From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751871AbbK1Mib (ORCPT ); Sat, 28 Nov 2015 07:38:31 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:58644 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751087AbbK1MiX (ORCPT ); Sat, 28 Nov 2015 07:38:23 -0500 Message-ID: <1448714292.1990.1.camel@decadent.org.uk> Subject: Linux 3.2.74 From: Ben Hutchings To: linux-kernel@vger.kernel.org, Andrew Morton , torvalds@linux-foundation.org, Jiri Slaby , stable@vger.kernel.org Cc: lwn@lwn.net Date: Sat, 28 Nov 2015 12:38:12 +0000 Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-8pwWhx2Bdd/pdLXb5zV+" X-Mailer: Evolution 3.18.2-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 46.233.112.252 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-8pwWhx2Bdd/pdLXb5zV+ Content-Type: multipart/mixed; boundary="=-+ucCKqsbQMP/Uf02XI2k" --=-+ucCKqsbQMP/Uf02XI2k Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 SSdtIGFubm91bmNpbmcgdGhlIHJlbGVhc2Ugb2YgdGhlIDMuMi43NCBrZXJuZWwuCgpBbGwgdXNl cnMgb2YgdGhlIDMuMiBrZXJuZWwgc2VyaWVzIHNob3VsZCB1cGdyYWRlLgoKVGhlIHVwZGF0ZWQg My4yLnkgZ2l0IHRyZWUgY2FuIGJlIGZvdW5kIGF0OgrCoMKgwqDCoMKgwqDCoMKgaHR0cHM6Ly9n aXQua2VybmVsLm9yZy9wdWIvc2NtL2xpbnV4L2tlcm5lbC9naXQvc3RhYmxlL2xpbnV4LXN0YWJs ZS5naXQgbGludXgtMy4yLnkKYW5kIGNhbiBiZSBicm93c2VkIGF0IHRoZSBub3JtYWwga2VybmVs Lm9yZyBnaXQgd2ViIGJyb3dzZXI6CsKgwqDCoMKgwqDCoMKgwqBodHRwczovL2dpdC5rZXJuZWwu b3JnLz9wPWxpbnV4L2tlcm5lbC9naXQvc3RhYmxlL2xpbnV4LXN0YWJsZS5naXQKClRoZSBkaWZm IGZyb20gMy4yLjczIGlzIGF0dGFjaGVkIHRvIHRoaXMgbWVzc2FnZS4KCkJlbi4KCi0tLS0tLS0t LS0tLQoKwqBEb2N1bWVudGF0aW9uL3N5c2N0bC9mcy50eHTCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqB8wqDCoDE4ICsrLQrCoE1ha2VmaWxlwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgMiArLQrCoGFy Y2gvYXJtL21hY2gtcHhhL2luY2x1ZGUvbWFjaC9weGEyN3guaMKgwqDCoHzCoMKgwqAyICstCsKg YXJjaC9hcm0vbWFjaC1weGEvcHhhMjd4LmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oHzCoMKgwqAyICstCsKgYXJjaC9taXBzL2luY2x1ZGUvYXNtL2F0b21pYy5owqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgfMKgwqDCoDIgKy0KwqBhcmNoL3g4Ni9rZXJuZWwvaGVhZF82NC5TwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgwqA4ICsrCsKgYXJjaC94ODYva2VybmVs L3ZlcmlmeV9jcHUuU8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoDEyICstCsKgYXJj aC94ODYva3ZtL3N2bS5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgfMKgwqAxNCArLS0KwqBjcnlwdG8vYWxnaWZfaGFzaC5jwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgMTIgKy0KwqBkcml2ZXJzL2FjcGkvb3Ns LmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKg OSArLQrCoGRyaXZlcnMvYmx1ZXRvb3RoL2F0aDNrLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgfMKgwqDCoDQgKwrCoGRyaXZlcnMvYmx1ZXRvb3RoL2J0dXNiLmPCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDIgKwrCoGRyaXZlcnMvZmlyZXdpcmUvb2hj aS5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgNSArCsKgZHJp dmVycy9oaWQvaGlkLWNvcmUuY8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqB8wqDCoMKgMiArLQrCoGRyaXZlcnMvaW9tbXUvaW50ZWwtaW9tbXUuY8KgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoHzCoMKgwqA3ICstCsKgZHJpdmVycy9tdGQvbXRkX2Jsa2RldnMuY8Kg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoDEwICstCsKgZHJpdmVycy9tdGQv bXRkcGFydC5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDC oDQgKy0KwqBkcml2ZXJzL25ldC9jYW4vZGV2LmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqB8wqDCoMKgMiArLQrCoGRyaXZlcnMvbmV0L3dpcmVsZXNzL213aWZpZXgv ZGVidWdmcy5jwqDCoMKgwqB8wqDCoDE0ICstLQrCoGRyaXZlcnMvcGNpL2FjY2Vzcy5jwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoDI3ICstLS0tCsKgZHJp dmVycy9wY2kvcXVpcmtzLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoHzCoMKgMjAgKysrLQrCoGRyaXZlcnMvcG93ZXIvd204MzF4X3Bvd2VyLmPCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDYgKy0KwqBkcml2ZXJzL3Njc2kvbWVnYXJhaWQvbWVn YXJhaWRfc2FzLmjCoMKgwqDCoMKgwqB8wqDCoMKgMiArCsKgZHJpdmVycy9zY3NpL21lZ2FyYWlk L21lZ2FyYWlkX3Nhc19iYXNlLmMgfMKgwqAxNSArKy0KwqBkcml2ZXJzL3Njc2kvc2NzaV9zeXNm cy5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgMTggKy0tCsKgZHJpdmVy cy9zdGFnaW5nL3J0bDg3MTIvdXNiX2ludGYuY8KgwqDCoMKgwqDCoMKgwqB8wqDCoMKgMSArCsKg ZnMvYmluZm10X2VsZi5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgfMKgwqAxMCArLQrCoGZzL2J0cmZzL2N0cmVlLmjCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqAzOSArKysrKy0tCsKgZnMv YnRyZnMvZmlsZS5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgfMKgwqAxOCArKy0KwqBmcy9idHJmcy9pbm9kZS5jwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgOTEgKysrKysrKysrKysrLS0t CsKgZnMvYnRyZnMvaW9jdGwuY8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqB8IDE4OCArKysrKysrKysrKysrKysrKysrKysrKystLS0tLS0KwqBmcy9i dHJmcy9wcmludC10cmVlLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqB8wqDCoMKgMiArLQrCoGZzL2J0cmZzL3RyZWUtbG9nLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDIgKy0KwqBmcy9idHJmcy94YXR0ci5jwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgwqA0 ICstCsKgZnMvY2FjaGVmaWxlcy9yZHdyLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoHzCoMKgNzggKysrKysrKy0tLS0tLQrCoGZzL2V4ZWMuY8KgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzC oMKgNDkgKysrKysrKy0KwqBmcy9leHQ0L3N1cGVyLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoDEyICstCsKgZnMvZnNjYWNoZS9uZXRm cy5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqAz NCArKystLS0KwqBmcy9mc2NhY2hlL3BhZ2UuY8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDIgKy0KwqBmcy9qYmQyL2pvdXJuYWwuY8KgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDYgKy0K wqBmcy9zcGxpY2UuY8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgfMKgwqAxMiArLQrCoGluY2x1ZGUvbGludXgvYWNwaS5owqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgNiArCsKgaW5jbHVk ZS9saW51eC9qYmQyLmjCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oHzCoMKgwqAxICsKwqBpbmNsdWRlL25ldC9pbmV0X2NvbW1vbi5owqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoHzCoMKgwqAzICstCsKga2VybmVsL2V2ZW50cy9jb3JlLmPCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgwqA0ICsKwqBsaWIvZGV2 cmVzLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqB8wqDCoMKgMiArLQrCoG5ldC9jb3JlL2RzdC5jwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgMiArLQrCoG5ldC9pcHY0 L2lwbXIuY8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoHzCoMKgwqA0ICstCsKgbmV0L2lwdjYvdHVubmVsNi5jwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqAxMiArLQrCoG5ldC9pcmRhL2lybG1wLmPC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDC oDIgKy0KwqBuZXQvbWFjODAyMTEvbWxtZS5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoHzCoMKgwqAyICstCsKgbmV0L3BhY2tldC9hZl9wYWNrZXQuY8KgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgNiArLQrCoG5ldC9yZHMv dGNwX3JlY3YuY8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oHzCoMKgMTEgKy0KwqBzY3JpcHRzL3JlY29yZG1jb3VudC5owqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgwqAyICstCsKgc291bmQvcGNpL2hkYS9oZGFfaW50ZWwu Y8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgMiArCsKgc291bmQvcGNp L2hkYS9wYXRjaF9zaWdtYXRlbC5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDEgKwrC oDU2IGZpbGVzIGNoYW5nZWQsIDU4NiBpbnNlcnRpb25zKCspLCAyNDEgZGVsZXRpb25zKC0pCgpB bGV4IFdpbGxpYW1zb24gKDIpOgrCoMKgwqDCoMKgwqBQQ0k6IEZpeCBkZXZmbiBmb3IgVlBEIGFj Y2VzcyB0aHJvdWdoIGZ1bmN0aW9uIDAKwqDCoMKgwqDCoMKgUENJOiBVc2UgZnVuY3Rpb24gMCBW UEQgZm9yIGlkZW50aWNhbCBmdW5jdGlvbnMsIHJlZ3VsYXIgVlBEIGZvciBvdGhlcnMKCkFuaSBT aW5oYSAoMSk6CsKgwqDCoMKgwqDCoGlwbXI6IGZpeCBwb3NzaWJsZSByYWNlIHJlc3VsdGluZyBm cm9tIGltcHJvcGVyIHVzYWdlIG9mIElQX0lOQ19TVEFUU19CSCgpIGluIHByZWVtcHRpYmxlIGNv bnRleHQuCgpBcm5kIEJlcmdtYW5uICgxKToKwqDCoMKgwqDCoMKgQVJNOiBweGE6IHJlbW92ZSBp bmNvcnJlY3QgX19pbml0IGFubm90YXRpb24gb24gcHhhMjd4X3NldF9wd3Jtb2RlCgpCZW4gSHV0 Y2hpbmdzICgxKToKwqDCoMKgwqDCoMKgTGludXggMy4yLjc0CgpCb3JpcyBCUkVaSUxMT04gKDEp OgrCoMKgwqDCoMKgwqBtdGQ6IG10ZHBhcnQ6IGZpeCBhZGRfbXRkX3BhcnRpdGlvbnMgZXJyb3Ig cGF0aAoKQm9yaXNsYXYgUGV0a292ICgxKToKwqDCoMKgwqDCoMKgeDg2L2NwdTogQ2FsbCB2ZXJp ZnlfY3B1KCkgYWZ0ZXIgaGF2aW5nIGVudGVyZWQgbG9uZyBtb2RlIHRvbwoKQnJpYW4gTm9ycmlz ICgxKToKwqDCoMKgwqDCoMKgbXRkOiBibGtkZXZzOiBmaXggcG90ZW50aWFsIGRlYWRsb2NrICsg bG9ja2RlcCB3YXJuaW5ncwoKQ2hlbiBZdSAoMSk6CsKgwqDCoMKgwqDCoEFDUEk6IFVzZSBjb3Jy ZWN0IElSUSB3aGVuIHVuaW5zdGFsbGluZyBBQ1BJIGludGVycnVwdCBoYW5kbGVyCgpDaHJpcyBN YXNvbiAoMSk6CsKgwqDCoMKgwqDCoEJ0cmZzOiBkb24ndCB1c2UgcmFtX2J5dGVzIGZvciB1bmNv bXByZXNzZWQgaW5saW5lIGl0ZW1zCgpDaHJpc3RvcGggSGVsbHdpZyAoMSk6CsKgwqDCoMKgwqDC oHNjc2k6IHJlc3RhcnQgbGlzdCBzZWFyY2ggYWZ0ZXIgdW5sb2NrIGluIHNjc2lfcmVtb3ZlX3Rh cmdldAoKQ2hyaXN0b3BoZSBMZXJveSAoMSk6CsKgwqDCoMKgwqDCoHNwbGljZTogc2VuZGZpbGUo KSBhdCBvbmNlIGZhaWxzIGZvciBiaWcgZmlsZXMKCkRhZWhvIEplb25nICgxKToKwqDCoMKgwqDC oMKgZXh0NCwgamJkMjogZW5zdXJlIGVudGVyaW5nIGludG8gcGFuaWMgYWZ0ZXIgcmVjb3JkaW5n IGFuIGVycm9yIGluIHN1cGVyYmxvY2sKCkRhbiBDYXJwZW50ZXIgKDMpOgrCoMKgwqDCoMKgwqBt d2lmaWV4OiBmaXggbXdpZmlleF9yZGVlcHJvbV9yZWFkKCkKwqDCoMKgwqDCoMKgZGV2cmVzOiBm aXggYSBmb3IgbG9vcCBib3VuZHMgY2hlY2sKwqDCoMKgwqDCoMKgaXJkYTogcHJlY2VkZW5jZSBi dWcgaW4gaXJsbXBfc2VxX2hiX2lkeCgpCgpEYXZpZCBIb3dlbGxzICgxKToKwqDCoMKgwqDCoMKg RlMtQ2FjaGU6IEhhbmRsZSBhIHdyaXRlIHRvIHRoZSBwYWdlIGltbWVkaWF0ZWx5IGJleW9uZCB0 aGUgRU9GIG1hcmtlcgoKRGF2aWQgV29vZGhvdXNlICgxKToKwqDCoMKgwqDCoMKgaW9tbXUvdnQt ZDogRml4IEFUU1IgaGFuZGxpbmcgZm9yIFJvb3QtQ29tcGxleCBpbnRlZ3JhdGVkIGVuZHBvaW50 cwoKRG1pdHJ5IFR1bmluICgyKToKwqDCoMKgwqDCoMKgQmx1ZXRvb3RoOiBhdGgzazogQWRkIG5l dyBBUjMwMTIgMDkzMDowMjFjIGlkCsKgwqDCoMKgwqDCoEJsdWV0b290aDogYXRoM2s6IEFkZCBz dXBwb3J0IG9mIEFSMzAxMiAwY2YzOjgxN2IgZGV2aWNlCgpFcmljIER1bWF6ZXQgKDMpOgrCoMKg wqDCoMKgwqBwYWNrZXQ6IGZpeCBtYXRjaF9mYW5vdXRfZ3JvdXAoKQrCoMKgwqDCoMKgwqBuZXQ6 IGZpeCBhIHJhY2UgaW4gZHN0X3JlbGVhc2UoKQrCoMKgwqDCoMKgwqBuZXQ6IGF2b2lkIE5VTEwg ZGVyZWYgaW4gaW5ldF9jdGxfc29ja19kZXN0cm95KCkKCkZpbGlwZSBNYW5hbmEgKDUpOgrCoMKg wqDCoMKgwqBCdHJmczogZml4IGZpbGUgY29ycnVwdGlvbiBhbmQgZGF0YSBsb3NzIGFmdGVyIGNs b25pbmcgaW5saW5lIGV4dGVudHMKwqDCoMKgwqDCoMKgQnRyZnM6IGZpeCB0cnVuY2F0aW9uIG9m IGNvbXByZXNzZWQgYW5kIGlubGluZWQgZXh0ZW50cwrCoMKgwqDCoMKgwqBCdHJmczogZml4IHJh Y2UgbGVhZGluZyB0byBpbmNvcnJlY3QgaXRlbSBkZWxldGlvbiB3aGVuIGRyb3BwaW5nIGV4dGVu dHMKwqDCoMKgwqDCoMKgQnRyZnM6IGZpeCByYWNlIGxlYWRpbmcgdG8gQlVHX09OIHdoZW4gcnVu bmluZyBkZWxhbGxvYyBmb3Igbm9kYXRhY293CsKgwqDCoMKgwqDCoEJ0cmZzOiBmaXggcmFjZSB3 aGVuIGxpc3RpbmcgYW4gaW5vZGUncyB4YXR0cnMKCkhlcmJlcnQgWHUgKDEpOgrCoMKgwqDCoMKg wqBjcnlwdG86IGFsZ2lmX2hhc2ggLSBPbmx5IGV4cG9ydCBhbmQgaW1wb3J0IG9uIHNvY2tldHMg d2l0aCBkYXRhCgpKYW4gU2NobWlkdCAoMSk6CsKgwqDCoMKgwqDCoEJ0cmZzOiBhZGRlZCBoZWxw ZXIgYnRyZnNfbmV4dF9pdGVtKCkKCkphbm4gSG9ybiAoMSk6CsKgwqDCoMKgwqDCoGZzOiBpZiBh IGNvcmVkdW1wIGFscmVhZHkgZXhpc3RzLCB1bmxpbmsgYW5kIHJlY3JlYXRlIHdpdGggT19FWENM CgpKb2hhbm5lcyBCZXJnICgxKToKwqDCoMKgwqDCoMKgbWFjODAyMTE6IGZpeCBkcml2ZXIgUlNT SSBldmVudCBjYWxjdWxhdGlvbnMKCktlZXMgQ29vayAoMSk6CsKgwqDCoMKgwqDCoGZzOiBtYWtl IGR1bXBhYmxlPTIgcmVxdWlyZSBmdWxseSBxdWFsaWZpZWQgcGF0aAoKS2luZ2xvbmcgTWVlICgy KToKwqDCoMKgwqDCoMKgRlMtQ2FjaGU6IEluY3JlYXNlIHJlZmVyZW5jZSBvZiBwYXJlbnQgYWZ0 ZXIgcmVnaXN0ZXJpbmcsIG5ldGZzIHN1Y2Nlc3MKwqDCoMKgwqDCoMKgRlMtQ2FjaGU6IERvbid0 IG92ZXJyaWRlIG5ldGZzJ3MgcHJpbWFyeV9pbmRleCBpZiByZWdpc3RlcmluZyBmYWlsZWQKCkxh cnJ5IEZpbmdlciAoMSk6CsKgwqDCoMKgwqDCoHN0YWdpbmc6IHJ0bDg3MTI6IEFkZCBkZXZpY2Ug SUQgZm9yIFNpdGVjb20gV0xBMjEwMAoKTWFjaWVqIFcuIFJvenlja2kgKDEpOgrCoMKgwqDCoMKg wqBiaW5mbXRfZWxmOiBEb24ndCBjbG9iYmVyIHBhc3NlZCBleGVjdXRhYmxlJ3MgZmlsZSBoZWFk ZXIKCk1hcmVrIFZhc3V0ICgxKToKwqDCoMKgwqDCoMKgY2FuOiBVc2UgY29ycmVjdCB0eXBlIGlu IHNpemVvZigpIGluIG5sYV9wdXQoKQoKTWljaGFsIEt1YmXEjWVrICgxKToKwqDCoMKgwqDCoMKg aXB2NjogZml4IHR1bm5lbCBlcnJvciBoYW5kbGluZwoKUGFvbG8gQm9uemluaSAoMSk6CsKgwqDC oMKgwqDCoEtWTTogc3ZtOiB1bmNvbmRpdGlvbmFsbHkgaW50ZXJjZXB0ICNEQgoKUGV0ZXIgT2Jl cnBhcmxlaXRlciAoMSk6CsKgwqDCoMKgwqDCoHNjc2lfc3lzZnM6IEZpeCBxdWV1ZV9yYW1wX3Vw X3BlcmlvZCByZXR1cm4gY29kZQoKUGV0ZXIgWmlqbHN0cmEgKDEpOgrCoMKgwqDCoMKgwqBwZXJm OiBGaXggaW5oZXJpdGVkIGV2ZW50cyB2cy4gdHJhY2Vwb2ludCBmaWx0ZXJzCgpSYWxmIEJhZWNo bGUgKDEpOgrCoMKgwqDCoMKgwqBNSVBTOiBhdG9taWM6IEZpeCBjb21tZW50IGRlc2NyaWJpbmcg YXRvbWljNjRfYWRkX3VubGVzcydzIHJldHVybiB2YWx1ZS4KClJpY2hhcmQgUHVyZGllICgxKToK wqDCoMKgwqDCoMKgSElEOiBjb3JlOiBBdm9pZCB1bmluaXRpYWxpemVkIGJ1ZmZlciBhY2Nlc3MK ClNvd21pbmkgVmFyYWRoYW4gKDEpOgrCoMKgwqDCoMKgwqBSRFMtVENQOiBSZWNvdmVyIGNvcnJl Y3RseSBmcm9tIHBza2JfcHVsbCgpL3Brc2JfdHJpbSgpIGZhaWx1cmUgaW4gcmRzX3RjcF9kYXRh X3JlY3YKClN0ZWZhbiBSaWNodGVyICgxKToKwqDCoMKgwqDCoMKgZmlyZXdpcmU6IG9oY2k6IGZp eCBKTWljcm9uIEpNQjM4eCBJVCBjb250ZXh0IGRpc2NvdmVyeQoKVGFrYXNoaSBJd2FpICgyKToK wqDCoMKgwqDCoMKgQUxTQTogaGRhIC0gRGlzYWJsZSA2NGJpdCBhZGRyZXNzIGZvciBDcmVhdGl2 ZSBIREEgY29udHJvbGxlcnMKwqDCoMKgwqDCoMKgQUxTQTogaGRhIC0gQXBwbHkgcGluIGZpeHVw IGZvciBIUCBQcm9Cb29rIDY1NTBiCgpWYWxlbnRpbiBSb3RoYmVyZyAoMSk6CsKgwqDCoMKgwqDC oHdtODMxeF9wb3dlcjogVXNlIElSUUZfT05FU0hPVCB0byByZXF1ZXN0IHRocmVhZGVkIElSUXMK CmxpYmluICgxKToKwqDCoMKgwqDCoMKgcmVjb3JkbWNvdW50OiBGaXggZW5kaWFubmVzcyBoYW5k bGluZyBidWcgZm9yIG5vcF9tY291bnQKCnN1bWl0LnNheGVuYUBhdmFnb3RlY2guY29tICgyKToK wqDCoMKgwqDCoMKgbWVnYXJhaWRfc2FzOiBEbyBub3QgdXNlIFBBR0VfU0laRSBmb3IgbWF4X3Nl Y3RvcnMKwqDCoMKgwqDCoMKgbWVnYXJhaWRfc2FzIDogU01BUCByZXN0cmljdGlvbi0tZG8gbm90 IGFjY2VzcyB1c2VyIG1lbW9yeSBmcm9tIElPQ1RMIGNvZGUKCi0tIApCZW4gSHV0Y2hpbmdzClBv d2VyIGNvcnJ1cHRzLiAgQWJzb2x1dGUgcG93ZXIgaXMga2luZCBvZiBuZWF0LgogICAgICAgICAg ICAgICAgICAgICAgICAgICAtIEpvaG4gTGVobWFuLCBTZWNyZXRhcnkgb2YgdGhlIFVTIE5hdnkg MTk4MS0xOTg3 --=-+ucCKqsbQMP/Uf02XI2k Content-Type: text/x-diff; charset="UTF-8"; name="linux-3.2.74.patch" Content-Disposition: attachment; filename="linux-3.2.74.patch" Content-Transfer-Encoding: quoted-printable diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt index 88fd7f5..b318a78 100644 --- a/Documentation/sysctl/fs.txt +++ b/Documentation/sysctl/fs.txt @@ -163,16 +163,22 @@ This value can be used to query and set the core dump= mode for setuid or otherwise protected/tainted binaries. The modes are =20 0 - (default) - traditional behaviour. Any process which has changed - privilege levels or is execute only will not be dumped + privilege levels or is execute only will not be dumped. 1 - (debug) - all processes dump core when possible. The core dump is owned by the current user and no security is applied. This is intended for system debugging situations only. Ptrace is unchecked. + This is insecure as it allows regular users to examine the memory + contents of privileged processes. 2 - (suidsafe) - any binary which normally would not be dumped is dumped - readable by root only. This allows the end user to remove - such a dump but not access it directly. For security reasons - core dumps in this mode will not overwrite one another or - other files. This mode is appropriate when administrators are - attempting to debug problems in a normal environment. + anyway, but only if the "core_pattern" kernel sysctl is set to + either a pipe handler or a fully qualified path. (For more details + on this limitation, see CVE-2006-2451.) This mode is appropriate + when administrators are attempting to debug problems in a normal + environment, and either have a core dump pipe handler that knows + to treat privileged core dumps with care, or specific directory + defined for catching core dumps. If a core dump happens without + a pipe handler or fully qualifid path, a message will be emitted + to syslog warning about the lack of a correct setting. =20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 diff --git a/Makefile b/Makefile index 411d203..89a7d05 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ VERSION =3D 3 PATCHLEVEL =3D 2 -SUBLEVEL =3D 73 +SUBLEVEL =3D 74 EXTRAVERSION =3D NAME =3D Saber-toothed Squirrel =20 diff --git a/arch/arm/mach-pxa/include/mach/pxa27x.h b/arch/arm/mach-pxa/in= clude/mach/pxa27x.h index 7cff640..66c4cbf 100644 --- a/arch/arm/mach-pxa/include/mach/pxa27x.h +++ b/arch/arm/mach-pxa/include/mach/pxa27x.h @@ -21,7 +21,7 @@ =20 extern void __init pxa27x_map_io(void); extern void __init pxa27x_init_irq(void); -extern int __init pxa27x_set_pwrmode(unsigned int mode); +extern int pxa27x_set_pwrmode(unsigned int mode); extern void pxa27x_cpu_pm_enter(suspend_state_t state); =20 #define pxa27x_handle_irq ichp_handle_irq diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c index a9447f9..f7510b1 100644 --- a/arch/arm/mach-pxa/pxa27x.c +++ b/arch/arm/mach-pxa/pxa27x.c @@ -241,7 +241,7 @@ static struct clk_lookup pxa27x_clkregs[] =3D { */ static unsigned int pwrmode =3D PWRMODE_SLEEP; =20 -int __init pxa27x_set_pwrmode(unsigned int mode) +int pxa27x_set_pwrmode(unsigned int mode) { switch (mode) { case PWRMODE_SLEEP: diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.= h index 1d93f81..9d4581d 100644 --- a/arch/mips/include/asm/atomic.h +++ b/arch/mips/include/asm/atomic.h @@ -679,7 +679,7 @@ static __inline__ long atomic64_sub_if_positive(long i,= atomic64_t * v) * @u: ...unless v is equal to u. * * Atomically adds @a to @v, so long as it was not @u. - * Returns the old value of @v. + * Returns true iff @v was not @u. */ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u) { diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S index e11e394..0f8ebf7 100644 --- a/arch/x86/kernel/head_64.S +++ b/arch/x86/kernel/head_64.S @@ -63,6 +63,9 @@ startup_64: * tables and then reload them. */ =20 + /* Sanitize CPU configuration */ + call verify_cpu + /* Compute the delta between the address I am compiled to run at and the * address I am actually running at. */ @@ -160,6 +163,9 @@ ENTRY(secondary_startup_64) * after the boot processor executes this code. */ =20 + /* Sanitize CPU configuration */ + call verify_cpu + /* Enable PAE mode and PGE */ movl $(X86_CR4_PAE | X86_CR4_PGE), %eax movq %rax, %cr4 @@ -253,6 +259,8 @@ ENTRY(secondary_startup_64) pushq %rax # target address in negative space lretq =20 +#include "verify_cpu.S" + /* SMP bootup changes these two */ __REFDATA .align 8 diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S index b9242ba..4cf401f 100644 --- a/arch/x86/kernel/verify_cpu.S +++ b/arch/x86/kernel/verify_cpu.S @@ -34,10 +34,11 @@ #include =20 verify_cpu: - pushfl # Save caller passed flags - pushl $0 # Kill any dangerous flags - popfl + pushf # Save caller passed flags + push $0 # Kill any dangerous flags + popf =20 +#ifndef __x86_64__ pushfl # standard way to check for cpuid popl %eax movl %eax,%ebx @@ -48,6 +49,7 @@ verify_cpu: popl %eax cmpl %eax,%ebx jz verify_cpu_no_longmode # cpu has no cpuid +#endif =20 movl $0x0,%eax # See if cpuid 1 is implemented cpuid @@ -130,10 +132,10 @@ verify_cpu_sse_test: jmp verify_cpu_sse_test # try again =20 verify_cpu_no_longmode: - popfl # Restore caller passed flags + popf # Restore caller passed flags movl $1,%eax ret verify_cpu_sse_ok: - popfl # Restore caller passed flags + popf # Restore caller passed flags xorl %eax, %eax ret diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 0de6783..ff3535a 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1015,6 +1015,7 @@ static void init_vmcb(struct vcpu_svm *svm) set_exception_intercept(svm, UD_VECTOR); set_exception_intercept(svm, MC_VECTOR); set_exception_intercept(svm, AC_VECTOR); + set_exception_intercept(svm, DB_VECTOR); =20 set_intercept(svm, INTERCEPT_INTR); set_intercept(svm, INTERCEPT_NMI); @@ -1550,20 +1551,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu, mark_dirty(svm->vmcb, VMCB_SEG); } =20 -static void update_db_intercept(struct kvm_vcpu *vcpu) +static void update_bp_intercept(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); =20 - clr_exception_intercept(svm, DB_VECTOR); clr_exception_intercept(svm, BP_VECTOR); =20 - if (svm->nmi_singlestep) - set_exception_intercept(svm, DB_VECTOR); - if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) { - if (vcpu->guest_debug & - (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) - set_exception_intercept(svm, DB_VECTOR); if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP) set_exception_intercept(svm, BP_VECTOR); } else @@ -1581,7 +1575,7 @@ static void svm_guest_debug(struct kvm_vcpu *vcpu, st= ruct kvm_guest_debug *dbg) =20 mark_dirty(svm->vmcb, VMCB_DR); =20 - update_db_intercept(vcpu); + update_bp_intercept(vcpu); } =20 static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd) @@ -1655,7 +1649,6 @@ static int db_interception(struct vcpu_svm *svm) if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP)) svm->vmcb->save.rflags &=3D ~(X86_EFLAGS_TF | X86_EFLAGS_RF); - update_db_intercept(&svm->vcpu); } =20 if (svm->vcpu.guest_debug & @@ -3557,7 +3550,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu) */ svm->nmi_singlestep =3D true; svm->vmcb->save.rflags |=3D (X86_EFLAGS_TF | X86_EFLAGS_RF); - update_db_intercept(vcpu); } =20 static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr) diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index 8502462..a68b56a 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -192,9 +192,14 @@ static int hash_accept(struct socket *sock, struct soc= ket *newsock, int flags) struct sock *sk2; struct alg_sock *ask2; struct hash_ctx *ctx2; + bool more; int err; =20 - err =3D crypto_ahash_export(req, state); + lock_sock(sk); + more =3D ctx->more; + err =3D more ? crypto_ahash_export(req, state) : 0; + release_sock(sk); + if (err) return err; =20 @@ -205,7 +210,10 @@ static int hash_accept(struct socket *sock, struct soc= ket *newsock, int flags) sk2 =3D newsock->sk; ask2 =3D alg_sk(sk2); ctx2 =3D ask2->private; - ctx2->more =3D 1; + ctx2->more =3D more; + + if (!more) + return err; =20 err =3D crypto_ahash_import(&ctx2->req, state); if (err) { diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 7be7aa6..ec965de 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -82,6 +82,7 @@ static struct workqueue_struct *kacpid_wq; static struct workqueue_struct *kacpi_notify_wq; struct workqueue_struct *kacpi_hotplug_wq; EXPORT_SYMBOL(kacpi_hotplug_wq); +unsigned int acpi_sci_irq =3D INVALID_ACPI_IRQ; =20 struct acpi_res_list { resource_size_t start; @@ -566,17 +567,19 @@ acpi_os_install_interrupt_handler(u32 gsi, acpi_osd_h= andler handler, acpi_irq_handler =3D NULL; return AE_NOT_ACQUIRED; } + acpi_sci_irq =3D irq; =20 return AE_OK; } =20 -acpi_status acpi_os_remove_interrupt_handler(u32 irq, acpi_osd_handler han= dler) +acpi_status acpi_os_remove_interrupt_handler(u32 gsi, acpi_osd_handler han= dler) { - if (irq !=3D acpi_gbl_FADT.sci_interrupt) + if (gsi !=3D acpi_gbl_FADT.sci_interrupt || !acpi_sci_irq_valid()) return AE_BAD_PARAMETER; =20 - free_irq(irq, acpi_irq); + free_irq(acpi_sci_irq, acpi_irq); acpi_irq_handler =3D NULL; + acpi_sci_irq =3D INVALID_ACPI_IRQ; =20 return AE_OK; } diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c index e9e8f3b..9fb9287 100644 --- a/drivers/bluetooth/ath3k.c +++ b/drivers/bluetooth/ath3k.c @@ -90,6 +90,7 @@ static struct usb_device_id ath3k_table[] =3D { { USB_DEVICE(0x04CA, 0x300f) }, { USB_DEVICE(0x04CA, 0x3010) }, { USB_DEVICE(0x0930, 0x0219) }, + { USB_DEVICE(0x0930, 0x021c) }, { USB_DEVICE(0x0930, 0x0220) }, { USB_DEVICE(0x0930, 0x0227) }, { USB_DEVICE(0x0b05, 0x17d0) }, @@ -101,6 +102,7 @@ static struct usb_device_id ath3k_table[] =3D { { USB_DEVICE(0x0CF3, 0x311F) }, { USB_DEVICE(0x0cf3, 0x3121) }, { USB_DEVICE(0x0CF3, 0x817a) }, + { USB_DEVICE(0x0CF3, 0x817b) }, { USB_DEVICE(0x0cf3, 0xe003) }, { USB_DEVICE(0x0CF3, 0xE004) }, { USB_DEVICE(0x0CF3, 0xE005) }, @@ -148,6 +150,7 @@ static struct usb_device_id ath3k_blist_tbl[] =3D { { USB_DEVICE(0x04ca, 0x300f), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3010), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info =3D BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x021c), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0220), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0227), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0b05, 0x17d0), .driver_info =3D BTUSB_ATH3012 }, @@ -159,6 +162,7 @@ static struct usb_device_id ath3k_blist_tbl[] =3D { { USB_DEVICE(0x0cf3, 0x311F), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3121), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0CF3, 0x817a), .driver_info =3D BTUSB_ATH3012 }, + { USB_DEVICE(0x0CF3, 0x817b), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe005), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe003), .driver_info =3D BTUSB_ATH3012 }, diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index c5e400b..d83c855 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -175,6 +175,7 @@ static struct usb_device_id blacklist_table[] =3D { { USB_DEVICE(0x04ca, 0x300f), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3010), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info =3D BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x021c), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0220), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0227), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0b05, 0x17d0), .driver_info =3D BTUSB_ATH3012 }, @@ -186,6 +187,7 @@ static struct usb_device_id blacklist_table[] =3D { { USB_DEVICE(0x0cf3, 0x311f), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3121), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x817a), .driver_info =3D BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x817b), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe003), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info =3D BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe005), .driver_info =3D BTUSB_ATH3012 }, diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c index 0a0225a..e6624c6 100644 --- a/drivers/firewire/ohci.c +++ b/drivers/firewire/ohci.c @@ -3547,6 +3547,11 @@ static int __devinit pci_probe(struct pci_dev *dev, =20 reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0); ohci->it_context_support =3D reg_read(ohci, OHCI1394_IsoXmitIntMaskSet); + /* JMicron JMB38x often shows 0 at first read, just ignore it */ + if (!ohci->it_context_support) { + fw_notify("overriding IsoXmitIntMask\n"); + ohci->it_context_support =3D 0xf; + } reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0); ohci->it_context_mask =3D ohci->it_context_support; ohci->n_it =3D hweight32(ohci->it_context_mask); diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 64d79d2..61660f8 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1295,7 +1295,7 @@ int hid_connect(struct hid_device *hdev, unsigned int= connect_mask) "Multi-Axis Controller" }; const char *type, *bus; - char buf[64]; + char buf[64] =3D ""; unsigned int i; int len; int ret; diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c index 710fc19..41b7464 100644 --- a/drivers/iommu/intel-iommu.c +++ b/drivers/iommu/intel-iommu.c @@ -3572,10 +3572,15 @@ found: for (bus =3D dev->bus; bus; bus =3D bus->parent) { struct pci_dev *bridge =3D bus->self; =20 - if (!bridge || !pci_is_pcie(bridge) || + /* If it's an integrated device, allow ATS */ + if (!bridge) + return 1; + /* Connected via non-PCIe: no ATS */ + if (!pci_is_pcie(bridge) || bridge->pcie_type =3D=3D PCI_EXP_TYPE_PCI_BRIDGE) return 0; =20 + /* If we found the root port, look it up in the ATSR */ if (bridge->pcie_type =3D=3D PCI_EXP_TYPE_ROOT_PORT) { for (i =3D 0; i < atsru->devices_cnt; i++) if (atsru->devices[i] =3D=3D bridge) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index df58db3..05613bf 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -213,8 +213,8 @@ static int blktrans_open(struct block_device *bdev, fmo= de_t mode) if (!dev) return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ =20 - mutex_lock(&dev->lock); mutex_lock(&mtd_table_mutex); + mutex_lock(&dev->lock); =20 if (dev->open) goto unlock; @@ -237,8 +237,8 @@ static int blktrans_open(struct block_device *bdev, fmo= de_t mode) =20 unlock: dev->open++; - mutex_unlock(&mtd_table_mutex); mutex_unlock(&dev->lock); + mutex_unlock(&mtd_table_mutex); blktrans_dev_put(dev); return ret; =20 @@ -248,8 +248,8 @@ error_release: error_put: module_put(dev->tr->owner); kref_put(&dev->ref, blktrans_dev_release); - mutex_unlock(&mtd_table_mutex); mutex_unlock(&dev->lock); + mutex_unlock(&mtd_table_mutex); blktrans_dev_put(dev); return ret; } @@ -262,8 +262,8 @@ static int blktrans_release(struct gendisk *disk, fmode= _t mode) if (!dev) return ret; =20 - mutex_lock(&dev->lock); mutex_lock(&mtd_table_mutex); + mutex_lock(&dev->lock); =20 if (--dev->open) goto unlock; @@ -276,8 +276,8 @@ static int blktrans_release(struct gendisk *disk, fmode= _t mode) __put_mtd_device(dev->mtd); } unlock: - mutex_unlock(&mtd_table_mutex); mutex_unlock(&dev->lock); + mutex_unlock(&mtd_table_mutex); blktrans_dev_put(dev); return ret; } diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c index 198da0a..3aab083 100644 --- a/drivers/mtd/mtdpart.c +++ b/drivers/mtd/mtdpart.c @@ -671,8 +671,10 @@ int add_mtd_partitions(struct mtd_info *master, =20 for (i =3D 0; i < nbparts; i++) { slave =3D allocate_partition(master, parts + i, i, cur_offset); - if (IS_ERR(slave)) + if (IS_ERR(slave)) { + del_mtd_partitions(master); return PTR_ERR(slave); + } =20 mutex_lock(&mtd_partitions_mutex); list_add(&slave->list, &mtd_partitions); diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c index db9100f..664263a 100644 --- a/drivers/net/can/dev.c +++ b/drivers/net/can/dev.c @@ -693,7 +693,7 @@ static int can_fill_info(struct sk_buff *skb, const str= uct net_device *dev) NLA_PUT_U32(skb, IFLA_CAN_RESTART_MS, priv->restart_ms); NLA_PUT(skb, IFLA_CAN_BITTIMING, sizeof(priv->bittiming), &priv->bittiming); - NLA_PUT(skb, IFLA_CAN_CLOCK, sizeof(cm), &priv->clock); + NLA_PUT(skb, IFLA_CAN_CLOCK, sizeof(priv->clock), &priv->clock); if (priv->do_get_berr_counter && !priv->do_get_berr_counter(dev, &bec)) NLA_PUT(skb, IFLA_CAN_BERR_COUNTER, sizeof(bec), &bec); if (priv->bittiming_const) diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/= mwifiex/debugfs.c index d26a78b..1c0e1a4 100644 --- a/drivers/net/wireless/mwifiex/debugfs.c +++ b/drivers/net/wireless/mwifiex/debugfs.c @@ -633,7 +633,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *u= buf, (struct mwifiex_private *) file->private_data; unsigned long addr =3D get_zeroed_page(GFP_KERNEL); char *buf =3D (char *) addr; - int pos =3D 0, ret =3D 0, i; + int pos, ret, i; u8 value[MAX_EEPROM_DATA]; =20 if (!buf) @@ -641,7 +641,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *u= buf, =20 if (saved_offset =3D=3D -1) { /* No command has been given */ - pos +=3D snprintf(buf, PAGE_SIZE, "0"); + pos =3D snprintf(buf, PAGE_SIZE, "0"); goto done; } =20 @@ -650,17 +650,17 @@ mwifiex_rdeeprom_read(struct file *file, char __user = *ubuf, (u16) saved_bytes, value); if (ret) { ret =3D -EINVAL; - goto done; + goto out_free; } =20 - pos +=3D snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes); + pos =3D snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes); =20 for (i =3D 0; i < saved_bytes; i++) - pos +=3D snprintf(buf + strlen(buf), PAGE_SIZE, "%d ", value[i]); - - ret =3D simple_read_from_buffer(ubuf, count, ppos, buf, pos); + pos +=3D scnprintf(buf + pos, PAGE_SIZE - pos, "%d ", value[i]); =20 done: + ret =3D simple_read_from_buffer(ubuf, count, ppos, buf, pos); +out_free: free_page(addr); return ret; } diff --git a/drivers/pci/access.c b/drivers/pci/access.c index fac01f8..32785cd 100644 --- a/drivers/pci/access.c +++ b/drivers/pci/access.c @@ -358,7 +358,8 @@ static const struct pci_vpd_ops pci_vpd_pci22_ops =3D { static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t cou= nt, void *arg) { - struct pci_dev *tdev =3D pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); + struct pci_dev *tdev =3D pci_get_slot(dev->bus, + PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); ssize_t ret; =20 if (!tdev) @@ -372,7 +373,8 @@ static ssize_t pci_vpd_f0_read(struct pci_dev *dev, lof= f_t pos, size_t count, static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t co= unt, const void *arg) { - struct pci_dev *tdev =3D pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); + struct pci_dev *tdev =3D pci_get_slot(dev->bus, + PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); ssize_t ret; =20 if (!tdev) @@ -389,22 +391,6 @@ static const struct pci_vpd_ops pci_vpd_f0_ops =3D { .release =3D pci_vpd_pci22_release, }; =20 -static int pci_vpd_f0_dev_check(struct pci_dev *dev) -{ - struct pci_dev *tdev =3D pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); - int ret =3D 0; - - if (!tdev) - return -ENODEV; - if (!tdev->vpd || !tdev->multifunction || - dev->class !=3D tdev->class || dev->vendor !=3D tdev->vendor || - dev->device !=3D tdev->device) - ret =3D -ENODEV; - - pci_dev_put(tdev); - return ret; -} - int pci_vpd_pci22_init(struct pci_dev *dev) { struct pci_vpd_pci22 *vpd; @@ -413,12 +399,7 @@ int pci_vpd_pci22_init(struct pci_dev *dev) cap =3D pci_find_capability(dev, PCI_CAP_ID_VPD); if (!cap) return -ENODEV; - if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) { - int ret =3D pci_vpd_f0_dev_check(dev); =20 - if (ret) - return ret; - } vpd =3D kzalloc(sizeof(*vpd), GFP_ATOMIC); if (!vpd) return -ENOMEM; diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 93be760..604ee35 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -1941,12 +1941,28 @@ static void __devinit quirk_netmos(struct pci_dev *= dev) } DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID, quirk_netmos); =20 +/* + * Quirk non-zero PCI functions to route VPD access through function 0 for + * devices that share VPD resources between functions. The functions are + * expected to be identical devices. + */ static void quirk_f0_vpd_link(struct pci_dev *dev) { + struct pci_dev *f0; + if ((dev->class >> 8) !=3D PCI_CLASS_NETWORK_ETHERNET || - !dev->multifunction || !PCI_FUNC(dev->devfn)) + !PCI_FUNC(dev->devfn)) return; - dev->dev_flags |=3D PCI_DEV_FLAGS_VPD_REF_F0; + + f0 =3D pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); + if (!f0) + return; + + if (f0->vpd && dev->class =3D=3D f0->class && + dev->vendor =3D=3D f0->vendor && dev->device =3D=3D f0->device) + dev->dev_flags |=3D PCI_DEV_FLAGS_VPD_REF_F0; + + pci_dev_put(f0); } DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_f0_vpd_link= ); =20 diff --git a/drivers/power/wm831x_power.c b/drivers/power/wm831x_power.c index 6cc2ca6..cbee41ce 100644 --- a/drivers/power/wm831x_power.c +++ b/drivers/power/wm831x_power.c @@ -557,7 +557,7 @@ static __devinit int wm831x_power_probe(struct platform= _device *pdev) =20 irq =3D platform_get_irq_byname(pdev, "SYSLO"); ret =3D request_threaded_irq(irq, NULL, wm831x_syslo_irq, - IRQF_TRIGGER_RISING, "System power low", + IRQF_TRIGGER_RISING | IRQF_ONESHOT, "System power low", power); if (ret !=3D 0) { dev_err(&pdev->dev, "Failed to request SYSLO IRQ %d: %d\n", @@ -567,7 +567,7 @@ static __devinit int wm831x_power_probe(struct platform= _device *pdev) =20 irq =3D platform_get_irq_byname(pdev, "PWR SRC"); ret =3D request_threaded_irq(irq, NULL, wm831x_pwr_src_irq, - IRQF_TRIGGER_RISING, "Power source", + IRQF_TRIGGER_RISING | IRQF_ONESHOT, "Power source", power); if (ret !=3D 0) { dev_err(&pdev->dev, "Failed to request PWR SRC IRQ %d: %d\n", @@ -578,7 +578,7 @@ static __devinit int wm831x_power_probe(struct platform= _device *pdev) for (i =3D 0; i < ARRAY_SIZE(wm831x_bat_irqs); i++) { irq =3D platform_get_irq_byname(pdev, wm831x_bat_irqs[i]); ret =3D request_threaded_irq(irq, NULL, wm831x_bat_irq, - IRQF_TRIGGER_RISING, + IRQF_TRIGGER_RISING | IRQF_ONESHOT, wm831x_bat_irqs[i], power); if (ret !=3D 0) { diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/m= egaraid_sas.h index 049c22f..458fb34 100644 --- a/drivers/scsi/megaraid/megaraid_sas.h +++ b/drivers/scsi/megaraid/megaraid_sas.h @@ -300,6 +300,8 @@ enum MR_EVT_ARGS { MR_EVT_ARGS_GENERIC, }; =20 + +#define SGE_BUFFER_SIZE 4096 /* * define constants for device list query options */ diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megar= aid/megaraid_sas_base.c index e45c865..3b1ba10 100644 --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -3636,7 +3636,7 @@ static int megasas_init_fw(struct megasas_instance *i= nstance) } =20 instance->max_sectors_per_req =3D instance->max_num_sge * - PAGE_SIZE / 512; + SGE_BUFFER_SIZE / 512; if (tmp_sectors && (instance->max_sectors_per_req > tmp_sectors)) instance->max_sectors_per_req =3D tmp_sectors; =20 @@ -5083,6 +5083,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *= file, unsigned long arg) int i; int error =3D 0; compat_uptr_t ptr; + unsigned long local_raw_ptr; + u32 local_sense_off; + u32 local_sense_len; =20 if (clear_user(ioc, sizeof(*ioc))) return -EFAULT; @@ -5100,9 +5103,15 @@ static int megasas_mgmt_compat_ioctl_fw(struct file = *file, unsigned long arg) * sense_len is not null, so prepare the 64bit value under * the same condition. */ - if (ioc->sense_len) { + if (get_user(local_raw_ptr, ioc->frame.raw) || + get_user(local_sense_off, &ioc->sense_off) || + get_user(local_sense_len, &ioc->sense_len)) + return -EFAULT; + + + if (local_sense_len) { void __user **sense_ioc_ptr =3D - (void __user **)(ioc->frame.raw + ioc->sense_off); + (void __user **)((u8*)local_raw_ptr + local_sense_off); compat_uptr_t *sense_cioc_ptr =3D (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off); if (get_user(ptr, sense_cioc_ptr) || diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index 88bc82e..d76c347 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -788,7 +788,7 @@ sdev_store_queue_ramp_up_period(struct device *dev, return -EINVAL; =20 sdev->queue_ramp_up_period =3D msecs_to_jiffies(period); - return period; + return count; } =20 static struct device_attribute sdev_attr_queue_ramp_up_period =3D @@ -1029,31 +1029,23 @@ static void __scsi_remove_target(struct scsi_target= *starget) void scsi_remove_target(struct device *dev) { struct Scsi_Host *shost =3D dev_to_shost(dev->parent); - struct scsi_target *starget, *last =3D NULL; + struct scsi_target *starget; unsigned long flags; =20 - /* remove targets being careful to lookup next entry before - * deleting the last - */ +restart: spin_lock_irqsave(shost->host_lock, flags); list_for_each_entry(starget, &shost->__targets, siblings) { if (starget->state =3D=3D STARGET_DEL) continue; if (starget->dev.parent =3D=3D dev || &starget->dev =3D=3D dev) { - /* assuming new targets arrive at the end */ kref_get(&starget->reap_ref); spin_unlock_irqrestore(shost->host_lock, flags); - if (last) - scsi_target_reap(last); - last =3D starget; __scsi_remove_target(starget); - spin_lock_irqsave(shost->host_lock, flags); + scsi_target_reap(starget); + goto restart; } } spin_unlock_irqrestore(shost->host_lock, flags); - - if (last) - scsi_target_reap(last); } EXPORT_SYMBOL(scsi_remove_target); =20 diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/u= sb_intf.c index a74e83d..6381393 100644 --- a/drivers/staging/rtl8712/usb_intf.c +++ b/drivers/staging/rtl8712/usb_intf.c @@ -147,6 +147,7 @@ static struct usb_device_id rtl871x_usb_id_tbl[] =3D { {USB_DEVICE(0x0DF6, 0x0058)}, {USB_DEVICE(0x0DF6, 0x0049)}, {USB_DEVICE(0x0DF6, 0x004C)}, + {USB_DEVICE(0x0DF6, 0x006C)}, {USB_DEVICE(0x0DF6, 0x0064)}, /* Skyworth */ {USB_DEVICE(0x14b2, 0x3300)}, diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index d252462..0f3bbea 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -671,16 +671,16 @@ static int load_elf_binary(struct linux_binprm *bprm,= struct pt_regs *regs) */ would_dump(bprm, interpreter); =20 - retval =3D kernel_read(interpreter, 0, bprm->buf, - BINPRM_BUF_SIZE); - if (retval !=3D BINPRM_BUF_SIZE) { + /* Get the exec headers */ + retval =3D kernel_read(interpreter, 0, + (void *)&loc->interp_elf_ex, + sizeof(loc->interp_elf_ex)); + if (retval !=3D sizeof(loc->interp_elf_ex)) { if (retval >=3D 0) retval =3D -EIO; goto out_free_dentry; } =20 - /* Get the exec headers */ - loc->interp_elf_ex =3D *((struct elfhdr *)bprm->buf); break; } elf_ppnt++; diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h index 83a871f..0d9228b 100644 --- a/fs/btrfs/ctree.h +++ b/fs/btrfs/ctree.h @@ -2174,15 +2174,6 @@ BTRFS_SETGET_FUNCS(file_extent_encryption, struct bt= rfs_file_extent_item, BTRFS_SETGET_FUNCS(file_extent_other_encoding, struct btrfs_file_extent_it= em, other_encoding, 16); =20 -/* this returns the number of file bytes represented by the inline item. - * If an item is compressed, this is the uncompressed size - */ -static inline u32 btrfs_file_extent_inline_len(struct extent_buffer *eb, - struct btrfs_file_extent_item *e) -{ - return btrfs_file_extent_ram_bytes(eb, e); -} - /* * this returns the number of bytes used by the item on disk, minus the * size of any extent headers. If a file is compressed on disk, this is @@ -2196,6 +2187,29 @@ static inline u32 btrfs_file_extent_inline_item_len(= struct extent_buffer *eb, return btrfs_item_size(eb, e) - offset; } =20 +/* this returns the number of file bytes represented by the inline item. + * If an item is compressed, this is the uncompressed size + */ +static inline u32 btrfs_file_extent_inline_len(struct extent_buffer *eb, + int slot, + struct btrfs_file_extent_item *fi) +{ + /* + * return the space used on disk if this item isn't + * compressed or encoded + */ + if (btrfs_file_extent_compression(eb, fi) =3D=3D 0 && + btrfs_file_extent_encryption(eb, fi) =3D=3D 0 && + btrfs_file_extent_other_encoding(eb, fi) =3D=3D 0) { + return btrfs_file_extent_inline_item_len(eb, + btrfs_item_nr(eb, slot)); + } + + /* otherwise use the ram bytes field */ + return btrfs_file_extent_ram_bytes(eb, fi); +} + + static inline struct btrfs_root *btrfs_sb(struct super_block *sb) { return sb->s_fs_info; @@ -2482,6 +2496,13 @@ static inline int btrfs_insert_empty_item(struct btr= fs_trans_handle *trans, } =20 int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path); +static inline int btrfs_next_item(struct btrfs_root *root, struct btrfs_pa= th *p) +{ + ++p->slots[0]; + if (p->slots[0] >=3D btrfs_header_nritems(p->nodes[0])) + return btrfs_next_leaf(root, p); + return 0; +} int btrfs_prev_leaf(struct btrfs_root *root, struct btrfs_path *path); int btrfs_leaf_free_space(struct btrfs_root *root, struct extent_buffer *l= eaf); void btrfs_drop_snapshot(struct btrfs_root *root, diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c index 97fbe93..a1da0ab 100644 --- a/fs/btrfs/file.c +++ b/fs/btrfs/file.c @@ -605,8 +605,15 @@ next_slot: } =20 btrfs_item_key_to_cpu(leaf, &key, path->slots[0]); - if (key.objectid > ino || - key.type > BTRFS_EXTENT_DATA_KEY || key.offset >=3D end) + + if (key.objectid > ino) + break; + if (WARN_ON_ONCE(key.objectid < ino) || + key.type < BTRFS_EXTENT_DATA_KEY) { + path->slots[0]++; + goto next_slot; + } + if (key.type > BTRFS_EXTENT_DATA_KEY || key.offset >=3D end) break; =20 fi =3D btrfs_item_ptr(leaf, path->slots[0], @@ -622,10 +629,11 @@ next_slot: btrfs_file_extent_num_bytes(leaf, fi); } else if (extent_type =3D=3D BTRFS_FILE_EXTENT_INLINE) { extent_end =3D key.offset + - btrfs_file_extent_inline_len(leaf, fi); + btrfs_file_extent_inline_len(leaf, + path->slots[0], fi); } else { - WARN_ON(1); - extent_end =3D search_start; + /* can't happen */ + BUG(); } =20 if (extent_end <=3D search_start) { diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index cb10cb9..e4c38d4 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -88,6 +88,7 @@ static unsigned char btrfs_type_by_mode[S_IFMT >> S_SHIFT= ] =3D { }; =20 static int btrfs_setsize(struct inode *inode, loff_t newsize); +static int btrfs_truncate_page(struct address_space *mapping, loff_t from)= ; static int btrfs_truncate(struct inode *inode); static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end= ); static noinline int cow_file_range(struct inode *inode, @@ -1126,8 +1127,14 @@ next_slot: num_bytes =3D 0; btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]); =20 - if (found_key.objectid > ino || - found_key.type > BTRFS_EXTENT_DATA_KEY || + if (found_key.objectid > ino) + break; + if (WARN_ON_ONCE(found_key.objectid < ino) || + found_key.type < BTRFS_EXTENT_DATA_KEY) { + path->slots[0]++; + goto next_slot; + } + if (found_key.type > BTRFS_EXTENT_DATA_KEY || found_key.offset > end) break; =20 @@ -1178,7 +1185,8 @@ next_slot: nocow =3D 1; } else if (extent_type =3D=3D BTRFS_FILE_EXTENT_INLINE) { extent_end =3D found_key.offset + - btrfs_file_extent_inline_len(leaf, fi); + btrfs_file_extent_inline_len(leaf, + path->slots[0], fi); extent_end =3D ALIGN(extent_end, root->sectorsize); } else { BUG_ON(1); @@ -2991,6 +2999,47 @@ out: return err; } =20 +static int truncate_inline_extent(struct btrfs_trans_handle *trans, + struct inode *inode, + struct btrfs_path *path, + struct btrfs_key *found_key, + const u64 item_end, + const u64 new_size) +{ + struct extent_buffer *leaf =3D path->nodes[0]; + int slot =3D path->slots[0]; + struct btrfs_file_extent_item *fi; + u32 size =3D (u32)(new_size - found_key->offset); + struct btrfs_root *root =3D BTRFS_I(inode)->root; + + fi =3D btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item); + + if (btrfs_file_extent_compression(leaf, fi) !=3D BTRFS_COMPRESS_NONE) { + loff_t offset =3D new_size; + + /* + * Zero out the remaining of the last page of our inline extent, + * instead of directly truncating our inline extent here - that + * would be much more complex (decompressing all the data, then + * compressing the truncated data, which might be bigger than + * the size of the inline extent, resize the extent, etc). + * We release the path because to get the page we might need to + * read the extent item from disk (data not in the page cache). + */ + btrfs_release_path(path); + return btrfs_truncate_page(inode->i_mapping, offset); + } + + btrfs_set_file_extent_ram_bytes(leaf, fi, size); + size =3D btrfs_file_extent_calc_inline_size(size); + btrfs_truncate_item(trans, root, path, size, 1); + + if (root->ref_cows) + inode_sub_bytes(inode, item_end + 1 - new_size); + + return 0; +} + /* * this can truncate away extent items, csum items and directory items. * It starts at a high offset and removes keys until it can't find @@ -3095,7 +3144,7 @@ search_again: btrfs_file_extent_num_bytes(leaf, fi); } else if (extent_type =3D=3D BTRFS_FILE_EXTENT_INLINE) { item_end +=3D btrfs_file_extent_inline_len(leaf, - fi); + path->slots[0], fi); } item_end--; } @@ -3152,22 +3201,30 @@ search_again: * special encodings */ if (!del_item && - btrfs_file_extent_compression(leaf, fi) =3D=3D 0 && btrfs_file_extent_encryption(leaf, fi) =3D=3D 0 && btrfs_file_extent_other_encoding(leaf, fi) =3D=3D 0) { - u32 size =3D new_size - found_key.offset; =20 - if (root->ref_cows) { - inode_sub_bytes(inode, item_end + 1 - - new_size); + /* + * Need to release path in order to truncate a + * compressed extent. So delete any accumulated + * extent items so far. + */ + if (btrfs_file_extent_compression(leaf, fi) !=3D + BTRFS_COMPRESS_NONE && pending_del_nr) { + err =3D btrfs_del_items(trans, root, path, + pending_del_slot, + pending_del_nr); + BUG_ON(err); + pending_del_nr =3D 0; } - size =3D - btrfs_file_extent_calc_inline_size(size); - ret =3D btrfs_truncate_item(trans, root, path, - size, 1); + + err =3D truncate_inline_extent(trans, inode, + path, &found_key, + item_end, + new_size); + BUG_ON(err); } else if (root->ref_cows) { - inode_sub_bytes(inode, item_end + 1 - - found_key.offset); + inode_sub_bytes(inode, item_end + 1 - new_size); } } delete: @@ -5036,7 +5093,7 @@ again: btrfs_file_extent_num_bytes(leaf, item); } else if (found_type =3D=3D BTRFS_FILE_EXTENT_INLINE) { size_t size; - size =3D btrfs_file_extent_inline_len(leaf, item); + size =3D btrfs_file_extent_inline_len(leaf, path->slots[0], item); extent_end =3D (extent_start + size + root->sectorsize - 1) & ~((u64)root->sectorsize - 1); } @@ -5103,7 +5160,7 @@ again: goto out; } =20 - size =3D btrfs_file_extent_inline_len(leaf, item); + size =3D btrfs_file_extent_inline_len(leaf, path->slots[0], item); extent_offset =3D page_offset(page) + pg_offset - extent_start; copy_size =3D min_t(u64, PAGE_CACHE_SIZE - pg_offset, size - extent_offset); diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index ba26540..f1ca909 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -2164,6 +2164,151 @@ out: return ret; } =20 +/* + * Make sure we do not end up inserting an inline extent into a file that = has + * already other (non-inline) extents. If a file has an inline extent it c= an + * not have any other extents and the (single) inline extent must start at= the + * file offset 0. Failing to respect these rules will lead to file corrupt= ion, + * resulting in EIO errors on read/write operations, hitting BUG_ON's in m= m, etc + * + * We can have extents that have been already written to disk or we can ha= ve + * dirty ranges still in delalloc, in which case the extent maps and items= are + * created only when we run delalloc, and the delalloc ranges might fall o= utside + * the range we are currently locking in the inode's io tree. So we check = the + * inode's i_size because of that (i_size updates are done while holding t= he + * i_mutex, which we are holding here). + * We also check to see if the inode has a size not greater than "datal" b= ut has + * extents beyond it, due to an fallocate with FALLOC_FL_KEEP_SIZE (and we= are + * protected against such concurrent fallocate calls by the i_mutex). + * + * If the file has no extents but a size greater than datal, do not allow = the + * copy because we would need turn the inline extent into a non-inline one= (even + * with NO_HOLES enabled). If we find our destination inode only has one i= nline + * extent, just overwrite it with the source inline extent if its size is = less + * than the source extent's size, or we could copy the source inline exten= t's + * data into the destination inode's inline extent if the later is greater= then + * the former. + */ +static int clone_copy_inline_extent(struct inode *src, + struct inode *dst, + struct btrfs_trans_handle *trans, + struct btrfs_path *path, + struct btrfs_key *new_key, + const u64 drop_start, + const u64 datal, + const u64 skip, + const u64 size, + char *inline_data) +{ + struct btrfs_root *root =3D BTRFS_I(dst)->root; + const u64 aligned_end =3D ALIGN(new_key->offset + datal, + root->sectorsize); + int ret; + struct btrfs_key key; + u64 hint_byte; + + if (new_key->offset > 0) + return -EOPNOTSUPP; + + key.objectid =3D btrfs_ino(dst); + key.type =3D BTRFS_EXTENT_DATA_KEY; + key.offset =3D 0; + ret =3D btrfs_search_slot(NULL, root, &key, path, 0, 0); + if (ret < 0) { + return ret; + } else if (ret > 0) { + if (path->slots[0] >=3D btrfs_header_nritems(path->nodes[0])) { + ret =3D btrfs_next_leaf(root, path); + if (ret < 0) + return ret; + else if (ret > 0) + goto copy_inline_extent; + } + btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]); + if (key.objectid =3D=3D btrfs_ino(dst) && + key.type =3D=3D BTRFS_EXTENT_DATA_KEY) { + return -EOPNOTSUPP; + } + } else if (i_size_read(dst) <=3D datal) { + struct btrfs_file_extent_item *ei; + u64 ext_len; + + /* + * If the file size is <=3D datal, make sure there are no other + * extents following (can happen do to an fallocate call with + * the flag FALLOC_FL_KEEP_SIZE). + */ + ei =3D btrfs_item_ptr(path->nodes[0], path->slots[0], + struct btrfs_file_extent_item); + /* + * If it's an inline extent, it can not have other extents + * following it. + */ + if (btrfs_file_extent_type(path->nodes[0], ei) =3D=3D + BTRFS_FILE_EXTENT_INLINE) + goto copy_inline_extent; + + ext_len =3D btrfs_file_extent_num_bytes(path->nodes[0], ei); + if (ext_len > aligned_end) + return -EOPNOTSUPP; + + ret =3D btrfs_next_item(root, path); + if (ret < 0) { + return ret; + } else if (ret =3D=3D 0) { + btrfs_item_key_to_cpu(path->nodes[0], &key, + path->slots[0]); + if (key.objectid =3D=3D btrfs_ino(dst) && + key.type =3D=3D BTRFS_EXTENT_DATA_KEY) + return -EOPNOTSUPP; + } + } + +copy_inline_extent: + /* + * We have no extent items, or we have an extent at offset 0 which may + * or may not be inlined. All these cases are dealt the same way. + */ + if (i_size_read(dst) > datal) { + /* + * If the destination inode has an inline extent... + * This would require copying the data from the source inline + * extent into the beginning of the destination's inline extent. + * But this is really complex, both extents can be compressed + * or just one of them, which would require decompressing and + * re-compressing data (which could increase the new compressed + * size, not allowing the compressed data to fit anymore in an + * inline extent). + * So just don't support this case for now (it should be rare, + * we are not really saving space when cloning inline extents). + */ + return -EOPNOTSUPP; + } + + btrfs_release_path(path); + ret =3D btrfs_drop_extents(trans, dst, drop_start, aligned_end, + &hint_byte, 1); + if (ret) + return ret; + ret =3D btrfs_insert_empty_item(trans, root, path, new_key, size); + if (ret) + return ret; + + if (skip) { + const u32 start =3D btrfs_file_extent_calc_inline_size(0); + + memmove(inline_data + start, inline_data + start + skip, datal); + } + + write_extent_buffer(path->nodes[0], inline_data, + btrfs_item_ptr_offset(path->nodes[0], + path->slots[0]), + size); + inode_add_bytes(dst, datal); + + return 0; +} + static noinline long btrfs_ioctl_clone(struct file *file, unsigned long sr= cfd, u64 off, u64 olen, u64 destoff) { @@ -2448,20 +2593,6 @@ static noinline long btrfs_ioctl_clone(struct file *= file, unsigned long srcfd, new_key.offset +=3D skip; } =20 - /* - * Don't copy an inline extent into an offset - * greater than zero. Having an inline extent - * at such an offset results in chaos as btrfs - * isn't prepared for such cases. Just skip - * this case for the same reasons as commented - * at btrfs_ioctl_clone(). - */ - if (new_key.offset > 0) { - ret =3D -EOPNOTSUPP; - btrfs_end_transaction(trans, root); - goto out; - } - if (key.offset + datal > off+len) trim =3D key.offset + datal - (off+len); =20 @@ -2473,29 +2604,20 @@ static noinline long btrfs_ioctl_clone(struct file = *file, unsigned long srcfd, size -=3D skip + trim; datal -=3D skip + trim; =20 - ret =3D btrfs_drop_extents(trans, inode, - new_key.offset, - new_key.offset + datal, - &hint_byte, 1); - BUG_ON(ret); - - ret =3D btrfs_insert_empty_item(trans, root, path, - &new_key, size); - BUG_ON(ret); - - if (skip) { - u32 start =3D - btrfs_file_extent_calc_inline_size(0); - memmove(buf+start, buf+start+skip, - datal); + ret =3D clone_copy_inline_extent(src, inode, + trans, path, + &new_key, + new_key.offset, + datal, + skip, size, buf); + if (ret) { + BUG_ON(ret !=3D -EOPNOTSUPP); + btrfs_end_transaction(trans, root); + goto out; } =20 leaf =3D path->nodes[0]; slot =3D path->slots[0]; - write_extent_buffer(leaf, buf, - btrfs_item_ptr_offset(leaf, slot), - size); - inode_add_bytes(inode, datal); } =20 btrfs_mark_buffer_dirty(leaf); diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c index f38e452..f8224fb 100644 --- a/fs/btrfs/print-tree.c +++ b/fs/btrfs/print-tree.c @@ -240,7 +240,7 @@ void btrfs_print_leaf(struct btrfs_root *root, struct e= xtent_buffer *l) BTRFS_FILE_EXTENT_INLINE) { printk(KERN_INFO "\t\tinline extent data " "size %u\n", - btrfs_file_extent_inline_len(l, fi)); + btrfs_file_extent_inline_len(l, i, fi)); break; } printk(KERN_INFO "\t\textent data disk bytenr %llu " diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c index 21faa12..c658e7b 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -537,7 +537,7 @@ static noinline int replay_one_extent(struct btrfs_tran= s_handle *trans, if (btrfs_file_extent_disk_bytenr(eb, item) =3D=3D 0) nbytes =3D 0; } else if (found_type =3D=3D BTRFS_FILE_EXTENT_INLINE) { - size =3D btrfs_file_extent_inline_len(eb, item); + size =3D btrfs_file_extent_inline_len(eb, slot, item); nbytes =3D btrfs_file_extent_ram_bytes(eb, item); extent_end =3D (start + size + mask) & ~mask; } else { diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c index 60ff45e..9d3d74f 100644 --- a/fs/btrfs/xattr.c +++ b/fs/btrfs/xattr.c @@ -259,8 +259,10 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *b= uffer, size_t size) /* check to make sure this item is what we want */ if (found_key.objectid !=3D key.objectid) break; - if (btrfs_key_type(&found_key) !=3D BTRFS_XATTR_ITEM_KEY) + if (found_key.type > BTRFS_XATTR_ITEM_KEY) break; + if (found_key.type < BTRFS_XATTR_ITEM_KEY) + goto next; =20 di =3D btrfs_item_ptr(leaf, slot, struct btrfs_dir_item); if (verify_dir_item(root, leaf, di)) diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c index b4d2438..00d9425 100644 --- a/fs/cachefiles/rdwr.c +++ b/fs/cachefiles/rdwr.c @@ -914,6 +914,15 @@ int cachefiles_write_page(struct fscache_storage *op, = struct page *page) cache =3D container_of(object->fscache.cache, struct cachefiles_cache, cache); =20 + pos =3D (loff_t)page->index << PAGE_SHIFT; + + /* We mustn't write more data than we have, so we have to beware of a + * partial page at EOF. + */ + eof =3D object->fscache.store_limit_l; + if (pos >=3D eof) + goto error; + /* write the page to the backing filesystem and let it store it in its * own time */ dget(object->backer); @@ -922,47 +931,46 @@ int cachefiles_write_page(struct fscache_storage *op,= struct page *page) cache->cache_cred); if (IS_ERR(file)) { ret =3D PTR_ERR(file); - } else { + goto error_2; + } + if (!file->f_op->write) { ret =3D -EIO; - if (file->f_op->write) { - pos =3D (loff_t) page->index << PAGE_SHIFT; - - /* we mustn't write more data than we have, so we have - * to beware of a partial page at EOF */ - eof =3D object->fscache.store_limit_l; - len =3D PAGE_SIZE; - if (eof & ~PAGE_MASK) { - ASSERTCMP(pos, <, eof); - if (eof - pos < PAGE_SIZE) { - _debug("cut short %llx to %llx", - pos, eof); - len =3D eof - pos; - ASSERTCMP(pos + len, =3D=3D, eof); - } - } + goto error_2; + } =20 - data =3D kmap(page); - old_fs =3D get_fs(); - set_fs(KERNEL_DS); - ret =3D file->f_op->write( - file, (const void __user *) data, len, &pos); - set_fs(old_fs); - kunmap(page); - if (ret !=3D len) - ret =3D -EIO; + len =3D PAGE_SIZE; + if (eof & ~PAGE_MASK) { + if (eof - pos < PAGE_SIZE) { + _debug("cut short %llx to %llx", + pos, eof); + len =3D eof - pos; + ASSERTCMP(pos + len, =3D=3D, eof); } - fput(file); } =20 - if (ret < 0) { - if (ret =3D=3D -EIO) - cachefiles_io_error_obj( - object, "Write page to backing file failed"); - ret =3D -ENOBUFS; - } + data =3D kmap(page); + old_fs =3D get_fs(); + set_fs(KERNEL_DS); + ret =3D file->f_op->write( + file, (const void __user *) data, len, &pos); + set_fs(old_fs); + kunmap(page); + fput(file); + if (ret !=3D len) + goto error_eio; + + _leave(" =3D 0"); + return 0; =20 - _leave(" =3D %d", ret); - return ret; +error_eio: + ret =3D -EIO; +error_2: + if (ret =3D=3D -EIO) + cachefiles_io_error_obj(object, + "Write page to backing file failed"); +error: + _leave(" =3D -ENOBUFS [%d]", ret); + return -ENOBUFS; } =20 /* diff --git a/fs/exec.c b/fs/exec.c index 7adb43f..aba5e13 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -2134,8 +2134,9 @@ void do_coredump(long signr, int exit_code, struct pt= _regs *regs) const struct cred *old_cred; struct cred *cred; int retval =3D 0; - int flag =3D 0; int ispipe; + /* require nonrelative corefile path and be extra careful */ + bool need_suid_safe =3D false; static atomic_t core_dump_count =3D ATOMIC_INIT(0); struct coredump_params cprm =3D { .signr =3D signr, @@ -2161,14 +2162,15 @@ void do_coredump(long signr, int exit_code, struct = pt_regs *regs) if (!cred) goto fail; /* - * We cannot trust fsuid as being the "true" uid of the - * process nor do we know its entire history. We only know it - * was tainted so we dump it as root in mode 2. + * We cannot trust fsuid as being the "true" uid of the process + * nor do we know its entire history. We only know it was tainted + * so we dump it as root in mode 2, and only into a controlled + * environment (pipe handler or fully qualified path). */ if (__get_dumpable(cprm.mm_flags) =3D=3D 2) { /* Setuid core dump mode */ - flag =3D O_EXCL; /* Stop rewrite attacks */ cred->fsuid =3D 0; /* Dump root private */ + need_suid_safe =3D true; } =20 retval =3D coredump_wait(exit_code, &core_state); @@ -2248,8 +2250,43 @@ void do_coredump(long signr, int exit_code, struct p= t_regs *regs) if (cprm.limit < binfmt->min_coredump) goto fail_unlock; =20 + if (need_suid_safe && cn.corename[0] !=3D '/') { + printk(KERN_WARNING "Pid %d(%s) can only dump core "\ + "to fully qualified path!\n", + task_tgid_vnr(current), current->comm); + printk(KERN_WARNING "Skipping core dump\n"); + goto fail_unlock; + } + + /* + * Unlink the file if it exists unless this is a SUID + * binary - in that case, we're running around with root + * privs and don't want to unlink another user's coredump. + */ + if (!need_suid_safe) { + mm_segment_t old_fs; + + old_fs =3D get_fs(); + set_fs(KERNEL_DS); + /* + * If it doesn't exist, that's fine. If there's some + * other problem, we'll catch it at the filp_open(). + */ + (void) sys_unlink((const char __user *)cn.corename); + set_fs(old_fs); + } + + /* + * There is a race between unlinking and creating the + * file, but if that causes an EEXIST here, that's + * fine - another process raced with us while creating + * the corefile, and the other process won. To userspace, + * what matters is that at least one of the two processes + * writes its coredump successfully, not which one. + */ cprm.file =3D filp_open(cn.corename, - O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag, + O_CREAT | 2 | O_NOFOLLOW | + O_LARGEFILE | O_EXCL, 0600); if (IS_ERR(cprm.file)) goto fail_unlock; diff --git a/fs/ext4/super.c b/fs/ext4/super.c index e2cf43b..52b8ac7 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -463,9 +463,13 @@ static void ext4_handle_error(struct super_block *sb) ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); sb->s_flags |=3D MS_RDONLY; } - if (test_opt(sb, ERRORS_PANIC)) + if (test_opt(sb, ERRORS_PANIC)) { + if (EXT4_SB(sb)->s_journal && + !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR)) + return; panic("EXT4-fs (device %s): panic forced after error\n", sb->s_id); + } } =20 void __ext4_error(struct super_block *sb, const char *function, @@ -628,8 +632,12 @@ void __ext4_abort(struct super_block *sb, const char *= function, jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO); save_error_info(sb, function, line); } - if (test_opt(sb, ERRORS_PANIC)) + if (test_opt(sb, ERRORS_PANIC)) { + if (EXT4_SB(sb)->s_journal && + !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR)) + return; panic("EXT4-fs panic from previous error\n"); + } } =20 void ext4_msg(struct super_block *sb, const char *prefix, const char *fmt,= ...) diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c index e028b8e..6f4e4ed 100644 --- a/fs/fscache/netfs.c +++ b/fs/fscache/netfs.c @@ -22,6 +22,7 @@ static LIST_HEAD(fscache_netfs_list); int __fscache_register_netfs(struct fscache_netfs *netfs) { struct fscache_netfs *ptr; + struct fscache_cookie *cookie; int ret; =20 _enter("{%s}", netfs->name); @@ -29,27 +30,23 @@ int __fscache_register_netfs(struct fscache_netfs *netf= s) INIT_LIST_HEAD(&netfs->link); =20 /* allocate a cookie for the primary index */ - netfs->primary_index =3D - kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL); + cookie =3D kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL); =20 - if (!netfs->primary_index) { + if (!cookie) { _leave(" =3D -ENOMEM"); return -ENOMEM; } =20 /* initialise the primary index cookie */ - atomic_set(&netfs->primary_index->usage, 1); - atomic_set(&netfs->primary_index->n_children, 0); + atomic_set(&cookie->usage, 1); + atomic_set(&cookie->n_children, 0); =20 - netfs->primary_index->def =3D &fscache_fsdef_netfs_def; - netfs->primary_index->parent =3D &fscache_fsdef_index; - netfs->primary_index->netfs_data =3D netfs; + cookie->def =3D &fscache_fsdef_netfs_def; + cookie->parent =3D &fscache_fsdef_index; + cookie->netfs_data =3D netfs; =20 - atomic_inc(&netfs->primary_index->parent->usage); - atomic_inc(&netfs->primary_index->parent->n_children); - - spin_lock_init(&netfs->primary_index->lock); - INIT_HLIST_HEAD(&netfs->primary_index->backing_objects); + spin_lock_init(&cookie->lock); + INIT_HLIST_HEAD(&cookie->backing_objects); =20 /* check the netfs type is not already present */ down_write(&fscache_addremove_sem); @@ -60,6 +57,10 @@ int __fscache_register_netfs(struct fscache_netfs *netfs= ) goto already_registered; } =20 + atomic_inc(&cookie->parent->usage); + atomic_inc(&cookie->parent->n_children); + + netfs->primary_index =3D cookie; list_add(&netfs->link, &fscache_netfs_list); ret =3D 0; =20 @@ -69,11 +70,8 @@ int __fscache_register_netfs(struct fscache_netfs *netfs= ) already_registered: up_write(&fscache_addremove_sem); =20 - if (ret < 0) { - netfs->primary_index->parent =3D NULL; - __fscache_cookie_put(netfs->primary_index); - netfs->primary_index =3D NULL; - } + if (ret < 0) + kmem_cache_free(fscache_cookie_jar, cookie); =20 _leave(" =3D %d", ret); return ret; diff --git a/fs/fscache/page.c b/fs/fscache/page.c index 3f7a59b..c9d52e1 100644 --- a/fs/fscache/page.c +++ b/fs/fscache/page.c @@ -676,7 +676,7 @@ static void fscache_write_op(struct fscache_operation *= _op) goto superseded; page =3D results[0]; _debug("gang %d [%lx]", n, page->index); - if (page->index > op->store_limit) { + if (page->index >=3D op->store_limit) { fscache_stat(&fscache_n_store_pages_over_limit); goto superseded; } diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 7b7607e..c19b8ce 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1956,8 +1956,12 @@ static void __journal_abort_soft (journal_t *journal= , int errno) =20 __jbd2_journal_abort_hard(journal); =20 - if (errno) + if (errno) { jbd2_journal_update_sb_errno(journal); + write_lock(&journal->j_state_lock); + journal->j_flags |=3D JBD2_REC_ERR; + write_unlock(&journal->j_state_lock); + } } =20 /** diff --git a/fs/splice.c b/fs/splice.c index 34c2b2b..8357b82 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -1187,7 +1187,7 @@ ssize_t splice_direct_to_actor(struct file *in, struc= t splice_desc *sd, long ret, bytes; umode_t i_mode; size_t len; - int i, flags; + int i, flags, more; =20 /* * We require the input being a regular file, as we don't want to @@ -1230,6 +1230,7 @@ ssize_t splice_direct_to_actor(struct file *in, struc= t splice_desc *sd, * Don't block on output, we have to drain the direct pipe. */ sd->flags &=3D ~SPLICE_F_NONBLOCK; + more =3D sd->flags & SPLICE_F_MORE; =20 while (len) { size_t read_len; @@ -1243,6 +1244,15 @@ ssize_t splice_direct_to_actor(struct file *in, stru= ct splice_desc *sd, sd->total_len =3D read_len; =20 /* + * If more data is pending, set SPLICE_F_MORE + * If this is the last data and SPLICE_F_MORE was not set + * initially, clears it. + */ + if (read_len < len) + sd->flags |=3D SPLICE_F_MORE; + else if (!more) + sd->flags &=3D ~SPLICE_F_MORE; + /* * NOTE: nonblocking mode only applies to the input. We * must not do the output in nonblocking mode as then we * could get stuck data in the internal pipe: diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 6001b4da..4e3ac03 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -110,6 +110,12 @@ int acpi_unregister_ioapic(acpi_handle handle, u32 gsi= _base); void acpi_irq_stats_init(void); extern u32 acpi_irq_handled; extern u32 acpi_irq_not_handled; +extern unsigned int acpi_sci_irq; +#define INVALID_ACPI_IRQ ((unsigned)-1) +static inline bool acpi_sci_irq_valid(void) +{ + return acpi_sci_irq !=3D INVALID_ACPI_IRQ; +} =20 extern int sbf_port; extern unsigned long acpi_realmode_flags; diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h index fbfd0c4..f272051 100644 --- a/include/linux/jbd2.h +++ b/include/linux/jbd2.h @@ -954,6 +954,7 @@ struct journal_s #define JBD2_ABORT_ON_SYNCDATA_ERR 0x040 /* Abort the journal on file * data write error in ordered * mode */ +#define JBD2_REC_ERR 0x080 /* The errno in the sb has been recorded */ =20 /* * Function declarations for the journaling transaction and buffer diff --git a/include/net/inet_common.h b/include/net/inet_common.h index 22fac98..df3be8f 100644 --- a/include/net/inet_common.h +++ b/include/net/inet_common.h @@ -38,7 +38,8 @@ extern int inet_ctl_sock_create(struct sock **sk, unsigne= d short family, =20 static inline void inet_ctl_sock_destroy(struct sock *sk) { - sk_release_kernel(sk); + if (sk) + sk_release_kernel(sk); } =20 #endif diff --git a/kernel/events/core.c b/kernel/events/core.c index f475286..7c0b4f0 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5393,6 +5393,10 @@ static int perf_tp_filter_match(struct perf_event *e= vent, { void *record =3D data->raw->data; =20 + /* only top level events have filters set */ + if (event->parent) + event =3D event->parent; + if (likely(!event->filter) || filter_match_preds(event->filter, record)) return 1; return 0; diff --git a/lib/devres.c b/lib/devres.c index 7c0e953..41bff68 100644 --- a/lib/devres.c +++ b/lib/devres.c @@ -339,7 +339,7 @@ void pcim_iounmap_regions(struct pci_dev *pdev, u16 mas= k) if (!iomap) return; =20 - for (i =3D 0; i < DEVICE_COUNT_RESOURCE; i++) { + for (i =3D 0; i < PCIM_IOMAP_MAX; i++) { if (!(mask & (1 << i))) continue; =20 diff --git a/net/core/dst.c b/net/core/dst.c index d5e2c4c..946e214 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -272,7 +272,7 @@ void dst_release(struct dst_entry *dst) =20 newrefcnt =3D atomic_dec_return(&dst->__refcnt); WARN_ON(newrefcnt < 0); - if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) { + if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) { dst =3D dst_destroy(dst); if (dst) __dst_free(dst); diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index 7993d16..581dcb3 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -1590,7 +1590,7 @@ static inline int ipmr_forward_finish(struct sk_buff = *skb) { struct ip_options *opt =3D &(IPCB(skb)->opt); =20 - IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS)= ; + IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); =20 if (unlikely(opt->optlen)) ip_forward_options(skb); @@ -1652,7 +1652,7 @@ static void ipmr_queue_xmit(struct net *net, struct m= r_table *mrt, * to blackhole. */ =20 - IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS); + IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS); ip_rt_put(rt); goto out_free; } diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c index 4f3cec1..aa109da 100644 --- a/net/ipv6/tunnel6.c +++ b/net/ipv6/tunnel6.c @@ -145,6 +145,16 @@ static void tunnel6_err(struct sk_buff *skb, struct in= et6_skb_parm *opt, break; } =20 +static void tunnel46_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + u8 type, u8 code, int offset, __be32 info) +{ + struct xfrm6_tunnel *handler; + + for_each_tunnel_rcu(tunnel46_handlers, handler) + if (!handler->err_handler(skb, opt, type, code, offset, info)) + break; +} + static const struct inet6_protocol tunnel6_protocol =3D { .handler =3D tunnel6_rcv, .err_handler =3D tunnel6_err, @@ -153,7 +163,7 @@ static const struct inet6_protocol tunnel6_protocol =3D= { =20 static const struct inet6_protocol tunnel46_protocol =3D { .handler =3D tunnel46_rcv, - .err_handler =3D tunnel6_err, + .err_handler =3D tunnel46_err, .flags =3D INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, }; =20 diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c index 6115a44..0721f82 100644 --- a/net/irda/irlmp.c +++ b/net/irda/irlmp.c @@ -1868,7 +1868,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state= *iter, loff_t *off) for (element =3D hashbin_get_first(iter->hashbin); element !=3D NULL; element =3D hashbin_get_next(iter->hashbin)) { - if (!off || *off-- =3D=3D 0) { + if (!off || (*off)-- =3D=3D 0) { /* NB: hashbin left locked */ return element; } diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 9da8626..ef00f24 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -1840,7 +1840,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211= _sub_if_data *sdata, =20 if (ifmgd->rssi_min_thold !=3D ifmgd->rssi_max_thold && ifmgd->count_beacon_signal >=3D IEEE80211_SIGNAL_AVE_MIN_COUNT) { - int sig =3D ifmgd->ave_beacon_signal; + int sig =3D ifmgd->ave_beacon_signal / 16; int last_sig =3D ifmgd->last_ave_beacon_signal; =20 /* diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 0c21f06..4a912f7 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1263,10 +1263,10 @@ static void __fanout_unlink(struct sock *sk, struct= packet_sock *po) =20 bool match_fanout_group(struct packet_type *ptype, struct sock * sk) { - if (ptype->af_packet_priv =3D=3D (void*)((struct packet_sock *)sk)->fanou= t) - return true; + if (sk->sk_family !=3D PF_PACKET) + return false; =20 - return false; + return ptype->af_packet_priv =3D=3D pkt_sk(sk)->fanout; } =20 static int fanout_add(struct sock *sk, u16 id, u16 type_flags) diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c index 78205e2..4204e3b 100644 --- a/net/rds/tcp_recv.c +++ b/net/rds/tcp_recv.c @@ -235,8 +235,15 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, = struct sk_buff *skb, } =20 to_copy =3D min(tc->t_tinc_data_rem, left); - pskb_pull(clone, offset); - pskb_trim(clone, to_copy); + if (!pskb_pull(clone, offset) || + pskb_trim(clone, to_copy)) { + pr_warn("rds_tcp_data_recv: pull/trim failed " + "left %zu data_rem %zu skb_len %d\n", + left, tc->t_tinc_data_rem, skb->len); + kfree_skb(clone); + desc->error =3D -ENOMEM; + goto out; + } skb_queue_tail(&tinc->ti_skb_list, clone); =20 rdsdebug("skb %p data %p len %d off %u to_copy %zu -> " diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h index 5e29610..799d734 100644 --- a/scripts/recordmcount.h +++ b/scripts/recordmcount.h @@ -375,7 +375,7 @@ static void nop_mcount(Elf_Shdr const *const relhdr, =20 if (mcountsym =3D=3D Elf_r_sym(relp) && !is_fake_mcount(relp)) { if (make_nop) - ret =3D make_nop((void *)ehdr, shdr->sh_offset + relp->r_offset); + ret =3D make_nop((void *)ehdr, _w(shdr->sh_offset) + _w(relp->r_offset= )); if (warn_on_notrace_sect && !once) { printf("Section %s has mcount callers being ignored\n", txtname); diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index dcc95c5..1da4738 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -3099,11 +3099,13 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) =3D { .class =3D PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8, .class_mask =3D 0xffffff, .driver_data =3D AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND | + AZX_DCAPS_NO_64BIT | AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB }, #else /* this entry seems still valid -- i.e. without emu20kx chip */ { PCI_DEVICE(0x1102, 0x0009), .driver_data =3D AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND | + AZX_DCAPS_NO_64BIT | AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB }, #endif /* Vortex86MX */ diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.= c index 240658b..9b8982246 100644 --- a/sound/pci/hda/patch_sigmatel.c +++ b/sound/pci/hda/patch_sigmatel.c @@ -4980,6 +4980,7 @@ static int find_mute_led_gpio(struct hda_codec *codec= , int default_polarity) static int hp_blike_system(u32 subsystem_id) { switch (subsystem_id) { + case 0x103c1473: /* HP ProBook 6550b */ case 0x103c1520: case 0x103c1521: case 0x103c1523: =0D --=-+ucCKqsbQMP/Uf02XI2k-- --=-8pwWhx2Bdd/pdLXb5zV+ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUAVlmgNOe/yOyVhhEJAQqzNxAAjKv1Bx+wgzxUwgi0N6cztfKwvHT53ZZL hhi4UjXSLS76lgOP3nctCS228CaXAAKs21TEgYWgS4FPs6VgJPE2fmKG+8Pf/JsJ DYuujA4N78iryV03XnbzRWJvBQTiPR+Ofc3hcK1vuWRmEIG1aK6iDprnevkFcs0H o6C3RyyIz6ZW9bMY74EsP4osrQkvo21BKk0JWaHlKOwl0KNtnpRqiPGsW9+ZBOfA zEFf9llSiBAEP7ApAwpdE0Yg886cPgLTngmoiajk2z9iced/OaY7lv5mOLDJDBHP RCQkoaMbJwXIJYA3OZ8lqKDYLdp8HhDovhKY/7YpgHWn4TWBISHg4hrgfJcrz1W1 canFHXaAobCNRNxa++HQ7oLOe2MvrIYa/vkhItgwpqwJAk2DcDr8TSD2jEEVCioe GiduAULRb0J/+UuHZ7at4aHVBJCK4ONyAp7AaY5SvQfr2vyjmE7cdCZdPp5PtlAh sWjiZ2XL6iH/I3uIBQuMbLRAKdiM/5e1Zz7QOSzhBOgqB7wdOXAjysuqQHqUSSUl mL4ssdS7X1UJb12aGnsCdNI5IO+hpGCWtnEvsSrEk8vSonm95UdBGyuCyPWiFxti RhCDoI//PNrUt0GxeaNxTAdGrQmPVpsbRYQPou9J8Z0qXXJ9TQ9lK+5PYpm6gHNP LXGyLY5j6jc= =H0MW -----END PGP SIGNATURE----- --=-8pwWhx2Bdd/pdLXb5zV+--