Commit 973c3ed7 authored Mar 01, 2018 by Chetan C R

Merge google common 'android-3.18' into 'msm-3.18'



Merge with google common 'android-3.18' at
ba855159 into 'msm-3.18'
* quic/tmp-ba855159:
  Linux 3.18.94

  ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree
  Linux 3.18.94
  um: Fix out-of-tree build
  ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  spi: imx: do not access registers while clocks disabled
  selinux: general protection fault in sock_has_perm
  CDC-ACM: apply quirk for card reader
  staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID
  media: usbtv: add a new usbid
  scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg
  quota: Check for register_shrinker() failure.
  net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit
  hwmon: (pmbus) Use 64bit math for DIRECT format values
  nfsd: check for use of the closed special stateid
  nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0)
  xen-netfront: remove warning when unloading module
  KVM: VMX: Fix rflags cache during vCPU reset
  mac80211: fix the update of path metric for RANN frame
  bcache: check return value of register_shrinker
  KVM: X86: Fix operand/address-size during instruction decoding
  KVM: x86: Don't re-execute instruction when not passing CR2 value
  KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure
  igb: Free IRQs when device is hotplugged
  gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  ALSA: seq: Make ioctls race-free
  loop: fix concurrent lo_open/lo_release
  um: Remove copy&paste code from init.h
  um: Stop abusing __KERNEL__
  um: link vmlinux with -no-pie
  Input: do not emit unneeded EV_SYN when suspending
  UPSTREAM: ANDROID: binder: remove waitqueue when thread exits.
  ANDROID: sdcardfs: Protect set_top
  ANDROID: fsnotify: Notify lower fs of open
  Revert "ANDROID: sdcardfs: notify lower file of opens"
  ANDROID: sdcardfs: Use lower getattr times/size
  Linux 3.18.93
  hrtimer: Reset hrtimer cpu base proper on CPU hotplug
  ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY
  ipv6: fix udpv6 sendmsg crash caused by too small MTU
  net: Allow neigh contructor functions ability to modify the primary_key
  vmxnet3: repair memory leak
  sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf
  sctp: do not allow the v4 socket to bind a v4mapped v6 address
  pppoe: take ->needed_headroom of lower device into account on xmit
  net: qdisc_pkt_len_init() should be more robust
  tcp: __tcp_hdrlen() helper
  net: igmp: fix source address check for IGMPv3 reports
  dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state
  net: tcp: close sock if net namespace is exiting
  x86/microcode/intel: Extend BDW late-loading further with LLC size check
  eventpoll.h: add missing epoll event masks
  scsi: libiscsi: fix shifting of DID_REQUEUE host byte
  fs/fcntl: f_setown, avoid undefined behaviour
  reiserfs: don't preallocate blocks for extended attributes
  reiserfs: fix race in prealloc discard
  netfilter: xt_osf: Add missing permission checks
  netfilter: nfnetlink_cthelper: Add missing permission checks
  netfilter: nf_conntrack_sip: extend request line validation
  netfilter: restart search if moved to other chain
  netfilter: nf_ct_expect: remove the redundant slash when policy name is empty
  ipc: msg, make msgrcv work with LONG_MIN
  hwpoison, memcg: forcibly uncharge LRU pages
  mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack
  can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once
  can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once
  x86/asm/32: Make sync_core() handle missing CPUID on all 32-bit kernels
  MIPS: AR7: ensure the port type's FCR value is used
  arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
  dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6
  dm btree: fix serious bug in btree_split_beneath()
  ARM: dts: kirkwood: fix pin-muxing of MPP7 on OpenBlocks A7
  phy: work around 'phys' references to usb-nop-xceiv devices
  Input: twl4030-vibra - fix sibling-node lookup
  Input: twl4030-vibra - fix ERROR: Bad of_node_put() warning
  Input: twl6040-vibra - fix child-node lookup
  Input: twl6040-vibra - fix DT node memory management
  Input: 88pm860x-ts - fix child-node lookup
  pipe: avoid round_pipe_size() nr_pages overflow on 32-bit
  af_key: fix buffer overread in parse_exthdrs()
  af_key: fix buffer overread in verify_address_len()
  ALSA: hda - Apply the existing quirk to iMac 14,1
  ALSA: pcm: Remove yet superfluous WARN_ON()
  futex: Prevent overflow by strengthen input validation
  scsi: sg: disable SET_FORCE_LOW_DMA
  gcov: disable for COMPILE_TEST
  UPSTREAM: eventpoll.h: add missing epoll event masks
  ANDROID: ext4: don't put symlink in pagecache into highmem
  blkdev: Refactoring block io latency histogram codes
  ANDROID: xattr: Pass EOPNOTSUPP to permission2
  ANDROID: sdcardfs: Move default_normal to superblock
  FROMLIST: arm64: kpti: Fix the interaction between ASID switching and software PAN
  FROMLIST: arm64: Move post_ttbr_update_workaround to C code
  Linux 3.18.92
  e1000e: Fix e1000_check_for_copper_link_ich8lan return value.
  uas: ignore UAS for Norelsys NS1068(X) chips
  Bluetooth: Prevent stack info leak from the EFS element.
  staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl
  target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK
  iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref
  x86/microcode/intel: Extend BDW late-loading with a revision check
  crypto: algapi - fix NULL dereference in crypto_remove_spawns()
  net: stmmac: enable EEE in MII, GMII or RGMII only
  sh_eth: fix SH7757 GEther initialization
  sh_eth: fix TSU resource handling
  RDS: null pointer dereference in rds_atomic_free_op
  RDS: Heap OOB write in rds_message_alloc_sgs()
  8021q: fix a memory leak for VLAN 0 device
  x86/acpi: Reduce code duplication in mp_override_legacy_irq()
  ALSA: aloop: Fix racy hw constraints adjustment
  ALSA: aloop: Fix inconsistent format due to incomplete rule
  ALSA: aloop: Release cable upon open error path
  ALSA: pcm: Allow aborting mutex lock at OSS read/write loops
  ALSA: pcm: Abort properly at pending signal in OSS read/write loops
  ALSA: pcm: Add missing error checks in OSS emulation plugin builder
  ALSA: pcm: Remove incorrect snd_BUG_ON() usages
  x86/acpi: Handle SCI interrupts above legacy space gracefully
  kvm: vmx: Scrub hardware GPRs at VM-exit
  perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race
  MIPS: Also verify sizeof `elf_fpreg_t' with PTRACE_SETREGSET
  MIPS: Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses
  MIPS: Fix an FCSR access API regression with NT_PRFPREG and MSA
  MIPS: Consistently handle buffer counter with PTRACE_SETREGSET
  MIPS: Guard against any partial write attempt with PTRACE_SETREGSET
  MIPS: Factor out NT_PRFPREG regset access helpers
  IB/srpt: Disable RDMA access by the initiator
  Input: elantech - add new icbody type 15
  kernel/signal.c: remove the no longer needed SIGNAL_UNKILLABLE check in complete_signal()
  kernel/signal.c: protect the SIGNAL_UNKILLABLE tasks from !sig_kernel_only() signals
  kernel/signal.c: protect the traced SIGNAL_UNKILLABLE tasks from SIGKILL
  fscache: Fix the default for fscache_maybe_release_page()
  crypto: n2 - cure use after free
  kernel/acct.c: fix the acct->needcheck check in check_free_space()
  ANDROID: Kconfig: add depends for UID_SYS_STATS
  fscrypt: updates on 4.15-rc4
  ANDROID: uid_sys_stats: fix the comment
  ANDROID: base: dd: Export driver_probe_done()
  ANDROID dm-verity: fix root device init timing issue.
  clocksource: arch_timer: make virtual counter access configurable
  arm64: issue isb when trapping CNTVCT_EL0 access
  BACKPORT: arm64: Add CNTFRQ_EL0 trap handler
  BACKPORT: arm64: Add CNTVCT_EL0 trap handler
  ANDROID: sdcardfs: Fix missing break on default_normal
  arm64: Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry
  arm64: use RET instruction for exiting the trampoline
  FROMLIST: arm64: kaslr: Put kernel vectors address in separate data page
  FROMLIST: arm64: mm: Introduce TTBR_ASID_MASK for getting at the ASID in the TTBR
  FROMLIST: arm64: Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0
  FROMLIST: arm64: entry: Add fake CPU feature for unmapping the kernel at EL0
  FROMLIST: arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks
  FROMLIST: arm64: erratum: Work around Falkor erratum #E1003 in trampoline code
  FROMLIST: arm64: entry: Hook up entry trampoline to exception vectors
  FROMLIST: arm64: entry: Explicitly pass exception level to kernel_ventry macro
  FROMLIST: arm64: mm: Map entry trampoline into trampoline and kernel page tables
  FROMLIST: arm64: entry: Add exception trampoline page for exceptions from EL0
  FROMLIST: arm64: mm: Invalidate both kernel and user ASIDs when performing TLBI
  FROMLIST: arm64: mm: Add arm64_kernel_unmapped_at_el0 helper
  FROMLIST: arm64: mm: Allocate ASIDs in pairs
  FROMLIST: arm64: mm: Fix and re-enable ARM64_SW_TTBR0_PAN
  FROMLIST: arm64: mm: Move ASID from TTBR0 to TTBR1
  FROMLIST: arm64: mm: Temporarily disable ARM64_SW_TTBR0_PAN
  FROMLIST: arm64: mm: Use non-global mappings for kernel space
  BACKPORT: arm64: fix R/O permissions of FDT mapping
  UPSTREAM: arm64: introduce mov_q macro to move a constant into a 64-bit register
  UPSTREAM: arm64: mm: keep reserved ASIDs in sync with mm after multiple rollovers
  UPSTREAM: arm64: factor out entry stack manipulation
  UPSTREAM: arm64: tlbflush.h: add __tlbi() macro
  ANDROID: sdcardfs: Add default_normal option
  ANDROID: sdcardfs: notify lower file of opens
  BACKPORT: aio: mark AIO pseudo-fs noexec

Conflicts:
	arch/arm64/Kconfig
	arch/arm64/include/asm/cpufeature.h
	arch/arm64/include/asm/mmu.h
	arch/arm64/include/asm/mmu_context.h
	arch/arm64/kernel/efi.c
	arch/arm64/mm/context.c
	arch/arm64/mm/mmu.c
	drivers/clocksource/arm_arch_timer.c
	drivers/input/input.c
	drivers/mmc/core/core.c
	drivers/scsi/sg.c
	drivers/usb/gadget/function/f_fs.c
	drivers/usb/serial/cp210x.c
	include/linux/mmc/host.h

USB related changes were ignored as per the feedback
from the USB team.

Change-Id: Ibe377d99a94a06fc45ed47478647dd798df1363b
Signed-off-by: Chetan C R <cravin@codeaurora.org>

parents 916aa65c ba855159

Makefile

+1 −1

Original line number	Diff line number	Diff line
		VERSION = 3
		PATCHLEVEL = 18
		SUBLEVEL = 91
		SUBLEVEL = 94
		EXTRAVERSION =
		NAME = Diseased Newt

arch/arm/boot/dts/kirkwood-openblocks_a7.dts

+8 −2

Original line number	Diff line number	Diff line
		@@ -53,7 +53,8 @@
		};

		pinctrl: pin-controller@10000 {
		pinctrl-0 = <&pmx_dip_switches &pmx_gpio_header>;
		pinctrl-0 = <&pmx_dip_switches &pmx_gpio_header
		&pmx_gpio_header_gpo>;
		pinctrl-names = "default";

		pmx_uart0: pmx-uart0 {
		@@ -85,11 +86,16 @@
		* ground.
		*/
		pmx_gpio_header: pmx-gpio-header {
		marvell,pins = "mpp17", "mpp7", "mpp29", "mpp28",
		marvell,pins = "mpp17", "mpp29", "mpp28",
		"mpp35", "mpp34", "mpp40";
		marvell,function = "gpio";
		};

		pmx_gpio_header_gpo: pxm-gpio-header-gpo {
		marvell,pins = "mpp7";
		marvell,function = "gpo";
		};

		pmx_gpio_init: pmx-init {
		marvell,pins = "mpp38";
		marvell,function = "gpio";

arch/arm64/kvm/handle_exit.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -34,7 +34,7 @@ static int handle_hvc(struct kvm_vcpu vcpu, struct kvm_run run)

		ret = kvm_psci_call(vcpu);
		if (ret < 0) {
		kvm_inject_undefined(vcpu);
		*vcpu_reg(vcpu, 0) = ~0UL;
		return 1;
		}

		@@ -43,7 +43,7 @@ static int handle_hvc(struct kvm_vcpu vcpu, struct kvm_run run)

		static int handle_smc(struct kvm_vcpu vcpu, struct kvm_run run)
		{
		kvm_inject_undefined(vcpu);
		*vcpu_reg(vcpu, 0) = ~0UL;
		return 1;
		}

arch/mips/ar7/platform.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -581,7 +581,7 @@ static int __init ar7_register_uarts(void)
		uart_port.type = PORT_AR7;
		uart_port.uartclk = clk_get_rate(bus_clk) / 2;
		uart_port.iotype = UPIO_MEM32;
		uart_port.flags = UPF_FIXED_TYPE;
		uart_port.flags = UPF_FIXED_TYPE \| UPF_BOOT_AUTOCONF;
		uart_port.regshift = 2;

		uart_port.line = 0;

arch/mips/kernel/ptrace.c

+122 −25

Original line number	Diff line number	Diff line
		@@ -400,61 +400,158 @@ static int gpr64_set(struct task_struct *target,

		#endif /* CONFIG_64BIT */

		/*
		* Copy the floating-point context to the supplied NT_PRFPREG buffer,
		* !CONFIG_CPU_HAS_MSA variant. FP context's general register slots
		* correspond 1:1 to buffer slots. Only general registers are copied.
		*/
		static int fpr_get_fpa(struct task_struct *target,
		unsigned int pos, unsigned int count,
		void kbuf, void __user ubuf)
		{
		return user_regset_copyout(pos, count, kbuf, ubuf,
		&target->thread.fpu,
		0, NUM_FPU_REGS * sizeof(elf_fpreg_t));
		}

		/*
		* Copy the floating-point context to the supplied NT_PRFPREG buffer,
		* CONFIG_CPU_HAS_MSA variant. Only lower 64 bits of FP context's
		* general register slots are copied to buffer slots. Only general
		* registers are copied.
		*/
		static int fpr_get_msa(struct task_struct *target,
		unsigned int pos, unsigned int count,
		void kbuf, void __user ubuf)
		{
		unsigned int i;
		u64 fpr_val;
		int err;

		BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
		for (i = 0; i < NUM_FPU_REGS; i++) {
		fpr_val = get_fpr64(&target->thread.fpu.fpr[i], 0);
		err = user_regset_copyout(pos, count, kbuf, ubuf,
		&fpr_val, i * sizeof(elf_fpreg_t),
		(i + 1) * sizeof(elf_fpreg_t));
		if (err)
		return err;
		}

		return 0;
		}

		/*
		* Copy the floating-point context to the supplied NT_PRFPREG buffer.
		* Choose the appropriate helper for general registers, and then copy
		* the FCSR register separately.
		*/
		static int fpr_get(struct task_struct *target,
		const struct user_regset *regset,
		unsigned int pos, unsigned int count,
		void kbuf, void __user ubuf)
		{
		unsigned i;
		const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
		int err;
		u64 fpr_val;

		/* XXX fcr31 */
		if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))
		err = fpr_get_fpa(target, &pos, &count, &kbuf, &ubuf);
		else
		err = fpr_get_msa(target, &pos, &count, &kbuf, &ubuf);
		if (err)
		return err;

		err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
		&target->thread.fpu.fcr31,
		fcr31_pos, fcr31_pos + sizeof(u32));

		if (sizeof(target->thread.fpu.fpr[i]) == sizeof(elf_fpreg_t))
		return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
		return err;
		}

		/*
		* Copy the supplied NT_PRFPREG buffer to the floating-point context,
		* !CONFIG_CPU_HAS_MSA variant. Buffer slots correspond 1:1 to FP
		* context's general register slots. Only general registers are copied.
		*/
		static int fpr_set_fpa(struct task_struct *target,
		unsigned int pos, unsigned int count,
		const void kbuf, const void __user ubuf)
		{
		return user_regset_copyin(pos, count, kbuf, ubuf,
		&target->thread.fpu,
		0, sizeof(elf_fpregset_t));
		0, NUM_FPU_REGS * sizeof(elf_fpreg_t));
		}

		for (i = 0; i < NUM_FPU_REGS; i++) {
		fpr_val = get_fpr64(&target->thread.fpu.fpr[i], 0);
		err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
		/*
		* Copy the supplied NT_PRFPREG buffer to the floating-point context,
		* CONFIG_CPU_HAS_MSA variant. Buffer slots are copied to lower 64
		* bits only of FP context's general register slots. Only general
		* registers are copied.
		*/
		static int fpr_set_msa(struct task_struct *target,
		unsigned int pos, unsigned int count,
		const void kbuf, const void __user ubuf)
		{
		unsigned int i;
		u64 fpr_val;
		int err;

		BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
		for (i = 0; i < NUM_FPU_REGS && *count > 0; i++) {
		err = user_regset_copyin(pos, count, kbuf, ubuf,
		&fpr_val, i * sizeof(elf_fpreg_t),
		(i + 1) * sizeof(elf_fpreg_t));
		if (err)
		return err;
		set_fpr64(&target->thread.fpu.fpr[i], 0, fpr_val);
		}

		return 0;
		}

		/*
		* Copy the supplied NT_PRFPREG buffer to the floating-point context.
		* Choose the appropriate helper for general registers, and then copy
		* the FCSR register separately.
		*
		* We optimize for the case where `count % sizeof(elf_fpreg_t) == 0',
		* which is supposed to have been guaranteed by the kernel before
		* calling us, e.g. in `ptrace_regset'. We enforce that requirement,
		* so that we can safely avoid preinitializing temporaries for
		* partial register writes.
		*/
		static int fpr_set(struct task_struct *target,
		const struct user_regset *regset,
		unsigned int pos, unsigned int count,
		const void kbuf, const void __user ubuf)
		{
		unsigned i;
		const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
		u32 fcr31;
		int err;
		u64 fpr_val;

		/* XXX fcr31 */
		BUG_ON(count % sizeof(elf_fpreg_t));

		if (sizeof(target->thread.fpu.fpr[i]) == sizeof(elf_fpreg_t))
		return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
		&target->thread.fpu,
		0, sizeof(elf_fpregset_t));
		if (pos + count > sizeof(elf_fpregset_t))
		return -EIO;

		BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
		for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) {
		if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))
		err = fpr_set_fpa(target, &pos, &count, &kbuf, &ubuf);
		else
		err = fpr_set_msa(target, &pos, &count, &kbuf, &ubuf);
		if (err)
		return err;

		if (count > 0) {
		err = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
		&fpr_val, i * sizeof(elf_fpreg_t),
		(i + 1) * sizeof(elf_fpreg_t));
		&fcr31,
		fcr31_pos, fcr31_pos + sizeof(u32));
		if (err)
		return err;
		set_fpr64(&target->thread.fpu.fpr[i], 0, fpr_val);

		target->thread.fpu.fcr31 = fcr31 & ~FPU_CSR_ALL_X;
		}

		return 0;
		return err;
		}

		enum mips_regset {