Contents of /trunk/kernel-alx-legacy/patches-4.9/0352-4.9.253-all-fixes.patch
Parent Directory | Revision Log
Revision 3654 -
(show annotations)
(download)
Mon Oct 24 14:07:33 2022 UTC (23 months ago) by niro
File size: 26159 byte(s)
Mon Oct 24 14:07:33 2022 UTC (23 months ago) by niro
File size: 26159 byte(s)
-linux-4.9.253
1 | diff --git a/Makefile b/Makefile |
2 | index 2213fe336705f..62a07bdcfacb7 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 252 |
9 | +SUBLEVEL = 253 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/arc/Makefile b/arch/arc/Makefile |
14 | index fd79faab78926..5dc2d73c64994 100644 |
15 | --- a/arch/arc/Makefile |
16 | +++ b/arch/arc/Makefile |
17 | @@ -108,6 +108,7 @@ bootpImage: vmlinux |
18 | |
19 | boot_targets += uImage uImage.bin uImage.gz |
20 | |
21 | +PHONY += $(boot_targets) |
22 | $(boot_targets): vmlinux |
23 | $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@ |
24 | |
25 | diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h |
26 | index ffb5f33475f19..f0f43eb709d2f 100644 |
27 | --- a/arch/arc/include/asm/page.h |
28 | +++ b/arch/arc/include/asm/page.h |
29 | @@ -13,6 +13,7 @@ |
30 | #ifndef __ASSEMBLY__ |
31 | |
32 | #define clear_page(paddr) memset((paddr), 0, PAGE_SIZE) |
33 | +#define copy_user_page(to, from, vaddr, pg) copy_page(to, from) |
34 | #define copy_page(to, from) memcpy((to), (from), PAGE_SIZE) |
35 | |
36 | struct vm_area_struct; |
37 | diff --git a/arch/arm/boot/dts/picoxcell-pc3x2.dtsi b/arch/arm/boot/dts/picoxcell-pc3x2.dtsi |
38 | index 533919e96eaee..f22a6b4363177 100644 |
39 | --- a/arch/arm/boot/dts/picoxcell-pc3x2.dtsi |
40 | +++ b/arch/arm/boot/dts/picoxcell-pc3x2.dtsi |
41 | @@ -54,18 +54,21 @@ |
42 | emac: gem@30000 { |
43 | compatible = "cadence,gem"; |
44 | reg = <0x30000 0x10000>; |
45 | + interrupt-parent = <&vic0>; |
46 | interrupts = <31>; |
47 | }; |
48 | |
49 | dmac1: dmac@40000 { |
50 | compatible = "snps,dw-dmac"; |
51 | reg = <0x40000 0x10000>; |
52 | + interrupt-parent = <&vic0>; |
53 | interrupts = <25>; |
54 | }; |
55 | |
56 | dmac2: dmac@50000 { |
57 | compatible = "snps,dw-dmac"; |
58 | reg = <0x50000 0x10000>; |
59 | + interrupt-parent = <&vic0>; |
60 | interrupts = <26>; |
61 | }; |
62 | |
63 | @@ -243,6 +246,7 @@ |
64 | axi2pico@c0000000 { |
65 | compatible = "picochip,axi2pico-pc3x2"; |
66 | reg = <0xc0000000 0x10000>; |
67 | + interrupt-parent = <&vic0>; |
68 | interrupts = <13 14 15 16 17 18 19 20 21>; |
69 | }; |
70 | }; |
71 | diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c |
72 | index fdf99e9dd4c39..3a015e41b762b 100644 |
73 | --- a/arch/mips/boot/compressed/decompress.c |
74 | +++ b/arch/mips/boot/compressed/decompress.c |
75 | @@ -17,6 +17,7 @@ |
76 | #include <linux/libfdt.h> |
77 | |
78 | #include <asm/addrspace.h> |
79 | +#include <asm/unaligned.h> |
80 | |
81 | /* |
82 | * These two variables specify the free mem region |
83 | @@ -124,7 +125,7 @@ void decompress_kernel(unsigned long boot_heap_start) |
84 | dtb_size = fdt_totalsize((void *)&__appended_dtb); |
85 | |
86 | /* last four bytes is always image size in little endian */ |
87 | - image_size = le32_to_cpup((void *)&__image_end - 4); |
88 | + image_size = get_unaligned_le32((void *)&__image_end - 4); |
89 | |
90 | /* copy dtb to where the booted kernel will expect it */ |
91 | memcpy((void *)VMLINUX_LOAD_ADDRESS_ULL + image_size, |
92 | diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c |
93 | index 1958910b75c07..b4a7c303019b0 100644 |
94 | --- a/arch/mips/kernel/relocate.c |
95 | +++ b/arch/mips/kernel/relocate.c |
96 | @@ -175,8 +175,14 @@ static int __init relocate_exception_table(long offset) |
97 | static inline __init unsigned long rotate_xor(unsigned long hash, |
98 | const void *area, size_t size) |
99 | { |
100 | - size_t i; |
101 | - unsigned long *ptr = (unsigned long *)area; |
102 | + const typeof(hash) *ptr = PTR_ALIGN(area, sizeof(hash)); |
103 | + size_t diff, i; |
104 | + |
105 | + diff = (void *)ptr - area; |
106 | + if (unlikely(size < diff + sizeof(hash))) |
107 | + return hash; |
108 | + |
109 | + size = ALIGN_DOWN(size - diff, sizeof(hash)); |
110 | |
111 | for (i = 0; i < size / sizeof(hash); i++) { |
112 | /* Rotate by odd number of bits and XOR. */ |
113 | diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h |
114 | index b012e94b7d9f9..eae0b278d5172 100644 |
115 | --- a/drivers/acpi/internal.h |
116 | +++ b/drivers/acpi/internal.h |
117 | @@ -98,7 +98,7 @@ void acpi_scan_table_handler(u32 event, void *table, void *context); |
118 | extern struct list_head acpi_bus_id_list; |
119 | |
120 | struct acpi_device_bus_id { |
121 | - char bus_id[15]; |
122 | + const char *bus_id; |
123 | unsigned int instance_no; |
124 | struct list_head node; |
125 | }; |
126 | diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c |
127 | index 9a7f017dda47f..f49e2b7880ac2 100644 |
128 | --- a/drivers/acpi/scan.c |
129 | +++ b/drivers/acpi/scan.c |
130 | @@ -485,6 +485,7 @@ static void acpi_device_del(struct acpi_device *device) |
131 | acpi_device_bus_id->instance_no--; |
132 | else { |
133 | list_del(&acpi_device_bus_id->node); |
134 | + kfree_const(acpi_device_bus_id->bus_id); |
135 | kfree(acpi_device_bus_id); |
136 | } |
137 | break; |
138 | @@ -673,7 +674,14 @@ int acpi_device_add(struct acpi_device *device, |
139 | } |
140 | if (!found) { |
141 | acpi_device_bus_id = new_bus_id; |
142 | - strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); |
143 | + acpi_device_bus_id->bus_id = |
144 | + kstrdup_const(acpi_device_hid(device), GFP_KERNEL); |
145 | + if (!acpi_device_bus_id->bus_id) { |
146 | + pr_err(PREFIX "Memory allocation error for bus id\n"); |
147 | + result = -ENOMEM; |
148 | + goto err_free_new_bus_id; |
149 | + } |
150 | + |
151 | acpi_device_bus_id->instance_no = 0; |
152 | list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); |
153 | } |
154 | @@ -708,6 +716,11 @@ int acpi_device_add(struct acpi_device *device, |
155 | if (device->parent) |
156 | list_del(&device->node); |
157 | list_del(&device->wakeup_list); |
158 | + |
159 | + err_free_new_bus_id: |
160 | + if (!found) |
161 | + kfree(new_bus_id); |
162 | + |
163 | mutex_unlock(&acpi_device_lock); |
164 | |
165 | err_detach: |
166 | diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c |
167 | index cacb720f44a02..2896808545f43 100644 |
168 | --- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c |
169 | +++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c |
170 | @@ -180,6 +180,7 @@ find_free_vf_and_create_qp_grp(struct usnic_ib_dev *us_ibdev, |
171 | |
172 | } |
173 | usnic_uiom_free_dev_list(dev_list); |
174 | + dev_list = NULL; |
175 | } |
176 | |
177 | if (!found) { |
178 | @@ -207,6 +208,8 @@ find_free_vf_and_create_qp_grp(struct usnic_ib_dev *us_ibdev, |
179 | spin_unlock(&vf->lock); |
180 | if (IS_ERR_OR_NULL(qp_grp)) { |
181 | usnic_err("Failed to allocate qp_grp\n"); |
182 | + if (usnic_ib_share_vf) |
183 | + usnic_uiom_free_dev_list(dev_list); |
184 | return ERR_PTR(qp_grp ? PTR_ERR(qp_grp) : -ENOMEM); |
185 | } |
186 | |
187 | diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c |
188 | index 8f2042432c851..66a46c84e28f5 100644 |
189 | --- a/drivers/input/ff-core.c |
190 | +++ b/drivers/input/ff-core.c |
191 | @@ -237,9 +237,15 @@ int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file) |
192 | EXPORT_SYMBOL_GPL(input_ff_erase); |
193 | |
194 | /* |
195 | - * flush_effects - erase all effects owned by a file handle |
196 | + * input_ff_flush - erase all effects owned by a file handle |
197 | + * @dev: input device to erase effect from |
198 | + * @file: purported owner of the effects |
199 | + * |
200 | + * This function erases all force-feedback effects associated with |
201 | + * the given owner from specified device. Note that @file may be %NULL, |
202 | + * in which case all effects will be erased. |
203 | */ |
204 | -static int flush_effects(struct input_dev *dev, struct file *file) |
205 | +int input_ff_flush(struct input_dev *dev, struct file *file) |
206 | { |
207 | struct ff_device *ff = dev->ff; |
208 | int i; |
209 | @@ -255,6 +261,7 @@ static int flush_effects(struct input_dev *dev, struct file *file) |
210 | |
211 | return 0; |
212 | } |
213 | +EXPORT_SYMBOL_GPL(input_ff_flush); |
214 | |
215 | /** |
216 | * input_ff_event() - generic handler for force-feedback events |
217 | @@ -343,7 +350,7 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects) |
218 | mutex_init(&ff->mutex); |
219 | |
220 | dev->ff = ff; |
221 | - dev->flush = flush_effects; |
222 | + dev->flush = input_ff_flush; |
223 | dev->event = input_ff_event; |
224 | __set_bit(EV_FF, dev->evbit); |
225 | |
226 | diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c |
227 | index 89d37d0d45ed5..fcd10a4708c3e 100644 |
228 | --- a/drivers/input/misc/uinput.c |
229 | +++ b/drivers/input/misc/uinput.c |
230 | @@ -231,6 +231,18 @@ static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id) |
231 | return uinput_request_submit(udev, &request); |
232 | } |
233 | |
234 | +static int uinput_dev_flush(struct input_dev *dev, struct file *file) |
235 | +{ |
236 | + /* |
237 | + * If we are called with file == NULL that means we are tearing |
238 | + * down the device, and therefore we can not handle FF erase |
239 | + * requests: either we are handling UI_DEV_DESTROY (and holding |
240 | + * the udev->mutex), or the file descriptor is closed and there is |
241 | + * nobody on the other side anymore. |
242 | + */ |
243 | + return file ? input_ff_flush(dev, file) : 0; |
244 | +} |
245 | + |
246 | static void uinput_destroy_device(struct uinput_device *udev) |
247 | { |
248 | const char *name, *phys; |
249 | @@ -298,6 +310,12 @@ static int uinput_create_device(struct uinput_device *udev) |
250 | dev->ff->playback = uinput_dev_playback; |
251 | dev->ff->set_gain = uinput_dev_set_gain; |
252 | dev->ff->set_autocenter = uinput_dev_set_autocenter; |
253 | + /* |
254 | + * The standard input_ff_flush() implementation does |
255 | + * not quite work for uinput as we can't reasonably |
256 | + * handle FF requests during device teardown. |
257 | + */ |
258 | + dev->flush = uinput_dev_flush; |
259 | } |
260 | |
261 | error = input_register_device(udev->dev); |
262 | diff --git a/drivers/isdn/mISDN/Kconfig b/drivers/isdn/mISDN/Kconfig |
263 | index c0730d5c734d6..fb61181a5c4f7 100644 |
264 | --- a/drivers/isdn/mISDN/Kconfig |
265 | +++ b/drivers/isdn/mISDN/Kconfig |
266 | @@ -12,6 +12,7 @@ if MISDN != n |
267 | config MISDN_DSP |
268 | tristate "Digital Audio Processing of transparent data" |
269 | depends on MISDN |
270 | + select BITREVERSE |
271 | help |
272 | Enable support for digital audio processing capability. |
273 | |
274 | diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c |
275 | index 1f015edcca227..3c6fc61597f7e 100644 |
276 | --- a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c |
277 | +++ b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c |
278 | @@ -223,3 +223,4 @@ static struct platform_driver fs_enet_bb_mdio_driver = { |
279 | }; |
280 | |
281 | module_platform_driver(fs_enet_bb_mdio_driver); |
282 | +MODULE_LICENSE("GPL"); |
283 | diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c |
284 | index a89267b94352a..fb2b0586469b2 100644 |
285 | --- a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c |
286 | +++ b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c |
287 | @@ -224,3 +224,4 @@ static struct platform_driver fs_enet_fec_mdio_driver = { |
288 | }; |
289 | |
290 | module_platform_driver(fs_enet_fec_mdio_driver); |
291 | +MODULE_LICENSE("GPL"); |
292 | diff --git a/drivers/net/ethernet/freescale/ucc_geth.h b/drivers/net/ethernet/freescale/ucc_geth.h |
293 | index 5da19b440a6a8..bf25e49d4fe34 100644 |
294 | --- a/drivers/net/ethernet/freescale/ucc_geth.h |
295 | +++ b/drivers/net/ethernet/freescale/ucc_geth.h |
296 | @@ -580,7 +580,14 @@ struct ucc_geth_tx_global_pram { |
297 | u32 vtagtable[0x8]; /* 8 4-byte VLAN tags */ |
298 | u32 tqptr; /* a base pointer to the Tx Queues Memory |
299 | Region */ |
300 | - u8 res2[0x80 - 0x74]; |
301 | + u8 res2[0x78 - 0x74]; |
302 | + u64 snums_en; |
303 | + u32 l2l3baseptr; /* top byte consists of a few other bit fields */ |
304 | + |
305 | + u16 mtu[8]; |
306 | + u8 res3[0xa8 - 0x94]; |
307 | + u32 wrrtablebase; /* top byte is reserved */ |
308 | + u8 res4[0xc0 - 0xac]; |
309 | } __packed; |
310 | |
311 | /* structure representing Extended Filtering Global Parameters in PRAM */ |
312 | diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c |
313 | index 7a0281a36c281..a5ee3d328f3d6 100644 |
314 | --- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c |
315 | +++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c |
316 | @@ -586,11 +586,6 @@ static const struct net_device_ops netxen_netdev_ops = { |
317 | #endif |
318 | }; |
319 | |
320 | -static inline bool netxen_function_zero(struct pci_dev *pdev) |
321 | -{ |
322 | - return (PCI_FUNC(pdev->devfn) == 0) ? true : false; |
323 | -} |
324 | - |
325 | static inline void netxen_set_interrupt_mode(struct netxen_adapter *adapter, |
326 | u32 mode) |
327 | { |
328 | @@ -686,7 +681,7 @@ static int netxen_setup_intr(struct netxen_adapter *adapter) |
329 | netxen_initialize_interrupt_registers(adapter); |
330 | netxen_set_msix_bit(pdev, 0); |
331 | |
332 | - if (netxen_function_zero(pdev)) { |
333 | + if (adapter->portnum == 0) { |
334 | if (!netxen_setup_msi_interrupts(adapter, num_msix)) |
335 | netxen_set_interrupt_mode(adapter, NETXEN_MSI_MODE); |
336 | else |
337 | diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c |
338 | index 99ca9526dd65a..d418542924e16 100644 |
339 | --- a/drivers/net/usb/cdc_ncm.c |
340 | +++ b/drivers/net/usb/cdc_ncm.c |
341 | @@ -1128,7 +1128,10 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) |
342 | * accordingly. Otherwise, we should check here. |
343 | */ |
344 | if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) |
345 | - delayed_ndp_size = ALIGN(ctx->max_ndp_size, ctx->tx_ndp_modulus); |
346 | + delayed_ndp_size = ctx->max_ndp_size + |
347 | + max_t(u32, |
348 | + ctx->tx_ndp_modulus, |
349 | + ctx->tx_modulus + ctx->tx_remainder) - 1; |
350 | else |
351 | delayed_ndp_size = 0; |
352 | |
353 | @@ -1281,7 +1284,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) |
354 | if (!(dev->driver_info->flags & FLAG_SEND_ZLP) && |
355 | skb_out->len > ctx->min_tx_pkt) { |
356 | padding_count = ctx->tx_max - skb_out->len; |
357 | - memset(skb_put(skb_out, padding_count), 0, padding_count); |
358 | + if (!WARN_ON(padding_count > ctx->tx_max)) |
359 | + memset(skb_put(skb_out, padding_count), 0, padding_count); |
360 | } else if (skb_out->len < ctx->tx_max && |
361 | (skb_out->len % dev->maxpacket) == 0) { |
362 | *skb_put(skb_out, 1) = 0; /* force short packet */ |
363 | diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c |
364 | index 9ccbdf1431063..dc5b8e69f8e86 100644 |
365 | --- a/drivers/net/usb/rndis_host.c |
366 | +++ b/drivers/net/usb/rndis_host.c |
367 | @@ -398,7 +398,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) |
368 | reply_len = sizeof *phym; |
369 | retval = rndis_query(dev, intf, u.buf, |
370 | RNDIS_OID_GEN_PHYSICAL_MEDIUM, |
371 | - 0, (void **) &phym, &reply_len); |
372 | + reply_len, (void **)&phym, &reply_len); |
373 | if (retval != 0 || !phym) { |
374 | /* OID is optional so don't fail here. */ |
375 | phym_unspec = cpu_to_le32(RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED); |
376 | diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c |
377 | index 1c57ce64abba0..e383c63689157 100644 |
378 | --- a/drivers/spi/spi-cadence.c |
379 | +++ b/drivers/spi/spi-cadence.c |
380 | @@ -118,6 +118,7 @@ struct cdns_spi { |
381 | void __iomem *regs; |
382 | struct clk *ref_clk; |
383 | struct clk *pclk; |
384 | + unsigned int clk_rate; |
385 | u32 speed_hz; |
386 | const u8 *txbuf; |
387 | u8 *rxbuf; |
388 | @@ -253,7 +254,7 @@ static void cdns_spi_config_clock_freq(struct spi_device *spi, |
389 | u32 ctrl_reg, baud_rate_val; |
390 | unsigned long frequency; |
391 | |
392 | - frequency = clk_get_rate(xspi->ref_clk); |
393 | + frequency = xspi->clk_rate; |
394 | |
395 | ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR); |
396 | |
397 | @@ -558,8 +559,9 @@ static int cdns_spi_probe(struct platform_device *pdev) |
398 | master->auto_runtime_pm = true; |
399 | master->mode_bits = SPI_CPOL | SPI_CPHA; |
400 | |
401 | + xspi->clk_rate = clk_get_rate(xspi->ref_clk); |
402 | /* Set to default valid value */ |
403 | - master->max_speed_hz = clk_get_rate(xspi->ref_clk) / 4; |
404 | + master->max_speed_hz = xspi->clk_rate / 4; |
405 | xspi->speed_hz = master->max_speed_hz; |
406 | |
407 | master->bits_per_word_mask = SPI_BPW_MASK(8); |
408 | diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c |
409 | index 2a14c71739d7d..c1c7df26d62f2 100644 |
410 | --- a/drivers/usb/host/ohci-hcd.c |
411 | +++ b/drivers/usb/host/ohci-hcd.c |
412 | @@ -100,7 +100,7 @@ static void io_watchdog_func(unsigned long _ohci); |
413 | |
414 | |
415 | /* Some boards misreport power switching/overcurrent */ |
416 | -static bool distrust_firmware = true; |
417 | +static bool distrust_firmware; |
418 | module_param (distrust_firmware, bool, 0); |
419 | MODULE_PARM_DESC (distrust_firmware, |
420 | "true to distrust firmware power/overcurrent setup"); |
421 | diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c |
422 | index 2016f5a5d3cf1..75fff707beb6a 100644 |
423 | --- a/fs/ext4/ioctl.c |
424 | +++ b/fs/ext4/ioctl.c |
425 | @@ -799,7 +799,10 @@ resizefs_out: |
426 | err = ext4_journal_get_write_access(handle, sbi->s_sbh); |
427 | if (err) |
428 | goto pwsalt_err_journal; |
429 | + lock_buffer(sbi->s_sbh); |
430 | generate_random_uuid(sbi->s_es->s_encrypt_pw_salt); |
431 | + ext4_superblock_csum_set(sb); |
432 | + unlock_buffer(sbi->s_sbh); |
433 | err = ext4_handle_dirty_metadata(handle, NULL, |
434 | sbi->s_sbh); |
435 | pwsalt_err_journal: |
436 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c |
437 | index 8ded38ac4cdef..6224b0e6fb643 100644 |
438 | --- a/fs/ext4/namei.c |
439 | +++ b/fs/ext4/namei.c |
440 | @@ -3421,8 +3421,6 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent, |
441 | return retval; |
442 | } |
443 | } |
444 | - brelse(ent->bh); |
445 | - ent->bh = NULL; |
446 | |
447 | return 0; |
448 | } |
449 | @@ -3635,6 +3633,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, |
450 | } |
451 | } |
452 | |
453 | + old_file_type = old.de->file_type; |
454 | if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir)) |
455 | ext4_handle_sync(handle); |
456 | |
457 | @@ -3662,7 +3661,6 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, |
458 | force_reread = (new.dir->i_ino == old.dir->i_ino && |
459 | ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA)); |
460 | |
461 | - old_file_type = old.de->file_type; |
462 | if (whiteout) { |
463 | /* |
464 | * Do this before adding a new entry, so the old entry is sure |
465 | @@ -3734,15 +3732,19 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, |
466 | retval = 0; |
467 | |
468 | end_rename: |
469 | - brelse(old.dir_bh); |
470 | - brelse(old.bh); |
471 | - brelse(new.bh); |
472 | if (whiteout) { |
473 | - if (retval) |
474 | + if (retval) { |
475 | + ext4_setent(handle, &old, |
476 | + old.inode->i_ino, old_file_type); |
477 | drop_nlink(whiteout); |
478 | + } |
479 | unlock_new_inode(whiteout); |
480 | iput(whiteout); |
481 | + |
482 | } |
483 | + brelse(old.dir_bh); |
484 | + brelse(old.bh); |
485 | + brelse(new.bh); |
486 | if (handle) |
487 | ext4_journal_stop(handle); |
488 | return retval; |
489 | diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h |
490 | index 52ea41bce0383..e0f0397fc7ce2 100644 |
491 | --- a/fs/nfs/internal.h |
492 | +++ b/fs/nfs/internal.h |
493 | @@ -572,12 +572,14 @@ extern int nfs4_test_session_trunk(struct rpc_clnt *, |
494 | |
495 | static inline struct inode *nfs_igrab_and_active(struct inode *inode) |
496 | { |
497 | - inode = igrab(inode); |
498 | - if (inode != NULL && !nfs_sb_active(inode->i_sb)) { |
499 | - iput(inode); |
500 | - inode = NULL; |
501 | + struct super_block *sb = inode->i_sb; |
502 | + |
503 | + if (sb && nfs_sb_active(sb)) { |
504 | + if (igrab(inode)) |
505 | + return inode; |
506 | + nfs_sb_deactive(sb); |
507 | } |
508 | - return inode; |
509 | + return NULL; |
510 | } |
511 | |
512 | static inline void nfs_iput_and_deactive(struct inode *inode) |
513 | diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c |
514 | index 7e50248ca432c..93c6fb53cc0ed 100644 |
515 | --- a/fs/nfsd/nfs3xdr.c |
516 | +++ b/fs/nfsd/nfs3xdr.c |
517 | @@ -822,9 +822,14 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp, |
518 | if (isdotent(name, namlen)) { |
519 | if (namlen == 2) { |
520 | dchild = dget_parent(dparent); |
521 | - /* filesystem root - cannot return filehandle for ".." */ |
522 | + /* |
523 | + * Don't return filehandle for ".." if we're at |
524 | + * the filesystem or export root: |
525 | + */ |
526 | if (dchild == dparent) |
527 | goto out; |
528 | + if (dparent == exp->ex_path.dentry) |
529 | + goto out; |
530 | } else |
531 | dchild = dget(dparent); |
532 | } else |
533 | diff --git a/include/linux/acpi.h b/include/linux/acpi.h |
534 | index 5670bb9788bb4..192b045cc56ec 100644 |
535 | --- a/include/linux/acpi.h |
536 | +++ b/include/linux/acpi.h |
537 | @@ -734,6 +734,13 @@ static inline int acpi_device_modalias(struct device *dev, |
538 | return -ENODEV; |
539 | } |
540 | |
541 | +static inline struct platform_device * |
542 | +acpi_create_platform_device(struct acpi_device *adev, |
543 | + struct property_entry *properties) |
544 | +{ |
545 | + return NULL; |
546 | +} |
547 | + |
548 | static inline bool acpi_dma_supported(struct acpi_device *adev) |
549 | { |
550 | return false; |
551 | diff --git a/include/linux/input.h b/include/linux/input.h |
552 | index a65e3b24fb183..fb5e23c7ed988 100644 |
553 | --- a/include/linux/input.h |
554 | +++ b/include/linux/input.h |
555 | @@ -529,6 +529,7 @@ int input_ff_event(struct input_dev *dev, unsigned int type, unsigned int code, |
556 | |
557 | int input_ff_upload(struct input_dev *dev, struct ff_effect *effect, struct file *file); |
558 | int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file); |
559 | +int input_ff_flush(struct input_dev *dev, struct file *file); |
560 | |
561 | int input_ff_create_memless(struct input_dev *dev, void *data, |
562 | int (*play_effect)(struct input_dev *, void *, struct ff_effect *)); |
563 | diff --git a/mm/hugetlb.c b/mm/hugetlb.c |
564 | index b469d099dc5f6..52b5e0e026d60 100644 |
565 | --- a/mm/hugetlb.c |
566 | +++ b/mm/hugetlb.c |
567 | @@ -3767,7 +3767,7 @@ retry: |
568 | * So we need to block hugepage fault by PG_hwpoison bit check. |
569 | */ |
570 | if (unlikely(PageHWPoison(page))) { |
571 | - ret = VM_FAULT_HWPOISON | |
572 | + ret = VM_FAULT_HWPOISON_LARGE | |
573 | VM_FAULT_SET_HINDEX(hstate_index(h)); |
574 | goto backout_unlocked; |
575 | } |
576 | diff --git a/mm/slub.c b/mm/slub.c |
577 | index 51a73d2d1082e..7ccfc043c28e2 100644 |
578 | --- a/mm/slub.c |
579 | +++ b/mm/slub.c |
580 | @@ -1833,7 +1833,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n, |
581 | |
582 | t = acquire_slab(s, n, page, object == NULL, &objects); |
583 | if (!t) |
584 | - break; |
585 | + continue; /* cmpxchg raced */ |
586 | |
587 | available += objects; |
588 | if (!object) { |
589 | diff --git a/net/core/skbuff.c b/net/core/skbuff.c |
590 | index 026f4525063c1..5582a4ed7c2fb 100644 |
591 | --- a/net/core/skbuff.c |
592 | +++ b/net/core/skbuff.c |
593 | @@ -489,13 +489,17 @@ EXPORT_SYMBOL(__netdev_alloc_skb); |
594 | struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len, |
595 | gfp_t gfp_mask) |
596 | { |
597 | - struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache); |
598 | + struct napi_alloc_cache *nc; |
599 | struct sk_buff *skb; |
600 | void *data; |
601 | |
602 | len += NET_SKB_PAD + NET_IP_ALIGN; |
603 | |
604 | - if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) || |
605 | + /* If requested length is either too small or too big, |
606 | + * we use kmalloc() for skb->head allocation. |
607 | + */ |
608 | + if (len <= SKB_WITH_OVERHEAD(1024) || |
609 | + len > SKB_WITH_OVERHEAD(PAGE_SIZE) || |
610 | (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) { |
611 | skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE); |
612 | if (!skb) |
613 | @@ -503,6 +507,7 @@ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len, |
614 | goto skb_success; |
615 | } |
616 | |
617 | + nc = this_cpu_ptr(&napi_alloc_cache); |
618 | len += SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); |
619 | len = SKB_DATA_ALIGN(len); |
620 | |
621 | diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c |
622 | index a1116701287fb..2dbf5a0faad32 100644 |
623 | --- a/net/dcb/dcbnl.c |
624 | +++ b/net/dcb/dcbnl.c |
625 | @@ -1726,6 +1726,8 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh) |
626 | fn = &reply_funcs[dcb->cmd]; |
627 | if (!fn->cb) |
628 | return -EOPNOTSUPP; |
629 | + if (fn->type == RTM_SETDCB && !netlink_capable(skb, CAP_NET_ADMIN)) |
630 | + return -EPERM; |
631 | |
632 | if (!tb[DCB_ATTR_IFNAME]) |
633 | return -EINVAL; |
634 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c |
635 | index df705303992e0..a4a5863e482cd 100644 |
636 | --- a/net/ipv6/sit.c |
637 | +++ b/net/ipv6/sit.c |
638 | @@ -1583,8 +1583,11 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev, |
639 | } |
640 | |
641 | #ifdef CONFIG_IPV6_SIT_6RD |
642 | - if (ipip6_netlink_6rd_parms(data, &ip6rd)) |
643 | + if (ipip6_netlink_6rd_parms(data, &ip6rd)) { |
644 | err = ipip6_tunnel_update_6rd(nt, &ip6rd); |
645 | + if (err < 0) |
646 | + unregister_netdevice_queue(dev, NULL); |
647 | + } |
648 | #endif |
649 | |
650 | return err; |
651 | diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c |
652 | index 5f446cd9f3fd4..0dbd17137dee6 100644 |
653 | --- a/net/netfilter/nf_conntrack_standalone.c |
654 | +++ b/net/netfilter/nf_conntrack_standalone.c |
655 | @@ -458,6 +458,9 @@ nf_conntrack_hash_sysctl(struct ctl_table *table, int write, |
656 | { |
657 | int ret; |
658 | |
659 | + /* module_param hashsize could have changed value */ |
660 | + nf_conntrack_htable_size_user = nf_conntrack_htable_size; |
661 | + |
662 | ret = proc_dointvec(table, write, buffer, lenp, ppos); |
663 | if (ret < 0 || !write) |
664 | return ret; |
665 | diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c |
666 | index fa475b02bdceb..16efd04d4a801 100644 |
667 | --- a/net/rxrpc/key.c |
668 | +++ b/net/rxrpc/key.c |
669 | @@ -1106,7 +1106,7 @@ static long rxrpc_read(const struct key *key, |
670 | default: /* we have a ticket we can't encode */ |
671 | pr_err("Unsupported key token type (%u)\n", |
672 | token->security_index); |
673 | - continue; |
674 | + return -ENOPKG; |
675 | } |
676 | |
677 | _debug("token[%u]: toksize=%u", ntoks, toksize); |
678 | @@ -1226,7 +1226,9 @@ static long rxrpc_read(const struct key *key, |
679 | break; |
680 | |
681 | default: |
682 | - break; |
683 | + pr_err("Unsupported key token type (%u)\n", |
684 | + token->security_index); |
685 | + return -ENOPKG; |
686 | } |
687 | |
688 | ASSERTCMP((unsigned long)xdr - (unsigned long)oldxdr, ==, |
689 | diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c |
690 | index 8391c27855501..7404f02702a1c 100644 |
691 | --- a/net/sunrpc/addr.c |
692 | +++ b/net/sunrpc/addr.c |
693 | @@ -184,7 +184,7 @@ static int rpc_parse_scope_id(struct net *net, const char *buf, |
694 | scope_id = dev->ifindex; |
695 | dev_put(dev); |
696 | } else { |
697 | - if (kstrtou32(p, 10, &scope_id) == 0) { |
698 | + if (kstrtou32(p, 10, &scope_id) != 0) { |
699 | kfree(p); |
700 | return 0; |
701 | } |
702 | diff --git a/net/tipc/link.c b/net/tipc/link.c |
703 | index c7406c1fdc14b..06327f78f2032 100644 |
704 | --- a/net/tipc/link.c |
705 | +++ b/net/tipc/link.c |
706 | @@ -877,9 +877,8 @@ void tipc_link_reset(struct tipc_link *l) |
707 | int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, |
708 | struct sk_buff_head *xmitq) |
709 | { |
710 | - struct tipc_msg *hdr = buf_msg(skb_peek(list)); |
711 | unsigned int maxwin = l->window; |
712 | - unsigned int i, imp = msg_importance(hdr); |
713 | + unsigned int i; |
714 | unsigned int mtu = l->mtu; |
715 | u16 ack = l->rcv_nxt - 1; |
716 | u16 seqno = l->snd_nxt; |
717 | @@ -888,7 +887,13 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, |
718 | struct sk_buff_head *backlogq = &l->backlogq; |
719 | struct sk_buff *skb, *_skb, *bskb; |
720 | int pkt_cnt = skb_queue_len(list); |
721 | + struct tipc_msg *hdr; |
722 | + int imp; |
723 | + |
724 | + if (pkt_cnt <= 0) |
725 | + return 0; |
726 | |
727 | + imp = msg_importance(hdr); |
728 | /* Match msg importance against this and all higher backlog limits: */ |
729 | if (!skb_queue_empty(backlogq)) { |
730 | for (i = imp; i <= TIPC_SYSTEM_IMPORTANCE; i++) { |
731 | @@ -896,6 +901,8 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, |
732 | return link_schedule_user(l, list); |
733 | } |
734 | } |
735 | + |
736 | + hdr = buf_msg(skb_peek(list)); |
737 | if (unlikely(msg_size(hdr) > mtu)) { |
738 | skb_queue_purge(list); |
739 | return -EMSGSIZE; |
740 | diff --git a/security/lsm_audit.c b/security/lsm_audit.c |
741 | index 44a20c2184092..cc4000dba600a 100644 |
742 | --- a/security/lsm_audit.c |
743 | +++ b/security/lsm_audit.c |
744 | @@ -277,7 +277,9 @@ static void dump_common_audit_data(struct audit_buffer *ab, |
745 | struct inode *inode; |
746 | |
747 | audit_log_format(ab, " name="); |
748 | + spin_lock(&a->u.dentry->d_lock); |
749 | audit_log_untrustedstring(ab, a->u.dentry->d_name.name); |
750 | + spin_unlock(&a->u.dentry->d_lock); |
751 | |
752 | inode = d_backing_inode(a->u.dentry); |
753 | if (inode) { |
754 | @@ -295,8 +297,9 @@ static void dump_common_audit_data(struct audit_buffer *ab, |
755 | dentry = d_find_alias(inode); |
756 | if (dentry) { |
757 | audit_log_format(ab, " name="); |
758 | - audit_log_untrustedstring(ab, |
759 | - dentry->d_name.name); |
760 | + spin_lock(&dentry->d_lock); |
761 | + audit_log_untrustedstring(ab, dentry->d_name.name); |
762 | + spin_unlock(&dentry->d_lock); |
763 | dput(dentry); |
764 | } |
765 | audit_log_format(ab, " dev="); |
766 | diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c |
767 | index 41a29bb215199..11edb6f6bdafe 100644 |
768 | --- a/sound/soc/soc-dapm.c |
769 | +++ b/sound/soc/soc-dapm.c |
770 | @@ -2349,6 +2349,7 @@ void snd_soc_dapm_free_widget(struct snd_soc_dapm_widget *w) |
771 | enum snd_soc_dapm_direction dir; |
772 | |
773 | list_del(&w->list); |
774 | + list_del(&w->dirty); |
775 | /* |
776 | * remove source and sink paths associated to this widget. |
777 | * While removing the path, remove reference to it from both |