Commit cb7518e6 authored Dec 27, 2017 by Greg Kroah-Hartman

Merge 4.9.72 into android-4.9



Changes in 4.9.72
	cxl: Check if vphb exists before iterating over AFU devices
	arm64: Initialise high_memory global variable earlier
	ALSA: hda - add support for docking station for HP 820 G2
	ALSA: hda - add support for docking station for HP 840 G3
	kvm: fix usage of uninit spinlock in avic_vm_destroy()
	HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB
	HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair
	arm: kprobes: Fix the return address of multiple kretprobes
	arm: kprobes: Align stack to 8-bytes in test code
	nvme-loop: handle cpu unplug when re-establishing the controller
	cpuidle: Validate cpu_dev in cpuidle_add_sysfs()
	r8152: fix the list rx_done may be used without initialization
	crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex
	vsock: track pkt owner vsock
	vhost-vsock: add pkt cancel capability
	vsock: cancel packets when failing to connect
	sch_dsmark: fix invalid skb_cow() usage
	bna: integer overflow bug in debugfs
	sctp: out_qlen should be updated when pruning unsent queue
	net: qmi_wwan: Add USB IDs for MDM6600 modem on Motorola Droid 4
	hwmon: (max31790) Set correct PWM value
	usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed
	usb: gadget: udc: remove pointer dereference after free
	netfilter: nfnl_cthelper: fix runtime expectation policy updates
	netfilter: nfnl_cthelper: Fix memory leak
	iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5
	r8152: fix the rx early size of RTL8153
	tipc: fix nametbl deadlock at tipc_nametbl_unsubscribe
	inet: frag: release spinlock before calling icmp_send()
	pinctrl: st: add irq_request/release_resources callbacks
	scsi: lpfc: Fix PT2PT PRLI reject
	kvm: vmx: Flush TLB when the APIC-access address changes
	KVM: x86: correct async page present tracepoint
	KVM: VMX: Fix enable VPID conditions
	ARM: dts: ti: fix PCI bus dtc warnings
	hwmon: (asus_atk0110) fix uninitialized data access
	HID: xinmo: fix for out of range for THT 2P arcade controller.
	ASoC: STI: Fix reader substream pointer set
	r8152: prevent the driver from transmitting packets with carrier off
	s390/qeth: size calculation outbound buffers
	s390/qeth: no ETH header for outbound AF_IUCV
	bna: avoid writing uninitialized data into hw registers
	i40iw: Receive netdev events post INET_NOTIFIER state
	IB/core: Protect against self-requeue of a cq work item
	infiniband: Fix alignment of mmap cookies to support VIPT caching
	nbd: set queue timeout properly
	net: Do not allow negative values for busy_read and busy_poll sysctl interfaces
	IB/rxe: double free on error
	IB/rxe: increment msn only when completing a request
	i40e: Do not enable NAPI on q_vectors that have no rings
	RDMA/iser: Fix possible mr leak on device removal event
	irda: vlsi_ir: fix check for DMA mapping errors
	netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table
	netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register
	ARM: dts: am335x-evmsk: adjust mmc2 param to allow suspend
	cpufreq: Fix creation of symbolic links to policy directories
	net: ipconfig: fix ic_close_devs() use-after-free
	KVM: pci-assign: do not map smm memory slot pages in vt-d page tables
	virtio-balloon: use actual number of stats for stats queue buffers
	virtio_balloon: prevent uninitialized variable use
	isdn: kcapi: avoid uninitialized data
	net: moxa: fix TX overrun memory leak
	xhci: plat: Register shutdown for xhci_plat
	netfilter: nfnetlink_queue: fix secctx memory leak
	Btrfs: fix an integer overflow check
	ARM: dma-mapping: disallow dma_get_sgtable() for non-kernel managed memory
	cpuidle: powernv: Pass correct drv->cpumask for registration
	bnxt_en: Fix NULL pointer dereference in reopen failure path
	backlight: pwm_bl: Fix overflow condition
	crypto: crypto4xx - increase context and scatter ring buffer elements
	rtc: pl031: make interrupt optional
	kvm, mm: account kvm related kmem slabs to kmemcg
	net: phy: at803x: Change error to EINVAL for invalid MAC
	PCI: Avoid bus reset if bridge itself is broken
	scsi: cxgb4i: fix Tx skb leak
	scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive
	PCI: Create SR-IOV virtfn/physfn links before attaching driver
	PM / OPP: Move error message to debug level
	igb: check memory allocation failure
	ixgbe: fix use of uninitialized padding
	IB/rxe: check for allocation failure on elem
	PCI/AER: Report non-fatal errors only to the affected endpoint
	tracing: Exclude 'generic fields' from histograms
	ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback
	fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw
	scsi: lpfc: Fix secure firmware updates
	scsi: lpfc: PLOGI failures during NPIV testing
	vfio/pci: Virtualize Maximum Payload Size
	fm10k: ensure we process SM mbx when processing VF mbx
	net: ipv6: send NS for DAD when link operationally up
	staging: greybus: light: Release memory obtained by kasprintf
	clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision
	tcp: fix under-evaluated ssthresh in TCP Vegas
	rtc: set the alarm to the next expiring timer
	cpuidle: fix broadcast control when broadcast can not be entered
	thermal: hisilicon: Handle return value of clk_prepare_enable
	thermal/drivers/hisi: Fix missing interrupt enablement
	thermal/drivers/hisi: Fix kernel panic on alarm interrupt
	thermal/drivers/hisi: Simplify the temperature/step computation
	thermal/drivers/hisi: Fix multiple alarm interrupts firing
	MIPS: math-emu: Fix final emulation phase for certain instructions
	platform/x86: asus-wireless: send an EV_SYN/SYN_REPORT between state changes
	Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
	bpf: adjust insn_aux_data when patching insns
	bpf: fix branch pruning logic
	bpf: reject out-of-bounds stack pointer calculation
	bpf: fix incorrect sign extension in check_alu_op()
	sparc32: Export vac_cache_size to fix build error
	Linux 4.9.72

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

parents 25063787 2df39793

Makefile

+1 −1

Original line number	Diff line number	Diff line
		VERSION = 4
		PATCHLEVEL = 9
		SUBLEVEL = 71
		SUBLEVEL = 72
		EXTRAVERSION =
		NAME = Roaring Lionus

arch/arm/boot/dts/am335x-evmsk.dts

+1 −0

Original line number	Diff line number	Diff line
		@@ -668,6 +668,7 @@
		ti,non-removable;
		bus-width = <4>;
		cap-power-off-card;
		keep-power-in-suspend;
		pinctrl-names = "default";
		pinctrl-0 = <&mmc2_pins>;

arch/arm/boot/dts/dra7.dtsi

+2 −0

Original line number	Diff line number	Diff line
		@@ -282,6 +282,7 @@
		device_type = "pci";
		ranges = <0x81000000 0 0 0x03000 0 0x00010000
		0x82000000 0 0x20013000 0x13000 0 0xffed000>;
		bus-range = <0x00 0xff>;
		#interrupt-cells = <1>;
		num-lanes = <1>;
		linux,pci-domain = <0>;
		@@ -318,6 +319,7 @@
		device_type = "pci";
		ranges = <0x81000000 0 0 0x03000 0 0x00010000
		0x82000000 0 0x30013000 0x13000 0 0xffed000>;
		bus-range = <0x00 0xff>;
		#interrupt-cells = <1>;
		num-lanes = <1>;
		linux,pci-domain = <1>;

arch/arm/mm/dma-mapping.c

+19 −1

Original line number	Diff line number	Diff line
		@@ -930,13 +930,31 @@ static void arm_coherent_dma_free(struct device dev, size_t size, void cpu_add
		__arm_dma_free(dev, size, cpu_addr, handle, attrs, true);
		}

		/*
		* The whole dma_get_sgtable() idea is fundamentally unsafe - it seems
		* that the intention is to allow exporting memory allocated via the
		* coherent DMA APIs through the dma_buf API, which only accepts a
		* scattertable. This presents a couple of problems:
		* 1. Not all memory allocated via the coherent DMA APIs is backed by
		* a struct page
		* 2. Passing coherent DMA memory into the streaming APIs is not allowed
		* as we will try to flush the memory through a different alias to that
		* actually being used (and the flushes are redundant.)
		*/
		int arm_dma_get_sgtable(struct device dev, struct sg_table sgt,
		void *cpu_addr, dma_addr_t handle, size_t size,
		unsigned long attrs)
		{
		struct page *page = pfn_to_page(dma_to_pfn(dev, handle));
		unsigned long pfn = dma_to_pfn(dev, handle);
		struct page *page;
		int ret;

		/* If the PFN is not valid, we do not have a struct page */
		if (!pfn_valid(pfn))
		return -ENXIO;

		page = pfn_to_page(pfn);

		ret = sg_alloc_table(sgt, 1, GFP_KERNEL);
		if (unlikely(ret))
		return ret;

arch/arm/probes/kprobes/core.c

+22 −2

Original line number	Diff line number	Diff line
		@@ -433,6 +433,7 @@ static __used __kprobes void trampoline_handler(struct pt_regs regs)
		struct hlist_node *tmp;
		unsigned long flags, orig_ret_address = 0;
		unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
		kprobe_opcode_t *correct_ret_addr = NULL;

		INIT_HLIST_HEAD(&empty_rp);
		kretprobe_hash_lock(current, &head, &flags);
		@@ -455,14 +456,34 @@ static __used __kprobes void trampoline_handler(struct pt_regs regs)
		/* another task is sharing our hash bucket */
		continue;

		orig_ret_address = (unsigned long)ri->ret_addr;

		if (orig_ret_address != trampoline_address)
		/*
		* This is the real return address. Any other
		* instances associated with this task are for
		* other calls deeper on the call stack
		*/
		break;
		}

		kretprobe_assert(ri, orig_ret_address, trampoline_address);

		correct_ret_addr = ri->ret_addr;
		hlist_for_each_entry_safe(ri, tmp, head, hlist) {
		if (ri->task != current)
		/* another task is sharing our hash bucket */
		continue;

		orig_ret_address = (unsigned long)ri->ret_addr;
		if (ri->rp && ri->rp->handler) {
		__this_cpu_write(current_kprobe, &ri->rp->kp);
		get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
		ri->ret_addr = correct_ret_addr;
		ri->rp->handler(ri, regs);
		__this_cpu_write(current_kprobe, NULL);
		}

		orig_ret_address = (unsigned long)ri->ret_addr;
		recycle_rp_inst(ri, &empty_rp);

		if (orig_ret_address != trampoline_address)
		@@ -474,7 +495,6 @@ static __used __kprobes void trampoline_handler(struct pt_regs regs)
		break;
		}

		kretprobe_assert(ri, orig_ret_address, trampoline_address);
		kretprobe_hash_unlock(current, &flags);

		hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {