Contents of /trunk/kernel-alx/patches-3.10/0174-3.10.75-all-fixes.patch
Parent Directory | Revision Log
Revision 2662 -
(show annotations)
(download)
Tue Jul 21 16:20:23 2015 UTC (9 years, 2 months ago) by niro
File size: 25722 byte(s)
Tue Jul 21 16:20:23 2015 UTC (9 years, 2 months ago) by niro
File size: 25722 byte(s)
-linux-3.10.75
1 | diff --git a/Makefile b/Makefile |
2 | index d2a3930159ea..87909d8302ad 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 3 |
7 | PATCHLEVEL = 10 |
8 | -SUBLEVEL = 74 |
9 | +SUBLEVEL = 75 |
10 | EXTRAVERSION = |
11 | NAME = TOSSUG Baby Fish |
12 | |
13 | diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c |
14 | index a88894190e41..c991fe680e58 100644 |
15 | --- a/drivers/acpi/processor_idle.c |
16 | +++ b/drivers/acpi/processor_idle.c |
17 | @@ -978,7 +978,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr) |
18 | return -EINVAL; |
19 | |
20 | drv->safe_state_index = -1; |
21 | - for (i = 0; i < CPUIDLE_STATE_MAX; i++) { |
22 | + for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) { |
23 | drv->states[i].name[0] = '\0'; |
24 | drv->states[i].desc[0] = '\0'; |
25 | } |
26 | diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c |
27 | index cf1576d54363..a5c987ae665d 100644 |
28 | --- a/drivers/block/nbd.c |
29 | +++ b/drivers/block/nbd.c |
30 | @@ -815,10 +815,6 @@ static int __init nbd_init(void) |
31 | return -EINVAL; |
32 | } |
33 | |
34 | - nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL); |
35 | - if (!nbd_dev) |
36 | - return -ENOMEM; |
37 | - |
38 | part_shift = 0; |
39 | if (max_part > 0) { |
40 | part_shift = fls(max_part); |
41 | @@ -840,6 +836,10 @@ static int __init nbd_init(void) |
42 | if (nbds_max > 1UL << (MINORBITS - part_shift)) |
43 | return -EINVAL; |
44 | |
45 | + nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL); |
46 | + if (!nbd_dev) |
47 | + return -ENOMEM; |
48 | + |
49 | for (i = 0; i < nbds_max; i++) { |
50 | struct gendisk *disk = alloc_disk(1 << part_shift); |
51 | if (!disk) |
52 | diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c |
53 | index ec3fc4fd9160..b94a37630e36 100644 |
54 | --- a/drivers/dma/omap-dma.c |
55 | +++ b/drivers/dma/omap-dma.c |
56 | @@ -487,6 +487,7 @@ static int omap_dma_terminate_all(struct omap_chan *c) |
57 | * c->desc is NULL and exit.) |
58 | */ |
59 | if (c->desc) { |
60 | + omap_dma_desc_free(&c->desc->vd); |
61 | c->desc = NULL; |
62 | /* Avoid stopping the dma twice */ |
63 | if (!c->paused) |
64 | diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c |
65 | index b131520521e4..72b02483ff03 100644 |
66 | --- a/drivers/gpu/drm/radeon/radeon_bios.c |
67 | +++ b/drivers/gpu/drm/radeon/radeon_bios.c |
68 | @@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev) |
69 | |
70 | static bool radeon_read_bios(struct radeon_device *rdev) |
71 | { |
72 | - uint8_t __iomem *bios; |
73 | + uint8_t __iomem *bios, val1, val2; |
74 | size_t size; |
75 | |
76 | rdev->bios = NULL; |
77 | @@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev) |
78 | return false; |
79 | } |
80 | |
81 | - if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) { |
82 | + val1 = readb(&bios[0]); |
83 | + val2 = readb(&bios[1]); |
84 | + |
85 | + if (size == 0 || val1 != 0x55 || val2 != 0xaa) { |
86 | pci_unmap_rom(rdev->pdev, bios); |
87 | return false; |
88 | } |
89 | - rdev->bios = kmemdup(bios, size, GFP_KERNEL); |
90 | + rdev->bios = kzalloc(size, GFP_KERNEL); |
91 | if (rdev->bios == NULL) { |
92 | pci_unmap_rom(rdev->pdev, bios); |
93 | return false; |
94 | } |
95 | + memcpy_fromio(rdev->bios, bios, size); |
96 | pci_unmap_rom(rdev->pdev, bios); |
97 | return true; |
98 | } |
99 | diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c |
100 | index e0017c22bb9c..f53e9a803a0e 100644 |
101 | --- a/drivers/iio/imu/adis_trigger.c |
102 | +++ b/drivers/iio/imu/adis_trigger.c |
103 | @@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev) |
104 | iio_trigger_set_drvdata(adis->trig, adis); |
105 | ret = iio_trigger_register(adis->trig); |
106 | |
107 | - indio_dev->trig = adis->trig; |
108 | + indio_dev->trig = iio_trigger_get(adis->trig); |
109 | if (ret) |
110 | goto error_free_irq; |
111 | |
112 | diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c |
113 | index 7da0832f187b..01d661e0fa6c 100644 |
114 | --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c |
115 | +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c |
116 | @@ -25,6 +25,16 @@ |
117 | #include <linux/poll.h> |
118 | #include "inv_mpu_iio.h" |
119 | |
120 | +static void inv_clear_kfifo(struct inv_mpu6050_state *st) |
121 | +{ |
122 | + unsigned long flags; |
123 | + |
124 | + /* take the spin lock sem to avoid interrupt kick in */ |
125 | + spin_lock_irqsave(&st->time_stamp_lock, flags); |
126 | + kfifo_reset(&st->timestamps); |
127 | + spin_unlock_irqrestore(&st->time_stamp_lock, flags); |
128 | +} |
129 | + |
130 | int inv_reset_fifo(struct iio_dev *indio_dev) |
131 | { |
132 | int result; |
133 | @@ -51,6 +61,10 @@ int inv_reset_fifo(struct iio_dev *indio_dev) |
134 | INV_MPU6050_BIT_FIFO_RST); |
135 | if (result) |
136 | goto reset_fifo_fail; |
137 | + |
138 | + /* clear timestamps fifo */ |
139 | + inv_clear_kfifo(st); |
140 | + |
141 | /* enable interrupt */ |
142 | if (st->chip_config.accl_fifo_enable || |
143 | st->chip_config.gyro_fifo_enable) { |
144 | @@ -84,16 +98,6 @@ reset_fifo_fail: |
145 | return result; |
146 | } |
147 | |
148 | -static void inv_clear_kfifo(struct inv_mpu6050_state *st) |
149 | -{ |
150 | - unsigned long flags; |
151 | - |
152 | - /* take the spin lock sem to avoid interrupt kick in */ |
153 | - spin_lock_irqsave(&st->time_stamp_lock, flags); |
154 | - kfifo_reset(&st->timestamps); |
155 | - spin_unlock_irqrestore(&st->time_stamp_lock, flags); |
156 | -} |
157 | - |
158 | /** |
159 | * inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt. |
160 | */ |
161 | @@ -187,7 +191,6 @@ end_session: |
162 | flush_fifo: |
163 | /* Flush HW and SW FIFOs. */ |
164 | inv_reset_fifo(indio_dev); |
165 | - inv_clear_kfifo(st); |
166 | mutex_unlock(&indio_dev->mlock); |
167 | iio_trigger_notify_done(indio_dev->trig); |
168 | |
169 | diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c |
170 | index a84112322071..055ebebc07dd 100644 |
171 | --- a/drivers/infiniband/core/umem.c |
172 | +++ b/drivers/infiniband/core/umem.c |
173 | @@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, |
174 | if (dmasync) |
175 | dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); |
176 | |
177 | + /* |
178 | + * If the combination of the addr and size requested for this memory |
179 | + * region causes an integer overflow, return error. |
180 | + */ |
181 | + if ((PAGE_ALIGN(addr + size) <= size) || |
182 | + (PAGE_ALIGN(addr + size) <= addr)) |
183 | + return ERR_PTR(-EINVAL); |
184 | + |
185 | if (!can_do_mlock()) |
186 | return ERR_PTR(-EPERM); |
187 | |
188 | diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c |
189 | index 2c6f0f2ecd9d..949b38633496 100644 |
190 | --- a/drivers/infiniband/core/uverbs_main.c |
191 | +++ b/drivers/infiniband/core/uverbs_main.c |
192 | @@ -460,6 +460,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file, |
193 | |
194 | entry->desc.async.element = element; |
195 | entry->desc.async.event_type = event; |
196 | + entry->desc.async.reserved = 0; |
197 | entry->counter = counter; |
198 | |
199 | list_add_tail(&entry->list, &file->async_file->event_list); |
200 | diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c |
201 | index 4d599cedbb0b..6ee534874535 100644 |
202 | --- a/drivers/infiniband/hw/mlx4/mad.c |
203 | +++ b/drivers/infiniband/hw/mlx4/mad.c |
204 | @@ -64,6 +64,14 @@ enum { |
205 | #define GUID_TBL_BLK_NUM_ENTRIES 8 |
206 | #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES) |
207 | |
208 | +/* Counters should be saturate once they reach their maximum value */ |
209 | +#define ASSIGN_32BIT_COUNTER(counter, value) do {\ |
210 | + if ((value) > U32_MAX) \ |
211 | + counter = cpu_to_be32(U32_MAX); \ |
212 | + else \ |
213 | + counter = cpu_to_be32(value); \ |
214 | +} while (0) |
215 | + |
216 | struct mlx4_mad_rcv_buf { |
217 | struct ib_grh grh; |
218 | u8 payload[256]; |
219 | @@ -730,10 +738,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num, |
220 | static void edit_counter(struct mlx4_counter *cnt, |
221 | struct ib_pma_portcounters *pma_cnt) |
222 | { |
223 | - pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2)); |
224 | - pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2)); |
225 | - pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames)); |
226 | - pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames)); |
227 | + ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data, |
228 | + (be64_to_cpu(cnt->tx_bytes) >> 2)); |
229 | + ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data, |
230 | + (be64_to_cpu(cnt->rx_bytes) >> 2)); |
231 | + ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets, |
232 | + be64_to_cpu(cnt->tx_frames)); |
233 | + ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets, |
234 | + be64_to_cpu(cnt->rx_frames)); |
235 | } |
236 | |
237 | static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num, |
238 | diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h |
239 | index f804c1faa7ff..d3b54f7b849f 100644 |
240 | --- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h |
241 | +++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h |
242 | @@ -29,7 +29,7 @@ |
243 | |
244 | /* Offset base used to differentiate between CAPTURE and OUTPUT |
245 | * while mmaping */ |
246 | -#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2) |
247 | +#define DST_QUEUE_OFF_BASE (1 << 30) |
248 | |
249 | #define MFC_BANK1_ALLOC_CTX 0 |
250 | #define MFC_BANK2_ALLOC_CTX 1 |
251 | diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h |
252 | index 71ea77576d22..e783ea0e3837 100644 |
253 | --- a/drivers/net/wireless/iwlwifi/dvm/dev.h |
254 | +++ b/drivers/net/wireless/iwlwifi/dvm/dev.h |
255 | @@ -670,7 +670,6 @@ struct iwl_priv { |
256 | unsigned long reload_jiffies; |
257 | int reload_count; |
258 | bool ucode_loaded; |
259 | - bool init_ucode_run; /* Don't run init uCode again */ |
260 | |
261 | u8 plcp_delta_threshold; |
262 | |
263 | diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c |
264 | index 0a1cdc5e856b..5ad94a8080b8 100644 |
265 | --- a/drivers/net/wireless/iwlwifi/dvm/ucode.c |
266 | +++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c |
267 | @@ -425,9 +425,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv) |
268 | if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len) |
269 | return 0; |
270 | |
271 | - if (priv->init_ucode_run) |
272 | - return 0; |
273 | - |
274 | iwl_init_notification_wait(&priv->notif_wait, &calib_wait, |
275 | calib_complete, ARRAY_SIZE(calib_complete), |
276 | iwlagn_wait_calib, priv); |
277 | @@ -447,8 +444,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv) |
278 | */ |
279 | ret = iwl_wait_notification(&priv->notif_wait, &calib_wait, |
280 | UCODE_CALIB_TIMEOUT); |
281 | - if (!ret) |
282 | - priv->init_ucode_run = true; |
283 | |
284 | goto out; |
285 | |
286 | diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c |
287 | index 1ad39c799c74..bfe812fcce34 100644 |
288 | --- a/drivers/scsi/be2iscsi/be_main.c |
289 | +++ b/drivers/scsi/be2iscsi/be_main.c |
290 | @@ -5080,9 +5080,9 @@ free_port: |
291 | hba_free: |
292 | if (phba->msix_enabled) |
293 | pci_disable_msix(phba->pcidev); |
294 | - iscsi_host_remove(phba->shost); |
295 | pci_dev_put(phba->pcidev); |
296 | iscsi_host_free(phba->shost); |
297 | + pci_set_drvdata(pcidev, NULL); |
298 | disable_pci: |
299 | pci_disable_device(pcidev); |
300 | return ret; |
301 | diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c |
302 | index e5953c8018c5..9f3168e8e5a8 100644 |
303 | --- a/drivers/scsi/scsi_lib.c |
304 | +++ b/drivers/scsi/scsi_lib.c |
305 | @@ -1242,9 +1242,11 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req) |
306 | "rejecting I/O to dead device\n"); |
307 | ret = BLKPREP_KILL; |
308 | break; |
309 | - case SDEV_QUIESCE: |
310 | case SDEV_BLOCK: |
311 | case SDEV_CREATED_BLOCK: |
312 | + ret = BLKPREP_DEFER; |
313 | + break; |
314 | + case SDEV_QUIESCE: |
315 | /* |
316 | * If the devices is blocked we defer normal commands. |
317 | */ |
318 | diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c |
319 | index 9559ea749d83..5a3ea20e9cb5 100644 |
320 | --- a/drivers/target/iscsi/iscsi_target.c |
321 | +++ b/drivers/target/iscsi/iscsi_target.c |
322 | @@ -1179,7 +1179,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, |
323 | * traditional iSCSI block I/O. |
324 | */ |
325 | if (iscsit_allocate_iovecs(cmd) < 0) { |
326 | - return iscsit_add_reject_cmd(cmd, |
327 | + return iscsit_reject_cmd(cmd, |
328 | ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); |
329 | } |
330 | immed_data = cmd->immediate_data; |
331 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c |
332 | index 0e57bcb8e3f7..2320e20d5be7 100644 |
333 | --- a/drivers/usb/host/xhci-pci.c |
334 | +++ b/drivers/usb/host/xhci-pci.c |
335 | @@ -94,6 +94,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
336 | if (pdev->vendor == PCI_VENDOR_ID_INTEL) { |
337 | xhci->quirks |= XHCI_LPM_SUPPORT; |
338 | xhci->quirks |= XHCI_INTEL_HOST; |
339 | + xhci->quirks |= XHCI_AVOID_BEI; |
340 | } |
341 | if (pdev->vendor == PCI_VENDOR_ID_INTEL && |
342 | pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) { |
343 | @@ -109,7 +110,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
344 | * PPT chipsets. |
345 | */ |
346 | xhci->quirks |= XHCI_SPURIOUS_REBOOT; |
347 | - xhci->quirks |= XHCI_AVOID_BEI; |
348 | } |
349 | if (pdev->vendor == PCI_VENDOR_ID_ETRON && |
350 | pdev->device == PCI_DEVICE_ID_ASROCK_P67) { |
351 | diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c |
352 | index cf127a080644..4d918d5f945a 100644 |
353 | --- a/drivers/usb/serial/ftdi_sio.c |
354 | +++ b/drivers/usb/serial/ftdi_sio.c |
355 | @@ -620,6 +620,7 @@ static struct usb_device_id id_table_combined [] = { |
356 | .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, |
357 | { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), |
358 | .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, |
359 | + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, |
360 | /* |
361 | * ELV devices: |
362 | */ |
363 | @@ -1899,8 +1900,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial) |
364 | { |
365 | struct usb_device *udev = serial->dev; |
366 | |
367 | - if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) || |
368 | - (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2"))) |
369 | + if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) |
370 | + return ftdi_jtag_probe(serial); |
371 | + |
372 | + if (udev->product && |
373 | + (!strcmp(udev->product, "BeagleBone/XDS100V2") || |
374 | + !strcmp(udev->product, "SNAP Connect E10"))) |
375 | return ftdi_jtag_probe(serial); |
376 | |
377 | return 0; |
378 | diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h |
379 | index e8d352615297..e906b6aa2424 100644 |
380 | --- a/drivers/usb/serial/ftdi_sio_ids.h |
381 | +++ b/drivers/usb/serial/ftdi_sio_ids.h |
382 | @@ -561,6 +561,12 @@ |
383 | */ |
384 | #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ |
385 | |
386 | +/* |
387 | + * Synapse Wireless product ids (FTDI_VID) |
388 | + * http://www.synapse-wireless.com |
389 | + */ |
390 | +#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */ |
391 | + |
392 | |
393 | /********************************/ |
394 | /** third-party VID/PID combos **/ |
395 | diff --git a/fs/cifs/file.c b/fs/cifs/file.c |
396 | index 5fcc10fa62bd..f4a8577c3e91 100644 |
397 | --- a/fs/cifs/file.c |
398 | +++ b/fs/cifs/file.c |
399 | @@ -1789,6 +1789,7 @@ refind_writable: |
400 | cifsFileInfo_put(inv_file); |
401 | spin_lock(&cifs_file_list_lock); |
402 | ++refind; |
403 | + inv_file = NULL; |
404 | goto refind_writable; |
405 | } |
406 | } |
407 | diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c |
408 | index 46387e49aa46..8cd6474e248f 100644 |
409 | --- a/fs/ocfs2/file.c |
410 | +++ b/fs/ocfs2/file.c |
411 | @@ -2372,10 +2372,14 @@ out_dio: |
412 | /* buffered aio wouldn't have proper lock coverage today */ |
413 | BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT)); |
414 | |
415 | + if (unlikely(written <= 0)) |
416 | + goto no_sync; |
417 | + |
418 | if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) || |
419 | ((file->f_flags & O_DIRECT) && !direct_io)) { |
420 | - ret = filemap_fdatawrite_range(file->f_mapping, *ppos, |
421 | - *ppos + count - 1); |
422 | + ret = filemap_fdatawrite_range(file->f_mapping, |
423 | + iocb->ki_pos - written, |
424 | + iocb->ki_pos - 1); |
425 | if (ret < 0) |
426 | written = ret; |
427 | |
428 | @@ -2388,10 +2392,12 @@ out_dio: |
429 | } |
430 | |
431 | if (!ret) |
432 | - ret = filemap_fdatawait_range(file->f_mapping, *ppos, |
433 | - *ppos + count - 1); |
434 | + ret = filemap_fdatawait_range(file->f_mapping, |
435 | + iocb->ki_pos - written, |
436 | + iocb->ki_pos - 1); |
437 | } |
438 | |
439 | +no_sync: |
440 | /* |
441 | * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io |
442 | * function pointer which is called when o_direct io completes so that |
443 | diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c |
444 | index 65fc60a07c47..9f285fb9bab3 100644 |
445 | --- a/fs/proc/task_mmu.c |
446 | +++ b/fs/proc/task_mmu.c |
447 | @@ -1110,9 +1110,19 @@ out: |
448 | return ret; |
449 | } |
450 | |
451 | +static int pagemap_open(struct inode *inode, struct file *file) |
452 | +{ |
453 | + /* do not disclose physical addresses to unprivileged |
454 | + userspace (closes a rowhammer attack vector) */ |
455 | + if (!capable(CAP_SYS_ADMIN)) |
456 | + return -EPERM; |
457 | + return 0; |
458 | +} |
459 | + |
460 | const struct file_operations proc_pagemap_operations = { |
461 | .llseek = mem_lseek, /* borrow this */ |
462 | .read = pagemap_read, |
463 | + .open = pagemap_open, |
464 | }; |
465 | #endif /* CONFIG_PROC_PAGE_MONITOR */ |
466 | |
467 | diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h |
468 | index fa1abeb45b76..49c48dda162d 100644 |
469 | --- a/include/linux/blk_types.h |
470 | +++ b/include/linux/blk_types.h |
471 | @@ -170,7 +170,9 @@ enum rq_flag_bits { |
472 | __REQ_ELVPRIV, /* elevator private data attached */ |
473 | __REQ_FAILED, /* set if the request failed */ |
474 | __REQ_QUIET, /* don't worry about errors */ |
475 | - __REQ_PREEMPT, /* set for "ide_preempt" requests */ |
476 | + __REQ_PREEMPT, /* set for "ide_preempt" requests and also |
477 | + for requests for which the SCSI "quiesce" |
478 | + state must be ignored. */ |
479 | __REQ_ALLOCED, /* request came from our alloc pool */ |
480 | __REQ_COPY_USER, /* contains copies of user pages */ |
481 | __REQ_FLUSH_SEQ, /* request for flush sequence */ |
482 | diff --git a/include/linux/kernel.h b/include/linux/kernel.h |
483 | index e9ef6d6b51d5..341551c7b4c8 100644 |
484 | --- a/include/linux/kernel.h |
485 | +++ b/include/linux/kernel.h |
486 | @@ -29,6 +29,19 @@ |
487 | #define ULLONG_MAX (~0ULL) |
488 | #define SIZE_MAX (~(size_t)0) |
489 | |
490 | +#define U8_MAX ((u8)~0U) |
491 | +#define S8_MAX ((s8)(U8_MAX>>1)) |
492 | +#define S8_MIN ((s8)(-S8_MAX - 1)) |
493 | +#define U16_MAX ((u16)~0U) |
494 | +#define S16_MAX ((s16)(U16_MAX>>1)) |
495 | +#define S16_MIN ((s16)(-S16_MAX - 1)) |
496 | +#define U32_MAX ((u32)~0U) |
497 | +#define S32_MAX ((s32)(U32_MAX>>1)) |
498 | +#define S32_MIN ((s32)(-S32_MAX - 1)) |
499 | +#define U64_MAX ((u64)~0ULL) |
500 | +#define S64_MAX ((s64)(U64_MAX>>1)) |
501 | +#define S64_MIN ((s64)(-S64_MAX - 1)) |
502 | + |
503 | #define STACK_MAGIC 0xdeadbeef |
504 | |
505 | #define REPEAT_BYTE(x) ((~0ul / 0xff) * (x)) |
506 | diff --git a/ipc/compat.c b/ipc/compat.c |
507 | index 892f6585dd60..d3b376025e9b 100644 |
508 | --- a/ipc/compat.c |
509 | +++ b/ipc/compat.c |
510 | @@ -381,7 +381,7 @@ COMPAT_SYSCALL_DEFINE6(ipc, u32, call, int, first, int, second, |
511 | uptr = compat_ptr(ipck.msgp); |
512 | fifth = ipck.msgtyp; |
513 | } |
514 | - return do_msgrcv(first, uptr, second, fifth, third, |
515 | + return do_msgrcv(first, uptr, second, (s32)fifth, third, |
516 | compat_do_msg_fill); |
517 | } |
518 | case MSGGET: |
519 | diff --git a/kernel/printk.c b/kernel/printk.c |
520 | index f7aff4bd5454..fd0154a57d6e 100644 |
521 | --- a/kernel/printk.c |
522 | +++ b/kernel/printk.c |
523 | @@ -107,7 +107,7 @@ static struct console *exclusive_console; |
524 | */ |
525 | struct console_cmdline |
526 | { |
527 | - char name[8]; /* Name of the driver */ |
528 | + char name[16]; /* Name of the driver */ |
529 | int index; /* Minor dev. to use */ |
530 | char *options; /* Options for the driver */ |
531 | #ifdef CONFIG_A11Y_BRAILLE_CONSOLE |
532 | @@ -2290,6 +2290,8 @@ void register_console(struct console *newcon) |
533 | */ |
534 | for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; |
535 | i++) { |
536 | + BUILD_BUG_ON(sizeof(console_cmdline[i].name) != |
537 | + sizeof(newcon->name)); |
538 | if (strcmp(console_cmdline[i].name, newcon->name) != 0) |
539 | continue; |
540 | if (newcon->index >= 0 && |
541 | diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c |
542 | index 1ad92b46753e..2298237db142 100644 |
543 | --- a/mm/memory_hotplug.c |
544 | +++ b/mm/memory_hotplug.c |
545 | @@ -1039,6 +1039,10 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start) |
546 | return NULL; |
547 | |
548 | arch_refresh_nodedata(nid, pgdat); |
549 | + } else { |
550 | + /* Reset the nr_zones and classzone_idx to 0 before reuse */ |
551 | + pgdat->nr_zones = 0; |
552 | + pgdat->classzone_idx = 0; |
553 | } |
554 | |
555 | /* we can use NODE_DATA(nid) from here */ |
556 | @@ -1802,15 +1806,6 @@ void try_offline_node(int nid) |
557 | if (is_vmalloc_addr(zone->wait_table)) |
558 | vfree(zone->wait_table); |
559 | } |
560 | - |
561 | - /* |
562 | - * Since there is no way to guarentee the address of pgdat/zone is not |
563 | - * on stack of any kernel threads or used by other kernel objects |
564 | - * without reference counting or other symchronizing method, do not |
565 | - * reset node_data and free pgdat here. Just reset it to 0 and reuse |
566 | - * the memory when the node is online again. |
567 | - */ |
568 | - memset(pgdat, 0, sizeof(*pgdat)); |
569 | } |
570 | EXPORT_SYMBOL(try_offline_node); |
571 | |
572 | diff --git a/mm/page-writeback.c b/mm/page-writeback.c |
573 | index 73cbc5dc150b..b034f79deb0e 100644 |
574 | --- a/mm/page-writeback.c |
575 | +++ b/mm/page-writeback.c |
576 | @@ -793,8 +793,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi, |
577 | * bw * elapsed + write_bandwidth * (period - elapsed) |
578 | * write_bandwidth = --------------------------------------------------- |
579 | * period |
580 | + * |
581 | + * @written may have decreased due to account_page_redirty(). |
582 | + * Avoid underflowing @bw calculation. |
583 | */ |
584 | - bw = written - bdi->written_stamp; |
585 | + bw = written - min(written, bdi->written_stamp); |
586 | bw *= HZ; |
587 | if (unlikely(elapsed > period)) { |
588 | do_div(bw, elapsed); |
589 | @@ -858,7 +861,7 @@ static void global_update_bandwidth(unsigned long thresh, |
590 | unsigned long now) |
591 | { |
592 | static DEFINE_SPINLOCK(dirty_lock); |
593 | - static unsigned long update_time; |
594 | + static unsigned long update_time = INITIAL_JIFFIES; |
595 | |
596 | /* |
597 | * check locklessly first to optimize away locking for the most time |
598 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
599 | index 913dc4f49b10..92b5e1f7d3b0 100644 |
600 | --- a/net/ipv4/tcp_output.c |
601 | +++ b/net/ipv4/tcp_output.c |
602 | @@ -2909,6 +2909,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) |
603 | goto fallback; |
604 | syn_data->ip_summed = CHECKSUM_PARTIAL; |
605 | memcpy(syn_data->cb, syn->cb, sizeof(syn->cb)); |
606 | + skb_shinfo(syn_data)->gso_segs = 1; |
607 | if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space), |
608 | fo->data->msg_iov, 0, space))) { |
609 | kfree_skb(syn_data); |
610 | diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c |
611 | index 612a5ddaf93b..799bafc2af39 100644 |
612 | --- a/net/llc/sysctl_net_llc.c |
613 | +++ b/net/llc/sysctl_net_llc.c |
614 | @@ -18,28 +18,28 @@ static struct ctl_table llc2_timeout_table[] = { |
615 | { |
616 | .procname = "ack", |
617 | .data = &sysctl_llc2_ack_timeout, |
618 | - .maxlen = sizeof(long), |
619 | + .maxlen = sizeof(sysctl_llc2_ack_timeout), |
620 | .mode = 0644, |
621 | .proc_handler = proc_dointvec_jiffies, |
622 | }, |
623 | { |
624 | .procname = "busy", |
625 | .data = &sysctl_llc2_busy_timeout, |
626 | - .maxlen = sizeof(long), |
627 | + .maxlen = sizeof(sysctl_llc2_busy_timeout), |
628 | .mode = 0644, |
629 | .proc_handler = proc_dointvec_jiffies, |
630 | }, |
631 | { |
632 | .procname = "p", |
633 | .data = &sysctl_llc2_p_timeout, |
634 | - .maxlen = sizeof(long), |
635 | + .maxlen = sizeof(sysctl_llc2_p_timeout), |
636 | .mode = 0644, |
637 | .proc_handler = proc_dointvec_jiffies, |
638 | }, |
639 | { |
640 | .procname = "rej", |
641 | .data = &sysctl_llc2_rej_timeout, |
642 | - .maxlen = sizeof(long), |
643 | + .maxlen = sizeof(sysctl_llc2_rej_timeout), |
644 | .mode = 0644, |
645 | .proc_handler = proc_dointvec_jiffies, |
646 | }, |
647 | diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c |
648 | index 2b8199f68785..5497f50af2f0 100644 |
649 | --- a/net/netfilter/nfnetlink_queue_core.c |
650 | +++ b/net/netfilter/nfnetlink_queue_core.c |
651 | @@ -228,7 +228,7 @@ nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data) |
652 | } |
653 | |
654 | static int |
655 | -nfqnl_zcopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen) |
656 | +nfqnl_zcopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) |
657 | { |
658 | int i, j = 0; |
659 | int plen = 0; /* length of skb->head fragment */ |
660 | diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c |
661 | index 907214b4c4d0..fc6cbe827856 100644 |
662 | --- a/net/rds/sysctl.c |
663 | +++ b/net/rds/sysctl.c |
664 | @@ -71,14 +71,14 @@ static ctl_table rds_sysctl_rds_table[] = { |
665 | { |
666 | .procname = "max_unacked_packets", |
667 | .data = &rds_sysctl_max_unacked_packets, |
668 | - .maxlen = sizeof(unsigned long), |
669 | + .maxlen = sizeof(int), |
670 | .mode = 0644, |
671 | .proc_handler = proc_dointvec, |
672 | }, |
673 | { |
674 | .procname = "max_unacked_bytes", |
675 | .data = &rds_sysctl_max_unacked_bytes, |
676 | - .maxlen = sizeof(unsigned long), |
677 | + .maxlen = sizeof(int), |
678 | .mode = 0644, |
679 | .proc_handler = proc_dointvec, |
680 | }, |
681 | diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c |
682 | index ff427733c290..464be51025f6 100644 |
683 | --- a/security/selinux/selinuxfs.c |
684 | +++ b/security/selinux/selinuxfs.c |
685 | @@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, |
686 | goto out; |
687 | |
688 | /* No partial writes. */ |
689 | - length = EINVAL; |
690 | + length = -EINVAL; |
691 | if (*ppos != 0) |
692 | goto out; |
693 | |
694 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
695 | index 4008034b6ebe..a8eb7fe2766e 100644 |
696 | --- a/sound/pci/hda/patch_realtek.c |
697 | +++ b/sound/pci/hda/patch_realtek.c |
698 | @@ -266,7 +266,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on) |
699 | { |
700 | /* We currently only handle front, HP */ |
701 | static hda_nid_t pins[] = { |
702 | - 0x0f, 0x10, 0x14, 0x15, 0 |
703 | + 0x0f, 0x10, 0x14, 0x15, 0x17, 0 |
704 | }; |
705 | hda_nid_t *p; |
706 | for (p = pins; *p; p++) |
707 | @@ -3363,6 +3363,7 @@ enum { |
708 | ALC269_FIXUP_QUANTA_MUTE, |
709 | ALC269_FIXUP_LIFEBOOK, |
710 | ALC269_FIXUP_LIFEBOOK_EXTMIC, |
711 | + ALC269_FIXUP_LIFEBOOK_HP_PIN, |
712 | ALC269_FIXUP_AMIC, |
713 | ALC269_FIXUP_DMIC, |
714 | ALC269VB_FIXUP_AMIC, |
715 | @@ -3477,6 +3478,13 @@ static const struct hda_fixup alc269_fixups[] = { |
716 | { } |
717 | }, |
718 | }, |
719 | + [ALC269_FIXUP_LIFEBOOK_HP_PIN] = { |
720 | + .type = HDA_FIXUP_PINS, |
721 | + .v.pins = (const struct hda_pintbl[]) { |
722 | + { 0x21, 0x0221102f }, /* HP out */ |
723 | + { } |
724 | + }, |
725 | + }, |
726 | [ALC269_FIXUP_AMIC] = { |
727 | .type = HDA_FIXUP_PINS, |
728 | .v.pins = (const struct hda_pintbl[]) { |
729 | @@ -3727,6 +3735,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { |
730 | SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK), |
731 | SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC), |
732 | SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), |
733 | + SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), |
734 | SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), |
735 | SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), |
736 | SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), |
737 | diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c |
738 | index c89a5bf5c00e..c311681bd390 100644 |
739 | --- a/sound/usb/mixer_quirks.c |
740 | +++ b/sound/usb/mixer_quirks.c |
741 | @@ -175,6 +175,7 @@ static const struct rc_config { |
742 | { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */ |
743 | { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ |
744 | { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ |
745 | + { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ |
746 | { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ |
747 | }; |
748 |