Merge android-4.19.26 (c97d2b5) into msm-4.19

* refs/heads/tmp-c97d2b5:
  Linux 4.19.26
  net: phylink: avoid resolving link state too early
  pinctrl: max77620: Use define directive for max77620_pinconf_param values
  udlfb: handle unplug properly
  netfilter: ipt_CLUSTERIP: fix sleep-in-atomic bug in clusterip_config_entry_put()
  netfilter: nfnetlink_osf: add missing fmatch check
  netfilter: ipv6: Don't preserve original oif for loopback address
  netfilter: nft_compat: use-after-free when deleting targets
  netfilter: nf_tables: fix flush after rule deletion in the same batch
  Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
  staging: erofs: unzip_vle_lz4.c,utils.c: rectify BUG_ONs
  staging: erofs: unzip_{pagevec.h,vle.c}: rectify BUG_ONs
  staging: erofs: {dir,inode,super}.c: rectify BUG_ONs
  staging: erofs: add a full barrier in erofs_workgroup_unfreeze
  staging: erofs: fix `erofs_workgroup_{try_to_freeze, unfreeze}'
  staging: erofs: atomic_cond_read_relaxed on ref-locked workgroup
  staging: erofs: remove the redundant d_rehash() for the root dentry
  staging: erofs: drop multiref support temporarily
  staging: erofs: replace BUG_ON with DBG_BUGON in data.c
  staging: erofs: complete error handing of z_erofs_do_read_page
  staging: erofs: fix a bug when appling cache strategy
  net: avoid false positives in untrusted gso validation
  net: validate untrusted gso packets without csum offload
  kvm: x86: Return LA57 feature based on hardware capability
  mac80211: allocate tailroom for forwarded mesh packets
  drm/amd/display: Fix MST reboot/poweroff sequence
  drm/i915/fbdev: Actually configure untiled displays
  gpu: drm: radeon: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime
  drm/amdgpu: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime
  ARC: define ARCH_SLAB_MINALIGN = 8
  ARC: U-boot: check arguments paranoidly
  ARCv2: Enable unaligned access in early ASM code
  parisc: Fix ptrace syscall number modification
  KEYS: always initialize keyring_index_key::desc_len
  KEYS: user: Align the payload buffer
  RDMA/srp: Rework SCSI device reset handling
  net/mlx5e: XDP, fix redirect resources availability check
  net_sched: fix two more memory leaks in cls_tcindex
  net_sched: fix a memory leak in cls_tcindex
  net_sched: fix a race condition in tcindex_destroy()
  sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
  geneve: should not call rt6_lookup() when ipv6 was disabled
  net: socket: make bond ioctls go through compat_ifreq_ioctl()
  net: socket: fix SIOCGIFNAME in compat
  Revert "kill dev_ifsioc()"
  Revert "socket: fix struct ifreq size in compat ioctl"
  team: avoid complex list operations in team_nl_cmd_options_set()
  sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate
  sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment
  net: sfp: do not probe SFP module before we're attached
  net/packet: fix 4gb buffer limit due to overflow check
  net/mlx5e: Don't overwrite pedit action when multiple pedit used
  net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
  net: ena: fix race between link up and device initalization
  ipv6: propagate genlmsg_reply return code
  inet_diag: fix reporting cgroup classid and fallback to priority
  batman-adv: fix uninit-value in batadv_interface_tx()
  isdn: avm: Fix string plus integer warning from Clang
  net/mlx5e: Fix wrong (zero) TX drop counter indication for representor
  selftests: forwarding: Add a test case for externally learned FDB entries
  mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky
  net: bridge: Mark FDB entries that were added by user as such
  mlxsw: pci: Return error on PCI reset timeout
  dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start
  bpf: bpf_setsockopt: reset sock dst on SO_MARK changes
  leds: lp5523: fix a missing check of return value of lp55xx_read
  hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table
  atm: he: fix sign-extension overflow on large shift
  selftests/bpf: retry tests that expect build-id
  bpf: zero out build_id for BPF_STACK_BUILD_ID_IP
  bpf: don't assume build-id length is always 20 bytes
  afs: Fix key refcounting in file locking code
  afs: Don't set vnode->cb_s_break in afs_validate()
  selftests: tc-testing: fix parsing of ife type
  selftests: tc-testing: fix tunnel_key failure if dst_port is unspecified
  selftests: tc-testing: drop test on missing tunnel key id
  pvcalls-front: fix potential null dereference
  drm/sun4i: backend: add missing of_node_puts
  vhost: return EINVAL if iovecs size does not match the message size
  drm/amd/display: fix PME notification not working in RV desktop
  drm/amdkfd: Don't assign dGPUs to APU topology devices
  drm/meson: add missing of_node_put
  always clear the X2APIC_ENABLE bit for PV guest
  netfilter: nft_flow_offload: fix checking method of conntrack helper
  scsi: cxgb4i: add wait_for_completion()
  scsi: ufs: Fix geometry descriptor size
  scsi: qedi: Add ep_state for login completion on un-reachable targets
  scsi: ufs: Fix system suspend status
  scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes
  isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
  net: stmmac: Prevent RX starvation in stmmac_napi_poll()
  net: stmmac: Fix the logic of checking if RX Watchdog must be enabled
  net: stmmac: Check if CBS is supported before configuring
  net: stmmac: dwxgmac2: Only clear interrupts that are active
  net: stmmac: Fix PCI module removal leak
  acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id()
  powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool.
  RDMA/mthca: Clear QP objects during their allocation
  netfilter: nft_flow_offload: fix interaction with vrf slave device
  bpf: fix panic in stack_map_get_build_id() on i386 and arm32
  pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock
  bpf: correctly set initial window on active Fast Open sender
  netfilter: nft_flow_offload: Fix reverse route lookup
  MIPS: jazz: fix 64bit build
  include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR
  scsi: isci: initialize shost fully before calling scsi_add_host()
  scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
  netfilter: nf_tables: fix leaking object reference count
  selftests: forwarding: Add a test for VLAN deletion
  mlxsw: spectrum_acl: Add cleanup after C-TCAM update error condition
  xprtrdma: Double free in rpcrdma_sendctxs_create()
  MIPS: ath79: Enable OF serial ports in the default config
  net/mlx4: Get rid of page operation after dma_alloc_coherent
  watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem
  selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in test_sock_addr
  bpf: Fix [::] -> [::1] rewrite in sys_sendmsg
  net: hns: Fix use after free identified by SLUB debug
  qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier
  qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count
  xen/pvcalls: remove set but not used variable 'intf'
  mfd: mc13xxx: Fix a missing check of a register-read failure
  mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe()
  mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove
  mfd: axp20x: Add supported cells for AXP803
  mfd: axp20x: Re-align MFD cell entries
  mfd: axp20x: Add AC power supply cell for AXP813
  mfd: wm5110: Add missing ASRC rate register
  mfd: qcom_rpm: write fw_version to CTRL_REG
  mfd: bd9571mwv: Add volatile register to make DVFS work
  mfd: ab8500-core: Return zero in get_register_interruptible()
  mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported
  mfd: db8500-prcmu: Fix some section annotations
  mfd: twl-core: Fix section annotations on {,un}protect_pm_master
  pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read
  pvcalls-front: properly allocate sk
  pvcalls-front: don't try to free unallocated rings
  pvcalls-front: read all data before closing the connection
  mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
  backlight: pwm_bl: Fix devicetree parsing with auto-generated brightness tables
  KEYS: allow reaching the keys quotas exactly
  ALSA: hda/realtek: Disable PC beep in passthrough on alc285
  ALSA: hda/realtek - Headset microphone and internal speaker support for System76 oryp5
  proc, oom: do not report alien mms when setting oom_score_adj
  numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
  ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
  libceph: handle an empty authorize reply
  mac80211: Free mpath object when rhashtable insertion fails
  mac80211: Use linked list instead of rhashtable walk for mesh tables
  mac80211: Restore vif beacon interval if start ap fails
  gpio: pxa: avoid attempting to set pin direction via pinctrl on MMP2
  gpio: MT7621: use a per instance irq_chip structure
  MIPS: eBPF: Always return sign extended 32b values
  tracing: Fix number of entries in trace header
  ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction

Change-Id: Ie585d8274f881ac87155e9deda341c43cd8923b4
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>

net/socket.c

@@ -951,8 +951,7 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
 EXPORT_SYMBOL(dlci_ioctl_set);
 
 static long sock_do_ioctl(struct net *net, struct socket *sock,
-			  unsigned int cmd, unsigned long arg,
-			  unsigned int ifreq_size)
+			  unsigned int cmd, unsigned long arg)
 {
 	int err;
 	void __user *argp = (void __user *)arg;
@@ -978,11 +977,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
 	} else {
 		struct ifreq ifr;
 		bool need_copyout;
-		if (copy_from_user(&ifr, argp, ifreq_size))
+		if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
 			return -EFAULT;
 		err = dev_ioctl(net, cmd, &ifr, &need_copyout);
 		if (!err && need_copyout)
-			if (copy_to_user(argp, &ifr, ifreq_size))
+			if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
 				return -EFAULT;
 	}
 	return err;
@@ -1081,8 +1080,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
 			err = open_related_ns(&net->ns, get_net_ns);
 			break;
 		default:
-			err = sock_do_ioctl(net, sock, cmd, arg,
-					    sizeof(struct ifreq));
+			err = sock_do_ioctl(net, sock, cmd, arg);
 			break;
 		}
 	return err;
@@ -2773,8 +2771,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
 	int err;
 
 	set_fs(KERNEL_DS);
-	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv,
-			    sizeof(struct compat_ifreq));
+	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
 	set_fs(old_fs);
 	if (!err)
 		err = compat_put_timeval(&ktv, up);
@@ -2790,8 +2787,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
 	int err;
 
 	set_fs(KERNEL_DS);
-	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts,
-			    sizeof(struct compat_ifreq));
+	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
 	set_fs(old_fs);
 	if (!err)
 		err = compat_put_timespec(&kts, up);
@@ -2987,6 +2983,54 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
 	return dev_ioctl(net, cmd, &ifreq, NULL);
 }
 
+static int compat_ifreq_ioctl(struct net *net, struct socket *sock,
+			      unsigned int cmd,
+			      struct compat_ifreq __user *uifr32)
+{
+	struct ifreq __user *uifr;
+	int err;
+
+	/* Handle the fact that while struct ifreq has the same *layout* on
+	 * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
+	 * which are handled elsewhere, it still has different *size* due to
+	 * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
+	 * resulting in struct ifreq being 32 and 40 bytes respectively).
+	 * As a result, if the struct happens to be at the end of a page and
+	 * the next page isn't readable/writable, we get a fault. To prevent
+	 * that, copy back and forth to the full size.
+	 */
+
+	uifr = compat_alloc_user_space(sizeof(*uifr));
+	if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
+		return -EFAULT;
+
+	err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
+
+	if (!err) {
+		switch (cmd) {
+		case SIOCGIFFLAGS:
+		case SIOCGIFMETRIC:
+		case SIOCGIFMTU:
+		case SIOCGIFMEM:
+		case SIOCGIFHWADDR:
+		case SIOCGIFINDEX:
+		case SIOCGIFADDR:
+		case SIOCGIFBRDADDR:
+		case SIOCGIFDSTADDR:
+		case SIOCGIFNETMASK:
+		case SIOCGIFPFLAGS:
+		case SIOCGIFTXQLEN:
+		case SIOCGMIIPHY:
+		case SIOCGMIIREG:
+		case SIOCGIFNAME:
+			if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
+				err = -EFAULT;
+			break;
+		}
+	}
+	return err;
+}
+
 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
 			struct compat_ifreq __user *uifr32)
 {
@@ -3102,8 +3146,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
 	}
 
 	set_fs(KERNEL_DS);
-	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r,
-			    sizeof(struct compat_ifreq));
+	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
 	set_fs(old_fs);
 
 out:
@@ -3203,21 +3246,22 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
 	case SIOCSIFTXQLEN:
 	case SIOCBRADDIF:
 	case SIOCBRDELIF:
+	case SIOCGIFNAME:
 	case SIOCSIFNAME:
 	case SIOCGMIIPHY:
 	case SIOCGMIIREG:
 	case SIOCSMIIREG:
-	case SIOCSARP:
-	case SIOCGARP:
-	case SIOCDARP:
-	case SIOCATMARK:
 	case SIOCBONDENSLAVE:
 	case SIOCBONDRELEASE:
 	case SIOCBONDSETHWADDR:
 	case SIOCBONDCHANGEACTIVE:
-	case SIOCGIFNAME:
-		return sock_do_ioctl(net, sock, cmd, arg,
-				     sizeof(struct compat_ifreq));
+		return compat_ifreq_ioctl(net, sock, cmd, argp);
+
+	case SIOCSARP:
+	case SIOCGARP:
+	case SIOCDARP:
+	case SIOCATMARK:
+		return sock_do_ioctl(net, sock, cmd, arg);
 	}
 
 	return -ENOIOCTLCMD;