Merge branch 'android11-5.4' into branch 'android11-5.4-lts'

Sync up with android11-5.4 for the following commits:

2ddac3780b BACKPORT: ALSA: pcm: Fix races among concurrent prealloc proc writes
6ef42e5789 BACKPORT: ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
32745ed213 BACKPORT: ALSA: pcm: Fix races among concurrent read/write and buffer changes
bf4e161bf9 ANDROID: Fix up abi issue with struct snd_pcm_runtime
3026e8262a BACKPORT: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
46eb6b6125 BACKPORT: nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
375c2e2cdb Merge tag 'android11-5.4.191_r01' into android11-5.4
e7792e2790 BACKPORT: scsi: ufs: Resume ufs host before accessing ufs device
12bf063cb9 BACKPORT: can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
1ae6fd7e6f ANDROID: ABI: Added symbols for allwinner
7d33bb909e BACKPORT: can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path
09c810c77d BACKPORT: esp: Fix possible buffer overflow in ESP transformation
f896faff41 ANDROID: ABI: Update allowed list for QCOM
0840b18507 ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
7f04e0c309 BACKPORT: staging: ion: Prevent incorrect reference counting behavour
9adbfa635e FROMGIT: net: fix wrong network header length
2586f0405b ANDROID: fix KCFLAGS override by __ANDROID_COMMON_KERNEL__
d2ed4cfcd5 ANDROID: Add flag to indicate compiling against ACK
850a2f987c BACKPORT: net/packet: fix slab-out-of-bounds access in packet_recvmsg()
45e2b6a26f BACKPORT: block: Add a helper to validate the block size
353ca06c86 BACKPORT: virtio-blk: Use blk_validate_block_size() to validate block size
4177a169eb BACKPORT: fuse: fix pipe buffer lifetime for direct_io
39435ab3a6 ANDROID: ABI: Update allowed list for galaxy

And track more new symbols that are coming from the 'android11-5.4'
branch:

Leaf changes summary: 12 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 9 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 3 Added variables

9 Added functions:

  [A] 'function void* __devm_alloc_percpu(device*, size_t, size_t)'
  [A] 'function int blkdev_fsync(file*, loff_t, loff_t, int)'
  [A] 'function void devm_extcon_dev_free(device*, extcon_dev*)'
  [A] 'function gen_pool* devm_gen_pool_create(device*, int, int, const char*)'
  [A] 'function loff_t fixed_size_llseek(file*, loff_t, int, loff_t)'
  [A] 'function u64 get_random_u64()'
  [A] 'function void kmsg_dump_rewind(kmsg_dumper*)'
  [A] 'function u64 nsec_to_clock_t(u64)'
  [A] 'function int unregister_die_notifier(notifier_block*)'

3 Added variables:

  [A] 'tracepoint __tracepoint_android_vh_printk_store'
  [A] 'tracepoint __tracepoint_android_vh_show_regs'
  [A] 'kernel_cpustat kernel_cpustat'

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I81e7c0853a4dd0be2c64403b767725c612b0340c

android/abi_gki_aarch64_galaxy

@@ -1,4 +1,6 @@
 [abi_symbol_list]
+  LZ4_decompress_safe
+  PDE_DATA
   ___ratelimit
   __alloc_disk_node
   __alloc_pages_nodemask
@@ -40,6 +42,7 @@
   __cpuhp_setup_state_cpuslocked
   __dev_kfree_skb_any
   __dev_kfree_skb_irq
+  __devm_alloc_percpu
   __devm_iio_device_register
   __devm_irq_alloc_descs
   __devm_of_phy_provider_register
@@ -150,9 +153,9 @@
   __srcu_read_unlock
   __stack_chk_fail
   __stack_chk_guard
-  __sw_hweight8
   __sw_hweight32
   __sw_hweight64
+  __sw_hweight8
   __sync_dirty_buffer
   __task_pid_nr_ns
   __tasklet_hi_schedule
@@ -162,7 +165,9 @@
   __tracepoint_android_vh_ipi_stop
   __tracepoint_android_vh_is_fpsimd_save
   __tracepoint_android_vh_kfree_skb
+  __tracepoint_android_vh_printk_store
   __tracepoint_android_vh_ptype_head
+  __tracepoint_android_vh_show_regs
   __tracepoint_android_vh_wq_lockup_pool
   __tracepoint_device_pm_callback_end
   __tracepoint_device_pm_callback_start
@@ -286,6 +291,7 @@
   blk_rq_unmap_user
   blk_stat_enable_accounting
   blk_verify_command
+  blkdev_fsync
   blkdev_get_by_dev
   blkdev_get_by_path
   blkdev_put
@@ -590,6 +596,7 @@
   devm_extcon_register_notifier
   devm_free_irq
   devm_fwnode_get_index_gpiod_from_child
+  devm_gen_pool_create
   devm_gpio_request
   devm_gpio_request_one
   devm_gpiochip_add_data
@@ -609,6 +616,7 @@
   devm_kmalloc
   devm_kmemdup
   devm_kstrdup
+  devm_kstrdup_const
   devm_led_classdev_register_ext
   devm_nvmem_cell_get
   devm_nvmem_device_get
@@ -727,8 +735,8 @@
   dmaengine_unmap_put
   dmam_alloc_attrs
   dmam_free_coherent
-  do_exit
   do_SAK
+  do_exit
   do_wait_intr
   down
   down_interruptible
@@ -1011,6 +1019,7 @@
   find_vpid
   finish_wait
   firmware_request_nowarn
+  fixed_size_llseek
   flush_dcache_page
   flush_delayed_work
   flush_work
@@ -1055,8 +1064,10 @@
   generic_file_splice_read
   generic_handle_irq
   generic_mii_ioctl
+  generic_perform_write
   generic_read_dir
   generic_shutdown_super
+  generic_write_checks
   genl_register_family
   genl_unregister_family
   genlmsg_put
@@ -1068,6 +1079,7 @@
   get_pid_task
   get_random_bytes
   get_random_u32
+  get_random_u64
   get_task_exe_file
   get_task_mm
   get_task_pid
@@ -1101,6 +1113,7 @@
   gpio_to_desc
   gpiochip_add_data_with_key
   gpiochip_add_pin_range
+  gpiochip_find
   gpiochip_generic_free
   gpiochip_generic_request
   gpiochip_get_data
@@ -1110,10 +1123,10 @@
   gpiochip_remove
   gpiochip_set_nested_irqchip
   gpiochip_unlock_as_irq
+  gpiod_cansleep
   gpiod_direction_input
   gpiod_direction_output
   gpiod_direction_output_raw
-  gpiod_cansleep
   gpiod_get_optional
   gpiod_get_raw_value
   gpiod_get_raw_value_cansleep
@@ -1223,9 +1236,9 @@
   iio_read_channel_processed
   iio_read_channel_raw
   import_iovec
+  in6_pton
   in_aton
   in_egroup_p
-  in6_pton
   init_dummy_netdev
   init_net
   init_srcu_struct
@@ -1309,6 +1322,7 @@
   ion_heap_unmap_kernel
   ion_query_heaps_kernel
   iounmap
+  iov_iter_kvec
   iput
   ipv6_stub
   irq_chip_ack_parent
@@ -1362,14 +1376,15 @@
   iterate_dir
   iterate_fd
   jiffies
+  jiffies64_to_msecs
   jiffies_64_to_clock_t
   jiffies_to_msecs
   jiffies_to_usecs
-  jiffies64_to_msecs
   kasprintf
   kern_path
   kernel_bind
   kernel_connect
+  kernel_cpustat
   kernel_getsockname
   kernel_kobj
   kernel_read
@@ -1401,6 +1416,8 @@
   kmem_cache_free
   kmemdup
   kmemdup_nul
+  kmsg_dump_get_line
+  kmsg_dump_rewind
   kobject_add
   kobject_create_and_add
   kobject_del
@@ -1478,7 +1495,6 @@
   lockref_get
   lookup_one_len
   loops_per_jiffy
-  LZ4_decompress_safe
   map_vm_area
   match_int
   match_token
@@ -1593,6 +1609,7 @@
   ns_to_timespec
   ns_to_timespec64
   ns_to_timeval
+  nsec_to_clock_t
   nsecs_to_jiffies
   nvmem_cell_get
   nvmem_cell_put
@@ -1770,7 +1787,6 @@
   pci_write_config_dword
   pcie_capability_read_word
   pcim_enable_device
-  PDE_DATA
   perf_trace_buf_alloc
   perf_trace_run_bpf_submit
   pfn_valid
@@ -1940,6 +1956,7 @@
   regmap_bulk_write
   regmap_field_read
   regmap_field_update_bits_base
+  regmap_mmio_detach_clk
   regmap_multi_reg_write
   regmap_multi_reg_write_bypassed
   regmap_raw_read
@@ -1979,7 +1996,6 @@
   regulatory_set_wiphy_regd_sync_rtnl
   release_firmware
   release_sock
-  regmap_mmio_detach_clk
   remap_pfn_range
   remap_vmalloc_range
   remove_proc_entry
@@ -2023,6 +2039,8 @@
   rpmsg_trysend
   rpmsg_unregister_device
   rps_needed
+  rt_mutex_lock
+  rt_mutex_unlock
   rtc_class_close
   rtc_class_open
   rtc_read_time
@@ -2033,8 +2051,6 @@
   rtnl_is_locked
   rtnl_lock
   rtnl_unlock
-  rt_mutex_lock
-  rt_mutex_unlock
   runqueues
   save_stack_trace
   save_stack_trace_tsk
@@ -2532,6 +2548,8 @@
   unlock_rename
   unmap_mapping_range
   unregister_chrdev_region
+  unregister_console
+  unregister_die_notifier
   unregister_filesystem
   unregister_inet6addr_notifier
   unregister_inetaddr_notifier
@@ -2722,7 +2740,6 @@
   usbnet_write_cmd_nopm
   user_path_at_empty
   usleep_range
-  v4l_bound_align_image
   v4l2_ctrl_find
   v4l2_ctrl_g_ctrl
   v4l2_ctrl_get_name
@@ -2764,6 +2781,7 @@
   v4l2_subdev_call_wrappers
   v4l2_subdev_init
   v4l2_type_names
+  v4l_bound_align_image
   vabits_actual
   vb2_buffer_done
   vb2_common_vm_ops
@@ -2810,6 +2828,7 @@
   vfs_create
   vfs_fallocate
   vfs_fsync
+  vfs_fsync_range
   vfs_getattr
   vfs_getxattr
   vfs_link

android/abi_gki_aarch64_qcom

@@ -1309,6 +1309,7 @@
   kfree
   kfree_skb
   kfree_skb_list
+  kill_anon_super
   kill_fasync
   kill_litter_super
   kimage_vaddr

android/abi_gki_aarch64_sunxi

@@ -308,3 +308,6 @@
   dev_pm_opp_put_prop_name
   dev_pm_opp_put_supported_hw
   dev_pm_opp_set_prop_name
+
+# required by disp.ko
+  devm_extcon_dev_free

build.config.common

@@ -9,6 +9,7 @@ DEPMOD=depmod
 CLANG_PREBUILT_BIN=prebuilts-master/clang/host/linux-x86/clang-r416183b/bin
 BUILDTOOLS_PREBUILT_BIN=build/build-tools/path/linux-x86
 
+KCFLAGS="${KCFLAGS} -D__ANDROID_COMMON_KERNEL__"
 EXTRA_CMDS=''
 STOP_SHIP_TRACEPRINTK=1
 IN_KERNEL_MODULES=1

drivers/block/virtio_blk.c

@@ -944,7 +944,7 @@ static int virtblk_probe(struct virtio_device *vdev)
 			dev_err(&vdev->dev,
 				"virtio_blk: invalid block size: 0x%x\n",
 				blk_size);
-			goto out_free_tags;
+			goto out_cleanup_disk;
 		}
 
 		blk_queue_logical_block_size(q, blk_size);
@@ -1016,6 +1016,8 @@ static int virtblk_probe(struct virtio_device *vdev)
 	device_add_disk(&vdev->dev, vblk->disk, virtblk_attr_groups);
 	return 0;
 
+out_cleanup_disk:
+	blk_cleanup_queue(vblk->disk->queue);
 out_free_tags:
 	blk_mq_free_tag_set(&vblk->tag_set);
 out_put_disk:

drivers/md/dm-bow.c

@@ -599,6 +599,7 @@ static void dm_bow_dtr(struct dm_target *ti)
 	struct bow_context *bc = (struct bow_context *) ti->private;
 	struct kobject *kobj;
 
+	mutex_lock(&bc->ranges_lock);
 	while (rb_first(&bc->ranges)) {
 		struct bow_range *br = container_of(rb_first(&bc->ranges),
 						    struct bow_range, node);
@@ -606,6 +607,8 @@ static void dm_bow_dtr(struct dm_target *ti)
 		rb_erase(&br->node, &bc->ranges);
 		kfree(br);
 	}
+	mutex_unlock(&bc->ranges_lock);
+
 	if (bc->workqueue)
 		destroy_workqueue(bc->workqueue);
 	if (bc->bufio)
@@ -1182,6 +1185,7 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 		return;
 	}
 
+	mutex_lock(&bc->ranges_lock);
 	for (i = rb_first(&bc->ranges); i; i = rb_next(i)) {
 		struct bow_range *br = container_of(i, struct bow_range, node);
 
@@ -1189,11 +1193,11 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 				    readable_type[br->type],
 				    (unsigned long long)br->sector);
 		if (result >= end)
-			return;
+			goto unlock;
 
 		result += scnprintf(result, end - result, "\n");
 		if (result >= end)
-			return;
+			goto unlock;
 
 		if (br->type == TRIMMED)
 			++trimmed_range_count;
@@ -1215,19 +1219,22 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 		if (!rb_next(i)) {
 			scnprintf(result, end - result,
 				  "\nERROR: Last range not of type TOP");
-			return;
+			goto unlock;
 		}
 
 		if (br->sector > range_top(br)) {
 			scnprintf(result, end - result,
 				  "\nERROR: sectors out of order");
-			return;
+			goto unlock;
 		}
 	}
 
 	if (trimmed_range_count != trimmed_list_length)
 		scnprintf(result, end - result,
 			  "\nERROR: not all trimmed ranges in trimmed list");
+
+unlock:
+	mutex_unlock(&bc->ranges_lock);
 }
 
 static void dm_bow_status(struct dm_target *ti, status_type_t type,

drivers/scsi/ufs/ufs-sysfs.c

@@ -211,8 +211,11 @@ static ssize_t ufs_sysfs_read_desc_param(struct ufs_hba *hba,
 	if (param_size > 8)
 		return -EINVAL;
 
+	pm_runtime_get_sync(hba->dev);
 	ret = ufshcd_read_desc_param(hba, desc_id, desc_index,
 				param_offset, desc_buf, param_size);
+	pm_runtime_put_sync(hba->dev);
+
 	if (ret)
 		return -EINVAL;
 	switch (param_size) {
@@ -578,6 +581,7 @@ static ssize_t _name##_show(struct device *dev,				\
 	desc_buf = kzalloc(QUERY_DESC_MAX_SIZE, GFP_ATOMIC);		\
 	if (!desc_buf)                                                  \
 		return -ENOMEM;                                         \
+	pm_runtime_get_sync(hba->dev);					\
 	ret = ufshcd_query_descriptor_retry(hba,			\
 		UPIU_QUERY_OPCODE_READ_DESC, QUERY_DESC_IDN_DEVICE,	\
 		0, 0, desc_buf, &desc_len);				\
@@ -594,6 +598,7 @@ static ssize_t _name##_show(struct device *dev,				\
 		goto out;						\
 	ret = snprintf(buf, PAGE_SIZE, "%s\n", desc_buf);		\
 out:									\
+	pm_runtime_put_sync(hba->dev);					\
 	kfree(desc_buf);						\
 	return ret;							\
 }									\
@@ -630,14 +635,18 @@ static ssize_t _name##_show(struct device *dev,				\
 	struct device_attribute *attr, char *buf)			\
 {									\
 	bool flag;							\
+	int ret;							\
 	u8 index = 0;							\
 	struct ufs_hba *hba = dev_get_drvdata(dev);			\
 	if (ufshcd_is_wb_flags(QUERY_FLAG_IDN##_uname))			\
 		index = ufshcd_wb_get_query_index(hba);			\
-	if (ufshcd_query_flag(hba, UPIU_QUERY_OPCODE_READ_FLAG,		\
-		QUERY_FLAG_IDN##_uname, index, &flag))			\
+	pm_runtime_get_sync(hba->dev);					\
+	ret = ufshcd_query_flag(hba, UPIU_QUERY_OPCODE_READ_FLAG,	\
+			QUERY_FLAG_IDN##_uname, index, &flag);		\
+	pm_runtime_put_sync(hba->dev);					\
+	if (ret)							\
 		return -EINVAL;						\
-	return sprintf(buf, "%s\n", flag ? "true" : "false"); \
+	return sprintf(buf, "%s\n", flag ? "true" : "false");		\
 }									\
 static DEVICE_ATTR_RO(_name)
 
@@ -686,10 +695,14 @@ static ssize_t _name##_show(struct device *dev,				\
 	struct ufs_hba *hba = dev_get_drvdata(dev);			\
 	u32 value;							\
 	u8 index = 0;							\
+	int ret;							\
 	if (ufshcd_is_wb_attrs(QUERY_ATTR_IDN##_uname))			\
 		index = ufshcd_wb_get_query_index(hba);			\
-	if (ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_READ_ATTR,		\
-		QUERY_ATTR_IDN##_uname, index, 0, &value))		\
+	pm_runtime_get_sync(hba->dev);					\
+	ret = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_READ_ATTR,	\
+			QUERY_ATTR_IDN##_uname, index, 0, &value);	\
+	pm_runtime_put_sync(hba->dev);					\
+	if (ret)							\
 		return -EINVAL;						\
 	return sprintf(buf, "0x%08X\n", value);				\
 }									\
@@ -822,10 +835,15 @@ static ssize_t dyn_cap_needed_attribute_show(struct device *dev,
 	struct scsi_device *sdev = to_scsi_device(dev);
 	struct ufs_hba *hba = shost_priv(sdev->host);
 	u8 lun = ufshcd_scsi_to_upiu_lun(sdev->lun);
+	int ret;
 
-	if (ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_READ_ATTR,
-		QUERY_ATTR_IDN_DYN_CAP_NEEDED, lun, 0, &value))
+	pm_runtime_get_sync(hba->dev);
+	ret = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_READ_ATTR,
+			QUERY_ATTR_IDN_DYN_CAP_NEEDED, lun, 0, &value);
+	pm_runtime_put_sync(hba->dev);
+	if (ret)
 		return -EINVAL;
+
 	return sprintf(buf, "0x%08X\n", value);
 }
 static DEVICE_ATTR_RO(dyn_cap_needed_attribute);

net/core/skbuff.c

@@ -3680,7 +3680,7 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
 	unsigned int delta_len = 0;
 	struct sk_buff *tail = NULL;
 	struct sk_buff *nskb, *tmp;
-	int err;
+	int len_diff, err;
 
 	skb_push(skb, -skb_network_offset(skb) + offset);
 
@@ -3720,9 +3720,11 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
 		skb_push(nskb, -skb_network_offset(nskb) + offset);
 
 		skb_release_head_state(nskb);
+		len_diff = skb_network_header_len(nskb) - skb_network_header_len(skb);
 		 __copy_skb_header(nskb, skb);
 
 		skb_headers_offset_update(nskb, skb_headroom(nskb) - skb_headroom(skb));
+		nskb->transport_header += len_diff;
 		skb_copy_from_linear_data_offset(skb, -tnl_hlen,
 						 nskb->data - tnl_hlen,
 						 offset + tnl_hlen);

sound/core/pcm_lib.c

@@ -1861,9 +1861,11 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
 		if (avail >= runtime->twake)
 			break;
 		snd_pcm_stream_unlock_irq(substream);
+		mutex_unlock(&runtime->buffer_mutex);
 
 		tout = schedule_timeout(wait_time);
 
+		mutex_lock(&runtime->buffer_mutex);
 		snd_pcm_stream_lock_irq(substream);
 		set_current_state(TASK_INTERRUPTIBLE);
 		switch (runtime->status->state) {
@@ -2159,6 +2161,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
 
 	nonblock = !!(substream->f_flags & O_NONBLOCK);
 
+	mutex_lock(&runtime->buffer_mutex);
 	snd_pcm_stream_lock_irq(substream);
 	err = pcm_accessible_state(runtime);
 	if (err < 0)
@@ -2251,6 +2254,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
 	if (xfer > 0 && err >= 0)
 		snd_pcm_update_state(substream, runtime);
 	snd_pcm_stream_unlock_irq(substream);
+	mutex_unlock(&runtime->buffer_mutex);
 	return xfer > 0 ? (snd_pcm_sframes_t)xfer : err;
 }
 EXPORT_SYMBOL(__snd_pcm_lib_xfer);

sound/core/pcm_native.c

@@ -658,7 +658,7 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
 			     struct snd_pcm_hw_params *params)
 {
 	struct snd_pcm_runtime *runtime;
-	int err, usecs;
+	int err = 0, usecs;
 	unsigned int bits;
 	snd_pcm_uframes_t frames;