Contents of /trunk/kernel-alx-legacy/patches-4.9/0401-4.9.302-all-fixes.patch
Parent Directory | Revision Log
Revision 3703 -
(show annotations)
(download)
Mon Oct 24 14:08:16 2022 UTC (19 months, 3 weeks ago) by niro
File size: 28739 byte(s)
Mon Oct 24 14:08:16 2022 UTC (19 months, 3 weeks ago) by niro
File size: 28739 byte(s)
-linux-4.9.302
1 | diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt |
2 | index ffab8b5caa603..30ba179392d81 100644 |
3 | --- a/Documentation/sysctl/kernel.txt |
4 | +++ b/Documentation/sysctl/kernel.txt |
5 | @@ -90,6 +90,7 @@ show up in /proc/sys/kernel: |
6 | - sysctl_writes_strict |
7 | - tainted |
8 | - threads-max |
9 | +- unprivileged_bpf_disabled |
10 | - unknown_nmi_panic |
11 | - watchdog |
12 | - watchdog_thresh |
13 | @@ -995,6 +996,26 @@ available RAM pages threads-max is reduced accordingly. |
14 | |
15 | ============================================================== |
16 | |
17 | +unprivileged_bpf_disabled: |
18 | + |
19 | +Writing 1 to this entry will disable unprivileged calls to bpf(); |
20 | +once disabled, calling bpf() without CAP_SYS_ADMIN will return |
21 | +-EPERM. Once set to 1, this can't be cleared from the running kernel |
22 | +anymore. |
23 | + |
24 | +Writing 2 to this entry will also disable unprivileged calls to bpf(), |
25 | +however, an admin can still change this setting later on, if needed, by |
26 | +writing 0 or 1 to this entry. |
27 | + |
28 | +If BPF_UNPRIV_DEFAULT_OFF is enabled in the kernel config, then this |
29 | +entry will default to 2 instead of 0. |
30 | + |
31 | + 0 - Unprivileged calls to bpf() are enabled |
32 | + 1 - Unprivileged calls to bpf() are disabled without recovery |
33 | + 2 - Unprivileged calls to bpf() are disabled |
34 | + |
35 | +============================================================== |
36 | + |
37 | unknown_nmi_panic: |
38 | |
39 | The value in this file affects behavior of handling NMI. When the |
40 | diff --git a/Makefile b/Makefile |
41 | index 776408b6c56e7..d2a09d4a37082 100644 |
42 | --- a/Makefile |
43 | +++ b/Makefile |
44 | @@ -1,6 +1,6 @@ |
45 | VERSION = 4 |
46 | PATCHLEVEL = 9 |
47 | -SUBLEVEL = 301 |
48 | +SUBLEVEL = 302 |
49 | EXTRAVERSION = |
50 | NAME = Roaring Lionus |
51 | |
52 | diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts |
53 | index 57e29977ba06c..acaa3a7c2fc65 100644 |
54 | --- a/arch/arm/boot/dts/imx23-evk.dts |
55 | +++ b/arch/arm/boot/dts/imx23-evk.dts |
56 | @@ -48,7 +48,6 @@ |
57 | MX23_PAD_LCD_RESET__GPIO_1_18 |
58 | MX23_PAD_PWM3__GPIO_1_29 |
59 | MX23_PAD_PWM4__GPIO_1_30 |
60 | - MX23_PAD_SSP1_DETECT__SSP1_DETECT |
61 | >; |
62 | fsl,drive-strength = <MXS_DRIVE_4mA>; |
63 | fsl,voltage = <MXS_VOLTAGE_HIGH>; |
64 | diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi |
65 | index fc4ae2e423bd7..b0fdcae66ead3 100644 |
66 | --- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi |
67 | +++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi |
68 | @@ -9,6 +9,8 @@ |
69 | * |
70 | */ |
71 | |
72 | +#include <dt-bindings/gpio/gpio.h> |
73 | + |
74 | / { |
75 | aliases { |
76 | backlight = &backlight; |
77 | @@ -201,6 +203,7 @@ |
78 | MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059 |
79 | MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059 |
80 | MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059 |
81 | + MX6QDL_PAD_SD3_DAT5__GPIO7_IO00 0x1b0b0 |
82 | >; |
83 | }; |
84 | |
85 | @@ -267,7 +270,7 @@ |
86 | &usdhc3 { |
87 | pinctrl-names = "default"; |
88 | pinctrl-0 = <&pinctrl_usdhc3>; |
89 | - non-removable; |
90 | + cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; |
91 | status = "okay"; |
92 | }; |
93 | |
94 | diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig |
95 | index da9813f09d7d7..2b5ae00f8df25 100644 |
96 | --- a/drivers/hid/Kconfig |
97 | +++ b/drivers/hid/Kconfig |
98 | @@ -865,7 +865,7 @@ config THRUSTMASTER_FF |
99 | |
100 | config HID_WACOM |
101 | tristate "Wacom Intuos/Graphire tablet support (USB)" |
102 | - depends on HID |
103 | + depends on USB_HID |
104 | select POWER_SUPPLY |
105 | select NEW_LEDS |
106 | select LEDS_CLASS |
107 | diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c |
108 | index d19ad92eede95..b7d7f40885689 100644 |
109 | --- a/drivers/hwmon/dell-smm-hwmon.c |
110 | +++ b/drivers/hwmon/dell-smm-hwmon.c |
111 | @@ -294,7 +294,7 @@ static int i8k_get_fan_nominal_speed(int fan, int speed) |
112 | } |
113 | |
114 | /* |
115 | - * Set the fan speed (off, low, high). Returns the new fan status. |
116 | + * Set the fan speed (off, low, high, ...). |
117 | */ |
118 | static int i8k_set_fan(int fan, int speed) |
119 | { |
120 | @@ -303,7 +303,7 @@ static int i8k_set_fan(int fan, int speed) |
121 | speed = (speed < 0) ? 0 : ((speed > i8k_fan_max) ? i8k_fan_max : speed); |
122 | regs.ebx = (fan & 0xff) | (speed << 8); |
123 | |
124 | - return i8k_smm(®s) ? : i8k_get_fan_status(fan); |
125 | + return i8k_smm(®s); |
126 | } |
127 | |
128 | static int i8k_get_temp_type(int sensor) |
129 | @@ -417,7 +417,7 @@ static int |
130 | i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg) |
131 | { |
132 | int val = 0; |
133 | - int speed; |
134 | + int speed, err; |
135 | unsigned char buff[16]; |
136 | int __user *argp = (int __user *)arg; |
137 | |
138 | @@ -478,7 +478,11 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg) |
139 | if (copy_from_user(&speed, argp + 1, sizeof(int))) |
140 | return -EFAULT; |
141 | |
142 | - val = i8k_set_fan(val, speed); |
143 | + err = i8k_set_fan(val, speed); |
144 | + if (err < 0) |
145 | + return err; |
146 | + |
147 | + val = i8k_get_fan_status(val); |
148 | break; |
149 | |
150 | default: |
151 | diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h |
152 | index 323b86b38b3a3..6cd2ae95e21ed 100644 |
153 | --- a/drivers/input/serio/i8042-x86ia64io.h |
154 | +++ b/drivers/input/serio/i8042-x86ia64io.h |
155 | @@ -586,11 +586,6 @@ static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = { |
156 | DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), |
157 | DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"), |
158 | }, |
159 | - }, { |
160 | - .matches = { |
161 | - DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), |
162 | - DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */ |
163 | - }, |
164 | }, |
165 | { } |
166 | }; |
167 | @@ -677,6 +672,12 @@ static const struct dmi_system_id i8042_dmi_noselftest_table[] = { |
168 | DMI_MATCH(DMI_PRODUCT_NAME, "Z450LA"), |
169 | }, |
170 | }, |
171 | + { |
172 | + .matches = { |
173 | + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), |
174 | + DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */ |
175 | + }, |
176 | + }, |
177 | { } |
178 | }; |
179 | static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { |
180 | diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c |
181 | index 1e2ee97b92406..578d8e12e2d21 100644 |
182 | --- a/drivers/net/bonding/bond_3ad.c |
183 | +++ b/drivers/net/bonding/bond_3ad.c |
184 | @@ -971,8 +971,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) |
185 | if (port->aggregator && |
186 | port->aggregator->is_active && |
187 | !__port_is_enabled(port)) { |
188 | - |
189 | __enable_port(port); |
190 | + *update_slave_arr = true; |
191 | } |
192 | } |
193 | break; |
194 | @@ -1724,6 +1724,7 @@ static void ad_agg_selection_logic(struct aggregator *agg, |
195 | port = port->next_port_in_aggregator) { |
196 | __enable_port(port); |
197 | } |
198 | + *update_slave_arr = true; |
199 | } |
200 | } |
201 | |
202 | diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c |
203 | index 46998a58e3d96..467dc0c60759f 100644 |
204 | --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c |
205 | +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c |
206 | @@ -278,16 +278,6 @@ static int axienet_dma_bd_init(struct net_device *ndev) |
207 | axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET, |
208 | cr | XAXIDMA_CR_RUNSTOP_MASK); |
209 | |
210 | - /* Wait for PhyRstCmplt bit to be set, indicating the PHY reset has finished */ |
211 | - ret = read_poll_timeout(axienet_ior, value, |
212 | - value & XAE_INT_PHYRSTCMPLT_MASK, |
213 | - DELAY_OF_ONE_MILLISEC, 50000, false, lp, |
214 | - XAE_IS_OFFSET); |
215 | - if (ret) { |
216 | - dev_err(lp->dev, "%s: timeout waiting for PhyRstCmplt\n", __func__); |
217 | - return ret; |
218 | - } |
219 | - |
220 | return 0; |
221 | out: |
222 | axienet_dma_bd_release(ndev); |
223 | diff --git a/drivers/staging/fbtft/fbtft.h b/drivers/staging/fbtft/fbtft.h |
224 | index 0275319906748..a76723a4219a6 100644 |
225 | --- a/drivers/staging/fbtft/fbtft.h |
226 | +++ b/drivers/staging/fbtft/fbtft.h |
227 | @@ -343,7 +343,10 @@ static int __init fbtft_driver_module_init(void) \ |
228 | ret = spi_register_driver(&fbtft_driver_spi_driver); \ |
229 | if (ret < 0) \ |
230 | return ret; \ |
231 | - return platform_driver_register(&fbtft_driver_platform_driver); \ |
232 | + ret = platform_driver_register(&fbtft_driver_platform_driver); \ |
233 | + if (ret < 0) \ |
234 | + spi_unregister_driver(&fbtft_driver_spi_driver); \ |
235 | + return ret; \ |
236 | } \ |
237 | \ |
238 | static void __exit fbtft_driver_module_exit(void) \ |
239 | diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c |
240 | index 761b065a40bb3..b2a76ecb5789c 100644 |
241 | --- a/drivers/target/iscsi/iscsi_target_tpg.c |
242 | +++ b/drivers/target/iscsi/iscsi_target_tpg.c |
243 | @@ -452,6 +452,9 @@ static bool iscsit_tpg_check_network_portal( |
244 | break; |
245 | } |
246 | spin_unlock(&tpg->tpg_np_lock); |
247 | + |
248 | + if (match) |
249 | + break; |
250 | } |
251 | spin_unlock(&tiqn->tiqn_tpg_lock); |
252 | |
253 | diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c |
254 | index 8214b0326b3a1..690cb5a63f9a0 100644 |
255 | --- a/drivers/tty/n_tty.c |
256 | +++ b/drivers/tty/n_tty.c |
257 | @@ -1377,7 +1377,7 @@ handle_newline: |
258 | put_tty_queue(c, ldata); |
259 | smp_store_release(&ldata->canon_head, ldata->read_head); |
260 | kill_fasync(&tty->fasync, SIGIO, POLL_IN); |
261 | - wake_up_interruptible_poll(&tty->read_wait, POLLIN); |
262 | + wake_up_interruptible_poll(&tty->read_wait, POLLIN | POLLRDNORM); |
263 | return 0; |
264 | } |
265 | } |
266 | @@ -1658,7 +1658,7 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp, |
267 | |
268 | if (read_cnt(ldata)) { |
269 | kill_fasync(&tty->fasync, SIGIO, POLL_IN); |
270 | - wake_up_interruptible_poll(&tty->read_wait, POLLIN); |
271 | + wake_up_interruptible_poll(&tty->read_wait, POLLIN | POLLRDNORM); |
272 | } |
273 | } |
274 | |
275 | diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c |
276 | index b4f528d26bf1a..5c6243a31166a 100644 |
277 | --- a/drivers/tty/serial/sh-sci.c |
278 | +++ b/drivers/tty/serial/sh-sci.c |
279 | @@ -2377,6 +2377,10 @@ done: |
280 | |
281 | serial_port_out(port, SCFCR, ctrl); |
282 | } |
283 | + if (port->flags & UPF_HARD_FLOW) { |
284 | + /* Refresh (Auto) RTS */ |
285 | + sci_set_mctrl(port, port->mctrl); |
286 | + } |
287 | |
288 | scr_val |= s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0); |
289 | dev_dbg(port->dev, "SCSCR 0x%x\n", scr_val); |
290 | @@ -2391,10 +2395,6 @@ done: |
291 | */ |
292 | udelay(DIV_ROUND_UP(10 * 1000000, baud)); |
293 | } |
294 | - if (port->flags & UPF_HARD_FLOW) { |
295 | - /* Refresh (Auto) RTS */ |
296 | - sci_set_mctrl(port, port->mctrl); |
297 | - } |
298 | |
299 | #ifdef CONFIG_SERIAL_SH_SCI_DMA |
300 | /* |
301 | diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c |
302 | index e1c1627a3356b..e785a8a7f1c22 100644 |
303 | --- a/drivers/tty/vt/vt_ioctl.c |
304 | +++ b/drivers/tty/vt/vt_ioctl.c |
305 | @@ -694,6 +694,7 @@ int vt_ioctl(struct tty_struct *tty, |
306 | ret = -ENXIO; |
307 | else { |
308 | arg--; |
309 | + arg = array_index_nospec(arg, MAX_NR_CONSOLES); |
310 | console_lock(); |
311 | ret = vc_allocate(arg); |
312 | console_unlock(); |
313 | @@ -718,9 +719,9 @@ int vt_ioctl(struct tty_struct *tty, |
314 | if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) |
315 | ret = -ENXIO; |
316 | else { |
317 | - vsa.console = array_index_nospec(vsa.console, |
318 | - MAX_NR_CONSOLES + 1); |
319 | vsa.console--; |
320 | + vsa.console = array_index_nospec(vsa.console, |
321 | + MAX_NR_CONSOLES); |
322 | console_lock(); |
323 | ret = vc_allocate(vsa.console); |
324 | if (ret == 0) { |
325 | diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c |
326 | index e7ad3ae4ea6bd..65bcbbad6d545 100644 |
327 | --- a/drivers/usb/dwc2/gadget.c |
328 | +++ b/drivers/usb/dwc2/gadget.c |
329 | @@ -3979,7 +3979,7 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg) |
330 | hsotg->gadget.speed = USB_SPEED_UNKNOWN; |
331 | spin_unlock_irqrestore(&hsotg->lock, flags); |
332 | |
333 | - for (ep = 0; ep < hsotg->num_of_eps; ep++) { |
334 | + for (ep = 1; ep < hsotg->num_of_eps; ep++) { |
335 | if (hsotg->eps_in[ep]) |
336 | dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep); |
337 | if (hsotg->eps_out[ep]) |
338 | diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c |
339 | index e340ef67321e5..58c4b745eae13 100644 |
340 | --- a/drivers/usb/dwc3/gadget.c |
341 | +++ b/drivers/usb/dwc3/gadget.c |
342 | @@ -902,6 +902,19 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, |
343 | if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable) |
344 | trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(req->request.stream_id); |
345 | |
346 | + /* |
347 | + * As per data book 4.2.3.2TRB Control Bit Rules section |
348 | + * |
349 | + * The controller autonomously checks the HWO field of a TRB to determine if the |
350 | + * entire TRB is valid. Therefore, software must ensure that the rest of the TRB |
351 | + * is valid before setting the HWO field to '1'. In most systems, this means that |
352 | + * software must update the fourth DWORD of a TRB last. |
353 | + * |
354 | + * However there is a possibility of CPU re-ordering here which can cause |
355 | + * controller to observe the HWO bit set prematurely. |
356 | + * Add a write memory barrier to prevent CPU re-ordering. |
357 | + */ |
358 | + wmb(); |
359 | trb->ctrl |= DWC3_TRB_CTRL_HWO; |
360 | |
361 | trace_dwc3_prepare_trb(dep, trb); |
362 | diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c |
363 | index a7c44a3cb2d25..3b8a8e2d34848 100644 |
364 | --- a/drivers/usb/gadget/composite.c |
365 | +++ b/drivers/usb/gadget/composite.c |
366 | @@ -1932,6 +1932,9 @@ unknown: |
367 | if (w_index != 0x5 || (w_value >> 8)) |
368 | break; |
369 | interface = w_value & 0xFF; |
370 | + if (interface >= MAX_CONFIG_INTERFACES || |
371 | + !os_desc_cfg->interface[interface]) |
372 | + break; |
373 | buf[6] = w_index; |
374 | if (w_length == 0x0A) { |
375 | count = count_ext_prop(os_desc_cfg, |
376 | diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c |
377 | index ab6ac1b74ac0f..a912b6b9153fd 100644 |
378 | --- a/drivers/usb/gadget/function/rndis.c |
379 | +++ b/drivers/usb/gadget/function/rndis.c |
380 | @@ -642,14 +642,17 @@ static int rndis_set_response(struct rndis_params *params, |
381 | rndis_set_cmplt_type *resp; |
382 | rndis_resp_t *r; |
383 | |
384 | + BufLength = le32_to_cpu(buf->InformationBufferLength); |
385 | + BufOffset = le32_to_cpu(buf->InformationBufferOffset); |
386 | + if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || |
387 | + (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) |
388 | + return -EINVAL; |
389 | + |
390 | r = rndis_add_response(params, sizeof(rndis_set_cmplt_type)); |
391 | if (!r) |
392 | return -ENOMEM; |
393 | resp = (rndis_set_cmplt_type *)r->buf; |
394 | |
395 | - BufLength = le32_to_cpu(buf->InformationBufferLength); |
396 | - BufOffset = le32_to_cpu(buf->InformationBufferOffset); |
397 | - |
398 | #ifdef VERBOSE_DEBUG |
399 | pr_debug("%s: Length: %d\n", __func__, BufLength); |
400 | pr_debug("%s: Offset: %d\n", __func__, BufOffset); |
401 | diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c |
402 | index c6ff79360302f..a8573da2717a1 100644 |
403 | --- a/drivers/usb/serial/ch341.c |
404 | +++ b/drivers/usb/serial/ch341.c |
405 | @@ -74,6 +74,7 @@ static const struct usb_device_id id_table[] = { |
406 | { USB_DEVICE(0x1a86, 0x5523) }, |
407 | { USB_DEVICE(0x1a86, 0x7522) }, |
408 | { USB_DEVICE(0x1a86, 0x7523) }, |
409 | + { USB_DEVICE(0x2184, 0x0057) }, |
410 | { USB_DEVICE(0x4348, 0x5523) }, |
411 | { USB_DEVICE(0x9986, 0x7523) }, |
412 | { }, |
413 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c |
414 | index dde28ede396bf..ddee42e44a33b 100644 |
415 | --- a/drivers/usb/serial/cp210x.c |
416 | +++ b/drivers/usb/serial/cp210x.c |
417 | @@ -49,6 +49,7 @@ static int cp210x_port_remove(struct usb_serial_port *); |
418 | static void cp210x_dtr_rts(struct usb_serial_port *p, int on); |
419 | |
420 | static const struct usb_device_id id_table[] = { |
421 | + { USB_DEVICE(0x0404, 0x034C) }, /* NCR Retail IO Box */ |
422 | { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */ |
423 | { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */ |
424 | { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ |
425 | @@ -66,6 +67,7 @@ static const struct usb_device_id id_table[] = { |
426 | { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */ |
427 | { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */ |
428 | { USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */ |
429 | + { USB_DEVICE(0x106F, 0x0003) }, /* CPI / Money Controls Bulk Coin Recycler */ |
430 | { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */ |
431 | { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */ |
432 | { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */ |
433 | diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c |
434 | index fe6b32c2ff1cb..5c4fa4fcb1e88 100644 |
435 | --- a/drivers/usb/serial/ftdi_sio.c |
436 | +++ b/drivers/usb/serial/ftdi_sio.c |
437 | @@ -964,6 +964,7 @@ static const struct usb_device_id id_table_combined[] = { |
438 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) }, |
439 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) }, |
440 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) }, |
441 | + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_159_PID) }, |
442 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) }, |
443 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) }, |
444 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) }, |
445 | @@ -972,12 +973,14 @@ static const struct usb_device_id id_table_combined[] = { |
446 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) }, |
447 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) }, |
448 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) }, |
449 | + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_235_PID) }, |
450 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) }, |
451 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) }, |
452 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) }, |
453 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) }, |
454 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) }, |
455 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) }, |
456 | + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_320_PID) }, |
457 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) }, |
458 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) }, |
459 | { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) }, |
460 | diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h |
461 | index 3b7cea8df446c..006e92d26baba 100644 |
462 | --- a/drivers/usb/serial/ftdi_sio_ids.h |
463 | +++ b/drivers/usb/serial/ftdi_sio_ids.h |
464 | @@ -1505,6 +1505,9 @@ |
465 | #define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */ |
466 | #define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */ |
467 | #define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */ |
468 | +#define BRAINBOXES_US_159_PID 0x1021 /* US-159 1xRS232 */ |
469 | +#define BRAINBOXES_US_235_PID 0x1017 /* US-235 1xRS232 */ |
470 | +#define BRAINBOXES_US_320_PID 0x1019 /* US-320 1xRS422/485 */ |
471 | #define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */ |
472 | #define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */ |
473 | #define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */ |
474 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
475 | index 9479abb9eaaaf..4c3ff0706554f 100644 |
476 | --- a/drivers/usb/serial/option.c |
477 | +++ b/drivers/usb/serial/option.c |
478 | @@ -1625,6 +1625,8 @@ static const struct usb_device_id option_ids[] = { |
479 | .driver_info = RSVD(2) }, |
480 | { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */ |
481 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */ |
482 | + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff), /* ZTE MF286D */ |
483 | + .driver_info = RSVD(5) }, |
484 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, |
485 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, |
486 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) }, |
487 | diff --git a/fs/nfs/client.c b/fs/nfs/client.c |
488 | index d322ed5cbc1ca..6386875d0a33a 100644 |
489 | --- a/fs/nfs/client.c |
490 | +++ b/fs/nfs/client.c |
491 | @@ -179,6 +179,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init) |
492 | INIT_LIST_HEAD(&clp->cl_superblocks); |
493 | clp->cl_rpcclient = ERR_PTR(-EINVAL); |
494 | |
495 | + clp->cl_flags = cl_init->init_flags; |
496 | clp->cl_proto = cl_init->proto; |
497 | clp->cl_net = get_net(cl_init->net); |
498 | |
499 | @@ -400,7 +401,6 @@ nfs_get_client(const struct nfs_client_initdata *cl_init, |
500 | list_add_tail(&new->cl_share_link, |
501 | &nn->nfs_client_list); |
502 | spin_unlock(&nn->nfs_client_lock); |
503 | - new->cl_flags = cl_init->init_flags; |
504 | return rpc_ops->init_client(new, cl_init); |
505 | } |
506 | |
507 | diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c |
508 | index 2fb4633897084..48baa92846e5f 100644 |
509 | --- a/fs/nfs/nfs4client.c |
510 | +++ b/fs/nfs/nfs4client.c |
511 | @@ -1329,8 +1329,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname, |
512 | goto out; |
513 | } |
514 | |
515 | - if (server->nfs_client->cl_hostname == NULL) |
516 | + if (server->nfs_client->cl_hostname == NULL) { |
517 | server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL); |
518 | + if (server->nfs_client->cl_hostname == NULL) |
519 | + return -ENOMEM; |
520 | + } |
521 | nfs_server_insert_lists(server); |
522 | |
523 | error = nfs_probe_destination(server); |
524 | diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c |
525 | index 4e63daeef6339..466c07bd06295 100644 |
526 | --- a/fs/nfs/nfs4state.c |
527 | +++ b/fs/nfs/nfs4state.c |
528 | @@ -1985,6 +1985,9 @@ static int nfs4_try_migration(struct nfs_server *server, struct rpc_cred *cred) |
529 | } |
530 | |
531 | result = -NFS4ERR_NXIO; |
532 | + if (!locations->nlocations) |
533 | + goto out; |
534 | + |
535 | if (!(locations->fattr.valid & NFS_ATTR_FATTR_V4_LOCATIONS)) { |
536 | dprintk("<-- %s: No fs_locations data, migration skipped\n", |
537 | __func__); |
538 | diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c |
539 | index 0a7c4e30a385e..b50c97c6aecb3 100644 |
540 | --- a/fs/nfs/nfs4xdr.c |
541 | +++ b/fs/nfs/nfs4xdr.c |
542 | @@ -3633,8 +3633,6 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st |
543 | if (unlikely(!p)) |
544 | goto out_overflow; |
545 | n = be32_to_cpup(p); |
546 | - if (n <= 0) |
547 | - goto out_eio; |
548 | for (res->nlocations = 0; res->nlocations < n; res->nlocations++) { |
549 | u32 m; |
550 | struct nfs4_fs_location *loc; |
551 | @@ -4177,10 +4175,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, |
552 | } else |
553 | printk(KERN_WARNING "%s: label too long (%u)!\n", |
554 | __func__, len); |
555 | + if (label && label->label) |
556 | + dprintk("%s: label=%.*s, len=%d, PI=%d, LFS=%d\n", |
557 | + __func__, label->len, (char *)label->label, |
558 | + label->len, label->pi, label->lfs); |
559 | } |
560 | - if (label && label->label) |
561 | - dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__, |
562 | - (char *)label->label, label->len, label->pi, label->lfs); |
563 | return status; |
564 | |
565 | out_overflow: |
566 | diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c |
567 | index 00b472fe77c19..1bf2e1c47cbfd 100644 |
568 | --- a/fs/nfsd/nfs3proc.c |
569 | +++ b/fs/nfsd/nfs3proc.c |
570 | @@ -191,6 +191,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp, struct nfsd3_writeargs *argp, |
571 | (unsigned long long) argp->offset, |
572 | argp->stable? " stable" : ""); |
573 | |
574 | + resp->status = nfserr_fbig; |
575 | + if (argp->offset > (u64)OFFSET_MAX || |
576 | + argp->offset + argp->len > (u64)OFFSET_MAX) |
577 | + return rpc_success; |
578 | + |
579 | fh_copy(&resp->fh, &argp->fh); |
580 | resp->committed = argp->stable; |
581 | nfserr = nfsd_write(rqstp, &resp->fh, NULL, |
582 | diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c |
583 | index 66985a6a7047b..d029decd87e3d 100644 |
584 | --- a/fs/nfsd/nfs4proc.c |
585 | +++ b/fs/nfsd/nfs4proc.c |
586 | @@ -982,8 +982,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, |
587 | unsigned long cnt; |
588 | int nvecs; |
589 | |
590 | - if (write->wr_offset >= OFFSET_MAX) |
591 | - return nfserr_inval; |
592 | + if (write->wr_offset > (u64)OFFSET_MAX || |
593 | + write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX) |
594 | + return nfserr_fbig; |
595 | |
596 | status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->current_fh, |
597 | stateid, WR_STATE, &filp, NULL); |
598 | diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h |
599 | index 5a23535a5018d..6a6f1d3bf8538 100644 |
600 | --- a/include/net/dst_metadata.h |
601 | +++ b/include/net/dst_metadata.h |
602 | @@ -97,8 +97,20 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb) |
603 | |
604 | memcpy(&new_md->u.tun_info, &md_dst->u.tun_info, |
605 | sizeof(struct ip_tunnel_info) + md_size); |
606 | +#ifdef CONFIG_DST_CACHE |
607 | + /* Unclone the dst cache if there is one */ |
608 | + if (new_md->u.tun_info.dst_cache.cache) { |
609 | + int ret; |
610 | + |
611 | + ret = dst_cache_init(&new_md->u.tun_info.dst_cache, GFP_ATOMIC); |
612 | + if (ret) { |
613 | + metadata_dst_free(new_md); |
614 | + return ERR_PTR(ret); |
615 | + } |
616 | + } |
617 | +#endif |
618 | + |
619 | skb_dst_drop(skb); |
620 | - dst_hold(&new_md->dst); |
621 | skb_dst_set(skb, &new_md->dst); |
622 | return new_md; |
623 | } |
624 | diff --git a/init/Kconfig b/init/Kconfig |
625 | index 07570008e2fd9..7e09227b976fa 100644 |
626 | --- a/init/Kconfig |
627 | +++ b/init/Kconfig |
628 | @@ -1645,6 +1645,16 @@ config ADVISE_SYSCALLS |
629 | applications use these syscalls, you can disable this option to save |
630 | space. |
631 | |
632 | +config BPF_UNPRIV_DEFAULT_OFF |
633 | + bool "Disable unprivileged BPF by default" |
634 | + depends on BPF_SYSCALL |
635 | + help |
636 | + Disables unprivileged BPF by default by setting the corresponding |
637 | + /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can |
638 | + still reenable it by setting it to 0 later on, or permanently |
639 | + disable it by setting it to 1 (from which no other transition to |
640 | + 0 is possible anymore). |
641 | + |
642 | config USERFAULTFD |
643 | bool "Enable userfaultfd() system call" |
644 | select ANON_INODES |
645 | diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c |
646 | index e10314223cbfe..e30ad1be68412 100644 |
647 | --- a/kernel/bpf/syscall.c |
648 | +++ b/kernel/bpf/syscall.c |
649 | @@ -22,7 +22,8 @@ |
650 | |
651 | DEFINE_PER_CPU(int, bpf_prog_active); |
652 | |
653 | -int sysctl_unprivileged_bpf_disabled __read_mostly; |
654 | +int sysctl_unprivileged_bpf_disabled __read_mostly = |
655 | + IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0; |
656 | |
657 | static LIST_HEAD(bpf_map_types); |
658 | |
659 | diff --git a/kernel/sysctl.c b/kernel/sysctl.c |
660 | index 513e6da318c47..78b445562b81e 100644 |
661 | --- a/kernel/sysctl.c |
662 | +++ b/kernel/sysctl.c |
663 | @@ -221,6 +221,28 @@ static int sysrq_sysctl_handler(struct ctl_table *table, int write, |
664 | |
665 | #endif |
666 | |
667 | +#ifdef CONFIG_BPF_SYSCALL |
668 | +static int bpf_unpriv_handler(struct ctl_table *table, int write, |
669 | + void *buffer, size_t *lenp, loff_t *ppos) |
670 | +{ |
671 | + int ret, unpriv_enable = *(int *)table->data; |
672 | + bool locked_state = unpriv_enable == 1; |
673 | + struct ctl_table tmp = *table; |
674 | + |
675 | + if (write && !capable(CAP_SYS_ADMIN)) |
676 | + return -EPERM; |
677 | + |
678 | + tmp.data = &unpriv_enable; |
679 | + ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); |
680 | + if (write && !ret) { |
681 | + if (locked_state && unpriv_enable != 1) |
682 | + return -EPERM; |
683 | + *(int *)table->data = unpriv_enable; |
684 | + } |
685 | + return ret; |
686 | +} |
687 | +#endif |
688 | + |
689 | static struct ctl_table kern_table[]; |
690 | static struct ctl_table vm_table[]; |
691 | static struct ctl_table fs_table[]; |
692 | @@ -1202,10 +1224,9 @@ static struct ctl_table kern_table[] = { |
693 | .data = &sysctl_unprivileged_bpf_disabled, |
694 | .maxlen = sizeof(sysctl_unprivileged_bpf_disabled), |
695 | .mode = 0644, |
696 | - /* only handle a transition from default "0" to "1" */ |
697 | - .proc_handler = proc_dointvec_minmax, |
698 | - .extra1 = &one, |
699 | - .extra2 = &one, |
700 | + .proc_handler = bpf_unpriv_handler, |
701 | + .extra1 = &zero, |
702 | + .extra2 = &two, |
703 | }, |
704 | #endif |
705 | #if defined(CONFIG_TREE_RCU) || defined(CONFIG_PREEMPT_RCU) |
706 | diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c |
707 | index 354926e61f067..58c0ab8894c70 100644 |
708 | --- a/net/ipv4/ipmr.c |
709 | +++ b/net/ipv4/ipmr.c |
710 | @@ -242,7 +242,9 @@ static int __net_init ipmr_rules_init(struct net *net) |
711 | return 0; |
712 | |
713 | err2: |
714 | + rtnl_lock(); |
715 | ipmr_free_table(mrt); |
716 | + rtnl_unlock(); |
717 | err1: |
718 | fib_rules_unregister(ops); |
719 | return err; |
720 | diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c |
721 | index f38b22f54c093..3dce62ec37ed4 100644 |
722 | --- a/net/ipv6/ip6mr.c |
723 | +++ b/net/ipv6/ip6mr.c |
724 | @@ -251,7 +251,9 @@ static int __net_init ip6mr_rules_init(struct net *net) |
725 | return 0; |
726 | |
727 | err2: |
728 | + rtnl_lock(); |
729 | ip6mr_free_table(mrt); |
730 | + rtnl_unlock(); |
731 | err1: |
732 | fib_rules_unregister(ops); |
733 | return err; |
734 | diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c |
735 | index 7ebcaff8c1c4f..963f607b34999 100644 |
736 | --- a/net/tipc/name_distr.c |
737 | +++ b/net/tipc/name_distr.c |
738 | @@ -288,7 +288,7 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i, |
739 | return true; |
740 | } |
741 | } else { |
742 | - pr_warn("Unrecognized name table message received\n"); |
743 | + pr_warn_ratelimited("Unknown name table message received\n"); |
744 | } |
745 | return false; |
746 | } |
747 | diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c |
748 | index 853a7d2333b3e..51d2fef7cd677 100644 |
749 | --- a/security/integrity/ima/ima_fs.c |
750 | +++ b/security/integrity/ima/ima_fs.c |
751 | @@ -477,11 +477,11 @@ int __init ima_fs_init(void) |
752 | |
753 | return 0; |
754 | out: |
755 | + securityfs_remove(ima_policy); |
756 | securityfs_remove(violations); |
757 | securityfs_remove(runtime_measurements_count); |
758 | securityfs_remove(ascii_runtime_measurements); |
759 | securityfs_remove(binary_runtime_measurements); |
760 | securityfs_remove(ima_dir); |
761 | - securityfs_remove(ima_policy); |
762 | return -1; |
763 | } |
764 | diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c |
765 | index 90987d15b6fe6..6c415667ba67f 100644 |
766 | --- a/security/integrity/integrity_audit.c |
767 | +++ b/security/integrity/integrity_audit.c |
768 | @@ -39,6 +39,8 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode, |
769 | return; |
770 | |
771 | ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno); |
772 | + if (!ab) |
773 | + return; |
774 | audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u", |
775 | task_pid_nr(current), |
776 | from_kuid(&init_user_ns, current_cred()->uid), |
777 | diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c |
778 | index 7133c36f99b6c..b3abc4cf7eb0a 100644 |
779 | --- a/sound/usb/line6/podhd.c |
780 | +++ b/sound/usb/line6/podhd.c |
781 | @@ -385,7 +385,7 @@ static const struct line6_properties podhd_properties_table[] = { |
782 | .name = "POD HD500", |
783 | .capabilities = LINE6_CAP_PCM |
784 | | LINE6_CAP_HWMON, |
785 | - .altsetting = 0, |
786 | + .altsetting = 1, |
787 | .ep_ctrl_r = 0x81, |
788 | .ep_ctrl_w = 0x01, |
789 | .ep_audio_r = 0x86, |
790 | @@ -396,7 +396,7 @@ static const struct line6_properties podhd_properties_table[] = { |
791 | .name = "POD HD500", |
792 | .capabilities = LINE6_CAP_PCM |
793 | | LINE6_CAP_HWMON, |
794 | - .altsetting = 1, |
795 | + .altsetting = 0, |
796 | .ep_ctrl_r = 0x81, |
797 | .ep_ctrl_w = 0x01, |
798 | .ep_audio_r = 0x86, |