEADER sched: etf: do not assume all sockets are full blown net/x25: Fix x25_neigh refcnt leak when receiving frame net: stmmac: dwmac-meson8b: Add missing boundary to RGMII TX clock array net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node net: bcmgenet: correct per TX/RX ring statistics macvlan: fix null dereference in macvlan_device_event() macsec: avoid to set wrong mtu ipv6: fix restrict IPV6_ADDRFORM operation cxgb4: fix large delays in PTP synchronization cxgb4: fix adapter crash due to wrong MC size x86/KVM: Clean up host's steal time structure x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed x86/kvm: Cache gfn to pfn translation x86/kvm: Introduce kvm_(un)map_gfn() KVM: Properly check if "page" is valid in kvm_vcpu_unmap kvm: fix compile on s390 part 2 kvm: fix compilation on s390 kvm: fix compilation on aarch64 KVM: Introduce a new guest mapping API KVM: nVMX: Always sync GUEST_BNDCFGS when it comes from vmcs01 KVM: VMX: Zero out *all* general purpose registers after VM-Exit f2fs: fix to avoid memory leakage in f2fs_listxattr blktrace: fix dereference after null check blktrace: Protect q->blk_trace with RCU net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup net: ipv6: add net argument to ip6_dst_lookup_flow PCI/ASPM: Allow re-enabling Clock PM scsi: smartpqi: fix call trace in device discovery virtio-blk: improve virtqueue error to BLK_STS tracing/selftests: Turn off timeout setting drm/amd/display: Not doing optimize bandwidth if flip pending. xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3 ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet perf/core: Disable page faults when getting phys address pwm: bcm2835: Dynamically allocate base pwm: renesas-tpu: Fix late Runtime PM enablement Revert "powerpc/64: irq_work avoid interrupt when called with hardware irqs enabled" loop: Better discard support for block devices s390/cio: avoid duplicated 'ADD' uevents kconfig: qconf: Fix a few alignment issues ipc/util.c: sysvipc_find_ipc() should increase position index selftests: kmod: fix handling test numbers above 9 kernel/gcov/fs.c: gcov_seq_next() should increase position index nvme: fix deadlock caused by ANA update wrong locking ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() scsi: iscsi: Report unbind session event when the target has been removed pwm: rcar: Fix late Runtime PM enablement ceph: don't skip updating wanted caps when cap is stale ceph: return ceph_mdsc_do_request() errors from __get_parent() scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login watchdog: reset last_hw_keepalive time at start arm64: Silence clang warning on mismatched value/register sizes arm64: compat: Workaround Neoverse-N1 #1542419 for compat user-space arm64: Fake the IminLine size on systems affected by Neoverse-N1 #1542419 arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419 arm64: Add part number for Neoverse N1 vti4: removed duplicate log message. crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static bpftool: Fix printing incorrect pointer in btf_dump_ptr drm/msm: Use the correct dma_sync calls harder ext4: fix extent_status fragmentation for plain files ANDROID: abi_gki_aarch64_cuttlefish_whitelist: remove stale symbols ANDROID: GKI: ipv4: increase __IPV4_DEVCONF_MAX to 64 ANDROID: GKI: power: add missing export for POWER_RESET_QCOM=m BACKPORT: cfg80211: Support key configuration for Beacon protection (BIGTK) BACKPORT: cfg80211: Enhance the AKM advertizement to support per interface. UPSTREAM: sysrq: Use panic() to force a crash ANDROID: GKI: kernel: sound: update codec options with block size ANDROID: add compat cross compiler ANDROID: x86/vdso: disable LTO only for VDSO BACKPORT: arm64: vdso32: Enable Clang Compilation UPSTREAM: arm64: compat: vdso: Expose BUILD_VDSO32 BACKPORT: lib/vdso: Enable common headers BACKPORT: arm: vdso: Enable arm to use common headers BACKPORT: x86/vdso: Enable x86 to use common headers BACKPORT: mips: vdso: Enable mips to use common headers UPSTREAM: arm64: vdso32: Include common headers in the vdso library UPSTREAM: arm64: vdso: Include common headers in the vdso library UPSTREAM: arm64: Introduce asm/vdso/processor.h BACKPORT: arm64: vdso32: Code clean up UPSTREAM: linux/elfnote.h: Replace elf.h with UAPI equivalent UPSTREAM: scripts: Fix the inclusion order in modpost UPSTREAM: common: Introduce processor.h UPSTREAM: linux/ktime.h: Extract common header for vDSO UPSTREAM: linux/jiffies.h: Extract common header for vDSO UPSTREAM: linux/time64.h: Extract common header for vDSO BACKPORT: linux/time32.h: Extract common header for vDSO BACKPORT: linux/time.h: Extract common header for vDSO UPSTREAM: linux/math64.h: Extract common header for vDSO BACKPORT: linux/clocksource.h: Extract common header for vDSO BACKPORT: mips: Introduce asm/vdso/clocksource.h BACKPORT: arm64: Introduce asm/vdso/clocksource.h BACKPORT: arm: Introduce asm/vdso/clocksource.h BACKPORT: x86: Introduce asm/vdso/clocksource.h UPSTREAM: linux/limits.h: Extract common header for vDSO BACKPORT: linux/kernel.h: split *_MAX and *_MIN macros into <linux/limits.h> BACKPORT: linux/bits.h: Extract common header for vDSO UPSTREAM: linux/const.h: Extract common header for vDSO BACKPORT: arm64: vdso: fix flip/flop vdso build bug UPSTREAM: lib/vdso: Allow the high resolution parts to be compiled out UPSTREAM: lib/vdso: Only read hrtimer_res when needed in __cvdso_clock_getres() UPSTREAM: lib/vdso: Mark do_hres() and do_coarse() as __always_inline UPSTREAM: lib/vdso: Avoid duplication in __cvdso_clock_getres() UPSTREAM: lib/vdso: Let do_coarse() return 0 to simplify the callsite UPSTREAM: lib/vdso: Remove checks on return value for 32 bit vDSO UPSTREAM: lib/vdso: Build 32 bit specific functions in the right context UPSTREAM: lib/vdso: Make __cvdso_clock_getres() static UPSTREAM: lib/vdso: Make clock_getres() POSIX compliant again UPSTREAM: lib/vdso/32: Provide legacy syscall fallbacks UPSTREAM: lib/vdso: Move fallback invocation to the callers UPSTREAM: lib/vdso/32: Remove inconsistent NULL pointer checks UPSTREAM: lib/vdso: Make delta calculation work correctly UPSTREAM: arm64: compat: Fix syscall number of compat_clock_getres BACKPORT: arm64: lse: Fix LSE atomics with LLVM UPSTREAM: mips: Fix gettimeofday() in the vdso library UPSTREAM: mips: vdso: Fix __arch_get_hw_counter() BACKPORT: arm64: Kconfig: Make CONFIG_COMPAT_VDSO a proper Kconfig option UPSTREAM: arm64: vdso32: Rename COMPATCC to CC_COMPAT UPSTREAM: arm64: vdso32: Pass '--target' option to clang via VDSO_CAFLAGS UPSTREAM: arm64: vdso32: Don't use KBUILD_CPPFLAGS unconditionally UPSTREAM: arm64: vdso32: Move definition of COMPATCC into vdso32/Makefile UPSTREAM: arm64: Default to building compat vDSO with clang when CONFIG_CC_IS_CLANG UPSTREAM: lib: vdso: Remove CROSS_COMPILE_COMPAT_VDSO UPSTREAM: arm64: vdso32: Remove jump label config option in Makefile UPSTREAM: arm64: vdso32: Detect binutils support for dmb ishld BACKPORT: arm64: vdso: Remove stale files from old assembly implementation UPSTREAM: arm64: vdso32: Fix broken compat vDSO build warnings UPSTREAM: mips: compat: vdso: Use legacy syscalls as fallback BACKPORT: arm64: Relax Documentation/arm64/tagged-pointers.rst BACKPORT: arm64: Add tagged-address-abi.rst to index.rst UPSTREAM: arm64: vdso: Fix Makefile regression UPSTREAM: mips: vdso: Fix flip/flop vdso building bug UPSTREAM: mips: vdso: Fix source path UPSTREAM: mips: Add clock_gettime64 entry point UPSTREAM: mips: Add clock_getres entry point BACKPORT: mips: Add support for generic vDSO BACKPORT: arm64: vdso: Explicitly add build-id option BACKPORT: arm64: vdso: use $(LD) instead of $(CC) to link VDSO BACKPORT: arm64: vdso: Cleanup Makefiles UPSTREAM: arm64: vdso: Fix population of AT_SYSINFO_EHDR for compat vdso UPSTREAM: arm64: vdso: Fix compilation with clang older than 8 UPSTREAM: arm64: compat: Fix __arch_get_hw_counter() implementation UPSTREAM: arm64: Fix __arch_get_hw_counter() implementation UPSTREAM: x86/vdso/32: Use 32bit syscall fallback UPSTREAM: x86/vdso: Fix flip/flop vdso build bug UPSTREAM: x86/vdso: Give the [ph]vclock_page declarations real types UPSTREAM: x86/vdso: Add clock_gettime64() entry point BACKPORT: x86/vdso: Add clock_getres() entry point BACKPORT: x86/vdso: Switch to generic vDSO implementation UPSTREAM: x86/segments: Introduce the 'CPUNODE' naming to better document the segment limit CPU/node NR trick UPSTREAM: x86/vdso: Initialize the CPU/node NR segment descriptor earlier UPSTREAM: x86/vdso: Introduce helper functions for CPU and node number UPSTREAM: x86/segments/64: Rename the GDT PER_CPU entry to CPU_NUMBER BACKPORT: arm64: vdso: Enable vDSO compat support UPSTREAM: arm64: compat: Get sigreturn trampolines from vDSO UPSTREAM: arm64: elf: VDSO code page discovery UPSTREAM: arm64: compat: VDSO setup for compat layer UPSTREAM: arm64: vdso: Refactor vDSO code BACKPORT: arm64: compat: Add vDSO UPSTREAM: arm64: compat: Generate asm offsets for signals UPSTREAM: arm64: compat: Expose signal related structures UPSTREAM: arm64: compat: Add missing syscall numbers BACKPORT: arm64: vdso: Substitute gettimeofday() with C implementation UPSTREAM: timekeeping: Provide a generic update_vsyscall() implementation UPSTREAM: lib/vdso: Add compat support UPSTREAM: lib/vdso: Provide generic VDSO implementation UPSTREAM: vdso: Define standardized vdso_datapage UPSTREAM: hrtimer: Split out hrtimer defines into separate header UPSTREAM: nds32: Fix vDSO clock_getres() UPSTREAM: arm64: compat: Reduce address limit for 64K pages BACKPORT: arm64: compat: Add KUSER_HELPERS config option UPSTREAM: arm64: compat: Refactor aarch32_alloc_vdso_pages() BACKPORT: arm64: compat: Split kuser32 UPSTREAM: arm64: compat: Alloc separate pages for vectors and sigpage ANDROID: GKI: Update ABI XML representation ANDROID: GKI: Enable GENERIC_IRQ_CHIP ANDROID: GKI: power_supply: Add FG_TYPE power-supply property ANDROID: GKI: mm: export mm_trace_rss_stat for modules to report RSS changes ANDROID: GKI: gki_defconfig: Enable CONFIG_LEDS_TRIGGER_TRANSIENT ANDROID: GKI: gki_defconfig: Enable CONFIG_CPU_FREQ_STAT ANDROID: GKI: arm64: gki_defconfig: Disable HW tracing features ANDROID: GKI: gki_defconfig: Enable CONFIG_I2C_CHARDEV ANDROID: Incremental fs: Use simple compression in log buffer ANDROID: GKI: usb: core: Add support to parse config summary capability descriptors ANDROID: GKI: Update ABI XML representation ANDROID: dm-bow: Fix not to skip trim at framented range ANDROID: Remove VLA from uid_sys_stats.c f2fs: fix missing check for f2fs_unlock_op ANDROID: fix wakeup reason findings UPSTREAM: cfg80211: fix and clean up cfg80211_gen_new_bssid() UPSTREAM: cfg80211: save multi-bssid properties UPSTREAM: cfg80211: make BSSID generation function inline UPSTREAM: cfg80211: parse multi-bssid only if HW supports it UPSTREAM: cfg80211: Move Multiple BSS info to struct cfg80211_bss to be visible UPSTREAM: cfg80211: Properly track transmitting and non-transmitting BSS UPSTREAM: cfg80211: use for_each_element() for multi-bssid parsing UPSTREAM: cfg80211: Parsing of Multiple BSSID information in scanning UPSTREAM: cfg80211/nl80211: Offload OWE processing to user space in AP mode ANDROID: GKI: cfg80211: Sync nl80211 commands/feature with upstream ANDROID: GKI: gki_defconfig: Enable FW_LOADER_USER_HELPER* ANDROID: GKI: arm64: gki_defconfig: Disable CONFIG_ARM64_TAGGED_ADDR_ABI ANDROID: GKI: gki_defconfig: CONFIG_CHR_DEV_SG=y ANDROID: GKI: gki_defconfig: CONFIG_DM_DEFAULT_KEY=m ANDROID: update the ABI xml representation ANDROID: init: GKI: enable hidden configs for GPU Linux 4.19.118 bpf: fix buggy r0 retval refinement for tracing helpers KEYS: Don't write out to userspace while holding key semaphore mtd: phram: fix a double free issue in error path mtd: lpddr: Fix a double free in probe() mtd: spinand: Explicitly use MTD_OPS_RAW to write the bad block marker to OOB locktorture: Print ratio of acquisitions, not failures tty: evh_bytechan: Fix out of bounds accesses iio: si1133: read 24-bit signed integer for measurement fbdev: potential information leak in do_fb_ioctl() net: dsa: bcm_sf2: Fix overflow checks f2fs: fix to wait all node page writeback iommu/amd: Fix the configuration of GCR3 table root pointer libnvdimm: Out of bounds read in __nd_ioctl() power: supply: axp288_fuel_gauge: Broaden vendor check for Intel Compute Sticks. ext2: fix debug reference to ext2_xattr_cache ext2: fix empty body warnings when -Wextra is used iommu/vt-d: Fix mm reference leak drm/vc4: Fix HDMI mode validation f2fs: fix NULL pointer dereference in f2fs_write_begin() NFS: Fix memory leaks in nfs_pageio_stop_mirroring() drm/amdkfd: kfree the wrong pointer x86: ACPI: fix CPU hotplug deadlock KVM: s390: vsie: Fix possible race when shadowing region 3 tables compiler.h: fix error in BUILD_BUG_ON() reporting percpu_counter: fix a data race at vm_committed_as include/linux/swapops.h: correct guards for non_swap_entry() cifs: Allocate encryption header through kmalloc um: ubd: Prevent buffer overrun on command completion ext4: do not commit super on read-only bdev s390/cpum_sf: Fix wrong page count in error message powerpc/maple: Fix declaration made after definition s390/cpuinfo: fix wrong output when CPU0 is offline NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails NFSv4/pnfs: Return valid stateids in nfs_layout_find_inode_by_stateid() rtc: 88pm860x: fix possible race condition soc: imx: gpc: fix power up sequencing clk: tegra: Fix Tegra PMC clock out parents power: supply: bq27xxx_battery: Silence deferred-probe error clk: at91: usb: continue if clk_hw_round_rate() return zero x86/Hyper-V: Report crash data in die() when panic_on_oops is set x86/Hyper-V: Report crash register data when sysctl_record_panic_msg is not set x86/Hyper-V: Trigger crash enlightenment only once during system crash. x86/Hyper-V: Free hv_panic_page when fail to register kmsg dump x86/Hyper-V: Unload vmbus channel in hv panic callback xsk: Add missing check on user supplied headroom size rbd: call rbd_dev_unprobe() after unwatching and flushing notifies rbd: avoid a deadlock on header_rwsem when flushing notifies video: fbdev: sis: Remove unnecessary parentheses and commented code lib/raid6: use vdupq_n_u8 to avoid endianness warnings x86/Hyper-V: Report crash register data or kmsg before running crash kernel of: overlay: kmemleak in dup_and_fixup_symbol_prop() of: unittest: kmemleak in of_unittest_overlay_high_level() of: unittest: kmemleak in of_unittest_platform_populate() of: unittest: kmemleak on changeset destroy ALSA: hda: Don't release card at firmware loading error irqchip/mbigen: Free msi_desc on device teardown netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type ARM: dts: imx6: Use gpc for FEC interrupt controller to fix wake on LAN. arm, bpf: Fix bugs with ALU64 {RSH, ARSH} BPF_K shift by 0 watchdog: sp805: fix restart handler ext4: use non-movable memory for superblock readahead scsi: sg: add sg_remove_request in sg_common_write objtool: Fix switch table detection in .text.unlikely arm, bpf: Fix offset overflow for BPF_MEM BPF_DW ANDROID: GKI: Bulk update ABI report. ANDROID: GKI: qos: Register irq notify after adding the qos request ANDROID: GKI: Add dual role mode to usb_dr_modes array UPSTREAM: virtio-gpu api: comment feature flags ANDROID: arch:arm64: Increase kernel command line size ANDROID: GKI: Add special linux_banner_ptr for modules Revert "ANDROID: GKI: Make linux_banner a C pointer" ANDROID: GKI: PM / devfreq: Add new flag to do simple clock scaling ANDROID: GKI: Resolve ABI diff for struct snd_usb_audio ANDROID: GKI: Bulk update ABI ANDROID: GKI: Update the whitelist for qcom SoCs ANDROID: GKI: arm64: gki_defconfig: Set CONFIG_SCSI_UFSHCD=m ANDROID: GKI: scsi: add option to override the command timeout ANDROID: GKI: scsi: Adjust DBD setting in mode sense for caching mode page per LLD ANDROID: add ion_stat tracepoint to common kernel UPSTREAM: gpu/trace: add a gpu total memory usage tracepoint Linux 4.19.117 mm/vmalloc.c: move 'area->pages' after if statement wil6210: remove reset file from debugfs wil6210: make sure Rx ring sizes are correlated wil6210: add general initialization/size checks wil6210: ignore HALP ICR if already handled wil6210: check rx_buff_mgmt before accessing it x86/resctrl: Fix invalid attempt at removing the default resource group x86/resctrl: Preserve CDP enable over CPU hotplug x86/microcode/AMD: Increase microcode PATCH_MAX_SIZE scsi: target: fix hang when multiple threads try to destroy the same iscsi session scsi: target: remove boilerplate code kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD ext4: do not zeroout extents beyond i_disksize drm/amd/powerplay: force the trim of the mclk dpm_levels if OD is enabled usb: dwc3: gadget: Don't clear flags before transfer ended usb: dwc3: gadget: don't enable interrupt when disabling endpoint mac80211_hwsim: Use kstrndup() in place of kasprintf() btrfs: check commit root generation in should_ignore_root tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation keys: Fix proc_keys_next to increase position index ALSA: usb-audio: Check mapping at creating connector controls, too ALSA: usb-audio: Don't create jack controls for PCM terminals ALSA: usb-audio: Don't override ignore_ctl_error value from the map ALSA: usb-audio: Filter error from connector kctl ops, too ASoC: Intel: mrfld: return error codes when an error occurs ASoC: Intel: mrfld: fix incorrect check on p->sink ext4: fix incorrect inodes per group in error message ext4: fix incorrect group count in ext4_fill_super error message pwm: pca9685: Fix PWM/GPIO inter-operation jbd2: improve comments about freeing data buffers whose page mapping is NULL scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic ovl: fix value of i_ino for lower hardlink corner case net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes net: revert default NAPI poll timeout to 2 jiffies net: qrtr: send msgs from local of same id as broadcast net: ipv6: do not consider routes via gateways for anycast address check net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin hsr: check protocol version in hsr_newlink() amd-xgbe: Use __napi_schedule() in BH context ANDROID: GKI: drivers: of-thermal: Relate thermal zones using same sensor ANDROID: GKI: Bulk ABI update ANDROID: GKI: dma: Add set_dma_mask hook to struct dma_map_ops ANDROID: GKI: ABI update due to recent patches FROMLIST: drm/prime: add support for virtio exported objects FROMLIST: dma-buf: add support for virtio exported objects UPSTREAM: drm/virtio: module_param_named() requires linux/moduleparam.h UPSTREAM: drm/virtio: fix resource id creation race UPSTREAM: drm/virtio: make resource id workaround runtime switchable. BACKPORT: drm/virtio: Drop deprecated load/unload initialization ANDROID: GKI: Add DRM_TTM config to GKI ANDROID: Bulk update the ABI xml representation ANDROID: GKI: spmi: pmic-arb: don't enable SPMI_MSM_PMIC_ARB by default ANDROID: GKI: attribute page lock and waitqueue functions as sched ANDROID: GKI: extcon: Fix Add usage of blocking notifier chain ANDROID: GKI: USB: pd: Extcon fix for C current ANDROID: drm/dsi: Fix byte order of DCS set/get brightness ANDROID: GKI: mm: Export symbols to modularize CONFIG_MSM_DRM ANDROID: GKI: ALSA: compress: Add support to send codec specific data ANDROID: GKI: ALSA: Compress - dont use lock for all ioctls ANDROID: GKI: ASoC: msm: qdsp6v2: add support for AMR_WB_PLUS offload ANDROID: GKI: msm: dolby: MAT and THD audiocodec name modification ANDROID: GKI: asoc: msm: Add support for compressed perf mode ANDROID: GKI: msm: audio: support for gapless_pcm ANDROID: GKI: uapi: msm: dolby: Support for TrueHD and MAT decoders ANDROID: GKI: ASoC: msm: qdsp6v2: Add TrueHD HDMI compress pass-though ANDROID: GKI: ALSA: compress: Add APTX format support in ALSA ANDROID: GKI: msm: qdsp6v2: Add timestamp support for compress capture ANDROID: GKI: SoC: msm: Add support for meta data in compressed TX ANDROID: GKI: ALSA: compress: Add DSD format support for ALSA ANDROID: GKI: ASoC: msm: qdsp6v2: add support for ALAC and APE offload ANDROID: GKI: SoC: msm: Add compressed TX and passthrough support ANDROID: GKI: ASoC: msm: qdsp6v2: Add FLAC in compress offload path ANDROID: GKI: ASoC: msm: add support for different compressed formats ANDROID: GKI: ASoC: msm: Update the encode option and sample rate ANDROID: GKI: Enable CONFIG_SND_VERBOSE_PROCFS in gki_defconfig ANDROID: GKI: Add hidden CONFIG_SND_SOC_COMPRESS to gki_defconfig ANDROID: GKI: ALSA: pcm: add locks for accessing runtime resource ANDROID: GKI: Update ABI for DRM changes ANDROID: GKI: Add drm_dp_send_dpcd_{read,write} accessor functions ANDROID: GKI: drm: Add drm_dp_mst_get_max_sdp_streams_supported accessor function ANDROID: GKI: drm: Add drm_dp_mst_has_fec accessor function ANDROID: GKI: Add 'dsc_info' to struct drm_dp_mst_port ANDROID: GKI: usb: Add support to handle USB SMMU S1 address ANDROID: GKI: usb: Add helper APIs to return xhci phys addresses ANDROID: Add C protos for dma_buf/drm_prime get_uuid ANDROID: GKI: Make linux_banner a C pointer ANDROID: GKI: Add 'refresh_rate', 'id' to struct drm_panel_notifier ANDROID: GKI: Add 'i2c_mutex' to struct drm_dp_aux ANDROID: GKI: Add 'checksum' to struct drm_connector Revert "BACKPORT: drm: Add HDR source metadata property" Revert "BACKPORT: drm: Parse HDR metadata info from EDID" ANDROID: drm: Add DP colorspace property ANDROID: GKI: drm: Initialize display->hdmi when parsing vsdb ANDROID: drivers: gpu: drm: add support to batch commands ANDROID: ABI: update the qcom whitelist ANDROID: GKI: ARM64: smp: add vendor field pending_ipi ANDROID: gki_defconfig: enable msm serial early console ANDROID: serial: msm_geni_serial_console : Add Earlycon support ANDROID: GKI: serial: core: export uart_console_device f2fs: fix quota_sync failure due to f2fs_lock_op f2fs: support read iostat f2fs: Fix the accounting of dcc->undiscard_blks f2fs: fix to handle error path of f2fs_ra_meta_pages() f2fs: report the discard cmd errors properly f2fs: fix long latency due to discard during umount f2fs: add tracepoint for f2fs iostat f2fs: introduce sysfs/data_io_flag to attach REQ_META/FUA ANDROID: GKI: update abi definition due to previous changes in the tree Linux 4.19.116 efi/x86: Fix the deletion of variables in mixed mode mfd: dln2: Fix sanity checking for endpoints etnaviv: perfmon: fix total and idle HI cyleces readout misc: echo: Remove unnecessary parentheses and simplify check for zero powerpc/fsl_booke: Avoid creating duplicate tlb1 entry ftrace/kprobe: Show the maxactive number on kprobe_events drm: Remove PageReserved manipulation from drm_pci_alloc drm/dp_mst: Fix clearing payload state on topology disable Revert "drm/dp_mst: Remove VCPI while disabling topology mgr" crypto: ccree - only try to map auth tag if needed crypto: ccree - dec auth tag size from cryptlen map crypto: ccree - don't mangle the request assoclen crypto: ccree - zero out internal struct before use crypto: ccree - improve error handling crypto: caam - update xts sector size for large input length dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone() btrfs: use nofs allocations for running delayed items powerpc: Make setjmp/longjmp signature standard powerpc: Add attributes for setjmp/longjmp scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug powerpc/kprobes: Ignore traps that happened in real mode powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries powerpc/64/tm: Don't let userspace set regs->trap via sigreturn powerpc/powernv/idle: Restore AMR/UAMOR/AMOR after idle xen/blkfront: fix memory allocation flags in blkfront_setup_indirect() ipmi: fix hung processes in __get_guid() libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set hfsplus: fix crash and filesystem corruption when deleting files cpufreq: powernv: Fix use-after-free kmod: make request_module() return an error when autoloading is disabled clk: ingenic/jz4770: Exit with error if CGU init failed Input: i8042 - add Acer Aspire 5738z to nomux list s390/diag: fix display of diagnose call statistics perf tools: Support Python 3.8+ in Makefile ocfs2: no need try to truncate file beyond i_size fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() ext4: fix a data race at inode->i_blocks NFS: Fix a page leak in nfs_destroy_unlinked_subrequests() powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable drm/etnaviv: rework perfmon query infrastructure rtc: omap: Use define directive for PIN_CONFIG_ACTIVE_HIGH selftests: vm: drop dependencies on page flags from mlock2 tests arm64: armv8_deprecated: Fix undef_hook mask for thumb setend scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point dm verity fec: fix memory leak in verity_fec_dtr dm writecache: add cond_resched to avoid CPU hangs arm64: dts: allwinner: h6: Fix PMU compatible net: qualcomm: rmnet: Allow configuration updates to existing devices mm: Use fixed constant in page_frag_alloc instead of size + 1 tools: gpio: Fix out-of-tree build regression x86/speculation: Remove redundant arch_smt_update() invocation powerpc/pseries: Drop pointless static qualifier in vpa_debugfs_init() erofs: correct the remaining shrink objects crypto: mxs-dcp - fix scatterlist linearization for hash btrfs: fix missing semaphore unlock in btrfs_sync_file btrfs: fix missing file extent item for hole after ranged fsync btrfs: drop block from cache on error in relocation btrfs: set update the uuid generation as soon as possible Btrfs: fix crash during unmount due to race with delayed inode workers mtd: spinand: Do not erase the block before writing a bad block marker mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers CIFS: Fix bug which the return value by asynchronous read is error KVM: VMX: fix crash cleanup when KVM wasn't used KVM: x86: Gracefully handle __vmalloc() failure during VM allocation KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support KVM: x86: Allocate new rmap and large page tracking when moving memslot KVM: s390: vsie: Fix delivery of addressing exceptions KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks KVM: nVMX: Properly handle userspace interrupt window request x86/entry/32: Add missing ASM_CLAC to general_protection entry signal: Extend exec_id to 64bits ath9k: Handle txpower changes even when TPC is disabled MIPS: OCTEON: irq: Fix potential NULL pointer dereference MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3 pstore: pstore_ftrace_seq_next should increase position index irqchip/versatile-fpga: Apply clear-mask earlier KEYS: reaching the keys quotas correctly tpm: tpm2_bios_measurements_next should increase position index tpm: tpm1_bios_measurements_next should increase position index tpm: Don't make log failures fatal PCI: endpoint: Fix for concurrent memory allocation in OB address region PCI: Add boot interrupt quirk mechanism for Xeon chipsets PCI/ASPM: Clear the correct bits when enabling L1 substates PCI: pciehp: Fix indefinite wait on sysfs requests nvme: Treat discovery subsystems as unique subsystems nvme-fc: Revert "add module to ops template to allow module references" thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n acpi/x86: ignore unspecified bit positions in the ACPI global lock field media: ti-vpe: cal: fix disable_irqs to only the intended target ALSA: hda/realtek - Add quirk for MSI GL63 ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256 ALSA: pcm: oss: Fix regression by buffer overflow fix ALSA: ice1724: Fix invalid access for enumerated ctl items ALSA: hda: Fix potential access overflow in beep helper ALSA: hda: Add driver blacklist ALSA: usb-audio: Add mixer workaround for TRX40 and co usb: gadget: composite: Inform controller driver of self-powered usb: gadget: f_fs: Fix use after free issue as part of queue failure ASoC: topology: use name_prefix for new kcontrol ASoC: dpcm: allow start or stop during pause for backend ASoC: dapm: connect virtual mux with default value ASoC: fix regwmask slub: improve bit diffusion for freelist ptr obfuscation uapi: rename ext2_swab() to swab() and share globally in swab.h IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads btrfs: track reloc roots based on their commit root bytenr btrfs: remove a BUG_ON() from merge_reloc_roots() btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued block, bfq: fix use-after-free in bfq_idle_slice_timer_body locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps() firmware: fix a double abort case with fw_load_sysfs_fallback md: check arrays is suspended in mddev_detach before call quiesce operations irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency usb: dwc3: core: add support for disabling SS instances in park mode media: i2c: ov5695: Fix power on and off sequences block: Fix use-after-free issue accessing struct io_cq genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy() efi/x86: Ignore the memory attributes table on i386 x86/boot: Use unsigned comparison for addresses gfs2: Don't demote a glock until its revokes are written pstore/platform: fix potential mem leak if pstore_init_fs failed libata: Remove extra scsi_host_put() in ata_scsi_add_hosts() media: i2c: video-i2c: fix build errors due to 'imply hwmon' PCI/switchtec: Fix init_completion race condition with poll_wait() selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault sched: Avoid scale real weight down to zero irqchip/versatile-fpga: Handle chained IRQs properly block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices x86: Don't let pgprot_modify() change the page encryption bit xhci: bail out early if driver can't accress host in resume null_blk: fix spurious IO errors after failed past-wp access null_blk: Handle null_add_dev() failures properly null_blk: Fix the null_add_dev() error path firmware: arm_sdei: fix double-lock on hibernate with shared events media: venus: hfi_parser: Ignore HEVC encoding for V1 cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL i2c: st: fix missing struct parameter description qlcnic: Fix bad kzalloc null test cxgb4/ptp: pass the sign of offset delta in FW CMD hinic: fix wrong para of wait_for_completion_timeout hinic: fix a bug of waitting for IO stopped net: vxge: fix wrong __VA_ARGS__ usage bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads ARM: dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high voltage ANDROID: build.config.allmodconfig: Re-enable XFS_FS FROMGIT: of: property: Add device link support for extcon ANDROID: GKI: arm64: gki_defconfig: enable CONFIG_MM_EVENT_STAT ANDROID: GKI: add fields from per-process mm event tracking feature ANDROID: GKI: fix ABI diffs caused by ION heap and pool vmstat additions UPSTREAM: GKI: panic/reboot: allow specifying reboot_mode for panic only ANDROID: GKI: of: property: Add device link support for phys property ANDROID: GKI: usb: phy: Fix ABI diff for usb_otg_state ANDROID: GKI: usb: phy: Fix ABI diff due to usb_phy.drive_dp_pulse ANDROID: GKI: usb: phy: Fix ABI diff for usb_phy_type and usb_phy.reset ANDROID: gki_defconfig: enable CONFIG_GPIO_SYSFS ANDROID: GKI: qcom: Fix compile issue when setting msm_lmh_dcvs as a module ANDROID: GKI: drivers: cpu_cooling: allow platform freq mitigation ANDROID: GKI: ASoC: Add locking in DAPM widget power update ANDROID: GKI: ASoC: jack: Fix buttons enum value ANDROID: GKI: ALSA: jack: Add support to report second microphone ANDROID: GKI: ALSA: jack: Update supported jack switch types ANDROID: GKI: ALSA: jack: update jack types ANDROID: GKI: Export symbols arm_cpuidle_suspend, cpuidle_dev and cpuidle_register_governor ANDROID: GKI: usb: hcd: Add USB atomic notifier callback for HC died error ANDROID: media: increase video max frame number BACKPORT: nvmem: core: add NVMEM_SYSFS Kconfig UPSTREAM: nvmem: add support for cell info UPSTREAM: nvmem: remove the global cell list UPSTREAM: nvmem: use kref UPSTREAM: nvmem: use list_for_each_entry_safe in nvmem_device_remove_all_cells() UPSTREAM: nvmem: provide nvmem_dev_name() ANDROID: GKI: Bulk ABI update ANDROID: GKI: cpuhotplug: adding hotplug enums for vendor code ANDROID: Incremental fs: Fix create_file performance ANDROID: build.config.common: Add BUILDTOOLS_PREBUILT_BIN UPSTREAM: kheaders: include only headers into kheaders_data.tar.xz UPSTREAM: kheaders: remove meaningless -R option of 'ls' ANDROID: GKI: of: platform: initialize of_reserved_mem ANDROID: driver: gpu: drm: add notifier for panel related events ANDROID: include: drm: support unicasting mipi cmds to dsi ctrls ANDROID: include: drm: increase DRM max property count to 64 BACKPORT: drm: Add HDMI colorspace property ANDROID: drm: edid: add support for additional CEA extension blocks BACKPORT: drm: Parse HDR metadata info from EDID BACKPORT: drm: Add HDR source metadata property BACKPORT: drm/dp_mst: Parse FEC capability on MST ports ANDROID: GKI: ABI update for DRM changes ANDROID: ABI: add missing elf variables to representation ANDROID: GKI: power_supply: Add PROP_MOISTURE_DETECTION_ENABLED ANDROID: include: drm: add the definitions for DP Link Compliance tests ANDROID: drivers: gpu: drm: fix bugs encountered while fuzzing FROMLIST: power_supply: Add additional health properties to the header UPSTREAM: power: supply: core: Update sysfs-class-power ABI document UPSTREAM: Merge remote-tracking branch 'aosp/upstream-f2fs-stable-linux-4.19.y' into android-4.19 (v5.7-rc1) ANDROID: drivers: gpu: drm: add support for secure framebuffer ANDROID: include: uapi: drm: add additional QCOM modifiers ANDROID: drm: dsi: add two DSI mode flags for BLLP ANDROID: include: uapi: drm: add additional drm mode flags UPSTREAM: drm: plug memory leak on drm_setup() failure UPSTREAM: drm: factor out drm_close_helper() function ANDROID: GKI: Bulk ABI update BACKPORT: nl80211: Add per peer statistics to compute FCS error rate ANDROID: GKI: sound: usb: Add snd_usb_enable_audio_stream/find_snd_usb_substream ANDROID: GKI: add dma-buf includes ANDROID: GKI: sched: struct fields for Per-Sched-domain over utilization ANDROID: GKI: Add vendor fields to root_domain ANDROID: gki_defconfig: Enable CONFIG_IRQ_TIME_ACCOUNTING ANDROID: fix allmodconfig build to use the right toolchain ANDROID: fix allmodconfig build to use the right toolchain ANDROID: GKI: Update ABI Revert "UPSTREAM: mm, page_alloc: spread allocations across zones before introducing fragmentation" Revert "UPSTREAM: mm: use alloc_flags to record if kswapd can wake" Revert "BACKPORT: mm: move zone watermark accesses behind an accessor" Revert "BACKPORT: mm: reclaim small amounts of memory when an external fragmentation event occurs" Revert "BACKPORT: mm, compaction: be selective about what pageblocks to clear skip hints" ANDROID: GKI: panic: add vendor callback function in panic() UPSTREAM: GKI: thermal: make device_register's type argument const ANDROID: GKI: add base.h include to match MODULE_VERSIONS ANDROID: update the ABI based on the new whitelist ANDROID: GKI: fdt: export symbols required by modules ANDROID: GKI: drivers: of: Add APIs to find DDR device rank, HBB ANDROID: GKI: security: Add mmap export symbols for modules ANDROID: GKI: arch: add stub symbols for boot_reason and cold_boot ANDROID: GKI: USB: Fix ABI diff for struct usb_bus ANDROID: GKI: USB: Resolve ABI diff for usb_gadget and usb_gadget_ops ANDROID: GKI: add hidden V4L2_MEM2MEM_DEV ANDROID: GKI: enable VIDEO_V4L2_SUBDEV_API ANDROID: GKI: export symbols from abi_gki_aarch64_qcom_whitelist ANDROID: Update the whitelist for qcom SoCs ANDROID: Incremental fs: Fix compound page usercopy crash ANDROID: Incremental fs: Clean up incfs_test build process ANDROID: Incremental fs: make remount log buffer change atomic ANDROID: Incremental fs: Optimize get_filled_block ANDROID: Incremental fs: Fix mislabeled __user ptrs ANDROID: Incremental fs: Use 64-bit int for file_size when writing hash blocks Linux 4.19.115 drm/msm: Use the correct dma_sync calls in msm_gem drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read() usb: dwc3: don't set gadget->is_otg flag rpmsg: glink: Remove chunk size word align warning arm64: Fix size of __early_cpu_boot_status drm/msm: stop abusing dma_map/unmap for cache clk: qcom: rcg: Return failure for RCG update fbcon: fix null-ptr-deref in fbcon_switch RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl RDMA/cma: Teach lockdep about the order of rtnl and lock RDMA/ucma: Put a lock around every call to the rdma_cm layer ceph: canonicalize server path in place ceph: remove the extra slashes in the server path IB/hfi1: Fix memory leaks in sysfs registration and unregistration IB/hfi1: Call kobject_put() when kobject_init_and_add() fails ASoC: jz4740-i2s: Fix divider written at incorrect offset in register hwrng: imx-rngc - fix an error path tools/accounting/getdelays.c: fix netlink attribute length usb: dwc3: gadget: Wrap around when skip TRBs random: always use batched entropy for get_random_u{32,64} mlxsw: spectrum_flower: Do not stop at FLOW_ACTION_VLAN_MANGLE slcan: Don't transmit uninitialized stack data in padding net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before accessing PHY registers net: dsa: bcm_sf2: Ensure correct sub-node is parsed net: dsa: bcm_sf2: Do not register slave MDIO bus with OF ipv6: don't auto-add link-local address to lag ports mm: mempolicy: require at least one nodeid for MPOL_PREFERRED include/linux/notifier.h: SRCU: fix ctags bitops: protect variables in set_mask_bits() macro padata: always acquire cpu_hotplug_lock before pinst->lock net: Fix Tx hash bound checking rxrpc: Fix sendmsg(MSG_WAITALL) handling ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard power: supply: axp288_charger: Add special handling for HP Pavilion x2 10 extcon: axp288: Add wakeup support mei: me: add cedar fork device ids coresight: do not use the BIT() macro in the UAPI header misc: pci_endpoint_test: Avoid using module parameter to determine irqtype misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices misc: rtsx: set correct pcr_ops for rts522A media: rc: IR signal for Panasonic air conditioner too long drm/etnaviv: replace MMU flush marker with flush sequence tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks tools/power turbostat: Fix gcc build warnings drm/amdgpu: fix typo for vcn1 idle check initramfs: restore default compression behavior drm/bochs: downgrade pci_request_region failure from error to warning drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017 nvme-rdma: Avoid double freeing of async event data sctp: fix possibly using a bad saddr with a given dst sctp: fix refcount bug in sctp_wfree net, ip_tunnel: fix interface lookup with no key ipv4: fix a RCU-list lock in fib_triestat_seq_show ANDROID: GKI: export symbols required by SPECTRA_CAMERA ANDROID: GKI: ARM/ARM64: Introduce arch_read_hardware_id ANDROID: GKI: drivers: base: soc: export symbols for socinfo ANDROID: GKI: Update ABI ANDROID: GKI: ASoC: msm: fix integer overflow for long duration offload playback ANDROID: GKI: Bulk ABI update Revert "ANDROID: GKI: mm: add struct/enum fields for SPECULATIVE_PAGE_FAULTS" ANDROID: GKI: Revert "arm64: kill flush_cache_all()" ANDROID: GKI: Revert "arm64: Remove unused macros from assembler.h" ANDROID: GKI: kernel/dma, mm/cma: Export symbols needed by vendor modules ANDROID: GKI: mm: Export symbols __next_zones_zonelist and zone_watermark_ok_safe ANDROID: GKI: mm/memblock: export memblock_overlaps_memory ANDROID: GKI: net, skbuff: export symbols needed by vendor drivers ANDROID: GKI: Add stub __cpu_isolated_mask symbol ANDROID: GKI: sched: stub sched_isolate symbols ANDROID: GKI: export saved_command_line ANDROID: GKI: Update ABI ANDROID: GKI: ASoC: core: Update ALSA core to issue restart in underrun. ANDROID: GKI: SoC: pcm: Add a restart callback field to struct snd_pcm_ops ANDROID: GKI: SoC: pcm: Add fields to struct snd_pcm_ops and struct snd_soc_component_driver ANDROID: GKI: ASoC: core: Add compat_ioctl callback to struct snd_pcm_ops ANDROID: GKI: ALSA: core: modify, rename and export create_subdir API ANDROID: GKI: usb: Add helper API to issue stop endpoint command ANDROID: GKI: Thermal: thermal_zone_get_cdev_by_name added ANDROID: GKI: add missing exports for CONFIG_ARM_SMMU=m ANDROID: power: wakeup_reason: wake reason enhancements BACKPORT: FROMGIT: kbuild: mkcompile_h: Include $LD version in /proc/version ANDROID: GKI: kernel: Export symbols needed by msm_minidump.ko and minidump_log.ko ubifs: wire up FS_IOC_GET_ENCRYPTION_NONCE f2fs: wire up FS_IOC_GET_ENCRYPTION_NONCE ext4: wire up FS_IOC_GET_ENCRYPTION_NONCE fscrypt: add FS_IOC_GET_ENCRYPTION_NONCE ioctl ANDROID: Bulk update the ABI xml ANDROID: gki_defconfig: add CONFIG_IPV6_SUBTREES ANDROID: GKI: arm64: reserve space in cpu_hwcaps and cpu_hwcap_keys arrays ANDROID: GKI: of: reserved_mem: Fix kmemleak crash on no-map region ANDROID: GKI: sched: add task boost vendor fields to task_struct ANDROID: GKI: mm: add rss counter for unreclaimable pages ANDROID: GKI: irqdomain: add bus token DOMAIN_BUS_WAKEUP ANDROID: GKI: arm64: fault: do_tlb_conf_fault_cb register fault callback ANDROID: GKI: QoS: Enhance framework to support cpu/irq specific QoS requests ANDROID: GKI: Bulk ABI update ANDROID: GKI: PM/devfreq: Do not switch governors from sysfs when device is suspended ANDROID: GKI: PM / devfreq: Fix race condition between suspend/resume and governor_store ANDROID: GKI: PM / devfreq: Introduce a sysfs lock ANDROID: GKI: regmap: irq: Add support to clear ack registers ANDROID: GKI: Remove SCHED_AUTOGROUP ANDROID: ignore compiler tag __must_check for GENKSYMS ANDROID: GKI: Bulk update ABI ANDROID: GKI: Fix ABI diff for struct thermal_cooling_device_ops ANDROID: GKI: ASoC: soc-core: export function to find components ANDROID: GKI: thermal: thermal_sys: Add configurable thermal trip points. ANDROID: fscrypt: fall back to filesystem-layer crypto when needed ANDROID: block: require drivers to declare supported crypto key type(s) ANDROID: block: make blk_crypto_start_using_mode() properly check for support ANDROID: GKI: power: supply: format regression ANDROID: GKI: kobject: increase number of kobject uevent pointers to 64 ANDROID: GKI: drivers: video: backlight: Fix ABI diff for struct backlight_device ANDROID: GKI: usb: xhci: Add support for secondary interrupters ANDROID: GKI: usb: host: xhci: Add support for usb core indexing ANDROID: gki_defconfig: enable USB_XHCI_HCD ANDROID: gki_defconfig: enable CONFIG_BRIDGE ANDROID: GKI: Update ABI report ANDROID: GKI: arm64: smp: Add set_update_ipi_history_callback ANDROID: kbuild: ensure __cfi_check is correctly aligned f2fs: keep inline_data when compression conversion f2fs: fix to disable compression on directory f2fs: add missing CONFIG_F2FS_FS_COMPRESSION f2fs: switch discard_policy.timeout to bool type f2fs: fix to verify tpage before releasing in f2fs_free_dic() f2fs: show compression in statx f2fs: clean up dic->tpages assignment f2fs: compress: support zstd compress algorithm f2fs: compress: add .{init,destroy}_decompress_ctx callback f2fs: compress: fix to call missing destroy_compress_ctx() f2fs: change default compression algorithm f2fs: clean up {cic,dic}.ref handling f2fs: fix to use f2fs_readpage_limit() in f2fs_read_multi_pages() f2fs: xattr.h: Make stub helpers inline f2fs: fix to avoid double unlock f2fs: fix potential .flags overflow on 32bit architecture f2fs: fix NULL pointer dereference in f2fs_verity_work() f2fs: fix to clear PG_error if fsverity failed f2fs: don't call fscrypt_get_encryption_info() explicitly in f2fs_tmpfile() f2fs: don't trigger data flush in foreground operation f2fs: fix NULL pointer dereference in f2fs_write_begin() f2fs: clean up f2fs_may_encrypt() f2fs: fix to avoid potential deadlock f2fs: don't change inode status under page lock f2fs: fix potential deadlock on compressed quota file f2fs: delete DIO read lock f2fs: don't mark compressed inode dirty during f2fs_iget() f2fs: fix to account compressed blocks in f2fs_compressed_blocks() f2fs: xattr.h: Replace zero-length array with flexible-array member f2fs: fix to update f2fs_super_block fields under sb_lock f2fs: Add a new CP flag to help fsck fix resize SPO issues f2fs: Fix mount failure due to SPO after a successful online resize FS f2fs: use kmem_cache pool during inline xattr lookups f2fs: skip migration only when BG_GC is called f2fs: fix to show tracepoint correctly f2fs: avoid __GFP_NOFAIL in f2fs_bio_alloc f2fs: introduce F2FS_IOC_GET_COMPRESS_BLOCKS f2fs: fix to avoid triggering IO in write path f2fs: add prefix for f2fs slab cache name f2fs: introduce DEFAULT_IO_TIMEOUT f2fs: skip GC when section is full f2fs: add migration count iff migration happens f2fs: clean up bggc mount option f2fs: clean up lfs/adaptive mount option f2fs: fix to show norecovery mount option f2fs: clean up parameter of macro XATTR_SIZE() f2fs: clean up codes with {f2fs_,}data_blkaddr() f2fs: show mounted time f2fs: Use scnprintf() for avoiding potential buffer overflow f2fs: allow to clear F2FS_COMPR_FL flag f2fs: fix to check dirty pages during compressed inode conversion f2fs: fix to account compressed inode correctly f2fs: fix wrong check on F2FS_IOC_FSSETXATTR f2fs: fix to avoid use-after-free in f2fs_write_multi_pages() f2fs: fix to avoid using uninitialized variable f2fs: fix inconsistent comments f2fs: remove i_sem lock coverage in f2fs_setxattr() f2fs: cover last_disk_size update with spinlock f2fs: fix to check i_compr_blocks correctly FROMLIST: kmod: make request_module() return an error when autoloading is disabled ANDROID: GKI: Update ABI report ANDROID: GKI: ARM64: dma-mapping: export symbol arch_setup_dma_ops ANDROID: GKI: ARM: dma-mapping: export symbol arch_setup_dma_ops ANDROID: GKI: ASoC: dapm: Avoid static route b/w cpu and codec dai ANDROID: GKI: ASoC: pcm: Add support for hostless playback/capture ANDROID: GKI: ASoC: core - add hostless DAI support ANDROID: GKI: drivers: thermal: Resolve ABI diff for struct thermal_zone_device_ops ANDROID: GKI: drivers: thermal: Add support for getting trip temperature ANDROID: GKI: Add functions of_thermal_handle_trip/of_thermal_handle_trip_temp ANDROID: GKI: drivers: thermal: Add post suspend evaluate flag to thermal zone devicetree UPSTREAM: loop: Only freeze block queue when needed. UPSTREAM: loop: Only change blocksize when needed. ANDROID: Fix wq fp check for CFI builds ANDROID: GKI: update abi definition after CONFIG_DEBUG_LIST was enabled ANDROID: gki_defconfig: enable CONFIG_DEBUG_LIST ANDROID: GKI: Update ABI definition ANDROID: GKI: remove condition causing sk_buff struct ABI differences ANDROID: GKI: Export symbol arch_timer_mem_get_cval ANDROID: GKI: pwm: core: Add option to config PWM duty/period with u64 data length ANDROID: Update ABI whitelist for qcom SoCs ANDROID: Incremental fs: Fix remount ANDROID: Incremental fs: Protect get_fill_block, and add a field ANDROID: Incremental fs: Fix crash polling 0 size read_log ANDROID: Incremental fs: get_filled_blocks: better index_out ANDROID: GKI: of: property: Add device links support for "qcom,wrapper-dev" ANDROID: GKI: update abi definitions due to recent changes ANDROID: GKI: clk: Initialize in stack clk_init_data to 0 in all drivers ANDROID: GKI: drivers: clksource: Add API to return cval ANDROID: GKI: clk: Add support for voltage voting ANDROID: GKI: kernel: Export task and IRQ affinity symbols ANDROID: GKI: regulator: core: Add support for regulator providers with sync state ANDROID: GKI: regulator: Call proxy-consumer functions for each regulator registered ANDROID: GKI: regulator: Add proxy consumer driver ANDROID: GKI: regulator: core: allow long device tree supply regulator property names ANDROID: GKI: Revert "regulator: Enable supply regulator if child rail is enabled." ANDROID: GKI: regulator: Remove redundant set_mode call in drms_uA_update ANDROID: GKI: net: Add the get current NAPI context API ANDROID: GKI: remove DRM_KMS_CMA_HELPER from GKI configuration ANDROID: GKI: edac: Fix ABI diffs in edac_device_ctl_info struct ANDROID: GKI: pwm: Add different PWM output types support UPSTREAM: cfg80211: Authentication offload to user space in AP mode Linux 4.19.114 arm64: dts: ls1046ardb: set RGMII interfaces to RGMII_ID mode arm64: dts: ls1043a-rdb: correct RGMII delay mode to rgmii-id ARM: dts: N900: fix onenand timings ARM: dts: imx6: phycore-som: fix arm and soc minimum voltage ARM: bcm2835-rpi-zero-w: Add missing pinctrl name ARM: dts: oxnas: Fix clear-mask property perf map: Fix off by one in strncpy() size argument arm64: alternative: fix build with clang integrated assembler net: ks8851-ml: Fix IO operations, again gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model bpf: Explicitly memset some bpf info structures declared on the stack bpf: Explicitly memset the bpf_attr structure platform/x86: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table vt: vt_ioctl: fix use-after-free in vt_in_use() vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console vt: vt_ioctl: remove unnecessary console allocation checks vt: switch vt_dont_switch to bool vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines vt: selection, introduce vc_is_sel mac80211: fix authentication with iwlwifi/mvm mac80211: Check port authorization in the ieee80211_tx_dequeue() case media: xirlink_cit: add missing descriptor sanity checks media: stv06xx: add missing descriptor sanity checks media: dib0700: fix rc endpoint lookup media: ov519: add missing endpoint sanity checks libfs: fix infoleak in simple_attr_read() ahci: Add Intel Comet Lake H RAID PCI ID staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table media: usbtv: fix control-message timeouts media: flexcop-usb: fix endpoint sanity check usb: musb: fix crash with highmen PIO and usbmon USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback USB: cdc-acm: restore capability check order USB: serial: option: add Wistron Neweb D19Q1 USB: serial: option: add BroadMobi BM806U USB: serial: option: add support for ASKEY WWHC050 mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX mac80211: add option for setting control flags Revert "r8169: check that Realtek PHY driver module is loaded" vti6: Fix memory leak of skb if input policy check fails bpf/btf: Fix BTF verification of enum members in struct/union netfilter: nft_fwd_netdev: validate family and chain type netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6} afs: Fix some tracing details xfrm: policy: Fix doulbe free in xfrm_policy_timer xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire xfrm: fix uctx len check in verify_sec_ctx_len RDMA/mlx5: Block delay drop to unprivileged users vti[6]: fix packet tx through bpf_redirect() in XinY cases xfrm: handle NETDEV_UNREGISTER for xfrm device genirq: Fix reference leaks on irq affinity notifiers RDMA/core: Ensure security pkey modify is not lost gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk mac80211: mark station unauthorized before key removal nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type scsi: sd: Fix optimal I/O size for devices that change reported values scripts/dtc: Remove redundant YYLOC global declaration tools: Let O= makes handle a relative path with -C option perf probe: Do not depend on dwfl_module_addrsym() ARM: dts: omap5: Add bus_dma_limit for L3 bus ARM: dts: dra7: Add bus_dma_limit for L3 bus ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL Input: avoid BIT() macro usage in the serio.h UAPI header Input: synaptics - enable RMI on HP Envy 13-ad105ng Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger() i2c: hix5hd2: add missed clk_disable_unprepare in remove ftrace/x86: Anotate text_mutex split between ftrace_arch_code_modify_post_process() and ftrace_arch_code_modify_prepare() sxgbe: Fix off by one in samsung driver strncpy size arg dpaa_eth: Remove unnecessary boolean expression in dpaa_get_headroom mac80211: Do not send mesh HWMP PREQ if HWMP is disabled scsi: ipr: Fix softlockup when rescanning devices in petitboot s390/qeth: handle error when backing RX buffer fsl/fman: detect FMan erratum A050385 arm64: dts: ls1043a: FMan erratum A050385 dt-bindings: net: FMan erratum A050385 cgroup1: don't call release_agent when it is "" drivers/of/of_mdio.c:fix of_mdiobus_register() cpupower: avoid multiple definition with gcc -fno-common nfs: add minor version to nfs_server_key for fscache cgroup-v1: cgroup_pidlist_next should update position index hsr: set .netnsok flag hsr: add restart routine into hsr_get_node_list() hsr: use rcu_read_lock() in hsr_get_node_{list/status}() vxlan: check return value of gro_cells_init() tcp: repair: fix TCP_QUEUE_SEQ implementation r8169: re-enable MSI on RTL8168c net: phy: mdio-mux-bcm-iproc: check clk_prepare_enable() return value net: dsa: mt7530: Change the LINK bit to reflect the link status net: ip_gre: Accept IFLA_INFO_DATA-less configuration net: ip_gre: Separate ERSPAN newlink / changelink callbacks bnxt_en: Reset rings if ring reservation fails during open() bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets() slcan: not call free_netdev before rtnl_unlock in slcan_open NFC: fdp: Fix a signedness bug in fdp_nci_send_patch() net: stmmac: dwmac-rk: fix error path in rk_gmac_probe net_sched: keep alloc_hash updated after hash allocation net_sched: cls_route: remove the right filter from hashtable net: qmi_wwan: add support for ASKEY WWHC050 net/packet: tpacket_rcv: avoid a producer race condition net: mvneta: Fix the case where the last poll did not process all rx net: dsa: Fix duplicate frames flooded by learning net: cbs: Fix software cbs to consider packet sending time mlxsw: spectrum_mr: Fix list iteration in error path macsec: restrict to ethernet devices hsr: fix general protection fault in hsr_addr_is_self() geneve: move debug check after netdev unregister Revert "drm/dp_mst: Skip validating ports during destruction, just ref" mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard mmc: core: Allow host controllers to require R1B for CMD6 f2fs: fix to avoid potential deadlock f2fs: add missing function name in kernel message f2fs: recycle unused compress_data.chksum feild f2fs: fix to avoid NULL pointer dereference f2fs: fix leaking uninitialized memory in compressed clusters f2fs: fix the panic in do_checkpoint() f2fs: fix to wait all node page writeback mm/swapfile.c: move inode_lock out of claim_swapfile fscrypt: don't evict dirty inodes after removing key Conflicts: Documentation/arm64/silicon-errata.txt Documentation/devicetree/bindings Documentation/devicetree/bindings/net/fsl-fman.txt arch/arm/kernel/setup.c arch/arm/kernel/smp.c arch/arm/mm/dma-mapping.c arch/arm64/Kconfig arch/arm64/Makefile arch/arm64/include/asm/cpucaps.h arch/arm64/include/asm/cputype.h arch/arm64/include/asm/proc-fns.h arch/arm64/include/asm/traps.h arch/arm64/kernel/arm64ksyms.c arch/arm64/kernel/cpu_errata.c arch/arm64/kernel/setup.c arch/arm64/kernel/smp.c arch/arm64/mm/dma-mapping.c arch/arm64/mm/fault.c arch/arm64/mm/proc.S drivers/base/power/wakeup.c drivers/clk/clk.c drivers/clk/qcom/clk-rcg2.c drivers/clocksource/arm_arch_timer.c drivers/devfreq/devfreq.c drivers/devfreq/governor_simpleondemand.c drivers/dma-buf/dma-buf.c drivers/extcon/extcon.c drivers/gpu/Makefile drivers/gpu/drm/drm_connector.c drivers/gpu/drm/drm_dp_mst_topology.c drivers/gpu/drm/drm_edid.c drivers/gpu/drm/drm_file.c drivers/gpu/drm/drm_panel.c drivers/gpu/drm/drm_property.c drivers/iommu/Kconfig drivers/iommu/Makefile drivers/iommu/arm-smmu.c drivers/iommu/dma-iommu.c drivers/iommu/dma-mapping-fast.c drivers/iommu/io-pgtable-arm.c drivers/iommu/io-pgtable-fast.c drivers/iommu/io-pgtable.c drivers/iommu/iommu.c drivers/irqchip/irq-gic-v3.c drivers/media/v4l2-core/v4l2-ioctl.c drivers/mmc/core/Kconfig drivers/mmc/core/block.c drivers/mmc/core/queue.c drivers/mmc/host/cqhci.c drivers/mmc/host/sdhci-msm.c drivers/net/wireless/ath/wil6210/interrupt.c drivers/net/wireless/ath/wil6210/main.c drivers/net/wireless/ath/wil6210/wil6210.h drivers/net/wireless/ath/wil6210/wmi.c drivers/nvmem/core.c drivers/nvmem/nvmem-sysfs.c drivers/of/fdt.c drivers/power/supply/power_supply_sysfs.c drivers/pwm/sysfs.c drivers/regulator/core.c drivers/scsi/sd.c drivers/scsi/ufs/ufshcd.c drivers/tty/serial/Kconfig drivers/tty/serial/Makefile drivers/usb/common/common.c fs/crypto/crypto.c fs/f2fs/checkpoint.c fs/f2fs/f2fs.h include/drm/drm_connector.h include/drm/drm_dp_mst_helper.h include/drm/drm_panel.h include/linux/clk-provider.h include/linux/dma-buf.h include/linux/dma-mapping-fast.h include/linux/dma-mapping.h include/linux/extcon.h include/linux/io-pgtable.h include/linux/iommu.h include/linux/kobject.h include/linux/mm.h include/linux/mm_types.h include/linux/mmc/host.h include/linux/netdevice.h include/linux/power_supply.h include/linux/pwm.h include/linux/regulator/driver.h include/linux/thermal.h include/linux/vm_event_item.h include/net/cfg80211.h include/scsi/scsi_device.h include/sound/pcm.h include/sound/soc.h include/uapi/drm/drm_mode.h include/uapi/linux/coresight-stm.h include/uapi/linux/ip.h include/uapi/linux/nl80211.h include/uapi/linux/videodev2.h include/uapi/sound/compress_offload.h kernel/dma/coherent.c kernel/dma/mapping.c kernel/panic.c kernel/power/qos.c kernel/sched/sched.h mm/Kconfig mm/filemap.c mm/swapfile.c mm/vmalloc.c mm/vmstat.c net/qrtr/qrtr.c net/wireless/nl80211.c net/wireless/scan.c sound/core/compress_offload.c sound/soc/soc-core.c sound/usb/card.c sound/usb/pcm.c sound/usb/pcm.h sound/usb/usbaudio.h Fixed build errors: drivers/base/power/main.c drivers/thermal/thermal_core.c drivers/cpuidle/lpm-levels.c include/soc/qcom/lpm_levels.h Change-Id: Idf25b239f53681bdfa2ef371a91720fadf1a3f01 Signed-off-by: Srinivasarao P <spathi@codeaurora.org>	2020-09-20 23:45:10 +05:30
Kishore Sri venkata Ganesh Bolisetty	db7aababa7	binder: update latency_sensitive flag for binder transactions ... To minimize wake up latency for binder transactions, set low_latency flag. Change-Id: If103199fc96e35d90b0eaaf32da38ae135976658 Signed-off-by: Kishore Sri venkata Ganesh Bolisetty <bsrivenk@codeaurora.org>	2020-07-14 20:15:41 -07:00
Gaurav Kohli	fa47f10173	binder: fix braces warning in binderfs ... Add braces to avoid compile time warning of missing braces. Change-Id: I9e9e26bfcf7cdb7ea24a8530989ff4480b6eb757 Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org>	2020-07-09 12:56:54 +05:30
Todd Kjos	a72dc1bf5d	binder: fix null deref of proc->context ... The binder driver makes the assumption proc->context pointer is invariant after initialization (as documented in the kerneldoc header for struct proc). However, in commit f0fe2c0f050d ("binder: prevent UAF for binderfs devices II") proc->context is set to NULL during binder_deferred_release(). Another proc was in the middle of setting up a transaction to the dying process and crashed on a NULL pointer deref on "context" which is a local set to &proc->context: new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1; Here's the stack: [ 5237.855435] Call trace: [ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec [ 5237.855446] binder_inc_ref_for_node+0x140/0x280 [ 5237.855451] binder_translate_binder+0x1d0/0x388 [ 5237.855456] binder_transaction+0x2228/0x3730 [ 5237.855461] binder_thread_write+0x640/0x25bc [ 5237.855466] binder_ioctl_write_read+0xb0/0x464 [ 5237.855471] binder_ioctl+0x30c/0x96c [ 5237.855477] do_vfs_ioctl+0x3e0/0x700 [ 5237.855482] __arm64_sys_ioctl+0x78/0xa4 [ 5237.855488] el0_svc_common+0xb4/0x194 [ 5237.855493] el0_svc_handler+0x74/0x98 [ 5237.855497] el0_svc+0x8/0xc The fix is to move the kfree of the binder_device to binder_free_proc() so the binder_device is freed when we know there are no references remaining on the binder_proc. Change-Id: Icb74dba032540a67854deb00e1e78e32326717b6 Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II") Signed-off-by: Todd Kjos <tkjos@google.com> Patch-mainline: linux-kernel @ 06/22/20, 13:07:15 -0700 Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>	2020-06-23 10:36:22 +05:30
Greg Kroah-Hartman	de1774a9d2	Merge 4.19.120 into android-4.19 ... Changes in 4.19.120 remoteproc: Fix wrong rvring index computation mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap binder: take read mode of mmap_sem in binder_alloc_free_page() usb: dwc3: gadget: Do link recovery for SS and SSP usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete iio:ad7797: Use correct attribute_group ASoC: q6dsp6: q6afe-dai: add missing channels to MI2S DAIs ASoC: tas571x: disable regulators on failed probe ASoC: wm8960: Fix wrong clock after suspend & resume nfsd: memory corruption in nfsd4_lock() i2c: altera: use proper variable to hold errno rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket net/cxgb4: Check the return from t4_query_params properly xfs: acquire superblock freeze protection on eofblocks scans svcrdma: Fix trace point use-after-free race svcrdma: Fix leak of svc_rdma_recv_ctxt objects PCI: Avoid ASMedia XHCI USB PME# from D0 defect PCI: Move Apex Edge TPU class quirk to fix BAR assignment ARM: dts: bcm283x: Disable dsi0 node cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled net/mlx5: Fix failing fw tracer allocation on s390 perf/core: fix parent pid/tid in task exit events bpf, x86_32: Fix incorrect encoding in BPF_LDX zero-extension mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path xfs: clear PF_MEMALLOC before exiting xfsaild thread bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B net: fec: set GPR bit on suspend by DT configuration. x86: hyperv: report value of misc_features xfs: fix partially uninitialized structure in xfs_reflink_remap_extent ALSA: hda: Keep the controller initialization even if no codecs found ALSA: hda: Explicitly permit using autosuspend if runtime PM is supported scsi: target: fix PR IN / READ FULL STATUS for FC scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings objtool: Support Clang non-section symbols in ORC dump xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status ALSA: hda: call runtime_allow() for all hda controllers arm64: Delete the space separator in __emit_inst ext4: use matching invalidatepage in ext4_writepage ext4: increase wait time needed before reuse of deleted inode numbers ext4: convert BUG_ON's to WARN_ON's in mballoc.c hwmon: (jc42) Fix name to have no illegal characters bpf, x86_32: Fix clobbering of dst for BPF_JSET qed: Fix use after free in qed_chain_free ext4: check for non-zero journal inum in ext4_calculate_overhead propagate_one(): mnt_set_mountpoint() needs mount_lock Linux 4.19.120 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ied3c507eb5bd85c39aff278827e534cf150e2cc0	2020-05-03 08:48:02 +02:00
Tyler Hicks	b4b9073a8a	binder: take read mode of mmap_sem in binder_alloc_free_page() ... commit 60d4885710836595192c42d3e04b27551d30ec91 upstream. Restore the behavior of locking mmap_sem for reading in binder_alloc_free_page(), as was first done in commit 3013bf62b67a ("binder: reduce mmap_sem write-side lock"). That change was inadvertently reverted by commit 5cec2d2e5839 ("binder: fix race between munmap() and direct reclaim"). In addition, change the name of the label for the error path to accurately reflect that we're taking the lock for reading. Backporting note: This fix is only needed when *both* of the commits mentioned above are applied. That's an unlikely situation since they both landed during the development of v5.1 but only one of them is targeted for stable. Fixes: 5cec2d2e5839 ("binder: fix race between munmap() and direct reclaim") Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Todd Kjos <tkjos@android.com> Cc: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-05-02 17:25:48 +02:00
Christian Brauner	e8281e59c9	UPSTREAM: binder: prevent UAF for binderfs devices II ... This is a necessary follow up to the first fix I proposed and we merged in 2669b8b0c79 ("binder: prevent UAF for binderfs devices"). I have been overly optimistic that the simple fix I proposed would work. But alas, ihold() + iput() won't work since the inodes won't survive the destruction of the superblock. So all we get with my prior fix is a different race with a tinier race-window but it doesn't solve the issue. Fwiw, the problem lies with generic_shutdown_super(). It even has this cozy Al-style comment: if (!list_empty(&sb->s_inodes)) { printk("VFS: Busy inodes after unmount of %s. " "Self-destruct in 5 seconds. Have a nice day...\n", sb->s_id); } On binder_release(), binder_defer_work(proc, BINDER_DEFERRED_RELEASE) is called which punts the actual cleanup operation to a workqueue. At some point, binder_deferred_func() will be called which will end up calling binder_deferred_release() which will retrieve and cleanup the binder_context attach to this struct binder_proc. If we trace back where this binder_context is attached to binder_proc we see that it is set in binder_open() and is taken from the struct binder_device it is associated with. This obviously assumes that the struct binder_device that context is attached to is _never_ freed. While that might be true for devtmpfs binder devices it is most certainly wrong for binderfs binder devices. So, assume binder_open() is called on a binderfs binder devices. We now stash away the struct binder_context associated with that struct binder_devices: proc->context = &binder_dev->context; /* binderfs stashes devices in i_private */ if (is_binderfs_device(nodp)) { binder_dev = nodp->i_private; info = nodp->i_sb->s_fs_info; binder_binderfs_dir_entry_proc = info->proc_log_dir; } else { . . . proc->context = &binder_dev->context; Now let's assume that the binderfs instance for that binder devices is shutdown via umount() and/or the mount namespace associated with it goes away. As long as there is still an fd open for that binderfs binder device things are fine. But let's assume we now close the last fd for that binderfs binder device. Now binder_release() is called and punts to the workqueue. Assume that the workqueue has quite a bit of stuff to do and doesn't get to cleaning up the struct binder_proc and the associated struct binder_context with it for that binderfs binder device right away. In the meantime, the VFS is killing the super block and is ultimately calling sb->evict_inode() which means it will call binderfs_evict_inode() which does: static void binderfs_evict_inode(struct inode *inode) { struct binder_device *device = inode->i_private; struct binderfs_info *info = BINDERFS_I(inode); clear_inode(inode); if (!S_ISCHR(inode->i_mode) || !device) return; mutex_lock(&binderfs_minors_mutex); --info->device_count; ida_free(&binderfs_minors, device->miscdev.minor); mutex_unlock(&binderfs_minors_mutex); kfree(device->context.name); kfree(device); } thereby freeing the struct binder_device including struct binder_context. Now the workqueue finally has time to get around to cleaning up struct binder_proc and is now trying to access the associate struct binder_context. Since it's already freed it will OOPs. Fix this by introducing a refounct on binder devices. This is an alternative fix to 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()"). Fixes: 3ad20fe393b3 ("binder: implement binderfs") Fixes: 2669b8b0c798 ("binder: prevent UAF for binderfs devices") Fixes: 03e2e07e3814 ("binder: Make transaction_log available in binderfs") Related: 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Acked-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20200303164340.670054-1-christian.brauner@ubuntu.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit f0fe2c0f050d31babcad7d65f1d550d462a40064) Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I54a6c910002bf1077ba0c34c48fb96f4ffbf012e	2020-03-09 19:48:21 +00:00
Christian Brauner	31ddf99370	UPSTREAM: binder: prevent UAF for binderfs devices ... On binder_release(), binder_defer_work(proc, BINDER_DEFERRED_RELEASE) is called which punts the actual cleanup operation to a workqueue. At some point, binder_deferred_func() will be called which will end up calling binder_deferred_release() which will retrieve and cleanup the binder_context attach to this struct binder_proc. If we trace back where this binder_context is attached to binder_proc we see that it is set in binder_open() and is taken from the struct binder_device it is associated with. This obviously assumes that the struct binder_device that context is attached to is _never_ freed. While that might be true for devtmpfs binder devices it is most certainly wrong for binderfs binder devices. So, assume binder_open() is called on a binderfs binder devices. We now stash away the struct binder_context associated with that struct binder_devices: proc->context = &binder_dev->context; /* binderfs stashes devices in i_private */ if (is_binderfs_device(nodp)) { binder_dev = nodp->i_private; info = nodp->i_sb->s_fs_info; binder_binderfs_dir_entry_proc = info->proc_log_dir; } else { . . . proc->context = &binder_dev->context; Now let's assume that the binderfs instance for that binder devices is shutdown via umount() and/or the mount namespace associated with it goes away. As long as there is still an fd open for that binderfs binder device things are fine. But let's assume we now close the last fd for that binderfs binder device. Now binder_release() is called and punts to the workqueue. Assume that the workqueue has quite a bit of stuff to do and doesn't get to cleaning up the struct binder_proc and the associated struct binder_context with it for that binderfs binder device right away. In the meantime, the VFS is killing the super block and is ultimately calling sb->evict_inode() which means it will call binderfs_evict_inode() which does: static void binderfs_evict_inode(struct inode *inode) { struct binder_device *device = inode->i_private; struct binderfs_info *info = BINDERFS_I(inode); clear_inode(inode); if (!S_ISCHR(inode->i_mode) || !device) return; mutex_lock(&binderfs_minors_mutex); --info->device_count; ida_free(&binderfs_minors, device->miscdev.minor); mutex_unlock(&binderfs_minors_mutex); kfree(device->context.name); kfree(device); } thereby freeing the struct binder_device including struct binder_context. Now the workqueue finally has time to get around to cleaning up struct binder_proc and is now trying to access the associate struct binder_context. Since it's already freed it will OOPs. Fix this by holding an additional reference to the inode that is only released once the workqueue is done cleaning up struct binder_proc. This is an easy alternative to introducing separate refcounting on struct binder_device which we can always do later if it becomes necessary. This is an alternative fix to 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()"). Fixes: 3ad20fe393b3 ("binder: implement binderfs") Fixes: 03e2e07e3814 ("binder: Make transaction_log available in binderfs") Related: 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 2669b8b0c798fbe1a31d49e07aa33233d469ad9b) Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I047a1e360b4146872bbc1d206dce7a864bb4588b	2020-03-09 19:48:07 +00:00
Todd Kjos	64b698c15a	UPSTREAM: binder: fix incorrect calculation for num_valid ... commit 16981742717b04644a41052570fb502682a315d2 upstream. For BINDER_TYPE_PTR and BINDER_TYPE_FDA transactions, the num_valid local was calculated incorrectly causing the range check in binder_validate_ptr() to miss out-of-bounds offsets. Fixes: bde4a19fc04f ("binder: use userspace pointer as base of buffer space") Change-Id: Ida77db13d8e5b726f0b14513f55c2b30277338cd Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191213202531.55010-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 145988638 Signed-off-by: Todd Kjos <tkjos@google.com>	2019-12-18 19:49:13 +00:00
Greg Kroah-Hartman	e5312e5d68	Merge 4.19.89 into android-4.19 ... Changes in 4.19.89 rsi: release skb if rsi_prepare_beacon fails arm64: tegra: Fix 'active-low' warning for Jetson TX1 regulator sparc64: implement ioremap_uc lp: fix sparc64 LPSETTIMEOUT ioctl usb: gadget: u_serial: add missing port entry locking tty: serial: fsl_lpuart: use the sg count from dma_map_sg tty: serial: msm_serial: Fix flow control serial: pl011: Fix DMA ->flush_buffer() serial: serial_core: Perform NULL checks for break_ctl ops serial: ifx6x60: add missed pm_runtime_disable autofs: fix a leak in autofs_expire_indirect() RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN iwlwifi: pcie: don't consider IV len in A-MSDU exportfs_decode_fh(): negative pinned may become positive without the parent locked audit_get_nd(): don't unlock parent too early NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error xfrm: release device reference for invalid state Input: cyttsp4_core - fix use after free bug sched/core: Avoid spurious lock dependencies perf/core: Consistently fail fork on allocation failures ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() drm/sun4i: tcon: Set min division of TCON0_DCLK to 1. selftests: kvm: fix build with glibc >= 2.30 rsxx: add missed destroy_workqueue calls in remove net: ep93xx_eth: fix mismatch of request_mem_region in remove i2c: core: fix use after free in of_i2c_notify serial: core: Allow processing sysrq at port unlock time cxgb4vf: fix memleak in mac_hlist initialization iwlwifi: mvm: synchronize TID queue removal iwlwifi: trans: Clear persistence bit when starting the FW iwlwifi: mvm: Send non offchannel traffic via AP sta ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ audit: Embed key into chunk netfilter: nf_tables: don't use position attribute on rule replacement ARC: IOC: panic if kernel was started with previously enabled IOC net/mlx5: Release resource on error flow clk: sunxi-ng: a64: Fix gate bit of DSI DPHY ice: Fix NVM mask defines dlm: fix possible call to kfree() for non-initialized pointer ARM: dts: exynos: Fix LDO13 min values on Odroid XU3/XU4/HC1 extcon: max8997: Fix lack of path setting in USB device mode net: ethernet: ti: cpts: correct debug for expired txq skb rtc: s3c-rtc: Avoid using broken ALMYEAR register rtc: max77686: Fix the returned value in case of error in 'max77686_rtc_read_time()' i40e: don't restart nway if autoneg not supported virtchnl: Fix off by one error clk: rockchip: fix rk3188 sclk_smc gate data clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name dlm: fix missing idr_destroy for recover_idr MIPS: SiByte: Enable ZONE_DMA32 for LittleSur net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing MII_PHYSID2 scsi: zfcp: update kernel message for invalid FCP_CMND length, it's not the CDB scsi: zfcp: drop default switch case which might paper over missing case drivers: soc: Allow building the amlogic drivers without ARCH_MESON bus: ti-sysc: Fix getting optional clocks in clock_roles ARM: dts: imx6: RDU2: fix eGalax touchscreen node crypto: ecc - check for invalid values in the key verification test crypto: bcm - fix normal/non key hash algorithm failure arm64: dts: zynqmp: Fix node names which contain "_" pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues Staging: iio: adt7316: Fix i2c data reading, set the data field firmware: raspberrypi: Fix firmware calls with large buffers mm/vmstat.c: fix NUMA statistics updates clk: rockchip: fix I2S1 clock gate register for rk3328 clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328 sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit regulator: Fix return value of _set_load() stub USB: serial: f81534: fix reading old/new IC config xfs: extent shifting doesn't fully invalidate page cache net-next/hinic:fix a bug in set mac address net-next/hinic: fix a bug in rx data flow ice: Fix return value from NAPI poll ice: Fix possible NULL pointer de-reference iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents iomap: sub-block dio needs to zeroout beyond EOF iomap: dio data corruption and spurious errors when pipes fill iomap: readpages doesn't zero page tail beyond EOF iw_cxgb4: only reconnect with MPAv1 if the peer aborts MIPS: OCTEON: octeon-platform: fix typing net/smc: use after free fix in smc_wr_tx_put_slot() math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning nds32: Fix the items of hwcap_str ordering issue. rtc: max8997: Fix the returned value in case of error in 'max8997_rtc_read_alarm()' rtc: dt-binding: abx80x: fix resistance scale ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module media: coda: fix memory corruption in case more than 32 instances are opened media: pulse8-cec: return 0 when invalidating the logical address media: cec: report Vendor ID after initialization iwlwifi: fix cfg structs for 22000 with different RF modules ravb: Clean up duplex handling net/ipv6: re-do dad when interface has IFF_NOARP flag change dmaengine: coh901318: Fix a double-lock bug dmaengine: coh901318: Remove unused variable dmaengine: dw-dmac: implement dma protection control setting net: qualcomm: rmnet: move null check on dev before dereferecing it selftests/powerpc: Allocate base registers selftests/powerpc: Skip test instead of failing usb: dwc3: debugfs: Properly print/set link state for HS usb: dwc3: don't log probe deferrals; but do log other error codes ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion() f2fs: fix to account preflush command for noflush_merge mode f2fs: fix count of seg_freed to make sec_freed correct f2fs: change segment to section in f2fs_ioc_gc_range ARM: dts: rockchip: Fix the PMU interrupt number for rv1108 ARM: dts: rockchip: Assign the proper GPIO clocks for rv1108 f2fs: fix to allow node segment for GC by ioctl path sparc: Fix JIT fused branch convergance. sparc: Correct ctx->saw_frame_pointer logic. nvme: Free ctrl device name on init failure dma-mapping: fix return type of dma_set_max_seg_size() slimbus: ngd: Fix build error on x86 altera-stapl: check for a null key before strcasecmp'ing it serial: imx: fix error handling in console_setup i2c: imx: don't print error message on probe defer clk: meson: Fix GXL HDMI PLL fractional bits width gpu: host1x: Fix syncpoint ID field size on Tegra186 lockd: fix decoding of TEST results sctp: increase sk_wmem_alloc when head->truesize is increased iommu/amd: Fix line-break in error log reporting ASoC: rsnd: tidyup registering method for rsnd_kctrl_new() ARM: dts: sun4i: Fix gpio-keys warning ARM: dts: sun4i: Fix HDMI output DTC warning ARM: dts: sun5i: a10s: Fix HDMI output DTC warning ARM: dts: r8a779[01]: Disable unconnected LVDS encoders ARM: dts: sun7i: Fix HDMI output DTC warning ARM: dts: sun8i: a23/a33: Fix OPP DTC warnings ARM: dts: sun8i: v3s: Change pinctrl nodes to avoid warning dlm: NULL check before kmem_cache_destroy is not needed ARM: debug: enable UART1 for socfpga Cyclone5 can: xilinx: fix return type of ndo_start_xmit function nfsd: fix a warning in __cld_pipe_upcall() bpf: btf: implement btf_name_valid_identifier() bpf: btf: check name validity for various types tools: bpftool: fix a bitfield pretty print issue ASoC: au8540: use 64-bit arithmetic instead of 32-bit ARM: OMAP1/2: fix SoC name printing arm64: dts: meson-gxl-libretech-cc: fix GPIO lines names arm64: dts: meson-gxbb-nanopi-k2: fix GPIO lines names arm64: dts: meson-gxbb-odroidc2: fix GPIO lines names arm64: dts: meson-gxl-khadas-vim: fix GPIO lines names net/x25: fix called/calling length calculation in x25_parse_address_block net/x25: fix null_x25_address handling tools/bpf: make libbpf _GNU_SOURCE friendly clk: mediatek: Drop __init from mtk_clk_register_cpumuxes() clk: mediatek: Drop more __init markings for driver probe soc: renesas: r8a77970-sysc: Correct names of A2DP/A2CN power domains soc: renesas: r8a77980-sysc: Correct names of A2DP[01] power domains soc: renesas: r8a77980-sysc: Correct A3VIP[012] power domain hierarchy kbuild: disable dtc simple_bus_reg warnings by default tcp: make tcp_space() aware of socket backlog ARM: dts: mmp2: fix the gpio interrupt cell number ARM: dts: realview-pbx: Fix duplicate regulator nodes tcp: fix off-by-one bug on aborting window-probing socket tcp: fix SNMP under-estimation on failed retransmission tcp: fix SNMP TCP timeout under-estimation modpost: skip ELF local symbols during section mismatch check kbuild: fix single target build for external module mtd: fix mtd_oobavail() incoherent returned value ARM: dts: pxa: clean up USB controller nodes clk: meson: meson8b: fix the offset of vid_pll_dco's N value clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent clk: qcom: Fix MSM8998 resets media: cxd2880-spi: fix probe when dvb_attach fails ARM: dts: realview: Fix some more duplicate regulator nodes dlm: fix invalid cluster name warning net/mlx4_core: Fix return codes of unsupported operations pstore/ram: Avoid NULL deref in ftrace merging failure path powerpc/math-emu: Update macros from GCC clk: renesas: r8a77990: Correct parent clock of DU clk: renesas: r8a77995: Correct parent clock of DU MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition nfsd: Return EPERM, not EACCES, in some SETATTR cases media: uvcvideo: Abstract streaming object lifetime tty: serial: qcom_geni_serial: Fix softlock ARM: dts: sun8i: h3: Fix the system-control register range tty: Don't block on IO when ldisc change is pending media: stkwebcam: Bugfix for wrong return values firmware: qcom: scm: fix compilation error when disabled clk: qcom: gcc-msm8998: Disable halt check of UFS clocks sctp: frag_point sanity check soc: renesas: r8a77990-sysc: Fix initialization order of 3DG-{A,B} mlxsw: spectrum_router: Relax GRE decap matching check IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state IB/hfi1: Close VNIC sdma_progress sleep window mlx4: Use snprintf instead of complicated strcpy usb: mtu3: fix dbginfo in qmu_tx_zlp_error_handler clk: renesas: rcar-gen3: Set state when registering SD clocks ASoC: max9867: Fix power management ARM: dts: sunxi: Fix PMU compatible strings ARM: dts: am335x-pdu001: Fix polarity of card detection input media: vimc: fix start stream when link is disabled net: aquantia: fix RSS table and key sizes sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision fuse: verify nlink fuse: verify attributes ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 ALSA: pcm: oss: Avoid potential buffer overflows ALSA: hda - Add mute led support for HP ProBook 645 G4 Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers Input: goodix - add upside-down quirk for Teclast X89 tablet coresight: etm4x: Fix input validation for sysfs. Input: Fix memory leak in psxpad_spi_probe x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all() x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect xfrm interface: fix memory leak on creation xfrm interface: avoid corruption on changelink xfrm interface: fix list corruption for x-netns xfrm interface: fix management of phydev CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks CIFS: Fix SMB2 oplock break processing tty: vt: keyboard: reject invalid keycodes can: slcan: Fix use-after-free Read in slcan_open kernfs: fix ino wrap-around detection jbd2: Fix possible overflow in jbd2_log_space_left() drm/msm: fix memleak on release drm/i810: Prevent underflow in ioctl arm64: dts: exynos: Revert "Remove unneeded address space mapping for soc node" KVM: arm/arm64: vgic: Don't rely on the wrong pending table KVM: x86: do not modify masked bits of shared MSRs KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES KVM: x86: Grab KVM's srcu lock when setting nested state crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize crypto: af_alg - cast ki_complete ternary op to int crypto: ccp - fix uninitialized list head crypto: ecdh - fix big endian bug in ECC library crypto: user - fix memory leak in crypto_report spi: atmel: Fix CS high support mwifiex: update set_mac_address logic can: ucan: fix non-atomic allocation in completion handler RDMA/qib: Validate ->show()/store() callbacks before calling them iomap: Fix pipe page leakage during splicing thermal: Fix deadlock in thermal thermal_zone_device_check vcs: prevent write access to vcsu devices binder: Fix race between mmap() and binder_alloc_print_pages() binder: Handle start==NULL in binder_update_page_range() ALSA: hda - Fix pending unsol events at shutdown md/raid0: Fix an error message in raid0_make_request() watchdog: aspeed: Fix clock behaviour for ast2600 perf script: Fix invalid LBR/binary mismatch error splice: don't read more than available pipe space iomap: partially revert 4721a601099 (simulated directio short read on EFAULT) xfs: add missing error check in xfs_prepare_shift() ASoC: rsnd: fixup MIX kctrl registration KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) net: qrtr: fix memort leak in qrtr_tun_write_iter appletalk: Fix potential NULL pointer dereference in unregister_snap_client appletalk: Set error code if register_snap_client failed Linux 4.19.89 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie3fa59adde9a7e9a6d4684de0e95de14a8b83d0b	2019-12-13 10:01:10 +01:00
Jann Horn	af0174a63c	binder: Handle start==NULL in binder_update_page_range() ... commit 2a9edd056ed4fbf9d2e797c3fc06335af35bccc4 upstream. The old loop wouldn't stop when reaching `start` if `start==NULL`, instead continuing backwards to index -1 and crashing. Luckily you need to be highly privileged to map things at NULL, so it's not a big problem. Fix it by adjusting the loop so that the loop variable is always in bounds. This patch is deliberately minimal to simplify backporting, but IMO this function could use a refactor. The jump labels in the second loop body are horrible (the error gotos should be jumping to free_range instead), and both loops would look nicer if they just iterated upwards through indices. And the up_read()+mmput() shouldn't be duplicated like that. Cc: stable@vger.kernel.org Fixes: 457b9a6f09 ("Staging: android: add binder driver") Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20191018205631.248274-3-jannh@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-13 08:52:52 +01:00
Jann Horn	fe0d31eddb	binder: Fix race between mmap() and binder_alloc_print_pages() ... commit 8eb52a1ee37aafd9b796713aa0b3ab9cbc455be3 upstream. binder_alloc_print_pages() iterates over alloc->pages[0..alloc->buffer_size-1] under alloc->mutex. binder_alloc_mmap_handler() writes alloc->pages and alloc->buffer_size without holding that lock, and even writes them before the last bailout point. Unfortunately we can't take the alloc->mutex in the ->mmap() handler because mmap_sem can be taken while alloc->mutex is held. So instead, we have to locklessly check whether the binder_alloc has been fully initialized with binder_alloc_get_vma(), like in binder_alloc_new_buf_locked(). Fixes: 8ef4665aa1 ("android: binder: Add page usage in binder stats") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20191018205631.248274-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-13 08:52:51 +01:00
Hridya Valsaraju	725ce554a4	UPSTREAM: binder: Add binder_proc logging to binderfs ... Currently /sys/kernel/debug/binder/proc contains the debug data for every binder_proc instance. This patch makes this information also available in a binderfs instance mounted with a mount option "stats=global" in addition to debugfs. The patch does not affect the presence of the file in debugfs. If a binderfs instance is mounted at path /dev/binderfs, this file would be present at /dev/binderfs/binder_logs/proc. This change provides an alternate way to access this file when debugfs is not mounted. Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Link: https://lore.kernel.org/r/20190903161655.107408-5-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 4feb80faf428a02d407a9ea1952004af01308765) Change-Id: I3aa974979f2d4aebbe79ea9df30ede2813826157	2019-12-08 21:46:53 -08:00
Hridya Valsaraju	ce106a8de6	UPSTREAM: binder: Make transaction_log available in binderfs ... Currently, the binder transaction log files 'transaction_log' and 'failed_transaction_log' live in debugfs at the following locations: /sys/kernel/debug/binder/failed_transaction_log /sys/kernel/debug/binder/transaction_log This patch makes these files also available in a binderfs instance mounted with the mount option "stats=global". It does not affect the presence of these files in debugfs. If a binderfs instance is mounted at path /dev/binderfs, the location of these files will be as follows: /dev/binderfs/binder_logs/failed_transaction_log /dev/binderfs/binder_logs/transaction_log This change provides an alternate option to access these files when debugfs is not mounted. Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Link: https://lore.kernel.org/r/20190903161655.107408-4-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit c31e73121f4c1ec41143423ac6ce3ce6dafdcec1) Change-Id: I20d9e6c4c7115297f9740cc42a516c315b3a209e	2019-12-08 21:46:47 -08:00
Hridya Valsaraju	7aeb384a5f	UPSTREAM: binder: Add stats, state and transactions files ... The following binder stat files currently live in debugfs. /sys/kernel/debug/binder/state /sys/kernel/debug/binder/stats /sys/kernel/debug/binder/transactions This patch makes these files available in a binderfs instance mounted with the mount option 'stats=global'. For example, if a binderfs instance is mounted at path /dev/binderfs, the above files will be available at the following locations: /dev/binderfs/binder_logs/state /dev/binderfs/binder_logs/stats /dev/binderfs/binder_logs/transactions This provides a way to access them even when debugfs is not mounted. Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20190903161655.107408-3-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 0e13e452dafc009049a9a5a4153e2f9e51b23915) Change-Id: Ieeb666a719fb3195133403054de7b103a358e1ae	2019-12-08 21:46:40 -08:00
Hridya Valsaraju	2c164059d0	UPSTREAM: binder: add a mount option to show global stats ... Currently, all binder state and statistics live in debugfs. We need this information even when debugfs is not mounted. This patch adds the mount option 'stats' to enable a binderfs instance to have binder debug information present in the same. 'stats=global' will enable the global binder statistics. In the future, 'stats=local' will enable binder statistics local to the binderfs instance. The two modes 'global' and 'local' will be mutually exclusive. 'stats=global' option is only available for a binderfs instance mounted in the initial user namespace. An attempt to use the option to mount a binderfs instance in another user namespace will return an EPERM error. Signed-off-by: Hridya Valsaraju <hridya@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20190903161655.107408-2-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit f00834518ed3194b866f5f3d63b71e0ed7f6bc00) Change-Id: I4c9da221e7e19729a6489436ffa6233864eac4f7	2019-12-08 21:46:35 -08:00
Hridya Valsaraju	b8387dee32	UPSTREAM: binder: Validate the default binderfs device names. ... Length of a binderfs device name cannot exceed BINDERFS_MAX_NAME. This patch adds a check in binderfs_init() to ensure the same for the default binder devices that will be created in every binderfs instance. Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Hridya Valsaraju <hridya@google.com> Bug: 136497735 (cherry picked from commit 028fb5822b76bc2e095b5c145d7bd263878d9e27) Change-Id: I347a427690ae35c792ce15afc90151937b879ef7	2019-12-08 21:46:28 -08:00
Hridya Valsaraju	5d46bcfa79	UPSTREAM: binder: Add default binder devices through binderfs when configured ... Currently, since each binderfs instance needs its own private binder devices, every time a binderfs instance is mounted, all the default binder devices need to be created via the BINDER_CTL_ADD IOCTL. This patch aims to add a solution to automatically create the default binder devices for each binderfs instance that gets mounted. To achieve this goal, when CONFIG_ANDROID_BINDERFS is set, the default binder devices specified by CONFIG_ANDROID_BINDER_DEVICES are created in each binderfs instance instead of global devices being created by the binder driver. Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Bug: 136497735 (cherry picked from commit ca2864c6e8965c37df97f11e6f99e83e09806b1c) Change-Id: I4f6c5d95997ffd3df182d6ec32d467b15d1f0c42 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:46:21 -08:00
Christian Brauner	c30322673b	UPSTREAM: binder: fix CONFIG_ANDROID_BINDER_DEVICES ... Several users have tried to only rely on binderfs to provide binder devices and set CONFIG_ANDROID_BINDER_DEVICES="" empty. This is a great use-case of binderfs and one that was always intended to work. However, this is currently not possible since setting CONFIG_ANDROID_BINDER_DEVICES="" emtpy will simply panic the kernel: kobject: (00000000028c2f79): attempted to be registered with empty name! WARNING: CPU: 7 PID: 1703 at lib/kobject.c:228 kobject_add_internal+0x288/0x2b0 Modules linked in: binder_linux(+) bridge stp llc ipmi_ssif gpio_ich dcdbas coretemp kvm_intel kvm irqbypass serio_raw input_leds lpc_ich i5100_edac mac_hid ipmi_si ipmi_devintf ipmi_msghandler sch_fq_codel ib_i CPU: 7 PID: 1703 Comm: modprobe Not tainted 5.0.0-rc2-brauner-binderfs #263 Hardware name: Dell DCS XS24-SC2 /XS24-SC2 , BIOS S59_3C20 04/07/2011 RIP: 0010:kobject_add_internal+0x288/0x2b0 Code: 12 95 48 c7 c7 78 63 3b 95 e8 77 35 71 ff e9 91 fe ff ff 0f 0b eb a7 0f 0b eb 9a 48 89 de 48 c7 c7 00 63 3b 95 e8 f8 95 6a ff <0f> 0b 41 bc ea ff ff ff e9 6d fe ff ff 41 bc fe ff ff ff e9 62 fe RSP: 0018:ffff973f84237a30 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8b53e2472010 RCX: 0000000000000006 RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffff8b53edbd63a0 RBP: ffff973f84237a60 R08: 0000000000000342 R09: 0000000000000004 R10: ffff973f84237af0 R11: 0000000000000001 R12: 0000000000000000 R13: ffff8b53e9f1a1e0 R14: 00000000e9f1a1e0 R15: 0000000000a00037 FS: 00007fbac36f7540(0000) GS:ffff8b53edbc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbac364cfa7 CR3: 00000004a6d48000 CR4: 00000000000406e0 Call Trace: kobject_add+0x71/0xd0 ? _cond_resched+0x19/0x40 ? mutex_lock+0x12/0x40 device_add+0x12e/0x6b0 device_create_groups_vargs+0xe4/0xf0 device_create_with_groups+0x3f/0x60 ? _cond_resched+0x19/0x40 misc_register+0x140/0x180 binder_init+0x1ed/0x2d4 [binder_linux] ? trace_event_define_fields_binder_transaction_fd_send+0x8e/0x8e [binder_linux] do_one_initcall+0x4a/0x1c9 ? _cond_resched+0x19/0x40 ? kmem_cache_alloc_trace+0x151/0x1c0 do_init_module+0x5f/0x216 load_module+0x223d/0x2b20 __do_sys_finit_module+0xfc/0x120 ? __do_sys_finit_module+0xfc/0x120 __x64_sys_finit_module+0x1a/0x20 do_syscall_64+0x5a/0x120 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fbac3202839 Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd1494a908 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 000055b629ebec60 RCX: 00007fbac3202839 RDX: 0000000000000000 RSI: 000055b629c20d2e RDI: 0000000000000003 RBP: 000055b629c20d2e R08: 0000000000000000 R09: 000055b629ec2310 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 000055b629ebed70 R14: 0000000000040000 R15: 000055b629ebec60 So check for the empty string since strsep() will otherwise return the emtpy string which will cause kobject_add_internal() to panic when trying to add a kobject with an emtpy name. Fixes: ac4812c5ff ("binder: Support multiple /dev instances") Cc: Martijn Coenen <maco@google.com> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Acked-by: Todd Kjos <tkjos@google.com> Bug: 136497735 (cherry picked from commit 793c8232937610ae00bc174b87d7fc324346eaea) Change-Id: I2ad3e2370596ced6ab2b2b197421182f9f9485e7 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:45:58 -08:00
Rasmus Villemoes	760b8036e6	UPSTREAM: android: binder: use kstrdup instead of open-coding it ... Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Bug: 136497735 Change-Id: I545073facdb76ea12accfc7bfa4738f2e3bf0b28 (cherry picked from commit 6b6642dadd685af885367d6e30f18553e2a23b22) Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:45:48 -08:00
Christian Brauner	8d0719a920	UPSTREAM: binderfs: remove separate device_initcall() ... binderfs should not have a separate device_initcall(). When a kernel is compiled with CONFIG_ANDROID_BINDERFS register the filesystem alongside CONFIG_ANDROID_IPC. This use-case is especially sensible when users specify CONFIG_ANDROID_IPC=y, CONFIG_ANDROID_BINDERFS=y and ANDROID_BINDER_DEVICES="". When CONFIG_ANDROID_BINDERFS=n then this always succeeds so there's no regression potential for legacy workloads. Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 5b9633af298bfd1de650f6774d3fada546543101) Change-Id: I91892655d9d36df5218189f7874312eec7ae3c46 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:45:36 -08:00
Christian Brauner	7654fff18f	UPSTREAM: binderfs: respect limit on binder control creation ... We currently adhere to the reserved devices limit when creating new binderfs devices in binderfs instances not located in the inital ipc namespace. But it is still possible to rob the host instances of their 4 reserved devices by creating the maximum allowed number of devices in a single binderfs instance located in a non-initial ipc namespace and then mounting 4 separate binderfs instances in non-initial ipc namespaces. That happens because the limit is currently not respected for the creation of the initial binder-control device node. Block this nonsense by performing the same check in binderfs_binder_ctl_create() that we perform in binderfs_binder_device_create(). Fixes: 36bdf3cae09d ("binderfs: reserve devices for initial mount") Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit da8ddba566ff0a883237dbc8c5dadef1ca769e19) Change-Id: I7e170260ce79fc23a034ce75450d58ff39a7b902 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:45:24 -08:00
Christian Brauner	0c11523bd0	UPSTREAM: binderfs: switch from d_add() to d_instantiate() ... In a previous commit we switched from a d_alloc_name() + d_lookup() combination to setup a new dentry and find potential duplicates to the more idiomatic lookup_one_len(). As far as I understand, this also means we need to switch from d_add() to d_instantiate() since lookup_one_len() will create a new dentry when it doesn't find an existing one and add the new dentry to the hash queues. So we only need to call d_instantiate() to connect the dentry to the inode and turn it into a positive dentry. If we were to use d_add() we sure see stack traces like the following indicating that adding the same dentry twice over the same inode: [ 744.441889] CPU: 4 PID: 2849 Comm: landscape-sysin Not tainted 5.0.0-rc1-brauner-binderfs #243 [ 744.441889] Hardware name: Dell DCS XS24-SC2 /XS24-SC2 , BIOS S59_3C20 04/07/2011 [ 744.441889] RIP: 0010:__d_lookup_rcu+0x76/0x190 [ 744.441889] Code: 89 75 c0 49 c1 e9 20 49 89 fd 45 89 ce 41 83 e6 07 42 8d 04 f5 00 00 00 00 89 45 c8 eb 0c 48 8b 1b 48 85 db 0f 84 81 00 00 00 <44> 8b 63 fc 4c 3b 6b 10 75 ea 48 83 7b 08 00 74 e3 41 83 e4 fe 41 [ 744.441889] RSP: 0018:ffffb8c984e27ad0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 744.441889] RAX: 0000000000000038 RBX: ffff9407ef770c08 RCX: ffffb8c980011000 [ 744.441889] RDX: ffffb8c984e27b54 RSI: ffffb8c984e27ce0 RDI: ffff9407e6689600 [ 744.441889] RBP: ffffb8c984e27b28 R08: ffffb8c984e27ba4 R09: 0000000000000007 [ 744.441889] R10: ffff9407e5c4f05c R11: 973f3eb9d84a94e5 R12: 0000000000000002 [ 744.441889] R13: ffff9407e6689600 R14: 0000000000000007 R15: 00000007bfef7a13 [ 744.441889] FS: 00007f0db13bb740(0000) GS:ffff9407f3b00000(0000) knlGS:0000000000000000 [ 744.441889] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 744.441889] CR2: 00007f0dacc51024 CR3: 000000032961a000 CR4: 00000000000006e0 [ 744.441889] Call Trace: [ 744.441889] lookup_fast+0x53/0x300 [ 744.441889] walk_component+0x49/0x350 [ 744.441889] ? inode_permission+0x63/0x1a0 [ 744.441889] link_path_walk.part.33+0x1bc/0x5a0 [ 744.441889] ? path_init+0x190/0x310 [ 744.441889] path_lookupat+0x95/0x210 [ 744.441889] filename_lookup+0xb6/0x190 [ 744.441889] ? __check_object_size+0xb8/0x1b0 [ 744.441889] ? strncpy_from_user+0x50/0x1a0 [ 744.441889] user_path_at_empty+0x36/0x40 [ 744.441889] ? user_path_at_empty+0x36/0x40 [ 744.441889] vfs_statx+0x76/0xe0 [ 744.441889] __do_sys_newstat+0x3d/0x70 [ 744.441889] __x64_sys_newstat+0x16/0x20 [ 744.441889] do_syscall_64+0x5a/0x120 [ 744.441889] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 744.441889] RIP: 0033:0x7f0db0ec2775 [ 744.441889] Code: 00 00 00 75 05 48 83 c4 18 c3 e8 26 55 02 00 66 0f 1f 44 00 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 e1 b6 2d 00 f7 d8 64 89 [ 744.441889] RSP: 002b:00007ffc36bc9388 EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 744.441889] RAX: ffffffffffffffda RBX: 00007ffc36bc9300 RCX: 00007f0db0ec2775 [ 744.441889] RDX: 00007ffc36bc9400 RSI: 00007ffc36bc9400 RDI: 00007f0dad26f050 [ 744.441889] RBP: 0000000000c0bc60 R08: 0000000000000000 R09: 0000000000000001 [ 744.441889] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc36bc9400 [ 744.441889] R13: 0000000000000001 R14: 00000000ffffff9c R15: 0000000000c0bc60 Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 01684db950ea2b840531ab9298a8785776b6f6e8) Change-Id: I5e7cd8df8210943ee59e1297f2eb8f81f5fa2cb5 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:45:10 -08:00
Christian Brauner	2cb9e4c1f1	UPSTREAM: binderfs: drop lock in binderfs_binder_ctl_create ... The binderfs_binder_ctl_create() call is a no-op on subsequent calls and the first call is done before we unlock the suberblock. Hence, there is no need to take inode_lock() in there. Let's remove it. Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 29ef1c8e16aed079ac09989d752e38d412b6e1a8) Change-Id: I7c294796ac7891f62387e09dc34332ca4c3ee67b Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:45:00 -08:00
Christian Brauner	dd9111f9a9	UPSTREAM: binderfs: kill_litter_super() before cleanup ... Al pointed out that first calling kill_litter_super() before cleaning up info is more correct since destroying info doesn't depend on the state of the dentries and inodes. That the opposite remains true is not guaranteed. Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 4198479524aeccaf53c3a4cc73784982535573fa) Change-Id: Ie2dfc2c2f17dde25b4215853b05fa8f21fb6b298 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:44:47 -08:00
Christian Brauner	87c091ea68	UPSTREAM: binderfs: rework binderfs_binder_device_create() ... - switch from d_alloc_name() + d_lookup() to lookup_one_len(): Instead of using d_alloc_name() and then doing a d_lookup() with the allocated dentry to find whether a device with the name we're trying to create already exists switch to using lookup_one_len(). The latter will either return the existing dentry or a new one. - switch from kmalloc() + strscpy() to kmemdup(): Use a more idiomatic way to copy the name for the new dentry that userspace gave us. Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 01b3f1fc568352a1ffdcd3ee82a0297f16cc9bd9) Change-Id: I993a7dfa2f48bc6deb305852ff4085dc8dcaae4d Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:44:33 -08:00
Christian Brauner	34ffb8ef8e	UPSTREAM: binderfs: rework binderfs_fill_super() ... Al pointed out that on binderfs_fill_super() error deactivate_locked_super() will call binderfs_kill_super() so all of the freeing and putting we currently do in binderfs_fill_super() is unnecessary and buggy. Let's simply return errors and let binderfs_fill_super() take care of cleaning up on error. Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 36975fc3e5f241cc4f45df4ab4624d7d5199d9ed) Change-Id: I89cac3746d67638901e554c3ede6c0f2931e67d4 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:43:56 -08:00
Christian Brauner	65d2e4cb02	UPSTREAM: binderfs: prevent renaming the control dentry ... - make binderfs control dentry immutable: We don't allow to unlink it since it is crucial for binderfs to be useable but if we allow to rename it we make the unlink trivial to bypass. So prevent renaming too and simply treat the control dentry as immutable. - add is_binderfs_control_device() helper: Take the opportunity and turn the check for the control dentry into a separate helper is_binderfs_control_device() since it's now used in two places. - simplify binderfs_rename(): Instead of hand-rolling our custom version of simple_rename() just dumb the whole function down to first check whether we're trying to rename the control dentry. If we do EPERM the caller and if not call simple_rename(). Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit e98e6fa18636609f14a7f866524950a783cf4fbf) Change-Id: I44e49a144b624c360ab8a277970625c64511da15 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:43:43 -08:00
Christian Brauner	d1531c57b4	UPSTREAM: binderfs: remove outdated comment ... The comment stems from an early version of that patchset and is just confusing now. Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 7c4d08fc4d5aca073bd4ebecbb9eda5e4d858b71) Change-Id: I8d5376e217763d7a6203a54516d4220ccdbe268d Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:43:31 -08:00
Wei Yongjun	01408afb08	UPSTREAM: binderfs: fix error return code in binderfs_fill_super() ... Fix to return a negative error code -ENOMEM from the new_inode() and d_make_root() error handling cases instead of 0, as done elsewhere in this function. Fixes: 849d540ddfcd ("binderfs: implement "max" mount option") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Reviewed-by: Christian Brauner <christian@brauner.io> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 7e7ca7744a539f1a172e3b81c29d000787e3d774) Change-Id: If9d120c4abdbc0d5528c85d2515a9d5e40addfdc Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:43:19 -08:00
Christian Brauner	2e2d87cd43	UPSTREAM: binderfs: handle !CONFIG_IPC_NS builds ... kbuild reported a build faile in [1]. This is triggered when CONFIG_IPC_NS is not set. So let's make the use of init_ipc_ns conditional on CONFIG_IPC_NS being set. [1]: https://lists.01.org/pipermail/kbuild-all/2019-January/056903.html Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 7fefaadd6a962987baac50e7b3c4c3d5ef9b55c6) Change-Id: I97b0a7a13a82d79d97fe340d4267795e4e6442c7 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:43:06 -08:00
Christian Brauner	cbfaab8aa3	UPSTREAM: binderfs: reserve devices for initial mount ... The binderfs instance in the initial ipc namespace will always have a reserve of 4 binder devices unless explicitly capped by specifying a lower value via the "max" mount option. This ensures when binder devices are removed (on accident or on purpose) they can always be recreated without risking that all minor numbers have already been used up. Cc: Todd Kjos <tkjos@google.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 36bdf3cae09df891b191f3955c8e54a2e05d67d0) Change-Id: I001f305659c37e3b631696712332ae2e21464be8 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:42:50 -08:00
Christian Brauner	a482713b5a	UPSTREAM: binderfs: rename header to binderfs.h ... It doesn't make sense to call the header binder_ctl.h when its sole existence is tied to binderfs. So give it a sensible name. Users will far more easily remember binderfs.h than binder_ctl.h. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit c13295ad219d8bb0e47942d4cfc8251de449a67e) Change-Id: Ide6275bbbaec2e25df19e11754afb7f1827888b2 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:42:38 -08:00
Christian Brauner	0489f7830a	UPSTREAM: binderfs: implement "max" mount option ... Since binderfs can be mounted by userns root in non-initial user namespaces some precautions are in order. First, a way to set a maximum on the number of binder devices that can be allocated per binderfs instance and second, a way to reserve a reasonable chunk of binderfs devices for the initial ipc namespace. A first approach as seen in [1] used sysctls similiar to devpts but was shown to be flawed (cf. [2] and [3]) since some aspects were unneeded. This is an alternative approach which avoids sysctls completely and instead switches to a single mount option. Starting with this commit binderfs instances can be mounted with a limit on the number of binder devices that can be allocated. The max=<count> mount option serves as a per-instance limit. If max=<count> is set then only <count> number of binder devices can be allocated in this binderfs instance. This allows to safely bind-mount binderfs instances into unprivileged user namespaces since userns root in a non-initial user namespace cannot change the mount option as long as it does not own the mount namespace the binderfs mount was created in and hence cannot drain the host of minor device numbers [1]: https://lore.kernel.org/lkml/20181221133909.18794-1-christian@brauner.io/ [2]; https://lore.kernel.org/lkml/20181221163316.GA8517@kroah.com/ [3]: https://lore.kernel.org/lkml/CAHRSSEx+gDVW4fKKK8oZNAir9G5icJLyodO8hykv3O0O1jt2FQ@mail.gmail.com/ [4]: https://lore.kernel.org/lkml/20181221192044.5yvfnuri7gdop4rs@brauner.io/ Cc: Todd Kjos <tkjos@google.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 849d540ddfcd4f232f3b2cf40a2e07eccbd6212c) Change-Id: Idfc17f9570d165b05779d0bfdb782117beb9c44e Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:42:21 -08:00
Christian Brauner	dfddd4455e	UPSTREAM: binderfs: make each binderfs mount a new instance ... When currently mounting binderfs in the same ipc namespace twice: mount -t binder binder /A mount -t binder binder /B then the binderfs instances mounted on /A and /B will be the same, i.e. they will have the same superblock. This was the first approach that seemed reasonable. However, this leads to some problems and inconsistencies: /* private binderfs instance in same ipc namespace */ There is no way for a user to request a private binderfs instance in the same ipc namespace. This request has been made in a private mail to me by two independent people. /* bind-mounts */ If users want the same binderfs instance to appear in multiple places they can use bind mounts. So there is no value in having a request for a new binderfs mount giving them the same instance. /* unexpected behavior */ It's surprising that request to mount binderfs is not giving the user a new instance like tmpfs, devpts, ramfs, and others do. /* past mistakes */ Other pseudo-filesystems once made the same mistakes of giving back the same superblock when actually requesting a new mount (cf. devpts's deprecated "newinstance" option). We should not make the same mistake. Once we've committed to always giving back the same superblock in the same IPC namespace with the next kernel release we will not be able to make that change so better to do it now. /* kdbusfs */ It was pointed out to me that kdbusfs - which is conceptually closely related to binderfs - also allowed users to get a private kdbusfs instance in the same IPC namespace by making each mount of kdbusfs a separate instance. I think that makes a lot of sense. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit b6c770d7c9dc7185b17d53a9d5ca1278c182d6fa) Change-Id: I7e341524f625802429f89966d9edf9cab9ca59f3 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:42:05 -08:00
Christian Brauner	69f53873ae	UPSTREAM: binderfs: remove wrong kern_mount() call ... The binderfs filesystem never needs to be mounted by the kernel itself. This is conceptually wrong and should never have been done in the first place. Fixes: 3ad20fe393b ("binder: implement binderfs") Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit fdd94acd50d607cf6a971455307e711fd8ee16e) Change-Id: Ife722830ecb64ab75ccdd012043864ae1b10d792 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:41:53 -08:00
Christian Brauner	3492afe5d5	UPSTREAM: binder: implement binderfs ... As discussed at Linux Plumbers Conference 2018 in Vancouver [1] this is the implementation of binderfs. /* Abstract */ binderfs is a backwards-compatible filesystem for Android's binder ipc mechanism. Each ipc namespace will mount a new binderfs instance. Mounting binderfs multiple times at different locations in the same ipc namespace will not cause a new super block to be allocated and hence it will be the same filesystem instance. Each new binderfs mount will have its own set of binder devices only visible in the ipc namespace it has been mounted in. All devices in a new binderfs mount will follow the scheme binder%d and numbering will always start at 0. /* Backwards compatibility */ Devices requested in the Kconfig via CONFIG_ANDROID_BINDER_DEVICES for the initial ipc namespace will work as before. They will be registered via misc_register() and appear in the devtmpfs mount. Specifically, the standard devices binder, hwbinder, and vndbinder will all appear in their standard locations in /dev. Mounting or unmounting the binderfs mount in the initial ipc namespace will have no effect on these devices, i.e. they will neither show up in the binderfs mount nor will they disappear when the binderfs mount is gone. /* binder-control */ Each new binderfs instance comes with a binder-control device. No other devices will be present at first. The binder-control device can be used to dynamically allocate binder devices. All requests operate on the binderfs mount the binder-control device resides in. Assuming a new instance of binderfs has been mounted at /dev/binderfs via mount -t binderfs binderfs /dev/binderfs. Then a request to create a new binder device can be made as illustrated in [2]. Binderfs devices can simply be removed via unlink(). /* Implementation details */ - dynamic major number allocation: When binderfs is registered as a new filesystem it will dynamically allocate a new major number. The allocated major number will be returned in struct binderfs_device when a new binder device is allocated. - global minor number tracking: Minor are tracked in a global idr struct that is capped at BINDERFS_MAX_MINOR. The minor number tracker is protected by a global mutex. This is the only point of contention between binderfs mounts. - struct binderfs_info: Each binderfs super block has its own struct binderfs_info that tracks specific details about a binderfs instance: - ipc namespace - dentry of the binder-control device - root uid and root gid of the user namespace the binderfs instance was mounted in - mountable by user namespace root: binderfs can be mounted by user namespace root in a non-initial user namespace. The devices will be owned by user namespace root. - binderfs binder devices without misc infrastructure: New binder devices associated with a binderfs mount do not use the full misc_register() infrastructure. The misc_register() infrastructure can only create new devices in the host's devtmpfs mount. binderfs does however only make devices appear under its own mountpoint and thus allocates new character device nodes from the inode of the root dentry of the super block. This will have the side-effect that binderfs specific device nodes do not appear in sysfs. This behavior is similar to devpts allocated pts devices and has no effect on the functionality of the ipc mechanism itself. [1]: https://goo.gl/JL2tfX [2]: program to allocate a new binderfs binder device: #define _GNU_SOURCE #include <errno.h> #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/ioctl.h> #include <sys/stat.h> #include <sys/types.h> #include <unistd.h> #include <linux/android/binder_ctl.h> int main(int argc, char *argv[]) { int fd, ret, saved_errno; size_t len; struct binderfs_device device = { 0 }; if (argc < 2) exit(EXIT_FAILURE); len = strlen(argv[1]); if (len > BINDERFS_MAX_NAME) exit(EXIT_FAILURE); memcpy(device.name, argv[1], len); fd = open("/dev/binderfs/binder-control", O_RDONLY | O_CLOEXEC); if (fd < 0) { printf("%s - Failed to open binder-control device\n", strerror(errno)); exit(EXIT_FAILURE); } ret = ioctl(fd, BINDER_CTL_ADD, &device); saved_errno = errno; close(fd); errno = saved_errno; if (ret < 0) { printf("%s - Failed to allocate new binder device\n", strerror(errno)); exit(EXIT_FAILURE); } printf("Allocated new binder device with major %d, minor %d, and " "name %s\n", device.major, device.minor, device.name); exit(EXIT_SUCCESS); } Cc: Martijn Coenen <maco@android.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 136497735 (cherry picked from commit 3ad20fe393b31025bebfc2d76964561f65df48aa) Change-Id: I145af9b0bc25b3a59a4f663c9e926889c2b41d18 Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:41:34 -08:00
Yangtao Li	56ed129659	UPSTREAM: binder: remove BINDER_DEBUG_ENTRY() ... We already have the DEFINE_SHOW_ATTRIBUTE.There is no need to define such a macro,so remove BINDER_DEBUG_ENTRY. Signed-off-by: Yangtao Li <tiny.windzz@gmail.com> Reviewed-by: Joey Pabalinas <joeypabalinas@gmail.com> Acked-by: Todd Kjos <tkjos@android.com> Bug: 136497735 (cherry picked from commit c13e0a5288195aadec1e53af7a48ea8dae971416) Change-Id: I48ef17510ea0e252f747a864bd1e98951b0a81ba Signed-off-by: Hridya Valsaraju <hridya@google.com>	2019-12-08 21:40:31 -08:00
Greg Kroah-Hartman	44b82a3d1b	Merge 4.19.85 into android-4.19 ... Changes in 4.19.85 KVM: x86: introduce is_pae_paging MIPS: BCM63XX: fix switch core reset on BCM6368 scsi: core: Handle drivers which set sg_tablesize to zero ax88172a: fix information leak on short answers ipmr: Fix skb headroom in ipmr_get_route(). net: gemini: add missed free_netdev net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules slip: Fix memory leak in slip_open error path ALSA: usb-audio: Fix missing error check at mixer resolution test ALSA: usb-audio: not submit urb for stopped endpoint ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk() ALSA: usb-audio: Fix incorrect size check for processing/extension units Btrfs: fix log context list corruption after rename exchange operation Input: ff-memless - kill timer in destroy() Input: synaptics-rmi4 - fix video buffer size Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver Input: synaptics-rmi4 - do not consume more data than we have (F11, F12) Input: synaptics-rmi4 - clear IRQ enables for F54 Input: synaptics-rmi4 - destroy F54 poller workqueue when removing IB/hfi1: Ensure full Gen3 speed in a Gen4 system IB/hfi1: Use a common pad buffer for 9B and 16B packets i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either net: ethernet: dwmac-sun8i: Use the correct function in exit path iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros mm: mempolicy: fix the wrong return value and potential pages leak of mbind mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() mmc: sdhci-of-at91: fix quirk2 overwrite iio: adc: max9611: explicitly cast gain_selectors tee: optee: take DT status property into account ath10k: fix kernel panic by moving pci flush after napi_disable iio: dac: mcp4922: fix error handling in mcp4922_write_raw clk: sunxi-ng: h6: fix PWM gate/reset offset soundwire: Initialize completion for defer messages soundwire: intel: Fix uninitialized adev deref arm64: dts: allwinner: a64: Orange Pi Win: Fix SD card node arm64: dts: allwinner: a64: Olinuxino: fix DRAM voltage arm64: dts: allwinner: a64: NanoPi-A64: Fix DCDC1 voltage ALSA: pcm: signedness bug in snd_pcm_plug_alloc() soc/tegra: pmc: Fix pad voltage configuration for Tegra186 arm64: dts: tegra210-p2180: Correct sdmmc4 vqmmc-supply y2038: make do_gettimeofday() and get_seconds() inline ARM: dts: rcar: Correct SATA device sizes to 2 MiB ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45 rtc: sysfs: fix NULL check in rtc_add_groups() rtc: rv8803: fix the rv8803 id in the OF table remoteproc/davinci: Use %zx for formating size_t extcon: cht-wc: Return from default case to avoid warnings cfg80211: Avoid regulatory restore when COUNTRY_IE_IGNORE is set ALSA: seq: Do error checks at creating system ports ath10k: skip resetting rx filter for WCN3990 ath9k: fix tx99 with monitor mode interface wil6210: drop Rx multicast packets that are looped-back to STA wil6210: set edma variables only for Talyn-MB devices wil6210: prevent usage of tx ring 0 for eDMA wil6210: fix invalid memory access for rx_buff_mgmt debugfs ath10k: limit available channels via DT ieee80211-freq-limit ice: Update request resource command to latest specification ice: Prevent control queue operations during reset gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated ice: Fix and update driver version string ASoC: dapm: Don't fail creating new DAPM control on NULL pinctrl ASoC: dpcm: Properly initialise hw->rate_max ASoC: meson: axg-fifo: report interrupt request failure ASoC: AMD: Change MCLK to 48Mhz pinctrl: ingenic: Probe driver at subsys_initcall MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3 ARM: dts: exynos: Use i2c-gpio for HDMI-DDC on Arndale ARM: dts: exynos: Fix HDMI-HPD line handling on Arndale ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook liquidio: fix race condition in instruction completion processing arm64: dts: stratix10: i2c clock running out of spec ARM: dts: exynos: Fix regulators configuration on Peach Pi/Pit Chromebooks i40evf: Validate the number of queues a PF sends i40e: use correct length for strncpy i40evf: set IFF_UNICAST_FLT flag for the VF i40e: Check and correct speed values for link on open i40evf: Don't enable vlan stripping when rx offload is turned on i40e: hold the rtnl lock on clearing interrupt scheme i40evf: cancel workqueue sync for adminq when a VF is removed i40e: Prevent deleting MAC address from VF when set by PF IB/rxe: avoid back-to-back retries IB/rxe: fixes for rdma read retry iwlwifi: drop packets with bad status in CD iwlwifi: don't WARN on trying to dump dead firmware iwlwifi: mvm: avoid sending too many BARs media: vicodec: fix out-of-range values when decoding media: i2c: Fix pm_runtime_get_if_in_use() usage in sensor drivers media: ov772x: Disable clk on error path ARM: dts: pxa: fix the rtc controller ARM: dts: pxa: fix power i2c base address rtl8187: Fix warning generated when strncpy() destination length matches the sixe argument mwifiex: do no submit URB in suspended state mwifex: free rx_cmd skb in suspended state brcmfmac: fix wrong strnchr usage mt76: Fix comparisons with invalid hardware key index soc: imx: gpc: fix PDN delay ASoC: rsnd: ssi: Fix issue in dma data address assignment net: hns3: Fix for multicast failure net: hns3: Fix error of checking used vlan id net: hns3: Fix for loopback selftest failed problem net: hns3: Change the dst mac addr of loopback packet net/mlx5: Fix atomic_mode enum values net: phy: mscc: read 'vsc8531,vddmac' as an u32 net: phy: mscc: read 'vsc8531, edge-slowdown' as an u32 ARM: dts: meson8: fix the clock controller register size ARM: dts: meson8b: fix the clock controller register size mtd: rawnand: marvell: use regmap_update_bits() for syscon access mtd: rawnand: fsl_ifc: check result of SRAM initialization mtd: rawnand: fsl_ifc: fixup SRAM init for newer ctrl versions mtd: rawnand: qcom: don't include dma-direct.h IB/mlx5: Change TX affinity assignment in RoCE LAG mode qxl: fix null-pointer crash during suspend mac80211: fix saving a few HE values cfg80211: validate wmm rule when setting f2fs: avoid wrong decrypted data from disk net: lan78xx: Bail out if lan78xx_get_endpoints fails rtnetlink: move type calculation out of loop ASoC: sgtl5000: avoid division by zero if lo_vag is zero ath10k: avoid possible memory access violation ARM: dts: exynos: Disable pull control for S5M8767 PMIC ath10k: wmi: disable softirq's while calling ieee80211_rx i2c: mediatek: Use DMA safe buffers for i2c transactions IB/mlx5: Don't hold spin lock while checking device state IB/ipoib: Ensure that MTU isn't less than minimum permitted RDMA/core: Rate limit MAD error messages RDMA/core: Follow correct unregister order between sysfs and cgroup mips: txx9: fix iounmap related issue udf: Fix crash during mount ASoC: dapm: Avoid uninitialised variable warning ASoC: Intel: hdac_hdmi: Limit sampling rates at dai creation ata: Disable AHCI ALPM feature for Ampere Computing eMAG SATA of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC ARM: dts: omap3-gta04: give spi_lcd node a label so that we can overwrite in other DTS files ARM: dts: omap3-gta04: fixes for tvout / venc ARM: dts: omap3-gta04: tvout: enable as display1 alias ARM: dts: omap3-gta04: fix touchscreen tsc2007 ARM: dts: omap3-gta04: make NAND partitions compatible with recent U-Boot ARM: dts: omap3-gta04: keep vpll2 always on f2fs: submit bio after shutdown failover: Fix error return code in net_failover_create sched/debug: Explicitly cast sched_feat() to bool sched/debug: Use symbolic names for task state constants firmware: arm_scmi: use strlcpy to ensure NULL-terminated strings arm64: dts: rockchip: Fix VCC5V0_HOST_EN on rk3399-sapphire ARM: dts: exynos: Disable pull control for PMIC IRQ line on Artik5 board usb: mtu3: disable vbus rise/fall interrupts of ltssm dmaengine: dma-jz4780: Don't depend on MACH_JZ4780 dmaengine: dma-jz4780: Further residue status fix EDAC, sb_edac: Return early on ADDRV bit and address type test rtc: mt6397: fix possible race condition rtc: pl030: fix possible race condition ath9k: add back support for using active monitor interfaces for tx99 dmaengine: at_xdmac: remove a stray bottom half unlock RDMA/hns: Fix an error code in hns_roce_v2_init_eq_table() IB/hfi1: Missing return value in error path for user sdma signal: Always ignore SIGKILL and SIGSTOP sent to the global init signal: Properly deliver SIGILL from uprobes signal: Properly deliver SIGSEGV from x86 uprobes f2fs: fix memory leak of write_io in fill_super() f2fs: fix memory leak of percpu counter in fill_super() f2fs: fix setattr project check upon fssetxattr ioctl scsi: qla2xxx: Use correct qpair for ABTS/CMD scsi: qla2xxx: Fix iIDMA error scsi: qla2xxx: Defer chip reset until target mode is enabled scsi: qla2xxx: Terminate Plogi/PRLI if WWN is 0 scsi: qla2xxx: Fix deadlock between ATIO and HW lock scsi: qla2xxx: Increase abort timeout value scsi: qla2xxx: Check for Register disconnect scsi: qla2xxx: Fix port speed display on chip reset scsi: qla2xxx: Fix dropped srb resource. scsi: qla2xxx: Fix duplicate switch's Nport ID entries scsi: lpfc: Fix GFT_ID and PRLI logic for RSCN scsi: lpfc: Correct invalid EQ doorbell write on if_type=6 scsi: lpfc: Fix errors in log messages. scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set scsi: pm80xx: Corrected dma_unmap_sg() parameter scsi: pm80xx: Fixed system hang issue during kexec boot kprobes: Don't call BUG_ON() if there is a kprobe in use on free list net: aquantia: fix hw_atl_utils_fw_upload_dwords Drivers: hv: vmbus: Fix synic per-cpu context initialization nvmem: core: return error code instead of NULL from nvmem_device_get media: dt-bindings: adv748x: Fix decimal unit addresses ALSA: hda: Fix implicit definition of pci_iomap() on SH media: fix: media: pci: meye: validate offset to avoid arbitrary access media: dvb: fix compat ioctl translation net: bcmgenet: Fix speed selection for reverse MII arm64: dts: meson: libretech: update board model arm64: dts: meson-axg: use the proper compatible for ethmac ALSA: intel8x0m: Register irq handler after register initializations arm64: dts: renesas: salvator-common: adv748x: Override secondary addresses arm64: dts: renesas: r8a77965: Attach the SYS-DMAC to the IPMMU arm64: dts: renesas: r8a77965: Fix HS-USB compatible arm64: dts: renesas: r8a77965: Fix clock/reset for usb2_phy1 pinctrl: at91-pio4: fix has_config check in atmel_pctl_dt_subnode_to_map() llc: avoid blocking in llc_sap_close() ARM: dts: qcom: ipq4019: fix cpu0's qcom,saw2 reg value soc: qcom: geni: Don't ignore clk_round_rate() errors in geni_se_clk_tbl_get() soc: qcom: geni: geni_se_clk_freq_match() should always accept multiples soc: qcom: wcnss_ctrl: Avoid string overflow soc: qcom: apr: Avoid string overflow drivers: qcom: rpmh-rsc: clear wait_for_compl after use arm64: dts: broadcom: Fix I2C and SPI bus warnings ARM: dts: bcm: Fix SPI bus warnings ARM: dts: aspeed: Fix I2C bus warnings powerpc/vdso: Correct call frame information ARM: dts: socfpga: Fix I2C bus unit-address error ARM: dts: sunxi: Fix I2C bus warnings pinctrl: at91: don't use the same irqchip with multiple gpiochips ARM: dts: sun9i: Fix I2C bus warnings android: binder: no outgoing transaction when thread todo has transaction cxgb4: Fix endianness issue in t4_fwcache() arm64: fix for bad_mode() handler to always result in panic block, bfq: inject other-queue I/O into seeky idle queues on NCQ flash blok, bfq: do not plug I/O if all queues are weight-raised arm64: dts: meson: Fix erroneous SPI bus warnings power: supply: ab8500_fg: silence uninitialized variable warnings power: reset: at91-poweroff: do not procede if at91_shdwc is allocated power: supply: max8998-charger: Fix platform data retrieval component: fix loop condition to call unbind() if bind() fails kernfs: Fix range checks in kernfs_get_target_path ip_gre: fix parsing gre header in ipgre_err scsi: ufshcd: Fix NULL pointer dereference for in ufshcd_init ARM: dts: rockchip: Fix erroneous SPI bus dtc warnings on rk3036 arm64: dts: rockchip: Fix I2C bus unit-address error on rk3399-puma-haikou ACPI / LPSS: Exclude I2C busses shared with PUNIT from pmc_atom_d3_mask netfilter: nf_tables: avoid BUG_ON usage ath9k: Fix a locking bug in ath9k_add_interface() s390/qeth: uninstall IRQ handler on device removal s390/qeth: invoke softirqs after napi_schedule() media: vsp1: Fix vsp1_regs.h license header media: vsp1: Fix YCbCr planar formats pitch calculation media: ov2680: don't register the v4l2 subdevice before checking chip ID PCI/ACPI: Correct error message for ASPM disabling net: socionext: Fix two sleep-in-atomic-context bugs in ave_rxfifo_reset() PCI: mediatek: Fix unchecked return value ARM: dts: xilinx: Fix I2C and SPI bus warnings serial: uartps: Fix suspend functionality serial: samsung: Enable baud clock for UART reset procedure in resume serial: mxs-auart: Fix potential infinite loop tty: serial: qcom_geni_serial: Fix serial when not used as console arm64: dts: ti: k3-am65: Change #address-cells and #size-cells of interconnect to 2 samples/bpf: fix a compilation failure spi/bcm63xx-hsspi: keep pll clk enabled spi: mediatek: Don't modify spi_transfer when transfer. ASoC: rt5682: Fix the boost volume at the begining of playback ipmi_si_pci: fix NULL device in ipmi_si error message ipmi_si: fix potential integer overflow on large shift ipmi:dmi: Ignore IPMI SMBIOS entries with a zero base address ipmi: fix return value of ipmi_set_my_LUN net: hns3: fix return type of ndo_start_xmit function net: cavium: fix return type of ndo_start_xmit function net: ibm: fix return type of ndo_start_xmit function powerpc/iommu: Avoid derefence before pointer check selftests/powerpc: Do not fail with reschedule powerpc/64s/hash: Fix stab_rr off by one initialization powerpc/pseries/memory-hotplug: Only update DT once per memory DLPAR request powerpc/pseries: Disable CPU hotplug across migrations powerpc: Fix duplicate const clang warning in user access code RDMA/i40iw: Fix incorrect iterator type ARM: dts: atmel: Fix I2C and SPI bus warnings OPP: Protect dev_list with opp_table lock of/unittest: Fix I2C bus unit-address error libfdt: Ensure INT_MAX is defined in libfdt_env.h power: supply: twl4030_charger: fix charging current out-of-bounds power: supply: twl4030_charger: disable eoc interrupt on linear charge net: mvpp2: fix the number of queues per cpu for PPv2.2 net: marvell: fix return type of ndo_start_xmit function net: toshiba: fix return type of ndo_start_xmit function net: xilinx: fix return type of ndo_start_xmit function net: broadcom: fix return type of ndo_start_xmit function net: amd: fix return type of ndo_start_xmit function net: sun: fix return type of ndo_start_xmit function net: hns3: Fix for setting speed for phy failed problem net: hns3: Fix cmdq registers initialization issue for vf net: hns3: Clear client pointer when initialize client failed or unintialize finished net: hns3: Fix client initialize state issue when roce client initialize failed net: hns3: Fix parameter type for q_id in hclge_tm_q_to_qs_map_cfg() nfp: provide a better warning when ring allocation fails usb: chipidea: imx: enable OTG overcurrent in case USB subsystem is already started usb: chipidea: Fix otg event handler usb: usbtmc: Fix ioctl USBTMC_IOCTL_ABORT_BULK_OUT s390/zcrypt: enable AP bus scan without a valid default domain s390/vdso: avoid 64-bit vdso mapping for compat tasks s390/vdso: correct CFI annotations of vDSO functions brcmfmac: increase buffer for obtaining firmware capabilities brcmsmac: Use kvmalloc() for ucode allocations mlxsw: spectrum: Init shaper for TCs 8..15 PCI: portdrv: Initialize service drivers directly ARM: dts: am335x-evm: fix number of cpsw ARM: dts: ti: Fix SPI and I2C bus warnings f2fs: avoid infinite loop in f2fs_alloc_nid f2fs: fix to recover inode's uid/gid during POR ARM: dts: ux500: Correct SCU unit address ARM: dts: ux500: Fix LCDA clock line muxing ARM: dts: ste: Fix SPI controller node names spi: pic32: Use proper enum in dmaengine_prep_slave_rg crypto: chacha20 - Fix chacha20_block() keystream alignment (again) cpufeature: avoid warning when compiling with clang crypto: arm/crc32 - avoid warning when compiling with Clang ARM: dts: marvell: Fix SPI and I2C bus warnings x86/mce-inject: Reset injection struct after injection ARM: dts: stm32: enable display on stm32mp157c-ev1 board ARM: dts: clearfog: fix sdhci supply property name ARM: dts: stm32: Fix SPI controller node names bnx2x: Ignore bandwidth attention in single function mode PCI/AER: Take reference on error devices PCI/AER: Don't read upstream ports below fatal errors PCI/ERR: Use slot reset if available samples/bpf: fix compilation failure net: phy: mdio-bcm-unimac: Allow configuring MDIO clock divider net: micrel: fix return type of ndo_start_xmit function net: freescale: fix return type of ndo_start_xmit function x86/CPU: Use correct macros for Cyrix calls x86/CPU: Change query logic so CPUID is enabled before testing EDAC: Correct DIMM capacity unit symbol MIPS: kexec: Relax memory restriction arm64: dts: rockchip: Fix microSD in rk3399 sapphire board mlxsw: Make MLXSW_SP1_FWREV_MINOR a hard requirement media: imx: work around false-positive warning, again media: pci: ivtv: Fix a sleep-in-atomic-context bug in ivtv_yuv_init() media: au0828: Fix incorrect error messages media: davinci: Fix implicit enum conversion warning ARM: dts: rockchip: explicitly set vcc_sd0 pin to gpio on rk3188-radxarock usb: gadget: uvc: configfs: Drop leaked references to config items usb: gadget: uvc: configfs: Prevent format changes after linking header usb: gadget: uvc: configfs: Sort frame intervals upon writing ARM: dts: exynos: Correct audio subsystem parent clock on Peach Chromebooks i2c: aspeed: fix invalid clock parameters for very large divisors gpiolib: Fix gpio_direction_* for single direction GPIOs ARM: at91: pm: call put_device instead of of_node_put in at91_pm_config_ws phy: brcm-sata: allow PHY_BRCM_SATA driver to be built for DSL SoCs phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs phy: phy-twl4030-usb: fix denied runtime access ARM: dts: imx6ull: update vdd_soc voltage for 900MHz operating point usb: gadget: uvc: Factor out video USB request queueing usb: gadget: uvc: Only halt video streaming endpoint in bulk mode coresight: Use ERR_CAST instead of ERR_PTR coresight: Fix handling of sinks coresight: perf: Fix per cpu path management coresight: perf: Disable trace path upon source error coresight: tmc-etr: Handle driver mode specific ETR buffers coresight: etm4x: Configure EL2 exception level when kernel is running in HYP coresight: tmc: Fix byte-address alignment for RRP coresight: dynamic-replicator: Handle multiple connections slimbus: ngd: register ngd driver only once. slimbus: ngd: return proper error code instead of zero silmbus: ngd: register controller after power up. misc: kgdbts: Fix restrict error misc: genwqe: should return proper error value. vmbus: keep pointer to ring buffer page vfio/pci: Fix potential memory leak in vfio_msi_cap_len vfio/pci: Mask buggy SR-IOV VF INTx support iw_cxgb4: Use proper enumerated type in c4iw_bar2_addrs scsi: libsas: always unregister the old device if going to discover new f2fs: fix remount problem of option io_bits phy: lantiq: Fix compile warning arm64: dts: fsl: Fix I2C and SPI bus warnings ARM: dts: imx51-zii-rdu1: Fix the rtc compatible string arm64: tegra: I2C on Tegra194 is not compatible with Tegra114 ARM: dts: tegra30: fix xcvr-setup-use-fuses ARM: dts: tegra20: restore address order ARM: tegra: apalis_t30: fix mmc1 cmd pull-up ARM: tegra: apalis_t30: fix mcp2515 can controller interrupt polarity ARM: tegra: colibri_t30: fix mcp2515 can controller interrupt polarity ARM: dts: paz00: fix wakeup gpio keycode net: smsc: fix return type of ndo_start_xmit function net: faraday: fix return type of ndo_start_xmit function PCI/ERR: Run error recovery callbacks for all affected devices f2fs: update i_size after DIO completion f2fs: fix to recover inode's project id during POR f2fs: mark inode dirty explicitly in recover_inode() RDMA: Fix dependencies for rdma_user_mmap_io EDAC: Raise the maximum number of memory controllers ARM: dts: realview: Fix SPI controller node names firmware: dell_rbu: Make payload memory uncachable Bluetooth: hci_serdev: clear HCI_UART_PROTO_READY to avoid closing proto races Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS Bluetooth: btrsi: fix bt tx timeout issue x86/hyperv: Suppress "PCI: Fatal: No config space access function found" crypto: s5p-sss: Fix race in error handling crypto: s5p-sss: Fix Fix argument list alignment crypto: fix a memory leak in rsa-kcs1pad's encryption mode iwlwifi: dbg: don't crash if the firmware crashes in the middle of a debug dump iwlwifi: fix non_shared_ant for 22000 devices iwlwifi: pcie: read correct prph address for newer devices iwlwifi: api: annotate compressed BA notif array sizes iwlwifi: pcie: gen2: build A-MSDU only for GSO iwlwifi: pcie: fit reclaim msg to MAX_MSG_LEN iwlwifi: mvm: use correct FIFO length iwlwifi: mvm: Allow TKIP for AP mode scsi: NCR5380: Clear all unissued commands on host reset scsi: NCR5380: Have NCR5380_select() return a bool scsi: NCR5380: Withhold disconnect privilege for REQUEST SENSE scsi: NCR5380: Use DRIVER_SENSE to indicate valid sense data scsi: NCR5380: Check for invalid reselection target scsi: NCR5380: Don't clear busy flag when abort fails scsi: NCR5380: Don't call dsprintk() following reselection interrupt scsi: NCR5380: Handle BUS FREE during reselection scsi: NCR5380: Check for bus reset arm64: dts: amd: Fix SPI bus warnings arm64: dts: lg: Fix SPI controller node names ARM: dts: lpc32xx: Fix SPI controller node names rtc: isl1208: avoid possible sysfs race rtc: tx4939: fixup nvmem name and register size rtc: armada38x: fix possible race condition netfilter: masquerade: don't flush all conntracks if only one address deleted on device usb: xhci-mtk: fix ISOC error when interval is zero usb: usbtmc: uninitialized symbol 'actual' in usbtmc_ioctl_clear fuse: use READ_ONCE on congestion_threshold and max_background IB/iser: Fix possible NULL deref at iser_inv_desc() media: ov2680: fix null dereference at power on s390/vdso: correct vdso mapping for compat tasks net: phy: mdio-bcm-unimac: mark PM functions as __maybe_unused memfd: Use radix_tree_deref_slot_protected to avoid the warning. slcan: Fix memory leak in error path Linux 4.19.85 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0857e66ee2cdd412cd736548a1395bf764a8ab0a	2019-11-20 20:43:17 +01:00
Sherry Yang	b0cb2d8164	android: binder: no outgoing transaction when thread todo has transaction ... [ Upstream commit 44b73962cb25f1c8170ea695c4564b05a75e1fd4 ] When a process dies, failed reply is sent to the sender of any transaction queued on a dead thread's todo list. The sender asserts that the received failed reply corresponds to the head of the transaction stack. This assert can fail if the dead thread is allowed to send outgoing transactions when there is already a transaction on its todo list, because this new transaction can end up on the transaction stack of the original sender. The following steps illustrate how this assertion can fail. 1. Thread1 sends txn19 to Thread2 (T1->transaction_stack=txn19, T2->todo+=txn19) 2. Without processing todo list, Thread2 sends txn20 to Thread1 (T1->todo+=txn20, T2->transaction_stack=txn20) 3. T1 processes txn20 on its todo list (T1->transaction_stack=txn20->txn19, T1->todo=<empty>) 4. T2 dies, T2->todo cleanup attempts to send failed reply for txn19, but T1->transaction_stack points to txn20 -- assertion failes Step 2. is the incorrect behavior. When there is a transaction on a thread's todo list, this thread should not be able to send any outgoing synchronous transactions. Only the head of the todo list needs to be checked because only threads that are waiting for proc work can directly receive work from another thread, and no work is allowed to be queued on such a thread without waking up the thread. This patch also enforces that a thread is not waiting for proc work when a work is directly enqueued to its todo list. Acked-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Sherry Yang <sherryy@android.com> Reviewed-by: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2019-11-20 18:46:42 +01:00
Greg Kroah-Hartman	844ecc4634	Merge 4.19.64 into android-4.19 ... Changes in 4.19.64 hv_sock: Add support for delayed close vsock: correct removal of socket from the list NFS: Fix dentry revalidation on NFSv4 lookup NFS: Refactor nfs_lookup_revalidate() NFSv4: Fix lookup revalidate of regular files usb: dwc2: Disable all EP's on disconnect usb: dwc2: Fix disable all EP's on disconnect arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ binder: fix possible UAF when freeing buffer ISDN: hfcsusb: checking idx of ep configuration media: au0828: fix null dereference in error path ath10k: Change the warning message string media: cpia2_usb: first wake up, then free in disconnect media: pvrusb2: use a different format for warnings NFS: Cleanup if nfs_match_client is interrupted media: radio-raremono: change devm_k*alloc to k*alloc iommu/vt-d: Don't queue_iova() if there is no flush queue iommu/iova: Fix compilation error with !CONFIG_IOMMU_IOVA Bluetooth: hci_uart: check for missing tty operations vhost: introduce vhost_exceeds_weight() vhost_net: fix possible infinite loop vhost: vsock: add weight support vhost: scsi: add weight support sched/fair: Don't free p->numa_faults with concurrent readers sched/fair: Use RCU accessors consistently for ->numa_group /proc/<pid>/cmdline: remove all the special cases /proc/<pid>/cmdline: add back the setproctitle() special case drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl Fix allyesconfig output. ceph: hold i_ceph_lock when removing caps for freeing inode block, scsi: Change the preempt-only flag into a counter scsi: core: Avoid that a kernel warning appears during system resume ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL Linux 4.19.64 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3e9055b677bd8ad9d5070307fae0bc765d444e9d	2019-08-04 09:37:11 +02:00
Todd Kjos	22068d49d0	binder: fix possible UAF when freeing buffer ... commit a370003cc301d4361bae20c9ef615f89bf8d1e8a upstream. There is a race between the binder driver cleaning up a completed transaction via binder_free_transaction() and a user calling binder_ioctl(BC_FREE_BUFFER) to release a buffer. It doesn't matter which is first but they need to be protected against running concurrently which can result in a UAF. Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-08-04 09:30:53 +02:00
Greg Kroah-Hartman	75ff56e1a2	Merge 4.19.63 into android-4.19 ... Changes in 4.19.63 hvsock: fix epollout hang from race condition drm/panel: simple: Fix panel_simple_dsi_probe iio: adc: stm32-dfsdm: manage the get_irq error case iio: adc: stm32-dfsdm: missing error case during probe staging: vt6656: use meaningful error code during buffer allocation usb: core: hub: Disable hub-initiated U1/U2 tty: max310x: Fix invalid baudrate divisors calculator pinctrl: rockchip: fix leaked of_node references tty: serial: cpm_uart - fix init when SMC is relocated drm/amd/display: Fill prescale_params->scale for RGB565 drm/amdgpu/sriov: Need to initialize the HDP_NONSURFACE_BAStE drm/amd/display: Disable ABM before destroy ABM struct drm/amdkfd: Fix a potential memory leak drm/amdkfd: Fix sdma queue map issue drm/edid: Fix a missing-check bug in drm_load_edid_firmware() PCI: Return error if cannot probe VF drm/bridge: tc358767: read display_props in get_modes() drm/bridge: sii902x: pixel clock unit is 10kHz instead of 1kHz gpu: host1x: Increase maximum DMA segment size drm/crc-debugfs: User irqsafe spinlock in drm_crtc_add_crc_entry drm/crc-debugfs: Also sprinkle irqrestore over early exits memstick: Fix error cleanup path of memstick_init tty/serial: digicolor: Fix digicolor-usart already registered warning tty: serial: msm_serial: avoid system lockup condition serial: 8250: Fix TX interrupt handling condition drm/amd/display: Always allocate initial connector state state drm/virtio: Add memory barriers for capset cache. phy: renesas: rcar-gen2: Fix memory leak at error paths drm/amd/display: fix compilation error powerpc/pseries/mobility: prevent cpu hotplug during DT update drm/rockchip: Properly adjust to a true clock in adjusted_mode serial: imx: fix locking in set_termios() tty: serial_core: Set port active bit in uart_port_activate usb: gadget: Zero ffs_io_data mmc: sdhci: sdhci-pci-o2micro: Check if controller supports 8-bit width powerpc/pci/of: Fix OF flags parsing for 64bit BARs drm/msm: Depopulate platform on probe failure serial: mctrl_gpio: Check if GPIO property exisits before requesting it PCI: sysfs: Ignore lockdep for remove attribute i2c: stm32f7: fix the get_irq error cases kbuild: Add -Werror=unknown-warning-option to CLANG_FLAGS genksyms: Teach parser about 128-bit built-in types PCI: xilinx-nwl: Fix Multi MSI data programming iio: iio-utils: Fix possible incorrect mask calculation powerpc/cacheflush: fix variable set but not used powerpc/xmon: Fix disabling tracing while in xmon recordmcount: Fix spurious mcount entries on powerpc mfd: madera: Add missing of table registration mfd: core: Set fwnode for created devices mfd: arizona: Fix undefined behavior mfd: hi655x-pmic: Fix missing return value check for devm_regmap_init_mmio_clk mm/swap: fix release_pages() when releasing devmap pages um: Silence lockdep complaint about mmap_sem powerpc/4xx/uic: clear pending interrupt after irq type/pol change RDMA/i40iw: Set queue pair state when being queried serial: sh-sci: Terminate TX DMA during buffer flushing serial: sh-sci: Fix TX DMA buffer flushing and workqueue races IB/mlx5: Fixed reporting counters on 2nd port for Dual port RoCE powerpc/mm: Handle page table allocation failures IB/ipoib: Add child to parent list only if device initialized arm64: assembler: Switch ESB-instruction with a vanilla nop if !ARM64_HAS_RAS PCI: mobiveil: Fix PCI base address in MEM/IO outbound windows PCI: mobiveil: Fix the Class Code field kallsyms: exclude kasan local symbols on s390 PCI: mobiveil: Initialize Primary/Secondary/Subordinate bus numbers PCI: mobiveil: Use the 1st inbound window for MEM inbound transactions perf test mmap-thread-lookup: Initialize variable to suppress memory sanitizer warning perf stat: Fix use-after-freed pointer detected by the smatch tool perf top: Fix potential NULL pointer dereference detected by the smatch tool perf session: Fix potential NULL pointer dereference found by the smatch tool perf annotate: Fix dereferencing freed memory found by the smatch tool perf hists browser: Fix potential NULL pointer dereference found by the smatch tool RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB powerpc/boot: add {get, put}_unaligned_be32 to xz_config.h block: init flush rq ref count to 1 f2fs: avoid out-of-range memory access mailbox: handle failed named mailbox channel request dlm: check if workqueues are NULL before flushing/destroying powerpc/eeh: Handle hugepages in ioremap space block/bio-integrity: fix a memory leak bug sh: prevent warnings when using iounmap mm/kmemleak.c: fix check for softirq context 9p: pass the correct prototype to read_cache_page mm/gup.c: mark undo_dev_pagemap as __maybe_unused mm/gup.c: remove some BUG_ONs from get_gate_page() memcg, fsnotify: no oom-kill for remote memcg charging mm/mmu_notifier: use hlist_add_head_rcu() proc: use down_read_killable mmap_sem for /proc/pid/smaps_rollup proc: use down_read_killable mmap_sem for /proc/pid/pagemap proc: use down_read_killable mmap_sem for /proc/pid/clear_refs proc: use down_read_killable mmap_sem for /proc/pid/map_files cxgb4: reduce kernel stack usage in cudbg_collect_mem_region() proc: use down_read_killable mmap_sem for /proc/pid/maps locking/lockdep: Fix lock used or unused stats error mm: use down_read_killable for locking mmap_sem in access_remote_vm locking/lockdep: Hide unused 'class' variable usb: wusbcore: fix unbalanced get/put cluster_id usb: pci-quirks: Correct AMD PLL quirk detection btrfs: inode: Don't compress if NODATASUM or NODATACOW set x86/sysfb_efi: Add quirks for some devices with swapped width and height x86/speculation/mds: Apply more accurate check on hypervisor platform binder: prevent transactions to context manager from its own process. fpga-manager: altera-ps-spi: Fix build error mei: me: add mule creek canyon (EHL) device ids hpet: Fix division by zero in hpet_time_div() ALSA: ac97: Fix double free of ac97_codec_device ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1 ALSA: hda - Add a conexant codec entry to let mute led work powerpc/xive: Fix loop exit-condition in xive_find_target_in_mask() powerpc/tm: Fix oops on sigreturn on systems without TM libnvdimm/bus: Stop holding nvdimm_bus_list_mutex over __nd_ioctl() access: avoid the RCU grace period for the temporary subjective credentials Linux 4.19.63 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic31529aa6fd283d16d6bfb182187a9402a4db44f	2019-07-31 08:03:42 +02:00
Hridya Valsaraju	e907b13144	binder: prevent transactions to context manager from its own process. ... commit 49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec upstream. Currently, a transaction to context manager from its own process is prevented by checking if its binder_proc struct is the same as that of the sender. However, this would not catch cases where the process opens the binder device again and uses the new fd to send a transaction to the context manager. Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com Signed-off-by: Hridya Valsaraju <hridya@google.com> Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-07-31 07:27:10 +02:00
Martijn Coenen	b9079579b0	UPSTREAM: binder: Set end of SG buffer area properly. ... In case the target node requests a security context, the extra_buffers_size is increased with the size of the security context. But, that size is not available for use by regular scatter-gather buffers; make sure the ending of that buffer is marked correctly. Bug: 136210786 Acked-by: Todd Kjos <tkjos@google.com> Fixes: ec74136ded79 ("binder: create node flag to request sender's security context") Signed-off-by: Martijn Coenen <maco@android.com> Cc: stable@vger.kernel.org # 5.1+ Link: https://lore.kernel.org/r/20190709110923.220736-1-maco@android.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a56587065094fd96eb4c2b5ad65571daad32156d)	2019-07-24 12:42:52 +02:00
Greg Kroah-Hartman	0f653d9aa3	Merge 4.19.59 into android-4.19 ... Changes in 4.19.59 crypto: talitos - rename alternative AEAD algos. soc: brcmstb: Fix error path for unsupported CPUs soc: bcm: brcmstb: biuctrl: Register writes require a barrier Input: elantech - enable middle button support on 2 ThinkPads samples, bpf: fix to change the buffer size for read() samples, bpf: suppress compiler warning mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he() bpf: sockmap, fix use after free from sleep in psock backlog workqueue soundwire: stream: fix out of boundary access on port properties staging:iio:ad7150: fix threshold mode config bit mac80211: mesh: fix RCU warning mac80211: free peer keys before vif down in mesh mwifiex: Fix possible buffer overflows at parsing bss descriptor iwlwifi: Fix double-free problems in iwl_req_fw_callback() mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() soundwire: intel: set dai min and max channels correctly dt-bindings: can: mcp251x: add mcp25625 support can: mcp251x: add support for mcp25625 can: m_can: implement errata "Needless activation of MRAF irq" can: af_can: Fix error path of can_init() net: phy: rename Asix Electronics PHY driver ibmvnic: Do not close unopened driver during reset ibmvnic: Refresh device multicast list after reset ibmvnic: Fix unchecked return codes of memory allocations ARM: dts: am335x phytec boards: Fix cd-gpios active level s390/boot: disable address-of-packed-member warning drm/vmwgfx: Honor the sg list segment size limitation drm/vmwgfx: fix a warning due to missing dma_parms riscv: Fix udelay in RV32. Input: imx_keypad - make sure keyboard can always wake up system KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed ARM: davinci: da850-evm: call regulator_has_full_constraints() ARM: davinci: da8xx: specify dma_coherent_mask for lcdc mac80211: only warn once on chanctx_conf being NULL mac80211: do not start any work during reconfigure flow bpf, devmap: Fix premature entry free on destroying map bpf, devmap: Add missing bulk queue free bpf, devmap: Add missing RCU read lock on flush bpf, x64: fix stack layout of JITed bpf code qmi_wwan: add support for QMAP padding in the RX path qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode qmi_wwan: extend permitted QMAP mux_id value range mmc: core: complete HS400 before checking status md: fix for divide error in status_resync bnx2x: Check if transceiver implements DDM before access drm: return -EFAULT if copy_to_user() fails ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL net: lio_core: fix potential sign-extension overflow on large shift scsi: qedi: Check targetname while finding boot target information quota: fix a problem about transfer quota net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge() NFS4: Only set creation opendata if O_CREAT net :sunrpc :clnt :Fix xps refcount imbalance on the error path fscrypt: don't set policy for a dead directory udf: Fix incorrect final NOT_ALLOCATED (hole) extent length media: stv0297: fix frequency range limit ALSA: usb-audio: Fix parse of UAC2 Extension Units ALSA: hda/realtek - Headphone Mic can't record after S3 block, bfq: NULL out the bic when it's no longer valid perf pmu: Fix uncore PMU alias list for ARM64 x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() x86/tls: Fix possible spectre-v1 in do_get_thread_area() Documentation: Add section about CPU vulnerabilities for Spectre Documentation/admin: Remove the vsyscall=native documentation mwifiex: Abort at too short BSS descriptor element mwifiex: Don't abort on small, spec-compliant vendor IEs USB: serial: ftdi_sio: add ID for isodebug v1 USB: serial: option: add support for GosunCn ME3630 RNDIS mode Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled" p54usb: Fix race between disconnect and firmware loading usb: gadget: ether: Fix race between gether_disconnect and rx_submit usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset() usb: renesas_usbhs: add a workaround for a race condition of workqueue drivers/usb/typec/tps6598x.c: fix portinfo width drivers/usb/typec/tps6598x.c: fix 4CC cmd write staging: comedi: dt282x: fix a null pointer deref on interrupt staging: comedi: amplc_pci230: fix null pointer deref on interrupt HID: Add another Primax PIXART OEM mouse quirk lkdtm: support llvm-objcopy binder: fix memory leak in error path carl9170: fix misuse of device driver API VMCI: Fix integer overflow in VMCI handle arrays MIPS: Remove superfluous check for __linux__ staging: fsl-dpaa2/ethsw: fix memory leak of switchdev_work staging: bcm2835-camera: Replace spinlock protecting context_map with mutex staging: bcm2835-camera: Ensure all buffers are returned on disable staging: bcm2835-camera: Remove check of the number of buffers supplied staging: bcm2835-camera: Handle empty EOS buffers whilst streaming staging: rtl8712: reduce stack usage, again Linux 4.19.59 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I650890ad9d984de0fc729677bd29506cd21338be	2019-07-14 08:44:38 +02:00
Todd Kjos	524ad00e80	binder: fix memory leak in error path ... commit 1909a671dbc3606685b1daf8b22a16f65ea7edda upstream. syzkallar found a 32-byte memory leak in a rarely executed error case. The transaction complete work item was not freed if put_user() failed when writing the BR_TRANSACTION_COMPLETE to the user command buffer. Fixed by freeing it before put_user() is called. Reported-by: syzbot+182ce46596c3f2e1eb24@syzkaller.appspotmail.com Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-07-14 08:11:21 +02:00
Todd Kjos	b14fd5b76a	UPSTREAM: binder: check for overflow when alloc for security context ... commit 0b0509508beff65c1d50541861bc0d4973487dc5 upstream. When allocating space in the target buffer for the security context, make sure the extra_buffers_size doesn't overflow. This can only happen if the given size is invalid, but an overflow can turn it into a valid size. Fail the transaction if an overflow is detected. Bug: 130571081 Change-Id: I03fa4c879895fe4f768d880f87dce329423bfb9a Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-06-11 22:43:28 +00:00
Todd Kjos	9d57cfd4e9	binder: fix race between munmap() and direct reclaim ... commit 5cec2d2e5839f9c0fec319c523a911e0a7fd299f upstream. An munmap() on a binder device causes binder_vma_close() to be called which clears the alloc->vma pointer. If direct reclaim causes binder_alloc_free_page() to be called, there is a race where alloc->vma is read into a local vma pointer and then used later after the mm->mmap_sem is acquired. This can result in calling zap_page_range() with an invalid vma which manifests as a use-after-free in zap_page_range(). The fix is to check alloc->vma after acquiring the mmap_sem (which we were acquiring anyway) and skip zap_page_range() if it has changed to NULL. Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Todd Kjos <tkjos@google.com> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Cc: stable <stable@vger.kernel.org> # 4.19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-06-09 09:17:23 +02:00
Todd Kjos	137c838f17	Revert "binder: fix handling of misaligned binder object" ... This reverts commit 6bf7d3c5c0. The commit message is for a different patch. Reverting and then adding the same patch back with the correct commit message. Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Cc: stable <stable@vger.kernel.org> # 4.19 Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-06-09 09:17:23 +02:00