Annotation of /trunk/kernel-alx-legacy/patches-4.9/0334-4.9.235-all-fixes.patch
Parent Directory | Revision Log
Revision 3626 -
(hide annotations)
(download)
Mon Sep 7 06:18:42 2020 UTC (4 years ago) by niro
File size: 96262 byte(s)
Mon Sep 7 06:18:42 2020 UTC (4 years ago) by niro
File size: 96262 byte(s)
-linux-4.9.235
1 | niro | 3626 | diff --git a/Makefile b/Makefile |
2 | index e5a6f33e95de6..d21084a36bd4d 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 9 | ||
8 | -SUBLEVEL = 234 | ||
9 | +SUBLEVEL = 235 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Roaring Lionus | ||
12 | |||
13 | diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | ||
14 | index fabc0cebe2aa2..1f9ff2cea2151 100644 | ||
15 | --- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | ||
16 | +++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | ||
17 | @@ -555,7 +555,7 @@ | ||
18 | pins = "gpio63", "gpio64", "gpio65", "gpio66", | ||
19 | "gpio67", "gpio68"; | ||
20 | drive-strength = <2>; | ||
21 | - bias-disable; | ||
22 | + bias-pull-down; | ||
23 | }; | ||
24 | }; | ||
25 | }; | ||
26 | diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c | ||
27 | index 115b0955715f3..ed7e3a288b4e5 100644 | ||
28 | --- a/arch/arm64/kvm/hyp/switch.c | ||
29 | +++ b/arch/arm64/kvm/hyp/switch.c | ||
30 | @@ -412,7 +412,7 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par, | ||
31 | * making sure it is a kernel address and not a PC-relative | ||
32 | * reference. | ||
33 | */ | ||
34 | - asm volatile("ldr %0, =__hyp_panic_string" : "=r" (str_va)); | ||
35 | + asm volatile("ldr %0, =%1" : "=r" (str_va) : "S" (__hyp_panic_string)); | ||
36 | |||
37 | __hyp_do_panic(str_va, | ||
38 | spsr, elr, | ||
39 | diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c | ||
40 | index 530a36f465ced..afcc86726448e 100644 | ||
41 | --- a/arch/mips/vdso/genvdso.c | ||
42 | +++ b/arch/mips/vdso/genvdso.c | ||
43 | @@ -126,6 +126,7 @@ static void *map_vdso(const char *path, size_t *_size) | ||
44 | if (fstat(fd, &stat) != 0) { | ||
45 | fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name, | ||
46 | path, strerror(errno)); | ||
47 | + close(fd); | ||
48 | return NULL; | ||
49 | } | ||
50 | |||
51 | @@ -134,6 +135,7 @@ static void *map_vdso(const char *path, size_t *_size) | ||
52 | if (addr == MAP_FAILED) { | ||
53 | fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name, | ||
54 | path, strerror(errno)); | ||
55 | + close(fd); | ||
56 | return NULL; | ||
57 | } | ||
58 | |||
59 | @@ -143,6 +145,7 @@ static void *map_vdso(const char *path, size_t *_size) | ||
60 | if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) { | ||
61 | fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name, | ||
62 | path); | ||
63 | + close(fd); | ||
64 | return NULL; | ||
65 | } | ||
66 | |||
67 | @@ -154,6 +157,7 @@ static void *map_vdso(const char *path, size_t *_size) | ||
68 | default: | ||
69 | fprintf(stderr, "%s: '%s' has invalid ELF class\n", | ||
70 | program_name, path); | ||
71 | + close(fd); | ||
72 | return NULL; | ||
73 | } | ||
74 | |||
75 | @@ -165,6 +169,7 @@ static void *map_vdso(const char *path, size_t *_size) | ||
76 | default: | ||
77 | fprintf(stderr, "%s: '%s' has invalid ELF data order\n", | ||
78 | program_name, path); | ||
79 | + close(fd); | ||
80 | return NULL; | ||
81 | } | ||
82 | |||
83 | @@ -172,15 +177,18 @@ static void *map_vdso(const char *path, size_t *_size) | ||
84 | fprintf(stderr, | ||
85 | "%s: '%s' has invalid ELF machine (expected EM_MIPS)\n", | ||
86 | program_name, path); | ||
87 | + close(fd); | ||
88 | return NULL; | ||
89 | } else if (swap_uint16(ehdr->e_type) != ET_DYN) { | ||
90 | fprintf(stderr, | ||
91 | "%s: '%s' has invalid ELF type (expected ET_DYN)\n", | ||
92 | program_name, path); | ||
93 | + close(fd); | ||
94 | return NULL; | ||
95 | } | ||
96 | |||
97 | *_size = stat.st_size; | ||
98 | + close(fd); | ||
99 | return addr; | ||
100 | } | ||
101 | |||
102 | @@ -284,10 +292,12 @@ int main(int argc, char **argv) | ||
103 | /* Calculate and write symbol offsets to <output file> */ | ||
104 | if (!get_symbols(dbg_vdso_path, dbg_vdso)) { | ||
105 | unlink(out_path); | ||
106 | + fclose(out_file); | ||
107 | return EXIT_FAILURE; | ||
108 | } | ||
109 | |||
110 | fprintf(out_file, "};\n"); | ||
111 | + fclose(out_file); | ||
112 | |||
113 | return EXIT_SUCCESS; | ||
114 | } | ||
115 | diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c | ||
116 | index ba49ae6625f1b..a10b67df83bae 100644 | ||
117 | --- a/arch/powerpc/perf/core-book3s.c | ||
118 | +++ b/arch/powerpc/perf/core-book3s.c | ||
119 | @@ -2042,6 +2042,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val, | ||
120 | |||
121 | if (perf_event_overflow(event, &data, regs)) | ||
122 | power_pmu_stop(event, 0); | ||
123 | + } else if (period) { | ||
124 | + /* Account for interrupt in case of invalid SIAR */ | ||
125 | + if (perf_event_account_interrupt(event)) | ||
126 | + power_pmu_stop(event, 0); | ||
127 | } | ||
128 | } | ||
129 | |||
130 | diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig | ||
131 | index d9088f0b8fcc5..621be43433303 100644 | ||
132 | --- a/arch/powerpc/platforms/cell/Kconfig | ||
133 | +++ b/arch/powerpc/platforms/cell/Kconfig | ||
134 | @@ -45,6 +45,7 @@ config SPU_FS | ||
135 | tristate "SPU file system" | ||
136 | default m | ||
137 | depends on PPC_CELL | ||
138 | + depends on COREDUMP | ||
139 | select SPU_BASE | ||
140 | select MEMORY_HOTPLUG | ||
141 | help | ||
142 | diff --git a/drivers/base/core.c b/drivers/base/core.c | ||
143 | index 69a71074dc65b..fe9f2aea84bd4 100644 | ||
144 | --- a/drivers/base/core.c | ||
145 | +++ b/drivers/base/core.c | ||
146 | @@ -2348,9 +2348,9 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) | ||
147 | */ | ||
148 | void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) | ||
149 | { | ||
150 | - if (fwnode) { | ||
151 | - struct fwnode_handle *fn = dev->fwnode; | ||
152 | + struct fwnode_handle *fn = dev->fwnode; | ||
153 | |||
154 | + if (fwnode) { | ||
155 | if (fwnode_is_primary(fn)) | ||
156 | fn = fn->secondary; | ||
157 | |||
158 | @@ -2360,8 +2360,12 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) | ||
159 | } | ||
160 | dev->fwnode = fwnode; | ||
161 | } else { | ||
162 | - dev->fwnode = fwnode_is_primary(dev->fwnode) ? | ||
163 | - dev->fwnode->secondary : NULL; | ||
164 | + if (fwnode_is_primary(fn)) { | ||
165 | + dev->fwnode = fn->secondary; | ||
166 | + fn->secondary = NULL; | ||
167 | + } else { | ||
168 | + dev->fwnode = NULL; | ||
169 | + } | ||
170 | } | ||
171 | } | ||
172 | EXPORT_SYMBOL_GPL(set_primary_fwnode); | ||
173 | diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c | ||
174 | index a2714890fe431..d707cd16ed014 100644 | ||
175 | --- a/drivers/base/power/main.c | ||
176 | +++ b/drivers/base/power/main.c | ||
177 | @@ -1366,13 +1366,17 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) | ||
178 | } | ||
179 | |||
180 | /* | ||
181 | - * If a device configured to wake up the system from sleep states | ||
182 | - * has been suspended at run time and there's a resume request pending | ||
183 | - * for it, this is equivalent to the device signaling wakeup, so the | ||
184 | - * system suspend operation should be aborted. | ||
185 | + * Wait for possible runtime PM transitions of the device in progress | ||
186 | + * to complete and if there's a runtime resume request pending for it, | ||
187 | + * resume it before proceeding with invoking the system-wide suspend | ||
188 | + * callbacks for it. | ||
189 | + * | ||
190 | + * If the system-wide suspend callbacks below change the configuration | ||
191 | + * of the device, they must disable runtime PM for it or otherwise | ||
192 | + * ensure that its runtime-resume callbacks will not be confused by that | ||
193 | + * change in case they are invoked going forward. | ||
194 | */ | ||
195 | - if (pm_runtime_barrier(dev) && device_may_wakeup(dev)) | ||
196 | - pm_wakeup_event(dev, 0); | ||
197 | + pm_runtime_barrier(dev); | ||
198 | |||
199 | if (pm_wakeup_pending()) { | ||
200 | dev->power.direct_complete = false; | ||
201 | diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c | ||
202 | index 1c88d97074951..3438b98e60948 100644 | ||
203 | --- a/drivers/edac/ie31200_edac.c | ||
204 | +++ b/drivers/edac/ie31200_edac.c | ||
205 | @@ -145,6 +145,8 @@ | ||
206 | (n << (28 + (2 * skl) - PAGE_SHIFT)) | ||
207 | |||
208 | static int nr_channels; | ||
209 | +static struct pci_dev *mci_pdev; | ||
210 | +static int ie31200_registered = 1; | ||
211 | |||
212 | struct ie31200_priv { | ||
213 | void __iomem *window; | ||
214 | @@ -512,12 +514,16 @@ fail_free: | ||
215 | static int ie31200_init_one(struct pci_dev *pdev, | ||
216 | const struct pci_device_id *ent) | ||
217 | { | ||
218 | - edac_dbg(0, "MC:\n"); | ||
219 | + int rc; | ||
220 | |||
221 | + edac_dbg(0, "MC:\n"); | ||
222 | if (pci_enable_device(pdev) < 0) | ||
223 | return -EIO; | ||
224 | + rc = ie31200_probe1(pdev, ent->driver_data); | ||
225 | + if (rc == 0 && !mci_pdev) | ||
226 | + mci_pdev = pci_dev_get(pdev); | ||
227 | |||
228 | - return ie31200_probe1(pdev, ent->driver_data); | ||
229 | + return rc; | ||
230 | } | ||
231 | |||
232 | static void ie31200_remove_one(struct pci_dev *pdev) | ||
233 | @@ -526,6 +532,8 @@ static void ie31200_remove_one(struct pci_dev *pdev) | ||
234 | struct ie31200_priv *priv; | ||
235 | |||
236 | edac_dbg(0, "\n"); | ||
237 | + pci_dev_put(mci_pdev); | ||
238 | + mci_pdev = NULL; | ||
239 | mci = edac_mc_del_mc(&pdev->dev); | ||
240 | if (!mci) | ||
241 | return; | ||
242 | @@ -574,17 +582,53 @@ static struct pci_driver ie31200_driver = { | ||
243 | |||
244 | static int __init ie31200_init(void) | ||
245 | { | ||
246 | + int pci_rc, i; | ||
247 | + | ||
248 | edac_dbg(3, "MC:\n"); | ||
249 | /* Ensure that the OPSTATE is set correctly for POLL or NMI */ | ||
250 | opstate_init(); | ||
251 | |||
252 | - return pci_register_driver(&ie31200_driver); | ||
253 | + pci_rc = pci_register_driver(&ie31200_driver); | ||
254 | + if (pci_rc < 0) | ||
255 | + goto fail0; | ||
256 | + | ||
257 | + if (!mci_pdev) { | ||
258 | + ie31200_registered = 0; | ||
259 | + for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) { | ||
260 | + mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor, | ||
261 | + ie31200_pci_tbl[i].device, | ||
262 | + NULL); | ||
263 | + if (mci_pdev) | ||
264 | + break; | ||
265 | + } | ||
266 | + if (!mci_pdev) { | ||
267 | + edac_dbg(0, "ie31200 pci_get_device fail\n"); | ||
268 | + pci_rc = -ENODEV; | ||
269 | + goto fail1; | ||
270 | + } | ||
271 | + pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]); | ||
272 | + if (pci_rc < 0) { | ||
273 | + edac_dbg(0, "ie31200 init fail\n"); | ||
274 | + pci_rc = -ENODEV; | ||
275 | + goto fail1; | ||
276 | + } | ||
277 | + } | ||
278 | + return 0; | ||
279 | + | ||
280 | +fail1: | ||
281 | + pci_unregister_driver(&ie31200_driver); | ||
282 | +fail0: | ||
283 | + pci_dev_put(mci_pdev); | ||
284 | + | ||
285 | + return pci_rc; | ||
286 | } | ||
287 | |||
288 | static void __exit ie31200_exit(void) | ||
289 | { | ||
290 | edac_dbg(3, "MC:\n"); | ||
291 | pci_unregister_driver(&ie31200_driver); | ||
292 | + if (!ie31200_registered) | ||
293 | + ie31200_remove_one(mci_pdev); | ||
294 | } | ||
295 | |||
296 | module_init(ie31200_init); | ||
297 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | ||
298 | index e9311eb7b8d9f..694f631d9c90d 100644 | ||
299 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | ||
300 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | ||
301 | @@ -734,8 +734,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) | ||
302 | |||
303 | if (!drm_kms_helper_is_poll_worker()) { | ||
304 | r = pm_runtime_get_sync(connector->dev->dev); | ||
305 | - if (r < 0) | ||
306 | + if (r < 0) { | ||
307 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
308 | return connector_status_disconnected; | ||
309 | + } | ||
310 | } | ||
311 | |||
312 | if (encoder) { | ||
313 | @@ -872,8 +874,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) | ||
314 | |||
315 | if (!drm_kms_helper_is_poll_worker()) { | ||
316 | r = pm_runtime_get_sync(connector->dev->dev); | ||
317 | - if (r < 0) | ||
318 | + if (r < 0) { | ||
319 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
320 | return connector_status_disconnected; | ||
321 | + } | ||
322 | } | ||
323 | |||
324 | encoder = amdgpu_connector_best_single_encoder(connector); | ||
325 | @@ -996,8 +1000,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) | ||
326 | |||
327 | if (!drm_kms_helper_is_poll_worker()) { | ||
328 | r = pm_runtime_get_sync(connector->dev->dev); | ||
329 | - if (r < 0) | ||
330 | + if (r < 0) { | ||
331 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
332 | return connector_status_disconnected; | ||
333 | + } | ||
334 | } | ||
335 | |||
336 | if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { | ||
337 | @@ -1371,8 +1377,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) | ||
338 | |||
339 | if (!drm_kms_helper_is_poll_worker()) { | ||
340 | r = pm_runtime_get_sync(connector->dev->dev); | ||
341 | - if (r < 0) | ||
342 | + if (r < 0) { | ||
343 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
344 | return connector_status_disconnected; | ||
345 | + } | ||
346 | } | ||
347 | |||
348 | if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { | ||
349 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | ||
350 | index 15a2d8f3725d5..fdf7a18058881 100644 | ||
351 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | ||
352 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | ||
353 | @@ -268,7 +268,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set) | ||
354 | |||
355 | ret = pm_runtime_get_sync(dev->dev); | ||
356 | if (ret < 0) | ||
357 | - return ret; | ||
358 | + goto out; | ||
359 | |||
360 | ret = drm_crtc_helper_set_config(set); | ||
361 | |||
362 | @@ -283,7 +283,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set) | ||
363 | take the current one */ | ||
364 | if (active && !adev->have_disp_power_ref) { | ||
365 | adev->have_disp_power_ref = true; | ||
366 | - return ret; | ||
367 | + goto out; | ||
368 | } | ||
369 | /* if we have no active crtcs, then drop the power ref | ||
370 | we got before */ | ||
371 | @@ -292,6 +292,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set) | ||
372 | adev->have_disp_power_ref = false; | ||
373 | } | ||
374 | |||
375 | +out: | ||
376 | /* drop the power reference we got coming in here */ | ||
377 | pm_runtime_put_autosuspend(dev->dev); | ||
378 | return ret; | ||
379 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
380 | index e0890deccb2fe..7cae10fec78de 100644 | ||
381 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
382 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
383 | @@ -633,11 +633,12 @@ long amdgpu_drm_ioctl(struct file *filp, | ||
384 | dev = file_priv->minor->dev; | ||
385 | ret = pm_runtime_get_sync(dev->dev); | ||
386 | if (ret < 0) | ||
387 | - return ret; | ||
388 | + goto out; | ||
389 | |||
390 | ret = drm_ioctl(filp, cmd, arg); | ||
391 | |||
392 | pm_runtime_mark_last_busy(dev->dev); | ||
393 | +out: | ||
394 | pm_runtime_put_autosuspend(dev->dev); | ||
395 | return ret; | ||
396 | } | ||
397 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | ||
398 | index ab5134d920d96..96fc1566f28e5 100644 | ||
399 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | ||
400 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | ||
401 | @@ -543,7 +543,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) | ||
402 | |||
403 | r = pm_runtime_get_sync(dev->dev); | ||
404 | if (r < 0) | ||
405 | - return r; | ||
406 | + goto pm_put; | ||
407 | |||
408 | fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL); | ||
409 | if (unlikely(!fpriv)) { | ||
410 | @@ -566,6 +566,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) | ||
411 | |||
412 | out_suspend: | ||
413 | pm_runtime_mark_last_busy(dev->dev); | ||
414 | +pm_put: | ||
415 | pm_runtime_put_autosuspend(dev->dev); | ||
416 | |||
417 | return r; | ||
418 | diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c | ||
419 | index 8c6e47c5507fb..74221e096855d 100644 | ||
420 | --- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c | ||
421 | +++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c | ||
422 | @@ -841,8 +841,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, | ||
423 | |||
424 | ret = kobject_init_and_add(dev->kobj_node, &node_type, | ||
425 | sys_props.kobj_nodes, "%d", id); | ||
426 | - if (ret < 0) | ||
427 | + if (ret < 0) { | ||
428 | + kobject_put(dev->kobj_node); | ||
429 | return ret; | ||
430 | + } | ||
431 | |||
432 | dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node); | ||
433 | if (!dev->kobj_mem) | ||
434 | @@ -885,8 +887,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, | ||
435 | return -ENOMEM; | ||
436 | ret = kobject_init_and_add(mem->kobj, &mem_type, | ||
437 | dev->kobj_mem, "%d", i); | ||
438 | - if (ret < 0) | ||
439 | + if (ret < 0) { | ||
440 | + kobject_put(mem->kobj); | ||
441 | return ret; | ||
442 | + } | ||
443 | |||
444 | mem->attr.name = "properties"; | ||
445 | mem->attr.mode = KFD_SYSFS_FILE_MODE; | ||
446 | @@ -904,8 +908,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, | ||
447 | return -ENOMEM; | ||
448 | ret = kobject_init_and_add(cache->kobj, &cache_type, | ||
449 | dev->kobj_cache, "%d", i); | ||
450 | - if (ret < 0) | ||
451 | + if (ret < 0) { | ||
452 | + kobject_put(cache->kobj); | ||
453 | return ret; | ||
454 | + } | ||
455 | |||
456 | cache->attr.name = "properties"; | ||
457 | cache->attr.mode = KFD_SYSFS_FILE_MODE; | ||
458 | @@ -923,8 +929,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, | ||
459 | return -ENOMEM; | ||
460 | ret = kobject_init_and_add(iolink->kobj, &iolink_type, | ||
461 | dev->kobj_iolink, "%d", i); | ||
462 | - if (ret < 0) | ||
463 | + if (ret < 0) { | ||
464 | + kobject_put(iolink->kobj); | ||
465 | return ret; | ||
466 | + } | ||
467 | |||
468 | iolink->attr.name = "properties"; | ||
469 | iolink->attr.mode = KFD_SYSFS_FILE_MODE; | ||
470 | @@ -976,8 +984,10 @@ static int kfd_topology_update_sysfs(void) | ||
471 | ret = kobject_init_and_add(sys_props.kobj_topology, | ||
472 | &sysprops_type, &kfd_device->kobj, | ||
473 | "topology"); | ||
474 | - if (ret < 0) | ||
475 | + if (ret < 0) { | ||
476 | + kobject_put(sys_props.kobj_topology); | ||
477 | return ret; | ||
478 | + } | ||
479 | |||
480 | sys_props.kobj_nodes = kobject_create_and_add("nodes", | ||
481 | sys_props.kobj_topology); | ||
482 | diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
483 | index 5bfae1f972c74..0061deca290a4 100644 | ||
484 | --- a/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
485 | +++ b/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
486 | @@ -281,8 +281,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) | ||
487 | pm_runtime_get_noresume(dev->dev); | ||
488 | } else { | ||
489 | ret = pm_runtime_get_sync(dev->dev); | ||
490 | - if (ret < 0 && ret != -EACCES) | ||
491 | + if (ret < 0 && ret != -EACCES) { | ||
492 | + pm_runtime_put_autosuspend(dev->dev); | ||
493 | return conn_status; | ||
494 | + } | ||
495 | } | ||
496 | |||
497 | nv_encoder = nouveau_connector_ddc_detect(connector); | ||
498 | diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c | ||
499 | index 275abc424ce25..40da9143f7220 100644 | ||
500 | --- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c | ||
501 | +++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c | ||
502 | @@ -183,8 +183,10 @@ nouveau_fbcon_open(struct fb_info *info, int user) | ||
503 | struct nouveau_fbdev *fbcon = info->par; | ||
504 | struct nouveau_drm *drm = nouveau_drm(fbcon->dev); | ||
505 | int ret = pm_runtime_get_sync(drm->dev->dev); | ||
506 | - if (ret < 0 && ret != -EACCES) | ||
507 | + if (ret < 0 && ret != -EACCES) { | ||
508 | + pm_runtime_put(drm->dev->dev); | ||
509 | return ret; | ||
510 | + } | ||
511 | return 0; | ||
512 | } | ||
513 | |||
514 | diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c | ||
515 | index efa875120071a..9e6c2be0cc7d4 100644 | ||
516 | --- a/drivers/gpu/drm/radeon/radeon_connectors.c | ||
517 | +++ b/drivers/gpu/drm/radeon/radeon_connectors.c | ||
518 | @@ -892,8 +892,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) | ||
519 | |||
520 | if (!drm_kms_helper_is_poll_worker()) { | ||
521 | r = pm_runtime_get_sync(connector->dev->dev); | ||
522 | - if (r < 0) | ||
523 | + if (r < 0) { | ||
524 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
525 | return connector_status_disconnected; | ||
526 | + } | ||
527 | } | ||
528 | |||
529 | if (encoder) { | ||
530 | @@ -1038,8 +1040,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force) | ||
531 | |||
532 | if (!drm_kms_helper_is_poll_worker()) { | ||
533 | r = pm_runtime_get_sync(connector->dev->dev); | ||
534 | - if (r < 0) | ||
535 | + if (r < 0) { | ||
536 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
537 | return connector_status_disconnected; | ||
538 | + } | ||
539 | } | ||
540 | |||
541 | encoder = radeon_best_single_encoder(connector); | ||
542 | @@ -1176,8 +1180,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force) | ||
543 | |||
544 | if (!drm_kms_helper_is_poll_worker()) { | ||
545 | r = pm_runtime_get_sync(connector->dev->dev); | ||
546 | - if (r < 0) | ||
547 | + if (r < 0) { | ||
548 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
549 | return connector_status_disconnected; | ||
550 | + } | ||
551 | } | ||
552 | |||
553 | encoder = radeon_best_single_encoder(connector); | ||
554 | @@ -1260,8 +1266,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) | ||
555 | |||
556 | if (!drm_kms_helper_is_poll_worker()) { | ||
557 | r = pm_runtime_get_sync(connector->dev->dev); | ||
558 | - if (r < 0) | ||
559 | + if (r < 0) { | ||
560 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
561 | return connector_status_disconnected; | ||
562 | + } | ||
563 | } | ||
564 | |||
565 | if (radeon_connector->detected_hpd_without_ddc) { | ||
566 | @@ -1701,8 +1709,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force) | ||
567 | |||
568 | if (!drm_kms_helper_is_poll_worker()) { | ||
569 | r = pm_runtime_get_sync(connector->dev->dev); | ||
570 | - if (r < 0) | ||
571 | + if (r < 0) { | ||
572 | + pm_runtime_put_autosuspend(connector->dev->dev); | ||
573 | return connector_status_disconnected; | ||
574 | + } | ||
575 | } | ||
576 | |||
577 | if (!force && radeon_check_hpd_status_unchanged(connector)) { | ||
578 | diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c | ||
579 | index 850527d5fab1b..606fd875740c0 100644 | ||
580 | --- a/drivers/hid/i2c-hid/i2c-hid-core.c | ||
581 | +++ b/drivers/hid/i2c-hid/i2c-hid-core.c | ||
582 | @@ -407,6 +407,19 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state) | ||
583 | dev_err(&client->dev, "failed to change power setting.\n"); | ||
584 | |||
585 | set_pwr_exit: | ||
586 | + | ||
587 | + /* | ||
588 | + * The HID over I2C specification states that if a DEVICE needs time | ||
589 | + * after the PWR_ON request, it should utilise CLOCK stretching. | ||
590 | + * However, it has been observered that the Windows driver provides a | ||
591 | + * 1ms sleep between the PWR_ON and RESET requests. | ||
592 | + * According to Goodix Windows even waits 60 ms after (other?) | ||
593 | + * PWR_ON requests. Testing has confirmed that several devices | ||
594 | + * will not work properly without a delay after a PWR_ON request. | ||
595 | + */ | ||
596 | + if (!ret && power_state == I2C_HID_PWR_ON) | ||
597 | + msleep(60); | ||
598 | + | ||
599 | return ret; | ||
600 | } | ||
601 | |||
602 | @@ -428,15 +441,6 @@ static int i2c_hid_hwreset(struct i2c_client *client) | ||
603 | if (ret) | ||
604 | goto out_unlock; | ||
605 | |||
606 | - /* | ||
607 | - * The HID over I2C specification states that if a DEVICE needs time | ||
608 | - * after the PWR_ON request, it should utilise CLOCK stretching. | ||
609 | - * However, it has been observered that the Windows driver provides a | ||
610 | - * 1ms sleep between the PWR_ON and RESET requests and that some devices | ||
611 | - * rely on this. | ||
612 | - */ | ||
613 | - usleep_range(1000, 5000); | ||
614 | - | ||
615 | i2c_hid_dbg(ihid, "resetting...\n"); | ||
616 | |||
617 | ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0); | ||
618 | diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c | ||
619 | index dbdd265075daf..7bce23a43907e 100644 | ||
620 | --- a/drivers/hid/usbhid/hiddev.c | ||
621 | +++ b/drivers/hid/usbhid/hiddev.c | ||
622 | @@ -554,12 +554,16 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, | ||
623 | |||
624 | switch (cmd) { | ||
625 | case HIDIOCGUSAGE: | ||
626 | + if (uref->usage_index >= field->report_count) | ||
627 | + goto inval; | ||
628 | uref->value = field->value[uref->usage_index]; | ||
629 | if (copy_to_user(user_arg, uref, sizeof(*uref))) | ||
630 | goto fault; | ||
631 | goto goodreturn; | ||
632 | |||
633 | case HIDIOCSUSAGE: | ||
634 | + if (uref->usage_index >= field->report_count) | ||
635 | + goto inval; | ||
636 | field->value[uref->usage_index] = uref->value; | ||
637 | goto goodreturn; | ||
638 | |||
639 | diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c | ||
640 | index 4231673435e7b..6be02da2ccc46 100644 | ||
641 | --- a/drivers/i2c/busses/i2c-rcar.c | ||
642 | +++ b/drivers/i2c/busses/i2c-rcar.c | ||
643 | @@ -534,6 +534,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) | ||
644 | /* master sent stop */ | ||
645 | if (ssr_filtered & SSR) { | ||
646 | i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); | ||
647 | + rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ | ||
648 | rcar_i2c_write(priv, ICSIER, SAR); | ||
649 | rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); | ||
650 | } | ||
651 | diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c | ||
652 | index f106fd9782bfb..99c36a5438a75 100644 | ||
653 | --- a/drivers/iommu/iova.c | ||
654 | +++ b/drivers/iommu/iova.c | ||
655 | @@ -676,7 +676,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad) | ||
656 | for (i = 0 ; i < mag->size; ++i) { | ||
657 | struct iova *iova = private_find_iova(iovad, mag->pfns[i]); | ||
658 | |||
659 | - BUG_ON(!iova); | ||
660 | + if (WARN_ON(!iova)) | ||
661 | + continue; | ||
662 | + | ||
663 | private_free_iova(iovad, iova); | ||
664 | } | ||
665 | |||
666 | diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c | ||
667 | index 29deda7aed040..2d3ff028f50c9 100644 | ||
668 | --- a/drivers/md/dm-table.c | ||
669 | +++ b/drivers/md/dm-table.c | ||
670 | @@ -510,14 +510,14 @@ static int adjoin(struct dm_table *table, struct dm_target *ti) | ||
671 | * On the other hand, dm-switch needs to process bulk data using messages and | ||
672 | * excessive use of GFP_NOIO could cause trouble. | ||
673 | */ | ||
674 | -static char **realloc_argv(unsigned *array_size, char **old_argv) | ||
675 | +static char **realloc_argv(unsigned *size, char **old_argv) | ||
676 | { | ||
677 | char **argv; | ||
678 | unsigned new_size; | ||
679 | gfp_t gfp; | ||
680 | |||
681 | - if (*array_size) { | ||
682 | - new_size = *array_size * 2; | ||
683 | + if (*size) { | ||
684 | + new_size = *size * 2; | ||
685 | gfp = GFP_KERNEL; | ||
686 | } else { | ||
687 | new_size = 8; | ||
688 | @@ -525,8 +525,8 @@ static char **realloc_argv(unsigned *array_size, char **old_argv) | ||
689 | } | ||
690 | argv = kmalloc(new_size * sizeof(*argv), gfp); | ||
691 | if (argv) { | ||
692 | - memcpy(argv, old_argv, *array_size * sizeof(*argv)); | ||
693 | - *array_size = new_size; | ||
694 | + memcpy(argv, old_argv, *size * sizeof(*argv)); | ||
695 | + *size = new_size; | ||
696 | } | ||
697 | |||
698 | kfree(old_argv); | ||
699 | diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c | ||
700 | index 382caf200ba16..c313f51688f44 100644 | ||
701 | --- a/drivers/media/pci/ttpci/av7110.c | ||
702 | +++ b/drivers/media/pci/ttpci/av7110.c | ||
703 | @@ -426,14 +426,15 @@ static void debiirq(unsigned long cookie) | ||
704 | case DATA_CI_GET: | ||
705 | { | ||
706 | u8 *data = av7110->debi_virt; | ||
707 | + u8 data_0 = data[0]; | ||
708 | |||
709 | - if ((data[0] < 2) && data[2] == 0xff) { | ||
710 | + if (data_0 < 2 && data[2] == 0xff) { | ||
711 | int flags = 0; | ||
712 | if (data[5] > 0) | ||
713 | flags |= CA_CI_MODULE_PRESENT; | ||
714 | if (data[5] > 5) | ||
715 | flags |= CA_CI_MODULE_READY; | ||
716 | - av7110->ci_slot[data[0]].flags = flags; | ||
717 | + av7110->ci_slot[data_0].flags = flags; | ||
718 | } else | ||
719 | ci_get_data(&av7110->ci_rbuffer, | ||
720 | av7110->debi_virt, | ||
721 | diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c | ||
722 | index 5104cc0ee40e3..a3c4cc025ed6f 100644 | ||
723 | --- a/drivers/media/platform/davinci/vpif_capture.c | ||
724 | +++ b/drivers/media/platform/davinci/vpif_capture.c | ||
725 | @@ -1408,8 +1408,6 @@ probe_out: | ||
726 | /* Unregister video device */ | ||
727 | video_unregister_device(&ch->video_dev); | ||
728 | } | ||
729 | - kfree(vpif_obj.sd); | ||
730 | - v4l2_device_unregister(&vpif_obj.v4l2_dev); | ||
731 | |||
732 | return err; | ||
733 | } | ||
734 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c | ||
735 | index d52fd842ef1fe..8322129c3f987 100644 | ||
736 | --- a/drivers/net/bonding/bond_main.c | ||
737 | +++ b/drivers/net/bonding/bond_main.c | ||
738 | @@ -1985,7 +1985,8 @@ static int bond_release_and_destroy(struct net_device *bond_dev, | ||
739 | int ret; | ||
740 | |||
741 | ret = bond_release(bond_dev, slave_dev); | ||
742 | - if (ret == 0 && !bond_has_slaves(bond)) { | ||
743 | + if (ret == 0 && !bond_has_slaves(bond) && | ||
744 | + bond_dev->reg_state != NETREG_UNREGISTERING) { | ||
745 | bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; | ||
746 | netdev_info(bond_dev, "Destroying bond %s\n", | ||
747 | bond_dev->name); | ||
748 | @@ -4131,13 +4132,23 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev) | ||
749 | return ret; | ||
750 | } | ||
751 | |||
752 | +static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed) | ||
753 | +{ | ||
754 | + if (speed == 0 || speed == SPEED_UNKNOWN) | ||
755 | + speed = slave->speed; | ||
756 | + else | ||
757 | + speed = min(speed, slave->speed); | ||
758 | + | ||
759 | + return speed; | ||
760 | +} | ||
761 | + | ||
762 | static int bond_ethtool_get_settings(struct net_device *bond_dev, | ||
763 | struct ethtool_cmd *ecmd) | ||
764 | { | ||
765 | struct bonding *bond = netdev_priv(bond_dev); | ||
766 | - unsigned long speed = 0; | ||
767 | struct list_head *iter; | ||
768 | struct slave *slave; | ||
769 | + u32 speed = 0; | ||
770 | |||
771 | ecmd->duplex = DUPLEX_UNKNOWN; | ||
772 | ecmd->port = PORT_OTHER; | ||
773 | @@ -4149,8 +4160,13 @@ static int bond_ethtool_get_settings(struct net_device *bond_dev, | ||
774 | */ | ||
775 | bond_for_each_slave(bond, slave, iter) { | ||
776 | if (bond_slave_can_tx(slave)) { | ||
777 | - if (slave->speed != SPEED_UNKNOWN) | ||
778 | - speed += slave->speed; | ||
779 | + if (slave->speed != SPEED_UNKNOWN) { | ||
780 | + if (BOND_MODE(bond) == BOND_MODE_BROADCAST) | ||
781 | + speed = bond_mode_bcast_speed(slave, | ||
782 | + speed); | ||
783 | + else | ||
784 | + speed += slave->speed; | ||
785 | + } | ||
786 | if (ecmd->duplex == DUPLEX_UNKNOWN && | ||
787 | slave->duplex != DUPLEX_UNKNOWN) | ||
788 | ecmd->duplex = slave->duplex; | ||
789 | diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c | ||
790 | index b665d27f8e299..95ab44aa0eeab 100644 | ||
791 | --- a/drivers/net/ethernet/freescale/gianfar.c | ||
792 | +++ b/drivers/net/ethernet/freescale/gianfar.c | ||
793 | @@ -844,8 +844,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev) | ||
794 | continue; | ||
795 | |||
796 | err = gfar_parse_group(child, priv, model); | ||
797 | - if (err) | ||
798 | + if (err) { | ||
799 | + of_node_put(child); | ||
800 | goto err_grp_init; | ||
801 | + } | ||
802 | } | ||
803 | } else { /* SQ_SG_MODE */ | ||
804 | err = gfar_parse_group(np, priv, model); | ||
805 | diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c | ||
806 | index 72f37e546ed24..ac757819cadb5 100644 | ||
807 | --- a/drivers/net/ipvlan/ipvlan_main.c | ||
808 | +++ b/drivers/net/ipvlan/ipvlan_main.c | ||
809 | @@ -168,12 +168,21 @@ static void ipvlan_port_destroy(struct net_device *dev) | ||
810 | kfree_rcu(port, rcu); | ||
811 | } | ||
812 | |||
813 | +#define IPVLAN_ALWAYS_ON_OFLOADS \ | ||
814 | + (NETIF_F_SG | NETIF_F_HW_CSUM | \ | ||
815 | + NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL) | ||
816 | + | ||
817 | +#define IPVLAN_ALWAYS_ON \ | ||
818 | + (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED) | ||
819 | + | ||
820 | #define IPVLAN_FEATURES \ | ||
821 | (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \ | ||
822 | NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_GSO_ROBUST | \ | ||
823 | NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \ | ||
824 | NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER) | ||
825 | |||
826 | + /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */ | ||
827 | + | ||
828 | #define IPVLAN_STATE_MASK \ | ||
829 | ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT)) | ||
830 | |||
831 | @@ -186,7 +195,9 @@ static int ipvlan_init(struct net_device *dev) | ||
832 | dev->state = (dev->state & ~IPVLAN_STATE_MASK) | | ||
833 | (phy_dev->state & IPVLAN_STATE_MASK); | ||
834 | dev->features = phy_dev->features & IPVLAN_FEATURES; | ||
835 | - dev->features |= NETIF_F_LLTX; | ||
836 | + dev->features |= IPVLAN_ALWAYS_ON; | ||
837 | + dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES; | ||
838 | + dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS; | ||
839 | dev->gso_max_size = phy_dev->gso_max_size; | ||
840 | dev->gso_max_segs = phy_dev->gso_max_segs; | ||
841 | dev->hard_header_len = phy_dev->hard_header_len; | ||
842 | @@ -274,7 +285,14 @@ static netdev_features_t ipvlan_fix_features(struct net_device *dev, | ||
843 | { | ||
844 | struct ipvl_dev *ipvlan = netdev_priv(dev); | ||
845 | |||
846 | - return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES); | ||
847 | + features |= NETIF_F_ALL_FOR_ALL; | ||
848 | + features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES); | ||
849 | + features = netdev_increment_features(ipvlan->phy_dev->features, | ||
850 | + features, features); | ||
851 | + features |= IPVLAN_ALWAYS_ON; | ||
852 | + features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON); | ||
853 | + | ||
854 | + return features; | ||
855 | } | ||
856 | |||
857 | static void ipvlan_change_rx_flags(struct net_device *dev, int change) | ||
858 | @@ -675,10 +693,9 @@ static int ipvlan_device_event(struct notifier_block *unused, | ||
859 | |||
860 | case NETDEV_FEAT_CHANGE: | ||
861 | list_for_each_entry(ipvlan, &port->ipvlans, pnode) { | ||
862 | - ipvlan->dev->features = dev->features & IPVLAN_FEATURES; | ||
863 | ipvlan->dev->gso_max_size = dev->gso_max_size; | ||
864 | ipvlan->dev->gso_max_segs = dev->gso_max_segs; | ||
865 | - netdev_features_change(ipvlan->dev); | ||
866 | + netdev_update_features(ipvlan->dev); | ||
867 | } | ||
868 | break; | ||
869 | |||
870 | diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h | ||
871 | index 6038b7486f1db..e04e0260035ad 100644 | ||
872 | --- a/drivers/net/wireless/ath/ath10k/hw.h | ||
873 | +++ b/drivers/net/wireless/ath/ath10k/hw.h | ||
874 | @@ -558,7 +558,7 @@ ath10k_rx_desc_get_l3_pad_bytes(struct ath10k_hw_params *hw, | ||
875 | |||
876 | #define TARGET_10_4_TX_DBG_LOG_SIZE 1024 | ||
877 | #define TARGET_10_4_NUM_WDS_ENTRIES 32 | ||
878 | -#define TARGET_10_4_DMA_BURST_SIZE 0 | ||
879 | +#define TARGET_10_4_DMA_BURST_SIZE 1 | ||
880 | #define TARGET_10_4_MAC_AGGR_DELIM 0 | ||
881 | #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1 | ||
882 | #define TARGET_10_4_VOW_CONFIG 0 | ||
883 | diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c | ||
884 | index 93b22a5b6878e..e524573aa8a09 100644 | ||
885 | --- a/drivers/net/wireless/realtek/rtlwifi/usb.c | ||
886 | +++ b/drivers/net/wireless/realtek/rtlwifi/usb.c | ||
887 | @@ -752,8 +752,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw) | ||
888 | |||
889 | usb_anchor_urb(urb, &rtlusb->rx_submitted); | ||
890 | err = usb_submit_urb(urb, GFP_KERNEL); | ||
891 | - if (err) | ||
892 | + if (err) { | ||
893 | + usb_unanchor_urb(urb); | ||
894 | + usb_free_urb(urb); | ||
895 | goto err_out; | ||
896 | + } | ||
897 | usb_free_urb(urb); | ||
898 | } | ||
899 | return 0; | ||
900 | diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c | ||
901 | index 429d34c348b9f..01a343ad7155c 100644 | ||
902 | --- a/drivers/pci/slot.c | ||
903 | +++ b/drivers/pci/slot.c | ||
904 | @@ -303,13 +303,16 @@ placeholder: | ||
905 | slot_name = make_slot_name(name); | ||
906 | if (!slot_name) { | ||
907 | err = -ENOMEM; | ||
908 | + kfree(slot); | ||
909 | goto err; | ||
910 | } | ||
911 | |||
912 | err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL, | ||
913 | "%s", slot_name); | ||
914 | - if (err) | ||
915 | + if (err) { | ||
916 | + kobject_put(&slot->kobj); | ||
917 | goto err; | ||
918 | + } | ||
919 | |||
920 | INIT_LIST_HEAD(&slot->list); | ||
921 | list_add(&slot->list, &parent->slots); | ||
922 | @@ -328,7 +331,6 @@ out: | ||
923 | mutex_unlock(&pci_slot_mutex); | ||
924 | return slot; | ||
925 | err: | ||
926 | - kfree(slot); | ||
927 | slot = ERR_PTR(err); | ||
928 | goto out; | ||
929 | } | ||
930 | diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c | ||
931 | index 39a2b0cde9e42..d81fdcd6a1fe0 100644 | ||
932 | --- a/drivers/s390/cio/css.c | ||
933 | +++ b/drivers/s390/cio/css.c | ||
934 | @@ -529,6 +529,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data) | ||
935 | rc = css_evaluate_known_subchannel(sch, 1); | ||
936 | if (rc == -EAGAIN) | ||
937 | css_schedule_eval(sch->schid); | ||
938 | + /* | ||
939 | + * The loop might take long time for platforms with lots of | ||
940 | + * known devices. Allow scheduling here. | ||
941 | + */ | ||
942 | + cond_resched(); | ||
943 | } | ||
944 | return 0; | ||
945 | } | ||
946 | diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c | ||
947 | index 3c2f34db937b6..f5f3a8113bc55 100644 | ||
948 | --- a/drivers/scsi/fcoe/fcoe_ctlr.c | ||
949 | +++ b/drivers/scsi/fcoe/fcoe_ctlr.c | ||
950 | @@ -267,9 +267,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new) | ||
951 | WARN_ON(!fcf_dev); | ||
952 | new->fcf_dev = NULL; | ||
953 | fcoe_fcf_device_delete(fcf_dev); | ||
954 | - kfree(new); | ||
955 | mutex_unlock(&cdev->lock); | ||
956 | } | ||
957 | + kfree(new); | ||
958 | } | ||
959 | |||
960 | /** | ||
961 | diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c | ||
962 | index e18bbc66e83b1..77cb16d8dfd35 100644 | ||
963 | --- a/drivers/scsi/lpfc/lpfc_vport.c | ||
964 | +++ b/drivers/scsi/lpfc/lpfc_vport.c | ||
965 | @@ -624,27 +624,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport) | ||
966 | vport->port_state < LPFC_VPORT_READY) | ||
967 | return -EAGAIN; | ||
968 | } | ||
969 | + | ||
970 | /* | ||
971 | - * This is a bit of a mess. We want to ensure the shost doesn't get | ||
972 | - * torn down until we're done with the embedded lpfc_vport structure. | ||
973 | - * | ||
974 | - * Beyond holding a reference for this function, we also need a | ||
975 | - * reference for outstanding I/O requests we schedule during delete | ||
976 | - * processing. But once we scsi_remove_host() we can no longer obtain | ||
977 | - * a reference through scsi_host_get(). | ||
978 | - * | ||
979 | - * So we take two references here. We release one reference at the | ||
980 | - * bottom of the function -- after delinking the vport. And we | ||
981 | - * release the other at the completion of the unreg_vpi that get's | ||
982 | - * initiated after we've disposed of all other resources associated | ||
983 | - * with the port. | ||
984 | + * Take early refcount for outstanding I/O requests we schedule during | ||
985 | + * delete processing for unreg_vpi. Always keep this before | ||
986 | + * scsi_remove_host() as we can no longer obtain a reference through | ||
987 | + * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL. | ||
988 | */ | ||
989 | if (!scsi_host_get(shost)) | ||
990 | return VPORT_INVAL; | ||
991 | - if (!scsi_host_get(shost)) { | ||
992 | - scsi_host_put(shost); | ||
993 | - return VPORT_INVAL; | ||
994 | - } | ||
995 | + | ||
996 | lpfc_free_sysfs_attr(vport); | ||
997 | |||
998 | lpfc_debugfs_terminate(vport); | ||
999 | @@ -792,8 +781,9 @@ skip_logo: | ||
1000 | if (!(vport->vpi_state & LPFC_VPI_REGISTERED) || | ||
1001 | lpfc_mbx_unreg_vpi(vport)) | ||
1002 | scsi_host_put(shost); | ||
1003 | - } else | ||
1004 | + } else { | ||
1005 | scsi_host_put(shost); | ||
1006 | + } | ||
1007 | |||
1008 | lpfc_free_vpi(phba, vport->vpi); | ||
1009 | vport->work_port_events = 0; | ||
1010 | diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c | ||
1011 | index 42b97f1196232..c2bce3f6eaace 100644 | ||
1012 | --- a/drivers/scsi/scsi_transport_iscsi.c | ||
1013 | +++ b/drivers/scsi/scsi_transport_iscsi.c | ||
1014 | @@ -3191,7 +3191,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport, | ||
1015 | pr_err("%s could not find host no %u\n", | ||
1016 | __func__, ev->u.set_flashnode.host_no); | ||
1017 | err = -ENODEV; | ||
1018 | - goto put_host; | ||
1019 | + goto exit_set_fnode; | ||
1020 | } | ||
1021 | |||
1022 | idx = ev->u.set_flashnode.flashnode_idx; | ||
1023 | diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c | ||
1024 | index a7f520581cb0f..ad5f2e2b4cbaf 100644 | ||
1025 | --- a/drivers/scsi/ufs/ufshcd.c | ||
1026 | +++ b/drivers/scsi/ufs/ufshcd.c | ||
1027 | @@ -659,6 +659,7 @@ unblock_reqs: | ||
1028 | int ufshcd_hold(struct ufs_hba *hba, bool async) | ||
1029 | { | ||
1030 | int rc = 0; | ||
1031 | + bool flush_result; | ||
1032 | unsigned long flags; | ||
1033 | |||
1034 | if (!ufshcd_is_clkgating_allowed(hba)) | ||
1035 | @@ -690,7 +691,9 @@ start: | ||
1036 | break; | ||
1037 | } | ||
1038 | spin_unlock_irqrestore(hba->host->host_lock, flags); | ||
1039 | - flush_work(&hba->clk_gating.ungate_work); | ||
1040 | + flush_result = flush_work(&hba->clk_gating.ungate_work); | ||
1041 | + if (hba->clk_gating.is_suspended && !flush_result) | ||
1042 | + goto out; | ||
1043 | spin_lock_irqsave(hba->host->host_lock, flags); | ||
1044 | goto start; | ||
1045 | } | ||
1046 | @@ -4397,7 +4400,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status) | ||
1047 | */ | ||
1048 | static irqreturn_t ufshcd_intr(int irq, void *__hba) | ||
1049 | { | ||
1050 | - u32 intr_status, enabled_intr_status; | ||
1051 | + u32 intr_status, enabled_intr_status = 0; | ||
1052 | irqreturn_t retval = IRQ_NONE; | ||
1053 | struct ufs_hba *hba = __hba; | ||
1054 | int retries = hba->nutrs; | ||
1055 | @@ -4411,7 +4414,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) | ||
1056 | * read, make sure we handle them by checking the interrupt status | ||
1057 | * again in a loop until we process all of the reqs before returning. | ||
1058 | */ | ||
1059 | - do { | ||
1060 | + while (intr_status && retries--) { | ||
1061 | enabled_intr_status = | ||
1062 | intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE); | ||
1063 | if (intr_status) | ||
1064 | @@ -4422,7 +4425,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) | ||
1065 | } | ||
1066 | |||
1067 | intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS); | ||
1068 | - } while (intr_status && --retries); | ||
1069 | + } | ||
1070 | |||
1071 | spin_unlock(hba->host->host_lock); | ||
1072 | return retval; | ||
1073 | diff --git a/drivers/staging/media/cec/cec-api.c b/drivers/staging/media/cec/cec-api.c | ||
1074 | index e274e2f223986..264bb7d1efcb8 100644 | ||
1075 | --- a/drivers/staging/media/cec/cec-api.c | ||
1076 | +++ b/drivers/staging/media/cec/cec-api.c | ||
1077 | @@ -141,7 +141,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap, | ||
1078 | struct cec_log_addrs log_addrs; | ||
1079 | |||
1080 | mutex_lock(&adap->lock); | ||
1081 | - log_addrs = adap->log_addrs; | ||
1082 | + /* | ||
1083 | + * We use memcpy here instead of assignment since there is a | ||
1084 | + * hole at the end of struct cec_log_addrs that an assignment | ||
1085 | + * might ignore. So when we do copy_to_user() we could leak | ||
1086 | + * one byte of memory. | ||
1087 | + */ | ||
1088 | + memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs)); | ||
1089 | if (!adap->is_configured) | ||
1090 | memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID, | ||
1091 | sizeof(log_addrs.log_addr)); | ||
1092 | diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c | ||
1093 | index 1a83456a65a00..693fbb2858404 100644 | ||
1094 | --- a/drivers/target/target_core_user.c | ||
1095 | +++ b/drivers/target/target_core_user.c | ||
1096 | @@ -666,7 +666,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) | ||
1097 | struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned; | ||
1098 | struct tcmu_cmd *cmd; | ||
1099 | |||
1100 | - tcmu_flush_dcache_range(entry, sizeof(*entry)); | ||
1101 | + /* | ||
1102 | + * Flush max. up to end of cmd ring since current entry might | ||
1103 | + * be a padding that is shorter than sizeof(*entry) | ||
1104 | + */ | ||
1105 | + size_t ring_left = head_to_end(udev->cmdr_last_cleaned, | ||
1106 | + udev->cmdr_size); | ||
1107 | + tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ? | ||
1108 | + ring_left : sizeof(*entry)); | ||
1109 | |||
1110 | if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) { | ||
1111 | UPDATE_HEAD(udev->cmdr_last_cleaned, | ||
1112 | diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c | ||
1113 | index c7a7574172fae..5641b877dca53 100644 | ||
1114 | --- a/drivers/tty/serial/8250/8250_port.c | ||
1115 | +++ b/drivers/tty/serial/8250/8250_port.c | ||
1116 | @@ -2205,6 +2205,10 @@ int serial8250_do_startup(struct uart_port *port) | ||
1117 | |||
1118 | if (port->irq) { | ||
1119 | unsigned char iir1; | ||
1120 | + | ||
1121 | + if (port->irqflags & IRQF_SHARED) | ||
1122 | + disable_irq_nosync(port->irq); | ||
1123 | + | ||
1124 | /* | ||
1125 | * Test for UARTs that do not reassert THRE when the | ||
1126 | * transmitter is idle and the interrupt has already | ||
1127 | @@ -2214,8 +2218,6 @@ int serial8250_do_startup(struct uart_port *port) | ||
1128 | * allow register changes to become visible. | ||
1129 | */ | ||
1130 | spin_lock_irqsave(&port->lock, flags); | ||
1131 | - if (up->port.irqflags & IRQF_SHARED) | ||
1132 | - disable_irq_nosync(port->irq); | ||
1133 | |||
1134 | wait_for_xmitr(up, UART_LSR_THRE); | ||
1135 | serial_port_out_sync(port, UART_IER, UART_IER_THRI); | ||
1136 | @@ -2227,9 +2229,10 @@ int serial8250_do_startup(struct uart_port *port) | ||
1137 | iir = serial_port_in(port, UART_IIR); | ||
1138 | serial_port_out(port, UART_IER, 0); | ||
1139 | |||
1140 | + spin_unlock_irqrestore(&port->lock, flags); | ||
1141 | + | ||
1142 | if (port->irqflags & IRQF_SHARED) | ||
1143 | enable_irq(port->irq); | ||
1144 | - spin_unlock_irqrestore(&port->lock, flags); | ||
1145 | |||
1146 | /* | ||
1147 | * If the interrupt is not reasserted, or we otherwise | ||
1148 | diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c | ||
1149 | index b3b9b3d2cddf9..6e27dee3876a4 100644 | ||
1150 | --- a/drivers/tty/serial/amba-pl011.c | ||
1151 | +++ b/drivers/tty/serial/amba-pl011.c | ||
1152 | @@ -2249,9 +2249,8 @@ pl011_console_write(struct console *co, const char *s, unsigned int count) | ||
1153 | clk_disable(uap->clk); | ||
1154 | } | ||
1155 | |||
1156 | -static void __init | ||
1157 | -pl011_console_get_options(struct uart_amba_port *uap, int *baud, | ||
1158 | - int *parity, int *bits) | ||
1159 | +static void pl011_console_get_options(struct uart_amba_port *uap, int *baud, | ||
1160 | + int *parity, int *bits) | ||
1161 | { | ||
1162 | if (pl011_read(uap, REG_CR) & UART01x_CR_UARTEN) { | ||
1163 | unsigned int lcr_h, ibrd, fbrd; | ||
1164 | @@ -2284,7 +2283,7 @@ pl011_console_get_options(struct uart_amba_port *uap, int *baud, | ||
1165 | } | ||
1166 | } | ||
1167 | |||
1168 | -static int __init pl011_console_setup(struct console *co, char *options) | ||
1169 | +static int pl011_console_setup(struct console *co, char *options) | ||
1170 | { | ||
1171 | struct uart_amba_port *uap; | ||
1172 | int baud = 38400; | ||
1173 | @@ -2352,8 +2351,8 @@ static int __init pl011_console_setup(struct console *co, char *options) | ||
1174 | * | ||
1175 | * Returns 0 if console matches; otherwise non-zero to use default matching | ||
1176 | */ | ||
1177 | -static int __init pl011_console_match(struct console *co, char *name, int idx, | ||
1178 | - char *options) | ||
1179 | +static int pl011_console_match(struct console *co, char *name, int idx, | ||
1180 | + char *options) | ||
1181 | { | ||
1182 | unsigned char iotype; | ||
1183 | resource_size_t addr; | ||
1184 | @@ -2533,7 +2532,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap, | ||
1185 | |||
1186 | static int pl011_register_port(struct uart_amba_port *uap) | ||
1187 | { | ||
1188 | - int ret; | ||
1189 | + int ret, i; | ||
1190 | |||
1191 | /* Ensure interrupts from this UART are masked and cleared */ | ||
1192 | pl011_write(0, uap, REG_IMSC); | ||
1193 | @@ -2544,6 +2543,9 @@ static int pl011_register_port(struct uart_amba_port *uap) | ||
1194 | if (ret < 0) { | ||
1195 | dev_err(uap->port.dev, | ||
1196 | "Failed to register AMBA-PL011 driver\n"); | ||
1197 | + for (i = 0; i < ARRAY_SIZE(amba_ports); i++) | ||
1198 | + if (amba_ports[i] == uap) | ||
1199 | + amba_ports[i] = NULL; | ||
1200 | return ret; | ||
1201 | } | ||
1202 | } | ||
1203 | diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c | ||
1204 | index 01ff8ec780237..4dfdb59061bea 100644 | ||
1205 | --- a/drivers/tty/serial/samsung.c | ||
1206 | +++ b/drivers/tty/serial/samsung.c | ||
1207 | @@ -1725,9 +1725,11 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, | ||
1208 | ourport->tx_irq = ret + 1; | ||
1209 | } | ||
1210 | |||
1211 | - ret = platform_get_irq(platdev, 1); | ||
1212 | - if (ret > 0) | ||
1213 | - ourport->tx_irq = ret; | ||
1214 | + if (!s3c24xx_serial_has_interrupt_mask(port)) { | ||
1215 | + ret = platform_get_irq(platdev, 1); | ||
1216 | + if (ret > 0) | ||
1217 | + ourport->tx_irq = ret; | ||
1218 | + } | ||
1219 | /* | ||
1220 | * DMA is currently supported only on DT platforms, if DMA properties | ||
1221 | * are specified. | ||
1222 | diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c | ||
1223 | index 3e5a3614fad03..1f00f42213c27 100644 | ||
1224 | --- a/drivers/tty/vt/vt.c | ||
1225 | +++ b/drivers/tty/vt/vt.c | ||
1226 | @@ -868,7 +868,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, | ||
1227 | unsigned int old_rows, old_row_size; | ||
1228 | unsigned int new_cols, new_rows, new_row_size, new_screen_size; | ||
1229 | unsigned int user; | ||
1230 | - unsigned short *newscreen; | ||
1231 | + unsigned short *oldscreen, *newscreen; | ||
1232 | |||
1233 | WARN_CONSOLE_UNLOCKED(); | ||
1234 | |||
1235 | @@ -950,10 +950,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, | ||
1236 | if (new_scr_end > new_origin) | ||
1237 | scr_memsetw((void *)new_origin, vc->vc_video_erase_char, | ||
1238 | new_scr_end - new_origin); | ||
1239 | - kfree(vc->vc_screenbuf); | ||
1240 | + oldscreen = vc->vc_screenbuf; | ||
1241 | vc->vc_screenbuf = newscreen; | ||
1242 | vc->vc_screenbuf_size = new_screen_size; | ||
1243 | set_origin(vc); | ||
1244 | + kfree(oldscreen); | ||
1245 | |||
1246 | /* do part of a reset_terminal() */ | ||
1247 | vc->vc_top = 0; | ||
1248 | diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c | ||
1249 | index 4ed0d77e59181..78a3b969cae71 100644 | ||
1250 | --- a/drivers/tty/vt/vt_ioctl.c | ||
1251 | +++ b/drivers/tty/vt/vt_ioctl.c | ||
1252 | @@ -896,12 +896,22 @@ int vt_ioctl(struct tty_struct *tty, | ||
1253 | console_lock(); | ||
1254 | vcp = vc_cons[i].d; | ||
1255 | if (vcp) { | ||
1256 | + int ret; | ||
1257 | + int save_scan_lines = vcp->vc_scan_lines; | ||
1258 | + int save_font_height = vcp->vc_font.height; | ||
1259 | + | ||
1260 | if (v.v_vlin) | ||
1261 | vcp->vc_scan_lines = v.v_vlin; | ||
1262 | if (v.v_clin) | ||
1263 | vcp->vc_font.height = v.v_clin; | ||
1264 | vcp->vc_resize_user = 1; | ||
1265 | - vc_resize(vcp, v.v_cols, v.v_rows); | ||
1266 | + ret = vc_resize(vcp, v.v_cols, v.v_rows); | ||
1267 | + if (ret) { | ||
1268 | + vcp->vc_scan_lines = save_scan_lines; | ||
1269 | + vcp->vc_font.height = save_font_height; | ||
1270 | + console_unlock(); | ||
1271 | + return ret; | ||
1272 | + } | ||
1273 | } | ||
1274 | console_unlock(); | ||
1275 | } | ||
1276 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c | ||
1277 | index e6e0f786547bf..eed7c8d8e3d4f 100644 | ||
1278 | --- a/drivers/usb/core/quirks.c | ||
1279 | +++ b/drivers/usb/core/quirks.c | ||
1280 | @@ -299,6 +299,8 @@ static const struct usb_device_id usb_quirk_list[] = { | ||
1281 | |||
1282 | { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, | ||
1283 | |||
1284 | + { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM }, | ||
1285 | + | ||
1286 | /* DJI CineSSD */ | ||
1287 | { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, | ||
1288 | |||
1289 | diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c | ||
1290 | index 6399923239e78..b69747367bd75 100644 | ||
1291 | --- a/drivers/usb/gadget/function/f_ncm.c | ||
1292 | +++ b/drivers/usb/gadget/function/f_ncm.c | ||
1293 | @@ -1209,12 +1209,15 @@ static int ncm_unwrap_ntb(struct gether *port, | ||
1294 | int ndp_index; | ||
1295 | unsigned dg_len, dg_len2; | ||
1296 | unsigned ndp_len; | ||
1297 | + unsigned block_len; | ||
1298 | struct sk_buff *skb2; | ||
1299 | int ret = -EINVAL; | ||
1300 | - unsigned max_size = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize); | ||
1301 | + unsigned ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize); | ||
1302 | + unsigned frame_max = le16_to_cpu(ecm_desc.wMaxSegmentSize); | ||
1303 | const struct ndp_parser_opts *opts = ncm->parser_opts; | ||
1304 | unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0; | ||
1305 | int dgram_counter; | ||
1306 | + bool ndp_after_header; | ||
1307 | |||
1308 | /* dwSignature */ | ||
1309 | if (get_unaligned_le32(tmp) != opts->nth_sign) { | ||
1310 | @@ -1233,25 +1236,37 @@ static int ncm_unwrap_ntb(struct gether *port, | ||
1311 | } | ||
1312 | tmp++; /* skip wSequence */ | ||
1313 | |||
1314 | + block_len = get_ncm(&tmp, opts->block_length); | ||
1315 | /* (d)wBlockLength */ | ||
1316 | - if (get_ncm(&tmp, opts->block_length) > max_size) { | ||
1317 | + if (block_len > ntb_max) { | ||
1318 | INFO(port->func.config->cdev, "OUT size exceeded\n"); | ||
1319 | goto err; | ||
1320 | } | ||
1321 | |||
1322 | ndp_index = get_ncm(&tmp, opts->ndp_index); | ||
1323 | + ndp_after_header = false; | ||
1324 | |||
1325 | /* Run through all the NDP's in the NTB */ | ||
1326 | do { | ||
1327 | - /* NCM 3.2 */ | ||
1328 | - if (((ndp_index % 4) != 0) && | ||
1329 | - (ndp_index < opts->nth_size)) { | ||
1330 | + /* | ||
1331 | + * NCM 3.2 | ||
1332 | + * dwNdpIndex | ||
1333 | + */ | ||
1334 | + if (((ndp_index % 4) != 0) || | ||
1335 | + (ndp_index < opts->nth_size) || | ||
1336 | + (ndp_index > (block_len - | ||
1337 | + opts->ndp_size))) { | ||
1338 | INFO(port->func.config->cdev, "Bad index: %#X\n", | ||
1339 | ndp_index); | ||
1340 | goto err; | ||
1341 | } | ||
1342 | + if (ndp_index == opts->nth_size) | ||
1343 | + ndp_after_header = true; | ||
1344 | |||
1345 | - /* walk through NDP */ | ||
1346 | + /* | ||
1347 | + * walk through NDP | ||
1348 | + * dwSignature | ||
1349 | + */ | ||
1350 | tmp = (void *)(skb->data + ndp_index); | ||
1351 | if (get_unaligned_le32(tmp) != ncm->ndp_sign) { | ||
1352 | INFO(port->func.config->cdev, "Wrong NDP SIGN\n"); | ||
1353 | @@ -1262,14 +1277,15 @@ static int ncm_unwrap_ntb(struct gether *port, | ||
1354 | ndp_len = get_unaligned_le16(tmp++); | ||
1355 | /* | ||
1356 | * NCM 3.3.1 | ||
1357 | + * wLength | ||
1358 | * entry is 2 items | ||
1359 | * item size is 16/32 bits, opts->dgram_item_len * 2 bytes | ||
1360 | * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry | ||
1361 | * Each entry is a dgram index and a dgram length. | ||
1362 | */ | ||
1363 | if ((ndp_len < opts->ndp_size | ||
1364 | - + 2 * 2 * (opts->dgram_item_len * 2)) | ||
1365 | - || (ndp_len % opts->ndplen_align != 0)) { | ||
1366 | + + 2 * 2 * (opts->dgram_item_len * 2)) || | ||
1367 | + (ndp_len % opts->ndplen_align != 0)) { | ||
1368 | INFO(port->func.config->cdev, "Bad NDP length: %#X\n", | ||
1369 | ndp_len); | ||
1370 | goto err; | ||
1371 | @@ -1286,8 +1302,21 @@ static int ncm_unwrap_ntb(struct gether *port, | ||
1372 | |||
1373 | do { | ||
1374 | index = index2; | ||
1375 | + /* wDatagramIndex[0] */ | ||
1376 | + if ((index < opts->nth_size) || | ||
1377 | + (index > block_len - opts->dpe_size)) { | ||
1378 | + INFO(port->func.config->cdev, | ||
1379 | + "Bad index: %#X\n", index); | ||
1380 | + goto err; | ||
1381 | + } | ||
1382 | + | ||
1383 | dg_len = dg_len2; | ||
1384 | - if (dg_len < 14 + crc_len) { /* ethernet hdr + crc */ | ||
1385 | + /* | ||
1386 | + * wDatagramLength[0] | ||
1387 | + * ethernet hdr + crc or larger than max frame size | ||
1388 | + */ | ||
1389 | + if ((dg_len < 14 + crc_len) || | ||
1390 | + (dg_len > frame_max)) { | ||
1391 | INFO(port->func.config->cdev, | ||
1392 | "Bad dgram length: %#X\n", dg_len); | ||
1393 | goto err; | ||
1394 | @@ -1311,6 +1340,37 @@ static int ncm_unwrap_ntb(struct gether *port, | ||
1395 | index2 = get_ncm(&tmp, opts->dgram_item_len); | ||
1396 | dg_len2 = get_ncm(&tmp, opts->dgram_item_len); | ||
1397 | |||
1398 | + if (index2 == 0 || dg_len2 == 0) | ||
1399 | + break; | ||
1400 | + | ||
1401 | + /* wDatagramIndex[1] */ | ||
1402 | + if (ndp_after_header) { | ||
1403 | + if (index2 < opts->nth_size + opts->ndp_size) { | ||
1404 | + INFO(port->func.config->cdev, | ||
1405 | + "Bad index: %#X\n", index2); | ||
1406 | + goto err; | ||
1407 | + } | ||
1408 | + } else { | ||
1409 | + if (index2 < opts->nth_size + opts->dpe_size) { | ||
1410 | + INFO(port->func.config->cdev, | ||
1411 | + "Bad index: %#X\n", index2); | ||
1412 | + goto err; | ||
1413 | + } | ||
1414 | + } | ||
1415 | + if (index2 > block_len - opts->dpe_size) { | ||
1416 | + INFO(port->func.config->cdev, | ||
1417 | + "Bad index: %#X\n", index2); | ||
1418 | + goto err; | ||
1419 | + } | ||
1420 | + | ||
1421 | + /* wDatagramLength[1] */ | ||
1422 | + if ((dg_len2 < 14 + crc_len) || | ||
1423 | + (dg_len2 > frame_max)) { | ||
1424 | + INFO(port->func.config->cdev, | ||
1425 | + "Bad dgram length: %#X\n", dg_len); | ||
1426 | + goto err; | ||
1427 | + } | ||
1428 | + | ||
1429 | /* | ||
1430 | * Copy the data into a new skb. | ||
1431 | * This ensures the truesize is correct | ||
1432 | @@ -1327,9 +1387,6 @@ static int ncm_unwrap_ntb(struct gether *port, | ||
1433 | ndp_len -= 2 * (opts->dgram_item_len * 2); | ||
1434 | |||
1435 | dgram_counter++; | ||
1436 | - | ||
1437 | - if (index2 == 0 || dg_len2 == 0) | ||
1438 | - break; | ||
1439 | } while (ndp_len > 2 * (opts->dgram_item_len * 2)); | ||
1440 | } while (ndp_index); | ||
1441 | |||
1442 | diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c | ||
1443 | index d2351139342f6..7e8e262b36297 100644 | ||
1444 | --- a/drivers/usb/gadget/function/f_tcm.c | ||
1445 | +++ b/drivers/usb/gadget/function/f_tcm.c | ||
1446 | @@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream) | ||
1447 | goto err_sts; | ||
1448 | |||
1449 | return 0; | ||
1450 | + | ||
1451 | err_sts: | ||
1452 | - usb_ep_free_request(fu->ep_status, stream->req_status); | ||
1453 | - stream->req_status = NULL; | ||
1454 | -err_out: | ||
1455 | usb_ep_free_request(fu->ep_out, stream->req_out); | ||
1456 | stream->req_out = NULL; | ||
1457 | +err_out: | ||
1458 | + usb_ep_free_request(fu->ep_in, stream->req_in); | ||
1459 | + stream->req_in = NULL; | ||
1460 | out: | ||
1461 | return -ENOMEM; | ||
1462 | } | ||
1463 | diff --git a/drivers/usb/gadget/u_f.h b/drivers/usb/gadget/u_f.h | ||
1464 | index 2f03334c68741..d150a6795f481 100644 | ||
1465 | --- a/drivers/usb/gadget/u_f.h | ||
1466 | +++ b/drivers/usb/gadget/u_f.h | ||
1467 | @@ -17,6 +17,7 @@ | ||
1468 | #define __U_F_H__ | ||
1469 | |||
1470 | #include <linux/usb/gadget.h> | ||
1471 | +#include <linux/overflow.h> | ||
1472 | |||
1473 | /* Variable Length Array Macros **********************************************/ | ||
1474 | #define vla_group(groupname) size_t groupname##__next = 0 | ||
1475 | @@ -24,21 +25,36 @@ | ||
1476 | |||
1477 | #define vla_item(groupname, type, name, n) \ | ||
1478 | size_t groupname##_##name##__offset = ({ \ | ||
1479 | - size_t align_mask = __alignof__(type) - 1; \ | ||
1480 | - size_t offset = (groupname##__next + align_mask) & ~align_mask;\ | ||
1481 | - size_t size = (n) * sizeof(type); \ | ||
1482 | - groupname##__next = offset + size; \ | ||
1483 | + size_t offset = 0; \ | ||
1484 | + if (groupname##__next != SIZE_MAX) { \ | ||
1485 | + size_t align_mask = __alignof__(type) - 1; \ | ||
1486 | + size_t size = array_size(n, sizeof(type)); \ | ||
1487 | + offset = (groupname##__next + align_mask) & \ | ||
1488 | + ~align_mask; \ | ||
1489 | + if (check_add_overflow(offset, size, \ | ||
1490 | + &groupname##__next)) { \ | ||
1491 | + groupname##__next = SIZE_MAX; \ | ||
1492 | + offset = 0; \ | ||
1493 | + } \ | ||
1494 | + } \ | ||
1495 | offset; \ | ||
1496 | }) | ||
1497 | |||
1498 | #define vla_item_with_sz(groupname, type, name, n) \ | ||
1499 | - size_t groupname##_##name##__sz = (n) * sizeof(type); \ | ||
1500 | - size_t groupname##_##name##__offset = ({ \ | ||
1501 | - size_t align_mask = __alignof__(type) - 1; \ | ||
1502 | - size_t offset = (groupname##__next + align_mask) & ~align_mask;\ | ||
1503 | - size_t size = groupname##_##name##__sz; \ | ||
1504 | - groupname##__next = offset + size; \ | ||
1505 | - offset; \ | ||
1506 | + size_t groupname##_##name##__sz = array_size(n, sizeof(type)); \ | ||
1507 | + size_t groupname##_##name##__offset = ({ \ | ||
1508 | + size_t offset = 0; \ | ||
1509 | + if (groupname##__next != SIZE_MAX) { \ | ||
1510 | + size_t align_mask = __alignof__(type) - 1; \ | ||
1511 | + offset = (groupname##__next + align_mask) & \ | ||
1512 | + ~align_mask; \ | ||
1513 | + if (check_add_overflow(offset, groupname##_##name##__sz,\ | ||
1514 | + &groupname##__next)) { \ | ||
1515 | + groupname##__next = SIZE_MAX; \ | ||
1516 | + offset = 0; \ | ||
1517 | + } \ | ||
1518 | + } \ | ||
1519 | + offset; \ | ||
1520 | }) | ||
1521 | |||
1522 | #define vla_ptr(ptr, groupname, name) \ | ||
1523 | diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c | ||
1524 | index 6865b919403f7..2ed062a2e93b4 100644 | ||
1525 | --- a/drivers/usb/host/ohci-exynos.c | ||
1526 | +++ b/drivers/usb/host/ohci-exynos.c | ||
1527 | @@ -166,9 +166,8 @@ skip_phy: | ||
1528 | hcd->rsrc_len = resource_size(res); | ||
1529 | |||
1530 | irq = platform_get_irq(pdev, 0); | ||
1531 | - if (!irq) { | ||
1532 | - dev_err(&pdev->dev, "Failed to get IRQ\n"); | ||
1533 | - err = -ENODEV; | ||
1534 | + if (irq < 0) { | ||
1535 | + err = irq; | ||
1536 | goto fail_io; | ||
1537 | } | ||
1538 | |||
1539 | diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c | ||
1540 | index 04d36fa607342..194ea29d7a57e 100644 | ||
1541 | --- a/drivers/usb/host/xhci-hub.c | ||
1542 | +++ b/drivers/usb/host/xhci-hub.c | ||
1543 | @@ -623,15 +623,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, | ||
1544 | { | ||
1545 | u32 pls = status_reg & PORT_PLS_MASK; | ||
1546 | |||
1547 | - /* resume state is a xHCI internal state. | ||
1548 | - * Do not report it to usb core, instead, pretend to be U3, | ||
1549 | - * thus usb core knows it's not ready for transfer | ||
1550 | - */ | ||
1551 | - if (pls == XDEV_RESUME) { | ||
1552 | - *status |= USB_SS_PORT_LS_U3; | ||
1553 | - return; | ||
1554 | - } | ||
1555 | - | ||
1556 | /* When the CAS bit is set then warm reset | ||
1557 | * should be performed on port | ||
1558 | */ | ||
1559 | @@ -653,6 +644,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, | ||
1560 | */ | ||
1561 | pls |= USB_PORT_STAT_CONNECTION; | ||
1562 | } else { | ||
1563 | + /* | ||
1564 | + * Resume state is an xHCI internal state. Do not report it to | ||
1565 | + * usb core, instead, pretend to be U3, thus usb core knows | ||
1566 | + * it's not ready for transfer. | ||
1567 | + */ | ||
1568 | + if (pls == XDEV_RESUME) { | ||
1569 | + *status |= USB_SS_PORT_LS_U3; | ||
1570 | + return; | ||
1571 | + } | ||
1572 | + | ||
1573 | /* | ||
1574 | * If CAS bit isn't set but the Port is already at | ||
1575 | * Compliance Mode, fake a connection so the USB core | ||
1576 | diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c | ||
1577 | index bd6e06ef88acd..5dfc58ac97f30 100644 | ||
1578 | --- a/drivers/usb/misc/lvstest.c | ||
1579 | +++ b/drivers/usb/misc/lvstest.c | ||
1580 | @@ -392,7 +392,7 @@ static int lvs_rh_probe(struct usb_interface *intf, | ||
1581 | USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT); | ||
1582 | if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) { | ||
1583 | dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret); | ||
1584 | - return ret; | ||
1585 | + return ret < 0 ? ret : -EINVAL; | ||
1586 | } | ||
1587 | |||
1588 | /* submit urb to poll interrupt endpoint */ | ||
1589 | diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c | ||
1590 | index 895e8c0288cf9..30b3bdc4e6761 100644 | ||
1591 | --- a/drivers/usb/misc/sisusbvga/sisusb.c | ||
1592 | +++ b/drivers/usb/misc/sisusbvga/sisusb.c | ||
1593 | @@ -762,7 +762,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr, | ||
1594 | u8 swap8, fromkern = kernbuffer ? 1 : 0; | ||
1595 | u16 swap16; | ||
1596 | u32 swap32, flag = (length >> 28) & 1; | ||
1597 | - char buf[4]; | ||
1598 | + u8 buf[4]; | ||
1599 | |||
1600 | /* if neither kernbuffer not userbuffer are given, assume | ||
1601 | * data in obuf | ||
1602 | diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c | ||
1603 | index 2350502f90540..1be1fa1b73770 100644 | ||
1604 | --- a/drivers/usb/misc/yurex.c | ||
1605 | +++ b/drivers/usb/misc/yurex.c | ||
1606 | @@ -502,7 +502,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, | ||
1607 | prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE); | ||
1608 | dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__, | ||
1609 | dev->cntl_buffer[0]); | ||
1610 | - retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL); | ||
1611 | + retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC); | ||
1612 | if (retval >= 0) | ||
1613 | timeout = schedule_timeout(YUREX_WRITE_TIMEOUT); | ||
1614 | finish_wait(&dev->waitq, &wait); | ||
1615 | diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h | ||
1616 | index 46079468df426..4a94effb64f77 100644 | ||
1617 | --- a/drivers/usb/storage/unusual_devs.h | ||
1618 | +++ b/drivers/usb/storage/unusual_devs.h | ||
1619 | @@ -2347,7 +2347,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114, | ||
1620 | "JMicron", | ||
1621 | "USB to ATA/ATAPI Bridge", | ||
1622 | USB_SC_DEVICE, USB_PR_DEVICE, NULL, | ||
1623 | - US_FL_BROKEN_FUA ), | ||
1624 | + US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ), | ||
1625 | |||
1626 | /* Reported by Andrey Rahmatullin <wrar@altlinux.org> */ | ||
1627 | UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100, | ||
1628 | diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h | ||
1629 | index 4df15faa66d71..018b0663d6109 100644 | ||
1630 | --- a/drivers/usb/storage/unusual_uas.h | ||
1631 | +++ b/drivers/usb/storage/unusual_uas.h | ||
1632 | @@ -41,6 +41,13 @@ | ||
1633 | * and don't forget to CC: the USB development list <linux-usb@vger.kernel.org> | ||
1634 | */ | ||
1635 | |||
1636 | +/* Reported-by: Till Dörges <doerges@pre-sense.de> */ | ||
1637 | +UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999, | ||
1638 | + "Sony", | ||
1639 | + "PSZ-HA*", | ||
1640 | + USB_SC_DEVICE, USB_PR_DEVICE, NULL, | ||
1641 | + US_FL_NO_REPORT_OPCODES), | ||
1642 | + | ||
1643 | /* Reported-by: Julian Groß <julian.g@posteo.de> */ | ||
1644 | UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999, | ||
1645 | "LaCie", | ||
1646 | @@ -156,6 +163,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, | ||
1647 | USB_SC_DEVICE, USB_PR_DEVICE, NULL, | ||
1648 | US_FL_BROKEN_FUA), | ||
1649 | |||
1650 | +/* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */ | ||
1651 | +UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999, | ||
1652 | + "PNY", | ||
1653 | + "Pro Elite SSD", | ||
1654 | + USB_SC_DEVICE, USB_PR_DEVICE, NULL, | ||
1655 | + US_FL_NO_ATA_1X), | ||
1656 | + | ||
1657 | /* Reported-by: Hans de Goede <hdegoede@redhat.com> */ | ||
1658 | UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, | ||
1659 | "VIA", | ||
1660 | diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c | ||
1661 | index 178b507a6fe0c..dd6797e54e8ab 100644 | ||
1662 | --- a/drivers/video/console/fbcon.c | ||
1663 | +++ b/drivers/video/console/fbcon.c | ||
1664 | @@ -2116,6 +2116,9 @@ static void updatescrollmode(struct display *p, | ||
1665 | } | ||
1666 | } | ||
1667 | |||
1668 | +#define PITCH(w) (((w) + 7) >> 3) | ||
1669 | +#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */ | ||
1670 | + | ||
1671 | static int fbcon_resize(struct vc_data *vc, unsigned int width, | ||
1672 | unsigned int height, unsigned int user) | ||
1673 | { | ||
1674 | @@ -2125,6 +2128,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, | ||
1675 | struct fb_var_screeninfo var = info->var; | ||
1676 | int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh; | ||
1677 | |||
1678 | + if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) { | ||
1679 | + int size; | ||
1680 | + int pitch = PITCH(vc->vc_font.width); | ||
1681 | + | ||
1682 | + /* | ||
1683 | + * If user font, ensure that a possible change to user font | ||
1684 | + * height or width will not allow a font data out-of-bounds access. | ||
1685 | + * NOTE: must use original charcount in calculation as font | ||
1686 | + * charcount can change and cannot be used to determine the | ||
1687 | + * font data allocated size. | ||
1688 | + */ | ||
1689 | + if (pitch <= 0) | ||
1690 | + return -EINVAL; | ||
1691 | + size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data)); | ||
1692 | + if (size > FNTSIZE(vc->vc_font.data)) | ||
1693 | + return -EINVAL; | ||
1694 | + } | ||
1695 | + | ||
1696 | virt_w = FBCON_SWAP(ops->rotate, width, height); | ||
1697 | virt_h = FBCON_SWAP(ops->rotate, height, width); | ||
1698 | virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width, | ||
1699 | @@ -2586,7 +2607,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne | ||
1700 | int size; | ||
1701 | int i, csum; | ||
1702 | u8 *new_data, *data = font->data; | ||
1703 | - int pitch = (font->width+7) >> 3; | ||
1704 | + int pitch = PITCH(font->width); | ||
1705 | |||
1706 | /* Is there a reason why fbconsole couldn't handle any charcount >256? | ||
1707 | * If not this check should be changed to charcount < 256 */ | ||
1708 | @@ -2602,7 +2623,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne | ||
1709 | if (fbcon_invalid_charcount(info, charcount)) | ||
1710 | return -EINVAL; | ||
1711 | |||
1712 | - size = h * pitch * charcount; | ||
1713 | + size = CALC_FONTSZ(h, pitch, charcount); | ||
1714 | |||
1715 | new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); | ||
1716 | |||
1717 | diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c | ||
1718 | index 7a75dfda98457..00f5a54aaf9b7 100644 | ||
1719 | --- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c | ||
1720 | +++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c | ||
1721 | @@ -531,8 +531,11 @@ int dispc_runtime_get(void) | ||
1722 | DSSDBG("dispc_runtime_get\n"); | ||
1723 | |||
1724 | r = pm_runtime_get_sync(&dispc.pdev->dev); | ||
1725 | - WARN_ON(r < 0); | ||
1726 | - return r < 0 ? r : 0; | ||
1727 | + if (WARN_ON(r < 0)) { | ||
1728 | + pm_runtime_put_sync(&dispc.pdev->dev); | ||
1729 | + return r; | ||
1730 | + } | ||
1731 | + return 0; | ||
1732 | } | ||
1733 | EXPORT_SYMBOL(dispc_runtime_get); | ||
1734 | |||
1735 | diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c | ||
1736 | index 30d49f3800b33..2bfd9063cdfc3 100644 | ||
1737 | --- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c | ||
1738 | +++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c | ||
1739 | @@ -1148,8 +1148,11 @@ static int dsi_runtime_get(struct platform_device *dsidev) | ||
1740 | DSSDBG("dsi_runtime_get\n"); | ||
1741 | |||
1742 | r = pm_runtime_get_sync(&dsi->pdev->dev); | ||
1743 | - WARN_ON(r < 0); | ||
1744 | - return r < 0 ? r : 0; | ||
1745 | + if (WARN_ON(r < 0)) { | ||
1746 | + pm_runtime_put_sync(&dsi->pdev->dev); | ||
1747 | + return r; | ||
1748 | + } | ||
1749 | + return 0; | ||
1750 | } | ||
1751 | |||
1752 | static void dsi_runtime_put(struct platform_device *dsidev) | ||
1753 | diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c | ||
1754 | index 4429ad37b64cd..acecee5b1c102 100644 | ||
1755 | --- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c | ||
1756 | +++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c | ||
1757 | @@ -778,8 +778,11 @@ int dss_runtime_get(void) | ||
1758 | DSSDBG("dss_runtime_get\n"); | ||
1759 | |||
1760 | r = pm_runtime_get_sync(&dss.pdev->dev); | ||
1761 | - WARN_ON(r < 0); | ||
1762 | - return r < 0 ? r : 0; | ||
1763 | + if (WARN_ON(r < 0)) { | ||
1764 | + pm_runtime_put_sync(&dss.pdev->dev); | ||
1765 | + return r; | ||
1766 | + } | ||
1767 | + return 0; | ||
1768 | } | ||
1769 | |||
1770 | void dss_runtime_put(void) | ||
1771 | diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c | ||
1772 | index 156a254705ea5..ab64bf0215e82 100644 | ||
1773 | --- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c | ||
1774 | +++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c | ||
1775 | @@ -50,9 +50,10 @@ static int hdmi_runtime_get(void) | ||
1776 | DSSDBG("hdmi_runtime_get\n"); | ||
1777 | |||
1778 | r = pm_runtime_get_sync(&hdmi.pdev->dev); | ||
1779 | - WARN_ON(r < 0); | ||
1780 | - if (r < 0) | ||
1781 | + if (WARN_ON(r < 0)) { | ||
1782 | + pm_runtime_put_sync(&hdmi.pdev->dev); | ||
1783 | return r; | ||
1784 | + } | ||
1785 | |||
1786 | return 0; | ||
1787 | } | ||
1788 | diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c | ||
1789 | index 4da36bcab9779..c6efaca3235a8 100644 | ||
1790 | --- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c | ||
1791 | +++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c | ||
1792 | @@ -54,9 +54,10 @@ static int hdmi_runtime_get(void) | ||
1793 | DSSDBG("hdmi_runtime_get\n"); | ||
1794 | |||
1795 | r = pm_runtime_get_sync(&hdmi.pdev->dev); | ||
1796 | - WARN_ON(r < 0); | ||
1797 | - if (r < 0) | ||
1798 | + if (WARN_ON(r < 0)) { | ||
1799 | + pm_runtime_put_sync(&hdmi.pdev->dev); | ||
1800 | return r; | ||
1801 | + } | ||
1802 | |||
1803 | return 0; | ||
1804 | } | ||
1805 | diff --git a/drivers/video/fbdev/omap2/omapfb/dss/venc.c b/drivers/video/fbdev/omap2/omapfb/dss/venc.c | ||
1806 | index 392464da12e41..96714b4596d2d 100644 | ||
1807 | --- a/drivers/video/fbdev/omap2/omapfb/dss/venc.c | ||
1808 | +++ b/drivers/video/fbdev/omap2/omapfb/dss/venc.c | ||
1809 | @@ -402,8 +402,11 @@ static int venc_runtime_get(void) | ||
1810 | DSSDBG("venc_runtime_get\n"); | ||
1811 | |||
1812 | r = pm_runtime_get_sync(&venc.pdev->dev); | ||
1813 | - WARN_ON(r < 0); | ||
1814 | - return r < 0 ? r : 0; | ||
1815 | + if (WARN_ON(r < 0)) { | ||
1816 | + pm_runtime_put_sync(&venc.pdev->dev); | ||
1817 | + return r; | ||
1818 | + } | ||
1819 | + return 0; | ||
1820 | } | ||
1821 | |||
1822 | static void venc_runtime_put(void) | ||
1823 | diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c | ||
1824 | index 4b0cc9d0ca537..0dadfabcfd80b 100644 | ||
1825 | --- a/drivers/xen/events/events_base.c | ||
1826 | +++ b/drivers/xen/events/events_base.c | ||
1827 | @@ -155,7 +155,7 @@ int get_evtchn_to_irq(unsigned evtchn) | ||
1828 | /* Get info for IRQ */ | ||
1829 | struct irq_info *info_for_irq(unsigned irq) | ||
1830 | { | ||
1831 | - return irq_get_handler_data(irq); | ||
1832 | + return irq_get_chip_data(irq); | ||
1833 | } | ||
1834 | |||
1835 | /* Constructors for packed IRQ information. */ | ||
1836 | @@ -384,7 +384,7 @@ static void xen_irq_init(unsigned irq) | ||
1837 | info->type = IRQT_UNBOUND; | ||
1838 | info->refcnt = -1; | ||
1839 | |||
1840 | - irq_set_handler_data(irq, info); | ||
1841 | + irq_set_chip_data(irq, info); | ||
1842 | |||
1843 | list_add_tail(&info->list, &xen_irq_list_head); | ||
1844 | } | ||
1845 | @@ -433,14 +433,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) | ||
1846 | |||
1847 | static void xen_free_irq(unsigned irq) | ||
1848 | { | ||
1849 | - struct irq_info *info = irq_get_handler_data(irq); | ||
1850 | + struct irq_info *info = irq_get_chip_data(irq); | ||
1851 | |||
1852 | if (WARN_ON(!info)) | ||
1853 | return; | ||
1854 | |||
1855 | list_del(&info->list); | ||
1856 | |||
1857 | - irq_set_handler_data(irq, NULL); | ||
1858 | + irq_set_chip_data(irq, NULL); | ||
1859 | |||
1860 | WARN_ON(info->refcnt > 0); | ||
1861 | |||
1862 | @@ -610,7 +610,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); | ||
1863 | static void __unbind_from_irq(unsigned int irq) | ||
1864 | { | ||
1865 | int evtchn = evtchn_from_irq(irq); | ||
1866 | - struct irq_info *info = irq_get_handler_data(irq); | ||
1867 | + struct irq_info *info = irq_get_chip_data(irq); | ||
1868 | |||
1869 | if (info->refcnt > 0) { | ||
1870 | info->refcnt--; | ||
1871 | @@ -1114,7 +1114,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, | ||
1872 | |||
1873 | void unbind_from_irqhandler(unsigned int irq, void *dev_id) | ||
1874 | { | ||
1875 | - struct irq_info *info = irq_get_handler_data(irq); | ||
1876 | + struct irq_info *info = irq_get_chip_data(irq); | ||
1877 | |||
1878 | if (WARN_ON(!info)) | ||
1879 | return; | ||
1880 | @@ -1148,7 +1148,7 @@ int evtchn_make_refcounted(unsigned int evtchn) | ||
1881 | if (irq == -1) | ||
1882 | return -ENOENT; | ||
1883 | |||
1884 | - info = irq_get_handler_data(irq); | ||
1885 | + info = irq_get_chip_data(irq); | ||
1886 | |||
1887 | if (!info) | ||
1888 | return -ENOENT; | ||
1889 | @@ -1176,7 +1176,7 @@ int evtchn_get(unsigned int evtchn) | ||
1890 | if (irq == -1) | ||
1891 | goto done; | ||
1892 | |||
1893 | - info = irq_get_handler_data(irq); | ||
1894 | + info = irq_get_chip_data(irq); | ||
1895 | |||
1896 | if (!info) | ||
1897 | goto done; | ||
1898 | diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c | ||
1899 | index d9909e2fc4c21..b100b8dae5884 100644 | ||
1900 | --- a/fs/btrfs/disk-io.c | ||
1901 | +++ b/fs/btrfs/disk-io.c | ||
1902 | @@ -4432,6 +4432,7 @@ static void btrfs_cleanup_bg_io(struct btrfs_block_group_cache *cache) | ||
1903 | cache->io_ctl.inode = NULL; | ||
1904 | iput(inode); | ||
1905 | } | ||
1906 | + ASSERT(cache->io_ctl.pages == NULL); | ||
1907 | btrfs_put_block_group(cache); | ||
1908 | } | ||
1909 | |||
1910 | diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c | ||
1911 | index 568ff2ee015be..8e93bd391b352 100644 | ||
1912 | --- a/fs/btrfs/free-space-cache.c | ||
1913 | +++ b/fs/btrfs/free-space-cache.c | ||
1914 | @@ -1165,7 +1165,6 @@ int btrfs_wait_cache_io(struct btrfs_root *root, | ||
1915 | ret = update_cache_item(trans, root, inode, path, offset, | ||
1916 | io_ctl->entries, io_ctl->bitmaps); | ||
1917 | out: | ||
1918 | - io_ctl_free(io_ctl); | ||
1919 | if (ret) { | ||
1920 | invalidate_inode_pages2(inode->i_mapping); | ||
1921 | BTRFS_I(inode)->generation = 0; | ||
1922 | @@ -1314,6 +1313,7 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode, | ||
1923 | * them out later | ||
1924 | */ | ||
1925 | io_ctl_drop_pages(io_ctl); | ||
1926 | + io_ctl_free(io_ctl); | ||
1927 | |||
1928 | unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0, | ||
1929 | i_size_read(inode) - 1, &cached_state, GFP_NOFS); | ||
1930 | diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c | ||
1931 | index c28ac9c464251..5bd1758f57b64 100644 | ||
1932 | --- a/fs/btrfs/tree-log.c | ||
1933 | +++ b/fs/btrfs/tree-log.c | ||
1934 | @@ -3191,11 +3191,13 @@ fail: | ||
1935 | btrfs_free_path(path); | ||
1936 | out_unlock: | ||
1937 | mutex_unlock(&BTRFS_I(dir)->log_mutex); | ||
1938 | - if (ret == -ENOSPC) { | ||
1939 | + if (err == -ENOSPC) { | ||
1940 | btrfs_set_log_full_commit(root->fs_info, trans); | ||
1941 | - ret = 0; | ||
1942 | - } else if (ret < 0) | ||
1943 | - btrfs_abort_transaction(trans, ret); | ||
1944 | + err = 0; | ||
1945 | + } else if (err < 0 && err != -ENOENT) { | ||
1946 | + /* ENOENT can be returned if the entry hasn't been fsynced yet */ | ||
1947 | + btrfs_abort_transaction(trans, err); | ||
1948 | + } | ||
1949 | |||
1950 | btrfs_end_log_trans(root); | ||
1951 | |||
1952 | diff --git a/fs/buffer.c b/fs/buffer.c | ||
1953 | index a89be9741d125..52f1a60417d1d 100644 | ||
1954 | --- a/fs/buffer.c | ||
1955 | +++ b/fs/buffer.c | ||
1956 | @@ -3203,6 +3203,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags) | ||
1957 | WARN_ON(atomic_read(&bh->b_count) < 1); | ||
1958 | lock_buffer(bh); | ||
1959 | if (test_clear_buffer_dirty(bh)) { | ||
1960 | + /* | ||
1961 | + * The bh should be mapped, but it might not be if the | ||
1962 | + * device was hot-removed. Not much we can do but fail the I/O. | ||
1963 | + */ | ||
1964 | + if (!buffer_mapped(bh)) { | ||
1965 | + unlock_buffer(bh); | ||
1966 | + return -EIO; | ||
1967 | + } | ||
1968 | + | ||
1969 | get_bh(bh); | ||
1970 | bh->b_end_io = end_buffer_write_sync; | ||
1971 | ret = submit_bh(REQ_OP_WRITE, op_flags, bh); | ||
1972 | diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c | ||
1973 | index 3139fbd4c34e3..4ec5a109df82b 100644 | ||
1974 | --- a/fs/ceph/mds_client.c | ||
1975 | +++ b/fs/ceph/mds_client.c | ||
1976 | @@ -3386,6 +3386,9 @@ static void delayed_work(struct work_struct *work) | ||
1977 | dout("mdsc delayed_work\n"); | ||
1978 | ceph_check_delayed_caps(mdsc); | ||
1979 | |||
1980 | + if (mdsc->stopping) | ||
1981 | + return; | ||
1982 | + | ||
1983 | mutex_lock(&mdsc->mutex); | ||
1984 | renew_interval = mdsc->mdsmap->m_session_timeout >> 2; | ||
1985 | renew_caps = time_after_eq(jiffies, HZ*renew_interval + | ||
1986 | @@ -3717,7 +3720,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc) | ||
1987 | static void ceph_mdsc_stop(struct ceph_mds_client *mdsc) | ||
1988 | { | ||
1989 | dout("stop\n"); | ||
1990 | - cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */ | ||
1991 | + /* | ||
1992 | + * Make sure the delayed work stopped before releasing | ||
1993 | + * the resources. | ||
1994 | + * | ||
1995 | + * Because the cancel_delayed_work_sync() will only | ||
1996 | + * guarantee that the work finishes executing. But the | ||
1997 | + * delayed work will re-arm itself again after that. | ||
1998 | + */ | ||
1999 | + flush_delayed_work(&mdsc->delayed_work); | ||
2000 | + | ||
2001 | if (mdsc->mdsmap) | ||
2002 | ceph_mdsmap_destroy(mdsc->mdsmap); | ||
2003 | kfree(mdsc->sessions); | ||
2004 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c | ||
2005 | index 370e4273042c5..472fa29c6f604 100644 | ||
2006 | --- a/fs/ext4/super.c | ||
2007 | +++ b/fs/ext4/super.c | ||
2008 | @@ -4680,13 +4680,6 @@ static int ext4_commit_super(struct super_block *sb, int sync) | ||
2009 | if (!sbh || block_device_ejected(sb)) | ||
2010 | return error; | ||
2011 | |||
2012 | - /* | ||
2013 | - * The superblock bh should be mapped, but it might not be if the | ||
2014 | - * device was hot-removed. Not much we can do but fail the I/O. | ||
2015 | - */ | ||
2016 | - if (!buffer_mapped(sbh)) | ||
2017 | - return error; | ||
2018 | - | ||
2019 | /* | ||
2020 | * If the file system is mounted read-only, don't update the | ||
2021 | * superblock write time. This avoids updating the superblock | ||
2022 | diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c | ||
2023 | index 5a1a6dbbc55fb..f978ae2bb846f 100644 | ||
2024 | --- a/fs/fs-writeback.c | ||
2025 | +++ b/fs/fs-writeback.c | ||
2026 | @@ -45,7 +45,6 @@ struct wb_completion { | ||
2027 | struct wb_writeback_work { | ||
2028 | long nr_pages; | ||
2029 | struct super_block *sb; | ||
2030 | - unsigned long *older_than_this; | ||
2031 | enum writeback_sync_modes sync_mode; | ||
2032 | unsigned int tagged_writepages:1; | ||
2033 | unsigned int for_kupdate:1; | ||
2034 | @@ -160,7 +159,9 @@ static void inode_io_list_del_locked(struct inode *inode, | ||
2035 | struct bdi_writeback *wb) | ||
2036 | { | ||
2037 | assert_spin_locked(&wb->list_lock); | ||
2038 | + assert_spin_locked(&inode->i_lock); | ||
2039 | |||
2040 | + inode->i_state &= ~I_SYNC_QUEUED; | ||
2041 | list_del_init(&inode->i_io_list); | ||
2042 | wb_io_lists_depopulated(wb); | ||
2043 | } | ||
2044 | @@ -1039,7 +1040,9 @@ void inode_io_list_del(struct inode *inode) | ||
2045 | struct bdi_writeback *wb; | ||
2046 | |||
2047 | wb = inode_to_wb_and_lock_list(inode); | ||
2048 | + spin_lock(&inode->i_lock); | ||
2049 | inode_io_list_del_locked(inode, wb); | ||
2050 | + spin_unlock(&inode->i_lock); | ||
2051 | spin_unlock(&wb->list_lock); | ||
2052 | } | ||
2053 | |||
2054 | @@ -1088,8 +1091,10 @@ void sb_clear_inode_writeback(struct inode *inode) | ||
2055 | * the case then the inode must have been redirtied while it was being written | ||
2056 | * out and we don't reset its dirtied_when. | ||
2057 | */ | ||
2058 | -static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) | ||
2059 | +static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb) | ||
2060 | { | ||
2061 | + assert_spin_locked(&inode->i_lock); | ||
2062 | + | ||
2063 | if (!list_empty(&wb->b_dirty)) { | ||
2064 | struct inode *tail; | ||
2065 | |||
2066 | @@ -1098,6 +1103,14 @@ static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) | ||
2067 | inode->dirtied_when = jiffies; | ||
2068 | } | ||
2069 | inode_io_list_move_locked(inode, wb, &wb->b_dirty); | ||
2070 | + inode->i_state &= ~I_SYNC_QUEUED; | ||
2071 | +} | ||
2072 | + | ||
2073 | +static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) | ||
2074 | +{ | ||
2075 | + spin_lock(&inode->i_lock); | ||
2076 | + redirty_tail_locked(inode, wb); | ||
2077 | + spin_unlock(&inode->i_lock); | ||
2078 | } | ||
2079 | |||
2080 | /* | ||
2081 | @@ -1136,16 +1149,13 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t) | ||
2082 | #define EXPIRE_DIRTY_ATIME 0x0001 | ||
2083 | |||
2084 | /* | ||
2085 | - * Move expired (dirtied before work->older_than_this) dirty inodes from | ||
2086 | + * Move expired (dirtied before dirtied_before) dirty inodes from | ||
2087 | * @delaying_queue to @dispatch_queue. | ||
2088 | */ | ||
2089 | static int move_expired_inodes(struct list_head *delaying_queue, | ||
2090 | struct list_head *dispatch_queue, | ||
2091 | - int flags, | ||
2092 | - struct wb_writeback_work *work) | ||
2093 | + int flags, unsigned long dirtied_before) | ||
2094 | { | ||
2095 | - unsigned long *older_than_this = NULL; | ||
2096 | - unsigned long expire_time; | ||
2097 | LIST_HEAD(tmp); | ||
2098 | struct list_head *pos, *node; | ||
2099 | struct super_block *sb = NULL; | ||
2100 | @@ -1153,21 +1163,17 @@ static int move_expired_inodes(struct list_head *delaying_queue, | ||
2101 | int do_sb_sort = 0; | ||
2102 | int moved = 0; | ||
2103 | |||
2104 | - if ((flags & EXPIRE_DIRTY_ATIME) == 0) | ||
2105 | - older_than_this = work->older_than_this; | ||
2106 | - else if (!work->for_sync) { | ||
2107 | - expire_time = jiffies - (dirtytime_expire_interval * HZ); | ||
2108 | - older_than_this = &expire_time; | ||
2109 | - } | ||
2110 | while (!list_empty(delaying_queue)) { | ||
2111 | inode = wb_inode(delaying_queue->prev); | ||
2112 | - if (older_than_this && | ||
2113 | - inode_dirtied_after(inode, *older_than_this)) | ||
2114 | + if (inode_dirtied_after(inode, dirtied_before)) | ||
2115 | break; | ||
2116 | list_move(&inode->i_io_list, &tmp); | ||
2117 | moved++; | ||
2118 | + spin_lock(&inode->i_lock); | ||
2119 | if (flags & EXPIRE_DIRTY_ATIME) | ||
2120 | - set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state); | ||
2121 | + inode->i_state |= I_DIRTY_TIME_EXPIRED; | ||
2122 | + inode->i_state |= I_SYNC_QUEUED; | ||
2123 | + spin_unlock(&inode->i_lock); | ||
2124 | if (sb_is_blkdev_sb(inode->i_sb)) | ||
2125 | continue; | ||
2126 | if (sb && sb != inode->i_sb) | ||
2127 | @@ -1205,18 +1211,22 @@ out: | ||
2128 | * | | ||
2129 | * +--> dequeue for IO | ||
2130 | */ | ||
2131 | -static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work) | ||
2132 | +static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work, | ||
2133 | + unsigned long dirtied_before) | ||
2134 | { | ||
2135 | int moved; | ||
2136 | + unsigned long time_expire_jif = dirtied_before; | ||
2137 | |||
2138 | assert_spin_locked(&wb->list_lock); | ||
2139 | list_splice_init(&wb->b_more_io, &wb->b_io); | ||
2140 | - moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work); | ||
2141 | + moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before); | ||
2142 | + if (!work->for_sync) | ||
2143 | + time_expire_jif = jiffies - dirtytime_expire_interval * HZ; | ||
2144 | moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io, | ||
2145 | - EXPIRE_DIRTY_ATIME, work); | ||
2146 | + EXPIRE_DIRTY_ATIME, time_expire_jif); | ||
2147 | if (moved) | ||
2148 | wb_io_lists_populated(wb); | ||
2149 | - trace_writeback_queue_io(wb, work, moved); | ||
2150 | + trace_writeback_queue_io(wb, work, dirtied_before, moved); | ||
2151 | } | ||
2152 | |||
2153 | static int write_inode(struct inode *inode, struct writeback_control *wbc) | ||
2154 | @@ -1310,7 +1320,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, | ||
2155 | * writeback is not making progress due to locked | ||
2156 | * buffers. Skip this inode for now. | ||
2157 | */ | ||
2158 | - redirty_tail(inode, wb); | ||
2159 | + redirty_tail_locked(inode, wb); | ||
2160 | return; | ||
2161 | } | ||
2162 | |||
2163 | @@ -1330,7 +1340,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, | ||
2164 | * retrying writeback of the dirty page/inode | ||
2165 | * that cannot be performed immediately. | ||
2166 | */ | ||
2167 | - redirty_tail(inode, wb); | ||
2168 | + redirty_tail_locked(inode, wb); | ||
2169 | } | ||
2170 | } else if (inode->i_state & I_DIRTY) { | ||
2171 | /* | ||
2172 | @@ -1338,10 +1348,11 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, | ||
2173 | * such as delayed allocation during submission or metadata | ||
2174 | * updates after data IO completion. | ||
2175 | */ | ||
2176 | - redirty_tail(inode, wb); | ||
2177 | + redirty_tail_locked(inode, wb); | ||
2178 | } else if (inode->i_state & I_DIRTY_TIME) { | ||
2179 | inode->dirtied_when = jiffies; | ||
2180 | inode_io_list_move_locked(inode, wb, &wb->b_dirty_time); | ||
2181 | + inode->i_state &= ~I_SYNC_QUEUED; | ||
2182 | } else { | ||
2183 | /* The inode is clean. Remove from writeback lists. */ | ||
2184 | inode_io_list_del_locked(inode, wb); | ||
2185 | @@ -1585,8 +1596,8 @@ static long writeback_sb_inodes(struct super_block *sb, | ||
2186 | */ | ||
2187 | spin_lock(&inode->i_lock); | ||
2188 | if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) { | ||
2189 | + redirty_tail_locked(inode, wb); | ||
2190 | spin_unlock(&inode->i_lock); | ||
2191 | - redirty_tail(inode, wb); | ||
2192 | continue; | ||
2193 | } | ||
2194 | if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) { | ||
2195 | @@ -1727,7 +1738,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages, | ||
2196 | blk_start_plug(&plug); | ||
2197 | spin_lock(&wb->list_lock); | ||
2198 | if (list_empty(&wb->b_io)) | ||
2199 | - queue_io(wb, &work); | ||
2200 | + queue_io(wb, &work, jiffies); | ||
2201 | __writeback_inodes_wb(wb, &work); | ||
2202 | spin_unlock(&wb->list_lock); | ||
2203 | blk_finish_plug(&plug); | ||
2204 | @@ -1747,7 +1758,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages, | ||
2205 | * takes longer than a dirty_writeback_interval interval, then leave a | ||
2206 | * one-second gap. | ||
2207 | * | ||
2208 | - * older_than_this takes precedence over nr_to_write. So we'll only write back | ||
2209 | + * dirtied_before takes precedence over nr_to_write. So we'll only write back | ||
2210 | * all dirty pages if they are all attached to "old" mappings. | ||
2211 | */ | ||
2212 | static long wb_writeback(struct bdi_writeback *wb, | ||
2213 | @@ -1755,14 +1766,11 @@ static long wb_writeback(struct bdi_writeback *wb, | ||
2214 | { | ||
2215 | unsigned long wb_start = jiffies; | ||
2216 | long nr_pages = work->nr_pages; | ||
2217 | - unsigned long oldest_jif; | ||
2218 | + unsigned long dirtied_before = jiffies; | ||
2219 | struct inode *inode; | ||
2220 | long progress; | ||
2221 | struct blk_plug plug; | ||
2222 | |||
2223 | - oldest_jif = jiffies; | ||
2224 | - work->older_than_this = &oldest_jif; | ||
2225 | - | ||
2226 | blk_start_plug(&plug); | ||
2227 | spin_lock(&wb->list_lock); | ||
2228 | for (;;) { | ||
2229 | @@ -1796,14 +1804,14 @@ static long wb_writeback(struct bdi_writeback *wb, | ||
2230 | * safe. | ||
2231 | */ | ||
2232 | if (work->for_kupdate) { | ||
2233 | - oldest_jif = jiffies - | ||
2234 | + dirtied_before = jiffies - | ||
2235 | msecs_to_jiffies(dirty_expire_interval * 10); | ||
2236 | } else if (work->for_background) | ||
2237 | - oldest_jif = jiffies; | ||
2238 | + dirtied_before = jiffies; | ||
2239 | |||
2240 | trace_writeback_start(wb, work); | ||
2241 | if (list_empty(&wb->b_io)) | ||
2242 | - queue_io(wb, work); | ||
2243 | + queue_io(wb, work, dirtied_before); | ||
2244 | if (work->sb) | ||
2245 | progress = writeback_sb_inodes(work->sb, wb, work); | ||
2246 | else | ||
2247 | @@ -2176,11 +2184,12 @@ void __mark_inode_dirty(struct inode *inode, int flags) | ||
2248 | inode->i_state |= flags; | ||
2249 | |||
2250 | /* | ||
2251 | - * If the inode is being synced, just update its dirty state. | ||
2252 | - * The unlocker will place the inode on the appropriate | ||
2253 | - * superblock list, based upon its state. | ||
2254 | + * If the inode is queued for writeback by flush worker, just | ||
2255 | + * update its dirty state. Once the flush worker is done with | ||
2256 | + * the inode it will place it on the appropriate superblock | ||
2257 | + * list, based upon its state. | ||
2258 | */ | ||
2259 | - if (inode->i_state & I_SYNC) | ||
2260 | + if (inode->i_state & I_SYNC_QUEUED) | ||
2261 | goto out_unlock_inode; | ||
2262 | |||
2263 | /* | ||
2264 | diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c | ||
2265 | index 8de458d64134a..cfbf5474bccab 100644 | ||
2266 | --- a/fs/jbd2/transaction.c | ||
2267 | +++ b/fs/jbd2/transaction.c | ||
2268 | @@ -1896,6 +1896,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) | ||
2269 | */ | ||
2270 | static void __jbd2_journal_unfile_buffer(struct journal_head *jh) | ||
2271 | { | ||
2272 | + J_ASSERT_JH(jh, jh->b_transaction != NULL); | ||
2273 | + J_ASSERT_JH(jh, jh->b_next_transaction == NULL); | ||
2274 | + | ||
2275 | __jbd2_journal_temp_unlink_buffer(jh); | ||
2276 | jh->b_transaction = NULL; | ||
2277 | jbd2_journal_put_journal_head(jh); | ||
2278 | @@ -1987,6 +1990,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, | ||
2279 | { | ||
2280 | struct buffer_head *head; | ||
2281 | struct buffer_head *bh; | ||
2282 | + bool has_write_io_error = false; | ||
2283 | int ret = 0; | ||
2284 | |||
2285 | J_ASSERT(PageLocked(page)); | ||
2286 | @@ -2011,11 +2015,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, | ||
2287 | jbd_unlock_bh_state(bh); | ||
2288 | if (buffer_jbd(bh)) | ||
2289 | goto busy; | ||
2290 | + | ||
2291 | + /* | ||
2292 | + * If we free a metadata buffer which has been failed to | ||
2293 | + * write out, the jbd2 checkpoint procedure will not detect | ||
2294 | + * this failure and may lead to filesystem inconsistency | ||
2295 | + * after cleanup journal tail. | ||
2296 | + */ | ||
2297 | + if (buffer_write_io_error(bh)) { | ||
2298 | + pr_err("JBD2: Error while async write back metadata bh %llu.", | ||
2299 | + (unsigned long long)bh->b_blocknr); | ||
2300 | + has_write_io_error = true; | ||
2301 | + } | ||
2302 | } while ((bh = bh->b_this_page) != head); | ||
2303 | |||
2304 | ret = try_to_free_buffers(page); | ||
2305 | |||
2306 | busy: | ||
2307 | + if (has_write_io_error) | ||
2308 | + jbd2_journal_abort(journal, -EIO); | ||
2309 | + | ||
2310 | return ret; | ||
2311 | } | ||
2312 | |||
2313 | @@ -2443,6 +2462,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh) | ||
2314 | |||
2315 | was_dirty = test_clear_buffer_jbddirty(bh); | ||
2316 | __jbd2_journal_temp_unlink_buffer(jh); | ||
2317 | + | ||
2318 | + /* | ||
2319 | + * b_transaction must be set, otherwise the new b_transaction won't | ||
2320 | + * be holding jh reference | ||
2321 | + */ | ||
2322 | + J_ASSERT_JH(jh, jh->b_transaction != NULL); | ||
2323 | + | ||
2324 | /* | ||
2325 | * We set b_transaction here because b_next_transaction will inherit | ||
2326 | * our jh reference and thus __jbd2_journal_file_buffer() must not | ||
2327 | diff --git a/include/linux/efi.h b/include/linux/efi.h | ||
2328 | index 02c4f16685b69..69605956beb85 100644 | ||
2329 | --- a/include/linux/efi.h | ||
2330 | +++ b/include/linux/efi.h | ||
2331 | @@ -910,7 +910,11 @@ extern void *efi_get_pal_addr (void); | ||
2332 | extern void efi_map_pal_code (void); | ||
2333 | extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg); | ||
2334 | extern void efi_gettimeofday (struct timespec64 *ts); | ||
2335 | +#ifdef CONFIG_EFI | ||
2336 | extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */ | ||
2337 | +#else | ||
2338 | +static inline void efi_enter_virtual_mode (void) {} | ||
2339 | +#endif | ||
2340 | #ifdef CONFIG_X86 | ||
2341 | extern void efi_late_init(void); | ||
2342 | extern void efi_free_boot_services(void); | ||
2343 | diff --git a/include/linux/fs.h b/include/linux/fs.h | ||
2344 | index 2d569738eb320..b8d65e0ab9341 100644 | ||
2345 | --- a/include/linux/fs.h | ||
2346 | +++ b/include/linux/fs.h | ||
2347 | @@ -1954,6 +1954,10 @@ static inline bool HAS_UNMAPPED_ID(struct inode *inode) | ||
2348 | * wb stat updates to grab mapping->tree_lock. See | ||
2349 | * inode_switch_wb_work_fn() for details. | ||
2350 | * | ||
2351 | + * I_SYNC_QUEUED Inode is queued in b_io or b_more_io writeback lists. | ||
2352 | + * Used to detect that mark_inode_dirty() should not move | ||
2353 | + * inode between dirty lists. | ||
2354 | + * | ||
2355 | * Q: What is the difference between I_WILL_FREE and I_FREEING? | ||
2356 | */ | ||
2357 | #define I_DIRTY_SYNC (1 << 0) | ||
2358 | @@ -1971,9 +1975,9 @@ static inline bool HAS_UNMAPPED_ID(struct inode *inode) | ||
2359 | #define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP) | ||
2360 | #define I_LINKABLE (1 << 10) | ||
2361 | #define I_DIRTY_TIME (1 << 11) | ||
2362 | -#define __I_DIRTY_TIME_EXPIRED 12 | ||
2363 | -#define I_DIRTY_TIME_EXPIRED (1 << __I_DIRTY_TIME_EXPIRED) | ||
2364 | +#define I_DIRTY_TIME_EXPIRED (1 << 12) | ||
2365 | #define I_WB_SWITCH (1 << 13) | ||
2366 | +#define I_SYNC_QUEUED (1 << 17) | ||
2367 | |||
2368 | #define I_DIRTY (I_DIRTY_SYNC | I_DIRTY_DATASYNC | I_DIRTY_PAGES) | ||
2369 | #define I_DIRTY_ALL (I_DIRTY | I_DIRTY_TIME) | ||
2370 | diff --git a/include/linux/overflow.h b/include/linux/overflow.h | ||
2371 | index d309788f4cd24..40b48e2133cb8 100644 | ||
2372 | --- a/include/linux/overflow.h | ||
2373 | +++ b/include/linux/overflow.h | ||
2374 | @@ -233,4 +233,77 @@ | ||
2375 | (*_d >> _to_shift) != _a); \ | ||
2376 | }) | ||
2377 | |||
2378 | +/** | ||
2379 | + * array_size() - Calculate size of 2-dimensional array. | ||
2380 | + * | ||
2381 | + * @a: dimension one | ||
2382 | + * @b: dimension two | ||
2383 | + * | ||
2384 | + * Calculates size of 2-dimensional array: @a * @b. | ||
2385 | + * | ||
2386 | + * Returns: number of bytes needed to represent the array or SIZE_MAX on | ||
2387 | + * overflow. | ||
2388 | + */ | ||
2389 | +static inline __must_check size_t array_size(size_t a, size_t b) | ||
2390 | +{ | ||
2391 | + size_t bytes; | ||
2392 | + | ||
2393 | + if (check_mul_overflow(a, b, &bytes)) | ||
2394 | + return SIZE_MAX; | ||
2395 | + | ||
2396 | + return bytes; | ||
2397 | +} | ||
2398 | + | ||
2399 | +/** | ||
2400 | + * array3_size() - Calculate size of 3-dimensional array. | ||
2401 | + * | ||
2402 | + * @a: dimension one | ||
2403 | + * @b: dimension two | ||
2404 | + * @c: dimension three | ||
2405 | + * | ||
2406 | + * Calculates size of 3-dimensional array: @a * @b * @c. | ||
2407 | + * | ||
2408 | + * Returns: number of bytes needed to represent the array or SIZE_MAX on | ||
2409 | + * overflow. | ||
2410 | + */ | ||
2411 | +static inline __must_check size_t array3_size(size_t a, size_t b, size_t c) | ||
2412 | +{ | ||
2413 | + size_t bytes; | ||
2414 | + | ||
2415 | + if (check_mul_overflow(a, b, &bytes)) | ||
2416 | + return SIZE_MAX; | ||
2417 | + if (check_mul_overflow(bytes, c, &bytes)) | ||
2418 | + return SIZE_MAX; | ||
2419 | + | ||
2420 | + return bytes; | ||
2421 | +} | ||
2422 | + | ||
2423 | +static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c) | ||
2424 | +{ | ||
2425 | + size_t bytes; | ||
2426 | + | ||
2427 | + if (check_mul_overflow(n, size, &bytes)) | ||
2428 | + return SIZE_MAX; | ||
2429 | + if (check_add_overflow(bytes, c, &bytes)) | ||
2430 | + return SIZE_MAX; | ||
2431 | + | ||
2432 | + return bytes; | ||
2433 | +} | ||
2434 | + | ||
2435 | +/** | ||
2436 | + * struct_size() - Calculate size of structure with trailing array. | ||
2437 | + * @p: Pointer to the structure. | ||
2438 | + * @member: Name of the array member. | ||
2439 | + * @n: Number of elements in the array. | ||
2440 | + * | ||
2441 | + * Calculates size of memory needed for structure @p followed by an | ||
2442 | + * array of @n @member elements. | ||
2443 | + * | ||
2444 | + * Return: number of bytes needed or SIZE_MAX on overflow. | ||
2445 | + */ | ||
2446 | +#define struct_size(p, member, n) \ | ||
2447 | + __ab_c_size(n, \ | ||
2448 | + sizeof(*(p)->member) + __must_be_array((p)->member),\ | ||
2449 | + sizeof(*(p))) | ||
2450 | + | ||
2451 | #endif /* __LINUX_OVERFLOW_H */ | ||
2452 | diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h | ||
2453 | index 2ccd9ccbf9efe..ec964a924cd2f 100644 | ||
2454 | --- a/include/trace/events/writeback.h | ||
2455 | +++ b/include/trace/events/writeback.h | ||
2456 | @@ -360,8 +360,9 @@ DEFINE_WBC_EVENT(wbc_writepage); | ||
2457 | TRACE_EVENT(writeback_queue_io, | ||
2458 | TP_PROTO(struct bdi_writeback *wb, | ||
2459 | struct wb_writeback_work *work, | ||
2460 | + unsigned long dirtied_before, | ||
2461 | int moved), | ||
2462 | - TP_ARGS(wb, work, moved), | ||
2463 | + TP_ARGS(wb, work, dirtied_before, moved), | ||
2464 | TP_STRUCT__entry( | ||
2465 | __array(char, name, 32) | ||
2466 | __field(unsigned long, older) | ||
2467 | @@ -371,19 +372,17 @@ TRACE_EVENT(writeback_queue_io, | ||
2468 | __field(unsigned int, cgroup_ino) | ||
2469 | ), | ||
2470 | TP_fast_assign( | ||
2471 | - unsigned long *older_than_this = work->older_than_this; | ||
2472 | strncpy(__entry->name, dev_name(wb->bdi->dev), 32); | ||
2473 | - __entry->older = older_than_this ? *older_than_this : 0; | ||
2474 | - __entry->age = older_than_this ? | ||
2475 | - (jiffies - *older_than_this) * 1000 / HZ : -1; | ||
2476 | + __entry->older = dirtied_before; | ||
2477 | + __entry->age = (jiffies - dirtied_before) * 1000 / HZ; | ||
2478 | __entry->moved = moved; | ||
2479 | __entry->reason = work->reason; | ||
2480 | __entry->cgroup_ino = __trace_wb_assign_cgroup(wb); | ||
2481 | ), | ||
2482 | TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup_ino=%u", | ||
2483 | __entry->name, | ||
2484 | - __entry->older, /* older_than_this in jiffies */ | ||
2485 | - __entry->age, /* older_than_this in relative milliseconds */ | ||
2486 | + __entry->older, /* dirtied_before in jiffies */ | ||
2487 | + __entry->age, /* dirtied_before in relative milliseconds */ | ||
2488 | __entry->moved, | ||
2489 | __print_symbolic(__entry->reason, WB_WORK_REASON), | ||
2490 | __entry->cgroup_ino | ||
2491 | diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c | ||
2492 | index 75d80809c48c9..09bad6cbb95cf 100644 | ||
2493 | --- a/kernel/locking/lockdep_proc.c | ||
2494 | +++ b/kernel/locking/lockdep_proc.c | ||
2495 | @@ -425,7 +425,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt) | ||
2496 | seq_time(m, lt->min); | ||
2497 | seq_time(m, lt->max); | ||
2498 | seq_time(m, lt->total); | ||
2499 | - seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0); | ||
2500 | + seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0); | ||
2501 | } | ||
2502 | |||
2503 | static void seq_stats(struct seq_file *m, struct lock_stat_data *data) | ||
2504 | diff --git a/net/core/skbuff.c b/net/core/skbuff.c | ||
2505 | index 7164569c1ec80..e72775024c6af 100644 | ||
2506 | --- a/net/core/skbuff.c | ||
2507 | +++ b/net/core/skbuff.c | ||
2508 | @@ -4591,8 +4591,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb) | ||
2509 | skb = skb_share_check(skb, GFP_ATOMIC); | ||
2510 | if (unlikely(!skb)) | ||
2511 | goto err_free; | ||
2512 | - | ||
2513 | - if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) | ||
2514 | + /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */ | ||
2515 | + if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short)))) | ||
2516 | goto err_free; | ||
2517 | |||
2518 | vhdr = (struct vlan_hdr *)skb->data; | ||
2519 | diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c | ||
2520 | index ed795d50a8d2b..d9e60aa2ea1b2 100644 | ||
2521 | --- a/net/ipv6/ip6_tunnel.c | ||
2522 | +++ b/net/ipv6/ip6_tunnel.c | ||
2523 | @@ -871,7 +871,15 @@ int ip6_tnl_rcv(struct ip6_tnl *t, struct sk_buff *skb, | ||
2524 | struct metadata_dst *tun_dst, | ||
2525 | bool log_ecn_err) | ||
2526 | { | ||
2527 | - return __ip6_tnl_rcv(t, skb, tpi, NULL, ip6ip6_dscp_ecn_decapsulate, | ||
2528 | + int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t, | ||
2529 | + const struct ipv6hdr *ipv6h, | ||
2530 | + struct sk_buff *skb); | ||
2531 | + | ||
2532 | + dscp_ecn_decapsulate = ip6ip6_dscp_ecn_decapsulate; | ||
2533 | + if (tpi->proto == htons(ETH_P_IP)) | ||
2534 | + dscp_ecn_decapsulate = ip4ip6_dscp_ecn_decapsulate; | ||
2535 | + | ||
2536 | + return __ip6_tnl_rcv(t, skb, tpi, NULL, dscp_ecn_decapsulate, | ||
2537 | log_ecn_err); | ||
2538 | } | ||
2539 | EXPORT_SYMBOL(ip6_tnl_rcv); | ||
2540 | diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c | ||
2541 | index cdc49e680be4b..403be9bfd8d16 100644 | ||
2542 | --- a/net/tipc/netlink_compat.c | ||
2543 | +++ b/net/tipc/netlink_compat.c | ||
2544 | @@ -250,8 +250,9 @@ err_out: | ||
2545 | static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, | ||
2546 | struct tipc_nl_compat_msg *msg) | ||
2547 | { | ||
2548 | - int err; | ||
2549 | + struct nlmsghdr *nlh; | ||
2550 | struct sk_buff *arg; | ||
2551 | + int err; | ||
2552 | |||
2553 | if (msg->req_type && (!msg->req_size || | ||
2554 | !TLV_CHECK_TYPE(msg->req, msg->req_type))) | ||
2555 | @@ -280,6 +281,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, | ||
2556 | return -ENOMEM; | ||
2557 | } | ||
2558 | |||
2559 | + nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI); | ||
2560 | + if (!nlh) { | ||
2561 | + kfree_skb(arg); | ||
2562 | + kfree_skb(msg->rep); | ||
2563 | + msg->rep = NULL; | ||
2564 | + return -EMSGSIZE; | ||
2565 | + } | ||
2566 | + nlmsg_end(arg, nlh); | ||
2567 | + | ||
2568 | err = __tipc_nl_compat_dumpit(cmd, msg, arg); | ||
2569 | if (err) { | ||
2570 | kfree_skb(msg->rep); | ||
2571 | diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c | ||
2572 | index 528102cc2d5d0..d824ff4ae3e3b 100644 | ||
2573 | --- a/sound/pci/cs46xx/cs46xx_lib.c | ||
2574 | +++ b/sound/pci/cs46xx/cs46xx_lib.c | ||
2575 | @@ -780,7 +780,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned | ||
2576 | rate = 48000 / 9; | ||
2577 | |||
2578 | /* | ||
2579 | - * We can not capture at at rate greater than the Input Rate (48000). | ||
2580 | + * We can not capture at a rate greater than the Input Rate (48000). | ||
2581 | * Return an error if an attempt is made to stray outside that limit. | ||
2582 | */ | ||
2583 | if (rate > 48000) | ||
2584 | diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c | ||
2585 | index 7488e1b7a7707..4e726d39b05d1 100644 | ||
2586 | --- a/sound/pci/cs46xx/dsp_spos_scb_lib.c | ||
2587 | +++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c | ||
2588 | @@ -1742,7 +1742,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip) | ||
2589 | struct dsp_spos_instance * ins = chip->dsp_spos_instance; | ||
2590 | |||
2591 | if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) { | ||
2592 | - /* remove AsynchFGTxSCB and and PCMSerialInput_II */ | ||
2593 | + /* remove AsynchFGTxSCB and PCMSerialInput_II */ | ||
2594 | cs46xx_dsp_disable_spdif_out (chip); | ||
2595 | |||
2596 | /* save state */ | ||
2597 | diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c | ||
2598 | index cbe0248225c1c..4e67614f15f8e 100644 | ||
2599 | --- a/sound/pci/hda/hda_codec.c | ||
2600 | +++ b/sound/pci/hda/hda_codec.c | ||
2601 | @@ -3496,7 +3496,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save); | ||
2602 | * @nid: NID to check / update | ||
2603 | * | ||
2604 | * Check whether the given NID is in the amp list. If it's in the list, | ||
2605 | - * check the current AMP status, and update the the power-status according | ||
2606 | + * check the current AMP status, and update the power-status according | ||
2607 | * to the mute status. | ||
2608 | * | ||
2609 | * This function is supposed to be set or called from the check_power_status | ||
2610 | diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c | ||
2611 | index 949c90a859fab..184089c5e8cbc 100644 | ||
2612 | --- a/sound/pci/hda/hda_generic.c | ||
2613 | +++ b/sound/pci/hda/hda_generic.c | ||
2614 | @@ -820,7 +820,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path, | ||
2615 | } | ||
2616 | } | ||
2617 | |||
2618 | -/* sync power of each widget in the the given path */ | ||
2619 | +/* sync power of each widget in the given path */ | ||
2620 | static hda_nid_t path_power_update(struct hda_codec *codec, | ||
2621 | struct nid_path *path, | ||
2622 | bool allow_powerdown) | ||
2623 | diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c | ||
2624 | index d1a6d20ace0da..80b72d0702c5e 100644 | ||
2625 | --- a/sound/pci/hda/patch_sigmatel.c | ||
2626 | +++ b/sound/pci/hda/patch_sigmatel.c | ||
2627 | @@ -862,7 +862,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec, | ||
2628 | static struct snd_kcontrol_new beep_vol_ctl = | ||
2629 | HDA_CODEC_VOLUME(NULL, 0, 0, 0); | ||
2630 | |||
2631 | - /* check for mute support for the the amp */ | ||
2632 | + /* check for mute support for the amp */ | ||
2633 | if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) { | ||
2634 | const struct snd_kcontrol_new *temp; | ||
2635 | if (spec->anabeep_nid == nid) | ||
2636 | diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c | ||
2637 | index 3919aed39ca03..5e52086d7b986 100644 | ||
2638 | --- a/sound/pci/ice1712/prodigy192.c | ||
2639 | +++ b/sound/pci/ice1712/prodigy192.c | ||
2640 | @@ -31,7 +31,7 @@ | ||
2641 | * Experimentally I found out that only a combination of | ||
2642 | * OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 - | ||
2643 | * VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct | ||
2644 | - * sampling rate. That means the the FPGA doubles the | ||
2645 | + * sampling rate. That means that the FPGA doubles the | ||
2646 | * MCK01 rate. | ||
2647 | * | ||
2648 | * Copyright (c) 2003 Takashi Iwai <tiwai@suse.de> | ||
2649 | diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c | ||
2650 | index 4cf3200e988b0..df44135e1b0c9 100644 | ||
2651 | --- a/sound/pci/oxygen/xonar_dg.c | ||
2652 | +++ b/sound/pci/oxygen/xonar_dg.c | ||
2653 | @@ -39,7 +39,7 @@ | ||
2654 | * GPIO 4 <- headphone detect | ||
2655 | * GPIO 5 -> enable ADC analog circuit for the left channel | ||
2656 | * GPIO 6 -> enable ADC analog circuit for the right channel | ||
2657 | - * GPIO 7 -> switch green rear output jack between CS4245 and and the first | ||
2658 | + * GPIO 7 -> switch green rear output jack between CS4245 and the first | ||
2659 | * channel of CS4361 (mechanical relay) | ||
2660 | * GPIO 8 -> enable output to speakers | ||
2661 | * | ||
2662 | diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c | ||
2663 | index fef3b9a21a667..e441e23a37e4f 100644 | ||
2664 | --- a/sound/soc/tegra/tegra30_ahub.c | ||
2665 | +++ b/sound/soc/tegra/tegra30_ahub.c | ||
2666 | @@ -656,8 +656,10 @@ static int tegra30_ahub_resume(struct device *dev) | ||
2667 | int ret; | ||
2668 | |||
2669 | ret = pm_runtime_get_sync(dev); | ||
2670 | - if (ret < 0) | ||
2671 | + if (ret < 0) { | ||
2672 | + pm_runtime_put(dev); | ||
2673 | return ret; | ||
2674 | + } | ||
2675 | ret = regcache_sync(ahub->regmap_ahub); | ||
2676 | ret |= regcache_sync(ahub->regmap_apbif); | ||
2677 | pm_runtime_put(dev); | ||
2678 | diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c | ||
2679 | index 8e55583aa104e..516f37896092c 100644 | ||
2680 | --- a/sound/soc/tegra/tegra30_i2s.c | ||
2681 | +++ b/sound/soc/tegra/tegra30_i2s.c | ||
2682 | @@ -552,8 +552,10 @@ static int tegra30_i2s_resume(struct device *dev) | ||
2683 | int ret; | ||
2684 | |||
2685 | ret = pm_runtime_get_sync(dev); | ||
2686 | - if (ret < 0) | ||
2687 | + if (ret < 0) { | ||
2688 | + pm_runtime_put(dev); | ||
2689 | return ret; | ||
2690 | + } | ||
2691 | ret = regcache_sync(i2s->regmap); | ||
2692 | pm_runtime_put(dev); | ||
2693 | |||
2694 | diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h | ||
2695 | index 689fd3103e5b6..a917b7e02d312 100644 | ||
2696 | --- a/sound/usb/quirks-table.h | ||
2697 | +++ b/sound/usb/quirks-table.h | ||
2698 | @@ -3331,8 +3331,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), | ||
2699 | * they pretend to be 96kHz mono as a workaround for stereo being broken | ||
2700 | * by that... | ||
2701 | * | ||
2702 | - * They also have swapped L-R channels, but that's for userspace to deal | ||
2703 | - * with. | ||
2704 | + * They also have an issue with initial stream alignment that causes the | ||
2705 | + * channels to be swapped and out of phase, which is dealt with in quirks.c. | ||
2706 | */ | ||
2707 | { | ||
2708 | .match_flags = USB_DEVICE_ID_MATCH_DEVICE | | ||
2709 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c | ||
2710 | index 94110b1dcd3d8..031baa43646fb 100644 | ||
2711 | --- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c | ||
2712 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c | ||
2713 | @@ -91,8 +91,6 @@ int back_to_back_ebbs(void) | ||
2714 | ebb_global_disable(); | ||
2715 | ebb_freeze_pmcs(); | ||
2716 | |||
2717 | - count_pmc(1, sample_period); | ||
2718 | - | ||
2719 | dump_ebb_state(); | ||
2720 | |||
2721 | event_close(&event); | ||
2722 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c | ||
2723 | index 7c57a8d79535d..361e0be9df9ae 100644 | ||
2724 | --- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c | ||
2725 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c | ||
2726 | @@ -42,8 +42,6 @@ int cycles(void) | ||
2727 | ebb_global_disable(); | ||
2728 | ebb_freeze_pmcs(); | ||
2729 | |||
2730 | - count_pmc(1, sample_period); | ||
2731 | - | ||
2732 | dump_ebb_state(); | ||
2733 | |||
2734 | event_close(&event); | ||
2735 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c | ||
2736 | index ecf5ee3283a3e..fe7d0dc2a1a26 100644 | ||
2737 | --- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c | ||
2738 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c | ||
2739 | @@ -99,8 +99,6 @@ int cycles_with_freeze(void) | ||
2740 | ebb_global_disable(); | ||
2741 | ebb_freeze_pmcs(); | ||
2742 | |||
2743 | - count_pmc(1, sample_period); | ||
2744 | - | ||
2745 | dump_ebb_state(); | ||
2746 | |||
2747 | printf("EBBs while frozen %d\n", ebbs_while_frozen); | ||
2748 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c | ||
2749 | index c0faba520b35c..b9b30f974b5ea 100644 | ||
2750 | --- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c | ||
2751 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c | ||
2752 | @@ -71,8 +71,6 @@ int cycles_with_mmcr2(void) | ||
2753 | ebb_global_disable(); | ||
2754 | ebb_freeze_pmcs(); | ||
2755 | |||
2756 | - count_pmc(1, sample_period); | ||
2757 | - | ||
2758 | dump_ebb_state(); | ||
2759 | |||
2760 | event_close(&event); | ||
2761 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c | ||
2762 | index 46681fec549b8..2694ae161a84a 100644 | ||
2763 | --- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c | ||
2764 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c | ||
2765 | @@ -396,8 +396,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe) | ||
2766 | ebb_global_disable(); | ||
2767 | ebb_freeze_pmcs(); | ||
2768 | |||
2769 | - count_pmc(1, sample_period); | ||
2770 | - | ||
2771 | dump_ebb_state(); | ||
2772 | |||
2773 | event_close(&event); | ||
2774 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c | ||
2775 | index a991d2ea8d0a1..174e4f4dae6c0 100644 | ||
2776 | --- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c | ||
2777 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c | ||
2778 | @@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe) | ||
2779 | ebb_global_disable(); | ||
2780 | ebb_freeze_pmcs(); | ||
2781 | |||
2782 | - count_pmc(1, sample_period); | ||
2783 | - | ||
2784 | dump_ebb_state(); | ||
2785 | |||
2786 | FAIL_IF(ebb_state.stats.ebb_count == 0); | ||
2787 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c | ||
2788 | index eb8acb78bc6c1..531083accfcad 100644 | ||
2789 | --- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c | ||
2790 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c | ||
2791 | @@ -75,7 +75,6 @@ static int test_body(void) | ||
2792 | ebb_freeze_pmcs(); | ||
2793 | ebb_global_disable(); | ||
2794 | |||
2795 | - count_pmc(4, sample_period); | ||
2796 | mtspr(SPRN_PMC4, 0xdead); | ||
2797 | |||
2798 | dump_summary_ebb_state(); | ||
2799 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c | ||
2800 | index 6ff8c8ff27d66..035c02273cd49 100644 | ||
2801 | --- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c | ||
2802 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c | ||
2803 | @@ -70,13 +70,6 @@ int multi_counter(void) | ||
2804 | ebb_global_disable(); | ||
2805 | ebb_freeze_pmcs(); | ||
2806 | |||
2807 | - count_pmc(1, sample_period); | ||
2808 | - count_pmc(2, sample_period); | ||
2809 | - count_pmc(3, sample_period); | ||
2810 | - count_pmc(4, sample_period); | ||
2811 | - count_pmc(5, sample_period); | ||
2812 | - count_pmc(6, sample_period); | ||
2813 | - | ||
2814 | dump_ebb_state(); | ||
2815 | |||
2816 | for (i = 0; i < 6; i++) | ||
2817 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c | ||
2818 | index 037cb6154f360..3e9d4ac965c85 100644 | ||
2819 | --- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c | ||
2820 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c | ||
2821 | @@ -61,8 +61,6 @@ static int cycles_child(void) | ||
2822 | ebb_global_disable(); | ||
2823 | ebb_freeze_pmcs(); | ||
2824 | |||
2825 | - count_pmc(1, sample_period); | ||
2826 | - | ||
2827 | dump_summary_ebb_state(); | ||
2828 | |||
2829 | event_close(&event); | ||
2830 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c | ||
2831 | index c5fa64790c22e..d90891fe96a32 100644 | ||
2832 | --- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c | ||
2833 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c | ||
2834 | @@ -82,8 +82,6 @@ static int test_body(void) | ||
2835 | ebb_global_disable(); | ||
2836 | ebb_freeze_pmcs(); | ||
2837 | |||
2838 | - count_pmc(1, sample_period); | ||
2839 | - | ||
2840 | dump_ebb_state(); | ||
2841 | |||
2842 | if (mmcr0_mismatch) | ||
2843 | diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c | ||
2844 | index 30e1ac62e8cb4..8ca92b9ee5b01 100644 | ||
2845 | --- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c | ||
2846 | +++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c | ||
2847 | @@ -76,8 +76,6 @@ int pmc56_overflow(void) | ||
2848 | ebb_global_disable(); | ||
2849 | ebb_freeze_pmcs(); | ||
2850 | |||
2851 | - count_pmc(2, sample_period); | ||
2852 | - | ||
2853 | dump_ebb_state(); | ||
2854 | |||
2855 | printf("PMC5/6 overflow %d\n", pmc56_overflowed); |