diff --git a/android/GKI_VERSION b/android/GKI_VERSION
index df5f76c88f61..ca7dca22a8d6 100644
--- a/android/GKI_VERSION
+++ b/android/GKI_VERSION
@@ -1 +1 @@
-LTS_5.4.161_b9d179c605d3
+LTS_5.4.161_5d7a491ae4a7
diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index d9c149005f72..ebc1d68e38dc 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -2365,6 +2365,7 @@
+
@@ -6213,12 +6214,12 @@
-
+
-
+
-
+
@@ -6884,12 +6885,12 @@
-
+
-
+
-
+
@@ -19586,109 +19587,109 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -22162,9 +22163,9 @@
-
+
-
+
@@ -23718,6 +23719,17 @@
+
+
+
+
+
+
+
+
+
+
+
@@ -25155,165 +25167,165 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -25932,6 +25944,11 @@
+
+
+
+
+
@@ -26343,7 +26360,7 @@
-
+
@@ -26397,7 +26414,7 @@
-
+
@@ -28617,18 +28634,18 @@
-
+
-
+
-
+
-
+
-
+
@@ -31261,7 +31278,7 @@
-
+
@@ -31269,7 +31286,7 @@
-
+
@@ -32557,7 +32574,7 @@
-
+
@@ -32819,7 +32836,7 @@
-
+
@@ -35859,109 +35876,109 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -37083,6 +37100,14 @@
+
+
+
+
+
+
+
+
@@ -37877,14 +37902,6 @@
-
-
-
-
-
-
-
-
@@ -46666,13 +46683,6 @@
-
-
-
-
-
-
-
@@ -46773,102 +46783,102 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -46877,7 +46887,7 @@
-
+
@@ -46901,347 +46911,347 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -47268,63 +47278,63 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -47412,12 +47422,12 @@
-
+
-
+
-
+
@@ -47484,24 +47494,24 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -48200,22 +48210,22 @@
-
-
+
+
-
-
+
+
-
-
+
+
-
-
-
-
+
+
+
+
@@ -48224,18 +48234,18 @@
-
-
+
+
-
-
-
-
+
+
+
+
-
-
+
+
@@ -48370,7 +48380,7 @@
-
+
@@ -48789,18 +48799,18 @@
-
-
+
+
-
-
-
+
+
+
-
-
-
+
+
+
@@ -48845,42 +48855,42 @@
-
-
-
+
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
-
-
+
+
+
+
+
-
-
+
+
@@ -48895,13 +48905,13 @@
-
-
-
+
+
+
-
-
+
+
@@ -55450,6 +55460,12 @@
+
+
+
+
+
+
@@ -55831,97 +55847,97 @@
-
-
+
+
-
-
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
@@ -67103,55 +67119,55 @@
-
-
-
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
@@ -73937,16 +73953,6 @@
-
-
-
-
-
-
-
-
-
-
@@ -73960,12 +73966,6 @@
-
-
-
-
-
-
@@ -78188,6 +78188,12 @@
+
+
+
+
+
+
@@ -81841,6 +81847,16 @@
+
+
+
+
+
+
+
+
+
+
@@ -85969,11 +85985,11 @@
-
+
-
+
@@ -85981,14 +85997,14 @@
-
+
-
+
-
+
@@ -91169,12 +91185,12 @@
-
+
-
+
@@ -91183,7 +91199,7 @@
-
+
@@ -92138,422 +92154,422 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -92573,63 +92589,63 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -92655,59 +92671,59 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -92733,7 +92749,7 @@
-
+
@@ -92799,13 +92815,13 @@
-
+
-
+
@@ -105551,10 +105567,10 @@
-
-
-
-
+
+
+
+
@@ -107366,8 +107382,8 @@
-
-
+
+
@@ -107393,74 +107409,74 @@
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
+
+
-
-
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
+
+
-
-
+
+
-
-
+
+
-
-
-
+
+
+
@@ -107795,25 +107811,25 @@
-
-
+
+
-
-
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
@@ -108222,8 +108238,8 @@
-
-
+
+
@@ -108243,52 +108259,52 @@
-
-
-
-
+
+
+
+
-
+
-
+
-
-
-
-
-
-
+
+
-
-
+
+
-
-
+
+
-
-
+
+
+
+
+
+
-
-
-
+
+
+
@@ -108297,18 +108313,18 @@
-
-
+
+
-
-
-
+
+
+
-
-
-
+
+
+
@@ -108318,28 +108334,28 @@
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
+
+
@@ -108478,7 +108494,7 @@
-
+
@@ -108541,54 +108557,54 @@
-
-
+
+
-
-
+
+
-
-
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
+
+
+
@@ -109234,7 +109250,7 @@
-
+
@@ -109256,7 +109272,7 @@
-
+
@@ -109266,7 +109282,7 @@
-
+
@@ -109274,12 +109290,12 @@
-
+
-
+
@@ -109302,7 +109318,7 @@
-
+
@@ -109318,15 +109334,15 @@
-
+
-
+
-
+
@@ -109337,7 +109353,7 @@
-
+
@@ -109351,7 +109367,7 @@
-
+
@@ -109906,7 +109922,7 @@
-
+
@@ -109983,12 +109999,12 @@
-
+
-
+
@@ -110002,11 +110018,6 @@
-
-
-
-
-
@@ -112435,53 +112446,53 @@
-
-
+
+
-
-
-
+
+
+
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
@@ -112914,165 +112925,165 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -113186,18 +113197,18 @@
-
+
-
+
-
+
-
+
-
+
@@ -114635,7 +114646,23 @@
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -114823,7 +114850,7 @@
-
+
@@ -114902,7 +114929,7 @@
-
+
@@ -114951,7 +114978,7 @@
-
+
@@ -115242,7 +115269,7 @@
-
+
@@ -115253,7 +115280,7 @@
-
+
@@ -115261,7 +115288,7 @@
-
+
@@ -115711,7 +115738,7 @@
-
+
@@ -117045,12 +117072,6 @@
-
-
-
-
-
-
@@ -117058,6 +117079,12 @@
+
+
+
+
+
+
@@ -117124,16 +117151,16 @@
-
-
-
-
+
+
+
+
-
-
-
-
+
+
+
+
@@ -117489,21 +117516,21 @@
-
-
+
+
-
-
+
+
-
-
+
+
-
-
-
+
+
+
@@ -119181,7 +119208,7 @@
-
+
@@ -119194,31 +119221,31 @@
-
+
-
+
-
+
-
+
-
-
+
+
-
-
-
-
-
+
+
+
+
+
-
-
+
+
@@ -119289,24 +119316,24 @@
-
+
-
+
-
+
-
+
-
+
-
-
+
+
@@ -119325,8 +119352,8 @@
-
-
+
+
@@ -119361,85 +119388,85 @@
-
-
+
+
-
-
+
+
-
-
-
-
+
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
+
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
+
+
-
-
+
+
-
-
-
+
+
+
-
+
-
+
@@ -119480,7 +119507,7 @@
-
+
@@ -119495,72 +119522,72 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -119611,44 +119638,44 @@
-
-
-
+
+
+
-
+
-
+
-
+
-
+
-
+
-
+
-
-
+
+
-
-
+
+
@@ -119657,22 +119684,22 @@
-
-
+
+
-
-
+
+
-
+
-
+
-
+
@@ -119730,7 +119757,7 @@
-
+
@@ -120021,17 +120048,17 @@
-
-
-
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
@@ -124742,9 +124769,9 @@
-
-
-
+
+
+
@@ -126123,12 +126150,12 @@
-
-
+
+
-
-
+
+
@@ -128948,15 +128975,15 @@
-
+
-
+
-
+
@@ -129104,57 +129131,57 @@
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
-
-
-
+
+
+
+
+
+
-
-
-
-
-
-
-
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-
+
+
-
-
+
+
-
-
-
+
+
+
@@ -130964,38 +130991,38 @@
-
-
-
-
-
-
-
+
+
+
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
-
-
-
+
+
+
+
+
+
-
-
+
+
@@ -136308,8 +136335,8 @@
-
-
+
+
@@ -139148,9 +139175,9 @@
-
-
-
+
+
+
@@ -139743,9 +139770,9 @@
-
-
-
+
+
+
@@ -140217,15 +140244,15 @@
-
+
-
+
-
+
-
+
@@ -140264,7 +140291,7 @@
-
+
@@ -140274,7 +140301,7 @@
-
+
@@ -140285,17 +140312,17 @@
-
+
-
+
-
+
@@ -140305,13 +140332,13 @@
-
+
-
+
@@ -140322,22 +140349,22 @@
-
+
-
+
-
+
-
+
@@ -142479,9 +142506,9 @@
-
-
-
+
+
+
@@ -142494,20 +142521,20 @@
-
-
+
+
-
-
+
+
-
-
+
+
-
-
+
+
@@ -142518,8 +142545,8 @@
-
-
+
+
@@ -144275,28 +144302,28 @@
-
-
+
+
-
-
+
+
-
-
+
+
-
-
+
+
-
-
+
+
-
-
+
+
@@ -144628,9 +144655,9 @@
-
-
-
+
+
+
@@ -147369,6 +147396,10 @@
+
+
+
+
@@ -147719,24 +147750,24 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -147984,18 +148015,18 @@
-
+
-
+
-
+
-
+
-
+
@@ -148505,7 +148536,7 @@
-
+
@@ -148606,6 +148637,12 @@
+
+
+
+
+
+
@@ -148980,6 +149017,13 @@
+
+
+
+
+
+
+
@@ -149670,20 +149714,20 @@
-
-
+
+
-
-
+
+
-
-
+
+
-
-
+
+
@@ -150813,7 +150857,7 @@
-
+
@@ -150824,35 +150868,35 @@
-
+
-
+
-
-
+
+
-
-
+
+
-
-
+
+
-
-
-
+
+
+
-
-
-
-
-
-
+
+
+
+
+
+
@@ -152753,12 +152797,12 @@
-
+
-
+
-
+
@@ -153706,9 +153750,9 @@
-
+
-
+
@@ -162851,22 +162895,22 @@
-
-
-
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
@@ -162933,19 +162977,19 @@
-
-
-
-
+
+
+
+
-
-
-
+
+
+
@@ -164174,18 +164218,18 @@
-
+
-
+
-
+
-
+
-
+
@@ -164416,7 +164460,7 @@
-
+
@@ -164640,12 +164684,12 @@
-
+
-
+
-
+
@@ -164700,7 +164744,7 @@
-
+
@@ -164838,12 +164882,12 @@
-
+
-
+
@@ -165101,10 +165145,10 @@
-
-
-
-
+
+
+
+
@@ -165623,12 +165667,6 @@
-
-
-
-
-
-
@@ -166568,15 +166606,15 @@
-
-
-
-
+
+
+
+
-
-
-
+
+
+
@@ -166670,12 +166708,6 @@
-
-
-
-
-
-
@@ -166898,209 +166930,9 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -167236,39 +167068,28 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
+
@@ -167343,106 +167164,99 @@
-
-
-
-
+
+
+
+
-
-
-
-
+
+
+
+
-
-
+
+
-
-
-
-
+
+
+
+
-
-
+
+
-
-
-
-
+
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
-
+
+
+
+
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
-
+
+
+
+
-
-
-
+
+
+
-
-
-
-
-
-
-
@@ -167450,10 +167264,6 @@
-
-
-
-
@@ -167561,7 +167371,7 @@
-
+
@@ -167574,8 +167384,8 @@
-
-
+
+
@@ -167606,8 +167416,8 @@
-
-
+
+
@@ -167787,12 +167597,12 @@
-
-
+
+
-
-
+
+
@@ -167803,100 +167613,100 @@
-
-
-
-
-
+
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-
-
-
-
+
+
-
-
-
-
-
-
+
+
+
-
-
-
-
+
+
+
-
-
-
-
-
+
+
+
+
+
+
-
-
-
-
+
+
+
+
+
+
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -168973,7 +168783,7 @@
-
+
@@ -171415,7 +171225,7 @@
-
+
@@ -171455,7 +171265,7 @@
-
+
@@ -171537,7 +171347,7 @@
-
+
@@ -171977,7 +171787,7 @@
-
+
@@ -173722,7 +173532,7 @@
-
+
@@ -173742,7 +173552,7 @@
-
+
@@ -173750,12 +173560,12 @@
-
+
-
+
@@ -173886,7 +173696,7 @@
-
+
@@ -175278,9 +175088,9 @@
-
-
-
+
+
+
@@ -175552,75 +175362,75 @@
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
-
+
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
+
+
-
-
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
-
+
+
+
+
+
+
@@ -177043,7 +176853,7 @@
-
+
@@ -177179,7 +176989,7 @@
-
+
@@ -177722,27 +177532,27 @@
-
-
-
-
-
+
+
+
+
+
-
-
-
-
-
-
-
+
+
+
+
+
+
+
-
-
-
-
-
+
+
+
+
+
@@ -178205,13 +178015,224 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -178293,7 +178314,7 @@
-
+
@@ -178306,6 +178327,17 @@
+
+
+
+
+
+
+
+
+
+
+
@@ -184196,72 +184228,72 @@
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
-
-
+
+
+
+
+
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
+
+
+
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
@@ -190945,16 +190977,16 @@
-
-
-
-
+
+
+
+
-
-
-
-
+
+
+
+
@@ -190963,69 +190995,69 @@
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
diff --git a/android/abi_gki_aarch64_db845c b/android/abi_gki_aarch64_db845c
index d9bc40995f5b..898684f65cfe 100644
--- a/android/abi_gki_aarch64_db845c
+++ b/android/abi_gki_aarch64_db845c
@@ -583,6 +583,7 @@
__kfifo_alloc
__kfifo_free
kmalloc_order_trace
+ ktime_get_with_offset
__local_bh_enable_ip
memmove
param_ops_ulong
@@ -590,6 +591,7 @@
__rcu_read_lock
__rcu_read_unlock
regulatory_hint
+ rfc1042_header
skb_copy
skb_realloc_headroom
strlcat
@@ -660,6 +662,7 @@
phy_pm_runtime_get_sync
phy_pm_runtime_put_sync
platform_get_irq_byname_optional
+ pm_runtime_barrier
system_freezable_wq
usb_add_gadget_udc
usb_decode_ctrl
@@ -733,7 +736,6 @@
generic_file_read_iter
generic_file_splice_read
generic_read_dir
- generic_shutdown_super
__get_free_pages
get_zeroed_page
iget5_locked
@@ -745,6 +747,7 @@
kernel_read
kernel_write
kern_path
+ kill_anon_super
kobject_create_and_add
kobject_put
lockref_get
diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig
index cf3b76daba79..13f4ea529726 100644
--- a/arch/arm64/configs/gki_defconfig
+++ b/arch/arm64/configs/gki_defconfig
@@ -317,6 +317,7 @@ CONFIG_SERIAL_8250=y
# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
CONFIG_SERIAL_8250_CONSOLE=y
# CONFIG_SERIAL_8250_EXAR is not set
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
CONFIG_SERIAL_OF_PLATFORM=y
CONFIG_SERIAL_AMBA_PL011=y
CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
diff --git a/arch/x86/configs/gki_defconfig b/arch/x86/configs/gki_defconfig
index 64cb6f5cd38b..8dade88321d3 100644
--- a/arch/x86/configs/gki_defconfig
+++ b/arch/x86/configs/gki_defconfig
@@ -290,6 +290,7 @@ CONFIG_INPUT_UINPUT=y
CONFIG_SERIAL_8250=y
# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
CONFIG_SERIAL_OF_PLATFORM=y
CONFIG_SERIAL_DEV_BUS=y
CONFIG_HW_RANDOM=y
diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
index ed8ec011a9fd..42f3e42a10ee 100644
--- a/arch/x86/include/asm/setup.h
+++ b/arch/x86/include/asm/setup.h
@@ -4,7 +4,7 @@
#include
-#define COMMAND_LINE_SIZE 2048
+#define COMMAND_LINE_SIZE 4096
#include
#include
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 2739ebbc684b..add45eb9ea97 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -662,7 +662,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size);
if (buffer->async_transaction) {
- alloc->free_async_space += size + sizeof(struct binder_buffer);
+ alloc->free_async_space += buffer_size + sizeof(struct binder_buffer);
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
"%d: binder_free_buf size %zd async free %zd\n",
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index d6491e973fa4..0d5ae8053049 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -1,26 +1,18 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2015-2016, Linaro Limited
+ * Copyright (c) 2015-2017, 2019-2021 Linaro Limited
*/
+#include
#include
-#include
-#include
#include
+#include
#include
#include
#include
#include "tee_private.h"
-static void tee_shm_release(struct tee_shm *shm)
+static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm)
{
- struct tee_device *teedev = shm->teedev;
-
- mutex_lock(&teedev->mutex);
- idr_remove(&teedev->idr, shm->id);
- if (shm->ctx)
- list_del(&shm->link);
- mutex_unlock(&teedev->mutex);
-
if (shm->flags & TEE_SHM_POOL) {
struct tee_shm_pool_mgr *poolm;
@@ -52,51 +44,6 @@ static void tee_shm_release(struct tee_shm *shm)
tee_device_put(teedev);
}
-static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment
- *attach, enum dma_data_direction dir)
-{
- return NULL;
-}
-
-static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach,
- struct sg_table *table,
- enum dma_data_direction dir)
-{
-}
-
-static void tee_shm_op_release(struct dma_buf *dmabuf)
-{
- struct tee_shm *shm = dmabuf->priv;
-
- tee_shm_release(shm);
-}
-
-static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum)
-{
- return NULL;
-}
-
-static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
-{
- struct tee_shm *shm = dmabuf->priv;
- size_t size = vma->vm_end - vma->vm_start;
-
- /* Refuse sharing shared memory provided by application */
- if (shm->flags & TEE_SHM_REGISTER)
- return -EINVAL;
-
- return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
- size, vma->vm_page_prot);
-}
-
-static const struct dma_buf_ops tee_shm_dma_buf_ops = {
- .map_dma_buf = tee_shm_op_map_dma_buf,
- .unmap_dma_buf = tee_shm_op_unmap_dma_buf,
- .release = tee_shm_op_release,
- .map = tee_shm_op_map,
- .mmap = tee_shm_op_mmap,
-};
-
static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
struct tee_device *teedev,
size_t size, u32 flags)
@@ -137,6 +84,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
goto err_dev_put;
}
+ refcount_set(&shm->refcount, 1);
shm->flags = flags | TEE_SHM_POOL;
shm->teedev = teedev;
shm->ctx = ctx;
@@ -159,21 +107,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
goto err_pool_free;
}
- if (flags & TEE_SHM_DMA_BUF) {
- DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
-
- exp_info.ops = &tee_shm_dma_buf_ops;
- exp_info.size = shm->size;
- exp_info.flags = O_RDWR;
- exp_info.priv = shm;
-
- shm->dmabuf = dma_buf_export(&exp_info);
- if (IS_ERR(shm->dmabuf)) {
- ret = ERR_CAST(shm->dmabuf);
- goto err_rem;
- }
- }
-
if (ctx) {
teedev_ctx_get(ctx);
mutex_lock(&teedev->mutex);
@@ -182,10 +115,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
}
return shm;
-err_rem:
- mutex_lock(&teedev->mutex);
- idr_remove(&teedev->idr, shm->id);
- mutex_unlock(&teedev->mutex);
err_pool_free:
poolm->ops->free(poolm, shm);
err_kfree:
@@ -268,6 +197,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
goto err;
}
+ refcount_set(&shm->refcount, 1);
shm->flags = flags | TEE_SHM_REGISTER;
shm->teedev = teedev;
shm->ctx = ctx;
@@ -309,22 +239,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
goto err;
}
- if (flags & TEE_SHM_DMA_BUF) {
- DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
-
- exp_info.ops = &tee_shm_dma_buf_ops;
- exp_info.size = shm->size;
- exp_info.flags = O_RDWR;
- exp_info.priv = shm;
-
- shm->dmabuf = dma_buf_export(&exp_info);
- if (IS_ERR(shm->dmabuf)) {
- ret = ERR_CAST(shm->dmabuf);
- teedev->desc->ops->shm_unregister(ctx, shm);
- goto err;
- }
- }
-
mutex_lock(&teedev->mutex);
list_add_tail(&shm->link, &ctx->list_shm);
mutex_unlock(&teedev->mutex);
@@ -352,6 +266,35 @@ err:
}
EXPORT_SYMBOL_GPL(tee_shm_register);
+static int tee_shm_fop_release(struct inode *inode, struct file *filp)
+{
+ tee_shm_put(filp->private_data);
+ return 0;
+}
+
+static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+ struct tee_shm *shm = filp->private_data;
+ size_t size = vma->vm_end - vma->vm_start;
+
+ /* Refuse sharing shared memory provided by application */
+ if (shm->flags & TEE_SHM_USER_MAPPED)
+ return -EINVAL;
+
+ /* check for overflowing the buffer's size */
+ if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT)
+ return -EINVAL;
+
+ return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
+ size, vma->vm_page_prot);
+}
+
+static const struct file_operations tee_shm_fops = {
+ .owner = THIS_MODULE,
+ .release = tee_shm_fop_release,
+ .mmap = tee_shm_fop_mmap,
+};
+
/**
* tee_shm_get_fd() - Increase reference count and return file descriptor
* @shm: Shared memory handle
@@ -364,10 +307,11 @@ int tee_shm_get_fd(struct tee_shm *shm)
if (!(shm->flags & TEE_SHM_DMA_BUF))
return -EINVAL;
- get_dma_buf(shm->dmabuf);
- fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
+ /* matched by tee_shm_put() in tee_shm_op_release() */
+ refcount_inc(&shm->refcount);
+ fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR);
if (fd < 0)
- dma_buf_put(shm->dmabuf);
+ tee_shm_put(shm);
return fd;
}
@@ -377,17 +321,7 @@ int tee_shm_get_fd(struct tee_shm *shm)
*/
void tee_shm_free(struct tee_shm *shm)
{
- /*
- * dma_buf_put() decreases the dmabuf reference counter and will
- * call tee_shm_release() when the last reference is gone.
- *
- * In the case of driver private memory we call tee_shm_release
- * directly instead as it doesn't have a reference counter.
- */
- if (shm->flags & TEE_SHM_DMA_BUF)
- dma_buf_put(shm->dmabuf);
- else
- tee_shm_release(shm);
+ tee_shm_put(shm);
}
EXPORT_SYMBOL_GPL(tee_shm_free);
@@ -494,10 +428,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id)
teedev = ctx->teedev;
mutex_lock(&teedev->mutex);
shm = idr_find(&teedev->idr, id);
+ /*
+ * If the tee_shm was found in the IDR it must have a refcount
+ * larger than 0 due to the guarantee in tee_shm_put() below. So
+ * it's safe to use refcount_inc().
+ */
if (!shm || shm->ctx != ctx)
shm = ERR_PTR(-EINVAL);
- else if (shm->flags & TEE_SHM_DMA_BUF)
- get_dma_buf(shm->dmabuf);
+ else
+ refcount_inc(&shm->refcount);
mutex_unlock(&teedev->mutex);
return shm;
}
@@ -509,7 +448,25 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
*/
void tee_shm_put(struct tee_shm *shm)
{
- if (shm->flags & TEE_SHM_DMA_BUF)
- dma_buf_put(shm->dmabuf);
+ struct tee_device *teedev = shm->teedev;
+ bool do_release = false;
+
+ mutex_lock(&teedev->mutex);
+ if (refcount_dec_and_test(&shm->refcount)) {
+ /*
+ * refcount has reached 0, we must now remove it from the
+ * IDR before releasing the mutex. This will guarantee that
+ * the refcount_inc() in tee_shm_get_from_id() never starts
+ * from 0.
+ */
+ idr_remove(&teedev->idr, shm->id);
+ if (shm->ctx)
+ list_del(&shm->link);
+ do_release = true;
+ }
+ mutex_unlock(&teedev->mutex);
+
+ if (do_release)
+ tee_shm_release(teedev, shm);
}
EXPORT_SYMBOL_GPL(tee_shm_put);
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index fdfb46424a39..d947f2a848cb 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2004,6 +2004,9 @@ unknown:
if (w_index != 0x5 || (w_value >> 8))
break;
interface = w_value & 0xFF;
+ if (interface >= MAX_CONFIG_INTERFACES ||
+ !os_desc_cfg->interface[interface])
+ break;
buf[6] = w_index;
count = count_ext_prop(os_desc_cfg,
interface);
diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
index 04c142c13075..ab827c1badc5 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -637,14 +637,17 @@ static int rndis_set_response(struct rndis_params *params,
rndis_set_cmplt_type *resp;
rndis_resp_t *r;
+ BufLength = le32_to_cpu(buf->InformationBufferLength);
+ BufOffset = le32_to_cpu(buf->InformationBufferOffset);
+ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
+ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
+ return -EINVAL;
+
r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
if (!r)
return -ENOMEM;
resp = (rndis_set_cmplt_type *)r->buf;
- BufLength = le32_to_cpu(buf->InformationBufferLength);
- BufOffset = le32_to_cpu(buf->InformationBufferOffset);
-
#ifdef VERBOSE_DEBUG
pr_debug("%s: Length: %d\n", __func__, BufLength);
pr_debug("%s: Offset: %d\n", __func__, BufOffset);
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 6b1c4e1299b5..97c33c16ef5f 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2581,6 +2581,11 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
{
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ /* The below cases were checked when setting it. */
+ if (f2fs_is_pinned_file(inode))
+ return false;
+ if (fio && is_sbi_flag_set(sbi, SBI_NEED_FSCK))
+ return true;
if (f2fs_lfs_mode(sbi))
return true;
if (S_ISDIR(inode->i_mode))
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index a6fc4445ccdd..b42b1fa737bd 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3235,17 +3235,17 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg)
inode_lock(inode);
- if (f2fs_should_update_outplace(inode, NULL)) {
- ret = -EINVAL;
- goto out;
- }
-
if (!pin) {
clear_inode_flag(inode, FI_PIN_FILE);
f2fs_i_gc_failures_write(inode, 0);
goto done;
}
+ if (f2fs_should_update_outplace(inode, NULL)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
if (f2fs_pin_file_control(inode, false)) {
ret = -EAGAIN;
goto out;
diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c
index 8d4c4e39fa46..b849568ae9b8 100644
--- a/fs/incfs/vfs.c
+++ b/fs/incfs/vfs.c
@@ -319,6 +319,7 @@ static struct mount_info *get_mount_info(struct super_block *sb)
{
struct mount_info *result = sb->s_fs_info;
+ WARN_ON(!result);
return result;
}
@@ -677,7 +678,7 @@ static int iterate_incfs_dir(struct file *file, struct dir_context *ctx)
struct mount_info *mi = get_mount_info(file_superblock(file));
bool root;
- if (!dir || !mi) {
+ if (!dir) {
error = -EBADF;
goto out;
}
@@ -1841,9 +1842,6 @@ static int dir_rename(struct inode *old_dir, struct dentry *old_dentry,
struct dentry *trap;
int error = 0;
- if (!mi)
- return -EBADF;
-
error = mutex_lock_interruptible(&mi->mi_dir_struct_mutex);
if (error)
return error;
@@ -2091,9 +2089,6 @@ static ssize_t incfs_getxattr(struct dentry *d, const char *name,
char *stored_value;
size_t stored_size;
- if (!mi)
- return -EBADF;
-
if (di && di->backing_path.dentry)
return vfs_getxattr(di->backing_path.dentry, name, value, size);
@@ -2130,9 +2125,6 @@ static ssize_t incfs_setxattr(struct dentry *d, const char *name,
void **stored_value;
size_t *stored_size;
- if (!mi)
- return -EBADF;
-
if (di && di->backing_path.dentry)
return vfs_setxattr(di->backing_path.dentry, name, value, size,
flags);
@@ -2173,11 +2165,6 @@ static ssize_t incfs_listxattr(struct dentry *d, char *list, size_t size)
return vfs_listxattr(di->backing_path.dentry, list, size);
}
-static int incfs_test_super(struct super_block *s, void *p)
-{
- return s->s_fs_info != NULL;
-}
-
struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
const char *dev_name, void *data)
{
@@ -2187,8 +2174,7 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
struct dentry *index_dir;
struct super_block *src_fs_sb = NULL;
struct inode *root_inode = NULL;
- struct super_block *sb = sget(type, incfs_test_super, set_anon_super,
- flags, NULL);
+ struct super_block *sb = sget(type, NULL, set_anon_super, flags, NULL);
int error = 0;
if (IS_ERR(sb))
@@ -2229,18 +2215,13 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
src_fs_sb = backing_dir_path.dentry->d_sb;
sb->s_maxbytes = src_fs_sb->s_maxbytes;
- if (!sb->s_fs_info) {
- mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path);
+ mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path);
- if (IS_ERR_OR_NULL(mi)) {
- error = PTR_ERR(mi);
- pr_err("incfs: Error allocating mount info. %d\n", error);
- mi = NULL;
- goto err;
- }
- sb->s_fs_info = mi;
- } else {
- mi = sb->s_fs_info;
+ if (IS_ERR_OR_NULL(mi)) {
+ error = PTR_ERR(mi);
+ pr_err("incfs: Error allocating mount info. %d\n", error);
+ mi = NULL;
+ goto err;
}
index_dir = open_or_create_index_dir(backing_dir_path.dentry);
@@ -2252,22 +2233,21 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
}
mi->mi_index_dir = index_dir;
+ sb->s_fs_info = mi;
root_inode = fetch_regular_inode(sb, backing_dir_path.dentry);
if (IS_ERR(root_inode)) {
error = PTR_ERR(root_inode);
goto err;
}
+ sb->s_root = d_make_root(root_inode);
if (!sb->s_root) {
- sb->s_root = d_make_root(root_inode);
- if (!sb->s_root) {
- error = -ENOMEM;
- goto err;
- }
- error = incfs_init_dentry(sb->s_root, &backing_dir_path);
- if (error)
- goto err;
+ error = -ENOMEM;
+ goto err;
}
+ error = incfs_init_dentry(sb->s_root, &backing_dir_path);
+ if (error)
+ goto err;
path_put(&backing_dir_path);
sb->s_flags |= SB_ACTIVE;
@@ -2288,9 +2268,6 @@ static int incfs_remount_fs(struct super_block *sb, int *flags, char *data)
struct mount_info *mi = get_mount_info(sb);
int err = 0;
- if (!mi)
- return err;
-
sync_filesystem(sb);
err = parse_options(&options, (char *)data);
if (err)
@@ -2318,9 +2295,6 @@ static int show_options(struct seq_file *m, struct dentry *root)
{
struct mount_info *mi = get_mount_info(root->d_sb);
- if (!mi)
- return -EBADF;
-
seq_printf(m, ",read_timeout_ms=%u", mi->mi_options.read_timeout_ms);
seq_printf(m, ",readahead=%u", mi->mi_options.readahead_pages);
if (mi->mi_options.read_log_pages != 0) {
diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index efe078fe5d4a..0caa151cae4e 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -427,8 +427,7 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,
if (unlikely(!inode))
return failed_creating(dentry);
- /* Do not set bits for OTH */
- inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP;
+ inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
inode->i_op = ops;
inode->i_fop = &simple_dir_operations;
diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h
index cd15c1b7fae0..e08ace76eba6 100644
--- a/include/linux/tee_drv.h
+++ b/include/linux/tee_drv.h
@@ -178,7 +178,7 @@ void tee_device_unregister(struct tee_device *teedev);
* @offset: offset of buffer in user space
* @pages: locked pages from userspace
* @num_pages: number of locked pages
- * @dmabuf: dmabuf used to for exporting to user space
+ * @refcount: reference counter
* @flags: defined by TEE_SHM_* in tee_drv.h
* @id: unique id of a shared memory object on this device
*
@@ -195,7 +195,7 @@ struct tee_shm {
unsigned int offset;
struct page **pages;
size_t num_pages;
- struct dma_buf *dmabuf;
+ refcount_t refcount;
u32 flags;
int id;
};
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 6684696fa457..4b2819b0a05a 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -94,7 +94,7 @@ static struct hlist_head *dev_map_create_hash(unsigned int entries,
int i;
struct hlist_head *hash;
- hash = bpf_map_area_alloc(entries * sizeof(*hash), numa_node);
+ hash = bpf_map_area_alloc((u64) entries * sizeof(*hash), numa_node);
if (hash != NULL)
for (i = 0; i < entries; i++)
INIT_HLIST_HEAD(&hash[i]);
@@ -159,7 +159,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
spin_lock_init(&dtab->index_lock);
} else {
- dtab->netdev_map = bpf_map_area_alloc(dtab->map.max_entries *
+ dtab->netdev_map = bpf_map_area_alloc((u64) dtab->map.max_entries *
sizeof(struct bpf_dtab_netdev *),
dtab->map.numa_node);
if (!dtab->netdev_map)
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index b513f70b0cc0..17bf2db821c6 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -552,6 +552,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
+ /*
+ * Release agent gets called with all capabilities,
+ * require capabilities to set release agent.
+ */
+ if ((of->file->f_cred->user_ns != &init_user_ns) ||
+ !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
cgrp = cgroup_kn_lock_live(of->kn, false);
if (!cgrp)
return -ENODEV;
@@ -964,6 +972,12 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param)
/* Specifying two release agents is forbidden */
if (ctx->release_agent)
return cg_invalf(fc, "cgroup1: release_agent respecified");
+ /*
+ * Release agent gets called with all capabilities,
+ * require capabilities to set release agent.
+ */
+ if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))
+ return cg_invalf(fc, "cgroup1: Setting release_agent not allowed");
ctx->release_agent = param->string;
param->string = NULL;
break;
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 957e3e58df65..9d3bda3d49fe 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -398,6 +398,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by
return 0;
pipe->nrbufs++;
buf->ops = &page_cache_pipe_buf_ops;
+ buf->flags = 0;
get_page(buf->page = page);
buf->offset = offset;
buf->len = bytes;
@@ -524,6 +525,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size,
break;
pipe->nrbufs++;
pipe->bufs[idx].ops = &default_pipe_buf_ops;
+ pipe->bufs[idx].flags = 0;
pipe->bufs[idx].page = page;
pipe->bufs[idx].offset = 0;
if (left <= PAGE_SIZE) {
diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index df52061f99f7..2646e8f98f67 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -48,7 +48,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
if (err)
goto free_stab;
- stab->sks = bpf_map_area_alloc(stab->map.max_entries *
+ stab->sks = bpf_map_area_alloc((u64) stab->map.max_entries *
sizeof(struct sock *),
stab->map.numa_node);
if (stab->sks)
diff --git a/net/tipc/link.c b/net/tipc/link.c
index f25010261a9e..8f2ee71c63c6 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
u16 peers_tol = msg_link_tolerance(hdr);
u16 peers_prio = msg_linkprio(hdr);
u16 rcv_nxt = l->rcv_nxt;
- u16 dlen = msg_data_sz(hdr);
+ u32 dlen = msg_data_sz(hdr), glen = 0;
int mtyp = msg_type(hdr);
bool reply = msg_probe(hdr);
- u16 glen = 0;
void *data;
char *if_name;
int rc = 0;
trace_tipc_proto_rcv(skb, false, l->name);
+
+ if (dlen > U16_MAX)
+ goto exit;
+
if (tipc_link_is_blocked(l) || !xmitq)
goto exit;
@@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))
ga = NULL;
}
-
+ if(glen > dlen)
+ break;
tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr,
&l->mon_state, l->bearer_id);
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index 58708b4c7719..e7155a774300 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
state->probing = false;
/* Sanity check received domain record */
+ if (new_member_cnt > MAX_MON_DOMAIN)
+ return;
if (dlen < dom_rec_len(arrv_dom, 0))
return;
if (dlen != dom_rec_len(arrv_dom, new_member_cnt))