OSDN Git Service
Linux Build Service Account [Tue, 18 Sep 2018 07:58:34 +0000 (00:58 -0700)]
Merge "defconfig: msm8998: align with android config requirement"
Linux Build Service Account [Mon, 17 Sep 2018 21:15:32 +0000 (14:15 -0700)]
Merge "ASoC: msm: qdsp6v2: Handle invalid session for dtmf enable"
Linux Build Service Account [Mon, 17 Sep 2018 21:15:31 +0000 (14:15 -0700)]
Merge "soc: qcom: hab: add IRQF_NO_SUSPEND to irq flags."
Soumya Managoli [Thu, 6 Sep 2018 10:25:58 +0000 (15:55 +0530)]
ASoC: msm: qdsp6v2: Handle invalid session for dtmf enable
If session id is invalid then dtmf voice info will also
be invalid.
Add check to return error if session id is invalid.
CRs-Fixed:
2306771
Change-Id: I362340f9f666c95949eaa94d0ced4cb3a1b9abab
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
Yimin Peng [Tue, 11 Sep 2018 06:52:09 +0000 (14:52 +0800)]
soc: qcom: hab: add IRQF_NO_SUSPEND to irq flags.
The virtclk can disable clocks by hab in suspend flow. If hab irq is
disabled then, the power manage task will stick in uninterruptable hab
receive function.
Change-Id: I780ecede7494346953f5f77d665dd77c2cc6d28a
Signed-off-by: Yimin Peng <yiminp@codeaurora.org>
Teng Fei Fan [Tue, 4 Sep 2018 03:53:15 +0000 (11:53 +0800)]
ARM: dts: msm: add initial dts support for SDM455 CDP devices
Add initial devices trees for SDM455 CDP devices
Change-Id: I33bf922baf1dcd5c214f0be81affba25eab0c70c
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Teng Fei Fan [Mon, 3 Sep 2018 03:46:00 +0000 (11:46 +0800)]
ARM: dts: msm: add initial dts support for SDM455 QRD devices
Add initial devices trees for SDM455 QRD devices
Change-Id: I7107029ac33f47f1866d7907ff9086d98c466039
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Teng Fei Fan [Mon, 3 Sep 2018 02:39:20 +0000 (10:39 +0800)]
ARM: dts: msm: add initial dts support for SDM455 MTP devices
Add initial device trees for SDM455 MTP devices
Change-Id: I8b8f3038ae435db9ea87c7e6a72d79e82f72806f
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Linux Build Service Account [Sat, 15 Sep 2018 06:53:12 +0000 (23:53 -0700)]
Merge "cnss2: Clear CNSS_DEV_ERR_NOTIFY after collecting firmware dump"
Gerrit - the friendly Code Review server [Fri, 14 Sep 2018 23:44:05 +0000 (16:44 -0700)]
Merge changes into msm-4.4
Yue Ma [Tue, 11 Sep 2018 00:27:01 +0000 (17:27 -0700)]
cnss2: Clear CNSS_DEV_ERR_NOTIFY after collecting firmware dump
CNSS_DEV_ERR_NOTIFY should not be cleared before collecting firmware
dump as device is still in asserted state. Clear it after collecting
firmware dump.
Change-Id: Ic57c65d8ffa1806a0af83e653d6573f19ab1e705
Signed-off-by: Yue Ma <yuem@codeaurora.org>
Linux Build Service Account [Fri, 14 Sep 2018 17:02:38 +0000 (10:02 -0700)]
Merge "drivers: dma-removed: fix signedness issue"
Linux Build Service Account [Fri, 14 Sep 2018 17:02:36 +0000 (10:02 -0700)]
Merge "rtc: qpnp-rtc: Read ALARM_EN and update to alarm enabled status"
Linux Build Service Account [Fri, 14 Sep 2018 17:02:34 +0000 (10:02 -0700)]
Merge "soc: qcom: socinfo: Add support for SDM455 soc-id"
Linux Build Service Account [Fri, 14 Sep 2018 17:02:32 +0000 (10:02 -0700)]
Merge "fbdev: msm: try recovering from PP timeout without panic"
Linux Build Service Account [Fri, 14 Sep 2018 07:53:24 +0000 (00:53 -0700)]
Merge "soc: qcom: secure_buffer: Fix the parameter passing to dmac_flush_range"
Srinivasarao P [Mon, 13 Aug 2018 12:21:11 +0000 (17:51 +0530)]
drivers: dma-removed: fix signedness issue
Large values returned by bitmap_find_next_zero_area() can overflow
and become negative when stored in signed variable 'pageno' that
can lead to failure of condition 'pageno < dma_mem->nr_pages'.
Due to this, Use-after-free issue is observed in bitmap_set(),
When user requests to allocate large size buffer using ion calls.
BUG: KASAN: use-after-free in bitmap_set+0x9c/0xd4 at addr
ffffffe774946cc0
Read of size 8 by task syz-executor0/19717
page:
ffffffbe5dd25180 count:0 mapcount:-127 mapping:(null)
index:0xffffffe774947000 flags: 0x0()
page dumped because: kasan: bad access detected
page_owner info is not active (free page?)
CPU: 3 PID: 19717 Comm: syz-executor0 Tainted: G W 4.4.78+ #1
Call trace:
[<
ffffffa10c68b6fc>] dump_backtrace+0x0/0x2fc
[<
ffffffa10c68ba1c>] show_stack+0x24/0x30
[<
ffffffa10cc29a34>] dump_stack+0xdc/0x134
[<
ffffffa10c8b2c10>] kasan_report+0x380/0x508
[<
ffffffa10c8b1f38>] __asan_load8+0x24/0x80
[<
ffffffa10cc42218>] bitmap_set+0x9c/0xd4
[<
ffffffa10d15941c>] removed_alloc+0x188/0x5e4
[<
ffffffa10dba4f40>] ion_cma_allocate+0x164/0x3e0
[<
ffffffa10db9cef4>] __ion_alloc+0x368/0x1044
[<
ffffffa10db9e0c8>] ion_ioctl+0x25c/0x6ac
[<
ffffffa10c8e2f40>] do_vfs_ioctl+0x844/0x9a8
[<
ffffffa10c8e311c>] SyS_ioctl+0x78/0xbc
[<
ffffffa10c683730>] el0_svc_naked+0x24/0x28
Change-Id: Ibbaa451250bdfa9ce2a6e2cb9d2ee357ee0c8385
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Zhenhua Huang [Thu, 6 Sep 2018 06:27:14 +0000 (14:27 +0800)]
soc: qcom: secure_buffer: Fix the parameter passing to dmac_flush_range
For "chunk_list + chunk_list_len", if the chunk_list is type of u32*,
the chunk_list_len will be 4 * of original size. So we flushed a wrong
area size. In some condition like we enabled CONFIG_DEBUG_PAGEALLOC, it
may flush out of page bound of the invalid pte page.
Fix it by manually convert it as void* when doing the addition.
CRs-Fixed:
2309993
Change-Id: I2b88d78ba73d9904fa2bf6106937001715b6037f
Signed-off-by: Zhenhua Huang <zhenhuah@codeaurora.org>
Linux Build Service Account [Thu, 13 Sep 2018 22:57:39 +0000 (15:57 -0700)]
Merge "cnss2: Add API to check if WLAN PCIe device is down"
Yue Ma [Tue, 11 Sep 2018 00:20:54 +0000 (17:20 -0700)]
cnss2: Add API to check if WLAN PCIe device is down
API provision for WLAN host driver to check if WLAN PCIe device
is down.
Change-Id: I91efcd781af67c72b787c89e6b619c4cc49da34b
Signed-off-by: Yue Ma <yuem@codeaurora.org>
Linux Build Service Account [Thu, 13 Sep 2018 10:11:30 +0000 (03:11 -0700)]
Merge "rtac: Add mutex lock to ensure proper fops access"
Linux Build Service Account [Wed, 12 Sep 2018 18:08:36 +0000 (11:08 -0700)]
Merge "dt: msm: gvmq: enable virtual ssr for adsp and wlan"
Venkata Rao Kakani [Wed, 12 Sep 2018 06:51:10 +0000 (12:21 +0530)]
dt: msm: gvmq: enable virtual ssr for adsp and wlan
Subsystem notification for adsp and wlan in guest.
Change-Id: I49e3e0a160a2434ba9df8008a5ad5051fbeed194
Signed-off-by: Venkata Rao Kakani <vkakani@codeaurora.org>
Mao Jinlong [Wed, 2 Aug 2017 08:14:19 +0000 (16:14 +0800)]
rtc: qpnp-rtc: Read ALARM_EN and update to alarm enabled status
ALARM_EN status is retained in PMIC register after device shutdown
if poweron_alarm is enabled. Read it to make sure the driver has
consistent value with the register status.
Change-Id: Iee0a19ba5126265b36a353c1d1b249d09185564a
Signed-off-by: Mao Jinlong <c_jmao@codeaurora.org>
Linux Build Service Account [Wed, 12 Sep 2018 05:43:33 +0000 (22:43 -0700)]
Merge "ARM: dts: msm: Add CPR support for SDM630 speed-bin 3"
Linux Build Service Account [Tue, 11 Sep 2018 16:46:30 +0000 (09:46 -0700)]
Merge "ARM: dts: msm: Add support for complete subsystem ramdump for SDM660"
Linux Build Service Account [Tue, 11 Sep 2018 16:46:29 +0000 (09:46 -0700)]
Merge "aio: hold an extra file reference over AIO read/write operations"
Anirudh Ghayal [Mon, 3 Sep 2018 05:34:29 +0000 (11:04 +0530)]
ARM: dts: msm: Add CPR support for SDM630 speed-bin 3
Add the CPR configuration of Speed-bin 3 for the power
and performance cluster of SDM630.
Change-Id: I6bf9a837ae941cf3ad9413da6e44821916acf197
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
Tanya Dixit [Tue, 11 Sep 2018 12:29:29 +0000 (17:59 +0530)]
rtac: Add mutex lock to ensure proper fops access
Add mutex lock in rtac_open and rtac_release
to avoid usage count discrepancies leading
to multiple calls to unmap memory resulting in
null pointer dereference.
CRs-Fixed:
2271712
Change-Id: Ie6da28837c352030b8d7e377d68a70cf04e7072a
Signed-off-by: Tanya Dixit <tdixit@codeaurora.org>
Naitik Bharadiya [Mon, 10 Sep 2018 11:41:55 +0000 (17:11 +0530)]
ARM: dts: msm: Add support for complete subsystem ramdump for SDM660
Add support to dump complete ramdump of subsystem from start of first
segment to end of last segment without leaving any hole in between.
Change-Id: I0bcab1d4e04748d3934b7a4d99eec59727c3afb1
Signed-off-by: Naitik Bharadiya <bharad@codeaurora.org>
Linux Build Service Account [Tue, 11 Sep 2018 09:04:20 +0000 (02:04 -0700)]
Merge "mdio: Add support for mdio drivers."
Linux Build Service Account [Tue, 11 Sep 2018 09:04:19 +0000 (02:04 -0700)]
Merge "drm/msm-hyp: expand display type enumeration"
Hardik Arya [Wed, 8 Aug 2018 04:58:34 +0000 (10:28 +0530)]
soc: qcom: glink_spi_xprt: Validate fifo read index of remote side
Since message received from spi cannot be trusted there is possibility
of out-of-bound read if received read_id is not in range of fifo.
The patch validate rx_fifo_read index of edge info for remote side.
Change-Id: I3d3fa749935f477e5f98f986adc24e6e6a682d4d
Signed-off-by: Hardik Arya <harya@codeaurora.org>
Camus Wong [Mon, 27 Aug 2018 21:09:48 +0000 (17:09 -0400)]
drm/msm-hyp: expand display type enumeration
Expand display type/id enumeration up to eight types.
Change-Id: I19c47e6b4aa57dc94020f909260e1de2218ca82d
Signed-off-by: Camus Wong <camusw@codeaurora.org>
Andrew Lunn [Wed, 6 Jan 2016 19:11:26 +0000 (20:11 +0100)]
mdio: Add support for mdio drivers.
Not all devices on an MDIO bus are PHYs. Meaning not all MDIO drivers
are PHY drivers. Add support for generic MDIO drivers.
Change-Id: I65c7c8a497bbac9ef67b3d21c869818a09378e3c
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-Commit:
a9049e0c513c4521dbfaa302af8ed08b3366b41f
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Anthony Mah <amah@codeaurora.org>
Christoph Hellwig [Sun, 30 Oct 2016 16:42:01 +0000 (11:42 -0500)]
aio: hold an extra file reference over AIO read/write operations
Otherwise we might dereference an already freed file and/or inode
when aio_complete is called before we return from the read_iter or
write_iter method.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
(cherry picked from commit
0b944d3a4bba6b25f43aed530f4fa85c04d162a6)
Change-Id: I628a87b5036ba1ba5ba5152fa0329d02999d3649
Git-Commit:
0b944d3a4bba6b25f43aed530f4fa85c04d162a6
Git-Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
[riteshh@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
Naitik Bharadiya [Mon, 10 Sep 2018 05:31:08 +0000 (11:01 +0530)]
defconfig: msm8998: align with android config requirement
Align with android-base.cfg which is android kernel config
requirement for msm8998_defconfig.
Change-Id: I69cbca16705d25b5505792b11ae4f054be09457f
Signed-off-by: Naitik Bharadiya <bharad@codeaurora.org>
Linux Build Service Account [Mon, 10 Sep 2018 05:08:35 +0000 (22:08 -0700)]
Merge "Revert "msm: adsprpc: DSP device node to provide restricted access to ADSP/SLPI""
Teng Fei Fan [Mon, 3 Sep 2018 07:46:47 +0000 (15:46 +0800)]
soc: qcom: socinfo: Add support for SDM455 soc-id
Add socinfo support for SDM455 Soc and update the
bindings fot the same.
Change-Id: I9b30795e202d84ae06020983b2d656772fb4f313
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Linux Build Service Account [Sun, 9 Sep 2018 06:45:06 +0000 (23:45 -0700)]
Merge "clk: msm: add uninterruptible flag in hab receiving for virtual reset."
Linux Build Service Account [Sun, 9 Sep 2018 06:45:04 +0000 (23:45 -0700)]
Merge "ARM: dts: msm: Invert polarity of PMD_MPP_08 for msm8996 CV2X"
Linux Build Service Account [Sat, 8 Sep 2018 19:33:58 +0000 (12:33 -0700)]
Merge "USB: pd: Notify selfpowered state based on type C current"
Linux Build Service Account [Fri, 7 Sep 2018 17:15:55 +0000 (10:15 -0700)]
Merge "kthread/smpboot: Serialize kthread parking against wakeup"
Linux Build Service Account [Fri, 7 Sep 2018 17:15:44 +0000 (10:15 -0700)]
Merge "f_qc_rndis: Call rndis_ipa_init() from rndis_qc_bind()"
Linux Build Service Account [Fri, 7 Sep 2018 17:15:43 +0000 (10:15 -0700)]
Merge "mm: Kconfig: Add support for config size of purging vmap_area"
Gaurav Kohli [Tue, 24 Apr 2018 06:43:34 +0000 (12:13 +0530)]
kthread/smpboot: Serialize kthread parking against wakeup
The control cpu thread which initiates hotplug calls kthread_park()
for hotplug thread and sets KTHREAD_SHOULD_PARK. After this control
thread wakes up the hotplug thread. There is a chance that wakeup
code sees the hotplug thread (running on AP core) in INTERRUPTIBLE
state, but sets its state to RUNNING after hotplug thread has entered
kthread_parkme() and changed its state to TASK_PARKED. This can result
in panic later on in kthread_unpark(), as it sees KTHREAD_IS_PARKED
flag set but fails to rebind the kthread, due to it being not in
TASK_PARKED state. Fix this, by serializing wakeup state change,
against state change before parking the kthread.
Below is the possible race:
Control thread Hotplug Thread
kthread_park()
set KTHREAD_SHOULD_PARK
smpboot_thread_fn
set_current_state(TASK_INTERRUPTIBLE);
kthread_parkme
wake_up_process()
raw_spin_lock_irqsave(&p->pi_lock, flags);
if (!(p->state & state)) -> this will fail
goto out;
__kthread_parkme
__set_current_state(TASK_PARKED);
if (p->on_rq && ttwu_remote(p, wake_flags))
ttwu_remote()
p->state = TASK_RUNNING;
schedule();
So to avoid this race, take pi_lock to serial state changes.
Change-Id: Ie71645d37046f7ee74df880dbead29efbaad199a
Suggested-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org>
Zhiqiang Tu [Fri, 7 Sep 2018 07:38:17 +0000 (15:38 +0800)]
clk: msm: add uninterruptible flag in hab receiving for virtual reset.
Add uninterruptible flag in hab receiving for virtual reset controller
to avoid being interrupted by signal.
Change-Id: Iddca4134eec082537110bd7735e0e282cd5c7454
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
Vijayavardhan Vennapusa [Tue, 28 Aug 2018 07:10:30 +0000 (12:40 +0530)]
f_qc_rndis: Call rndis_ipa_init() from rndis_qc_bind()
During composition switch, current driver ends up calling
rndis_ipa_cleanup twice without calling rndis_ipa_init() in between.
This could cause spinbug in IPA driver due to uninitialized spin lock.
Hence fix the issue by moving rndis_ipa_init() to bind() callback and
calling rndis_ipa_cleanup() in unbind() callback.
Change-Id: I1be18de9137ba61cf0f004c7edeac54235617d33
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Zhenhua Huang [Thu, 21 Jun 2018 04:54:40 +0000 (12:54 +0800)]
mm: Kconfig: Add support for config size of purging vmap_area
This size is the maximum amount of virtual address space we gather
up before attempting to purge with a TLB flush. It is 128M in most cases.
With repeated and high size vmalloc operations, it may easily generate
more fragments. This is wasting limited vmalloc area, for 32bits.
So make it configable and the default multiplier as 8, 32bits only.
Change-Id: I68a75acb16d3cff05f8b13c05ae78922269e219f
Signed-off-by: Zhenhua Huang <zhenhuah@codeaurora.org>
Aditya Mathur [Thu, 6 Sep 2018 23:46:27 +0000 (16:46 -0700)]
ARM: dts: msm: Invert polarity of PMD_MPP_08 for msm8996 CV2X
Invert the polarity of PMD_MPP_08 on msm8996 CV2X
to properly power on and off the external
modem as required.
Change-Id: I56226f4d14a2e21331bacf0a7125dc06bfd91aac
Signed-off-by: Aditya Mathur <aditmath@codeaurora.org>
Linux Build Service Account [Thu, 6 Sep 2018 21:14:26 +0000 (14:14 -0700)]
Merge "drm/msm/hdmi: add rgb flag for HDMI customized mode"
Linux Build Service Account [Thu, 6 Sep 2018 21:14:25 +0000 (14:14 -0700)]
Merge "Merge android-4.4.153 (
5e24b4e) into msm-4.4"
Linux Build Service Account [Thu, 6 Sep 2018 14:25:59 +0000 (07:25 -0700)]
Merge "printk: Make the console flush configurable in hotplug path"
Linux Build Service Account [Thu, 6 Sep 2018 14:25:58 +0000 (07:25 -0700)]
Merge "adv7481: Modify EDID array to support 1080p60Hz"
Linux Build Service Account [Thu, 6 Sep 2018 14:25:57 +0000 (07:25 -0700)]
Merge "audio: qdsp6v2: check EINTR when retry for habmm_socket_recv"
Linux Build Service Account [Thu, 6 Sep 2018 14:25:56 +0000 (07:25 -0700)]
Merge "cnss: comment cnss_msm_pcie_pm_control at GreenHills platform"
Mohammed Khajapasha [Fri, 4 Sep 2015 15:03:31 +0000 (20:33 +0530)]
printk: Make the console flush configurable in hotplug path
The thread which initiates the hot plug can get scheduled
out, while trying to acquire the console lock,
thus increasing the hot plug latency. This option
allows to selectively disable the console flush and
in turn reduce the hot plug latency.
Change-Id: I42507804d321b29b7761146a6c175d959bf79925
Signed-off-by: Mohammed Khajapasha <mkhaja@codeaurora.org>
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Linux Build Service Account [Thu, 6 Sep 2018 05:13:30 +0000 (22:13 -0700)]
Merge "soc: qcom: subsystem_notif_virt: Fix error condition check"
Linux Build Service Account [Thu, 6 Sep 2018 05:13:23 +0000 (22:13 -0700)]
Merge "msm: mdss: Fix Gamma LUT bounds condition"
Suprith Malligere Shankaregowda [Fri, 31 Aug 2018 13:52:30 +0000 (19:22 +0530)]
adv7481: Modify EDID array to support 1080p60Hz
1080p60Hz HDMI_OUT(PC) not displayed in TIF due to wrong clock value,
So increasing clock value to 148.5MHz in Detailed Timing Descriptor
And reorder video data block to support 1080p60Hz.
Change-Id: I91ffc02f97c9b4fa5362444382af1b91af9c03b6
Signed-off-by: Suprith Malligere Shankaregowda <supgow@codeaurora.org>
Tony Han [Wed, 5 Sep 2018 11:28:10 +0000 (19:28 +0800)]
audio: qdsp6v2: check EINTR when retry for habmm_socket_recv
HAB returns -EINTR instead of -EAGAIN to request a retry from the
habmm_socket_recv() call.
Change-Id: I61bcef5c11048a3947b8079d1591937d7b83602a
Signed-off-by: Tony Han <xiahan@codeaurora.org>
Yunyun Cao [Thu, 6 Sep 2018 03:37:11 +0000 (11:37 +0800)]
drm/msm/hdmi: add rgb flag for HDMI customized mode
Add rgb flag to make sure HDMI customized mode pass
the format check.
Change-Id: I2d1df731bef493e15f83dac569673589e2408c68
Signed-off-by: Yunyun Cao <yunyunc@codeaurora.org>
Gerrit - the friendly Code Review server [Wed, 5 Sep 2018 18:56:52 +0000 (11:56 -0700)]
Merge changes into msm-4.4
Anant Goel [Tue, 4 Sep 2018 21:42:20 +0000 (14:42 -0700)]
soc: qcom: subsystem_notif_virt: Fix error condition check
An error check casts an integer to a pointer. Fix the error
check so that the integer is not casted to a pointer.
Change-Id: Ib15634745cc2243e4fe54557d6670956d8349e93
Signed-off-by: Anant Goel <anantg@codeaurora.org>
Linux Build Service Account [Wed, 5 Sep 2018 11:32:32 +0000 (04:32 -0700)]
Merge "nl80211: nl80211_update_ft_ies to validate NL80211_ATTR_IE"
Vijayavardhan Vennapusa [Tue, 28 Aug 2018 05:36:16 +0000 (11:06 +0530)]
USB: pd: Notify selfpowered state based on type C current
It is required to notify device as selfpowered and bmaxpower as zero
even for non PD capable devices based on Type C current. Hence notify
as selfpowerer in bMattributes of configuation descriptor in case of
medium or high Type C current.
Change-Id: Ie552560d93a8195f4c69fdaf6086ef3a52b31d39
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Arunk Khandavalli [Wed, 5 Sep 2018 07:11:22 +0000 (12:41 +0530)]
nl80211: nl80211_update_ft_ies to validate NL80211_ATTR_IE
Current nl80211_update_ft_ies doesn't validate NL80211_ATTR_IE
before dereferencing it, which leads to a null pointer exception
if not passed.
This commit validates this attribute too.
Change-Id: Ia40b02fc218bc26a07bc6b2153f425b8cae3bd82
CRs-Fixed:
2261685
Signed-off-by: Arunk Khandavalli <akhandav@codeaurora.org>
Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
Linux Build Service Account [Wed, 5 Sep 2018 04:18:58 +0000 (21:18 -0700)]
Merge "net: Include additional rmnet header in flow_dissector"
Chaoli Zhou [Fri, 31 Aug 2018 06:05:26 +0000 (14:05 +0800)]
cnss: comment cnss_msm_pcie_pm_control at GreenHills platform
It doesn't support virtualized clock currently,
so we cannot disable/enable clock while do PCIE link
suspend/resume from Linux side at Greenhills platform,
so comment the API cnss_msm_pcie_pm_control to prevent
doing PCIE link suspend/resume.
Change-Id: Ie10d781042ff3e85b3206fd300e9ec3f71897479
Signed-off-by: Chaoli Zhou <zchaoli@codeaurora.org>
Gustavo Solaira [Fri, 24 Aug 2018 22:03:55 +0000 (15:03 -0700)]
net: Include additional rmnet header in flow_dissector
Add an additional header in flow_dissector since it
provides some structs that are needed for it.
Change-Id: I654ce9838f704c71b5c5015ef30d88a01a528f0b
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
Gustavo Solaira [Fri, 24 Aug 2018 22:02:24 +0000 (15:02 -0700)]
diag: Only include MHI headers if it is enabled
Only include the MHI header file if CONFIG_MSM_MHI
is enabled, avoid compilation errors if the platform
does not support MHI.
Change-Id: Ic2d84a8bbd066d0d8e50711a7499ae9a959a0b71
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
Linux Build Service Account [Tue, 4 Sep 2018 18:41:12 +0000 (11:41 -0700)]
Merge "asoc : msm: Fix zero size pointer issue"
Linux Build Service Account [Tue, 4 Sep 2018 18:41:11 +0000 (11:41 -0700)]
Merge "net: hns: Fix a skb used after free bug"
Soumya Managoli [Tue, 31 Jul 2018 13:08:29 +0000 (18:38 +0530)]
asoc : msm: Fix zero size pointer issue
APPS crashes randomly due to invalid memory allocation
in q6asm_audio_client_buf_free_contiguous.
Added check to return error if memory allocation size is 0.
Change-Id: I40f49aa147d513b29b56224a5ee77ccbb2dcc110
CRs-Fixed:
2285272
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
Yunsheng Lin [Thu, 6 Jul 2017 02:22:00 +0000 (10:22 +0800)]
net: hns: Fix a skb used after free bug
skb maybe freed in hns_nic_net_xmit_hw() and return NETDEV_TX_OK,
which cause hns_nic_net_xmit to use a freed skb.
BUG: KASAN: use-after-free in hns_nic_net_xmit_hw+0x62c/0x940...
[17659.112635] alloc_debug_processing+0x18c/0x1a0
[17659.117208] __slab_alloc+0x52c/0x560
[17659.120909] kmem_cache_alloc_node+0xac/0x2c0
[17659.125309] __alloc_skb+0x6c/0x260
[17659.128837] tcp_send_ack+0x8c/0x280
[17659.132449] __tcp_ack_snd_check+0x9c/0xf0
[17659.136587] tcp_rcv_established+0x5a4/0xa70
[17659.140899] tcp_v4_do_rcv+0x27c/0x620
[17659.144687] tcp_prequeue_process+0x108/0x170
[17659.149085] tcp_recvmsg+0x940/0x1020
[17659.152787] inet_recvmsg+0x124/0x180
[17659.156488] sock_recvmsg+0x64/0x80
[17659.160012] SyS_recvfrom+0xd8/0x180
[17659.163626] __sys_trace_return+0x0/0x4
[17659.167506] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=23 cpu=1 pid=13
[17659.174000] free_debug_processing+0x1d4/0x2c0
[17659.178486] __slab_free+0x240/0x390
[17659.182100] kmem_cache_free+0x24c/0x270
[17659.186062] kfree_skbmem+0xa0/0xb0
[17659.189587] __kfree_skb+0x28/0x40
[17659.193025] napi_gro_receive+0x168/0x1c0
[17659.197074] hns_nic_rx_up_pro+0x58/0x90
[17659.201038] hns_nic_rx_poll_one+0x518/0xbc0
[17659.205352] hns_nic_common_poll+0x94/0x140
[17659.209576] net_rx_action+0x458/0x5e0
[17659.213363] __do_softirq+0x1b8/0x480
[17659.217062] run_ksoftirqd+0x64/0x80
[17659.220679] smpboot_thread_fn+0x224/0x310
[17659.224821] kthread+0x150/0x170
[17659.228084] ret_from_fork+0x10/0x40
BUG: KASAN: use-after-free in hns_nic_net_xmit+0x8c/0xc0...
[17751.080490] __slab_alloc+0x52c/0x560
[17751.084188] kmem_cache_alloc+0x244/0x280
[17751.088238] __build_skb+0x40/0x150
[17751.091764] build_skb+0x28/0x100
[17751.095115] __alloc_rx_skb+0x94/0x150
[17751.098900] __napi_alloc_skb+0x34/0x90
[17751.102776] hns_nic_rx_poll_one+0x180/0xbc0
[17751.107097] hns_nic_common_poll+0x94/0x140
[17751.111333] net_rx_action+0x458/0x5e0
[17751.115123] __do_softirq+0x1b8/0x480
[17751.118823] run_ksoftirqd+0x64/0x80
[17751.122437] smpboot_thread_fn+0x224/0x310
[17751.126575] kthread+0x150/0x170
[17751.129838] ret_from_fork+0x10/0x40
[17751.133454] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=19 cpu=7 pid=43
[17751.139951] free_debug_processing+0x1d4/0x2c0
[17751.144436] __slab_free+0x240/0x390
[17751.148051] kmem_cache_free+0x24c/0x270
[17751.152014] kfree_skbmem+0xa0/0xb0
[17751.155543] __kfree_skb+0x28/0x40
[17751.159022] napi_gro_receive+0x168/0x1c0
[17751.163074] hns_nic_rx_up_pro+0x58/0x90
[17751.167041] hns_nic_rx_poll_one+0x518/0xbc0
[17751.171358] hns_nic_common_poll+0x94/0x140
[17751.175585] net_rx_action+0x458/0x5e0
[17751.179373] __do_softirq+0x1b8/0x480
[17751.183076] run_ksoftirqd+0x64/0x80
[17751.186691] smpboot_thread_fn+0x224/0x310
[17751.190826] kthread+0x150/0x170
[17751.194093] ret_from_fork+0x10/0x40
Change-Id: I5fbdea5d0264c79dbcc91f8519cda1004b667866
Fixes:
13ac695e7ea1 ("net:hns: Add support of Hip06 SoC to the Hislicon Network Subsystem")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: lipeng <lipeng321@huawei.com>
Reported-by: Jun He <hjat2005@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit:
27463ad99f738ed93c7c8b3e2e5bc8c4853a2ff2
Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>
Acked-By: Chinmay Agarwal <chinagar@qti.qualcomm.com>
[ tejaswit@codeaurora.org : resolved minor conflicts ]
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Akhil P Oommen [Fri, 6 Jul 2018 09:56:11 +0000 (15:26 +0530)]
msm: kgsl: Replace scm call api with its atomic version
scm_call2() API can block indefinitely if another client is using
this API. This is due to a mutex in this API to serialize calls to
the TZ. This blocks the GPU wake up which in turn can result in
kgsl fence timeouts. Since CPZ register programing is handled at
the hypervisor, we can safely avoid this serialization by using
scm_call2_atomic() API which doesn't block.
Change-Id: I48ba3e1a682e1027463a1c6b067e6cfcb4a0e8bc
Signed-off-by: Akhil P Oommen <akhilpo@codeaurora.org>
Ch Ganesh Kumar [Mon, 20 Aug 2018 08:05:37 +0000 (13:35 +0530)]
msm: mdss: Fix Gamma LUT bounds condition
Validate the Gamma correction feature with all bound condition.
This change corrects the Gamma LUT block bound condition.
Change-Id: I3fc460b6a6e2e76f7c07b649e1db1e01ce208476
Signed-off-by: Ch Ganesh Kumar <chganesh@codeaurora.org>
Linux Build Service Account [Mon, 3 Sep 2018 01:27:50 +0000 (18:27 -0700)]
Merge "ARM: dts: msm: Add 8GB DDR device tree for msm8996 ivi vplatform"
Linux Build Service Account [Sat, 1 Sep 2018 23:12:40 +0000 (16:12 -0700)]
Merge "drm: Pass CRTC ID in userspace vblank events"
Linux Build Service Account [Sat, 1 Sep 2018 23:12:37 +0000 (16:12 -0700)]
Merge "cnss: Use the nosync API in cnss when disabling irq"
Linux Build Service Account [Sat, 1 Sep 2018 23:12:34 +0000 (16:12 -0700)]
Merge "diag: Add protection before accessing md_session_map"
Linux Build Service Account [Sat, 1 Sep 2018 04:18:41 +0000 (21:18 -0700)]
Merge "drm: msm: sde: Fix SMMU fault during DRM test"
Linux Build Service Account [Fri, 31 Aug 2018 19:34:15 +0000 (12:34 -0700)]
Merge "Merge android-4.4.150 (
5541782) into msm-4.4"
raghavendra ambadas [Thu, 30 Aug 2018 11:35:52 +0000 (17:05 +0530)]
fbdev: msm: try recovering from PP timeout without panic
Driver dumps mdp register and xlog as soon as pingpong timeout
occurs. It is possible to recover device while waiting for TE signal,
so call panic if pingpong timeout happens for 10 consecutive frames.
Change-Id: I1661b21b3179f77a0a8daa8d2cde2115c7a38f5e
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Linux Build Service Account [Thu, 30 Aug 2018 20:05:57 +0000 (13:05 -0700)]
Merge "icnss: Add a flag to indicare FW rejuvenate"
Linux Build Service Account [Thu, 30 Aug 2018 20:05:56 +0000 (13:05 -0700)]
Merge "msm:ais:Handling bigger value than upper bound in msm_cpp_irq api"
Linux Build Service Account [Thu, 30 Aug 2018 20:05:55 +0000 (13:05 -0700)]
Merge "USB: core: only clean up what we allocated"
Anurag Chouhan [Thu, 30 Aug 2018 08:59:14 +0000 (14:29 +0530)]
icnss: Add a flag to indicare FW rejuvenate
Add a flag to maintain fw rejuvenate state,
set if fw rejuvenate happens and reset at fw ready.
export an API to the wlan host driver to distinguish the
case of ssr or pdr with the FW rejuventae.
Change-Id: I7a01cc4996f68f78aa13eacf36648331a701882a
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>
Linux Build Service Account [Thu, 30 Aug 2018 09:20:54 +0000 (02:20 -0700)]
Merge "Revert "power: wakeup_reason: send uevent to user space""
Zhiqiang Tu [Tue, 21 Aug 2018 06:23:58 +0000 (14:23 +0800)]
ARM: dts: msm: Add 8GB DDR device tree for msm8996 ivi vplatform
Add a new device tree to support 8GB DDR target for msm8996 IVI
virtual platform.
Change-Id: Ia3be942de1c3064aecc59560743849335e8ff60d
Signed-off-by: Anant Goel <anantg@codeaurora.org>
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
Linux Build Service Account [Thu, 30 Aug 2018 00:20:36 +0000 (17:20 -0700)]
Merge "msm: ipa3: Add mutex to prevent race condition"
Linux Build Service Account [Thu, 30 Aug 2018 00:20:35 +0000 (17:20 -0700)]
Merge "msm:ipa: Prevent NAT table deletion only if public ip is not assigned"
Mohammed Javid [Fri, 8 Jun 2018 11:25:32 +0000 (16:55 +0530)]
msm: ipa3: Add mutex to prevent race condition
There is a race condition between ipa3_nat_init_cmd
and ipa_read_nat4. The two thread will R/W the critical
global variables. This will result in race conditions
and possibly buffer overread/ overwrite issues. Add code
to prevent this race condition.
Change-Id: I6bf9a837ae941cf3ad9413da6e44821916acf196
Acked-by: Pooja Kumari <kumarip@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Linux Build Service Account [Wed, 29 Aug 2018 04:19:00 +0000 (21:19 -0700)]
Merge "defconfig : Enable Hibernation support for msm8996AU."
Atul Raut [Mon, 2 Apr 2018 23:25:42 +0000 (16:25 -0700)]
defconfig : Enable Hibernation support for msm8996AU.
Add support to Hibernation for msm8996AU based auto
platform.
Change-Id: I6db195dbf33a146c01b3d097ef9b34cb11019f60
Signed-off-by: Atul Raut <araut@codeaurora.org>
Linux Build Service Account [Tue, 28 Aug 2018 19:48:51 +0000 (12:48 -0700)]
Merge "diag: Update msg mask's ranges properly"
Linux Build Service Account [Tue, 28 Aug 2018 19:48:50 +0000 (12:48 -0700)]
Merge "msm: ipa: Validate routing rule id"
Mohammed Javid [Mon, 27 Aug 2018 10:02:35 +0000 (15:32 +0530)]
msm:ipa: Prevent NAT table deletion only if public ip is not assigned
Currnetly NAT table is not deleted even if public ip is assigned to
NAT table. Add check to prevent deletion only if public ip is not assigned.
Change-Id: I4855b21472d3f6bf541d07733b18592e9e677ce6
Acked-by: Pooja Kumari <kumarip@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Srinivasarao P [Tue, 28 Aug 2018 11:57:24 +0000 (17:27 +0530)]
Merge android-4.4.153 (
5e24b4e) into msm-4.4
* refs/heads/tmp-
5e24b4e
Linux 4.4.153
ovl: warn instead of error if d_type is not supported
ovl: Do d_type check only if work dir creation was successful
ovl: Ensure upper filesystem supports d_type
x86/mm: Fix use-after-free of ldt_struct
x86/mm/pat: Fix L1TF stable backport for CPA
ANDROID: x86_64_cuttlefish_defconfig: Enable lz4 compression for zram
UPSTREAM: drivers/block/zram/zram_drv.c: fix bug storing backing_dev
BACKPORT: zram: introduce zram memory tracking
BACKPORT: zram: record accessed second
BACKPORT: zram: mark incompressible page as ZRAM_HUGE
UPSTREAM: zram: correct flag name of ZRAM_ACCESS
UPSTREAM: zram: Delete gendisk before cleaning up the request queue
UPSTREAM: drivers/block/zram/zram_drv.c: make zram_page_end_io() static
BACKPORT: zram: set BDI_CAP_STABLE_WRITES once
UPSTREAM: zram: fix null dereference of handle
UPSTREAM: zram: add config and doc file for writeback feature
BACKPORT: zram: read page from backing device
BACKPORT: zram: write incompressible pages to backing device
BACKPORT: zram: identify asynchronous IO's return value
BACKPORT: zram: add free space management in backing device
UPSTREAM: zram: add interface to specif backing device
UPSTREAM: zram: rename zram_decompress_page to __zram_bvec_read
UPSTREAM: zram: inline zram_compress
UPSTREAM: zram: clean up duplicated codes in __zram_bvec_write
Linux 4.4.152
reiserfs: fix broken xattr handling (heap corruption, bad retval)
i2c: imx: Fix race condition in dma read
PCI: pciehp: Fix use-after-free on unplug
PCI: Skip MPS logic for Virtual Functions (VFs)
PCI: hotplug: Don't leak pci_slot on registration failure
parisc: Remove unnecessary barriers from spinlock.h
bridge: Propagate vlan add failure to user
packet: refine ring v3 block size test to hold one frame
netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
xfrm_user: prevent leaking 2 bytes of kernel memory
parisc: Remove ordered stores from syscall.S
ext4: fix spectre gadget in ext4_mb_regular_allocator()
KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
staging: android: ion: check for kref overflow
tcp: identify cryptic messages as TCP seq # bugs
net: qca_spi: Fix log level if probe fails
net: qca_spi: Make sure the QCA7000 reset is triggered
net: qca_spi: Avoid packet drop during initial sync
net: usb: rtl8150: demote allmulti message to dev_dbg()
net/ethernet/freescale/fman: fix cross-build error
drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply()
tcp: remove DELAYED ACK events in DCTCP
qlogic: check kstrtoul() for errors
packet: reset network header if packet shorter than ll reserved space
ixgbe: Be more careful when modifying MAC filters
ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller
ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot
perf llvm-utils: Remove bashism from kernel include fetch script
bnxt_en: Fix for system hang if request_irq fails
drm/armada: fix colorkey mode property
ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem
ieee802154: at86rf230: use __func__ macro for debug messages
ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem
ARM: pxa: irq: fix handling of ICMR registers in suspend/resume
netfilter: x_tables: set module owner for icmp(6) matches
smsc75xx: Add workaround for gigabit link up hardware errata.
kasan: fix shadow_size calculation error in kasan_module_alloc
tracing: Use __printf markup to silence compiler
ARM: imx_v4_v5_defconfig: Select ULPI support
ARM: imx_v6_v7_defconfig: Select ULPI support
HID: wacom: Correct touch maximum XY of 2nd-gen Intuos
m68k: fix "bad page state" oops on ColdFire boot
bnx2x: Fix receiving tx-timeout in error or recovery state.
drm/exynos: decon5433: Fix WINCONx reset value
drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes
drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes
md/raid10: fix that replacement cannot complete recovery after reassemble
dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
ARM: dts: da850: Fix interrups property for gpio
selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs
perf report powerpc: Fix crash if callchain is empty
perf test session topology: Fix test on s390
usb: xhci: increase CRS timeout value
ARM: dts: am437x: make edt-ft5x06 a wakeup source
brcmfmac: stop watchdog before detach and free everything
cxgb4: when disabling dcb set txq dcb priority to 0
Smack: Mark inode instant in smack_task_to_inode
ipv6: mcast: fix unsolicited report interval after receiving querys
locking/lockdep: Do not record IRQ state within lockdep code
net: davinci_emac: match the mdio device against its compatible if possible
ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP
net: propagate dev_get_valid_name return code
net: hamradio: use eth_broadcast_addr
enic: initialize enic->rfs_h.lock in enic_probe
qed: Add sanity check for SIMD fastpath handler.
arm64: make secondary_start_kernel() notrace
scsi: xen-scsifront: add error handling for xenbus_printf
usb: gadget: dwc2: fix memory leak in gadget_init()
usb: gadget: composite: fix delayed_status race condition when set_interface
usb: dwc2: fix isoc split in transfer with no data
ARM: dts: Cygnus: Fix I2C controller interrupt type
selftests: sync: add config fragment for testing sync framework
selftests: zram: return Kselftest Skip code for skipped tests
selftests: user: return Kselftest Skip code for skipped tests
selftests: static_keys: return Kselftest Skip code for skipped tests
selftests: pstore: return Kselftest Skip code for skipped tests
netfilter: ipv6: nf_defrag: reduce struct net memory waste
ARC: Explicitly add -mmedium-calls to CFLAGS
ANDROID: x86_64_cuttlefish_defconfig: Enable zram and zstd
BACKPORT: crypto: zstd - Add zstd support
UPSTREAM: zram: add zstd to the supported algorithms list
UPSTREAM: lib: Add zstd modules
UPSTREAM: lib: Add xxhash module
UPSTREAM: zram: rework copy of compressor name in comp_algorithm_store()
UPSTREAM: zram: constify attribute_group structures.
UPSTREAM: zram: count same page write as page_stored
UPSTREAM: zram: reduce load operation in page_same_filled
UPSTREAM: zram: use zram_free_page instead of open-coded
UPSTREAM: zram: introduce zram data accessor
UPSTREAM: zram: remove zram_meta structure
UPSTREAM: zram: use zram_slot_lock instead of raw bit_spin_lock op
BACKPORT: zram: partial IO refactoring
BACKPORT: zram: handle multiple pages attached bio's bvec
UPSTREAM: zram: fix operator precedence to get offset
BACKPORT: zram: extend zero pages to same element pages
BACKPORT: zram: remove waitqueue for IO done
UPSTREAM: zram: remove obsolete sysfs attrs
UPSTREAM: zram: support BDI_CAP_STABLE_WRITES
UPSTREAM: zram: revalidate disk under init_lock
BACKPORT: mm: support anonymous stable page
UPSTREAM: zram: use __GFP_MOVABLE for memory allocation
UPSTREAM: zram: drop gfp_t from zcomp_strm_alloc()
UPSTREAM: zram: add more compression algorithms
UPSTREAM: zram: delete custom lzo/lz4
UPSTREAM: zram: cosmetic: cleanup documentation
UPSTREAM: zram: use crypto api to check alg availability
BACKPORT: zram: switch to crypto compress API
UPSTREAM: zram: rename zstrm find-release functions
UPSTREAM: zram: introduce per-device debug_stat sysfs node
UPSTREAM: zram: remove max_comp_streams internals
UPSTREAM: zram: user per-cpu compression streams
BACKPORT: zsmalloc: require GFP in zs_malloc()
UPSTREAM: zram/zcomp: do not zero out zcomp private pages
UPSTREAM: zram: pass gfp from zcomp frontend to backend
UPSTREAM: socket: close race condition between sock_close() and sockfs_setattr()
ANDROID: Refresh x86_64_cuttlefish_defconfig
Linux 4.4.151
isdn: Disable IIOCDBGVAR
Bluetooth: avoid killing an already killed socket
x86/mm: Simplify p[g4um]d_page() macros
serial: 8250_dw: always set baud rate in dw8250_set_termios
ACPI / PM: save NVS memory for ASUS 1025C laptop
ACPI: save NVS memory for Lenovo G50-45
USB: option: add support for DW5821e
USB: serial: sierra: fix potential deadlock at close
ALSA: vxpocket: Fix invalid endian conversions
ALSA: memalloc: Don't exceed over the requested size
ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry
ALSA: cs5535audio: Fix invalid endian conversion
ALSA: virmidi: Fix too long output trigger loop
ALSA: vx222: Fix invalid endian conversions
ALSA: hda - Turn CX8200 into D3 as well upon reboot
ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs
net_sched: fix NULL pointer dereference when delete tcindex filter
vsock: split dwork to avoid reinitializations
net_sched: Fix missing res info when create new tc_index filter
llc: use refcount_inc_not_zero() for llc_sap_find()
l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache
dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()
Conflicts:
drivers/block/zram/zram_drv.c
drivers/staging/android/ion/ion.c
include/linux/swap.h
mm/zsmalloc.c
Change-Id: I1c437ac5133503a939d06d51ec778b65371df6d1
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Hardik Arya [Wed, 8 Aug 2018 09:16:20 +0000 (14:46 +0530)]
diag: Update msg mask's ranges properly
There is a possibility of out-of-bound read if msg mask
ranges received from peripheral are more than max ssid per
range. Cap msg mask's ssid ranges to MAX_SSID_PER_RANGE if
ranges received from peripheral are greater than the same.
Change-Id: I886692ad223e16678bfaecbe381c62fdf3503cb5
Signed-off-by: Hardik Arya <harya@codeaurora.org>