Annotation of /trunk/kernel-alx-legacy/patches-4.9/0340-4.9.241-all-fixes.patch
Parent Directory
|
Revision Log
Revision 3642 -
(hide annotations)
(download)
Mon Oct 24 14:07:22 2022 UTC (20 months ago) by niro
File size: 130674 byte(s)
Mon Oct 24 14:07:22 2022 UTC (20 months ago) by niro
File size: 130674 byte(s)
-linux-4.9.241
1 | niro | 3642 | diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt |
2 | index 49935d5bb5c6b..a374412610ba3 100644 | ||
3 | --- a/Documentation/networking/ip-sysctl.txt | ||
4 | +++ b/Documentation/networking/ip-sysctl.txt | ||
5 | @@ -887,12 +887,14 @@ icmp_ratelimit - INTEGER | ||
6 | icmp_msgs_per_sec - INTEGER | ||
7 | Limit maximal number of ICMP packets sent per second from this host. | ||
8 | Only messages whose type matches icmp_ratemask (see below) are | ||
9 | - controlled by this limit. | ||
10 | + controlled by this limit. For security reasons, the precise count | ||
11 | + of messages per second is randomized. | ||
12 | Default: 1000 | ||
13 | |||
14 | icmp_msgs_burst - INTEGER | ||
15 | icmp_msgs_per_sec controls number of ICMP packets sent per second, | ||
16 | while icmp_msgs_burst controls the burst size of these packets. | ||
17 | + For security reasons, the precise burst size is randomized. | ||
18 | Default: 50 | ||
19 | |||
20 | icmp_ratemask - INTEGER | ||
21 | diff --git a/Makefile b/Makefile | ||
22 | index a6a9d494dc18f..c4f3d2ea9b43e 100644 | ||
23 | --- a/Makefile | ||
24 | +++ b/Makefile | ||
25 | @@ -1,6 +1,6 @@ | ||
26 | VERSION = 4 | ||
27 | PATCHLEVEL = 9 | ||
28 | -SUBLEVEL = 240 | ||
29 | +SUBLEVEL = 241 | ||
30 | EXTRAVERSION = | ||
31 | NAME = Roaring Lionus | ||
32 | |||
33 | diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c | ||
34 | index d1870c777c6e2..3a465bfa7d4a2 100644 | ||
35 | --- a/arch/arm/mm/cache-l2x0.c | ||
36 | +++ b/arch/arm/mm/cache-l2x0.c | ||
37 | @@ -1252,20 +1252,28 @@ static void __init l2c310_of_parse(const struct device_node *np, | ||
38 | |||
39 | ret = of_property_read_u32(np, "prefetch-data", &val); | ||
40 | if (ret == 0) { | ||
41 | - if (val) | ||
42 | + if (val) { | ||
43 | prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH; | ||
44 | - else | ||
45 | + *aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH; | ||
46 | + } else { | ||
47 | prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; | ||
48 | + *aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; | ||
49 | + } | ||
50 | + *aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; | ||
51 | } else if (ret != -EINVAL) { | ||
52 | pr_err("L2C-310 OF prefetch-data property value is missing\n"); | ||
53 | } | ||
54 | |||
55 | ret = of_property_read_u32(np, "prefetch-instr", &val); | ||
56 | if (ret == 0) { | ||
57 | - if (val) | ||
58 | + if (val) { | ||
59 | prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH; | ||
60 | - else | ||
61 | + *aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH; | ||
62 | + } else { | ||
63 | prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; | ||
64 | + *aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; | ||
65 | + } | ||
66 | + *aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; | ||
67 | } else if (ret != -EINVAL) { | ||
68 | pr_err("L2C-310 OF prefetch-instr property value is missing\n"); | ||
69 | } | ||
70 | diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi | ||
71 | index 08b88f6791beb..fb5001a6879c7 100644 | ||
72 | --- a/arch/arm64/boot/dts/qcom/msm8916.dtsi | ||
73 | +++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi | ||
74 | @@ -715,7 +715,7 @@ | ||
75 | reg-names = "mdp_phys"; | ||
76 | |||
77 | interrupt-parent = <&mdss>; | ||
78 | - interrupts = <0 0>; | ||
79 | + interrupts = <0>; | ||
80 | |||
81 | clocks = <&gcc GCC_MDSS_AHB_CLK>, | ||
82 | <&gcc GCC_MDSS_AXI_CLK>, | ||
83 | @@ -745,7 +745,7 @@ | ||
84 | reg-names = "dsi_ctrl"; | ||
85 | |||
86 | interrupt-parent = <&mdss>; | ||
87 | - interrupts = <4 0>; | ||
88 | + interrupts = <4>; | ||
89 | |||
90 | assigned-clocks = <&gcc BYTE0_CLK_SRC>, | ||
91 | <&gcc PCLK0_CLK_SRC>; | ||
92 | diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi | ||
93 | index 54dc28351c8cb..b9ff697987338 100644 | ||
94 | --- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi | ||
95 | +++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi | ||
96 | @@ -175,7 +175,7 @@ | ||
97 | }; | ||
98 | |||
99 | i2c0: i2c@ff020000 { | ||
100 | - compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; | ||
101 | + compatible = "cdns,i2c-r1p14"; | ||
102 | status = "disabled"; | ||
103 | interrupt-parent = <&gic>; | ||
104 | interrupts = <0 17 4>; | ||
105 | @@ -185,7 +185,7 @@ | ||
106 | }; | ||
107 | |||
108 | i2c1: i2c@ff030000 { | ||
109 | - compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; | ||
110 | + compatible = "cdns,i2c-r1p14"; | ||
111 | status = "disabled"; | ||
112 | interrupt-parent = <&gic>; | ||
113 | interrupts = <0 18 4>; | ||
114 | diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h | ||
115 | index 26aeeaad32678..a36ef27155bc2 100644 | ||
116 | --- a/arch/powerpc/include/asm/reg.h | ||
117 | +++ b/arch/powerpc/include/asm/reg.h | ||
118 | @@ -683,7 +683,7 @@ | ||
119 | #define THRM1_TIN (1 << 31) | ||
120 | #define THRM1_TIV (1 << 30) | ||
121 | #define THRM1_THRES(x) ((x&0x7f)<<23) | ||
122 | -#define THRM3_SITV(x) ((x&0x3fff)<<1) | ||
123 | +#define THRM3_SITV(x) ((x & 0x1fff) << 1) | ||
124 | #define THRM1_TID (1<<2) | ||
125 | #define THRM1_TIE (1<<1) | ||
126 | #define THRM1_V (1<<0) | ||
127 | diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c | ||
128 | index a753b72efbc0c..70c9d134a9d44 100644 | ||
129 | --- a/arch/powerpc/kernel/tau_6xx.c | ||
130 | +++ b/arch/powerpc/kernel/tau_6xx.c | ||
131 | @@ -37,8 +37,6 @@ static struct tau_temp | ||
132 | |||
133 | struct timer_list tau_timer; | ||
134 | |||
135 | -#undef DEBUG | ||
136 | - | ||
137 | /* TODO: put these in a /proc interface, with some sanity checks, and maybe | ||
138 | * dynamic adjustment to minimize # of interrupts */ | ||
139 | /* configurable values for step size and how much to expand the window when | ||
140 | @@ -71,47 +69,33 @@ void set_thresholds(unsigned long cpu) | ||
141 | |||
142 | void TAUupdate(int cpu) | ||
143 | { | ||
144 | - unsigned thrm; | ||
145 | - | ||
146 | -#ifdef DEBUG | ||
147 | - printk("TAUupdate "); | ||
148 | -#endif | ||
149 | + u32 thrm; | ||
150 | + u32 bits = THRM1_TIV | THRM1_TIN | THRM1_V; | ||
151 | |||
152 | /* if both thresholds are crossed, the step_sizes cancel out | ||
153 | * and the window winds up getting expanded twice. */ | ||
154 | - if((thrm = mfspr(SPRN_THRM1)) & THRM1_TIV){ /* is valid? */ | ||
155 | - if(thrm & THRM1_TIN){ /* crossed low threshold */ | ||
156 | - if (tau[cpu].low >= step_size){ | ||
157 | - tau[cpu].low -= step_size; | ||
158 | - tau[cpu].high -= (step_size - window_expand); | ||
159 | - } | ||
160 | - tau[cpu].grew = 1; | ||
161 | -#ifdef DEBUG | ||
162 | - printk("low threshold crossed "); | ||
163 | -#endif | ||
164 | + thrm = mfspr(SPRN_THRM1); | ||
165 | + if ((thrm & bits) == bits) { | ||
166 | + mtspr(SPRN_THRM1, 0); | ||
167 | + | ||
168 | + if (tau[cpu].low >= step_size) { | ||
169 | + tau[cpu].low -= step_size; | ||
170 | + tau[cpu].high -= (step_size - window_expand); | ||
171 | } | ||
172 | + tau[cpu].grew = 1; | ||
173 | + pr_debug("%s: low threshold crossed\n", __func__); | ||
174 | } | ||
175 | - if((thrm = mfspr(SPRN_THRM2)) & THRM1_TIV){ /* is valid? */ | ||
176 | - if(thrm & THRM1_TIN){ /* crossed high threshold */ | ||
177 | - if (tau[cpu].high <= 127-step_size){ | ||
178 | - tau[cpu].low += (step_size - window_expand); | ||
179 | - tau[cpu].high += step_size; | ||
180 | - } | ||
181 | - tau[cpu].grew = 1; | ||
182 | -#ifdef DEBUG | ||
183 | - printk("high threshold crossed "); | ||
184 | -#endif | ||
185 | + thrm = mfspr(SPRN_THRM2); | ||
186 | + if ((thrm & bits) == bits) { | ||
187 | + mtspr(SPRN_THRM2, 0); | ||
188 | + | ||
189 | + if (tau[cpu].high <= 127 - step_size) { | ||
190 | + tau[cpu].low += (step_size - window_expand); | ||
191 | + tau[cpu].high += step_size; | ||
192 | } | ||
193 | + tau[cpu].grew = 1; | ||
194 | + pr_debug("%s: high threshold crossed\n", __func__); | ||
195 | } | ||
196 | - | ||
197 | -#ifdef DEBUG | ||
198 | - printk("grew = %d\n", tau[cpu].grew); | ||
199 | -#endif | ||
200 | - | ||
201 | -#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */ | ||
202 | - set_thresholds(cpu); | ||
203 | -#endif | ||
204 | - | ||
205 | } | ||
206 | |||
207 | #ifdef CONFIG_TAU_INT | ||
208 | @@ -136,18 +120,18 @@ void TAUException(struct pt_regs * regs) | ||
209 | static void tau_timeout(void * info) | ||
210 | { | ||
211 | int cpu; | ||
212 | - unsigned long flags; | ||
213 | int size; | ||
214 | int shrink; | ||
215 | |||
216 | - /* disabling interrupts *should* be okay */ | ||
217 | - local_irq_save(flags); | ||
218 | cpu = smp_processor_id(); | ||
219 | |||
220 | #ifndef CONFIG_TAU_INT | ||
221 | TAUupdate(cpu); | ||
222 | #endif | ||
223 | |||
224 | + /* Stop thermal sensor comparisons and interrupts */ | ||
225 | + mtspr(SPRN_THRM3, 0); | ||
226 | + | ||
227 | size = tau[cpu].high - tau[cpu].low; | ||
228 | if (size > min_window && ! tau[cpu].grew) { | ||
229 | /* do an exponential shrink of half the amount currently over size */ | ||
230 | @@ -169,22 +153,12 @@ static void tau_timeout(void * info) | ||
231 | |||
232 | set_thresholds(cpu); | ||
233 | |||
234 | - /* | ||
235 | - * Do the enable every time, since otherwise a bunch of (relatively) | ||
236 | - * complex sleep code needs to be added. One mtspr every time | ||
237 | - * tau_timeout is called is probably not a big deal. | ||
238 | - * | ||
239 | - * Enable thermal sensor and set up sample interval timer | ||
240 | - * need 20 us to do the compare.. until a nice 'cpu_speed' function | ||
241 | - * call is implemented, just assume a 500 mhz clock. It doesn't really | ||
242 | - * matter if we take too long for a compare since it's all interrupt | ||
243 | - * driven anyway. | ||
244 | - * | ||
245 | - * use a extra long time.. (60 us @ 500 mhz) | ||
246 | + /* Restart thermal sensor comparisons and interrupts. | ||
247 | + * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet" | ||
248 | + * recommends that "the maximum value be set in THRM3 under all | ||
249 | + * conditions." | ||
250 | */ | ||
251 | - mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E); | ||
252 | - | ||
253 | - local_irq_restore(flags); | ||
254 | + mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E); | ||
255 | } | ||
256 | |||
257 | static void tau_timeout_smp(unsigned long unused) | ||
258 | diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h | ||
259 | index acd17648cd188..5ea24d16a74a1 100644 | ||
260 | --- a/arch/powerpc/perf/hv-gpci-requests.h | ||
261 | +++ b/arch/powerpc/perf/hv-gpci-requests.h | ||
262 | @@ -94,7 +94,7 @@ REQUEST(__field(0, 8, partition_id) | ||
263 | |||
264 | #define REQUEST_NAME system_performance_capabilities | ||
265 | #define REQUEST_NUM 0x40 | ||
266 | -#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" | ||
267 | +#define REQUEST_IDX_KIND "starting_index=0xffffffff" | ||
268 | #include I(REQUEST_BEGIN) | ||
269 | REQUEST(__field(0, 1, perf_collect_privileged) | ||
270 | __field(0x1, 1, capability_mask) | ||
271 | @@ -222,7 +222,7 @@ REQUEST(__field(0, 2, partition_id) | ||
272 | |||
273 | #define REQUEST_NAME system_hypervisor_times | ||
274 | #define REQUEST_NUM 0xF0 | ||
275 | -#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" | ||
276 | +#define REQUEST_IDX_KIND "starting_index=0xffffffff" | ||
277 | #include I(REQUEST_BEGIN) | ||
278 | REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors) | ||
279 | __count(0x8, 8, time_spent_processing_virtual_processor_timers) | ||
280 | @@ -233,7 +233,7 @@ REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors) | ||
281 | |||
282 | #define REQUEST_NAME system_tlbie_count_and_time | ||
283 | #define REQUEST_NUM 0xF4 | ||
284 | -#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" | ||
285 | +#define REQUEST_IDX_KIND "starting_index=0xffffffff" | ||
286 | #include I(REQUEST_BEGIN) | ||
287 | REQUEST(__count(0, 8, tlbie_instructions_issued) | ||
288 | /* | ||
289 | diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c | ||
290 | index 6143c99f3ec50..7592a6491a9a2 100644 | ||
291 | --- a/arch/powerpc/perf/isa207-common.c | ||
292 | +++ b/arch/powerpc/perf/isa207-common.c | ||
293 | @@ -51,6 +51,15 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) | ||
294 | |||
295 | mask |= CNST_PMC_MASK(pmc); | ||
296 | value |= CNST_PMC_VAL(pmc); | ||
297 | + | ||
298 | + /* | ||
299 | + * PMC5 and PMC6 are used to count cycles and instructions and | ||
300 | + * they do not support most of the constraint bits. Add a check | ||
301 | + * to exclude PMC5/6 from most of the constraints except for | ||
302 | + * EBB/BHRB. | ||
303 | + */ | ||
304 | + if (pmc >= 5) | ||
305 | + goto ebb_bhrb; | ||
306 | } | ||
307 | |||
308 | if (pmc <= 4) { | ||
309 | @@ -111,6 +120,7 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) | ||
310 | value |= CNST_THRESH_VAL(event >> EVENT_THRESH_SHIFT); | ||
311 | } | ||
312 | |||
313 | +ebb_bhrb: | ||
314 | if (!pmc && ebb) | ||
315 | /* EBB events must specify the PMC */ | ||
316 | return -1; | ||
317 | diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig | ||
318 | index fbdae8377b714..a7ba4c61d8e93 100644 | ||
319 | --- a/arch/powerpc/platforms/Kconfig | ||
320 | +++ b/arch/powerpc/platforms/Kconfig | ||
321 | @@ -242,7 +242,7 @@ config TAU | ||
322 | temp is actually what /proc/cpuinfo says it is. | ||
323 | |||
324 | config TAU_INT | ||
325 | - bool "Interrupt driven TAU driver (DANGEROUS)" | ||
326 | + bool "Interrupt driven TAU driver (EXPERIMENTAL)" | ||
327 | depends on TAU | ||
328 | ---help--- | ||
329 | The TAU supports an interrupt driven mode which causes an interrupt | ||
330 | @@ -250,12 +250,7 @@ config TAU_INT | ||
331 | to get notified the temp has exceeded a range. With this option off, | ||
332 | a timer is used to re-check the temperature periodically. | ||
333 | |||
334 | - However, on some cpus it appears that the TAU interrupt hardware | ||
335 | - is buggy and can cause a situation which would lead unexplained hard | ||
336 | - lockups. | ||
337 | - | ||
338 | - Unless you are extending the TAU driver, or enjoy kernel/hardware | ||
339 | - debugging, leave this option off. | ||
340 | + If in doubt, say N here. | ||
341 | |||
342 | config TAU_AVERAGE | ||
343 | bool "Average high and low temp" | ||
344 | diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c | ||
345 | index 4c827826c05eb..e21e2c0af69d2 100644 | ||
346 | --- a/arch/powerpc/platforms/powernv/opal-dump.c | ||
347 | +++ b/arch/powerpc/platforms/powernv/opal-dump.c | ||
348 | @@ -319,15 +319,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj, | ||
349 | return count; | ||
350 | } | ||
351 | |||
352 | -static struct dump_obj *create_dump_obj(uint32_t id, size_t size, | ||
353 | - uint32_t type) | ||
354 | +static void create_dump_obj(uint32_t id, size_t size, uint32_t type) | ||
355 | { | ||
356 | struct dump_obj *dump; | ||
357 | int rc; | ||
358 | |||
359 | dump = kzalloc(sizeof(*dump), GFP_KERNEL); | ||
360 | if (!dump) | ||
361 | - return NULL; | ||
362 | + return; | ||
363 | |||
364 | dump->kobj.kset = dump_kset; | ||
365 | |||
366 | @@ -347,21 +346,39 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size, | ||
367 | rc = kobject_add(&dump->kobj, NULL, "0x%x-0x%x", type, id); | ||
368 | if (rc) { | ||
369 | kobject_put(&dump->kobj); | ||
370 | - return NULL; | ||
371 | + return; | ||
372 | } | ||
373 | |||
374 | + /* | ||
375 | + * As soon as the sysfs file for this dump is created/activated there is | ||
376 | + * a chance the opal_errd daemon (or any userspace) might read and | ||
377 | + * acknowledge the dump before kobject_uevent() is called. If that | ||
378 | + * happens then there is a potential race between | ||
379 | + * dump_ack_store->kobject_put() and kobject_uevent() which leads to a | ||
380 | + * use-after-free of a kernfs object resulting in a kernel crash. | ||
381 | + * | ||
382 | + * To avoid that, we need to take a reference on behalf of the bin file, | ||
383 | + * so that our reference remains valid while we call kobject_uevent(). | ||
384 | + * We then drop our reference before exiting the function, leaving the | ||
385 | + * bin file to drop the last reference (if it hasn't already). | ||
386 | + */ | ||
387 | + | ||
388 | + /* Take a reference for the bin file */ | ||
389 | + kobject_get(&dump->kobj); | ||
390 | rc = sysfs_create_bin_file(&dump->kobj, &dump->dump_attr); | ||
391 | - if (rc) { | ||
392 | + if (rc == 0) { | ||
393 | + kobject_uevent(&dump->kobj, KOBJ_ADD); | ||
394 | + | ||
395 | + pr_info("%s: New platform dump. ID = 0x%x Size %u\n", | ||
396 | + __func__, dump->id, dump->size); | ||
397 | + } else { | ||
398 | + /* Drop reference count taken for bin file */ | ||
399 | kobject_put(&dump->kobj); | ||
400 | - return NULL; | ||
401 | } | ||
402 | |||
403 | - pr_info("%s: New platform dump. ID = 0x%x Size %u\n", | ||
404 | - __func__, dump->id, dump->size); | ||
405 | - | ||
406 | - kobject_uevent(&dump->kobj, KOBJ_ADD); | ||
407 | - | ||
408 | - return dump; | ||
409 | + /* Drop our reference */ | ||
410 | + kobject_put(&dump->kobj); | ||
411 | + return; | ||
412 | } | ||
413 | |||
414 | static irqreturn_t process_dump(int irq, void *data) | ||
415 | diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c | ||
416 | index 31ca557af60bc..262b8c5e1b9d0 100644 | ||
417 | --- a/arch/powerpc/platforms/pseries/rng.c | ||
418 | +++ b/arch/powerpc/platforms/pseries/rng.c | ||
419 | @@ -40,6 +40,7 @@ static __init int rng_init(void) | ||
420 | |||
421 | ppc_md.get_random_seed = pseries_get_random_long; | ||
422 | |||
423 | + of_node_put(dn); | ||
424 | return 0; | ||
425 | } | ||
426 | machine_subsys_initcall(pseries, rng_init); | ||
427 | diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c | ||
428 | index e7fa26c4ff73e..d3a0322ee3276 100644 | ||
429 | --- a/arch/powerpc/sysdev/xics/icp-hv.c | ||
430 | +++ b/arch/powerpc/sysdev/xics/icp-hv.c | ||
431 | @@ -179,6 +179,7 @@ int icp_hv_init(void) | ||
432 | |||
433 | icp_ops = &icp_hv_ops; | ||
434 | |||
435 | + of_node_put(np); | ||
436 | return 0; | ||
437 | } | ||
438 | |||
439 | diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c | ||
440 | index da3cd734dee10..d455221d958fc 100644 | ||
441 | --- a/arch/x86/kvm/emulate.c | ||
442 | +++ b/arch/x86/kvm/emulate.c | ||
443 | @@ -3536,7 +3536,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt) | ||
444 | u64 tsc_aux = 0; | ||
445 | |||
446 | if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux)) | ||
447 | - return emulate_gp(ctxt, 0); | ||
448 | + return emulate_ud(ctxt); | ||
449 | ctxt->dst.val = tsc_aux; | ||
450 | return X86EMUL_CONTINUE; | ||
451 | } | ||
452 | diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c | ||
453 | index 73055b8e411f4..5cbc6591fa1d3 100644 | ||
454 | --- a/arch/x86/kvm/mmu.c | ||
455 | +++ b/arch/x86/kvm/mmu.c | ||
456 | @@ -5321,6 +5321,7 @@ static void kvm_recover_nx_lpages(struct kvm *kvm) | ||
457 | cond_resched_lock(&kvm->mmu_lock); | ||
458 | } | ||
459 | } | ||
460 | + kvm_mmu_commit_zap_page(kvm, &invalid_list); | ||
461 | |||
462 | spin_unlock(&kvm->mmu_lock); | ||
463 | srcu_read_unlock(&kvm->srcu, rcu_idx); | ||
464 | diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c | ||
465 | index d38f098350f65..ba818a738f9a5 100644 | ||
466 | --- a/crypto/algif_aead.c | ||
467 | +++ b/crypto/algif_aead.c | ||
468 | @@ -455,7 +455,7 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg, | ||
469 | memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm)); | ||
470 | aead_request_set_tfm(req, tfm); | ||
471 | aead_request_set_ad(req, ctx->aead_assoclen); | ||
472 | - aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, | ||
473 | + aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, | ||
474 | aead_async_cb, req); | ||
475 | used -= ctx->aead_assoclen; | ||
476 | |||
477 | @@ -925,7 +925,7 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) | ||
478 | ask->private = ctx; | ||
479 | |||
480 | aead_request_set_tfm(&ctx->aead_req, aead); | ||
481 | - aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG, | ||
482 | + aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, | ||
483 | af_alg_complete, &ctx->completion); | ||
484 | |||
485 | sk->sk_destruct = aead_sock_destruct; | ||
486 | diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c | ||
487 | index 90988e7a5b47f..2e7da9b379d48 100644 | ||
488 | --- a/drivers/clk/at91/clk-main.c | ||
489 | +++ b/drivers/clk/at91/clk-main.c | ||
490 | @@ -517,12 +517,17 @@ static int clk_sam9x5_main_set_parent(struct clk_hw *hw, u8 index) | ||
491 | return -EINVAL; | ||
492 | |||
493 | regmap_read(regmap, AT91_CKGR_MOR, &tmp); | ||
494 | - tmp &= ~MOR_KEY_MASK; | ||
495 | |||
496 | if (index && !(tmp & AT91_PMC_MOSCSEL)) | ||
497 | - regmap_write(regmap, AT91_CKGR_MOR, tmp | AT91_PMC_MOSCSEL); | ||
498 | + tmp = AT91_PMC_MOSCSEL; | ||
499 | else if (!index && (tmp & AT91_PMC_MOSCSEL)) | ||
500 | - regmap_write(regmap, AT91_CKGR_MOR, tmp & ~AT91_PMC_MOSCSEL); | ||
501 | + tmp = 0; | ||
502 | + else | ||
503 | + return 0; | ||
504 | + | ||
505 | + regmap_update_bits(regmap, AT91_CKGR_MOR, | ||
506 | + AT91_PMC_MOSCSEL | MOR_KEY_MASK, | ||
507 | + tmp | AT91_PMC_KEY); | ||
508 | |||
509 | while (!clk_sam9x5_main_ready(regmap)) | ||
510 | cpu_relax(); | ||
511 | diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c | ||
512 | index 2b5075298cdc0..3f16b553982d1 100644 | ||
513 | --- a/drivers/clk/bcm/clk-bcm2835.c | ||
514 | +++ b/drivers/clk/bcm/clk-bcm2835.c | ||
515 | @@ -1177,8 +1177,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman, | ||
516 | pll->hw.init = &init; | ||
517 | |||
518 | ret = devm_clk_hw_register(cprman->dev, &pll->hw); | ||
519 | - if (ret) | ||
520 | + if (ret) { | ||
521 | + kfree(pll); | ||
522 | return NULL; | ||
523 | + } | ||
524 | return &pll->hw; | ||
525 | } | ||
526 | |||
527 | diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c | ||
528 | index c3b05676e0dbe..8d18264794252 100644 | ||
529 | --- a/drivers/cpufreq/powernv-cpufreq.c | ||
530 | +++ b/drivers/cpufreq/powernv-cpufreq.c | ||
531 | @@ -784,12 +784,15 @@ static int powernv_cpufreq_reboot_notifier(struct notifier_block *nb, | ||
532 | unsigned long action, void *unused) | ||
533 | { | ||
534 | int cpu; | ||
535 | - struct cpufreq_policy cpu_policy; | ||
536 | + struct cpufreq_policy *cpu_policy; | ||
537 | |||
538 | rebooting = true; | ||
539 | for_each_online_cpu(cpu) { | ||
540 | - cpufreq_get_policy(&cpu_policy, cpu); | ||
541 | - powernv_cpufreq_target_index(&cpu_policy, get_nominal_index()); | ||
542 | + cpu_policy = cpufreq_cpu_get(cpu); | ||
543 | + if (!cpu_policy) | ||
544 | + continue; | ||
545 | + powernv_cpufreq_target_index(cpu_policy, get_nominal_index()); | ||
546 | + cpufreq_cpu_put(cpu_policy); | ||
547 | } | ||
548 | |||
549 | return NOTIFY_DONE; | ||
550 | diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c | ||
551 | index c3f13d6505e15..0aa18c1164bfb 100644 | ||
552 | --- a/drivers/crypto/ccp/ccp-ops.c | ||
553 | +++ b/drivers/crypto/ccp/ccp-ops.c | ||
554 | @@ -1195,7 +1195,7 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) | ||
555 | break; | ||
556 | default: | ||
557 | ret = -EINVAL; | ||
558 | - goto e_ctx; | ||
559 | + goto e_data; | ||
560 | } | ||
561 | } else { | ||
562 | /* Stash the context */ | ||
563 | diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c | ||
564 | index b54af97a20bb3..a54de1299e9ef 100644 | ||
565 | --- a/drivers/crypto/ixp4xx_crypto.c | ||
566 | +++ b/drivers/crypto/ixp4xx_crypto.c | ||
567 | @@ -532,7 +532,7 @@ static void release_ixp_crypto(struct device *dev) | ||
568 | |||
569 | if (crypt_virt) { | ||
570 | dma_free_coherent(dev, | ||
571 | - NPE_QLEN_TOTAL * sizeof( struct crypt_ctl), | ||
572 | + NPE_QLEN * sizeof(struct crypt_ctl), | ||
573 | crypt_virt, crypt_phys); | ||
574 | } | ||
575 | return; | ||
576 | diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c | ||
577 | index e7ca922a45e13..4adcf89add252 100644 | ||
578 | --- a/drivers/crypto/omap-sham.c | ||
579 | +++ b/drivers/crypto/omap-sham.c | ||
580 | @@ -454,6 +454,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length, | ||
581 | struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req); | ||
582 | u32 val, mask; | ||
583 | |||
584 | + if (likely(ctx->digcnt)) | ||
585 | + omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt); | ||
586 | + | ||
587 | /* | ||
588 | * Setting ALGO_CONST only for the first iteration and | ||
589 | * CLOSE_HASH only for the last one. Note that flags mode bits | ||
590 | diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c | ||
591 | index c655162caf08f..599038edd90d3 100644 | ||
592 | --- a/drivers/edac/i5100_edac.c | ||
593 | +++ b/drivers/edac/i5100_edac.c | ||
594 | @@ -1073,16 +1073,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) | ||
595 | PCI_DEVICE_ID_INTEL_5100_19, 0); | ||
596 | if (!einj) { | ||
597 | ret = -ENODEV; | ||
598 | - goto bail_einj; | ||
599 | + goto bail_mc_free; | ||
600 | } | ||
601 | |||
602 | rc = pci_enable_device(einj); | ||
603 | if (rc < 0) { | ||
604 | ret = rc; | ||
605 | - goto bail_disable_einj; | ||
606 | + goto bail_einj; | ||
607 | } | ||
608 | |||
609 | - | ||
610 | mci->pdev = &pdev->dev; | ||
611 | |||
612 | priv = mci->pvt_info; | ||
613 | @@ -1149,14 +1148,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) | ||
614 | bail_scrub: | ||
615 | priv->scrub_enable = 0; | ||
616 | cancel_delayed_work_sync(&(priv->i5100_scrubbing)); | ||
617 | - edac_mc_free(mci); | ||
618 | - | ||
619 | -bail_disable_einj: | ||
620 | pci_disable_device(einj); | ||
621 | |||
622 | bail_einj: | ||
623 | pci_dev_put(einj); | ||
624 | |||
625 | +bail_mc_free: | ||
626 | + edac_mc_free(mci); | ||
627 | + | ||
628 | bail_disable_ch1: | ||
629 | pci_disable_device(ch1mm); | ||
630 | |||
631 | diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c | ||
632 | index c52f9adf5e04c..7ec4e3fbafd8c 100644 | ||
633 | --- a/drivers/gpu/drm/gma500/cdv_intel_dp.c | ||
634 | +++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c | ||
635 | @@ -2121,7 +2121,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev | ||
636 | intel_dp->dpcd, | ||
637 | sizeof(intel_dp->dpcd)); | ||
638 | cdv_intel_edp_panel_vdd_off(gma_encoder); | ||
639 | - if (ret == 0) { | ||
640 | + if (ret <= 0) { | ||
641 | /* if this fails, presume the device is a ghost */ | ||
642 | DRM_INFO("failed to retrieve link info, disabling eDP\n"); | ||
643 | cdv_intel_dp_encoder_destroy(encoder); | ||
644 | diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c | ||
645 | index 036b0fbae0fb7..ba7855da7c7f6 100644 | ||
646 | --- a/drivers/gpu/drm/virtio/virtgpu_kms.c | ||
647 | +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c | ||
648 | @@ -113,8 +113,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev, | ||
649 | vgdev->capsets[i].id > 0, 5 * HZ); | ||
650 | if (ret == 0) { | ||
651 | DRM_ERROR("timed out waiting for cap set %d\n", i); | ||
652 | + spin_lock(&vgdev->display_info_lock); | ||
653 | kfree(vgdev->capsets); | ||
654 | vgdev->capsets = NULL; | ||
655 | + spin_unlock(&vgdev->display_info_lock); | ||
656 | return; | ||
657 | } | ||
658 | DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n", | ||
659 | diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c | ||
660 | index 772a5a3b0ce1a..18e8fcad6690b 100644 | ||
661 | --- a/drivers/gpu/drm/virtio/virtgpu_vq.c | ||
662 | +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c | ||
663 | @@ -596,9 +596,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev, | ||
664 | int i = le32_to_cpu(cmd->capset_index); | ||
665 | |||
666 | spin_lock(&vgdev->display_info_lock); | ||
667 | - vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); | ||
668 | - vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); | ||
669 | - vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); | ||
670 | + if (vgdev->capsets) { | ||
671 | + vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); | ||
672 | + vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); | ||
673 | + vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); | ||
674 | + } else { | ||
675 | + DRM_ERROR("invalid capset memory."); | ||
676 | + } | ||
677 | spin_unlock(&vgdev->display_info_lock); | ||
678 | wake_up(&vgdev->resp_wq); | ||
679 | } | ||
680 | diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c | ||
681 | index bf4675a273965..9be8c31f613fd 100644 | ||
682 | --- a/drivers/hid/hid-roccat-kone.c | ||
683 | +++ b/drivers/hid/hid-roccat-kone.c | ||
684 | @@ -297,31 +297,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj, | ||
685 | struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev)); | ||
686 | struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev)); | ||
687 | int retval = 0, difference, old_profile; | ||
688 | + struct kone_settings *settings = (struct kone_settings *)buf; | ||
689 | |||
690 | /* I need to get my data in one piece */ | ||
691 | if (off != 0 || count != sizeof(struct kone_settings)) | ||
692 | return -EINVAL; | ||
693 | |||
694 | mutex_lock(&kone->kone_lock); | ||
695 | - difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings)); | ||
696 | + difference = memcmp(settings, &kone->settings, | ||
697 | + sizeof(struct kone_settings)); | ||
698 | if (difference) { | ||
699 | - retval = kone_set_settings(usb_dev, | ||
700 | - (struct kone_settings const *)buf); | ||
701 | - if (retval) { | ||
702 | - mutex_unlock(&kone->kone_lock); | ||
703 | - return retval; | ||
704 | + if (settings->startup_profile < 1 || | ||
705 | + settings->startup_profile > 5) { | ||
706 | + retval = -EINVAL; | ||
707 | + goto unlock; | ||
708 | } | ||
709 | |||
710 | + retval = kone_set_settings(usb_dev, settings); | ||
711 | + if (retval) | ||
712 | + goto unlock; | ||
713 | + | ||
714 | old_profile = kone->settings.startup_profile; | ||
715 | - memcpy(&kone->settings, buf, sizeof(struct kone_settings)); | ||
716 | + memcpy(&kone->settings, settings, sizeof(struct kone_settings)); | ||
717 | |||
718 | kone_profile_activated(kone, kone->settings.startup_profile); | ||
719 | |||
720 | if (kone->settings.startup_profile != old_profile) | ||
721 | kone_profile_report(kone, kone->settings.startup_profile); | ||
722 | } | ||
723 | +unlock: | ||
724 | mutex_unlock(&kone->kone_lock); | ||
725 | |||
726 | + if (retval) | ||
727 | + return retval; | ||
728 | + | ||
729 | return sizeof(struct kone_settings); | ||
730 | } | ||
731 | static BIN_ATTR(settings, 0660, kone_sysfs_read_settings, | ||
732 | diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c | ||
733 | index 20ec34761b39b..29cd059c01f1c 100644 | ||
734 | --- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c | ||
735 | +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c | ||
736 | @@ -231,7 +231,6 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, | ||
737 | ps_opcode = HNS_ROCE_WQE_OPCODE_SEND; | ||
738 | break; | ||
739 | case IB_WR_LOCAL_INV: | ||
740 | - break; | ||
741 | case IB_WR_ATOMIC_CMP_AND_SWP: | ||
742 | case IB_WR_ATOMIC_FETCH_AND_ADD: | ||
743 | case IB_WR_LSO: | ||
744 | diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c | ||
745 | index 5dc920fe13269..c8c586c78d071 100644 | ||
746 | --- a/drivers/infiniband/hw/mlx4/cm.c | ||
747 | +++ b/drivers/infiniband/hw/mlx4/cm.c | ||
748 | @@ -309,6 +309,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id) | ||
749 | if (!sriov->is_going_down) { | ||
750 | id->scheduled_delete = 1; | ||
751 | schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT); | ||
752 | + } else if (id->scheduled_delete) { | ||
753 | + /* Adjust timeout if already scheduled */ | ||
754 | + mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT); | ||
755 | } | ||
756 | spin_unlock_irqrestore(&sriov->going_down_lock, flags); | ||
757 | spin_unlock(&sriov->id_map_lock); | ||
758 | diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c | ||
759 | index f32ffd74ec476..bf4e0d7a3ec21 100644 | ||
760 | --- a/drivers/infiniband/hw/mlx4/mad.c | ||
761 | +++ b/drivers/infiniband/hw/mlx4/mad.c | ||
762 | @@ -1276,6 +1276,18 @@ static void mlx4_ib_tunnel_comp_handler(struct ib_cq *cq, void *arg) | ||
763 | spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); | ||
764 | } | ||
765 | |||
766 | +static void mlx4_ib_wire_comp_handler(struct ib_cq *cq, void *arg) | ||
767 | +{ | ||
768 | + unsigned long flags; | ||
769 | + struct mlx4_ib_demux_pv_ctx *ctx = cq->cq_context; | ||
770 | + struct mlx4_ib_dev *dev = to_mdev(ctx->ib_dev); | ||
771 | + | ||
772 | + spin_lock_irqsave(&dev->sriov.going_down_lock, flags); | ||
773 | + if (!dev->sriov.is_going_down && ctx->state == DEMUX_PV_STATE_ACTIVE) | ||
774 | + queue_work(ctx->wi_wq, &ctx->work); | ||
775 | + spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); | ||
776 | +} | ||
777 | + | ||
778 | static int mlx4_ib_post_pv_qp_buf(struct mlx4_ib_demux_pv_ctx *ctx, | ||
779 | struct mlx4_ib_demux_pv_qp *tun_qp, | ||
780 | int index) | ||
781 | @@ -1978,7 +1990,8 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, | ||
782 | cq_size *= 2; | ||
783 | |||
784 | cq_attr.cqe = cq_size; | ||
785 | - ctx->cq = ib_create_cq(ctx->ib_dev, mlx4_ib_tunnel_comp_handler, | ||
786 | + ctx->cq = ib_create_cq(ctx->ib_dev, | ||
787 | + create_tun ? mlx4_ib_tunnel_comp_handler : mlx4_ib_wire_comp_handler, | ||
788 | NULL, ctx, &cq_attr); | ||
789 | if (IS_ERR(ctx->cq)) { | ||
790 | ret = PTR_ERR(ctx->cq); | ||
791 | @@ -2015,6 +2028,7 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, | ||
792 | INIT_WORK(&ctx->work, mlx4_ib_sqp_comp_worker); | ||
793 | |||
794 | ctx->wq = to_mdev(ibdev)->sriov.demux[port - 1].wq; | ||
795 | + ctx->wi_wq = to_mdev(ibdev)->sriov.demux[port - 1].wi_wq; | ||
796 | |||
797 | ret = ib_req_notify_cq(ctx->cq, IB_CQ_NEXT_COMP); | ||
798 | if (ret) { | ||
799 | @@ -2158,7 +2172,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, | ||
800 | goto err_mcg; | ||
801 | } | ||
802 | |||
803 | - snprintf(name, sizeof name, "mlx4_ibt%d", port); | ||
804 | + snprintf(name, sizeof(name), "mlx4_ibt%d", port); | ||
805 | ctx->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); | ||
806 | if (!ctx->wq) { | ||
807 | pr_err("Failed to create tunnelling WQ for port %d\n", port); | ||
808 | @@ -2166,7 +2180,15 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, | ||
809 | goto err_wq; | ||
810 | } | ||
811 | |||
812 | - snprintf(name, sizeof name, "mlx4_ibud%d", port); | ||
813 | + snprintf(name, sizeof(name), "mlx4_ibwi%d", port); | ||
814 | + ctx->wi_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); | ||
815 | + if (!ctx->wi_wq) { | ||
816 | + pr_err("Failed to create wire WQ for port %d\n", port); | ||
817 | + ret = -ENOMEM; | ||
818 | + goto err_wiwq; | ||
819 | + } | ||
820 | + | ||
821 | + snprintf(name, sizeof(name), "mlx4_ibud%d", port); | ||
822 | ctx->ud_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); | ||
823 | if (!ctx->ud_wq) { | ||
824 | pr_err("Failed to create up/down WQ for port %d\n", port); | ||
825 | @@ -2177,6 +2199,10 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, | ||
826 | return 0; | ||
827 | |||
828 | err_udwq: | ||
829 | + destroy_workqueue(ctx->wi_wq); | ||
830 | + ctx->wi_wq = NULL; | ||
831 | + | ||
832 | +err_wiwq: | ||
833 | destroy_workqueue(ctx->wq); | ||
834 | ctx->wq = NULL; | ||
835 | |||
836 | @@ -2224,12 +2250,14 @@ static void mlx4_ib_free_demux_ctx(struct mlx4_ib_demux_ctx *ctx) | ||
837 | ctx->tun[i]->state = DEMUX_PV_STATE_DOWNING; | ||
838 | } | ||
839 | flush_workqueue(ctx->wq); | ||
840 | + flush_workqueue(ctx->wi_wq); | ||
841 | for (i = 0; i < dev->dev->caps.sqp_demux; i++) { | ||
842 | destroy_pv_resources(dev, i, ctx->port, ctx->tun[i], 0); | ||
843 | free_pv_object(dev, i, ctx->port); | ||
844 | } | ||
845 | kfree(ctx->tun); | ||
846 | destroy_workqueue(ctx->ud_wq); | ||
847 | + destroy_workqueue(ctx->wi_wq); | ||
848 | destroy_workqueue(ctx->wq); | ||
849 | } | ||
850 | } | ||
851 | diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h | ||
852 | index 35141f451e5c7..91c89ef6ce04f 100644 | ||
853 | --- a/drivers/infiniband/hw/mlx4/mlx4_ib.h | ||
854 | +++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h | ||
855 | @@ -439,6 +439,7 @@ struct mlx4_ib_demux_pv_ctx { | ||
856 | struct ib_pd *pd; | ||
857 | struct work_struct work; | ||
858 | struct workqueue_struct *wq; | ||
859 | + struct workqueue_struct *wi_wq; | ||
860 | struct mlx4_ib_demux_pv_qp qp[2]; | ||
861 | }; | ||
862 | |||
863 | @@ -446,6 +447,7 @@ struct mlx4_ib_demux_ctx { | ||
864 | struct ib_device *ib_dev; | ||
865 | int port; | ||
866 | struct workqueue_struct *wq; | ||
867 | + struct workqueue_struct *wi_wq; | ||
868 | struct workqueue_struct *ud_wq; | ||
869 | spinlock_t ud_lock; | ||
870 | atomic64_t subnet_prefix; | ||
871 | diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c | ||
872 | index f937873e93dfc..b95f1457c407d 100644 | ||
873 | --- a/drivers/infiniband/hw/qedr/main.c | ||
874 | +++ b/drivers/infiniband/hw/qedr/main.c | ||
875 | @@ -527,7 +527,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev) | ||
876 | qed_attr = dev->ops->rdma_query_device(dev->rdma_ctx); | ||
877 | |||
878 | /* Part 2 - check capabilities */ | ||
879 | - page_size = ~dev->attr.page_size_caps + 1; | ||
880 | + page_size = ~qed_attr->page_size_caps + 1; | ||
881 | if (page_size > PAGE_SIZE) { | ||
882 | DP_ERR(dev, | ||
883 | "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n", | ||
884 | diff --git a/drivers/infiniband/sw/rdmavt/vt.c b/drivers/infiniband/sw/rdmavt/vt.c | ||
885 | index d430c2f7cec4c..1a1d7329fbb20 100644 | ||
886 | --- a/drivers/infiniband/sw/rdmavt/vt.c | ||
887 | +++ b/drivers/infiniband/sw/rdmavt/vt.c | ||
888 | @@ -96,9 +96,7 @@ struct rvt_dev_info *rvt_alloc_device(size_t size, int nports) | ||
889 | if (!rdi) | ||
890 | return rdi; | ||
891 | |||
892 | - rdi->ports = kcalloc(nports, | ||
893 | - sizeof(struct rvt_ibport **), | ||
894 | - GFP_KERNEL); | ||
895 | + rdi->ports = kcalloc(nports, sizeof(*rdi->ports), GFP_KERNEL); | ||
896 | if (!rdi->ports) | ||
897 | ib_dealloc_device(&rdi->ibdev); | ||
898 | |||
899 | diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c | ||
900 | index f77b295e0123e..01788a78041b3 100644 | ||
901 | --- a/drivers/input/keyboard/ep93xx_keypad.c | ||
902 | +++ b/drivers/input/keyboard/ep93xx_keypad.c | ||
903 | @@ -257,8 +257,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev) | ||
904 | } | ||
905 | |||
906 | keypad->irq = platform_get_irq(pdev, 0); | ||
907 | - if (!keypad->irq) { | ||
908 | - err = -ENXIO; | ||
909 | + if (keypad->irq < 0) { | ||
910 | + err = keypad->irq; | ||
911 | goto failed_free; | ||
912 | } | ||
913 | |||
914 | diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c | ||
915 | index 3d2c60c8de830..c6a468dfdfb48 100644 | ||
916 | --- a/drivers/input/keyboard/omap4-keypad.c | ||
917 | +++ b/drivers/input/keyboard/omap4-keypad.c | ||
918 | @@ -253,10 +253,8 @@ static int omap4_keypad_probe(struct platform_device *pdev) | ||
919 | } | ||
920 | |||
921 | irq = platform_get_irq(pdev, 0); | ||
922 | - if (!irq) { | ||
923 | - dev_err(&pdev->dev, "no keyboard irq assigned\n"); | ||
924 | - return -EINVAL; | ||
925 | - } | ||
926 | + if (irq < 0) | ||
927 | + return irq; | ||
928 | |||
929 | keypad_data = kzalloc(sizeof(struct omap4_keypad), GFP_KERNEL); | ||
930 | if (!keypad_data) { | ||
931 | diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c | ||
932 | index 323a0fb575a44..d87e7cd11ecb6 100644 | ||
933 | --- a/drivers/input/keyboard/twl4030_keypad.c | ||
934 | +++ b/drivers/input/keyboard/twl4030_keypad.c | ||
935 | @@ -63,7 +63,7 @@ struct twl4030_keypad { | ||
936 | bool autorepeat; | ||
937 | unsigned int n_rows; | ||
938 | unsigned int n_cols; | ||
939 | - unsigned int irq; | ||
940 | + int irq; | ||
941 | |||
942 | struct device *dbg_dev; | ||
943 | struct input_dev *input; | ||
944 | @@ -389,10 +389,8 @@ static int twl4030_kp_probe(struct platform_device *pdev) | ||
945 | } | ||
946 | |||
947 | kp->irq = platform_get_irq(pdev, 0); | ||
948 | - if (!kp->irq) { | ||
949 | - dev_err(&pdev->dev, "no keyboard irq assigned\n"); | ||
950 | - return -EINVAL; | ||
951 | - } | ||
952 | + if (kp->irq < 0) | ||
953 | + return kp->irq; | ||
954 | |||
955 | error = matrix_keypad_build_keymap(keymap_data, NULL, | ||
956 | TWL4030_MAX_ROWS, | ||
957 | diff --git a/drivers/input/serio/sun4i-ps2.c b/drivers/input/serio/sun4i-ps2.c | ||
958 | index 04b96fe393397..46512b4d686a8 100644 | ||
959 | --- a/drivers/input/serio/sun4i-ps2.c | ||
960 | +++ b/drivers/input/serio/sun4i-ps2.c | ||
961 | @@ -210,7 +210,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev) | ||
962 | struct sun4i_ps2data *drvdata; | ||
963 | struct serio *serio; | ||
964 | struct device *dev = &pdev->dev; | ||
965 | - unsigned int irq; | ||
966 | int error; | ||
967 | |||
968 | drvdata = kzalloc(sizeof(struct sun4i_ps2data), GFP_KERNEL); | ||
969 | @@ -263,14 +262,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev) | ||
970 | writel(0, drvdata->reg_base + PS2_REG_GCTL); | ||
971 | |||
972 | /* Get IRQ for the device */ | ||
973 | - irq = platform_get_irq(pdev, 0); | ||
974 | - if (!irq) { | ||
975 | - dev_err(dev, "no IRQ found\n"); | ||
976 | - error = -ENXIO; | ||
977 | + drvdata->irq = platform_get_irq(pdev, 0); | ||
978 | + if (drvdata->irq < 0) { | ||
979 | + error = drvdata->irq; | ||
980 | goto err_disable_clk; | ||
981 | } | ||
982 | |||
983 | - drvdata->irq = irq; | ||
984 | drvdata->serio = serio; | ||
985 | drvdata->dev = dev; | ||
986 | |||
987 | diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c | ||
988 | index 8275267eac254..4be7ddc04af0f 100644 | ||
989 | --- a/drivers/input/touchscreen/imx6ul_tsc.c | ||
990 | +++ b/drivers/input/touchscreen/imx6ul_tsc.c | ||
991 | @@ -490,20 +490,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev) | ||
992 | |||
993 | mutex_lock(&input_dev->mutex); | ||
994 | |||
995 | - if (input_dev->users) { | ||
996 | - retval = clk_prepare_enable(tsc->adc_clk); | ||
997 | - if (retval) | ||
998 | - goto out; | ||
999 | - | ||
1000 | - retval = clk_prepare_enable(tsc->tsc_clk); | ||
1001 | - if (retval) { | ||
1002 | - clk_disable_unprepare(tsc->adc_clk); | ||
1003 | - goto out; | ||
1004 | - } | ||
1005 | + if (!input_dev->users) | ||
1006 | + goto out; | ||
1007 | |||
1008 | - retval = imx6ul_tsc_init(tsc); | ||
1009 | + retval = clk_prepare_enable(tsc->adc_clk); | ||
1010 | + if (retval) | ||
1011 | + goto out; | ||
1012 | + | ||
1013 | + retval = clk_prepare_enable(tsc->tsc_clk); | ||
1014 | + if (retval) { | ||
1015 | + clk_disable_unprepare(tsc->adc_clk); | ||
1016 | + goto out; | ||
1017 | } | ||
1018 | |||
1019 | + retval = imx6ul_tsc_init(tsc); | ||
1020 | + if (retval) { | ||
1021 | + clk_disable_unprepare(tsc->tsc_clk); | ||
1022 | + clk_disable_unprepare(tsc->adc_clk); | ||
1023 | + goto out; | ||
1024 | + } | ||
1025 | out: | ||
1026 | mutex_unlock(&input_dev->mutex); | ||
1027 | return retval; | ||
1028 | diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c | ||
1029 | index 5d634706a7eaa..382f290c3f4d5 100644 | ||
1030 | --- a/drivers/media/firewire/firedtv-fw.c | ||
1031 | +++ b/drivers/media/firewire/firedtv-fw.c | ||
1032 | @@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) | ||
1033 | |||
1034 | name_len = fw_csr_string(unit->directory, CSR_MODEL, | ||
1035 | name, sizeof(name)); | ||
1036 | - if (name_len < 0) | ||
1037 | - return name_len; | ||
1038 | + if (name_len < 0) { | ||
1039 | + err = name_len; | ||
1040 | + goto fail_free; | ||
1041 | + } | ||
1042 | for (i = ARRAY_SIZE(model_names); --i; ) | ||
1043 | if (strlen(model_names[i]) <= name_len && | ||
1044 | strncmp(name, model_names[i], name_len) == 0) | ||
1045 | diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c | ||
1046 | index acb804bceccbc..e1736777e6ccb 100644 | ||
1047 | --- a/drivers/media/i2c/m5mols/m5mols_core.c | ||
1048 | +++ b/drivers/media/i2c/m5mols/m5mols_core.c | ||
1049 | @@ -754,7 +754,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable) | ||
1050 | |||
1051 | ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies); | ||
1052 | if (ret) { | ||
1053 | - info->set_power(&client->dev, 0); | ||
1054 | + if (info->set_power) | ||
1055 | + info->set_power(&client->dev, 0); | ||
1056 | return ret; | ||
1057 | } | ||
1058 | |||
1059 | diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c | ||
1060 | index 7ebcb9473956e..3e47b432d0f4e 100644 | ||
1061 | --- a/drivers/media/i2c/tc358743.c | ||
1062 | +++ b/drivers/media/i2c/tc358743.c | ||
1063 | @@ -1321,7 +1321,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled) | ||
1064 | static irqreturn_t tc358743_irq_handler(int irq, void *dev_id) | ||
1065 | { | ||
1066 | struct tc358743_state *state = dev_id; | ||
1067 | - bool handled; | ||
1068 | + bool handled = false; | ||
1069 | |||
1070 | tc358743_isr(&state->sd, 0, &handled); | ||
1071 | |||
1072 | diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c | ||
1073 | index 97b91a9f9fa93..1d6173998a299 100644 | ||
1074 | --- a/drivers/media/pci/bt8xx/bttv-driver.c | ||
1075 | +++ b/drivers/media/pci/bt8xx/bttv-driver.c | ||
1076 | @@ -4059,11 +4059,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) | ||
1077 | btv->id = dev->device; | ||
1078 | if (pci_enable_device(dev)) { | ||
1079 | pr_warn("%d: Can't enable device\n", btv->c.nr); | ||
1080 | - return -EIO; | ||
1081 | + result = -EIO; | ||
1082 | + goto free_mem; | ||
1083 | } | ||
1084 | if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) { | ||
1085 | pr_warn("%d: No suitable DMA available\n", btv->c.nr); | ||
1086 | - return -EIO; | ||
1087 | + result = -EIO; | ||
1088 | + goto free_mem; | ||
1089 | } | ||
1090 | if (!request_mem_region(pci_resource_start(dev,0), | ||
1091 | pci_resource_len(dev,0), | ||
1092 | @@ -4071,7 +4073,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) | ||
1093 | pr_warn("%d: can't request iomem (0x%llx)\n", | ||
1094 | btv->c.nr, | ||
1095 | (unsigned long long)pci_resource_start(dev, 0)); | ||
1096 | - return -EBUSY; | ||
1097 | + result = -EBUSY; | ||
1098 | + goto free_mem; | ||
1099 | } | ||
1100 | pci_set_master(dev); | ||
1101 | pci_set_command(dev); | ||
1102 | @@ -4257,6 +4260,10 @@ fail0: | ||
1103 | release_mem_region(pci_resource_start(btv->c.pci,0), | ||
1104 | pci_resource_len(btv->c.pci,0)); | ||
1105 | pci_disable_device(btv->c.pci); | ||
1106 | + | ||
1107 | +free_mem: | ||
1108 | + bttvs[btv->c.nr] = NULL; | ||
1109 | + kfree(btv); | ||
1110 | return result; | ||
1111 | } | ||
1112 | |||
1113 | diff --git a/drivers/media/pci/saa7134/saa7134-tvaudio.c b/drivers/media/pci/saa7134/saa7134-tvaudio.c | ||
1114 | index 38f94b742e283..0b5d6f4994571 100644 | ||
1115 | --- a/drivers/media/pci/saa7134/saa7134-tvaudio.c | ||
1116 | +++ b/drivers/media/pci/saa7134/saa7134-tvaudio.c | ||
1117 | @@ -697,7 +697,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value) | ||
1118 | { | ||
1119 | int err; | ||
1120 | |||
1121 | - audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", reg << 2, value); | ||
1122 | + audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", | ||
1123 | + (reg << 2) & 0xffffffff, value); | ||
1124 | err = saa_dsp_wait_bit(dev,SAA7135_DSP_RWSTATE_WRR); | ||
1125 | if (err < 0) | ||
1126 | return err; | ||
1127 | diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c | ||
1128 | index 8efe9160ab346..dbc4f57f34a52 100644 | ||
1129 | --- a/drivers/media/platform/exynos4-is/fimc-isp.c | ||
1130 | +++ b/drivers/media/platform/exynos4-is/fimc-isp.c | ||
1131 | @@ -311,8 +311,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on) | ||
1132 | |||
1133 | if (on) { | ||
1134 | ret = pm_runtime_get_sync(&is->pdev->dev); | ||
1135 | - if (ret < 0) | ||
1136 | + if (ret < 0) { | ||
1137 | + pm_runtime_put(&is->pdev->dev); | ||
1138 | return ret; | ||
1139 | + } | ||
1140 | set_bit(IS_ST_PWR_ON, &is->state); | ||
1141 | |||
1142 | ret = fimc_is_start_firmware(is); | ||
1143 | diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c | ||
1144 | index b91abf1c4d43b..f1921e06ffe1b 100644 | ||
1145 | --- a/drivers/media/platform/exynos4-is/fimc-lite.c | ||
1146 | +++ b/drivers/media/platform/exynos4-is/fimc-lite.c | ||
1147 | @@ -480,7 +480,7 @@ static int fimc_lite_open(struct file *file) | ||
1148 | set_bit(ST_FLITE_IN_USE, &fimc->state); | ||
1149 | ret = pm_runtime_get_sync(&fimc->pdev->dev); | ||
1150 | if (ret < 0) | ||
1151 | - goto unlock; | ||
1152 | + goto err_pm; | ||
1153 | |||
1154 | ret = v4l2_fh_open(file); | ||
1155 | if (ret < 0) | ||
1156 | diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c | ||
1157 | index cdaf3a8e2555e..a1599659b88ba 100644 | ||
1158 | --- a/drivers/media/platform/exynos4-is/media-dev.c | ||
1159 | +++ b/drivers/media/platform/exynos4-is/media-dev.c | ||
1160 | @@ -477,8 +477,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd) | ||
1161 | return -ENXIO; | ||
1162 | |||
1163 | ret = pm_runtime_get_sync(fmd->pmf); | ||
1164 | - if (ret < 0) | ||
1165 | + if (ret < 0) { | ||
1166 | + pm_runtime_put(fmd->pmf); | ||
1167 | return ret; | ||
1168 | + } | ||
1169 | |||
1170 | fmd->num_sensors = 0; | ||
1171 | |||
1172 | @@ -1255,11 +1257,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) | ||
1173 | if (IS_ERR(pctl->state_default)) | ||
1174 | return PTR_ERR(pctl->state_default); | ||
1175 | |||
1176 | + /* PINCTRL_STATE_IDLE is optional */ | ||
1177 | pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, | ||
1178 | PINCTRL_STATE_IDLE); | ||
1179 | - if (IS_ERR(pctl->state_idle)) | ||
1180 | - return PTR_ERR(pctl->state_idle); | ||
1181 | - | ||
1182 | return 0; | ||
1183 | } | ||
1184 | |||
1185 | diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c | ||
1186 | index befd9fc0adc4a..dc87c9cfa52ff 100644 | ||
1187 | --- a/drivers/media/platform/exynos4-is/mipi-csis.c | ||
1188 | +++ b/drivers/media/platform/exynos4-is/mipi-csis.c | ||
1189 | @@ -513,8 +513,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable) | ||
1190 | if (enable) { | ||
1191 | s5pcsis_clear_counters(state); | ||
1192 | ret = pm_runtime_get_sync(&state->pdev->dev); | ||
1193 | - if (ret && ret != 1) | ||
1194 | + if (ret && ret != 1) { | ||
1195 | + pm_runtime_put_noidle(&state->pdev->dev); | ||
1196 | return ret; | ||
1197 | + } | ||
1198 | } | ||
1199 | |||
1200 | mutex_lock(&state->lock); | ||
1201 | diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c | ||
1202 | index ce651d3ca1b82..a56863b090144 100644 | ||
1203 | --- a/drivers/media/platform/omap3isp/isp.c | ||
1204 | +++ b/drivers/media/platform/omap3isp/isp.c | ||
1205 | @@ -2273,8 +2273,10 @@ static int isp_probe(struct platform_device *pdev) | ||
1206 | mem = platform_get_resource(pdev, IORESOURCE_MEM, i); | ||
1207 | isp->mmio_base[map_idx] = | ||
1208 | devm_ioremap_resource(isp->dev, mem); | ||
1209 | - if (IS_ERR(isp->mmio_base[map_idx])) | ||
1210 | - return PTR_ERR(isp->mmio_base[map_idx]); | ||
1211 | + if (IS_ERR(isp->mmio_base[map_idx])) { | ||
1212 | + ret = PTR_ERR(isp->mmio_base[map_idx]); | ||
1213 | + goto error; | ||
1214 | + } | ||
1215 | } | ||
1216 | |||
1217 | ret = isp_get_clocks(isp); | ||
1218 | diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c | ||
1219 | index 8e9c3bd36d03e..5b5722e65e9b9 100644 | ||
1220 | --- a/drivers/media/platform/rcar-fcp.c | ||
1221 | +++ b/drivers/media/platform/rcar-fcp.c | ||
1222 | @@ -107,8 +107,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp) | ||
1223 | return 0; | ||
1224 | |||
1225 | ret = pm_runtime_get_sync(fcp->dev); | ||
1226 | - if (ret < 0) | ||
1227 | + if (ret < 0) { | ||
1228 | + pm_runtime_put_noidle(fcp->dev); | ||
1229 | return ret; | ||
1230 | + } | ||
1231 | |||
1232 | return 0; | ||
1233 | } | ||
1234 | diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c | ||
1235 | index ec40019703132..560e1ff236508 100644 | ||
1236 | --- a/drivers/media/platform/s3c-camif/camif-core.c | ||
1237 | +++ b/drivers/media/platform/s3c-camif/camif-core.c | ||
1238 | @@ -476,7 +476,7 @@ static int s3c_camif_probe(struct platform_device *pdev) | ||
1239 | |||
1240 | ret = camif_media_dev_init(camif); | ||
1241 | if (ret < 0) | ||
1242 | - goto err_alloc; | ||
1243 | + goto err_pm; | ||
1244 | |||
1245 | ret = camif_register_sensor(camif); | ||
1246 | if (ret < 0) | ||
1247 | @@ -510,10 +510,9 @@ err_sens: | ||
1248 | media_device_unregister(&camif->media_dev); | ||
1249 | media_device_cleanup(&camif->media_dev); | ||
1250 | camif_unregister_media_entities(camif); | ||
1251 | -err_alloc: | ||
1252 | +err_pm: | ||
1253 | pm_runtime_put(dev); | ||
1254 | pm_runtime_disable(dev); | ||
1255 | -err_pm: | ||
1256 | camif_clk_put(camif); | ||
1257 | err_clk: | ||
1258 | s3c_camif_unregister_subdev(camif); | ||
1259 | diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c | ||
1260 | index d88c9ba401b5d..bec4278401b2a 100644 | ||
1261 | --- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c | ||
1262 | +++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c | ||
1263 | @@ -1366,7 +1366,7 @@ static int bdisp_probe(struct platform_device *pdev) | ||
1264 | ret = pm_runtime_get_sync(dev); | ||
1265 | if (ret < 0) { | ||
1266 | dev_err(dev, "failed to set PM\n"); | ||
1267 | - goto err_dbg; | ||
1268 | + goto err_pm; | ||
1269 | } | ||
1270 | |||
1271 | /* Filters */ | ||
1272 | @@ -1394,7 +1394,6 @@ err_filter: | ||
1273 | bdisp_hw_free_filters(bdisp->dev); | ||
1274 | err_pm: | ||
1275 | pm_runtime_put(dev); | ||
1276 | -err_dbg: | ||
1277 | bdisp_debugfs_remove(bdisp); | ||
1278 | err_v4l2: | ||
1279 | v4l2_device_unregister(&bdisp->v4l2_dev); | ||
1280 | diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c | ||
1281 | index cf2a8d8845367..c4d97fb80aaec 100644 | ||
1282 | --- a/drivers/media/platform/sti/hva/hva-hw.c | ||
1283 | +++ b/drivers/media/platform/sti/hva/hva-hw.c | ||
1284 | @@ -389,7 +389,7 @@ int hva_hw_probe(struct platform_device *pdev, struct hva_dev *hva) | ||
1285 | ret = pm_runtime_get_sync(dev); | ||
1286 | if (ret < 0) { | ||
1287 | dev_err(dev, "%s failed to set PM\n", HVA_PREFIX); | ||
1288 | - goto err_clk; | ||
1289 | + goto err_pm; | ||
1290 | } | ||
1291 | |||
1292 | /* check IP hardware version */ | ||
1293 | diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c | ||
1294 | index dbb4829acc438..360a2ad14ce42 100644 | ||
1295 | --- a/drivers/media/platform/ti-vpe/vpe.c | ||
1296 | +++ b/drivers/media/platform/ti-vpe/vpe.c | ||
1297 | @@ -2133,6 +2133,8 @@ static int vpe_runtime_get(struct platform_device *pdev) | ||
1298 | |||
1299 | r = pm_runtime_get_sync(&pdev->dev); | ||
1300 | WARN_ON(r < 0); | ||
1301 | + if (r) | ||
1302 | + pm_runtime_put_noidle(&pdev->dev); | ||
1303 | return r < 0 ? r : 0; | ||
1304 | } | ||
1305 | |||
1306 | diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c | ||
1307 | index 4ac1ff482a0b3..fcb1838d670d4 100644 | ||
1308 | --- a/drivers/media/platform/vsp1/vsp1_drv.c | ||
1309 | +++ b/drivers/media/platform/vsp1/vsp1_drv.c | ||
1310 | @@ -487,7 +487,12 @@ int vsp1_device_get(struct vsp1_device *vsp1) | ||
1311 | int ret; | ||
1312 | |||
1313 | ret = pm_runtime_get_sync(vsp1->dev); | ||
1314 | - return ret < 0 ? ret : 0; | ||
1315 | + if (ret < 0) { | ||
1316 | + pm_runtime_put_noidle(vsp1->dev); | ||
1317 | + return ret; | ||
1318 | + } | ||
1319 | + | ||
1320 | + return 0; | ||
1321 | } | ||
1322 | |||
1323 | /* | ||
1324 | @@ -727,12 +732,12 @@ static int vsp1_probe(struct platform_device *pdev) | ||
1325 | /* Configure device parameters based on the version register. */ | ||
1326 | pm_runtime_enable(&pdev->dev); | ||
1327 | |||
1328 | - ret = pm_runtime_get_sync(&pdev->dev); | ||
1329 | + ret = vsp1_device_get(vsp1); | ||
1330 | if (ret < 0) | ||
1331 | goto done; | ||
1332 | |||
1333 | vsp1->version = vsp1_read(vsp1, VI6_IP_VERSION); | ||
1334 | - pm_runtime_put_sync(&pdev->dev); | ||
1335 | + vsp1_device_put(vsp1); | ||
1336 | |||
1337 | for (i = 0; i < ARRAY_SIZE(vsp1_device_infos); ++i) { | ||
1338 | if ((vsp1->version & VI6_IP_VERSION_MODEL_MASK) == | ||
1339 | diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c | ||
1340 | index 9f5b59706741c..7f98db4bc0277 100644 | ||
1341 | --- a/drivers/media/rc/ati_remote.c | ||
1342 | +++ b/drivers/media/rc/ati_remote.c | ||
1343 | @@ -850,6 +850,10 @@ static int ati_remote_probe(struct usb_interface *interface, | ||
1344 | err("%s: endpoint_in message size==0? \n", __func__); | ||
1345 | return -ENODEV; | ||
1346 | } | ||
1347 | + if (!usb_endpoint_is_int_out(endpoint_out)) { | ||
1348 | + err("%s: Unexpected endpoint_out\n", __func__); | ||
1349 | + return -ENODEV; | ||
1350 | + } | ||
1351 | |||
1352 | ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL); | ||
1353 | rc_dev = rc_allocate_device(); | ||
1354 | diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c | ||
1355 | index 05eed4be25df2..5156c971c241c 100644 | ||
1356 | --- a/drivers/media/usb/uvc/uvc_v4l2.c | ||
1357 | +++ b/drivers/media/usb/uvc/uvc_v4l2.c | ||
1358 | @@ -257,11 +257,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, | ||
1359 | if (ret < 0) | ||
1360 | goto done; | ||
1361 | |||
1362 | + /* After the probe, update fmt with the values returned from | ||
1363 | + * negotiation with the device. | ||
1364 | + */ | ||
1365 | + for (i = 0; i < stream->nformats; ++i) { | ||
1366 | + if (probe->bFormatIndex == stream->format[i].index) { | ||
1367 | + format = &stream->format[i]; | ||
1368 | + break; | ||
1369 | + } | ||
1370 | + } | ||
1371 | + | ||
1372 | + if (i == stream->nformats) { | ||
1373 | + uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n", | ||
1374 | + probe->bFormatIndex); | ||
1375 | + return -EINVAL; | ||
1376 | + } | ||
1377 | + | ||
1378 | + for (i = 0; i < format->nframes; ++i) { | ||
1379 | + if (probe->bFrameIndex == format->frame[i].bFrameIndex) { | ||
1380 | + frame = &format->frame[i]; | ||
1381 | + break; | ||
1382 | + } | ||
1383 | + } | ||
1384 | + | ||
1385 | + if (i == format->nframes) { | ||
1386 | + uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n", | ||
1387 | + probe->bFrameIndex); | ||
1388 | + return -EINVAL; | ||
1389 | + } | ||
1390 | + | ||
1391 | fmt->fmt.pix.width = frame->wWidth; | ||
1392 | fmt->fmt.pix.height = frame->wHeight; | ||
1393 | fmt->fmt.pix.field = V4L2_FIELD_NONE; | ||
1394 | fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(format, frame); | ||
1395 | fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize; | ||
1396 | + fmt->fmt.pix.pixelformat = format->fcc; | ||
1397 | fmt->fmt.pix.colorspace = format->colorspace; | ||
1398 | fmt->fmt.pix.priv = 0; | ||
1399 | |||
1400 | diff --git a/drivers/memory/fsl-corenet-cf.c b/drivers/memory/fsl-corenet-cf.c | ||
1401 | index 662d050243bec..2fbf8d09af36b 100644 | ||
1402 | --- a/drivers/memory/fsl-corenet-cf.c | ||
1403 | +++ b/drivers/memory/fsl-corenet-cf.c | ||
1404 | @@ -215,10 +215,8 @@ static int ccf_probe(struct platform_device *pdev) | ||
1405 | dev_set_drvdata(&pdev->dev, ccf); | ||
1406 | |||
1407 | irq = platform_get_irq(pdev, 0); | ||
1408 | - if (!irq) { | ||
1409 | - dev_err(&pdev->dev, "%s: no irq\n", __func__); | ||
1410 | - return -ENXIO; | ||
1411 | - } | ||
1412 | + if (irq < 0) | ||
1413 | + return irq; | ||
1414 | |||
1415 | ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf); | ||
1416 | if (ret) { | ||
1417 | diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c | ||
1418 | index bf0fe0137dfed..a9d47c06f80f3 100644 | ||
1419 | --- a/drivers/memory/omap-gpmc.c | ||
1420 | +++ b/drivers/memory/omap-gpmc.c | ||
1421 | @@ -951,7 +951,7 @@ static int gpmc_cs_remap(int cs, u32 base) | ||
1422 | int ret; | ||
1423 | u32 old_base, size; | ||
1424 | |||
1425 | - if (cs > gpmc_cs_num) { | ||
1426 | + if (cs >= gpmc_cs_num) { | ||
1427 | pr_err("%s: requested chip-select is disabled\n", __func__); | ||
1428 | return -ENODEV; | ||
1429 | } | ||
1430 | @@ -986,7 +986,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base) | ||
1431 | struct resource *res = &gpmc->mem; | ||
1432 | int r = -1; | ||
1433 | |||
1434 | - if (cs > gpmc_cs_num) { | ||
1435 | + if (cs >= gpmc_cs_num) { | ||
1436 | pr_err("%s: requested chip-select is disabled\n", __func__); | ||
1437 | return -ENODEV; | ||
1438 | } | ||
1439 | diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c | ||
1440 | index 98029ee0959e3..be61f8606a045 100644 | ||
1441 | --- a/drivers/mfd/rtsx_pcr.c | ||
1442 | +++ b/drivers/mfd/rtsx_pcr.c | ||
1443 | @@ -1255,12 +1255,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, | ||
1444 | ret = mfd_add_devices(&pcidev->dev, pcr->id, rtsx_pcr_cells, | ||
1445 | ARRAY_SIZE(rtsx_pcr_cells), NULL, 0, NULL); | ||
1446 | if (ret < 0) | ||
1447 | - goto disable_irq; | ||
1448 | + goto free_slots; | ||
1449 | |||
1450 | schedule_delayed_work(&pcr->idle_work, msecs_to_jiffies(200)); | ||
1451 | |||
1452 | return 0; | ||
1453 | |||
1454 | +free_slots: | ||
1455 | + kfree(pcr->slots); | ||
1456 | disable_irq: | ||
1457 | free_irq(pcr->irq, (void *)pcr); | ||
1458 | disable_msi: | ||
1459 | diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c | ||
1460 | index 3270b8dbc9498..4ca245518a199 100644 | ||
1461 | --- a/drivers/mfd/sm501.c | ||
1462 | +++ b/drivers/mfd/sm501.c | ||
1463 | @@ -1425,8 +1425,14 @@ static int sm501_plat_probe(struct platform_device *dev) | ||
1464 | goto err_claim; | ||
1465 | } | ||
1466 | |||
1467 | - return sm501_init_dev(sm); | ||
1468 | + ret = sm501_init_dev(sm); | ||
1469 | + if (ret) | ||
1470 | + goto err_unmap; | ||
1471 | + | ||
1472 | + return 0; | ||
1473 | |||
1474 | + err_unmap: | ||
1475 | + iounmap(sm->regs); | ||
1476 | err_claim: | ||
1477 | release_resource(sm->regs_claim); | ||
1478 | kfree(sm->regs_claim); | ||
1479 | diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c | ||
1480 | index 5afe4cd165699..cd7e7e36907bc 100644 | ||
1481 | --- a/drivers/misc/eeprom/at25.c | ||
1482 | +++ b/drivers/misc/eeprom/at25.c | ||
1483 | @@ -355,7 +355,7 @@ static int at25_probe(struct spi_device *spi) | ||
1484 | at25->nvmem_config.reg_read = at25_ee_read; | ||
1485 | at25->nvmem_config.reg_write = at25_ee_write; | ||
1486 | at25->nvmem_config.priv = at25; | ||
1487 | - at25->nvmem_config.stride = 4; | ||
1488 | + at25->nvmem_config.stride = 1; | ||
1489 | at25->nvmem_config.word_size = 1; | ||
1490 | at25->nvmem_config.size = chip.byte_len; | ||
1491 | |||
1492 | diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c | ||
1493 | index 32ab0f43f5061..4e2cfb6eea353 100644 | ||
1494 | --- a/drivers/misc/mic/scif/scif_rma.c | ||
1495 | +++ b/drivers/misc/mic/scif/scif_rma.c | ||
1496 | @@ -1401,6 +1401,8 @@ retry: | ||
1497 | NULL); | ||
1498 | up_write(&mm->mmap_sem); | ||
1499 | if (nr_pages != pinned_pages->nr_pages) { | ||
1500 | + if (pinned_pages->nr_pages < 0) | ||
1501 | + pinned_pages->nr_pages = 0; | ||
1502 | if (try_upgrade) { | ||
1503 | if (ulimit) | ||
1504 | __scif_dec_pinned_vm_lock(mm, | ||
1505 | @@ -1421,7 +1423,6 @@ retry: | ||
1506 | |||
1507 | if (pinned_pages->nr_pages < nr_pages) { | ||
1508 | err = -EFAULT; | ||
1509 | - pinned_pages->nr_pages = nr_pages; | ||
1510 | goto dec_pinned; | ||
1511 | } | ||
1512 | |||
1513 | @@ -1434,7 +1435,6 @@ dec_pinned: | ||
1514 | __scif_dec_pinned_vm_lock(mm, nr_pages, 0); | ||
1515 | /* Something went wrong! Rollback */ | ||
1516 | error_unmap: | ||
1517 | - pinned_pages->nr_pages = nr_pages; | ||
1518 | scif_destroy_pinned_pages(pinned_pages); | ||
1519 | *pages = NULL; | ||
1520 | dev_dbg(scif_info.mdev.this_device, | ||
1521 | diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c | ||
1522 | index 1a2b67f3183d5..f9da3150f80a2 100644 | ||
1523 | --- a/drivers/misc/mic/vop/vop_main.c | ||
1524 | +++ b/drivers/misc/mic/vop/vop_main.c | ||
1525 | @@ -301,7 +301,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev, | ||
1526 | /* First assign the vring's allocated in host memory */ | ||
1527 | vqconfig = _vop_vq_config(vdev->desc) + index; | ||
1528 | memcpy_fromio(&config, vqconfig, sizeof(config)); | ||
1529 | - _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN); | ||
1530 | + _vr_size = round_up(vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN), 4); | ||
1531 | vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info)); | ||
1532 | va = vpdev->hw_ops->ioremap(vpdev, le64_to_cpu(config.address), | ||
1533 | vr_size); | ||
1534 | diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c | ||
1535 | index fed992e2c2583..49e7a7240469c 100644 | ||
1536 | --- a/drivers/misc/mic/vop/vop_vringh.c | ||
1537 | +++ b/drivers/misc/mic/vop/vop_vringh.c | ||
1538 | @@ -308,7 +308,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, | ||
1539 | |||
1540 | num = le16_to_cpu(vqconfig[i].num); | ||
1541 | mutex_init(&vvr->vr_mutex); | ||
1542 | - vr_size = PAGE_ALIGN(vring_size(num, MIC_VIRTIO_RING_ALIGN) + | ||
1543 | + vr_size = PAGE_ALIGN(round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4) + | ||
1544 | sizeof(struct _mic_vring_info)); | ||
1545 | vr->va = (void *) | ||
1546 | __get_free_pages(GFP_KERNEL | __GFP_ZERO, | ||
1547 | @@ -320,7 +320,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, | ||
1548 | goto err; | ||
1549 | } | ||
1550 | vr->len = vr_size; | ||
1551 | - vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN); | ||
1552 | + vr->info = vr->va + round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4); | ||
1553 | vr->info->magic = cpu_to_le32(MIC_MAGIC + vdev->virtio_id + i); | ||
1554 | vr_addr = dma_map_single(&vpdev->dev, vr->va, vr_size, | ||
1555 | DMA_BIDIRECTIONAL); | ||
1556 | @@ -611,6 +611,7 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf, | ||
1557 | size_t partlen; | ||
1558 | bool dma = VOP_USE_DMA; | ||
1559 | int err = 0; | ||
1560 | + size_t offset = 0; | ||
1561 | |||
1562 | if (daddr & (dma_alignment - 1)) { | ||
1563 | vdev->tx_dst_unaligned += len; | ||
1564 | @@ -659,13 +660,20 @@ memcpy: | ||
1565 | * We are copying to IO below and should ideally use something | ||
1566 | * like copy_from_user_toio(..) if it existed. | ||
1567 | */ | ||
1568 | - if (copy_from_user((void __force *)dbuf, ubuf, len)) { | ||
1569 | - err = -EFAULT; | ||
1570 | - dev_err(vop_dev(vdev), "%s %d err %d\n", | ||
1571 | - __func__, __LINE__, err); | ||
1572 | - goto err; | ||
1573 | + while (len) { | ||
1574 | + partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE); | ||
1575 | + | ||
1576 | + if (copy_from_user(vvr->buf, ubuf + offset, partlen)) { | ||
1577 | + err = -EFAULT; | ||
1578 | + dev_err(vop_dev(vdev), "%s %d err %d\n", | ||
1579 | + __func__, __LINE__, err); | ||
1580 | + goto err; | ||
1581 | + } | ||
1582 | + memcpy_toio(dbuf + offset, vvr->buf, partlen); | ||
1583 | + offset += partlen; | ||
1584 | + vdev->out_bytes += partlen; | ||
1585 | + len -= partlen; | ||
1586 | } | ||
1587 | - vdev->out_bytes += len; | ||
1588 | err = 0; | ||
1589 | err: | ||
1590 | vpdev->hw_ops->iounmap(vpdev, dbuf); | ||
1591 | diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c | ||
1592 | index 5927db046a87c..6ac3c59c9ae78 100644 | ||
1593 | --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c | ||
1594 | +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c | ||
1595 | @@ -758,8 +758,9 @@ static int qp_host_get_user_memory(u64 produce_uva, | ||
1596 | if (retval < (int)produce_q->kernel_if->num_pages) { | ||
1597 | pr_debug("get_user_pages_fast(produce) failed (retval=%d)", | ||
1598 | retval); | ||
1599 | - qp_release_pages(produce_q->kernel_if->u.h.header_page, | ||
1600 | - retval, false); | ||
1601 | + if (retval > 0) | ||
1602 | + qp_release_pages(produce_q->kernel_if->u.h.header_page, | ||
1603 | + retval, false); | ||
1604 | err = VMCI_ERROR_NO_MEM; | ||
1605 | goto out; | ||
1606 | } | ||
1607 | @@ -770,8 +771,9 @@ static int qp_host_get_user_memory(u64 produce_uva, | ||
1608 | if (retval < (int)consume_q->kernel_if->num_pages) { | ||
1609 | pr_debug("get_user_pages_fast(consume) failed (retval=%d)", | ||
1610 | retval); | ||
1611 | - qp_release_pages(consume_q->kernel_if->u.h.header_page, | ||
1612 | - retval, false); | ||
1613 | + if (retval > 0) | ||
1614 | + qp_release_pages(consume_q->kernel_if->u.h.header_page, | ||
1615 | + retval, false); | ||
1616 | qp_release_pages(produce_q->kernel_if->u.h.header_page, | ||
1617 | produce_q->kernel_if->num_pages, false); | ||
1618 | err = VMCI_ERROR_NO_MEM; | ||
1619 | diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c | ||
1620 | index dcb3dee59fa5f..934c4816d78bf 100644 | ||
1621 | --- a/drivers/mmc/core/sdio_cis.c | ||
1622 | +++ b/drivers/mmc/core/sdio_cis.c | ||
1623 | @@ -30,6 +30,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func, | ||
1624 | unsigned i, nr_strings; | ||
1625 | char **buffer, *string; | ||
1626 | |||
1627 | + if (size < 2) | ||
1628 | + return 0; | ||
1629 | + | ||
1630 | /* Find all null-terminated (including zero length) strings in | ||
1631 | the TPLLV1_INFO field. Trailing garbage is ignored. */ | ||
1632 | buf += 2; | ||
1633 | diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c | ||
1634 | index 2342277c9bcb0..5e36366d9b36d 100644 | ||
1635 | --- a/drivers/mtd/lpddr/lpddr2_nvm.c | ||
1636 | +++ b/drivers/mtd/lpddr/lpddr2_nvm.c | ||
1637 | @@ -408,6 +408,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add, | ||
1638 | return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK); | ||
1639 | } | ||
1640 | |||
1641 | +static const struct mtd_info lpddr2_nvm_mtd_info = { | ||
1642 | + .type = MTD_RAM, | ||
1643 | + .writesize = 1, | ||
1644 | + .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), | ||
1645 | + ._read = lpddr2_nvm_read, | ||
1646 | + ._write = lpddr2_nvm_write, | ||
1647 | + ._erase = lpddr2_nvm_erase, | ||
1648 | + ._unlock = lpddr2_nvm_unlock, | ||
1649 | + ._lock = lpddr2_nvm_lock, | ||
1650 | +}; | ||
1651 | + | ||
1652 | /* | ||
1653 | * lpddr2_nvm driver probe method | ||
1654 | */ | ||
1655 | @@ -448,6 +459,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) | ||
1656 | .pfow_base = OW_BASE_ADDRESS, | ||
1657 | .fldrv_priv = pcm_data, | ||
1658 | }; | ||
1659 | + | ||
1660 | if (IS_ERR(map->virt)) | ||
1661 | return PTR_ERR(map->virt); | ||
1662 | |||
1663 | @@ -459,22 +471,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) | ||
1664 | return PTR_ERR(pcm_data->ctl_regs); | ||
1665 | |||
1666 | /* Populate mtd_info data structure */ | ||
1667 | - *mtd = (struct mtd_info) { | ||
1668 | - .dev = { .parent = &pdev->dev }, | ||
1669 | - .name = pdev->dev.init_name, | ||
1670 | - .type = MTD_RAM, | ||
1671 | - .priv = map, | ||
1672 | - .size = resource_size(add_range), | ||
1673 | - .erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width, | ||
1674 | - .writesize = 1, | ||
1675 | - .writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width, | ||
1676 | - .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), | ||
1677 | - ._read = lpddr2_nvm_read, | ||
1678 | - ._write = lpddr2_nvm_write, | ||
1679 | - ._erase = lpddr2_nvm_erase, | ||
1680 | - ._unlock = lpddr2_nvm_unlock, | ||
1681 | - ._lock = lpddr2_nvm_lock, | ||
1682 | - }; | ||
1683 | + *mtd = lpddr2_nvm_mtd_info; | ||
1684 | + mtd->dev.parent = &pdev->dev; | ||
1685 | + mtd->name = pdev->dev.init_name; | ||
1686 | + mtd->priv = map; | ||
1687 | + mtd->size = resource_size(add_range); | ||
1688 | + mtd->erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width; | ||
1689 | + mtd->writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width; | ||
1690 | |||
1691 | /* Verify the presence of the device looking for PFOW string */ | ||
1692 | if (!lpddr2_nvm_pfow_present(map)) { | ||
1693 | diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c | ||
1694 | index 97bb8f6304d4f..09165eaac7a15 100644 | ||
1695 | --- a/drivers/mtd/mtdoops.c | ||
1696 | +++ b/drivers/mtd/mtdoops.c | ||
1697 | @@ -313,12 +313,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper, | ||
1698 | kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE, | ||
1699 | record_size - MTDOOPS_HEADER_SIZE, NULL); | ||
1700 | |||
1701 | - /* Panics must be written immediately */ | ||
1702 | - if (reason != KMSG_DUMP_OOPS) | ||
1703 | + if (reason != KMSG_DUMP_OOPS) { | ||
1704 | + /* Panics must be written immediately */ | ||
1705 | mtdoops_write(cxt, 1); | ||
1706 | - | ||
1707 | - /* For other cases, schedule work to write it "nicely" */ | ||
1708 | - schedule_work(&cxt->work_write); | ||
1709 | + } else { | ||
1710 | + /* For other cases, schedule work to write it "nicely" */ | ||
1711 | + schedule_work(&cxt->work_write); | ||
1712 | + } | ||
1713 | } | ||
1714 | |||
1715 | static void mtdoops_notify_add(struct mtd_info *mtd) | ||
1716 | diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h | ||
1717 | index 130f910e47854..b6ebcee40a0d4 100644 | ||
1718 | --- a/drivers/net/ethernet/cisco/enic/enic.h | ||
1719 | +++ b/drivers/net/ethernet/cisco/enic/enic.h | ||
1720 | @@ -163,6 +163,7 @@ struct enic { | ||
1721 | u16 num_vfs; | ||
1722 | #endif | ||
1723 | spinlock_t enic_api_lock; | ||
1724 | + bool enic_api_busy; | ||
1725 | struct enic_port_profile *pp; | ||
1726 | |||
1727 | /* work queue cache line section */ | ||
1728 | diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c | ||
1729 | index b161f24522b87..b028ea2dec2b9 100644 | ||
1730 | --- a/drivers/net/ethernet/cisco/enic/enic_api.c | ||
1731 | +++ b/drivers/net/ethernet/cisco/enic/enic_api.c | ||
1732 | @@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf, | ||
1733 | struct vnic_dev *vdev = enic->vdev; | ||
1734 | |||
1735 | spin_lock(&enic->enic_api_lock); | ||
1736 | + while (enic->enic_api_busy) { | ||
1737 | + spin_unlock(&enic->enic_api_lock); | ||
1738 | + cpu_relax(); | ||
1739 | + spin_lock(&enic->enic_api_lock); | ||
1740 | + } | ||
1741 | + | ||
1742 | spin_lock_bh(&enic->devcmd_lock); | ||
1743 | |||
1744 | vnic_dev_cmd_proxy_by_index_start(vdev, vf); | ||
1745 | diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c | ||
1746 | index 96290b83dfde9..3a3f3a7d7a75f 100644 | ||
1747 | --- a/drivers/net/ethernet/cisco/enic/enic_main.c | ||
1748 | +++ b/drivers/net/ethernet/cisco/enic/enic_main.c | ||
1749 | @@ -1938,8 +1938,6 @@ static int enic_dev_wait(struct vnic_dev *vdev, | ||
1750 | int done; | ||
1751 | int err; | ||
1752 | |||
1753 | - BUG_ON(in_interrupt()); | ||
1754 | - | ||
1755 | err = start(vdev, arg); | ||
1756 | if (err) | ||
1757 | return err; | ||
1758 | @@ -2116,6 +2114,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic) | ||
1759 | rss_hash_bits, rss_base_cpu, rss_enable); | ||
1760 | } | ||
1761 | |||
1762 | +static void enic_set_api_busy(struct enic *enic, bool busy) | ||
1763 | +{ | ||
1764 | + spin_lock(&enic->enic_api_lock); | ||
1765 | + enic->enic_api_busy = busy; | ||
1766 | + spin_unlock(&enic->enic_api_lock); | ||
1767 | +} | ||
1768 | + | ||
1769 | static void enic_reset(struct work_struct *work) | ||
1770 | { | ||
1771 | struct enic *enic = container_of(work, struct enic, reset); | ||
1772 | @@ -2125,7 +2130,9 @@ static void enic_reset(struct work_struct *work) | ||
1773 | |||
1774 | rtnl_lock(); | ||
1775 | |||
1776 | - spin_lock(&enic->enic_api_lock); | ||
1777 | + /* Stop any activity from infiniband */ | ||
1778 | + enic_set_api_busy(enic, true); | ||
1779 | + | ||
1780 | enic_stop(enic->netdev); | ||
1781 | enic_dev_soft_reset(enic); | ||
1782 | enic_reset_addr_lists(enic); | ||
1783 | @@ -2133,7 +2140,10 @@ static void enic_reset(struct work_struct *work) | ||
1784 | enic_set_rss_nic_cfg(enic); | ||
1785 | enic_dev_set_ig_vlan_rewrite_mode(enic); | ||
1786 | enic_open(enic->netdev); | ||
1787 | - spin_unlock(&enic->enic_api_lock); | ||
1788 | + | ||
1789 | + /* Allow infiniband to fiddle with the device again */ | ||
1790 | + enic_set_api_busy(enic, false); | ||
1791 | + | ||
1792 | call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); | ||
1793 | |||
1794 | rtnl_unlock(); | ||
1795 | @@ -2145,7 +2155,9 @@ static void enic_tx_hang_reset(struct work_struct *work) | ||
1796 | |||
1797 | rtnl_lock(); | ||
1798 | |||
1799 | - spin_lock(&enic->enic_api_lock); | ||
1800 | + /* Stop any activity from infiniband */ | ||
1801 | + enic_set_api_busy(enic, true); | ||
1802 | + | ||
1803 | enic_dev_hang_notify(enic); | ||
1804 | enic_stop(enic->netdev); | ||
1805 | enic_dev_hang_reset(enic); | ||
1806 | @@ -2154,7 +2166,10 @@ static void enic_tx_hang_reset(struct work_struct *work) | ||
1807 | enic_set_rss_nic_cfg(enic); | ||
1808 | enic_dev_set_ig_vlan_rewrite_mode(enic); | ||
1809 | enic_open(enic->netdev); | ||
1810 | - spin_unlock(&enic->enic_api_lock); | ||
1811 | + | ||
1812 | + /* Allow infiniband to fiddle with the device again */ | ||
1813 | + enic_set_api_busy(enic, false); | ||
1814 | + | ||
1815 | call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); | ||
1816 | |||
1817 | rtnl_unlock(); | ||
1818 | diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c | ||
1819 | index de9897c8e9331..f5fd20dc8ab19 100644 | ||
1820 | --- a/drivers/net/ethernet/ibm/ibmveth.c | ||
1821 | +++ b/drivers/net/ethernet/ibm/ibmveth.c | ||
1822 | @@ -1256,6 +1256,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) | ||
1823 | int offset = ibmveth_rxq_frame_offset(adapter); | ||
1824 | int csum_good = ibmveth_rxq_csum_good(adapter); | ||
1825 | int lrg_pkt = ibmveth_rxq_large_packet(adapter); | ||
1826 | + __sum16 iph_check = 0; | ||
1827 | |||
1828 | skb = ibmveth_rxq_get_buffer(adapter); | ||
1829 | |||
1830 | @@ -1307,7 +1308,17 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) | ||
1831 | } | ||
1832 | } | ||
1833 | |||
1834 | - if (length > netdev->mtu + ETH_HLEN) { | ||
1835 | + /* PHYP without PLSO support places a -1 in the ip | ||
1836 | + * checksum for large send frames. | ||
1837 | + */ | ||
1838 | + if (skb->protocol == cpu_to_be16(ETH_P_IP)) { | ||
1839 | + struct iphdr *iph = (struct iphdr *)skb->data; | ||
1840 | + | ||
1841 | + iph_check = iph->check; | ||
1842 | + } | ||
1843 | + | ||
1844 | + if ((length > netdev->mtu + ETH_HLEN) || | ||
1845 | + lrg_pkt || iph_check == 0xffff) { | ||
1846 | ibmveth_rx_mss_helper(skb, mss, lrg_pkt); | ||
1847 | adapter->rx_large_packets++; | ||
1848 | } | ||
1849 | diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c | ||
1850 | index c051987aab830..cd8895838a04c 100644 | ||
1851 | --- a/drivers/net/ethernet/korina.c | ||
1852 | +++ b/drivers/net/ethernet/korina.c | ||
1853 | @@ -1188,7 +1188,7 @@ out: | ||
1854 | return rc; | ||
1855 | |||
1856 | probe_err_register: | ||
1857 | - kfree(lp->td_ring); | ||
1858 | + kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring)); | ||
1859 | probe_err_td_ring: | ||
1860 | iounmap(lp->tx_dma_regs); | ||
1861 | probe_err_dma_tx: | ||
1862 | @@ -1208,6 +1208,7 @@ static int korina_remove(struct platform_device *pdev) | ||
1863 | iounmap(lp->eth_regs); | ||
1864 | iounmap(lp->rx_dma_regs); | ||
1865 | iounmap(lp->tx_dma_regs); | ||
1866 | + kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring)); | ||
1867 | |||
1868 | unregister_netdev(bif->dev); | ||
1869 | free_netdev(bif->dev); | ||
1870 | diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c | ||
1871 | index 7a4393ffe98e2..3521e3a77556d 100644 | ||
1872 | --- a/drivers/net/ethernet/realtek/r8169.c | ||
1873 | +++ b/drivers/net/ethernet/realtek/r8169.c | ||
1874 | @@ -4476,6 +4476,58 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr) | ||
1875 | rtl_unlock_work(tp); | ||
1876 | } | ||
1877 | |||
1878 | +static void rtl_init_rxcfg(struct rtl8169_private *tp) | ||
1879 | +{ | ||
1880 | + void __iomem *ioaddr = tp->mmio_addr; | ||
1881 | + | ||
1882 | + switch (tp->mac_version) { | ||
1883 | + case RTL_GIGA_MAC_VER_01: | ||
1884 | + case RTL_GIGA_MAC_VER_02: | ||
1885 | + case RTL_GIGA_MAC_VER_03: | ||
1886 | + case RTL_GIGA_MAC_VER_04: | ||
1887 | + case RTL_GIGA_MAC_VER_05: | ||
1888 | + case RTL_GIGA_MAC_VER_06: | ||
1889 | + case RTL_GIGA_MAC_VER_10: | ||
1890 | + case RTL_GIGA_MAC_VER_11: | ||
1891 | + case RTL_GIGA_MAC_VER_12: | ||
1892 | + case RTL_GIGA_MAC_VER_13: | ||
1893 | + case RTL_GIGA_MAC_VER_14: | ||
1894 | + case RTL_GIGA_MAC_VER_15: | ||
1895 | + case RTL_GIGA_MAC_VER_16: | ||
1896 | + case RTL_GIGA_MAC_VER_17: | ||
1897 | + RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST); | ||
1898 | + break; | ||
1899 | + case RTL_GIGA_MAC_VER_18: | ||
1900 | + case RTL_GIGA_MAC_VER_19: | ||
1901 | + case RTL_GIGA_MAC_VER_20: | ||
1902 | + case RTL_GIGA_MAC_VER_21: | ||
1903 | + case RTL_GIGA_MAC_VER_22: | ||
1904 | + case RTL_GIGA_MAC_VER_23: | ||
1905 | + case RTL_GIGA_MAC_VER_24: | ||
1906 | + case RTL_GIGA_MAC_VER_34: | ||
1907 | + case RTL_GIGA_MAC_VER_35: | ||
1908 | + RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); | ||
1909 | + break; | ||
1910 | + case RTL_GIGA_MAC_VER_40: | ||
1911 | + case RTL_GIGA_MAC_VER_41: | ||
1912 | + case RTL_GIGA_MAC_VER_42: | ||
1913 | + case RTL_GIGA_MAC_VER_43: | ||
1914 | + case RTL_GIGA_MAC_VER_44: | ||
1915 | + case RTL_GIGA_MAC_VER_45: | ||
1916 | + case RTL_GIGA_MAC_VER_46: | ||
1917 | + case RTL_GIGA_MAC_VER_47: | ||
1918 | + case RTL_GIGA_MAC_VER_48: | ||
1919 | + case RTL_GIGA_MAC_VER_49: | ||
1920 | + case RTL_GIGA_MAC_VER_50: | ||
1921 | + case RTL_GIGA_MAC_VER_51: | ||
1922 | + RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); | ||
1923 | + break; | ||
1924 | + default: | ||
1925 | + RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST); | ||
1926 | + break; | ||
1927 | + } | ||
1928 | +} | ||
1929 | + | ||
1930 | static int rtl_set_mac_address(struct net_device *dev, void *p) | ||
1931 | { | ||
1932 | struct rtl8169_private *tp = netdev_priv(dev); | ||
1933 | @@ -4494,6 +4546,10 @@ static int rtl_set_mac_address(struct net_device *dev, void *p) | ||
1934 | |||
1935 | pm_runtime_put_noidle(d); | ||
1936 | |||
1937 | + /* Reportedly at least Asus X453MA truncates packets otherwise */ | ||
1938 | + if (tp->mac_version == RTL_GIGA_MAC_VER_37) | ||
1939 | + rtl_init_rxcfg(tp); | ||
1940 | + | ||
1941 | return 0; | ||
1942 | } | ||
1943 | |||
1944 | @@ -4931,58 +4987,6 @@ static void rtl_init_pll_power_ops(struct rtl8169_private *tp) | ||
1945 | } | ||
1946 | } | ||
1947 | |||
1948 | -static void rtl_init_rxcfg(struct rtl8169_private *tp) | ||
1949 | -{ | ||
1950 | - void __iomem *ioaddr = tp->mmio_addr; | ||
1951 | - | ||
1952 | - switch (tp->mac_version) { | ||
1953 | - case RTL_GIGA_MAC_VER_01: | ||
1954 | - case RTL_GIGA_MAC_VER_02: | ||
1955 | - case RTL_GIGA_MAC_VER_03: | ||
1956 | - case RTL_GIGA_MAC_VER_04: | ||
1957 | - case RTL_GIGA_MAC_VER_05: | ||
1958 | - case RTL_GIGA_MAC_VER_06: | ||
1959 | - case RTL_GIGA_MAC_VER_10: | ||
1960 | - case RTL_GIGA_MAC_VER_11: | ||
1961 | - case RTL_GIGA_MAC_VER_12: | ||
1962 | - case RTL_GIGA_MAC_VER_13: | ||
1963 | - case RTL_GIGA_MAC_VER_14: | ||
1964 | - case RTL_GIGA_MAC_VER_15: | ||
1965 | - case RTL_GIGA_MAC_VER_16: | ||
1966 | - case RTL_GIGA_MAC_VER_17: | ||
1967 | - RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST); | ||
1968 | - break; | ||
1969 | - case RTL_GIGA_MAC_VER_18: | ||
1970 | - case RTL_GIGA_MAC_VER_19: | ||
1971 | - case RTL_GIGA_MAC_VER_20: | ||
1972 | - case RTL_GIGA_MAC_VER_21: | ||
1973 | - case RTL_GIGA_MAC_VER_22: | ||
1974 | - case RTL_GIGA_MAC_VER_23: | ||
1975 | - case RTL_GIGA_MAC_VER_24: | ||
1976 | - case RTL_GIGA_MAC_VER_34: | ||
1977 | - case RTL_GIGA_MAC_VER_35: | ||
1978 | - RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); | ||
1979 | - break; | ||
1980 | - case RTL_GIGA_MAC_VER_40: | ||
1981 | - case RTL_GIGA_MAC_VER_41: | ||
1982 | - case RTL_GIGA_MAC_VER_42: | ||
1983 | - case RTL_GIGA_MAC_VER_43: | ||
1984 | - case RTL_GIGA_MAC_VER_44: | ||
1985 | - case RTL_GIGA_MAC_VER_45: | ||
1986 | - case RTL_GIGA_MAC_VER_46: | ||
1987 | - case RTL_GIGA_MAC_VER_47: | ||
1988 | - case RTL_GIGA_MAC_VER_48: | ||
1989 | - case RTL_GIGA_MAC_VER_49: | ||
1990 | - case RTL_GIGA_MAC_VER_50: | ||
1991 | - case RTL_GIGA_MAC_VER_51: | ||
1992 | - RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); | ||
1993 | - break; | ||
1994 | - default: | ||
1995 | - RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST); | ||
1996 | - break; | ||
1997 | - } | ||
1998 | -} | ||
1999 | - | ||
2000 | static void rtl8169_init_ring_indexes(struct rtl8169_private *tp) | ||
2001 | { | ||
2002 | tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0; | ||
2003 | diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c | ||
2004 | index 9bd4aa8083ce7..6061bff85523f 100644 | ||
2005 | --- a/drivers/net/wan/hdlc.c | ||
2006 | +++ b/drivers/net/wan/hdlc.c | ||
2007 | @@ -57,7 +57,15 @@ int hdlc_change_mtu(struct net_device *dev, int new_mtu) | ||
2008 | static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev, | ||
2009 | struct packet_type *p, struct net_device *orig_dev) | ||
2010 | { | ||
2011 | - struct hdlc_device *hdlc = dev_to_hdlc(dev); | ||
2012 | + struct hdlc_device *hdlc; | ||
2013 | + | ||
2014 | + /* First make sure "dev" is an HDLC device */ | ||
2015 | + if (!(dev->priv_flags & IFF_WAN_HDLC)) { | ||
2016 | + kfree_skb(skb); | ||
2017 | + return NET_RX_SUCCESS; | ||
2018 | + } | ||
2019 | + | ||
2020 | + hdlc = dev_to_hdlc(dev); | ||
2021 | |||
2022 | if (!net_eq(dev_net(dev), &init_net)) { | ||
2023 | kfree_skb(skb); | ||
2024 | diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c | ||
2025 | index 2f11836078ab5..1be781f8ffc1b 100644 | ||
2026 | --- a/drivers/net/wan/hdlc_raw_eth.c | ||
2027 | +++ b/drivers/net/wan/hdlc_raw_eth.c | ||
2028 | @@ -101,6 +101,7 @@ static int raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr) | ||
2029 | old_qlen = dev->tx_queue_len; | ||
2030 | ether_setup(dev); | ||
2031 | dev->tx_queue_len = old_qlen; | ||
2032 | + dev->priv_flags &= ~IFF_TX_SKB_SHARING; | ||
2033 | eth_hw_addr_random(dev); | ||
2034 | call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev); | ||
2035 | netif_dormant_off(dev); | ||
2036 | diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c | ||
2037 | index a3c2180475971..fce2064ebc469 100644 | ||
2038 | --- a/drivers/net/wireless/ath/ath10k/htt_rx.c | ||
2039 | +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c | ||
2040 | @@ -100,6 +100,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num) | ||
2041 | BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2); | ||
2042 | |||
2043 | idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr); | ||
2044 | + | ||
2045 | + if (idx < 0 || idx >= htt->rx_ring.size) { | ||
2046 | + ath10k_err(htt->ar, "rx ring index is not valid, firmware malfunctioning?\n"); | ||
2047 | + idx &= htt->rx_ring.size_mask; | ||
2048 | + ret = -ENOMEM; | ||
2049 | + goto fail; | ||
2050 | + } | ||
2051 | + | ||
2052 | while (num > 0) { | ||
2053 | skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN); | ||
2054 | if (!skb) { | ||
2055 | diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c | ||
2056 | index 2294ba311c47a..8b3fe88d1c4e7 100644 | ||
2057 | --- a/drivers/net/wireless/ath/ath10k/mac.c | ||
2058 | +++ b/drivers/net/wireless/ath/ath10k/mac.c | ||
2059 | @@ -6579,7 +6579,7 @@ ath10k_mac_update_bss_chan_survey(struct ath10k *ar, | ||
2060 | struct ieee80211_channel *channel) | ||
2061 | { | ||
2062 | int ret; | ||
2063 | - enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR; | ||
2064 | + enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ; | ||
2065 | |||
2066 | lockdep_assert_held(&ar->conf_mutex); | ||
2067 | |||
2068 | diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c | ||
2069 | index 1af3fed5a72ca..1a68518279689 100644 | ||
2070 | --- a/drivers/net/wireless/ath/ath6kl/main.c | ||
2071 | +++ b/drivers/net/wireless/ath/ath6kl/main.c | ||
2072 | @@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr, | ||
2073 | |||
2074 | ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid); | ||
2075 | |||
2076 | + if (aid < 1 || aid > AP_MAX_NUM_STA) | ||
2077 | + return; | ||
2078 | + | ||
2079 | if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { | ||
2080 | struct ieee80211_mgmt *mgmt = | ||
2081 | (struct ieee80211_mgmt *) assoc_info; | ||
2082 | diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c | ||
2083 | index 55609fc4e50e6..73eab12cb3bda 100644 | ||
2084 | --- a/drivers/net/wireless/ath/ath6kl/wmi.c | ||
2085 | +++ b/drivers/net/wireless/ath/ath6kl/wmi.c | ||
2086 | @@ -2648,6 +2648,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class, | ||
2087 | return -EINVAL; | ||
2088 | } | ||
2089 | |||
2090 | + if (tsid >= 16) { | ||
2091 | + ath6kl_err("invalid tsid: %d\n", tsid); | ||
2092 | + return -EINVAL; | ||
2093 | + } | ||
2094 | + | ||
2095 | skb = ath6kl_wmi_get_new_buf(sizeof(*cmd)); | ||
2096 | if (!skb) | ||
2097 | return -ENOMEM; | ||
2098 | diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c | ||
2099 | index fb5b7ce3d2c3d..7c409cd43b709 100644 | ||
2100 | --- a/drivers/net/wireless/ath/ath9k/hif_usb.c | ||
2101 | +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c | ||
2102 | @@ -447,10 +447,19 @@ static void hif_usb_stop(void *hif_handle) | ||
2103 | spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); | ||
2104 | |||
2105 | /* The pending URBs have to be canceled. */ | ||
2106 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); | ||
2107 | list_for_each_entry_safe(tx_buf, tx_buf_tmp, | ||
2108 | &hif_dev->tx.tx_pending, list) { | ||
2109 | + usb_get_urb(tx_buf->urb); | ||
2110 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); | ||
2111 | usb_kill_urb(tx_buf->urb); | ||
2112 | + list_del(&tx_buf->list); | ||
2113 | + usb_free_urb(tx_buf->urb); | ||
2114 | + kfree(tx_buf->buf); | ||
2115 | + kfree(tx_buf); | ||
2116 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); | ||
2117 | } | ||
2118 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); | ||
2119 | |||
2120 | usb_kill_anchored_urbs(&hif_dev->mgmt_submitted); | ||
2121 | } | ||
2122 | @@ -760,27 +769,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev) | ||
2123 | struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL; | ||
2124 | unsigned long flags; | ||
2125 | |||
2126 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); | ||
2127 | list_for_each_entry_safe(tx_buf, tx_buf_tmp, | ||
2128 | &hif_dev->tx.tx_buf, list) { | ||
2129 | + usb_get_urb(tx_buf->urb); | ||
2130 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); | ||
2131 | usb_kill_urb(tx_buf->urb); | ||
2132 | list_del(&tx_buf->list); | ||
2133 | usb_free_urb(tx_buf->urb); | ||
2134 | kfree(tx_buf->buf); | ||
2135 | kfree(tx_buf); | ||
2136 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); | ||
2137 | } | ||
2138 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); | ||
2139 | |||
2140 | spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); | ||
2141 | hif_dev->tx.flags |= HIF_USB_TX_FLUSH; | ||
2142 | spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); | ||
2143 | |||
2144 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); | ||
2145 | list_for_each_entry_safe(tx_buf, tx_buf_tmp, | ||
2146 | &hif_dev->tx.tx_pending, list) { | ||
2147 | + usb_get_urb(tx_buf->urb); | ||
2148 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); | ||
2149 | usb_kill_urb(tx_buf->urb); | ||
2150 | list_del(&tx_buf->list); | ||
2151 | usb_free_urb(tx_buf->urb); | ||
2152 | kfree(tx_buf->buf); | ||
2153 | kfree(tx_buf); | ||
2154 | + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); | ||
2155 | } | ||
2156 | + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); | ||
2157 | |||
2158 | usb_kill_anchored_urbs(&hif_dev->mgmt_submitted); | ||
2159 | } | ||
2160 | diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c | ||
2161 | index 1af216aa5adae..625823e45d8f0 100644 | ||
2162 | --- a/drivers/net/wireless/ath/ath9k/htc_hst.c | ||
2163 | +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c | ||
2164 | @@ -346,6 +346,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle, | ||
2165 | |||
2166 | if (skb) { | ||
2167 | htc_hdr = (struct htc_frame_hdr *) skb->data; | ||
2168 | + if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint)) | ||
2169 | + goto ret; | ||
2170 | endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id]; | ||
2171 | skb_pull(skb, sizeof(struct htc_frame_hdr)); | ||
2172 | |||
2173 | diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c | ||
2174 | index ca8797c653125..86beadf0f2493 100644 | ||
2175 | --- a/drivers/net/wireless/ath/wcn36xx/main.c | ||
2176 | +++ b/drivers/net/wireless/ath/wcn36xx/main.c | ||
2177 | @@ -158,7 +158,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = { | ||
2178 | .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, | ||
2179 | .mcs = { | ||
2180 | .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, | ||
2181 | - .rx_highest = cpu_to_le16(72), | ||
2182 | + .rx_highest = cpu_to_le16(150), | ||
2183 | .tx_params = IEEE80211_HT_MCS_TX_DEFINED, | ||
2184 | } | ||
2185 | } | ||
2186 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | ||
2187 | index ab9f136c15937..e306e5a89dd4f 100644 | ||
2188 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | ||
2189 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | ||
2190 | @@ -1540,6 +1540,8 @@ fail: | ||
2191 | BRCMF_TX_IOCTL_MAX_MSG_SIZE, | ||
2192 | msgbuf->ioctbuf, | ||
2193 | msgbuf->ioctbuf_handle); | ||
2194 | + if (msgbuf->txflow_wq) | ||
2195 | + destroy_workqueue(msgbuf->txflow_wq); | ||
2196 | kfree(msgbuf); | ||
2197 | } | ||
2198 | return -ENOMEM; | ||
2199 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | ||
2200 | index 93d4cde0eb313..c9f48ec46f4a1 100644 | ||
2201 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | ||
2202 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | ||
2203 | @@ -5090,8 +5090,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi) | ||
2204 | pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft; | ||
2205 | pi->pi_fptr.detach = wlc_phy_detach_lcnphy; | ||
2206 | |||
2207 | - if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) | ||
2208 | + if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) { | ||
2209 | + kfree(pi->u.pi_lcnphy); | ||
2210 | return false; | ||
2211 | + } | ||
2212 | |||
2213 | if (LCNREV_IS(pi->pubpi.phy_rev, 1)) { | ||
2214 | if (pi_lcn->lcnphy_tempsense_option == 3) { | ||
2215 | diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
2216 | index d91ab2b8d6671..d46efa8d70732 100644 | ||
2217 | --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
2218 | +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
2219 | @@ -3046,9 +3046,12 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm, | ||
2220 | aux_roc_req.apply_time_max_delay = cpu_to_le32(delay); | ||
2221 | |||
2222 | IWL_DEBUG_TE(mvm, | ||
2223 | - "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n", | ||
2224 | - channel->hw_value, req_dur, duration, delay, | ||
2225 | - dtim_interval); | ||
2226 | + "ROC: Requesting to remain on channel %u for %ums\n", | ||
2227 | + channel->hw_value, req_dur); | ||
2228 | + IWL_DEBUG_TE(mvm, | ||
2229 | + "\t(requested = %ums, max_delay = %ums, dtim_interval = %ums)\n", | ||
2230 | + duration, delay, dtim_interval); | ||
2231 | + | ||
2232 | /* Set the node address */ | ||
2233 | memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN); | ||
2234 | |||
2235 | diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c | ||
2236 | index 5fde2e2f1fea8..422a8d31ed7f9 100644 | ||
2237 | --- a/drivers/net/wireless/marvell/mwifiex/scan.c | ||
2238 | +++ b/drivers/net/wireless/marvell/mwifiex/scan.c | ||
2239 | @@ -1879,7 +1879,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, | ||
2240 | chan, CFG80211_BSS_FTYPE_UNKNOWN, | ||
2241 | bssid, timestamp, | ||
2242 | cap_info_bitmap, beacon_period, | ||
2243 | - ie_buf, ie_len, rssi, GFP_KERNEL); | ||
2244 | + ie_buf, ie_len, rssi, GFP_ATOMIC); | ||
2245 | if (bss) { | ||
2246 | bss_priv = (struct mwifiex_bss_priv *)bss->priv; | ||
2247 | bss_priv->band = band; | ||
2248 | diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c | ||
2249 | index 486b8c75cd1f9..679cc0035514e 100644 | ||
2250 | --- a/drivers/net/wireless/marvell/mwifiex/sdio.c | ||
2251 | +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c | ||
2252 | @@ -2049,6 +2049,8 @@ error: | ||
2253 | kfree(card->mpa_rx.buf); | ||
2254 | card->mpa_tx.buf_size = 0; | ||
2255 | card->mpa_rx.buf_size = 0; | ||
2256 | + card->mpa_tx.buf = NULL; | ||
2257 | + card->mpa_rx.buf = NULL; | ||
2258 | } | ||
2259 | |||
2260 | return ret; | ||
2261 | diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | ||
2262 | index 18d5984b78dab..e73613b9f2f59 100644 | ||
2263 | --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | ||
2264 | +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | ||
2265 | @@ -5422,7 +5422,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) | ||
2266 | ret = usb_submit_urb(urb, GFP_KERNEL); | ||
2267 | if (ret) { | ||
2268 | usb_unanchor_urb(urb); | ||
2269 | - usb_free_urb(urb); | ||
2270 | goto error; | ||
2271 | } | ||
2272 | |||
2273 | @@ -5431,6 +5430,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) | ||
2274 | rtl8xxxu_write32(priv, REG_USB_HIMR, val32); | ||
2275 | |||
2276 | error: | ||
2277 | + usb_free_urb(urb); | ||
2278 | return ret; | ||
2279 | } | ||
2280 | |||
2281 | @@ -5756,6 +5756,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) | ||
2282 | struct rtl8xxxu_priv *priv = hw->priv; | ||
2283 | struct rtl8xxxu_rx_urb *rx_urb; | ||
2284 | struct rtl8xxxu_tx_urb *tx_urb; | ||
2285 | + struct sk_buff *skb; | ||
2286 | unsigned long flags; | ||
2287 | int ret, i; | ||
2288 | |||
2289 | @@ -5806,6 +5807,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) | ||
2290 | rx_urb->hw = hw; | ||
2291 | |||
2292 | ret = rtl8xxxu_submit_rx_urb(priv, rx_urb); | ||
2293 | + if (ret) { | ||
2294 | + if (ret != -ENOMEM) { | ||
2295 | + skb = (struct sk_buff *)rx_urb->urb.context; | ||
2296 | + dev_kfree_skb(skb); | ||
2297 | + } | ||
2298 | + rtl8xxxu_queue_rx_urb(priv, rx_urb); | ||
2299 | + } | ||
2300 | } | ||
2301 | exit: | ||
2302 | /* | ||
2303 | diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c | ||
2304 | index 6ccba0d862df7..927b574e5d596 100644 | ||
2305 | --- a/drivers/ntb/hw/amd/ntb_hw_amd.c | ||
2306 | +++ b/drivers/ntb/hw/amd/ntb_hw_amd.c | ||
2307 | @@ -994,6 +994,7 @@ static int amd_ntb_init_pci(struct amd_ntb_dev *ndev, | ||
2308 | |||
2309 | err_dma_mask: | ||
2310 | pci_clear_master(pdev); | ||
2311 | + pci_release_regions(pdev); | ||
2312 | err_pci_regions: | ||
2313 | pci_disable_device(pdev); | ||
2314 | err_pci_enable: | ||
2315 | diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c | ||
2316 | index 63b87a8472762..4b58f352c0c93 100644 | ||
2317 | --- a/drivers/nvme/target/core.c | ||
2318 | +++ b/drivers/nvme/target/core.c | ||
2319 | @@ -591,7 +591,8 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl) | ||
2320 | * in case a host died before it enabled the controller. Hence, simply | ||
2321 | * reset the keep alive timer when the controller is enabled. | ||
2322 | */ | ||
2323 | - mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); | ||
2324 | + if (ctrl->kato) | ||
2325 | + mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); | ||
2326 | } | ||
2327 | |||
2328 | static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl) | ||
2329 | diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c | ||
2330 | index ebe8e8dc46770..c246d3a2fc5f6 100644 | ||
2331 | --- a/drivers/rapidio/devices/rio_mport_cdev.c | ||
2332 | +++ b/drivers/rapidio/devices/rio_mport_cdev.c | ||
2333 | @@ -901,15 +901,16 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode, | ||
2334 | if (pinned < 0) { | ||
2335 | rmcd_error("get_user_pages err=%ld", pinned); | ||
2336 | nr_pages = 0; | ||
2337 | - } else | ||
2338 | + } else { | ||
2339 | rmcd_error("pinned %ld out of %ld pages", | ||
2340 | pinned, nr_pages); | ||
2341 | + /* | ||
2342 | + * Set nr_pages up to mean "how many pages to unpin, in | ||
2343 | + * the error handler: | ||
2344 | + */ | ||
2345 | + nr_pages = pinned; | ||
2346 | + } | ||
2347 | ret = -EFAULT; | ||
2348 | - /* | ||
2349 | - * Set nr_pages up to mean "how many pages to unpin, in | ||
2350 | - * the error handler: | ||
2351 | - */ | ||
2352 | - nr_pages = pinned; | ||
2353 | goto err_pg; | ||
2354 | } | ||
2355 | |||
2356 | @@ -1739,6 +1740,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, | ||
2357 | struct rio_dev *rdev; | ||
2358 | struct rio_switch *rswitch = NULL; | ||
2359 | struct rio_mport *mport; | ||
2360 | + struct device *dev; | ||
2361 | size_t size; | ||
2362 | u32 rval; | ||
2363 | u32 swpinfo = 0; | ||
2364 | @@ -1753,8 +1755,10 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, | ||
2365 | rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name, | ||
2366 | dev_info.comptag, dev_info.destid, dev_info.hopcount); | ||
2367 | |||
2368 | - if (bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name)) { | ||
2369 | + dev = bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name); | ||
2370 | + if (dev) { | ||
2371 | rmcd_debug(RDEV, "device %s already exists", dev_info.name); | ||
2372 | + put_device(dev); | ||
2373 | return -EEXIST; | ||
2374 | } | ||
2375 | |||
2376 | diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c | ||
2377 | index 9355b65920ab4..0f730e4bf6bcb 100644 | ||
2378 | --- a/drivers/regulator/core.c | ||
2379 | +++ b/drivers/regulator/core.c | ||
2380 | @@ -4029,15 +4029,20 @@ regulator_register(const struct regulator_desc *regulator_desc, | ||
2381 | else if (regulator_desc->supply_name) | ||
2382 | rdev->supply_name = regulator_desc->supply_name; | ||
2383 | |||
2384 | - /* | ||
2385 | - * Attempt to resolve the regulator supply, if specified, | ||
2386 | - * but don't return an error if we fail because we will try | ||
2387 | - * to resolve it again later as more regulators are added. | ||
2388 | - */ | ||
2389 | - if (regulator_resolve_supply(rdev)) | ||
2390 | - rdev_dbg(rdev, "unable to resolve supply\n"); | ||
2391 | - | ||
2392 | ret = set_machine_constraints(rdev, constraints); | ||
2393 | + if (ret == -EPROBE_DEFER) { | ||
2394 | + /* Regulator might be in bypass mode and so needs its supply | ||
2395 | + * to set the constraints */ | ||
2396 | + /* FIXME: this currently triggers a chicken-and-egg problem | ||
2397 | + * when creating -SUPPLY symlink in sysfs to a regulator | ||
2398 | + * that is just being created */ | ||
2399 | + ret = regulator_resolve_supply(rdev); | ||
2400 | + if (!ret) | ||
2401 | + ret = set_machine_constraints(rdev, constraints); | ||
2402 | + else | ||
2403 | + rdev_dbg(rdev, "unable to resolve supply early: %pe\n", | ||
2404 | + ERR_PTR(ret)); | ||
2405 | + } | ||
2406 | if (ret < 0) | ||
2407 | goto wash; | ||
2408 | |||
2409 | diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c | ||
2410 | index 741cc96379cb7..04788e0b90236 100644 | ||
2411 | --- a/drivers/scsi/be2iscsi/be_main.c | ||
2412 | +++ b/drivers/scsi/be2iscsi/be_main.c | ||
2413 | @@ -3052,6 +3052,7 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba, | ||
2414 | if (!eq_vaddress) | ||
2415 | goto create_eq_error; | ||
2416 | |||
2417 | + mem->dma = paddr; | ||
2418 | mem->va = eq_vaddress; | ||
2419 | ret = be_fill_queue(eq, phba->params.num_eq_entries, | ||
2420 | sizeof(struct be_eq_entry), eq_vaddress); | ||
2421 | @@ -3061,7 +3062,6 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba, | ||
2422 | goto create_eq_error; | ||
2423 | } | ||
2424 | |||
2425 | - mem->dma = paddr; | ||
2426 | ret = beiscsi_cmd_eq_create(&phba->ctrl, eq, | ||
2427 | phwi_context->cur_eqd); | ||
2428 | if (ret) { | ||
2429 | @@ -3116,6 +3116,7 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba, | ||
2430 | if (!cq_vaddress) | ||
2431 | goto create_cq_error; | ||
2432 | |||
2433 | + mem->dma = paddr; | ||
2434 | ret = be_fill_queue(cq, phba->params.num_cq_entries, | ||
2435 | sizeof(struct sol_cqe), cq_vaddress); | ||
2436 | if (ret) { | ||
2437 | @@ -3125,7 +3126,6 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba, | ||
2438 | goto create_cq_error; | ||
2439 | } | ||
2440 | |||
2441 | - mem->dma = paddr; | ||
2442 | ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false, | ||
2443 | false, 0); | ||
2444 | if (ret) { | ||
2445 | diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c | ||
2446 | index dab195f04da78..06ca0495f3e8e 100644 | ||
2447 | --- a/drivers/scsi/csiostor/csio_hw.c | ||
2448 | +++ b/drivers/scsi/csiostor/csio_hw.c | ||
2449 | @@ -1973,7 +1973,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info, | ||
2450 | FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), | ||
2451 | FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), | ||
2452 | FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); | ||
2453 | - ret = EINVAL; | ||
2454 | + ret = -EINVAL; | ||
2455 | goto bye; | ||
2456 | } | ||
2457 | |||
2458 | diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c | ||
2459 | index 54dea767dfde9..04b3ac17531db 100644 | ||
2460 | --- a/drivers/scsi/ibmvscsi/ibmvfc.c | ||
2461 | +++ b/drivers/scsi/ibmvscsi/ibmvfc.c | ||
2462 | @@ -4804,6 +4804,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id) | ||
2463 | if (IS_ERR(vhost->work_thread)) { | ||
2464 | dev_err(dev, "Couldn't create kernel thread: %ld\n", | ||
2465 | PTR_ERR(vhost->work_thread)); | ||
2466 | + rc = PTR_ERR(vhost->work_thread); | ||
2467 | goto free_host_mem; | ||
2468 | } | ||
2469 | |||
2470 | diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c | ||
2471 | index 39285070f3b51..17ec51f9d9880 100644 | ||
2472 | --- a/drivers/scsi/mvumi.c | ||
2473 | +++ b/drivers/scsi/mvumi.c | ||
2474 | @@ -2476,6 +2476,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba) | ||
2475 | if (IS_ERR(mhba->dm_thread)) { | ||
2476 | dev_err(&mhba->pdev->dev, | ||
2477 | "failed to create device scan thread\n"); | ||
2478 | + ret = PTR_ERR(mhba->dm_thread); | ||
2479 | mutex_unlock(&mhba->sas_discovery_mutex); | ||
2480 | goto fail_create_thread; | ||
2481 | } | ||
2482 | diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c | ||
2483 | index 3fda5836aac69..f10088a1d38c0 100644 | ||
2484 | --- a/drivers/scsi/qla4xxx/ql4_os.c | ||
2485 | +++ b/drivers/scsi/qla4xxx/ql4_os.c | ||
2486 | @@ -1223,7 +1223,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len) | ||
2487 | le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error); | ||
2488 | exit_host_stats: | ||
2489 | if (ql_iscsi_stats) | ||
2490 | - dma_free_coherent(&ha->pdev->dev, host_stats_size, | ||
2491 | + dma_free_coherent(&ha->pdev->dev, stats_size, | ||
2492 | ql_iscsi_stats, iscsi_stats_dma); | ||
2493 | |||
2494 | ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n", | ||
2495 | diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c | ||
2496 | index 3c4d7c2b4ade8..de05196738da5 100644 | ||
2497 | --- a/drivers/tty/hvc/hvcs.c | ||
2498 | +++ b/drivers/tty/hvc/hvcs.c | ||
2499 | @@ -1232,13 +1232,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) | ||
2500 | |||
2501 | tty_wait_until_sent(tty, HVCS_CLOSE_WAIT); | ||
2502 | |||
2503 | - /* | ||
2504 | - * This line is important because it tells hvcs_open that this | ||
2505 | - * device needs to be re-configured the next time hvcs_open is | ||
2506 | - * called. | ||
2507 | - */ | ||
2508 | - tty->driver_data = NULL; | ||
2509 | - | ||
2510 | free_irq(irq, hvcsd); | ||
2511 | return; | ||
2512 | } else if (hvcsd->port.count < 0) { | ||
2513 | @@ -1254,6 +1247,13 @@ static void hvcs_cleanup(struct tty_struct * tty) | ||
2514 | { | ||
2515 | struct hvcs_struct *hvcsd = tty->driver_data; | ||
2516 | |||
2517 | + /* | ||
2518 | + * This line is important because it tells hvcs_open that this | ||
2519 | + * device needs to be re-configured the next time hvcs_open is | ||
2520 | + * called. | ||
2521 | + */ | ||
2522 | + tty->driver_data = NULL; | ||
2523 | + | ||
2524 | tty_port_put(&hvcsd->port); | ||
2525 | } | ||
2526 | |||
2527 | diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c | ||
2528 | index c0dfb642383b2..dc7f4eb18e0a7 100644 | ||
2529 | --- a/drivers/tty/ipwireless/network.c | ||
2530 | +++ b/drivers/tty/ipwireless/network.c | ||
2531 | @@ -116,7 +116,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, | ||
2532 | skb->len, | ||
2533 | notify_packet_sent, | ||
2534 | network); | ||
2535 | - if (ret == -1) { | ||
2536 | + if (ret < 0) { | ||
2537 | skb_pull(skb, 2); | ||
2538 | return 0; | ||
2539 | } | ||
2540 | @@ -133,7 +133,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, | ||
2541 | notify_packet_sent, | ||
2542 | network); | ||
2543 | kfree(buf); | ||
2544 | - if (ret == -1) | ||
2545 | + if (ret < 0) | ||
2546 | return 0; | ||
2547 | } | ||
2548 | kfree_skb(skb); | ||
2549 | diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c | ||
2550 | index 2685d59d27245..4f9690442507f 100644 | ||
2551 | --- a/drivers/tty/ipwireless/tty.c | ||
2552 | +++ b/drivers/tty/ipwireless/tty.c | ||
2553 | @@ -217,7 +217,7 @@ static int ipw_write(struct tty_struct *linux_tty, | ||
2554 | ret = ipwireless_send_packet(tty->hardware, IPW_CHANNEL_RAS, | ||
2555 | buf, count, | ||
2556 | ipw_write_packet_sent_callback, tty); | ||
2557 | - if (ret == -1) { | ||
2558 | + if (ret < 0) { | ||
2559 | mutex_unlock(&tty->ipw_tty_mutex); | ||
2560 | return 0; | ||
2561 | } | ||
2562 | diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c | ||
2563 | index 171130a9ecc87..8a063a036bc08 100644 | ||
2564 | --- a/drivers/tty/pty.c | ||
2565 | +++ b/drivers/tty/pty.c | ||
2566 | @@ -115,10 +115,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) | ||
2567 | spin_lock_irqsave(&to->port->lock, flags); | ||
2568 | /* Stuff the data into the input queue of the other end */ | ||
2569 | c = tty_insert_flip_string(to->port, buf, c); | ||
2570 | + spin_unlock_irqrestore(&to->port->lock, flags); | ||
2571 | /* And shovel */ | ||
2572 | if (c) | ||
2573 | tty_flip_buffer_push(to->port); | ||
2574 | - spin_unlock_irqrestore(&to->port->lock, flags); | ||
2575 | } | ||
2576 | return c; | ||
2577 | } | ||
2578 | diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig | ||
2579 | index 25c1d7bc01004..7ea229cb1d864 100644 | ||
2580 | --- a/drivers/tty/serial/Kconfig | ||
2581 | +++ b/drivers/tty/serial/Kconfig | ||
2582 | @@ -9,6 +9,7 @@ menu "Serial drivers" | ||
2583 | |||
2584 | config SERIAL_EARLYCON | ||
2585 | bool | ||
2586 | + depends on SERIAL_CORE | ||
2587 | help | ||
2588 | Support for early consoles with the earlycon parameter. This enables | ||
2589 | the console before standard serial driver is probed. The console is | ||
2590 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c | ||
2591 | index 2dc563b61b88a..726291c5562da 100644 | ||
2592 | --- a/drivers/usb/class/cdc-acm.c | ||
2593 | +++ b/drivers/usb/class/cdc-acm.c | ||
2594 | @@ -1178,9 +1178,21 @@ static int acm_probe(struct usb_interface *intf, | ||
2595 | } | ||
2596 | } | ||
2597 | } else { | ||
2598 | + int class = -1; | ||
2599 | + | ||
2600 | data_intf_num = union_header->bSlaveInterface0; | ||
2601 | control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0); | ||
2602 | data_interface = usb_ifnum_to_if(usb_dev, data_intf_num); | ||
2603 | + | ||
2604 | + if (control_interface) | ||
2605 | + class = control_interface->cur_altsetting->desc.bInterfaceClass; | ||
2606 | + | ||
2607 | + if (class != USB_CLASS_COMM && class != USB_CLASS_CDC_DATA) { | ||
2608 | + dev_dbg(&intf->dev, "Broken union descriptor, assuming single interface\n"); | ||
2609 | + combined_interfaces = 1; | ||
2610 | + control_interface = data_interface = intf; | ||
2611 | + goto look_for_collapsed_interface; | ||
2612 | + } | ||
2613 | } | ||
2614 | |||
2615 | if (!control_interface || !data_interface) { | ||
2616 | @@ -1840,6 +1852,17 @@ static const struct usb_device_id acm_ids[] = { | ||
2617 | .driver_info = IGNORE_DEVICE, | ||
2618 | }, | ||
2619 | |||
2620 | + /* Exclude ETAS ES58x */ | ||
2621 | + { USB_DEVICE(0x108c, 0x0159), /* ES581.4 */ | ||
2622 | + .driver_info = IGNORE_DEVICE, | ||
2623 | + }, | ||
2624 | + { USB_DEVICE(0x108c, 0x0168), /* ES582.1 */ | ||
2625 | + .driver_info = IGNORE_DEVICE, | ||
2626 | + }, | ||
2627 | + { USB_DEVICE(0x108c, 0x0169), /* ES584.1 */ | ||
2628 | + .driver_info = IGNORE_DEVICE, | ||
2629 | + }, | ||
2630 | + | ||
2631 | { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */ | ||
2632 | .driver_info = SEND_ZERO_PACKET, | ||
2633 | }, | ||
2634 | diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c | ||
2635 | index 09337a973335c..f9d39c993f2f3 100644 | ||
2636 | --- a/drivers/usb/class/cdc-wdm.c | ||
2637 | +++ b/drivers/usb/class/cdc-wdm.c | ||
2638 | @@ -61,6 +61,9 @@ MODULE_DEVICE_TABLE (usb, wdm_ids); | ||
2639 | |||
2640 | #define WDM_MAX 16 | ||
2641 | |||
2642 | +/* we cannot wait forever at flush() */ | ||
2643 | +#define WDM_FLUSH_TIMEOUT (30 * HZ) | ||
2644 | + | ||
2645 | /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */ | ||
2646 | #define WDM_DEFAULT_BUFSIZE 256 | ||
2647 | |||
2648 | @@ -151,7 +154,7 @@ static void wdm_out_callback(struct urb *urb) | ||
2649 | kfree(desc->outbuf); | ||
2650 | desc->outbuf = NULL; | ||
2651 | clear_bit(WDM_IN_USE, &desc->flags); | ||
2652 | - wake_up(&desc->wait); | ||
2653 | + wake_up_all(&desc->wait); | ||
2654 | } | ||
2655 | |||
2656 | /* forward declaration */ | ||
2657 | @@ -402,6 +405,9 @@ static ssize_t wdm_write | ||
2658 | if (test_bit(WDM_RESETTING, &desc->flags)) | ||
2659 | r = -EIO; | ||
2660 | |||
2661 | + if (test_bit(WDM_DISCONNECTING, &desc->flags)) | ||
2662 | + r = -ENODEV; | ||
2663 | + | ||
2664 | if (r < 0) { | ||
2665 | rv = r; | ||
2666 | goto out_free_mem_pm; | ||
2667 | @@ -433,6 +439,7 @@ static ssize_t wdm_write | ||
2668 | if (rv < 0) { | ||
2669 | desc->outbuf = NULL; | ||
2670 | clear_bit(WDM_IN_USE, &desc->flags); | ||
2671 | + wake_up_all(&desc->wait); /* for wdm_wait_for_response() */ | ||
2672 | dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv); | ||
2673 | rv = usb_translate_errors(rv); | ||
2674 | goto out_free_mem_pm; | ||
2675 | @@ -593,28 +600,58 @@ err: | ||
2676 | return rv; | ||
2677 | } | ||
2678 | |||
2679 | -static int wdm_flush(struct file *file, fl_owner_t id) | ||
2680 | +static int wdm_wait_for_response(struct file *file, long timeout) | ||
2681 | { | ||
2682 | struct wdm_device *desc = file->private_data; | ||
2683 | + long rv; /* Use long here because (int) MAX_SCHEDULE_TIMEOUT < 0. */ | ||
2684 | |||
2685 | - wait_event(desc->wait, | ||
2686 | - /* | ||
2687 | - * needs both flags. We cannot do with one | ||
2688 | - * because resetting it would cause a race | ||
2689 | - * with write() yet we need to signal | ||
2690 | - * a disconnect | ||
2691 | - */ | ||
2692 | - !test_bit(WDM_IN_USE, &desc->flags) || | ||
2693 | - test_bit(WDM_DISCONNECTING, &desc->flags)); | ||
2694 | - | ||
2695 | - /* cannot dereference desc->intf if WDM_DISCONNECTING */ | ||
2696 | + /* | ||
2697 | + * Needs both flags. We cannot do with one because resetting it would | ||
2698 | + * cause a race with write() yet we need to signal a disconnect. | ||
2699 | + */ | ||
2700 | + rv = wait_event_interruptible_timeout(desc->wait, | ||
2701 | + !test_bit(WDM_IN_USE, &desc->flags) || | ||
2702 | + test_bit(WDM_DISCONNECTING, &desc->flags), | ||
2703 | + timeout); | ||
2704 | + | ||
2705 | + /* | ||
2706 | + * To report the correct error. This is best effort. | ||
2707 | + * We are inevitably racing with the hardware. | ||
2708 | + */ | ||
2709 | if (test_bit(WDM_DISCONNECTING, &desc->flags)) | ||
2710 | return -ENODEV; | ||
2711 | - if (desc->werr < 0) | ||
2712 | - dev_err(&desc->intf->dev, "Error in flush path: %d\n", | ||
2713 | - desc->werr); | ||
2714 | + if (!rv) | ||
2715 | + return -EIO; | ||
2716 | + if (rv < 0) | ||
2717 | + return -EINTR; | ||
2718 | |||
2719 | - return usb_translate_errors(desc->werr); | ||
2720 | + spin_lock_irq(&desc->iuspin); | ||
2721 | + rv = desc->werr; | ||
2722 | + desc->werr = 0; | ||
2723 | + spin_unlock_irq(&desc->iuspin); | ||
2724 | + | ||
2725 | + return usb_translate_errors(rv); | ||
2726 | + | ||
2727 | +} | ||
2728 | + | ||
2729 | +/* | ||
2730 | + * You need to send a signal when you react to malicious or defective hardware. | ||
2731 | + * Also, don't abort when fsync() returned -EINVAL, for older kernels which do | ||
2732 | + * not implement wdm_flush() will return -EINVAL. | ||
2733 | + */ | ||
2734 | +static int wdm_fsync(struct file *file, loff_t start, loff_t end, int datasync) | ||
2735 | +{ | ||
2736 | + return wdm_wait_for_response(file, MAX_SCHEDULE_TIMEOUT); | ||
2737 | +} | ||
2738 | + | ||
2739 | +/* | ||
2740 | + * Same with wdm_fsync(), except it uses finite timeout in order to react to | ||
2741 | + * malicious or defective hardware which ceased communication after close() was | ||
2742 | + * implicitly called due to process termination. | ||
2743 | + */ | ||
2744 | +static int wdm_flush(struct file *file, fl_owner_t id) | ||
2745 | +{ | ||
2746 | + return wdm_wait_for_response(file, WDM_FLUSH_TIMEOUT); | ||
2747 | } | ||
2748 | |||
2749 | static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait) | ||
2750 | @@ -739,6 +776,7 @@ static const struct file_operations wdm_fops = { | ||
2751 | .owner = THIS_MODULE, | ||
2752 | .read = wdm_read, | ||
2753 | .write = wdm_write, | ||
2754 | + .fsync = wdm_fsync, | ||
2755 | .open = wdm_open, | ||
2756 | .flush = wdm_flush, | ||
2757 | .release = wdm_release, | ||
2758 | diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c | ||
2759 | index 56dcc0820898c..6785ebc078047 100644 | ||
2760 | --- a/drivers/usb/core/urb.c | ||
2761 | +++ b/drivers/usb/core/urb.c | ||
2762 | @@ -765,11 +765,12 @@ void usb_block_urb(struct urb *urb) | ||
2763 | EXPORT_SYMBOL_GPL(usb_block_urb); | ||
2764 | |||
2765 | /** | ||
2766 | - * usb_kill_anchored_urbs - cancel transfer requests en masse | ||
2767 | + * usb_kill_anchored_urbs - kill all URBs associated with an anchor | ||
2768 | * @anchor: anchor the requests are bound to | ||
2769 | * | ||
2770 | - * this allows all outstanding URBs to be killed starting | ||
2771 | - * from the back of the queue | ||
2772 | + * This kills all outstanding URBs starting from the back of the queue, | ||
2773 | + * with guarantee that no completer callbacks will take place from the | ||
2774 | + * anchor after this function returns. | ||
2775 | * | ||
2776 | * This routine should not be called by a driver after its disconnect | ||
2777 | * method has returned. | ||
2778 | @@ -777,20 +778,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb); | ||
2779 | void usb_kill_anchored_urbs(struct usb_anchor *anchor) | ||
2780 | { | ||
2781 | struct urb *victim; | ||
2782 | + int surely_empty; | ||
2783 | |||
2784 | - spin_lock_irq(&anchor->lock); | ||
2785 | - while (!list_empty(&anchor->urb_list)) { | ||
2786 | - victim = list_entry(anchor->urb_list.prev, struct urb, | ||
2787 | - anchor_list); | ||
2788 | - /* we must make sure the URB isn't freed before we kill it*/ | ||
2789 | - usb_get_urb(victim); | ||
2790 | - spin_unlock_irq(&anchor->lock); | ||
2791 | - /* this will unanchor the URB */ | ||
2792 | - usb_kill_urb(victim); | ||
2793 | - usb_put_urb(victim); | ||
2794 | + do { | ||
2795 | spin_lock_irq(&anchor->lock); | ||
2796 | - } | ||
2797 | - spin_unlock_irq(&anchor->lock); | ||
2798 | + while (!list_empty(&anchor->urb_list)) { | ||
2799 | + victim = list_entry(anchor->urb_list.prev, | ||
2800 | + struct urb, anchor_list); | ||
2801 | + /* make sure the URB isn't freed before we kill it */ | ||
2802 | + usb_get_urb(victim); | ||
2803 | + spin_unlock_irq(&anchor->lock); | ||
2804 | + /* this will unanchor the URB */ | ||
2805 | + usb_kill_urb(victim); | ||
2806 | + usb_put_urb(victim); | ||
2807 | + spin_lock_irq(&anchor->lock); | ||
2808 | + } | ||
2809 | + surely_empty = usb_anchor_check_wakeup(anchor); | ||
2810 | + | ||
2811 | + spin_unlock_irq(&anchor->lock); | ||
2812 | + cpu_relax(); | ||
2813 | + } while (!surely_empty); | ||
2814 | } | ||
2815 | EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs); | ||
2816 | |||
2817 | @@ -809,21 +816,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs); | ||
2818 | void usb_poison_anchored_urbs(struct usb_anchor *anchor) | ||
2819 | { | ||
2820 | struct urb *victim; | ||
2821 | + int surely_empty; | ||
2822 | |||
2823 | - spin_lock_irq(&anchor->lock); | ||
2824 | - anchor->poisoned = 1; | ||
2825 | - while (!list_empty(&anchor->urb_list)) { | ||
2826 | - victim = list_entry(anchor->urb_list.prev, struct urb, | ||
2827 | - anchor_list); | ||
2828 | - /* we must make sure the URB isn't freed before we kill it*/ | ||
2829 | - usb_get_urb(victim); | ||
2830 | - spin_unlock_irq(&anchor->lock); | ||
2831 | - /* this will unanchor the URB */ | ||
2832 | - usb_poison_urb(victim); | ||
2833 | - usb_put_urb(victim); | ||
2834 | + do { | ||
2835 | spin_lock_irq(&anchor->lock); | ||
2836 | - } | ||
2837 | - spin_unlock_irq(&anchor->lock); | ||
2838 | + anchor->poisoned = 1; | ||
2839 | + while (!list_empty(&anchor->urb_list)) { | ||
2840 | + victim = list_entry(anchor->urb_list.prev, | ||
2841 | + struct urb, anchor_list); | ||
2842 | + /* make sure the URB isn't freed before we kill it */ | ||
2843 | + usb_get_urb(victim); | ||
2844 | + spin_unlock_irq(&anchor->lock); | ||
2845 | + /* this will unanchor the URB */ | ||
2846 | + usb_poison_urb(victim); | ||
2847 | + usb_put_urb(victim); | ||
2848 | + spin_lock_irq(&anchor->lock); | ||
2849 | + } | ||
2850 | + surely_empty = usb_anchor_check_wakeup(anchor); | ||
2851 | + | ||
2852 | + spin_unlock_irq(&anchor->lock); | ||
2853 | + cpu_relax(); | ||
2854 | + } while (!surely_empty); | ||
2855 | } | ||
2856 | EXPORT_SYMBOL_GPL(usb_poison_anchored_urbs); | ||
2857 | |||
2858 | @@ -963,14 +976,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor) | ||
2859 | { | ||
2860 | struct urb *victim; | ||
2861 | unsigned long flags; | ||
2862 | + int surely_empty; | ||
2863 | + | ||
2864 | + do { | ||
2865 | + spin_lock_irqsave(&anchor->lock, flags); | ||
2866 | + while (!list_empty(&anchor->urb_list)) { | ||
2867 | + victim = list_entry(anchor->urb_list.prev, | ||
2868 | + struct urb, anchor_list); | ||
2869 | + __usb_unanchor_urb(victim, anchor); | ||
2870 | + } | ||
2871 | + surely_empty = usb_anchor_check_wakeup(anchor); | ||
2872 | |||
2873 | - spin_lock_irqsave(&anchor->lock, flags); | ||
2874 | - while (!list_empty(&anchor->urb_list)) { | ||
2875 | - victim = list_entry(anchor->urb_list.prev, struct urb, | ||
2876 | - anchor_list); | ||
2877 | - __usb_unanchor_urb(victim, anchor); | ||
2878 | - } | ||
2879 | - spin_unlock_irqrestore(&anchor->lock, flags); | ||
2880 | + spin_unlock_irqrestore(&anchor->lock, flags); | ||
2881 | + cpu_relax(); | ||
2882 | + } while (!surely_empty); | ||
2883 | } | ||
2884 | |||
2885 | EXPORT_SYMBOL_GPL(usb_scuttle_anchored_urbs); | ||
2886 | diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c | ||
2887 | index 0061bf130598e..4395ea07c1bb4 100644 | ||
2888 | --- a/drivers/usb/gadget/function/f_ncm.c | ||
2889 | +++ b/drivers/usb/gadget/function/f_ncm.c | ||
2890 | @@ -91,8 +91,10 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f) | ||
2891 | /* peak (theoretical) bulk transfer rate in bits-per-second */ | ||
2892 | static inline unsigned ncm_bitrate(struct usb_gadget *g) | ||
2893 | { | ||
2894 | - if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) | ||
2895 | - return 13 * 1024 * 8 * 1000 * 8; | ||
2896 | + if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) | ||
2897 | + return 4250000000U; | ||
2898 | + else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) | ||
2899 | + return 3750000000U; | ||
2900 | else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH) | ||
2901 | return 13 * 512 * 8 * 1000 * 8; | ||
2902 | else | ||
2903 | @@ -1546,7 +1548,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) | ||
2904 | fs_ncm_notify_desc.bEndpointAddress; | ||
2905 | |||
2906 | status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function, | ||
2907 | - ncm_ss_function, NULL); | ||
2908 | + ncm_ss_function, ncm_ss_function); | ||
2909 | if (status) | ||
2910 | goto fail; | ||
2911 | |||
2912 | diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c | ||
2913 | index 0de36cda6e410..d89b3046dd10b 100644 | ||
2914 | --- a/drivers/usb/gadget/function/f_printer.c | ||
2915 | +++ b/drivers/usb/gadget/function/f_printer.c | ||
2916 | @@ -35,6 +35,7 @@ | ||
2917 | #include <linux/types.h> | ||
2918 | #include <linux/ctype.h> | ||
2919 | #include <linux/cdev.h> | ||
2920 | +#include <linux/kref.h> | ||
2921 | |||
2922 | #include <asm/byteorder.h> | ||
2923 | #include <linux/io.h> | ||
2924 | @@ -69,7 +70,7 @@ struct printer_dev { | ||
2925 | struct usb_gadget *gadget; | ||
2926 | s8 interface; | ||
2927 | struct usb_ep *in_ep, *out_ep; | ||
2928 | - | ||
2929 | + struct kref kref; | ||
2930 | struct list_head rx_reqs; /* List of free RX structs */ | ||
2931 | struct list_head rx_reqs_active; /* List of Active RX xfers */ | ||
2932 | struct list_head rx_buffers; /* List of completed xfers */ | ||
2933 | @@ -223,6 +224,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, | ||
2934 | |||
2935 | /*-------------------------------------------------------------------------*/ | ||
2936 | |||
2937 | +static void printer_dev_free(struct kref *kref) | ||
2938 | +{ | ||
2939 | + struct printer_dev *dev = container_of(kref, struct printer_dev, kref); | ||
2940 | + | ||
2941 | + kfree(dev); | ||
2942 | +} | ||
2943 | + | ||
2944 | static struct usb_request * | ||
2945 | printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags) | ||
2946 | { | ||
2947 | @@ -353,6 +361,7 @@ printer_open(struct inode *inode, struct file *fd) | ||
2948 | |||
2949 | spin_unlock_irqrestore(&dev->lock, flags); | ||
2950 | |||
2951 | + kref_get(&dev->kref); | ||
2952 | DBG(dev, "printer_open returned %x\n", ret); | ||
2953 | return ret; | ||
2954 | } | ||
2955 | @@ -370,6 +379,7 @@ printer_close(struct inode *inode, struct file *fd) | ||
2956 | dev->printer_status &= ~PRINTER_SELECTED; | ||
2957 | spin_unlock_irqrestore(&dev->lock, flags); | ||
2958 | |||
2959 | + kref_put(&dev->kref, printer_dev_free); | ||
2960 | DBG(dev, "printer_close\n"); | ||
2961 | |||
2962 | return 0; | ||
2963 | @@ -1320,7 +1330,8 @@ static void gprinter_free(struct usb_function *f) | ||
2964 | struct f_printer_opts *opts; | ||
2965 | |||
2966 | opts = container_of(f->fi, struct f_printer_opts, func_inst); | ||
2967 | - kfree(dev); | ||
2968 | + | ||
2969 | + kref_put(&dev->kref, printer_dev_free); | ||
2970 | mutex_lock(&opts->lock); | ||
2971 | --opts->refcnt; | ||
2972 | mutex_unlock(&opts->lock); | ||
2973 | @@ -1389,6 +1400,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi) | ||
2974 | return ERR_PTR(-ENOMEM); | ||
2975 | } | ||
2976 | |||
2977 | + kref_init(&dev->kref); | ||
2978 | ++opts->refcnt; | ||
2979 | dev->minor = opts->minor; | ||
2980 | dev->pnp_string = opts->pnp_string; | ||
2981 | diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c | ||
2982 | index d5fbc2352029b..589d1f5fb575a 100644 | ||
2983 | --- a/drivers/usb/gadget/function/u_ether.c | ||
2984 | +++ b/drivers/usb/gadget/function/u_ether.c | ||
2985 | @@ -97,7 +97,7 @@ struct eth_dev { | ||
2986 | static inline int qlen(struct usb_gadget *gadget, unsigned qmult) | ||
2987 | { | ||
2988 | if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH || | ||
2989 | - gadget->speed == USB_SPEED_SUPER)) | ||
2990 | + gadget->speed >= USB_SPEED_SUPER)) | ||
2991 | return qmult * DEFAULT_QLEN; | ||
2992 | else | ||
2993 | return DEFAULT_QLEN; | ||
2994 | diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c | ||
2995 | index 17f1cf02ce342..2a14c71739d7d 100644 | ||
2996 | --- a/drivers/usb/host/ohci-hcd.c | ||
2997 | +++ b/drivers/usb/host/ohci-hcd.c | ||
2998 | @@ -665,20 +665,24 @@ retry: | ||
2999 | |||
3000 | /* handle root hub init quirks ... */ | ||
3001 | val = roothub_a (ohci); | ||
3002 | - val &= ~(RH_A_PSM | RH_A_OCPM); | ||
3003 | + /* Configure for per-port over-current protection by default */ | ||
3004 | + val &= ~RH_A_NOCP; | ||
3005 | + val |= RH_A_OCPM; | ||
3006 | if (ohci->flags & OHCI_QUIRK_SUPERIO) { | ||
3007 | - /* NSC 87560 and maybe others */ | ||
3008 | + /* NSC 87560 and maybe others. | ||
3009 | + * Ganged power switching, no over-current protection. | ||
3010 | + */ | ||
3011 | val |= RH_A_NOCP; | ||
3012 | - val &= ~(RH_A_POTPGT | RH_A_NPS); | ||
3013 | - ohci_writel (ohci, val, &ohci->regs->roothub.a); | ||
3014 | + val &= ~(RH_A_POTPGT | RH_A_NPS | RH_A_PSM | RH_A_OCPM); | ||
3015 | } else if ((ohci->flags & OHCI_QUIRK_AMD756) || | ||
3016 | (ohci->flags & OHCI_QUIRK_HUB_POWER)) { | ||
3017 | /* hub power always on; required for AMD-756 and some | ||
3018 | - * Mac platforms. ganged overcurrent reporting, if any. | ||
3019 | + * Mac platforms. | ||
3020 | */ | ||
3021 | val |= RH_A_NPS; | ||
3022 | - ohci_writel (ohci, val, &ohci->regs->roothub.a); | ||
3023 | } | ||
3024 | + ohci_writel(ohci, val, &ohci->regs->roothub.a); | ||
3025 | + | ||
3026 | ohci_writel (ohci, RH_HS_LPSC, &ohci->regs->roothub.status); | ||
3027 | ohci_writel (ohci, (val & RH_A_NPS) ? 0 : RH_B_PPCM, | ||
3028 | &ohci->regs->roothub.b); | ||
3029 | diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c | ||
3030 | index bdfdd506bc588..c989f777bf771 100644 | ||
3031 | --- a/drivers/vfio/pci/vfio_pci_intrs.c | ||
3032 | +++ b/drivers/vfio/pci/vfio_pci_intrs.c | ||
3033 | @@ -355,11 +355,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, | ||
3034 | vdev->ctx[vector].producer.token = trigger; | ||
3035 | vdev->ctx[vector].producer.irq = irq; | ||
3036 | ret = irq_bypass_register_producer(&vdev->ctx[vector].producer); | ||
3037 | - if (unlikely(ret)) | ||
3038 | + if (unlikely(ret)) { | ||
3039 | dev_info(&pdev->dev, | ||
3040 | "irq bypass producer (token %p) registration fails: %d\n", | ||
3041 | vdev->ctx[vector].producer.token, ret); | ||
3042 | |||
3043 | + vdev->ctx[vector].producer.token = NULL; | ||
3044 | + } | ||
3045 | vdev->ctx[vector].trigger = trigger; | ||
3046 | |||
3047 | return 0; | ||
3048 | diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c | ||
3049 | index d414c7a3acf5a..a2f77625b7170 100644 | ||
3050 | --- a/drivers/video/backlight/sky81452-backlight.c | ||
3051 | +++ b/drivers/video/backlight/sky81452-backlight.c | ||
3052 | @@ -207,6 +207,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt( | ||
3053 | num_entry); | ||
3054 | if (ret < 0) { | ||
3055 | dev_err(dev, "led-sources node is invalid.\n"); | ||
3056 | + of_node_put(np); | ||
3057 | return ERR_PTR(-EINVAL); | ||
3058 | } | ||
3059 | |||
3060 | diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c | ||
3061 | index dfe3eb769638b..fde27feae5d0c 100644 | ||
3062 | --- a/drivers/video/fbdev/sis/init.c | ||
3063 | +++ b/drivers/video/fbdev/sis/init.c | ||
3064 | @@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, | ||
3065 | |||
3066 | i = 0; | ||
3067 | |||
3068 | + if (SiS_Pr->ChipType == SIS_730) | ||
3069 | + queuedata = &FQBQData730[0]; | ||
3070 | + else | ||
3071 | + queuedata = &FQBQData[0]; | ||
3072 | + | ||
3073 | if(ModeNo > 0x13) { | ||
3074 | |||
3075 | /* Get VCLK */ | ||
3076 | @@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, | ||
3077 | /* Get half colordepth */ | ||
3078 | colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)]; | ||
3079 | |||
3080 | - if(SiS_Pr->ChipType == SIS_730) { | ||
3081 | - queuedata = &FQBQData730[0]; | ||
3082 | - } else { | ||
3083 | - queuedata = &FQBQData[0]; | ||
3084 | - } | ||
3085 | - | ||
3086 | do { | ||
3087 | templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth; | ||
3088 | |||
3089 | diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c | ||
3090 | index ee6957a799bb6..aea8fd85cbf70 100644 | ||
3091 | --- a/drivers/video/fbdev/vga16fb.c | ||
3092 | +++ b/drivers/video/fbdev/vga16fb.c | ||
3093 | @@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info) | ||
3094 | } | ||
3095 | |||
3096 | static void vga16fb_clock_chip(struct vga16fb_par *par, | ||
3097 | - unsigned int pixclock, | ||
3098 | + unsigned int *pixclock, | ||
3099 | const struct fb_info *info, | ||
3100 | int mul, int div) | ||
3101 | { | ||
3102 | @@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, | ||
3103 | { 0 /* bad */, 0x00, 0x00}}; | ||
3104 | int err; | ||
3105 | |||
3106 | - pixclock = (pixclock * mul) / div; | ||
3107 | + *pixclock = (*pixclock * mul) / div; | ||
3108 | best = vgaclocks; | ||
3109 | - err = pixclock - best->pixclock; | ||
3110 | + err = *pixclock - best->pixclock; | ||
3111 | if (err < 0) err = -err; | ||
3112 | for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) { | ||
3113 | int tmp; | ||
3114 | |||
3115 | - tmp = pixclock - ptr->pixclock; | ||
3116 | + tmp = *pixclock - ptr->pixclock; | ||
3117 | if (tmp < 0) tmp = -tmp; | ||
3118 | if (tmp < err) { | ||
3119 | err = tmp; | ||
3120 | @@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, | ||
3121 | } | ||
3122 | par->misc |= best->misc; | ||
3123 | par->clkdiv = best->seq_clock_mode; | ||
3124 | - pixclock = (best->pixclock * div) / mul; | ||
3125 | + *pixclock = (best->pixclock * div) / mul; | ||
3126 | } | ||
3127 | |||
3128 | #define FAIL(X) return -EINVAL | ||
3129 | @@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var, | ||
3130 | |||
3131 | if (mode & MODE_8BPP) | ||
3132 | /* pixel clock == vga clock / 2 */ | ||
3133 | - vga16fb_clock_chip(par, var->pixclock, info, 1, 2); | ||
3134 | + vga16fb_clock_chip(par, &var->pixclock, info, 1, 2); | ||
3135 | else | ||
3136 | /* pixel clock == vga clock */ | ||
3137 | - vga16fb_clock_chip(par, var->pixclock, info, 1, 1); | ||
3138 | + vga16fb_clock_chip(par, &var->pixclock, info, 1, 1); | ||
3139 | |||
3140 | var->red.offset = var->green.offset = var->blue.offset = | ||
3141 | var->transp.offset = 0; | ||
3142 | diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c | ||
3143 | index 732e9abdcf969..29b9680035258 100644 | ||
3144 | --- a/drivers/virt/fsl_hypervisor.c | ||
3145 | +++ b/drivers/virt/fsl_hypervisor.c | ||
3146 | @@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) | ||
3147 | |||
3148 | unsigned int i; | ||
3149 | long ret = 0; | ||
3150 | - int num_pinned; /* return value from get_user_pages() */ | ||
3151 | + int num_pinned = 0; /* return value from get_user_pages_fast() */ | ||
3152 | phys_addr_t remote_paddr; /* The next address in the remote buffer */ | ||
3153 | uint32_t count; /* The number of bytes left to copy */ | ||
3154 | |||
3155 | @@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) | ||
3156 | return -EINVAL; | ||
3157 | |||
3158 | /* | ||
3159 | - * The array of pages returned by get_user_pages() covers only | ||
3160 | + * The array of pages returned by get_user_pages_fast() covers only | ||
3161 | * page-aligned memory. Since the user buffer is probably not | ||
3162 | * page-aligned, we need to handle the discrepancy. | ||
3163 | * | ||
3164 | @@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) | ||
3165 | |||
3166 | /* | ||
3167 | * 'pages' is an array of struct page pointers that's initialized by | ||
3168 | - * get_user_pages(). | ||
3169 | + * get_user_pages_fast(). | ||
3170 | */ | ||
3171 | pages = kzalloc(num_pages * sizeof(struct page *), GFP_KERNEL); | ||
3172 | if (!pages) { | ||
3173 | @@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) | ||
3174 | if (!sg_list_unaligned) { | ||
3175 | pr_debug("fsl-hv: could not allocate S/G list\n"); | ||
3176 | ret = -ENOMEM; | ||
3177 | - goto exit; | ||
3178 | + goto free_pages; | ||
3179 | } | ||
3180 | sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list)); | ||
3181 | |||
3182 | @@ -253,7 +253,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) | ||
3183 | up_read(¤t->mm->mmap_sem); | ||
3184 | |||
3185 | if (num_pinned != num_pages) { | ||
3186 | - /* get_user_pages() failed */ | ||
3187 | pr_debug("fsl-hv: could not lock source buffer\n"); | ||
3188 | ret = (num_pinned < 0) ? num_pinned : -EFAULT; | ||
3189 | goto exit; | ||
3190 | @@ -295,13 +294,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) | ||
3191 | virt_to_phys(sg_list), num_pages); | ||
3192 | |||
3193 | exit: | ||
3194 | - if (pages) { | ||
3195 | - for (i = 0; i < num_pages; i++) | ||
3196 | - if (pages[i]) | ||
3197 | - put_page(pages[i]); | ||
3198 | + if (pages && (num_pinned > 0)) { | ||
3199 | + for (i = 0; i < num_pinned; i++) | ||
3200 | + put_page(pages[i]); | ||
3201 | } | ||
3202 | |||
3203 | kfree(sg_list_unaligned); | ||
3204 | +free_pages: | ||
3205 | kfree(pages); | ||
3206 | |||
3207 | if (!ret) | ||
3208 | diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c | ||
3209 | index a3b56544c21b9..ae1f2817bd6a6 100644 | ||
3210 | --- a/fs/cifs/asn1.c | ||
3211 | +++ b/fs/cifs/asn1.c | ||
3212 | @@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, | ||
3213 | return 0; | ||
3214 | } else if ((cls != ASN1_CTX) || (con != ASN1_CON) | ||
3215 | || (tag != ASN1_EOC)) { | ||
3216 | - cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n", | ||
3217 | - cls, con, tag, end, *end); | ||
3218 | + cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n", | ||
3219 | + cls, con, tag, end); | ||
3220 | return 0; | ||
3221 | } | ||
3222 | |||
3223 | @@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, | ||
3224 | return 0; | ||
3225 | } else if ((cls != ASN1_UNI) || (con != ASN1_CON) | ||
3226 | || (tag != ASN1_SEQ)) { | ||
3227 | - cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n", | ||
3228 | - cls, con, tag, end, *end); | ||
3229 | + cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n", | ||
3230 | + cls, con, tag, end); | ||
3231 | return 0; | ||
3232 | } | ||
3233 | |||
3234 | @@ -563,8 +563,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, | ||
3235 | return 0; | ||
3236 | } else if ((cls != ASN1_CTX) || (con != ASN1_CON) | ||
3237 | || (tag != ASN1_EOC)) { | ||
3238 | - cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n", | ||
3239 | - cls, con, tag, end, *end); | ||
3240 | + cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n", | ||
3241 | + cls, con, tag, end); | ||
3242 | return 0; | ||
3243 | } | ||
3244 | |||
3245 | @@ -575,8 +575,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, | ||
3246 | return 0; | ||
3247 | } else if ((cls != ASN1_UNI) || (con != ASN1_CON) | ||
3248 | || (tag != ASN1_SEQ)) { | ||
3249 | - cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n", | ||
3250 | - cls, con, tag, end, *end); | ||
3251 | + cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n", | ||
3252 | + cls, con, tag, sequence_end); | ||
3253 | return 0; | ||
3254 | } | ||
3255 | |||
3256 | diff --git a/fs/dlm/config.c b/fs/dlm/config.c | ||
3257 | index df955d2209ce9..6def89d2209d3 100644 | ||
3258 | --- a/fs/dlm/config.c | ||
3259 | +++ b/fs/dlm/config.c | ||
3260 | @@ -218,6 +218,7 @@ struct dlm_space { | ||
3261 | struct list_head members; | ||
3262 | struct mutex members_lock; | ||
3263 | int members_count; | ||
3264 | + struct dlm_nodes *nds; | ||
3265 | }; | ||
3266 | |||
3267 | struct dlm_comms { | ||
3268 | @@ -426,6 +427,7 @@ static struct config_group *make_space(struct config_group *g, const char *name) | ||
3269 | INIT_LIST_HEAD(&sp->members); | ||
3270 | mutex_init(&sp->members_lock); | ||
3271 | sp->members_count = 0; | ||
3272 | + sp->nds = nds; | ||
3273 | return &sp->group; | ||
3274 | |||
3275 | fail: | ||
3276 | @@ -447,6 +449,7 @@ static void drop_space(struct config_group *g, struct config_item *i) | ||
3277 | static void release_space(struct config_item *i) | ||
3278 | { | ||
3279 | struct dlm_space *sp = config_item_to_space(i); | ||
3280 | + kfree(sp->nds); | ||
3281 | kfree(sp); | ||
3282 | } | ||
3283 | |||
3284 | diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c | ||
3285 | index 7c410f8794124..2aa073b82d30f 100644 | ||
3286 | --- a/fs/ntfs/inode.c | ||
3287 | +++ b/fs/ntfs/inode.c | ||
3288 | @@ -1844,6 +1844,12 @@ int ntfs_read_inode_mount(struct inode *vi) | ||
3289 | brelse(bh); | ||
3290 | } | ||
3291 | |||
3292 | + if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) { | ||
3293 | + ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.", | ||
3294 | + le32_to_cpu(m->bytes_allocated), vol->mft_record_size); | ||
3295 | + goto err_out; | ||
3296 | + } | ||
3297 | + | ||
3298 | /* Apply the mst fixups. */ | ||
3299 | if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) { | ||
3300 | /* FIXME: Try to use the $MFTMirr now. */ | ||
3301 | diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c | ||
3302 | index ca71bf881ad1e..4a39bb98f8ab5 100644 | ||
3303 | --- a/fs/quota/quota_v2.c | ||
3304 | +++ b/fs/quota/quota_v2.c | ||
3305 | @@ -266,6 +266,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot) | ||
3306 | d->dqb_curspace = cpu_to_le64(m->dqb_curspace); | ||
3307 | d->dqb_btime = cpu_to_le64(m->dqb_btime); | ||
3308 | d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id)); | ||
3309 | + d->dqb_pad = 0; | ||
3310 | if (qtree_entry_unused(info, dp)) | ||
3311 | d->dqb_itime = cpu_to_le64(1); | ||
3312 | } | ||
3313 | diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c | ||
3314 | index 897154e993800..f28999f717761 100644 | ||
3315 | --- a/fs/reiserfs/inode.c | ||
3316 | +++ b/fs/reiserfs/inode.c | ||
3317 | @@ -2166,7 +2166,8 @@ out_end_trans: | ||
3318 | out_inserted_sd: | ||
3319 | clear_nlink(inode); | ||
3320 | th->t_trans_id = 0; /* so the caller can't use this handle later */ | ||
3321 | - unlock_new_inode(inode); /* OK to do even if we hadn't locked it */ | ||
3322 | + if (inode->i_state & I_NEW) | ||
3323 | + unlock_new_inode(inode); | ||
3324 | iput(inode); | ||
3325 | return err; | ||
3326 | } | ||
3327 | diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c | ||
3328 | index 677608a89b08d..c533d8715a6ca 100644 | ||
3329 | --- a/fs/reiserfs/super.c | ||
3330 | +++ b/fs/reiserfs/super.c | ||
3331 | @@ -1234,6 +1234,10 @@ static int reiserfs_parse_options(struct super_block *s, | ||
3332 | "turned on."); | ||
3333 | return 0; | ||
3334 | } | ||
3335 | + if (qf_names[qtype] != | ||
3336 | + REISERFS_SB(s)->s_qf_names[qtype]) | ||
3337 | + kfree(qf_names[qtype]); | ||
3338 | + qf_names[qtype] = NULL; | ||
3339 | if (*arg) { /* Some filename specified? */ | ||
3340 | if (REISERFS_SB(s)->s_qf_names[qtype] | ||
3341 | && strcmp(REISERFS_SB(s)->s_qf_names[qtype], | ||
3342 | @@ -1263,10 +1267,6 @@ static int reiserfs_parse_options(struct super_block *s, | ||
3343 | else | ||
3344 | *mount_options |= 1 << REISERFS_GRPQUOTA; | ||
3345 | } else { | ||
3346 | - if (qf_names[qtype] != | ||
3347 | - REISERFS_SB(s)->s_qf_names[qtype]) | ||
3348 | - kfree(qf_names[qtype]); | ||
3349 | - qf_names[qtype] = NULL; | ||
3350 | if (qtype == USRQUOTA) | ||
3351 | *mount_options &= ~(1 << REISERFS_USRQUOTA); | ||
3352 | else | ||
3353 | diff --git a/fs/udf/inode.c b/fs/udf/inode.c | ||
3354 | index 9e66d85021fcb..149baf5f3d195 100644 | ||
3355 | --- a/fs/udf/inode.c | ||
3356 | +++ b/fs/udf/inode.c | ||
3357 | @@ -140,21 +140,24 @@ void udf_evict_inode(struct inode *inode) | ||
3358 | struct udf_inode_info *iinfo = UDF_I(inode); | ||
3359 | int want_delete = 0; | ||
3360 | |||
3361 | - if (!inode->i_nlink && !is_bad_inode(inode)) { | ||
3362 | - want_delete = 1; | ||
3363 | - udf_setsize(inode, 0); | ||
3364 | - udf_update_inode(inode, IS_SYNC(inode)); | ||
3365 | + if (!is_bad_inode(inode)) { | ||
3366 | + if (!inode->i_nlink) { | ||
3367 | + want_delete = 1; | ||
3368 | + udf_setsize(inode, 0); | ||
3369 | + udf_update_inode(inode, IS_SYNC(inode)); | ||
3370 | + } | ||
3371 | + if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && | ||
3372 | + inode->i_size != iinfo->i_lenExtents) { | ||
3373 | + udf_warn(inode->i_sb, | ||
3374 | + "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n", | ||
3375 | + inode->i_ino, inode->i_mode, | ||
3376 | + (unsigned long long)inode->i_size, | ||
3377 | + (unsigned long long)iinfo->i_lenExtents); | ||
3378 | + } | ||
3379 | } | ||
3380 | truncate_inode_pages_final(&inode->i_data); | ||
3381 | invalidate_inode_buffers(inode); | ||
3382 | clear_inode(inode); | ||
3383 | - if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && | ||
3384 | - inode->i_size != iinfo->i_lenExtents) { | ||
3385 | - udf_warn(inode->i_sb, "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n", | ||
3386 | - inode->i_ino, inode->i_mode, | ||
3387 | - (unsigned long long)inode->i_size, | ||
3388 | - (unsigned long long)iinfo->i_lenExtents); | ||
3389 | - } | ||
3390 | kfree(iinfo->i_ext.i_data); | ||
3391 | iinfo->i_ext.i_data = NULL; | ||
3392 | udf_clear_extent_cache(inode); | ||
3393 | diff --git a/fs/udf/super.c b/fs/udf/super.c | ||
3394 | index 4abdba453885e..c8c037e8e57b5 100644 | ||
3395 | --- a/fs/udf/super.c | ||
3396 | +++ b/fs/udf/super.c | ||
3397 | @@ -1391,6 +1391,12 @@ static int udf_load_sparable_map(struct super_block *sb, | ||
3398 | (int)spm->numSparingTables); | ||
3399 | return -EIO; | ||
3400 | } | ||
3401 | + if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) { | ||
3402 | + udf_err(sb, "error loading logical volume descriptor: " | ||
3403 | + "Too big sparing table size (%u)\n", | ||
3404 | + le32_to_cpu(spm->sizeSparingTable)); | ||
3405 | + return -EIO; | ||
3406 | + } | ||
3407 | |||
3408 | for (i = 0; i < spm->numSparingTables; i++) { | ||
3409 | loc = le32_to_cpu(spm->locSparingTable[i]); | ||
3410 | diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c | ||
3411 | index 0d93d3c10fcc4..d812f84252d5b 100644 | ||
3412 | --- a/fs/xfs/xfs_rtalloc.c | ||
3413 | +++ b/fs/xfs/xfs_rtalloc.c | ||
3414 | @@ -257,6 +257,9 @@ xfs_rtallocate_extent_block( | ||
3415 | end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1; | ||
3416 | i <= end; | ||
3417 | i++) { | ||
3418 | + /* Make sure we don't scan off the end of the rt volume. */ | ||
3419 | + maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i; | ||
3420 | + | ||
3421 | /* | ||
3422 | * See if there's a free extent of maxlen starting at i. | ||
3423 | * If it's not so then next will contain the first non-free. | ||
3424 | @@ -448,6 +451,14 @@ xfs_rtallocate_extent_near( | ||
3425 | */ | ||
3426 | if (bno >= mp->m_sb.sb_rextents) | ||
3427 | bno = mp->m_sb.sb_rextents - 1; | ||
3428 | + | ||
3429 | + /* Make sure we don't run off the end of the rt volume. */ | ||
3430 | + maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno; | ||
3431 | + if (maxlen < minlen) { | ||
3432 | + *rtblock = NULLRTBLOCK; | ||
3433 | + return 0; | ||
3434 | + } | ||
3435 | + | ||
3436 | /* | ||
3437 | * Try the exact allocation first. | ||
3438 | */ | ||
3439 | diff --git a/include/linux/overflow.h b/include/linux/overflow.h | ||
3440 | index 40b48e2133cb8..38a47cc62cf3a 100644 | ||
3441 | --- a/include/linux/overflow.h | ||
3442 | +++ b/include/linux/overflow.h | ||
3443 | @@ -3,6 +3,7 @@ | ||
3444 | #define __LINUX_OVERFLOW_H | ||
3445 | |||
3446 | #include <linux/compiler.h> | ||
3447 | +#include <linux/limits.h> | ||
3448 | |||
3449 | /* | ||
3450 | * In the fallback code below, we need to compute the minimum and | ||
3451 | diff --git a/include/net/ip.h b/include/net/ip.h | ||
3452 | index d577fb5647c5d..f987eaf999004 100644 | ||
3453 | --- a/include/net/ip.h | ||
3454 | +++ b/include/net/ip.h | ||
3455 | @@ -342,12 +342,18 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, | ||
3456 | bool forwarding) | ||
3457 | { | ||
3458 | struct net *net = dev_net(dst->dev); | ||
3459 | + unsigned int mtu; | ||
3460 | |||
3461 | if (net->ipv4.sysctl_ip_fwd_use_pmtu || | ||
3462 | ip_mtu_locked(dst) || | ||
3463 | !forwarding) | ||
3464 | return dst_mtu(dst); | ||
3465 | |||
3466 | + /* 'forwarding = true' case should always honour route mtu */ | ||
3467 | + mtu = dst_metric_raw(dst, RTAX_MTU); | ||
3468 | + if (mtu) | ||
3469 | + return mtu; | ||
3470 | + | ||
3471 | return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); | ||
3472 | } | ||
3473 | |||
3474 | diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h | ||
3475 | index 20bf7eaef05a0..d699fdc78cbb9 100644 | ||
3476 | --- a/include/scsi/scsi_common.h | ||
3477 | +++ b/include/scsi/scsi_common.h | ||
3478 | @@ -24,6 +24,13 @@ scsi_command_size(const unsigned char *cmnd) | ||
3479 | scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]); | ||
3480 | } | ||
3481 | |||
3482 | +static inline unsigned char | ||
3483 | +scsi_command_control(const unsigned char *cmnd) | ||
3484 | +{ | ||
3485 | + return (cmnd[0] == VARIABLE_LENGTH_CMD) ? | ||
3486 | + cmnd[1] : cmnd[COMMAND_SIZE(cmnd[0]) - 1]; | ||
3487 | +} | ||
3488 | + | ||
3489 | /* Returns a human-readable name for the device */ | ||
3490 | extern const char *scsi_device_type(unsigned type); | ||
3491 | |||
3492 | diff --git a/include/trace/events/target.h b/include/trace/events/target.h | ||
3493 | index 50fea660c0f89..d543e8b87e50a 100644 | ||
3494 | --- a/include/trace/events/target.h | ||
3495 | +++ b/include/trace/events/target.h | ||
3496 | @@ -139,6 +139,7 @@ TRACE_EVENT(target_sequencer_start, | ||
3497 | __field( unsigned int, opcode ) | ||
3498 | __field( unsigned int, data_length ) | ||
3499 | __field( unsigned int, task_attribute ) | ||
3500 | + __field( unsigned char, control ) | ||
3501 | __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) | ||
3502 | __string( initiator, cmd->se_sess->se_node_acl->initiatorname ) | ||
3503 | ), | ||
3504 | @@ -148,6 +149,7 @@ TRACE_EVENT(target_sequencer_start, | ||
3505 | __entry->opcode = cmd->t_task_cdb[0]; | ||
3506 | __entry->data_length = cmd->data_length; | ||
3507 | __entry->task_attribute = cmd->sam_task_attr; | ||
3508 | + __entry->control = scsi_command_control(cmd->t_task_cdb); | ||
3509 | memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE); | ||
3510 | __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname); | ||
3511 | ), | ||
3512 | @@ -157,9 +159,7 @@ TRACE_EVENT(target_sequencer_start, | ||
3513 | show_opcode_name(__entry->opcode), | ||
3514 | __entry->data_length, __print_hex(__entry->cdb, 16), | ||
3515 | show_task_attribute_name(__entry->task_attribute), | ||
3516 | - scsi_command_size(__entry->cdb) <= 16 ? | ||
3517 | - __entry->cdb[scsi_command_size(__entry->cdb) - 1] : | ||
3518 | - __entry->cdb[1] | ||
3519 | + __entry->control | ||
3520 | ) | ||
3521 | ); | ||
3522 | |||
3523 | @@ -174,6 +174,7 @@ TRACE_EVENT(target_cmd_complete, | ||
3524 | __field( unsigned int, opcode ) | ||
3525 | __field( unsigned int, data_length ) | ||
3526 | __field( unsigned int, task_attribute ) | ||
3527 | + __field( unsigned char, control ) | ||
3528 | __field( unsigned char, scsi_status ) | ||
3529 | __field( unsigned char, sense_length ) | ||
3530 | __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) | ||
3531 | @@ -186,6 +187,7 @@ TRACE_EVENT(target_cmd_complete, | ||
3532 | __entry->opcode = cmd->t_task_cdb[0]; | ||
3533 | __entry->data_length = cmd->data_length; | ||
3534 | __entry->task_attribute = cmd->sam_task_attr; | ||
3535 | + __entry->control = scsi_command_control(cmd->t_task_cdb); | ||
3536 | __entry->scsi_status = cmd->scsi_status; | ||
3537 | __entry->sense_length = cmd->scsi_status == SAM_STAT_CHECK_CONDITION ? | ||
3538 | min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0; | ||
3539 | @@ -202,9 +204,7 @@ TRACE_EVENT(target_cmd_complete, | ||
3540 | show_opcode_name(__entry->opcode), | ||
3541 | __entry->data_length, __print_hex(__entry->cdb, 16), | ||
3542 | show_task_attribute_name(__entry->task_attribute), | ||
3543 | - scsi_command_size(__entry->cdb) <= 16 ? | ||
3544 | - __entry->cdb[scsi_command_size(__entry->cdb) - 1] : | ||
3545 | - __entry->cdb[1] | ||
3546 | + __entry->control | ||
3547 | ) | ||
3548 | ); | ||
3549 | |||
3550 | diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c | ||
3551 | index cc892a9e109d8..ae39b014b7d6c 100644 | ||
3552 | --- a/kernel/debug/kdb/kdb_io.c | ||
3553 | +++ b/kernel/debug/kdb/kdb_io.c | ||
3554 | @@ -683,12 +683,16 @@ int vkdb_printf(enum kdb_msgsrc src, const char *fmt, va_list ap) | ||
3555 | size_avail = sizeof(kdb_buffer) - len; | ||
3556 | goto kdb_print_out; | ||
3557 | } | ||
3558 | - if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) | ||
3559 | + if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) { | ||
3560 | /* | ||
3561 | * This was a interactive search (using '/' at more | ||
3562 | - * prompt) and it has completed. Clear the flag. | ||
3563 | + * prompt) and it has completed. Replace the \0 with | ||
3564 | + * its original value to ensure multi-line strings | ||
3565 | + * are handled properly, and return to normal mode. | ||
3566 | */ | ||
3567 | + *cphold = replaced_byte; | ||
3568 | kdb_grepping_flag = 0; | ||
3569 | + } | ||
3570 | /* | ||
3571 | * at this point the string is a full line and | ||
3572 | * should be printed, up to the null. | ||
3573 | diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c | ||
3574 | index 3c775d6b7317f..7b393faf930f8 100644 | ||
3575 | --- a/kernel/power/hibernate.c | ||
3576 | +++ b/kernel/power/hibernate.c | ||
3577 | @@ -834,17 +834,6 @@ static int software_resume(void) | ||
3578 | |||
3579 | /* Check if the device is there */ | ||
3580 | swsusp_resume_device = name_to_dev_t(resume_file); | ||
3581 | - | ||
3582 | - /* | ||
3583 | - * name_to_dev_t is ineffective to verify parition if resume_file is in | ||
3584 | - * integer format. (e.g. major:minor) | ||
3585 | - */ | ||
3586 | - if (isdigit(resume_file[0]) && resume_wait) { | ||
3587 | - int partno; | ||
3588 | - while (!get_gendisk(swsusp_resume_device, &partno)) | ||
3589 | - msleep(10); | ||
3590 | - } | ||
3591 | - | ||
3592 | if (!swsusp_resume_device) { | ||
3593 | /* | ||
3594 | * Some device discovery might still be in progress; we need | ||
3595 | diff --git a/lib/crc32.c b/lib/crc32.c | ||
3596 | index 7fbd1a112b9d2..0d450462b0bd5 100644 | ||
3597 | --- a/lib/crc32.c | ||
3598 | +++ b/lib/crc32.c | ||
3599 | @@ -327,7 +327,7 @@ static inline u32 __pure crc32_be_generic(u32 crc, unsigned char const *p, | ||
3600 | return crc; | ||
3601 | } | ||
3602 | |||
3603 | -#if CRC_LE_BITS == 1 | ||
3604 | +#if CRC_BE_BITS == 1 | ||
3605 | u32 __pure crc32_be(u32 crc, unsigned char const *p, size_t len) | ||
3606 | { | ||
3607 | return crc32_be_generic(crc, p, len, NULL, CRCPOLY_BE); | ||
3608 | diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c | ||
3609 | index ab6b1788dbfc3..f46f59129bf39 100644 | ||
3610 | --- a/net/bluetooth/l2cap_sock.c | ||
3611 | +++ b/net/bluetooth/l2cap_sock.c | ||
3612 | @@ -1340,8 +1340,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) | ||
3613 | |||
3614 | parent = bt_sk(sk)->parent; | ||
3615 | |||
3616 | - sock_set_flag(sk, SOCK_ZAPPED); | ||
3617 | - | ||
3618 | switch (chan->state) { | ||
3619 | case BT_OPEN: | ||
3620 | case BT_BOUND: | ||
3621 | @@ -1368,8 +1366,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) | ||
3622 | |||
3623 | break; | ||
3624 | } | ||
3625 | - | ||
3626 | release_sock(sk); | ||
3627 | + | ||
3628 | + /* Only zap after cleanup to avoid use after free race */ | ||
3629 | + sock_set_flag(sk, SOCK_ZAPPED); | ||
3630 | + | ||
3631 | } | ||
3632 | |||
3633 | static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, | ||
3634 | diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c | ||
3635 | index cc5c8d598e5e8..9a21080e24560 100644 | ||
3636 | --- a/net/ipv4/icmp.c | ||
3637 | +++ b/net/ipv4/icmp.c | ||
3638 | @@ -246,7 +246,7 @@ static struct { | ||
3639 | /** | ||
3640 | * icmp_global_allow - Are we allowed to send one more ICMP message ? | ||
3641 | * | ||
3642 | - * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec. | ||
3643 | + * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec. | ||
3644 | * Returns false if we reached the limit and can not send another packet. | ||
3645 | * Note: called with BH disabled | ||
3646 | */ | ||
3647 | @@ -274,7 +274,10 @@ bool icmp_global_allow(void) | ||
3648 | } | ||
3649 | credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); | ||
3650 | if (credit) { | ||
3651 | - credit--; | ||
3652 | + /* We want to use a credit of one in average, but need to randomize | ||
3653 | + * it for security reasons. | ||
3654 | + */ | ||
3655 | + credit = max_t(int, credit - prandom_u32_max(3), 0); | ||
3656 | rc = true; | ||
3657 | } | ||
3658 | WRITE_ONCE(icmp_global.credit, credit); | ||
3659 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c | ||
3660 | index 23246d8a3eaea..d05135ea3c289 100644 | ||
3661 | --- a/net/ipv4/tcp_input.c | ||
3662 | +++ b/net/ipv4/tcp_input.c | ||
3663 | @@ -5598,6 +5598,8 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb, | ||
3664 | tcp_data_snd_check(sk); | ||
3665 | if (!inet_csk_ack_scheduled(sk)) | ||
3666 | goto no_ack; | ||
3667 | + } else { | ||
3668 | + tcp_update_wl(tp, TCP_SKB_CB(skb)->seq); | ||
3669 | } | ||
3670 | |||
3671 | __tcp_ack_snd_check(sk, 0); | ||
3672 | diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c | ||
3673 | index 33125fc009cfd..ba9e711f7e3d6 100644 | ||
3674 | --- a/net/netfilter/ipvs/ip_vs_ctl.c | ||
3675 | +++ b/net/netfilter/ipvs/ip_vs_ctl.c | ||
3676 | @@ -2424,6 +2424,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) | ||
3677 | /* Set timeout values for (tcp tcpfin udp) */ | ||
3678 | ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg); | ||
3679 | goto out_unlock; | ||
3680 | + } else if (!len) { | ||
3681 | + /* No more commands with len == 0 below */ | ||
3682 | + ret = -EINVAL; | ||
3683 | + goto out_unlock; | ||
3684 | } | ||
3685 | |||
3686 | usvc_compat = (struct ip_vs_service_user *)arg; | ||
3687 | @@ -2500,9 +2504,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) | ||
3688 | break; | ||
3689 | case IP_VS_SO_SET_DELDEST: | ||
3690 | ret = ip_vs_del_dest(svc, &udest); | ||
3691 | - break; | ||
3692 | - default: | ||
3693 | - ret = -EINVAL; | ||
3694 | } | ||
3695 | |||
3696 | out_unlock: | ||
3697 | diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c | ||
3698 | index e79a49fe61e88..0afae9f73ebb4 100644 | ||
3699 | --- a/net/nfc/netlink.c | ||
3700 | +++ b/net/nfc/netlink.c | ||
3701 | @@ -1227,7 +1227,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info) | ||
3702 | u32 idx; | ||
3703 | char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1]; | ||
3704 | |||
3705 | - if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) | ||
3706 | + if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME]) | ||
3707 | return -EINVAL; | ||
3708 | |||
3709 | idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); | ||
3710 | diff --git a/net/tipc/msg.c b/net/tipc/msg.c | ||
3711 | index ea554756a786d..41290fe810220 100644 | ||
3712 | --- a/net/tipc/msg.c | ||
3713 | +++ b/net/tipc/msg.c | ||
3714 | @@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) | ||
3715 | if (fragid == FIRST_FRAGMENT) { | ||
3716 | if (unlikely(head)) | ||
3717 | goto err; | ||
3718 | - frag = skb_unshare(frag, GFP_ATOMIC); | ||
3719 | + if (skb_cloned(frag)) | ||
3720 | + frag = skb_copy(frag, GFP_ATOMIC); | ||
3721 | if (unlikely(!frag)) | ||
3722 | goto err; | ||
3723 | head = *headbuf = frag; | ||
3724 | diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c | ||
3725 | index 1eb77161d5e64..5bd89f536720d 100644 | ||
3726 | --- a/net/wireless/nl80211.c | ||
3727 | +++ b/net/wireless/nl80211.c | ||
3728 | @@ -1749,7 +1749,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, | ||
3729 | * case we'll continue with more data in the next round, | ||
3730 | * but break unconditionally so unsplit data stops here. | ||
3731 | */ | ||
3732 | - state->split_start++; | ||
3733 | + if (state->split) | ||
3734 | + state->split_start++; | ||
3735 | + else | ||
3736 | + state->split_start = 0; | ||
3737 | break; | ||
3738 | case 9: | ||
3739 | if (rdev->wiphy.extended_capabilities && | ||
3740 | diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c | ||
3741 | index 49db1def1721c..84e583ab8fd0c 100644 | ||
3742 | --- a/samples/mic/mpssd/mpssd.c | ||
3743 | +++ b/samples/mic/mpssd/mpssd.c | ||
3744 | @@ -414,9 +414,9 @@ mic_virtio_copy(struct mic_info *mic, int fd, | ||
3745 | |||
3746 | static inline unsigned _vring_size(unsigned int num, unsigned long align) | ||
3747 | { | ||
3748 | - return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num) | ||
3749 | + return _ALIGN_UP(((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num) | ||
3750 | + align - 1) & ~(align - 1)) | ||
3751 | - + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num; | ||
3752 | + + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num, 4); | ||
3753 | } | ||
3754 | |||
3755 | /* | ||
3756 | diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c | ||
3757 | index 5155c343406e0..170f12031ae5f 100644 | ||
3758 | --- a/security/integrity/ima/ima_crypto.c | ||
3759 | +++ b/security/integrity/ima/ima_crypto.c | ||
3760 | @@ -683,6 +683,8 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest, | ||
3761 | ima_pcrread(i, pcr_i); | ||
3762 | /* now accumulate with current aggregate */ | ||
3763 | rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE); | ||
3764 | + if (rc != 0) | ||
3765 | + return rc; | ||
3766 | } | ||
3767 | if (!rc) | ||
3768 | crypto_shash_final(shash, digest); | ||
3769 | diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c | ||
3770 | index 4b78979599131..ade880fe24a41 100644 | ||
3771 | --- a/sound/core/seq/oss/seq_oss.c | ||
3772 | +++ b/sound/core/seq/oss/seq_oss.c | ||
3773 | @@ -187,9 +187,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) | ||
3774 | if (snd_BUG_ON(!dp)) | ||
3775 | return -ENXIO; | ||
3776 | |||
3777 | - mutex_lock(®ister_mutex); | ||
3778 | + if (cmd != SNDCTL_SEQ_SYNC && | ||
3779 | + mutex_lock_interruptible(®ister_mutex)) | ||
3780 | + return -ERESTARTSYS; | ||
3781 | rc = snd_seq_oss_ioctl(dp, cmd, arg); | ||
3782 | - mutex_unlock(®ister_mutex); | ||
3783 | + if (cmd != SNDCTL_SEQ_SYNC) | ||
3784 | + mutex_unlock(®ister_mutex); | ||
3785 | return rc; | ||
3786 | } | ||
3787 | |||
3788 | diff --git a/sound/firewire/bebob/bebob_hwdep.c b/sound/firewire/bebob/bebob_hwdep.c | ||
3789 | index ce731f4d8b4f5..733ba42e24622 100644 | ||
3790 | --- a/sound/firewire/bebob/bebob_hwdep.c | ||
3791 | +++ b/sound/firewire/bebob/bebob_hwdep.c | ||
3792 | @@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, | ||
3793 | } | ||
3794 | |||
3795 | memset(&event, 0, sizeof(event)); | ||
3796 | + count = min_t(long, count, sizeof(event.lock_status)); | ||
3797 | if (bebob->dev_lock_changed) { | ||
3798 | event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; | ||
3799 | event.lock_status.status = (bebob->dev_lock_count > 0); | ||
3800 | bebob->dev_lock_changed = false; | ||
3801 | - | ||
3802 | - count = min_t(long, count, sizeof(event.lock_status)); | ||
3803 | } | ||
3804 | |||
3805 | spin_unlock_irq(&bebob->lock); | ||
3806 | diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c | ||
3807 | index 420d200f9a053..eeed53cf325ac 100644 | ||
3808 | --- a/sound/soc/qcom/lpass-platform.c | ||
3809 | +++ b/sound/soc/qcom/lpass-platform.c | ||
3810 | @@ -68,7 +68,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream) | ||
3811 | int ret, dma_ch, dir = substream->stream; | ||
3812 | struct lpass_pcm_data *data; | ||
3813 | |||
3814 | - data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL); | ||
3815 | + data = kzalloc(sizeof(*data), GFP_KERNEL); | ||
3816 | if (!data) | ||
3817 | return -ENOMEM; | ||
3818 | |||
3819 | @@ -140,6 +140,7 @@ static int lpass_platform_pcmops_close(struct snd_pcm_substream *substream) | ||
3820 | if (v->free_dma_channel) | ||
3821 | v->free_dma_channel(drvdata, dma_ch); | ||
3822 | |||
3823 | + kfree(data); | ||
3824 | return 0; | ||
3825 | } | ||
3826 | |||
3827 | diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c | ||
3828 | index 24c6621e2d951..54790a09d1582 100644 | ||
3829 | --- a/tools/perf/util/intel-pt.c | ||
3830 | +++ b/tools/perf/util/intel-pt.c | ||
3831 | @@ -873,6 +873,8 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt, | ||
3832 | |||
3833 | if (queue->tid == -1 || pt->have_sched_switch) { | ||
3834 | ptq->tid = machine__get_current_tid(pt->machine, ptq->cpu); | ||
3835 | + if (ptq->tid == -1) | ||
3836 | + ptq->pid = -1; | ||
3837 | thread__zput(ptq->thread); | ||
3838 | } | ||
3839 | |||
3840 | @@ -1732,10 +1734,8 @@ static int intel_pt_context_switch(struct intel_pt *pt, union perf_event *event, | ||
3841 | tid = sample->tid; | ||
3842 | } | ||
3843 | |||
3844 | - if (tid == -1) { | ||
3845 | - pr_err("context_switch event has no tid\n"); | ||
3846 | - return -EINVAL; | ||
3847 | - } | ||
3848 | + if (tid == -1) | ||
3849 | + intel_pt_log("context_switch event has no tid\n"); | ||
3850 | |||
3851 | intel_pt_log("context_switch: cpu %d pid %d tid %d time %"PRIu64" tsc %#"PRIx64"\n", | ||
3852 | cpu, pid, tid, sample->time, perf_time_to_tsc(sample->time, |