Contents of /trunk/kernel-alx-legacy/patches-4.9/0340-4.9.241-all-fixes.patch
Parent Directory | Revision Log
Revision 3642 -
(show annotations)
(download)
Mon Oct 24 14:07:22 2022 UTC (23 months ago) by niro
File size: 130674 byte(s)
Mon Oct 24 14:07:22 2022 UTC (23 months ago) by niro
File size: 130674 byte(s)
-linux-4.9.241
1 | diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt |
2 | index 49935d5bb5c6b..a374412610ba3 100644 |
3 | --- a/Documentation/networking/ip-sysctl.txt |
4 | +++ b/Documentation/networking/ip-sysctl.txt |
5 | @@ -887,12 +887,14 @@ icmp_ratelimit - INTEGER |
6 | icmp_msgs_per_sec - INTEGER |
7 | Limit maximal number of ICMP packets sent per second from this host. |
8 | Only messages whose type matches icmp_ratemask (see below) are |
9 | - controlled by this limit. |
10 | + controlled by this limit. For security reasons, the precise count |
11 | + of messages per second is randomized. |
12 | Default: 1000 |
13 | |
14 | icmp_msgs_burst - INTEGER |
15 | icmp_msgs_per_sec controls number of ICMP packets sent per second, |
16 | while icmp_msgs_burst controls the burst size of these packets. |
17 | + For security reasons, the precise burst size is randomized. |
18 | Default: 50 |
19 | |
20 | icmp_ratemask - INTEGER |
21 | diff --git a/Makefile b/Makefile |
22 | index a6a9d494dc18f..c4f3d2ea9b43e 100644 |
23 | --- a/Makefile |
24 | +++ b/Makefile |
25 | @@ -1,6 +1,6 @@ |
26 | VERSION = 4 |
27 | PATCHLEVEL = 9 |
28 | -SUBLEVEL = 240 |
29 | +SUBLEVEL = 241 |
30 | EXTRAVERSION = |
31 | NAME = Roaring Lionus |
32 | |
33 | diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c |
34 | index d1870c777c6e2..3a465bfa7d4a2 100644 |
35 | --- a/arch/arm/mm/cache-l2x0.c |
36 | +++ b/arch/arm/mm/cache-l2x0.c |
37 | @@ -1252,20 +1252,28 @@ static void __init l2c310_of_parse(const struct device_node *np, |
38 | |
39 | ret = of_property_read_u32(np, "prefetch-data", &val); |
40 | if (ret == 0) { |
41 | - if (val) |
42 | + if (val) { |
43 | prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH; |
44 | - else |
45 | + *aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH; |
46 | + } else { |
47 | prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; |
48 | + *aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; |
49 | + } |
50 | + *aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; |
51 | } else if (ret != -EINVAL) { |
52 | pr_err("L2C-310 OF prefetch-data property value is missing\n"); |
53 | } |
54 | |
55 | ret = of_property_read_u32(np, "prefetch-instr", &val); |
56 | if (ret == 0) { |
57 | - if (val) |
58 | + if (val) { |
59 | prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH; |
60 | - else |
61 | + *aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH; |
62 | + } else { |
63 | prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; |
64 | + *aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; |
65 | + } |
66 | + *aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; |
67 | } else if (ret != -EINVAL) { |
68 | pr_err("L2C-310 OF prefetch-instr property value is missing\n"); |
69 | } |
70 | diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi |
71 | index 08b88f6791beb..fb5001a6879c7 100644 |
72 | --- a/arch/arm64/boot/dts/qcom/msm8916.dtsi |
73 | +++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi |
74 | @@ -715,7 +715,7 @@ |
75 | reg-names = "mdp_phys"; |
76 | |
77 | interrupt-parent = <&mdss>; |
78 | - interrupts = <0 0>; |
79 | + interrupts = <0>; |
80 | |
81 | clocks = <&gcc GCC_MDSS_AHB_CLK>, |
82 | <&gcc GCC_MDSS_AXI_CLK>, |
83 | @@ -745,7 +745,7 @@ |
84 | reg-names = "dsi_ctrl"; |
85 | |
86 | interrupt-parent = <&mdss>; |
87 | - interrupts = <4 0>; |
88 | + interrupts = <4>; |
89 | |
90 | assigned-clocks = <&gcc BYTE0_CLK_SRC>, |
91 | <&gcc PCLK0_CLK_SRC>; |
92 | diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi |
93 | index 54dc28351c8cb..b9ff697987338 100644 |
94 | --- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi |
95 | +++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi |
96 | @@ -175,7 +175,7 @@ |
97 | }; |
98 | |
99 | i2c0: i2c@ff020000 { |
100 | - compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; |
101 | + compatible = "cdns,i2c-r1p14"; |
102 | status = "disabled"; |
103 | interrupt-parent = <&gic>; |
104 | interrupts = <0 17 4>; |
105 | @@ -185,7 +185,7 @@ |
106 | }; |
107 | |
108 | i2c1: i2c@ff030000 { |
109 | - compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; |
110 | + compatible = "cdns,i2c-r1p14"; |
111 | status = "disabled"; |
112 | interrupt-parent = <&gic>; |
113 | interrupts = <0 18 4>; |
114 | diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h |
115 | index 26aeeaad32678..a36ef27155bc2 100644 |
116 | --- a/arch/powerpc/include/asm/reg.h |
117 | +++ b/arch/powerpc/include/asm/reg.h |
118 | @@ -683,7 +683,7 @@ |
119 | #define THRM1_TIN (1 << 31) |
120 | #define THRM1_TIV (1 << 30) |
121 | #define THRM1_THRES(x) ((x&0x7f)<<23) |
122 | -#define THRM3_SITV(x) ((x&0x3fff)<<1) |
123 | +#define THRM3_SITV(x) ((x & 0x1fff) << 1) |
124 | #define THRM1_TID (1<<2) |
125 | #define THRM1_TIE (1<<1) |
126 | #define THRM1_V (1<<0) |
127 | diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c |
128 | index a753b72efbc0c..70c9d134a9d44 100644 |
129 | --- a/arch/powerpc/kernel/tau_6xx.c |
130 | +++ b/arch/powerpc/kernel/tau_6xx.c |
131 | @@ -37,8 +37,6 @@ static struct tau_temp |
132 | |
133 | struct timer_list tau_timer; |
134 | |
135 | -#undef DEBUG |
136 | - |
137 | /* TODO: put these in a /proc interface, with some sanity checks, and maybe |
138 | * dynamic adjustment to minimize # of interrupts */ |
139 | /* configurable values for step size and how much to expand the window when |
140 | @@ -71,47 +69,33 @@ void set_thresholds(unsigned long cpu) |
141 | |
142 | void TAUupdate(int cpu) |
143 | { |
144 | - unsigned thrm; |
145 | - |
146 | -#ifdef DEBUG |
147 | - printk("TAUupdate "); |
148 | -#endif |
149 | + u32 thrm; |
150 | + u32 bits = THRM1_TIV | THRM1_TIN | THRM1_V; |
151 | |
152 | /* if both thresholds are crossed, the step_sizes cancel out |
153 | * and the window winds up getting expanded twice. */ |
154 | - if((thrm = mfspr(SPRN_THRM1)) & THRM1_TIV){ /* is valid? */ |
155 | - if(thrm & THRM1_TIN){ /* crossed low threshold */ |
156 | - if (tau[cpu].low >= step_size){ |
157 | - tau[cpu].low -= step_size; |
158 | - tau[cpu].high -= (step_size - window_expand); |
159 | - } |
160 | - tau[cpu].grew = 1; |
161 | -#ifdef DEBUG |
162 | - printk("low threshold crossed "); |
163 | -#endif |
164 | + thrm = mfspr(SPRN_THRM1); |
165 | + if ((thrm & bits) == bits) { |
166 | + mtspr(SPRN_THRM1, 0); |
167 | + |
168 | + if (tau[cpu].low >= step_size) { |
169 | + tau[cpu].low -= step_size; |
170 | + tau[cpu].high -= (step_size - window_expand); |
171 | } |
172 | + tau[cpu].grew = 1; |
173 | + pr_debug("%s: low threshold crossed\n", __func__); |
174 | } |
175 | - if((thrm = mfspr(SPRN_THRM2)) & THRM1_TIV){ /* is valid? */ |
176 | - if(thrm & THRM1_TIN){ /* crossed high threshold */ |
177 | - if (tau[cpu].high <= 127-step_size){ |
178 | - tau[cpu].low += (step_size - window_expand); |
179 | - tau[cpu].high += step_size; |
180 | - } |
181 | - tau[cpu].grew = 1; |
182 | -#ifdef DEBUG |
183 | - printk("high threshold crossed "); |
184 | -#endif |
185 | + thrm = mfspr(SPRN_THRM2); |
186 | + if ((thrm & bits) == bits) { |
187 | + mtspr(SPRN_THRM2, 0); |
188 | + |
189 | + if (tau[cpu].high <= 127 - step_size) { |
190 | + tau[cpu].low += (step_size - window_expand); |
191 | + tau[cpu].high += step_size; |
192 | } |
193 | + tau[cpu].grew = 1; |
194 | + pr_debug("%s: high threshold crossed\n", __func__); |
195 | } |
196 | - |
197 | -#ifdef DEBUG |
198 | - printk("grew = %d\n", tau[cpu].grew); |
199 | -#endif |
200 | - |
201 | -#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */ |
202 | - set_thresholds(cpu); |
203 | -#endif |
204 | - |
205 | } |
206 | |
207 | #ifdef CONFIG_TAU_INT |
208 | @@ -136,18 +120,18 @@ void TAUException(struct pt_regs * regs) |
209 | static void tau_timeout(void * info) |
210 | { |
211 | int cpu; |
212 | - unsigned long flags; |
213 | int size; |
214 | int shrink; |
215 | |
216 | - /* disabling interrupts *should* be okay */ |
217 | - local_irq_save(flags); |
218 | cpu = smp_processor_id(); |
219 | |
220 | #ifndef CONFIG_TAU_INT |
221 | TAUupdate(cpu); |
222 | #endif |
223 | |
224 | + /* Stop thermal sensor comparisons and interrupts */ |
225 | + mtspr(SPRN_THRM3, 0); |
226 | + |
227 | size = tau[cpu].high - tau[cpu].low; |
228 | if (size > min_window && ! tau[cpu].grew) { |
229 | /* do an exponential shrink of half the amount currently over size */ |
230 | @@ -169,22 +153,12 @@ static void tau_timeout(void * info) |
231 | |
232 | set_thresholds(cpu); |
233 | |
234 | - /* |
235 | - * Do the enable every time, since otherwise a bunch of (relatively) |
236 | - * complex sleep code needs to be added. One mtspr every time |
237 | - * tau_timeout is called is probably not a big deal. |
238 | - * |
239 | - * Enable thermal sensor and set up sample interval timer |
240 | - * need 20 us to do the compare.. until a nice 'cpu_speed' function |
241 | - * call is implemented, just assume a 500 mhz clock. It doesn't really |
242 | - * matter if we take too long for a compare since it's all interrupt |
243 | - * driven anyway. |
244 | - * |
245 | - * use a extra long time.. (60 us @ 500 mhz) |
246 | + /* Restart thermal sensor comparisons and interrupts. |
247 | + * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet" |
248 | + * recommends that "the maximum value be set in THRM3 under all |
249 | + * conditions." |
250 | */ |
251 | - mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E); |
252 | - |
253 | - local_irq_restore(flags); |
254 | + mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E); |
255 | } |
256 | |
257 | static void tau_timeout_smp(unsigned long unused) |
258 | diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h |
259 | index acd17648cd188..5ea24d16a74a1 100644 |
260 | --- a/arch/powerpc/perf/hv-gpci-requests.h |
261 | +++ b/arch/powerpc/perf/hv-gpci-requests.h |
262 | @@ -94,7 +94,7 @@ REQUEST(__field(0, 8, partition_id) |
263 | |
264 | #define REQUEST_NAME system_performance_capabilities |
265 | #define REQUEST_NUM 0x40 |
266 | -#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" |
267 | +#define REQUEST_IDX_KIND "starting_index=0xffffffff" |
268 | #include I(REQUEST_BEGIN) |
269 | REQUEST(__field(0, 1, perf_collect_privileged) |
270 | __field(0x1, 1, capability_mask) |
271 | @@ -222,7 +222,7 @@ REQUEST(__field(0, 2, partition_id) |
272 | |
273 | #define REQUEST_NAME system_hypervisor_times |
274 | #define REQUEST_NUM 0xF0 |
275 | -#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" |
276 | +#define REQUEST_IDX_KIND "starting_index=0xffffffff" |
277 | #include I(REQUEST_BEGIN) |
278 | REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors) |
279 | __count(0x8, 8, time_spent_processing_virtual_processor_timers) |
280 | @@ -233,7 +233,7 @@ REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors) |
281 | |
282 | #define REQUEST_NAME system_tlbie_count_and_time |
283 | #define REQUEST_NUM 0xF4 |
284 | -#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" |
285 | +#define REQUEST_IDX_KIND "starting_index=0xffffffff" |
286 | #include I(REQUEST_BEGIN) |
287 | REQUEST(__count(0, 8, tlbie_instructions_issued) |
288 | /* |
289 | diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c |
290 | index 6143c99f3ec50..7592a6491a9a2 100644 |
291 | --- a/arch/powerpc/perf/isa207-common.c |
292 | +++ b/arch/powerpc/perf/isa207-common.c |
293 | @@ -51,6 +51,15 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) |
294 | |
295 | mask |= CNST_PMC_MASK(pmc); |
296 | value |= CNST_PMC_VAL(pmc); |
297 | + |
298 | + /* |
299 | + * PMC5 and PMC6 are used to count cycles and instructions and |
300 | + * they do not support most of the constraint bits. Add a check |
301 | + * to exclude PMC5/6 from most of the constraints except for |
302 | + * EBB/BHRB. |
303 | + */ |
304 | + if (pmc >= 5) |
305 | + goto ebb_bhrb; |
306 | } |
307 | |
308 | if (pmc <= 4) { |
309 | @@ -111,6 +120,7 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) |
310 | value |= CNST_THRESH_VAL(event >> EVENT_THRESH_SHIFT); |
311 | } |
312 | |
313 | +ebb_bhrb: |
314 | if (!pmc && ebb) |
315 | /* EBB events must specify the PMC */ |
316 | return -1; |
317 | diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig |
318 | index fbdae8377b714..a7ba4c61d8e93 100644 |
319 | --- a/arch/powerpc/platforms/Kconfig |
320 | +++ b/arch/powerpc/platforms/Kconfig |
321 | @@ -242,7 +242,7 @@ config TAU |
322 | temp is actually what /proc/cpuinfo says it is. |
323 | |
324 | config TAU_INT |
325 | - bool "Interrupt driven TAU driver (DANGEROUS)" |
326 | + bool "Interrupt driven TAU driver (EXPERIMENTAL)" |
327 | depends on TAU |
328 | ---help--- |
329 | The TAU supports an interrupt driven mode which causes an interrupt |
330 | @@ -250,12 +250,7 @@ config TAU_INT |
331 | to get notified the temp has exceeded a range. With this option off, |
332 | a timer is used to re-check the temperature periodically. |
333 | |
334 | - However, on some cpus it appears that the TAU interrupt hardware |
335 | - is buggy and can cause a situation which would lead unexplained hard |
336 | - lockups. |
337 | - |
338 | - Unless you are extending the TAU driver, or enjoy kernel/hardware |
339 | - debugging, leave this option off. |
340 | + If in doubt, say N here. |
341 | |
342 | config TAU_AVERAGE |
343 | bool "Average high and low temp" |
344 | diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c |
345 | index 4c827826c05eb..e21e2c0af69d2 100644 |
346 | --- a/arch/powerpc/platforms/powernv/opal-dump.c |
347 | +++ b/arch/powerpc/platforms/powernv/opal-dump.c |
348 | @@ -319,15 +319,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj, |
349 | return count; |
350 | } |
351 | |
352 | -static struct dump_obj *create_dump_obj(uint32_t id, size_t size, |
353 | - uint32_t type) |
354 | +static void create_dump_obj(uint32_t id, size_t size, uint32_t type) |
355 | { |
356 | struct dump_obj *dump; |
357 | int rc; |
358 | |
359 | dump = kzalloc(sizeof(*dump), GFP_KERNEL); |
360 | if (!dump) |
361 | - return NULL; |
362 | + return; |
363 | |
364 | dump->kobj.kset = dump_kset; |
365 | |
366 | @@ -347,21 +346,39 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size, |
367 | rc = kobject_add(&dump->kobj, NULL, "0x%x-0x%x", type, id); |
368 | if (rc) { |
369 | kobject_put(&dump->kobj); |
370 | - return NULL; |
371 | + return; |
372 | } |
373 | |
374 | + /* |
375 | + * As soon as the sysfs file for this dump is created/activated there is |
376 | + * a chance the opal_errd daemon (or any userspace) might read and |
377 | + * acknowledge the dump before kobject_uevent() is called. If that |
378 | + * happens then there is a potential race between |
379 | + * dump_ack_store->kobject_put() and kobject_uevent() which leads to a |
380 | + * use-after-free of a kernfs object resulting in a kernel crash. |
381 | + * |
382 | + * To avoid that, we need to take a reference on behalf of the bin file, |
383 | + * so that our reference remains valid while we call kobject_uevent(). |
384 | + * We then drop our reference before exiting the function, leaving the |
385 | + * bin file to drop the last reference (if it hasn't already). |
386 | + */ |
387 | + |
388 | + /* Take a reference for the bin file */ |
389 | + kobject_get(&dump->kobj); |
390 | rc = sysfs_create_bin_file(&dump->kobj, &dump->dump_attr); |
391 | - if (rc) { |
392 | + if (rc == 0) { |
393 | + kobject_uevent(&dump->kobj, KOBJ_ADD); |
394 | + |
395 | + pr_info("%s: New platform dump. ID = 0x%x Size %u\n", |
396 | + __func__, dump->id, dump->size); |
397 | + } else { |
398 | + /* Drop reference count taken for bin file */ |
399 | kobject_put(&dump->kobj); |
400 | - return NULL; |
401 | } |
402 | |
403 | - pr_info("%s: New platform dump. ID = 0x%x Size %u\n", |
404 | - __func__, dump->id, dump->size); |
405 | - |
406 | - kobject_uevent(&dump->kobj, KOBJ_ADD); |
407 | - |
408 | - return dump; |
409 | + /* Drop our reference */ |
410 | + kobject_put(&dump->kobj); |
411 | + return; |
412 | } |
413 | |
414 | static irqreturn_t process_dump(int irq, void *data) |
415 | diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c |
416 | index 31ca557af60bc..262b8c5e1b9d0 100644 |
417 | --- a/arch/powerpc/platforms/pseries/rng.c |
418 | +++ b/arch/powerpc/platforms/pseries/rng.c |
419 | @@ -40,6 +40,7 @@ static __init int rng_init(void) |
420 | |
421 | ppc_md.get_random_seed = pseries_get_random_long; |
422 | |
423 | + of_node_put(dn); |
424 | return 0; |
425 | } |
426 | machine_subsys_initcall(pseries, rng_init); |
427 | diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c |
428 | index e7fa26c4ff73e..d3a0322ee3276 100644 |
429 | --- a/arch/powerpc/sysdev/xics/icp-hv.c |
430 | +++ b/arch/powerpc/sysdev/xics/icp-hv.c |
431 | @@ -179,6 +179,7 @@ int icp_hv_init(void) |
432 | |
433 | icp_ops = &icp_hv_ops; |
434 | |
435 | + of_node_put(np); |
436 | return 0; |
437 | } |
438 | |
439 | diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c |
440 | index da3cd734dee10..d455221d958fc 100644 |
441 | --- a/arch/x86/kvm/emulate.c |
442 | +++ b/arch/x86/kvm/emulate.c |
443 | @@ -3536,7 +3536,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt) |
444 | u64 tsc_aux = 0; |
445 | |
446 | if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux)) |
447 | - return emulate_gp(ctxt, 0); |
448 | + return emulate_ud(ctxt); |
449 | ctxt->dst.val = tsc_aux; |
450 | return X86EMUL_CONTINUE; |
451 | } |
452 | diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c |
453 | index 73055b8e411f4..5cbc6591fa1d3 100644 |
454 | --- a/arch/x86/kvm/mmu.c |
455 | +++ b/arch/x86/kvm/mmu.c |
456 | @@ -5321,6 +5321,7 @@ static void kvm_recover_nx_lpages(struct kvm *kvm) |
457 | cond_resched_lock(&kvm->mmu_lock); |
458 | } |
459 | } |
460 | + kvm_mmu_commit_zap_page(kvm, &invalid_list); |
461 | |
462 | spin_unlock(&kvm->mmu_lock); |
463 | srcu_read_unlock(&kvm->srcu, rcu_idx); |
464 | diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c |
465 | index d38f098350f65..ba818a738f9a5 100644 |
466 | --- a/crypto/algif_aead.c |
467 | +++ b/crypto/algif_aead.c |
468 | @@ -455,7 +455,7 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg, |
469 | memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm)); |
470 | aead_request_set_tfm(req, tfm); |
471 | aead_request_set_ad(req, ctx->aead_assoclen); |
472 | - aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, |
473 | + aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, |
474 | aead_async_cb, req); |
475 | used -= ctx->aead_assoclen; |
476 | |
477 | @@ -925,7 +925,7 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) |
478 | ask->private = ctx; |
479 | |
480 | aead_request_set_tfm(&ctx->aead_req, aead); |
481 | - aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG, |
482 | + aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, |
483 | af_alg_complete, &ctx->completion); |
484 | |
485 | sk->sk_destruct = aead_sock_destruct; |
486 | diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c |
487 | index 90988e7a5b47f..2e7da9b379d48 100644 |
488 | --- a/drivers/clk/at91/clk-main.c |
489 | +++ b/drivers/clk/at91/clk-main.c |
490 | @@ -517,12 +517,17 @@ static int clk_sam9x5_main_set_parent(struct clk_hw *hw, u8 index) |
491 | return -EINVAL; |
492 | |
493 | regmap_read(regmap, AT91_CKGR_MOR, &tmp); |
494 | - tmp &= ~MOR_KEY_MASK; |
495 | |
496 | if (index && !(tmp & AT91_PMC_MOSCSEL)) |
497 | - regmap_write(regmap, AT91_CKGR_MOR, tmp | AT91_PMC_MOSCSEL); |
498 | + tmp = AT91_PMC_MOSCSEL; |
499 | else if (!index && (tmp & AT91_PMC_MOSCSEL)) |
500 | - regmap_write(regmap, AT91_CKGR_MOR, tmp & ~AT91_PMC_MOSCSEL); |
501 | + tmp = 0; |
502 | + else |
503 | + return 0; |
504 | + |
505 | + regmap_update_bits(regmap, AT91_CKGR_MOR, |
506 | + AT91_PMC_MOSCSEL | MOR_KEY_MASK, |
507 | + tmp | AT91_PMC_KEY); |
508 | |
509 | while (!clk_sam9x5_main_ready(regmap)) |
510 | cpu_relax(); |
511 | diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c |
512 | index 2b5075298cdc0..3f16b553982d1 100644 |
513 | --- a/drivers/clk/bcm/clk-bcm2835.c |
514 | +++ b/drivers/clk/bcm/clk-bcm2835.c |
515 | @@ -1177,8 +1177,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman, |
516 | pll->hw.init = &init; |
517 | |
518 | ret = devm_clk_hw_register(cprman->dev, &pll->hw); |
519 | - if (ret) |
520 | + if (ret) { |
521 | + kfree(pll); |
522 | return NULL; |
523 | + } |
524 | return &pll->hw; |
525 | } |
526 | |
527 | diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c |
528 | index c3b05676e0dbe..8d18264794252 100644 |
529 | --- a/drivers/cpufreq/powernv-cpufreq.c |
530 | +++ b/drivers/cpufreq/powernv-cpufreq.c |
531 | @@ -784,12 +784,15 @@ static int powernv_cpufreq_reboot_notifier(struct notifier_block *nb, |
532 | unsigned long action, void *unused) |
533 | { |
534 | int cpu; |
535 | - struct cpufreq_policy cpu_policy; |
536 | + struct cpufreq_policy *cpu_policy; |
537 | |
538 | rebooting = true; |
539 | for_each_online_cpu(cpu) { |
540 | - cpufreq_get_policy(&cpu_policy, cpu); |
541 | - powernv_cpufreq_target_index(&cpu_policy, get_nominal_index()); |
542 | + cpu_policy = cpufreq_cpu_get(cpu); |
543 | + if (!cpu_policy) |
544 | + continue; |
545 | + powernv_cpufreq_target_index(cpu_policy, get_nominal_index()); |
546 | + cpufreq_cpu_put(cpu_policy); |
547 | } |
548 | |
549 | return NOTIFY_DONE; |
550 | diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c |
551 | index c3f13d6505e15..0aa18c1164bfb 100644 |
552 | --- a/drivers/crypto/ccp/ccp-ops.c |
553 | +++ b/drivers/crypto/ccp/ccp-ops.c |
554 | @@ -1195,7 +1195,7 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) |
555 | break; |
556 | default: |
557 | ret = -EINVAL; |
558 | - goto e_ctx; |
559 | + goto e_data; |
560 | } |
561 | } else { |
562 | /* Stash the context */ |
563 | diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c |
564 | index b54af97a20bb3..a54de1299e9ef 100644 |
565 | --- a/drivers/crypto/ixp4xx_crypto.c |
566 | +++ b/drivers/crypto/ixp4xx_crypto.c |
567 | @@ -532,7 +532,7 @@ static void release_ixp_crypto(struct device *dev) |
568 | |
569 | if (crypt_virt) { |
570 | dma_free_coherent(dev, |
571 | - NPE_QLEN_TOTAL * sizeof( struct crypt_ctl), |
572 | + NPE_QLEN * sizeof(struct crypt_ctl), |
573 | crypt_virt, crypt_phys); |
574 | } |
575 | return; |
576 | diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c |
577 | index e7ca922a45e13..4adcf89add252 100644 |
578 | --- a/drivers/crypto/omap-sham.c |
579 | +++ b/drivers/crypto/omap-sham.c |
580 | @@ -454,6 +454,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length, |
581 | struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req); |
582 | u32 val, mask; |
583 | |
584 | + if (likely(ctx->digcnt)) |
585 | + omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt); |
586 | + |
587 | /* |
588 | * Setting ALGO_CONST only for the first iteration and |
589 | * CLOSE_HASH only for the last one. Note that flags mode bits |
590 | diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c |
591 | index c655162caf08f..599038edd90d3 100644 |
592 | --- a/drivers/edac/i5100_edac.c |
593 | +++ b/drivers/edac/i5100_edac.c |
594 | @@ -1073,16 +1073,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) |
595 | PCI_DEVICE_ID_INTEL_5100_19, 0); |
596 | if (!einj) { |
597 | ret = -ENODEV; |
598 | - goto bail_einj; |
599 | + goto bail_mc_free; |
600 | } |
601 | |
602 | rc = pci_enable_device(einj); |
603 | if (rc < 0) { |
604 | ret = rc; |
605 | - goto bail_disable_einj; |
606 | + goto bail_einj; |
607 | } |
608 | |
609 | - |
610 | mci->pdev = &pdev->dev; |
611 | |
612 | priv = mci->pvt_info; |
613 | @@ -1149,14 +1148,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) |
614 | bail_scrub: |
615 | priv->scrub_enable = 0; |
616 | cancel_delayed_work_sync(&(priv->i5100_scrubbing)); |
617 | - edac_mc_free(mci); |
618 | - |
619 | -bail_disable_einj: |
620 | pci_disable_device(einj); |
621 | |
622 | bail_einj: |
623 | pci_dev_put(einj); |
624 | |
625 | +bail_mc_free: |
626 | + edac_mc_free(mci); |
627 | + |
628 | bail_disable_ch1: |
629 | pci_disable_device(ch1mm); |
630 | |
631 | diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c |
632 | index c52f9adf5e04c..7ec4e3fbafd8c 100644 |
633 | --- a/drivers/gpu/drm/gma500/cdv_intel_dp.c |
634 | +++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c |
635 | @@ -2121,7 +2121,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev |
636 | intel_dp->dpcd, |
637 | sizeof(intel_dp->dpcd)); |
638 | cdv_intel_edp_panel_vdd_off(gma_encoder); |
639 | - if (ret == 0) { |
640 | + if (ret <= 0) { |
641 | /* if this fails, presume the device is a ghost */ |
642 | DRM_INFO("failed to retrieve link info, disabling eDP\n"); |
643 | cdv_intel_dp_encoder_destroy(encoder); |
644 | diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c |
645 | index 036b0fbae0fb7..ba7855da7c7f6 100644 |
646 | --- a/drivers/gpu/drm/virtio/virtgpu_kms.c |
647 | +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c |
648 | @@ -113,8 +113,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev, |
649 | vgdev->capsets[i].id > 0, 5 * HZ); |
650 | if (ret == 0) { |
651 | DRM_ERROR("timed out waiting for cap set %d\n", i); |
652 | + spin_lock(&vgdev->display_info_lock); |
653 | kfree(vgdev->capsets); |
654 | vgdev->capsets = NULL; |
655 | + spin_unlock(&vgdev->display_info_lock); |
656 | return; |
657 | } |
658 | DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n", |
659 | diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c |
660 | index 772a5a3b0ce1a..18e8fcad6690b 100644 |
661 | --- a/drivers/gpu/drm/virtio/virtgpu_vq.c |
662 | +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c |
663 | @@ -596,9 +596,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev, |
664 | int i = le32_to_cpu(cmd->capset_index); |
665 | |
666 | spin_lock(&vgdev->display_info_lock); |
667 | - vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); |
668 | - vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); |
669 | - vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); |
670 | + if (vgdev->capsets) { |
671 | + vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); |
672 | + vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); |
673 | + vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); |
674 | + } else { |
675 | + DRM_ERROR("invalid capset memory."); |
676 | + } |
677 | spin_unlock(&vgdev->display_info_lock); |
678 | wake_up(&vgdev->resp_wq); |
679 | } |
680 | diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c |
681 | index bf4675a273965..9be8c31f613fd 100644 |
682 | --- a/drivers/hid/hid-roccat-kone.c |
683 | +++ b/drivers/hid/hid-roccat-kone.c |
684 | @@ -297,31 +297,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj, |
685 | struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev)); |
686 | struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev)); |
687 | int retval = 0, difference, old_profile; |
688 | + struct kone_settings *settings = (struct kone_settings *)buf; |
689 | |
690 | /* I need to get my data in one piece */ |
691 | if (off != 0 || count != sizeof(struct kone_settings)) |
692 | return -EINVAL; |
693 | |
694 | mutex_lock(&kone->kone_lock); |
695 | - difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings)); |
696 | + difference = memcmp(settings, &kone->settings, |
697 | + sizeof(struct kone_settings)); |
698 | if (difference) { |
699 | - retval = kone_set_settings(usb_dev, |
700 | - (struct kone_settings const *)buf); |
701 | - if (retval) { |
702 | - mutex_unlock(&kone->kone_lock); |
703 | - return retval; |
704 | + if (settings->startup_profile < 1 || |
705 | + settings->startup_profile > 5) { |
706 | + retval = -EINVAL; |
707 | + goto unlock; |
708 | } |
709 | |
710 | + retval = kone_set_settings(usb_dev, settings); |
711 | + if (retval) |
712 | + goto unlock; |
713 | + |
714 | old_profile = kone->settings.startup_profile; |
715 | - memcpy(&kone->settings, buf, sizeof(struct kone_settings)); |
716 | + memcpy(&kone->settings, settings, sizeof(struct kone_settings)); |
717 | |
718 | kone_profile_activated(kone, kone->settings.startup_profile); |
719 | |
720 | if (kone->settings.startup_profile != old_profile) |
721 | kone_profile_report(kone, kone->settings.startup_profile); |
722 | } |
723 | +unlock: |
724 | mutex_unlock(&kone->kone_lock); |
725 | |
726 | + if (retval) |
727 | + return retval; |
728 | + |
729 | return sizeof(struct kone_settings); |
730 | } |
731 | static BIN_ATTR(settings, 0660, kone_sysfs_read_settings, |
732 | diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c |
733 | index 20ec34761b39b..29cd059c01f1c 100644 |
734 | --- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c |
735 | +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c |
736 | @@ -231,7 +231,6 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, |
737 | ps_opcode = HNS_ROCE_WQE_OPCODE_SEND; |
738 | break; |
739 | case IB_WR_LOCAL_INV: |
740 | - break; |
741 | case IB_WR_ATOMIC_CMP_AND_SWP: |
742 | case IB_WR_ATOMIC_FETCH_AND_ADD: |
743 | case IB_WR_LSO: |
744 | diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c |
745 | index 5dc920fe13269..c8c586c78d071 100644 |
746 | --- a/drivers/infiniband/hw/mlx4/cm.c |
747 | +++ b/drivers/infiniband/hw/mlx4/cm.c |
748 | @@ -309,6 +309,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id) |
749 | if (!sriov->is_going_down) { |
750 | id->scheduled_delete = 1; |
751 | schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT); |
752 | + } else if (id->scheduled_delete) { |
753 | + /* Adjust timeout if already scheduled */ |
754 | + mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT); |
755 | } |
756 | spin_unlock_irqrestore(&sriov->going_down_lock, flags); |
757 | spin_unlock(&sriov->id_map_lock); |
758 | diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c |
759 | index f32ffd74ec476..bf4e0d7a3ec21 100644 |
760 | --- a/drivers/infiniband/hw/mlx4/mad.c |
761 | +++ b/drivers/infiniband/hw/mlx4/mad.c |
762 | @@ -1276,6 +1276,18 @@ static void mlx4_ib_tunnel_comp_handler(struct ib_cq *cq, void *arg) |
763 | spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); |
764 | } |
765 | |
766 | +static void mlx4_ib_wire_comp_handler(struct ib_cq *cq, void *arg) |
767 | +{ |
768 | + unsigned long flags; |
769 | + struct mlx4_ib_demux_pv_ctx *ctx = cq->cq_context; |
770 | + struct mlx4_ib_dev *dev = to_mdev(ctx->ib_dev); |
771 | + |
772 | + spin_lock_irqsave(&dev->sriov.going_down_lock, flags); |
773 | + if (!dev->sriov.is_going_down && ctx->state == DEMUX_PV_STATE_ACTIVE) |
774 | + queue_work(ctx->wi_wq, &ctx->work); |
775 | + spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); |
776 | +} |
777 | + |
778 | static int mlx4_ib_post_pv_qp_buf(struct mlx4_ib_demux_pv_ctx *ctx, |
779 | struct mlx4_ib_demux_pv_qp *tun_qp, |
780 | int index) |
781 | @@ -1978,7 +1990,8 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, |
782 | cq_size *= 2; |
783 | |
784 | cq_attr.cqe = cq_size; |
785 | - ctx->cq = ib_create_cq(ctx->ib_dev, mlx4_ib_tunnel_comp_handler, |
786 | + ctx->cq = ib_create_cq(ctx->ib_dev, |
787 | + create_tun ? mlx4_ib_tunnel_comp_handler : mlx4_ib_wire_comp_handler, |
788 | NULL, ctx, &cq_attr); |
789 | if (IS_ERR(ctx->cq)) { |
790 | ret = PTR_ERR(ctx->cq); |
791 | @@ -2015,6 +2028,7 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, |
792 | INIT_WORK(&ctx->work, mlx4_ib_sqp_comp_worker); |
793 | |
794 | ctx->wq = to_mdev(ibdev)->sriov.demux[port - 1].wq; |
795 | + ctx->wi_wq = to_mdev(ibdev)->sriov.demux[port - 1].wi_wq; |
796 | |
797 | ret = ib_req_notify_cq(ctx->cq, IB_CQ_NEXT_COMP); |
798 | if (ret) { |
799 | @@ -2158,7 +2172,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, |
800 | goto err_mcg; |
801 | } |
802 | |
803 | - snprintf(name, sizeof name, "mlx4_ibt%d", port); |
804 | + snprintf(name, sizeof(name), "mlx4_ibt%d", port); |
805 | ctx->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); |
806 | if (!ctx->wq) { |
807 | pr_err("Failed to create tunnelling WQ for port %d\n", port); |
808 | @@ -2166,7 +2180,15 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, |
809 | goto err_wq; |
810 | } |
811 | |
812 | - snprintf(name, sizeof name, "mlx4_ibud%d", port); |
813 | + snprintf(name, sizeof(name), "mlx4_ibwi%d", port); |
814 | + ctx->wi_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); |
815 | + if (!ctx->wi_wq) { |
816 | + pr_err("Failed to create wire WQ for port %d\n", port); |
817 | + ret = -ENOMEM; |
818 | + goto err_wiwq; |
819 | + } |
820 | + |
821 | + snprintf(name, sizeof(name), "mlx4_ibud%d", port); |
822 | ctx->ud_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); |
823 | if (!ctx->ud_wq) { |
824 | pr_err("Failed to create up/down WQ for port %d\n", port); |
825 | @@ -2177,6 +2199,10 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, |
826 | return 0; |
827 | |
828 | err_udwq: |
829 | + destroy_workqueue(ctx->wi_wq); |
830 | + ctx->wi_wq = NULL; |
831 | + |
832 | +err_wiwq: |
833 | destroy_workqueue(ctx->wq); |
834 | ctx->wq = NULL; |
835 | |
836 | @@ -2224,12 +2250,14 @@ static void mlx4_ib_free_demux_ctx(struct mlx4_ib_demux_ctx *ctx) |
837 | ctx->tun[i]->state = DEMUX_PV_STATE_DOWNING; |
838 | } |
839 | flush_workqueue(ctx->wq); |
840 | + flush_workqueue(ctx->wi_wq); |
841 | for (i = 0; i < dev->dev->caps.sqp_demux; i++) { |
842 | destroy_pv_resources(dev, i, ctx->port, ctx->tun[i], 0); |
843 | free_pv_object(dev, i, ctx->port); |
844 | } |
845 | kfree(ctx->tun); |
846 | destroy_workqueue(ctx->ud_wq); |
847 | + destroy_workqueue(ctx->wi_wq); |
848 | destroy_workqueue(ctx->wq); |
849 | } |
850 | } |
851 | diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h |
852 | index 35141f451e5c7..91c89ef6ce04f 100644 |
853 | --- a/drivers/infiniband/hw/mlx4/mlx4_ib.h |
854 | +++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h |
855 | @@ -439,6 +439,7 @@ struct mlx4_ib_demux_pv_ctx { |
856 | struct ib_pd *pd; |
857 | struct work_struct work; |
858 | struct workqueue_struct *wq; |
859 | + struct workqueue_struct *wi_wq; |
860 | struct mlx4_ib_demux_pv_qp qp[2]; |
861 | }; |
862 | |
863 | @@ -446,6 +447,7 @@ struct mlx4_ib_demux_ctx { |
864 | struct ib_device *ib_dev; |
865 | int port; |
866 | struct workqueue_struct *wq; |
867 | + struct workqueue_struct *wi_wq; |
868 | struct workqueue_struct *ud_wq; |
869 | spinlock_t ud_lock; |
870 | atomic64_t subnet_prefix; |
871 | diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c |
872 | index f937873e93dfc..b95f1457c407d 100644 |
873 | --- a/drivers/infiniband/hw/qedr/main.c |
874 | +++ b/drivers/infiniband/hw/qedr/main.c |
875 | @@ -527,7 +527,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev) |
876 | qed_attr = dev->ops->rdma_query_device(dev->rdma_ctx); |
877 | |
878 | /* Part 2 - check capabilities */ |
879 | - page_size = ~dev->attr.page_size_caps + 1; |
880 | + page_size = ~qed_attr->page_size_caps + 1; |
881 | if (page_size > PAGE_SIZE) { |
882 | DP_ERR(dev, |
883 | "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n", |
884 | diff --git a/drivers/infiniband/sw/rdmavt/vt.c b/drivers/infiniband/sw/rdmavt/vt.c |
885 | index d430c2f7cec4c..1a1d7329fbb20 100644 |
886 | --- a/drivers/infiniband/sw/rdmavt/vt.c |
887 | +++ b/drivers/infiniband/sw/rdmavt/vt.c |
888 | @@ -96,9 +96,7 @@ struct rvt_dev_info *rvt_alloc_device(size_t size, int nports) |
889 | if (!rdi) |
890 | return rdi; |
891 | |
892 | - rdi->ports = kcalloc(nports, |
893 | - sizeof(struct rvt_ibport **), |
894 | - GFP_KERNEL); |
895 | + rdi->ports = kcalloc(nports, sizeof(*rdi->ports), GFP_KERNEL); |
896 | if (!rdi->ports) |
897 | ib_dealloc_device(&rdi->ibdev); |
898 | |
899 | diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c |
900 | index f77b295e0123e..01788a78041b3 100644 |
901 | --- a/drivers/input/keyboard/ep93xx_keypad.c |
902 | +++ b/drivers/input/keyboard/ep93xx_keypad.c |
903 | @@ -257,8 +257,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev) |
904 | } |
905 | |
906 | keypad->irq = platform_get_irq(pdev, 0); |
907 | - if (!keypad->irq) { |
908 | - err = -ENXIO; |
909 | + if (keypad->irq < 0) { |
910 | + err = keypad->irq; |
911 | goto failed_free; |
912 | } |
913 | |
914 | diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c |
915 | index 3d2c60c8de830..c6a468dfdfb48 100644 |
916 | --- a/drivers/input/keyboard/omap4-keypad.c |
917 | +++ b/drivers/input/keyboard/omap4-keypad.c |
918 | @@ -253,10 +253,8 @@ static int omap4_keypad_probe(struct platform_device *pdev) |
919 | } |
920 | |
921 | irq = platform_get_irq(pdev, 0); |
922 | - if (!irq) { |
923 | - dev_err(&pdev->dev, "no keyboard irq assigned\n"); |
924 | - return -EINVAL; |
925 | - } |
926 | + if (irq < 0) |
927 | + return irq; |
928 | |
929 | keypad_data = kzalloc(sizeof(struct omap4_keypad), GFP_KERNEL); |
930 | if (!keypad_data) { |
931 | diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c |
932 | index 323a0fb575a44..d87e7cd11ecb6 100644 |
933 | --- a/drivers/input/keyboard/twl4030_keypad.c |
934 | +++ b/drivers/input/keyboard/twl4030_keypad.c |
935 | @@ -63,7 +63,7 @@ struct twl4030_keypad { |
936 | bool autorepeat; |
937 | unsigned int n_rows; |
938 | unsigned int n_cols; |
939 | - unsigned int irq; |
940 | + int irq; |
941 | |
942 | struct device *dbg_dev; |
943 | struct input_dev *input; |
944 | @@ -389,10 +389,8 @@ static int twl4030_kp_probe(struct platform_device *pdev) |
945 | } |
946 | |
947 | kp->irq = platform_get_irq(pdev, 0); |
948 | - if (!kp->irq) { |
949 | - dev_err(&pdev->dev, "no keyboard irq assigned\n"); |
950 | - return -EINVAL; |
951 | - } |
952 | + if (kp->irq < 0) |
953 | + return kp->irq; |
954 | |
955 | error = matrix_keypad_build_keymap(keymap_data, NULL, |
956 | TWL4030_MAX_ROWS, |
957 | diff --git a/drivers/input/serio/sun4i-ps2.c b/drivers/input/serio/sun4i-ps2.c |
958 | index 04b96fe393397..46512b4d686a8 100644 |
959 | --- a/drivers/input/serio/sun4i-ps2.c |
960 | +++ b/drivers/input/serio/sun4i-ps2.c |
961 | @@ -210,7 +210,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev) |
962 | struct sun4i_ps2data *drvdata; |
963 | struct serio *serio; |
964 | struct device *dev = &pdev->dev; |
965 | - unsigned int irq; |
966 | int error; |
967 | |
968 | drvdata = kzalloc(sizeof(struct sun4i_ps2data), GFP_KERNEL); |
969 | @@ -263,14 +262,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev) |
970 | writel(0, drvdata->reg_base + PS2_REG_GCTL); |
971 | |
972 | /* Get IRQ for the device */ |
973 | - irq = platform_get_irq(pdev, 0); |
974 | - if (!irq) { |
975 | - dev_err(dev, "no IRQ found\n"); |
976 | - error = -ENXIO; |
977 | + drvdata->irq = platform_get_irq(pdev, 0); |
978 | + if (drvdata->irq < 0) { |
979 | + error = drvdata->irq; |
980 | goto err_disable_clk; |
981 | } |
982 | |
983 | - drvdata->irq = irq; |
984 | drvdata->serio = serio; |
985 | drvdata->dev = dev; |
986 | |
987 | diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c |
988 | index 8275267eac254..4be7ddc04af0f 100644 |
989 | --- a/drivers/input/touchscreen/imx6ul_tsc.c |
990 | +++ b/drivers/input/touchscreen/imx6ul_tsc.c |
991 | @@ -490,20 +490,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev) |
992 | |
993 | mutex_lock(&input_dev->mutex); |
994 | |
995 | - if (input_dev->users) { |
996 | - retval = clk_prepare_enable(tsc->adc_clk); |
997 | - if (retval) |
998 | - goto out; |
999 | - |
1000 | - retval = clk_prepare_enable(tsc->tsc_clk); |
1001 | - if (retval) { |
1002 | - clk_disable_unprepare(tsc->adc_clk); |
1003 | - goto out; |
1004 | - } |
1005 | + if (!input_dev->users) |
1006 | + goto out; |
1007 | |
1008 | - retval = imx6ul_tsc_init(tsc); |
1009 | + retval = clk_prepare_enable(tsc->adc_clk); |
1010 | + if (retval) |
1011 | + goto out; |
1012 | + |
1013 | + retval = clk_prepare_enable(tsc->tsc_clk); |
1014 | + if (retval) { |
1015 | + clk_disable_unprepare(tsc->adc_clk); |
1016 | + goto out; |
1017 | } |
1018 | |
1019 | + retval = imx6ul_tsc_init(tsc); |
1020 | + if (retval) { |
1021 | + clk_disable_unprepare(tsc->tsc_clk); |
1022 | + clk_disable_unprepare(tsc->adc_clk); |
1023 | + goto out; |
1024 | + } |
1025 | out: |
1026 | mutex_unlock(&input_dev->mutex); |
1027 | return retval; |
1028 | diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c |
1029 | index 5d634706a7eaa..382f290c3f4d5 100644 |
1030 | --- a/drivers/media/firewire/firedtv-fw.c |
1031 | +++ b/drivers/media/firewire/firedtv-fw.c |
1032 | @@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) |
1033 | |
1034 | name_len = fw_csr_string(unit->directory, CSR_MODEL, |
1035 | name, sizeof(name)); |
1036 | - if (name_len < 0) |
1037 | - return name_len; |
1038 | + if (name_len < 0) { |
1039 | + err = name_len; |
1040 | + goto fail_free; |
1041 | + } |
1042 | for (i = ARRAY_SIZE(model_names); --i; ) |
1043 | if (strlen(model_names[i]) <= name_len && |
1044 | strncmp(name, model_names[i], name_len) == 0) |
1045 | diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c |
1046 | index acb804bceccbc..e1736777e6ccb 100644 |
1047 | --- a/drivers/media/i2c/m5mols/m5mols_core.c |
1048 | +++ b/drivers/media/i2c/m5mols/m5mols_core.c |
1049 | @@ -754,7 +754,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable) |
1050 | |
1051 | ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies); |
1052 | if (ret) { |
1053 | - info->set_power(&client->dev, 0); |
1054 | + if (info->set_power) |
1055 | + info->set_power(&client->dev, 0); |
1056 | return ret; |
1057 | } |
1058 | |
1059 | diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c |
1060 | index 7ebcb9473956e..3e47b432d0f4e 100644 |
1061 | --- a/drivers/media/i2c/tc358743.c |
1062 | +++ b/drivers/media/i2c/tc358743.c |
1063 | @@ -1321,7 +1321,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled) |
1064 | static irqreturn_t tc358743_irq_handler(int irq, void *dev_id) |
1065 | { |
1066 | struct tc358743_state *state = dev_id; |
1067 | - bool handled; |
1068 | + bool handled = false; |
1069 | |
1070 | tc358743_isr(&state->sd, 0, &handled); |
1071 | |
1072 | diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c |
1073 | index 97b91a9f9fa93..1d6173998a299 100644 |
1074 | --- a/drivers/media/pci/bt8xx/bttv-driver.c |
1075 | +++ b/drivers/media/pci/bt8xx/bttv-driver.c |
1076 | @@ -4059,11 +4059,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) |
1077 | btv->id = dev->device; |
1078 | if (pci_enable_device(dev)) { |
1079 | pr_warn("%d: Can't enable device\n", btv->c.nr); |
1080 | - return -EIO; |
1081 | + result = -EIO; |
1082 | + goto free_mem; |
1083 | } |
1084 | if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) { |
1085 | pr_warn("%d: No suitable DMA available\n", btv->c.nr); |
1086 | - return -EIO; |
1087 | + result = -EIO; |
1088 | + goto free_mem; |
1089 | } |
1090 | if (!request_mem_region(pci_resource_start(dev,0), |
1091 | pci_resource_len(dev,0), |
1092 | @@ -4071,7 +4073,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) |
1093 | pr_warn("%d: can't request iomem (0x%llx)\n", |
1094 | btv->c.nr, |
1095 | (unsigned long long)pci_resource_start(dev, 0)); |
1096 | - return -EBUSY; |
1097 | + result = -EBUSY; |
1098 | + goto free_mem; |
1099 | } |
1100 | pci_set_master(dev); |
1101 | pci_set_command(dev); |
1102 | @@ -4257,6 +4260,10 @@ fail0: |
1103 | release_mem_region(pci_resource_start(btv->c.pci,0), |
1104 | pci_resource_len(btv->c.pci,0)); |
1105 | pci_disable_device(btv->c.pci); |
1106 | + |
1107 | +free_mem: |
1108 | + bttvs[btv->c.nr] = NULL; |
1109 | + kfree(btv); |
1110 | return result; |
1111 | } |
1112 | |
1113 | diff --git a/drivers/media/pci/saa7134/saa7134-tvaudio.c b/drivers/media/pci/saa7134/saa7134-tvaudio.c |
1114 | index 38f94b742e283..0b5d6f4994571 100644 |
1115 | --- a/drivers/media/pci/saa7134/saa7134-tvaudio.c |
1116 | +++ b/drivers/media/pci/saa7134/saa7134-tvaudio.c |
1117 | @@ -697,7 +697,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value) |
1118 | { |
1119 | int err; |
1120 | |
1121 | - audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", reg << 2, value); |
1122 | + audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", |
1123 | + (reg << 2) & 0xffffffff, value); |
1124 | err = saa_dsp_wait_bit(dev,SAA7135_DSP_RWSTATE_WRR); |
1125 | if (err < 0) |
1126 | return err; |
1127 | diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c |
1128 | index 8efe9160ab346..dbc4f57f34a52 100644 |
1129 | --- a/drivers/media/platform/exynos4-is/fimc-isp.c |
1130 | +++ b/drivers/media/platform/exynos4-is/fimc-isp.c |
1131 | @@ -311,8 +311,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on) |
1132 | |
1133 | if (on) { |
1134 | ret = pm_runtime_get_sync(&is->pdev->dev); |
1135 | - if (ret < 0) |
1136 | + if (ret < 0) { |
1137 | + pm_runtime_put(&is->pdev->dev); |
1138 | return ret; |
1139 | + } |
1140 | set_bit(IS_ST_PWR_ON, &is->state); |
1141 | |
1142 | ret = fimc_is_start_firmware(is); |
1143 | diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c |
1144 | index b91abf1c4d43b..f1921e06ffe1b 100644 |
1145 | --- a/drivers/media/platform/exynos4-is/fimc-lite.c |
1146 | +++ b/drivers/media/platform/exynos4-is/fimc-lite.c |
1147 | @@ -480,7 +480,7 @@ static int fimc_lite_open(struct file *file) |
1148 | set_bit(ST_FLITE_IN_USE, &fimc->state); |
1149 | ret = pm_runtime_get_sync(&fimc->pdev->dev); |
1150 | if (ret < 0) |
1151 | - goto unlock; |
1152 | + goto err_pm; |
1153 | |
1154 | ret = v4l2_fh_open(file); |
1155 | if (ret < 0) |
1156 | diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c |
1157 | index cdaf3a8e2555e..a1599659b88ba 100644 |
1158 | --- a/drivers/media/platform/exynos4-is/media-dev.c |
1159 | +++ b/drivers/media/platform/exynos4-is/media-dev.c |
1160 | @@ -477,8 +477,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd) |
1161 | return -ENXIO; |
1162 | |
1163 | ret = pm_runtime_get_sync(fmd->pmf); |
1164 | - if (ret < 0) |
1165 | + if (ret < 0) { |
1166 | + pm_runtime_put(fmd->pmf); |
1167 | return ret; |
1168 | + } |
1169 | |
1170 | fmd->num_sensors = 0; |
1171 | |
1172 | @@ -1255,11 +1257,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) |
1173 | if (IS_ERR(pctl->state_default)) |
1174 | return PTR_ERR(pctl->state_default); |
1175 | |
1176 | + /* PINCTRL_STATE_IDLE is optional */ |
1177 | pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, |
1178 | PINCTRL_STATE_IDLE); |
1179 | - if (IS_ERR(pctl->state_idle)) |
1180 | - return PTR_ERR(pctl->state_idle); |
1181 | - |
1182 | return 0; |
1183 | } |
1184 | |
1185 | diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c |
1186 | index befd9fc0adc4a..dc87c9cfa52ff 100644 |
1187 | --- a/drivers/media/platform/exynos4-is/mipi-csis.c |
1188 | +++ b/drivers/media/platform/exynos4-is/mipi-csis.c |
1189 | @@ -513,8 +513,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable) |
1190 | if (enable) { |
1191 | s5pcsis_clear_counters(state); |
1192 | ret = pm_runtime_get_sync(&state->pdev->dev); |
1193 | - if (ret && ret != 1) |
1194 | + if (ret && ret != 1) { |
1195 | + pm_runtime_put_noidle(&state->pdev->dev); |
1196 | return ret; |
1197 | + } |
1198 | } |
1199 | |
1200 | mutex_lock(&state->lock); |
1201 | diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c |
1202 | index ce651d3ca1b82..a56863b090144 100644 |
1203 | --- a/drivers/media/platform/omap3isp/isp.c |
1204 | +++ b/drivers/media/platform/omap3isp/isp.c |
1205 | @@ -2273,8 +2273,10 @@ static int isp_probe(struct platform_device *pdev) |
1206 | mem = platform_get_resource(pdev, IORESOURCE_MEM, i); |
1207 | isp->mmio_base[map_idx] = |
1208 | devm_ioremap_resource(isp->dev, mem); |
1209 | - if (IS_ERR(isp->mmio_base[map_idx])) |
1210 | - return PTR_ERR(isp->mmio_base[map_idx]); |
1211 | + if (IS_ERR(isp->mmio_base[map_idx])) { |
1212 | + ret = PTR_ERR(isp->mmio_base[map_idx]); |
1213 | + goto error; |
1214 | + } |
1215 | } |
1216 | |
1217 | ret = isp_get_clocks(isp); |
1218 | diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c |
1219 | index 8e9c3bd36d03e..5b5722e65e9b9 100644 |
1220 | --- a/drivers/media/platform/rcar-fcp.c |
1221 | +++ b/drivers/media/platform/rcar-fcp.c |
1222 | @@ -107,8 +107,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp) |
1223 | return 0; |
1224 | |
1225 | ret = pm_runtime_get_sync(fcp->dev); |
1226 | - if (ret < 0) |
1227 | + if (ret < 0) { |
1228 | + pm_runtime_put_noidle(fcp->dev); |
1229 | return ret; |
1230 | + } |
1231 | |
1232 | return 0; |
1233 | } |
1234 | diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c |
1235 | index ec40019703132..560e1ff236508 100644 |
1236 | --- a/drivers/media/platform/s3c-camif/camif-core.c |
1237 | +++ b/drivers/media/platform/s3c-camif/camif-core.c |
1238 | @@ -476,7 +476,7 @@ static int s3c_camif_probe(struct platform_device *pdev) |
1239 | |
1240 | ret = camif_media_dev_init(camif); |
1241 | if (ret < 0) |
1242 | - goto err_alloc; |
1243 | + goto err_pm; |
1244 | |
1245 | ret = camif_register_sensor(camif); |
1246 | if (ret < 0) |
1247 | @@ -510,10 +510,9 @@ err_sens: |
1248 | media_device_unregister(&camif->media_dev); |
1249 | media_device_cleanup(&camif->media_dev); |
1250 | camif_unregister_media_entities(camif); |
1251 | -err_alloc: |
1252 | +err_pm: |
1253 | pm_runtime_put(dev); |
1254 | pm_runtime_disable(dev); |
1255 | -err_pm: |
1256 | camif_clk_put(camif); |
1257 | err_clk: |
1258 | s3c_camif_unregister_subdev(camif); |
1259 | diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c |
1260 | index d88c9ba401b5d..bec4278401b2a 100644 |
1261 | --- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c |
1262 | +++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c |
1263 | @@ -1366,7 +1366,7 @@ static int bdisp_probe(struct platform_device *pdev) |
1264 | ret = pm_runtime_get_sync(dev); |
1265 | if (ret < 0) { |
1266 | dev_err(dev, "failed to set PM\n"); |
1267 | - goto err_dbg; |
1268 | + goto err_pm; |
1269 | } |
1270 | |
1271 | /* Filters */ |
1272 | @@ -1394,7 +1394,6 @@ err_filter: |
1273 | bdisp_hw_free_filters(bdisp->dev); |
1274 | err_pm: |
1275 | pm_runtime_put(dev); |
1276 | -err_dbg: |
1277 | bdisp_debugfs_remove(bdisp); |
1278 | err_v4l2: |
1279 | v4l2_device_unregister(&bdisp->v4l2_dev); |
1280 | diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c |
1281 | index cf2a8d8845367..c4d97fb80aaec 100644 |
1282 | --- a/drivers/media/platform/sti/hva/hva-hw.c |
1283 | +++ b/drivers/media/platform/sti/hva/hva-hw.c |
1284 | @@ -389,7 +389,7 @@ int hva_hw_probe(struct platform_device *pdev, struct hva_dev *hva) |
1285 | ret = pm_runtime_get_sync(dev); |
1286 | if (ret < 0) { |
1287 | dev_err(dev, "%s failed to set PM\n", HVA_PREFIX); |
1288 | - goto err_clk; |
1289 | + goto err_pm; |
1290 | } |
1291 | |
1292 | /* check IP hardware version */ |
1293 | diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c |
1294 | index dbb4829acc438..360a2ad14ce42 100644 |
1295 | --- a/drivers/media/platform/ti-vpe/vpe.c |
1296 | +++ b/drivers/media/platform/ti-vpe/vpe.c |
1297 | @@ -2133,6 +2133,8 @@ static int vpe_runtime_get(struct platform_device *pdev) |
1298 | |
1299 | r = pm_runtime_get_sync(&pdev->dev); |
1300 | WARN_ON(r < 0); |
1301 | + if (r) |
1302 | + pm_runtime_put_noidle(&pdev->dev); |
1303 | return r < 0 ? r : 0; |
1304 | } |
1305 | |
1306 | diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c |
1307 | index 4ac1ff482a0b3..fcb1838d670d4 100644 |
1308 | --- a/drivers/media/platform/vsp1/vsp1_drv.c |
1309 | +++ b/drivers/media/platform/vsp1/vsp1_drv.c |
1310 | @@ -487,7 +487,12 @@ int vsp1_device_get(struct vsp1_device *vsp1) |
1311 | int ret; |
1312 | |
1313 | ret = pm_runtime_get_sync(vsp1->dev); |
1314 | - return ret < 0 ? ret : 0; |
1315 | + if (ret < 0) { |
1316 | + pm_runtime_put_noidle(vsp1->dev); |
1317 | + return ret; |
1318 | + } |
1319 | + |
1320 | + return 0; |
1321 | } |
1322 | |
1323 | /* |
1324 | @@ -727,12 +732,12 @@ static int vsp1_probe(struct platform_device *pdev) |
1325 | /* Configure device parameters based on the version register. */ |
1326 | pm_runtime_enable(&pdev->dev); |
1327 | |
1328 | - ret = pm_runtime_get_sync(&pdev->dev); |
1329 | + ret = vsp1_device_get(vsp1); |
1330 | if (ret < 0) |
1331 | goto done; |
1332 | |
1333 | vsp1->version = vsp1_read(vsp1, VI6_IP_VERSION); |
1334 | - pm_runtime_put_sync(&pdev->dev); |
1335 | + vsp1_device_put(vsp1); |
1336 | |
1337 | for (i = 0; i < ARRAY_SIZE(vsp1_device_infos); ++i) { |
1338 | if ((vsp1->version & VI6_IP_VERSION_MODEL_MASK) == |
1339 | diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c |
1340 | index 9f5b59706741c..7f98db4bc0277 100644 |
1341 | --- a/drivers/media/rc/ati_remote.c |
1342 | +++ b/drivers/media/rc/ati_remote.c |
1343 | @@ -850,6 +850,10 @@ static int ati_remote_probe(struct usb_interface *interface, |
1344 | err("%s: endpoint_in message size==0? \n", __func__); |
1345 | return -ENODEV; |
1346 | } |
1347 | + if (!usb_endpoint_is_int_out(endpoint_out)) { |
1348 | + err("%s: Unexpected endpoint_out\n", __func__); |
1349 | + return -ENODEV; |
1350 | + } |
1351 | |
1352 | ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL); |
1353 | rc_dev = rc_allocate_device(); |
1354 | diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c |
1355 | index 05eed4be25df2..5156c971c241c 100644 |
1356 | --- a/drivers/media/usb/uvc/uvc_v4l2.c |
1357 | +++ b/drivers/media/usb/uvc/uvc_v4l2.c |
1358 | @@ -257,11 +257,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, |
1359 | if (ret < 0) |
1360 | goto done; |
1361 | |
1362 | + /* After the probe, update fmt with the values returned from |
1363 | + * negotiation with the device. |
1364 | + */ |
1365 | + for (i = 0; i < stream->nformats; ++i) { |
1366 | + if (probe->bFormatIndex == stream->format[i].index) { |
1367 | + format = &stream->format[i]; |
1368 | + break; |
1369 | + } |
1370 | + } |
1371 | + |
1372 | + if (i == stream->nformats) { |
1373 | + uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n", |
1374 | + probe->bFormatIndex); |
1375 | + return -EINVAL; |
1376 | + } |
1377 | + |
1378 | + for (i = 0; i < format->nframes; ++i) { |
1379 | + if (probe->bFrameIndex == format->frame[i].bFrameIndex) { |
1380 | + frame = &format->frame[i]; |
1381 | + break; |
1382 | + } |
1383 | + } |
1384 | + |
1385 | + if (i == format->nframes) { |
1386 | + uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n", |
1387 | + probe->bFrameIndex); |
1388 | + return -EINVAL; |
1389 | + } |
1390 | + |
1391 | fmt->fmt.pix.width = frame->wWidth; |
1392 | fmt->fmt.pix.height = frame->wHeight; |
1393 | fmt->fmt.pix.field = V4L2_FIELD_NONE; |
1394 | fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(format, frame); |
1395 | fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize; |
1396 | + fmt->fmt.pix.pixelformat = format->fcc; |
1397 | fmt->fmt.pix.colorspace = format->colorspace; |
1398 | fmt->fmt.pix.priv = 0; |
1399 | |
1400 | diff --git a/drivers/memory/fsl-corenet-cf.c b/drivers/memory/fsl-corenet-cf.c |
1401 | index 662d050243bec..2fbf8d09af36b 100644 |
1402 | --- a/drivers/memory/fsl-corenet-cf.c |
1403 | +++ b/drivers/memory/fsl-corenet-cf.c |
1404 | @@ -215,10 +215,8 @@ static int ccf_probe(struct platform_device *pdev) |
1405 | dev_set_drvdata(&pdev->dev, ccf); |
1406 | |
1407 | irq = platform_get_irq(pdev, 0); |
1408 | - if (!irq) { |
1409 | - dev_err(&pdev->dev, "%s: no irq\n", __func__); |
1410 | - return -ENXIO; |
1411 | - } |
1412 | + if (irq < 0) |
1413 | + return irq; |
1414 | |
1415 | ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf); |
1416 | if (ret) { |
1417 | diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c |
1418 | index bf0fe0137dfed..a9d47c06f80f3 100644 |
1419 | --- a/drivers/memory/omap-gpmc.c |
1420 | +++ b/drivers/memory/omap-gpmc.c |
1421 | @@ -951,7 +951,7 @@ static int gpmc_cs_remap(int cs, u32 base) |
1422 | int ret; |
1423 | u32 old_base, size; |
1424 | |
1425 | - if (cs > gpmc_cs_num) { |
1426 | + if (cs >= gpmc_cs_num) { |
1427 | pr_err("%s: requested chip-select is disabled\n", __func__); |
1428 | return -ENODEV; |
1429 | } |
1430 | @@ -986,7 +986,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base) |
1431 | struct resource *res = &gpmc->mem; |
1432 | int r = -1; |
1433 | |
1434 | - if (cs > gpmc_cs_num) { |
1435 | + if (cs >= gpmc_cs_num) { |
1436 | pr_err("%s: requested chip-select is disabled\n", __func__); |
1437 | return -ENODEV; |
1438 | } |
1439 | diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c |
1440 | index 98029ee0959e3..be61f8606a045 100644 |
1441 | --- a/drivers/mfd/rtsx_pcr.c |
1442 | +++ b/drivers/mfd/rtsx_pcr.c |
1443 | @@ -1255,12 +1255,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, |
1444 | ret = mfd_add_devices(&pcidev->dev, pcr->id, rtsx_pcr_cells, |
1445 | ARRAY_SIZE(rtsx_pcr_cells), NULL, 0, NULL); |
1446 | if (ret < 0) |
1447 | - goto disable_irq; |
1448 | + goto free_slots; |
1449 | |
1450 | schedule_delayed_work(&pcr->idle_work, msecs_to_jiffies(200)); |
1451 | |
1452 | return 0; |
1453 | |
1454 | +free_slots: |
1455 | + kfree(pcr->slots); |
1456 | disable_irq: |
1457 | free_irq(pcr->irq, (void *)pcr); |
1458 | disable_msi: |
1459 | diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c |
1460 | index 3270b8dbc9498..4ca245518a199 100644 |
1461 | --- a/drivers/mfd/sm501.c |
1462 | +++ b/drivers/mfd/sm501.c |
1463 | @@ -1425,8 +1425,14 @@ static int sm501_plat_probe(struct platform_device *dev) |
1464 | goto err_claim; |
1465 | } |
1466 | |
1467 | - return sm501_init_dev(sm); |
1468 | + ret = sm501_init_dev(sm); |
1469 | + if (ret) |
1470 | + goto err_unmap; |
1471 | + |
1472 | + return 0; |
1473 | |
1474 | + err_unmap: |
1475 | + iounmap(sm->regs); |
1476 | err_claim: |
1477 | release_resource(sm->regs_claim); |
1478 | kfree(sm->regs_claim); |
1479 | diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c |
1480 | index 5afe4cd165699..cd7e7e36907bc 100644 |
1481 | --- a/drivers/misc/eeprom/at25.c |
1482 | +++ b/drivers/misc/eeprom/at25.c |
1483 | @@ -355,7 +355,7 @@ static int at25_probe(struct spi_device *spi) |
1484 | at25->nvmem_config.reg_read = at25_ee_read; |
1485 | at25->nvmem_config.reg_write = at25_ee_write; |
1486 | at25->nvmem_config.priv = at25; |
1487 | - at25->nvmem_config.stride = 4; |
1488 | + at25->nvmem_config.stride = 1; |
1489 | at25->nvmem_config.word_size = 1; |
1490 | at25->nvmem_config.size = chip.byte_len; |
1491 | |
1492 | diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c |
1493 | index 32ab0f43f5061..4e2cfb6eea353 100644 |
1494 | --- a/drivers/misc/mic/scif/scif_rma.c |
1495 | +++ b/drivers/misc/mic/scif/scif_rma.c |
1496 | @@ -1401,6 +1401,8 @@ retry: |
1497 | NULL); |
1498 | up_write(&mm->mmap_sem); |
1499 | if (nr_pages != pinned_pages->nr_pages) { |
1500 | + if (pinned_pages->nr_pages < 0) |
1501 | + pinned_pages->nr_pages = 0; |
1502 | if (try_upgrade) { |
1503 | if (ulimit) |
1504 | __scif_dec_pinned_vm_lock(mm, |
1505 | @@ -1421,7 +1423,6 @@ retry: |
1506 | |
1507 | if (pinned_pages->nr_pages < nr_pages) { |
1508 | err = -EFAULT; |
1509 | - pinned_pages->nr_pages = nr_pages; |
1510 | goto dec_pinned; |
1511 | } |
1512 | |
1513 | @@ -1434,7 +1435,6 @@ dec_pinned: |
1514 | __scif_dec_pinned_vm_lock(mm, nr_pages, 0); |
1515 | /* Something went wrong! Rollback */ |
1516 | error_unmap: |
1517 | - pinned_pages->nr_pages = nr_pages; |
1518 | scif_destroy_pinned_pages(pinned_pages); |
1519 | *pages = NULL; |
1520 | dev_dbg(scif_info.mdev.this_device, |
1521 | diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c |
1522 | index 1a2b67f3183d5..f9da3150f80a2 100644 |
1523 | --- a/drivers/misc/mic/vop/vop_main.c |
1524 | +++ b/drivers/misc/mic/vop/vop_main.c |
1525 | @@ -301,7 +301,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev, |
1526 | /* First assign the vring's allocated in host memory */ |
1527 | vqconfig = _vop_vq_config(vdev->desc) + index; |
1528 | memcpy_fromio(&config, vqconfig, sizeof(config)); |
1529 | - _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN); |
1530 | + _vr_size = round_up(vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN), 4); |
1531 | vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info)); |
1532 | va = vpdev->hw_ops->ioremap(vpdev, le64_to_cpu(config.address), |
1533 | vr_size); |
1534 | diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c |
1535 | index fed992e2c2583..49e7a7240469c 100644 |
1536 | --- a/drivers/misc/mic/vop/vop_vringh.c |
1537 | +++ b/drivers/misc/mic/vop/vop_vringh.c |
1538 | @@ -308,7 +308,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, |
1539 | |
1540 | num = le16_to_cpu(vqconfig[i].num); |
1541 | mutex_init(&vvr->vr_mutex); |
1542 | - vr_size = PAGE_ALIGN(vring_size(num, MIC_VIRTIO_RING_ALIGN) + |
1543 | + vr_size = PAGE_ALIGN(round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4) + |
1544 | sizeof(struct _mic_vring_info)); |
1545 | vr->va = (void *) |
1546 | __get_free_pages(GFP_KERNEL | __GFP_ZERO, |
1547 | @@ -320,7 +320,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, |
1548 | goto err; |
1549 | } |
1550 | vr->len = vr_size; |
1551 | - vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN); |
1552 | + vr->info = vr->va + round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4); |
1553 | vr->info->magic = cpu_to_le32(MIC_MAGIC + vdev->virtio_id + i); |
1554 | vr_addr = dma_map_single(&vpdev->dev, vr->va, vr_size, |
1555 | DMA_BIDIRECTIONAL); |
1556 | @@ -611,6 +611,7 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf, |
1557 | size_t partlen; |
1558 | bool dma = VOP_USE_DMA; |
1559 | int err = 0; |
1560 | + size_t offset = 0; |
1561 | |
1562 | if (daddr & (dma_alignment - 1)) { |
1563 | vdev->tx_dst_unaligned += len; |
1564 | @@ -659,13 +660,20 @@ memcpy: |
1565 | * We are copying to IO below and should ideally use something |
1566 | * like copy_from_user_toio(..) if it existed. |
1567 | */ |
1568 | - if (copy_from_user((void __force *)dbuf, ubuf, len)) { |
1569 | - err = -EFAULT; |
1570 | - dev_err(vop_dev(vdev), "%s %d err %d\n", |
1571 | - __func__, __LINE__, err); |
1572 | - goto err; |
1573 | + while (len) { |
1574 | + partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE); |
1575 | + |
1576 | + if (copy_from_user(vvr->buf, ubuf + offset, partlen)) { |
1577 | + err = -EFAULT; |
1578 | + dev_err(vop_dev(vdev), "%s %d err %d\n", |
1579 | + __func__, __LINE__, err); |
1580 | + goto err; |
1581 | + } |
1582 | + memcpy_toio(dbuf + offset, vvr->buf, partlen); |
1583 | + offset += partlen; |
1584 | + vdev->out_bytes += partlen; |
1585 | + len -= partlen; |
1586 | } |
1587 | - vdev->out_bytes += len; |
1588 | err = 0; |
1589 | err: |
1590 | vpdev->hw_ops->iounmap(vpdev, dbuf); |
1591 | diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c |
1592 | index 5927db046a87c..6ac3c59c9ae78 100644 |
1593 | --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c |
1594 | +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c |
1595 | @@ -758,8 +758,9 @@ static int qp_host_get_user_memory(u64 produce_uva, |
1596 | if (retval < (int)produce_q->kernel_if->num_pages) { |
1597 | pr_debug("get_user_pages_fast(produce) failed (retval=%d)", |
1598 | retval); |
1599 | - qp_release_pages(produce_q->kernel_if->u.h.header_page, |
1600 | - retval, false); |
1601 | + if (retval > 0) |
1602 | + qp_release_pages(produce_q->kernel_if->u.h.header_page, |
1603 | + retval, false); |
1604 | err = VMCI_ERROR_NO_MEM; |
1605 | goto out; |
1606 | } |
1607 | @@ -770,8 +771,9 @@ static int qp_host_get_user_memory(u64 produce_uva, |
1608 | if (retval < (int)consume_q->kernel_if->num_pages) { |
1609 | pr_debug("get_user_pages_fast(consume) failed (retval=%d)", |
1610 | retval); |
1611 | - qp_release_pages(consume_q->kernel_if->u.h.header_page, |
1612 | - retval, false); |
1613 | + if (retval > 0) |
1614 | + qp_release_pages(consume_q->kernel_if->u.h.header_page, |
1615 | + retval, false); |
1616 | qp_release_pages(produce_q->kernel_if->u.h.header_page, |
1617 | produce_q->kernel_if->num_pages, false); |
1618 | err = VMCI_ERROR_NO_MEM; |
1619 | diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c |
1620 | index dcb3dee59fa5f..934c4816d78bf 100644 |
1621 | --- a/drivers/mmc/core/sdio_cis.c |
1622 | +++ b/drivers/mmc/core/sdio_cis.c |
1623 | @@ -30,6 +30,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func, |
1624 | unsigned i, nr_strings; |
1625 | char **buffer, *string; |
1626 | |
1627 | + if (size < 2) |
1628 | + return 0; |
1629 | + |
1630 | /* Find all null-terminated (including zero length) strings in |
1631 | the TPLLV1_INFO field. Trailing garbage is ignored. */ |
1632 | buf += 2; |
1633 | diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c |
1634 | index 2342277c9bcb0..5e36366d9b36d 100644 |
1635 | --- a/drivers/mtd/lpddr/lpddr2_nvm.c |
1636 | +++ b/drivers/mtd/lpddr/lpddr2_nvm.c |
1637 | @@ -408,6 +408,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add, |
1638 | return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK); |
1639 | } |
1640 | |
1641 | +static const struct mtd_info lpddr2_nvm_mtd_info = { |
1642 | + .type = MTD_RAM, |
1643 | + .writesize = 1, |
1644 | + .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), |
1645 | + ._read = lpddr2_nvm_read, |
1646 | + ._write = lpddr2_nvm_write, |
1647 | + ._erase = lpddr2_nvm_erase, |
1648 | + ._unlock = lpddr2_nvm_unlock, |
1649 | + ._lock = lpddr2_nvm_lock, |
1650 | +}; |
1651 | + |
1652 | /* |
1653 | * lpddr2_nvm driver probe method |
1654 | */ |
1655 | @@ -448,6 +459,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) |
1656 | .pfow_base = OW_BASE_ADDRESS, |
1657 | .fldrv_priv = pcm_data, |
1658 | }; |
1659 | + |
1660 | if (IS_ERR(map->virt)) |
1661 | return PTR_ERR(map->virt); |
1662 | |
1663 | @@ -459,22 +471,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) |
1664 | return PTR_ERR(pcm_data->ctl_regs); |
1665 | |
1666 | /* Populate mtd_info data structure */ |
1667 | - *mtd = (struct mtd_info) { |
1668 | - .dev = { .parent = &pdev->dev }, |
1669 | - .name = pdev->dev.init_name, |
1670 | - .type = MTD_RAM, |
1671 | - .priv = map, |
1672 | - .size = resource_size(add_range), |
1673 | - .erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width, |
1674 | - .writesize = 1, |
1675 | - .writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width, |
1676 | - .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), |
1677 | - ._read = lpddr2_nvm_read, |
1678 | - ._write = lpddr2_nvm_write, |
1679 | - ._erase = lpddr2_nvm_erase, |
1680 | - ._unlock = lpddr2_nvm_unlock, |
1681 | - ._lock = lpddr2_nvm_lock, |
1682 | - }; |
1683 | + *mtd = lpddr2_nvm_mtd_info; |
1684 | + mtd->dev.parent = &pdev->dev; |
1685 | + mtd->name = pdev->dev.init_name; |
1686 | + mtd->priv = map; |
1687 | + mtd->size = resource_size(add_range); |
1688 | + mtd->erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width; |
1689 | + mtd->writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width; |
1690 | |
1691 | /* Verify the presence of the device looking for PFOW string */ |
1692 | if (!lpddr2_nvm_pfow_present(map)) { |
1693 | diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c |
1694 | index 97bb8f6304d4f..09165eaac7a15 100644 |
1695 | --- a/drivers/mtd/mtdoops.c |
1696 | +++ b/drivers/mtd/mtdoops.c |
1697 | @@ -313,12 +313,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper, |
1698 | kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE, |
1699 | record_size - MTDOOPS_HEADER_SIZE, NULL); |
1700 | |
1701 | - /* Panics must be written immediately */ |
1702 | - if (reason != KMSG_DUMP_OOPS) |
1703 | + if (reason != KMSG_DUMP_OOPS) { |
1704 | + /* Panics must be written immediately */ |
1705 | mtdoops_write(cxt, 1); |
1706 | - |
1707 | - /* For other cases, schedule work to write it "nicely" */ |
1708 | - schedule_work(&cxt->work_write); |
1709 | + } else { |
1710 | + /* For other cases, schedule work to write it "nicely" */ |
1711 | + schedule_work(&cxt->work_write); |
1712 | + } |
1713 | } |
1714 | |
1715 | static void mtdoops_notify_add(struct mtd_info *mtd) |
1716 | diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h |
1717 | index 130f910e47854..b6ebcee40a0d4 100644 |
1718 | --- a/drivers/net/ethernet/cisco/enic/enic.h |
1719 | +++ b/drivers/net/ethernet/cisco/enic/enic.h |
1720 | @@ -163,6 +163,7 @@ struct enic { |
1721 | u16 num_vfs; |
1722 | #endif |
1723 | spinlock_t enic_api_lock; |
1724 | + bool enic_api_busy; |
1725 | struct enic_port_profile *pp; |
1726 | |
1727 | /* work queue cache line section */ |
1728 | diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c |
1729 | index b161f24522b87..b028ea2dec2b9 100644 |
1730 | --- a/drivers/net/ethernet/cisco/enic/enic_api.c |
1731 | +++ b/drivers/net/ethernet/cisco/enic/enic_api.c |
1732 | @@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf, |
1733 | struct vnic_dev *vdev = enic->vdev; |
1734 | |
1735 | spin_lock(&enic->enic_api_lock); |
1736 | + while (enic->enic_api_busy) { |
1737 | + spin_unlock(&enic->enic_api_lock); |
1738 | + cpu_relax(); |
1739 | + spin_lock(&enic->enic_api_lock); |
1740 | + } |
1741 | + |
1742 | spin_lock_bh(&enic->devcmd_lock); |
1743 | |
1744 | vnic_dev_cmd_proxy_by_index_start(vdev, vf); |
1745 | diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c |
1746 | index 96290b83dfde9..3a3f3a7d7a75f 100644 |
1747 | --- a/drivers/net/ethernet/cisco/enic/enic_main.c |
1748 | +++ b/drivers/net/ethernet/cisco/enic/enic_main.c |
1749 | @@ -1938,8 +1938,6 @@ static int enic_dev_wait(struct vnic_dev *vdev, |
1750 | int done; |
1751 | int err; |
1752 | |
1753 | - BUG_ON(in_interrupt()); |
1754 | - |
1755 | err = start(vdev, arg); |
1756 | if (err) |
1757 | return err; |
1758 | @@ -2116,6 +2114,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic) |
1759 | rss_hash_bits, rss_base_cpu, rss_enable); |
1760 | } |
1761 | |
1762 | +static void enic_set_api_busy(struct enic *enic, bool busy) |
1763 | +{ |
1764 | + spin_lock(&enic->enic_api_lock); |
1765 | + enic->enic_api_busy = busy; |
1766 | + spin_unlock(&enic->enic_api_lock); |
1767 | +} |
1768 | + |
1769 | static void enic_reset(struct work_struct *work) |
1770 | { |
1771 | struct enic *enic = container_of(work, struct enic, reset); |
1772 | @@ -2125,7 +2130,9 @@ static void enic_reset(struct work_struct *work) |
1773 | |
1774 | rtnl_lock(); |
1775 | |
1776 | - spin_lock(&enic->enic_api_lock); |
1777 | + /* Stop any activity from infiniband */ |
1778 | + enic_set_api_busy(enic, true); |
1779 | + |
1780 | enic_stop(enic->netdev); |
1781 | enic_dev_soft_reset(enic); |
1782 | enic_reset_addr_lists(enic); |
1783 | @@ -2133,7 +2140,10 @@ static void enic_reset(struct work_struct *work) |
1784 | enic_set_rss_nic_cfg(enic); |
1785 | enic_dev_set_ig_vlan_rewrite_mode(enic); |
1786 | enic_open(enic->netdev); |
1787 | - spin_unlock(&enic->enic_api_lock); |
1788 | + |
1789 | + /* Allow infiniband to fiddle with the device again */ |
1790 | + enic_set_api_busy(enic, false); |
1791 | + |
1792 | call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); |
1793 | |
1794 | rtnl_unlock(); |
1795 | @@ -2145,7 +2155,9 @@ static void enic_tx_hang_reset(struct work_struct *work) |
1796 | |
1797 | rtnl_lock(); |
1798 | |
1799 | - spin_lock(&enic->enic_api_lock); |
1800 | + /* Stop any activity from infiniband */ |
1801 | + enic_set_api_busy(enic, true); |
1802 | + |
1803 | enic_dev_hang_notify(enic); |
1804 | enic_stop(enic->netdev); |
1805 | enic_dev_hang_reset(enic); |
1806 | @@ -2154,7 +2166,10 @@ static void enic_tx_hang_reset(struct work_struct *work) |
1807 | enic_set_rss_nic_cfg(enic); |
1808 | enic_dev_set_ig_vlan_rewrite_mode(enic); |
1809 | enic_open(enic->netdev); |
1810 | - spin_unlock(&enic->enic_api_lock); |
1811 | + |
1812 | + /* Allow infiniband to fiddle with the device again */ |
1813 | + enic_set_api_busy(enic, false); |
1814 | + |
1815 | call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); |
1816 | |
1817 | rtnl_unlock(); |
1818 | diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c |
1819 | index de9897c8e9331..f5fd20dc8ab19 100644 |
1820 | --- a/drivers/net/ethernet/ibm/ibmveth.c |
1821 | +++ b/drivers/net/ethernet/ibm/ibmveth.c |
1822 | @@ -1256,6 +1256,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) |
1823 | int offset = ibmveth_rxq_frame_offset(adapter); |
1824 | int csum_good = ibmveth_rxq_csum_good(adapter); |
1825 | int lrg_pkt = ibmveth_rxq_large_packet(adapter); |
1826 | + __sum16 iph_check = 0; |
1827 | |
1828 | skb = ibmveth_rxq_get_buffer(adapter); |
1829 | |
1830 | @@ -1307,7 +1308,17 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) |
1831 | } |
1832 | } |
1833 | |
1834 | - if (length > netdev->mtu + ETH_HLEN) { |
1835 | + /* PHYP without PLSO support places a -1 in the ip |
1836 | + * checksum for large send frames. |
1837 | + */ |
1838 | + if (skb->protocol == cpu_to_be16(ETH_P_IP)) { |
1839 | + struct iphdr *iph = (struct iphdr *)skb->data; |
1840 | + |
1841 | + iph_check = iph->check; |
1842 | + } |
1843 | + |
1844 | + if ((length > netdev->mtu + ETH_HLEN) || |
1845 | + lrg_pkt || iph_check == 0xffff) { |
1846 | ibmveth_rx_mss_helper(skb, mss, lrg_pkt); |
1847 | adapter->rx_large_packets++; |
1848 | } |
1849 | diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c |
1850 | index c051987aab830..cd8895838a04c 100644 |
1851 | --- a/drivers/net/ethernet/korina.c |
1852 | +++ b/drivers/net/ethernet/korina.c |
1853 | @@ -1188,7 +1188,7 @@ out: |
1854 | return rc; |
1855 | |
1856 | probe_err_register: |
1857 | - kfree(lp->td_ring); |
1858 | + kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring)); |
1859 | probe_err_td_ring: |
1860 | iounmap(lp->tx_dma_regs); |
1861 | probe_err_dma_tx: |
1862 | @@ -1208,6 +1208,7 @@ static int korina_remove(struct platform_device *pdev) |
1863 | iounmap(lp->eth_regs); |
1864 | iounmap(lp->rx_dma_regs); |
1865 | iounmap(lp->tx_dma_regs); |
1866 | + kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring)); |
1867 | |
1868 | unregister_netdev(bif->dev); |
1869 | free_netdev(bif->dev); |
1870 | diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c |
1871 | index 7a4393ffe98e2..3521e3a77556d 100644 |
1872 | --- a/drivers/net/ethernet/realtek/r8169.c |
1873 | +++ b/drivers/net/ethernet/realtek/r8169.c |
1874 | @@ -4476,6 +4476,58 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr) |
1875 | rtl_unlock_work(tp); |
1876 | } |
1877 | |
1878 | +static void rtl_init_rxcfg(struct rtl8169_private *tp) |
1879 | +{ |
1880 | + void __iomem *ioaddr = tp->mmio_addr; |
1881 | + |
1882 | + switch (tp->mac_version) { |
1883 | + case RTL_GIGA_MAC_VER_01: |
1884 | + case RTL_GIGA_MAC_VER_02: |
1885 | + case RTL_GIGA_MAC_VER_03: |
1886 | + case RTL_GIGA_MAC_VER_04: |
1887 | + case RTL_GIGA_MAC_VER_05: |
1888 | + case RTL_GIGA_MAC_VER_06: |
1889 | + case RTL_GIGA_MAC_VER_10: |
1890 | + case RTL_GIGA_MAC_VER_11: |
1891 | + case RTL_GIGA_MAC_VER_12: |
1892 | + case RTL_GIGA_MAC_VER_13: |
1893 | + case RTL_GIGA_MAC_VER_14: |
1894 | + case RTL_GIGA_MAC_VER_15: |
1895 | + case RTL_GIGA_MAC_VER_16: |
1896 | + case RTL_GIGA_MAC_VER_17: |
1897 | + RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST); |
1898 | + break; |
1899 | + case RTL_GIGA_MAC_VER_18: |
1900 | + case RTL_GIGA_MAC_VER_19: |
1901 | + case RTL_GIGA_MAC_VER_20: |
1902 | + case RTL_GIGA_MAC_VER_21: |
1903 | + case RTL_GIGA_MAC_VER_22: |
1904 | + case RTL_GIGA_MAC_VER_23: |
1905 | + case RTL_GIGA_MAC_VER_24: |
1906 | + case RTL_GIGA_MAC_VER_34: |
1907 | + case RTL_GIGA_MAC_VER_35: |
1908 | + RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); |
1909 | + break; |
1910 | + case RTL_GIGA_MAC_VER_40: |
1911 | + case RTL_GIGA_MAC_VER_41: |
1912 | + case RTL_GIGA_MAC_VER_42: |
1913 | + case RTL_GIGA_MAC_VER_43: |
1914 | + case RTL_GIGA_MAC_VER_44: |
1915 | + case RTL_GIGA_MAC_VER_45: |
1916 | + case RTL_GIGA_MAC_VER_46: |
1917 | + case RTL_GIGA_MAC_VER_47: |
1918 | + case RTL_GIGA_MAC_VER_48: |
1919 | + case RTL_GIGA_MAC_VER_49: |
1920 | + case RTL_GIGA_MAC_VER_50: |
1921 | + case RTL_GIGA_MAC_VER_51: |
1922 | + RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); |
1923 | + break; |
1924 | + default: |
1925 | + RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST); |
1926 | + break; |
1927 | + } |
1928 | +} |
1929 | + |
1930 | static int rtl_set_mac_address(struct net_device *dev, void *p) |
1931 | { |
1932 | struct rtl8169_private *tp = netdev_priv(dev); |
1933 | @@ -4494,6 +4546,10 @@ static int rtl_set_mac_address(struct net_device *dev, void *p) |
1934 | |
1935 | pm_runtime_put_noidle(d); |
1936 | |
1937 | + /* Reportedly at least Asus X453MA truncates packets otherwise */ |
1938 | + if (tp->mac_version == RTL_GIGA_MAC_VER_37) |
1939 | + rtl_init_rxcfg(tp); |
1940 | + |
1941 | return 0; |
1942 | } |
1943 | |
1944 | @@ -4931,58 +4987,6 @@ static void rtl_init_pll_power_ops(struct rtl8169_private *tp) |
1945 | } |
1946 | } |
1947 | |
1948 | -static void rtl_init_rxcfg(struct rtl8169_private *tp) |
1949 | -{ |
1950 | - void __iomem *ioaddr = tp->mmio_addr; |
1951 | - |
1952 | - switch (tp->mac_version) { |
1953 | - case RTL_GIGA_MAC_VER_01: |
1954 | - case RTL_GIGA_MAC_VER_02: |
1955 | - case RTL_GIGA_MAC_VER_03: |
1956 | - case RTL_GIGA_MAC_VER_04: |
1957 | - case RTL_GIGA_MAC_VER_05: |
1958 | - case RTL_GIGA_MAC_VER_06: |
1959 | - case RTL_GIGA_MAC_VER_10: |
1960 | - case RTL_GIGA_MAC_VER_11: |
1961 | - case RTL_GIGA_MAC_VER_12: |
1962 | - case RTL_GIGA_MAC_VER_13: |
1963 | - case RTL_GIGA_MAC_VER_14: |
1964 | - case RTL_GIGA_MAC_VER_15: |
1965 | - case RTL_GIGA_MAC_VER_16: |
1966 | - case RTL_GIGA_MAC_VER_17: |
1967 | - RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST); |
1968 | - break; |
1969 | - case RTL_GIGA_MAC_VER_18: |
1970 | - case RTL_GIGA_MAC_VER_19: |
1971 | - case RTL_GIGA_MAC_VER_20: |
1972 | - case RTL_GIGA_MAC_VER_21: |
1973 | - case RTL_GIGA_MAC_VER_22: |
1974 | - case RTL_GIGA_MAC_VER_23: |
1975 | - case RTL_GIGA_MAC_VER_24: |
1976 | - case RTL_GIGA_MAC_VER_34: |
1977 | - case RTL_GIGA_MAC_VER_35: |
1978 | - RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); |
1979 | - break; |
1980 | - case RTL_GIGA_MAC_VER_40: |
1981 | - case RTL_GIGA_MAC_VER_41: |
1982 | - case RTL_GIGA_MAC_VER_42: |
1983 | - case RTL_GIGA_MAC_VER_43: |
1984 | - case RTL_GIGA_MAC_VER_44: |
1985 | - case RTL_GIGA_MAC_VER_45: |
1986 | - case RTL_GIGA_MAC_VER_46: |
1987 | - case RTL_GIGA_MAC_VER_47: |
1988 | - case RTL_GIGA_MAC_VER_48: |
1989 | - case RTL_GIGA_MAC_VER_49: |
1990 | - case RTL_GIGA_MAC_VER_50: |
1991 | - case RTL_GIGA_MAC_VER_51: |
1992 | - RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); |
1993 | - break; |
1994 | - default: |
1995 | - RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST); |
1996 | - break; |
1997 | - } |
1998 | -} |
1999 | - |
2000 | static void rtl8169_init_ring_indexes(struct rtl8169_private *tp) |
2001 | { |
2002 | tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0; |
2003 | diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c |
2004 | index 9bd4aa8083ce7..6061bff85523f 100644 |
2005 | --- a/drivers/net/wan/hdlc.c |
2006 | +++ b/drivers/net/wan/hdlc.c |
2007 | @@ -57,7 +57,15 @@ int hdlc_change_mtu(struct net_device *dev, int new_mtu) |
2008 | static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev, |
2009 | struct packet_type *p, struct net_device *orig_dev) |
2010 | { |
2011 | - struct hdlc_device *hdlc = dev_to_hdlc(dev); |
2012 | + struct hdlc_device *hdlc; |
2013 | + |
2014 | + /* First make sure "dev" is an HDLC device */ |
2015 | + if (!(dev->priv_flags & IFF_WAN_HDLC)) { |
2016 | + kfree_skb(skb); |
2017 | + return NET_RX_SUCCESS; |
2018 | + } |
2019 | + |
2020 | + hdlc = dev_to_hdlc(dev); |
2021 | |
2022 | if (!net_eq(dev_net(dev), &init_net)) { |
2023 | kfree_skb(skb); |
2024 | diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c |
2025 | index 2f11836078ab5..1be781f8ffc1b 100644 |
2026 | --- a/drivers/net/wan/hdlc_raw_eth.c |
2027 | +++ b/drivers/net/wan/hdlc_raw_eth.c |
2028 | @@ -101,6 +101,7 @@ static int raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr) |
2029 | old_qlen = dev->tx_queue_len; |
2030 | ether_setup(dev); |
2031 | dev->tx_queue_len = old_qlen; |
2032 | + dev->priv_flags &= ~IFF_TX_SKB_SHARING; |
2033 | eth_hw_addr_random(dev); |
2034 | call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev); |
2035 | netif_dormant_off(dev); |
2036 | diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c |
2037 | index a3c2180475971..fce2064ebc469 100644 |
2038 | --- a/drivers/net/wireless/ath/ath10k/htt_rx.c |
2039 | +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c |
2040 | @@ -100,6 +100,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num) |
2041 | BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2); |
2042 | |
2043 | idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr); |
2044 | + |
2045 | + if (idx < 0 || idx >= htt->rx_ring.size) { |
2046 | + ath10k_err(htt->ar, "rx ring index is not valid, firmware malfunctioning?\n"); |
2047 | + idx &= htt->rx_ring.size_mask; |
2048 | + ret = -ENOMEM; |
2049 | + goto fail; |
2050 | + } |
2051 | + |
2052 | while (num > 0) { |
2053 | skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN); |
2054 | if (!skb) { |
2055 | diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c |
2056 | index 2294ba311c47a..8b3fe88d1c4e7 100644 |
2057 | --- a/drivers/net/wireless/ath/ath10k/mac.c |
2058 | +++ b/drivers/net/wireless/ath/ath10k/mac.c |
2059 | @@ -6579,7 +6579,7 @@ ath10k_mac_update_bss_chan_survey(struct ath10k *ar, |
2060 | struct ieee80211_channel *channel) |
2061 | { |
2062 | int ret; |
2063 | - enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR; |
2064 | + enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ; |
2065 | |
2066 | lockdep_assert_held(&ar->conf_mutex); |
2067 | |
2068 | diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c |
2069 | index 1af3fed5a72ca..1a68518279689 100644 |
2070 | --- a/drivers/net/wireless/ath/ath6kl/main.c |
2071 | +++ b/drivers/net/wireless/ath/ath6kl/main.c |
2072 | @@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr, |
2073 | |
2074 | ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid); |
2075 | |
2076 | + if (aid < 1 || aid > AP_MAX_NUM_STA) |
2077 | + return; |
2078 | + |
2079 | if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { |
2080 | struct ieee80211_mgmt *mgmt = |
2081 | (struct ieee80211_mgmt *) assoc_info; |
2082 | diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c |
2083 | index 55609fc4e50e6..73eab12cb3bda 100644 |
2084 | --- a/drivers/net/wireless/ath/ath6kl/wmi.c |
2085 | +++ b/drivers/net/wireless/ath/ath6kl/wmi.c |
2086 | @@ -2648,6 +2648,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class, |
2087 | return -EINVAL; |
2088 | } |
2089 | |
2090 | + if (tsid >= 16) { |
2091 | + ath6kl_err("invalid tsid: %d\n", tsid); |
2092 | + return -EINVAL; |
2093 | + } |
2094 | + |
2095 | skb = ath6kl_wmi_get_new_buf(sizeof(*cmd)); |
2096 | if (!skb) |
2097 | return -ENOMEM; |
2098 | diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c |
2099 | index fb5b7ce3d2c3d..7c409cd43b709 100644 |
2100 | --- a/drivers/net/wireless/ath/ath9k/hif_usb.c |
2101 | +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c |
2102 | @@ -447,10 +447,19 @@ static void hif_usb_stop(void *hif_handle) |
2103 | spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); |
2104 | |
2105 | /* The pending URBs have to be canceled. */ |
2106 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); |
2107 | list_for_each_entry_safe(tx_buf, tx_buf_tmp, |
2108 | &hif_dev->tx.tx_pending, list) { |
2109 | + usb_get_urb(tx_buf->urb); |
2110 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); |
2111 | usb_kill_urb(tx_buf->urb); |
2112 | + list_del(&tx_buf->list); |
2113 | + usb_free_urb(tx_buf->urb); |
2114 | + kfree(tx_buf->buf); |
2115 | + kfree(tx_buf); |
2116 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); |
2117 | } |
2118 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); |
2119 | |
2120 | usb_kill_anchored_urbs(&hif_dev->mgmt_submitted); |
2121 | } |
2122 | @@ -760,27 +769,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev) |
2123 | struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL; |
2124 | unsigned long flags; |
2125 | |
2126 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); |
2127 | list_for_each_entry_safe(tx_buf, tx_buf_tmp, |
2128 | &hif_dev->tx.tx_buf, list) { |
2129 | + usb_get_urb(tx_buf->urb); |
2130 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); |
2131 | usb_kill_urb(tx_buf->urb); |
2132 | list_del(&tx_buf->list); |
2133 | usb_free_urb(tx_buf->urb); |
2134 | kfree(tx_buf->buf); |
2135 | kfree(tx_buf); |
2136 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); |
2137 | } |
2138 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); |
2139 | |
2140 | spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); |
2141 | hif_dev->tx.flags |= HIF_USB_TX_FLUSH; |
2142 | spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); |
2143 | |
2144 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); |
2145 | list_for_each_entry_safe(tx_buf, tx_buf_tmp, |
2146 | &hif_dev->tx.tx_pending, list) { |
2147 | + usb_get_urb(tx_buf->urb); |
2148 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); |
2149 | usb_kill_urb(tx_buf->urb); |
2150 | list_del(&tx_buf->list); |
2151 | usb_free_urb(tx_buf->urb); |
2152 | kfree(tx_buf->buf); |
2153 | kfree(tx_buf); |
2154 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); |
2155 | } |
2156 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); |
2157 | |
2158 | usb_kill_anchored_urbs(&hif_dev->mgmt_submitted); |
2159 | } |
2160 | diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c |
2161 | index 1af216aa5adae..625823e45d8f0 100644 |
2162 | --- a/drivers/net/wireless/ath/ath9k/htc_hst.c |
2163 | +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c |
2164 | @@ -346,6 +346,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle, |
2165 | |
2166 | if (skb) { |
2167 | htc_hdr = (struct htc_frame_hdr *) skb->data; |
2168 | + if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint)) |
2169 | + goto ret; |
2170 | endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id]; |
2171 | skb_pull(skb, sizeof(struct htc_frame_hdr)); |
2172 | |
2173 | diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c |
2174 | index ca8797c653125..86beadf0f2493 100644 |
2175 | --- a/drivers/net/wireless/ath/wcn36xx/main.c |
2176 | +++ b/drivers/net/wireless/ath/wcn36xx/main.c |
2177 | @@ -158,7 +158,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = { |
2178 | .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, |
2179 | .mcs = { |
2180 | .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, |
2181 | - .rx_highest = cpu_to_le16(72), |
2182 | + .rx_highest = cpu_to_le16(150), |
2183 | .tx_params = IEEE80211_HT_MCS_TX_DEFINED, |
2184 | } |
2185 | } |
2186 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c |
2187 | index ab9f136c15937..e306e5a89dd4f 100644 |
2188 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c |
2189 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c |
2190 | @@ -1540,6 +1540,8 @@ fail: |
2191 | BRCMF_TX_IOCTL_MAX_MSG_SIZE, |
2192 | msgbuf->ioctbuf, |
2193 | msgbuf->ioctbuf_handle); |
2194 | + if (msgbuf->txflow_wq) |
2195 | + destroy_workqueue(msgbuf->txflow_wq); |
2196 | kfree(msgbuf); |
2197 | } |
2198 | return -ENOMEM; |
2199 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c |
2200 | index 93d4cde0eb313..c9f48ec46f4a1 100644 |
2201 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c |
2202 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c |
2203 | @@ -5090,8 +5090,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi) |
2204 | pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft; |
2205 | pi->pi_fptr.detach = wlc_phy_detach_lcnphy; |
2206 | |
2207 | - if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) |
2208 | + if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) { |
2209 | + kfree(pi->u.pi_lcnphy); |
2210 | return false; |
2211 | + } |
2212 | |
2213 | if (LCNREV_IS(pi->pubpi.phy_rev, 1)) { |
2214 | if (pi_lcn->lcnphy_tempsense_option == 3) { |
2215 | diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
2216 | index d91ab2b8d6671..d46efa8d70732 100644 |
2217 | --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
2218 | +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
2219 | @@ -3046,9 +3046,12 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm, |
2220 | aux_roc_req.apply_time_max_delay = cpu_to_le32(delay); |
2221 | |
2222 | IWL_DEBUG_TE(mvm, |
2223 | - "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n", |
2224 | - channel->hw_value, req_dur, duration, delay, |
2225 | - dtim_interval); |
2226 | + "ROC: Requesting to remain on channel %u for %ums\n", |
2227 | + channel->hw_value, req_dur); |
2228 | + IWL_DEBUG_TE(mvm, |
2229 | + "\t(requested = %ums, max_delay = %ums, dtim_interval = %ums)\n", |
2230 | + duration, delay, dtim_interval); |
2231 | + |
2232 | /* Set the node address */ |
2233 | memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN); |
2234 | |
2235 | diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c |
2236 | index 5fde2e2f1fea8..422a8d31ed7f9 100644 |
2237 | --- a/drivers/net/wireless/marvell/mwifiex/scan.c |
2238 | +++ b/drivers/net/wireless/marvell/mwifiex/scan.c |
2239 | @@ -1879,7 +1879,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, |
2240 | chan, CFG80211_BSS_FTYPE_UNKNOWN, |
2241 | bssid, timestamp, |
2242 | cap_info_bitmap, beacon_period, |
2243 | - ie_buf, ie_len, rssi, GFP_KERNEL); |
2244 | + ie_buf, ie_len, rssi, GFP_ATOMIC); |
2245 | if (bss) { |
2246 | bss_priv = (struct mwifiex_bss_priv *)bss->priv; |
2247 | bss_priv->band = band; |
2248 | diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c |
2249 | index 486b8c75cd1f9..679cc0035514e 100644 |
2250 | --- a/drivers/net/wireless/marvell/mwifiex/sdio.c |
2251 | +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c |
2252 | @@ -2049,6 +2049,8 @@ error: |
2253 | kfree(card->mpa_rx.buf); |
2254 | card->mpa_tx.buf_size = 0; |
2255 | card->mpa_rx.buf_size = 0; |
2256 | + card->mpa_tx.buf = NULL; |
2257 | + card->mpa_rx.buf = NULL; |
2258 | } |
2259 | |
2260 | return ret; |
2261 | diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c |
2262 | index 18d5984b78dab..e73613b9f2f59 100644 |
2263 | --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c |
2264 | +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c |
2265 | @@ -5422,7 +5422,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) |
2266 | ret = usb_submit_urb(urb, GFP_KERNEL); |
2267 | if (ret) { |
2268 | usb_unanchor_urb(urb); |
2269 | - usb_free_urb(urb); |
2270 | goto error; |
2271 | } |
2272 | |
2273 | @@ -5431,6 +5430,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) |
2274 | rtl8xxxu_write32(priv, REG_USB_HIMR, val32); |
2275 | |
2276 | error: |
2277 | + usb_free_urb(urb); |
2278 | return ret; |
2279 | } |
2280 | |
2281 | @@ -5756,6 +5756,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) |
2282 | struct rtl8xxxu_priv *priv = hw->priv; |
2283 | struct rtl8xxxu_rx_urb *rx_urb; |
2284 | struct rtl8xxxu_tx_urb *tx_urb; |
2285 | + struct sk_buff *skb; |
2286 | unsigned long flags; |
2287 | int ret, i; |
2288 | |
2289 | @@ -5806,6 +5807,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) |
2290 | rx_urb->hw = hw; |
2291 | |
2292 | ret = rtl8xxxu_submit_rx_urb(priv, rx_urb); |
2293 | + if (ret) { |
2294 | + if (ret != -ENOMEM) { |
2295 | + skb = (struct sk_buff *)rx_urb->urb.context; |
2296 | + dev_kfree_skb(skb); |
2297 | + } |
2298 | + rtl8xxxu_queue_rx_urb(priv, rx_urb); |
2299 | + } |
2300 | } |
2301 | exit: |
2302 | /* |
2303 | diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c |
2304 | index 6ccba0d862df7..927b574e5d596 100644 |
2305 | --- a/drivers/ntb/hw/amd/ntb_hw_amd.c |
2306 | +++ b/drivers/ntb/hw/amd/ntb_hw_amd.c |
2307 | @@ -994,6 +994,7 @@ static int amd_ntb_init_pci(struct amd_ntb_dev *ndev, |
2308 | |
2309 | err_dma_mask: |
2310 | pci_clear_master(pdev); |
2311 | + pci_release_regions(pdev); |
2312 | err_pci_regions: |
2313 | pci_disable_device(pdev); |
2314 | err_pci_enable: |
2315 | diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c |
2316 | index 63b87a8472762..4b58f352c0c93 100644 |
2317 | --- a/drivers/nvme/target/core.c |
2318 | +++ b/drivers/nvme/target/core.c |
2319 | @@ -591,7 +591,8 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl) |
2320 | * in case a host died before it enabled the controller. Hence, simply |
2321 | * reset the keep alive timer when the controller is enabled. |
2322 | */ |
2323 | - mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); |
2324 | + if (ctrl->kato) |
2325 | + mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); |
2326 | } |
2327 | |
2328 | static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl) |
2329 | diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c |
2330 | index ebe8e8dc46770..c246d3a2fc5f6 100644 |
2331 | --- a/drivers/rapidio/devices/rio_mport_cdev.c |
2332 | +++ b/drivers/rapidio/devices/rio_mport_cdev.c |
2333 | @@ -901,15 +901,16 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode, |
2334 | if (pinned < 0) { |
2335 | rmcd_error("get_user_pages err=%ld", pinned); |
2336 | nr_pages = 0; |
2337 | - } else |
2338 | + } else { |
2339 | rmcd_error("pinned %ld out of %ld pages", |
2340 | pinned, nr_pages); |
2341 | + /* |
2342 | + * Set nr_pages up to mean "how many pages to unpin, in |
2343 | + * the error handler: |
2344 | + */ |
2345 | + nr_pages = pinned; |
2346 | + } |
2347 | ret = -EFAULT; |
2348 | - /* |
2349 | - * Set nr_pages up to mean "how many pages to unpin, in |
2350 | - * the error handler: |
2351 | - */ |
2352 | - nr_pages = pinned; |
2353 | goto err_pg; |
2354 | } |
2355 | |
2356 | @@ -1739,6 +1740,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, |
2357 | struct rio_dev *rdev; |
2358 | struct rio_switch *rswitch = NULL; |
2359 | struct rio_mport *mport; |
2360 | + struct device *dev; |
2361 | size_t size; |
2362 | u32 rval; |
2363 | u32 swpinfo = 0; |
2364 | @@ -1753,8 +1755,10 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, |
2365 | rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name, |
2366 | dev_info.comptag, dev_info.destid, dev_info.hopcount); |
2367 | |
2368 | - if (bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name)) { |
2369 | + dev = bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name); |
2370 | + if (dev) { |
2371 | rmcd_debug(RDEV, "device %s already exists", dev_info.name); |
2372 | + put_device(dev); |
2373 | return -EEXIST; |
2374 | } |
2375 | |
2376 | diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c |
2377 | index 9355b65920ab4..0f730e4bf6bcb 100644 |
2378 | --- a/drivers/regulator/core.c |
2379 | +++ b/drivers/regulator/core.c |
2380 | @@ -4029,15 +4029,20 @@ regulator_register(const struct regulator_desc *regulator_desc, |
2381 | else if (regulator_desc->supply_name) |
2382 | rdev->supply_name = regulator_desc->supply_name; |
2383 | |
2384 | - /* |
2385 | - * Attempt to resolve the regulator supply, if specified, |
2386 | - * but don't return an error if we fail because we will try |
2387 | - * to resolve it again later as more regulators are added. |
2388 | - */ |
2389 | - if (regulator_resolve_supply(rdev)) |
2390 | - rdev_dbg(rdev, "unable to resolve supply\n"); |
2391 | - |
2392 | ret = set_machine_constraints(rdev, constraints); |
2393 | + if (ret == -EPROBE_DEFER) { |
2394 | + /* Regulator might be in bypass mode and so needs its supply |
2395 | + * to set the constraints */ |
2396 | + /* FIXME: this currently triggers a chicken-and-egg problem |
2397 | + * when creating -SUPPLY symlink in sysfs to a regulator |
2398 | + * that is just being created */ |
2399 | + ret = regulator_resolve_supply(rdev); |
2400 | + if (!ret) |
2401 | + ret = set_machine_constraints(rdev, constraints); |
2402 | + else |
2403 | + rdev_dbg(rdev, "unable to resolve supply early: %pe\n", |
2404 | + ERR_PTR(ret)); |
2405 | + } |
2406 | if (ret < 0) |
2407 | goto wash; |
2408 | |
2409 | diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c |
2410 | index 741cc96379cb7..04788e0b90236 100644 |
2411 | --- a/drivers/scsi/be2iscsi/be_main.c |
2412 | +++ b/drivers/scsi/be2iscsi/be_main.c |
2413 | @@ -3052,6 +3052,7 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba, |
2414 | if (!eq_vaddress) |
2415 | goto create_eq_error; |
2416 | |
2417 | + mem->dma = paddr; |
2418 | mem->va = eq_vaddress; |
2419 | ret = be_fill_queue(eq, phba->params.num_eq_entries, |
2420 | sizeof(struct be_eq_entry), eq_vaddress); |
2421 | @@ -3061,7 +3062,6 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba, |
2422 | goto create_eq_error; |
2423 | } |
2424 | |
2425 | - mem->dma = paddr; |
2426 | ret = beiscsi_cmd_eq_create(&phba->ctrl, eq, |
2427 | phwi_context->cur_eqd); |
2428 | if (ret) { |
2429 | @@ -3116,6 +3116,7 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba, |
2430 | if (!cq_vaddress) |
2431 | goto create_cq_error; |
2432 | |
2433 | + mem->dma = paddr; |
2434 | ret = be_fill_queue(cq, phba->params.num_cq_entries, |
2435 | sizeof(struct sol_cqe), cq_vaddress); |
2436 | if (ret) { |
2437 | @@ -3125,7 +3126,6 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba, |
2438 | goto create_cq_error; |
2439 | } |
2440 | |
2441 | - mem->dma = paddr; |
2442 | ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false, |
2443 | false, 0); |
2444 | if (ret) { |
2445 | diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c |
2446 | index dab195f04da78..06ca0495f3e8e 100644 |
2447 | --- a/drivers/scsi/csiostor/csio_hw.c |
2448 | +++ b/drivers/scsi/csiostor/csio_hw.c |
2449 | @@ -1973,7 +1973,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info, |
2450 | FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), |
2451 | FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), |
2452 | FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); |
2453 | - ret = EINVAL; |
2454 | + ret = -EINVAL; |
2455 | goto bye; |
2456 | } |
2457 | |
2458 | diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c |
2459 | index 54dea767dfde9..04b3ac17531db 100644 |
2460 | --- a/drivers/scsi/ibmvscsi/ibmvfc.c |
2461 | +++ b/drivers/scsi/ibmvscsi/ibmvfc.c |
2462 | @@ -4804,6 +4804,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id) |
2463 | if (IS_ERR(vhost->work_thread)) { |
2464 | dev_err(dev, "Couldn't create kernel thread: %ld\n", |
2465 | PTR_ERR(vhost->work_thread)); |
2466 | + rc = PTR_ERR(vhost->work_thread); |
2467 | goto free_host_mem; |
2468 | } |
2469 | |
2470 | diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c |
2471 | index 39285070f3b51..17ec51f9d9880 100644 |
2472 | --- a/drivers/scsi/mvumi.c |
2473 | +++ b/drivers/scsi/mvumi.c |
2474 | @@ -2476,6 +2476,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba) |
2475 | if (IS_ERR(mhba->dm_thread)) { |
2476 | dev_err(&mhba->pdev->dev, |
2477 | "failed to create device scan thread\n"); |
2478 | + ret = PTR_ERR(mhba->dm_thread); |
2479 | mutex_unlock(&mhba->sas_discovery_mutex); |
2480 | goto fail_create_thread; |
2481 | } |
2482 | diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c |
2483 | index 3fda5836aac69..f10088a1d38c0 100644 |
2484 | --- a/drivers/scsi/qla4xxx/ql4_os.c |
2485 | +++ b/drivers/scsi/qla4xxx/ql4_os.c |
2486 | @@ -1223,7 +1223,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len) |
2487 | le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error); |
2488 | exit_host_stats: |
2489 | if (ql_iscsi_stats) |
2490 | - dma_free_coherent(&ha->pdev->dev, host_stats_size, |
2491 | + dma_free_coherent(&ha->pdev->dev, stats_size, |
2492 | ql_iscsi_stats, iscsi_stats_dma); |
2493 | |
2494 | ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n", |
2495 | diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c |
2496 | index 3c4d7c2b4ade8..de05196738da5 100644 |
2497 | --- a/drivers/tty/hvc/hvcs.c |
2498 | +++ b/drivers/tty/hvc/hvcs.c |
2499 | @@ -1232,13 +1232,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) |
2500 | |
2501 | tty_wait_until_sent(tty, HVCS_CLOSE_WAIT); |
2502 | |
2503 | - /* |
2504 | - * This line is important because it tells hvcs_open that this |
2505 | - * device needs to be re-configured the next time hvcs_open is |
2506 | - * called. |
2507 | - */ |
2508 | - tty->driver_data = NULL; |
2509 | - |
2510 | free_irq(irq, hvcsd); |
2511 | return; |
2512 | } else if (hvcsd->port.count < 0) { |
2513 | @@ -1254,6 +1247,13 @@ static void hvcs_cleanup(struct tty_struct * tty) |
2514 | { |
2515 | struct hvcs_struct *hvcsd = tty->driver_data; |
2516 | |
2517 | + /* |
2518 | + * This line is important because it tells hvcs_open that this |
2519 | + * device needs to be re-configured the next time hvcs_open is |
2520 | + * called. |
2521 | + */ |
2522 | + tty->driver_data = NULL; |
2523 | + |
2524 | tty_port_put(&hvcsd->port); |
2525 | } |
2526 | |
2527 | diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c |
2528 | index c0dfb642383b2..dc7f4eb18e0a7 100644 |
2529 | --- a/drivers/tty/ipwireless/network.c |
2530 | +++ b/drivers/tty/ipwireless/network.c |
2531 | @@ -116,7 +116,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, |
2532 | skb->len, |
2533 | notify_packet_sent, |
2534 | network); |
2535 | - if (ret == -1) { |
2536 | + if (ret < 0) { |
2537 | skb_pull(skb, 2); |
2538 | return 0; |
2539 | } |
2540 | @@ -133,7 +133,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, |
2541 | notify_packet_sent, |
2542 | network); |
2543 | kfree(buf); |
2544 | - if (ret == -1) |
2545 | + if (ret < 0) |
2546 | return 0; |
2547 | } |
2548 | kfree_skb(skb); |
2549 | diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c |
2550 | index 2685d59d27245..4f9690442507f 100644 |
2551 | --- a/drivers/tty/ipwireless/tty.c |
2552 | +++ b/drivers/tty/ipwireless/tty.c |
2553 | @@ -217,7 +217,7 @@ static int ipw_write(struct tty_struct *linux_tty, |
2554 | ret = ipwireless_send_packet(tty->hardware, IPW_CHANNEL_RAS, |
2555 | buf, count, |
2556 | ipw_write_packet_sent_callback, tty); |
2557 | - if (ret == -1) { |
2558 | + if (ret < 0) { |
2559 | mutex_unlock(&tty->ipw_tty_mutex); |
2560 | return 0; |
2561 | } |
2562 | diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c |
2563 | index 171130a9ecc87..8a063a036bc08 100644 |
2564 | --- a/drivers/tty/pty.c |
2565 | +++ b/drivers/tty/pty.c |
2566 | @@ -115,10 +115,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) |
2567 | spin_lock_irqsave(&to->port->lock, flags); |
2568 | /* Stuff the data into the input queue of the other end */ |
2569 | c = tty_insert_flip_string(to->port, buf, c); |
2570 | + spin_unlock_irqrestore(&to->port->lock, flags); |
2571 | /* And shovel */ |
2572 | if (c) |
2573 | tty_flip_buffer_push(to->port); |
2574 | - spin_unlock_irqrestore(&to->port->lock, flags); |
2575 | } |
2576 | return c; |
2577 | } |
2578 | diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig |
2579 | index 25c1d7bc01004..7ea229cb1d864 100644 |
2580 | --- a/drivers/tty/serial/Kconfig |
2581 | +++ b/drivers/tty/serial/Kconfig |
2582 | @@ -9,6 +9,7 @@ menu "Serial drivers" |
2583 | |
2584 | config SERIAL_EARLYCON |
2585 | bool |
2586 | + depends on SERIAL_CORE |
2587 | help |
2588 | Support for early consoles with the earlycon parameter. This enables |
2589 | the console before standard serial driver is probed. The console is |
2590 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
2591 | index 2dc563b61b88a..726291c5562da 100644 |
2592 | --- a/drivers/usb/class/cdc-acm.c |
2593 | +++ b/drivers/usb/class/cdc-acm.c |
2594 | @@ -1178,9 +1178,21 @@ static int acm_probe(struct usb_interface *intf, |
2595 | } |
2596 | } |
2597 | } else { |
2598 | + int class = -1; |
2599 | + |
2600 | data_intf_num = union_header->bSlaveInterface0; |
2601 | control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0); |
2602 | data_interface = usb_ifnum_to_if(usb_dev, data_intf_num); |
2603 | + |
2604 | + if (control_interface) |
2605 | + class = control_interface->cur_altsetting->desc.bInterfaceClass; |
2606 | + |
2607 | + if (class != USB_CLASS_COMM && class != USB_CLASS_CDC_DATA) { |
2608 | + dev_dbg(&intf->dev, "Broken union descriptor, assuming single interface\n"); |
2609 | + combined_interfaces = 1; |
2610 | + control_interface = data_interface = intf; |
2611 | + goto look_for_collapsed_interface; |
2612 | + } |
2613 | } |
2614 | |
2615 | if (!control_interface || !data_interface) { |
2616 | @@ -1840,6 +1852,17 @@ static const struct usb_device_id acm_ids[] = { |
2617 | .driver_info = IGNORE_DEVICE, |
2618 | }, |
2619 | |
2620 | + /* Exclude ETAS ES58x */ |
2621 | + { USB_DEVICE(0x108c, 0x0159), /* ES581.4 */ |
2622 | + .driver_info = IGNORE_DEVICE, |
2623 | + }, |
2624 | + { USB_DEVICE(0x108c, 0x0168), /* ES582.1 */ |
2625 | + .driver_info = IGNORE_DEVICE, |
2626 | + }, |
2627 | + { USB_DEVICE(0x108c, 0x0169), /* ES584.1 */ |
2628 | + .driver_info = IGNORE_DEVICE, |
2629 | + }, |
2630 | + |
2631 | { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */ |
2632 | .driver_info = SEND_ZERO_PACKET, |
2633 | }, |
2634 | diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c |
2635 | index 09337a973335c..f9d39c993f2f3 100644 |
2636 | --- a/drivers/usb/class/cdc-wdm.c |
2637 | +++ b/drivers/usb/class/cdc-wdm.c |
2638 | @@ -61,6 +61,9 @@ MODULE_DEVICE_TABLE (usb, wdm_ids); |
2639 | |
2640 | #define WDM_MAX 16 |
2641 | |
2642 | +/* we cannot wait forever at flush() */ |
2643 | +#define WDM_FLUSH_TIMEOUT (30 * HZ) |
2644 | + |
2645 | /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */ |
2646 | #define WDM_DEFAULT_BUFSIZE 256 |
2647 | |
2648 | @@ -151,7 +154,7 @@ static void wdm_out_callback(struct urb *urb) |
2649 | kfree(desc->outbuf); |
2650 | desc->outbuf = NULL; |
2651 | clear_bit(WDM_IN_USE, &desc->flags); |
2652 | - wake_up(&desc->wait); |
2653 | + wake_up_all(&desc->wait); |
2654 | } |
2655 | |
2656 | /* forward declaration */ |
2657 | @@ -402,6 +405,9 @@ static ssize_t wdm_write |
2658 | if (test_bit(WDM_RESETTING, &desc->flags)) |
2659 | r = -EIO; |
2660 | |
2661 | + if (test_bit(WDM_DISCONNECTING, &desc->flags)) |
2662 | + r = -ENODEV; |
2663 | + |
2664 | if (r < 0) { |
2665 | rv = r; |
2666 | goto out_free_mem_pm; |
2667 | @@ -433,6 +439,7 @@ static ssize_t wdm_write |
2668 | if (rv < 0) { |
2669 | desc->outbuf = NULL; |
2670 | clear_bit(WDM_IN_USE, &desc->flags); |
2671 | + wake_up_all(&desc->wait); /* for wdm_wait_for_response() */ |
2672 | dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv); |
2673 | rv = usb_translate_errors(rv); |
2674 | goto out_free_mem_pm; |
2675 | @@ -593,28 +600,58 @@ err: |
2676 | return rv; |
2677 | } |
2678 | |
2679 | -static int wdm_flush(struct file *file, fl_owner_t id) |
2680 | +static int wdm_wait_for_response(struct file *file, long timeout) |
2681 | { |
2682 | struct wdm_device *desc = file->private_data; |
2683 | + long rv; /* Use long here because (int) MAX_SCHEDULE_TIMEOUT < 0. */ |
2684 | |
2685 | - wait_event(desc->wait, |
2686 | - /* |
2687 | - * needs both flags. We cannot do with one |
2688 | - * because resetting it would cause a race |
2689 | - * with write() yet we need to signal |
2690 | - * a disconnect |
2691 | - */ |
2692 | - !test_bit(WDM_IN_USE, &desc->flags) || |
2693 | - test_bit(WDM_DISCONNECTING, &desc->flags)); |
2694 | - |
2695 | - /* cannot dereference desc->intf if WDM_DISCONNECTING */ |
2696 | + /* |
2697 | + * Needs both flags. We cannot do with one because resetting it would |
2698 | + * cause a race with write() yet we need to signal a disconnect. |
2699 | + */ |
2700 | + rv = wait_event_interruptible_timeout(desc->wait, |
2701 | + !test_bit(WDM_IN_USE, &desc->flags) || |
2702 | + test_bit(WDM_DISCONNECTING, &desc->flags), |
2703 | + timeout); |
2704 | + |
2705 | + /* |
2706 | + * To report the correct error. This is best effort. |
2707 | + * We are inevitably racing with the hardware. |
2708 | + */ |
2709 | if (test_bit(WDM_DISCONNECTING, &desc->flags)) |
2710 | return -ENODEV; |
2711 | - if (desc->werr < 0) |
2712 | - dev_err(&desc->intf->dev, "Error in flush path: %d\n", |
2713 | - desc->werr); |
2714 | + if (!rv) |
2715 | + return -EIO; |
2716 | + if (rv < 0) |
2717 | + return -EINTR; |
2718 | |
2719 | - return usb_translate_errors(desc->werr); |
2720 | + spin_lock_irq(&desc->iuspin); |
2721 | + rv = desc->werr; |
2722 | + desc->werr = 0; |
2723 | + spin_unlock_irq(&desc->iuspin); |
2724 | + |
2725 | + return usb_translate_errors(rv); |
2726 | + |
2727 | +} |
2728 | + |
2729 | +/* |
2730 | + * You need to send a signal when you react to malicious or defective hardware. |
2731 | + * Also, don't abort when fsync() returned -EINVAL, for older kernels which do |
2732 | + * not implement wdm_flush() will return -EINVAL. |
2733 | + */ |
2734 | +static int wdm_fsync(struct file *file, loff_t start, loff_t end, int datasync) |
2735 | +{ |
2736 | + return wdm_wait_for_response(file, MAX_SCHEDULE_TIMEOUT); |
2737 | +} |
2738 | + |
2739 | +/* |
2740 | + * Same with wdm_fsync(), except it uses finite timeout in order to react to |
2741 | + * malicious or defective hardware which ceased communication after close() was |
2742 | + * implicitly called due to process termination. |
2743 | + */ |
2744 | +static int wdm_flush(struct file *file, fl_owner_t id) |
2745 | +{ |
2746 | + return wdm_wait_for_response(file, WDM_FLUSH_TIMEOUT); |
2747 | } |
2748 | |
2749 | static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait) |
2750 | @@ -739,6 +776,7 @@ static const struct file_operations wdm_fops = { |
2751 | .owner = THIS_MODULE, |
2752 | .read = wdm_read, |
2753 | .write = wdm_write, |
2754 | + .fsync = wdm_fsync, |
2755 | .open = wdm_open, |
2756 | .flush = wdm_flush, |
2757 | .release = wdm_release, |
2758 | diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c |
2759 | index 56dcc0820898c..6785ebc078047 100644 |
2760 | --- a/drivers/usb/core/urb.c |
2761 | +++ b/drivers/usb/core/urb.c |
2762 | @@ -765,11 +765,12 @@ void usb_block_urb(struct urb *urb) |
2763 | EXPORT_SYMBOL_GPL(usb_block_urb); |
2764 | |
2765 | /** |
2766 | - * usb_kill_anchored_urbs - cancel transfer requests en masse |
2767 | + * usb_kill_anchored_urbs - kill all URBs associated with an anchor |
2768 | * @anchor: anchor the requests are bound to |
2769 | * |
2770 | - * this allows all outstanding URBs to be killed starting |
2771 | - * from the back of the queue |
2772 | + * This kills all outstanding URBs starting from the back of the queue, |
2773 | + * with guarantee that no completer callbacks will take place from the |
2774 | + * anchor after this function returns. |
2775 | * |
2776 | * This routine should not be called by a driver after its disconnect |
2777 | * method has returned. |
2778 | @@ -777,20 +778,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb); |
2779 | void usb_kill_anchored_urbs(struct usb_anchor *anchor) |
2780 | { |
2781 | struct urb *victim; |
2782 | + int surely_empty; |
2783 | |
2784 | - spin_lock_irq(&anchor->lock); |
2785 | - while (!list_empty(&anchor->urb_list)) { |
2786 | - victim = list_entry(anchor->urb_list.prev, struct urb, |
2787 | - anchor_list); |
2788 | - /* we must make sure the URB isn't freed before we kill it*/ |
2789 | - usb_get_urb(victim); |
2790 | - spin_unlock_irq(&anchor->lock); |
2791 | - /* this will unanchor the URB */ |
2792 | - usb_kill_urb(victim); |
2793 | - usb_put_urb(victim); |
2794 | + do { |
2795 | spin_lock_irq(&anchor->lock); |
2796 | - } |
2797 | - spin_unlock_irq(&anchor->lock); |
2798 | + while (!list_empty(&anchor->urb_list)) { |
2799 | + victim = list_entry(anchor->urb_list.prev, |
2800 | + struct urb, anchor_list); |
2801 | + /* make sure the URB isn't freed before we kill it */ |
2802 | + usb_get_urb(victim); |
2803 | + spin_unlock_irq(&anchor->lock); |
2804 | + /* this will unanchor the URB */ |
2805 | + usb_kill_urb(victim); |
2806 | + usb_put_urb(victim); |
2807 | + spin_lock_irq(&anchor->lock); |
2808 | + } |
2809 | + surely_empty = usb_anchor_check_wakeup(anchor); |
2810 | + |
2811 | + spin_unlock_irq(&anchor->lock); |
2812 | + cpu_relax(); |
2813 | + } while (!surely_empty); |
2814 | } |
2815 | EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs); |
2816 | |
2817 | @@ -809,21 +816,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs); |
2818 | void usb_poison_anchored_urbs(struct usb_anchor *anchor) |
2819 | { |
2820 | struct urb *victim; |
2821 | + int surely_empty; |
2822 | |
2823 | - spin_lock_irq(&anchor->lock); |
2824 | - anchor->poisoned = 1; |
2825 | - while (!list_empty(&anchor->urb_list)) { |
2826 | - victim = list_entry(anchor->urb_list.prev, struct urb, |
2827 | - anchor_list); |
2828 | - /* we must make sure the URB isn't freed before we kill it*/ |
2829 | - usb_get_urb(victim); |
2830 | - spin_unlock_irq(&anchor->lock); |
2831 | - /* this will unanchor the URB */ |
2832 | - usb_poison_urb(victim); |
2833 | - usb_put_urb(victim); |
2834 | + do { |
2835 | spin_lock_irq(&anchor->lock); |
2836 | - } |
2837 | - spin_unlock_irq(&anchor->lock); |
2838 | + anchor->poisoned = 1; |
2839 | + while (!list_empty(&anchor->urb_list)) { |
2840 | + victim = list_entry(anchor->urb_list.prev, |
2841 | + struct urb, anchor_list); |
2842 | + /* make sure the URB isn't freed before we kill it */ |
2843 | + usb_get_urb(victim); |
2844 | + spin_unlock_irq(&anchor->lock); |
2845 | + /* this will unanchor the URB */ |
2846 | + usb_poison_urb(victim); |
2847 | + usb_put_urb(victim); |
2848 | + spin_lock_irq(&anchor->lock); |
2849 | + } |
2850 | + surely_empty = usb_anchor_check_wakeup(anchor); |
2851 | + |
2852 | + spin_unlock_irq(&anchor->lock); |
2853 | + cpu_relax(); |
2854 | + } while (!surely_empty); |
2855 | } |
2856 | EXPORT_SYMBOL_GPL(usb_poison_anchored_urbs); |
2857 | |
2858 | @@ -963,14 +976,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor) |
2859 | { |
2860 | struct urb *victim; |
2861 | unsigned long flags; |
2862 | + int surely_empty; |
2863 | + |
2864 | + do { |
2865 | + spin_lock_irqsave(&anchor->lock, flags); |
2866 | + while (!list_empty(&anchor->urb_list)) { |
2867 | + victim = list_entry(anchor->urb_list.prev, |
2868 | + struct urb, anchor_list); |
2869 | + __usb_unanchor_urb(victim, anchor); |
2870 | + } |
2871 | + surely_empty = usb_anchor_check_wakeup(anchor); |
2872 | |
2873 | - spin_lock_irqsave(&anchor->lock, flags); |
2874 | - while (!list_empty(&anchor->urb_list)) { |
2875 | - victim = list_entry(anchor->urb_list.prev, struct urb, |
2876 | - anchor_list); |
2877 | - __usb_unanchor_urb(victim, anchor); |
2878 | - } |
2879 | - spin_unlock_irqrestore(&anchor->lock, flags); |
2880 | + spin_unlock_irqrestore(&anchor->lock, flags); |
2881 | + cpu_relax(); |
2882 | + } while (!surely_empty); |
2883 | } |
2884 | |
2885 | EXPORT_SYMBOL_GPL(usb_scuttle_anchored_urbs); |
2886 | diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c |
2887 | index 0061bf130598e..4395ea07c1bb4 100644 |
2888 | --- a/drivers/usb/gadget/function/f_ncm.c |
2889 | +++ b/drivers/usb/gadget/function/f_ncm.c |
2890 | @@ -91,8 +91,10 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f) |
2891 | /* peak (theoretical) bulk transfer rate in bits-per-second */ |
2892 | static inline unsigned ncm_bitrate(struct usb_gadget *g) |
2893 | { |
2894 | - if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) |
2895 | - return 13 * 1024 * 8 * 1000 * 8; |
2896 | + if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) |
2897 | + return 4250000000U; |
2898 | + else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) |
2899 | + return 3750000000U; |
2900 | else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH) |
2901 | return 13 * 512 * 8 * 1000 * 8; |
2902 | else |
2903 | @@ -1546,7 +1548,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) |
2904 | fs_ncm_notify_desc.bEndpointAddress; |
2905 | |
2906 | status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function, |
2907 | - ncm_ss_function, NULL); |
2908 | + ncm_ss_function, ncm_ss_function); |
2909 | if (status) |
2910 | goto fail; |
2911 | |
2912 | diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c |
2913 | index 0de36cda6e410..d89b3046dd10b 100644 |
2914 | --- a/drivers/usb/gadget/function/f_printer.c |
2915 | +++ b/drivers/usb/gadget/function/f_printer.c |
2916 | @@ -35,6 +35,7 @@ |
2917 | #include <linux/types.h> |
2918 | #include <linux/ctype.h> |
2919 | #include <linux/cdev.h> |
2920 | +#include <linux/kref.h> |
2921 | |
2922 | #include <asm/byteorder.h> |
2923 | #include <linux/io.h> |
2924 | @@ -69,7 +70,7 @@ struct printer_dev { |
2925 | struct usb_gadget *gadget; |
2926 | s8 interface; |
2927 | struct usb_ep *in_ep, *out_ep; |
2928 | - |
2929 | + struct kref kref; |
2930 | struct list_head rx_reqs; /* List of free RX structs */ |
2931 | struct list_head rx_reqs_active; /* List of Active RX xfers */ |
2932 | struct list_head rx_buffers; /* List of completed xfers */ |
2933 | @@ -223,6 +224,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, |
2934 | |
2935 | /*-------------------------------------------------------------------------*/ |
2936 | |
2937 | +static void printer_dev_free(struct kref *kref) |
2938 | +{ |
2939 | + struct printer_dev *dev = container_of(kref, struct printer_dev, kref); |
2940 | + |
2941 | + kfree(dev); |
2942 | +} |
2943 | + |
2944 | static struct usb_request * |
2945 | printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags) |
2946 | { |
2947 | @@ -353,6 +361,7 @@ printer_open(struct inode *inode, struct file *fd) |
2948 | |
2949 | spin_unlock_irqrestore(&dev->lock, flags); |
2950 | |
2951 | + kref_get(&dev->kref); |
2952 | DBG(dev, "printer_open returned %x\n", ret); |
2953 | return ret; |
2954 | } |
2955 | @@ -370,6 +379,7 @@ printer_close(struct inode *inode, struct file *fd) |
2956 | dev->printer_status &= ~PRINTER_SELECTED; |
2957 | spin_unlock_irqrestore(&dev->lock, flags); |
2958 | |
2959 | + kref_put(&dev->kref, printer_dev_free); |
2960 | DBG(dev, "printer_close\n"); |
2961 | |
2962 | return 0; |
2963 | @@ -1320,7 +1330,8 @@ static void gprinter_free(struct usb_function *f) |
2964 | struct f_printer_opts *opts; |
2965 | |
2966 | opts = container_of(f->fi, struct f_printer_opts, func_inst); |
2967 | - kfree(dev); |
2968 | + |
2969 | + kref_put(&dev->kref, printer_dev_free); |
2970 | mutex_lock(&opts->lock); |
2971 | --opts->refcnt; |
2972 | mutex_unlock(&opts->lock); |
2973 | @@ -1389,6 +1400,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi) |
2974 | return ERR_PTR(-ENOMEM); |
2975 | } |
2976 | |
2977 | + kref_init(&dev->kref); |
2978 | ++opts->refcnt; |
2979 | dev->minor = opts->minor; |
2980 | dev->pnp_string = opts->pnp_string; |
2981 | diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c |
2982 | index d5fbc2352029b..589d1f5fb575a 100644 |
2983 | --- a/drivers/usb/gadget/function/u_ether.c |
2984 | +++ b/drivers/usb/gadget/function/u_ether.c |
2985 | @@ -97,7 +97,7 @@ struct eth_dev { |
2986 | static inline int qlen(struct usb_gadget *gadget, unsigned qmult) |
2987 | { |
2988 | if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH || |
2989 | - gadget->speed == USB_SPEED_SUPER)) |
2990 | + gadget->speed >= USB_SPEED_SUPER)) |
2991 | return qmult * DEFAULT_QLEN; |
2992 | else |
2993 | return DEFAULT_QLEN; |
2994 | diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c |
2995 | index 17f1cf02ce342..2a14c71739d7d 100644 |
2996 | --- a/drivers/usb/host/ohci-hcd.c |
2997 | +++ b/drivers/usb/host/ohci-hcd.c |
2998 | @@ -665,20 +665,24 @@ retry: |
2999 | |
3000 | /* handle root hub init quirks ... */ |
3001 | val = roothub_a (ohci); |
3002 | - val &= ~(RH_A_PSM | RH_A_OCPM); |
3003 | + /* Configure for per-port over-current protection by default */ |
3004 | + val &= ~RH_A_NOCP; |
3005 | + val |= RH_A_OCPM; |
3006 | if (ohci->flags & OHCI_QUIRK_SUPERIO) { |
3007 | - /* NSC 87560 and maybe others */ |
3008 | + /* NSC 87560 and maybe others. |
3009 | + * Ganged power switching, no over-current protection. |
3010 | + */ |
3011 | val |= RH_A_NOCP; |
3012 | - val &= ~(RH_A_POTPGT | RH_A_NPS); |
3013 | - ohci_writel (ohci, val, &ohci->regs->roothub.a); |
3014 | + val &= ~(RH_A_POTPGT | RH_A_NPS | RH_A_PSM | RH_A_OCPM); |
3015 | } else if ((ohci->flags & OHCI_QUIRK_AMD756) || |
3016 | (ohci->flags & OHCI_QUIRK_HUB_POWER)) { |
3017 | /* hub power always on; required for AMD-756 and some |
3018 | - * Mac platforms. ganged overcurrent reporting, if any. |
3019 | + * Mac platforms. |
3020 | */ |
3021 | val |= RH_A_NPS; |
3022 | - ohci_writel (ohci, val, &ohci->regs->roothub.a); |
3023 | } |
3024 | + ohci_writel(ohci, val, &ohci->regs->roothub.a); |
3025 | + |
3026 | ohci_writel (ohci, RH_HS_LPSC, &ohci->regs->roothub.status); |
3027 | ohci_writel (ohci, (val & RH_A_NPS) ? 0 : RH_B_PPCM, |
3028 | &ohci->regs->roothub.b); |
3029 | diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c |
3030 | index bdfdd506bc588..c989f777bf771 100644 |
3031 | --- a/drivers/vfio/pci/vfio_pci_intrs.c |
3032 | +++ b/drivers/vfio/pci/vfio_pci_intrs.c |
3033 | @@ -355,11 +355,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, |
3034 | vdev->ctx[vector].producer.token = trigger; |
3035 | vdev->ctx[vector].producer.irq = irq; |
3036 | ret = irq_bypass_register_producer(&vdev->ctx[vector].producer); |
3037 | - if (unlikely(ret)) |
3038 | + if (unlikely(ret)) { |
3039 | dev_info(&pdev->dev, |
3040 | "irq bypass producer (token %p) registration fails: %d\n", |
3041 | vdev->ctx[vector].producer.token, ret); |
3042 | |
3043 | + vdev->ctx[vector].producer.token = NULL; |
3044 | + } |
3045 | vdev->ctx[vector].trigger = trigger; |
3046 | |
3047 | return 0; |
3048 | diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c |
3049 | index d414c7a3acf5a..a2f77625b7170 100644 |
3050 | --- a/drivers/video/backlight/sky81452-backlight.c |
3051 | +++ b/drivers/video/backlight/sky81452-backlight.c |
3052 | @@ -207,6 +207,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt( |
3053 | num_entry); |
3054 | if (ret < 0) { |
3055 | dev_err(dev, "led-sources node is invalid.\n"); |
3056 | + of_node_put(np); |
3057 | return ERR_PTR(-EINVAL); |
3058 | } |
3059 | |
3060 | diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c |
3061 | index dfe3eb769638b..fde27feae5d0c 100644 |
3062 | --- a/drivers/video/fbdev/sis/init.c |
3063 | +++ b/drivers/video/fbdev/sis/init.c |
3064 | @@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, |
3065 | |
3066 | i = 0; |
3067 | |
3068 | + if (SiS_Pr->ChipType == SIS_730) |
3069 | + queuedata = &FQBQData730[0]; |
3070 | + else |
3071 | + queuedata = &FQBQData[0]; |
3072 | + |
3073 | if(ModeNo > 0x13) { |
3074 | |
3075 | /* Get VCLK */ |
3076 | @@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, |
3077 | /* Get half colordepth */ |
3078 | colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)]; |
3079 | |
3080 | - if(SiS_Pr->ChipType == SIS_730) { |
3081 | - queuedata = &FQBQData730[0]; |
3082 | - } else { |
3083 | - queuedata = &FQBQData[0]; |
3084 | - } |
3085 | - |
3086 | do { |
3087 | templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth; |
3088 | |
3089 | diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c |
3090 | index ee6957a799bb6..aea8fd85cbf70 100644 |
3091 | --- a/drivers/video/fbdev/vga16fb.c |
3092 | +++ b/drivers/video/fbdev/vga16fb.c |
3093 | @@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info) |
3094 | } |
3095 | |
3096 | static void vga16fb_clock_chip(struct vga16fb_par *par, |
3097 | - unsigned int pixclock, |
3098 | + unsigned int *pixclock, |
3099 | const struct fb_info *info, |
3100 | int mul, int div) |
3101 | { |
3102 | @@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, |
3103 | { 0 /* bad */, 0x00, 0x00}}; |
3104 | int err; |
3105 | |
3106 | - pixclock = (pixclock * mul) / div; |
3107 | + *pixclock = (*pixclock * mul) / div; |
3108 | best = vgaclocks; |
3109 | - err = pixclock - best->pixclock; |
3110 | + err = *pixclock - best->pixclock; |
3111 | if (err < 0) err = -err; |
3112 | for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) { |
3113 | int tmp; |
3114 | |
3115 | - tmp = pixclock - ptr->pixclock; |
3116 | + tmp = *pixclock - ptr->pixclock; |
3117 | if (tmp < 0) tmp = -tmp; |
3118 | if (tmp < err) { |
3119 | err = tmp; |
3120 | @@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, |
3121 | } |
3122 | par->misc |= best->misc; |
3123 | par->clkdiv = best->seq_clock_mode; |
3124 | - pixclock = (best->pixclock * div) / mul; |
3125 | + *pixclock = (best->pixclock * div) / mul; |
3126 | } |
3127 | |
3128 | #define FAIL(X) return -EINVAL |
3129 | @@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var, |
3130 | |
3131 | if (mode & MODE_8BPP) |
3132 | /* pixel clock == vga clock / 2 */ |
3133 | - vga16fb_clock_chip(par, var->pixclock, info, 1, 2); |
3134 | + vga16fb_clock_chip(par, &var->pixclock, info, 1, 2); |
3135 | else |
3136 | /* pixel clock == vga clock */ |
3137 | - vga16fb_clock_chip(par, var->pixclock, info, 1, 1); |
3138 | + vga16fb_clock_chip(par, &var->pixclock, info, 1, 1); |
3139 | |
3140 | var->red.offset = var->green.offset = var->blue.offset = |
3141 | var->transp.offset = 0; |
3142 | diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c |
3143 | index 732e9abdcf969..29b9680035258 100644 |
3144 | --- a/drivers/virt/fsl_hypervisor.c |
3145 | +++ b/drivers/virt/fsl_hypervisor.c |
3146 | @@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) |
3147 | |
3148 | unsigned int i; |
3149 | long ret = 0; |
3150 | - int num_pinned; /* return value from get_user_pages() */ |
3151 | + int num_pinned = 0; /* return value from get_user_pages_fast() */ |
3152 | phys_addr_t remote_paddr; /* The next address in the remote buffer */ |
3153 | uint32_t count; /* The number of bytes left to copy */ |
3154 | |
3155 | @@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) |
3156 | return -EINVAL; |
3157 | |
3158 | /* |
3159 | - * The array of pages returned by get_user_pages() covers only |
3160 | + * The array of pages returned by get_user_pages_fast() covers only |
3161 | * page-aligned memory. Since the user buffer is probably not |
3162 | * page-aligned, we need to handle the discrepancy. |
3163 | * |
3164 | @@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) |
3165 | |
3166 | /* |
3167 | * 'pages' is an array of struct page pointers that's initialized by |
3168 | - * get_user_pages(). |
3169 | + * get_user_pages_fast(). |
3170 | */ |
3171 | pages = kzalloc(num_pages * sizeof(struct page *), GFP_KERNEL); |
3172 | if (!pages) { |
3173 | @@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) |
3174 | if (!sg_list_unaligned) { |
3175 | pr_debug("fsl-hv: could not allocate S/G list\n"); |
3176 | ret = -ENOMEM; |
3177 | - goto exit; |
3178 | + goto free_pages; |
3179 | } |
3180 | sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list)); |
3181 | |
3182 | @@ -253,7 +253,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) |
3183 | up_read(¤t->mm->mmap_sem); |
3184 | |
3185 | if (num_pinned != num_pages) { |
3186 | - /* get_user_pages() failed */ |
3187 | pr_debug("fsl-hv: could not lock source buffer\n"); |
3188 | ret = (num_pinned < 0) ? num_pinned : -EFAULT; |
3189 | goto exit; |
3190 | @@ -295,13 +294,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) |
3191 | virt_to_phys(sg_list), num_pages); |
3192 | |
3193 | exit: |
3194 | - if (pages) { |
3195 | - for (i = 0; i < num_pages; i++) |
3196 | - if (pages[i]) |
3197 | - put_page(pages[i]); |
3198 | + if (pages && (num_pinned > 0)) { |
3199 | + for (i = 0; i < num_pinned; i++) |
3200 | + put_page(pages[i]); |
3201 | } |
3202 | |
3203 | kfree(sg_list_unaligned); |
3204 | +free_pages: |
3205 | kfree(pages); |
3206 | |
3207 | if (!ret) |
3208 | diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c |
3209 | index a3b56544c21b9..ae1f2817bd6a6 100644 |
3210 | --- a/fs/cifs/asn1.c |
3211 | +++ b/fs/cifs/asn1.c |
3212 | @@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, |
3213 | return 0; |
3214 | } else if ((cls != ASN1_CTX) || (con != ASN1_CON) |
3215 | || (tag != ASN1_EOC)) { |
3216 | - cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n", |
3217 | - cls, con, tag, end, *end); |
3218 | + cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n", |
3219 | + cls, con, tag, end); |
3220 | return 0; |
3221 | } |
3222 | |
3223 | @@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, |
3224 | return 0; |
3225 | } else if ((cls != ASN1_UNI) || (con != ASN1_CON) |
3226 | || (tag != ASN1_SEQ)) { |
3227 | - cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n", |
3228 | - cls, con, tag, end, *end); |
3229 | + cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n", |
3230 | + cls, con, tag, end); |
3231 | return 0; |
3232 | } |
3233 | |
3234 | @@ -563,8 +563,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, |
3235 | return 0; |
3236 | } else if ((cls != ASN1_CTX) || (con != ASN1_CON) |
3237 | || (tag != ASN1_EOC)) { |
3238 | - cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n", |
3239 | - cls, con, tag, end, *end); |
3240 | + cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n", |
3241 | + cls, con, tag, end); |
3242 | return 0; |
3243 | } |
3244 | |
3245 | @@ -575,8 +575,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, |
3246 | return 0; |
3247 | } else if ((cls != ASN1_UNI) || (con != ASN1_CON) |
3248 | || (tag != ASN1_SEQ)) { |
3249 | - cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n", |
3250 | - cls, con, tag, end, *end); |
3251 | + cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n", |
3252 | + cls, con, tag, sequence_end); |
3253 | return 0; |
3254 | } |
3255 | |
3256 | diff --git a/fs/dlm/config.c b/fs/dlm/config.c |
3257 | index df955d2209ce9..6def89d2209d3 100644 |
3258 | --- a/fs/dlm/config.c |
3259 | +++ b/fs/dlm/config.c |
3260 | @@ -218,6 +218,7 @@ struct dlm_space { |
3261 | struct list_head members; |
3262 | struct mutex members_lock; |
3263 | int members_count; |
3264 | + struct dlm_nodes *nds; |
3265 | }; |
3266 | |
3267 | struct dlm_comms { |
3268 | @@ -426,6 +427,7 @@ static struct config_group *make_space(struct config_group *g, const char *name) |
3269 | INIT_LIST_HEAD(&sp->members); |
3270 | mutex_init(&sp->members_lock); |
3271 | sp->members_count = 0; |
3272 | + sp->nds = nds; |
3273 | return &sp->group; |
3274 | |
3275 | fail: |
3276 | @@ -447,6 +449,7 @@ static void drop_space(struct config_group *g, struct config_item *i) |
3277 | static void release_space(struct config_item *i) |
3278 | { |
3279 | struct dlm_space *sp = config_item_to_space(i); |
3280 | + kfree(sp->nds); |
3281 | kfree(sp); |
3282 | } |
3283 | |
3284 | diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c |
3285 | index 7c410f8794124..2aa073b82d30f 100644 |
3286 | --- a/fs/ntfs/inode.c |
3287 | +++ b/fs/ntfs/inode.c |
3288 | @@ -1844,6 +1844,12 @@ int ntfs_read_inode_mount(struct inode *vi) |
3289 | brelse(bh); |
3290 | } |
3291 | |
3292 | + if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) { |
3293 | + ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.", |
3294 | + le32_to_cpu(m->bytes_allocated), vol->mft_record_size); |
3295 | + goto err_out; |
3296 | + } |
3297 | + |
3298 | /* Apply the mst fixups. */ |
3299 | if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) { |
3300 | /* FIXME: Try to use the $MFTMirr now. */ |
3301 | diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c |
3302 | index ca71bf881ad1e..4a39bb98f8ab5 100644 |
3303 | --- a/fs/quota/quota_v2.c |
3304 | +++ b/fs/quota/quota_v2.c |
3305 | @@ -266,6 +266,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot) |
3306 | d->dqb_curspace = cpu_to_le64(m->dqb_curspace); |
3307 | d->dqb_btime = cpu_to_le64(m->dqb_btime); |
3308 | d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id)); |
3309 | + d->dqb_pad = 0; |
3310 | if (qtree_entry_unused(info, dp)) |
3311 | d->dqb_itime = cpu_to_le64(1); |
3312 | } |
3313 | diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c |
3314 | index 897154e993800..f28999f717761 100644 |
3315 | --- a/fs/reiserfs/inode.c |
3316 | +++ b/fs/reiserfs/inode.c |
3317 | @@ -2166,7 +2166,8 @@ out_end_trans: |
3318 | out_inserted_sd: |
3319 | clear_nlink(inode); |
3320 | th->t_trans_id = 0; /* so the caller can't use this handle later */ |
3321 | - unlock_new_inode(inode); /* OK to do even if we hadn't locked it */ |
3322 | + if (inode->i_state & I_NEW) |
3323 | + unlock_new_inode(inode); |
3324 | iput(inode); |
3325 | return err; |
3326 | } |
3327 | diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c |
3328 | index 677608a89b08d..c533d8715a6ca 100644 |
3329 | --- a/fs/reiserfs/super.c |
3330 | +++ b/fs/reiserfs/super.c |
3331 | @@ -1234,6 +1234,10 @@ static int reiserfs_parse_options(struct super_block *s, |
3332 | "turned on."); |
3333 | return 0; |
3334 | } |
3335 | + if (qf_names[qtype] != |
3336 | + REISERFS_SB(s)->s_qf_names[qtype]) |
3337 | + kfree(qf_names[qtype]); |
3338 | + qf_names[qtype] = NULL; |
3339 | if (*arg) { /* Some filename specified? */ |
3340 | if (REISERFS_SB(s)->s_qf_names[qtype] |
3341 | && strcmp(REISERFS_SB(s)->s_qf_names[qtype], |
3342 | @@ -1263,10 +1267,6 @@ static int reiserfs_parse_options(struct super_block *s, |
3343 | else |
3344 | *mount_options |= 1 << REISERFS_GRPQUOTA; |
3345 | } else { |
3346 | - if (qf_names[qtype] != |
3347 | - REISERFS_SB(s)->s_qf_names[qtype]) |
3348 | - kfree(qf_names[qtype]); |
3349 | - qf_names[qtype] = NULL; |
3350 | if (qtype == USRQUOTA) |
3351 | *mount_options &= ~(1 << REISERFS_USRQUOTA); |
3352 | else |
3353 | diff --git a/fs/udf/inode.c b/fs/udf/inode.c |
3354 | index 9e66d85021fcb..149baf5f3d195 100644 |
3355 | --- a/fs/udf/inode.c |
3356 | +++ b/fs/udf/inode.c |
3357 | @@ -140,21 +140,24 @@ void udf_evict_inode(struct inode *inode) |
3358 | struct udf_inode_info *iinfo = UDF_I(inode); |
3359 | int want_delete = 0; |
3360 | |
3361 | - if (!inode->i_nlink && !is_bad_inode(inode)) { |
3362 | - want_delete = 1; |
3363 | - udf_setsize(inode, 0); |
3364 | - udf_update_inode(inode, IS_SYNC(inode)); |
3365 | + if (!is_bad_inode(inode)) { |
3366 | + if (!inode->i_nlink) { |
3367 | + want_delete = 1; |
3368 | + udf_setsize(inode, 0); |
3369 | + udf_update_inode(inode, IS_SYNC(inode)); |
3370 | + } |
3371 | + if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && |
3372 | + inode->i_size != iinfo->i_lenExtents) { |
3373 | + udf_warn(inode->i_sb, |
3374 | + "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n", |
3375 | + inode->i_ino, inode->i_mode, |
3376 | + (unsigned long long)inode->i_size, |
3377 | + (unsigned long long)iinfo->i_lenExtents); |
3378 | + } |
3379 | } |
3380 | truncate_inode_pages_final(&inode->i_data); |
3381 | invalidate_inode_buffers(inode); |
3382 | clear_inode(inode); |
3383 | - if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && |
3384 | - inode->i_size != iinfo->i_lenExtents) { |
3385 | - udf_warn(inode->i_sb, "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n", |
3386 | - inode->i_ino, inode->i_mode, |
3387 | - (unsigned long long)inode->i_size, |
3388 | - (unsigned long long)iinfo->i_lenExtents); |
3389 | - } |
3390 | kfree(iinfo->i_ext.i_data); |
3391 | iinfo->i_ext.i_data = NULL; |
3392 | udf_clear_extent_cache(inode); |
3393 | diff --git a/fs/udf/super.c b/fs/udf/super.c |
3394 | index 4abdba453885e..c8c037e8e57b5 100644 |
3395 | --- a/fs/udf/super.c |
3396 | +++ b/fs/udf/super.c |
3397 | @@ -1391,6 +1391,12 @@ static int udf_load_sparable_map(struct super_block *sb, |
3398 | (int)spm->numSparingTables); |
3399 | return -EIO; |
3400 | } |
3401 | + if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) { |
3402 | + udf_err(sb, "error loading logical volume descriptor: " |
3403 | + "Too big sparing table size (%u)\n", |
3404 | + le32_to_cpu(spm->sizeSparingTable)); |
3405 | + return -EIO; |
3406 | + } |
3407 | |
3408 | for (i = 0; i < spm->numSparingTables; i++) { |
3409 | loc = le32_to_cpu(spm->locSparingTable[i]); |
3410 | diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c |
3411 | index 0d93d3c10fcc4..d812f84252d5b 100644 |
3412 | --- a/fs/xfs/xfs_rtalloc.c |
3413 | +++ b/fs/xfs/xfs_rtalloc.c |
3414 | @@ -257,6 +257,9 @@ xfs_rtallocate_extent_block( |
3415 | end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1; |
3416 | i <= end; |
3417 | i++) { |
3418 | + /* Make sure we don't scan off the end of the rt volume. */ |
3419 | + maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i; |
3420 | + |
3421 | /* |
3422 | * See if there's a free extent of maxlen starting at i. |
3423 | * If it's not so then next will contain the first non-free. |
3424 | @@ -448,6 +451,14 @@ xfs_rtallocate_extent_near( |
3425 | */ |
3426 | if (bno >= mp->m_sb.sb_rextents) |
3427 | bno = mp->m_sb.sb_rextents - 1; |
3428 | + |
3429 | + /* Make sure we don't run off the end of the rt volume. */ |
3430 | + maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno; |
3431 | + if (maxlen < minlen) { |
3432 | + *rtblock = NULLRTBLOCK; |
3433 | + return 0; |
3434 | + } |
3435 | + |
3436 | /* |
3437 | * Try the exact allocation first. |
3438 | */ |
3439 | diff --git a/include/linux/overflow.h b/include/linux/overflow.h |
3440 | index 40b48e2133cb8..38a47cc62cf3a 100644 |
3441 | --- a/include/linux/overflow.h |
3442 | +++ b/include/linux/overflow.h |
3443 | @@ -3,6 +3,7 @@ |
3444 | #define __LINUX_OVERFLOW_H |
3445 | |
3446 | #include <linux/compiler.h> |
3447 | +#include <linux/limits.h> |
3448 | |
3449 | /* |
3450 | * In the fallback code below, we need to compute the minimum and |
3451 | diff --git a/include/net/ip.h b/include/net/ip.h |
3452 | index d577fb5647c5d..f987eaf999004 100644 |
3453 | --- a/include/net/ip.h |
3454 | +++ b/include/net/ip.h |
3455 | @@ -342,12 +342,18 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, |
3456 | bool forwarding) |
3457 | { |
3458 | struct net *net = dev_net(dst->dev); |
3459 | + unsigned int mtu; |
3460 | |
3461 | if (net->ipv4.sysctl_ip_fwd_use_pmtu || |
3462 | ip_mtu_locked(dst) || |
3463 | !forwarding) |
3464 | return dst_mtu(dst); |
3465 | |
3466 | + /* 'forwarding = true' case should always honour route mtu */ |
3467 | + mtu = dst_metric_raw(dst, RTAX_MTU); |
3468 | + if (mtu) |
3469 | + return mtu; |
3470 | + |
3471 | return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); |
3472 | } |
3473 | |
3474 | diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h |
3475 | index 20bf7eaef05a0..d699fdc78cbb9 100644 |
3476 | --- a/include/scsi/scsi_common.h |
3477 | +++ b/include/scsi/scsi_common.h |
3478 | @@ -24,6 +24,13 @@ scsi_command_size(const unsigned char *cmnd) |
3479 | scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]); |
3480 | } |
3481 | |
3482 | +static inline unsigned char |
3483 | +scsi_command_control(const unsigned char *cmnd) |
3484 | +{ |
3485 | + return (cmnd[0] == VARIABLE_LENGTH_CMD) ? |
3486 | + cmnd[1] : cmnd[COMMAND_SIZE(cmnd[0]) - 1]; |
3487 | +} |
3488 | + |
3489 | /* Returns a human-readable name for the device */ |
3490 | extern const char *scsi_device_type(unsigned type); |
3491 | |
3492 | diff --git a/include/trace/events/target.h b/include/trace/events/target.h |
3493 | index 50fea660c0f89..d543e8b87e50a 100644 |
3494 | --- a/include/trace/events/target.h |
3495 | +++ b/include/trace/events/target.h |
3496 | @@ -139,6 +139,7 @@ TRACE_EVENT(target_sequencer_start, |
3497 | __field( unsigned int, opcode ) |
3498 | __field( unsigned int, data_length ) |
3499 | __field( unsigned int, task_attribute ) |
3500 | + __field( unsigned char, control ) |
3501 | __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) |
3502 | __string( initiator, cmd->se_sess->se_node_acl->initiatorname ) |
3503 | ), |
3504 | @@ -148,6 +149,7 @@ TRACE_EVENT(target_sequencer_start, |
3505 | __entry->opcode = cmd->t_task_cdb[0]; |
3506 | __entry->data_length = cmd->data_length; |
3507 | __entry->task_attribute = cmd->sam_task_attr; |
3508 | + __entry->control = scsi_command_control(cmd->t_task_cdb); |
3509 | memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE); |
3510 | __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname); |
3511 | ), |
3512 | @@ -157,9 +159,7 @@ TRACE_EVENT(target_sequencer_start, |
3513 | show_opcode_name(__entry->opcode), |
3514 | __entry->data_length, __print_hex(__entry->cdb, 16), |
3515 | show_task_attribute_name(__entry->task_attribute), |
3516 | - scsi_command_size(__entry->cdb) <= 16 ? |
3517 | - __entry->cdb[scsi_command_size(__entry->cdb) - 1] : |
3518 | - __entry->cdb[1] |
3519 | + __entry->control |
3520 | ) |
3521 | ); |
3522 | |
3523 | @@ -174,6 +174,7 @@ TRACE_EVENT(target_cmd_complete, |
3524 | __field( unsigned int, opcode ) |
3525 | __field( unsigned int, data_length ) |
3526 | __field( unsigned int, task_attribute ) |
3527 | + __field( unsigned char, control ) |
3528 | __field( unsigned char, scsi_status ) |
3529 | __field( unsigned char, sense_length ) |
3530 | __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) |
3531 | @@ -186,6 +187,7 @@ TRACE_EVENT(target_cmd_complete, |
3532 | __entry->opcode = cmd->t_task_cdb[0]; |
3533 | __entry->data_length = cmd->data_length; |
3534 | __entry->task_attribute = cmd->sam_task_attr; |
3535 | + __entry->control = scsi_command_control(cmd->t_task_cdb); |
3536 | __entry->scsi_status = cmd->scsi_status; |
3537 | __entry->sense_length = cmd->scsi_status == SAM_STAT_CHECK_CONDITION ? |
3538 | min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0; |
3539 | @@ -202,9 +204,7 @@ TRACE_EVENT(target_cmd_complete, |
3540 | show_opcode_name(__entry->opcode), |
3541 | __entry->data_length, __print_hex(__entry->cdb, 16), |
3542 | show_task_attribute_name(__entry->task_attribute), |
3543 | - scsi_command_size(__entry->cdb) <= 16 ? |
3544 | - __entry->cdb[scsi_command_size(__entry->cdb) - 1] : |
3545 | - __entry->cdb[1] |
3546 | + __entry->control |
3547 | ) |
3548 | ); |
3549 | |
3550 | diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c |
3551 | index cc892a9e109d8..ae39b014b7d6c 100644 |
3552 | --- a/kernel/debug/kdb/kdb_io.c |
3553 | +++ b/kernel/debug/kdb/kdb_io.c |
3554 | @@ -683,12 +683,16 @@ int vkdb_printf(enum kdb_msgsrc src, const char *fmt, va_list ap) |
3555 | size_avail = sizeof(kdb_buffer) - len; |
3556 | goto kdb_print_out; |
3557 | } |
3558 | - if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) |
3559 | + if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) { |
3560 | /* |
3561 | * This was a interactive search (using '/' at more |
3562 | - * prompt) and it has completed. Clear the flag. |
3563 | + * prompt) and it has completed. Replace the \0 with |
3564 | + * its original value to ensure multi-line strings |
3565 | + * are handled properly, and return to normal mode. |
3566 | */ |
3567 | + *cphold = replaced_byte; |
3568 | kdb_grepping_flag = 0; |
3569 | + } |
3570 | /* |
3571 | * at this point the string is a full line and |
3572 | * should be printed, up to the null. |
3573 | diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c |
3574 | index 3c775d6b7317f..7b393faf930f8 100644 |
3575 | --- a/kernel/power/hibernate.c |
3576 | +++ b/kernel/power/hibernate.c |
3577 | @@ -834,17 +834,6 @@ static int software_resume(void) |
3578 | |
3579 | /* Check if the device is there */ |
3580 | swsusp_resume_device = name_to_dev_t(resume_file); |
3581 | - |
3582 | - /* |
3583 | - * name_to_dev_t is ineffective to verify parition if resume_file is in |
3584 | - * integer format. (e.g. major:minor) |
3585 | - */ |
3586 | - if (isdigit(resume_file[0]) && resume_wait) { |
3587 | - int partno; |
3588 | - while (!get_gendisk(swsusp_resume_device, &partno)) |
3589 | - msleep(10); |
3590 | - } |
3591 | - |
3592 | if (!swsusp_resume_device) { |
3593 | /* |
3594 | * Some device discovery might still be in progress; we need |
3595 | diff --git a/lib/crc32.c b/lib/crc32.c |
3596 | index 7fbd1a112b9d2..0d450462b0bd5 100644 |
3597 | --- a/lib/crc32.c |
3598 | +++ b/lib/crc32.c |
3599 | @@ -327,7 +327,7 @@ static inline u32 __pure crc32_be_generic(u32 crc, unsigned char const *p, |
3600 | return crc; |
3601 | } |
3602 | |
3603 | -#if CRC_LE_BITS == 1 |
3604 | +#if CRC_BE_BITS == 1 |
3605 | u32 __pure crc32_be(u32 crc, unsigned char const *p, size_t len) |
3606 | { |
3607 | return crc32_be_generic(crc, p, len, NULL, CRCPOLY_BE); |
3608 | diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c |
3609 | index ab6b1788dbfc3..f46f59129bf39 100644 |
3610 | --- a/net/bluetooth/l2cap_sock.c |
3611 | +++ b/net/bluetooth/l2cap_sock.c |
3612 | @@ -1340,8 +1340,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) |
3613 | |
3614 | parent = bt_sk(sk)->parent; |
3615 | |
3616 | - sock_set_flag(sk, SOCK_ZAPPED); |
3617 | - |
3618 | switch (chan->state) { |
3619 | case BT_OPEN: |
3620 | case BT_BOUND: |
3621 | @@ -1368,8 +1366,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) |
3622 | |
3623 | break; |
3624 | } |
3625 | - |
3626 | release_sock(sk); |
3627 | + |
3628 | + /* Only zap after cleanup to avoid use after free race */ |
3629 | + sock_set_flag(sk, SOCK_ZAPPED); |
3630 | + |
3631 | } |
3632 | |
3633 | static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, |
3634 | diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c |
3635 | index cc5c8d598e5e8..9a21080e24560 100644 |
3636 | --- a/net/ipv4/icmp.c |
3637 | +++ b/net/ipv4/icmp.c |
3638 | @@ -246,7 +246,7 @@ static struct { |
3639 | /** |
3640 | * icmp_global_allow - Are we allowed to send one more ICMP message ? |
3641 | * |
3642 | - * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec. |
3643 | + * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec. |
3644 | * Returns false if we reached the limit and can not send another packet. |
3645 | * Note: called with BH disabled |
3646 | */ |
3647 | @@ -274,7 +274,10 @@ bool icmp_global_allow(void) |
3648 | } |
3649 | credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); |
3650 | if (credit) { |
3651 | - credit--; |
3652 | + /* We want to use a credit of one in average, but need to randomize |
3653 | + * it for security reasons. |
3654 | + */ |
3655 | + credit = max_t(int, credit - prandom_u32_max(3), 0); |
3656 | rc = true; |
3657 | } |
3658 | WRITE_ONCE(icmp_global.credit, credit); |
3659 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c |
3660 | index 23246d8a3eaea..d05135ea3c289 100644 |
3661 | --- a/net/ipv4/tcp_input.c |
3662 | +++ b/net/ipv4/tcp_input.c |
3663 | @@ -5598,6 +5598,8 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb, |
3664 | tcp_data_snd_check(sk); |
3665 | if (!inet_csk_ack_scheduled(sk)) |
3666 | goto no_ack; |
3667 | + } else { |
3668 | + tcp_update_wl(tp, TCP_SKB_CB(skb)->seq); |
3669 | } |
3670 | |
3671 | __tcp_ack_snd_check(sk, 0); |
3672 | diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c |
3673 | index 33125fc009cfd..ba9e711f7e3d6 100644 |
3674 | --- a/net/netfilter/ipvs/ip_vs_ctl.c |
3675 | +++ b/net/netfilter/ipvs/ip_vs_ctl.c |
3676 | @@ -2424,6 +2424,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) |
3677 | /* Set timeout values for (tcp tcpfin udp) */ |
3678 | ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg); |
3679 | goto out_unlock; |
3680 | + } else if (!len) { |
3681 | + /* No more commands with len == 0 below */ |
3682 | + ret = -EINVAL; |
3683 | + goto out_unlock; |
3684 | } |
3685 | |
3686 | usvc_compat = (struct ip_vs_service_user *)arg; |
3687 | @@ -2500,9 +2504,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) |
3688 | break; |
3689 | case IP_VS_SO_SET_DELDEST: |
3690 | ret = ip_vs_del_dest(svc, &udest); |
3691 | - break; |
3692 | - default: |
3693 | - ret = -EINVAL; |
3694 | } |
3695 | |
3696 | out_unlock: |
3697 | diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c |
3698 | index e79a49fe61e88..0afae9f73ebb4 100644 |
3699 | --- a/net/nfc/netlink.c |
3700 | +++ b/net/nfc/netlink.c |
3701 | @@ -1227,7 +1227,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info) |
3702 | u32 idx; |
3703 | char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1]; |
3704 | |
3705 | - if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) |
3706 | + if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME]) |
3707 | return -EINVAL; |
3708 | |
3709 | idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); |
3710 | diff --git a/net/tipc/msg.c b/net/tipc/msg.c |
3711 | index ea554756a786d..41290fe810220 100644 |
3712 | --- a/net/tipc/msg.c |
3713 | +++ b/net/tipc/msg.c |
3714 | @@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) |
3715 | if (fragid == FIRST_FRAGMENT) { |
3716 | if (unlikely(head)) |
3717 | goto err; |
3718 | - frag = skb_unshare(frag, GFP_ATOMIC); |
3719 | + if (skb_cloned(frag)) |
3720 | + frag = skb_copy(frag, GFP_ATOMIC); |
3721 | if (unlikely(!frag)) |
3722 | goto err; |
3723 | head = *headbuf = frag; |
3724 | diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c |
3725 | index 1eb77161d5e64..5bd89f536720d 100644 |
3726 | --- a/net/wireless/nl80211.c |
3727 | +++ b/net/wireless/nl80211.c |
3728 | @@ -1749,7 +1749,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, |
3729 | * case we'll continue with more data in the next round, |
3730 | * but break unconditionally so unsplit data stops here. |
3731 | */ |
3732 | - state->split_start++; |
3733 | + if (state->split) |
3734 | + state->split_start++; |
3735 | + else |
3736 | + state->split_start = 0; |
3737 | break; |
3738 | case 9: |
3739 | if (rdev->wiphy.extended_capabilities && |
3740 | diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c |
3741 | index 49db1def1721c..84e583ab8fd0c 100644 |
3742 | --- a/samples/mic/mpssd/mpssd.c |
3743 | +++ b/samples/mic/mpssd/mpssd.c |
3744 | @@ -414,9 +414,9 @@ mic_virtio_copy(struct mic_info *mic, int fd, |
3745 | |
3746 | static inline unsigned _vring_size(unsigned int num, unsigned long align) |
3747 | { |
3748 | - return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num) |
3749 | + return _ALIGN_UP(((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num) |
3750 | + align - 1) & ~(align - 1)) |
3751 | - + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num; |
3752 | + + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num, 4); |
3753 | } |
3754 | |
3755 | /* |
3756 | diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c |
3757 | index 5155c343406e0..170f12031ae5f 100644 |
3758 | --- a/security/integrity/ima/ima_crypto.c |
3759 | +++ b/security/integrity/ima/ima_crypto.c |
3760 | @@ -683,6 +683,8 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest, |
3761 | ima_pcrread(i, pcr_i); |
3762 | /* now accumulate with current aggregate */ |
3763 | rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE); |
3764 | + if (rc != 0) |
3765 | + return rc; |
3766 | } |
3767 | if (!rc) |
3768 | crypto_shash_final(shash, digest); |
3769 | diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c |
3770 | index 4b78979599131..ade880fe24a41 100644 |
3771 | --- a/sound/core/seq/oss/seq_oss.c |
3772 | +++ b/sound/core/seq/oss/seq_oss.c |
3773 | @@ -187,9 +187,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) |
3774 | if (snd_BUG_ON(!dp)) |
3775 | return -ENXIO; |
3776 | |
3777 | - mutex_lock(®ister_mutex); |
3778 | + if (cmd != SNDCTL_SEQ_SYNC && |
3779 | + mutex_lock_interruptible(®ister_mutex)) |
3780 | + return -ERESTARTSYS; |
3781 | rc = snd_seq_oss_ioctl(dp, cmd, arg); |
3782 | - mutex_unlock(®ister_mutex); |
3783 | + if (cmd != SNDCTL_SEQ_SYNC) |
3784 | + mutex_unlock(®ister_mutex); |
3785 | return rc; |
3786 | } |
3787 | |
3788 | diff --git a/sound/firewire/bebob/bebob_hwdep.c b/sound/firewire/bebob/bebob_hwdep.c |
3789 | index ce731f4d8b4f5..733ba42e24622 100644 |
3790 | --- a/sound/firewire/bebob/bebob_hwdep.c |
3791 | +++ b/sound/firewire/bebob/bebob_hwdep.c |
3792 | @@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, |
3793 | } |
3794 | |
3795 | memset(&event, 0, sizeof(event)); |
3796 | + count = min_t(long, count, sizeof(event.lock_status)); |
3797 | if (bebob->dev_lock_changed) { |
3798 | event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; |
3799 | event.lock_status.status = (bebob->dev_lock_count > 0); |
3800 | bebob->dev_lock_changed = false; |
3801 | - |
3802 | - count = min_t(long, count, sizeof(event.lock_status)); |
3803 | } |
3804 | |
3805 | spin_unlock_irq(&bebob->lock); |
3806 | diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c |
3807 | index 420d200f9a053..eeed53cf325ac 100644 |
3808 | --- a/sound/soc/qcom/lpass-platform.c |
3809 | +++ b/sound/soc/qcom/lpass-platform.c |
3810 | @@ -68,7 +68,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream) |
3811 | int ret, dma_ch, dir = substream->stream; |
3812 | struct lpass_pcm_data *data; |
3813 | |
3814 | - data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL); |
3815 | + data = kzalloc(sizeof(*data), GFP_KERNEL); |
3816 | if (!data) |
3817 | return -ENOMEM; |
3818 | |
3819 | @@ -140,6 +140,7 @@ static int lpass_platform_pcmops_close(struct snd_pcm_substream *substream) |
3820 | if (v->free_dma_channel) |
3821 | v->free_dma_channel(drvdata, dma_ch); |
3822 | |
3823 | + kfree(data); |
3824 | return 0; |
3825 | } |
3826 | |
3827 | diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c |
3828 | index 24c6621e2d951..54790a09d1582 100644 |
3829 | --- a/tools/perf/util/intel-pt.c |
3830 | +++ b/tools/perf/util/intel-pt.c |
3831 | @@ -873,6 +873,8 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt, |
3832 | |
3833 | if (queue->tid == -1 || pt->have_sched_switch) { |
3834 | ptq->tid = machine__get_current_tid(pt->machine, ptq->cpu); |
3835 | + if (ptq->tid == -1) |
3836 | + ptq->pid = -1; |
3837 | thread__zput(ptq->thread); |
3838 | } |
3839 | |
3840 | @@ -1732,10 +1734,8 @@ static int intel_pt_context_switch(struct intel_pt *pt, union perf_event *event, |
3841 | tid = sample->tid; |
3842 | } |
3843 | |
3844 | - if (tid == -1) { |
3845 | - pr_err("context_switch event has no tid\n"); |
3846 | - return -EINVAL; |
3847 | - } |
3848 | + if (tid == -1) |
3849 | + intel_pt_log("context_switch event has no tid\n"); |
3850 | |
3851 | intel_pt_log("context_switch: cpu %d pid %d tid %d time %"PRIu64" tsc %#"PRIx64"\n", |
3852 | cpu, pid, tid, sample->time, perf_time_to_tsc(sample->time, |