Merge branch 'android11-5.4' into 'android11-5.4-lts'

Sync up with android11-5.4 for the following commits:

459ed28f1a BACKPORT: ext4: don't BUG if someone dirty pages without asking ext4 first
a894c2e4c8 ANDROID: incremental-fs: limit mount stack depth
cab636f066 Revert "ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree"
9e36653776 ANDROID: usb: gadget: f_accessory: add compat_ioctl support
55f3c6361f UPSTREAM: sr9700: sanity check for packet length
ea62106bb8 ANDROID: ABI: update allowed list for galaxy
4581cd018d ANDROID: GKI: Add symbol list for Zebra
67a04462df UPSTREAM: Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
598165f1e4 UPSTREAM: usb: gadget: clear related members when goto fail
9901d8bdac UPSTREAM: usb: gadget: don't release an existing dev->buf

Change-Id: I069190826ae1e15e32719984e4a92ff90a5721a9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

android/abi_gki_aarch64_galaxy

@@ -167,6 +167,7 @@
   __tracepoint_device_pm_callback_end
   __tracepoint_device_pm_callback_start
   __tracepoint_gpu_mem_total
+  __tracepoint_kfree_skb
   __tracepoint_pelt_cfs_tp
   __tracepoint_suspend_resume
   __tty_alloc_driver

android/abi_gki_aarch64_zebra

@@ -0,0 +1,8 @@
+[abi_symbol_list]
+# commonly used symbols
+
+# for wifi
+  mmc_sw_reset
+  nla_reserve
+  nla_append
+  prandom_seed

build.config.gki.aarch64

@@ -24,6 +24,7 @@ android/abi_gki_aarch64_sunxi
 android/abi_gki_aarch64_unisoc
 android/abi_gki_aarch64_vivo
 android/abi_gki_aarch64_xiaomi
+android/abi_gki_aarch64_zebra
 "
 TRIM_NONLISTED_KMI=1
 KMI_SYMBOL_LIST_ADD_ONLY=1

drivers/md/dm-bow.c

@@ -236,7 +236,6 @@ static void set_type(struct bow_context *bc, struct bow_range **br, int type)
 
 	(*br)->type = type;
 
-	mutex_lock(&bc->ranges_lock);
 	if (next->type == type) {
 		if (type == TRIMMED)
 			list_del(&next->trimmed_list);
@@ -250,7 +249,6 @@ static void set_type(struct bow_context *bc, struct bow_range **br, int type)
 		rb_erase(&(*br)->node, &bc->ranges);
 		kfree(*br);
 	}
-	mutex_unlock(&bc->ranges_lock);
 
 	*br = NULL;
 }
@@ -601,7 +599,6 @@ static void dm_bow_dtr(struct dm_target *ti)
 	struct bow_context *bc = (struct bow_context *) ti->private;
 	struct kobject *kobj;
 
-	mutex_lock(&bc->ranges_lock);
 	while (rb_first(&bc->ranges)) {
 		struct bow_range *br = container_of(rb_first(&bc->ranges),
 						    struct bow_range, node);
@@ -609,8 +606,6 @@ static void dm_bow_dtr(struct dm_target *ti)
 		rb_erase(&br->node, &bc->ranges);
 		kfree(br);
 	}
-	mutex_unlock(&bc->ranges_lock);
-
 	if (bc->workqueue)
 		destroy_workqueue(bc->workqueue);
 	if (bc->bufio)
@@ -1187,7 +1182,6 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 		return;
 	}
 
-	mutex_lock(&bc->ranges_lock);
 	for (i = rb_first(&bc->ranges); i; i = rb_next(i)) {
 		struct bow_range *br = container_of(i, struct bow_range, node);
 
@@ -1195,11 +1189,11 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 				    readable_type[br->type],
 				    (unsigned long long)br->sector);
 		if (result >= end)
-			goto unlock;
+			return;
 
 		result += scnprintf(result, end - result, "\n");
 		if (result >= end)
-			goto unlock;
+			return;
 
 		if (br->type == TRIMMED)
 			++trimmed_range_count;
@@ -1221,22 +1215,19 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 		if (!rb_next(i)) {
 			scnprintf(result, end - result,
 				  "\nERROR: Last range not of type TOP");
-			goto unlock;
+			return;
 		}
 
 		if (br->sector > range_top(br)) {
 			scnprintf(result, end - result,
 				  "\nERROR: sectors out of order");
-			goto unlock;
+			return;
 		}
 	}
 
 	if (trimmed_range_count != trimmed_list_length)
 		scnprintf(result, end - result,
 			  "\nERROR: not all trimmed ranges in trimmed list");
-
-unlock:
-	mutex_unlock(&bc->ranges_lock);
 }
 
 static void dm_bow_status(struct dm_target *ti, status_type_t type,

drivers/usb/gadget/function/f_accessory.c

@@ -854,6 +854,7 @@ static const struct file_operations acc_fops = {
 	.read = acc_read,
 	.write = acc_write,
 	.unlocked_ioctl = acc_ioctl,
+	.compat_ioctl = acc_ioctl,
 	.open = acc_open,
 	.release = acc_release,
 };

fs/incfs/data_mgmt.h

@@ -109,6 +109,9 @@ struct mount_info {
 	struct path mi_backing_dir_path;
 
 	struct dentry *mi_index_dir;
+	/* For stacking mounts, if true, this indicates if the index dir needs
+	 * to be freed for this SB otherwise it was created by lower level SB */
+	bool mi_index_free;
 
 	const struct cred *mi_owner;
 

fs/incfs/vfs.c

@@ -755,7 +755,8 @@ static struct dentry *incfs_lookup_dentry(struct dentry *parent,
 	return result;
 }
 
-static struct dentry *open_or_create_index_dir(struct dentry *backing_dir)
+static struct dentry *open_or_create_index_dir(struct dentry *backing_dir,
+					       bool *created)
 {
 	static const char name[] = ".index";
 	struct dentry *index_dentry;
@@ -769,6 +770,7 @@ static struct dentry *open_or_create_index_dir(struct dentry *backing_dir)
 		return index_dentry;
 	} else if (d_really_is_positive(index_dentry)) {
 		/* Index already exists. */
+		*created = false;
 		return index_dentry;
 	}
 
@@ -787,6 +789,7 @@ static struct dentry *open_or_create_index_dir(struct dentry *backing_dir)
 		return ERR_PTR(-EINVAL);
 	}
 
+	*created = true;
 	return index_dentry;
 }
 
@@ -2175,6 +2178,7 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
 	struct super_block *src_fs_sb = NULL;
 	struct inode *root_inode = NULL;
 	struct super_block *sb = sget(type, NULL, set_anon_super, flags, NULL);
+	bool dir_created = false;
 	int error = 0;
 
 	if (IS_ERR(sb))
@@ -2191,17 +2195,23 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
 
 	BUILD_BUG_ON(PAGE_SIZE != INCFS_DATA_FILE_BLOCK_SIZE);
 
+	if (!dev_name) {
+		pr_err("incfs: Backing dir is not set, filesystem can't be mounted.\n");
+		error = -ENOENT;
+		goto err_deactivate;
+	}
+
 	error = parse_options(&options, (char *)data);
 	if (error != 0) {
 		pr_err("incfs: Options parsing error. %d\n", error);
-		goto err;
+		goto err_deactivate;
 	}
 
 	sb->s_bdi->ra_pages = options.readahead_pages;
 	if (!dev_name) {
 		pr_err("incfs: Backing dir is not set, filesystem can't be mounted.\n");
 		error = -ENOENT;
-		goto err;
+		goto err_deactivate;
 	}
 
 	error = kern_path(dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY,
@@ -2210,55 +2220,64 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
 		!d_really_is_positive(backing_dir_path.dentry)) {
 		pr_err("incfs: Error accessing: %s.\n",
 			dev_name);
-		goto err;
+		goto err_deactivate;
 	}
 	src_fs_sb = backing_dir_path.dentry->d_sb;
 	sb->s_maxbytes = src_fs_sb->s_maxbytes;
+	sb->s_stack_depth = src_fs_sb->s_stack_depth + 1;
+
+	if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
+		error = -EINVAL;
+		goto err_put_path;
+	}
 
 	mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path);
-
 	if (IS_ERR_OR_NULL(mi)) {
 		error = PTR_ERR(mi);
 		pr_err("incfs: Error allocating mount info. %d\n", error);
-		mi = NULL;
+		goto err_put_path;
-		goto err;
 	}
 
-	index_dir = open_or_create_index_dir(backing_dir_path.dentry);
+	sb->s_fs_info = mi;
+	mi->mi_backing_dir_path = backing_dir_path;
+	index_dir = open_or_create_index_dir(backing_dir_path.dentry,
+					     &dir_created);
 	if (IS_ERR_OR_NULL(index_dir)) {
 		error = PTR_ERR(index_dir);
 		pr_err("incfs: Can't find or create .index dir in %s\n",
 			dev_name);
-		goto err;
+		goto err_put_path;
 	}
-	mi->mi_index_dir = index_dir;
 
-	sb->s_fs_info = mi;
+	mi->mi_index_dir = index_dir;
+	mi->mi_index_free = dir_created;
+
 	root_inode = fetch_regular_inode(sb, backing_dir_path.dentry);
 	if (IS_ERR(root_inode)) {
 		error = PTR_ERR(root_inode);
-		goto err;
+		goto err_put_path;
 	}
 
 	sb->s_root = d_make_root(root_inode);
 	if (!sb->s_root) {
 		error = -ENOMEM;
-		goto err;
+		goto err_put_path;
 	}
 	error = incfs_init_dentry(sb->s_root, &backing_dir_path);
 	if (error)
-		goto err;
+		goto err_put_path;
 
 	path_put(&backing_dir_path);
 	sb->s_flags |= SB_ACTIVE;
 
 	pr_debug("incfs: mount\n");
 	return dget(sb->s_root);
-err:
+
-	sb->s_fs_info = NULL;
+err_put_path:
 	path_put(&backing_dir_path);
-	incfs_free_mount_info(mi);
+err_deactivate:
 	deactivate_locked_super(sb);
+	pr_err("incfs: mount failed %d\n", error);
 	return ERR_PTR(error);
 }
 
@@ -2284,11 +2303,22 @@ static int incfs_remount_fs(struct super_block *sb, int *flags, char *data)
 void incfs_kill_sb(struct super_block *sb)
 {
 	struct mount_info *mi = sb->s_fs_info;
+	struct inode *dinode = NULL;
 
 	pr_debug("incfs: unmount\n");
-	incfs_free_mount_info(mi);
+
-	generic_shutdown_super(sb);
+	if (mi) {
-	sb->s_fs_info = NULL;
+		if (mi->mi_backing_dir_path.dentry)
+			dinode = d_inode(mi->mi_backing_dir_path.dentry);
+
+		if (dinode) {
+			if (mi->mi_index_dir && mi->mi_index_free)
+				vfs_rmdir(dinode, mi->mi_index_dir);
+		}
+		incfs_free_mount_info(mi);
+		sb->s_fs_info = NULL;
+	}
+	kill_anon_super(sb);
 }
 
 static int show_options(struct seq_file *m, struct dentry *root)