Contents of /trunk/kernel-alx/patches-3.10/0159-3.10.60-all-fixes.patch
Parent Directory | Revision Log
Revision 2647 -
(show annotations)
(download)
Tue Jul 21 16:20:21 2015 UTC (9 years, 2 months ago) by niro
File size: 144980 byte(s)
Tue Jul 21 16:20:21 2015 UTC (9 years, 2 months ago) by niro
File size: 144980 byte(s)
-linux-3.10.60
1 | diff --git a/Makefile b/Makefile |
2 | index 7baf27f5cf0f..9d4f30d0d201 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 3 |
7 | PATCHLEVEL = 10 |
8 | -SUBLEVEL = 59 |
9 | +SUBLEVEL = 60 |
10 | EXTRAVERSION = |
11 | NAME = TOSSUG Baby Fish |
12 | |
13 | diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts |
14 | index 4f31b2eb5cdf..398064cef746 100644 |
15 | --- a/arch/arc/boot/dts/nsimosci.dts |
16 | +++ b/arch/arc/boot/dts/nsimosci.dts |
17 | @@ -20,7 +20,7 @@ |
18 | /* this is for console on PGU */ |
19 | /* bootargs = "console=tty0 consoleblank=0"; */ |
20 | /* this is for console on serial */ |
21 | - bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=ttyS0,115200n8 consoleblank=0 debug"; |
22 | + bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; |
23 | }; |
24 | |
25 | aliases { |
26 | diff --git a/arch/arc/include/asm/kgdb.h b/arch/arc/include/asm/kgdb.h |
27 | index 4930957ca3d3..e897610c657a 100644 |
28 | --- a/arch/arc/include/asm/kgdb.h |
29 | +++ b/arch/arc/include/asm/kgdb.h |
30 | @@ -19,7 +19,7 @@ |
31 | * register API yet */ |
32 | #undef DBG_MAX_REG_NUM |
33 | |
34 | -#define GDB_MAX_REGS 39 |
35 | +#define GDB_MAX_REGS 87 |
36 | |
37 | #define BREAK_INSTR_SIZE 2 |
38 | #define CACHE_FLUSH_IS_SAFE 1 |
39 | @@ -33,23 +33,27 @@ static inline void arch_kgdb_breakpoint(void) |
40 | |
41 | extern void kgdb_trap(struct pt_regs *regs, int param); |
42 | |
43 | -enum arc700_linux_regnums { |
44 | +/* This is the numbering of registers according to the GDB. See GDB's |
45 | + * arc-tdep.h for details. |
46 | + * |
47 | + * Registers are ordered for GDB 7.5. It is incompatible with GDB 6.8. */ |
48 | +enum arc_linux_regnums { |
49 | _R0 = 0, |
50 | _R1, _R2, _R3, _R4, _R5, _R6, _R7, _R8, _R9, _R10, _R11, _R12, _R13, |
51 | _R14, _R15, _R16, _R17, _R18, _R19, _R20, _R21, _R22, _R23, _R24, |
52 | _R25, _R26, |
53 | - _BTA = 27, |
54 | - _LP_START = 28, |
55 | - _LP_END = 29, |
56 | - _LP_COUNT = 30, |
57 | - _STATUS32 = 31, |
58 | - _BLINK = 32, |
59 | - _FP = 33, |
60 | - __SP = 34, |
61 | - _EFA = 35, |
62 | - _RET = 36, |
63 | - _ORIG_R8 = 37, |
64 | - _STOP_PC = 38 |
65 | + _FP = 27, |
66 | + __SP = 28, |
67 | + _R30 = 30, |
68 | + _BLINK = 31, |
69 | + _LP_COUNT = 60, |
70 | + _STOP_PC = 64, |
71 | + _RET = 64, |
72 | + _LP_START = 65, |
73 | + _LP_END = 66, |
74 | + _STATUS32 = 67, |
75 | + _ECR = 76, |
76 | + _BTA = 82, |
77 | }; |
78 | |
79 | #else |
80 | diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c |
81 | index 0e17e1352718..a91a7a99f70f 100644 |
82 | --- a/arch/mips/mm/tlbex.c |
83 | +++ b/arch/mips/mm/tlbex.c |
84 | @@ -1091,6 +1091,7 @@ static void __cpuinit build_update_entries(u32 **p, unsigned int tmp, |
85 | struct mips_huge_tlb_info { |
86 | int huge_pte; |
87 | int restore_scratch; |
88 | + bool need_reload_pte; |
89 | }; |
90 | |
91 | static struct mips_huge_tlb_info __cpuinit |
92 | @@ -1105,6 +1106,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l, |
93 | |
94 | rv.huge_pte = scratch; |
95 | rv.restore_scratch = 0; |
96 | + rv.need_reload_pte = false; |
97 | |
98 | if (check_for_high_segbits) { |
99 | UASM_i_MFC0(p, tmp, C0_BADVADDR); |
100 | @@ -1293,6 +1295,7 @@ static void __cpuinit build_r4000_tlb_refill_handler(void) |
101 | } else { |
102 | htlb_info.huge_pte = K0; |
103 | htlb_info.restore_scratch = 0; |
104 | + htlb_info.need_reload_pte = true; |
105 | vmalloc_mode = refill_noscratch; |
106 | /* |
107 | * create the plain linear handler |
108 | @@ -1329,7 +1332,8 @@ static void __cpuinit build_r4000_tlb_refill_handler(void) |
109 | } |
110 | #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT |
111 | uasm_l_tlb_huge_update(&l, p); |
112 | - UASM_i_LW(&p, K0, 0, K1); |
113 | + if (htlb_info.need_reload_pte) |
114 | + UASM_i_LW(&p, htlb_info.huge_pte, 0, K1); |
115 | build_huge_update_entries(&p, htlb_info.huge_pte, K1); |
116 | build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random, |
117 | htlb_info.restore_scratch); |
118 | diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S |
119 | index 474dc1b59f72..c9305ef1d411 100644 |
120 | --- a/arch/x86/ia32/ia32entry.S |
121 | +++ b/arch/x86/ia32/ia32entry.S |
122 | @@ -151,6 +151,16 @@ ENTRY(ia32_sysenter_target) |
123 | 1: movl (%rbp),%ebp |
124 | _ASM_EXTABLE(1b,ia32_badarg) |
125 | ASM_CLAC |
126 | + |
127 | + /* |
128 | + * Sysenter doesn't filter flags, so we need to clear NT |
129 | + * ourselves. To save a few cycles, we can check whether |
130 | + * NT was set instead of doing an unconditional popfq. |
131 | + */ |
132 | + testl $X86_EFLAGS_NT,EFLAGS-ARGOFFSET(%rsp) |
133 | + jnz sysenter_fix_flags |
134 | +sysenter_flags_fixed: |
135 | + |
136 | orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET) |
137 | testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) |
138 | CFI_REMEMBER_STATE |
139 | @@ -184,6 +194,8 @@ sysexit_from_sys_call: |
140 | TRACE_IRQS_ON |
141 | ENABLE_INTERRUPTS_SYSEXIT32 |
142 | |
143 | + CFI_RESTORE_STATE |
144 | + |
145 | #ifdef CONFIG_AUDITSYSCALL |
146 | .macro auditsys_entry_common |
147 | movl %esi,%r9d /* 6th arg: 4th syscall arg */ |
148 | @@ -226,7 +238,6 @@ sysexit_from_sys_call: |
149 | .endm |
150 | |
151 | sysenter_auditsys: |
152 | - CFI_RESTORE_STATE |
153 | auditsys_entry_common |
154 | movl %ebp,%r9d /* reload 6th syscall arg */ |
155 | jmp sysenter_dispatch |
156 | @@ -235,6 +246,11 @@ sysexit_audit: |
157 | auditsys_exit sysexit_from_sys_call |
158 | #endif |
159 | |
160 | +sysenter_fix_flags: |
161 | + pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) |
162 | + popfq_cfi |
163 | + jmp sysenter_flags_fixed |
164 | + |
165 | sysenter_tracesys: |
166 | #ifdef CONFIG_AUDITSYSCALL |
167 | testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) |
168 | diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h |
169 | index 9c999c1674fa..01f15b227d7e 100644 |
170 | --- a/arch/x86/include/asm/elf.h |
171 | +++ b/arch/x86/include/asm/elf.h |
172 | @@ -155,8 +155,9 @@ do { \ |
173 | #define elf_check_arch(x) \ |
174 | ((x)->e_machine == EM_X86_64) |
175 | |
176 | -#define compat_elf_check_arch(x) \ |
177 | - (elf_check_arch_ia32(x) || (x)->e_machine == EM_X86_64) |
178 | +#define compat_elf_check_arch(x) \ |
179 | + (elf_check_arch_ia32(x) || \ |
180 | + (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64)) |
181 | |
182 | #if __USER32_DS != __USER_DS |
183 | # error "The following code assumes __USER32_DS == __USER_DS" |
184 | diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h |
185 | index 373058c9b75d..4c481e751e8e 100644 |
186 | --- a/arch/x86/include/asm/kvm_host.h |
187 | +++ b/arch/x86/include/asm/kvm_host.h |
188 | @@ -953,6 +953,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code) |
189 | kvm_queue_exception_e(vcpu, GP_VECTOR, error_code); |
190 | } |
191 | |
192 | +static inline u64 get_canonical(u64 la) |
193 | +{ |
194 | + return ((int64_t)la << 16) >> 16; |
195 | +} |
196 | + |
197 | +static inline bool is_noncanonical_address(u64 la) |
198 | +{ |
199 | +#ifdef CONFIG_X86_64 |
200 | + return get_canonical(la) != la; |
201 | +#else |
202 | + return false; |
203 | +#endif |
204 | +} |
205 | + |
206 | #define TSS_IOPB_BASE_OFFSET 0x66 |
207 | #define TSS_BASE_SIZE 0x68 |
208 | #define TSS_IOPB_SIZE (65536 / 8) |
209 | @@ -1011,7 +1025,7 @@ int kvm_cpu_get_interrupt(struct kvm_vcpu *v); |
210 | void kvm_vcpu_reset(struct kvm_vcpu *vcpu); |
211 | |
212 | void kvm_define_shared_msr(unsigned index, u32 msr); |
213 | -void kvm_set_shared_msr(unsigned index, u64 val, u64 mask); |
214 | +int kvm_set_shared_msr(unsigned index, u64 val, u64 mask); |
215 | |
216 | bool kvm_is_linear_rip(struct kvm_vcpu *vcpu, unsigned long linear_rip); |
217 | |
218 | diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h |
219 | index 54991a746043..b16e6d28f149 100644 |
220 | --- a/arch/x86/include/uapi/asm/processor-flags.h |
221 | +++ b/arch/x86/include/uapi/asm/processor-flags.h |
222 | @@ -6,7 +6,7 @@ |
223 | * EFLAGS bits |
224 | */ |
225 | #define X86_EFLAGS_CF 0x00000001 /* Carry Flag */ |
226 | -#define X86_EFLAGS_BIT1 0x00000002 /* Bit 1 - always on */ |
227 | +#define X86_EFLAGS_FIXED 0x00000002 /* Bit 1 - always on */ |
228 | #define X86_EFLAGS_PF 0x00000004 /* Parity Flag */ |
229 | #define X86_EFLAGS_AF 0x00000010 /* Auxiliary carry Flag */ |
230 | #define X86_EFLAGS_ZF 0x00000040 /* Zero Flag */ |
231 | diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c |
232 | index 904611bf0e5a..033eb44dc661 100644 |
233 | --- a/arch/x86/kernel/apic/apic.c |
234 | +++ b/arch/x86/kernel/apic/apic.c |
235 | @@ -1263,7 +1263,7 @@ void __cpuinit setup_local_APIC(void) |
236 | unsigned int value, queued; |
237 | int i, j, acked = 0; |
238 | unsigned long long tsc = 0, ntsc; |
239 | - long long max_loops = cpu_khz; |
240 | + long long max_loops = cpu_khz ? cpu_khz : 1000000; |
241 | |
242 | if (cpu_has_tsc) |
243 | rdtscll(tsc); |
244 | @@ -1360,7 +1360,7 @@ void __cpuinit setup_local_APIC(void) |
245 | break; |
246 | } |
247 | if (queued) { |
248 | - if (cpu_has_tsc) { |
249 | + if (cpu_has_tsc && cpu_khz) { |
250 | rdtscll(ntsc); |
251 | max_loops = (cpu_khz << 10) - (ntsc - tsc); |
252 | } else |
253 | diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c |
254 | index deeb48d9459b..6a7e3e9cffc3 100644 |
255 | --- a/arch/x86/kernel/cpu/common.c |
256 | +++ b/arch/x86/kernel/cpu/common.c |
257 | @@ -1134,7 +1134,7 @@ void syscall_init(void) |
258 | /* Flags to clear on syscall */ |
259 | wrmsrl(MSR_SYSCALL_MASK, |
260 | X86_EFLAGS_TF|X86_EFLAGS_DF|X86_EFLAGS_IF| |
261 | - X86_EFLAGS_IOPL|X86_EFLAGS_AC); |
262 | + X86_EFLAGS_IOPL|X86_EFLAGS_AC|X86_EFLAGS_NT); |
263 | } |
264 | |
265 | /* |
266 | diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S |
267 | index 39ba6914bbc6..8c6b5c2284c7 100644 |
268 | --- a/arch/x86/kernel/entry_64.S |
269 | +++ b/arch/x86/kernel/entry_64.S |
270 | @@ -366,7 +366,7 @@ ENDPROC(native_usergs_sysret64) |
271 | /*CFI_REL_OFFSET ss,0*/ |
272 | pushq_cfi %rax /* rsp */ |
273 | CFI_REL_OFFSET rsp,0 |
274 | - pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_BIT1) /* eflags - interrupts on */ |
275 | + pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) /* eflags - interrupts on */ |
276 | /*CFI_REL_OFFSET rflags,0*/ |
277 | pushq_cfi $__KERNEL_CS /* cs */ |
278 | /*CFI_REL_OFFSET cs,0*/ |
279 | diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c |
280 | index 7305f7dfc7ab..0339f5c14bf9 100644 |
281 | --- a/arch/x86/kernel/process_32.c |
282 | +++ b/arch/x86/kernel/process_32.c |
283 | @@ -147,7 +147,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, |
284 | childregs->bp = arg; |
285 | childregs->orig_ax = -1; |
286 | childregs->cs = __KERNEL_CS | get_kernel_rpl(); |
287 | - childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_BIT1; |
288 | + childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_FIXED; |
289 | p->fpu_counter = 0; |
290 | p->thread.io_bitmap_ptr = NULL; |
291 | memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps)); |
292 | diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c |
293 | index 355ae06dbf94..f99a242730e9 100644 |
294 | --- a/arch/x86/kernel/process_64.c |
295 | +++ b/arch/x86/kernel/process_64.c |
296 | @@ -176,7 +176,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, |
297 | childregs->bp = arg; |
298 | childregs->orig_ax = -1; |
299 | childregs->cs = __KERNEL_CS | get_kernel_rpl(); |
300 | - childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_BIT1; |
301 | + childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_FIXED; |
302 | return 0; |
303 | } |
304 | *childregs = *current_pt_regs(); |
305 | diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c |
306 | index 087ab2af381a..66deef41512f 100644 |
307 | --- a/arch/x86/kernel/signal.c |
308 | +++ b/arch/x86/kernel/signal.c |
309 | @@ -677,6 +677,11 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs) |
310 | * handler too. |
311 | */ |
312 | regs->flags &= ~X86_EFLAGS_TF; |
313 | + /* |
314 | + * Ensure the signal handler starts with the new fpu state. |
315 | + */ |
316 | + if (used_math()) |
317 | + drop_init_fpu(current); |
318 | } |
319 | signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP)); |
320 | } |
321 | diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c |
322 | index 098b3cfda72e..4e27ba53c40c 100644 |
323 | --- a/arch/x86/kernel/tsc.c |
324 | +++ b/arch/x86/kernel/tsc.c |
325 | @@ -968,14 +968,17 @@ void __init tsc_init(void) |
326 | |
327 | x86_init.timers.tsc_pre_init(); |
328 | |
329 | - if (!cpu_has_tsc) |
330 | + if (!cpu_has_tsc) { |
331 | + setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); |
332 | return; |
333 | + } |
334 | |
335 | tsc_khz = x86_platform.calibrate_tsc(); |
336 | cpu_khz = tsc_khz; |
337 | |
338 | if (!tsc_khz) { |
339 | mark_tsc_unstable("could not calculate TSC khz"); |
340 | + setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); |
341 | return; |
342 | } |
343 | |
344 | diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c |
345 | index ada87a329edc..1ee723298e90 100644 |
346 | --- a/arch/x86/kernel/xsave.c |
347 | +++ b/arch/x86/kernel/xsave.c |
348 | @@ -268,8 +268,6 @@ int save_xstate_sig(void __user *buf, void __user *buf_fx, int size) |
349 | if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate)) |
350 | return -1; |
351 | |
352 | - drop_init_fpu(tsk); /* trigger finit */ |
353 | - |
354 | return 0; |
355 | } |
356 | |
357 | @@ -400,8 +398,11 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size) |
358 | set_used_math(); |
359 | } |
360 | |
361 | - if (use_eager_fpu()) |
362 | + if (use_eager_fpu()) { |
363 | + preempt_disable(); |
364 | math_state_restore(); |
365 | + preempt_enable(); |
366 | + } |
367 | |
368 | return err; |
369 | } else { |
370 | diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c |
371 | index fb3fddc322f8..4c01f022c6ac 100644 |
372 | --- a/arch/x86/kvm/emulate.c |
373 | +++ b/arch/x86/kvm/emulate.c |
374 | @@ -663,11 +663,6 @@ static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc) |
375 | masked_increment(reg_rmw(ctxt, VCPU_REGS_RSP), stack_mask(ctxt), inc); |
376 | } |
377 | |
378 | -static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) |
379 | -{ |
380 | - register_address_increment(ctxt, &ctxt->_eip, rel); |
381 | -} |
382 | - |
383 | static u32 desc_limit_scaled(struct desc_struct *desc) |
384 | { |
385 | u32 limit = get_desc_limit(desc); |
386 | @@ -741,6 +736,38 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt) |
387 | return emulate_exception(ctxt, NM_VECTOR, 0, false); |
388 | } |
389 | |
390 | +static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst, |
391 | + int cs_l) |
392 | +{ |
393 | + switch (ctxt->op_bytes) { |
394 | + case 2: |
395 | + ctxt->_eip = (u16)dst; |
396 | + break; |
397 | + case 4: |
398 | + ctxt->_eip = (u32)dst; |
399 | + break; |
400 | + case 8: |
401 | + if ((cs_l && is_noncanonical_address(dst)) || |
402 | + (!cs_l && (dst & ~(u32)-1))) |
403 | + return emulate_gp(ctxt, 0); |
404 | + ctxt->_eip = dst; |
405 | + break; |
406 | + default: |
407 | + WARN(1, "unsupported eip assignment size\n"); |
408 | + } |
409 | + return X86EMUL_CONTINUE; |
410 | +} |
411 | + |
412 | +static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst) |
413 | +{ |
414 | + return assign_eip_far(ctxt, dst, ctxt->mode == X86EMUL_MODE_PROT64); |
415 | +} |
416 | + |
417 | +static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) |
418 | +{ |
419 | + return assign_eip_near(ctxt, ctxt->_eip + rel); |
420 | +} |
421 | + |
422 | static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg) |
423 | { |
424 | u16 selector; |
425 | @@ -2161,13 +2188,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt) |
426 | case 2: /* call near abs */ { |
427 | long int old_eip; |
428 | old_eip = ctxt->_eip; |
429 | - ctxt->_eip = ctxt->src.val; |
430 | + rc = assign_eip_near(ctxt, ctxt->src.val); |
431 | + if (rc != X86EMUL_CONTINUE) |
432 | + break; |
433 | ctxt->src.val = old_eip; |
434 | rc = em_push(ctxt); |
435 | break; |
436 | } |
437 | case 4: /* jmp abs */ |
438 | - ctxt->_eip = ctxt->src.val; |
439 | + rc = assign_eip_near(ctxt, ctxt->src.val); |
440 | break; |
441 | case 5: /* jmp far */ |
442 | rc = em_jmp_far(ctxt); |
443 | @@ -2199,10 +2228,14 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt) |
444 | |
445 | static int em_ret(struct x86_emulate_ctxt *ctxt) |
446 | { |
447 | - ctxt->dst.type = OP_REG; |
448 | - ctxt->dst.addr.reg = &ctxt->_eip; |
449 | - ctxt->dst.bytes = ctxt->op_bytes; |
450 | - return em_pop(ctxt); |
451 | + int rc; |
452 | + unsigned long eip; |
453 | + |
454 | + rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); |
455 | + if (rc != X86EMUL_CONTINUE) |
456 | + return rc; |
457 | + |
458 | + return assign_eip_near(ctxt, eip); |
459 | } |
460 | |
461 | static int em_ret_far(struct x86_emulate_ctxt *ctxt) |
462 | @@ -2469,7 +2502,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) |
463 | { |
464 | const struct x86_emulate_ops *ops = ctxt->ops; |
465 | struct desc_struct cs, ss; |
466 | - u64 msr_data; |
467 | + u64 msr_data, rcx, rdx; |
468 | int usermode; |
469 | u16 cs_sel = 0, ss_sel = 0; |
470 | |
471 | @@ -2485,6 +2518,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) |
472 | else |
473 | usermode = X86EMUL_MODE_PROT32; |
474 | |
475 | + rcx = reg_read(ctxt, VCPU_REGS_RCX); |
476 | + rdx = reg_read(ctxt, VCPU_REGS_RDX); |
477 | + |
478 | cs.dpl = 3; |
479 | ss.dpl = 3; |
480 | ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data); |
481 | @@ -2502,6 +2538,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) |
482 | ss_sel = cs_sel + 8; |
483 | cs.d = 0; |
484 | cs.l = 1; |
485 | + if (is_noncanonical_address(rcx) || |
486 | + is_noncanonical_address(rdx)) |
487 | + return emulate_gp(ctxt, 0); |
488 | break; |
489 | } |
490 | cs_sel |= SELECTOR_RPL_MASK; |
491 | @@ -2510,8 +2549,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) |
492 | ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS); |
493 | ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS); |
494 | |
495 | - ctxt->_eip = reg_read(ctxt, VCPU_REGS_RDX); |
496 | - *reg_write(ctxt, VCPU_REGS_RSP) = reg_read(ctxt, VCPU_REGS_RCX); |
497 | + ctxt->_eip = rdx; |
498 | + *reg_write(ctxt, VCPU_REGS_RSP) = rcx; |
499 | |
500 | return X86EMUL_CONTINUE; |
501 | } |
502 | @@ -3050,10 +3089,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt) |
503 | |
504 | static int em_call(struct x86_emulate_ctxt *ctxt) |
505 | { |
506 | + int rc; |
507 | long rel = ctxt->src.val; |
508 | |
509 | ctxt->src.val = (unsigned long)ctxt->_eip; |
510 | - jmp_rel(ctxt, rel); |
511 | + rc = jmp_rel(ctxt, rel); |
512 | + if (rc != X86EMUL_CONTINUE) |
513 | + return rc; |
514 | return em_push(ctxt); |
515 | } |
516 | |
517 | @@ -3085,11 +3127,12 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt) |
518 | static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt) |
519 | { |
520 | int rc; |
521 | + unsigned long eip; |
522 | |
523 | - ctxt->dst.type = OP_REG; |
524 | - ctxt->dst.addr.reg = &ctxt->_eip; |
525 | - ctxt->dst.bytes = ctxt->op_bytes; |
526 | - rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes); |
527 | + rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); |
528 | + if (rc != X86EMUL_CONTINUE) |
529 | + return rc; |
530 | + rc = assign_eip_near(ctxt, eip); |
531 | if (rc != X86EMUL_CONTINUE) |
532 | return rc; |
533 | rsp_increment(ctxt, ctxt->src.val); |
534 | @@ -3379,20 +3422,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt) |
535 | |
536 | static int em_loop(struct x86_emulate_ctxt *ctxt) |
537 | { |
538 | + int rc = X86EMUL_CONTINUE; |
539 | + |
540 | register_address_increment(ctxt, reg_rmw(ctxt, VCPU_REGS_RCX), -1); |
541 | if ((address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) != 0) && |
542 | (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags))) |
543 | - jmp_rel(ctxt, ctxt->src.val); |
544 | + rc = jmp_rel(ctxt, ctxt->src.val); |
545 | |
546 | - return X86EMUL_CONTINUE; |
547 | + return rc; |
548 | } |
549 | |
550 | static int em_jcxz(struct x86_emulate_ctxt *ctxt) |
551 | { |
552 | + int rc = X86EMUL_CONTINUE; |
553 | + |
554 | if (address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) == 0) |
555 | - jmp_rel(ctxt, ctxt->src.val); |
556 | + rc = jmp_rel(ctxt, ctxt->src.val); |
557 | |
558 | - return X86EMUL_CONTINUE; |
559 | + return rc; |
560 | } |
561 | |
562 | static int em_in(struct x86_emulate_ctxt *ctxt) |
563 | @@ -4721,7 +4768,7 @@ special_insn: |
564 | break; |
565 | case 0x70 ... 0x7f: /* jcc (short) */ |
566 | if (test_cc(ctxt->b, ctxt->eflags)) |
567 | - jmp_rel(ctxt, ctxt->src.val); |
568 | + rc = jmp_rel(ctxt, ctxt->src.val); |
569 | break; |
570 | case 0x8d: /* lea r16/r32, m */ |
571 | ctxt->dst.val = ctxt->src.addr.mem.ea; |
572 | @@ -4750,7 +4797,7 @@ special_insn: |
573 | break; |
574 | case 0xe9: /* jmp rel */ |
575 | case 0xeb: /* jmp rel short */ |
576 | - jmp_rel(ctxt, ctxt->src.val); |
577 | + rc = jmp_rel(ctxt, ctxt->src.val); |
578 | ctxt->dst.type = OP_NONE; /* Disable writeback. */ |
579 | break; |
580 | case 0xf4: /* hlt */ |
581 | @@ -4862,7 +4909,7 @@ twobyte_insn: |
582 | break; |
583 | case 0x80 ... 0x8f: /* jnz rel, etc*/ |
584 | if (test_cc(ctxt->b, ctxt->eflags)) |
585 | - jmp_rel(ctxt, ctxt->src.val); |
586 | + rc = jmp_rel(ctxt, ctxt->src.val); |
587 | break; |
588 | case 0x90 ... 0x9f: /* setcc r/m8 */ |
589 | ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags); |
590 | diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c |
591 | index 518d86471b76..298781d4cfb4 100644 |
592 | --- a/arch/x86/kvm/i8254.c |
593 | +++ b/arch/x86/kvm/i8254.c |
594 | @@ -262,8 +262,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu) |
595 | return; |
596 | |
597 | timer = &pit->pit_state.timer; |
598 | + mutex_lock(&pit->pit_state.lock); |
599 | if (hrtimer_cancel(timer)) |
600 | hrtimer_start_expires(timer, HRTIMER_MODE_ABS); |
601 | + mutex_unlock(&pit->pit_state.lock); |
602 | } |
603 | |
604 | static void destroy_pit_timer(struct kvm_pit *pit) |
605 | diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c |
606 | index 765210d4d925..8bf40a243d75 100644 |
607 | --- a/arch/x86/kvm/svm.c |
608 | +++ b/arch/x86/kvm/svm.c |
609 | @@ -3196,7 +3196,7 @@ static int wrmsr_interception(struct vcpu_svm *svm) |
610 | msr.host_initiated = false; |
611 | |
612 | svm->next_rip = kvm_rip_read(&svm->vcpu) + 2; |
613 | - if (svm_set_msr(&svm->vcpu, &msr)) { |
614 | + if (kvm_set_msr(&svm->vcpu, &msr)) { |
615 | trace_kvm_msr_write_ex(ecx, data); |
616 | kvm_inject_gp(&svm->vcpu, 0); |
617 | } else { |
618 | @@ -3478,9 +3478,9 @@ static int handle_exit(struct kvm_vcpu *vcpu) |
619 | |
620 | if (exit_code >= ARRAY_SIZE(svm_exit_handlers) |
621 | || !svm_exit_handlers[exit_code]) { |
622 | - kvm_run->exit_reason = KVM_EXIT_UNKNOWN; |
623 | - kvm_run->hw.hardware_exit_reason = exit_code; |
624 | - return 0; |
625 | + WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_code); |
626 | + kvm_queue_exception(vcpu, UD_VECTOR); |
627 | + return 1; |
628 | } |
629 | |
630 | return svm_exit_handlers[exit_code](svm); |
631 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
632 | index 7cdafb6dc705..51139ff34917 100644 |
633 | --- a/arch/x86/kvm/vmx.c |
634 | +++ b/arch/x86/kvm/vmx.c |
635 | @@ -2493,12 +2493,15 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) |
636 | break; |
637 | msr = find_msr_entry(vmx, msr_index); |
638 | if (msr) { |
639 | + u64 old_msr_data = msr->data; |
640 | msr->data = data; |
641 | if (msr - vmx->guest_msrs < vmx->save_nmsrs) { |
642 | preempt_disable(); |
643 | - kvm_set_shared_msr(msr->index, msr->data, |
644 | - msr->mask); |
645 | + ret = kvm_set_shared_msr(msr->index, msr->data, |
646 | + msr->mask); |
647 | preempt_enable(); |
648 | + if (ret) |
649 | + msr->data = old_msr_data; |
650 | } |
651 | break; |
652 | } |
653 | @@ -5062,7 +5065,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu) |
654 | msr.data = data; |
655 | msr.index = ecx; |
656 | msr.host_initiated = false; |
657 | - if (vmx_set_msr(vcpu, &msr) != 0) { |
658 | + if (kvm_set_msr(vcpu, &msr) != 0) { |
659 | trace_kvm_msr_write_ex(ecx, data); |
660 | kvm_inject_gp(vcpu, 0); |
661 | return 1; |
662 | @@ -6651,10 +6654,10 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) |
663 | && kvm_vmx_exit_handlers[exit_reason]) |
664 | return kvm_vmx_exit_handlers[exit_reason](vcpu); |
665 | else { |
666 | - vcpu->run->exit_reason = KVM_EXIT_UNKNOWN; |
667 | - vcpu->run->hw.hardware_exit_reason = exit_reason; |
668 | + WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason); |
669 | + kvm_queue_exception(vcpu, UD_VECTOR); |
670 | + return 1; |
671 | } |
672 | - return 0; |
673 | } |
674 | |
675 | static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) |
676 | @@ -7949,7 +7952,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, |
677 | |
678 | kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->host_rsp); |
679 | kvm_register_write(vcpu, VCPU_REGS_RIP, vmcs12->host_rip); |
680 | - vmx_set_rflags(vcpu, X86_EFLAGS_BIT1); |
681 | + vmx_set_rflags(vcpu, X86_EFLAGS_FIXED); |
682 | /* |
683 | * Note that calling vmx_set_cr0 is important, even if cr0 hasn't |
684 | * actually changed, because it depends on the current state of |
685 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c |
686 | index e8753555f144..684f46dc87de 100644 |
687 | --- a/arch/x86/kvm/x86.c |
688 | +++ b/arch/x86/kvm/x86.c |
689 | @@ -225,20 +225,25 @@ static void kvm_shared_msr_cpu_online(void) |
690 | shared_msr_update(i, shared_msrs_global.msrs[i]); |
691 | } |
692 | |
693 | -void kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) |
694 | +int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) |
695 | { |
696 | unsigned int cpu = smp_processor_id(); |
697 | struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); |
698 | + int err; |
699 | |
700 | if (((value ^ smsr->values[slot].curr) & mask) == 0) |
701 | - return; |
702 | + return 0; |
703 | smsr->values[slot].curr = value; |
704 | - wrmsrl(shared_msrs_global.msrs[slot], value); |
705 | + err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); |
706 | + if (err) |
707 | + return 1; |
708 | + |
709 | if (!smsr->registered) { |
710 | smsr->urn.on_user_return = kvm_on_user_return; |
711 | user_return_notifier_register(&smsr->urn); |
712 | smsr->registered = true; |
713 | } |
714 | + return 0; |
715 | } |
716 | EXPORT_SYMBOL_GPL(kvm_set_shared_msr); |
717 | |
718 | @@ -920,7 +925,6 @@ void kvm_enable_efer_bits(u64 mask) |
719 | } |
720 | EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); |
721 | |
722 | - |
723 | /* |
724 | * Writes msr value into into the appropriate "register". |
725 | * Returns 0 on success, non-0 otherwise. |
726 | @@ -928,8 +932,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); |
727 | */ |
728 | int kvm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) |
729 | { |
730 | + switch (msr->index) { |
731 | + case MSR_FS_BASE: |
732 | + case MSR_GS_BASE: |
733 | + case MSR_KERNEL_GS_BASE: |
734 | + case MSR_CSTAR: |
735 | + case MSR_LSTAR: |
736 | + if (is_noncanonical_address(msr->data)) |
737 | + return 1; |
738 | + break; |
739 | + case MSR_IA32_SYSENTER_EIP: |
740 | + case MSR_IA32_SYSENTER_ESP: |
741 | + /* |
742 | + * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if |
743 | + * non-canonical address is written on Intel but not on |
744 | + * AMD (which ignores the top 32-bits, because it does |
745 | + * not implement 64-bit SYSENTER). |
746 | + * |
747 | + * 64-bit code should hence be able to write a non-canonical |
748 | + * value on AMD. Making the address canonical ensures that |
749 | + * vmentry does not fail on Intel after writing a non-canonical |
750 | + * value, and that something deterministic happens if the guest |
751 | + * invokes 64-bit SYSENTER. |
752 | + */ |
753 | + msr->data = get_canonical(msr->data); |
754 | + } |
755 | return kvm_x86_ops->set_msr(vcpu, msr); |
756 | } |
757 | +EXPORT_SYMBOL_GPL(kvm_set_msr); |
758 | |
759 | /* |
760 | * Adapt set_msr() to msr_io()'s calling convention |
761 | diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c |
762 | index bb32480c2d71..aabdf762f592 100644 |
763 | --- a/arch/x86/mm/pageattr.c |
764 | +++ b/arch/x86/mm/pageattr.c |
765 | @@ -389,7 +389,7 @@ phys_addr_t slow_virt_to_phys(void *__virt_addr) |
766 | psize = page_level_size(level); |
767 | pmask = page_level_mask(level); |
768 | offset = virt_addr & ~pmask; |
769 | - phys_addr = pte_pfn(*pte) << PAGE_SHIFT; |
770 | + phys_addr = (phys_addr_t)pte_pfn(*pte) << PAGE_SHIFT; |
771 | return (phys_addr | offset); |
772 | } |
773 | EXPORT_SYMBOL_GPL(slow_virt_to_phys); |
774 | diff --git a/block/blk-settings.c b/block/blk-settings.c |
775 | index 53309333c2f0..ec00a0f75212 100644 |
776 | --- a/block/blk-settings.c |
777 | +++ b/block/blk-settings.c |
778 | @@ -553,7 +553,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, |
779 | bottom = max(b->physical_block_size, b->io_min) + alignment; |
780 | |
781 | /* Verify that top and bottom intervals line up */ |
782 | - if (max(top, bottom) & (min(top, bottom) - 1)) { |
783 | + if (max(top, bottom) % min(top, bottom)) { |
784 | t->misaligned = 1; |
785 | ret = -1; |
786 | } |
787 | @@ -594,7 +594,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, |
788 | |
789 | /* Find lowest common alignment_offset */ |
790 | t->alignment_offset = lcm(t->alignment_offset, alignment) |
791 | - & (max(t->physical_block_size, t->io_min) - 1); |
792 | + % max(t->physical_block_size, t->io_min); |
793 | |
794 | /* Verify that new alignment_offset is on a logical block boundary */ |
795 | if (t->alignment_offset & (t->logical_block_size - 1)) { |
796 | diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c |
797 | index a5ffcc988f0b..1b4988b4bc11 100644 |
798 | --- a/block/scsi_ioctl.c |
799 | +++ b/block/scsi_ioctl.c |
800 | @@ -506,7 +506,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, |
801 | |
802 | if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { |
803 | err = DRIVER_ERROR << 24; |
804 | - goto out; |
805 | + goto error; |
806 | } |
807 | |
808 | memset(sense, 0, sizeof(sense)); |
809 | @@ -516,7 +516,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, |
810 | |
811 | blk_execute_rq(q, disk, rq, 0); |
812 | |
813 | -out: |
814 | err = rq->errors & 0xff; /* only 8 bit SCSI status */ |
815 | if (err) { |
816 | if (rq->sense_len && rq->sense) { |
817 | diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c |
818 | index a19c027b29bd..83187f497c7c 100644 |
819 | --- a/crypto/algif_skcipher.c |
820 | +++ b/crypto/algif_skcipher.c |
821 | @@ -49,7 +49,7 @@ struct skcipher_ctx { |
822 | struct ablkcipher_request req; |
823 | }; |
824 | |
825 | -#define MAX_SGL_ENTS ((PAGE_SIZE - sizeof(struct skcipher_sg_list)) / \ |
826 | +#define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \ |
827 | sizeof(struct scatterlist) - 1) |
828 | |
829 | static inline int skcipher_sndbuf(struct sock *sk) |
830 | diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c |
831 | index b603720b877d..37acda6fa7e4 100644 |
832 | --- a/drivers/ata/libata-sff.c |
833 | +++ b/drivers/ata/libata-sff.c |
834 | @@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask, |
835 | |
836 | DPRINTK("ata%u: bus reset via SRST\n", ap->print_id); |
837 | |
838 | - /* software reset. causes dev0 to be selected */ |
839 | - iowrite8(ap->ctl, ioaddr->ctl_addr); |
840 | - udelay(20); /* FIXME: flush */ |
841 | - iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); |
842 | - udelay(20); /* FIXME: flush */ |
843 | - iowrite8(ap->ctl, ioaddr->ctl_addr); |
844 | - ap->last_ctl = ap->ctl; |
845 | + if (ap->ioaddr.ctl_addr) { |
846 | + /* software reset. causes dev0 to be selected */ |
847 | + iowrite8(ap->ctl, ioaddr->ctl_addr); |
848 | + udelay(20); /* FIXME: flush */ |
849 | + iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); |
850 | + udelay(20); /* FIXME: flush */ |
851 | + iowrite8(ap->ctl, ioaddr->ctl_addr); |
852 | + ap->last_ctl = ap->ctl; |
853 | + } |
854 | |
855 | /* wait the port to become ready */ |
856 | return ata_sff_wait_after_reset(&ap->link, devmask, deadline); |
857 | @@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_port *ap) |
858 | |
859 | spin_unlock_irqrestore(ap->lock, flags); |
860 | |
861 | - /* ignore ata_sff_softreset if ctl isn't accessible */ |
862 | - if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr) |
863 | - softreset = NULL; |
864 | - |
865 | /* ignore built-in hardresets if SCR access is not available */ |
866 | if ((hardreset == sata_std_hardreset || |
867 | hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link)) |
868 | diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c |
869 | index f3febbce6c46..34c91ac3a814 100644 |
870 | --- a/drivers/ata/pata_serverworks.c |
871 | +++ b/drivers/ata/pata_serverworks.c |
872 | @@ -252,12 +252,18 @@ static void serverworks_set_dmamode(struct ata_port *ap, struct ata_device *adev |
873 | pci_write_config_byte(pdev, 0x54, ultra_cfg); |
874 | } |
875 | |
876 | -static struct scsi_host_template serverworks_sht = { |
877 | +static struct scsi_host_template serverworks_osb4_sht = { |
878 | + ATA_BMDMA_SHT(DRV_NAME), |
879 | + .sg_tablesize = LIBATA_DUMB_MAX_PRD, |
880 | +}; |
881 | + |
882 | +static struct scsi_host_template serverworks_csb_sht = { |
883 | ATA_BMDMA_SHT(DRV_NAME), |
884 | }; |
885 | |
886 | static struct ata_port_operations serverworks_osb4_port_ops = { |
887 | .inherits = &ata_bmdma_port_ops, |
888 | + .qc_prep = ata_bmdma_dumb_qc_prep, |
889 | .cable_detect = serverworks_cable_detect, |
890 | .mode_filter = serverworks_osb4_filter, |
891 | .set_piomode = serverworks_set_piomode, |
892 | @@ -266,6 +272,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = { |
893 | |
894 | static struct ata_port_operations serverworks_csb_port_ops = { |
895 | .inherits = &serverworks_osb4_port_ops, |
896 | + .qc_prep = ata_bmdma_qc_prep, |
897 | .mode_filter = serverworks_csb_filter, |
898 | }; |
899 | |
900 | @@ -405,6 +412,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id |
901 | } |
902 | }; |
903 | const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL }; |
904 | + struct scsi_host_template *sht = &serverworks_csb_sht; |
905 | int rc; |
906 | |
907 | rc = pcim_enable_device(pdev); |
908 | @@ -418,6 +426,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id |
909 | /* Select non UDMA capable OSB4 if we can't do fixups */ |
910 | if (rc < 0) |
911 | ppi[0] = &info[1]; |
912 | + sht = &serverworks_osb4_sht; |
913 | } |
914 | /* setup CSB5/CSB6 : South Bridge and IDE option RAID */ |
915 | else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) || |
916 | @@ -434,7 +443,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id |
917 | ppi[1] = &ata_dummy_port_info; |
918 | } |
919 | |
920 | - return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0); |
921 | + return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0); |
922 | } |
923 | |
924 | #ifdef CONFIG_PM |
925 | diff --git a/drivers/base/core.c b/drivers/base/core.c |
926 | index ca4bcb8b3938..2a19097a7cb1 100644 |
927 | --- a/drivers/base/core.c |
928 | +++ b/drivers/base/core.c |
929 | @@ -765,12 +765,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) |
930 | return &dir->kobj; |
931 | } |
932 | |
933 | +static DEFINE_MUTEX(gdp_mutex); |
934 | |
935 | static struct kobject *get_device_parent(struct device *dev, |
936 | struct device *parent) |
937 | { |
938 | if (dev->class) { |
939 | - static DEFINE_MUTEX(gdp_mutex); |
940 | struct kobject *kobj = NULL; |
941 | struct kobject *parent_kobj; |
942 | struct kobject *k; |
943 | @@ -834,7 +834,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) |
944 | glue_dir->kset != &dev->class->p->glue_dirs) |
945 | return; |
946 | |
947 | + mutex_lock(&gdp_mutex); |
948 | kobject_put(glue_dir); |
949 | + mutex_unlock(&gdp_mutex); |
950 | } |
951 | |
952 | static void cleanup_device_parent(struct device *dev) |
953 | diff --git a/drivers/block/drbd/drbd_interval.c b/drivers/block/drbd/drbd_interval.c |
954 | index 89c497c630b4..04a14e0f8878 100644 |
955 | --- a/drivers/block/drbd/drbd_interval.c |
956 | +++ b/drivers/block/drbd/drbd_interval.c |
957 | @@ -79,6 +79,7 @@ bool |
958 | drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) |
959 | { |
960 | struct rb_node **new = &root->rb_node, *parent = NULL; |
961 | + sector_t this_end = this->sector + (this->size >> 9); |
962 | |
963 | BUG_ON(!IS_ALIGNED(this->size, 512)); |
964 | |
965 | @@ -87,6 +88,8 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) |
966 | rb_entry(*new, struct drbd_interval, rb); |
967 | |
968 | parent = *new; |
969 | + if (here->end < this_end) |
970 | + here->end = this_end; |
971 | if (this->sector < here->sector) |
972 | new = &(*new)->rb_left; |
973 | else if (this->sector > here->sector) |
974 | @@ -99,6 +102,7 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) |
975 | return false; |
976 | } |
977 | |
978 | + this->end = this_end; |
979 | rb_link_node(&this->rb, parent, new); |
980 | rb_insert_augmented(&this->rb, root, &augment_callbacks); |
981 | return true; |
982 | diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c |
983 | index 07caf44d5755..9951e66b8502 100644 |
984 | --- a/drivers/block/rbd.c |
985 | +++ b/drivers/block/rbd.c |
986 | @@ -3227,7 +3227,7 @@ static int rbd_obj_read_sync(struct rbd_device *rbd_dev, |
987 | page_count = (u32) calc_pages_for(offset, length); |
988 | pages = ceph_alloc_page_vector(page_count, GFP_KERNEL); |
989 | if (IS_ERR(pages)) |
990 | - ret = PTR_ERR(pages); |
991 | + return PTR_ERR(pages); |
992 | |
993 | ret = -ENOMEM; |
994 | obj_request = rbd_obj_request_create(object_name, offset, length, |
995 | diff --git a/drivers/char/random.c b/drivers/char/random.c |
996 | index 81eefa1c0d3f..aee3464a5bdc 100644 |
997 | --- a/drivers/char/random.c |
998 | +++ b/drivers/char/random.c |
999 | @@ -933,8 +933,8 @@ static void extract_buf(struct entropy_store *r, __u8 *out) |
1000 | * pool while mixing, and hash one final time. |
1001 | */ |
1002 | sha_transform(hash.w, extract, workspace); |
1003 | - memset(extract, 0, sizeof(extract)); |
1004 | - memset(workspace, 0, sizeof(workspace)); |
1005 | + memzero_explicit(extract, sizeof(extract)); |
1006 | + memzero_explicit(workspace, sizeof(workspace)); |
1007 | |
1008 | /* |
1009 | * In case the hash function has some recognizable output |
1010 | @@ -957,7 +957,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out) |
1011 | } |
1012 | |
1013 | memcpy(out, &hash, EXTRACT_SIZE); |
1014 | - memset(&hash, 0, sizeof(hash)); |
1015 | + memzero_explicit(&hash, sizeof(hash)); |
1016 | } |
1017 | |
1018 | static ssize_t extract_entropy(struct entropy_store *r, void *buf, |
1019 | @@ -1005,7 +1005,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, |
1020 | } |
1021 | |
1022 | /* Wipe data just returned from memory */ |
1023 | - memset(tmp, 0, sizeof(tmp)); |
1024 | + memzero_explicit(tmp, sizeof(tmp)); |
1025 | |
1026 | return ret; |
1027 | } |
1028 | @@ -1043,7 +1043,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf, |
1029 | } |
1030 | |
1031 | /* Wipe data just returned from memory */ |
1032 | - memset(tmp, 0, sizeof(tmp)); |
1033 | + memzero_explicit(tmp, sizeof(tmp)); |
1034 | |
1035 | return ret; |
1036 | } |
1037 | diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c |
1038 | index 34d19b1984a1..decf84e71943 100644 |
1039 | --- a/drivers/cpufreq/intel_pstate.c |
1040 | +++ b/drivers/cpufreq/intel_pstate.c |
1041 | @@ -599,6 +599,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy) |
1042 | if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) { |
1043 | limits.min_perf_pct = 100; |
1044 | limits.min_perf = int_tofp(1); |
1045 | + limits.max_policy_pct = 100; |
1046 | limits.max_perf_pct = 100; |
1047 | limits.max_perf = int_tofp(1); |
1048 | limits.no_turbo = 0; |
1049 | diff --git a/drivers/edac/cpc925_edac.c b/drivers/edac/cpc925_edac.c |
1050 | index 7f3c57113ba1..1e08ce765f0c 100644 |
1051 | --- a/drivers/edac/cpc925_edac.c |
1052 | +++ b/drivers/edac/cpc925_edac.c |
1053 | @@ -562,7 +562,7 @@ static void cpc925_mc_check(struct mem_ctl_info *mci) |
1054 | |
1055 | if (apiexcp & UECC_EXCP_DETECTED) { |
1056 | cpc925_mc_printk(mci, KERN_INFO, "DRAM UECC Fault\n"); |
1057 | - edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, |
1058 | + edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, |
1059 | pfn, offset, 0, |
1060 | csrow, -1, -1, |
1061 | mci->ctl_name, ""); |
1062 | diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c |
1063 | index 1c4056a50383..2697deae3ab7 100644 |
1064 | --- a/drivers/edac/e7xxx_edac.c |
1065 | +++ b/drivers/edac/e7xxx_edac.c |
1066 | @@ -226,7 +226,7 @@ static void process_ce(struct mem_ctl_info *mci, struct e7xxx_error_info *info) |
1067 | static void process_ce_no_info(struct mem_ctl_info *mci) |
1068 | { |
1069 | edac_dbg(3, "\n"); |
1070 | - edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, 0, 0, 0, -1, -1, -1, |
1071 | + edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, 0, 0, 0, -1, -1, -1, |
1072 | "e7xxx CE log register overflow", ""); |
1073 | } |
1074 | |
1075 | diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c |
1076 | index aa44c1718f50..71b26513b93b 100644 |
1077 | --- a/drivers/edac/i3200_edac.c |
1078 | +++ b/drivers/edac/i3200_edac.c |
1079 | @@ -242,11 +242,11 @@ static void i3200_process_error_info(struct mem_ctl_info *mci, |
1080 | -1, -1, |
1081 | "i3000 UE", ""); |
1082 | } else if (log & I3200_ECCERRLOG_CE) { |
1083 | - edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, |
1084 | + edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, |
1085 | 0, 0, eccerrlog_syndrome(log), |
1086 | eccerrlog_row(channel, log), |
1087 | -1, -1, |
1088 | - "i3000 UE", ""); |
1089 | + "i3000 CE", ""); |
1090 | } |
1091 | } |
1092 | } |
1093 | diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c |
1094 | index 3e3e431c8301..b93b0d006ebb 100644 |
1095 | --- a/drivers/edac/i82860_edac.c |
1096 | +++ b/drivers/edac/i82860_edac.c |
1097 | @@ -124,7 +124,7 @@ static int i82860_process_error_info(struct mem_ctl_info *mci, |
1098 | dimm->location[0], dimm->location[1], -1, |
1099 | "i82860 UE", ""); |
1100 | else |
1101 | - edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, |
1102 | + edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, |
1103 | info->eap, 0, info->derrsyn, |
1104 | dimm->location[0], dimm->location[1], -1, |
1105 | "i82860 CE", ""); |
1106 | diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c |
1107 | index 7fc9f7272b56..e8f6418b6dec 100644 |
1108 | --- a/drivers/gpu/drm/ast/ast_mode.c |
1109 | +++ b/drivers/gpu/drm/ast/ast_mode.c |
1110 | @@ -1012,8 +1012,8 @@ static u32 copy_cursor_image(u8 *src, u8 *dst, int width, int height) |
1111 | srcdata32[1].ul = *((u32 *)(srcxor + 4)) & 0xf0f0f0f0; |
1112 | data32.b[0] = srcdata32[0].b[1] | (srcdata32[0].b[0] >> 4); |
1113 | data32.b[1] = srcdata32[0].b[3] | (srcdata32[0].b[2] >> 4); |
1114 | - data32.b[2] = srcdata32[0].b[1] | (srcdata32[1].b[0] >> 4); |
1115 | - data32.b[3] = srcdata32[0].b[3] | (srcdata32[1].b[2] >> 4); |
1116 | + data32.b[2] = srcdata32[1].b[1] | (srcdata32[1].b[0] >> 4); |
1117 | + data32.b[3] = srcdata32[1].b[3] | (srcdata32[1].b[2] >> 4); |
1118 | |
1119 | writel(data32.ul, dstxor); |
1120 | csum += data32.ul; |
1121 | diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c |
1122 | index 2d9b9d7a7992..f3edd2841f2d 100644 |
1123 | --- a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c |
1124 | +++ b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c |
1125 | @@ -124,6 +124,7 @@ dcb_outp_parse(struct nouveau_bios *bios, u8 idx, u8 *ver, u8 *len, |
1126 | struct dcb_output *outp) |
1127 | { |
1128 | u16 dcb = dcb_outp(bios, idx, ver, len); |
1129 | + memset(outp, 0x00, sizeof(*outp)); |
1130 | if (dcb) { |
1131 | if (*ver >= 0x20) { |
1132 | u32 conn = nv_ro32(bios, dcb + 0x00); |
1133 | diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c |
1134 | index f060b7487c34..f5ddd3550796 100644 |
1135 | --- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c |
1136 | +++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c |
1137 | @@ -78,6 +78,7 @@ static int modeset_init(struct drm_device *dev) |
1138 | if ((priv->num_encoders == 0) || (priv->num_connectors == 0)) { |
1139 | /* oh nos! */ |
1140 | dev_err(dev->dev, "no encoders/connectors found\n"); |
1141 | + drm_mode_config_cleanup(dev); |
1142 | return -ENXIO; |
1143 | } |
1144 | |
1145 | @@ -170,33 +171,37 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) |
1146 | dev->dev_private = priv; |
1147 | |
1148 | priv->wq = alloc_ordered_workqueue("tilcdc", 0); |
1149 | + if (!priv->wq) { |
1150 | + ret = -ENOMEM; |
1151 | + goto fail_free_priv; |
1152 | + } |
1153 | |
1154 | res = platform_get_resource(pdev, IORESOURCE_MEM, 0); |
1155 | if (!res) { |
1156 | dev_err(dev->dev, "failed to get memory resource\n"); |
1157 | ret = -EINVAL; |
1158 | - goto fail; |
1159 | + goto fail_free_wq; |
1160 | } |
1161 | |
1162 | priv->mmio = ioremap_nocache(res->start, resource_size(res)); |
1163 | if (!priv->mmio) { |
1164 | dev_err(dev->dev, "failed to ioremap\n"); |
1165 | ret = -ENOMEM; |
1166 | - goto fail; |
1167 | + goto fail_free_wq; |
1168 | } |
1169 | |
1170 | priv->clk = clk_get(dev->dev, "fck"); |
1171 | if (IS_ERR(priv->clk)) { |
1172 | dev_err(dev->dev, "failed to get functional clock\n"); |
1173 | ret = -ENODEV; |
1174 | - goto fail; |
1175 | + goto fail_iounmap; |
1176 | } |
1177 | |
1178 | priv->disp_clk = clk_get(dev->dev, "dpll_disp_ck"); |
1179 | if (IS_ERR(priv->clk)) { |
1180 | dev_err(dev->dev, "failed to get display clock\n"); |
1181 | ret = -ENODEV; |
1182 | - goto fail; |
1183 | + goto fail_put_clk; |
1184 | } |
1185 | |
1186 | #ifdef CONFIG_CPU_FREQ |
1187 | @@ -206,7 +211,7 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) |
1188 | CPUFREQ_TRANSITION_NOTIFIER); |
1189 | if (ret) { |
1190 | dev_err(dev->dev, "failed to register cpufreq notifier\n"); |
1191 | - goto fail; |
1192 | + goto fail_put_disp_clk; |
1193 | } |
1194 | #endif |
1195 | |
1196 | @@ -238,13 +243,13 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) |
1197 | ret = modeset_init(dev); |
1198 | if (ret < 0) { |
1199 | dev_err(dev->dev, "failed to initialize mode setting\n"); |
1200 | - goto fail; |
1201 | + goto fail_cpufreq_unregister; |
1202 | } |
1203 | |
1204 | ret = drm_vblank_init(dev, 1); |
1205 | if (ret < 0) { |
1206 | dev_err(dev->dev, "failed to initialize vblank\n"); |
1207 | - goto fail; |
1208 | + goto fail_mode_config_cleanup; |
1209 | } |
1210 | |
1211 | pm_runtime_get_sync(dev->dev); |
1212 | @@ -252,7 +257,7 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) |
1213 | pm_runtime_put_sync(dev->dev); |
1214 | if (ret < 0) { |
1215 | dev_err(dev->dev, "failed to install IRQ handler\n"); |
1216 | - goto fail; |
1217 | + goto fail_vblank_cleanup; |
1218 | } |
1219 | |
1220 | platform_set_drvdata(pdev, dev); |
1221 | @@ -260,13 +265,48 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) |
1222 | priv->fbdev = drm_fbdev_cma_init(dev, 16, |
1223 | dev->mode_config.num_crtc, |
1224 | dev->mode_config.num_connector); |
1225 | + if (IS_ERR(priv->fbdev)) { |
1226 | + ret = PTR_ERR(priv->fbdev); |
1227 | + goto fail_irq_uninstall; |
1228 | + } |
1229 | |
1230 | drm_kms_helper_poll_init(dev); |
1231 | |
1232 | return 0; |
1233 | |
1234 | -fail: |
1235 | - tilcdc_unload(dev); |
1236 | +fail_irq_uninstall: |
1237 | + pm_runtime_get_sync(dev->dev); |
1238 | + drm_irq_uninstall(dev); |
1239 | + pm_runtime_put_sync(dev->dev); |
1240 | + |
1241 | +fail_vblank_cleanup: |
1242 | + drm_vblank_cleanup(dev); |
1243 | + |
1244 | +fail_mode_config_cleanup: |
1245 | + drm_mode_config_cleanup(dev); |
1246 | + |
1247 | +fail_cpufreq_unregister: |
1248 | + pm_runtime_disable(dev->dev); |
1249 | +#ifdef CONFIG_CPU_FREQ |
1250 | + cpufreq_unregister_notifier(&priv->freq_transition, |
1251 | + CPUFREQ_TRANSITION_NOTIFIER); |
1252 | +fail_put_disp_clk: |
1253 | + clk_put(priv->disp_clk); |
1254 | +#endif |
1255 | + |
1256 | +fail_put_clk: |
1257 | + clk_put(priv->clk); |
1258 | + |
1259 | +fail_iounmap: |
1260 | + iounmap(priv->mmio); |
1261 | + |
1262 | +fail_free_wq: |
1263 | + flush_workqueue(priv->wq); |
1264 | + destroy_workqueue(priv->wq); |
1265 | + |
1266 | +fail_free_priv: |
1267 | + dev->dev_private = NULL; |
1268 | + kfree(priv); |
1269 | return ret; |
1270 | } |
1271 | |
1272 | diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c |
1273 | index b1240a250149..09324d0178d5 100644 |
1274 | --- a/drivers/i2c/busses/i2c-at91.c |
1275 | +++ b/drivers/i2c/busses/i2c-at91.c |
1276 | @@ -435,7 +435,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) |
1277 | } |
1278 | } |
1279 | |
1280 | - ret = wait_for_completion_io_timeout(&dev->cmd_complete, |
1281 | + ret = wait_for_completion_timeout(&dev->cmd_complete, |
1282 | dev->adapter.timeout); |
1283 | if (ret == 0) { |
1284 | dev_err(dev->dev, "controller timed out\n"); |
1285 | diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h |
1286 | index 1291673bd57e..ce715b1bee46 100644 |
1287 | --- a/drivers/input/serio/i8042-x86ia64io.h |
1288 | +++ b/drivers/input/serio/i8042-x86ia64io.h |
1289 | @@ -101,6 +101,12 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { |
1290 | }, |
1291 | { |
1292 | .matches = { |
1293 | + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), |
1294 | + DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"), |
1295 | + }, |
1296 | + }, |
1297 | + { |
1298 | + .matches = { |
1299 | DMI_MATCH(DMI_SYS_VENDOR, "Compaq"), |
1300 | DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"), |
1301 | DMI_MATCH(DMI_PRODUCT_VERSION, "8500"), |
1302 | @@ -609,6 +615,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { |
1303 | }, |
1304 | }, |
1305 | { |
1306 | + /* Fujitsu A544 laptop */ |
1307 | + /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */ |
1308 | + .matches = { |
1309 | + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), |
1310 | + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"), |
1311 | + }, |
1312 | + }, |
1313 | + { |
1314 | + /* Fujitsu AH544 laptop */ |
1315 | + /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ |
1316 | + .matches = { |
1317 | + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), |
1318 | + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), |
1319 | + }, |
1320 | + }, |
1321 | + { |
1322 | /* Fujitsu U574 laptop */ |
1323 | /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ |
1324 | .matches = { |
1325 | diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c |
1326 | index f0a3347b6441..516923926335 100644 |
1327 | --- a/drivers/lguest/x86/core.c |
1328 | +++ b/drivers/lguest/x86/core.c |
1329 | @@ -700,7 +700,7 @@ void lguest_arch_setup_regs(struct lg_cpu *cpu, unsigned long start) |
1330 | * interrupts are enabled. We always leave interrupts enabled while |
1331 | * running the Guest. |
1332 | */ |
1333 | - regs->eflags = X86_EFLAGS_IF | X86_EFLAGS_BIT1; |
1334 | + regs->eflags = X86_EFLAGS_IF | X86_EFLAGS_FIXED; |
1335 | |
1336 | /* |
1337 | * The "Extended Instruction Pointer" register says where the Guest is |
1338 | diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c |
1339 | index a6e985fcceb8..c9b4ca9e0696 100644 |
1340 | --- a/drivers/md/dm-bufio.c |
1341 | +++ b/drivers/md/dm-bufio.c |
1342 | @@ -462,6 +462,7 @@ static void __relink_lru(struct dm_buffer *b, int dirty) |
1343 | c->n_buffers[dirty]++; |
1344 | b->list_mode = dirty; |
1345 | list_move(&b->lru_list, &c->lru[dirty]); |
1346 | + b->last_accessed = jiffies; |
1347 | } |
1348 | |
1349 | /*---------------------------------------------------------------- |
1350 | diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c |
1351 | index 08d9a207259a..c69d0b787746 100644 |
1352 | --- a/drivers/md/dm-log-userspace-transfer.c |
1353 | +++ b/drivers/md/dm-log-userspace-transfer.c |
1354 | @@ -272,7 +272,7 @@ int dm_ulog_tfr_init(void) |
1355 | |
1356 | r = cn_add_callback(&ulog_cn_id, "dmlogusr", cn_ulog_callback); |
1357 | if (r) { |
1358 | - cn_del_callback(&ulog_cn_id); |
1359 | + kfree(prealloced_cn_msg); |
1360 | return r; |
1361 | } |
1362 | |
1363 | diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c |
1364 | index 1e344b033277..22e8c2032f6d 100644 |
1365 | --- a/drivers/media/dvb-frontends/ds3000.c |
1366 | +++ b/drivers/media/dvb-frontends/ds3000.c |
1367 | @@ -864,6 +864,13 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config, |
1368 | memcpy(&state->frontend.ops, &ds3000_ops, |
1369 | sizeof(struct dvb_frontend_ops)); |
1370 | state->frontend.demodulator_priv = state; |
1371 | + |
1372 | + /* |
1373 | + * Some devices like T480 starts with voltage on. Be sure |
1374 | + * to turn voltage off during init, as this can otherwise |
1375 | + * interfere with Unicable SCR systems. |
1376 | + */ |
1377 | + ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF); |
1378 | return &state->frontend; |
1379 | |
1380 | error3: |
1381 | diff --git a/drivers/media/i2c/tda7432.c b/drivers/media/i2c/tda7432.c |
1382 | index 28b5121881f5..09f4387dbc49 100644 |
1383 | --- a/drivers/media/i2c/tda7432.c |
1384 | +++ b/drivers/media/i2c/tda7432.c |
1385 | @@ -293,7 +293,7 @@ static int tda7432_s_ctrl(struct v4l2_ctrl *ctrl) |
1386 | if (t->mute->val) { |
1387 | lf |= TDA7432_MUTE; |
1388 | lr |= TDA7432_MUTE; |
1389 | - lf |= TDA7432_MUTE; |
1390 | + rf |= TDA7432_MUTE; |
1391 | rr |= TDA7432_MUTE; |
1392 | } |
1393 | /* Mute & update balance*/ |
1394 | diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c |
1395 | index 32d60e5546bc..a2737b4b090b 100644 |
1396 | --- a/drivers/media/usb/em28xx/em28xx-video.c |
1397 | +++ b/drivers/media/usb/em28xx/em28xx-video.c |
1398 | @@ -696,13 +696,16 @@ static int em28xx_stop_streaming(struct vb2_queue *vq) |
1399 | } |
1400 | |
1401 | spin_lock_irqsave(&dev->slock, flags); |
1402 | + if (dev->usb_ctl.vid_buf != NULL) { |
1403 | + vb2_buffer_done(&dev->usb_ctl.vid_buf->vb, VB2_BUF_STATE_ERROR); |
1404 | + dev->usb_ctl.vid_buf = NULL; |
1405 | + } |
1406 | while (!list_empty(&vidq->active)) { |
1407 | struct em28xx_buffer *buf; |
1408 | buf = list_entry(vidq->active.next, struct em28xx_buffer, list); |
1409 | list_del(&buf->list); |
1410 | vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); |
1411 | } |
1412 | - dev->usb_ctl.vid_buf = NULL; |
1413 | spin_unlock_irqrestore(&dev->slock, flags); |
1414 | |
1415 | return 0; |
1416 | @@ -724,13 +727,16 @@ int em28xx_stop_vbi_streaming(struct vb2_queue *vq) |
1417 | } |
1418 | |
1419 | spin_lock_irqsave(&dev->slock, flags); |
1420 | + if (dev->usb_ctl.vbi_buf != NULL) { |
1421 | + vb2_buffer_done(&dev->usb_ctl.vbi_buf->vb, VB2_BUF_STATE_ERROR); |
1422 | + dev->usb_ctl.vbi_buf = NULL; |
1423 | + } |
1424 | while (!list_empty(&vbiq->active)) { |
1425 | struct em28xx_buffer *buf; |
1426 | buf = list_entry(vbiq->active.next, struct em28xx_buffer, list); |
1427 | list_del(&buf->list); |
1428 | vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); |
1429 | } |
1430 | - dev->usb_ctl.vbi_buf = NULL; |
1431 | spin_unlock_irqrestore(&dev->slock, flags); |
1432 | |
1433 | return 0; |
1434 | diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c |
1435 | index 3fed63f4e026..ec9a4fa3bc86 100644 |
1436 | --- a/drivers/media/v4l2-core/v4l2-common.c |
1437 | +++ b/drivers/media/v4l2-core/v4l2-common.c |
1438 | @@ -485,16 +485,13 @@ static unsigned int clamp_align(unsigned int x, unsigned int min, |
1439 | /* Bits that must be zero to be aligned */ |
1440 | unsigned int mask = ~((1 << align) - 1); |
1441 | |
1442 | + /* Clamp to aligned min and max */ |
1443 | + x = clamp(x, (min + ~mask) & mask, max & mask); |
1444 | + |
1445 | /* Round to nearest aligned value */ |
1446 | if (align) |
1447 | x = (x + (1 << (align - 1))) & mask; |
1448 | |
1449 | - /* Clamp to aligned value of min and max */ |
1450 | - if (x < min) |
1451 | - x = (min + ~mask) & mask; |
1452 | - else if (x > max) |
1453 | - x = max & mask; |
1454 | - |
1455 | return x; |
1456 | } |
1457 | |
1458 | diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c |
1459 | index 45f26be359ea..7e28bd0de554 100644 |
1460 | --- a/drivers/mfd/rtsx_pcr.c |
1461 | +++ b/drivers/mfd/rtsx_pcr.c |
1462 | @@ -1137,7 +1137,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, |
1463 | pcr->msi_en = msi_en; |
1464 | if (pcr->msi_en) { |
1465 | ret = pci_enable_msi(pcidev); |
1466 | - if (ret < 0) |
1467 | + if (ret) |
1468 | pcr->msi_en = false; |
1469 | } |
1470 | |
1471 | diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c |
1472 | index 7ffb5cba30a9..4c65a5a4d8f4 100644 |
1473 | --- a/drivers/mmc/host/rtsx_pci_sdmmc.c |
1474 | +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c |
1475 | @@ -341,6 +341,13 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, |
1476 | } |
1477 | |
1478 | if (rsp_type == SD_RSP_TYPE_R2) { |
1479 | + /* |
1480 | + * The controller offloads the last byte {CRC-7, end bit 1'b1} |
1481 | + * of response type R2. Assign dummy CRC, 0, and end bit to the |
1482 | + * byte(ptr[16], goes into the LSB of resp[3] later). |
1483 | + */ |
1484 | + ptr[16] = 1; |
1485 | + |
1486 | for (i = 0; i < 4; i++) { |
1487 | cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); |
1488 | dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", |
1489 | diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c |
1490 | index 0648c6996d43..bf8108d65b73 100644 |
1491 | --- a/drivers/mtd/ubi/fastmap.c |
1492 | +++ b/drivers/mtd/ubi/fastmap.c |
1493 | @@ -330,6 +330,7 @@ static int process_pool_aeb(struct ubi_device *ubi, struct ubi_attach_info *ai, |
1494 | av = tmp_av; |
1495 | else { |
1496 | ubi_err("orphaned volume in fastmap pool!"); |
1497 | + kmem_cache_free(ai->aeb_slab_cache, new_aeb); |
1498 | return UBI_BAD_FASTMAP; |
1499 | } |
1500 | |
1501 | diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig |
1502 | index 3835321b8cf3..3bc3ebc0882f 100644 |
1503 | --- a/drivers/net/Kconfig |
1504 | +++ b/drivers/net/Kconfig |
1505 | @@ -139,6 +139,7 @@ config MACVLAN |
1506 | config MACVTAP |
1507 | tristate "MAC-VLAN based tap driver" |
1508 | depends on MACVLAN |
1509 | + depends on INET |
1510 | help |
1511 | This adds a specialized tap character device driver that is based |
1512 | on the MAC-VLAN network interface, called macvtap. A macvtap device |
1513 | @@ -209,6 +210,7 @@ config RIONET_RX_SIZE |
1514 | |
1515 | config TUN |
1516 | tristate "Universal TUN/TAP device driver support" |
1517 | + depends on INET |
1518 | select CRC32 |
1519 | ---help--- |
1520 | TUN/TAP provides packet reception and transmission for user space |
1521 | diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c |
1522 | index 72ff14b811c6..5a1897d86e94 100644 |
1523 | --- a/drivers/net/ppp/ppp_generic.c |
1524 | +++ b/drivers/net/ppp/ppp_generic.c |
1525 | @@ -601,7 +601,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) |
1526 | if (file == ppp->owner) |
1527 | ppp_shutdown_interface(ppp); |
1528 | } |
1529 | - if (atomic_long_read(&file->f_count) <= 2) { |
1530 | + if (atomic_long_read(&file->f_count) < 2) { |
1531 | ppp_release(NULL, file); |
1532 | err = 0; |
1533 | } else |
1534 | diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c |
1535 | index d33c3ae2fcea..3b449c4ecf72 100644 |
1536 | --- a/drivers/net/usb/ax88179_178a.c |
1537 | +++ b/drivers/net/usb/ax88179_178a.c |
1538 | @@ -695,6 +695,7 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) |
1539 | { |
1540 | struct usbnet *dev = netdev_priv(net); |
1541 | struct sockaddr *addr = p; |
1542 | + int ret; |
1543 | |
1544 | if (netif_running(net)) |
1545 | return -EBUSY; |
1546 | @@ -704,8 +705,12 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) |
1547 | memcpy(net->dev_addr, addr->sa_data, ETH_ALEN); |
1548 | |
1549 | /* Set the MAC address */ |
1550 | - return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, |
1551 | + ret = ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, |
1552 | ETH_ALEN, net->dev_addr); |
1553 | + if (ret < 0) |
1554 | + return ret; |
1555 | + |
1556 | + return 0; |
1557 | } |
1558 | |
1559 | static const struct net_device_ops ax88179_netdev_ops = { |
1560 | diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c |
1561 | index 9ef0711a5cc1..400b8679796a 100644 |
1562 | --- a/drivers/net/wireless/rt2x00/rt2800usb.c |
1563 | +++ b/drivers/net/wireless/rt2x00/rt2800usb.c |
1564 | @@ -1091,6 +1091,7 @@ static struct usb_device_id rt2800usb_device_table[] = { |
1565 | /* Ovislink */ |
1566 | { USB_DEVICE(0x1b75, 0x3071) }, |
1567 | { USB_DEVICE(0x1b75, 0x3072) }, |
1568 | + { USB_DEVICE(0x1b75, 0xa200) }, |
1569 | /* Para */ |
1570 | { USB_DEVICE(0x20b8, 0x8888) }, |
1571 | /* Pegatron */ |
1572 | diff --git a/drivers/of/base.c b/drivers/of/base.c |
1573 | index 1d10b4ec6814..b60f9a77ab03 100644 |
1574 | --- a/drivers/of/base.c |
1575 | +++ b/drivers/of/base.c |
1576 | @@ -963,52 +963,6 @@ int of_property_read_string(struct device_node *np, const char *propname, |
1577 | EXPORT_SYMBOL_GPL(of_property_read_string); |
1578 | |
1579 | /** |
1580 | - * of_property_read_string_index - Find and read a string from a multiple |
1581 | - * strings property. |
1582 | - * @np: device node from which the property value is to be read. |
1583 | - * @propname: name of the property to be searched. |
1584 | - * @index: index of the string in the list of strings |
1585 | - * @out_string: pointer to null terminated return string, modified only if |
1586 | - * return value is 0. |
1587 | - * |
1588 | - * Search for a property in a device tree node and retrieve a null |
1589 | - * terminated string value (pointer to data, not a copy) in the list of strings |
1590 | - * contained in that property. |
1591 | - * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if |
1592 | - * property does not have a value, and -EILSEQ if the string is not |
1593 | - * null-terminated within the length of the property data. |
1594 | - * |
1595 | - * The out_string pointer is modified only if a valid string can be decoded. |
1596 | - */ |
1597 | -int of_property_read_string_index(struct device_node *np, const char *propname, |
1598 | - int index, const char **output) |
1599 | -{ |
1600 | - struct property *prop = of_find_property(np, propname, NULL); |
1601 | - int i = 0; |
1602 | - size_t l = 0, total = 0; |
1603 | - const char *p; |
1604 | - |
1605 | - if (!prop) |
1606 | - return -EINVAL; |
1607 | - if (!prop->value) |
1608 | - return -ENODATA; |
1609 | - if (strnlen(prop->value, prop->length) >= prop->length) |
1610 | - return -EILSEQ; |
1611 | - |
1612 | - p = prop->value; |
1613 | - |
1614 | - for (i = 0; total < prop->length; total += l, p += l) { |
1615 | - l = strlen(p) + 1; |
1616 | - if (i++ == index) { |
1617 | - *output = p; |
1618 | - return 0; |
1619 | - } |
1620 | - } |
1621 | - return -ENODATA; |
1622 | -} |
1623 | -EXPORT_SYMBOL_GPL(of_property_read_string_index); |
1624 | - |
1625 | -/** |
1626 | * of_property_match_string() - Find string in a list and return index |
1627 | * @np: pointer to node containing string list property |
1628 | * @propname: string list property name |
1629 | @@ -1034,7 +988,7 @@ int of_property_match_string(struct device_node *np, const char *propname, |
1630 | end = p + prop->length; |
1631 | |
1632 | for (i = 0; p < end; i++, p += l) { |
1633 | - l = strlen(p) + 1; |
1634 | + l = strnlen(p, end - p) + 1; |
1635 | if (p + l > end) |
1636 | return -EILSEQ; |
1637 | pr_debug("comparing %s with %s\n", string, p); |
1638 | @@ -1046,39 +1000,41 @@ int of_property_match_string(struct device_node *np, const char *propname, |
1639 | EXPORT_SYMBOL_GPL(of_property_match_string); |
1640 | |
1641 | /** |
1642 | - * of_property_count_strings - Find and return the number of strings from a |
1643 | - * multiple strings property. |
1644 | + * of_property_read_string_util() - Utility helper for parsing string properties |
1645 | * @np: device node from which the property value is to be read. |
1646 | * @propname: name of the property to be searched. |
1647 | + * @out_strs: output array of string pointers. |
1648 | + * @sz: number of array elements to read. |
1649 | + * @skip: Number of strings to skip over at beginning of list. |
1650 | * |
1651 | - * Search for a property in a device tree node and retrieve the number of null |
1652 | - * terminated string contain in it. Returns the number of strings on |
1653 | - * success, -EINVAL if the property does not exist, -ENODATA if property |
1654 | - * does not have a value, and -EILSEQ if the string is not null-terminated |
1655 | - * within the length of the property data. |
1656 | + * Don't call this function directly. It is a utility helper for the |
1657 | + * of_property_read_string*() family of functions. |
1658 | */ |
1659 | -int of_property_count_strings(struct device_node *np, const char *propname) |
1660 | +int of_property_read_string_helper(struct device_node *np, const char *propname, |
1661 | + const char **out_strs, size_t sz, int skip) |
1662 | { |
1663 | struct property *prop = of_find_property(np, propname, NULL); |
1664 | - int i = 0; |
1665 | - size_t l = 0, total = 0; |
1666 | - const char *p; |
1667 | + int l = 0, i = 0; |
1668 | + const char *p, *end; |
1669 | |
1670 | if (!prop) |
1671 | return -EINVAL; |
1672 | if (!prop->value) |
1673 | return -ENODATA; |
1674 | - if (strnlen(prop->value, prop->length) >= prop->length) |
1675 | - return -EILSEQ; |
1676 | - |
1677 | p = prop->value; |
1678 | + end = p + prop->length; |
1679 | |
1680 | - for (i = 0; total < prop->length; total += l, p += l, i++) |
1681 | - l = strlen(p) + 1; |
1682 | - |
1683 | - return i; |
1684 | + for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) { |
1685 | + l = strnlen(p, end - p) + 1; |
1686 | + if (p + l > end) |
1687 | + return -EILSEQ; |
1688 | + if (out_strs && i >= skip) |
1689 | + *out_strs++ = p; |
1690 | + } |
1691 | + i -= skip; |
1692 | + return i <= 0 ? -ENODATA : i; |
1693 | } |
1694 | -EXPORT_SYMBOL_GPL(of_property_count_strings); |
1695 | +EXPORT_SYMBOL_GPL(of_property_read_string_helper); |
1696 | |
1697 | /** |
1698 | * of_parse_phandle - Resolve a phandle property to a device_node pointer |
1699 | diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c |
1700 | index 0eb5c38b4e07..f5e8dc7a725c 100644 |
1701 | --- a/drivers/of/selftest.c |
1702 | +++ b/drivers/of/selftest.c |
1703 | @@ -126,8 +126,9 @@ static void __init of_selftest_parse_phandle_with_args(void) |
1704 | selftest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc); |
1705 | } |
1706 | |
1707 | -static void __init of_selftest_property_match_string(void) |
1708 | +static void __init of_selftest_property_string(void) |
1709 | { |
1710 | + const char *strings[4]; |
1711 | struct device_node *np; |
1712 | int rc; |
1713 | |
1714 | @@ -145,13 +146,66 @@ static void __init of_selftest_property_match_string(void) |
1715 | rc = of_property_match_string(np, "phandle-list-names", "third"); |
1716 | selftest(rc == 2, "third expected:0 got:%i\n", rc); |
1717 | rc = of_property_match_string(np, "phandle-list-names", "fourth"); |
1718 | - selftest(rc == -ENODATA, "unmatched string; rc=%i", rc); |
1719 | + selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc); |
1720 | rc = of_property_match_string(np, "missing-property", "blah"); |
1721 | - selftest(rc == -EINVAL, "missing property; rc=%i", rc); |
1722 | + selftest(rc == -EINVAL, "missing property; rc=%i\n", rc); |
1723 | rc = of_property_match_string(np, "empty-property", "blah"); |
1724 | - selftest(rc == -ENODATA, "empty property; rc=%i", rc); |
1725 | + selftest(rc == -ENODATA, "empty property; rc=%i\n", rc); |
1726 | rc = of_property_match_string(np, "unterminated-string", "blah"); |
1727 | - selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc); |
1728 | + selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); |
1729 | + |
1730 | + /* of_property_count_strings() tests */ |
1731 | + rc = of_property_count_strings(np, "string-property"); |
1732 | + selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); |
1733 | + rc = of_property_count_strings(np, "phandle-list-names"); |
1734 | + selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); |
1735 | + rc = of_property_count_strings(np, "unterminated-string"); |
1736 | + selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); |
1737 | + rc = of_property_count_strings(np, "unterminated-string-list"); |
1738 | + selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); |
1739 | + |
1740 | + /* of_property_read_string_index() tests */ |
1741 | + rc = of_property_read_string_index(np, "string-property", 0, strings); |
1742 | + selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc); |
1743 | + strings[0] = NULL; |
1744 | + rc = of_property_read_string_index(np, "string-property", 1, strings); |
1745 | + selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); |
1746 | + rc = of_property_read_string_index(np, "phandle-list-names", 0, strings); |
1747 | + selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); |
1748 | + rc = of_property_read_string_index(np, "phandle-list-names", 1, strings); |
1749 | + selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc); |
1750 | + rc = of_property_read_string_index(np, "phandle-list-names", 2, strings); |
1751 | + selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc); |
1752 | + strings[0] = NULL; |
1753 | + rc = of_property_read_string_index(np, "phandle-list-names", 3, strings); |
1754 | + selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); |
1755 | + strings[0] = NULL; |
1756 | + rc = of_property_read_string_index(np, "unterminated-string", 0, strings); |
1757 | + selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); |
1758 | + rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings); |
1759 | + selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); |
1760 | + strings[0] = NULL; |
1761 | + rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */ |
1762 | + selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); |
1763 | + strings[1] = NULL; |
1764 | + |
1765 | + /* of_property_read_string_array() tests */ |
1766 | + rc = of_property_read_string_array(np, "string-property", strings, 4); |
1767 | + selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); |
1768 | + rc = of_property_read_string_array(np, "phandle-list-names", strings, 4); |
1769 | + selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); |
1770 | + rc = of_property_read_string_array(np, "unterminated-string", strings, 4); |
1771 | + selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); |
1772 | + /* -- An incorrectly formed string should cause a failure */ |
1773 | + rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4); |
1774 | + selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); |
1775 | + /* -- parsing the correctly formed strings should still work: */ |
1776 | + strings[2] = NULL; |
1777 | + rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2); |
1778 | + selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc); |
1779 | + strings[1] = NULL; |
1780 | + rc = of_property_read_string_array(np, "phandle-list-names", strings, 1); |
1781 | + selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]); |
1782 | } |
1783 | |
1784 | static int __init of_selftest(void) |
1785 | @@ -167,7 +221,7 @@ static int __init of_selftest(void) |
1786 | |
1787 | pr_info("start of selftest - you will see error messages\n"); |
1788 | of_selftest_parse_phandle_with_args(); |
1789 | - of_selftest_property_match_string(); |
1790 | + of_selftest_property_string(); |
1791 | pr_info("end of selftest - %s\n", selftest_passed ? "PASS" : "FAIL"); |
1792 | return 0; |
1793 | } |
1794 | diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c |
1795 | index c9076bdaf2c1..59a8d325a697 100644 |
1796 | --- a/drivers/platform/x86/acer-wmi.c |
1797 | +++ b/drivers/platform/x86/acer-wmi.c |
1798 | @@ -572,6 +572,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] = { |
1799 | DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5750"), |
1800 | }, |
1801 | }, |
1802 | + { |
1803 | + /* |
1804 | + * Note no video_set_backlight_video_vendor, we must use the |
1805 | + * acer interface, as there is no native backlight interface. |
1806 | + */ |
1807 | + .ident = "Acer KAV80", |
1808 | + .matches = { |
1809 | + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), |
1810 | + DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"), |
1811 | + }, |
1812 | + }, |
1813 | {} |
1814 | }; |
1815 | |
1816 | diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c |
1817 | index 66b0b26a1381..cfd49eca67aa 100644 |
1818 | --- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c |
1819 | +++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c |
1820 | @@ -762,7 +762,16 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct qla_tgt_sess *sess) |
1821 | pr_debug("fc_rport domain: port_id 0x%06x\n", nacl->nport_id); |
1822 | |
1823 | node = btree_remove32(&lport->lport_fcport_map, nacl->nport_id); |
1824 | - WARN_ON(node && (node != se_nacl)); |
1825 | + if (WARN_ON(node && (node != se_nacl))) { |
1826 | + /* |
1827 | + * The nacl no longer matches what we think it should be. |
1828 | + * Most likely a new dynamic acl has been added while |
1829 | + * someone dropped the hardware lock. It clearly is a |
1830 | + * bug elsewhere, but this bit can't make things worse. |
1831 | + */ |
1832 | + btree_insert32(&lport->lport_fcport_map, nacl->nport_id, |
1833 | + node, GFP_ATOMIC); |
1834 | + } |
1835 | |
1836 | pr_debug("Removed from fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%06x\n", |
1837 | se_nacl, nacl->nport_wwnn, nacl->nport_id); |
1838 | diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c |
1839 | index 371cc66f1a0e..5266c89fc989 100644 |
1840 | --- a/drivers/spi/spi-pl022.c |
1841 | +++ b/drivers/spi/spi-pl022.c |
1842 | @@ -1080,7 +1080,7 @@ err_rxdesc: |
1843 | pl022->sgt_tx.nents, DMA_TO_DEVICE); |
1844 | err_tx_sgmap: |
1845 | dma_unmap_sg(rxchan->device->dev, pl022->sgt_rx.sgl, |
1846 | - pl022->sgt_tx.nents, DMA_FROM_DEVICE); |
1847 | + pl022->sgt_rx.nents, DMA_FROM_DEVICE); |
1848 | err_rx_sgmap: |
1849 | sg_free_table(&pl022->sgt_tx); |
1850 | err_alloc_tx_sg: |
1851 | diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c |
1852 | index 48b396fced0a..d26a2d195d21 100644 |
1853 | --- a/drivers/spi/spi-pxa2xx.c |
1854 | +++ b/drivers/spi/spi-pxa2xx.c |
1855 | @@ -1324,7 +1324,9 @@ static int pxa2xx_spi_suspend(struct device *dev) |
1856 | if (status != 0) |
1857 | return status; |
1858 | write_SSCR0(0, drv_data->ioaddr); |
1859 | - clk_disable_unprepare(ssp->clk); |
1860 | + |
1861 | + if (!pm_runtime_suspended(dev)) |
1862 | + clk_disable_unprepare(ssp->clk); |
1863 | |
1864 | return 0; |
1865 | } |
1866 | @@ -1338,7 +1340,8 @@ static int pxa2xx_spi_resume(struct device *dev) |
1867 | pxa2xx_spi_dma_resume(drv_data); |
1868 | |
1869 | /* Enable the SSP clock */ |
1870 | - clk_prepare_enable(ssp->clk); |
1871 | + if (!pm_runtime_suspended(dev)) |
1872 | + clk_prepare_enable(ssp->clk); |
1873 | |
1874 | /* Start the queue running */ |
1875 | status = spi_master_resume(drv_data->master); |
1876 | diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c |
1877 | index 6330af656a0f..bc23d66a7a1e 100644 |
1878 | --- a/drivers/staging/iio/impedance-analyzer/ad5933.c |
1879 | +++ b/drivers/staging/iio/impedance-analyzer/ad5933.c |
1880 | @@ -115,6 +115,7 @@ static const struct iio_chan_spec ad5933_channels[] = { |
1881 | .channel = 0, |
1882 | .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED), |
1883 | .address = AD5933_REG_TEMP_DATA, |
1884 | + .scan_index = -1, |
1885 | .scan_type = { |
1886 | .sign = 's', |
1887 | .realbits = 14, |
1888 | @@ -124,9 +125,7 @@ static const struct iio_chan_spec ad5933_channels[] = { |
1889 | .type = IIO_VOLTAGE, |
1890 | .indexed = 1, |
1891 | .channel = 0, |
1892 | - .extend_name = "real_raw", |
1893 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | |
1894 | - BIT(IIO_CHAN_INFO_SCALE), |
1895 | + .extend_name = "real", |
1896 | .address = AD5933_REG_REAL_DATA, |
1897 | .scan_index = 0, |
1898 | .scan_type = { |
1899 | @@ -138,9 +137,7 @@ static const struct iio_chan_spec ad5933_channels[] = { |
1900 | .type = IIO_VOLTAGE, |
1901 | .indexed = 1, |
1902 | .channel = 0, |
1903 | - .extend_name = "imag_raw", |
1904 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | |
1905 | - BIT(IIO_CHAN_INFO_SCALE), |
1906 | + .extend_name = "imag", |
1907 | .address = AD5933_REG_IMAG_DATA, |
1908 | .scan_index = 1, |
1909 | .scan_type = { |
1910 | @@ -746,14 +743,14 @@ static int ad5933_probe(struct i2c_client *client, |
1911 | indio_dev->name = id->name; |
1912 | indio_dev->modes = INDIO_DIRECT_MODE; |
1913 | indio_dev->channels = ad5933_channels; |
1914 | - indio_dev->num_channels = 1; /* only register temp0_input */ |
1915 | + indio_dev->num_channels = ARRAY_SIZE(ad5933_channels); |
1916 | |
1917 | ret = ad5933_register_ring_funcs_and_init(indio_dev); |
1918 | if (ret) |
1919 | goto error_disable_reg; |
1920 | |
1921 | - /* skip temp0_input, register in0_(real|imag)_raw */ |
1922 | - ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2); |
1923 | + ret = iio_buffer_register(indio_dev, ad5933_channels, |
1924 | + ARRAY_SIZE(ad5933_channels)); |
1925 | if (ret) |
1926 | goto error_unreg_ring; |
1927 | |
1928 | diff --git a/drivers/staging/iio/meter/ade7758.h b/drivers/staging/iio/meter/ade7758.h |
1929 | index 07318203a836..e8c98cf57070 100644 |
1930 | --- a/drivers/staging/iio/meter/ade7758.h |
1931 | +++ b/drivers/staging/iio/meter/ade7758.h |
1932 | @@ -119,7 +119,6 @@ struct ade7758_state { |
1933 | u8 *tx; |
1934 | u8 *rx; |
1935 | struct mutex buf_lock; |
1936 | - const struct iio_chan_spec *ade7758_ring_channels; |
1937 | struct spi_transfer ring_xfer[4]; |
1938 | struct spi_message ring_msg; |
1939 | /* |
1940 | diff --git a/drivers/staging/iio/meter/ade7758_core.c b/drivers/staging/iio/meter/ade7758_core.c |
1941 | index 8f5bcfab3563..75d9fe6a1bc1 100644 |
1942 | --- a/drivers/staging/iio/meter/ade7758_core.c |
1943 | +++ b/drivers/staging/iio/meter/ade7758_core.c |
1944 | @@ -648,9 +648,6 @@ static const struct iio_chan_spec ade7758_channels[] = { |
1945 | .type = IIO_VOLTAGE, |
1946 | .indexed = 1, |
1947 | .channel = 0, |
1948 | - .extend_name = "raw", |
1949 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
1950 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
1951 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE), |
1952 | .scan_index = 0, |
1953 | .scan_type = { |
1954 | @@ -662,9 +659,6 @@ static const struct iio_chan_spec ade7758_channels[] = { |
1955 | .type = IIO_CURRENT, |
1956 | .indexed = 1, |
1957 | .channel = 0, |
1958 | - .extend_name = "raw", |
1959 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
1960 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
1961 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT), |
1962 | .scan_index = 1, |
1963 | .scan_type = { |
1964 | @@ -676,9 +670,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
1965 | .type = IIO_POWER, |
1966 | .indexed = 1, |
1967 | .channel = 0, |
1968 | - .extend_name = "apparent_raw", |
1969 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
1970 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
1971 | + .extend_name = "apparent", |
1972 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR), |
1973 | .scan_index = 2, |
1974 | .scan_type = { |
1975 | @@ -690,9 +682,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
1976 | .type = IIO_POWER, |
1977 | .indexed = 1, |
1978 | .channel = 0, |
1979 | - .extend_name = "active_raw", |
1980 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
1981 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
1982 | + .extend_name = "active", |
1983 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR), |
1984 | .scan_index = 3, |
1985 | .scan_type = { |
1986 | @@ -704,9 +694,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
1987 | .type = IIO_POWER, |
1988 | .indexed = 1, |
1989 | .channel = 0, |
1990 | - .extend_name = "reactive_raw", |
1991 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
1992 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
1993 | + .extend_name = "reactive", |
1994 | .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR), |
1995 | .scan_index = 4, |
1996 | .scan_type = { |
1997 | @@ -718,9 +706,6 @@ static const struct iio_chan_spec ade7758_channels[] = { |
1998 | .type = IIO_VOLTAGE, |
1999 | .indexed = 1, |
2000 | .channel = 1, |
2001 | - .extend_name = "raw", |
2002 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2003 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2004 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE), |
2005 | .scan_index = 5, |
2006 | .scan_type = { |
2007 | @@ -732,9 +717,6 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2008 | .type = IIO_CURRENT, |
2009 | .indexed = 1, |
2010 | .channel = 1, |
2011 | - .extend_name = "raw", |
2012 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2013 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2014 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT), |
2015 | .scan_index = 6, |
2016 | .scan_type = { |
2017 | @@ -746,9 +728,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2018 | .type = IIO_POWER, |
2019 | .indexed = 1, |
2020 | .channel = 1, |
2021 | - .extend_name = "apparent_raw", |
2022 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2023 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2024 | + .extend_name = "apparent", |
2025 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR), |
2026 | .scan_index = 7, |
2027 | .scan_type = { |
2028 | @@ -760,9 +740,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2029 | .type = IIO_POWER, |
2030 | .indexed = 1, |
2031 | .channel = 1, |
2032 | - .extend_name = "active_raw", |
2033 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2034 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2035 | + .extend_name = "active", |
2036 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR), |
2037 | .scan_index = 8, |
2038 | .scan_type = { |
2039 | @@ -774,9 +752,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2040 | .type = IIO_POWER, |
2041 | .indexed = 1, |
2042 | .channel = 1, |
2043 | - .extend_name = "reactive_raw", |
2044 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2045 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2046 | + .extend_name = "reactive", |
2047 | .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR), |
2048 | .scan_index = 9, |
2049 | .scan_type = { |
2050 | @@ -788,9 +764,6 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2051 | .type = IIO_VOLTAGE, |
2052 | .indexed = 1, |
2053 | .channel = 2, |
2054 | - .extend_name = "raw", |
2055 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2056 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2057 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE), |
2058 | .scan_index = 10, |
2059 | .scan_type = { |
2060 | @@ -802,9 +775,6 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2061 | .type = IIO_CURRENT, |
2062 | .indexed = 1, |
2063 | .channel = 2, |
2064 | - .extend_name = "raw", |
2065 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2066 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2067 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT), |
2068 | .scan_index = 11, |
2069 | .scan_type = { |
2070 | @@ -816,9 +786,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2071 | .type = IIO_POWER, |
2072 | .indexed = 1, |
2073 | .channel = 2, |
2074 | - .extend_name = "apparent_raw", |
2075 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2076 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2077 | + .extend_name = "apparent", |
2078 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR), |
2079 | .scan_index = 12, |
2080 | .scan_type = { |
2081 | @@ -830,9 +798,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2082 | .type = IIO_POWER, |
2083 | .indexed = 1, |
2084 | .channel = 2, |
2085 | - .extend_name = "active_raw", |
2086 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2087 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2088 | + .extend_name = "active", |
2089 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR), |
2090 | .scan_index = 13, |
2091 | .scan_type = { |
2092 | @@ -844,9 +810,7 @@ static const struct iio_chan_spec ade7758_channels[] = { |
2093 | .type = IIO_POWER, |
2094 | .indexed = 1, |
2095 | .channel = 2, |
2096 | - .extend_name = "reactive_raw", |
2097 | - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), |
2098 | - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), |
2099 | + .extend_name = "reactive", |
2100 | .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR), |
2101 | .scan_index = 14, |
2102 | .scan_type = { |
2103 | @@ -890,13 +854,14 @@ static int ade7758_probe(struct spi_device *spi) |
2104 | goto error_free_rx; |
2105 | } |
2106 | st->us = spi; |
2107 | - st->ade7758_ring_channels = &ade7758_channels[0]; |
2108 | mutex_init(&st->buf_lock); |
2109 | |
2110 | indio_dev->name = spi->dev.driver->name; |
2111 | indio_dev->dev.parent = &spi->dev; |
2112 | indio_dev->info = &ade7758_info; |
2113 | indio_dev->modes = INDIO_DIRECT_MODE; |
2114 | + indio_dev->channels = ade7758_channels; |
2115 | + indio_dev->num_channels = ARRAY_SIZE(ade7758_channels); |
2116 | |
2117 | ret = ade7758_configure_ring(indio_dev); |
2118 | if (ret) |
2119 | diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c |
2120 | index b29e2d5d9937..6a0ef97e9146 100644 |
2121 | --- a/drivers/staging/iio/meter/ade7758_ring.c |
2122 | +++ b/drivers/staging/iio/meter/ade7758_ring.c |
2123 | @@ -89,11 +89,10 @@ static irqreturn_t ade7758_trigger_handler(int irq, void *p) |
2124 | **/ |
2125 | static int ade7758_ring_preenable(struct iio_dev *indio_dev) |
2126 | { |
2127 | - struct ade7758_state *st = iio_priv(indio_dev); |
2128 | unsigned channel; |
2129 | int ret; |
2130 | |
2131 | - if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) |
2132 | + if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) |
2133 | return -EINVAL; |
2134 | |
2135 | ret = iio_sw_buffer_preenable(indio_dev); |
2136 | @@ -104,7 +103,7 @@ static int ade7758_ring_preenable(struct iio_dev *indio_dev) |
2137 | indio_dev->masklength); |
2138 | |
2139 | ade7758_write_waveform_type(&indio_dev->dev, |
2140 | - st->ade7758_ring_channels[channel].address); |
2141 | + indio_dev->channels[channel].address); |
2142 | |
2143 | return 0; |
2144 | } |
2145 | diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c |
2146 | index 68398753eb82..2be407e22eb4 100644 |
2147 | --- a/drivers/target/target_core_device.c |
2148 | +++ b/drivers/target/target_core_device.c |
2149 | @@ -1293,7 +1293,8 @@ int core_dev_add_initiator_node_lun_acl( |
2150 | * Check to see if there are any existing persistent reservation APTPL |
2151 | * pre-registrations that need to be enabled for this LUN ACL.. |
2152 | */ |
2153 | - core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, lacl); |
2154 | + core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, nacl, |
2155 | + lacl->mapped_lun); |
2156 | return 0; |
2157 | } |
2158 | |
2159 | diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c |
2160 | index 04a74938bb43..27ec6e4d1c7c 100644 |
2161 | --- a/drivers/target/target_core_pr.c |
2162 | +++ b/drivers/target/target_core_pr.c |
2163 | @@ -945,10 +945,10 @@ int core_scsi3_check_aptpl_registration( |
2164 | struct se_device *dev, |
2165 | struct se_portal_group *tpg, |
2166 | struct se_lun *lun, |
2167 | - struct se_lun_acl *lun_acl) |
2168 | + struct se_node_acl *nacl, |
2169 | + u32 mapped_lun) |
2170 | { |
2171 | - struct se_node_acl *nacl = lun_acl->se_lun_nacl; |
2172 | - struct se_dev_entry *deve = nacl->device_list[lun_acl->mapped_lun]; |
2173 | + struct se_dev_entry *deve = nacl->device_list[mapped_lun]; |
2174 | |
2175 | if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS) |
2176 | return 0; |
2177 | diff --git a/drivers/target/target_core_pr.h b/drivers/target/target_core_pr.h |
2178 | index b4a004247ab2..ea9220de1dff 100644 |
2179 | --- a/drivers/target/target_core_pr.h |
2180 | +++ b/drivers/target/target_core_pr.h |
2181 | @@ -55,7 +55,7 @@ extern int core_scsi3_alloc_aptpl_registration( |
2182 | unsigned char *, u16, u32, int, int, u8); |
2183 | extern int core_scsi3_check_aptpl_registration(struct se_device *, |
2184 | struct se_portal_group *, struct se_lun *, |
2185 | - struct se_lun_acl *); |
2186 | + struct se_node_acl *, u32); |
2187 | extern void core_scsi3_free_pr_reg_from_nacl(struct se_device *, |
2188 | struct se_node_acl *); |
2189 | extern void core_scsi3_free_all_registrations(struct se_device *); |
2190 | diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c |
2191 | index aac9d2727e3c..8572207e3d4d 100644 |
2192 | --- a/drivers/target/target_core_tpg.c |
2193 | +++ b/drivers/target/target_core_tpg.c |
2194 | @@ -40,6 +40,7 @@ |
2195 | #include <target/target_core_fabric.h> |
2196 | |
2197 | #include "target_core_internal.h" |
2198 | +#include "target_core_pr.h" |
2199 | |
2200 | extern struct se_device *g_lun0_dev; |
2201 | |
2202 | @@ -165,6 +166,13 @@ void core_tpg_add_node_to_devs( |
2203 | |
2204 | core_enable_device_list_for_node(lun, NULL, lun->unpacked_lun, |
2205 | lun_access, acl, tpg); |
2206 | + /* |
2207 | + * Check to see if there are any existing persistent reservation |
2208 | + * APTPL pre-registrations that need to be enabled for this dynamic |
2209 | + * LUN ACL now.. |
2210 | + */ |
2211 | + core_scsi3_check_aptpl_registration(dev, tpg, lun, acl, |
2212 | + lun->unpacked_lun); |
2213 | spin_lock(&tpg->tpg_lun_lock); |
2214 | } |
2215 | spin_unlock(&tpg->tpg_lun_lock); |
2216 | diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c |
2217 | index 6866d86e8663..12342695ed79 100644 |
2218 | --- a/drivers/target/target_core_transport.c |
2219 | +++ b/drivers/target/target_core_transport.c |
2220 | @@ -1788,8 +1788,7 @@ static void transport_complete_qf(struct se_cmd *cmd) |
2221 | |
2222 | if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) { |
2223 | ret = cmd->se_tfo->queue_status(cmd); |
2224 | - if (ret) |
2225 | - goto out; |
2226 | + goto out; |
2227 | } |
2228 | |
2229 | switch (cmd->data_direction) { |
2230 | diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c |
2231 | index 0f1cc2c8c22a..1fabb22ae615 100644 |
2232 | --- a/drivers/tty/serial/serial_core.c |
2233 | +++ b/drivers/tty/serial/serial_core.c |
2234 | @@ -359,7 +359,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios, |
2235 | * The spd_hi, spd_vhi, spd_shi, spd_warp kludge... |
2236 | * Die! Die! Die! |
2237 | */ |
2238 | - if (baud == 38400) |
2239 | + if (try == 0 && baud == 38400) |
2240 | baud = altbaud; |
2241 | |
2242 | /* |
2243 | diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c |
2244 | index 3723c0ebb316..d35afccdb6c9 100644 |
2245 | --- a/drivers/tty/tty_io.c |
2246 | +++ b/drivers/tty/tty_io.c |
2247 | @@ -1698,6 +1698,7 @@ int tty_release(struct inode *inode, struct file *filp) |
2248 | int pty_master, tty_closing, o_tty_closing, do_sleep; |
2249 | int idx; |
2250 | char buf[64]; |
2251 | + long timeout = 0; |
2252 | |
2253 | if (tty_paranoia_check(tty, inode, __func__)) |
2254 | return 0; |
2255 | @@ -1782,7 +1783,11 @@ int tty_release(struct inode *inode, struct file *filp) |
2256 | __func__, tty_name(tty, buf)); |
2257 | tty_unlock_pair(tty, o_tty); |
2258 | mutex_unlock(&tty_mutex); |
2259 | - schedule(); |
2260 | + schedule_timeout_killable(timeout); |
2261 | + if (timeout < 120 * HZ) |
2262 | + timeout = 2 * timeout + 1; |
2263 | + else |
2264 | + timeout = MAX_SCHEDULE_TIMEOUT; |
2265 | } |
2266 | |
2267 | /* |
2268 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
2269 | index fbf3f11aed2c..1e71f918eb9f 100644 |
2270 | --- a/drivers/usb/class/cdc-acm.c |
2271 | +++ b/drivers/usb/class/cdc-acm.c |
2272 | @@ -883,11 +883,12 @@ static void acm_tty_set_termios(struct tty_struct *tty, |
2273 | /* FIXME: Needs to clear unsupported bits in the termios */ |
2274 | acm->clocal = ((termios->c_cflag & CLOCAL) != 0); |
2275 | |
2276 | - if (!newline.dwDTERate) { |
2277 | + if (C_BAUD(tty) == B0) { |
2278 | newline.dwDTERate = acm->line.dwDTERate; |
2279 | newctrl &= ~ACM_CTRL_DTR; |
2280 | - } else |
2281 | + } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) { |
2282 | newctrl |= ACM_CTRL_DTR; |
2283 | + } |
2284 | |
2285 | if (newctrl != acm->ctrlout) |
2286 | acm_set_control(acm, acm->ctrlout = newctrl); |
2287 | @@ -1588,6 +1589,7 @@ static const struct usb_device_id acm_ids[] = { |
2288 | { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ |
2289 | .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ |
2290 | }, |
2291 | + { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ |
2292 | { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ |
2293 | }, |
2294 | /* Motorola H24 HSPA module: */ |
2295 | diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c |
2296 | index d53547d2e4c7..f6e5ceb03afb 100644 |
2297 | --- a/drivers/usb/core/hcd.c |
2298 | +++ b/drivers/usb/core/hcd.c |
2299 | @@ -1947,6 +1947,8 @@ int usb_alloc_streams(struct usb_interface *interface, |
2300 | return -EINVAL; |
2301 | if (dev->speed != USB_SPEED_SUPER) |
2302 | return -EINVAL; |
2303 | + if (dev->state < USB_STATE_CONFIGURED) |
2304 | + return -ENODEV; |
2305 | |
2306 | /* Streams only apply to bulk endpoints. */ |
2307 | for (i = 0; i < num_eps; i++) |
2308 | diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c |
2309 | index 3cea676ba901..6cd418f6ac07 100644 |
2310 | --- a/drivers/usb/dwc3/ep0.c |
2311 | +++ b/drivers/usb/dwc3/ep0.c |
2312 | @@ -270,7 +270,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) |
2313 | |
2314 | /* stall is always issued on EP0 */ |
2315 | dep = dwc->eps[0]; |
2316 | - __dwc3_gadget_ep_set_halt(dep, 1); |
2317 | + __dwc3_gadget_ep_set_halt(dep, 1, false); |
2318 | dep->flags = DWC3_EP_ENABLED; |
2319 | dwc->delayed_status = false; |
2320 | |
2321 | @@ -480,7 +480,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc, |
2322 | return -EINVAL; |
2323 | if (set == 0 && (dep->flags & DWC3_EP_WEDGE)) |
2324 | break; |
2325 | - ret = __dwc3_gadget_ep_set_halt(dep, set); |
2326 | + ret = __dwc3_gadget_ep_set_halt(dep, set, true); |
2327 | if (ret) |
2328 | return -EINVAL; |
2329 | break; |
2330 | diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c |
2331 | index d868b62c1a16..8f8e75e392de 100644 |
2332 | --- a/drivers/usb/dwc3/gadget.c |
2333 | +++ b/drivers/usb/dwc3/gadget.c |
2334 | @@ -550,12 +550,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, |
2335 | if (!usb_endpoint_xfer_isoc(desc)) |
2336 | return 0; |
2337 | |
2338 | - memset(&trb_link, 0, sizeof(trb_link)); |
2339 | - |
2340 | /* Link TRB for ISOC. The HWO bit is never reset */ |
2341 | trb_st_hw = &dep->trb_pool[0]; |
2342 | |
2343 | trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1]; |
2344 | + memset(trb_link, 0, sizeof(*trb_link)); |
2345 | |
2346 | trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); |
2347 | trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); |
2348 | @@ -606,7 +605,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) |
2349 | |
2350 | /* make sure HW endpoint isn't stalled */ |
2351 | if (dep->flags & DWC3_EP_STALL) |
2352 | - __dwc3_gadget_ep_set_halt(dep, 0); |
2353 | + __dwc3_gadget_ep_set_halt(dep, 0, false); |
2354 | |
2355 | reg = dwc3_readl(dwc->regs, DWC3_DALEPENA); |
2356 | reg &= ~DWC3_DALEPENA_EP(dep->number); |
2357 | @@ -1206,7 +1205,7 @@ out0: |
2358 | return ret; |
2359 | } |
2360 | |
2361 | -int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) |
2362 | +int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) |
2363 | { |
2364 | struct dwc3_gadget_ep_cmd_params params; |
2365 | struct dwc3 *dwc = dep->dwc; |
2366 | @@ -1215,6 +1214,14 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) |
2367 | memset(¶ms, 0x00, sizeof(params)); |
2368 | |
2369 | if (value) { |
2370 | + if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) || |
2371 | + (!list_empty(&dep->req_queued) || |
2372 | + !list_empty(&dep->request_list)))) { |
2373 | + dev_dbg(dwc->dev, "%s: pending request, cannot halt\n", |
2374 | + dep->name); |
2375 | + return -EAGAIN; |
2376 | + } |
2377 | + |
2378 | ret = dwc3_send_gadget_ep_cmd(dwc, dep->number, |
2379 | DWC3_DEPCMD_SETSTALL, ¶ms); |
2380 | if (ret) |
2381 | @@ -1254,7 +1261,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value) |
2382 | goto out; |
2383 | } |
2384 | |
2385 | - ret = __dwc3_gadget_ep_set_halt(dep, value); |
2386 | + ret = __dwc3_gadget_ep_set_halt(dep, value, false); |
2387 | out: |
2388 | spin_unlock_irqrestore(&dwc->lock, flags); |
2389 | |
2390 | @@ -1274,7 +1281,7 @@ static int dwc3_gadget_ep_set_wedge(struct usb_ep *ep) |
2391 | if (dep->number == 0 || dep->number == 1) |
2392 | return dwc3_gadget_ep0_set_halt(ep, 1); |
2393 | else |
2394 | - return dwc3_gadget_ep_set_halt(ep, 1); |
2395 | + return __dwc3_gadget_ep_set_halt(dep, 1, false); |
2396 | } |
2397 | |
2398 | /* -------------------------------------------------------------------------- */ |
2399 | diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h |
2400 | index 99e6d7248820..b3f25c302e35 100644 |
2401 | --- a/drivers/usb/dwc3/gadget.h |
2402 | +++ b/drivers/usb/dwc3/gadget.h |
2403 | @@ -114,7 +114,7 @@ void dwc3_ep0_out_start(struct dwc3 *dwc); |
2404 | int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value); |
2405 | int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, |
2406 | gfp_t gfp_flags); |
2407 | -int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value); |
2408 | +int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol); |
2409 | int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, |
2410 | unsigned cmd, struct dwc3_gadget_ep_cmd_params *params); |
2411 | int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param); |
2412 | diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c |
2413 | index ab1065afbbd0..3384486c2884 100644 |
2414 | --- a/drivers/usb/gadget/f_acm.c |
2415 | +++ b/drivers/usb/gadget/f_acm.c |
2416 | @@ -430,11 +430,12 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) |
2417 | if (acm->notify->driver_data) { |
2418 | VDBG(cdev, "reset acm control interface %d\n", intf); |
2419 | usb_ep_disable(acm->notify); |
2420 | - } else { |
2421 | - VDBG(cdev, "init acm ctrl interface %d\n", intf); |
2422 | + } |
2423 | + |
2424 | + if (!acm->notify->desc) |
2425 | if (config_ep_by_speed(cdev->gadget, f, acm->notify)) |
2426 | return -EINVAL; |
2427 | - } |
2428 | + |
2429 | usb_ep_enable(acm->notify); |
2430 | acm->notify->driver_data = acm; |
2431 | |
2432 | diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c |
2433 | index 5514822114a5..817a26cbfab1 100644 |
2434 | --- a/drivers/usb/gadget/udc-core.c |
2435 | +++ b/drivers/usb/gadget/udc-core.c |
2436 | @@ -439,6 +439,11 @@ static ssize_t usb_udc_softconn_store(struct device *dev, |
2437 | { |
2438 | struct usb_udc *udc = container_of(dev, struct usb_udc, dev); |
2439 | |
2440 | + if (!udc->driver) { |
2441 | + dev_err(dev, "soft-connect without a gadget driver\n"); |
2442 | + return -EOPNOTSUPP; |
2443 | + } |
2444 | + |
2445 | if (sysfs_streq(buf, "connect")) { |
2446 | usb_gadget_udc_start(udc->gadget, udc->driver); |
2447 | usb_gadget_connect(udc->gadget); |
2448 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c |
2449 | index b22a4bc308e2..e9183eda39e0 100644 |
2450 | --- a/drivers/usb/serial/cp210x.c |
2451 | +++ b/drivers/usb/serial/cp210x.c |
2452 | @@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = { |
2453 | { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ |
2454 | { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ |
2455 | { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ |
2456 | + { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ |
2457 | { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ |
2458 | { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */ |
2459 | { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */ |
2460 | diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c |
2461 | index 4235693ba2f7..768c2b4722d1 100644 |
2462 | --- a/drivers/usb/serial/ftdi_sio.c |
2463 | +++ b/drivers/usb/serial/ftdi_sio.c |
2464 | @@ -148,6 +148,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = { |
2465 | * /sys/bus/usb/ftdi_sio/new_id, then send patch/report! |
2466 | */ |
2467 | static struct usb_device_id id_table_combined [] = { |
2468 | + { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) }, |
2469 | { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) }, |
2470 | { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) }, |
2471 | { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) }, |
2472 | @@ -677,6 +678,8 @@ static struct usb_device_id id_table_combined [] = { |
2473 | { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) }, |
2474 | { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) }, |
2475 | { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) }, |
2476 | + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, |
2477 | + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, |
2478 | { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, |
2479 | { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, |
2480 | { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, |
2481 | diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h |
2482 | index 8927a5c39b00..302ab9a71f06 100644 |
2483 | --- a/drivers/usb/serial/ftdi_sio_ids.h |
2484 | +++ b/drivers/usb/serial/ftdi_sio_ids.h |
2485 | @@ -30,6 +30,12 @@ |
2486 | |
2487 | /*** third-party PIDs (using FTDI_VID) ***/ |
2488 | |
2489 | +/* |
2490 | + * Certain versions of the official Windows FTDI driver reprogrammed |
2491 | + * counterfeit FTDI devices to PID 0. Support these devices anyway. |
2492 | + */ |
2493 | +#define FTDI_BRICK_PID 0x0000 |
2494 | + |
2495 | #define FTDI_LUMEL_PD12_PID 0x6002 |
2496 | |
2497 | /* |
2498 | @@ -143,8 +149,12 @@ |
2499 | * Xsens Technologies BV products (http://www.xsens.com). |
2500 | */ |
2501 | #define XSENS_VID 0x2639 |
2502 | -#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ |
2503 | +#define XSENS_AWINDA_STATION_PID 0x0101 |
2504 | +#define XSENS_AWINDA_DONGLE_PID 0x0102 |
2505 | #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ |
2506 | +#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ |
2507 | + |
2508 | +/* Xsens devices using FTDI VID */ |
2509 | #define XSENS_CONVERTER_0_PID 0xD388 /* Xsens USB converter */ |
2510 | #define XSENS_CONVERTER_1_PID 0xD389 /* Xsens Wireless Receiver */ |
2511 | #define XSENS_CONVERTER_2_PID 0xD38A |
2512 | diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c |
2513 | index 5f4b0cd0f6e9..b0eb1dfc601a 100644 |
2514 | --- a/drivers/usb/serial/opticon.c |
2515 | +++ b/drivers/usb/serial/opticon.c |
2516 | @@ -219,7 +219,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, |
2517 | |
2518 | /* The conncected devices do not have a bulk write endpoint, |
2519 | * to transmit data to de barcode device the control endpoint is used */ |
2520 | - dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO); |
2521 | + dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC); |
2522 | if (!dr) { |
2523 | dev_err(&port->dev, "out of memory\n"); |
2524 | count = -ENOMEM; |
2525 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
2526 | index e47aabe0c760..8b3484134ab0 100644 |
2527 | --- a/drivers/usb/serial/option.c |
2528 | +++ b/drivers/usb/serial/option.c |
2529 | @@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb); |
2530 | #define TELIT_PRODUCT_DE910_DUAL 0x1010 |
2531 | #define TELIT_PRODUCT_UE910_V2 0x1012 |
2532 | #define TELIT_PRODUCT_LE920 0x1200 |
2533 | +#define TELIT_PRODUCT_LE910 0x1201 |
2534 | |
2535 | /* ZTE PRODUCTS */ |
2536 | #define ZTE_VENDOR_ID 0x19d2 |
2537 | @@ -361,6 +362,7 @@ static void option_instat_callback(struct urb *urb); |
2538 | |
2539 | /* Haier products */ |
2540 | #define HAIER_VENDOR_ID 0x201e |
2541 | +#define HAIER_PRODUCT_CE81B 0x10f8 |
2542 | #define HAIER_PRODUCT_CE100 0x2009 |
2543 | |
2544 | /* Cinterion (formerly Siemens) products */ |
2545 | @@ -588,6 +590,11 @@ static const struct option_blacklist_info zte_1255_blacklist = { |
2546 | .reserved = BIT(3) | BIT(4), |
2547 | }; |
2548 | |
2549 | +static const struct option_blacklist_info telit_le910_blacklist = { |
2550 | + .sendsetup = BIT(0), |
2551 | + .reserved = BIT(1) | BIT(2), |
2552 | +}; |
2553 | + |
2554 | static const struct option_blacklist_info telit_le920_blacklist = { |
2555 | .sendsetup = BIT(0), |
2556 | .reserved = BIT(1) | BIT(5), |
2557 | @@ -1137,6 +1144,8 @@ static const struct usb_device_id option_ids[] = { |
2558 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, |
2559 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, |
2560 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, |
2561 | + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), |
2562 | + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, |
2563 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), |
2564 | .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, |
2565 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ |
2566 | @@ -1612,6 +1621,7 @@ static const struct usb_device_id option_ids[] = { |
2567 | { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, |
2568 | { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, |
2569 | { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, |
2570 | + { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) }, |
2571 | /* Pirelli */ |
2572 | { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) }, |
2573 | { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2, 0xff) }, |
2574 | diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c |
2575 | index 22c7d4360fa2..b1d815eb6d0b 100644 |
2576 | --- a/drivers/usb/storage/transport.c |
2577 | +++ b/drivers/usb/storage/transport.c |
2578 | @@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) |
2579 | */ |
2580 | if (result == USB_STOR_XFER_LONG) |
2581 | fake_sense = 1; |
2582 | + |
2583 | + /* |
2584 | + * Sometimes a device will mistakenly skip the data phase |
2585 | + * and go directly to the status phase without sending a |
2586 | + * zero-length packet. If we get a 13-byte response here, |
2587 | + * check whether it really is a CSW. |
2588 | + */ |
2589 | + if (result == USB_STOR_XFER_SHORT && |
2590 | + srb->sc_data_direction == DMA_FROM_DEVICE && |
2591 | + transfer_length - scsi_get_resid(srb) == |
2592 | + US_BULK_CS_WRAP_LEN) { |
2593 | + struct scatterlist *sg = NULL; |
2594 | + unsigned int offset = 0; |
2595 | + |
2596 | + if (usb_stor_access_xfer_buf((unsigned char *) bcs, |
2597 | + US_BULK_CS_WRAP_LEN, srb, &sg, |
2598 | + &offset, FROM_XFER_BUF) == |
2599 | + US_BULK_CS_WRAP_LEN && |
2600 | + bcs->Signature == |
2601 | + cpu_to_le32(US_BULK_CS_SIGN)) { |
2602 | + usb_stor_dbg(us, "Device skipped data phase\n"); |
2603 | + scsi_set_resid(srb, transfer_length); |
2604 | + goto skipped_data_phase; |
2605 | + } |
2606 | + } |
2607 | } |
2608 | |
2609 | /* See flow chart on pg 15 of the Bulk Only Transport spec for |
2610 | @@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) |
2611 | if (result != USB_STOR_XFER_GOOD) |
2612 | return USB_STOR_TRANSPORT_ERROR; |
2613 | |
2614 | + skipped_data_phase: |
2615 | /* check bulk status */ |
2616 | residue = le32_to_cpu(bcs->Residue); |
2617 | usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n", |
2618 | diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c |
2619 | index 61b182bf32a2..dbfe4eecf12e 100644 |
2620 | --- a/drivers/video/console/bitblit.c |
2621 | +++ b/drivers/video/console/bitblit.c |
2622 | @@ -205,7 +205,6 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, |
2623 | static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, |
2624 | int bottom_only) |
2625 | { |
2626 | - int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; |
2627 | unsigned int cw = vc->vc_font.width; |
2628 | unsigned int ch = vc->vc_font.height; |
2629 | unsigned int rw = info->var.xres - (vc->vc_cols*cw); |
2630 | @@ -214,7 +213,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, |
2631 | unsigned int bs = info->var.yres - bh; |
2632 | struct fb_fillrect region; |
2633 | |
2634 | - region.color = attr_bgcol_ec(bgshift, vc, info); |
2635 | + region.color = 0; |
2636 | region.rop = ROP_COPY; |
2637 | |
2638 | if (rw && !bottom_only) { |
2639 | diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c |
2640 | index 41b32ae23dac..5a3cbf6dff4d 100644 |
2641 | --- a/drivers/video/console/fbcon_ccw.c |
2642 | +++ b/drivers/video/console/fbcon_ccw.c |
2643 | @@ -197,9 +197,8 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, |
2644 | unsigned int bh = info->var.xres - (vc->vc_rows*ch); |
2645 | unsigned int bs = vc->vc_rows*ch; |
2646 | struct fb_fillrect region; |
2647 | - int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; |
2648 | |
2649 | - region.color = attr_bgcol_ec(bgshift,vc,info); |
2650 | + region.color = 0; |
2651 | region.rop = ROP_COPY; |
2652 | |
2653 | if (rw && !bottom_only) { |
2654 | diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c |
2655 | index a93670ef7f89..e7ee44db4e98 100644 |
2656 | --- a/drivers/video/console/fbcon_cw.c |
2657 | +++ b/drivers/video/console/fbcon_cw.c |
2658 | @@ -180,9 +180,8 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, |
2659 | unsigned int bh = info->var.xres - (vc->vc_rows*ch); |
2660 | unsigned int rs = info->var.yres - rw; |
2661 | struct fb_fillrect region; |
2662 | - int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; |
2663 | |
2664 | - region.color = attr_bgcol_ec(bgshift,vc,info); |
2665 | + region.color = 0; |
2666 | region.rop = ROP_COPY; |
2667 | |
2668 | if (rw && !bottom_only) { |
2669 | diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c |
2670 | index ff0872c0498b..19e3714abfe8 100644 |
2671 | --- a/drivers/video/console/fbcon_ud.c |
2672 | +++ b/drivers/video/console/fbcon_ud.c |
2673 | @@ -227,9 +227,8 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, |
2674 | unsigned int rw = info->var.xres - (vc->vc_cols*cw); |
2675 | unsigned int bh = info->var.yres - (vc->vc_rows*ch); |
2676 | struct fb_fillrect region; |
2677 | - int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; |
2678 | |
2679 | - region.color = attr_bgcol_ec(bgshift,vc,info); |
2680 | + region.color = 0; |
2681 | region.rop = ROP_COPY; |
2682 | |
2683 | if (rw && !bottom_only) { |
2684 | diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c |
2685 | index a7ce73029f59..933241a6ab10 100644 |
2686 | --- a/drivers/virtio/virtio_pci.c |
2687 | +++ b/drivers/virtio/virtio_pci.c |
2688 | @@ -791,6 +791,7 @@ static int virtio_pci_restore(struct device *dev) |
2689 | struct pci_dev *pci_dev = to_pci_dev(dev); |
2690 | struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev); |
2691 | struct virtio_driver *drv; |
2692 | + unsigned status = 0; |
2693 | int ret; |
2694 | |
2695 | drv = container_of(vp_dev->vdev.dev.driver, |
2696 | @@ -801,14 +802,40 @@ static int virtio_pci_restore(struct device *dev) |
2697 | return ret; |
2698 | |
2699 | pci_set_master(pci_dev); |
2700 | + /* We always start by resetting the device, in case a previous |
2701 | + * driver messed it up. */ |
2702 | + vp_reset(&vp_dev->vdev); |
2703 | + |
2704 | + /* Acknowledge that we've seen the device. */ |
2705 | + status |= VIRTIO_CONFIG_S_ACKNOWLEDGE; |
2706 | + vp_set_status(&vp_dev->vdev, status); |
2707 | + |
2708 | + /* Maybe driver failed before freeze. |
2709 | + * Restore the failed status, for debugging. */ |
2710 | + status |= vp_dev->saved_status & VIRTIO_CONFIG_S_FAILED; |
2711 | + vp_set_status(&vp_dev->vdev, status); |
2712 | + |
2713 | + if (!drv) |
2714 | + return 0; |
2715 | + |
2716 | + /* We have a driver! */ |
2717 | + status |= VIRTIO_CONFIG_S_DRIVER; |
2718 | + vp_set_status(&vp_dev->vdev, status); |
2719 | + |
2720 | vp_finalize_features(&vp_dev->vdev); |
2721 | |
2722 | - if (drv && drv->restore) |
2723 | + if (drv->restore) { |
2724 | ret = drv->restore(&vp_dev->vdev); |
2725 | + if (ret) { |
2726 | + status |= VIRTIO_CONFIG_S_FAILED; |
2727 | + vp_set_status(&vp_dev->vdev, status); |
2728 | + return ret; |
2729 | + } |
2730 | + } |
2731 | |
2732 | /* Finally, tell the device we're all set */ |
2733 | - if (!ret) |
2734 | - vp_set_status(&vp_dev->vdev, vp_dev->saved_status); |
2735 | + status |= VIRTIO_CONFIG_S_DRIVER_OK; |
2736 | + vp_set_status(&vp_dev->vdev, status); |
2737 | |
2738 | return ret; |
2739 | } |
2740 | diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c |
2741 | index 3af77aa051d2..e4bcfec7787e 100644 |
2742 | --- a/fs/btrfs/file-item.c |
2743 | +++ b/fs/btrfs/file-item.c |
2744 | @@ -403,7 +403,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end, |
2745 | ret = 0; |
2746 | fail: |
2747 | while (ret < 0 && !list_empty(&tmplist)) { |
2748 | - sums = list_entry(&tmplist, struct btrfs_ordered_sum, list); |
2749 | + sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list); |
2750 | list_del(&sums->list); |
2751 | kfree(sums); |
2752 | } |
2753 | diff --git a/fs/buffer.c b/fs/buffer.c |
2754 | index 10fca21ee8aa..83fedaa53b55 100644 |
2755 | --- a/fs/buffer.c |
2756 | +++ b/fs/buffer.c |
2757 | @@ -2018,6 +2018,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, |
2758 | struct page *page, void *fsdata) |
2759 | { |
2760 | struct inode *inode = mapping->host; |
2761 | + loff_t old_size = inode->i_size; |
2762 | int i_size_changed = 0; |
2763 | |
2764 | copied = block_write_end(file, mapping, pos, len, copied, page, fsdata); |
2765 | @@ -2037,6 +2038,8 @@ int generic_write_end(struct file *file, struct address_space *mapping, |
2766 | unlock_page(page); |
2767 | page_cache_release(page); |
2768 | |
2769 | + if (old_size < pos) |
2770 | + pagecache_isize_extended(inode, old_size, pos); |
2771 | /* |
2772 | * Don't mark the inode dirty under page lock. First, it unnecessarily |
2773 | * makes the holding time of page lock longer. Second, it forces lock |
2774 | @@ -2254,6 +2257,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping, |
2775 | err = 0; |
2776 | |
2777 | balance_dirty_pages_ratelimited(mapping); |
2778 | + |
2779 | + if (unlikely(fatal_signal_pending(current))) { |
2780 | + err = -EINTR; |
2781 | + goto out; |
2782 | + } |
2783 | } |
2784 | |
2785 | /* page covers the boundary, find the boundary offset */ |
2786 | diff --git a/fs/ext3/super.c b/fs/ext3/super.c |
2787 | index 6356665a74bb..882d4bdfd428 100644 |
2788 | --- a/fs/ext3/super.c |
2789 | +++ b/fs/ext3/super.c |
2790 | @@ -1300,13 +1300,6 @@ set_qf_format: |
2791 | "not specified."); |
2792 | return 0; |
2793 | } |
2794 | - } else { |
2795 | - if (sbi->s_jquota_fmt) { |
2796 | - ext3_msg(sb, KERN_ERR, "error: journaled quota format " |
2797 | - "specified with no journaling " |
2798 | - "enabled."); |
2799 | - return 0; |
2800 | - } |
2801 | } |
2802 | #endif |
2803 | return 1; |
2804 | diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h |
2805 | index 790b14c5f262..e4c4ac07cc32 100644 |
2806 | --- a/fs/ext4/ext4.h |
2807 | +++ b/fs/ext4/ext4.h |
2808 | @@ -2088,6 +2088,7 @@ int do_journal_get_write_access(handle_t *handle, |
2809 | #define CONVERT_INLINE_DATA 2 |
2810 | |
2811 | extern struct inode *ext4_iget(struct super_block *, unsigned long); |
2812 | +extern struct inode *ext4_iget_normal(struct super_block *, unsigned long); |
2813 | extern int ext4_write_inode(struct inode *, struct writeback_control *); |
2814 | extern int ext4_setattr(struct dentry *, struct iattr *); |
2815 | extern int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry, |
2816 | @@ -2260,8 +2261,8 @@ extern int ext4_register_li_request(struct super_block *sb, |
2817 | static inline int ext4_has_group_desc_csum(struct super_block *sb) |
2818 | { |
2819 | return EXT4_HAS_RO_COMPAT_FEATURE(sb, |
2820 | - EXT4_FEATURE_RO_COMPAT_GDT_CSUM | |
2821 | - EXT4_FEATURE_RO_COMPAT_METADATA_CSUM); |
2822 | + EXT4_FEATURE_RO_COMPAT_GDT_CSUM) || |
2823 | + (EXT4_SB(sb)->s_chksum_driver != NULL); |
2824 | } |
2825 | |
2826 | static inline ext4_fsblk_t ext4_blocks_count(struct ext4_super_block *es) |
2827 | diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c |
2828 | index 1ecd3a8c2444..4d4718cf25ab 100644 |
2829 | --- a/fs/ext4/ialloc.c |
2830 | +++ b/fs/ext4/ialloc.c |
2831 | @@ -793,6 +793,10 @@ got: |
2832 | struct buffer_head *block_bitmap_bh; |
2833 | |
2834 | block_bitmap_bh = ext4_read_block_bitmap(sb, group); |
2835 | + if (!block_bitmap_bh) { |
2836 | + err = -EIO; |
2837 | + goto out; |
2838 | + } |
2839 | BUFFER_TRACE(block_bitmap_bh, "get block bitmap access"); |
2840 | err = ext4_journal_get_write_access(handle, block_bitmap_bh); |
2841 | if (err) { |
2842 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c |
2843 | index f9e11df768d5..e48bd5a1814b 100644 |
2844 | --- a/fs/ext4/inode.c |
2845 | +++ b/fs/ext4/inode.c |
2846 | @@ -2647,6 +2647,20 @@ static int ext4_nonda_switch(struct super_block *sb) |
2847 | return 0; |
2848 | } |
2849 | |
2850 | +/* We always reserve for an inode update; the superblock could be there too */ |
2851 | +static int ext4_da_write_credits(struct inode *inode, loff_t pos, unsigned len) |
2852 | +{ |
2853 | + if (likely(EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, |
2854 | + EXT4_FEATURE_RO_COMPAT_LARGE_FILE))) |
2855 | + return 1; |
2856 | + |
2857 | + if (pos + len <= 0x7fffffffULL) |
2858 | + return 1; |
2859 | + |
2860 | + /* We might need to update the superblock to set LARGE_FILE */ |
2861 | + return 2; |
2862 | +} |
2863 | + |
2864 | static int ext4_da_write_begin(struct file *file, struct address_space *mapping, |
2865 | loff_t pos, unsigned len, unsigned flags, |
2866 | struct page **pagep, void **fsdata) |
2867 | @@ -2697,7 +2711,8 @@ retry_grab: |
2868 | * of file which has an already mapped buffer. |
2869 | */ |
2870 | retry_journal: |
2871 | - handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, 1); |
2872 | + handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, |
2873 | + ext4_da_write_credits(inode, pos, len)); |
2874 | if (IS_ERR(handle)) { |
2875 | page_cache_release(page); |
2876 | return PTR_ERR(handle); |
2877 | @@ -4351,6 +4366,13 @@ bad_inode: |
2878 | return ERR_PTR(ret); |
2879 | } |
2880 | |
2881 | +struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino) |
2882 | +{ |
2883 | + if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) |
2884 | + return ERR_PTR(-EIO); |
2885 | + return ext4_iget(sb, ino); |
2886 | +} |
2887 | + |
2888 | static int ext4_inode_blocks_set(handle_t *handle, |
2889 | struct ext4_inode *raw_inode, |
2890 | struct ext4_inode_info *ei) |
2891 | diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c |
2892 | index 42624a995b00..d4fd81c44f55 100644 |
2893 | --- a/fs/ext4/ioctl.c |
2894 | +++ b/fs/ext4/ioctl.c |
2895 | @@ -549,9 +549,17 @@ group_add_out: |
2896 | } |
2897 | |
2898 | case EXT4_IOC_SWAP_BOOT: |
2899 | + { |
2900 | + int err; |
2901 | if (!(filp->f_mode & FMODE_WRITE)) |
2902 | return -EBADF; |
2903 | - return swap_inode_boot_loader(sb, inode); |
2904 | + err = mnt_want_write_file(filp); |
2905 | + if (err) |
2906 | + return err; |
2907 | + err = swap_inode_boot_loader(sb, inode); |
2908 | + mnt_drop_write_file(filp); |
2909 | + return err; |
2910 | + } |
2911 | |
2912 | case EXT4_IOC_RESIZE_FS: { |
2913 | ext4_fsblk_t n_blocks_count; |
2914 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c |
2915 | index ab2f6dc44b3a..f1312173fa90 100644 |
2916 | --- a/fs/ext4/namei.c |
2917 | +++ b/fs/ext4/namei.c |
2918 | @@ -1430,7 +1430,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi |
2919 | dentry->d_name.name); |
2920 | return ERR_PTR(-EIO); |
2921 | } |
2922 | - inode = ext4_iget(dir->i_sb, ino); |
2923 | + inode = ext4_iget_normal(dir->i_sb, ino); |
2924 | if (inode == ERR_PTR(-ESTALE)) { |
2925 | EXT4_ERROR_INODE(dir, |
2926 | "deleted inode referenced: %u", |
2927 | @@ -1461,7 +1461,7 @@ struct dentry *ext4_get_parent(struct dentry *child) |
2928 | return ERR_PTR(-EIO); |
2929 | } |
2930 | |
2931 | - return d_obtain_alias(ext4_iget(child->d_inode->i_sb, ino)); |
2932 | + return d_obtain_alias(ext4_iget_normal(child->d_inode->i_sb, ino)); |
2933 | } |
2934 | |
2935 | /* |
2936 | diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c |
2937 | index c503850a61a8..a69bd74ed390 100644 |
2938 | --- a/fs/ext4/resize.c |
2939 | +++ b/fs/ext4/resize.c |
2940 | @@ -1066,7 +1066,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data, |
2941 | break; |
2942 | |
2943 | if (meta_bg == 0) |
2944 | - backup_block = group * bpg + blk_off; |
2945 | + backup_block = ((ext4_fsblk_t)group) * bpg + blk_off; |
2946 | else |
2947 | backup_block = (ext4_group_first_block_no(sb, group) + |
2948 | ext4_bg_has_super(sb, group)); |
2949 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c |
2950 | index 1fc14f7a08b2..21a0b43a7d31 100644 |
2951 | --- a/fs/ext4/super.c |
2952 | +++ b/fs/ext4/super.c |
2953 | @@ -964,7 +964,7 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb, |
2954 | * Currently we don't know the generation for parent directory, so |
2955 | * a generation of 0 means "accept any" |
2956 | */ |
2957 | - inode = ext4_iget(sb, ino); |
2958 | + inode = ext4_iget_normal(sb, ino); |
2959 | if (IS_ERR(inode)) |
2960 | return ERR_CAST(inode); |
2961 | if (generation && inode->i_generation != generation) { |
2962 | @@ -1632,13 +1632,6 @@ static int parse_options(char *options, struct super_block *sb, |
2963 | "not specified"); |
2964 | return 0; |
2965 | } |
2966 | - } else { |
2967 | - if (sbi->s_jquota_fmt) { |
2968 | - ext4_msg(sb, KERN_ERR, "journaled quota format " |
2969 | - "specified with no journaling " |
2970 | - "enabled"); |
2971 | - return 0; |
2972 | - } |
2973 | } |
2974 | #endif |
2975 | if (test_opt(sb, DIOREAD_NOLOCK)) { |
2976 | @@ -1957,6 +1950,10 @@ static __le16 ext4_group_desc_csum(struct ext4_sb_info *sbi, __u32 block_group, |
2977 | } |
2978 | |
2979 | /* old crc16 code */ |
2980 | + if (!(sbi->s_es->s_feature_ro_compat & |
2981 | + cpu_to_le32(EXT4_FEATURE_RO_COMPAT_GDT_CSUM))) |
2982 | + return 0; |
2983 | + |
2984 | offset = offsetof(struct ext4_group_desc, bg_checksum); |
2985 | |
2986 | crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid)); |
2987 | diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c |
2988 | index 298e9c8da364..a20816e7eb3a 100644 |
2989 | --- a/fs/ext4/xattr.c |
2990 | +++ b/fs/ext4/xattr.c |
2991 | @@ -189,14 +189,28 @@ ext4_listxattr(struct dentry *dentry, char *buffer, size_t size) |
2992 | } |
2993 | |
2994 | static int |
2995 | -ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end) |
2996 | +ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end, |
2997 | + void *value_start) |
2998 | { |
2999 | - while (!IS_LAST_ENTRY(entry)) { |
3000 | - struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(entry); |
3001 | + struct ext4_xattr_entry *e = entry; |
3002 | + |
3003 | + while (!IS_LAST_ENTRY(e)) { |
3004 | + struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e); |
3005 | if ((void *)next >= end) |
3006 | return -EIO; |
3007 | - entry = next; |
3008 | + e = next; |
3009 | } |
3010 | + |
3011 | + while (!IS_LAST_ENTRY(entry)) { |
3012 | + if (entry->e_value_size != 0 && |
3013 | + (value_start + le16_to_cpu(entry->e_value_offs) < |
3014 | + (void *)e + sizeof(__u32) || |
3015 | + value_start + le16_to_cpu(entry->e_value_offs) + |
3016 | + le32_to_cpu(entry->e_value_size) > end)) |
3017 | + return -EIO; |
3018 | + entry = EXT4_XATTR_NEXT(entry); |
3019 | + } |
3020 | + |
3021 | return 0; |
3022 | } |
3023 | |
3024 | @@ -213,7 +227,8 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh) |
3025 | return -EIO; |
3026 | if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh))) |
3027 | return -EIO; |
3028 | - error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size); |
3029 | + error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size, |
3030 | + bh->b_data); |
3031 | if (!error) |
3032 | set_buffer_verified(bh); |
3033 | return error; |
3034 | @@ -329,7 +344,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, |
3035 | header = IHDR(inode, raw_inode); |
3036 | entry = IFIRST(header); |
3037 | end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; |
3038 | - error = ext4_xattr_check_names(entry, end); |
3039 | + error = ext4_xattr_check_names(entry, end, entry); |
3040 | if (error) |
3041 | goto cleanup; |
3042 | error = ext4_xattr_find_entry(&entry, name_index, name, |
3043 | @@ -457,7 +472,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size) |
3044 | raw_inode = ext4_raw_inode(&iloc); |
3045 | header = IHDR(inode, raw_inode); |
3046 | end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; |
3047 | - error = ext4_xattr_check_names(IFIRST(header), end); |
3048 | + error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header)); |
3049 | if (error) |
3050 | goto cleanup; |
3051 | error = ext4_xattr_list_entries(dentry, IFIRST(header), |
3052 | @@ -972,7 +987,8 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, |
3053 | is->s.here = is->s.first; |
3054 | is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; |
3055 | if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) { |
3056 | - error = ext4_xattr_check_names(IFIRST(header), is->s.end); |
3057 | + error = ext4_xattr_check_names(IFIRST(header), is->s.end, |
3058 | + IFIRST(header)); |
3059 | if (error) |
3060 | return error; |
3061 | /* Find the named attribute. */ |
3062 | diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c |
3063 | index 3bacc1909ddb..6e2fb5cbacde 100644 |
3064 | --- a/fs/jbd2/recovery.c |
3065 | +++ b/fs/jbd2/recovery.c |
3066 | @@ -522,6 +522,7 @@ static int do_one_pass(journal_t *journal, |
3067 | !jbd2_descr_block_csum_verify(journal, |
3068 | bh->b_data)) { |
3069 | err = -EIO; |
3070 | + brelse(bh); |
3071 | goto failed; |
3072 | } |
3073 | |
3074 | diff --git a/fs/jffs2/jffs2_fs_sb.h b/fs/jffs2/jffs2_fs_sb.h |
3075 | index 413ef89c2d1b..046fee8b6e9b 100644 |
3076 | --- a/fs/jffs2/jffs2_fs_sb.h |
3077 | +++ b/fs/jffs2/jffs2_fs_sb.h |
3078 | @@ -134,8 +134,6 @@ struct jffs2_sb_info { |
3079 | struct rw_semaphore wbuf_sem; /* Protects the write buffer */ |
3080 | |
3081 | struct delayed_work wbuf_dwork; /* write-buffer write-out work */ |
3082 | - int wbuf_queued; /* non-zero delayed work is queued */ |
3083 | - spinlock_t wbuf_dwork_lock; /* protects wbuf_dwork and and wbuf_queued */ |
3084 | |
3085 | unsigned char *oobbuf; |
3086 | int oobavail; /* How many bytes are available for JFFS2 in OOB */ |
3087 | diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c |
3088 | index a6597d60d76d..09ed55190ee2 100644 |
3089 | --- a/fs/jffs2/wbuf.c |
3090 | +++ b/fs/jffs2/wbuf.c |
3091 | @@ -1162,10 +1162,6 @@ static void delayed_wbuf_sync(struct work_struct *work) |
3092 | struct jffs2_sb_info *c = work_to_sb(work); |
3093 | struct super_block *sb = OFNI_BS_2SFFJ(c); |
3094 | |
3095 | - spin_lock(&c->wbuf_dwork_lock); |
3096 | - c->wbuf_queued = 0; |
3097 | - spin_unlock(&c->wbuf_dwork_lock); |
3098 | - |
3099 | if (!(sb->s_flags & MS_RDONLY)) { |
3100 | jffs2_dbg(1, "%s()\n", __func__); |
3101 | jffs2_flush_wbuf_gc(c, 0); |
3102 | @@ -1180,14 +1176,9 @@ void jffs2_dirty_trigger(struct jffs2_sb_info *c) |
3103 | if (sb->s_flags & MS_RDONLY) |
3104 | return; |
3105 | |
3106 | - spin_lock(&c->wbuf_dwork_lock); |
3107 | - if (!c->wbuf_queued) { |
3108 | + delay = msecs_to_jiffies(dirty_writeback_interval * 10); |
3109 | + if (queue_delayed_work(system_long_wq, &c->wbuf_dwork, delay)) |
3110 | jffs2_dbg(1, "%s()\n", __func__); |
3111 | - delay = msecs_to_jiffies(dirty_writeback_interval * 10); |
3112 | - queue_delayed_work(system_long_wq, &c->wbuf_dwork, delay); |
3113 | - c->wbuf_queued = 1; |
3114 | - } |
3115 | - spin_unlock(&c->wbuf_dwork_lock); |
3116 | } |
3117 | |
3118 | int jffs2_nand_flash_setup(struct jffs2_sb_info *c) |
3119 | @@ -1211,7 +1202,6 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c) |
3120 | |
3121 | /* Initialise write buffer */ |
3122 | init_rwsem(&c->wbuf_sem); |
3123 | - spin_lock_init(&c->wbuf_dwork_lock); |
3124 | INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); |
3125 | c->wbuf_pagesize = c->mtd->writesize; |
3126 | c->wbuf_ofs = 0xFFFFFFFF; |
3127 | @@ -1251,7 +1241,6 @@ int jffs2_dataflash_setup(struct jffs2_sb_info *c) { |
3128 | |
3129 | /* Initialize write buffer */ |
3130 | init_rwsem(&c->wbuf_sem); |
3131 | - spin_lock_init(&c->wbuf_dwork_lock); |
3132 | INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); |
3133 | c->wbuf_pagesize = c->mtd->erasesize; |
3134 | |
3135 | @@ -1311,7 +1300,6 @@ int jffs2_nor_wbuf_flash_setup(struct jffs2_sb_info *c) { |
3136 | |
3137 | /* Initialize write buffer */ |
3138 | init_rwsem(&c->wbuf_sem); |
3139 | - spin_lock_init(&c->wbuf_dwork_lock); |
3140 | INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); |
3141 | |
3142 | c->wbuf_pagesize = c->mtd->writesize; |
3143 | @@ -1346,7 +1334,6 @@ int jffs2_ubivol_setup(struct jffs2_sb_info *c) { |
3144 | return 0; |
3145 | |
3146 | init_rwsem(&c->wbuf_sem); |
3147 | - spin_lock_init(&c->wbuf_dwork_lock); |
3148 | INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); |
3149 | |
3150 | c->wbuf_pagesize = c->mtd->writesize; |
3151 | diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c |
3152 | index 1812f026960c..6ae664b489af 100644 |
3153 | --- a/fs/lockd/mon.c |
3154 | +++ b/fs/lockd/mon.c |
3155 | @@ -159,6 +159,12 @@ static int nsm_mon_unmon(struct nsm_handle *nsm, u32 proc, struct nsm_res *res, |
3156 | |
3157 | msg.rpc_proc = &clnt->cl_procinfo[proc]; |
3158 | status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); |
3159 | + if (status == -ECONNREFUSED) { |
3160 | + dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n", |
3161 | + status); |
3162 | + rpc_force_rebind(clnt); |
3163 | + status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); |
3164 | + } |
3165 | if (status < 0) |
3166 | dprintk("lockd: NSM upcall RPC failed, status=%d\n", |
3167 | status); |
3168 | diff --git a/fs/namespace.c b/fs/namespace.c |
3169 | index 7f6a9348c589..154822397780 100644 |
3170 | --- a/fs/namespace.c |
3171 | +++ b/fs/namespace.c |
3172 | @@ -2696,6 +2696,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, |
3173 | /* make sure we can reach put_old from new_root */ |
3174 | if (!is_path_reachable(old_mnt, old.dentry, &new)) |
3175 | goto out4; |
3176 | + /* make certain new is below the root */ |
3177 | + if (!is_path_reachable(new_mnt, new.dentry, &root)) |
3178 | + goto out4; |
3179 | root_mp->m_count++; /* pin it so it won't go away */ |
3180 | br_write_lock(&vfsmount_lock); |
3181 | detach_mnt(new_mnt, &parent_path); |
3182 | diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c |
3183 | index 0f9ce13972d0..9240dd1678da 100644 |
3184 | --- a/fs/nfsd/nfs4proc.c |
3185 | +++ b/fs/nfsd/nfs4proc.c |
3186 | @@ -1191,7 +1191,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp) |
3187 | */ |
3188 | if (argp->opcnt == resp->opcnt) |
3189 | return false; |
3190 | - |
3191 | + if (next->opnum == OP_ILLEGAL) |
3192 | + return false; |
3193 | nextd = OPDESC(next); |
3194 | /* |
3195 | * Rest of 2.6.3.1.1: certain operations will return WRONGSEC |
3196 | diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c |
3197 | index e4bcb2cf055a..3ba30825f387 100644 |
3198 | --- a/fs/pstore/inode.c |
3199 | +++ b/fs/pstore/inode.c |
3200 | @@ -316,10 +316,10 @@ int pstore_mkfile(enum pstore_type_id type, char *psname, u64 id, int count, |
3201 | sprintf(name, "dmesg-%s-%lld", psname, id); |
3202 | break; |
3203 | case PSTORE_TYPE_CONSOLE: |
3204 | - sprintf(name, "console-%s", psname); |
3205 | + sprintf(name, "console-%s-%lld", psname, id); |
3206 | break; |
3207 | case PSTORE_TYPE_FTRACE: |
3208 | - sprintf(name, "ftrace-%s", psname); |
3209 | + sprintf(name, "ftrace-%s-%lld", psname, id); |
3210 | break; |
3211 | case PSTORE_TYPE_MCE: |
3212 | sprintf(name, "mce-%s-%lld", psname, id); |
3213 | diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c |
3214 | index 38802d683969..7a10e047bc33 100644 |
3215 | --- a/fs/quota/dquot.c |
3216 | +++ b/fs/quota/dquot.c |
3217 | @@ -637,7 +637,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type) |
3218 | dqstats_inc(DQST_LOOKUPS); |
3219 | err = sb->dq_op->write_dquot(dquot); |
3220 | if (!ret && err) |
3221 | - err = ret; |
3222 | + ret = err; |
3223 | dqput(dquot); |
3224 | spin_lock(&dq_list_lock); |
3225 | } |
3226 | diff --git a/fs/super.c b/fs/super.c |
3227 | index 68307c029228..e028b508db25 100644 |
3228 | --- a/fs/super.c |
3229 | +++ b/fs/super.c |
3230 | @@ -76,6 +76,8 @@ static int prune_super(struct shrinker *shrink, struct shrink_control *sc) |
3231 | |
3232 | total_objects = sb->s_nr_dentry_unused + |
3233 | sb->s_nr_inodes_unused + fs_objects + 1; |
3234 | + if (!total_objects) |
3235 | + total_objects = 1; |
3236 | |
3237 | if (sc->nr_to_scan) { |
3238 | int dentries; |
3239 | diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c |
3240 | index ff8229340cd5..26b69b2d4a45 100644 |
3241 | --- a/fs/ubifs/commit.c |
3242 | +++ b/fs/ubifs/commit.c |
3243 | @@ -166,15 +166,10 @@ static int do_commit(struct ubifs_info *c) |
3244 | err = ubifs_orphan_end_commit(c); |
3245 | if (err) |
3246 | goto out; |
3247 | - old_ltail_lnum = c->ltail_lnum; |
3248 | - err = ubifs_log_end_commit(c, new_ltail_lnum); |
3249 | - if (err) |
3250 | - goto out; |
3251 | err = dbg_check_old_index(c, &zroot); |
3252 | if (err) |
3253 | goto out; |
3254 | |
3255 | - mutex_lock(&c->mst_mutex); |
3256 | c->mst_node->cmt_no = cpu_to_le64(c->cmt_no); |
3257 | c->mst_node->log_lnum = cpu_to_le32(new_ltail_lnum); |
3258 | c->mst_node->root_lnum = cpu_to_le32(zroot.lnum); |
3259 | @@ -203,8 +198,9 @@ static int do_commit(struct ubifs_info *c) |
3260 | c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS); |
3261 | else |
3262 | c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS); |
3263 | - err = ubifs_write_master(c); |
3264 | - mutex_unlock(&c->mst_mutex); |
3265 | + |
3266 | + old_ltail_lnum = c->ltail_lnum; |
3267 | + err = ubifs_log_end_commit(c, new_ltail_lnum); |
3268 | if (err) |
3269 | goto out; |
3270 | |
3271 | diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c |
3272 | index 36bd4efd0819..06649d21b056 100644 |
3273 | --- a/fs/ubifs/log.c |
3274 | +++ b/fs/ubifs/log.c |
3275 | @@ -106,10 +106,14 @@ static inline long long empty_log_bytes(const struct ubifs_info *c) |
3276 | h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs; |
3277 | t = (long long)c->ltail_lnum * c->leb_size; |
3278 | |
3279 | - if (h >= t) |
3280 | + if (h > t) |
3281 | return c->log_bytes - h + t; |
3282 | - else |
3283 | + else if (h != t) |
3284 | return t - h; |
3285 | + else if (c->lhead_lnum != c->ltail_lnum) |
3286 | + return 0; |
3287 | + else |
3288 | + return c->log_bytes; |
3289 | } |
3290 | |
3291 | /** |
3292 | @@ -447,9 +451,9 @@ out: |
3293 | * @ltail_lnum: new log tail LEB number |
3294 | * |
3295 | * This function is called on when the commit operation was finished. It |
3296 | - * moves log tail to new position and unmaps LEBs which contain obsolete data. |
3297 | - * Returns zero in case of success and a negative error code in case of |
3298 | - * failure. |
3299 | + * moves log tail to new position and updates the master node so that it stores |
3300 | + * the new log tail LEB number. Returns zero in case of success and a negative |
3301 | + * error code in case of failure. |
3302 | */ |
3303 | int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) |
3304 | { |
3305 | @@ -477,7 +481,12 @@ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) |
3306 | spin_unlock(&c->buds_lock); |
3307 | |
3308 | err = dbg_check_bud_bytes(c); |
3309 | + if (err) |
3310 | + goto out; |
3311 | |
3312 | + err = ubifs_write_master(c); |
3313 | + |
3314 | +out: |
3315 | mutex_unlock(&c->log_mutex); |
3316 | return err; |
3317 | } |
3318 | diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c |
3319 | index ab83ace9910a..1a4bb9e8b3b8 100644 |
3320 | --- a/fs/ubifs/master.c |
3321 | +++ b/fs/ubifs/master.c |
3322 | @@ -352,10 +352,9 @@ int ubifs_read_master(struct ubifs_info *c) |
3323 | * ubifs_write_master - write master node. |
3324 | * @c: UBIFS file-system description object |
3325 | * |
3326 | - * This function writes the master node. The caller has to take the |
3327 | - * @c->mst_mutex lock before calling this function. Returns zero in case of |
3328 | - * success and a negative error code in case of failure. The master node is |
3329 | - * written twice to enable recovery. |
3330 | + * This function writes the master node. Returns zero in case of success and a |
3331 | + * negative error code in case of failure. The master node is written twice to |
3332 | + * enable recovery. |
3333 | */ |
3334 | int ubifs_write_master(struct ubifs_info *c) |
3335 | { |
3336 | diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c |
3337 | index 879b9976c12b..05115d719408 100644 |
3338 | --- a/fs/ubifs/super.c |
3339 | +++ b/fs/ubifs/super.c |
3340 | @@ -1970,7 +1970,6 @@ static struct ubifs_info *alloc_ubifs_info(struct ubi_volume_desc *ubi) |
3341 | mutex_init(&c->lp_mutex); |
3342 | mutex_init(&c->tnc_mutex); |
3343 | mutex_init(&c->log_mutex); |
3344 | - mutex_init(&c->mst_mutex); |
3345 | mutex_init(&c->umount_mutex); |
3346 | mutex_init(&c->bu_mutex); |
3347 | mutex_init(&c->write_reserve_mutex); |
3348 | diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h |
3349 | index b2babce4d70f..bd51277f6fe1 100644 |
3350 | --- a/fs/ubifs/ubifs.h |
3351 | +++ b/fs/ubifs/ubifs.h |
3352 | @@ -1042,7 +1042,6 @@ struct ubifs_debug_info; |
3353 | * |
3354 | * @mst_node: master node |
3355 | * @mst_offs: offset of valid master node |
3356 | - * @mst_mutex: protects the master node area, @mst_node, and @mst_offs |
3357 | * |
3358 | * @max_bu_buf_len: maximum bulk-read buffer length |
3359 | * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu |
3360 | @@ -1282,7 +1281,6 @@ struct ubifs_info { |
3361 | |
3362 | struct ubifs_mst_node *mst_node; |
3363 | int mst_offs; |
3364 | - struct mutex mst_mutex; |
3365 | |
3366 | int max_bu_buf_len; |
3367 | struct mutex bu_mutex; |
3368 | diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h |
3369 | index 3a1cff56ef20..d7b717090f2f 100644 |
3370 | --- a/include/drm/drm_pciids.h |
3371 | +++ b/include/drm/drm_pciids.h |
3372 | @@ -52,7 +52,6 @@ |
3373 | {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ |
3374 | {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ |
3375 | {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ |
3376 | - {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \ |
3377 | {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ |
3378 | {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ |
3379 | {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ |
3380 | diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h |
3381 | index 2fdb4a451b49..494d228a91dd 100644 |
3382 | --- a/include/linux/blkdev.h |
3383 | +++ b/include/linux/blkdev.h |
3384 | @@ -1187,10 +1187,9 @@ static inline int queue_alignment_offset(struct request_queue *q) |
3385 | static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector) |
3386 | { |
3387 | unsigned int granularity = max(lim->physical_block_size, lim->io_min); |
3388 | - unsigned int alignment = (sector << 9) & (granularity - 1); |
3389 | + unsigned int alignment = sector_div(sector, granularity >> 9) << 9; |
3390 | |
3391 | - return (granularity + lim->alignment_offset - alignment) |
3392 | - & (granularity - 1); |
3393 | + return (granularity + lim->alignment_offset - alignment) % granularity; |
3394 | } |
3395 | |
3396 | static inline int bdev_alignment_offset(struct block_device *bdev) |
3397 | diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h |
3398 | index 24545cd90a25..02ae99e8e6d3 100644 |
3399 | --- a/include/linux/compiler-gcc.h |
3400 | +++ b/include/linux/compiler-gcc.h |
3401 | @@ -37,6 +37,9 @@ |
3402 | __asm__ ("" : "=r"(__ptr) : "0"(ptr)); \ |
3403 | (typeof(ptr)) (__ptr + (off)); }) |
3404 | |
3405 | +/* Make the optimizer believe the variable can be manipulated arbitrarily. */ |
3406 | +#define OPTIMIZER_HIDE_VAR(var) __asm__ ("" : "=r" (var) : "0" (var)) |
3407 | + |
3408 | #ifdef __CHECKER__ |
3409 | #define __must_be_array(arr) 0 |
3410 | #else |
3411 | diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h |
3412 | index dc1bd3dcf11f..5529c5239421 100644 |
3413 | --- a/include/linux/compiler-intel.h |
3414 | +++ b/include/linux/compiler-intel.h |
3415 | @@ -15,6 +15,7 @@ |
3416 | */ |
3417 | #undef barrier |
3418 | #undef RELOC_HIDE |
3419 | +#undef OPTIMIZER_HIDE_VAR |
3420 | |
3421 | #define barrier() __memory_barrier() |
3422 | |
3423 | @@ -23,6 +24,12 @@ |
3424 | __ptr = (unsigned long) (ptr); \ |
3425 | (typeof(ptr)) (__ptr + (off)); }) |
3426 | |
3427 | +/* This should act as an optimization barrier on var. |
3428 | + * Given that this compiler does not have inline assembly, a compiler barrier |
3429 | + * is the best we can do. |
3430 | + */ |
3431 | +#define OPTIMIZER_HIDE_VAR(var) barrier() |
3432 | + |
3433 | /* Intel ECC compiler doesn't support __builtin_types_compatible_p() */ |
3434 | #define __must_be_array(a) 0 |
3435 | |
3436 | diff --git a/include/linux/compiler.h b/include/linux/compiler.h |
3437 | index 92669cd182a6..a2329c5e6206 100644 |
3438 | --- a/include/linux/compiler.h |
3439 | +++ b/include/linux/compiler.h |
3440 | @@ -170,6 +170,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); |
3441 | (typeof(ptr)) (__ptr + (off)); }) |
3442 | #endif |
3443 | |
3444 | +#ifndef OPTIMIZER_HIDE_VAR |
3445 | +#define OPTIMIZER_HIDE_VAR(var) barrier() |
3446 | +#endif |
3447 | + |
3448 | /* Not-quite-unique ID. */ |
3449 | #ifndef __UNIQUE_ID |
3450 | # define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __LINE__) |
3451 | diff --git a/include/linux/mm.h b/include/linux/mm.h |
3452 | index a9a48309f045..7da14357aa76 100644 |
3453 | --- a/include/linux/mm.h |
3454 | +++ b/include/linux/mm.h |
3455 | @@ -1004,6 +1004,7 @@ static inline void unmap_shared_mapping_range(struct address_space *mapping, |
3456 | |
3457 | extern void truncate_pagecache(struct inode *inode, loff_t old, loff_t new); |
3458 | extern void truncate_setsize(struct inode *inode, loff_t newsize); |
3459 | +void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to); |
3460 | void truncate_pagecache_range(struct inode *inode, loff_t offset, loff_t end); |
3461 | int truncate_inode_page(struct address_space *mapping, struct page *page); |
3462 | int generic_error_remove_page(struct address_space *mapping, struct page *page); |
3463 | diff --git a/include/linux/of.h b/include/linux/of.h |
3464 | index 1fd08ca23106..5e9d35233a65 100644 |
3465 | --- a/include/linux/of.h |
3466 | +++ b/include/linux/of.h |
3467 | @@ -252,14 +252,12 @@ extern int of_property_read_u64(const struct device_node *np, |
3468 | extern int of_property_read_string(struct device_node *np, |
3469 | const char *propname, |
3470 | const char **out_string); |
3471 | -extern int of_property_read_string_index(struct device_node *np, |
3472 | - const char *propname, |
3473 | - int index, const char **output); |
3474 | extern int of_property_match_string(struct device_node *np, |
3475 | const char *propname, |
3476 | const char *string); |
3477 | -extern int of_property_count_strings(struct device_node *np, |
3478 | - const char *propname); |
3479 | +extern int of_property_read_string_helper(struct device_node *np, |
3480 | + const char *propname, |
3481 | + const char **out_strs, size_t sz, int index); |
3482 | extern int of_device_is_compatible(const struct device_node *device, |
3483 | const char *); |
3484 | extern int of_device_is_available(const struct device_node *device); |
3485 | @@ -439,15 +437,9 @@ static inline int of_property_read_string(struct device_node *np, |
3486 | return -ENOSYS; |
3487 | } |
3488 | |
3489 | -static inline int of_property_read_string_index(struct device_node *np, |
3490 | - const char *propname, int index, |
3491 | - const char **out_string) |
3492 | -{ |
3493 | - return -ENOSYS; |
3494 | -} |
3495 | - |
3496 | -static inline int of_property_count_strings(struct device_node *np, |
3497 | - const char *propname) |
3498 | +static inline int of_property_read_string_helper(struct device_node *np, |
3499 | + const char *propname, |
3500 | + const char **out_strs, size_t sz, int index) |
3501 | { |
3502 | return -ENOSYS; |
3503 | } |
3504 | @@ -523,6 +515,70 @@ static inline int of_node_to_nid(struct device_node *np) |
3505 | #endif |
3506 | |
3507 | /** |
3508 | + * of_property_read_string_array() - Read an array of strings from a multiple |
3509 | + * strings property. |
3510 | + * @np: device node from which the property value is to be read. |
3511 | + * @propname: name of the property to be searched. |
3512 | + * @out_strs: output array of string pointers. |
3513 | + * @sz: number of array elements to read. |
3514 | + * |
3515 | + * Search for a property in a device tree node and retrieve a list of |
3516 | + * terminated string values (pointer to data, not a copy) in that property. |
3517 | + * |
3518 | + * If @out_strs is NULL, the number of strings in the property is returned. |
3519 | + */ |
3520 | +static inline int of_property_read_string_array(struct device_node *np, |
3521 | + const char *propname, const char **out_strs, |
3522 | + size_t sz) |
3523 | +{ |
3524 | + return of_property_read_string_helper(np, propname, out_strs, sz, 0); |
3525 | +} |
3526 | + |
3527 | +/** |
3528 | + * of_property_count_strings() - Find and return the number of strings from a |
3529 | + * multiple strings property. |
3530 | + * @np: device node from which the property value is to be read. |
3531 | + * @propname: name of the property to be searched. |
3532 | + * |
3533 | + * Search for a property in a device tree node and retrieve the number of null |
3534 | + * terminated string contain in it. Returns the number of strings on |
3535 | + * success, -EINVAL if the property does not exist, -ENODATA if property |
3536 | + * does not have a value, and -EILSEQ if the string is not null-terminated |
3537 | + * within the length of the property data. |
3538 | + */ |
3539 | +static inline int of_property_count_strings(struct device_node *np, |
3540 | + const char *propname) |
3541 | +{ |
3542 | + return of_property_read_string_helper(np, propname, NULL, 0, 0); |
3543 | +} |
3544 | + |
3545 | +/** |
3546 | + * of_property_read_string_index() - Find and read a string from a multiple |
3547 | + * strings property. |
3548 | + * @np: device node from which the property value is to be read. |
3549 | + * @propname: name of the property to be searched. |
3550 | + * @index: index of the string in the list of strings |
3551 | + * @out_string: pointer to null terminated return string, modified only if |
3552 | + * return value is 0. |
3553 | + * |
3554 | + * Search for a property in a device tree node and retrieve a null |
3555 | + * terminated string value (pointer to data, not a copy) in the list of strings |
3556 | + * contained in that property. |
3557 | + * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if |
3558 | + * property does not have a value, and -EILSEQ if the string is not |
3559 | + * null-terminated within the length of the property data. |
3560 | + * |
3561 | + * The out_string pointer is modified only if a valid string can be decoded. |
3562 | + */ |
3563 | +static inline int of_property_read_string_index(struct device_node *np, |
3564 | + const char *propname, |
3565 | + int index, const char **output) |
3566 | +{ |
3567 | + int rc = of_property_read_string_helper(np, propname, output, 1, index); |
3568 | + return rc < 0 ? rc : 0; |
3569 | +} |
3570 | + |
3571 | +/** |
3572 | * of_property_read_bool - Findfrom a property |
3573 | * @np: device node from which the property value is to be read. |
3574 | * @propname: name of the property to be searched. |
3575 | diff --git a/include/linux/oom.h b/include/linux/oom.h |
3576 | index da60007075b5..297cda528855 100644 |
3577 | --- a/include/linux/oom.h |
3578 | +++ b/include/linux/oom.h |
3579 | @@ -50,6 +50,9 @@ static inline bool oom_task_origin(const struct task_struct *p) |
3580 | extern unsigned long oom_badness(struct task_struct *p, |
3581 | struct mem_cgroup *memcg, const nodemask_t *nodemask, |
3582 | unsigned long totalpages); |
3583 | + |
3584 | +extern int oom_kills_count(void); |
3585 | +extern void note_oom_kill(void); |
3586 | extern void oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order, |
3587 | unsigned int points, unsigned long totalpages, |
3588 | struct mem_cgroup *memcg, nodemask_t *nodemask, |
3589 | diff --git a/include/linux/string.h b/include/linux/string.h |
3590 | index ac889c5ea11b..0ed878d0465c 100644 |
3591 | --- a/include/linux/string.h |
3592 | +++ b/include/linux/string.h |
3593 | @@ -129,7 +129,7 @@ int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4); |
3594 | #endif |
3595 | |
3596 | extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos, |
3597 | - const void *from, size_t available); |
3598 | + const void *from, size_t available); |
3599 | |
3600 | /** |
3601 | * strstarts - does @str start with @prefix? |
3602 | @@ -141,7 +141,8 @@ static inline bool strstarts(const char *str, const char *prefix) |
3603 | return strncmp(str, prefix, strlen(prefix)) == 0; |
3604 | } |
3605 | |
3606 | -extern size_t memweight(const void *ptr, size_t bytes); |
3607 | +size_t memweight(const void *ptr, size_t bytes); |
3608 | +void memzero_explicit(void *s, size_t count); |
3609 | |
3610 | /** |
3611 | * kbasename - return the last part of a pathname. |
3612 | diff --git a/kernel/freezer.c b/kernel/freezer.c |
3613 | index 78758512b1e1..bd733f6e610d 100644 |
3614 | --- a/kernel/freezer.c |
3615 | +++ b/kernel/freezer.c |
3616 | @@ -42,6 +42,9 @@ bool freezing_slow_path(struct task_struct *p) |
3617 | if (p->flags & PF_NOFREEZE) |
3618 | return false; |
3619 | |
3620 | + if (test_thread_flag(TIF_MEMDIE)) |
3621 | + return false; |
3622 | + |
3623 | if (pm_nosig_freezing || cgroup_freezing(p)) |
3624 | return true; |
3625 | |
3626 | diff --git a/kernel/module.c b/kernel/module.c |
3627 | index 10a3af821d28..61fb677211cb 100644 |
3628 | --- a/kernel/module.c |
3629 | +++ b/kernel/module.c |
3630 | @@ -1866,7 +1866,9 @@ static void free_module(struct module *mod) |
3631 | |
3632 | /* We leave it in list to prevent duplicate loads, but make sure |
3633 | * that noone uses it while it's being deconstructed. */ |
3634 | + mutex_lock(&module_mutex); |
3635 | mod->state = MODULE_STATE_UNFORMED; |
3636 | + mutex_unlock(&module_mutex); |
3637 | |
3638 | /* Remove dynamic debug info */ |
3639 | ddebug_remove_module(mod->name); |
3640 | diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c |
3641 | index 424c2d4265c9..77e6b83c0431 100644 |
3642 | --- a/kernel/posix-timers.c |
3643 | +++ b/kernel/posix-timers.c |
3644 | @@ -634,6 +634,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, |
3645 | goto out; |
3646 | } |
3647 | } else { |
3648 | + memset(&event.sigev_value, 0, sizeof(event.sigev_value)); |
3649 | event.sigev_notify = SIGEV_SIGNAL; |
3650 | event.sigev_signo = SIGALRM; |
3651 | event.sigev_value.sival_int = new_timer->it_id; |
3652 | diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c |
3653 | index b26f5f1e773e..1634dc6e2fe7 100644 |
3654 | --- a/kernel/power/hibernate.c |
3655 | +++ b/kernel/power/hibernate.c |
3656 | @@ -491,8 +491,14 @@ int hibernation_restore(int platform_mode) |
3657 | error = dpm_suspend_start(PMSG_QUIESCE); |
3658 | if (!error) { |
3659 | error = resume_target_kernel(platform_mode); |
3660 | - dpm_resume_end(PMSG_RECOVER); |
3661 | + /* |
3662 | + * The above should either succeed and jump to the new kernel, |
3663 | + * or return with an error. Otherwise things are just |
3664 | + * undefined, so let's be paranoid. |
3665 | + */ |
3666 | + BUG_ON(!error); |
3667 | } |
3668 | + dpm_resume_end(PMSG_RECOVER); |
3669 | pm_restore_gfp_mask(); |
3670 | ftrace_start(); |
3671 | resume_console(); |
3672 | diff --git a/kernel/power/process.c b/kernel/power/process.c |
3673 | index 1b212bee1510..0695319b5fde 100644 |
3674 | --- a/kernel/power/process.c |
3675 | +++ b/kernel/power/process.c |
3676 | @@ -103,6 +103,28 @@ static int try_to_freeze_tasks(bool user_only) |
3677 | return todo ? -EBUSY : 0; |
3678 | } |
3679 | |
3680 | +/* |
3681 | + * Returns true if all freezable tasks (except for current) are frozen already |
3682 | + */ |
3683 | +static bool check_frozen_processes(void) |
3684 | +{ |
3685 | + struct task_struct *g, *p; |
3686 | + bool ret = true; |
3687 | + |
3688 | + read_lock(&tasklist_lock); |
3689 | + for_each_process_thread(g, p) { |
3690 | + if (p != current && !freezer_should_skip(p) && |
3691 | + !frozen(p)) { |
3692 | + ret = false; |
3693 | + goto done; |
3694 | + } |
3695 | + } |
3696 | +done: |
3697 | + read_unlock(&tasklist_lock); |
3698 | + |
3699 | + return ret; |
3700 | +} |
3701 | + |
3702 | /** |
3703 | * freeze_processes - Signal user space processes to enter the refrigerator. |
3704 | * |
3705 | @@ -111,6 +133,7 @@ static int try_to_freeze_tasks(bool user_only) |
3706 | int freeze_processes(void) |
3707 | { |
3708 | int error; |
3709 | + int oom_kills_saved; |
3710 | |
3711 | error = __usermodehelper_disable(UMH_FREEZING); |
3712 | if (error) |
3713 | @@ -121,12 +144,27 @@ int freeze_processes(void) |
3714 | |
3715 | printk("Freezing user space processes ... "); |
3716 | pm_freezing = true; |
3717 | + oom_kills_saved = oom_kills_count(); |
3718 | error = try_to_freeze_tasks(true); |
3719 | if (!error) { |
3720 | - printk("done."); |
3721 | __usermodehelper_set_disable_depth(UMH_DISABLED); |
3722 | oom_killer_disable(); |
3723 | + |
3724 | + /* |
3725 | + * There might have been an OOM kill while we were |
3726 | + * freezing tasks and the killed task might be still |
3727 | + * on the way out so we have to double check for race. |
3728 | + */ |
3729 | + if (oom_kills_count() != oom_kills_saved && |
3730 | + !check_frozen_processes()) { |
3731 | + __usermodehelper_set_disable_depth(UMH_ENABLED); |
3732 | + printk("OOM in progress."); |
3733 | + error = -EBUSY; |
3734 | + goto done; |
3735 | + } |
3736 | + printk("done."); |
3737 | } |
3738 | +done: |
3739 | printk("\n"); |
3740 | BUG_ON(in_atomic()); |
3741 | |
3742 | diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c |
3743 | index 322e16461072..bdb9ee0af991 100644 |
3744 | --- a/kernel/trace/trace_syscalls.c |
3745 | +++ b/kernel/trace/trace_syscalls.c |
3746 | @@ -312,7 +312,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id) |
3747 | int size; |
3748 | |
3749 | syscall_nr = trace_get_syscall_nr(current, regs); |
3750 | - if (syscall_nr < 0) |
3751 | + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) |
3752 | return; |
3753 | if (!test_bit(syscall_nr, tr->enabled_enter_syscalls)) |
3754 | return; |
3755 | @@ -354,7 +354,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret) |
3756 | int syscall_nr; |
3757 | |
3758 | syscall_nr = trace_get_syscall_nr(current, regs); |
3759 | - if (syscall_nr < 0) |
3760 | + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) |
3761 | return; |
3762 | if (!test_bit(syscall_nr, tr->enabled_exit_syscalls)) |
3763 | return; |
3764 | @@ -557,7 +557,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id) |
3765 | int size; |
3766 | |
3767 | syscall_nr = trace_get_syscall_nr(current, regs); |
3768 | - if (syscall_nr < 0) |
3769 | + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) |
3770 | return; |
3771 | if (!test_bit(syscall_nr, enabled_perf_enter_syscalls)) |
3772 | return; |
3773 | @@ -633,7 +633,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret) |
3774 | int size; |
3775 | |
3776 | syscall_nr = trace_get_syscall_nr(current, regs); |
3777 | - if (syscall_nr < 0) |
3778 | + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) |
3779 | return; |
3780 | if (!test_bit(syscall_nr, enabled_perf_exit_syscalls)) |
3781 | return; |
3782 | diff --git a/lib/bitmap.c b/lib/bitmap.c |
3783 | index 06f7e4fe8d2d..e5c4ebe586ba 100644 |
3784 | --- a/lib/bitmap.c |
3785 | +++ b/lib/bitmap.c |
3786 | @@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long *dst, |
3787 | lower = src[off + k]; |
3788 | if (left && off + k == lim - 1) |
3789 | lower &= mask; |
3790 | - dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem; |
3791 | + dst[k] = lower >> rem; |
3792 | + if (rem) |
3793 | + dst[k] |= upper << (BITS_PER_LONG - rem); |
3794 | if (left && k == lim - 1) |
3795 | dst[k] &= mask; |
3796 | } |
3797 | @@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long *dst, |
3798 | upper = src[k]; |
3799 | if (left && k == lim - 1) |
3800 | upper &= (1UL << left) - 1; |
3801 | - dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem; |
3802 | + dst[k + off] = upper << rem; |
3803 | + if (rem) |
3804 | + dst[k + off] |= lower >> (BITS_PER_LONG - rem); |
3805 | if (left && k + off == lim - 1) |
3806 | dst[k + off] &= (1UL << left) - 1; |
3807 | } |
3808 | diff --git a/lib/string.c b/lib/string.c |
3809 | index e5878de4f101..43d0781daf47 100644 |
3810 | --- a/lib/string.c |
3811 | +++ b/lib/string.c |
3812 | @@ -586,6 +586,22 @@ void *memset(void *s, int c, size_t count) |
3813 | EXPORT_SYMBOL(memset); |
3814 | #endif |
3815 | |
3816 | +/** |
3817 | + * memzero_explicit - Fill a region of memory (e.g. sensitive |
3818 | + * keying data) with 0s. |
3819 | + * @s: Pointer to the start of the area. |
3820 | + * @count: The size of the area. |
3821 | + * |
3822 | + * memzero_explicit() doesn't need an arch-specific version as |
3823 | + * it just invokes the one of memset() implicitly. |
3824 | + */ |
3825 | +void memzero_explicit(void *s, size_t count) |
3826 | +{ |
3827 | + memset(s, 0, count); |
3828 | + OPTIMIZER_HIDE_VAR(s); |
3829 | +} |
3830 | +EXPORT_SYMBOL(memzero_explicit); |
3831 | + |
3832 | #ifndef __HAVE_ARCH_MEMCPY |
3833 | /** |
3834 | * memcpy - Copy one area of memory to another |
3835 | diff --git a/mm/oom_kill.c b/mm/oom_kill.c |
3836 | index 8e40908e724a..f104c7e9f61e 100644 |
3837 | --- a/mm/oom_kill.c |
3838 | +++ b/mm/oom_kill.c |
3839 | @@ -402,6 +402,23 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order, |
3840 | dump_tasks(memcg, nodemask); |
3841 | } |
3842 | |
3843 | +/* |
3844 | + * Number of OOM killer invocations (including memcg OOM killer). |
3845 | + * Primarily used by PM freezer to check for potential races with |
3846 | + * OOM killed frozen task. |
3847 | + */ |
3848 | +static atomic_t oom_kills = ATOMIC_INIT(0); |
3849 | + |
3850 | +int oom_kills_count(void) |
3851 | +{ |
3852 | + return atomic_read(&oom_kills); |
3853 | +} |
3854 | + |
3855 | +void note_oom_kill(void) |
3856 | +{ |
3857 | + atomic_inc(&oom_kills); |
3858 | +} |
3859 | + |
3860 | #define K(x) ((x) << (PAGE_SHIFT-10)) |
3861 | /* |
3862 | * Must be called while holding a reference to p, which will be released upon |
3863 | diff --git a/mm/page_alloc.c b/mm/page_alloc.c |
3864 | index 71305c6aba5b..494a081ec5e4 100644 |
3865 | --- a/mm/page_alloc.c |
3866 | +++ b/mm/page_alloc.c |
3867 | @@ -2120,6 +2120,14 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, |
3868 | } |
3869 | |
3870 | /* |
3871 | + * PM-freezer should be notified that there might be an OOM killer on |
3872 | + * its way to kill and wake somebody up. This is too early and we might |
3873 | + * end up not killing anything but false positives are acceptable. |
3874 | + * See freeze_processes. |
3875 | + */ |
3876 | + note_oom_kill(); |
3877 | + |
3878 | + /* |
3879 | * Go through the zonelist yet one more time, keep very high watermark |
3880 | * here, this is only to catch a parallel oom killing, we must fail if |
3881 | * we're still under heavy pressure. |
3882 | diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c |
3883 | index 6d757e3a872a..e007236f345a 100644 |
3884 | --- a/mm/page_cgroup.c |
3885 | +++ b/mm/page_cgroup.c |
3886 | @@ -170,6 +170,7 @@ static void free_page_cgroup(void *addr) |
3887 | sizeof(struct page_cgroup) * PAGES_PER_SECTION; |
3888 | |
3889 | BUG_ON(PageReserved(page)); |
3890 | + kmemleak_free(addr); |
3891 | free_pages_exact(addr, table_size); |
3892 | } |
3893 | } |
3894 | diff --git a/mm/percpu.c b/mm/percpu.c |
3895 | index 9bc1bf914cc8..25e2ea52db82 100644 |
3896 | --- a/mm/percpu.c |
3897 | +++ b/mm/percpu.c |
3898 | @@ -1910,8 +1910,6 @@ void __init setup_per_cpu_areas(void) |
3899 | |
3900 | if (pcpu_setup_first_chunk(ai, fc) < 0) |
3901 | panic("Failed to initialize percpu areas."); |
3902 | - |
3903 | - pcpu_free_alloc_info(ai); |
3904 | } |
3905 | |
3906 | #endif /* CONFIG_SMP */ |
3907 | diff --git a/mm/truncate.c b/mm/truncate.c |
3908 | index c75b736e54b7..2d6151fc8f08 100644 |
3909 | --- a/mm/truncate.c |
3910 | +++ b/mm/truncate.c |
3911 | @@ -20,6 +20,7 @@ |
3912 | #include <linux/buffer_head.h> /* grr. try_to_release_page, |
3913 | do_invalidatepage */ |
3914 | #include <linux/cleancache.h> |
3915 | +#include <linux/rmap.h> |
3916 | #include "internal.h" |
3917 | |
3918 | |
3919 | @@ -567,16 +568,67 @@ EXPORT_SYMBOL(truncate_pagecache); |
3920 | */ |
3921 | void truncate_setsize(struct inode *inode, loff_t newsize) |
3922 | { |
3923 | - loff_t oldsize; |
3924 | + loff_t oldsize = inode->i_size; |
3925 | |
3926 | - oldsize = inode->i_size; |
3927 | i_size_write(inode, newsize); |
3928 | - |
3929 | + if (newsize > oldsize) |
3930 | + pagecache_isize_extended(inode, oldsize, newsize); |
3931 | truncate_pagecache(inode, oldsize, newsize); |
3932 | } |
3933 | EXPORT_SYMBOL(truncate_setsize); |
3934 | |
3935 | /** |
3936 | + * pagecache_isize_extended - update pagecache after extension of i_size |
3937 | + * @inode: inode for which i_size was extended |
3938 | + * @from: original inode size |
3939 | + * @to: new inode size |
3940 | + * |
3941 | + * Handle extension of inode size either caused by extending truncate or by |
3942 | + * write starting after current i_size. We mark the page straddling current |
3943 | + * i_size RO so that page_mkwrite() is called on the nearest write access to |
3944 | + * the page. This way filesystem can be sure that page_mkwrite() is called on |
3945 | + * the page before user writes to the page via mmap after the i_size has been |
3946 | + * changed. |
3947 | + * |
3948 | + * The function must be called after i_size is updated so that page fault |
3949 | + * coming after we unlock the page will already see the new i_size. |
3950 | + * The function must be called while we still hold i_mutex - this not only |
3951 | + * makes sure i_size is stable but also that userspace cannot observe new |
3952 | + * i_size value before we are prepared to store mmap writes at new inode size. |
3953 | + */ |
3954 | +void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to) |
3955 | +{ |
3956 | + int bsize = 1 << inode->i_blkbits; |
3957 | + loff_t rounded_from; |
3958 | + struct page *page; |
3959 | + pgoff_t index; |
3960 | + |
3961 | + WARN_ON(to > inode->i_size); |
3962 | + |
3963 | + if (from >= to || bsize == PAGE_CACHE_SIZE) |
3964 | + return; |
3965 | + /* Page straddling @from will not have any hole block created? */ |
3966 | + rounded_from = round_up(from, bsize); |
3967 | + if (to <= rounded_from || !(rounded_from & (PAGE_CACHE_SIZE - 1))) |
3968 | + return; |
3969 | + |
3970 | + index = from >> PAGE_CACHE_SHIFT; |
3971 | + page = find_lock_page(inode->i_mapping, index); |
3972 | + /* Page not cached? Nothing to do */ |
3973 | + if (!page) |
3974 | + return; |
3975 | + /* |
3976 | + * See clear_page_dirty_for_io() for details why set_page_dirty() |
3977 | + * is needed. |
3978 | + */ |
3979 | + if (page_mkclean(page)) |
3980 | + set_page_dirty(page); |
3981 | + unlock_page(page); |
3982 | + page_cache_release(page); |
3983 | +} |
3984 | +EXPORT_SYMBOL(pagecache_isize_extended); |
3985 | + |
3986 | +/** |
3987 | * truncate_pagecache_range - unmap and remove pagecache that is hole-punched |
3988 | * @inode: inode |
3989 | * @lstart: offset of beginning of hole |
3990 | diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c |
3991 | index 66e77f380fce..e3bea2e0821a 100644 |
3992 | --- a/net/ceph/messenger.c |
3993 | +++ b/net/ceph/messenger.c |
3994 | @@ -290,7 +290,8 @@ int ceph_msgr_init(void) |
3995 | if (ceph_msgr_slab_init()) |
3996 | return -ENOMEM; |
3997 | |
3998 | - ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_NON_REENTRANT, 0); |
3999 | + ceph_msgr_wq = alloc_workqueue("ceph-msgr", |
4000 | + WQ_NON_REENTRANT | WQ_MEM_RECLAIM, 0); |
4001 | if (ceph_msgr_wq) |
4002 | return 0; |
4003 | |
4004 | diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c |
4005 | index 9c3979a50804..bc773a10dca6 100644 |
4006 | --- a/net/ipv4/fib_semantics.c |
4007 | +++ b/net/ipv4/fib_semantics.c |
4008 | @@ -533,7 +533,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi) |
4009 | return 1; |
4010 | |
4011 | attrlen = rtnh_attrlen(rtnh); |
4012 | - if (attrlen < 0) { |
4013 | + if (attrlen > 0) { |
4014 | struct nlattr *nla, *attrs = rtnh_attrs(rtnh); |
4015 | |
4016 | nla = nla_find(attrs, attrlen, RTA_GATEWAY); |
4017 | diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c |
4018 | index 5afbbbe03b0e..22fa05e041ea 100644 |
4019 | --- a/net/ipv4/ip_output.c |
4020 | +++ b/net/ipv4/ip_output.c |
4021 | @@ -1481,6 +1481,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, |
4022 | struct sk_buff *nskb; |
4023 | struct sock *sk; |
4024 | struct inet_sock *inet; |
4025 | + int err; |
4026 | |
4027 | if (ip_options_echo(&replyopts.opt.opt, skb)) |
4028 | return; |
4029 | @@ -1517,8 +1518,13 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, |
4030 | sock_net_set(sk, net); |
4031 | __skb_queue_head_init(&sk->sk_write_queue); |
4032 | sk->sk_sndbuf = sysctl_wmem_default; |
4033 | - ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, len, 0, |
4034 | - &ipc, &rt, MSG_DONTWAIT); |
4035 | + err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, |
4036 | + len, 0, &ipc, &rt, MSG_DONTWAIT); |
4037 | + if (unlikely(err)) { |
4038 | + ip_flush_pending_frames(sk); |
4039 | + goto out; |
4040 | + } |
4041 | + |
4042 | nskb = skb_peek(&sk->sk_write_queue); |
4043 | if (nskb) { |
4044 | if (arg->csumoffset >= 0) |
4045 | @@ -1530,7 +1536,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, |
4046 | skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb)); |
4047 | ip_push_pending_frames(sk, &fl4); |
4048 | } |
4049 | - |
4050 | +out: |
4051 | put_cpu_var(unicast_sock); |
4052 | |
4053 | ip_rt_put(rt); |
4054 | diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c |
4055 | index a02bef35b134..d68d6cfac3b5 100644 |
4056 | --- a/net/mac80211/rate.c |
4057 | +++ b/net/mac80211/rate.c |
4058 | @@ -448,7 +448,7 @@ static void rate_fixup_ratelist(struct ieee80211_vif *vif, |
4059 | */ |
4060 | if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) { |
4061 | u32 basic_rates = vif->bss_conf.basic_rates; |
4062 | - s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0; |
4063 | + s8 baserate = basic_rates ? ffs(basic_rates) - 1 : 0; |
4064 | |
4065 | rate = &sband->bitrates[rates[0].idx]; |
4066 | |
4067 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c |
4068 | index 5ed562dfe743..afe41178c9fb 100644 |
4069 | --- a/net/netlink/af_netlink.c |
4070 | +++ b/net/netlink/af_netlink.c |
4071 | @@ -571,7 +571,7 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, |
4072 | * after validation, the socket and the ring may only be used by a |
4073 | * single process, otherwise we fall back to copying. |
4074 | */ |
4075 | - if (atomic_long_read(&sk->sk_socket->file->f_count) > 2 || |
4076 | + if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 || |
4077 | atomic_read(&nlk->mapped) > 1) |
4078 | excl = false; |
4079 | |
4080 | diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c |
4081 | index b9b2bebeb350..b980a6ce5c79 100644 |
4082 | --- a/security/integrity/evm/evm_main.c |
4083 | +++ b/security/integrity/evm/evm_main.c |
4084 | @@ -286,9 +286,12 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, |
4085 | { |
4086 | const struct evm_ima_xattr_data *xattr_data = xattr_value; |
4087 | |
4088 | - if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) |
4089 | - && (xattr_data->type == EVM_XATTR_HMAC)) |
4090 | - return -EPERM; |
4091 | + if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { |
4092 | + if (!xattr_value_len) |
4093 | + return -EINVAL; |
4094 | + if (xattr_data->type != EVM_IMA_XATTR_DIGSIG) |
4095 | + return -EPERM; |
4096 | + } |
4097 | return evm_protect_xattr(dentry, xattr_name, xattr_value, |
4098 | xattr_value_len); |
4099 | } |
4100 | diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c |
4101 | index 70d4a8a7f21c..fdd6e4f8be39 100644 |
4102 | --- a/security/selinux/hooks.c |
4103 | +++ b/security/selinux/hooks.c |
4104 | @@ -437,6 +437,7 @@ next_inode: |
4105 | list_entry(sbsec->isec_head.next, |
4106 | struct inode_security_struct, list); |
4107 | struct inode *inode = isec->inode; |
4108 | + list_del_init(&isec->list); |
4109 | spin_unlock(&sbsec->isec_lock); |
4110 | inode = igrab(inode); |
4111 | if (inode) { |
4112 | @@ -445,7 +446,6 @@ next_inode: |
4113 | iput(inode); |
4114 | } |
4115 | spin_lock(&sbsec->isec_lock); |
4116 | - list_del_init(&isec->list); |
4117 | goto next_inode; |
4118 | } |
4119 | spin_unlock(&sbsec->isec_lock); |
4120 | diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c |
4121 | index af49721ba0e3..c4ac3c1e19af 100644 |
4122 | --- a/sound/core/pcm_compat.c |
4123 | +++ b/sound/core/pcm_compat.c |
4124 | @@ -206,6 +206,8 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream, |
4125 | if (err < 0) |
4126 | return err; |
4127 | |
4128 | + if (clear_user(src, sizeof(*src))) |
4129 | + return -EFAULT; |
4130 | if (put_user(status.state, &src->state) || |
4131 | compat_put_timespec(&status.trigger_tstamp, &src->trigger_tstamp) || |
4132 | compat_put_timespec(&status.tstamp, &src->tstamp) || |
4133 | diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c |
4134 | index dec997188dfb..a650aa48c786 100644 |
4135 | --- a/virt/kvm/iommu.c |
4136 | +++ b/virt/kvm/iommu.c |
4137 | @@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm, |
4138 | gfn_t base_gfn, unsigned long npages); |
4139 | |
4140 | static pfn_t kvm_pin_pages(struct kvm_memory_slot *slot, gfn_t gfn, |
4141 | - unsigned long size) |
4142 | + unsigned long npages) |
4143 | { |
4144 | gfn_t end_gfn; |
4145 | pfn_t pfn; |
4146 | |
4147 | pfn = gfn_to_pfn_memslot(slot, gfn); |
4148 | - end_gfn = gfn + (size >> PAGE_SHIFT); |
4149 | + end_gfn = gfn + npages; |
4150 | gfn += 1; |
4151 | |
4152 | if (is_error_noslot_pfn(pfn)) |
4153 | @@ -119,7 +119,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) |
4154 | * Pin all pages we are about to map in memory. This is |
4155 | * important because we unmap and unpin in 4kb steps later. |
4156 | */ |
4157 | - pfn = kvm_pin_pages(slot, gfn, page_size); |
4158 | + pfn = kvm_pin_pages(slot, gfn, page_size >> PAGE_SHIFT); |
4159 | if (is_error_noslot_pfn(pfn)) { |
4160 | gfn += 1; |
4161 | continue; |
4162 | @@ -131,7 +131,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) |
4163 | if (r) { |
4164 | printk(KERN_ERR "kvm_iommu_map_address:" |
4165 | "iommu failed to map pfn=%llx\n", pfn); |
4166 | - kvm_unpin_pages(kvm, pfn, page_size); |
4167 | + kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT); |
4168 | goto unmap_pages; |
4169 | } |
4170 |