[gentoo-commits] proj/linux-patches:4.9 commit in: /

["Mike Pagano" <mpagano@gentoo.org>]

commit:     76a9bde411289f9d109fa8370cae7ed52a44fec6
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 29 17:46:26 2022 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jan 29 17:46:26 2022 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=76a9bde4

Linux patch 4.9.299

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |   4 +
 1298_linux-4.9.299.patch | 807 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 811 insertions(+)

diff --git a/0000_README b/0000_README
index 52cd88fb..671be5e2 100644
--- a/0000_README
+++ b/0000_README
@@ -1235,6 +1235,10 @@ Patch:  1297_linux-4.9.298.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.298
 
+Patch:  1298_linux-4.9.299.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.299
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1298_linux-4.9.299.patch b/1298_linux-4.9.299.patch
new file mode 100644
index 00000000..95feaed3
--- /dev/null
+++ b/1298_linux-4.9.299.patch
@@ -0,0 +1,807 @@
+diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
+index 481b6a9c25d5a..16ddfd6bd6a1a 100644
+--- a/Documentation/virtual/kvm/mmu.txt
++++ b/Documentation/virtual/kvm/mmu.txt
+@@ -152,8 +152,8 @@ Shadow pages contain the following information:
+     shadow pages) so role.quadrant takes values in the range 0..3.  Each
+     quadrant maps 1GB virtual address space.
+   role.access:
+-    Inherited guest access permissions in the form uwx.  Note execute
+-    permission is positive, not negative.
++    Inherited guest access permissions from the parent ptes in the form uwx.
++    Note execute permission is positive, not negative.
+   role.invalid:
+     The page is invalid and should not be used.  It is a root page that is
+     currently pinned (by a cpu hardware register pointing to it); once it is
+diff --git a/Makefile b/Makefile
+index b0f683f18df71..99d37c23495ef 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 298
++SUBLEVEL = 299
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index bb8f39fe3a225..8df8cdd093e98 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -15,30 +15,42 @@ config ARM_PTDUMP
+ 	  kernel.
+ 	  If in doubt, say "N"
+ 
+-# RMK wants arm kernels compiled with frame pointers or stack unwinding.
+-# If you know what you are doing and are willing to live without stack
+-# traces, you can get a slightly smaller kernel by setting this option to
+-# n, but then RMK will have to kill you ;).
+-config FRAME_POINTER
+-	bool
+-	depends on !THUMB2_KERNEL
+-	default y if !ARM_UNWIND || FUNCTION_GRAPH_TRACER
++choice
++	prompt "Choose kernel unwinder"
++	default UNWINDER_ARM if AEABI && !FUNCTION_GRAPH_TRACER
++	default UNWINDER_FRAME_POINTER if !AEABI || FUNCTION_GRAPH_TRACER
++	help
++	  This determines which method will be used for unwinding kernel stack
++	  traces for panics, oopses, bugs, warnings, perf, /proc/<pid>/stack,
++	  livepatch, lockdep, and more.
++
++config UNWINDER_FRAME_POINTER
++	bool "Frame pointer unwinder"
++	depends on !THUMB2_KERNEL && !CC_IS_CLANG
++	select ARCH_WANT_FRAME_POINTERS
++	select FRAME_POINTER
+ 	help
+-	  If you say N here, the resulting kernel will be slightly smaller and
+-	  faster. However, if neither FRAME_POINTER nor ARM_UNWIND are enabled,
+-	  when a problem occurs with the kernel, the information that is
+-	  reported is severely limited.
++	  This option enables the frame pointer unwinder for unwinding
++	  kernel stack traces.
+ 
+-config ARM_UNWIND
+-	bool "Enable stack unwinding support (EXPERIMENTAL)"
++config UNWINDER_ARM
++	bool "ARM EABI stack unwinder"
+ 	depends on AEABI
+-	default y
++	select ARM_UNWIND
+ 	help
+ 	  This option enables stack unwinding support in the kernel
+ 	  using the information automatically generated by the
+ 	  compiler. The resulting kernel image is slightly bigger but
+ 	  the performance is not affected. Currently, this feature
+-	  only works with EABI compilers. If unsure say Y.
++	  only works with EABI compilers.
++
++endchoice
++
++config ARM_UNWIND
++	bool
++
++config FRAME_POINTER
++	bool
+ 
+ config OLD_MCOUNT
+ 	bool
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index e03225e707b26..d92c7758efad1 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -100,8 +100,8 @@ struct guest_walker {
+ 	gpa_t pte_gpa[PT_MAX_FULL_LEVELS];
+ 	pt_element_t __user *ptep_user[PT_MAX_FULL_LEVELS];
+ 	bool pte_writable[PT_MAX_FULL_LEVELS];
+-	unsigned pt_access;
+-	unsigned pte_access;
++	unsigned int pt_access[PT_MAX_FULL_LEVELS];
++	unsigned int pte_access;
+ 	gfn_t gfn;
+ 	struct x86_exception fault;
+ };
+@@ -285,9 +285,11 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
+ 	pt_element_t pte;
+ 	pt_element_t __user *uninitialized_var(ptep_user);
+ 	gfn_t table_gfn;
+-	unsigned index, pt_access, pte_access, accessed_dirty, pte_pkey;
++	u64 pt_access, pte_access;
++	unsigned index, accessed_dirty, pte_pkey;
+ 	gpa_t pte_gpa;
+ 	int offset;
++	u64 walk_nx_mask = 0;
+ 	const int write_fault = access & PFERR_WRITE_MASK;
+ 	const int user_fault  = access & PFERR_USER_MASK;
+ 	const int fetch_fault = access & PFERR_FETCH_MASK;
+@@ -301,6 +303,7 @@ retry_walk:
+ 	pte           = mmu->get_cr3(vcpu);
+ 
+ #if PTTYPE == 64
++	walk_nx_mask = 1ULL << PT64_NX_SHIFT;
+ 	if (walker->level == PT32E_ROOT_LEVEL) {
+ 		pte = mmu->get_pdptr(vcpu, (addr >> 30) & 3);
+ 		trace_kvm_mmu_paging_element(pte, walker->level);
+@@ -312,15 +315,14 @@ retry_walk:
+ 	walker->max_level = walker->level;
+ 	ASSERT(!(is_long_mode(vcpu) && !is_pae(vcpu)));
+ 
+-	accessed_dirty = PT_GUEST_ACCESSED_MASK;
+-	pt_access = pte_access = ACC_ALL;
++	pte_access = ~0;
+ 	++walker->level;
+ 
+ 	do {
+ 		gfn_t real_gfn;
+ 		unsigned long host_addr;
+ 
+-		pt_access &= pte_access;
++		pt_access = pte_access;
+ 		--walker->level;
+ 
+ 		index = PT_INDEX(addr, walker->level);
+@@ -363,6 +365,12 @@ retry_walk:
+ 
+ 		trace_kvm_mmu_paging_element(pte, walker->level);
+ 
++		/*
++		 * Inverting the NX it lets us AND it like other
++		 * permission bits.
++		 */
++		pte_access = pt_access & (pte ^ walk_nx_mask);
++
+ 		if (unlikely(!FNAME(is_present_gpte)(pte)))
+ 			goto error;
+ 
+@@ -371,14 +379,18 @@ retry_walk:
+ 			goto error;
+ 		}
+ 
+-		accessed_dirty &= pte;
+-		pte_access = pt_access & FNAME(gpte_access)(vcpu, pte);
+-
+ 		walker->ptes[walker->level - 1] = pte;
++
++		/* Convert to ACC_*_MASK flags for struct guest_walker.  */
++		walker->pt_access[walker->level - 1] = FNAME(gpte_access)(vcpu, pt_access ^ walk_nx_mask);
+ 	} while (!is_last_gpte(mmu, walker->level, pte));
+ 
+ 	pte_pkey = FNAME(gpte_pkeys)(vcpu, pte);
+-	errcode = permission_fault(vcpu, mmu, pte_access, pte_pkey, access);
++	accessed_dirty = pte_access & PT_GUEST_ACCESSED_MASK;
++
++	/* Convert to ACC_*_MASK flags for struct guest_walker.  */
++	walker->pte_access = FNAME(gpte_access)(vcpu, pte_access ^ walk_nx_mask);
++	errcode = permission_fault(vcpu, mmu, walker->pte_access, pte_pkey, access);
+ 	if (unlikely(errcode))
+ 		goto error;
+ 
+@@ -395,7 +407,7 @@ retry_walk:
+ 	walker->gfn = real_gpa >> PAGE_SHIFT;
+ 
+ 	if (!write_fault)
+-		FNAME(protect_clean_gpte)(&pte_access, pte);
++		FNAME(protect_clean_gpte)(&walker->pte_access, pte);
+ 	else
+ 		/*
+ 		 * On a write fault, fold the dirty bit into accessed_dirty.
+@@ -413,10 +425,9 @@ retry_walk:
+ 			goto retry_walk;
+ 	}
+ 
+-	walker->pt_access = pt_access;
+-	walker->pte_access = pte_access;
+ 	pgprintk("%s: pte %llx pte_access %x pt_access %x\n",
+-		 __func__, (u64)pte, pte_access, pt_access);
++		 __func__, (u64)pte, walker->pte_access,
++		 walker->pt_access[walker->level - 1]);
+ 	return 1;
+ 
+ error:
+@@ -444,7 +455,7 @@ error:
+ 	 */
+ 	if (!(errcode & PFERR_RSVD_MASK)) {
+ 		vcpu->arch.exit_qualification &= 0x187;
+-		vcpu->arch.exit_qualification |= ((pt_access & pte) & 0x7) << 3;
++		vcpu->arch.exit_qualification |= (pte_access & 0x7) << 3;
+ 	}
+ #endif
+ 	walker->fault.address = addr;
+@@ -578,7 +589,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
+ {
+ 	struct kvm_mmu_page *sp = NULL;
+ 	struct kvm_shadow_walk_iterator it;
+-	unsigned direct_access, access = gw->pt_access;
++	unsigned int direct_access, access;
+ 	int top_level, ret;
+ 	gfn_t gfn, base_gfn;
+ 
+@@ -610,6 +621,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
+ 		sp = NULL;
+ 		if (!is_shadow_present_pte(*it.sptep)) {
+ 			table_gfn = gw->table_gfn[it.level - 2];
++			access = gw->pt_access[it.level - 2];
+ 			sp = kvm_mmu_get_page(vcpu, table_gfn, addr, it.level-1,
+ 					      false, access);
+ 		}
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index c4f155663ca9a..14cd0a742e794 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1763,6 +1763,8 @@ struct drm_i915_private {
+ 
+ 	struct intel_uncore uncore;
+ 
++	struct mutex tlb_invalidate_lock;
++
+ 	struct i915_virtual_gpu vgpu;
+ 
+ 	struct intel_gvt gvt;
+@@ -2211,7 +2213,8 @@ struct drm_i915_gem_object {
+ 	 * rendering and so a non-zero seqno), and is not set if it i s on
+ 	 * inactive (ready to be unbound) list.
+ 	 */
+-#define I915_BO_ACTIVE_SHIFT 0
++#define I915_BO_WAS_BOUND_BIT    0
++#define I915_BO_ACTIVE_SHIFT 1
+ #define I915_BO_ACTIVE_MASK ((1 << I915_NUM_ENGINES) - 1)
+ #define __I915_BO_ACTIVE(bo) \
+ 	((READ_ONCE((bo)->flags) >> I915_BO_ACTIVE_SHIFT) & I915_BO_ACTIVE_MASK)
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 3fb4f9acacba0..9265ac5774c25 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2185,6 +2185,67 @@ i915_gem_object_put_pages_gtt(struct drm_i915_gem_object *obj)
+ 	kfree(obj->pages);
+ }
+ 
++static int
++__intel_wait_for_register_fw(struct drm_i915_private *dev_priv,
++			     i915_reg_t reg,
++			     const u32 mask,
++			     const u32 value,
++			     const unsigned int timeout_us,
++			     const unsigned int timeout_ms)
++{
++#define done ((I915_READ_FW(reg) & mask) == value)
++	int ret = wait_for_us(done, timeout_us);
++	if (ret)
++		ret = wait_for(done, timeout_ms);
++	return ret;
++#undef done
++}
++
++static void invalidate_tlbs(struct drm_i915_private *dev_priv)
++{
++	static const i915_reg_t gen8_regs[] = {
++		[RCS]  = GEN8_RTCR,
++		[VCS]  = GEN8_M1TCR,
++		[VCS2] = GEN8_M2TCR,
++		[VECS] = GEN8_VTCR,
++		[BCS]  = GEN8_BTCR,
++	};
++	struct intel_engine_cs *engine;
++
++	if (INTEL_GEN(dev_priv) < 8)
++		return;
++
++	assert_rpm_wakelock_held(dev_priv);
++
++	mutex_lock(&dev_priv->tlb_invalidate_lock);
++	intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
++
++	for_each_engine(engine, dev_priv) {
++		/*
++		 * HW architecture suggest typical invalidation time at 40us,
++		 * with pessimistic cases up to 100us and a recommendation to
++		 * cap at 1ms. We go a bit higher just in case.
++		 */
++		const unsigned int timeout_us = 100;
++		const unsigned int timeout_ms = 4;
++		const enum intel_engine_id id = engine->id;
++
++		if (WARN_ON_ONCE(id >= ARRAY_SIZE(gen8_regs) ||
++				 !i915_mmio_reg_offset(gen8_regs[id])))
++			continue;
++
++		I915_WRITE_FW(gen8_regs[id], 1);
++		if (__intel_wait_for_register_fw(dev_priv,
++						 gen8_regs[id], 1, 0,
++						 timeout_us, timeout_ms))
++			DRM_ERROR_RATELIMITED("%s TLB invalidation did not complete in %ums!\n",
++					      engine->name, timeout_ms);
++	}
++
++	intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
++	mutex_unlock(&dev_priv->tlb_invalidate_lock);
++}
++
+ int
+ i915_gem_object_put_pages(struct drm_i915_gem_object *obj)
+ {
+@@ -2215,6 +2276,15 @@ i915_gem_object_put_pages(struct drm_i915_gem_object *obj)
+ 		obj->mapping = NULL;
+ 	}
+ 
++	if (test_and_clear_bit(I915_BO_WAS_BOUND_BIT, &obj->flags)) {
++		struct drm_i915_private *i915 = to_i915(obj->base.dev);
++
++		if (intel_runtime_pm_get_if_in_use(i915)) {
++			invalidate_tlbs(i915);
++			intel_runtime_pm_put(i915);
++		}
++	}
++
+ 	ops->put_pages(obj);
+ 	obj->pages = NULL;
+ 
+@@ -4627,6 +4697,8 @@ i915_gem_load_init(struct drm_device *dev)
+ 
+ 	atomic_set(&dev_priv->mm.bsd_engine_dispatch_index, 0);
+ 
++	mutex_init(&dev_priv->tlb_invalidate_lock);
++
+ 	spin_lock_init(&dev_priv->fb_tracking.lock);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index 16f56f14f4d06..edaff73b7aa9d 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -3685,6 +3685,10 @@ int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level,
+ 		return ret;
+ 
+ 	vma->flags |= bind_flags;
++
++	if (vma->obj)
++		set_bit(I915_BO_WAS_BOUND_BIT, &vma->obj->flags);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 5468e69bf520a..1ff1e33df2c71 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1698,6 +1698,12 @@ enum skl_disp_power_wells {
+ #define GAMT_CHKN_BIT_REG	_MMIO(0x4ab8)
+ #define   GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING	(1<<28)
+ 
++#define GEN8_RTCR	_MMIO(0x4260)
++#define GEN8_M1TCR	_MMIO(0x4264)
++#define GEN8_M2TCR	_MMIO(0x4268)
++#define GEN8_BTCR	_MMIO(0x426c)
++#define GEN8_VTCR	_MMIO(0x4270)
++
+ #if 0
+ #define PRB0_TAIL	_MMIO(0x2030)
+ #define PRB0_HEAD	_MMIO(0x2034)
+diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c
+index 280b5ffea5922..3a373711f5ad9 100644
+--- a/drivers/media/firewire/firedtv-avc.c
++++ b/drivers/media/firewire/firedtv-avc.c
+@@ -1169,7 +1169,11 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
+ 		read_pos += program_info_length;
+ 		write_pos += program_info_length;
+ 	}
+-	while (read_pos < length) {
++	while (read_pos + 4 < length) {
++		if (write_pos + 4 >= sizeof(c->operand) - 4) {
++			ret = -EINVAL;
++			goto out;
++		}
+ 		c->operand[write_pos++] = msg[read_pos++];
+ 		c->operand[write_pos++] = msg[read_pos++];
+ 		c->operand[write_pos++] = msg[read_pos++];
+@@ -1181,13 +1185,17 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
+ 		c->operand[write_pos++] = es_info_length >> 8;
+ 		c->operand[write_pos++] = es_info_length & 0xff;
+ 		if (es_info_length > 0) {
++			if (read_pos >= length) {
++				ret = -EINVAL;
++				goto out;
++			}
+ 			pmt_cmd_id = msg[read_pos++];
+ 			if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+ 				dev_err(fdtv->device, "invalid pmt_cmd_id %d "
+ 					"at stream level\n", pmt_cmd_id);
+ 
+-			if (es_info_length > sizeof(c->operand) - 4 -
+-					     write_pos) {
++			if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
++			    es_info_length > length - read_pos) {
+ 				ret = -EINVAL;
+ 				goto out;
+ 			}
+diff --git a/drivers/media/firewire/firedtv-ci.c b/drivers/media/firewire/firedtv-ci.c
+index edbb30fdd9d95..93fb4b7312afc 100644
+--- a/drivers/media/firewire/firedtv-ci.c
++++ b/drivers/media/firewire/firedtv-ci.c
+@@ -138,6 +138,8 @@ static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg)
+ 	} else {
+ 		data_length = msg->msg[3];
+ 	}
++	if (data_length > sizeof(msg->msg) - data_pos)
++		return -EINVAL;
+ 
+ 	return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length);
+ }
+diff --git a/drivers/staging/android/ion/ion-ioctl.c b/drivers/staging/android/ion/ion-ioctl.c
+index e3596855a7031..a27865b94416b 100644
+--- a/drivers/staging/android/ion/ion-ioctl.c
++++ b/drivers/staging/android/ion/ion-ioctl.c
+@@ -30,6 +30,69 @@ union ion_ioctl_arg {
+ 	struct ion_heap_query query;
+ };
+ 
++/* Must hold the client lock */
++static void user_ion_handle_get(struct ion_handle *handle)
++{
++	if (handle->user_ref_count++ == 0)
++		kref_get(&handle->ref);
++}
++
++/* Must hold the client lock */
++static struct ion_handle *user_ion_handle_get_check_overflow(
++	struct ion_handle *handle)
++{
++	if (handle->user_ref_count + 1 == 0)
++		return ERR_PTR(-EOVERFLOW);
++	user_ion_handle_get(handle);
++	return handle;
++}
++
++/* passes a kref to the user ref count.
++ * We know we're holding a kref to the object before and
++ * after this call, so no need to reverify handle.
++ */
++static struct ion_handle *pass_to_user(struct ion_handle *handle)
++{
++	struct ion_client *client = handle->client;
++	struct ion_handle *ret;
++
++	mutex_lock(&client->lock);
++	ret = user_ion_handle_get_check_overflow(handle);
++	ion_handle_put_nolock(handle);
++	mutex_unlock(&client->lock);
++	return ret;
++}
++
++/* Must hold the client lock */
++static int user_ion_handle_put_nolock(struct ion_handle *handle)
++{
++	int ret;
++
++	if (--handle->user_ref_count == 0)
++		ret = ion_handle_put_nolock(handle);
++
++	return ret;
++}
++
++static void user_ion_free_nolock(struct ion_client *client,
++				 struct ion_handle *handle)
++{
++	bool valid_handle;
++
++	WARN_ON(client != handle->client);
++
++	valid_handle = ion_handle_validate(client, handle);
++	if (!valid_handle) {
++		WARN(1, "%s: invalid handle passed to free.\n", __func__);
++		return;
++	}
++	if (handle->user_ref_count == 0) {
++		WARN(1, "%s: User does not have access!\n", __func__);
++		return;
++	}
++	user_ion_handle_put_nolock(handle);
++}
++
+ static int validate_ioctl_arg(unsigned int cmd, union ion_ioctl_arg *arg)
+ {
+ 	int ret = 0;
+@@ -96,16 +159,15 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 	{
+ 		struct ion_handle *handle;
+ 
+-		handle = ion_alloc(client, data.allocation.len,
+-						data.allocation.align,
+-						data.allocation.heap_id_mask,
+-						data.allocation.flags);
++		handle = __ion_alloc(client, data.allocation.len,
++				     data.allocation.align,
++				     data.allocation.heap_id_mask,
++				     data.allocation.flags, true);
+ 		if (IS_ERR(handle))
+ 			return PTR_ERR(handle);
+-
+ 		data.allocation.handle = handle->id;
+-
+ 		cleanup_handle = handle;
++		pass_to_user(handle);
+ 		break;
+ 	}
+ 	case ION_IOC_FREE:
+@@ -118,7 +180,7 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 			mutex_unlock(&client->lock);
+ 			return PTR_ERR(handle);
+ 		}
+-		ion_free_nolock(client, handle);
++		user_ion_free_nolock(client, handle);
+ 		ion_handle_put_nolock(handle);
+ 		mutex_unlock(&client->lock);
+ 		break;
+@@ -146,10 +208,16 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 		struct ion_handle *handle;
+ 
+ 		handle = ion_import_dma_buf_fd(client, data.fd.fd);
+-		if (IS_ERR(handle))
++		if (IS_ERR(handle)) {
+ 			ret = PTR_ERR(handle);
+-		else
++		} else {
+ 			data.handle.handle = handle->id;
++			handle = pass_to_user(handle);
++			if (IS_ERR(handle)) {
++				ret = PTR_ERR(handle);
++				data.handle.handle = 0;
++			}
++		}
+ 		break;
+ 	}
+ 	case ION_IOC_SYNC:
+@@ -174,10 +242,16 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 
+ 	if (dir & _IOC_READ) {
+ 		if (copy_to_user((void __user *)arg, &data, _IOC_SIZE(cmd))) {
+-			if (cleanup_handle)
+-				ion_free(client, cleanup_handle);
++			if (cleanup_handle) {
++				mutex_lock(&client->lock);
++				user_ion_free_nolock(client, cleanup_handle);
++				ion_handle_put_nolock(cleanup_handle);
++				mutex_unlock(&client->lock);
++			}
+ 			return -EFAULT;
+ 		}
+ 	}
++	if (cleanup_handle)
++		ion_handle_put(cleanup_handle);
+ 	return ret;
+ }
+diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
+index aac9b38b8c25c..b272f2ab87e8f 100644
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -363,8 +363,8 @@ struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,
+ 	return ERR_PTR(-EINVAL);
+ }
+ 
+-static bool ion_handle_validate(struct ion_client *client,
+-				struct ion_handle *handle)
++bool ion_handle_validate(struct ion_client *client,
++			 struct ion_handle *handle)
+ {
+ 	WARN_ON(!mutex_is_locked(&client->lock));
+ 	return idr_find(&client->idr, handle->id) == handle;
+@@ -401,9 +401,9 @@ static int ion_handle_add(struct ion_client *client, struct ion_handle *handle)
+ 	return 0;
+ }
+ 
+-struct ion_handle *ion_alloc(struct ion_client *client, size_t len,
+-			     size_t align, unsigned int heap_id_mask,
+-			     unsigned int flags)
++struct ion_handle *__ion_alloc(struct ion_client *client, size_t len,
++			       size_t align, unsigned int heap_id_mask,
++			       unsigned int flags, bool grab_handle)
+ {
+ 	struct ion_handle *handle;
+ 	struct ion_device *dev = client->dev;
+@@ -453,6 +453,8 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len,
+ 		return handle;
+ 
+ 	mutex_lock(&client->lock);
++	if (grab_handle)
++		ion_handle_get(handle);
+ 	ret = ion_handle_add(client, handle);
+ 	mutex_unlock(&client->lock);
+ 	if (ret) {
+@@ -462,6 +464,13 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len,
+ 
+ 	return handle;
+ }
++
++struct ion_handle *ion_alloc(struct ion_client *client, size_t len,
++			     size_t align, unsigned int heap_id_mask,
++			     unsigned int flags)
++{
++	return __ion_alloc(client, len, align, heap_id_mask, flags, false);
++}
+ EXPORT_SYMBOL(ion_alloc);
+ 
+ void ion_free_nolock(struct ion_client *client,
+diff --git a/drivers/staging/android/ion/ion.h b/drivers/staging/android/ion/ion.h
+index 93dafb4586e43..cfa50dfb46edc 100644
+--- a/drivers/staging/android/ion/ion.h
++++ b/drivers/staging/android/ion/ion.h
+@@ -109,6 +109,10 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len,
+ 			     size_t align, unsigned int heap_id_mask,
+ 			     unsigned int flags);
+ 
++struct ion_handle *__ion_alloc(struct ion_client *client, size_t len,
++			       size_t align, unsigned int heap_id_mask,
++			       unsigned int flags, bool grab_handle);
++
+ /**
+  * ion_free - free a handle
+  * @client:	the client
+diff --git a/drivers/staging/android/ion/ion_priv.h b/drivers/staging/android/ion/ion_priv.h
+index 760e41885448a..e1dd25eab1dbd 100644
+--- a/drivers/staging/android/ion/ion_priv.h
++++ b/drivers/staging/android/ion/ion_priv.h
+@@ -149,6 +149,7 @@ struct ion_client {
+  */
+ struct ion_handle {
+ 	struct kref ref;
++	unsigned int user_ref_count;
+ 	struct ion_client *client;
+ 	struct ion_buffer *buffer;
+ 	struct rb_node node;
+@@ -459,6 +460,9 @@ int ion_sync_for_device(struct ion_client *client, int fd);
+ struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,
+ 						int id);
+ 
++bool ion_handle_validate(struct ion_client *client,
++			 struct ion_handle *handle);
++
+ void ion_free_nolock(struct ion_client *client, struct ion_handle *handle);
+ 
+ int ion_handle_put_nolock(struct ion_handle *handle);
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 3ee60c5332179..2fb4633897084 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -177,8 +177,11 @@ void nfs40_shutdown_client(struct nfs_client *clp)
+ 
+ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ {
+-	int err;
++	char buf[INET6_ADDRSTRLEN + 1];
++	const char *ip_addr = cl_init->ip_addr;
+ 	struct nfs_client *clp = nfs_alloc_client(cl_init);
++	int err;
++
+ 	if (IS_ERR(clp))
+ 		return clp;
+ 
+@@ -202,6 +205,44 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+ 	init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
++
++	if (cl_init->minorversion != 0)
++		__set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
++	__set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
++	__set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags);
++
++	/*
++	 * Set up the connection to the server before we add add to the
++	 * global list.
++	 */
++	err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I);
++	if (err == -EINVAL)
++		err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX);
++	if (err < 0)
++		goto error;
++
++	/* If no clientaddr= option was specified, find a usable cb address */
++	if (ip_addr == NULL) {
++		struct sockaddr_storage cb_addr;
++		struct sockaddr *sap = (struct sockaddr *)&cb_addr;
++
++		err = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr));
++		if (err < 0)
++			goto error;
++		err = rpc_ntop(sap, buf, sizeof(buf));
++		if (err < 0)
++			goto error;
++		ip_addr = (const char *)buf;
++	}
++	strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
++
++	err = nfs_idmap_new(clp);
++	if (err < 0) {
++		dprintk("%s: failed to create idmapper. Error = %d\n",
++			__func__, err);
++		goto error;
++	}
++	__set_bit(NFS_CS_IDMAP, &clp->cl_res_state);
+ 	return clp;
+ 
+ error:
+@@ -354,8 +395,6 @@ static int nfs4_init_client_minor_version(struct nfs_client *clp)
+ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+ 				    const struct nfs_client_initdata *cl_init)
+ {
+-	char buf[INET6_ADDRSTRLEN + 1];
+-	const char *ip_addr = cl_init->ip_addr;
+ 	struct nfs_client *old;
+ 	int error;
+ 
+@@ -365,43 +404,6 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+ 		return clp;
+ 	}
+ 
+-	/* Check NFS protocol revision and initialize RPC op vector */
+-	clp->rpc_ops = &nfs_v4_clientops;
+-
+-	if (clp->cl_minorversion != 0)
+-		__set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
+-	__set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
+-	__set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags);
+-
+-	error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I);
+-	if (error == -EINVAL)
+-		error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX);
+-	if (error < 0)
+-		goto error;
+-
+-	/* If no clientaddr= option was specified, find a usable cb address */
+-	if (ip_addr == NULL) {
+-		struct sockaddr_storage cb_addr;
+-		struct sockaddr *sap = (struct sockaddr *)&cb_addr;
+-
+-		error = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr));
+-		if (error < 0)
+-			goto error;
+-		error = rpc_ntop(sap, buf, sizeof(buf));
+-		if (error < 0)
+-			goto error;
+-		ip_addr = (const char *)buf;
+-	}
+-	strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
+-
+-	error = nfs_idmap_new(clp);
+-	if (error < 0) {
+-		dprintk("%s: failed to create idmapper. Error = %d\n",
+-			__func__, error);
+-		goto error;
+-	}
+-	__set_bit(NFS_CS_IDMAP, &clp->cl_res_state);
+-
+ 	error = nfs4_init_client_minor_version(clp);
+ 	if (error < 0)
+ 		goto error;
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index bc5ff3a53d4a6..e7addfcd302f4 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1091,7 +1091,7 @@ config LOCKDEP
+ 	bool
+ 	depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
+ 	select STACKTRACE
+-	select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 && !MICROBLAZE && !ARC && !SCORE
++	select FRAME_POINTER if !MIPS && !PPC && !ARM && !S390 && !MICROBLAZE && !ARC && !SCORE
+ 	select KALLSYMS
+ 	select KALLSYMS_ALL
+ 
+@@ -1670,7 +1670,7 @@ config FAULT_INJECTION_STACKTRACE_FILTER
+ 	depends on FAULT_INJECTION_DEBUG_FS && STACKTRACE_SUPPORT
+ 	depends on !X86_64
+ 	select STACKTRACE
+-	select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC && !SCORE
++	select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM && !ARC && !SCORE
+ 	help
+ 	  Provide stacktrace filter for fault-injection capabilities
+ 
+@@ -1679,7 +1679,7 @@ config LATENCYTOP
+ 	depends on DEBUG_KERNEL
+ 	depends on STACKTRACE_SUPPORT
+ 	depends on PROC_FS
+-	select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC
++	select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM && !ARC
+ 	select KALLSYMS
+ 	select KALLSYMS_ALL
+ 	select STACKTRACE