commit e545f0d8a54a9594fe604d67d80ca6fddf72ca59 upstream.

If secure authentication of a devices fails, either because the device
already has another key uploaded, or there is some other error sending
challenge to the device, and the user only wants to approve the device
just once (without a new key being uploaded to the device) the current
implementation does not allow this because the key cannot be cleared
once set even if we allow it to be changed.

Make this scenario possible and allow clearing the key by writing
empty string to the key sysfs file.

Signed-off-by: Yehezkel Bernat <yehezkel.bernat@intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull MTD updates from Brian Norris:
 "General updates:
   - Cleanups and additional flash support for "dataflash" driver
   - new driver for mchp23k256 SPI SRAM device
   - improve handling of MTDs without eraseblocks (i.e., MTD_NO_ERASE)
   - refactor and improve "sub-partition" handling with TRX partition
     parser; partitions can now be created as sub-partitions of another
     partition

  SPINOR updates, from Cyrille Pitchen and Marek Vasut:
   - introduce support to the SPI 1-2-2 and 1-4-4 protocols.
   - introduce support to the Double Data Rate (DDR) mode.
   - introduce support to the Octo SPI protocols.
   - add support to new memory parts for Spansion, Macronix and Winbond.
   - add fixes for the Aspeed, STM32 and Cadence QSPI controler drivers.
   - clean up the st_spi_fsm driver.

  NAND updates, from Boris Brezillon:
   - addition of on-die ECC support to Micron driver
   - addition of helpers to help drivers choose most appropriate ECC
     settings
   - deletion of dead-code (cached programming and ->errstat() hook)
   - make sure drivers that do not support the SET/GET FEATURES command
     return ENOTSUPP use a dummy ->set/get_features implementation
     returning -ENOTSUPP (required for Micron on-die ECC)
   - change the semantic of ecc->write_page() for drivers setting the
     NAND_ECC_CUSTOM_PAGE_ACCESS flag
   - support exiting 'GET STATUS' command in default ->cmdfunc()
     implementations
   - change the prototype of ->setup_data_interface()

  A bunch of driver related changes:
   - various cleanup, fixes and improvements of the MTK driver
   - OMAP DT bindings fixes
   - support for ->setup_data_interface() in the fsmc driver
   - support for imx7 in the gpmi driver
   - finalization of the denali driver rework (thanks to Masahiro for
     the work he's done on this driver)
   - fix "bitflips in erased pages" handling in the ifc driver
   - addition of PM ops and dynamic timing configuration to the atmel
     driver"

* tag 'for-linus-20170713' of git://git.infradead.org/linux-mtd: (118 commits)
  Documentation: ABI: mtd: describe "offset" more precisely
  mtd: Fix check in mtd_unpoint()
  mtd: nand: mtk: release lock on error path
  mtd: st_spi_fsm: remove SPINOR_OP_RDSR2 and use SPINOR_OP_RDCR instead
  mtd: spi-nor: cqspi: remove duplicate const
  mtd: spi-nor: Add support for Spansion S25FL064L
  mtd: spi-nor: Add support for mx66u51235f
  mtd: nand: mtk: add ->setup_data_interface() hook
  mtd: nand: mtk: remove unneeded mtk_ecc_hw_init from mtk_ecc_resume
  mtd: nand: mtk: remove unneeded mtk_nfc_hw_init from mtk_nfc_resume
  mtd: nand: mtk: disable ecc irq when writing page with hwecc
  mtd: nand: mtk: fix incorrect register setting order about ecc irq
  mtd: partitions: fixup some allocate_partition() whitespace
  mtd: parsers: trx: fix pr_err format for printing offset
  MAINTAINERS: Update SPI NOR subsystem git repositories
  mtd: extract TRX parser out of bcm47xxpart into a separated module
  mtd: partitions: add support for partition parsers
  mtd: partitions: add support for subpartitions
  mtd: partitions: rename "master" to the "parent" where appropriate
  mtd: partitions: remove sysfs files when deleting all master's partitions
  ...

So far Linux supported only two levels of MTD devices so we didn't need
a very precise description for this sysfs file. With commit
97519dc52b44a ("mtd: partitions: add support for subpartitions") there
is support for a tree structure so we should have more precise
description. Using "parent" and "flash device" makes it more accurate.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Pull f2fs updates from Jaegeuk Kim:
 "In this round, we've added new features such as disk quota and statx,
  and modified internal bio management flow to merge more IOs depending
  on block types. We've also made internal threads freezeable for
  Android battery life. In addition to them, there are some patches to
  avoid lock contention as well as a couple of deadlock conditions.

  Enhancements:
   - support usrquota, grpquota, and statx
   - manage DATA/NODE typed bios separately to serialize more IOs
   - modify f2fs_lock_op/wio_mutex to avoid lock contention
   - prevent lock contention in migratepage

  Bug fixes:
   - fix missing load of written inode flag
   - fix worst case victim selection in GC
   - freezeable GC and discard threads for Android battery life
   - sanitize f2fs metadata to deal with security hole
   - clean up sysfs-related code and docs"

* tag 'for-f2fs-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (59 commits)
  f2fs: support plain user/group quota
  f2fs: avoid deadlock caused by lock order of page and lock_op
  f2fs: use spin_{,un}lock_irq{save,restore}
  f2fs: relax migratepage for atomic written page
  f2fs: don't count inode block in in-memory inode.i_blocks
  Revert "f2fs: fix to clean previous mount option when remount_fs"
  f2fs: do not set LOST_PINO for renamed dir
  f2fs: do not set LOST_PINO for newly created dir
  f2fs: skip ->writepages for {mete,node}_inode during recovery
  f2fs: introduce __check_sit_bitmap
  f2fs: stop gc/discard thread in prior during umount
  f2fs: introduce reserved_blocks in sysfs
  f2fs: avoid redundant f2fs_flush after remount
  f2fs: report # of free inodes more precisely
  f2fs: add ioctl to do gc with target block address
  f2fs: don't need to check encrypted inode for partial truncation
  f2fs: measure inode.i_blocks as generic filesystem
  f2fs: set CP_TRIMMED_FLAG correctly
  f2fs: require key for truncate(2) of encrypted file
  f2fs: move sysfs code from super.c to fs/f2fs/sysfs.c
  ...

Pull DeviceTree updates from Rob Herring:

 - vsprintf format specifier %pOF for device_node's. This will enable us
   to stop storing the full node names. Conversion of users will happen
   next cycle.

 - Update documentation to point to DT specification instead of ePAPR.

 - Split out graph and property functions to a separate file.

 - New of-graph functions for ALSA

 - Add vendor prefixes for RISC-V, Linksys, iWave Systems, Roofull,
   Itead, and BananaPi.

 - Improve dtx_diff utility filename printing.

* tag 'devicetree-for-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (32 commits)
  of: document /sys/firmware/fdt
  dt-bindings: Add RISC-V vendor prefix
  vsprintf: Add %p extension "%pOF" for device tree
  of: find_node_by_full_name rewrite to compare each level
  of: use kbasename instead of open coding
  dt-bindings: thermal: add file extension to brcm,ns-thermal
  of: update ePAPR references to point to Devicetree Specification
  scripts/dtc: dtx_diff - Show real file names in diff header
  of: detect invalid phandle in overlay
  of: be consistent in form of file mode
  of: make __of_attach_node() static
  of: address.c header comment typo
  of: fdt.c header comment typo
  of: make of_fdt_is_compatible() static
  dt-bindings: display-timing.txt convert non-ascii characters to ascii
  Documentation: remove overlay-notes reference to non-existent file
  dt-bindings: usb: exynos-usb: Add missing required VDD properties
  dt-bindings: Add vendor prefix for Linksys
  MAINTAINERS: add device tree ABI documentation file
  of: Add vendor prefix for iWave Systems Technologies Pvt. Ltd
  ...

In this patch, we add a new sysfs interface, with it, we can control
number of reserved blocks in system which could not be used by user,
it enable f2fs to let user to configure for adjusting over-provision
ratio dynamically instead of changing it by mkfs.

So we can expect it will help to reserve more free space for relieving
GC in both filesystem and flash device.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

Pull xen updates from Juergen Gross:
 "Other than fixes and cleanups it contains:

   - support > 32 VCPUs at domain restore

   - support for new sysfs nodes related to Xen

   - some performance tuning for Linux running as Xen guest"

* tag 'for-linus-4.13-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  x86/xen: allow userspace access during hypercalls
  x86: xen: remove unnecessary variable in xen_foreach_remap_area()
  xen: allocate page for shared info page from low memory
  xen: avoid deadlock in xenbus driver
  xen: add sysfs node for hypervisor build id
  xen: sync include/xen/interface/version.h
  xen: add sysfs node for guest type
  doc,xen: document hypervisor sysfs nodes for xen
  xen/vcpu: Handle xen_vcpu_setup() failure at boot
  xen/vcpu: Handle xen_vcpu_setup() failure in hotplug
  xen/pv: Fix OOPS on restore for a PV, !SMP domain
  xen/pvh*: Support > 32 VCPUs at domain restore
  xen/vcpu: Simplify xen_vcpu related code
  xen-evtchn: Bind dyn evtchn:qemu-dm interrupt to next online VCPU
  xen: avoid type warning in xchg_xen_ulong
  xen: fix HYPERVISOR_dm_op() prototype
  xen: don't print error message in case of missing Xenstore entry
  arm/xen: Adjust one function call together with a variable assignment
  arm/xen: Delete an error message for a failed memory allocation in __set_phys_to_machine_multi()
  arm/xen: Improve a size determination in __set_phys_to_machine_multi()

Pull x86 platform driver updates from Darren Hart:
 "Introduce new bus architecture for WMI and expose BMOF data through
  sysfs. Correct several assumptions about WMI instance number from 1 to
  0. Further fujitsu-laptop cleanups, continuing to prepare for
  separation into two modules. Add support for several new ideapad
  laptops and silead-based tablets. Various minor fixes and const
  cleanups.

  Detail summary:

  sony-laptop:
   - constify attribute_group and input index array

  fujitsu-laptop:
   - rework debugging
   - do not evaluate ACPI _INI methods
   - do not update ACPI device power status
   - sanitize hotkey input device identification
   - use strcpy to set ACPI device names and classes
   - remove redundant safety checks
   - use device-specific data in remaining module code
   - use device-specific data in LED-related code
   - explicitly pass ACPI device to call_fext_func()
   - track the last instantiated FUJ02E3 ACPI device
   - allocate fujitsu_laptop in acpi_fujitsu_laptop_add()
   - use device-specific data in backlight code
   - allocate fujitsu_bl in acpi_fujitsu_bl_add()
   - distinguish current uses of device-specific data

  msi-laptop:
   - constify msipf*_attribute_group

  eeepc-laptop:
   - constify platform_attribute_group

  toshiba_haps:
   - constify haps_attr_group

  dell-wmi-led:
   - Adjust instance of wmi_evaluate_method calls to 0

  alienware-wmi:
   - Adjust instance of wmi_evaluate_method calls to 0

  intel_menlow:
   - Add const to thermal_cooling_device_ops structure

  acerhdf:
   - Add const to thermal_cooling_device_ops structure

  dell-laptop:
   - Fix bogus keyboard backlight sysfs interface

  acer-wmi:
   - Using zero as first WMI instance number
   - Detect RF Button capability

  ideapad-laptop:
   - Add Y720-15IKBN to no_hw_rfkill
   - Add Y520-15IKBN to no_hw_rfkill
   - constify rfkill_ops structure
   - Squelch ACPI event 1
   - hide unused 'touchpad_store'
   - Switch touchpad attribute to be RO
   - Add sysfs interface for touchpad state

  silead_dmi:
   - Add touchscreen info for PoV mobii wintab p800w
   - Add touchscreen info for Pipo W2S tablet
   - Add touchscreen info for GP-electronic T701

  dell-rbtn:
   - constify rfkill_ops structures
   - Improve explanation about DELLABC6

  samsung-laptop:
   - constify rfkill_ops structures

  panasonic-laptop:
   - remove unused code

  samsung-laptop:
   - Initialize loca variable

  dell-wmi:
   - Convert to the WMI bus infrastructure
   - Add a better description for "stealth mode"
   - Add a comment explaining the 0xb2 magic number

  wmi-bmof:
   - New driver to expose embedded Binary WMI MOF metadata

  wmi*:
   - Fix printing info about WDG structure
   - Add recent copyright statements
   - Require query for data blocks, rename writable to setable
   - Add an interface for subdrivers to access sibling devices
   - Bind the platform device, not the ACPI node
   - Add a new interface to read block data
   - Incorporate acpi_install_notify_handler
   - Instantiate all devices before adding them
   - Probe data objects for read and write capabilities
   - Split devices into types and add basic sysfs attributes
   - Fix error handling when creating devices
   - Turn WMI into a bus driver
   - Track wmi devices per ACPI device
   - Clean up acpi_wmi_add
   - Pass the acpi_device through to parse_wdg
   - Drop "Mapper (un)loaded" messages

  intel_cht_int33fe:
   - Set supplied-from property on max17047 dev

  intel_pmc_ipc:
   - Mark ipc_data_readb() as __maybe_unused

  topstar-laptop:
   - Add new device id

  peaq-wmi:
   - Add new peaq-wmi driver

  thinkpad_acpi:
   - Add a comment about 0 in module_param_call()
   - Join string literals back

  toshiba_acpi:
   - use memdup_user_nul"

* tag 'platform-drivers-x86-v4.13-1' of git://git.infradead.org/linux-platform-drivers-x86: (67 commits)
  platform/x86: sony-laptop: constify attribute_group and input index array
  platform/x86: fujitsu-laptop: rework debugging
  platform/x86: fujitsu-laptop: do not evaluate ACPI _INI methods
  platform/x86: fujitsu-laptop: do not update ACPI device power status
  platform/x86: fujitsu-laptop: sanitize hotkey input device identification
  platform/x86: fujitsu-laptop: use strcpy to set ACPI device names and classes
  platform/x86: fujitsu-laptop: remove redundant safety checks
  platform/x86: msi-laptop: constify msipf*_attribute_group
  platform/x86: eeepc-laptop: constify platform_attribute_group
  platform/x86: toshiba_haps: constify haps_attr_group
  platform/x86: dell-wmi-led: Adjust instance of wmi_evaluate_method calls to 0
  platform/x86: alienware-wmi: Adjust instance of wmi_evaluate_method calls to 0
  platform/x86: intel_menlow: Add const to thermal_cooling_device_ops structure
  platform/x86: acerhdf: Add const to thermal_cooling_device_ops structure
  platform/x86: dell-laptop: Fix bogus keyboard backlight sysfs interface
  platform/x86: acer-wmi: Using zero as first WMI instance number
  platform/x86: ideapad-laptop: Add Y720-15IKBN to no_hw_rfkill
  platform/x86: ideapad-laptop: Add Y520-15IKBN to no_hw_rfkill
  platform/x86: silead_dmi: Add touchscreen info for PoV mobii wintab p800w
  platform/x86: silead_dmi: Add touchscreen info for Pipo W2S tablet
  ...

Pull networking updates from David Miller:
 "Reasonably busy this cycle, but perhaps not as busy as in the 4.12
  merge window:

   1) Several optimizations for UDP processing under high load from
      Paolo Abeni.

   2) Support pacing internally in TCP when using the sch_fq packet
      scheduler for this is not practical. From Eric Dumazet.

   3) Support mutliple filter chains per qdisc, from Jiri Pirko.

   4) Move to 1ms TCP timestamp clock, from Eric Dumazet.

   5) Add batch dequeueing to vhost_net, from Jason Wang.

   6) Flesh out more completely SCTP checksum offload support, from
      Davide Caratti.

   7) More plumbing of extended netlink ACKs, from David Ahern, Pablo
      Neira Ayuso, and Matthias Schiffer.

   8) Add devlink support to nfp driver, from Simon Horman.

   9) Add RTM_F_FIB_MATCH flag to RTM_GETROUTE queries, from Roopa
      Prabhu.

  10) Add stack depth tracking to BPF verifier and use this information
      in the various eBPF JITs. From Alexei Starovoitov.

  11) Support XDP on qed device VFs, from Yuval Mintz.

  12) Introduce BPF PROG ID for better introspection of installed BPF
      programs. From Martin KaFai Lau.

  13) Add bpf_set_hash helper for TC bpf programs, from Daniel Borkmann.

  14) For loads, allow narrower accesses in bpf verifier checking, from
      Yonghong Song.

  15) Support MIPS in the BPF selftests and samples infrastructure, the
      MIPS eBPF JIT will be merged in via the MIPS GIT tree. From David
      Daney.

  16) Support kernel based TLS, from Dave Watson and others.

  17) Remove completely DST garbage collection, from Wei Wang.

  18) Allow installing TCP MD5 rules using prefixes, from Ivan
      Delalande.

  19) Add XDP support to Intel i40e driver, from Björn Töpel

  20) Add support for TC flower offload in nfp driver, from Simon
      Horman, Pieter Jansen van Vuuren, Benjamin LaHaise, Jakub
      Kicinski, and Bert van Leeuwen.

  21) IPSEC offloading support in mlx5, from Ilan Tayari.

  22) Add HW PTP support to macb driver, from Rafal Ozieblo.

  23) Networking refcount_t conversions, From Elena Reshetova.

  24) Add sock_ops support to BPF, from Lawrence Brako. This is useful
      for tuning the TCP sockopt settings of a group of applications,
      currently via CGROUPs"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1899 commits)
  net: phy: dp83867: add workaround for incorrect RX_CTRL pin strap
  dt-bindings: phy: dp83867: provide a workaround for incorrect RX_CTRL pin strap
  cxgb4: Support for get_ts_info ethtool method
  cxgb4: Add PTP Hardware Clock (PHC) support
  cxgb4: time stamping interface for PTP
  nfp: default to chained metadata prepend format
  nfp: remove legacy MAC address lookup
  nfp: improve order of interfaces in breakout mode
  net: macb: remove extraneous return when MACB_EXT_DESC is defined
  bpf: add missing break in for the TCP_BPF_SNDCWND_CLAMP case
  bpf: fix return in load_bpf_file
  mpls: fix rtm policy in mpls_getroute
  net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t
  net, ax25: convert ax25_route.refcount from atomic_t to refcount_t
  net, ax25: convert ax25_uid_assoc.refcount from atomic_t to refcount_t
  net, sctp: convert sctp_ep_common.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_transport.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_chunk.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_datamsg.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_auth_bytes.refcnt from atomic_t to refcount_t
  ...

Pull security layer updates from James Morris:

 - a major update for AppArmor. From JJ:

     * several bug fixes and cleanups

     * the patch to add symlink support to securityfs that was floated
       on the list earlier and the apparmorfs changes that make use of
       securityfs symlinks

     * it introduces the domain labeling base code that Ubuntu has been
       carrying for several years, with several cleanups applied. And it
       converts the current mediation over to using the domain labeling
       base, which brings domain stacking support with it. This finally
       will bring the base upstream code in line with Ubuntu and provide
       a base to upstream the new feature work that Ubuntu carries.

     * This does _not_ contain any of the newer apparmor mediation
       features/controls (mount, signals, network, keys, ...) that
       Ubuntu is currently carrying, all of which will be RFC'd on top
       of this.

 - Notable also is the Infiniband work in SELinux, and the new file:map
   permission. From Paul:

      "While we're down to 21 patches for v4.13 (it was 31 for v4.12),
       the diffstat jumps up tremendously with over 2k of line changes.

       Almost all of these changes are the SELinux/IB work done by
       Daniel Jurgens; some other noteworthy changes include a NFS v4.2
       labeling fix, a new file:map permission, and reporting of policy
       capabilities on policy load"

   There's also now genfscon labeling support for tracefs, which was
   lost in v4.1 with the separation from debugfs.

 - Smack incorporates a safer socket check in file_receive, and adds a
   cap_capable call in privilege check.

 - TPM as usual has a bunch of fixes and enhancements.

 - Multiple calls to security_add_hooks() can now be made for the same
   LSM, to allow LSMs to have hook declarations across multiple files.

 - IMA now supports different "ima_appraise=" modes (eg. log, fix) from
   the boot command line.

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (126 commits)
  apparmor: put back designators in struct initialisers
  seccomp: Switch from atomic_t to recount_t
  seccomp: Adjust selftests to avoid double-join
  seccomp: Clean up core dump logic
  IMA: update IMA policy documentation to include pcr= option
  ima: Log the same audit cause whenever a file has no signature
  ima: Simplify policy_func_show.
  integrity: Small code improvements
  ima: fix get_binary_runtime_size()
  ima: use ima_parse_buf() to parse template data
  ima: use ima_parse_buf() to parse measurements headers
  ima: introduce ima_parse_buf()
  ima: Add cgroups2 to the defaults list
  ima: use memdup_user_nul
  ima: fix up #endif comments
  IMA: Correct Kconfig dependencies for hash selection
  ima: define is_ima_appraise_enabled()
  ima: define Kconfig IMA_APPRAISE_BOOTPARAM option
  ima: define a set of appraisal rules requiring file signatures
  ima: extend the "ima_policy" boot command line to support multiple policies
  ...