Contents of /trunk/kernel-alx/patches-3.14/0108-3.14.9-all-fixes.patch
Parent Directory | Revision Log
Revision 2506 -
(show annotations)
(download)
Fri Oct 17 07:55:45 2014 UTC (9 years, 11 months ago) by niro
File size: 108101 byte(s)
Fri Oct 17 07:55:45 2014 UTC (9 years, 11 months ago) by niro
File size: 108101 byte(s)
-patches for 3.14
1 | diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy |
2 | index f1c5cc9d17a8..4c3efe434806 100644 |
3 | --- a/Documentation/ABI/testing/ima_policy |
4 | +++ b/Documentation/ABI/testing/ima_policy |
5 | @@ -23,7 +23,7 @@ Description: |
6 | [fowner]] |
7 | lsm: [[subj_user=] [subj_role=] [subj_type=] |
8 | [obj_user=] [obj_role=] [obj_type=]] |
9 | - option: [[appraise_type=]] |
10 | + option: [[appraise_type=]] [permit_directio] |
11 | |
12 | base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] |
13 | mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] |
14 | diff --git a/Makefile b/Makefile |
15 | index ef1d59b750ea..ee247656432f 100644 |
16 | --- a/Makefile |
17 | +++ b/Makefile |
18 | @@ -1,6 +1,6 @@ |
19 | VERSION = 3 |
20 | PATCHLEVEL = 14 |
21 | -SUBLEVEL = 8 |
22 | +SUBLEVEL = 9 |
23 | EXTRAVERSION = |
24 | NAME = Remembering Coco |
25 | |
26 | diff --git a/arch/arm/mach-at91/sysirq_mask.c b/arch/arm/mach-at91/sysirq_mask.c |
27 | index 2ba694f9626b..f8bc3511a8c8 100644 |
28 | --- a/arch/arm/mach-at91/sysirq_mask.c |
29 | +++ b/arch/arm/mach-at91/sysirq_mask.c |
30 | @@ -25,24 +25,28 @@ |
31 | |
32 | #include "generic.h" |
33 | |
34 | -#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */ |
35 | -#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */ |
36 | +#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */ |
37 | +#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */ |
38 | +#define AT91_RTC_IRQ_MASK 0x1f /* Available IRQs mask */ |
39 | |
40 | void __init at91_sysirq_mask_rtc(u32 rtc_base) |
41 | { |
42 | void __iomem *base; |
43 | - u32 mask; |
44 | |
45 | base = ioremap(rtc_base, 64); |
46 | if (!base) |
47 | return; |
48 | |
49 | - mask = readl_relaxed(base + AT91_RTC_IMR); |
50 | - if (mask) { |
51 | - pr_info("AT91: Disabling rtc irq\n"); |
52 | - writel_relaxed(mask, base + AT91_RTC_IDR); |
53 | - (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */ |
54 | - } |
55 | + /* |
56 | + * sam9x5 SoCs have the following errata: |
57 | + * "RTC: Interrupt Mask Register cannot be used |
58 | + * Interrupt Mask Register read always returns 0." |
59 | + * |
60 | + * Hence we're not relying on IMR values to disable |
61 | + * interrupts. |
62 | + */ |
63 | + writel_relaxed(AT91_RTC_IRQ_MASK, base + AT91_RTC_IDR); |
64 | + (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */ |
65 | |
66 | iounmap(base); |
67 | } |
68 | diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c |
69 | index da5186fbd77a..5efce56f0df0 100644 |
70 | --- a/arch/mips/kvm/kvm_mips.c |
71 | +++ b/arch/mips/kvm/kvm_mips.c |
72 | @@ -304,7 +304,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) |
73 | if (cpu_has_veic || cpu_has_vint) { |
74 | size = 0x200 + VECTORSPACING * 64; |
75 | } else { |
76 | - size = 0x200; |
77 | + size = 0x4000; |
78 | } |
79 | |
80 | /* Save Linux EBASE */ |
81 | diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c |
82 | index 01fe9946d388..44d258da0a1b 100644 |
83 | --- a/arch/sparc/net/bpf_jit_comp.c |
84 | +++ b/arch/sparc/net/bpf_jit_comp.c |
85 | @@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start_, void *end_) |
86 | #define BNE (F2(0, 2) | CONDNE) |
87 | |
88 | #ifdef CONFIG_SPARC64 |
89 | -#define BNE_PTR (F2(0, 1) | CONDNE | (2 << 20)) |
90 | +#define BE_PTR (F2(0, 1) | CONDE | (2 << 20)) |
91 | #else |
92 | -#define BNE_PTR BNE |
93 | +#define BE_PTR BE |
94 | #endif |
95 | |
96 | #define SETHI(K, REG) \ |
97 | @@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *fp) |
98 | case BPF_S_ANC_IFINDEX: |
99 | emit_skb_loadptr(dev, r_A); |
100 | emit_cmpi(r_A, 0); |
101 | - emit_branch(BNE_PTR, cleanup_addr + 4); |
102 | + emit_branch(BE_PTR, cleanup_addr + 4); |
103 | emit_nop(); |
104 | emit_load32(r_A, struct net_device, ifindex, r_A); |
105 | break; |
106 | @@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *fp) |
107 | case BPF_S_ANC_HATYPE: |
108 | emit_skb_loadptr(dev, r_A); |
109 | emit_cmpi(r_A, 0); |
110 | - emit_branch(BNE_PTR, cleanup_addr + 4); |
111 | + emit_branch(BE_PTR, cleanup_addr + 4); |
112 | emit_nop(); |
113 | emit_load16(r_A, struct net_device, type, r_A); |
114 | break; |
115 | diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c |
116 | index 9736529ade08..006911858174 100644 |
117 | --- a/arch/x86/kvm/lapic.c |
118 | +++ b/arch/x86/kvm/lapic.c |
119 | @@ -360,6 +360,8 @@ static inline void apic_clear_irr(int vec, struct kvm_lapic *apic) |
120 | |
121 | static inline void apic_set_isr(int vec, struct kvm_lapic *apic) |
122 | { |
123 | + /* Note that we never get here with APIC virtualization enabled. */ |
124 | + |
125 | if (!__apic_test_and_set_vector(vec, apic->regs + APIC_ISR)) |
126 | ++apic->isr_count; |
127 | BUG_ON(apic->isr_count > MAX_APIC_VECTOR); |
128 | @@ -371,12 +373,48 @@ static inline void apic_set_isr(int vec, struct kvm_lapic *apic) |
129 | apic->highest_isr_cache = vec; |
130 | } |
131 | |
132 | +static inline int apic_find_highest_isr(struct kvm_lapic *apic) |
133 | +{ |
134 | + int result; |
135 | + |
136 | + /* |
137 | + * Note that isr_count is always 1, and highest_isr_cache |
138 | + * is always -1, with APIC virtualization enabled. |
139 | + */ |
140 | + if (!apic->isr_count) |
141 | + return -1; |
142 | + if (likely(apic->highest_isr_cache != -1)) |
143 | + return apic->highest_isr_cache; |
144 | + |
145 | + result = find_highest_vector(apic->regs + APIC_ISR); |
146 | + ASSERT(result == -1 || result >= 16); |
147 | + |
148 | + return result; |
149 | +} |
150 | + |
151 | static inline void apic_clear_isr(int vec, struct kvm_lapic *apic) |
152 | { |
153 | - if (__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR)) |
154 | + struct kvm_vcpu *vcpu; |
155 | + if (!__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR)) |
156 | + return; |
157 | + |
158 | + vcpu = apic->vcpu; |
159 | + |
160 | + /* |
161 | + * We do get here for APIC virtualization enabled if the guest |
162 | + * uses the Hyper-V APIC enlightenment. In this case we may need |
163 | + * to trigger a new interrupt delivery by writing the SVI field; |
164 | + * on the other hand isr_count and highest_isr_cache are unused |
165 | + * and must be left alone. |
166 | + */ |
167 | + if (unlikely(kvm_apic_vid_enabled(vcpu->kvm))) |
168 | + kvm_x86_ops->hwapic_isr_update(vcpu->kvm, |
169 | + apic_find_highest_isr(apic)); |
170 | + else { |
171 | --apic->isr_count; |
172 | - BUG_ON(apic->isr_count < 0); |
173 | - apic->highest_isr_cache = -1; |
174 | + BUG_ON(apic->isr_count < 0); |
175 | + apic->highest_isr_cache = -1; |
176 | + } |
177 | } |
178 | |
179 | int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu) |
180 | @@ -456,22 +494,6 @@ static void pv_eoi_clr_pending(struct kvm_vcpu *vcpu) |
181 | __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention); |
182 | } |
183 | |
184 | -static inline int apic_find_highest_isr(struct kvm_lapic *apic) |
185 | -{ |
186 | - int result; |
187 | - |
188 | - /* Note that isr_count is always 1 with vid enabled */ |
189 | - if (!apic->isr_count) |
190 | - return -1; |
191 | - if (likely(apic->highest_isr_cache != -1)) |
192 | - return apic->highest_isr_cache; |
193 | - |
194 | - result = find_highest_vector(apic->regs + APIC_ISR); |
195 | - ASSERT(result == -1 || result >= 16); |
196 | - |
197 | - return result; |
198 | -} |
199 | - |
200 | void kvm_apic_update_tmr(struct kvm_vcpu *vcpu, u32 *tmr) |
201 | { |
202 | struct kvm_lapic *apic = vcpu->arch.apic; |
203 | @@ -1605,6 +1627,8 @@ int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu) |
204 | int vector = kvm_apic_has_interrupt(vcpu); |
205 | struct kvm_lapic *apic = vcpu->arch.apic; |
206 | |
207 | + /* Note that we never get here with APIC virtualization enabled. */ |
208 | + |
209 | if (vector == -1) |
210 | return -1; |
211 | |
212 | diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c |
213 | index 1512e41cd93d..43665d0d0905 100644 |
214 | --- a/crypto/crypto_user.c |
215 | +++ b/crypto/crypto_user.c |
216 | @@ -466,7 +466,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) |
217 | type -= CRYPTO_MSG_BASE; |
218 | link = &crypto_dispatch[type]; |
219 | |
220 | - if (!capable(CAP_NET_ADMIN)) |
221 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
222 | return -EPERM; |
223 | |
224 | if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) && |
225 | diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c |
226 | index 18c5b9b16645..3165811e2407 100644 |
227 | --- a/drivers/connector/cn_proc.c |
228 | +++ b/drivers/connector/cn_proc.c |
229 | @@ -369,7 +369,7 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg, |
230 | return; |
231 | |
232 | /* Can only change if privileged. */ |
233 | - if (!capable(CAP_NET_ADMIN)) { |
234 | + if (!__netlink_ns_capable(nsp, &init_user_ns, CAP_NET_ADMIN)) { |
235 | err = EPERM; |
236 | goto out; |
237 | } |
238 | diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c |
239 | index 2e7801af466e..05827eccc53a 100644 |
240 | --- a/drivers/hv/connection.c |
241 | +++ b/drivers/hv/connection.c |
242 | @@ -224,8 +224,8 @@ cleanup: |
243 | vmbus_connection.int_page = NULL; |
244 | } |
245 | |
246 | - free_pages((unsigned long)vmbus_connection.monitor_pages[0], 1); |
247 | - free_pages((unsigned long)vmbus_connection.monitor_pages[1], 1); |
248 | + free_pages((unsigned long)vmbus_connection.monitor_pages[0], 0); |
249 | + free_pages((unsigned long)vmbus_connection.monitor_pages[1], 0); |
250 | vmbus_connection.monitor_pages[0] = NULL; |
251 | vmbus_connection.monitor_pages[1] = NULL; |
252 | |
253 | diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c |
254 | index 7e17a5495e02..393fd8a98735 100644 |
255 | --- a/drivers/hv/hv_balloon.c |
256 | +++ b/drivers/hv/hv_balloon.c |
257 | @@ -19,6 +19,7 @@ |
258 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
259 | |
260 | #include <linux/kernel.h> |
261 | +#include <linux/jiffies.h> |
262 | #include <linux/mman.h> |
263 | #include <linux/delay.h> |
264 | #include <linux/init.h> |
265 | @@ -459,6 +460,11 @@ static bool do_hot_add; |
266 | */ |
267 | static uint pressure_report_delay = 45; |
268 | |
269 | +/* |
270 | + * The last time we posted a pressure report to host. |
271 | + */ |
272 | +static unsigned long last_post_time; |
273 | + |
274 | module_param(hot_add, bool, (S_IRUGO | S_IWUSR)); |
275 | MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add"); |
276 | |
277 | @@ -542,6 +548,7 @@ struct hv_dynmem_device { |
278 | |
279 | static struct hv_dynmem_device dm_device; |
280 | |
281 | +static void post_status(struct hv_dynmem_device *dm); |
282 | #ifdef CONFIG_MEMORY_HOTPLUG |
283 | |
284 | static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size) |
285 | @@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size, |
286 | * have not been "onlined" within the allowed time. |
287 | */ |
288 | wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ); |
289 | - |
290 | + post_status(&dm_device); |
291 | } |
292 | |
293 | return; |
294 | @@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem_device *dm) |
295 | { |
296 | struct dm_status status; |
297 | struct sysinfo val; |
298 | + unsigned long now = jiffies; |
299 | + unsigned long last_post = last_post_time; |
300 | |
301 | if (pressure_report_delay > 0) { |
302 | --pressure_report_delay; |
303 | return; |
304 | } |
305 | + |
306 | + if (!time_after(now, (last_post_time + HZ))) |
307 | + return; |
308 | + |
309 | si_meminfo(&val); |
310 | memset(&status, 0, sizeof(struct dm_status)); |
311 | status.hdr.type = DM_STATUS_REPORT; |
312 | @@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem_device *dm) |
313 | if (status.hdr.trans_id != atomic_read(&trans_id)) |
314 | return; |
315 | |
316 | + /* |
317 | + * If the last post time that we sampled has changed, |
318 | + * we have raced, don't post the status. |
319 | + */ |
320 | + if (last_post != last_post_time) |
321 | + return; |
322 | + |
323 | + last_post_time = jiffies; |
324 | vmbus_sendpacket(dm->dev->channel, &status, |
325 | sizeof(struct dm_status), |
326 | (unsigned long)NULL, |
327 | @@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struct *dummy) |
328 | |
329 | if (ret == -EAGAIN) |
330 | msleep(20); |
331 | - |
332 | + post_status(&dm_device); |
333 | } while (ret == -EAGAIN); |
334 | |
335 | if (ret) { |
336 | @@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynmem_device *dm, |
337 | struct dm_unballoon_response resp; |
338 | int i; |
339 | |
340 | - for (i = 0; i < range_count; i++) |
341 | + for (i = 0; i < range_count; i++) { |
342 | free_balloon_pages(dm, &range_array[i]); |
343 | + post_status(&dm_device); |
344 | + } |
345 | |
346 | if (req->more_pages == 1) |
347 | return; |
348 | diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c |
349 | index bbba014c9939..e6bf77d1ec08 100644 |
350 | --- a/drivers/iio/adc/at91_adc.c |
351 | +++ b/drivers/iio/adc/at91_adc.c |
352 | @@ -322,12 +322,11 @@ static int at91_adc_channel_init(struct iio_dev *idev) |
353 | return idev->num_channels; |
354 | } |
355 | |
356 | -static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev, |
357 | +static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev, |
358 | struct at91_adc_trigger *triggers, |
359 | const char *trigger_name) |
360 | { |
361 | struct at91_adc_state *st = iio_priv(idev); |
362 | - u8 value = 0; |
363 | int i; |
364 | |
365 | for (i = 0; i < st->trigger_number; i++) { |
366 | @@ -340,15 +339,16 @@ static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev, |
367 | return -ENOMEM; |
368 | |
369 | if (strcmp(trigger_name, name) == 0) { |
370 | - value = triggers[i].value; |
371 | kfree(name); |
372 | - break; |
373 | + if (triggers[i].value == 0) |
374 | + return -EINVAL; |
375 | + return triggers[i].value; |
376 | } |
377 | |
378 | kfree(name); |
379 | } |
380 | |
381 | - return value; |
382 | + return -EINVAL; |
383 | } |
384 | |
385 | static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) |
386 | @@ -358,14 +358,14 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) |
387 | struct iio_buffer *buffer = idev->buffer; |
388 | struct at91_adc_reg_desc *reg = st->registers; |
389 | u32 status = at91_adc_readl(st, reg->trigger_register); |
390 | - u8 value; |
391 | + int value; |
392 | u8 bit; |
393 | |
394 | value = at91_adc_get_trigger_value_by_name(idev, |
395 | st->trigger_list, |
396 | idev->trig->name); |
397 | - if (value == 0) |
398 | - return -EINVAL; |
399 | + if (value < 0) |
400 | + return value; |
401 | |
402 | if (state) { |
403 | st->buffer = kmalloc(idev->scan_bytes, GFP_KERNEL); |
404 | diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c |
405 | index 360259266d4f..ef5ffc0c37a4 100644 |
406 | --- a/drivers/iio/adc/max1363.c |
407 | +++ b/drivers/iio/adc/max1363.c |
408 | @@ -1258,8 +1258,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { |
409 | .num_modes = ARRAY_SIZE(max1238_mode_list), |
410 | .default_mode = s0to11, |
411 | .info = &max1238_info, |
412 | - .channels = max1238_channels, |
413 | - .num_channels = ARRAY_SIZE(max1238_channels), |
414 | + .channels = max1038_channels, |
415 | + .num_channels = ARRAY_SIZE(max1038_channels), |
416 | }, |
417 | [max11605] = { |
418 | .bits = 8, |
419 | @@ -1268,8 +1268,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { |
420 | .num_modes = ARRAY_SIZE(max1238_mode_list), |
421 | .default_mode = s0to11, |
422 | .info = &max1238_info, |
423 | - .channels = max1238_channels, |
424 | - .num_channels = ARRAY_SIZE(max1238_channels), |
425 | + .channels = max1038_channels, |
426 | + .num_channels = ARRAY_SIZE(max1038_channels), |
427 | }, |
428 | [max11606] = { |
429 | .bits = 10, |
430 | @@ -1318,8 +1318,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { |
431 | .num_modes = ARRAY_SIZE(max1238_mode_list), |
432 | .default_mode = s0to11, |
433 | .info = &max1238_info, |
434 | - .channels = max1238_channels, |
435 | - .num_channels = ARRAY_SIZE(max1238_channels), |
436 | + .channels = max1138_channels, |
437 | + .num_channels = ARRAY_SIZE(max1138_channels), |
438 | }, |
439 | [max11611] = { |
440 | .bits = 10, |
441 | @@ -1328,8 +1328,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { |
442 | .num_modes = ARRAY_SIZE(max1238_mode_list), |
443 | .default_mode = s0to11, |
444 | .info = &max1238_info, |
445 | - .channels = max1238_channels, |
446 | - .num_channels = ARRAY_SIZE(max1238_channels), |
447 | + .channels = max1138_channels, |
448 | + .num_channels = ARRAY_SIZE(max1138_channels), |
449 | }, |
450 | [max11612] = { |
451 | .bits = 12, |
452 | diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c |
453 | index 05423543f89d..053117c02bbc 100644 |
454 | --- a/drivers/iio/magnetometer/ak8975.c |
455 | +++ b/drivers/iio/magnetometer/ak8975.c |
456 | @@ -352,8 +352,6 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val) |
457 | { |
458 | struct ak8975_data *data = iio_priv(indio_dev); |
459 | struct i2c_client *client = data->client; |
460 | - u16 meas_reg; |
461 | - s16 raw; |
462 | int ret; |
463 | |
464 | mutex_lock(&data->lock); |
465 | @@ -401,16 +399,11 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val) |
466 | dev_err(&client->dev, "Read axis data fails\n"); |
467 | goto exit; |
468 | } |
469 | - meas_reg = ret; |
470 | |
471 | mutex_unlock(&data->lock); |
472 | |
473 | - /* Endian conversion of the measured values. */ |
474 | - raw = (s16) (le16_to_cpu(meas_reg)); |
475 | - |
476 | /* Clamp to valid range. */ |
477 | - raw = clamp_t(s16, raw, -4096, 4095); |
478 | - *val = raw; |
479 | + *val = clamp_t(s16, ret, -4096, 4095); |
480 | return IIO_VAL_INT; |
481 | |
482 | exit: |
483 | diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c |
484 | index ac8c8ab723e5..fe53669eeeeb 100644 |
485 | --- a/drivers/iio/pressure/mpl3115.c |
486 | +++ b/drivers/iio/pressure/mpl3115.c |
487 | @@ -98,7 +98,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev, |
488 | mutex_unlock(&data->lock); |
489 | if (ret < 0) |
490 | return ret; |
491 | - *val = sign_extend32(be32_to_cpu(tmp) >> 12, 23); |
492 | + *val = be32_to_cpu(tmp) >> 12; |
493 | return IIO_VAL_INT; |
494 | case IIO_TEMP: /* in 0.0625 celsius / LSB */ |
495 | mutex_lock(&data->lock); |
496 | @@ -112,7 +112,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev, |
497 | mutex_unlock(&data->lock); |
498 | if (ret < 0) |
499 | return ret; |
500 | - *val = sign_extend32(be32_to_cpu(tmp) >> 20, 15); |
501 | + *val = sign_extend32(be32_to_cpu(tmp) >> 20, 11); |
502 | return IIO_VAL_INT; |
503 | default: |
504 | return -EINVAL; |
505 | @@ -185,7 +185,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { |
506 | BIT(IIO_CHAN_INFO_SCALE), |
507 | .scan_index = 0, |
508 | .scan_type = { |
509 | - .sign = 's', |
510 | + .sign = 'u', |
511 | .realbits = 20, |
512 | .storagebits = 32, |
513 | .shift = 12, |
514 | diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c |
515 | index 95c316bb7a42..4a13b0001471 100644 |
516 | --- a/drivers/net/ethernet/mellanox/mlx4/main.c |
517 | +++ b/drivers/net/ethernet/mellanox/mlx4/main.c |
518 | @@ -2275,13 +2275,8 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data) |
519 | /* Allow large DMA segments, up to the firmware limit of 1 GB */ |
520 | dma_set_max_seg_size(&pdev->dev, 1024 * 1024 * 1024); |
521 | |
522 | - priv = kzalloc(sizeof(*priv), GFP_KERNEL); |
523 | - if (!priv) { |
524 | - err = -ENOMEM; |
525 | - goto err_release_regions; |
526 | - } |
527 | - |
528 | - dev = &priv->dev; |
529 | + dev = pci_get_drvdata(pdev); |
530 | + priv = mlx4_priv(dev); |
531 | dev->pdev = pdev; |
532 | INIT_LIST_HEAD(&priv->ctx_list); |
533 | spin_lock_init(&priv->ctx_lock); |
534 | @@ -2465,8 +2460,7 @@ slave_start: |
535 | mlx4_sense_init(dev); |
536 | mlx4_start_sense(dev); |
537 | |
538 | - priv->pci_dev_data = pci_dev_data; |
539 | - pci_set_drvdata(pdev, dev); |
540 | + priv->removed = 0; |
541 | |
542 | return 0; |
543 | |
544 | @@ -2532,84 +2526,108 @@ err_disable_pdev: |
545 | |
546 | static int mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id) |
547 | { |
548 | + struct mlx4_priv *priv; |
549 | + struct mlx4_dev *dev; |
550 | + |
551 | printk_once(KERN_INFO "%s", mlx4_version); |
552 | |
553 | + priv = kzalloc(sizeof(*priv), GFP_KERNEL); |
554 | + if (!priv) |
555 | + return -ENOMEM; |
556 | + |
557 | + dev = &priv->dev; |
558 | + pci_set_drvdata(pdev, dev); |
559 | + priv->pci_dev_data = id->driver_data; |
560 | + |
561 | return __mlx4_init_one(pdev, id->driver_data); |
562 | } |
563 | |
564 | -static void mlx4_remove_one(struct pci_dev *pdev) |
565 | +static void __mlx4_remove_one(struct pci_dev *pdev) |
566 | { |
567 | struct mlx4_dev *dev = pci_get_drvdata(pdev); |
568 | struct mlx4_priv *priv = mlx4_priv(dev); |
569 | + int pci_dev_data; |
570 | int p; |
571 | |
572 | - if (dev) { |
573 | - /* in SRIOV it is not allowed to unload the pf's |
574 | - * driver while there are alive vf's */ |
575 | - if (mlx4_is_master(dev)) { |
576 | - if (mlx4_how_many_lives_vf(dev)) |
577 | - printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n"); |
578 | - } |
579 | - mlx4_stop_sense(dev); |
580 | - mlx4_unregister_device(dev); |
581 | + if (priv->removed) |
582 | + return; |
583 | |
584 | - for (p = 1; p <= dev->caps.num_ports; p++) { |
585 | - mlx4_cleanup_port_info(&priv->port[p]); |
586 | - mlx4_CLOSE_PORT(dev, p); |
587 | - } |
588 | + pci_dev_data = priv->pci_dev_data; |
589 | |
590 | - if (mlx4_is_master(dev)) |
591 | - mlx4_free_resource_tracker(dev, |
592 | - RES_TR_FREE_SLAVES_ONLY); |
593 | - |
594 | - mlx4_cleanup_counters_table(dev); |
595 | - mlx4_cleanup_qp_table(dev); |
596 | - mlx4_cleanup_srq_table(dev); |
597 | - mlx4_cleanup_cq_table(dev); |
598 | - mlx4_cmd_use_polling(dev); |
599 | - mlx4_cleanup_eq_table(dev); |
600 | - mlx4_cleanup_mcg_table(dev); |
601 | - mlx4_cleanup_mr_table(dev); |
602 | - mlx4_cleanup_xrcd_table(dev); |
603 | - mlx4_cleanup_pd_table(dev); |
604 | + /* in SRIOV it is not allowed to unload the pf's |
605 | + * driver while there are alive vf's */ |
606 | + if (mlx4_is_master(dev) && mlx4_how_many_lives_vf(dev)) |
607 | + printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n"); |
608 | + mlx4_stop_sense(dev); |
609 | + mlx4_unregister_device(dev); |
610 | |
611 | - if (mlx4_is_master(dev)) |
612 | - mlx4_free_resource_tracker(dev, |
613 | - RES_TR_FREE_STRUCTS_ONLY); |
614 | - |
615 | - iounmap(priv->kar); |
616 | - mlx4_uar_free(dev, &priv->driver_uar); |
617 | - mlx4_cleanup_uar_table(dev); |
618 | - if (!mlx4_is_slave(dev)) |
619 | - mlx4_clear_steering(dev); |
620 | - mlx4_free_eq_table(dev); |
621 | - if (mlx4_is_master(dev)) |
622 | - mlx4_multi_func_cleanup(dev); |
623 | - mlx4_close_hca(dev); |
624 | - if (mlx4_is_slave(dev)) |
625 | - mlx4_multi_func_cleanup(dev); |
626 | - mlx4_cmd_cleanup(dev); |
627 | - |
628 | - if (dev->flags & MLX4_FLAG_MSI_X) |
629 | - pci_disable_msix(pdev); |
630 | - if (dev->flags & MLX4_FLAG_SRIOV) { |
631 | - mlx4_warn(dev, "Disabling SR-IOV\n"); |
632 | - pci_disable_sriov(pdev); |
633 | - } |
634 | + for (p = 1; p <= dev->caps.num_ports; p++) { |
635 | + mlx4_cleanup_port_info(&priv->port[p]); |
636 | + mlx4_CLOSE_PORT(dev, p); |
637 | + } |
638 | |
639 | - if (!mlx4_is_slave(dev)) |
640 | - mlx4_free_ownership(dev); |
641 | + if (mlx4_is_master(dev)) |
642 | + mlx4_free_resource_tracker(dev, |
643 | + RES_TR_FREE_SLAVES_ONLY); |
644 | + |
645 | + mlx4_cleanup_counters_table(dev); |
646 | + mlx4_cleanup_qp_table(dev); |
647 | + mlx4_cleanup_srq_table(dev); |
648 | + mlx4_cleanup_cq_table(dev); |
649 | + mlx4_cmd_use_polling(dev); |
650 | + mlx4_cleanup_eq_table(dev); |
651 | + mlx4_cleanup_mcg_table(dev); |
652 | + mlx4_cleanup_mr_table(dev); |
653 | + mlx4_cleanup_xrcd_table(dev); |
654 | + mlx4_cleanup_pd_table(dev); |
655 | |
656 | - kfree(dev->caps.qp0_tunnel); |
657 | - kfree(dev->caps.qp0_proxy); |
658 | - kfree(dev->caps.qp1_tunnel); |
659 | - kfree(dev->caps.qp1_proxy); |
660 | + if (mlx4_is_master(dev)) |
661 | + mlx4_free_resource_tracker(dev, |
662 | + RES_TR_FREE_STRUCTS_ONLY); |
663 | |
664 | - kfree(priv); |
665 | - pci_release_regions(pdev); |
666 | - pci_disable_device(pdev); |
667 | - pci_set_drvdata(pdev, NULL); |
668 | + iounmap(priv->kar); |
669 | + mlx4_uar_free(dev, &priv->driver_uar); |
670 | + mlx4_cleanup_uar_table(dev); |
671 | + if (!mlx4_is_slave(dev)) |
672 | + mlx4_clear_steering(dev); |
673 | + mlx4_free_eq_table(dev); |
674 | + if (mlx4_is_master(dev)) |
675 | + mlx4_multi_func_cleanup(dev); |
676 | + mlx4_close_hca(dev); |
677 | + if (mlx4_is_slave(dev)) |
678 | + mlx4_multi_func_cleanup(dev); |
679 | + mlx4_cmd_cleanup(dev); |
680 | + |
681 | + if (dev->flags & MLX4_FLAG_MSI_X) |
682 | + pci_disable_msix(pdev); |
683 | + if (dev->flags & MLX4_FLAG_SRIOV) { |
684 | + mlx4_warn(dev, "Disabling SR-IOV\n"); |
685 | + pci_disable_sriov(pdev); |
686 | } |
687 | + |
688 | + if (!mlx4_is_slave(dev)) |
689 | + mlx4_free_ownership(dev); |
690 | + |
691 | + kfree(dev->caps.qp0_tunnel); |
692 | + kfree(dev->caps.qp0_proxy); |
693 | + kfree(dev->caps.qp1_tunnel); |
694 | + kfree(dev->caps.qp1_proxy); |
695 | + |
696 | + pci_release_regions(pdev); |
697 | + pci_disable_device(pdev); |
698 | + memset(priv, 0, sizeof(*priv)); |
699 | + priv->pci_dev_data = pci_dev_data; |
700 | + priv->removed = 1; |
701 | +} |
702 | + |
703 | +static void mlx4_remove_one(struct pci_dev *pdev) |
704 | +{ |
705 | + struct mlx4_dev *dev = pci_get_drvdata(pdev); |
706 | + struct mlx4_priv *priv = mlx4_priv(dev); |
707 | + |
708 | + __mlx4_remove_one(pdev); |
709 | + kfree(priv); |
710 | + pci_set_drvdata(pdev, NULL); |
711 | } |
712 | |
713 | int mlx4_restart_one(struct pci_dev *pdev) |
714 | @@ -2619,7 +2637,7 @@ int mlx4_restart_one(struct pci_dev *pdev) |
715 | int pci_dev_data; |
716 | |
717 | pci_dev_data = priv->pci_dev_data; |
718 | - mlx4_remove_one(pdev); |
719 | + __mlx4_remove_one(pdev); |
720 | return __mlx4_init_one(pdev, pci_dev_data); |
721 | } |
722 | |
723 | @@ -2674,7 +2692,7 @@ MODULE_DEVICE_TABLE(pci, mlx4_pci_table); |
724 | static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev, |
725 | pci_channel_state_t state) |
726 | { |
727 | - mlx4_remove_one(pdev); |
728 | + __mlx4_remove_one(pdev); |
729 | |
730 | return state == pci_channel_io_perm_failure ? |
731 | PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET; |
732 | @@ -2682,11 +2700,11 @@ static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev, |
733 | |
734 | static pci_ers_result_t mlx4_pci_slot_reset(struct pci_dev *pdev) |
735 | { |
736 | - const struct pci_device_id *id; |
737 | - int ret; |
738 | + struct mlx4_dev *dev = pci_get_drvdata(pdev); |
739 | + struct mlx4_priv *priv = mlx4_priv(dev); |
740 | + int ret; |
741 | |
742 | - id = pci_match_id(mlx4_pci_table, pdev); |
743 | - ret = __mlx4_init_one(pdev, id->driver_data); |
744 | + ret = __mlx4_init_one(pdev, priv->pci_dev_data); |
745 | |
746 | return ret ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED; |
747 | } |
748 | @@ -2700,7 +2718,7 @@ static struct pci_driver mlx4_driver = { |
749 | .name = DRV_NAME, |
750 | .id_table = mlx4_pci_table, |
751 | .probe = mlx4_init_one, |
752 | - .shutdown = mlx4_remove_one, |
753 | + .shutdown = __mlx4_remove_one, |
754 | .remove = mlx4_remove_one, |
755 | .err_handler = &mlx4_err_handler, |
756 | }; |
757 | diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h |
758 | index 7aec6c833973..99d7a28a2ada 100644 |
759 | --- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h |
760 | +++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h |
761 | @@ -796,6 +796,7 @@ struct mlx4_priv { |
762 | spinlock_t ctx_lock; |
763 | |
764 | int pci_dev_data; |
765 | + int removed; |
766 | |
767 | struct list_head pgdir_list; |
768 | struct mutex pgdir_mutex; |
769 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c |
770 | index 7d4f54912bad..3e46c894a107 100644 |
771 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c |
772 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c |
773 | @@ -1022,6 +1022,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev, |
774 | struct qlcnic_dcb_cee *peer; |
775 | int i; |
776 | |
777 | + memset(info, 0, sizeof(*info)); |
778 | *app_count = 0; |
779 | |
780 | if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state)) |
781 | diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c |
782 | index 040cb94e8219..957f0ffe31c4 100644 |
783 | --- a/drivers/net/ethernet/renesas/sh_eth.c |
784 | +++ b/drivers/net/ethernet/renesas/sh_eth.c |
785 | @@ -301,6 +301,27 @@ static const u16 sh_eth_offset_fast_sh4[SH_ETH_MAX_REGISTER_OFFSET] = { |
786 | }; |
787 | |
788 | static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = { |
789 | + [EDMR] = 0x0000, |
790 | + [EDTRR] = 0x0004, |
791 | + [EDRRR] = 0x0008, |
792 | + [TDLAR] = 0x000c, |
793 | + [RDLAR] = 0x0010, |
794 | + [EESR] = 0x0014, |
795 | + [EESIPR] = 0x0018, |
796 | + [TRSCER] = 0x001c, |
797 | + [RMFCR] = 0x0020, |
798 | + [TFTR] = 0x0024, |
799 | + [FDR] = 0x0028, |
800 | + [RMCR] = 0x002c, |
801 | + [EDOCR] = 0x0030, |
802 | + [FCFTR] = 0x0034, |
803 | + [RPADIR] = 0x0038, |
804 | + [TRIMD] = 0x003c, |
805 | + [RBWAR] = 0x0040, |
806 | + [RDFAR] = 0x0044, |
807 | + [TBRAR] = 0x004c, |
808 | + [TDFAR] = 0x0050, |
809 | + |
810 | [ECMR] = 0x0160, |
811 | [ECSR] = 0x0164, |
812 | [ECSIPR] = 0x0168, |
813 | @@ -539,7 +560,6 @@ static struct sh_eth_cpu_data sh7757_data = { |
814 | .register_type = SH_ETH_REG_FAST_SH4, |
815 | |
816 | .eesipr_value = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff, |
817 | - .rmcr_value = RMCR_RNC, |
818 | |
819 | .tx_check = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO, |
820 | .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE | |
821 | @@ -617,7 +637,6 @@ static struct sh_eth_cpu_data sh7757_data_giga = { |
822 | EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | |
823 | EESR_TDE | EESR_ECI, |
824 | .fdr_value = 0x0000072f, |
825 | - .rmcr_value = RMCR_RNC, |
826 | |
827 | .irq_flags = IRQF_SHARED, |
828 | .apr = 1, |
829 | @@ -745,7 +764,6 @@ static struct sh_eth_cpu_data r8a7740_data = { |
830 | EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | |
831 | EESR_TDE | EESR_ECI, |
832 | .fdr_value = 0x0000070f, |
833 | - .rmcr_value = RMCR_RNC, |
834 | |
835 | .apr = 1, |
836 | .mpr = 1, |
837 | @@ -777,7 +795,6 @@ static struct sh_eth_cpu_data r7s72100_data = { |
838 | EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | |
839 | EESR_TDE | EESR_ECI, |
840 | .fdr_value = 0x0000070f, |
841 | - .rmcr_value = RMCR_RNC, |
842 | |
843 | .no_psr = 1, |
844 | .apr = 1, |
845 | @@ -826,9 +843,6 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd) |
846 | if (!cd->fdr_value) |
847 | cd->fdr_value = DEFAULT_FDR_INIT; |
848 | |
849 | - if (!cd->rmcr_value) |
850 | - cd->rmcr_value = DEFAULT_RMCR_VALUE; |
851 | - |
852 | if (!cd->tx_check) |
853 | cd->tx_check = DEFAULT_TX_CHECK; |
854 | |
855 | @@ -1281,8 +1295,8 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start) |
856 | sh_eth_write(ndev, mdp->cd->fdr_value, FDR); |
857 | sh_eth_write(ndev, 0, TFTR); |
858 | |
859 | - /* Frame recv control */ |
860 | - sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR); |
861 | + /* Frame recv control (enable multiple-packets per rx irq) */ |
862 | + sh_eth_write(ndev, RMCR_RNC, RMCR); |
863 | |
864 | sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER); |
865 | |
866 | diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h |
867 | index 6075915b88ec..a096b4bf9799 100644 |
868 | --- a/drivers/net/ethernet/renesas/sh_eth.h |
869 | +++ b/drivers/net/ethernet/renesas/sh_eth.h |
870 | @@ -320,7 +320,6 @@ enum TD_STS_BIT { |
871 | enum RMCR_BIT { |
872 | RMCR_RNC = 0x00000001, |
873 | }; |
874 | -#define DEFAULT_RMCR_VALUE 0x00000000 |
875 | |
876 | /* ECMR */ |
877 | enum FELIC_MODE_BIT { |
878 | @@ -467,7 +466,6 @@ struct sh_eth_cpu_data { |
879 | unsigned long fdr_value; |
880 | unsigned long fcftr_value; |
881 | unsigned long rpadir_value; |
882 | - unsigned long rmcr_value; |
883 | |
884 | /* interrupt checking mask */ |
885 | unsigned long tx_check; |
886 | diff --git a/drivers/net/ethernet/sfc/io.h b/drivers/net/ethernet/sfc/io.h |
887 | index 4d3f119b67b3..afb94aa2c15e 100644 |
888 | --- a/drivers/net/ethernet/sfc/io.h |
889 | +++ b/drivers/net/ethernet/sfc/io.h |
890 | @@ -66,10 +66,17 @@ |
891 | #define EFX_USE_QWORD_IO 1 |
892 | #endif |
893 | |
894 | +/* Hardware issue requires that only 64-bit naturally aligned writes |
895 | + * are seen by hardware. Its not strictly necessary to restrict to |
896 | + * x86_64 arch, but done for safety since unusual write combining behaviour |
897 | + * can break PIO. |
898 | + */ |
899 | +#ifdef CONFIG_X86_64 |
900 | /* PIO is a win only if write-combining is possible */ |
901 | #ifdef ARCH_HAS_IOREMAP_WC |
902 | #define EFX_USE_PIO 1 |
903 | #endif |
904 | +#endif |
905 | |
906 | #ifdef EFX_USE_QWORD_IO |
907 | static inline void _efx_writeq(struct efx_nic *efx, __le64 value, |
908 | diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c |
909 | index 75d11fa4eb0a..d79c842680a5 100644 |
910 | --- a/drivers/net/ethernet/sfc/tx.c |
911 | +++ b/drivers/net/ethernet/sfc/tx.c |
912 | @@ -189,6 +189,18 @@ struct efx_short_copy_buffer { |
913 | u8 buf[L1_CACHE_BYTES]; |
914 | }; |
915 | |
916 | +/* Copy in explicit 64-bit writes. */ |
917 | +static void efx_memcpy_64(void __iomem *dest, void *src, size_t len) |
918 | +{ |
919 | + u64 *src64 = src; |
920 | + u64 __iomem *dest64 = dest; |
921 | + size_t l64 = len / 8; |
922 | + size_t i; |
923 | + |
924 | + for (i = 0; i < l64; i++) |
925 | + writeq(src64[i], &dest64[i]); |
926 | +} |
927 | + |
928 | /* Copy to PIO, respecting that writes to PIO buffers must be dword aligned. |
929 | * Advances piobuf pointer. Leaves additional data in the copy buffer. |
930 | */ |
931 | @@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(struct efx_nic *efx, u8 __iomem **piobuf, |
932 | { |
933 | int block_len = len & ~(sizeof(copy_buf->buf) - 1); |
934 | |
935 | - memcpy_toio(*piobuf, data, block_len); |
936 | + efx_memcpy_64(*piobuf, data, block_len); |
937 | *piobuf += block_len; |
938 | len -= block_len; |
939 | |
940 | @@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(struct efx_nic *efx, u8 __iomem **piobuf, |
941 | if (copy_buf->used < sizeof(copy_buf->buf)) |
942 | return; |
943 | |
944 | - memcpy_toio(*piobuf, copy_buf->buf, sizeof(copy_buf->buf)); |
945 | + efx_memcpy_64(*piobuf, copy_buf->buf, sizeof(copy_buf->buf)); |
946 | *piobuf += sizeof(copy_buf->buf); |
947 | data += copy_to_buf; |
948 | len -= copy_to_buf; |
949 | @@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct efx_nic *efx, u8 __iomem *piobuf, |
950 | { |
951 | /* if there's anything in it, write the whole buffer, including junk */ |
952 | if (copy_buf->used) |
953 | - memcpy_toio(piobuf, copy_buf->buf, sizeof(copy_buf->buf)); |
954 | + efx_memcpy_64(piobuf, copy_buf->buf, sizeof(copy_buf->buf)); |
955 | } |
956 | |
957 | /* Traverse skb structure and copy fragments in to PIO buffer. |
958 | @@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue *tx_queue, struct sk_buff *skb) |
959 | */ |
960 | BUILD_BUG_ON(L1_CACHE_BYTES > |
961 | SKB_DATA_ALIGN(sizeof(struct skb_shared_info))); |
962 | - memcpy_toio(tx_queue->piobuf, skb->data, |
963 | - ALIGN(skb->len, L1_CACHE_BYTES)); |
964 | + efx_memcpy_64(tx_queue->piobuf, skb->data, |
965 | + ALIGN(skb->len, L1_CACHE_BYTES)); |
966 | } |
967 | |
968 | EFX_POPULATE_QWORD_5(buffer->option, |
969 | diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c |
970 | index 20bb66944c4a..5adecc5f52b7 100644 |
971 | --- a/drivers/net/macvlan.c |
972 | +++ b/drivers/net/macvlan.c |
973 | @@ -1043,7 +1043,6 @@ static int macvlan_device_event(struct notifier_block *unused, |
974 | list_for_each_entry_safe(vlan, next, &port->vlans, list) |
975 | vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill); |
976 | unregister_netdevice_many(&list_kill); |
977 | - list_del(&list_kill); |
978 | break; |
979 | case NETDEV_PRE_TYPE_CHANGE: |
980 | /* Forbid underlaying device to change its type. */ |
981 | diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c |
982 | index c8624a8235ab..26d8c29b59de 100644 |
983 | --- a/drivers/net/team/team.c |
984 | +++ b/drivers/net/team/team.c |
985 | @@ -1732,6 +1732,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) |
986 | * to traverse list in reverse under rcu_read_lock |
987 | */ |
988 | mutex_lock(&team->lock); |
989 | + team->port_mtu_change_allowed = true; |
990 | list_for_each_entry(port, &team->port_list, list) { |
991 | err = dev_set_mtu(port->dev, new_mtu); |
992 | if (err) { |
993 | @@ -1740,6 +1741,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) |
994 | goto unwind; |
995 | } |
996 | } |
997 | + team->port_mtu_change_allowed = false; |
998 | mutex_unlock(&team->lock); |
999 | |
1000 | dev->mtu = new_mtu; |
1001 | @@ -1749,6 +1751,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) |
1002 | unwind: |
1003 | list_for_each_entry_continue_reverse(port, &team->port_list, list) |
1004 | dev_set_mtu(port->dev, dev->mtu); |
1005 | + team->port_mtu_change_allowed = false; |
1006 | mutex_unlock(&team->lock); |
1007 | |
1008 | return err; |
1009 | @@ -2857,7 +2860,9 @@ static int team_device_event(struct notifier_block *unused, |
1010 | break; |
1011 | case NETDEV_PRECHANGEMTU: |
1012 | /* Forbid to change mtu of underlaying device */ |
1013 | - return NOTIFY_BAD; |
1014 | + if (!port->team->port_mtu_change_allowed) |
1015 | + return NOTIFY_BAD; |
1016 | + break; |
1017 | case NETDEV_PRE_TYPE_CHANGE: |
1018 | /* Forbid to change type of underlaying device */ |
1019 | return NOTIFY_BAD; |
1020 | diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c |
1021 | index 48c4902c0d62..b71120842c4f 100644 |
1022 | --- a/drivers/net/usb/qmi_wwan.c |
1023 | +++ b/drivers/net/usb/qmi_wwan.c |
1024 | @@ -752,7 +752,12 @@ static const struct usb_device_id products[] = { |
1025 | {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ |
1026 | {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ |
1027 | {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ |
1028 | - {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ |
1029 | + {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */ |
1030 | + {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */ |
1031 | + {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)}, /* Olivetti Olicard 140 */ |
1032 | + {QMI_FIXED_INTF(0x0b3c, 0xc004, 6)}, /* Olivetti Olicard 155 */ |
1033 | + {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ |
1034 | + {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */ |
1035 | {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ |
1036 | {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ |
1037 | {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ |
1038 | diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c |
1039 | index d091e52b00e1..40ad25d7f28b 100644 |
1040 | --- a/drivers/net/vxlan.c |
1041 | +++ b/drivers/net/vxlan.c |
1042 | @@ -2282,9 +2282,9 @@ static void vxlan_setup(struct net_device *dev) |
1043 | eth_hw_addr_random(dev); |
1044 | ether_setup(dev); |
1045 | if (vxlan->default_dst.remote_ip.sa.sa_family == AF_INET6) |
1046 | - dev->hard_header_len = ETH_HLEN + VXLAN6_HEADROOM; |
1047 | + dev->needed_headroom = ETH_HLEN + VXLAN6_HEADROOM; |
1048 | else |
1049 | - dev->hard_header_len = ETH_HLEN + VXLAN_HEADROOM; |
1050 | + dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM; |
1051 | |
1052 | dev->netdev_ops = &vxlan_netdev_ops; |
1053 | dev->destructor = free_netdev; |
1054 | @@ -2667,8 +2667,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev, |
1055 | if (!tb[IFLA_MTU]) |
1056 | dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM); |
1057 | |
1058 | - /* update header length based on lower device */ |
1059 | - dev->hard_header_len = lowerdev->hard_header_len + |
1060 | + dev->needed_headroom = lowerdev->hard_header_len + |
1061 | (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM); |
1062 | } else if (use_ipv6) |
1063 | vxlan->flags |= VXLAN_F_IPV6; |
1064 | diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c |
1065 | index 3281c90691c3..44fe83ee9bee 100644 |
1066 | --- a/drivers/rtc/rtc-at91rm9200.c |
1067 | +++ b/drivers/rtc/rtc-at91rm9200.c |
1068 | @@ -48,6 +48,7 @@ struct at91_rtc_config { |
1069 | |
1070 | static const struct at91_rtc_config *at91_rtc_config; |
1071 | static DECLARE_COMPLETION(at91_rtc_updated); |
1072 | +static DECLARE_COMPLETION(at91_rtc_upd_rdy); |
1073 | static unsigned int at91_alarm_year = AT91_RTC_EPOCH; |
1074 | static void __iomem *at91_rtc_regs; |
1075 | static int irq; |
1076 | @@ -161,6 +162,8 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm) |
1077 | 1900 + tm->tm_year, tm->tm_mon, tm->tm_mday, |
1078 | tm->tm_hour, tm->tm_min, tm->tm_sec); |
1079 | |
1080 | + wait_for_completion(&at91_rtc_upd_rdy); |
1081 | + |
1082 | /* Stop Time/Calendar from counting */ |
1083 | cr = at91_rtc_read(AT91_RTC_CR); |
1084 | at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM); |
1085 | @@ -183,7 +186,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm) |
1086 | |
1087 | /* Restart Time/Calendar */ |
1088 | cr = at91_rtc_read(AT91_RTC_CR); |
1089 | + at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_SECEV); |
1090 | at91_rtc_write(AT91_RTC_CR, cr & ~(AT91_RTC_UPDCAL | AT91_RTC_UPDTIM)); |
1091 | + at91_rtc_write_ier(AT91_RTC_SECEV); |
1092 | |
1093 | return 0; |
1094 | } |
1095 | @@ -290,8 +295,10 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id) |
1096 | if (rtsr) { /* this interrupt is shared! Is it ours? */ |
1097 | if (rtsr & AT91_RTC_ALARM) |
1098 | events |= (RTC_AF | RTC_IRQF); |
1099 | - if (rtsr & AT91_RTC_SECEV) |
1100 | - events |= (RTC_UF | RTC_IRQF); |
1101 | + if (rtsr & AT91_RTC_SECEV) { |
1102 | + complete(&at91_rtc_upd_rdy); |
1103 | + at91_rtc_write_idr(AT91_RTC_SECEV); |
1104 | + } |
1105 | if (rtsr & AT91_RTC_ACKUPD) |
1106 | complete(&at91_rtc_updated); |
1107 | |
1108 | @@ -413,6 +420,11 @@ static int __init at91_rtc_probe(struct platform_device *pdev) |
1109 | return PTR_ERR(rtc); |
1110 | platform_set_drvdata(pdev, rtc); |
1111 | |
1112 | + /* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy |
1113 | + * completion. |
1114 | + */ |
1115 | + at91_rtc_write_ier(AT91_RTC_SECEV); |
1116 | + |
1117 | dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n"); |
1118 | return 0; |
1119 | } |
1120 | diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c |
1121 | index fe30ea94ffe6..109802f776ed 100644 |
1122 | --- a/drivers/scsi/scsi_netlink.c |
1123 | +++ b/drivers/scsi/scsi_netlink.c |
1124 | @@ -77,7 +77,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb) |
1125 | goto next_msg; |
1126 | } |
1127 | |
1128 | - if (!capable(CAP_SYS_ADMIN)) { |
1129 | + if (!netlink_capable(skb, CAP_SYS_ADMIN)) { |
1130 | err = -EPERM; |
1131 | goto next_msg; |
1132 | } |
1133 | diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c |
1134 | index 514844efac75..9ec1df9cff95 100644 |
1135 | --- a/drivers/staging/iio/adc/mxs-lradc.c |
1136 | +++ b/drivers/staging/iio/adc/mxs-lradc.c |
1137 | @@ -846,6 +846,14 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val) |
1138 | LRADC_CTRL1); |
1139 | mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0); |
1140 | |
1141 | + /* Enable / disable the divider per requirement */ |
1142 | + if (test_bit(chan, &lradc->is_divided)) |
1143 | + mxs_lradc_reg_set(lradc, 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, |
1144 | + LRADC_CTRL2); |
1145 | + else |
1146 | + mxs_lradc_reg_clear(lradc, |
1147 | + 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, LRADC_CTRL2); |
1148 | + |
1149 | /* Clean the slot's previous content, then set new one. */ |
1150 | mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(0), LRADC_CTRL4); |
1151 | mxs_lradc_reg_set(lradc, chan, LRADC_CTRL4); |
1152 | @@ -964,15 +972,11 @@ static int mxs_lradc_write_raw(struct iio_dev *iio_dev, |
1153 | if (val == scale_avail[MXS_LRADC_DIV_DISABLED].integer && |
1154 | val2 == scale_avail[MXS_LRADC_DIV_DISABLED].nano) { |
1155 | /* divider by two disabled */ |
1156 | - writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, |
1157 | - lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_CLR); |
1158 | clear_bit(chan->channel, &lradc->is_divided); |
1159 | ret = 0; |
1160 | } else if (val == scale_avail[MXS_LRADC_DIV_ENABLED].integer && |
1161 | val2 == scale_avail[MXS_LRADC_DIV_ENABLED].nano) { |
1162 | /* divider by two enabled */ |
1163 | - writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, |
1164 | - lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_SET); |
1165 | set_bit(chan->channel, &lradc->is_divided); |
1166 | ret = 0; |
1167 | } |
1168 | diff --git a/drivers/staging/iio/light/tsl2x7x_core.c b/drivers/staging/iio/light/tsl2x7x_core.c |
1169 | index 1e538086d48b..ce1e74e000bb 100644 |
1170 | --- a/drivers/staging/iio/light/tsl2x7x_core.c |
1171 | +++ b/drivers/staging/iio/light/tsl2x7x_core.c |
1172 | @@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_dev *indio_dev) |
1173 | chip->tsl2x7x_config[TSL2X7X_PRX_COUNT] = |
1174 | chip->tsl2x7x_settings.prox_pulse_count; |
1175 | chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] = |
1176 | - chip->tsl2x7x_settings.prox_thres_low; |
1177 | + (chip->tsl2x7x_settings.prox_thres_low) & 0xFF; |
1178 | + chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] = |
1179 | + (chip->tsl2x7x_settings.prox_thres_low >> 8) & 0xFF; |
1180 | chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] = |
1181 | - chip->tsl2x7x_settings.prox_thres_high; |
1182 | + (chip->tsl2x7x_settings.prox_thres_high) & 0xFF; |
1183 | + chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] = |
1184 | + (chip->tsl2x7x_settings.prox_thres_high >> 8) & 0xFF; |
1185 | |
1186 | /* and make sure we're not already on */ |
1187 | if (chip->tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) { |
1188 | diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c |
1189 | index de77d9aa22c6..6689de6c5591 100644 |
1190 | --- a/drivers/target/iscsi/iscsi_target_auth.c |
1191 | +++ b/drivers/target/iscsi/iscsi_target_auth.c |
1192 | @@ -314,6 +314,16 @@ static int chap_server_compute_md5( |
1193 | goto out; |
1194 | } |
1195 | /* |
1196 | + * During mutual authentication, the CHAP_C generated by the |
1197 | + * initiator must not match the original CHAP_C generated by |
1198 | + * the target. |
1199 | + */ |
1200 | + if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) { |
1201 | + pr_err("initiator CHAP_C matches target CHAP_C, failing" |
1202 | + " login attempt\n"); |
1203 | + goto out; |
1204 | + } |
1205 | + /* |
1206 | * Generate CHAP_N and CHAP_R for mutual authentication. |
1207 | */ |
1208 | tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); |
1209 | diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c |
1210 | index 98b48d400a3a..c39cf37800d3 100644 |
1211 | --- a/drivers/target/target_core_transport.c |
1212 | +++ b/drivers/target/target_core_transport.c |
1213 | @@ -2342,6 +2342,10 @@ static void target_release_cmd_kref(struct kref *kref) |
1214 | */ |
1215 | int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd) |
1216 | { |
1217 | + if (!se_sess) { |
1218 | + se_cmd->se_tfo->release_cmd(se_cmd); |
1219 | + return 1; |
1220 | + } |
1221 | return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref, |
1222 | &se_sess->sess_cmd_lock); |
1223 | } |
1224 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
1225 | index 7783acabe443..eabccd45f4e8 100644 |
1226 | --- a/drivers/usb/class/cdc-acm.c |
1227 | +++ b/drivers/usb/class/cdc-acm.c |
1228 | @@ -122,13 +122,23 @@ static void acm_release_minor(struct acm *acm) |
1229 | static int acm_ctrl_msg(struct acm *acm, int request, int value, |
1230 | void *buf, int len) |
1231 | { |
1232 | - int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0), |
1233 | + int retval; |
1234 | + |
1235 | + retval = usb_autopm_get_interface(acm->control); |
1236 | + if (retval) |
1237 | + return retval; |
1238 | + |
1239 | + retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0), |
1240 | request, USB_RT_ACM, value, |
1241 | acm->control->altsetting[0].desc.bInterfaceNumber, |
1242 | buf, len, 5000); |
1243 | + |
1244 | dev_dbg(&acm->control->dev, |
1245 | "%s - rq 0x%02x, val %#x, len %#x, result %d\n", |
1246 | __func__, request, value, len, retval); |
1247 | + |
1248 | + usb_autopm_put_interface(acm->control); |
1249 | + |
1250 | return retval < 0 ? retval : 0; |
1251 | } |
1252 | |
1253 | @@ -496,6 +506,7 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) |
1254 | { |
1255 | struct acm *acm = container_of(port, struct acm, port); |
1256 | int retval = -ENODEV; |
1257 | + int i; |
1258 | |
1259 | dev_dbg(&acm->control->dev, "%s\n", __func__); |
1260 | |
1261 | @@ -544,6 +555,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) |
1262 | return 0; |
1263 | |
1264 | error_submit_read_urbs: |
1265 | + for (i = 0; i < acm->rx_buflimit; i++) |
1266 | + usb_kill_urb(acm->read_urbs[i]); |
1267 | acm->ctrlout = 0; |
1268 | acm_set_control(acm, acm->ctrlout); |
1269 | error_set_control: |
1270 | @@ -571,21 +584,35 @@ static void acm_port_destruct(struct tty_port *port) |
1271 | static void acm_port_shutdown(struct tty_port *port) |
1272 | { |
1273 | struct acm *acm = container_of(port, struct acm, port); |
1274 | + struct urb *urb; |
1275 | + struct acm_wb *wb; |
1276 | int i; |
1277 | + int pm_err; |
1278 | |
1279 | dev_dbg(&acm->control->dev, "%s\n", __func__); |
1280 | |
1281 | mutex_lock(&acm->mutex); |
1282 | if (!acm->disconnected) { |
1283 | - usb_autopm_get_interface(acm->control); |
1284 | + pm_err = usb_autopm_get_interface(acm->control); |
1285 | acm_set_control(acm, acm->ctrlout = 0); |
1286 | + |
1287 | + for (;;) { |
1288 | + urb = usb_get_from_anchor(&acm->delayed); |
1289 | + if (!urb) |
1290 | + break; |
1291 | + wb = urb->context; |
1292 | + wb->use = 0; |
1293 | + usb_autopm_put_interface_async(acm->control); |
1294 | + } |
1295 | + |
1296 | usb_kill_urb(acm->ctrlurb); |
1297 | for (i = 0; i < ACM_NW; i++) |
1298 | usb_kill_urb(acm->wb[i].urb); |
1299 | for (i = 0; i < acm->rx_buflimit; i++) |
1300 | usb_kill_urb(acm->read_urbs[i]); |
1301 | acm->control->needs_remote_wakeup = 0; |
1302 | - usb_autopm_put_interface(acm->control); |
1303 | + if (!pm_err) |
1304 | + usb_autopm_put_interface(acm->control); |
1305 | } |
1306 | mutex_unlock(&acm->mutex); |
1307 | } |
1308 | @@ -644,14 +671,17 @@ static int acm_tty_write(struct tty_struct *tty, |
1309 | memcpy(wb->buf, buf, count); |
1310 | wb->len = count; |
1311 | |
1312 | - usb_autopm_get_interface_async(acm->control); |
1313 | + stat = usb_autopm_get_interface_async(acm->control); |
1314 | + if (stat) { |
1315 | + wb->use = 0; |
1316 | + spin_unlock_irqrestore(&acm->write_lock, flags); |
1317 | + return stat; |
1318 | + } |
1319 | + |
1320 | if (acm->susp_count) { |
1321 | - if (!acm->delayed_wb) |
1322 | - acm->delayed_wb = wb; |
1323 | - else |
1324 | - usb_autopm_put_interface_async(acm->control); |
1325 | + usb_anchor_urb(wb->urb, &acm->delayed); |
1326 | spin_unlock_irqrestore(&acm->write_lock, flags); |
1327 | - return count; /* A white lie */ |
1328 | + return count; |
1329 | } |
1330 | usb_mark_last_busy(acm->dev); |
1331 | |
1332 | @@ -1267,6 +1297,7 @@ made_compressed_probe: |
1333 | acm->bInterval = epread->bInterval; |
1334 | tty_port_init(&acm->port); |
1335 | acm->port.ops = &acm_port_ops; |
1336 | + init_usb_anchor(&acm->delayed); |
1337 | |
1338 | buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma); |
1339 | if (!buf) { |
1340 | @@ -1512,18 +1543,15 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) |
1341 | struct acm *acm = usb_get_intfdata(intf); |
1342 | int cnt; |
1343 | |
1344 | + spin_lock_irq(&acm->read_lock); |
1345 | + spin_lock(&acm->write_lock); |
1346 | if (PMSG_IS_AUTO(message)) { |
1347 | - int b; |
1348 | - |
1349 | - spin_lock_irq(&acm->write_lock); |
1350 | - b = acm->transmitting; |
1351 | - spin_unlock_irq(&acm->write_lock); |
1352 | - if (b) |
1353 | + if (acm->transmitting) { |
1354 | + spin_unlock(&acm->write_lock); |
1355 | + spin_unlock_irq(&acm->read_lock); |
1356 | return -EBUSY; |
1357 | + } |
1358 | } |
1359 | - |
1360 | - spin_lock_irq(&acm->read_lock); |
1361 | - spin_lock(&acm->write_lock); |
1362 | cnt = acm->susp_count++; |
1363 | spin_unlock(&acm->write_lock); |
1364 | spin_unlock_irq(&acm->read_lock); |
1365 | @@ -1531,8 +1559,7 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) |
1366 | if (cnt) |
1367 | return 0; |
1368 | |
1369 | - if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) |
1370 | - stop_data_traffic(acm); |
1371 | + stop_data_traffic(acm); |
1372 | |
1373 | return 0; |
1374 | } |
1375 | @@ -1540,29 +1567,24 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) |
1376 | static int acm_resume(struct usb_interface *intf) |
1377 | { |
1378 | struct acm *acm = usb_get_intfdata(intf); |
1379 | - struct acm_wb *wb; |
1380 | + struct urb *urb; |
1381 | int rv = 0; |
1382 | - int cnt; |
1383 | |
1384 | spin_lock_irq(&acm->read_lock); |
1385 | - acm->susp_count -= 1; |
1386 | - cnt = acm->susp_count; |
1387 | - spin_unlock_irq(&acm->read_lock); |
1388 | + spin_lock(&acm->write_lock); |
1389 | |
1390 | - if (cnt) |
1391 | - return 0; |
1392 | + if (--acm->susp_count) |
1393 | + goto out; |
1394 | |
1395 | if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) { |
1396 | - rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO); |
1397 | - |
1398 | - spin_lock_irq(&acm->write_lock); |
1399 | - if (acm->delayed_wb) { |
1400 | - wb = acm->delayed_wb; |
1401 | - acm->delayed_wb = NULL; |
1402 | - spin_unlock_irq(&acm->write_lock); |
1403 | - acm_start_wb(acm, wb); |
1404 | - } else { |
1405 | - spin_unlock_irq(&acm->write_lock); |
1406 | + rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC); |
1407 | + |
1408 | + for (;;) { |
1409 | + urb = usb_get_from_anchor(&acm->delayed); |
1410 | + if (!urb) |
1411 | + break; |
1412 | + |
1413 | + acm_start_wb(acm, urb->context); |
1414 | } |
1415 | |
1416 | /* |
1417 | @@ -1570,12 +1592,14 @@ static int acm_resume(struct usb_interface *intf) |
1418 | * do the write path at all cost |
1419 | */ |
1420 | if (rv < 0) |
1421 | - goto err_out; |
1422 | + goto out; |
1423 | |
1424 | - rv = acm_submit_read_urbs(acm, GFP_NOIO); |
1425 | + rv = acm_submit_read_urbs(acm, GFP_ATOMIC); |
1426 | } |
1427 | +out: |
1428 | + spin_unlock(&acm->write_lock); |
1429 | + spin_unlock_irq(&acm->read_lock); |
1430 | |
1431 | -err_out: |
1432 | return rv; |
1433 | } |
1434 | |
1435 | diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h |
1436 | index e38dc785808f..80826f843e04 100644 |
1437 | --- a/drivers/usb/class/cdc-acm.h |
1438 | +++ b/drivers/usb/class/cdc-acm.h |
1439 | @@ -120,7 +120,7 @@ struct acm { |
1440 | unsigned int throttled:1; /* actually throttled */ |
1441 | unsigned int throttle_req:1; /* throttle requested */ |
1442 | u8 bInterval; |
1443 | - struct acm_wb *delayed_wb; /* write queued for a device about to be woken */ |
1444 | + struct usb_anchor delayed; /* writes queued for a device about to be woken */ |
1445 | }; |
1446 | |
1447 | #define CDC_DATA_INTERFACE_TYPE 0x0a |
1448 | diff --git a/include/linux/if_team.h b/include/linux/if_team.h |
1449 | index a899dc24be15..a6aa970758a2 100644 |
1450 | --- a/include/linux/if_team.h |
1451 | +++ b/include/linux/if_team.h |
1452 | @@ -194,6 +194,7 @@ struct team { |
1453 | bool user_carrier_enabled; |
1454 | bool queue_override_enabled; |
1455 | struct list_head *qom_lists; /* array of queue override mapping lists */ |
1456 | + bool port_mtu_change_allowed; |
1457 | struct { |
1458 | unsigned int count; |
1459 | unsigned int interval; /* in ms */ |
1460 | diff --git a/include/linux/netlink.h b/include/linux/netlink.h |
1461 | index aad8eeaf416d..034cda789a15 100644 |
1462 | --- a/include/linux/netlink.h |
1463 | +++ b/include/linux/netlink.h |
1464 | @@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb) |
1465 | } |
1466 | |
1467 | enum netlink_skb_flags { |
1468 | - NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */ |
1469 | - NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */ |
1470 | - NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */ |
1471 | + NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */ |
1472 | + NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */ |
1473 | + NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */ |
1474 | + NETLINK_SKB_DST = 0x8, /* Dst set in sendto or sendmsg */ |
1475 | }; |
1476 | |
1477 | struct netlink_skb_parms { |
1478 | @@ -169,4 +170,11 @@ struct netlink_tap { |
1479 | extern int netlink_add_tap(struct netlink_tap *nt); |
1480 | extern int netlink_remove_tap(struct netlink_tap *nt); |
1481 | |
1482 | +bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, |
1483 | + struct user_namespace *ns, int cap); |
1484 | +bool netlink_ns_capable(const struct sk_buff *skb, |
1485 | + struct user_namespace *ns, int cap); |
1486 | +bool netlink_capable(const struct sk_buff *skb, int cap); |
1487 | +bool netlink_net_capable(const struct sk_buff *skb, int cap); |
1488 | + |
1489 | #endif /* __LINUX_NETLINK_H */ |
1490 | diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h |
1491 | index 302ab805b0bb..46cca4c06848 100644 |
1492 | --- a/include/linux/sock_diag.h |
1493 | +++ b/include/linux/sock_diag.h |
1494 | @@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie); |
1495 | void sock_diag_save_cookie(void *sk, __u32 *cookie); |
1496 | |
1497 | int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr); |
1498 | -int sock_diag_put_filterinfo(struct sock *sk, |
1499 | +int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk, |
1500 | struct sk_buff *skb, int attrtype); |
1501 | |
1502 | #endif |
1503 | diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h |
1504 | index 6efe73c79c52..058271bde27a 100644 |
1505 | --- a/include/net/inetpeer.h |
1506 | +++ b/include/net/inetpeer.h |
1507 | @@ -177,16 +177,9 @@ static inline void inet_peer_refcheck(const struct inet_peer *p) |
1508 | /* can be called with or without local BH being disabled */ |
1509 | static inline int inet_getid(struct inet_peer *p, int more) |
1510 | { |
1511 | - int old, new; |
1512 | more++; |
1513 | inet_peer_refcheck(p); |
1514 | - do { |
1515 | - old = atomic_read(&p->ip_id_count); |
1516 | - new = old + more; |
1517 | - if (!new) |
1518 | - new = 1; |
1519 | - } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old); |
1520 | - return new; |
1521 | + return atomic_add_return(more, &p->ip_id_count) - more; |
1522 | } |
1523 | |
1524 | #endif /* _NET_INETPEER_H */ |
1525 | diff --git a/include/net/sock.h b/include/net/sock.h |
1526 | index b9586a137cad..57c31dd15e64 100644 |
1527 | --- a/include/net/sock.h |
1528 | +++ b/include/net/sock.h |
1529 | @@ -2278,6 +2278,11 @@ int sock_get_timestampns(struct sock *, struct timespec __user *); |
1530 | int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, int level, |
1531 | int type); |
1532 | |
1533 | +bool sk_ns_capable(const struct sock *sk, |
1534 | + struct user_namespace *user_ns, int cap); |
1535 | +bool sk_capable(const struct sock *sk, int cap); |
1536 | +bool sk_net_capable(const struct sock *sk, int cap); |
1537 | + |
1538 | /* |
1539 | * Enable debug/info messages |
1540 | */ |
1541 | diff --git a/include/sound/core.h b/include/sound/core.h |
1542 | index 2a14f1f02d4f..d6bc9616058b 100644 |
1543 | --- a/include/sound/core.h |
1544 | +++ b/include/sound/core.h |
1545 | @@ -121,6 +121,8 @@ struct snd_card { |
1546 | int user_ctl_count; /* count of all user controls */ |
1547 | struct list_head controls; /* all controls for this card */ |
1548 | struct list_head ctl_files; /* active control files */ |
1549 | + struct mutex user_ctl_lock; /* protects user controls against |
1550 | + concurrent access */ |
1551 | |
1552 | struct snd_info_entry *proc_root; /* root for soundcard specific files */ |
1553 | struct snd_info_entry *proc_id; /* the card id */ |
1554 | diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h |
1555 | index 5759810e1c1b..21eed488783f 100644 |
1556 | --- a/include/uapi/sound/compress_offload.h |
1557 | +++ b/include/uapi/sound/compress_offload.h |
1558 | @@ -80,7 +80,7 @@ struct snd_compr_tstamp { |
1559 | struct snd_compr_avail { |
1560 | __u64 avail; |
1561 | struct snd_compr_tstamp tstamp; |
1562 | -}; |
1563 | +} __attribute__((packed)); |
1564 | |
1565 | enum snd_compr_direction { |
1566 | SND_COMPRESS_PLAYBACK = 0, |
1567 | diff --git a/kernel/audit.c b/kernel/audit.c |
1568 | index d5f31c17813a..0c9dc860cc15 100644 |
1569 | --- a/kernel/audit.c |
1570 | +++ b/kernel/audit.c |
1571 | @@ -639,13 +639,13 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) |
1572 | case AUDIT_TTY_SET: |
1573 | case AUDIT_TRIM: |
1574 | case AUDIT_MAKE_EQUIV: |
1575 | - if (!capable(CAP_AUDIT_CONTROL)) |
1576 | + if (!netlink_capable(skb, CAP_AUDIT_CONTROL)) |
1577 | err = -EPERM; |
1578 | break; |
1579 | case AUDIT_USER: |
1580 | case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: |
1581 | case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: |
1582 | - if (!capable(CAP_AUDIT_WRITE)) |
1583 | + if (!netlink_capable(skb, CAP_AUDIT_WRITE)) |
1584 | err = -EPERM; |
1585 | break; |
1586 | default: /* bad msg */ |
1587 | diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c |
1588 | index df6839e3ce08..99a03acb7d47 100644 |
1589 | --- a/lib/lz4/lz4_decompress.c |
1590 | +++ b/lib/lz4/lz4_decompress.c |
1591 | @@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) |
1592 | len = *ip++; |
1593 | for (; len == 255; length += 255) |
1594 | len = *ip++; |
1595 | + if (unlikely(length > (size_t)(length + len))) |
1596 | + goto _output_error; |
1597 | length += len; |
1598 | } |
1599 | |
1600 | diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c |
1601 | index 569985d522d5..8563081e8da3 100644 |
1602 | --- a/lib/lzo/lzo1x_decompress_safe.c |
1603 | +++ b/lib/lzo/lzo1x_decompress_safe.c |
1604 | @@ -19,11 +19,31 @@ |
1605 | #include <linux/lzo.h> |
1606 | #include "lzodefs.h" |
1607 | |
1608 | -#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x)) |
1609 | -#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x)) |
1610 | -#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun |
1611 | -#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun |
1612 | -#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun |
1613 | +#define HAVE_IP(t, x) \ |
1614 | + (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \ |
1615 | + (((t + x) >= t) && ((t + x) >= x))) |
1616 | + |
1617 | +#define HAVE_OP(t, x) \ |
1618 | + (((size_t)(op_end - op) >= (size_t)(t + x)) && \ |
1619 | + (((t + x) >= t) && ((t + x) >= x))) |
1620 | + |
1621 | +#define NEED_IP(t, x) \ |
1622 | + do { \ |
1623 | + if (!HAVE_IP(t, x)) \ |
1624 | + goto input_overrun; \ |
1625 | + } while (0) |
1626 | + |
1627 | +#define NEED_OP(t, x) \ |
1628 | + do { \ |
1629 | + if (!HAVE_OP(t, x)) \ |
1630 | + goto output_overrun; \ |
1631 | + } while (0) |
1632 | + |
1633 | +#define TEST_LB(m_pos) \ |
1634 | + do { \ |
1635 | + if ((m_pos) < out) \ |
1636 | + goto lookbehind_overrun; \ |
1637 | + } while (0) |
1638 | |
1639 | int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, |
1640 | unsigned char *out, size_t *out_len) |
1641 | @@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, |
1642 | while (unlikely(*ip == 0)) { |
1643 | t += 255; |
1644 | ip++; |
1645 | - NEED_IP(1); |
1646 | + NEED_IP(1, 0); |
1647 | } |
1648 | t += 15 + *ip++; |
1649 | } |
1650 | t += 3; |
1651 | copy_literal_run: |
1652 | #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) |
1653 | - if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) { |
1654 | + if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) { |
1655 | const unsigned char *ie = ip + t; |
1656 | unsigned char *oe = op + t; |
1657 | do { |
1658 | @@ -81,8 +101,8 @@ copy_literal_run: |
1659 | } else |
1660 | #endif |
1661 | { |
1662 | - NEED_OP(t); |
1663 | - NEED_IP(t + 3); |
1664 | + NEED_OP(t, 0); |
1665 | + NEED_IP(t, 3); |
1666 | do { |
1667 | *op++ = *ip++; |
1668 | } while (--t > 0); |
1669 | @@ -95,7 +115,7 @@ copy_literal_run: |
1670 | m_pos -= t >> 2; |
1671 | m_pos -= *ip++ << 2; |
1672 | TEST_LB(m_pos); |
1673 | - NEED_OP(2); |
1674 | + NEED_OP(2, 0); |
1675 | op[0] = m_pos[0]; |
1676 | op[1] = m_pos[1]; |
1677 | op += 2; |
1678 | @@ -119,10 +139,10 @@ copy_literal_run: |
1679 | while (unlikely(*ip == 0)) { |
1680 | t += 255; |
1681 | ip++; |
1682 | - NEED_IP(1); |
1683 | + NEED_IP(1, 0); |
1684 | } |
1685 | t += 31 + *ip++; |
1686 | - NEED_IP(2); |
1687 | + NEED_IP(2, 0); |
1688 | } |
1689 | m_pos = op - 1; |
1690 | next = get_unaligned_le16(ip); |
1691 | @@ -137,10 +157,10 @@ copy_literal_run: |
1692 | while (unlikely(*ip == 0)) { |
1693 | t += 255; |
1694 | ip++; |
1695 | - NEED_IP(1); |
1696 | + NEED_IP(1, 0); |
1697 | } |
1698 | t += 7 + *ip++; |
1699 | - NEED_IP(2); |
1700 | + NEED_IP(2, 0); |
1701 | } |
1702 | next = get_unaligned_le16(ip); |
1703 | ip += 2; |
1704 | @@ -154,7 +174,7 @@ copy_literal_run: |
1705 | #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) |
1706 | if (op - m_pos >= 8) { |
1707 | unsigned char *oe = op + t; |
1708 | - if (likely(HAVE_OP(t + 15))) { |
1709 | + if (likely(HAVE_OP(t, 15))) { |
1710 | do { |
1711 | COPY8(op, m_pos); |
1712 | op += 8; |
1713 | @@ -164,7 +184,7 @@ copy_literal_run: |
1714 | m_pos += 8; |
1715 | } while (op < oe); |
1716 | op = oe; |
1717 | - if (HAVE_IP(6)) { |
1718 | + if (HAVE_IP(6, 0)) { |
1719 | state = next; |
1720 | COPY4(op, ip); |
1721 | op += next; |
1722 | @@ -172,7 +192,7 @@ copy_literal_run: |
1723 | continue; |
1724 | } |
1725 | } else { |
1726 | - NEED_OP(t); |
1727 | + NEED_OP(t, 0); |
1728 | do { |
1729 | *op++ = *m_pos++; |
1730 | } while (op < oe); |
1731 | @@ -181,7 +201,7 @@ copy_literal_run: |
1732 | #endif |
1733 | { |
1734 | unsigned char *oe = op + t; |
1735 | - NEED_OP(t); |
1736 | + NEED_OP(t, 0); |
1737 | op[0] = m_pos[0]; |
1738 | op[1] = m_pos[1]; |
1739 | op += 2; |
1740 | @@ -194,15 +214,15 @@ match_next: |
1741 | state = next; |
1742 | t = next; |
1743 | #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) |
1744 | - if (likely(HAVE_IP(6) && HAVE_OP(4))) { |
1745 | + if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) { |
1746 | COPY4(op, ip); |
1747 | op += t; |
1748 | ip += t; |
1749 | } else |
1750 | #endif |
1751 | { |
1752 | - NEED_IP(t + 3); |
1753 | - NEED_OP(t); |
1754 | + NEED_IP(t, 3); |
1755 | + NEED_OP(t, 0); |
1756 | while (t > 0) { |
1757 | *op++ = *ip++; |
1758 | t--; |
1759 | diff --git a/lib/nlattr.c b/lib/nlattr.c |
1760 | index fc6754720ced..10ad042d01be 100644 |
1761 | --- a/lib/nlattr.c |
1762 | +++ b/lib/nlattr.c |
1763 | @@ -201,8 +201,8 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head, |
1764 | } |
1765 | |
1766 | if (unlikely(rem > 0)) |
1767 | - printk(KERN_WARNING "netlink: %d bytes leftover after parsing " |
1768 | - "attributes.\n", rem); |
1769 | + pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n", |
1770 | + rem, current->comm); |
1771 | |
1772 | err = 0; |
1773 | errout: |
1774 | diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c |
1775 | index 7985deaff52f..04d6348fd530 100644 |
1776 | --- a/net/bridge/br_input.c |
1777 | +++ b/net/bridge/br_input.c |
1778 | @@ -147,8 +147,8 @@ static int br_handle_local_finish(struct sk_buff *skb) |
1779 | struct net_bridge_port *p = br_port_get_rcu(skb->dev); |
1780 | u16 vid = 0; |
1781 | |
1782 | - br_vlan_get_tag(skb, &vid); |
1783 | - if (p->flags & BR_LEARNING) |
1784 | + /* check if vlan is allowed, to avoid spoofing */ |
1785 | + if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid)) |
1786 | br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false); |
1787 | return 0; /* process further */ |
1788 | } |
1789 | diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h |
1790 | index 3ba11bc99b65..f2d254b69353 100644 |
1791 | --- a/net/bridge/br_private.h |
1792 | +++ b/net/bridge/br_private.h |
1793 | @@ -581,6 +581,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v, |
1794 | struct sk_buff *skb, u16 *vid); |
1795 | bool br_allowed_egress(struct net_bridge *br, const struct net_port_vlans *v, |
1796 | const struct sk_buff *skb); |
1797 | +bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid); |
1798 | struct sk_buff *br_handle_vlan(struct net_bridge *br, |
1799 | const struct net_port_vlans *v, |
1800 | struct sk_buff *skb); |
1801 | @@ -648,6 +649,12 @@ static inline bool br_allowed_egress(struct net_bridge *br, |
1802 | return true; |
1803 | } |
1804 | |
1805 | +static inline bool br_should_learn(struct net_bridge_port *p, |
1806 | + struct sk_buff *skb, u16 *vid) |
1807 | +{ |
1808 | + return true; |
1809 | +} |
1810 | + |
1811 | static inline struct sk_buff *br_handle_vlan(struct net_bridge *br, |
1812 | const struct net_port_vlans *v, |
1813 | struct sk_buff *skb) |
1814 | diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c |
1815 | index ba7757b7737d..b1c637208497 100644 |
1816 | --- a/net/bridge/br_vlan.c |
1817 | +++ b/net/bridge/br_vlan.c |
1818 | @@ -241,6 +241,34 @@ bool br_allowed_egress(struct net_bridge *br, |
1819 | return false; |
1820 | } |
1821 | |
1822 | +/* Called under RCU */ |
1823 | +bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid) |
1824 | +{ |
1825 | + struct net_bridge *br = p->br; |
1826 | + struct net_port_vlans *v; |
1827 | + |
1828 | + if (!br->vlan_enabled) |
1829 | + return true; |
1830 | + |
1831 | + v = rcu_dereference(p->vlan_info); |
1832 | + if (!v) |
1833 | + return false; |
1834 | + |
1835 | + br_vlan_get_tag(skb, vid); |
1836 | + if (!*vid) { |
1837 | + *vid = br_get_pvid(v); |
1838 | + if (*vid == VLAN_N_VID) |
1839 | + return false; |
1840 | + |
1841 | + return true; |
1842 | + } |
1843 | + |
1844 | + if (test_bit(*vid, v->vlan_bitmap)) |
1845 | + return true; |
1846 | + |
1847 | + return false; |
1848 | +} |
1849 | + |
1850 | /* Must be protected by RTNL. |
1851 | * Must be called with vid in range from 1 to 4094 inclusive. |
1852 | */ |
1853 | diff --git a/net/can/gw.c b/net/can/gw.c |
1854 | index ac31891967da..050a2110d43f 100644 |
1855 | --- a/net/can/gw.c |
1856 | +++ b/net/can/gw.c |
1857 | @@ -804,7 +804,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh) |
1858 | u8 limhops = 0; |
1859 | int err = 0; |
1860 | |
1861 | - if (!capable(CAP_NET_ADMIN)) |
1862 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
1863 | return -EPERM; |
1864 | |
1865 | if (nlmsg_len(nlh) < sizeof(*r)) |
1866 | @@ -893,7 +893,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh) |
1867 | u8 limhops = 0; |
1868 | int err = 0; |
1869 | |
1870 | - if (!capable(CAP_NET_ADMIN)) |
1871 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
1872 | return -EPERM; |
1873 | |
1874 | if (nlmsg_len(nlh) < sizeof(*r)) |
1875 | diff --git a/net/core/dev.c b/net/core/dev.c |
1876 | index fccc195e0fc8..4c1b483f7c07 100644 |
1877 | --- a/net/core/dev.c |
1878 | +++ b/net/core/dev.c |
1879 | @@ -6548,6 +6548,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue); |
1880 | /** |
1881 | * unregister_netdevice_many - unregister many devices |
1882 | * @head: list of devices |
1883 | + * |
1884 | + * Note: As most callers use a stack allocated list_head, |
1885 | + * we force a list_del() to make sure stack wont be corrupted later. |
1886 | */ |
1887 | void unregister_netdevice_many(struct list_head *head) |
1888 | { |
1889 | @@ -6557,6 +6560,7 @@ void unregister_netdevice_many(struct list_head *head) |
1890 | rollback_registered_many(head); |
1891 | list_for_each_entry(dev, head, unreg_list) |
1892 | net_set_todo(dev); |
1893 | + list_del(head); |
1894 | } |
1895 | } |
1896 | EXPORT_SYMBOL(unregister_netdevice_many); |
1897 | @@ -7012,7 +7016,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) |
1898 | } |
1899 | } |
1900 | unregister_netdevice_many(&dev_kill_list); |
1901 | - list_del(&dev_kill_list); |
1902 | rtnl_unlock(); |
1903 | } |
1904 | |
1905 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
1906 | index 83b9d6ae5119..aef1500ebc05 100644 |
1907 | --- a/net/core/rtnetlink.c |
1908 | +++ b/net/core/rtnetlink.c |
1909 | @@ -1166,6 +1166,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) |
1910 | struct nlattr *tb[IFLA_MAX+1]; |
1911 | u32 ext_filter_mask = 0; |
1912 | int err; |
1913 | + int hdrlen; |
1914 | |
1915 | s_h = cb->args[0]; |
1916 | s_idx = cb->args[1]; |
1917 | @@ -1173,8 +1174,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) |
1918 | rcu_read_lock(); |
1919 | cb->seq = net->dev_base_seq; |
1920 | |
1921 | - if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX, |
1922 | - ifla_policy) >= 0) { |
1923 | + /* A hack to preserve kernel<->userspace interface. |
1924 | + * The correct header is ifinfomsg. It is consistent with rtnl_getlink. |
1925 | + * However, before Linux v3.9 the code here assumed rtgenmsg and that's |
1926 | + * what iproute2 < v3.9.0 used. |
1927 | + * We can detect the old iproute2. Even including the IFLA_EXT_MASK |
1928 | + * attribute, its netlink message is shorter than struct ifinfomsg. |
1929 | + */ |
1930 | + hdrlen = nlmsg_len(cb->nlh) < sizeof(struct ifinfomsg) ? |
1931 | + sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg); |
1932 | + |
1933 | + if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) { |
1934 | |
1935 | if (tb[IFLA_EXT_MASK]) |
1936 | ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]); |
1937 | @@ -1428,7 +1438,8 @@ static int do_set_master(struct net_device *dev, int ifindex) |
1938 | return 0; |
1939 | } |
1940 | |
1941 | -static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, |
1942 | +static int do_setlink(const struct sk_buff *skb, |
1943 | + struct net_device *dev, struct ifinfomsg *ifm, |
1944 | struct nlattr **tb, char *ifname, int modified) |
1945 | { |
1946 | const struct net_device_ops *ops = dev->netdev_ops; |
1947 | @@ -1440,7 +1451,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, |
1948 | err = PTR_ERR(net); |
1949 | goto errout; |
1950 | } |
1951 | - if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { |
1952 | + if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) { |
1953 | err = -EPERM; |
1954 | goto errout; |
1955 | } |
1956 | @@ -1694,7 +1705,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh) |
1957 | if (err < 0) |
1958 | goto errout; |
1959 | |
1960 | - err = do_setlink(dev, ifm, tb, ifname, 0); |
1961 | + err = do_setlink(skb, dev, ifm, tb, ifname, 0); |
1962 | errout: |
1963 | return err; |
1964 | } |
1965 | @@ -1734,7 +1745,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh) |
1966 | |
1967 | ops->dellink(dev, &list_kill); |
1968 | unregister_netdevice_many(&list_kill); |
1969 | - list_del(&list_kill); |
1970 | return 0; |
1971 | } |
1972 | |
1973 | @@ -1811,7 +1821,8 @@ err: |
1974 | } |
1975 | EXPORT_SYMBOL(rtnl_create_link); |
1976 | |
1977 | -static int rtnl_group_changelink(struct net *net, int group, |
1978 | +static int rtnl_group_changelink(const struct sk_buff *skb, |
1979 | + struct net *net, int group, |
1980 | struct ifinfomsg *ifm, |
1981 | struct nlattr **tb) |
1982 | { |
1983 | @@ -1820,7 +1831,7 @@ static int rtnl_group_changelink(struct net *net, int group, |
1984 | |
1985 | for_each_netdev(net, dev) { |
1986 | if (dev->group == group) { |
1987 | - err = do_setlink(dev, ifm, tb, NULL, 0); |
1988 | + err = do_setlink(skb, dev, ifm, tb, NULL, 0); |
1989 | if (err < 0) |
1990 | return err; |
1991 | } |
1992 | @@ -1962,12 +1973,12 @@ replay: |
1993 | modified = 1; |
1994 | } |
1995 | |
1996 | - return do_setlink(dev, ifm, tb, ifname, modified); |
1997 | + return do_setlink(skb, dev, ifm, tb, ifname, modified); |
1998 | } |
1999 | |
2000 | if (!(nlh->nlmsg_flags & NLM_F_CREATE)) { |
2001 | if (ifm->ifi_index == 0 && tb[IFLA_GROUP]) |
2002 | - return rtnl_group_changelink(net, |
2003 | + return rtnl_group_changelink(skb, net, |
2004 | nla_get_u32(tb[IFLA_GROUP]), |
2005 | ifm, tb); |
2006 | return -ENODEV; |
2007 | @@ -2084,9 +2095,13 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh) |
2008 | struct nlattr *tb[IFLA_MAX+1]; |
2009 | u32 ext_filter_mask = 0; |
2010 | u16 min_ifinfo_dump_size = 0; |
2011 | + int hdrlen; |
2012 | + |
2013 | + /* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */ |
2014 | + hdrlen = nlmsg_len(nlh) < sizeof(struct ifinfomsg) ? |
2015 | + sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg); |
2016 | |
2017 | - if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX, |
2018 | - ifla_policy) >= 0) { |
2019 | + if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) { |
2020 | if (tb[IFLA_EXT_MASK]) |
2021 | ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]); |
2022 | } |
2023 | @@ -2354,7 +2369,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh) |
2024 | int err = -EINVAL; |
2025 | __u8 *addr; |
2026 | |
2027 | - if (!capable(CAP_NET_ADMIN)) |
2028 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2029 | return -EPERM; |
2030 | |
2031 | err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL); |
2032 | @@ -2806,7 +2821,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) |
2033 | sz_idx = type>>2; |
2034 | kind = type&3; |
2035 | |
2036 | - if (kind != 2 && !ns_capable(net->user_ns, CAP_NET_ADMIN)) |
2037 | + if (kind != 2 && !netlink_net_capable(skb, CAP_NET_ADMIN)) |
2038 | return -EPERM; |
2039 | |
2040 | if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) { |
2041 | diff --git a/net/core/sock.c b/net/core/sock.c |
2042 | index c0fc6bdad1e3..c8069561bdb7 100644 |
2043 | --- a/net/core/sock.c |
2044 | +++ b/net/core/sock.c |
2045 | @@ -145,6 +145,55 @@ |
2046 | static DEFINE_MUTEX(proto_list_mutex); |
2047 | static LIST_HEAD(proto_list); |
2048 | |
2049 | +/** |
2050 | + * sk_ns_capable - General socket capability test |
2051 | + * @sk: Socket to use a capability on or through |
2052 | + * @user_ns: The user namespace of the capability to use |
2053 | + * @cap: The capability to use |
2054 | + * |
2055 | + * Test to see if the opener of the socket had when the socket was |
2056 | + * created and the current process has the capability @cap in the user |
2057 | + * namespace @user_ns. |
2058 | + */ |
2059 | +bool sk_ns_capable(const struct sock *sk, |
2060 | + struct user_namespace *user_ns, int cap) |
2061 | +{ |
2062 | + return file_ns_capable(sk->sk_socket->file, user_ns, cap) && |
2063 | + ns_capable(user_ns, cap); |
2064 | +} |
2065 | +EXPORT_SYMBOL(sk_ns_capable); |
2066 | + |
2067 | +/** |
2068 | + * sk_capable - Socket global capability test |
2069 | + * @sk: Socket to use a capability on or through |
2070 | + * @cap: The global capbility to use |
2071 | + * |
2072 | + * Test to see if the opener of the socket had when the socket was |
2073 | + * created and the current process has the capability @cap in all user |
2074 | + * namespaces. |
2075 | + */ |
2076 | +bool sk_capable(const struct sock *sk, int cap) |
2077 | +{ |
2078 | + return sk_ns_capable(sk, &init_user_ns, cap); |
2079 | +} |
2080 | +EXPORT_SYMBOL(sk_capable); |
2081 | + |
2082 | +/** |
2083 | + * sk_net_capable - Network namespace socket capability test |
2084 | + * @sk: Socket to use a capability on or through |
2085 | + * @cap: The capability to use |
2086 | + * |
2087 | + * Test to see if the opener of the socket had when the socke was created |
2088 | + * and the current process has the capability @cap over the network namespace |
2089 | + * the socket is a member of. |
2090 | + */ |
2091 | +bool sk_net_capable(const struct sock *sk, int cap) |
2092 | +{ |
2093 | + return sk_ns_capable(sk, sock_net(sk)->user_ns, cap); |
2094 | +} |
2095 | +EXPORT_SYMBOL(sk_net_capable); |
2096 | + |
2097 | + |
2098 | #ifdef CONFIG_MEMCG_KMEM |
2099 | int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss) |
2100 | { |
2101 | diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c |
2102 | index 6a7fae228634..c38e7a2b5a8e 100644 |
2103 | --- a/net/core/sock_diag.c |
2104 | +++ b/net/core/sock_diag.c |
2105 | @@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) |
2106 | } |
2107 | EXPORT_SYMBOL_GPL(sock_diag_put_meminfo); |
2108 | |
2109 | -int sock_diag_put_filterinfo(struct sock *sk, |
2110 | +int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk, |
2111 | struct sk_buff *skb, int attrtype) |
2112 | { |
2113 | struct nlattr *attr; |
2114 | @@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct sock *sk, |
2115 | unsigned int len; |
2116 | int err = 0; |
2117 | |
2118 | - if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { |
2119 | + if (!may_report_filterinfo) { |
2120 | nla_reserve(skb, attrtype, 0); |
2121 | return 0; |
2122 | } |
2123 | diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c |
2124 | index 553644402670..f8b98d89c285 100644 |
2125 | --- a/net/dcb/dcbnl.c |
2126 | +++ b/net/dcb/dcbnl.c |
2127 | @@ -1669,7 +1669,7 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh) |
2128 | struct nlmsghdr *reply_nlh = NULL; |
2129 | const struct reply_func *fn; |
2130 | |
2131 | - if ((nlh->nlmsg_type == RTM_SETDCB) && !capable(CAP_NET_ADMIN)) |
2132 | + if ((nlh->nlmsg_type == RTM_SETDCB) && !netlink_capable(skb, CAP_NET_ADMIN)) |
2133 | return -EPERM; |
2134 | |
2135 | ret = nlmsg_parse(nlh, sizeof(*dcb), tb, DCB_ATTR_MAX, |
2136 | diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c |
2137 | index a603823a3e27..3b726f31c64c 100644 |
2138 | --- a/net/decnet/dn_dev.c |
2139 | +++ b/net/decnet/dn_dev.c |
2140 | @@ -574,7 +574,7 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh) |
2141 | struct dn_ifaddr __rcu **ifap; |
2142 | int err = -EINVAL; |
2143 | |
2144 | - if (!capable(CAP_NET_ADMIN)) |
2145 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2146 | return -EPERM; |
2147 | |
2148 | if (!net_eq(net, &init_net)) |
2149 | @@ -618,7 +618,7 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh) |
2150 | struct dn_ifaddr *ifa; |
2151 | int err; |
2152 | |
2153 | - if (!capable(CAP_NET_ADMIN)) |
2154 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2155 | return -EPERM; |
2156 | |
2157 | if (!net_eq(net, &init_net)) |
2158 | diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c |
2159 | index 57dc159245ec..d332aefb0846 100644 |
2160 | --- a/net/decnet/dn_fib.c |
2161 | +++ b/net/decnet/dn_fib.c |
2162 | @@ -505,7 +505,7 @@ static int dn_fib_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh) |
2163 | struct nlattr *attrs[RTA_MAX+1]; |
2164 | int err; |
2165 | |
2166 | - if (!capable(CAP_NET_ADMIN)) |
2167 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2168 | return -EPERM; |
2169 | |
2170 | if (!net_eq(net, &init_net)) |
2171 | @@ -530,7 +530,7 @@ static int dn_fib_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh) |
2172 | struct nlattr *attrs[RTA_MAX+1]; |
2173 | int err; |
2174 | |
2175 | - if (!capable(CAP_NET_ADMIN)) |
2176 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2177 | return -EPERM; |
2178 | |
2179 | if (!net_eq(net, &init_net)) |
2180 | diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c |
2181 | index e83015cecfa7..e4d9560a910b 100644 |
2182 | --- a/net/decnet/netfilter/dn_rtmsg.c |
2183 | +++ b/net/decnet/netfilter/dn_rtmsg.c |
2184 | @@ -107,7 +107,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb) |
2185 | if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) |
2186 | return; |
2187 | |
2188 | - if (!capable(CAP_NET_ADMIN)) |
2189 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2190 | RCV_SKB_FAIL(-EPERM); |
2191 | |
2192 | /* Eventually we might send routing messages too */ |
2193 | diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c |
2194 | index 8b5134c582f1..a3095fdefbed 100644 |
2195 | --- a/net/ipv4/datagram.c |
2196 | +++ b/net/ipv4/datagram.c |
2197 | @@ -86,18 +86,26 @@ out: |
2198 | } |
2199 | EXPORT_SYMBOL(ip4_datagram_connect); |
2200 | |
2201 | +/* Because UDP xmit path can manipulate sk_dst_cache without holding |
2202 | + * socket lock, we need to use sk_dst_set() here, |
2203 | + * even if we own the socket lock. |
2204 | + */ |
2205 | void ip4_datagram_release_cb(struct sock *sk) |
2206 | { |
2207 | const struct inet_sock *inet = inet_sk(sk); |
2208 | const struct ip_options_rcu *inet_opt; |
2209 | __be32 daddr = inet->inet_daddr; |
2210 | + struct dst_entry *dst; |
2211 | struct flowi4 fl4; |
2212 | struct rtable *rt; |
2213 | |
2214 | - if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0)) |
2215 | - return; |
2216 | - |
2217 | rcu_read_lock(); |
2218 | + |
2219 | + dst = __sk_dst_get(sk); |
2220 | + if (!dst || !dst->obsolete || dst->ops->check(dst, 0)) { |
2221 | + rcu_read_unlock(); |
2222 | + return; |
2223 | + } |
2224 | inet_opt = rcu_dereference(inet->inet_opt); |
2225 | if (inet_opt && inet_opt->opt.srr) |
2226 | daddr = inet_opt->opt.faddr; |
2227 | @@ -105,8 +113,10 @@ void ip4_datagram_release_cb(struct sock *sk) |
2228 | inet->inet_saddr, inet->inet_dport, |
2229 | inet->inet_sport, sk->sk_protocol, |
2230 | RT_CONN_FLAGS(sk), sk->sk_bound_dev_if); |
2231 | - if (!IS_ERR(rt)) |
2232 | - __sk_dst_set(sk, &rt->dst); |
2233 | + |
2234 | + dst = !IS_ERR(rt) ? &rt->dst : NULL; |
2235 | + sk_dst_set(sk, dst); |
2236 | + |
2237 | rcu_read_unlock(); |
2238 | } |
2239 | EXPORT_SYMBOL_GPL(ip4_datagram_release_cb); |
2240 | diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c |
2241 | index 812b18351462..62eaa005e146 100644 |
2242 | --- a/net/ipv4/ipip.c |
2243 | +++ b/net/ipv4/ipip.c |
2244 | @@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb, u32 info) |
2245 | |
2246 | if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { |
2247 | ipv4_update_pmtu(skb, dev_net(skb->dev), info, |
2248 | - t->dev->ifindex, 0, IPPROTO_IPIP, 0); |
2249 | + t->parms.link, 0, IPPROTO_IPIP, 0); |
2250 | err = 0; |
2251 | goto out; |
2252 | } |
2253 | |
2254 | if (type == ICMP_REDIRECT) { |
2255 | - ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0, |
2256 | + ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, |
2257 | IPPROTO_IPIP, 0); |
2258 | err = 0; |
2259 | goto out; |
2260 | @@ -486,4 +486,5 @@ static void __exit ipip_fini(void) |
2261 | module_init(ipip_init); |
2262 | module_exit(ipip_fini); |
2263 | MODULE_LICENSE("GPL"); |
2264 | +MODULE_ALIAS_RTNL_LINK("ipip"); |
2265 | MODULE_ALIAS_NETDEV("tunl0"); |
2266 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c |
2267 | index eeaac399420d..e3647465138b 100644 |
2268 | --- a/net/ipv4/tcp_input.c |
2269 | +++ b/net/ipv4/tcp_input.c |
2270 | @@ -2683,13 +2683,12 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack) |
2271 | bool recovered = !before(tp->snd_una, tp->high_seq); |
2272 | |
2273 | if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */ |
2274 | - if (flag & FLAG_ORIG_SACK_ACKED) { |
2275 | - /* Step 3.b. A timeout is spurious if not all data are |
2276 | - * lost, i.e., never-retransmitted data are (s)acked. |
2277 | - */ |
2278 | - tcp_try_undo_loss(sk, true); |
2279 | + /* Step 3.b. A timeout is spurious if not all data are |
2280 | + * lost, i.e., never-retransmitted data are (s)acked. |
2281 | + */ |
2282 | + if (tcp_try_undo_loss(sk, flag & FLAG_ORIG_SACK_ACKED)) |
2283 | return; |
2284 | - } |
2285 | + |
2286 | if (after(tp->snd_nxt, tp->high_seq) && |
2287 | (flag & FLAG_DATA_SACKED || is_dupack)) { |
2288 | tp->frto = 0; /* Loss was real: 2nd part of step 3.a */ |
2289 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
2290 | index 77bd16fa9f34..b25e852625d8 100644 |
2291 | --- a/net/ipv4/udp.c |
2292 | +++ b/net/ipv4/udp.c |
2293 | @@ -1833,6 +1833,10 @@ static struct sock *__udp4_lib_mcast_demux_lookup(struct net *net, |
2294 | unsigned int count, slot = udp_hashfn(net, hnum, udp_table.mask); |
2295 | struct udp_hslot *hslot = &udp_table.hash[slot]; |
2296 | |
2297 | + /* Do not bother scanning a too big list */ |
2298 | + if (hslot->count > 10) |
2299 | + return NULL; |
2300 | + |
2301 | rcu_read_lock(); |
2302 | begin: |
2303 | count = 0; |
2304 | diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c |
2305 | index 0e51f68ab163..912033957ad3 100644 |
2306 | --- a/net/ipv6/ip6_tunnel.c |
2307 | +++ b/net/ipv6/ip6_tunnel.c |
2308 | @@ -61,6 +61,7 @@ |
2309 | MODULE_AUTHOR("Ville Nuorvala"); |
2310 | MODULE_DESCRIPTION("IPv6 tunneling device"); |
2311 | MODULE_LICENSE("GPL"); |
2312 | +MODULE_ALIAS_RTNL_LINK("ip6tnl"); |
2313 | MODULE_ALIAS_NETDEV("ip6tnl0"); |
2314 | |
2315 | #ifdef IP6_TNL_DEBUG |
2316 | diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c |
2317 | index 827f795209cf..b31a01263185 100644 |
2318 | --- a/net/ipv6/output_core.c |
2319 | +++ b/net/ipv6/output_core.c |
2320 | @@ -10,7 +10,7 @@ |
2321 | void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) |
2322 | { |
2323 | static atomic_t ipv6_fragmentation_id; |
2324 | - int old, new; |
2325 | + int ident; |
2326 | |
2327 | #if IS_ENABLED(CONFIG_IPV6) |
2328 | if (rt && !(rt->dst.flags & DST_NOPEER)) { |
2329 | @@ -26,13 +26,8 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) |
2330 | } |
2331 | } |
2332 | #endif |
2333 | - do { |
2334 | - old = atomic_read(&ipv6_fragmentation_id); |
2335 | - new = old + 1; |
2336 | - if (!new) |
2337 | - new = 1; |
2338 | - } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old); |
2339 | - fhdr->identification = htonl(new); |
2340 | + ident = atomic_inc_return(&ipv6_fragmentation_id); |
2341 | + fhdr->identification = htonl(ident); |
2342 | } |
2343 | EXPORT_SYMBOL(ipv6_select_ident); |
2344 | |
2345 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c |
2346 | index b4d74c86586c..fe548ba72687 100644 |
2347 | --- a/net/ipv6/sit.c |
2348 | +++ b/net/ipv6/sit.c |
2349 | @@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb, u32 info) |
2350 | |
2351 | if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { |
2352 | ipv4_update_pmtu(skb, dev_net(skb->dev), info, |
2353 | - t->dev->ifindex, 0, IPPROTO_IPV6, 0); |
2354 | + t->parms.link, 0, IPPROTO_IPV6, 0); |
2355 | err = 0; |
2356 | goto out; |
2357 | } |
2358 | if (type == ICMP_REDIRECT) { |
2359 | - ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0, |
2360 | + ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, |
2361 | IPPROTO_IPV6, 0); |
2362 | err = 0; |
2363 | goto out; |
2364 | @@ -1850,4 +1850,5 @@ xfrm_tunnel_failed: |
2365 | module_init(sit_init); |
2366 | module_exit(sit_cleanup); |
2367 | MODULE_LICENSE("GPL"); |
2368 | +MODULE_ALIAS_RTNL_LINK("sit"); |
2369 | MODULE_ALIAS_NETDEV("sit0"); |
2370 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c |
2371 | index 1e586d92260e..20b63d2ab70f 100644 |
2372 | --- a/net/ipv6/udp.c |
2373 | +++ b/net/ipv6/udp.c |
2374 | @@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk, |
2375 | if (inet->inet_dport != rmt_port) |
2376 | continue; |
2377 | } |
2378 | - if (!ipv6_addr_any(&sk->sk_v6_daddr) && |
2379 | - !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) |
2380 | + if (!ipv6_addr_any(&s->sk_v6_daddr) && |
2381 | + !ipv6_addr_equal(&s->sk_v6_daddr, rmt_addr)) |
2382 | continue; |
2383 | |
2384 | if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif) |
2385 | continue; |
2386 | |
2387 | - if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) { |
2388 | - if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr)) |
2389 | + if (!ipv6_addr_any(&s->sk_v6_rcv_saddr)) { |
2390 | + if (!ipv6_addr_equal(&s->sk_v6_rcv_saddr, loc_addr)) |
2391 | continue; |
2392 | } |
2393 | if (!inet6_mc_check(s, loc_addr, rmt_addr)) |
2394 | diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c |
2395 | index ce1c44370610..8f7fabc46c97 100644 |
2396 | --- a/net/mac80211/iface.c |
2397 | +++ b/net/mac80211/iface.c |
2398 | @@ -1761,7 +1761,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local) |
2399 | } |
2400 | mutex_unlock(&local->iflist_mtx); |
2401 | unregister_netdevice_many(&unreg_list); |
2402 | - list_del(&unreg_list); |
2403 | |
2404 | list_for_each_entry_safe(sdata, tmp, &wdev_list, list) { |
2405 | list_del(&sdata->list); |
2406 | diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c |
2407 | index 880418d3ee50..bf8a108b46e2 100644 |
2408 | --- a/net/netfilter/nfnetlink.c |
2409 | +++ b/net/netfilter/nfnetlink.c |
2410 | @@ -367,7 +367,7 @@ static void nfnetlink_rcv(struct sk_buff *skb) |
2411 | skb->len < nlh->nlmsg_len) |
2412 | return; |
2413 | |
2414 | - if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { |
2415 | + if (!netlink_net_capable(skb, CAP_NET_ADMIN)) { |
2416 | netlink_ack(skb, nlh, -EPERM); |
2417 | return; |
2418 | } |
2419 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c |
2420 | index 04748ab649c2..7f40fd25acae 100644 |
2421 | --- a/net/netlink/af_netlink.c |
2422 | +++ b/net/netlink/af_netlink.c |
2423 | @@ -1360,7 +1360,74 @@ retry: |
2424 | return err; |
2425 | } |
2426 | |
2427 | -static inline int netlink_capable(const struct socket *sock, unsigned int flag) |
2428 | +/** |
2429 | + * __netlink_ns_capable - General netlink message capability test |
2430 | + * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace. |
2431 | + * @user_ns: The user namespace of the capability to use |
2432 | + * @cap: The capability to use |
2433 | + * |
2434 | + * Test to see if the opener of the socket we received the message |
2435 | + * from had when the netlink socket was created and the sender of the |
2436 | + * message has has the capability @cap in the user namespace @user_ns. |
2437 | + */ |
2438 | +bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, |
2439 | + struct user_namespace *user_ns, int cap) |
2440 | +{ |
2441 | + return ((nsp->flags & NETLINK_SKB_DST) || |
2442 | + file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) && |
2443 | + ns_capable(user_ns, cap); |
2444 | +} |
2445 | +EXPORT_SYMBOL(__netlink_ns_capable); |
2446 | + |
2447 | +/** |
2448 | + * netlink_ns_capable - General netlink message capability test |
2449 | + * @skb: socket buffer holding a netlink command from userspace |
2450 | + * @user_ns: The user namespace of the capability to use |
2451 | + * @cap: The capability to use |
2452 | + * |
2453 | + * Test to see if the opener of the socket we received the message |
2454 | + * from had when the netlink socket was created and the sender of the |
2455 | + * message has has the capability @cap in the user namespace @user_ns. |
2456 | + */ |
2457 | +bool netlink_ns_capable(const struct sk_buff *skb, |
2458 | + struct user_namespace *user_ns, int cap) |
2459 | +{ |
2460 | + return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap); |
2461 | +} |
2462 | +EXPORT_SYMBOL(netlink_ns_capable); |
2463 | + |
2464 | +/** |
2465 | + * netlink_capable - Netlink global message capability test |
2466 | + * @skb: socket buffer holding a netlink command from userspace |
2467 | + * @cap: The capability to use |
2468 | + * |
2469 | + * Test to see if the opener of the socket we received the message |
2470 | + * from had when the netlink socket was created and the sender of the |
2471 | + * message has has the capability @cap in all user namespaces. |
2472 | + */ |
2473 | +bool netlink_capable(const struct sk_buff *skb, int cap) |
2474 | +{ |
2475 | + return netlink_ns_capable(skb, &init_user_ns, cap); |
2476 | +} |
2477 | +EXPORT_SYMBOL(netlink_capable); |
2478 | + |
2479 | +/** |
2480 | + * netlink_net_capable - Netlink network namespace message capability test |
2481 | + * @skb: socket buffer holding a netlink command from userspace |
2482 | + * @cap: The capability to use |
2483 | + * |
2484 | + * Test to see if the opener of the socket we received the message |
2485 | + * from had when the netlink socket was created and the sender of the |
2486 | + * message has has the capability @cap over the network namespace of |
2487 | + * the socket we received the message from. |
2488 | + */ |
2489 | +bool netlink_net_capable(const struct sk_buff *skb, int cap) |
2490 | +{ |
2491 | + return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap); |
2492 | +} |
2493 | +EXPORT_SYMBOL(netlink_net_capable); |
2494 | + |
2495 | +static inline int netlink_allowed(const struct socket *sock, unsigned int flag) |
2496 | { |
2497 | return (nl_table[sock->sk->sk_protocol].flags & flag) || |
2498 | ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); |
2499 | @@ -1428,7 +1495,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, |
2500 | |
2501 | /* Only superuser is allowed to listen multicasts */ |
2502 | if (nladdr->nl_groups) { |
2503 | - if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV)) |
2504 | + if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) |
2505 | return -EPERM; |
2506 | err = netlink_realloc_groups(sk); |
2507 | if (err) |
2508 | @@ -1490,7 +1557,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, |
2509 | return -EINVAL; |
2510 | |
2511 | if ((nladdr->nl_groups || nladdr->nl_pid) && |
2512 | - !netlink_capable(sock, NL_CFG_F_NONROOT_SEND)) |
2513 | + !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) |
2514 | return -EPERM; |
2515 | |
2516 | if (!nlk->portid) |
2517 | @@ -2096,7 +2163,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, |
2518 | break; |
2519 | case NETLINK_ADD_MEMBERSHIP: |
2520 | case NETLINK_DROP_MEMBERSHIP: { |
2521 | - if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV)) |
2522 | + if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) |
2523 | return -EPERM; |
2524 | err = netlink_realloc_groups(sk); |
2525 | if (err) |
2526 | @@ -2228,6 +2295,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, |
2527 | struct sk_buff *skb; |
2528 | int err; |
2529 | struct scm_cookie scm; |
2530 | + u32 netlink_skb_flags = 0; |
2531 | |
2532 | if (msg->msg_flags&MSG_OOB) |
2533 | return -EOPNOTSUPP; |
2534 | @@ -2247,8 +2315,9 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, |
2535 | dst_group = ffs(addr->nl_groups); |
2536 | err = -EPERM; |
2537 | if ((dst_group || dst_portid) && |
2538 | - !netlink_capable(sock, NL_CFG_F_NONROOT_SEND)) |
2539 | + !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) |
2540 | goto out; |
2541 | + netlink_skb_flags |= NETLINK_SKB_DST; |
2542 | } else { |
2543 | dst_portid = nlk->dst_portid; |
2544 | dst_group = nlk->dst_group; |
2545 | @@ -2278,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, |
2546 | NETLINK_CB(skb).portid = nlk->portid; |
2547 | NETLINK_CB(skb).dst_group = dst_group; |
2548 | NETLINK_CB(skb).creds = siocb->scm->creds; |
2549 | + NETLINK_CB(skb).flags = netlink_skb_flags; |
2550 | |
2551 | err = -EFAULT; |
2552 | if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) { |
2553 | diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c |
2554 | index b1dcdb932a86..a3ba3ca0ff92 100644 |
2555 | --- a/net/netlink/genetlink.c |
2556 | +++ b/net/netlink/genetlink.c |
2557 | @@ -561,7 +561,7 @@ static int genl_family_rcv_msg(struct genl_family *family, |
2558 | return -EOPNOTSUPP; |
2559 | |
2560 | if ((ops->flags & GENL_ADMIN_PERM) && |
2561 | - !capable(CAP_NET_ADMIN)) |
2562 | + !netlink_capable(skb, CAP_NET_ADMIN)) |
2563 | return -EPERM; |
2564 | |
2565 | if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) { |
2566 | diff --git a/net/packet/diag.c b/net/packet/diag.c |
2567 | index 435ff99ba8c7..92f2c7107eec 100644 |
2568 | --- a/net/packet/diag.c |
2569 | +++ b/net/packet/diag.c |
2570 | @@ -128,6 +128,7 @@ static int pdiag_put_fanout(struct packet_sock *po, struct sk_buff *nlskb) |
2571 | |
2572 | static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, |
2573 | struct packet_diag_req *req, |
2574 | + bool may_report_filterinfo, |
2575 | struct user_namespace *user_ns, |
2576 | u32 portid, u32 seq, u32 flags, int sk_ino) |
2577 | { |
2578 | @@ -172,7 +173,8 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, |
2579 | goto out_nlmsg_trim; |
2580 | |
2581 | if ((req->pdiag_show & PACKET_SHOW_FILTER) && |
2582 | - sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER)) |
2583 | + sock_diag_put_filterinfo(may_report_filterinfo, sk, skb, |
2584 | + PACKET_DIAG_FILTER)) |
2585 | goto out_nlmsg_trim; |
2586 | |
2587 | return nlmsg_end(skb, nlh); |
2588 | @@ -188,9 +190,11 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) |
2589 | struct packet_diag_req *req; |
2590 | struct net *net; |
2591 | struct sock *sk; |
2592 | + bool may_report_filterinfo; |
2593 | |
2594 | net = sock_net(skb->sk); |
2595 | req = nlmsg_data(cb->nlh); |
2596 | + may_report_filterinfo = netlink_net_capable(cb->skb, CAP_NET_ADMIN); |
2597 | |
2598 | mutex_lock(&net->packet.sklist_lock); |
2599 | sk_for_each(sk, &net->packet.sklist) { |
2600 | @@ -200,6 +204,7 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) |
2601 | goto next; |
2602 | |
2603 | if (sk_diag_fill(sk, skb, req, |
2604 | + may_report_filterinfo, |
2605 | sk_user_ns(NETLINK_CB(cb->skb).sk), |
2606 | NETLINK_CB(cb->skb).portid, |
2607 | cb->nlh->nlmsg_seq, NLM_F_MULTI, |
2608 | diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c |
2609 | index dc15f4300808..b64151ade6b3 100644 |
2610 | --- a/net/phonet/pn_netlink.c |
2611 | +++ b/net/phonet/pn_netlink.c |
2612 | @@ -70,10 +70,10 @@ static int addr_doit(struct sk_buff *skb, struct nlmsghdr *nlh) |
2613 | int err; |
2614 | u8 pnaddr; |
2615 | |
2616 | - if (!capable(CAP_NET_ADMIN)) |
2617 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2618 | return -EPERM; |
2619 | |
2620 | - if (!capable(CAP_SYS_ADMIN)) |
2621 | + if (!netlink_capable(skb, CAP_SYS_ADMIN)) |
2622 | return -EPERM; |
2623 | |
2624 | ASSERT_RTNL(); |
2625 | @@ -233,10 +233,10 @@ static int route_doit(struct sk_buff *skb, struct nlmsghdr *nlh) |
2626 | int err; |
2627 | u8 dst; |
2628 | |
2629 | - if (!capable(CAP_NET_ADMIN)) |
2630 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2631 | return -EPERM; |
2632 | |
2633 | - if (!capable(CAP_SYS_ADMIN)) |
2634 | + if (!netlink_capable(skb, CAP_SYS_ADMIN)) |
2635 | return -EPERM; |
2636 | |
2637 | ASSERT_RTNL(); |
2638 | diff --git a/net/sched/act_api.c b/net/sched/act_api.c |
2639 | index 72bdc7166345..3b2265523552 100644 |
2640 | --- a/net/sched/act_api.c |
2641 | +++ b/net/sched/act_api.c |
2642 | @@ -908,7 +908,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n) |
2643 | u32 portid = skb ? NETLINK_CB(skb).portid : 0; |
2644 | int ret = 0, ovr = 0; |
2645 | |
2646 | - if ((n->nlmsg_type != RTM_GETACTION) && !capable(CAP_NET_ADMIN)) |
2647 | + if ((n->nlmsg_type != RTM_GETACTION) && !netlink_capable(skb, CAP_NET_ADMIN)) |
2648 | return -EPERM; |
2649 | |
2650 | ret = nlmsg_parse(n, sizeof(struct tcamsg), tca, TCA_ACT_MAX, NULL); |
2651 | diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c |
2652 | index 29a30a14c315..bdbdb1a7920a 100644 |
2653 | --- a/net/sched/cls_api.c |
2654 | +++ b/net/sched/cls_api.c |
2655 | @@ -134,7 +134,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n) |
2656 | int err; |
2657 | int tp_created = 0; |
2658 | |
2659 | - if ((n->nlmsg_type != RTM_GETTFILTER) && !capable(CAP_NET_ADMIN)) |
2660 | + if ((n->nlmsg_type != RTM_GETTFILTER) && !netlink_capable(skb, CAP_NET_ADMIN)) |
2661 | return -EPERM; |
2662 | |
2663 | replay: |
2664 | diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c |
2665 | index a07d55e75698..98532cfa7823 100644 |
2666 | --- a/net/sched/sch_api.c |
2667 | +++ b/net/sched/sch_api.c |
2668 | @@ -1084,7 +1084,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n) |
2669 | struct Qdisc *p = NULL; |
2670 | int err; |
2671 | |
2672 | - if ((n->nlmsg_type != RTM_GETQDISC) && !capable(CAP_NET_ADMIN)) |
2673 | + if ((n->nlmsg_type != RTM_GETQDISC) && !netlink_capable(skb, CAP_NET_ADMIN)) |
2674 | return -EPERM; |
2675 | |
2676 | err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL); |
2677 | @@ -1151,7 +1151,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n) |
2678 | struct Qdisc *q, *p; |
2679 | int err; |
2680 | |
2681 | - if (!capable(CAP_NET_ADMIN)) |
2682 | + if (!netlink_capable(skb, CAP_NET_ADMIN)) |
2683 | return -EPERM; |
2684 | |
2685 | replay: |
2686 | @@ -1491,7 +1491,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n) |
2687 | u32 qid; |
2688 | int err; |
2689 | |
2690 | - if ((n->nlmsg_type != RTM_GETTCLASS) && !capable(CAP_NET_ADMIN)) |
2691 | + if ((n->nlmsg_type != RTM_GETTCLASS) && !netlink_capable(skb, CAP_NET_ADMIN)) |
2692 | return -EPERM; |
2693 | |
2694 | err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL); |
2695 | diff --git a/net/sctp/associola.c b/net/sctp/associola.c |
2696 | index 878e17aafbe5..a4d570126f5d 100644 |
2697 | --- a/net/sctp/associola.c |
2698 | +++ b/net/sctp/associola.c |
2699 | @@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_association *asoc) |
2700 | /* Only real associations count against the endpoint, so |
2701 | * don't bother for if this is a temporary association. |
2702 | */ |
2703 | - if (!asoc->temp) { |
2704 | + if (!list_empty(&asoc->asocs)) { |
2705 | list_del(&asoc->asocs); |
2706 | |
2707 | /* Decrement the backlog value for a TCP-style listening |
2708 | diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c |
2709 | index 3aaf73de9e2d..ad844d365340 100644 |
2710 | --- a/net/tipc/netlink.c |
2711 | +++ b/net/tipc/netlink.c |
2712 | @@ -47,7 +47,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info) |
2713 | int hdr_space = nlmsg_total_size(GENL_HDRLEN + TIPC_GENL_HDRLEN); |
2714 | u16 cmd; |
2715 | |
2716 | - if ((req_userhdr->cmd & 0xC000) && (!capable(CAP_NET_ADMIN))) |
2717 | + if ((req_userhdr->cmd & 0xC000) && (!netlink_capable(skb, CAP_NET_ADMIN))) |
2718 | cmd = TIPC_CMD_NOT_NET_ADMIN; |
2719 | else |
2720 | cmd = req_userhdr->cmd; |
2721 | diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c |
2722 | index 2f7ddc3a59b4..b10d04fa3933 100644 |
2723 | --- a/net/xfrm/xfrm_user.c |
2724 | +++ b/net/xfrm/xfrm_user.c |
2725 | @@ -2350,7 +2350,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) |
2726 | link = &xfrm_dispatch[type]; |
2727 | |
2728 | /* All operations require privileges, even GET */ |
2729 | - if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) |
2730 | + if (!netlink_net_capable(skb, CAP_NET_ADMIN)) |
2731 | return -EPERM; |
2732 | |
2733 | if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || |
2734 | diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c |
2735 | index 336b3ddfe63f..3c5cbb977254 100644 |
2736 | --- a/security/integrity/evm/evm_main.c |
2737 | +++ b/security/integrity/evm/evm_main.c |
2738 | @@ -285,12 +285,20 @@ out: |
2739 | * @xattr_value: pointer to the new extended attribute value |
2740 | * @xattr_value_len: pointer to the new extended attribute value length |
2741 | * |
2742 | - * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that |
2743 | - * the current value is valid. |
2744 | + * Before allowing the 'security.evm' protected xattr to be updated, |
2745 | + * verify the existing value is valid. As only the kernel should have |
2746 | + * access to the EVM encrypted key needed to calculate the HMAC, prevent |
2747 | + * userspace from writing HMAC value. Writing 'security.evm' requires |
2748 | + * requires CAP_SYS_ADMIN privileges. |
2749 | */ |
2750 | int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, |
2751 | const void *xattr_value, size_t xattr_value_len) |
2752 | { |
2753 | + const struct evm_ima_xattr_data *xattr_data = xattr_value; |
2754 | + |
2755 | + if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) |
2756 | + && (xattr_data->type == EVM_XATTR_HMAC)) |
2757 | + return -EPERM; |
2758 | return evm_protect_xattr(dentry, xattr_name, xattr_value, |
2759 | xattr_value_len); |
2760 | } |
2761 | diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c |
2762 | index c38bbce8c6a6..025824af08e0 100644 |
2763 | --- a/security/integrity/ima/ima_api.c |
2764 | +++ b/security/integrity/ima/ima_api.c |
2765 | @@ -199,6 +199,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, |
2766 | struct evm_ima_xattr_data **xattr_value, |
2767 | int *xattr_len) |
2768 | { |
2769 | + const char *audit_cause = "failed"; |
2770 | struct inode *inode = file_inode(file); |
2771 | const char *filename = file->f_dentry->d_name.name; |
2772 | int result = 0; |
2773 | @@ -213,6 +214,12 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, |
2774 | if (!(iint->flags & IMA_COLLECTED)) { |
2775 | u64 i_version = file_inode(file)->i_version; |
2776 | |
2777 | + if (file->f_flags & O_DIRECT) { |
2778 | + audit_cause = "failed(directio)"; |
2779 | + result = -EACCES; |
2780 | + goto out; |
2781 | + } |
2782 | + |
2783 | /* use default hash algorithm */ |
2784 | hash.hdr.algo = ima_hash_algo; |
2785 | |
2786 | @@ -233,9 +240,10 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, |
2787 | result = -ENOMEM; |
2788 | } |
2789 | } |
2790 | +out: |
2791 | if (result) |
2792 | integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, |
2793 | - filename, "collect_data", "failed", |
2794 | + filename, "collect_data", audit_cause, |
2795 | result, 0); |
2796 | return result; |
2797 | } |
2798 | diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c |
2799 | index fdf60def52e9..b5c126fe0bd9 100644 |
2800 | --- a/security/integrity/ima/ima_crypto.c |
2801 | +++ b/security/integrity/ima/ima_crypto.c |
2802 | @@ -25,6 +25,36 @@ |
2803 | |
2804 | static struct crypto_shash *ima_shash_tfm; |
2805 | |
2806 | +/** |
2807 | + * ima_kernel_read - read file content |
2808 | + * |
2809 | + * This is a function for reading file content instead of kernel_read(). |
2810 | + * It does not perform locking checks to ensure it cannot be blocked. |
2811 | + * It does not perform security checks because it is irrelevant for IMA. |
2812 | + * |
2813 | + */ |
2814 | +static int ima_kernel_read(struct file *file, loff_t offset, |
2815 | + char *addr, unsigned long count) |
2816 | +{ |
2817 | + mm_segment_t old_fs; |
2818 | + char __user *buf = addr; |
2819 | + ssize_t ret; |
2820 | + |
2821 | + if (!(file->f_mode & FMODE_READ)) |
2822 | + return -EBADF; |
2823 | + if (!file->f_op->read && !file->f_op->aio_read) |
2824 | + return -EINVAL; |
2825 | + |
2826 | + old_fs = get_fs(); |
2827 | + set_fs(get_ds()); |
2828 | + if (file->f_op->read) |
2829 | + ret = file->f_op->read(file, buf, count, &offset); |
2830 | + else |
2831 | + ret = do_sync_read(file, buf, count, &offset); |
2832 | + set_fs(old_fs); |
2833 | + return ret; |
2834 | +} |
2835 | + |
2836 | int ima_init_crypto(void) |
2837 | { |
2838 | long rc; |
2839 | @@ -98,7 +128,7 @@ static int ima_calc_file_hash_tfm(struct file *file, |
2840 | while (offset < i_size) { |
2841 | int rbuf_len; |
2842 | |
2843 | - rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE); |
2844 | + rbuf_len = ima_kernel_read(file, offset, rbuf, PAGE_SIZE); |
2845 | if (rbuf_len < 0) { |
2846 | rc = rbuf_len; |
2847 | break; |
2848 | diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c |
2849 | index 149ee1119f87..76d8aad146a8 100644 |
2850 | --- a/security/integrity/ima/ima_main.c |
2851 | +++ b/security/integrity/ima/ima_main.c |
2852 | @@ -217,8 +217,11 @@ static int process_measurement(struct file *file, const char *filename, |
2853 | xattr_ptr = &xattr_value; |
2854 | |
2855 | rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len); |
2856 | - if (rc != 0) |
2857 | + if (rc != 0) { |
2858 | + if (file->f_flags & O_DIRECT) |
2859 | + rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES; |
2860 | goto out_digsig; |
2861 | + } |
2862 | |
2863 | pathname = !filename ? ima_d_path(&file->f_path, &pathbuf) : filename; |
2864 | if (!pathname) |
2865 | diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c |
2866 | index a9c3d3cd1990..085c4964be99 100644 |
2867 | --- a/security/integrity/ima/ima_policy.c |
2868 | +++ b/security/integrity/ima/ima_policy.c |
2869 | @@ -351,7 +351,7 @@ enum { |
2870 | Opt_obj_user, Opt_obj_role, Opt_obj_type, |
2871 | Opt_subj_user, Opt_subj_role, Opt_subj_type, |
2872 | Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner, |
2873 | - Opt_appraise_type, Opt_fsuuid |
2874 | + Opt_appraise_type, Opt_fsuuid, Opt_permit_directio |
2875 | }; |
2876 | |
2877 | static match_table_t policy_tokens = { |
2878 | @@ -373,6 +373,7 @@ static match_table_t policy_tokens = { |
2879 | {Opt_uid, "uid=%s"}, |
2880 | {Opt_fowner, "fowner=%s"}, |
2881 | {Opt_appraise_type, "appraise_type=%s"}, |
2882 | + {Opt_permit_directio, "permit_directio"}, |
2883 | {Opt_err, NULL} |
2884 | }; |
2885 | |
2886 | @@ -621,6 +622,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) |
2887 | else |
2888 | result = -EINVAL; |
2889 | break; |
2890 | + case Opt_permit_directio: |
2891 | + entry->flags |= IMA_PERMIT_DIRECTIO; |
2892 | + break; |
2893 | case Opt_err: |
2894 | ima_log_string(ab, "UNKNOWN", p); |
2895 | result = -EINVAL; |
2896 | diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h |
2897 | index 2fb5e53e927f..33c0a70f6b15 100644 |
2898 | --- a/security/integrity/integrity.h |
2899 | +++ b/security/integrity/integrity.h |
2900 | @@ -30,6 +30,7 @@ |
2901 | #define IMA_ACTION_FLAGS 0xff000000 |
2902 | #define IMA_DIGSIG 0x01000000 |
2903 | #define IMA_DIGSIG_REQUIRED 0x02000000 |
2904 | +#define IMA_PERMIT_DIRECTIO 0x04000000 |
2905 | |
2906 | #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ |
2907 | IMA_APPRAISE_SUBMASK) |
2908 | diff --git a/sound/core/control.c b/sound/core/control.c |
2909 | index d8aa206e8bde..98a29b26c5f4 100644 |
2910 | --- a/sound/core/control.c |
2911 | +++ b/sound/core/control.c |
2912 | @@ -289,6 +289,10 @@ static bool snd_ctl_remove_numid_conflict(struct snd_card *card, |
2913 | { |
2914 | struct snd_kcontrol *kctl; |
2915 | |
2916 | + /* Make sure that the ids assigned to the control do not wrap around */ |
2917 | + if (card->last_numid >= UINT_MAX - count) |
2918 | + card->last_numid = 0; |
2919 | + |
2920 | list_for_each_entry(kctl, &card->controls, list) { |
2921 | if (kctl->id.numid < card->last_numid + 1 + count && |
2922 | kctl->id.numid + kctl->count > card->last_numid + 1) { |
2923 | @@ -331,6 +335,7 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) |
2924 | { |
2925 | struct snd_ctl_elem_id id; |
2926 | unsigned int idx; |
2927 | + unsigned int count; |
2928 | int err = -EINVAL; |
2929 | |
2930 | if (! kcontrol) |
2931 | @@ -338,6 +343,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) |
2932 | if (snd_BUG_ON(!card || !kcontrol->info)) |
2933 | goto error; |
2934 | id = kcontrol->id; |
2935 | + if (id.index > UINT_MAX - kcontrol->count) |
2936 | + goto error; |
2937 | + |
2938 | down_write(&card->controls_rwsem); |
2939 | if (snd_ctl_find_id(card, &id)) { |
2940 | up_write(&card->controls_rwsem); |
2941 | @@ -359,8 +367,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) |
2942 | card->controls_count += kcontrol->count; |
2943 | kcontrol->id.numid = card->last_numid + 1; |
2944 | card->last_numid += kcontrol->count; |
2945 | + count = kcontrol->count; |
2946 | up_write(&card->controls_rwsem); |
2947 | - for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++) |
2948 | + for (idx = 0; idx < count; idx++, id.index++, id.numid++) |
2949 | snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); |
2950 | return 0; |
2951 | |
2952 | @@ -389,6 +398,7 @@ int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol, |
2953 | bool add_on_replace) |
2954 | { |
2955 | struct snd_ctl_elem_id id; |
2956 | + unsigned int count; |
2957 | unsigned int idx; |
2958 | struct snd_kcontrol *old; |
2959 | int ret; |
2960 | @@ -424,8 +434,9 @@ add: |
2961 | card->controls_count += kcontrol->count; |
2962 | kcontrol->id.numid = card->last_numid + 1; |
2963 | card->last_numid += kcontrol->count; |
2964 | + count = kcontrol->count; |
2965 | up_write(&card->controls_rwsem); |
2966 | - for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++) |
2967 | + for (idx = 0; idx < count; idx++, id.index++, id.numid++) |
2968 | snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); |
2969 | return 0; |
2970 | |
2971 | @@ -898,9 +909,9 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, |
2972 | result = kctl->put(kctl, control); |
2973 | } |
2974 | if (result > 0) { |
2975 | + struct snd_ctl_elem_id id = control->id; |
2976 | up_read(&card->controls_rwsem); |
2977 | - snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, |
2978 | - &control->id); |
2979 | + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id); |
2980 | return 0; |
2981 | } |
2982 | } |
2983 | @@ -992,6 +1003,7 @@ static int snd_ctl_elem_unlock(struct snd_ctl_file *file, |
2984 | |
2985 | struct user_element { |
2986 | struct snd_ctl_elem_info info; |
2987 | + struct snd_card *card; |
2988 | void *elem_data; /* element data */ |
2989 | unsigned long elem_data_size; /* size of element data in bytes */ |
2990 | void *tlv_data; /* TLV data */ |
2991 | @@ -1035,7 +1047,9 @@ static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol, |
2992 | { |
2993 | struct user_element *ue = kcontrol->private_data; |
2994 | |
2995 | + mutex_lock(&ue->card->user_ctl_lock); |
2996 | memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size); |
2997 | + mutex_unlock(&ue->card->user_ctl_lock); |
2998 | return 0; |
2999 | } |
3000 | |
3001 | @@ -1044,10 +1058,12 @@ static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol, |
3002 | { |
3003 | int change; |
3004 | struct user_element *ue = kcontrol->private_data; |
3005 | - |
3006 | + |
3007 | + mutex_lock(&ue->card->user_ctl_lock); |
3008 | change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0; |
3009 | if (change) |
3010 | memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size); |
3011 | + mutex_unlock(&ue->card->user_ctl_lock); |
3012 | return change; |
3013 | } |
3014 | |
3015 | @@ -1067,19 +1083,32 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol, |
3016 | new_data = memdup_user(tlv, size); |
3017 | if (IS_ERR(new_data)) |
3018 | return PTR_ERR(new_data); |
3019 | + mutex_lock(&ue->card->user_ctl_lock); |
3020 | change = ue->tlv_data_size != size; |
3021 | if (!change) |
3022 | change = memcmp(ue->tlv_data, new_data, size); |
3023 | kfree(ue->tlv_data); |
3024 | ue->tlv_data = new_data; |
3025 | ue->tlv_data_size = size; |
3026 | + mutex_unlock(&ue->card->user_ctl_lock); |
3027 | } else { |
3028 | - if (! ue->tlv_data_size || ! ue->tlv_data) |
3029 | - return -ENXIO; |
3030 | - if (size < ue->tlv_data_size) |
3031 | - return -ENOSPC; |
3032 | + int ret = 0; |
3033 | + |
3034 | + mutex_lock(&ue->card->user_ctl_lock); |
3035 | + if (!ue->tlv_data_size || !ue->tlv_data) { |
3036 | + ret = -ENXIO; |
3037 | + goto err_unlock; |
3038 | + } |
3039 | + if (size < ue->tlv_data_size) { |
3040 | + ret = -ENOSPC; |
3041 | + goto err_unlock; |
3042 | + } |
3043 | if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size)) |
3044 | - return -EFAULT; |
3045 | + ret = -EFAULT; |
3046 | +err_unlock: |
3047 | + mutex_unlock(&ue->card->user_ctl_lock); |
3048 | + if (ret) |
3049 | + return ret; |
3050 | } |
3051 | return change; |
3052 | } |
3053 | @@ -1137,8 +1166,6 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, |
3054 | struct user_element *ue; |
3055 | int idx, err; |
3056 | |
3057 | - if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS) |
3058 | - return -ENOMEM; |
3059 | if (info->count < 1) |
3060 | return -EINVAL; |
3061 | access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE : |
3062 | @@ -1147,21 +1174,16 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, |
3063 | SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE)); |
3064 | info->id.numid = 0; |
3065 | memset(&kctl, 0, sizeof(kctl)); |
3066 | - down_write(&card->controls_rwsem); |
3067 | - _kctl = snd_ctl_find_id(card, &info->id); |
3068 | - err = 0; |
3069 | - if (_kctl) { |
3070 | - if (replace) |
3071 | - err = snd_ctl_remove(card, _kctl); |
3072 | - else |
3073 | - err = -EBUSY; |
3074 | - } else { |
3075 | - if (replace) |
3076 | - err = -ENOENT; |
3077 | + |
3078 | + if (replace) { |
3079 | + err = snd_ctl_remove_user_ctl(file, &info->id); |
3080 | + if (err) |
3081 | + return err; |
3082 | } |
3083 | - up_write(&card->controls_rwsem); |
3084 | - if (err < 0) |
3085 | - return err; |
3086 | + |
3087 | + if (card->user_ctl_count >= MAX_USER_CONTROLS) |
3088 | + return -ENOMEM; |
3089 | + |
3090 | memcpy(&kctl.id, &info->id, sizeof(info->id)); |
3091 | kctl.count = info->owner ? info->owner : 1; |
3092 | access |= SNDRV_CTL_ELEM_ACCESS_USER; |
3093 | @@ -1211,6 +1233,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, |
3094 | ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL); |
3095 | if (ue == NULL) |
3096 | return -ENOMEM; |
3097 | + ue->card = card; |
3098 | ue->info = *info; |
3099 | ue->info.access = 0; |
3100 | ue->elem_data = (char *)ue + sizeof(*ue); |
3101 | @@ -1322,8 +1345,9 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file, |
3102 | } |
3103 | err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv); |
3104 | if (err > 0) { |
3105 | + struct snd_ctl_elem_id id = kctl->id; |
3106 | up_read(&card->controls_rwsem); |
3107 | - snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &kctl->id); |
3108 | + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id); |
3109 | return 0; |
3110 | } |
3111 | } else { |
3112 | diff --git a/sound/core/init.c b/sound/core/init.c |
3113 | index 0d42fcda0de2..39c25167add8 100644 |
3114 | --- a/sound/core/init.c |
3115 | +++ b/sound/core/init.c |
3116 | @@ -218,6 +218,7 @@ int snd_card_create(int idx, const char *xid, |
3117 | INIT_LIST_HEAD(&card->devices); |
3118 | init_rwsem(&card->controls_rwsem); |
3119 | rwlock_init(&card->ctl_files_rwlock); |
3120 | + mutex_init(&card->user_ctl_lock); |
3121 | INIT_LIST_HEAD(&card->controls); |
3122 | INIT_LIST_HEAD(&card->ctl_files); |
3123 | spin_lock_init(&card->files_lock); |
3124 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
3125 | index 0b6ee2b37bdb..2a16a90fd952 100644 |
3126 | --- a/sound/pci/hda/patch_realtek.c |
3127 | +++ b/sound/pci/hda/patch_realtek.c |
3128 | @@ -3932,6 +3932,7 @@ enum { |
3129 | ALC269_FIXUP_HEADSET_MIC, |
3130 | ALC269_FIXUP_QUANTA_MUTE, |
3131 | ALC269_FIXUP_LIFEBOOK, |
3132 | + ALC269_FIXUP_LIFEBOOK_EXTMIC, |
3133 | ALC269_FIXUP_AMIC, |
3134 | ALC269_FIXUP_DMIC, |
3135 | ALC269VB_FIXUP_AMIC, |
3136 | @@ -4059,6 +4060,13 @@ static const struct hda_fixup alc269_fixups[] = { |
3137 | .chained = true, |
3138 | .chain_id = ALC269_FIXUP_QUANTA_MUTE |
3139 | }, |
3140 | + [ALC269_FIXUP_LIFEBOOK_EXTMIC] = { |
3141 | + .type = HDA_FIXUP_PINS, |
3142 | + .v.pins = (const struct hda_pintbl[]) { |
3143 | + { 0x19, 0x01a1903c }, /* headset mic, with jack detect */ |
3144 | + { } |
3145 | + }, |
3146 | + }, |
3147 | [ALC269_FIXUP_AMIC] = { |
3148 | .type = HDA_FIXUP_PINS, |
3149 | .v.pins = (const struct hda_pintbl[]) { |
3150 | @@ -4427,14 +4435,24 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { |
3151 | SND_PCI_QUIRK(0x103c, 0x1983, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3152 | SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED), |
3153 | /* ALC282 */ |
3154 | + SND_PCI_QUIRK(0x103c, 0x220d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3155 | + SND_PCI_QUIRK(0x103c, 0x220e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3156 | SND_PCI_QUIRK(0x103c, 0x220f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3157 | + SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3158 | + SND_PCI_QUIRK(0x103c, 0x2211, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3159 | + SND_PCI_QUIRK(0x103c, 0x2212, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3160 | SND_PCI_QUIRK(0x103c, 0x2213, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3161 | + SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3162 | SND_PCI_QUIRK(0x103c, 0x2266, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3163 | SND_PCI_QUIRK(0x103c, 0x2267, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3164 | SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3165 | SND_PCI_QUIRK(0x103c, 0x2269, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3166 | SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3167 | SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3168 | + SND_PCI_QUIRK(0x103c, 0x226c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3169 | + SND_PCI_QUIRK(0x103c, 0x226d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3170 | + SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3171 | + SND_PCI_QUIRK(0x103c, 0x226f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3172 | SND_PCI_QUIRK(0x103c, 0x227a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3173 | SND_PCI_QUIRK(0x103c, 0x227b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3174 | SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3175 | @@ -4474,6 +4492,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { |
3176 | SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3177 | SND_PCI_QUIRK(0x103c, 0x22c3, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3178 | SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3179 | + SND_PCI_QUIRK(0x103c, 0x2334, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3180 | + SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3181 | + SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3182 | + SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), |
3183 | SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED), |
3184 | SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), |
3185 | SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), |
3186 | @@ -4496,6 +4518,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { |
3187 | SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), |
3188 | SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), |
3189 | SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), |
3190 | + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), |
3191 | SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), |
3192 | SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), |
3193 | SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE), |
3194 | @@ -5536,6 +5559,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { |
3195 | { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 }, |
3196 | { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 }, |
3197 | { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 }, |
3198 | + { .id = 0x10ec0867, .name = "ALC891", .patch = patch_alc882 }, |
3199 | { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 }, |
3200 | { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 }, |
3201 | { .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc882 }, |
3202 | diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c |
3203 | index 9f714ea86613..b3f7c9026a29 100644 |
3204 | --- a/sound/soc/codecs/max98090.c |
3205 | +++ b/sound/soc/codecs/max98090.c |
3206 | @@ -255,6 +255,7 @@ static struct reg_default max98090_reg[] = { |
3207 | static bool max98090_volatile_register(struct device *dev, unsigned int reg) |
3208 | { |
3209 | switch (reg) { |
3210 | + case M98090_REG_SOFTWARE_RESET: |
3211 | case M98090_REG_DEVICE_STATUS: |
3212 | case M98090_REG_JACK_STATUS: |
3213 | case M98090_REG_REVISION_ID: |
3214 | @@ -2360,6 +2361,8 @@ static int max98090_runtime_resume(struct device *dev) |
3215 | |
3216 | regcache_cache_only(max98090->regmap, false); |
3217 | |
3218 | + max98090_reset(max98090); |
3219 | + |
3220 | regcache_sync(max98090->regmap); |
3221 | |
3222 | return 0; |
3223 | diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c |
3224 | index 470fbfb4b386..eb241c6571a9 100644 |
3225 | --- a/sound/soc/codecs/tlv320aic3x.c |
3226 | +++ b/sound/soc/codecs/tlv320aic3x.c |
3227 | @@ -169,7 +169,7 @@ static int snd_soc_dapm_put_volsw_aic3x(struct snd_kcontrol *kcontrol, |
3228 | mask <<= shift; |
3229 | val <<= shift; |
3230 | |
3231 | - change = snd_soc_test_bits(codec, val, mask, reg); |
3232 | + change = snd_soc_test_bits(codec, reg, mask, val); |
3233 | if (change) { |
3234 | update.kcontrol = kcontrol; |
3235 | update.reg = reg; |
3236 | diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c |
3237 | index c1369c3ad643..731d47b64daa 100644 |
3238 | --- a/sound/soc/soc-dapm.c |
3239 | +++ b/sound/soc/soc-dapm.c |
3240 | @@ -2888,22 +2888,19 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol, |
3241 | mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME); |
3242 | |
3243 | change = dapm_kcontrol_set_value(kcontrol, val); |
3244 | - |
3245 | - if (reg != SND_SOC_NOPM) { |
3246 | - mask = mask << shift; |
3247 | - val = val << shift; |
3248 | - |
3249 | - change = snd_soc_test_bits(codec, reg, mask, val); |
3250 | - } |
3251 | - |
3252 | if (change) { |
3253 | if (reg != SND_SOC_NOPM) { |
3254 | - update.kcontrol = kcontrol; |
3255 | - update.reg = reg; |
3256 | - update.mask = mask; |
3257 | - update.val = val; |
3258 | + mask = mask << shift; |
3259 | + val = val << shift; |
3260 | + |
3261 | + if (snd_soc_test_bits(codec, reg, mask, val)) { |
3262 | + update.kcontrol = kcontrol; |
3263 | + update.reg = reg; |
3264 | + update.mask = mask; |
3265 | + update.val = val; |
3266 | + card->update = &update; |
3267 | + } |
3268 | |
3269 | - card->update = &update; |
3270 | } |
3271 | |
3272 | ret = soc_dapm_mixer_update_power(card, kcontrol, connect); |