Annotation of /trunk/kernel-alx-legacy/patches-4.9/0372-4.9.273-all-fixes.patch
Parent Directory | Revision Log
Revision 3674 -
(hide annotations)
(download)
Mon Oct 24 14:07:51 2022 UTC (23 months ago) by niro
File size: 35749 byte(s)
Mon Oct 24 14:07:51 2022 UTC (23 months ago) by niro
File size: 35749 byte(s)
-linux-4.9.273
1 | niro | 3674 | diff --git a/Makefile b/Makefile |
2 | index 39aa8b66fc6ff..e43823c3337f3 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 9 | ||
8 | -SUBLEVEL = 272 | ||
9 | +SUBLEVEL = 273 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Roaring Lionus | ||
12 | |||
13 | diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c | ||
14 | index 5530070e0d05d..57497a26e79cb 100644 | ||
15 | --- a/arch/mips/lib/mips-atomic.c | ||
16 | +++ b/arch/mips/lib/mips-atomic.c | ||
17 | @@ -37,7 +37,7 @@ | ||
18 | */ | ||
19 | notrace void arch_local_irq_disable(void) | ||
20 | { | ||
21 | - preempt_disable(); | ||
22 | + preempt_disable_notrace(); | ||
23 | |||
24 | __asm__ __volatile__( | ||
25 | " .set push \n" | ||
26 | @@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void) | ||
27 | : /* no inputs */ | ||
28 | : "memory"); | ||
29 | |||
30 | - preempt_enable(); | ||
31 | + preempt_enable_notrace(); | ||
32 | } | ||
33 | EXPORT_SYMBOL(arch_local_irq_disable); | ||
34 | |||
35 | @@ -61,7 +61,7 @@ notrace unsigned long arch_local_irq_save(void) | ||
36 | { | ||
37 | unsigned long flags; | ||
38 | |||
39 | - preempt_disable(); | ||
40 | + preempt_disable_notrace(); | ||
41 | |||
42 | __asm__ __volatile__( | ||
43 | " .set push \n" | ||
44 | @@ -78,7 +78,7 @@ notrace unsigned long arch_local_irq_save(void) | ||
45 | : /* no inputs */ | ||
46 | : "memory"); | ||
47 | |||
48 | - preempt_enable(); | ||
49 | + preempt_enable_notrace(); | ||
50 | |||
51 | return flags; | ||
52 | } | ||
53 | @@ -88,7 +88,7 @@ notrace void arch_local_irq_restore(unsigned long flags) | ||
54 | { | ||
55 | unsigned long __tmp1; | ||
56 | |||
57 | - preempt_disable(); | ||
58 | + preempt_disable_notrace(); | ||
59 | |||
60 | __asm__ __volatile__( | ||
61 | " .set push \n" | ||
62 | @@ -106,7 +106,7 @@ notrace void arch_local_irq_restore(unsigned long flags) | ||
63 | : "0" (flags) | ||
64 | : "memory"); | ||
65 | |||
66 | - preempt_enable(); | ||
67 | + preempt_enable_notrace(); | ||
68 | } | ||
69 | EXPORT_SYMBOL(arch_local_irq_restore); | ||
70 | |||
71 | diff --git a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | ||
72 | index af12ead88c5f0..404f570ebe238 100644 | ||
73 | --- a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | ||
74 | +++ b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | ||
75 | @@ -122,7 +122,15 @@ | ||
76 | }; | ||
77 | |||
78 | /include/ "pq3-i2c-0.dtsi" | ||
79 | + i2c@3000 { | ||
80 | + fsl,i2c-erratum-a004447; | ||
81 | + }; | ||
82 | + | ||
83 | /include/ "pq3-i2c-1.dtsi" | ||
84 | + i2c@3100 { | ||
85 | + fsl,i2c-erratum-a004447; | ||
86 | + }; | ||
87 | + | ||
88 | /include/ "pq3-duart-0.dtsi" | ||
89 | /include/ "pq3-espi-0.dtsi" | ||
90 | spi0: spi@7000 { | ||
91 | diff --git a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | ||
92 | index 51e975d7631aa..8921f17fca42e 100644 | ||
93 | --- a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | ||
94 | +++ b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | ||
95 | @@ -389,7 +389,23 @@ | ||
96 | }; | ||
97 | |||
98 | /include/ "qoriq-i2c-0.dtsi" | ||
99 | + i2c@118000 { | ||
100 | + fsl,i2c-erratum-a004447; | ||
101 | + }; | ||
102 | + | ||
103 | + i2c@118100 { | ||
104 | + fsl,i2c-erratum-a004447; | ||
105 | + }; | ||
106 | + | ||
107 | /include/ "qoriq-i2c-1.dtsi" | ||
108 | + i2c@119000 { | ||
109 | + fsl,i2c-erratum-a004447; | ||
110 | + }; | ||
111 | + | ||
112 | + i2c@119100 { | ||
113 | + fsl,i2c-erratum-a004447; | ||
114 | + }; | ||
115 | + | ||
116 | /include/ "qoriq-duart-0.dtsi" | ||
117 | /include/ "qoriq-duart-1.dtsi" | ||
118 | /include/ "qoriq-gpio-0.dtsi" | ||
119 | diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c | ||
120 | index 56b2dd9a5b687..315d51ac14b8d 100644 | ||
121 | --- a/drivers/gpu/drm/drm_auth.c | ||
122 | +++ b/drivers/gpu/drm/drm_auth.c | ||
123 | @@ -244,9 +244,10 @@ int drm_master_open(struct drm_file *file_priv) | ||
124 | void drm_master_release(struct drm_file *file_priv) | ||
125 | { | ||
126 | struct drm_device *dev = file_priv->minor->dev; | ||
127 | - struct drm_master *master = file_priv->master; | ||
128 | + struct drm_master *master; | ||
129 | |||
130 | mutex_lock(&dev->master_mutex); | ||
131 | + master = file_priv->master; | ||
132 | if (file_priv->magic) | ||
133 | idr_remove(&file_priv->master->magic_map, file_priv->magic); | ||
134 | |||
135 | diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c | ||
136 | index 565a49a0c5641..90e4f839eb1cb 100644 | ||
137 | --- a/drivers/i2c/busses/i2c-mpc.c | ||
138 | +++ b/drivers/i2c/busses/i2c-mpc.c | ||
139 | @@ -23,6 +23,7 @@ | ||
140 | |||
141 | #include <linux/clk.h> | ||
142 | #include <linux/io.h> | ||
143 | +#include <linux/iopoll.h> | ||
144 | #include <linux/fsl_devices.h> | ||
145 | #include <linux/i2c.h> | ||
146 | #include <linux/interrupt.h> | ||
147 | @@ -49,6 +50,7 @@ | ||
148 | #define CCR_MTX 0x10 | ||
149 | #define CCR_TXAK 0x08 | ||
150 | #define CCR_RSTA 0x04 | ||
151 | +#define CCR_RSVD 0x02 | ||
152 | |||
153 | #define CSR_MCF 0x80 | ||
154 | #define CSR_MAAS 0x40 | ||
155 | @@ -70,6 +72,7 @@ struct mpc_i2c { | ||
156 | u8 fdr, dfsrr; | ||
157 | #endif | ||
158 | struct clk *clk_per; | ||
159 | + bool has_errata_A004447; | ||
160 | }; | ||
161 | |||
162 | struct mpc_i2c_divider { | ||
163 | @@ -178,6 +181,75 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) | ||
164 | return 0; | ||
165 | } | ||
166 | |||
167 | +static int i2c_mpc_wait_sr(struct mpc_i2c *i2c, int mask) | ||
168 | +{ | ||
169 | + void __iomem *addr = i2c->base + MPC_I2C_SR; | ||
170 | + u8 val; | ||
171 | + | ||
172 | + return readb_poll_timeout(addr, val, val & mask, 0, 100); | ||
173 | +} | ||
174 | + | ||
175 | +/* | ||
176 | + * Workaround for Erratum A004447. From the P2040CE Rev Q | ||
177 | + * | ||
178 | + * 1. Set up the frequency divider and sampling rate. | ||
179 | + * 2. I2CCR - a0h | ||
180 | + * 3. Poll for I2CSR[MBB] to get set. | ||
181 | + * 4. If I2CSR[MAL] is set (an indication that SDA is stuck low), then go to | ||
182 | + * step 5. If MAL is not set, then go to step 13. | ||
183 | + * 5. I2CCR - 00h | ||
184 | + * 6. I2CCR - 22h | ||
185 | + * 7. I2CCR - a2h | ||
186 | + * 8. Poll for I2CSR[MBB] to get set. | ||
187 | + * 9. Issue read to I2CDR. | ||
188 | + * 10. Poll for I2CSR[MIF] to be set. | ||
189 | + * 11. I2CCR - 82h | ||
190 | + * 12. Workaround complete. Skip the next steps. | ||
191 | + * 13. Issue read to I2CDR. | ||
192 | + * 14. Poll for I2CSR[MIF] to be set. | ||
193 | + * 15. I2CCR - 80h | ||
194 | + */ | ||
195 | +static void mpc_i2c_fixup_A004447(struct mpc_i2c *i2c) | ||
196 | +{ | ||
197 | + int ret; | ||
198 | + u32 val; | ||
199 | + | ||
200 | + writeccr(i2c, CCR_MEN | CCR_MSTA); | ||
201 | + ret = i2c_mpc_wait_sr(i2c, CSR_MBB); | ||
202 | + if (ret) { | ||
203 | + dev_err(i2c->dev, "timeout waiting for CSR_MBB\n"); | ||
204 | + return; | ||
205 | + } | ||
206 | + | ||
207 | + val = readb(i2c->base + MPC_I2C_SR); | ||
208 | + | ||
209 | + if (val & CSR_MAL) { | ||
210 | + writeccr(i2c, 0x00); | ||
211 | + writeccr(i2c, CCR_MSTA | CCR_RSVD); | ||
212 | + writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSVD); | ||
213 | + ret = i2c_mpc_wait_sr(i2c, CSR_MBB); | ||
214 | + if (ret) { | ||
215 | + dev_err(i2c->dev, "timeout waiting for CSR_MBB\n"); | ||
216 | + return; | ||
217 | + } | ||
218 | + val = readb(i2c->base + MPC_I2C_DR); | ||
219 | + ret = i2c_mpc_wait_sr(i2c, CSR_MIF); | ||
220 | + if (ret) { | ||
221 | + dev_err(i2c->dev, "timeout waiting for CSR_MIF\n"); | ||
222 | + return; | ||
223 | + } | ||
224 | + writeccr(i2c, CCR_MEN | CCR_RSVD); | ||
225 | + } else { | ||
226 | + val = readb(i2c->base + MPC_I2C_DR); | ||
227 | + ret = i2c_mpc_wait_sr(i2c, CSR_MIF); | ||
228 | + if (ret) { | ||
229 | + dev_err(i2c->dev, "timeout waiting for CSR_MIF\n"); | ||
230 | + return; | ||
231 | + } | ||
232 | + writeccr(i2c, CCR_MEN); | ||
233 | + } | ||
234 | +} | ||
235 | + | ||
236 | #if defined(CONFIG_PPC_MPC52xx) || defined(CONFIG_PPC_MPC512x) | ||
237 | static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = { | ||
238 | {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23}, | ||
239 | @@ -581,7 +653,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) | ||
240 | if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) { | ||
241 | writeb(status & ~CSR_MAL, | ||
242 | i2c->base + MPC_I2C_SR); | ||
243 | - mpc_i2c_fixup(i2c); | ||
244 | + i2c_recover_bus(&i2c->adap); | ||
245 | } | ||
246 | return -EIO; | ||
247 | } | ||
248 | @@ -617,7 +689,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) | ||
249 | if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) { | ||
250 | writeb(status & ~CSR_MAL, | ||
251 | i2c->base + MPC_I2C_SR); | ||
252 | - mpc_i2c_fixup(i2c); | ||
253 | + i2c_recover_bus(&i2c->adap); | ||
254 | } | ||
255 | return -EIO; | ||
256 | } | ||
257 | @@ -632,6 +704,18 @@ static u32 mpc_functionality(struct i2c_adapter *adap) | ||
258 | | I2C_FUNC_SMBUS_READ_BLOCK_DATA | I2C_FUNC_SMBUS_BLOCK_PROC_CALL; | ||
259 | } | ||
260 | |||
261 | +static int fsl_i2c_bus_recovery(struct i2c_adapter *adap) | ||
262 | +{ | ||
263 | + struct mpc_i2c *i2c = i2c_get_adapdata(adap); | ||
264 | + | ||
265 | + if (i2c->has_errata_A004447) | ||
266 | + mpc_i2c_fixup_A004447(i2c); | ||
267 | + else | ||
268 | + mpc_i2c_fixup(i2c); | ||
269 | + | ||
270 | + return 0; | ||
271 | +} | ||
272 | + | ||
273 | static const struct i2c_algorithm mpc_algo = { | ||
274 | .master_xfer = mpc_xfer, | ||
275 | .functionality = mpc_functionality, | ||
276 | @@ -643,6 +727,10 @@ static struct i2c_adapter mpc_ops = { | ||
277 | .timeout = HZ, | ||
278 | }; | ||
279 | |||
280 | +static struct i2c_bus_recovery_info fsl_i2c_recovery_info = { | ||
281 | + .recover_bus = fsl_i2c_bus_recovery, | ||
282 | +}; | ||
283 | + | ||
284 | static const struct of_device_id mpc_i2c_of_match[]; | ||
285 | static int fsl_i2c_probe(struct platform_device *op) | ||
286 | { | ||
287 | @@ -727,6 +815,8 @@ static int fsl_i2c_probe(struct platform_device *op) | ||
288 | dev_info(i2c->dev, "timeout %u us\n", mpc_ops.timeout * 1000000 / HZ); | ||
289 | |||
290 | platform_set_drvdata(op, i2c); | ||
291 | + if (of_property_read_bool(op->dev.of_node, "fsl,i2c-erratum-a004447")) | ||
292 | + i2c->has_errata_A004447 = true; | ||
293 | |||
294 | i2c->adap = mpc_ops; | ||
295 | of_address_to_resource(op->dev.of_node, 0, &res); | ||
296 | @@ -735,6 +825,7 @@ static int fsl_i2c_probe(struct platform_device *op) | ||
297 | i2c_set_adapdata(&i2c->adap, i2c); | ||
298 | i2c->adap.dev.parent = &op->dev; | ||
299 | i2c->adap.dev.of_node = of_node_get(op->dev.of_node); | ||
300 | + i2c->adap.bus_recovery_info = &fsl_i2c_recovery_info; | ||
301 | |||
302 | result = i2c_add_adapter(&i2c->adap); | ||
303 | if (result < 0) | ||
304 | diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c | ||
305 | index afde4edef9ae8..6dea4c180c494 100644 | ||
306 | --- a/drivers/isdn/hardware/mISDN/netjet.c | ||
307 | +++ b/drivers/isdn/hardware/mISDN/netjet.c | ||
308 | @@ -1114,7 +1114,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent) | ||
309 | card->typ = NETJET_S_TJ300; | ||
310 | |||
311 | card->base = pci_resource_start(pdev, 0); | ||
312 | - card->irq = pdev->irq; | ||
313 | pci_set_drvdata(pdev, card); | ||
314 | err = setup_instance(card); | ||
315 | if (err) | ||
316 | diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c | ||
317 | index 1b2e9217ec789..d520ce32ddbfc 100644 | ||
318 | --- a/drivers/net/appletalk/cops.c | ||
319 | +++ b/drivers/net/appletalk/cops.c | ||
320 | @@ -324,6 +324,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) | ||
321 | break; | ||
322 | } | ||
323 | |||
324 | + dev->base_addr = ioaddr; | ||
325 | + | ||
326 | /* Reserve any actual interrupt. */ | ||
327 | if (dev->irq) { | ||
328 | retval = request_irq(dev->irq, cops_interrupt, 0, dev->name, dev); | ||
329 | @@ -331,8 +333,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) | ||
330 | goto err_out; | ||
331 | } | ||
332 | |||
333 | - dev->base_addr = ioaddr; | ||
334 | - | ||
335 | lp = netdev_priv(dev); | ||
336 | spin_lock_init(&lp->lock); | ||
337 | |||
338 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c | ||
339 | index 16437aa35bc4c..2b721ed392adb 100644 | ||
340 | --- a/drivers/net/bonding/bond_main.c | ||
341 | +++ b/drivers/net/bonding/bond_main.c | ||
342 | @@ -1280,6 +1280,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond, | ||
343 | |||
344 | slave->bond = bond; | ||
345 | slave->dev = slave_dev; | ||
346 | + INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); | ||
347 | |||
348 | if (bond_kobj_init(slave)) | ||
349 | return NULL; | ||
350 | @@ -1292,7 +1293,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond, | ||
351 | return NULL; | ||
352 | } | ||
353 | } | ||
354 | - INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); | ||
355 | |||
356 | return slave; | ||
357 | } | ||
358 | diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | ||
359 | index e8a09d0afe1c9..545b59ff5d7e7 100644 | ||
360 | --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | ||
361 | +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | ||
362 | @@ -1240,8 +1240,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param, | ||
363 | goto failed; | ||
364 | |||
365 | /* SR-IOV capability was enabled but there are no VFs*/ | ||
366 | - if (iov->total == 0) | ||
367 | + if (iov->total == 0) { | ||
368 | + err = -EINVAL; | ||
369 | goto failed; | ||
370 | + } | ||
371 | |||
372 | iov->nr_virtfn = min_t(u16, iov->total, num_vfs_param); | ||
373 | |||
374 | diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c | ||
375 | index f20718b730e5b..69fa47351a329 100644 | ||
376 | --- a/drivers/net/ethernet/cadence/macb.c | ||
377 | +++ b/drivers/net/ethernet/cadence/macb.c | ||
378 | @@ -2031,6 +2031,9 @@ static struct net_device_stats *gem_get_stats(struct macb *bp) | ||
379 | struct gem_stats *hwstat = &bp->hw_stats.gem; | ||
380 | struct net_device_stats *nstat = &bp->stats; | ||
381 | |||
382 | + if (!netif_running(bp->dev)) | ||
383 | + return nstat; | ||
384 | + | ||
385 | gem_update_stats(bp); | ||
386 | |||
387 | nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors + | ||
388 | diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c | ||
389 | index f2cb77c3b1992..192950a112c93 100644 | ||
390 | --- a/drivers/net/ethernet/qlogic/qla3xxx.c | ||
391 | +++ b/drivers/net/ethernet/qlogic/qla3xxx.c | ||
392 | @@ -115,7 +115,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev, | ||
393 | value = readl(&port_regs->CommonRegs.semaphoreReg); | ||
394 | if ((value & (sem_mask >> 16)) == sem_bits) | ||
395 | return 0; | ||
396 | - ssleep(1); | ||
397 | + mdelay(1000); | ||
398 | } while (--seconds); | ||
399 | return -1; | ||
400 | } | ||
401 | diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c | ||
402 | index a9bbdcec0bad7..8cc7563ab103b 100644 | ||
403 | --- a/drivers/net/phy/mdio_bus.c | ||
404 | +++ b/drivers/net/phy/mdio_bus.c | ||
405 | @@ -362,7 +362,8 @@ void mdiobus_unregister(struct mii_bus *bus) | ||
406 | struct mdio_device *mdiodev; | ||
407 | int i; | ||
408 | |||
409 | - BUG_ON(bus->state != MDIOBUS_REGISTERED); | ||
410 | + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) | ||
411 | + return; | ||
412 | bus->state = MDIOBUS_UNREGISTERED; | ||
413 | |||
414 | for (i = 0; i < PHY_MAX_ADDR; i++) { | ||
415 | diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c | ||
416 | index 258a3f9a25197..dc09f10d5d4b8 100644 | ||
417 | --- a/drivers/scsi/hosts.c | ||
418 | +++ b/drivers/scsi/hosts.c | ||
419 | @@ -368,7 +368,7 @@ static void scsi_host_dev_release(struct device *dev) | ||
420 | |||
421 | ida_simple_remove(&host_index_ida, shost->host_no); | ||
422 | |||
423 | - if (parent) | ||
424 | + if (shost->shost_state != SHOST_CREATED) | ||
425 | put_device(parent); | ||
426 | kfree(shost); | ||
427 | } | ||
428 | @@ -421,8 +421,10 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) | ||
429 | mutex_init(&shost->scan_mutex); | ||
430 | |||
431 | index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL); | ||
432 | - if (index < 0) | ||
433 | - goto fail_kfree; | ||
434 | + if (index < 0) { | ||
435 | + kfree(shost); | ||
436 | + return NULL; | ||
437 | + } | ||
438 | shost->host_no = index; | ||
439 | |||
440 | shost->dma_channel = 0xff; | ||
441 | @@ -509,7 +511,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) | ||
442 | shost_printk(KERN_WARNING, shost, | ||
443 | "error handler thread failed to spawn, error = %ld\n", | ||
444 | PTR_ERR(shost->ehandler)); | ||
445 | - goto fail_index_remove; | ||
446 | + goto fail; | ||
447 | } | ||
448 | |||
449 | shost->tmf_work_q = alloc_workqueue("scsi_tmf_%d", | ||
450 | @@ -518,17 +520,18 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) | ||
451 | if (!shost->tmf_work_q) { | ||
452 | shost_printk(KERN_WARNING, shost, | ||
453 | "failed to create tmf workq\n"); | ||
454 | - goto fail_kthread; | ||
455 | + goto fail; | ||
456 | } | ||
457 | scsi_proc_hostdir_add(shost->hostt); | ||
458 | return shost; | ||
459 | + fail: | ||
460 | + /* | ||
461 | + * Host state is still SHOST_CREATED and that is enough to release | ||
462 | + * ->shost_gendev. scsi_host_dev_release() will free | ||
463 | + * dev_name(&shost->shost_dev). | ||
464 | + */ | ||
465 | + put_device(&shost->shost_gendev); | ||
466 | |||
467 | - fail_kthread: | ||
468 | - kthread_stop(shost->ehandler); | ||
469 | - fail_index_remove: | ||
470 | - ida_simple_remove(&host_index_ida, shost->host_no); | ||
471 | - fail_kfree: | ||
472 | - kfree(shost); | ||
473 | return NULL; | ||
474 | } | ||
475 | EXPORT_SYMBOL(scsi_host_alloc); | ||
476 | diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c | ||
477 | index b889caa556a0b..6ef7a094ee515 100644 | ||
478 | --- a/drivers/scsi/qla2xxx/qla_target.c | ||
479 | +++ b/drivers/scsi/qla2xxx/qla_target.c | ||
480 | @@ -1224,6 +1224,7 @@ void qlt_stop_phase2(struct qla_tgt *tgt) | ||
481 | "Waiting for %d IRQ commands to complete (tgt %p)", | ||
482 | tgt->irq_cmd_count, tgt); | ||
483 | |||
484 | + mutex_lock(&tgt->ha->optrom_mutex); | ||
485 | mutex_lock(&vha->vha_tgt.tgt_mutex); | ||
486 | spin_lock_irqsave(&ha->hardware_lock, flags); | ||
487 | while ((tgt->irq_cmd_count != 0) || (tgt->atio_irq_cmd_count != 0)) { | ||
488 | @@ -1235,6 +1236,7 @@ void qlt_stop_phase2(struct qla_tgt *tgt) | ||
489 | tgt->tgt_stopped = 1; | ||
490 | spin_unlock_irqrestore(&ha->hardware_lock, flags); | ||
491 | mutex_unlock(&vha->vha_tgt.tgt_mutex); | ||
492 | + mutex_unlock(&tgt->ha->optrom_mutex); | ||
493 | |||
494 | ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00c, "Stop of tgt %p finished", | ||
495 | tgt); | ||
496 | diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c | ||
497 | index df6fabcce4f78..4d2172c115c6e 100644 | ||
498 | --- a/drivers/scsi/vmw_pvscsi.c | ||
499 | +++ b/drivers/scsi/vmw_pvscsi.c | ||
500 | @@ -577,7 +577,13 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, | ||
501 | case BTSTAT_SUCCESS: | ||
502 | case BTSTAT_LINKED_COMMAND_COMPLETED: | ||
503 | case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG: | ||
504 | - /* If everything went fine, let's move on.. */ | ||
505 | + /* | ||
506 | + * Commands like INQUIRY may transfer less data than | ||
507 | + * requested by the initiator via bufflen. Set residual | ||
508 | + * count to make upper layer aware of the actual amount | ||
509 | + * of data returned. | ||
510 | + */ | ||
511 | + scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); | ||
512 | cmd->result = (DID_OK << 16); | ||
513 | break; | ||
514 | |||
515 | diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c | ||
516 | index 2331469f943d2..bd08b53ff81d2 100644 | ||
517 | --- a/drivers/usb/dwc3/ep0.c | ||
518 | +++ b/drivers/usb/dwc3/ep0.c | ||
519 | @@ -328,6 +328,9 @@ static struct dwc3_ep *dwc3_wIndex_to_dep(struct dwc3 *dwc, __le16 wIndex_le) | ||
520 | epnum |= 1; | ||
521 | |||
522 | dep = dwc->eps[epnum]; | ||
523 | + if (dep == NULL) | ||
524 | + return NULL; | ||
525 | + | ||
526 | if (dep->flags & DWC3_EP_ENABLED) | ||
527 | return dep; | ||
528 | |||
529 | diff --git a/drivers/usb/gadget/config.c b/drivers/usb/gadget/config.c | ||
530 | index 9b9d31eb6037f..2695a4db38292 100644 | ||
531 | --- a/drivers/usb/gadget/config.c | ||
532 | +++ b/drivers/usb/gadget/config.c | ||
533 | @@ -168,6 +168,14 @@ int usb_assign_descriptors(struct usb_function *f, | ||
534 | { | ||
535 | struct usb_gadget *g = f->config->cdev->gadget; | ||
536 | |||
537 | + /* super-speed-plus descriptor falls back to super-speed one, | ||
538 | + * if such a descriptor was provided, thus avoiding a NULL | ||
539 | + * pointer dereference if a 5gbps capable gadget is used with | ||
540 | + * a 10gbps capable config (device port + cable + host port) | ||
541 | + */ | ||
542 | + if (!ssp) | ||
543 | + ssp = ss; | ||
544 | + | ||
545 | if (fs) { | ||
546 | f->fs_descriptors = usb_copy_descriptors(fs); | ||
547 | if (!f->fs_descriptors) | ||
548 | diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c | ||
549 | index 8e3e443827854..5bd80cb3635ce 100644 | ||
550 | --- a/drivers/usb/gadget/function/f_ecm.c | ||
551 | +++ b/drivers/usb/gadget/function/f_ecm.c | ||
552 | @@ -793,7 +793,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) | ||
553 | fs_ecm_notify_desc.bEndpointAddress; | ||
554 | |||
555 | status = usb_assign_descriptors(f, ecm_fs_function, ecm_hs_function, | ||
556 | - ecm_ss_function, NULL); | ||
557 | + ecm_ss_function, ecm_ss_function); | ||
558 | if (status) | ||
559 | goto fail; | ||
560 | |||
561 | diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c | ||
562 | index 007ec6e4a5d42..5abc27f12a418 100644 | ||
563 | --- a/drivers/usb/gadget/function/f_eem.c | ||
564 | +++ b/drivers/usb/gadget/function/f_eem.c | ||
565 | @@ -309,7 +309,7 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f) | ||
566 | eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress; | ||
567 | |||
568 | status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function, | ||
569 | - eem_ss_function, NULL); | ||
570 | + eem_ss_function, eem_ss_function); | ||
571 | if (status) | ||
572 | goto fail; | ||
573 | |||
574 | @@ -502,7 +502,7 @@ static int eem_unwrap(struct gether *port, | ||
575 | skb2 = skb_clone(skb, GFP_ATOMIC); | ||
576 | if (unlikely(!skb2)) { | ||
577 | DBG(cdev, "unable to unframe EEM packet\n"); | ||
578 | - continue; | ||
579 | + goto next; | ||
580 | } | ||
581 | skb_trim(skb2, len - ETH_FCS_LEN); | ||
582 | |||
583 | @@ -513,7 +513,7 @@ static int eem_unwrap(struct gether *port, | ||
584 | if (unlikely(!skb3)) { | ||
585 | DBG(cdev, "unable to realign EEM packet\n"); | ||
586 | dev_kfree_skb_any(skb2); | ||
587 | - continue; | ||
588 | + goto next; | ||
589 | } | ||
590 | dev_kfree_skb_any(skb2); | ||
591 | skb_queue_tail(list, skb3); | ||
592 | diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c | ||
593 | index e70093835e14a..8c1810d655983 100644 | ||
594 | --- a/drivers/usb/gadget/function/f_loopback.c | ||
595 | +++ b/drivers/usb/gadget/function/f_loopback.c | ||
596 | @@ -211,7 +211,7 @@ autoconf_fail: | ||
597 | ss_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress; | ||
598 | |||
599 | ret = usb_assign_descriptors(f, fs_loopback_descs, hs_loopback_descs, | ||
600 | - ss_loopback_descs, NULL); | ||
601 | + ss_loopback_descs, ss_loopback_descs); | ||
602 | if (ret) | ||
603 | return ret; | ||
604 | |||
605 | diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c | ||
606 | index 4395ea07c1bb4..8300ca14b2a58 100644 | ||
607 | --- a/drivers/usb/gadget/function/f_ncm.c | ||
608 | +++ b/drivers/usb/gadget/function/f_ncm.c | ||
609 | @@ -588,7 +588,7 @@ static void ncm_do_notify(struct f_ncm *ncm) | ||
610 | data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); | ||
611 | data[1] = data[0]; | ||
612 | |||
613 | - DBG(cdev, "notify speed %d\n", ncm_bitrate(cdev->gadget)); | ||
614 | + DBG(cdev, "notify speed %u\n", ncm_bitrate(cdev->gadget)); | ||
615 | ncm->notify_state = NCM_NOTIFY_CONNECT; | ||
616 | break; | ||
617 | } | ||
618 | diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c | ||
619 | index b3d036d06553c..c347fe13d45dd 100644 | ||
620 | --- a/drivers/usb/gadget/function/f_printer.c | ||
621 | +++ b/drivers/usb/gadget/function/f_printer.c | ||
622 | @@ -1057,7 +1057,8 @@ autoconf_fail: | ||
623 | ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress; | ||
624 | |||
625 | ret = usb_assign_descriptors(f, fs_printer_function, | ||
626 | - hs_printer_function, ss_printer_function, NULL); | ||
627 | + hs_printer_function, ss_printer_function, | ||
628 | + ss_printer_function); | ||
629 | if (ret) | ||
630 | return ret; | ||
631 | |||
632 | diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c | ||
633 | index 2f310973155a5..d48b14a3dfa62 100644 | ||
634 | --- a/drivers/usb/gadget/function/f_rndis.c | ||
635 | +++ b/drivers/usb/gadget/function/f_rndis.c | ||
636 | @@ -789,7 +789,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) | ||
637 | ss_notify_desc.bEndpointAddress = fs_notify_desc.bEndpointAddress; | ||
638 | |||
639 | status = usb_assign_descriptors(f, eth_fs_function, eth_hs_function, | ||
640 | - eth_ss_function, NULL); | ||
641 | + eth_ss_function, eth_ss_function); | ||
642 | if (status) | ||
643 | goto fail; | ||
644 | |||
645 | diff --git a/drivers/usb/gadget/function/f_serial.c b/drivers/usb/gadget/function/f_serial.c | ||
646 | index cb00ada21d9c2..e1efb69c80bad 100644 | ||
647 | --- a/drivers/usb/gadget/function/f_serial.c | ||
648 | +++ b/drivers/usb/gadget/function/f_serial.c | ||
649 | @@ -236,7 +236,7 @@ static int gser_bind(struct usb_configuration *c, struct usb_function *f) | ||
650 | gser_ss_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress; | ||
651 | |||
652 | status = usb_assign_descriptors(f, gser_fs_function, gser_hs_function, | ||
653 | - gser_ss_function, NULL); | ||
654 | + gser_ss_function, gser_ss_function); | ||
655 | if (status) | ||
656 | goto fail; | ||
657 | dev_dbg(&cdev->gadget->dev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n", | ||
658 | diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c | ||
659 | index 6e9d958004a0d..1c5745f7abea1 100644 | ||
660 | --- a/drivers/usb/gadget/function/f_sourcesink.c | ||
661 | +++ b/drivers/usb/gadget/function/f_sourcesink.c | ||
662 | @@ -435,7 +435,8 @@ no_iso: | ||
663 | ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress; | ||
664 | |||
665 | ret = usb_assign_descriptors(f, fs_source_sink_descs, | ||
666 | - hs_source_sink_descs, ss_source_sink_descs, NULL); | ||
667 | + hs_source_sink_descs, ss_source_sink_descs, | ||
668 | + ss_source_sink_descs); | ||
669 | if (ret) | ||
670 | return ret; | ||
671 | |||
672 | diff --git a/drivers/usb/gadget/function/f_subset.c b/drivers/usb/gadget/function/f_subset.c | ||
673 | index 434b983f3b4c2..055bd0706cdd0 100644 | ||
674 | --- a/drivers/usb/gadget/function/f_subset.c | ||
675 | +++ b/drivers/usb/gadget/function/f_subset.c | ||
676 | @@ -362,7 +362,7 @@ geth_bind(struct usb_configuration *c, struct usb_function *f) | ||
677 | fs_subset_out_desc.bEndpointAddress; | ||
678 | |||
679 | status = usb_assign_descriptors(f, fs_eth_function, hs_eth_function, | ||
680 | - ss_eth_function, NULL); | ||
681 | + ss_eth_function, ss_eth_function); | ||
682 | if (status) | ||
683 | goto fail; | ||
684 | |||
685 | diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c | ||
686 | index 7e8e262b36297..821f470c6a2f9 100644 | ||
687 | --- a/drivers/usb/gadget/function/f_tcm.c | ||
688 | +++ b/drivers/usb/gadget/function/f_tcm.c | ||
689 | @@ -2071,7 +2071,8 @@ static int tcm_bind(struct usb_configuration *c, struct usb_function *f) | ||
690 | uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress; | ||
691 | |||
692 | ret = usb_assign_descriptors(f, uasp_fs_function_desc, | ||
693 | - uasp_hs_function_desc, uasp_ss_function_desc, NULL); | ||
694 | + uasp_hs_function_desc, uasp_ss_function_desc, | ||
695 | + uasp_ss_function_desc); | ||
696 | if (ret) | ||
697 | goto ep_fail; | ||
698 | |||
699 | diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c | ||
700 | index 276e9790442d9..8f4bd9fa82449 100644 | ||
701 | --- a/drivers/usb/serial/ftdi_sio.c | ||
702 | +++ b/drivers/usb/serial/ftdi_sio.c | ||
703 | @@ -606,6 +606,7 @@ static const struct usb_device_id id_table_combined[] = { | ||
704 | .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, | ||
705 | { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, | ||
706 | { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, | ||
707 | + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) }, | ||
708 | { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, | ||
709 | { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, | ||
710 | { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, | ||
711 | diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h | ||
712 | index b5f28a7952282..54ded2bc9eb6c 100644 | ||
713 | --- a/drivers/usb/serial/ftdi_sio_ids.h | ||
714 | +++ b/drivers/usb/serial/ftdi_sio_ids.h | ||
715 | @@ -580,6 +580,7 @@ | ||
716 | #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ | ||
717 | #define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */ | ||
718 | #define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */ | ||
719 | +#define FTDI_NT_ORIONMX_PID 0x7c93 /* OrionMX */ | ||
720 | |||
721 | /* | ||
722 | * Synapse Wireless product ids (FTDI_VID) | ||
723 | diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c | ||
724 | index 76564b3bebb9b..cc0bf59bd08db 100644 | ||
725 | --- a/drivers/usb/serial/omninet.c | ||
726 | +++ b/drivers/usb/serial/omninet.c | ||
727 | @@ -27,6 +27,7 @@ | ||
728 | |||
729 | #define ZYXEL_VENDOR_ID 0x0586 | ||
730 | #define ZYXEL_OMNINET_ID 0x1000 | ||
731 | +#define ZYXEL_OMNI_56K_PLUS_ID 0x1500 | ||
732 | /* This one seems to be a re-branded ZyXEL device */ | ||
733 | #define BT_IGNITIONPRO_ID 0x2000 | ||
734 | |||
735 | @@ -44,6 +45,7 @@ static int omninet_port_remove(struct usb_serial_port *port); | ||
736 | |||
737 | static const struct usb_device_id id_table[] = { | ||
738 | { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNINET_ID) }, | ||
739 | + { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNI_56K_PLUS_ID) }, | ||
740 | { USB_DEVICE(ZYXEL_VENDOR_ID, BT_IGNITIONPRO_ID) }, | ||
741 | { } /* Terminating entry */ | ||
742 | }; | ||
743 | diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c | ||
744 | index 19952ccd028a9..ba69acaa7a30f 100644 | ||
745 | --- a/drivers/usb/serial/quatech2.c | ||
746 | +++ b/drivers/usb/serial/quatech2.c | ||
747 | @@ -419,7 +419,7 @@ static void qt2_close(struct usb_serial_port *port) | ||
748 | |||
749 | /* flush the port transmit buffer */ | ||
750 | i = usb_control_msg(serial->dev, | ||
751 | - usb_rcvctrlpipe(serial->dev, 0), | ||
752 | + usb_sndctrlpipe(serial->dev, 0), | ||
753 | QT2_FLUSH_DEVICE, 0x40, 1, | ||
754 | port_priv->device_port, NULL, 0, QT2_USB_TIMEOUT); | ||
755 | |||
756 | @@ -429,7 +429,7 @@ static void qt2_close(struct usb_serial_port *port) | ||
757 | |||
758 | /* flush the port receive buffer */ | ||
759 | i = usb_control_msg(serial->dev, | ||
760 | - usb_rcvctrlpipe(serial->dev, 0), | ||
761 | + usb_sndctrlpipe(serial->dev, 0), | ||
762 | QT2_FLUSH_DEVICE, 0x40, 0, | ||
763 | port_priv->device_port, NULL, 0, QT2_USB_TIMEOUT); | ||
764 | |||
765 | @@ -701,7 +701,7 @@ static int qt2_attach(struct usb_serial *serial) | ||
766 | int status; | ||
767 | |||
768 | /* power on unit */ | ||
769 | - status = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), | ||
770 | + status = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), | ||
771 | 0xc2, 0x40, 0x8000, 0, NULL, 0, | ||
772 | QT2_USB_TIMEOUT); | ||
773 | if (status < 0) { | ||
774 | diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c | ||
775 | index 03661b744eaf0..79454ea77153d 100644 | ||
776 | --- a/fs/btrfs/file.c | ||
777 | +++ b/fs/btrfs/file.c | ||
778 | @@ -1089,7 +1089,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans, | ||
779 | int del_nr = 0; | ||
780 | int del_slot = 0; | ||
781 | int recow; | ||
782 | - int ret; | ||
783 | + int ret = 0; | ||
784 | u64 ino = btrfs_ino(inode); | ||
785 | |||
786 | path = btrfs_alloc_path(); | ||
787 | @@ -1309,7 +1309,7 @@ again: | ||
788 | } | ||
789 | out: | ||
790 | btrfs_free_path(path); | ||
791 | - return 0; | ||
792 | + return ret; | ||
793 | } | ||
794 | |||
795 | /* | ||
796 | diff --git a/fs/nfs/client.c b/fs/nfs/client.c | ||
797 | index 28d8a57a9908c..d322ed5cbc1ca 100644 | ||
798 | --- a/fs/nfs/client.c | ||
799 | +++ b/fs/nfs/client.c | ||
800 | @@ -379,7 +379,7 @@ nfs_get_client(const struct nfs_client_initdata *cl_init, | ||
801 | |||
802 | if (cl_init->hostname == NULL) { | ||
803 | WARN_ON(1); | ||
804 | - return NULL; | ||
805 | + return ERR_PTR(-EINVAL); | ||
806 | } | ||
807 | |||
808 | dprintk("--> nfs_get_client(%s,v%u)\n", | ||
809 | diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c | ||
810 | index 94130588ebf52..2ea772f596e3c 100644 | ||
811 | --- a/fs/nfs/nfs4proc.c | ||
812 | +++ b/fs/nfs/nfs4proc.c | ||
813 | @@ -5183,6 +5183,14 @@ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen | ||
814 | do { | ||
815 | err = __nfs4_proc_set_acl(inode, buf, buflen); | ||
816 | trace_nfs4_set_acl(inode, err); | ||
817 | + if (err == -NFS4ERR_BADOWNER || err == -NFS4ERR_BADNAME) { | ||
818 | + /* | ||
819 | + * no need to retry since the kernel | ||
820 | + * isn't involved in encoding the ACEs. | ||
821 | + */ | ||
822 | + err = -EINVAL; | ||
823 | + break; | ||
824 | + } | ||
825 | err = nfs4_handle_exception(NFS_SERVER(inode), err, | ||
826 | &exception); | ||
827 | } while (exception.retry); | ||
828 | diff --git a/fs/proc/base.c b/fs/proc/base.c | ||
829 | index 294fb8ee2ff46..0368ff9335cb5 100644 | ||
830 | --- a/fs/proc/base.c | ||
831 | +++ b/fs/proc/base.c | ||
832 | @@ -2493,6 +2493,13 @@ out: | ||
833 | } | ||
834 | |||
835 | #ifdef CONFIG_SECURITY | ||
836 | +static int proc_pid_attr_open(struct inode *inode, struct file *file) | ||
837 | +{ | ||
838 | + file->private_data = NULL; | ||
839 | + __mem_open(inode, file, PTRACE_MODE_READ_FSCREDS); | ||
840 | + return 0; | ||
841 | +} | ||
842 | + | ||
843 | static ssize_t proc_pid_attr_read(struct file * file, char __user * buf, | ||
844 | size_t count, loff_t *ppos) | ||
845 | { | ||
846 | @@ -2523,7 +2530,7 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, | ||
847 | struct task_struct *task = get_proc_task(inode); | ||
848 | |||
849 | /* A task may only write when it was the opener. */ | ||
850 | - if (file->f_cred != current_real_cred()) | ||
851 | + if (file->private_data != current->mm) | ||
852 | return -EPERM; | ||
853 | |||
854 | length = -ESRCH; | ||
855 | @@ -2561,9 +2568,11 @@ out_no_task: | ||
856 | } | ||
857 | |||
858 | static const struct file_operations proc_pid_attr_operations = { | ||
859 | + .open = proc_pid_attr_open, | ||
860 | .read = proc_pid_attr_read, | ||
861 | .write = proc_pid_attr_write, | ||
862 | .llseek = generic_file_llseek, | ||
863 | + .release = mem_release, | ||
864 | }; | ||
865 | |||
866 | static const struct pid_entry attr_dir_stuff[] = { | ||
867 | diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h | ||
868 | index bb4af1bfcaf43..05aa860daa5cd 100644 | ||
869 | --- a/include/linux/kvm_host.h | ||
870 | +++ b/include/linux/kvm_host.h | ||
871 | @@ -26,6 +26,7 @@ | ||
872 | #include <linux/context_tracking.h> | ||
873 | #include <linux/irqbypass.h> | ||
874 | #include <linux/swait.h> | ||
875 | +#include <linux/nospec.h> | ||
876 | #include <asm/signal.h> | ||
877 | |||
878 | #include <linux/kvm.h> | ||
879 | @@ -932,7 +933,15 @@ __gfn_to_memslot(struct kvm_memslots *slots, gfn_t gfn) | ||
880 | static inline unsigned long | ||
881 | __gfn_to_hva_memslot(struct kvm_memory_slot *slot, gfn_t gfn) | ||
882 | { | ||
883 | - return slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE; | ||
884 | + /* | ||
885 | + * The index was checked originally in search_memslots. To avoid | ||
886 | + * that a malicious guest builds a Spectre gadget out of e.g. page | ||
887 | + * table walks, do not let the processor speculate loads outside | ||
888 | + * the guest's registered memslots. | ||
889 | + */ | ||
890 | + unsigned long offset = gfn - slot->base_gfn; | ||
891 | + offset = array_index_nospec(offset, slot->npages); | ||
892 | + return slot->userspace_addr + offset * PAGE_SIZE; | ||
893 | } | ||
894 | |||
895 | static inline int memslot_id(struct kvm *kvm, gfn_t gfn) | ||
896 | diff --git a/kernel/cgroup.c b/kernel/cgroup.c | ||
897 | index 684d02f343b4c..3378c44e147e6 100644 | ||
898 | --- a/kernel/cgroup.c | ||
899 | +++ b/kernel/cgroup.c | ||
900 | @@ -3598,6 +3598,10 @@ static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent, | ||
901 | struct cgroup *cgrp = kn->priv; | ||
902 | int ret; | ||
903 | |||
904 | + /* do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable */ | ||
905 | + if (strchr(new_name_str, '\n')) | ||
906 | + return -EINVAL; | ||
907 | + | ||
908 | if (kernfs_type(kn) != KERNFS_DIR) | ||
909 | return -ENOTDIR; | ||
910 | if (kn->parent != new_parent) | ||
911 | @@ -5636,8 +5640,6 @@ int __init cgroup_init_early(void) | ||
912 | return 0; | ||
913 | } | ||
914 | |||
915 | -static u16 cgroup_disable_mask __initdata; | ||
916 | - | ||
917 | /** | ||
918 | * cgroup_init - cgroup initialization | ||
919 | * | ||
920 | @@ -5695,12 +5697,8 @@ int __init cgroup_init(void) | ||
921 | * disabled flag and cftype registration needs kmalloc, | ||
922 | * both of which aren't available during early_init. | ||
923 | */ | ||
924 | - if (cgroup_disable_mask & (1 << ssid)) { | ||
925 | - static_branch_disable(cgroup_subsys_enabled_key[ssid]); | ||
926 | - printk(KERN_INFO "Disabling %s control group subsystem\n", | ||
927 | - ss->name); | ||
928 | + if (!cgroup_ssid_enabled(ssid)) | ||
929 | continue; | ||
930 | - } | ||
931 | |||
932 | if (cgroup_ssid_no_v1(ssid)) | ||
933 | printk(KERN_INFO "Disabling %s control group subsystem in v1 mounts\n", | ||
934 | @@ -6143,7 +6141,10 @@ static int __init cgroup_disable(char *str) | ||
935 | if (strcmp(token, ss->name) && | ||
936 | strcmp(token, ss->legacy_name)) | ||
937 | continue; | ||
938 | - cgroup_disable_mask |= 1 << i; | ||
939 | + | ||
940 | + static_branch_disable(cgroup_subsys_enabled_key[i]); | ||
941 | + pr_info("Disabling %s control group subsystem\n", | ||
942 | + ss->name); | ||
943 | } | ||
944 | } | ||
945 | return 1; | ||
946 | diff --git a/kernel/events/core.c b/kernel/events/core.c | ||
947 | index 9d4a71deac992..7615a97a3511d 100644 | ||
948 | --- a/kernel/events/core.c | ||
949 | +++ b/kernel/events/core.c | ||
950 | @@ -3782,7 +3782,9 @@ find_get_context(struct pmu *pmu, struct task_struct *task, | ||
951 | cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu); | ||
952 | ctx = &cpuctx->ctx; | ||
953 | get_ctx(ctx); | ||
954 | + raw_spin_lock_irqsave(&ctx->lock, flags); | ||
955 | ++ctx->pin_count; | ||
956 | + raw_spin_unlock_irqrestore(&ctx->lock, flags); | ||
957 | |||
958 | return ctx; | ||
959 | } | ||
960 | diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c | ||
961 | index a6851f8b9b245..84f2caf6a6991 100644 | ||
962 | --- a/kernel/trace/ftrace.c | ||
963 | +++ b/kernel/trace/ftrace.c | ||
964 | @@ -1961,12 +1961,18 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, | ||
965 | |||
966 | static void print_ip_ins(const char *fmt, const unsigned char *p) | ||
967 | { | ||
968 | + char ins[MCOUNT_INSN_SIZE]; | ||
969 | int i; | ||
970 | |||
971 | + if (probe_kernel_read(ins, p, MCOUNT_INSN_SIZE)) { | ||
972 | + printk(KERN_CONT "%s[FAULT] %px\n", fmt, p); | ||
973 | + return; | ||
974 | + } | ||
975 | + | ||
976 | printk(KERN_CONT "%s", fmt); | ||
977 | |||
978 | for (i = 0; i < MCOUNT_INSN_SIZE; i++) | ||
979 | - printk(KERN_CONT "%s%02x", i ? ":" : "", p[i]); | ||
980 | + printk(KERN_CONT "%s%02x", i ? ":" : "", ins[i]); | ||
981 | } | ||
982 | |||
983 | enum ftrace_bug_type ftrace_bug_type; | ||
984 | diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c | ||
985 | index 55b7b4cf0080d..cdf614943aa3d 100644 | ||
986 | --- a/kernel/trace/trace.c | ||
987 | +++ b/kernel/trace/trace.c | ||
988 | @@ -2083,7 +2083,7 @@ trace_event_buffer_lock_reserve(struct ring_buffer **current_rb, | ||
989 | (entry = this_cpu_read(trace_buffered_event))) { | ||
990 | /* Try to use the per cpu buffer first */ | ||
991 | val = this_cpu_inc_return(trace_buffered_event_cnt); | ||
992 | - if ((len < (PAGE_SIZE - sizeof(*entry))) && val == 1) { | ||
993 | + if ((len < (PAGE_SIZE - sizeof(*entry) - sizeof(entry->array[0]))) && val == 1) { | ||
994 | trace_event_setup(entry, type, flags, pc); | ||
995 | entry->array[0] = len; | ||
996 | return entry; | ||
997 | diff --git a/kernel/workqueue.c b/kernel/workqueue.c | ||
998 | index 3231088afd73d..a410d5827a73f 100644 | ||
999 | --- a/kernel/workqueue.c | ||
1000 | +++ b/kernel/workqueue.c | ||
1001 | @@ -49,6 +49,7 @@ | ||
1002 | #include <linux/moduleparam.h> | ||
1003 | #include <linux/uaccess.h> | ||
1004 | #include <linux/nmi.h> | ||
1005 | +#include <linux/kvm_para.h> | ||
1006 | |||
1007 | #include "workqueue_internal.h" | ||
1008 | |||
1009 | @@ -5387,6 +5388,7 @@ static void wq_watchdog_timer_fn(unsigned long data) | ||
1010 | { | ||
1011 | unsigned long thresh = READ_ONCE(wq_watchdog_thresh) * HZ; | ||
1012 | bool lockup_detected = false; | ||
1013 | + unsigned long now = jiffies; | ||
1014 | struct worker_pool *pool; | ||
1015 | int pi; | ||
1016 | |||
1017 | @@ -5401,6 +5403,12 @@ static void wq_watchdog_timer_fn(unsigned long data) | ||
1018 | if (list_empty(&pool->worklist)) | ||
1019 | continue; | ||
1020 | |||
1021 | + /* | ||
1022 | + * If a virtual machine is stopped by the host it can look to | ||
1023 | + * the watchdog like a stall. | ||
1024 | + */ | ||
1025 | + kvm_check_and_clear_guest_paused(); | ||
1026 | + | ||
1027 | /* get the latest of pool and touched timestamps */ | ||
1028 | pool_ts = READ_ONCE(pool->watchdog_ts); | ||
1029 | touched = READ_ONCE(wq_watchdog_touched); | ||
1030 | @@ -5419,12 +5427,12 @@ static void wq_watchdog_timer_fn(unsigned long data) | ||
1031 | } | ||
1032 | |||
1033 | /* did we stall? */ | ||
1034 | - if (time_after(jiffies, ts + thresh)) { | ||
1035 | + if (time_after(now, ts + thresh)) { | ||
1036 | lockup_detected = true; | ||
1037 | pr_emerg("BUG: workqueue lockup - pool"); | ||
1038 | pr_cont_pool_info(pool); | ||
1039 | pr_cont(" stuck for %us!\n", | ||
1040 | - jiffies_to_msecs(jiffies - pool_ts) / 1000); | ||
1041 | + jiffies_to_msecs(now - pool_ts) / 1000); | ||
1042 | } | ||
1043 | } | ||
1044 | |||
1045 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c | ||
1046 | index 205865292ba34..541410f1c3b74 100644 | ||
1047 | --- a/net/netlink/af_netlink.c | ||
1048 | +++ b/net/netlink/af_netlink.c | ||
1049 | @@ -436,11 +436,13 @@ void netlink_table_ungrab(void) | ||
1050 | static inline void | ||
1051 | netlink_lock_table(void) | ||
1052 | { | ||
1053 | + unsigned long flags; | ||
1054 | + | ||
1055 | /* read_lock() synchronizes us to netlink_table_grab */ | ||
1056 | |||
1057 | - read_lock(&nl_table_lock); | ||
1058 | + read_lock_irqsave(&nl_table_lock, flags); | ||
1059 | atomic_inc(&nl_table_users); | ||
1060 | - read_unlock(&nl_table_lock); | ||
1061 | + read_unlock_irqrestore(&nl_table_lock, flags); | ||
1062 | } | ||
1063 | |||
1064 | static inline void | ||
1065 | diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c | ||
1066 | index 92a3cfae4de87..2fba626a01253 100644 | ||
1067 | --- a/net/nfc/rawsock.c | ||
1068 | +++ b/net/nfc/rawsock.c | ||
1069 | @@ -345,7 +345,7 @@ static int rawsock_create(struct net *net, struct socket *sock, | ||
1070 | return -ESOCKTNOSUPPORT; | ||
1071 | |||
1072 | if (sock->type == SOCK_RAW) { | ||
1073 | - if (!capable(CAP_NET_RAW)) | ||
1074 | + if (!ns_capable(net->user_ns, CAP_NET_RAW)) | ||
1075 | return -EPERM; | ||
1076 | sock->ops = &rawsock_raw_ops; | ||
1077 | } else { | ||
1078 | diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c | ||
1079 | index d6e00c77edcd7..7cf76661c3cc9 100644 | ||
1080 | --- a/sound/soc/codecs/sti-sas.c | ||
1081 | +++ b/sound/soc/codecs/sti-sas.c | ||
1082 | @@ -542,6 +542,7 @@ static const struct of_device_id sti_sas_dev_match[] = { | ||
1083 | }, | ||
1084 | {}, | ||
1085 | }; | ||
1086 | +MODULE_DEVICE_TABLE(of, sti_sas_dev_match); | ||
1087 | |||
1088 | static int sti_sas_driver_probe(struct platform_device *pdev) | ||
1089 | { | ||
1090 | diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c | ||
1091 | index 89808ab008ad2..9187d8119a75c 100644 | ||
1092 | --- a/tools/perf/util/session.c | ||
1093 | +++ b/tools/perf/util/session.c | ||
1094 | @@ -1427,6 +1427,7 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset, | ||
1095 | if (event->header.size < hdr_sz || event->header.size > buf_sz) | ||
1096 | return -1; | ||
1097 | |||
1098 | + buf += hdr_sz; | ||
1099 | rest = event->header.size - hdr_sz; | ||
1100 | |||
1101 | if (readn(fd, buf, rest) != (ssize_t)rest) |