-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHVg7kACgkQONu9yGCS
aT7Fyg/+PAROx6wzrR5J/OjD3n0i6mic+Uxu540MA6TO1cWrbvpKM8GDx3hRvNsN
E3rKwrToZ6En69xPpXr5aSoA6x/4AKWE6tf3aQBjCY0hxG35yGSK2e/tvQmJ9zpn
A2jD6Pf6IRsv144UU6s3OTAA0ToKctqi6yL1P9wlhSu1qoETFDDVKzJiZfKiFLgQ
qgTLK5mMH0koGbZ+T4XFnHRjfJ647GYU5eWHeIBfKoH8YEQ40f1fNaByqZR9A2RZ
uYR5qtH+hAidUFov8CuwKU3U6SBf7JGkWCfa+3IjlGAoVMzZatntNYIdmrx0XQJ6
LLSE/vlZzLN3xrYyBS6SSGweFMHbMkFBgdc0pQnozPWGb/v1zj0tXc+N6wz142De
pIreSUU1mxJjBnnIHEy9gYMaeVc+oCZKODxwrKyJhme8UZFx3YQR2tH9r4j+2Z1F
Os3HW6IexkJpm+XT2ZajQ1gZih7pbOFNjWoN7CwkhP2484XAUkvdK/MJnDEe+vCC
xBDsgSnxCJ3vYTKfql1j85RFedT/pb+AOXOXe/K0kfo+SLnALV4uQ8gx5Z/WsHNp
LRfTC2H88sCL+JJw8gwOY3g8685qNAP91CAtWW388SS+k6p+TGxmXQK+ockTzPzE
GNIOlE3cT5ZC0TlfojMH0dRrFqrnqSAvIHT2QJmZagLexlM7WRA=
=F6Mn
-----END PGP SIGNATURE-----
Merge 5.10.90 into android12-5.10-lts
Changes in 5.10.90
Input: i8042 - add deferred probe support
Input: i8042 - enable deferred probe quirk for ASUS UM325UA
tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().
tomoyo: use hwight16() in tomoyo_domain_quota_is_ok()
parisc: Clear stale IIR value on instruction access rights trap
platform/x86: apple-gmux: use resource_size() with res
memblock: fix memblock_phys_alloc() section mismatch error
recordmcount.pl: fix typo in s390 mcount regex
selinux: initialize proto variable in selinux_ip_postroute_compat()
scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources
net/mlx5e: Wrap the tx reporter dump callback to extract the sq
net/mlx5e: Fix ICOSQ recovery flow for XSK
udp: using datalen to cap ipv6 udp max gso segments
selftests: Calculate udpgso segment count without header adjustment
sctp: use call_rcu to free endpoint
net/smc: fix using of uninitialized completions
net: usb: pegasus: Do not drop long Ethernet frames
net: ag71xx: Fix a potential double free in error handling paths
net: lantiq_xrx200: fix statistics of received bytes
NFC: st21nfca: Fix memory leak in device probe and remove
net/smc: improved fix wait on already cleared link
net/smc: don't send CDC/LLC message if link not ready
net/smc: fix kernel panic caused by race of smc_sock
igc: Fix TX timestamp support for non-MSI-X platforms
ionic: Initialize the 'lif->dbid_inuse' bitmap
net/mlx5e: Fix wrong features assignment in case of error
selftests/net: udpgso_bench_tx: fix dst ip argument
net/ncsi: check for error return from call to nla_put_u32
fsl/fman: Fix missing put_device() call in fman_port_probe
i2c: validate user data in compat ioctl
nfc: uapi: use kernel size_t to fix user-space builds
uapi: fix linux/nfc.h userspace compilation errors
drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled
drm/amdgpu: add support for IP discovery gc_info table v2
xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
usb: mtu3: add memory barrier before set GPD's HWO
usb: mtu3: fix list_head check warning
usb: mtu3: set interval of FS intr and isoc endpoint
binder: fix async_free_space accounting for empty parcels
scsi: vmw_pvscsi: Set residual data length conditionally
Input: appletouch - initialize work before device registration
Input: spaceball - fix parsing of movement data packets
net: fix use-after-free in tw_timer_handler
perf script: Fix CPU filtering of a script's switch events
bpf: Add kconfig knob for disabling unpriv bpf by default
Linux 5.10.90
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I299d1e939d3b01b5d6f34f7b9ec701d624bbfde3
commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream.
In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space")
fixed a kernel structure visibility issue. As part of that patch,
sizeof(void *) was used as the buffer size for 0-length data payloads so
the driver could detect abusive clients sending 0-length asynchronous
transactions to a server by enforcing limits on async_free_size.
Unfortunately, on the "free" side, the accounting of async_free_space
did not add the sizeof(void *) back. The result was that up to 8-bytes of
async_free_space were leaked on every async transaction of 8-bytes or
less. These small transactions are uncommon, so this accounting issue
has gone undetected for several years.
The fix is to use "buffer_size" (the allocated buffer size) instead of
"size" (the logical buffer size) when updating the async_free_space
during the free operation. These are the same except for this
corner case of asynchronous transactions with payloads < 8 bytes.
Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space")
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable@vger.kernel.org # 4.14+
Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmG4cugACgkQONu9yGCS
aT4+uxAAiLJvOIA6ElsmMq2c3pNu9UDPh58j1FlmhggAxr7baIvR1UuEZURTSLW9
pnu+r9bHkhJGBOpANfPJAQZqv+JtCi3crMhw0mwHJ0Mls3TNSmclzB1+jGM4w93E
cT+5hoDeQqwZwpKYvWI7u9UGEE0BXluVTRCvmuncaJ8wGbxnDgV0AEXe32XDlFxB
kSLAXO1FFn8Z1yMg9BMVURU9IAszdwCIhqbcNWnPunOPowdHDWBJdF7eSZUqmJfq
TMyFgm6c6ENbBrwYt+9qf+1oS/D9r6TEjwaFoRJ4ApWSAD4iKV7U6dA0rxm9mrMl
nSAxNXuSXXYszoYjrxPPRGhCY/URahs1Vmju1WK//4vz3brxk5N88T+2nN7PMYKn
bIHGTl9SadlrHvi/OBqOvbsNMHX+ln/V/y7ct0fsxXeNBHYXdXCtimRDvtsj9kmp
HO9OLXVsF6DUM22ODW28Vxt7HGN3XQzs0y2jwfzdMV81p3oEqP9wWQITwG2LVVAE
WdkvQ/3ugdkR9F15Vp0cjkbJQLN4UbYUJW5K7SZTW013TgsYyIHQrP5qj9xvfwNt
KdILXVMH2JqPXAkRqmFqIeNIUX2oevWwpgV/SwqIj3T5ytmXPluZsaMlGg5xZ401
Xuhp0LPU6rl+wcCt1bInZvn8nrTVDADpao7xTbSyoel5TAunVrk=
=u1Am
-----END PGP SIGNATURE-----
Merge 5.10.85 into android12-5.10-lts
Changes in 5.10.85
usb: gadget: uvc: fix multiple opens
gcc-plugins: simplify GCC plugin-dev capability test
gcc-plugins: fix gcc 11 indigestion with plugins...
HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
HID: google: add eel USB id
HID: add hid_is_usb() function to make it simpler for USB detection
HID: add USB_HID dependancy to hid-prodikeys
HID: add USB_HID dependancy to hid-chicony
HID: add USB_HID dependancy on some USB HID drivers
HID: bigbenff: prevent null pointer dereference
HID: wacom: fix problems when device is not a valid USB device
HID: check for valid USB device for many HID drivers
nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups
IB/hfi1: Insure use of smp_processor_id() is preempt disabled
IB/hfi1: Fix early init panic
IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
can: kvaser_usb: get CAN clock frequency from device
can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter
can: sja1000: fix use after free in ems_pcmcia_add_card()
x86/sme: Explicitly map new EFI memmap table as encrypted
drm/amd/amdkfd: adjust dummy functions' placement
drm/amdkfd: separate kfd_iommu_resume from kfd_resume
drm/amdgpu: add amdgpu_amdkfd_resume_iommu
drm/amdgpu: move iommu_resume before ip init/resume
drm/amdgpu: init iommu after amdkfd device init
drm/amdkfd: fix boot failure when iommu is disabled in Picasso.
nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
selftests: netfilter: add a vrf+conntrack testcase
vrf: don't run conntrack on vrf with !dflt qdisc
bpf, x86: Fix "no previous prototype" warning
bpf: Fix the off-by-two error in range markings
ice: ignore dropped packets during init
bonding: make tx_rebalance_counter an atomic
nfp: Fix memory leak in nfp_cpp_area_cache_add()
seg6: fix the iif in the IPv6 socket control block
udp: using datalen to cap max gso segments
netfilter: conntrack: annotate data-races around ct->timeout
iavf: restore MSI state on reset
iavf: Fix reporting when setting descriptor count
IB/hfi1: Correct guard on eager buffer deallocation
devlink: fix netns refcount leak in devlink_nl_cmd_reload()
net/sched: fq_pie: prevent dismantle issue
KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall
mm: bdi: initialize bdi_min_ratio when bdi is unregistered
ALSA: ctl: Fix copy of updated id with element read/write
ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
ALSA: pcm: oss: Fix negative period/buffer sizes
ALSA: pcm: oss: Limit the period size to 16MB
ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
scsi: qla2xxx: Format log strings only if needed
btrfs: clear extent buffer uptodate when we fail to write it
btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
md: fix update super 1.0 on rdev size change
nfsd: fix use-after-free due to delegation race
nfsd: Fix nsfd startup race (again)
tracefs: Have new files inherit the ownership of their parent
mmc: renesas_sdhi: initialize variable properly when tuning
clk: qcom: regmap-mux: fix parent clock lookup
drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
can: pch_can: pch_can_rx_normal: fix use after free
can: m_can: Disable and ignore ELO interrupt
libata: add horkage for ASMedia 1092
wait: add wake_up_pollfree()
binder: use wake_up_pollfree()
signalfd: use wake_up_pollfree()
aio: keep poll requests on waitqueue until completed
aio: fix use-after-free due to missing POLLFREE handling
net: mvpp2: fix XDP rx queues registering
tracefs: Set all files to the same group ownership as the mount option
block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
scsi: scsi_debug: Fix buffer size of REPORT ZONES command
qede: validate non LSO skb length
PM: runtime: Fix pm_runtime_active() kerneldoc comment
ASoC: rt5682: Fix crash due to out of scope stack vars
ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer
ASoC: codecs: wsa881x: fix return values from kcontrol put
ASoC: codecs: wcd934x: handle channel mappping list correctly
ASoC: codecs: wcd934x: return correct value from mixer put
RDMA/hns: Do not halt commands during reset until later
RDMA/hns: Do not destroy QP resources in the hw resetting phase
clk: imx: use module_platform_driver
i40e: Fix failed opcode appearing if handling messages from VF
i40e: Fix pre-set max number of queues for VF
mtd: rawnand: fsmc: Take instruction delay into account
mtd: rawnand: fsmc: Fix timing computation
i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge"
perf tools: Fix SMT detection fast read path
Documentation/locking/locktypes: Update migrate_disable() bits.
dt-bindings: net: Reintroduce PHY no lane swap binding
tools build: Remove needless libpython-version feature check that breaks test-all fast path
net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
net: altera: set a couple error code in probe()
net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
net, neigh: clear whole pneigh_entry at alloc time
net/qla3xxx: fix an error code in ql_adapter_up()
selftests/fib_tests: Rework fib_rp_filter_test()
USB: gadget: detect too-big endpoint 0 requests
USB: gadget: zero allocate endpoint 0 buffers
usb: core: config: fix validation of wMaxPacketValue entries
xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending
usb: core: config: using bit mask instead of individual bits
xhci: avoid race between disable slot command and host runtime suspend
iio: gyro: adxrs290: fix data signedness
iio: trigger: Fix reference counting
iio: trigger: stm32-timer: fix MODULE_ALIAS
iio: stk3310: Don't return error code in interrupt handler
iio: mma8452: Fix trigger reference couting
iio: ltr501: Don't return error code in trigger handler
iio: kxsd9: Don't return error code in trigger handler
iio: itg3200: Call iio_trigger_notify_done() on error
iio: dln2-adc: Fix lockdep complaint
iio: dln2: Check return value of devm_iio_trigger_register()
iio: at91-sama5d2: Fix incorrect sign extension
iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
iio: adc: axp20x_adc: fix charging current reporting on AXP22x
iio: ad7768-1: Call iio_trigger_notify_done() on error
iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
csky: fix typo of fpu config macro
irqchip/aspeed-scu: Replace update_bits with write_bits.
irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
irqchip: nvic: Fix offset for Interrupt Priority Offsets
misc: fastrpc: fix improper packet size calculation
bpf: Add selftests to cover packet access corner cases
kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc
doc: gcc-plugins: update gcc-plugins.rst
MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal
Documentation/Kbuild: Remove references to gcc-plugin.sh
Linux 5.10.85
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I351da1b00f30a370b021125180a48b1c1ecb97ce
commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream.
wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up
all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll
and aio poll are fortunately not affected by this, but it's very
fragile. Thus, the new function wake_up_pollfree() has been introduced.
Convert binder to use wake_up_pollfree().
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: f5cb779ba1 ("ANDROID: binder: remove waitqueue when thread exits.")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c21a80ca0684ec2910344d72556c816cb8940c01 upstream.
This is a partial revert of commit
29bc22ac5e5b ("binder: use euid from cred instead of using task").
Setting sender_euid using proc->cred caused some Android system test
regressions that need further investigation. It is a partial
reversion because subsequent patches rely on proc->cred.
Fixes: 29bc22ac5e5b ("binder: use euid from cred instead of using task")
Cc: stable@vger.kernel.org # 4.4+
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I9b1769a3510fed250bb21859ef8beebabe034c66
Link: https://lore.kernel.org/r/20211112180720.2858135-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When a task yields, it relinquishes the cpu and
scheduler is tasked to find another task.
However our vendor scheduler logic implementation
could return the same task leading to a loop where
the yielded task gets to run back, so add hook point
in do_sched_yield() for vendor can do some work
before task is scheduled.
Bug: 205804537
Change-Id: I6528c3f4b0ee360559ef9c97cb1eb2b2d1357870
Signed-off-by: Tengfei Fan <quic_tengfan@quicinc.com>
Sync up with android12-5.10 for the following commits:
d30938528e ANDROID: GKI: Update symbol list for VIVO
47458bf124 ANDROID: block: export tracepoints
e41b116463 ANDROID: setlocalversion: make KMI_GENERATION optional
5dac28a174 BACKPORT: uapi: virtio_ids: add a sound device type ID from OASIS spec
2f3f5731de ANDROID: GKI: Add vendor hook to binder transaction
775cd2119d ANDROID: qcom: Add smp_call_function_single_async to ABI
d736cbf8d9 Revert "sched/fair: Keep load_avg and load_sum synced"
de0ba4ea3c Revert "sched/pelt: Ensure that *_sum is always synced with *_avg"
8630facf34 Revert "sched/fair: Ensure _sum and _avg values stay consistent"
7a7b5f89d9 ANDROID: locking/rwsem: only clean RWSEM_FLAG_HANDOFF when already set
a1a4c80265 UPSTREAM: f2fs: change fiemap way in printing compression chunk
cc98cd4a3e ANDROID: GKI: add allowed list file for xiaomi
fa9c907453 ANDROID: GKI: Update symbol list
ea592f07f6 ANDROID: Update symbol list for mtk
a4eacf3227 ANDROID: binder: fix regression in sender_euid
6b7c37f6c4 ANDROID: fips140: use UTS_RELEASE as FIPS version
11db2de0af BACKPORT: binder: use cred instead of task for getsecid
3af7a2f610 BACKPORT: binder: use cred instead of task for selinux checks
d492977395 BACKPORT: binder: use euid from cred instead of using task
7e2fbdaeab ANDROID: vendor_hooks: Add hooks for frequency optimization
054a3c228a ANDROID: GKI: Update symbols to symbol list
0db6925868 ANDROID: vendor_hooks: export get_wchan
a61d61bab7 ANDROID: vendor_hooks: Add hooks to record the time of the process in various states
6cf4b65244 FROMGIT: dma-buf: acquire name lock before read/write dma_buf.name
Due to api additions in android12-5.10, this also adds more api symbols
to track:
Leaf changes summary: 33 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 19 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 14 Added variables
19 Added functions:
[A] 'function int __traceiter_android_vh_cpufreq_fast_switch(void*, cpufreq_policy*, unsigned int, unsigned int)'
[A] 'function int __traceiter_android_vh_cpufreq_resolve_freq(void*, cpufreq_policy*, unsigned int, unsigned int)'
[A] 'function int __traceiter_android_vh_cpufreq_target(void*, cpufreq_policy*, unsigned int, unsigned int)'
[A] 'function int __traceiter_android_vh_sched_stat_runtime_rt(void*, task_struct*, u64)'
[A] 'function int __traceiter_block_bio_complete(void*, request_queue*, bio*)'
[A] 'function int __traceiter_block_bio_queue(void*, request_queue*, bio*)'
[A] 'function int __traceiter_block_getrq(void*, request_queue*, bio*, int)'
[A] 'function int __traceiter_block_rq_complete(void*, request*, int, unsigned int)'
[A] 'function int __traceiter_block_rq_insert(void*, request_queue*, request*)'
[A] 'function int __traceiter_block_rq_issue(void*, request_queue*, request*)'
[A] 'function int __traceiter_block_rq_merge(void*, request_queue*, request*)'
[A] 'function int __traceiter_block_rq_requeue(void*, request_queue*, request*)'
[A] 'function int __traceiter_block_split(void*, request_queue*, bio*, unsigned int)'
[A] 'function int __traceiter_sched_stat_runtime(void*, task_struct*, u64, u64)'
[A] 'function int dev_change_flags(net_device*, unsigned int, netlink_ext_ack*)'
[A] 'function unsigned long int get_wchan(task_struct*)'
[A] 'function void* mempool_alloc_pages(gfp_t, void*)'
[A] 'function void mempool_free_pages(void*, void*)'
[A] 'function int mempool_resize(mempool_t*, int)'
14 Added variables:
[A] 'tracepoint __tracepoint_android_vh_cpufreq_fast_switch'
[A] 'tracepoint __tracepoint_android_vh_cpufreq_resolve_freq'
[A] 'tracepoint __tracepoint_android_vh_cpufreq_target'
[A] 'tracepoint __tracepoint_android_vh_sched_stat_runtime_rt'
[A] 'tracepoint __tracepoint_block_bio_complete'
[A] 'tracepoint __tracepoint_block_bio_queue'
[A] 'tracepoint __tracepoint_block_getrq'
[A] 'tracepoint __tracepoint_block_rq_complete'
[A] 'tracepoint __tracepoint_block_rq_insert'
[A] 'tracepoint __tracepoint_block_rq_issue'
[A] 'tracepoint __tracepoint_block_rq_merge'
[A] 'tracepoint __tracepoint_block_rq_requeue'
[A] 'tracepoint __tracepoint_block_split'
[A] 'tracepoint __tracepoint_sched_stat_runtime'
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I15990841323b2a040b41d8207da3532f3d0db795
commit 4d5b5539742d2554591751b4248b0204d20dcc9d upstream.
Use the 'struct cred' saved at binder_open() to lookup
the security ID via security_cred_getsecid(). This
ensures that the security context that opened binder
is the one used to generate the secctx.
Cc: stable@vger.kernel.org # 5.4+
Fixes: ec74136ded ("binder: create node flag to request sender's security context")
Signed-off-by: Todd Kjos <tkjos@google.com>
Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 52f88693378a58094c538662ba652aff0253c4fe upstream.
Since binder was integrated with selinux, it has passed
'struct task_struct' associated with the binder_proc
to represent the source and target of transactions.
The conversion of task to SID was then done in the hook
implementations. It turns out that there are race conditions
which can result in an incorrect security context being used.
Fix by using the 'struct cred' saved during binder_open and pass
it to the selinux subsystem.
Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables)
Fixes: 79af73079d ("Add security hooks to binder and implement the hooks for SELinux.")
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 29bc22ac5e5bc63275e850f0c8fc549e3d0e306b upstream.
Save the 'struct cred' associated with a binder process
at initial open to avoid potential race conditions
when converting to an euid.
Set a transaction's sender_euid from the 'struct cred'
saved at binder_open() instead of looking up the euid
from the binder proc's 'struct task'. This ensures
the euid is associated with the security context that
of the task that opened binder.
Cc: stable@vger.kernel.org # 4.4+
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Signed-off-by: Todd Kjos <tkjos@google.com>
Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Suggested-by: Jann Horn <jannh@google.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
We want to get binder free space information in the binder
transaction, but this needs to hold the mutex lock. So we add
this restrict hook to do this.
Bug: 205648032
Change-Id: Ie1f377018da686bd62f5ac2d1e5421899741e6d5
Signed-off-by: Liangliang Li <liliangliang@vivo.com>
commit 32e9f56a96d8d0f23cb2aeb2a3cd18d40393e787 upstream.
When freeing txn buffers, binder_transaction_buffer_release()
attempts to detect whether the current context is the target by
comparing current->group_leader to proc->tsk. This is an unreliable
test. Instead explicitly pass an 'is_failure' boolean.
Detecting the sender was being used as a way to tell if the
transaction failed to be sent. When cleaning up after
failing to send a transaction, there is no need to close
the fds associated with a BINDER_TYPE_FDA object. Now
'is_failure' can be used to accurately detect this case.
Fixes: 44d8047f1d ("binder: use standard functions to allocate fds")
Cc: stable <stable@vger.kernel.org>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211015233811.3532235-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
A recent change to use proc->cred instead of proc->tsk as the source
for sender_euid caused a failure in the CredentialsTest#CaptureLayersTest
test. Revert 1 line of the patch to fix the test. The rest of the patch
needs to remain since the subsequent patches rely on it.
Before fixing upstream, we need to investigate more since the code looks
correct so the issue may be a latent userspace bug.
Bug: 205938623
Fixes: d65efd5b73dc ("UPSTREAM: binder: use euid from cred instead of using task")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I16543a50f43f79131234995fb0813de00795bd3d
Use the 'struct cred' saved at binder_open() to lookup
the security ID via security_cred_getsecid(). This
ensures that the security context that opened binder
is the one used to generate the secctx.
Cc: stable@vger.kernel.org # 5.4+
Fixes: ec74136ded ("binder: create node flag to request sender's security context")
Signed-off-by: Todd Kjos <tkjos@google.com>
Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Bug: 200688826
(cherry picked from commit 4d5b5539742d2554591751b4248b0204d20dcc9d)
[ refactored to avoid changing KMI: struct binder_proc ]
Change-Id: Ie023be3190caf20ca3901560455e9f027c9426cd
Since binder was integrated with selinux, it has passed
'struct task_struct' associated with the binder_proc
to represent the source and target of transactions.
The conversion of task to SID was then done in the hook
implementations. It turns out that there are race conditions
which can result in an incorrect security context being used.
Fix by using the 'struct cred' saved during binder_open and pass
it to the selinux subsystem.
Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables)
Fixes: 79af73079d ("Add security hooks to binder and implement the hooks for SELinux.")
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Bug: 200688826
(cherry picked from commit 52f88693378a58094c538662ba652aff0253c4fe)
[ refactored to avoid changing KMI: struct binder_proc ]
Change-Id: I1664c1f0c2142c17e9ca0d6790bb94de79f531e3
Save the 'struct cred' associated with a binder process
at initial open to avoid potential race conditions
when converting to an euid.
Set a transaction's sender_euid from the 'struct cred'
saved at binder_open() instead of looking up the euid
from the binder proc's 'struct task'. This ensures
the euid is associated with the security context that
of the task that opened binder.
Cc: stable@vger.kernel.org # 4.4+
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Signed-off-by: Todd Kjos <tkjos@google.com>
Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Suggested-by: Jann Horn <jannh@google.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Bug: 200688826
(cherry picked from commit 29bc22ac5e5bc63275e850f0c8fc549e3d0e306b)
[ refactored to avoid changing KMI: struct binder_proc ]
Change-Id: Icaf996a7f5543b7d6943dff3cbe89bfc3614044c
These hooks will do the following works:
a) Record the number of times when target_freq being clamped
b) Record the number of times when target_freq is greater than policy->cur
c) Make corresponding optimization strategies in different hooks
Bug: 205906618
Signed-off-by: Liujie Xie <xieliujie@oppo.com>
Change-Id: I8eba66fd0c6d36393ca39045cf228b659834e0ae
Signed-off-by: xieliujie <xieliujie@oppo.com>
These hooks will do the following works:
a) record the time of the process in various states
b) Make corresponding optimization strategies in different hooks
Bug: 205938967
Signed-off-by: Liujie Xie <xieliujie@oppo.com>
Change-Id: Ia3c47bbf0aadd17337ce18fd910343b1b8c3ef93
Add hooks to gather data of unusual aborts and summarize it with
other information.
Bug: 203187389
Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I37b3047e72f64dc210d3d3bffe5ee207daeba8d6
dpcm_end_walk_at_be() stops the graph walk when first BE is found for
the given FE component. In a component model we may want to connect
multiple DAIs from different components.
android_vh_snd_soc_card_get_comp_chain can be registered here
to allows DAI/component chaining.
Later PCM operations can be called for all these listed components for a
valid DAPM path.
ALSA machine driver can setup component_chaining like below code slice.
static void my_board_component_chaining_hook(void *data, bool *ret)
{
*ret = true;
}
static int my_board_dev_probe(struct platform_device *pdev)
{
register_trace_android_vh_snd_soc_card_get_comp_chain(
my_board_component_chaining_hook, NULL);
return 0;
}
static int my_board_dev_remove(struct platform_device *pdev)
{
unregister_trace_android_vh_snd_soc_card_get_comp_chain(
my_board_component_chaining_hook, NULL);
return 0;
}
static struct platform_driver my_board_driver = {
...
.probe = my_board_dev_probe,
.remove = my_board_dev_remove,
...
};
Bug: 198732156
Signed-off-by: Bicycle Tsai <bicycle.tsai@mediatek.com>
Change-Id: Ife5df291d40af9ec83d57462b6a08aba95d9119d
This reverts commit 1aa1f6a7cf.
The hook android_vh_mpam_set is not used by any vendor, so remove
it to help with merge issues with future LTS releases.
If this is needed by any real user, it can easily be reverted to add it
back and then the symbol should be added to the abi list at the same
time to prevent it from being removed again later.
Bug: 203756332
Bug: 165333282
Cc: C-J.Chen <C-J.Chen@mediatek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I18356743538df7d41a00f54479bf2a0bc3a62e06
Add struct (iova_domain *) in iova alloc & free vendor hook by create a new vendor hook.
Thus we can know the iova we are operating belongs to which iova domain.
Bug: 201255968
Change-Id: I7df419650af2e85a3b2b8c3d6995247694bdc953
Signed-off-by: Chao Hao <chao.hao@mediatek.com>
Signed-off-by: Guangming Cao <Guangming.Cao@mediatek.com>
Currently the core UFS driver does not have a vops to notify when the
device is operational. This commit introduces a hook, which serves to
notify device completing initialization and is ready to accept I/O.
This is required by the FIPS140-2 [1] self integrity test of inline
encryption engine, which must run whenever the host controller is reset.
The code requires sleeping while waiting for I/O to complete and allocating
some memory dynamically, which requires the vendor hook to be restricted.
[1] https://csrc.nist.gov/publications/detail/fips/140/2/final
Bug: 185809932
Signed-off-by: Konstantin Vyshetsky <vkon@google.com>
Change-Id: I6f476f9c2e2b50574d2898c3f1ef6b648d92df24
commit 5fdb55c1ac9585eb23bb2541d5819224429e103d upstream.
During BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object
cleanup may close 1 or more fds. The close operations are
completed using the task work mechanism -- which means the thread
needs to return to userspace or the file object may never be
dereferenced -- which can lead to hung processes.
Force the binder thread back to userspace if an fd is closed during
BC_FREE_BUFFER handling.
Fixes: 80cd795630 ("binder: fix use-after-free due to ksys_close() during fdget()")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20210830195146.587206-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
During BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object
cleanup may close 1 or more fds. The close operations are
completed using the task work mechanism -- which means the thread
needs to return to userspace or the file object may never be
dereferenced -- which can lead to hung processes.
Force the binder thread back to userspace if an fd is closed during
BC_FREE_BUFFER handling.
Fixes: 80cd795630 ("binder: fix use-after-free due to ksys_close() during fdget()")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20210830195146.587206-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 111997867
(cherry picked from commit 5fdb55c1ac9585eb23bb2541d5819224429e103d
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
Change-Id: Idffa9b54edfc289d95b24f7ae2aa11ae494c7158
Currently cgroup freezer is used to freeze the application threads, and
BINDER_FREEZE is used to freeze the corresponding binder interface.
There's already a mechanism in ioctl(BINDER_FREEZE) to wait for any
existing transactions to drain out before actually freezing the binder
interface.
But freezing an app requires 2 steps, freezing the binder interface with
ioctl(BINDER_FREEZE) and then freezing the application main threads with
cgroupfs. This is not an atomic operation. The following race issue
might happen.
1) Binder interface is frozen by ioctl(BINDER_FREEZE);
2) Main thread A initiates a new sync binder transaction to process B;
3) Main thread A is frozen by "echo 1 > cgroup.freeze";
4) The response from process B reaches the frozen thread, which will
unexpectedly fail.
This patch provides a mechanism to check if there's any new pending
transaction happening between ioctl(BINDER_FREEZE) and freezing the
main thread. If there's any, the main thread freezing operation can
be rolled back to finish the pending transaction.
Furthermore, the response might reach the binder driver before the
rollback actually happens. That will still cause failed transaction.
As the other process doesn't wait for another response of the response,
the response transaction failure can be fixed by treating the response
transaction like an oneway/async one, allowing it to reach the frozen
thread. And it will be consumed when the thread gets unfrozen later.
NOTE: This patch reuses the existing definition of struct
binder_frozen_status_info but expands the bit assignments of __u32
member sync_recv.
To ensure backward compatibility, bit 0 of sync_recv still indicates
there's an outstanding sync binder transaction. This patch adds new
information to bit 1 of sync_recv, indicating the binder transaction
happens exactly when there's a race.
If an existing userspace app runs on a new kernel, a sync binder call
will set bit 0 of sync_recv so ioctl(BINDER_GET_FROZEN_INFO) still
return the expected value (true). The app just doesn't check bit 1
intentionally so it doesn't have the ability to tell if there's a race.
This behavior is aligned with what happens on an old kernel which
doesn't set bit 1 at all.
A new userspace app can 1) check bit 0 to know if there's a sync binder
transaction happened when being frozen - same as before; and 2) check
bit 1 to know if that sync binder transaction happened exactly when
there's a race - a new information for rollback decision.
Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Li Li <dualli@google.com>
Test: stress test with apps being frozen and initiating binder calls at
the same time, confirmed the pending transactions succeeded.
Link: https://lore.kernel.org/r/20210910164210.2282716-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 198493121
(cherry picked from commit b564171ade70570b7f335fa8ed17adb28409e3ac
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-linus)
Change-Id: I488ba75056f18bb3094ba5007027b76b5caebec9
Add hook in try_to_unmap_one() to trace this function for debug memory
swap bugs.
Bug: 198385827
Change-Id: I1fdbe60e09bb491b949e06a07133710453ecca03
Signed-off-by: Jiewen Wang <jiewen.wang@vivo.com>
Add hook in mmap_region() to record the vma and address information
of monitored processes.
Bug: 198385827
Change-Id: I0bde29113b47ca7f4a9f5d42a54188e791ca3b7e
Signed-off-by: Jiewen Wang <jiewen.wang@vivo.com>
This patch implements a vendor hook that changes d3hot_delay to use
usleep_range() instead of msleep() to reduce the resume time from 20ms to 10ms.
The call sequence is as follows:
pci_pm_resume_noirq()
pci_pm_default_resume_early()
pci_power_up()
pci_raw_set_power_state() --> msleep(10)
The default d3hot_delay is 10ms. Using msleep for delays less than 20ms could
result in delays up to 20ms.
Reference: Documentation/timers/timers-howto.rst
Using usleep_range() results in the delay being closer to 10ms and this reduces
the resume time.
Bug: 194231641
Change-Id: If3e4dcfb99edad302371273933fa6784854cf892
Signed-off-by: Sajid Dalvi <sdalvi@google.com>
Some hardware has a way to restore all keyslots at once that is
significantly faster than restoring each keyslot individually, as is
done by blk_ksm_reprogram_all_keys(). Add a hook
"android_rvh_ufs_reprogram_all_keys" that allows overriding the
restoration of all keyslots after UFS reset. This may sleep, so this
must be a "restricted" Android vendor hook rather than a regular one.
Note that currently this functionality can't be upstreamed, as support
for the hardware that needs it would need to be upstreamed first.
Bug: 162257402
Bug: 181905172
Change-Id: I0b25393a5131941f085892560e08a64e63cd1369
Signed-off-by: Eric Biggers <ebiggers@google.com>
Add hook to tcp/udp to collect network info and do performance tuning.
Bug: 190523684
Change-Id: Id790a381d5ce6c35a747697510f14678ccf3ff2f
Signed-off-by: Liangliang Li <liliangliang@vivo.com>
Need restricted hook so that it can sleep.
The old non-restricted versions need to stay in place as a consequence
of KMI freeze.
Bug: 194431527
Change-Id: I7093b66f95c3b9c473386ade60d8897426ddbb13
Signed-off-by: Shaleen Agrawal <shalagra@codeaurora.org>
The vendor hook functions we implemented will invoke callback functions which have do some sleep or spinlock
operations and have risk of deadlock due to preemption disabled of normal vendor hook function.
So we have to use restricted vendor hook function instead.
Due to KMI freeze we could not change the existing hooks.
trace_android_rvh_media_device_setup_link =>invoke setup_link, link_notify callback
trace_android_rvh_v4l2subdev_set_xxx =>invoke set_xxx callback
Bug: 193870284
Signed-off-by: Louis Kuo <louis.kuo@mediatek.com>
Change-Id: I94fe2e112b6c3d9ac5177abb30a99b7007068f7e
security_secid_to_secctx() can fail because of a GFP_ATOMIC allocation
This needs to be retried from userspace. However, binder driver doesn't
propagate specific enough error codes just yet (WIP b/28321379). We'll
retry on the binder driver as a temporary work around until userspace
can do this instead.
Bug: 174806915
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: Ifebddeb7adf9707613512952b97ab702f0d2d592
Vendor hook is add in the commit:
https://android-review.googlesource.com/c/kernel/common/+/1687592
When we register the vendor hook and build, there is build error:
too long symbol "__tracepoint_android_vh_binder_transaction_priority_skip"
So, I shorten the function name
android_vh_binder_transaction_priority_skip -->
android_vh_binder_priority_skip
Bug: 186482511
Signed-off-by: xieliujie <xieliujie@oppo.com>
Change-Id: I27f39dd32436b09257bcf6e746f4ccdfbd6d6cfe
Some vendors want to add a field when a 'sruct sock' is added so give a
hook to handle this. Any memory allocated when
trace_android_rvh_sk_alloc() is called needs to be freed when
trace_android_rvh_sk_free() is called.
Note, if trace_android_rvh_sk_alloc() fails, be sure to be able to
handle this in trace_android_rvh_sk_free(), but that should not be an
issue as that needs to be addressed in vendor code that runs for 'struct
sock' objects that have been created before the vendor code is loaded no
matter what.
Bug: 171013716
Signed-off-by: Vignesh Saravanaperumal <vignesh1.s@samsung.com>
Change-Id: I108a2f31d2dcc228f46159816deee6235afafbbd
Some vendors want to add a field when a 'sruct nf_conn' is added so give a
hook to handle this. Any memory allocated when
trace_android_rvh_nf_conn_alloc() is called needs to be freed when
trace_android_rvh_nf_conn_free() is called.
Note, if trace_android_rvh_nf_conn_alloc() fails, be sure to be able to
handle this in trace_android_rvh_nf_conn_free(), but that should not be
an issue as that needs to be addressed in vendor code that runs for
'struct nf_conn' objects that have been created before the vendor code
is loaded no matter what.
Bug: 171013716
Signed-off-by: Vignesh Saravanaperumal <vignesh1.s@samsung.com>
Change-Id: I4d2b025196a3df7ba4adec313c90483811cac728
in our vendor driver, we need the following three kernel variables:
include/linuc/mm.h:
extern unsigned long stack_guard_gap;
extern int sysctl_legacy_va_layout;
include/linux/security.h:
extern unsigned long mmap_min_addr;
Bug: 191439466
Signed-off-by: xieliujie <xieliujie@oppo.com>
Change-Id: I9d1759d8157ddd214475742e417dfb9e870d4b2e
Add a hook to query from vendor's compress driver if it is support pause
in draining and if the platform need to keep in draining state.
Bug: 184020292
Bug: 178992384
Change-Id: Id2e2ff72d7ee66fc633473ec109ed3d8a2baaeff
Signed-off-by: Robert Lee <lerobert@google.com>
This vendor hook let us initialize payload of the request.
Bug: 188749221
Change-Id: I51d6a3010ac0ab36066dbe1368158592832112b7
Signed-off-by: Yang Yang <yang.yang@vivo.com>
This vendor hook let us attach oem data as payload to the request.
The payload is used by oem driver for debugging purpose.
Bug: 188749221
Change-Id: Iac598bd9cce836dac0efe9198a3e7752928f351a
Signed-off-by: Yang Yang <yang.yang@vivo.com>
Add vendor hook android_vh_sound_check_support_cpu_suspend
to allow ACPU to suspend during USB playback/capture,
if this is supported.
Bug: 192206510
Change-Id: Ia8d4c335db27de5fcefab13cab653fd1ae34f691
Signed-off-by: JJ Lee <leejj@google.com>
This patch provides an ipv6 vendor hook which can be used to
disable kernel auto generate the ipv6 link-local address.
The reasons why the kernel does not need to automatically
generate the ipv6 link-local address are as follows:
(1) In the 3GPP TS 29.061, here is a description as follows:
"in order to avoid any conflict between the link-local address
of the MS and that of the GGSN, the Interface-Identifier used
by the MS to build its link-local address shall be assigned by
the GGSN. The GGSN ensures the uniqueness of this Interface-
Identifier. The MT shall then enforce the use of this
Interface-Identifier by the TE"
In other words, in the cellular network, GGSN determines whether
to reply a solicited RA message by identifying the low 64 bits
of the source address of the received RS message. Therefore,
cellular network device's ipv6 link-local address should be set
as the format of fe80::(GGSN assigned IID).
For example: When using a new kernel and ARPHRD_RAWIP, kernel
will generate an EUI64 format ipv6 link-local address, and the
Linux kernel will uses this link-local address to send RS message.
The result is that the GGSN will not reply to the RS message with
a solicited RA message.
For mobile operators that don't need to support RFC7217, setting
addr_gen_mode == 1 is sufficient, it can avoid the above issue,
but when the addr_gen_mode is changed to the
IN6_ADDR_GEN_MODE_STABLE_PRIVACY, the above problem still exist.
The detail as follows:
(2) For some other mobile operators that need to support RFC7217,
the mobile device's addr_gen_mode will be switched to the
IN6_ADDR_GEN_MODE_STABLE_PRIVACY, instead of using
IN6_ADDR_GEN_MODE_NONE.
The purpose is: in the IN6_ADDR_GEN_MODE_STABLE_PRIVACY mode,
kernel can gererate a stable privacy global ipv6 address after
receiveing RA, and network processes can use this global address
to communicate with the outside network.
Of course, mobile operators that need to support RFC7217 should
also meet the requirement of 3GPP TS 29.061, that is, MT should
use IID assigned by the GGSN to build its ipv6 link-local address
and use this address to send RS. We don't want the kernel to
automatically generate an ipv6 link-local address when
addr_gen_mode == 2. Otherwise, using the stable privacy ipv6
link-local address automatically generated by the kernel to send
RS message, GGSN will not be able to respond to the RS and reply
a RA message.
Therefore, after this patch, the kernel can determine whether to
disable the automatic ipv6 link-local address generation by judging
the net device name.
Bug: 190685002
Change-Id: I93420cacd96789769edc7214fb8a2dd1455ce374
Signed-off-by: Rocco Yue <rocco.yue@mediatek.com>
Add the hook that vendor can design and bypass the suspend/resume.
When the bypass is set, skip the orignal suspend/resume methods.
In mobile, a co-processor can be used with USB audio, and ACPU may
be able to sleep in such condition to improve power consumption.
We will need vendor hook to support this.
Bug: 192774581
Signed-off-by: Puma Hsu <pumahsu@google.com>
Change-Id: Ic62a8a1e662bbe3fb0aa17af7491daace0b9f18a
Through this vendor hook, we can get the timing to check
current running task for the validation of its credential
and bpf operations.
Bug: 191291287
Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com>
Change-Id: Ie4ed8df7ad66df2486fc7e52a26d9191fc0c176e
Greg Kroah-Hartman