Merge remote-tracking branch 'ALS/kernel.lnx.3.18.r33-rel'

* ALS/kernel.lnx.3.18.r33-rel:
  staging: ion: msm: Apply d82ad70 to msm_ion_custom_ioctl
  BACKPORT: staging: android: ion: Pull out ion ioctls to a separate file
  Linux 3.18.124
  ebtables: arpreply: Add the standard target sanity check
  ubifs: Check for name being NULL while mounting
  cgroup: Fix deadlock in cpu hotplug path
  ext4: avoid running out of journal credits when appending to an inline file
  jbd2: don't mark block as modified if the handle is out of credits
  ext4: add more inode number paranoia checks
  ext4: never move the system.data xattr out of the inode body
  ext4: always verify the magic number in xattr blocks
  ext4: add corruption check in ext4_xattr_set_entry()
  ext4: fix false negatives *and* false positives in ext4_check_descriptors()
  ext4: always check block group bounds in ext4_init_block_bitmap()
  ext4: fix check to prevent initializing reserved inodes
  ext4: only look at the bg_flags field if it is valid
  USB: serial: simple: add Motorola Tetra MTP6550 id
  PM / core: Clear the direct_complete flag on errors
  mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys
  PCI: Reprogram bridge prefetch registers on resume
  x86/vdso: Fix vDSO syscall fallback asm constraint regression
  x86/vdso: Fix asm constraints on vDSO syscall fallbacks
  fbdev/omapfb: fix omapfb_memory_read infoleak
  proc: restrict kernel stack dumps to root
  mtd: fsl-quadspi: fix macro collision problems with READ/WRITE
  Make file credentials available to the seqfile interfaces
  dm thin metadata: fix __udivdi3 undefined on 32-bit
  ocfs2: fix locking for res->tracking and dlm->tracking_list
  crypto: mxs-dcp - Fix wait logic on chan threads
  smb2: fix missing files in root share directory listing
  xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage
  xen/manage: don't complain about an empty value in control/sysrq node
  cifs: read overflow in is_valid_oplock_break()
  s390/qeth: don't dump past end of unknown HW header
  r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
  hexagon: modify ffs() and fls() to return int
  arch/hexagon: fix kernel/dma.c build warning
  dm thin metadata: try to avoid ever aborting transactions
  fs/cifs: suppress a string overflow warning
  USB: yurex: Check for truncation in yurex_read()
  RDMA/ucma: check fd type in ucma_migrate_id()
  mm: madvise(MADV_DODUMP): allow hugetlbfs pages
  tools/vm/page-types.c: fix "defined but not used" warning
  tools/vm/slabinfo.c: fix sign-compare warning
  mac80211: shorten the IBSS debug messages
  mac80211: Fix station bandwidth setting after channel switch
  mac80211: fix a race between restart and CSA flows
  fs/cifs: don't translate SFM_SLASH (U+F026) to backslash
  net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx()
  RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0
  cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE
  gpio: adp5588: Fix sleep-in-atomic-context bug
  mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function
  media: v4l: event: Prevent freeing event subscriptions while accessed
  arm64: KVM: Sanitize PSTATE.M when being set from userspace
  hwmon: (adt7475) Make adt7475_read_word() return errors
  e1000: ensure to free old tx/rx rings in set_ringparam()
  e1000: check on netif_running() before calling e1000_up()
  thermal: of-thermal: disable passive polling when thermal zone is disabled
  ext4: verify the depth of extent tree in ext4_find_extent()
  arm64: KVM: Tighten guest core register access from userspace
  staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free
  scsi: target: iscsi: Use bin2hex instead of a re-implementation
  USB: remove LPM management from usb_driver_claim_interface()
  Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()"
  USB: usbdevfs: restore warning for nonsensical flags
  USB: usbdevfs: sanitize flags more
  media: uvcvideo: Support realtek's UVC 1.5 device
  slub: make ->cpu_partial unsigned int
  USB: handle NULL config in usb_find_alt_setting()
  USB: fix error handling in usb_driver_claim_interface()
  spi: rspi: Fix interrupted DMA transfers
  spi: sh-msiof: Fix handling of write value for SISTR register
  spi: tegra20-slink: explicitly enable/disable clock
  serial: cpm_uart: return immediately from console poll
  floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
  nfsd: fix corrupted reply to badly ordered compound
  module: exclude SHN_UNDEF symbols from kallsyms api
  ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs
  scsi: bnx2i: add error handling for ioremap_nocache
  HID: hid-ntrig: add error handling for sysfs_create_group
  ARM: mvebu: declare asm symbols as character arrays in pmsu.c
  wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()
  rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication()
  ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
  media: tm6000: add error handling for dvb_register_adapter
  drivers/tty: add error handling for pcmcia_loop_config
  staging: android: ashmem: Fix mmap size validation
  media: soc_camera: ov772x: correct setting of banding filter
  media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power
  ALSA: snd-aoa: add of_node_put() in error path
  s390/extmem: fix gcc 8 stringop-overflow warning
  alarmtimer: Prevent overflow for relative nanosleep
  usb: wusbcore: security: cast sizeof to int for comparison
  scsi: ibmvscsi: Improve strings handling
  scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size
  x86/tsc: Add missing header to tsc_msr.c
  powerpc/kdump: Handle crashkernel memory reservation failure
  media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt()
  USB: serial: kobil_sct: fix modem-status error handling
  uwb: hwa-rc: fix memory leak at probe
  x86/numa_emulation: Fix emulated-to-physical node mapping
  tsl2550: fix lux1_input error in low light
  crypto: skcipher - Fix -Wstringop-truncation warnings
  HID: sony: Support DS4 dongle
  HID: sony: Update device ids
  arm64: Add trace_hardirqs_off annotation in ret_to_user
  ext4: don't mark mmp buffer head dirty
  ext4: fix online resize's handling of a too-small final block group
  ext4: recalucate superblock checksum after updating free blocks/inodes
  ext4: avoid divide by zero fault when deleting corrupted inline directories
  ocfs2: fix ocfs2 read block panic
  scsi: target: iscsi: Use hex2bin instead of a re-implementation
  ipv6: fix possible use-after-free in ip6_xmit()
  neighbour: confirm neigh entries when ARP packet is received
  net: hp100: fix always-true check for link up state
  net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
  gso_segment: Reset skb->mac_len after modifying network header
  mm: shmem.c: Correctly annotate new inodes for lockdep
  ring-buffer: Allow for rescheduling when removing pages
  ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
  ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
  ASoC: cs4265: fix MMTLR Data switch control

Makefile

@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 123
+SUBLEVEL = 124
 EXTRAVERSION =
 NAME = Diseased Newt
 

arch/arm/mach-mvebu/pmsu.c

@@ -117,8 +117,8 @@ void mvebu_pmsu_set_cpu_boot_addr(int hw_cpu, void *boot_addr)
 		PMSU_BOOT_ADDR_REDIRECT_OFFSET(hw_cpu));
 }
 
-extern unsigned char mvebu_boot_wa_start;
-extern unsigned char mvebu_boot_wa_end;
+extern unsigned char mvebu_boot_wa_start[];
+extern unsigned char mvebu_boot_wa_end[];
 
 /*
  * This function sets up the boot address workaround needed for SMP
@@ -131,7 +131,7 @@ int mvebu_setup_boot_addr_wa(unsigned int crypto_eng_target,
 			     phys_addr_t resume_addr_reg)
 {
 	void __iomem *sram_virt_base;
-	u32 code_len = &mvebu_boot_wa_end - &mvebu_boot_wa_start;
+	u32 code_len = mvebu_boot_wa_end - mvebu_boot_wa_start;
 
 	mvebu_mbus_del_window(BOOTROM_BASE, BOOTROM_SIZE);
 	mvebu_mbus_add_window_by_id(crypto_eng_target, crypto_eng_attribute,

arch/arm64/include/asm/kvm_emulate.h

@@ -38,6 +38,11 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu);
 void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr);
 void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
 
+static inline bool vcpu_el1_is_32bit(struct kvm_vcpu *vcpu)
+{
+	return !(vcpu->arch.hcr_el2 & HCR_RW);
+}
+
 static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
 {
 	vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;

arch/arm64/kernel/entry.S

@@ -845,6 +845,9 @@ work_pending:
 	bl	do_notify_resume
 	b	ret_to_user
 work_resched:
+#ifdef CONFIG_TRACE_IRQFLAGS
+	bl	trace_hardirqs_off		// the IRQs are off here, inform the tracing code
+#endif
 	bl	schedule
 
 /*

arch/arm64/kvm/guest.c

@@ -46,6 +46,45 @@ static u64 core_reg_offset_from_id(u64 id)
 	return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE);
 }
 
+static int validate_core_offset(const struct kvm_one_reg *reg)
+{
+	u64 off = core_reg_offset_from_id(reg->id);
+	int size;
+
+	switch (off) {
+	case KVM_REG_ARM_CORE_REG(regs.regs[0]) ...
+	     KVM_REG_ARM_CORE_REG(regs.regs[30]):
+	case KVM_REG_ARM_CORE_REG(regs.sp):
+	case KVM_REG_ARM_CORE_REG(regs.pc):
+	case KVM_REG_ARM_CORE_REG(regs.pstate):
+	case KVM_REG_ARM_CORE_REG(sp_el1):
+	case KVM_REG_ARM_CORE_REG(elr_el1):
+	case KVM_REG_ARM_CORE_REG(spsr[0]) ...
+	     KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]):
+		size = sizeof(__u64);
+		break;
+
+	case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ...
+	     KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]):
+		size = sizeof(__uint128_t);
+		break;
+
+	case KVM_REG_ARM_CORE_REG(fp_regs.fpsr):
+	case KVM_REG_ARM_CORE_REG(fp_regs.fpcr):
+		size = sizeof(__u32);
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	if (KVM_REG_SIZE(reg->id) == size &&
+	    IS_ALIGNED(off, size / sizeof(__u32)))
+		return 0;
+
+	return -EINVAL;
+}
+
 static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 {
 	/*
@@ -65,6 +104,9 @@ static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 	    (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
 		return -ENOENT;
 
+	if (validate_core_offset(reg))
+		return -EINVAL;
+
 	if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id)))
 		return -EFAULT;
 
@@ -87,6 +129,9 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 	    (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
 		return -ENOENT;
 
+	if (validate_core_offset(reg))
+		return -EINVAL;
+
 	if (KVM_REG_SIZE(reg->id) > sizeof(tmp))
 		return -EINVAL;
 
@@ -96,17 +141,25 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 	}
 
 	if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) {
-		u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK;
+		u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK;
 		switch (mode) {
 		case COMPAT_PSR_MODE_USR:
+			if ((read_cpuid(ID_AA64PFR0_EL1) & 0xf) != 2)
+				return -EINVAL;
+			break;
 		case COMPAT_PSR_MODE_FIQ:
 		case COMPAT_PSR_MODE_IRQ:
 		case COMPAT_PSR_MODE_SVC:
 		case COMPAT_PSR_MODE_ABT:
 		case COMPAT_PSR_MODE_UND:
+			if (!vcpu_el1_is_32bit(vcpu))
+				return -EINVAL;
+			break;
 		case PSR_MODE_EL0t:
 		case PSR_MODE_EL1t:
 		case PSR_MODE_EL1h:
+			if (vcpu_el1_is_32bit(vcpu))
+				return -EINVAL;
 			break;
 		default:
 			err = -EINVAL;

arch/hexagon/include/asm/bitops.h

@@ -211,7 +211,7 @@ static inline long ffz(int x)
  * This is defined the same way as ffs.
  * Note fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32.
  */
-static inline long fls(int x)
+static inline int fls(int x)
 {
 	int r;
 
@@ -232,7 +232,7 @@ static inline long fls(int x)
  * the libc and compiler builtin ffs routines, therefore
  * differs in spirit from the above ffz (man ffs).
  */
-static inline long ffs(int x)
+static inline int ffs(int x)
 {
 	int r;
 

arch/hexagon/kernel/dma.c

@@ -79,7 +79,7 @@ static void *hexagon_dma_alloc_coherent(struct device *dev, size_t size,
 			panic("Can't create %s() memory pool!", __func__);
 		else
 			gen_pool_add(coherent_pool,
-				pfn_to_virt(max_low_pfn),
+				(unsigned long)pfn_to_virt(max_low_pfn),
 				hexagon_coherent_pool_size, -1);
 	}
 

arch/powerpc/kernel/machine_kexec.c

@@ -186,7 +186,12 @@ void __init reserve_crashkernel(void)
 			(unsigned long)(crashk_res.start >> 20),
 			(unsigned long)(memblock_phys_mem_size() >> 20));
 
-	memblock_reserve(crashk_res.start, crash_size);
+	if (!memblock_is_region_memory(crashk_res.start, crash_size) ||
+	    memblock_reserve(crashk_res.start, crash_size)) {
+		pr_err("Failed to reserve memory for crashkernel!\n");
+		crashk_res.start = crashk_res.end = 0;
+		return;
+	}
 }
 
 int overlaps_crashkernel(unsigned long start, unsigned long size)

arch/powerpc/kvm/book3s_64_mmu_hv.c

@@ -449,7 +449,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
 	unsigned long pp, key;
 	unsigned long v, gr;
 	__be64 *hptep;
-	int index;
+	long int index;
 	int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
 
 	/* Get SLB entry */

arch/s390/mm/extmem.c

@@ -80,7 +80,7 @@ struct qin64 {
 struct dcss_segment {
 	struct list_head list;
 	char dcss_name[8];
-	char res_name[15];
+	char res_name[16];
 	unsigned long start_addr;
 	unsigned long end;
 	atomic_t ref_count;
@@ -445,7 +445,7 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long
 	memcpy(&seg->res_name, seg->dcss_name, 8);
 	EBCASC(seg->res_name, 8);
 	seg->res_name[8] = '\0';
-	strncat(seg->res_name, " (DCSS)", 7);
+	strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name));
 	seg->res->name = seg->res_name;
 	rc = seg->vm_segtype;
 	if (rc == SEG_TYPE_SC ||

arch/x86/kernel/tsc_msr.c

@@ -21,6 +21,7 @@
 #include <asm/setup.h>
 #include <asm/apic.h>
 #include <asm/param.h>
+#include <asm/tsc.h>
 
 /* CPU reference clock frequency: in KHz */
 #define FREQ_83		83200

arch/x86/mm/numa_emulation.c

@@ -60,7 +60,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei,
 	eb->nid = nid;
 
 	if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
-		emu_nid_to_phys[nid] = nid;
+		emu_nid_to_phys[nid] = pb->nid;
 
 	pb->start += size;
 	if (pb->start >= pb->end) {

arch/x86/vdso/vclock_gettime.c

@@ -46,17 +46,19 @@ static notrace cycle_t vread_hpet(void)
 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
 {
 	long ret;
-	asm("syscall" : "=a" (ret) :
-	    "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : "memory");
+	asm ("syscall" : "=a" (ret), "=m" (*ts) :
+	     "0" (__NR_clock_gettime), "D" (clock), "S" (ts) :
+	     "memory", "rcx", "r11");
 	return ret;
 }
 
 notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz)
 {
 	long ret;
 
-	asm("syscall" : "=a" (ret) :
-	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
+	asm ("syscall" : "=a" (ret), "=m" (*tv), "=m" (*tz) :
+	     "0" (__NR_gettimeofday), "D" (tv), "S" (tz) :
+	     "memory", "rcx", "r11");
 	return ret;
 }
 
@@ -136,13 +138,13 @@ notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
 {
 	long ret;
 
-	asm(
+	asm (
 		"mov %%ebx, %%edx \n"
-		"mov %2, %%ebx \n"
+		"mov %[clock], %%ebx \n"
 		"call __kernel_vsyscall \n"
 		"mov %%edx, %%ebx \n"
-		: "=a" (ret)
-		: "0" (__NR_clock_gettime), "g" (clock), "c" (ts)
+		: "=a" (ret), "=m" (*ts)
+		: "0" (__NR_clock_gettime), [clock] "g" (clock), "c" (ts)
 		: "memory", "edx");
 	return ret;
 }
@@ -151,13 +153,13 @@ notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz)
 {
 	long ret;
 
-	asm(
+	asm (
 		"mov %%ebx, %%edx \n"
-		"mov %2, %%ebx \n"
+		"mov %[tv], %%ebx \n"
 		"call __kernel_vsyscall \n"
 		"mov %%edx, %%ebx \n"
-		: "=a" (ret)
-		: "0" (__NR_gettimeofday), "g" (tv), "c" (tz)
+		: "=a" (ret), "=m" (*tv), "=m" (*tz)
+		: "0" (__NR_gettimeofday), [tv] "g" (tv), "c" (tz)
 		: "memory", "edx");
 	return ret;
 }

crypto/ablkcipher.c

@@ -382,6 +382,7 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
 	strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
@@ -463,6 +464,7 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
 	strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;

crypto/blkcipher.c

@@ -514,6 +514,7 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
 	strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize;

drivers/base/power/main.c

@@ -1352,8 +1352,10 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
 
 	dpm_wait_for_children(dev, async);
 
-	if (async_error)
+	if (async_error) {
+		dev->power.direct_complete = false;
 		goto Complete;
+	}
 
 	/*
 	 * If a device configured to wake up the system from sleep states
@@ -1368,6 +1370,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
 		pm_get_active_wakeup_sources(suspend_abort,
 			MAX_SUSPEND_ABORT_LEN);
 		log_suspend_abort_reason(suspend_abort);
+		dev->power.direct_complete = false;
 		async_error = -EBUSY;
 		goto Complete;
 	}

drivers/block/floppy.c

@@ -3459,6 +3459,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 					  (struct floppy_struct **)&outparam);
 		if (ret)
 			return ret;
+		memcpy(&inparam.g, outparam,
+				offsetof(struct floppy_struct, name));
+		outparam = &inparam.g;
 		break;
 	case FDMSGON:
 		UDP->flags |= FTD_MSG;