Merge tag 'v4.9.220' into 4.9-2.3.x-imx

This is the 4.9.220 stable release

Conflicts:
	arch/arm/Kconfig.debug
	arch/arm/boot/dts/imx7s.dtsi
	arch/arm/mach-imx/common.h
	arch/arm/mach-imx/cpuidle-imx6q.c
	arch/arm/mach-imx/cpuidle-imx6sx.c
	arch/arm/mach-imx/suspend-imx6.S
	block/blk-core.c
	drivers/crypto/caam/caamalg.c
	drivers/crypto/mxs-dcp.c
	drivers/dma/imx-sdma.c
	drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
	drivers/input/keyboard/imx_keypad.c
	drivers/input/keyboard/snvs_pwrkey.c
	drivers/mmc/host/sdhci.c
	drivers/net/can/flexcan.c
	drivers/net/ethernet/freescale/fec_main.c
	drivers/net/phy/phy_device.c
	drivers/net/wireless/ath/ath10k/pci.c
	drivers/tty/serial/imx.c
	drivers/usb/dwc3/gadget.c
	drivers/usb/host/xhci.c
	include/linux/blkdev.h
	include/linux/cpu.h
	include/linux/platform_data/dma-imx-sdma.h
	kernel/cpu.c
	net/wireless/util.c
	sound/soc/fsl/Kconfig
	sound/soc/fsl/fsl_esai.c
	sound/soc/fsl/fsl_sai.c
	sound/soc/fsl/imx-sgtl5000.c

1 files changed, 28 insertions, 0 deletions

diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index c6314d1552ea..99fd4f53c856 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -370,8 +370,23 @@ static inline vm_flags_t calc_vm_may_flags(unsigned long prot)
 	       _calc_vm_trans(prot, PROT_EXEC,  VM_MAYEXEC);
 }
 
+static int ashmem_vmfile_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	/* do not allow to mmap ashmem backing shmem file directly */
+	return -EPERM;
+}
+
+static unsigned long
+ashmem_vmfile_get_unmapped_area(struct file *file, unsigned long addr,
+				unsigned long len, unsigned long pgoff,
+				unsigned long flags)
+{
+	return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+}
+
 static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
 {
+	static struct file_operations vmfile_fops;
 	struct ashmem_area *asma = file->private_data;
 	int ret = 0;
 
@@ -412,6 +427,19 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
 		}
 		vmfile->f_mode |= FMODE_LSEEK;
 		asma->file = vmfile;
+		/*
+		 * override mmap operation of the vmfile so that it can't be
+		 * remapped which would lead to creation of a new vma with no
+		 * asma permission checks. Have to override get_unmapped_area
+		 * as well to prevent VM_BUG_ON check for f_ops modification.
+		 */
+		if (!vmfile_fops.mmap) {
+			vmfile_fops = *vmfile->f_op;
+			vmfile_fops.mmap = ashmem_vmfile_mmap;
+			vmfile_fops.get_unmapped_area =
+					ashmem_vmfile_get_unmapped_area;
+		}
+		vmfile->f_op = &vmfile_fops;
 	}
 	get_file(asma->file);