Merge 08d6938927854b385171dacc17928bce018f86ad on remote branch
Change-Id: Ifddef2bfbdb1e0a815726fc6d8f31fa07175426b
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 12d9a68..54de8ff 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -912,12 +912,14 @@
icmp_msgs_per_sec - INTEGER
Limit maximal number of ICMP packets sent per second from this host.
Only messages whose type matches icmp_ratemask (see below) are
- controlled by this limit.
+ controlled by this limit. For security reasons, the precise count
+ of messages per second is randomized.
Default: 1000
icmp_msgs_burst - INTEGER
icmp_msgs_per_sec controls number of ICMP packets sent per second,
while icmp_msgs_burst controls the burst size of these packets.
+ For security reasons, the precise burst size is randomized.
Default: 50
icmp_ratemask - INTEGER
diff --git a/arch/arm64/boot/dts/qcom/sdm670-camera-sensor-mtp.dtsi b/arch/arm64/boot/dts/qcom/sdm670-camera-sensor-mtp.dtsi
index 19dca08..a886b86 100644
--- a/arch/arm64/boot/dts/qcom/sdm670-camera-sensor-mtp.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670-camera-sensor-mtp.dtsi
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2020, 2021 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -411,7 +411,7 @@
};
qcom,cam-sensor@3 {
- cell-index = <0>;
+ cell-index = <3>;
compatible = "qcom,cam-sensor";
reg = <0x0>;
csiphy-sd-index = <0>;
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c
index 7eaa40d..becb445 100644
--- a/drivers/char/adsprpc.c
+++ b/drivers/char/adsprpc.c
@@ -3622,22 +3622,26 @@
{
int err = 0, buf_size = 0;
char strpid[PID_SIZE];
+ char cur_comm[TASK_COMM_LEN];
+ memcpy(cur_comm, current->comm, TASK_COMM_LEN);
+ cur_comm[TASK_COMM_LEN-1] = '\0';
fl->tgid = current->tgid;
snprintf(strpid, PID_SIZE, "%d", current->pid);
- buf_size = strlen(current->comm) + strlen("_") + strlen(strpid) + 1;
+ buf_size = strlen(cur_comm) + strlen("_") + strlen(strpid) + 1;
fl->debug_buf = kzalloc(buf_size, GFP_KERNEL);
if (!fl->debug_buf) {
err = -ENOMEM;
return err;
}
- snprintf(fl->debug_buf, UL_SIZE, "%.10s%s%d",
- current->comm, "_", current->pid);
+ snprintf(fl->debug_buf, buf_size, "%.10s%s%d",
+ cur_comm, "_", current->pid);
fl->debugfs_file = debugfs_create_file(fl->debug_buf, 0644,
debugfs_root, fl, &debugfs_fops);
if (!fl->debugfs_file)
pr_warn("Error: %s: %s: failed to create debugfs file %s\n",
- current->comm, __func__, fl->debug_buf);
+ cur_comm, __func__, fl->debug_buf);
+
return err;
}
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 9bf732b..77ab3d9 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -1053,25 +1053,6 @@
mode->timing.bpp = dp->panel->get_mode_bpp(dp->panel,
mode->timing.bpp, pixel_clk_khz);
- /* Refactor bits per pixel for YUV422 format */
- if (mode->timing.out_format == MSM_MODE_FLAG_COLOR_FORMAT_YCBCR422) {
- switch (mode->timing.bpp) {
- case 18:
- mode->timing.bpp = 24;
- break;
- case 24:
- mode->timing.bpp = 30;
- break;
- case 30:
- mode->timing.bpp = 36;
- break;
- default:
- mode->timing.bpp = 30;
- break;
- };
- pr_debug("YCC422 bpp = %d\n", mode->timing.bpp);
- }
-
dp->panel->pinfo = mode->timing;
dp->panel->init(dp->panel);
mutex_unlock(&dp->session_lock);
diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c
index 0577b6d..edfb2ca 100644
--- a/drivers/gpu/msm/kgsl.c
+++ b/drivers/gpu/msm/kgsl.c
@@ -263,9 +263,9 @@
kref_init(&entry->refcount);
/* put this ref in userspace memory alloc and map ioctls */
kref_get(&entry->refcount);
+ atomic_set(&entry->map_count, 0);
}
- atomic_set(&entry->map_count, 0);
return entry;
}
#ifdef CONFIG_DMA_SHARED_BUFFER
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index f15f219..8f64487 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -67,6 +67,14 @@
struct buffer_aux {
int hash_verified;
};
+/*
+ * While system shutdown, skip verity work for I/O error.
+ */
+static inline bool verity_is_system_shutting_down(void)
+{
+ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF
+ || system_state == SYSTEM_RESTART;
+}
/*
* Initialize struct buffer_aux for a freshly created buffer.
@@ -513,7 +521,8 @@
{
struct dm_verity_io *io = bio->bi_private;
- if (bio->bi_error && !verity_fec_is_enabled(io->v)) {
+ if (bio->bi_error &&
+ (!verity_fec_is_enabled(io->v) || verity_is_system_shutting_down())) {
verity_finish_io(io, bio->bi_error);
return;
}
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 11c061b..af27a71 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1286,10 +1286,8 @@
*/
if (!for_part) {
ret = devcgroup_inode_permission(bdev->bd_inode, perm);
- if (ret != 0) {
- bdput(bdev);
+ if (ret != 0)
return ret;
- }
}
restart:
@@ -1361,8 +1359,10 @@
goto out_clear;
BUG_ON(for_part);
ret = __blkdev_get(whole, mode, 1);
- if (ret)
+ if (ret) {
+ bdput(whole);
goto out_clear;
+ }
bdev->bd_contains = whole;
bdev->bd_part = disk_get_part(disk, partno);
if (!(disk->flags & GENHD_FL_UP) ||
@@ -1416,7 +1416,6 @@
put_disk(disk);
module_put(owner);
out:
- bdput(bdev);
return ret;
}
@@ -1502,6 +1501,9 @@
bdput(whole);
}
+ if (res)
+ bdput(bdev);
+
return res;
}
EXPORT_SYMBOL(blkdev_get);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5dab158..6b66f05 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -246,7 +246,7 @@
/**
* icmp_global_allow - Are we allowed to send one more ICMP message ?
*
- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.
+ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
* Returns false if we reached the limit and can not send another packet.
* Note: called with BH disabled
*/
@@ -274,7 +274,10 @@
}
credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
if (credit) {
- credit--;
+ /* We want to use a credit of one in average, but need to randomize
+ * it for security reasons.
+ */
+ credit = max_t(int, credit - prandom_u32_max(3), 0);
rc = true;
}
WRITE_ONCE(icmp_global.credit, credit);