Contents of /trunk/kernel-alx-legacy/patches-4.9/0134-4.9.35-all-fixes.patch
Parent Directory | Revision Log
Revision 3608 -
(show annotations)
(download)
Fri Aug 14 07:34:29 2020 UTC (4 years, 1 month ago) by niro
File size: 63041 byte(s)
Fri Aug 14 07:34:29 2020 UTC (4 years, 1 month ago) by niro
File size: 63041 byte(s)
-added kerenl-alx-legacy pkg
1 | diff --git a/Makefile b/Makefile |
2 | index a40b373eba3a..0a8d47465f97 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 34 |
9 | +SUBLEVEL = 35 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | @@ -651,6 +651,12 @@ KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \ |
14 | # Tell gcc to never replace conditional load with a non-conditional one |
15 | KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0) |
16 | |
17 | +# check for 'asm goto' |
18 | +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) |
19 | + KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO |
20 | + KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO |
21 | +endif |
22 | + |
23 | include scripts/Makefile.gcc-plugins |
24 | |
25 | ifdef CONFIG_READABLE_ASM |
26 | @@ -796,12 +802,6 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=incompatible-pointer-types) |
27 | # use the deterministic mode of AR if available |
28 | KBUILD_ARFLAGS := $(call ar-option,D) |
29 | |
30 | -# check for 'asm goto' |
31 | -ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) |
32 | - KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO |
33 | - KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO |
34 | -endif |
35 | - |
36 | include scripts/Makefile.kasan |
37 | include scripts/Makefile.extrawarn |
38 | include scripts/Makefile.ubsan |
39 | diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c |
40 | index a2c2478e7d78..4bcfe01b5aad 100644 |
41 | --- a/arch/arm64/kernel/vdso.c |
42 | +++ b/arch/arm64/kernel/vdso.c |
43 | @@ -217,10 +217,11 @@ void update_vsyscall(struct timekeeper *tk) |
44 | /* tkr_mono.cycle_last == tkr_raw.cycle_last */ |
45 | vdso_data->cs_cycle_last = tk->tkr_mono.cycle_last; |
46 | vdso_data->raw_time_sec = tk->raw_time.tv_sec; |
47 | - vdso_data->raw_time_nsec = tk->raw_time.tv_nsec; |
48 | + vdso_data->raw_time_nsec = (tk->raw_time.tv_nsec << |
49 | + tk->tkr_raw.shift) + |
50 | + tk->tkr_raw.xtime_nsec; |
51 | vdso_data->xtime_clock_sec = tk->xtime_sec; |
52 | vdso_data->xtime_clock_nsec = tk->tkr_mono.xtime_nsec; |
53 | - /* tkr_raw.xtime_nsec == 0 */ |
54 | vdso_data->cs_mono_mult = tk->tkr_mono.mult; |
55 | vdso_data->cs_raw_mult = tk->tkr_raw.mult; |
56 | /* tkr_mono.shift == tkr_raw.shift */ |
57 | diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S |
58 | index e00b4671bd7c..76320e920965 100644 |
59 | --- a/arch/arm64/kernel/vdso/gettimeofday.S |
60 | +++ b/arch/arm64/kernel/vdso/gettimeofday.S |
61 | @@ -256,7 +256,6 @@ monotonic_raw: |
62 | seqcnt_check fail=monotonic_raw |
63 | |
64 | /* All computations are done with left-shifted nsecs. */ |
65 | - lsl x14, x14, x12 |
66 | get_nsec_per_sec res=x9 |
67 | lsl x9, x9, x12 |
68 | |
69 | diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S |
70 | index 1ba82ea90230..2e2fc1e37715 100644 |
71 | --- a/arch/powerpc/kernel/exceptions-64s.S |
72 | +++ b/arch/powerpc/kernel/exceptions-64s.S |
73 | @@ -1411,10 +1411,8 @@ USE_TEXT_SECTION() |
74 | .align 7 |
75 | do_hash_page: |
76 | #ifdef CONFIG_PPC_STD_MMU_64 |
77 | - andis. r0,r4,0xa410 /* weird error? */ |
78 | + andis. r0,r4,0xa450 /* weird error? */ |
79 | bne- handle_page_fault /* if not, try to insert a HPTE */ |
80 | - andis. r0,r4,DSISR_DABRMATCH@h |
81 | - bne- handle_dabr_fault |
82 | CURRENT_THREAD_INFO(r11, r1) |
83 | lwz r0,TI_PREEMPT(r11) /* If we're in an "NMI" */ |
84 | andis. r0,r0,NMI_MASK@h /* (i.e. an irq when soft-disabled) */ |
85 | @@ -1438,11 +1436,16 @@ do_hash_page: |
86 | |
87 | /* Error */ |
88 | blt- 13f |
89 | + |
90 | + /* Reload DSISR into r4 for the DABR check below */ |
91 | + ld r4,_DSISR(r1) |
92 | #endif /* CONFIG_PPC_STD_MMU_64 */ |
93 | |
94 | /* Here we have a page fault that hash_page can't handle. */ |
95 | handle_page_fault: |
96 | -11: ld r4,_DAR(r1) |
97 | +11: andis. r0,r4,DSISR_DABRMATCH@h |
98 | + bne- handle_dabr_fault |
99 | + ld r4,_DAR(r1) |
100 | ld r5,_DSISR(r1) |
101 | addi r3,r1,STACK_FRAME_OVERHEAD |
102 | bl do_page_fault |
103 | diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c |
104 | index e785cc9e1ecd..fe97cbe04576 100644 |
105 | --- a/arch/powerpc/kernel/kprobes.c |
106 | +++ b/arch/powerpc/kernel/kprobes.c |
107 | @@ -511,6 +511,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) |
108 | regs->gpr[2] = (unsigned long)(((func_descr_t *)jp->entry)->toc); |
109 | #endif |
110 | |
111 | + /* |
112 | + * jprobes use jprobe_return() which skips the normal return |
113 | + * path of the function, and this messes up the accounting of the |
114 | + * function graph tracer. |
115 | + * |
116 | + * Pause function graph tracing while performing the jprobe function. |
117 | + */ |
118 | + pause_graph_tracing(); |
119 | + |
120 | return 1; |
121 | } |
122 | |
123 | @@ -533,6 +542,8 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) |
124 | * saved regs... |
125 | */ |
126 | memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs)); |
127 | + /* It's OK to start function graph tracing again */ |
128 | + unpause_graph_tracing(); |
129 | preempt_enable_no_resched(); |
130 | return 1; |
131 | } |
132 | diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c |
133 | index 094deb60c6fe..5c0298422300 100644 |
134 | --- a/arch/powerpc/kvm/book3s_hv.c |
135 | +++ b/arch/powerpc/kvm/book3s_hv.c |
136 | @@ -2807,12 +2807,34 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) |
137 | { |
138 | int r; |
139 | int srcu_idx; |
140 | + unsigned long ebb_regs[3] = {}; /* shut up GCC */ |
141 | |
142 | if (!vcpu->arch.sane) { |
143 | run->exit_reason = KVM_EXIT_INTERNAL_ERROR; |
144 | return -EINVAL; |
145 | } |
146 | |
147 | + /* |
148 | + * Don't allow entry with a suspended transaction, because |
149 | + * the guest entry/exit code will lose it. |
150 | + * If the guest has TM enabled, save away their TM-related SPRs |
151 | + * (they will get restored by the TM unavailable interrupt). |
152 | + */ |
153 | +#ifdef CONFIG_PPC_TRANSACTIONAL_MEM |
154 | + if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs && |
155 | + (current->thread.regs->msr & MSR_TM)) { |
156 | + if (MSR_TM_ACTIVE(current->thread.regs->msr)) { |
157 | + run->exit_reason = KVM_EXIT_FAIL_ENTRY; |
158 | + run->fail_entry.hardware_entry_failure_reason = 0; |
159 | + return -EINVAL; |
160 | + } |
161 | + current->thread.tm_tfhar = mfspr(SPRN_TFHAR); |
162 | + current->thread.tm_tfiar = mfspr(SPRN_TFIAR); |
163 | + current->thread.tm_texasr = mfspr(SPRN_TEXASR); |
164 | + current->thread.regs->msr &= ~MSR_TM; |
165 | + } |
166 | +#endif |
167 | + |
168 | kvmppc_core_prepare_to_enter(vcpu); |
169 | |
170 | /* No need to go into the guest when all we'll do is come back out */ |
171 | @@ -2834,6 +2856,13 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) |
172 | |
173 | flush_all_to_thread(current); |
174 | |
175 | + /* Save userspace EBB register values */ |
176 | + if (cpu_has_feature(CPU_FTR_ARCH_207S)) { |
177 | + ebb_regs[0] = mfspr(SPRN_EBBHR); |
178 | + ebb_regs[1] = mfspr(SPRN_EBBRR); |
179 | + ebb_regs[2] = mfspr(SPRN_BESCR); |
180 | + } |
181 | + |
182 | vcpu->arch.wqp = &vcpu->arch.vcore->wq; |
183 | vcpu->arch.pgdir = current->mm->pgd; |
184 | vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST; |
185 | @@ -2856,6 +2885,13 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) |
186 | r = kvmppc_xics_rm_complete(vcpu, 0); |
187 | } while (is_kvmppc_resume_guest(r)); |
188 | |
189 | + /* Restore userspace EBB register values */ |
190 | + if (cpu_has_feature(CPU_FTR_ARCH_207S)) { |
191 | + mtspr(SPRN_EBBHR, ebb_regs[0]); |
192 | + mtspr(SPRN_EBBRR, ebb_regs[1]); |
193 | + mtspr(SPRN_BESCR, ebb_regs[2]); |
194 | + } |
195 | + |
196 | out: |
197 | vcpu->arch.state = KVMPPC_VCPU_NOTREADY; |
198 | atomic_dec(&vcpu->kvm->arch.vcpus_running); |
199 | diff --git a/arch/powerpc/perf/perf_regs.c b/arch/powerpc/perf/perf_regs.c |
200 | index d24a8a3668fa..28ae8bd6228e 100644 |
201 | --- a/arch/powerpc/perf/perf_regs.c |
202 | +++ b/arch/powerpc/perf/perf_regs.c |
203 | @@ -100,5 +100,6 @@ void perf_get_regs_user(struct perf_regs *regs_user, |
204 | struct pt_regs *regs_user_copy) |
205 | { |
206 | regs_user->regs = task_pt_regs(current); |
207 | - regs_user->abi = perf_reg_abi(current); |
208 | + regs_user->abi = (regs_user->regs) ? perf_reg_abi(current) : |
209 | + PERF_SAMPLE_REGS_ABI_NONE; |
210 | } |
211 | diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c |
212 | index 4aa8a7e2a1da..f5d79840f4e0 100644 |
213 | --- a/arch/s390/kvm/gaccess.c |
214 | +++ b/arch/s390/kvm/gaccess.c |
215 | @@ -972,11 +972,12 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, |
216 | ptr = asce.origin * 4096; |
217 | if (asce.r) { |
218 | *fake = 1; |
219 | + ptr = 0; |
220 | asce.dt = ASCE_TYPE_REGION1; |
221 | } |
222 | switch (asce.dt) { |
223 | case ASCE_TYPE_REGION1: |
224 | - if (vaddr.rfx01 > asce.tl && !asce.r) |
225 | + if (vaddr.rfx01 > asce.tl && !*fake) |
226 | return PGM_REGION_FIRST_TRANS; |
227 | break; |
228 | case ASCE_TYPE_REGION2: |
229 | @@ -1004,8 +1005,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, |
230 | union region1_table_entry rfte; |
231 | |
232 | if (*fake) { |
233 | - /* offset in 16EB guest memory block */ |
234 | - ptr = ptr + ((unsigned long) vaddr.rsx << 53UL); |
235 | + ptr += (unsigned long) vaddr.rfx << 53; |
236 | rfte.val = ptr; |
237 | goto shadow_r2t; |
238 | } |
239 | @@ -1031,8 +1031,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, |
240 | union region2_table_entry rste; |
241 | |
242 | if (*fake) { |
243 | - /* offset in 8PB guest memory block */ |
244 | - ptr = ptr + ((unsigned long) vaddr.rtx << 42UL); |
245 | + ptr += (unsigned long) vaddr.rsx << 42; |
246 | rste.val = ptr; |
247 | goto shadow_r3t; |
248 | } |
249 | @@ -1059,8 +1058,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, |
250 | union region3_table_entry rtte; |
251 | |
252 | if (*fake) { |
253 | - /* offset in 4TB guest memory block */ |
254 | - ptr = ptr + ((unsigned long) vaddr.sx << 31UL); |
255 | + ptr += (unsigned long) vaddr.rtx << 31; |
256 | rtte.val = ptr; |
257 | goto shadow_sgt; |
258 | } |
259 | @@ -1096,8 +1094,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, |
260 | union segment_table_entry ste; |
261 | |
262 | if (*fake) { |
263 | - /* offset in 2G guest memory block */ |
264 | - ptr = ptr + ((unsigned long) vaddr.sx << 20UL); |
265 | + ptr += (unsigned long) vaddr.sx << 20; |
266 | ste.val = ptr; |
267 | goto shadow_pgt; |
268 | } |
269 | diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c |
270 | index cb8522290e6a..3bdb917716b1 100644 |
271 | --- a/arch/x86/events/intel/core.c |
272 | +++ b/arch/x86/events/intel/core.c |
273 | @@ -431,11 +431,11 @@ static __initconst const u64 skl_hw_cache_event_ids |
274 | [ C(DTLB) ] = { |
275 | [ C(OP_READ) ] = { |
276 | [ C(RESULT_ACCESS) ] = 0x81d0, /* MEM_INST_RETIRED.ALL_LOADS */ |
277 | - [ C(RESULT_MISS) ] = 0x608, /* DTLB_LOAD_MISSES.WALK_COMPLETED */ |
278 | + [ C(RESULT_MISS) ] = 0xe08, /* DTLB_LOAD_MISSES.WALK_COMPLETED */ |
279 | }, |
280 | [ C(OP_WRITE) ] = { |
281 | [ C(RESULT_ACCESS) ] = 0x82d0, /* MEM_INST_RETIRED.ALL_STORES */ |
282 | - [ C(RESULT_MISS) ] = 0x649, /* DTLB_STORE_MISSES.WALK_COMPLETED */ |
283 | + [ C(RESULT_MISS) ] = 0xe49, /* DTLB_STORE_MISSES.WALK_COMPLETED */ |
284 | }, |
285 | [ C(OP_PREFETCH) ] = { |
286 | [ C(RESULT_ACCESS) ] = 0x0, |
287 | diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c |
288 | index 4a80ee752597..c42202d63567 100644 |
289 | --- a/drivers/block/xen-blkback/blkback.c |
290 | +++ b/drivers/block/xen-blkback/blkback.c |
291 | @@ -1436,34 +1436,35 @@ static int dispatch_rw_block_io(struct xen_blkif_ring *ring, |
292 | static void make_response(struct xen_blkif_ring *ring, u64 id, |
293 | unsigned short op, int st) |
294 | { |
295 | - struct blkif_response resp; |
296 | + struct blkif_response *resp; |
297 | unsigned long flags; |
298 | union blkif_back_rings *blk_rings; |
299 | int notify; |
300 | |
301 | - resp.id = id; |
302 | - resp.operation = op; |
303 | - resp.status = st; |
304 | - |
305 | spin_lock_irqsave(&ring->blk_ring_lock, flags); |
306 | blk_rings = &ring->blk_rings; |
307 | /* Place on the response ring for the relevant domain. */ |
308 | switch (ring->blkif->blk_protocol) { |
309 | case BLKIF_PROTOCOL_NATIVE: |
310 | - memcpy(RING_GET_RESPONSE(&blk_rings->native, blk_rings->native.rsp_prod_pvt), |
311 | - &resp, sizeof(resp)); |
312 | + resp = RING_GET_RESPONSE(&blk_rings->native, |
313 | + blk_rings->native.rsp_prod_pvt); |
314 | break; |
315 | case BLKIF_PROTOCOL_X86_32: |
316 | - memcpy(RING_GET_RESPONSE(&blk_rings->x86_32, blk_rings->x86_32.rsp_prod_pvt), |
317 | - &resp, sizeof(resp)); |
318 | + resp = RING_GET_RESPONSE(&blk_rings->x86_32, |
319 | + blk_rings->x86_32.rsp_prod_pvt); |
320 | break; |
321 | case BLKIF_PROTOCOL_X86_64: |
322 | - memcpy(RING_GET_RESPONSE(&blk_rings->x86_64, blk_rings->x86_64.rsp_prod_pvt), |
323 | - &resp, sizeof(resp)); |
324 | + resp = RING_GET_RESPONSE(&blk_rings->x86_64, |
325 | + blk_rings->x86_64.rsp_prod_pvt); |
326 | break; |
327 | default: |
328 | BUG(); |
329 | } |
330 | + |
331 | + resp->id = id; |
332 | + resp->operation = op; |
333 | + resp->status = st; |
334 | + |
335 | blk_rings->common.rsp_prod_pvt++; |
336 | RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blk_rings->common, notify); |
337 | spin_unlock_irqrestore(&ring->blk_ring_lock, flags); |
338 | diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h |
339 | index dea61f6ab8cb..ecb35fe8ca8d 100644 |
340 | --- a/drivers/block/xen-blkback/common.h |
341 | +++ b/drivers/block/xen-blkback/common.h |
342 | @@ -75,9 +75,8 @@ extern unsigned int xenblk_max_queues; |
343 | struct blkif_common_request { |
344 | char dummy; |
345 | }; |
346 | -struct blkif_common_response { |
347 | - char dummy; |
348 | -}; |
349 | + |
350 | +/* i386 protocol version */ |
351 | |
352 | struct blkif_x86_32_request_rw { |
353 | uint8_t nr_segments; /* number of segments */ |
354 | @@ -129,14 +128,6 @@ struct blkif_x86_32_request { |
355 | } u; |
356 | } __attribute__((__packed__)); |
357 | |
358 | -/* i386 protocol version */ |
359 | -#pragma pack(push, 4) |
360 | -struct blkif_x86_32_response { |
361 | - uint64_t id; /* copied from request */ |
362 | - uint8_t operation; /* copied from request */ |
363 | - int16_t status; /* BLKIF_RSP_??? */ |
364 | -}; |
365 | -#pragma pack(pop) |
366 | /* x86_64 protocol version */ |
367 | |
368 | struct blkif_x86_64_request_rw { |
369 | @@ -193,18 +184,12 @@ struct blkif_x86_64_request { |
370 | } u; |
371 | } __attribute__((__packed__)); |
372 | |
373 | -struct blkif_x86_64_response { |
374 | - uint64_t __attribute__((__aligned__(8))) id; |
375 | - uint8_t operation; /* copied from request */ |
376 | - int16_t status; /* BLKIF_RSP_??? */ |
377 | -}; |
378 | - |
379 | DEFINE_RING_TYPES(blkif_common, struct blkif_common_request, |
380 | - struct blkif_common_response); |
381 | + struct blkif_response); |
382 | DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request, |
383 | - struct blkif_x86_32_response); |
384 | + struct blkif_response __packed); |
385 | DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request, |
386 | - struct blkif_x86_64_response); |
387 | + struct blkif_response); |
388 | |
389 | union blkif_back_rings { |
390 | struct blkif_back_ring native; |
391 | @@ -281,6 +266,7 @@ struct xen_blkif_ring { |
392 | |
393 | wait_queue_head_t wq; |
394 | atomic_t inflight; |
395 | + bool active; |
396 | /* One thread per blkif ring. */ |
397 | struct task_struct *xenblkd; |
398 | unsigned int waiting_reqs; |
399 | diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c |
400 | index 3cc6d1d86f1e..9b69fe410c08 100644 |
401 | --- a/drivers/block/xen-blkback/xenbus.c |
402 | +++ b/drivers/block/xen-blkback/xenbus.c |
403 | @@ -159,7 +159,7 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif) |
404 | init_waitqueue_head(&ring->shutdown_wq); |
405 | ring->blkif = blkif; |
406 | ring->st_print = jiffies; |
407 | - xen_blkif_get(blkif); |
408 | + ring->active = true; |
409 | } |
410 | |
411 | return 0; |
412 | @@ -249,6 +249,9 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) |
413 | struct xen_blkif_ring *ring = &blkif->rings[r]; |
414 | unsigned int i = 0; |
415 | |
416 | + if (!ring->active) |
417 | + continue; |
418 | + |
419 | if (ring->xenblkd) { |
420 | kthread_stop(ring->xenblkd); |
421 | wake_up(&ring->shutdown_wq); |
422 | @@ -296,7 +299,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) |
423 | BUG_ON(ring->free_pages_num != 0); |
424 | BUG_ON(ring->persistent_gnt_c != 0); |
425 | WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages)); |
426 | - xen_blkif_put(blkif); |
427 | + ring->active = false; |
428 | } |
429 | blkif->nr_ring_pages = 0; |
430 | /* |
431 | diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c |
432 | index 8ca07fe8d3f3..0cca3601d99e 100644 |
433 | --- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c |
434 | +++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c |
435 | @@ -556,7 +556,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(lcd0_ch1_clk, "lcd0-ch1", lcd_ch1_parents, |
436 | 0x12c, 0, 4, 24, 3, BIT(31), |
437 | CLK_SET_RATE_PARENT); |
438 | static SUNXI_CCU_M_WITH_MUX_GATE(lcd1_ch1_clk, "lcd1-ch1", lcd_ch1_parents, |
439 | - 0x12c, 0, 4, 24, 3, BIT(31), |
440 | + 0x130, 0, 4, 24, 3, BIT(31), |
441 | CLK_SET_RATE_PARENT); |
442 | |
443 | static const char * const csi_sclk_parents[] = { "pll-video0", "pll-video1", |
444 | diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c |
445 | index e18dc596cf24..6204cc32d09c 100644 |
446 | --- a/drivers/dma/bcm2835-dma.c |
447 | +++ b/drivers/dma/bcm2835-dma.c |
448 | @@ -251,8 +251,11 @@ static void bcm2835_dma_create_cb_set_length( |
449 | */ |
450 | |
451 | /* have we filled in period_length yet? */ |
452 | - if (*total_len + control_block->length < period_len) |
453 | + if (*total_len + control_block->length < period_len) { |
454 | + /* update number of bytes in this period so far */ |
455 | + *total_len += control_block->length; |
456 | return; |
457 | + } |
458 | |
459 | /* calculate the length that remains to reach period_length */ |
460 | control_block->length = period_len - *total_len; |
461 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c |
462 | index 8e6bf548d689..f8fdbd1378a7 100644 |
463 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c |
464 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c |
465 | @@ -693,6 +693,10 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev) |
466 | DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n", |
467 | adev->clock.default_dispclk / 100); |
468 | adev->clock.default_dispclk = 60000; |
469 | + } else if (adev->clock.default_dispclk <= 60000) { |
470 | + DRM_INFO("Changing default dispclk from %dMhz to 625Mhz\n", |
471 | + adev->clock.default_dispclk / 100); |
472 | + adev->clock.default_dispclk = 62500; |
473 | } |
474 | adev->clock.dp_extclk = |
475 | le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq); |
476 | diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c |
477 | index f7d236f95e74..57fbde14e978 100644 |
478 | --- a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c |
479 | +++ b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c |
480 | @@ -164,7 +164,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state) |
481 | struct drm_device *dev = crtc->dev; |
482 | struct amdgpu_device *adev = dev->dev_private; |
483 | int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating); |
484 | - ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args; |
485 | + ENABLE_DISP_POWER_GATING_PS_ALLOCATION args; |
486 | |
487 | memset(&args, 0, sizeof(args)); |
488 | |
489 | @@ -177,7 +177,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state) |
490 | void amdgpu_atombios_crtc_powergate_init(struct amdgpu_device *adev) |
491 | { |
492 | int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating); |
493 | - ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args; |
494 | + ENABLE_DISP_POWER_GATING_PS_ALLOCATION args; |
495 | |
496 | memset(&args, 0, sizeof(args)); |
497 | |
498 | diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c |
499 | index 432480ff9d22..3178ba0c537c 100644 |
500 | --- a/drivers/gpu/drm/radeon/radeon_combios.c |
501 | +++ b/drivers/gpu/drm/radeon/radeon_combios.c |
502 | @@ -3393,6 +3393,13 @@ void radeon_combios_asic_init(struct drm_device *dev) |
503 | rdev->pdev->subsystem_vendor == 0x103c && |
504 | rdev->pdev->subsystem_device == 0x280a) |
505 | return; |
506 | + /* quirk for rs4xx Toshiba Sattellite L20-183 latop to make it resume |
507 | + * - it hangs on resume inside the dynclk 1 table. |
508 | + */ |
509 | + if (rdev->family == CHIP_RS400 && |
510 | + rdev->pdev->subsystem_vendor == 0x1179 && |
511 | + rdev->pdev->subsystem_device == 0xff31) |
512 | + return; |
513 | |
514 | /* DYN CLK 1 */ |
515 | table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE); |
516 | diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c |
517 | index 621af069a3d2..3b21ca5a6c81 100644 |
518 | --- a/drivers/gpu/drm/radeon/radeon_device.c |
519 | +++ b/drivers/gpu/drm/radeon/radeon_device.c |
520 | @@ -136,6 +136,10 @@ static struct radeon_px_quirk radeon_px_quirk_list[] = { |
521 | * https://bugzilla.kernel.org/show_bug.cgi?id=51381 |
522 | */ |
523 | { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX }, |
524 | + /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU |
525 | + * https://bugs.freedesktop.org/show_bug.cgi?id=101491 |
526 | + */ |
527 | + { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX }, |
528 | /* macbook pro 8.2 */ |
529 | { PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, RADEON_PX_QUIRK_LONG_WAKEUP }, |
530 | { 0, 0, 0, 0, 0 }, |
531 | diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h |
532 | index da9307701abe..cfca43f635a6 100644 |
533 | --- a/drivers/hid/hid-ids.h |
534 | +++ b/drivers/hid/hid-ids.h |
535 | @@ -311,6 +311,9 @@ |
536 | #define USB_VENDOR_ID_DELCOM 0x0fc5 |
537 | #define USB_DEVICE_ID_DELCOM_VISUAL_IND 0xb080 |
538 | |
539 | +#define USB_VENDOR_ID_DELL 0x413c |
540 | +#define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE 0x301a |
541 | + |
542 | #define USB_VENDOR_ID_DELORME 0x1163 |
543 | #define USB_DEVICE_ID_DELORME_EARTHMATE 0x0100 |
544 | #define USB_DEVICE_ID_DELORME_EM_LT20 0x0200 |
545 | diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c |
546 | index 97dbb2562ace..2b1620797959 100644 |
547 | --- a/drivers/hid/usbhid/hid-quirks.c |
548 | +++ b/drivers/hid/usbhid/hid-quirks.c |
549 | @@ -81,6 +81,7 @@ static const struct hid_blacklist { |
550 | { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS }, |
551 | { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, |
552 | { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET }, |
553 | + { USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, |
554 | { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, |
555 | { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT }, |
556 | { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3, HID_QUIRK_MULTI_INPUT }, |
557 | diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h |
558 | index e7b96f1ac2c5..5be14ad29d46 100644 |
559 | --- a/drivers/input/serio/i8042-x86ia64io.h |
560 | +++ b/drivers/input/serio/i8042-x86ia64io.h |
561 | @@ -788,6 +788,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { |
562 | DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"), |
563 | }, |
564 | }, |
565 | + { |
566 | + /* Fujitsu UH554 laptop */ |
567 | + .matches = { |
568 | + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), |
569 | + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK UH544"), |
570 | + }, |
571 | + }, |
572 | { } |
573 | }; |
574 | |
575 | diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c |
576 | index d0fc165d7d66..21dde5249085 100644 |
577 | --- a/drivers/mtd/spi-nor/spi-nor.c |
578 | +++ b/drivers/mtd/spi-nor/spi-nor.c |
579 | @@ -1255,6 +1255,13 @@ static int spansion_quad_enable(struct spi_nor *nor) |
580 | return -EINVAL; |
581 | } |
582 | |
583 | + ret = spi_nor_wait_till_ready(nor); |
584 | + if (ret) { |
585 | + dev_err(nor->dev, |
586 | + "timeout while writing configuration register\n"); |
587 | + return ret; |
588 | + } |
589 | + |
590 | /* read back and check it */ |
591 | ret = read_cr(nor); |
592 | if (!(ret > 0 && (ret & CR_QUAD_EN_SPAN))) { |
593 | diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c |
594 | index f9c2feb4a4e7..0c2a32a305bc 100644 |
595 | --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c |
596 | +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c |
597 | @@ -2201,9 +2201,10 @@ static int cxgb_up(struct adapter *adap) |
598 | { |
599 | int err; |
600 | |
601 | + mutex_lock(&uld_mutex); |
602 | err = setup_sge_queues(adap); |
603 | if (err) |
604 | - goto out; |
605 | + goto rel_lock; |
606 | err = setup_rss(adap); |
607 | if (err) |
608 | goto freeq; |
609 | @@ -2227,7 +2228,6 @@ static int cxgb_up(struct adapter *adap) |
610 | goto irq_err; |
611 | } |
612 | |
613 | - mutex_lock(&uld_mutex); |
614 | enable_rx(adap); |
615 | t4_sge_start(adap); |
616 | t4_intr_enable(adap); |
617 | @@ -2240,13 +2240,15 @@ static int cxgb_up(struct adapter *adap) |
618 | #endif |
619 | /* Initialize hash mac addr list*/ |
620 | INIT_LIST_HEAD(&adap->mac_hlist); |
621 | - out: |
622 | return err; |
623 | + |
624 | irq_err: |
625 | dev_err(adap->pdev_dev, "request_irq failed, err %d\n", err); |
626 | freeq: |
627 | t4_free_sge_resources(adap); |
628 | - goto out; |
629 | + rel_lock: |
630 | + mutex_unlock(&uld_mutex); |
631 | + return err; |
632 | } |
633 | |
634 | static void cxgb_down(struct adapter *adapter) |
635 | diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c |
636 | index d6a541bde331..2f70f80de27f 100644 |
637 | --- a/drivers/net/phy/marvell.c |
638 | +++ b/drivers/net/phy/marvell.c |
639 | @@ -1114,8 +1114,6 @@ static int marvell_read_status_page(struct phy_device *phydev, int page) |
640 | if (adv < 0) |
641 | return adv; |
642 | |
643 | - lpa &= adv; |
644 | - |
645 | if (status & MII_M1011_PHY_STATUS_FULLDUPLEX) |
646 | phydev->duplex = DUPLEX_FULL; |
647 | else |
648 | diff --git a/drivers/net/phy/mdio-bcm-iproc.c b/drivers/net/phy/mdio-bcm-iproc.c |
649 | index c0b4e65267af..46fe1ae919a3 100644 |
650 | --- a/drivers/net/phy/mdio-bcm-iproc.c |
651 | +++ b/drivers/net/phy/mdio-bcm-iproc.c |
652 | @@ -81,8 +81,6 @@ static int iproc_mdio_read(struct mii_bus *bus, int phy_id, int reg) |
653 | if (rc) |
654 | return rc; |
655 | |
656 | - iproc_mdio_config_clk(priv->base); |
657 | - |
658 | /* Prepare the read operation */ |
659 | cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) | |
660 | (reg << MII_DATA_RA_SHIFT) | |
661 | @@ -112,8 +110,6 @@ static int iproc_mdio_write(struct mii_bus *bus, int phy_id, |
662 | if (rc) |
663 | return rc; |
664 | |
665 | - iproc_mdio_config_clk(priv->base); |
666 | - |
667 | /* Prepare the write operation */ |
668 | cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) | |
669 | (reg << MII_DATA_RA_SHIFT) | |
670 | @@ -163,6 +159,8 @@ static int iproc_mdio_probe(struct platform_device *pdev) |
671 | bus->read = iproc_mdio_read; |
672 | bus->write = iproc_mdio_write; |
673 | |
674 | + iproc_mdio_config_clk(priv->base); |
675 | + |
676 | rc = of_mdiobus_register(bus, pdev->dev.of_node); |
677 | if (rc) { |
678 | dev_err(&pdev->dev, "MDIO bus registration failed\n"); |
679 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c |
680 | index c7c1e9906500..d231042f19d6 100644 |
681 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c |
682 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c |
683 | @@ -442,7 +442,7 @@ struct brcmf_fw { |
684 | const char *nvram_name; |
685 | u16 domain_nr; |
686 | u16 bus_nr; |
687 | - void (*done)(struct device *dev, const struct firmware *fw, |
688 | + void (*done)(struct device *dev, int err, const struct firmware *fw, |
689 | void *nvram_image, u32 nvram_len); |
690 | }; |
691 | |
692 | @@ -477,52 +477,51 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx) |
693 | if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL)) |
694 | goto fail; |
695 | |
696 | - fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length); |
697 | + fwctx->done(fwctx->dev, 0, fwctx->code, nvram, nvram_length); |
698 | kfree(fwctx); |
699 | return; |
700 | |
701 | fail: |
702 | brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev)); |
703 | release_firmware(fwctx->code); |
704 | - device_release_driver(fwctx->dev); |
705 | + fwctx->done(fwctx->dev, -ENOENT, NULL, NULL, 0); |
706 | kfree(fwctx); |
707 | } |
708 | |
709 | static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx) |
710 | { |
711 | struct brcmf_fw *fwctx = ctx; |
712 | - int ret; |
713 | + int ret = 0; |
714 | |
715 | brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev)); |
716 | - if (!fw) |
717 | + if (!fw) { |
718 | + ret = -ENOENT; |
719 | goto fail; |
720 | - |
721 | - /* only requested code so done here */ |
722 | - if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) { |
723 | - fwctx->done(fwctx->dev, fw, NULL, 0); |
724 | - kfree(fwctx); |
725 | - return; |
726 | } |
727 | + /* only requested code so done here */ |
728 | + if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) |
729 | + goto done; |
730 | + |
731 | fwctx->code = fw; |
732 | ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name, |
733 | fwctx->dev, GFP_KERNEL, fwctx, |
734 | brcmf_fw_request_nvram_done); |
735 | |
736 | - if (!ret) |
737 | - return; |
738 | - |
739 | - brcmf_fw_request_nvram_done(NULL, fwctx); |
740 | + /* pass NULL to nvram callback for bcm47xx fallback */ |
741 | + if (ret) |
742 | + brcmf_fw_request_nvram_done(NULL, fwctx); |
743 | return; |
744 | |
745 | fail: |
746 | brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev)); |
747 | - device_release_driver(fwctx->dev); |
748 | +done: |
749 | + fwctx->done(fwctx->dev, ret, fw, NULL, 0); |
750 | kfree(fwctx); |
751 | } |
752 | |
753 | int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags, |
754 | const char *code, const char *nvram, |
755 | - void (*fw_cb)(struct device *dev, |
756 | + void (*fw_cb)(struct device *dev, int err, |
757 | const struct firmware *fw, |
758 | void *nvram_image, u32 nvram_len), |
759 | u16 domain_nr, u16 bus_nr) |
760 | @@ -555,7 +554,7 @@ int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags, |
761 | |
762 | int brcmf_fw_get_firmwares(struct device *dev, u16 flags, |
763 | const char *code, const char *nvram, |
764 | - void (*fw_cb)(struct device *dev, |
765 | + void (*fw_cb)(struct device *dev, int err, |
766 | const struct firmware *fw, |
767 | void *nvram_image, u32 nvram_len)) |
768 | { |
769 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h |
770 | index d3c9f0d52ae3..8fa4b7e1ab3d 100644 |
771 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h |
772 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h |
773 | @@ -73,13 +73,13 @@ void brcmf_fw_nvram_free(void *nvram); |
774 | */ |
775 | int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags, |
776 | const char *code, const char *nvram, |
777 | - void (*fw_cb)(struct device *dev, |
778 | + void (*fw_cb)(struct device *dev, int err, |
779 | const struct firmware *fw, |
780 | void *nvram_image, u32 nvram_len), |
781 | u16 domain_nr, u16 bus_nr); |
782 | int brcmf_fw_get_firmwares(struct device *dev, u16 flags, |
783 | const char *code, const char *nvram, |
784 | - void (*fw_cb)(struct device *dev, |
785 | + void (*fw_cb)(struct device *dev, int err, |
786 | const struct firmware *fw, |
787 | void *nvram_image, u32 nvram_len)); |
788 | |
789 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c |
790 | index 3deba90c7eb5..d3d79219fbb0 100644 |
791 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c |
792 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c |
793 | @@ -1618,16 +1618,23 @@ static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = { |
794 | .write32 = brcmf_pcie_buscore_write32, |
795 | }; |
796 | |
797 | -static void brcmf_pcie_setup(struct device *dev, const struct firmware *fw, |
798 | +static void brcmf_pcie_setup(struct device *dev, int ret, |
799 | + const struct firmware *fw, |
800 | void *nvram, u32 nvram_len) |
801 | { |
802 | - struct brcmf_bus *bus = dev_get_drvdata(dev); |
803 | - struct brcmf_pciedev *pcie_bus_dev = bus->bus_priv.pcie; |
804 | - struct brcmf_pciedev_info *devinfo = pcie_bus_dev->devinfo; |
805 | + struct brcmf_bus *bus; |
806 | + struct brcmf_pciedev *pcie_bus_dev; |
807 | + struct brcmf_pciedev_info *devinfo; |
808 | struct brcmf_commonring **flowrings; |
809 | - int ret; |
810 | u32 i; |
811 | |
812 | + /* check firmware loading result */ |
813 | + if (ret) |
814 | + goto fail; |
815 | + |
816 | + bus = dev_get_drvdata(dev); |
817 | + pcie_bus_dev = bus->bus_priv.pcie; |
818 | + devinfo = pcie_bus_dev->devinfo; |
819 | brcmf_pcie_attach(devinfo); |
820 | |
821 | /* Some of the firmwares have the size of the memory of the device |
822 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
823 | index 2458e6e05276..8744b9beda33 100644 |
824 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
825 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
826 | @@ -3975,21 +3975,26 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = { |
827 | .get_memdump = brcmf_sdio_bus_get_memdump, |
828 | }; |
829 | |
830 | -static void brcmf_sdio_firmware_callback(struct device *dev, |
831 | +static void brcmf_sdio_firmware_callback(struct device *dev, int err, |
832 | const struct firmware *code, |
833 | void *nvram, u32 nvram_len) |
834 | { |
835 | - struct brcmf_bus *bus_if = dev_get_drvdata(dev); |
836 | - struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio; |
837 | - struct brcmf_sdio *bus = sdiodev->bus; |
838 | - int err = 0; |
839 | + struct brcmf_bus *bus_if; |
840 | + struct brcmf_sdio_dev *sdiodev; |
841 | + struct brcmf_sdio *bus; |
842 | u8 saveclk; |
843 | |
844 | - brcmf_dbg(TRACE, "Enter: dev=%s\n", dev_name(dev)); |
845 | + brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err); |
846 | + bus_if = dev_get_drvdata(dev); |
847 | + sdiodev = bus_if->bus_priv.sdio; |
848 | + if (err) |
849 | + goto fail; |
850 | |
851 | if (!bus_if->drvr) |
852 | return; |
853 | |
854 | + bus = sdiodev->bus; |
855 | + |
856 | /* try to download image and nvram to the dongle */ |
857 | bus->alp_only = true; |
858 | err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len); |
859 | @@ -4076,6 +4081,7 @@ static void brcmf_sdio_firmware_callback(struct device *dev, |
860 | fail: |
861 | brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err); |
862 | device_release_driver(dev); |
863 | + device_release_driver(&sdiodev->func[2]->dev); |
864 | } |
865 | |
866 | struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) |
867 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c |
868 | index 2f978a39b58a..053f3b59f21e 100644 |
869 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c |
870 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c |
871 | @@ -1158,17 +1158,18 @@ static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo) |
872 | return ret; |
873 | } |
874 | |
875 | -static void brcmf_usb_probe_phase2(struct device *dev, |
876 | +static void brcmf_usb_probe_phase2(struct device *dev, int ret, |
877 | const struct firmware *fw, |
878 | void *nvram, u32 nvlen) |
879 | { |
880 | struct brcmf_bus *bus = dev_get_drvdata(dev); |
881 | - struct brcmf_usbdev_info *devinfo; |
882 | - int ret; |
883 | + struct brcmf_usbdev_info *devinfo = bus->bus_priv.usb->devinfo; |
884 | + |
885 | + if (ret) |
886 | + goto error; |
887 | |
888 | brcmf_dbg(USB, "Start fw downloading\n"); |
889 | |
890 | - devinfo = bus->bus_priv.usb->devinfo; |
891 | ret = check_file(fw->data); |
892 | if (ret < 0) { |
893 | brcmf_err("invalid firmware\n"); |
894 | diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c |
895 | index b7273be9303d..c8d9075339cf 100644 |
896 | --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c |
897 | +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c |
898 | @@ -1422,21 +1422,6 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) |
899 | cancel_work_sync(&rt2x00dev->intf_work); |
900 | cancel_delayed_work_sync(&rt2x00dev->autowakeup_work); |
901 | cancel_work_sync(&rt2x00dev->sleep_work); |
902 | -#if IS_ENABLED(CONFIG_RT2X00_LIB_USB) |
903 | - if (rt2x00_is_usb(rt2x00dev)) { |
904 | - usb_kill_anchored_urbs(rt2x00dev->anchor); |
905 | - hrtimer_cancel(&rt2x00dev->txstatus_timer); |
906 | - cancel_work_sync(&rt2x00dev->rxdone_work); |
907 | - cancel_work_sync(&rt2x00dev->txdone_work); |
908 | - } |
909 | -#endif |
910 | - if (rt2x00dev->workqueue) |
911 | - destroy_workqueue(rt2x00dev->workqueue); |
912 | - |
913 | - /* |
914 | - * Free the tx status fifo. |
915 | - */ |
916 | - kfifo_free(&rt2x00dev->txstatus_fifo); |
917 | |
918 | /* |
919 | * Kill the tx status tasklet. |
920 | @@ -1452,6 +1437,14 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) |
921 | */ |
922 | rt2x00lib_uninitialize(rt2x00dev); |
923 | |
924 | + if (rt2x00dev->workqueue) |
925 | + destroy_workqueue(rt2x00dev->workqueue); |
926 | + |
927 | + /* |
928 | + * Free the tx status fifo. |
929 | + */ |
930 | + kfifo_free(&rt2x00dev->txstatus_fifo); |
931 | + |
932 | /* |
933 | * Free extra components |
934 | */ |
935 | diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c |
936 | index 662705e31136..631df690adbe 100644 |
937 | --- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c |
938 | +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c |
939 | @@ -740,6 +740,11 @@ void rt2x00usb_uninitialize(struct rt2x00_dev *rt2x00dev) |
940 | { |
941 | struct data_queue *queue; |
942 | |
943 | + usb_kill_anchored_urbs(rt2x00dev->anchor); |
944 | + hrtimer_cancel(&rt2x00dev->txstatus_timer); |
945 | + cancel_work_sync(&rt2x00dev->rxdone_work); |
946 | + cancel_work_sync(&rt2x00dev->txdone_work); |
947 | + |
948 | queue_for_each(rt2x00dev, queue) |
949 | rt2x00usb_free_entries(queue); |
950 | } |
951 | diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c |
952 | index 6a43fd3d0576..502f5547a1f2 100644 |
953 | --- a/drivers/of/fdt.c |
954 | +++ b/drivers/of/fdt.c |
955 | @@ -741,9 +741,12 @@ int __init of_scan_flat_dt(int (*it)(unsigned long node, |
956 | const char *pathp; |
957 | int offset, rc = 0, depth = -1; |
958 | |
959 | - for (offset = fdt_next_node(blob, -1, &depth); |
960 | - offset >= 0 && depth >= 0 && !rc; |
961 | - offset = fdt_next_node(blob, offset, &depth)) { |
962 | + if (!blob) |
963 | + return 0; |
964 | + |
965 | + for (offset = fdt_next_node(blob, -1, &depth); |
966 | + offset >= 0 && depth >= 0 && !rc; |
967 | + offset = fdt_next_node(blob, offset, &depth)) { |
968 | |
969 | pathp = fdt_get_name(blob, offset, NULL); |
970 | if (*pathp == '/') |
971 | diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c |
972 | index 838783c3fed0..24d4492d0168 100644 |
973 | --- a/drivers/spi/spi.c |
974 | +++ b/drivers/spi/spi.c |
975 | @@ -1004,7 +1004,7 @@ static int spi_transfer_one_message(struct spi_master *master, |
976 | ret = 0; |
977 | ms = 8LL * 1000LL * xfer->len; |
978 | do_div(ms, xfer->speed_hz); |
979 | - ms += ms + 100; /* some tolerance */ |
980 | + ms += ms + 200; /* some tolerance */ |
981 | |
982 | if (ms > UINT_MAX) |
983 | ms = UINT_MAX; |
984 | diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c |
985 | index 01ea228358ea..155fe0e0623f 100644 |
986 | --- a/drivers/target/iscsi/iscsi_target.c |
987 | +++ b/drivers/target/iscsi/iscsi_target.c |
988 | @@ -1287,6 +1287,18 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr, |
989 | */ |
990 | if (dump_payload) |
991 | goto after_immediate_data; |
992 | + /* |
993 | + * Check for underflow case where both EDTL and immediate data payload |
994 | + * exceeds what is presented by CDB's TRANSFER LENGTH, and what has |
995 | + * already been set in target_cmd_size_check() as se_cmd->data_length. |
996 | + * |
997 | + * For this special case, fail the command and dump the immediate data |
998 | + * payload. |
999 | + */ |
1000 | + if (cmd->first_burst_len > cmd->se_cmd.data_length) { |
1001 | + cmd->sense_reason = TCM_INVALID_CDB_FIELD; |
1002 | + goto after_immediate_data; |
1003 | + } |
1004 | |
1005 | immed_ret = iscsit_handle_immediate_data(cmd, hdr, |
1006 | cmd->first_burst_len); |
1007 | @@ -4431,8 +4443,11 @@ static void iscsit_logout_post_handler_closesession( |
1008 | * always sleep waiting for RX/TX thread shutdown to complete |
1009 | * within iscsit_close_connection(). |
1010 | */ |
1011 | - if (!conn->conn_transport->rdma_shutdown) |
1012 | + if (!conn->conn_transport->rdma_shutdown) { |
1013 | sleep = cmpxchg(&conn->tx_thread_active, true, false); |
1014 | + if (!sleep) |
1015 | + return; |
1016 | + } |
1017 | |
1018 | atomic_set(&conn->conn_logout_remove, 0); |
1019 | complete(&conn->conn_logout_comp); |
1020 | @@ -4448,8 +4463,11 @@ static void iscsit_logout_post_handler_samecid( |
1021 | { |
1022 | int sleep = 1; |
1023 | |
1024 | - if (!conn->conn_transport->rdma_shutdown) |
1025 | + if (!conn->conn_transport->rdma_shutdown) { |
1026 | sleep = cmpxchg(&conn->tx_thread_active, true, false); |
1027 | + if (!sleep) |
1028 | + return; |
1029 | + } |
1030 | |
1031 | atomic_set(&conn->conn_logout_remove, 0); |
1032 | complete(&conn->conn_logout_comp); |
1033 | diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h |
1034 | index e2c970a9d61c..be52838cc1a8 100644 |
1035 | --- a/drivers/target/target_core_internal.h |
1036 | +++ b/drivers/target/target_core_internal.h |
1037 | @@ -131,7 +131,7 @@ int init_se_kmem_caches(void); |
1038 | void release_se_kmem_caches(void); |
1039 | u32 scsi_get_new_index(scsi_index_t); |
1040 | void transport_subsystem_check_init(void); |
1041 | -void transport_cmd_finish_abort(struct se_cmd *, int); |
1042 | +int transport_cmd_finish_abort(struct se_cmd *, int); |
1043 | unsigned char *transport_dump_cmd_direction(struct se_cmd *); |
1044 | void transport_dump_dev_state(struct se_device *, char *, int *); |
1045 | void transport_dump_dev_info(struct se_device *, struct se_lun *, |
1046 | diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c |
1047 | index 4f229e711e1c..27dd1e12f246 100644 |
1048 | --- a/drivers/target/target_core_tmr.c |
1049 | +++ b/drivers/target/target_core_tmr.c |
1050 | @@ -75,7 +75,7 @@ void core_tmr_release_req(struct se_tmr_req *tmr) |
1051 | kfree(tmr); |
1052 | } |
1053 | |
1054 | -static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) |
1055 | +static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) |
1056 | { |
1057 | unsigned long flags; |
1058 | bool remove = true, send_tas; |
1059 | @@ -91,7 +91,7 @@ static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) |
1060 | transport_send_task_abort(cmd); |
1061 | } |
1062 | |
1063 | - transport_cmd_finish_abort(cmd, remove); |
1064 | + return transport_cmd_finish_abort(cmd, remove); |
1065 | } |
1066 | |
1067 | static int target_check_cdb_and_preempt(struct list_head *list, |
1068 | @@ -185,8 +185,8 @@ void core_tmr_abort_task( |
1069 | cancel_work_sync(&se_cmd->work); |
1070 | transport_wait_for_tasks(se_cmd); |
1071 | |
1072 | - transport_cmd_finish_abort(se_cmd, true); |
1073 | - target_put_sess_cmd(se_cmd); |
1074 | + if (!transport_cmd_finish_abort(se_cmd, true)) |
1075 | + target_put_sess_cmd(se_cmd); |
1076 | |
1077 | printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for" |
1078 | " ref_tag: %llu\n", ref_tag); |
1079 | @@ -286,8 +286,8 @@ static void core_tmr_drain_tmr_list( |
1080 | cancel_work_sync(&cmd->work); |
1081 | transport_wait_for_tasks(cmd); |
1082 | |
1083 | - transport_cmd_finish_abort(cmd, 1); |
1084 | - target_put_sess_cmd(cmd); |
1085 | + if (!transport_cmd_finish_abort(cmd, 1)) |
1086 | + target_put_sess_cmd(cmd); |
1087 | } |
1088 | } |
1089 | |
1090 | @@ -385,8 +385,8 @@ static void core_tmr_drain_state_list( |
1091 | cancel_work_sync(&cmd->work); |
1092 | transport_wait_for_tasks(cmd); |
1093 | |
1094 | - core_tmr_handle_tas_abort(cmd, tas); |
1095 | - target_put_sess_cmd(cmd); |
1096 | + if (!core_tmr_handle_tas_abort(cmd, tas)) |
1097 | + target_put_sess_cmd(cmd); |
1098 | } |
1099 | } |
1100 | |
1101 | diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c |
1102 | index 077344cc819f..1f9bfa4195ea 100644 |
1103 | --- a/drivers/target/target_core_transport.c |
1104 | +++ b/drivers/target/target_core_transport.c |
1105 | @@ -673,9 +673,10 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd) |
1106 | percpu_ref_put(&lun->lun_ref); |
1107 | } |
1108 | |
1109 | -void transport_cmd_finish_abort(struct se_cmd *cmd, int remove) |
1110 | +int transport_cmd_finish_abort(struct se_cmd *cmd, int remove) |
1111 | { |
1112 | bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF); |
1113 | + int ret = 0; |
1114 | |
1115 | if (cmd->se_cmd_flags & SCF_SE_LUN_CMD) |
1116 | transport_lun_remove_cmd(cmd); |
1117 | @@ -687,9 +688,11 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove) |
1118 | cmd->se_tfo->aborted_task(cmd); |
1119 | |
1120 | if (transport_cmd_check_stop_to_fabric(cmd)) |
1121 | - return; |
1122 | + return 1; |
1123 | if (remove && ack_kref) |
1124 | - transport_put_cmd(cmd); |
1125 | + ret = transport_put_cmd(cmd); |
1126 | + |
1127 | + return ret; |
1128 | } |
1129 | |
1130 | static void target_complete_failure_work(struct work_struct *work) |
1131 | diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c |
1132 | index 89081b834615..04ffd7640c33 100644 |
1133 | --- a/drivers/usb/gadget/function/f_fs.c |
1134 | +++ b/drivers/usb/gadget/function/f_fs.c |
1135 | @@ -1858,12 +1858,12 @@ static int ffs_func_eps_enable(struct ffs_function *func) |
1136 | ep->ep->driver_data = ep; |
1137 | ep->ep->desc = ds; |
1138 | |
1139 | - comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + |
1140 | - USB_DT_ENDPOINT_SIZE); |
1141 | - ep->ep->maxburst = comp_desc->bMaxBurst + 1; |
1142 | - |
1143 | - if (needs_comp_desc) |
1144 | + if (needs_comp_desc) { |
1145 | + comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + |
1146 | + USB_DT_ENDPOINT_SIZE); |
1147 | + ep->ep->maxburst = comp_desc->bMaxBurst + 1; |
1148 | ep->ep->comp_desc = comp_desc; |
1149 | + } |
1150 | |
1151 | ret = usb_ep_enable(ep->ep); |
1152 | if (likely(!ret)) { |
1153 | diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c |
1154 | index fc09eb77ddf3..ffc69dd28928 100644 |
1155 | --- a/fs/autofs4/dev-ioctl.c |
1156 | +++ b/fs/autofs4/dev-ioctl.c |
1157 | @@ -345,7 +345,7 @@ static int autofs_dev_ioctl_fail(struct file *fp, |
1158 | int status; |
1159 | |
1160 | token = (autofs_wqt_t) param->fail.token; |
1161 | - status = param->fail.status ? param->fail.status : -ENOENT; |
1162 | + status = param->fail.status < 0 ? param->fail.status : -ENOENT; |
1163 | return autofs4_wait_release(sbi, token, status); |
1164 | } |
1165 | |
1166 | diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c |
1167 | index 87b87e091e8e..efd72e1fae74 100644 |
1168 | --- a/fs/cifs/smb1ops.c |
1169 | +++ b/fs/cifs/smb1ops.c |
1170 | @@ -849,8 +849,13 @@ cifs_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, |
1171 | struct cifs_fid *fid, __u16 search_flags, |
1172 | struct cifs_search_info *srch_inf) |
1173 | { |
1174 | - return CIFSFindFirst(xid, tcon, path, cifs_sb, |
1175 | - &fid->netfid, search_flags, srch_inf, true); |
1176 | + int rc; |
1177 | + |
1178 | + rc = CIFSFindFirst(xid, tcon, path, cifs_sb, |
1179 | + &fid->netfid, search_flags, srch_inf, true); |
1180 | + if (rc) |
1181 | + cifs_dbg(FYI, "find first failed=%d\n", rc); |
1182 | + return rc; |
1183 | } |
1184 | |
1185 | static int |
1186 | diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c |
1187 | index 36334fe3266c..b6968241c26f 100644 |
1188 | --- a/fs/cifs/smb2ops.c |
1189 | +++ b/fs/cifs/smb2ops.c |
1190 | @@ -964,7 +964,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, |
1191 | rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL); |
1192 | kfree(utf16_path); |
1193 | if (rc) { |
1194 | - cifs_dbg(VFS, "open dir failed\n"); |
1195 | + cifs_dbg(FYI, "open dir failed rc=%d\n", rc); |
1196 | return rc; |
1197 | } |
1198 | |
1199 | @@ -974,7 +974,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, |
1200 | rc = SMB2_query_directory(xid, tcon, fid->persistent_fid, |
1201 | fid->volatile_fid, 0, srch_inf); |
1202 | if (rc) { |
1203 | - cifs_dbg(VFS, "query directory failed\n"); |
1204 | + cifs_dbg(FYI, "query directory failed rc=%d\n", rc); |
1205 | SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid); |
1206 | } |
1207 | return rc; |
1208 | diff --git a/fs/exec.c b/fs/exec.c |
1209 | index 67e86571685a..91441402d706 100644 |
1210 | --- a/fs/exec.c |
1211 | +++ b/fs/exec.c |
1212 | @@ -215,8 +215,26 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, |
1213 | |
1214 | if (write) { |
1215 | unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start; |
1216 | + unsigned long ptr_size; |
1217 | struct rlimit *rlim; |
1218 | |
1219 | + /* |
1220 | + * Since the stack will hold pointers to the strings, we |
1221 | + * must account for them as well. |
1222 | + * |
1223 | + * The size calculation is the entire vma while each arg page is |
1224 | + * built, so each time we get here it's calculating how far it |
1225 | + * is currently (rather than each call being just the newly |
1226 | + * added size from the arg page). As a result, we need to |
1227 | + * always add the entire size of the pointers, so that on the |
1228 | + * last call to get_arg_page() we'll actually have the entire |
1229 | + * correct size. |
1230 | + */ |
1231 | + ptr_size = (bprm->argc + bprm->envc) * sizeof(void *); |
1232 | + if (ptr_size > ULONG_MAX - size) |
1233 | + goto fail; |
1234 | + size += ptr_size; |
1235 | + |
1236 | acct_arg_size(bprm, size / PAGE_SIZE); |
1237 | |
1238 | /* |
1239 | @@ -234,13 +252,15 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, |
1240 | * to work from. |
1241 | */ |
1242 | rlim = current->signal->rlim; |
1243 | - if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) { |
1244 | - put_page(page); |
1245 | - return NULL; |
1246 | - } |
1247 | + if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) |
1248 | + goto fail; |
1249 | } |
1250 | |
1251 | return page; |
1252 | + |
1253 | +fail: |
1254 | + put_page(page); |
1255 | + return NULL; |
1256 | } |
1257 | |
1258 | static void put_arg_page(struct page *page) |
1259 | diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h |
1260 | index e88005459035..2c225d46a428 100644 |
1261 | --- a/include/linux/timekeeper_internal.h |
1262 | +++ b/include/linux/timekeeper_internal.h |
1263 | @@ -29,7 +29,6 @@ |
1264 | */ |
1265 | struct tk_read_base { |
1266 | struct clocksource *clock; |
1267 | - cycle_t (*read)(struct clocksource *cs); |
1268 | cycle_t mask; |
1269 | cycle_t cycle_last; |
1270 | u32 mult; |
1271 | @@ -58,7 +57,7 @@ struct tk_read_base { |
1272 | * interval. |
1273 | * @xtime_remainder: Shifted nano seconds left over when rounding |
1274 | * @cycle_interval |
1275 | - * @raw_interval: Raw nano seconds accumulated per NTP interval. |
1276 | + * @raw_interval: Shifted raw nano seconds accumulated per NTP interval. |
1277 | * @ntp_error: Difference between accumulated time and NTP time in ntp |
1278 | * shifted nano seconds. |
1279 | * @ntp_error_shift: Shift conversion between clock shifted nano seconds and |
1280 | @@ -100,7 +99,7 @@ struct timekeeper { |
1281 | cycle_t cycle_interval; |
1282 | u64 xtime_interval; |
1283 | s64 xtime_remainder; |
1284 | - u32 raw_interval; |
1285 | + u64 raw_interval; |
1286 | /* The ntp_tick_length() value currently being used. |
1287 | * This cached copy ensures we consistently apply the tick |
1288 | * length for an entire tick, as ntp_tick_length may change |
1289 | diff --git a/kernel/signal.c b/kernel/signal.c |
1290 | index 0b1415720a15..deb04d5983ed 100644 |
1291 | --- a/kernel/signal.c |
1292 | +++ b/kernel/signal.c |
1293 | @@ -503,7 +503,8 @@ int unhandled_signal(struct task_struct *tsk, int sig) |
1294 | return !tsk->ptrace; |
1295 | } |
1296 | |
1297 | -static void collect_signal(int sig, struct sigpending *list, siginfo_t *info) |
1298 | +static void collect_signal(int sig, struct sigpending *list, siginfo_t *info, |
1299 | + bool *resched_timer) |
1300 | { |
1301 | struct sigqueue *q, *first = NULL; |
1302 | |
1303 | @@ -525,6 +526,12 @@ static void collect_signal(int sig, struct sigpending *list, siginfo_t *info) |
1304 | still_pending: |
1305 | list_del_init(&first->list); |
1306 | copy_siginfo(info, &first->info); |
1307 | + |
1308 | + *resched_timer = |
1309 | + (first->flags & SIGQUEUE_PREALLOC) && |
1310 | + (info->si_code == SI_TIMER) && |
1311 | + (info->si_sys_private); |
1312 | + |
1313 | __sigqueue_free(first); |
1314 | } else { |
1315 | /* |
1316 | @@ -541,12 +548,12 @@ static void collect_signal(int sig, struct sigpending *list, siginfo_t *info) |
1317 | } |
1318 | |
1319 | static int __dequeue_signal(struct sigpending *pending, sigset_t *mask, |
1320 | - siginfo_t *info) |
1321 | + siginfo_t *info, bool *resched_timer) |
1322 | { |
1323 | int sig = next_signal(pending, mask); |
1324 | |
1325 | if (sig) |
1326 | - collect_signal(sig, pending, info); |
1327 | + collect_signal(sig, pending, info, resched_timer); |
1328 | return sig; |
1329 | } |
1330 | |
1331 | @@ -558,15 +565,16 @@ static int __dequeue_signal(struct sigpending *pending, sigset_t *mask, |
1332 | */ |
1333 | int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info) |
1334 | { |
1335 | + bool resched_timer = false; |
1336 | int signr; |
1337 | |
1338 | /* We only dequeue private signals from ourselves, we don't let |
1339 | * signalfd steal them |
1340 | */ |
1341 | - signr = __dequeue_signal(&tsk->pending, mask, info); |
1342 | + signr = __dequeue_signal(&tsk->pending, mask, info, &resched_timer); |
1343 | if (!signr) { |
1344 | signr = __dequeue_signal(&tsk->signal->shared_pending, |
1345 | - mask, info); |
1346 | + mask, info, &resched_timer); |
1347 | /* |
1348 | * itimer signal ? |
1349 | * |
1350 | @@ -611,7 +619,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info) |
1351 | */ |
1352 | current->jobctl |= JOBCTL_STOP_DEQUEUED; |
1353 | } |
1354 | - if ((info->si_code & __SI_MASK) == __SI_TIMER && info->si_sys_private) { |
1355 | + if (resched_timer) { |
1356 | /* |
1357 | * Release the siglock to ensure proper locking order |
1358 | * of timer locks outside of siglocks. Note, we leave |
1359 | diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c |
1360 | index 46e312e9be38..d831827d7ab0 100644 |
1361 | --- a/kernel/time/timekeeping.c |
1362 | +++ b/kernel/time/timekeeping.c |
1363 | @@ -116,6 +116,26 @@ static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta) |
1364 | tk->offs_boot = ktime_add(tk->offs_boot, delta); |
1365 | } |
1366 | |
1367 | +/* |
1368 | + * tk_clock_read - atomic clocksource read() helper |
1369 | + * |
1370 | + * This helper is necessary to use in the read paths because, while the |
1371 | + * seqlock ensures we don't return a bad value while structures are updated, |
1372 | + * it doesn't protect from potential crashes. There is the possibility that |
1373 | + * the tkr's clocksource may change between the read reference, and the |
1374 | + * clock reference passed to the read function. This can cause crashes if |
1375 | + * the wrong clocksource is passed to the wrong read function. |
1376 | + * This isn't necessary to use when holding the timekeeper_lock or doing |
1377 | + * a read of the fast-timekeeper tkrs (which is protected by its own locking |
1378 | + * and update logic). |
1379 | + */ |
1380 | +static inline u64 tk_clock_read(struct tk_read_base *tkr) |
1381 | +{ |
1382 | + struct clocksource *clock = READ_ONCE(tkr->clock); |
1383 | + |
1384 | + return clock->read(clock); |
1385 | +} |
1386 | + |
1387 | #ifdef CONFIG_DEBUG_TIMEKEEPING |
1388 | #define WARNING_FREQ (HZ*300) /* 5 minute rate-limiting */ |
1389 | |
1390 | @@ -173,7 +193,7 @@ static inline cycle_t timekeeping_get_delta(struct tk_read_base *tkr) |
1391 | */ |
1392 | do { |
1393 | seq = read_seqcount_begin(&tk_core.seq); |
1394 | - now = tkr->read(tkr->clock); |
1395 | + now = tk_clock_read(tkr); |
1396 | last = tkr->cycle_last; |
1397 | mask = tkr->mask; |
1398 | max = tkr->clock->max_cycles; |
1399 | @@ -207,7 +227,7 @@ static inline cycle_t timekeeping_get_delta(struct tk_read_base *tkr) |
1400 | cycle_t cycle_now, delta; |
1401 | |
1402 | /* read clocksource */ |
1403 | - cycle_now = tkr->read(tkr->clock); |
1404 | + cycle_now = tk_clock_read(tkr); |
1405 | |
1406 | /* calculate the delta since the last update_wall_time */ |
1407 | delta = clocksource_delta(cycle_now, tkr->cycle_last, tkr->mask); |
1408 | @@ -236,12 +256,10 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock) |
1409 | ++tk->cs_was_changed_seq; |
1410 | old_clock = tk->tkr_mono.clock; |
1411 | tk->tkr_mono.clock = clock; |
1412 | - tk->tkr_mono.read = clock->read; |
1413 | tk->tkr_mono.mask = clock->mask; |
1414 | - tk->tkr_mono.cycle_last = tk->tkr_mono.read(clock); |
1415 | + tk->tkr_mono.cycle_last = tk_clock_read(&tk->tkr_mono); |
1416 | |
1417 | tk->tkr_raw.clock = clock; |
1418 | - tk->tkr_raw.read = clock->read; |
1419 | tk->tkr_raw.mask = clock->mask; |
1420 | tk->tkr_raw.cycle_last = tk->tkr_mono.cycle_last; |
1421 | |
1422 | @@ -260,8 +278,7 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock) |
1423 | /* Go back from cycles -> shifted ns */ |
1424 | tk->xtime_interval = (u64) interval * clock->mult; |
1425 | tk->xtime_remainder = ntpinterval - tk->xtime_interval; |
1426 | - tk->raw_interval = |
1427 | - ((u64) interval * clock->mult) >> clock->shift; |
1428 | + tk->raw_interval = interval * clock->mult; |
1429 | |
1430 | /* if changing clocks, convert xtime_nsec shift units */ |
1431 | if (old_clock) { |
1432 | @@ -405,7 +422,7 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) |
1433 | |
1434 | now += timekeeping_delta_to_ns(tkr, |
1435 | clocksource_delta( |
1436 | - tkr->read(tkr->clock), |
1437 | + tk_clock_read(tkr), |
1438 | tkr->cycle_last, |
1439 | tkr->mask)); |
1440 | } while (read_seqcount_retry(&tkf->seq, seq)); |
1441 | @@ -433,6 +450,10 @@ static cycle_t dummy_clock_read(struct clocksource *cs) |
1442 | return cycles_at_suspend; |
1443 | } |
1444 | |
1445 | +static struct clocksource dummy_clock = { |
1446 | + .read = dummy_clock_read, |
1447 | +}; |
1448 | + |
1449 | /** |
1450 | * halt_fast_timekeeper - Prevent fast timekeeper from accessing clocksource. |
1451 | * @tk: Timekeeper to snapshot. |
1452 | @@ -449,13 +470,13 @@ static void halt_fast_timekeeper(struct timekeeper *tk) |
1453 | struct tk_read_base *tkr = &tk->tkr_mono; |
1454 | |
1455 | memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy)); |
1456 | - cycles_at_suspend = tkr->read(tkr->clock); |
1457 | - tkr_dummy.read = dummy_clock_read; |
1458 | + cycles_at_suspend = tk_clock_read(tkr); |
1459 | + tkr_dummy.clock = &dummy_clock; |
1460 | update_fast_timekeeper(&tkr_dummy, &tk_fast_mono); |
1461 | |
1462 | tkr = &tk->tkr_raw; |
1463 | memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy)); |
1464 | - tkr_dummy.read = dummy_clock_read; |
1465 | + tkr_dummy.clock = &dummy_clock; |
1466 | update_fast_timekeeper(&tkr_dummy, &tk_fast_raw); |
1467 | } |
1468 | |
1469 | @@ -621,11 +642,10 @@ static void timekeeping_update(struct timekeeper *tk, unsigned int action) |
1470 | */ |
1471 | static void timekeeping_forward_now(struct timekeeper *tk) |
1472 | { |
1473 | - struct clocksource *clock = tk->tkr_mono.clock; |
1474 | cycle_t cycle_now, delta; |
1475 | s64 nsec; |
1476 | |
1477 | - cycle_now = tk->tkr_mono.read(clock); |
1478 | + cycle_now = tk_clock_read(&tk->tkr_mono); |
1479 | delta = clocksource_delta(cycle_now, tk->tkr_mono.cycle_last, tk->tkr_mono.mask); |
1480 | tk->tkr_mono.cycle_last = cycle_now; |
1481 | tk->tkr_raw.cycle_last = cycle_now; |
1482 | @@ -901,8 +921,7 @@ void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot) |
1483 | |
1484 | do { |
1485 | seq = read_seqcount_begin(&tk_core.seq); |
1486 | - |
1487 | - now = tk->tkr_mono.read(tk->tkr_mono.clock); |
1488 | + now = tk_clock_read(&tk->tkr_mono); |
1489 | systime_snapshot->cs_was_changed_seq = tk->cs_was_changed_seq; |
1490 | systime_snapshot->clock_was_set_seq = tk->clock_was_set_seq; |
1491 | base_real = ktime_add(tk->tkr_mono.base, |
1492 | @@ -1081,7 +1100,7 @@ int get_device_system_crosststamp(int (*get_time_fn) |
1493 | * Check whether the system counter value provided by the |
1494 | * device driver is on the current timekeeping interval. |
1495 | */ |
1496 | - now = tk->tkr_mono.read(tk->tkr_mono.clock); |
1497 | + now = tk_clock_read(&tk->tkr_mono); |
1498 | interval_start = tk->tkr_mono.cycle_last; |
1499 | if (!cycle_between(interval_start, cycles, now)) { |
1500 | clock_was_set_seq = tk->clock_was_set_seq; |
1501 | @@ -1639,7 +1658,7 @@ void timekeeping_resume(void) |
1502 | * The less preferred source will only be tried if there is no better |
1503 | * usable source. The rtc part is handled separately in rtc core code. |
1504 | */ |
1505 | - cycle_now = tk->tkr_mono.read(clock); |
1506 | + cycle_now = tk_clock_read(&tk->tkr_mono); |
1507 | if ((clock->flags & CLOCK_SOURCE_SUSPEND_NONSTOP) && |
1508 | cycle_now > tk->tkr_mono.cycle_last) { |
1509 | u64 num, max = ULLONG_MAX; |
1510 | @@ -2003,7 +2022,7 @@ static cycle_t logarithmic_accumulation(struct timekeeper *tk, cycle_t offset, |
1511 | unsigned int *clock_set) |
1512 | { |
1513 | cycle_t interval = tk->cycle_interval << shift; |
1514 | - u64 raw_nsecs; |
1515 | + u64 snsec_per_sec; |
1516 | |
1517 | /* If the offset is smaller than a shifted interval, do nothing */ |
1518 | if (offset < interval) |
1519 | @@ -2018,14 +2037,15 @@ static cycle_t logarithmic_accumulation(struct timekeeper *tk, cycle_t offset, |
1520 | *clock_set |= accumulate_nsecs_to_secs(tk); |
1521 | |
1522 | /* Accumulate raw time */ |
1523 | - raw_nsecs = (u64)tk->raw_interval << shift; |
1524 | - raw_nsecs += tk->raw_time.tv_nsec; |
1525 | - if (raw_nsecs >= NSEC_PER_SEC) { |
1526 | - u64 raw_secs = raw_nsecs; |
1527 | - raw_nsecs = do_div(raw_secs, NSEC_PER_SEC); |
1528 | - tk->raw_time.tv_sec += raw_secs; |
1529 | + tk->tkr_raw.xtime_nsec += (u64)tk->raw_time.tv_nsec << tk->tkr_raw.shift; |
1530 | + tk->tkr_raw.xtime_nsec += tk->raw_interval << shift; |
1531 | + snsec_per_sec = (u64)NSEC_PER_SEC << tk->tkr_raw.shift; |
1532 | + while (tk->tkr_raw.xtime_nsec >= snsec_per_sec) { |
1533 | + tk->tkr_raw.xtime_nsec -= snsec_per_sec; |
1534 | + tk->raw_time.tv_sec++; |
1535 | } |
1536 | - tk->raw_time.tv_nsec = raw_nsecs; |
1537 | + tk->raw_time.tv_nsec = tk->tkr_raw.xtime_nsec >> tk->tkr_raw.shift; |
1538 | + tk->tkr_raw.xtime_nsec -= (u64)tk->raw_time.tv_nsec << tk->tkr_raw.shift; |
1539 | |
1540 | /* Accumulate error between NTP and clock interval */ |
1541 | tk->ntp_error += tk->ntp_tick << shift; |
1542 | @@ -2057,7 +2077,7 @@ void update_wall_time(void) |
1543 | #ifdef CONFIG_ARCH_USES_GETTIMEOFFSET |
1544 | offset = real_tk->cycle_interval; |
1545 | #else |
1546 | - offset = clocksource_delta(tk->tkr_mono.read(tk->tkr_mono.clock), |
1547 | + offset = clocksource_delta(tk_clock_read(&tk->tkr_mono), |
1548 | tk->tkr_mono.cycle_last, tk->tkr_mono.mask); |
1549 | #endif |
1550 | |
1551 | diff --git a/lib/cmdline.c b/lib/cmdline.c |
1552 | index 8f13cf73c2ec..79069d7938ea 100644 |
1553 | --- a/lib/cmdline.c |
1554 | +++ b/lib/cmdline.c |
1555 | @@ -22,14 +22,14 @@ |
1556 | * the values[M, M+1, ..., N] into the ints array in get_options. |
1557 | */ |
1558 | |
1559 | -static int get_range(char **str, int *pint) |
1560 | +static int get_range(char **str, int *pint, int n) |
1561 | { |
1562 | int x, inc_counter, upper_range; |
1563 | |
1564 | (*str)++; |
1565 | upper_range = simple_strtol((*str), NULL, 0); |
1566 | inc_counter = upper_range - *pint; |
1567 | - for (x = *pint; x < upper_range; x++) |
1568 | + for (x = *pint; n && x < upper_range; x++, n--) |
1569 | *pint++ = x; |
1570 | return inc_counter; |
1571 | } |
1572 | @@ -96,7 +96,7 @@ char *get_options(const char *str, int nints, int *ints) |
1573 | break; |
1574 | if (res == 3) { |
1575 | int range_nums; |
1576 | - range_nums = get_range((char **)&str, ints + i); |
1577 | + range_nums = get_range((char **)&str, ints + i, nints - i); |
1578 | if (range_nums < 0) |
1579 | break; |
1580 | /* |
1581 | diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c |
1582 | index 18c737a61d80..7fc340726d03 100644 |
1583 | --- a/net/rxrpc/key.c |
1584 | +++ b/net/rxrpc/key.c |
1585 | @@ -217,7 +217,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, |
1586 | unsigned int *_toklen) |
1587 | { |
1588 | const __be32 *xdr = *_xdr; |
1589 | - unsigned int toklen = *_toklen, n_parts, loop, tmp; |
1590 | + unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen; |
1591 | |
1592 | /* there must be at least one name, and at least #names+1 length |
1593 | * words */ |
1594 | @@ -247,16 +247,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, |
1595 | toklen -= 4; |
1596 | if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX) |
1597 | return -EINVAL; |
1598 | - if (tmp > toklen) |
1599 | + paddedlen = (tmp + 3) & ~3; |
1600 | + if (paddedlen > toklen) |
1601 | return -EINVAL; |
1602 | princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL); |
1603 | if (!princ->name_parts[loop]) |
1604 | return -ENOMEM; |
1605 | memcpy(princ->name_parts[loop], xdr, tmp); |
1606 | princ->name_parts[loop][tmp] = 0; |
1607 | - tmp = (tmp + 3) & ~3; |
1608 | - toklen -= tmp; |
1609 | - xdr += tmp >> 2; |
1610 | + toklen -= paddedlen; |
1611 | + xdr += paddedlen >> 2; |
1612 | } |
1613 | |
1614 | if (toklen < 4) |
1615 | @@ -265,16 +265,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, |
1616 | toklen -= 4; |
1617 | if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX) |
1618 | return -EINVAL; |
1619 | - if (tmp > toklen) |
1620 | + paddedlen = (tmp + 3) & ~3; |
1621 | + if (paddedlen > toklen) |
1622 | return -EINVAL; |
1623 | princ->realm = kmalloc(tmp + 1, GFP_KERNEL); |
1624 | if (!princ->realm) |
1625 | return -ENOMEM; |
1626 | memcpy(princ->realm, xdr, tmp); |
1627 | princ->realm[tmp] = 0; |
1628 | - tmp = (tmp + 3) & ~3; |
1629 | - toklen -= tmp; |
1630 | - xdr += tmp >> 2; |
1631 | + toklen -= paddedlen; |
1632 | + xdr += paddedlen >> 2; |
1633 | |
1634 | _debug("%s/...@%s", princ->name_parts[0], princ->realm); |
1635 | |
1636 | @@ -293,7 +293,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td, |
1637 | unsigned int *_toklen) |
1638 | { |
1639 | const __be32 *xdr = *_xdr; |
1640 | - unsigned int toklen = *_toklen, len; |
1641 | + unsigned int toklen = *_toklen, len, paddedlen; |
1642 | |
1643 | /* there must be at least one tag and one length word */ |
1644 | if (toklen <= 8) |
1645 | @@ -307,15 +307,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td, |
1646 | toklen -= 8; |
1647 | if (len > max_data_size) |
1648 | return -EINVAL; |
1649 | + paddedlen = (len + 3) & ~3; |
1650 | + if (paddedlen > toklen) |
1651 | + return -EINVAL; |
1652 | td->data_len = len; |
1653 | |
1654 | if (len > 0) { |
1655 | td->data = kmemdup(xdr, len, GFP_KERNEL); |
1656 | if (!td->data) |
1657 | return -ENOMEM; |
1658 | - len = (len + 3) & ~3; |
1659 | - toklen -= len; |
1660 | - xdr += len >> 2; |
1661 | + toklen -= paddedlen; |
1662 | + xdr += paddedlen >> 2; |
1663 | } |
1664 | |
1665 | _debug("tag %x len %x", td->tag, td->data_len); |
1666 | @@ -387,7 +389,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, |
1667 | const __be32 **_xdr, unsigned int *_toklen) |
1668 | { |
1669 | const __be32 *xdr = *_xdr; |
1670 | - unsigned int toklen = *_toklen, len; |
1671 | + unsigned int toklen = *_toklen, len, paddedlen; |
1672 | |
1673 | /* there must be at least one length word */ |
1674 | if (toklen <= 4) |
1675 | @@ -399,6 +401,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, |
1676 | toklen -= 4; |
1677 | if (len > AFSTOKEN_K5_TIX_MAX) |
1678 | return -EINVAL; |
1679 | + paddedlen = (len + 3) & ~3; |
1680 | + if (paddedlen > toklen) |
1681 | + return -EINVAL; |
1682 | *_tktlen = len; |
1683 | |
1684 | _debug("ticket len %u", len); |
1685 | @@ -407,9 +412,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, |
1686 | *_ticket = kmemdup(xdr, len, GFP_KERNEL); |
1687 | if (!*_ticket) |
1688 | return -ENOMEM; |
1689 | - len = (len + 3) & ~3; |
1690 | - toklen -= len; |
1691 | - xdr += len >> 2; |
1692 | + toklen -= paddedlen; |
1693 | + xdr += paddedlen >> 2; |
1694 | } |
1695 | |
1696 | *_xdr = xdr; |
1697 | @@ -552,7 +556,7 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) |
1698 | { |
1699 | const __be32 *xdr = prep->data, *token; |
1700 | const char *cp; |
1701 | - unsigned int len, tmp, loop, ntoken, toklen, sec_ix; |
1702 | + unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix; |
1703 | size_t datalen = prep->datalen; |
1704 | int ret; |
1705 | |
1706 | @@ -578,22 +582,21 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) |
1707 | if (len < 1 || len > AFSTOKEN_CELL_MAX) |
1708 | goto not_xdr; |
1709 | datalen -= 4; |
1710 | - tmp = (len + 3) & ~3; |
1711 | - if (tmp > datalen) |
1712 | + paddedlen = (len + 3) & ~3; |
1713 | + if (paddedlen > datalen) |
1714 | goto not_xdr; |
1715 | |
1716 | cp = (const char *) xdr; |
1717 | for (loop = 0; loop < len; loop++) |
1718 | if (!isprint(cp[loop])) |
1719 | goto not_xdr; |
1720 | - if (len < tmp) |
1721 | - for (; loop < tmp; loop++) |
1722 | - if (cp[loop]) |
1723 | - goto not_xdr; |
1724 | + for (; loop < paddedlen; loop++) |
1725 | + if (cp[loop]) |
1726 | + goto not_xdr; |
1727 | _debug("cellname: [%u/%u] '%*.*s'", |
1728 | - len, tmp, len, len, (const char *) xdr); |
1729 | - datalen -= tmp; |
1730 | - xdr += tmp >> 2; |
1731 | + len, paddedlen, len, len, (const char *) xdr); |
1732 | + datalen -= paddedlen; |
1733 | + xdr += paddedlen >> 2; |
1734 | |
1735 | /* get the token count */ |
1736 | if (datalen < 12) |
1737 | @@ -614,10 +617,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) |
1738 | sec_ix = ntohl(*xdr); |
1739 | datalen -= 4; |
1740 | _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix); |
1741 | - if (toklen < 20 || toklen > datalen) |
1742 | + paddedlen = (toklen + 3) & ~3; |
1743 | + if (toklen < 20 || toklen > datalen || paddedlen > datalen) |
1744 | goto not_xdr; |
1745 | - datalen -= (toklen + 3) & ~3; |
1746 | - xdr += (toklen + 3) >> 2; |
1747 | + datalen -= paddedlen; |
1748 | + xdr += paddedlen >> 2; |
1749 | |
1750 | } while (--loop > 0); |
1751 | |
1752 | diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c |
1753 | index bb1261591a1f..7f0598b32f13 100644 |
1754 | --- a/sound/core/pcm_lib.c |
1755 | +++ b/sound/core/pcm_lib.c |
1756 | @@ -2491,7 +2491,7 @@ static int pcm_chmap_ctl_get(struct snd_kcontrol *kcontrol, |
1757 | struct snd_pcm_substream *substream; |
1758 | const struct snd_pcm_chmap_elem *map; |
1759 | |
1760 | - if (snd_BUG_ON(!info->chmap)) |
1761 | + if (!info->chmap) |
1762 | return -EINVAL; |
1763 | substream = snd_pcm_chmap_substream(info, idx); |
1764 | if (!substream) |
1765 | @@ -2523,7 +2523,7 @@ static int pcm_chmap_ctl_tlv(struct snd_kcontrol *kcontrol, int op_flag, |
1766 | unsigned int __user *dst; |
1767 | int c, count = 0; |
1768 | |
1769 | - if (snd_BUG_ON(!info->chmap)) |
1770 | + if (!info->chmap) |
1771 | return -EINVAL; |
1772 | if (size < 8) |
1773 | return -ENOMEM; |
1774 | diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c |
1775 | index 00060c4a9deb..9741757436be 100644 |
1776 | --- a/sound/firewire/amdtp-stream.c |
1777 | +++ b/sound/firewire/amdtp-stream.c |
1778 | @@ -606,7 +606,9 @@ static void out_stream_callback(struct fw_iso_context *context, u32 tstamp, |
1779 | cycle = increment_cycle_count(cycle, 1); |
1780 | if (handle_out_packet(s, cycle, i) < 0) { |
1781 | s->packet_index = -1; |
1782 | - amdtp_stream_pcm_abort(s); |
1783 | + if (in_interrupt()) |
1784 | + amdtp_stream_pcm_abort(s); |
1785 | + WRITE_ONCE(s->pcm_buffer_pointer, SNDRV_PCM_POS_XRUN); |
1786 | return; |
1787 | } |
1788 | } |
1789 | @@ -658,7 +660,9 @@ static void in_stream_callback(struct fw_iso_context *context, u32 tstamp, |
1790 | /* Queueing error or detecting invalid payload. */ |
1791 | if (i < packets) { |
1792 | s->packet_index = -1; |
1793 | - amdtp_stream_pcm_abort(s); |
1794 | + if (in_interrupt()) |
1795 | + amdtp_stream_pcm_abort(s); |
1796 | + WRITE_ONCE(s->pcm_buffer_pointer, SNDRV_PCM_POS_XRUN); |
1797 | return; |
1798 | } |
1799 | |
1800 | diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h |
1801 | index c1bc7fad056e..f7c054bc9d92 100644 |
1802 | --- a/sound/firewire/amdtp-stream.h |
1803 | +++ b/sound/firewire/amdtp-stream.h |
1804 | @@ -124,7 +124,7 @@ struct amdtp_stream { |
1805 | /* For a PCM substream processing. */ |
1806 | struct snd_pcm_substream *pcm; |
1807 | struct tasklet_struct period_tasklet; |
1808 | - unsigned int pcm_buffer_pointer; |
1809 | + snd_pcm_uframes_t pcm_buffer_pointer; |
1810 | unsigned int pcm_period_pointer; |
1811 | |
1812 | /* To wait for first packet. */ |