kernel/linux.git/drivers/staging/android, branch v4.17.1

drivers:staging:android:ashmem: Changing return type from int to loff_t

2018-03-19T18:43:24+00:00

Changing return type from int to loff_t. Actual return type of the function (vfs_llseek) is loff_t (long long). Here due to implicit converion from long long to int, result will be implementation defined. Signed-off-by: Rohit Kumar Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Update wording in drivers/staging/android/ion/Kconfig

2018-03-19T18:43:24+00:00

Changes the usage of the word 'Chose' to 'Choose' in the ION Memory Manager Kconfig. Signed-off-by: Phillip Potter Acked-by: Laura Abbott Signed-off-by: Greg Kroah-Hartman

Merge 4.16-rc6 into staging-next

2018-03-19T05:47:01+00:00

We want the staging fixes in here as well to handle merge/test issues. Signed-off-by: Greg Kroah-Hartman

staging: android: ashmem: Fix possible deadlock in ashmem_ioctl

2018-03-06T15:21:10+00:00

ashmem_mutex may create a chain of dependencies like: CPU0 CPU1 mmap syscall ioctl syscall -> mmap_sem (acquired) -> ashmem_ioctl -> ashmem_mmap -> ashmem_mutex (acquired) -> ashmem_mutex (try to acquire) -> copy_from_user -> mmap_sem (try to acquire) There is a lock odering problem between mmap_sem and ashmem_mutex causing a lockdep splat[1] during a syzcaller test. This patch fixes the problem by move copy_from_user out of ashmem_mutex. [1] https://www.spinics.net/lists/kernel/msg2733200.html Fixes: ce8a3a9e76d0 (staging: android: ashmem: Fix a race condition in pin ioctls) Reported-by: syzbot+d7a918a7a8e1c952bc36@syzkaller.appspotmail.com Signed-off-by: Yisheng Xie Signed-off-by: Greg Kroah-Hartman

staging: android: ashmem: Fix lockdep issue during llseek

2018-03-01T16:37:07+00:00

ashmem_mutex create a chain of dependencies like so: (1) mmap syscall -> mmap_sem -> (acquired) ashmem_mmap ashmem_mutex (try to acquire) (block) (2) llseek syscall -> ashmem_llseek -> ashmem_mutex -> (acquired) inode_lock -> inode->i_rwsem (try to acquire) (block) (3) getdents -> iterate_dir -> inode_lock -> inode->i_rwsem (acquired) copy_to_user -> mmap_sem (try to acquire) There is a lock ordering created between mmap_sem and inode->i_rwsem causing a lockdep splat [2] during a syzcaller test, this patch fixes the issue by unlocking the mutex earlier. Functionally that's Ok since we don't need to protect vfs_llseek. [1] https://patchwork.kernel.org/patch/10185031/ [2] https://lkml.org/lkml/2018/1/10/48 Acked-by: Todd Kjos Cc: Arve Hjonnevag Cc: stable@vger.kernel.org Reported-by: syzbot+8ec30bb7bf1a981a2012@syzkaller.appspotmail.com Signed-off-by: Joel Fernandes Acked-by: Greg Hackmann Signed-off-by: Greg Kroah-Hartman

Merge 4.16-rc3 into staging-next

2018-02-26T14:32:00+00:00

We want the IIO/Staging fixes in here, and to resolve a merge problem with the move of the fsl-mc code. Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Remove check of idev->debug_root

2018-02-22T13:53:05+00:00

We will go on initial idev if failed to create debug_root, and it does not matter to check the return value of this debugfs call, just remove it. Signed-off-by: Yisheng Xie Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Remove check of debug_file

2018-02-22T13:53:05+00:00

There's no need to check the return value of debug_file for it is just a debugfs and we will go on the following process if we failed to create debug_file. So just remove it. Signed-off-by: Yisheng Xie Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Initialize dma_address of new sg list

2018-02-20T08:05:35+00:00

Fix the dup_sg_table function to initialize the dma_address of the new sg list entries instead of the source dma_address entries. Since ION duplicates the sg_list this issue does not appear to result in an actual bug. Signed-off-by: Liam Mark Acked-by: Laura Abbott Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Zero CMA allocated memory

2018-02-16T16:50:09+00:00

Since commit 204f672255c2 ("staging: android: ion: Use CMA APIs directly") the CMA API is now used directly and therefore the allocated memory is no longer automatically zeroed. Explicitly zero CMA allocated memory to ensure that no data is exposed to userspace. Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly") Signed-off-by: Liam Mark Acked-by: Laura Abbott Signed-off-by: Greg Kroah-Hartman