Merge 4.19.280 into android-4.19-stable

Changes in 4.19.280
	power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
	i40evf: Change a VF mac without reloading the VF driver
	intel-ethernet: rename i40evf to iavf
	iavf: diet and reformat
	iavf: fix inverted Rx hash condition leading to disabled hash
	intel/igbvf: free irq on the error path in igbvf_request_msix()
	igbvf: Regard vf reset nack as success
	i2c: imx-lpi2c: check only for enabled interrupt flags
	scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
	net: usb: smsc95xx: Limit packet length to skb->len
	qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
	xirc2ps_cs: Fix use after free bug in xirc2ps_detach
	net: qcom/emac: Fix use after free bug in emac_remove due to race condition
	net/ps3_gelic_net: Fix RX sk_buff length
	net/ps3_gelic_net: Use dma_mapping_error
	bpf: Adjust insufficient default bpf_jit_limit
	net/mlx5: Read the TC mapping of all priorities on ETS query
	atm: idt77252: fix kmemleak when rmmod idt77252
	erspan: do not use skb_mac_header() in ndo_start_xmit()
	net/sonic: use dma_mapping_error() for error check
	hvc/xen: prevent concurrent accesses to the shared ring
	net: mdio: thunder: Add missing fwnode_handle_put()
	Bluetooth: btqcomsmd: Fix command timeout after setting BD address
	Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
	hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
	uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
	thunderbolt: Use const qualifier for `ring_interrupt_index`
	riscv: Bump COMMAND_LINE_SIZE value to 1024
	ca8210: fix mac_len negative array access
	m68k: Only force 030 bus error if PC not in exception table
	scsi: target: iscsi: Fix an error message in iscsi_check_key()
	scsi: ufs: core: Add soft dependency on governor_simpleondemand
	net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
	net: usb: qmi_wwan: add Telit 0x1080 composition
	sh: sanitize the flags on sigreturn
	cifs: empty interface list when server doesn't support query interfaces
	scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
	usb: gadget: u_audio: don't let userspace block driver unbind
	igb: revert rtnl_lock() that causes deadlock
	dm thin: fix deadlock when swapping to thin device
	usb: chipdea: core: fix return -EINVAL if request role is the same with current role
	usb: chipidea: core: fix possible concurrent when switch role
	nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
	i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
	dm stats: check for and propagate alloc_percpu failure
	dm crypt: add cond_resched() to dmcrypt_write()
	sched/fair: sanitize vruntime of entity being placed
	sched/fair: Sanitize vruntime of entity being migrated
	tun: avoid double free in tun_free_netdev
	ocfs2: fix data corruption after failed write
	bus: imx-weim: fix branch condition evaluates to a garbage value
	md: avoid signed overflow in slot_store()
	ALSA: asihpi: check pao in control_message()
	ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
	fbdev: tgafb: Fix potential divide by zero
	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
	fbdev: nvidia: Fix potential divide by zero
	fbdev: intelfb: Fix potential divide by zero
	fbdev: lxfb: Fix potential divide by zero
	fbdev: au1200fb: Fix potential divide by zero
	ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
	scsi: megaraid_sas: Fix crash after a double completion
	can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
	i40e: fix registers dump after run ethtool adapter self test
	net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
	net: mvneta: make tx buffer array agnostic
	Input: alps - fix compatibility with -funsigned-char
	Input: focaltech - use explicitly signed char type
	cifs: prevent infinite recursion in CIFSGetDFSRefer()
	cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
	xen/netback: don't do grant copy across page boundary
	pinctrl: at91-pio4: fix domain name assignment
	ALSA: hda/conexant: Partial revert of a quirk for Lenovo
	ALSA: usb-audio: Fix regression on detection of Roland VS-100
	drm/etnaviv: fix reference leak when mmaping imported buffer
	s390/uaccess: add missing earlyclobber annotations to __clear_user()
	usb: host: ohci-pxa27x: Fix and & vs | typo
	ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
	firmware: arm_scmi: Fix device node validation for mailbox transport
	gfs2: Always check inode size of inline inodes
	net: sched: cbq: dont intepret cls results when asked to drop
	cgroup/cpuset: Change cpuset_rwsem and hotplug lock order
	cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
	cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
	Linux 4.19.280

Change-Id: I63f8dc1e674a396e468ee0ea314d141682d60b72
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

drivers/firmware/arm_scmi/driver.c

@@ -705,6 +705,39 @@ static int scmi_remove(struct platform_device *pdev)
 	return ret;
 }
 
+static int scmi_mailbox_chan_validate(struct device *cdev)
+{
+	int num_mb, num_sh, ret = 0;
+	struct device_node *np = cdev->of_node;
+
+	num_mb = of_count_phandle_with_args(np, "mboxes", "#mbox-cells");
+	num_sh = of_count_phandle_with_args(np, "shmem", NULL);
+	/* Bail out if mboxes and shmem descriptors are inconsistent */
+	if (num_mb <= 0 || num_sh > 2 || num_mb != num_sh) {
+		dev_warn(cdev, "Invalid channel descriptor for '%s'\n",
+			 of_node_full_name(np));
+		return -EINVAL;
+	}
+
+	if (num_sh > 1) {
+		struct device_node *np_tx, *np_rx;
+
+		np_tx = of_parse_phandle(np, "shmem", 0);
+		np_rx = of_parse_phandle(np, "shmem", 1);
+		/* SCMI Tx and Rx shared mem areas have to be distinct */
+		if (!np_tx || !np_rx || np_tx == np_rx) {
+			dev_warn(cdev, "Invalid shmem descriptor for '%s'\n",
+				 of_node_full_name(np));
+			ret = -EINVAL;
+		}
+
+		of_node_put(np_tx);
+		of_node_put(np_rx);
+	}
+
+	return ret;
+}
+
 static inline int
 scmi_mbox_chan_setup(struct scmi_info *info, struct device *dev, int prot_id)
 {
@@ -720,6 +753,10 @@ scmi_mbox_chan_setup(struct scmi_info *info, struct device *dev, int prot_id)
 		goto idr_alloc;
 	}
 
+	ret = scmi_mailbox_chan_validate(dev);
+	if (ret)
+		return ret;
+
 	cinfo = devm_kzalloc(info->dev, sizeof(*cinfo), GFP_KERNEL);
 	if (!cinfo)
 		return -ENOMEM;