Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 668ee6e3 authored by jianzhou's avatar jianzhou
Browse files

Merge android-4.9.222(5da84b2c) into msm-4.9 



* refs/heads/tmp-5da84b2c:
  Linux 4.9.222
  drm/qxl: qxl_release use after free
  selinux: properly handle multiple messages in selinux_netlink_send()
  dmaengine: dmatest: Fix iteration non-stop logic
  nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
  ALSA: opti9xx: shut up gcc-10 range warning
  iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system
  vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
  RDMA/mlx4: Initialize ib_spec on the stack
  dm verity fec: fix hash block number in verity_fec_decode
  PM: hibernate: Freeze kernel threads in software_resume()
  PM: ACPI: Output correct message on target power state
  ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
  ALSA: hda/hdmi: fix without unlocked before return
  btrfs: fix block group leak when removing fails
  drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
  drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
  drm/edid: Fix off-by-one in DispID DTD pixel clock
  ext4: fix special inode number checks in __ext4_iget()

Change-Id: I86eedb2817d75310fb04c13f98618a97091ce133
Signed-off-by: default avatarjianzhou <jianzhou@codeaurora.org>
parents c4a753dd 5da84b2c

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 4

PATCHLEVEL = 9

SUBLEVEL = 221

SUBLEVEL = 222

EXTRAVERSION =

NAME = Roaring Lionus

drivers/acpi/device_pm.c

+2 −2
Original line number Diff line number Diff line
@@ -226,13 +226,13 @@ int acpi_device_set_power(struct acpi_device *device, int state) 
 end:

	if (result) {

		dev_warn(&device->dev, "Failed to change power state to %s\n",

			 acpi_power_state_string(state));

			 acpi_power_state_string(target_state));

	} else {

		device->power.state = target_state;

		ACPI_DEBUG_PRINT((ACPI_DB_INFO,

				  "Device [%s] transitioned to %s\n",

				  device->pnp.bus_id,

				  acpi_power_state_string(state)));

				  acpi_power_state_string(target_state)));

	}



	return result;

drivers/dma/dmatest.c

+2 −2
Original line number Diff line number Diff line
@@ -505,8 +505,8 @@ static int dmatest_func(void *data) 
	flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;



	ktime = ktime_get();

	while (!kthread_should_stop()

	       && !(params->iterations && total_tests >= params->iterations)) {

	while (!(kthread_should_stop() ||

	       (params->iterations && total_tests >= params->iterations))) {

		struct dma_async_tx_descriptor *tx = NULL;

		struct dmaengine_unmap_data *um;

		dma_addr_t srcs[src_cnt];

drivers/gpu/drm/drm_edid.c

+1 −1
Original line number Diff line number Diff line
@@ -4523,7 +4523,7 @@ static struct drm_display_mode *drm_mode_displayid_detailed(struct drm_device *d 
	struct drm_display_mode *mode;

	unsigned pixel_clock = (timings->pixel_clock[0] |

				(timings->pixel_clock[1] << 8) |

				(timings->pixel_clock[2] << 16));

				(timings->pixel_clock[2] << 16)) + 1;

	unsigned hactive = (timings->hactive[0] | timings->hactive[1] << 8) + 1;

	unsigned hblank = (timings->hblank[0] | timings->hblank[1] << 8) + 1;

	unsigned hsync = (timings->hsync[0] | (timings->hsync[1] & 0x7f) << 8) + 1;

drivers/gpu/drm/qxl/qxl_cmd.c

+5 −5
Original line number Diff line number Diff line
@@ -500,9 +500,10 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, 
		return ret;



	ret = qxl_release_reserve_list(release, true);

	if (ret)

	if (ret) {

		qxl_release_free(qdev, release);

		return ret;



	}

	cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);

	cmd->type = QXL_SURFACE_CMD_CREATE;

	cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
@@ -528,8 +529,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, 
	/* no need to add a release to the fence for this surface bo,

	   since it is only released when we ask to destroy the surface

	   and it would never signal otherwise */

	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);

	qxl_release_fence_buffer_objects(release);

	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);



	surf->hw_surf_alloc = true;

	spin_lock(&qdev->surf_id_idr_lock);
@@ -571,9 +572,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev, 
	cmd->surface_id = id;

	qxl_release_unmap(qdev, release, &cmd->release_info);



	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);



	qxl_release_fence_buffer_objects(release);

	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);



	return 0;

}