Magellan Linux

Annotation of /trunk/kernel-alx-legacy/patches-4.9/0411-4.9.312-all-fixes.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 3713 - (hide annotations) (download)
Mon Oct 24 14:08:25 2022 UTC (22 months, 4 weeks ago) by niro
File size: 15714 byte(s)
-linux-4.9.312
1 niro 3713 diff --git a/Makefile b/Makefile
2     index c1a20e4a2d136..a9f16c9c9614f 100644
3     --- a/Makefile
4     +++ b/Makefile
5     @@ -1,6 +1,6 @@
6     VERSION = 4
7     PATCHLEVEL = 9
8     -SUBLEVEL = 311
9     +SUBLEVEL = 312
10     EXTRAVERSION =
11     NAME = Roaring Lionus
12    
13     diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
14     index 37ad245cf9899..fb458623f3860 100644
15     --- a/arch/arc/kernel/entry.S
16     +++ b/arch/arc/kernel/entry.S
17     @@ -191,6 +191,7 @@ tracesys_exit:
18     st r0, [sp, PT_r0] ; sys call return value in pt_regs
19    
20     ;POST Sys Call Ptrace Hook
21     + mov r0, sp ; pt_regs needed
22     bl @syscall_trace_exit
23     b ret_from_exception ; NOT ret_from_system_call at is saves r0 which
24     ; we'd done before calling post hook above
25     diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
26     index 635b0d5494874..c16f396140032 100644
27     --- a/arch/arm/mach-vexpress/spc.c
28     +++ b/arch/arm/mach-vexpress/spc.c
29     @@ -584,7 +584,7 @@ static int __init ve_spc_clk_init(void)
30     }
31    
32     cluster = topology_physical_package_id(cpu_dev->id);
33     - if (init_opp_table[cluster])
34     + if (cluster < 0 || init_opp_table[cluster])
35     continue;
36    
37     if (ve_init_opp_table(cpu_dev))
38     diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
39     index b6e5447d563ee..f538bac4ac66a 100644
40     --- a/block/compat_ioctl.c
41     +++ b/block/compat_ioctl.c
42     @@ -394,7 +394,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
43     return 0;
44     case BLKGETSIZE:
45     size = i_size_read(bdev->bd_inode);
46     - if ((size >> 9) > ~0UL)
47     + if ((size >> 9) > ~(compat_ulong_t)0)
48     return -EFBIG;
49     return compat_put_ulong(arg, size >> 9);
50    
51     diff --git a/drivers/ata/pata_marvell.c b/drivers/ata/pata_marvell.c
52     index ff468a6fd8ddc..677f582cf3d6c 100644
53     --- a/drivers/ata/pata_marvell.c
54     +++ b/drivers/ata/pata_marvell.c
55     @@ -82,6 +82,8 @@ static int marvell_cable_detect(struct ata_port *ap)
56     switch(ap->port_no)
57     {
58     case 0:
59     + if (!ap->ioaddr.bmdma_addr)
60     + return ATA_CBL_PATA_UNK;
61     if (ioread8(ap->ioaddr.bmdma_addr + 1) & 1)
62     return ATA_CBL_PATA40;
63     return ATA_CBL_PATA80;
64     diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
65     index c15ca560fe60d..ca266fcca186c 100644
66     --- a/drivers/dma/at_xdmac.c
67     +++ b/drivers/dma/at_xdmac.c
68     @@ -1392,7 +1392,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
69     {
70     struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan);
71     struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device);
72     - struct at_xdmac_desc *desc, *_desc;
73     + struct at_xdmac_desc *desc, *_desc, *iter;
74     struct list_head *descs_list;
75     enum dma_status ret;
76     int residue, retry;
77     @@ -1507,11 +1507,13 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
78     * microblock.
79     */
80     descs_list = &desc->descs_list;
81     - list_for_each_entry_safe(desc, _desc, descs_list, desc_node) {
82     - dwidth = at_xdmac_get_dwidth(desc->lld.mbr_cfg);
83     - residue -= (desc->lld.mbr_ubc & 0xffffff) << dwidth;
84     - if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda)
85     + list_for_each_entry_safe(iter, _desc, descs_list, desc_node) {
86     + dwidth = at_xdmac_get_dwidth(iter->lld.mbr_cfg);
87     + residue -= (iter->lld.mbr_ubc & 0xffffff) << dwidth;
88     + if ((iter->lld.mbr_nda & 0xfffffffc) == cur_nda) {
89     + desc = iter;
90     break;
91     + }
92     }
93     residue += cur_ubc << dwidth;
94    
95     diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
96     index 558d509b7d855..4337cf9defc24 100644
97     --- a/drivers/dma/imx-sdma.c
98     +++ b/drivers/dma/imx-sdma.c
99     @@ -1528,7 +1528,7 @@ static int sdma_event_remap(struct sdma_engine *sdma)
100     u32 reg, val, shift, num_map, i;
101     int ret = 0;
102    
103     - if (IS_ERR(np) || IS_ERR(gpr_np))
104     + if (IS_ERR(np) || !gpr_np)
105     goto out;
106    
107     event_remap = of_find_property(np, propname, NULL);
108     @@ -1576,7 +1576,7 @@ static int sdma_event_remap(struct sdma_engine *sdma)
109     }
110    
111     out:
112     - if (!IS_ERR(gpr_np))
113     + if (gpr_np)
114     of_node_put(gpr_np);
115    
116     return ret;
117     diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
118     index 83bf997dda03c..e14bfbdbaf2bf 100644
119     --- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
120     +++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
121     @@ -192,7 +192,10 @@ static void mdp5_plane_reset(struct drm_plane *plane)
122     drm_framebuffer_unreference(plane->state->fb);
123    
124     kfree(to_mdp5_plane_state(plane->state));
125     + plane->state = NULL;
126     mdp5_state = kzalloc(sizeof(*mdp5_state), GFP_KERNEL);
127     + if (!mdp5_state)
128     + return;
129    
130     /* assign default blend parameters */
131     mdp5_state->alpha = 255;
132     diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
133     index 500016209ae0c..3ed40bde796b7 100644
134     --- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
135     +++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
136     @@ -1010,8 +1010,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
137     {
138     u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) |
139     link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND;
140     - u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */
141     - u16 lat_enc_d = 0; /* latency decoded */
142     + u32 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */
143     + u32 lat_enc_d = 0; /* latency decoded */
144     u16 lat_enc = 0; /* latency encoded */
145    
146     if (link) {
147     diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
148     index 0bfadec8b79c9..d59cb381e80b1 100644
149     --- a/drivers/net/vxlan.c
150     +++ b/drivers/net/vxlan.c
151     @@ -490,11 +490,11 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
152    
153     rd = kmalloc(sizeof(*rd), GFP_ATOMIC);
154     if (rd == NULL)
155     - return -ENOBUFS;
156     + return -ENOMEM;
157    
158     if (dst_cache_init(&rd->dst_cache, GFP_ATOMIC)) {
159     kfree(rd);
160     - return -ENOBUFS;
161     + return -ENOMEM;
162     }
163    
164     rd->remote_ip = *ip;
165     diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
166     index 998a4bd6db78a..d8f34883c0960 100644
167     --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
168     +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
169     @@ -547,7 +547,7 @@ enum brcmf_sdio_frmtype {
170     BRCMF_SDIO_FT_SUB,
171     };
172    
173     -#define SDIOD_DRVSTR_KEY(chip, pmu) (((chip) << 16) | (pmu))
174     +#define SDIOD_DRVSTR_KEY(chip, pmu) (((unsigned int)(chip) << 16) | (pmu))
175    
176     /* SDIO Pad drive strength to select value mappings */
177     struct sdiod_drive_str {
178     diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
179     index 8c146e2b6727a..4664d3e191c81 100644
180     --- a/drivers/platform/x86/samsung-laptop.c
181     +++ b/drivers/platform/x86/samsung-laptop.c
182     @@ -1125,8 +1125,6 @@ static void kbd_led_set(struct led_classdev *led_cdev,
183    
184     if (value > samsung->kbd_led.max_brightness)
185     value = samsung->kbd_led.max_brightness;
186     - else if (value < 0)
187     - value = 0;
188    
189     samsung->kbd_led_wk = value;
190     queue_work(samsung->led_workqueue, &samsung->kbd_led_work);
191     diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
192     index 95e4f074b7665..b85c283ad08b3 100644
193     --- a/fs/cifs/cifsfs.c
194     +++ b/fs/cifs/cifsfs.c
195     @@ -766,7 +766,7 @@ cifs_loose_read_iter(struct kiocb *iocb, struct iov_iter *iter)
196     ssize_t rc;
197     struct inode *inode = file_inode(iocb->ki_filp);
198    
199     - if (iocb->ki_filp->f_flags & O_DIRECT)
200     + if (iocb->ki_flags & IOCB_DIRECT)
201     return cifs_user_readv(iocb, iter);
202    
203     rc = cifs_revalidate_mapping(inode);
204     diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
205     index e66aa8918dee2..754b33828853d 100644
206     --- a/fs/ext4/inode.c
207     +++ b/fs/ext4/inode.c
208     @@ -3980,7 +3980,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
209     struct super_block *sb = inode->i_sb;
210     ext4_lblk_t first_block, stop_block;
211     struct address_space *mapping = inode->i_mapping;
212     - loff_t first_block_offset, last_block_offset;
213     + loff_t first_block_offset, last_block_offset, max_length;
214     + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
215     handle_t *handle;
216     unsigned int credits;
217     int ret = 0;
218     @@ -4026,6 +4027,14 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
219     offset;
220     }
221    
222     + /*
223     + * For punch hole the length + offset needs to be within one block
224     + * before last range. Adjust the length if it goes beyond that limit.
225     + */
226     + max_length = sbi->s_bitmap_maxbytes - inode->i_sb->s_blocksize;
227     + if (offset + length > max_length)
228     + length = max_length - offset;
229     +
230     if (offset & (sb->s_blocksize - 1) ||
231     (offset + length) & (sb->s_blocksize - 1)) {
232     /*
233     diff --git a/fs/ext4/super.c b/fs/ext4/super.c
234     index e17a6396bde6c..c50ba683a570a 100644
235     --- a/fs/ext4/super.c
236     +++ b/fs/ext4/super.c
237     @@ -3241,9 +3241,11 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp,
238     ext4_fsblk_t first_block, last_block, b;
239     ext4_group_t i, ngroups = ext4_get_groups_count(sb);
240     int s, j, count = 0;
241     + int has_super = ext4_bg_has_super(sb, grp);
242    
243     if (!ext4_has_feature_bigalloc(sb))
244     - return (ext4_bg_has_super(sb, grp) + ext4_bg_num_gdb(sb, grp) +
245     + return (has_super + ext4_bg_num_gdb(sb, grp) +
246     + (has_super ? le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) : 0) +
247     sbi->s_itb_per_group + 2);
248    
249     first_block = le32_to_cpu(sbi->s_es->s_first_data_block) +
250     @@ -4162,9 +4164,18 @@ no_journal:
251     * Get the # of file system overhead blocks from the
252     * superblock if present.
253     */
254     - if (es->s_overhead_clusters)
255     - sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters);
256     - else {
257     + sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters);
258     + /* ignore the precalculated value if it is ridiculous */
259     + if (sbi->s_overhead > ext4_blocks_count(es))
260     + sbi->s_overhead = 0;
261     + /*
262     + * If the bigalloc feature is not enabled recalculating the
263     + * overhead doesn't take long, so we might as well just redo
264     + * it to make sure we are using the correct value.
265     + */
266     + if (!ext4_has_feature_bigalloc(sb))
267     + sbi->s_overhead = 0;
268     + if (sbi->s_overhead == 0) {
269     err = ext4_calculate_overhead(sb);
270     if (err)
271     goto failed_mount_wq;
272     diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
273     index a4182b150bb07..9f83a4c602f99 100644
274     --- a/fs/gfs2/rgrp.c
275     +++ b/fs/gfs2/rgrp.c
276     @@ -917,15 +917,15 @@ static int read_rindex_entry(struct gfs2_inode *ip)
277     rgd->rd_bitbytes = be32_to_cpu(buf.ri_bitbytes);
278     spin_lock_init(&rgd->rd_rsspin);
279    
280     - error = compute_bitstructs(rgd);
281     - if (error)
282     - goto fail;
283     -
284     error = gfs2_glock_get(sdp, rgd->rd_addr,
285     &gfs2_rgrp_glops, CREATE, &rgd->rd_gl);
286     if (error)
287     goto fail;
288    
289     + error = compute_bitstructs(rgd);
290     + if (error)
291     + goto fail_glock;
292     +
293     rgd->rd_rgl = (struct gfs2_rgrp_lvb *)rgd->rd_gl->gl_lksb.sb_lvbptr;
294     rgd->rd_flags &= ~(GFS2_RDF_UPTODATE | GFS2_RDF_PREFERRED);
295     if (rgd->rd_data > sdp->sd_max_rg_data)
296     @@ -942,6 +942,7 @@ static int read_rindex_entry(struct gfs2_inode *ip)
297     }
298    
299     error = 0; /* someone else read in the rgrp; free it and ignore it */
300     +fail_glock:
301     gfs2_glock_put(rgd->rd_gl);
302    
303     fail:
304     diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
305     index 6fec9e81bd70d..1979298fdca9e 100644
306     --- a/include/linux/etherdevice.h
307     +++ b/include/linux/etherdevice.h
308     @@ -125,7 +125,7 @@ static inline bool is_multicast_ether_addr(const u8 *addr)
309     #endif
310     }
311    
312     -static inline bool is_multicast_ether_addr_64bits(const u8 addr[6+2])
313     +static inline bool is_multicast_ether_addr_64bits(const u8 *addr)
314     {
315     #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
316     #ifdef __BIG_ENDIAN
317     @@ -339,8 +339,7 @@ static inline bool ether_addr_equal(const u8 *addr1, const u8 *addr2)
318     * Please note that alignment of addr1 & addr2 are only guaranteed to be 16 bits.
319     */
320    
321     -static inline bool ether_addr_equal_64bits(const u8 addr1[6+2],
322     - const u8 addr2[6+2])
323     +static inline bool ether_addr_equal_64bits(const u8 *addr1, const u8 *addr2)
324     {
325     #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
326     u64 fold = (*(const u64 *)addr1) ^ (*(const u64 *)addr2);
327     diff --git a/mm/page_alloc.c b/mm/page_alloc.c
328     index 25c21aa398f8c..a6e682569e5b9 100644
329     --- a/mm/page_alloc.c
330     +++ b/mm/page_alloc.c
331     @@ -6504,7 +6504,7 @@ void __init mem_init_print_info(const char *str)
332     */
333     #define adj_init_size(start, end, size, pos, adj) \
334     do { \
335     - if (start <= pos && pos < end && size > adj) \
336     + if (&start[0] <= &pos[0] && &pos[0] < &end[0] && size > adj) \
337     size -= adj; \
338     } while (0)
339    
340     diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
341     index 8aef475fef310..a8674e9ff37b7 100644
342     --- a/net/netlink/af_netlink.c
343     +++ b/net/netlink/af_netlink.c
344     @@ -2194,6 +2194,13 @@ static int netlink_dump(struct sock *sk)
345     * single netdev. The outcome is MSG_TRUNC error.
346     */
347     skb_reserve(skb, skb_tailroom(skb) - alloc_size);
348     +
349     + /* Make sure malicious BPF programs can not read unitialized memory
350     + * from skb->head -> skb->data
351     + */
352     + skb_reset_network_header(skb);
353     + skb_reset_mac_header(skb);
354     +
355     netlink_skb_set_owner_r(skb, sk);
356    
357     if (nlk->dump_done_errno > 0)
358     diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
359     index 28471cfad9225..26921f755f3a9 100644
360     --- a/net/openvswitch/flow_netlink.c
361     +++ b/net/openvswitch/flow_netlink.c
362     @@ -1863,7 +1863,7 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
363     new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
364    
365     if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
366     - if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
367     + if ((next_offset + req_size) > MAX_ACTIONS_BUFSIZE) {
368     OVS_NLERR(log, "Flow action size exceeds max %u",
369     MAX_ACTIONS_BUFSIZE);
370     return ERR_PTR(-EMSGSIZE);
371     diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
372     index e79d6881a97eb..2ae2801dd7bee 100644
373     --- a/net/packet/af_packet.c
374     +++ b/net/packet/af_packet.c
375     @@ -2808,8 +2808,9 @@ tpacket_error:
376    
377     status = TP_STATUS_SEND_REQUEST;
378     err = po->xmit(skb);
379     - if (unlikely(err > 0)) {
380     - err = net_xmit_errno(err);
381     + if (unlikely(err != 0)) {
382     + if (err > 0)
383     + err = net_xmit_errno(err);
384     if (err && __packet_get_status(po, ph) ==
385     TP_STATUS_AVAILABLE) {
386     /* skb was destructed already */
387     @@ -3009,8 +3010,12 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
388     skb->no_fcs = 1;
389    
390     err = po->xmit(skb);
391     - if (err > 0 && (err = net_xmit_errno(err)) != 0)
392     - goto out_unlock;
393     + if (unlikely(err != 0)) {
394     + if (err > 0)
395     + err = net_xmit_errno(err);
396     + if (err)
397     + goto out_unlock;
398     + }
399    
400     dev_put(dev);
401    
402     diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
403     index 21b0368c2a3bc..878a4fc97f042 100644
404     --- a/sound/soc/soc-dapm.c
405     +++ b/sound/soc/soc-dapm.c
406     @@ -1569,8 +1569,7 @@ static void dapm_seq_run(struct snd_soc_card *card,
407     switch (w->id) {
408     case snd_soc_dapm_pre:
409     if (!w->event)
410     - list_for_each_entry_safe_continue(w, n, list,
411     - power_list);
412     + continue;
413    
414     if (event == SND_SOC_DAPM_STREAM_START)
415     ret = w->event(w,
416     @@ -1582,8 +1581,7 @@ static void dapm_seq_run(struct snd_soc_card *card,
417    
418     case snd_soc_dapm_post:
419     if (!w->event)
420     - list_for_each_entry_safe_continue(w, n, list,
421     - power_list);
422     + continue;
423    
424     if (event == SND_SOC_DAPM_STREAM_START)
425     ret = w->event(w,
426     diff --git a/sound/usb/midi.c b/sound/usb/midi.c
427     index f0b41fee71304..83da676519a8d 100644
428     --- a/sound/usb/midi.c
429     +++ b/sound/usb/midi.c
430     @@ -1210,6 +1210,7 @@ static void snd_usbmidi_output_drain(struct snd_rawmidi_substream *substream)
431     } while (drain_urbs && timeout);
432     finish_wait(&ep->drain_wait, &wait);
433     }
434     + port->active = 0;
435     spin_unlock_irq(&ep->buffer_lock);
436     }
437    
438     diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
439     index 62456a806bb4d..4b8f1c46420d4 100644
440     --- a/sound/usb/usbaudio.h
441     +++ b/sound/usb/usbaudio.h
442     @@ -22,7 +22,7 @@
443     */
444    
445     /* handling of USB vendor/product ID pairs as 32-bit numbers */
446     -#define USB_ID(vendor, product) (((vendor) << 16) | (product))
447     +#define USB_ID(vendor, product) (((unsigned int)(vendor) << 16) | (product))
448     #define USB_ID_VENDOR(id) ((id) >> 16)
449     #define USB_ID_PRODUCT(id) ((u16)(id))
450