Contents of /trunk/kernel-alx-legacy/patches-4.9/0370-4.9.271-all-fixes.patch
Parent Directory | Revision Log
Revision 3672 -
(show annotations)
(download)
Mon Oct 24 14:07:49 2022 UTC (23 months ago) by niro
File size: 85208 byte(s)
Mon Oct 24 14:07:49 2022 UTC (23 months ago) by niro
File size: 85208 byte(s)
-linux-4.9.271
1 | diff --git a/Documentation/sphinx/parse-headers.pl b/Documentation/sphinx/parse-headers.pl |
2 | index db0186a7618f2..299b0f82af27f 100755 |
3 | --- a/Documentation/sphinx/parse-headers.pl |
4 | +++ b/Documentation/sphinx/parse-headers.pl |
5 | @@ -1,4 +1,4 @@ |
6 | -#!/usr/bin/perl |
7 | +#!/usr/bin/env perl |
8 | use strict; |
9 | use Text::Tabs; |
10 | |
11 | diff --git a/Documentation/target/tcm_mod_builder.py b/Documentation/target/tcm_mod_builder.py |
12 | index 94bf6944bb1e4..7e79ff6b09e0e 100755 |
13 | --- a/Documentation/target/tcm_mod_builder.py |
14 | +++ b/Documentation/target/tcm_mod_builder.py |
15 | @@ -1,4 +1,4 @@ |
16 | -#!/usr/bin/python |
17 | +#!/usr/bin/env python |
18 | # The TCM v4 multi-protocol fabric module generation script for drivers/target/$NEW_MOD |
19 | # |
20 | # Copyright (c) 2010 Rising Tide Systems |
21 | diff --git a/Documentation/trace/postprocess/decode_msr.py b/Documentation/trace/postprocess/decode_msr.py |
22 | index 0ab40e0db5809..aa9cc7abd5c2b 100644 |
23 | --- a/Documentation/trace/postprocess/decode_msr.py |
24 | +++ b/Documentation/trace/postprocess/decode_msr.py |
25 | @@ -1,4 +1,4 @@ |
26 | -#!/usr/bin/python |
27 | +#!/usr/bin/env python |
28 | # add symbolic names to read_msr / write_msr in trace |
29 | # decode_msr msr-index.h < trace |
30 | import sys |
31 | diff --git a/Documentation/trace/postprocess/trace-pagealloc-postprocess.pl b/Documentation/trace/postprocess/trace-pagealloc-postprocess.pl |
32 | index 0a120aae33ce5..b9b7d80c2f9d2 100644 |
33 | --- a/Documentation/trace/postprocess/trace-pagealloc-postprocess.pl |
34 | +++ b/Documentation/trace/postprocess/trace-pagealloc-postprocess.pl |
35 | @@ -1,4 +1,4 @@ |
36 | -#!/usr/bin/perl |
37 | +#!/usr/bin/env perl |
38 | # This is a POC (proof of concept or piece of crap, take your pick) for reading the |
39 | # text representation of trace output related to page allocation. It makes an attempt |
40 | # to extract some high-level information on what is going on. The accuracy of the parser |
41 | diff --git a/Documentation/trace/postprocess/trace-vmscan-postprocess.pl b/Documentation/trace/postprocess/trace-vmscan-postprocess.pl |
42 | index 8f961ef2b4577..7749cdf372f76 100644 |
43 | --- a/Documentation/trace/postprocess/trace-vmscan-postprocess.pl |
44 | +++ b/Documentation/trace/postprocess/trace-vmscan-postprocess.pl |
45 | @@ -1,4 +1,4 @@ |
46 | -#!/usr/bin/perl |
47 | +#!/usr/bin/env perl |
48 | # This is a POC for reading the text representation of trace output related to |
49 | # page reclaim. It makes an attempt to extract some high-level information on |
50 | # what is going on. The accuracy of the parser may vary |
51 | diff --git a/Makefile b/Makefile |
52 | index e8313ffb8af98..4964c2494edb5 100644 |
53 | --- a/Makefile |
54 | +++ b/Makefile |
55 | @@ -1,6 +1,6 @@ |
56 | VERSION = 4 |
57 | PATCHLEVEL = 9 |
58 | -SUBLEVEL = 270 |
59 | +SUBLEVEL = 271 |
60 | EXTRAVERSION = |
61 | NAME = Roaring Lionus |
62 | |
63 | diff --git a/arch/ia64/scripts/unwcheck.py b/arch/ia64/scripts/unwcheck.py |
64 | index 2bfd941ff7c7c..c27849889e193 100644 |
65 | --- a/arch/ia64/scripts/unwcheck.py |
66 | +++ b/arch/ia64/scripts/unwcheck.py |
67 | @@ -1,4 +1,4 @@ |
68 | -#!/usr/bin/python |
69 | +#!/usr/bin/env python |
70 | # |
71 | # Usage: unwcheck.py FILE |
72 | # |
73 | diff --git a/arch/mips/alchemy/board-xxs1500.c b/arch/mips/alchemy/board-xxs1500.c |
74 | index 0fc53e08a894c..c05f7376148a7 100644 |
75 | --- a/arch/mips/alchemy/board-xxs1500.c |
76 | +++ b/arch/mips/alchemy/board-xxs1500.c |
77 | @@ -30,6 +30,7 @@ |
78 | #include <asm/bootinfo.h> |
79 | #include <asm/reboot.h> |
80 | #include <asm/mach-au1x00/au1000.h> |
81 | +#include <asm/mach-au1x00/gpio-au1000.h> |
82 | #include <prom.h> |
83 | |
84 | const char *get_system_type(void) |
85 | diff --git a/arch/mips/ralink/of.c b/arch/mips/ralink/of.c |
86 | index 0aa67a2d0ae6e..6b72268303541 100644 |
87 | --- a/arch/mips/ralink/of.c |
88 | +++ b/arch/mips/ralink/of.c |
89 | @@ -10,6 +10,7 @@ |
90 | |
91 | #include <linux/io.h> |
92 | #include <linux/clk.h> |
93 | +#include <linux/export.h> |
94 | #include <linux/init.h> |
95 | #include <linux/sizes.h> |
96 | #include <linux/of_fdt.h> |
97 | @@ -27,6 +28,7 @@ |
98 | |
99 | __iomem void *rt_sysc_membase; |
100 | __iomem void *rt_memc_membase; |
101 | +EXPORT_SYMBOL_GPL(rt_sysc_membase); |
102 | |
103 | __iomem void *plat_of_remap_node(const char *node) |
104 | { |
105 | diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h |
106 | new file mode 100644 |
107 | index 0000000000000..7538294721bed |
108 | --- /dev/null |
109 | +++ b/arch/openrisc/include/asm/barrier.h |
110 | @@ -0,0 +1,9 @@ |
111 | +/* SPDX-License-Identifier: GPL-2.0 */ |
112 | +#ifndef __ASM_BARRIER_H |
113 | +#define __ASM_BARRIER_H |
114 | + |
115 | +#define mb() asm volatile ("l.msync" ::: "memory") |
116 | + |
117 | +#include <asm-generic/barrier.h> |
118 | + |
119 | +#endif /* __ASM_BARRIER_H */ |
120 | diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c |
121 | index bedfd2412ec19..7975ddd40b357 100644 |
122 | --- a/drivers/char/hpet.c |
123 | +++ b/drivers/char/hpet.c |
124 | @@ -976,6 +976,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) |
125 | if (ACPI_SUCCESS(status)) { |
126 | hdp->hd_phys_address = addr.address.minimum; |
127 | hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length); |
128 | + if (!hdp->hd_address) |
129 | + return AE_ERROR; |
130 | |
131 | if (hpet_is_known(hdp)) { |
132 | iounmap(hdp->hd_address); |
133 | @@ -989,6 +991,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) |
134 | hdp->hd_phys_address = fixmem32->address; |
135 | hdp->hd_address = ioremap(fixmem32->address, |
136 | HPET_RANGE_SIZE); |
137 | + if (!hdp->hd_address) |
138 | + return AE_ERROR; |
139 | |
140 | if (hpet_is_known(hdp)) { |
141 | iounmap(hdp->hd_address); |
142 | diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c |
143 | index 82f36e4660830..143ea7cad7561 100644 |
144 | --- a/drivers/dma/qcom/hidma_mgmt.c |
145 | +++ b/drivers/dma/qcom/hidma_mgmt.c |
146 | @@ -398,6 +398,20 @@ static int __init hidma_mgmt_init(void) |
147 | of_node_put(child); |
148 | } |
149 | #endif |
150 | + /* |
151 | + * We do not check for return value here, as it is assumed that |
152 | + * platform_driver_register must not fail. The reason for this is that |
153 | + * the (potential) hidma_mgmt_of_populate_channels calls above are not |
154 | + * cleaned up if it does fail, and to do this work is quite |
155 | + * complicated. In particular, various calls of of_address_to_resource, |
156 | + * of_irq_to_resource, platform_device_register_full, of_dma_configure, |
157 | + * and of_msi_configure which then call other functions and so on, must |
158 | + * be cleaned up - this is not a trivial exercise. |
159 | + * |
160 | + * Currently, this module is not intended to be unloaded, and there is |
161 | + * no module_exit function defined which does the needed cleanup. For |
162 | + * this reason, we have to assume success here. |
163 | + */ |
164 | platform_driver_register(&hidma_mgmt_driver); |
165 | |
166 | return 0; |
167 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c |
168 | index 7271e3f32d82e..ab041ae58b20a 100644 |
169 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c |
170 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c |
171 | @@ -886,6 +886,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm) |
172 | |
173 | if (gtt && gtt->userptr) { |
174 | kfree(ttm->sg); |
175 | + ttm->sg = NULL; |
176 | ttm->page_flags &= ~TTM_PAGE_FLAG_SG; |
177 | return; |
178 | } |
179 | diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c |
180 | index 26f1691f67abc..0e04b27e3158d 100644 |
181 | --- a/drivers/i2c/busses/i2c-i801.c |
182 | +++ b/drivers/i2c/busses/i2c-i801.c |
183 | @@ -375,11 +375,9 @@ static int i801_check_post(struct i801_priv *priv, int status) |
184 | dev_err(&priv->pci_dev->dev, "Transaction timeout\n"); |
185 | /* try to stop the current command */ |
186 | dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n"); |
187 | - outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL, |
188 | - SMBHSTCNT(priv)); |
189 | + outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv)); |
190 | usleep_range(1000, 2000); |
191 | - outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL), |
192 | - SMBHSTCNT(priv)); |
193 | + outb_p(0, SMBHSTCNT(priv)); |
194 | |
195 | /* Check if it worked */ |
196 | status = inb_p(SMBHSTSTS(priv)); |
197 | diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c |
198 | index 499af26e736e7..acccdfb954207 100644 |
199 | --- a/drivers/i2c/busses/i2c-s3c2410.c |
200 | +++ b/drivers/i2c/busses/i2c-s3c2410.c |
201 | @@ -495,7 +495,10 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat) |
202 | * forces us to send a new START |
203 | * when we change direction |
204 | */ |
205 | + dev_dbg(i2c->dev, |
206 | + "missing START before write->read\n"); |
207 | s3c24xx_i2c_stop(i2c, -EINVAL); |
208 | + break; |
209 | } |
210 | |
211 | goto retry_write; |
212 | diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c |
213 | index 437762a1e4877..f940b1607ef45 100644 |
214 | --- a/drivers/iio/adc/ad7793.c |
215 | +++ b/drivers/iio/adc/ad7793.c |
216 | @@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, |
217 | id &= AD7793_ID_MASK; |
218 | |
219 | if (id != st->chip_info->id) { |
220 | + ret = -ENODEV; |
221 | dev_err(&st->sd.spi->dev, "device ID query failed\n"); |
222 | goto out; |
223 | } |
224 | diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c |
225 | index d5bdbaf93a1af..d0b6377b98345 100644 |
226 | --- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c |
227 | +++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c |
228 | @@ -645,17 +645,19 @@ static void |
229 | release_io(struct inf_hw *hw) |
230 | { |
231 | if (hw->cfg.mode) { |
232 | - if (hw->cfg.p) { |
233 | + if (hw->cfg.mode == AM_MEMIO) { |
234 | release_mem_region(hw->cfg.start, hw->cfg.size); |
235 | - iounmap(hw->cfg.p); |
236 | + if (hw->cfg.p) |
237 | + iounmap(hw->cfg.p); |
238 | } else |
239 | release_region(hw->cfg.start, hw->cfg.size); |
240 | hw->cfg.mode = AM_NONE; |
241 | } |
242 | if (hw->addr.mode) { |
243 | - if (hw->addr.p) { |
244 | + if (hw->addr.mode == AM_MEMIO) { |
245 | release_mem_region(hw->addr.start, hw->addr.size); |
246 | - iounmap(hw->addr.p); |
247 | + if (hw->addr.p) |
248 | + iounmap(hw->addr.p); |
249 | } else |
250 | release_region(hw->addr.start, hw->addr.size); |
251 | hw->addr.mode = AM_NONE; |
252 | @@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw) |
253 | (ulong)hw->cfg.start, (ulong)hw->cfg.size); |
254 | return err; |
255 | } |
256 | - if (hw->ci->cfg_mode == AM_MEMIO) |
257 | - hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); |
258 | hw->cfg.mode = hw->ci->cfg_mode; |
259 | + if (hw->ci->cfg_mode == AM_MEMIO) { |
260 | + hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); |
261 | + if (!hw->cfg.p) |
262 | + return -ENOMEM; |
263 | + } |
264 | if (debug & DEBUG_HW) |
265 | pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n", |
266 | hw->name, (ulong)hw->cfg.start, |
267 | @@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw) |
268 | (ulong)hw->addr.start, (ulong)hw->addr.size); |
269 | return err; |
270 | } |
271 | - if (hw->ci->addr_mode == AM_MEMIO) |
272 | - hw->addr.p = ioremap(hw->addr.start, hw->addr.size); |
273 | hw->addr.mode = hw->ci->addr_mode; |
274 | + if (hw->ci->addr_mode == AM_MEMIO) { |
275 | + hw->addr.p = ioremap(hw->addr.start, hw->addr.size); |
276 | + if (!hw->addr.p) |
277 | + return -ENOMEM; |
278 | + } |
279 | if (debug & DEBUG_HW) |
280 | pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n", |
281 | hw->name, (ulong)hw->addr.start, |
282 | diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c |
283 | index 6acdbec05f702..d85d13a4c57a4 100644 |
284 | --- a/drivers/md/dm-snap.c |
285 | +++ b/drivers/md/dm-snap.c |
286 | @@ -788,7 +788,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new) |
287 | static uint32_t __minimum_chunk_size(struct origin *o) |
288 | { |
289 | struct dm_snapshot *snap; |
290 | - unsigned chunk_size = 0; |
291 | + unsigned chunk_size = rounddown_pow_of_two(UINT_MAX); |
292 | |
293 | if (o) |
294 | list_for_each_entry(snap, &o->snapshots, list) |
295 | diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c |
296 | index e87ac30d7fb83..b43135c5a9607 100644 |
297 | --- a/drivers/media/dvb-frontends/sp8870.c |
298 | +++ b/drivers/media/dvb-frontends/sp8870.c |
299 | @@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe) |
300 | sp8870_writereg(state, 0xc05, reg0xc05); |
301 | |
302 | // read status reg in order to clear pending irqs |
303 | - sp8870_readreg(state, 0x200); |
304 | + err = sp8870_readreg(state, 0x200); |
305 | + if (err < 0) |
306 | + return err; |
307 | |
308 | // system controller start |
309 | sp8870_microcontroller_start(state); |
310 | diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c |
311 | index a0a90dd34ca83..a098aeb290c36 100644 |
312 | --- a/drivers/media/usb/gspca/m5602/m5602_po1030.c |
313 | +++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c |
314 | @@ -159,6 +159,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = { |
315 | int po1030_probe(struct sd *sd) |
316 | { |
317 | u8 dev_id_h = 0, i; |
318 | + int err; |
319 | struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; |
320 | |
321 | if (force_sensor) { |
322 | @@ -177,10 +178,13 @@ int po1030_probe(struct sd *sd) |
323 | for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) { |
324 | u8 data = preinit_po1030[i][2]; |
325 | if (preinit_po1030[i][0] == SENSOR) |
326 | - m5602_write_sensor(sd, |
327 | - preinit_po1030[i][1], &data, 1); |
328 | + err = m5602_write_sensor(sd, preinit_po1030[i][1], |
329 | + &data, 1); |
330 | else |
331 | - m5602_write_bridge(sd, preinit_po1030[i][1], data); |
332 | + err = m5602_write_bridge(sd, preinit_po1030[i][1], |
333 | + data); |
334 | + if (err < 0) |
335 | + return err; |
336 | } |
337 | |
338 | if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1)) |
339 | diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c |
340 | index e4249ce2c42f4..ab2184003c29d 100644 |
341 | --- a/drivers/misc/kgdbts.c |
342 | +++ b/drivers/misc/kgdbts.c |
343 | @@ -110,8 +110,9 @@ |
344 | printk(KERN_INFO a); \ |
345 | } while (0) |
346 | #define v2printk(a...) do { \ |
347 | - if (verbose > 1) \ |
348 | + if (verbose > 1) { \ |
349 | printk(KERN_INFO a); \ |
350 | + } \ |
351 | touch_nmi_watchdog(); \ |
352 | } while (0) |
353 | #define eprintk(a...) do { \ |
354 | diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h |
355 | index c439c827eea80..0ef759671b546 100644 |
356 | --- a/drivers/misc/lis3lv02d/lis3lv02d.h |
357 | +++ b/drivers/misc/lis3lv02d/lis3lv02d.h |
358 | @@ -284,6 +284,7 @@ struct lis3lv02d { |
359 | int regs_size; |
360 | u8 *reg_cache; |
361 | bool regs_stored; |
362 | + bool init_required; |
363 | u8 odr_mask; /* ODR bit mask */ |
364 | u8 whoami; /* indicates measurement precision */ |
365 | s16 (*read_data) (struct lis3lv02d *lis3, int reg); |
366 | diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c |
367 | index 5a4893ce9c240..857bf1f8f4c05 100644 |
368 | --- a/drivers/misc/mei/interrupt.c |
369 | +++ b/drivers/misc/mei/interrupt.c |
370 | @@ -226,6 +226,9 @@ static int mei_cl_irq_read(struct mei_cl *cl, struct mei_cl_cb *cb, |
371 | return ret; |
372 | } |
373 | |
374 | + pm_runtime_mark_last_busy(dev->dev); |
375 | + pm_request_autosuspend(dev->dev); |
376 | + |
377 | list_move_tail(&cb->list, &cl->rd_pending); |
378 | |
379 | return 0; |
380 | diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c |
381 | index c2dea4916e5d7..32834dad0b836 100644 |
382 | --- a/drivers/net/caif/caif_serial.c |
383 | +++ b/drivers/net/caif/caif_serial.c |
384 | @@ -281,7 +281,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev) |
385 | { |
386 | struct ser_device *ser; |
387 | |
388 | - BUG_ON(dev == NULL); |
389 | ser = netdev_priv(dev); |
390 | |
391 | /* Send flow off once, on high water mark */ |
392 | diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c |
393 | index 1f7034d739b00..e15e487c14dd0 100644 |
394 | --- a/drivers/net/ethernet/broadcom/bnx2.c |
395 | +++ b/drivers/net/ethernet/broadcom/bnx2.c |
396 | @@ -8256,9 +8256,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev) |
397 | BNX2_WR(bp, PCI_COMMAND, reg); |
398 | } else if ((BNX2_CHIP_ID(bp) == BNX2_CHIP_ID_5706_A1) && |
399 | !(bp->flags & BNX2_FLAG_PCIX)) { |
400 | - |
401 | dev_err(&pdev->dev, |
402 | "5706 A1 can only be used in a PCIX bus, aborting\n"); |
403 | + rc = -EPERM; |
404 | goto err_out_unmap; |
405 | } |
406 | |
407 | diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c |
408 | index 399cfd217288d..cfda55bfa811a 100644 |
409 | --- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c |
410 | +++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c |
411 | @@ -548,6 +548,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id) |
412 | return -1; |
413 | |
414 | base = ioremap(link->resource[2]->start, resource_size(link->resource[2])); |
415 | + if (!base) { |
416 | + pcmcia_release_window(link, link->resource[2]); |
417 | + return -1; |
418 | + } |
419 | + |
420 | pcmcia_map_mem_page(link, link->resource[2], 0); |
421 | |
422 | /* |
423 | diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c |
424 | index d1224d33ecfab..410a36c982419 100644 |
425 | --- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c |
426 | +++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c |
427 | @@ -1931,8 +1931,6 @@ static int mlx4_en_set_tunable(struct net_device *dev, |
428 | return ret; |
429 | } |
430 | |
431 | -#define MLX4_EEPROM_PAGE_LEN 256 |
432 | - |
433 | static int mlx4_en_get_module_info(struct net_device *dev, |
434 | struct ethtool_modinfo *modinfo) |
435 | { |
436 | @@ -1967,7 +1965,7 @@ static int mlx4_en_get_module_info(struct net_device *dev, |
437 | break; |
438 | case MLX4_MODULE_ID_SFP: |
439 | modinfo->type = ETH_MODULE_SFF_8472; |
440 | - modinfo->eeprom_len = MLX4_EEPROM_PAGE_LEN; |
441 | + modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN; |
442 | break; |
443 | default: |
444 | return -ENOSYS; |
445 | diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c |
446 | index 3173875a715fc..231f097128502 100644 |
447 | --- a/drivers/net/ethernet/mellanox/mlx4/port.c |
448 | +++ b/drivers/net/ethernet/mellanox/mlx4/port.c |
449 | @@ -1856,6 +1856,7 @@ EXPORT_SYMBOL(mlx4_get_roce_gid_from_slave); |
450 | #define I2C_ADDR_LOW 0x50 |
451 | #define I2C_ADDR_HIGH 0x51 |
452 | #define I2C_PAGE_SIZE 256 |
453 | +#define I2C_HIGH_PAGE_SIZE 128 |
454 | |
455 | /* Module Info Data */ |
456 | struct mlx4_cable_info { |
457 | @@ -1909,6 +1910,88 @@ static inline const char *cable_info_mad_err_str(u16 mad_status) |
458 | return "Unknown Error"; |
459 | } |
460 | |
461 | +static int mlx4_get_module_id(struct mlx4_dev *dev, u8 port, u8 *module_id) |
462 | +{ |
463 | + struct mlx4_cmd_mailbox *inbox, *outbox; |
464 | + struct mlx4_mad_ifc *inmad, *outmad; |
465 | + struct mlx4_cable_info *cable_info; |
466 | + int ret; |
467 | + |
468 | + inbox = mlx4_alloc_cmd_mailbox(dev); |
469 | + if (IS_ERR(inbox)) |
470 | + return PTR_ERR(inbox); |
471 | + |
472 | + outbox = mlx4_alloc_cmd_mailbox(dev); |
473 | + if (IS_ERR(outbox)) { |
474 | + mlx4_free_cmd_mailbox(dev, inbox); |
475 | + return PTR_ERR(outbox); |
476 | + } |
477 | + |
478 | + inmad = (struct mlx4_mad_ifc *)(inbox->buf); |
479 | + outmad = (struct mlx4_mad_ifc *)(outbox->buf); |
480 | + |
481 | + inmad->method = 0x1; /* Get */ |
482 | + inmad->class_version = 0x1; |
483 | + inmad->mgmt_class = 0x1; |
484 | + inmad->base_version = 0x1; |
485 | + inmad->attr_id = cpu_to_be16(0xFF60); /* Module Info */ |
486 | + |
487 | + cable_info = (struct mlx4_cable_info *)inmad->data; |
488 | + cable_info->dev_mem_address = 0; |
489 | + cable_info->page_num = 0; |
490 | + cable_info->i2c_addr = I2C_ADDR_LOW; |
491 | + cable_info->size = cpu_to_be16(1); |
492 | + |
493 | + ret = mlx4_cmd_box(dev, inbox->dma, outbox->dma, port, 3, |
494 | + MLX4_CMD_MAD_IFC, MLX4_CMD_TIME_CLASS_C, |
495 | + MLX4_CMD_NATIVE); |
496 | + if (ret) |
497 | + goto out; |
498 | + |
499 | + if (be16_to_cpu(outmad->status)) { |
500 | + /* Mad returned with bad status */ |
501 | + ret = be16_to_cpu(outmad->status); |
502 | + mlx4_warn(dev, |
503 | + "MLX4_CMD_MAD_IFC Get Module ID attr(%x) port(%d) i2c_addr(%x) offset(%d) size(%d): Response Mad Status(%x) - %s\n", |
504 | + 0xFF60, port, I2C_ADDR_LOW, 0, 1, ret, |
505 | + cable_info_mad_err_str(ret)); |
506 | + ret = -ret; |
507 | + goto out; |
508 | + } |
509 | + cable_info = (struct mlx4_cable_info *)outmad->data; |
510 | + *module_id = cable_info->data[0]; |
511 | +out: |
512 | + mlx4_free_cmd_mailbox(dev, inbox); |
513 | + mlx4_free_cmd_mailbox(dev, outbox); |
514 | + return ret; |
515 | +} |
516 | + |
517 | +static void mlx4_sfp_eeprom_params_set(u8 *i2c_addr, u8 *page_num, u16 *offset) |
518 | +{ |
519 | + *i2c_addr = I2C_ADDR_LOW; |
520 | + *page_num = 0; |
521 | + |
522 | + if (*offset < I2C_PAGE_SIZE) |
523 | + return; |
524 | + |
525 | + *i2c_addr = I2C_ADDR_HIGH; |
526 | + *offset -= I2C_PAGE_SIZE; |
527 | +} |
528 | + |
529 | +static void mlx4_qsfp_eeprom_params_set(u8 *i2c_addr, u8 *page_num, u16 *offset) |
530 | +{ |
531 | + /* Offsets 0-255 belong to page 0. |
532 | + * Offsets 256-639 belong to pages 01, 02, 03. |
533 | + * For example, offset 400 is page 02: 1 + (400 - 256) / 128 = 2 |
534 | + */ |
535 | + if (*offset < I2C_PAGE_SIZE) |
536 | + *page_num = 0; |
537 | + else |
538 | + *page_num = 1 + (*offset - I2C_PAGE_SIZE) / I2C_HIGH_PAGE_SIZE; |
539 | + *i2c_addr = I2C_ADDR_LOW; |
540 | + *offset -= *page_num * I2C_HIGH_PAGE_SIZE; |
541 | +} |
542 | + |
543 | /** |
544 | * mlx4_get_module_info - Read cable module eeprom data |
545 | * @dev: mlx4_dev. |
546 | @@ -1928,12 +2011,30 @@ int mlx4_get_module_info(struct mlx4_dev *dev, u8 port, |
547 | struct mlx4_cmd_mailbox *inbox, *outbox; |
548 | struct mlx4_mad_ifc *inmad, *outmad; |
549 | struct mlx4_cable_info *cable_info; |
550 | - u16 i2c_addr; |
551 | + u8 module_id, i2c_addr, page_num; |
552 | int ret; |
553 | |
554 | if (size > MODULE_INFO_MAX_READ) |
555 | size = MODULE_INFO_MAX_READ; |
556 | |
557 | + ret = mlx4_get_module_id(dev, port, &module_id); |
558 | + if (ret) |
559 | + return ret; |
560 | + |
561 | + switch (module_id) { |
562 | + case MLX4_MODULE_ID_SFP: |
563 | + mlx4_sfp_eeprom_params_set(&i2c_addr, &page_num, &offset); |
564 | + break; |
565 | + case MLX4_MODULE_ID_QSFP: |
566 | + case MLX4_MODULE_ID_QSFP_PLUS: |
567 | + case MLX4_MODULE_ID_QSFP28: |
568 | + mlx4_qsfp_eeprom_params_set(&i2c_addr, &page_num, &offset); |
569 | + break; |
570 | + default: |
571 | + mlx4_err(dev, "Module ID not recognized: %#x\n", module_id); |
572 | + return -EINVAL; |
573 | + } |
574 | + |
575 | inbox = mlx4_alloc_cmd_mailbox(dev); |
576 | if (IS_ERR(inbox)) |
577 | return PTR_ERR(inbox); |
578 | @@ -1959,11 +2060,9 @@ int mlx4_get_module_info(struct mlx4_dev *dev, u8 port, |
579 | */ |
580 | size -= offset + size - I2C_PAGE_SIZE; |
581 | |
582 | - i2c_addr = I2C_ADDR_LOW; |
583 | - |
584 | cable_info = (struct mlx4_cable_info *)inmad->data; |
585 | cable_info->dev_mem_address = cpu_to_be16(offset); |
586 | - cable_info->page_num = 0; |
587 | + cable_info->page_num = page_num; |
588 | cable_info->i2c_addr = i2c_addr; |
589 | cable_info->size = cpu_to_be16(size); |
590 | |
591 | diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c |
592 | index 32516661f180b..c17967b23d3c3 100644 |
593 | --- a/drivers/net/ethernet/ti/netcp_core.c |
594 | +++ b/drivers/net/ethernet/ti/netcp_core.c |
595 | @@ -1325,9 +1325,9 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe) |
596 | tx_pipe->dma_queue = knav_queue_open(name, tx_pipe->dma_queue_id, |
597 | KNAV_QUEUE_SHARED); |
598 | if (IS_ERR(tx_pipe->dma_queue)) { |
599 | + ret = PTR_ERR(tx_pipe->dma_queue); |
600 | dev_err(dev, "Could not open DMA queue for channel \"%s\": %d\n", |
601 | name, ret); |
602 | - ret = PTR_ERR(tx_pipe->dma_queue); |
603 | goto err; |
604 | } |
605 | |
606 | diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c |
607 | index ab6914f8bd50f..1da104150f445 100644 |
608 | --- a/drivers/net/phy/mdio-octeon.c |
609 | +++ b/drivers/net/phy/mdio-octeon.c |
610 | @@ -75,7 +75,6 @@ static int octeon_mdiobus_probe(struct platform_device *pdev) |
611 | |
612 | return 0; |
613 | fail_register: |
614 | - mdiobus_free(bus->mii_bus); |
615 | smi_en.u64 = 0; |
616 | oct_mdio_writeq(smi_en.u64, bus->register_base + SMI_EN); |
617 | return err; |
618 | @@ -89,7 +88,6 @@ static int octeon_mdiobus_remove(struct platform_device *pdev) |
619 | bus = platform_get_drvdata(pdev); |
620 | |
621 | mdiobus_unregister(bus->mii_bus); |
622 | - mdiobus_free(bus->mii_bus); |
623 | smi_en.u64 = 0; |
624 | oct_mdio_writeq(smi_en.u64, bus->register_base + SMI_EN); |
625 | return 0; |
626 | diff --git a/drivers/net/phy/mdio-thunder.c b/drivers/net/phy/mdio-thunder.c |
627 | index 564616968cad4..c0c922eff760c 100644 |
628 | --- a/drivers/net/phy/mdio-thunder.c |
629 | +++ b/drivers/net/phy/mdio-thunder.c |
630 | @@ -129,7 +129,6 @@ static void thunder_mdiobus_pci_remove(struct pci_dev *pdev) |
631 | continue; |
632 | |
633 | mdiobus_unregister(bus->mii_bus); |
634 | - mdiobus_free(bus->mii_bus); |
635 | oct_mdio_writeq(0, bus->register_base + SMI_EN); |
636 | } |
637 | pci_set_drvdata(pdev, NULL); |
638 | diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c |
639 | index 6ecccc737974c..5066b7bc67da6 100644 |
640 | --- a/drivers/net/usb/hso.c |
641 | +++ b/drivers/net/usb/hso.c |
642 | @@ -1703,7 +1703,7 @@ static int hso_serial_tiocmset(struct tty_struct *tty, |
643 | spin_unlock_irqrestore(&serial->serial_lock, flags); |
644 | |
645 | return usb_control_msg(serial->parent->usb, |
646 | - usb_rcvctrlpipe(serial->parent->usb, 0), 0x22, |
647 | + usb_sndctrlpipe(serial->parent->usb, 0), 0x22, |
648 | 0x21, val, if_num, NULL, 0, |
649 | USB_CTRL_SET_TIMEOUT); |
650 | } |
651 | @@ -2451,7 +2451,7 @@ static int hso_rfkill_set_block(void *data, bool blocked) |
652 | if (hso_dev->usb_gone) |
653 | rv = 0; |
654 | else |
655 | - rv = usb_control_msg(hso_dev->usb, usb_rcvctrlpipe(hso_dev->usb, 0), |
656 | + rv = usb_control_msg(hso_dev->usb, usb_sndctrlpipe(hso_dev->usb, 0), |
657 | enabled ? 0x82 : 0x81, 0x40, 0, 0, NULL, 0, |
658 | USB_CTRL_SET_TIMEOUT); |
659 | mutex_unlock(&hso_dev->mutex); |
660 | diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c |
661 | index 977d9c7725541..3a391ae5c4e0d 100644 |
662 | --- a/drivers/net/usb/smsc75xx.c |
663 | +++ b/drivers/net/usb/smsc75xx.c |
664 | @@ -1497,7 +1497,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) |
665 | ret = smsc75xx_wait_ready(dev, 0); |
666 | if (ret < 0) { |
667 | netdev_warn(dev->net, "device not ready in smsc75xx_bind\n"); |
668 | - return ret; |
669 | + goto err; |
670 | } |
671 | |
672 | smsc75xx_init_mac_address(dev); |
673 | @@ -1506,7 +1506,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) |
674 | ret = smsc75xx_reset(dev); |
675 | if (ret < 0) { |
676 | netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret); |
677 | - return ret; |
678 | + goto err; |
679 | } |
680 | |
681 | dev->net->netdev_ops = &smsc75xx_netdev_ops; |
682 | @@ -1515,6 +1515,10 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) |
683 | dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD; |
684 | dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; |
685 | return 0; |
686 | + |
687 | +err: |
688 | + kfree(pdata); |
689 | + return ret; |
690 | } |
691 | |
692 | static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) |
693 | diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c |
694 | index 3cbc71fa70d18..381bff3a21038 100644 |
695 | --- a/drivers/net/wireless/ath/ath10k/htt_rx.c |
696 | +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c |
697 | @@ -1582,14 +1582,62 @@ static void ath10k_htt_rx_h_unchain(struct ath10k *ar, |
698 | ath10k_unchain_msdu(amsdu); |
699 | } |
700 | |
701 | +static bool ath10k_htt_rx_validate_amsdu(struct ath10k *ar, |
702 | + struct sk_buff_head *amsdu) |
703 | +{ |
704 | + u8 *subframe_hdr; |
705 | + struct sk_buff *first; |
706 | + bool is_first, is_last; |
707 | + struct htt_rx_desc *rxd; |
708 | + struct ieee80211_hdr *hdr; |
709 | + size_t hdr_len, crypto_len; |
710 | + enum htt_rx_mpdu_encrypt_type enctype; |
711 | + int bytes_aligned = ar->hw_params.decap_align_bytes; |
712 | + |
713 | + first = skb_peek(amsdu); |
714 | + |
715 | + rxd = (void *)first->data - sizeof(*rxd); |
716 | + hdr = (void *)rxd->rx_hdr_status; |
717 | + |
718 | + is_first = !!(rxd->msdu_end.common.info0 & |
719 | + __cpu_to_le32(RX_MSDU_END_INFO0_FIRST_MSDU)); |
720 | + is_last = !!(rxd->msdu_end.common.info0 & |
721 | + __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU)); |
722 | + |
723 | + /* Return in case of non-aggregated msdu */ |
724 | + if (is_first && is_last) |
725 | + return true; |
726 | + |
727 | + /* First msdu flag is not set for the first msdu of the list */ |
728 | + if (!is_first) |
729 | + return false; |
730 | + |
731 | + enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0), |
732 | + RX_MPDU_START_INFO0_ENCRYPT_TYPE); |
733 | + |
734 | + hdr_len = ieee80211_hdrlen(hdr->frame_control); |
735 | + crypto_len = ath10k_htt_rx_crypto_param_len(ar, enctype); |
736 | + |
737 | + subframe_hdr = (u8 *)hdr + round_up(hdr_len, bytes_aligned) + |
738 | + crypto_len; |
739 | + |
740 | + /* Validate if the amsdu has a proper first subframe. |
741 | + * There are chances a single msdu can be received as amsdu when |
742 | + * the unauthenticated amsdu flag of a QoS header |
743 | + * gets flipped in non-SPP AMSDU's, in such cases the first |
744 | + * subframe has llc/snap header in place of a valid da. |
745 | + * return false if the da matches rfc1042 pattern |
746 | + */ |
747 | + if (ether_addr_equal(subframe_hdr, rfc1042_header)) |
748 | + return false; |
749 | + |
750 | + return true; |
751 | +} |
752 | + |
753 | static bool ath10k_htt_rx_amsdu_allowed(struct ath10k *ar, |
754 | struct sk_buff_head *amsdu, |
755 | struct ieee80211_rx_status *rx_status) |
756 | { |
757 | - /* FIXME: It might be a good idea to do some fuzzy-testing to drop |
758 | - * invalid/dangerous frames. |
759 | - */ |
760 | - |
761 | if (!rx_status->freq) { |
762 | ath10k_warn(ar, "no channel configured; ignoring frame(s)!\n"); |
763 | return false; |
764 | @@ -1600,6 +1648,11 @@ static bool ath10k_htt_rx_amsdu_allowed(struct ath10k *ar, |
765 | return false; |
766 | } |
767 | |
768 | + if (!ath10k_htt_rx_validate_amsdu(ar, amsdu)) { |
769 | + ath10k_dbg(ar, ATH10K_DBG_HTT, "invalid amsdu received\n"); |
770 | + return false; |
771 | + } |
772 | + |
773 | return true; |
774 | } |
775 | |
776 | diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c |
777 | index d0c881dd58467..f1e9cbcfdc168 100644 |
778 | --- a/drivers/net/wireless/marvell/libertas/mesh.c |
779 | +++ b/drivers/net/wireless/marvell/libertas/mesh.c |
780 | @@ -797,19 +797,6 @@ static const struct attribute_group mesh_ie_group = { |
781 | .attrs = mesh_ie_attrs, |
782 | }; |
783 | |
784 | -static void lbs_persist_config_init(struct net_device *dev) |
785 | -{ |
786 | - int ret; |
787 | - ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group); |
788 | - ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group); |
789 | -} |
790 | - |
791 | -static void lbs_persist_config_remove(struct net_device *dev) |
792 | -{ |
793 | - sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group); |
794 | - sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group); |
795 | -} |
796 | - |
797 | |
798 | /*************************************************************************** |
799 | * Initializing and starting, stopping mesh |
800 | @@ -1021,6 +1008,10 @@ static int lbs_add_mesh(struct lbs_private *priv) |
801 | SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent); |
802 | |
803 | mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST; |
804 | + mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group; |
805 | + mesh_dev->sysfs_groups[1] = &boot_opts_group; |
806 | + mesh_dev->sysfs_groups[2] = &mesh_ie_group; |
807 | + |
808 | /* Register virtual mesh interface */ |
809 | ret = register_netdev(mesh_dev); |
810 | if (ret) { |
811 | @@ -1028,19 +1019,10 @@ static int lbs_add_mesh(struct lbs_private *priv) |
812 | goto err_free_netdev; |
813 | } |
814 | |
815 | - ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); |
816 | - if (ret) |
817 | - goto err_unregister; |
818 | - |
819 | - lbs_persist_config_init(mesh_dev); |
820 | - |
821 | /* Everything successful */ |
822 | ret = 0; |
823 | goto done; |
824 | |
825 | -err_unregister: |
826 | - unregister_netdev(mesh_dev); |
827 | - |
828 | err_free_netdev: |
829 | free_netdev(mesh_dev); |
830 | |
831 | @@ -1063,8 +1045,6 @@ void lbs_remove_mesh(struct lbs_private *priv) |
832 | lbs_deb_enter(LBS_DEB_MESH); |
833 | netif_stop_queue(mesh_dev); |
834 | netif_carrier_off(mesh_dev); |
835 | - sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); |
836 | - lbs_persist_config_remove(mesh_dev); |
837 | unregister_netdev(mesh_dev); |
838 | priv->mesh_dev = NULL; |
839 | kfree(mesh_dev->ieee80211_ptr); |
840 | diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c |
841 | index abd9d83f60094..403d966223ee9 100644 |
842 | --- a/drivers/platform/x86/hp_accel.c |
843 | +++ b/drivers/platform/x86/hp_accel.c |
844 | @@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids); |
845 | static int lis3lv02d_acpi_init(struct lis3lv02d *lis3) |
846 | { |
847 | struct acpi_device *dev = lis3->bus_priv; |
848 | + if (!lis3->init_required) |
849 | + return 0; |
850 | + |
851 | if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI, |
852 | NULL, NULL) != AE_OK) |
853 | return -EINVAL; |
854 | @@ -366,6 +369,7 @@ static int lis3lv02d_add(struct acpi_device *device) |
855 | } |
856 | |
857 | /* call the core layer do its init */ |
858 | + lis3_dev.init_required = true; |
859 | ret = lis3lv02d_init_device(&lis3_dev); |
860 | if (ret) |
861 | return ret; |
862 | @@ -413,11 +417,27 @@ static int lis3lv02d_suspend(struct device *dev) |
863 | |
864 | static int lis3lv02d_resume(struct device *dev) |
865 | { |
866 | + lis3_dev.init_required = false; |
867 | + lis3lv02d_poweron(&lis3_dev); |
868 | + return 0; |
869 | +} |
870 | + |
871 | +static int lis3lv02d_restore(struct device *dev) |
872 | +{ |
873 | + lis3_dev.init_required = true; |
874 | lis3lv02d_poweron(&lis3_dev); |
875 | return 0; |
876 | } |
877 | |
878 | -static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume); |
879 | +static const struct dev_pm_ops hp_accel_pm = { |
880 | + .suspend = lis3lv02d_suspend, |
881 | + .resume = lis3lv02d_resume, |
882 | + .freeze = lis3lv02d_suspend, |
883 | + .thaw = lis3lv02d_resume, |
884 | + .poweroff = lis3lv02d_suspend, |
885 | + .restore = lis3lv02d_restore, |
886 | +}; |
887 | + |
888 | #define HP_ACCEL_PM (&hp_accel_pm) |
889 | #else |
890 | #define HP_ACCEL_PM NULL |
891 | diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c |
892 | index b7dfe06261f1e..9865d11eda75c 100644 |
893 | --- a/drivers/platform/x86/intel_punit_ipc.c |
894 | +++ b/drivers/platform/x86/intel_punit_ipc.c |
895 | @@ -330,6 +330,7 @@ static const struct acpi_device_id punit_ipc_acpi_ids[] = { |
896 | { "INT34D4", 0 }, |
897 | { } |
898 | }; |
899 | +MODULE_DEVICE_TABLE(acpi, punit_ipc_acpi_ids); |
900 | |
901 | static struct platform_driver intel_punit_ipc_driver = { |
902 | .probe = intel_punit_ipc_probe, |
903 | diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c |
904 | index c7be7bb37209f..b9b4491d732ab 100644 |
905 | --- a/drivers/scsi/BusLogic.c |
906 | +++ b/drivers/scsi/BusLogic.c |
907 | @@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command, |
908 | ccb->opcode = BLOGIC_INITIATOR_CCB_SG; |
909 | ccb->datalen = count * sizeof(struct blogic_sg_seg); |
910 | if (blogic_multimaster_type(adapter)) |
911 | - ccb->data = (void *)((unsigned int) ccb->dma_handle + |
912 | + ccb->data = (unsigned int) ccb->dma_handle + |
913 | ((unsigned long) &ccb->sglist - |
914 | - (unsigned long) ccb)); |
915 | + (unsigned long) ccb); |
916 | else |
917 | - ccb->data = ccb->sglist; |
918 | + ccb->data = virt_to_32bit_virt(ccb->sglist); |
919 | |
920 | scsi_for_each_sg(command, sg, count, i) { |
921 | ccb->sglist[i].segbytes = sg_dma_len(sg); |
922 | diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h |
923 | index b53ec2f1e8cdc..5c950a7a1b1c7 100644 |
924 | --- a/drivers/scsi/BusLogic.h |
925 | +++ b/drivers/scsi/BusLogic.h |
926 | @@ -821,7 +821,7 @@ struct blogic_ccb { |
927 | unsigned char cdblen; /* Byte 2 */ |
928 | unsigned char sense_datalen; /* Byte 3 */ |
929 | u32 datalen; /* Bytes 4-7 */ |
930 | - void *data; /* Bytes 8-11 */ |
931 | + u32 data; /* Bytes 8-11 */ |
932 | unsigned char:8; /* Byte 12 */ |
933 | unsigned char:8; /* Byte 13 */ |
934 | enum blogic_adapter_status adapter_status; /* Byte 14 */ |
935 | diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c |
936 | index d3c5297c6c89e..30e0730f613e8 100644 |
937 | --- a/drivers/scsi/libsas/sas_port.c |
938 | +++ b/drivers/scsi/libsas/sas_port.c |
939 | @@ -41,7 +41,7 @@ static bool phy_is_wideport_member(struct asd_sas_port *port, struct asd_sas_phy |
940 | |
941 | static void sas_resume_port(struct asd_sas_phy *phy) |
942 | { |
943 | - struct domain_device *dev; |
944 | + struct domain_device *dev, *n; |
945 | struct asd_sas_port *port = phy->port; |
946 | struct sas_ha_struct *sas_ha = phy->ha; |
947 | struct sas_internal *si = to_sas_internal(sas_ha->core.shost->transportt); |
948 | @@ -60,7 +60,7 @@ static void sas_resume_port(struct asd_sas_phy *phy) |
949 | * 1/ presume every device came back |
950 | * 2/ force the next revalidation to check all expander phys |
951 | */ |
952 | - list_for_each_entry(dev, &port->dev_list, dev_list_node) { |
953 | + list_for_each_entry_safe(dev, n, &port->dev_list, dev_list_node) { |
954 | int i, rc; |
955 | |
956 | rc = sas_notify_lldd_dev_found(dev); |
957 | diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c |
958 | index f0ba5eb26128b..84e2296c45a24 100644 |
959 | --- a/drivers/spi/spi.c |
960 | +++ b/drivers/spi/spi.c |
961 | @@ -1869,6 +1869,7 @@ struct spi_master *devm_spi_alloc_master(struct device *dev, unsigned int size) |
962 | |
963 | master = spi_alloc_master(dev, size); |
964 | if (master) { |
965 | + master->devm_allocated = true; |
966 | *ptr = master; |
967 | devres_add(dev, ptr); |
968 | } else { |
969 | @@ -2059,11 +2060,6 @@ int devm_spi_register_master(struct device *dev, struct spi_master *master) |
970 | } |
971 | EXPORT_SYMBOL_GPL(devm_spi_register_master); |
972 | |
973 | -static int devm_spi_match_master(struct device *dev, void *res, void *master) |
974 | -{ |
975 | - return *(struct spi_master **)res == master; |
976 | -} |
977 | - |
978 | static int __unregister(struct device *dev, void *null) |
979 | { |
980 | spi_unregister_device(to_spi_device(dev)); |
981 | @@ -2102,8 +2098,7 @@ void spi_unregister_master(struct spi_master *master) |
982 | /* Release the last reference on the master if its driver |
983 | * has not yet been converted to devm_spi_alloc_master(). |
984 | */ |
985 | - if (!devres_find(master->dev.parent, devm_spi_release_master, |
986 | - devm_spi_match_master, master)) |
987 | + if (!master->devm_allocated) |
988 | put_device(&master->dev); |
989 | |
990 | if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) |
991 | diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c |
992 | index 1055649f034c0..59266650e071a 100644 |
993 | --- a/drivers/staging/emxx_udc/emxx_udc.c |
994 | +++ b/drivers/staging/emxx_udc/emxx_udc.c |
995 | @@ -2173,7 +2173,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc, |
996 | struct nbu2ss_ep *ep, |
997 | int status) |
998 | { |
999 | - struct nbu2ss_req *req; |
1000 | + struct nbu2ss_req *req, *n; |
1001 | |
1002 | /* Endpoint Disable */ |
1003 | _nbu2ss_epn_exit(udc, ep); |
1004 | @@ -2185,7 +2185,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc, |
1005 | return 0; |
1006 | |
1007 | /* called with irqs blocked */ |
1008 | - list_for_each_entry(req, &ep->queue, queue) { |
1009 | + list_for_each_entry_safe(req, n, &ep->queue, queue) { |
1010 | _nbu2ss_ep_done(ep, req, status); |
1011 | } |
1012 | |
1013 | diff --git a/drivers/staging/iio/cdc/ad7746.c b/drivers/staging/iio/cdc/ad7746.c |
1014 | index 5771d4ee8ef10..1a71bca4e6988 100644 |
1015 | --- a/drivers/staging/iio/cdc/ad7746.c |
1016 | +++ b/drivers/staging/iio/cdc/ad7746.c |
1017 | @@ -714,7 +714,6 @@ static int ad7746_probe(struct i2c_client *client, |
1018 | indio_dev->num_channels = ARRAY_SIZE(ad7746_channels); |
1019 | else |
1020 | indio_dev->num_channels = ARRAY_SIZE(ad7746_channels) - 2; |
1021 | - indio_dev->num_channels = ARRAY_SIZE(ad7746_channels); |
1022 | indio_dev->modes = INDIO_DIRECT_MODE; |
1023 | |
1024 | if (pdata) { |
1025 | diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c |
1026 | index 80ab672d61cc4..febbacecb3ba6 100644 |
1027 | --- a/drivers/tty/serial/max310x.c |
1028 | +++ b/drivers/tty/serial/max310x.c |
1029 | @@ -1385,10 +1385,12 @@ static int __init max310x_uart_init(void) |
1030 | return ret; |
1031 | |
1032 | #ifdef CONFIG_SPI_MASTER |
1033 | - spi_register_driver(&max310x_spi_driver); |
1034 | + ret = spi_register_driver(&max310x_spi_driver); |
1035 | + if (ret) |
1036 | + uart_unregister_driver(&max310x_uart); |
1037 | #endif |
1038 | |
1039 | - return 0; |
1040 | + return ret; |
1041 | } |
1042 | module_init(max310x_uart_init); |
1043 | |
1044 | diff --git a/drivers/tty/serial/rp2.c b/drivers/tty/serial/rp2.c |
1045 | index 056f91b3a4ca5..b7d1b1645c842 100644 |
1046 | --- a/drivers/tty/serial/rp2.c |
1047 | +++ b/drivers/tty/serial/rp2.c |
1048 | @@ -198,7 +198,6 @@ struct rp2_card { |
1049 | void __iomem *bar0; |
1050 | void __iomem *bar1; |
1051 | spinlock_t card_lock; |
1052 | - struct completion fw_loaded; |
1053 | }; |
1054 | |
1055 | #define RP_ID(prod) PCI_VDEVICE(RP, (prod)) |
1056 | @@ -667,17 +666,10 @@ static void rp2_remove_ports(struct rp2_card *card) |
1057 | card->initialized_ports = 0; |
1058 | } |
1059 | |
1060 | -static void rp2_fw_cb(const struct firmware *fw, void *context) |
1061 | +static int rp2_load_firmware(struct rp2_card *card, const struct firmware *fw) |
1062 | { |
1063 | - struct rp2_card *card = context; |
1064 | resource_size_t phys_base; |
1065 | - int i, rc = -ENOENT; |
1066 | - |
1067 | - if (!fw) { |
1068 | - dev_err(&card->pdev->dev, "cannot find '%s' firmware image\n", |
1069 | - RP2_FW_NAME); |
1070 | - goto no_fw; |
1071 | - } |
1072 | + int i, rc = 0; |
1073 | |
1074 | phys_base = pci_resource_start(card->pdev, 1); |
1075 | |
1076 | @@ -723,23 +715,13 @@ static void rp2_fw_cb(const struct firmware *fw, void *context) |
1077 | card->initialized_ports++; |
1078 | } |
1079 | |
1080 | - release_firmware(fw); |
1081 | -no_fw: |
1082 | - /* |
1083 | - * rp2_fw_cb() is called from a workqueue long after rp2_probe() |
1084 | - * has already returned success. So if something failed here, |
1085 | - * we'll just leave the now-dormant device in place until somebody |
1086 | - * unbinds it. |
1087 | - */ |
1088 | - if (rc) |
1089 | - dev_warn(&card->pdev->dev, "driver initialization failed\n"); |
1090 | - |
1091 | - complete(&card->fw_loaded); |
1092 | + return rc; |
1093 | } |
1094 | |
1095 | static int rp2_probe(struct pci_dev *pdev, |
1096 | const struct pci_device_id *id) |
1097 | { |
1098 | + const struct firmware *fw; |
1099 | struct rp2_card *card; |
1100 | struct rp2_uart_port *ports; |
1101 | void __iomem * const *bars; |
1102 | @@ -750,7 +732,6 @@ static int rp2_probe(struct pci_dev *pdev, |
1103 | return -ENOMEM; |
1104 | pci_set_drvdata(pdev, card); |
1105 | spin_lock_init(&card->card_lock); |
1106 | - init_completion(&card->fw_loaded); |
1107 | |
1108 | rc = pcim_enable_device(pdev); |
1109 | if (rc) |
1110 | @@ -783,21 +764,23 @@ static int rp2_probe(struct pci_dev *pdev, |
1111 | return -ENOMEM; |
1112 | card->ports = ports; |
1113 | |
1114 | - rc = devm_request_irq(&pdev->dev, pdev->irq, rp2_uart_interrupt, |
1115 | - IRQF_SHARED, DRV_NAME, card); |
1116 | - if (rc) |
1117 | + rc = request_firmware(&fw, RP2_FW_NAME, &pdev->dev); |
1118 | + if (rc < 0) { |
1119 | + dev_err(&pdev->dev, "cannot find '%s' firmware image\n", |
1120 | + RP2_FW_NAME); |
1121 | return rc; |
1122 | + } |
1123 | |
1124 | - /* |
1125 | - * Only catastrophic errors (e.g. ENOMEM) are reported here. |
1126 | - * If the FW image is missing, we'll find out in rp2_fw_cb() |
1127 | - * and print an error message. |
1128 | - */ |
1129 | - rc = request_firmware_nowait(THIS_MODULE, 1, RP2_FW_NAME, &pdev->dev, |
1130 | - GFP_KERNEL, card, rp2_fw_cb); |
1131 | + rc = rp2_load_firmware(card, fw); |
1132 | + |
1133 | + release_firmware(fw); |
1134 | + if (rc < 0) |
1135 | + return rc; |
1136 | + |
1137 | + rc = devm_request_irq(&pdev->dev, pdev->irq, rp2_uart_interrupt, |
1138 | + IRQF_SHARED, DRV_NAME, card); |
1139 | if (rc) |
1140 | return rc; |
1141 | - dev_dbg(&pdev->dev, "waiting for firmware blob...\n"); |
1142 | |
1143 | return 0; |
1144 | } |
1145 | @@ -806,7 +789,6 @@ static void rp2_remove(struct pci_dev *pdev) |
1146 | { |
1147 | struct rp2_card *card = pci_get_drvdata(pdev); |
1148 | |
1149 | - wait_for_completion(&card->fw_loaded); |
1150 | rp2_remove_ports(card); |
1151 | } |
1152 | |
1153 | diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h |
1154 | index 34c1a7e22aae0..be5075d414067 100644 |
1155 | --- a/drivers/usb/core/hub.h |
1156 | +++ b/drivers/usb/core/hub.h |
1157 | @@ -151,8 +151,10 @@ static inline unsigned hub_power_on_good_delay(struct usb_hub *hub) |
1158 | { |
1159 | unsigned delay = hub->descriptor->bPwrOn2PwrGood * 2; |
1160 | |
1161 | - /* Wait at least 100 msec for power to become stable */ |
1162 | - return max(delay, 100U); |
1163 | + if (!hub->hdev->parent) /* root hub */ |
1164 | + return delay; |
1165 | + else /* Wait at least 100 msec for power to become stable */ |
1166 | + return max(delay, 100U); |
1167 | } |
1168 | |
1169 | static inline int hub_port_debounce_be_connected(struct usb_hub *hub, |
1170 | diff --git a/drivers/usb/misc/trancevibrator.c b/drivers/usb/misc/trancevibrator.c |
1171 | index 9795457723d86..ad71840db899e 100644 |
1172 | --- a/drivers/usb/misc/trancevibrator.c |
1173 | +++ b/drivers/usb/misc/trancevibrator.c |
1174 | @@ -74,9 +74,9 @@ static ssize_t set_speed(struct device *dev, struct device_attribute *attr, |
1175 | /* Set speed */ |
1176 | retval = usb_control_msg(tv->udev, usb_sndctrlpipe(tv->udev, 0), |
1177 | 0x01, /* vendor request: set speed */ |
1178 | - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER, |
1179 | + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER, |
1180 | tv->speed, /* speed value */ |
1181 | - 0, NULL, 0, USB_CTRL_GET_TIMEOUT); |
1182 | + 0, NULL, 0, USB_CTRL_SET_TIMEOUT); |
1183 | if (retval) { |
1184 | tv->speed = old; |
1185 | dev_dbg(&tv->udev->dev, "retval = %d\n", retval); |
1186 | diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c |
1187 | index e77465a30ac69..0ec6d76d1563b 100644 |
1188 | --- a/drivers/usb/misc/uss720.c |
1189 | +++ b/drivers/usb/misc/uss720.c |
1190 | @@ -750,6 +750,7 @@ static int uss720_probe(struct usb_interface *intf, |
1191 | parport_announce_port(pp); |
1192 | |
1193 | usb_set_intfdata(intf, pp); |
1194 | + usb_put_dev(usbdev); |
1195 | return 0; |
1196 | |
1197 | probe_abort: |
1198 | diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c |
1199 | index c9f979063af13..276e9790442d9 100644 |
1200 | --- a/drivers/usb/serial/ftdi_sio.c |
1201 | +++ b/drivers/usb/serial/ftdi_sio.c |
1202 | @@ -1029,6 +1029,9 @@ static const struct usb_device_id id_table_combined[] = { |
1203 | /* Sienna devices */ |
1204 | { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) }, |
1205 | { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) }, |
1206 | + /* IDS GmbH devices */ |
1207 | + { USB_DEVICE(IDS_VID, IDS_SI31A_PID) }, |
1208 | + { USB_DEVICE(IDS_VID, IDS_CM31A_PID) }, |
1209 | /* U-Blox devices */ |
1210 | { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, |
1211 | { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, |
1212 | diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h |
1213 | index f3302516a1e4f..b5f28a7952282 100644 |
1214 | --- a/drivers/usb/serial/ftdi_sio_ids.h |
1215 | +++ b/drivers/usb/serial/ftdi_sio_ids.h |
1216 | @@ -1566,6 +1566,13 @@ |
1217 | #define UNJO_VID 0x22B7 |
1218 | #define UNJO_ISODEBUG_V1_PID 0x150D |
1219 | |
1220 | +/* |
1221 | + * IDS GmbH |
1222 | + */ |
1223 | +#define IDS_VID 0x2CAF |
1224 | +#define IDS_SI31A_PID 0x13A2 |
1225 | +#define IDS_CM31A_PID 0x13A3 |
1226 | + |
1227 | /* |
1228 | * U-Blox products (http://www.u-blox.com). |
1229 | */ |
1230 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
1231 | index 351be73862809..6faa9ac538877 100644 |
1232 | --- a/drivers/usb/serial/option.c |
1233 | +++ b/drivers/usb/serial/option.c |
1234 | @@ -1222,6 +1222,10 @@ static const struct usb_device_id option_ids[] = { |
1235 | .driver_info = NCTRL(0) | RSVD(1) }, |
1236 | { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ |
1237 | .driver_info = NCTRL(0) }, |
1238 | + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff), /* Telit LE910-S1 (RNDIS) */ |
1239 | + .driver_info = NCTRL(2) }, |
1240 | + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */ |
1241 | + .driver_info = NCTRL(2) }, |
1242 | { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ |
1243 | .driver_info = NCTRL(0) | ZLP }, |
1244 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ |
1245 | diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c |
1246 | index bf5533d6d83bd..3dd0bbb36dd27 100644 |
1247 | --- a/drivers/usb/serial/pl2303.c |
1248 | +++ b/drivers/usb/serial/pl2303.c |
1249 | @@ -102,6 +102,7 @@ static const struct usb_device_id id_table[] = { |
1250 | { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) }, |
1251 | { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) }, |
1252 | { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) }, |
1253 | + { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) }, |
1254 | { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, |
1255 | { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, |
1256 | { } /* Terminating entry */ |
1257 | diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h |
1258 | index 9d27c076f477e..62b8cd673aa11 100644 |
1259 | --- a/drivers/usb/serial/pl2303.h |
1260 | +++ b/drivers/usb/serial/pl2303.h |
1261 | @@ -156,6 +156,7 @@ |
1262 | /* ADLINK ND-6530 RS232,RS485 and RS422 adapter */ |
1263 | #define ADLINK_VENDOR_ID 0x0b63 |
1264 | #define ADLINK_ND6530_PRODUCT_ID 0x6530 |
1265 | +#define ADLINK_ND6530GC_PRODUCT_ID 0x653a |
1266 | |
1267 | /* SMART USB Serial Adapter */ |
1268 | #define SMART_VENDOR_ID 0x0b8c |
1269 | diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c |
1270 | index a7e41723c34cf..720bcf29d4f6c 100644 |
1271 | --- a/drivers/usb/serial/ti_usb_3410_5052.c |
1272 | +++ b/drivers/usb/serial/ti_usb_3410_5052.c |
1273 | @@ -41,6 +41,7 @@ |
1274 | /* Vendor and product ids */ |
1275 | #define TI_VENDOR_ID 0x0451 |
1276 | #define IBM_VENDOR_ID 0x04b3 |
1277 | +#define STARTECH_VENDOR_ID 0x14b0 |
1278 | #define TI_3410_PRODUCT_ID 0x3410 |
1279 | #define IBM_4543_PRODUCT_ID 0x4543 |
1280 | #define IBM_454B_PRODUCT_ID 0x454b |
1281 | @@ -378,6 +379,7 @@ static const struct usb_device_id ti_id_table_3410[] = { |
1282 | { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1131_PRODUCT_ID) }, |
1283 | { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1150_PRODUCT_ID) }, |
1284 | { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1151_PRODUCT_ID) }, |
1285 | + { USB_DEVICE(STARTECH_VENDOR_ID, TI_3410_PRODUCT_ID) }, |
1286 | { } /* terminator */ |
1287 | }; |
1288 | |
1289 | @@ -416,6 +418,7 @@ static const struct usb_device_id ti_id_table_combined[] = { |
1290 | { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1131_PRODUCT_ID) }, |
1291 | { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1150_PRODUCT_ID) }, |
1292 | { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1151_PRODUCT_ID) }, |
1293 | + { USB_DEVICE(STARTECH_VENDOR_ID, TI_3410_PRODUCT_ID) }, |
1294 | { } /* terminator */ |
1295 | }; |
1296 | |
1297 | diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c |
1298 | index 9909b63d2acda..5c86fecaf167e 100644 |
1299 | --- a/fs/btrfs/tree-log.c |
1300 | +++ b/fs/btrfs/tree-log.c |
1301 | @@ -1600,8 +1600,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans, |
1302 | ret = btrfs_update_inode(trans, root, inode); |
1303 | } else if (ret == -EEXIST) { |
1304 | ret = 0; |
1305 | - } else { |
1306 | - BUG(); /* Logic Error */ |
1307 | } |
1308 | iput(inode); |
1309 | |
1310 | diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c |
1311 | index ba1909b887efb..e7339a39e7189 100644 |
1312 | --- a/fs/hugetlbfs/inode.c |
1313 | +++ b/fs/hugetlbfs/inode.c |
1314 | @@ -451,7 +451,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart, |
1315 | if (next >= end) |
1316 | break; |
1317 | |
1318 | - hash = hugetlb_fault_mutex_hash(h, mapping, next, 0); |
1319 | + hash = hugetlb_fault_mutex_hash(h, mapping, next); |
1320 | mutex_lock(&hugetlb_fault_mutex_table[hash]); |
1321 | |
1322 | /* |
1323 | @@ -634,7 +634,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset, |
1324 | addr = index * hpage_size; |
1325 | |
1326 | /* mutex taken here, fault path and hole punch */ |
1327 | - hash = hugetlb_fault_mutex_hash(h, mapping, index, addr); |
1328 | + hash = hugetlb_fault_mutex_hash(h, mapping, index); |
1329 | mutex_lock(&hugetlb_fault_mutex_table[hash]); |
1330 | |
1331 | /* See if already present in mapping to avoid alloc/free */ |
1332 | diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c |
1333 | index a3fc48ba4931d..dec7e5ad525af 100644 |
1334 | --- a/fs/nfs/filelayout/filelayout.c |
1335 | +++ b/fs/nfs/filelayout/filelayout.c |
1336 | @@ -726,7 +726,7 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo, |
1337 | if (unlikely(!p)) |
1338 | goto out_err; |
1339 | fl->fh_array[i]->size = be32_to_cpup(p++); |
1340 | - if (sizeof(struct nfs_fh) < fl->fh_array[i]->size) { |
1341 | + if (fl->fh_array[i]->size > NFS_MAXFHSIZE) { |
1342 | printk(KERN_ERR "NFS: Too big fh %d received %d\n", |
1343 | i, fl->fh_array[i]->size); |
1344 | goto out_err; |
1345 | diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c |
1346 | index 7138383382ff1..80718d9999edb 100644 |
1347 | --- a/fs/nfs/nfs4file.c |
1348 | +++ b/fs/nfs/nfs4file.c |
1349 | @@ -147,7 +147,7 @@ static loff_t nfs4_file_llseek(struct file *filep, loff_t offset, int whence) |
1350 | case SEEK_HOLE: |
1351 | case SEEK_DATA: |
1352 | ret = nfs42_proc_llseek(filep, offset, whence); |
1353 | - if (ret != -ENOTSUPP) |
1354 | + if (ret != -EOPNOTSUPP) |
1355 | return ret; |
1356 | default: |
1357 | return nfs_file_llseek(filep, offset, whence); |
1358 | diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c |
1359 | index 529f3a5762637..3e0fcb86390ac 100644 |
1360 | --- a/fs/nfs/pagelist.c |
1361 | +++ b/fs/nfs/pagelist.c |
1362 | @@ -952,17 +952,16 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc) |
1363 | { |
1364 | struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc); |
1365 | |
1366 | - |
1367 | if (!list_empty(&mirror->pg_list)) { |
1368 | int error = desc->pg_ops->pg_doio(desc); |
1369 | if (error < 0) |
1370 | desc->pg_error = error; |
1371 | - else |
1372 | + if (list_empty(&mirror->pg_list)) { |
1373 | mirror->pg_bytes_written += mirror->pg_count; |
1374 | - } |
1375 | - if (list_empty(&mirror->pg_list)) { |
1376 | - mirror->pg_count = 0; |
1377 | - mirror->pg_base = 0; |
1378 | + mirror->pg_count = 0; |
1379 | + mirror->pg_base = 0; |
1380 | + mirror->pg_recoalesce = 0; |
1381 | + } |
1382 | } |
1383 | } |
1384 | |
1385 | @@ -1061,7 +1060,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc) |
1386 | |
1387 | do { |
1388 | list_splice_init(&mirror->pg_list, &head); |
1389 | - mirror->pg_bytes_written -= mirror->pg_count; |
1390 | mirror->pg_count = 0; |
1391 | mirror->pg_base = 0; |
1392 | mirror->pg_recoalesce = 0; |
1393 | diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c |
1394 | index d347d95a1bac1..f19cded49b29d 100644 |
1395 | --- a/fs/nfs/pnfs.c |
1396 | +++ b/fs/nfs/pnfs.c |
1397 | @@ -1070,6 +1070,11 @@ _pnfs_return_layout(struct inode *ino) |
1398 | { |
1399 | struct pnfs_layout_hdr *lo = NULL; |
1400 | struct nfs_inode *nfsi = NFS_I(ino); |
1401 | + struct pnfs_layout_range range = { |
1402 | + .iomode = IOMODE_ANY, |
1403 | + .offset = 0, |
1404 | + .length = NFS4_MAX_UINT64, |
1405 | + }; |
1406 | LIST_HEAD(tmp_list); |
1407 | nfs4_stateid stateid; |
1408 | int status = 0, empty; |
1409 | @@ -1088,16 +1093,10 @@ _pnfs_return_layout(struct inode *ino) |
1410 | pnfs_get_layout_hdr(lo); |
1411 | empty = list_empty(&lo->plh_segs); |
1412 | pnfs_clear_layoutcommit(ino, &tmp_list); |
1413 | - pnfs_mark_matching_lsegs_return(lo, &tmp_list, NULL, 0); |
1414 | - |
1415 | - if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) { |
1416 | - struct pnfs_layout_range range = { |
1417 | - .iomode = IOMODE_ANY, |
1418 | - .offset = 0, |
1419 | - .length = NFS4_MAX_UINT64, |
1420 | - }; |
1421 | + pnfs_mark_matching_lsegs_return(lo, &tmp_list, &range, 0); |
1422 | + |
1423 | + if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) |
1424 | NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range); |
1425 | - } |
1426 | |
1427 | /* Don't send a LAYOUTRETURN if list was initially empty */ |
1428 | if (empty) { |
1429 | diff --git a/fs/proc/base.c b/fs/proc/base.c |
1430 | index b9e41832315a6..294fb8ee2ff46 100644 |
1431 | --- a/fs/proc/base.c |
1432 | +++ b/fs/proc/base.c |
1433 | @@ -2522,6 +2522,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, |
1434 | ssize_t length; |
1435 | struct task_struct *task = get_proc_task(inode); |
1436 | |
1437 | + /* A task may only write when it was the opener. */ |
1438 | + if (file->f_cred != current_real_cred()) |
1439 | + return -EPERM; |
1440 | + |
1441 | length = -ESRCH; |
1442 | if (!task) |
1443 | goto out_no_task; |
1444 | diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h |
1445 | index 4e4c35a6bfc5a..8dd365c654780 100644 |
1446 | --- a/include/linux/hugetlb.h |
1447 | +++ b/include/linux/hugetlb.h |
1448 | @@ -93,7 +93,7 @@ void free_huge_page(struct page *page); |
1449 | void hugetlb_fix_reserve_counts(struct inode *inode); |
1450 | extern struct mutex *hugetlb_fault_mutex_table; |
1451 | u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, |
1452 | - pgoff_t idx, unsigned long address); |
1453 | + pgoff_t idx); |
1454 | |
1455 | pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud); |
1456 | |
1457 | diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h |
1458 | index 69111fa2e5780..3d0a12c5cdf52 100644 |
1459 | --- a/include/linux/netfilter/x_tables.h |
1460 | +++ b/include/linux/netfilter/x_tables.h |
1461 | @@ -334,7 +334,7 @@ static inline unsigned int xt_write_recseq_begin(void) |
1462 | * since addend is most likely 1 |
1463 | */ |
1464 | __this_cpu_add(xt_recseq.sequence, addend); |
1465 | - smp_wmb(); |
1466 | + smp_mb(); |
1467 | |
1468 | return addend; |
1469 | } |
1470 | diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h |
1471 | index 8470695e5dd78..9c8445f1af0cc 100644 |
1472 | --- a/include/linux/spi/spi.h |
1473 | +++ b/include/linux/spi/spi.h |
1474 | @@ -443,6 +443,9 @@ struct spi_master { |
1475 | #define SPI_MASTER_MUST_RX BIT(3) /* requires rx */ |
1476 | #define SPI_MASTER_MUST_TX BIT(4) /* requires tx */ |
1477 | |
1478 | + /* flag indicating this is a non-devres managed controller */ |
1479 | + bool devm_allocated; |
1480 | + |
1481 | /* |
1482 | * on some hardware transfer / message size may be constrained |
1483 | * the limit may depend on device transfer settings |
1484 | diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h |
1485 | index 28a0d7a8c1429..ba388549b38c1 100644 |
1486 | --- a/include/net/cfg80211.h |
1487 | +++ b/include/net/cfg80211.h |
1488 | @@ -4056,7 +4056,8 @@ unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr); |
1489 | * Return: 0 on success. Non-zero on error. |
1490 | */ |
1491 | int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, |
1492 | - const u8 *addr, enum nl80211_iftype iftype); |
1493 | + const u8 *addr, enum nl80211_iftype iftype, |
1494 | + bool is_amsdu); |
1495 | |
1496 | /** |
1497 | * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3 |
1498 | @@ -4068,7 +4069,7 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, |
1499 | static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr, |
1500 | enum nl80211_iftype iftype) |
1501 | { |
1502 | - return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype); |
1503 | + return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, false); |
1504 | } |
1505 | |
1506 | /** |
1507 | diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h |
1508 | index 87499b6b35d6d..2ba054fe14ac1 100644 |
1509 | --- a/include/net/nfc/nci_core.h |
1510 | +++ b/include/net/nfc/nci_core.h |
1511 | @@ -310,6 +310,7 @@ int nci_nfcc_loopback(struct nci_dev *ndev, void *data, size_t data_len, |
1512 | struct sk_buff **resp); |
1513 | |
1514 | struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev); |
1515 | +void nci_hci_deallocate(struct nci_dev *ndev); |
1516 | int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event, |
1517 | const u8 *param, size_t param_len); |
1518 | int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate, |
1519 | diff --git a/mm/hugetlb.c b/mm/hugetlb.c |
1520 | index 9049e8613237f..b7215b0807ca6 100644 |
1521 | --- a/mm/hugetlb.c |
1522 | +++ b/mm/hugetlb.c |
1523 | @@ -3887,7 +3887,7 @@ backout_unlocked: |
1524 | |
1525 | #ifdef CONFIG_SMP |
1526 | u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, |
1527 | - pgoff_t idx, unsigned long address) |
1528 | + pgoff_t idx) |
1529 | { |
1530 | unsigned long key[2]; |
1531 | u32 hash; |
1532 | @@ -3895,7 +3895,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, |
1533 | key[0] = (unsigned long) mapping; |
1534 | key[1] = idx; |
1535 | |
1536 | - hash = jhash2((u32 *)&key, sizeof(key)/sizeof(u32), 0); |
1537 | + hash = jhash2((u32 *)&key, sizeof(key)/(sizeof(u32)), 0); |
1538 | |
1539 | return hash & (num_fault_mutexes - 1); |
1540 | } |
1541 | @@ -3905,7 +3905,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, |
1542 | * return 0 and avoid the hashing overhead. |
1543 | */ |
1544 | u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, |
1545 | - pgoff_t idx, unsigned long address) |
1546 | + pgoff_t idx) |
1547 | { |
1548 | return 0; |
1549 | } |
1550 | @@ -3950,7 +3950,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, |
1551 | * get spurious allocation failures if two CPUs race to instantiate |
1552 | * the same page in the page cache. |
1553 | */ |
1554 | - hash = hugetlb_fault_mutex_hash(h, mapping, idx, address); |
1555 | + hash = hugetlb_fault_mutex_hash(h, mapping, idx); |
1556 | mutex_lock(&hugetlb_fault_mutex_table[hash]); |
1557 | |
1558 | entry = huge_ptep_get(ptep); |
1559 | diff --git a/mm/vmstat.c b/mm/vmstat.c |
1560 | index e60435d556e3d..d01a2b3c1b898 100644 |
1561 | --- a/mm/vmstat.c |
1562 | +++ b/mm/vmstat.c |
1563 | @@ -1178,6 +1178,9 @@ static void pagetypeinfo_showfree_print(struct seq_file *m, |
1564 | list_for_each(curr, &area->free_list[mtype]) |
1565 | freecount++; |
1566 | seq_printf(m, "%6lu ", freecount); |
1567 | + spin_unlock_irq(&zone->lock); |
1568 | + cond_resched(); |
1569 | + spin_lock_irq(&zone->lock); |
1570 | } |
1571 | seq_putc(m, '\n'); |
1572 | } |
1573 | diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c |
1574 | index 1152ce34dad4a..0bb150e68c53f 100644 |
1575 | --- a/net/bluetooth/cmtp/core.c |
1576 | +++ b/net/bluetooth/cmtp/core.c |
1577 | @@ -391,6 +391,11 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock) |
1578 | if (!(session->flags & BIT(CMTP_LOOPBACK))) { |
1579 | err = cmtp_attach_device(session); |
1580 | if (err < 0) { |
1581 | + /* Caller will call fput in case of failure, and so |
1582 | + * will cmtp_session kthread. |
1583 | + */ |
1584 | + get_file(session->sock->file); |
1585 | + |
1586 | atomic_inc(&session->terminate); |
1587 | wake_up_interruptible(sk_sleep(session->sock->sk)); |
1588 | up_write(&cmtp_session_sem); |
1589 | diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c |
1590 | index f904b9b240275..9a78b89690bd6 100644 |
1591 | --- a/net/ipv6/mcast.c |
1592 | +++ b/net/ipv6/mcast.c |
1593 | @@ -1580,10 +1580,7 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu) |
1594 | IPV6_TLV_PADN, 0 }; |
1595 | |
1596 | /* we assume size > sizeof(ra) here */ |
1597 | - /* limit our allocations to order-0 page */ |
1598 | - size = min_t(int, size, SKB_MAX_ORDER(0, 0)); |
1599 | skb = sock_alloc_send_skb(sk, size, 1, &err); |
1600 | - |
1601 | if (!skb) |
1602 | return NULL; |
1603 | |
1604 | diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h |
1605 | index 9c20c53f6729e..21b35255ecc24 100644 |
1606 | --- a/net/mac80211/ieee80211_i.h |
1607 | +++ b/net/mac80211/ieee80211_i.h |
1608 | @@ -52,12 +52,6 @@ struct ieee80211_local; |
1609 | #define IEEE80211_ENCRYPT_HEADROOM 8 |
1610 | #define IEEE80211_ENCRYPT_TAILROOM 18 |
1611 | |
1612 | -/* IEEE 802.11 (Ch. 9.5 Defragmentation) requires support for concurrent |
1613 | - * reception of at least three fragmented frames. This limit can be increased |
1614 | - * by changing this define, at the cost of slower frame reassembly and |
1615 | - * increased memory use (about 2 kB of RAM per entry). */ |
1616 | -#define IEEE80211_FRAGMENT_MAX 4 |
1617 | - |
1618 | /* power level hasn't been configured (or set to automatic) */ |
1619 | #define IEEE80211_UNSET_POWER_LEVEL INT_MIN |
1620 | |
1621 | @@ -88,18 +82,6 @@ struct ieee80211_local; |
1622 | |
1623 | #define IEEE80211_MAX_NAN_INSTANCE_ID 255 |
1624 | |
1625 | -struct ieee80211_fragment_entry { |
1626 | - struct sk_buff_head skb_list; |
1627 | - unsigned long first_frag_time; |
1628 | - u16 seq; |
1629 | - u16 extra_len; |
1630 | - u16 last_frag; |
1631 | - u8 rx_queue; |
1632 | - bool check_sequential_pn; /* needed for CCMP/GCMP */ |
1633 | - u8 last_pn[6]; /* PN of the last fragment if CCMP was used */ |
1634 | -}; |
1635 | - |
1636 | - |
1637 | struct ieee80211_bss { |
1638 | u32 device_ts_beacon, device_ts_presp; |
1639 | |
1640 | @@ -239,8 +221,15 @@ struct ieee80211_rx_data { |
1641 | */ |
1642 | int security_idx; |
1643 | |
1644 | - u32 tkip_iv32; |
1645 | - u16 tkip_iv16; |
1646 | + union { |
1647 | + struct { |
1648 | + u32 iv32; |
1649 | + u16 iv16; |
1650 | + } tkip; |
1651 | + struct { |
1652 | + u8 pn[IEEE80211_CCMP_PN_LEN]; |
1653 | + } ccm_gcm; |
1654 | + }; |
1655 | }; |
1656 | |
1657 | struct ieee80211_csa_settings { |
1658 | @@ -869,9 +858,7 @@ struct ieee80211_sub_if_data { |
1659 | |
1660 | char name[IFNAMSIZ]; |
1661 | |
1662 | - /* Fragment table for host-based reassembly */ |
1663 | - struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX]; |
1664 | - unsigned int fragment_next; |
1665 | + struct ieee80211_fragment_cache frags; |
1666 | |
1667 | /* TID bitmap for NoAck policy */ |
1668 | u16 noack_map; |
1669 | @@ -2136,4 +2123,7 @@ extern const struct ethtool_ops ieee80211_ethtool_ops; |
1670 | #define debug_noinline |
1671 | #endif |
1672 | |
1673 | +void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache); |
1674 | +void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache); |
1675 | + |
1676 | #endif /* IEEE80211_I_H */ |
1677 | diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c |
1678 | index 7d43e0085cfc7..deebf42c740e6 100644 |
1679 | --- a/net/mac80211/iface.c |
1680 | +++ b/net/mac80211/iface.c |
1681 | @@ -1120,16 +1120,12 @@ static void ieee80211_set_multicast_list(struct net_device *dev) |
1682 | */ |
1683 | static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata) |
1684 | { |
1685 | - int i; |
1686 | - |
1687 | /* free extra data */ |
1688 | ieee80211_free_keys(sdata, false); |
1689 | |
1690 | ieee80211_debugfs_remove_netdev(sdata); |
1691 | |
1692 | - for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) |
1693 | - __skb_queue_purge(&sdata->fragments[i].skb_list); |
1694 | - sdata->fragment_next = 0; |
1695 | + ieee80211_destroy_frag_cache(&sdata->frags); |
1696 | |
1697 | if (ieee80211_vif_is_mesh(&sdata->vif)) |
1698 | ieee80211_mesh_teardown_sdata(sdata); |
1699 | @@ -1863,8 +1859,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name, |
1700 | sdata->wdev.wiphy = local->hw.wiphy; |
1701 | sdata->local = local; |
1702 | |
1703 | - for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) |
1704 | - skb_queue_head_init(&sdata->fragments[i].skb_list); |
1705 | + ieee80211_init_frag_cache(&sdata->frags); |
1706 | |
1707 | INIT_LIST_HEAD(&sdata->key_list); |
1708 | |
1709 | diff --git a/net/mac80211/key.c b/net/mac80211/key.c |
1710 | index 6e02f8dfce2b2..4e23f240f599e 100644 |
1711 | --- a/net/mac80211/key.c |
1712 | +++ b/net/mac80211/key.c |
1713 | @@ -647,6 +647,7 @@ int ieee80211_key_link(struct ieee80211_key *key, |
1714 | struct sta_info *sta) |
1715 | { |
1716 | struct ieee80211_local *local = sdata->local; |
1717 | + static atomic_t key_color = ATOMIC_INIT(0); |
1718 | struct ieee80211_key *old_key; |
1719 | int idx = key->conf.keyidx; |
1720 | bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; |
1721 | @@ -658,6 +659,12 @@ int ieee80211_key_link(struct ieee80211_key *key, |
1722 | bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; |
1723 | int ret; |
1724 | |
1725 | + /* |
1726 | + * Assign a unique ID to every key so we can easily prevent mixed |
1727 | + * key and fragment cache attacks. |
1728 | + */ |
1729 | + key->color = atomic_inc_return(&key_color); |
1730 | + |
1731 | mutex_lock(&sdata->local->key_mtx); |
1732 | |
1733 | if (sta && pairwise) |
1734 | diff --git a/net/mac80211/key.h b/net/mac80211/key.h |
1735 | index 4aa20cef08595..2749a7d05e763 100644 |
1736 | --- a/net/mac80211/key.h |
1737 | +++ b/net/mac80211/key.h |
1738 | @@ -127,6 +127,8 @@ struct ieee80211_key { |
1739 | } debugfs; |
1740 | #endif |
1741 | |
1742 | + unsigned int color; |
1743 | + |
1744 | /* |
1745 | * key config, must be last because it contains key |
1746 | * material as variable length member |
1747 | diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c |
1748 | index c38d68131d02e..721caa5a5430f 100644 |
1749 | --- a/net/mac80211/rx.c |
1750 | +++ b/net/mac80211/rx.c |
1751 | @@ -1873,19 +1873,34 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) |
1752 | return result; |
1753 | } |
1754 | |
1755 | +void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache) |
1756 | +{ |
1757 | + int i; |
1758 | + |
1759 | + for (i = 0; i < ARRAY_SIZE(cache->entries); i++) |
1760 | + skb_queue_head_init(&cache->entries[i].skb_list); |
1761 | +} |
1762 | + |
1763 | +void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache) |
1764 | +{ |
1765 | + int i; |
1766 | + |
1767 | + for (i = 0; i < ARRAY_SIZE(cache->entries); i++) |
1768 | + __skb_queue_purge(&cache->entries[i].skb_list); |
1769 | +} |
1770 | + |
1771 | static inline struct ieee80211_fragment_entry * |
1772 | -ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, |
1773 | +ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache, |
1774 | unsigned int frag, unsigned int seq, int rx_queue, |
1775 | struct sk_buff **skb) |
1776 | { |
1777 | struct ieee80211_fragment_entry *entry; |
1778 | |
1779 | - entry = &sdata->fragments[sdata->fragment_next++]; |
1780 | - if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) |
1781 | - sdata->fragment_next = 0; |
1782 | + entry = &cache->entries[cache->next++]; |
1783 | + if (cache->next >= IEEE80211_FRAGMENT_MAX) |
1784 | + cache->next = 0; |
1785 | |
1786 | - if (!skb_queue_empty(&entry->skb_list)) |
1787 | - __skb_queue_purge(&entry->skb_list); |
1788 | + __skb_queue_purge(&entry->skb_list); |
1789 | |
1790 | __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ |
1791 | *skb = NULL; |
1792 | @@ -1900,14 +1915,14 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, |
1793 | } |
1794 | |
1795 | static inline struct ieee80211_fragment_entry * |
1796 | -ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, |
1797 | +ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache, |
1798 | unsigned int frag, unsigned int seq, |
1799 | int rx_queue, struct ieee80211_hdr *hdr) |
1800 | { |
1801 | struct ieee80211_fragment_entry *entry; |
1802 | int i, idx; |
1803 | |
1804 | - idx = sdata->fragment_next; |
1805 | + idx = cache->next; |
1806 | for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { |
1807 | struct ieee80211_hdr *f_hdr; |
1808 | |
1809 | @@ -1915,7 +1930,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, |
1810 | if (idx < 0) |
1811 | idx = IEEE80211_FRAGMENT_MAX - 1; |
1812 | |
1813 | - entry = &sdata->fragments[idx]; |
1814 | + entry = &cache->entries[idx]; |
1815 | if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || |
1816 | entry->rx_queue != rx_queue || |
1817 | entry->last_frag + 1 != frag) |
1818 | @@ -1942,16 +1957,27 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, |
1819 | return NULL; |
1820 | } |
1821 | |
1822 | +static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc) |
1823 | +{ |
1824 | + return rx->key && |
1825 | + (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || |
1826 | + rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || |
1827 | + rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || |
1828 | + rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && |
1829 | + ieee80211_has_protected(fc); |
1830 | +} |
1831 | + |
1832 | static ieee80211_rx_result debug_noinline |
1833 | ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) |
1834 | { |
1835 | + struct ieee80211_fragment_cache *cache = &rx->sdata->frags; |
1836 | struct ieee80211_hdr *hdr; |
1837 | u16 sc; |
1838 | __le16 fc; |
1839 | unsigned int frag, seq; |
1840 | struct ieee80211_fragment_entry *entry; |
1841 | struct sk_buff *skb; |
1842 | - struct ieee80211_rx_status *status; |
1843 | + struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); |
1844 | |
1845 | hdr = (struct ieee80211_hdr *)rx->skb->data; |
1846 | fc = hdr->frame_control; |
1847 | @@ -1967,6 +1993,9 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) |
1848 | goto out_no_led; |
1849 | } |
1850 | |
1851 | + if (rx->sta) |
1852 | + cache = &rx->sta->frags; |
1853 | + |
1854 | if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) |
1855 | goto out; |
1856 | |
1857 | @@ -1985,20 +2014,17 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) |
1858 | |
1859 | if (frag == 0) { |
1860 | /* This is the first fragment of a new frame. */ |
1861 | - entry = ieee80211_reassemble_add(rx->sdata, frag, seq, |
1862 | + entry = ieee80211_reassemble_add(cache, frag, seq, |
1863 | rx->seqno_idx, &(rx->skb)); |
1864 | - if (rx->key && |
1865 | - (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || |
1866 | - rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || |
1867 | - rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || |
1868 | - rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && |
1869 | - ieee80211_has_protected(fc)) { |
1870 | + if (requires_sequential_pn(rx, fc)) { |
1871 | int queue = rx->security_idx; |
1872 | |
1873 | /* Store CCMP/GCMP PN so that we can verify that the |
1874 | * next fragment has a sequential PN value. |
1875 | */ |
1876 | entry->check_sequential_pn = true; |
1877 | + entry->is_protected = true; |
1878 | + entry->key_color = rx->key->color; |
1879 | memcpy(entry->last_pn, |
1880 | rx->key->u.ccmp.rx_pn[queue], |
1881 | IEEE80211_CCMP_PN_LEN); |
1882 | @@ -2010,6 +2036,11 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) |
1883 | sizeof(rx->key->u.gcmp.rx_pn[queue])); |
1884 | BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != |
1885 | IEEE80211_GCMP_PN_LEN); |
1886 | + } else if (rx->key && |
1887 | + (ieee80211_has_protected(fc) || |
1888 | + (status->flag & RX_FLAG_DECRYPTED))) { |
1889 | + entry->is_protected = true; |
1890 | + entry->key_color = rx->key->color; |
1891 | } |
1892 | return RX_QUEUED; |
1893 | } |
1894 | @@ -2017,7 +2048,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) |
1895 | /* This is a fragment for a frame that should already be pending in |
1896 | * fragment cache. Add this fragment to the end of the pending entry. |
1897 | */ |
1898 | - entry = ieee80211_reassemble_find(rx->sdata, frag, seq, |
1899 | + entry = ieee80211_reassemble_find(cache, frag, seq, |
1900 | rx->seqno_idx, hdr); |
1901 | if (!entry) { |
1902 | I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); |
1903 | @@ -2032,25 +2063,39 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) |
1904 | if (entry->check_sequential_pn) { |
1905 | int i; |
1906 | u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; |
1907 | - int queue; |
1908 | |
1909 | - if (!rx->key || |
1910 | - (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP && |
1911 | - rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 && |
1912 | - rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP && |
1913 | - rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256)) |
1914 | + if (!requires_sequential_pn(rx, fc)) |
1915 | return RX_DROP_UNUSABLE; |
1916 | + |
1917 | + /* Prevent mixed key and fragment cache attacks */ |
1918 | + if (entry->key_color != rx->key->color) |
1919 | + return RX_DROP_UNUSABLE; |
1920 | + |
1921 | memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); |
1922 | for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { |
1923 | pn[i]++; |
1924 | if (pn[i]) |
1925 | break; |
1926 | } |
1927 | - queue = rx->security_idx; |
1928 | - rpn = rx->key->u.ccmp.rx_pn[queue]; |
1929 | + |
1930 | + rpn = rx->ccm_gcm.pn; |
1931 | if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) |
1932 | return RX_DROP_UNUSABLE; |
1933 | memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); |
1934 | + } else if (entry->is_protected && |
1935 | + (!rx->key || |
1936 | + (!ieee80211_has_protected(fc) && |
1937 | + !(status->flag & RX_FLAG_DECRYPTED)) || |
1938 | + rx->key->color != entry->key_color)) { |
1939 | + /* Drop this as a mixed key or fragment cache attack, even |
1940 | + * if for TKIP Michael MIC should protect us, and WEP is a |
1941 | + * lost cause anyway. |
1942 | + */ |
1943 | + return RX_DROP_UNUSABLE; |
1944 | + } else if (entry->is_protected && rx->key && |
1945 | + entry->key_color != rx->key->color && |
1946 | + (status->flag & RX_FLAG_DECRYPTED)) { |
1947 | + return RX_DROP_UNUSABLE; |
1948 | } |
1949 | |
1950 | skb_pull(rx->skb, ieee80211_hdrlen(fc)); |
1951 | @@ -2239,13 +2284,13 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) |
1952 | struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; |
1953 | |
1954 | /* |
1955 | - * Allow EAPOL frames to us/the PAE group address regardless |
1956 | - * of whether the frame was encrypted or not. |
1957 | + * Allow EAPOL frames to us/the PAE group address regardless of |
1958 | + * whether the frame was encrypted or not, and always disallow |
1959 | + * all other destination addresses for them. |
1960 | */ |
1961 | - if (ehdr->h_proto == rx->sdata->control_port_protocol && |
1962 | - (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || |
1963 | - ether_addr_equal(ehdr->h_dest, pae_group_addr))) |
1964 | - return true; |
1965 | + if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol)) |
1966 | + return ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || |
1967 | + ether_addr_equal(ehdr->h_dest, pae_group_addr); |
1968 | |
1969 | if (ieee80211_802_1x_port_control(rx) || |
1970 | ieee80211_drop_unencrypted(rx, fc)) |
1971 | @@ -2285,6 +2330,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx) |
1972 | if ((sdata->vif.type == NL80211_IFTYPE_AP || |
1973 | sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && |
1974 | !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && |
1975 | + ehdr->h_proto != rx->sdata->control_port_protocol && |
1976 | (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { |
1977 | if (is_multicast_ether_addr(ehdr->h_dest)) { |
1978 | /* |
1979 | @@ -2337,9 +2383,30 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx) |
1980 | #endif |
1981 | |
1982 | if (skb) { |
1983 | + struct ethhdr *ehdr = (void *)skb_mac_header(skb); |
1984 | + |
1985 | /* deliver to local stack */ |
1986 | skb->protocol = eth_type_trans(skb, dev); |
1987 | memset(skb->cb, 0, sizeof(skb->cb)); |
1988 | + |
1989 | + /* |
1990 | + * 802.1X over 802.11 requires that the authenticator address |
1991 | + * be used for EAPOL frames. However, 802.1X allows the use of |
1992 | + * the PAE group address instead. If the interface is part of |
1993 | + * a bridge and we pass the frame with the PAE group address, |
1994 | + * then the bridge will forward it to the network (even if the |
1995 | + * client was not associated yet), which isn't supposed to |
1996 | + * happen. |
1997 | + * To avoid that, rewrite the destination address to our own |
1998 | + * address, so that the authenticator (e.g. hostapd) will see |
1999 | + * the frame, but bridge won't forward it anywhere else. Note |
2000 | + * that due to earlier filtering, the only other address can |
2001 | + * be the PAE group address. |
2002 | + */ |
2003 | + if (unlikely(skb->protocol == sdata->control_port_protocol && |
2004 | + !ether_addr_equal(ehdr->h_dest, sdata->vif.addr))) |
2005 | + ether_addr_copy(ehdr->h_dest, sdata->vif.addr); |
2006 | + |
2007 | if (rx->napi) |
2008 | napi_gro_receive(rx->napi, skb); |
2009 | else |
2010 | @@ -2421,9 +2488,27 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) |
2011 | |
2012 | if (ieee80211_data_to_8023_exthdr(skb, ðhdr, |
2013 | rx->sdata->vif.addr, |
2014 | - rx->sdata->vif.type)) |
2015 | + rx->sdata->vif.type, |
2016 | + true)) |
2017 | return RX_DROP_UNUSABLE; |
2018 | |
2019 | + if (rx->key) { |
2020 | + /* |
2021 | + * We should not receive A-MSDUs on pre-HT connections, |
2022 | + * and HT connections cannot use old ciphers. Thus drop |
2023 | + * them, as in those cases we couldn't even have SPP |
2024 | + * A-MSDUs or such. |
2025 | + */ |
2026 | + switch (rx->key->conf.cipher) { |
2027 | + case WLAN_CIPHER_SUITE_WEP40: |
2028 | + case WLAN_CIPHER_SUITE_WEP104: |
2029 | + case WLAN_CIPHER_SUITE_TKIP: |
2030 | + return RX_DROP_UNUSABLE; |
2031 | + default: |
2032 | + break; |
2033 | + } |
2034 | + } |
2035 | + |
2036 | ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, |
2037 | rx->sdata->vif.type, |
2038 | rx->local->hw.extra_tx_headroom, |
2039 | diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c |
2040 | index bdcc6cb60b1c8..ded1264cf8e4b 100644 |
2041 | --- a/net/mac80211/sta_info.c |
2042 | +++ b/net/mac80211/sta_info.c |
2043 | @@ -366,6 +366,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata, |
2044 | |
2045 | u64_stats_init(&sta->rx_stats.syncp); |
2046 | |
2047 | + ieee80211_init_frag_cache(&sta->frags); |
2048 | + |
2049 | sta->sta_state = IEEE80211_STA_NONE; |
2050 | |
2051 | /* Mark TID as unreserved */ |
2052 | @@ -999,6 +1001,8 @@ static void __sta_info_destroy_part2(struct sta_info *sta) |
2053 | rate_control_remove_sta_debugfs(sta); |
2054 | ieee80211_sta_debugfs_remove(sta); |
2055 | |
2056 | + ieee80211_destroy_frag_cache(&sta->frags); |
2057 | + |
2058 | cleanup_single_sta(sta); |
2059 | } |
2060 | |
2061 | diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h |
2062 | index cc808ac783e5c..fd31c4db12821 100644 |
2063 | --- a/net/mac80211/sta_info.h |
2064 | +++ b/net/mac80211/sta_info.h |
2065 | @@ -391,6 +391,34 @@ struct ieee80211_sta_rx_stats { |
2066 | u64 msdu[IEEE80211_NUM_TIDS + 1]; |
2067 | }; |
2068 | |
2069 | +/* |
2070 | + * IEEE 802.11-2016 (10.6 "Defragmentation") recommends support for "concurrent |
2071 | + * reception of at least one MSDU per access category per associated STA" |
2072 | + * on APs, or "at least one MSDU per access category" on other interface types. |
2073 | + * |
2074 | + * This limit can be increased by changing this define, at the cost of slower |
2075 | + * frame reassembly and increased memory use while fragments are pending. |
2076 | + */ |
2077 | +#define IEEE80211_FRAGMENT_MAX 4 |
2078 | + |
2079 | +struct ieee80211_fragment_entry { |
2080 | + struct sk_buff_head skb_list; |
2081 | + unsigned long first_frag_time; |
2082 | + u16 seq; |
2083 | + u16 extra_len; |
2084 | + u16 last_frag; |
2085 | + u8 rx_queue; |
2086 | + u8 check_sequential_pn:1, /* needed for CCMP/GCMP */ |
2087 | + is_protected:1; |
2088 | + u8 last_pn[6]; /* PN of the last fragment if CCMP was used */ |
2089 | + unsigned int key_color; |
2090 | +}; |
2091 | + |
2092 | +struct ieee80211_fragment_cache { |
2093 | + struct ieee80211_fragment_entry entries[IEEE80211_FRAGMENT_MAX]; |
2094 | + unsigned int next; |
2095 | +}; |
2096 | + |
2097 | /** |
2098 | * struct sta_info - STA information |
2099 | * |
2100 | @@ -454,6 +482,7 @@ struct ieee80211_sta_rx_stats { |
2101 | * @pcpu_rx_stats: per-CPU RX statistics, assigned only if the driver needs |
2102 | * this (by advertising the USES_RSS hw flag) |
2103 | * @status_stats: TX status statistics |
2104 | + * @frags: fragment cache |
2105 | */ |
2106 | struct sta_info { |
2107 | /* General information, mostly static */ |
2108 | @@ -551,6 +580,8 @@ struct sta_info { |
2109 | |
2110 | struct cfg80211_chan_def tdls_chandef; |
2111 | |
2112 | + struct ieee80211_fragment_cache frags; |
2113 | + |
2114 | /* keep last! */ |
2115 | struct ieee80211_sta sta; |
2116 | }; |
2117 | diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c |
2118 | index c0529c4b60f82..7819a2507d395 100644 |
2119 | --- a/net/mac80211/wpa.c |
2120 | +++ b/net/mac80211/wpa.c |
2121 | @@ -162,8 +162,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) |
2122 | |
2123 | update_iv: |
2124 | /* update IV in key information to be able to detect replays */ |
2125 | - rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32; |
2126 | - rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16; |
2127 | + rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip.iv32; |
2128 | + rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip.iv16; |
2129 | |
2130 | return RX_CONTINUE; |
2131 | |
2132 | @@ -289,8 +289,8 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx) |
2133 | key, skb->data + hdrlen, |
2134 | skb->len - hdrlen, rx->sta->sta.addr, |
2135 | hdr->addr1, hwaccel, rx->security_idx, |
2136 | - &rx->tkip_iv32, |
2137 | - &rx->tkip_iv16); |
2138 | + &rx->tkip.iv32, |
2139 | + &rx->tkip.iv16); |
2140 | if (res != TKIP_DECRYPT_OK) |
2141 | return RX_DROP_UNUSABLE; |
2142 | |
2143 | @@ -548,6 +548,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, |
2144 | } |
2145 | |
2146 | memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN); |
2147 | + if (unlikely(ieee80211_is_frag(hdr))) |
2148 | + memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN); |
2149 | } |
2150 | |
2151 | /* Remove CCMP header and MIC */ |
2152 | @@ -777,6 +779,8 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) |
2153 | } |
2154 | |
2155 | memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN); |
2156 | + if (unlikely(ieee80211_is_frag(hdr))) |
2157 | + memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN); |
2158 | } |
2159 | |
2160 | /* Remove GCMP header and MIC */ |
2161 | diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c |
2162 | index 059f9fa0f6c91..52e1632bfee8c 100644 |
2163 | --- a/net/netfilter/x_tables.c |
2164 | +++ b/net/netfilter/x_tables.c |
2165 | @@ -1173,6 +1173,9 @@ xt_replace_table(struct xt_table *table, |
2166 | smp_wmb(); |
2167 | table->private = newinfo; |
2168 | |
2169 | + /* make sure all cpus see new ->private value */ |
2170 | + smp_mb(); |
2171 | + |
2172 | /* |
2173 | * Even though table entries have now been swapped, other CPU's |
2174 | * may still be using the old entries. This is okay, because |
2175 | diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c |
2176 | index 85a3d9ed4c290..bff6ba84d3979 100644 |
2177 | --- a/net/nfc/nci/core.c |
2178 | +++ b/net/nfc/nci/core.c |
2179 | @@ -1188,6 +1188,7 @@ EXPORT_SYMBOL(nci_allocate_device); |
2180 | void nci_free_device(struct nci_dev *ndev) |
2181 | { |
2182 | nfc_free_device(ndev->nfc_dev); |
2183 | + nci_hci_deallocate(ndev); |
2184 | kfree(ndev); |
2185 | } |
2186 | EXPORT_SYMBOL(nci_free_device); |
2187 | diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c |
2188 | index a0ab26d535dca..5fae3f064ad0a 100644 |
2189 | --- a/net/nfc/nci/hci.c |
2190 | +++ b/net/nfc/nci/hci.c |
2191 | @@ -798,3 +798,8 @@ struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev) |
2192 | |
2193 | return hdev; |
2194 | } |
2195 | + |
2196 | +void nci_hci_deallocate(struct nci_dev *ndev) |
2197 | +{ |
2198 | + kfree(ndev->hci_dev); |
2199 | +} |
2200 | diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c |
2201 | index 551cf193649e9..02ef78d2b3dff 100644 |
2202 | --- a/net/sched/sch_dsmark.c |
2203 | +++ b/net/sched/sch_dsmark.c |
2204 | @@ -388,7 +388,8 @@ static void dsmark_reset(struct Qdisc *sch) |
2205 | struct dsmark_qdisc_data *p = qdisc_priv(sch); |
2206 | |
2207 | pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p); |
2208 | - qdisc_reset(p->q); |
2209 | + if (p->q) |
2210 | + qdisc_reset(p->q); |
2211 | sch->qstats.backlog = 0; |
2212 | sch->q.qlen = 0; |
2213 | } |
2214 | diff --git a/net/tipc/msg.c b/net/tipc/msg.c |
2215 | index aeb4554dfddac..c1ab2ff2f6ace 100644 |
2216 | --- a/net/tipc/msg.c |
2217 | +++ b/net/tipc/msg.c |
2218 | @@ -141,18 +141,13 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) |
2219 | if (unlikely(head)) |
2220 | goto err; |
2221 | *buf = NULL; |
2222 | + if (skb_has_frag_list(frag) && __skb_linearize(frag)) |
2223 | + goto err; |
2224 | frag = skb_unshare(frag, GFP_ATOMIC); |
2225 | if (unlikely(!frag)) |
2226 | goto err; |
2227 | head = *headbuf = frag; |
2228 | TIPC_SKB_CB(head)->tail = NULL; |
2229 | - if (skb_is_nonlinear(head)) { |
2230 | - skb_walk_frags(head, tail) { |
2231 | - TIPC_SKB_CB(head)->tail = tail; |
2232 | - } |
2233 | - } else { |
2234 | - skb_frag_list_init(head); |
2235 | - } |
2236 | return 0; |
2237 | } |
2238 | |
2239 | diff --git a/net/tipc/socket.c b/net/tipc/socket.c |
2240 | index 804cab8f95090..c1b9074f3325e 100644 |
2241 | --- a/net/tipc/socket.c |
2242 | +++ b/net/tipc/socket.c |
2243 | @@ -741,7 +741,10 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq, |
2244 | spin_lock_bh(&inputq->lock); |
2245 | if (skb_peek(arrvq) == skb) { |
2246 | skb_queue_splice_tail_init(&tmpq, inputq); |
2247 | - __skb_dequeue(arrvq); |
2248 | + /* Decrease the skb's refcnt as increasing in the |
2249 | + * function tipc_skb_peek |
2250 | + */ |
2251 | + kfree_skb(__skb_dequeue(arrvq)); |
2252 | } |
2253 | spin_unlock_bh(&inputq->lock); |
2254 | __skb_queue_purge(&tmpq); |
2255 | diff --git a/net/wireless/util.c b/net/wireless/util.c |
2256 | index 262922cf6a0cc..939320571d71f 100644 |
2257 | --- a/net/wireless/util.c |
2258 | +++ b/net/wireless/util.c |
2259 | @@ -421,7 +421,8 @@ unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr) |
2260 | EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen); |
2261 | |
2262 | int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, |
2263 | - const u8 *addr, enum nl80211_iftype iftype) |
2264 | + const u8 *addr, enum nl80211_iftype iftype, |
2265 | + bool is_amsdu) |
2266 | { |
2267 | struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; |
2268 | struct { |
2269 | @@ -509,7 +510,7 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, |
2270 | skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)); |
2271 | tmp.h_proto = payload.proto; |
2272 | |
2273 | - if (likely((ether_addr_equal(payload.hdr, rfc1042_header) && |
2274 | + if (likely((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) && |
2275 | tmp.h_proto != htons(ETH_P_AARP) && |
2276 | tmp.h_proto != htons(ETH_P_IPX)) || |
2277 | ether_addr_equal(payload.hdr, bridge_tunnel_header))) |
2278 | @@ -768,6 +769,9 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, |
2279 | remaining = skb->len - offset; |
2280 | if (subframe_len > remaining) |
2281 | goto purge; |
2282 | + /* mitigate A-MSDU aggregation injection attacks */ |
2283 | + if (ether_addr_equal(eth.h_dest, rfc1042_header)) |
2284 | + goto purge; |
2285 | |
2286 | offset += sizeof(struct ethhdr); |
2287 | last = remaining <= subframe_len + padding; |
2288 | diff --git a/scripts/analyze_suspend.py b/scripts/analyze_suspend.py |
2289 | index a0ba48fa2c5ea..edc4f1255f9ba 100755 |
2290 | --- a/scripts/analyze_suspend.py |
2291 | +++ b/scripts/analyze_suspend.py |
2292 | @@ -1,4 +1,4 @@ |
2293 | -#!/usr/bin/python |
2294 | +#!/usr/bin/env python |
2295 | # |
2296 | # Tool for analyzing suspend/resume timing |
2297 | # Copyright (c) 2013, Intel Corporation. |
2298 | diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter |
2299 | index d9ff038c1b284..a650bea5ccddd 100755 |
2300 | --- a/scripts/bloat-o-meter |
2301 | +++ b/scripts/bloat-o-meter |
2302 | @@ -1,4 +1,4 @@ |
2303 | -#!/usr/bin/python |
2304 | +#!/usr/bin/env python3 |
2305 | # |
2306 | # Copyright 2004 Matt Mackall <mpm@selenic.com> |
2307 | # |
2308 | diff --git a/scripts/bootgraph.pl b/scripts/bootgraph.pl |
2309 | index 9ca667bcaee95..594c55541b162 100755 |
2310 | --- a/scripts/bootgraph.pl |
2311 | +++ b/scripts/bootgraph.pl |
2312 | @@ -1,4 +1,4 @@ |
2313 | -#!/usr/bin/perl |
2314 | +#!/usr/bin/env perl |
2315 | |
2316 | # Copyright 2008, Intel Corporation |
2317 | # |
2318 | diff --git a/scripts/checkincludes.pl b/scripts/checkincludes.pl |
2319 | index 97b2c6143fe4f..cfdfa02d4d923 100755 |
2320 | --- a/scripts/checkincludes.pl |
2321 | +++ b/scripts/checkincludes.pl |
2322 | @@ -1,4 +1,4 @@ |
2323 | -#!/usr/bin/perl |
2324 | +#!/usr/bin/env perl |
2325 | # |
2326 | # checkincludes: find/remove files included more than once |
2327 | # |
2328 | diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl |
2329 | index b8f6165452771..32828fafcf5b1 100755 |
2330 | --- a/scripts/checkstack.pl |
2331 | +++ b/scripts/checkstack.pl |
2332 | @@ -1,4 +1,4 @@ |
2333 | -#!/usr/bin/perl |
2334 | +#!/usr/bin/env perl |
2335 | |
2336 | # Check the stack usage of functions |
2337 | # |
2338 | diff --git a/scripts/config b/scripts/config |
2339 | index 73de17d396987..06ac9882e1de2 100755 |
2340 | --- a/scripts/config |
2341 | +++ b/scripts/config |
2342 | @@ -1,4 +1,4 @@ |
2343 | -#!/bin/bash |
2344 | +#!/usr/bin/env bash |
2345 | # Manipulate options in a .config file from the command line |
2346 | |
2347 | myname=${0##*/} |
2348 | diff --git a/scripts/diffconfig b/scripts/diffconfig |
2349 | index 0db267d0adc92..19189f3c4a034 100755 |
2350 | --- a/scripts/diffconfig |
2351 | +++ b/scripts/diffconfig |
2352 | @@ -1,4 +1,4 @@ |
2353 | -#!/usr/bin/python |
2354 | +#!/usr/bin/env python3 |
2355 | # |
2356 | # diffconfig - a tool to compare .config files. |
2357 | # |
2358 | diff --git a/scripts/dtc/dt_to_config b/scripts/dtc/dt_to_config |
2359 | index 9a248b505c585..5dfd1bff351f7 100755 |
2360 | --- a/scripts/dtc/dt_to_config |
2361 | +++ b/scripts/dtc/dt_to_config |
2362 | @@ -1,4 +1,4 @@ |
2363 | -#!/usr/bin/perl |
2364 | +#!/usr/bin/env perl |
2365 | |
2366 | # Copyright 2016 by Frank Rowand |
2367 | # Copyright 2016 by Gaurav Minocha |
2368 | diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl |
2369 | index 47877deae6d7f..61d9b256c6581 100755 |
2370 | --- a/scripts/extract_xc3028.pl |
2371 | +++ b/scripts/extract_xc3028.pl |
2372 | @@ -1,4 +1,4 @@ |
2373 | -#!/usr/bin/perl |
2374 | +#!/usr/bin/env perl |
2375 | |
2376 | # Copyright (c) Mauro Carvalho Chehab <mchehab@infradead.org> |
2377 | # Released under GPLv2 |
2378 | diff --git a/scripts/get_dvb_firmware b/scripts/get_dvb_firmware |
2379 | index 1a0a04125f713..f3f230225aba0 100755 |
2380 | --- a/scripts/get_dvb_firmware |
2381 | +++ b/scripts/get_dvb_firmware |
2382 | @@ -1,4 +1,4 @@ |
2383 | -#!/usr/bin/perl |
2384 | +#!/usr/bin/env perl |
2385 | # DVB firmware extractor |
2386 | # |
2387 | # (c) 2004 Andrew de Quincey |
2388 | diff --git a/scripts/markup_oops.pl b/scripts/markup_oops.pl |
2389 | index c21d16328d3f2..70dcfb6b3de1c 100755 |
2390 | --- a/scripts/markup_oops.pl |
2391 | +++ b/scripts/markup_oops.pl |
2392 | @@ -1,4 +1,4 @@ |
2393 | -#!/usr/bin/perl |
2394 | +#!/usr/bin/env perl |
2395 | |
2396 | use File::Basename; |
2397 | use Math::BigInt; |
2398 | diff --git a/scripts/profile2linkerlist.pl b/scripts/profile2linkerlist.pl |
2399 | index 6943fa7cc95b6..f23d7be943948 100755 |
2400 | --- a/scripts/profile2linkerlist.pl |
2401 | +++ b/scripts/profile2linkerlist.pl |
2402 | @@ -1,4 +1,4 @@ |
2403 | -#!/usr/bin/perl |
2404 | +#!/usr/bin/env perl |
2405 | |
2406 | # |
2407 | # Takes a (sorted) output of readprofile and turns it into a list suitable for |
2408 | diff --git a/scripts/show_delta b/scripts/show_delta |
2409 | index 5b365009e6a39..55c66dce6fc17 100755 |
2410 | --- a/scripts/show_delta |
2411 | +++ b/scripts/show_delta |
2412 | @@ -1,4 +1,4 @@ |
2413 | -#!/usr/bin/python |
2414 | +#!/usr/bin/env python |
2415 | # |
2416 | # show_deltas: Read list of printk messages instrumented with |
2417 | # time data, and format with time deltas. |
2418 | diff --git a/scripts/stackdelta b/scripts/stackdelta |
2419 | index 48eabf2f48f85..20a79f19a111d 100755 |
2420 | --- a/scripts/stackdelta |
2421 | +++ b/scripts/stackdelta |
2422 | @@ -1,4 +1,4 @@ |
2423 | -#!/usr/bin/perl |
2424 | +#!/usr/bin/env perl |
2425 | |
2426 | # Read two files produced by the stackusage script, and show the |
2427 | # delta between them. |
2428 | diff --git a/scripts/tracing/draw_functrace.py b/scripts/tracing/draw_functrace.py |
2429 | index db40fa04cd513..30f117dfab438 100755 |
2430 | --- a/scripts/tracing/draw_functrace.py |
2431 | +++ b/scripts/tracing/draw_functrace.py |
2432 | @@ -1,4 +1,4 @@ |
2433 | -#!/usr/bin/python |
2434 | +#!/usr/bin/env python |
2435 | |
2436 | """ |
2437 | Copyright 2008 (c) Frederic Weisbecker <fweisbec@gmail.com> |
2438 | diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c |
2439 | index 6df29fa30fb9d..9e449dd8da929 100644 |
2440 | --- a/sound/soc/codecs/cs35l33.c |
2441 | +++ b/sound/soc/codecs/cs35l33.c |
2442 | @@ -1209,6 +1209,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client, |
2443 | dev_err(&i2c_client->dev, |
2444 | "CS35L33 Device ID (%X). Expected ID %X\n", |
2445 | devid, CS35L33_CHIP_ID); |
2446 | + ret = -EINVAL; |
2447 | goto err_enable; |
2448 | } |
2449 | |
2450 | diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat |
2451 | index 581278c584887..5e5797cc37572 100755 |
2452 | --- a/tools/kvm/kvm_stat/kvm_stat |
2453 | +++ b/tools/kvm/kvm_stat/kvm_stat |
2454 | @@ -1,4 +1,4 @@ |
2455 | -#!/usr/bin/python |
2456 | +#!/usr/bin/env python |
2457 | # |
2458 | # top-like utility for displaying kvm statistics |
2459 | # |
2460 | diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c |
2461 | index 0619054bd7a0d..61fe3ce5862d5 100644 |
2462 | --- a/tools/perf/pmu-events/jevents.c |
2463 | +++ b/tools/perf/pmu-events/jevents.c |
2464 | @@ -603,7 +603,7 @@ static int get_maxfds(void) |
2465 | struct rlimit rlim; |
2466 | |
2467 | if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) |
2468 | - return min((int)rlim.rlim_max / 2, 512); |
2469 | + return min(rlim.rlim_max / 2, (rlim_t)512); |
2470 | |
2471 | return 512; |
2472 | } |
2473 | diff --git a/tools/perf/python/tracepoint.py b/tools/perf/python/tracepoint.py |
2474 | index eb4dbed57de7e..ce273c8b512b0 100755 |
2475 | --- a/tools/perf/python/tracepoint.py |
2476 | +++ b/tools/perf/python/tracepoint.py |
2477 | @@ -1,4 +1,4 @@ |
2478 | -#! /usr/bin/python |
2479 | +#! /usr/bin/env python |
2480 | # -*- python -*- |
2481 | # -*- coding: utf-8 -*- |
2482 | |
2483 | diff --git a/tools/perf/python/twatch.py b/tools/perf/python/twatch.py |
2484 | index c235c22b107ab..5a55b25f0b8c3 100755 |
2485 | --- a/tools/perf/python/twatch.py |
2486 | +++ b/tools/perf/python/twatch.py |
2487 | @@ -1,4 +1,4 @@ |
2488 | -#! /usr/bin/python |
2489 | +#! /usr/bin/env python |
2490 | # -*- python -*- |
2491 | # -*- coding: utf-8 -*- |
2492 | # twatch - Experimental use of the perf python interface |
2493 | diff --git a/tools/perf/scripts/python/sched-migration.py b/tools/perf/scripts/python/sched-migration.py |
2494 | index de66cb3b72c9e..dd3e7ae2a1af3 100644 |
2495 | --- a/tools/perf/scripts/python/sched-migration.py |
2496 | +++ b/tools/perf/scripts/python/sched-migration.py |
2497 | @@ -1,4 +1,4 @@ |
2498 | -#!/usr/bin/python |
2499 | +#!/usr/bin/env python |
2500 | # |
2501 | # Cpu task migration overview toy |
2502 | # |
2503 | diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py |
2504 | index c8680984d2d66..163f38fbd79c0 100644 |
2505 | --- a/tools/perf/util/setup.py |
2506 | +++ b/tools/perf/util/setup.py |
2507 | @@ -1,4 +1,4 @@ |
2508 | -#!/usr/bin/python2 |
2509 | +#!/usr/bin/env python2 |
2510 | |
2511 | from distutils.core import setup, Extension |
2512 | from os import getenv |
2513 | diff --git a/tools/testing/ktest/compare-ktest-sample.pl b/tools/testing/ktest/compare-ktest-sample.pl |
2514 | index a373a5bfff683..c488e863d83f1 100755 |
2515 | --- a/tools/testing/ktest/compare-ktest-sample.pl |
2516 | +++ b/tools/testing/ktest/compare-ktest-sample.pl |
2517 | @@ -1,4 +1,4 @@ |
2518 | -#!/usr/bin/perl |
2519 | +#!/usr/bin/env perl |
2520 | |
2521 | open (IN,"ktest.pl"); |
2522 | while (<IN>) { |