Merge branch 'android-msm-pixel-4.19-sc-security' into android-msm-pixel-4.19-sc-v2
May 2022.1
Bug: 218985673
Change-Id: I01bb69aedb8ff9a00807d873303f4ce895abf8bf
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index fd36e7c..409ab0c 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1735,32 +1735,32 @@
struct mmc_card *card = mq->card;
struct mmc_host *host = card->host;
blk_status_t error = BLK_STS_OK;
- int retries = 0;
do {
u32 status;
int err;
+ int retries = 0;
- mmc_blk_rw_rq_prep(mqrq, card, 1, mq);
+ while (retries++ <= MMC_READ_SINGLE_RETRIES) {
+ mmc_blk_rw_rq_prep(mqrq, card, 1, mq);
- mmc_wait_for_req(host, mrq);
+ mmc_wait_for_req(host, mrq);
- err = mmc_send_status(card, &status);
- if (err)
- goto error_exit;
-
- if (!mmc_host_is_spi(host) &&
- !mmc_blk_in_tran_state(status)) {
- err = mmc_blk_fix_state(card, req);
+ err = mmc_send_status(card, &status);
if (err)
goto error_exit;
+
+ if (!mmc_host_is_spi(host) &&
+ !mmc_blk_in_tran_state(status)) {
+ err = mmc_blk_fix_state(card, req);
+ if (err)
+ goto error_exit;
+ }
+
+ if (!mrq->cmd->error)
+ break;
}
- if (mrq->cmd->error && retries++ < MMC_READ_SINGLE_RETRIES)
- continue;
-
- retries = 0;
-
if (mrq->cmd->error ||
mrq->data->error ||
(!mmc_host_is_spi(host) &&
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 39e6e978..4391962 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -393,6 +393,7 @@
return 0;
pipe->nrbufs++;
buf->ops = &page_cache_pipe_buf_ops;
+ buf->flags = 0;
get_page(buf->page = page);
buf->offset = offset;
buf->len = bytes;
@@ -517,6 +518,7 @@
break;
pipe->nrbufs++;
pipe->bufs[idx].ops = &default_pipe_buf_ops;
+ pipe->bufs[idx].flags = 0;
pipe->bufs[idx].page = page;
pipe->bufs[idx].offset = 0;
if (left <= PAGE_SIZE) {
diff --git a/net/netfilter/xt_qtaguid.c b/net/netfilter/xt_qtaguid.c
index a61f436..635fcf7 100644
--- a/net/netfilter/xt_qtaguid.c
+++ b/net/netfilter/xt_qtaguid.c
@@ -1067,18 +1067,6 @@
return sock_tag_tree_search(&sock_tag_tree, sk);
}
-static struct sock_tag *get_sock_stat(const struct sock *sk)
-{
- struct sock_tag *sock_tag_entry;
- MT_DEBUG("qtaguid: get_sock_stat(sk=%p)\n", sk);
- if (!sk)
- return NULL;
- spin_lock_bh(&sock_tag_list_lock);
- sock_tag_entry = get_sock_stat_nl(sk);
- spin_unlock_bh(&sock_tag_list_lock);
- return sock_tag_entry;
-}
-
static int ipx_proto(const struct sk_buff *skb,
struct xt_action_param *par)
{
@@ -1313,12 +1301,15 @@
* Look for a tagged sock.
* It will have an acct_uid.
*/
- sock_tag_entry = get_sock_stat(sk);
+ spin_lock_bh(&sock_tag_list_lock);
+ sock_tag_entry = sk ? get_sock_stat_nl(sk) : NULL;
if (sock_tag_entry) {
tag = sock_tag_entry->tag;
acct_tag = get_atag_from_tag(tag);
uid_tag = get_utag_from_tag(tag);
- } else {
+ }
+ spin_unlock_bh(&sock_tag_list_lock);
+ if (!sock_tag_entry) {
acct_tag = make_atag_from_value(0);
tag = combine_atag_with_uid(acct_tag, uid);
uid_tag = make_tag_from_uid(uid);
