Merge branch 'android-4.14-spl-topic' into exynos9609

Change-Id: I1d2f8981e4f53d40d9149fa555e24702d6985226

diff --cc drivers/android/binder.c
index dddd93a40107137725116e150d71385b1b5661e1,7a49ff6b5778f621909d8139028c7ee59ccdfb19..4344956cd59d9fd657b3af59b82942c440fae6f5
--- 1/drivers/android/binder.c
--- 2/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@@ -3228,9 -3126,20 +3230,23 @@@ static void binder_transaction(struct b
                t->priority = target_proc->default_priority;
        }
  
+       if (target_node && target_node->txn_security_ctx) {
+               u32 secid;
+ 
+               security_task_getsecid(proc->tsk, &secid);
+               ret = security_secid_to_secctx(secid, &secctx, &secctx_sz);
+               if (ret) {
+                       return_error = BR_FAILED_REPLY;
+                       return_error_param = ret;
+                       return_error_line = __LINE__;
+                       goto err_get_secctx_failed;
+               }
+               extra_buffers_size += ALIGN(secctx_sz, sizeof(u64));
+       }
+ 
 +#ifdef CONFIG_DEBUG_SNAPSHOT_BINDER
 +      dss_binder_transaction(reply, t, t->from ? t->from : thread, target_node ? target_node->debug_id : 0);
 +#endif
        trace_binder_transaction(reply, t, target_node);
  
        t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
@@@ -3753,14 -3667,18 +3784,18 @@@ static int binder_thread_write(struct b
  
                        buffer = binder_alloc_prepare_to_free(&proc->alloc,
                                                              data_ptr);
-                       if (buffer == NULL) {
-                               binder_user_error("%d:%d(%s:%s) BC_FREE_BUFFER u%016llx no match\n",
-                                       proc->pid, thread->pid, proc->tsk->comm, thread->task->comm, (u64)data_ptr);
-                               break;
-                       }
-                       if (!buffer->allow_user_free) {
-                               binder_user_error("%d:%d(%s:%s) BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
-                                       proc->pid, thread->pid, proc->tsk->comm, thread->task->comm, (u64)data_ptr);
+                       if (IS_ERR_OR_NULL(buffer)) {
+                               if (PTR_ERR(buffer) == -EPERM) {
+                                       binder_user_error(
 -                                              "%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
 -                                              proc->pid, thread->pid,
++                                              "%d:%d(%s:%s) BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
++                                              proc->pid, thread->pid, proc->tsk->comm, thread->task->comm,
+                                               (u64)data_ptr);
+                               } else {
+                                       binder_user_error(
 -                                              "%d:%d BC_FREE_BUFFER u%016llx no match\n",
 -                                              proc->pid, thread->pid,
++                                              "%d:%d(%s:%s) BC_FREE_BUFFER u%016llx no match\n",
++                                              proc->pid, thread->pid, proc->tsk->comm, thread->task->comm,
+                                               (u64)data_ptr);
+                               }
                                break;
                        }
                        binder_debug(BINDER_DEBUG_FREE_BUFFER,
@@@ -4430,25 -4350,21 +4474,27 @@@ retry
  
                        return -EFAULT;
                }
-               ptr += sizeof(tr);
+               ptr += trsize;
  
 +#ifdef CONFIG_DEBUG_SNAPSHOT_BINDER
 +              dss_binder_transaction_received(t, thread);
 +#endif
                trace_binder_transaction_received(t);
                binder_stat_br(proc, thread, cmd);
                binder_debug(BINDER_DEBUG_TRANSACTION,
 -                           "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n",
 -                           proc->pid, thread->pid,
 +                           "%d:%d(%s:%s) %s %d %d:%d(%s:%s), cmd %d size %zd-%zd ptr %016llx-%016llx\n",
 +                           proc->pid, thread->pid, proc->tsk->comm, thread->task->comm,
                             (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
-                            "BR_REPLY",
+                               (cmd == BR_TRANSACTION_SEC_CTX) ?
+                                    "BR_TRANSACTION_SEC_CTX" : "BR_REPLY",
                             t->debug_id, t_from ? t_from->proc->pid : 0,
 -                           t_from ? t_from->pid : 0, cmd,
 +                           t_from ? t_from->pid : 0,
 +                           t_from ? t_from->proc->tsk->comm : "",
 +                           t_from ? t_from->task->comm : "",
 +                           cmd,
                             t->buffer->data_size, t->buffer->offsets_size,
-                            (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets);
+                            (u64)trd->data.ptr.buffer,
+                            (u64)trd->data.ptr.offsets);
  
                if (t_from)
                        binder_thread_dec_tmpref(t_from);

diff --cc drivers/android/binder_alloc.c
Simple merge