Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a32f2cd7 authored by Srinivasarao P's avatar Srinivasarao P
Browse files

Merge android-4.4.182 (9c4ab572) into msm-4.4 



* refs/heads/tmp-9c4ab572
  Linux 4.4.182
  tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
  tcp: add tcp_min_snd_mss sysctl
  tcp: tcp_fragment() should apply sane memory limits
  tcp: limit payload size of sacked skbs
  UPSTREAM: binder: check for overflow when alloc for security context
  BACKPORT: binder: fix race between munmap() and direct reclaim

Change-Id: I4cfb9eb282f54f083631fec4c8161eed42e8ab54
Signed-off-by: default avatarSrinivasarao P <spathi@codeaurora.org>
parents 17c66e9e 9c4ab572

Documentation/networking/ip-sysctl.txt

+8 −0
Original line number Diff line number Diff line
@@ -220,6 +220,14 @@ tcp_base_mss - INTEGER 
	Path MTU discovery (MTU probing).  If MTU probing is enabled,

	this is the initial MSS used by the connection.



tcp_min_snd_mss - INTEGER

	TCP SYN and SYNACK messages usually advertise an ADVMSS option,

	as described in RFC 1122 and RFC 6691.

	If this ADVMSS option is smaller than tcp_min_snd_mss,

	it is silently capped to tcp_min_snd_mss.



	Default : 48 (at least 8 bytes of payload per segment)



tcp_congestion_control - STRING

	Set the congestion control algorithm to be used for new

	connections. The algorithm "reno" is always available, but

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 4

PATCHLEVEL = 4

SUBLEVEL = 181

SUBLEVEL = 182

EXTRAVERSION =

NAME = Blurry Fish Butt

drivers/android/binder.c

+11 −1
Original line number Diff line number Diff line
@@ -3130,6 +3130,7 @@ static void binder_transaction(struct binder_proc *proc, 


	if (target_node && target_node->txn_security_ctx) {

		u32 secid;

		size_t added_size;



		security_task_getsecid(proc->tsk, &secid);

		ret = security_secid_to_secctx(secid, &secctx, &secctx_sz);
@@ -3139,7 +3140,15 @@ static void binder_transaction(struct binder_proc *proc, 
			return_error_line = __LINE__;

			goto err_get_secctx_failed;

		}

		extra_buffers_size += ALIGN(secctx_sz, sizeof(u64));

		added_size = ALIGN(secctx_sz, sizeof(u64));

		extra_buffers_size += added_size;

		if (extra_buffers_size < added_size) {

			/* integer overflow of extra_buffers_size */

			return_error = BR_FAILED_REPLY;

			return_error_param = EINVAL;

			return_error_line = __LINE__;

			goto err_bad_extra_size;

		}

	}



	trace_binder_transaction(reply, t, target_node);
@@ -3441,6 +3450,7 @@ err_copy_data_failed: 
	t->buffer->transaction = NULL;

	binder_alloc_free_buf(&target_proc->alloc, t->buffer);

err_binder_alloc_buf_failed:

err_bad_extra_size:

	if (secctx)

		security_release_secctx(secctx, secctx_sz);

err_get_secctx_failed:

drivers/android/binder_alloc.c

+9 −11
Original line number Diff line number Diff line
@@ -924,15 +924,14 @@ enum lru_status binder_alloc_free_page(struct list_head *item, 


	index = page - alloc->pages;

	page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;

	vma = alloc->vma;

	if (vma) {



	mm = alloc->vma_vm_mm;

	/* Same as mmget_not_zero() in later kernel versions */

	if (!atomic_inc_not_zero(&alloc->vma_vm_mm->mm_users))

		goto err_mmget;

		mm = alloc->vma_vm_mm;

	if (!down_write_trylock(&mm->mmap_sem))

		goto err_down_write_mmap_sem_failed;

	}

	vma = alloc->vma;



	list_lru_isolate(lru, item);

	spin_unlock(lock);
@@ -946,10 +945,9 @@ enum lru_status binder_alloc_free_page(struct list_head *item, 
			       PAGE_SIZE, NULL);



		trace_binder_unmap_user_end(alloc, index);



	}

	up_write(&mm->mmap_sem);

	mmput(mm);

	}



	trace_binder_unmap_kernel_start(alloc, index);

include/linux/tcp.h

+3 −0
Original line number Diff line number Diff line
@@ -419,4 +419,7 @@ static inline void tcp_saved_syn_free(struct tcp_sock *tp) 
	tp->saved_syn = NULL;

}



int tcp_skb_shift(struct sk_buff *to, struct sk_buff *from, int pcount,

		  int shiftlen);



#endif	/* _LINUX_TCP_H */