Commit 9bc46222 authored May 25, 2017 by Greg Kroah-Hartman

Merge 4.4.70 into android-4.4



Changes in 4.4.70
	usb: misc: legousbtower: Fix buffers on stack
	usb: misc: legousbtower: Fix memory leak
	USB: ene_usb6250: fix DMA to the stack
	watchdog: pcwd_usb: fix NULL-deref at probe
	char: lp: fix possible integer overflow in lp_setup()
	USB: core: replace %p with %pK
	ARM: tegra: paz00: Mark panel regulator as enabled on boot
	tpm_crb: check for bad response size
	infiniband: call ipv6 route lookup via the stub interface
	dm btree: fix for dm_btree_find_lowest_key()
	dm raid: select the Kconfig option CONFIG_MD_RAID0
	dm bufio: avoid a possible ABBA deadlock
	dm bufio: check new buffer allocation watermark every 30 seconds
	dm cache metadata: fail operations if fail_io mode has been established
	dm bufio: make the parameter "retain_bytes" unsigned long
	dm thin metadata: call precommit before saving the roots
	dm space map disk: fix some book keeping in the disk space map
	md: update slab_cache before releasing new stripes when stripes resizing
	rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
	mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
	ima: accept previously set IMA_NEW_FILE
	KVM: x86: Fix load damaged SSEx MXCSR register
	KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
	regulator: tps65023: Fix inverted core enable logic.
	s390/kdump: Add final note
	s390/cputime: fix incorrect system time
	ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
	ath9k_htc: fix NULL-deref at probe
	drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
	drm/amdgpu: Make display watermark calculations more accurate
	drm/nouveau/therm: remove ineffective workarounds for alarm bugs
	drm/nouveau/tmr: ack interrupt before processing alarms
	drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
	drm/nouveau/tmr: avoid processing completed alarms when adding a new one
	drm/nouveau/tmr: handle races with hw when updating the next alarm time
	cdc-acm: fix possible invalid access when processing notification
	proc: Fix unbalanced hard link numbers
	of: fix sparse warning in of_pci_range_parser_one
	iio: dac: ad7303: fix channel description
	pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
	pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
	USB: serial: ftdi_sio: fix setting latency for unprivileged users
	USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
	ext4 crypto: don't let data integrity writebacks fail with ENOMEM
	ext4 crypto: fix some error handling
	net: qmi_wwan: Add SIMCom 7230E
	fscrypt: fix context consistency check when key(s) unavailable
	f2fs: check entire encrypted bigname when finding a dentry
	fscrypt: avoid collisions when presenting long encrypted filenames
	sched/fair: Do not announce throttled next buddy in dequeue_task_fair()
	sched/fair: Initialize throttle_count for new task-groups lazily
	usb: host: xhci-plat: propagate return value of platform_get_irq()
	xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
	usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
	net: irda: irda-usb: fix firmware name on big-endian hosts
	usbvision: fix NULL-deref at probe
	mceusb: fix NULL-deref at probe
	ttusb2: limit messages to buffer size
	usb: musb: tusb6010_omap: Do not reset the other direction's packet size
	USB: iowarrior: fix info ioctl on big-endian hosts
	usb: serial: option: add Telit ME910 support
	USB: serial: qcserial: add more Lenovo EM74xx device IDs
	USB: serial: mct_u232: fix big-endian baud-rate handling
	USB: serial: io_ti: fix div-by-zero in set_termios
	USB: hub: fix SS hub-descriptor handling
	USB: hub: fix non-SS hub-descriptor handling
	ipx: call ipxitf_put() in ioctl error path
	iio: proximity: as3935: fix as3935_write
	ceph: fix recursion between ceph_set_acl() and __ceph_setattr()
	gspca: konica: add missing endpoint sanity check
	s5p-mfc: Fix unbalanced call to clock management
	dib0700: fix NULL-deref at probe
	zr364xx: enforce minimum size when reading header
	dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
	cx231xx-audio: fix init error path
	cx231xx-audio: fix NULL-deref at probe
	cx231xx-cards: fix NULL-deref at probe
	powerpc/book3s/mce: Move add_taint() later in virtual mode
	powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
	powerpc/64e: Fix hang when debugging programs with relocated kernel
	ARM: dts: at91: sama5d3_xplained: fix ADC vref
	ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
	arm64: xchg: hazard against entire exchange variable
	arm64: uaccess: ensure extension of access_ok() addr
	arm64: documentation: document tagged pointer stack constraints
	xc2028: Fix use-after-free bug properly
	mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp
	staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
	staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
	iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
	metag/uaccess: Fix access_ok()
	metag/uaccess: Check access_ok in strncpy_from_user
	uwb: fix device quirk on big-endian hosts
	genirq: Fix chained interrupt data ordering
	osf_wait4(): fix infoleak
	tracing/kprobes: Enforce kprobes teardown after testing
	PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
	PCI: Freeze PME scan before suspending devices
	drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
	nfsd: encoders mustn't use unitialized values in error cases
	drivers: char: mem: Check for address space wraparound with mmap()
	Linux 4.4.70

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

parents 200f49cf b409ba3b

Documentation/arm64/tagged-pointers.txt

+47 −15

Original line number	Diff line number	Diff line
		@@ -11,24 +11,56 @@ in AArch64 Linux.
		The kernel configures the translation tables so that translations made
		via TTBR0 (i.e. userspace mappings) have the top byte (bits 63:56) of
		the virtual address ignored by the translation hardware. This frees up
		this byte for application use, with the following caveats:
		this byte for application use.

		(1) The kernel requires that all user addresses passed to EL1
		are tagged with tag 0x00. This means that any syscall
		parameters containing user virtual addresses must have
		their top byte cleared before trapping to the kernel.

		(2) Non-zero tags are not preserved when delivering signals.
		This means that signal handlers in applications making use
		of tags cannot rely on the tag information for user virtual
		addresses being maintained for fields inside siginfo_t.
		One exception to this rule is for signals raised in response
		to watchpoint debug exceptions, where the tag information
		will be preserved.
		Passing tagged addresses to the kernel
		--------------------------------------

		(3) Special care should be taken when using tagged pointers,
		since it is likely that C compilers will not hazard two
		virtual addresses differing only in the upper byte.
		All interpretation of userspace memory addresses by the kernel assumes
		an address tag of 0x00.

		This includes, but is not limited to, addresses found in:

		- pointer arguments to system calls, including pointers in structures
		passed to system calls,

		- the stack pointer (sp), e.g. when interpreting it to deliver a
		signal,

		- the frame pointer (x29) and frame records, e.g. when interpreting
		them to generate a backtrace or call graph.

		Using non-zero address tags in any of these locations may result in an
		error code being returned, a (fatal) signal being raised, or other modes
		of failure.

		For these reasons, passing non-zero address tags to the kernel via
		system calls is forbidden, and using a non-zero address tag for sp is
		strongly discouraged.

		Programs maintaining a frame pointer and frame records that use non-zero
		address tags may suffer impaired or inaccurate debug and profiling
		visibility.


		Preserving tags
		---------------

		Non-zero tags are not preserved when delivering signals. This means that
		signal handlers in applications making use of tags cannot rely on the
		tag information for user virtual addresses being maintained for fields
		inside siginfo_t. One exception to this rule is for signals raised in
		response to watchpoint debug exceptions, where the tag information will
		be preserved.

		The architecture prevents the use of a tagged PC, so the upper byte will
		be set to a sign-extension of bit 55 on exception return.


		Other considerations
		--------------------

		Special care should be taken when using tagged pointers, since it is
		likely that C compilers will not hazard two virtual addresses differing
		only in the upper byte.

Makefile

+1 −1

Original line number	Diff line number	Diff line
		VERSION = 4
		PATCHLEVEL = 4
		SUBLEVEL = 69
		SUBLEVEL = 70
		EXTRAVERSION =
		NAME = Blurry Fish Butt

arch/alpha/kernel/osf_sys.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -1188,8 +1188,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
		if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
		return -EFAULT;

		err = 0;
		err \|= put_user(status, ustatus);
		err = put_user(status, ustatus);
		if (ret < 0)
		return err ? err : ret;

		err \|= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
		err \|= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
		err \|= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);

arch/arm/boot/dts/at91-sama5d3_xplained.dts

+2 −3

Original line number	Diff line number	Diff line
		@@ -162,9 +162,10 @@
		};

		adc0: adc@f8018000 {
		atmel,adc-vref = <3300>;
		atmel,adc-channels-used = <0xfe>;
		pinctrl-0 = <
		&pinctrl_adc0_adtrg
		&pinctrl_adc0_ad0
		&pinctrl_adc0_ad1
		&pinctrl_adc0_ad2
		&pinctrl_adc0_ad3
		@@ -172,8 +173,6 @@
		&pinctrl_adc0_ad5
		&pinctrl_adc0_ad6
		&pinctrl_adc0_ad7
		&pinctrl_adc0_ad8
		&pinctrl_adc0_ad9
		>;
		status = "okay";
		};

arch/arm/boot/dts/tegra20-paz00.dts

+1 −0

Original line number	Diff line number	Diff line
		@@ -565,6 +565,7 @@
		regulator-name = "+3VS,vdd_pnl";
		regulator-min-microvolt = <3300000>;
		regulator-max-microvolt = <3300000>;
		regulator-boot-on;
		gpio = <&gpio TEGRA_GPIO(A, 4) GPIO_ACTIVE_HIGH>;
		enable-active-high;
		};