Annotation of /trunk/kernel-alx-legacy/patches-4.9/0134-4.9.35-all-fixes.patch
Parent Directory | Revision Log
Revision 3608 -
(hide annotations)
(download)
Fri Aug 14 07:34:29 2020 UTC (4 years, 1 month ago) by niro
File size: 63041 byte(s)
Fri Aug 14 07:34:29 2020 UTC (4 years, 1 month ago) by niro
File size: 63041 byte(s)
-added kerenl-alx-legacy pkg
1 | niro | 3608 | diff --git a/Makefile b/Makefile |
2 | index a40b373eba3a..0a8d47465f97 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 9 | ||
8 | -SUBLEVEL = 34 | ||
9 | +SUBLEVEL = 35 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Roaring Lionus | ||
12 | |||
13 | @@ -651,6 +651,12 @@ KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \ | ||
14 | # Tell gcc to never replace conditional load with a non-conditional one | ||
15 | KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0) | ||
16 | |||
17 | +# check for 'asm goto' | ||
18 | +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) | ||
19 | + KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO | ||
20 | + KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO | ||
21 | +endif | ||
22 | + | ||
23 | include scripts/Makefile.gcc-plugins | ||
24 | |||
25 | ifdef CONFIG_READABLE_ASM | ||
26 | @@ -796,12 +802,6 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=incompatible-pointer-types) | ||
27 | # use the deterministic mode of AR if available | ||
28 | KBUILD_ARFLAGS := $(call ar-option,D) | ||
29 | |||
30 | -# check for 'asm goto' | ||
31 | -ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) | ||
32 | - KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO | ||
33 | - KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO | ||
34 | -endif | ||
35 | - | ||
36 | include scripts/Makefile.kasan | ||
37 | include scripts/Makefile.extrawarn | ||
38 | include scripts/Makefile.ubsan | ||
39 | diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c | ||
40 | index a2c2478e7d78..4bcfe01b5aad 100644 | ||
41 | --- a/arch/arm64/kernel/vdso.c | ||
42 | +++ b/arch/arm64/kernel/vdso.c | ||
43 | @@ -217,10 +217,11 @@ void update_vsyscall(struct timekeeper *tk) | ||
44 | /* tkr_mono.cycle_last == tkr_raw.cycle_last */ | ||
45 | vdso_data->cs_cycle_last = tk->tkr_mono.cycle_last; | ||
46 | vdso_data->raw_time_sec = tk->raw_time.tv_sec; | ||
47 | - vdso_data->raw_time_nsec = tk->raw_time.tv_nsec; | ||
48 | + vdso_data->raw_time_nsec = (tk->raw_time.tv_nsec << | ||
49 | + tk->tkr_raw.shift) + | ||
50 | + tk->tkr_raw.xtime_nsec; | ||
51 | vdso_data->xtime_clock_sec = tk->xtime_sec; | ||
52 | vdso_data->xtime_clock_nsec = tk->tkr_mono.xtime_nsec; | ||
53 | - /* tkr_raw.xtime_nsec == 0 */ | ||
54 | vdso_data->cs_mono_mult = tk->tkr_mono.mult; | ||
55 | vdso_data->cs_raw_mult = tk->tkr_raw.mult; | ||
56 | /* tkr_mono.shift == tkr_raw.shift */ | ||
57 | diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S | ||
58 | index e00b4671bd7c..76320e920965 100644 | ||
59 | --- a/arch/arm64/kernel/vdso/gettimeofday.S | ||
60 | +++ b/arch/arm64/kernel/vdso/gettimeofday.S | ||
61 | @@ -256,7 +256,6 @@ monotonic_raw: | ||
62 | seqcnt_check fail=monotonic_raw | ||
63 | |||
64 | /* All computations are done with left-shifted nsecs. */ | ||
65 | - lsl x14, x14, x12 | ||
66 | get_nsec_per_sec res=x9 | ||
67 | lsl x9, x9, x12 | ||
68 | |||
69 | diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S | ||
70 | index 1ba82ea90230..2e2fc1e37715 100644 | ||
71 | --- a/arch/powerpc/kernel/exceptions-64s.S | ||
72 | +++ b/arch/powerpc/kernel/exceptions-64s.S | ||
73 | @@ -1411,10 +1411,8 @@ USE_TEXT_SECTION() | ||
74 | .align 7 | ||
75 | do_hash_page: | ||
76 | #ifdef CONFIG_PPC_STD_MMU_64 | ||
77 | - andis. r0,r4,0xa410 /* weird error? */ | ||
78 | + andis. r0,r4,0xa450 /* weird error? */ | ||
79 | bne- handle_page_fault /* if not, try to insert a HPTE */ | ||
80 | - andis. r0,r4,DSISR_DABRMATCH@h | ||
81 | - bne- handle_dabr_fault | ||
82 | CURRENT_THREAD_INFO(r11, r1) | ||
83 | lwz r0,TI_PREEMPT(r11) /* If we're in an "NMI" */ | ||
84 | andis. r0,r0,NMI_MASK@h /* (i.e. an irq when soft-disabled) */ | ||
85 | @@ -1438,11 +1436,16 @@ do_hash_page: | ||
86 | |||
87 | /* Error */ | ||
88 | blt- 13f | ||
89 | + | ||
90 | + /* Reload DSISR into r4 for the DABR check below */ | ||
91 | + ld r4,_DSISR(r1) | ||
92 | #endif /* CONFIG_PPC_STD_MMU_64 */ | ||
93 | |||
94 | /* Here we have a page fault that hash_page can't handle. */ | ||
95 | handle_page_fault: | ||
96 | -11: ld r4,_DAR(r1) | ||
97 | +11: andis. r0,r4,DSISR_DABRMATCH@h | ||
98 | + bne- handle_dabr_fault | ||
99 | + ld r4,_DAR(r1) | ||
100 | ld r5,_DSISR(r1) | ||
101 | addi r3,r1,STACK_FRAME_OVERHEAD | ||
102 | bl do_page_fault | ||
103 | diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c | ||
104 | index e785cc9e1ecd..fe97cbe04576 100644 | ||
105 | --- a/arch/powerpc/kernel/kprobes.c | ||
106 | +++ b/arch/powerpc/kernel/kprobes.c | ||
107 | @@ -511,6 +511,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) | ||
108 | regs->gpr[2] = (unsigned long)(((func_descr_t *)jp->entry)->toc); | ||
109 | #endif | ||
110 | |||
111 | + /* | ||
112 | + * jprobes use jprobe_return() which skips the normal return | ||
113 | + * path of the function, and this messes up the accounting of the | ||
114 | + * function graph tracer. | ||
115 | + * | ||
116 | + * Pause function graph tracing while performing the jprobe function. | ||
117 | + */ | ||
118 | + pause_graph_tracing(); | ||
119 | + | ||
120 | return 1; | ||
121 | } | ||
122 | |||
123 | @@ -533,6 +542,8 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) | ||
124 | * saved regs... | ||
125 | */ | ||
126 | memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs)); | ||
127 | + /* It's OK to start function graph tracing again */ | ||
128 | + unpause_graph_tracing(); | ||
129 | preempt_enable_no_resched(); | ||
130 | return 1; | ||
131 | } | ||
132 | diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c | ||
133 | index 094deb60c6fe..5c0298422300 100644 | ||
134 | --- a/arch/powerpc/kvm/book3s_hv.c | ||
135 | +++ b/arch/powerpc/kvm/book3s_hv.c | ||
136 | @@ -2807,12 +2807,34 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) | ||
137 | { | ||
138 | int r; | ||
139 | int srcu_idx; | ||
140 | + unsigned long ebb_regs[3] = {}; /* shut up GCC */ | ||
141 | |||
142 | if (!vcpu->arch.sane) { | ||
143 | run->exit_reason = KVM_EXIT_INTERNAL_ERROR; | ||
144 | return -EINVAL; | ||
145 | } | ||
146 | |||
147 | + /* | ||
148 | + * Don't allow entry with a suspended transaction, because | ||
149 | + * the guest entry/exit code will lose it. | ||
150 | + * If the guest has TM enabled, save away their TM-related SPRs | ||
151 | + * (they will get restored by the TM unavailable interrupt). | ||
152 | + */ | ||
153 | +#ifdef CONFIG_PPC_TRANSACTIONAL_MEM | ||
154 | + if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs && | ||
155 | + (current->thread.regs->msr & MSR_TM)) { | ||
156 | + if (MSR_TM_ACTIVE(current->thread.regs->msr)) { | ||
157 | + run->exit_reason = KVM_EXIT_FAIL_ENTRY; | ||
158 | + run->fail_entry.hardware_entry_failure_reason = 0; | ||
159 | + return -EINVAL; | ||
160 | + } | ||
161 | + current->thread.tm_tfhar = mfspr(SPRN_TFHAR); | ||
162 | + current->thread.tm_tfiar = mfspr(SPRN_TFIAR); | ||
163 | + current->thread.tm_texasr = mfspr(SPRN_TEXASR); | ||
164 | + current->thread.regs->msr &= ~MSR_TM; | ||
165 | + } | ||
166 | +#endif | ||
167 | + | ||
168 | kvmppc_core_prepare_to_enter(vcpu); | ||
169 | |||
170 | /* No need to go into the guest when all we'll do is come back out */ | ||
171 | @@ -2834,6 +2856,13 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) | ||
172 | |||
173 | flush_all_to_thread(current); | ||
174 | |||
175 | + /* Save userspace EBB register values */ | ||
176 | + if (cpu_has_feature(CPU_FTR_ARCH_207S)) { | ||
177 | + ebb_regs[0] = mfspr(SPRN_EBBHR); | ||
178 | + ebb_regs[1] = mfspr(SPRN_EBBRR); | ||
179 | + ebb_regs[2] = mfspr(SPRN_BESCR); | ||
180 | + } | ||
181 | + | ||
182 | vcpu->arch.wqp = &vcpu->arch.vcore->wq; | ||
183 | vcpu->arch.pgdir = current->mm->pgd; | ||
184 | vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST; | ||
185 | @@ -2856,6 +2885,13 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) | ||
186 | r = kvmppc_xics_rm_complete(vcpu, 0); | ||
187 | } while (is_kvmppc_resume_guest(r)); | ||
188 | |||
189 | + /* Restore userspace EBB register values */ | ||
190 | + if (cpu_has_feature(CPU_FTR_ARCH_207S)) { | ||
191 | + mtspr(SPRN_EBBHR, ebb_regs[0]); | ||
192 | + mtspr(SPRN_EBBRR, ebb_regs[1]); | ||
193 | + mtspr(SPRN_BESCR, ebb_regs[2]); | ||
194 | + } | ||
195 | + | ||
196 | out: | ||
197 | vcpu->arch.state = KVMPPC_VCPU_NOTREADY; | ||
198 | atomic_dec(&vcpu->kvm->arch.vcpus_running); | ||
199 | diff --git a/arch/powerpc/perf/perf_regs.c b/arch/powerpc/perf/perf_regs.c | ||
200 | index d24a8a3668fa..28ae8bd6228e 100644 | ||
201 | --- a/arch/powerpc/perf/perf_regs.c | ||
202 | +++ b/arch/powerpc/perf/perf_regs.c | ||
203 | @@ -100,5 +100,6 @@ void perf_get_regs_user(struct perf_regs *regs_user, | ||
204 | struct pt_regs *regs_user_copy) | ||
205 | { | ||
206 | regs_user->regs = task_pt_regs(current); | ||
207 | - regs_user->abi = perf_reg_abi(current); | ||
208 | + regs_user->abi = (regs_user->regs) ? perf_reg_abi(current) : | ||
209 | + PERF_SAMPLE_REGS_ABI_NONE; | ||
210 | } | ||
211 | diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c | ||
212 | index 4aa8a7e2a1da..f5d79840f4e0 100644 | ||
213 | --- a/arch/s390/kvm/gaccess.c | ||
214 | +++ b/arch/s390/kvm/gaccess.c | ||
215 | @@ -972,11 +972,12 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, | ||
216 | ptr = asce.origin * 4096; | ||
217 | if (asce.r) { | ||
218 | *fake = 1; | ||
219 | + ptr = 0; | ||
220 | asce.dt = ASCE_TYPE_REGION1; | ||
221 | } | ||
222 | switch (asce.dt) { | ||
223 | case ASCE_TYPE_REGION1: | ||
224 | - if (vaddr.rfx01 > asce.tl && !asce.r) | ||
225 | + if (vaddr.rfx01 > asce.tl && !*fake) | ||
226 | return PGM_REGION_FIRST_TRANS; | ||
227 | break; | ||
228 | case ASCE_TYPE_REGION2: | ||
229 | @@ -1004,8 +1005,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, | ||
230 | union region1_table_entry rfte; | ||
231 | |||
232 | if (*fake) { | ||
233 | - /* offset in 16EB guest memory block */ | ||
234 | - ptr = ptr + ((unsigned long) vaddr.rsx << 53UL); | ||
235 | + ptr += (unsigned long) vaddr.rfx << 53; | ||
236 | rfte.val = ptr; | ||
237 | goto shadow_r2t; | ||
238 | } | ||
239 | @@ -1031,8 +1031,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, | ||
240 | union region2_table_entry rste; | ||
241 | |||
242 | if (*fake) { | ||
243 | - /* offset in 8PB guest memory block */ | ||
244 | - ptr = ptr + ((unsigned long) vaddr.rtx << 42UL); | ||
245 | + ptr += (unsigned long) vaddr.rsx << 42; | ||
246 | rste.val = ptr; | ||
247 | goto shadow_r3t; | ||
248 | } | ||
249 | @@ -1059,8 +1058,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, | ||
250 | union region3_table_entry rtte; | ||
251 | |||
252 | if (*fake) { | ||
253 | - /* offset in 4TB guest memory block */ | ||
254 | - ptr = ptr + ((unsigned long) vaddr.sx << 31UL); | ||
255 | + ptr += (unsigned long) vaddr.rtx << 31; | ||
256 | rtte.val = ptr; | ||
257 | goto shadow_sgt; | ||
258 | } | ||
259 | @@ -1096,8 +1094,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, | ||
260 | union segment_table_entry ste; | ||
261 | |||
262 | if (*fake) { | ||
263 | - /* offset in 2G guest memory block */ | ||
264 | - ptr = ptr + ((unsigned long) vaddr.sx << 20UL); | ||
265 | + ptr += (unsigned long) vaddr.sx << 20; | ||
266 | ste.val = ptr; | ||
267 | goto shadow_pgt; | ||
268 | } | ||
269 | diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c | ||
270 | index cb8522290e6a..3bdb917716b1 100644 | ||
271 | --- a/arch/x86/events/intel/core.c | ||
272 | +++ b/arch/x86/events/intel/core.c | ||
273 | @@ -431,11 +431,11 @@ static __initconst const u64 skl_hw_cache_event_ids | ||
274 | [ C(DTLB) ] = { | ||
275 | [ C(OP_READ) ] = { | ||
276 | [ C(RESULT_ACCESS) ] = 0x81d0, /* MEM_INST_RETIRED.ALL_LOADS */ | ||
277 | - [ C(RESULT_MISS) ] = 0x608, /* DTLB_LOAD_MISSES.WALK_COMPLETED */ | ||
278 | + [ C(RESULT_MISS) ] = 0xe08, /* DTLB_LOAD_MISSES.WALK_COMPLETED */ | ||
279 | }, | ||
280 | [ C(OP_WRITE) ] = { | ||
281 | [ C(RESULT_ACCESS) ] = 0x82d0, /* MEM_INST_RETIRED.ALL_STORES */ | ||
282 | - [ C(RESULT_MISS) ] = 0x649, /* DTLB_STORE_MISSES.WALK_COMPLETED */ | ||
283 | + [ C(RESULT_MISS) ] = 0xe49, /* DTLB_STORE_MISSES.WALK_COMPLETED */ | ||
284 | }, | ||
285 | [ C(OP_PREFETCH) ] = { | ||
286 | [ C(RESULT_ACCESS) ] = 0x0, | ||
287 | diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c | ||
288 | index 4a80ee752597..c42202d63567 100644 | ||
289 | --- a/drivers/block/xen-blkback/blkback.c | ||
290 | +++ b/drivers/block/xen-blkback/blkback.c | ||
291 | @@ -1436,34 +1436,35 @@ static int dispatch_rw_block_io(struct xen_blkif_ring *ring, | ||
292 | static void make_response(struct xen_blkif_ring *ring, u64 id, | ||
293 | unsigned short op, int st) | ||
294 | { | ||
295 | - struct blkif_response resp; | ||
296 | + struct blkif_response *resp; | ||
297 | unsigned long flags; | ||
298 | union blkif_back_rings *blk_rings; | ||
299 | int notify; | ||
300 | |||
301 | - resp.id = id; | ||
302 | - resp.operation = op; | ||
303 | - resp.status = st; | ||
304 | - | ||
305 | spin_lock_irqsave(&ring->blk_ring_lock, flags); | ||
306 | blk_rings = &ring->blk_rings; | ||
307 | /* Place on the response ring for the relevant domain. */ | ||
308 | switch (ring->blkif->blk_protocol) { | ||
309 | case BLKIF_PROTOCOL_NATIVE: | ||
310 | - memcpy(RING_GET_RESPONSE(&blk_rings->native, blk_rings->native.rsp_prod_pvt), | ||
311 | - &resp, sizeof(resp)); | ||
312 | + resp = RING_GET_RESPONSE(&blk_rings->native, | ||
313 | + blk_rings->native.rsp_prod_pvt); | ||
314 | break; | ||
315 | case BLKIF_PROTOCOL_X86_32: | ||
316 | - memcpy(RING_GET_RESPONSE(&blk_rings->x86_32, blk_rings->x86_32.rsp_prod_pvt), | ||
317 | - &resp, sizeof(resp)); | ||
318 | + resp = RING_GET_RESPONSE(&blk_rings->x86_32, | ||
319 | + blk_rings->x86_32.rsp_prod_pvt); | ||
320 | break; | ||
321 | case BLKIF_PROTOCOL_X86_64: | ||
322 | - memcpy(RING_GET_RESPONSE(&blk_rings->x86_64, blk_rings->x86_64.rsp_prod_pvt), | ||
323 | - &resp, sizeof(resp)); | ||
324 | + resp = RING_GET_RESPONSE(&blk_rings->x86_64, | ||
325 | + blk_rings->x86_64.rsp_prod_pvt); | ||
326 | break; | ||
327 | default: | ||
328 | BUG(); | ||
329 | } | ||
330 | + | ||
331 | + resp->id = id; | ||
332 | + resp->operation = op; | ||
333 | + resp->status = st; | ||
334 | + | ||
335 | blk_rings->common.rsp_prod_pvt++; | ||
336 | RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blk_rings->common, notify); | ||
337 | spin_unlock_irqrestore(&ring->blk_ring_lock, flags); | ||
338 | diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h | ||
339 | index dea61f6ab8cb..ecb35fe8ca8d 100644 | ||
340 | --- a/drivers/block/xen-blkback/common.h | ||
341 | +++ b/drivers/block/xen-blkback/common.h | ||
342 | @@ -75,9 +75,8 @@ extern unsigned int xenblk_max_queues; | ||
343 | struct blkif_common_request { | ||
344 | char dummy; | ||
345 | }; | ||
346 | -struct blkif_common_response { | ||
347 | - char dummy; | ||
348 | -}; | ||
349 | + | ||
350 | +/* i386 protocol version */ | ||
351 | |||
352 | struct blkif_x86_32_request_rw { | ||
353 | uint8_t nr_segments; /* number of segments */ | ||
354 | @@ -129,14 +128,6 @@ struct blkif_x86_32_request { | ||
355 | } u; | ||
356 | } __attribute__((__packed__)); | ||
357 | |||
358 | -/* i386 protocol version */ | ||
359 | -#pragma pack(push, 4) | ||
360 | -struct blkif_x86_32_response { | ||
361 | - uint64_t id; /* copied from request */ | ||
362 | - uint8_t operation; /* copied from request */ | ||
363 | - int16_t status; /* BLKIF_RSP_??? */ | ||
364 | -}; | ||
365 | -#pragma pack(pop) | ||
366 | /* x86_64 protocol version */ | ||
367 | |||
368 | struct blkif_x86_64_request_rw { | ||
369 | @@ -193,18 +184,12 @@ struct blkif_x86_64_request { | ||
370 | } u; | ||
371 | } __attribute__((__packed__)); | ||
372 | |||
373 | -struct blkif_x86_64_response { | ||
374 | - uint64_t __attribute__((__aligned__(8))) id; | ||
375 | - uint8_t operation; /* copied from request */ | ||
376 | - int16_t status; /* BLKIF_RSP_??? */ | ||
377 | -}; | ||
378 | - | ||
379 | DEFINE_RING_TYPES(blkif_common, struct blkif_common_request, | ||
380 | - struct blkif_common_response); | ||
381 | + struct blkif_response); | ||
382 | DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request, | ||
383 | - struct blkif_x86_32_response); | ||
384 | + struct blkif_response __packed); | ||
385 | DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request, | ||
386 | - struct blkif_x86_64_response); | ||
387 | + struct blkif_response); | ||
388 | |||
389 | union blkif_back_rings { | ||
390 | struct blkif_back_ring native; | ||
391 | @@ -281,6 +266,7 @@ struct xen_blkif_ring { | ||
392 | |||
393 | wait_queue_head_t wq; | ||
394 | atomic_t inflight; | ||
395 | + bool active; | ||
396 | /* One thread per blkif ring. */ | ||
397 | struct task_struct *xenblkd; | ||
398 | unsigned int waiting_reqs; | ||
399 | diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c | ||
400 | index 3cc6d1d86f1e..9b69fe410c08 100644 | ||
401 | --- a/drivers/block/xen-blkback/xenbus.c | ||
402 | +++ b/drivers/block/xen-blkback/xenbus.c | ||
403 | @@ -159,7 +159,7 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif) | ||
404 | init_waitqueue_head(&ring->shutdown_wq); | ||
405 | ring->blkif = blkif; | ||
406 | ring->st_print = jiffies; | ||
407 | - xen_blkif_get(blkif); | ||
408 | + ring->active = true; | ||
409 | } | ||
410 | |||
411 | return 0; | ||
412 | @@ -249,6 +249,9 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) | ||
413 | struct xen_blkif_ring *ring = &blkif->rings[r]; | ||
414 | unsigned int i = 0; | ||
415 | |||
416 | + if (!ring->active) | ||
417 | + continue; | ||
418 | + | ||
419 | if (ring->xenblkd) { | ||
420 | kthread_stop(ring->xenblkd); | ||
421 | wake_up(&ring->shutdown_wq); | ||
422 | @@ -296,7 +299,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) | ||
423 | BUG_ON(ring->free_pages_num != 0); | ||
424 | BUG_ON(ring->persistent_gnt_c != 0); | ||
425 | WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages)); | ||
426 | - xen_blkif_put(blkif); | ||
427 | + ring->active = false; | ||
428 | } | ||
429 | blkif->nr_ring_pages = 0; | ||
430 | /* | ||
431 | diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c | ||
432 | index 8ca07fe8d3f3..0cca3601d99e 100644 | ||
433 | --- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c | ||
434 | +++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c | ||
435 | @@ -556,7 +556,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(lcd0_ch1_clk, "lcd0-ch1", lcd_ch1_parents, | ||
436 | 0x12c, 0, 4, 24, 3, BIT(31), | ||
437 | CLK_SET_RATE_PARENT); | ||
438 | static SUNXI_CCU_M_WITH_MUX_GATE(lcd1_ch1_clk, "lcd1-ch1", lcd_ch1_parents, | ||
439 | - 0x12c, 0, 4, 24, 3, BIT(31), | ||
440 | + 0x130, 0, 4, 24, 3, BIT(31), | ||
441 | CLK_SET_RATE_PARENT); | ||
442 | |||
443 | static const char * const csi_sclk_parents[] = { "pll-video0", "pll-video1", | ||
444 | diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c | ||
445 | index e18dc596cf24..6204cc32d09c 100644 | ||
446 | --- a/drivers/dma/bcm2835-dma.c | ||
447 | +++ b/drivers/dma/bcm2835-dma.c | ||
448 | @@ -251,8 +251,11 @@ static void bcm2835_dma_create_cb_set_length( | ||
449 | */ | ||
450 | |||
451 | /* have we filled in period_length yet? */ | ||
452 | - if (*total_len + control_block->length < period_len) | ||
453 | + if (*total_len + control_block->length < period_len) { | ||
454 | + /* update number of bytes in this period so far */ | ||
455 | + *total_len += control_block->length; | ||
456 | return; | ||
457 | + } | ||
458 | |||
459 | /* calculate the length that remains to reach period_length */ | ||
460 | control_block->length = period_len - *total_len; | ||
461 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | ||
462 | index 8e6bf548d689..f8fdbd1378a7 100644 | ||
463 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | ||
464 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | ||
465 | @@ -693,6 +693,10 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev) | ||
466 | DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n", | ||
467 | adev->clock.default_dispclk / 100); | ||
468 | adev->clock.default_dispclk = 60000; | ||
469 | + } else if (adev->clock.default_dispclk <= 60000) { | ||
470 | + DRM_INFO("Changing default dispclk from %dMhz to 625Mhz\n", | ||
471 | + adev->clock.default_dispclk / 100); | ||
472 | + adev->clock.default_dispclk = 62500; | ||
473 | } | ||
474 | adev->clock.dp_extclk = | ||
475 | le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq); | ||
476 | diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c | ||
477 | index f7d236f95e74..57fbde14e978 100644 | ||
478 | --- a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c | ||
479 | +++ b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c | ||
480 | @@ -164,7 +164,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state) | ||
481 | struct drm_device *dev = crtc->dev; | ||
482 | struct amdgpu_device *adev = dev->dev_private; | ||
483 | int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating); | ||
484 | - ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args; | ||
485 | + ENABLE_DISP_POWER_GATING_PS_ALLOCATION args; | ||
486 | |||
487 | memset(&args, 0, sizeof(args)); | ||
488 | |||
489 | @@ -177,7 +177,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state) | ||
490 | void amdgpu_atombios_crtc_powergate_init(struct amdgpu_device *adev) | ||
491 | { | ||
492 | int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating); | ||
493 | - ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args; | ||
494 | + ENABLE_DISP_POWER_GATING_PS_ALLOCATION args; | ||
495 | |||
496 | memset(&args, 0, sizeof(args)); | ||
497 | |||
498 | diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c | ||
499 | index 432480ff9d22..3178ba0c537c 100644 | ||
500 | --- a/drivers/gpu/drm/radeon/radeon_combios.c | ||
501 | +++ b/drivers/gpu/drm/radeon/radeon_combios.c | ||
502 | @@ -3393,6 +3393,13 @@ void radeon_combios_asic_init(struct drm_device *dev) | ||
503 | rdev->pdev->subsystem_vendor == 0x103c && | ||
504 | rdev->pdev->subsystem_device == 0x280a) | ||
505 | return; | ||
506 | + /* quirk for rs4xx Toshiba Sattellite L20-183 latop to make it resume | ||
507 | + * - it hangs on resume inside the dynclk 1 table. | ||
508 | + */ | ||
509 | + if (rdev->family == CHIP_RS400 && | ||
510 | + rdev->pdev->subsystem_vendor == 0x1179 && | ||
511 | + rdev->pdev->subsystem_device == 0xff31) | ||
512 | + return; | ||
513 | |||
514 | /* DYN CLK 1 */ | ||
515 | table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE); | ||
516 | diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c | ||
517 | index 621af069a3d2..3b21ca5a6c81 100644 | ||
518 | --- a/drivers/gpu/drm/radeon/radeon_device.c | ||
519 | +++ b/drivers/gpu/drm/radeon/radeon_device.c | ||
520 | @@ -136,6 +136,10 @@ static struct radeon_px_quirk radeon_px_quirk_list[] = { | ||
521 | * https://bugzilla.kernel.org/show_bug.cgi?id=51381 | ||
522 | */ | ||
523 | { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX }, | ||
524 | + /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU | ||
525 | + * https://bugs.freedesktop.org/show_bug.cgi?id=101491 | ||
526 | + */ | ||
527 | + { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX }, | ||
528 | /* macbook pro 8.2 */ | ||
529 | { PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, RADEON_PX_QUIRK_LONG_WAKEUP }, | ||
530 | { 0, 0, 0, 0, 0 }, | ||
531 | diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h | ||
532 | index da9307701abe..cfca43f635a6 100644 | ||
533 | --- a/drivers/hid/hid-ids.h | ||
534 | +++ b/drivers/hid/hid-ids.h | ||
535 | @@ -311,6 +311,9 @@ | ||
536 | #define USB_VENDOR_ID_DELCOM 0x0fc5 | ||
537 | #define USB_DEVICE_ID_DELCOM_VISUAL_IND 0xb080 | ||
538 | |||
539 | +#define USB_VENDOR_ID_DELL 0x413c | ||
540 | +#define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE 0x301a | ||
541 | + | ||
542 | #define USB_VENDOR_ID_DELORME 0x1163 | ||
543 | #define USB_DEVICE_ID_DELORME_EARTHMATE 0x0100 | ||
544 | #define USB_DEVICE_ID_DELORME_EM_LT20 0x0200 | ||
545 | diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c | ||
546 | index 97dbb2562ace..2b1620797959 100644 | ||
547 | --- a/drivers/hid/usbhid/hid-quirks.c | ||
548 | +++ b/drivers/hid/usbhid/hid-quirks.c | ||
549 | @@ -81,6 +81,7 @@ static const struct hid_blacklist { | ||
550 | { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS }, | ||
551 | { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, | ||
552 | { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET }, | ||
553 | + { USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, | ||
554 | { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, | ||
555 | { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT }, | ||
556 | { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3, HID_QUIRK_MULTI_INPUT }, | ||
557 | diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h | ||
558 | index e7b96f1ac2c5..5be14ad29d46 100644 | ||
559 | --- a/drivers/input/serio/i8042-x86ia64io.h | ||
560 | +++ b/drivers/input/serio/i8042-x86ia64io.h | ||
561 | @@ -788,6 +788,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { | ||
562 | DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"), | ||
563 | }, | ||
564 | }, | ||
565 | + { | ||
566 | + /* Fujitsu UH554 laptop */ | ||
567 | + .matches = { | ||
568 | + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), | ||
569 | + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK UH544"), | ||
570 | + }, | ||
571 | + }, | ||
572 | { } | ||
573 | }; | ||
574 | |||
575 | diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c | ||
576 | index d0fc165d7d66..21dde5249085 100644 | ||
577 | --- a/drivers/mtd/spi-nor/spi-nor.c | ||
578 | +++ b/drivers/mtd/spi-nor/spi-nor.c | ||
579 | @@ -1255,6 +1255,13 @@ static int spansion_quad_enable(struct spi_nor *nor) | ||
580 | return -EINVAL; | ||
581 | } | ||
582 | |||
583 | + ret = spi_nor_wait_till_ready(nor); | ||
584 | + if (ret) { | ||
585 | + dev_err(nor->dev, | ||
586 | + "timeout while writing configuration register\n"); | ||
587 | + return ret; | ||
588 | + } | ||
589 | + | ||
590 | /* read back and check it */ | ||
591 | ret = read_cr(nor); | ||
592 | if (!(ret > 0 && (ret & CR_QUAD_EN_SPAN))) { | ||
593 | diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | ||
594 | index f9c2feb4a4e7..0c2a32a305bc 100644 | ||
595 | --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | ||
596 | +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | ||
597 | @@ -2201,9 +2201,10 @@ static int cxgb_up(struct adapter *adap) | ||
598 | { | ||
599 | int err; | ||
600 | |||
601 | + mutex_lock(&uld_mutex); | ||
602 | err = setup_sge_queues(adap); | ||
603 | if (err) | ||
604 | - goto out; | ||
605 | + goto rel_lock; | ||
606 | err = setup_rss(adap); | ||
607 | if (err) | ||
608 | goto freeq; | ||
609 | @@ -2227,7 +2228,6 @@ static int cxgb_up(struct adapter *adap) | ||
610 | goto irq_err; | ||
611 | } | ||
612 | |||
613 | - mutex_lock(&uld_mutex); | ||
614 | enable_rx(adap); | ||
615 | t4_sge_start(adap); | ||
616 | t4_intr_enable(adap); | ||
617 | @@ -2240,13 +2240,15 @@ static int cxgb_up(struct adapter *adap) | ||
618 | #endif | ||
619 | /* Initialize hash mac addr list*/ | ||
620 | INIT_LIST_HEAD(&adap->mac_hlist); | ||
621 | - out: | ||
622 | return err; | ||
623 | + | ||
624 | irq_err: | ||
625 | dev_err(adap->pdev_dev, "request_irq failed, err %d\n", err); | ||
626 | freeq: | ||
627 | t4_free_sge_resources(adap); | ||
628 | - goto out; | ||
629 | + rel_lock: | ||
630 | + mutex_unlock(&uld_mutex); | ||
631 | + return err; | ||
632 | } | ||
633 | |||
634 | static void cxgb_down(struct adapter *adapter) | ||
635 | diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c | ||
636 | index d6a541bde331..2f70f80de27f 100644 | ||
637 | --- a/drivers/net/phy/marvell.c | ||
638 | +++ b/drivers/net/phy/marvell.c | ||
639 | @@ -1114,8 +1114,6 @@ static int marvell_read_status_page(struct phy_device *phydev, int page) | ||
640 | if (adv < 0) | ||
641 | return adv; | ||
642 | |||
643 | - lpa &= adv; | ||
644 | - | ||
645 | if (status & MII_M1011_PHY_STATUS_FULLDUPLEX) | ||
646 | phydev->duplex = DUPLEX_FULL; | ||
647 | else | ||
648 | diff --git a/drivers/net/phy/mdio-bcm-iproc.c b/drivers/net/phy/mdio-bcm-iproc.c | ||
649 | index c0b4e65267af..46fe1ae919a3 100644 | ||
650 | --- a/drivers/net/phy/mdio-bcm-iproc.c | ||
651 | +++ b/drivers/net/phy/mdio-bcm-iproc.c | ||
652 | @@ -81,8 +81,6 @@ static int iproc_mdio_read(struct mii_bus *bus, int phy_id, int reg) | ||
653 | if (rc) | ||
654 | return rc; | ||
655 | |||
656 | - iproc_mdio_config_clk(priv->base); | ||
657 | - | ||
658 | /* Prepare the read operation */ | ||
659 | cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) | | ||
660 | (reg << MII_DATA_RA_SHIFT) | | ||
661 | @@ -112,8 +110,6 @@ static int iproc_mdio_write(struct mii_bus *bus, int phy_id, | ||
662 | if (rc) | ||
663 | return rc; | ||
664 | |||
665 | - iproc_mdio_config_clk(priv->base); | ||
666 | - | ||
667 | /* Prepare the write operation */ | ||
668 | cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) | | ||
669 | (reg << MII_DATA_RA_SHIFT) | | ||
670 | @@ -163,6 +159,8 @@ static int iproc_mdio_probe(struct platform_device *pdev) | ||
671 | bus->read = iproc_mdio_read; | ||
672 | bus->write = iproc_mdio_write; | ||
673 | |||
674 | + iproc_mdio_config_clk(priv->base); | ||
675 | + | ||
676 | rc = of_mdiobus_register(bus, pdev->dev.of_node); | ||
677 | if (rc) { | ||
678 | dev_err(&pdev->dev, "MDIO bus registration failed\n"); | ||
679 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | ||
680 | index c7c1e9906500..d231042f19d6 100644 | ||
681 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | ||
682 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | ||
683 | @@ -442,7 +442,7 @@ struct brcmf_fw { | ||
684 | const char *nvram_name; | ||
685 | u16 domain_nr; | ||
686 | u16 bus_nr; | ||
687 | - void (*done)(struct device *dev, const struct firmware *fw, | ||
688 | + void (*done)(struct device *dev, int err, const struct firmware *fw, | ||
689 | void *nvram_image, u32 nvram_len); | ||
690 | }; | ||
691 | |||
692 | @@ -477,52 +477,51 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx) | ||
693 | if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL)) | ||
694 | goto fail; | ||
695 | |||
696 | - fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length); | ||
697 | + fwctx->done(fwctx->dev, 0, fwctx->code, nvram, nvram_length); | ||
698 | kfree(fwctx); | ||
699 | return; | ||
700 | |||
701 | fail: | ||
702 | brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev)); | ||
703 | release_firmware(fwctx->code); | ||
704 | - device_release_driver(fwctx->dev); | ||
705 | + fwctx->done(fwctx->dev, -ENOENT, NULL, NULL, 0); | ||
706 | kfree(fwctx); | ||
707 | } | ||
708 | |||
709 | static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx) | ||
710 | { | ||
711 | struct brcmf_fw *fwctx = ctx; | ||
712 | - int ret; | ||
713 | + int ret = 0; | ||
714 | |||
715 | brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev)); | ||
716 | - if (!fw) | ||
717 | + if (!fw) { | ||
718 | + ret = -ENOENT; | ||
719 | goto fail; | ||
720 | - | ||
721 | - /* only requested code so done here */ | ||
722 | - if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) { | ||
723 | - fwctx->done(fwctx->dev, fw, NULL, 0); | ||
724 | - kfree(fwctx); | ||
725 | - return; | ||
726 | } | ||
727 | + /* only requested code so done here */ | ||
728 | + if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) | ||
729 | + goto done; | ||
730 | + | ||
731 | fwctx->code = fw; | ||
732 | ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name, | ||
733 | fwctx->dev, GFP_KERNEL, fwctx, | ||
734 | brcmf_fw_request_nvram_done); | ||
735 | |||
736 | - if (!ret) | ||
737 | - return; | ||
738 | - | ||
739 | - brcmf_fw_request_nvram_done(NULL, fwctx); | ||
740 | + /* pass NULL to nvram callback for bcm47xx fallback */ | ||
741 | + if (ret) | ||
742 | + brcmf_fw_request_nvram_done(NULL, fwctx); | ||
743 | return; | ||
744 | |||
745 | fail: | ||
746 | brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev)); | ||
747 | - device_release_driver(fwctx->dev); | ||
748 | +done: | ||
749 | + fwctx->done(fwctx->dev, ret, fw, NULL, 0); | ||
750 | kfree(fwctx); | ||
751 | } | ||
752 | |||
753 | int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags, | ||
754 | const char *code, const char *nvram, | ||
755 | - void (*fw_cb)(struct device *dev, | ||
756 | + void (*fw_cb)(struct device *dev, int err, | ||
757 | const struct firmware *fw, | ||
758 | void *nvram_image, u32 nvram_len), | ||
759 | u16 domain_nr, u16 bus_nr) | ||
760 | @@ -555,7 +554,7 @@ int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags, | ||
761 | |||
762 | int brcmf_fw_get_firmwares(struct device *dev, u16 flags, | ||
763 | const char *code, const char *nvram, | ||
764 | - void (*fw_cb)(struct device *dev, | ||
765 | + void (*fw_cb)(struct device *dev, int err, | ||
766 | const struct firmware *fw, | ||
767 | void *nvram_image, u32 nvram_len)) | ||
768 | { | ||
769 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h | ||
770 | index d3c9f0d52ae3..8fa4b7e1ab3d 100644 | ||
771 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h | ||
772 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h | ||
773 | @@ -73,13 +73,13 @@ void brcmf_fw_nvram_free(void *nvram); | ||
774 | */ | ||
775 | int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags, | ||
776 | const char *code, const char *nvram, | ||
777 | - void (*fw_cb)(struct device *dev, | ||
778 | + void (*fw_cb)(struct device *dev, int err, | ||
779 | const struct firmware *fw, | ||
780 | void *nvram_image, u32 nvram_len), | ||
781 | u16 domain_nr, u16 bus_nr); | ||
782 | int brcmf_fw_get_firmwares(struct device *dev, u16 flags, | ||
783 | const char *code, const char *nvram, | ||
784 | - void (*fw_cb)(struct device *dev, | ||
785 | + void (*fw_cb)(struct device *dev, int err, | ||
786 | const struct firmware *fw, | ||
787 | void *nvram_image, u32 nvram_len)); | ||
788 | |||
789 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | ||
790 | index 3deba90c7eb5..d3d79219fbb0 100644 | ||
791 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | ||
792 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | ||
793 | @@ -1618,16 +1618,23 @@ static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = { | ||
794 | .write32 = brcmf_pcie_buscore_write32, | ||
795 | }; | ||
796 | |||
797 | -static void brcmf_pcie_setup(struct device *dev, const struct firmware *fw, | ||
798 | +static void brcmf_pcie_setup(struct device *dev, int ret, | ||
799 | + const struct firmware *fw, | ||
800 | void *nvram, u32 nvram_len) | ||
801 | { | ||
802 | - struct brcmf_bus *bus = dev_get_drvdata(dev); | ||
803 | - struct brcmf_pciedev *pcie_bus_dev = bus->bus_priv.pcie; | ||
804 | - struct brcmf_pciedev_info *devinfo = pcie_bus_dev->devinfo; | ||
805 | + struct brcmf_bus *bus; | ||
806 | + struct brcmf_pciedev *pcie_bus_dev; | ||
807 | + struct brcmf_pciedev_info *devinfo; | ||
808 | struct brcmf_commonring **flowrings; | ||
809 | - int ret; | ||
810 | u32 i; | ||
811 | |||
812 | + /* check firmware loading result */ | ||
813 | + if (ret) | ||
814 | + goto fail; | ||
815 | + | ||
816 | + bus = dev_get_drvdata(dev); | ||
817 | + pcie_bus_dev = bus->bus_priv.pcie; | ||
818 | + devinfo = pcie_bus_dev->devinfo; | ||
819 | brcmf_pcie_attach(devinfo); | ||
820 | |||
821 | /* Some of the firmwares have the size of the memory of the device | ||
822 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | ||
823 | index 2458e6e05276..8744b9beda33 100644 | ||
824 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | ||
825 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | ||
826 | @@ -3975,21 +3975,26 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = { | ||
827 | .get_memdump = brcmf_sdio_bus_get_memdump, | ||
828 | }; | ||
829 | |||
830 | -static void brcmf_sdio_firmware_callback(struct device *dev, | ||
831 | +static void brcmf_sdio_firmware_callback(struct device *dev, int err, | ||
832 | const struct firmware *code, | ||
833 | void *nvram, u32 nvram_len) | ||
834 | { | ||
835 | - struct brcmf_bus *bus_if = dev_get_drvdata(dev); | ||
836 | - struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio; | ||
837 | - struct brcmf_sdio *bus = sdiodev->bus; | ||
838 | - int err = 0; | ||
839 | + struct brcmf_bus *bus_if; | ||
840 | + struct brcmf_sdio_dev *sdiodev; | ||
841 | + struct brcmf_sdio *bus; | ||
842 | u8 saveclk; | ||
843 | |||
844 | - brcmf_dbg(TRACE, "Enter: dev=%s\n", dev_name(dev)); | ||
845 | + brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err); | ||
846 | + bus_if = dev_get_drvdata(dev); | ||
847 | + sdiodev = bus_if->bus_priv.sdio; | ||
848 | + if (err) | ||
849 | + goto fail; | ||
850 | |||
851 | if (!bus_if->drvr) | ||
852 | return; | ||
853 | |||
854 | + bus = sdiodev->bus; | ||
855 | + | ||
856 | /* try to download image and nvram to the dongle */ | ||
857 | bus->alp_only = true; | ||
858 | err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len); | ||
859 | @@ -4076,6 +4081,7 @@ static void brcmf_sdio_firmware_callback(struct device *dev, | ||
860 | fail: | ||
861 | brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err); | ||
862 | device_release_driver(dev); | ||
863 | + device_release_driver(&sdiodev->func[2]->dev); | ||
864 | } | ||
865 | |||
866 | struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) | ||
867 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | ||
868 | index 2f978a39b58a..053f3b59f21e 100644 | ||
869 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | ||
870 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | ||
871 | @@ -1158,17 +1158,18 @@ static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo) | ||
872 | return ret; | ||
873 | } | ||
874 | |||
875 | -static void brcmf_usb_probe_phase2(struct device *dev, | ||
876 | +static void brcmf_usb_probe_phase2(struct device *dev, int ret, | ||
877 | const struct firmware *fw, | ||
878 | void *nvram, u32 nvlen) | ||
879 | { | ||
880 | struct brcmf_bus *bus = dev_get_drvdata(dev); | ||
881 | - struct brcmf_usbdev_info *devinfo; | ||
882 | - int ret; | ||
883 | + struct brcmf_usbdev_info *devinfo = bus->bus_priv.usb->devinfo; | ||
884 | + | ||
885 | + if (ret) | ||
886 | + goto error; | ||
887 | |||
888 | brcmf_dbg(USB, "Start fw downloading\n"); | ||
889 | |||
890 | - devinfo = bus->bus_priv.usb->devinfo; | ||
891 | ret = check_file(fw->data); | ||
892 | if (ret < 0) { | ||
893 | brcmf_err("invalid firmware\n"); | ||
894 | diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | ||
895 | index b7273be9303d..c8d9075339cf 100644 | ||
896 | --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | ||
897 | +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | ||
898 | @@ -1422,21 +1422,6 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) | ||
899 | cancel_work_sync(&rt2x00dev->intf_work); | ||
900 | cancel_delayed_work_sync(&rt2x00dev->autowakeup_work); | ||
901 | cancel_work_sync(&rt2x00dev->sleep_work); | ||
902 | -#if IS_ENABLED(CONFIG_RT2X00_LIB_USB) | ||
903 | - if (rt2x00_is_usb(rt2x00dev)) { | ||
904 | - usb_kill_anchored_urbs(rt2x00dev->anchor); | ||
905 | - hrtimer_cancel(&rt2x00dev->txstatus_timer); | ||
906 | - cancel_work_sync(&rt2x00dev->rxdone_work); | ||
907 | - cancel_work_sync(&rt2x00dev->txdone_work); | ||
908 | - } | ||
909 | -#endif | ||
910 | - if (rt2x00dev->workqueue) | ||
911 | - destroy_workqueue(rt2x00dev->workqueue); | ||
912 | - | ||
913 | - /* | ||
914 | - * Free the tx status fifo. | ||
915 | - */ | ||
916 | - kfifo_free(&rt2x00dev->txstatus_fifo); | ||
917 | |||
918 | /* | ||
919 | * Kill the tx status tasklet. | ||
920 | @@ -1452,6 +1437,14 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) | ||
921 | */ | ||
922 | rt2x00lib_uninitialize(rt2x00dev); | ||
923 | |||
924 | + if (rt2x00dev->workqueue) | ||
925 | + destroy_workqueue(rt2x00dev->workqueue); | ||
926 | + | ||
927 | + /* | ||
928 | + * Free the tx status fifo. | ||
929 | + */ | ||
930 | + kfifo_free(&rt2x00dev->txstatus_fifo); | ||
931 | + | ||
932 | /* | ||
933 | * Free extra components | ||
934 | */ | ||
935 | diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | ||
936 | index 662705e31136..631df690adbe 100644 | ||
937 | --- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | ||
938 | +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | ||
939 | @@ -740,6 +740,11 @@ void rt2x00usb_uninitialize(struct rt2x00_dev *rt2x00dev) | ||
940 | { | ||
941 | struct data_queue *queue; | ||
942 | |||
943 | + usb_kill_anchored_urbs(rt2x00dev->anchor); | ||
944 | + hrtimer_cancel(&rt2x00dev->txstatus_timer); | ||
945 | + cancel_work_sync(&rt2x00dev->rxdone_work); | ||
946 | + cancel_work_sync(&rt2x00dev->txdone_work); | ||
947 | + | ||
948 | queue_for_each(rt2x00dev, queue) | ||
949 | rt2x00usb_free_entries(queue); | ||
950 | } | ||
951 | diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c | ||
952 | index 6a43fd3d0576..502f5547a1f2 100644 | ||
953 | --- a/drivers/of/fdt.c | ||
954 | +++ b/drivers/of/fdt.c | ||
955 | @@ -741,9 +741,12 @@ int __init of_scan_flat_dt(int (*it)(unsigned long node, | ||
956 | const char *pathp; | ||
957 | int offset, rc = 0, depth = -1; | ||
958 | |||
959 | - for (offset = fdt_next_node(blob, -1, &depth); | ||
960 | - offset >= 0 && depth >= 0 && !rc; | ||
961 | - offset = fdt_next_node(blob, offset, &depth)) { | ||
962 | + if (!blob) | ||
963 | + return 0; | ||
964 | + | ||
965 | + for (offset = fdt_next_node(blob, -1, &depth); | ||
966 | + offset >= 0 && depth >= 0 && !rc; | ||
967 | + offset = fdt_next_node(blob, offset, &depth)) { | ||
968 | |||
969 | pathp = fdt_get_name(blob, offset, NULL); | ||
970 | if (*pathp == '/') | ||
971 | diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c | ||
972 | index 838783c3fed0..24d4492d0168 100644 | ||
973 | --- a/drivers/spi/spi.c | ||
974 | +++ b/drivers/spi/spi.c | ||
975 | @@ -1004,7 +1004,7 @@ static int spi_transfer_one_message(struct spi_master *master, | ||
976 | ret = 0; | ||
977 | ms = 8LL * 1000LL * xfer->len; | ||
978 | do_div(ms, xfer->speed_hz); | ||
979 | - ms += ms + 100; /* some tolerance */ | ||
980 | + ms += ms + 200; /* some tolerance */ | ||
981 | |||
982 | if (ms > UINT_MAX) | ||
983 | ms = UINT_MAX; | ||
984 | diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c | ||
985 | index 01ea228358ea..155fe0e0623f 100644 | ||
986 | --- a/drivers/target/iscsi/iscsi_target.c | ||
987 | +++ b/drivers/target/iscsi/iscsi_target.c | ||
988 | @@ -1287,6 +1287,18 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr, | ||
989 | */ | ||
990 | if (dump_payload) | ||
991 | goto after_immediate_data; | ||
992 | + /* | ||
993 | + * Check for underflow case where both EDTL and immediate data payload | ||
994 | + * exceeds what is presented by CDB's TRANSFER LENGTH, and what has | ||
995 | + * already been set in target_cmd_size_check() as se_cmd->data_length. | ||
996 | + * | ||
997 | + * For this special case, fail the command and dump the immediate data | ||
998 | + * payload. | ||
999 | + */ | ||
1000 | + if (cmd->first_burst_len > cmd->se_cmd.data_length) { | ||
1001 | + cmd->sense_reason = TCM_INVALID_CDB_FIELD; | ||
1002 | + goto after_immediate_data; | ||
1003 | + } | ||
1004 | |||
1005 | immed_ret = iscsit_handle_immediate_data(cmd, hdr, | ||
1006 | cmd->first_burst_len); | ||
1007 | @@ -4431,8 +4443,11 @@ static void iscsit_logout_post_handler_closesession( | ||
1008 | * always sleep waiting for RX/TX thread shutdown to complete | ||
1009 | * within iscsit_close_connection(). | ||
1010 | */ | ||
1011 | - if (!conn->conn_transport->rdma_shutdown) | ||
1012 | + if (!conn->conn_transport->rdma_shutdown) { | ||
1013 | sleep = cmpxchg(&conn->tx_thread_active, true, false); | ||
1014 | + if (!sleep) | ||
1015 | + return; | ||
1016 | + } | ||
1017 | |||
1018 | atomic_set(&conn->conn_logout_remove, 0); | ||
1019 | complete(&conn->conn_logout_comp); | ||
1020 | @@ -4448,8 +4463,11 @@ static void iscsit_logout_post_handler_samecid( | ||
1021 | { | ||
1022 | int sleep = 1; | ||
1023 | |||
1024 | - if (!conn->conn_transport->rdma_shutdown) | ||
1025 | + if (!conn->conn_transport->rdma_shutdown) { | ||
1026 | sleep = cmpxchg(&conn->tx_thread_active, true, false); | ||
1027 | + if (!sleep) | ||
1028 | + return; | ||
1029 | + } | ||
1030 | |||
1031 | atomic_set(&conn->conn_logout_remove, 0); | ||
1032 | complete(&conn->conn_logout_comp); | ||
1033 | diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h | ||
1034 | index e2c970a9d61c..be52838cc1a8 100644 | ||
1035 | --- a/drivers/target/target_core_internal.h | ||
1036 | +++ b/drivers/target/target_core_internal.h | ||
1037 | @@ -131,7 +131,7 @@ int init_se_kmem_caches(void); | ||
1038 | void release_se_kmem_caches(void); | ||
1039 | u32 scsi_get_new_index(scsi_index_t); | ||
1040 | void transport_subsystem_check_init(void); | ||
1041 | -void transport_cmd_finish_abort(struct se_cmd *, int); | ||
1042 | +int transport_cmd_finish_abort(struct se_cmd *, int); | ||
1043 | unsigned char *transport_dump_cmd_direction(struct se_cmd *); | ||
1044 | void transport_dump_dev_state(struct se_device *, char *, int *); | ||
1045 | void transport_dump_dev_info(struct se_device *, struct se_lun *, | ||
1046 | diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c | ||
1047 | index 4f229e711e1c..27dd1e12f246 100644 | ||
1048 | --- a/drivers/target/target_core_tmr.c | ||
1049 | +++ b/drivers/target/target_core_tmr.c | ||
1050 | @@ -75,7 +75,7 @@ void core_tmr_release_req(struct se_tmr_req *tmr) | ||
1051 | kfree(tmr); | ||
1052 | } | ||
1053 | |||
1054 | -static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) | ||
1055 | +static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) | ||
1056 | { | ||
1057 | unsigned long flags; | ||
1058 | bool remove = true, send_tas; | ||
1059 | @@ -91,7 +91,7 @@ static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) | ||
1060 | transport_send_task_abort(cmd); | ||
1061 | } | ||
1062 | |||
1063 | - transport_cmd_finish_abort(cmd, remove); | ||
1064 | + return transport_cmd_finish_abort(cmd, remove); | ||
1065 | } | ||
1066 | |||
1067 | static int target_check_cdb_and_preempt(struct list_head *list, | ||
1068 | @@ -185,8 +185,8 @@ void core_tmr_abort_task( | ||
1069 | cancel_work_sync(&se_cmd->work); | ||
1070 | transport_wait_for_tasks(se_cmd); | ||
1071 | |||
1072 | - transport_cmd_finish_abort(se_cmd, true); | ||
1073 | - target_put_sess_cmd(se_cmd); | ||
1074 | + if (!transport_cmd_finish_abort(se_cmd, true)) | ||
1075 | + target_put_sess_cmd(se_cmd); | ||
1076 | |||
1077 | printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for" | ||
1078 | " ref_tag: %llu\n", ref_tag); | ||
1079 | @@ -286,8 +286,8 @@ static void core_tmr_drain_tmr_list( | ||
1080 | cancel_work_sync(&cmd->work); | ||
1081 | transport_wait_for_tasks(cmd); | ||
1082 | |||
1083 | - transport_cmd_finish_abort(cmd, 1); | ||
1084 | - target_put_sess_cmd(cmd); | ||
1085 | + if (!transport_cmd_finish_abort(cmd, 1)) | ||
1086 | + target_put_sess_cmd(cmd); | ||
1087 | } | ||
1088 | } | ||
1089 | |||
1090 | @@ -385,8 +385,8 @@ static void core_tmr_drain_state_list( | ||
1091 | cancel_work_sync(&cmd->work); | ||
1092 | transport_wait_for_tasks(cmd); | ||
1093 | |||
1094 | - core_tmr_handle_tas_abort(cmd, tas); | ||
1095 | - target_put_sess_cmd(cmd); | ||
1096 | + if (!core_tmr_handle_tas_abort(cmd, tas)) | ||
1097 | + target_put_sess_cmd(cmd); | ||
1098 | } | ||
1099 | } | ||
1100 | |||
1101 | diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c | ||
1102 | index 077344cc819f..1f9bfa4195ea 100644 | ||
1103 | --- a/drivers/target/target_core_transport.c | ||
1104 | +++ b/drivers/target/target_core_transport.c | ||
1105 | @@ -673,9 +673,10 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd) | ||
1106 | percpu_ref_put(&lun->lun_ref); | ||
1107 | } | ||
1108 | |||
1109 | -void transport_cmd_finish_abort(struct se_cmd *cmd, int remove) | ||
1110 | +int transport_cmd_finish_abort(struct se_cmd *cmd, int remove) | ||
1111 | { | ||
1112 | bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF); | ||
1113 | + int ret = 0; | ||
1114 | |||
1115 | if (cmd->se_cmd_flags & SCF_SE_LUN_CMD) | ||
1116 | transport_lun_remove_cmd(cmd); | ||
1117 | @@ -687,9 +688,11 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove) | ||
1118 | cmd->se_tfo->aborted_task(cmd); | ||
1119 | |||
1120 | if (transport_cmd_check_stop_to_fabric(cmd)) | ||
1121 | - return; | ||
1122 | + return 1; | ||
1123 | if (remove && ack_kref) | ||
1124 | - transport_put_cmd(cmd); | ||
1125 | + ret = transport_put_cmd(cmd); | ||
1126 | + | ||
1127 | + return ret; | ||
1128 | } | ||
1129 | |||
1130 | static void target_complete_failure_work(struct work_struct *work) | ||
1131 | diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c | ||
1132 | index 89081b834615..04ffd7640c33 100644 | ||
1133 | --- a/drivers/usb/gadget/function/f_fs.c | ||
1134 | +++ b/drivers/usb/gadget/function/f_fs.c | ||
1135 | @@ -1858,12 +1858,12 @@ static int ffs_func_eps_enable(struct ffs_function *func) | ||
1136 | ep->ep->driver_data = ep; | ||
1137 | ep->ep->desc = ds; | ||
1138 | |||
1139 | - comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + | ||
1140 | - USB_DT_ENDPOINT_SIZE); | ||
1141 | - ep->ep->maxburst = comp_desc->bMaxBurst + 1; | ||
1142 | - | ||
1143 | - if (needs_comp_desc) | ||
1144 | + if (needs_comp_desc) { | ||
1145 | + comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + | ||
1146 | + USB_DT_ENDPOINT_SIZE); | ||
1147 | + ep->ep->maxburst = comp_desc->bMaxBurst + 1; | ||
1148 | ep->ep->comp_desc = comp_desc; | ||
1149 | + } | ||
1150 | |||
1151 | ret = usb_ep_enable(ep->ep); | ||
1152 | if (likely(!ret)) { | ||
1153 | diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c | ||
1154 | index fc09eb77ddf3..ffc69dd28928 100644 | ||
1155 | --- a/fs/autofs4/dev-ioctl.c | ||
1156 | +++ b/fs/autofs4/dev-ioctl.c | ||
1157 | @@ -345,7 +345,7 @@ static int autofs_dev_ioctl_fail(struct file *fp, | ||
1158 | int status; | ||
1159 | |||
1160 | token = (autofs_wqt_t) param->fail.token; | ||
1161 | - status = param->fail.status ? param->fail.status : -ENOENT; | ||
1162 | + status = param->fail.status < 0 ? param->fail.status : -ENOENT; | ||
1163 | return autofs4_wait_release(sbi, token, status); | ||
1164 | } | ||
1165 | |||
1166 | diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c | ||
1167 | index 87b87e091e8e..efd72e1fae74 100644 | ||
1168 | --- a/fs/cifs/smb1ops.c | ||
1169 | +++ b/fs/cifs/smb1ops.c | ||
1170 | @@ -849,8 +849,13 @@ cifs_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, | ||
1171 | struct cifs_fid *fid, __u16 search_flags, | ||
1172 | struct cifs_search_info *srch_inf) | ||
1173 | { | ||
1174 | - return CIFSFindFirst(xid, tcon, path, cifs_sb, | ||
1175 | - &fid->netfid, search_flags, srch_inf, true); | ||
1176 | + int rc; | ||
1177 | + | ||
1178 | + rc = CIFSFindFirst(xid, tcon, path, cifs_sb, | ||
1179 | + &fid->netfid, search_flags, srch_inf, true); | ||
1180 | + if (rc) | ||
1181 | + cifs_dbg(FYI, "find first failed=%d\n", rc); | ||
1182 | + return rc; | ||
1183 | } | ||
1184 | |||
1185 | static int | ||
1186 | diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c | ||
1187 | index 36334fe3266c..b6968241c26f 100644 | ||
1188 | --- a/fs/cifs/smb2ops.c | ||
1189 | +++ b/fs/cifs/smb2ops.c | ||
1190 | @@ -964,7 +964,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, | ||
1191 | rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL); | ||
1192 | kfree(utf16_path); | ||
1193 | if (rc) { | ||
1194 | - cifs_dbg(VFS, "open dir failed\n"); | ||
1195 | + cifs_dbg(FYI, "open dir failed rc=%d\n", rc); | ||
1196 | return rc; | ||
1197 | } | ||
1198 | |||
1199 | @@ -974,7 +974,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, | ||
1200 | rc = SMB2_query_directory(xid, tcon, fid->persistent_fid, | ||
1201 | fid->volatile_fid, 0, srch_inf); | ||
1202 | if (rc) { | ||
1203 | - cifs_dbg(VFS, "query directory failed\n"); | ||
1204 | + cifs_dbg(FYI, "query directory failed rc=%d\n", rc); | ||
1205 | SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid); | ||
1206 | } | ||
1207 | return rc; | ||
1208 | diff --git a/fs/exec.c b/fs/exec.c | ||
1209 | index 67e86571685a..91441402d706 100644 | ||
1210 | --- a/fs/exec.c | ||
1211 | +++ b/fs/exec.c | ||
1212 | @@ -215,8 +215,26 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, | ||
1213 | |||
1214 | if (write) { | ||
1215 | unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start; | ||
1216 | + unsigned long ptr_size; | ||
1217 | struct rlimit *rlim; | ||
1218 | |||
1219 | + /* | ||
1220 | + * Since the stack will hold pointers to the strings, we | ||
1221 | + * must account for them as well. | ||
1222 | + * | ||
1223 | + * The size calculation is the entire vma while each arg page is | ||
1224 | + * built, so each time we get here it's calculating how far it | ||
1225 | + * is currently (rather than each call being just the newly | ||
1226 | + * added size from the arg page). As a result, we need to | ||
1227 | + * always add the entire size of the pointers, so that on the | ||
1228 | + * last call to get_arg_page() we'll actually have the entire | ||
1229 | + * correct size. | ||
1230 | + */ | ||
1231 | + ptr_size = (bprm->argc + bprm->envc) * sizeof(void *); | ||
1232 | + if (ptr_size > ULONG_MAX - size) | ||
1233 | + goto fail; | ||
1234 | + size += ptr_size; | ||
1235 | + | ||
1236 | acct_arg_size(bprm, size / PAGE_SIZE); | ||
1237 | |||
1238 | /* | ||
1239 | @@ -234,13 +252,15 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, | ||
1240 | * to work from. | ||
1241 | */ | ||
1242 | rlim = current->signal->rlim; | ||
1243 | - if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) { | ||
1244 | - put_page(page); | ||
1245 | - return NULL; | ||
1246 | - } | ||
1247 | + if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) | ||
1248 | + goto fail; | ||
1249 | } | ||
1250 | |||
1251 | return page; | ||
1252 | + | ||
1253 | +fail: | ||
1254 | + put_page(page); | ||
1255 | + return NULL; | ||
1256 | } | ||
1257 | |||
1258 | static void put_arg_page(struct page *page) | ||
1259 | diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h | ||
1260 | index e88005459035..2c225d46a428 100644 | ||
1261 | --- a/include/linux/timekeeper_internal.h | ||
1262 | +++ b/include/linux/timekeeper_internal.h | ||
1263 | @@ -29,7 +29,6 @@ | ||
1264 | */ | ||
1265 | struct tk_read_base { | ||
1266 | struct clocksource *clock; | ||
1267 | - cycle_t (*read)(struct clocksource *cs); | ||
1268 | cycle_t mask; | ||
1269 | cycle_t cycle_last; | ||
1270 | u32 mult; | ||
1271 | @@ -58,7 +57,7 @@ struct tk_read_base { | ||
1272 | * interval. | ||
1273 | * @xtime_remainder: Shifted nano seconds left over when rounding | ||
1274 | * @cycle_interval | ||
1275 | - * @raw_interval: Raw nano seconds accumulated per NTP interval. | ||
1276 | + * @raw_interval: Shifted raw nano seconds accumulated per NTP interval. | ||
1277 | * @ntp_error: Difference between accumulated time and NTP time in ntp | ||
1278 | * shifted nano seconds. | ||
1279 | * @ntp_error_shift: Shift conversion between clock shifted nano seconds and | ||
1280 | @@ -100,7 +99,7 @@ struct timekeeper { | ||
1281 | cycle_t cycle_interval; | ||
1282 | u64 xtime_interval; | ||
1283 | s64 xtime_remainder; | ||
1284 | - u32 raw_interval; | ||
1285 | + u64 raw_interval; | ||
1286 | /* The ntp_tick_length() value currently being used. | ||
1287 | * This cached copy ensures we consistently apply the tick | ||
1288 | * length for an entire tick, as ntp_tick_length may change | ||
1289 | diff --git a/kernel/signal.c b/kernel/signal.c | ||
1290 | index 0b1415720a15..deb04d5983ed 100644 | ||
1291 | --- a/kernel/signal.c | ||
1292 | +++ b/kernel/signal.c | ||
1293 | @@ -503,7 +503,8 @@ int unhandled_signal(struct task_struct *tsk, int sig) | ||
1294 | return !tsk->ptrace; | ||
1295 | } | ||
1296 | |||
1297 | -static void collect_signal(int sig, struct sigpending *list, siginfo_t *info) | ||
1298 | +static void collect_signal(int sig, struct sigpending *list, siginfo_t *info, | ||
1299 | + bool *resched_timer) | ||
1300 | { | ||
1301 | struct sigqueue *q, *first = NULL; | ||
1302 | |||
1303 | @@ -525,6 +526,12 @@ static void collect_signal(int sig, struct sigpending *list, siginfo_t *info) | ||
1304 | still_pending: | ||
1305 | list_del_init(&first->list); | ||
1306 | copy_siginfo(info, &first->info); | ||
1307 | + | ||
1308 | + *resched_timer = | ||
1309 | + (first->flags & SIGQUEUE_PREALLOC) && | ||
1310 | + (info->si_code == SI_TIMER) && | ||
1311 | + (info->si_sys_private); | ||
1312 | + | ||
1313 | __sigqueue_free(first); | ||
1314 | } else { | ||
1315 | /* | ||
1316 | @@ -541,12 +548,12 @@ static void collect_signal(int sig, struct sigpending *list, siginfo_t *info) | ||
1317 | } | ||
1318 | |||
1319 | static int __dequeue_signal(struct sigpending *pending, sigset_t *mask, | ||
1320 | - siginfo_t *info) | ||
1321 | + siginfo_t *info, bool *resched_timer) | ||
1322 | { | ||
1323 | int sig = next_signal(pending, mask); | ||
1324 | |||
1325 | if (sig) | ||
1326 | - collect_signal(sig, pending, info); | ||
1327 | + collect_signal(sig, pending, info, resched_timer); | ||
1328 | return sig; | ||
1329 | } | ||
1330 | |||
1331 | @@ -558,15 +565,16 @@ static int __dequeue_signal(struct sigpending *pending, sigset_t *mask, | ||
1332 | */ | ||
1333 | int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info) | ||
1334 | { | ||
1335 | + bool resched_timer = false; | ||
1336 | int signr; | ||
1337 | |||
1338 | /* We only dequeue private signals from ourselves, we don't let | ||
1339 | * signalfd steal them | ||
1340 | */ | ||
1341 | - signr = __dequeue_signal(&tsk->pending, mask, info); | ||
1342 | + signr = __dequeue_signal(&tsk->pending, mask, info, &resched_timer); | ||
1343 | if (!signr) { | ||
1344 | signr = __dequeue_signal(&tsk->signal->shared_pending, | ||
1345 | - mask, info); | ||
1346 | + mask, info, &resched_timer); | ||
1347 | /* | ||
1348 | * itimer signal ? | ||
1349 | * | ||
1350 | @@ -611,7 +619,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info) | ||
1351 | */ | ||
1352 | current->jobctl |= JOBCTL_STOP_DEQUEUED; | ||
1353 | } | ||
1354 | - if ((info->si_code & __SI_MASK) == __SI_TIMER && info->si_sys_private) { | ||
1355 | + if (resched_timer) { | ||
1356 | /* | ||
1357 | * Release the siglock to ensure proper locking order | ||
1358 | * of timer locks outside of siglocks. Note, we leave | ||
1359 | diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c | ||
1360 | index 46e312e9be38..d831827d7ab0 100644 | ||
1361 | --- a/kernel/time/timekeeping.c | ||
1362 | +++ b/kernel/time/timekeeping.c | ||
1363 | @@ -116,6 +116,26 @@ static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta) | ||
1364 | tk->offs_boot = ktime_add(tk->offs_boot, delta); | ||
1365 | } | ||
1366 | |||
1367 | +/* | ||
1368 | + * tk_clock_read - atomic clocksource read() helper | ||
1369 | + * | ||
1370 | + * This helper is necessary to use in the read paths because, while the | ||
1371 | + * seqlock ensures we don't return a bad value while structures are updated, | ||
1372 | + * it doesn't protect from potential crashes. There is the possibility that | ||
1373 | + * the tkr's clocksource may change between the read reference, and the | ||
1374 | + * clock reference passed to the read function. This can cause crashes if | ||
1375 | + * the wrong clocksource is passed to the wrong read function. | ||
1376 | + * This isn't necessary to use when holding the timekeeper_lock or doing | ||
1377 | + * a read of the fast-timekeeper tkrs (which is protected by its own locking | ||
1378 | + * and update logic). | ||
1379 | + */ | ||
1380 | +static inline u64 tk_clock_read(struct tk_read_base *tkr) | ||
1381 | +{ | ||
1382 | + struct clocksource *clock = READ_ONCE(tkr->clock); | ||
1383 | + | ||
1384 | + return clock->read(clock); | ||
1385 | +} | ||
1386 | + | ||
1387 | #ifdef CONFIG_DEBUG_TIMEKEEPING | ||
1388 | #define WARNING_FREQ (HZ*300) /* 5 minute rate-limiting */ | ||
1389 | |||
1390 | @@ -173,7 +193,7 @@ static inline cycle_t timekeeping_get_delta(struct tk_read_base *tkr) | ||
1391 | */ | ||
1392 | do { | ||
1393 | seq = read_seqcount_begin(&tk_core.seq); | ||
1394 | - now = tkr->read(tkr->clock); | ||
1395 | + now = tk_clock_read(tkr); | ||
1396 | last = tkr->cycle_last; | ||
1397 | mask = tkr->mask; | ||
1398 | max = tkr->clock->max_cycles; | ||
1399 | @@ -207,7 +227,7 @@ static inline cycle_t timekeeping_get_delta(struct tk_read_base *tkr) | ||
1400 | cycle_t cycle_now, delta; | ||
1401 | |||
1402 | /* read clocksource */ | ||
1403 | - cycle_now = tkr->read(tkr->clock); | ||
1404 | + cycle_now = tk_clock_read(tkr); | ||
1405 | |||
1406 | /* calculate the delta since the last update_wall_time */ | ||
1407 | delta = clocksource_delta(cycle_now, tkr->cycle_last, tkr->mask); | ||
1408 | @@ -236,12 +256,10 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock) | ||
1409 | ++tk->cs_was_changed_seq; | ||
1410 | old_clock = tk->tkr_mono.clock; | ||
1411 | tk->tkr_mono.clock = clock; | ||
1412 | - tk->tkr_mono.read = clock->read; | ||
1413 | tk->tkr_mono.mask = clock->mask; | ||
1414 | - tk->tkr_mono.cycle_last = tk->tkr_mono.read(clock); | ||
1415 | + tk->tkr_mono.cycle_last = tk_clock_read(&tk->tkr_mono); | ||
1416 | |||
1417 | tk->tkr_raw.clock = clock; | ||
1418 | - tk->tkr_raw.read = clock->read; | ||
1419 | tk->tkr_raw.mask = clock->mask; | ||
1420 | tk->tkr_raw.cycle_last = tk->tkr_mono.cycle_last; | ||
1421 | |||
1422 | @@ -260,8 +278,7 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock) | ||
1423 | /* Go back from cycles -> shifted ns */ | ||
1424 | tk->xtime_interval = (u64) interval * clock->mult; | ||
1425 | tk->xtime_remainder = ntpinterval - tk->xtime_interval; | ||
1426 | - tk->raw_interval = | ||
1427 | - ((u64) interval * clock->mult) >> clock->shift; | ||
1428 | + tk->raw_interval = interval * clock->mult; | ||
1429 | |||
1430 | /* if changing clocks, convert xtime_nsec shift units */ | ||
1431 | if (old_clock) { | ||
1432 | @@ -405,7 +422,7 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) | ||
1433 | |||
1434 | now += timekeeping_delta_to_ns(tkr, | ||
1435 | clocksource_delta( | ||
1436 | - tkr->read(tkr->clock), | ||
1437 | + tk_clock_read(tkr), | ||
1438 | tkr->cycle_last, | ||
1439 | tkr->mask)); | ||
1440 | } while (read_seqcount_retry(&tkf->seq, seq)); | ||
1441 | @@ -433,6 +450,10 @@ static cycle_t dummy_clock_read(struct clocksource *cs) | ||
1442 | return cycles_at_suspend; | ||
1443 | } | ||
1444 | |||
1445 | +static struct clocksource dummy_clock = { | ||
1446 | + .read = dummy_clock_read, | ||
1447 | +}; | ||
1448 | + | ||
1449 | /** | ||
1450 | * halt_fast_timekeeper - Prevent fast timekeeper from accessing clocksource. | ||
1451 | * @tk: Timekeeper to snapshot. | ||
1452 | @@ -449,13 +470,13 @@ static void halt_fast_timekeeper(struct timekeeper *tk) | ||
1453 | struct tk_read_base *tkr = &tk->tkr_mono; | ||
1454 | |||
1455 | memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy)); | ||
1456 | - cycles_at_suspend = tkr->read(tkr->clock); | ||
1457 | - tkr_dummy.read = dummy_clock_read; | ||
1458 | + cycles_at_suspend = tk_clock_read(tkr); | ||
1459 | + tkr_dummy.clock = &dummy_clock; | ||
1460 | update_fast_timekeeper(&tkr_dummy, &tk_fast_mono); | ||
1461 | |||
1462 | tkr = &tk->tkr_raw; | ||
1463 | memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy)); | ||
1464 | - tkr_dummy.read = dummy_clock_read; | ||
1465 | + tkr_dummy.clock = &dummy_clock; | ||
1466 | update_fast_timekeeper(&tkr_dummy, &tk_fast_raw); | ||
1467 | } | ||
1468 | |||
1469 | @@ -621,11 +642,10 @@ static void timekeeping_update(struct timekeeper *tk, unsigned int action) | ||
1470 | */ | ||
1471 | static void timekeeping_forward_now(struct timekeeper *tk) | ||
1472 | { | ||
1473 | - struct clocksource *clock = tk->tkr_mono.clock; | ||
1474 | cycle_t cycle_now, delta; | ||
1475 | s64 nsec; | ||
1476 | |||
1477 | - cycle_now = tk->tkr_mono.read(clock); | ||
1478 | + cycle_now = tk_clock_read(&tk->tkr_mono); | ||
1479 | delta = clocksource_delta(cycle_now, tk->tkr_mono.cycle_last, tk->tkr_mono.mask); | ||
1480 | tk->tkr_mono.cycle_last = cycle_now; | ||
1481 | tk->tkr_raw.cycle_last = cycle_now; | ||
1482 | @@ -901,8 +921,7 @@ void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot) | ||
1483 | |||
1484 | do { | ||
1485 | seq = read_seqcount_begin(&tk_core.seq); | ||
1486 | - | ||
1487 | - now = tk->tkr_mono.read(tk->tkr_mono.clock); | ||
1488 | + now = tk_clock_read(&tk->tkr_mono); | ||
1489 | systime_snapshot->cs_was_changed_seq = tk->cs_was_changed_seq; | ||
1490 | systime_snapshot->clock_was_set_seq = tk->clock_was_set_seq; | ||
1491 | base_real = ktime_add(tk->tkr_mono.base, | ||
1492 | @@ -1081,7 +1100,7 @@ int get_device_system_crosststamp(int (*get_time_fn) | ||
1493 | * Check whether the system counter value provided by the | ||
1494 | * device driver is on the current timekeeping interval. | ||
1495 | */ | ||
1496 | - now = tk->tkr_mono.read(tk->tkr_mono.clock); | ||
1497 | + now = tk_clock_read(&tk->tkr_mono); | ||
1498 | interval_start = tk->tkr_mono.cycle_last; | ||
1499 | if (!cycle_between(interval_start, cycles, now)) { | ||
1500 | clock_was_set_seq = tk->clock_was_set_seq; | ||
1501 | @@ -1639,7 +1658,7 @@ void timekeeping_resume(void) | ||
1502 | * The less preferred source will only be tried if there is no better | ||
1503 | * usable source. The rtc part is handled separately in rtc core code. | ||
1504 | */ | ||
1505 | - cycle_now = tk->tkr_mono.read(clock); | ||
1506 | + cycle_now = tk_clock_read(&tk->tkr_mono); | ||
1507 | if ((clock->flags & CLOCK_SOURCE_SUSPEND_NONSTOP) && | ||
1508 | cycle_now > tk->tkr_mono.cycle_last) { | ||
1509 | u64 num, max = ULLONG_MAX; | ||
1510 | @@ -2003,7 +2022,7 @@ static cycle_t logarithmic_accumulation(struct timekeeper *tk, cycle_t offset, | ||
1511 | unsigned int *clock_set) | ||
1512 | { | ||
1513 | cycle_t interval = tk->cycle_interval << shift; | ||
1514 | - u64 raw_nsecs; | ||
1515 | + u64 snsec_per_sec; | ||
1516 | |||
1517 | /* If the offset is smaller than a shifted interval, do nothing */ | ||
1518 | if (offset < interval) | ||
1519 | @@ -2018,14 +2037,15 @@ static cycle_t logarithmic_accumulation(struct timekeeper *tk, cycle_t offset, | ||
1520 | *clock_set |= accumulate_nsecs_to_secs(tk); | ||
1521 | |||
1522 | /* Accumulate raw time */ | ||
1523 | - raw_nsecs = (u64)tk->raw_interval << shift; | ||
1524 | - raw_nsecs += tk->raw_time.tv_nsec; | ||
1525 | - if (raw_nsecs >= NSEC_PER_SEC) { | ||
1526 | - u64 raw_secs = raw_nsecs; | ||
1527 | - raw_nsecs = do_div(raw_secs, NSEC_PER_SEC); | ||
1528 | - tk->raw_time.tv_sec += raw_secs; | ||
1529 | + tk->tkr_raw.xtime_nsec += (u64)tk->raw_time.tv_nsec << tk->tkr_raw.shift; | ||
1530 | + tk->tkr_raw.xtime_nsec += tk->raw_interval << shift; | ||
1531 | + snsec_per_sec = (u64)NSEC_PER_SEC << tk->tkr_raw.shift; | ||
1532 | + while (tk->tkr_raw.xtime_nsec >= snsec_per_sec) { | ||
1533 | + tk->tkr_raw.xtime_nsec -= snsec_per_sec; | ||
1534 | + tk->raw_time.tv_sec++; | ||
1535 | } | ||
1536 | - tk->raw_time.tv_nsec = raw_nsecs; | ||
1537 | + tk->raw_time.tv_nsec = tk->tkr_raw.xtime_nsec >> tk->tkr_raw.shift; | ||
1538 | + tk->tkr_raw.xtime_nsec -= (u64)tk->raw_time.tv_nsec << tk->tkr_raw.shift; | ||
1539 | |||
1540 | /* Accumulate error between NTP and clock interval */ | ||
1541 | tk->ntp_error += tk->ntp_tick << shift; | ||
1542 | @@ -2057,7 +2077,7 @@ void update_wall_time(void) | ||
1543 | #ifdef CONFIG_ARCH_USES_GETTIMEOFFSET | ||
1544 | offset = real_tk->cycle_interval; | ||
1545 | #else | ||
1546 | - offset = clocksource_delta(tk->tkr_mono.read(tk->tkr_mono.clock), | ||
1547 | + offset = clocksource_delta(tk_clock_read(&tk->tkr_mono), | ||
1548 | tk->tkr_mono.cycle_last, tk->tkr_mono.mask); | ||
1549 | #endif | ||
1550 | |||
1551 | diff --git a/lib/cmdline.c b/lib/cmdline.c | ||
1552 | index 8f13cf73c2ec..79069d7938ea 100644 | ||
1553 | --- a/lib/cmdline.c | ||
1554 | +++ b/lib/cmdline.c | ||
1555 | @@ -22,14 +22,14 @@ | ||
1556 | * the values[M, M+1, ..., N] into the ints array in get_options. | ||
1557 | */ | ||
1558 | |||
1559 | -static int get_range(char **str, int *pint) | ||
1560 | +static int get_range(char **str, int *pint, int n) | ||
1561 | { | ||
1562 | int x, inc_counter, upper_range; | ||
1563 | |||
1564 | (*str)++; | ||
1565 | upper_range = simple_strtol((*str), NULL, 0); | ||
1566 | inc_counter = upper_range - *pint; | ||
1567 | - for (x = *pint; x < upper_range; x++) | ||
1568 | + for (x = *pint; n && x < upper_range; x++, n--) | ||
1569 | *pint++ = x; | ||
1570 | return inc_counter; | ||
1571 | } | ||
1572 | @@ -96,7 +96,7 @@ char *get_options(const char *str, int nints, int *ints) | ||
1573 | break; | ||
1574 | if (res == 3) { | ||
1575 | int range_nums; | ||
1576 | - range_nums = get_range((char **)&str, ints + i); | ||
1577 | + range_nums = get_range((char **)&str, ints + i, nints - i); | ||
1578 | if (range_nums < 0) | ||
1579 | break; | ||
1580 | /* | ||
1581 | diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c | ||
1582 | index 18c737a61d80..7fc340726d03 100644 | ||
1583 | --- a/net/rxrpc/key.c | ||
1584 | +++ b/net/rxrpc/key.c | ||
1585 | @@ -217,7 +217,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, | ||
1586 | unsigned int *_toklen) | ||
1587 | { | ||
1588 | const __be32 *xdr = *_xdr; | ||
1589 | - unsigned int toklen = *_toklen, n_parts, loop, tmp; | ||
1590 | + unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen; | ||
1591 | |||
1592 | /* there must be at least one name, and at least #names+1 length | ||
1593 | * words */ | ||
1594 | @@ -247,16 +247,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, | ||
1595 | toklen -= 4; | ||
1596 | if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX) | ||
1597 | return -EINVAL; | ||
1598 | - if (tmp > toklen) | ||
1599 | + paddedlen = (tmp + 3) & ~3; | ||
1600 | + if (paddedlen > toklen) | ||
1601 | return -EINVAL; | ||
1602 | princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL); | ||
1603 | if (!princ->name_parts[loop]) | ||
1604 | return -ENOMEM; | ||
1605 | memcpy(princ->name_parts[loop], xdr, tmp); | ||
1606 | princ->name_parts[loop][tmp] = 0; | ||
1607 | - tmp = (tmp + 3) & ~3; | ||
1608 | - toklen -= tmp; | ||
1609 | - xdr += tmp >> 2; | ||
1610 | + toklen -= paddedlen; | ||
1611 | + xdr += paddedlen >> 2; | ||
1612 | } | ||
1613 | |||
1614 | if (toklen < 4) | ||
1615 | @@ -265,16 +265,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, | ||
1616 | toklen -= 4; | ||
1617 | if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX) | ||
1618 | return -EINVAL; | ||
1619 | - if (tmp > toklen) | ||
1620 | + paddedlen = (tmp + 3) & ~3; | ||
1621 | + if (paddedlen > toklen) | ||
1622 | return -EINVAL; | ||
1623 | princ->realm = kmalloc(tmp + 1, GFP_KERNEL); | ||
1624 | if (!princ->realm) | ||
1625 | return -ENOMEM; | ||
1626 | memcpy(princ->realm, xdr, tmp); | ||
1627 | princ->realm[tmp] = 0; | ||
1628 | - tmp = (tmp + 3) & ~3; | ||
1629 | - toklen -= tmp; | ||
1630 | - xdr += tmp >> 2; | ||
1631 | + toklen -= paddedlen; | ||
1632 | + xdr += paddedlen >> 2; | ||
1633 | |||
1634 | _debug("%s/...@%s", princ->name_parts[0], princ->realm); | ||
1635 | |||
1636 | @@ -293,7 +293,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td, | ||
1637 | unsigned int *_toklen) | ||
1638 | { | ||
1639 | const __be32 *xdr = *_xdr; | ||
1640 | - unsigned int toklen = *_toklen, len; | ||
1641 | + unsigned int toklen = *_toklen, len, paddedlen; | ||
1642 | |||
1643 | /* there must be at least one tag and one length word */ | ||
1644 | if (toklen <= 8) | ||
1645 | @@ -307,15 +307,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td, | ||
1646 | toklen -= 8; | ||
1647 | if (len > max_data_size) | ||
1648 | return -EINVAL; | ||
1649 | + paddedlen = (len + 3) & ~3; | ||
1650 | + if (paddedlen > toklen) | ||
1651 | + return -EINVAL; | ||
1652 | td->data_len = len; | ||
1653 | |||
1654 | if (len > 0) { | ||
1655 | td->data = kmemdup(xdr, len, GFP_KERNEL); | ||
1656 | if (!td->data) | ||
1657 | return -ENOMEM; | ||
1658 | - len = (len + 3) & ~3; | ||
1659 | - toklen -= len; | ||
1660 | - xdr += len >> 2; | ||
1661 | + toklen -= paddedlen; | ||
1662 | + xdr += paddedlen >> 2; | ||
1663 | } | ||
1664 | |||
1665 | _debug("tag %x len %x", td->tag, td->data_len); | ||
1666 | @@ -387,7 +389,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, | ||
1667 | const __be32 **_xdr, unsigned int *_toklen) | ||
1668 | { | ||
1669 | const __be32 *xdr = *_xdr; | ||
1670 | - unsigned int toklen = *_toklen, len; | ||
1671 | + unsigned int toklen = *_toklen, len, paddedlen; | ||
1672 | |||
1673 | /* there must be at least one length word */ | ||
1674 | if (toklen <= 4) | ||
1675 | @@ -399,6 +401,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, | ||
1676 | toklen -= 4; | ||
1677 | if (len > AFSTOKEN_K5_TIX_MAX) | ||
1678 | return -EINVAL; | ||
1679 | + paddedlen = (len + 3) & ~3; | ||
1680 | + if (paddedlen > toklen) | ||
1681 | + return -EINVAL; | ||
1682 | *_tktlen = len; | ||
1683 | |||
1684 | _debug("ticket len %u", len); | ||
1685 | @@ -407,9 +412,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, | ||
1686 | *_ticket = kmemdup(xdr, len, GFP_KERNEL); | ||
1687 | if (!*_ticket) | ||
1688 | return -ENOMEM; | ||
1689 | - len = (len + 3) & ~3; | ||
1690 | - toklen -= len; | ||
1691 | - xdr += len >> 2; | ||
1692 | + toklen -= paddedlen; | ||
1693 | + xdr += paddedlen >> 2; | ||
1694 | } | ||
1695 | |||
1696 | *_xdr = xdr; | ||
1697 | @@ -552,7 +556,7 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) | ||
1698 | { | ||
1699 | const __be32 *xdr = prep->data, *token; | ||
1700 | const char *cp; | ||
1701 | - unsigned int len, tmp, loop, ntoken, toklen, sec_ix; | ||
1702 | + unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix; | ||
1703 | size_t datalen = prep->datalen; | ||
1704 | int ret; | ||
1705 | |||
1706 | @@ -578,22 +582,21 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) | ||
1707 | if (len < 1 || len > AFSTOKEN_CELL_MAX) | ||
1708 | goto not_xdr; | ||
1709 | datalen -= 4; | ||
1710 | - tmp = (len + 3) & ~3; | ||
1711 | - if (tmp > datalen) | ||
1712 | + paddedlen = (len + 3) & ~3; | ||
1713 | + if (paddedlen > datalen) | ||
1714 | goto not_xdr; | ||
1715 | |||
1716 | cp = (const char *) xdr; | ||
1717 | for (loop = 0; loop < len; loop++) | ||
1718 | if (!isprint(cp[loop])) | ||
1719 | goto not_xdr; | ||
1720 | - if (len < tmp) | ||
1721 | - for (; loop < tmp; loop++) | ||
1722 | - if (cp[loop]) | ||
1723 | - goto not_xdr; | ||
1724 | + for (; loop < paddedlen; loop++) | ||
1725 | + if (cp[loop]) | ||
1726 | + goto not_xdr; | ||
1727 | _debug("cellname: [%u/%u] '%*.*s'", | ||
1728 | - len, tmp, len, len, (const char *) xdr); | ||
1729 | - datalen -= tmp; | ||
1730 | - xdr += tmp >> 2; | ||
1731 | + len, paddedlen, len, len, (const char *) xdr); | ||
1732 | + datalen -= paddedlen; | ||
1733 | + xdr += paddedlen >> 2; | ||
1734 | |||
1735 | /* get the token count */ | ||
1736 | if (datalen < 12) | ||
1737 | @@ -614,10 +617,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) | ||
1738 | sec_ix = ntohl(*xdr); | ||
1739 | datalen -= 4; | ||
1740 | _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix); | ||
1741 | - if (toklen < 20 || toklen > datalen) | ||
1742 | + paddedlen = (toklen + 3) & ~3; | ||
1743 | + if (toklen < 20 || toklen > datalen || paddedlen > datalen) | ||
1744 | goto not_xdr; | ||
1745 | - datalen -= (toklen + 3) & ~3; | ||
1746 | - xdr += (toklen + 3) >> 2; | ||
1747 | + datalen -= paddedlen; | ||
1748 | + xdr += paddedlen >> 2; | ||
1749 | |||
1750 | } while (--loop > 0); | ||
1751 | |||
1752 | diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c | ||
1753 | index bb1261591a1f..7f0598b32f13 100644 | ||
1754 | --- a/sound/core/pcm_lib.c | ||
1755 | +++ b/sound/core/pcm_lib.c | ||
1756 | @@ -2491,7 +2491,7 @@ static int pcm_chmap_ctl_get(struct snd_kcontrol *kcontrol, | ||
1757 | struct snd_pcm_substream *substream; | ||
1758 | const struct snd_pcm_chmap_elem *map; | ||
1759 | |||
1760 | - if (snd_BUG_ON(!info->chmap)) | ||
1761 | + if (!info->chmap) | ||
1762 | return -EINVAL; | ||
1763 | substream = snd_pcm_chmap_substream(info, idx); | ||
1764 | if (!substream) | ||
1765 | @@ -2523,7 +2523,7 @@ static int pcm_chmap_ctl_tlv(struct snd_kcontrol *kcontrol, int op_flag, | ||
1766 | unsigned int __user *dst; | ||
1767 | int c, count = 0; | ||
1768 | |||
1769 | - if (snd_BUG_ON(!info->chmap)) | ||
1770 | + if (!info->chmap) | ||
1771 | return -EINVAL; | ||
1772 | if (size < 8) | ||
1773 | return -ENOMEM; | ||
1774 | diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c | ||
1775 | index 00060c4a9deb..9741757436be 100644 | ||
1776 | --- a/sound/firewire/amdtp-stream.c | ||
1777 | +++ b/sound/firewire/amdtp-stream.c | ||
1778 | @@ -606,7 +606,9 @@ static void out_stream_callback(struct fw_iso_context *context, u32 tstamp, | ||
1779 | cycle = increment_cycle_count(cycle, 1); | ||
1780 | if (handle_out_packet(s, cycle, i) < 0) { | ||
1781 | s->packet_index = -1; | ||
1782 | - amdtp_stream_pcm_abort(s); | ||
1783 | + if (in_interrupt()) | ||
1784 | + amdtp_stream_pcm_abort(s); | ||
1785 | + WRITE_ONCE(s->pcm_buffer_pointer, SNDRV_PCM_POS_XRUN); | ||
1786 | return; | ||
1787 | } | ||
1788 | } | ||
1789 | @@ -658,7 +660,9 @@ static void in_stream_callback(struct fw_iso_context *context, u32 tstamp, | ||
1790 | /* Queueing error or detecting invalid payload. */ | ||
1791 | if (i < packets) { | ||
1792 | s->packet_index = -1; | ||
1793 | - amdtp_stream_pcm_abort(s); | ||
1794 | + if (in_interrupt()) | ||
1795 | + amdtp_stream_pcm_abort(s); | ||
1796 | + WRITE_ONCE(s->pcm_buffer_pointer, SNDRV_PCM_POS_XRUN); | ||
1797 | return; | ||
1798 | } | ||
1799 | |||
1800 | diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h | ||
1801 | index c1bc7fad056e..f7c054bc9d92 100644 | ||
1802 | --- a/sound/firewire/amdtp-stream.h | ||
1803 | +++ b/sound/firewire/amdtp-stream.h | ||
1804 | @@ -124,7 +124,7 @@ struct amdtp_stream { | ||
1805 | /* For a PCM substream processing. */ | ||
1806 | struct snd_pcm_substream *pcm; | ||
1807 | struct tasklet_struct period_tasklet; | ||
1808 | - unsigned int pcm_buffer_pointer; | ||
1809 | + snd_pcm_uframes_t pcm_buffer_pointer; | ||
1810 | unsigned int pcm_period_pointer; | ||
1811 | |||
1812 | /* To wait for first packet. */ |