Contents of /trunk/kernel-alx-legacy/patches-4.9/0404-4.9.305-all-fixes.patch
Parent Directory | Revision Log
Revision 3706 -
(show annotations)
(download)
Mon Oct 24 14:08:19 2022 UTC (23 months ago) by niro
File size: 27097 byte(s)
Mon Oct 24 14:08:19 2022 UTC (23 months ago) by niro
File size: 27097 byte(s)
-linux-4.9.305
1 | diff --git a/Makefile b/Makefile |
2 | index bd2f7d437b439..308c848b01dc2 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 304 |
9 | +SUBLEVEL = 305 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c |
14 | index 7edc6c3f4bd91..a99e7ebcd004d 100644 |
15 | --- a/arch/arm/mm/mmu.c |
16 | +++ b/arch/arm/mm/mmu.c |
17 | @@ -228,12 +228,14 @@ early_param("ecc", early_ecc); |
18 | static int __init early_cachepolicy(char *p) |
19 | { |
20 | pr_warn("cachepolicy kernel parameter not supported without cp15\n"); |
21 | + return 0; |
22 | } |
23 | early_param("cachepolicy", early_cachepolicy); |
24 | |
25 | static int __init noalign_setup(char *__unused) |
26 | { |
27 | pr_warn("noalign kernel parameter not supported without cp15\n"); |
28 | + return 1; |
29 | } |
30 | __setup("noalign", noalign_setup); |
31 | |
32 | diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c |
33 | index 821fc1f2324c8..44cc02afaa8bd 100644 |
34 | --- a/drivers/ata/pata_hpt37x.c |
35 | +++ b/drivers/ata/pata_hpt37x.c |
36 | @@ -964,14 +964,14 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id) |
37 | |
38 | if ((freq >> 12) != 0xABCDE) { |
39 | int i; |
40 | - u8 sr; |
41 | + u16 sr; |
42 | u32 total = 0; |
43 | |
44 | pr_warn("BIOS has not set timing clocks\n"); |
45 | |
46 | /* This is the process the HPT371 BIOS is reported to use */ |
47 | for (i = 0; i < 128; i++) { |
48 | - pci_read_config_byte(dev, 0x78, &sr); |
49 | + pci_read_config_word(dev, 0x78, &sr); |
50 | total += sr & 0x1FF; |
51 | udelay(15); |
52 | } |
53 | diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c |
54 | index 12fa48e380cf5..4f8dfe77da3c5 100644 |
55 | --- a/drivers/dma/sh/shdma-base.c |
56 | +++ b/drivers/dma/sh/shdma-base.c |
57 | @@ -118,8 +118,10 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx) |
58 | ret = pm_runtime_get(schan->dev); |
59 | |
60 | spin_unlock_irq(&schan->chan_lock); |
61 | - if (ret < 0) |
62 | + if (ret < 0) { |
63 | dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret); |
64 | + pm_runtime_put(schan->dev); |
65 | + } |
66 | |
67 | pm_runtime_barrier(schan->dev); |
68 | |
69 | diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c |
70 | index fceaafd67ec61..e619ced030d52 100644 |
71 | --- a/drivers/firmware/efi/vars.c |
72 | +++ b/drivers/firmware/efi/vars.c |
73 | @@ -763,6 +763,7 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes, |
74 | { |
75 | const struct efivar_operations *ops; |
76 | efi_status_t status; |
77 | + unsigned long varsize; |
78 | |
79 | if (!__efivars) |
80 | return -EINVAL; |
81 | @@ -785,15 +786,17 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes, |
82 | return efivar_entry_set_nonblocking(name, vendor, attributes, |
83 | size, data); |
84 | |
85 | + varsize = size + ucs2_strsize(name, 1024); |
86 | if (!block) { |
87 | if (down_trylock(&efivars_lock)) |
88 | return -EBUSY; |
89 | + status = check_var_size_nonblocking(attributes, varsize); |
90 | } else { |
91 | if (down_interruptible(&efivars_lock)) |
92 | return -EINTR; |
93 | + status = check_var_size(attributes, varsize); |
94 | } |
95 | |
96 | - status = check_var_size(attributes, size + ucs2_strsize(name, 1024)); |
97 | if (status != EFI_SUCCESS) { |
98 | up(&efivars_lock); |
99 | return -ENOSPC; |
100 | diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c |
101 | index 595bf12e76538..062d0eb50799b 100644 |
102 | --- a/drivers/firmware/qemu_fw_cfg.c |
103 | +++ b/drivers/firmware/qemu_fw_cfg.c |
104 | @@ -462,12 +462,12 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f) |
105 | err = kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype, |
106 | fw_cfg_sel_ko, "%d", entry->f.select); |
107 | if (err) |
108 | - goto err_register; |
109 | + goto err_put_entry; |
110 | |
111 | /* add raw binary content access */ |
112 | err = sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw); |
113 | if (err) |
114 | - goto err_add_raw; |
115 | + goto err_del_entry; |
116 | |
117 | /* try adding "/sys/firmware/qemu_fw_cfg/by_name/" symlink */ |
118 | fw_cfg_build_symlink(fw_cfg_fname_kset, &entry->kobj, entry->f.name); |
119 | @@ -476,10 +476,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f) |
120 | fw_cfg_sysfs_cache_enlist(entry); |
121 | return 0; |
122 | |
123 | -err_add_raw: |
124 | +err_del_entry: |
125 | kobject_del(&entry->kobj); |
126 | -err_register: |
127 | - kfree(entry); |
128 | +err_put_entry: |
129 | + kobject_put(&entry->kobj); |
130 | return err; |
131 | } |
132 | |
133 | diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c |
134 | index 3cafa1d28fedd..07dea71d41fc5 100644 |
135 | --- a/drivers/hid/hid-debug.c |
136 | +++ b/drivers/hid/hid-debug.c |
137 | @@ -833,7 +833,9 @@ static const char *keys[KEY_MAX + 1] = { |
138 | [KEY_F22] = "F22", [KEY_F23] = "F23", |
139 | [KEY_F24] = "F24", [KEY_PLAYCD] = "PlayCD", |
140 | [KEY_PAUSECD] = "PauseCD", [KEY_PROG3] = "Prog3", |
141 | - [KEY_PROG4] = "Prog4", [KEY_SUSPEND] = "Suspend", |
142 | + [KEY_PROG4] = "Prog4", |
143 | + [KEY_ALL_APPLICATIONS] = "AllApplications", |
144 | + [KEY_SUSPEND] = "Suspend", |
145 | [KEY_CLOSE] = "Close", [KEY_PLAY] = "Play", |
146 | [KEY_FASTFORWARD] = "FastForward", [KEY_BASSBOOST] = "BassBoost", |
147 | [KEY_PRINT] = "Print", [KEY_HP] = "HP", |
148 | diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c |
149 | index 5e1a51ba6500f..1dccc072da4af 100644 |
150 | --- a/drivers/hid/hid-input.c |
151 | +++ b/drivers/hid/hid-input.c |
152 | @@ -937,6 +937,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel |
153 | case 0x28b: map_key_clear(KEY_FORWARDMAIL); break; |
154 | case 0x28c: map_key_clear(KEY_SEND); break; |
155 | |
156 | + case 0x2a2: map_key_clear(KEY_ALL_APPLICATIONS); break; |
157 | + |
158 | case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV); break; |
159 | case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT); break; |
160 | case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP); break; |
161 | diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig |
162 | index 759c621a860a9..be4b7b1ad39b6 100644 |
163 | --- a/drivers/i2c/busses/Kconfig |
164 | +++ b/drivers/i2c/busses/Kconfig |
165 | @@ -783,7 +783,7 @@ config I2C_PXA_SLAVE |
166 | |
167 | config I2C_QUP |
168 | tristate "Qualcomm QUP based I2C controller" |
169 | - depends on ARCH_QCOM |
170 | + depends on ARCH_QCOM || COMPILE_TEST |
171 | help |
172 | If you say yes to this option, support will be included for the |
173 | built-in I2C interface on the Qualcomm SoCs. |
174 | diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c |
175 | index 7ed09865cb4b9..4729c14b75017 100644 |
176 | --- a/drivers/i2c/busses/i2c-bcm2835.c |
177 | +++ b/drivers/i2c/busses/i2c-bcm2835.c |
178 | @@ -28,6 +28,11 @@ |
179 | #define BCM2835_I2C_FIFO 0x10 |
180 | #define BCM2835_I2C_DIV 0x14 |
181 | #define BCM2835_I2C_DEL 0x18 |
182 | +/* |
183 | + * 16-bit field for the number of SCL cycles to wait after rising SCL |
184 | + * before deciding the slave is not responding. 0 disables the |
185 | + * timeout detection. |
186 | + */ |
187 | #define BCM2835_I2C_CLKT 0x1c |
188 | |
189 | #define BCM2835_I2C_C_READ BIT(0) |
190 | @@ -313,6 +318,12 @@ static int bcm2835_i2c_probe(struct platform_device *pdev) |
191 | adap->dev.of_node = pdev->dev.of_node; |
192 | adap->quirks = &bcm2835_i2c_quirks; |
193 | |
194 | + /* |
195 | + * Disable the hardware clock stretching timeout. SMBUS |
196 | + * specifies a limit for how long the device can stretch the |
197 | + * clock, but core I2C doesn't. |
198 | + */ |
199 | + bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_CLKT, 0); |
200 | bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0); |
201 | |
202 | ret = i2c_add_adapter(adap); |
203 | diff --git a/drivers/input/input.c b/drivers/input/input.c |
204 | index 5d94fc3fce0bb..cb31236425a11 100644 |
205 | --- a/drivers/input/input.c |
206 | +++ b/drivers/input/input.c |
207 | @@ -2112,6 +2112,12 @@ int input_register_device(struct input_dev *dev) |
208 | /* KEY_RESERVED is not supposed to be transmitted to userspace. */ |
209 | __clear_bit(KEY_RESERVED, dev->keybit); |
210 | |
211 | + /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */ |
212 | + if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) { |
213 | + __clear_bit(BTN_RIGHT, dev->keybit); |
214 | + __clear_bit(BTN_MIDDLE, dev->keybit); |
215 | + } |
216 | + |
217 | /* Make sure that bitmasks not mentioned in dev->evbit are clean. */ |
218 | input_cleanse_bitmasks(dev); |
219 | |
220 | diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c |
221 | index 16f5d56600530..44015e6bd6a05 100644 |
222 | --- a/drivers/input/mouse/elan_i2c_core.c |
223 | +++ b/drivers/input/mouse/elan_i2c_core.c |
224 | @@ -132,55 +132,21 @@ static int elan_get_fwinfo(u8 iap_version, u16 *validpage_count, |
225 | return 0; |
226 | } |
227 | |
228 | -static int elan_enable_power(struct elan_tp_data *data) |
229 | +static int elan_set_power(struct elan_tp_data *data, bool on) |
230 | { |
231 | int repeat = ETP_RETRY_COUNT; |
232 | int error; |
233 | |
234 | - error = regulator_enable(data->vcc); |
235 | - if (error) { |
236 | - dev_err(&data->client->dev, |
237 | - "failed to enable regulator: %d\n", error); |
238 | - return error; |
239 | - } |
240 | - |
241 | do { |
242 | - error = data->ops->power_control(data->client, true); |
243 | + error = data->ops->power_control(data->client, on); |
244 | if (error >= 0) |
245 | return 0; |
246 | |
247 | msleep(30); |
248 | } while (--repeat > 0); |
249 | |
250 | - dev_err(&data->client->dev, "failed to enable power: %d\n", error); |
251 | - return error; |
252 | -} |
253 | - |
254 | -static int elan_disable_power(struct elan_tp_data *data) |
255 | -{ |
256 | - int repeat = ETP_RETRY_COUNT; |
257 | - int error; |
258 | - |
259 | - do { |
260 | - error = data->ops->power_control(data->client, false); |
261 | - if (!error) { |
262 | - error = regulator_disable(data->vcc); |
263 | - if (error) { |
264 | - dev_err(&data->client->dev, |
265 | - "failed to disable regulator: %d\n", |
266 | - error); |
267 | - /* Attempt to power the chip back up */ |
268 | - data->ops->power_control(data->client, true); |
269 | - break; |
270 | - } |
271 | - |
272 | - return 0; |
273 | - } |
274 | - |
275 | - msleep(30); |
276 | - } while (--repeat > 0); |
277 | - |
278 | - dev_err(&data->client->dev, "failed to disable power: %d\n", error); |
279 | + dev_err(&data->client->dev, "failed to set power %s: %d\n", |
280 | + on ? "on" : "off", error); |
281 | return error; |
282 | } |
283 | |
284 | @@ -1195,9 +1161,19 @@ static int __maybe_unused elan_suspend(struct device *dev) |
285 | /* Enable wake from IRQ */ |
286 | data->irq_wake = (enable_irq_wake(client->irq) == 0); |
287 | } else { |
288 | - ret = elan_disable_power(data); |
289 | + ret = elan_set_power(data, false); |
290 | + if (ret) |
291 | + goto err; |
292 | + |
293 | + ret = regulator_disable(data->vcc); |
294 | + if (ret) { |
295 | + dev_err(dev, "error %d disabling regulator\n", ret); |
296 | + /* Attempt to power the chip back up */ |
297 | + elan_set_power(data, true); |
298 | + } |
299 | } |
300 | |
301 | +err: |
302 | mutex_unlock(&data->sysfs_mutex); |
303 | return ret; |
304 | } |
305 | @@ -1208,12 +1184,18 @@ static int __maybe_unused elan_resume(struct device *dev) |
306 | struct elan_tp_data *data = i2c_get_clientdata(client); |
307 | int error; |
308 | |
309 | - if (device_may_wakeup(dev) && data->irq_wake) { |
310 | + if (!device_may_wakeup(dev)) { |
311 | + error = regulator_enable(data->vcc); |
312 | + if (error) { |
313 | + dev_err(dev, "error %d enabling regulator\n", error); |
314 | + goto err; |
315 | + } |
316 | + } else if (data->irq_wake) { |
317 | disable_irq_wake(client->irq); |
318 | data->irq_wake = false; |
319 | } |
320 | |
321 | - error = elan_enable_power(data); |
322 | + error = elan_set_power(data, true); |
323 | if (error) { |
324 | dev_err(dev, "power up when resuming failed: %d\n", error); |
325 | goto err; |
326 | diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c |
327 | index 239de38fbd6a5..1c9fff038569d 100644 |
328 | --- a/drivers/net/arcnet/com20020-pci.c |
329 | +++ b/drivers/net/arcnet/com20020-pci.c |
330 | @@ -115,6 +115,9 @@ static int com20020pci_probe(struct pci_dev *pdev, |
331 | return -ENOMEM; |
332 | |
333 | ci = (struct com20020_pci_card_info *)id->driver_data; |
334 | + if (!ci) |
335 | + return -EINVAL; |
336 | + |
337 | priv->ci = ci; |
338 | mm = &ci->misc_map; |
339 | |
340 | diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c |
341 | index 75399aa1ba951..6771c51f72c37 100644 |
342 | --- a/drivers/net/can/usb/gs_usb.c |
343 | +++ b/drivers/net/can/usb/gs_usb.c |
344 | @@ -198,8 +198,8 @@ struct gs_can { |
345 | struct gs_usb { |
346 | struct gs_can *canch[GS_MAX_INTF]; |
347 | struct usb_anchor rx_submitted; |
348 | - atomic_t active_channels; |
349 | struct usb_device *udev; |
350 | + u8 active_channels; |
351 | }; |
352 | |
353 | /* 'allocate' a tx context. |
354 | @@ -597,7 +597,7 @@ static int gs_can_open(struct net_device *netdev) |
355 | if (rc) |
356 | return rc; |
357 | |
358 | - if (atomic_add_return(1, &parent->active_channels) == 1) { |
359 | + if (!parent->active_channels) { |
360 | for (i = 0; i < GS_MAX_RX_URBS; i++) { |
361 | struct urb *urb; |
362 | u8 *buf; |
363 | @@ -698,6 +698,7 @@ static int gs_can_open(struct net_device *netdev) |
364 | |
365 | dev->can.state = CAN_STATE_ERROR_ACTIVE; |
366 | |
367 | + parent->active_channels++; |
368 | if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)) |
369 | netif_start_queue(netdev); |
370 | |
371 | @@ -713,7 +714,8 @@ static int gs_can_close(struct net_device *netdev) |
372 | netif_stop_queue(netdev); |
373 | |
374 | /* Stop polling */ |
375 | - if (atomic_dec_and_test(&parent->active_channels)) |
376 | + parent->active_channels--; |
377 | + if (!parent->active_channels) |
378 | usb_kill_anchored_urbs(&parent->rx_submitted); |
379 | |
380 | /* Stop sending URBs */ |
381 | @@ -992,8 +994,6 @@ static int gs_usb_probe(struct usb_interface *intf, |
382 | |
383 | init_usb_anchor(&dev->rx_submitted); |
384 | |
385 | - atomic_set(&dev->active_channels, 0); |
386 | - |
387 | usb_set_intfdata(intf, dev); |
388 | dev->udev = interface_to_usbdev(intf); |
389 | |
390 | diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c |
391 | index a89721fad633e..29220141e4e46 100644 |
392 | --- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c |
393 | +++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c |
394 | @@ -3677,6 +3677,8 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai, |
395 | MAC_STATS_ACCUM_SECS : (MAC_STATS_ACCUM_SECS * 10); |
396 | adapter->params.pci.vpd_cap_addr = |
397 | pci_find_capability(adapter->pdev, PCI_CAP_ID_VPD); |
398 | + if (!adapter->params.pci.vpd_cap_addr) |
399 | + return -ENODEV; |
400 | ret = get_vpd_params(adapter, &adapter->params.vpd); |
401 | if (ret < 0) |
402 | return ret; |
403 | diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c |
404 | index 11dd7c8d576d6..ab1d01dd2eb3a 100644 |
405 | --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c |
406 | +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c |
407 | @@ -2311,18 +2311,18 @@ static int __init sxgbe_cmdline_opt(char *str) |
408 | char *opt; |
409 | |
410 | if (!str || !*str) |
411 | - return -EINVAL; |
412 | + return 1; |
413 | while ((opt = strsep(&str, ",")) != NULL) { |
414 | if (!strncmp(opt, "eee_timer:", 10)) { |
415 | if (kstrtoint(opt + 10, 0, &eee_timer)) |
416 | goto err; |
417 | } |
418 | } |
419 | - return 0; |
420 | + return 1; |
421 | |
422 | err: |
423 | pr_err("%s: ERROR broken module parameter conversion\n", __func__); |
424 | - return -EINVAL; |
425 | + return 1; |
426 | } |
427 | |
428 | __setup("sxgbeeth=", sxgbe_cmdline_opt); |
429 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
430 | index 0a7ff854d1c34..bb44f8161ea94 100644 |
431 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
432 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
433 | @@ -3608,7 +3608,7 @@ static int __init stmmac_cmdline_opt(char *str) |
434 | char *opt; |
435 | |
436 | if (!str || !*str) |
437 | - return -EINVAL; |
438 | + return 1; |
439 | while ((opt = strsep(&str, ",")) != NULL) { |
440 | if (!strncmp(opt, "debug:", 6)) { |
441 | if (kstrtoint(opt + 6, 0, &debug)) |
442 | @@ -3639,11 +3639,11 @@ static int __init stmmac_cmdline_opt(char *str) |
443 | goto err; |
444 | } |
445 | } |
446 | - return 0; |
447 | + return 1; |
448 | |
449 | err: |
450 | pr_err("%s: ERROR broken module parameter conversion", __func__); |
451 | - return -EINVAL; |
452 | + return 1; |
453 | } |
454 | |
455 | __setup("stmmaceth=", stmmac_cmdline_opt); |
456 | diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c |
457 | index 8d85cedb4bf5b..cbf959e7bbff7 100644 |
458 | --- a/drivers/net/hamradio/mkiss.c |
459 | +++ b/drivers/net/hamradio/mkiss.c |
460 | @@ -41,6 +41,8 @@ |
461 | |
462 | #define AX_MTU 236 |
463 | |
464 | +/* some arch define END as assembly function ending, just undef it */ |
465 | +#undef END |
466 | /* SLIP/KISS protocol characters. */ |
467 | #define END 0300 /* indicates end of frame */ |
468 | #define ESC 0333 /* indicates byte stuffing */ |
469 | diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c |
470 | index d86132d41416d..95256765b3887 100644 |
471 | --- a/drivers/net/usb/cdc_mbim.c |
472 | +++ b/drivers/net/usb/cdc_mbim.c |
473 | @@ -652,6 +652,11 @@ static const struct usb_device_id mbim_devs[] = { |
474 | .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, |
475 | }, |
476 | |
477 | + /* Telit FN990 */ |
478 | + { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1071, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), |
479 | + .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, |
480 | + }, |
481 | + |
482 | /* default entry */ |
483 | { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), |
484 | .driver_info = (unsigned long)&cdc_mbim_info_zlp, |
485 | diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c |
486 | index dd6924d21b8a1..a34647efb5ea5 100644 |
487 | --- a/drivers/net/wireless/mac80211_hwsim.c |
488 | +++ b/drivers/net/wireless/mac80211_hwsim.c |
489 | @@ -1987,6 +1987,15 @@ static void hw_scan_work(struct work_struct *work) |
490 | memcpy(skb_put(probe, req->ie_len), req->ie, |
491 | req->ie_len); |
492 | |
493 | + if (!ieee80211_tx_prepare_skb(hwsim->hw, |
494 | + hwsim->hw_scan_vif, |
495 | + probe, |
496 | + hwsim->tmp_chan->band, |
497 | + NULL)) { |
498 | + kfree_skb(probe); |
499 | + continue; |
500 | + } |
501 | + |
502 | local_bh_disable(); |
503 | mac80211_hwsim_tx_frame(hwsim->hw, probe, |
504 | hwsim->tmp_chan); |
505 | @@ -2919,6 +2928,10 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2, |
506 | } |
507 | txi->flags |= IEEE80211_TX_STAT_ACK; |
508 | } |
509 | + |
510 | + if (hwsim_flags & HWSIM_TX_CTL_NO_ACK) |
511 | + txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED; |
512 | + |
513 | ieee80211_tx_status_irqsafe(data2->hw, skb); |
514 | return 0; |
515 | out: |
516 | diff --git a/drivers/soc/fsl/qe/qe_io.c b/drivers/soc/fsl/qe/qe_io.c |
517 | index 7ae59abc78637..127a4a836e675 100644 |
518 | --- a/drivers/soc/fsl/qe/qe_io.c |
519 | +++ b/drivers/soc/fsl/qe/qe_io.c |
520 | @@ -41,6 +41,8 @@ int par_io_init(struct device_node *np) |
521 | if (ret) |
522 | return ret; |
523 | par_io = ioremap(res.start, resource_size(&res)); |
524 | + if (!par_io) |
525 | + return -ENOMEM; |
526 | |
527 | num_ports = of_get_property(np, "num-ports", NULL); |
528 | if (num_ports) |
529 | diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c |
530 | index 19eb954a7afa3..2b30b5a1b577e 100644 |
531 | --- a/drivers/usb/gadget/legacy/inode.c |
532 | +++ b/drivers/usb/gadget/legacy/inode.c |
533 | @@ -1833,8 +1833,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) |
534 | spin_lock_irq (&dev->lock); |
535 | value = -EINVAL; |
536 | if (dev->buf) { |
537 | + spin_unlock_irq(&dev->lock); |
538 | kfree(kbuf); |
539 | - goto fail; |
540 | + return value; |
541 | } |
542 | dev->buf = kbuf; |
543 | |
544 | @@ -1882,8 +1883,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) |
545 | |
546 | value = usb_gadget_probe_driver(&gadgetfs_driver); |
547 | if (value != 0) { |
548 | - kfree (dev->buf); |
549 | - dev->buf = NULL; |
550 | + spin_lock_irq(&dev->lock); |
551 | + goto fail; |
552 | } else { |
553 | /* at this point "good" hardware has for the first time |
554 | * let the USB the host see us. alternatively, if users |
555 | @@ -1900,6 +1901,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) |
556 | return value; |
557 | |
558 | fail: |
559 | + dev->config = NULL; |
560 | + dev->hs_config = NULL; |
561 | + dev->dev = NULL; |
562 | spin_unlock_irq (&dev->lock); |
563 | pr_debug ("%s: %s fail %Zd, %p\n", shortname, __func__, value, dev); |
564 | kfree (dev->buf); |
565 | diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c |
566 | index 375ccd209206a..95e4f074b7665 100644 |
567 | --- a/fs/cifs/cifsfs.c |
568 | +++ b/fs/cifs/cifsfs.c |
569 | @@ -746,6 +746,7 @@ cifs_do_mount(struct file_system_type *fs_type, |
570 | |
571 | out_super: |
572 | deactivate_locked_super(sb); |
573 | + return root; |
574 | out: |
575 | cifs_cleanup_volume_info(volume_info); |
576 | return root; |
577 | diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h |
578 | index 2280cfe86c561..faa535defddd0 100644 |
579 | --- a/include/net/netfilter/nf_queue.h |
580 | +++ b/include/net/netfilter/nf_queue.h |
581 | @@ -31,7 +31,7 @@ void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *q |
582 | void nf_unregister_queue_handler(struct net *net); |
583 | void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict); |
584 | |
585 | -void nf_queue_entry_get_refs(struct nf_queue_entry *entry); |
586 | +bool nf_queue_entry_get_refs(struct nf_queue_entry *entry); |
587 | void nf_queue_entry_release_refs(struct nf_queue_entry *entry); |
588 | |
589 | static inline void init_hashrandom(u32 *jhash_initval) |
590 | diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h |
591 | index b584868e1b26b..fd7cacbfc8c2c 100644 |
592 | --- a/include/uapi/linux/input-event-codes.h |
593 | +++ b/include/uapi/linux/input-event-codes.h |
594 | @@ -277,7 +277,8 @@ |
595 | #define KEY_PAUSECD 201 |
596 | #define KEY_PROG3 202 |
597 | #define KEY_PROG4 203 |
598 | -#define KEY_DASHBOARD 204 /* AL Dashboard */ |
599 | +#define KEY_ALL_APPLICATIONS 204 /* AC Desktop Show All Applications */ |
600 | +#define KEY_DASHBOARD KEY_ALL_APPLICATIONS |
601 | #define KEY_SUSPEND 205 |
602 | #define KEY_CLOSE 206 /* AC Close */ |
603 | #define KEY_PLAY 207 |
604 | diff --git a/mm/shmem.c b/mm/shmem.c |
605 | index 51aa13f596220..dffa36e6d1c45 100644 |
606 | --- a/mm/shmem.c |
607 | +++ b/mm/shmem.c |
608 | @@ -2478,7 +2478,8 @@ static void shmem_tag_pins(struct address_space *mapping) |
609 | slot = radix_tree_iter_retry(&iter); |
610 | continue; |
611 | } |
612 | - } else if (page_count(page) - page_mapcount(page) > 1) { |
613 | + } else if (!PageTail(page) && page_count(page) != |
614 | + hpage_nr_pages(page) + total_mapcount(page)) { |
615 | radix_tree_tag_set(&mapping->page_tree, iter.index, |
616 | SHMEM_TAG_PINNED); |
617 | } |
618 | @@ -2538,8 +2539,8 @@ static int shmem_wait_for_pins(struct address_space *mapping) |
619 | page = NULL; |
620 | } |
621 | |
622 | - if (page && |
623 | - page_count(page) - page_mapcount(page) != 1) { |
624 | + if (page && page_count(page) != |
625 | + hpage_nr_pages(page) + total_mapcount(page)) { |
626 | if (scan < LAST_SCAN) |
627 | goto continue_resched; |
628 | |
629 | diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c |
630 | index 2dbf5a0faad32..e32a520c3702b 100644 |
631 | --- a/net/dcb/dcbnl.c |
632 | +++ b/net/dcb/dcbnl.c |
633 | @@ -1938,10 +1938,54 @@ int dcb_ieee_delapp(struct net_device *dev, struct dcb_app *del) |
634 | } |
635 | EXPORT_SYMBOL(dcb_ieee_delapp); |
636 | |
637 | +static void dcbnl_flush_dev(struct net_device *dev) |
638 | +{ |
639 | + struct dcb_app_type *itr, *tmp; |
640 | + |
641 | + spin_lock_bh(&dcb_lock); |
642 | + |
643 | + list_for_each_entry_safe(itr, tmp, &dcb_app_list, list) { |
644 | + if (itr->ifindex == dev->ifindex) { |
645 | + list_del(&itr->list); |
646 | + kfree(itr); |
647 | + } |
648 | + } |
649 | + |
650 | + spin_unlock_bh(&dcb_lock); |
651 | +} |
652 | + |
653 | +static int dcbnl_netdevice_event(struct notifier_block *nb, |
654 | + unsigned long event, void *ptr) |
655 | +{ |
656 | + struct net_device *dev = netdev_notifier_info_to_dev(ptr); |
657 | + |
658 | + switch (event) { |
659 | + case NETDEV_UNREGISTER: |
660 | + if (!dev->dcbnl_ops) |
661 | + return NOTIFY_DONE; |
662 | + |
663 | + dcbnl_flush_dev(dev); |
664 | + |
665 | + return NOTIFY_OK; |
666 | + default: |
667 | + return NOTIFY_DONE; |
668 | + } |
669 | +} |
670 | + |
671 | +static struct notifier_block dcbnl_nb __read_mostly = { |
672 | + .notifier_call = dcbnl_netdevice_event, |
673 | +}; |
674 | + |
675 | static int __init dcbnl_init(void) |
676 | { |
677 | + int err; |
678 | + |
679 | INIT_LIST_HEAD(&dcb_app_list); |
680 | |
681 | + err = register_netdevice_notifier(&dcbnl_nb); |
682 | + if (err) |
683 | + return err; |
684 | + |
685 | rtnl_register(PF_UNSPEC, RTM_GETDCB, dcb_doit, NULL, NULL); |
686 | rtnl_register(PF_UNSPEC, RTM_SETDCB, dcb_doit, NULL, NULL); |
687 | |
688 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c |
689 | index d93a98dfe52df..55be18cae35ba 100644 |
690 | --- a/net/ipv6/ip6_output.c |
691 | +++ b/net/ipv6/ip6_output.c |
692 | @@ -1274,8 +1274,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, |
693 | if (np->frag_size) |
694 | mtu = np->frag_size; |
695 | } |
696 | - if (mtu < IPV6_MIN_MTU) |
697 | - return -EINVAL; |
698 | cork->base.fragsize = mtu; |
699 | if (dst_allfrag(rt->dst.path)) |
700 | cork->base.flags |= IPCORK_ALLFRAG; |
701 | @@ -1324,8 +1322,6 @@ static int __ip6_append_data(struct sock *sk, |
702 | |
703 | fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len + |
704 | (opt ? opt->opt_nflen : 0); |
705 | - maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - |
706 | - sizeof(struct frag_hdr); |
707 | |
708 | headersize = sizeof(struct ipv6hdr) + |
709 | (opt ? opt->opt_flen + opt->opt_nflen : 0) + |
710 | @@ -1333,6 +1329,13 @@ static int __ip6_append_data(struct sock *sk, |
711 | sizeof(struct frag_hdr) : 0) + |
712 | rt->rt6i_nfheader_len; |
713 | |
714 | + if (mtu < fragheaderlen || |
715 | + ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr)) |
716 | + goto emsgsize; |
717 | + |
718 | + maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - |
719 | + sizeof(struct frag_hdr); |
720 | + |
721 | /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit |
722 | * the first fragment |
723 | */ |
724 | diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c |
725 | index 3dc370ad23bf6..41af02a70742e 100644 |
726 | --- a/net/mac80211/rx.c |
727 | +++ b/net/mac80211/rx.c |
728 | @@ -2607,13 +2607,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) |
729 | ether_addr_equal(sdata->vif.addr, hdr->addr3)) |
730 | return RX_CONTINUE; |
731 | |
732 | - ac = ieee80211_select_queue_80211(sdata, skb, hdr); |
733 | + ac = ieee802_1d_to_ac[skb->priority]; |
734 | q = sdata->vif.hw_queue[ac]; |
735 | if (ieee80211_queue_stopped(&local->hw, q)) { |
736 | IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); |
737 | return RX_DROP_MONITOR; |
738 | } |
739 | - skb_set_queue_mapping(skb, q); |
740 | + skb_set_queue_mapping(skb, ac); |
741 | |
742 | if (!--mesh_hdr->ttl) { |
743 | if (!is_multicast_ether_addr(hdr->addr1)) |
744 | diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c |
745 | index 8f08d759844a9..333ea23681017 100644 |
746 | --- a/net/netfilter/nf_queue.c |
747 | +++ b/net/netfilter/nf_queue.c |
748 | @@ -44,6 +44,15 @@ void nf_unregister_queue_handler(struct net *net) |
749 | } |
750 | EXPORT_SYMBOL(nf_unregister_queue_handler); |
751 | |
752 | +static void nf_queue_sock_put(struct sock *sk) |
753 | +{ |
754 | +#ifdef CONFIG_INET |
755 | + sock_gen_put(sk); |
756 | +#else |
757 | + sock_put(sk); |
758 | +#endif |
759 | +} |
760 | + |
761 | void nf_queue_entry_release_refs(struct nf_queue_entry *entry) |
762 | { |
763 | struct nf_hook_state *state = &entry->state; |
764 | @@ -54,7 +63,7 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry) |
765 | if (state->out) |
766 | dev_put(state->out); |
767 | if (state->sk) |
768 | - sock_put(state->sk); |
769 | + nf_queue_sock_put(state->sk); |
770 | #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
771 | if (entry->skb->nf_bridge) { |
772 | struct net_device *physdev; |
773 | @@ -71,10 +80,13 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry) |
774 | EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs); |
775 | |
776 | /* Bump dev refs so they don't vanish while packet is out */ |
777 | -void nf_queue_entry_get_refs(struct nf_queue_entry *entry) |
778 | +bool nf_queue_entry_get_refs(struct nf_queue_entry *entry) |
779 | { |
780 | struct nf_hook_state *state = &entry->state; |
781 | |
782 | + if (state->sk && !atomic_inc_not_zero(&state->sk->sk_refcnt)) |
783 | + return false; |
784 | + |
785 | if (state->in) |
786 | dev_hold(state->in); |
787 | if (state->out) |
788 | @@ -93,6 +105,7 @@ void nf_queue_entry_get_refs(struct nf_queue_entry *entry) |
789 | dev_hold(physdev); |
790 | } |
791 | #endif |
792 | + return true; |
793 | } |
794 | EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs); |
795 | |
796 | @@ -139,7 +152,11 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, |
797 | .size = sizeof(*entry) + afinfo->route_key_size, |
798 | }; |
799 | |
800 | - nf_queue_entry_get_refs(entry); |
801 | + if (!nf_queue_entry_get_refs(entry)) { |
802 | + kfree(entry); |
803 | + return -ENOTCONN; |
804 | + } |
805 | + |
806 | skb_dst_force(skb); |
807 | afinfo->saveroute(skb, entry); |
808 | status = qh->outfn(entry, queuenum); |
809 | diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c |
810 | index a35510565d4d1..66814a9d030cc 100644 |
811 | --- a/net/netfilter/nfnetlink_queue.c |
812 | +++ b/net/netfilter/nfnetlink_queue.c |
813 | @@ -673,9 +673,15 @@ static struct nf_queue_entry * |
814 | nf_queue_entry_dup(struct nf_queue_entry *e) |
815 | { |
816 | struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC); |
817 | - if (entry) |
818 | - nf_queue_entry_get_refs(entry); |
819 | - return entry; |
820 | + |
821 | + if (!entry) |
822 | + return NULL; |
823 | + |
824 | + if (nf_queue_entry_get_refs(entry)) |
825 | + return entry; |
826 | + |
827 | + kfree(entry); |
828 | + return NULL; |
829 | } |
830 | |
831 | #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
832 | diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c |
833 | index e2c200c3c1353..74968ddee49fa 100644 |
834 | --- a/sound/soc/soc-ops.c |
835 | +++ b/sound/soc/soc-ops.c |
836 | @@ -328,7 +328,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, |
837 | mask = BIT(sign_bit + 1) - 1; |
838 | |
839 | val = ucontrol->value.integer.value[0]; |
840 | - if (mc->platform_max && val > mc->platform_max) |
841 | + if (mc->platform_max && ((int)val + min) > mc->platform_max) |
842 | return -EINVAL; |
843 | if (val > max - min) |
844 | return -EINVAL; |
845 | @@ -341,7 +341,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, |
846 | val = val << shift; |
847 | if (snd_soc_volsw_is_stereo(mc)) { |
848 | val2 = ucontrol->value.integer.value[1]; |
849 | - if (mc->platform_max && val2 > mc->platform_max) |
850 | + if (mc->platform_max && ((int)val2 + min) > mc->platform_max) |
851 | return -EINVAL; |
852 | if (val2 > max - min) |
853 | return -EINVAL; |