Annotation of /trunk/kernel-alx/patches-3.10/0159-3.10.60-all-fixes.patch
Parent Directory | Revision Log
Revision 2647 -
(hide annotations)
(download)
Tue Jul 21 16:20:21 2015 UTC (9 years, 2 months ago) by niro
File size: 144980 byte(s)
Tue Jul 21 16:20:21 2015 UTC (9 years, 2 months ago) by niro
File size: 144980 byte(s)
-linux-3.10.60
1 | niro | 2647 | diff --git a/Makefile b/Makefile |
2 | index 7baf27f5cf0f..9d4f30d0d201 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 3 | ||
7 | PATCHLEVEL = 10 | ||
8 | -SUBLEVEL = 59 | ||
9 | +SUBLEVEL = 60 | ||
10 | EXTRAVERSION = | ||
11 | NAME = TOSSUG Baby Fish | ||
12 | |||
13 | diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts | ||
14 | index 4f31b2eb5cdf..398064cef746 100644 | ||
15 | --- a/arch/arc/boot/dts/nsimosci.dts | ||
16 | +++ b/arch/arc/boot/dts/nsimosci.dts | ||
17 | @@ -20,7 +20,7 @@ | ||
18 | /* this is for console on PGU */ | ||
19 | /* bootargs = "console=tty0 consoleblank=0"; */ | ||
20 | /* this is for console on serial */ | ||
21 | - bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=ttyS0,115200n8 consoleblank=0 debug"; | ||
22 | + bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; | ||
23 | }; | ||
24 | |||
25 | aliases { | ||
26 | diff --git a/arch/arc/include/asm/kgdb.h b/arch/arc/include/asm/kgdb.h | ||
27 | index 4930957ca3d3..e897610c657a 100644 | ||
28 | --- a/arch/arc/include/asm/kgdb.h | ||
29 | +++ b/arch/arc/include/asm/kgdb.h | ||
30 | @@ -19,7 +19,7 @@ | ||
31 | * register API yet */ | ||
32 | #undef DBG_MAX_REG_NUM | ||
33 | |||
34 | -#define GDB_MAX_REGS 39 | ||
35 | +#define GDB_MAX_REGS 87 | ||
36 | |||
37 | #define BREAK_INSTR_SIZE 2 | ||
38 | #define CACHE_FLUSH_IS_SAFE 1 | ||
39 | @@ -33,23 +33,27 @@ static inline void arch_kgdb_breakpoint(void) | ||
40 | |||
41 | extern void kgdb_trap(struct pt_regs *regs, int param); | ||
42 | |||
43 | -enum arc700_linux_regnums { | ||
44 | +/* This is the numbering of registers according to the GDB. See GDB's | ||
45 | + * arc-tdep.h for details. | ||
46 | + * | ||
47 | + * Registers are ordered for GDB 7.5. It is incompatible with GDB 6.8. */ | ||
48 | +enum arc_linux_regnums { | ||
49 | _R0 = 0, | ||
50 | _R1, _R2, _R3, _R4, _R5, _R6, _R7, _R8, _R9, _R10, _R11, _R12, _R13, | ||
51 | _R14, _R15, _R16, _R17, _R18, _R19, _R20, _R21, _R22, _R23, _R24, | ||
52 | _R25, _R26, | ||
53 | - _BTA = 27, | ||
54 | - _LP_START = 28, | ||
55 | - _LP_END = 29, | ||
56 | - _LP_COUNT = 30, | ||
57 | - _STATUS32 = 31, | ||
58 | - _BLINK = 32, | ||
59 | - _FP = 33, | ||
60 | - __SP = 34, | ||
61 | - _EFA = 35, | ||
62 | - _RET = 36, | ||
63 | - _ORIG_R8 = 37, | ||
64 | - _STOP_PC = 38 | ||
65 | + _FP = 27, | ||
66 | + __SP = 28, | ||
67 | + _R30 = 30, | ||
68 | + _BLINK = 31, | ||
69 | + _LP_COUNT = 60, | ||
70 | + _STOP_PC = 64, | ||
71 | + _RET = 64, | ||
72 | + _LP_START = 65, | ||
73 | + _LP_END = 66, | ||
74 | + _STATUS32 = 67, | ||
75 | + _ECR = 76, | ||
76 | + _BTA = 82, | ||
77 | }; | ||
78 | |||
79 | #else | ||
80 | diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c | ||
81 | index 0e17e1352718..a91a7a99f70f 100644 | ||
82 | --- a/arch/mips/mm/tlbex.c | ||
83 | +++ b/arch/mips/mm/tlbex.c | ||
84 | @@ -1091,6 +1091,7 @@ static void __cpuinit build_update_entries(u32 **p, unsigned int tmp, | ||
85 | struct mips_huge_tlb_info { | ||
86 | int huge_pte; | ||
87 | int restore_scratch; | ||
88 | + bool need_reload_pte; | ||
89 | }; | ||
90 | |||
91 | static struct mips_huge_tlb_info __cpuinit | ||
92 | @@ -1105,6 +1106,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l, | ||
93 | |||
94 | rv.huge_pte = scratch; | ||
95 | rv.restore_scratch = 0; | ||
96 | + rv.need_reload_pte = false; | ||
97 | |||
98 | if (check_for_high_segbits) { | ||
99 | UASM_i_MFC0(p, tmp, C0_BADVADDR); | ||
100 | @@ -1293,6 +1295,7 @@ static void __cpuinit build_r4000_tlb_refill_handler(void) | ||
101 | } else { | ||
102 | htlb_info.huge_pte = K0; | ||
103 | htlb_info.restore_scratch = 0; | ||
104 | + htlb_info.need_reload_pte = true; | ||
105 | vmalloc_mode = refill_noscratch; | ||
106 | /* | ||
107 | * create the plain linear handler | ||
108 | @@ -1329,7 +1332,8 @@ static void __cpuinit build_r4000_tlb_refill_handler(void) | ||
109 | } | ||
110 | #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT | ||
111 | uasm_l_tlb_huge_update(&l, p); | ||
112 | - UASM_i_LW(&p, K0, 0, K1); | ||
113 | + if (htlb_info.need_reload_pte) | ||
114 | + UASM_i_LW(&p, htlb_info.huge_pte, 0, K1); | ||
115 | build_huge_update_entries(&p, htlb_info.huge_pte, K1); | ||
116 | build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random, | ||
117 | htlb_info.restore_scratch); | ||
118 | diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S | ||
119 | index 474dc1b59f72..c9305ef1d411 100644 | ||
120 | --- a/arch/x86/ia32/ia32entry.S | ||
121 | +++ b/arch/x86/ia32/ia32entry.S | ||
122 | @@ -151,6 +151,16 @@ ENTRY(ia32_sysenter_target) | ||
123 | 1: movl (%rbp),%ebp | ||
124 | _ASM_EXTABLE(1b,ia32_badarg) | ||
125 | ASM_CLAC | ||
126 | + | ||
127 | + /* | ||
128 | + * Sysenter doesn't filter flags, so we need to clear NT | ||
129 | + * ourselves. To save a few cycles, we can check whether | ||
130 | + * NT was set instead of doing an unconditional popfq. | ||
131 | + */ | ||
132 | + testl $X86_EFLAGS_NT,EFLAGS-ARGOFFSET(%rsp) | ||
133 | + jnz sysenter_fix_flags | ||
134 | +sysenter_flags_fixed: | ||
135 | + | ||
136 | orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET) | ||
137 | testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) | ||
138 | CFI_REMEMBER_STATE | ||
139 | @@ -184,6 +194,8 @@ sysexit_from_sys_call: | ||
140 | TRACE_IRQS_ON | ||
141 | ENABLE_INTERRUPTS_SYSEXIT32 | ||
142 | |||
143 | + CFI_RESTORE_STATE | ||
144 | + | ||
145 | #ifdef CONFIG_AUDITSYSCALL | ||
146 | .macro auditsys_entry_common | ||
147 | movl %esi,%r9d /* 6th arg: 4th syscall arg */ | ||
148 | @@ -226,7 +238,6 @@ sysexit_from_sys_call: | ||
149 | .endm | ||
150 | |||
151 | sysenter_auditsys: | ||
152 | - CFI_RESTORE_STATE | ||
153 | auditsys_entry_common | ||
154 | movl %ebp,%r9d /* reload 6th syscall arg */ | ||
155 | jmp sysenter_dispatch | ||
156 | @@ -235,6 +246,11 @@ sysexit_audit: | ||
157 | auditsys_exit sysexit_from_sys_call | ||
158 | #endif | ||
159 | |||
160 | +sysenter_fix_flags: | ||
161 | + pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) | ||
162 | + popfq_cfi | ||
163 | + jmp sysenter_flags_fixed | ||
164 | + | ||
165 | sysenter_tracesys: | ||
166 | #ifdef CONFIG_AUDITSYSCALL | ||
167 | testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) | ||
168 | diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h | ||
169 | index 9c999c1674fa..01f15b227d7e 100644 | ||
170 | --- a/arch/x86/include/asm/elf.h | ||
171 | +++ b/arch/x86/include/asm/elf.h | ||
172 | @@ -155,8 +155,9 @@ do { \ | ||
173 | #define elf_check_arch(x) \ | ||
174 | ((x)->e_machine == EM_X86_64) | ||
175 | |||
176 | -#define compat_elf_check_arch(x) \ | ||
177 | - (elf_check_arch_ia32(x) || (x)->e_machine == EM_X86_64) | ||
178 | +#define compat_elf_check_arch(x) \ | ||
179 | + (elf_check_arch_ia32(x) || \ | ||
180 | + (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64)) | ||
181 | |||
182 | #if __USER32_DS != __USER_DS | ||
183 | # error "The following code assumes __USER32_DS == __USER_DS" | ||
184 | diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h | ||
185 | index 373058c9b75d..4c481e751e8e 100644 | ||
186 | --- a/arch/x86/include/asm/kvm_host.h | ||
187 | +++ b/arch/x86/include/asm/kvm_host.h | ||
188 | @@ -953,6 +953,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code) | ||
189 | kvm_queue_exception_e(vcpu, GP_VECTOR, error_code); | ||
190 | } | ||
191 | |||
192 | +static inline u64 get_canonical(u64 la) | ||
193 | +{ | ||
194 | + return ((int64_t)la << 16) >> 16; | ||
195 | +} | ||
196 | + | ||
197 | +static inline bool is_noncanonical_address(u64 la) | ||
198 | +{ | ||
199 | +#ifdef CONFIG_X86_64 | ||
200 | + return get_canonical(la) != la; | ||
201 | +#else | ||
202 | + return false; | ||
203 | +#endif | ||
204 | +} | ||
205 | + | ||
206 | #define TSS_IOPB_BASE_OFFSET 0x66 | ||
207 | #define TSS_BASE_SIZE 0x68 | ||
208 | #define TSS_IOPB_SIZE (65536 / 8) | ||
209 | @@ -1011,7 +1025,7 @@ int kvm_cpu_get_interrupt(struct kvm_vcpu *v); | ||
210 | void kvm_vcpu_reset(struct kvm_vcpu *vcpu); | ||
211 | |||
212 | void kvm_define_shared_msr(unsigned index, u32 msr); | ||
213 | -void kvm_set_shared_msr(unsigned index, u64 val, u64 mask); | ||
214 | +int kvm_set_shared_msr(unsigned index, u64 val, u64 mask); | ||
215 | |||
216 | bool kvm_is_linear_rip(struct kvm_vcpu *vcpu, unsigned long linear_rip); | ||
217 | |||
218 | diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h | ||
219 | index 54991a746043..b16e6d28f149 100644 | ||
220 | --- a/arch/x86/include/uapi/asm/processor-flags.h | ||
221 | +++ b/arch/x86/include/uapi/asm/processor-flags.h | ||
222 | @@ -6,7 +6,7 @@ | ||
223 | * EFLAGS bits | ||
224 | */ | ||
225 | #define X86_EFLAGS_CF 0x00000001 /* Carry Flag */ | ||
226 | -#define X86_EFLAGS_BIT1 0x00000002 /* Bit 1 - always on */ | ||
227 | +#define X86_EFLAGS_FIXED 0x00000002 /* Bit 1 - always on */ | ||
228 | #define X86_EFLAGS_PF 0x00000004 /* Parity Flag */ | ||
229 | #define X86_EFLAGS_AF 0x00000010 /* Auxiliary carry Flag */ | ||
230 | #define X86_EFLAGS_ZF 0x00000040 /* Zero Flag */ | ||
231 | diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c | ||
232 | index 904611bf0e5a..033eb44dc661 100644 | ||
233 | --- a/arch/x86/kernel/apic/apic.c | ||
234 | +++ b/arch/x86/kernel/apic/apic.c | ||
235 | @@ -1263,7 +1263,7 @@ void __cpuinit setup_local_APIC(void) | ||
236 | unsigned int value, queued; | ||
237 | int i, j, acked = 0; | ||
238 | unsigned long long tsc = 0, ntsc; | ||
239 | - long long max_loops = cpu_khz; | ||
240 | + long long max_loops = cpu_khz ? cpu_khz : 1000000; | ||
241 | |||
242 | if (cpu_has_tsc) | ||
243 | rdtscll(tsc); | ||
244 | @@ -1360,7 +1360,7 @@ void __cpuinit setup_local_APIC(void) | ||
245 | break; | ||
246 | } | ||
247 | if (queued) { | ||
248 | - if (cpu_has_tsc) { | ||
249 | + if (cpu_has_tsc && cpu_khz) { | ||
250 | rdtscll(ntsc); | ||
251 | max_loops = (cpu_khz << 10) - (ntsc - tsc); | ||
252 | } else | ||
253 | diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c | ||
254 | index deeb48d9459b..6a7e3e9cffc3 100644 | ||
255 | --- a/arch/x86/kernel/cpu/common.c | ||
256 | +++ b/arch/x86/kernel/cpu/common.c | ||
257 | @@ -1134,7 +1134,7 @@ void syscall_init(void) | ||
258 | /* Flags to clear on syscall */ | ||
259 | wrmsrl(MSR_SYSCALL_MASK, | ||
260 | X86_EFLAGS_TF|X86_EFLAGS_DF|X86_EFLAGS_IF| | ||
261 | - X86_EFLAGS_IOPL|X86_EFLAGS_AC); | ||
262 | + X86_EFLAGS_IOPL|X86_EFLAGS_AC|X86_EFLAGS_NT); | ||
263 | } | ||
264 | |||
265 | /* | ||
266 | diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S | ||
267 | index 39ba6914bbc6..8c6b5c2284c7 100644 | ||
268 | --- a/arch/x86/kernel/entry_64.S | ||
269 | +++ b/arch/x86/kernel/entry_64.S | ||
270 | @@ -366,7 +366,7 @@ ENDPROC(native_usergs_sysret64) | ||
271 | /*CFI_REL_OFFSET ss,0*/ | ||
272 | pushq_cfi %rax /* rsp */ | ||
273 | CFI_REL_OFFSET rsp,0 | ||
274 | - pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_BIT1) /* eflags - interrupts on */ | ||
275 | + pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) /* eflags - interrupts on */ | ||
276 | /*CFI_REL_OFFSET rflags,0*/ | ||
277 | pushq_cfi $__KERNEL_CS /* cs */ | ||
278 | /*CFI_REL_OFFSET cs,0*/ | ||
279 | diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c | ||
280 | index 7305f7dfc7ab..0339f5c14bf9 100644 | ||
281 | --- a/arch/x86/kernel/process_32.c | ||
282 | +++ b/arch/x86/kernel/process_32.c | ||
283 | @@ -147,7 +147,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, | ||
284 | childregs->bp = arg; | ||
285 | childregs->orig_ax = -1; | ||
286 | childregs->cs = __KERNEL_CS | get_kernel_rpl(); | ||
287 | - childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_BIT1; | ||
288 | + childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_FIXED; | ||
289 | p->fpu_counter = 0; | ||
290 | p->thread.io_bitmap_ptr = NULL; | ||
291 | memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps)); | ||
292 | diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c | ||
293 | index 355ae06dbf94..f99a242730e9 100644 | ||
294 | --- a/arch/x86/kernel/process_64.c | ||
295 | +++ b/arch/x86/kernel/process_64.c | ||
296 | @@ -176,7 +176,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, | ||
297 | childregs->bp = arg; | ||
298 | childregs->orig_ax = -1; | ||
299 | childregs->cs = __KERNEL_CS | get_kernel_rpl(); | ||
300 | - childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_BIT1; | ||
301 | + childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_FIXED; | ||
302 | return 0; | ||
303 | } | ||
304 | *childregs = *current_pt_regs(); | ||
305 | diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c | ||
306 | index 087ab2af381a..66deef41512f 100644 | ||
307 | --- a/arch/x86/kernel/signal.c | ||
308 | +++ b/arch/x86/kernel/signal.c | ||
309 | @@ -677,6 +677,11 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs) | ||
310 | * handler too. | ||
311 | */ | ||
312 | regs->flags &= ~X86_EFLAGS_TF; | ||
313 | + /* | ||
314 | + * Ensure the signal handler starts with the new fpu state. | ||
315 | + */ | ||
316 | + if (used_math()) | ||
317 | + drop_init_fpu(current); | ||
318 | } | ||
319 | signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP)); | ||
320 | } | ||
321 | diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c | ||
322 | index 098b3cfda72e..4e27ba53c40c 100644 | ||
323 | --- a/arch/x86/kernel/tsc.c | ||
324 | +++ b/arch/x86/kernel/tsc.c | ||
325 | @@ -968,14 +968,17 @@ void __init tsc_init(void) | ||
326 | |||
327 | x86_init.timers.tsc_pre_init(); | ||
328 | |||
329 | - if (!cpu_has_tsc) | ||
330 | + if (!cpu_has_tsc) { | ||
331 | + setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); | ||
332 | return; | ||
333 | + } | ||
334 | |||
335 | tsc_khz = x86_platform.calibrate_tsc(); | ||
336 | cpu_khz = tsc_khz; | ||
337 | |||
338 | if (!tsc_khz) { | ||
339 | mark_tsc_unstable("could not calculate TSC khz"); | ||
340 | + setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); | ||
341 | return; | ||
342 | } | ||
343 | |||
344 | diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c | ||
345 | index ada87a329edc..1ee723298e90 100644 | ||
346 | --- a/arch/x86/kernel/xsave.c | ||
347 | +++ b/arch/x86/kernel/xsave.c | ||
348 | @@ -268,8 +268,6 @@ int save_xstate_sig(void __user *buf, void __user *buf_fx, int size) | ||
349 | if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate)) | ||
350 | return -1; | ||
351 | |||
352 | - drop_init_fpu(tsk); /* trigger finit */ | ||
353 | - | ||
354 | return 0; | ||
355 | } | ||
356 | |||
357 | @@ -400,8 +398,11 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size) | ||
358 | set_used_math(); | ||
359 | } | ||
360 | |||
361 | - if (use_eager_fpu()) | ||
362 | + if (use_eager_fpu()) { | ||
363 | + preempt_disable(); | ||
364 | math_state_restore(); | ||
365 | + preempt_enable(); | ||
366 | + } | ||
367 | |||
368 | return err; | ||
369 | } else { | ||
370 | diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c | ||
371 | index fb3fddc322f8..4c01f022c6ac 100644 | ||
372 | --- a/arch/x86/kvm/emulate.c | ||
373 | +++ b/arch/x86/kvm/emulate.c | ||
374 | @@ -663,11 +663,6 @@ static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc) | ||
375 | masked_increment(reg_rmw(ctxt, VCPU_REGS_RSP), stack_mask(ctxt), inc); | ||
376 | } | ||
377 | |||
378 | -static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) | ||
379 | -{ | ||
380 | - register_address_increment(ctxt, &ctxt->_eip, rel); | ||
381 | -} | ||
382 | - | ||
383 | static u32 desc_limit_scaled(struct desc_struct *desc) | ||
384 | { | ||
385 | u32 limit = get_desc_limit(desc); | ||
386 | @@ -741,6 +736,38 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt) | ||
387 | return emulate_exception(ctxt, NM_VECTOR, 0, false); | ||
388 | } | ||
389 | |||
390 | +static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst, | ||
391 | + int cs_l) | ||
392 | +{ | ||
393 | + switch (ctxt->op_bytes) { | ||
394 | + case 2: | ||
395 | + ctxt->_eip = (u16)dst; | ||
396 | + break; | ||
397 | + case 4: | ||
398 | + ctxt->_eip = (u32)dst; | ||
399 | + break; | ||
400 | + case 8: | ||
401 | + if ((cs_l && is_noncanonical_address(dst)) || | ||
402 | + (!cs_l && (dst & ~(u32)-1))) | ||
403 | + return emulate_gp(ctxt, 0); | ||
404 | + ctxt->_eip = dst; | ||
405 | + break; | ||
406 | + default: | ||
407 | + WARN(1, "unsupported eip assignment size\n"); | ||
408 | + } | ||
409 | + return X86EMUL_CONTINUE; | ||
410 | +} | ||
411 | + | ||
412 | +static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst) | ||
413 | +{ | ||
414 | + return assign_eip_far(ctxt, dst, ctxt->mode == X86EMUL_MODE_PROT64); | ||
415 | +} | ||
416 | + | ||
417 | +static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) | ||
418 | +{ | ||
419 | + return assign_eip_near(ctxt, ctxt->_eip + rel); | ||
420 | +} | ||
421 | + | ||
422 | static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg) | ||
423 | { | ||
424 | u16 selector; | ||
425 | @@ -2161,13 +2188,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt) | ||
426 | case 2: /* call near abs */ { | ||
427 | long int old_eip; | ||
428 | old_eip = ctxt->_eip; | ||
429 | - ctxt->_eip = ctxt->src.val; | ||
430 | + rc = assign_eip_near(ctxt, ctxt->src.val); | ||
431 | + if (rc != X86EMUL_CONTINUE) | ||
432 | + break; | ||
433 | ctxt->src.val = old_eip; | ||
434 | rc = em_push(ctxt); | ||
435 | break; | ||
436 | } | ||
437 | case 4: /* jmp abs */ | ||
438 | - ctxt->_eip = ctxt->src.val; | ||
439 | + rc = assign_eip_near(ctxt, ctxt->src.val); | ||
440 | break; | ||
441 | case 5: /* jmp far */ | ||
442 | rc = em_jmp_far(ctxt); | ||
443 | @@ -2199,10 +2228,14 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt) | ||
444 | |||
445 | static int em_ret(struct x86_emulate_ctxt *ctxt) | ||
446 | { | ||
447 | - ctxt->dst.type = OP_REG; | ||
448 | - ctxt->dst.addr.reg = &ctxt->_eip; | ||
449 | - ctxt->dst.bytes = ctxt->op_bytes; | ||
450 | - return em_pop(ctxt); | ||
451 | + int rc; | ||
452 | + unsigned long eip; | ||
453 | + | ||
454 | + rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); | ||
455 | + if (rc != X86EMUL_CONTINUE) | ||
456 | + return rc; | ||
457 | + | ||
458 | + return assign_eip_near(ctxt, eip); | ||
459 | } | ||
460 | |||
461 | static int em_ret_far(struct x86_emulate_ctxt *ctxt) | ||
462 | @@ -2469,7 +2502,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) | ||
463 | { | ||
464 | const struct x86_emulate_ops *ops = ctxt->ops; | ||
465 | struct desc_struct cs, ss; | ||
466 | - u64 msr_data; | ||
467 | + u64 msr_data, rcx, rdx; | ||
468 | int usermode; | ||
469 | u16 cs_sel = 0, ss_sel = 0; | ||
470 | |||
471 | @@ -2485,6 +2518,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) | ||
472 | else | ||
473 | usermode = X86EMUL_MODE_PROT32; | ||
474 | |||
475 | + rcx = reg_read(ctxt, VCPU_REGS_RCX); | ||
476 | + rdx = reg_read(ctxt, VCPU_REGS_RDX); | ||
477 | + | ||
478 | cs.dpl = 3; | ||
479 | ss.dpl = 3; | ||
480 | ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data); | ||
481 | @@ -2502,6 +2538,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) | ||
482 | ss_sel = cs_sel + 8; | ||
483 | cs.d = 0; | ||
484 | cs.l = 1; | ||
485 | + if (is_noncanonical_address(rcx) || | ||
486 | + is_noncanonical_address(rdx)) | ||
487 | + return emulate_gp(ctxt, 0); | ||
488 | break; | ||
489 | } | ||
490 | cs_sel |= SELECTOR_RPL_MASK; | ||
491 | @@ -2510,8 +2549,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) | ||
492 | ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS); | ||
493 | ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS); | ||
494 | |||
495 | - ctxt->_eip = reg_read(ctxt, VCPU_REGS_RDX); | ||
496 | - *reg_write(ctxt, VCPU_REGS_RSP) = reg_read(ctxt, VCPU_REGS_RCX); | ||
497 | + ctxt->_eip = rdx; | ||
498 | + *reg_write(ctxt, VCPU_REGS_RSP) = rcx; | ||
499 | |||
500 | return X86EMUL_CONTINUE; | ||
501 | } | ||
502 | @@ -3050,10 +3089,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt) | ||
503 | |||
504 | static int em_call(struct x86_emulate_ctxt *ctxt) | ||
505 | { | ||
506 | + int rc; | ||
507 | long rel = ctxt->src.val; | ||
508 | |||
509 | ctxt->src.val = (unsigned long)ctxt->_eip; | ||
510 | - jmp_rel(ctxt, rel); | ||
511 | + rc = jmp_rel(ctxt, rel); | ||
512 | + if (rc != X86EMUL_CONTINUE) | ||
513 | + return rc; | ||
514 | return em_push(ctxt); | ||
515 | } | ||
516 | |||
517 | @@ -3085,11 +3127,12 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt) | ||
518 | static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt) | ||
519 | { | ||
520 | int rc; | ||
521 | + unsigned long eip; | ||
522 | |||
523 | - ctxt->dst.type = OP_REG; | ||
524 | - ctxt->dst.addr.reg = &ctxt->_eip; | ||
525 | - ctxt->dst.bytes = ctxt->op_bytes; | ||
526 | - rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes); | ||
527 | + rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); | ||
528 | + if (rc != X86EMUL_CONTINUE) | ||
529 | + return rc; | ||
530 | + rc = assign_eip_near(ctxt, eip); | ||
531 | if (rc != X86EMUL_CONTINUE) | ||
532 | return rc; | ||
533 | rsp_increment(ctxt, ctxt->src.val); | ||
534 | @@ -3379,20 +3422,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt) | ||
535 | |||
536 | static int em_loop(struct x86_emulate_ctxt *ctxt) | ||
537 | { | ||
538 | + int rc = X86EMUL_CONTINUE; | ||
539 | + | ||
540 | register_address_increment(ctxt, reg_rmw(ctxt, VCPU_REGS_RCX), -1); | ||
541 | if ((address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) != 0) && | ||
542 | (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags))) | ||
543 | - jmp_rel(ctxt, ctxt->src.val); | ||
544 | + rc = jmp_rel(ctxt, ctxt->src.val); | ||
545 | |||
546 | - return X86EMUL_CONTINUE; | ||
547 | + return rc; | ||
548 | } | ||
549 | |||
550 | static int em_jcxz(struct x86_emulate_ctxt *ctxt) | ||
551 | { | ||
552 | + int rc = X86EMUL_CONTINUE; | ||
553 | + | ||
554 | if (address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) == 0) | ||
555 | - jmp_rel(ctxt, ctxt->src.val); | ||
556 | + rc = jmp_rel(ctxt, ctxt->src.val); | ||
557 | |||
558 | - return X86EMUL_CONTINUE; | ||
559 | + return rc; | ||
560 | } | ||
561 | |||
562 | static int em_in(struct x86_emulate_ctxt *ctxt) | ||
563 | @@ -4721,7 +4768,7 @@ special_insn: | ||
564 | break; | ||
565 | case 0x70 ... 0x7f: /* jcc (short) */ | ||
566 | if (test_cc(ctxt->b, ctxt->eflags)) | ||
567 | - jmp_rel(ctxt, ctxt->src.val); | ||
568 | + rc = jmp_rel(ctxt, ctxt->src.val); | ||
569 | break; | ||
570 | case 0x8d: /* lea r16/r32, m */ | ||
571 | ctxt->dst.val = ctxt->src.addr.mem.ea; | ||
572 | @@ -4750,7 +4797,7 @@ special_insn: | ||
573 | break; | ||
574 | case 0xe9: /* jmp rel */ | ||
575 | case 0xeb: /* jmp rel short */ | ||
576 | - jmp_rel(ctxt, ctxt->src.val); | ||
577 | + rc = jmp_rel(ctxt, ctxt->src.val); | ||
578 | ctxt->dst.type = OP_NONE; /* Disable writeback. */ | ||
579 | break; | ||
580 | case 0xf4: /* hlt */ | ||
581 | @@ -4862,7 +4909,7 @@ twobyte_insn: | ||
582 | break; | ||
583 | case 0x80 ... 0x8f: /* jnz rel, etc*/ | ||
584 | if (test_cc(ctxt->b, ctxt->eflags)) | ||
585 | - jmp_rel(ctxt, ctxt->src.val); | ||
586 | + rc = jmp_rel(ctxt, ctxt->src.val); | ||
587 | break; | ||
588 | case 0x90 ... 0x9f: /* setcc r/m8 */ | ||
589 | ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags); | ||
590 | diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c | ||
591 | index 518d86471b76..298781d4cfb4 100644 | ||
592 | --- a/arch/x86/kvm/i8254.c | ||
593 | +++ b/arch/x86/kvm/i8254.c | ||
594 | @@ -262,8 +262,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu) | ||
595 | return; | ||
596 | |||
597 | timer = &pit->pit_state.timer; | ||
598 | + mutex_lock(&pit->pit_state.lock); | ||
599 | if (hrtimer_cancel(timer)) | ||
600 | hrtimer_start_expires(timer, HRTIMER_MODE_ABS); | ||
601 | + mutex_unlock(&pit->pit_state.lock); | ||
602 | } | ||
603 | |||
604 | static void destroy_pit_timer(struct kvm_pit *pit) | ||
605 | diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c | ||
606 | index 765210d4d925..8bf40a243d75 100644 | ||
607 | --- a/arch/x86/kvm/svm.c | ||
608 | +++ b/arch/x86/kvm/svm.c | ||
609 | @@ -3196,7 +3196,7 @@ static int wrmsr_interception(struct vcpu_svm *svm) | ||
610 | msr.host_initiated = false; | ||
611 | |||
612 | svm->next_rip = kvm_rip_read(&svm->vcpu) + 2; | ||
613 | - if (svm_set_msr(&svm->vcpu, &msr)) { | ||
614 | + if (kvm_set_msr(&svm->vcpu, &msr)) { | ||
615 | trace_kvm_msr_write_ex(ecx, data); | ||
616 | kvm_inject_gp(&svm->vcpu, 0); | ||
617 | } else { | ||
618 | @@ -3478,9 +3478,9 @@ static int handle_exit(struct kvm_vcpu *vcpu) | ||
619 | |||
620 | if (exit_code >= ARRAY_SIZE(svm_exit_handlers) | ||
621 | || !svm_exit_handlers[exit_code]) { | ||
622 | - kvm_run->exit_reason = KVM_EXIT_UNKNOWN; | ||
623 | - kvm_run->hw.hardware_exit_reason = exit_code; | ||
624 | - return 0; | ||
625 | + WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_code); | ||
626 | + kvm_queue_exception(vcpu, UD_VECTOR); | ||
627 | + return 1; | ||
628 | } | ||
629 | |||
630 | return svm_exit_handlers[exit_code](svm); | ||
631 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c | ||
632 | index 7cdafb6dc705..51139ff34917 100644 | ||
633 | --- a/arch/x86/kvm/vmx.c | ||
634 | +++ b/arch/x86/kvm/vmx.c | ||
635 | @@ -2493,12 +2493,15 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) | ||
636 | break; | ||
637 | msr = find_msr_entry(vmx, msr_index); | ||
638 | if (msr) { | ||
639 | + u64 old_msr_data = msr->data; | ||
640 | msr->data = data; | ||
641 | if (msr - vmx->guest_msrs < vmx->save_nmsrs) { | ||
642 | preempt_disable(); | ||
643 | - kvm_set_shared_msr(msr->index, msr->data, | ||
644 | - msr->mask); | ||
645 | + ret = kvm_set_shared_msr(msr->index, msr->data, | ||
646 | + msr->mask); | ||
647 | preempt_enable(); | ||
648 | + if (ret) | ||
649 | + msr->data = old_msr_data; | ||
650 | } | ||
651 | break; | ||
652 | } | ||
653 | @@ -5062,7 +5065,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu) | ||
654 | msr.data = data; | ||
655 | msr.index = ecx; | ||
656 | msr.host_initiated = false; | ||
657 | - if (vmx_set_msr(vcpu, &msr) != 0) { | ||
658 | + if (kvm_set_msr(vcpu, &msr) != 0) { | ||
659 | trace_kvm_msr_write_ex(ecx, data); | ||
660 | kvm_inject_gp(vcpu, 0); | ||
661 | return 1; | ||
662 | @@ -6651,10 +6654,10 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) | ||
663 | && kvm_vmx_exit_handlers[exit_reason]) | ||
664 | return kvm_vmx_exit_handlers[exit_reason](vcpu); | ||
665 | else { | ||
666 | - vcpu->run->exit_reason = KVM_EXIT_UNKNOWN; | ||
667 | - vcpu->run->hw.hardware_exit_reason = exit_reason; | ||
668 | + WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason); | ||
669 | + kvm_queue_exception(vcpu, UD_VECTOR); | ||
670 | + return 1; | ||
671 | } | ||
672 | - return 0; | ||
673 | } | ||
674 | |||
675 | static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) | ||
676 | @@ -7949,7 +7952,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, | ||
677 | |||
678 | kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->host_rsp); | ||
679 | kvm_register_write(vcpu, VCPU_REGS_RIP, vmcs12->host_rip); | ||
680 | - vmx_set_rflags(vcpu, X86_EFLAGS_BIT1); | ||
681 | + vmx_set_rflags(vcpu, X86_EFLAGS_FIXED); | ||
682 | /* | ||
683 | * Note that calling vmx_set_cr0 is important, even if cr0 hasn't | ||
684 | * actually changed, because it depends on the current state of | ||
685 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c | ||
686 | index e8753555f144..684f46dc87de 100644 | ||
687 | --- a/arch/x86/kvm/x86.c | ||
688 | +++ b/arch/x86/kvm/x86.c | ||
689 | @@ -225,20 +225,25 @@ static void kvm_shared_msr_cpu_online(void) | ||
690 | shared_msr_update(i, shared_msrs_global.msrs[i]); | ||
691 | } | ||
692 | |||
693 | -void kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) | ||
694 | +int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) | ||
695 | { | ||
696 | unsigned int cpu = smp_processor_id(); | ||
697 | struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); | ||
698 | + int err; | ||
699 | |||
700 | if (((value ^ smsr->values[slot].curr) & mask) == 0) | ||
701 | - return; | ||
702 | + return 0; | ||
703 | smsr->values[slot].curr = value; | ||
704 | - wrmsrl(shared_msrs_global.msrs[slot], value); | ||
705 | + err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); | ||
706 | + if (err) | ||
707 | + return 1; | ||
708 | + | ||
709 | if (!smsr->registered) { | ||
710 | smsr->urn.on_user_return = kvm_on_user_return; | ||
711 | user_return_notifier_register(&smsr->urn); | ||
712 | smsr->registered = true; | ||
713 | } | ||
714 | + return 0; | ||
715 | } | ||
716 | EXPORT_SYMBOL_GPL(kvm_set_shared_msr); | ||
717 | |||
718 | @@ -920,7 +925,6 @@ void kvm_enable_efer_bits(u64 mask) | ||
719 | } | ||
720 | EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); | ||
721 | |||
722 | - | ||
723 | /* | ||
724 | * Writes msr value into into the appropriate "register". | ||
725 | * Returns 0 on success, non-0 otherwise. | ||
726 | @@ -928,8 +932,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); | ||
727 | */ | ||
728 | int kvm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) | ||
729 | { | ||
730 | + switch (msr->index) { | ||
731 | + case MSR_FS_BASE: | ||
732 | + case MSR_GS_BASE: | ||
733 | + case MSR_KERNEL_GS_BASE: | ||
734 | + case MSR_CSTAR: | ||
735 | + case MSR_LSTAR: | ||
736 | + if (is_noncanonical_address(msr->data)) | ||
737 | + return 1; | ||
738 | + break; | ||
739 | + case MSR_IA32_SYSENTER_EIP: | ||
740 | + case MSR_IA32_SYSENTER_ESP: | ||
741 | + /* | ||
742 | + * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if | ||
743 | + * non-canonical address is written on Intel but not on | ||
744 | + * AMD (which ignores the top 32-bits, because it does | ||
745 | + * not implement 64-bit SYSENTER). | ||
746 | + * | ||
747 | + * 64-bit code should hence be able to write a non-canonical | ||
748 | + * value on AMD. Making the address canonical ensures that | ||
749 | + * vmentry does not fail on Intel after writing a non-canonical | ||
750 | + * value, and that something deterministic happens if the guest | ||
751 | + * invokes 64-bit SYSENTER. | ||
752 | + */ | ||
753 | + msr->data = get_canonical(msr->data); | ||
754 | + } | ||
755 | return kvm_x86_ops->set_msr(vcpu, msr); | ||
756 | } | ||
757 | +EXPORT_SYMBOL_GPL(kvm_set_msr); | ||
758 | |||
759 | /* | ||
760 | * Adapt set_msr() to msr_io()'s calling convention | ||
761 | diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c | ||
762 | index bb32480c2d71..aabdf762f592 100644 | ||
763 | --- a/arch/x86/mm/pageattr.c | ||
764 | +++ b/arch/x86/mm/pageattr.c | ||
765 | @@ -389,7 +389,7 @@ phys_addr_t slow_virt_to_phys(void *__virt_addr) | ||
766 | psize = page_level_size(level); | ||
767 | pmask = page_level_mask(level); | ||
768 | offset = virt_addr & ~pmask; | ||
769 | - phys_addr = pte_pfn(*pte) << PAGE_SHIFT; | ||
770 | + phys_addr = (phys_addr_t)pte_pfn(*pte) << PAGE_SHIFT; | ||
771 | return (phys_addr | offset); | ||
772 | } | ||
773 | EXPORT_SYMBOL_GPL(slow_virt_to_phys); | ||
774 | diff --git a/block/blk-settings.c b/block/blk-settings.c | ||
775 | index 53309333c2f0..ec00a0f75212 100644 | ||
776 | --- a/block/blk-settings.c | ||
777 | +++ b/block/blk-settings.c | ||
778 | @@ -553,7 +553,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, | ||
779 | bottom = max(b->physical_block_size, b->io_min) + alignment; | ||
780 | |||
781 | /* Verify that top and bottom intervals line up */ | ||
782 | - if (max(top, bottom) & (min(top, bottom) - 1)) { | ||
783 | + if (max(top, bottom) % min(top, bottom)) { | ||
784 | t->misaligned = 1; | ||
785 | ret = -1; | ||
786 | } | ||
787 | @@ -594,7 +594,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, | ||
788 | |||
789 | /* Find lowest common alignment_offset */ | ||
790 | t->alignment_offset = lcm(t->alignment_offset, alignment) | ||
791 | - & (max(t->physical_block_size, t->io_min) - 1); | ||
792 | + % max(t->physical_block_size, t->io_min); | ||
793 | |||
794 | /* Verify that new alignment_offset is on a logical block boundary */ | ||
795 | if (t->alignment_offset & (t->logical_block_size - 1)) { | ||
796 | diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c | ||
797 | index a5ffcc988f0b..1b4988b4bc11 100644 | ||
798 | --- a/block/scsi_ioctl.c | ||
799 | +++ b/block/scsi_ioctl.c | ||
800 | @@ -506,7 +506,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, | ||
801 | |||
802 | if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { | ||
803 | err = DRIVER_ERROR << 24; | ||
804 | - goto out; | ||
805 | + goto error; | ||
806 | } | ||
807 | |||
808 | memset(sense, 0, sizeof(sense)); | ||
809 | @@ -516,7 +516,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, | ||
810 | |||
811 | blk_execute_rq(q, disk, rq, 0); | ||
812 | |||
813 | -out: | ||
814 | err = rq->errors & 0xff; /* only 8 bit SCSI status */ | ||
815 | if (err) { | ||
816 | if (rq->sense_len && rq->sense) { | ||
817 | diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c | ||
818 | index a19c027b29bd..83187f497c7c 100644 | ||
819 | --- a/crypto/algif_skcipher.c | ||
820 | +++ b/crypto/algif_skcipher.c | ||
821 | @@ -49,7 +49,7 @@ struct skcipher_ctx { | ||
822 | struct ablkcipher_request req; | ||
823 | }; | ||
824 | |||
825 | -#define MAX_SGL_ENTS ((PAGE_SIZE - sizeof(struct skcipher_sg_list)) / \ | ||
826 | +#define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \ | ||
827 | sizeof(struct scatterlist) - 1) | ||
828 | |||
829 | static inline int skcipher_sndbuf(struct sock *sk) | ||
830 | diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c | ||
831 | index b603720b877d..37acda6fa7e4 100644 | ||
832 | --- a/drivers/ata/libata-sff.c | ||
833 | +++ b/drivers/ata/libata-sff.c | ||
834 | @@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask, | ||
835 | |||
836 | DPRINTK("ata%u: bus reset via SRST\n", ap->print_id); | ||
837 | |||
838 | - /* software reset. causes dev0 to be selected */ | ||
839 | - iowrite8(ap->ctl, ioaddr->ctl_addr); | ||
840 | - udelay(20); /* FIXME: flush */ | ||
841 | - iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); | ||
842 | - udelay(20); /* FIXME: flush */ | ||
843 | - iowrite8(ap->ctl, ioaddr->ctl_addr); | ||
844 | - ap->last_ctl = ap->ctl; | ||
845 | + if (ap->ioaddr.ctl_addr) { | ||
846 | + /* software reset. causes dev0 to be selected */ | ||
847 | + iowrite8(ap->ctl, ioaddr->ctl_addr); | ||
848 | + udelay(20); /* FIXME: flush */ | ||
849 | + iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); | ||
850 | + udelay(20); /* FIXME: flush */ | ||
851 | + iowrite8(ap->ctl, ioaddr->ctl_addr); | ||
852 | + ap->last_ctl = ap->ctl; | ||
853 | + } | ||
854 | |||
855 | /* wait the port to become ready */ | ||
856 | return ata_sff_wait_after_reset(&ap->link, devmask, deadline); | ||
857 | @@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_port *ap) | ||
858 | |||
859 | spin_unlock_irqrestore(ap->lock, flags); | ||
860 | |||
861 | - /* ignore ata_sff_softreset if ctl isn't accessible */ | ||
862 | - if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr) | ||
863 | - softreset = NULL; | ||
864 | - | ||
865 | /* ignore built-in hardresets if SCR access is not available */ | ||
866 | if ((hardreset == sata_std_hardreset || | ||
867 | hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link)) | ||
868 | diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c | ||
869 | index f3febbce6c46..34c91ac3a814 100644 | ||
870 | --- a/drivers/ata/pata_serverworks.c | ||
871 | +++ b/drivers/ata/pata_serverworks.c | ||
872 | @@ -252,12 +252,18 @@ static void serverworks_set_dmamode(struct ata_port *ap, struct ata_device *adev | ||
873 | pci_write_config_byte(pdev, 0x54, ultra_cfg); | ||
874 | } | ||
875 | |||
876 | -static struct scsi_host_template serverworks_sht = { | ||
877 | +static struct scsi_host_template serverworks_osb4_sht = { | ||
878 | + ATA_BMDMA_SHT(DRV_NAME), | ||
879 | + .sg_tablesize = LIBATA_DUMB_MAX_PRD, | ||
880 | +}; | ||
881 | + | ||
882 | +static struct scsi_host_template serverworks_csb_sht = { | ||
883 | ATA_BMDMA_SHT(DRV_NAME), | ||
884 | }; | ||
885 | |||
886 | static struct ata_port_operations serverworks_osb4_port_ops = { | ||
887 | .inherits = &ata_bmdma_port_ops, | ||
888 | + .qc_prep = ata_bmdma_dumb_qc_prep, | ||
889 | .cable_detect = serverworks_cable_detect, | ||
890 | .mode_filter = serverworks_osb4_filter, | ||
891 | .set_piomode = serverworks_set_piomode, | ||
892 | @@ -266,6 +272,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = { | ||
893 | |||
894 | static struct ata_port_operations serverworks_csb_port_ops = { | ||
895 | .inherits = &serverworks_osb4_port_ops, | ||
896 | + .qc_prep = ata_bmdma_qc_prep, | ||
897 | .mode_filter = serverworks_csb_filter, | ||
898 | }; | ||
899 | |||
900 | @@ -405,6 +412,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id | ||
901 | } | ||
902 | }; | ||
903 | const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL }; | ||
904 | + struct scsi_host_template *sht = &serverworks_csb_sht; | ||
905 | int rc; | ||
906 | |||
907 | rc = pcim_enable_device(pdev); | ||
908 | @@ -418,6 +426,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id | ||
909 | /* Select non UDMA capable OSB4 if we can't do fixups */ | ||
910 | if (rc < 0) | ||
911 | ppi[0] = &info[1]; | ||
912 | + sht = &serverworks_osb4_sht; | ||
913 | } | ||
914 | /* setup CSB5/CSB6 : South Bridge and IDE option RAID */ | ||
915 | else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) || | ||
916 | @@ -434,7 +443,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id | ||
917 | ppi[1] = &ata_dummy_port_info; | ||
918 | } | ||
919 | |||
920 | - return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0); | ||
921 | + return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0); | ||
922 | } | ||
923 | |||
924 | #ifdef CONFIG_PM | ||
925 | diff --git a/drivers/base/core.c b/drivers/base/core.c | ||
926 | index ca4bcb8b3938..2a19097a7cb1 100644 | ||
927 | --- a/drivers/base/core.c | ||
928 | +++ b/drivers/base/core.c | ||
929 | @@ -765,12 +765,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) | ||
930 | return &dir->kobj; | ||
931 | } | ||
932 | |||
933 | +static DEFINE_MUTEX(gdp_mutex); | ||
934 | |||
935 | static struct kobject *get_device_parent(struct device *dev, | ||
936 | struct device *parent) | ||
937 | { | ||
938 | if (dev->class) { | ||
939 | - static DEFINE_MUTEX(gdp_mutex); | ||
940 | struct kobject *kobj = NULL; | ||
941 | struct kobject *parent_kobj; | ||
942 | struct kobject *k; | ||
943 | @@ -834,7 +834,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) | ||
944 | glue_dir->kset != &dev->class->p->glue_dirs) | ||
945 | return; | ||
946 | |||
947 | + mutex_lock(&gdp_mutex); | ||
948 | kobject_put(glue_dir); | ||
949 | + mutex_unlock(&gdp_mutex); | ||
950 | } | ||
951 | |||
952 | static void cleanup_device_parent(struct device *dev) | ||
953 | diff --git a/drivers/block/drbd/drbd_interval.c b/drivers/block/drbd/drbd_interval.c | ||
954 | index 89c497c630b4..04a14e0f8878 100644 | ||
955 | --- a/drivers/block/drbd/drbd_interval.c | ||
956 | +++ b/drivers/block/drbd/drbd_interval.c | ||
957 | @@ -79,6 +79,7 @@ bool | ||
958 | drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) | ||
959 | { | ||
960 | struct rb_node **new = &root->rb_node, *parent = NULL; | ||
961 | + sector_t this_end = this->sector + (this->size >> 9); | ||
962 | |||
963 | BUG_ON(!IS_ALIGNED(this->size, 512)); | ||
964 | |||
965 | @@ -87,6 +88,8 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) | ||
966 | rb_entry(*new, struct drbd_interval, rb); | ||
967 | |||
968 | parent = *new; | ||
969 | + if (here->end < this_end) | ||
970 | + here->end = this_end; | ||
971 | if (this->sector < here->sector) | ||
972 | new = &(*new)->rb_left; | ||
973 | else if (this->sector > here->sector) | ||
974 | @@ -99,6 +102,7 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) | ||
975 | return false; | ||
976 | } | ||
977 | |||
978 | + this->end = this_end; | ||
979 | rb_link_node(&this->rb, parent, new); | ||
980 | rb_insert_augmented(&this->rb, root, &augment_callbacks); | ||
981 | return true; | ||
982 | diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c | ||
983 | index 07caf44d5755..9951e66b8502 100644 | ||
984 | --- a/drivers/block/rbd.c | ||
985 | +++ b/drivers/block/rbd.c | ||
986 | @@ -3227,7 +3227,7 @@ static int rbd_obj_read_sync(struct rbd_device *rbd_dev, | ||
987 | page_count = (u32) calc_pages_for(offset, length); | ||
988 | pages = ceph_alloc_page_vector(page_count, GFP_KERNEL); | ||
989 | if (IS_ERR(pages)) | ||
990 | - ret = PTR_ERR(pages); | ||
991 | + return PTR_ERR(pages); | ||
992 | |||
993 | ret = -ENOMEM; | ||
994 | obj_request = rbd_obj_request_create(object_name, offset, length, | ||
995 | diff --git a/drivers/char/random.c b/drivers/char/random.c | ||
996 | index 81eefa1c0d3f..aee3464a5bdc 100644 | ||
997 | --- a/drivers/char/random.c | ||
998 | +++ b/drivers/char/random.c | ||
999 | @@ -933,8 +933,8 @@ static void extract_buf(struct entropy_store *r, __u8 *out) | ||
1000 | * pool while mixing, and hash one final time. | ||
1001 | */ | ||
1002 | sha_transform(hash.w, extract, workspace); | ||
1003 | - memset(extract, 0, sizeof(extract)); | ||
1004 | - memset(workspace, 0, sizeof(workspace)); | ||
1005 | + memzero_explicit(extract, sizeof(extract)); | ||
1006 | + memzero_explicit(workspace, sizeof(workspace)); | ||
1007 | |||
1008 | /* | ||
1009 | * In case the hash function has some recognizable output | ||
1010 | @@ -957,7 +957,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out) | ||
1011 | } | ||
1012 | |||
1013 | memcpy(out, &hash, EXTRACT_SIZE); | ||
1014 | - memset(&hash, 0, sizeof(hash)); | ||
1015 | + memzero_explicit(&hash, sizeof(hash)); | ||
1016 | } | ||
1017 | |||
1018 | static ssize_t extract_entropy(struct entropy_store *r, void *buf, | ||
1019 | @@ -1005,7 +1005,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, | ||
1020 | } | ||
1021 | |||
1022 | /* Wipe data just returned from memory */ | ||
1023 | - memset(tmp, 0, sizeof(tmp)); | ||
1024 | + memzero_explicit(tmp, sizeof(tmp)); | ||
1025 | |||
1026 | return ret; | ||
1027 | } | ||
1028 | @@ -1043,7 +1043,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf, | ||
1029 | } | ||
1030 | |||
1031 | /* Wipe data just returned from memory */ | ||
1032 | - memset(tmp, 0, sizeof(tmp)); | ||
1033 | + memzero_explicit(tmp, sizeof(tmp)); | ||
1034 | |||
1035 | return ret; | ||
1036 | } | ||
1037 | diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c | ||
1038 | index 34d19b1984a1..decf84e71943 100644 | ||
1039 | --- a/drivers/cpufreq/intel_pstate.c | ||
1040 | +++ b/drivers/cpufreq/intel_pstate.c | ||
1041 | @@ -599,6 +599,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy) | ||
1042 | if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) { | ||
1043 | limits.min_perf_pct = 100; | ||
1044 | limits.min_perf = int_tofp(1); | ||
1045 | + limits.max_policy_pct = 100; | ||
1046 | limits.max_perf_pct = 100; | ||
1047 | limits.max_perf = int_tofp(1); | ||
1048 | limits.no_turbo = 0; | ||
1049 | diff --git a/drivers/edac/cpc925_edac.c b/drivers/edac/cpc925_edac.c | ||
1050 | index 7f3c57113ba1..1e08ce765f0c 100644 | ||
1051 | --- a/drivers/edac/cpc925_edac.c | ||
1052 | +++ b/drivers/edac/cpc925_edac.c | ||
1053 | @@ -562,7 +562,7 @@ static void cpc925_mc_check(struct mem_ctl_info *mci) | ||
1054 | |||
1055 | if (apiexcp & UECC_EXCP_DETECTED) { | ||
1056 | cpc925_mc_printk(mci, KERN_INFO, "DRAM UECC Fault\n"); | ||
1057 | - edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, | ||
1058 | + edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, | ||
1059 | pfn, offset, 0, | ||
1060 | csrow, -1, -1, | ||
1061 | mci->ctl_name, ""); | ||
1062 | diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c | ||
1063 | index 1c4056a50383..2697deae3ab7 100644 | ||
1064 | --- a/drivers/edac/e7xxx_edac.c | ||
1065 | +++ b/drivers/edac/e7xxx_edac.c | ||
1066 | @@ -226,7 +226,7 @@ static void process_ce(struct mem_ctl_info *mci, struct e7xxx_error_info *info) | ||
1067 | static void process_ce_no_info(struct mem_ctl_info *mci) | ||
1068 | { | ||
1069 | edac_dbg(3, "\n"); | ||
1070 | - edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, 0, 0, 0, -1, -1, -1, | ||
1071 | + edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, 0, 0, 0, -1, -1, -1, | ||
1072 | "e7xxx CE log register overflow", ""); | ||
1073 | } | ||
1074 | |||
1075 | diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c | ||
1076 | index aa44c1718f50..71b26513b93b 100644 | ||
1077 | --- a/drivers/edac/i3200_edac.c | ||
1078 | +++ b/drivers/edac/i3200_edac.c | ||
1079 | @@ -242,11 +242,11 @@ static void i3200_process_error_info(struct mem_ctl_info *mci, | ||
1080 | -1, -1, | ||
1081 | "i3000 UE", ""); | ||
1082 | } else if (log & I3200_ECCERRLOG_CE) { | ||
1083 | - edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, | ||
1084 | + edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, | ||
1085 | 0, 0, eccerrlog_syndrome(log), | ||
1086 | eccerrlog_row(channel, log), | ||
1087 | -1, -1, | ||
1088 | - "i3000 UE", ""); | ||
1089 | + "i3000 CE", ""); | ||
1090 | } | ||
1091 | } | ||
1092 | } | ||
1093 | diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c | ||
1094 | index 3e3e431c8301..b93b0d006ebb 100644 | ||
1095 | --- a/drivers/edac/i82860_edac.c | ||
1096 | +++ b/drivers/edac/i82860_edac.c | ||
1097 | @@ -124,7 +124,7 @@ static int i82860_process_error_info(struct mem_ctl_info *mci, | ||
1098 | dimm->location[0], dimm->location[1], -1, | ||
1099 | "i82860 UE", ""); | ||
1100 | else | ||
1101 | - edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, | ||
1102 | + edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, | ||
1103 | info->eap, 0, info->derrsyn, | ||
1104 | dimm->location[0], dimm->location[1], -1, | ||
1105 | "i82860 CE", ""); | ||
1106 | diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c | ||
1107 | index 7fc9f7272b56..e8f6418b6dec 100644 | ||
1108 | --- a/drivers/gpu/drm/ast/ast_mode.c | ||
1109 | +++ b/drivers/gpu/drm/ast/ast_mode.c | ||
1110 | @@ -1012,8 +1012,8 @@ static u32 copy_cursor_image(u8 *src, u8 *dst, int width, int height) | ||
1111 | srcdata32[1].ul = *((u32 *)(srcxor + 4)) & 0xf0f0f0f0; | ||
1112 | data32.b[0] = srcdata32[0].b[1] | (srcdata32[0].b[0] >> 4); | ||
1113 | data32.b[1] = srcdata32[0].b[3] | (srcdata32[0].b[2] >> 4); | ||
1114 | - data32.b[2] = srcdata32[0].b[1] | (srcdata32[1].b[0] >> 4); | ||
1115 | - data32.b[3] = srcdata32[0].b[3] | (srcdata32[1].b[2] >> 4); | ||
1116 | + data32.b[2] = srcdata32[1].b[1] | (srcdata32[1].b[0] >> 4); | ||
1117 | + data32.b[3] = srcdata32[1].b[3] | (srcdata32[1].b[2] >> 4); | ||
1118 | |||
1119 | writel(data32.ul, dstxor); | ||
1120 | csum += data32.ul; | ||
1121 | diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c | ||
1122 | index 2d9b9d7a7992..f3edd2841f2d 100644 | ||
1123 | --- a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c | ||
1124 | +++ b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c | ||
1125 | @@ -124,6 +124,7 @@ dcb_outp_parse(struct nouveau_bios *bios, u8 idx, u8 *ver, u8 *len, | ||
1126 | struct dcb_output *outp) | ||
1127 | { | ||
1128 | u16 dcb = dcb_outp(bios, idx, ver, len); | ||
1129 | + memset(outp, 0x00, sizeof(*outp)); | ||
1130 | if (dcb) { | ||
1131 | if (*ver >= 0x20) { | ||
1132 | u32 conn = nv_ro32(bios, dcb + 0x00); | ||
1133 | diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c | ||
1134 | index f060b7487c34..f5ddd3550796 100644 | ||
1135 | --- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c | ||
1136 | +++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c | ||
1137 | @@ -78,6 +78,7 @@ static int modeset_init(struct drm_device *dev) | ||
1138 | if ((priv->num_encoders == 0) || (priv->num_connectors == 0)) { | ||
1139 | /* oh nos! */ | ||
1140 | dev_err(dev->dev, "no encoders/connectors found\n"); | ||
1141 | + drm_mode_config_cleanup(dev); | ||
1142 | return -ENXIO; | ||
1143 | } | ||
1144 | |||
1145 | @@ -170,33 +171,37 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) | ||
1146 | dev->dev_private = priv; | ||
1147 | |||
1148 | priv->wq = alloc_ordered_workqueue("tilcdc", 0); | ||
1149 | + if (!priv->wq) { | ||
1150 | + ret = -ENOMEM; | ||
1151 | + goto fail_free_priv; | ||
1152 | + } | ||
1153 | |||
1154 | res = platform_get_resource(pdev, IORESOURCE_MEM, 0); | ||
1155 | if (!res) { | ||
1156 | dev_err(dev->dev, "failed to get memory resource\n"); | ||
1157 | ret = -EINVAL; | ||
1158 | - goto fail; | ||
1159 | + goto fail_free_wq; | ||
1160 | } | ||
1161 | |||
1162 | priv->mmio = ioremap_nocache(res->start, resource_size(res)); | ||
1163 | if (!priv->mmio) { | ||
1164 | dev_err(dev->dev, "failed to ioremap\n"); | ||
1165 | ret = -ENOMEM; | ||
1166 | - goto fail; | ||
1167 | + goto fail_free_wq; | ||
1168 | } | ||
1169 | |||
1170 | priv->clk = clk_get(dev->dev, "fck"); | ||
1171 | if (IS_ERR(priv->clk)) { | ||
1172 | dev_err(dev->dev, "failed to get functional clock\n"); | ||
1173 | ret = -ENODEV; | ||
1174 | - goto fail; | ||
1175 | + goto fail_iounmap; | ||
1176 | } | ||
1177 | |||
1178 | priv->disp_clk = clk_get(dev->dev, "dpll_disp_ck"); | ||
1179 | if (IS_ERR(priv->clk)) { | ||
1180 | dev_err(dev->dev, "failed to get display clock\n"); | ||
1181 | ret = -ENODEV; | ||
1182 | - goto fail; | ||
1183 | + goto fail_put_clk; | ||
1184 | } | ||
1185 | |||
1186 | #ifdef CONFIG_CPU_FREQ | ||
1187 | @@ -206,7 +211,7 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) | ||
1188 | CPUFREQ_TRANSITION_NOTIFIER); | ||
1189 | if (ret) { | ||
1190 | dev_err(dev->dev, "failed to register cpufreq notifier\n"); | ||
1191 | - goto fail; | ||
1192 | + goto fail_put_disp_clk; | ||
1193 | } | ||
1194 | #endif | ||
1195 | |||
1196 | @@ -238,13 +243,13 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) | ||
1197 | ret = modeset_init(dev); | ||
1198 | if (ret < 0) { | ||
1199 | dev_err(dev->dev, "failed to initialize mode setting\n"); | ||
1200 | - goto fail; | ||
1201 | + goto fail_cpufreq_unregister; | ||
1202 | } | ||
1203 | |||
1204 | ret = drm_vblank_init(dev, 1); | ||
1205 | if (ret < 0) { | ||
1206 | dev_err(dev->dev, "failed to initialize vblank\n"); | ||
1207 | - goto fail; | ||
1208 | + goto fail_mode_config_cleanup; | ||
1209 | } | ||
1210 | |||
1211 | pm_runtime_get_sync(dev->dev); | ||
1212 | @@ -252,7 +257,7 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) | ||
1213 | pm_runtime_put_sync(dev->dev); | ||
1214 | if (ret < 0) { | ||
1215 | dev_err(dev->dev, "failed to install IRQ handler\n"); | ||
1216 | - goto fail; | ||
1217 | + goto fail_vblank_cleanup; | ||
1218 | } | ||
1219 | |||
1220 | platform_set_drvdata(pdev, dev); | ||
1221 | @@ -260,13 +265,48 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) | ||
1222 | priv->fbdev = drm_fbdev_cma_init(dev, 16, | ||
1223 | dev->mode_config.num_crtc, | ||
1224 | dev->mode_config.num_connector); | ||
1225 | + if (IS_ERR(priv->fbdev)) { | ||
1226 | + ret = PTR_ERR(priv->fbdev); | ||
1227 | + goto fail_irq_uninstall; | ||
1228 | + } | ||
1229 | |||
1230 | drm_kms_helper_poll_init(dev); | ||
1231 | |||
1232 | return 0; | ||
1233 | |||
1234 | -fail: | ||
1235 | - tilcdc_unload(dev); | ||
1236 | +fail_irq_uninstall: | ||
1237 | + pm_runtime_get_sync(dev->dev); | ||
1238 | + drm_irq_uninstall(dev); | ||
1239 | + pm_runtime_put_sync(dev->dev); | ||
1240 | + | ||
1241 | +fail_vblank_cleanup: | ||
1242 | + drm_vblank_cleanup(dev); | ||
1243 | + | ||
1244 | +fail_mode_config_cleanup: | ||
1245 | + drm_mode_config_cleanup(dev); | ||
1246 | + | ||
1247 | +fail_cpufreq_unregister: | ||
1248 | + pm_runtime_disable(dev->dev); | ||
1249 | +#ifdef CONFIG_CPU_FREQ | ||
1250 | + cpufreq_unregister_notifier(&priv->freq_transition, | ||
1251 | + CPUFREQ_TRANSITION_NOTIFIER); | ||
1252 | +fail_put_disp_clk: | ||
1253 | + clk_put(priv->disp_clk); | ||
1254 | +#endif | ||
1255 | + | ||
1256 | +fail_put_clk: | ||
1257 | + clk_put(priv->clk); | ||
1258 | + | ||
1259 | +fail_iounmap: | ||
1260 | + iounmap(priv->mmio); | ||
1261 | + | ||
1262 | +fail_free_wq: | ||
1263 | + flush_workqueue(priv->wq); | ||
1264 | + destroy_workqueue(priv->wq); | ||
1265 | + | ||
1266 | +fail_free_priv: | ||
1267 | + dev->dev_private = NULL; | ||
1268 | + kfree(priv); | ||
1269 | return ret; | ||
1270 | } | ||
1271 | |||
1272 | diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c | ||
1273 | index b1240a250149..09324d0178d5 100644 | ||
1274 | --- a/drivers/i2c/busses/i2c-at91.c | ||
1275 | +++ b/drivers/i2c/busses/i2c-at91.c | ||
1276 | @@ -435,7 +435,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) | ||
1277 | } | ||
1278 | } | ||
1279 | |||
1280 | - ret = wait_for_completion_io_timeout(&dev->cmd_complete, | ||
1281 | + ret = wait_for_completion_timeout(&dev->cmd_complete, | ||
1282 | dev->adapter.timeout); | ||
1283 | if (ret == 0) { | ||
1284 | dev_err(dev->dev, "controller timed out\n"); | ||
1285 | diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h | ||
1286 | index 1291673bd57e..ce715b1bee46 100644 | ||
1287 | --- a/drivers/input/serio/i8042-x86ia64io.h | ||
1288 | +++ b/drivers/input/serio/i8042-x86ia64io.h | ||
1289 | @@ -101,6 +101,12 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { | ||
1290 | }, | ||
1291 | { | ||
1292 | .matches = { | ||
1293 | + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), | ||
1294 | + DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"), | ||
1295 | + }, | ||
1296 | + }, | ||
1297 | + { | ||
1298 | + .matches = { | ||
1299 | DMI_MATCH(DMI_SYS_VENDOR, "Compaq"), | ||
1300 | DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"), | ||
1301 | DMI_MATCH(DMI_PRODUCT_VERSION, "8500"), | ||
1302 | @@ -609,6 +615,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { | ||
1303 | }, | ||
1304 | }, | ||
1305 | { | ||
1306 | + /* Fujitsu A544 laptop */ | ||
1307 | + /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */ | ||
1308 | + .matches = { | ||
1309 | + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), | ||
1310 | + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"), | ||
1311 | + }, | ||
1312 | + }, | ||
1313 | + { | ||
1314 | + /* Fujitsu AH544 laptop */ | ||
1315 | + /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ | ||
1316 | + .matches = { | ||
1317 | + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), | ||
1318 | + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), | ||
1319 | + }, | ||
1320 | + }, | ||
1321 | + { | ||
1322 | /* Fujitsu U574 laptop */ | ||
1323 | /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ | ||
1324 | .matches = { | ||
1325 | diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c | ||
1326 | index f0a3347b6441..516923926335 100644 | ||
1327 | --- a/drivers/lguest/x86/core.c | ||
1328 | +++ b/drivers/lguest/x86/core.c | ||
1329 | @@ -700,7 +700,7 @@ void lguest_arch_setup_regs(struct lg_cpu *cpu, unsigned long start) | ||
1330 | * interrupts are enabled. We always leave interrupts enabled while | ||
1331 | * running the Guest. | ||
1332 | */ | ||
1333 | - regs->eflags = X86_EFLAGS_IF | X86_EFLAGS_BIT1; | ||
1334 | + regs->eflags = X86_EFLAGS_IF | X86_EFLAGS_FIXED; | ||
1335 | |||
1336 | /* | ||
1337 | * The "Extended Instruction Pointer" register says where the Guest is | ||
1338 | diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c | ||
1339 | index a6e985fcceb8..c9b4ca9e0696 100644 | ||
1340 | --- a/drivers/md/dm-bufio.c | ||
1341 | +++ b/drivers/md/dm-bufio.c | ||
1342 | @@ -462,6 +462,7 @@ static void __relink_lru(struct dm_buffer *b, int dirty) | ||
1343 | c->n_buffers[dirty]++; | ||
1344 | b->list_mode = dirty; | ||
1345 | list_move(&b->lru_list, &c->lru[dirty]); | ||
1346 | + b->last_accessed = jiffies; | ||
1347 | } | ||
1348 | |||
1349 | /*---------------------------------------------------------------- | ||
1350 | diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c | ||
1351 | index 08d9a207259a..c69d0b787746 100644 | ||
1352 | --- a/drivers/md/dm-log-userspace-transfer.c | ||
1353 | +++ b/drivers/md/dm-log-userspace-transfer.c | ||
1354 | @@ -272,7 +272,7 @@ int dm_ulog_tfr_init(void) | ||
1355 | |||
1356 | r = cn_add_callback(&ulog_cn_id, "dmlogusr", cn_ulog_callback); | ||
1357 | if (r) { | ||
1358 | - cn_del_callback(&ulog_cn_id); | ||
1359 | + kfree(prealloced_cn_msg); | ||
1360 | return r; | ||
1361 | } | ||
1362 | |||
1363 | diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c | ||
1364 | index 1e344b033277..22e8c2032f6d 100644 | ||
1365 | --- a/drivers/media/dvb-frontends/ds3000.c | ||
1366 | +++ b/drivers/media/dvb-frontends/ds3000.c | ||
1367 | @@ -864,6 +864,13 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config, | ||
1368 | memcpy(&state->frontend.ops, &ds3000_ops, | ||
1369 | sizeof(struct dvb_frontend_ops)); | ||
1370 | state->frontend.demodulator_priv = state; | ||
1371 | + | ||
1372 | + /* | ||
1373 | + * Some devices like T480 starts with voltage on. Be sure | ||
1374 | + * to turn voltage off during init, as this can otherwise | ||
1375 | + * interfere with Unicable SCR systems. | ||
1376 | + */ | ||
1377 | + ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF); | ||
1378 | return &state->frontend; | ||
1379 | |||
1380 | error3: | ||
1381 | diff --git a/drivers/media/i2c/tda7432.c b/drivers/media/i2c/tda7432.c | ||
1382 | index 28b5121881f5..09f4387dbc49 100644 | ||
1383 | --- a/drivers/media/i2c/tda7432.c | ||
1384 | +++ b/drivers/media/i2c/tda7432.c | ||
1385 | @@ -293,7 +293,7 @@ static int tda7432_s_ctrl(struct v4l2_ctrl *ctrl) | ||
1386 | if (t->mute->val) { | ||
1387 | lf |= TDA7432_MUTE; | ||
1388 | lr |= TDA7432_MUTE; | ||
1389 | - lf |= TDA7432_MUTE; | ||
1390 | + rf |= TDA7432_MUTE; | ||
1391 | rr |= TDA7432_MUTE; | ||
1392 | } | ||
1393 | /* Mute & update balance*/ | ||
1394 | diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c | ||
1395 | index 32d60e5546bc..a2737b4b090b 100644 | ||
1396 | --- a/drivers/media/usb/em28xx/em28xx-video.c | ||
1397 | +++ b/drivers/media/usb/em28xx/em28xx-video.c | ||
1398 | @@ -696,13 +696,16 @@ static int em28xx_stop_streaming(struct vb2_queue *vq) | ||
1399 | } | ||
1400 | |||
1401 | spin_lock_irqsave(&dev->slock, flags); | ||
1402 | + if (dev->usb_ctl.vid_buf != NULL) { | ||
1403 | + vb2_buffer_done(&dev->usb_ctl.vid_buf->vb, VB2_BUF_STATE_ERROR); | ||
1404 | + dev->usb_ctl.vid_buf = NULL; | ||
1405 | + } | ||
1406 | while (!list_empty(&vidq->active)) { | ||
1407 | struct em28xx_buffer *buf; | ||
1408 | buf = list_entry(vidq->active.next, struct em28xx_buffer, list); | ||
1409 | list_del(&buf->list); | ||
1410 | vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); | ||
1411 | } | ||
1412 | - dev->usb_ctl.vid_buf = NULL; | ||
1413 | spin_unlock_irqrestore(&dev->slock, flags); | ||
1414 | |||
1415 | return 0; | ||
1416 | @@ -724,13 +727,16 @@ int em28xx_stop_vbi_streaming(struct vb2_queue *vq) | ||
1417 | } | ||
1418 | |||
1419 | spin_lock_irqsave(&dev->slock, flags); | ||
1420 | + if (dev->usb_ctl.vbi_buf != NULL) { | ||
1421 | + vb2_buffer_done(&dev->usb_ctl.vbi_buf->vb, VB2_BUF_STATE_ERROR); | ||
1422 | + dev->usb_ctl.vbi_buf = NULL; | ||
1423 | + } | ||
1424 | while (!list_empty(&vbiq->active)) { | ||
1425 | struct em28xx_buffer *buf; | ||
1426 | buf = list_entry(vbiq->active.next, struct em28xx_buffer, list); | ||
1427 | list_del(&buf->list); | ||
1428 | vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); | ||
1429 | } | ||
1430 | - dev->usb_ctl.vbi_buf = NULL; | ||
1431 | spin_unlock_irqrestore(&dev->slock, flags); | ||
1432 | |||
1433 | return 0; | ||
1434 | diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c | ||
1435 | index 3fed63f4e026..ec9a4fa3bc86 100644 | ||
1436 | --- a/drivers/media/v4l2-core/v4l2-common.c | ||
1437 | +++ b/drivers/media/v4l2-core/v4l2-common.c | ||
1438 | @@ -485,16 +485,13 @@ static unsigned int clamp_align(unsigned int x, unsigned int min, | ||
1439 | /* Bits that must be zero to be aligned */ | ||
1440 | unsigned int mask = ~((1 << align) - 1); | ||
1441 | |||
1442 | + /* Clamp to aligned min and max */ | ||
1443 | + x = clamp(x, (min + ~mask) & mask, max & mask); | ||
1444 | + | ||
1445 | /* Round to nearest aligned value */ | ||
1446 | if (align) | ||
1447 | x = (x + (1 << (align - 1))) & mask; | ||
1448 | |||
1449 | - /* Clamp to aligned value of min and max */ | ||
1450 | - if (x < min) | ||
1451 | - x = (min + ~mask) & mask; | ||
1452 | - else if (x > max) | ||
1453 | - x = max & mask; | ||
1454 | - | ||
1455 | return x; | ||
1456 | } | ||
1457 | |||
1458 | diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c | ||
1459 | index 45f26be359ea..7e28bd0de554 100644 | ||
1460 | --- a/drivers/mfd/rtsx_pcr.c | ||
1461 | +++ b/drivers/mfd/rtsx_pcr.c | ||
1462 | @@ -1137,7 +1137,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, | ||
1463 | pcr->msi_en = msi_en; | ||
1464 | if (pcr->msi_en) { | ||
1465 | ret = pci_enable_msi(pcidev); | ||
1466 | - if (ret < 0) | ||
1467 | + if (ret) | ||
1468 | pcr->msi_en = false; | ||
1469 | } | ||
1470 | |||
1471 | diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c | ||
1472 | index 7ffb5cba30a9..4c65a5a4d8f4 100644 | ||
1473 | --- a/drivers/mmc/host/rtsx_pci_sdmmc.c | ||
1474 | +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c | ||
1475 | @@ -341,6 +341,13 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, | ||
1476 | } | ||
1477 | |||
1478 | if (rsp_type == SD_RSP_TYPE_R2) { | ||
1479 | + /* | ||
1480 | + * The controller offloads the last byte {CRC-7, end bit 1'b1} | ||
1481 | + * of response type R2. Assign dummy CRC, 0, and end bit to the | ||
1482 | + * byte(ptr[16], goes into the LSB of resp[3] later). | ||
1483 | + */ | ||
1484 | + ptr[16] = 1; | ||
1485 | + | ||
1486 | for (i = 0; i < 4; i++) { | ||
1487 | cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); | ||
1488 | dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", | ||
1489 | diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c | ||
1490 | index 0648c6996d43..bf8108d65b73 100644 | ||
1491 | --- a/drivers/mtd/ubi/fastmap.c | ||
1492 | +++ b/drivers/mtd/ubi/fastmap.c | ||
1493 | @@ -330,6 +330,7 @@ static int process_pool_aeb(struct ubi_device *ubi, struct ubi_attach_info *ai, | ||
1494 | av = tmp_av; | ||
1495 | else { | ||
1496 | ubi_err("orphaned volume in fastmap pool!"); | ||
1497 | + kmem_cache_free(ai->aeb_slab_cache, new_aeb); | ||
1498 | return UBI_BAD_FASTMAP; | ||
1499 | } | ||
1500 | |||
1501 | diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig | ||
1502 | index 3835321b8cf3..3bc3ebc0882f 100644 | ||
1503 | --- a/drivers/net/Kconfig | ||
1504 | +++ b/drivers/net/Kconfig | ||
1505 | @@ -139,6 +139,7 @@ config MACVLAN | ||
1506 | config MACVTAP | ||
1507 | tristate "MAC-VLAN based tap driver" | ||
1508 | depends on MACVLAN | ||
1509 | + depends on INET | ||
1510 | help | ||
1511 | This adds a specialized tap character device driver that is based | ||
1512 | on the MAC-VLAN network interface, called macvtap. A macvtap device | ||
1513 | @@ -209,6 +210,7 @@ config RIONET_RX_SIZE | ||
1514 | |||
1515 | config TUN | ||
1516 | tristate "Universal TUN/TAP device driver support" | ||
1517 | + depends on INET | ||
1518 | select CRC32 | ||
1519 | ---help--- | ||
1520 | TUN/TAP provides packet reception and transmission for user space | ||
1521 | diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c | ||
1522 | index 72ff14b811c6..5a1897d86e94 100644 | ||
1523 | --- a/drivers/net/ppp/ppp_generic.c | ||
1524 | +++ b/drivers/net/ppp/ppp_generic.c | ||
1525 | @@ -601,7 +601,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) | ||
1526 | if (file == ppp->owner) | ||
1527 | ppp_shutdown_interface(ppp); | ||
1528 | } | ||
1529 | - if (atomic_long_read(&file->f_count) <= 2) { | ||
1530 | + if (atomic_long_read(&file->f_count) < 2) { | ||
1531 | ppp_release(NULL, file); | ||
1532 | err = 0; | ||
1533 | } else | ||
1534 | diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c | ||
1535 | index d33c3ae2fcea..3b449c4ecf72 100644 | ||
1536 | --- a/drivers/net/usb/ax88179_178a.c | ||
1537 | +++ b/drivers/net/usb/ax88179_178a.c | ||
1538 | @@ -695,6 +695,7 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) | ||
1539 | { | ||
1540 | struct usbnet *dev = netdev_priv(net); | ||
1541 | struct sockaddr *addr = p; | ||
1542 | + int ret; | ||
1543 | |||
1544 | if (netif_running(net)) | ||
1545 | return -EBUSY; | ||
1546 | @@ -704,8 +705,12 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) | ||
1547 | memcpy(net->dev_addr, addr->sa_data, ETH_ALEN); | ||
1548 | |||
1549 | /* Set the MAC address */ | ||
1550 | - return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, | ||
1551 | + ret = ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, | ||
1552 | ETH_ALEN, net->dev_addr); | ||
1553 | + if (ret < 0) | ||
1554 | + return ret; | ||
1555 | + | ||
1556 | + return 0; | ||
1557 | } | ||
1558 | |||
1559 | static const struct net_device_ops ax88179_netdev_ops = { | ||
1560 | diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c | ||
1561 | index 9ef0711a5cc1..400b8679796a 100644 | ||
1562 | --- a/drivers/net/wireless/rt2x00/rt2800usb.c | ||
1563 | +++ b/drivers/net/wireless/rt2x00/rt2800usb.c | ||
1564 | @@ -1091,6 +1091,7 @@ static struct usb_device_id rt2800usb_device_table[] = { | ||
1565 | /* Ovislink */ | ||
1566 | { USB_DEVICE(0x1b75, 0x3071) }, | ||
1567 | { USB_DEVICE(0x1b75, 0x3072) }, | ||
1568 | + { USB_DEVICE(0x1b75, 0xa200) }, | ||
1569 | /* Para */ | ||
1570 | { USB_DEVICE(0x20b8, 0x8888) }, | ||
1571 | /* Pegatron */ | ||
1572 | diff --git a/drivers/of/base.c b/drivers/of/base.c | ||
1573 | index 1d10b4ec6814..b60f9a77ab03 100644 | ||
1574 | --- a/drivers/of/base.c | ||
1575 | +++ b/drivers/of/base.c | ||
1576 | @@ -963,52 +963,6 @@ int of_property_read_string(struct device_node *np, const char *propname, | ||
1577 | EXPORT_SYMBOL_GPL(of_property_read_string); | ||
1578 | |||
1579 | /** | ||
1580 | - * of_property_read_string_index - Find and read a string from a multiple | ||
1581 | - * strings property. | ||
1582 | - * @np: device node from which the property value is to be read. | ||
1583 | - * @propname: name of the property to be searched. | ||
1584 | - * @index: index of the string in the list of strings | ||
1585 | - * @out_string: pointer to null terminated return string, modified only if | ||
1586 | - * return value is 0. | ||
1587 | - * | ||
1588 | - * Search for a property in a device tree node and retrieve a null | ||
1589 | - * terminated string value (pointer to data, not a copy) in the list of strings | ||
1590 | - * contained in that property. | ||
1591 | - * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if | ||
1592 | - * property does not have a value, and -EILSEQ if the string is not | ||
1593 | - * null-terminated within the length of the property data. | ||
1594 | - * | ||
1595 | - * The out_string pointer is modified only if a valid string can be decoded. | ||
1596 | - */ | ||
1597 | -int of_property_read_string_index(struct device_node *np, const char *propname, | ||
1598 | - int index, const char **output) | ||
1599 | -{ | ||
1600 | - struct property *prop = of_find_property(np, propname, NULL); | ||
1601 | - int i = 0; | ||
1602 | - size_t l = 0, total = 0; | ||
1603 | - const char *p; | ||
1604 | - | ||
1605 | - if (!prop) | ||
1606 | - return -EINVAL; | ||
1607 | - if (!prop->value) | ||
1608 | - return -ENODATA; | ||
1609 | - if (strnlen(prop->value, prop->length) >= prop->length) | ||
1610 | - return -EILSEQ; | ||
1611 | - | ||
1612 | - p = prop->value; | ||
1613 | - | ||
1614 | - for (i = 0; total < prop->length; total += l, p += l) { | ||
1615 | - l = strlen(p) + 1; | ||
1616 | - if (i++ == index) { | ||
1617 | - *output = p; | ||
1618 | - return 0; | ||
1619 | - } | ||
1620 | - } | ||
1621 | - return -ENODATA; | ||
1622 | -} | ||
1623 | -EXPORT_SYMBOL_GPL(of_property_read_string_index); | ||
1624 | - | ||
1625 | -/** | ||
1626 | * of_property_match_string() - Find string in a list and return index | ||
1627 | * @np: pointer to node containing string list property | ||
1628 | * @propname: string list property name | ||
1629 | @@ -1034,7 +988,7 @@ int of_property_match_string(struct device_node *np, const char *propname, | ||
1630 | end = p + prop->length; | ||
1631 | |||
1632 | for (i = 0; p < end; i++, p += l) { | ||
1633 | - l = strlen(p) + 1; | ||
1634 | + l = strnlen(p, end - p) + 1; | ||
1635 | if (p + l > end) | ||
1636 | return -EILSEQ; | ||
1637 | pr_debug("comparing %s with %s\n", string, p); | ||
1638 | @@ -1046,39 +1000,41 @@ int of_property_match_string(struct device_node *np, const char *propname, | ||
1639 | EXPORT_SYMBOL_GPL(of_property_match_string); | ||
1640 | |||
1641 | /** | ||
1642 | - * of_property_count_strings - Find and return the number of strings from a | ||
1643 | - * multiple strings property. | ||
1644 | + * of_property_read_string_util() - Utility helper for parsing string properties | ||
1645 | * @np: device node from which the property value is to be read. | ||
1646 | * @propname: name of the property to be searched. | ||
1647 | + * @out_strs: output array of string pointers. | ||
1648 | + * @sz: number of array elements to read. | ||
1649 | + * @skip: Number of strings to skip over at beginning of list. | ||
1650 | * | ||
1651 | - * Search for a property in a device tree node and retrieve the number of null | ||
1652 | - * terminated string contain in it. Returns the number of strings on | ||
1653 | - * success, -EINVAL if the property does not exist, -ENODATA if property | ||
1654 | - * does not have a value, and -EILSEQ if the string is not null-terminated | ||
1655 | - * within the length of the property data. | ||
1656 | + * Don't call this function directly. It is a utility helper for the | ||
1657 | + * of_property_read_string*() family of functions. | ||
1658 | */ | ||
1659 | -int of_property_count_strings(struct device_node *np, const char *propname) | ||
1660 | +int of_property_read_string_helper(struct device_node *np, const char *propname, | ||
1661 | + const char **out_strs, size_t sz, int skip) | ||
1662 | { | ||
1663 | struct property *prop = of_find_property(np, propname, NULL); | ||
1664 | - int i = 0; | ||
1665 | - size_t l = 0, total = 0; | ||
1666 | - const char *p; | ||
1667 | + int l = 0, i = 0; | ||
1668 | + const char *p, *end; | ||
1669 | |||
1670 | if (!prop) | ||
1671 | return -EINVAL; | ||
1672 | if (!prop->value) | ||
1673 | return -ENODATA; | ||
1674 | - if (strnlen(prop->value, prop->length) >= prop->length) | ||
1675 | - return -EILSEQ; | ||
1676 | - | ||
1677 | p = prop->value; | ||
1678 | + end = p + prop->length; | ||
1679 | |||
1680 | - for (i = 0; total < prop->length; total += l, p += l, i++) | ||
1681 | - l = strlen(p) + 1; | ||
1682 | - | ||
1683 | - return i; | ||
1684 | + for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) { | ||
1685 | + l = strnlen(p, end - p) + 1; | ||
1686 | + if (p + l > end) | ||
1687 | + return -EILSEQ; | ||
1688 | + if (out_strs && i >= skip) | ||
1689 | + *out_strs++ = p; | ||
1690 | + } | ||
1691 | + i -= skip; | ||
1692 | + return i <= 0 ? -ENODATA : i; | ||
1693 | } | ||
1694 | -EXPORT_SYMBOL_GPL(of_property_count_strings); | ||
1695 | +EXPORT_SYMBOL_GPL(of_property_read_string_helper); | ||
1696 | |||
1697 | /** | ||
1698 | * of_parse_phandle - Resolve a phandle property to a device_node pointer | ||
1699 | diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c | ||
1700 | index 0eb5c38b4e07..f5e8dc7a725c 100644 | ||
1701 | --- a/drivers/of/selftest.c | ||
1702 | +++ b/drivers/of/selftest.c | ||
1703 | @@ -126,8 +126,9 @@ static void __init of_selftest_parse_phandle_with_args(void) | ||
1704 | selftest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc); | ||
1705 | } | ||
1706 | |||
1707 | -static void __init of_selftest_property_match_string(void) | ||
1708 | +static void __init of_selftest_property_string(void) | ||
1709 | { | ||
1710 | + const char *strings[4]; | ||
1711 | struct device_node *np; | ||
1712 | int rc; | ||
1713 | |||
1714 | @@ -145,13 +146,66 @@ static void __init of_selftest_property_match_string(void) | ||
1715 | rc = of_property_match_string(np, "phandle-list-names", "third"); | ||
1716 | selftest(rc == 2, "third expected:0 got:%i\n", rc); | ||
1717 | rc = of_property_match_string(np, "phandle-list-names", "fourth"); | ||
1718 | - selftest(rc == -ENODATA, "unmatched string; rc=%i", rc); | ||
1719 | + selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc); | ||
1720 | rc = of_property_match_string(np, "missing-property", "blah"); | ||
1721 | - selftest(rc == -EINVAL, "missing property; rc=%i", rc); | ||
1722 | + selftest(rc == -EINVAL, "missing property; rc=%i\n", rc); | ||
1723 | rc = of_property_match_string(np, "empty-property", "blah"); | ||
1724 | - selftest(rc == -ENODATA, "empty property; rc=%i", rc); | ||
1725 | + selftest(rc == -ENODATA, "empty property; rc=%i\n", rc); | ||
1726 | rc = of_property_match_string(np, "unterminated-string", "blah"); | ||
1727 | - selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc); | ||
1728 | + selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); | ||
1729 | + | ||
1730 | + /* of_property_count_strings() tests */ | ||
1731 | + rc = of_property_count_strings(np, "string-property"); | ||
1732 | + selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); | ||
1733 | + rc = of_property_count_strings(np, "phandle-list-names"); | ||
1734 | + selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); | ||
1735 | + rc = of_property_count_strings(np, "unterminated-string"); | ||
1736 | + selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); | ||
1737 | + rc = of_property_count_strings(np, "unterminated-string-list"); | ||
1738 | + selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); | ||
1739 | + | ||
1740 | + /* of_property_read_string_index() tests */ | ||
1741 | + rc = of_property_read_string_index(np, "string-property", 0, strings); | ||
1742 | + selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1743 | + strings[0] = NULL; | ||
1744 | + rc = of_property_read_string_index(np, "string-property", 1, strings); | ||
1745 | + selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1746 | + rc = of_property_read_string_index(np, "phandle-list-names", 0, strings); | ||
1747 | + selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1748 | + rc = of_property_read_string_index(np, "phandle-list-names", 1, strings); | ||
1749 | + selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1750 | + rc = of_property_read_string_index(np, "phandle-list-names", 2, strings); | ||
1751 | + selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1752 | + strings[0] = NULL; | ||
1753 | + rc = of_property_read_string_index(np, "phandle-list-names", 3, strings); | ||
1754 | + selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1755 | + strings[0] = NULL; | ||
1756 | + rc = of_property_read_string_index(np, "unterminated-string", 0, strings); | ||
1757 | + selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1758 | + rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings); | ||
1759 | + selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1760 | + strings[0] = NULL; | ||
1761 | + rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */ | ||
1762 | + selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); | ||
1763 | + strings[1] = NULL; | ||
1764 | + | ||
1765 | + /* of_property_read_string_array() tests */ | ||
1766 | + rc = of_property_read_string_array(np, "string-property", strings, 4); | ||
1767 | + selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); | ||
1768 | + rc = of_property_read_string_array(np, "phandle-list-names", strings, 4); | ||
1769 | + selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); | ||
1770 | + rc = of_property_read_string_array(np, "unterminated-string", strings, 4); | ||
1771 | + selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); | ||
1772 | + /* -- An incorrectly formed string should cause a failure */ | ||
1773 | + rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4); | ||
1774 | + selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); | ||
1775 | + /* -- parsing the correctly formed strings should still work: */ | ||
1776 | + strings[2] = NULL; | ||
1777 | + rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2); | ||
1778 | + selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc); | ||
1779 | + strings[1] = NULL; | ||
1780 | + rc = of_property_read_string_array(np, "phandle-list-names", strings, 1); | ||
1781 | + selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]); | ||
1782 | } | ||
1783 | |||
1784 | static int __init of_selftest(void) | ||
1785 | @@ -167,7 +221,7 @@ static int __init of_selftest(void) | ||
1786 | |||
1787 | pr_info("start of selftest - you will see error messages\n"); | ||
1788 | of_selftest_parse_phandle_with_args(); | ||
1789 | - of_selftest_property_match_string(); | ||
1790 | + of_selftest_property_string(); | ||
1791 | pr_info("end of selftest - %s\n", selftest_passed ? "PASS" : "FAIL"); | ||
1792 | return 0; | ||
1793 | } | ||
1794 | diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c | ||
1795 | index c9076bdaf2c1..59a8d325a697 100644 | ||
1796 | --- a/drivers/platform/x86/acer-wmi.c | ||
1797 | +++ b/drivers/platform/x86/acer-wmi.c | ||
1798 | @@ -572,6 +572,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] = { | ||
1799 | DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5750"), | ||
1800 | }, | ||
1801 | }, | ||
1802 | + { | ||
1803 | + /* | ||
1804 | + * Note no video_set_backlight_video_vendor, we must use the | ||
1805 | + * acer interface, as there is no native backlight interface. | ||
1806 | + */ | ||
1807 | + .ident = "Acer KAV80", | ||
1808 | + .matches = { | ||
1809 | + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), | ||
1810 | + DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"), | ||
1811 | + }, | ||
1812 | + }, | ||
1813 | {} | ||
1814 | }; | ||
1815 | |||
1816 | diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c | ||
1817 | index 66b0b26a1381..cfd49eca67aa 100644 | ||
1818 | --- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c | ||
1819 | +++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c | ||
1820 | @@ -762,7 +762,16 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct qla_tgt_sess *sess) | ||
1821 | pr_debug("fc_rport domain: port_id 0x%06x\n", nacl->nport_id); | ||
1822 | |||
1823 | node = btree_remove32(&lport->lport_fcport_map, nacl->nport_id); | ||
1824 | - WARN_ON(node && (node != se_nacl)); | ||
1825 | + if (WARN_ON(node && (node != se_nacl))) { | ||
1826 | + /* | ||
1827 | + * The nacl no longer matches what we think it should be. | ||
1828 | + * Most likely a new dynamic acl has been added while | ||
1829 | + * someone dropped the hardware lock. It clearly is a | ||
1830 | + * bug elsewhere, but this bit can't make things worse. | ||
1831 | + */ | ||
1832 | + btree_insert32(&lport->lport_fcport_map, nacl->nport_id, | ||
1833 | + node, GFP_ATOMIC); | ||
1834 | + } | ||
1835 | |||
1836 | pr_debug("Removed from fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%06x\n", | ||
1837 | se_nacl, nacl->nport_wwnn, nacl->nport_id); | ||
1838 | diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c | ||
1839 | index 371cc66f1a0e..5266c89fc989 100644 | ||
1840 | --- a/drivers/spi/spi-pl022.c | ||
1841 | +++ b/drivers/spi/spi-pl022.c | ||
1842 | @@ -1080,7 +1080,7 @@ err_rxdesc: | ||
1843 | pl022->sgt_tx.nents, DMA_TO_DEVICE); | ||
1844 | err_tx_sgmap: | ||
1845 | dma_unmap_sg(rxchan->device->dev, pl022->sgt_rx.sgl, | ||
1846 | - pl022->sgt_tx.nents, DMA_FROM_DEVICE); | ||
1847 | + pl022->sgt_rx.nents, DMA_FROM_DEVICE); | ||
1848 | err_rx_sgmap: | ||
1849 | sg_free_table(&pl022->sgt_tx); | ||
1850 | err_alloc_tx_sg: | ||
1851 | diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c | ||
1852 | index 48b396fced0a..d26a2d195d21 100644 | ||
1853 | --- a/drivers/spi/spi-pxa2xx.c | ||
1854 | +++ b/drivers/spi/spi-pxa2xx.c | ||
1855 | @@ -1324,7 +1324,9 @@ static int pxa2xx_spi_suspend(struct device *dev) | ||
1856 | if (status != 0) | ||
1857 | return status; | ||
1858 | write_SSCR0(0, drv_data->ioaddr); | ||
1859 | - clk_disable_unprepare(ssp->clk); | ||
1860 | + | ||
1861 | + if (!pm_runtime_suspended(dev)) | ||
1862 | + clk_disable_unprepare(ssp->clk); | ||
1863 | |||
1864 | return 0; | ||
1865 | } | ||
1866 | @@ -1338,7 +1340,8 @@ static int pxa2xx_spi_resume(struct device *dev) | ||
1867 | pxa2xx_spi_dma_resume(drv_data); | ||
1868 | |||
1869 | /* Enable the SSP clock */ | ||
1870 | - clk_prepare_enable(ssp->clk); | ||
1871 | + if (!pm_runtime_suspended(dev)) | ||
1872 | + clk_prepare_enable(ssp->clk); | ||
1873 | |||
1874 | /* Start the queue running */ | ||
1875 | status = spi_master_resume(drv_data->master); | ||
1876 | diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c | ||
1877 | index 6330af656a0f..bc23d66a7a1e 100644 | ||
1878 | --- a/drivers/staging/iio/impedance-analyzer/ad5933.c | ||
1879 | +++ b/drivers/staging/iio/impedance-analyzer/ad5933.c | ||
1880 | @@ -115,6 +115,7 @@ static const struct iio_chan_spec ad5933_channels[] = { | ||
1881 | .channel = 0, | ||
1882 | .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED), | ||
1883 | .address = AD5933_REG_TEMP_DATA, | ||
1884 | + .scan_index = -1, | ||
1885 | .scan_type = { | ||
1886 | .sign = 's', | ||
1887 | .realbits = 14, | ||
1888 | @@ -124,9 +125,7 @@ static const struct iio_chan_spec ad5933_channels[] = { | ||
1889 | .type = IIO_VOLTAGE, | ||
1890 | .indexed = 1, | ||
1891 | .channel = 0, | ||
1892 | - .extend_name = "real_raw", | ||
1893 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | | ||
1894 | - BIT(IIO_CHAN_INFO_SCALE), | ||
1895 | + .extend_name = "real", | ||
1896 | .address = AD5933_REG_REAL_DATA, | ||
1897 | .scan_index = 0, | ||
1898 | .scan_type = { | ||
1899 | @@ -138,9 +137,7 @@ static const struct iio_chan_spec ad5933_channels[] = { | ||
1900 | .type = IIO_VOLTAGE, | ||
1901 | .indexed = 1, | ||
1902 | .channel = 0, | ||
1903 | - .extend_name = "imag_raw", | ||
1904 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | | ||
1905 | - BIT(IIO_CHAN_INFO_SCALE), | ||
1906 | + .extend_name = "imag", | ||
1907 | .address = AD5933_REG_IMAG_DATA, | ||
1908 | .scan_index = 1, | ||
1909 | .scan_type = { | ||
1910 | @@ -746,14 +743,14 @@ static int ad5933_probe(struct i2c_client *client, | ||
1911 | indio_dev->name = id->name; | ||
1912 | indio_dev->modes = INDIO_DIRECT_MODE; | ||
1913 | indio_dev->channels = ad5933_channels; | ||
1914 | - indio_dev->num_channels = 1; /* only register temp0_input */ | ||
1915 | + indio_dev->num_channels = ARRAY_SIZE(ad5933_channels); | ||
1916 | |||
1917 | ret = ad5933_register_ring_funcs_and_init(indio_dev); | ||
1918 | if (ret) | ||
1919 | goto error_disable_reg; | ||
1920 | |||
1921 | - /* skip temp0_input, register in0_(real|imag)_raw */ | ||
1922 | - ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2); | ||
1923 | + ret = iio_buffer_register(indio_dev, ad5933_channels, | ||
1924 | + ARRAY_SIZE(ad5933_channels)); | ||
1925 | if (ret) | ||
1926 | goto error_unreg_ring; | ||
1927 | |||
1928 | diff --git a/drivers/staging/iio/meter/ade7758.h b/drivers/staging/iio/meter/ade7758.h | ||
1929 | index 07318203a836..e8c98cf57070 100644 | ||
1930 | --- a/drivers/staging/iio/meter/ade7758.h | ||
1931 | +++ b/drivers/staging/iio/meter/ade7758.h | ||
1932 | @@ -119,7 +119,6 @@ struct ade7758_state { | ||
1933 | u8 *tx; | ||
1934 | u8 *rx; | ||
1935 | struct mutex buf_lock; | ||
1936 | - const struct iio_chan_spec *ade7758_ring_channels; | ||
1937 | struct spi_transfer ring_xfer[4]; | ||
1938 | struct spi_message ring_msg; | ||
1939 | /* | ||
1940 | diff --git a/drivers/staging/iio/meter/ade7758_core.c b/drivers/staging/iio/meter/ade7758_core.c | ||
1941 | index 8f5bcfab3563..75d9fe6a1bc1 100644 | ||
1942 | --- a/drivers/staging/iio/meter/ade7758_core.c | ||
1943 | +++ b/drivers/staging/iio/meter/ade7758_core.c | ||
1944 | @@ -648,9 +648,6 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
1945 | .type = IIO_VOLTAGE, | ||
1946 | .indexed = 1, | ||
1947 | .channel = 0, | ||
1948 | - .extend_name = "raw", | ||
1949 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
1950 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
1951 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE), | ||
1952 | .scan_index = 0, | ||
1953 | .scan_type = { | ||
1954 | @@ -662,9 +659,6 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
1955 | .type = IIO_CURRENT, | ||
1956 | .indexed = 1, | ||
1957 | .channel = 0, | ||
1958 | - .extend_name = "raw", | ||
1959 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
1960 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
1961 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT), | ||
1962 | .scan_index = 1, | ||
1963 | .scan_type = { | ||
1964 | @@ -676,9 +670,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
1965 | .type = IIO_POWER, | ||
1966 | .indexed = 1, | ||
1967 | .channel = 0, | ||
1968 | - .extend_name = "apparent_raw", | ||
1969 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
1970 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
1971 | + .extend_name = "apparent", | ||
1972 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR), | ||
1973 | .scan_index = 2, | ||
1974 | .scan_type = { | ||
1975 | @@ -690,9 +682,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
1976 | .type = IIO_POWER, | ||
1977 | .indexed = 1, | ||
1978 | .channel = 0, | ||
1979 | - .extend_name = "active_raw", | ||
1980 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
1981 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
1982 | + .extend_name = "active", | ||
1983 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR), | ||
1984 | .scan_index = 3, | ||
1985 | .scan_type = { | ||
1986 | @@ -704,9 +694,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
1987 | .type = IIO_POWER, | ||
1988 | .indexed = 1, | ||
1989 | .channel = 0, | ||
1990 | - .extend_name = "reactive_raw", | ||
1991 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
1992 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
1993 | + .extend_name = "reactive", | ||
1994 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR), | ||
1995 | .scan_index = 4, | ||
1996 | .scan_type = { | ||
1997 | @@ -718,9 +706,6 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
1998 | .type = IIO_VOLTAGE, | ||
1999 | .indexed = 1, | ||
2000 | .channel = 1, | ||
2001 | - .extend_name = "raw", | ||
2002 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2003 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2004 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE), | ||
2005 | .scan_index = 5, | ||
2006 | .scan_type = { | ||
2007 | @@ -732,9 +717,6 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2008 | .type = IIO_CURRENT, | ||
2009 | .indexed = 1, | ||
2010 | .channel = 1, | ||
2011 | - .extend_name = "raw", | ||
2012 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2013 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2014 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT), | ||
2015 | .scan_index = 6, | ||
2016 | .scan_type = { | ||
2017 | @@ -746,9 +728,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2018 | .type = IIO_POWER, | ||
2019 | .indexed = 1, | ||
2020 | .channel = 1, | ||
2021 | - .extend_name = "apparent_raw", | ||
2022 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2023 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2024 | + .extend_name = "apparent", | ||
2025 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR), | ||
2026 | .scan_index = 7, | ||
2027 | .scan_type = { | ||
2028 | @@ -760,9 +740,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2029 | .type = IIO_POWER, | ||
2030 | .indexed = 1, | ||
2031 | .channel = 1, | ||
2032 | - .extend_name = "active_raw", | ||
2033 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2034 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2035 | + .extend_name = "active", | ||
2036 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR), | ||
2037 | .scan_index = 8, | ||
2038 | .scan_type = { | ||
2039 | @@ -774,9 +752,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2040 | .type = IIO_POWER, | ||
2041 | .indexed = 1, | ||
2042 | .channel = 1, | ||
2043 | - .extend_name = "reactive_raw", | ||
2044 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2045 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2046 | + .extend_name = "reactive", | ||
2047 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR), | ||
2048 | .scan_index = 9, | ||
2049 | .scan_type = { | ||
2050 | @@ -788,9 +764,6 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2051 | .type = IIO_VOLTAGE, | ||
2052 | .indexed = 1, | ||
2053 | .channel = 2, | ||
2054 | - .extend_name = "raw", | ||
2055 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2056 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2057 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE), | ||
2058 | .scan_index = 10, | ||
2059 | .scan_type = { | ||
2060 | @@ -802,9 +775,6 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2061 | .type = IIO_CURRENT, | ||
2062 | .indexed = 1, | ||
2063 | .channel = 2, | ||
2064 | - .extend_name = "raw", | ||
2065 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2066 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2067 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT), | ||
2068 | .scan_index = 11, | ||
2069 | .scan_type = { | ||
2070 | @@ -816,9 +786,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2071 | .type = IIO_POWER, | ||
2072 | .indexed = 1, | ||
2073 | .channel = 2, | ||
2074 | - .extend_name = "apparent_raw", | ||
2075 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2076 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2077 | + .extend_name = "apparent", | ||
2078 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR), | ||
2079 | .scan_index = 12, | ||
2080 | .scan_type = { | ||
2081 | @@ -830,9 +798,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2082 | .type = IIO_POWER, | ||
2083 | .indexed = 1, | ||
2084 | .channel = 2, | ||
2085 | - .extend_name = "active_raw", | ||
2086 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2087 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2088 | + .extend_name = "active", | ||
2089 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR), | ||
2090 | .scan_index = 13, | ||
2091 | .scan_type = { | ||
2092 | @@ -844,9 +810,7 @@ static const struct iio_chan_spec ade7758_channels[] = { | ||
2093 | .type = IIO_POWER, | ||
2094 | .indexed = 1, | ||
2095 | .channel = 2, | ||
2096 | - .extend_name = "reactive_raw", | ||
2097 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), | ||
2098 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), | ||
2099 | + .extend_name = "reactive", | ||
2100 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR), | ||
2101 | .scan_index = 14, | ||
2102 | .scan_type = { | ||
2103 | @@ -890,13 +854,14 @@ static int ade7758_probe(struct spi_device *spi) | ||
2104 | goto error_free_rx; | ||
2105 | } | ||
2106 | st->us = spi; | ||
2107 | - st->ade7758_ring_channels = &ade7758_channels[0]; | ||
2108 | mutex_init(&st->buf_lock); | ||
2109 | |||
2110 | indio_dev->name = spi->dev.driver->name; | ||
2111 | indio_dev->dev.parent = &spi->dev; | ||
2112 | indio_dev->info = &ade7758_info; | ||
2113 | indio_dev->modes = INDIO_DIRECT_MODE; | ||
2114 | + indio_dev->channels = ade7758_channels; | ||
2115 | + indio_dev->num_channels = ARRAY_SIZE(ade7758_channels); | ||
2116 | |||
2117 | ret = ade7758_configure_ring(indio_dev); | ||
2118 | if (ret) | ||
2119 | diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c | ||
2120 | index b29e2d5d9937..6a0ef97e9146 100644 | ||
2121 | --- a/drivers/staging/iio/meter/ade7758_ring.c | ||
2122 | +++ b/drivers/staging/iio/meter/ade7758_ring.c | ||
2123 | @@ -89,11 +89,10 @@ static irqreturn_t ade7758_trigger_handler(int irq, void *p) | ||
2124 | **/ | ||
2125 | static int ade7758_ring_preenable(struct iio_dev *indio_dev) | ||
2126 | { | ||
2127 | - struct ade7758_state *st = iio_priv(indio_dev); | ||
2128 | unsigned channel; | ||
2129 | int ret; | ||
2130 | |||
2131 | - if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) | ||
2132 | + if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) | ||
2133 | return -EINVAL; | ||
2134 | |||
2135 | ret = iio_sw_buffer_preenable(indio_dev); | ||
2136 | @@ -104,7 +103,7 @@ static int ade7758_ring_preenable(struct iio_dev *indio_dev) | ||
2137 | indio_dev->masklength); | ||
2138 | |||
2139 | ade7758_write_waveform_type(&indio_dev->dev, | ||
2140 | - st->ade7758_ring_channels[channel].address); | ||
2141 | + indio_dev->channels[channel].address); | ||
2142 | |||
2143 | return 0; | ||
2144 | } | ||
2145 | diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c | ||
2146 | index 68398753eb82..2be407e22eb4 100644 | ||
2147 | --- a/drivers/target/target_core_device.c | ||
2148 | +++ b/drivers/target/target_core_device.c | ||
2149 | @@ -1293,7 +1293,8 @@ int core_dev_add_initiator_node_lun_acl( | ||
2150 | * Check to see if there are any existing persistent reservation APTPL | ||
2151 | * pre-registrations that need to be enabled for this LUN ACL.. | ||
2152 | */ | ||
2153 | - core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, lacl); | ||
2154 | + core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, nacl, | ||
2155 | + lacl->mapped_lun); | ||
2156 | return 0; | ||
2157 | } | ||
2158 | |||
2159 | diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c | ||
2160 | index 04a74938bb43..27ec6e4d1c7c 100644 | ||
2161 | --- a/drivers/target/target_core_pr.c | ||
2162 | +++ b/drivers/target/target_core_pr.c | ||
2163 | @@ -945,10 +945,10 @@ int core_scsi3_check_aptpl_registration( | ||
2164 | struct se_device *dev, | ||
2165 | struct se_portal_group *tpg, | ||
2166 | struct se_lun *lun, | ||
2167 | - struct se_lun_acl *lun_acl) | ||
2168 | + struct se_node_acl *nacl, | ||
2169 | + u32 mapped_lun) | ||
2170 | { | ||
2171 | - struct se_node_acl *nacl = lun_acl->se_lun_nacl; | ||
2172 | - struct se_dev_entry *deve = nacl->device_list[lun_acl->mapped_lun]; | ||
2173 | + struct se_dev_entry *deve = nacl->device_list[mapped_lun]; | ||
2174 | |||
2175 | if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS) | ||
2176 | return 0; | ||
2177 | diff --git a/drivers/target/target_core_pr.h b/drivers/target/target_core_pr.h | ||
2178 | index b4a004247ab2..ea9220de1dff 100644 | ||
2179 | --- a/drivers/target/target_core_pr.h | ||
2180 | +++ b/drivers/target/target_core_pr.h | ||
2181 | @@ -55,7 +55,7 @@ extern int core_scsi3_alloc_aptpl_registration( | ||
2182 | unsigned char *, u16, u32, int, int, u8); | ||
2183 | extern int core_scsi3_check_aptpl_registration(struct se_device *, | ||
2184 | struct se_portal_group *, struct se_lun *, | ||
2185 | - struct se_lun_acl *); | ||
2186 | + struct se_node_acl *, u32); | ||
2187 | extern void core_scsi3_free_pr_reg_from_nacl(struct se_device *, | ||
2188 | struct se_node_acl *); | ||
2189 | extern void core_scsi3_free_all_registrations(struct se_device *); | ||
2190 | diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c | ||
2191 | index aac9d2727e3c..8572207e3d4d 100644 | ||
2192 | --- a/drivers/target/target_core_tpg.c | ||
2193 | +++ b/drivers/target/target_core_tpg.c | ||
2194 | @@ -40,6 +40,7 @@ | ||
2195 | #include <target/target_core_fabric.h> | ||
2196 | |||
2197 | #include "target_core_internal.h" | ||
2198 | +#include "target_core_pr.h" | ||
2199 | |||
2200 | extern struct se_device *g_lun0_dev; | ||
2201 | |||
2202 | @@ -165,6 +166,13 @@ void core_tpg_add_node_to_devs( | ||
2203 | |||
2204 | core_enable_device_list_for_node(lun, NULL, lun->unpacked_lun, | ||
2205 | lun_access, acl, tpg); | ||
2206 | + /* | ||
2207 | + * Check to see if there are any existing persistent reservation | ||
2208 | + * APTPL pre-registrations that need to be enabled for this dynamic | ||
2209 | + * LUN ACL now.. | ||
2210 | + */ | ||
2211 | + core_scsi3_check_aptpl_registration(dev, tpg, lun, acl, | ||
2212 | + lun->unpacked_lun); | ||
2213 | spin_lock(&tpg->tpg_lun_lock); | ||
2214 | } | ||
2215 | spin_unlock(&tpg->tpg_lun_lock); | ||
2216 | diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c | ||
2217 | index 6866d86e8663..12342695ed79 100644 | ||
2218 | --- a/drivers/target/target_core_transport.c | ||
2219 | +++ b/drivers/target/target_core_transport.c | ||
2220 | @@ -1788,8 +1788,7 @@ static void transport_complete_qf(struct se_cmd *cmd) | ||
2221 | |||
2222 | if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) { | ||
2223 | ret = cmd->se_tfo->queue_status(cmd); | ||
2224 | - if (ret) | ||
2225 | - goto out; | ||
2226 | + goto out; | ||
2227 | } | ||
2228 | |||
2229 | switch (cmd->data_direction) { | ||
2230 | diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c | ||
2231 | index 0f1cc2c8c22a..1fabb22ae615 100644 | ||
2232 | --- a/drivers/tty/serial/serial_core.c | ||
2233 | +++ b/drivers/tty/serial/serial_core.c | ||
2234 | @@ -359,7 +359,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios, | ||
2235 | * The spd_hi, spd_vhi, spd_shi, spd_warp kludge... | ||
2236 | * Die! Die! Die! | ||
2237 | */ | ||
2238 | - if (baud == 38400) | ||
2239 | + if (try == 0 && baud == 38400) | ||
2240 | baud = altbaud; | ||
2241 | |||
2242 | /* | ||
2243 | diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c | ||
2244 | index 3723c0ebb316..d35afccdb6c9 100644 | ||
2245 | --- a/drivers/tty/tty_io.c | ||
2246 | +++ b/drivers/tty/tty_io.c | ||
2247 | @@ -1698,6 +1698,7 @@ int tty_release(struct inode *inode, struct file *filp) | ||
2248 | int pty_master, tty_closing, o_tty_closing, do_sleep; | ||
2249 | int idx; | ||
2250 | char buf[64]; | ||
2251 | + long timeout = 0; | ||
2252 | |||
2253 | if (tty_paranoia_check(tty, inode, __func__)) | ||
2254 | return 0; | ||
2255 | @@ -1782,7 +1783,11 @@ int tty_release(struct inode *inode, struct file *filp) | ||
2256 | __func__, tty_name(tty, buf)); | ||
2257 | tty_unlock_pair(tty, o_tty); | ||
2258 | mutex_unlock(&tty_mutex); | ||
2259 | - schedule(); | ||
2260 | + schedule_timeout_killable(timeout); | ||
2261 | + if (timeout < 120 * HZ) | ||
2262 | + timeout = 2 * timeout + 1; | ||
2263 | + else | ||
2264 | + timeout = MAX_SCHEDULE_TIMEOUT; | ||
2265 | } | ||
2266 | |||
2267 | /* | ||
2268 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c | ||
2269 | index fbf3f11aed2c..1e71f918eb9f 100644 | ||
2270 | --- a/drivers/usb/class/cdc-acm.c | ||
2271 | +++ b/drivers/usb/class/cdc-acm.c | ||
2272 | @@ -883,11 +883,12 @@ static void acm_tty_set_termios(struct tty_struct *tty, | ||
2273 | /* FIXME: Needs to clear unsupported bits in the termios */ | ||
2274 | acm->clocal = ((termios->c_cflag & CLOCAL) != 0); | ||
2275 | |||
2276 | - if (!newline.dwDTERate) { | ||
2277 | + if (C_BAUD(tty) == B0) { | ||
2278 | newline.dwDTERate = acm->line.dwDTERate; | ||
2279 | newctrl &= ~ACM_CTRL_DTR; | ||
2280 | - } else | ||
2281 | + } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) { | ||
2282 | newctrl |= ACM_CTRL_DTR; | ||
2283 | + } | ||
2284 | |||
2285 | if (newctrl != acm->ctrlout) | ||
2286 | acm_set_control(acm, acm->ctrlout = newctrl); | ||
2287 | @@ -1588,6 +1589,7 @@ static const struct usb_device_id acm_ids[] = { | ||
2288 | { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ | ||
2289 | .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ | ||
2290 | }, | ||
2291 | + { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ | ||
2292 | { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ | ||
2293 | }, | ||
2294 | /* Motorola H24 HSPA module: */ | ||
2295 | diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c | ||
2296 | index d53547d2e4c7..f6e5ceb03afb 100644 | ||
2297 | --- a/drivers/usb/core/hcd.c | ||
2298 | +++ b/drivers/usb/core/hcd.c | ||
2299 | @@ -1947,6 +1947,8 @@ int usb_alloc_streams(struct usb_interface *interface, | ||
2300 | return -EINVAL; | ||
2301 | if (dev->speed != USB_SPEED_SUPER) | ||
2302 | return -EINVAL; | ||
2303 | + if (dev->state < USB_STATE_CONFIGURED) | ||
2304 | + return -ENODEV; | ||
2305 | |||
2306 | /* Streams only apply to bulk endpoints. */ | ||
2307 | for (i = 0; i < num_eps; i++) | ||
2308 | diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c | ||
2309 | index 3cea676ba901..6cd418f6ac07 100644 | ||
2310 | --- a/drivers/usb/dwc3/ep0.c | ||
2311 | +++ b/drivers/usb/dwc3/ep0.c | ||
2312 | @@ -270,7 +270,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) | ||
2313 | |||
2314 | /* stall is always issued on EP0 */ | ||
2315 | dep = dwc->eps[0]; | ||
2316 | - __dwc3_gadget_ep_set_halt(dep, 1); | ||
2317 | + __dwc3_gadget_ep_set_halt(dep, 1, false); | ||
2318 | dep->flags = DWC3_EP_ENABLED; | ||
2319 | dwc->delayed_status = false; | ||
2320 | |||
2321 | @@ -480,7 +480,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc, | ||
2322 | return -EINVAL; | ||
2323 | if (set == 0 && (dep->flags & DWC3_EP_WEDGE)) | ||
2324 | break; | ||
2325 | - ret = __dwc3_gadget_ep_set_halt(dep, set); | ||
2326 | + ret = __dwc3_gadget_ep_set_halt(dep, set, true); | ||
2327 | if (ret) | ||
2328 | return -EINVAL; | ||
2329 | break; | ||
2330 | diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c | ||
2331 | index d868b62c1a16..8f8e75e392de 100644 | ||
2332 | --- a/drivers/usb/dwc3/gadget.c | ||
2333 | +++ b/drivers/usb/dwc3/gadget.c | ||
2334 | @@ -550,12 +550,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, | ||
2335 | if (!usb_endpoint_xfer_isoc(desc)) | ||
2336 | return 0; | ||
2337 | |||
2338 | - memset(&trb_link, 0, sizeof(trb_link)); | ||
2339 | - | ||
2340 | /* Link TRB for ISOC. The HWO bit is never reset */ | ||
2341 | trb_st_hw = &dep->trb_pool[0]; | ||
2342 | |||
2343 | trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1]; | ||
2344 | + memset(trb_link, 0, sizeof(*trb_link)); | ||
2345 | |||
2346 | trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); | ||
2347 | trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); | ||
2348 | @@ -606,7 +605,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) | ||
2349 | |||
2350 | /* make sure HW endpoint isn't stalled */ | ||
2351 | if (dep->flags & DWC3_EP_STALL) | ||
2352 | - __dwc3_gadget_ep_set_halt(dep, 0); | ||
2353 | + __dwc3_gadget_ep_set_halt(dep, 0, false); | ||
2354 | |||
2355 | reg = dwc3_readl(dwc->regs, DWC3_DALEPENA); | ||
2356 | reg &= ~DWC3_DALEPENA_EP(dep->number); | ||
2357 | @@ -1206,7 +1205,7 @@ out0: | ||
2358 | return ret; | ||
2359 | } | ||
2360 | |||
2361 | -int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) | ||
2362 | +int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) | ||
2363 | { | ||
2364 | struct dwc3_gadget_ep_cmd_params params; | ||
2365 | struct dwc3 *dwc = dep->dwc; | ||
2366 | @@ -1215,6 +1214,14 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) | ||
2367 | memset(¶ms, 0x00, sizeof(params)); | ||
2368 | |||
2369 | if (value) { | ||
2370 | + if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) || | ||
2371 | + (!list_empty(&dep->req_queued) || | ||
2372 | + !list_empty(&dep->request_list)))) { | ||
2373 | + dev_dbg(dwc->dev, "%s: pending request, cannot halt\n", | ||
2374 | + dep->name); | ||
2375 | + return -EAGAIN; | ||
2376 | + } | ||
2377 | + | ||
2378 | ret = dwc3_send_gadget_ep_cmd(dwc, dep->number, | ||
2379 | DWC3_DEPCMD_SETSTALL, ¶ms); | ||
2380 | if (ret) | ||
2381 | @@ -1254,7 +1261,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value) | ||
2382 | goto out; | ||
2383 | } | ||
2384 | |||
2385 | - ret = __dwc3_gadget_ep_set_halt(dep, value); | ||
2386 | + ret = __dwc3_gadget_ep_set_halt(dep, value, false); | ||
2387 | out: | ||
2388 | spin_unlock_irqrestore(&dwc->lock, flags); | ||
2389 | |||
2390 | @@ -1274,7 +1281,7 @@ static int dwc3_gadget_ep_set_wedge(struct usb_ep *ep) | ||
2391 | if (dep->number == 0 || dep->number == 1) | ||
2392 | return dwc3_gadget_ep0_set_halt(ep, 1); | ||
2393 | else | ||
2394 | - return dwc3_gadget_ep_set_halt(ep, 1); | ||
2395 | + return __dwc3_gadget_ep_set_halt(dep, 1, false); | ||
2396 | } | ||
2397 | |||
2398 | /* -------------------------------------------------------------------------- */ | ||
2399 | diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h | ||
2400 | index 99e6d7248820..b3f25c302e35 100644 | ||
2401 | --- a/drivers/usb/dwc3/gadget.h | ||
2402 | +++ b/drivers/usb/dwc3/gadget.h | ||
2403 | @@ -114,7 +114,7 @@ void dwc3_ep0_out_start(struct dwc3 *dwc); | ||
2404 | int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value); | ||
2405 | int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, | ||
2406 | gfp_t gfp_flags); | ||
2407 | -int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value); | ||
2408 | +int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol); | ||
2409 | int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, | ||
2410 | unsigned cmd, struct dwc3_gadget_ep_cmd_params *params); | ||
2411 | int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param); | ||
2412 | diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c | ||
2413 | index ab1065afbbd0..3384486c2884 100644 | ||
2414 | --- a/drivers/usb/gadget/f_acm.c | ||
2415 | +++ b/drivers/usb/gadget/f_acm.c | ||
2416 | @@ -430,11 +430,12 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) | ||
2417 | if (acm->notify->driver_data) { | ||
2418 | VDBG(cdev, "reset acm control interface %d\n", intf); | ||
2419 | usb_ep_disable(acm->notify); | ||
2420 | - } else { | ||
2421 | - VDBG(cdev, "init acm ctrl interface %d\n", intf); | ||
2422 | + } | ||
2423 | + | ||
2424 | + if (!acm->notify->desc) | ||
2425 | if (config_ep_by_speed(cdev->gadget, f, acm->notify)) | ||
2426 | return -EINVAL; | ||
2427 | - } | ||
2428 | + | ||
2429 | usb_ep_enable(acm->notify); | ||
2430 | acm->notify->driver_data = acm; | ||
2431 | |||
2432 | diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c | ||
2433 | index 5514822114a5..817a26cbfab1 100644 | ||
2434 | --- a/drivers/usb/gadget/udc-core.c | ||
2435 | +++ b/drivers/usb/gadget/udc-core.c | ||
2436 | @@ -439,6 +439,11 @@ static ssize_t usb_udc_softconn_store(struct device *dev, | ||
2437 | { | ||
2438 | struct usb_udc *udc = container_of(dev, struct usb_udc, dev); | ||
2439 | |||
2440 | + if (!udc->driver) { | ||
2441 | + dev_err(dev, "soft-connect without a gadget driver\n"); | ||
2442 | + return -EOPNOTSUPP; | ||
2443 | + } | ||
2444 | + | ||
2445 | if (sysfs_streq(buf, "connect")) { | ||
2446 | usb_gadget_udc_start(udc->gadget, udc->driver); | ||
2447 | usb_gadget_connect(udc->gadget); | ||
2448 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c | ||
2449 | index b22a4bc308e2..e9183eda39e0 100644 | ||
2450 | --- a/drivers/usb/serial/cp210x.c | ||
2451 | +++ b/drivers/usb/serial/cp210x.c | ||
2452 | @@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = { | ||
2453 | { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ | ||
2454 | { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ | ||
2455 | { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ | ||
2456 | + { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ | ||
2457 | { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ | ||
2458 | { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */ | ||
2459 | { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */ | ||
2460 | diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c | ||
2461 | index 4235693ba2f7..768c2b4722d1 100644 | ||
2462 | --- a/drivers/usb/serial/ftdi_sio.c | ||
2463 | +++ b/drivers/usb/serial/ftdi_sio.c | ||
2464 | @@ -148,6 +148,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = { | ||
2465 | * /sys/bus/usb/ftdi_sio/new_id, then send patch/report! | ||
2466 | */ | ||
2467 | static struct usb_device_id id_table_combined [] = { | ||
2468 | + { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) }, | ||
2469 | { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) }, | ||
2470 | { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) }, | ||
2471 | { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) }, | ||
2472 | @@ -677,6 +678,8 @@ static struct usb_device_id id_table_combined [] = { | ||
2473 | { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) }, | ||
2474 | { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) }, | ||
2475 | { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) }, | ||
2476 | + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, | ||
2477 | + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, | ||
2478 | { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, | ||
2479 | { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, | ||
2480 | { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, | ||
2481 | diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h | ||
2482 | index 8927a5c39b00..302ab9a71f06 100644 | ||
2483 | --- a/drivers/usb/serial/ftdi_sio_ids.h | ||
2484 | +++ b/drivers/usb/serial/ftdi_sio_ids.h | ||
2485 | @@ -30,6 +30,12 @@ | ||
2486 | |||
2487 | /*** third-party PIDs (using FTDI_VID) ***/ | ||
2488 | |||
2489 | +/* | ||
2490 | + * Certain versions of the official Windows FTDI driver reprogrammed | ||
2491 | + * counterfeit FTDI devices to PID 0. Support these devices anyway. | ||
2492 | + */ | ||
2493 | +#define FTDI_BRICK_PID 0x0000 | ||
2494 | + | ||
2495 | #define FTDI_LUMEL_PD12_PID 0x6002 | ||
2496 | |||
2497 | /* | ||
2498 | @@ -143,8 +149,12 @@ | ||
2499 | * Xsens Technologies BV products (http://www.xsens.com). | ||
2500 | */ | ||
2501 | #define XSENS_VID 0x2639 | ||
2502 | -#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ | ||
2503 | +#define XSENS_AWINDA_STATION_PID 0x0101 | ||
2504 | +#define XSENS_AWINDA_DONGLE_PID 0x0102 | ||
2505 | #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ | ||
2506 | +#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ | ||
2507 | + | ||
2508 | +/* Xsens devices using FTDI VID */ | ||
2509 | #define XSENS_CONVERTER_0_PID 0xD388 /* Xsens USB converter */ | ||
2510 | #define XSENS_CONVERTER_1_PID 0xD389 /* Xsens Wireless Receiver */ | ||
2511 | #define XSENS_CONVERTER_2_PID 0xD38A | ||
2512 | diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c | ||
2513 | index 5f4b0cd0f6e9..b0eb1dfc601a 100644 | ||
2514 | --- a/drivers/usb/serial/opticon.c | ||
2515 | +++ b/drivers/usb/serial/opticon.c | ||
2516 | @@ -219,7 +219,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, | ||
2517 | |||
2518 | /* The conncected devices do not have a bulk write endpoint, | ||
2519 | * to transmit data to de barcode device the control endpoint is used */ | ||
2520 | - dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO); | ||
2521 | + dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC); | ||
2522 | if (!dr) { | ||
2523 | dev_err(&port->dev, "out of memory\n"); | ||
2524 | count = -ENOMEM; | ||
2525 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c | ||
2526 | index e47aabe0c760..8b3484134ab0 100644 | ||
2527 | --- a/drivers/usb/serial/option.c | ||
2528 | +++ b/drivers/usb/serial/option.c | ||
2529 | @@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb); | ||
2530 | #define TELIT_PRODUCT_DE910_DUAL 0x1010 | ||
2531 | #define TELIT_PRODUCT_UE910_V2 0x1012 | ||
2532 | #define TELIT_PRODUCT_LE920 0x1200 | ||
2533 | +#define TELIT_PRODUCT_LE910 0x1201 | ||
2534 | |||
2535 | /* ZTE PRODUCTS */ | ||
2536 | #define ZTE_VENDOR_ID 0x19d2 | ||
2537 | @@ -361,6 +362,7 @@ static void option_instat_callback(struct urb *urb); | ||
2538 | |||
2539 | /* Haier products */ | ||
2540 | #define HAIER_VENDOR_ID 0x201e | ||
2541 | +#define HAIER_PRODUCT_CE81B 0x10f8 | ||
2542 | #define HAIER_PRODUCT_CE100 0x2009 | ||
2543 | |||
2544 | /* Cinterion (formerly Siemens) products */ | ||
2545 | @@ -588,6 +590,11 @@ static const struct option_blacklist_info zte_1255_blacklist = { | ||
2546 | .reserved = BIT(3) | BIT(4), | ||
2547 | }; | ||
2548 | |||
2549 | +static const struct option_blacklist_info telit_le910_blacklist = { | ||
2550 | + .sendsetup = BIT(0), | ||
2551 | + .reserved = BIT(1) | BIT(2), | ||
2552 | +}; | ||
2553 | + | ||
2554 | static const struct option_blacklist_info telit_le920_blacklist = { | ||
2555 | .sendsetup = BIT(0), | ||
2556 | .reserved = BIT(1) | BIT(5), | ||
2557 | @@ -1137,6 +1144,8 @@ static const struct usb_device_id option_ids[] = { | ||
2558 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, | ||
2559 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, | ||
2560 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, | ||
2561 | + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), | ||
2562 | + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, | ||
2563 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), | ||
2564 | .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, | ||
2565 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ | ||
2566 | @@ -1612,6 +1621,7 @@ static const struct usb_device_id option_ids[] = { | ||
2567 | { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, | ||
2568 | { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, | ||
2569 | { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, | ||
2570 | + { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) }, | ||
2571 | /* Pirelli */ | ||
2572 | { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) }, | ||
2573 | { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2, 0xff) }, | ||
2574 | diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c | ||
2575 | index 22c7d4360fa2..b1d815eb6d0b 100644 | ||
2576 | --- a/drivers/usb/storage/transport.c | ||
2577 | +++ b/drivers/usb/storage/transport.c | ||
2578 | @@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) | ||
2579 | */ | ||
2580 | if (result == USB_STOR_XFER_LONG) | ||
2581 | fake_sense = 1; | ||
2582 | + | ||
2583 | + /* | ||
2584 | + * Sometimes a device will mistakenly skip the data phase | ||
2585 | + * and go directly to the status phase without sending a | ||
2586 | + * zero-length packet. If we get a 13-byte response here, | ||
2587 | + * check whether it really is a CSW. | ||
2588 | + */ | ||
2589 | + if (result == USB_STOR_XFER_SHORT && | ||
2590 | + srb->sc_data_direction == DMA_FROM_DEVICE && | ||
2591 | + transfer_length - scsi_get_resid(srb) == | ||
2592 | + US_BULK_CS_WRAP_LEN) { | ||
2593 | + struct scatterlist *sg = NULL; | ||
2594 | + unsigned int offset = 0; | ||
2595 | + | ||
2596 | + if (usb_stor_access_xfer_buf((unsigned char *) bcs, | ||
2597 | + US_BULK_CS_WRAP_LEN, srb, &sg, | ||
2598 | + &offset, FROM_XFER_BUF) == | ||
2599 | + US_BULK_CS_WRAP_LEN && | ||
2600 | + bcs->Signature == | ||
2601 | + cpu_to_le32(US_BULK_CS_SIGN)) { | ||
2602 | + usb_stor_dbg(us, "Device skipped data phase\n"); | ||
2603 | + scsi_set_resid(srb, transfer_length); | ||
2604 | + goto skipped_data_phase; | ||
2605 | + } | ||
2606 | + } | ||
2607 | } | ||
2608 | |||
2609 | /* See flow chart on pg 15 of the Bulk Only Transport spec for | ||
2610 | @@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) | ||
2611 | if (result != USB_STOR_XFER_GOOD) | ||
2612 | return USB_STOR_TRANSPORT_ERROR; | ||
2613 | |||
2614 | + skipped_data_phase: | ||
2615 | /* check bulk status */ | ||
2616 | residue = le32_to_cpu(bcs->Residue); | ||
2617 | usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n", | ||
2618 | diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c | ||
2619 | index 61b182bf32a2..dbfe4eecf12e 100644 | ||
2620 | --- a/drivers/video/console/bitblit.c | ||
2621 | +++ b/drivers/video/console/bitblit.c | ||
2622 | @@ -205,7 +205,6 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, | ||
2623 | static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, | ||
2624 | int bottom_only) | ||
2625 | { | ||
2626 | - int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; | ||
2627 | unsigned int cw = vc->vc_font.width; | ||
2628 | unsigned int ch = vc->vc_font.height; | ||
2629 | unsigned int rw = info->var.xres - (vc->vc_cols*cw); | ||
2630 | @@ -214,7 +213,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, | ||
2631 | unsigned int bs = info->var.yres - bh; | ||
2632 | struct fb_fillrect region; | ||
2633 | |||
2634 | - region.color = attr_bgcol_ec(bgshift, vc, info); | ||
2635 | + region.color = 0; | ||
2636 | region.rop = ROP_COPY; | ||
2637 | |||
2638 | if (rw && !bottom_only) { | ||
2639 | diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c | ||
2640 | index 41b32ae23dac..5a3cbf6dff4d 100644 | ||
2641 | --- a/drivers/video/console/fbcon_ccw.c | ||
2642 | +++ b/drivers/video/console/fbcon_ccw.c | ||
2643 | @@ -197,9 +197,8 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, | ||
2644 | unsigned int bh = info->var.xres - (vc->vc_rows*ch); | ||
2645 | unsigned int bs = vc->vc_rows*ch; | ||
2646 | struct fb_fillrect region; | ||
2647 | - int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; | ||
2648 | |||
2649 | - region.color = attr_bgcol_ec(bgshift,vc,info); | ||
2650 | + region.color = 0; | ||
2651 | region.rop = ROP_COPY; | ||
2652 | |||
2653 | if (rw && !bottom_only) { | ||
2654 | diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c | ||
2655 | index a93670ef7f89..e7ee44db4e98 100644 | ||
2656 | --- a/drivers/video/console/fbcon_cw.c | ||
2657 | +++ b/drivers/video/console/fbcon_cw.c | ||
2658 | @@ -180,9 +180,8 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, | ||
2659 | unsigned int bh = info->var.xres - (vc->vc_rows*ch); | ||
2660 | unsigned int rs = info->var.yres - rw; | ||
2661 | struct fb_fillrect region; | ||
2662 | - int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; | ||
2663 | |||
2664 | - region.color = attr_bgcol_ec(bgshift,vc,info); | ||
2665 | + region.color = 0; | ||
2666 | region.rop = ROP_COPY; | ||
2667 | |||
2668 | if (rw && !bottom_only) { | ||
2669 | diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c | ||
2670 | index ff0872c0498b..19e3714abfe8 100644 | ||
2671 | --- a/drivers/video/console/fbcon_ud.c | ||
2672 | +++ b/drivers/video/console/fbcon_ud.c | ||
2673 | @@ -227,9 +227,8 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, | ||
2674 | unsigned int rw = info->var.xres - (vc->vc_cols*cw); | ||
2675 | unsigned int bh = info->var.yres - (vc->vc_rows*ch); | ||
2676 | struct fb_fillrect region; | ||
2677 | - int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; | ||
2678 | |||
2679 | - region.color = attr_bgcol_ec(bgshift,vc,info); | ||
2680 | + region.color = 0; | ||
2681 | region.rop = ROP_COPY; | ||
2682 | |||
2683 | if (rw && !bottom_only) { | ||
2684 | diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c | ||
2685 | index a7ce73029f59..933241a6ab10 100644 | ||
2686 | --- a/drivers/virtio/virtio_pci.c | ||
2687 | +++ b/drivers/virtio/virtio_pci.c | ||
2688 | @@ -791,6 +791,7 @@ static int virtio_pci_restore(struct device *dev) | ||
2689 | struct pci_dev *pci_dev = to_pci_dev(dev); | ||
2690 | struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev); | ||
2691 | struct virtio_driver *drv; | ||
2692 | + unsigned status = 0; | ||
2693 | int ret; | ||
2694 | |||
2695 | drv = container_of(vp_dev->vdev.dev.driver, | ||
2696 | @@ -801,14 +802,40 @@ static int virtio_pci_restore(struct device *dev) | ||
2697 | return ret; | ||
2698 | |||
2699 | pci_set_master(pci_dev); | ||
2700 | + /* We always start by resetting the device, in case a previous | ||
2701 | + * driver messed it up. */ | ||
2702 | + vp_reset(&vp_dev->vdev); | ||
2703 | + | ||
2704 | + /* Acknowledge that we've seen the device. */ | ||
2705 | + status |= VIRTIO_CONFIG_S_ACKNOWLEDGE; | ||
2706 | + vp_set_status(&vp_dev->vdev, status); | ||
2707 | + | ||
2708 | + /* Maybe driver failed before freeze. | ||
2709 | + * Restore the failed status, for debugging. */ | ||
2710 | + status |= vp_dev->saved_status & VIRTIO_CONFIG_S_FAILED; | ||
2711 | + vp_set_status(&vp_dev->vdev, status); | ||
2712 | + | ||
2713 | + if (!drv) | ||
2714 | + return 0; | ||
2715 | + | ||
2716 | + /* We have a driver! */ | ||
2717 | + status |= VIRTIO_CONFIG_S_DRIVER; | ||
2718 | + vp_set_status(&vp_dev->vdev, status); | ||
2719 | + | ||
2720 | vp_finalize_features(&vp_dev->vdev); | ||
2721 | |||
2722 | - if (drv && drv->restore) | ||
2723 | + if (drv->restore) { | ||
2724 | ret = drv->restore(&vp_dev->vdev); | ||
2725 | + if (ret) { | ||
2726 | + status |= VIRTIO_CONFIG_S_FAILED; | ||
2727 | + vp_set_status(&vp_dev->vdev, status); | ||
2728 | + return ret; | ||
2729 | + } | ||
2730 | + } | ||
2731 | |||
2732 | /* Finally, tell the device we're all set */ | ||
2733 | - if (!ret) | ||
2734 | - vp_set_status(&vp_dev->vdev, vp_dev->saved_status); | ||
2735 | + status |= VIRTIO_CONFIG_S_DRIVER_OK; | ||
2736 | + vp_set_status(&vp_dev->vdev, status); | ||
2737 | |||
2738 | return ret; | ||
2739 | } | ||
2740 | diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c | ||
2741 | index 3af77aa051d2..e4bcfec7787e 100644 | ||
2742 | --- a/fs/btrfs/file-item.c | ||
2743 | +++ b/fs/btrfs/file-item.c | ||
2744 | @@ -403,7 +403,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end, | ||
2745 | ret = 0; | ||
2746 | fail: | ||
2747 | while (ret < 0 && !list_empty(&tmplist)) { | ||
2748 | - sums = list_entry(&tmplist, struct btrfs_ordered_sum, list); | ||
2749 | + sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list); | ||
2750 | list_del(&sums->list); | ||
2751 | kfree(sums); | ||
2752 | } | ||
2753 | diff --git a/fs/buffer.c b/fs/buffer.c | ||
2754 | index 10fca21ee8aa..83fedaa53b55 100644 | ||
2755 | --- a/fs/buffer.c | ||
2756 | +++ b/fs/buffer.c | ||
2757 | @@ -2018,6 +2018,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, | ||
2758 | struct page *page, void *fsdata) | ||
2759 | { | ||
2760 | struct inode *inode = mapping->host; | ||
2761 | + loff_t old_size = inode->i_size; | ||
2762 | int i_size_changed = 0; | ||
2763 | |||
2764 | copied = block_write_end(file, mapping, pos, len, copied, page, fsdata); | ||
2765 | @@ -2037,6 +2038,8 @@ int generic_write_end(struct file *file, struct address_space *mapping, | ||
2766 | unlock_page(page); | ||
2767 | page_cache_release(page); | ||
2768 | |||
2769 | + if (old_size < pos) | ||
2770 | + pagecache_isize_extended(inode, old_size, pos); | ||
2771 | /* | ||
2772 | * Don't mark the inode dirty under page lock. First, it unnecessarily | ||
2773 | * makes the holding time of page lock longer. Second, it forces lock | ||
2774 | @@ -2254,6 +2257,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping, | ||
2775 | err = 0; | ||
2776 | |||
2777 | balance_dirty_pages_ratelimited(mapping); | ||
2778 | + | ||
2779 | + if (unlikely(fatal_signal_pending(current))) { | ||
2780 | + err = -EINTR; | ||
2781 | + goto out; | ||
2782 | + } | ||
2783 | } | ||
2784 | |||
2785 | /* page covers the boundary, find the boundary offset */ | ||
2786 | diff --git a/fs/ext3/super.c b/fs/ext3/super.c | ||
2787 | index 6356665a74bb..882d4bdfd428 100644 | ||
2788 | --- a/fs/ext3/super.c | ||
2789 | +++ b/fs/ext3/super.c | ||
2790 | @@ -1300,13 +1300,6 @@ set_qf_format: | ||
2791 | "not specified."); | ||
2792 | return 0; | ||
2793 | } | ||
2794 | - } else { | ||
2795 | - if (sbi->s_jquota_fmt) { | ||
2796 | - ext3_msg(sb, KERN_ERR, "error: journaled quota format " | ||
2797 | - "specified with no journaling " | ||
2798 | - "enabled."); | ||
2799 | - return 0; | ||
2800 | - } | ||
2801 | } | ||
2802 | #endif | ||
2803 | return 1; | ||
2804 | diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h | ||
2805 | index 790b14c5f262..e4c4ac07cc32 100644 | ||
2806 | --- a/fs/ext4/ext4.h | ||
2807 | +++ b/fs/ext4/ext4.h | ||
2808 | @@ -2088,6 +2088,7 @@ int do_journal_get_write_access(handle_t *handle, | ||
2809 | #define CONVERT_INLINE_DATA 2 | ||
2810 | |||
2811 | extern struct inode *ext4_iget(struct super_block *, unsigned long); | ||
2812 | +extern struct inode *ext4_iget_normal(struct super_block *, unsigned long); | ||
2813 | extern int ext4_write_inode(struct inode *, struct writeback_control *); | ||
2814 | extern int ext4_setattr(struct dentry *, struct iattr *); | ||
2815 | extern int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry, | ||
2816 | @@ -2260,8 +2261,8 @@ extern int ext4_register_li_request(struct super_block *sb, | ||
2817 | static inline int ext4_has_group_desc_csum(struct super_block *sb) | ||
2818 | { | ||
2819 | return EXT4_HAS_RO_COMPAT_FEATURE(sb, | ||
2820 | - EXT4_FEATURE_RO_COMPAT_GDT_CSUM | | ||
2821 | - EXT4_FEATURE_RO_COMPAT_METADATA_CSUM); | ||
2822 | + EXT4_FEATURE_RO_COMPAT_GDT_CSUM) || | ||
2823 | + (EXT4_SB(sb)->s_chksum_driver != NULL); | ||
2824 | } | ||
2825 | |||
2826 | static inline ext4_fsblk_t ext4_blocks_count(struct ext4_super_block *es) | ||
2827 | diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c | ||
2828 | index 1ecd3a8c2444..4d4718cf25ab 100644 | ||
2829 | --- a/fs/ext4/ialloc.c | ||
2830 | +++ b/fs/ext4/ialloc.c | ||
2831 | @@ -793,6 +793,10 @@ got: | ||
2832 | struct buffer_head *block_bitmap_bh; | ||
2833 | |||
2834 | block_bitmap_bh = ext4_read_block_bitmap(sb, group); | ||
2835 | + if (!block_bitmap_bh) { | ||
2836 | + err = -EIO; | ||
2837 | + goto out; | ||
2838 | + } | ||
2839 | BUFFER_TRACE(block_bitmap_bh, "get block bitmap access"); | ||
2840 | err = ext4_journal_get_write_access(handle, block_bitmap_bh); | ||
2841 | if (err) { | ||
2842 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c | ||
2843 | index f9e11df768d5..e48bd5a1814b 100644 | ||
2844 | --- a/fs/ext4/inode.c | ||
2845 | +++ b/fs/ext4/inode.c | ||
2846 | @@ -2647,6 +2647,20 @@ static int ext4_nonda_switch(struct super_block *sb) | ||
2847 | return 0; | ||
2848 | } | ||
2849 | |||
2850 | +/* We always reserve for an inode update; the superblock could be there too */ | ||
2851 | +static int ext4_da_write_credits(struct inode *inode, loff_t pos, unsigned len) | ||
2852 | +{ | ||
2853 | + if (likely(EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, | ||
2854 | + EXT4_FEATURE_RO_COMPAT_LARGE_FILE))) | ||
2855 | + return 1; | ||
2856 | + | ||
2857 | + if (pos + len <= 0x7fffffffULL) | ||
2858 | + return 1; | ||
2859 | + | ||
2860 | + /* We might need to update the superblock to set LARGE_FILE */ | ||
2861 | + return 2; | ||
2862 | +} | ||
2863 | + | ||
2864 | static int ext4_da_write_begin(struct file *file, struct address_space *mapping, | ||
2865 | loff_t pos, unsigned len, unsigned flags, | ||
2866 | struct page **pagep, void **fsdata) | ||
2867 | @@ -2697,7 +2711,8 @@ retry_grab: | ||
2868 | * of file which has an already mapped buffer. | ||
2869 | */ | ||
2870 | retry_journal: | ||
2871 | - handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, 1); | ||
2872 | + handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, | ||
2873 | + ext4_da_write_credits(inode, pos, len)); | ||
2874 | if (IS_ERR(handle)) { | ||
2875 | page_cache_release(page); | ||
2876 | return PTR_ERR(handle); | ||
2877 | @@ -4351,6 +4366,13 @@ bad_inode: | ||
2878 | return ERR_PTR(ret); | ||
2879 | } | ||
2880 | |||
2881 | +struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino) | ||
2882 | +{ | ||
2883 | + if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) | ||
2884 | + return ERR_PTR(-EIO); | ||
2885 | + return ext4_iget(sb, ino); | ||
2886 | +} | ||
2887 | + | ||
2888 | static int ext4_inode_blocks_set(handle_t *handle, | ||
2889 | struct ext4_inode *raw_inode, | ||
2890 | struct ext4_inode_info *ei) | ||
2891 | diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c | ||
2892 | index 42624a995b00..d4fd81c44f55 100644 | ||
2893 | --- a/fs/ext4/ioctl.c | ||
2894 | +++ b/fs/ext4/ioctl.c | ||
2895 | @@ -549,9 +549,17 @@ group_add_out: | ||
2896 | } | ||
2897 | |||
2898 | case EXT4_IOC_SWAP_BOOT: | ||
2899 | + { | ||
2900 | + int err; | ||
2901 | if (!(filp->f_mode & FMODE_WRITE)) | ||
2902 | return -EBADF; | ||
2903 | - return swap_inode_boot_loader(sb, inode); | ||
2904 | + err = mnt_want_write_file(filp); | ||
2905 | + if (err) | ||
2906 | + return err; | ||
2907 | + err = swap_inode_boot_loader(sb, inode); | ||
2908 | + mnt_drop_write_file(filp); | ||
2909 | + return err; | ||
2910 | + } | ||
2911 | |||
2912 | case EXT4_IOC_RESIZE_FS: { | ||
2913 | ext4_fsblk_t n_blocks_count; | ||
2914 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c | ||
2915 | index ab2f6dc44b3a..f1312173fa90 100644 | ||
2916 | --- a/fs/ext4/namei.c | ||
2917 | +++ b/fs/ext4/namei.c | ||
2918 | @@ -1430,7 +1430,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi | ||
2919 | dentry->d_name.name); | ||
2920 | return ERR_PTR(-EIO); | ||
2921 | } | ||
2922 | - inode = ext4_iget(dir->i_sb, ino); | ||
2923 | + inode = ext4_iget_normal(dir->i_sb, ino); | ||
2924 | if (inode == ERR_PTR(-ESTALE)) { | ||
2925 | EXT4_ERROR_INODE(dir, | ||
2926 | "deleted inode referenced: %u", | ||
2927 | @@ -1461,7 +1461,7 @@ struct dentry *ext4_get_parent(struct dentry *child) | ||
2928 | return ERR_PTR(-EIO); | ||
2929 | } | ||
2930 | |||
2931 | - return d_obtain_alias(ext4_iget(child->d_inode->i_sb, ino)); | ||
2932 | + return d_obtain_alias(ext4_iget_normal(child->d_inode->i_sb, ino)); | ||
2933 | } | ||
2934 | |||
2935 | /* | ||
2936 | diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c | ||
2937 | index c503850a61a8..a69bd74ed390 100644 | ||
2938 | --- a/fs/ext4/resize.c | ||
2939 | +++ b/fs/ext4/resize.c | ||
2940 | @@ -1066,7 +1066,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data, | ||
2941 | break; | ||
2942 | |||
2943 | if (meta_bg == 0) | ||
2944 | - backup_block = group * bpg + blk_off; | ||
2945 | + backup_block = ((ext4_fsblk_t)group) * bpg + blk_off; | ||
2946 | else | ||
2947 | backup_block = (ext4_group_first_block_no(sb, group) + | ||
2948 | ext4_bg_has_super(sb, group)); | ||
2949 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c | ||
2950 | index 1fc14f7a08b2..21a0b43a7d31 100644 | ||
2951 | --- a/fs/ext4/super.c | ||
2952 | +++ b/fs/ext4/super.c | ||
2953 | @@ -964,7 +964,7 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb, | ||
2954 | * Currently we don't know the generation for parent directory, so | ||
2955 | * a generation of 0 means "accept any" | ||
2956 | */ | ||
2957 | - inode = ext4_iget(sb, ino); | ||
2958 | + inode = ext4_iget_normal(sb, ino); | ||
2959 | if (IS_ERR(inode)) | ||
2960 | return ERR_CAST(inode); | ||
2961 | if (generation && inode->i_generation != generation) { | ||
2962 | @@ -1632,13 +1632,6 @@ static int parse_options(char *options, struct super_block *sb, | ||
2963 | "not specified"); | ||
2964 | return 0; | ||
2965 | } | ||
2966 | - } else { | ||
2967 | - if (sbi->s_jquota_fmt) { | ||
2968 | - ext4_msg(sb, KERN_ERR, "journaled quota format " | ||
2969 | - "specified with no journaling " | ||
2970 | - "enabled"); | ||
2971 | - return 0; | ||
2972 | - } | ||
2973 | } | ||
2974 | #endif | ||
2975 | if (test_opt(sb, DIOREAD_NOLOCK)) { | ||
2976 | @@ -1957,6 +1950,10 @@ static __le16 ext4_group_desc_csum(struct ext4_sb_info *sbi, __u32 block_group, | ||
2977 | } | ||
2978 | |||
2979 | /* old crc16 code */ | ||
2980 | + if (!(sbi->s_es->s_feature_ro_compat & | ||
2981 | + cpu_to_le32(EXT4_FEATURE_RO_COMPAT_GDT_CSUM))) | ||
2982 | + return 0; | ||
2983 | + | ||
2984 | offset = offsetof(struct ext4_group_desc, bg_checksum); | ||
2985 | |||
2986 | crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid)); | ||
2987 | diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c | ||
2988 | index 298e9c8da364..a20816e7eb3a 100644 | ||
2989 | --- a/fs/ext4/xattr.c | ||
2990 | +++ b/fs/ext4/xattr.c | ||
2991 | @@ -189,14 +189,28 @@ ext4_listxattr(struct dentry *dentry, char *buffer, size_t size) | ||
2992 | } | ||
2993 | |||
2994 | static int | ||
2995 | -ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end) | ||
2996 | +ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end, | ||
2997 | + void *value_start) | ||
2998 | { | ||
2999 | - while (!IS_LAST_ENTRY(entry)) { | ||
3000 | - struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(entry); | ||
3001 | + struct ext4_xattr_entry *e = entry; | ||
3002 | + | ||
3003 | + while (!IS_LAST_ENTRY(e)) { | ||
3004 | + struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e); | ||
3005 | if ((void *)next >= end) | ||
3006 | return -EIO; | ||
3007 | - entry = next; | ||
3008 | + e = next; | ||
3009 | } | ||
3010 | + | ||
3011 | + while (!IS_LAST_ENTRY(entry)) { | ||
3012 | + if (entry->e_value_size != 0 && | ||
3013 | + (value_start + le16_to_cpu(entry->e_value_offs) < | ||
3014 | + (void *)e + sizeof(__u32) || | ||
3015 | + value_start + le16_to_cpu(entry->e_value_offs) + | ||
3016 | + le32_to_cpu(entry->e_value_size) > end)) | ||
3017 | + return -EIO; | ||
3018 | + entry = EXT4_XATTR_NEXT(entry); | ||
3019 | + } | ||
3020 | + | ||
3021 | return 0; | ||
3022 | } | ||
3023 | |||
3024 | @@ -213,7 +227,8 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh) | ||
3025 | return -EIO; | ||
3026 | if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh))) | ||
3027 | return -EIO; | ||
3028 | - error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size); | ||
3029 | + error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size, | ||
3030 | + bh->b_data); | ||
3031 | if (!error) | ||
3032 | set_buffer_verified(bh); | ||
3033 | return error; | ||
3034 | @@ -329,7 +344,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, | ||
3035 | header = IHDR(inode, raw_inode); | ||
3036 | entry = IFIRST(header); | ||
3037 | end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; | ||
3038 | - error = ext4_xattr_check_names(entry, end); | ||
3039 | + error = ext4_xattr_check_names(entry, end, entry); | ||
3040 | if (error) | ||
3041 | goto cleanup; | ||
3042 | error = ext4_xattr_find_entry(&entry, name_index, name, | ||
3043 | @@ -457,7 +472,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size) | ||
3044 | raw_inode = ext4_raw_inode(&iloc); | ||
3045 | header = IHDR(inode, raw_inode); | ||
3046 | end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; | ||
3047 | - error = ext4_xattr_check_names(IFIRST(header), end); | ||
3048 | + error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header)); | ||
3049 | if (error) | ||
3050 | goto cleanup; | ||
3051 | error = ext4_xattr_list_entries(dentry, IFIRST(header), | ||
3052 | @@ -972,7 +987,8 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, | ||
3053 | is->s.here = is->s.first; | ||
3054 | is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; | ||
3055 | if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) { | ||
3056 | - error = ext4_xattr_check_names(IFIRST(header), is->s.end); | ||
3057 | + error = ext4_xattr_check_names(IFIRST(header), is->s.end, | ||
3058 | + IFIRST(header)); | ||
3059 | if (error) | ||
3060 | return error; | ||
3061 | /* Find the named attribute. */ | ||
3062 | diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c | ||
3063 | index 3bacc1909ddb..6e2fb5cbacde 100644 | ||
3064 | --- a/fs/jbd2/recovery.c | ||
3065 | +++ b/fs/jbd2/recovery.c | ||
3066 | @@ -522,6 +522,7 @@ static int do_one_pass(journal_t *journal, | ||
3067 | !jbd2_descr_block_csum_verify(journal, | ||
3068 | bh->b_data)) { | ||
3069 | err = -EIO; | ||
3070 | + brelse(bh); | ||
3071 | goto failed; | ||
3072 | } | ||
3073 | |||
3074 | diff --git a/fs/jffs2/jffs2_fs_sb.h b/fs/jffs2/jffs2_fs_sb.h | ||
3075 | index 413ef89c2d1b..046fee8b6e9b 100644 | ||
3076 | --- a/fs/jffs2/jffs2_fs_sb.h | ||
3077 | +++ b/fs/jffs2/jffs2_fs_sb.h | ||
3078 | @@ -134,8 +134,6 @@ struct jffs2_sb_info { | ||
3079 | struct rw_semaphore wbuf_sem; /* Protects the write buffer */ | ||
3080 | |||
3081 | struct delayed_work wbuf_dwork; /* write-buffer write-out work */ | ||
3082 | - int wbuf_queued; /* non-zero delayed work is queued */ | ||
3083 | - spinlock_t wbuf_dwork_lock; /* protects wbuf_dwork and and wbuf_queued */ | ||
3084 | |||
3085 | unsigned char *oobbuf; | ||
3086 | int oobavail; /* How many bytes are available for JFFS2 in OOB */ | ||
3087 | diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c | ||
3088 | index a6597d60d76d..09ed55190ee2 100644 | ||
3089 | --- a/fs/jffs2/wbuf.c | ||
3090 | +++ b/fs/jffs2/wbuf.c | ||
3091 | @@ -1162,10 +1162,6 @@ static void delayed_wbuf_sync(struct work_struct *work) | ||
3092 | struct jffs2_sb_info *c = work_to_sb(work); | ||
3093 | struct super_block *sb = OFNI_BS_2SFFJ(c); | ||
3094 | |||
3095 | - spin_lock(&c->wbuf_dwork_lock); | ||
3096 | - c->wbuf_queued = 0; | ||
3097 | - spin_unlock(&c->wbuf_dwork_lock); | ||
3098 | - | ||
3099 | if (!(sb->s_flags & MS_RDONLY)) { | ||
3100 | jffs2_dbg(1, "%s()\n", __func__); | ||
3101 | jffs2_flush_wbuf_gc(c, 0); | ||
3102 | @@ -1180,14 +1176,9 @@ void jffs2_dirty_trigger(struct jffs2_sb_info *c) | ||
3103 | if (sb->s_flags & MS_RDONLY) | ||
3104 | return; | ||
3105 | |||
3106 | - spin_lock(&c->wbuf_dwork_lock); | ||
3107 | - if (!c->wbuf_queued) { | ||
3108 | + delay = msecs_to_jiffies(dirty_writeback_interval * 10); | ||
3109 | + if (queue_delayed_work(system_long_wq, &c->wbuf_dwork, delay)) | ||
3110 | jffs2_dbg(1, "%s()\n", __func__); | ||
3111 | - delay = msecs_to_jiffies(dirty_writeback_interval * 10); | ||
3112 | - queue_delayed_work(system_long_wq, &c->wbuf_dwork, delay); | ||
3113 | - c->wbuf_queued = 1; | ||
3114 | - } | ||
3115 | - spin_unlock(&c->wbuf_dwork_lock); | ||
3116 | } | ||
3117 | |||
3118 | int jffs2_nand_flash_setup(struct jffs2_sb_info *c) | ||
3119 | @@ -1211,7 +1202,6 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c) | ||
3120 | |||
3121 | /* Initialise write buffer */ | ||
3122 | init_rwsem(&c->wbuf_sem); | ||
3123 | - spin_lock_init(&c->wbuf_dwork_lock); | ||
3124 | INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); | ||
3125 | c->wbuf_pagesize = c->mtd->writesize; | ||
3126 | c->wbuf_ofs = 0xFFFFFFFF; | ||
3127 | @@ -1251,7 +1241,6 @@ int jffs2_dataflash_setup(struct jffs2_sb_info *c) { | ||
3128 | |||
3129 | /* Initialize write buffer */ | ||
3130 | init_rwsem(&c->wbuf_sem); | ||
3131 | - spin_lock_init(&c->wbuf_dwork_lock); | ||
3132 | INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); | ||
3133 | c->wbuf_pagesize = c->mtd->erasesize; | ||
3134 | |||
3135 | @@ -1311,7 +1300,6 @@ int jffs2_nor_wbuf_flash_setup(struct jffs2_sb_info *c) { | ||
3136 | |||
3137 | /* Initialize write buffer */ | ||
3138 | init_rwsem(&c->wbuf_sem); | ||
3139 | - spin_lock_init(&c->wbuf_dwork_lock); | ||
3140 | INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); | ||
3141 | |||
3142 | c->wbuf_pagesize = c->mtd->writesize; | ||
3143 | @@ -1346,7 +1334,6 @@ int jffs2_ubivol_setup(struct jffs2_sb_info *c) { | ||
3144 | return 0; | ||
3145 | |||
3146 | init_rwsem(&c->wbuf_sem); | ||
3147 | - spin_lock_init(&c->wbuf_dwork_lock); | ||
3148 | INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); | ||
3149 | |||
3150 | c->wbuf_pagesize = c->mtd->writesize; | ||
3151 | diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c | ||
3152 | index 1812f026960c..6ae664b489af 100644 | ||
3153 | --- a/fs/lockd/mon.c | ||
3154 | +++ b/fs/lockd/mon.c | ||
3155 | @@ -159,6 +159,12 @@ static int nsm_mon_unmon(struct nsm_handle *nsm, u32 proc, struct nsm_res *res, | ||
3156 | |||
3157 | msg.rpc_proc = &clnt->cl_procinfo[proc]; | ||
3158 | status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); | ||
3159 | + if (status == -ECONNREFUSED) { | ||
3160 | + dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n", | ||
3161 | + status); | ||
3162 | + rpc_force_rebind(clnt); | ||
3163 | + status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); | ||
3164 | + } | ||
3165 | if (status < 0) | ||
3166 | dprintk("lockd: NSM upcall RPC failed, status=%d\n", | ||
3167 | status); | ||
3168 | diff --git a/fs/namespace.c b/fs/namespace.c | ||
3169 | index 7f6a9348c589..154822397780 100644 | ||
3170 | --- a/fs/namespace.c | ||
3171 | +++ b/fs/namespace.c | ||
3172 | @@ -2696,6 +2696,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, | ||
3173 | /* make sure we can reach put_old from new_root */ | ||
3174 | if (!is_path_reachable(old_mnt, old.dentry, &new)) | ||
3175 | goto out4; | ||
3176 | + /* make certain new is below the root */ | ||
3177 | + if (!is_path_reachable(new_mnt, new.dentry, &root)) | ||
3178 | + goto out4; | ||
3179 | root_mp->m_count++; /* pin it so it won't go away */ | ||
3180 | br_write_lock(&vfsmount_lock); | ||
3181 | detach_mnt(new_mnt, &parent_path); | ||
3182 | diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c | ||
3183 | index 0f9ce13972d0..9240dd1678da 100644 | ||
3184 | --- a/fs/nfsd/nfs4proc.c | ||
3185 | +++ b/fs/nfsd/nfs4proc.c | ||
3186 | @@ -1191,7 +1191,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp) | ||
3187 | */ | ||
3188 | if (argp->opcnt == resp->opcnt) | ||
3189 | return false; | ||
3190 | - | ||
3191 | + if (next->opnum == OP_ILLEGAL) | ||
3192 | + return false; | ||
3193 | nextd = OPDESC(next); | ||
3194 | /* | ||
3195 | * Rest of 2.6.3.1.1: certain operations will return WRONGSEC | ||
3196 | diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c | ||
3197 | index e4bcb2cf055a..3ba30825f387 100644 | ||
3198 | --- a/fs/pstore/inode.c | ||
3199 | +++ b/fs/pstore/inode.c | ||
3200 | @@ -316,10 +316,10 @@ int pstore_mkfile(enum pstore_type_id type, char *psname, u64 id, int count, | ||
3201 | sprintf(name, "dmesg-%s-%lld", psname, id); | ||
3202 | break; | ||
3203 | case PSTORE_TYPE_CONSOLE: | ||
3204 | - sprintf(name, "console-%s", psname); | ||
3205 | + sprintf(name, "console-%s-%lld", psname, id); | ||
3206 | break; | ||
3207 | case PSTORE_TYPE_FTRACE: | ||
3208 | - sprintf(name, "ftrace-%s", psname); | ||
3209 | + sprintf(name, "ftrace-%s-%lld", psname, id); | ||
3210 | break; | ||
3211 | case PSTORE_TYPE_MCE: | ||
3212 | sprintf(name, "mce-%s-%lld", psname, id); | ||
3213 | diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c | ||
3214 | index 38802d683969..7a10e047bc33 100644 | ||
3215 | --- a/fs/quota/dquot.c | ||
3216 | +++ b/fs/quota/dquot.c | ||
3217 | @@ -637,7 +637,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type) | ||
3218 | dqstats_inc(DQST_LOOKUPS); | ||
3219 | err = sb->dq_op->write_dquot(dquot); | ||
3220 | if (!ret && err) | ||
3221 | - err = ret; | ||
3222 | + ret = err; | ||
3223 | dqput(dquot); | ||
3224 | spin_lock(&dq_list_lock); | ||
3225 | } | ||
3226 | diff --git a/fs/super.c b/fs/super.c | ||
3227 | index 68307c029228..e028b508db25 100644 | ||
3228 | --- a/fs/super.c | ||
3229 | +++ b/fs/super.c | ||
3230 | @@ -76,6 +76,8 @@ static int prune_super(struct shrinker *shrink, struct shrink_control *sc) | ||
3231 | |||
3232 | total_objects = sb->s_nr_dentry_unused + | ||
3233 | sb->s_nr_inodes_unused + fs_objects + 1; | ||
3234 | + if (!total_objects) | ||
3235 | + total_objects = 1; | ||
3236 | |||
3237 | if (sc->nr_to_scan) { | ||
3238 | int dentries; | ||
3239 | diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c | ||
3240 | index ff8229340cd5..26b69b2d4a45 100644 | ||
3241 | --- a/fs/ubifs/commit.c | ||
3242 | +++ b/fs/ubifs/commit.c | ||
3243 | @@ -166,15 +166,10 @@ static int do_commit(struct ubifs_info *c) | ||
3244 | err = ubifs_orphan_end_commit(c); | ||
3245 | if (err) | ||
3246 | goto out; | ||
3247 | - old_ltail_lnum = c->ltail_lnum; | ||
3248 | - err = ubifs_log_end_commit(c, new_ltail_lnum); | ||
3249 | - if (err) | ||
3250 | - goto out; | ||
3251 | err = dbg_check_old_index(c, &zroot); | ||
3252 | if (err) | ||
3253 | goto out; | ||
3254 | |||
3255 | - mutex_lock(&c->mst_mutex); | ||
3256 | c->mst_node->cmt_no = cpu_to_le64(c->cmt_no); | ||
3257 | c->mst_node->log_lnum = cpu_to_le32(new_ltail_lnum); | ||
3258 | c->mst_node->root_lnum = cpu_to_le32(zroot.lnum); | ||
3259 | @@ -203,8 +198,9 @@ static int do_commit(struct ubifs_info *c) | ||
3260 | c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS); | ||
3261 | else | ||
3262 | c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS); | ||
3263 | - err = ubifs_write_master(c); | ||
3264 | - mutex_unlock(&c->mst_mutex); | ||
3265 | + | ||
3266 | + old_ltail_lnum = c->ltail_lnum; | ||
3267 | + err = ubifs_log_end_commit(c, new_ltail_lnum); | ||
3268 | if (err) | ||
3269 | goto out; | ||
3270 | |||
3271 | diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c | ||
3272 | index 36bd4efd0819..06649d21b056 100644 | ||
3273 | --- a/fs/ubifs/log.c | ||
3274 | +++ b/fs/ubifs/log.c | ||
3275 | @@ -106,10 +106,14 @@ static inline long long empty_log_bytes(const struct ubifs_info *c) | ||
3276 | h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs; | ||
3277 | t = (long long)c->ltail_lnum * c->leb_size; | ||
3278 | |||
3279 | - if (h >= t) | ||
3280 | + if (h > t) | ||
3281 | return c->log_bytes - h + t; | ||
3282 | - else | ||
3283 | + else if (h != t) | ||
3284 | return t - h; | ||
3285 | + else if (c->lhead_lnum != c->ltail_lnum) | ||
3286 | + return 0; | ||
3287 | + else | ||
3288 | + return c->log_bytes; | ||
3289 | } | ||
3290 | |||
3291 | /** | ||
3292 | @@ -447,9 +451,9 @@ out: | ||
3293 | * @ltail_lnum: new log tail LEB number | ||
3294 | * | ||
3295 | * This function is called on when the commit operation was finished. It | ||
3296 | - * moves log tail to new position and unmaps LEBs which contain obsolete data. | ||
3297 | - * Returns zero in case of success and a negative error code in case of | ||
3298 | - * failure. | ||
3299 | + * moves log tail to new position and updates the master node so that it stores | ||
3300 | + * the new log tail LEB number. Returns zero in case of success and a negative | ||
3301 | + * error code in case of failure. | ||
3302 | */ | ||
3303 | int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) | ||
3304 | { | ||
3305 | @@ -477,7 +481,12 @@ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) | ||
3306 | spin_unlock(&c->buds_lock); | ||
3307 | |||
3308 | err = dbg_check_bud_bytes(c); | ||
3309 | + if (err) | ||
3310 | + goto out; | ||
3311 | |||
3312 | + err = ubifs_write_master(c); | ||
3313 | + | ||
3314 | +out: | ||
3315 | mutex_unlock(&c->log_mutex); | ||
3316 | return err; | ||
3317 | } | ||
3318 | diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c | ||
3319 | index ab83ace9910a..1a4bb9e8b3b8 100644 | ||
3320 | --- a/fs/ubifs/master.c | ||
3321 | +++ b/fs/ubifs/master.c | ||
3322 | @@ -352,10 +352,9 @@ int ubifs_read_master(struct ubifs_info *c) | ||
3323 | * ubifs_write_master - write master node. | ||
3324 | * @c: UBIFS file-system description object | ||
3325 | * | ||
3326 | - * This function writes the master node. The caller has to take the | ||
3327 | - * @c->mst_mutex lock before calling this function. Returns zero in case of | ||
3328 | - * success and a negative error code in case of failure. The master node is | ||
3329 | - * written twice to enable recovery. | ||
3330 | + * This function writes the master node. Returns zero in case of success and a | ||
3331 | + * negative error code in case of failure. The master node is written twice to | ||
3332 | + * enable recovery. | ||
3333 | */ | ||
3334 | int ubifs_write_master(struct ubifs_info *c) | ||
3335 | { | ||
3336 | diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c | ||
3337 | index 879b9976c12b..05115d719408 100644 | ||
3338 | --- a/fs/ubifs/super.c | ||
3339 | +++ b/fs/ubifs/super.c | ||
3340 | @@ -1970,7 +1970,6 @@ static struct ubifs_info *alloc_ubifs_info(struct ubi_volume_desc *ubi) | ||
3341 | mutex_init(&c->lp_mutex); | ||
3342 | mutex_init(&c->tnc_mutex); | ||
3343 | mutex_init(&c->log_mutex); | ||
3344 | - mutex_init(&c->mst_mutex); | ||
3345 | mutex_init(&c->umount_mutex); | ||
3346 | mutex_init(&c->bu_mutex); | ||
3347 | mutex_init(&c->write_reserve_mutex); | ||
3348 | diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h | ||
3349 | index b2babce4d70f..bd51277f6fe1 100644 | ||
3350 | --- a/fs/ubifs/ubifs.h | ||
3351 | +++ b/fs/ubifs/ubifs.h | ||
3352 | @@ -1042,7 +1042,6 @@ struct ubifs_debug_info; | ||
3353 | * | ||
3354 | * @mst_node: master node | ||
3355 | * @mst_offs: offset of valid master node | ||
3356 | - * @mst_mutex: protects the master node area, @mst_node, and @mst_offs | ||
3357 | * | ||
3358 | * @max_bu_buf_len: maximum bulk-read buffer length | ||
3359 | * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu | ||
3360 | @@ -1282,7 +1281,6 @@ struct ubifs_info { | ||
3361 | |||
3362 | struct ubifs_mst_node *mst_node; | ||
3363 | int mst_offs; | ||
3364 | - struct mutex mst_mutex; | ||
3365 | |||
3366 | int max_bu_buf_len; | ||
3367 | struct mutex bu_mutex; | ||
3368 | diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h | ||
3369 | index 3a1cff56ef20..d7b717090f2f 100644 | ||
3370 | --- a/include/drm/drm_pciids.h | ||
3371 | +++ b/include/drm/drm_pciids.h | ||
3372 | @@ -52,7 +52,6 @@ | ||
3373 | {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ | ||
3374 | {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ | ||
3375 | {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ | ||
3376 | - {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \ | ||
3377 | {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ | ||
3378 | {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ | ||
3379 | {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ | ||
3380 | diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h | ||
3381 | index 2fdb4a451b49..494d228a91dd 100644 | ||
3382 | --- a/include/linux/blkdev.h | ||
3383 | +++ b/include/linux/blkdev.h | ||
3384 | @@ -1187,10 +1187,9 @@ static inline int queue_alignment_offset(struct request_queue *q) | ||
3385 | static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector) | ||
3386 | { | ||
3387 | unsigned int granularity = max(lim->physical_block_size, lim->io_min); | ||
3388 | - unsigned int alignment = (sector << 9) & (granularity - 1); | ||
3389 | + unsigned int alignment = sector_div(sector, granularity >> 9) << 9; | ||
3390 | |||
3391 | - return (granularity + lim->alignment_offset - alignment) | ||
3392 | - & (granularity - 1); | ||
3393 | + return (granularity + lim->alignment_offset - alignment) % granularity; | ||
3394 | } | ||
3395 | |||
3396 | static inline int bdev_alignment_offset(struct block_device *bdev) | ||
3397 | diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h | ||
3398 | index 24545cd90a25..02ae99e8e6d3 100644 | ||
3399 | --- a/include/linux/compiler-gcc.h | ||
3400 | +++ b/include/linux/compiler-gcc.h | ||
3401 | @@ -37,6 +37,9 @@ | ||
3402 | __asm__ ("" : "=r"(__ptr) : "0"(ptr)); \ | ||
3403 | (typeof(ptr)) (__ptr + (off)); }) | ||
3404 | |||
3405 | +/* Make the optimizer believe the variable can be manipulated arbitrarily. */ | ||
3406 | +#define OPTIMIZER_HIDE_VAR(var) __asm__ ("" : "=r" (var) : "0" (var)) | ||
3407 | + | ||
3408 | #ifdef __CHECKER__ | ||
3409 | #define __must_be_array(arr) 0 | ||
3410 | #else | ||
3411 | diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h | ||
3412 | index dc1bd3dcf11f..5529c5239421 100644 | ||
3413 | --- a/include/linux/compiler-intel.h | ||
3414 | +++ b/include/linux/compiler-intel.h | ||
3415 | @@ -15,6 +15,7 @@ | ||
3416 | */ | ||
3417 | #undef barrier | ||
3418 | #undef RELOC_HIDE | ||
3419 | +#undef OPTIMIZER_HIDE_VAR | ||
3420 | |||
3421 | #define barrier() __memory_barrier() | ||
3422 | |||
3423 | @@ -23,6 +24,12 @@ | ||
3424 | __ptr = (unsigned long) (ptr); \ | ||
3425 | (typeof(ptr)) (__ptr + (off)); }) | ||
3426 | |||
3427 | +/* This should act as an optimization barrier on var. | ||
3428 | + * Given that this compiler does not have inline assembly, a compiler barrier | ||
3429 | + * is the best we can do. | ||
3430 | + */ | ||
3431 | +#define OPTIMIZER_HIDE_VAR(var) barrier() | ||
3432 | + | ||
3433 | /* Intel ECC compiler doesn't support __builtin_types_compatible_p() */ | ||
3434 | #define __must_be_array(a) 0 | ||
3435 | |||
3436 | diff --git a/include/linux/compiler.h b/include/linux/compiler.h | ||
3437 | index 92669cd182a6..a2329c5e6206 100644 | ||
3438 | --- a/include/linux/compiler.h | ||
3439 | +++ b/include/linux/compiler.h | ||
3440 | @@ -170,6 +170,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); | ||
3441 | (typeof(ptr)) (__ptr + (off)); }) | ||
3442 | #endif | ||
3443 | |||
3444 | +#ifndef OPTIMIZER_HIDE_VAR | ||
3445 | +#define OPTIMIZER_HIDE_VAR(var) barrier() | ||
3446 | +#endif | ||
3447 | + | ||
3448 | /* Not-quite-unique ID. */ | ||
3449 | #ifndef __UNIQUE_ID | ||
3450 | # define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __LINE__) | ||
3451 | diff --git a/include/linux/mm.h b/include/linux/mm.h | ||
3452 | index a9a48309f045..7da14357aa76 100644 | ||
3453 | --- a/include/linux/mm.h | ||
3454 | +++ b/include/linux/mm.h | ||
3455 | @@ -1004,6 +1004,7 @@ static inline void unmap_shared_mapping_range(struct address_space *mapping, | ||
3456 | |||
3457 | extern void truncate_pagecache(struct inode *inode, loff_t old, loff_t new); | ||
3458 | extern void truncate_setsize(struct inode *inode, loff_t newsize); | ||
3459 | +void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to); | ||
3460 | void truncate_pagecache_range(struct inode *inode, loff_t offset, loff_t end); | ||
3461 | int truncate_inode_page(struct address_space *mapping, struct page *page); | ||
3462 | int generic_error_remove_page(struct address_space *mapping, struct page *page); | ||
3463 | diff --git a/include/linux/of.h b/include/linux/of.h | ||
3464 | index 1fd08ca23106..5e9d35233a65 100644 | ||
3465 | --- a/include/linux/of.h | ||
3466 | +++ b/include/linux/of.h | ||
3467 | @@ -252,14 +252,12 @@ extern int of_property_read_u64(const struct device_node *np, | ||
3468 | extern int of_property_read_string(struct device_node *np, | ||
3469 | const char *propname, | ||
3470 | const char **out_string); | ||
3471 | -extern int of_property_read_string_index(struct device_node *np, | ||
3472 | - const char *propname, | ||
3473 | - int index, const char **output); | ||
3474 | extern int of_property_match_string(struct device_node *np, | ||
3475 | const char *propname, | ||
3476 | const char *string); | ||
3477 | -extern int of_property_count_strings(struct device_node *np, | ||
3478 | - const char *propname); | ||
3479 | +extern int of_property_read_string_helper(struct device_node *np, | ||
3480 | + const char *propname, | ||
3481 | + const char **out_strs, size_t sz, int index); | ||
3482 | extern int of_device_is_compatible(const struct device_node *device, | ||
3483 | const char *); | ||
3484 | extern int of_device_is_available(const struct device_node *device); | ||
3485 | @@ -439,15 +437,9 @@ static inline int of_property_read_string(struct device_node *np, | ||
3486 | return -ENOSYS; | ||
3487 | } | ||
3488 | |||
3489 | -static inline int of_property_read_string_index(struct device_node *np, | ||
3490 | - const char *propname, int index, | ||
3491 | - const char **out_string) | ||
3492 | -{ | ||
3493 | - return -ENOSYS; | ||
3494 | -} | ||
3495 | - | ||
3496 | -static inline int of_property_count_strings(struct device_node *np, | ||
3497 | - const char *propname) | ||
3498 | +static inline int of_property_read_string_helper(struct device_node *np, | ||
3499 | + const char *propname, | ||
3500 | + const char **out_strs, size_t sz, int index) | ||
3501 | { | ||
3502 | return -ENOSYS; | ||
3503 | } | ||
3504 | @@ -523,6 +515,70 @@ static inline int of_node_to_nid(struct device_node *np) | ||
3505 | #endif | ||
3506 | |||
3507 | /** | ||
3508 | + * of_property_read_string_array() - Read an array of strings from a multiple | ||
3509 | + * strings property. | ||
3510 | + * @np: device node from which the property value is to be read. | ||
3511 | + * @propname: name of the property to be searched. | ||
3512 | + * @out_strs: output array of string pointers. | ||
3513 | + * @sz: number of array elements to read. | ||
3514 | + * | ||
3515 | + * Search for a property in a device tree node and retrieve a list of | ||
3516 | + * terminated string values (pointer to data, not a copy) in that property. | ||
3517 | + * | ||
3518 | + * If @out_strs is NULL, the number of strings in the property is returned. | ||
3519 | + */ | ||
3520 | +static inline int of_property_read_string_array(struct device_node *np, | ||
3521 | + const char *propname, const char **out_strs, | ||
3522 | + size_t sz) | ||
3523 | +{ | ||
3524 | + return of_property_read_string_helper(np, propname, out_strs, sz, 0); | ||
3525 | +} | ||
3526 | + | ||
3527 | +/** | ||
3528 | + * of_property_count_strings() - Find and return the number of strings from a | ||
3529 | + * multiple strings property. | ||
3530 | + * @np: device node from which the property value is to be read. | ||
3531 | + * @propname: name of the property to be searched. | ||
3532 | + * | ||
3533 | + * Search for a property in a device tree node and retrieve the number of null | ||
3534 | + * terminated string contain in it. Returns the number of strings on | ||
3535 | + * success, -EINVAL if the property does not exist, -ENODATA if property | ||
3536 | + * does not have a value, and -EILSEQ if the string is not null-terminated | ||
3537 | + * within the length of the property data. | ||
3538 | + */ | ||
3539 | +static inline int of_property_count_strings(struct device_node *np, | ||
3540 | + const char *propname) | ||
3541 | +{ | ||
3542 | + return of_property_read_string_helper(np, propname, NULL, 0, 0); | ||
3543 | +} | ||
3544 | + | ||
3545 | +/** | ||
3546 | + * of_property_read_string_index() - Find and read a string from a multiple | ||
3547 | + * strings property. | ||
3548 | + * @np: device node from which the property value is to be read. | ||
3549 | + * @propname: name of the property to be searched. | ||
3550 | + * @index: index of the string in the list of strings | ||
3551 | + * @out_string: pointer to null terminated return string, modified only if | ||
3552 | + * return value is 0. | ||
3553 | + * | ||
3554 | + * Search for a property in a device tree node and retrieve a null | ||
3555 | + * terminated string value (pointer to data, not a copy) in the list of strings | ||
3556 | + * contained in that property. | ||
3557 | + * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if | ||
3558 | + * property does not have a value, and -EILSEQ if the string is not | ||
3559 | + * null-terminated within the length of the property data. | ||
3560 | + * | ||
3561 | + * The out_string pointer is modified only if a valid string can be decoded. | ||
3562 | + */ | ||
3563 | +static inline int of_property_read_string_index(struct device_node *np, | ||
3564 | + const char *propname, | ||
3565 | + int index, const char **output) | ||
3566 | +{ | ||
3567 | + int rc = of_property_read_string_helper(np, propname, output, 1, index); | ||
3568 | + return rc < 0 ? rc : 0; | ||
3569 | +} | ||
3570 | + | ||
3571 | +/** | ||
3572 | * of_property_read_bool - Findfrom a property | ||
3573 | * @np: device node from which the property value is to be read. | ||
3574 | * @propname: name of the property to be searched. | ||
3575 | diff --git a/include/linux/oom.h b/include/linux/oom.h | ||
3576 | index da60007075b5..297cda528855 100644 | ||
3577 | --- a/include/linux/oom.h | ||
3578 | +++ b/include/linux/oom.h | ||
3579 | @@ -50,6 +50,9 @@ static inline bool oom_task_origin(const struct task_struct *p) | ||
3580 | extern unsigned long oom_badness(struct task_struct *p, | ||
3581 | struct mem_cgroup *memcg, const nodemask_t *nodemask, | ||
3582 | unsigned long totalpages); | ||
3583 | + | ||
3584 | +extern int oom_kills_count(void); | ||
3585 | +extern void note_oom_kill(void); | ||
3586 | extern void oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order, | ||
3587 | unsigned int points, unsigned long totalpages, | ||
3588 | struct mem_cgroup *memcg, nodemask_t *nodemask, | ||
3589 | diff --git a/include/linux/string.h b/include/linux/string.h | ||
3590 | index ac889c5ea11b..0ed878d0465c 100644 | ||
3591 | --- a/include/linux/string.h | ||
3592 | +++ b/include/linux/string.h | ||
3593 | @@ -129,7 +129,7 @@ int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4); | ||
3594 | #endif | ||
3595 | |||
3596 | extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos, | ||
3597 | - const void *from, size_t available); | ||
3598 | + const void *from, size_t available); | ||
3599 | |||
3600 | /** | ||
3601 | * strstarts - does @str start with @prefix? | ||
3602 | @@ -141,7 +141,8 @@ static inline bool strstarts(const char *str, const char *prefix) | ||
3603 | return strncmp(str, prefix, strlen(prefix)) == 0; | ||
3604 | } | ||
3605 | |||
3606 | -extern size_t memweight(const void *ptr, size_t bytes); | ||
3607 | +size_t memweight(const void *ptr, size_t bytes); | ||
3608 | +void memzero_explicit(void *s, size_t count); | ||
3609 | |||
3610 | /** | ||
3611 | * kbasename - return the last part of a pathname. | ||
3612 | diff --git a/kernel/freezer.c b/kernel/freezer.c | ||
3613 | index 78758512b1e1..bd733f6e610d 100644 | ||
3614 | --- a/kernel/freezer.c | ||
3615 | +++ b/kernel/freezer.c | ||
3616 | @@ -42,6 +42,9 @@ bool freezing_slow_path(struct task_struct *p) | ||
3617 | if (p->flags & PF_NOFREEZE) | ||
3618 | return false; | ||
3619 | |||
3620 | + if (test_thread_flag(TIF_MEMDIE)) | ||
3621 | + return false; | ||
3622 | + | ||
3623 | if (pm_nosig_freezing || cgroup_freezing(p)) | ||
3624 | return true; | ||
3625 | |||
3626 | diff --git a/kernel/module.c b/kernel/module.c | ||
3627 | index 10a3af821d28..61fb677211cb 100644 | ||
3628 | --- a/kernel/module.c | ||
3629 | +++ b/kernel/module.c | ||
3630 | @@ -1866,7 +1866,9 @@ static void free_module(struct module *mod) | ||
3631 | |||
3632 | /* We leave it in list to prevent duplicate loads, but make sure | ||
3633 | * that noone uses it while it's being deconstructed. */ | ||
3634 | + mutex_lock(&module_mutex); | ||
3635 | mod->state = MODULE_STATE_UNFORMED; | ||
3636 | + mutex_unlock(&module_mutex); | ||
3637 | |||
3638 | /* Remove dynamic debug info */ | ||
3639 | ddebug_remove_module(mod->name); | ||
3640 | diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c | ||
3641 | index 424c2d4265c9..77e6b83c0431 100644 | ||
3642 | --- a/kernel/posix-timers.c | ||
3643 | +++ b/kernel/posix-timers.c | ||
3644 | @@ -634,6 +634,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, | ||
3645 | goto out; | ||
3646 | } | ||
3647 | } else { | ||
3648 | + memset(&event.sigev_value, 0, sizeof(event.sigev_value)); | ||
3649 | event.sigev_notify = SIGEV_SIGNAL; | ||
3650 | event.sigev_signo = SIGALRM; | ||
3651 | event.sigev_value.sival_int = new_timer->it_id; | ||
3652 | diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c | ||
3653 | index b26f5f1e773e..1634dc6e2fe7 100644 | ||
3654 | --- a/kernel/power/hibernate.c | ||
3655 | +++ b/kernel/power/hibernate.c | ||
3656 | @@ -491,8 +491,14 @@ int hibernation_restore(int platform_mode) | ||
3657 | error = dpm_suspend_start(PMSG_QUIESCE); | ||
3658 | if (!error) { | ||
3659 | error = resume_target_kernel(platform_mode); | ||
3660 | - dpm_resume_end(PMSG_RECOVER); | ||
3661 | + /* | ||
3662 | + * The above should either succeed and jump to the new kernel, | ||
3663 | + * or return with an error. Otherwise things are just | ||
3664 | + * undefined, so let's be paranoid. | ||
3665 | + */ | ||
3666 | + BUG_ON(!error); | ||
3667 | } | ||
3668 | + dpm_resume_end(PMSG_RECOVER); | ||
3669 | pm_restore_gfp_mask(); | ||
3670 | ftrace_start(); | ||
3671 | resume_console(); | ||
3672 | diff --git a/kernel/power/process.c b/kernel/power/process.c | ||
3673 | index 1b212bee1510..0695319b5fde 100644 | ||
3674 | --- a/kernel/power/process.c | ||
3675 | +++ b/kernel/power/process.c | ||
3676 | @@ -103,6 +103,28 @@ static int try_to_freeze_tasks(bool user_only) | ||
3677 | return todo ? -EBUSY : 0; | ||
3678 | } | ||
3679 | |||
3680 | +/* | ||
3681 | + * Returns true if all freezable tasks (except for current) are frozen already | ||
3682 | + */ | ||
3683 | +static bool check_frozen_processes(void) | ||
3684 | +{ | ||
3685 | + struct task_struct *g, *p; | ||
3686 | + bool ret = true; | ||
3687 | + | ||
3688 | + read_lock(&tasklist_lock); | ||
3689 | + for_each_process_thread(g, p) { | ||
3690 | + if (p != current && !freezer_should_skip(p) && | ||
3691 | + !frozen(p)) { | ||
3692 | + ret = false; | ||
3693 | + goto done; | ||
3694 | + } | ||
3695 | + } | ||
3696 | +done: | ||
3697 | + read_unlock(&tasklist_lock); | ||
3698 | + | ||
3699 | + return ret; | ||
3700 | +} | ||
3701 | + | ||
3702 | /** | ||
3703 | * freeze_processes - Signal user space processes to enter the refrigerator. | ||
3704 | * | ||
3705 | @@ -111,6 +133,7 @@ static int try_to_freeze_tasks(bool user_only) | ||
3706 | int freeze_processes(void) | ||
3707 | { | ||
3708 | int error; | ||
3709 | + int oom_kills_saved; | ||
3710 | |||
3711 | error = __usermodehelper_disable(UMH_FREEZING); | ||
3712 | if (error) | ||
3713 | @@ -121,12 +144,27 @@ int freeze_processes(void) | ||
3714 | |||
3715 | printk("Freezing user space processes ... "); | ||
3716 | pm_freezing = true; | ||
3717 | + oom_kills_saved = oom_kills_count(); | ||
3718 | error = try_to_freeze_tasks(true); | ||
3719 | if (!error) { | ||
3720 | - printk("done."); | ||
3721 | __usermodehelper_set_disable_depth(UMH_DISABLED); | ||
3722 | oom_killer_disable(); | ||
3723 | + | ||
3724 | + /* | ||
3725 | + * There might have been an OOM kill while we were | ||
3726 | + * freezing tasks and the killed task might be still | ||
3727 | + * on the way out so we have to double check for race. | ||
3728 | + */ | ||
3729 | + if (oom_kills_count() != oom_kills_saved && | ||
3730 | + !check_frozen_processes()) { | ||
3731 | + __usermodehelper_set_disable_depth(UMH_ENABLED); | ||
3732 | + printk("OOM in progress."); | ||
3733 | + error = -EBUSY; | ||
3734 | + goto done; | ||
3735 | + } | ||
3736 | + printk("done."); | ||
3737 | } | ||
3738 | +done: | ||
3739 | printk("\n"); | ||
3740 | BUG_ON(in_atomic()); | ||
3741 | |||
3742 | diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c | ||
3743 | index 322e16461072..bdb9ee0af991 100644 | ||
3744 | --- a/kernel/trace/trace_syscalls.c | ||
3745 | +++ b/kernel/trace/trace_syscalls.c | ||
3746 | @@ -312,7 +312,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id) | ||
3747 | int size; | ||
3748 | |||
3749 | syscall_nr = trace_get_syscall_nr(current, regs); | ||
3750 | - if (syscall_nr < 0) | ||
3751 | + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) | ||
3752 | return; | ||
3753 | if (!test_bit(syscall_nr, tr->enabled_enter_syscalls)) | ||
3754 | return; | ||
3755 | @@ -354,7 +354,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret) | ||
3756 | int syscall_nr; | ||
3757 | |||
3758 | syscall_nr = trace_get_syscall_nr(current, regs); | ||
3759 | - if (syscall_nr < 0) | ||
3760 | + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) | ||
3761 | return; | ||
3762 | if (!test_bit(syscall_nr, tr->enabled_exit_syscalls)) | ||
3763 | return; | ||
3764 | @@ -557,7 +557,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id) | ||
3765 | int size; | ||
3766 | |||
3767 | syscall_nr = trace_get_syscall_nr(current, regs); | ||
3768 | - if (syscall_nr < 0) | ||
3769 | + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) | ||
3770 | return; | ||
3771 | if (!test_bit(syscall_nr, enabled_perf_enter_syscalls)) | ||
3772 | return; | ||
3773 | @@ -633,7 +633,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret) | ||
3774 | int size; | ||
3775 | |||
3776 | syscall_nr = trace_get_syscall_nr(current, regs); | ||
3777 | - if (syscall_nr < 0) | ||
3778 | + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) | ||
3779 | return; | ||
3780 | if (!test_bit(syscall_nr, enabled_perf_exit_syscalls)) | ||
3781 | return; | ||
3782 | diff --git a/lib/bitmap.c b/lib/bitmap.c | ||
3783 | index 06f7e4fe8d2d..e5c4ebe586ba 100644 | ||
3784 | --- a/lib/bitmap.c | ||
3785 | +++ b/lib/bitmap.c | ||
3786 | @@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long *dst, | ||
3787 | lower = src[off + k]; | ||
3788 | if (left && off + k == lim - 1) | ||
3789 | lower &= mask; | ||
3790 | - dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem; | ||
3791 | + dst[k] = lower >> rem; | ||
3792 | + if (rem) | ||
3793 | + dst[k] |= upper << (BITS_PER_LONG - rem); | ||
3794 | if (left && k == lim - 1) | ||
3795 | dst[k] &= mask; | ||
3796 | } | ||
3797 | @@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long *dst, | ||
3798 | upper = src[k]; | ||
3799 | if (left && k == lim - 1) | ||
3800 | upper &= (1UL << left) - 1; | ||
3801 | - dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem; | ||
3802 | + dst[k + off] = upper << rem; | ||
3803 | + if (rem) | ||
3804 | + dst[k + off] |= lower >> (BITS_PER_LONG - rem); | ||
3805 | if (left && k + off == lim - 1) | ||
3806 | dst[k + off] &= (1UL << left) - 1; | ||
3807 | } | ||
3808 | diff --git a/lib/string.c b/lib/string.c | ||
3809 | index e5878de4f101..43d0781daf47 100644 | ||
3810 | --- a/lib/string.c | ||
3811 | +++ b/lib/string.c | ||
3812 | @@ -586,6 +586,22 @@ void *memset(void *s, int c, size_t count) | ||
3813 | EXPORT_SYMBOL(memset); | ||
3814 | #endif | ||
3815 | |||
3816 | +/** | ||
3817 | + * memzero_explicit - Fill a region of memory (e.g. sensitive | ||
3818 | + * keying data) with 0s. | ||
3819 | + * @s: Pointer to the start of the area. | ||
3820 | + * @count: The size of the area. | ||
3821 | + * | ||
3822 | + * memzero_explicit() doesn't need an arch-specific version as | ||
3823 | + * it just invokes the one of memset() implicitly. | ||
3824 | + */ | ||
3825 | +void memzero_explicit(void *s, size_t count) | ||
3826 | +{ | ||
3827 | + memset(s, 0, count); | ||
3828 | + OPTIMIZER_HIDE_VAR(s); | ||
3829 | +} | ||
3830 | +EXPORT_SYMBOL(memzero_explicit); | ||
3831 | + | ||
3832 | #ifndef __HAVE_ARCH_MEMCPY | ||
3833 | /** | ||
3834 | * memcpy - Copy one area of memory to another | ||
3835 | diff --git a/mm/oom_kill.c b/mm/oom_kill.c | ||
3836 | index 8e40908e724a..f104c7e9f61e 100644 | ||
3837 | --- a/mm/oom_kill.c | ||
3838 | +++ b/mm/oom_kill.c | ||
3839 | @@ -402,6 +402,23 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order, | ||
3840 | dump_tasks(memcg, nodemask); | ||
3841 | } | ||
3842 | |||
3843 | +/* | ||
3844 | + * Number of OOM killer invocations (including memcg OOM killer). | ||
3845 | + * Primarily used by PM freezer to check for potential races with | ||
3846 | + * OOM killed frozen task. | ||
3847 | + */ | ||
3848 | +static atomic_t oom_kills = ATOMIC_INIT(0); | ||
3849 | + | ||
3850 | +int oom_kills_count(void) | ||
3851 | +{ | ||
3852 | + return atomic_read(&oom_kills); | ||
3853 | +} | ||
3854 | + | ||
3855 | +void note_oom_kill(void) | ||
3856 | +{ | ||
3857 | + atomic_inc(&oom_kills); | ||
3858 | +} | ||
3859 | + | ||
3860 | #define K(x) ((x) << (PAGE_SHIFT-10)) | ||
3861 | /* | ||
3862 | * Must be called while holding a reference to p, which will be released upon | ||
3863 | diff --git a/mm/page_alloc.c b/mm/page_alloc.c | ||
3864 | index 71305c6aba5b..494a081ec5e4 100644 | ||
3865 | --- a/mm/page_alloc.c | ||
3866 | +++ b/mm/page_alloc.c | ||
3867 | @@ -2120,6 +2120,14 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, | ||
3868 | } | ||
3869 | |||
3870 | /* | ||
3871 | + * PM-freezer should be notified that there might be an OOM killer on | ||
3872 | + * its way to kill and wake somebody up. This is too early and we might | ||
3873 | + * end up not killing anything but false positives are acceptable. | ||
3874 | + * See freeze_processes. | ||
3875 | + */ | ||
3876 | + note_oom_kill(); | ||
3877 | + | ||
3878 | + /* | ||
3879 | * Go through the zonelist yet one more time, keep very high watermark | ||
3880 | * here, this is only to catch a parallel oom killing, we must fail if | ||
3881 | * we're still under heavy pressure. | ||
3882 | diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c | ||
3883 | index 6d757e3a872a..e007236f345a 100644 | ||
3884 | --- a/mm/page_cgroup.c | ||
3885 | +++ b/mm/page_cgroup.c | ||
3886 | @@ -170,6 +170,7 @@ static void free_page_cgroup(void *addr) | ||
3887 | sizeof(struct page_cgroup) * PAGES_PER_SECTION; | ||
3888 | |||
3889 | BUG_ON(PageReserved(page)); | ||
3890 | + kmemleak_free(addr); | ||
3891 | free_pages_exact(addr, table_size); | ||
3892 | } | ||
3893 | } | ||
3894 | diff --git a/mm/percpu.c b/mm/percpu.c | ||
3895 | index 9bc1bf914cc8..25e2ea52db82 100644 | ||
3896 | --- a/mm/percpu.c | ||
3897 | +++ b/mm/percpu.c | ||
3898 | @@ -1910,8 +1910,6 @@ void __init setup_per_cpu_areas(void) | ||
3899 | |||
3900 | if (pcpu_setup_first_chunk(ai, fc) < 0) | ||
3901 | panic("Failed to initialize percpu areas."); | ||
3902 | - | ||
3903 | - pcpu_free_alloc_info(ai); | ||
3904 | } | ||
3905 | |||
3906 | #endif /* CONFIG_SMP */ | ||
3907 | diff --git a/mm/truncate.c b/mm/truncate.c | ||
3908 | index c75b736e54b7..2d6151fc8f08 100644 | ||
3909 | --- a/mm/truncate.c | ||
3910 | +++ b/mm/truncate.c | ||
3911 | @@ -20,6 +20,7 @@ | ||
3912 | #include <linux/buffer_head.h> /* grr. try_to_release_page, | ||
3913 | do_invalidatepage */ | ||
3914 | #include <linux/cleancache.h> | ||
3915 | +#include <linux/rmap.h> | ||
3916 | #include "internal.h" | ||
3917 | |||
3918 | |||
3919 | @@ -567,16 +568,67 @@ EXPORT_SYMBOL(truncate_pagecache); | ||
3920 | */ | ||
3921 | void truncate_setsize(struct inode *inode, loff_t newsize) | ||
3922 | { | ||
3923 | - loff_t oldsize; | ||
3924 | + loff_t oldsize = inode->i_size; | ||
3925 | |||
3926 | - oldsize = inode->i_size; | ||
3927 | i_size_write(inode, newsize); | ||
3928 | - | ||
3929 | + if (newsize > oldsize) | ||
3930 | + pagecache_isize_extended(inode, oldsize, newsize); | ||
3931 | truncate_pagecache(inode, oldsize, newsize); | ||
3932 | } | ||
3933 | EXPORT_SYMBOL(truncate_setsize); | ||
3934 | |||
3935 | /** | ||
3936 | + * pagecache_isize_extended - update pagecache after extension of i_size | ||
3937 | + * @inode: inode for which i_size was extended | ||
3938 | + * @from: original inode size | ||
3939 | + * @to: new inode size | ||
3940 | + * | ||
3941 | + * Handle extension of inode size either caused by extending truncate or by | ||
3942 | + * write starting after current i_size. We mark the page straddling current | ||
3943 | + * i_size RO so that page_mkwrite() is called on the nearest write access to | ||
3944 | + * the page. This way filesystem can be sure that page_mkwrite() is called on | ||
3945 | + * the page before user writes to the page via mmap after the i_size has been | ||
3946 | + * changed. | ||
3947 | + * | ||
3948 | + * The function must be called after i_size is updated so that page fault | ||
3949 | + * coming after we unlock the page will already see the new i_size. | ||
3950 | + * The function must be called while we still hold i_mutex - this not only | ||
3951 | + * makes sure i_size is stable but also that userspace cannot observe new | ||
3952 | + * i_size value before we are prepared to store mmap writes at new inode size. | ||
3953 | + */ | ||
3954 | +void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to) | ||
3955 | +{ | ||
3956 | + int bsize = 1 << inode->i_blkbits; | ||
3957 | + loff_t rounded_from; | ||
3958 | + struct page *page; | ||
3959 | + pgoff_t index; | ||
3960 | + | ||
3961 | + WARN_ON(to > inode->i_size); | ||
3962 | + | ||
3963 | + if (from >= to || bsize == PAGE_CACHE_SIZE) | ||
3964 | + return; | ||
3965 | + /* Page straddling @from will not have any hole block created? */ | ||
3966 | + rounded_from = round_up(from, bsize); | ||
3967 | + if (to <= rounded_from || !(rounded_from & (PAGE_CACHE_SIZE - 1))) | ||
3968 | + return; | ||
3969 | + | ||
3970 | + index = from >> PAGE_CACHE_SHIFT; | ||
3971 | + page = find_lock_page(inode->i_mapping, index); | ||
3972 | + /* Page not cached? Nothing to do */ | ||
3973 | + if (!page) | ||
3974 | + return; | ||
3975 | + /* | ||
3976 | + * See clear_page_dirty_for_io() for details why set_page_dirty() | ||
3977 | + * is needed. | ||
3978 | + */ | ||
3979 | + if (page_mkclean(page)) | ||
3980 | + set_page_dirty(page); | ||
3981 | + unlock_page(page); | ||
3982 | + page_cache_release(page); | ||
3983 | +} | ||
3984 | +EXPORT_SYMBOL(pagecache_isize_extended); | ||
3985 | + | ||
3986 | +/** | ||
3987 | * truncate_pagecache_range - unmap and remove pagecache that is hole-punched | ||
3988 | * @inode: inode | ||
3989 | * @lstart: offset of beginning of hole | ||
3990 | diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c | ||
3991 | index 66e77f380fce..e3bea2e0821a 100644 | ||
3992 | --- a/net/ceph/messenger.c | ||
3993 | +++ b/net/ceph/messenger.c | ||
3994 | @@ -290,7 +290,8 @@ int ceph_msgr_init(void) | ||
3995 | if (ceph_msgr_slab_init()) | ||
3996 | return -ENOMEM; | ||
3997 | |||
3998 | - ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_NON_REENTRANT, 0); | ||
3999 | + ceph_msgr_wq = alloc_workqueue("ceph-msgr", | ||
4000 | + WQ_NON_REENTRANT | WQ_MEM_RECLAIM, 0); | ||
4001 | if (ceph_msgr_wq) | ||
4002 | return 0; | ||
4003 | |||
4004 | diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c | ||
4005 | index 9c3979a50804..bc773a10dca6 100644 | ||
4006 | --- a/net/ipv4/fib_semantics.c | ||
4007 | +++ b/net/ipv4/fib_semantics.c | ||
4008 | @@ -533,7 +533,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi) | ||
4009 | return 1; | ||
4010 | |||
4011 | attrlen = rtnh_attrlen(rtnh); | ||
4012 | - if (attrlen < 0) { | ||
4013 | + if (attrlen > 0) { | ||
4014 | struct nlattr *nla, *attrs = rtnh_attrs(rtnh); | ||
4015 | |||
4016 | nla = nla_find(attrs, attrlen, RTA_GATEWAY); | ||
4017 | diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c | ||
4018 | index 5afbbbe03b0e..22fa05e041ea 100644 | ||
4019 | --- a/net/ipv4/ip_output.c | ||
4020 | +++ b/net/ipv4/ip_output.c | ||
4021 | @@ -1481,6 +1481,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, | ||
4022 | struct sk_buff *nskb; | ||
4023 | struct sock *sk; | ||
4024 | struct inet_sock *inet; | ||
4025 | + int err; | ||
4026 | |||
4027 | if (ip_options_echo(&replyopts.opt.opt, skb)) | ||
4028 | return; | ||
4029 | @@ -1517,8 +1518,13 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, | ||
4030 | sock_net_set(sk, net); | ||
4031 | __skb_queue_head_init(&sk->sk_write_queue); | ||
4032 | sk->sk_sndbuf = sysctl_wmem_default; | ||
4033 | - ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, len, 0, | ||
4034 | - &ipc, &rt, MSG_DONTWAIT); | ||
4035 | + err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, | ||
4036 | + len, 0, &ipc, &rt, MSG_DONTWAIT); | ||
4037 | + if (unlikely(err)) { | ||
4038 | + ip_flush_pending_frames(sk); | ||
4039 | + goto out; | ||
4040 | + } | ||
4041 | + | ||
4042 | nskb = skb_peek(&sk->sk_write_queue); | ||
4043 | if (nskb) { | ||
4044 | if (arg->csumoffset >= 0) | ||
4045 | @@ -1530,7 +1536,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, | ||
4046 | skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb)); | ||
4047 | ip_push_pending_frames(sk, &fl4); | ||
4048 | } | ||
4049 | - | ||
4050 | +out: | ||
4051 | put_cpu_var(unicast_sock); | ||
4052 | |||
4053 | ip_rt_put(rt); | ||
4054 | diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c | ||
4055 | index a02bef35b134..d68d6cfac3b5 100644 | ||
4056 | --- a/net/mac80211/rate.c | ||
4057 | +++ b/net/mac80211/rate.c | ||
4058 | @@ -448,7 +448,7 @@ static void rate_fixup_ratelist(struct ieee80211_vif *vif, | ||
4059 | */ | ||
4060 | if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) { | ||
4061 | u32 basic_rates = vif->bss_conf.basic_rates; | ||
4062 | - s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0; | ||
4063 | + s8 baserate = basic_rates ? ffs(basic_rates) - 1 : 0; | ||
4064 | |||
4065 | rate = &sband->bitrates[rates[0].idx]; | ||
4066 | |||
4067 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c | ||
4068 | index 5ed562dfe743..afe41178c9fb 100644 | ||
4069 | --- a/net/netlink/af_netlink.c | ||
4070 | +++ b/net/netlink/af_netlink.c | ||
4071 | @@ -571,7 +571,7 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, | ||
4072 | * after validation, the socket and the ring may only be used by a | ||
4073 | * single process, otherwise we fall back to copying. | ||
4074 | */ | ||
4075 | - if (atomic_long_read(&sk->sk_socket->file->f_count) > 2 || | ||
4076 | + if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 || | ||
4077 | atomic_read(&nlk->mapped) > 1) | ||
4078 | excl = false; | ||
4079 | |||
4080 | diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c | ||
4081 | index b9b2bebeb350..b980a6ce5c79 100644 | ||
4082 | --- a/security/integrity/evm/evm_main.c | ||
4083 | +++ b/security/integrity/evm/evm_main.c | ||
4084 | @@ -286,9 +286,12 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, | ||
4085 | { | ||
4086 | const struct evm_ima_xattr_data *xattr_data = xattr_value; | ||
4087 | |||
4088 | - if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) | ||
4089 | - && (xattr_data->type == EVM_XATTR_HMAC)) | ||
4090 | - return -EPERM; | ||
4091 | + if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { | ||
4092 | + if (!xattr_value_len) | ||
4093 | + return -EINVAL; | ||
4094 | + if (xattr_data->type != EVM_IMA_XATTR_DIGSIG) | ||
4095 | + return -EPERM; | ||
4096 | + } | ||
4097 | return evm_protect_xattr(dentry, xattr_name, xattr_value, | ||
4098 | xattr_value_len); | ||
4099 | } | ||
4100 | diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c | ||
4101 | index 70d4a8a7f21c..fdd6e4f8be39 100644 | ||
4102 | --- a/security/selinux/hooks.c | ||
4103 | +++ b/security/selinux/hooks.c | ||
4104 | @@ -437,6 +437,7 @@ next_inode: | ||
4105 | list_entry(sbsec->isec_head.next, | ||
4106 | struct inode_security_struct, list); | ||
4107 | struct inode *inode = isec->inode; | ||
4108 | + list_del_init(&isec->list); | ||
4109 | spin_unlock(&sbsec->isec_lock); | ||
4110 | inode = igrab(inode); | ||
4111 | if (inode) { | ||
4112 | @@ -445,7 +446,6 @@ next_inode: | ||
4113 | iput(inode); | ||
4114 | } | ||
4115 | spin_lock(&sbsec->isec_lock); | ||
4116 | - list_del_init(&isec->list); | ||
4117 | goto next_inode; | ||
4118 | } | ||
4119 | spin_unlock(&sbsec->isec_lock); | ||
4120 | diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c | ||
4121 | index af49721ba0e3..c4ac3c1e19af 100644 | ||
4122 | --- a/sound/core/pcm_compat.c | ||
4123 | +++ b/sound/core/pcm_compat.c | ||
4124 | @@ -206,6 +206,8 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream, | ||
4125 | if (err < 0) | ||
4126 | return err; | ||
4127 | |||
4128 | + if (clear_user(src, sizeof(*src))) | ||
4129 | + return -EFAULT; | ||
4130 | if (put_user(status.state, &src->state) || | ||
4131 | compat_put_timespec(&status.trigger_tstamp, &src->trigger_tstamp) || | ||
4132 | compat_put_timespec(&status.tstamp, &src->tstamp) || | ||
4133 | diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c | ||
4134 | index dec997188dfb..a650aa48c786 100644 | ||
4135 | --- a/virt/kvm/iommu.c | ||
4136 | +++ b/virt/kvm/iommu.c | ||
4137 | @@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm, | ||
4138 | gfn_t base_gfn, unsigned long npages); | ||
4139 | |||
4140 | static pfn_t kvm_pin_pages(struct kvm_memory_slot *slot, gfn_t gfn, | ||
4141 | - unsigned long size) | ||
4142 | + unsigned long npages) | ||
4143 | { | ||
4144 | gfn_t end_gfn; | ||
4145 | pfn_t pfn; | ||
4146 | |||
4147 | pfn = gfn_to_pfn_memslot(slot, gfn); | ||
4148 | - end_gfn = gfn + (size >> PAGE_SHIFT); | ||
4149 | + end_gfn = gfn + npages; | ||
4150 | gfn += 1; | ||
4151 | |||
4152 | if (is_error_noslot_pfn(pfn)) | ||
4153 | @@ -119,7 +119,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) | ||
4154 | * Pin all pages we are about to map in memory. This is | ||
4155 | * important because we unmap and unpin in 4kb steps later. | ||
4156 | */ | ||
4157 | - pfn = kvm_pin_pages(slot, gfn, page_size); | ||
4158 | + pfn = kvm_pin_pages(slot, gfn, page_size >> PAGE_SHIFT); | ||
4159 | if (is_error_noslot_pfn(pfn)) { | ||
4160 | gfn += 1; | ||
4161 | continue; | ||
4162 | @@ -131,7 +131,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) | ||
4163 | if (r) { | ||
4164 | printk(KERN_ERR "kvm_iommu_map_address:" | ||
4165 | "iommu failed to map pfn=%llx\n", pfn); | ||
4166 | - kvm_unpin_pages(kvm, pfn, page_size); | ||
4167 | + kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT); | ||
4168 | goto unmap_pages; | ||
4169 | } | ||
4170 |