Commit Graph

12237 Commits

Author SHA1 Message Date
0cd606d997 cfg80211: fix and clean up cfg80211_gen_new_bssid()
Fix cfg80211_gen_new_bssid() to not rely on u64 modulo arithmetic,
which isn't needed since we really just want to mask there. Also,
clean it up to calculate the mask only once and use GENMASK_ULL()
instead of open-coding the mask calculation.

Change-Id: I085ee8206f36a161a00b4968b1875e47f7c72fc1
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 5d4071abd9a1e2b417beef31aaf7d45999e4882e
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Tengfei Fan <tengfeif@codeaurora.org>
2019-11-05 17:27:33 +08:00
7f6a034a6f cnss2: Expose PCIe window register lock related APIs
The register window needs to be configed properly before accessing
any larger than 4K range PCIe registers. Expose the lock to WLAN
driver to avoid race condition when both drivers try to config it.

Change-Id: I94ccd963d4fd0a9715330d2e5733346ccd993ae1
Signed-off-by: Yue Ma <yuem@codeaurora.org>
2019-10-18 14:53:44 -07:00
c17fcf60d2 Merge android-4.19-q.75 (cfe571e) into msm-4.19
* refs/heads/tmp-cfe571e:
  Linux 4.19.75
  media: technisat-usb2: break out of loop at end of buffer
  arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field
  binfmt_elf: move brk out of mmap when doing direct loader exec
  floppy: fix usercopy direction
  ovl: fix regression caused by overlapping layers detection
  PCI: kirin: Fix section mismatch warning
  iommu/amd: Fix race in increase_address_space()
  iommu/amd: Flush old domains in kdump kernel
  keys: Fix missing null pointer check in request_key_auth_describe()
  x86/hyper-v: Fix overflow bug in fill_gva_list()
  x86/uaccess: Don't leak the AC flags into __get_user() argument evaluation
  dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
  dmaengine: ti: dma-crossbar: Fix a memory leak bug
  net: seeq: Fix the function used to release some memory in an error handling path
  net: aquantia: fix out of memory condition on rx side
  tools/power turbostat: fix buffer overrun
  tools/power x86_energy_perf_policy: Fix argument parsing
  tools/power x86_energy_perf_policy: Fix "uninitialized variable" warnings at -O2
  amd-xgbe: Fix error path in xgbe_mod_init()
  perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops
  perf/x86/intel: Restrict period on Nehalem
  i2c: designware: Synchronize IRQs when unregistering slave client
  sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
  ibmvnic: Do not process reset during or after device removal
  ARM: 8901/1: add a criteria for pfn_valid of arm
  usb: host: xhci-tegra: Set DMA mask correctly
  cifs: Use kzfree() to zero out the password
  cifs: set domainName when a domain-key is used in multiuser
  kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol
  NFSv2: Fix write regression
  NFSv2: Fix eof handling
  netfilter: nf_conntrack_ftp: Fix debug output
  netfilter: xt_physdev: Fix spurious error message in physdev_mt_check
  x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
  r8152: Set memory to all 0xFFs on failed reg reads
  bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0
  batman-adv: Only read OGM2 tvlv_len after buffer len check
  ARM: 8874/1: mm: only adjust sections of valid mm structures
  qed: Add cleanup in qed_slowpath_start()
  xdp: unpin xdp umem pages in error path
  Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105
  NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
  NFSv4: Fix return value in nfs_finish_open()
  NFSv4: Fix return values for nfs4_file_open()
  netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info
  netfilter: nft_flow_offload: missing netlink attribute policy
  netfilter: ebtables: Fix argument order to ADD_COUNTER
  fpga: altera-ps-spi: Fix getting of optional confd gpio
  tools: bpftool: close prog FD before exit on showing a single program
  selftests/bpf: fix "bind{4, 6} deny specific IP & port" on s390
  s390/bpf: use 32-bit index for tail calls
  bus: ti-sysc: Simplify cleanup upon failures in sysc_probe()
  ARM: OMAP1: ams-delta-fiq: Fix missing irq_ack
  ARM: dts: dra74x: Fix iodelay configuration for mmc3
  ARM: OMAP2+: Fix omap4 errata warning on other SoCs
  s390/bpf: fix lcgr instruction encoding
  bus: ti-sysc: Fix using configured sysc mask value
  ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss
  ARM: dts: am57xx: Disable voltage switching for SD card
  ieee802154: hwsim: unregister hw while hwsim_subscribe_all_others fails
  ieee802154: hwsim: Fix error handle path in hwsim_init_module
  nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
  mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
  tty/serial: atmel: reschedule TX after RX was started
  serial: sprd: correct the wrong sequence of arguments
  firmware: google: check if size is valid when decoding VPD data
  KVM: coalesced_mmio: add bounds checking
  net_sched: let qdisc_put() accept NULL pointer
  xen-netfront: do not assume sk_buff_head list is empty in error handling
  udp: correct reuseport selection with connected sockets
  ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit
  phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
  media: tm6000: double free if usb disconnect while streaming
  USB: usbcore: Fix slab-out-of-bounds bug during device reset
  powerpc/mm/radix: Use the right page size for vmemmap mapping
  Input: elan_i2c - remove Lenovo Legion Y7000 PnpID
  RDMA/restrack: Release task struct which was hold by CM_ID object
  HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report
  netfilter: nf_flow_table: set default timeout after successful insertion

Change-Id: Id15fbdb2fd66826ddff749ecbbfea6a565a43192
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-09-24 00:38:59 -07:00
cfe571e421 Merge 4.19.75 into android-4.19-q
Changes in 4.19.75
	netfilter: nf_flow_table: set default timeout after successful insertion
	HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report
	RDMA/restrack: Release task struct which was hold by CM_ID object
	Input: elan_i2c - remove Lenovo Legion Y7000 PnpID
	powerpc/mm/radix: Use the right page size for vmemmap mapping
	USB: usbcore: Fix slab-out-of-bounds bug during device reset
	media: tm6000: double free if usb disconnect while streaming
	phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
	ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit
	udp: correct reuseport selection with connected sockets
	xen-netfront: do not assume sk_buff_head list is empty in error handling
	net_sched: let qdisc_put() accept NULL pointer
	KVM: coalesced_mmio: add bounds checking
	firmware: google: check if size is valid when decoding VPD data
	serial: sprd: correct the wrong sequence of arguments
	tty/serial: atmel: reschedule TX after RX was started
	mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
	nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
	ieee802154: hwsim: Fix error handle path in hwsim_init_module
	ieee802154: hwsim: unregister hw while hwsim_subscribe_all_others fails
	ARM: dts: am57xx: Disable voltage switching for SD card
	ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss
	bus: ti-sysc: Fix using configured sysc mask value
	s390/bpf: fix lcgr instruction encoding
	ARM: OMAP2+: Fix omap4 errata warning on other SoCs
	ARM: dts: dra74x: Fix iodelay configuration for mmc3
	ARM: OMAP1: ams-delta-fiq: Fix missing irq_ack
	bus: ti-sysc: Simplify cleanup upon failures in sysc_probe()
	s390/bpf: use 32-bit index for tail calls
	selftests/bpf: fix "bind{4, 6} deny specific IP & port" on s390
	tools: bpftool: close prog FD before exit on showing a single program
	fpga: altera-ps-spi: Fix getting of optional confd gpio
	netfilter: ebtables: Fix argument order to ADD_COUNTER
	netfilter: nft_flow_offload: missing netlink attribute policy
	netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info
	NFSv4: Fix return values for nfs4_file_open()
	NFSv4: Fix return value in nfs_finish_open()
	NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
	Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105
	xdp: unpin xdp umem pages in error path
	qed: Add cleanup in qed_slowpath_start()
	ARM: 8874/1: mm: only adjust sections of valid mm structures
	batman-adv: Only read OGM2 tvlv_len after buffer len check
	bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0
	r8152: Set memory to all 0xFFs on failed reg reads
	x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
	netfilter: xt_physdev: Fix spurious error message in physdev_mt_check
	netfilter: nf_conntrack_ftp: Fix debug output
	NFSv2: Fix eof handling
	NFSv2: Fix write regression
	kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol
	cifs: set domainName when a domain-key is used in multiuser
	cifs: Use kzfree() to zero out the password
	usb: host: xhci-tegra: Set DMA mask correctly
	ARM: 8901/1: add a criteria for pfn_valid of arm
	ibmvnic: Do not process reset during or after device removal
	sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
	i2c: designware: Synchronize IRQs when unregistering slave client
	perf/x86/intel: Restrict period on Nehalem
	perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops
	amd-xgbe: Fix error path in xgbe_mod_init()
	tools/power x86_energy_perf_policy: Fix "uninitialized variable" warnings at -O2
	tools/power x86_energy_perf_policy: Fix argument parsing
	tools/power turbostat: fix buffer overrun
	net: aquantia: fix out of memory condition on rx side
	net: seeq: Fix the function used to release some memory in an error handling path
	dmaengine: ti: dma-crossbar: Fix a memory leak bug
	dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
	x86/uaccess: Don't leak the AC flags into __get_user() argument evaluation
	x86/hyper-v: Fix overflow bug in fill_gva_list()
	keys: Fix missing null pointer check in request_key_auth_describe()
	iommu/amd: Flush old domains in kdump kernel
	iommu/amd: Fix race in increase_address_space()
	PCI: kirin: Fix section mismatch warning
	ovl: fix regression caused by overlapping layers detection
	floppy: fix usercopy direction
	binfmt_elf: move brk out of mmap when doing direct loader exec
	arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field
	media: technisat-usb2: break out of loop at end of buffer
	Linux 4.19.75

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib6ad09b3285fefb43d8bac96520f6dfc149c1283
2019-09-21 07:56:42 +02:00
fdd60d80c4 udp: correct reuseport selection with connected sockets
[ Upstream commit acdcecc61285faed359f1a3568c32089cc3a8329 ]

UDP reuseport groups can hold a mix unconnected and connected sockets.
Ensure that connections only receive all traffic to their 4-tuple.

Fast reuseport returns on the first reuseport match on the assumption
that all matches are equal. Only if connections are present, return to
the previous behavior of scoring all sockets.

Record if connections are present and if so (1) treat such connected
sockets as an independent match from the group, (2) only return
2-tuple matches from reuseport and (3) do not return on the first
2-tuple reuseport match to allow for a higher scoring match later.

New field has_conns is set without locks. No other fields in the
bitmap are modified at runtime and the field is only ever set
unconditionally, so an RMW cannot miss a change.

Fixes: e32ea7e747 ("soreuseport: fast reuseport UDP socket selection")
Link: http://lkml.kernel.org/r/CA+FuTSfRP09aJNYRt04SS6qj22ViiOEWaWmLAwX0psk8-PGNxw@mail.gmail.com
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Craig Gallek <kraig@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-21 07:16:43 +02:00
0e5107f00a Merge android-4.19-q.73 (8feec99) into msm-4.19
* refs/heads/tmp-8feec99:
  Documentation: devicetree: Remove Exynos bindings from kernel
  Documentation: devicetree: Remove Armadeus bindings from kernel
  Revert "dt-bindings: mmc: Add supports-cqe property"
  Revert "dt-bindings: mmc: Add disable-cqe-dcmd property."
  Linux 4.19.73
  vhost: make sure log_num < in_num
  powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts
  powerpc/tm: Remove msr_tm_active()
  PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround
  ext4: unsigned int compared against zero
  ext4: fix block validity checks for journal inodes using indirect blocks
  ext4: don't perform block validity checks on the journal inode
  drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors
  virtio/s390: fix race on airq_areas[]
  drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV
  bcache: fix race in btree_flush_write()
  bcache: add comments for mutex_lock(&b->write_lock)
  bcache: only clear BTREE_NODE_dirty bit when it is set
  NFSv4: Fix delegation state recovery
  iio: adc: gyroadc: fix uninitialized return code
  mm/migrate.c: initialize pud_entry in migrate_vma()
  i2c: at91: fix clk_offset for sama5d2
  i2c: at91: disable TXRDY interrupt after sending data
  gpio: don't WARN() on NULL descs if gpiolib is disabled
  iommu/iova: Remove stale cached32_node
  powerpc/mm: Limit rma_size to 1TB when running without HV mode
  ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips
  drm/panel: Add support for Armadeus ST0700 Adapt
  dm thin metadata: check if in fail_io mode when setting needs_check
  pstore: Fix double-free in pstore_mkfile() failure path
  resource: fix locking in find_next_iomem_res()
  resource: Fix find_next_iomem_res() iteration issue
  resource: Include resource end in walk_*() interfaces
  btrfs: correctly validate compression type
  RDMA/srp: Accept again source addresses that do not have a port number
  RDMA/srp: Document srp_parse_in() arguments
  ARM: dts: gemini: Set DIR-685 SPI CS as active low
  KVM: PPC: Book3S HV: Fix CR0 setting in TM emulation
  KVM: PPC: Use ccr field in pt_regs struct embedded in vcpu struct
  KVM: VMX: check CPUID before allowing read/write of IA32_XSS
  KVM: VMX: Fix handling of #MC that occurs during VM-Entry
  KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad value
  KVM: x86: optimize check for valid PAT value
  ceph: use ceph_evict_inode to cleanup inode's resource
  ALSA: hda - Don't resume forcibly i915 HDMI/DP codec
  cifs: Properly handle auto disabling of serverino option
  scsi: zfcp: fix request object use-after-free in send path causing wrong traces
  staging: wilc1000: fix error path cleanup in wilc_wlan_initialize()
  scsi: target/iblock: Fix overrun in WRITE SAME emulation
  scsi: target/core: Use the SECTOR_SHIFT constant
  apparmor: reset pos on failure to unpack for various functions
  IB/hfi1: Avoid hardlockup with flushlist_lock
  clk: tegra210: Fix default rates for HDA clocks
  clk: tegra: Fix maximum audio sync clock for Tegra124/210
  cifs: add spinlock for the openFileList to cifsInodeInfo
  Btrfs: fix race between block group removal and block group allocation
  drm/amdgpu/{uvd,vcn}: fetch ring's read_ptr after alloc
  drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2)
  kvm: Check irqchip mode before assign irqfd
  drm/amdkfd: Add missing Polaris10 ID
  ARC: mm: SIGSEGV userspace trying to access kernel virtual memory
  ARC: mm: fix uninitialised signal code in do_page_fault
  signal/arc: Use force_sig_fault where appropriate
  dm crypt: move detailed message into debug level
  cifs: smbd: take an array of reqeusts when sending upper layer data
  PCI: dwc: Use devm_pci_alloc_host_bridge() to simplify code
  mmc: sdhci-pci: Add support for Intel CML
  blk-mq: free hw queue's resource in hctx's release handler
  dm mpath: fix missing call of path selector type->end_io
  PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary
  PCI: Add macro for Switchtec quirk declarations
  dt-bindings: mmc: Add disable-cqe-dcmd property.
  dt-bindings: mmc: Add supports-cqe property
  ARM: dts: qcom: ipq4019: enlarge PCIe BAR range
  ARM: dts: qcom: ipq4019: Fix MSI IRQ type
  ARM: dts: qcom: ipq4019: fix PCI range
  ext4: protect journal inode's blocks using block_validity
  media: i2c: tda1997x: select V4L2_FWNODE
  cifs: Fix lease buffer length error
  KVM: x86: Always use 32-bit SMRAM save state for 32-bit kernels
  x86/kvm: move kvm_load/put_guest_xcr0 into atomic context
  kvm: mmu: Fix overflow on kvm mmu page limit calculation
  IB/mlx5: Reset access mask when looping inside page fault handler
  arm64: dts: stratix10: add the sysmgr-syscon property from the gmac's
  usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps
  drm/i915: Sanity check mmap length against object size
  drm/i915: Handle vm_mmap error during I915_GEM_MMAP ioctl with WC set
  CIFS: Fix leaking locked VFS cache pages in writeback retry
  CIFS: Fix error paths in writeback code
  drm: add __user attribute to ptr_to_compat()
  PCI: qcom: Don't deassert reset GPIO during probe
  PCI: qcom: Fix error handling in runtime PM support
  btrfs: init csum_list before possible free
  btrfs: scrub: fix circular locking dependency warning
  btrfs: scrub: move scrub_setup_ctx allocation out of device_list_mutex
  btrfs: scrub: pass fs_info to scrub_setup_ctx
  mmc: renesas_sdhi: Fix card initialization failure in high speed mode
  powerpc/kvm: Save and restore host AMR/IAMR/UAMOR
  spi: spi-gpio: fix SPI_CS_HIGH capability
  x86/kvmclock: set offset for kvm unstable clock
  iwlwifi: add new card for 9260 series
  iwlwifi: fix devices with PCI Device ID 0x34F0 and 11ac RF modules
  drm/nouveau: Don't WARN_ON VCPI allocation failures
  mt76: fix corrupted software generated tx CCMP PN
  iio: adc: exynos-adc: Use proper number of channels for Exynos4x12
  dt-bindings: iio: adc: exynos-adc: Add S5PV210 variant
  iio: adc: exynos-adc: Add S5PV210 variant
  KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run
  bcache: treat stale && dirty keys as bad keys
  bcache: replace hard coded number with BUCKET_GC_GEN_MAX
  tpm: Fix some name collisions with drivers/char/tpm.h
  mfd: Kconfig: Fix I2C_DESIGNWARE_PLATFORM dependencies
  drm/i915/ilk: Fix warning when reading emon_status with no output
  drm/vblank: Allow dynamic per-crtc max_vblank_count
  crypto: ccree - add missing inline qualifier
  crypto: ccree - fix resume race condition on init
  IB/uverbs: Fix OOPs upon device disassociation
  ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while handle_mm_fault
  ARC: show_regs: lockdep: re-enable preemption
  media: vim2m: only cancel work if it is for right context
  btrfs: Use real device structure to verify dev extent
  btrfs: volumes: Make sure no dev extent is beyond device boundary
  powerpc/pkeys: Fix handling of pkey state across fork()
  scsi: megaraid_sas: Use 63-bit DMA addressing
  scsi: megaraid_sas: Add check for reset adapter bit
  scsi: megaraid_sas: Fix combined reply queue mode detection
  btrfs: Fix error handling in btrfs_cleanup_ordered_extents
  btrfs: Remove extent_io_ops::fill_delalloc
  Btrfs: fix deadlock with memory reclaim during scrub
  Btrfs: clean up scrub is_dev_replace parameter
  KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode switch
  drm/i915: Cleanup gt powerstate from gem
  drm/i915: Restore sane defaults for KMS on GEM error load
  media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work
  media: vim2m: use workqueue
  s390/zcrypt: reinit ap queue state machine during device probe
  ARM: davinci: dm644x: define gpio interrupts as separate resources
  ARM: davinci: dm355: define gpio interrupts as separate resources
  ARM: davinci: dm646x: define gpio interrupts as separate resources
  ARM: davinci: dm365: define gpio interrupts as separate resources
  ARM: davinci: da8xx: define gpio interrupts as separate resources
  drm/amd/dm: Understand why attaching path/tile properties are needed
  drm/amd/pp: Fix truncated clock value when set watermark
  powerplay: Respect units on max dcfclk watermark
  Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up
  Drivers: hv: kvp: Fix the indentation of some "break" statements
  drm/atomic_helper: Disallow new modesets on unregistered connectors
  drm/i915/gen9+: Fix initial readout for Y tiled framebuffers
  drm/i915: Rename PLANE_CTL_DECOMPRESSION_ENABLE
  drm/i915: Fix intel_dp_mst_best_encoder()
  x86/kvm/lapic: preserve gfn_to_hva_cache len on cache reinit
  KVM: hyperv: define VP assist page helpers
  KVM: x86: hyperv: keep track of mismatched VP indexes
  KVM: x86: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv' variables
  KVM: x86: hyperv: enforce vp_index < KVM_MAX_VCPUS
  drm/amdgpu: Update gc_9_0 golden settings.
  drm/amdgpu/gfx9: Update gfx9 golden settings.
  remoteproc: qcom: q6v5-mss: add SCM probe dependency
  x86, hibernate: Fix nosave_regions setup for hibernation
  Drivers: hv: kvp: Fix two "this statement may fall through" warnings
  keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
  scsi: qla2xxx: Move log messages before issuing command to firmware
  media: cec: remove cec-edid.c
  media: cec/v4l2: move V4L2 specific CEC functions to V4L2
  drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"
  kernel/module: Fix mem leak in module_add_modinfo_attrs
  modules: always page-align module section allocations
  remoteproc: qcom: q6v5: shore up resource probe handling
  clk: s2mps11: Add used attribute to s2mps11_dt_match
  nvme-fc: use separate work queue to avoid warning
  riscv: remove unused variable in ftrace
  scripts/decode_stacktrace: match basepath using shell prefix operator, not regex
  arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64
  media: stm32-dcmi: fix irq = 0 case
  powerpc/64: mark start_here_multiplatform as __ref
  x86/ftrace: Fix warning and considate ftrace_jmp_replace() and ftrace_call_replace()
  selftests: fib_rule_tests: use pre-defined DEV_ADDR
  timekeeping: Use proper ktime_add when adding nsecs in coarse offset
  {nl,mac}80211: fix interface combinations on crypto controlled devices
  blk-iolatency: fix STS_AGAIN handling
  Blk-iolatency: warn on negative inflight IO counter
  hv_sock: Fix hang when a connection is closed
  batman-adv: Only read OGM tvlv_len after buffer len check
  batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
  powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
  vhost/test: fix build for vhost test - again
  vhost/test: fix build for vhost test
  drm/vmwgfx: Fix double free in vmw_recv_msg()
  sched/fair: Don't assign runtime for throttled cfs_rq
  ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre
  ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL
  ALSA: hda/realtek - Add quirk for HP Pavilion 15
  ALSA: hda/realtek - Fix overridden device-specific initialization
  ALSA: hda - Fix potential endless loop at applying quirks
  ANDROID: regression introduced override_creds=off

Change-Id: I74d7d497d9ec70b589ac400f62e266858ee7893d
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-09-18 00:41:18 -07:00
8feec99e2c Merge 4.19.73 into android-4.19-q
Changes in 4.19.73
	ALSA: hda - Fix potential endless loop at applying quirks
	ALSA: hda/realtek - Fix overridden device-specific initialization
	ALSA: hda/realtek - Add quirk for HP Pavilion 15
	ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL
	ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre
	sched/fair: Don't assign runtime for throttled cfs_rq
	drm/vmwgfx: Fix double free in vmw_recv_msg()
	vhost/test: fix build for vhost test
	vhost/test: fix build for vhost test - again
	powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
	batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
	batman-adv: Only read OGM tvlv_len after buffer len check
	hv_sock: Fix hang when a connection is closed
	Blk-iolatency: warn on negative inflight IO counter
	blk-iolatency: fix STS_AGAIN handling
	{nl,mac}80211: fix interface combinations on crypto controlled devices
	timekeeping: Use proper ktime_add when adding nsecs in coarse offset
	selftests: fib_rule_tests: use pre-defined DEV_ADDR
	x86/ftrace: Fix warning and considate ftrace_jmp_replace() and ftrace_call_replace()
	powerpc/64: mark start_here_multiplatform as __ref
	media: stm32-dcmi: fix irq = 0 case
	arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64
	scripts/decode_stacktrace: match basepath using shell prefix operator, not regex
	riscv: remove unused variable in ftrace
	nvme-fc: use separate work queue to avoid warning
	clk: s2mps11: Add used attribute to s2mps11_dt_match
	remoteproc: qcom: q6v5: shore up resource probe handling
	modules: always page-align module section allocations
	kernel/module: Fix mem leak in module_add_modinfo_attrs
	drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"
	media: cec/v4l2: move V4L2 specific CEC functions to V4L2
	media: cec: remove cec-edid.c
	scsi: qla2xxx: Move log messages before issuing command to firmware
	keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
	Drivers: hv: kvp: Fix two "this statement may fall through" warnings
	x86, hibernate: Fix nosave_regions setup for hibernation
	remoteproc: qcom: q6v5-mss: add SCM probe dependency
	drm/amdgpu/gfx9: Update gfx9 golden settings.
	drm/amdgpu: Update gc_9_0 golden settings.
	KVM: x86: hyperv: enforce vp_index < KVM_MAX_VCPUS
	KVM: x86: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv' variables
	KVM: x86: hyperv: keep track of mismatched VP indexes
	KVM: hyperv: define VP assist page helpers
	x86/kvm/lapic: preserve gfn_to_hva_cache len on cache reinit
	drm/i915: Fix intel_dp_mst_best_encoder()
	drm/i915: Rename PLANE_CTL_DECOMPRESSION_ENABLE
	drm/i915/gen9+: Fix initial readout for Y tiled framebuffers
	drm/atomic_helper: Disallow new modesets on unregistered connectors
	Drivers: hv: kvp: Fix the indentation of some "break" statements
	Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up
	powerplay: Respect units on max dcfclk watermark
	drm/amd/pp: Fix truncated clock value when set watermark
	drm/amd/dm: Understand why attaching path/tile properties are needed
	ARM: davinci: da8xx: define gpio interrupts as separate resources
	ARM: davinci: dm365: define gpio interrupts as separate resources
	ARM: davinci: dm646x: define gpio interrupts as separate resources
	ARM: davinci: dm355: define gpio interrupts as separate resources
	ARM: davinci: dm644x: define gpio interrupts as separate resources
	s390/zcrypt: reinit ap queue state machine during device probe
	media: vim2m: use workqueue
	media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work
	drm/i915: Restore sane defaults for KMS on GEM error load
	drm/i915: Cleanup gt powerstate from gem
	KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode switch
	Btrfs: clean up scrub is_dev_replace parameter
	Btrfs: fix deadlock with memory reclaim during scrub
	btrfs: Remove extent_io_ops::fill_delalloc
	btrfs: Fix error handling in btrfs_cleanup_ordered_extents
	scsi: megaraid_sas: Fix combined reply queue mode detection
	scsi: megaraid_sas: Add check for reset adapter bit
	scsi: megaraid_sas: Use 63-bit DMA addressing
	powerpc/pkeys: Fix handling of pkey state across fork()
	btrfs: volumes: Make sure no dev extent is beyond device boundary
	btrfs: Use real device structure to verify dev extent
	media: vim2m: only cancel work if it is for right context
	ARC: show_regs: lockdep: re-enable preemption
	ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while handle_mm_fault
	IB/uverbs: Fix OOPs upon device disassociation
	crypto: ccree - fix resume race condition on init
	crypto: ccree - add missing inline qualifier
	drm/vblank: Allow dynamic per-crtc max_vblank_count
	drm/i915/ilk: Fix warning when reading emon_status with no output
	mfd: Kconfig: Fix I2C_DESIGNWARE_PLATFORM dependencies
	tpm: Fix some name collisions with drivers/char/tpm.h
	bcache: replace hard coded number with BUCKET_GC_GEN_MAX
	bcache: treat stale && dirty keys as bad keys
	KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run
	iio: adc: exynos-adc: Add S5PV210 variant
	dt-bindings: iio: adc: exynos-adc: Add S5PV210 variant
	iio: adc: exynos-adc: Use proper number of channels for Exynos4x12
	mt76: fix corrupted software generated tx CCMP PN
	drm/nouveau: Don't WARN_ON VCPI allocation failures
	iwlwifi: fix devices with PCI Device ID 0x34F0 and 11ac RF modules
	iwlwifi: add new card for 9260 series
	x86/kvmclock: set offset for kvm unstable clock
	spi: spi-gpio: fix SPI_CS_HIGH capability
	powerpc/kvm: Save and restore host AMR/IAMR/UAMOR
	mmc: renesas_sdhi: Fix card initialization failure in high speed mode
	btrfs: scrub: pass fs_info to scrub_setup_ctx
	btrfs: scrub: move scrub_setup_ctx allocation out of device_list_mutex
	btrfs: scrub: fix circular locking dependency warning
	btrfs: init csum_list before possible free
	PCI: qcom: Fix error handling in runtime PM support
	PCI: qcom: Don't deassert reset GPIO during probe
	drm: add __user attribute to ptr_to_compat()
	CIFS: Fix error paths in writeback code
	CIFS: Fix leaking locked VFS cache pages in writeback retry
	drm/i915: Handle vm_mmap error during I915_GEM_MMAP ioctl with WC set
	drm/i915: Sanity check mmap length against object size
	usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps
	arm64: dts: stratix10: add the sysmgr-syscon property from the gmac's
	IB/mlx5: Reset access mask when looping inside page fault handler
	kvm: mmu: Fix overflow on kvm mmu page limit calculation
	x86/kvm: move kvm_load/put_guest_xcr0 into atomic context
	KVM: x86: Always use 32-bit SMRAM save state for 32-bit kernels
	cifs: Fix lease buffer length error
	media: i2c: tda1997x: select V4L2_FWNODE
	ext4: protect journal inode's blocks using block_validity
	ARM: dts: qcom: ipq4019: fix PCI range
	ARM: dts: qcom: ipq4019: Fix MSI IRQ type
	ARM: dts: qcom: ipq4019: enlarge PCIe BAR range
	dt-bindings: mmc: Add supports-cqe property
	dt-bindings: mmc: Add disable-cqe-dcmd property.
	PCI: Add macro for Switchtec quirk declarations
	PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary
	dm mpath: fix missing call of path selector type->end_io
	blk-mq: free hw queue's resource in hctx's release handler
	mmc: sdhci-pci: Add support for Intel CML
	PCI: dwc: Use devm_pci_alloc_host_bridge() to simplify code
	cifs: smbd: take an array of reqeusts when sending upper layer data
	dm crypt: move detailed message into debug level
	signal/arc: Use force_sig_fault where appropriate
	ARC: mm: fix uninitialised signal code in do_page_fault
	ARC: mm: SIGSEGV userspace trying to access kernel virtual memory
	drm/amdkfd: Add missing Polaris10 ID
	kvm: Check irqchip mode before assign irqfd
	drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2)
	drm/amdgpu/{uvd,vcn}: fetch ring's read_ptr after alloc
	Btrfs: fix race between block group removal and block group allocation
	cifs: add spinlock for the openFileList to cifsInodeInfo
	clk: tegra: Fix maximum audio sync clock for Tegra124/210
	clk: tegra210: Fix default rates for HDA clocks
	IB/hfi1: Avoid hardlockup with flushlist_lock
	apparmor: reset pos on failure to unpack for various functions
	scsi: target/core: Use the SECTOR_SHIFT constant
	scsi: target/iblock: Fix overrun in WRITE SAME emulation
	staging: wilc1000: fix error path cleanup in wilc_wlan_initialize()
	scsi: zfcp: fix request object use-after-free in send path causing wrong traces
	cifs: Properly handle auto disabling of serverino option
	ALSA: hda - Don't resume forcibly i915 HDMI/DP codec
	ceph: use ceph_evict_inode to cleanup inode's resource
	KVM: x86: optimize check for valid PAT value
	KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad value
	KVM: VMX: Fix handling of #MC that occurs during VM-Entry
	KVM: VMX: check CPUID before allowing read/write of IA32_XSS
	KVM: PPC: Use ccr field in pt_regs struct embedded in vcpu struct
	KVM: PPC: Book3S HV: Fix CR0 setting in TM emulation
	ARM: dts: gemini: Set DIR-685 SPI CS as active low
	RDMA/srp: Document srp_parse_in() arguments
	RDMA/srp: Accept again source addresses that do not have a port number
	btrfs: correctly validate compression type
	resource: Include resource end in walk_*() interfaces
	resource: Fix find_next_iomem_res() iteration issue
	resource: fix locking in find_next_iomem_res()
	pstore: Fix double-free in pstore_mkfile() failure path
	dm thin metadata: check if in fail_io mode when setting needs_check
	drm/panel: Add support for Armadeus ST0700 Adapt
	ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips
	powerpc/mm: Limit rma_size to 1TB when running without HV mode
	iommu/iova: Remove stale cached32_node
	gpio: don't WARN() on NULL descs if gpiolib is disabled
	i2c: at91: disable TXRDY interrupt after sending data
	i2c: at91: fix clk_offset for sama5d2
	mm/migrate.c: initialize pud_entry in migrate_vma()
	iio: adc: gyroadc: fix uninitialized return code
	NFSv4: Fix delegation state recovery
	bcache: only clear BTREE_NODE_dirty bit when it is set
	bcache: add comments for mutex_lock(&b->write_lock)
	bcache: fix race in btree_flush_write()
	drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV
	virtio/s390: fix race on airq_areas[]
	drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors
	ext4: don't perform block validity checks on the journal inode
	ext4: fix block validity checks for journal inodes using indirect blocks
	ext4: unsigned int compared against zero
	PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround
	powerpc/tm: Remove msr_tm_active()
	powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts
	vhost: make sure log_num < in_num
	Linux 4.19.73

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9949b14a25edc8d3fdf8518e1d862dc534b2f4f4
2019-09-16 09:34:35 +02:00
1aa38eceb6 {nl,mac}80211: fix interface combinations on crypto controlled devices
[ Upstream commit e6f4051123fd33901e9655a675b22aefcdc5d277 ]

Commit 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on
crypto controlled devices") has introduced a change which allows
4addr operation on crypto controlled devices (ex: ath10k). This
change has inadvertently impacted the interface combinations logic
on such devices.

General rule is that software interfaces like AP/VLAN should not be
listed under supported interface combinations and should not be
considered during validation of these combinations; because of the
aforementioned change, AP/VLAN interfaces(if present) will be checked
against interfaces supported by the device and blocks valid interface
combinations.

Consider a case where an AP and AP/VLAN are up and running; when a
second AP device is brought up on the same physical device, this AP
will be checked against the AP/VLAN interface (which will not be
part of supported interface combinations of the device) and blocks
second AP to come up.

Add a new API cfg80211_iftype_allowed() to fix the problem, this
API works for all devices with/without SW crypto control.

Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
Fixes: 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on crypto controlled devices")
Link: https://lore.kernel.org/r/1563779690-9716-1-git-send-email-mpubbise@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-09-16 08:21:42 +02:00
ccd9df2b0b Merge "Merge android-4.19-q.72 (64f28a8) into msm-4.19" 2019-09-14 12:00:56 -07:00
f020f7cc0d Merge "cnss2: Expose QMI send related APIs" 2019-09-10 12:15:27 -07:00
dd955093cd Merge android-4.19-q.72 (64f28a8) into msm-4.19
* refs/heads/tmp-64f28a8:
  Linux 4.19.72
  Revert "x86/apic: Include the LDR when clearing out APIC registers"
  libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
  x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement()
  KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity
  afs: Fix leak in afs_lookup_cell_rcu()
  KVM: arm/arm64: Only skip MMIO insn once
  ceph: fix buffer free while holding i_ceph_lock in fill_inode()
  ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob()
  ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
  selftests/kvm: make platform_info_test pass on AMD
  selftests: kvm: fix state save/load on processors without XSAVE
  infiniband: hfi1: fix memory leaks
  infiniband: hfi1: fix a memory leak bug
  IB/mlx4: Fix memory leaks
  nvme-multipath: fix possible I/O hang when paths are updated
  Tools: hv: kvp: eliminate 'may be used uninitialized' warning
  Input: hyperv-keyboard: Use in-place iterator API in the channel callback
  x86/boot/compressed/64: Fix boot on machines with broken E820 table
  HID: cp2112: prevent sleeping function called from invalid context
  kprobes: Fix potential deadlock in kprobe_optimizer()
  ravb: Fix use-after-free ravb_tstamp_skb
  wimax/i2400m: fix a memory leak bug
  net: cavium: fix driver name
  ibmvnic: Unmap DMA address of TX descriptor buffers after use
  net: kalmia: fix memory leaks
  cx82310_eth: fix a memory leak bug
  vfs: fix page locking deadlocks when deduping files
  lan78xx: Fix memory leaks
  net: myri10ge: fix memory leaks
  liquidio: add cleanup in octeon_setup_iq()
  cxgb4: fix a memory leak bug
  scsi: target: tcmu: avoid use-after-free after command timeout
  scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure
  drm/mediatek: set DMA max segment size
  drm/mediatek: use correct device to import PRIME buffers
  netfilter: nft_flow_offload: skip tcp rst and fin packets
  gpio: Fix build error of function redefinition
  ibmveth: Convert multicast list size for little-endian system
  Bluetooth: btqca: Add a short delay before downloading the NVM
  net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
  hv_netvsc: Fix a warning of suspicious RCU usage
  tools: bpftool: fix error message (prog -> object)
  netfilter: nf_tables: use-after-free in failing rule with bound set
  net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
  spi: bcm2835aux: fix corruptions for longer spi transfers
  spi: bcm2835aux: remove dangerous uncontrolled read of fifo
  spi: bcm2835aux: unifying code between polling and interrupt driven code
  x86/boot: Preserve boot_params.secure_boot from sanitizing
  net/rds: Fix info leak in rds6_inc_info_copy()
  tcp: remove empty skb from write queue in error cases
  tcp: inherit timestamp on mtu probe
  net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
  net_sched: fix a NULL pointer deref in ipt action
  net: sched: act_sample: fix psample group handling on overwrite
  net: fix skb use after free in netpoll
  mld: fix memory leak in mld_del_delrec()

Change-Id: Ia09fdffc6f30154c2bb5b7591d2d8a96c2c0648e
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-09-10 05:51:06 -07:00
64f28a85d2 Merge 4.19.72 into android-4.19-q
Changes in 4.19.72
	mld: fix memory leak in mld_del_delrec()
	net: fix skb use after free in netpoll
	net: sched: act_sample: fix psample group handling on overwrite
	net_sched: fix a NULL pointer deref in ipt action
	net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
	tcp: inherit timestamp on mtu probe
	tcp: remove empty skb from write queue in error cases
	net/rds: Fix info leak in rds6_inc_info_copy()
	x86/boot: Preserve boot_params.secure_boot from sanitizing
	spi: bcm2835aux: unifying code between polling and interrupt driven code
	spi: bcm2835aux: remove dangerous uncontrolled read of fifo
	spi: bcm2835aux: fix corruptions for longer spi transfers
	net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
	netfilter: nf_tables: use-after-free in failing rule with bound set
	tools: bpftool: fix error message (prog -> object)
	hv_netvsc: Fix a warning of suspicious RCU usage
	net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
	Bluetooth: btqca: Add a short delay before downloading the NVM
	ibmveth: Convert multicast list size for little-endian system
	gpio: Fix build error of function redefinition
	netfilter: nft_flow_offload: skip tcp rst and fin packets
	drm/mediatek: use correct device to import PRIME buffers
	drm/mediatek: set DMA max segment size
	scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure
	scsi: target: tcmu: avoid use-after-free after command timeout
	cxgb4: fix a memory leak bug
	liquidio: add cleanup in octeon_setup_iq()
	net: myri10ge: fix memory leaks
	lan78xx: Fix memory leaks
	vfs: fix page locking deadlocks when deduping files
	cx82310_eth: fix a memory leak bug
	net: kalmia: fix memory leaks
	ibmvnic: Unmap DMA address of TX descriptor buffers after use
	net: cavium: fix driver name
	wimax/i2400m: fix a memory leak bug
	ravb: Fix use-after-free ravb_tstamp_skb
	kprobes: Fix potential deadlock in kprobe_optimizer()
	HID: cp2112: prevent sleeping function called from invalid context
	x86/boot/compressed/64: Fix boot on machines with broken E820 table
	Input: hyperv-keyboard: Use in-place iterator API in the channel callback
	Tools: hv: kvp: eliminate 'may be used uninitialized' warning
	nvme-multipath: fix possible I/O hang when paths are updated
	IB/mlx4: Fix memory leaks
	infiniband: hfi1: fix a memory leak bug
	infiniband: hfi1: fix memory leaks
	selftests: kvm: fix state save/load on processors without XSAVE
	selftests/kvm: make platform_info_test pass on AMD
	ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
	ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob()
	ceph: fix buffer free while holding i_ceph_lock in fill_inode()
	KVM: arm/arm64: Only skip MMIO insn once
	afs: Fix leak in afs_lookup_cell_rcu()
	KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity
	x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement()
	libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
	Revert "x86/apic: Include the LDR when clearing out APIC registers"
	Linux 4.19.72

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9c77f23ff47856e50448608a70410d502d3c2f1a
2019-09-10 10:49:19 +01:00
5776970fb4 netfilter: nf_tables: use-after-free in failing rule with bound set
[ Upstream commit 6a0a8d10a3661a036b55af695542a714c429ab7c ]

If a rule that has already a bound anonymous set fails to be added, the
preparation phase releases the rule and the bound set. However, the
transaction object from the abort path still has a reference to the set
object that is stale, leading to a use-after-free when checking for the
set->bound field. Add a new field to the transaction that specifies if
the set is bound, so the abort path can skip releasing it since the rule
command owns it and it takes care of releasing it. After this update,
the set->bound field is removed.

[   24.649883] Unable to handle kernel paging request at virtual address 0000000000040434
[   24.657858] Mem abort info:
[   24.660686]   ESR = 0x96000004
[   24.663769]   Exception class = DABT (current EL), IL = 32 bits
[   24.669725]   SET = 0, FnV = 0
[   24.672804]   EA = 0, S1PTW = 0
[   24.675975] Data abort info:
[   24.678880]   ISV = 0, ISS = 0x00000004
[   24.682743]   CM = 0, WnR = 0
[   24.685723] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000428952000
[   24.692207] [0000000000040434] pgd=0000000000000000
[   24.697119] Internal error: Oops: 96000004 [#1] SMP
[...]
[   24.889414] Call trace:
[   24.891870]  __nf_tables_abort+0x3f0/0x7a0
[   24.895984]  nf_tables_abort+0x20/0x40
[   24.899750]  nfnetlink_rcv_batch+0x17c/0x588
[   24.904037]  nfnetlink_rcv+0x13c/0x190
[   24.907803]  netlink_unicast+0x18c/0x208
[   24.911742]  netlink_sendmsg+0x1b0/0x350
[   24.915682]  sock_sendmsg+0x4c/0x68
[   24.919185]  ___sys_sendmsg+0x288/0x2c8
[   24.923037]  __sys_sendmsg+0x7c/0xd0
[   24.926628]  __arm64_sys_sendmsg+0x2c/0x38
[   24.930744]  el0_svc_common.constprop.0+0x94/0x158
[   24.935556]  el0_svc_handler+0x34/0x90
[   24.939322]  el0_svc+0x8/0xc
[   24.942216] Code: 37280300 f9404023 91014262 aa1703e0 (f9401863)
[   24.948336] ---[ end trace cebbb9dcbed3b56f ]---

Fixes: f6ac85858976 ("netfilter: nf_tables: unbind set in rule from commit path")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-09-10 10:33:42 +01:00
38166934f8 net_sched: fix a NULL pointer deref in ipt action
[ Upstream commit 981471bd3abf4d572097645d765391533aac327d ]

The net pointer in struct xt_tgdtor_param is not explicitly
initialized therefore is still NULL when dereferencing it.
So we have to find a way to pass the correct net pointer to
ipt_destroy_target().

The best way I find is just saving the net pointer inside the per
netns struct tcf_idrinfo, which could make this patch smaller.

Fixes: 0c66dc1ea3 ("netfilter: conntrack: register hooks in netns when needed by ruleset")
Reported-and-tested-by: itugrok@yahoo.com
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-10 10:33:39 +01:00
5ff0ab0c66 net: sched: act_sample: fix psample group handling on overwrite
[ Upstream commit dbf47a2a094edf58983265e323ca4bdcdb58b5ee ]

Action sample doesn't properly handle psample_group pointer in overwrite
case. Following issues need to be fixed:

- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
  s->psample_group, even though we neither setting the pointer to NULL, nor
  preventing concurrent readers from accessing the pointer in some way.
  Use rcu_swap_protected() instead to safely reset the pointer.

- Old value of s->psample_group is not released or deallocated in any way,
  which results resource leak. Use psample_group_put() on non-NULL value
  obtained with rcu_swap_protected().

- The function psample_group_put() that released reference to struct
  psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
  grace period when deallocating it. Extend struct psample_group with rcu
  head and use kfree_rcu when freeing it.

Fixes: 5c5670fae4 ("net/sched: Introduce sample tc action")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-10 10:33:38 +01:00
afd697d007 nl80211: Add support for EDMG channels
802.11ay specification defines Enhanced Directional Multi-Gigabit
(EDMG) STA and AP which allow channel bonding of 2 channels and more.

Introduce new NL attributes that are needed for enabling and
configuring EDMG support.

Two new attributes are used by kernel to publish driver's EDMG
capabilities to the userspace:
NL80211_BAND_ATTR_EDMG_CHANNELS - bitmap field that indicates the 2.16
GHz channel(s) that are supported by the driver.
When this attribute is not set it means driver does not support EDMG.
NL80211_BAND_ATTR_EDMG_BW_CONFIG - represent the channel bandwidth
configurations supported by the driver.

Additional two new attributes are used by the userspace for connect
command and for AP configuration:
NL80211_ATTR_WIPHY_EDMG_CHANNELS
NL80211_ATTR_WIPHY_EDMG_BW_CONFIG

New rate info flag - RATE_INFO_FLAGS_EDMG, can be reported from driver
and used for bitrate calculation that will take into account EDMG
according to the 802.11ay specification.

Change-Id: I06d3f04d16b68d35c1dd9cd3624916302e8725a1
Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>
Link: https://lore.kernel.org/r/1566138918-3823-2-git-send-email-ailizaro@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 2a38075cd0beefa4da326380cf54c7b365ddc035
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
[ailizaro@codeaurora.org: fix conflict due to missing NLA policy]
Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>
2019-09-09 11:15:51 +03:00
def7a5127d cnss2: Expose QMI send related APIs
Interface change to expose QMI send related APIs for WLAN driver.
This patch is to provide API interface to ease compilation issues
among various branches of kernel and WLAN driver. The actual
implementation will be in a separate patch.

Change-Id: I691eedd37a9f855191a3944c2ffd6acfbe65f9ba
Signed-off-by: Yue Ma <yuem@codeaurora.org>
2019-09-05 15:22:34 -07:00
5dc7d7712c Merge "Merge android-4.19-q.66 (5118163) into msm-4.19" 2019-08-20 06:00:30 -07:00
4d333b4784 Merge "Merge android-4.19.62 (f232ce6) into msm-4.19" 2019-08-19 17:38:46 -07:00
f80dad3cdc Merge android-4.19-q.65 (03d5ba408) into msm-4.19
* refs/heads/tmp-03d5ba408:
  Linux 4.19.65
  Documentation: Add swapgs description to the Spectre v1 documentation
  x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS
  x86/entry/64: Use JMP instead of JMPQ
  x86/speculation: Enable Spectre v1 swapgs mitigations
  x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations
  x86/cpufeatures: Combine word 11 and 12 into a new scattered features word
  x86/cpufeatures: Carve out CQM features retrieval
  scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
  x86/vdso: Prevent segfaults due to hoisted vclock reads
  gcc-9: properly declare the {pv,hv}clock_page storage
  objtool: Support GCC 9 cold subfunction naming scheme
  ARC: enable uboot support unconditionally
  eeprom: at24: make spd world-readable again
  drm/i915/gvt: fix incorrect cache entry for guest page mapping
  IB/hfi1: Check for error on call to alloc_rsm_map_table
  IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification
  IB/mlx5: Fix clean_mr() to work in the expected order
  IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache
  IB/mlx5: Use direct mkey destroy command upon UMR unreg failure
  IB/mlx5: Fix unreg_umr to ignore the mkey state
  xen/swiotlb: fix condition for calling xen_destroy_contiguous_region()
  nbd: replace kill_bdev() with __invalidate_device() again
  arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
  arm64: compat: Allow single-byte watchpoints on all addresses
  drivers/perf: arm_pmu: Fix failure path in PM notifier
  parisc: Fix build of compressed kernel even with debug enabled
  cgroup: kselftest: relax fs_spec checks
  s390/dasd: fix endless loop after read unit address configuration
  mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker
  ALSA: hda: Fix 1-minute detection delay when i915 module is not available
  selinux: fix memory leak in policydb_init()
  mtd: rawnand: micron: handle on-die "ECC-off" devices correctly
  IB/hfi1: Fix Spectre v1 vulnerability
  gpiolib: fix incorrect IRQ requesting of an active-low lineevent
  mmc: meson-mx-sdio: Fix misuse of GENMASK macro
  mmc: dw_mmc: Fix occasional hang after tuning on eMMC
  Btrfs: fix race leading to fs corruption after transaction abort
  Btrfs: fix incremental send failure after deduplication
  kbuild: initialize CLANG_FLAGS correctly in the top Makefile
  kconfig: Clear "written" flag to avoid data loss
  drm/nouveau: fix memory leak in nouveau_conn_reset()
  x86, boot: Remove multiple copy of static function sanitize_boot_params()
  x86/paravirt: Fix callee-saved function ELF sizes
  x86/kvm: Don't call kvm_spurious_fault() from .fixup
  xen/pv: Fix a boot up hang revealed by int3 self test
  mlxsw: spectrum_dcb: Configure DSCP map as the last rule is removed
  ipc/mqueue.c: only perform resource calculation if user valid
  drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings
  uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers
  coda: fix build using bare-metal toolchain
  coda: add error handling for fget
  lib/test_string.c: avoid masking memset16/32/64 failures
  lib/test_overflow.c: avoid tainting the kernel and fix wrap size
  mm/cma.c: fail if fixed declaration can't be honored
  x86: math-emu: Hide clang warnings for 16-bit overflow
  x86/apic: Silence -Wtype-limits compiler warnings
  be2net: Signal that the device cannot transmit during reconfiguration
  ACPI: fix false-positive -Wuninitialized warning
  x86: kvm: avoid constant-conversion warning
  perf version: Fix segfault due to missing OPT_END()
  scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized
  ACPI: blacklist: fix clang warning for unused DMI table
  ceph: return -ERANGE if virtual xattr value didn't fit in buffer
  ceph: fix improper use of smp_mb__before_atomic()
  cifs: Fix a race condition with cifs_echo_request
  btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit()
  btrfs: fix minimum number of chunk errors for DUP
  clk: sprd: Add check for return value of sprd_clk_regmap_init()
  fs/adfs: super: fix use-after-free bug
  clk: tegra210: fix PLLU and PLLU_OUT1
  dmaengine: rcar-dmac: Reject zero-length slave DMA requests
  MIPS: lantiq: Fix bitfield masking
  firmware/psci: psci_checker: Park kthreads before stopping them
  kernel/module.c: Only return -EEXIST for modules that have finished loading
  arm64: dts: rockchip: fix isp iommu clocks and power domain
  dmaengine: tegra-apb: Error out if DMA_PREP_INTERRUPT flag is unset
  ftrace: Enable trampoline when rec count returns back to one
  ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend
  ARM: dts: rockchip: Make rk3288-veyron-mickey's emmc work again
  ARM: dts: rockchip: Make rk3288-veyron-minnie run at hs200
  ARM: riscpc: fix DMA
  UPSTREAM: net-ipv6-ndisc: add support for RFC7710 RA Captive Portal Identifier

Change-Id: I8be34f8ee12a7ddc6b14a0d121f53c4b4315c377
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-08-14 04:55:04 -07:00
c4aaceec07 Merge "Merge android-4.19.58 (5ad6eeb) into msm-4.19" 2019-08-13 19:10:22 -07:00
a71cb5b9bd Merge android-4.19.62 (f232ce6) into msm-4.19
* refs/heads/tmp-f232ce6:
  Linux 4.19.62
  net: sched: verify that q!=NULL before setting q->flags
  mm: vmscan: scan anonymous pages on file refaults
  KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested
  KVM: nVMX: do not use dangling shadow VMCS after guest reset
  ext4: allow directory holes
  ext4: use jbd2_inode dirty range scoping
  jbd2: introduce jbd2_inode dirty range scoping
  mm: add filemap_fdatawait_range_keep_errors()
  ext4: enforce the immutable flag on open files
  ext4: don't allow any modifications to an immutable file
  perf/core: Fix race between close() and fork()
  perf/core: Fix exclusive events' grouping
  MIPS: lb60: Fix pin mappings
  gpio: davinci: silence error prints in case of EPROBE_DEFER
  dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc
  dma-buf: balance refcount inbalance
  net: bridge: stp: don't cache eth dest pointer before skb pull
  net: bridge: don't cache ether dest pointer on input
  net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
  net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
  sctp: not bind the socket in sctp_connect
  net/tls: make sure offload also gets the keys wiped
  net_sched: unset TCQ_F_CAN_BYPASS when adding filters
  netrom: hold sock when setting skb->destructor
  netrom: fix a memory leak in nr_rx_frame()
  macsec: fix checksumming after decryption
  macsec: fix use-after-free of skb during RX
  net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn
  vrf: make sure skb->data contains ip header to make routing
  tcp: Reset bytes_acked and bytes_received when disconnecting
  tcp: fix tcp_set_congestion_control() use from bpf hook
  tcp: be more careful in tcp_fragment()
  sky2: Disable MSI on ASUS P6T
  sctp: fix error handling on stream scheduler initialization
  rxrpc: Fix send on a connected, but unbound socket
  r8169: fix issue with confused RX unit after PHY power-down on RTL8411b
  nfc: fix potential illegal memory access
  net: stmmac: Re-work the queue selection for TSO packets
  net: phy: sfp: hwmon: Fix scaling of RX power
  net: openvswitch: fix csum updates for MPLS actions
  net: neigh: fix multiple neigh timer scheduling
  net: make skb_dst_force return true when dst is refcounted
  net: dsa: mv88e6xxx: wait after reset deactivation
  net: bcmgenet: use promisc for unsupported filters
  ipv6: Unlink sibling route in case of failure
  ipv6: rt6_check should return NULL if 'from' is NULL
  ipv4: don't set IPv6 only flags to IPv4 addresses
  igmp: fix memory leak in igmpv3_del_delrec()
  hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback()
  caif-hsi: fix possible deadlock in cfhsi_exit_module()
  bnx2x: Prevent load reordering in tx completion processing
  ANDROID: xfrm: remove in_compat_syscall() checks
  ANDROID: enable CONFIG_RTC_DRV_TEST on cuttlefish

Conflicts:
	kernel/events/core.c

Change-Id: Id501b344a427f6daab82039b9922e8e69d660feb
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-08-13 01:20:35 -07:00
e369d405c1 Merge android-4.19.61 (71ce27c) into msm-4.19
* refs/heads/tmp-71ce27c:
  Revert "dt-bindings: allow up to four clocks for orion-mdio"
  Linux 4.19.61
  dm bufio: fix deadlock with loop device
  dt-bindings: allow up to four clocks for orion-mdio
  net: mvmdio: allow up to four clocks to be specified for orion-mdio
  blkcg: update blkcg_print_stat() to handle larger outputs
  blk-iolatency: clear use_delay when io.latency is set to zero
  blk-throttle: fix zero wait time for iops throttled group
  usb: Handle USB3 remote wakeup for LPM enabled devices correctly
  Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
  intel_th: msu: Fix single mode with disabled IOMMU
  mtd: spinand: read returns badly if the last page has bitflips
  mtd: rawnand: mtk: Correct low level time calculation of r/w cycle
  eCryptfs: fix a couple type promotion bugs
  mmc: sdhci-msm: fix mutex while in spinlock
  powerpc/pseries: Fix oops in hotplug memory notifier
  powerpc/powernv/npu: Fix reference leak
  powerpc/watchpoint: Restore NV GPRs while returning from exception
  powerpc/32s: fix suspend/resume when IBATs 4-7 are used
  parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
  parisc: Ensure userspace privilege for ptraced processes in regset functions
  crypto: caam - limit output IV to CBC to work around CTR mode DMA issue
  gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
  xfs: abort unaligned nowait directio early
  xfs: serialize unaligned dio writes against all other dio writes
  xfs: fix reporting supported extra file attributes for statx()
  xfs: reserve blocks for ifree transaction during log recovery
  xfs: don't ever put nlink > 0 inodes on the unlinked list
  xfs: rename m_inotbt_nores to m_finobt_nores
  xfs: don't overflow xattr listent buffer
  xfs: flush removing page cache in xfs_reflink_remap_prep
  xfs: fix pagecache truncation prior to reflink
  include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures
  coda: pass the host file in vma->vm_file on mmap
  libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields
  HID: wacom: correct touch resolution x/y typo
  HID: wacom: generic: Correct pad syncing
  HID: wacom: generic: only switch the mode on devices with LEDs
  IB/mlx5: Report correctly tag matching rendezvous capability
  Btrfs: add missing inode version, ctime and mtime updates when punching hole
  Btrfs: fix fsync not persisting dentry deletions due to inode evictions
  Btrfs: fix data loss after inode eviction, renaming it, and fsync it
  PCI: qcom: Ensure that PERST is asserted for at least 100 ms
  PCI: Do not poll for PME if the device is in D3cold
  PCI: hv: Fix a use-after-free bug in hv_eject_device_work()
  intel_th: pci: Add Ice Lake NNPI support
  drm/edid: parse CEA blocks embedded in DisplayID
  perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs
  perf/x86/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs
  perf/x86/intel: Fix spurious NMI on fixed counter
  x86/boot: Fix memory leak in default_get_smp_config()
  9p/virtio: Add cleanup path in p9_virtio_init
  9p/xen: Add cleanup path in p9_trans_xen_init
  xen/events: fix binding user event channels to cpus
  dm zoned: fix zone state management race
  padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
  drm/nouveau/i2c: Enable i2c pads & busses during preinit
  kconfig: fix missing choice values in auto.conf
  fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.
  arm64: tegra: Fix AGIC register range
  KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
  media: videobuf2-dma-sg: Prevent size from overflowing
  media: videobuf2-core: Prevent size alignment wrapping buffer size to 0
  media: coda: Remove unbalanced and unneeded mutex unlock
  media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
  ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
  ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform
  ALSA: seq: Break too long mutex context in the write loop
  raid5-cache: Need to do start() part job after adding journal device
  ASoC: dapm: Adapt for debugfs API change
  lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
  pnfs: Fix a problem where we gratuitously start doing I/O through the MDS
  pNFS: Fix a typo in pnfs_update_layout
  pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error
  NFSv4: Handle the special Linux file open access mode
  iwlwifi: fix RF-Kill interrupt while FW load for gen2 devices
  iwlwifi: don't WARN when calling iwl_get_shared_mem_conf with RF-Kill
  iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X
  iwlwifi: pcie: don't service an interrupt that was masked
  arm64: tegra: Update Jetson TX1 GPU regulator timings
  regulator: s2mps11: Fix buck7 and buck8 wrong voltages
  Input: alps - fix a mismatch between a condition check and its comment
  Input: synaptics - whitelist Lenovo T580 SMBus intertouch
  Input: alps - don't handle ALPS cs19 trackpoint-only device
  Input: gtco - bounds check collection indent level
  bcache: destroy dc->writeback_write_wq if failed to create dc->writeback_thread
  bcache: fix mistaken sysfs entry for io_error counter
  bcache: ignore read-ahead request failure on backing device
  bcache: Revert "bcache: free heap cache_set->flush_btree in bch_journal_free"
  bcache: Revert "bcache: fix high CPU occupancy during journal"
  Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()"
  crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe
  crypto: ccp/gcm - use const time tag comparison.
  crypto: ccp - memset structure fields to zero before reuse
  crypto: crypto4xx - block ciphers should only accept complete blocks
  crypto: crypto4xx - fix blocksize for cfb and ofb
  crypto: crypto4xx - fix AES CTR blocksize value
  crypto: chacha20poly1305 - fix atomic sleep when using async algorithm
  crypto: arm64/sha2-ce - correct digest for empty data in finup
  crypto: arm64/sha1-ce - correct digest for empty data in finup
  crypto: ccp - Validate the the error value used to index error messages
  crypto: ghash - fix unaligned memory access in ghash_setkey()
  scsi: mac_scsi: Fix pseudo DMA implementation, take 2
  scsi: mac_scsi: Increase PIO/PDMA transfer length threshold
  scsi: megaraid_sas: Fix calculation of target ID
  scsi: core: Fix race on creating sense cache
  Revert "scsi: ncr5380: Increase register polling limit"
  scsi: NCR5380: Always re-enable reselection interrupt
  scsi: NCR5380: Reduce goto statements in NCR5380_select()
  xen: let alloc_xenballooned_pages() fail if not enough memory free
  floppy: fix out-of-bounds read in copy_buffer
  floppy: fix invalid pointer dereference in drive_name
  floppy: fix out-of-bounds read in next_valid_format
  floppy: fix div-by-zero in setup_format_params
  iavf: fix dereference of null rx_buffer pointer
  net: mvmdio: defer probe of orion-mdio if a clock is not ready
  gtp: fix use-after-free in gtp_newlink()
  gtp: fix use-after-free in gtp_encap_destroy()
  gtp: fix Illegal context switch in RCU read-side critical section.
  gtp: fix suspicious RCU usage
  Bluetooth: validate BLE connection interval updates
  gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()
  Bluetooth: Check state in l2cap_disconnect_rsp
  perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64
  Bluetooth: 6lowpan: search for destination address in all peers
  Bluetooth: Add new 13d3:3501 QCA_ROME device
  Bluetooth: Add new 13d3:3491 QCA_ROME device
  Bluetooth: hci_bcsp: Fix memory leak in rx_skb
  tools: bpftool: Fix json dump crash on powerpc
  gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants
  bonding: validate ip header before check IPPROTO_IGMP
  selftests: bpf: fix inlines in test_lwt_seg6local
  bpf, libbpf, smatch: Fix potential NULL pointer dereference
  rxrpc: Fix oops in tracepoint
  net: usb: asix: init MAC address buffers
  bnx2x: Prevent ptp_task to be rescheduled indefinitely
  perf stat: Fix group lookup for metric group
  perf stat: Make metric event lookup more robust
  bpf: fix uapi bpf_prog_info fields alignment
  iwlwifi: mvm: Drop large non sta frames
  igb: clear out skb->tstamp after reading the txtime
  net: mvpp2: prs: Don't override the sign bit in SRAM parser shift
  ath10k: destroy sdio workqueue while remove sdio module
  net: hns3: add some error checking in hclge_tm module
  net: hns3: fix a -Wformat-nonliteral compile warning
  bcache: fix potential deadlock in cached_def_free()
  bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
  bcache: acquire bch_register_lock later in cached_dev_free()
  bcache: check CACHE_SET_IO_DISABLE bit in bch_journal()
  bcache: check CACHE_SET_IO_DISABLE in allocator code
  EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
  wil6210: drop old event after wmi_call timeout
  crypto: asymmetric_keys - select CRYPTO_HASH where needed
  crypto: serpent - mark __serpent_setkey_sbox noinline
  ixgbe: Check DDM existence in transceiver before access
  rslib: Fix handling of of caller provided syndrome
  rslib: Fix decoding of shortened codes
  xsk: Properly terminate assignment in xskq_produce_flush_desc
  clocksource/drivers/exynos_mct: Increase priority over ARM arch timer
  libata: don't request sense data on !ZAC ATA devices
  ASoC: Intel: hdac_hdmi: Set ops to NULL on remove
  perf tools: Increase MAX_NR_CPUS and MAX_CACHES
  ath10k: fix PCIE device wake up failed
  ath10k: add missing error handling
  ipvs: fix tinfo memory leak in start_sync_thread
  mt7601u: fix possible memory leak when the device is disconnected
  x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
  mt7601u: do not schedule rx_tasklet when the device has been disconnected
  rtlwifi: rtl8192cu: fix error handle when usb probe failed
  net: stmmac: sun8i: force select external PHY when no internal one
  media: hdpvr: fix locking and a missing msleep
  media: vimc: cap: check v4l2_fill_pixfmt return value
  media: coda: increment sequence offset for the last returned frame
  media: coda: fix last buffer handling in V4L2_ENC_CMD_STOP
  media: coda: fix mpeg2 sequence number handling
  acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
  timer_list: Guard procfs specific code
  ntp: Limit TAI-UTC offset
  media: i2c: fix warning same module names
  media: s5p-mfc: Make additional clocks optional
  ipvs: defer hook registration to avoid leaks
  ipsec: select crypto ciphers for xfrm_algo
  arm64: Do not enable IRQs for ct_user_exit
  lightnvm: pblk: fix freeing of merged pages
  nvme-pci: set the errno on ctrl state change error
  nvme-pci: properly report state change failure in nvme_reset_work
  nvme: fix possible io failures when removing multipathed ns
  EDAC/sysfs: Fix memory leak when creating a csrow object
  ACPICA: Clear status of GPEs on first direct enable
  blk-iolatency: only account submitted bios
  x86/cacheinfo: Fix a -Wtype-limits warning
  ipoib: correcly show a VF hardware address
  vhost_net: disable zerocopy by default
  perf evsel: Make perf_evsel__name() accept a NULL argument
  x86/atomic: Fix smp_mb__{before,after}_atomic()
  perf/x86/intel/uncore: Handle invalid event coding for free-running counter
  sched/fair: Fix "runnable_avg_yN_inv" not used warnings
  sched/core: Add __sched tag for io_schedule()
  xfrm: fix sa selector validation
  blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration
  block: null_blk: fix race condition for null_del_dev
  net: hns3: fix for skb leak when doing selftest
  qed: iWARP - Fix tc for MPA ll2 connection
  x86/cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS
  rcu: Force inlining of rcu_read_lock()
  ASoC: meson: axg-tdm: fix sample clock inversion
  x86/cpu: Add Ice Lake NNPI to Intel family
  selinux: fix empty write to keycreate file
  media: s5p-mfc: fix reading min scratch buffer size on MFC v6/v7
  bpf: silence warning messages in core
  regmap: fix bulk writes on paged registers
  gpio: omap: ensure irq is enabled before wakeup
  gpio: omap: fix lack of irqstatus_raw0 for OMAP4
  iommu: Fix a leak in iommu_insert_resv_region
  media: fdp1: Support M3N and E3 platforms
  media: uvcvideo: Fix access to uninitialized fields on probe error
  irqchip/meson-gpio: Add support for Meson-G12A SoC
  perf report: Fix OOM error in TUI mode on s390
  perf test 6: Fix missing kvm module load for s390
  perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode
  ipset: Fix memory accounting for hash types on resize
  net: sfp: add mutex to prevent concurrent state checks
  RAS/CEC: Fix pfn insertion
  s390/qdio: handle PENDING state for QEBSM devices
  net: axienet: Fix race condition causing TX hang
  net: fec: Do not use netdev messages too early
  crypto: inside-secure - do not rely on the hardware last bit for result descriptors
  net: stmmac: modify default value of tx-frames
  net: stmmac: dwmac4: fix flow control issue
  perf jvmti: Address gcc string overflow warning for strncpy()
  arm64: mm: make CONFIG_ZONE_DMA32 configurable
  cpupower : frequency-set -r option misses the last cpu in related cpu list
  net: hns3: set ops to null when unregister ad_dev
  media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
  locking/lockdep: Fix merging of hlocks with non-zero references
  batman-adv: Fix duplicated OGMs on NETDEV_UP
  tua6100: Avoid build warnings.
  crypto: talitos - Align SEC1 accesses to 32 bits boundaries.
  crypto: talitos - properly handle split ICV.
  net: phy: Check against net_device being NULL
  media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
  media: saa7164: fix remove_proc_entry warning
  media: mc-device.c: don't memset __user pointer contents
  perf annotate TUI browser: Do not use member from variable within its own initialization
  fscrypt: clean up some BUG_ON()s in block encryption/decryption
  xfrm: Fix xfrm sel prefix length validation
  af_key: fix leaks in key_pol_get_resp and dump_sp.
  signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
  qed: Set the doorbell address correctly
  net: stmmac: dwmac4/5: Clear unused address entries
  net: stmmac: dwmac1000: Clear unused address entries
  media: media_device_enum_links32: clean a reserved field
  media: vpss: fix a potential NULL pointer dereference
  media: marvell-ccic: fix DMA s/g desc number calculation
  media: ov7740: avoid invalid framesize setting
  crypto: talitos - fix skcipher failure due to wrong output IV
  media: spi: IR LED: add missing of table registration
  media: dvb: usb: fix use after free in dvb_usb_device_exit
  batman-adv: fix for leaked TVLV handler.
  regmap: debugfs: Fix memory leak in regmap_debugfs_init
  ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
  wil6210: fix spurious interrupts in 3-msi
  ath10k: add peer id check in ath10k_peer_find_by_id
  ath6kl: add some bounds checking
  ath9k: Check for errors when reading SREV register
  ath10k: Do not send probe response template for mesh
  wil6210: fix potential out-of-bounds read
  dmaengine: imx-sdma: fix use-after-free on probe error path
  scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported
  arm64/efi: Mark __efistub_stext_offset as an absolute symbol explicitly
  MIPS: fix build on non-linux hosts
  MIPS: ath79: fix ar933x uart parity mode
  ANDROID: arm64: fix function types in COND_SYSCALL
  ANDROID: x86: fix function types in COND_SYSCALL
  ANDROID: kernel/Makefile: do not disable LTO for sys_ni.c with CFI
  UPSTREAM: binder: Set end of SG buffer area properly.

Conflicts:
	arch/arm64/Kconfig
	arch/x86/include/asm/syscall_wrapper.h
	drivers/mmc/host/sdhci-msm.c

Change-Id: If28d1c397b31023c16a571e0fe33682fe65759db
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-08-13 01:20:20 -07:00
857a9095a1 Merge android-4.19.59 (0f653d9) into msm-4.19
* refs/heads/tmp-0f653d9:
  Revert "dt-bindings: can: mcp251x: add mcp25625 support"
  Linux 4.19.59
  staging: rtl8712: reduce stack usage, again
  staging: bcm2835-camera: Handle empty EOS buffers whilst streaming
  staging: bcm2835-camera: Remove check of the number of buffers supplied
  staging: bcm2835-camera: Ensure all buffers are returned on disable
  staging: bcm2835-camera: Replace spinlock protecting context_map with mutex
  staging: fsl-dpaa2/ethsw: fix memory leak of switchdev_work
  MIPS: Remove superfluous check for __linux__
  VMCI: Fix integer overflow in VMCI handle arrays
  carl9170: fix misuse of device driver API
  binder: fix memory leak in error path
  lkdtm: support llvm-objcopy
  HID: Add another Primax PIXART OEM mouse quirk
  staging: comedi: amplc_pci230: fix null pointer deref on interrupt
  staging: comedi: dt282x: fix a null pointer deref on interrupt
  drivers/usb/typec/tps6598x.c: fix 4CC cmd write
  drivers/usb/typec/tps6598x.c: fix portinfo width
  usb: renesas_usbhs: add a workaround for a race condition of workqueue
  usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset()
  usb: gadget: ether: Fix race between gether_disconnect and rx_submit
  p54usb: Fix race between disconnect and firmware loading
  Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
  USB: serial: option: add support for GosunCn ME3630 RNDIS mode
  USB: serial: ftdi_sio: add ID for isodebug v1
  mwifiex: Don't abort on small, spec-compliant vendor IEs
  mwifiex: Abort at too short BSS descriptor element
  Documentation/admin: Remove the vsyscall=native documentation
  Documentation: Add section about CPU vulnerabilities for Spectre
  x86/tls: Fix possible spectre-v1 in do_get_thread_area()
  x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
  perf pmu: Fix uncore PMU alias list for ARM64
  block, bfq: NULL out the bic when it's no longer valid
  ALSA: hda/realtek - Headphone Mic can't record after S3
  ALSA: usb-audio: Fix parse of UAC2 Extension Units
  media: stv0297: fix frequency range limit
  udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
  fscrypt: don't set policy for a dead directory
  net :sunrpc :clnt :Fix xps refcount imbalance on the error path
  NFS4: Only set creation opendata if O_CREAT
  net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge()
  quota: fix a problem about transfer quota
  scsi: qedi: Check targetname while finding boot target information
  net: lio_core: fix potential sign-extension overflow on large shift
  ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
  drm: return -EFAULT if copy_to_user() fails
  bnx2x: Check if transceiver implements DDM before access
  md: fix for divide error in status_resync
  mmc: core: complete HS400 before checking status
  qmi_wwan: extend permitted QMAP mux_id value range
  qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode
  qmi_wwan: add support for QMAP padding in the RX path
  bpf, x64: fix stack layout of JITed bpf code
  bpf, devmap: Add missing RCU read lock on flush
  bpf, devmap: Add missing bulk queue free
  bpf, devmap: Fix premature entry free on destroying map
  mac80211: do not start any work during reconfigure flow
  mac80211: only warn once on chanctx_conf being NULL
  ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
  ARM: davinci: da850-evm: call regulator_has_full_constraints()
  mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed
  KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy
  Input: imx_keypad - make sure keyboard can always wake up system
  riscv: Fix udelay in RV32.
  drm/vmwgfx: fix a warning due to missing dma_parms
  drm/vmwgfx: Honor the sg list segment size limitation
  s390/boot: disable address-of-packed-member warning
  ARM: dts: am335x phytec boards: Fix cd-gpios active level
  ibmvnic: Fix unchecked return codes of memory allocations
  ibmvnic: Refresh device multicast list after reset
  ibmvnic: Do not close unopened driver during reset
  net: phy: rename Asix Electronics PHY driver
  can: af_can: Fix error path of can_init()
  can: m_can: implement errata "Needless activation of MRAF irq"
  can: mcp251x: add support for mcp25625
  dt-bindings: can: mcp251x: add mcp25625 support
  soundwire: intel: set dai min and max channels correctly
  mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
  iwlwifi: Fix double-free problems in iwl_req_fw_callback()
  mwifiex: Fix possible buffer overflows at parsing bss descriptor
  mac80211: free peer keys before vif down in mesh
  mac80211: mesh: fix RCU warning
  staging:iio:ad7150: fix threshold mode config bit
  soundwire: stream: fix out of boundary access on port properties
  bpf: sockmap, fix use after free from sleep in psock backlog workqueue
  mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he()
  samples, bpf: suppress compiler warning
  samples, bpf: fix to change the buffer size for read()
  Input: elantech - enable middle button support on 2 ThinkPads
  soc: bcm: brcmstb: biuctrl: Register writes require a barrier
  soc: brcmstb: Fix error path for unsupported CPUs
  crypto: talitos - rename alternative AEAD algos.

Conflicts:
	drivers/mmc/core/mmc.c

Change-Id: I74e5063a4119ad000d89f7a87c683aa5531145f5
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-08-13 01:19:56 -07:00
053efa6d4c Merge android-4.19.58 (5ad6eeb) into msm-4.19
* refs/heads/tmp-5ad6eeb:
  Linux 4.19.58
  dmaengine: imx-sdma: remove BD_INTR for channel0
  dmaengine: qcom: bam_dma: Fix completed descriptors count
  MIPS: have "plain" make calls build dtbs for selected platforms
  MIPS: Add missing EHB in mtc0 -> mfc0 sequence.
  MIPS: Fix bounds check virt_addr_valid
  svcrdma: Ignore source port when computing DRC hash
  nfsd: Fix overflow causing non-working mounts on 1 TB machines
  KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC
  KVM: x86: degrade WARN to pr_warn_ratelimited
  netfilter: ipv6: nf_defrag: accept duplicate fragments again
  bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K
  net: hns: fix unsigned comparison to less than zero
  sc16is7xx: move label 'err_spi' to correct section
  netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
  ip6: fix skb leak in ip6frag_expire_frag_queue()
  rds: Fix warning.
  ALSA: hda: Initialize power_state field properly
  net: hns: Fixes the missing put_device in positive leg for roce reset
  x86/boot/compressed/64: Do not corrupt EDX on EFER.LME=1 setting
  selftests: fib_rule_tests: Fix icmp proto with ipv6
  scsi: tcmu: fix use after free
  mac80211: mesh: fix missing unlock on error in table_path_del()
  f2fs: don't access node/meta inode mapping after iput
  drm/fb-helper: generic: Don't take module ref for fbcon
  media: s5p-mfc: fix incorrect bus assignment in virtual child device
  net/smc: move unhash before release of clcsock
  mlxsw: spectrum: Handle VLAN device unlinking
  tty: rocket: fix incorrect forward declaration of 'rp_init()'
  btrfs: Ensure replaced device doesn't have pending chunk allocation
  mm/vmscan.c: prevent useless kswapd loops
  ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code()
  drm/imx: only send event on crtc disable if kept disabled
  drm/imx: notify drm core before sending event during crtc disable
  drm/etnaviv: add missing failure path to destroy suballoc
  drm/amdgpu/gfx9: use reset default for PA_SC_FIFO_SIZE
  drm/amd/powerplay: use hardware fan control if no powerplay fan table
  arm64: kaslr: keep modules inside module region when KASAN is enabled
  ARM: dts: armada-xp-98dx3236: Switch to armada-38x-uart serial node
  tracing/snapshot: Resize spare buffer if size changed
  fs/userfaultfd.c: disable irqs for fault_pending and event locks
  lib/mpi: Fix karactx leak in mpi_powm
  ALSA: hda/realtek - Change front mic location for Lenovo M710q
  ALSA: hda/realtek: Add quirks for several Clevo notebook barebones
  ALSA: usb-audio: fix sign unintended sign extension on left shifts
  ALSA: line6: Fix write on zero-sized buffer
  ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
  ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
  crypto: cryptd - Fix skcipher instance memory leak
  crypto: user - prevent operating on larval algorithms
  ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
  drm/i915/dmc: protect against reading random memory
  ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper()
  module: Fix livepatch/ftrace module text permissions race
  tracing: avoid build warning with HAVE_NOP_MCOUNT
  mm/mlock.c: change count_mm_mlocked_page_nr return type
  scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE
  cpuset: restore sanity to cpuset_cpus_allowed_fallback()
  i2c: pca-platform: Fix GPIO lookup code
  platform/mellanox: mlxreg-hotplug: Add devm_free_irq call to remove flow
  platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device registration
  platform/x86: intel-vbtn: Report switch events when event wakes device
  platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi
  drm: panel-orientation-quirks: Add quirk for GPD MicroPC
  drm: panel-orientation-quirks: Add quirk for GPD pocket2
  scsi: hpsa: correct ioaccel2 chaining
  SoC: rt274: Fix internal jack assignment in set_jack callback
  ALSA: hdac: fix memory release for SST and SOF drivers
  usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
  usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
  x86/CPU: Add more Icelake model numbers
  ASoC: sun4i-i2s: Add offset to RX channel select
  ASoC: sun4i-i2s: Fix sun8i tx channel offset mask
  ASoC: max98090: remove 24-bit format support if RJ is 0
  drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable()
  drm/mediatek: clear num_pipes when unbind driver
  drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver
  drm/mediatek: unbind components in mtk_drm_unbind()
  drm/mediatek: fix unbind functions
  spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
  ASoC: ak4458: rstn_control - return a non-zero on error only
  ASoC: soc-pcm: BE dai needs prepare when pause release after resume
  ASoC: ak4458: add return value for ak4458_probe
  ASoC : cs4265 : readable register too low
  netfilter: nft_flow_offload: IPCB is only valid for ipv4 family
  netfilter: nft_flow_offload: don't offload when sequence numbers need adjustment
  netfilter: nft_flow_offload: set liberal tracking mode for tcp
  netfilter: nf_flow_table: ignore DF bit setting
  md/raid0: Do not bypass blocking queue entered for raid0 bios
  block: Fix a NULL pointer dereference in generic_make_request()
  Bluetooth: Fix faulty expression for minimum encryption key size check

Change-Id: I42f3ee04258a2392be42269d05d99dc0b02a9feb
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-08-13 01:19:52 -07:00
09e52c3c98 Merge android-4.19.57 (5b2dde5) into msm-4.19
* refs/heads/tmp-5b2dde5:
  Revert "Revert "usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup""
  Revert "usb: dwc3: gadget: combine unaligned and zero flags"
  Revert "usb: dwc3: gadget: track number of TRBs per request"
  Revert "usb: dwc3: gadget: use num_trbs when skipping TRBs on ->dequeue()"
  Revert "usb: dwc3: gadget: extract dwc3_gadget_ep_skip_trbs()"
  Revert "usb: dwc3: gadget: introduce cancelled_list"
  Revert "usb: dwc3: gadget: move requests to cancelled_list"
  Revert "usb: dwc3: gadget: remove wait_end_transfer"
  Revert "usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup"
  Revert "usb: dwc3: Reset num_trbs after skipping"
  Linux 4.19.57
  arm64: insn: Fix ldadd instruction encoding
  usb: dwc3: Reset num_trbs after skipping
  tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb
  RDMA: Directly cast the sockaddr union to sockaddr
  futex: Update comments and docs about return values of arch futex code
  bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd
  arm64: futex: Avoid copying out uninitialised stack in failed cmpxchg()
  bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err
  bpf: udp: Avoid calling reuseport's bpf_prog from udp_gro
  bpf: fix unconnected udp hooks
  bpf: fix nested bpf tracepoints with per-cpu data
  bpf: lpm_trie: check left child of last leftmost node for NULL
  bpf: simplify definition of BPF_FIB_LOOKUP related flags
  tun: wake up waitqueues after IFF_UP is set
  tipc: check msg->req data len in tipc_nl_compat_bearer_disable
  tipc: change to use register_pernet_device
  team: Always enable vlan tx offload
  sctp: change to hold sk after auth shkey is created successfully
  net: stmmac: set IC bit when transmitting frames with HW timestamp
  net: stmmac: fixed new system time seconds value calculation
  net: remove duplicate fetch in sock_getsockopt
  net/packet: fix memory leak in packet_set_ring()
  ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
  bonding: Always enable vlan tx offload
  af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET
  eeprom: at24: fix unexpected timeout under high load
  irqchip/mips-gic: Use the correct local interrupt map registers
  SUNRPC: Clean up initialisation of the struct rpc_rqst
  cpu/speculation: Warn on unsupported mitigations= parameter
  NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O
  KVM: x86/mmu: Allocate PAE root array when using SVM's 32-bit NPT
  x86/resctrl: Prevent possible overrun during bitmap operations
  x86/microcode: Fix the microcode load on CPU hotplug for real
  x86/speculation: Allow guests to use SSBD even if host does not
  scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
  dm log writes: make sure super sector log updates are written in order
  mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
  mm: hugetlb: soft-offline: dissolve_free_huge_page() return zero on !PageHuge
  mm: soft-offline: return -EBUSY if set_hwpoison_free_buddy_page() fails
  clk: socfpga: stratix10: fix divider entry for the emac clocks
  fs/binfmt_flat.c: make load_flat_shared_library() work
  mm/mempolicy.c: fix an incorrect rebind node in mpol_rebind_nodemask
  fs/proc/array.c: allow reporting eip/esp for all coredumping threads
  usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup
  usb: dwc3: gadget: remove wait_end_transfer
  usb: dwc3: gadget: move requests to cancelled_list
  usb: dwc3: gadget: introduce cancelled_list
  usb: dwc3: gadget: extract dwc3_gadget_ep_skip_trbs()
  usb: dwc3: gadget: use num_trbs when skipping TRBs on ->dequeue()
  usb: dwc3: gadget: track number of TRBs per request
  usb: dwc3: gadget: combine unaligned and zero flags
  Revert "usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup"
  qmi_wwan: Fix out-of-bounds read
  net/9p: include trans_common.h to fix missing prototype warning.
  9p/trans_fd: put worker reqs on destroy
  9p/trans_fd: abort p9_read_work if req status changed
  9p: potential NULL dereference
  9p: p9dirent_read: check network-provided name length
  9p/rdma: remove useless check in cm_event_handler
  9p: acl: fix uninitialized iattr access
  9p: Rename req to rreq in trans_fd
  9p/rdma: do not disconnect on down_interruptible EAGAIN
  9p: Add refcount to p9_req_t
  9p: rename p9_free_req() function
  9p: add a per-client fcall kmem_cache
  9p: embed fcall in req to round down buffer allocs
  9p: Use a slab for allocating requests
  9p/xen: fix check for xenbus_read error in front_probe
  IB/hfi1: Close PSM sdma_progress sleep window
  Revert "x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP"
  arm64: Don't unconditionally add -Wno-psabi to KBUILD_CFLAGS
  perf header: Fix unchecked usage of strncpy()
  perf help: Remove needless use of strncpy()
  perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul
  ANDROID: drivers/misc: disable LTO for rodata.o

Conflicts:
	arch/arm64/Makefile

Change-Id: Id088f01491976ee9860dba83d2f3bff5ab35189d
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-08-13 00:06:24 -07:00
9842b32732 Merge "Merge android-4.19.56 (e5304c6) into msm-4.19" 2019-08-07 00:09:14 -07:00
4b5eb0d132 UPSTREAM: net-ipv6-ndisc: add support for RFC7710 RA Captive Portal Identifier
This is trivial since we already have support for the entirely
identical (from the kernel's point of view) RDNSS and DNSSL that
also contain opaque data that needs to be passed down to userspace.

As specified in RFC7710, Captive Portal option contains a URL.
8-bit identifier of the option type as assigned by the IANA is 37.
This option should also be treated as userland.

Hence, treat ND option 37 as userland (Captive Portal support)

See:
  https://tools.ietf.org/html/rfc7710
  https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml

Fixes: e35f30c131
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Remin Nguyen Van <reminv@google.com>
Cc: Alexey I. Froloff <raorn@raorn.name>
Signed-off-by: David S. Miller <davem@davemloft.net>

Bug: 137914568
Change-Id: I73c12c45660e6371c1e193f799c0da7d97bd5435
(cherry picked from commit 66b5f1c439843bcbab01cc7f3854ae2742f3d1e3)
2019-08-05 05:26:02 +00:00
f094f0c406 net: ipv4: Remove tcp_default_init_rwnd
This reverts commit 1e9a9ffbbd ("RFC: ANDROID: net: ipv4: tcp:
Namespace-ify sysctl_tcp_default_init_rwnd") and
commit 89e8c70306 ("ANDROID: net: ipv4: tcp: add a sysctl to config
the tcp_default_init_rwnd")

This feature has been deprecated.

CRs-Fixed: 2500636
Change-Id: Ie831694ab897e2b267b8208833f5a2b28c1c2abe
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
2019-08-02 00:42:21 -06:00
7ece8a38da Merge "Merge android-4.19.55 (65f49f0) into msm-4.19" 2019-07-30 19:02:40 -07:00
f3ed73ffbc Merge "Merge android-4.19.48 (01f5de3) into msm-4.19" 2019-07-29 03:54:14 -07:00
42d42e8a03 Merge 4.19.62 into android-4.19-q
Changes in 4.19.62
	bnx2x: Prevent load reordering in tx completion processing
	caif-hsi: fix possible deadlock in cfhsi_exit_module()
	hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback()
	igmp: fix memory leak in igmpv3_del_delrec()
	ipv4: don't set IPv6 only flags to IPv4 addresses
	ipv6: rt6_check should return NULL if 'from' is NULL
	ipv6: Unlink sibling route in case of failure
	net: bcmgenet: use promisc for unsupported filters
	net: dsa: mv88e6xxx: wait after reset deactivation
	net: make skb_dst_force return true when dst is refcounted
	net: neigh: fix multiple neigh timer scheduling
	net: openvswitch: fix csum updates for MPLS actions
	net: phy: sfp: hwmon: Fix scaling of RX power
	net: stmmac: Re-work the queue selection for TSO packets
	nfc: fix potential illegal memory access
	r8169: fix issue with confused RX unit after PHY power-down on RTL8411b
	rxrpc: Fix send on a connected, but unbound socket
	sctp: fix error handling on stream scheduler initialization
	sky2: Disable MSI on ASUS P6T
	tcp: be more careful in tcp_fragment()
	tcp: fix tcp_set_congestion_control() use from bpf hook
	tcp: Reset bytes_acked and bytes_received when disconnecting
	vrf: make sure skb->data contains ip header to make routing
	net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn
	macsec: fix use-after-free of skb during RX
	macsec: fix checksumming after decryption
	netrom: fix a memory leak in nr_rx_frame()
	netrom: hold sock when setting skb->destructor
	net_sched: unset TCQ_F_CAN_BYPASS when adding filters
	net/tls: make sure offload also gets the keys wiped
	sctp: not bind the socket in sctp_connect
	net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
	net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
	net: bridge: don't cache ether dest pointer on input
	net: bridge: stp: don't cache eth dest pointer before skb pull
	dma-buf: balance refcount inbalance
	dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc
	gpio: davinci: silence error prints in case of EPROBE_DEFER
	MIPS: lb60: Fix pin mappings
	perf/core: Fix exclusive events' grouping
	perf/core: Fix race between close() and fork()
	ext4: don't allow any modifications to an immutable file
	ext4: enforce the immutable flag on open files
	mm: add filemap_fdatawait_range_keep_errors()
	jbd2: introduce jbd2_inode dirty range scoping
	ext4: use jbd2_inode dirty range scoping
	ext4: allow directory holes
	KVM: nVMX: do not use dangling shadow VMCS after guest reset
	KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested
	mm: vmscan: scan anonymous pages on file refaults
	net: sched: verify that q!=NULL before setting q->flags
	Linux 4.19.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iffec08285360929d5692c456c451ef423d991719
2019-07-28 08:43:34 +02:00
f232ce65ba Merge 4.19.62 into android-4.19
Changes in 4.19.62
	bnx2x: Prevent load reordering in tx completion processing
	caif-hsi: fix possible deadlock in cfhsi_exit_module()
	hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback()
	igmp: fix memory leak in igmpv3_del_delrec()
	ipv4: don't set IPv6 only flags to IPv4 addresses
	ipv6: rt6_check should return NULL if 'from' is NULL
	ipv6: Unlink sibling route in case of failure
	net: bcmgenet: use promisc for unsupported filters
	net: dsa: mv88e6xxx: wait after reset deactivation
	net: make skb_dst_force return true when dst is refcounted
	net: neigh: fix multiple neigh timer scheduling
	net: openvswitch: fix csum updates for MPLS actions
	net: phy: sfp: hwmon: Fix scaling of RX power
	net: stmmac: Re-work the queue selection for TSO packets
	nfc: fix potential illegal memory access
	r8169: fix issue with confused RX unit after PHY power-down on RTL8411b
	rxrpc: Fix send on a connected, but unbound socket
	sctp: fix error handling on stream scheduler initialization
	sky2: Disable MSI on ASUS P6T
	tcp: be more careful in tcp_fragment()
	tcp: fix tcp_set_congestion_control() use from bpf hook
	tcp: Reset bytes_acked and bytes_received when disconnecting
	vrf: make sure skb->data contains ip header to make routing
	net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn
	macsec: fix use-after-free of skb during RX
	macsec: fix checksumming after decryption
	netrom: fix a memory leak in nr_rx_frame()
	netrom: hold sock when setting skb->destructor
	net_sched: unset TCQ_F_CAN_BYPASS when adding filters
	net/tls: make sure offload also gets the keys wiped
	sctp: not bind the socket in sctp_connect
	net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
	net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
	net: bridge: don't cache ether dest pointer on input
	net: bridge: stp: don't cache eth dest pointer before skb pull
	dma-buf: balance refcount inbalance
	dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc
	gpio: davinci: silence error prints in case of EPROBE_DEFER
	MIPS: lb60: Fix pin mappings
	perf/core: Fix exclusive events' grouping
	perf/core: Fix race between close() and fork()
	ext4: don't allow any modifications to an immutable file
	ext4: enforce the immutable flag on open files
	mm: add filemap_fdatawait_range_keep_errors()
	jbd2: introduce jbd2_inode dirty range scoping
	ext4: use jbd2_inode dirty range scoping
	ext4: allow directory holes
	KVM: nVMX: do not use dangling shadow VMCS after guest reset
	KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested
	mm: vmscan: scan anonymous pages on file refaults
	net: sched: verify that q!=NULL before setting q->flags
	Linux 4.19.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2eb23bda9d5294a5c874fe4f403934fd99e84661
2019-07-28 08:43:04 +02:00
fde351aeff net/tls: make sure offload also gets the keys wiped
[ Upstream commit acd3e96d53a24d219f720ed4012b62723ae05da1 ]

Commit 86029d10af ("tls: zero the crypto information from tls_context
before freeing") added memzero_explicit() calls to clear the key material
before freeing struct tls_context, but it missed tls_device.c has its
own way of freeing this structure. Replace the missing free.

Fixes: 86029d10af ("tls: zero the crypto information from tls_context before freeing")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-28 08:29:27 +02:00
c60f57dfe9 tcp: fix tcp_set_congestion_control() use from bpf hook
[ Upstream commit 8d650cdedaabb33e85e9b7c517c0c71fcecc1de9 ]

Neal reported incorrect use of ns_capable() from bpf hook.

bpf_setsockopt(...TCP_CONGESTION...)
  -> tcp_set_congestion_control()
   -> ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)
    -> ns_capable_common()
     -> current_cred()
      -> rcu_dereference_protected(current->cred, 1)

Accessing 'current' in bpf context makes no sense, since packets
are processed from softirq context.

As Neal stated : The capability check in tcp_set_congestion_control()
was written assuming a system call context, and then was reused from
a BPF call site.

The fix is to add a new parameter to tcp_set_congestion_control(),
so that the ns_capable() call is only performed under the right
context.

Fixes: 91b5b21c7c ("bpf: Add support for changing congestion control")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Lawrence Brakmo <brakmo@fb.com>
Reported-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Lawrence Brakmo <brakmo@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-28 08:29:26 +02:00
6323c238bb tcp: be more careful in tcp_fragment()
[ Upstream commit b617158dc096709d8600c53b6052144d12b89fab ]

Some applications set tiny SO_SNDBUF values and expect
TCP to just work. Recent patches to address CVE-2019-11478
broke them in case of losses, since retransmits might
be prevented.

We should allow these flows to make progress.

This patch allows the first and last skb in retransmit queue
to be split even if memory limits are hit.

It also adds the some room due to the fact that tcp_sendmsg()
and tcp_sendpage() might overshoot sk_wmem_queued by about one full
TSO skb (64KB size). Note this allowance was already present
in stable backports for kernels < 4.15

Note for < 4.15 backports :
 tcp_rtx_queue_tail() will probably look like :

static inline struct sk_buff *tcp_rtx_queue_tail(const struct sock *sk)
{
	struct sk_buff *skb = tcp_send_head(sk);

	return skb ? tcp_write_queue_prev(sk, skb) : tcp_write_queue_tail(sk);
}

Fixes: f070ef2ac667 ("tcp: tcp_fragment() should apply sane memory limits")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrew Prout <aprout@ll.mit.edu>
Tested-by: Andrew Prout <aprout@ll.mit.edu>
Tested-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Tested-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Christoph Paasch <cpaasch@apple.com>
Cc: Jonathan Looney <jtl@netflix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-28 08:29:25 +02:00
832d0ea751 net: make skb_dst_force return true when dst is refcounted
[ Upstream commit b60a77386b1d4868f72f6353d35dabe5fbe981f2 ]

netfilter did not expect that skb_dst_force() can cause skb to lose its
dst entry.

I got a bug report with a skb->dst NULL dereference in netfilter
output path.  The backtrace contains nf_reinject(), so the dst might have
been cleared when skb got queued to userspace.

Other users were fixed via
if (skb_dst(skb)) {
	skb_dst_force(skb);
	if (!skb_dst(skb))
		goto handle_err;
}

But I think its preferable to make the 'dst might be cleared' part
of the function explicit.

In netfilter case, skb with a null dst is expected when queueing in
prerouting hook, so drop skb for the other hooks.

v2:
 v1 of this patch returned true in case skb had no dst entry.
 Eric said:
   Say if we have two skb_dst_force() calls for some reason
   on the same skb, only the first one will return false.

 This now returns false even when skb had no dst, as per Erics
 suggestion, so callers might need to check skb_dst() first before
 skb_dst_force().

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-28 08:29:24 +02:00
92e72d9a99 Merge 4.19.61 into android-4.19-q
Changes in 4.19.61
	MIPS: ath79: fix ar933x uart parity mode
	MIPS: fix build on non-linux hosts
	arm64/efi: Mark __efistub_stext_offset as an absolute symbol explicitly
	scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported
	dmaengine: imx-sdma: fix use-after-free on probe error path
	wil6210: fix potential out-of-bounds read
	ath10k: Do not send probe response template for mesh
	ath9k: Check for errors when reading SREV register
	ath6kl: add some bounds checking
	ath10k: add peer id check in ath10k_peer_find_by_id
	wil6210: fix spurious interrupts in 3-msi
	ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
	regmap: debugfs: Fix memory leak in regmap_debugfs_init
	batman-adv: fix for leaked TVLV handler.
	media: dvb: usb: fix use after free in dvb_usb_device_exit
	media: spi: IR LED: add missing of table registration
	crypto: talitos - fix skcipher failure due to wrong output IV
	media: ov7740: avoid invalid framesize setting
	media: marvell-ccic: fix DMA s/g desc number calculation
	media: vpss: fix a potential NULL pointer dereference
	media: media_device_enum_links32: clean a reserved field
	net: stmmac: dwmac1000: Clear unused address entries
	net: stmmac: dwmac4/5: Clear unused address entries
	qed: Set the doorbell address correctly
	signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
	af_key: fix leaks in key_pol_get_resp and dump_sp.
	xfrm: Fix xfrm sel prefix length validation
	fscrypt: clean up some BUG_ON()s in block encryption/decryption
	perf annotate TUI browser: Do not use member from variable within its own initialization
	media: mc-device.c: don't memset __user pointer contents
	media: saa7164: fix remove_proc_entry warning
	media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
	net: phy: Check against net_device being NULL
	crypto: talitos - properly handle split ICV.
	crypto: talitos - Align SEC1 accesses to 32 bits boundaries.
	tua6100: Avoid build warnings.
	batman-adv: Fix duplicated OGMs on NETDEV_UP
	locking/lockdep: Fix merging of hlocks with non-zero references
	media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
	net: hns3: set ops to null when unregister ad_dev
	cpupower : frequency-set -r option misses the last cpu in related cpu list
	arm64: mm: make CONFIG_ZONE_DMA32 configurable
	perf jvmti: Address gcc string overflow warning for strncpy()
	net: stmmac: dwmac4: fix flow control issue
	net: stmmac: modify default value of tx-frames
	crypto: inside-secure - do not rely on the hardware last bit for result descriptors
	net: fec: Do not use netdev messages too early
	net: axienet: Fix race condition causing TX hang
	s390/qdio: handle PENDING state for QEBSM devices
	RAS/CEC: Fix pfn insertion
	net: sfp: add mutex to prevent concurrent state checks
	ipset: Fix memory accounting for hash types on resize
	perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode
	perf test 6: Fix missing kvm module load for s390
	perf report: Fix OOM error in TUI mode on s390
	irqchip/meson-gpio: Add support for Meson-G12A SoC
	media: uvcvideo: Fix access to uninitialized fields on probe error
	media: fdp1: Support M3N and E3 platforms
	iommu: Fix a leak in iommu_insert_resv_region
	gpio: omap: fix lack of irqstatus_raw0 for OMAP4
	gpio: omap: ensure irq is enabled before wakeup
	regmap: fix bulk writes on paged registers
	bpf: silence warning messages in core
	media: s5p-mfc: fix reading min scratch buffer size on MFC v6/v7
	selinux: fix empty write to keycreate file
	x86/cpu: Add Ice Lake NNPI to Intel family
	ASoC: meson: axg-tdm: fix sample clock inversion
	rcu: Force inlining of rcu_read_lock()
	x86/cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS
	qed: iWARP - Fix tc for MPA ll2 connection
	net: hns3: fix for skb leak when doing selftest
	block: null_blk: fix race condition for null_del_dev
	blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration
	xfrm: fix sa selector validation
	sched/core: Add __sched tag for io_schedule()
	sched/fair: Fix "runnable_avg_yN_inv" not used warnings
	perf/x86/intel/uncore: Handle invalid event coding for free-running counter
	x86/atomic: Fix smp_mb__{before,after}_atomic()
	perf evsel: Make perf_evsel__name() accept a NULL argument
	vhost_net: disable zerocopy by default
	ipoib: correcly show a VF hardware address
	x86/cacheinfo: Fix a -Wtype-limits warning
	blk-iolatency: only account submitted bios
	ACPICA: Clear status of GPEs on first direct enable
	EDAC/sysfs: Fix memory leak when creating a csrow object
	nvme: fix possible io failures when removing multipathed ns
	nvme-pci: properly report state change failure in nvme_reset_work
	nvme-pci: set the errno on ctrl state change error
	lightnvm: pblk: fix freeing of merged pages
	arm64: Do not enable IRQs for ct_user_exit
	ipsec: select crypto ciphers for xfrm_algo
	ipvs: defer hook registration to avoid leaks
	media: s5p-mfc: Make additional clocks optional
	media: i2c: fix warning same module names
	ntp: Limit TAI-UTC offset
	timer_list: Guard procfs specific code
	acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
	media: coda: fix mpeg2 sequence number handling
	media: coda: fix last buffer handling in V4L2_ENC_CMD_STOP
	media: coda: increment sequence offset for the last returned frame
	media: vimc: cap: check v4l2_fill_pixfmt return value
	media: hdpvr: fix locking and a missing msleep
	net: stmmac: sun8i: force select external PHY when no internal one
	rtlwifi: rtl8192cu: fix error handle when usb probe failed
	mt7601u: do not schedule rx_tasklet when the device has been disconnected
	x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
	mt7601u: fix possible memory leak when the device is disconnected
	ipvs: fix tinfo memory leak in start_sync_thread
	ath10k: add missing error handling
	ath10k: fix PCIE device wake up failed
	perf tools: Increase MAX_NR_CPUS and MAX_CACHES
	ASoC: Intel: hdac_hdmi: Set ops to NULL on remove
	libata: don't request sense data on !ZAC ATA devices
	clocksource/drivers/exynos_mct: Increase priority over ARM arch timer
	xsk: Properly terminate assignment in xskq_produce_flush_desc
	rslib: Fix decoding of shortened codes
	rslib: Fix handling of of caller provided syndrome
	ixgbe: Check DDM existence in transceiver before access
	crypto: serpent - mark __serpent_setkey_sbox noinline
	crypto: asymmetric_keys - select CRYPTO_HASH where needed
	wil6210: drop old event after wmi_call timeout
	EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
	bcache: check CACHE_SET_IO_DISABLE in allocator code
	bcache: check CACHE_SET_IO_DISABLE bit in bch_journal()
	bcache: acquire bch_register_lock later in cached_dev_free()
	bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
	bcache: fix potential deadlock in cached_def_free()
	net: hns3: fix a -Wformat-nonliteral compile warning
	net: hns3: add some error checking in hclge_tm module
	ath10k: destroy sdio workqueue while remove sdio module
	net: mvpp2: prs: Don't override the sign bit in SRAM parser shift
	igb: clear out skb->tstamp after reading the txtime
	iwlwifi: mvm: Drop large non sta frames
	bpf: fix uapi bpf_prog_info fields alignment
	perf stat: Make metric event lookup more robust
	perf stat: Fix group lookup for metric group
	bnx2x: Prevent ptp_task to be rescheduled indefinitely
	net: usb: asix: init MAC address buffers
	rxrpc: Fix oops in tracepoint
	bpf, libbpf, smatch: Fix potential NULL pointer dereference
	selftests: bpf: fix inlines in test_lwt_seg6local
	bonding: validate ip header before check IPPROTO_IGMP
	gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants
	tools: bpftool: Fix json dump crash on powerpc
	Bluetooth: hci_bcsp: Fix memory leak in rx_skb
	Bluetooth: Add new 13d3:3491 QCA_ROME device
	Bluetooth: Add new 13d3:3501 QCA_ROME device
	Bluetooth: 6lowpan: search for destination address in all peers
	perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64
	Bluetooth: Check state in l2cap_disconnect_rsp
	gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()
	Bluetooth: validate BLE connection interval updates
	gtp: fix suspicious RCU usage
	gtp: fix Illegal context switch in RCU read-side critical section.
	gtp: fix use-after-free in gtp_encap_destroy()
	gtp: fix use-after-free in gtp_newlink()
	net: mvmdio: defer probe of orion-mdio if a clock is not ready
	iavf: fix dereference of null rx_buffer pointer
	floppy: fix div-by-zero in setup_format_params
	floppy: fix out-of-bounds read in next_valid_format
	floppy: fix invalid pointer dereference in drive_name
	floppy: fix out-of-bounds read in copy_buffer
	xen: let alloc_xenballooned_pages() fail if not enough memory free
	scsi: NCR5380: Reduce goto statements in NCR5380_select()
	scsi: NCR5380: Always re-enable reselection interrupt
	Revert "scsi: ncr5380: Increase register polling limit"
	scsi: core: Fix race on creating sense cache
	scsi: megaraid_sas: Fix calculation of target ID
	scsi: mac_scsi: Increase PIO/PDMA transfer length threshold
	scsi: mac_scsi: Fix pseudo DMA implementation, take 2
	crypto: ghash - fix unaligned memory access in ghash_setkey()
	crypto: ccp - Validate the the error value used to index error messages
	crypto: arm64/sha1-ce - correct digest for empty data in finup
	crypto: arm64/sha2-ce - correct digest for empty data in finup
	crypto: chacha20poly1305 - fix atomic sleep when using async algorithm
	crypto: crypto4xx - fix AES CTR blocksize value
	crypto: crypto4xx - fix blocksize for cfb and ofb
	crypto: crypto4xx - block ciphers should only accept complete blocks
	crypto: ccp - memset structure fields to zero before reuse
	crypto: ccp/gcm - use const time tag comparison.
	crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe
	Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()"
	bcache: Revert "bcache: fix high CPU occupancy during journal"
	bcache: Revert "bcache: free heap cache_set->flush_btree in bch_journal_free"
	bcache: ignore read-ahead request failure on backing device
	bcache: fix mistaken sysfs entry for io_error counter
	bcache: destroy dc->writeback_write_wq if failed to create dc->writeback_thread
	Input: gtco - bounds check collection indent level
	Input: alps - don't handle ALPS cs19 trackpoint-only device
	Input: synaptics - whitelist Lenovo T580 SMBus intertouch
	Input: alps - fix a mismatch between a condition check and its comment
	regulator: s2mps11: Fix buck7 and buck8 wrong voltages
	arm64: tegra: Update Jetson TX1 GPU regulator timings
	iwlwifi: pcie: don't service an interrupt that was masked
	iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X
	iwlwifi: don't WARN when calling iwl_get_shared_mem_conf with RF-Kill
	iwlwifi: fix RF-Kill interrupt while FW load for gen2 devices
	NFSv4: Handle the special Linux file open access mode
	pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error
	pNFS: Fix a typo in pnfs_update_layout
	pnfs: Fix a problem where we gratuitously start doing I/O through the MDS
	lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
	ASoC: dapm: Adapt for debugfs API change
	raid5-cache: Need to do start() part job after adding journal device
	ALSA: seq: Break too long mutex context in the write loop
	ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform
	ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
	media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
	media: coda: Remove unbalanced and unneeded mutex unlock
	media: videobuf2-core: Prevent size alignment wrapping buffer size to 0
	media: videobuf2-dma-sg: Prevent size from overflowing
	KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
	arm64: tegra: Fix AGIC register range
	fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.
	kconfig: fix missing choice values in auto.conf
	drm/nouveau/i2c: Enable i2c pads & busses during preinit
	padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
	dm zoned: fix zone state management race
	xen/events: fix binding user event channels to cpus
	9p/xen: Add cleanup path in p9_trans_xen_init
	9p/virtio: Add cleanup path in p9_virtio_init
	x86/boot: Fix memory leak in default_get_smp_config()
	perf/x86/intel: Fix spurious NMI on fixed counter
	perf/x86/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs
	perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs
	drm/edid: parse CEA blocks embedded in DisplayID
	intel_th: pci: Add Ice Lake NNPI support
	PCI: hv: Fix a use-after-free bug in hv_eject_device_work()
	PCI: Do not poll for PME if the device is in D3cold
	PCI: qcom: Ensure that PERST is asserted for at least 100 ms
	Btrfs: fix data loss after inode eviction, renaming it, and fsync it
	Btrfs: fix fsync not persisting dentry deletions due to inode evictions
	Btrfs: add missing inode version, ctime and mtime updates when punching hole
	IB/mlx5: Report correctly tag matching rendezvous capability
	HID: wacom: generic: only switch the mode on devices with LEDs
	HID: wacom: generic: Correct pad syncing
	HID: wacom: correct touch resolution x/y typo
	libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields
	coda: pass the host file in vma->vm_file on mmap
	include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures
	xfs: fix pagecache truncation prior to reflink
	xfs: flush removing page cache in xfs_reflink_remap_prep
	xfs: don't overflow xattr listent buffer
	xfs: rename m_inotbt_nores to m_finobt_nores
	xfs: don't ever put nlink > 0 inodes on the unlinked list
	xfs: reserve blocks for ifree transaction during log recovery
	xfs: fix reporting supported extra file attributes for statx()
	xfs: serialize unaligned dio writes against all other dio writes
	xfs: abort unaligned nowait directio early
	gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
	crypto: caam - limit output IV to CBC to work around CTR mode DMA issue
	parisc: Ensure userspace privilege for ptraced processes in regset functions
	parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
	powerpc/32s: fix suspend/resume when IBATs 4-7 are used
	powerpc/watchpoint: Restore NV GPRs while returning from exception
	powerpc/powernv/npu: Fix reference leak
	powerpc/pseries: Fix oops in hotplug memory notifier
	mmc: sdhci-msm: fix mutex while in spinlock
	eCryptfs: fix a couple type promotion bugs
	mtd: rawnand: mtk: Correct low level time calculation of r/w cycle
	mtd: spinand: read returns badly if the last page has bitflips
	intel_th: msu: Fix single mode with disabled IOMMU
	Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
	usb: Handle USB3 remote wakeup for LPM enabled devices correctly
	blk-throttle: fix zero wait time for iops throttled group
	blk-iolatency: clear use_delay when io.latency is set to zero
	blkcg: update blkcg_print_stat() to handle larger outputs
	net: mvmdio: allow up to four clocks to be specified for orion-mdio
	dt-bindings: allow up to four clocks for orion-mdio
	dm bufio: fix deadlock with loop device
	Linux 4.19.61

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iac73da7ad6363743eb8c31f204ebd579950f8654
2019-07-26 10:32:40 +02:00
71ce27c31a Merge 4.19.61 into android-4.19
Changes in 4.19.61
	MIPS: ath79: fix ar933x uart parity mode
	MIPS: fix build on non-linux hosts
	arm64/efi: Mark __efistub_stext_offset as an absolute symbol explicitly
	scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported
	dmaengine: imx-sdma: fix use-after-free on probe error path
	wil6210: fix potential out-of-bounds read
	ath10k: Do not send probe response template for mesh
	ath9k: Check for errors when reading SREV register
	ath6kl: add some bounds checking
	ath10k: add peer id check in ath10k_peer_find_by_id
	wil6210: fix spurious interrupts in 3-msi
	ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
	regmap: debugfs: Fix memory leak in regmap_debugfs_init
	batman-adv: fix for leaked TVLV handler.
	media: dvb: usb: fix use after free in dvb_usb_device_exit
	media: spi: IR LED: add missing of table registration
	crypto: talitos - fix skcipher failure due to wrong output IV
	media: ov7740: avoid invalid framesize setting
	media: marvell-ccic: fix DMA s/g desc number calculation
	media: vpss: fix a potential NULL pointer dereference
	media: media_device_enum_links32: clean a reserved field
	net: stmmac: dwmac1000: Clear unused address entries
	net: stmmac: dwmac4/5: Clear unused address entries
	qed: Set the doorbell address correctly
	signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
	af_key: fix leaks in key_pol_get_resp and dump_sp.
	xfrm: Fix xfrm sel prefix length validation
	fscrypt: clean up some BUG_ON()s in block encryption/decryption
	perf annotate TUI browser: Do not use member from variable within its own initialization
	media: mc-device.c: don't memset __user pointer contents
	media: saa7164: fix remove_proc_entry warning
	media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
	net: phy: Check against net_device being NULL
	crypto: talitos - properly handle split ICV.
	crypto: talitos - Align SEC1 accesses to 32 bits boundaries.
	tua6100: Avoid build warnings.
	batman-adv: Fix duplicated OGMs on NETDEV_UP
	locking/lockdep: Fix merging of hlocks with non-zero references
	media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
	net: hns3: set ops to null when unregister ad_dev
	cpupower : frequency-set -r option misses the last cpu in related cpu list
	arm64: mm: make CONFIG_ZONE_DMA32 configurable
	perf jvmti: Address gcc string overflow warning for strncpy()
	net: stmmac: dwmac4: fix flow control issue
	net: stmmac: modify default value of tx-frames
	crypto: inside-secure - do not rely on the hardware last bit for result descriptors
	net: fec: Do not use netdev messages too early
	net: axienet: Fix race condition causing TX hang
	s390/qdio: handle PENDING state for QEBSM devices
	RAS/CEC: Fix pfn insertion
	net: sfp: add mutex to prevent concurrent state checks
	ipset: Fix memory accounting for hash types on resize
	perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode
	perf test 6: Fix missing kvm module load for s390
	perf report: Fix OOM error in TUI mode on s390
	irqchip/meson-gpio: Add support for Meson-G12A SoC
	media: uvcvideo: Fix access to uninitialized fields on probe error
	media: fdp1: Support M3N and E3 platforms
	iommu: Fix a leak in iommu_insert_resv_region
	gpio: omap: fix lack of irqstatus_raw0 for OMAP4
	gpio: omap: ensure irq is enabled before wakeup
	regmap: fix bulk writes on paged registers
	bpf: silence warning messages in core
	media: s5p-mfc: fix reading min scratch buffer size on MFC v6/v7
	selinux: fix empty write to keycreate file
	x86/cpu: Add Ice Lake NNPI to Intel family
	ASoC: meson: axg-tdm: fix sample clock inversion
	rcu: Force inlining of rcu_read_lock()
	x86/cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS
	qed: iWARP - Fix tc for MPA ll2 connection
	net: hns3: fix for skb leak when doing selftest
	block: null_blk: fix race condition for null_del_dev
	blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration
	xfrm: fix sa selector validation
	sched/core: Add __sched tag for io_schedule()
	sched/fair: Fix "runnable_avg_yN_inv" not used warnings
	perf/x86/intel/uncore: Handle invalid event coding for free-running counter
	x86/atomic: Fix smp_mb__{before,after}_atomic()
	perf evsel: Make perf_evsel__name() accept a NULL argument
	vhost_net: disable zerocopy by default
	ipoib: correcly show a VF hardware address
	x86/cacheinfo: Fix a -Wtype-limits warning
	blk-iolatency: only account submitted bios
	ACPICA: Clear status of GPEs on first direct enable
	EDAC/sysfs: Fix memory leak when creating a csrow object
	nvme: fix possible io failures when removing multipathed ns
	nvme-pci: properly report state change failure in nvme_reset_work
	nvme-pci: set the errno on ctrl state change error
	lightnvm: pblk: fix freeing of merged pages
	arm64: Do not enable IRQs for ct_user_exit
	ipsec: select crypto ciphers for xfrm_algo
	ipvs: defer hook registration to avoid leaks
	media: s5p-mfc: Make additional clocks optional
	media: i2c: fix warning same module names
	ntp: Limit TAI-UTC offset
	timer_list: Guard procfs specific code
	acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
	media: coda: fix mpeg2 sequence number handling
	media: coda: fix last buffer handling in V4L2_ENC_CMD_STOP
	media: coda: increment sequence offset for the last returned frame
	media: vimc: cap: check v4l2_fill_pixfmt return value
	media: hdpvr: fix locking and a missing msleep
	net: stmmac: sun8i: force select external PHY when no internal one
	rtlwifi: rtl8192cu: fix error handle when usb probe failed
	mt7601u: do not schedule rx_tasklet when the device has been disconnected
	x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
	mt7601u: fix possible memory leak when the device is disconnected
	ipvs: fix tinfo memory leak in start_sync_thread
	ath10k: add missing error handling
	ath10k: fix PCIE device wake up failed
	perf tools: Increase MAX_NR_CPUS and MAX_CACHES
	ASoC: Intel: hdac_hdmi: Set ops to NULL on remove
	libata: don't request sense data on !ZAC ATA devices
	clocksource/drivers/exynos_mct: Increase priority over ARM arch timer
	xsk: Properly terminate assignment in xskq_produce_flush_desc
	rslib: Fix decoding of shortened codes
	rslib: Fix handling of of caller provided syndrome
	ixgbe: Check DDM existence in transceiver before access
	crypto: serpent - mark __serpent_setkey_sbox noinline
	crypto: asymmetric_keys - select CRYPTO_HASH where needed
	wil6210: drop old event after wmi_call timeout
	EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
	bcache: check CACHE_SET_IO_DISABLE in allocator code
	bcache: check CACHE_SET_IO_DISABLE bit in bch_journal()
	bcache: acquire bch_register_lock later in cached_dev_free()
	bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
	bcache: fix potential deadlock in cached_def_free()
	net: hns3: fix a -Wformat-nonliteral compile warning
	net: hns3: add some error checking in hclge_tm module
	ath10k: destroy sdio workqueue while remove sdio module
	net: mvpp2: prs: Don't override the sign bit in SRAM parser shift
	igb: clear out skb->tstamp after reading the txtime
	iwlwifi: mvm: Drop large non sta frames
	bpf: fix uapi bpf_prog_info fields alignment
	perf stat: Make metric event lookup more robust
	perf stat: Fix group lookup for metric group
	bnx2x: Prevent ptp_task to be rescheduled indefinitely
	net: usb: asix: init MAC address buffers
	rxrpc: Fix oops in tracepoint
	bpf, libbpf, smatch: Fix potential NULL pointer dereference
	selftests: bpf: fix inlines in test_lwt_seg6local
	bonding: validate ip header before check IPPROTO_IGMP
	gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants
	tools: bpftool: Fix json dump crash on powerpc
	Bluetooth: hci_bcsp: Fix memory leak in rx_skb
	Bluetooth: Add new 13d3:3491 QCA_ROME device
	Bluetooth: Add new 13d3:3501 QCA_ROME device
	Bluetooth: 6lowpan: search for destination address in all peers
	perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64
	Bluetooth: Check state in l2cap_disconnect_rsp
	gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()
	Bluetooth: validate BLE connection interval updates
	gtp: fix suspicious RCU usage
	gtp: fix Illegal context switch in RCU read-side critical section.
	gtp: fix use-after-free in gtp_encap_destroy()
	gtp: fix use-after-free in gtp_newlink()
	net: mvmdio: defer probe of orion-mdio if a clock is not ready
	iavf: fix dereference of null rx_buffer pointer
	floppy: fix div-by-zero in setup_format_params
	floppy: fix out-of-bounds read in next_valid_format
	floppy: fix invalid pointer dereference in drive_name
	floppy: fix out-of-bounds read in copy_buffer
	xen: let alloc_xenballooned_pages() fail if not enough memory free
	scsi: NCR5380: Reduce goto statements in NCR5380_select()
	scsi: NCR5380: Always re-enable reselection interrupt
	Revert "scsi: ncr5380: Increase register polling limit"
	scsi: core: Fix race on creating sense cache
	scsi: megaraid_sas: Fix calculation of target ID
	scsi: mac_scsi: Increase PIO/PDMA transfer length threshold
	scsi: mac_scsi: Fix pseudo DMA implementation, take 2
	crypto: ghash - fix unaligned memory access in ghash_setkey()
	crypto: ccp - Validate the the error value used to index error messages
	crypto: arm64/sha1-ce - correct digest for empty data in finup
	crypto: arm64/sha2-ce - correct digest for empty data in finup
	crypto: chacha20poly1305 - fix atomic sleep when using async algorithm
	crypto: crypto4xx - fix AES CTR blocksize value
	crypto: crypto4xx - fix blocksize for cfb and ofb
	crypto: crypto4xx - block ciphers should only accept complete blocks
	crypto: ccp - memset structure fields to zero before reuse
	crypto: ccp/gcm - use const time tag comparison.
	crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe
	Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()"
	bcache: Revert "bcache: fix high CPU occupancy during journal"
	bcache: Revert "bcache: free heap cache_set->flush_btree in bch_journal_free"
	bcache: ignore read-ahead request failure on backing device
	bcache: fix mistaken sysfs entry for io_error counter
	bcache: destroy dc->writeback_write_wq if failed to create dc->writeback_thread
	Input: gtco - bounds check collection indent level
	Input: alps - don't handle ALPS cs19 trackpoint-only device
	Input: synaptics - whitelist Lenovo T580 SMBus intertouch
	Input: alps - fix a mismatch between a condition check and its comment
	regulator: s2mps11: Fix buck7 and buck8 wrong voltages
	arm64: tegra: Update Jetson TX1 GPU regulator timings
	iwlwifi: pcie: don't service an interrupt that was masked
	iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X
	iwlwifi: don't WARN when calling iwl_get_shared_mem_conf with RF-Kill
	iwlwifi: fix RF-Kill interrupt while FW load for gen2 devices
	NFSv4: Handle the special Linux file open access mode
	pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error
	pNFS: Fix a typo in pnfs_update_layout
	pnfs: Fix a problem where we gratuitously start doing I/O through the MDS
	lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
	ASoC: dapm: Adapt for debugfs API change
	raid5-cache: Need to do start() part job after adding journal device
	ALSA: seq: Break too long mutex context in the write loop
	ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform
	ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
	media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
	media: coda: Remove unbalanced and unneeded mutex unlock
	media: videobuf2-core: Prevent size alignment wrapping buffer size to 0
	media: videobuf2-dma-sg: Prevent size from overflowing
	KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
	arm64: tegra: Fix AGIC register range
	fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.
	kconfig: fix missing choice values in auto.conf
	drm/nouveau/i2c: Enable i2c pads & busses during preinit
	padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
	dm zoned: fix zone state management race
	xen/events: fix binding user event channels to cpus
	9p/xen: Add cleanup path in p9_trans_xen_init
	9p/virtio: Add cleanup path in p9_virtio_init
	x86/boot: Fix memory leak in default_get_smp_config()
	perf/x86/intel: Fix spurious NMI on fixed counter
	perf/x86/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs
	perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs
	drm/edid: parse CEA blocks embedded in DisplayID
	intel_th: pci: Add Ice Lake NNPI support
	PCI: hv: Fix a use-after-free bug in hv_eject_device_work()
	PCI: Do not poll for PME if the device is in D3cold
	PCI: qcom: Ensure that PERST is asserted for at least 100 ms
	Btrfs: fix data loss after inode eviction, renaming it, and fsync it
	Btrfs: fix fsync not persisting dentry deletions due to inode evictions
	Btrfs: add missing inode version, ctime and mtime updates when punching hole
	IB/mlx5: Report correctly tag matching rendezvous capability
	HID: wacom: generic: only switch the mode on devices with LEDs
	HID: wacom: generic: Correct pad syncing
	HID: wacom: correct touch resolution x/y typo
	libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields
	coda: pass the host file in vma->vm_file on mmap
	include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures
	xfs: fix pagecache truncation prior to reflink
	xfs: flush removing page cache in xfs_reflink_remap_prep
	xfs: don't overflow xattr listent buffer
	xfs: rename m_inotbt_nores to m_finobt_nores
	xfs: don't ever put nlink > 0 inodes on the unlinked list
	xfs: reserve blocks for ifree transaction during log recovery
	xfs: fix reporting supported extra file attributes for statx()
	xfs: serialize unaligned dio writes against all other dio writes
	xfs: abort unaligned nowait directio early
	gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
	crypto: caam - limit output IV to CBC to work around CTR mode DMA issue
	parisc: Ensure userspace privilege for ptraced processes in regset functions
	parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
	powerpc/32s: fix suspend/resume when IBATs 4-7 are used
	powerpc/watchpoint: Restore NV GPRs while returning from exception
	powerpc/powernv/npu: Fix reference leak
	powerpc/pseries: Fix oops in hotplug memory notifier
	mmc: sdhci-msm: fix mutex while in spinlock
	eCryptfs: fix a couple type promotion bugs
	mtd: rawnand: mtk: Correct low level time calculation of r/w cycle
	mtd: spinand: read returns badly if the last page has bitflips
	intel_th: msu: Fix single mode with disabled IOMMU
	Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
	usb: Handle USB3 remote wakeup for LPM enabled devices correctly
	blk-throttle: fix zero wait time for iops throttled group
	blk-iolatency: clear use_delay when io.latency is set to zero
	blkcg: update blkcg_print_stat() to handle larger outputs
	net: mvmdio: allow up to four clocks to be specified for orion-mdio
	dt-bindings: allow up to four clocks for orion-mdio
	dm bufio: fix deadlock with loop device
	Linux 4.19.61

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2f565111b1c16f369fa86e0481527fcc6357fe1b
2019-07-26 10:31:53 +02:00
fe2ceeb4cf ipvs: fix tinfo memory leak in start_sync_thread
[ Upstream commit 5db7c8b9f9fc2aeec671ae3ca6375752c162e0e7 ]

syzkaller reports for memory leak in start_sync_thread [1]

As Eric points out, kthread may start and stop before the
threadfn function is called, so there is no chance the
data (tinfo in our case) to be released in thread.

Fix this by releasing tinfo in the controlling code instead.

[1]
BUG: memory leak
unreferenced object 0xffff8881206bf700 (size 32):
 comm "syz-executor761", pid 7268, jiffies 4294943441 (age 20.470s)
 hex dump (first 32 bytes):
   00 40 7c 09 81 88 ff ff 80 45 b8 21 81 88 ff ff  .@|......E.!....
   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 backtrace:
   [<0000000057619e23>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
   [<0000000057619e23>] slab_post_alloc_hook mm/slab.h:439 [inline]
   [<0000000057619e23>] slab_alloc mm/slab.c:3326 [inline]
   [<0000000057619e23>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553
   [<0000000086ce5479>] kmalloc include/linux/slab.h:547 [inline]
   [<0000000086ce5479>] start_sync_thread+0x5d2/0xe10 net/netfilter/ipvs/ip_vs_sync.c:1862
   [<000000001a9229cc>] do_ip_vs_set_ctl+0x4c5/0x780 net/netfilter/ipvs/ip_vs_ctl.c:2402
   [<00000000ece457c8>] nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
   [<00000000ece457c8>] nf_setsockopt+0x4c/0x80 net/netfilter/nf_sockopt.c:115
   [<00000000942f62d4>] ip_setsockopt net/ipv4/ip_sockglue.c:1258 [inline]
   [<00000000942f62d4>] ip_setsockopt+0x9b/0xb0 net/ipv4/ip_sockglue.c:1238
   [<00000000a56a8ffd>] udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2616
   [<00000000fa895401>] sock_common_setsockopt+0x38/0x50 net/core/sock.c:3130
   [<0000000095eef4cf>] __sys_setsockopt+0x98/0x120 net/socket.c:2078
   [<000000009747cf88>] __do_sys_setsockopt net/socket.c:2089 [inline]
   [<000000009747cf88>] __se_sys_setsockopt net/socket.c:2086 [inline]
   [<000000009747cf88>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2086
   [<00000000ded8ba80>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:301
   [<00000000893b4ac8>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported-by: syzbot+7e2e50c8adfccd2e5041@syzkaller.appspotmail.com
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Fixes: 998e7a7680 ("ipvs: Use kthread_run() instead of doing a double-fork via kernel_thread()")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-26 09:14:11 +02:00
d355c0141d Merge android-4.19.56 (e5304c6) into msm-4.19
* refs/heads/tmp-e5304c6:
  Linux 4.19.56
  powerpc/mm/64s/hash: Reallocate context ids on fork
  x86/resctrl: Don't stop walking closids when a locksetup group is found
  mac80211: Do not use stack memory with scatterlist for GMAC
  nl80211: fix station_info pertid memory leak
  mac80211: handle deauthentication/disassociation from TDLS peer
  {nl,mac}80211: allow 4addr AP operation on crypto controlled devices
  mac80211: drop robust management frames from unknown TA
  cfg80211: fix memory leak of wiphy device name
  SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write
  Bluetooth: Fix regression with minimum encryption key size alignment
  Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
  staging: erofs: add requirements field in superblock
  drm/vmwgfx: Use the backdoor port if the HB port is not available
  arm64: ssbd: explicitly depend on <linux/prctl.h>
  arm64/sve: <uapi/asm/ptrace.h> should not depend on <uapi/linux/prctl.h>
  ARM: dts: am57xx-idk: Remove support for voltage switching for SD card
  ARM: dts: dra76x: Update MMC2_HS200_MANUAL1 iodelay values
  ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
  powerpc/bpf: use unsigned division instruction for 64-bit operations
  riscv: mm: synchronize MMU after pte change
  can: purge socket error queue on sock destruct
  can: flexcan: fix timeout when set small bitrate
  can: xilinx_can: use correct bittiming_const for CAN FD core
  btrfs: start readahead also in seed devices
  nvme: Fix u32 overflow in the number of namespace list calculation
  arm64: Silence gcc warnings about arch ABI drift
  hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
  hwmon: (core) add thermal sensors only if dev->of_node is present
  s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
  net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is set
  scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous()
  scsi: ufs: Check that space was properly alloced in copy_query_response
  scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
  nvmet: fix data_len to 0 for bdev-backed write_zeroes
  drm/arm/hdlcd: Allow a bit of clock tolerance
  drm/arm/hdlcd: Actually validate CRTC modes
  drm/arm/mali-dp: Add a loop around the second set CVAL and try 5 times
  net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW RX_2BYTE_OFFSET is enabled
  net: ethernet: mediatek: Use hw_feature to judge if HWLRO is supported
  sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD
  mdesc: fix a missing-check bug in get_vdev_port_node_info()
  net: hns: Fix loopback test failed at copper ports
  net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0
  selftests: vm: install test_vmalloc.sh for run_vmtests
  kselftest/cgroup: fix incorrect test_core skip
  kselftest/cgroup: fix unexpected testing failure on test_core
  kselftest/cgroup: fix unexpected testing failure on test_memcontrol
  xtensa: Fix section mismatch between memblock_reserve and mem_reserve
  MIPS: uprobes: remove set but not used variable 'epc'
  IB/hfi1: Validate page aligned for a given virtual address
  IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value
  IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
  IB/rdmavt: Fix alloc_qpn() WARN_ON()
  parisc: Fix compiler warnings in float emulation code
  parport: Fix mem leak in parport_register_dev_model
  fpga: dfl: Add lockdep classes for pdata->lock
  fpga: dfl: afu: Pass the correct device to dma_mapping_error()
  ARC: [plat-hsdk]: Add missing FIFO size entry in GMAC node
  ARC: [plat-hsdk]: Add missing multicast filter bins number to GMAC node
  dmaengine: sprd: Fix block length overflow
  dmaengine: dw-axi-dmac: fix null dereference when pointer first is null
  ARC: fix build warnings
  brcmfmac: sdio: Don't tune while the card is off
  brcmfmac: sdio: Disable auto-tuning around commands expected to fail
  apparmor: enforce nullbyte at end of tag string
  apparmor: fix PROFILE_MEDIATES for untrusted input
  Input: silead - add MSSL0017 to acpi_device_id
  Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
  Input: synaptics - enable SMBus on ThinkPad E480 and E580
  iio: temperature: mlx90632 Relax the compatibility check
  IB/hfi1: Silence txreq allocation warnings
  IB/hfi1: Validate fault injection opcode user input
  usb: xhci: Don't try to recover an endpoint if port is in error state.
  xhci: detect USB 3.2 capable host controllers correctly
  usb: chipidea: udc: workaround for endpoint conflict issue
  scsi: ufs: Avoid runtime suspend possibly being blocked forever
  mmc: core: Prevent processing SDIO IRQs when the card is suspended
  mmc: core: Add sdio_retune_hold_now() and sdio_retune_release()
  mmc: core: API to temporarily disable retuning for SDIO CRC errors
  mmc: sdhci: sdhci-pci-o2micro: Correctly set bus width when tuning
  s390/ap: rework assembler functions to use unions for in/out register variables
  s390/jump_label: Use "jdd" constraint on gcc9
  ovl: fix bogus -Wmaybe-unitialized warning
  ovl: don't fail with disconnected lower NFS
  ovl: detect overlapping layers
  ovl: make i_ino consistent with st_ino in more cases
  ovl: fix wrong flags check in FS_IOC_FS[SG]ETXATTR ioctls
  ovl: support the FS_IOC_FS[SG]ETXATTR ioctls
  gcc-9: silence 'address-of-packed-member' warning
  objtool: Support per-function rodata sections
  tracing: Silence GCC 9 array bounds warning

Conflicts:
	Makefile
	drivers/mmc/core/sdio.c
	drivers/scsi/ufs/ufshcd-pltfrm.c

Change-Id: I236ed854cc550b2953d984f4e6686ab871e42f45
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-07-25 13:29:38 -07:00
1d0720259a Merge android-4.19.52 (d9bd265) into msm-4.19
* refs/heads/tmp-d9bd265:
  Linux 4.19.52
  tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
  tcp: add tcp_min_snd_mss sysctl
  tcp: tcp_fragment() should apply sane memory limits
  tcp: limit payload size of sacked skbs

Change-Id: I01c304645f63cde6b87926bb01c7b2112db2042d
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-07-18 07:44:02 -07:00
e09e20aa23 Merge android-4.19.51 (d1f7f3b) into msm-4.19
* refs/heads/tmp-d1f7f3b:
  Linux 4.19.51
  ALSA: seq: Cover unsubscribe_port() in list_mutex
  drm/vc4: fix fb references in async update
  ovl: support stacked SEEK_HOLE/SEEK_DATA
  ovl: check the capability before cred overridden
  Revert "drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)"
  Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"
  percpu: do not search past bitmap when allocating an area
  gpio: vf610: Do not share irq_chip
  soc: renesas: Identify R-Car M3-W ES1.3
  usb: typec: fusb302: Check vconn is off when we start toggling
  ARM: exynos: Fix undefined instruction during Exynos5422 resume
  pwm: Fix deadlock warning when removing PWM device
  ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa
  pwm: tiehrpwm: Update shadow register for disabling PWMs
  dmaengine: idma64: Use actual device for DMA transfers
  ice: Add missing case in print_link_msg for printing flow control
  gpio: gpio-omap: add check for off wake capable gpios
  PCI: xilinx: Check for __get_free_pages() failure
  block, bfq: increase idling for weight-raised queues
  video: imsttfb: fix potential NULL pointer dereferences
  video: hgafb: fix potential NULL pointer dereference
  scsi: qla2xxx: Reset the FCF_ASYNC_{SENT|ACTIVE} flags
  PCI: rcar: Fix 64bit MSI message address handling
  PCI: rcar: Fix a potential NULL pointer dereference
  net: hns3: return 0 and print warning when hit duplicate MAC
  power: supply: max14656: fix potential use-before-alloc
  platform/x86: intel_pmc_ipc: adding error handling
  ARM: OMAP2+: pm33xx-core: Do not Turn OFF CEFUSE as PPA may be using it
  drm/amd/display: Use plane->color_space for dpp if specified
  PCI: rpadlpar: Fix leaked device_node references in add/remove paths
  ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx7d: Specify IMX7D_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6sll: Specify IMX6SLL_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
  ARM: dts: imx53: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
  ARM: dts: imx50: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
  ARM: dts: imx51: Specify IMX5_CLK_IPG as "ahb" clock to SDMA
  soc: rockchip: Set the proper PWM for rk3288
  clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
  soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
  PCI: keystone: Prevent ARM32 specific code to be compiled for ARM64
  platform/chrome: cros_ec_proto: check for NULL transfer function
  i40e: Queues are reserved despite "Invalid argument" error
  x86/PCI: Fix PCI IRQ routing table memory leak
  net: thunderbolt: Unregister ThunderboltIP protocol handler when suspending
  switchtec: Fix unintended mask of MRPC event
  iommu/arm-smmu-v3: Don't disable SMMU in kdump kernel
  vfio: Fix WARNING "do not call blocking ops when !TASK_RUNNING"
  nfsd: avoid uninitialized variable warning
  nfsd: allow fh_want_write to be called twice
  fuse: retrieve: cap requested size to negotiated max_write
  nvmem: sunxi_sid: Support SID on A83T and H5
  nvmem: core: fix read buffer in place
  ALSA: hda - Register irq handler after the chip initialization
  netfilter: nf_flow_table: fix netdev refcnt leak
  netfilter: nf_flow_table: check ttl value in flow offload data path
  nvme-pci: shutdown on timeout during deletion
  nvme-pci: unquiesce admin queue on shutdown
  PCI: designware-ep: Use aligned ATU window for raising MSI interrupts
  misc: pci_endpoint_test: Fix test_reg_bar to be updated in pci_endpoint_test
  iommu/vt-d: Set intel_iommu_gfx_mapped correctly
  blk-mq: move cancel of requeue_work into blk_mq_release
  watchdog: fix compile time error of pretimeout governors
  watchdog: imx2_wdt: Fix set_timeout for big timeout values
  netfilter: nf_tables: fix base chain stat rcu_dereference usage
  mips: Make sure dt memory regions are valid
  netfilter: nf_conntrack_h323: restore boundary check correctness
  netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast
  mmc: mmci: Prevent polling for busy detection in IRQ context
  ovl: do not generate duplicate fsnotify events for "fake" path
  PCI: dwc: Free MSI IRQ page in dw_pcie_free_msi()
  PCI: dwc: Free MSI in dw_pcie_host_init() error path
  uml: fix a boot splat wrt use of cpu_all_mask
  configfs: fix possible use-after-free in configfs_register_group
  percpu: remove spurious lock dependency between percpu and sched
  f2fs: fix to do checksum even if inode page is uptodate
  f2fs: fix to do sanity check on valid block count of segment
  f2fs: fix to use inline space only if inline_xattr is enable
  f2fs: fix to avoid panic in dec_valid_block_count()
  f2fs: fix to clear dirty inode in error path of f2fs_iget()
  f2fs: fix to do sanity check on free nid
  f2fs: fix to avoid panic in f2fs_remove_inode_page()
  f2fs: fix to avoid panic in f2fs_inplace_write_data()
  f2fs: fix to avoid panic in do_recover_data()
  ntp: Allow TAI-UTC offset to be set to zero
  mailbox: stm32-ipcc: check invalid irq
  pwm: meson: Use the spin-lock only to protect register modifications
  EDAC/mpc85xx: Prevent building as a module
  bpf: fix undefined behavior in narrow load handling
  drm/nouveau/kms/gv100-: fix spurious window immediate interlocks
  objtool: Don't use ignore flag for fake jumps
  drm/bridge: adv7511: Fix low refresh rate selection
  drm/nouveau/kms/gf119-gp10x: push HeadSetControlOutputResource() mthd when encoders change
  perf/x86/intel: Allow PEBS multi-entry in watermark mode
  mfd: twl6040: Fix device init errors for ACCCTL register
  drm/nouveau/disp/dp: respect sink limits when selecting failsafe link configuration
  mfd: intel-lpss: Set the device in reset state when init
  mfd: tps65912-spi: Add missing of table registration
  drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
  thermal: rcar_gen3_thermal: disable interrupt in .remove
  kernel/sys.c: prctl: fix false positive in validate_prctl_map()
  mm/slab.c: fix an infinite loop in leaks_show()
  mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
  mm: page_mkclean vs MADV_DONTNEED race
  mm/cma.c: fix the bitmap status to show failed allocation reason
  initramfs: free initrd memory if opening /initrd.image fails
  mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
  mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE
  hugetlbfs: on restore reserve error path retain subpool reservation
  mm/hmm: select mmu notifier when selecting HMM
  ARM: prevent tracing IPI_CPU_BACKTRACE
  drm/pl111: Initialize clock spinlock early
  ipc: prevent lockup on alloc_msg and free_msg
  sysctl: return -EINVAL if val violates minmax
  fs/fat/file.c: issue flush after the writeback of FAT
  rapidio: fix a NULL pointer dereference when create_workqueue() fails
  x86: Fix RETPOLINE_CFLAGS check
  BACKPORT: kheaders: Do not regenerate archive if config is not changed
  BACKPORT: kheaders: Move from proc to sysfs
  BACKPORT: Provide in-kernel headers to make extending kernel easier
  UPSTREAM: binder: check for overflow when alloc for security context

Conflicts:
	arch/arm/kernel/smp.c

Change-Id: I3ea68f5be5910b6ae24d16194db149c24c36da36
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-07-18 07:43:59 -07:00
68133c40f6 Merge "cnss2: Add level for very high bandwidth" 2019-07-18 01:19:28 -07:00
77e589024e cnss2: Add level for very high bandwidth
Add additional bandwidth level for high throughput use cases.

CRs-Fixed: 2490222
Change-Id: I413f307a4c0a321845903a5b03c9b9b0441da8af
Signed-off-by: Mahesh Kumar Kalikot Veetil <mkalikot@codeaurora.org>
2019-07-15 13:28:24 -07:00
4bcfb79fa8 Merge android-4.19.50 (be7c1cb) into msm-4.19
* refs/heads/tmp-be7c1cb:
  Linux 4.19.50
  ethtool: check the return value of get_regs_len
  ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
  TTY: serial_core, add ->install
  drm/i915/gvt: Initialize intel_gvt_gtt_entry in stack
  drm: don't block fb changes for async plane updates
  drm/i915: Maintain consistent documentation subsection ordering
  drm/i915/fbc: disable framebuffer compression on GeminiLake
  drm/i915: Fix I915_EXEC_RING_MASK
  drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in
  drm/radeon: prefer lower reference dividers
  drm/amdgpu/psp: move psp version specific function pointers to early_init
  drm: add non-desktop quirks to Sensics and OSVR headsets.
  drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)
  drm: add non-desktop quirk for Valve HMDs
  drm/msm: fix fb references in async update
  drm/gma500/cdv: Check vbt config bits when detecting lvds panels
  test_firmware: Use correct snprintf() limit
  genwqe: Prevent an integer overflow in the ioctl
  Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment"
  MIPS: pistachio: Build uImage.gz by default
  MIPS: Bounds check virt_addr_valid
  xen-blkfront: switch kcalloc to kvcalloc for large array allocation
  s390/mm: fix address space detection in exception handling
  i2c: xiic: Add max_read_len quirk
  x86/insn-eval: Fix use-after-free access to LDT entry
  x86/power: Fix 'nosmt' vs hibernation triple fault during resume
  pstore/ram: Run without kernel crash dump region
  pstore: Set tfm to NULL on free_buf_for_compression
  pstore: Convert buf_lock to semaphore
  pstore: Remove needless lock during console writes
  fuse: fallocate: fix return with locked inode
  NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled
  NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter
  parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
  rcu: locking and unlocking need to always be at least barriers
  mtd: spinand: macronix: Fix ECC Status Read
  ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
  ipv6: use READ_ONCE() for inet->hdrincl as in ipv4
  Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied"
  pktgen: do not sleep with the thread lock held.
  packet: unconditionally free po->rollover
  net/tls: replace the sleeping lock around RX resync with a bit lock
  net: sfp: read eeprom in maximum 16 byte increments
  net: rds: fix memory leak in rds_ib_flush_mr_pool
  net: mvpp2: Use strscpy to handle stat strings
  net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
  net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set
  neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
  ipv6: fix the check before getting the cookie in rt6_get_cookie
  ipv4: not do cache for local delivery if bc_forwarding is enabled
  Fix memory leak in sctp_process_init
  ethtool: fix potential userspace buffer overflow

Change-Id: Ic49494d073fe049a92a42dd95a84315b64a13c3e
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-07-14 23:58:41 -07:00
d7864ac281 Merge android-4.19.48 (01f5de3) into msm-4.19
* refs/heads/tmp-01f5de3:
  Linux 4.19.48
  tipc: fix modprobe tipc failed after switch order of device registration
  Revert "tipc: fix modprobe tipc failed after switch order of device registration"
  xen/pciback: Don't disable PCI_COMMAND on PCI device reset.
  jump_label: move 'asm goto' support test to Kconfig
  compiler.h: give up __compiletime_assert_fallback()
  include/linux/compiler*.h: define asm_volatile_goto
  crypto: vmx - ghash: do nosimd fallback manually
  net/tls: don't ignore netdev notifications if no TLS features
  net/tls: fix state removal with feature flags off
  bnxt_en: Fix aggregation buffer leak under OOM condition.
  net: stmmac: dma channel control register need to be init first
  net/mlx5e: Disable rxhash when CQE compress is enabled
  net/mlx5: Allocate root ns memory using kzalloc to match kfree
  tipc: Avoid copying bytes beyond the supplied data
  net/mlx5: Avoid double free in fs init error unwinding path
  usbnet: fix kernel crash after disconnect
  net: stmmac: fix reset gpio free missing
  net: sched: don't use tc_action->order during action dump
  net: phy: marvell10g: report if the PHY fails to boot firmware
  net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value
  net: mvneta: Fix err code path of probe
  net-gro: fix use-after-free read in napi_gro_frags()
  net: fec: fix the clk mismatch in failed_reset path
  net: dsa: mv88e6xxx: fix handling of upper half of STATS_TYPE_PORT
  llc: fix skb leak in llc_build_and_send_ui_pkt()
  ipv6: Fix redirect with VRF
  ipv6: Consider sk_bound_dev_if when binding a raw socket to an address
  ipv4/igmp: fix build error if !CONFIG_IP_MULTICAST
  ipv4/igmp: fix another memory leak in igmpv3_del_delrec()
  inet: switch IP ID generator to siphash
  cxgb4: offload VLAN flows regardless of VLAN ethtype
  bonding/802.3ad: fix slave link initialization transition states

Conflicts:
	include/linux/compiler.h

Change-Id: I43dd2908aa00a247ac985c36d210e83370361315
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2019-07-14 23:58:35 -07:00
2b34bd7b80 Merge 4.19.59 into android-4.19-q
Changes in 4.19.59
	crypto: talitos - rename alternative AEAD algos.
	soc: brcmstb: Fix error path for unsupported CPUs
	soc: bcm: brcmstb: biuctrl: Register writes require a barrier
	Input: elantech - enable middle button support on 2 ThinkPads
	samples, bpf: fix to change the buffer size for read()
	samples, bpf: suppress compiler warning
	mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he()
	bpf: sockmap, fix use after free from sleep in psock backlog workqueue
	soundwire: stream: fix out of boundary access on port properties
	staging:iio:ad7150: fix threshold mode config bit
	mac80211: mesh: fix RCU warning
	mac80211: free peer keys before vif down in mesh
	mwifiex: Fix possible buffer overflows at parsing bss descriptor
	iwlwifi: Fix double-free problems in iwl_req_fw_callback()
	mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
	soundwire: intel: set dai min and max channels correctly
	dt-bindings: can: mcp251x: add mcp25625 support
	can: mcp251x: add support for mcp25625
	can: m_can: implement errata "Needless activation of MRAF irq"
	can: af_can: Fix error path of can_init()
	net: phy: rename Asix Electronics PHY driver
	ibmvnic: Do not close unopened driver during reset
	ibmvnic: Refresh device multicast list after reset
	ibmvnic: Fix unchecked return codes of memory allocations
	ARM: dts: am335x phytec boards: Fix cd-gpios active level
	s390/boot: disable address-of-packed-member warning
	drm/vmwgfx: Honor the sg list segment size limitation
	drm/vmwgfx: fix a warning due to missing dma_parms
	riscv: Fix udelay in RV32.
	Input: imx_keypad - make sure keyboard can always wake up system
	KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy
	mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed
	ARM: davinci: da850-evm: call regulator_has_full_constraints()
	ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
	mac80211: only warn once on chanctx_conf being NULL
	mac80211: do not start any work during reconfigure flow
	bpf, devmap: Fix premature entry free on destroying map
	bpf, devmap: Add missing bulk queue free
	bpf, devmap: Add missing RCU read lock on flush
	bpf, x64: fix stack layout of JITed bpf code
	qmi_wwan: add support for QMAP padding in the RX path
	qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode
	qmi_wwan: extend permitted QMAP mux_id value range
	mmc: core: complete HS400 before checking status
	md: fix for divide error in status_resync
	bnx2x: Check if transceiver implements DDM before access
	drm: return -EFAULT if copy_to_user() fails
	ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
	net: lio_core: fix potential sign-extension overflow on large shift
	scsi: qedi: Check targetname while finding boot target information
	quota: fix a problem about transfer quota
	net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge()
	NFS4: Only set creation opendata if O_CREAT
	net :sunrpc :clnt :Fix xps refcount imbalance on the error path
	fscrypt: don't set policy for a dead directory
	udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
	media: stv0297: fix frequency range limit
	ALSA: usb-audio: Fix parse of UAC2 Extension Units
	ALSA: hda/realtek - Headphone Mic can't record after S3
	block, bfq: NULL out the bic when it's no longer valid
	perf pmu: Fix uncore PMU alias list for ARM64
	x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
	x86/tls: Fix possible spectre-v1 in do_get_thread_area()
	Documentation: Add section about CPU vulnerabilities for Spectre
	Documentation/admin: Remove the vsyscall=native documentation
	mwifiex: Abort at too short BSS descriptor element
	mwifiex: Don't abort on small, spec-compliant vendor IEs
	USB: serial: ftdi_sio: add ID for isodebug v1
	USB: serial: option: add support for GosunCn ME3630 RNDIS mode
	Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
	p54usb: Fix race between disconnect and firmware loading
	usb: gadget: ether: Fix race between gether_disconnect and rx_submit
	usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset()
	usb: renesas_usbhs: add a workaround for a race condition of workqueue
	drivers/usb/typec/tps6598x.c: fix portinfo width
	drivers/usb/typec/tps6598x.c: fix 4CC cmd write
	staging: comedi: dt282x: fix a null pointer deref on interrupt
	staging: comedi: amplc_pci230: fix null pointer deref on interrupt
	HID: Add another Primax PIXART OEM mouse quirk
	lkdtm: support llvm-objcopy
	binder: fix memory leak in error path
	carl9170: fix misuse of device driver API
	VMCI: Fix integer overflow in VMCI handle arrays
	MIPS: Remove superfluous check for __linux__
	staging: fsl-dpaa2/ethsw: fix memory leak of switchdev_work
	staging: bcm2835-camera: Replace spinlock protecting context_map with mutex
	staging: bcm2835-camera: Ensure all buffers are returned on disable
	staging: bcm2835-camera: Remove check of the number of buffers supplied
	staging: bcm2835-camera: Handle empty EOS buffers whilst streaming
	staging: rtl8712: reduce stack usage, again
	Linux 4.19.59

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4d022ea019095cce9b418cba11efab636e538919
2019-07-14 08:47:42 +02:00
0f653d9aa3 Merge 4.19.59 into android-4.19
Changes in 4.19.59
	crypto: talitos - rename alternative AEAD algos.
	soc: brcmstb: Fix error path for unsupported CPUs
	soc: bcm: brcmstb: biuctrl: Register writes require a barrier
	Input: elantech - enable middle button support on 2 ThinkPads
	samples, bpf: fix to change the buffer size for read()
	samples, bpf: suppress compiler warning
	mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he()
	bpf: sockmap, fix use after free from sleep in psock backlog workqueue
	soundwire: stream: fix out of boundary access on port properties
	staging:iio:ad7150: fix threshold mode config bit
	mac80211: mesh: fix RCU warning
	mac80211: free peer keys before vif down in mesh
	mwifiex: Fix possible buffer overflows at parsing bss descriptor
	iwlwifi: Fix double-free problems in iwl_req_fw_callback()
	mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
	soundwire: intel: set dai min and max channels correctly
	dt-bindings: can: mcp251x: add mcp25625 support
	can: mcp251x: add support for mcp25625
	can: m_can: implement errata "Needless activation of MRAF irq"
	can: af_can: Fix error path of can_init()
	net: phy: rename Asix Electronics PHY driver
	ibmvnic: Do not close unopened driver during reset
	ibmvnic: Refresh device multicast list after reset
	ibmvnic: Fix unchecked return codes of memory allocations
	ARM: dts: am335x phytec boards: Fix cd-gpios active level
	s390/boot: disable address-of-packed-member warning
	drm/vmwgfx: Honor the sg list segment size limitation
	drm/vmwgfx: fix a warning due to missing dma_parms
	riscv: Fix udelay in RV32.
	Input: imx_keypad - make sure keyboard can always wake up system
	KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy
	mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed
	ARM: davinci: da850-evm: call regulator_has_full_constraints()
	ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
	mac80211: only warn once on chanctx_conf being NULL
	mac80211: do not start any work during reconfigure flow
	bpf, devmap: Fix premature entry free on destroying map
	bpf, devmap: Add missing bulk queue free
	bpf, devmap: Add missing RCU read lock on flush
	bpf, x64: fix stack layout of JITed bpf code
	qmi_wwan: add support for QMAP padding in the RX path
	qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode
	qmi_wwan: extend permitted QMAP mux_id value range
	mmc: core: complete HS400 before checking status
	md: fix for divide error in status_resync
	bnx2x: Check if transceiver implements DDM before access
	drm: return -EFAULT if copy_to_user() fails
	ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
	net: lio_core: fix potential sign-extension overflow on large shift
	scsi: qedi: Check targetname while finding boot target information
	quota: fix a problem about transfer quota
	net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge()
	NFS4: Only set creation opendata if O_CREAT
	net :sunrpc :clnt :Fix xps refcount imbalance on the error path
	fscrypt: don't set policy for a dead directory
	udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
	media: stv0297: fix frequency range limit
	ALSA: usb-audio: Fix parse of UAC2 Extension Units
	ALSA: hda/realtek - Headphone Mic can't record after S3
	block, bfq: NULL out the bic when it's no longer valid
	perf pmu: Fix uncore PMU alias list for ARM64
	x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
	x86/tls: Fix possible spectre-v1 in do_get_thread_area()
	Documentation: Add section about CPU vulnerabilities for Spectre
	Documentation/admin: Remove the vsyscall=native documentation
	mwifiex: Abort at too short BSS descriptor element
	mwifiex: Don't abort on small, spec-compliant vendor IEs
	USB: serial: ftdi_sio: add ID for isodebug v1
	USB: serial: option: add support for GosunCn ME3630 RNDIS mode
	Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
	p54usb: Fix race between disconnect and firmware loading
	usb: gadget: ether: Fix race between gether_disconnect and rx_submit
	usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset()
	usb: renesas_usbhs: add a workaround for a race condition of workqueue
	drivers/usb/typec/tps6598x.c: fix portinfo width
	drivers/usb/typec/tps6598x.c: fix 4CC cmd write
	staging: comedi: dt282x: fix a null pointer deref on interrupt
	staging: comedi: amplc_pci230: fix null pointer deref on interrupt
	HID: Add another Primax PIXART OEM mouse quirk
	lkdtm: support llvm-objcopy
	binder: fix memory leak in error path
	carl9170: fix misuse of device driver API
	VMCI: Fix integer overflow in VMCI handle arrays
	MIPS: Remove superfluous check for __linux__
	staging: fsl-dpaa2/ethsw: fix memory leak of switchdev_work
	staging: bcm2835-camera: Replace spinlock protecting context_map with mutex
	staging: bcm2835-camera: Ensure all buffers are returned on disable
	staging: bcm2835-camera: Remove check of the number of buffers supplied
	staging: bcm2835-camera: Handle empty EOS buffers whilst streaming
	staging: rtl8712: reduce stack usage, again
	Linux 4.19.59

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I650890ad9d984de0fc729677bd29506cd21338be
2019-07-14 08:44:38 +02:00
740b2ac495 ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
[ Upstream commit 6f6a8622057c92408930c31698394fae1557b188 ]

A similar fix to Patch "ip_tunnel: allow not to count pkts on tstats by
setting skb's dev to NULL" is also needed by ip6_tunnel.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-14 08:11:14 +02:00