Commit 68a56a7b authored Jul 16, 2018 by Blagovest Kolenichev

Merge android-4.9.112 (9e790395) into msm-4.9



* refs/heads/tmp-9e790395:
  Linux 4.9.112
  staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()
  netfilter: nf_log: don't hold nf_log_mutex during user access
  mtd: cfi_cmdset_0002: Change erase functions to check chip good only
  mtd: cfi_cmdset_0002: Change erase functions to retry for error
  mtd: cfi_cmdset_0002: Change definition naming to retry write operation
  dm bufio: don't take the lock in dm_bufio_shrink_count
  mtd: rawnand: mxc: set spare area size register explicitly
  dm bufio: drop the lock when doing GFP_NOIO allocation
  dm bufio: avoid sleeping while holding the dm_bufio lock
  mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
  media: cx25840: Use subdev host data for PLL override
  Kbuild: fix # escaping in .cmd files for future Make
  PM / OPP: Update voltage in case freq == old_freq
  HID: debug: check length before copy_to_user()
  HID: hiddev: fix potential Spectre v1
  HID: i2c-hid: Fix "incomplete report" noise
  mlxsw: spectrum: Forbid linking of VLAN devices to devices that have uppers
  ext4: check superblock mapped prior to committing
  ext4: add more mount time checks of the superblock
  ext4: add more inode number paranoia checks
  ext4: clear i_data in ext4_inode_info when removing inline data
  ext4: include the illegal physical block in the bad map ext4_error msg
  ext4: verify the depth of extent tree in ext4_find_extent()
  ext4: only look at the bg_flags field if it is valid
  ext4: always check block group bounds in ext4_init_block_bitmap()
  ext4: make sure bitmaps and the inode table don't overlap with bg descriptors
  jbd2: don't mark block as modified if the handle is out of credits
  drm/udl: fix display corruption of the last line
  cifs: Fix infinite loop when using hard mount option
  drbd: fix access after free
  s390: Correct register corruption in critical section cleanup
  scsi: sg: mitigate read/write abuse
  tracing: Fix missing return symbol in function_graph output
  mm: hugetlb: yield when prepping struct pages
  x86/cpu: Re-apply forced caps every time CPU caps are re-read
  x86/xen: Add call of speculative_store_bypass_ht_init() to PV paths
  IB/hfi1: Fix user context tail allocation for DMA_RTAIL
  ARM: dts: imx6q: Use correct SDMA script for SPI5 core
  net: phy: micrel: fix crash when statistic requested for KSZ9031 phy
  Revert "sit: reload iphdr in ipip6_rcv"
  netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
  kprobes/x86: Do not modify singlestep buffer while resuming
  ipv4: Fix error return value in fib_convert_metrics()
  i2c: rcar: fix resume by always initializing registers before transfer
  vt: prevent leaking uninitialized data to userspace via /dev/vcs*
  staging: android: ion: Return an ERR_PTR in ion_map_kernel
  n_tty: Access echo_* variables carefully.
  n_tty: Fix stall at n_tty_receive_char_special().
  usb: dwc2: fix the incorrect bitmaps for the ports of multi_tt hub
  USB: serial: cp210x: add Silicon Labs IDs for Windows Update
  USB: serial: cp210x: add CESINEL device ids
  usb: cdc_acm: Add quirk for Uniden UBC125 scanner

Change-Id: I0204423fdc9846b195022b0fec35e65f0fe41d83
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

parents fe646305 9e790395

Makefile

+1 −1

Original line number	Diff line number	Diff line
		VERSION = 4
		PATCHLEVEL = 9
		SUBLEVEL = 111
		SUBLEVEL = 112
		EXTRAVERSION =
		NAME = Roaring Lionus

arch/arm/boot/dts/imx6q.dtsi

+1 −1

Original line number	Diff line number	Diff line
		@@ -96,7 +96,7 @@
		clocks = <&clks IMX6Q_CLK_ECSPI5>,
		<&clks IMX6Q_CLK_ECSPI5>;
		clock-names = "ipg", "per";
		dmas = <&sdma 11 7 1>, <&sdma 12 7 2>;
		dmas = <&sdma 11 8 1>, <&sdma 12 8 2>;
		dma-names = "rx", "tx";
		status = "disabled";
		};

arch/s390/kernel/entry.S

+2 −2

Original line number	Diff line number	Diff line
		@@ -1187,7 +1187,7 @@ cleanup_critical:
		jl 0f
		clg %r9,BASED(.Lcleanup_table+104) # .Lload_fpu_regs_end
		jl .Lcleanup_load_fpu_regs
		0: BR_EX %r14
		0: BR_EX %r14,%r11

		.align 8
		.Lcleanup_table:
		@@ -1217,7 +1217,7 @@ cleanup_critical:
		ni __SIE_PROG0C+3(%r9),0xfe # no longer in SIE
		lctlg %c1,%c1,__LC_USER_ASCE # load primary asce
		larl %r9,sie_exit # skip forward to sie_exit
		BR_EX %r14
		BR_EX %r14,%r11
		#endif

		.Lcleanup_system_call:

arch/x86/kernel/cpu/common.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -848,6 +848,13 @@ void get_cpu_cap(struct cpuinfo_x86 *c)

		init_scattered_cpuid_features(c);
		init_speculation_control(c);

		/*
		* Clear/Set all flags overridden by options, after probe.
		* This needs to happen each time we re-probe, which may happen
		* several times during CPU initialization.
		*/
		apply_forced_caps(c);
		}

		static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)

arch/x86/kernel/kprobes/core.c

+20 −22

Original line number	Diff line number	Diff line
		@@ -414,25 +414,38 @@ void free_insn_page(void *page)
		module_memfree(page);
		}

		/* Prepare reljump right after instruction to boost */
		static void prepare_boost(struct kprobe *p, int length)
		{
		if (can_boost(p->ainsn.insn, p->addr) &&
		MAX_INSN_SIZE - length >= RELATIVEJUMP_SIZE) {
		/*
		* These instructions can be executed directly if it
		* jumps back to correct address.
		*/
		synthesize_reljump(p->ainsn.insn + length, p->addr + length);
		p->ainsn.boostable = 1;
		} else {
		p->ainsn.boostable = -1;
		}
		}

		static int arch_copy_kprobe(struct kprobe *p)
		{
		int ret;
		int len;

		set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1);

		/* Copy an instruction with recovering if other optprobe modifies it.*/
		ret = __copy_instruction(p->ainsn.insn, p->addr);
		if (!ret)
		len = __copy_instruction(p->ainsn.insn, p->addr);
		if (!len)
		return -EINVAL;

		/*
		* __copy_instruction can modify the displacement of the instruction,
		* but it doesn't affect boostable check.
		*/
		if (can_boost(p->ainsn.insn, p->addr))
		p->ainsn.boostable = 0;
		else
		p->ainsn.boostable = -1;
		prepare_boost(p, len);

		set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1);

		@@ -897,21 +910,6 @@ static void resume_execution(struct kprobe p, struct pt_regs regs,
		break;
		}

		if (p->ainsn.boostable == 0) {
		if ((regs->ip > copy_ip) &&
		(regs->ip - copy_ip) + 5 < MAX_INSN_SIZE) {
		/*
		* These instructions can be executed directly if it
		* jumps back to correct address.
		*/
		synthesize_reljump((void *)regs->ip,
		(void *)orig_ip + (regs->ip - copy_ip));
		p->ainsn.boostable = 1;
		} else {
		p->ainsn.boostable = -1;
		}
		}

		regs->ip += orig_ip - copy_ip;

		no_change: