Contents of /trunk/kernel-alx-legacy/patches-4.9/0363-4.9.264-all-fixes.patch
Parent Directory | Revision Log
Revision 3665 -
(show annotations)
(download)
Mon Oct 24 14:07:42 2022 UTC (23 months ago) by niro
File size: 72746 byte(s)
Mon Oct 24 14:07:42 2022 UTC (23 months ago) by niro
File size: 72746 byte(s)
-linux-4.9.264
1 | diff --git a/Makefile b/Makefile |
2 | index 80b265a383bb6..2ae6f4b707dd9 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 263 |
9 | +SUBLEVEL = 264 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi |
14 | index 97d331ec25001..cd8db85f7c119 100644 |
15 | --- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi |
16 | +++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi |
17 | @@ -177,6 +177,7 @@ |
18 | ranges = <0x0 0x00 0x1700000 0x100000>; |
19 | reg = <0x00 0x1700000 0x0 0x100000>; |
20 | interrupts = <0 75 0x4>; |
21 | + dma-coherent; |
22 | |
23 | sec_jr0: jr@10000 { |
24 | compatible = "fsl,sec-v5.4-job-ring", |
25 | diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h |
26 | index 86a43450f014c..bdf5ec2b83565 100644 |
27 | --- a/arch/arm64/include/asm/futex.h |
28 | +++ b/arch/arm64/include/asm/futex.h |
29 | @@ -26,7 +26,12 @@ |
30 | #include <asm/errno.h> |
31 | #include <asm/sysreg.h> |
32 | |
33 | +#define FUTEX_MAX_LOOPS 128 /* What's the largest number you can think of? */ |
34 | + |
35 | #define __futex_atomic_op(insn, ret, oldval, uaddr, tmp, oparg) \ |
36 | +do { \ |
37 | + unsigned int loops = FUTEX_MAX_LOOPS; \ |
38 | + \ |
39 | asm volatile( \ |
40 | ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, \ |
41 | CONFIG_ARM64_PAN) \ |
42 | @@ -34,21 +39,26 @@ |
43 | "1: ldxr %w1, %2\n" \ |
44 | insn "\n" \ |
45 | "2: stlxr %w0, %w3, %2\n" \ |
46 | -" cbnz %w0, 1b\n" \ |
47 | -" dmb ish\n" \ |
48 | +" cbz %w0, 3f\n" \ |
49 | +" sub %w4, %w4, %w0\n" \ |
50 | +" cbnz %w4, 1b\n" \ |
51 | +" mov %w0, %w7\n" \ |
52 | "3:\n" \ |
53 | +" dmb ish\n" \ |
54 | " .pushsection .fixup,\"ax\"\n" \ |
55 | " .align 2\n" \ |
56 | -"4: mov %w0, %w5\n" \ |
57 | +"4: mov %w0, %w6\n" \ |
58 | " b 3b\n" \ |
59 | " .popsection\n" \ |
60 | _ASM_EXTABLE(1b, 4b) \ |
61 | _ASM_EXTABLE(2b, 4b) \ |
62 | ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, \ |
63 | CONFIG_ARM64_PAN) \ |
64 | - : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp) \ |
65 | - : "r" (oparg), "Ir" (-EFAULT) \ |
66 | - : "memory") |
67 | + : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp), \ |
68 | + "+r" (loops) \ |
69 | + : "r" (oparg), "Ir" (-EFAULT), "Ir" (-EAGAIN) \ |
70 | + : "memory"); \ |
71 | +} while (0) |
72 | |
73 | static inline int |
74 | arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr) |
75 | @@ -59,23 +69,23 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr) |
76 | |
77 | switch (op) { |
78 | case FUTEX_OP_SET: |
79 | - __futex_atomic_op("mov %w3, %w4", |
80 | + __futex_atomic_op("mov %w3, %w5", |
81 | ret, oldval, uaddr, tmp, oparg); |
82 | break; |
83 | case FUTEX_OP_ADD: |
84 | - __futex_atomic_op("add %w3, %w1, %w4", |
85 | + __futex_atomic_op("add %w3, %w1, %w5", |
86 | ret, oldval, uaddr, tmp, oparg); |
87 | break; |
88 | case FUTEX_OP_OR: |
89 | - __futex_atomic_op("orr %w3, %w1, %w4", |
90 | + __futex_atomic_op("orr %w3, %w1, %w5", |
91 | ret, oldval, uaddr, tmp, oparg); |
92 | break; |
93 | case FUTEX_OP_ANDN: |
94 | - __futex_atomic_op("and %w3, %w1, %w4", |
95 | + __futex_atomic_op("and %w3, %w1, %w5", |
96 | ret, oldval, uaddr, tmp, ~oparg); |
97 | break; |
98 | case FUTEX_OP_XOR: |
99 | - __futex_atomic_op("eor %w3, %w1, %w4", |
100 | + __futex_atomic_op("eor %w3, %w1, %w5", |
101 | ret, oldval, uaddr, tmp, oparg); |
102 | break; |
103 | default: |
104 | @@ -95,6 +105,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr, |
105 | u32 oldval, u32 newval) |
106 | { |
107 | int ret = 0; |
108 | + unsigned int loops = FUTEX_MAX_LOOPS; |
109 | u32 val, tmp; |
110 | u32 __user *uaddr; |
111 | |
112 | @@ -106,21 +117,25 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr, |
113 | ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, CONFIG_ARM64_PAN) |
114 | " prfm pstl1strm, %2\n" |
115 | "1: ldxr %w1, %2\n" |
116 | -" sub %w3, %w1, %w4\n" |
117 | -" cbnz %w3, 3f\n" |
118 | -"2: stlxr %w3, %w5, %2\n" |
119 | -" cbnz %w3, 1b\n" |
120 | -" dmb ish\n" |
121 | +" sub %w3, %w1, %w5\n" |
122 | +" cbnz %w3, 4f\n" |
123 | +"2: stlxr %w3, %w6, %2\n" |
124 | +" cbz %w3, 3f\n" |
125 | +" sub %w4, %w4, %w3\n" |
126 | +" cbnz %w4, 1b\n" |
127 | +" mov %w0, %w8\n" |
128 | "3:\n" |
129 | +" dmb ish\n" |
130 | +"4:\n" |
131 | " .pushsection .fixup,\"ax\"\n" |
132 | -"4: mov %w0, %w6\n" |
133 | -" b 3b\n" |
134 | +"5: mov %w0, %w7\n" |
135 | +" b 4b\n" |
136 | " .popsection\n" |
137 | - _ASM_EXTABLE(1b, 4b) |
138 | - _ASM_EXTABLE(2b, 4b) |
139 | + _ASM_EXTABLE(1b, 5b) |
140 | + _ASM_EXTABLE(2b, 5b) |
141 | ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN) |
142 | - : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp) |
143 | - : "r" (oldval), "r" (newval), "Ir" (-EFAULT) |
144 | + : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp), "+r" (loops) |
145 | + : "r" (oldval), "r" (newval), "Ir" (-EFAULT), "Ir" (-EAGAIN) |
146 | : "memory"); |
147 | |
148 | *uval = val; |
149 | diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h |
150 | index 1d0b875fec44f..ec909eec0b4c6 100644 |
151 | --- a/arch/ia64/include/asm/syscall.h |
152 | +++ b/arch/ia64/include/asm/syscall.h |
153 | @@ -35,7 +35,7 @@ static inline void syscall_rollback(struct task_struct *task, |
154 | static inline long syscall_get_error(struct task_struct *task, |
155 | struct pt_regs *regs) |
156 | { |
157 | - return regs->r10 == -1 ? regs->r8:0; |
158 | + return regs->r10 == -1 ? -regs->r8:0; |
159 | } |
160 | |
161 | static inline long syscall_get_return_value(struct task_struct *task, |
162 | diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c |
163 | index 36f660da81242..56007258c0141 100644 |
164 | --- a/arch/ia64/kernel/ptrace.c |
165 | +++ b/arch/ia64/kernel/ptrace.c |
166 | @@ -2144,27 +2144,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data) |
167 | { |
168 | struct syscall_get_set_args *args = data; |
169 | struct pt_regs *pt = args->regs; |
170 | - unsigned long *krbs, cfm, ndirty; |
171 | + unsigned long *krbs, cfm, ndirty, nlocals, nouts; |
172 | int i, count; |
173 | |
174 | if (unw_unwind_to_user(info) < 0) |
175 | return; |
176 | |
177 | + /* |
178 | + * We get here via a few paths: |
179 | + * - break instruction: cfm is shared with caller. |
180 | + * syscall args are in out= regs, locals are non-empty. |
181 | + * - epsinstruction: cfm is set by br.call |
182 | + * locals don't exist. |
183 | + * |
184 | + * For both cases argguments are reachable in cfm.sof - cfm.sol. |
185 | + * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ] |
186 | + */ |
187 | cfm = pt->cr_ifs; |
188 | + nlocals = (cfm >> 7) & 0x7f; /* aka sol */ |
189 | + nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */ |
190 | krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8; |
191 | ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19)); |
192 | |
193 | count = 0; |
194 | if (in_syscall(pt)) |
195 | - count = min_t(int, args->n, cfm & 0x7f); |
196 | + count = min_t(int, args->n, nouts); |
197 | |
198 | + /* Iterate over outs. */ |
199 | for (i = 0; i < count; i++) { |
200 | + int j = ndirty + nlocals + i + args->i; |
201 | if (args->rw) |
202 | - *ia64_rse_skip_regs(krbs, ndirty + i + args->i) = |
203 | - args->args[i]; |
204 | + *ia64_rse_skip_regs(krbs, j) = args->args[i]; |
205 | else |
206 | - args->args[i] = *ia64_rse_skip_regs(krbs, |
207 | - ndirty + i + args->i); |
208 | + args->args[i] = *ia64_rse_skip_regs(krbs, j); |
209 | } |
210 | |
211 | if (!args->rw) { |
212 | diff --git a/arch/powerpc/include/asm/dcr-native.h b/arch/powerpc/include/asm/dcr-native.h |
213 | index 4a2beef742772..86fdda16bb73e 100644 |
214 | --- a/arch/powerpc/include/asm/dcr-native.h |
215 | +++ b/arch/powerpc/include/asm/dcr-native.h |
216 | @@ -65,8 +65,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) |
217 | #define mfdcr(rn) \ |
218 | ({unsigned int rval; \ |
219 | if (__builtin_constant_p(rn) && rn < 1024) \ |
220 | - asm volatile("mfdcr %0," __stringify(rn) \ |
221 | - : "=r" (rval)); \ |
222 | + asm volatile("mfdcr %0, %1" : "=r" (rval) \ |
223 | + : "n" (rn)); \ |
224 | else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ |
225 | rval = mfdcrx(rn); \ |
226 | else \ |
227 | @@ -76,8 +76,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) |
228 | #define mtdcr(rn, v) \ |
229 | do { \ |
230 | if (__builtin_constant_p(rn) && rn < 1024) \ |
231 | - asm volatile("mtdcr " __stringify(rn) ",%0" \ |
232 | - : : "r" (v)); \ |
233 | + asm volatile("mtdcr %0, %1" \ |
234 | + : : "n" (rn), "r" (v)); \ |
235 | else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ |
236 | mtdcrx(rn, v); \ |
237 | else \ |
238 | diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h |
239 | index f5ca15622dc9c..2bfa4deb8cae8 100644 |
240 | --- a/arch/x86/include/asm/tlbflush.h |
241 | +++ b/arch/x86/include/asm/tlbflush.h |
242 | @@ -245,12 +245,15 @@ static inline void __native_flush_tlb_single(unsigned long addr) |
243 | * ASID. But, userspace flushes are probably much more |
244 | * important performance-wise. |
245 | * |
246 | - * Make sure to do only a single invpcid when KAISER is |
247 | - * disabled and we have only a single ASID. |
248 | + * In the KAISER disabled case, do an INVLPG to make sure |
249 | + * the mapping is flushed in case it is a global one. |
250 | */ |
251 | - if (kaiser_enabled) |
252 | + if (kaiser_enabled) { |
253 | invpcid_flush_one(X86_CR3_PCID_ASID_USER, addr); |
254 | - invpcid_flush_one(X86_CR3_PCID_ASID_KERN, addr); |
255 | + invpcid_flush_one(X86_CR3_PCID_ASID_KERN, addr); |
256 | + } else { |
257 | + asm volatile("invlpg (%0)" ::"r" (addr) : "memory"); |
258 | + } |
259 | } |
260 | |
261 | static inline void __flush_tlb_all(void) |
262 | diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h |
263 | index eae0b278d5172..56c429ea6aaf4 100644 |
264 | --- a/drivers/acpi/internal.h |
265 | +++ b/drivers/acpi/internal.h |
266 | @@ -18,6 +18,8 @@ |
267 | #ifndef _ACPI_INTERNAL_H_ |
268 | #define _ACPI_INTERNAL_H_ |
269 | |
270 | +#include <linux/idr.h> |
271 | + |
272 | #define PREFIX "ACPI: " |
273 | |
274 | int early_acpi_osi_init(void); |
275 | @@ -97,9 +99,11 @@ void acpi_scan_table_handler(u32 event, void *table, void *context); |
276 | |
277 | extern struct list_head acpi_bus_id_list; |
278 | |
279 | +#define ACPI_MAX_DEVICE_INSTANCES 4096 |
280 | + |
281 | struct acpi_device_bus_id { |
282 | const char *bus_id; |
283 | - unsigned int instance_no; |
284 | + struct ida instance_ida; |
285 | struct list_head node; |
286 | }; |
287 | |
288 | diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c |
289 | index 5aa4a01f698fe..d749fe20fbfc5 100644 |
290 | --- a/drivers/acpi/scan.c |
291 | +++ b/drivers/acpi/scan.c |
292 | @@ -481,9 +481,8 @@ static void acpi_device_del(struct acpi_device *device) |
293 | list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) |
294 | if (!strcmp(acpi_device_bus_id->bus_id, |
295 | acpi_device_hid(device))) { |
296 | - if (acpi_device_bus_id->instance_no > 0) |
297 | - acpi_device_bus_id->instance_no--; |
298 | - else { |
299 | + ida_simple_remove(&acpi_device_bus_id->instance_ida, device->pnp.instance_no); |
300 | + if (ida_is_empty(&acpi_device_bus_id->instance_ida)) { |
301 | list_del(&acpi_device_bus_id->node); |
302 | kfree_const(acpi_device_bus_id->bus_id); |
303 | kfree(acpi_device_bus_id); |
304 | @@ -622,12 +621,38 @@ void acpi_bus_put_acpi_device(struct acpi_device *adev) |
305 | put_device(&adev->dev); |
306 | } |
307 | |
308 | +static struct acpi_device_bus_id *acpi_device_bus_id_match(const char *dev_id) |
309 | +{ |
310 | + struct acpi_device_bus_id *acpi_device_bus_id; |
311 | + |
312 | + /* Find suitable bus_id and instance number in acpi_bus_id_list. */ |
313 | + list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) { |
314 | + if (!strcmp(acpi_device_bus_id->bus_id, dev_id)) |
315 | + return acpi_device_bus_id; |
316 | + } |
317 | + return NULL; |
318 | +} |
319 | + |
320 | +static int acpi_device_set_name(struct acpi_device *device, |
321 | + struct acpi_device_bus_id *acpi_device_bus_id) |
322 | +{ |
323 | + struct ida *instance_ida = &acpi_device_bus_id->instance_ida; |
324 | + int result; |
325 | + |
326 | + result = ida_simple_get(instance_ida, 0, ACPI_MAX_DEVICE_INSTANCES, GFP_KERNEL); |
327 | + if (result < 0) |
328 | + return result; |
329 | + |
330 | + device->pnp.instance_no = result; |
331 | + dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, result); |
332 | + return 0; |
333 | +} |
334 | + |
335 | int acpi_device_add(struct acpi_device *device, |
336 | void (*release)(struct device *)) |
337 | { |
338 | + struct acpi_device_bus_id *acpi_device_bus_id; |
339 | int result; |
340 | - struct acpi_device_bus_id *acpi_device_bus_id, *new_bus_id; |
341 | - int found = 0; |
342 | |
343 | if (device->handle) { |
344 | acpi_status status; |
345 | @@ -653,41 +678,38 @@ int acpi_device_add(struct acpi_device *device, |
346 | INIT_LIST_HEAD(&device->del_list); |
347 | mutex_init(&device->physical_node_lock); |
348 | |
349 | - new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL); |
350 | - if (!new_bus_id) { |
351 | - pr_err(PREFIX "Memory allocation error\n"); |
352 | - result = -ENOMEM; |
353 | - goto err_detach; |
354 | - } |
355 | - |
356 | mutex_lock(&acpi_device_lock); |
357 | - /* |
358 | - * Find suitable bus_id and instance number in acpi_bus_id_list |
359 | - * If failed, create one and link it into acpi_bus_id_list |
360 | - */ |
361 | - list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) { |
362 | - if (!strcmp(acpi_device_bus_id->bus_id, |
363 | - acpi_device_hid(device))) { |
364 | - acpi_device_bus_id->instance_no++; |
365 | - found = 1; |
366 | - kfree(new_bus_id); |
367 | - break; |
368 | + |
369 | + acpi_device_bus_id = acpi_device_bus_id_match(acpi_device_hid(device)); |
370 | + if (acpi_device_bus_id) { |
371 | + result = acpi_device_set_name(device, acpi_device_bus_id); |
372 | + if (result) |
373 | + goto err_unlock; |
374 | + } else { |
375 | + acpi_device_bus_id = kzalloc(sizeof(*acpi_device_bus_id), |
376 | + GFP_KERNEL); |
377 | + if (!acpi_device_bus_id) { |
378 | + result = -ENOMEM; |
379 | + goto err_unlock; |
380 | } |
381 | - } |
382 | - if (!found) { |
383 | - acpi_device_bus_id = new_bus_id; |
384 | acpi_device_bus_id->bus_id = |
385 | kstrdup_const(acpi_device_hid(device), GFP_KERNEL); |
386 | if (!acpi_device_bus_id->bus_id) { |
387 | - pr_err(PREFIX "Memory allocation error for bus id\n"); |
388 | + kfree(acpi_device_bus_id); |
389 | result = -ENOMEM; |
390 | - goto err_free_new_bus_id; |
391 | + goto err_unlock; |
392 | + } |
393 | + |
394 | + ida_init(&acpi_device_bus_id->instance_ida); |
395 | + |
396 | + result = acpi_device_set_name(device, acpi_device_bus_id); |
397 | + if (result) { |
398 | + kfree(acpi_device_bus_id); |
399 | + goto err_unlock; |
400 | } |
401 | |
402 | - acpi_device_bus_id->instance_no = 0; |
403 | list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); |
404 | } |
405 | - dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no); |
406 | |
407 | if (device->parent) |
408 | list_add_tail(&device->node, &device->parent->children); |
409 | @@ -719,13 +741,9 @@ int acpi_device_add(struct acpi_device *device, |
410 | list_del(&device->node); |
411 | list_del(&device->wakeup_list); |
412 | |
413 | - err_free_new_bus_id: |
414 | - if (!found) |
415 | - kfree(new_bus_id); |
416 | - |
417 | + err_unlock: |
418 | mutex_unlock(&acpi_device_lock); |
419 | |
420 | - err_detach: |
421 | acpi_detach_data(device->handle, acpi_scan_drop_device); |
422 | return result; |
423 | } |
424 | diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c |
425 | index 9d16743c49178..2b7786cd548f8 100644 |
426 | --- a/drivers/atm/eni.c |
427 | +++ b/drivers/atm/eni.c |
428 | @@ -2279,7 +2279,8 @@ out: |
429 | return rc; |
430 | |
431 | err_eni_release: |
432 | - eni_do_release(dev); |
433 | + dev->phy = NULL; |
434 | + iounmap(ENI_DEV(dev)->ioaddr); |
435 | err_unregister: |
436 | atm_dev_deregister(dev); |
437 | err_free_consistent: |
438 | diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c |
439 | index feb023d7eebd6..40644670cff26 100644 |
440 | --- a/drivers/atm/idt77105.c |
441 | +++ b/drivers/atm/idt77105.c |
442 | @@ -261,7 +261,7 @@ static int idt77105_start(struct atm_dev *dev) |
443 | { |
444 | unsigned long flags; |
445 | |
446 | - if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL))) |
447 | + if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL))) |
448 | return -ENOMEM; |
449 | PRIV(dev)->dev = dev; |
450 | spin_lock_irqsave(&idt77105_priv_lock, flags); |
451 | @@ -338,7 +338,7 @@ static int idt77105_stop(struct atm_dev *dev) |
452 | else |
453 | idt77105_all = walk->next; |
454 | dev->phy = NULL; |
455 | - dev->dev_data = NULL; |
456 | + dev->phy_data = NULL; |
457 | kfree(walk); |
458 | break; |
459 | } |
460 | diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c |
461 | index 445505d9ea071..dec6c68156ee5 100644 |
462 | --- a/drivers/atm/lanai.c |
463 | +++ b/drivers/atm/lanai.c |
464 | @@ -2240,6 +2240,7 @@ static int lanai_dev_open(struct atm_dev *atmdev) |
465 | conf1_write(lanai); |
466 | #endif |
467 | iounmap(lanai->base); |
468 | + lanai->base = NULL; |
469 | error_pci: |
470 | pci_disable_device(lanai->pci); |
471 | error: |
472 | @@ -2252,6 +2253,8 @@ static int lanai_dev_open(struct atm_dev *atmdev) |
473 | static void lanai_dev_close(struct atm_dev *atmdev) |
474 | { |
475 | struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data; |
476 | + if (lanai->base==NULL) |
477 | + return; |
478 | printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n", |
479 | lanai->number); |
480 | lanai_timed_poll_stop(lanai); |
481 | @@ -2561,7 +2564,7 @@ static int lanai_init_one(struct pci_dev *pci, |
482 | struct atm_dev *atmdev; |
483 | int result; |
484 | |
485 | - lanai = kmalloc(sizeof(*lanai), GFP_KERNEL); |
486 | + lanai = kzalloc(sizeof(*lanai), GFP_KERNEL); |
487 | if (lanai == NULL) { |
488 | printk(KERN_ERR DEV_LABEL |
489 | ": couldn't allocate dev_data structure!\n"); |
490 | diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c |
491 | index 5120a96b3a894..b2f4e8df15911 100644 |
492 | --- a/drivers/atm/uPD98402.c |
493 | +++ b/drivers/atm/uPD98402.c |
494 | @@ -210,7 +210,7 @@ static void uPD98402_int(struct atm_dev *dev) |
495 | static int uPD98402_start(struct atm_dev *dev) |
496 | { |
497 | DPRINTK("phy_start\n"); |
498 | - if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL))) |
499 | + if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL))) |
500 | return -ENOMEM; |
501 | spin_lock_init(&PRIV(dev)->lock); |
502 | memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats)); |
503 | diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c |
504 | index 2b739ba841b1a..1a1ad0fdc039a 100644 |
505 | --- a/drivers/block/xen-blkback/blkback.c |
506 | +++ b/drivers/block/xen-blkback/blkback.c |
507 | @@ -937,7 +937,7 @@ next: |
508 | out: |
509 | for (i = last_map; i < num; i++) { |
510 | /* Don't zap current batch's valid persistent grants. */ |
511 | - if(i >= last_map + segs_to_map) |
512 | + if(i >= map_until) |
513 | pages[i]->persistent_gnt = NULL; |
514 | pages[i]->handle = BLKBACK_INVALID_HANDLE; |
515 | } |
516 | diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c |
517 | index 5012e3ad12256..624f74d03a83a 100644 |
518 | --- a/drivers/bus/omap_l3_noc.c |
519 | +++ b/drivers/bus/omap_l3_noc.c |
520 | @@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev) |
521 | */ |
522 | l3->debug_irq = platform_get_irq(pdev, 0); |
523 | ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler, |
524 | - 0x0, "l3-dbg-irq", l3); |
525 | + IRQF_NO_THREAD, "l3-dbg-irq", l3); |
526 | if (ret) { |
527 | dev_err(l3->dev, "request_irq failed for %d\n", |
528 | l3->debug_irq); |
529 | @@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) |
530 | |
531 | l3->app_irq = platform_get_irq(pdev, 1); |
532 | ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler, |
533 | - 0x0, "l3-app-irq", l3); |
534 | + IRQF_NO_THREAD, "l3-app-irq", l3); |
535 | if (ret) |
536 | dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq); |
537 | |
538 | diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c |
539 | index a60e1c1b4b5e8..8bd062635399a 100644 |
540 | --- a/drivers/infiniband/hw/cxgb4/cm.c |
541 | +++ b/drivers/infiniband/hw/cxgb4/cm.c |
542 | @@ -3472,13 +3472,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) |
543 | ep->com.local_addr.ss_family == AF_INET) { |
544 | err = cxgb4_remove_server_filter( |
545 | ep->com.dev->rdev.lldi.ports[0], ep->stid, |
546 | - ep->com.dev->rdev.lldi.rxq_ids[0], 0); |
547 | + ep->com.dev->rdev.lldi.rxq_ids[0], false); |
548 | } else { |
549 | struct sockaddr_in6 *sin6; |
550 | c4iw_init_wr_wait(&ep->com.wr_wait); |
551 | err = cxgb4_remove_server( |
552 | ep->com.dev->rdev.lldi.ports[0], ep->stid, |
553 | - ep->com.dev->rdev.lldi.rxq_ids[0], 0); |
554 | + ep->com.dev->rdev.lldi.rxq_ids[0], true); |
555 | if (err) |
556 | goto done; |
557 | err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait, |
558 | diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c |
559 | index 4ead5a18b7940..c41ab2cb272e7 100644 |
560 | --- a/drivers/net/can/c_can/c_can.c |
561 | +++ b/drivers/net/can/c_can/c_can.c |
562 | @@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { |
563 | .brp_inc = 1, |
564 | }; |
565 | |
566 | -static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv) |
567 | -{ |
568 | - if (priv->device) |
569 | - pm_runtime_enable(priv->device); |
570 | -} |
571 | - |
572 | -static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv) |
573 | -{ |
574 | - if (priv->device) |
575 | - pm_runtime_disable(priv->device); |
576 | -} |
577 | - |
578 | static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv) |
579 | { |
580 | if (priv->device) |
581 | @@ -1318,7 +1306,6 @@ static const struct net_device_ops c_can_netdev_ops = { |
582 | |
583 | int register_c_can_dev(struct net_device *dev) |
584 | { |
585 | - struct c_can_priv *priv = netdev_priv(dev); |
586 | int err; |
587 | |
588 | /* Deactivate pins to prevent DRA7 DCAN IP from being |
589 | @@ -1328,28 +1315,19 @@ int register_c_can_dev(struct net_device *dev) |
590 | */ |
591 | pinctrl_pm_select_sleep_state(dev->dev.parent); |
592 | |
593 | - c_can_pm_runtime_enable(priv); |
594 | - |
595 | dev->flags |= IFF_ECHO; /* we support local echo */ |
596 | dev->netdev_ops = &c_can_netdev_ops; |
597 | |
598 | err = register_candev(dev); |
599 | - if (err) |
600 | - c_can_pm_runtime_disable(priv); |
601 | - else |
602 | + if (!err) |
603 | devm_can_led_init(dev); |
604 | - |
605 | return err; |
606 | } |
607 | EXPORT_SYMBOL_GPL(register_c_can_dev); |
608 | |
609 | void unregister_c_can_dev(struct net_device *dev) |
610 | { |
611 | - struct c_can_priv *priv = netdev_priv(dev); |
612 | - |
613 | unregister_candev(dev); |
614 | - |
615 | - c_can_pm_runtime_disable(priv); |
616 | } |
617 | EXPORT_SYMBOL_GPL(unregister_c_can_dev); |
618 | |
619 | diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c |
620 | index d065c0e2d18e6..f3e0b2124a376 100644 |
621 | --- a/drivers/net/can/c_can/c_can_pci.c |
622 | +++ b/drivers/net/can/c_can/c_can_pci.c |
623 | @@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) |
624 | { |
625 | struct net_device *dev = pci_get_drvdata(pdev); |
626 | struct c_can_priv *priv = netdev_priv(dev); |
627 | + void __iomem *addr = priv->base; |
628 | |
629 | unregister_c_can_dev(dev); |
630 | |
631 | free_c_can_dev(dev); |
632 | |
633 | - pci_iounmap(pdev, priv->base); |
634 | + pci_iounmap(pdev, addr); |
635 | pci_disable_msi(pdev); |
636 | pci_clear_master(pdev); |
637 | pci_release_regions(pdev); |
638 | diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c |
639 | index 717530eac70c7..c6a03f565e3fc 100644 |
640 | --- a/drivers/net/can/c_can/c_can_platform.c |
641 | +++ b/drivers/net/can/c_can/c_can_platform.c |
642 | @@ -29,6 +29,7 @@ |
643 | #include <linux/list.h> |
644 | #include <linux/io.h> |
645 | #include <linux/platform_device.h> |
646 | +#include <linux/pm_runtime.h> |
647 | #include <linux/clk.h> |
648 | #include <linux/of.h> |
649 | #include <linux/of_device.h> |
650 | @@ -385,6 +386,7 @@ static int c_can_plat_probe(struct platform_device *pdev) |
651 | platform_set_drvdata(pdev, dev); |
652 | SET_NETDEV_DEV(dev, &pdev->dev); |
653 | |
654 | + pm_runtime_enable(priv->device); |
655 | ret = register_c_can_dev(dev); |
656 | if (ret) { |
657 | dev_err(&pdev->dev, "registering %s failed (err=%d)\n", |
658 | @@ -397,6 +399,7 @@ static int c_can_plat_probe(struct platform_device *pdev) |
659 | return 0; |
660 | |
661 | exit_free_device: |
662 | + pm_runtime_disable(priv->device); |
663 | free_c_can_dev(dev); |
664 | exit: |
665 | dev_err(&pdev->dev, "probe failed\n"); |
666 | @@ -407,9 +410,10 @@ exit: |
667 | static int c_can_plat_remove(struct platform_device *pdev) |
668 | { |
669 | struct net_device *dev = platform_get_drvdata(pdev); |
670 | + struct c_can_priv *priv = netdev_priv(dev); |
671 | |
672 | unregister_c_can_dev(dev); |
673 | - |
674 | + pm_runtime_disable(priv->device); |
675 | free_c_can_dev(dev); |
676 | |
677 | return 0; |
678 | diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c |
679 | index ea38b67d0b737..3d7bffd529feb 100644 |
680 | --- a/drivers/net/can/dev.c |
681 | +++ b/drivers/net/can/dev.c |
682 | @@ -1084,6 +1084,7 @@ static void can_dellink(struct net_device *dev, struct list_head *head) |
683 | |
684 | static struct rtnl_link_ops can_link_ops __read_mostly = { |
685 | .kind = "can", |
686 | + .netns_refund = true, |
687 | .maxtype = IFLA_CAN_MAX, |
688 | .policy = can_policy, |
689 | .setup = can_setup, |
690 | diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c |
691 | index 0bd7e71647964..197c27d8f584b 100644 |
692 | --- a/drivers/net/can/m_can/m_can.c |
693 | +++ b/drivers/net/can/m_can/m_can.c |
694 | @@ -428,9 +428,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) |
695 | } |
696 | |
697 | while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) { |
698 | - if (rxfs & RXFS_RFL) |
699 | - netdev_warn(dev, "Rx FIFO 0 Message Lost\n"); |
700 | - |
701 | m_can_read_fifo(dev, rxfs); |
702 | |
703 | quota--; |
704 | diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c |
705 | index 0c69d5858558a..40b3adf7ad998 100644 |
706 | --- a/drivers/net/dsa/bcm_sf2.c |
707 | +++ b/drivers/net/dsa/bcm_sf2.c |
708 | @@ -588,8 +588,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port) |
709 | * in bits 15:8 and the patch level in bits 7:0 which is exactly what |
710 | * the REG_PHY_REVISION register layout is. |
711 | */ |
712 | - |
713 | - return priv->hw_params.gphy_rev; |
714 | + if (priv->int_phy_mask & BIT(port)) |
715 | + return priv->hw_params.gphy_rev; |
716 | + else |
717 | + return 0; |
718 | } |
719 | |
720 | static void bcm_sf2_sw_adjust_link(struct dsa_switch *ds, int port, |
721 | diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c |
722 | index f9e74461bdc0b..1231816125955 100644 |
723 | --- a/drivers/net/ethernet/freescale/fec_ptp.c |
724 | +++ b/drivers/net/ethernet/freescale/fec_ptp.c |
725 | @@ -396,9 +396,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) |
726 | u64 ns; |
727 | unsigned long flags; |
728 | |
729 | + mutex_lock(&adapter->ptp_clk_mutex); |
730 | + /* Check the ptp clock */ |
731 | + if (!adapter->ptp_clk_on) { |
732 | + mutex_unlock(&adapter->ptp_clk_mutex); |
733 | + return -EINVAL; |
734 | + } |
735 | spin_lock_irqsave(&adapter->tmreg_lock, flags); |
736 | ns = timecounter_read(&adapter->tc); |
737 | spin_unlock_irqrestore(&adapter->tmreg_lock, flags); |
738 | + mutex_unlock(&adapter->ptp_clk_mutex); |
739 | |
740 | *ts = ns_to_timespec64(ns); |
741 | |
742 | diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c |
743 | index 6b03c8553e597..65deaf8f30047 100644 |
744 | --- a/drivers/net/ethernet/intel/e1000e/82571.c |
745 | +++ b/drivers/net/ethernet/intel/e1000e/82571.c |
746 | @@ -917,6 +917,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) |
747 | } else { |
748 | data &= ~IGP02E1000_PM_D0_LPLU; |
749 | ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data); |
750 | + if (ret_val) |
751 | + return ret_val; |
752 | /* LPLU and SmartSpeed are mutually exclusive. LPLU is used |
753 | * during Dx states where the power conservation is most |
754 | * important. During driver activity we should enable |
755 | diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c |
756 | index 3c01bc43889a2..46323019aa631 100644 |
757 | --- a/drivers/net/ethernet/intel/e1000e/netdev.c |
758 | +++ b/drivers/net/ethernet/intel/e1000e/netdev.c |
759 | @@ -5920,15 +5920,19 @@ static void e1000_reset_task(struct work_struct *work) |
760 | struct e1000_adapter *adapter; |
761 | adapter = container_of(work, struct e1000_adapter, reset_task); |
762 | |
763 | + rtnl_lock(); |
764 | /* don't run the task if already down */ |
765 | - if (test_bit(__E1000_DOWN, &adapter->state)) |
766 | + if (test_bit(__E1000_DOWN, &adapter->state)) { |
767 | + rtnl_unlock(); |
768 | return; |
769 | + } |
770 | |
771 | if (!(adapter->flags & FLAG_RESTART_NOW)) { |
772 | e1000e_dump(adapter); |
773 | e_err("Reset adapter unexpectedly\n"); |
774 | } |
775 | e1000e_reinit_locked(adapter); |
776 | + rtnl_unlock(); |
777 | } |
778 | |
779 | /** |
780 | diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c |
781 | index 36d73bf32f4fb..8e2aaf774693f 100644 |
782 | --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c |
783 | +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c |
784 | @@ -8677,8 +8677,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter, |
785 | ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask); |
786 | err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter, |
787 | input->sw_idx, queue); |
788 | - if (!err) |
789 | - ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx); |
790 | + if (err) |
791 | + goto err_out_w_lock; |
792 | + |
793 | + ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx); |
794 | spin_unlock(&adapter->fdir_perfect_lock); |
795 | |
796 | if ((uhtid != 0x800) && (adapter->jump_tables[uhtid])) |
797 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c |
798 | index 5174e0bd75d1e..625336264a44b 100644 |
799 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c |
800 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c |
801 | @@ -1426,6 +1426,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) |
802 | |
803 | if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) { |
804 | vfree(fw_dump->tmpl_hdr); |
805 | + fw_dump->tmpl_hdr = NULL; |
806 | |
807 | if (qlcnic_83xx_md_check_extended_dump_capability(adapter)) |
808 | extended = !qlcnic_83xx_extend_md_capab(adapter); |
809 | @@ -1444,6 +1445,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) |
810 | struct qlcnic_83xx_dump_template_hdr *hdr; |
811 | |
812 | hdr = fw_dump->tmpl_hdr; |
813 | + if (!hdr) |
814 | + return; |
815 | hdr->drv_cap_mask = 0x1f; |
816 | fw_dump->cap_mask = 0x1f; |
817 | dev_info(&pdev->dev, |
818 | diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c |
819 | index fe5b0ac8c6319..5bf47279f9c1b 100644 |
820 | --- a/drivers/net/ethernet/sun/niu.c |
821 | +++ b/drivers/net/ethernet/sun/niu.c |
822 | @@ -3948,8 +3948,6 @@ static void niu_xmac_interrupt(struct niu *np) |
823 | mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT; |
824 | if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP) |
825 | mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT; |
826 | - if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP) |
827 | - mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT; |
828 | if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP) |
829 | mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT; |
830 | if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP) |
831 | diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c |
832 | index 7108c68f16d3e..6ee7f8d2f2d17 100644 |
833 | --- a/drivers/net/ethernet/tehuti/tehuti.c |
834 | +++ b/drivers/net/ethernet/tehuti/tehuti.c |
835 | @@ -2062,6 +2062,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent) |
836 | /*bdx_hw_reset(priv); */ |
837 | if (bdx_read_mac(priv)) { |
838 | pr_err("load MAC address failed\n"); |
839 | + err = -EFAULT; |
840 | goto err_out_iomap; |
841 | } |
842 | SET_NETDEV_DEV(ndev, &pdev->dev); |
843 | diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c |
844 | index ff2270ead2e68..84e0e7f780297 100644 |
845 | --- a/drivers/net/usb/cdc-phonet.c |
846 | +++ b/drivers/net/usb/cdc-phonet.c |
847 | @@ -406,6 +406,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i |
848 | |
849 | err = register_netdev(dev); |
850 | if (err) { |
851 | + /* Set disconnected flag so that disconnect() returns early. */ |
852 | + pnd->disconnected = 1; |
853 | usb_driver_release_interface(&usbpn_driver, data_intf); |
854 | goto out; |
855 | } |
856 | diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c |
857 | index 87bf05a81db50..fc7d28edee077 100644 |
858 | --- a/drivers/net/wan/fsl_ucc_hdlc.c |
859 | +++ b/drivers/net/wan/fsl_ucc_hdlc.c |
860 | @@ -169,13 +169,17 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) |
861 | |
862 | priv->rx_skbuff = kzalloc(priv->rx_ring_size * sizeof(*priv->rx_skbuff), |
863 | GFP_KERNEL); |
864 | - if (!priv->rx_skbuff) |
865 | + if (!priv->rx_skbuff) { |
866 | + ret = -ENOMEM; |
867 | goto free_ucc_pram; |
868 | + } |
869 | |
870 | priv->tx_skbuff = kzalloc(priv->tx_ring_size * sizeof(*priv->tx_skbuff), |
871 | GFP_KERNEL); |
872 | - if (!priv->tx_skbuff) |
873 | + if (!priv->tx_skbuff) { |
874 | + ret = -ENOMEM; |
875 | goto free_rx_skbuff; |
876 | + } |
877 | |
878 | priv->skb_curtx = 0; |
879 | priv->skb_dirtytx = 0; |
880 | diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c |
881 | index 8e83649f77ce1..42e5677d932d8 100644 |
882 | --- a/drivers/usb/gadget/function/f_hid.c |
883 | +++ b/drivers/usb/gadget/function/f_hid.c |
884 | @@ -932,7 +932,7 @@ static void hidg_free_inst(struct usb_function_instance *f) |
885 | mutex_lock(&hidg_ida_lock); |
886 | |
887 | hidg_put_minor(opts->minor); |
888 | - if (idr_is_empty(&hidg_ida.idr)) |
889 | + if (ida_is_empty(&hidg_ida)) |
890 | ghid_cleanup(); |
891 | |
892 | mutex_unlock(&hidg_ida_lock); |
893 | @@ -958,7 +958,7 @@ static struct usb_function_instance *hidg_alloc_inst(void) |
894 | |
895 | mutex_lock(&hidg_ida_lock); |
896 | |
897 | - if (idr_is_empty(&hidg_ida.idr)) { |
898 | + if (ida_is_empty(&hidg_ida)) { |
899 | status = ghid_setup(NULL, HIDG_MINORS); |
900 | if (status) { |
901 | ret = ERR_PTR(status); |
902 | @@ -971,7 +971,7 @@ static struct usb_function_instance *hidg_alloc_inst(void) |
903 | if (opts->minor < 0) { |
904 | ret = ERR_PTR(opts->minor); |
905 | kfree(opts); |
906 | - if (idr_is_empty(&hidg_ida.idr)) |
907 | + if (ida_is_empty(&hidg_ida)) |
908 | ghid_cleanup(); |
909 | goto unlock; |
910 | } |
911 | diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c |
912 | index b962f24b500bf..b3d036d06553c 100644 |
913 | --- a/drivers/usb/gadget/function/f_printer.c |
914 | +++ b/drivers/usb/gadget/function/f_printer.c |
915 | @@ -1276,7 +1276,7 @@ static void gprinter_free_inst(struct usb_function_instance *f) |
916 | mutex_lock(&printer_ida_lock); |
917 | |
918 | gprinter_put_minor(opts->minor); |
919 | - if (idr_is_empty(&printer_ida.idr)) |
920 | + if (ida_is_empty(&printer_ida)) |
921 | gprinter_cleanup(); |
922 | |
923 | mutex_unlock(&printer_ida_lock); |
924 | @@ -1300,7 +1300,7 @@ static struct usb_function_instance *gprinter_alloc_inst(void) |
925 | |
926 | mutex_lock(&printer_ida_lock); |
927 | |
928 | - if (idr_is_empty(&printer_ida.idr)) { |
929 | + if (ida_is_empty(&printer_ida)) { |
930 | status = gprinter_setup(PRINTER_MINORS); |
931 | if (status) { |
932 | ret = ERR_PTR(status); |
933 | @@ -1313,7 +1313,7 @@ static struct usb_function_instance *gprinter_alloc_inst(void) |
934 | if (opts->minor < 0) { |
935 | ret = ERR_PTR(opts->minor); |
936 | kfree(opts); |
937 | - if (idr_is_empty(&printer_ida.idr)) |
938 | + if (ida_is_empty(&printer_ida)) |
939 | gprinter_cleanup(); |
940 | goto unlock; |
941 | } |
942 | diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig |
943 | index c3428767332c2..55ebf9f4a824e 100644 |
944 | --- a/fs/nfs/Kconfig |
945 | +++ b/fs/nfs/Kconfig |
946 | @@ -132,7 +132,7 @@ config PNFS_OBJLAYOUT |
947 | config PNFS_FLEXFILE_LAYOUT |
948 | tristate |
949 | depends on NFS_V4_1 && NFS_V3 |
950 | - default m |
951 | + default NFS_V4 |
952 | |
953 | config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN |
954 | string "NFSv4.1 Implementation ID Domain" |
955 | diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c |
956 | index 267126d32ec0f..4a68837e92ea4 100644 |
957 | --- a/fs/nfs/nfs3xdr.c |
958 | +++ b/fs/nfs/nfs3xdr.c |
959 | @@ -33,6 +33,7 @@ |
960 | */ |
961 | #define NFS3_fhandle_sz (1+16) |
962 | #define NFS3_fh_sz (NFS3_fhandle_sz) /* shorthand */ |
963 | +#define NFS3_post_op_fh_sz (1+NFS3_fh_sz) |
964 | #define NFS3_sattr_sz (15) |
965 | #define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2)) |
966 | #define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2)) |
967 | @@ -70,7 +71,7 @@ |
968 | #define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1) |
969 | #define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3) |
970 | #define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4) |
971 | -#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) |
972 | +#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) |
973 | #define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz)) |
974 | #define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) |
975 | #define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2) |
976 | diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c |
977 | index 0cebe0ca03b2a..94130588ebf52 100644 |
978 | --- a/fs/nfs/nfs4proc.c |
979 | +++ b/fs/nfs/nfs4proc.c |
980 | @@ -5144,6 +5144,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl |
981 | unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE); |
982 | int ret, i; |
983 | |
984 | + /* You can't remove system.nfs4_acl: */ |
985 | + if (buflen == 0) |
986 | + return -EINVAL; |
987 | if (!nfs4_server_supports_acls(server)) |
988 | return -EOPNOTSUPP; |
989 | if (npages > ARRAY_SIZE(pages)) |
990 | diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c |
991 | index d2a806416c3ab..1d406a2094a56 100644 |
992 | --- a/fs/squashfs/export.c |
993 | +++ b/fs/squashfs/export.c |
994 | @@ -165,14 +165,18 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb, |
995 | start = le64_to_cpu(table[n]); |
996 | end = le64_to_cpu(table[n + 1]); |
997 | |
998 | - if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { |
999 | + if (start >= end |
1000 | + || (end - start) > |
1001 | + (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
1002 | kfree(table); |
1003 | return ERR_PTR(-EINVAL); |
1004 | } |
1005 | } |
1006 | |
1007 | start = le64_to_cpu(table[indexes - 1]); |
1008 | - if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) { |
1009 | + if (start >= lookup_table_start || |
1010 | + (lookup_table_start - start) > |
1011 | + (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
1012 | kfree(table); |
1013 | return ERR_PTR(-EINVAL); |
1014 | } |
1015 | diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c |
1016 | index 8ccc0e3f6ea5a..d2e15baab5378 100644 |
1017 | --- a/fs/squashfs/id.c |
1018 | +++ b/fs/squashfs/id.c |
1019 | @@ -110,14 +110,16 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb, |
1020 | start = le64_to_cpu(table[n]); |
1021 | end = le64_to_cpu(table[n + 1]); |
1022 | |
1023 | - if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { |
1024 | + if (start >= end || (end - start) > |
1025 | + (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
1026 | kfree(table); |
1027 | return ERR_PTR(-EINVAL); |
1028 | } |
1029 | } |
1030 | |
1031 | start = le64_to_cpu(table[indexes - 1]); |
1032 | - if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) { |
1033 | + if (start >= id_table_start || (id_table_start - start) > |
1034 | + (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
1035 | kfree(table); |
1036 | return ERR_PTR(-EINVAL); |
1037 | } |
1038 | diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h |
1039 | index e66486366f025..2fd1262cc1bd4 100644 |
1040 | --- a/fs/squashfs/squashfs_fs.h |
1041 | +++ b/fs/squashfs/squashfs_fs.h |
1042 | @@ -30,6 +30,7 @@ |
1043 | |
1044 | /* size of metadata (inode and directory) blocks */ |
1045 | #define SQUASHFS_METADATA_SIZE 8192 |
1046 | +#define SQUASHFS_BLOCK_OFFSET 2 |
1047 | |
1048 | /* default size of block device I/O */ |
1049 | #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE |
1050 | diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c |
1051 | index 3a655d879600c..7f718d2bf3579 100644 |
1052 | --- a/fs/squashfs/xattr_id.c |
1053 | +++ b/fs/squashfs/xattr_id.c |
1054 | @@ -122,14 +122,16 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, |
1055 | start = le64_to_cpu(table[n]); |
1056 | end = le64_to_cpu(table[n + 1]); |
1057 | |
1058 | - if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { |
1059 | + if (start >= end || (end - start) > |
1060 | + (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
1061 | kfree(table); |
1062 | return ERR_PTR(-EINVAL); |
1063 | } |
1064 | } |
1065 | |
1066 | start = le64_to_cpu(table[indexes - 1]); |
1067 | - if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) { |
1068 | + if (start >= table_start || (table_start - start) > |
1069 | + (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
1070 | kfree(table); |
1071 | return ERR_PTR(-EINVAL); |
1072 | } |
1073 | diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h |
1074 | index c1a524de67c5b..53b2a1f320f9f 100644 |
1075 | --- a/include/acpi/acpi_bus.h |
1076 | +++ b/include/acpi/acpi_bus.h |
1077 | @@ -241,6 +241,7 @@ struct acpi_pnp_type { |
1078 | |
1079 | struct acpi_device_pnp { |
1080 | acpi_bus_id bus_id; /* Object name */ |
1081 | + int instance_no; /* Instance number of this object */ |
1082 | struct acpi_pnp_type type; /* ID type */ |
1083 | acpi_bus_address bus_address; /* _ADR */ |
1084 | char *unique_id; /* _UID */ |
1085 | diff --git a/include/linux/idr.h b/include/linux/idr.h |
1086 | index 083d61e927063..3639a28188c92 100644 |
1087 | --- a/include/linux/idr.h |
1088 | +++ b/include/linux/idr.h |
1089 | @@ -195,6 +195,11 @@ static inline int ida_get_new(struct ida *ida, int *p_id) |
1090 | return ida_get_new_above(ida, 0, p_id); |
1091 | } |
1092 | |
1093 | +static inline bool ida_is_empty(struct ida *ida) |
1094 | +{ |
1095 | + return idr_is_empty(&ida->idr); |
1096 | +} |
1097 | + |
1098 | void __init idr_init_cache(void); |
1099 | |
1100 | #endif /* __IDR_H__ */ |
1101 | diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h |
1102 | index a4ccc3122f938..cfcbc49f4ddfa 100644 |
1103 | --- a/include/linux/if_macvlan.h |
1104 | +++ b/include/linux/if_macvlan.h |
1105 | @@ -70,13 +70,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan, |
1106 | if (likely(success)) { |
1107 | struct vlan_pcpu_stats *pcpu_stats; |
1108 | |
1109 | - pcpu_stats = this_cpu_ptr(vlan->pcpu_stats); |
1110 | + pcpu_stats = get_cpu_ptr(vlan->pcpu_stats); |
1111 | u64_stats_update_begin(&pcpu_stats->syncp); |
1112 | pcpu_stats->rx_packets++; |
1113 | pcpu_stats->rx_bytes += len; |
1114 | if (multicast) |
1115 | pcpu_stats->rx_multicast++; |
1116 | u64_stats_update_end(&pcpu_stats->syncp); |
1117 | + put_cpu_ptr(vlan->pcpu_stats); |
1118 | } else { |
1119 | this_cpu_inc(vlan->pcpu_stats->rx_errors); |
1120 | } |
1121 | diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h |
1122 | index 650f3dd6b800f..f604a8fe9d2e5 100644 |
1123 | --- a/include/linux/u64_stats_sync.h |
1124 | +++ b/include/linux/u64_stats_sync.h |
1125 | @@ -68,12 +68,13 @@ struct u64_stats_sync { |
1126 | }; |
1127 | |
1128 | |
1129 | +#if BITS_PER_LONG == 32 && defined(CONFIG_SMP) |
1130 | +#define u64_stats_init(syncp) seqcount_init(&(syncp)->seq) |
1131 | +#else |
1132 | static inline void u64_stats_init(struct u64_stats_sync *syncp) |
1133 | { |
1134 | -#if BITS_PER_LONG == 32 && defined(CONFIG_SMP) |
1135 | - seqcount_init(&syncp->seq); |
1136 | -#endif |
1137 | } |
1138 | +#endif |
1139 | |
1140 | static inline void u64_stats_update_begin(struct u64_stats_sync *syncp) |
1141 | { |
1142 | diff --git a/include/net/red.h b/include/net/red.h |
1143 | index 17821f66de111..b3ab5c6bfa83f 100644 |
1144 | --- a/include/net/red.h |
1145 | +++ b/include/net/red.h |
1146 | @@ -167,7 +167,8 @@ static inline void red_set_vars(struct red_vars *v) |
1147 | v->qcount = -1; |
1148 | } |
1149 | |
1150 | -static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log) |
1151 | +static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, |
1152 | + u8 Scell_log, u8 *stab) |
1153 | { |
1154 | if (fls(qth_min) + Wlog > 32) |
1155 | return false; |
1156 | @@ -177,6 +178,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_ |
1157 | return false; |
1158 | if (qth_max < qth_min) |
1159 | return false; |
1160 | + if (stab) { |
1161 | + int i; |
1162 | + |
1163 | + for (i = 0; i < RED_STAB_SIZE; i++) |
1164 | + if (stab[i] >= 32) |
1165 | + return false; |
1166 | + } |
1167 | return true; |
1168 | } |
1169 | |
1170 | diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h |
1171 | index 4113916cc1bb0..af0745f316fe3 100644 |
1172 | --- a/include/net/rtnetlink.h |
1173 | +++ b/include/net/rtnetlink.h |
1174 | @@ -28,6 +28,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh) |
1175 | * |
1176 | * @list: Used internally |
1177 | * @kind: Identifier |
1178 | + * @netns_refund: Physical device, move to init_net on netns exit |
1179 | * @maxtype: Highest device specific netlink attribute number |
1180 | * @policy: Netlink policy for device specific attribute validation |
1181 | * @validate: Optional validation function for netlink/changelink parameters |
1182 | @@ -84,6 +85,7 @@ struct rtnl_link_ops { |
1183 | unsigned int (*get_num_tx_queues)(void); |
1184 | unsigned int (*get_num_rx_queues)(void); |
1185 | |
1186 | + bool netns_refund; |
1187 | int slave_maxtype; |
1188 | const struct nla_policy *slave_policy; |
1189 | int (*slave_validate)(struct nlattr *tb[], |
1190 | diff --git a/kernel/futex.c b/kernel/futex.c |
1191 | index 796b1c8608397..468f39476476b 100644 |
1192 | --- a/kernel/futex.c |
1193 | +++ b/kernel/futex.c |
1194 | @@ -1407,13 +1407,15 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval, |
1195 | |
1196 | static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) |
1197 | { |
1198 | + int err; |
1199 | u32 uninitialized_var(curval); |
1200 | |
1201 | if (unlikely(should_fail_futex(true))) |
1202 | return -EFAULT; |
1203 | |
1204 | - if (unlikely(cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))) |
1205 | - return -EFAULT; |
1206 | + err = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval); |
1207 | + if (unlikely(err)) |
1208 | + return err; |
1209 | |
1210 | /* If user space value changed, let the caller retry */ |
1211 | return curval != uval ? -EAGAIN : 0; |
1212 | @@ -1553,11 +1555,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) |
1213 | if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n")) |
1214 | return; |
1215 | |
1216 | - /* |
1217 | - * Queue the task for later wakeup for after we've released |
1218 | - * the hb->lock. wake_q_add() grabs reference to p. |
1219 | - */ |
1220 | - wake_q_add(wake_q, p); |
1221 | + get_task_struct(p); |
1222 | __unqueue_futex(q); |
1223 | /* |
1224 | * The waiting task can free the futex_q as soon as |
1225 | @@ -1565,8 +1563,14 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) |
1226 | * memory barrier is required here to prevent the following |
1227 | * store to lock_ptr from getting ahead of the plist_del. |
1228 | */ |
1229 | - smp_wmb(); |
1230 | - q->lock_ptr = NULL; |
1231 | + smp_store_release(&q->lock_ptr, NULL); |
1232 | + |
1233 | + /* |
1234 | + * Queue the task for later wakeup for after we've released |
1235 | + * the hb->lock. wake_q_add() grabs reference to p. |
1236 | + */ |
1237 | + wake_q_add(wake_q, p); |
1238 | + put_task_struct(p); |
1239 | } |
1240 | |
1241 | /* |
1242 | @@ -1601,13 +1605,13 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_ |
1243 | */ |
1244 | newval = FUTEX_WAITERS | task_pid_vnr(new_owner); |
1245 | |
1246 | - if (unlikely(should_fail_futex(true))) |
1247 | - ret = -EFAULT; |
1248 | - |
1249 | - if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) { |
1250 | + if (unlikely(should_fail_futex(true))) { |
1251 | ret = -EFAULT; |
1252 | + goto out_unlock; |
1253 | + } |
1254 | |
1255 | - } else if (curval != uval) { |
1256 | + ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval); |
1257 | + if (!ret && (curval != uval)) { |
1258 | /* |
1259 | * If a unconditional UNLOCK_PI operation (user space did not |
1260 | * try the TID->0 transition) raced with a waiter setting the |
1261 | @@ -1793,32 +1797,32 @@ retry_private: |
1262 | double_lock_hb(hb1, hb2); |
1263 | op_ret = futex_atomic_op_inuser(op, uaddr2); |
1264 | if (unlikely(op_ret < 0)) { |
1265 | - |
1266 | double_unlock_hb(hb1, hb2); |
1267 | |
1268 | -#ifndef CONFIG_MMU |
1269 | - /* |
1270 | - * we don't get EFAULT from MMU faults if we don't have an MMU, |
1271 | - * but we might get them from range checking |
1272 | - */ |
1273 | - ret = op_ret; |
1274 | - goto out_put_keys; |
1275 | -#endif |
1276 | - |
1277 | - if (unlikely(op_ret != -EFAULT)) { |
1278 | + if (!IS_ENABLED(CONFIG_MMU) || |
1279 | + unlikely(op_ret != -EFAULT && op_ret != -EAGAIN)) { |
1280 | + /* |
1281 | + * we don't get EFAULT from MMU faults if we don't have |
1282 | + * an MMU, but we might get them from range checking |
1283 | + */ |
1284 | ret = op_ret; |
1285 | goto out_put_keys; |
1286 | } |
1287 | |
1288 | - ret = fault_in_user_writeable(uaddr2); |
1289 | - if (ret) |
1290 | - goto out_put_keys; |
1291 | + if (op_ret == -EFAULT) { |
1292 | + ret = fault_in_user_writeable(uaddr2); |
1293 | + if (ret) |
1294 | + goto out_put_keys; |
1295 | + } |
1296 | |
1297 | - if (!(flags & FLAGS_SHARED)) |
1298 | + if (!(flags & FLAGS_SHARED)) { |
1299 | + cond_resched(); |
1300 | goto retry_private; |
1301 | + } |
1302 | |
1303 | put_futex_key(&key2); |
1304 | put_futex_key(&key1); |
1305 | + cond_resched(); |
1306 | goto retry; |
1307 | } |
1308 | |
1309 | @@ -2334,20 +2338,7 @@ queue_unlock(struct futex_hash_bucket *hb) |
1310 | hb_waiters_dec(hb); |
1311 | } |
1312 | |
1313 | -/** |
1314 | - * queue_me() - Enqueue the futex_q on the futex_hash_bucket |
1315 | - * @q: The futex_q to enqueue |
1316 | - * @hb: The destination hash bucket |
1317 | - * |
1318 | - * The hb->lock must be held by the caller, and is released here. A call to |
1319 | - * queue_me() is typically paired with exactly one call to unqueue_me(). The |
1320 | - * exceptions involve the PI related operations, which may use unqueue_me_pi() |
1321 | - * or nothing if the unqueue is done as part of the wake process and the unqueue |
1322 | - * state is implicit in the state of woken task (see futex_wait_requeue_pi() for |
1323 | - * an example). |
1324 | - */ |
1325 | -static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb) |
1326 | - __releases(&hb->lock) |
1327 | +static inline void __queue_me(struct futex_q *q, struct futex_hash_bucket *hb) |
1328 | { |
1329 | int prio; |
1330 | |
1331 | @@ -2364,6 +2355,24 @@ static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb) |
1332 | plist_node_init(&q->list, prio); |
1333 | plist_add(&q->list, &hb->chain); |
1334 | q->task = current; |
1335 | +} |
1336 | + |
1337 | +/** |
1338 | + * queue_me() - Enqueue the futex_q on the futex_hash_bucket |
1339 | + * @q: The futex_q to enqueue |
1340 | + * @hb: The destination hash bucket |
1341 | + * |
1342 | + * The hb->lock must be held by the caller, and is released here. A call to |
1343 | + * queue_me() is typically paired with exactly one call to unqueue_me(). The |
1344 | + * exceptions involve the PI related operations, which may use unqueue_me_pi() |
1345 | + * or nothing if the unqueue is done as part of the wake process and the unqueue |
1346 | + * state is implicit in the state of woken task (see futex_wait_requeue_pi() for |
1347 | + * an example). |
1348 | + */ |
1349 | +static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb) |
1350 | + __releases(&hb->lock) |
1351 | +{ |
1352 | + __queue_me(q, hb); |
1353 | spin_unlock(&hb->lock); |
1354 | } |
1355 | |
1356 | @@ -2488,10 +2497,22 @@ retry: |
1357 | } |
1358 | |
1359 | /* |
1360 | - * Since we just failed the trylock; there must be an owner. |
1361 | + * The trylock just failed, so either there is an owner or |
1362 | + * there is a higher priority waiter than this one. |
1363 | */ |
1364 | newowner = rt_mutex_owner(&pi_state->pi_mutex); |
1365 | - BUG_ON(!newowner); |
1366 | + /* |
1367 | + * If the higher priority waiter has not yet taken over the |
1368 | + * rtmutex then newowner is NULL. We can't return here with |
1369 | + * that state because it's inconsistent vs. the user space |
1370 | + * state. So drop the locks and try again. It's a valid |
1371 | + * situation and not any different from the other retry |
1372 | + * conditions. |
1373 | + */ |
1374 | + if (unlikely(!newowner)) { |
1375 | + err = -EAGAIN; |
1376 | + goto handle_err; |
1377 | + } |
1378 | } else { |
1379 | WARN_ON_ONCE(argowner != current); |
1380 | if (oldowner == current) { |
1381 | @@ -2509,14 +2530,17 @@ retry: |
1382 | if (!pi_state->owner) |
1383 | newtid |= FUTEX_OWNER_DIED; |
1384 | |
1385 | - if (get_futex_value_locked(&uval, uaddr)) |
1386 | - goto handle_fault; |
1387 | + err = get_futex_value_locked(&uval, uaddr); |
1388 | + if (err) |
1389 | + goto handle_err; |
1390 | |
1391 | for (;;) { |
1392 | newval = (uval & FUTEX_OWNER_DIED) | newtid; |
1393 | |
1394 | - if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) |
1395 | - goto handle_fault; |
1396 | + err = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval); |
1397 | + if (err) |
1398 | + goto handle_err; |
1399 | + |
1400 | if (curval == uval) |
1401 | break; |
1402 | uval = curval; |
1403 | @@ -2531,23 +2555,36 @@ retry: |
1404 | return argowner == current; |
1405 | |
1406 | /* |
1407 | - * To handle the page fault we need to drop the locks here. That gives |
1408 | - * the other task (either the highest priority waiter itself or the |
1409 | - * task which stole the rtmutex) the chance to try the fixup of the |
1410 | - * pi_state. So once we are back from handling the fault we need to |
1411 | - * check the pi_state after reacquiring the locks and before trying to |
1412 | - * do another fixup. When the fixup has been done already we simply |
1413 | - * return. |
1414 | + * In order to reschedule or handle a page fault, we need to drop the |
1415 | + * locks here. In the case of a fault, this gives the other task |
1416 | + * (either the highest priority waiter itself or the task which stole |
1417 | + * the rtmutex) the chance to try the fixup of the pi_state. So once we |
1418 | + * are back from handling the fault we need to check the pi_state after |
1419 | + * reacquiring the locks and before trying to do another fixup. When |
1420 | + * the fixup has been done already we simply return. |
1421 | * |
1422 | * Note: we hold both hb->lock and pi_mutex->wait_lock. We can safely |
1423 | * drop hb->lock since the caller owns the hb -> futex_q relation. |
1424 | * Dropping the pi_mutex->wait_lock requires the state revalidate. |
1425 | */ |
1426 | -handle_fault: |
1427 | +handle_err: |
1428 | raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); |
1429 | spin_unlock(q->lock_ptr); |
1430 | |
1431 | - err = fault_in_user_writeable(uaddr); |
1432 | + switch (err) { |
1433 | + case -EFAULT: |
1434 | + err = fault_in_user_writeable(uaddr); |
1435 | + break; |
1436 | + |
1437 | + case -EAGAIN: |
1438 | + cond_resched(); |
1439 | + err = 0; |
1440 | + break; |
1441 | + |
1442 | + default: |
1443 | + WARN_ON_ONCE(1); |
1444 | + break; |
1445 | + } |
1446 | |
1447 | spin_lock(q->lock_ptr); |
1448 | raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock); |
1449 | @@ -2869,6 +2906,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, |
1450 | { |
1451 | struct hrtimer_sleeper timeout, *to = NULL; |
1452 | struct task_struct *exiting = NULL; |
1453 | + struct rt_mutex_waiter rt_waiter; |
1454 | struct futex_hash_bucket *hb; |
1455 | struct futex_q q = futex_q_init; |
1456 | int res, ret; |
1457 | @@ -2929,24 +2967,71 @@ retry_private: |
1458 | } |
1459 | } |
1460 | |
1461 | + WARN_ON(!q.pi_state); |
1462 | + |
1463 | /* |
1464 | * Only actually queue now that the atomic ops are done: |
1465 | */ |
1466 | - queue_me(&q, hb); |
1467 | + __queue_me(&q, hb); |
1468 | |
1469 | - WARN_ON(!q.pi_state); |
1470 | - /* |
1471 | - * Block on the PI mutex: |
1472 | - */ |
1473 | - if (!trylock) { |
1474 | - ret = rt_mutex_timed_futex_lock(&q.pi_state->pi_mutex, to); |
1475 | - } else { |
1476 | + if (trylock) { |
1477 | ret = rt_mutex_futex_trylock(&q.pi_state->pi_mutex); |
1478 | /* Fixup the trylock return value: */ |
1479 | ret = ret ? 0 : -EWOULDBLOCK; |
1480 | + goto no_block; |
1481 | } |
1482 | |
1483 | + rt_mutex_init_waiter(&rt_waiter); |
1484 | + |
1485 | + /* |
1486 | + * On PREEMPT_RT_FULL, when hb->lock becomes an rt_mutex, we must not |
1487 | + * hold it while doing rt_mutex_start_proxy(), because then it will |
1488 | + * include hb->lock in the blocking chain, even through we'll not in |
1489 | + * fact hold it while blocking. This will lead it to report -EDEADLK |
1490 | + * and BUG when futex_unlock_pi() interleaves with this. |
1491 | + * |
1492 | + * Therefore acquire wait_lock while holding hb->lock, but drop the |
1493 | + * latter before calling __rt_mutex_start_proxy_lock(). This |
1494 | + * interleaves with futex_unlock_pi() -- which does a similar lock |
1495 | + * handoff -- such that the latter can observe the futex_q::pi_state |
1496 | + * before __rt_mutex_start_proxy_lock() is done. |
1497 | + */ |
1498 | + raw_spin_lock_irq(&q.pi_state->pi_mutex.wait_lock); |
1499 | + spin_unlock(q.lock_ptr); |
1500 | + /* |
1501 | + * __rt_mutex_start_proxy_lock() unconditionally enqueues the @rt_waiter |
1502 | + * such that futex_unlock_pi() is guaranteed to observe the waiter when |
1503 | + * it sees the futex_q::pi_state. |
1504 | + */ |
1505 | + ret = __rt_mutex_start_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter, current); |
1506 | + raw_spin_unlock_irq(&q.pi_state->pi_mutex.wait_lock); |
1507 | + |
1508 | + if (ret) { |
1509 | + if (ret == 1) |
1510 | + ret = 0; |
1511 | + goto cleanup; |
1512 | + } |
1513 | + |
1514 | + if (unlikely(to)) |
1515 | + hrtimer_start_expires(&to->timer, HRTIMER_MODE_ABS); |
1516 | + |
1517 | + ret = rt_mutex_wait_proxy_lock(&q.pi_state->pi_mutex, to, &rt_waiter); |
1518 | + |
1519 | +cleanup: |
1520 | spin_lock(q.lock_ptr); |
1521 | + /* |
1522 | + * If we failed to acquire the lock (deadlock/signal/timeout), we must |
1523 | + * first acquire the hb->lock before removing the lock from the |
1524 | + * rt_mutex waitqueue, such that we can keep the hb and rt_mutex wait |
1525 | + * lists consistent. |
1526 | + * |
1527 | + * In particular; it is important that futex_unlock_pi() can not |
1528 | + * observe this inconsistency. |
1529 | + */ |
1530 | + if (ret && !rt_mutex_cleanup_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter)) |
1531 | + ret = 0; |
1532 | + |
1533 | +no_block: |
1534 | /* |
1535 | * Fixup the pi_state owner and possibly acquire the lock if we |
1536 | * haven't already. |
1537 | @@ -2970,8 +3055,10 @@ out_unlock_put_key: |
1538 | out_put_key: |
1539 | put_futex_key(&q.key); |
1540 | out: |
1541 | - if (to) |
1542 | + if (to) { |
1543 | + hrtimer_cancel(&to->timer); |
1544 | destroy_hrtimer_on_stack(&to->timer); |
1545 | + } |
1546 | return ret != -EINTR ? ret : -ERESTARTNOINTR; |
1547 | |
1548 | uaddr_faulted: |
1549 | @@ -3039,14 +3126,14 @@ retry: |
1550 | |
1551 | get_pi_state(pi_state); |
1552 | /* |
1553 | - * Since modifying the wait_list is done while holding both |
1554 | - * hb->lock and wait_lock, holding either is sufficient to |
1555 | - * observe it. |
1556 | - * |
1557 | * By taking wait_lock while still holding hb->lock, we ensure |
1558 | * there is no point where we hold neither; and therefore |
1559 | * wake_futex_pi() must observe a state consistent with what we |
1560 | * observed. |
1561 | + * |
1562 | + * In particular; this forces __rt_mutex_start_proxy() to |
1563 | + * complete such that we're guaranteed to observe the |
1564 | + * rt_waiter. Also see the WARN in wake_futex_pi(). |
1565 | */ |
1566 | raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock); |
1567 | spin_unlock(&hb->lock); |
1568 | @@ -3071,10 +3158,8 @@ retry: |
1569 | * A unconditional UNLOCK_PI op raced against a waiter |
1570 | * setting the FUTEX_WAITERS bit. Try again. |
1571 | */ |
1572 | - if (ret == -EAGAIN) { |
1573 | - put_futex_key(&key); |
1574 | - goto retry; |
1575 | - } |
1576 | + if (ret == -EAGAIN) |
1577 | + goto pi_retry; |
1578 | /* |
1579 | * wake_futex_pi has detected invalid state. Tell user |
1580 | * space. |
1581 | @@ -3089,9 +3174,19 @@ retry: |
1582 | * preserve the WAITERS bit not the OWNER_DIED one. We are the |
1583 | * owner. |
1584 | */ |
1585 | - if (cmpxchg_futex_value_locked(&curval, uaddr, uval, 0)) { |
1586 | + if ((ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, 0))) { |
1587 | spin_unlock(&hb->lock); |
1588 | - goto pi_faulted; |
1589 | + switch (ret) { |
1590 | + case -EFAULT: |
1591 | + goto pi_faulted; |
1592 | + |
1593 | + case -EAGAIN: |
1594 | + goto pi_retry; |
1595 | + |
1596 | + default: |
1597 | + WARN_ON_ONCE(1); |
1598 | + goto out_putkey; |
1599 | + } |
1600 | } |
1601 | |
1602 | /* |
1603 | @@ -3105,6 +3200,11 @@ out_putkey: |
1604 | put_futex_key(&key); |
1605 | return ret; |
1606 | |
1607 | +pi_retry: |
1608 | + put_futex_key(&key); |
1609 | + cond_resched(); |
1610 | + goto retry; |
1611 | + |
1612 | pi_faulted: |
1613 | put_futex_key(&key); |
1614 | |
1615 | @@ -3235,10 +3335,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, |
1616 | * The waiter is allocated on our stack, manipulated by the requeue |
1617 | * code while we sleep on uaddr. |
1618 | */ |
1619 | - debug_rt_mutex_init_waiter(&rt_waiter); |
1620 | - RB_CLEAR_NODE(&rt_waiter.pi_tree_entry); |
1621 | - RB_CLEAR_NODE(&rt_waiter.tree_entry); |
1622 | - rt_waiter.task = NULL; |
1623 | + rt_mutex_init_waiter(&rt_waiter); |
1624 | |
1625 | ret = get_futex_key(uaddr2, flags & FLAGS_SHARED, &key2, VERIFY_WRITE); |
1626 | if (unlikely(ret != 0)) |
1627 | @@ -3443,13 +3540,19 @@ err_unlock: |
1628 | return ret; |
1629 | } |
1630 | |
1631 | +/* Constants for the pending_op argument of handle_futex_death */ |
1632 | +#define HANDLE_DEATH_PENDING true |
1633 | +#define HANDLE_DEATH_LIST false |
1634 | + |
1635 | /* |
1636 | * Process a futex-list entry, check whether it's owned by the |
1637 | * dying task, and do notification if so: |
1638 | */ |
1639 | -static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi) |
1640 | +static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, |
1641 | + bool pi, bool pending_op) |
1642 | { |
1643 | u32 uval, uninitialized_var(nval), mval; |
1644 | + int err; |
1645 | |
1646 | /* Futex address must be 32bit aligned */ |
1647 | if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0) |
1648 | @@ -3459,42 +3562,93 @@ retry: |
1649 | if (get_user(uval, uaddr)) |
1650 | return -1; |
1651 | |
1652 | - if ((uval & FUTEX_TID_MASK) == task_pid_vnr(curr)) { |
1653 | - /* |
1654 | - * Ok, this dying thread is truly holding a futex |
1655 | - * of interest. Set the OWNER_DIED bit atomically |
1656 | - * via cmpxchg, and if the value had FUTEX_WAITERS |
1657 | - * set, wake up a waiter (if any). (We have to do a |
1658 | - * futex_wake() even if OWNER_DIED is already set - |
1659 | - * to handle the rare but possible case of recursive |
1660 | - * thread-death.) The rest of the cleanup is done in |
1661 | - * userspace. |
1662 | - */ |
1663 | - mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED; |
1664 | - /* |
1665 | - * We are not holding a lock here, but we want to have |
1666 | - * the pagefault_disable/enable() protection because |
1667 | - * we want to handle the fault gracefully. If the |
1668 | - * access fails we try to fault in the futex with R/W |
1669 | - * verification via get_user_pages. get_user() above |
1670 | - * does not guarantee R/W access. If that fails we |
1671 | - * give up and leave the futex locked. |
1672 | - */ |
1673 | - if (cmpxchg_futex_value_locked(&nval, uaddr, uval, mval)) { |
1674 | + /* |
1675 | + * Special case for regular (non PI) futexes. The unlock path in |
1676 | + * user space has two race scenarios: |
1677 | + * |
1678 | + * 1. The unlock path releases the user space futex value and |
1679 | + * before it can execute the futex() syscall to wake up |
1680 | + * waiters it is killed. |
1681 | + * |
1682 | + * 2. A woken up waiter is killed before it can acquire the |
1683 | + * futex in user space. |
1684 | + * |
1685 | + * In both cases the TID validation below prevents a wakeup of |
1686 | + * potential waiters which can cause these waiters to block |
1687 | + * forever. |
1688 | + * |
1689 | + * In both cases the following conditions are met: |
1690 | + * |
1691 | + * 1) task->robust_list->list_op_pending != NULL |
1692 | + * @pending_op == true |
1693 | + * 2) User space futex value == 0 |
1694 | + * 3) Regular futex: @pi == false |
1695 | + * |
1696 | + * If these conditions are met, it is safe to attempt waking up a |
1697 | + * potential waiter without touching the user space futex value and |
1698 | + * trying to set the OWNER_DIED bit. The user space futex value is |
1699 | + * uncontended and the rest of the user space mutex state is |
1700 | + * consistent, so a woken waiter will just take over the |
1701 | + * uncontended futex. Setting the OWNER_DIED bit would create |
1702 | + * inconsistent state and malfunction of the user space owner died |
1703 | + * handling. |
1704 | + */ |
1705 | + if (pending_op && !pi && !uval) { |
1706 | + futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY); |
1707 | + return 0; |
1708 | + } |
1709 | + |
1710 | + if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr)) |
1711 | + return 0; |
1712 | + |
1713 | + /* |
1714 | + * Ok, this dying thread is truly holding a futex |
1715 | + * of interest. Set the OWNER_DIED bit atomically |
1716 | + * via cmpxchg, and if the value had FUTEX_WAITERS |
1717 | + * set, wake up a waiter (if any). (We have to do a |
1718 | + * futex_wake() even if OWNER_DIED is already set - |
1719 | + * to handle the rare but possible case of recursive |
1720 | + * thread-death.) The rest of the cleanup is done in |
1721 | + * userspace. |
1722 | + */ |
1723 | + mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED; |
1724 | + |
1725 | + /* |
1726 | + * We are not holding a lock here, but we want to have |
1727 | + * the pagefault_disable/enable() protection because |
1728 | + * we want to handle the fault gracefully. If the |
1729 | + * access fails we try to fault in the futex with R/W |
1730 | + * verification via get_user_pages. get_user() above |
1731 | + * does not guarantee R/W access. If that fails we |
1732 | + * give up and leave the futex locked. |
1733 | + */ |
1734 | + if ((err = cmpxchg_futex_value_locked(&nval, uaddr, uval, mval))) { |
1735 | + switch (err) { |
1736 | + case -EFAULT: |
1737 | if (fault_in_user_writeable(uaddr)) |
1738 | return -1; |
1739 | goto retry; |
1740 | - } |
1741 | - if (nval != uval) |
1742 | + |
1743 | + case -EAGAIN: |
1744 | + cond_resched(); |
1745 | goto retry; |
1746 | |
1747 | - /* |
1748 | - * Wake robust non-PI futexes here. The wakeup of |
1749 | - * PI futexes happens in exit_pi_state(): |
1750 | - */ |
1751 | - if (!pi && (uval & FUTEX_WAITERS)) |
1752 | - futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY); |
1753 | + default: |
1754 | + WARN_ON_ONCE(1); |
1755 | + return err; |
1756 | + } |
1757 | } |
1758 | + |
1759 | + if (nval != uval) |
1760 | + goto retry; |
1761 | + |
1762 | + /* |
1763 | + * Wake robust non-PI futexes here. The wakeup of |
1764 | + * PI futexes happens in exit_pi_state(): |
1765 | + */ |
1766 | + if (!pi && (uval & FUTEX_WAITERS)) |
1767 | + futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY); |
1768 | + |
1769 | return 0; |
1770 | } |
1771 | |
1772 | @@ -3563,10 +3717,11 @@ static void exit_robust_list(struct task_struct *curr) |
1773 | * A pending lock might already be on the list, so |
1774 | * don't process it twice: |
1775 | */ |
1776 | - if (entry != pending) |
1777 | + if (entry != pending) { |
1778 | if (handle_futex_death((void __user *)entry + futex_offset, |
1779 | - curr, pi)) |
1780 | + curr, pi, HANDLE_DEATH_LIST)) |
1781 | return; |
1782 | + } |
1783 | if (rc) |
1784 | return; |
1785 | entry = next_entry; |
1786 | @@ -3580,9 +3735,10 @@ static void exit_robust_list(struct task_struct *curr) |
1787 | cond_resched(); |
1788 | } |
1789 | |
1790 | - if (pending) |
1791 | + if (pending) { |
1792 | handle_futex_death((void __user *)pending + futex_offset, |
1793 | - curr, pip); |
1794 | + curr, pip, HANDLE_DEATH_PENDING); |
1795 | + } |
1796 | } |
1797 | |
1798 | static void futex_cleanup(struct task_struct *tsk) |
1799 | @@ -3865,7 +4021,8 @@ void compat_exit_robust_list(struct task_struct *curr) |
1800 | if (entry != pending) { |
1801 | void __user *uaddr = futex_uaddr(entry, futex_offset); |
1802 | |
1803 | - if (handle_futex_death(uaddr, curr, pi)) |
1804 | + if (handle_futex_death(uaddr, curr, pi, |
1805 | + HANDLE_DEATH_LIST)) |
1806 | return; |
1807 | } |
1808 | if (rc) |
1809 | @@ -3884,7 +4041,7 @@ void compat_exit_robust_list(struct task_struct *curr) |
1810 | if (pending) { |
1811 | void __user *uaddr = futex_uaddr(pending, futex_offset); |
1812 | |
1813 | - handle_futex_death(uaddr, curr, pip); |
1814 | + handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING); |
1815 | } |
1816 | } |
1817 | |
1818 | diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c |
1819 | index 6ff4156b3929e..1589e131ee4b8 100644 |
1820 | --- a/kernel/locking/rtmutex.c |
1821 | +++ b/kernel/locking/rtmutex.c |
1822 | @@ -1176,6 +1176,14 @@ void rt_mutex_adjust_pi(struct task_struct *task) |
1823 | next_lock, NULL, task); |
1824 | } |
1825 | |
1826 | +void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter) |
1827 | +{ |
1828 | + debug_rt_mutex_init_waiter(waiter); |
1829 | + RB_CLEAR_NODE(&waiter->pi_tree_entry); |
1830 | + RB_CLEAR_NODE(&waiter->tree_entry); |
1831 | + waiter->task = NULL; |
1832 | +} |
1833 | + |
1834 | /** |
1835 | * __rt_mutex_slowlock() - Perform the wait-wake-try-to-take loop |
1836 | * @lock: the rt_mutex to take |
1837 | @@ -1258,9 +1266,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state, |
1838 | unsigned long flags; |
1839 | int ret = 0; |
1840 | |
1841 | - debug_rt_mutex_init_waiter(&waiter); |
1842 | - RB_CLEAR_NODE(&waiter.pi_tree_entry); |
1843 | - RB_CLEAR_NODE(&waiter.tree_entry); |
1844 | + rt_mutex_init_waiter(&waiter); |
1845 | |
1846 | /* |
1847 | * Technically we could use raw_spin_[un]lock_irq() here, but this can |
1848 | @@ -1516,19 +1522,6 @@ int __sched rt_mutex_lock_interruptible(struct rt_mutex *lock) |
1849 | } |
1850 | EXPORT_SYMBOL_GPL(rt_mutex_lock_interruptible); |
1851 | |
1852 | -/* |
1853 | - * Futex variant with full deadlock detection. |
1854 | - * Futex variants must not use the fast-path, see __rt_mutex_futex_unlock(). |
1855 | - */ |
1856 | -int __sched rt_mutex_timed_futex_lock(struct rt_mutex *lock, |
1857 | - struct hrtimer_sleeper *timeout) |
1858 | -{ |
1859 | - might_sleep(); |
1860 | - |
1861 | - return rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, |
1862 | - timeout, RT_MUTEX_FULL_CHAINWALK); |
1863 | -} |
1864 | - |
1865 | /* |
1866 | * Futex variant, must not use fastpath. |
1867 | */ |
1868 | @@ -1703,30 +1696,34 @@ void rt_mutex_proxy_unlock(struct rt_mutex *lock) |
1869 | } |
1870 | |
1871 | /** |
1872 | - * rt_mutex_start_proxy_lock() - Start lock acquisition for another task |
1873 | + * __rt_mutex_start_proxy_lock() - Start lock acquisition for another task |
1874 | * @lock: the rt_mutex to take |
1875 | * @waiter: the pre-initialized rt_mutex_waiter |
1876 | * @task: the task to prepare |
1877 | * |
1878 | + * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock |
1879 | + * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that. |
1880 | + * |
1881 | + * NOTE: does _NOT_ remove the @waiter on failure; must either call |
1882 | + * rt_mutex_wait_proxy_lock() or rt_mutex_cleanup_proxy_lock() after this. |
1883 | + * |
1884 | * Returns: |
1885 | * 0 - task blocked on lock |
1886 | * 1 - acquired the lock for task, caller should wake it up |
1887 | * <0 - error |
1888 | * |
1889 | - * Special API call for FUTEX_REQUEUE_PI support. |
1890 | + * Special API call for PI-futex support. |
1891 | */ |
1892 | -int rt_mutex_start_proxy_lock(struct rt_mutex *lock, |
1893 | +int __rt_mutex_start_proxy_lock(struct rt_mutex *lock, |
1894 | struct rt_mutex_waiter *waiter, |
1895 | struct task_struct *task) |
1896 | { |
1897 | int ret; |
1898 | |
1899 | - raw_spin_lock_irq(&lock->wait_lock); |
1900 | + lockdep_assert_held(&lock->wait_lock); |
1901 | |
1902 | - if (try_to_take_rt_mutex(lock, task, NULL)) { |
1903 | - raw_spin_unlock_irq(&lock->wait_lock); |
1904 | + if (try_to_take_rt_mutex(lock, task, NULL)) |
1905 | return 1; |
1906 | - } |
1907 | |
1908 | /* We enforce deadlock detection for futexes */ |
1909 | ret = task_blocks_on_rt_mutex(lock, waiter, task, |
1910 | @@ -1742,13 +1739,42 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock, |
1911 | ret = 0; |
1912 | } |
1913 | |
1914 | + debug_rt_mutex_print_deadlock(waiter); |
1915 | + |
1916 | + return ret; |
1917 | +} |
1918 | + |
1919 | +/** |
1920 | + * rt_mutex_start_proxy_lock() - Start lock acquisition for another task |
1921 | + * @lock: the rt_mutex to take |
1922 | + * @waiter: the pre-initialized rt_mutex_waiter |
1923 | + * @task: the task to prepare |
1924 | + * |
1925 | + * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock |
1926 | + * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that. |
1927 | + * |
1928 | + * NOTE: unlike __rt_mutex_start_proxy_lock this _DOES_ remove the @waiter |
1929 | + * on failure. |
1930 | + * |
1931 | + * Returns: |
1932 | + * 0 - task blocked on lock |
1933 | + * 1 - acquired the lock for task, caller should wake it up |
1934 | + * <0 - error |
1935 | + * |
1936 | + * Special API call for PI-futex support. |
1937 | + */ |
1938 | +int rt_mutex_start_proxy_lock(struct rt_mutex *lock, |
1939 | + struct rt_mutex_waiter *waiter, |
1940 | + struct task_struct *task) |
1941 | +{ |
1942 | + int ret; |
1943 | + |
1944 | + raw_spin_lock_irq(&lock->wait_lock); |
1945 | + ret = __rt_mutex_start_proxy_lock(lock, waiter, task); |
1946 | if (unlikely(ret)) |
1947 | remove_waiter(lock, waiter); |
1948 | - |
1949 | raw_spin_unlock_irq(&lock->wait_lock); |
1950 | |
1951 | - debug_rt_mutex_print_deadlock(waiter); |
1952 | - |
1953 | return ret; |
1954 | } |
1955 | |
1956 | @@ -1796,18 +1822,14 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock, |
1957 | int ret; |
1958 | |
1959 | raw_spin_lock_irq(&lock->wait_lock); |
1960 | - |
1961 | - set_current_state(TASK_INTERRUPTIBLE); |
1962 | - |
1963 | /* sleep on the mutex */ |
1964 | + set_current_state(TASK_INTERRUPTIBLE); |
1965 | ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter); |
1966 | - |
1967 | /* |
1968 | * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might |
1969 | * have to fix that up. |
1970 | */ |
1971 | fixup_rt_mutex_waiters(lock); |
1972 | - |
1973 | raw_spin_unlock_irq(&lock->wait_lock); |
1974 | |
1975 | return ret; |
1976 | @@ -1818,7 +1840,8 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock, |
1977 | * @lock: the rt_mutex we were woken on |
1978 | * @waiter: the pre-initialized rt_mutex_waiter |
1979 | * |
1980 | - * Attempt to clean up after a failed rt_mutex_wait_proxy_lock(). |
1981 | + * Attempt to clean up after a failed __rt_mutex_start_proxy_lock() or |
1982 | + * rt_mutex_wait_proxy_lock(). |
1983 | * |
1984 | * Unless we acquired the lock; we're still enqueued on the wait-list and can |
1985 | * in fact still be granted ownership until we're removed. Therefore we can |
1986 | @@ -1838,15 +1861,32 @@ bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock, |
1987 | bool cleanup = false; |
1988 | |
1989 | raw_spin_lock_irq(&lock->wait_lock); |
1990 | + /* |
1991 | + * Do an unconditional try-lock, this deals with the lock stealing |
1992 | + * state where __rt_mutex_futex_unlock() -> mark_wakeup_next_waiter() |
1993 | + * sets a NULL owner. |
1994 | + * |
1995 | + * We're not interested in the return value, because the subsequent |
1996 | + * test on rt_mutex_owner() will infer that. If the trylock succeeded, |
1997 | + * we will own the lock and it will have removed the waiter. If we |
1998 | + * failed the trylock, we're still not owner and we need to remove |
1999 | + * ourselves. |
2000 | + */ |
2001 | + try_to_take_rt_mutex(lock, current, waiter); |
2002 | /* |
2003 | * Unless we're the owner; we're still enqueued on the wait_list. |
2004 | * So check if we became owner, if not, take us off the wait_list. |
2005 | */ |
2006 | if (rt_mutex_owner(lock) != current) { |
2007 | remove_waiter(lock, waiter); |
2008 | - fixup_rt_mutex_waiters(lock); |
2009 | cleanup = true; |
2010 | } |
2011 | + /* |
2012 | + * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might |
2013 | + * have to fix that up. |
2014 | + */ |
2015 | + fixup_rt_mutex_waiters(lock); |
2016 | + |
2017 | raw_spin_unlock_irq(&lock->wait_lock); |
2018 | |
2019 | return cleanup; |
2020 | diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h |
2021 | index bea5d677fe343..c5d3f577b2a7e 100644 |
2022 | --- a/kernel/locking/rtmutex_common.h |
2023 | +++ b/kernel/locking/rtmutex_common.h |
2024 | @@ -103,6 +103,10 @@ extern struct task_struct *rt_mutex_next_owner(struct rt_mutex *lock); |
2025 | extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock, |
2026 | struct task_struct *proxy_owner); |
2027 | extern void rt_mutex_proxy_unlock(struct rt_mutex *lock); |
2028 | +extern void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter); |
2029 | +extern int __rt_mutex_start_proxy_lock(struct rt_mutex *lock, |
2030 | + struct rt_mutex_waiter *waiter, |
2031 | + struct task_struct *task); |
2032 | extern int rt_mutex_start_proxy_lock(struct rt_mutex *lock, |
2033 | struct rt_mutex_waiter *waiter, |
2034 | struct task_struct *task); |
2035 | @@ -111,7 +115,6 @@ extern int rt_mutex_wait_proxy_lock(struct rt_mutex *lock, |
2036 | struct rt_mutex_waiter *waiter); |
2037 | extern bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock, |
2038 | struct rt_mutex_waiter *waiter); |
2039 | -extern int rt_mutex_timed_futex_lock(struct rt_mutex *l, struct hrtimer_sleeper *to); |
2040 | extern int rt_mutex_futex_trylock(struct rt_mutex *l); |
2041 | extern int __rt_mutex_futex_trylock(struct rt_mutex *l); |
2042 | |
2043 | diff --git a/net/core/dev.c b/net/core/dev.c |
2044 | index 9ac591dd16d50..5b69a9a41dd50 100644 |
2045 | --- a/net/core/dev.c |
2046 | +++ b/net/core/dev.c |
2047 | @@ -8300,7 +8300,7 @@ static void __net_exit default_device_exit(struct net *net) |
2048 | continue; |
2049 | |
2050 | /* Leave virtual devices for the generic cleanup */ |
2051 | - if (dev->rtnl_link_ops) |
2052 | + if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund) |
2053 | continue; |
2054 | |
2055 | /* Push remaining network devices to init_net */ |
2056 | diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c |
2057 | index 1a13715b9a591..f37fbc71fc1db 100644 |
2058 | --- a/net/mac80211/cfg.c |
2059 | +++ b/net/mac80211/cfg.c |
2060 | @@ -2681,14 +2681,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, |
2061 | continue; |
2062 | |
2063 | for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) { |
2064 | - if (~sdata->rc_rateidx_mcs_mask[i][j]) { |
2065 | + if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) { |
2066 | sdata->rc_has_mcs_mask[i] = true; |
2067 | break; |
2068 | } |
2069 | } |
2070 | |
2071 | for (j = 0; j < NL80211_VHT_NSS_MAX; j++) { |
2072 | - if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { |
2073 | + if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) { |
2074 | sdata->rc_has_vht_mcs_mask[i] = true; |
2075 | break; |
2076 | } |
2077 | diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c |
2078 | index 0c0695eb2609a..3796c24defcb9 100644 |
2079 | --- a/net/mac80211/ibss.c |
2080 | +++ b/net/mac80211/ibss.c |
2081 | @@ -1862,6 +1862,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata) |
2082 | |
2083 | /* remove beacon */ |
2084 | kfree(sdata->u.ibss.ie); |
2085 | + sdata->u.ibss.ie = NULL; |
2086 | + sdata->u.ibss.ie_len = 0; |
2087 | |
2088 | /* on the next join, re-program HT parameters */ |
2089 | memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa)); |
2090 | diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c |
2091 | index d62b7a7f65bb0..2cc5ced1cec94 100644 |
2092 | --- a/net/qrtr/qrtr.c |
2093 | +++ b/net/qrtr/qrtr.c |
2094 | @@ -728,6 +728,11 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg, |
2095 | rc = copied; |
2096 | |
2097 | if (addr) { |
2098 | + /* There is an anonymous 2-byte hole after sq_family, |
2099 | + * make sure to clear it. |
2100 | + */ |
2101 | + memset(addr, 0, sizeof(*addr)); |
2102 | + |
2103 | addr->sq_family = AF_QIPCRTR; |
2104 | addr->sq_node = le32_to_cpu(phdr->src_node_id); |
2105 | addr->sq_port = le32_to_cpu(phdr->src_port_id); |
2106 | diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c |
2107 | index 2fb79c245f3fc..1283c3bf401a5 100644 |
2108 | --- a/net/sched/sch_choke.c |
2109 | +++ b/net/sched/sch_choke.c |
2110 | @@ -409,6 +409,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt) |
2111 | struct sk_buff **old = NULL; |
2112 | unsigned int mask; |
2113 | u32 max_P; |
2114 | + u8 *stab; |
2115 | |
2116 | if (opt == NULL) |
2117 | return -EINVAL; |
2118 | @@ -424,8 +425,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt) |
2119 | max_P = tb[TCA_CHOKE_MAX_P] ? nla_get_u32(tb[TCA_CHOKE_MAX_P]) : 0; |
2120 | |
2121 | ctl = nla_data(tb[TCA_CHOKE_PARMS]); |
2122 | - |
2123 | - if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) |
2124 | + stab = nla_data(tb[TCA_CHOKE_STAB]); |
2125 | + if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) |
2126 | return -EINVAL; |
2127 | |
2128 | if (ctl->limit > CHOKE_MAX_QUEUE) |
2129 | @@ -478,7 +479,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt) |
2130 | |
2131 | red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, |
2132 | ctl->Plog, ctl->Scell_log, |
2133 | - nla_data(tb[TCA_CHOKE_STAB]), |
2134 | + stab, |
2135 | max_P); |
2136 | red_set_vars(&q->vars); |
2137 | |
2138 | diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c |
2139 | index d86a96313981b..745e8fae62b3e 100644 |
2140 | --- a/net/sched/sch_gred.c |
2141 | +++ b/net/sched/sch_gred.c |
2142 | @@ -356,7 +356,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp, |
2143 | struct gred_sched *table = qdisc_priv(sch); |
2144 | struct gred_sched_data *q = table->tab[dp]; |
2145 | |
2146 | - if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) |
2147 | + if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) |
2148 | return -EINVAL; |
2149 | |
2150 | if (!q) { |
2151 | diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c |
2152 | index 797895bddcfda..d6abf5c5a5b82 100644 |
2153 | --- a/net/sched/sch_red.c |
2154 | +++ b/net/sched/sch_red.c |
2155 | @@ -169,6 +169,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt) |
2156 | struct Qdisc *child = NULL; |
2157 | int err; |
2158 | u32 max_P; |
2159 | + u8 *stab; |
2160 | |
2161 | if (opt == NULL) |
2162 | return -EINVAL; |
2163 | @@ -184,7 +185,9 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt) |
2164 | max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; |
2165 | |
2166 | ctl = nla_data(tb[TCA_RED_PARMS]); |
2167 | - if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) |
2168 | + stab = nla_data(tb[TCA_RED_STAB]); |
2169 | + if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, |
2170 | + ctl->Scell_log, stab)) |
2171 | return -EINVAL; |
2172 | |
2173 | if (ctl->limit > 0) { |
2174 | @@ -206,7 +209,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt) |
2175 | red_set_parms(&q->parms, |
2176 | ctl->qth_min, ctl->qth_max, ctl->Wlog, |
2177 | ctl->Plog, ctl->Scell_log, |
2178 | - nla_data(tb[TCA_RED_STAB]), |
2179 | + stab, |
2180 | max_P); |
2181 | red_set_vars(&q->vars); |
2182 | |
2183 | diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c |
2184 | index 69a5fffed86c7..b2598a32b556e 100644 |
2185 | --- a/net/sched/sch_sfq.c |
2186 | +++ b/net/sched/sch_sfq.c |
2187 | @@ -645,7 +645,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) |
2188 | } |
2189 | |
2190 | if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, |
2191 | - ctl_v1->Wlog, ctl_v1->Scell_log)) |
2192 | + ctl_v1->Wlog, ctl_v1->Scell_log, NULL)) |
2193 | return -EINVAL; |
2194 | if (ctl_v1 && ctl_v1->qth_min) { |
2195 | p = kmalloc(sizeof(*p), GFP_KERNEL); |
2196 | diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c |
2197 | index b87221efdf7e0..51fdec9273d72 100644 |
2198 | --- a/tools/perf/util/auxtrace.c |
2199 | +++ b/tools/perf/util/auxtrace.c |
2200 | @@ -248,10 +248,6 @@ static int auxtrace_queues__add_buffer(struct auxtrace_queues *queues, |
2201 | queue->set = true; |
2202 | queue->tid = buffer->tid; |
2203 | queue->cpu = buffer->cpu; |
2204 | - } else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) { |
2205 | - pr_err("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n", |
2206 | - queue->cpu, queue->tid, buffer->cpu, buffer->tid); |
2207 | - return -EINVAL; |
2208 | } |
2209 | |
2210 | buffer->buffer_nr = queues->next_buffer_nr++; |