From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751192AbdHZQVv (ORCPT ); Sat, 26 Aug 2017 12:21:51 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:56852 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751062AbdHZQVn (ORCPT ); Sat, 26 Aug 2017 12:21:43 -0400 Date: Sat, 26 Aug 2017 17:21:32 +0100 From: Ben Hutchings To: linux-kernel@vger.kernel.org, Andrew Morton , torvalds@linux-foundation.org, Jiri Slaby , stable@vger.kernel.org Cc: lwn@lwn.net Message-ID: <20170826162132.GL18698@decadent.org.uk> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="dJyWBSYfjLochwFK" Content-Disposition: inline X-Mailer: LinuxStableQueue (scripts by bwh) User-Agent: Mutt/1.5.23 (2014-03-12) X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: ben@decadent.org.uk Subject: Linux 3.16.47 X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000) X-SA-Exim-Scanned: Yes (on shadbolt.decadent.org.uk) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --dJyWBSYfjLochwFK Content-Type: multipart/mixed; boundary="/d7X7C0hV/blnKmH" Content-Disposition: inline --/d7X7C0hV/blnKmH Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable I'm announcing the release of the 3.16.47 kernel. All users of the 3.16 kernel series should upgrade. The updated 3.16.y git tree can be found at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable= =2Egit linux-3.16.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=3Dlinux/kernel/git/stable/linux-stable.git The diff from 3.16.46 is attached to this message. Ben. ------------ Makefile | 2 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 5 +- arch/arm/kvm/psci.c | 8 +- arch/arm64/include/asm/barrier.h | 12 ++- arch/arm64/include/asm/kvm_emulate.h | 6 ++ arch/arm64/include/asm/uaccess.h | 3 +- arch/arm64/kvm/sys_regs.c | 8 +- arch/metag/include/asm/uaccess.h | 49 +++++++----- arch/powerpc/include/asm/qe.h | 1 + arch/powerpc/kernel/eeh_driver.c | 19 ++++- arch/powerpc/kernel/sysfs.c | 6 ++ arch/powerpc/platforms/pseries/dlpar.c | 1 - arch/x86/boot/boot.h | 2 +- arch/x86/kernel/cpu/perf_event.h | 1 + arch/x86/kernel/cpu/perf_event_intel.c | 31 +++++--- arch/x86/mm/numa_32.c | 1 + arch/x86/mm/tlb.c | 4 +- arch/x86/um/ptrace_64.c | 2 +- drivers/Makefile | 1 + drivers/ata/libata-scsi.c | 8 ++ drivers/gpu/drm/drm_edid.c | 8 ++ drivers/hsi/clients/ssi_protocol.c | 5 +- drivers/iio/dac/ad7303.c | 6 +- drivers/iio/proximity/as3935.c | 3 +- drivers/infiniband/core/uverbs_cmd.c | 13 ++- drivers/infiniband/core/verbs.c | 8 +- drivers/infiniband/hw/mlx4/main.c | 1 + drivers/infiniband/ulp/ipoib/ipoib_fs.c | 9 ++- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 13 +++ drivers/infiniband/ulp/ipoib/ipoib_main.c | 44 +++++++++-- drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 3 - drivers/input/misc/twl4030-pwrbutton.c | 2 +- drivers/md/dm-bufio.c | 9 ++- drivers/md/dm-era-target.c | 8 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/persistent-data/dm-btree.c | 8 +- drivers/media/i2c/soc_camera/ov2640.c | 6 +- drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 + drivers/media/rc/mceusb.c | 4 +- drivers/media/usb/cx231xx/cx231xx-audio.c | 41 +++++++--- drivers/media/usb/cx231xx/cx231xx-cards.c | 46 +++++++++-- drivers/media/usb/dvb-usb/dib0700_core.c | 3 + drivers/media/usb/dvb-usb/digitv.c | 4 + drivers/media/usb/dvb-usb/dw2102.c | 54 +++++++++++++ drivers/media/usb/dvb-usb/ttusb2.c | 19 +++++ drivers/media/usb/gspca/konica.c | 3 + drivers/media/usb/pvrusb2/pvrusb2-eeprom.c | 13 +-- drivers/media/usb/usbvision/usbvision-video.c | 9 ++- drivers/media/usb/uvc/uvc_video.c | 2 +- drivers/media/usb/zr364xx/zr364xx.c | 8 ++ drivers/mfd/omap-usb-tll.c | 2 +- drivers/mtd/nand/fsmc_nand.c | 9 ++- drivers/net/ethernet/broadcom/tg3.c | 4 - drivers/net/ethernet/freescale/ucc_geth.c | 8 +- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 +- drivers/net/ethernet/mellanox/mlx4/mcg.c | 15 +++- drivers/net/ethernet/mellanox/mlx4/qp.c | 13 +++ drivers/net/virtio_net.c | 30 ++++++- drivers/net/wireless/ath/ath9k/eeprom.c | 2 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 7 ++ drivers/net/wireless/mwifiex/pcie.c | 7 ++ drivers/net/wireless/zd1211rw/zd_usb.c | 3 + drivers/of/address.c | 2 +- drivers/pci/host/pcie-designware.c | 28 +++---- drivers/pci/pci-sysfs.c | 10 ++- drivers/pci/pci.c | 9 ++- drivers/pci/proc.c | 20 ++++- drivers/pci/quirks.c | 24 ++++++ drivers/pinctrl/sh-pfc/core.c | 3 + drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 18 +++-- drivers/power/isp1704_charger.c | 4 + drivers/power/lp8788-charger.c | 2 +- drivers/power/pda_power.c | 49 ++++++------ drivers/regulator/tps65023-regulator.c | 3 +- drivers/scsi/scsi_error.c | 18 +++++ drivers/scsi/sd.c | 27 ++++++- drivers/scsi/sd.h | 1 + drivers/staging/comedi/drivers/jr3_pci.c | 13 +-- drivers/staging/gdm724x/gdm_mux.c | 21 +---- drivers/staging/iio/light/tsl2x7x_core.c | 2 +- drivers/staging/media/lirc/lirc_serial.c | 4 +- drivers/staging/rtl8188eu/core/rtw_ap.c | 2 +- drivers/target/target_core_file.c | 3 +- drivers/tty/serial/omap-serial.c | 9 ++- drivers/tty/serial/sh-sci.c | 10 ++- drivers/usb/class/cdc-acm.c | 13 ++- drivers/usb/core/driver.c | 21 +++++ drivers/usb/core/file.c | 9 ++- drivers/usb/core/hub.c | 11 ++- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/misc/legousbtower.c | 38 ++++++--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++ drivers/vfio/vfio_iommu_type1.c | 92 ++++++++++--------= ---- drivers/video/Makefile | 1 + drivers/video/fbdev/Kconfig | 2 - fs/ceph/xattr.c | 3 + fs/cifs/cifsfs.c | 15 +++- fs/cifs/cifsglob.h | 1 + fs/cifs/cifssmb.c | 3 + fs/cifs/misc.c | 2 +- fs/cifs/netmisc.c | 6 +- fs/cifs/smb2misc.c | 5 +- fs/cifs/smb2pdu.c | 14 +++- fs/dcache.c | 37 +++++++++ fs/debugfs/inode.c | 10 +-- fs/ext4/inode.c | 5 ++ fs/namei.c | 10 +-- fs/nfs/pagelist.c | 10 ++- fs/nfsd/vfs.c | 2 +- fs/notify/fanotify/fanotify_user.c | 26 ++++-- fs/notify/fsnotify.c | 8 +- fs/timerfd.c | 17 +++- fs/xattr.c | 2 +- include/linux/dcache.h | 7 ++ include/linux/fsnotify.h | 31 -------- include/linux/ima.h | 4 +- include/linux/mlx4/qp.h | 1 + include/scsi/scsi_driver.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 9 +++ ipc/mqueue.c | 4 +- kernel/locking/lockdep.c | 4 +- kernel/padata.c | 2 +- kernel/trace/ftrace.c | 14 +++- net/bluetooth/hci_sock.c | 3 +- net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_lp.c | 6 +- net/ipv4/udp.c | 2 +- net/ipv6/exthdrs.c | 1 + net/ipv6/ip6_output.c | 7 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ndisc.c | 2 + net/ipv6/output_core.c | 8 +- net/netfilter/nf_conntrack_netlink.c | 60 ++++++++------ net/packet/af_packet.c | 13 ++- security/integrity/ima/ima.h | 4 +- security/integrity/ima/ima_appraise.c | 7 +- security/integrity/ima/ima_main.c | 14 ++-- tools/perf/builtin-inject.c | 2 + tools/perf/ui/browsers/hists.c | 2 +- 140 files changed, 1056 insertions(+), 445 deletions(-) Adrian Salido (1): dm ioctl: prevent stack leak in dm ioctl call Ajay Kaher (1): USB: Proper handling of Race Condition when two USB class drivers try= to call init_usb_class simultaneously Al Viro (1): dentry name snapshots Alex Williamson (1): vfio/type1: Remove locked page accounting workqueue Alexander Tsoy (1): ath9k_htc: add device ID for Toshiba WLM-20U2/GN-1080 Alexey Brodkin (1): usb: Make sure usb/phy/of gets built-in Alyssa Milburn (4): digitv: limit messages to buffer size zr364xx: enforce minimum size when reading header ttusb2: limit messages to buffer size dw2102: limit messages to buffer size Amir Goldstein (1): fanotify: don't expose EOPENSTALE to userspace Amitoj Kaur Chawla (1): staging: gdm724x: gdm_mux: Remove create_workqueue() Andrew Jones (1): KVM: arm/arm64: fix races in kvm_psci_vcpu_on Andy Lutomirski (1): x86/mm: Fix flush_tlb_page() on Xen Arnd Bergmann (2): pvrusb2: reduce stack usage pvr2_eeprom_analyze() fbdev: sti: don't select CONFIG_VT Ashish Kalra (1): x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup Bart Van Assche (1): target/fileio: Fix zero-length READ and WRITE handling Ben Hutchings (1): Linux 3.16.47 Benjamin Coddington (1): NFS: Use GFP_NOIO for two allocations in writeback Bjorn Helgaas (2): PCI: dwc: Unindent dw_handle_msi_irq() loop PCI: Ignore write combining when mapping I/O port space Brian Norris (1): mwifiex: pcie: fix cmd_buf use-after-free in remove/reset Changbin Du (1): perf hists browser: Fix typo in function switch_data_file Christoph Hellwig (1): libata: reject passthrough WRITE SAME requests Christophe Leroy (1): net: ethernet: ucc_geth: fix MEM_PART_MURAM mode Cong Wang (1): mqueue: fix a use-after-free in sys_mq_notify() Craig Gallek (1): ip6_tunnel: Fix missing tunnel encapsulation limit option Dan Carpenter (5): PCI: dwc: Fix uninitialized variable in dw_handle_msi_irq() ath9k: off by one in ath9k_hw_nvram_read_array() HSI: ssi_protocol: double free in ssip_pn_xmit() staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data() cifs: small underflow in cnvrtDosUnixTm() Daniel Gl=C3=B6ckner (1): ima: accept previously set IMA_NEW_FILE David Ahern (1): net: ipv6: send unsolicited NA on admin up David Carrillo-Cisneros (1): perf inject: Don't proceed if perf_session__process_event() fails David S. Miller (1): ipv6: Need to export ipv6_push_frag_opts for tunneling now. David Woodhouse (3): PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms PCI: Fix another sanity check bug in /proc/pci mmap PCI: Only allow WC mmap on prefetchable resources Dmitry Kasatkin (1): ima: pass 'opened' flag to identify newly created files Dmitry Tunin (1): ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device Eric Biggers (1): ext4: evict inline data when writing to memory map Eric Dumazet (1): tcp: fix wraparound issue in tcp_lp Eva Rachel Retuya (1): staging: iio: tsl2x7x_core: Fix standard deviation calculation Fabian Frederick (1): IPoIB: Remove unnecessary test for NULL before debugfs_remove() Feras Daoud (1): IB/ipoib: Update broadcast object if PKey value was changed in index 0 Frank Schaefer (1): ov2640: fix vflip control Geert Uytterhoeven (1): pinctrl: sh-pfc: Update info pointer after SoC-specific init Giedrius Statkevi=C4=8Dius (1): power: supply: lp8788: prevent out of bounds array access Guenter Roeck (2): usb: hub: Fix error loop seen after hub communication errors usb: hub: Do not attempt to autosuspend disconnected devices Hannes Reinecke (1): scsi: scsi_error: count medium access timeout only once per EH run Ian Abbott (2): staging: comedi: jr3_pci: fix possible null pointer dereference staging: comedi: jr3_pci: cope with jiffies wraparound Jack Morgenstein (1): IB/mlx4: Fix ib device initialization error flow James Hogan (2): metag/uaccess: Fix access_ok() metag/uaccess: Check access_ok in strncpy_from_user Jason A. Donenfeld (1): padata: free correct variable Johan Hovold (12): zd1211rw: fix NULL-deref at probe mceusb: fix NULL-deref at probe ath9k_htc: fix NULL-deref at probe gspca: konica: add missing endpoint sanity check dib0700: fix NULL-deref at probe usbvision: fix NULL-deref at probe cx231xx-cards: fix NULL-deref at probe cx231xx-audio: fix init error path cx231xx-audio: fix NULL-deref at probe serial: omap: fix runtime-pm handling on unbind serial: omap: suspend device on probe errors staging: gdm724x: gdm_mux: fix use-after-free on module unload Kamal Heib (1): net/mlx4_en: Change the error print to debug print Kan Liang (1): perf/x86: Fix spurious NMI with PEBS Load Latency event Kieran Bingham (1): uvcvideo: Fix empty packet statistic Laura Abbott (1): x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init() Leon Nardella (1): ath9k_htc: Add new USB ID Liping Zhang (2): netfilter: ctnetlink: fix deadlock due to acquire _expect_lock twice netfilter: ctnetlink: make it safer when updating ct->status Ludovic Desroches (2): ARM: dts: at91: sama5d3_xplained: fix ADC vref ARM: dts: at91: sama5d3_xplained: not all ADC channels are available Luis Henriques (1): ceph: fix memory leak in __ceph_setxattr() Lukas Wunner (1): PCI: Freeze PME scan before suspending devices Maksim Salau (2): usb: misc: legousbtower: Fix buffers on stack usb: misc: legousbtower: Fix memory leak Marc Zyngier (1): arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses Marek Szyprowski (1): s5p-mfc: Fix unbalanced call to clock management Marek Vasut (1): USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev = Kit Mario Kleiner (1): drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 Mark Rutland (2): arm64: ensure extension of smp_store_release value arm64: uaccess: ensure extension of access_ok() addr Matt Ranostay (1): iio: proximity: as3935: fix as3935_write Michael J. Ruhl (2): IB/core: If the MGID/MLID pair is not on the list return an error IB/core: For multicast functions, verify that LIDs are multicast LIDs Michael S. Tsirkin (1): virtio_net: fix support for small rings Michael Trimarchi (1): power: supply: pda_power: move from timer to delayed_work Michal Hocko (1): fs/xattr.c: zero out memory copied to userspace in getxattr Mikulas Patocka (1): dm bufio: avoid a possible ABBA deadlock Nikolay Borisov (1): lockdep: teach lockdep about memalloc_noio_save Pan Bian (1): power: supply: isp1704: Fix unchecked return value of devm_kzalloc Pavel Roskin (1): iio: dac: ad7303: fix channel description Peter Chen (1): usb: host: xhci: print correct command ring address Rabin Vincent (1): CIFS: fix oplock break deadlocks Richard Cochran (1): regulator: tps65023: Fix inverted core enable logic. Richard Weinberger (1): um: Fix PTRACE_POKEUSER on x86_64 Rob Herring (1): of: fix sparse warning in of_pci_range_parser_one Russell Currey (1): powerpc/eeh: Avoid use after free in eeh_handle_special_event() Sabrina Dubroca (1): ipv6: avoid overflow of offset in ip6_find_1stfragopt Sean Young (1): serial_ir: iommap is a memory address, not bool Sebastian Reichel (1): Input: twl4030-pwrbutton - use correct device for irq request Sergei Shtylyov (4): pinctrl: sh-pfc: r8a7791: Add missing HSCIF1 pinmux data pinctrl: sh-pfc: r8a7791: Add missing DVC_MUTE signal pinctrl: sh-pfc: r8a7791: Fix SCIF2 pinmux data pinctrl: sh-pfc: r8a7791: Fix IPSR comment typos Shamir Rabinovitch (1): IB/IPoIB: ibX: failed to create mcg debug file Somasundaram Krishnasamy (1): dm era: save spacemap metadata root after the pre-commit Stefan Assmann (1): PCI: Disable boot interrupt quirk for ASUS M2N-LR Stephane Eranian (1): perf/x86/pebs: Fix handling of PEBS buffer overflows Steve French (2): Set unicode flag on cifs echo request to avoid Mac error SMB3: Work around mount failure when using SMB3 dialect to Macs Steven Rostedt (VMware) (1): ftrace: Fix removing of second function probe Szymon Janc (1): Bluetooth: Fix user channel for 32bit userspace on 64bit kernel Takatoshi Akiyama (1): serial: sh-sci: Fix panic when serial console and DMA are enabled Talat Batheesh (2): net/mlx4_en: Avoid adding steering rules with invalid ring net/mlx4: Fix the check in attaching steering rules Thomas Gleixner (1): timerfd: Protect the might cancel mechanism proper Thomas Petazzoni (1): mtd: nand: fsmc: fix NAND width handling Tobias Herzog (1): cdc-acm: fix possible invalid access when processing notification Tony Lindgren (1): mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode Tyrel Datwyler (2): powerpc/pseries: Fix of_node_put() underflow during DLPAR remove powerpc/sysfs: Fix reference leak of cpu device_nodes present at boot Vinothkumar Raja (1): dm btree: fix for dm_btree_find_lowest_key() Willem de Bruijn (2): packet: fix tp_reserve race in packet_set_ring udp: consistently apply ufo or fragmentation YueHaibing (1): tg3: don't clear stats while tg3_close Zheng Li (1): ipv6: Should use consistent conditional judgement for ip6 fragment be= tween __ip6_append_data and ip6_finish_output --/d7X7C0hV/blnKmH Content-Type: text/x-diff; charset=UTF-8; name="linux-3.16.47.patch" Content-Disposition: attachment; filename="linux-3.16.47.patch" Content-Transfer-Encoding: quoted-printable diff --git a/Makefile b/Makefile index dcff3d828383..feec4287aa87 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ VERSION =3D 3 PATCHLEVEL =3D 16 -SUBLEVEL =3D 46 +SUBLEVEL =3D 47 EXTRAVERSION =3D NAME =3D Museum of Fishiegoodies =20 diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dt= s/at91-sama5d3_xplained.dts index 5b8e40400bec..d6ca9df52fde 100644 --- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts +++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts @@ -141,9 +141,10 @@ }; =20 adc0: adc@f8018000 { + atmel,adc-vref =3D <3300>; + atmel,adc-channels-used =3D <0xfe>; pinctrl-0 =3D < &pinctrl_adc0_adtrg - &pinctrl_adc0_ad0 &pinctrl_adc0_ad1 &pinctrl_adc0_ad2 &pinctrl_adc0_ad3 @@ -151,8 +152,6 @@ &pinctrl_adc0_ad5 &pinctrl_adc0_ad6 &pinctrl_adc0_ad7 - &pinctrl_adc0_ad8 - &pinctrl_adc0_ad9 >; status =3D "okay"; }; diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c index 09cf37737ee2..5030facb4aaf 100644 --- a/arch/arm/kvm/psci.c +++ b/arch/arm/kvm/psci.c @@ -191,9 +191,10 @@ int kvm_psci_version(struct kvm_vcpu *vcpu) =20 static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) { - int ret =3D 1; + struct kvm *kvm =3D vcpu->kvm; unsigned long psci_fn =3D *vcpu_reg(vcpu, 0) & ~((u32) 0); unsigned long val; + int ret =3D 1; =20 switch (psci_fn) { case PSCI_0_2_FN_PSCI_VERSION: @@ -213,7 +214,9 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) break; case PSCI_0_2_FN_CPU_ON: case PSCI_0_2_FN64_CPU_ON: + mutex_lock(&kvm->lock); val =3D kvm_psci_vcpu_on(vcpu); + mutex_unlock(&kvm->lock); break; case PSCI_0_2_FN_AFFINITY_INFO: case PSCI_0_2_FN64_AFFINITY_INFO: @@ -269,6 +272,7 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) =20 static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu) { + struct kvm *kvm =3D vcpu->kvm; unsigned long psci_fn =3D *vcpu_reg(vcpu, 0) & ~((u32) 0); unsigned long val; =20 @@ -278,7 +282,9 @@ static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu) val =3D PSCI_RET_SUCCESS; break; case KVM_PSCI_FN_CPU_ON: + mutex_lock(&kvm->lock); val =3D kvm_psci_vcpu_on(vcpu); + mutex_unlock(&kvm->lock); break; case KVM_PSCI_FN_CPU_SUSPEND: case KVM_PSCI_FN_MIGRATE: diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barr= ier.h index 6389d60574d9..9b3172e06467 100644 --- a/arch/arm64/include/asm/barrier.h +++ b/arch/arm64/include/asm/barrier.h @@ -58,17 +58,23 @@ do { \ #define smp_rmb() dmb(ishld) #define smp_wmb() dmb(ishst) =20 -#define smp_store_release(p, v) \ +#define smp_store_release(p, v) \ do { \ + union { typeof(*p) __val; char __c[1]; } __u =3D \ + { .__val =3D (__force typeof(*p)) (v) }; \ compiletime_assert_atomic_type(*p); \ switch (sizeof(*p)) { \ case 4: \ asm volatile ("stlr %w1, %0" \ - : "=3DQ" (*p) : "r" (v) : "memory"); \ + : "=3DQ" (*p) \ + : "r" (*(__u32 *)__u.__c) \ + : "memory"); \ break; \ case 8: \ asm volatile ("stlr %1, %0" \ - : "=3DQ" (*p) : "r" (v) : "memory"); \ + : "=3DQ" (*p) \ + : "r" (*(__u64 *)__u.__c) \ + : "memory"); \ break; \ } \ } while (0) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/= kvm_emulate.h index 2d99a58f7bf8..ef490a55cdf1 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -187,6 +187,12 @@ static inline u8 kvm_vcpu_trap_get_fault(const struct = kvm_vcpu *vcpu) return kvm_vcpu_get_hsr(vcpu) & ESR_EL2_FSC_TYPE; } =20 +static inline int kvm_vcpu_sys_get_rt(struct kvm_vcpu *vcpu) +{ + u32 esr =3D kvm_vcpu_get_hsr(vcpu); + return (esr >> 5) & 0x1f; +} + static inline unsigned long kvm_vcpu_get_mpidr(struct kvm_vcpu *vcpu) { return vcpu_sys_reg(vcpu, MPIDR_EL1); diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uacc= ess.h index 3bf8f4e99a51..40d8cb5409e1 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -89,11 +89,12 @@ static inline void set_fs(mm_segment_t fs) */ #define __range_ok(addr, size) \ ({ \ + unsigned long __addr =3D (unsigned long __force)(addr); \ unsigned long flag, roksum; \ __chk_user_ptr(addr); \ asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls" \ : "=3D&r" (flag), "=3D&r" (roksum) \ - : "1" (addr), "Ir" (size), \ + : "1" (__addr), "Ir" (size), \ "r" (current_thread_info()->addr_limit) \ : "cc"); \ flag; \ diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 444e8edd71b2..9dcca0bf95de 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -504,12 +504,12 @@ int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct = kvm_run *run) { struct sys_reg_params params; u32 hsr =3D kvm_vcpu_get_hsr(vcpu); - int Rt2 =3D (hsr >> 10) & 0xf; + int Rt2 =3D (hsr >> 10) & 0x1f; =20 params.is_aarch32 =3D true; params.is_32bit =3D false; params.CRm =3D (hsr >> 1) & 0xf; - params.Rt =3D (hsr >> 5) & 0xf; + params.Rt =3D kvm_vcpu_sys_get_rt(vcpu); params.is_write =3D ((hsr & 1) =3D=3D 0); =20 params.Op0 =3D 0; @@ -554,7 +554,7 @@ int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kv= m_run *run) params.is_aarch32 =3D true; params.is_32bit =3D true; params.CRm =3D (hsr >> 1) & 0xf; - params.Rt =3D (hsr >> 5) & 0xf; + params.Rt =3D kvm_vcpu_sys_get_rt(vcpu); params.is_write =3D ((hsr & 1) =3D=3D 0); params.CRn =3D (hsr >> 10) & 0xf; params.Op0 =3D 0; @@ -629,7 +629,7 @@ int kvm_handle_sys_reg(struct kvm_vcpu *vcpu, struct kv= m_run *run) params.CRn =3D (esr >> 10) & 0xf; params.CRm =3D (esr >> 1) & 0xf; params.Op2 =3D (esr >> 17) & 0x7; - params.Rt =3D (esr >> 5) & 0x1f; + params.Rt =3D kvm_vcpu_sys_get_rt(vcpu); params.is_write =3D !(esr & 1); =20 return emulate_sys_reg(vcpu, ¶ms); diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uacc= ess.h index 9d523375f68a..560a4d5257f5 100644 --- a/arch/metag/include/asm/uaccess.h +++ b/arch/metag/include/asm/uaccess.h @@ -28,24 +28,32 @@ =20 #define segment_eq(a, b) ((a).seg =3D=3D (b).seg) =20 -#define __kernel_ok (segment_eq(get_fs(), KERNEL_DS)) -/* - * Explicitly allow NULL pointers here. Parts of the kernel such - * as readv/writev use access_ok to validate pointers, but want - * to allow NULL pointers for various reasons. NULL pointers are - * safe to allow through because the first page is not mappable on - * Meta. - * - * We also wish to avoid letting user code access the system area - * and the kernel half of the address space. - */ -#define __user_bad(addr, size) (((addr) > 0 && (addr) < META_MEMORY_BASE) = || \ - ((addr) > PAGE_OFFSET && \ - (addr) < LINCORE_BASE)) - static inline int __access_ok(unsigned long addr, unsigned long size) { - return __kernel_ok || !__user_bad(addr, size); + /* + * Allow access to the user mapped memory area, but not the system area + * before it. The check extends to the top of the address space when + * kernel access is allowed (there's no real reason to user copy to the + * system area in any case). + */ + if (likely(addr >=3D META_MEMORY_BASE && addr < get_fs().seg && + size <=3D get_fs().seg - addr)) + return true; + /* + * Explicitly allow NULL pointers here. Parts of the kernel such + * as readv/writev use access_ok to validate pointers, but want + * to allow NULL pointers for various reasons. NULL pointers are + * safe to allow through because the first page is not mappable on + * Meta. + */ + if (!addr) + return true; + /* Allow access to core code memory area... */ + if (addr >=3D LINCORE_CODE_BASE && addr <=3D LINCORE_CODE_LIMIT && + size <=3D LINCORE_CODE_LIMIT + 1 - addr) + return true; + /* ... but no other areas. */ + return false; } =20 #define access_ok(type, addr, size) __access_ok((unsigned long)(addr), \ @@ -181,8 +189,13 @@ do { = \ extern long __must_check __strncpy_from_user(char *dst, const char __user = *src, long count); =20 -#define strncpy_from_user(dst, src, count) __strncpy_from_user(dst, src, c= ount) - +static inline long +strncpy_from_user(char *dst, const char __user *src, long count) +{ + if (!access_ok(VERIFY_READ, src, 1)) + return -EFAULT; + return __strncpy_from_user(dst, src, count); +} /* * Return the size of a string (including the ending 0) * diff --git a/arch/powerpc/include/asm/qe.h b/arch/powerpc/include/asm/qe.h index 32b9bfa0c9bd..2f760b0240f3 100644 --- a/arch/powerpc/include/asm/qe.h +++ b/arch/powerpc/include/asm/qe.h @@ -193,6 +193,7 @@ static inline int qe_alive_during_sleep(void) #define qe_muram_free cpm_muram_free #define qe_muram_addr cpm_muram_addr #define qe_muram_offset cpm_muram_offset +#define qe_muram_dma cpm_muram_dma =20 /* Structure that defines QE firmware binary files. * diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_dri= ver.c index e25ee5de2f6f..0e3ad5591414 100644 --- a/arch/powerpc/kernel/eeh_driver.c +++ b/arch/powerpc/kernel/eeh_driver.c @@ -584,7 +584,7 @@ static int eeh_reset_device(struct eeh_pe *pe, struct p= ci_bus *bus) */ #define MAX_WAIT_FOR_RECOVERY 300 =20 -static void eeh_handle_normal_event(struct eeh_pe *pe) +static bool eeh_handle_normal_event(struct eeh_pe *pe) { struct pci_bus *frozen_bus; int rc =3D 0; @@ -594,7 +594,7 @@ static void eeh_handle_normal_event(struct eeh_pe *pe) if (!frozen_bus) { pr_err("%s: Cannot find PCI bus for PHB#%d-PE#%x\n", __func__, pe->phb->global_number, pe->addr); - return; + return false; } =20 eeh_pe_update_time_stamp(pe); @@ -711,7 +711,7 @@ static void eeh_handle_normal_event(struct eeh_pe *pe) pr_info("EEH: Notify device driver to resume\n"); eeh_pe_dev_traverse(pe, eeh_report_resume, NULL); =20 - return; + return false; =20 excess_failures: /* @@ -751,7 +751,11 @@ static void eeh_handle_normal_event(struct eeh_pe *pe) pci_lock_rescan_remove(); pcibios_remove_pci_devices(frozen_bus); pci_unlock_rescan_remove(); + + /* The passed PE should no longer be used */ + return true; } + return false; } =20 static void eeh_handle_special_event(void) @@ -817,7 +821,14 @@ static void eeh_handle_special_event(void) */ if (rc =3D=3D EEH_NEXT_ERR_FROZEN_PE || rc =3D=3D EEH_NEXT_ERR_FENCED_PHB) { - eeh_handle_normal_event(pe); + /* + * eeh_handle_normal_event() can make the PE stale if it + * determines that the PE cannot possibly be recovered. + * Don't modify the PE state if that's the case. + */ + if (eeh_handle_normal_event(pe)) + continue; + eeh_pe_state_clear(pe, EEH_PE_RECOVERING); } else { pci_lock_rescan_remove(); diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c index 67fd2fd2620a..52e12019e101 100644 --- a/arch/powerpc/kernel/sysfs.c +++ b/arch/powerpc/kernel/sysfs.c @@ -672,6 +672,10 @@ static void register_cpu_online(unsigned int cpu) struct device_attribute *attrs, *pmc_attrs; int i, nattrs; =20 + /* For cpus present at boot a reference was already grabbed in register_c= pu() */ + if (!s->of_node) + s->of_node =3D of_get_cpu_node(cpu, NULL); + #ifdef CONFIG_PPC64 if (cpu_has_feature(CPU_FTR_SMT)) device_create_file(s, &dev_attr_smt_snooze_delay); @@ -825,6 +829,8 @@ static void unregister_cpu_online(unsigned int cpu) } #endif cacheinfo_cpu_offline(cpu); + of_node_put(s->of_node); + s->of_node =3D NULL; } =20 #ifdef CONFIG_ARCH_CPU_PROBE_RELEASE diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platform= s/pseries/dlpar.c index 7d82a2321fc7..3993608a52d9 100644 --- a/arch/powerpc/platforms/pseries/dlpar.c +++ b/arch/powerpc/platforms/pseries/dlpar.c @@ -298,7 +298,6 @@ int dlpar_detach_node(struct device_node *dn) if (rc) return rc; =20 - of_node_put(dn); /* Must decrement the refcount */ return 0; } =20 diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h index bd49ec61255c..f673f92596fa 100644 --- a/arch/x86/boot/boot.h +++ b/arch/x86/boot/boot.h @@ -16,7 +16,7 @@ #ifndef BOOT_BOOT_H #define BOOT_BOOT_H =20 -#define STACK_SIZE 512 /* Minimum number of bytes for stack */ +#define STACK_SIZE 1024 /* Minimum number of bytes for stack */ =20 #ifndef __ASSEMBLY__ =20 diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_ev= ent.h index 3d37c04718a5..a4fac2889e89 100644 --- a/arch/x86/kernel/cpu/perf_event.h +++ b/arch/x86/kernel/cpu/perf_event.h @@ -79,6 +79,7 @@ struct amd_nb { =20 /* The maximal number of PEBS events: */ #define MAX_PEBS_EVENTS 8 +#define PEBS_COUNTER_MASK ((1ULL << MAX_PEBS_EVENTS) - 1) =20 /* * A debug store configuration. diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/p= erf_event_intel.c index 598637302db8..38b5a3514c7d 100644 --- a/arch/x86/kernel/cpu/perf_event_intel.c +++ b/arch/x86/kernel/cpu/perf_event_intel.c @@ -1401,21 +1401,34 @@ static int intel_pmu_handle_irq(struct pt_regs *reg= s) goto done; } =20 + /* + * In case multiple PEBS events are sampled at the same time, + * it is possible to have GLOBAL_STATUS bit 62 set indicating + * PEBS buffer overflow and also seeing at most 3 PEBS counters + * having their bits set in the status register. This is a sign + * that there was at least one PEBS record pending at the time + * of the PMU interrupt. PEBS counters must only be processed + * via the drain_pebs() calls and not via the regular sample + * processing loop coming after that the function, otherwise + * phony regular samples may be generated in the sampling buffer + * not marked with the EXACT tag. Another possibility is to have + * one PEBS event and at least one non-PEBS event whic hoverflows + * while PEBS has armed. In this case, bit 62 of GLOBAL_STATUS will + * not be set, yet the overflow status bit for the PEBS counter will + * be on Skylake. + * + * To avoid this problem, we systematically ignore the PEBS-enabled + * counters from the GLOBAL_STATUS mask and we always process PEBS + * events via drain_pebs(). + */ + status &=3D ~(cpuc->pebs_enabled & PEBS_COUNTER_MASK); + /* * PEBS overflow sets bit 62 in the global status register */ if (__test_and_clear_bit(62, (unsigned long *)&status)) { handled++; x86_pmu.drain_pebs(regs); - /* - * There are cases where, even though, the PEBS ovfl bit is set - * in GLOBAL_OVF_STATUS, the PEBS events may also have their - * overflow bits set for their counters. We must clear them - * here because they have been processed as exact samples in - * the drain_pebs() routine. They must not be processed again - * in the for_each_bit_set() loop for regular samples below. - */ - status &=3D ~cpuc->pebs_enabled; status &=3D x86_pmu.intel_ctrl | GLOBAL_STATUS_TRACE_TOPAPMI; } =20 diff --git a/arch/x86/mm/numa_32.c b/arch/x86/mm/numa_32.c index 47b6436e41c2..3686a1db25b2 100644 --- a/arch/x86/mm/numa_32.c +++ b/arch/x86/mm/numa_32.c @@ -100,5 +100,6 @@ void __init initmem_init(void) printk(KERN_DEBUG "High memory starts at vaddr %08lx\n", (ulong) pfn_to_kaddr(highstart_pfn)); =20 + __vmalloc_start_set =3D true; setup_bootmem_allocator(); } diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c index 46e82e75192e..3465445be664 100644 --- a/arch/x86/mm/tlb.c +++ b/arch/x86/mm/tlb.c @@ -107,8 +107,6 @@ static void flush_tlb_func(void *info) if (this_cpu_read(cpu_tlbstate.state) =3D=3D TLBSTATE_OK) { if (f->flush_end =3D=3D TLB_FLUSH_ALL) local_flush_tlb(); - else if (!f->flush_end) - __flush_tlb_single(f->flush_start); else { unsigned long addr; addr =3D f->flush_start; @@ -248,7 +246,7 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigne= d long start) } =20 if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) < nr_cpu_ids) - flush_tlb_others(mm_cpumask(mm), mm, start, 0UL); + flush_tlb_others(mm_cpumask(mm), mm, start, start + PAGE_SIZE); =20 preempt_enable(); } diff --git a/arch/x86/um/ptrace_64.c b/arch/x86/um/ptrace_64.c index 3b52bf0b418a..b0d25e6ef464 100644 --- a/arch/x86/um/ptrace_64.c +++ b/arch/x86/um/ptrace_64.c @@ -120,7 +120,7 @@ int poke_user(struct task_struct *child, long addr, lon= g data) else if ((addr >=3D offsetof(struct user, u_debugreg[0])) && (addr <=3D offsetof(struct user, u_debugreg[7]))) { addr -=3D offsetof(struct user, u_debugreg[0]); - addr =3D addr >> 2; + addr =3D addr >> 3; if ((addr =3D=3D 4) || (addr =3D=3D 5)) return -EIO; child->thread.arch.debugregs[addr] =3D data; diff --git a/drivers/Makefile b/drivers/Makefile index f98b50d8251d..848ac29b5f5e 100644 --- a/drivers/Makefile +++ b/drivers/Makefile @@ -91,6 +91,7 @@ obj-$(CONFIG_USB_PHY) +=3D usb/ obj-$(CONFIG_USB) +=3D usb/ obj-$(CONFIG_PCI) +=3D usb/ obj-$(CONFIG_USB_GADGET) +=3D usb/ +obj-$(CONFIG_OF) +=3D usb/ obj-$(CONFIG_SERIO) +=3D input/serio/ obj-$(CONFIG_GAMEPORT) +=3D input/gameport/ obj-$(CONFIG_INPUT) +=3D input/ diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index b87512ff6292..90112092d1e6 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -3097,6 +3097,14 @@ static unsigned int ata_scsi_write_same_xlat(struct = ata_queued_cmd *qc) if (unlikely(!dev->dma_mode)) goto invalid_fld; =20 + /* + * We only allow sending this command through the block layer, + * as it modifies the DATA OUT buffer, which would corrupt user + * memory for SG_IO commands. + */ + if (unlikely(scmd->request->cmd_type !=3D REQ_TYPE_FS)) + goto invalid_fld; + if (unlikely(scmd->cmd_len < 16)) goto invalid_fld; scsi_16_lba_len(cdb, &block, &n_block); diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 0149b1e6dd5b..1db601e109d0 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -74,6 +74,8 @@ #define EDID_QUIRK_FORCE_12BPC (1 << 9) /* Force 6bpc */ #define EDID_QUIRK_FORCE_6BPC (1 << 10) +/* Force 10bpc */ +#define EDID_QUIRK_FORCE_10BPC (1 << 11) =20 struct detailed_mode_closure { struct drm_connector *connector; @@ -116,6 +118,9 @@ static struct edid_quirk { { "FCM", 13600, EDID_QUIRK_PREFER_LARGE_75 | EDID_QUIRK_DETAILED_IN_CM }, =20 + /* LGD panel of HP zBook 17 G2, eDP 10 bpc, but reports unknown bpc */ + { "LGD", 764, EDID_QUIRK_FORCE_10BPC }, + /* LG Philips LCD LP154W01-A5 */ { "LPL", 0, EDID_QUIRK_DETAILED_USE_MAXIMUM_SIZE }, { "LPL", 0x2a00, EDID_QUIRK_DETAILED_USE_MAXIMUM_SIZE }, @@ -3678,6 +3683,9 @@ int drm_add_edid_modes(struct drm_connector *connecto= r, struct edid *edid) if (quirks & EDID_QUIRK_FORCE_8BPC) connector->display_info.bpc =3D 8; =20 + if (quirks & EDID_QUIRK_FORCE_10BPC) + connector->display_info.bpc =3D 10; + if (quirks & EDID_QUIRK_FORCE_12BPC) connector->display_info.bpc =3D 12; =20 diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_p= rotocol.c index ce4be3738d46..1cd3470f1a48 100644 --- a/drivers/hsi/clients/ssi_protocol.c +++ b/drivers/hsi/clients/ssi_protocol.c @@ -976,7 +976,7 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net= _device *dev) goto drop; /* Pad to 32-bits - FIXME: Revisit*/ if ((skb->len & 3) && skb_pad(skb, 4 - (skb->len & 3))) - goto drop; + goto inc_dropped; =20 /* * Modem sends Phonet messages over SSI with its own endianess... @@ -1028,8 +1028,9 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct n= et_device *dev) drop2: hsi_free_msg(msg); drop: - dev->stats.tx_dropped++; dev_kfree_skb(skb); +inc_dropped: + dev->stats.tx_dropped++; =20 return 0; } diff --git a/drivers/iio/dac/ad7303.c b/drivers/iio/dac/ad7303.c index fa2810032968..9b7d2a3311e8 100644 --- a/drivers/iio/dac/ad7303.c +++ b/drivers/iio/dac/ad7303.c @@ -184,9 +184,9 @@ static const struct iio_chan_spec_ext_info ad7303_ext_i= nfo[] =3D { .address =3D (chan), \ .scan_type =3D { \ .sign =3D 'u', \ - .realbits =3D '8', \ - .storagebits =3D '8', \ - .shift =3D '0', \ + .realbits =3D 8, \ + .storagebits =3D 8, \ + .shift =3D 0, \ }, \ .ext_info =3D ad7303_ext_info, \ } diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c index 758c14703ad8..a6370a4d6705 100644 --- a/drivers/iio/proximity/as3935.c +++ b/drivers/iio/proximity/as3935.c @@ -50,7 +50,6 @@ #define AS3935_TUNE_CAP 0x08 #define AS3935_CALIBRATE 0x3D =20 -#define AS3935_WRITE_DATA BIT(15) #define AS3935_READ_DATA BIT(14) #define AS3935_ADDRESS(x) ((x) << 8) =20 @@ -105,7 +104,7 @@ static int as3935_write(struct as3935_state *st, { u8 *buf =3D st->buf; =20 - buf[0] =3D (AS3935_WRITE_DATA | AS3935_ADDRESS(reg)) >> 8; + buf[0] =3D AS3935_ADDRESS(reg) >> 8; buf[1] =3D val; =20 return spi_write(st->spi, buf, 2); diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core= /uverbs_cmd.c index ce649a7ffa56..779067acd270 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -2577,6 +2577,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file = *file, struct ib_qp *qp; struct ib_uverbs_mcast_entry *mcast; int ret =3D -EINVAL; + bool found =3D false; =20 if (copy_from_user(&cmd, buf, sizeof cmd)) return -EFAULT; @@ -2585,10 +2586,6 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file= *file, if (!qp) return -EINVAL; =20 - ret =3D ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid); - if (ret) - goto out_put; - obj =3D container_of(qp->uobject, struct ib_uqp_object, uevent.uobject); =20 list_for_each_entry(mcast, &obj->mcast_list, list) @@ -2596,9 +2593,17 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file= *file, !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) { list_del(&mcast->list); kfree(mcast); + found =3D true; break; } =20 + if (!found) { + ret =3D -EINVAL; + goto out_put; + } + + ret =3D ib_detach_mcast(qp, (union ib_gid *)cmd.gid, cmd.mlid); + out_put: put_qp_write(qp); =20 diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verb= s.c index 0c859f7fb7a4..fb0a6d8f9c32 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -1346,7 +1346,9 @@ int ib_attach_mcast(struct ib_qp *qp, union ib_gid *g= id, u16 lid) =20 if (!qp->device->attach_mcast) return -ENOSYS; - if (gid->raw[0] !=3D 0xff || qp->qp_type !=3D IB_QPT_UD) + if (gid->raw[0] !=3D 0xff || qp->qp_type !=3D IB_QPT_UD || + lid < 0xC000 || + lid =3D=3D be16_to_cpu(IB_LID_PERMISSIVE)) return -EINVAL; =20 ret =3D qp->device->attach_mcast(qp, gid, lid); @@ -1362,7 +1364,9 @@ int ib_detach_mcast(struct ib_qp *qp, union ib_gid *g= id, u16 lid) =20 if (!qp->device->detach_mcast) return -ENOSYS; - if (gid->raw[0] !=3D 0xff || qp->qp_type !=3D IB_QPT_UD) + if (gid->raw[0] !=3D 0xff || qp->qp_type !=3D IB_QPT_UD || + lid < 0xC000 || + lid =3D=3D be16_to_cpu(IB_LID_PERMISSIVE)) return -EINVAL; =20 ret =3D qp->device->detach_mcast(qp, gid, lid); diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4= /main.c index 1397da73f636..775c3cb87097 100644 --- a/drivers/infiniband/hw/mlx4/main.c +++ b/drivers/infiniband/hw/mlx4/main.c @@ -2281,6 +2281,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev) mlx4_counter_free(ibdev->dev, ibdev->counters[i - 1]); =20 err_map: + mlx4_ib_free_eqs(dev, ibdev); iounmap(ibdev->uar_map); =20 err_uar: diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/u= lp/ipoib/ipoib_fs.c index 50061854616e..09396bd7b02d 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c @@ -281,10 +281,11 @@ void ipoib_delete_debug_files(struct net_device *dev) { struct ipoib_dev_priv *priv =3D netdev_priv(dev); =20 - if (priv->mcg_dentry) - debugfs_remove(priv->mcg_dentry); - if (priv->path_dentry) - debugfs_remove(priv->path_dentry); + WARN_ONCE(!priv->mcg_dentry, "null mcg debug file\n"); + WARN_ONCE(!priv->path_dentry, "null path debug file\n"); + debugfs_remove(priv->mcg_dentry); + debugfs_remove(priv->path_dentry); + priv->mcg_dentry =3D priv->path_dentry =3D NULL; } =20 int ipoib_register_debugfs(void) diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/u= lp/ipoib/ipoib_ib.c index fcbfdda0e585..27fe62e2fd95 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c @@ -961,6 +961,19 @@ static inline int update_parent_pkey(struct ipoib_dev_= priv *priv) */ priv->dev->broadcast[8] =3D priv->pkey >> 8; priv->dev->broadcast[9] =3D priv->pkey & 0xff; + + /* + * Update the broadcast address in the priv->broadcast object, + * in case it already exists, otherwise no one will do that. + */ + if (priv->broadcast) { + spin_lock_irq(&priv->lock); + memcpy(priv->broadcast->mcmember.mgid.raw, + priv->dev->broadcast + 4, + sizeof(union ib_gid)); + spin_unlock_irq(&priv->lock); + } + return 0; } =20 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband= /ulp/ipoib/ipoib_main.c index 1aea17fe9cbe..40be7b4206c0 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c @@ -98,6 +98,33 @@ static struct ib_client ipoib_client =3D { .remove =3D ipoib_remove_one }; =20 +#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG +static int ipoib_netdev_event(struct notifier_block *this, + unsigned long event, void *ptr) +{ + struct netdev_notifier_info *ni =3D ptr; + struct net_device *dev =3D ni->dev; + + if (dev->netdev_ops->ndo_open !=3D ipoib_open) + return NOTIFY_DONE; + + switch (event) { + case NETDEV_REGISTER: + ipoib_create_debug_files(dev); + break; + case NETDEV_CHANGENAME: + ipoib_delete_debug_files(dev); + ipoib_create_debug_files(dev); + break; + case NETDEV_UNREGISTER: + ipoib_delete_debug_files(dev); + break; + } + + return NOTIFY_DONE; +} +#endif + int ipoib_open(struct net_device *dev) { struct ipoib_dev_priv *priv =3D netdev_priv(dev); @@ -1313,8 +1340,6 @@ void ipoib_dev_cleanup(struct net_device *dev) =20 ASSERT_RTNL(); =20 - ipoib_delete_debug_files(dev); - /* Delete any child interfaces first */ list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list) { /* Stop GC on child */ @@ -1620,8 +1645,6 @@ static struct net_device *ipoib_add_port(const char *= format, goto register_failed; } =20 - ipoib_create_debug_files(priv->dev); - if (ipoib_cm_add_mode_attr(priv->dev)) goto sysfs_failed; if (ipoib_add_pkey_attr(priv->dev)) @@ -1636,7 +1659,6 @@ static struct net_device *ipoib_add_port(const char *= format, return priv->dev; =20 sysfs_failed: - ipoib_delete_debug_files(priv->dev); unregister_netdev(priv->dev); =20 register_failed: @@ -1727,6 +1749,12 @@ static void ipoib_remove_one(struct ib_device *devic= e) kfree(dev_list); } =20 +#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG +static struct notifier_block ipoib_netdev_notifier =3D { + .notifier_call =3D ipoib_netdev_event, +}; +#endif + static int __init ipoib_init_module(void) { int ret; @@ -1776,6 +1804,9 @@ static int __init ipoib_init_module(void) if (ret) goto err_client; =20 +#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG + register_netdevice_notifier(&ipoib_netdev_notifier); +#endif return 0; =20 err_client: @@ -1793,6 +1824,9 @@ static int __init ipoib_init_module(void) =20 static void __exit ipoib_cleanup_module(void) { +#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG + unregister_netdevice_notifier(&ipoib_netdev_notifier); +#endif ipoib_netlink_fini(); ib_unregister_client(&ipoib_client); ib_sa_unregister_client(&ipoib_sa_client); diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband= /ulp/ipoib/ipoib_vlan.c index 05467aa7f498..4c83a970e7f3 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c @@ -86,8 +86,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct= ipoib_dev_priv *priv, =20 priv->parent =3D ppriv->dev; =20 - ipoib_create_debug_files(priv->dev); - /* RTNL childs don't need proprietary sysfs entries */ if (type =3D=3D IPOIB_LEGACY_CHILD) { if (ipoib_cm_add_mode_attr(priv->dev)) @@ -109,7 +107,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, stru= ct ipoib_dev_priv *priv, =20 sysfs_failed: result =3D -ENOMEM; - ipoib_delete_debug_files(priv->dev); unregister_netdevice(priv->dev); =20 register_failed: diff --git a/drivers/input/misc/twl4030-pwrbutton.c b/drivers/input/misc/tw= l4030-pwrbutton.c index 8400a1a34d87..d6ee310c63cd 100644 --- a/drivers/input/misc/twl4030-pwrbutton.c +++ b/drivers/input/misc/twl4030-pwrbutton.c @@ -70,7 +70,7 @@ static int twl4030_pwrbutton_probe(struct platform_device= *pdev) pwr->phys =3D "twl4030_pwrbutton/input0"; pwr->dev.parent =3D &pdev->dev; =20 - err =3D devm_request_threaded_irq(&pwr->dev, irq, NULL, powerbutton_irq, + err =3D devm_request_threaded_irq(&pdev->dev, irq, NULL, powerbutton_irq, IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING, "twl4030_pwrbutton", pwr); if (err < 0) { diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c index 4d1edcf552bb..08ae5b492bc4 100644 --- a/drivers/md/dm-bufio.c +++ b/drivers/md/dm-bufio.c @@ -873,10 +873,11 @@ static void __get_memory_limit(struct dm_bufio_client= *c, { unsigned long buffers; =20 - if (ACCESS_ONCE(dm_bufio_cache_size) !=3D dm_bufio_cache_size_latch) { - mutex_lock(&dm_bufio_clients_lock); - __cache_size_refresh(); - mutex_unlock(&dm_bufio_clients_lock); + if (unlikely(ACCESS_ONCE(dm_bufio_cache_size) !=3D dm_bufio_cache_size_la= tch)) { + if (mutex_trylock(&dm_bufio_clients_lock)) { + __cache_size_refresh(); + mutex_unlock(&dm_bufio_clients_lock); + } } =20 buffers =3D dm_bufio_cache_size_per_client >> diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c index ad913cd4aded..330151d6ee42 100644 --- a/drivers/md/dm-era-target.c +++ b/drivers/md/dm-era-target.c @@ -957,15 +957,15 @@ static int metadata_commit(struct era_metadata *md) } } =20 - r =3D save_sm_root(md); + r =3D dm_tm_pre_commit(md->tm); if (r) { - DMERR("%s: save_sm_root failed", __func__); + DMERR("%s: pre commit failed", __func__); return r; } =20 - r =3D dm_tm_pre_commit(md->tm); + r =3D save_sm_root(md); if (r) { - DMERR("%s: pre commit failed", __func__); + DMERR("%s: save_sm_root failed", __func__); return r; } =20 diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 51521429fb59..d20c2de3fd72 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1839,7 +1839,7 @@ static int ctl_ioctl(uint command, struct dm_ioctl __= user *user) if (r) goto out; =20 - param->data_size =3D sizeof(*param); + param->data_size =3D offsetof(struct dm_ioctl, data); r =3D fn(param, input_param_size); =20 if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) && diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-= data/dm-btree.c index 7b4bb1f09b01..c156f4a19978 100644 --- a/drivers/md/persistent-data/dm-btree.c +++ b/drivers/md/persistent-data/dm-btree.c @@ -804,8 +804,12 @@ static int find_key(struct ro_spine *s, dm_block_t blo= ck, bool find_highest, else *result_key =3D le64_to_cpu(ro_node(s)->keys[0]); =20 - if (next_block || flags & INTERNAL_NODE) - block =3D value64(ro_node(s), i); + if (next_block || flags & INTERNAL_NODE) { + if (find_highest) + block =3D value64(ro_node(s), i); + else + block =3D value64(ro_node(s), 0); + } =20 } while (flags & INTERNAL_NODE); =20 diff --git a/drivers/media/i2c/soc_camera/ov2640.c b/drivers/media/i2c/soc_= camera/ov2640.c index 6c6b1c3b45e3..ee28295baaba 100644 --- a/drivers/media/i2c/soc_camera/ov2640.c +++ b/drivers/media/i2c/soc_camera/ov2640.c @@ -713,8 +713,10 @@ static int ov2640_s_ctrl(struct v4l2_ctrl *ctrl) =20 switch (ctrl->id) { case V4L2_CID_VFLIP: - val =3D ctrl->val ? REG04_VFLIP_IMG : 0x00; - return ov2640_mask_set(client, REG04, REG04_VFLIP_IMG, val); + val =3D ctrl->val ? REG04_VFLIP_IMG | REG04_VREF_EN : 0x00; + return ov2640_mask_set(client, REG04, + REG04_VFLIP_IMG | REG04_VREF_EN, val); + /* NOTE: REG04_VREF_EN: 1 line shift / even/odd line swap */ case V4L2_CID_HFLIP: val =3D ctrl->val ? REG04_HFLIP_IMG : 0x00; return ov2640_mask_set(client, REG04, REG04_HFLIP_IMG, val); diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platf= orm/s5p-mfc/s5p_mfc.c index 19c25e0245d1..2f096332db84 100644 --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c @@ -169,6 +169,7 @@ static void s5p_mfc_watchdog_worker(struct work_struct = *work) } s5p_mfc_clock_on(); ret =3D s5p_mfc_init_hw(dev); + s5p_mfc_clock_off(); if (ret) mfc_err("Failed to reinit FW\n"); } diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c index d5c1df3c9db1..6afe8a211b22 100644 --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -1299,8 +1299,8 @@ static int mceusb_dev_probe(struct usb_interface *int= f, } } } - if (ep_in =3D=3D NULL) { - dev_dbg(&intf->dev, "inbound and/or endpoint not found"); + if (!ep_in || !ep_out) { + dev_dbg(&intf->dev, "required endpoints not found\n"); return -ENODEV; } =20 diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/= cx231xx/cx231xx-audio.c index 9b925874d392..5f94b00d104f 100644 --- a/drivers/media/usb/cx231xx/cx231xx-audio.c +++ b/drivers/media/usb/cx231xx/cx231xx-audio.c @@ -672,10 +672,8 @@ static int cx231xx_audio_init(struct cx231xx *dev) =20 spin_lock_init(&adev->slock); err =3D snd_pcm_new(card, "Cx231xx Audio", 0, 0, 1, &pcm); - if (err < 0) { - snd_card_free(card); - return err; - } + if (err < 0) + goto err_free_card; =20 snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, &snd_cx231xx_pcm_capture); @@ -689,10 +687,9 @@ static int cx231xx_audio_init(struct cx231xx *dev) INIT_WORK(&dev->wq_trigger, audio_trigger); =20 err =3D snd_card_register(card); - if (err < 0) { - snd_card_free(card); - return err; - } + if (err < 0) + goto err_free_card; + adev->sndcard =3D card; adev->udev =3D dev->udev; =20 @@ -702,6 +699,11 @@ static int cx231xx_audio_init(struct cx231xx *dev) hs_config_info[0].interface_info. audio_index + 1]; =20 + if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) { + err =3D -ENODEV; + goto err_free_card; + } + adev->end_point_addr =3D uif->altsetting[0].endpoint[isoc_pipe].desc. bEndpointAddress; @@ -710,15 +712,21 @@ static int cx231xx_audio_init(struct cx231xx *dev) cx231xx_info("EndPoint Addr 0x%x, Alternate settings: %i\n", adev->end_point_addr, adev->num_alt); adev->alt_max_pkt_size =3D kmalloc(32 * adev->num_alt, GFP_KERNEL); - - if (adev->alt_max_pkt_size =3D=3D NULL) { + if (!adev->alt_max_pkt_size) { cx231xx_errdev("out of memory!\n"); - return -ENOMEM; + err =3D -ENOMEM; + goto err_free_card; } =20 for (i =3D 0; i < adev->num_alt; i++) { - u16 tmp =3D - le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc. + u16 tmp; + + if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) { + err =3D -ENODEV; + goto err_free_pkt_size; + } + + tmp =3D le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc. wMaxPacketSize); adev->alt_max_pkt_size[i] =3D (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); @@ -727,6 +735,13 @@ static int cx231xx_audio_init(struct cx231xx *dev) } =20 return 0; + +err_free_pkt_size: + kfree(adev->alt_max_pkt_size); +err_free_card: + snd_card_free(card); + + return err; } =20 static int cx231xx_audio_fini(struct cx231xx *dev) diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/= cx231xx/cx231xx-cards.c index b62b37130f07..aae9831f05a8 100644 --- a/drivers/media/usb/cx231xx/cx231xx-cards.c +++ b/drivers/media/usb/cx231xx/cx231xx-cards.c @@ -1258,6 +1258,9 @@ static int cx231xx_usb_probe(struct usb_interface *in= terface, uif =3D udev->actconfig->interface[dev->current_pcb_config. hs_config_info[0].interface_info.video_index + 1]; =20 + if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) + return -ENODEV; + dev->video_mode.end_point_addr =3D uif->altsetting[0]. endpoint[isoc_pipe].desc.bEndpointAddress; =20 @@ -1275,8 +1278,12 @@ static int cx231xx_usb_probe(struct usb_interface *i= nterface, } =20 for (i =3D 0; i < dev->video_mode.num_alt; i++) { - u16 tmp =3D le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. - desc.wMaxPacketSize); + u16 tmp; + + if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) + return -ENODEV; + + tmp =3D le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPack= etSize); dev->video_mode.alt_max_pkt_size[i] =3D (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); cx231xx_info("Alternate setting %i, max size=3D %i\n", i, @@ -1288,6 +1295,9 @@ static int cx231xx_usb_probe(struct usb_interface *in= terface, hs_config_info[0].interface_info. vanc_index + 1]; =20 + if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) + return -ENODEV; + dev->vbi_mode.end_point_addr =3D uif->altsetting[0].endpoint[isoc_pipe].desc. bEndpointAddress; @@ -1306,8 +1316,12 @@ static int cx231xx_usb_probe(struct usb_interface *i= nterface, } =20 for (i =3D 0; i < dev->vbi_mode.num_alt; i++) { - u16 tmp =3D - le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. + u16 tmp; + + if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) + return -ENODEV; + + tmp =3D le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. desc.wMaxPacketSize); dev->vbi_mode.alt_max_pkt_size[i] =3D (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); @@ -1320,6 +1334,9 @@ static int cx231xx_usb_probe(struct usb_interface *in= terface, hs_config_info[0].interface_info. hanc_index + 1]; =20 + if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) + return -ENODEV; + dev->sliced_cc_mode.end_point_addr =3D uif->altsetting[0].endpoint[isoc_pipe].desc. bEndpointAddress; @@ -1338,7 +1355,12 @@ static int cx231xx_usb_probe(struct usb_interface *i= nterface, } =20 for (i =3D 0; i < dev->sliced_cc_mode.num_alt; i++) { - u16 tmp =3D le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. + u16 tmp; + + if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) + return -ENODEV; + + tmp =3D le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. desc.wMaxPacketSize); dev->sliced_cc_mode.alt_max_pkt_size[i] =3D (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); @@ -1353,6 +1375,11 @@ static int cx231xx_usb_probe(struct usb_interface *i= nterface, interface_info. ts1_index + 1]; =20 + if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) { + retval =3D -ENODEV; + goto err_video_alt; + } + dev->ts1_mode.end_point_addr =3D uif->altsetting[0].endpoint[isoc_pipe]. desc.bEndpointAddress; @@ -1371,7 +1398,14 @@ static int cx231xx_usb_probe(struct usb_interface *i= nterface, } =20 for (i =3D 0; i < dev->ts1_mode.num_alt; i++) { - u16 tmp =3D le16_to_cpu(uif->altsetting[i]. + u16 tmp; + + if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) { + retval =3D -ENODEV; + goto err_video_alt; + } + + tmp =3D le16_to_cpu(uif->altsetting[i]. endpoint[isoc_pipe].desc. wMaxPacketSize); dev->ts1_mode.alt_max_pkt_size[i] =3D diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/d= vb-usb/dib0700_core.c index 72eccefce9fc..4f3e71c7aec8 100644 --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -769,6 +769,9 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct u= sb_interface *intf) =20 /* Starting in firmware 1.20, the RC info is provided on a bulk pipe */ =20 + if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1) + return -ENODEV; + purb =3D usb_alloc_urb(0, GFP_KERNEL); if (purb =3D=3D NULL) { err("rc usb alloc urb failed"); diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb= /digitv.c index 772bde3c5020..c86fef6b1c21 100644 --- a/drivers/media/usb/dvb-usb/digitv.c +++ b/drivers/media/usb/dvb-usb/digitv.c @@ -30,6 +30,10 @@ static int digitv_ctrl_msg(struct dvb_usb_device *d, { int wo =3D (rbuf =3D=3D NULL || rlen =3D=3D 0); /* write-only */ u8 sndbuf[7],rcvbuf[7]; + + if (wlen > 4 || rlen > 4) + return -EIO; + memset(sndbuf,0,7); memset(rcvbuf,0,7); =20 sndbuf[0] =3D cmd; diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb= /dw2102.c index ae0f56a32e4d..3ec61a9082f3 100644 --- a/drivers/media/usb/dvb-usb/dw2102.c +++ b/drivers/media/usb/dvb-usb/dw2102.c @@ -247,6 +247,20 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapte= r *adap, =20 switch (num) { case 2: + if (msg[0].len !=3D 1) { + warn("i2c rd: len=3D%d is not 1!\n", + msg[0].len); + num =3D -EOPNOTSUPP; + break; + } + + if (2 + msg[1].len > sizeof(buf6)) { + warn("i2c rd: len=3D%d is too big!\n", + msg[1].len); + num =3D -EOPNOTSUPP; + break; + } + /* read si2109 register by number */ buf6[0] =3D msg[0].addr << 1; buf6[1] =3D msg[0].len; @@ -262,6 +276,13 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapte= r *adap, case 1: switch (msg[0].addr) { case 0x68: + if (2 + msg[0].len > sizeof(buf6)) { + warn("i2c wr: len=3D%d is too big!\n", + msg[0].len); + num =3D -EOPNOTSUPP; + break; + } + /* write to si2109 register */ buf6[0] =3D msg[0].addr << 1; buf6[1] =3D msg[0].len; @@ -305,6 +326,13 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapte= r *adap, struct i2c_msg ms /* first write first register number */ u8 ibuf[MAX_XFER_SIZE], obuf[3]; =20 + if (2 + msg[0].len !=3D sizeof(obuf)) { + warn("i2c rd: len=3D%d is not 1!\n", + msg[0].len); + ret =3D -EOPNOTSUPP; + goto unlock; + } + if (2 + msg[1].len > sizeof(ibuf)) { warn("i2c rd: len=3D%d is too big!\n", msg[1].len); @@ -505,6 +533,12 @@ static int dw3101_i2c_transfer(struct i2c_adapter *ada= p, struct i2c_msg msg[], /* first write first register number */ u8 ibuf[MAX_XFER_SIZE], obuf[3]; =20 + if (2 + msg[0].len !=3D sizeof(obuf)) { + warn("i2c rd: len=3D%d is not 1!\n", + msg[0].len); + ret =3D -EOPNOTSUPP; + goto unlock; + } if (2 + msg[1].len > sizeof(ibuf)) { warn("i2c rd: len=3D%d is too big!\n", msg[1].len); @@ -730,6 +764,13 @@ static int su3000_i2c_transfer(struct i2c_adapter *ada= p, struct i2c_msg msg[], msg[0].buf[0] =3D ibuf[1]; break; default: + if (3 + msg[0].len > sizeof(obuf)) { + warn("i2c wr: len=3D%d is too big!\n", + msg[0].len); + num =3D -EOPNOTSUPP; + break; + } + /* always i2c write*/ obuf[0] =3D 0x08; obuf[1] =3D msg[0].addr; @@ -745,6 +786,19 @@ static int su3000_i2c_transfer(struct i2c_adapter *ada= p, struct i2c_msg msg[], break; case 2: /* always i2c read */ + if (4 + msg[0].len > sizeof(obuf)) { + warn("i2c rd: len=3D%d is too big!\n", + msg[0].len); + num =3D -EOPNOTSUPP; + break; + } + if (1 + msg[1].len > sizeof(obuf)) { + warn("i2c rd: len=3D%d is too big!\n", + msg[1].len); + num =3D -EOPNOTSUPP; + break; + } + obuf[0] =3D 0x09; obuf[1] =3D msg[0].len; obuf[2] =3D msg[1].len; diff --git a/drivers/media/usb/dvb-usb/ttusb2.c b/drivers/media/usb/dvb-usb= /ttusb2.c index 2ce3d19c58ef..9dd0ee4f84de 100644 --- a/drivers/media/usb/dvb-usb/ttusb2.c +++ b/drivers/media/usb/dvb-usb/ttusb2.c @@ -78,6 +78,9 @@ static int ttusb2_msg(struct dvb_usb_device *d, u8 cmd, u8 *s, *r =3D NULL; int ret =3D 0; =20 + if (4 + rlen > 64) + return -EIO; + s =3D kzalloc(wlen+4, GFP_KERNEL); if (!s) return -ENOMEM; @@ -381,6 +384,22 @@ static int ttusb2_i2c_xfer(struct i2c_adapter *adap,st= ruct i2c_msg msg[],int num write_read =3D i+1 < num && (msg[i+1].flags & I2C_M_RD); read =3D msg[i].flags & I2C_M_RD; =20 + if (3 + msg[i].len > sizeof(obuf)) { + err("i2c wr len=3D%d too high", msg[i].len); + break; + } + if (write_read) { + if (3 + msg[i+1].len > sizeof(ibuf)) { + err("i2c rd len=3D%d too high", msg[i+1].len); + break; + } + } else if (read) { + if (3 + msg[i].len > sizeof(ibuf)) { + err("i2c rd len=3D%d too high", msg[i].len); + break; + } + } + obuf[0] =3D (msg[i].addr << 1) | (write_read | read); if (read) obuf[1] =3D 0; diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/kon= ica.c index 39c96bb4c985..04972291a5a5 100644 --- a/drivers/media/usb/gspca/konica.c +++ b/drivers/media/usb/gspca/konica.c @@ -188,6 +188,9 @@ static int sd_start(struct gspca_dev *gspca_dev) return -EIO; } =20 + if (alt->desc.bNumEndpoints < 2) + return -ENODEV; + packet_size =3D le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); =20 n =3D gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv; diff --git a/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c b/drivers/media/usb= /pvrusb2/pvrusb2-eeprom.c index 9515f3a68f8f..122815e1cb65 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c @@ -123,15 +123,10 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw) memset(&tvdata,0,sizeof(tvdata)); =20 eeprom =3D pvr2_eeprom_fetch(hdw); - if (!eeprom) return -EINVAL; - - { - struct i2c_client fake_client; - /* Newer version expects a useless client interface */ - fake_client.addr =3D hdw->eeprom_addr; - fake_client.adapter =3D &hdw->i2c_adap; - tveeprom_hauppauge_analog(&fake_client,&tvdata,eeprom); - } + if (!eeprom) + return -EINVAL; + + tveeprom_hauppauge_analog(NULL, &tvdata, eeprom); =20 trace_eeprom("eeprom assumed v4l tveeprom module"); trace_eeprom("eeprom direct call results:"); diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/= usb/usbvision/usbvision-video.c index 354f5a7ae887..e70eca819be9 100644 --- a/drivers/media/usb/usbvision/usbvision-video.c +++ b/drivers/media/usb/usbvision/usbvision-video.c @@ -1599,7 +1599,14 @@ static int usbvision_probe(struct usb_interface *int= f, } =20 for (i =3D 0; i < usbvision->num_alt; i++) { - u16 tmp =3D le16_to_cpu(uif->altsetting[i].endpoint[1].desc. + u16 tmp; + + if (uif->altsetting[i].desc.bNumEndpoints < 2) { + ret =3D -ENODEV; + goto err_pkt; + } + + tmp =3D le16_to_cpu(uif->altsetting[i].endpoint[1].desc. wMaxPacketSize); usbvision->alt_max_pkt_size[i] =3D (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_= video.c index 9144a2f3ed82..72774f32da2e 100644 --- a/drivers/media/usb/uvc/uvc_video.c +++ b/drivers/media/usb/uvc/uvc_video.c @@ -810,7 +810,7 @@ static void uvc_video_stats_decode(struct uvc_streaming= *stream, =20 /* Update the packets counters. */ stream->stats.frame.nb_packets++; - if (len > header_size) + if (len <=3D header_size) stream->stats.frame.nb_empty++; =20 if (data[1] & UVC_STREAM_ERR) diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364x= x/zr364xx.c index 74d56df3347f..886e64361e17 100644 --- a/drivers/media/usb/zr364xx/zr364xx.c +++ b/drivers/media/usb/zr364xx/zr364xx.c @@ -605,6 +605,14 @@ static int zr364xx_read_video_callback(struct zr364xx_= camera *cam, ptr =3D pdest =3D frm->lpvbits; =20 if (frm->ulState =3D=3D ZR364XX_READ_IDLE) { + if (purb->actual_length < 128) { + /* header incomplete */ + dev_info(&cam->udev->dev, + "%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n", + __func__, purb->actual_length); + return -EINVAL; + } + frm->ulState =3D ZR364XX_READ_FRAME; frm->cur_size =3D 0; =20 diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c index 0f8cd6bbe914..1224921217f2 100644 --- a/drivers/mfd/omap-usb-tll.c +++ b/drivers/mfd/omap-usb-tll.c @@ -376,8 +376,8 @@ int omap_tll_init(struct usbhs_omap_platform_data *pdat= a) * and use SDR Mode */ reg &=3D ~(OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE - | OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF | OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE); + reg |=3D OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF; } else if (pdata->port_mode[i] =3D=3D OMAP_EHCI_PORT_MODE_HSIC) { /* diff --git a/drivers/mtd/nand/fsmc_nand.c b/drivers/mtd/nand/fsmc_nand.c index 1550692973dc..c593a3fbcdd9 100644 --- a/drivers/mtd/nand/fsmc_nand.c +++ b/drivers/mtd/nand/fsmc_nand.c @@ -874,18 +874,19 @@ static int fsmc_nand_probe_config_dt(struct platform_= device *pdev, struct fsmc_nand_platform_data *pdata =3D dev_get_platdata(&pdev->dev); u32 val; =20 - /* Set default NAND width to 8 bits */ - pdata->width =3D 8; + pdata->options =3D 0; + if (!of_property_read_u32(np, "bank-width", &val)) { if (val =3D=3D 2) { - pdata->width =3D 16; + pdata->options |=3D NAND_BUSWIDTH_16; } else if (val !=3D 1) { dev_err(&pdev->dev, "invalid bank-width %u\n", val); return -EINVAL; } } + if (of_get_property(np, "nand-skip-bbtscan", NULL)) - pdata->options =3D NAND_SKIP_BBTSCAN; + pdata->options |=3D NAND_SKIP_BBTSCAN; =20 pdata->nand_timings =3D devm_kzalloc(&pdev->dev, sizeof(*pdata->nand_timings), GFP_KERNEL); diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/bro= adcom/tg3.c index c13932e671fb..17036ff0b925 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -11709,10 +11709,6 @@ static int tg3_close(struct net_device *dev) =20 tg3_stop(tp); =20 - /* Clear stats across close / open calls */ - memset(&tp->net_stats_prev, 0, sizeof(tp->net_stats_prev)); - memset(&tp->estats_prev, 0, sizeof(tp->estats_prev)); - if (pci_device_is_present(tp->pdev)) { tg3_power_down_prepare(tp); =20 diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethern= et/freescale/ucc_geth.c index 36fc429298e3..97e38b828a18 100644 --- a/drivers/net/ethernet/freescale/ucc_geth.c +++ b/drivers/net/ethernet/freescale/ucc_geth.c @@ -2590,11 +2590,10 @@ static int ucc_geth_startup(struct ucc_geth_private= *ugeth) } else if (ugeth->ug_info->uf_info.bd_mem_part =3D=3D MEM_PART_MURAM) { out_be32(&ugeth->p_send_q_mem_reg->sqqd[i].bd_ring_base, - (u32) immrbar_virt_to_phys(ugeth-> - p_tx_bd_ring[i])); + (u32)qe_muram_dma(ugeth->p_tx_bd_ring[i])); out_be32(&ugeth->p_send_q_mem_reg->sqqd[i]. last_bd_completed_address, - (u32) immrbar_virt_to_phys(endOfRing)); + (u32)qe_muram_dma(endOfRing)); } } =20 @@ -2840,8 +2839,7 @@ static int ucc_geth_startup(struct ucc_geth_private *= ugeth) } else if (ugeth->ug_info->uf_info.bd_mem_part =3D=3D MEM_PART_MURAM) { out_be32(&ugeth->p_rx_bd_qs_tbl[i].externalbdbaseptr, - (u32) immrbar_virt_to_phys(ugeth-> - p_rx_bd_ring[i])); + (u32)qe_muram_dma(ugeth->p_rx_bd_ring[i])); } /* rest of fields handled by QE */ } diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ether= net/mellanox/mlx4/en_rx.c index 92045adc74fd..d0fcb6831599 100644 --- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c @@ -993,7 +993,8 @@ void mlx4_en_calc_rx_buf(struct net_device *dev) en_dbg(DRV, priv, "Rx buffer scatter-list (effective-mtu:%d num_frags:%d)= :\n", eff_mtu, priv->num_frags); for (i =3D 0; i < priv->num_frags; i++) { - en_err(priv, + en_dbg(DRV, + priv, " frag:%d - size:%d prefix:%d align:%d stride:%d\n", i, priv->frag_info[i].frag_size, diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/etherne= t/mellanox/mlx4/mcg.c index 5866499a38ca..1e459a59dc72 100644 --- a/drivers/net/ethernet/mellanox/mlx4/mcg.c +++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c @@ -35,6 +35,7 @@ #include =20 #include +#include #include =20 #include "mlx4.h" @@ -889,16 +890,21 @@ int mlx4_flow_attach(struct mlx4_dev *dev, if (IS_ERR(mailbox)) return PTR_ERR(mailbox); =20 + if (!mlx4_qp_lookup(dev, rule->qpn)) { + mlx4_err_rule(dev, "QP doesn't exist\n", rule); + ret =3D -EINVAL; + goto out; + } + trans_rule_ctrl_to_hw(rule, mailbox->buf); =20 size +=3D sizeof(struct mlx4_net_trans_rule_hw_ctrl); =20 list_for_each_entry(cur, &rule->list, list) { ret =3D parse_trans_rule(dev, cur, mailbox->buf + size); - if (ret < 0) { - mlx4_free_cmd_mailbox(dev, mailbox); - return ret; - } + if (ret < 0) + goto out; + size +=3D ret; } =20 @@ -910,6 +916,7 @@ int mlx4_flow_attach(struct mlx4_dev *dev, else if (ret) mlx4_err_rule(dev, "Fail to register network rule\n", rule); =20 +out: mlx4_free_cmd_mailbox(dev, mailbox); =20 return ret; diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet= /mellanox/mlx4/qp.c index 0dc31d85fc3b..aeaf888e0e73 100644 --- a/drivers/net/ethernet/mellanox/mlx4/qp.c +++ b/drivers/net/ethernet/mellanox/mlx4/qp.c @@ -355,6 +355,19 @@ static void mlx4_qp_free_icm(struct mlx4_dev *dev, int= qpn) __mlx4_qp_free_icm(dev, qpn); } =20 +struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn) +{ + struct mlx4_qp_table *qp_table =3D &mlx4_priv(dev)->qp_table; + struct mlx4_qp *qp; + + spin_lock(&qp_table->lock); + + qp =3D __mlx4_qp_lookup(dev, qpn); + + spin_unlock(&qp_table->lock); + return qp; +} + int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t= gfp) { struct mlx4_priv *priv =3D mlx4_priv(dev); diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 0ef4ee7289b4..e021332165c3 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -27,6 +27,7 @@ #include #include #include +#include =20 static int napi_weight =3D NAPI_POLL_WEIGHT; module_param(napi_weight, int, 0444); @@ -92,6 +93,9 @@ struct receive_queue { /* RX: fragments + linear part + virtio header */ struct scatterlist sg[MAX_SKB_FRAGS + 2]; =20 + /* Min single buffer size for mergeable buffers case. */ + unsigned int min_buf_len; + /* Name of this receive queue: input.$index */ char name[40]; }; @@ -600,13 +604,14 @@ static int add_recvbuf_big(struct receive_queue *rq, = gfp_t gfp) return err; } =20 -static unsigned int get_mergeable_buf_len(struct ewma *avg_pkt_len) +static unsigned int get_mergeable_buf_len(struct receive_queue *rq, + struct ewma *avg_pkt_len) { const size_t hdr_len =3D sizeof(struct virtio_net_hdr_mrg_rxbuf); unsigned int len; =20 len =3D hdr_len + clamp_t(unsigned int, ewma_read(avg_pkt_len), - GOOD_PACKET_LEN, PAGE_SIZE - hdr_len); + rq->min_buf_len - hdr_len, PAGE_SIZE - hdr_len); return ALIGN(len, MERGEABLE_BUFFER_ALIGN); } =20 @@ -618,7 +623,7 @@ static int add_recvbuf_mergeable(struct receive_queue *= rq, gfp_t gfp) int err; unsigned int len, hole; =20 - len =3D get_mergeable_buf_len(&rq->mrg_avg_pkt_len); + len =3D get_mergeable_buf_len(rq, &rq->mrg_avg_pkt_len); if (unlikely(!skb_page_frag_refill(len, alloc_frag, gfp))) return -ENOMEM; =20 @@ -1462,6 +1467,21 @@ static void virtnet_del_vqs(struct virtnet_info *vi) virtnet_free_queues(vi); } =20 +/* How large should a single buffer be so a queue full of these can fit at + * least one full packet? + * Logic below assumes the mergeable buffer header is used. + */ +static unsigned int mergeable_min_buf_len(struct virtnet_info *vi, struct = virtqueue *vq) +{ + const unsigned int hdr_len =3D sizeof(struct virtio_net_hdr_mrg_rxbuf); + unsigned int rq_size =3D virtqueue_get_vring_size(vq); + unsigned int packet_len =3D IP_MAX_MTU; + unsigned int buf_len =3D hdr_len + ETH_HLEN + VLAN_HLEN + packet_len; + unsigned int min_buf_len =3D DIV_ROUND_UP(buf_len, rq_size); + + return max(min_buf_len, hdr_len); +} + static int virtnet_find_vqs(struct virtnet_info *vi) { vq_callback_t **callbacks; @@ -1517,6 +1537,7 @@ static int virtnet_find_vqs(struct virtnet_info *vi) =20 for (i =3D 0; i < vi->max_queue_pairs; i++) { vi->rq[i].vq =3D vqs[rxq2vq(i)]; + vi->rq[i].min_buf_len =3D mergeable_min_buf_len(vi, vi->rq[i].vq); vi->sq[i].vq =3D vqs[txq2vq(i)]; } =20 @@ -1601,7 +1622,8 @@ static ssize_t mergeable_rx_buffer_size_show(struct n= etdev_rx_queue *queue, =20 BUG_ON(queue_index >=3D vi->max_queue_pairs); avg =3D &vi->rq[queue_index].mrg_avg_pkt_len; - return sprintf(buf, "%u\n", get_mergeable_buf_len(avg)); + return sprintf(buf, "%u\n", + get_mergeable_buf_len(&vi->rq[queue_index], avg)); } =20 static struct rx_queue_attribute mergeable_rx_buffer_size_attribute =3D diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless= /ath/ath9k/eeprom.c index 2ac05486424b..ddef028875dc 100644 --- a/drivers/net/wireless/ath/ath9k/eeprom.c +++ b/drivers/net/wireless/ath/ath9k/eeprom.c @@ -118,7 +118,7 @@ static bool ath9k_hw_nvram_read_blob(struct ath_hw *ah,= u32 off, { u16 *blob_data; =20 - if (off * sizeof(u16) > ah->eeprom_blob->size) + if (off * sizeof(u16) >=3D ah->eeprom_blob->size) return false; =20 blob_data =3D (u16 *)ah->eeprom_blob->data; diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireles= s/ath/ath9k/hif_usb.c index 8e7153b186ed..2bb8dd09fec2 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -40,6 +40,8 @@ static struct usb_device_id ath9k_hif_usb_ids[] =3D { { USB_DEVICE(0x0cf3, 0xb003) }, /* Ubiquiti WifiStation Ext */ { USB_DEVICE(0x0cf3, 0xb002) }, /* Ubiquiti WifiStation */ { USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */ + { USB_DEVICE(0x0471, 0x209e) }, /* Philips (or NXP) PTA01 */ + { USB_DEVICE(0x1eda, 0x2315) }, /* AirTies */ =20 { USB_DEVICE(0x0cf3, 0x7015), .driver_info =3D AR9287_USB }, /* Atheros */ @@ -58,6 +60,8 @@ static struct usb_device_id ath9k_hif_usb_ids[] =3D { .driver_info =3D AR9280_USB }, /* Buffalo WLI-UV-AG300P */ { USB_DEVICE(0x04da, 0x3904), .driver_info =3D AR9280_USB }, + { USB_DEVICE(0x0930, 0x0a08), + .driver_info =3D AR9280_USB }, /* Toshiba WLM-20U2 and GN-1080 */ =20 { USB_DEVICE(0x0cf3, 0x20ff), .driver_info =3D STORAGE_DEVICE }, @@ -1143,6 +1147,9 @@ static int send_eject_command(struct usb_interface *i= nterface) u8 bulk_out_ep; int r; =20 + if (iface_desc->desc.bNumEndpoints < 2) + return -ENODEV; + /* Find bulk out endpoint */ for (r =3D 1; r >=3D 0; r--) { endpoint =3D &iface_desc->endpoint[r].desc; diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwi= fiex/pcie.c index 2cc9b6fca490..99119b45f996 100644 --- a/drivers/net/wireless/mwifiex/pcie.c +++ b/drivers/net/wireless/mwifiex/pcie.c @@ -905,6 +905,7 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifie= x_adapter *adapter) if (card && card->cmd_buf) { mwifiex_unmap_pci_memory(adapter, card->cmd_buf, PCI_DMA_TODEVICE); + dev_kfree_skb_any(card->cmd_buf); } return 0; } @@ -1446,6 +1447,11 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapte= r, struct sk_buff *skb) return -1; =20 card->cmd_buf =3D skb; + /* + * Need to keep a reference, since core driver might free up this + * buffer before we've unmapped it. + */ + skb_get(skb); =20 /* To send a command, the driver will: 1. Write the 64bit physical address of the data buffer to @@ -1542,6 +1548,7 @@ static int mwifiex_pcie_process_cmd_complete(struct m= wifiex_adapter *adapter) if (card->cmd_buf) { mwifiex_unmap_pci_memory(adapter, card->cmd_buf, PCI_DMA_TODEVICE); + dev_kfree_skb_any(card->cmd_buf); card->cmd_buf =3D NULL; } =20 diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/= zd1211rw/zd_usb.c index a912dc051111..8d621ee5f349 100644 --- a/drivers/net/wireless/zd1211rw/zd_usb.c +++ b/drivers/net/wireless/zd1211rw/zd_usb.c @@ -1278,6 +1278,9 @@ static int eject_installer(struct usb_interface *intf) u8 bulk_out_ep; int r; =20 + if (iface_desc->desc.bNumEndpoints < 2) + return -ENODEV; + /* Find bulk out endpoint */ for (r =3D 1; r >=3D 0; r--) { endpoint =3D &iface_desc->endpoint[r].desc; diff --git a/drivers/of/address.c b/drivers/of/address.c index 5af2a0deff14..01570bf23842 100644 --- a/drivers/of/address.c +++ b/drivers/of/address.c @@ -258,7 +258,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_= pci_range_parser *parser, if (!parser->range || parser->range + parser->np > parser->end) return NULL; =20 - range->pci_space =3D parser->range[0]; + range->pci_space =3D be32_to_cpup(parser->range); range->flags =3D of_bus_pci_get_flags(parser->range); range->pci_addr =3D of_read_number(parser->range + 1, ns); range->cpu_addr =3D of_translate_address(parser->node, diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-des= ignware.c index 1eaf4df3618a..2015aef792f1 100644 --- a/drivers/pci/host/pcie-designware.c +++ b/drivers/pci/host/pcie-designware.c @@ -158,25 +158,25 @@ static struct irq_chip dw_msi_irq_chip =3D { /* MSI int handler */ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp) { - unsigned long val; + u32 val; int i, pos, irq; irqreturn_t ret =3D IRQ_NONE; =20 for (i =3D 0; i < MAX_MSI_CTRLS; i++) { dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_STATUS + i * 12, 4, - (u32 *)&val); - if (val) { - ret =3D IRQ_HANDLED; - pos =3D 0; - while ((pos =3D find_next_bit(&val, 32, pos)) !=3D 32) { - irq =3D irq_find_mapping(pp->irq_domain, - i * 32 + pos); - dw_pcie_wr_own_conf(pp, - PCIE_MSI_INTR0_STATUS + i * 12, - 4, 1 << pos); - generic_handle_irq(irq); - pos++; - } + &val); + if (!val) + continue; + + ret =3D IRQ_HANDLED; + pos =3D 0; + while ((pos =3D find_next_bit((unsigned long *) &val, 32, + pos)) !=3D 32) { + irq =3D irq_find_mapping(pp->irq_domain, i * 32 + pos); + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS + i * 12, + 4, 1 << pos); + generic_handle_irq(irq); + pos++; } } =20 diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index ca5434b97ef4..7505fa72ea5d 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -965,15 +965,19 @@ void pci_remove_legacy_files(struct pci_bus *b) int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *= vma, enum pci_mmap_api mmap_api) { - unsigned long nr, start, size, pci_start; + unsigned long nr, start, size; + resource_size_t pci_start =3D 0, pci_end; =20 if (pci_resource_len(pdev, resno) =3D=3D 0) return 0; nr =3D vma_pages(vma); start =3D vma->vm_pgoff; size =3D ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1; - pci_start =3D (mmap_api =3D=3D PCI_MMAP_PROCFS) ? - pci_resource_start(pdev, resno) >> PAGE_SHIFT : 0; + if (mmap_api =3D=3D PCI_MMAP_PROCFS) { + pci_resource_to_user(pdev, resno, &pdev->resource[resno], + &pci_start, &pci_end); + pci_start >>=3D PAGE_SHIFT; + } if (start >=3D pci_start && start < pci_start + size && start + nr <=3D pci_start + size) return 1; diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 2e54269f5458..435d3830c181 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -1676,8 +1676,8 @@ static void pci_pme_list_scan(struct work_struct *wor= k) } } if (!list_empty(&pci_pme_list)) - schedule_delayed_work(&pci_pme_work, - msecs_to_jiffies(PME_TIMEOUT)); + queue_delayed_work(system_freezable_wq, &pci_pme_work, + msecs_to_jiffies(PME_TIMEOUT)); mutex_unlock(&pci_pme_list_mutex); } =20 @@ -1737,8 +1737,9 @@ void pci_pme_active(struct pci_dev *dev, bool enable) mutex_lock(&pci_pme_list_mutex); list_add(&pme_dev->list, &pci_pme_list); if (list_is_singular(&pci_pme_list)) - schedule_delayed_work(&pci_pme_work, - msecs_to_jiffies(PME_TIMEOUT)); + queue_delayed_work(system_freezable_wq, + &pci_pme_work, + msecs_to_jiffies(PME_TIMEOUT)); mutex_unlock(&pci_pme_list_mutex); } else { mutex_lock(&pci_pme_list_mutex); diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c index 3f155e78513f..66c886365fbc 100644 --- a/drivers/pci/proc.c +++ b/drivers/pci/proc.c @@ -231,23 +231,35 @@ static int proc_bus_pci_mmap(struct file *file, struc= t vm_area_struct *vma) { struct pci_dev *dev =3D PDE_DATA(file_inode(file)); struct pci_filp_private *fpriv =3D file->private_data; - int i, ret; + int i, ret, write_combine =3D 0, res_bit; =20 if (!capable(CAP_SYS_RAWIO)) return -EPERM; =20 + if (fpriv->mmap_state =3D=3D pci_mmap_io) + res_bit =3D IORESOURCE_IO; + else + res_bit =3D IORESOURCE_MEM; + /* Make sure the caller is mapping a real resource for this device */ for (i =3D 0; i < PCI_ROM_RESOURCE; i++) { - if (pci_mmap_fits(dev, i, vma, PCI_MMAP_PROCFS)) + if (dev->resource[i].flags & res_bit && + pci_mmap_fits(dev, i, vma, PCI_MMAP_PROCFS)) break; } =20 if (i >=3D PCI_ROM_RESOURCE) return -ENODEV; =20 + if (fpriv->mmap_state =3D=3D pci_mmap_mem && + fpriv->write_combine) { + if (dev->resource[i].flags & IORESOURCE_PREFETCH) + write_combine =3D 1; + else + return -EINVAL; + } ret =3D pci_mmap_page_range(dev, vma, - fpriv->mmap_state, - fpriv->write_combine); + fpriv->mmap_state, write_combine); if (ret < 0) return ret; =20 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 09215b036e94..914c1cbe4d3e 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -1637,6 +1637,29 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260a,= quirk_intel_pcie_pm); DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260b, quirk_intel_pcie_pm); =20 #ifdef CONFIG_X86_IO_APIC +static int dmi_disable_ioapicreroute(const struct dmi_system_id *d) +{ + noioapicreroute =3D 1; + pr_info("%s detected: disable boot interrupt reroute\n", d->ident); + + return 0; +} + +static struct dmi_system_id boot_interrupt_dmi_table[] =3D { + /* + * Systems to exclude from boot interrupt reroute quirks + */ + { + .callback =3D dmi_disable_ioapicreroute, + .ident =3D "ASUSTek Computer INC. M2N-LR", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "M2N-LR"), + }, + }, + {} +}; + /* * Boot interrupts on some chipsets cannot be turned off. For these chipse= ts, * remap the original interrupt in the linux kernel to the boot interrupt,= so @@ -1645,6 +1668,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260b, = quirk_intel_pcie_pm); */ static void quirk_reroute_to_boot_interrupts_intel(struct pci_dev *dev) { + dmi_check_system(boot_interrupt_dmi_table); if (noioapicquirk || noioapicreroute) return; =20 diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c index b9b464d0578c..1c7974d058a5 100644 --- a/drivers/pinctrl/sh-pfc/core.c +++ b/drivers/pinctrl/sh-pfc/core.c @@ -529,6 +529,9 @@ static int sh_pfc_probe(struct platform_device *pdev) ret =3D info->ops->init(pfc); if (ret < 0) return ret; + + /* .init() may have overridden pfc->info */ + info =3D pfc->info; } =20 pinctrl_provide_dummies(); diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/= pfc-r8a7791.c index 2e688dc4a3c8..34dbfae48646 100644 --- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c @@ -192,7 +192,7 @@ enum { =20 /* IPSR6 */ FN_AUDIO_CLKB, FN_STP_OPWM_0_B, FN_MSIOF1_SCK_B, - FN_SCIF_CLK, FN_BPFCLK_E, + FN_SCIF_CLK, FN_DVC_MUTE, FN_BPFCLK_E, FN_AUDIO_CLKC, FN_SCIFB0_SCK_C, FN_MSIOF1_SYNC_B, FN_RX2, FN_SCIFA2_RXD, FN_FMIN_E, FN_AUDIO_CLKOUT, FN_MSIOF1_SS1_B, FN_TX2, FN_SCIFA2_TXD, @@ -562,7 +562,7 @@ enum { =20 /* IPSR6 */ AUDIO_CLKB_MARK, STP_OPWM_0_B_MARK, MSIOF1_SCK_B_MARK, - SCIF_CLK_MARK, BPFCLK_E_MARK, + SCIF_CLK_MARK, DVC_MUTE_MARK, BPFCLK_E_MARK, AUDIO_CLKC_MARK, SCIFB0_SCK_C_MARK, MSIOF1_SYNC_B_MARK, RX2_MARK, SCIFA2_RXD_MARK, FMIN_E_MARK, AUDIO_CLKOUT_MARK, MSIOF1_SS1_B_MARK, TX2_MARK, SCIFA2_TXD_MARK, @@ -999,14 +999,17 @@ static const u16 pinmux_data[] =3D { PINMUX_IPSR_MODSEL_DATA(IP4_12_10, SCL2, SEL_IIC2_0), PINMUX_IPSR_MODSEL_DATA(IP4_12_10, GPS_CLK_B, SEL_GPS_1), PINMUX_IPSR_MODSEL_DATA(IP4_12_10, GLO_Q0_D, SEL_GPS_3), + PINMUX_IPSR_MODSEL_DATA(IP4_12_10, HSCK1_E, SEL_HSCIF1_4), PINMUX_IPSR_DATA(IP4_15_13, SSI_WS2), PINMUX_IPSR_MODSEL_DATA(IP4_15_13, SDA2, SEL_IIC2_0), PINMUX_IPSR_MODSEL_DATA(IP4_15_13, GPS_SIGN_B, SEL_GPS_1), PINMUX_IPSR_MODSEL_DATA(IP4_15_13, RX2_E, SEL_SCIF2_4), PINMUX_IPSR_MODSEL_DATA(IP4_15_13, GLO_Q1_D, SEL_GPS_3), + PINMUX_IPSR_MODSEL_DATA(IP4_15_13, HCTS1_N_E, SEL_HSCIF1_4), PINMUX_IPSR_DATA(IP4_18_16, SSI_SDATA2), PINMUX_IPSR_MODSEL_DATA(IP4_18_16, GPS_MAG_B, SEL_GPS_1), PINMUX_IPSR_MODSEL_DATA(IP4_18_16, TX2_E, SEL_SCIF2_4), + PINMUX_IPSR_MODSEL_DATA(IP4_18_16, HRTS1_N_E, SEL_HSCIF1_4), PINMUX_IPSR_DATA(IP4_19, SSI_SCK34), PINMUX_IPSR_DATA(IP4_20, SSI_WS34), PINMUX_IPSR_DATA(IP4_21, SSI_SDATA3), @@ -1079,6 +1082,7 @@ static const u16 pinmux_data[] =3D { PINMUX_IPSR_MODSEL_DATA(IP6_2_0, STP_OPWM_0_B, SEL_SSP_1), PINMUX_IPSR_MODSEL_DATA(IP6_2_0, MSIOF1_SCK_B, SEL_SOF1_1), PINMUX_IPSR_MODSEL_DATA(IP6_2_0, SCIF_CLK, SEL_SCIF_0), + PINMUX_IPSR_DATA(IP6_2_0, DVC_MUTE), PINMUX_IPSR_MODSEL_DATA(IP6_2_0, BPFCLK_E, SEL_FM_4), PINMUX_IPSR_DATA(IP6_5_3, AUDIO_CLKC), PINMUX_IPSR_MODSEL_DATA(IP6_5_3, SCIFB0_SCK_C, SEL_SCIFB_2), @@ -1088,7 +1092,7 @@ static const u16 pinmux_data[] =3D { PINMUX_IPSR_MODSEL_DATA(IP6_5_3, FMIN_E, SEL_FM_4), PINMUX_IPSR_DATA(IP6_7_6, AUDIO_CLKOUT), PINMUX_IPSR_MODSEL_DATA(IP6_7_6, MSIOF1_SS1_B, SEL_SOF1_1), - PINMUX_IPSR_MODSEL_DATA(IP6_5_3, TX2, SEL_SCIF2_0), + PINMUX_IPSR_MODSEL_DATA(IP6_7_6, TX2, SEL_SCIF2_0), PINMUX_IPSR_MODSEL_DATA(IP6_7_6, SCIFA2_TXD, SEL_SCIFA2_0), PINMUX_IPSR_DATA(IP6_9_8, IRQ0), PINMUX_IPSR_MODSEL_DATA(IP6_9_8, SCIFB1_RXD_D, SEL_SCIFB1_3), @@ -4956,7 +4960,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs= [] =3D { }, { PINMUX_CFG_REG_VAR("IPSR2", 0xE6060028, 32, 2, 3, 2, 2, 2, 2, 3, 3, 3, 3, 2, 2, 3) { - /* IP2_31_20 [2] */ + /* IP2_31_30 [2] */ 0, 0, 0, 0, /* IP2_29_27 [3] */ FN_EX_CS3_N, FN_ATADIR0_N, FN_MSIOF2_TXD, @@ -4976,7 +4980,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs= [] =3D { /* IP2_15_13 [3] */ FN_A24, FN_DREQ2, FN_IO3, FN_TX1, FN_SCIFA1_TXD, 0, 0, 0, - /* IP2_12_0 [3] */ + /* IP2_12_10 [3] */ FN_A23, FN_IO2, FN_BPFCLK_B, FN_RX0, FN_SCIFA0_RXD, 0, 0, 0, /* IP2_9_7 [3] */ @@ -5145,7 +5149,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs= [] =3D { 0, 0, /* IP6_2_0 [3] */ FN_AUDIO_CLKB, FN_STP_OPWM_0_B, FN_MSIOF1_SCK_B, - FN_SCIF_CLK, 0, FN_BPFCLK_E, + FN_SCIF_CLK, FN_DVC_MUTE, FN_BPFCLK_E, 0, 0, } }, { PINMUX_CFG_REG_VAR("IPSR7", 0xE606003C, 32, @@ -5287,7 +5291,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs= [] =3D { /* IP10_24_22 [3] */ FN_VI0_R1, FN_VI2_DATA2, FN_GLO_I1_B, FN_TS_SCK0_C, FN_ATAG1_N, 0, 0, 0, - /* IP10_21_29 [3] */ + /* IP10_21_19 [3] */ FN_VI0_R0, FN_VI2_DATA1, FN_GLO_I0_B, FN_TS_SDATA0_C, FN_ATACS11_N, 0, 0, 0, diff --git a/drivers/power/isp1704_charger.c b/drivers/power/isp1704_charge= r.c index 0b4cf9d63291..e5d88dd0a2f0 100644 --- a/drivers/power/isp1704_charger.c +++ b/drivers/power/isp1704_charger.c @@ -415,6 +415,10 @@ static int isp1704_charger_probe(struct platform_devic= e *pdev) =20 pdata =3D devm_kzalloc(&pdev->dev, sizeof(struct isp1704_charger_data), GFP_KERNEL); + if (!pdata) { + ret =3D -ENOMEM; + goto fail0; + } pdata->enable_gpio =3D gpio; =20 dev_info(&pdev->dev, "init gpio %d\n", pdata->enable_gpio); diff --git a/drivers/power/lp8788-charger.c b/drivers/power/lp8788-charger.c index 72da2a6c22db..620dc18b1137 100644 --- a/drivers/power/lp8788-charger.c +++ b/drivers/power/lp8788-charger.c @@ -642,7 +642,7 @@ static ssize_t lp8788_show_eoc_time(struct device *dev, { struct lp8788_charger *pchg =3D dev_get_drvdata(dev); char *stime[] =3D { "400ms", "5min", "10min", "15min", - "20min", "25min", "30min" "No timeout" }; + "20min", "25min", "30min", "No timeout" }; u8 val; =20 lp8788_read_byte(pchg->lp, LP8788_CHG_EOC, &val); diff --git a/drivers/power/pda_power.c b/drivers/power/pda_power.c index 0c52e2a0d90c..3a36774cbdfe 100644 --- a/drivers/power/pda_power.c +++ b/drivers/power/pda_power.c @@ -30,9 +30,9 @@ static inline unsigned int get_irq_flags(struct resource = *res) static struct device *dev; static struct pda_power_pdata *pdata; static struct resource *ac_irq, *usb_irq; -static struct timer_list charger_timer; -static struct timer_list supply_timer; -static struct timer_list polling_timer; +static struct delayed_work charger_work; +static struct delayed_work polling_work; +static struct delayed_work supply_work; static int polling; =20 #if IS_ENABLED(CONFIG_USB_PHY) @@ -143,7 +143,7 @@ static void update_charger(void) } } =20 -static void supply_timer_func(unsigned long unused) +static void supply_work_func(struct work_struct *work) { if (ac_status =3D=3D PDA_PSY_TO_CHANGE) { ac_status =3D new_ac_status; @@ -164,11 +164,12 @@ static void psy_changed(void) * Okay, charger set. Now wait a bit before notifying supplicants, * charge power should stabilize. */ - mod_timer(&supply_timer, - jiffies + msecs_to_jiffies(pdata->wait_for_charger)); + cancel_delayed_work(&supply_work); + schedule_delayed_work(&supply_work, + msecs_to_jiffies(pdata->wait_for_charger)); } =20 -static void charger_timer_func(unsigned long unused) +static void charger_work_func(struct work_struct *work) { update_status(); psy_changed(); @@ -187,13 +188,14 @@ static irqreturn_t power_changed_isr(int irq, void *p= ower_supply) * Wait a bit before reading ac/usb line status and setting charger, * because ac/usb status readings may lag from irq. */ - mod_timer(&charger_timer, - jiffies + msecs_to_jiffies(pdata->wait_for_status)); + cancel_delayed_work(&charger_work); + schedule_delayed_work(&charger_work, + msecs_to_jiffies(pdata->wait_for_status)); =20 return IRQ_HANDLED; } =20 -static void polling_timer_func(unsigned long unused) +static void polling_work_func(struct work_struct *work) { int changed =3D 0; =20 @@ -214,8 +216,9 @@ static void polling_timer_func(unsigned long unused) if (changed) psy_changed(); =20 - mod_timer(&polling_timer, - jiffies + msecs_to_jiffies(pdata->polling_interval)); + cancel_delayed_work(&polling_work); + schedule_delayed_work(&polling_work, + msecs_to_jiffies(pdata->polling_interval)); } =20 #if IS_ENABLED(CONFIG_USB_PHY) @@ -253,8 +256,9 @@ static int otg_handle_notification(struct notifier_bloc= k *nb, * Wait a bit before reading ac/usb line status and setting charger, * because ac/usb status readings may lag from irq. */ - mod_timer(&charger_timer, - jiffies + msecs_to_jiffies(pdata->wait_for_status)); + cancel_delayed_work(&charger_work); + schedule_delayed_work(&charger_work, + msecs_to_jiffies(pdata->wait_for_status)); =20 return NOTIFY_OK; } @@ -302,8 +306,8 @@ static int pda_power_probe(struct platform_device *pdev) if (!pdata->ac_max_uA) pdata->ac_max_uA =3D 500000; =20 - setup_timer(&charger_timer, charger_timer_func, 0); - setup_timer(&supply_timer, supply_timer_func, 0); + INIT_DELAYED_WORK(&charger_work, charger_work_func); + INIT_DELAYED_WORK(&supply_work, supply_work_func); =20 ac_irq =3D platform_get_resource_byname(pdev, IORESOURCE_IRQ, "ac"); usb_irq =3D platform_get_resource_byname(pdev, IORESOURCE_IRQ, "usb"); @@ -381,9 +385,10 @@ static int pda_power_probe(struct platform_device *pde= v) =20 if (polling) { dev_dbg(dev, "will poll for status\n"); - setup_timer(&polling_timer, polling_timer_func, 0); - mod_timer(&polling_timer, - jiffies + msecs_to_jiffies(pdata->polling_interval)); + INIT_DELAYED_WORK(&polling_work, polling_work_func); + cancel_delayed_work(&polling_work); + schedule_delayed_work(&polling_work, + msecs_to_jiffies(pdata->polling_interval)); } =20 if (ac_irq || usb_irq) @@ -429,9 +434,9 @@ static int pda_power_remove(struct platform_device *pde= v) free_irq(ac_irq->start, &pda_psy_ac); =20 if (polling) - del_timer_sync(&polling_timer); - del_timer_sync(&charger_timer); - del_timer_sync(&supply_timer); + cancel_delayed_work_sync(&polling_work); + cancel_delayed_work_sync(&charger_work); + cancel_delayed_work_sync(&supply_work); =20 if (pdata->is_usb_online) power_supply_unregister(&pda_psy_usb); diff --git a/drivers/regulator/tps65023-regulator.c b/drivers/regulator/tps= 65023-regulator.c index 3ef67a86115c..99963b8d39e9 100644 --- a/drivers/regulator/tps65023-regulator.c +++ b/drivers/regulator/tps65023-regulator.c @@ -293,8 +293,7 @@ static int tps_65023_probe(struct i2c_client *client, =20 /* Enable setting output voltage by I2C */ regmap_update_bits(tps->regmap, TPS65023_REG_CON_CTRL2, - TPS65023_REG_CTRL2_CORE_ADJ, - TPS65023_REG_CTRL2_CORE_ADJ); + TPS65023_REG_CTRL2_CORE_ADJ, 0); =20 return 0; } diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index 07ab11da83a0..61f72dfa642d 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c @@ -223,6 +223,23 @@ scsi_abort_command(struct scsi_cmnd *scmd) return SUCCESS; } =20 +/** + * scsi_eh_reset - call into ->eh_action to reset internal counters + * @scmd: scmd to run eh on. + * + * The scsi driver might be carrying internal state about the + * devices, so we need to call into the driver to reset the + * internal state once the error handler is started. + */ +static void scsi_eh_reset(struct scsi_cmnd *scmd) +{ + if (scmd->request->cmd_type =3D=3D REQ_TYPE_FS) { + struct scsi_driver *sdrv =3D scsi_cmd_to_driver(scmd); + if (sdrv->eh_reset) + sdrv->eh_reset(scmd); + } +} + /** * scsi_eh_scmd_add - add scsi cmd to error handling. * @scmd: scmd to run eh on. @@ -252,6 +269,7 @@ int scsi_eh_scmd_add(struct scsi_cmnd *scmd, int eh_fla= g) if (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) eh_flag &=3D ~SCSI_EH_CANCEL_CMD; scmd->eh_eflags |=3D eh_flag; + scsi_eh_reset(scmd); list_add_tail(&scmd->eh_entry, &shost->eh_cmd_q); shost->host_failed++; scsi_eh_wakeup(shost); diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index cd90c300cec7..3dcb3c080c1e 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -112,6 +112,7 @@ static void sd_rescan(struct device *); static int sd_init_command(struct scsi_cmnd *SCpnt); static void sd_uninit_command(struct scsi_cmnd *SCpnt); static int sd_done(struct scsi_cmnd *); +static void sd_eh_reset(struct scsi_cmnd *); static int sd_eh_action(struct scsi_cmnd *, int); static void sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer= ); static void scsi_disk_release(struct device *cdev); @@ -509,6 +510,7 @@ static struct scsi_driver sd_template =3D { .uninit_command =3D sd_uninit_command, .done =3D sd_done, .eh_action =3D sd_eh_action, + .eh_reset =3D sd_eh_reset, }; =20 /* @@ -1535,6 +1537,26 @@ static const struct block_device_operations sd_fops = =3D { .unlock_native_capacity =3D sd_unlock_native_capacity, }; =20 +/** + * sd_eh_reset - reset error handling callback + * @scmd: sd-issued command that has failed + * + * This function is called by the SCSI midlayer before starting + * SCSI EH. When counting medium access failures we have to be + * careful to register it only only once per device and SCSI EH run; + * there might be several timed out commands which will cause the + * 'max_medium_access_timeouts' counter to trigger after the first + * SCSI EH run already and set the device to offline. + * So this function resets the internal counter before starting SCSI EH. + **/ +static void sd_eh_reset(struct scsi_cmnd *scmd) +{ + struct scsi_disk *sdkp =3D scsi_disk(scmd->request->rq_disk); + + /* New SCSI EH run, reset gate variable */ + sdkp->ignore_medium_access_errors =3D false; +} + /** * sd_eh_action - error handling callback * @scmd: sd-issued command that has failed @@ -1564,7 +1586,10 @@ static int sd_eh_action(struct scsi_cmnd *scmd, int = eh_disp) * process of recovering or has it suffered an internal failure * that prevents access to the storage medium. */ - sdkp->medium_access_timed_out++; + if (!sdkp->ignore_medium_access_errors) { + sdkp->medium_access_timed_out++; + sdkp->ignore_medium_access_errors =3D true; + } =20 /* * If the device keeps failing read/write commands but TEST UNIT diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h index 3b3876696603..9b19adaba878 100644 --- a/drivers/scsi/sd.h +++ b/drivers/scsi/sd.h @@ -90,6 +90,7 @@ struct scsi_disk { unsigned lbpvpd : 1; unsigned ws10 : 1; unsigned ws16 : 1; + unsigned ignore_medium_access_errors : 1; }; #define to_scsi_disk(obj) container_of(obj,struct scsi_disk,dev) =20 diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/com= edi/drivers/jr3_pci.c index a8db9d86aadc..fa84814620d9 100644 --- a/drivers/staging/comedi/drivers/jr3_pci.c +++ b/drivers/staging/comedi/drivers/jr3_pci.c @@ -608,7 +608,7 @@ static void jr3_pci_poll_dev(unsigned long data) s =3D &dev->subdevices[i]; spriv =3D s->private; =20 - if (now > spriv->next_time_min) { + if (time_after_eq(now, spriv->next_time_min)) { struct jr3_pci_poll_delay sub_delay; =20 sub_delay =3D jr3_pci_poll_subdevice(s); @@ -726,11 +726,12 @@ static int jr3_pci_auto_attach(struct comedi_device *= dev, s->insn_read =3D jr3_pci_ai_insn_read; =20 spriv =3D jr3_pci_alloc_spriv(dev, s); - if (spriv) { - /* Channel specific range and maxdata */ - s->range_table_list =3D spriv->range_table_list; - s->maxdata_list =3D spriv->maxdata_list; - } + if (!spriv) + return -ENOMEM; + + /* Channel specific range and maxdata */ + s->range_table_list =3D spriv->range_table_list; + s->maxdata_list =3D spriv->maxdata_list; } =20 /* Reset DSP card */ diff --git a/drivers/staging/gdm724x/gdm_mux.c b/drivers/staging/gdm724x/gd= m_mux.c index 233e0768d1ef..629463beaa70 100644 --- a/drivers/staging/gdm724x/gdm_mux.c +++ b/drivers/staging/gdm724x/gdm_mux.c @@ -26,8 +26,6 @@ =20 #include "gdm_mux.h" =20 -static struct workqueue_struct *mux_rx_wq; - static u16 packet_type[TTY_MAX_COUNT] =3D {0xF011, 0xF010}; =20 #define USB_DEVICE_CDC_DATA(vid, pid) \ @@ -277,7 +275,7 @@ static void gdm_mux_rcv_complete(struct urb *urb) r->len =3D r->urb->actual_length; spin_lock_irqsave(&rx->to_host_lock, flags); list_add_tail(&r->to_host_list, &rx->to_host_list); - queue_work(mux_rx_wq, &mux_dev->work_rx.work); + schedule_work(&mux_dev->work_rx.work); spin_unlock_irqrestore(&rx->to_host_lock, flags); } } @@ -604,6 +602,8 @@ static int gdm_mux_suspend(struct usb_interface *intf, = pm_message_t pm_msg) mux_dev =3D tty_dev->priv_dev; rx =3D &mux_dev->rx; =20 + cancel_work_sync(&mux_dev->work_rx.work); + if (mux_dev->usb_state !=3D PM_NORMAL) { pr_err("usb suspend - invalid state\n"); return -1; @@ -659,13 +659,6 @@ static struct usb_driver gdm_mux_driver =3D { =20 static int __init gdm_usb_mux_init(void) { - - mux_rx_wq =3D create_workqueue("mux_rx_wq"); - if (mux_rx_wq =3D=3D NULL) { - pr_err("work queue create fail\n"); - return -1; - } - register_lte_tty_driver(); =20 return usb_register(&gdm_mux_driver); @@ -673,14 +666,8 @@ static int __init gdm_usb_mux_init(void) =20 static void __exit gdm_usb_mux_exit(void) { - unregister_lte_tty_driver(); - - if (mux_rx_wq) { - flush_workqueue(mux_rx_wq); - destroy_workqueue(mux_rx_wq); - } - usb_deregister(&gdm_mux_driver); + unregister_lte_tty_driver(); } =20 module_init(gdm_usb_mux_init); diff --git a/drivers/staging/iio/light/tsl2x7x_core.c b/drivers/staging/iio= /light/tsl2x7x_core.c index ab338e3ddd05..66020a8406a0 100644 --- a/drivers/staging/iio/light/tsl2x7x_core.c +++ b/drivers/staging/iio/light/tsl2x7x_core.c @@ -849,7 +849,7 @@ void tsl2x7x_prox_calculate(int *data, int length, tmp =3D data[i] - statP->mean; sample_sum +=3D tmp * tmp; } - statP->stddev =3D int_sqrt((long)sample_sum)/length; + statP->stddev =3D int_sqrt((long)sample_sum / length); } =20 /** diff --git a/drivers/staging/media/lirc/lirc_serial.c b/drivers/staging/med= ia/lirc/lirc_serial.c index efe561cd0935..24edefc17e62 100644 --- a/drivers/staging/media/lirc/lirc_serial.c +++ b/drivers/staging/media/lirc/lirc_serial.c @@ -105,7 +105,7 @@ struct lirc_serial { static int type; static int io; static int irq; -static bool iommap; +static ulong iommap; static int ioshift; static bool softcarrier =3D 1; static bool share_irq; @@ -1205,7 +1205,7 @@ module_param(io, int, S_IRUGO); MODULE_PARM_DESC(io, "I/O address base (0x3f8 or 0x2f8)"); =20 /* some architectures (e.g. intel xscale) have memory mapped registers */ -module_param(iommap, bool, S_IRUGO); +module_param(iommap, ulong, S_IRUGO); MODULE_PARM_DESC(iommap, "physical base for memory mapped I/O" " (0 =3D no memory mapped io)"); =20 diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8= 188eu/core/rtw_ap.c index 85fda6128db9..3782a580aea3 100644 --- a/drivers/staging/rtl8188eu/core/rtw_ap.c +++ b/drivers/staging/rtl8188eu/core/rtw_ap.c @@ -881,7 +881,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 = *pbuf, int len) return _FAIL; =20 =20 - if (len > MAX_IE_SZ) + if (len < 0 || len > MAX_IE_SZ) return _FAIL; =20 pbss_network->IELength =3D len; diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core= _file.c index 03bfa49b5590..d90b474c0a62 100644 --- a/drivers/target/target_core_file.c +++ b/drivers/target/target_core_file.c @@ -743,8 +743,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *s= gl, u32 sgl_nents, return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; } =20 - if (ret) - target_complete_cmd(cmd, SAM_STAT_GOOD); + target_complete_cmd(cmd, SAM_STAT_GOOD); return 0; } =20 diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-ser= ial.c index 9053aa7a970f..edaf1055d296 100644 --- a/drivers/tty/serial/omap-serial.c +++ b/drivers/tty/serial/omap-serial.c @@ -1741,7 +1741,8 @@ static int serial_omap_probe(struct platform_device *= pdev) return 0; =20 err_add_port: - pm_runtime_put(&pdev->dev); + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_put_sync(&pdev->dev); pm_runtime_disable(&pdev->dev); err_rs485: err_port_line: @@ -1754,9 +1755,13 @@ static int serial_omap_remove(struct platform_device= *dev) { struct uart_omap_port *up =3D platform_get_drvdata(dev); =20 + pm_runtime_get_sync(up->dev); + + uart_remove_one_port(&serial_omap_reg, &up->port); + + pm_runtime_dont_use_autosuspend(up->dev); pm_runtime_put_sync(up->dev); pm_runtime_disable(up->dev); - uart_remove_one_port(&serial_omap_reg, &up->port); pm_qos_remove_request(&up->pm_qos_request); device_init_wakeup(&dev->dev, false); =20 diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c index de3cdde1159e..b1d761e022f0 100644 --- a/drivers/tty/serial/sh-sci.c +++ b/drivers/tty/serial/sh-sci.c @@ -1715,11 +1715,13 @@ static int sci_startup(struct uart_port *port) =20 dev_dbg(port->dev, "%s(%d)\n", __func__, port->line); =20 + sci_request_dma(port); + ret =3D sci_request_irq(s); - if (unlikely(ret < 0)) + if (unlikely(ret < 0)) { + sci_free_dma(port); return ret; - - sci_request_dma(port); + } =20 spin_lock_irqsave(&port->lock, flags); sci_start_tx(port); @@ -1741,8 +1743,8 @@ static void sci_shutdown(struct uart_port *port) sci_stop_tx(port); spin_unlock_irqrestore(&port->lock, flags); =20 - sci_free_dma(port); sci_free_irq(s); + sci_free_dma(port); } =20 static unsigned int sci_scbrr_calc(struct sci_port *s, unsigned int bps, diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 919dc6a1bdf3..2c34b1e444a4 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -312,6 +312,12 @@ static void acm_ctrl_irq(struct urb *urb) break; =20 case USB_CDC_NOTIFY_SERIAL_STATE: + if (le16_to_cpu(dr->wLength) !=3D 2) { + dev_dbg(&acm->control->dev, + "%s - malformed serial state\n", __func__); + break; + } + newctrl =3D get_unaligned_le16(data); =20 if (!acm->clocal && (acm->ctrlin & ~newctrl & ACM_CTRL_DCD)) { @@ -348,11 +354,10 @@ static void acm_ctrl_irq(struct urb *urb) =20 default: dev_dbg(&acm->control->dev, - "%s - unknown notification %d received: index %d " - "len %d data0 %d data1 %d\n", + "%s - unknown notification %d received: index %d len %d\n", __func__, - dr->bNotificationType, dr->wIndex, - dr->wLength, data[0], data[1]); + dr->bNotificationType, dr->wIndex, dr->wLength); + break; } exit: diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c index e7bff99cdb2d..6307c94a59d4 100644 --- a/drivers/usb/core/driver.c +++ b/drivers/usb/core/driver.c @@ -1331,6 +1331,24 @@ static int usb_suspend_both(struct usb_device *udev,= pm_message_t msg) */ if (udev->parent && !PMSG_IS_AUTO(msg)) status =3D 0; + + /* + * If the device is inaccessible, don't try to resume + * suspended interfaces and just return the error. + */ + if (status && status !=3D -EBUSY) { + int err; + u16 devstat; + + err =3D usb_get_status(udev, USB_RECIP_DEVICE, 0, + &devstat); + if (err) { + dev_err(&udev->dev, + "Failed to suspend device, error %d\n", + status); + goto done; + } + } } =20 /* If the suspend failed, resume interfaces that did get suspended */ @@ -1767,6 +1785,9 @@ static int autosuspend_check(struct usb_device *udev) int w, i; struct usb_interface *intf; =20 + if (udev->state =3D=3D USB_STATE_NOTATTACHED) + return -ENODEV; + /* Fail if autosuspend is disabled, or any interfaces are in use, or * any interface drivers require remote wakeup but it isn't available. */ diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c index ea337a718cc1..b3de806085f0 100644 --- a/drivers/usb/core/file.c +++ b/drivers/usb/core/file.c @@ -26,6 +26,7 @@ #define MAX_USB_MINORS 256 static const struct file_operations *usb_minors[MAX_USB_MINORS]; static DECLARE_RWSEM(minor_rwsem); +static DEFINE_MUTEX(init_usb_class_mutex); =20 static int usb_open(struct inode *inode, struct file *file) { @@ -108,8 +109,9 @@ static void release_usb_class(struct kref *kref) =20 static void destroy_usb_class(void) { - if (usb_class) - kref_put(&usb_class->kref, release_usb_class); + mutex_lock(&init_usb_class_mutex); + kref_put(&usb_class->kref, release_usb_class); + mutex_unlock(&init_usb_class_mutex); } =20 int usb_major_init(void) @@ -171,7 +173,10 @@ int usb_register_dev(struct usb_interface *intf, if (intf->minor >=3D 0) return -EADDRINUSE; =20 + mutex_lock(&init_usb_class_mutex); retval =3D init_usb_class(); + mutex_unlock(&init_usb_class_mutex); + if (retval) return retval; =20 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 7a6ddda70386..7ed312aa0d2e 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1044,6 +1044,9 @@ static void hub_activate(struct usb_hub *hub, enum hu= b_activation_type type) =20 portstatus =3D portchange =3D 0; status =3D hub_port_status(hub, port1, &portstatus, &portchange); + if (status) + goto abort; + if (udev || (portstatus & USB_PORT_STAT_CONNECTION)) dev_dbg(&port_dev->dev, "status %04x change %04x\n", portstatus, portchange); @@ -1176,7 +1179,7 @@ static void hub_activate(struct usb_hub *hub, enum hu= b_activation_type type) =20 /* Scan all ports that need attention */ kick_khubd(hub); - + abort: /* Allow autosuspend if it was suppressed */ if (type <=3D HUB_INIT3) usb_autopm_put_interface_async(to_usb_interface(hub->intfdev)); @@ -2066,6 +2069,12 @@ void usb_disconnect(struct usb_device **pdev) dev_info(&udev->dev, "USB disconnect, device number %d\n", udev->devnum); =20 + /* + * Ensure that the pm runtime code knows that the USB device + * is in the process of being disconnected. + */ + pm_runtime_barrier(&udev->dev); + usb_lock_device(udev); =20 hub_disconnect_children(udev); diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index 0333ccc27b13..601420407721 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -2459,7 +2459,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) (xhci->cmd_ring->first_seg->dma & (u64) ~CMD_RING_RSVD_BITS) | xhci->cmd_ring->cycle_state; xhci_dbg_trace(xhci, trace_xhci_dbg_init, - "// Setting command ring address to 0x%x", val); + "// Setting command ring address to 0x%016llx", val_64); xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring); xhci_dbg_cmd_ptrs(xhci); =20 diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtowe= r.c index 042a1ad9698a..0f9b094343f5 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -317,9 +317,16 @@ static int tower_open (struct inode *inode, struct fil= e *file) int subminor; int retval =3D 0; struct usb_interface *interface; - struct tower_reset_reply reset_reply; + struct tower_reset_reply *reset_reply; int result; =20 + reset_reply =3D kmalloc(sizeof(*reset_reply), GFP_KERNEL); + + if (!reset_reply) { + retval =3D -ENOMEM; + goto exit; + } + nonseekable_open(inode, file); subminor =3D iminor(inode); =20 @@ -364,8 +371,8 @@ static int tower_open (struct inode *inode, struct file= *file) USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, 0, 0, - &reset_reply, - sizeof(reset_reply), + reset_reply, + sizeof(*reset_reply), 1000); if (result < 0) { dev_err(&dev->udev->dev, @@ -406,6 +413,7 @@ static int tower_open (struct inode *inode, struct file= *file) mutex_unlock(&dev->lock); =20 exit: + kfree(reset_reply); return retval; } =20 @@ -808,7 +816,7 @@ static int tower_probe (struct usb_interface *interface= , const struct usb_device struct lego_usb_tower *dev =3D NULL; struct usb_host_interface *iface_desc; struct usb_endpoint_descriptor* endpoint; - struct tower_get_version_reply get_version_reply; + struct tower_get_version_reply *get_version_reply =3D NULL; int i; int retval =3D -ENOMEM; int result; @@ -898,6 +906,13 @@ static int tower_probe (struct usb_interface *interfac= e, const struct usb_device dev->interrupt_in_interval =3D interrupt_in_interval ? interrupt_in_inter= val : dev->interrupt_in_endpoint->bInterval; dev->interrupt_out_interval =3D interrupt_out_interval ? interrupt_out_in= terval : dev->interrupt_out_endpoint->bInterval; =20 + get_version_reply =3D kmalloc(sizeof(*get_version_reply), GFP_KERNEL); + + if (!get_version_reply) { + retval =3D -ENOMEM; + goto error; + } + /* get the firmware version and log it */ result =3D usb_control_msg (udev, usb_rcvctrlpipe(udev, 0), @@ -905,18 +920,19 @@ static int tower_probe (struct usb_interface *interfa= ce, const struct usb_device USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, 0, 0, - &get_version_reply, - sizeof(get_version_reply), + get_version_reply, + sizeof(*get_version_reply), 1000); if (result < 0) { dev_err(idev, "LEGO USB Tower get version control request failed\n"); retval =3D result; goto error; } - dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d " - "build %d\n", get_version_reply.major, - get_version_reply.minor, - le16_to_cpu(get_version_reply.build_no)); + dev_info(&interface->dev, + "LEGO USB Tower firmware version is %d.%d build %d\n", + get_version_reply->major, + get_version_reply->minor, + le16_to_cpu(get_version_reply->build_no)); =20 /* we can register the device now, as it is ready */ usb_set_intfdata (interface, dev); @@ -937,9 +953,11 @@ static int tower_probe (struct usb_interface *interfac= e, const struct usb_device USB_MAJOR, dev->minor); =20 exit: + kfree(get_version_reply); return retval; =20 error: + kfree(get_version_reply); tower_delete(dev); return retval; } diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c index 56f88df5906b..c709fbc271d8 100644 --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -886,6 +886,7 @@ static const struct usb_device_id id_table_combined[] = =3D { { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0x00) }, + { USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PI= D, 2) }, { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), .driver_info =3D (kernel_ulong_t)&ftdi_jtag_quirk }, diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_si= o_ids.h index 7b2f2056b7ef..fe794427c1f6 100644 --- a/drivers/usb/serial/ftdi_sio_ids.h +++ b/drivers/usb/serial/ftdi_sio_ids.h @@ -873,6 +873,12 @@ #define FIC_VID 0x1457 #define FIC_NEO1973_DEBUG_PID 0x5118 =20 +/* + * Actel / Microsemi + */ +#define ACTEL_VID 0x1514 +#define MICROSEMI_ARROW_SF2PLUS_BOARD_PID 0x2008 + /* Olimex */ #define OLIMEX_VID 0x15BA #define OLIMEX_ARM_USB_OCD_PID 0x0003 diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type= 1.c index 0e153f23c47f..94cf33846827 100644 --- a/drivers/vfio/vfio_iommu_type1.c +++ b/drivers/vfio/vfio_iommu_type1.c @@ -128,57 +128,37 @@ static void vfio_unlink_dma(struct vfio_iommu *iommu,= struct vfio_dma *old) rb_erase(&old->node, &iommu->dma_list); } =20 -struct vwork { - struct mm_struct *mm; - long npage; - struct work_struct work; -}; - -/* delayed decrement/increment for locked_vm */ -static void vfio_lock_acct_bg(struct work_struct *work) +static int vfio_lock_acct(long npage, bool *lock_cap) { - struct vwork *vwork =3D container_of(work, struct vwork, work); struct mm_struct *mm; + int ret; =20 - mm =3D vwork->mm; - down_write(&mm->mmap_sem); - mm->locked_vm +=3D vwork->npage; - up_write(&mm->mmap_sem); - mmput(mm); - kfree(vwork); -} + if (!npage) + return 0; =20 -static void vfio_lock_acct(long npage) -{ - struct vwork *vwork; - struct mm_struct *mm; + mm =3D current->mm; + if (!mm) + return -ESRCH; /* process exited */ =20 - if (!current->mm || !npage) - return; /* process exited or nothing to do */ + ret =3D 0; + down_write(&mm->mmap_sem); + if (npage > 0) { + if (lock_cap ? !*lock_cap : !capable(CAP_IPC_LOCK)) { + unsigned long limit; =20 - if (down_write_trylock(¤t->mm->mmap_sem)) { - current->mm->locked_vm +=3D npage; - up_write(¤t->mm->mmap_sem); - return; - } + limit =3D rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; =20 - /* - * Couldn't get mmap_sem lock, so must setup to update - * mm->locked_vm later. If locked_vm were atomic, we - * wouldn't need this silliness - */ - vwork =3D kmalloc(sizeof(struct vwork), GFP_KERNEL); - if (!vwork) - return; - mm =3D get_task_mm(current); - if (!mm) { - kfree(vwork); - return; + if (mm->locked_vm + npage > limit) + ret =3D -ENOMEM; + } } - INIT_WORK(&vwork->work, vfio_lock_acct_bg); - vwork->mm =3D mm; - vwork->npage =3D npage; - schedule_work(&vwork->work); + + if (!ret) + mm->locked_vm +=3D npage; + + up_write(&mm->mmap_sem); + + return ret; } =20 /* @@ -260,7 +240,7 @@ static int vaddr_get_pfn(unsigned long vaddr, int prot,= unsigned long *pfn) static long vfio_pin_pages(unsigned long vaddr, long npage, int prot, unsigned long *pfn_base) { - unsigned long limit =3D rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; + unsigned long pfn =3D 0, limit =3D rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; bool lock_cap =3D capable(CAP_IPC_LOCK); long ret, i; =20 @@ -282,14 +262,13 @@ static long vfio_pin_pages(unsigned long vaddr, long = npage, } =20 if (unlikely(disable_hugepages)) { - vfio_lock_acct(1); - return 1; + ret =3D vfio_lock_acct(1, &lock_cap); + i =3D 1; + goto unpin_out; } =20 /* Lock all the consecutive pages from pfn_base */ for (i =3D 1, vaddr +=3D PAGE_SIZE; i < npage; i++, vaddr +=3D PAGE_SIZE)= { - unsigned long pfn =3D 0; - ret =3D vaddr_get_pfn(vaddr, prot, &pfn); if (ret) break; @@ -303,11 +282,20 @@ static long vfio_pin_pages(unsigned long vaddr, long = npage, put_pfn(pfn, prot); pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", __func__, limit << PAGE_SHIFT); - break; + ret =3D -ENOMEM; + goto unpin_out; } } =20 - vfio_lock_acct(i); + ret =3D vfio_lock_acct(i, &lock_cap); + +unpin_out: + if (ret) { + for (pfn =3D *pfn_base ; i ; pfn++, i--) + put_pfn(pfn, prot); + + return ret; + } =20 return i; } @@ -322,7 +310,7 @@ static long vfio_unpin_pages(unsigned long pfn, long np= age, unlocked +=3D put_pfn(pfn++, prot); =20 if (do_accounting) - vfio_lock_acct(-unlocked); + vfio_lock_acct(-unlocked, NULL); =20 return unlocked; } @@ -368,7 +356,7 @@ static void vfio_unmap_unpin(struct vfio_iommu *iommu, = struct vfio_dma *dma) iova +=3D unmapped; } =20 - vfio_lock_acct(-unlocked); + vfio_lock_acct(-unlocked, NULL); } =20 static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma) diff --git a/drivers/video/Makefile b/drivers/video/Makefile index 9ad3c17d6456..445b2c230b56 100644 --- a/drivers/video/Makefile +++ b/drivers/video/Makefile @@ -2,6 +2,7 @@ obj-$(CONFIG_VGASTATE) +=3D vgastate.o obj-$(CONFIG_HDMI) +=3D hdmi.o =20 obj-$(CONFIG_VT) +=3D console/ +obj-$(CONFIG_FB_STI) +=3D console/ obj-$(CONFIG_LOGO) +=3D logo/ obj-y +=3D backlight/ =20 diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig index fac73ceb90e5..81ff9b68da3e 100644 --- a/drivers/video/fbdev/Kconfig +++ b/drivers/video/fbdev/Kconfig @@ -650,8 +650,6 @@ config FB_STI select FB_CFB_FILLRECT select FB_CFB_COPYAREA select FB_CFB_IMAGEBLIT - select STI_CONSOLE - select VT default y ---help--- STI refers to the HP "Standard Text Interface" which is a set of diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index c9c2b887381e..335064342f92 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -369,6 +369,7 @@ static int __set_xattr(struct ceph_inode_info *ci, =20 if (update_xattr) { int err =3D 0; + if (xattr && (flags & XATTR_CREATE)) err =3D -EEXIST; else if (!xattr && (flags & XATTR_REPLACE)) @@ -376,12 +377,14 @@ static int __set_xattr(struct ceph_inode_info *ci, if (err) { kfree(name); kfree(val); + kfree(*newxattr); return err; } if (update_xattr < 0) { if (xattr) __remove_xattr(ci, xattr); kfree(name); + kfree(*newxattr); return 0; } } diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index a219cf00c2f0..f16839ccf1eb 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -86,6 +86,7 @@ extern mempool_t *cifs_req_poolp; extern mempool_t *cifs_mid_poolp; =20 struct workqueue_struct *cifsiod_wq; +struct workqueue_struct *cifsoplockd_wq; =20 /* * Bumps refcount for cifs super block. @@ -1210,9 +1211,16 @@ init_cifs(void) goto out_clean_proc; } =20 + cifsoplockd_wq =3D alloc_workqueue("cifsoplockd", + WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); + if (!cifsoplockd_wq) { + rc =3D -ENOMEM; + goto out_destroy_cifsiod_wq; + } + rc =3D cifs_fscache_register(); if (rc) - goto out_destroy_wq; + goto out_destroy_cifsoplockd_wq; =20 rc =3D cifs_init_inodecache(); if (rc) @@ -1260,7 +1268,9 @@ init_cifs(void) cifs_destroy_inodecache(); out_unreg_fscache: cifs_fscache_unregister(); -out_destroy_wq: +out_destroy_cifsoplockd_wq: + destroy_workqueue(cifsoplockd_wq); +out_destroy_cifsiod_wq: destroy_workqueue(cifsiod_wq); out_clean_proc: cifs_proc_clean(); @@ -1283,6 +1293,7 @@ exit_cifs(void) cifs_destroy_mids(); cifs_destroy_inodecache(); cifs_fscache_unregister(); + destroy_workqueue(cifsoplockd_wq); destroy_workqueue(cifsiod_wq); cifs_proc_clean(); } diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 7f2beb757957..dfdb22f6b419 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1581,6 +1581,7 @@ void cifs_oplock_break(struct work_struct *work); =20 extern const struct slow_work_ops cifs_oplock_break_ops; extern struct workqueue_struct *cifsiod_wq; +extern struct workqueue_struct *cifsoplockd_wq; =20 extern mempool_t *cifs_mid_poolp; =20 diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index 90c8558383f5..36344cb2f1ca 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -720,6 +720,9 @@ CIFSSMBEcho(struct TCP_Server_Info *server) if (rc) return rc; =20 + if (server->capabilities & CAP_UNICODE) + smb->hdr.Flags2 |=3D SMBFLG2_UNICODE; + /* set up echo request */ smb->hdr.Tid =3D 0xffff; smb->hdr.WordCount =3D 1; diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 5b3735b3ca85..9f0808335536 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -483,7 +483,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_I= nfo *srv) CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, &pCifsInode->flags); =20 - queue_work(cifsiod_wq, + queue_work(cifsoplockd_wq, &netfile->oplock_break); netfile->oplock_break_cancelled =3D false; =20 diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c index 6834b9c3bec1..f2cb1db1b202 100644 --- a/fs/cifs/netmisc.c +++ b/fs/cifs/netmisc.c @@ -966,10 +966,10 @@ struct timespec cnvrtDosUnixTm(__le16 le_date, __le16= le_time, int offset) cifs_dbg(VFS, "illegal hours %d\n", st->Hours); days =3D sd->Day; month =3D sd->Month; - if ((days > 31) || (month > 12)) { + if (days < 1 || days > 31 || month < 1 || month > 12) { cifs_dbg(VFS, "illegal date, month %d day: %d\n", month, days); - if (month > 12) - month =3D 12; + days =3D clamp(days, 1, 31); + month =3D clamp(month, 1, 12); } month -=3D 1; days +=3D total_days_of_prev_months[month]; diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c index 9f94c91ed458..ed976a94791c 100644 --- a/fs/cifs/smb2misc.c +++ b/fs/cifs/smb2misc.c @@ -447,7 +447,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2= _lease_break *rsp, else cfile->oplock_break_cancelled =3D true; =20 - queue_work(cifsiod_wq, &cfile->oplock_break); + queue_work(cifsoplockd_wq, &cfile->oplock_break); kfree(lw); return true; } @@ -591,7 +591,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Ser= ver_Info *server) CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, &cinode->flags); spin_unlock(&cfile->file_info_lock); - queue_work(cifsiod_wq, &cfile->oplock_break); + queue_work(cifsoplockd_wq, + &cfile->oplock_break); =20 spin_unlock(&tcon->open_file_lock); spin_unlock(&cifs_tcp_ses_lock); diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index bdc5fb4cb181..07d2f1c659e2 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -524,8 +524,12 @@ int smb3_validate_negotiate(const unsigned int xid, st= ruct cifs_tcon *tcon) } =20 if (rsplen !=3D sizeof(struct validate_negotiate_info_rsp)) { - cifs_dbg(VFS, "invalid size of protocol negotiate response\n"); - return -EIO; + cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n", + rsplen); + + /* relax check since Mac returns max bufsize allowed on ioctl */ + if (rsplen > CIFSMaxBufSize) + return -EIO; } =20 /* check validate negotiate info response matches what we got earlier */ @@ -1293,8 +1297,12 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon = *tcon, u64 persistent_fid, * than one credit. Windows typically sets this smaller, but for some * ioctls it may be useful to allow server to send more. No point * limiting what the server can send as long as fits in one credit + * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE + * (by default, note that it can be overridden to make max larger) + * in responses (except for read responses which can be bigger. + * We may want to bump this limit up */ - req->MaxOutputResponse =3D cpu_to_le32(0xFF00); /* < 64K uses 1 credit */ + req->MaxOutputResponse =3D cpu_to_le32(CIFSMaxBufSize); =20 if (is_fsctl) req->Flags =3D cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); diff --git a/fs/dcache.c b/fs/dcache.c index 40b3fc1fb608..c35d0ee1a7da 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -244,6 +244,43 @@ static void __d_free(struct rcu_head *head) kmem_cache_free(dentry_cache, dentry);=20 } =20 +void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *= dentry) +{ + spin_lock(&dentry->d_lock); + if (unlikely(dname_external(dentry))) { + u32 len; + char *p; + + for (;;) { + len =3D dentry->d_name.len; + spin_unlock(&dentry->d_lock); + + p =3D kmalloc(len + 1, GFP_KERNEL | __GFP_NOFAIL); + + spin_lock(&dentry->d_lock); + if (dentry->d_name.len <=3D len) + break; + kfree(p); + } + memcpy(p, dentry->d_name.name, dentry->d_name.len + 1); + spin_unlock(&dentry->d_lock); + + name->name =3D p; + } else { + memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN); + spin_unlock(&dentry->d_lock); + name->name =3D name->inline_name; + } +} +EXPORT_SYMBOL(take_dentry_name_snapshot); + +void release_dentry_name_snapshot(struct name_snapshot *name) +{ + if (unlikely(name->name !=3D name->inline_name)) + kfree(name->name); +} +EXPORT_SYMBOL(release_dentry_name_snapshot); + static void dentry_free(struct dentry *dentry) { WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias)); diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c index 75c865bd376d..79f310d80baf 100644 --- a/fs/debugfs/inode.c +++ b/fs/debugfs/inode.c @@ -620,7 +620,7 @@ struct dentry *debugfs_rename(struct dentry *old_dir, s= truct dentry *old_dentry, { int error; struct dentry *dentry =3D NULL, *trap; - const char *old_name; + struct name_snapshot old_name; =20 trap =3D lock_rename(new_dir, old_dir); /* Source or destination directories don't exist? */ @@ -635,19 +635,19 @@ struct dentry *debugfs_rename(struct dentry *old_dir,= struct dentry *old_dentry, if (IS_ERR(dentry) || dentry =3D=3D trap || dentry->d_inode) goto exit; =20 - old_name =3D fsnotify_oldname_init(old_dentry->d_name.name); + take_dentry_name_snapshot(&old_name, old_dentry); =20 error =3D simple_rename(old_dir->d_inode, old_dentry, new_dir->d_inode, dentry); if (error) { - fsnotify_oldname_free(old_name); + release_dentry_name_snapshot(&old_name); goto exit; } d_move(old_dentry, dentry); - fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name, + fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name.name, S_ISDIR(old_dentry->d_inode->i_mode), NULL, old_dentry); - fsnotify_oldname_free(old_name); + release_dentry_name_snapshot(&old_name); unlock_rename(new_dir, old_dir); dput(dentry); return old_dentry; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 7719a2a52c97..a7702f41cf95 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5273,6 +5273,11 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, st= ruct vm_fault *vmf) =20 sb_start_pagefault(inode->i_sb); file_update_time(vma->vm_file); + + ret =3D ext4_convert_inline_data(inode); + if (ret) + goto out_ret; + /* Delalloc case is easy... */ if (test_opt(inode->i_sb, DELALLOC) && !ext4_should_journal_data(inode) && diff --git a/fs/namei.c b/fs/namei.c index 55c97a75e5a7..134ca0e00d81 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3086,7 +3086,7 @@ static int do_last(struct nameidata *nd, struct path = *path, error =3D open_check_o_direct(file); if (error) goto exit_fput; - error =3D ima_file_check(file, op->acc_mode); + error =3D ima_file_check(file, op->acc_mode, *opened); if (error) goto exit_fput; =20 @@ -4082,11 +4082,11 @@ int vfs_rename(struct inode *old_dir, struct dentry= *old_dentry, { int error; bool is_dir =3D d_is_dir(old_dentry); - const unsigned char *old_name; struct inode *source =3D old_dentry->d_inode; struct inode *target =3D new_dentry->d_inode; bool new_is_dir =3D false; unsigned max_links =3D new_dir->i_sb->s_max_links; + struct name_snapshot old_name; =20 if (source =3D=3D target) return 0; @@ -4136,7 +4136,7 @@ int vfs_rename(struct inode *old_dir, struct dentry *= old_dentry, if (error) return error; =20 - old_name =3D fsnotify_oldname_init(old_dentry->d_name.name); + take_dentry_name_snapshot(&old_name, old_dentry); dget(new_dentry); if (!is_dir || (flags & RENAME_EXCHANGE)) lock_two_nondirectories(source, target); @@ -4195,14 +4195,14 @@ int vfs_rename(struct inode *old_dir, struct dentry= *old_dentry, mutex_unlock(&target->i_mutex); dput(new_dentry); if (!error) { - fsnotify_move(old_dir, new_dir, old_name, is_dir, + fsnotify_move(old_dir, new_dir, old_name.name, is_dir, !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); if (flags & RENAME_EXCHANGE) { fsnotify_move(new_dir, old_dir, old_dentry->d_name.name, new_is_dir, NULL, new_dentry); } } - fsnotify_oldname_free(old_name); + release_dentry_name_snapshot(&old_name); =20 return error; } diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c index a60f64d88df3..9fc33210f68f 100644 --- a/fs/nfs/pagelist.c +++ b/fs/nfs/pagelist.c @@ -29,13 +29,14 @@ static struct kmem_cache *nfs_page_cachep; static const struct rpc_call_ops nfs_pgio_common_ops; =20 -static bool nfs_pgarray_set(struct nfs_page_array *p, unsigned int pagecou= nt) +static bool nfs_pgarray_set(struct nfs_page_array *p, unsigned int pagecou= nt, + gfp_t gfp_flags) { p->npages =3D pagecount; if (pagecount <=3D ARRAY_SIZE(p->page_array)) p->pagevec =3D p->page_array; else { - p->pagevec =3D kcalloc(pagecount, sizeof(struct page *), GFP_KERNEL); + p->pagevec =3D kcalloc(pagecount, sizeof(struct page *), gfp_flags); if (!p->pagevec) p->npages =3D 0; } @@ -739,9 +740,12 @@ int nfs_generic_pgio(struct nfs_pageio_descriptor *des= c, struct list_head *head =3D &desc->pg_list; struct nfs_commit_info cinfo; unsigned int pagecount, pageused; + gfp_t gfp_flags =3D GFP_KERNEL; =20 pagecount =3D nfs_page_array_len(desc->pg_base, desc->pg_count); - if (!nfs_pgarray_set(&hdr->page_array, pagecount)) + if (desc->pg_rw_ops->rw_mode =3D=3D FMODE_WRITE) + gfp_flags =3D GFP_NOIO; + if (!nfs_pgarray_set(&hdr->page_array, pagecount, gfp_flags)) return nfs_pgio_error(desc, hdr); =20 nfs_init_cinfo(&cinfo, desc->pg_inode, desc->pg_dreq); diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 5c7f72cea0de..2f5de024f204 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -736,7 +736,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, u= mode_t type, host_err =3D PTR_ERR(*filp); *filp =3D NULL; } else { - host_err =3D ima_file_check(*filp, may_flags); + host_err =3D ima_file_check(*filp, may_flags, 0); =20 if (may_flags & NFSD_MAY_64BIT_COOKIE) (*filp)->f_mode |=3D FMODE_64BITHASH; diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanoti= fy_user.c index 394da4dc45e1..1c1a3afd434e 100644 --- a/fs/notify/fanotify/fanotify_user.c +++ b/fs/notify/fanotify/fanotify_user.c @@ -294,27 +294,37 @@ static ssize_t fanotify_read(struct file *file, char = __user *buf, } =20 ret =3D copy_event_to_user(group, kevent, buf); + if (unlikely(ret =3D=3D -EOPENSTALE)) { + /* + * We cannot report events with stale fd so drop it. + * Setting ret to 0 will continue the event loop and + * do the right thing if there are no more events to + * read (i.e. return bytes read, -EAGAIN or wait). + */ + ret =3D 0; + } + /* * Permission events get queued to wait for response. Other * events can be destroyed now. */ if (!(kevent->mask & FAN_ALL_PERM_EVENTS)) { fsnotify_destroy_event(group, kevent); - if (ret < 0) - break; } else { #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS - if (ret < 0) { + if (ret <=3D 0) { FANOTIFY_PE(kevent)->response =3D FAN_DENY; wake_up(&group->fanotify_data.access_waitq); - break; + } else { + spin_lock(&group->fanotify_data.access_lock); + list_add_tail(&kevent->list, + &group->fanotify_data.access_list); + spin_unlock(&group->fanotify_data.access_lock); } - spin_lock(&group->fanotify_data.access_lock); - list_add_tail(&kevent->list, - &group->fanotify_data.access_list); - spin_unlock(&group->fanotify_data.access_lock); #endif } + if (ret < 0) + break; buf +=3D ret; count -=3D ret; } diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c index 700129940c6e..c955b9edb2d5 100644 --- a/fs/notify/fsnotify.c +++ b/fs/notify/fsnotify.c @@ -105,16 +105,20 @@ int __fsnotify_parent(struct path *path, struct dentr= y *dentry, __u32 mask) if (unlikely(!fsnotify_inode_watches_children(p_inode))) __fsnotify_update_child_dentry_flags(p_inode); else if (p_inode->i_fsnotify_mask & mask) { + struct name_snapshot name; + /* we are notifying a parent so come up with the new mask which * specifies these are events which came from a child. */ mask |=3D FS_EVENT_ON_CHILD; =20 + take_dentry_name_snapshot(&name, dentry); if (path) ret =3D fsnotify(p_inode, mask, path, FSNOTIFY_EVENT_PATH, - dentry->d_name.name, 0); + name.name, 0); else ret =3D fsnotify(p_inode, mask, dentry->d_inode, FSNOTIFY_EVENT_INODE, - dentry->d_name.name, 0); + name.name, 0); + release_dentry_name_snapshot(&name); } =20 dput(parent); diff --git a/fs/timerfd.c b/fs/timerfd.c index 0013142c0475..0db5b6c1b10d 100644 --- a/fs/timerfd.c +++ b/fs/timerfd.c @@ -39,6 +39,7 @@ struct timerfd_ctx { int clockid; struct rcu_head rcu; struct list_head clist; + spinlock_t cancel_lock; bool might_cancel; }; =20 @@ -111,7 +112,7 @@ void timerfd_clock_was_set(void) rcu_read_unlock(); } =20 -static void timerfd_remove_cancel(struct timerfd_ctx *ctx) +static void __timerfd_remove_cancel(struct timerfd_ctx *ctx) { if (ctx->might_cancel) { ctx->might_cancel =3D false; @@ -121,6 +122,13 @@ static void timerfd_remove_cancel(struct timerfd_ctx *= ctx) } } =20 +static void timerfd_remove_cancel(struct timerfd_ctx *ctx) +{ + spin_lock(&ctx->cancel_lock); + __timerfd_remove_cancel(ctx); + spin_unlock(&ctx->cancel_lock); +} + static bool timerfd_canceled(struct timerfd_ctx *ctx) { if (!ctx->might_cancel || ctx->moffs.tv64 !=3D KTIME_MAX) @@ -131,6 +139,7 @@ static bool timerfd_canceled(struct timerfd_ctx *ctx) =20 static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags) { + spin_lock(&ctx->cancel_lock); if ((ctx->clockid =3D=3D CLOCK_REALTIME || ctx->clockid =3D=3D CLOCK_REALTIME_ALARM) && (flags & TFD_TIMER_ABSTIME) && (flags & TFD_TIMER_CANCEL_ON_SET)) { @@ -140,9 +149,10 @@ static void timerfd_setup_cancel(struct timerfd_ctx *c= tx, int flags) list_add_rcu(&ctx->clist, &cancel_list); spin_unlock(&cancel_lock); } - } else if (ctx->might_cancel) { - timerfd_remove_cancel(ctx); + } else { + __timerfd_remove_cancel(ctx); } + spin_unlock(&ctx->cancel_lock); } =20 static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx) @@ -326,6 +336,7 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flag= s) return -ENOMEM; =20 init_waitqueue_head(&ctx->wqh); + spin_lock_init(&ctx->cancel_lock); ctx->clockid =3D clockid; =20 if (isalarm(ctx)) diff --git a/fs/xattr.c b/fs/xattr.c index c69e6d43a0d2..7325e2ecbae9 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -455,7 +455,7 @@ getxattr(struct dentry *d, const char __user *name, voi= d __user *value, size =3D XATTR_SIZE_MAX; kvalue =3D kzalloc(size, GFP_KERNEL | __GFP_NOWARN); if (!kvalue) { - vvalue =3D vmalloc(size); + vvalue =3D vzalloc(size); if (!vvalue) return -ENOMEM; kvalue =3D vvalue; diff --git a/include/linux/dcache.h b/include/linux/dcache.h index 3597f13088a8..aa586fb8ee1a 100644 --- a/include/linux/dcache.h +++ b/include/linux/dcache.h @@ -530,4 +530,11 @@ static inline struct dentry *d_backing_dentry(struct d= entry *upper) return upper; } =20 +struct name_snapshot { + const char *name; + char inline_name[DNAME_INLINE_LEN]; +}; +void take_dentry_name_snapshot(struct name_snapshot *, struct dentry *); +void release_dentry_name_snapshot(struct name_snapshot *); + #endif /* __LINUX_DCACHE_H */ diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h index 7ee1774edee5..a7789559078b 100644 --- a/include/linux/fsnotify.h +++ b/include/linux/fsnotify.h @@ -310,35 +310,4 @@ static inline void fsnotify_change(struct dentry *dent= ry, unsigned int ia_valid) } } =20 -#if defined(CONFIG_FSNOTIFY) /* notify helpers */ - -/* - * fsnotify_oldname_init - save off the old filename before we change it - */ -static inline const unsigned char *fsnotify_oldname_init(const unsigned ch= ar *name) -{ - return kstrdup(name, GFP_KERNEL); -} - -/* - * fsnotify_oldname_free - free the name we got from fsnotify_oldname_init - */ -static inline void fsnotify_oldname_free(const unsigned char *old_name) -{ - kfree(old_name); -} - -#else /* CONFIG_FSNOTIFY */ - -static inline const char *fsnotify_oldname_init(const unsigned char *name) -{ - return NULL; -} - -static inline void fsnotify_oldname_free(const unsigned char *old_name) -{ -} - -#endif /* CONFIG_FSNOTIFY */ - #endif /* _LINUX_FS_NOTIFY_H */ diff --git a/include/linux/ima.h b/include/linux/ima.h index 1b7f268cddce..23a87a4fac9f 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -15,7 +15,7 @@ struct linux_binprm; =20 #ifdef CONFIG_IMA extern int ima_bprm_check(struct linux_binprm *bprm); -extern int ima_file_check(struct file *file, int mask); +extern int ima_file_check(struct file *file, int mask, int opened); extern void ima_file_free(struct file *file); extern int ima_file_mmap(struct file *file, unsigned long prot); extern int ima_module_check(struct file *file); @@ -26,7 +26,7 @@ static inline int ima_bprm_check(struct linux_binprm *bpr= m) return 0; } =20 -static inline int ima_file_check(struct file *file, int mask) +static inline int ima_file_check(struct file *file, int mask, int opened) { return 0; } diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h index 7040dc98ff8b..469e4e47d6ea 100644 --- a/include/linux/mlx4/qp.h +++ b/include/linux/mlx4/qp.h @@ -429,6 +429,7 @@ struct mlx4_update_qp_params { u8 smac_index; }; =20 +struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn); int mlx4_update_qp(struct mlx4_dev *dev, struct mlx4_qp *qp, enum mlx4_update_qp_attr attr, struct mlx4_update_qp_params *params); diff --git a/include/scsi/scsi_driver.h b/include/scsi/scsi_driver.h index 36c4114ed9bc..2ae64850dc34 100644 --- a/include/scsi/scsi_driver.h +++ b/include/scsi/scsi_driver.h @@ -17,6 +17,7 @@ struct scsi_driver { void (*uninit_command)(struct scsi_cmnd *); int (*done)(struct scsi_cmnd *); int (*eh_action)(struct scsi_cmnd *, int); + void (*eh_reset)(struct scsi_cmnd *); }; #define to_scsi_driver(drv) \ container_of((drv), struct scsi_driver, gendrv) diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/u= api/linux/netfilter/nf_conntrack_common.h index 319f47128db8..a9f568f38c17 100644 --- a/include/uapi/linux/netfilter/nf_conntrack_common.h +++ b/include/uapi/linux/netfilter/nf_conntrack_common.h @@ -91,6 +91,15 @@ enum ip_conntrack_status { /* Conntrack got a helper explicitly attached via CT target. */ IPS_HELPER_BIT =3D 13, IPS_HELPER =3D (1 << IPS_HELPER_BIT), + + /* Be careful here, modifying these bits can make things messy, + * so don't let users modify them directly. + */ + IPS_UNCHANGEABLE_MASK =3D (IPS_NAT_DONE_MASK | IPS_NAT_MASK | + IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING | + IPS_SEQ_ADJUST | IPS_TEMPLATE), + + __IPS_MAX_BIT =3D 14, }; =20 /* Connection tracking event types */ diff --git a/ipc/mqueue.c b/ipc/mqueue.c index f65a044d66c5..ebe44a53fe5a 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@ -1239,8 +1239,10 @@ SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes, =20 timeo =3D MAX_SCHEDULE_TIMEOUT; ret =3D netlink_attachskb(sock, nc, &timeo, NULL); - if (ret =3D=3D 1) + if (ret =3D=3D 1) { + sock =3D NULL; goto retry; + } if (ret) { sock =3D NULL; nc =3D NULL; diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c index d24e4339b46d..11db49ad509d 100644 --- a/kernel/locking/lockdep.c +++ b/kernel/locking/lockdep.c @@ -2724,6 +2724,8 @@ static void __lockdep_trace_alloc(gfp_t gfp_mask, uns= igned long flags) if (unlikely(!debug_locks)) return; =20 + gfp_mask =3D memalloc_noio_flags(gfp_mask); + /* no reclaim without waiting on it */ if (!(gfp_mask & __GFP_WAIT)) return; @@ -3644,7 +3646,7 @@ EXPORT_SYMBOL_GPL(lock_is_held); =20 void lockdep_set_current_reclaim_state(gfp_t gfp_mask) { - current->lockdep_reclaim_gfp =3D gfp_mask; + current->lockdep_reclaim_gfp =3D memalloc_noio_flags(gfp_mask); } =20 void lockdep_clear_current_reclaim_state(void) diff --git a/kernel/padata.c b/kernel/padata.c index 161402f0b517..3ecda3294690 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -356,7 +356,7 @@ static int padata_setup_cpumasks(struct parallel_data *= pd, =20 cpumask_and(pd->cpumask.pcpu, pcpumask, cpu_online_mask); if (!alloc_cpumask_var(&pd->cpumask.cbcpu, GFP_KERNEL)) { - free_cpumask_var(pd->cpumask.cbcpu); + free_cpumask_var(pd->cpumask.pcpu); return -ENOMEM; } =20 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 6cf0ed87edbc..3b1f547a80e1 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -3119,23 +3119,24 @@ static void __enable_ftrace_function_probe(void) ftrace_probe_registered =3D 1; } =20 -static void __disable_ftrace_function_probe(void) +static bool __disable_ftrace_function_probe(void) { int i; =20 if (!ftrace_probe_registered) - return; + return false; =20 for (i =3D 0; i < FTRACE_FUNC_HASHSIZE; i++) { struct hlist_head *hhd =3D &ftrace_func_hash[i]; if (hhd->first) - return; + return false; } =20 /* no more funcs left */ ftrace_shutdown(&trace_probe_ops, 0); =20 ftrace_probe_registered =3D 0; + return true; } =20 =20 @@ -3263,6 +3264,7 @@ __unregister_ftrace_function_probe(char *glob, struct= ftrace_probe_ops *ops, int type =3D MATCH_FULL; int i, len =3D 0; char *search; + bool disabled; =20 if (glob && (strcmp(glob, "*") =3D=3D 0 || !strlen(glob))) glob =3D NULL; @@ -3316,12 +3318,16 @@ __unregister_ftrace_function_probe(char *glob, stru= ct ftrace_probe_ops *ops, } } mutex_lock(&ftrace_lock); - __disable_ftrace_function_probe(); + disabled =3D __disable_ftrace_function_probe(); /* * Remove after the disable is called. Otherwise, if the last * probe is removed, a null hash means *all enabled*. */ ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash); + + /* still need to update the function call sites */ + if (ftrace_enabled && !disabled) + ftrace_run_update_code(FTRACE_UPDATE_CALLS); synchronize_sched(); list_for_each_entry_safe(entry, p, &free_list, free_list) { list_del(&entry->free_list); diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index 80d25c150a65..cb970c01b6c1 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -886,7 +886,8 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct = socket *sock, if (msg->msg_flags & MSG_OOB) return -EOPNOTSUPP; =20 - if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE)) + if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE| + MSG_CMSG_COMPAT)) return -EINVAL; =20 if (len < 4 || len > HCI_MAX_FRAME_SIZE) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 3d2f66fad322..d813da85bdaa 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -885,10 +885,12 @@ static int __ip_append_data(struct sock *sk, csummode =3D CHECKSUM_PARTIAL; =20 cork->length +=3D length; - if (((length > mtu) || (skb && skb_is_gso(skb))) && + if ((skb && skb_is_gso(skb)) || + ((length > mtu) && + (skb_queue_len(queue) <=3D 1) && (sk->sk_protocol =3D=3D IPPROTO_UDP) && (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) && - (sk->sk_type =3D=3D SOCK_DGRAM)) { + (sk->sk_type =3D=3D SOCK_DGRAM))) { err =3D ip_ufo_append_data(sk, queue, getfrag, from, length, hh_len, fragheaderlen, transhdrlen, maxfraglen, flags); @@ -1203,6 +1205,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4= *fl4, struct page *page, =20 cork->length +=3D size; if ((size + skb->len > mtu) && + (skb_queue_len(&sk->sk_write_queue) =3D=3D 1) && (sk->sk_protocol =3D=3D IPPROTO_UDP) && (rt->dst.dev->features & NETIF_F_UFO)) { skb_shinfo(skb)->gso_size =3D mtu - fragheaderlen; diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c index 1e70fa8fa793..3861dedd5365 100644 --- a/net/ipv4/tcp_lp.c +++ b/net/ipv4/tcp_lp.c @@ -264,13 +264,15 @@ static void tcp_lp_pkts_acked(struct sock *sk, u32 nu= m_acked, s32 rtt_us) { struct tcp_sock *tp =3D tcp_sk(sk); struct lp *lp =3D inet_csk_ca(sk); + u32 delta; =20 if (rtt_us > 0) tcp_lp_rtt_sample(sk, rtt_us); =20 /* calc inference */ - if (tcp_time_stamp > tp->rx_opt.rcv_tsecr) - lp->inference =3D 3 * (tcp_time_stamp - tp->rx_opt.rcv_tsecr); + delta =3D tcp_time_stamp - tp->rx_opt.rcv_tsecr; + if ((s32)delta > 0) + lp->inference =3D 3 * delta; =20 /* test if within inference */ if (lp->last_drop && (tcp_time_stamp - lp->last_drop < lp->inference)) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 59ddab1fce28..0a9aaab17e00 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -824,7 +824,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flo= wi4 *fl4) if (is_udplite) /* UDP-Lite */ csum =3D udplite_csum(skb); =20 - else if (sk->sk_no_check_tx) { /* UDP csum disabled */ + else if (sk->sk_no_check_tx && !skb_is_gso(skb)) { /* UDP csum off */ =20 skb->ip_summed =3D CHECKSUM_NONE; goto send; diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c index 33dbd6c1a00d..2d57f2a1ee26 100644 --- a/net/ipv6/exthdrs.c +++ b/net/ipv6/exthdrs.c @@ -709,6 +709,7 @@ void ipv6_push_frag_opts(struct sk_buff *skb, struct ip= v6_txoptions *opt, u8 *pr if (opt->dst1opt) ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt); } +EXPORT_SYMBOL(ipv6_push_frag_opts); =20 struct ipv6_txoptions * ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 2472ab9392ae..89da95f2b4b1 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1291,11 +1291,12 @@ int ip6_append_data(struct sock *sk, int getfrag(vo= id *from, char *to, =20 skb =3D skb_peek_tail(&sk->sk_write_queue); cork->length +=3D length; - if (((length > mtu) || - (skb && skb_is_gso(skb))) && + if ((skb && skb_is_gso(skb)) || + (((length + fragheaderlen) > mtu) && + (skb_queue_len(&sk->sk_write_queue) <=3D 1) && (sk->sk_protocol =3D=3D IPPROTO_UDP) && (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) && - (sk->sk_type =3D=3D SOCK_DGRAM)) { + (sk->sk_type =3D=3D SOCK_DGRAM))) { err =3D ip6_ufo_append_data(sk, getfrag, from, length, hh_len, fragheaderlen, exthdrlen, transhdrlen, mtu, flags, rt); diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 2879eb9a6049..c36764006d94 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -883,7 +883,7 @@ static void init_tel_txopt(struct ipv6_tel_txoption *op= t, __u8 encap_limit) opt->dst_opt[5] =3D IPV6_TLV_PADN; opt->dst_opt[6] =3D 1; =20 - opt->ops.dst0opt =3D (struct ipv6_opt_hdr *) opt->dst_opt; + opt->ops.dst1opt =3D (struct ipv6_opt_hdr *) opt->dst_opt; opt->ops.opt_nflen =3D 8; } =20 @@ -1051,7 +1051,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, proto =3D fl6->flowi6_proto; if (encap_limit >=3D 0) { init_tel_txopt(&opt, encap_limit); - ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL); + ipv6_push_frag_opts(skb, &opt.ops, &proto); } =20 if (likely(!skb->encapsulation)) { diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 56f77c58c9ae..79763be1fda6 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -1605,6 +1605,8 @@ static int ndisc_netdev_event(struct notifier_block *= this, unsigned long event, case NETDEV_CHANGEADDR: neigh_changeaddr(&nd_tbl, dev); fib6_run_gc(0, net, false); + /* fallthrough */ + case NETDEV_UP: idev =3D in6_dev_get(dev); if (!idev) break; diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c index 0fcaf38006f9..19f9a4a339b5 100644 --- a/net/ipv6/output_core.c +++ b/net/ipv6/output_core.c @@ -44,7 +44,7 @@ EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident); =20 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) { - u16 offset =3D sizeof(struct ipv6hdr); + unsigned int offset =3D sizeof(struct ipv6hdr); unsigned int packet_len =3D skb_tail_pointer(skb) - skb_network_header(skb); int found_rhdr =3D 0; @@ -52,6 +52,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) =20 while (offset <=3D packet_len) { struct ipv6_opt_hdr *exthdr; + unsigned int len; =20 switch (**nexthdr) { =20 @@ -77,7 +78,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthd= r) =20 exthdr =3D (struct ipv6_opt_hdr *)(skb_network_header(skb) + offset); - offset +=3D ipv6_optlen(exthdr); + len =3D ipv6_optlen(exthdr); + if (len + offset >=3D IPV6_MAXPLEN) + return -EINVAL; + offset +=3D len; *nexthdr =3D &exthdr->nexthdr; } =20 diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntr= ack_netlink.c index 3f96dbd25389..63f734c5af79 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -1307,6 +1307,24 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct, } #endif =20 +static void +__ctnetlink_change_status(struct nf_conn *ct, unsigned long on, + unsigned long off) +{ + unsigned int bit; + + /* Ignore these unchangable bits */ + on &=3D ~IPS_UNCHANGEABLE_MASK; + off &=3D ~IPS_UNCHANGEABLE_MASK; + + for (bit =3D 0; bit < __IPS_MAX_BIT; bit++) { + if (on & (1 << bit)) + set_bit(bit, &ct->status); + else if (off & (1 << bit)) + clear_bit(bit, &ct->status); + } +} + static int ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cd= a[]) { @@ -1326,10 +1344,7 @@ ctnetlink_change_status(struct nf_conn *ct, const st= ruct nlattr * const cda[]) /* ASSURED bit can only be set */ return -EBUSY; =20 - /* Be careful here, modifying NAT bits can screw up things, - * so don't let users modify them directly if they don't pass - * nf_nat_range. */ - ct->status |=3D status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK); + __ctnetlink_change_status(ct, status, 0); return 0; } =20 @@ -1384,24 +1399,22 @@ ctnetlink_change_helper(struct nf_conn *ct, const s= truct nlattr * const cda[]) return 0; } =20 + rcu_read_lock(); helper =3D __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct), nf_ct_protonum(ct)); if (helper =3D=3D NULL) { #ifdef CONFIG_MODULES - spin_unlock_bh(&nf_conntrack_expect_lock); + rcu_read_unlock(); =20 - if (request_module("nfct-helper-%s", helpname) < 0) { - spin_lock_bh(&nf_conntrack_expect_lock); + if (request_module("nfct-helper-%s", helpname) < 0) return -EOPNOTSUPP; - } =20 - spin_lock_bh(&nf_conntrack_expect_lock); + rcu_read_lock(); helper =3D __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct), nf_ct_protonum(ct)); - if (helper) - return -EAGAIN; #endif - return -EOPNOTSUPP; + rcu_read_unlock(); + return helper ? -EAGAIN : -EOPNOTSUPP; } =20 if (help) { @@ -1409,13 +1422,16 @@ ctnetlink_change_helper(struct nf_conn *ct, const s= truct nlattr * const cda[]) /* update private helper data if allowed. */ if (helper->from_nlattr) helper->from_nlattr(helpinfo, ct); - return 0; + err =3D 0; } else - return -EBUSY; + err =3D -EBUSY; + } else { + /* we cannot set a helper for an existing conntrack */ + err =3D -EOPNOTSUPP; } =20 - /* we cannot set a helper for an existing conntrack */ - return -EOPNOTSUPP; + rcu_read_unlock(); + return err; } =20 static inline int @@ -1512,7 +1528,7 @@ ctnetlink_change_seq_adj(struct nf_conn *ct, if (ret < 0) return ret; =20 - ct->status |=3D IPS_SEQ_ADJUST; + set_bit(IPS_SEQ_ADJUST_BIT, &ct->status); } =20 if (cda[CTA_SEQ_ADJ_REPLY]) { @@ -1521,7 +1537,7 @@ ctnetlink_change_seq_adj(struct nf_conn *ct, if (ret < 0) return ret; =20 - ct->status |=3D IPS_SEQ_ADJUST; + set_bit(IPS_SEQ_ADJUST_BIT, &ct->status); } =20 return 0; @@ -1831,9 +1847,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_= buff *skb, err =3D -EEXIST; ct =3D nf_ct_tuplehash_to_ctrack(h); if (!(nlh->nlmsg_flags & NLM_F_EXCL)) { - spin_lock_bh(&nf_conntrack_expect_lock); err =3D ctnetlink_change_conntrack(ct, cda); - spin_unlock_bh(&nf_conntrack_expect_lock); if (err =3D=3D 0) { nf_conntrack_eventmask_report((1 << IPCT_REPLY) | (1 << IPCT_ASSURED) | @@ -2165,11 +2179,7 @@ ctnetlink_nfqueue_parse(const struct nlattr *attr, s= truct nf_conn *ct) if (ret < 0) return ret; =20 - spin_lock_bh(&nf_conntrack_expect_lock); - ret =3D ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct); - spin_unlock_bh(&nf_conntrack_expect_lock); - - return ret; + return ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct); } =20 static int ctnetlink_nfqueue_exp_parse(const struct nlattr * const *cda, diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 5b4fb92144b0..d798c2fcd114 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3345,14 +3345,19 @@ packet_setsockopt(struct socket *sock, int level, i= nt optname, char __user *optv =20 if (optlen !=3D sizeof(val)) return -EINVAL; - if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) - return -EBUSY; if (copy_from_user(&val, optval, sizeof(val))) return -EFAULT; if (val > INT_MAX) return -EINVAL; - po->tp_reserve =3D val; - return 0; + lock_sock(sk); + if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { + ret =3D -EBUSY; + } else { + po->tp_reserve =3D val; + ret =3D 0; + } + release_sock(sk); + return ret; } case PACKET_LOSS: { diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 5cb7de9046fa..ec160e422ef4 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -176,7 +176,7 @@ void ima_delete_rules(void); int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, struct file *file, const unsigned char *filename, struct evm_ima_xattr_data *xattr_value, - int xattr_len); + int xattr_len, int opened); int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func); void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file= ); enum integrity_status ima_get_cache_status(struct integrity_iint_cache *ii= nt, @@ -192,7 +192,7 @@ static inline int ima_appraise_measurement(int func, struct file *file, const unsigned char *filename, struct evm_ima_xattr_data *xattr_value, - int xattr_len) + int xattr_len, int opened) { return INTEGRITY_UNKNOWN; } diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima= /ima_appraise.c index 85b147eddcf5..28aee9eb8b32 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -175,7 +175,7 @@ int ima_read_xattr(struct dentry *dentry, int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, struct file *file, const unsigned char *filename, struct evm_ima_xattr_data *xattr_value, - int xattr_len) + int xattr_len, int opened) { static const char op[] =3D "appraise_data"; char *cause =3D "unknown"; @@ -195,10 +195,11 @@ int ima_appraise_measurement(int func, struct integri= ty_iint_cache *iint, =20 cause =3D "missing-hash"; status =3D INTEGRITY_NOLABEL; - if (inode->i_size =3D=3D 0) { + if (opened & FILE_CREATED) iint->flags |=3D IMA_NEW_FILE; + if ((iint->flags & IMA_NEW_FILE) && + !(iint->flags & IMA_DIGSIG_REQUIRED)) status =3D INTEGRITY_PASS; - } goto out; } =20 diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima= _main.c index e7745a07146d..ac2e2cee7a2a 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -161,7 +161,7 @@ void ima_file_free(struct file *file) } =20 static int process_measurement(struct file *file, const char *filename, - int mask, int function) + int mask, int function, int opened) { struct inode *inode =3D file_inode(file); struct integrity_iint_cache *iint; @@ -229,7 +229,7 @@ static int process_measurement(struct file *file, const= char *filename, xattr_value, xattr_len); if (action & IMA_APPRAISE_SUBMASK) rc =3D ima_appraise_measurement(_func, iint, file, pathname, - xattr_value, xattr_len); + xattr_value, xattr_len, opened); if (action & IMA_AUDIT) ima_audit_measurement(iint, pathname); kfree(pathbuf); @@ -258,7 +258,7 @@ static int process_measurement(struct file *file, const= char *filename, int ima_file_mmap(struct file *file, unsigned long prot) { if (file && (prot & PROT_EXEC)) - return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK); + return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK, 0); return 0; } =20 @@ -280,7 +280,7 @@ int ima_bprm_check(struct linux_binprm *bprm) return process_measurement(bprm->file, (strcmp(bprm->filename, bprm->interp) =3D=3D 0) ? bprm->filename : bprm->interp, - MAY_EXEC, BPRM_CHECK); + MAY_EXEC, BPRM_CHECK, 0); } =20 /** @@ -293,12 +293,12 @@ int ima_bprm_check(struct linux_binprm *bprm) * On success return 0. On integrity appraisal error, assuming the file * is in policy and IMA-appraisal is in enforcing mode, return -EACCES. */ -int ima_file_check(struct file *file, int mask) +int ima_file_check(struct file *file, int mask, int opened) { ima_rdwr_violation_check(file); return process_measurement(file, NULL, mask & (MAY_READ | MAY_WRITE | MAY_EXEC), - FILE_CHECK); + FILE_CHECK, opened); } EXPORT_SYMBOL_GPL(ima_file_check); =20 @@ -321,7 +321,7 @@ int ima_module_check(struct file *file) #endif return 0; /* We rely on module signature checking */ } - return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK); + return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK, 0); } =20 static int __init init_ima(void) diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c index 16c7c11ad06e..4c29ff08c9a7 100644 --- a/tools/perf/builtin-inject.c +++ b/tools/perf/builtin-inject.c @@ -387,6 +387,8 @@ static int __cmd_inject(struct perf_inject *inject) lseek(file_out->fd, session->header.data_offset, SEEK_SET); =20 ret =3D perf_session__process_events(session, &inject->tool); + if (ret) + return ret; =20 if (!file_out->is_pipe) { session->header.data_size =3D inject->bytes_written; diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c index 868993d355e0..7babf14aa585 100644 --- a/tools/perf/ui/browsers/hists.c +++ b/tools/perf/ui/browsers/hists.c @@ -1305,7 +1305,7 @@ static int switch_data_file(void) return ret; =20 memset(options, 0, sizeof(options)); - memset(options, 0, sizeof(abs_path)); + memset(abs_path, 0, sizeof(abs_path)); =20 while ((dent =3D readdir(pwd_dir))) { char path[PATH_MAX]; --/d7X7C0hV/blnKmH-- --dJyWBSYfjLochwFK Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBWaGgDOe/yOyVhhEJAQoi9BAAvzWXWw8nrRnjy9p2nAeb81OT326tHhjK IDmWTEKHI+ZEaq0IzFrTOBcq2elLfz/fUspr0gs6dQocsdLX37z2YLsQi0UpOZpn hecCazQQMvYqrow+FRn0ol+PLq1j5LuqTJrQVzOUw9ONqB6hN0jaC+INHIiRiXr0 fii1+ElotXMjBn7/IYExwgn9j65xe9uw1vx1+6iQ0UVEu+SsXgaIC+9SxXyz4Lvx 8tsBYbaYjrIXiixtFRdnGh2gG1vwyyA/jAZ/CcfWEB1/bcuewzvvzgcSqUCdA0ef 58owVXg/61QuB/yIKsAw22+kiW8XCX2PEi/xjfdpniANNNg/nI+mPIht5NU3MB2n aDqe1axEC6bz2CWmcmNOzECYp2EKqELjzl6EQ0uVdHpMM2/LM4vxUQtiZDukvna4 7zkOMO/HFQ2nV7XUHNxAnZkny6IUwTULMGDvXHvLnqry6zCbi7RaqA0HGtxUi21i b/Dddtk3rXhIFXPFNroqsUgYDeolk6sLRd8oDRv2gePXRTbQjgjLqFFtxnxaBuiD CpMgL3zLx1xqT2JDurTTcagVN9akfGB3q1dW2YBkZpcyCqWSeQ2x2ik8rpCZKS8W qrY8YSmL6ft8z4gFSUox9tKV5+3hn+25q092uFUQxAv9ndk3sHZi7zcXL3ZLJipl tCUKiwGx0uM= =uEvP -----END PGP SIGNATURE----- --dJyWBSYfjLochwFK--