Merge android-4.4.185 (14e1196) into msm-4.4

* refs/heads/tmp-14e1196
  ANDROID: Communicates LMK events to userland where they can be logged
  Linux 4.4.185
  dmaengine: imx-sdma: remove BD_INTR for channel0
  KVM: x86: degrade WARN to pr_warn_ratelimited
  arm64, vdso: Define vdso_{start,end} as array
  ARC: handle gcc generated __builtin_trap for older compiler
  tty: rocket: fix incorrect forward declaration of 'rp_init()'
  btrfs: Ensure replaced device doesn't have pending chunk allocation
  lib/mpi: Fix karactx leak in mpi_powm
  ALSA: usb-audio: fix sign unintended sign extension on left shifts
  ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
  ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
  crypto: user - prevent operating on larval algorithms
  ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
  MIPS: Workaround GCC __builtin_unreachable reordering bug
  bug.h: work around GCC PR82365 in BUG()
  swiotlb: Make linux/swiotlb.h standalone includible
  mfd: omap-usb-tll: Fix register offsets
  MIPS: math-emu: do not use bools for arithmetic
  ARC: fix build warning in elf.h
  ARC: Assume multiplier is always present
  scsi: hpsa: correct ioaccel2 chaining
  usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
  usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
  ASoC: max98090: remove 24-bit format support if RJ is 0
  spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
  ASoC : cs4265 : readable register too low
  um: Compile with modern headers
  Bluetooth: Fix faulty expression for minimum encryption key size check
  net: check before dereferencing netdev_ops during busy poll
  bonding: Always enable vlan tx offload
  ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
  team: Always enable vlan tx offload
  tipc: check msg->req data len in tipc_nl_compat_bearer_disable
  tipc: change to use register_pernet_device
  sctp: change to hold sk after auth shkey is created successfully
  cpu/speculation: Warn on unsupported mitigations= parameter
  x86/speculation: Allow guests to use SSBD even if host does not
  ovl: modify ovl_permission() to do checks on two inodes
  KVM: X86: Fix scan ioapic use-before-initialization
  net/9p: include trans_common.h to fix missing prototype warning.
  9p: p9dirent_read: check network-provided name length
  9p/rdma: remove useless check in cm_event_handler
  9p: acl: fix uninitialized iattr access
  9p/rdma: do not disconnect on down_interruptible EAGAIN
  perf help: Remove needless use of strncpy()
  perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul
  mac80211: drop robust management frames from unknown TA
  cfg80211: fix memory leak of wiphy device name
  SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write
  Bluetooth: Fix regression with minimum encryption key size alignment
  Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
  ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
  can: purge socket error queue on sock destruct
  can: flexcan: fix timeout when set small bitrate
  btrfs: start readahead also in seed devices
  Btrfs: fix race between readahead and device replace/removal
  hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
  s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
  scsi: ufs: Check that space was properly alloced in copy_query_response
  scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
  sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD
  net: hns: Fix loopback test failed at copper ports
  MIPS: uprobes: remove set but not used variable 'epc'
  IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
  parisc: Fix compiler warnings in float emulation code
  parport: Fix mem leak in parport_register_dev_model
  apparmor: enforce nullbyte at end of tag string
  Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
  usb: chipidea: udc: workaround for endpoint conflict issue
  gcc-9: silence 'address-of-packed-member' warning
  tracing: Silence GCC 9 array bounds warning
  scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
  mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
  fs/binfmt_flat.c: make load_flat_shared_library() work
  ANDROID: Fixes to locking around handle_lmk_event
  ANDROID: Avoid taking multiple locks in handle_lmk_event

Side effects from the commit "ANDROID: Communicates LMK events to userland
where they can be logged" is addressed here, so picking this commit which
ignored from 4.4.180 merge.

Conflicts:
	drivers/staging/android/lowmemorykiller.c

Change-Id: I1156dc21d0f35e74e86d2ad202f99b7bc173b874
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

8 files changed, 55 insertions, 29 deletions

diff --git a/fs/9p/acl.c b/fs/9p/acl.c
index c30c6ceac2c4..d02ee4026e32 100644
--- a/fs/9p/acl.c
+++ b/fs/9p/acl.c
@@ -282,7 +282,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler,
 	switch (handler->flags) {
 	case ACL_TYPE_ACCESS:
 		if (acl) {
-			struct iattr iattr;
+			struct iattr iattr = { 0 };
 			struct posix_acl *old_acl = acl;
 
 			retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl);
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index f723cd3a455c..cc7bf84ef77c 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -808,9 +808,14 @@ err:
 
 static int load_flat_shared_library(int id, struct lib_info *libs)
 {
+	/*
+	 * This is a fake bprm struct; only the members "buf", "file" and
+	 * "filename" are actually used.
+	 */
 	struct linux_binprm bprm;
 	int res;
 	char buf[16];
+	loff_t pos = 0;
 
 	memset(&bprm, 0, sizeof(bprm));
 
@@ -824,25 +829,10 @@ static int load_flat_shared_library(int id, struct lib_info *libs)
 	if (IS_ERR(bprm.file))
 		return res;
 
-	bprm.cred = prepare_exec_creds();
-	res = -ENOMEM;
-	if (!bprm.cred)
-		goto out;
-
-	/* We don't really care about recalculating credentials at this point
-	 * as we're past the point of no return and are dealing with shared
-	 * libraries.
-	 */
-	bprm.cred_prepared = 1;
-
-	res = prepare_binprm(&bprm);
-
-	if (!IS_ERR_VALUE(res))
+	res = kernel_read(bprm.file, pos, bprm.buf, BINPRM_BUF_SIZE);
+	if (res >= 0)
 		res = load_flat_file(&bprm, libs, id, NULL);
 
-	abort_creds(bprm.cred);
-
-out:
 	allow_write_access(bprm.file);
 	fput(bprm.file);
 
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 81e5bc62e8e3..1414a99b3ab4 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -495,18 +495,27 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
 	}
 	btrfs_wait_ordered_roots(root->fs_info, -1);
 
-	trans = btrfs_start_transaction(root, 0);
-	if (IS_ERR(trans)) {
-		mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
-		return PTR_ERR(trans);
+	while (1) {
+		trans = btrfs_start_transaction(root, 0);
+		if (IS_ERR(trans)) {
+			mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
+			return PTR_ERR(trans);
+		}
+		ret = btrfs_commit_transaction(trans, root);
+		WARN_ON(ret);
+		mutex_lock(&uuid_mutex);
+		/* keep away write_all_supers() during the finishing procedure */
+		mutex_lock(&root->fs_info->fs_devices->device_list_mutex);
+		mutex_lock(&root->fs_info->chunk_mutex);
+		if (src_device->has_pending_chunks) {
+			mutex_unlock(&root->fs_info->chunk_mutex);
+			mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
+			mutex_unlock(&uuid_mutex);
+		} else {
+			break;
+		}
 	}
-	ret = btrfs_commit_transaction(trans, root);
-	WARN_ON(ret);
 
-	mutex_lock(&uuid_mutex);
-	/* keep away write_all_supers() during the finishing procedure */
-	mutex_lock(&root->fs_info->fs_devices->device_list_mutex);
-	mutex_lock(&root->fs_info->chunk_mutex);
 	btrfs_dev_replace_lock(dev_replace);
 	dev_replace->replace_state =
 		scrub_ret ? BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index 619f92963e27..f2af1f3d4aa8 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -762,16 +762,23 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info)
 	u64 total = 0;
 	int i;
 
+again:
 	do {
 		enqueued = 0;
+		mutex_lock(&fs_devices->device_list_mutex);
 		list_for_each_entry(device, &fs_devices->devices, dev_list) {
 			if (atomic_read(&device->reada_in_flight) <
 			    MAX_IN_FLIGHT)
 				enqueued += reada_start_machine_dev(fs_info,
 								    device);
 		}
+		mutex_unlock(&fs_devices->device_list_mutex);
 		total += enqueued;
 	} while (enqueued && total < 10000);
+	if (fs_devices->seed) {
+		fs_devices = fs_devices->seed;
+		goto again;
+	}
 
 	if (enqueued == 0)
 		return;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d1cca19b29d3..4eb7a6ba7e47 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4760,6 +4760,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
 	for (i = 0; i < map->num_stripes; i++) {
 		num_bytes = map->stripes[i].dev->bytes_used + stripe_size;
 		btrfs_device_set_bytes_used(map->stripes[i].dev, num_bytes);
+		map->stripes[i].dev->has_pending_chunks = true;
 	}
 
 	spin_lock(&extent_root->fs_info->free_chunk_lock);
@@ -7064,6 +7065,7 @@ void btrfs_update_commit_device_bytes_used(struct btrfs_root *root,
 		for (i = 0; i < map->num_stripes; i++) {
 			dev = map->stripes[i].dev;
 			dev->commit_bytes_used = dev->bytes_used;
+			dev->has_pending_chunks = false;
 		}
 	}
 	unlock_chunks(root);
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 3c651df420be..7feac2d9da56 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -62,6 +62,11 @@ struct btrfs_device {
 
 	spinlock_t io_lock ____cacheline_aligned;
 	int running_pending;
+	/* When true means this device has pending chunk alloc in
+	 * current transaction. Protected by chunk_mutex.
+	 */
+	bool has_pending_chunks;
+
 	/* regular prio bios */
 	struct btrfs_pending_bios pending_bios;
 	/* WRITE_SYNC bios */
diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
index 7e93d5706bf6..4d0d4076de5a 100644
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -455,7 +455,7 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
 	{STATUS_FILE_INVALID, -EIO, "STATUS_FILE_INVALID"},
 	{STATUS_ALLOTTED_SPACE_EXCEEDED, -EIO,
 	"STATUS_ALLOTTED_SPACE_EXCEEDED"},
-	{STATUS_INSUFFICIENT_RESOURCES, -EREMOTEIO,
+	{STATUS_INSUFFICIENT_RESOURCES, -EAGAIN,
 				"STATUS_INSUFFICIENT_RESOURCES"},
 	{STATUS_DFS_EXIT_PATH_FOUND, -EIO, "STATUS_DFS_EXIT_PATH_FOUND"},
 	{STATUS_DEVICE_DATA_ERROR, -EIO, "STATUS_DEVICE_DATA_ERROR"},
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 985a4cdae06d..9aff8178aa8c 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -9,6 +9,7 @@
 
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/cred.h>
 #include <linux/xattr.h>
 #include "overlayfs.h"
 
@@ -91,6 +92,7 @@ int ovl_permission(struct inode *inode, int mask)
 	struct ovl_entry *oe;
 	struct dentry *alias = NULL;
 	struct inode *realinode;
+	const struct cred *old_cred;
 	struct dentry *realdentry;
 	bool is_upper;
 	int err;
@@ -143,7 +145,18 @@ int ovl_permission(struct inode *inode, int mask)
 			goto out_dput;
 	}
 
+	/*
+	 * Check overlay inode with the creds of task and underlying inode
+	 * with creds of mounter
+	 */
+	err = generic_permission(inode, mask);
+	if (err)
+		goto out_dput;
+
+	old_cred = ovl_override_creds(inode->i_sb);
 	err = __inode_permission(realinode, mask);
+	revert_creds(old_cred);
+
 out_dput:
 	dput(alias);
 	return err;