ARM: rockchip: rk3228: implement function rk3228_restart

Change-Id: If6c5630a1ea9a8ebb95f527bd5d1aff082da079f
Signed-off-by: Chen Liang <cl@rock-chips.com>

ARM: rockchip: rk3228: add cru definition

Change-Id: If9fef6aa30685b727f271644eafdebab2ba1e441
Signed-off-by: Chen Liang <cl@rock-chips.com>

ARM: rockchip: rk3228: add efuse support

Change-Id: Ice2a00bd053d26303cc57c45fbc256b57eb95da0
Signed-off-by: Chen Liang <cl@rock-chips.com>

net: rockchip: gmac: support RK3228

Change-Id: I1cf343d2d7768681b7ec2ad0d95484267d59b82b
Signed-off-by: Roger Chen <roger.chen@rock-chips.com>

mmc: remove bondage between REQ_META and reliable write

Anytime a write operation is performed with Reliable Write flag enabled,
the eMMC device is enforced to bypass the cache and do a write to the
underling NVM device by Jedec specification; this causes a performance
penalty since write operations can't be optimized by the device cache.

In our tests, we replayed a typical mobile daily trace pattern and found
~9% overall time reduction in trace replay by using this patch. Also the
write ops within 4KB~64KB chunk size range get a 40~60% performance
improvement by using the patch (as this range of write chunks are the ones
affected by REQ_META).

This patch has been discussed in the Mobile & Embedded Linux Storage Forum
and it's the results of feedbacks from many people. We also checked with
fsdevl and f2fs mailing list developers that this change in the usage of
REQ_META is not affecting FS behavior and we got positive feedbacks.
Reporting here the feedbacks:
http://comments.gmane.org/gmane.linux.file-systems/97219
http://thread.gmane.org/gmane.linux.file-systems.f2fs/3178/focus=3183

Change-Id: I2143841c439b47d6ce161ff3ad05277ea867f51b
Signed-off-by: Bruce Ford <bford@micron.com>
Signed-off-by: Luca Porzio <lporzio@micron.com>
Fixes: ce39f9d17c14 ("mmc: support packed write command for eMMC4.5 devices")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>

ARM: dts: fix emmc/sdio/sd clkgates and offset for rk3228

Fixes: 2cb01afbb ("ARM: rk3228: dtsi: add SDCard/SDIO/eMMC ...")
Change-Id: Ie1fcd214d6dc3ec7e13ab54ada24dc71b8e7ffd3
Signed-off-by: xiaoyao <xiaoyao@rock-chips.com>

ARM: dts: add sdmmc/sdio pinctrl for rk3228

Change-Id: I0c3f3159d46705de40ca6ff7de4a8aee6ea17a24
Signed-off-by: xiaoyao <xiaoyao@rock-chips.com>

mmc: rk_sdmmc: support RK3228 chip

Add a variable to distinguish between types of chips, eg:
DW_MCI_TYPE_RK3228. The purpose is to add a unique code
in the future.

Change-Id: I6608ae7af0579343cabe92deddefe73b8e5d2194
Signed-off-by: xiaoyao <xiaoyao@rock-chips.com>

arm: rockchip: rk3228: dts: add pwm regulator, i2c rtc, wifi & bt

Change-Id: I2836ddab4e214ec43c9969457b7209a6fe948184
Signed-off-by: Huang zhibao <hzb@rock-chips.com>

ARM: rockchip: rk3228: add grf definition

Change-Id: Ifea3e16e7d0141b09d9df26a247e884d0c9f72e7
Signed-off-by: Chen Liang <cl@rock-chips.com>

rk: restore file mode

Change-Id: I3ac6ae87fc7ed90fa5ece0b6cb0ffe1a2561fa1d
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ASoC: restore spdif_receiver.c and spdif_transciever.c

Change-Id: I2eeca8b4be12c35bcc3d172f8b165c417a2561c8
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

rk_fb.h: remove multiple definitions

Change-Id: I34b7d0a4db251521693a5d13ace0d33ccad1717e
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

ARM: dts: rk3228: add usb node

Change-Id: I4ccd1fb9ad2cd5b036d0cfde736fe990ad0673d0
Signed-off-by: Yunzhi Li <lyz@rock-chips.com>

mmc: dw_mmc: fix the CardThreshold boundary at CardThrCtl register

According to DesignWare DoC file, CardThreshold bit should be
bit[27:16].
So it's correct to use (0xFFF << 16), not (0x1FFF << 16).

Change-Id: I184fff75e6e72624a22cdfc6b0ffcc236ffb07c2
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>

ARM: dtsi: rk3228: add dram timing node

Change-Id: Ieb7c43f6e546e75e72c7db99894d6ca0cfbb31a1
Signed-off-by: Tang Yun ping <typ@rock-chips.com>

video: lcdc: rk3228: fix colorspace for output YCBCR

Change-Id: I192a85c6d60a09c5f9a80b518690f0aac025becd
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

video: lcdc: rk3228: add vop tvout support

Change-Id: Ibfa16c73735132e0a50f7b52efb75681e61d9b20
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

video: lcdc: rk3228: fix interlace display

New version H/W don't need yszie div 2 anymore.

Change-Id: I1c8927ad5dd00fd1af16ef9ca60c9979b4db696e
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

video: hdmi: judge interlace mode from vmode bit mask

Vmode is a flag with bit mask, we can't judge interlace mode
from equal compare, need mask its bit.

Change-Id: Iad69bd52173c5ea179639deaff25f9a4ed3fc5d3
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

video: lcdc: judge interlace mode from vmode bit mask

Vmode is a flag with bit mask, we can't judge interlace mode
from equal compare, need mask its bit.

Change-Id: I0cc53503198f98dc58369f4c9e6dd78b47095968
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

rk_fb: add RGB BT709/BT2020 format

Change-Id: I9581f78955c3efe77375bfa5e8ac571ac1d5aae4
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

rk_fb: set interlace flag for dts timing

Change-Id: I8711cefdf224af88214ed39d9ae225be8bc62304
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

camera: rk_camsys: rk3288: change gpio map method in camsys_gpio.h

rk3288 gpio bank0 only has 24 pins not 32 pins,so modify the gpio map
method for rk3288.

Change-Id: I1d59b25d9acb0f51f9a1ad8ec74db2952534b1f2
Signed-off-by: ZhongYichong <zyc@rock-chips.com>

ARM: dts: rk3228-sdk: enable nandc

Change-Id: I449544595eb93f6cb9d7154aced253bebe1dceb7
Signed-off-by: Zhaoyifeng <zyf@rock-chips.com>

 ARM: dts: rk3228: add nandc support

Change-Id: I40ddba4f4ce56a34ca5e448f1dfbcc06c2ad445c
Signed-off-by: Zhaoyifeng <zyf@rock-chips.com>

mmc: Allow forward compatibility for eMMC

As stated by the eMMC 5.0 specification, a chip should not be rejected
only because of the revision stated in the EXT_CSD_REV field of the
EXT_CSD register.

Remove the control on this value, the control of the CSD_STRUCTURE field
should be sufficient to reject future incompatible changes.

Change-Id: Ib69314bee902a4036183ef9a3565d9f0423ec971
Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>

ARM: dts: rk3228-sdk: enable psci

Change-Id: I0d965a15e2938f8b54d056d0b7e21ec9ce33ee57
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

ARM: dtsi: rk3228: add psci support

This is just add psci code into kernel, if you want to enable psci,
you must add psci=enable in the Command Line.

Change-Id: Iaf0e0116cbaba0d210cb99d59c0ee82768bf54bb
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

ARM: rockchip: support arch32 psci suspend

Change-Id: I0341d1c019b8c00376af574cd9f51e87fafa8601
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

arm: rockchip: rk3228: dts: add pwm remote-ctrl

Change-Id: Iccb31c2472238887b24ca61d7c7bdcb54a1e0778
Signed-off-by: Huang zhibao <hzb@rock-chips.com>

video: rockchip: fb: delete DISPLAY_POLICY_BOX_TEMP

Change-Id: I59147b833754d5417d2813eb902923b4f700a9b0
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

ARM: dts: rk3288-box: set disp-policy to DISPLAY_POLICY_BOX

Change-Id: I3ede07d2c26aaef44ec7165353a3b3d6a6177f6e
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

ARM64: dts: rk3368-box: set disp-policy to DISPLAY_POLICY_BOX

Change-Id: Ib97c581b7488926d5f4203ea1d61ff706118bcc5
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

i2c: rockchip: fix power off issue for rk818

The power off sequence is behind of i2c bus shutdown func,
it would prevent the rk818 to do power off action. The irq was
disabled when rk818 power off, it could let rk818 to power off
through i2c bus.

Change-Id: Ia6155f137ab2fa36dbe19e06878b0228670b1398
Signed-off-by: David Wu <wdc@rock-chips.com>

hdmi: cec: add HDMI_IOCTL_CECWAKESTATE

android HDMI CEC HAL need to know cec state when resume,
so we add the HDMI_IOCTL_CECWAKESTATE.

Change-Id: Iff942c6085d10891200cd873cc2ba53e9a2d6cad
Signed-off-by: Shen Zhenyi <szy@rock-chips.com>

arm64: rockchip: rk3368: dts: modify dvfs_table for core

Change-Id: I73c4a277b9fa38160f5206ebd8603984535f0ade
Signed-off-by: Xiao Feng <xf@rock-chips.com>

pinctrl: rockchip: fix crashed issue during pinctrl suspend

if the chip was rk3288, it didn't use pinctrl-rk3368.c,
but pinctrl-rockchip.c, driver of pinctrl-rk3368 was not registered.
It would make the NULL pointer at pinctrl-rk3368 suspend func.

Change-Id: I09dd4fb9b8bf001a4222ed9bef62347785b9906f
Signed-off-by: David Wu <wdc@rock-chips.com>

rk312x, mali_400: upgrade rk_ko_ver to 5.

Change-Id: If1851d44e75ef16e1b916ecb910526f749822be0
Signed-off-by: chenzhen <chenzhen@rock-chips.com>

ion: rockchip-ion: add API to set memory region secured

Add ion ioctl command -ION_IOC_SET_SECURED
for user to set memory region secured.

Change-Id: Ic4a7432ab8d2fd9f60fdfe7457e92f7c99768e12
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

ARM: rockchip-psci: add interface for ion to set memory secured

Add function "psci_set_memory_secure" for device to set memory
region secured.

Change-Id: Ife807c91d37ae66a5e1a0a3d8263c68cd601937d
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

rk312x, mali_400: make it more 'difficult' to dump down in mali_dvfs_list.

Change-Id: If5fd646aa6ca7f7383db70c84ff71f1570fe23b1
Signed-off-by: chenzhen <chenzhen@rock-chips.com>

ARM: rockchip: rockchip_defconfig enable IP_MULTICAST

Change-Id: Ic40cb94753f9fedc548ae6a77b36d0bed5754d88
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip: rockchip_defconfig enable UID_CPUTIME

Change-Id: Ifb92e539e868ed15561ae8698b226422fae5fee8
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip: rockchip_defconfig enable kernel-mode NEON and NEON based cypto

Change-Id: Ie3975cd780bbbedaaa2e3384d49e9f90734b65fe
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip-psci: add function id for secure memory set

Change-Id: I73c0b2c603a4b72f07804c684cd89bc82e5529c4
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

ARM: rockchip: psci support arch32 and arch64 smc call

Change-Id: I736c6c15cbb41d52aa9ef1e98cb9ebdd6ac9ebfc
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

arm64: rockchip: rockchip_defconfig enable IP_MULTICAST

Change-Id: I07f7ad04f89c54b582b756c43d9841d99883e6df
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

arm64: rockchip: rockchip_defconfig enable UID_CPUTIME

Change-Id: Ia6f86bf86220261eda27ae1bba880fdf61241d5c
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: dts: rk3228: add ion node

Add ion node, with two memory reserved region,
cma-heap and system-heap

Change-Id: Ic6c4da56e0c608135653f901f37adfed7bc7cb15
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

arm64: rockchip: rockchip_defconfig enable ARM v8 crypto

Change-Id: I67d9ab8d0e8412e9899e64378beba8dd0764b310
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

arm64: rockchip: add support for kernel mode NEON

Change-Id: I964c5dad5562f0342b1d11d9a0483fcac0394e4d
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

rockchip: quiet module_request personality-8

In Android-M, below change in bionic was introduced
https://android-review.googlesource.com/122131

Which caused lot of SELinux denials to be logged regarding
module_request (similar to below one) for 32bit systems,
There is quite a lot of module_request denials when any 32bit
executable is executed.

type=1400 audit(946685139.719:12): avc: denied { module_request }
for pid=1970 comm="tzdatacheck" kmod="personality-8"
scontext=u:r:tzdatacheck:s0 tcontext=u:r:kernel:s0 tclass=system
permissive=1

So we patch the kernel to not attempt module loading for alternate
execution environments.

Change-Id: I7bd2c5fc08fd00fa7ff53d3ced401564b474fad4
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

mmc: dw_mmc: fix the max_blk_count in IDMAC

Even though 1MB is reserved for descriptor table in IDMAC,
the dw_mmc host driver is allowed to receive only maximum
128KB block length in one request. This is caused by setting
improper max_blk_count. It needs to be e adjusted so that
descriptor table is used fully. It is found that the performance
is improved with the increased the max_blk_count.

Change-Id: Ie4042f9e1924e0f575b9865aa721b7b61305c13d
Signed-off-by: Seungwon Jeon <tgih.jun@samsung.com>
Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>

ARM: dts: rk3228: hdmi: add pinctrl and pclk_hdmi_phy

Change-Id: I5570a3bf1970e6f8748cab55fea06a11af5c4f3e
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

Merge branch 'android-3.10'

Exclude:
ext4 crypto
nl80211: fix scheduled scan RSSI matchset attribute confusion
mmc
Add wlan platform partial_resume handler
wlan: Add WLAN_PLAT_AP_FLAG for SOFTAP country code
ipc
zram

uid_cputime: Check for the range while removing range of UIDs.

Checking if the uid_entry->uid matches the uid intended to be removed will
prevent deleting unwanted uid_entry.
Type cast the key for the hashtable to the same size, as when they were
inserted. This will make sure that we can find the uid_entry we want.

Bug: 25195548
Change-Id: I567942123cfb20e4b61ad624da19ec4cc84642c1
Signed-off: Ruchi kandoi <kandoiruchi@google.com>
(cherry picked from commit 170458885df2e4e081d3f8489cfd4f66a9598995)

Revert "android: binder: Change binder mutex to rtmutex."

This reverts commit ebce7cd30b3e00232c8be23d0f04d7c0599089b5.

This ends up doing more damage than good on most devices. Go back to
using a standard mutex.

(cherry picked from commit ea93186577de4fae3a2273c296bfcf1839048df0)

ipv6: inet6_sk() should use sk_fullsock()

SYN_RECV & TIMEWAIT sockets are not full blown, they do not have a pinet6
pointer.

Bug: 24163529
Change-Id: I6ce67a190d67d200c6ebeb81d2daeb9c86cd7581
Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
(cherry picked from commit feee3c175c23ae72ed17154caaa82a3002de0023)

net: add sk_fullsock() helper

We have many places where we want to check if a socket is
not a timewait or request socket. Use a helper to avoid
hard coding this.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[backported from net-next 1d0ab253872cdd3d8e7913f59c266c7fd01771d0]
[lorenzo@google.com: removed TCPF_NEW_SYN_RECV, and added a comment to add it back.]

Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Bug: 24163529
Change-Id: Ibf09017e1ab00af5e6925273117c335d7f515d73
(cherry picked from commit cdab04e3612c55f0906c84c3c05996a0507eab7d)

lowmemorykiller: trace kill events.

Allows for capturing lmk kill events and
their rationale.

Change-Id: Ibe215db5bb9806fc550c72c0b9832c85cbd56bf6
Signed-off-by: Martijn Coenen <maco@google.com>
(cherry picked from commit 6cfb58f07af4b913508f087fe551a08f5a21eb88)

arm64/crypto: use crypto instructions to generate AES key schedule

(cherry pick from commit 12ac3efe74f888a13cb4df88b38bb01e8034dea8)

This patch implements the AES key schedule generation using ARMv8
Crypto Instructions. It replaces the table based C implementation
in aes_generic.ko, which means we can drop the dependency on that
module.

Tested-by: Steve Capper <steve.capper@linaro.org>
Acked-by: Steve Capper <steve.capper@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23181629
(cherry picked from commit 60b9dd6043fdc26860d850c364fd92b1f4e170fc)

arm64: crypto: Change priority of arm64 aes cipher.

(cherry pick from commit d802476e8db2eb616d47d0a06310276532cc2ffa)

Change-Id: I0c614e0eca71b65945ff8bd17c65b03a02918b18
Signed-off-by: Riley Andrews <riandrews@google.com>
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23181629
(cherry picked from commit 52d464160266101140ce95992256c25cc03e2bb3)

selinux: do not check open perm on ftruncate call

Use the ATTR_FILE attribute to distinguish between truncate()
and ftruncate() system calls. The two other cases where
do_truncate is called with a filp (and therefore ATTR_FILE is set)
are for coredump files and for open(O_TRUNC). In both of those cases
the open permission has already been checked during file open and
therefore does not need to be repeated.

Commit 95dbf739313f ("SELinux: check OPEN on truncate calls")
fixed a major issue where domains were allowed to truncate files
without the open permission. However, it introduced a new bug where
a domain with the write permission can no longer ftruncate files
without the open permission, even when they receive an already open
file.

(cherry picked from commit b21800f304392ee5d20f411c37470183cc779f11)

Bug: 22567870
Change-Id: Id7c305e46beba5091c2c777529bd468216aae1c3

Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>
(cherry picked from commit df46bc83c1fc9b64b2e86290935a3ad550b2e56e)

Fix NULL pointer dereference in tcp_nuke_addr.

tcp_nuke addr only grabs the bottom half socket lock, but not the
userspace socket lock. This allows a userspace program to call
close() while the socket is running, which causes a NULL pointer
dereference in inet_put_port.

Bug: 23663111
Bug: 24072792
Change-Id: Iecb63af68c2db4764c74785153d1c9054f76b94f
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
(cherry picked from commit 74d66ee756afcc3269e4c1341f793c52be629af9)

usb: phy: fix dual role sysfs build if kernel modules are supported

Add a missing ";" after EXPORT_SYMBOL() otherwise we run
into following build error if Kernel Modules are supported:
----------
  CC      drivers/usb/phy/class-dual-role.o
drivers/usb/phy/class-dual-role.c:91:1: error: expected ',' or ';' before 'int'
 int dual_role_get_property(struct dual_role_phy_instance *dual_role,
 ^
make[3]: *** [drivers/usb/phy/class-dual-role.o] Error 1
----------

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
(cherry picked from commit 9ff158f4c245c2fecb1489a4aae62ca67c0846a1)

Change-Id: I7ec77584b3a753448ddc50a74204a20f4636f8a4
(cherry picked from commit f5af56b478111455ce9041d958b83f13bc742af6)

ion: Handle the memory mapping correctly on x86

This patch modifies the ion page pool code to address
limitation in x86 PAT. When one physical page is mapped
to multiple virtual pages, the same cache policy
should be used. Add set_memory_wc/uc call to avoid aliases.
If not, all mappings will be cached(write back).

Change-Id: I98ee8902df0c80135dddfa998c4ca4c2bb44e40e
Signed-off-by: Zhebin Jin <zhebin.jin@intel.com>
Signed-off-by: Vinil Cheeramvelil <vinil.cheeramvelil@intel.com>
(cherry picked from commit 6db47cc7e2f1d8dd8fc84912202ed749d6781a76)

Conflicts:
drivers/staging/android/ion/Kconfig
drivers/staging/android/ion/ion_priv.h

usb: phy: Dual role sysfs class definition

This CL adds a new class to monitor and change
dual role usb ports from userspace. The usb
phy drivers can register to the dual_role_usb
class and expose the capabilities of the ports.
The phy drivers can decide on whether a specific
attribute can be changed from userspace by
choosing to implement the appropriate callback.

Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Bug: 21615151
Change-Id: I121b4a94437972b5abe8f781e3007efa8531978
(cherry picked from commit f3061b9d608ce2314f24088281131ebadafa3985)

trace/events: fix compilation error

include/trace/events/filemap.h: In function 'ftrace_raw_output_mm_filemap_find_page_cache_miss':
include/trace/ftrace.h:232:9: error: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'size_t' [-Werror=format=]

Change-Id: Ic2d76f18fc8802cf1e2246f96d84a06d267a30ad
Signed-off-by: Jin Qian <jinqian@google.com>
(cherry picked from commit c91e2d317307431283b96ce040e8aefd44b0b286)

sysrq: Emergency Remount R/O in reverse order

This change fixes a problem where reboot on Android panics the kernel
almost every time when file systems are mounted over loop devices.

Android reboot command does:
- sync
- echo u > /proc/sysrq-trigger
- syscall_reboot

The problem is with sysrq emergency remount R/O trying to remount-ro
in wrong order.
since /data is re-mounted ro before loop devices, loop device
remount-ro fails to flush the journal and panics the kernel:

  EXT4-fs (loop0): Remounting filesystem read-only
  EXT4-fs (loop0): previous I/O error to superblock detected
  loop: Write error at byte offset 0, length 4096.
  Buffer I/O error on device loop0, logical block 0
  lost page write due to I/O error on loop0
  Kernel panic - not syncing: EXT4-fs panic from previous error

The fix is quite simple. In do_emergency_remount(), use
list_for_each_entry_reverse() on sb list instead of list_for_each_entry().
It makes a lot of sense to umount the file systems in reverse order in
which they were added to sb list.

Change-Id: I4370e39b5873bd16ade5d5f9ddb2704beb02a2bb
Signed-off-by: Amir Goldstein <amir@cellrox.com>
Acked-by: Oren Laadan <orenl@cellrox.com>
(cherry picked from commit 334cc257d864f112b64fb885be908e6cdd644c08)

pstore: pmsg: return -ENOMEM on vmalloc failure

Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23385441
Change-Id: I294cb72c25bddafbba4e64fdb0a18ae46655a05d
(cherry picked from commit 62bb84973c1d55a4cc35cc4d95cb723ce0aa2c0b)

Page cache miss tracing using ftrace on mm/filemap

This patch includes two trace events on generic_perform_write and
do_generic_file_read to check on the address_space mapping for the
pages to be accessed by the request.

Change-Id: Ib319b9b2c971b9e5c76645be6cfd995ef9465d77
Signed-off-by: Daniel Campello <campello@google.com>
(cherry picked from commit d3952c50853166bd04562766c9603ed86ab0da75)

Conflicts:
include/linux/pagemap.h

wakeup_reason: use vsnprintf instead of snsprintf for vargs.

Bug: 22368519
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit 26dfa1394af4da60bf8ce7c5e56168b1ad8f2179)

uid_cputime: Iterates over all the threads instead of processes.

Bug: 22833116
Change-Id: I775a18f61bd2f4df2bec23d01bd49421d0969f87
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit eb9cf7d0d416edc93edfe6e784189f02c82701a1)

ipv6: sysctl to restrict candidate source addresses

Per RFC 6724, section 4, "Candidate Source Addresses":

    It is RECOMMENDED that the candidate source addresses be the set
    of unicast addresses assigned to the interface that will be used
    to send to the destination (the "outgoing" interface).

Add a sysctl to enable this behaviour.

Signed-off-by: Erik Kline <ek@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[Simplified back-port of net-next 3985e8a3611a93bb36789f65db862e5700aab65e]

Bug: 19470192
Bug: 21832279
Bug: 22464419
Change-Id: Ib74ef945dcabe64215064f15ee1660b6524d65ce
(cherry picked from commit 0633924e7776754ccb473d649e5fa9ee45617a46)

uid_cputime: fix cputime overflow

Converting cputime_t to usec caused overflow when the value is greater
than 1 hour. Use msec and convert to unsigned long long to support bigger
range.

Bug: 22461683

Change-Id: I853fe3e8e7dbf0d3e2cc5c6f9688a5a6e1f1fb3e
Signed-off-by: Jin Qian <jinqian@google.com>
(cherry picked from commit 75bf23fe4bfb1805b411965b5ce3c4b81b957898)

initramfs: Add skip_initramfs command line option

Add a skip_initramfs option to allow choosing whether to boot using
the initramfs or not at runtime.

Change-Id: If30428fa748c1d4d3d7b9d97c1f781de5e4558c3
Signed-off-by: Rom Lemarchand <romlem@google.com>
(cherry picked from commit 6f36227aa43c9e4b17a2dcda6a38e79d1b00d1b5)

cpu_power: Avoids race condition when the task exits.

When the task is terminated, the cpu_power for that particular task is
added to the terminated tasks. cpu_power is set to ULLONG_MAX at this
point to avoid double accounting of the power. It is possible that before the
task releases all the resources, cpu reschedules the task or a timer
interrupt is fired. At this point we will try to add the additional time
to the process, which will cause the accounting to be skewed. This
avoids the case where we change the cpu_power when it is already set to
ULLONG_MAX.

Bug: 22064385
Change-Id: I405733725d535b0a864088516bf52fa3638ee6aa
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit fd72341df7e6e8b834f5d4ec86a30f248eb96385)

Fix arch/arm/crypto/sha256_glue.c

MODULE_ALIAS_CRYPTO is not defined, use MODULE_ALIAS.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Change-Id: I24803dbbbf7ac7889bc027f69af371b594eca835
(cherry picked from 5eb3cca16fcf9c62753058aaf73bb12b71acba79)

(cherry picked from commit 9645fcee58b4af5f9f9a530f0fb514e7245012a8)

of: add empty of_find_node_by_path() for !OF

Add an empty version of of_find_node_by_path().
This fixes following build error for asoc tree:
sound/soc/fsl/fsl_ssi.c: In function 'fsl_ssi_probe':
sound/soc/fsl/fsl_ssi.c:1471:2: error: implicit declaration of function 'of_find_node_by_path' [-Werror=implicit-function-declaration]
  sprop = of_get_property(of_find_node_by_path("/"), "compatible", NULL);

Change-Id: Ib635dffb97877a2820fb80b99db96a285a6d2d14
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Rob Herring <robh@kernel.org>
(cherry picked from commit 9e7f1b065a312062eb8acdb1c505ddb3792b7583)

uid_cputime: Avoids double accounting of process stime, utime and cpu_power in
task exit.

This avoids the race where a particular process is terminating and we
read the show_uid_stats. At this time since the task_struct still exists
and we will account for the terminating process as one of the active
task, where as the stats would have been added in the task exit
callback.

Bug: 22064385
Change-Id: Id2ae04b33fcd230eda9683a41b6019d4dd8f5d85
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit ddd9aac59e0aea3d5a4df485173115e8ecb3e17d)

Shrink ashmem directly through shmem_fallocate

When ashmem_shrink is called from direct reclaim on a user thread, a
call to do_fallocate will check for permissions against the security
policy of that user thread.  It can thus fail by chance if called on a
thread that isn't permitted to modify the relevant ashmem areas.

Because we know that we have a shmem file underneath, call the shmem
implementation of fallocate directly instead of going through the
user-space interface for fallocate.

FIX=DMS06243560
Area: Kernel/Linux Kernel

Bug: 21951515
Change-Id: Ie98fff18a2bdeb535cd24d4fbdd13677e12681a7
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
(cherry picked from commit 2ecc7f173a30ee7df10240d6944108252a5f5b7d)

cpufreq: Iterate over all the possible cpus to create powerstats.

For architectures which support a single policy for multiple cpus,
powerstats will not be initalized for all the cores. This change will
make sure powerstats is initialized for all the cores.

Also minor changes to increase code readability.

Bug: 21498425
Change-Id: I938f45e92ff6d5371c32c4d0e37274e6de66769c
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit 5862c50d1970886b5b5a57b5b52ecfd6feb95ebd)

Merge tag 'v3.10.92'

This is the 3.10.92 stable release

Merge tag 'lsk-v3.10-15.10-android'

LSK Android 15.10 v3.10

uart: rockchip: add uart supported for rk3228

Change-Id: I86b49f20954a739645b9277e45d6b75058ff9c2b
Signed-off-by: David Wu <wdc@rock-chips.com>

ARM: dts: rk3228: tsadc: support tsadc for rk3228

add rk3228 tsadc parameter for dtsi.

Change-Id: I74cc9b6c2e4d53aa5e3391d5a820937925f07077
Signed-off-by: zhangqing <zhangqing@rock-chips.com>

Linux 3.10.92

rbd: fix double free on rbd_dev->header_name

commit 3ebe138ac642a195c7f2efdb918f464734421fd6 upstream.

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dm thin: fix missing pool reference count decrement in pool_ctr error path

commit ba30670f4d5292c4e7f7980bbd5071f7c4794cdd upstream.

Fixes: ac8c3f3df ("dm thin: generate event when metadata threshold passed")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

workqueue: make sure delayed work run in local cpu

commit 874bbfe600a660cba9c776b3957b1ce393151b76 upstream.

My system keeps crashing with below message. vmstat_update() schedules a delayed
work in current cpu and expects the work runs in the cpu.
schedule_delayed_work() is expected to make delayed work run in local cpu. The
problem is timer can be migrated with NO_HZ. __queue_work() queues work in
timer handler, which could run in a different cpu other than where the delayed
work is scheduled. The end result is the delayed work runs in different cpu.
The patch makes __queue_delayed_work records local cpu earlier. Where the timer
runs doesn't change where the work runs with the change.

[   28.010131] ------------[ cut here ]------------
[   28.010609] kernel BUG at ../mm/vmstat.c:1392!
[   28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
[   28.011860] Modules linked in:
[   28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G        W4.3.0-rc3+ #634
[   28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014
[   28.014160] Workqueue: events vmstat_update
[   28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000
[   28.015445] RIP: 0010:[<ffffffff8115f921>]  [<ffffffff8115f921>]vmstat_update+0x31/0x80
[   28.016282] RSP: 0018:ffff8800ba42fd80  EFLAGS: 00010297
[   28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000
[   28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d
[   28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000
[   28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640
[   28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000
[   28.020071] FS:  0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000
[   28.020071] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0
[   28.020071] Stack:
[   28.020071]  ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88
[   28.020071]  ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8
[   28.020071]  ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340
[   28.020071] Call Trace:
[   28.020071]  [<ffffffff8106bd88>] process_one_work+0x1c8/0x540
[   28.020071]  [<ffffffff8106bd0b>] ? process_one_work+0x14b/0x540
[   28.020071]  [<ffffffff8106c214>] worker_thread+0x114/0x460
[   28.020071]  [<ffffffff8106c100>] ? process_one_work+0x540/0x540
[   28.020071]  [<ffffffff81071bf8>] kthread+0xf8/0x110
[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200
[   28.020071]  [<ffffffff81a6522f>] ret_from_fork+0x3f/0x70
[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200

Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

i2c: rcar: enable RuntimePM before registering to the core

commit 4f7effddf4549d57114289f273710f077c4c330a upstream.

The core may register clients attached to this master which may use
funtionality from the master. So, RuntimePM must be enabled before, otherwise
this will fail. While here, move drvdata, too.

Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: ahash - ensure statesize is non-zero

commit 8996eafdcbad149ac0f772fb1649fbb75c482a6a upstream.

Unlike shash algorithms, ahash drivers must implement export
and import as their descriptors may contain hardware state and
cannot be exported as is.  Unfortunately some ahash drivers did
not provide them and end up causing crashes with algif_hash.

This patch adds a check to prevent these drivers from registering
ahash algorithms until they are fixed.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: sparc - initialize blkcipher.ivsize

commit a66d7f724a96d6fd279bfbd2ee488def6b081bea upstream.

Some of the crypto algorithms write to the initialization vector,
but no space has been allocated for it. This clobbers adjacent memory.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

m68k/uaccess: Fix asm constraints for userspace access

commit 631d8b674f5f8235e9cb7e628b0fe9e5200e3158 upstream.

When compiling a MMU kernel with CPU_HAS_ADDRESS_SPACES=n (e.g. "MMU=y
allnoconfig": "echo CONFIG_MMU=y > allno.config && make KCONFIG_ALLCONFIG=1
allnoconfig"), we use plain "move" instead of "moves", and I got:

  CC      arch/m68k/lib/uaccess.o
{standard input}: Assembler messages:
{standard input}:47: Error: operands mismatch -- statement `move.b %a0,(%a1)' ignored

This happens because plain "move" doesn't support byte transfers between
memory and address registers, while "moves" does.

Fix the asm constraints for __generic_copy_from_user(),
__generic_copy_to_user(), and __clear_user() to only use data registers
when accessing userspace.

Also, relax the asm constraints for 16-bit userspace accesses in
__put_user() and __get_user(), as both "move" and "moves" do support
such transfers between memory and address registers.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

asix: Do full reset during ax88772_bind

[ Upstream commit 436c2a5036b6ffe813310df2cf327d3b69be0734 ]

commit 3cc81d85ee01 ("asix: Don't reset PHY on if_up for ASIX 88772")
causes the ethernet on Arndale to no longer function. This appears to
be because the Arndale ethernet requires a full reset before it will
function correctly, however simply reverting the above patch causes
problems with ethtool settings getting reset.

It seems the problem is that the ethernet is not properly reset during
bind, and indeed the code in ax88772_bind that resets the device is a
very small subset of the actual ax88772_reset function. This patch uses
ax88772_reset in place of the existing reset code in ax88772_bind which
removes some code duplication and fixes the ethernet on Arndale.

It is still possible that the original patch causes some issues with
suspend and resume but that seems like a separate issue and I haven't
had a chance to test that yet.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Tested-by: Riku Voipio <riku.voipio@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

asix: Don't reset PHY on if_up for ASIX 88772

[ Upstream commit 3cc81d85ee01e5a0b7ea2f4190e2ed1165f53c31 ]

I've noticed every time the interface is set to 'up,', the kernel
reports that the link speed is set to 100 Mbps/Full Duplex, even
when ethtool is used to set autonegotiation to 'off', half
duplex, 10 Mbps.
It can be tested by:
 ifconfig eth0 down
 ethtool -s eth0 autoneg off speed 10 duplex half
 ifconfig eth0 up

Then checking 'dmesg' for the link speed.

Signed-off-by: Michel Stam <m.stam@fugro.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings

[ Upstream commit 077cb37fcf6f00a45f375161200b5ee0cd4e937b ]

It seems that kernel memory can leak into userspace by a
kmalloc, ethtool_get_strings, then copy_to_user sequence.

Avoid this by using kcalloc to zero fill the copied buffer.

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ppp: don't override sk->sk_state in pppoe_flush_dev()

[ Upstream commit e6740165b8f7f06d8caee0fceab3fb9d790a6fed ]

Since commit 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"),
pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the
PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to
PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the
following oops:

[  570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0
[  570.142931] IP: [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0
[  570.144601] Oops: 0000 [#1] SMP
[  570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio
[  570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1
[  570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[  570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000
[  570.144601] RIP: 0010:[<ffffffffa018c701>]  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601] RSP: 0018:ffff880036b63e08  EFLAGS: 00010202
[  570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206
[  570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20
[  570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000
[  570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780
[  570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0
[  570.144601] FS:  00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000
[  570.144601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0
[  570.144601] Stack:
[  570.144601]  ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0
[  570.144601]  ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008
[  570.144601]  ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5
[  570.144601] Call Trace:
[  570.144601]  [<ffffffff812caabe>] sock_release+0x1a/0x75
[  570.144601]  [<ffffffff812cabad>] sock_close+0xd/0x11
[  570.144601]  [<ffffffff811347f5>] __fput+0xff/0x1a5
[  570.144601]  [<ffffffff811348cb>] ____fput+0x9/0xb
[  570.144601]  [<ffffffff81056682>] task_work_run+0x66/0x90
[  570.144601]  [<ffffffff8100189e>] prepare_exit_to_usermode+0x8c/0xa7
[  570.144601]  [<ffffffff81001a26>] syscall_return_slowpath+0x16d/0x19b
[  570.144601]  [<ffffffff813babb1>] int_ret_from_sys_call+0x25/0x9f
[  570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00
[  570.144601] RIP  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601]  RSP <ffff880036b63e08>
[  570.144601] CR2: 00000000000004e0
[  570.200518] ---[ end trace 46956baf17349563 ]---

pppoe_flush_dev() has no reason to override sk->sk_state with
PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to
PPPOX_DEAD, which is the correct state given that sk is unbound and
po->pppoe_dev is NULL.

Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
Tested-by: Oleksii Berezhniak <core@irc.lg.ua>
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: add pfmemalloc check in sk_add_backlog()

[ Upstream commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b ]

Greg reported crashes hitting the following check in __sk_backlog_rcv()

BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));

The pfmemalloc bit is currently checked in sk_filter().

This works correctly for TCP, because sk_filter() is ran in
tcp_v[46]_rcv() before hitting the prequeue or backlog checks.

For UDP or other protocols, this does not work, because the sk_filter()
is ran from sock_queue_rcv_skb(), which might be called _after_ backlog
queuing if socket is owned by user by the time packet is processed by
softirq handler.

Fixes: b4b9e35585089 ("netvm: set PF_MEMALLOC as appropriate during SKB processing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>