Merge keystone/android12-5.10-keystone-qcom-release.66+ (a2fed74) into msm-5.10

* refs/heads/tmp-a2fed74:
  FROMGIT: iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
  UPSTREAM: sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
  UPSTREAM: sctp: validate chunk size in __rcv_asconf_lookup
  UPSTREAM: bpf: Fix integer overflow in prealloc_elems_and_freelist()
  ANDROID: GKI: Update symbol list
  ANDROID: ABI: update allowed list for galaxy

Change-Id: If09a540f15ce1afee4f09da61778d8488a370b4b
Signed-off-by: Sivasri Kumar, Vanka <quic_svanka@quicinc.com>

android/ACK_SHA

@@ -1 +1 @@
-a7ab784f601a93a78c1c22cd0aacc2af64d8e3c8
+28d62c68d1de2858489eab21cc41973ad8aa295f

android/abi_gki_aarch64.xml

@@ -425,6 +425,7 @@
       <elf-symbol name='__traceiter_android_vh_ftrace_oops_enter' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1f2a1cc1'/>
       <elf-symbol name='__traceiter_android_vh_ftrace_oops_exit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x351f4988'/>
       <elf-symbol name='__traceiter_android_vh_ftrace_size_check' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd210b7ec'/>
+      <elf-symbol name='__traceiter_android_vh_futex_sleep_start' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x60eb49e2'/>
       <elf-symbol name='__traceiter_android_vh_get_from_fragment_pool' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x59ab5c34'/>
       <elf-symbol name='__traceiter_android_vh_gic_resume' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd99a1ac6'/>
       <elf-symbol name='__traceiter_android_vh_gpio_block_read' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfbb0ca4d'/>
@@ -5320,9 +5321,11 @@
       <elf-symbol name='usb_unregister_notify' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x811dc334'/>
       <elf-symbol name='usb_wakeup_enabled_descendants' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8576ad'/>
       <elf-symbol name='usb_wakeup_notification' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x84edb62f'/>
+      <elf-symbol name='usbnet_cdc_unbind' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd8edf3d6'/>
       <elf-symbol name='usbnet_change_mtu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x29b080fc'/>
       <elf-symbol name='usbnet_defer_kevent' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x983cd249'/>
       <elf-symbol name='usbnet_disconnect' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xff76f05'/>
+      <elf-symbol name='usbnet_generic_cdc_bind' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5b3d46dd'/>
       <elf-symbol name='usbnet_get_drvinfo' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc9eac17c'/>
       <elf-symbol name='usbnet_get_endpoints' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf4f15b5b'/>
       <elf-symbol name='usbnet_get_link' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd7a67954'/>
@@ -5882,6 +5885,7 @@
       <elf-symbol name='__tracepoint_android_vh_ftrace_oops_enter' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa485475e'/>
       <elf-symbol name='__tracepoint_android_vh_ftrace_oops_exit' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xecd968c8'/>
       <elf-symbol name='__tracepoint_android_vh_ftrace_size_check' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcbc20ca'/>
+      <elf-symbol name='__tracepoint_android_vh_futex_sleep_start' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc26ab705'/>
       <elf-symbol name='__tracepoint_android_vh_get_from_fragment_pool' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x801cc5b5'/>
       <elf-symbol name='__tracepoint_android_vh_gic_resume' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x80464cd'/>
       <elf-symbol name='__tracepoint_android_vh_gpio_block_read' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4842b6e5'/>
@@ -16980,8 +16984,8 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='1c800c47'>
-        <parameter type-id='12884b9a' name='dev'/>
-        <parameter type-id='8bf48c31' name='intf'/>
+        <parameter type-id='12884b9a'/>
+        <parameter type-id='8bf48c31'/>
         <return type-id='48b5725f'/>
       </function-type>
       <class-decl name='iw_statistics' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/uapi/linux/wireless.h' line='881' column='1' id='1c8cc2fd'>
@@ -37790,8 +37794,8 @@
       <pointer-type-def type-id='66f5cf2a' size-in-bits='64' id='53d4e65c'/>
       <pointer-type-def type-id='3bf19710' size-in-bits='64' id='53e3a7d6'/>
       <function-type size-in-bits='64' id='53e8ab6e'>
-        <parameter type-id='12884b9a'/>
-        <parameter type-id='8bf48c31'/>
+        <parameter type-id='12884b9a' name='dev'/>
+        <parameter type-id='8bf48c31' name='intf'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <qualified-type-def type-id='e3913a59' const='yes' id='53ecac3a'/>
@@ -115678,6 +115682,11 @@
         <parameter type-id='d8e6b335' name='ftrace_check' filepath='include/trace/hooks/ftrace_dump.h' line='24' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_futex_sleep_start' mangled-name='__traceiter_android_vh_futex_sleep_start' filepath='include/trace/hooks/futex.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_futex_sleep_start'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/futex.h' line='21' column='1'/>
+        <parameter type-id='f23e2572' name='p' filepath='include/trace/hooks/futex.h' line='21' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_get_from_fragment_pool' mangled-name='__traceiter_android_vh_get_from_fragment_pool' filepath='include/trace/hooks/mm.h' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_get_from_fragment_pool'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/mm.h' line='57' column='1'/>
         <parameter type-id='df4b7819' name='mm' filepath='include/trace/hooks/mm.h' line='57' column='1'/>
@@ -116911,6 +116920,7 @@
       <var-decl name='__tracepoint_android_vh_ftrace_oops_enter' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ftrace_oops_enter' visibility='default' filepath='include/trace/hooks/ftrace_dump.h' line='16' column='1' elf-symbol-id='__tracepoint_android_vh_ftrace_oops_enter'/>
       <var-decl name='__tracepoint_android_vh_ftrace_oops_exit' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ftrace_oops_exit' visibility='default' filepath='include/trace/hooks/ftrace_dump.h' line='20' column='1' elf-symbol-id='__tracepoint_android_vh_ftrace_oops_exit'/>
       <var-decl name='__tracepoint_android_vh_ftrace_size_check' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ftrace_size_check' visibility='default' filepath='include/trace/hooks/ftrace_dump.h' line='24' column='1' elf-symbol-id='__tracepoint_android_vh_ftrace_size_check'/>
+      <var-decl name='__tracepoint_android_vh_futex_sleep_start' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_futex_sleep_start' visibility='default' filepath='include/trace/hooks/futex.h' line='21' column='1' elf-symbol-id='__tracepoint_android_vh_futex_sleep_start'/>
       <var-decl name='__tracepoint_android_vh_get_from_fragment_pool' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_get_from_fragment_pool' visibility='default' filepath='include/trace/hooks/mm.h' line='57' column='1' elf-symbol-id='__tracepoint_android_vh_get_from_fragment_pool'/>
       <var-decl name='__tracepoint_android_vh_gic_resume' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_gic_resume' visibility='default' filepath='include/trace/hooks/gic.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_gic_resume'/>
       <var-decl name='__tracepoint_android_vh_gpio_block_read' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_gpio_block_read' visibility='default' filepath='include/trace/hooks/gpiolib.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_gpio_block_read'/>
@@ -141543,6 +141553,11 @@
         <parameter type-id='f0981eeb' name='portnum' filepath='drivers/usb/core/hub.c' line='696' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usbnet_cdc_unbind' mangled-name='usbnet_cdc_unbind' filepath='drivers/net/usb/cdc_ether.c' line='345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_cdc_unbind'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/cdc_ether.c' line='345' column='1'/>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/cdc_ether.c' line='345' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='usbnet_change_mtu' mangled-name='usbnet_change_mtu' filepath='drivers/net/usb/usbnet.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_change_mtu'>
         <parameter type-id='68a2d05b' name='net' filepath='drivers/net/usb/usbnet.c' line='375' column='1'/>
         <parameter type-id='95e97e5e' name='new_mtu' filepath='drivers/net/usb/usbnet.c' line='375' column='1'/>
@@ -141557,6 +141572,11 @@
         <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/usbnet.c' line='1567' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usbnet_generic_cdc_bind' mangled-name='usbnet_generic_cdc_bind' filepath='drivers/net/usb/cdc_ether.c' line='100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_generic_cdc_bind'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/cdc_ether.c' line='100' column='1'/>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/cdc_ether.c' line='100' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='usbnet_get_drvinfo' mangled-name='usbnet_get_drvinfo' filepath='drivers/net/usb/usbnet.c' line='1020' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_get_drvinfo'>
         <parameter type-id='68a2d05b' name='net' filepath='drivers/net/usb/usbnet.c' line='1020' column='1'/>
         <parameter type-id='8c4c4029' name='info' filepath='drivers/net/usb/usbnet.c' line='1020' column='1'/>

android/abi_gki_aarch64_galaxy

@@ -4317,9 +4317,11 @@
   usb_unpoison_urb
   usb_unregister_notify
   usb_wakeup_notification
+  usbnet_cdc_unbind
   usbnet_change_mtu
   usbnet_defer_kevent
   usbnet_disconnect
+  usbnet_generic_cdc_bind
   usbnet_get_drvinfo
   usbnet_get_endpoints
   usbnet_get_link

android/abi_gki_aarch64_oplus

@@ -2585,11 +2585,11 @@
   __traceiter_android_vh_alter_rwsem_list_add
   __traceiter_android_vh_arch_set_freq_scale
   __traceiter_android_vh_binder_alloc_new_buf_locked
-  __traceiter_android_vh_binder_new_ref
   __traceiter_android_vh_binder_del_ref
-  __traceiter_android_vh_binder_proc_transaction
+  __traceiter_android_vh_binder_new_ref
   __traceiter_android_vh_binder_preset
   __traceiter_android_vh_binder_priority_skip
+  __traceiter_android_vh_binder_proc_transaction
   __traceiter_android_vh_binder_proc_transaction_end
   __traceiter_android_vh_binder_reply
   __traceiter_android_vh_binder_restore_priority
@@ -2627,6 +2627,7 @@
   __traceiter_android_vh_ftrace_oops_enter
   __traceiter_android_vh_ftrace_oops_exit
   __traceiter_android_vh_ftrace_size_check
+  __traceiter_android_vh_futex_sleep_start
   __traceiter_android_vh_get_from_fragment_pool
   __traceiter_android_vh_gpio_block_read
   __traceiter_android_vh_include_reserved_zone
@@ -2780,11 +2781,11 @@
   __tracepoint_android_vh_alter_rwsem_list_add
   __tracepoint_android_vh_arch_set_freq_scale
   __tracepoint_android_vh_binder_alloc_new_buf_locked
-  __tracepoint_android_vh_binder_new_ref
   __tracepoint_android_vh_binder_del_ref
-  __tracepoint_android_vh_binder_proc_transaction
+  __tracepoint_android_vh_binder_new_ref
   __tracepoint_android_vh_binder_preset
   __tracepoint_android_vh_binder_priority_skip
+  __tracepoint_android_vh_binder_proc_transaction
   __tracepoint_android_vh_binder_proc_transaction_end
   __tracepoint_android_vh_binder_reply
   __tracepoint_android_vh_binder_restore_priority
@@ -2822,6 +2823,7 @@
   __tracepoint_android_vh_ftrace_oops_enter
   __tracepoint_android_vh_ftrace_oops_exit
   __tracepoint_android_vh_ftrace_size_check
+  __tracepoint_android_vh_futex_sleep_start
   __tracepoint_android_vh_get_from_fragment_pool
   __tracepoint_android_vh_gpio_block_read
   __tracepoint_android_vh_include_reserved_zone

drivers/iommu/io-pgtable-arm-v7s.c

@@ -246,13 +246,17 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
 			__GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size));
 	else if (lvl == 2)
 		table = kmem_cache_zalloc(data->l2_tables, gfp);
+
+	if (!table)
+		return NULL;
+
 	phys = virt_to_phys(table);
 	if (phys != (arm_v7s_iopte)phys) {
 		/* Doesn't fit in PTE */
 		dev_err(dev, "Page table does not fit in PTE: %pa", &phys);
 		goto out_free;
 	}
-	if (table && !cfg->coherent_walk) {
+	if (!cfg->coherent_walk) {
 		dma = dma_map_single(dev, table, size, DMA_TO_DEVICE);
 		if (dma_mapping_error(dev, dma))
 			goto out_free;

kernel/bpf/stackmap.c

@@ -64,7 +64,8 @@ static inline int stack_map_data_size(struct bpf_map *map)
 
 static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
 {
-	u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size;
+	u64 elem_size = sizeof(struct stack_map_bucket) +
+			(u64)smap->map.value_size;
 	int err;
 
 	smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,

net/sctp/input.c

@@ -1168,6 +1168,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
 	union sctp_addr_param *param;
 	union sctp_addr paddr;
 
+	if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))
+		return NULL;
+
 	/* Skip over the ADDIP header and find the Address parameter */
 	param = (union sctp_addr_param *)(asconf + 1);
 

net/sctp/sm_make_chunk.c

@@ -2150,9 +2150,16 @@ static enum sctp_ierror sctp_verify_param(struct net *net,
 		break;
 
 	case SCTP_PARAM_SET_PRIMARY:
-		if (ep->asconf_enable)
-			break;
-		goto unhandled;
+		if (!ep->asconf_enable)
+			goto unhandled;
+
+		if (ntohs(param.p->length) < sizeof(struct sctp_addip_param) +
+					     sizeof(struct sctp_paramhdr)) {
+			sctp_process_inv_paramlength(asoc, param.p,
+						     chunk, err_chunk);
+			retval = SCTP_IERROR_ABORT;
+		}
+		break;
 
 	case SCTP_PARAM_HOST_NAME_ADDRESS:
 		/* Tell the peer, we won't support this param.  */