Contents of /trunk/kernel-alx/patches-3.18/0124-3.18.25-all-fixes.patch
Parent Directory | Revision Log
Revision 2742 -
(show annotations)
(download)
Wed Dec 16 09:44:19 2015 UTC (8 years, 9 months ago) by niro
File size: 146967 byte(s)
Wed Dec 16 09:44:19 2015 UTC (8 years, 9 months ago) by niro
File size: 146967 byte(s)
-linux-3.18.25
1 | diff --git a/Makefile b/Makefile |
2 | index 9769e3bce6a2..6df25277ea44 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 3 |
7 | PATCHLEVEL = 18 |
8 | -SUBLEVEL = 24 |
9 | +SUBLEVEL = 25 |
10 | EXTRAVERSION = |
11 | NAME = Diseased Newt |
12 | |
13 | diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c |
14 | index f5b00f41c4f6..b8b6e22f9987 100644 |
15 | --- a/arch/arm/plat-orion/common.c |
16 | +++ b/arch/arm/plat-orion/common.c |
17 | @@ -499,7 +499,7 @@ void __init orion_ge00_switch_init(struct dsa_platform_data *d, int irq) |
18 | |
19 | d->netdev = &orion_ge00.dev; |
20 | for (i = 0; i < d->nr_chips; i++) |
21 | - d->chip[i].host_dev = &orion_ge00_shared.dev; |
22 | + d->chip[i].host_dev = &orion_ge_mvmdio.dev; |
23 | orion_switch_device.dev.platform_data = d; |
24 | |
25 | platform_device_register(&orion_switch_device); |
26 | diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile |
27 | index e7391aef5433..2d54c55400ed 100644 |
28 | --- a/arch/arm64/Makefile |
29 | +++ b/arch/arm64/Makefile |
30 | @@ -33,7 +33,7 @@ endif |
31 | CHECKFLAGS += -D__aarch64__ |
32 | |
33 | ifeq ($(CONFIG_ARM64_ERRATUM_843419), y) |
34 | -CFLAGS_MODULE += -mcmodel=large |
35 | +KBUILD_CFLAGS_MODULE += -mcmodel=large |
36 | endif |
37 | |
38 | # Default value |
39 | diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c |
40 | index 407991bf79f5..ccb6078ed9f2 100644 |
41 | --- a/arch/arm64/kernel/stacktrace.c |
42 | +++ b/arch/arm64/kernel/stacktrace.c |
43 | @@ -48,11 +48,7 @@ int notrace unwind_frame(struct stackframe *frame) |
44 | |
45 | frame->sp = fp + 0x10; |
46 | frame->fp = *(unsigned long *)(fp); |
47 | - /* |
48 | - * -4 here because we care about the PC at time of bl, |
49 | - * not where the return will go. |
50 | - */ |
51 | - frame->pc = *(unsigned long *)(fp + 8) - 4; |
52 | + frame->pc = *(unsigned long *)(fp + 8); |
53 | |
54 | return 0; |
55 | } |
56 | diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c |
57 | index af0dafab5807..79c459a2b684 100644 |
58 | --- a/arch/powerpc/kernel/rtas.c |
59 | +++ b/arch/powerpc/kernel/rtas.c |
60 | @@ -1045,6 +1045,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs) |
61 | if (!capable(CAP_SYS_ADMIN)) |
62 | return -EPERM; |
63 | |
64 | + if (!rtas.entry) |
65 | + return -EINVAL; |
66 | + |
67 | if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0) |
68 | return -EFAULT; |
69 | |
70 | diff --git a/arch/sparc/crypto/aes_glue.c b/arch/sparc/crypto/aes_glue.c |
71 | index 705408766ab0..ef0870500240 100644 |
72 | --- a/arch/sparc/crypto/aes_glue.c |
73 | +++ b/arch/sparc/crypto/aes_glue.c |
74 | @@ -433,6 +433,7 @@ static struct crypto_alg algs[] = { { |
75 | .blkcipher = { |
76 | .min_keysize = AES_MIN_KEY_SIZE, |
77 | .max_keysize = AES_MAX_KEY_SIZE, |
78 | + .ivsize = AES_BLOCK_SIZE, |
79 | .setkey = aes_set_key, |
80 | .encrypt = cbc_encrypt, |
81 | .decrypt = cbc_decrypt, |
82 | @@ -452,6 +453,7 @@ static struct crypto_alg algs[] = { { |
83 | .blkcipher = { |
84 | .min_keysize = AES_MIN_KEY_SIZE, |
85 | .max_keysize = AES_MAX_KEY_SIZE, |
86 | + .ivsize = AES_BLOCK_SIZE, |
87 | .setkey = aes_set_key, |
88 | .encrypt = ctr_crypt, |
89 | .decrypt = ctr_crypt, |
90 | diff --git a/arch/sparc/crypto/camellia_glue.c b/arch/sparc/crypto/camellia_glue.c |
91 | index 641f55cb61c3..eb87d6dd86b1 100644 |
92 | --- a/arch/sparc/crypto/camellia_glue.c |
93 | +++ b/arch/sparc/crypto/camellia_glue.c |
94 | @@ -274,6 +274,7 @@ static struct crypto_alg algs[] = { { |
95 | .blkcipher = { |
96 | .min_keysize = CAMELLIA_MIN_KEY_SIZE, |
97 | .max_keysize = CAMELLIA_MAX_KEY_SIZE, |
98 | + .ivsize = CAMELLIA_BLOCK_SIZE, |
99 | .setkey = camellia_set_key, |
100 | .encrypt = cbc_encrypt, |
101 | .decrypt = cbc_decrypt, |
102 | diff --git a/arch/sparc/crypto/des_glue.c b/arch/sparc/crypto/des_glue.c |
103 | index d11500972994..1359bfc544e4 100644 |
104 | --- a/arch/sparc/crypto/des_glue.c |
105 | +++ b/arch/sparc/crypto/des_glue.c |
106 | @@ -429,6 +429,7 @@ static struct crypto_alg algs[] = { { |
107 | .blkcipher = { |
108 | .min_keysize = DES_KEY_SIZE, |
109 | .max_keysize = DES_KEY_SIZE, |
110 | + .ivsize = DES_BLOCK_SIZE, |
111 | .setkey = des_set_key, |
112 | .encrypt = cbc_encrypt, |
113 | .decrypt = cbc_decrypt, |
114 | @@ -485,6 +486,7 @@ static struct crypto_alg algs[] = { { |
115 | .blkcipher = { |
116 | .min_keysize = DES3_EDE_KEY_SIZE, |
117 | .max_keysize = DES3_EDE_KEY_SIZE, |
118 | + .ivsize = DES3_EDE_BLOCK_SIZE, |
119 | .setkey = des3_ede_set_key, |
120 | .encrypt = cbc3_encrypt, |
121 | .decrypt = cbc3_decrypt, |
122 | diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h |
123 | index b5d7640abc5d..8a4add8e4639 100644 |
124 | --- a/arch/x86/include/uapi/asm/svm.h |
125 | +++ b/arch/x86/include/uapi/asm/svm.h |
126 | @@ -100,6 +100,7 @@ |
127 | { SVM_EXIT_EXCP_BASE + UD_VECTOR, "UD excp" }, \ |
128 | { SVM_EXIT_EXCP_BASE + PF_VECTOR, "PF excp" }, \ |
129 | { SVM_EXIT_EXCP_BASE + NM_VECTOR, "NM excp" }, \ |
130 | + { SVM_EXIT_EXCP_BASE + AC_VECTOR, "AC excp" }, \ |
131 | { SVM_EXIT_EXCP_BASE + MC_VECTOR, "MC excp" }, \ |
132 | { SVM_EXIT_INTR, "interrupt" }, \ |
133 | { SVM_EXIT_NMI, "nmi" }, \ |
134 | diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c |
135 | index 974e4d98ed29..852572c971c4 100644 |
136 | --- a/arch/x86/kvm/emulate.c |
137 | +++ b/arch/x86/kvm/emulate.c |
138 | @@ -658,7 +658,7 @@ static int __linearize(struct x86_emulate_ctxt *ctxt, |
139 | *max_size = 0; |
140 | switch (ctxt->mode) { |
141 | case X86EMUL_MODE_PROT64: |
142 | - if (((signed long)la << 16) >> 16 != la) |
143 | + if (is_noncanonical_address(la)) |
144 | return emulate_gp(ctxt, 0); |
145 | |
146 | *max_size = min_t(u64, ~0u, (1ull << 48) - la); |
147 | diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c |
148 | index f98baebfa9a7..9dc0aa0dae96 100644 |
149 | --- a/arch/x86/kvm/svm.c |
150 | +++ b/arch/x86/kvm/svm.c |
151 | @@ -1103,6 +1103,7 @@ static void init_vmcb(struct vcpu_svm *svm) |
152 | set_exception_intercept(svm, PF_VECTOR); |
153 | set_exception_intercept(svm, UD_VECTOR); |
154 | set_exception_intercept(svm, MC_VECTOR); |
155 | + set_exception_intercept(svm, AC_VECTOR); |
156 | |
157 | set_intercept(svm, INTERCEPT_INTR); |
158 | set_intercept(svm, INTERCEPT_NMI); |
159 | @@ -1789,6 +1790,12 @@ static int ud_interception(struct vcpu_svm *svm) |
160 | return 1; |
161 | } |
162 | |
163 | +static int ac_interception(struct vcpu_svm *svm) |
164 | +{ |
165 | + kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0); |
166 | + return 1; |
167 | +} |
168 | + |
169 | static void svm_fpu_activate(struct kvm_vcpu *vcpu) |
170 | { |
171 | struct vcpu_svm *svm = to_svm(vcpu); |
172 | @@ -3350,6 +3357,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = { |
173 | [SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception, |
174 | [SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception, |
175 | [SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception, |
176 | + [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception, |
177 | [SVM_EXIT_INTR] = intr_interception, |
178 | [SVM_EXIT_NMI] = nmi_interception, |
179 | [SVM_EXIT_SMI] = nop_on_interception, |
180 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
181 | index 0d7f1dcfcdac..84de207a8848 100644 |
182 | --- a/arch/x86/kvm/vmx.c |
183 | +++ b/arch/x86/kvm/vmx.c |
184 | @@ -1493,7 +1493,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu) |
185 | u32 eb; |
186 | |
187 | eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) | |
188 | - (1u << NM_VECTOR) | (1u << DB_VECTOR); |
189 | + (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR); |
190 | if ((vcpu->guest_debug & |
191 | (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) == |
192 | (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) |
193 | @@ -4933,6 +4933,9 @@ static int handle_exception(struct kvm_vcpu *vcpu) |
194 | return handle_rmode_exception(vcpu, ex_no, error_code); |
195 | |
196 | switch (ex_no) { |
197 | + case AC_VECTOR: |
198 | + kvm_queue_exception_e(vcpu, AC_VECTOR, error_code); |
199 | + return 1; |
200 | case DB_VECTOR: |
201 | dr6 = vmcs_readl(EXIT_QUALIFICATION); |
202 | if (!(vcpu->guest_debug & |
203 | diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c |
204 | index 40886c489903..520729d898fe 100644 |
205 | --- a/crypto/ablkcipher.c |
206 | +++ b/crypto/ablkcipher.c |
207 | @@ -695,7 +695,7 @@ struct crypto_ablkcipher *crypto_alloc_ablkcipher(const char *alg_name, |
208 | err: |
209 | if (err != -EAGAIN) |
210 | break; |
211 | - if (signal_pending(current)) { |
212 | + if (fatal_signal_pending(current)) { |
213 | err = -EINTR; |
214 | break; |
215 | } |
216 | diff --git a/crypto/ahash.c b/crypto/ahash.c |
217 | index f6a36a52d738..c1d8591913e9 100644 |
218 | --- a/crypto/ahash.c |
219 | +++ b/crypto/ahash.c |
220 | @@ -543,7 +543,8 @@ static int ahash_prepare_alg(struct ahash_alg *alg) |
221 | struct crypto_alg *base = &alg->halg.base; |
222 | |
223 | if (alg->halg.digestsize > PAGE_SIZE / 8 || |
224 | - alg->halg.statesize > PAGE_SIZE / 8) |
225 | + alg->halg.statesize > PAGE_SIZE / 8 || |
226 | + alg->halg.statesize == 0) |
227 | return -EINVAL; |
228 | |
229 | base->cra_type = &crypto_ahash_type; |
230 | diff --git a/crypto/algapi.c b/crypto/algapi.c |
231 | index 71a8143e23b1..314cc745f2f8 100644 |
232 | --- a/crypto/algapi.c |
233 | +++ b/crypto/algapi.c |
234 | @@ -337,7 +337,7 @@ static void crypto_wait_for_test(struct crypto_larval *larval) |
235 | crypto_alg_tested(larval->alg.cra_driver_name, 0); |
236 | } |
237 | |
238 | - err = wait_for_completion_interruptible(&larval->completion); |
239 | + err = wait_for_completion_killable(&larval->completion); |
240 | WARN_ON(err); |
241 | |
242 | out: |
243 | diff --git a/crypto/api.c b/crypto/api.c |
244 | index 2a81e98a0021..7db2e89a3114 100644 |
245 | --- a/crypto/api.c |
246 | +++ b/crypto/api.c |
247 | @@ -172,7 +172,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg) |
248 | struct crypto_larval *larval = (void *)alg; |
249 | long timeout; |
250 | |
251 | - timeout = wait_for_completion_interruptible_timeout( |
252 | + timeout = wait_for_completion_killable_timeout( |
253 | &larval->completion, 60 * HZ); |
254 | |
255 | alg = larval->adult; |
256 | @@ -435,7 +435,7 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask) |
257 | err: |
258 | if (err != -EAGAIN) |
259 | break; |
260 | - if (signal_pending(current)) { |
261 | + if (fatal_signal_pending(current)) { |
262 | err = -EINTR; |
263 | break; |
264 | } |
265 | @@ -552,7 +552,7 @@ void *crypto_alloc_tfm(const char *alg_name, |
266 | err: |
267 | if (err != -EAGAIN) |
268 | break; |
269 | - if (signal_pending(current)) { |
270 | + if (fatal_signal_pending(current)) { |
271 | err = -EINTR; |
272 | break; |
273 | } |
274 | diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c |
275 | index e2a34feec7a4..c90af2537d24 100644 |
276 | --- a/crypto/crypto_user.c |
277 | +++ b/crypto/crypto_user.c |
278 | @@ -367,7 +367,7 @@ static struct crypto_alg *crypto_user_aead_alg(const char *name, u32 type, |
279 | err = PTR_ERR(alg); |
280 | if (err != -EAGAIN) |
281 | break; |
282 | - if (signal_pending(current)) { |
283 | + if (fatal_signal_pending(current)) { |
284 | err = -EINTR; |
285 | break; |
286 | } |
287 | diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c |
288 | index dc1ca84e90f1..8f51d6e3883e 100644 |
289 | --- a/drivers/block/rbd.c |
290 | +++ b/drivers/block/rbd.c |
291 | @@ -3780,6 +3780,9 @@ static int rbd_init_disk(struct rbd_device *rbd_dev) |
292 | q->limits.discard_zeroes_data = 1; |
293 | |
294 | blk_queue_merge_bvec(q, rbd_merge_bvec); |
295 | + if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC)) |
296 | + q->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES; |
297 | + |
298 | disk->queue = q; |
299 | |
300 | q->queuedata = rbd_dev; |
301 | @@ -5198,7 +5201,6 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev) |
302 | out_err: |
303 | if (parent) { |
304 | rbd_dev_unparent(rbd_dev); |
305 | - kfree(rbd_dev->header_name); |
306 | rbd_dev_destroy(parent); |
307 | } else { |
308 | rbd_put_client(rbdc); |
309 | diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c |
310 | index 218c4858f494..34a01f191b33 100644 |
311 | --- a/drivers/block/xen-blkfront.c |
312 | +++ b/drivers/block/xen-blkfront.c |
313 | @@ -1911,7 +1911,8 @@ static void blkback_changed(struct xenbus_device *dev, |
314 | break; |
315 | /* Missed the backend's Closing state -- fallthrough */ |
316 | case XenbusStateClosing: |
317 | - blkfront_closing(info); |
318 | + if (info) |
319 | + blkfront_closing(info); |
320 | break; |
321 | } |
322 | } |
323 | diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c |
324 | index 448327fe4d85..60c68e3cedeb 100644 |
325 | --- a/drivers/gpu/drm/i915/intel_display.c |
326 | +++ b/drivers/gpu/drm/i915/intel_display.c |
327 | @@ -1650,6 +1650,8 @@ static void i9xx_enable_pll(struct intel_crtc *crtc) |
328 | I915_READ(DPLL(!crtc->pipe)) | DPLL_DVO_2X_MODE); |
329 | } |
330 | |
331 | + I915_WRITE(reg, dpll); |
332 | + |
333 | /* Wait for the clocks to stabilize. */ |
334 | POSTING_READ(reg); |
335 | udelay(150); |
336 | diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c |
337 | index 593ef8a2a069..ddcfc1d2544b 100644 |
338 | --- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c |
339 | +++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c |
340 | @@ -178,8 +178,30 @@ nouveau_fbcon_sync(struct fb_info *info) |
341 | return 0; |
342 | } |
343 | |
344 | +static int |
345 | +nouveau_fbcon_open(struct fb_info *info, int user) |
346 | +{ |
347 | + struct nouveau_fbdev *fbcon = info->par; |
348 | + struct nouveau_drm *drm = nouveau_drm(fbcon->dev); |
349 | + int ret = pm_runtime_get_sync(drm->dev->dev); |
350 | + if (ret < 0 && ret != -EACCES) |
351 | + return ret; |
352 | + return 0; |
353 | +} |
354 | + |
355 | +static int |
356 | +nouveau_fbcon_release(struct fb_info *info, int user) |
357 | +{ |
358 | + struct nouveau_fbdev *fbcon = info->par; |
359 | + struct nouveau_drm *drm = nouveau_drm(fbcon->dev); |
360 | + pm_runtime_put(drm->dev->dev); |
361 | + return 0; |
362 | +} |
363 | + |
364 | static struct fb_ops nouveau_fbcon_ops = { |
365 | .owner = THIS_MODULE, |
366 | + .fb_open = nouveau_fbcon_open, |
367 | + .fb_release = nouveau_fbcon_release, |
368 | .fb_check_var = drm_fb_helper_check_var, |
369 | .fb_set_par = drm_fb_helper_set_par, |
370 | .fb_fillrect = nouveau_fbcon_fillrect, |
371 | @@ -195,6 +217,8 @@ static struct fb_ops nouveau_fbcon_ops = { |
372 | |
373 | static struct fb_ops nouveau_fbcon_sw_ops = { |
374 | .owner = THIS_MODULE, |
375 | + .fb_open = nouveau_fbcon_open, |
376 | + .fb_release = nouveau_fbcon_release, |
377 | .fb_check_var = drm_fb_helper_check_var, |
378 | .fb_set_par = drm_fb_helper_set_par, |
379 | .fb_fillrect = cfb_fillrect, |
380 | diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c |
381 | index 36951ee4b157..9fcc77d5923e 100644 |
382 | --- a/drivers/gpu/drm/nouveau/nouveau_gem.c |
383 | +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c |
384 | @@ -199,11 +199,12 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem, |
385 | struct nouveau_bo *nvbo = nouveau_gem_object(gem); |
386 | struct nouveau_vma *vma; |
387 | |
388 | - if (nvbo->bo.mem.mem_type == TTM_PL_TT) |
389 | + if (is_power_of_2(nvbo->valid_domains)) |
390 | + rep->domain = nvbo->valid_domains; |
391 | + else if (nvbo->bo.mem.mem_type == TTM_PL_TT) |
392 | rep->domain = NOUVEAU_GEM_DOMAIN_GART; |
393 | else |
394 | rep->domain = NOUVEAU_GEM_DOMAIN_VRAM; |
395 | - |
396 | rep->offset = nvbo->bo.offset; |
397 | if (cli->vm) { |
398 | vma = nouveau_bo_vma_find(nvbo, cli->vm); |
399 | diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h |
400 | index d6f0e40db81d..ee38f9aba391 100644 |
401 | --- a/drivers/gpu/drm/radeon/radeon.h |
402 | +++ b/drivers/gpu/drm/radeon/radeon.h |
403 | @@ -1628,6 +1628,7 @@ struct radeon_pm { |
404 | struct device *int_hwmon_dev; |
405 | /* dpm */ |
406 | bool dpm_enabled; |
407 | + bool sysfs_initialized; |
408 | struct radeon_dpm dpm; |
409 | }; |
410 | |
411 | diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c |
412 | index 2e1e9aa79cea..21e6e9745d00 100644 |
413 | --- a/drivers/gpu/drm/radeon/radeon_display.c |
414 | +++ b/drivers/gpu/drm/radeon/radeon_display.c |
415 | @@ -1619,18 +1619,8 @@ int radeon_modeset_init(struct radeon_device *rdev) |
416 | radeon_fbdev_init(rdev); |
417 | drm_kms_helper_poll_init(rdev->ddev); |
418 | |
419 | - if (rdev->pm.dpm_enabled) { |
420 | - /* do dpm late init */ |
421 | - ret = radeon_pm_late_init(rdev); |
422 | - if (ret) { |
423 | - rdev->pm.dpm_enabled = false; |
424 | - DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n"); |
425 | - } |
426 | - /* set the dpm state for PX since there won't be |
427 | - * a modeset to call this. |
428 | - */ |
429 | - radeon_pm_compute_clocks(rdev); |
430 | - } |
431 | + /* do pm late init */ |
432 | + ret = radeon_pm_late_init(rdev); |
433 | |
434 | return 0; |
435 | } |
436 | diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c |
437 | index 1d94b542cd82..fa537c0602e8 100644 |
438 | --- a/drivers/gpu/drm/radeon/radeon_pm.c |
439 | +++ b/drivers/gpu/drm/radeon/radeon_pm.c |
440 | @@ -1192,14 +1192,6 @@ static int radeon_pm_init_old(struct radeon_device *rdev) |
441 | INIT_DELAYED_WORK(&rdev->pm.dynpm_idle_work, radeon_dynpm_idle_work_handler); |
442 | |
443 | if (rdev->pm.num_power_states > 1) { |
444 | - /* where's the best place to put these? */ |
445 | - ret = device_create_file(rdev->dev, &dev_attr_power_profile); |
446 | - if (ret) |
447 | - DRM_ERROR("failed to create device file for power profile\n"); |
448 | - ret = device_create_file(rdev->dev, &dev_attr_power_method); |
449 | - if (ret) |
450 | - DRM_ERROR("failed to create device file for power method\n"); |
451 | - |
452 | if (radeon_debugfs_pm_init(rdev)) { |
453 | DRM_ERROR("Failed to register debugfs file for PM!\n"); |
454 | } |
455 | @@ -1257,20 +1249,6 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev) |
456 | goto dpm_failed; |
457 | rdev->pm.dpm_enabled = true; |
458 | |
459 | - ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state); |
460 | - if (ret) |
461 | - DRM_ERROR("failed to create device file for dpm state\n"); |
462 | - ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level); |
463 | - if (ret) |
464 | - DRM_ERROR("failed to create device file for dpm state\n"); |
465 | - /* XXX: these are noops for dpm but are here for backwards compat */ |
466 | - ret = device_create_file(rdev->dev, &dev_attr_power_profile); |
467 | - if (ret) |
468 | - DRM_ERROR("failed to create device file for power profile\n"); |
469 | - ret = device_create_file(rdev->dev, &dev_attr_power_method); |
470 | - if (ret) |
471 | - DRM_ERROR("failed to create device file for power method\n"); |
472 | - |
473 | if (radeon_debugfs_pm_init(rdev)) { |
474 | DRM_ERROR("Failed to register debugfs file for dpm!\n"); |
475 | } |
476 | @@ -1411,9 +1389,51 @@ int radeon_pm_late_init(struct radeon_device *rdev) |
477 | int ret = 0; |
478 | |
479 | if (rdev->pm.pm_method == PM_METHOD_DPM) { |
480 | - mutex_lock(&rdev->pm.mutex); |
481 | - ret = radeon_dpm_late_enable(rdev); |
482 | - mutex_unlock(&rdev->pm.mutex); |
483 | + if (rdev->pm.dpm_enabled) { |
484 | + if (!rdev->pm.sysfs_initialized) { |
485 | + ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state); |
486 | + if (ret) |
487 | + DRM_ERROR("failed to create device file for dpm state\n"); |
488 | + ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level); |
489 | + if (ret) |
490 | + DRM_ERROR("failed to create device file for dpm state\n"); |
491 | + /* XXX: these are noops for dpm but are here for backwards compat */ |
492 | + ret = device_create_file(rdev->dev, &dev_attr_power_profile); |
493 | + if (ret) |
494 | + DRM_ERROR("failed to create device file for power profile\n"); |
495 | + ret = device_create_file(rdev->dev, &dev_attr_power_method); |
496 | + if (ret) |
497 | + DRM_ERROR("failed to create device file for power method\n"); |
498 | + if (!ret) |
499 | + rdev->pm.sysfs_initialized = true; |
500 | + } |
501 | + |
502 | + mutex_lock(&rdev->pm.mutex); |
503 | + ret = radeon_dpm_late_enable(rdev); |
504 | + mutex_unlock(&rdev->pm.mutex); |
505 | + if (ret) { |
506 | + rdev->pm.dpm_enabled = false; |
507 | + DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n"); |
508 | + } else { |
509 | + /* set the dpm state for PX since there won't be |
510 | + * a modeset to call this. |
511 | + */ |
512 | + radeon_pm_compute_clocks(rdev); |
513 | + } |
514 | + } |
515 | + } else { |
516 | + if ((rdev->pm.num_power_states > 1) && |
517 | + (!rdev->pm.sysfs_initialized)) { |
518 | + /* where's the best place to put these? */ |
519 | + ret = device_create_file(rdev->dev, &dev_attr_power_profile); |
520 | + if (ret) |
521 | + DRM_ERROR("failed to create device file for power profile\n"); |
522 | + ret = device_create_file(rdev->dev, &dev_attr_power_method); |
523 | + if (ret) |
524 | + DRM_ERROR("failed to create device file for power method\n"); |
525 | + if (!ret) |
526 | + rdev->pm.sysfs_initialized = true; |
527 | + } |
528 | } |
529 | return ret; |
530 | } |
531 | diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c |
532 | index f822fd2a1ada..884d82f9190e 100644 |
533 | --- a/drivers/hid/hid-apple.c |
534 | +++ b/drivers/hid/hid-apple.c |
535 | @@ -546,6 +546,12 @@ static const struct hid_device_id apple_devices[] = { |
536 | .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD }, |
537 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS), |
538 | .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS }, |
539 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI), |
540 | + .driver_data = APPLE_HAS_FN }, |
541 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO), |
542 | + .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD }, |
543 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS), |
544 | + .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS }, |
545 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI), |
546 | .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN }, |
547 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO), |
548 | diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c |
549 | index 737d18c924bc..ab52d1b30161 100644 |
550 | --- a/drivers/hid/hid-core.c |
551 | +++ b/drivers/hid/hid-core.c |
552 | @@ -1751,6 +1751,9 @@ static const struct hid_device_id hid_have_special_driver[] = { |
553 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) }, |
554 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) }, |
555 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) }, |
556 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI) }, |
557 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO) }, |
558 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS) }, |
559 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) }, |
560 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) }, |
561 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) }, |
562 | @@ -2434,6 +2437,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = { |
563 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) }, |
564 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) }, |
565 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) }, |
566 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI) }, |
567 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO) }, |
568 | + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS) }, |
569 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) }, |
570 | { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) }, |
571 | { } |
572 | diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h |
573 | index ef984eba8396..984e43cb83f0 100644 |
574 | --- a/drivers/hid/hid-ids.h |
575 | +++ b/drivers/hid/hid-ids.h |
576 | @@ -142,6 +142,9 @@ |
577 | #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290 |
578 | #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291 |
579 | #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292 |
580 | +#define USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI 0x0272 |
581 | +#define USB_DEVICE_ID_APPLE_WELLSPRING9_ISO 0x0273 |
582 | +#define USB_DEVICE_ID_APPLE_WELLSPRING9_JIS 0x0274 |
583 | #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY 0x030a |
584 | #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY 0x030b |
585 | #define USB_DEVICE_ID_APPLE_IRCONTROL 0x8240 |
586 | @@ -918,7 +921,8 @@ |
587 | #define USB_DEVICE_ID_TOUCHPACK_RTS 0x1688 |
588 | |
589 | #define USB_VENDOR_ID_TPV 0x25aa |
590 | -#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN 0x8883 |
591 | +#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882 0x8882 |
592 | +#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8883 0x8883 |
593 | |
594 | #define USB_VENDOR_ID_TURBOX 0x062a |
595 | #define USB_DEVICE_ID_TURBOX_KEYBOARD 0x0201 |
596 | diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c |
597 | index a4d1fe64c925..f7dd36e4fcb3 100644 |
598 | --- a/drivers/hid/usbhid/hid-quirks.c |
599 | +++ b/drivers/hid/usbhid/hid-quirks.c |
600 | @@ -111,7 +111,8 @@ static const struct hid_blacklist { |
601 | { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET }, |
602 | { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_1, HID_QUIRK_NOGET }, |
603 | { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET }, |
604 | - { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN, HID_QUIRK_NOGET }, |
605 | + { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882, HID_QUIRK_NOGET }, |
606 | + { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8883, HID_QUIRK_NOGET }, |
607 | { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD, HID_QUIRK_NOGET }, |
608 | { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT }, |
609 | { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60, HID_QUIRK_MULTI_INPUT }, |
610 | diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c |
611 | index 373dd4d47765..76babdb800f9 100644 |
612 | --- a/drivers/i2c/busses/i2c-designware-platdrv.c |
613 | +++ b/drivers/i2c/busses/i2c-designware-platdrv.c |
614 | @@ -24,6 +24,7 @@ |
615 | #include <linux/kernel.h> |
616 | #include <linux/module.h> |
617 | #include <linux/delay.h> |
618 | +#include <linux/dmi.h> |
619 | #include <linux/i2c.h> |
620 | #include <linux/clk.h> |
621 | #include <linux/clk-provider.h> |
622 | @@ -51,6 +52,22 @@ static u32 i2c_dw_get_clk_rate_khz(struct dw_i2c_dev *dev) |
623 | } |
624 | |
625 | #ifdef CONFIG_ACPI |
626 | +/* |
627 | + * The HCNT/LCNT information coming from ACPI should be the most accurate |
628 | + * for given platform. However, some systems get it wrong. On such systems |
629 | + * we get better results by calculating those based on the input clock. |
630 | + */ |
631 | +static const struct dmi_system_id dw_i2c_no_acpi_params[] = { |
632 | + { |
633 | + .ident = "Dell Inspiron 7348", |
634 | + .matches = { |
635 | + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), |
636 | + DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7348"), |
637 | + }, |
638 | + }, |
639 | + { } |
640 | +}; |
641 | + |
642 | static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], |
643 | u16 *hcnt, u16 *lcnt, u32 *sda_hold) |
644 | { |
645 | @@ -58,6 +75,9 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], |
646 | acpi_handle handle = ACPI_HANDLE(&pdev->dev); |
647 | union acpi_object *obj; |
648 | |
649 | + if (dmi_check_system(dw_i2c_no_acpi_params)) |
650 | + return; |
651 | + |
652 | if (ACPI_FAILURE(acpi_evaluate_object(handle, method, NULL, &buf))) |
653 | return; |
654 | |
655 | diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c |
656 | index d826e82dd997..47bd421f2750 100644 |
657 | --- a/drivers/i2c/busses/i2c-rcar.c |
658 | +++ b/drivers/i2c/busses/i2c-rcar.c |
659 | @@ -584,15 +584,16 @@ static int rcar_i2c_probe(struct platform_device *pdev) |
660 | return ret; |
661 | } |
662 | |
663 | + pm_runtime_enable(dev); |
664 | + platform_set_drvdata(pdev, priv); |
665 | + |
666 | ret = i2c_add_numbered_adapter(adap); |
667 | if (ret < 0) { |
668 | dev_err(dev, "reg adap failed: %d\n", ret); |
669 | + pm_runtime_disable(dev); |
670 | return ret; |
671 | } |
672 | |
673 | - pm_runtime_enable(dev); |
674 | - platform_set_drvdata(pdev, priv); |
675 | - |
676 | dev_info(dev, "probed\n"); |
677 | |
678 | return 0; |
679 | diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c |
680 | index c127af99a0e0..b928e7a62f59 100644 |
681 | --- a/drivers/i2c/busses/i2c-s3c2410.c |
682 | +++ b/drivers/i2c/busses/i2c-s3c2410.c |
683 | @@ -1219,17 +1219,19 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) |
684 | i2c->adap.nr = i2c->pdata->bus_num; |
685 | i2c->adap.dev.of_node = pdev->dev.of_node; |
686 | |
687 | + platform_set_drvdata(pdev, i2c); |
688 | + |
689 | + pm_runtime_enable(&pdev->dev); |
690 | + |
691 | ret = i2c_add_numbered_adapter(&i2c->adap); |
692 | if (ret < 0) { |
693 | dev_err(&pdev->dev, "failed to add bus to i2c core\n"); |
694 | + pm_runtime_disable(&pdev->dev); |
695 | s3c24xx_i2c_deregister_cpufreq(i2c); |
696 | clk_unprepare(i2c->clk); |
697 | return ret; |
698 | } |
699 | |
700 | - platform_set_drvdata(pdev, i2c); |
701 | - |
702 | - pm_runtime_enable(&pdev->dev); |
703 | pm_runtime_enable(&i2c->adap.dev); |
704 | |
705 | dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev)); |
706 | diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c |
707 | index e28a494e2a3a..c3a83f7aa096 100644 |
708 | --- a/drivers/infiniband/core/cm.c |
709 | +++ b/drivers/infiniband/core/cm.c |
710 | @@ -860,6 +860,11 @@ retest: |
711 | case IB_CM_SIDR_REQ_RCVD: |
712 | spin_unlock_irq(&cm_id_priv->lock); |
713 | cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT); |
714 | + spin_lock_irq(&cm.lock); |
715 | + if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) |
716 | + rb_erase(&cm_id_priv->sidr_id_node, |
717 | + &cm.remote_sidr_table); |
718 | + spin_unlock_irq(&cm.lock); |
719 | break; |
720 | case IB_CM_REQ_SENT: |
721 | ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg); |
722 | @@ -3099,7 +3104,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id, |
723 | spin_unlock_irqrestore(&cm_id_priv->lock, flags); |
724 | |
725 | spin_lock_irqsave(&cm.lock, flags); |
726 | - rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table); |
727 | + if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) { |
728 | + rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table); |
729 | + RB_CLEAR_NODE(&cm_id_priv->sidr_id_node); |
730 | + } |
731 | spin_unlock_irqrestore(&cm.lock, flags); |
732 | return 0; |
733 | |
734 | diff --git a/drivers/input/joystick/Kconfig b/drivers/input/joystick/Kconfig |
735 | index 56eb471b5576..4215b5382092 100644 |
736 | --- a/drivers/input/joystick/Kconfig |
737 | +++ b/drivers/input/joystick/Kconfig |
738 | @@ -196,6 +196,7 @@ config JOYSTICK_TWIDJOY |
739 | config JOYSTICK_ZHENHUA |
740 | tristate "5-byte Zhenhua RC transmitter" |
741 | select SERIO |
742 | + select BITREVERSE |
743 | help |
744 | Say Y here if you have a Zhen Hua PPM-4CH transmitter which is |
745 | supplied with a ready to fly micro electric indoor helicopters |
746 | diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c |
747 | index 024b7bdffe5b..3ab045369c0c 100644 |
748 | --- a/drivers/input/keyboard/omap4-keypad.c |
749 | +++ b/drivers/input/keyboard/omap4-keypad.c |
750 | @@ -266,7 +266,7 @@ static int omap4_keypad_probe(struct platform_device *pdev) |
751 | |
752 | error = omap4_keypad_parse_dt(&pdev->dev, keypad_data); |
753 | if (error) |
754 | - return error; |
755 | + goto err_free_keypad; |
756 | |
757 | res = request_mem_region(res->start, resource_size(res), pdev->name); |
758 | if (!res) { |
759 | diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c |
760 | index 95a3a6e2faf6..51a61e28b89e 100644 |
761 | --- a/drivers/input/mouse/psmouse-base.c |
762 | +++ b/drivers/input/mouse/psmouse-base.c |
763 | @@ -1473,6 +1473,10 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv) |
764 | if (error) |
765 | goto err_clear_drvdata; |
766 | |
767 | + /* give PT device some time to settle down before probing */ |
768 | + if (serio->id.type == SERIO_PS_PSTHRU) |
769 | + usleep_range(10000, 15000); |
770 | + |
771 | if (psmouse_probe(psmouse) < 0) { |
772 | error = -ENODEV; |
773 | goto err_close_serio; |
774 | diff --git a/drivers/input/serio/parkbd.c b/drivers/input/serio/parkbd.c |
775 | index 26b45936f9fd..1e8cd6f1fe9e 100644 |
776 | --- a/drivers/input/serio/parkbd.c |
777 | +++ b/drivers/input/serio/parkbd.c |
778 | @@ -194,6 +194,7 @@ static int __init parkbd_init(void) |
779 | parkbd_port = parkbd_allocate_serio(); |
780 | if (!parkbd_port) { |
781 | parport_release(parkbd_dev); |
782 | + parport_unregister_device(parkbd_dev); |
783 | return -ENOMEM; |
784 | } |
785 | |
786 | diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c |
787 | index fab0ea1a46d1..af3daf89c77d 100644 |
788 | --- a/drivers/iommu/amd_iommu.c |
789 | +++ b/drivers/iommu/amd_iommu.c |
790 | @@ -1705,14 +1705,16 @@ static unsigned long dma_ops_area_alloc(struct device *dev, |
791 | unsigned long next_bit = dom->next_address % APERTURE_RANGE_SIZE; |
792 | int max_index = dom->aperture_size >> APERTURE_RANGE_SHIFT; |
793 | int i = start >> APERTURE_RANGE_SHIFT; |
794 | - unsigned long boundary_size; |
795 | + unsigned long boundary_size, mask; |
796 | unsigned long address = -1; |
797 | unsigned long limit; |
798 | |
799 | next_bit >>= PAGE_SHIFT; |
800 | |
801 | - boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1, |
802 | - PAGE_SIZE) >> PAGE_SHIFT; |
803 | + mask = dma_get_seg_boundary(dev); |
804 | + |
805 | + boundary_size = mask + 1 ? ALIGN(mask + 1, PAGE_SIZE) >> PAGE_SHIFT : |
806 | + 1UL << (BITS_PER_LONG - PAGE_SHIFT); |
807 | |
808 | for (;i < max_index; ++i) { |
809 | unsigned long offset = dom->aperture[i]->offset >> PAGE_SHIFT; |
810 | @@ -2100,8 +2102,8 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain, bool ats) |
811 | static void clear_dte_entry(u16 devid) |
812 | { |
813 | /* remove entry from the device table seen by the hardware */ |
814 | - amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV; |
815 | - amd_iommu_dev_table[devid].data[1] = 0; |
816 | + amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV; |
817 | + amd_iommu_dev_table[devid].data[1] &= DTE_FLAG_MASK; |
818 | |
819 | amd_iommu_apply_erratum_63(devid); |
820 | } |
821 | diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h |
822 | index cec51a8ba844..791442af1fba 100644 |
823 | --- a/drivers/iommu/amd_iommu_types.h |
824 | +++ b/drivers/iommu/amd_iommu_types.h |
825 | @@ -289,6 +289,7 @@ |
826 | #define IOMMU_PTE_IR (1ULL << 61) |
827 | #define IOMMU_PTE_IW (1ULL << 62) |
828 | |
829 | +#define DTE_FLAG_MASK (0x3ffULL << 32) |
830 | #define DTE_FLAG_IOTLB (0x01UL << 32) |
831 | #define DTE_FLAG_GV (0x01ULL << 55) |
832 | #define DTE_GLX_SHIFT (56) |
833 | diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c |
834 | index 0801e35b9940..a7c9685c52f6 100644 |
835 | --- a/drivers/md/dm-thin.c |
836 | +++ b/drivers/md/dm-thin.c |
837 | @@ -2596,7 +2596,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) |
838 | metadata_low_callback, |
839 | pool); |
840 | if (r) |
841 | - goto out_free_pt; |
842 | + goto out_flags_changed; |
843 | |
844 | pt->callbacks.congested_fn = pool_is_congested; |
845 | dm_table_add_target_callbacks(ti->table, &pt->callbacks); |
846 | diff --git a/drivers/md/md.c b/drivers/md/md.c |
847 | index 9c5d53f3e4c6..6c169f18aab8 100644 |
848 | --- a/drivers/md/md.c |
849 | +++ b/drivers/md/md.c |
850 | @@ -7560,8 +7560,7 @@ static int remove_and_add_spares(struct mddev *mddev, |
851 | !test_bit(Bitmap_sync, &rdev->flags))) |
852 | continue; |
853 | |
854 | - if (rdev->saved_raid_disk < 0) |
855 | - rdev->recovery_offset = 0; |
856 | + rdev->recovery_offset = 0; |
857 | if (mddev->pers-> |
858 | hot_add_disk(mddev, rdev) == 0) { |
859 | if (sysfs_link_rdev(mddev, rdev)) |
860 | diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c |
861 | index 7c0d75547ccf..92cd09f3c69b 100644 |
862 | --- a/drivers/md/persistent-data/dm-btree-remove.c |
863 | +++ b/drivers/md/persistent-data/dm-btree-remove.c |
864 | @@ -301,11 +301,16 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, |
865 | { |
866 | int s; |
867 | uint32_t max_entries = le32_to_cpu(left->header.max_entries); |
868 | - unsigned target = (nr_left + nr_center + nr_right) / 3; |
869 | - BUG_ON(target > max_entries); |
870 | + unsigned total = nr_left + nr_center + nr_right; |
871 | + unsigned target_right = total / 3; |
872 | + unsigned remainder = (target_right * 3) != total; |
873 | + unsigned target_left = target_right + remainder; |
874 | + |
875 | + BUG_ON(target_left > max_entries); |
876 | + BUG_ON(target_right > max_entries); |
877 | |
878 | if (nr_left < nr_right) { |
879 | - s = nr_left - target; |
880 | + s = nr_left - target_left; |
881 | |
882 | if (s < 0 && nr_center < -s) { |
883 | /* not enough in central node */ |
884 | @@ -316,10 +321,10 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, |
885 | } else |
886 | shift(left, center, s); |
887 | |
888 | - shift(center, right, target - nr_right); |
889 | + shift(center, right, target_right - nr_right); |
890 | |
891 | } else { |
892 | - s = target - nr_right; |
893 | + s = target_right - nr_right; |
894 | if (s > 0 && nr_center < s) { |
895 | /* not enough in central node */ |
896 | shift(center, right, nr_center); |
897 | @@ -329,7 +334,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, |
898 | } else |
899 | shift(center, right, s); |
900 | |
901 | - shift(left, center, nr_left - target); |
902 | + shift(left, center, nr_left - target_left); |
903 | } |
904 | |
905 | *key_ptr(parent, c->index) = center->keys[0]; |
906 | diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c |
907 | index c7726cebc495..d6e47033b5e0 100644 |
908 | --- a/drivers/md/persistent-data/dm-btree.c |
909 | +++ b/drivers/md/persistent-data/dm-btree.c |
910 | @@ -523,7 +523,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key) |
911 | |
912 | r = new_block(s->info, &right); |
913 | if (r < 0) { |
914 | - /* FIXME: put left */ |
915 | + unlock_block(s->info, left); |
916 | return r; |
917 | } |
918 | |
919 | diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c |
920 | index d24245c7b94a..3c8ada48ca76 100644 |
921 | --- a/drivers/md/raid1.c |
922 | +++ b/drivers/md/raid1.c |
923 | @@ -2245,7 +2245,7 @@ static int narrow_write_error(struct r1bio *r1_bio, int i) |
924 | bio_trim(wbio, sector - r1_bio->sector, sectors); |
925 | wbio->bi_iter.bi_sector += rdev->data_offset; |
926 | wbio->bi_bdev = rdev->bdev; |
927 | - if (submit_bio_wait(WRITE, wbio) == 0) |
928 | + if (submit_bio_wait(WRITE, wbio) < 0) |
929 | /* failure! */ |
930 | ok = rdev_set_badblocks(rdev, sector, |
931 | sectors, 0) |
932 | diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c |
933 | index 17eb76760bf5..644f9e576736 100644 |
934 | --- a/drivers/md/raid10.c |
935 | +++ b/drivers/md/raid10.c |
936 | @@ -2599,7 +2599,7 @@ static int narrow_write_error(struct r10bio *r10_bio, int i) |
937 | choose_data_offset(r10_bio, rdev) + |
938 | (sector - r10_bio->sector)); |
939 | wbio->bi_bdev = rdev->bdev; |
940 | - if (submit_bio_wait(WRITE, wbio) == 0) |
941 | + if (submit_bio_wait(WRITE, wbio) < 0) |
942 | /* Failure! */ |
943 | ok = rdev_set_badblocks(rdev, sector, |
944 | sectors, 0) |
945 | diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c |
946 | index e421016bab77..5fa7549ba409 100644 |
947 | --- a/drivers/md/raid5.c |
948 | +++ b/drivers/md/raid5.c |
949 | @@ -3060,6 +3060,8 @@ static void handle_stripe_clean_event(struct r5conf *conf, |
950 | } |
951 | if (!discard_pending && |
952 | test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) { |
953 | + int hash = sh->hash_lock_index; |
954 | + |
955 | clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags); |
956 | clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags); |
957 | if (sh->qd_idx >= 0) { |
958 | @@ -3073,9 +3075,9 @@ static void handle_stripe_clean_event(struct r5conf *conf, |
959 | * no updated data, so remove it from hash list and the stripe |
960 | * will be reinitialized |
961 | */ |
962 | - spin_lock_irq(&conf->device_lock); |
963 | + spin_lock_irq(conf->hash_locks + hash); |
964 | remove_hash(sh); |
965 | - spin_unlock_irq(&conf->device_lock); |
966 | + spin_unlock_irq(conf->hash_locks + hash); |
967 | if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state)) |
968 | set_bit(STRIPE_HANDLE, &sh->state); |
969 | |
970 | diff --git a/drivers/media/platform/vsp1/vsp1_regs.h b/drivers/media/platform/vsp1/vsp1_regs.h |
971 | index 55f163d32d15..8bf802ca16ac 100644 |
972 | --- a/drivers/media/platform/vsp1/vsp1_regs.h |
973 | +++ b/drivers/media/platform/vsp1/vsp1_regs.h |
974 | @@ -238,7 +238,7 @@ |
975 | #define VI6_WPF_SZCLIP_EN (1 << 28) |
976 | #define VI6_WPF_SZCLIP_OFST_MASK (0xff << 16) |
977 | #define VI6_WPF_SZCLIP_OFST_SHIFT 16 |
978 | -#define VI6_WPF_SZCLIP_SIZE_MASK (0x1fff << 0) |
979 | +#define VI6_WPF_SZCLIP_SIZE_MASK (0xfff << 0) |
980 | #define VI6_WPF_SZCLIP_SIZE_SHIFT 0 |
981 | |
982 | #define VI6_WPF_OUTFMT 0x100c |
983 | @@ -304,9 +304,9 @@ |
984 | #define VI6_DPR_HST_ROUTE 0x2044 |
985 | #define VI6_DPR_HSI_ROUTE 0x2048 |
986 | #define VI6_DPR_BRU_ROUTE 0x204c |
987 | -#define VI6_DPR_ROUTE_FXA_MASK (0xff << 8) |
988 | +#define VI6_DPR_ROUTE_FXA_MASK (0xff << 16) |
989 | #define VI6_DPR_ROUTE_FXA_SHIFT 16 |
990 | -#define VI6_DPR_ROUTE_FP_MASK (0xff << 8) |
991 | +#define VI6_DPR_ROUTE_FP_MASK (0x3f << 8) |
992 | #define VI6_DPR_ROUTE_FP_SHIFT 8 |
993 | #define VI6_DPR_ROUTE_RT_MASK (0x3f << 0) |
994 | #define VI6_DPR_ROUTE_RT_SHIFT 0 |
995 | diff --git a/drivers/media/usb/gspca/m5602/m5602_s5k83a.c b/drivers/media/usb/gspca/m5602/m5602_s5k83a.c |
996 | index 7cbc3a00bda8..bf6b215438e3 100644 |
997 | --- a/drivers/media/usb/gspca/m5602/m5602_s5k83a.c |
998 | +++ b/drivers/media/usb/gspca/m5602/m5602_s5k83a.c |
999 | @@ -177,7 +177,7 @@ static int rotation_thread_function(void *data) |
1000 | __s32 vflip, hflip; |
1001 | |
1002 | set_current_state(TASK_INTERRUPTIBLE); |
1003 | - while (!schedule_timeout(100)) { |
1004 | + while (!schedule_timeout(msecs_to_jiffies(100))) { |
1005 | if (mutex_lock_interruptible(&sd->gspca_dev.usb_lock)) |
1006 | break; |
1007 | |
1008 | diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c |
1009 | index 9bfa041e3316..d78689831aea 100644 |
1010 | --- a/drivers/media/usb/usbvision/usbvision-video.c |
1011 | +++ b/drivers/media/usb/usbvision/usbvision-video.c |
1012 | @@ -435,6 +435,7 @@ static int usbvision_v4l2_close(struct file *file) |
1013 | usbvision_scratch_free(usbvision); |
1014 | |
1015 | usbvision->user--; |
1016 | + mutex_unlock(&usbvision->v4l2_lock); |
1017 | |
1018 | if (power_on_at_open) { |
1019 | /* power off in a little while |
1020 | @@ -448,7 +449,6 @@ static int usbvision_v4l2_close(struct file *file) |
1021 | usbvision_release(usbvision); |
1022 | return 0; |
1023 | } |
1024 | - mutex_unlock(&usbvision->v4l2_lock); |
1025 | |
1026 | PDEBUG(DBG_IO, "success"); |
1027 | return 0; |
1028 | diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c |
1029 | index 70bb7530b22c..fc7393729081 100644 |
1030 | --- a/drivers/message/fusion/mptctl.c |
1031 | +++ b/drivers/message/fusion/mptctl.c |
1032 | @@ -1859,6 +1859,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr) |
1033 | } |
1034 | spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags); |
1035 | |
1036 | + /* Basic sanity checks to prevent underflows or integer overflows */ |
1037 | + if (karg.maxReplyBytes < 0 || |
1038 | + karg.dataInSize < 0 || |
1039 | + karg.dataOutSize < 0 || |
1040 | + karg.dataSgeOffset < 0 || |
1041 | + karg.maxSenseBytes < 0 || |
1042 | + karg.dataSgeOffset > ioc->req_sz / 4) |
1043 | + return -EINVAL; |
1044 | + |
1045 | /* Verify that the final request frame will not be too large. |
1046 | */ |
1047 | sz = karg.dataSgeOffset * 4; |
1048 | diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c |
1049 | index 4642b5b816a0..6ccc0fdab767 100644 |
1050 | --- a/drivers/mfd/wm5110-tables.c |
1051 | +++ b/drivers/mfd/wm5110-tables.c |
1052 | @@ -249,6 +249,16 @@ static const struct reg_default wm5110_revd_patch[] = { |
1053 | { 0x80, 0x0 }, |
1054 | }; |
1055 | |
1056 | +/* Add extra headphone write sequence locations */ |
1057 | +static const struct reg_default wm5110_reve_patch[] = { |
1058 | + { 0x80, 0x3 }, |
1059 | + { 0x80, 0x3 }, |
1060 | + { 0x4b, 0x138 }, |
1061 | + { 0x4c, 0x13d }, |
1062 | + { 0x80, 0x0 }, |
1063 | + { 0x80, 0x0 }, |
1064 | +}; |
1065 | + |
1066 | /* We use a function so we can use ARRAY_SIZE() */ |
1067 | int wm5110_patch(struct arizona *arizona) |
1068 | { |
1069 | @@ -266,7 +276,9 @@ int wm5110_patch(struct arizona *arizona) |
1070 | wm5110_revd_patch, |
1071 | ARRAY_SIZE(wm5110_revd_patch)); |
1072 | default: |
1073 | - return 0; |
1074 | + return regmap_register_patch(arizona->regmap, |
1075 | + wm5110_reve_patch, |
1076 | + ARRAY_SIZE(wm5110_reve_patch)); |
1077 | } |
1078 | } |
1079 | EXPORT_SYMBOL_GPL(wm5110_patch); |
1080 | diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c |
1081 | index 61ebb038fb75..2a6b149d7da3 100644 |
1082 | --- a/drivers/net/ethernet/mellanox/mlx4/cmd.c |
1083 | +++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c |
1084 | @@ -2047,7 +2047,7 @@ int mlx4_multi_func_init(struct mlx4_dev *dev) |
1085 | spin_lock_init(&s_state->lock); |
1086 | } |
1087 | |
1088 | - memset(&priv->mfunc.master.cmd_eqe, 0, dev->caps.eqe_size); |
1089 | + memset(&priv->mfunc.master.cmd_eqe, 0, sizeof(struct mlx4_eqe)); |
1090 | priv->mfunc.master.cmd_eqe.type = MLX4_EVENT_TYPE_CMD; |
1091 | INIT_WORK(&priv->mfunc.master.comm_work, |
1092 | mlx4_master_comm_channel); |
1093 | diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c |
1094 | index af67e7d410eb..11ef2c2af9bf 100644 |
1095 | --- a/drivers/net/ethernet/mellanox/mlx4/eq.c |
1096 | +++ b/drivers/net/ethernet/mellanox/mlx4/eq.c |
1097 | @@ -185,7 +185,7 @@ static void slave_event(struct mlx4_dev *dev, u8 slave, struct mlx4_eqe *eqe) |
1098 | return; |
1099 | } |
1100 | |
1101 | - memcpy(s_eqe, eqe, dev->caps.eqe_size - 1); |
1102 | + memcpy(s_eqe, eqe, sizeof(struct mlx4_eqe) - 1); |
1103 | s_eqe->slave_id = slave; |
1104 | /* ensure all information is written before setting the ownersip bit */ |
1105 | wmb(); |
1106 | diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c |
1107 | index a77f05ce8325..63ec209cdfd3 100644 |
1108 | --- a/drivers/net/ethernet/sfc/ef10.c |
1109 | +++ b/drivers/net/ethernet/sfc/ef10.c |
1110 | @@ -1344,7 +1344,9 @@ static void efx_ef10_tx_write(struct efx_tx_queue *tx_queue) |
1111 | unsigned int write_ptr; |
1112 | efx_qword_t *txd; |
1113 | |
1114 | - BUG_ON(tx_queue->write_count == tx_queue->insert_count); |
1115 | + tx_queue->xmit_more_available = false; |
1116 | + if (unlikely(tx_queue->write_count == tx_queue->insert_count)) |
1117 | + return; |
1118 | |
1119 | do { |
1120 | write_ptr = tx_queue->write_count & tx_queue->ptr_mask; |
1121 | diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c |
1122 | index 6859437b59fb..b70b865fd19b 100644 |
1123 | --- a/drivers/net/ethernet/sfc/farch.c |
1124 | +++ b/drivers/net/ethernet/sfc/farch.c |
1125 | @@ -316,7 +316,9 @@ void efx_farch_tx_write(struct efx_tx_queue *tx_queue) |
1126 | unsigned write_ptr; |
1127 | unsigned old_write_count = tx_queue->write_count; |
1128 | |
1129 | - BUG_ON(tx_queue->write_count == tx_queue->insert_count); |
1130 | + tx_queue->xmit_more_available = false; |
1131 | + if (unlikely(tx_queue->write_count == tx_queue->insert_count)) |
1132 | + return; |
1133 | |
1134 | do { |
1135 | write_ptr = tx_queue->write_count & tx_queue->ptr_mask; |
1136 | diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h |
1137 | index 9ede32064685..eda39c82f7e7 100644 |
1138 | --- a/drivers/net/ethernet/sfc/net_driver.h |
1139 | +++ b/drivers/net/ethernet/sfc/net_driver.h |
1140 | @@ -218,6 +218,7 @@ struct efx_tx_buffer { |
1141 | * @tso_packets: Number of packets via the TSO xmit path |
1142 | * @pushes: Number of times the TX push feature has been used |
1143 | * @pio_packets: Number of times the TX PIO feature has been used |
1144 | + * @xmit_more_available: Are any packets waiting to be pushed to the NIC |
1145 | * @empty_read_count: If the completion path has seen the queue as empty |
1146 | * and the transmission path has not yet checked this, the value of |
1147 | * @read_count bitwise-added to %EFX_EMPTY_COUNT_VALID; otherwise 0. |
1148 | @@ -250,6 +251,7 @@ struct efx_tx_queue { |
1149 | unsigned int tso_packets; |
1150 | unsigned int pushes; |
1151 | unsigned int pio_packets; |
1152 | + bool xmit_more_available; |
1153 | /* Statistics to supplement MAC stats */ |
1154 | unsigned long tx_packets; |
1155 | |
1156 | diff --git a/drivers/net/ethernet/sfc/selftest.c b/drivers/net/ethernet/sfc/selftest.c |
1157 | index 10b6173d557d..b605dfd5c7bc 100644 |
1158 | --- a/drivers/net/ethernet/sfc/selftest.c |
1159 | +++ b/drivers/net/ethernet/sfc/selftest.c |
1160 | @@ -46,7 +46,7 @@ struct efx_loopback_payload { |
1161 | struct iphdr ip; |
1162 | struct udphdr udp; |
1163 | __be16 iteration; |
1164 | - const char msg[64]; |
1165 | + char msg[64]; |
1166 | } __packed; |
1167 | |
1168 | /* Loopback test source MAC address */ |
1169 | diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c |
1170 | index aaf2987512b5..e70edc3dea7e 100644 |
1171 | --- a/drivers/net/ethernet/sfc/tx.c |
1172 | +++ b/drivers/net/ethernet/sfc/tx.c |
1173 | @@ -431,8 +431,20 @@ finish_packet: |
1174 | efx_tx_maybe_stop_queue(tx_queue); |
1175 | |
1176 | /* Pass off to hardware */ |
1177 | - if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) |
1178 | + if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) { |
1179 | + struct efx_tx_queue *txq2 = efx_tx_queue_partner(tx_queue); |
1180 | + |
1181 | + /* There could be packets left on the partner queue if those |
1182 | + * SKBs had skb->xmit_more set. If we do not push those they |
1183 | + * could be left for a long time and cause a netdev watchdog. |
1184 | + */ |
1185 | + if (txq2->xmit_more_available) |
1186 | + efx_nic_push_buffers(txq2); |
1187 | + |
1188 | efx_nic_push_buffers(tx_queue); |
1189 | + } else { |
1190 | + tx_queue->xmit_more_available = skb->xmit_more; |
1191 | + } |
1192 | |
1193 | tx_queue->tx_packets++; |
1194 | |
1195 | @@ -721,6 +733,7 @@ void efx_init_tx_queue(struct efx_tx_queue *tx_queue) |
1196 | tx_queue->read_count = 0; |
1197 | tx_queue->old_read_count = 0; |
1198 | tx_queue->empty_read_count = 0 | EFX_EMPTY_COUNT_VALID; |
1199 | + tx_queue->xmit_more_available = false; |
1200 | |
1201 | /* Set up TX descriptor ring */ |
1202 | efx_nic_init_tx(tx_queue); |
1203 | @@ -746,6 +759,7 @@ void efx_fini_tx_queue(struct efx_tx_queue *tx_queue) |
1204 | |
1205 | ++tx_queue->read_count; |
1206 | } |
1207 | + tx_queue->xmit_more_available = false; |
1208 | netdev_tx_reset_queue(tx_queue->core_txq); |
1209 | } |
1210 | |
1211 | @@ -1301,8 +1315,20 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue, |
1212 | efx_tx_maybe_stop_queue(tx_queue); |
1213 | |
1214 | /* Pass off to hardware */ |
1215 | - if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) |
1216 | + if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) { |
1217 | + struct efx_tx_queue *txq2 = efx_tx_queue_partner(tx_queue); |
1218 | + |
1219 | + /* There could be packets left on the partner queue if those |
1220 | + * SKBs had skb->xmit_more set. If we do not push those they |
1221 | + * could be left for a long time and cause a netdev watchdog. |
1222 | + */ |
1223 | + if (txq2->xmit_more_available) |
1224 | + efx_nic_push_buffers(txq2); |
1225 | + |
1226 | efx_nic_push_buffers(tx_queue); |
1227 | + } else { |
1228 | + tx_queue->xmit_more_available = skb->xmit_more; |
1229 | + } |
1230 | |
1231 | tx_queue->tso_bursts++; |
1232 | return NETDEV_TX_OK; |
1233 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c |
1234 | index 3a08a1f78c73..11edb2c9e572 100644 |
1235 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c |
1236 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c |
1237 | @@ -721,10 +721,13 @@ static int stmmac_get_ts_info(struct net_device *dev, |
1238 | { |
1239 | struct stmmac_priv *priv = netdev_priv(dev); |
1240 | |
1241 | - if ((priv->hwts_tx_en) && (priv->hwts_rx_en)) { |
1242 | + if ((priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) { |
1243 | |
1244 | - info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE | |
1245 | + info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | |
1246 | + SOF_TIMESTAMPING_TX_HARDWARE | |
1247 | + SOF_TIMESTAMPING_RX_SOFTWARE | |
1248 | SOF_TIMESTAMPING_RX_HARDWARE | |
1249 | + SOF_TIMESTAMPING_SOFTWARE | |
1250 | SOF_TIMESTAMPING_RAW_HARDWARE; |
1251 | |
1252 | if (priv->ptp_clock) |
1253 | diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c |
1254 | index 91d0c6a86e37..91120f0ed98c 100644 |
1255 | --- a/drivers/net/macvtap.c |
1256 | +++ b/drivers/net/macvtap.c |
1257 | @@ -68,7 +68,7 @@ static const struct proto_ops macvtap_socket_ops; |
1258 | #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \ |
1259 | NETIF_F_TSO6) |
1260 | #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO) |
1261 | -#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG) |
1262 | +#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG | NETIF_F_FRAGLIST) |
1263 | |
1264 | static struct macvlan_dev *macvtap_get_vlan_rcu(const struct net_device *dev) |
1265 | { |
1266 | diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c |
1267 | index 854f2c9a7b2b..64860c041745 100644 |
1268 | --- a/drivers/net/phy/broadcom.c |
1269 | +++ b/drivers/net/phy/broadcom.c |
1270 | @@ -674,7 +674,7 @@ static struct mdio_device_id __maybe_unused broadcom_tbl[] = { |
1271 | { PHY_ID_BCM5421, 0xfffffff0 }, |
1272 | { PHY_ID_BCM5461, 0xfffffff0 }, |
1273 | { PHY_ID_BCM5464, 0xfffffff0 }, |
1274 | - { PHY_ID_BCM5482, 0xfffffff0 }, |
1275 | + { PHY_ID_BCM5481, 0xfffffff0 }, |
1276 | { PHY_ID_BCM5482, 0xfffffff0 }, |
1277 | { PHY_ID_BCM50610, 0xfffffff0 }, |
1278 | { PHY_ID_BCM50610M, 0xfffffff0 }, |
1279 | diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c |
1280 | index 6c9c16d76935..5aa563136373 100644 |
1281 | --- a/drivers/net/ppp/pppoe.c |
1282 | +++ b/drivers/net/ppp/pppoe.c |
1283 | @@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_device *dev) |
1284 | if (po->pppoe_dev == dev && |
1285 | sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { |
1286 | pppox_unbind_sock(sk); |
1287 | - sk->sk_state = PPPOX_ZOMBIE; |
1288 | sk->sk_state_change(sk); |
1289 | po->pppoe_dev = NULL; |
1290 | dev_put(dev); |
1291 | @@ -570,7 +569,7 @@ static int pppoe_release(struct socket *sock) |
1292 | |
1293 | po = pppox_sk(sk); |
1294 | |
1295 | - if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { |
1296 | + if (po->pppoe_dev) { |
1297 | dev_put(po->pppoe_dev); |
1298 | po->pppoe_dev = NULL; |
1299 | } |
1300 | diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c |
1301 | index b8a82b86f909..a5771515d9ab 100644 |
1302 | --- a/drivers/net/usb/qmi_wwan.c |
1303 | +++ b/drivers/net/usb/qmi_wwan.c |
1304 | @@ -535,6 +535,10 @@ static const struct usb_device_id products[] = { |
1305 | USB_CDC_PROTO_NONE), |
1306 | .driver_info = (unsigned long)&qmi_wwan_info, |
1307 | }, |
1308 | + { /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */ |
1309 | + USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7), |
1310 | + .driver_info = (unsigned long)&qmi_wwan_info, |
1311 | + }, |
1312 | |
1313 | /* 3. Combined interface devices matching on interface number */ |
1314 | {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */ |
1315 | @@ -760,12 +764,17 @@ static const struct usb_device_id products[] = { |
1316 | {QMI_FIXED_INTF(0x1199, 0x9056, 8)}, /* Sierra Wireless Modem */ |
1317 | {QMI_FIXED_INTF(0x1199, 0x9057, 8)}, |
1318 | {QMI_FIXED_INTF(0x1199, 0x9061, 8)}, /* Sierra Wireless Modem */ |
1319 | + {QMI_FIXED_INTF(0x1199, 0x9070, 8)}, /* Sierra Wireless MC74xx/EM74xx */ |
1320 | + {QMI_FIXED_INTF(0x1199, 0x9070, 10)}, /* Sierra Wireless MC74xx/EM74xx */ |
1321 | + {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx/EM74xx */ |
1322 | + {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx/EM74xx */ |
1323 | {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ |
1324 | {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ |
1325 | {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ |
1326 | {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ |
1327 | {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ |
1328 | {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ |
1329 | + {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */ |
1330 | {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */ |
1331 | {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */ |
1332 | {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)}, /* Olivetti Olicard 140 */ |
1333 | @@ -780,7 +789,6 @@ static const struct usb_device_id products[] = { |
1334 | {QMI_FIXED_INTF(0x413c, 0x81a4, 8)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ |
1335 | {QMI_FIXED_INTF(0x413c, 0x81a8, 8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */ |
1336 | {QMI_FIXED_INTF(0x413c, 0x81a9, 8)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */ |
1337 | - {QMI_FIXED_INTF(0x03f0, 0x581d, 4)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */ |
1338 | |
1339 | /* 4. Gobi 1000 devices */ |
1340 | {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ |
1341 | diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c |
1342 | index 484ecce78025..ce2a29971230 100644 |
1343 | --- a/drivers/net/virtio_net.c |
1344 | +++ b/drivers/net/virtio_net.c |
1345 | @@ -1746,9 +1746,9 @@ static int virtnet_probe(struct virtio_device *vdev) |
1346 | /* Do we support "hardware" checksums? */ |
1347 | if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) { |
1348 | /* This opens up the world of extra features. */ |
1349 | - dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST; |
1350 | + dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG; |
1351 | if (csum) |
1352 | - dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST; |
1353 | + dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG; |
1354 | |
1355 | if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) { |
1356 | dev->hw_features |= NETIF_F_TSO |
1357 | diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c |
1358 | index 3bd030494986..ee15a579ec70 100644 |
1359 | --- a/drivers/net/wireless/ath/ath9k/init.c |
1360 | +++ b/drivers/net/wireless/ath/ath9k/init.c |
1361 | @@ -821,6 +821,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw) |
1362 | hw->max_rate_tries = 10; |
1363 | hw->sta_data_size = sizeof(struct ath_node); |
1364 | hw->vif_data_size = sizeof(struct ath_vif); |
1365 | + hw->extra_tx_headroom = 4; |
1366 | |
1367 | hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1; |
1368 | hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1; |
1369 | diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c |
1370 | index cfe1293692fc..b51fb8977104 100644 |
1371 | --- a/drivers/net/wireless/iwlwifi/dvm/lib.c |
1372 | +++ b/drivers/net/wireless/iwlwifi/dvm/lib.c |
1373 | @@ -1022,7 +1022,7 @@ static void iwlagn_wowlan_program_keys(struct ieee80211_hw *hw, |
1374 | u8 *pn = seq.ccmp.pn; |
1375 | |
1376 | ieee80211_get_key_rx_seq(key, i, &seq); |
1377 | - aes_sc->pn = cpu_to_le64( |
1378 | + aes_sc[i].pn = cpu_to_le64( |
1379 | (u64)pn[5] | |
1380 | ((u64)pn[4] << 8) | |
1381 | ((u64)pn[3] << 16) | |
1382 | diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c |
1383 | index b04b8858c690..9dfd1d1106d7 100644 |
1384 | --- a/drivers/net/wireless/iwlwifi/iwl-7000.c |
1385 | +++ b/drivers/net/wireless/iwlwifi/iwl-7000.c |
1386 | @@ -102,6 +102,9 @@ |
1387 | #define IWL7265_FW_PRE "iwlwifi-7265-" |
1388 | #define IWL7265_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode" |
1389 | |
1390 | +#define IWL7265D_FW_PRE "iwlwifi-7265D-" |
1391 | +#define IWL7265D_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode" |
1392 | + |
1393 | #define NVM_HW_SECTION_NUM_FAMILY_7000 0 |
1394 | |
1395 | static const struct iwl_base_params iwl7000_base_params = { |
1396 | @@ -267,7 +270,37 @@ const struct iwl_cfg iwl7265_n_cfg = { |
1397 | .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs, |
1398 | }; |
1399 | |
1400 | +const struct iwl_cfg iwl7265d_2ac_cfg = { |
1401 | + .name = "Intel(R) Dual Band Wireless AC 7265", |
1402 | + .fw_name_pre = IWL7265D_FW_PRE, |
1403 | + IWL_DEVICE_7000, |
1404 | + .ht_params = &iwl7265_ht_params, |
1405 | + .nvm_ver = IWL7265_NVM_VERSION, |
1406 | + .nvm_calib_ver = IWL7265_TX_POWER_VERSION, |
1407 | + .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs, |
1408 | +}; |
1409 | + |
1410 | +const struct iwl_cfg iwl7265d_2n_cfg = { |
1411 | + .name = "Intel(R) Dual Band Wireless N 7265", |
1412 | + .fw_name_pre = IWL7265D_FW_PRE, |
1413 | + IWL_DEVICE_7000, |
1414 | + .ht_params = &iwl7265_ht_params, |
1415 | + .nvm_ver = IWL7265_NVM_VERSION, |
1416 | + .nvm_calib_ver = IWL7265_TX_POWER_VERSION, |
1417 | + .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs, |
1418 | +}; |
1419 | + |
1420 | +const struct iwl_cfg iwl7265d_n_cfg = { |
1421 | + .name = "Intel(R) Wireless N 7265", |
1422 | + .fw_name_pre = IWL7265D_FW_PRE, |
1423 | + IWL_DEVICE_7000, |
1424 | + .ht_params = &iwl7265_ht_params, |
1425 | + .nvm_ver = IWL7265_NVM_VERSION, |
1426 | + .nvm_calib_ver = IWL7265_TX_POWER_VERSION, |
1427 | + .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs, |
1428 | +}; |
1429 | + |
1430 | MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); |
1431 | -MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK)); |
1432 | -MODULE_FIRMWARE(IWL3165_MODULE_FIRMWARE(IWL3160_UCODE_API_OK)); |
1433 | +MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); |
1434 | MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); |
1435 | +MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); |
1436 | diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h |
1437 | index 2ef83a39ff10..6cc051cace5d 100644 |
1438 | --- a/drivers/net/wireless/iwlwifi/iwl-config.h |
1439 | +++ b/drivers/net/wireless/iwlwifi/iwl-config.h |
1440 | @@ -346,6 +346,9 @@ extern const struct iwl_cfg iwl3165_2ac_cfg; |
1441 | extern const struct iwl_cfg iwl7265_2ac_cfg; |
1442 | extern const struct iwl_cfg iwl7265_2n_cfg; |
1443 | extern const struct iwl_cfg iwl7265_n_cfg; |
1444 | +extern const struct iwl_cfg iwl7265d_2ac_cfg; |
1445 | +extern const struct iwl_cfg iwl7265d_2n_cfg; |
1446 | +extern const struct iwl_cfg iwl7265d_n_cfg; |
1447 | extern const struct iwl_cfg iwl8260_2n_cfg; |
1448 | extern const struct iwl_cfg iwl8260_2ac_cfg; |
1449 | extern const struct iwl_cfg iwl8260_2ac_sdio_cfg; |
1450 | diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h |
1451 | index 3f6f015285e5..671bdbca33ee 100644 |
1452 | --- a/drivers/net/wireless/iwlwifi/iwl-csr.h |
1453 | +++ b/drivers/net/wireless/iwlwifi/iwl-csr.h |
1454 | @@ -305,23 +305,24 @@ enum { |
1455 | }; |
1456 | |
1457 | |
1458 | -#define CSR_HW_REV_TYPE_MSK (0x000FFF0) |
1459 | -#define CSR_HW_REV_TYPE_5300 (0x0000020) |
1460 | -#define CSR_HW_REV_TYPE_5350 (0x0000030) |
1461 | -#define CSR_HW_REV_TYPE_5100 (0x0000050) |
1462 | -#define CSR_HW_REV_TYPE_5150 (0x0000040) |
1463 | -#define CSR_HW_REV_TYPE_1000 (0x0000060) |
1464 | -#define CSR_HW_REV_TYPE_6x00 (0x0000070) |
1465 | -#define CSR_HW_REV_TYPE_6x50 (0x0000080) |
1466 | -#define CSR_HW_REV_TYPE_6150 (0x0000084) |
1467 | -#define CSR_HW_REV_TYPE_6x05 (0x00000B0) |
1468 | -#define CSR_HW_REV_TYPE_6x30 CSR_HW_REV_TYPE_6x05 |
1469 | -#define CSR_HW_REV_TYPE_6x35 CSR_HW_REV_TYPE_6x05 |
1470 | -#define CSR_HW_REV_TYPE_2x30 (0x00000C0) |
1471 | -#define CSR_HW_REV_TYPE_2x00 (0x0000100) |
1472 | -#define CSR_HW_REV_TYPE_105 (0x0000110) |
1473 | -#define CSR_HW_REV_TYPE_135 (0x0000120) |
1474 | -#define CSR_HW_REV_TYPE_NONE (0x00001F0) |
1475 | +#define CSR_HW_REV_TYPE_MSK (0x000FFF0) |
1476 | +#define CSR_HW_REV_TYPE_5300 (0x0000020) |
1477 | +#define CSR_HW_REV_TYPE_5350 (0x0000030) |
1478 | +#define CSR_HW_REV_TYPE_5100 (0x0000050) |
1479 | +#define CSR_HW_REV_TYPE_5150 (0x0000040) |
1480 | +#define CSR_HW_REV_TYPE_1000 (0x0000060) |
1481 | +#define CSR_HW_REV_TYPE_6x00 (0x0000070) |
1482 | +#define CSR_HW_REV_TYPE_6x50 (0x0000080) |
1483 | +#define CSR_HW_REV_TYPE_6150 (0x0000084) |
1484 | +#define CSR_HW_REV_TYPE_6x05 (0x00000B0) |
1485 | +#define CSR_HW_REV_TYPE_6x30 CSR_HW_REV_TYPE_6x05 |
1486 | +#define CSR_HW_REV_TYPE_6x35 CSR_HW_REV_TYPE_6x05 |
1487 | +#define CSR_HW_REV_TYPE_2x30 (0x00000C0) |
1488 | +#define CSR_HW_REV_TYPE_2x00 (0x0000100) |
1489 | +#define CSR_HW_REV_TYPE_105 (0x0000110) |
1490 | +#define CSR_HW_REV_TYPE_135 (0x0000120) |
1491 | +#define CSR_HW_REV_TYPE_7265D (0x0000210) |
1492 | +#define CSR_HW_REV_TYPE_NONE (0x00001F0) |
1493 | |
1494 | /* EEPROM REG */ |
1495 | #define CSR_EEPROM_REG_READ_VALID_MSK (0x00000001) |
1496 | diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c |
1497 | index c17be0fb7283..8da34a5d024f 100644 |
1498 | --- a/drivers/net/wireless/iwlwifi/mvm/d3.c |
1499 | +++ b/drivers/net/wireless/iwlwifi/mvm/d3.c |
1500 | @@ -298,12 +298,12 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw, |
1501 | u8 *pn = seq.ccmp.pn; |
1502 | |
1503 | ieee80211_get_key_rx_seq(key, i, &seq); |
1504 | - aes_sc->pn = cpu_to_le64((u64)pn[5] | |
1505 | - ((u64)pn[4] << 8) | |
1506 | - ((u64)pn[3] << 16) | |
1507 | - ((u64)pn[2] << 24) | |
1508 | - ((u64)pn[1] << 32) | |
1509 | - ((u64)pn[0] << 40)); |
1510 | + aes_sc[i].pn = cpu_to_le64((u64)pn[5] | |
1511 | + ((u64)pn[4] << 8) | |
1512 | + ((u64)pn[3] << 16) | |
1513 | + ((u64)pn[2] << 24) | |
1514 | + ((u64)pn[1] << 32) | |
1515 | + ((u64)pn[0] << 40)); |
1516 | } |
1517 | data->use_rsc_tsc = true; |
1518 | break; |
1519 | diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c |
1520 | index 05cba8c05d3f..a2f624d5771d 100644 |
1521 | --- a/drivers/net/wireless/iwlwifi/pcie/drv.c |
1522 | +++ b/drivers/net/wireless/iwlwifi/pcie/drv.c |
1523 | @@ -410,6 +410,11 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
1524 | {IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)}, |
1525 | {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)}, |
1526 | {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)}, |
1527 | + {IWL_PCI_DEVICE(0x095A, 0x5F10, iwl7265_2ac_cfg)}, |
1528 | + {IWL_PCI_DEVICE(0x095B, 0x5212, iwl7265_2ac_cfg)}, |
1529 | + {IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)}, |
1530 | + {IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)}, |
1531 | + {IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)}, |
1532 | |
1533 | /* 8000 Series */ |
1534 | {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)}, |
1535 | @@ -503,6 +508,7 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) {} |
1536 | static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) |
1537 | { |
1538 | const struct iwl_cfg *cfg = (struct iwl_cfg *)(ent->driver_data); |
1539 | + const struct iwl_cfg *cfg_7265d __maybe_unused = NULL; |
1540 | struct iwl_trans *iwl_trans; |
1541 | struct iwl_trans_pcie *trans_pcie; |
1542 | int ret; |
1543 | @@ -511,6 +517,25 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) |
1544 | if (IS_ERR(iwl_trans)) |
1545 | return PTR_ERR(iwl_trans); |
1546 | |
1547 | +#if IS_ENABLED(CONFIG_IWLMVM) |
1548 | + /* |
1549 | + * special-case 7265D, it has the same PCI IDs. |
1550 | + * |
1551 | + * Note that because we already pass the cfg to the transport above, |
1552 | + * all the parameters that the transport uses must, until that is |
1553 | + * changed, be identical to the ones in the 7265D configuration. |
1554 | + */ |
1555 | + if (cfg == &iwl7265_2ac_cfg) |
1556 | + cfg_7265d = &iwl7265d_2ac_cfg; |
1557 | + else if (cfg == &iwl7265_2n_cfg) |
1558 | + cfg_7265d = &iwl7265d_2n_cfg; |
1559 | + else if (cfg == &iwl7265_n_cfg) |
1560 | + cfg_7265d = &iwl7265d_n_cfg; |
1561 | + if (cfg_7265d && |
1562 | + (iwl_trans->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D) |
1563 | + cfg = cfg_7265d; |
1564 | +#endif |
1565 | + |
1566 | pci_set_drvdata(pdev, iwl_trans); |
1567 | |
1568 | trans_pcie = IWL_TRANS_GET_PCIE_TRANS(iwl_trans); |
1569 | diff --git a/drivers/pci/access.c b/drivers/pci/access.c |
1570 | index 49dd766852ba..7f249b9ab2ce 100644 |
1571 | --- a/drivers/pci/access.c |
1572 | +++ b/drivers/pci/access.c |
1573 | @@ -352,6 +352,56 @@ static const struct pci_vpd_ops pci_vpd_pci22_ops = { |
1574 | .release = pci_vpd_pci22_release, |
1575 | }; |
1576 | |
1577 | +static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count, |
1578 | + void *arg) |
1579 | +{ |
1580 | + struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); |
1581 | + ssize_t ret; |
1582 | + |
1583 | + if (!tdev) |
1584 | + return -ENODEV; |
1585 | + |
1586 | + ret = pci_read_vpd(tdev, pos, count, arg); |
1587 | + pci_dev_put(tdev); |
1588 | + return ret; |
1589 | +} |
1590 | + |
1591 | +static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count, |
1592 | + const void *arg) |
1593 | +{ |
1594 | + struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); |
1595 | + ssize_t ret; |
1596 | + |
1597 | + if (!tdev) |
1598 | + return -ENODEV; |
1599 | + |
1600 | + ret = pci_write_vpd(tdev, pos, count, arg); |
1601 | + pci_dev_put(tdev); |
1602 | + return ret; |
1603 | +} |
1604 | + |
1605 | +static const struct pci_vpd_ops pci_vpd_f0_ops = { |
1606 | + .read = pci_vpd_f0_read, |
1607 | + .write = pci_vpd_f0_write, |
1608 | + .release = pci_vpd_pci22_release, |
1609 | +}; |
1610 | + |
1611 | +static int pci_vpd_f0_dev_check(struct pci_dev *dev) |
1612 | +{ |
1613 | + struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); |
1614 | + int ret = 0; |
1615 | + |
1616 | + if (!tdev) |
1617 | + return -ENODEV; |
1618 | + if (!tdev->vpd || !tdev->multifunction || |
1619 | + dev->class != tdev->class || dev->vendor != tdev->vendor || |
1620 | + dev->device != tdev->device) |
1621 | + ret = -ENODEV; |
1622 | + |
1623 | + pci_dev_put(tdev); |
1624 | + return ret; |
1625 | +} |
1626 | + |
1627 | int pci_vpd_pci22_init(struct pci_dev *dev) |
1628 | { |
1629 | struct pci_vpd_pci22 *vpd; |
1630 | @@ -360,12 +410,21 @@ int pci_vpd_pci22_init(struct pci_dev *dev) |
1631 | cap = pci_find_capability(dev, PCI_CAP_ID_VPD); |
1632 | if (!cap) |
1633 | return -ENODEV; |
1634 | + if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) { |
1635 | + int ret = pci_vpd_f0_dev_check(dev); |
1636 | + |
1637 | + if (ret) |
1638 | + return ret; |
1639 | + } |
1640 | vpd = kzalloc(sizeof(*vpd), GFP_ATOMIC); |
1641 | if (!vpd) |
1642 | return -ENOMEM; |
1643 | |
1644 | vpd->base.len = PCI_VPD_PCI22_SIZE; |
1645 | - vpd->base.ops = &pci_vpd_pci22_ops; |
1646 | + if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) |
1647 | + vpd->base.ops = &pci_vpd_f0_ops; |
1648 | + else |
1649 | + vpd->base.ops = &pci_vpd_pci22_ops; |
1650 | mutex_init(&vpd->lock); |
1651 | vpd->cap = cap; |
1652 | vpd->busy = false; |
1653 | diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c |
1654 | index ff7af33f2353..ce0aa47222f6 100644 |
1655 | --- a/drivers/pci/pci.c |
1656 | +++ b/drivers/pci/pci.c |
1657 | @@ -3206,7 +3206,7 @@ static int pci_pm_reset(struct pci_dev *dev, int probe) |
1658 | { |
1659 | u16 csr; |
1660 | |
1661 | - if (!dev->pm_cap) |
1662 | + if (!dev->pm_cap || dev->dev_flags & PCI_DEV_FLAGS_NO_PM_RESET) |
1663 | return -ENOTTY; |
1664 | |
1665 | pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &csr); |
1666 | diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c |
1667 | index 00b1cd32a4b1..b6d646a97494 100644 |
1668 | --- a/drivers/pci/quirks.c |
1669 | +++ b/drivers/pci/quirks.c |
1670 | @@ -1883,6 +1883,15 @@ static void quirk_netmos(struct pci_dev *dev) |
1671 | DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID, |
1672 | PCI_CLASS_COMMUNICATION_SERIAL, 8, quirk_netmos); |
1673 | |
1674 | +static void quirk_f0_vpd_link(struct pci_dev *dev) |
1675 | +{ |
1676 | + if (!dev->multifunction || !PCI_FUNC(dev->devfn)) |
1677 | + return; |
1678 | + dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0; |
1679 | +} |
1680 | +DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, |
1681 | + PCI_CLASS_NETWORK_ETHERNET, 8, quirk_f0_vpd_link); |
1682 | + |
1683 | static void quirk_e100_interrupt(struct pci_dev *dev) |
1684 | { |
1685 | u16 command, pmcsr; |
1686 | diff --git a/drivers/power/bq24190_charger.c b/drivers/power/bq24190_charger.c |
1687 | index e4c95e1a6733..d0e8236a6404 100644 |
1688 | --- a/drivers/power/bq24190_charger.c |
1689 | +++ b/drivers/power/bq24190_charger.c |
1690 | @@ -1208,7 +1208,7 @@ static irqreturn_t bq24190_irq_handler_thread(int irq, void *data) |
1691 | { |
1692 | struct bq24190_dev_info *bdi = data; |
1693 | bool alert_userspace = false; |
1694 | - u8 ss_reg, f_reg; |
1695 | + u8 ss_reg = 0, f_reg = 0; |
1696 | int ret; |
1697 | |
1698 | pm_runtime_get_sync(bdi->dev); |
1699 | diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c |
1700 | index 75ffe9980c3e..7c511add5aa7 100644 |
1701 | --- a/drivers/s390/char/con3270.c |
1702 | +++ b/drivers/s390/char/con3270.c |
1703 | @@ -413,6 +413,10 @@ con3270_irq(struct con3270 *cp, struct raw3270_request *rq, struct irb *irb) |
1704 | else |
1705 | /* Normal end. Copy residual count. */ |
1706 | rq->rescnt = irb->scsw.cmd.count; |
1707 | + } else if (irb->scsw.cmd.dstat & DEV_STAT_DEV_END) { |
1708 | + /* Interrupt without an outstanding request -> update all */ |
1709 | + cp->update_flags = CON_UPDATE_ALL; |
1710 | + con3270_set_timer(cp, 1); |
1711 | } |
1712 | return RAW3270_IO_DONE; |
1713 | } |
1714 | diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c |
1715 | index e91b89dc6d1f..e96fc7fd9498 100644 |
1716 | --- a/drivers/s390/char/tty3270.c |
1717 | +++ b/drivers/s390/char/tty3270.c |
1718 | @@ -659,6 +659,10 @@ tty3270_irq(struct tty3270 *tp, struct raw3270_request *rq, struct irb *irb) |
1719 | else |
1720 | /* Normal end. Copy residual count. */ |
1721 | rq->rescnt = irb->scsw.cmd.count; |
1722 | + } else if (irb->scsw.cmd.dstat & DEV_STAT_DEV_END) { |
1723 | + /* Interrupt without an outstanding request -> update all */ |
1724 | + tp->update_flags = TTY_UPDATE_ALL; |
1725 | + tty3270_set_timer(tp, 1); |
1726 | } |
1727 | return RAW3270_IO_DONE; |
1728 | } |
1729 | diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c |
1730 | index 0eb2da8a696f..89215d44d83f 100644 |
1731 | --- a/drivers/scsi/mvsas/mv_sas.c |
1732 | +++ b/drivers/scsi/mvsas/mv_sas.c |
1733 | @@ -988,6 +988,8 @@ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc) |
1734 | static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, |
1735 | struct mvs_slot_info *slot, u32 slot_idx) |
1736 | { |
1737 | + if (!slot) |
1738 | + return; |
1739 | if (!slot->task) |
1740 | return; |
1741 | if (!sas_protocol_ata(task->task_proto)) |
1742 | diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c |
1743 | index ffd42071a12e..6050c58db682 100644 |
1744 | --- a/drivers/staging/iio/adc/mxs-lradc.c |
1745 | +++ b/drivers/staging/iio/adc/mxs-lradc.c |
1746 | @@ -910,11 +910,12 @@ static int mxs_lradc_read_raw(struct iio_dev *iio_dev, |
1747 | case IIO_CHAN_INFO_OFFSET: |
1748 | if (chan->type == IIO_TEMP) { |
1749 | /* The calculated value from the ADC is in Kelvin, we |
1750 | - * want Celsius for hwmon so the offset is |
1751 | - * -272.15 * scale |
1752 | + * want Celsius for hwmon so the offset is -273.15 |
1753 | + * The offset is applied before scaling so it is |
1754 | + * actually -213.15 * 4 / 1.012 = -1079.644268 |
1755 | */ |
1756 | - *val = -1075; |
1757 | - *val2 = 691699; |
1758 | + *val = -1079; |
1759 | + *val2 = 644268; |
1760 | |
1761 | return IIO_VAL_INT_PLUS_MICRO; |
1762 | } |
1763 | diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c |
1764 | index 439bd1a5d00c..422773242917 100644 |
1765 | --- a/drivers/tty/serial/8250/8250_pci.c |
1766 | +++ b/drivers/tty/serial/8250/8250_pci.c |
1767 | @@ -1815,6 +1815,9 @@ pci_wch_ch353_setup(struct serial_private *priv, |
1768 | #define PCI_DEVICE_ID_SUNIX_1999 0x1999 |
1769 | |
1770 | |
1771 | +#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 |
1772 | +#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 |
1773 | + |
1774 | /* Unknown vendors/cards - this should not be in linux/pci_ids.h */ |
1775 | #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584 |
1776 | #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588 |
1777 | @@ -2323,6 +2326,20 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = { |
1778 | .subdevice = PCI_ANY_ID, |
1779 | .setup = pci_xr17v35x_setup, |
1780 | }, |
1781 | + { |
1782 | + .vendor = PCI_VENDOR_ID_EXAR, |
1783 | + .device = PCI_DEVICE_ID_EXAR_XR17V4358, |
1784 | + .subvendor = PCI_ANY_ID, |
1785 | + .subdevice = PCI_ANY_ID, |
1786 | + .setup = pci_xr17v35x_setup, |
1787 | + }, |
1788 | + { |
1789 | + .vendor = PCI_VENDOR_ID_EXAR, |
1790 | + .device = PCI_DEVICE_ID_EXAR_XR17V8358, |
1791 | + .subvendor = PCI_ANY_ID, |
1792 | + .subdevice = PCI_ANY_ID, |
1793 | + .setup = pci_xr17v35x_setup, |
1794 | + }, |
1795 | /* |
1796 | * Xircom cards |
1797 | */ |
1798 | @@ -2771,6 +2788,8 @@ enum pci_board_num_t { |
1799 | pbn_exar_XR17V352, |
1800 | pbn_exar_XR17V354, |
1801 | pbn_exar_XR17V358, |
1802 | + pbn_exar_XR17V4358, |
1803 | + pbn_exar_XR17V8358, |
1804 | pbn_exar_ibm_saturn, |
1805 | pbn_pasemi_1682M, |
1806 | pbn_ni8430_2, |
1807 | @@ -3440,6 +3459,22 @@ static struct pciserial_board pci_boards[] = { |
1808 | .reg_shift = 0, |
1809 | .first_offset = 0, |
1810 | }, |
1811 | + [pbn_exar_XR17V4358] = { |
1812 | + .flags = FL_BASE0, |
1813 | + .num_ports = 12, |
1814 | + .base_baud = 7812500, |
1815 | + .uart_offset = 0x400, |
1816 | + .reg_shift = 0, |
1817 | + .first_offset = 0, |
1818 | + }, |
1819 | + [pbn_exar_XR17V8358] = { |
1820 | + .flags = FL_BASE0, |
1821 | + .num_ports = 16, |
1822 | + .base_baud = 7812500, |
1823 | + .uart_offset = 0x400, |
1824 | + .reg_shift = 0, |
1825 | + .first_offset = 0, |
1826 | + }, |
1827 | [pbn_exar_ibm_saturn] = { |
1828 | .flags = FL_BASE0, |
1829 | .num_ports = 1, |
1830 | @@ -4808,7 +4843,7 @@ static struct pci_device_id serial_pci_tbl[] = { |
1831 | 0, |
1832 | 0, pbn_exar_XR17C158 }, |
1833 | /* |
1834 | - * Exar Corp. XR17V35[248] Dual/Quad/Octal PCIe UARTs |
1835 | + * Exar Corp. XR17V[48]35[248] Dual/Quad/Octal/Hexa PCIe UARTs |
1836 | */ |
1837 | { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V352, |
1838 | PCI_ANY_ID, PCI_ANY_ID, |
1839 | @@ -4822,7 +4857,14 @@ static struct pci_device_id serial_pci_tbl[] = { |
1840 | PCI_ANY_ID, PCI_ANY_ID, |
1841 | 0, |
1842 | 0, pbn_exar_XR17V358 }, |
1843 | - |
1844 | + { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V4358, |
1845 | + PCI_ANY_ID, PCI_ANY_ID, |
1846 | + 0, |
1847 | + 0, pbn_exar_XR17V4358 }, |
1848 | + { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V8358, |
1849 | + PCI_ANY_ID, PCI_ANY_ID, |
1850 | + 0, |
1851 | + 0, pbn_exar_XR17V8358 }, |
1852 | /* |
1853 | * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke) |
1854 | */ |
1855 | diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c |
1856 | index 795d6538d630..4188cacaf100 100644 |
1857 | --- a/drivers/usb/chipidea/debug.c |
1858 | +++ b/drivers/usb/chipidea/debug.c |
1859 | @@ -66,9 +66,11 @@ static int ci_port_test_show(struct seq_file *s, void *data) |
1860 | unsigned long flags; |
1861 | unsigned mode; |
1862 | |
1863 | + pm_runtime_get_sync(ci->dev); |
1864 | spin_lock_irqsave(&ci->lock, flags); |
1865 | mode = hw_port_test_get(ci); |
1866 | spin_unlock_irqrestore(&ci->lock, flags); |
1867 | + pm_runtime_put_sync(ci->dev); |
1868 | |
1869 | seq_printf(s, "mode = %u\n", mode); |
1870 | |
1871 | @@ -94,9 +96,11 @@ static ssize_t ci_port_test_write(struct file *file, const char __user *ubuf, |
1872 | if (sscanf(buf, "%u", &mode) != 1) |
1873 | return -EINVAL; |
1874 | |
1875 | + pm_runtime_get_sync(ci->dev); |
1876 | spin_lock_irqsave(&ci->lock, flags); |
1877 | ret = hw_port_test_set(ci, mode); |
1878 | spin_unlock_irqrestore(&ci->lock, flags); |
1879 | + pm_runtime_put_sync(ci->dev); |
1880 | |
1881 | return ret ? ret : count; |
1882 | } |
1883 | @@ -312,8 +316,10 @@ static ssize_t ci_role_write(struct file *file, const char __user *ubuf, |
1884 | if (role == CI_ROLE_END || role == ci->role) |
1885 | return -EINVAL; |
1886 | |
1887 | + pm_runtime_get_sync(ci->dev); |
1888 | ci_role_stop(ci); |
1889 | ret = ci_role_start(ci, role); |
1890 | + pm_runtime_put_sync(ci->dev); |
1891 | |
1892 | return ret ? ret : count; |
1893 | } |
1894 | diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c |
1895 | index ec978408a2ee..49978cc495e9 100644 |
1896 | --- a/drivers/usb/class/usbtmc.c |
1897 | +++ b/drivers/usb/class/usbtmc.c |
1898 | @@ -109,6 +109,7 @@ struct usbtmc_ID_rigol_quirk { |
1899 | |
1900 | static const struct usbtmc_ID_rigol_quirk usbtmc_id_quirk[] = { |
1901 | { 0x1ab1, 0x0588 }, |
1902 | + { 0x1ab1, 0x04b0 }, |
1903 | { 0, 0 } |
1904 | }; |
1905 | |
1906 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c |
1907 | index 2af32e26fafc..7e5c90eebb9c 100644 |
1908 | --- a/drivers/usb/host/xhci-pci.c |
1909 | +++ b/drivers/usb/host/xhci-pci.c |
1910 | @@ -135,6 +135,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
1911 | if (pdev->vendor == PCI_VENDOR_ID_INTEL && |
1912 | pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) { |
1913 | xhci->quirks |= XHCI_SPURIOUS_REBOOT; |
1914 | + xhci->quirks |= XHCI_SPURIOUS_WAKEUP; |
1915 | } |
1916 | if (pdev->vendor == PCI_VENDOR_ID_INTEL && |
1917 | (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || |
1918 | diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c |
1919 | index 136259bc93b8..1e5fb8cfc9e3 100644 |
1920 | --- a/drivers/usb/host/xhci-ring.c |
1921 | +++ b/drivers/usb/host/xhci-ring.c |
1922 | @@ -2238,6 +2238,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, |
1923 | u32 trb_comp_code; |
1924 | int ret = 0; |
1925 | int td_num = 0; |
1926 | + bool handling_skipped_tds = false; |
1927 | |
1928 | slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags)); |
1929 | xdev = xhci->devs[slot_id]; |
1930 | @@ -2371,6 +2372,10 @@ static int handle_tx_event(struct xhci_hcd *xhci, |
1931 | ep->skip = true; |
1932 | xhci_dbg(xhci, "Miss service interval error, set skip flag\n"); |
1933 | goto cleanup; |
1934 | + case COMP_PING_ERR: |
1935 | + ep->skip = true; |
1936 | + xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n"); |
1937 | + goto cleanup; |
1938 | default: |
1939 | if (xhci_is_vendor_info_code(xhci, trb_comp_code)) { |
1940 | status = 0; |
1941 | @@ -2507,13 +2512,18 @@ static int handle_tx_event(struct xhci_hcd *xhci, |
1942 | ep, &status); |
1943 | |
1944 | cleanup: |
1945 | + |
1946 | + |
1947 | + handling_skipped_tds = ep->skip && |
1948 | + trb_comp_code != COMP_MISSED_INT && |
1949 | + trb_comp_code != COMP_PING_ERR; |
1950 | + |
1951 | /* |
1952 | - * Do not update event ring dequeue pointer if ep->skip is set. |
1953 | - * Will roll back to continue process missed tds. |
1954 | + * Do not update event ring dequeue pointer if we're in a loop |
1955 | + * processing missed tds. |
1956 | */ |
1957 | - if (trb_comp_code == COMP_MISSED_INT || !ep->skip) { |
1958 | + if (!handling_skipped_tds) |
1959 | inc_deq(xhci, xhci->event_ring); |
1960 | - } |
1961 | |
1962 | if (ret) { |
1963 | urb = td->urb; |
1964 | @@ -2548,7 +2558,7 @@ cleanup: |
1965 | * Process them as short transfer until reach the td pointed by |
1966 | * the event. |
1967 | */ |
1968 | - } while (ep->skip && trb_comp_code != COMP_MISSED_INT); |
1969 | + } while (handling_skipped_tds); |
1970 | |
1971 | return 0; |
1972 | } |
1973 | diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c |
1974 | index d59b232614d5..8dfd86771fac 100644 |
1975 | --- a/drivers/usb/musb/musb_cppi41.c |
1976 | +++ b/drivers/usb/musb/musb_cppi41.c |
1977 | @@ -541,10 +541,18 @@ static int cppi41_dma_channel_abort(struct dma_channel *channel) |
1978 | csr &= ~MUSB_TXCSR_DMAENAB; |
1979 | musb_writew(epio, MUSB_TXCSR, csr); |
1980 | } else { |
1981 | + cppi41_set_autoreq_mode(cppi41_channel, EP_MODE_AUTOREQ_NONE); |
1982 | + |
1983 | + /* delay to drain to cppi dma pipeline for isoch */ |
1984 | + udelay(250); |
1985 | + |
1986 | csr = musb_readw(epio, MUSB_RXCSR); |
1987 | csr &= ~(MUSB_RXCSR_H_REQPKT | MUSB_RXCSR_DMAENAB); |
1988 | musb_writew(epio, MUSB_RXCSR, csr); |
1989 | |
1990 | + /* wait to drain cppi dma pipe line */ |
1991 | + udelay(50); |
1992 | + |
1993 | csr = musb_readw(epio, MUSB_RXCSR); |
1994 | if (csr & MUSB_RXCSR_RXPKTRDY) { |
1995 | csr |= MUSB_RXCSR_FLUSHFIFO; |
1996 | @@ -558,13 +566,14 @@ static int cppi41_dma_channel_abort(struct dma_channel *channel) |
1997 | tdbit <<= 16; |
1998 | |
1999 | do { |
2000 | - musb_writel(musb->ctrl_base, USB_TDOWN, tdbit); |
2001 | + if (is_tx) |
2002 | + musb_writel(musb->ctrl_base, USB_TDOWN, tdbit); |
2003 | ret = dmaengine_terminate_all(cppi41_channel->dc); |
2004 | } while (ret == -EAGAIN); |
2005 | |
2006 | - musb_writel(musb->ctrl_base, USB_TDOWN, tdbit); |
2007 | - |
2008 | if (is_tx) { |
2009 | + musb_writel(musb->ctrl_base, USB_TDOWN, tdbit); |
2010 | + |
2011 | csr = musb_readw(epio, MUSB_TXCSR); |
2012 | if (csr & MUSB_TXCSR_TXPKTRDY) { |
2013 | csr |= MUSB_TXCSR_FLUSHFIFO; |
2014 | diff --git a/drivers/usb/serial/symbolserial.c b/drivers/usb/serial/symbolserial.c |
2015 | index 6ed804450a5a..37f3ad15ed06 100644 |
2016 | --- a/drivers/usb/serial/symbolserial.c |
2017 | +++ b/drivers/usb/serial/symbolserial.c |
2018 | @@ -60,17 +60,15 @@ static void symbol_int_callback(struct urb *urb) |
2019 | |
2020 | usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data); |
2021 | |
2022 | + /* |
2023 | + * Data from the device comes with a 1 byte header: |
2024 | + * |
2025 | + * <size of data> <data>... |
2026 | + */ |
2027 | if (urb->actual_length > 1) { |
2028 | - data_length = urb->actual_length - 1; |
2029 | - |
2030 | - /* |
2031 | - * Data from the device comes with a 1 byte header: |
2032 | - * |
2033 | - * <size of data>data... |
2034 | - * This is real data to be sent to the tty layer |
2035 | - * we pretty much just ignore the size and send everything |
2036 | - * else to the tty layer. |
2037 | - */ |
2038 | + data_length = data[0]; |
2039 | + if (data_length > (urb->actual_length - 1)) |
2040 | + data_length = urb->actual_length - 1; |
2041 | tty_insert_flip_string(&port->port, &data[1], data_length); |
2042 | tty_flip_buffer_push(&port->port); |
2043 | } else { |
2044 | diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c |
2045 | index cb84f69f76ad..313f09a73624 100644 |
2046 | --- a/drivers/vhost/scsi.c |
2047 | +++ b/drivers/vhost/scsi.c |
2048 | @@ -1251,7 +1251,7 @@ tcm_vhost_send_evt(struct vhost_scsi *vs, |
2049 | * lun[4-7] need to be zero according to virtio-scsi spec. |
2050 | */ |
2051 | evt->event.lun[0] = 0x01; |
2052 | - evt->event.lun[1] = tpg->tport_tpgt & 0xFF; |
2053 | + evt->event.lun[1] = tpg->tport_tpgt; |
2054 | if (lun->unpacked_lun >= 256) |
2055 | evt->event.lun[2] = lun->unpacked_lun >> 8 | 0x40 ; |
2056 | evt->event.lun[3] = lun->unpacked_lun & 0xFF; |
2057 | @@ -2122,12 +2122,12 @@ tcm_vhost_make_tpg(struct se_wwn *wwn, |
2058 | struct tcm_vhost_tport, tport_wwn); |
2059 | |
2060 | struct tcm_vhost_tpg *tpg; |
2061 | - unsigned long tpgt; |
2062 | + u16 tpgt; |
2063 | int ret; |
2064 | |
2065 | if (strstr(name, "tpgt_") != name) |
2066 | return ERR_PTR(-EINVAL); |
2067 | - if (kstrtoul(name + 5, 10, &tpgt) || tpgt > UINT_MAX) |
2068 | + if (kstrtou16(name + 5, 10, &tpgt) || tpgt >= VHOST_SCSI_MAX_TARGET) |
2069 | return ERR_PTR(-EINVAL); |
2070 | |
2071 | tpg = kzalloc(sizeof(struct tcm_vhost_tpg), GFP_KERNEL); |
2072 | diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c |
2073 | index 2d3e32ebfd15..cfd1e6f6ac64 100644 |
2074 | --- a/fs/btrfs/backref.c |
2075 | +++ b/fs/btrfs/backref.c |
2076 | @@ -1778,7 +1778,6 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, |
2077 | int found = 0; |
2078 | struct extent_buffer *eb; |
2079 | struct btrfs_inode_extref *extref; |
2080 | - struct extent_buffer *leaf; |
2081 | u32 item_size; |
2082 | u32 cur_offset; |
2083 | unsigned long ptr; |
2084 | @@ -1806,9 +1805,8 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, |
2085 | btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK); |
2086 | btrfs_release_path(path); |
2087 | |
2088 | - leaf = path->nodes[0]; |
2089 | - item_size = btrfs_item_size_nr(leaf, slot); |
2090 | - ptr = btrfs_item_ptr_offset(leaf, slot); |
2091 | + item_size = btrfs_item_size_nr(eb, slot); |
2092 | + ptr = btrfs_item_ptr_offset(eb, slot); |
2093 | cur_offset = 0; |
2094 | |
2095 | while (cur_offset < item_size) { |
2096 | @@ -1822,7 +1820,7 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, |
2097 | if (ret) |
2098 | break; |
2099 | |
2100 | - cur_offset += btrfs_inode_extref_name_len(leaf, extref); |
2101 | + cur_offset += btrfs_inode_extref_name_len(eb, extref); |
2102 | cur_offset += sizeof(*extref); |
2103 | } |
2104 | btrfs_tree_read_unlock_blocking(eb); |
2105 | diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c |
2106 | index 61d00a6e398f..4ae04561be88 100644 |
2107 | --- a/fs/cifs/cifssmb.c |
2108 | +++ b/fs/cifs/cifssmb.c |
2109 | @@ -625,9 +625,8 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses) |
2110 | server->negflavor = CIFS_NEGFLAVOR_UNENCAP; |
2111 | memcpy(ses->server->cryptkey, pSMBr->u.EncryptionKey, |
2112 | CIFS_CRYPTO_KEY_SIZE); |
2113 | - } else if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC || |
2114 | - server->capabilities & CAP_EXTENDED_SECURITY) && |
2115 | - (pSMBr->EncryptionKeyLength == 0)) { |
2116 | + } else if (pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC || |
2117 | + server->capabilities & CAP_EXTENDED_SECURITY) { |
2118 | server->negflavor = CIFS_NEGFLAVOR_EXTENDED; |
2119 | rc = decode_ext_sec_blob(ses, pSMBr); |
2120 | } else if (server->sec_mode & SECMODE_PW_ENCRYPT) { |
2121 | diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c |
2122 | index b5fcb1ac0dd7..b95c32096a68 100644 |
2123 | --- a/fs/ext4/extents.c |
2124 | +++ b/fs/ext4/extents.c |
2125 | @@ -4792,12 +4792,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, |
2126 | else |
2127 | max_blocks -= lblk; |
2128 | |
2129 | - flags = EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT | |
2130 | - EXT4_GET_BLOCKS_CONVERT_UNWRITTEN | |
2131 | - EXT4_EX_NOCACHE; |
2132 | - if (mode & FALLOC_FL_KEEP_SIZE) |
2133 | - flags |= EXT4_GET_BLOCKS_KEEP_SIZE; |
2134 | - |
2135 | mutex_lock(&inode->i_mutex); |
2136 | |
2137 | /* |
2138 | @@ -4814,15 +4808,28 @@ static long ext4_zero_range(struct file *file, loff_t offset, |
2139 | ret = inode_newsize_ok(inode, new_size); |
2140 | if (ret) |
2141 | goto out_mutex; |
2142 | - /* |
2143 | - * If we have a partial block after EOF we have to allocate |
2144 | - * the entire block. |
2145 | - */ |
2146 | - if (partial_end) |
2147 | - max_blocks += 1; |
2148 | } |
2149 | |
2150 | + flags = EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT; |
2151 | + if (mode & FALLOC_FL_KEEP_SIZE) |
2152 | + flags |= EXT4_GET_BLOCKS_KEEP_SIZE; |
2153 | + |
2154 | + /* Preallocate the range including the unaligned edges */ |
2155 | + if (partial_begin || partial_end) { |
2156 | + ret = ext4_alloc_file_blocks(file, |
2157 | + round_down(offset, 1 << blkbits) >> blkbits, |
2158 | + (round_up((offset + len), 1 << blkbits) - |
2159 | + round_down(offset, 1 << blkbits)) >> blkbits, |
2160 | + new_size, flags, mode); |
2161 | + if (ret) |
2162 | + goto out_mutex; |
2163 | + |
2164 | + } |
2165 | + |
2166 | + /* Zero range excluding the unaligned edges */ |
2167 | if (max_blocks > 0) { |
2168 | + flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN | |
2169 | + EXT4_EX_NOCACHE); |
2170 | |
2171 | /* Now release the pages and zero block aligned part of pages*/ |
2172 | truncate_pagecache_range(inode, start, end - 1); |
2173 | @@ -4836,19 +4843,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, |
2174 | flags, mode); |
2175 | if (ret) |
2176 | goto out_dio; |
2177 | - /* |
2178 | - * Remove entire range from the extent status tree. |
2179 | - * |
2180 | - * ext4_es_remove_extent(inode, lblk, max_blocks) is |
2181 | - * NOT sufficient. I'm not sure why this is the case, |
2182 | - * but let's be conservative and remove the extent |
2183 | - * status tree for the entire inode. There should be |
2184 | - * no outstanding delalloc extents thanks to the |
2185 | - * filemap_write_and_wait_range() call above. |
2186 | - */ |
2187 | - ret = ext4_es_remove_extent(inode, 0, EXT_MAX_BLOCKS); |
2188 | - if (ret) |
2189 | - goto out_dio; |
2190 | } |
2191 | if (!partial_begin && !partial_end) |
2192 | goto out_dio; |
2193 | diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c |
2194 | index 4227dc4f7437..8c44654ce274 100644 |
2195 | --- a/fs/jbd2/checkpoint.c |
2196 | +++ b/fs/jbd2/checkpoint.c |
2197 | @@ -417,12 +417,12 @@ int jbd2_cleanup_journal_tail(journal_t *journal) |
2198 | * journal_clean_one_cp_list |
2199 | * |
2200 | * Find all the written-back checkpoint buffers in the given list and |
2201 | - * release them. |
2202 | + * release them. If 'destroy' is set, clean all buffers unconditionally. |
2203 | * |
2204 | * Called with j_list_lock held. |
2205 | * Returns 1 if we freed the transaction, 0 otherwise. |
2206 | */ |
2207 | -static int journal_clean_one_cp_list(struct journal_head *jh) |
2208 | +static int journal_clean_one_cp_list(struct journal_head *jh, bool destroy) |
2209 | { |
2210 | struct journal_head *last_jh; |
2211 | struct journal_head *next_jh = jh; |
2212 | @@ -436,7 +436,10 @@ static int journal_clean_one_cp_list(struct journal_head *jh) |
2213 | do { |
2214 | jh = next_jh; |
2215 | next_jh = jh->b_cpnext; |
2216 | - ret = __try_to_free_cp_buf(jh); |
2217 | + if (!destroy) |
2218 | + ret = __try_to_free_cp_buf(jh); |
2219 | + else |
2220 | + ret = __jbd2_journal_remove_checkpoint(jh) + 1; |
2221 | if (!ret) |
2222 | return freed; |
2223 | if (ret == 2) |
2224 | @@ -459,10 +462,11 @@ static int journal_clean_one_cp_list(struct journal_head *jh) |
2225 | * journal_clean_checkpoint_list |
2226 | * |
2227 | * Find all the written-back checkpoint buffers in the journal and release them. |
2228 | + * If 'destroy' is set, release all buffers unconditionally. |
2229 | * |
2230 | * Called with j_list_lock held. |
2231 | */ |
2232 | -void __jbd2_journal_clean_checkpoint_list(journal_t *journal) |
2233 | +void __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy) |
2234 | { |
2235 | transaction_t *transaction, *last_transaction, *next_transaction; |
2236 | int ret; |
2237 | @@ -476,7 +480,8 @@ void __jbd2_journal_clean_checkpoint_list(journal_t *journal) |
2238 | do { |
2239 | transaction = next_transaction; |
2240 | next_transaction = transaction->t_cpnext; |
2241 | - ret = journal_clean_one_cp_list(transaction->t_checkpoint_list); |
2242 | + ret = journal_clean_one_cp_list(transaction->t_checkpoint_list, |
2243 | + destroy); |
2244 | /* |
2245 | * This function only frees up some memory if possible so we |
2246 | * dont have an obligation to finish processing. Bail out if |
2247 | @@ -492,7 +497,7 @@ void __jbd2_journal_clean_checkpoint_list(journal_t *journal) |
2248 | * we can possibly see not yet submitted buffers on io_list |
2249 | */ |
2250 | ret = journal_clean_one_cp_list(transaction-> |
2251 | - t_checkpoint_io_list); |
2252 | + t_checkpoint_io_list, destroy); |
2253 | if (need_resched()) |
2254 | return; |
2255 | /* |
2256 | @@ -506,6 +511,28 @@ void __jbd2_journal_clean_checkpoint_list(journal_t *journal) |
2257 | } |
2258 | |
2259 | /* |
2260 | + * Remove buffers from all checkpoint lists as journal is aborted and we just |
2261 | + * need to free memory |
2262 | + */ |
2263 | +void jbd2_journal_destroy_checkpoint(journal_t *journal) |
2264 | +{ |
2265 | + /* |
2266 | + * We loop because __jbd2_journal_clean_checkpoint_list() may abort |
2267 | + * early due to a need of rescheduling. |
2268 | + */ |
2269 | + while (1) { |
2270 | + spin_lock(&journal->j_list_lock); |
2271 | + if (!journal->j_checkpoint_transactions) { |
2272 | + spin_unlock(&journal->j_list_lock); |
2273 | + break; |
2274 | + } |
2275 | + __jbd2_journal_clean_checkpoint_list(journal, true); |
2276 | + spin_unlock(&journal->j_list_lock); |
2277 | + cond_resched(); |
2278 | + } |
2279 | +} |
2280 | + |
2281 | +/* |
2282 | * journal_remove_checkpoint: called after a buffer has been committed |
2283 | * to disk (either by being write-back flushed to disk, or being |
2284 | * committed to the log). |
2285 | diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c |
2286 | index b73e0215baa7..362e5f614450 100644 |
2287 | --- a/fs/jbd2/commit.c |
2288 | +++ b/fs/jbd2/commit.c |
2289 | @@ -510,7 +510,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) |
2290 | * frees some memory |
2291 | */ |
2292 | spin_lock(&journal->j_list_lock); |
2293 | - __jbd2_journal_clean_checkpoint_list(journal); |
2294 | + __jbd2_journal_clean_checkpoint_list(journal, false); |
2295 | spin_unlock(&journal->j_list_lock); |
2296 | |
2297 | jbd_debug(3, "JBD2: commit phase 1\n"); |
2298 | diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c |
2299 | index be6f7178d23a..2540324f084b 100644 |
2300 | --- a/fs/jbd2/journal.c |
2301 | +++ b/fs/jbd2/journal.c |
2302 | @@ -1708,8 +1708,17 @@ int jbd2_journal_destroy(journal_t *journal) |
2303 | while (journal->j_checkpoint_transactions != NULL) { |
2304 | spin_unlock(&journal->j_list_lock); |
2305 | mutex_lock(&journal->j_checkpoint_mutex); |
2306 | - jbd2_log_do_checkpoint(journal); |
2307 | + err = jbd2_log_do_checkpoint(journal); |
2308 | mutex_unlock(&journal->j_checkpoint_mutex); |
2309 | + /* |
2310 | + * If checkpointing failed, just free the buffers to avoid |
2311 | + * looping forever |
2312 | + */ |
2313 | + if (err) { |
2314 | + jbd2_journal_destroy_checkpoint(journal); |
2315 | + spin_lock(&journal->j_list_lock); |
2316 | + break; |
2317 | + } |
2318 | spin_lock(&journal->j_list_lock); |
2319 | } |
2320 | |
2321 | diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h |
2322 | index ff560537dd61..2725b03b4ae2 100644 |
2323 | --- a/include/linux/ipv6.h |
2324 | +++ b/include/linux/ipv6.h |
2325 | @@ -212,7 +212,7 @@ struct ipv6_pinfo { |
2326 | struct ipv6_ac_socklist *ipv6_ac_list; |
2327 | struct ipv6_fl_socklist __rcu *ipv6_fl_list; |
2328 | |
2329 | - struct ipv6_txoptions *opt; |
2330 | + struct ipv6_txoptions __rcu *opt; |
2331 | struct sk_buff *pktoptions; |
2332 | struct sk_buff *rxpmtu; |
2333 | struct { |
2334 | diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h |
2335 | index dadb42109dec..4caf8acfef11 100644 |
2336 | --- a/include/linux/jbd2.h |
2337 | +++ b/include/linux/jbd2.h |
2338 | @@ -1042,8 +1042,9 @@ void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); |
2339 | extern void jbd2_journal_commit_transaction(journal_t *); |
2340 | |
2341 | /* Checkpoint list management */ |
2342 | -void __jbd2_journal_clean_checkpoint_list(journal_t *journal); |
2343 | +void __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy); |
2344 | int __jbd2_journal_remove_checkpoint(struct journal_head *); |
2345 | +void jbd2_journal_destroy_checkpoint(journal_t *journal); |
2346 | void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *); |
2347 | |
2348 | |
2349 | diff --git a/include/linux/pci.h b/include/linux/pci.h |
2350 | index e92cdad3240d..7a3484490867 100644 |
2351 | --- a/include/linux/pci.h |
2352 | +++ b/include/linux/pci.h |
2353 | @@ -177,6 +177,10 @@ enum pci_dev_flags { |
2354 | PCI_DEV_FLAG_PCIE_BRIDGE_ALIAS = (__force pci_dev_flags_t) (1 << 5), |
2355 | /* Do not use bus resets for device */ |
2356 | PCI_DEV_FLAGS_NO_BUS_RESET = (__force pci_dev_flags_t) (1 << 6), |
2357 | + /* Do not use PM reset even if device advertises NoSoftRst- */ |
2358 | + PCI_DEV_FLAGS_NO_PM_RESET = (__force pci_dev_flags_t) (1 << 7), |
2359 | + /* Get VPD from function 0 VPD */ |
2360 | + PCI_DEV_FLAGS_VPD_REF_F0 = (__force pci_dev_flags_t) (1 << 8), |
2361 | }; |
2362 | |
2363 | enum pci_irq_reroute_variant { |
2364 | diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h |
2365 | index 522d83731709..3b57c6712495 100644 |
2366 | --- a/include/linux/skbuff.h |
2367 | +++ b/include/linux/skbuff.h |
2368 | @@ -2549,6 +2549,9 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb, |
2369 | { |
2370 | if (skb->ip_summed == CHECKSUM_COMPLETE) |
2371 | skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); |
2372 | + else if (skb->ip_summed == CHECKSUM_PARTIAL && |
2373 | + skb_checksum_start_offset(skb) < 0) |
2374 | + skb->ip_summed = CHECKSUM_NONE; |
2375 | } |
2376 | |
2377 | unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len); |
2378 | diff --git a/include/net/af_unix.h b/include/net/af_unix.h |
2379 | index a175ba4a7adb..dfe4ddfbb43c 100644 |
2380 | --- a/include/net/af_unix.h |
2381 | +++ b/include/net/af_unix.h |
2382 | @@ -64,7 +64,11 @@ struct unix_sock { |
2383 | #define UNIX_GC_MAYBE_CYCLE 1 |
2384 | struct socket_wq peer_wq; |
2385 | }; |
2386 | -#define unix_sk(__sk) ((struct unix_sock *)__sk) |
2387 | + |
2388 | +static inline struct unix_sock *unix_sk(struct sock *sk) |
2389 | +{ |
2390 | + return (struct unix_sock *)sk; |
2391 | +} |
2392 | |
2393 | #define peer_wait peer_wq.wait |
2394 | |
2395 | diff --git a/include/net/inet_common.h b/include/net/inet_common.h |
2396 | index b2828a06a5a6..a7d812d05fba 100644 |
2397 | --- a/include/net/inet_common.h |
2398 | +++ b/include/net/inet_common.h |
2399 | @@ -42,7 +42,8 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, |
2400 | |
2401 | static inline void inet_ctl_sock_destroy(struct sock *sk) |
2402 | { |
2403 | - sk_release_kernel(sk); |
2404 | + if (sk) |
2405 | + sk_release_kernel(sk); |
2406 | } |
2407 | |
2408 | #endif |
2409 | diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h |
2410 | index a5593dab6af7..ef9557683fec 100644 |
2411 | --- a/include/net/ip6_tunnel.h |
2412 | +++ b/include/net/ip6_tunnel.h |
2413 | @@ -79,11 +79,12 @@ static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev) |
2414 | err = ip6_local_out(skb); |
2415 | |
2416 | if (net_xmit_eval(err) == 0) { |
2417 | - struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); |
2418 | + struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats); |
2419 | u64_stats_update_begin(&tstats->syncp); |
2420 | tstats->tx_bytes += pkt_len; |
2421 | tstats->tx_packets++; |
2422 | u64_stats_update_end(&tstats->syncp); |
2423 | + put_cpu_ptr(tstats); |
2424 | } else { |
2425 | stats->tx_errors++; |
2426 | stats->tx_aborted_errors++; |
2427 | diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h |
2428 | index 5bc6edeb7143..a3f2f8005126 100644 |
2429 | --- a/include/net/ip_tunnels.h |
2430 | +++ b/include/net/ip_tunnels.h |
2431 | @@ -186,12 +186,13 @@ static inline void iptunnel_xmit_stats(int err, |
2432 | struct pcpu_sw_netstats __percpu *stats) |
2433 | { |
2434 | if (err > 0) { |
2435 | - struct pcpu_sw_netstats *tstats = this_cpu_ptr(stats); |
2436 | + struct pcpu_sw_netstats *tstats = get_cpu_ptr(stats); |
2437 | |
2438 | u64_stats_update_begin(&tstats->syncp); |
2439 | tstats->tx_bytes += err; |
2440 | tstats->tx_packets++; |
2441 | u64_stats_update_end(&tstats->syncp); |
2442 | + put_cpu_ptr(tstats); |
2443 | } else if (err < 0) { |
2444 | err_stats->tx_errors++; |
2445 | err_stats->tx_aborted_errors++; |
2446 | diff --git a/include/net/ipv6.h b/include/net/ipv6.h |
2447 | index 4292929392b0..a5169a4e9ef7 100644 |
2448 | --- a/include/net/ipv6.h |
2449 | +++ b/include/net/ipv6.h |
2450 | @@ -207,6 +207,7 @@ extern rwlock_t ip6_ra_lock; |
2451 | */ |
2452 | |
2453 | struct ipv6_txoptions { |
2454 | + atomic_t refcnt; |
2455 | /* Length of this structure */ |
2456 | int tot_len; |
2457 | |
2458 | @@ -219,7 +220,7 @@ struct ipv6_txoptions { |
2459 | struct ipv6_opt_hdr *dst0opt; |
2460 | struct ipv6_rt_hdr *srcrt; /* Routing Header */ |
2461 | struct ipv6_opt_hdr *dst1opt; |
2462 | - |
2463 | + struct rcu_head rcu; |
2464 | /* Option buffer, as read by IPV6_PKTOPTIONS, starts here. */ |
2465 | }; |
2466 | |
2467 | @@ -252,6 +253,24 @@ struct ipv6_fl_socklist { |
2468 | struct rcu_head rcu; |
2469 | }; |
2470 | |
2471 | +static inline struct ipv6_txoptions *txopt_get(const struct ipv6_pinfo *np) |
2472 | +{ |
2473 | + struct ipv6_txoptions *opt; |
2474 | + |
2475 | + rcu_read_lock(); |
2476 | + opt = rcu_dereference(np->opt); |
2477 | + if (opt && !atomic_inc_not_zero(&opt->refcnt)) |
2478 | + opt = NULL; |
2479 | + rcu_read_unlock(); |
2480 | + return opt; |
2481 | +} |
2482 | + |
2483 | +static inline void txopt_put(struct ipv6_txoptions *opt) |
2484 | +{ |
2485 | + if (opt && atomic_dec_and_test(&opt->refcnt)) |
2486 | + kfree_rcu(opt, rcu); |
2487 | +} |
2488 | + |
2489 | struct ip6_flowlabel *fl6_sock_lookup(struct sock *sk, __be32 label); |
2490 | struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions *opt_space, |
2491 | struct ip6_flowlabel *fl, |
2492 | @@ -490,6 +509,7 @@ struct ip6_create_arg { |
2493 | u32 user; |
2494 | const struct in6_addr *src; |
2495 | const struct in6_addr *dst; |
2496 | + int iif; |
2497 | u8 ecn; |
2498 | }; |
2499 | |
2500 | diff --git a/include/net/sock.h b/include/net/sock.h |
2501 | index 4406dbe491f0..a098ce3cd242 100644 |
2502 | --- a/include/net/sock.h |
2503 | +++ b/include/net/sock.h |
2504 | @@ -819,6 +819,14 @@ static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *s |
2505 | if (sk_rcvqueues_full(sk, limit)) |
2506 | return -ENOBUFS; |
2507 | |
2508 | + /* |
2509 | + * If the skb was allocated from pfmemalloc reserves, only |
2510 | + * allow SOCK_MEMALLOC sockets to use it as this socket is |
2511 | + * helping free memory |
2512 | + */ |
2513 | + if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC)) |
2514 | + return -ENOMEM; |
2515 | + |
2516 | __sk_add_backlog(sk, skb); |
2517 | sk->sk_backlog.len += skb->truesize; |
2518 | return 0; |
2519 | diff --git a/include/sound/wm8904.h b/include/sound/wm8904.h |
2520 | index 898be3a8db9a..6d8f8fba3341 100644 |
2521 | --- a/include/sound/wm8904.h |
2522 | +++ b/include/sound/wm8904.h |
2523 | @@ -119,7 +119,7 @@ |
2524 | #define WM8904_MIC_REGS 2 |
2525 | #define WM8904_GPIO_REGS 4 |
2526 | #define WM8904_DRC_REGS 4 |
2527 | -#define WM8904_EQ_REGS 25 |
2528 | +#define WM8904_EQ_REGS 24 |
2529 | |
2530 | /** |
2531 | * DRC configurations are specified with a label and a set of register |
2532 | diff --git a/kernel/auditsc.c b/kernel/auditsc.c |
2533 | index e420a0c41b5f..cc3416f0deda 100644 |
2534 | --- a/kernel/auditsc.c |
2535 | +++ b/kernel/auditsc.c |
2536 | @@ -72,6 +72,8 @@ |
2537 | #include <linux/fs_struct.h> |
2538 | #include <linux/compat.h> |
2539 | #include <linux/ctype.h> |
2540 | +#include <linux/string.h> |
2541 | +#include <uapi/linux/limits.h> |
2542 | |
2543 | #include "audit.h" |
2544 | |
2545 | @@ -1861,8 +1863,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry, |
2546 | } |
2547 | |
2548 | list_for_each_entry_reverse(n, &context->names_list, list) { |
2549 | - /* does the name pointer match? */ |
2550 | - if (!n->name || n->name->name != name->name) |
2551 | + if (!n->name || strcmp(n->name->name, name->name)) |
2552 | continue; |
2553 | |
2554 | /* match the correct record type */ |
2555 | @@ -1877,12 +1878,48 @@ void __audit_inode(struct filename *name, const struct dentry *dentry, |
2556 | } |
2557 | |
2558 | out_alloc: |
2559 | - /* unable to find the name from a previous getname(). Allocate a new |
2560 | - * anonymous entry. |
2561 | - */ |
2562 | - n = audit_alloc_name(context, AUDIT_TYPE_NORMAL); |
2563 | + /* unable to find an entry with both a matching name and type */ |
2564 | + n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN); |
2565 | if (!n) |
2566 | return; |
2567 | + /* unfortunately, while we may have a path name to record with the |
2568 | + * inode, we can't always rely on the string lasting until the end of |
2569 | + * the syscall so we need to create our own copy, it may fail due to |
2570 | + * memory allocation issues, but we do our best */ |
2571 | + if (name) { |
2572 | + /* we can't use getname_kernel() due to size limits */ |
2573 | + size_t len = strlen(name->name) + 1; |
2574 | + struct filename *new = __getname(); |
2575 | + |
2576 | + if (unlikely(!new)) |
2577 | + goto out; |
2578 | + |
2579 | + if (len <= (PATH_MAX - sizeof(*new))) { |
2580 | + new->name = (char *)(new) + sizeof(*new); |
2581 | + new->separate = false; |
2582 | + } else if (len <= PATH_MAX) { |
2583 | + /* this looks odd, but is due to final_putname() */ |
2584 | + struct filename *new2; |
2585 | + |
2586 | + new2 = kmalloc(sizeof(*new2), GFP_KERNEL); |
2587 | + if (unlikely(!new2)) { |
2588 | + __putname(new); |
2589 | + goto out; |
2590 | + } |
2591 | + new2->name = (char *)new; |
2592 | + new2->separate = true; |
2593 | + new = new2; |
2594 | + } else { |
2595 | + /* we should never get here, but let's be safe */ |
2596 | + __putname(new); |
2597 | + goto out; |
2598 | + } |
2599 | + strlcpy((char *)new->name, name->name, len); |
2600 | + new->uptr = NULL; |
2601 | + new->aname = n; |
2602 | + n->name = new; |
2603 | + n->name_put = true; |
2604 | + } |
2605 | out: |
2606 | if (parent) { |
2607 | n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL; |
2608 | diff --git a/kernel/module.c b/kernel/module.c |
2609 | index c353707bbbd5..3da0c001d985 100644 |
2610 | --- a/kernel/module.c |
2611 | +++ b/kernel/module.c |
2612 | @@ -914,11 +914,15 @@ void symbol_put_addr(void *addr) |
2613 | if (core_kernel_text(a)) |
2614 | return; |
2615 | |
2616 | - /* module_text_address is safe here: we're supposed to have reference |
2617 | - * to module from symbol_get, so it can't go away. */ |
2618 | + /* |
2619 | + * Even though we hold a reference on the module; we still need to |
2620 | + * disable preemption in order to safely traverse the data structure. |
2621 | + */ |
2622 | + preempt_disable(); |
2623 | modaddr = __module_text_address(a); |
2624 | BUG_ON(!modaddr); |
2625 | module_put(modaddr); |
2626 | + preempt_enable(); |
2627 | } |
2628 | EXPORT_SYMBOL_GPL(symbol_put_addr); |
2629 | |
2630 | diff --git a/kernel/sched/core.c b/kernel/sched/core.c |
2631 | index a882dd91722d..d650e1e593b8 100644 |
2632 | --- a/kernel/sched/core.c |
2633 | +++ b/kernel/sched/core.c |
2634 | @@ -5284,6 +5284,14 @@ static int sched_cpu_active(struct notifier_block *nfb, |
2635 | case CPU_STARTING: |
2636 | set_cpu_rq_start_time(); |
2637 | return NOTIFY_OK; |
2638 | + case CPU_ONLINE: |
2639 | + /* |
2640 | + * At this point a starting CPU has marked itself as online via |
2641 | + * set_cpu_online(). But it might not yet have marked itself |
2642 | + * as active, which is essential from here on. |
2643 | + * |
2644 | + * Thus, fall-through and help the starting CPU along. |
2645 | + */ |
2646 | case CPU_DOWN_FAILED: |
2647 | set_cpu_active((long)hcpu, true); |
2648 | return NOTIFY_OK; |
2649 | diff --git a/kernel/workqueue.c b/kernel/workqueue.c |
2650 | index 2273f534b01a..bd3c41d4ec07 100644 |
2651 | --- a/kernel/workqueue.c |
2652 | +++ b/kernel/workqueue.c |
2653 | @@ -1442,13 +1442,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq, |
2654 | timer_stats_timer_set_start_info(&dwork->timer); |
2655 | |
2656 | dwork->wq = wq; |
2657 | + /* timer isn't guaranteed to run in this cpu, record earlier */ |
2658 | + if (cpu == WORK_CPU_UNBOUND) |
2659 | + cpu = raw_smp_processor_id(); |
2660 | dwork->cpu = cpu; |
2661 | timer->expires = jiffies + delay; |
2662 | |
2663 | - if (unlikely(cpu != WORK_CPU_UNBOUND)) |
2664 | - add_timer_on(timer, cpu); |
2665 | - else |
2666 | - add_timer(timer); |
2667 | + add_timer_on(timer, cpu); |
2668 | } |
2669 | |
2670 | /** |
2671 | diff --git a/lib/radix-tree.c b/lib/radix-tree.c |
2672 | index 3291a8e37490..3d2aa27b845b 100644 |
2673 | --- a/lib/radix-tree.c |
2674 | +++ b/lib/radix-tree.c |
2675 | @@ -33,7 +33,7 @@ |
2676 | #include <linux/string.h> |
2677 | #include <linux/bitops.h> |
2678 | #include <linux/rcupdate.h> |
2679 | -#include <linux/hardirq.h> /* in_interrupt() */ |
2680 | +#include <linux/preempt_mask.h> /* in_interrupt() */ |
2681 | |
2682 | |
2683 | /* |
2684 | diff --git a/mm/filemap.c b/mm/filemap.c |
2685 | index 37beab98b416..7e6ab98d4d3c 100644 |
2686 | --- a/mm/filemap.c |
2687 | +++ b/mm/filemap.c |
2688 | @@ -2489,6 +2489,11 @@ again: |
2689 | break; |
2690 | } |
2691 | |
2692 | + if (fatal_signal_pending(current)) { |
2693 | + status = -EINTR; |
2694 | + break; |
2695 | + } |
2696 | + |
2697 | status = a_ops->write_begin(file, mapping, pos, bytes, flags, |
2698 | &page, &fsdata); |
2699 | if (unlikely(status < 0)) |
2700 | @@ -2526,10 +2531,6 @@ again: |
2701 | written += copied; |
2702 | |
2703 | balance_dirty_pages_ratelimited(mapping); |
2704 | - if (fatal_signal_pending(current)) { |
2705 | - status = -EINTR; |
2706 | - break; |
2707 | - } |
2708 | } while (iov_iter_count(i)); |
2709 | |
2710 | return written ? written : status; |
2711 | diff --git a/net/core/datagram.c b/net/core/datagram.c |
2712 | index 61e99f315ed9..3a402a7b20e9 100644 |
2713 | --- a/net/core/datagram.c |
2714 | +++ b/net/core/datagram.c |
2715 | @@ -130,35 +130,6 @@ out_noerr: |
2716 | goto out; |
2717 | } |
2718 | |
2719 | -static int skb_set_peeked(struct sk_buff *skb) |
2720 | -{ |
2721 | - struct sk_buff *nskb; |
2722 | - |
2723 | - if (skb->peeked) |
2724 | - return 0; |
2725 | - |
2726 | - /* We have to unshare an skb before modifying it. */ |
2727 | - if (!skb_shared(skb)) |
2728 | - goto done; |
2729 | - |
2730 | - nskb = skb_clone(skb, GFP_ATOMIC); |
2731 | - if (!nskb) |
2732 | - return -ENOMEM; |
2733 | - |
2734 | - skb->prev->next = nskb; |
2735 | - skb->next->prev = nskb; |
2736 | - nskb->prev = skb->prev; |
2737 | - nskb->next = skb->next; |
2738 | - |
2739 | - consume_skb(skb); |
2740 | - skb = nskb; |
2741 | - |
2742 | -done: |
2743 | - skb->peeked = 1; |
2744 | - |
2745 | - return 0; |
2746 | -} |
2747 | - |
2748 | /** |
2749 | * __skb_recv_datagram - Receive a datagram skbuff |
2750 | * @sk: socket |
2751 | @@ -193,9 +164,7 @@ done: |
2752 | struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, |
2753 | int *peeked, int *off, int *err) |
2754 | { |
2755 | - struct sk_buff_head *queue = &sk->sk_receive_queue; |
2756 | struct sk_buff *skb, *last; |
2757 | - unsigned long cpu_flags; |
2758 | long timeo; |
2759 | /* |
2760 | * Caller is allowed not to check sk->sk_err before skb_recv_datagram() |
2761 | @@ -214,6 +183,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, |
2762 | * Look at current nfs client by the way... |
2763 | * However, this function was correct in any case. 8) |
2764 | */ |
2765 | + unsigned long cpu_flags; |
2766 | + struct sk_buff_head *queue = &sk->sk_receive_queue; |
2767 | int _off = *off; |
2768 | |
2769 | last = (struct sk_buff *)queue; |
2770 | @@ -227,11 +198,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, |
2771 | _off -= skb->len; |
2772 | continue; |
2773 | } |
2774 | - |
2775 | - error = skb_set_peeked(skb); |
2776 | - if (error) |
2777 | - goto unlock_err; |
2778 | - |
2779 | + skb->peeked = 1; |
2780 | atomic_inc(&skb->users); |
2781 | } else |
2782 | __skb_unlink(skb, queue); |
2783 | @@ -255,8 +222,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, |
2784 | |
2785 | return NULL; |
2786 | |
2787 | -unlock_err: |
2788 | - spin_unlock_irqrestore(&queue->lock, cpu_flags); |
2789 | no_packet: |
2790 | *err = error; |
2791 | return NULL; |
2792 | diff --git a/net/core/dst.c b/net/core/dst.c |
2793 | index a028409ee438..a80e92346b9b 100644 |
2794 | --- a/net/core/dst.c |
2795 | +++ b/net/core/dst.c |
2796 | @@ -285,7 +285,7 @@ void dst_release(struct dst_entry *dst) |
2797 | |
2798 | newrefcnt = atomic_dec_return(&dst->__refcnt); |
2799 | WARN_ON(newrefcnt < 0); |
2800 | - if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) |
2801 | + if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) |
2802 | call_rcu(&dst->rcu_head, dst_destroy_rcu); |
2803 | } |
2804 | } |
2805 | diff --git a/net/core/ethtool.c b/net/core/ethtool.c |
2806 | index 06dfb293e5aa..14bb1583947e 100644 |
2807 | --- a/net/core/ethtool.c |
2808 | +++ b/net/core/ethtool.c |
2809 | @@ -1257,7 +1257,7 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr) |
2810 | |
2811 | gstrings.len = ret; |
2812 | |
2813 | - data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER); |
2814 | + data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER); |
2815 | if (!data) |
2816 | return -ENOMEM; |
2817 | |
2818 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c |
2819 | index 2b0d99dad8be..0478423afd29 100644 |
2820 | --- a/net/core/neighbour.c |
2821 | +++ b/net/core/neighbour.c |
2822 | @@ -2263,7 +2263,7 @@ static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn, |
2823 | ndm->ndm_pad2 = 0; |
2824 | ndm->ndm_flags = pn->flags | NTF_PROXY; |
2825 | ndm->ndm_type = RTN_UNICAST; |
2826 | - ndm->ndm_ifindex = pn->dev->ifindex; |
2827 | + ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0; |
2828 | ndm->ndm_state = NUD_NONE; |
2829 | |
2830 | if (nla_put(skb, NDA_DST, tbl->key_len, pn->key)) |
2831 | @@ -2337,7 +2337,7 @@ static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb, |
2832 | if (h > s_h) |
2833 | s_idx = 0; |
2834 | for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) { |
2835 | - if (dev_net(n->dev) != net) |
2836 | + if (pneigh_net(n) != net) |
2837 | continue; |
2838 | if (idx < s_idx) |
2839 | goto next; |
2840 | diff --git a/net/core/scm.c b/net/core/scm.c |
2841 | index b442e7e25e60..d30eb057fa7b 100644 |
2842 | --- a/net/core/scm.c |
2843 | +++ b/net/core/scm.c |
2844 | @@ -306,6 +306,8 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) |
2845 | err = put_user(cmlen, &cm->cmsg_len); |
2846 | if (!err) { |
2847 | cmlen = CMSG_SPACE(i*sizeof(int)); |
2848 | + if (msg->msg_controllen < cmlen) |
2849 | + cmlen = msg->msg_controllen; |
2850 | msg->msg_control += cmlen; |
2851 | msg->msg_controllen -= cmlen; |
2852 | } |
2853 | diff --git a/net/core/skbuff.c b/net/core/skbuff.c |
2854 | index 72400a1bb439..ea0bcc4a9657 100644 |
2855 | --- a/net/core/skbuff.c |
2856 | +++ b/net/core/skbuff.c |
2857 | @@ -2881,11 +2881,12 @@ EXPORT_SYMBOL(skb_append_datato_frags); |
2858 | */ |
2859 | unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len) |
2860 | { |
2861 | + unsigned char *data = skb->data; |
2862 | + |
2863 | BUG_ON(len > skb->len); |
2864 | - skb->len -= len; |
2865 | - BUG_ON(skb->len < skb->data_len); |
2866 | - skb_postpull_rcsum(skb, skb->data, len); |
2867 | - return skb->data += len; |
2868 | + __skb_pull(skb, len); |
2869 | + skb_postpull_rcsum(skb, data, len); |
2870 | + return skb->data; |
2871 | } |
2872 | EXPORT_SYMBOL_GPL(skb_pull_rcsum); |
2873 | |
2874 | diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c |
2875 | index 6bcaa33cd804..7bcb22317841 100644 |
2876 | --- a/net/dccp/ipv6.c |
2877 | +++ b/net/dccp/ipv6.c |
2878 | @@ -238,7 +238,9 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req) |
2879 | security_req_classify_flow(req, flowi6_to_flowi(&fl6)); |
2880 | |
2881 | |
2882 | - final_p = fl6_update_dst(&fl6, np->opt, &final); |
2883 | + rcu_read_lock(); |
2884 | + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); |
2885 | + rcu_read_unlock(); |
2886 | |
2887 | dst = ip6_dst_lookup_flow(sk, &fl6, final_p); |
2888 | if (IS_ERR(dst)) { |
2889 | @@ -255,7 +257,10 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req) |
2890 | &ireq->ir_v6_loc_addr, |
2891 | &ireq->ir_v6_rmt_addr); |
2892 | fl6.daddr = ireq->ir_v6_rmt_addr; |
2893 | - err = ip6_xmit(sk, skb, &fl6, np->opt, np->tclass); |
2894 | + rcu_read_lock(); |
2895 | + err = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt), |
2896 | + np->tclass); |
2897 | + rcu_read_unlock(); |
2898 | err = net_xmit_eval(err); |
2899 | } |
2900 | |
2901 | @@ -450,6 +455,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk, |
2902 | { |
2903 | struct inet_request_sock *ireq = inet_rsk(req); |
2904 | struct ipv6_pinfo *newnp, *np = inet6_sk(sk); |
2905 | + struct ipv6_txoptions *opt; |
2906 | struct inet_sock *newinet; |
2907 | struct dccp6_sock *newdp6; |
2908 | struct sock *newsk; |
2909 | @@ -573,13 +579,15 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk, |
2910 | * Yes, keeping reference count would be much more clever, but we make |
2911 | * one more one thing there: reattach optmem to newsk. |
2912 | */ |
2913 | - if (np->opt != NULL) |
2914 | - newnp->opt = ipv6_dup_options(newsk, np->opt); |
2915 | - |
2916 | + opt = rcu_dereference(np->opt); |
2917 | + if (opt) { |
2918 | + opt = ipv6_dup_options(newsk, opt); |
2919 | + RCU_INIT_POINTER(newnp->opt, opt); |
2920 | + } |
2921 | inet_csk(newsk)->icsk_ext_hdr_len = 0; |
2922 | - if (newnp->opt != NULL) |
2923 | - inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen + |
2924 | - newnp->opt->opt_flen); |
2925 | + if (opt) |
2926 | + inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen + |
2927 | + opt->opt_flen; |
2928 | |
2929 | dccp_sync_mss(newsk, dst_mtu(dst)); |
2930 | |
2931 | @@ -832,6 +840,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr, |
2932 | struct ipv6_pinfo *np = inet6_sk(sk); |
2933 | struct dccp_sock *dp = dccp_sk(sk); |
2934 | struct in6_addr *saddr = NULL, *final_p, final; |
2935 | + struct ipv6_txoptions *opt; |
2936 | struct flowi6 fl6; |
2937 | struct dst_entry *dst; |
2938 | int addr_type; |
2939 | @@ -933,7 +942,8 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr, |
2940 | fl6.fl6_sport = inet->inet_sport; |
2941 | security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); |
2942 | |
2943 | - final_p = fl6_update_dst(&fl6, np->opt, &final); |
2944 | + opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk)); |
2945 | + final_p = fl6_update_dst(&fl6, opt, &final); |
2946 | |
2947 | dst = ip6_dst_lookup_flow(sk, &fl6, final_p); |
2948 | if (IS_ERR(dst)) { |
2949 | @@ -953,9 +963,8 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr, |
2950 | __ip6_dst_store(sk, dst, NULL, NULL); |
2951 | |
2952 | icsk->icsk_ext_hdr_len = 0; |
2953 | - if (np->opt != NULL) |
2954 | - icsk->icsk_ext_hdr_len = (np->opt->opt_flen + |
2955 | - np->opt->opt_nflen); |
2956 | + if (opt) |
2957 | + icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen; |
2958 | |
2959 | inet->inet_dport = usin->sin6_port; |
2960 | |
2961 | diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c |
2962 | index 51973ddc05a6..abc50b41bc39 100644 |
2963 | --- a/net/ipv4/gre_offload.c |
2964 | +++ b/net/ipv4/gre_offload.c |
2965 | @@ -36,7 +36,8 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb, |
2966 | SKB_GSO_TCP_ECN | |
2967 | SKB_GSO_GRE | |
2968 | SKB_GSO_GRE_CSUM | |
2969 | - SKB_GSO_IPIP))) |
2970 | + SKB_GSO_IPIP | |
2971 | + SKB_GSO_SIT))) |
2972 | goto out; |
2973 | |
2974 | if (!skb->encapsulation) |
2975 | diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c |
2976 | index c8034587859d..1b7f6da99ef4 100644 |
2977 | --- a/net/ipv4/ipmr.c |
2978 | +++ b/net/ipv4/ipmr.c |
2979 | @@ -136,7 +136,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, |
2980 | struct mfc_cache *c, struct rtmsg *rtm); |
2981 | static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc, |
2982 | int cmd); |
2983 | -static void mroute_clean_tables(struct mr_table *mrt); |
2984 | +static void mroute_clean_tables(struct mr_table *mrt, bool all); |
2985 | static void ipmr_expire_process(unsigned long arg); |
2986 | |
2987 | #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES |
2988 | @@ -348,7 +348,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id) |
2989 | static void ipmr_free_table(struct mr_table *mrt) |
2990 | { |
2991 | del_timer_sync(&mrt->ipmr_expire_timer); |
2992 | - mroute_clean_tables(mrt); |
2993 | + mroute_clean_tables(mrt, true); |
2994 | kfree(mrt); |
2995 | } |
2996 | |
2997 | @@ -1201,7 +1201,7 @@ static int ipmr_mfc_add(struct net *net, struct mr_table *mrt, |
2998 | * Close the multicast socket, and clear the vif tables etc |
2999 | */ |
3000 | |
3001 | -static void mroute_clean_tables(struct mr_table *mrt) |
3002 | +static void mroute_clean_tables(struct mr_table *mrt, bool all) |
3003 | { |
3004 | int i; |
3005 | LIST_HEAD(list); |
3006 | @@ -1210,8 +1210,9 @@ static void mroute_clean_tables(struct mr_table *mrt) |
3007 | /* Shut down all active vif entries */ |
3008 | |
3009 | for (i = 0; i < mrt->maxvif; i++) { |
3010 | - if (!(mrt->vif_table[i].flags & VIFF_STATIC)) |
3011 | - vif_delete(mrt, i, 0, &list); |
3012 | + if (!all && (mrt->vif_table[i].flags & VIFF_STATIC)) |
3013 | + continue; |
3014 | + vif_delete(mrt, i, 0, &list); |
3015 | } |
3016 | unregister_netdevice_many(&list); |
3017 | |
3018 | @@ -1219,7 +1220,7 @@ static void mroute_clean_tables(struct mr_table *mrt) |
3019 | |
3020 | for (i = 0; i < MFC_LINES; i++) { |
3021 | list_for_each_entry_safe(c, next, &mrt->mfc_cache_array[i], list) { |
3022 | - if (c->mfc_flags & MFC_STATIC) |
3023 | + if (!all && (c->mfc_flags & MFC_STATIC)) |
3024 | continue; |
3025 | list_del_rcu(&c->list); |
3026 | mroute_netlink_event(mrt, c, RTM_DELROUTE); |
3027 | @@ -1254,7 +1255,7 @@ static void mrtsock_destruct(struct sock *sk) |
3028 | NETCONFA_IFINDEX_ALL, |
3029 | net->ipv4.devconf_all); |
3030 | RCU_INIT_POINTER(mrt->mroute_sk, NULL); |
3031 | - mroute_clean_tables(mrt); |
3032 | + mroute_clean_tables(mrt, false); |
3033 | } |
3034 | } |
3035 | rtnl_unlock(); |
3036 | @@ -1674,8 +1675,8 @@ static inline int ipmr_forward_finish(struct sk_buff *skb) |
3037 | { |
3038 | struct ip_options *opt = &(IPCB(skb)->opt); |
3039 | |
3040 | - IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); |
3041 | - IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); |
3042 | + IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); |
3043 | + IP_ADD_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); |
3044 | |
3045 | if (unlikely(opt->optlen)) |
3046 | ip_forward_options(skb); |
3047 | @@ -1737,7 +1738,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt, |
3048 | * to blackhole. |
3049 | */ |
3050 | |
3051 | - IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS); |
3052 | + IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS); |
3053 | ip_rt_put(rt); |
3054 | goto out_free; |
3055 | } |
3056 | diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c |
3057 | index b3c53c8b331e..633cd34f57ec 100644 |
3058 | --- a/net/ipv4/sysctl_net_ipv4.c |
3059 | +++ b/net/ipv4/sysctl_net_ipv4.c |
3060 | @@ -45,10 +45,10 @@ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; |
3061 | /* Update system visible IP port range */ |
3062 | static void set_local_port_range(struct net *net, int range[2]) |
3063 | { |
3064 | - write_seqlock(&net->ipv4.ip_local_ports.lock); |
3065 | + write_seqlock_bh(&net->ipv4.ip_local_ports.lock); |
3066 | net->ipv4.ip_local_ports.range[0] = range[0]; |
3067 | net->ipv4.ip_local_ports.range[1] = range[1]; |
3068 | - write_sequnlock(&net->ipv4.ip_local_ports.lock); |
3069 | + write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); |
3070 | } |
3071 | |
3072 | /* Validate changes from /proc interface. */ |
3073 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c |
3074 | index 6f46cde58e54..0c96055b2382 100644 |
3075 | --- a/net/ipv4/tcp_input.c |
3076 | +++ b/net/ipv4/tcp_input.c |
3077 | @@ -4356,19 +4356,34 @@ static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, int |
3078 | int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size) |
3079 | { |
3080 | struct sk_buff *skb; |
3081 | + int err = -ENOMEM; |
3082 | + int data_len = 0; |
3083 | bool fragstolen; |
3084 | |
3085 | if (size == 0) |
3086 | return 0; |
3087 | |
3088 | - skb = alloc_skb(size, sk->sk_allocation); |
3089 | + if (size > PAGE_SIZE) { |
3090 | + int npages = min_t(size_t, size >> PAGE_SHIFT, MAX_SKB_FRAGS); |
3091 | + |
3092 | + data_len = npages << PAGE_SHIFT; |
3093 | + size = data_len + (size & ~PAGE_MASK); |
3094 | + } |
3095 | + skb = alloc_skb_with_frags(size - data_len, data_len, |
3096 | + PAGE_ALLOC_COSTLY_ORDER, |
3097 | + &err, sk->sk_allocation); |
3098 | if (!skb) |
3099 | goto err; |
3100 | |
3101 | + skb_put(skb, size - data_len); |
3102 | + skb->data_len = data_len; |
3103 | + skb->len = size; |
3104 | + |
3105 | if (tcp_try_rmem_schedule(sk, skb, skb->truesize)) |
3106 | goto err_free; |
3107 | |
3108 | - if (memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size)) |
3109 | + err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, size); |
3110 | + if (err) |
3111 | goto err_free; |
3112 | |
3113 | TCP_SKB_CB(skb)->seq = tcp_sk(sk)->rcv_nxt; |
3114 | @@ -4384,7 +4399,8 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size) |
3115 | err_free: |
3116 | kfree_skb(skb); |
3117 | err: |
3118 | - return -ENOMEM; |
3119 | + return err; |
3120 | + |
3121 | } |
3122 | |
3123 | static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) |
3124 | @@ -5524,6 +5540,7 @@ discard: |
3125 | } |
3126 | |
3127 | tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1; |
3128 | + tp->copied_seq = tp->rcv_nxt; |
3129 | tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1; |
3130 | |
3131 | /* RFC1323: The window in SYN & SYN/ACK segments is |
3132 | diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c |
3133 | index a5fdfe9fa542..6cd9f696d9c6 100644 |
3134 | --- a/net/ipv4/tcp_ipv4.c |
3135 | +++ b/net/ipv4/tcp_ipv4.c |
3136 | @@ -959,7 +959,8 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, |
3137 | } |
3138 | |
3139 | md5sig = rcu_dereference_protected(tp->md5sig_info, |
3140 | - sock_owned_by_user(sk)); |
3141 | + sock_owned_by_user(sk) || |
3142 | + lockdep_is_held(&sk->sk_lock.slock)); |
3143 | if (!md5sig) { |
3144 | md5sig = kmalloc(sizeof(*md5sig), gfp); |
3145 | if (!md5sig) |
3146 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c |
3147 | index 17a025847999..e34efa766031 100644 |
3148 | --- a/net/ipv6/addrconf.c |
3149 | +++ b/net/ipv6/addrconf.c |
3150 | @@ -396,6 +396,7 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev) |
3151 | if (err) { |
3152 | ipv6_mc_destroy_dev(ndev); |
3153 | del_timer(&ndev->regen_timer); |
3154 | + snmp6_unregister_dev(ndev); |
3155 | goto err_release; |
3156 | } |
3157 | /* protected by rtnl_lock */ |
3158 | @@ -4843,6 +4844,21 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write, |
3159 | return ret; |
3160 | } |
3161 | |
3162 | +static |
3163 | +int addrconf_sysctl_mtu(struct ctl_table *ctl, int write, |
3164 | + void __user *buffer, size_t *lenp, loff_t *ppos) |
3165 | +{ |
3166 | + struct inet6_dev *idev = ctl->extra1; |
3167 | + int min_mtu = IPV6_MIN_MTU; |
3168 | + struct ctl_table lctl; |
3169 | + |
3170 | + lctl = *ctl; |
3171 | + lctl.extra1 = &min_mtu; |
3172 | + lctl.extra2 = idev ? &idev->dev->mtu : NULL; |
3173 | + |
3174 | + return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos); |
3175 | +} |
3176 | + |
3177 | static void dev_disable_change(struct inet6_dev *idev) |
3178 | { |
3179 | struct netdev_notifier_info info; |
3180 | @@ -4994,7 +5010,7 @@ static struct addrconf_sysctl_table |
3181 | .data = &ipv6_devconf.mtu6, |
3182 | .maxlen = sizeof(int), |
3183 | .mode = 0644, |
3184 | - .proc_handler = proc_dointvec, |
3185 | + .proc_handler = addrconf_sysctl_mtu, |
3186 | }, |
3187 | { |
3188 | .procname = "accept_ra", |
3189 | diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c |
3190 | index e8c4400f23e9..05417c330f4e 100644 |
3191 | --- a/net/ipv6/af_inet6.c |
3192 | +++ b/net/ipv6/af_inet6.c |
3193 | @@ -425,9 +425,11 @@ void inet6_destroy_sock(struct sock *sk) |
3194 | |
3195 | /* Free tx options */ |
3196 | |
3197 | - opt = xchg(&np->opt, NULL); |
3198 | - if (opt != NULL) |
3199 | - sock_kfree_s(sk, opt, opt->tot_len); |
3200 | + opt = xchg((__force struct ipv6_txoptions **)&np->opt, NULL); |
3201 | + if (opt) { |
3202 | + atomic_sub(opt->tot_len, &sk->sk_omem_alloc); |
3203 | + txopt_put(opt); |
3204 | + } |
3205 | } |
3206 | EXPORT_SYMBOL_GPL(inet6_destroy_sock); |
3207 | |
3208 | @@ -656,7 +658,10 @@ int inet6_sk_rebuild_header(struct sock *sk) |
3209 | fl6.fl6_sport = inet->inet_sport; |
3210 | security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); |
3211 | |
3212 | - final_p = fl6_update_dst(&fl6, np->opt, &final); |
3213 | + rcu_read_lock(); |
3214 | + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), |
3215 | + &final); |
3216 | + rcu_read_unlock(); |
3217 | |
3218 | dst = ip6_dst_lookup_flow(sk, &fl6, final_p); |
3219 | if (IS_ERR(dst)) { |
3220 | diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c |
3221 | index e069aeb2cf72..9e3b0b66a4f3 100644 |
3222 | --- a/net/ipv6/datagram.c |
3223 | +++ b/net/ipv6/datagram.c |
3224 | @@ -167,8 +167,10 @@ ipv4_connected: |
3225 | |
3226 | security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); |
3227 | |
3228 | - opt = flowlabel ? flowlabel->opt : np->opt; |
3229 | + rcu_read_lock(); |
3230 | + opt = flowlabel ? flowlabel->opt : rcu_dereference(np->opt); |
3231 | final_p = fl6_update_dst(&fl6, opt, &final); |
3232 | + rcu_read_unlock(); |
3233 | |
3234 | dst = ip6_dst_lookup_flow(sk, &fl6, final_p); |
3235 | err = 0; |
3236 | diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c |
3237 | index bfde361b6134..4f08a0f452eb 100644 |
3238 | --- a/net/ipv6/exthdrs.c |
3239 | +++ b/net/ipv6/exthdrs.c |
3240 | @@ -727,6 +727,7 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt) |
3241 | *((char **)&opt2->dst1opt) += dif; |
3242 | if (opt2->srcrt) |
3243 | *((char **)&opt2->srcrt) += dif; |
3244 | + atomic_set(&opt2->refcnt, 1); |
3245 | } |
3246 | return opt2; |
3247 | } |
3248 | @@ -790,7 +791,7 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, |
3249 | return ERR_PTR(-ENOBUFS); |
3250 | |
3251 | memset(opt2, 0, tot_len); |
3252 | - |
3253 | + atomic_set(&opt2->refcnt, 1); |
3254 | opt2->tot_len = tot_len; |
3255 | p = (char *)(opt2 + 1); |
3256 | |
3257 | diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c |
3258 | index 29b32206e494..6cc516c825b6 100644 |
3259 | --- a/net/ipv6/inet6_connection_sock.c |
3260 | +++ b/net/ipv6/inet6_connection_sock.c |
3261 | @@ -77,7 +77,9 @@ struct dst_entry *inet6_csk_route_req(struct sock *sk, |
3262 | memset(fl6, 0, sizeof(*fl6)); |
3263 | fl6->flowi6_proto = IPPROTO_TCP; |
3264 | fl6->daddr = ireq->ir_v6_rmt_addr; |
3265 | - final_p = fl6_update_dst(fl6, np->opt, &final); |
3266 | + rcu_read_lock(); |
3267 | + final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); |
3268 | + rcu_read_unlock(); |
3269 | fl6->saddr = ireq->ir_v6_loc_addr; |
3270 | fl6->flowi6_oif = ireq->ir_iif; |
3271 | fl6->flowi6_mark = ireq->ir_mark; |
3272 | @@ -208,7 +210,9 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk, |
3273 | fl6->fl6_dport = inet->inet_dport; |
3274 | security_sk_classify_flow(sk, flowi6_to_flowi(fl6)); |
3275 | |
3276 | - final_p = fl6_update_dst(fl6, np->opt, &final); |
3277 | + rcu_read_lock(); |
3278 | + final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); |
3279 | + rcu_read_unlock(); |
3280 | |
3281 | dst = __inet6_csk_dst_check(sk, np->dst_cookie); |
3282 | if (!dst) { |
3283 | @@ -241,7 +245,8 @@ int inet6_csk_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl_unused |
3284 | /* Restore final destination back after routing done */ |
3285 | fl6.daddr = sk->sk_v6_daddr; |
3286 | |
3287 | - res = ip6_xmit(sk, skb, &fl6, np->opt, np->tclass); |
3288 | + res = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt), |
3289 | + np->tclass); |
3290 | rcu_read_unlock(); |
3291 | return res; |
3292 | } |
3293 | diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c |
3294 | index 0d58542f9db0..4ca7cdd15aad 100644 |
3295 | --- a/net/ipv6/ip6mr.c |
3296 | +++ b/net/ipv6/ip6mr.c |
3297 | @@ -120,7 +120,7 @@ static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc, |
3298 | int cmd); |
3299 | static int ip6mr_rtm_dumproute(struct sk_buff *skb, |
3300 | struct netlink_callback *cb); |
3301 | -static void mroute_clean_tables(struct mr6_table *mrt); |
3302 | +static void mroute_clean_tables(struct mr6_table *mrt, bool all); |
3303 | static void ipmr_expire_process(unsigned long arg); |
3304 | |
3305 | #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES |
3306 | @@ -337,7 +337,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id) |
3307 | static void ip6mr_free_table(struct mr6_table *mrt) |
3308 | { |
3309 | del_timer(&mrt->ipmr_expire_timer); |
3310 | - mroute_clean_tables(mrt); |
3311 | + mroute_clean_tables(mrt, true); |
3312 | kfree(mrt); |
3313 | } |
3314 | |
3315 | @@ -1540,7 +1540,7 @@ static int ip6mr_mfc_add(struct net *net, struct mr6_table *mrt, |
3316 | * Close the multicast socket, and clear the vif tables etc |
3317 | */ |
3318 | |
3319 | -static void mroute_clean_tables(struct mr6_table *mrt) |
3320 | +static void mroute_clean_tables(struct mr6_table *mrt, bool all) |
3321 | { |
3322 | int i; |
3323 | LIST_HEAD(list); |
3324 | @@ -1550,8 +1550,9 @@ static void mroute_clean_tables(struct mr6_table *mrt) |
3325 | * Shut down all active vif entries |
3326 | */ |
3327 | for (i = 0; i < mrt->maxvif; i++) { |
3328 | - if (!(mrt->vif6_table[i].flags & VIFF_STATIC)) |
3329 | - mif6_delete(mrt, i, &list); |
3330 | + if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC)) |
3331 | + continue; |
3332 | + mif6_delete(mrt, i, &list); |
3333 | } |
3334 | unregister_netdevice_many(&list); |
3335 | |
3336 | @@ -1560,7 +1561,7 @@ static void mroute_clean_tables(struct mr6_table *mrt) |
3337 | */ |
3338 | for (i = 0; i < MFC6_LINES; i++) { |
3339 | list_for_each_entry_safe(c, next, &mrt->mfc6_cache_array[i], list) { |
3340 | - if (c->mfc_flags & MFC_STATIC) |
3341 | + if (!all && (c->mfc_flags & MFC_STATIC)) |
3342 | continue; |
3343 | write_lock_bh(&mrt_lock); |
3344 | list_del(&c->list); |
3345 | @@ -1623,7 +1624,7 @@ int ip6mr_sk_done(struct sock *sk) |
3346 | net->ipv6.devconf_all); |
3347 | write_unlock_bh(&mrt_lock); |
3348 | |
3349 | - mroute_clean_tables(mrt); |
3350 | + mroute_clean_tables(mrt, false); |
3351 | err = 0; |
3352 | break; |
3353 | } |
3354 | diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c |
3355 | index e1a9583bb419..f81fcc09ea6c 100644 |
3356 | --- a/net/ipv6/ipv6_sockglue.c |
3357 | +++ b/net/ipv6/ipv6_sockglue.c |
3358 | @@ -110,10 +110,12 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk, |
3359 | icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen; |
3360 | icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie); |
3361 | } |
3362 | - opt = xchg(&inet6_sk(sk)->opt, opt); |
3363 | + opt = xchg((__force struct ipv6_txoptions **)&inet6_sk(sk)->opt, |
3364 | + opt); |
3365 | } else { |
3366 | spin_lock(&sk->sk_dst_lock); |
3367 | - opt = xchg(&inet6_sk(sk)->opt, opt); |
3368 | + opt = xchg((__force struct ipv6_txoptions **)&inet6_sk(sk)->opt, |
3369 | + opt); |
3370 | spin_unlock(&sk->sk_dst_lock); |
3371 | } |
3372 | sk_dst_reset(sk); |
3373 | @@ -213,9 +215,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, |
3374 | sk->sk_socket->ops = &inet_dgram_ops; |
3375 | sk->sk_family = PF_INET; |
3376 | } |
3377 | - opt = xchg(&np->opt, NULL); |
3378 | - if (opt) |
3379 | - sock_kfree_s(sk, opt, opt->tot_len); |
3380 | + opt = xchg((__force struct ipv6_txoptions **)&np->opt, |
3381 | + NULL); |
3382 | + if (opt) { |
3383 | + atomic_sub(opt->tot_len, &sk->sk_omem_alloc); |
3384 | + txopt_put(opt); |
3385 | + } |
3386 | pktopt = xchg(&np->pktoptions, NULL); |
3387 | kfree_skb(pktopt); |
3388 | |
3389 | @@ -385,7 +390,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, |
3390 | if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) |
3391 | break; |
3392 | |
3393 | - opt = ipv6_renew_options(sk, np->opt, optname, |
3394 | + opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk)); |
3395 | + opt = ipv6_renew_options(sk, opt, optname, |
3396 | (struct ipv6_opt_hdr __user *)optval, |
3397 | optlen); |
3398 | if (IS_ERR(opt)) { |
3399 | @@ -414,8 +420,10 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, |
3400 | retv = 0; |
3401 | opt = ipv6_update_options(sk, opt); |
3402 | sticky_done: |
3403 | - if (opt) |
3404 | - sock_kfree_s(sk, opt, opt->tot_len); |
3405 | + if (opt) { |
3406 | + atomic_sub(opt->tot_len, &sk->sk_omem_alloc); |
3407 | + txopt_put(opt); |
3408 | + } |
3409 | break; |
3410 | } |
3411 | |
3412 | @@ -468,6 +476,7 @@ sticky_done: |
3413 | break; |
3414 | |
3415 | memset(opt, 0, sizeof(*opt)); |
3416 | + atomic_set(&opt->refcnt, 1); |
3417 | opt->tot_len = sizeof(*opt) + optlen; |
3418 | retv = -EFAULT; |
3419 | if (copy_from_user(opt+1, optval, optlen)) |
3420 | @@ -484,8 +493,10 @@ update: |
3421 | retv = 0; |
3422 | opt = ipv6_update_options(sk, opt); |
3423 | done: |
3424 | - if (opt) |
3425 | - sock_kfree_s(sk, opt, opt->tot_len); |
3426 | + if (opt) { |
3427 | + atomic_sub(opt->tot_len, &sk->sk_omem_alloc); |
3428 | + txopt_put(opt); |
3429 | + } |
3430 | break; |
3431 | } |
3432 | case IPV6_UNICAST_HOPS: |
3433 | @@ -1092,10 +1103,11 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, |
3434 | case IPV6_RTHDR: |
3435 | case IPV6_DSTOPTS: |
3436 | { |
3437 | + struct ipv6_txoptions *opt; |
3438 | |
3439 | lock_sock(sk); |
3440 | - len = ipv6_getsockopt_sticky(sk, np->opt, |
3441 | - optname, optval, len); |
3442 | + opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk)); |
3443 | + len = ipv6_getsockopt_sticky(sk, opt, optname, optval, len); |
3444 | release_sock(sk); |
3445 | /* check if ipv6_getsockopt_sticky() returns err code */ |
3446 | if (len < 0) |
3447 | diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c |
3448 | index ed2c4e400b46..5aedf76fe287 100644 |
3449 | --- a/net/ipv6/mcast.c |
3450 | +++ b/net/ipv6/mcast.c |
3451 | @@ -1652,7 +1652,6 @@ out: |
3452 | if (!err) { |
3453 | ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT); |
3454 | ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); |
3455 | - IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, payload_len); |
3456 | } else { |
3457 | IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); |
3458 | } |
3459 | @@ -2015,7 +2014,6 @@ out: |
3460 | if (!err) { |
3461 | ICMP6MSGOUT_INC_STATS(net, idev, type); |
3462 | ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); |
3463 | - IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, full_len); |
3464 | } else |
3465 | IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); |
3466 | |
3467 | diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c |
3468 | index 6f187c8d8a1b..d235ed7f47ab 100644 |
3469 | --- a/net/ipv6/netfilter/nf_conntrack_reasm.c |
3470 | +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c |
3471 | @@ -190,7 +190,7 @@ static void nf_ct_frag6_expire(unsigned long data) |
3472 | /* Creation primitives. */ |
3473 | static inline struct frag_queue *fq_find(struct net *net, __be32 id, |
3474 | u32 user, struct in6_addr *src, |
3475 | - struct in6_addr *dst, u8 ecn) |
3476 | + struct in6_addr *dst, int iif, u8 ecn) |
3477 | { |
3478 | struct inet_frag_queue *q; |
3479 | struct ip6_create_arg arg; |
3480 | @@ -200,6 +200,7 @@ static inline struct frag_queue *fq_find(struct net *net, __be32 id, |
3481 | arg.user = user; |
3482 | arg.src = src; |
3483 | arg.dst = dst; |
3484 | + arg.iif = iif; |
3485 | arg.ecn = ecn; |
3486 | |
3487 | local_bh_disable(); |
3488 | @@ -603,7 +604,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user) |
3489 | fhdr = (struct frag_hdr *)skb_transport_header(clone); |
3490 | |
3491 | fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr, |
3492 | - ip6_frag_ecn(hdr)); |
3493 | + skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); |
3494 | if (fq == NULL) { |
3495 | pr_debug("Can't find and can't create new queue\n"); |
3496 | goto ret_orig; |
3497 | diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c |
3498 | index 896af8807979..a66a67d17ed6 100644 |
3499 | --- a/net/ipv6/raw.c |
3500 | +++ b/net/ipv6/raw.c |
3501 | @@ -735,6 +735,7 @@ static int rawv6_probe_proto_opt(struct flowi6 *fl6, struct msghdr *msg) |
3502 | static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk, |
3503 | struct msghdr *msg, size_t len) |
3504 | { |
3505 | + struct ipv6_txoptions *opt_to_free = NULL; |
3506 | struct ipv6_txoptions opt_space; |
3507 | DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name); |
3508 | struct in6_addr *daddr, *final_p, final; |
3509 | @@ -840,8 +841,10 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk, |
3510 | if (!(opt->opt_nflen|opt->opt_flen)) |
3511 | opt = NULL; |
3512 | } |
3513 | - if (opt == NULL) |
3514 | - opt = np->opt; |
3515 | + if (!opt) { |
3516 | + opt = txopt_get(np); |
3517 | + opt_to_free = opt; |
3518 | + } |
3519 | if (flowlabel) |
3520 | opt = fl6_merge_options(&opt_space, flowlabel, opt); |
3521 | opt = ipv6_fixup_options(&opt_space, opt); |
3522 | @@ -902,6 +905,7 @@ done: |
3523 | dst_release(dst); |
3524 | out: |
3525 | fl6_sock_release(flowlabel); |
3526 | + txopt_put(opt_to_free); |
3527 | return err < 0 ? err : len; |
3528 | do_confirm: |
3529 | dst_confirm(dst); |
3530 | diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c |
3531 | index 1a157ca2ebc1..28e72f396fde 100644 |
3532 | --- a/net/ipv6/reassembly.c |
3533 | +++ b/net/ipv6/reassembly.c |
3534 | @@ -108,7 +108,10 @@ bool ip6_frag_match(const struct inet_frag_queue *q, const void *a) |
3535 | return fq->id == arg->id && |
3536 | fq->user == arg->user && |
3537 | ipv6_addr_equal(&fq->saddr, arg->src) && |
3538 | - ipv6_addr_equal(&fq->daddr, arg->dst); |
3539 | + ipv6_addr_equal(&fq->daddr, arg->dst) && |
3540 | + (arg->iif == fq->iif || |
3541 | + !(ipv6_addr_type(arg->dst) & (IPV6_ADDR_MULTICAST | |
3542 | + IPV6_ADDR_LINKLOCAL))); |
3543 | } |
3544 | EXPORT_SYMBOL(ip6_frag_match); |
3545 | |
3546 | @@ -180,7 +183,7 @@ static void ip6_frag_expire(unsigned long data) |
3547 | |
3548 | static __inline__ struct frag_queue * |
3549 | fq_find(struct net *net, __be32 id, const struct in6_addr *src, |
3550 | - const struct in6_addr *dst, u8 ecn) |
3551 | + const struct in6_addr *dst, int iif, u8 ecn) |
3552 | { |
3553 | struct inet_frag_queue *q; |
3554 | struct ip6_create_arg arg; |
3555 | @@ -190,6 +193,7 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, |
3556 | arg.user = IP6_DEFRAG_LOCAL_DELIVER; |
3557 | arg.src = src; |
3558 | arg.dst = dst; |
3559 | + arg.iif = iif; |
3560 | arg.ecn = ecn; |
3561 | |
3562 | hash = inet6_hash_frag(id, src, dst); |
3563 | @@ -550,7 +554,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
3564 | } |
3565 | |
3566 | fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr, |
3567 | - ip6_frag_ecn(hdr)); |
3568 | + skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); |
3569 | if (fq != NULL) { |
3570 | int ret; |
3571 | |
3572 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c |
3573 | index a24557a1c1d8..45eae1e609d6 100644 |
3574 | --- a/net/ipv6/sit.c |
3575 | +++ b/net/ipv6/sit.c |
3576 | @@ -1394,34 +1394,20 @@ static int ipip6_tunnel_init(struct net_device *dev) |
3577 | return 0; |
3578 | } |
3579 | |
3580 | -static int __net_init ipip6_fb_tunnel_init(struct net_device *dev) |
3581 | +static void __net_init ipip6_fb_tunnel_init(struct net_device *dev) |
3582 | { |
3583 | struct ip_tunnel *tunnel = netdev_priv(dev); |
3584 | struct iphdr *iph = &tunnel->parms.iph; |
3585 | struct net *net = dev_net(dev); |
3586 | struct sit_net *sitn = net_generic(net, sit_net_id); |
3587 | |
3588 | - tunnel->dev = dev; |
3589 | - tunnel->net = dev_net(dev); |
3590 | - |
3591 | iph->version = 4; |
3592 | iph->protocol = IPPROTO_IPV6; |
3593 | iph->ihl = 5; |
3594 | iph->ttl = 64; |
3595 | |
3596 | - dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); |
3597 | - if (!dev->tstats) |
3598 | - return -ENOMEM; |
3599 | - |
3600 | - tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst); |
3601 | - if (!tunnel->dst_cache) { |
3602 | - free_percpu(dev->tstats); |
3603 | - return -ENOMEM; |
3604 | - } |
3605 | - |
3606 | dev_hold(dev); |
3607 | rcu_assign_pointer(sitn->tunnels_wc[0], tunnel); |
3608 | - return 0; |
3609 | } |
3610 | |
3611 | static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[]) |
3612 | @@ -1831,23 +1817,18 @@ static int __net_init sit_init_net(struct net *net) |
3613 | */ |
3614 | sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL; |
3615 | |
3616 | - err = ipip6_fb_tunnel_init(sitn->fb_tunnel_dev); |
3617 | - if (err) |
3618 | - goto err_dev_free; |
3619 | - |
3620 | - ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn); |
3621 | - |
3622 | if ((err = register_netdev(sitn->fb_tunnel_dev))) |
3623 | goto err_reg_dev; |
3624 | |
3625 | + ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn); |
3626 | + ipip6_fb_tunnel_init(sitn->fb_tunnel_dev); |
3627 | + |
3628 | t = netdev_priv(sitn->fb_tunnel_dev); |
3629 | |
3630 | strcpy(t->parms.name, sitn->fb_tunnel_dev->name); |
3631 | return 0; |
3632 | |
3633 | err_reg_dev: |
3634 | - dev_put(sitn->fb_tunnel_dev); |
3635 | -err_dev_free: |
3636 | ipip6_dev_free(sitn->fb_tunnel_dev); |
3637 | err_alloc_dev: |
3638 | return err; |
3639 | diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c |
3640 | index 2f25cb6347ca..aa9699301ea8 100644 |
3641 | --- a/net/ipv6/syncookies.c |
3642 | +++ b/net/ipv6/syncookies.c |
3643 | @@ -241,7 +241,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) |
3644 | memset(&fl6, 0, sizeof(fl6)); |
3645 | fl6.flowi6_proto = IPPROTO_TCP; |
3646 | fl6.daddr = ireq->ir_v6_rmt_addr; |
3647 | - final_p = fl6_update_dst(&fl6, np->opt, &final); |
3648 | + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); |
3649 | fl6.saddr = ireq->ir_v6_loc_addr; |
3650 | fl6.flowi6_oif = sk->sk_bound_dev_if; |
3651 | fl6.flowi6_mark = ireq->ir_mark; |
3652 | diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c |
3653 | index a3f9f11abf4c..26feadd0b763 100644 |
3654 | --- a/net/ipv6/tcp_ipv6.c |
3655 | +++ b/net/ipv6/tcp_ipv6.c |
3656 | @@ -134,6 +134,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, |
3657 | struct ipv6_pinfo *np = inet6_sk(sk); |
3658 | struct tcp_sock *tp = tcp_sk(sk); |
3659 | struct in6_addr *saddr = NULL, *final_p, final; |
3660 | + struct ipv6_txoptions *opt; |
3661 | struct rt6_info *rt; |
3662 | struct flowi6 fl6; |
3663 | struct dst_entry *dst; |
3664 | @@ -253,7 +254,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, |
3665 | fl6.fl6_dport = usin->sin6_port; |
3666 | fl6.fl6_sport = inet->inet_sport; |
3667 | |
3668 | - final_p = fl6_update_dst(&fl6, np->opt, &final); |
3669 | + opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk)); |
3670 | + final_p = fl6_update_dst(&fl6, opt, &final); |
3671 | |
3672 | security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); |
3673 | |
3674 | @@ -282,9 +284,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, |
3675 | tcp_fetch_timewait_stamp(sk, dst); |
3676 | |
3677 | icsk->icsk_ext_hdr_len = 0; |
3678 | - if (np->opt) |
3679 | - icsk->icsk_ext_hdr_len = (np->opt->opt_flen + |
3680 | - np->opt->opt_nflen); |
3681 | + if (opt) |
3682 | + icsk->icsk_ext_hdr_len = opt->opt_flen + |
3683 | + opt->opt_nflen; |
3684 | |
3685 | tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr); |
3686 | |
3687 | @@ -501,7 +503,8 @@ static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst, |
3688 | fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts)); |
3689 | |
3690 | skb_set_queue_mapping(skb, queue_mapping); |
3691 | - err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass); |
3692 | + err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt), |
3693 | + np->tclass); |
3694 | err = net_xmit_eval(err); |
3695 | } |
3696 | |
3697 | @@ -1052,6 +1055,7 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb, |
3698 | struct inet_request_sock *ireq; |
3699 | struct ipv6_pinfo *newnp, *np = inet6_sk(sk); |
3700 | struct tcp6_sock *newtcp6sk; |
3701 | + struct ipv6_txoptions *opt; |
3702 | struct inet_sock *newinet; |
3703 | struct tcp_sock *newtp; |
3704 | struct sock *newsk; |
3705 | @@ -1191,13 +1195,15 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb, |
3706 | but we make one more one thing there: reattach optmem |
3707 | to newsk. |
3708 | */ |
3709 | - if (np->opt) |
3710 | - newnp->opt = ipv6_dup_options(newsk, np->opt); |
3711 | - |
3712 | + opt = rcu_dereference(np->opt); |
3713 | + if (opt) { |
3714 | + opt = ipv6_dup_options(newsk, opt); |
3715 | + RCU_INIT_POINTER(newnp->opt, opt); |
3716 | + } |
3717 | inet_csk(newsk)->icsk_ext_hdr_len = 0; |
3718 | - if (newnp->opt) |
3719 | - inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen + |
3720 | - newnp->opt->opt_flen); |
3721 | + if (opt) |
3722 | + inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen + |
3723 | + opt->opt_flen; |
3724 | |
3725 | tcp_sync_mss(newsk, dst_mtu(dst)); |
3726 | newtp->advmss = dst_metric_advmss(dst); |
3727 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c |
3728 | index dd530f0e5a8a..a5ce70502699 100644 |
3729 | --- a/net/ipv6/udp.c |
3730 | +++ b/net/ipv6/udp.c |
3731 | @@ -1082,6 +1082,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk, |
3732 | DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name); |
3733 | struct in6_addr *daddr, *final_p, final; |
3734 | struct ipv6_txoptions *opt = NULL; |
3735 | + struct ipv6_txoptions *opt_to_free = NULL; |
3736 | struct ip6_flowlabel *flowlabel = NULL; |
3737 | struct flowi6 fl6; |
3738 | struct dst_entry *dst; |
3739 | @@ -1234,8 +1235,10 @@ do_udp_sendmsg: |
3740 | opt = NULL; |
3741 | connected = 0; |
3742 | } |
3743 | - if (opt == NULL) |
3744 | - opt = np->opt; |
3745 | + if (!opt) { |
3746 | + opt = txopt_get(np); |
3747 | + opt_to_free = opt; |
3748 | + } |
3749 | if (flowlabel) |
3750 | opt = fl6_merge_options(&opt_space, flowlabel, opt); |
3751 | opt = ipv6_fixup_options(&opt_space, opt); |
3752 | @@ -1329,6 +1332,7 @@ do_append_data: |
3753 | out: |
3754 | dst_release(dst); |
3755 | fl6_sock_release(flowlabel); |
3756 | + txopt_put(opt_to_free); |
3757 | if (!err) |
3758 | return len; |
3759 | /* |
3760 | diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c |
3761 | index a5f28d421ea8..c3a939d7848f 100644 |
3762 | --- a/net/irda/irlmp.c |
3763 | +++ b/net/irda/irlmp.c |
3764 | @@ -1877,7 +1877,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off) |
3765 | for (element = hashbin_get_first(iter->hashbin); |
3766 | element != NULL; |
3767 | element = hashbin_get_next(iter->hashbin)) { |
3768 | - if (!off || *off-- == 0) { |
3769 | + if (!off || (*off)-- == 0) { |
3770 | /* NB: hashbin left locked */ |
3771 | return element; |
3772 | } |
3773 | diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c |
3774 | index 895348e44c7d..508154a04558 100644 |
3775 | --- a/net/l2tp/l2tp_core.c |
3776 | +++ b/net/l2tp/l2tp_core.c |
3777 | @@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct work_struct *work) |
3778 | tunnel = container_of(work, struct l2tp_tunnel, del_work); |
3779 | sk = l2tp_tunnel_sock_lookup(tunnel); |
3780 | if (!sk) |
3781 | - return; |
3782 | + goto out; |
3783 | |
3784 | sock = sk->sk_socket; |
3785 | |
3786 | @@ -1340,6 +1340,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work) |
3787 | } |
3788 | |
3789 | l2tp_tunnel_sock_put(sk); |
3790 | +out: |
3791 | + l2tp_tunnel_dec_refcount(tunnel); |
3792 | } |
3793 | |
3794 | /* Create a socket for the tunnel, if one isn't set up by |
3795 | @@ -1639,8 +1641,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); |
3796 | */ |
3797 | int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) |
3798 | { |
3799 | + l2tp_tunnel_inc_refcount(tunnel); |
3800 | l2tp_tunnel_closeall(tunnel); |
3801 | - return (false == queue_work(l2tp_wq, &tunnel->del_work)); |
3802 | + if (false == queue_work(l2tp_wq, &tunnel->del_work)) { |
3803 | + l2tp_tunnel_dec_refcount(tunnel); |
3804 | + return 1; |
3805 | + } |
3806 | + return 0; |
3807 | } |
3808 | EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); |
3809 | |
3810 | diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c |
3811 | index 0edb263cc002..38658826175c 100644 |
3812 | --- a/net/l2tp/l2tp_ip6.c |
3813 | +++ b/net/l2tp/l2tp_ip6.c |
3814 | @@ -487,6 +487,7 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk, |
3815 | DECLARE_SOCKADDR(struct sockaddr_l2tpip6 *, lsa, msg->msg_name); |
3816 | struct in6_addr *daddr, *final_p, final; |
3817 | struct ipv6_pinfo *np = inet6_sk(sk); |
3818 | + struct ipv6_txoptions *opt_to_free = NULL; |
3819 | struct ipv6_txoptions *opt = NULL; |
3820 | struct ip6_flowlabel *flowlabel = NULL; |
3821 | struct dst_entry *dst = NULL; |
3822 | @@ -576,8 +577,10 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk, |
3823 | opt = NULL; |
3824 | } |
3825 | |
3826 | - if (opt == NULL) |
3827 | - opt = np->opt; |
3828 | + if (!opt) { |
3829 | + opt = txopt_get(np); |
3830 | + opt_to_free = opt; |
3831 | + } |
3832 | if (flowlabel) |
3833 | opt = fl6_merge_options(&opt_space, flowlabel, opt); |
3834 | opt = ipv6_fixup_options(&opt_space, opt); |
3835 | @@ -632,6 +635,7 @@ done: |
3836 | dst_release(dst); |
3837 | out: |
3838 | fl6_sock_release(flowlabel); |
3839 | + txopt_put(opt_to_free); |
3840 | |
3841 | return err < 0 ? err : len; |
3842 | |
3843 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
3844 | index bf6097793170..22853af1b6b7 100644 |
3845 | --- a/net/packet/af_packet.c |
3846 | +++ b/net/packet/af_packet.c |
3847 | @@ -1507,6 +1507,20 @@ static void fanout_release(struct sock *sk) |
3848 | mutex_unlock(&fanout_mutex); |
3849 | } |
3850 | |
3851 | +static bool packet_extra_vlan_len_allowed(const struct net_device *dev, |
3852 | + struct sk_buff *skb) |
3853 | +{ |
3854 | + /* Earlier code assumed this would be a VLAN pkt, double-check |
3855 | + * this now that we have the actual packet in hand. We can only |
3856 | + * do this check on Ethernet devices. |
3857 | + */ |
3858 | + if (unlikely(dev->type != ARPHRD_ETHER)) |
3859 | + return false; |
3860 | + |
3861 | + skb_reset_mac_header(skb); |
3862 | + return likely(eth_hdr(skb)->h_proto == htons(ETH_P_8021Q)); |
3863 | +} |
3864 | + |
3865 | static const struct proto_ops packet_ops; |
3866 | |
3867 | static const struct proto_ops packet_ops_spkt; |
3868 | @@ -1668,18 +1682,10 @@ retry: |
3869 | goto retry; |
3870 | } |
3871 | |
3872 | - if (len > (dev->mtu + dev->hard_header_len + extra_len)) { |
3873 | - /* Earlier code assumed this would be a VLAN pkt, |
3874 | - * double-check this now that we have the actual |
3875 | - * packet in hand. |
3876 | - */ |
3877 | - struct ethhdr *ehdr; |
3878 | - skb_reset_mac_header(skb); |
3879 | - ehdr = eth_hdr(skb); |
3880 | - if (ehdr->h_proto != htons(ETH_P_8021Q)) { |
3881 | - err = -EMSGSIZE; |
3882 | - goto out_unlock; |
3883 | - } |
3884 | + if (len > (dev->mtu + dev->hard_header_len + extra_len) && |
3885 | + !packet_extra_vlan_len_allowed(dev, skb)) { |
3886 | + err = -EMSGSIZE; |
3887 | + goto out_unlock; |
3888 | } |
3889 | |
3890 | skb->protocol = proto; |
3891 | @@ -2081,6 +2087,15 @@ static void tpacket_destruct_skb(struct sk_buff *skb) |
3892 | sock_wfree(skb); |
3893 | } |
3894 | |
3895 | +static void tpacket_set_protocol(const struct net_device *dev, |
3896 | + struct sk_buff *skb) |
3897 | +{ |
3898 | + if (dev->type == ARPHRD_ETHER) { |
3899 | + skb_reset_mac_header(skb); |
3900 | + skb->protocol = eth_hdr(skb)->h_proto; |
3901 | + } |
3902 | +} |
3903 | + |
3904 | static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, |
3905 | void *frame, struct net_device *dev, int size_max, |
3906 | __be16 proto, unsigned char *addr, int hlen) |
3907 | @@ -2117,8 +2132,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, |
3908 | skb_reserve(skb, hlen); |
3909 | skb_reset_network_header(skb); |
3910 | |
3911 | - if (!packet_use_direct_xmit(po)) |
3912 | - skb_probe_transport_header(skb, 0); |
3913 | if (unlikely(po->tp_tx_has_off)) { |
3914 | int off_min, off_max, off; |
3915 | off_min = po->tp_hdrlen - sizeof(struct sockaddr_ll); |
3916 | @@ -2168,6 +2181,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, |
3917 | dev->hard_header_len); |
3918 | if (unlikely(err)) |
3919 | return err; |
3920 | + if (!skb->protocol) |
3921 | + tpacket_set_protocol(dev, skb); |
3922 | |
3923 | data += dev->hard_header_len; |
3924 | to_write -= dev->hard_header_len; |
3925 | @@ -2202,6 +2217,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, |
3926 | len = ((to_write > len_max) ? len_max : to_write); |
3927 | } |
3928 | |
3929 | + skb_probe_transport_header(skb, 0); |
3930 | + |
3931 | return tp_len; |
3932 | } |
3933 | |
3934 | @@ -2246,12 +2263,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) |
3935 | if (unlikely(!(dev->flags & IFF_UP))) |
3936 | goto out_put; |
3937 | |
3938 | - reserve = dev->hard_header_len + VLAN_HLEN; |
3939 | + if (po->sk.sk_socket->type == SOCK_RAW) |
3940 | + reserve = dev->hard_header_len; |
3941 | size_max = po->tx_ring.frame_size |
3942 | - (po->tp_hdrlen - sizeof(struct sockaddr_ll)); |
3943 | |
3944 | - if (size_max > dev->mtu + reserve) |
3945 | - size_max = dev->mtu + reserve; |
3946 | + if (size_max > dev->mtu + reserve + VLAN_HLEN) |
3947 | + size_max = dev->mtu + reserve + VLAN_HLEN; |
3948 | |
3949 | do { |
3950 | ph = packet_current_frame(po, &po->tx_ring, |
3951 | @@ -2274,18 +2292,11 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) |
3952 | |
3953 | tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto, |
3954 | addr, hlen); |
3955 | - if (tp_len > dev->mtu + dev->hard_header_len) { |
3956 | - struct ethhdr *ehdr; |
3957 | - /* Earlier code assumed this would be a VLAN pkt, |
3958 | - * double-check this now that we have the actual |
3959 | - * packet in hand. |
3960 | - */ |
3961 | + if (likely(tp_len >= 0) && |
3962 | + tp_len > dev->mtu + reserve && |
3963 | + !packet_extra_vlan_len_allowed(dev, skb)) |
3964 | + tp_len = -EMSGSIZE; |
3965 | |
3966 | - skb_reset_mac_header(skb); |
3967 | - ehdr = eth_hdr(skb); |
3968 | - if (ehdr->h_proto != htons(ETH_P_8021Q)) |
3969 | - tp_len = -EMSGSIZE; |
3970 | - } |
3971 | if (unlikely(tp_len < 0)) { |
3972 | if (po->tp_loss) { |
3973 | __packet_set_status(po, ph, |
3974 | @@ -2497,18 +2508,10 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
3975 | |
3976 | sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags); |
3977 | |
3978 | - if (!gso_type && (len > dev->mtu + reserve + extra_len)) { |
3979 | - /* Earlier code assumed this would be a VLAN pkt, |
3980 | - * double-check this now that we have the actual |
3981 | - * packet in hand. |
3982 | - */ |
3983 | - struct ethhdr *ehdr; |
3984 | - skb_reset_mac_header(skb); |
3985 | - ehdr = eth_hdr(skb); |
3986 | - if (ehdr->h_proto != htons(ETH_P_8021Q)) { |
3987 | - err = -EMSGSIZE; |
3988 | - goto out_free; |
3989 | - } |
3990 | + if (!gso_type && (len > dev->mtu + reserve + extra_len) && |
3991 | + !packet_extra_vlan_len_allowed(dev, skb)) { |
3992 | + err = -EMSGSIZE; |
3993 | + goto out_free; |
3994 | } |
3995 | |
3996 | skb->protocol = proto; |
3997 | @@ -2537,8 +2540,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
3998 | len += vnet_hdr_len; |
3999 | } |
4000 | |
4001 | - if (!packet_use_direct_xmit(po)) |
4002 | - skb_probe_transport_header(skb, reserve); |
4003 | + skb_probe_transport_header(skb, reserve); |
4004 | + |
4005 | if (unlikely(extra_len == 4)) |
4006 | skb->no_fcs = 1; |
4007 | |
4008 | @@ -2642,22 +2645,40 @@ static int packet_release(struct socket *sock) |
4009 | * Attach a packet hook. |
4010 | */ |
4011 | |
4012 | -static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) |
4013 | +static int packet_do_bind(struct sock *sk, const char *name, int ifindex, |
4014 | + __be16 proto) |
4015 | { |
4016 | struct packet_sock *po = pkt_sk(sk); |
4017 | struct net_device *dev_curr; |
4018 | __be16 proto_curr; |
4019 | bool need_rehook; |
4020 | + struct net_device *dev = NULL; |
4021 | + int ret = 0; |
4022 | + bool unlisted = false; |
4023 | |
4024 | - if (po->fanout) { |
4025 | - if (dev) |
4026 | - dev_put(dev); |
4027 | - |
4028 | + if (po->fanout) |
4029 | return -EINVAL; |
4030 | - } |
4031 | |
4032 | lock_sock(sk); |
4033 | spin_lock(&po->bind_lock); |
4034 | + rcu_read_lock(); |
4035 | + |
4036 | + if (name) { |
4037 | + dev = dev_get_by_name_rcu(sock_net(sk), name); |
4038 | + if (!dev) { |
4039 | + ret = -ENODEV; |
4040 | + goto out_unlock; |
4041 | + } |
4042 | + } else if (ifindex) { |
4043 | + dev = dev_get_by_index_rcu(sock_net(sk), ifindex); |
4044 | + if (!dev) { |
4045 | + ret = -ENODEV; |
4046 | + goto out_unlock; |
4047 | + } |
4048 | + } |
4049 | + |
4050 | + if (dev) |
4051 | + dev_hold(dev); |
4052 | |
4053 | proto_curr = po->prot_hook.type; |
4054 | dev_curr = po->prot_hook.dev; |
4055 | @@ -2665,14 +2686,29 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) |
4056 | need_rehook = proto_curr != proto || dev_curr != dev; |
4057 | |
4058 | if (need_rehook) { |
4059 | - unregister_prot_hook(sk, true); |
4060 | + if (po->running) { |
4061 | + rcu_read_unlock(); |
4062 | + __unregister_prot_hook(sk, true); |
4063 | + rcu_read_lock(); |
4064 | + dev_curr = po->prot_hook.dev; |
4065 | + if (dev) |
4066 | + unlisted = !dev_get_by_index_rcu(sock_net(sk), |
4067 | + dev->ifindex); |
4068 | + } |
4069 | |
4070 | po->num = proto; |
4071 | po->prot_hook.type = proto; |
4072 | - po->prot_hook.dev = dev; |
4073 | |
4074 | - po->ifindex = dev ? dev->ifindex : 0; |
4075 | - packet_cached_dev_assign(po, dev); |
4076 | + if (unlikely(unlisted)) { |
4077 | + dev_put(dev); |
4078 | + po->prot_hook.dev = NULL; |
4079 | + po->ifindex = -1; |
4080 | + packet_cached_dev_reset(po); |
4081 | + } else { |
4082 | + po->prot_hook.dev = dev; |
4083 | + po->ifindex = dev ? dev->ifindex : 0; |
4084 | + packet_cached_dev_assign(po, dev); |
4085 | + } |
4086 | } |
4087 | if (dev_curr) |
4088 | dev_put(dev_curr); |
4089 | @@ -2680,7 +2716,7 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) |
4090 | if (proto == 0 || !need_rehook) |
4091 | goto out_unlock; |
4092 | |
4093 | - if (!dev || (dev->flags & IFF_UP)) { |
4094 | + if (!unlisted && (!dev || (dev->flags & IFF_UP))) { |
4095 | register_prot_hook(sk); |
4096 | } else { |
4097 | sk->sk_err = ENETDOWN; |
4098 | @@ -2689,9 +2725,10 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) |
4099 | } |
4100 | |
4101 | out_unlock: |
4102 | + rcu_read_unlock(); |
4103 | spin_unlock(&po->bind_lock); |
4104 | release_sock(sk); |
4105 | - return 0; |
4106 | + return ret; |
4107 | } |
4108 | |
4109 | /* |
4110 | @@ -2703,8 +2740,6 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, |
4111 | { |
4112 | struct sock *sk = sock->sk; |
4113 | char name[15]; |
4114 | - struct net_device *dev; |
4115 | - int err = -ENODEV; |
4116 | |
4117 | /* |
4118 | * Check legality |
4119 | @@ -2714,19 +2749,13 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, |
4120 | return -EINVAL; |
4121 | strlcpy(name, uaddr->sa_data, sizeof(name)); |
4122 | |
4123 | - dev = dev_get_by_name(sock_net(sk), name); |
4124 | - if (dev) |
4125 | - err = packet_do_bind(sk, dev, pkt_sk(sk)->num); |
4126 | - return err; |
4127 | + return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); |
4128 | } |
4129 | |
4130 | static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) |
4131 | { |
4132 | struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr; |
4133 | struct sock *sk = sock->sk; |
4134 | - struct net_device *dev = NULL; |
4135 | - int err; |
4136 | - |
4137 | |
4138 | /* |
4139 | * Check legality |
4140 | @@ -2737,16 +2766,8 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len |
4141 | if (sll->sll_family != AF_PACKET) |
4142 | return -EINVAL; |
4143 | |
4144 | - if (sll->sll_ifindex) { |
4145 | - err = -ENODEV; |
4146 | - dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex); |
4147 | - if (dev == NULL) |
4148 | - goto out; |
4149 | - } |
4150 | - err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num); |
4151 | - |
4152 | -out: |
4153 | - return err; |
4154 | + return packet_do_bind(sk, NULL, sll->sll_ifindex, |
4155 | + sll->sll_protocol ? : pkt_sk(sk)->num); |
4156 | } |
4157 | |
4158 | static struct proto packet_proto = { |
4159 | diff --git a/net/rds/connection.c b/net/rds/connection.c |
4160 | index 378c3a6acf84..f5fb7d6b7c41 100644 |
4161 | --- a/net/rds/connection.c |
4162 | +++ b/net/rds/connection.c |
4163 | @@ -183,6 +183,12 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr, |
4164 | } |
4165 | } |
4166 | |
4167 | + if (trans == NULL) { |
4168 | + kmem_cache_free(rds_conn_slab, conn); |
4169 | + conn = ERR_PTR(-ENODEV); |
4170 | + goto out; |
4171 | + } |
4172 | + |
4173 | conn->c_trans = trans; |
4174 | |
4175 | ret = trans->conn_alloc(conn, gfp); |
4176 | diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c |
4177 | index 9ae6e0a264ec..2dd88db4a1a2 100644 |
4178 | --- a/net/rds/tcp_recv.c |
4179 | +++ b/net/rds/tcp_recv.c |
4180 | @@ -234,8 +234,15 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb, |
4181 | } |
4182 | |
4183 | to_copy = min(tc->t_tinc_data_rem, left); |
4184 | - pskb_pull(clone, offset); |
4185 | - pskb_trim(clone, to_copy); |
4186 | + if (!pskb_pull(clone, offset) || |
4187 | + pskb_trim(clone, to_copy)) { |
4188 | + pr_warn("rds_tcp_data_recv: pull/trim failed " |
4189 | + "left %zu data_rem %zu skb_len %d\n", |
4190 | + left, tc->t_tinc_data_rem, skb->len); |
4191 | + kfree_skb(clone); |
4192 | + desc->error = -ENOMEM; |
4193 | + goto out; |
4194 | + } |
4195 | skb_queue_tail(&tinc->ti_skb_list, clone); |
4196 | |
4197 | rdsdebug("skb %p data %p len %d off %u to_copy %zu -> " |
4198 | diff --git a/net/sctp/auth.c b/net/sctp/auth.c |
4199 | index fb7976aee61c..603c3bbc5923 100644 |
4200 | --- a/net/sctp/auth.c |
4201 | +++ b/net/sctp/auth.c |
4202 | @@ -800,8 +800,8 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep, |
4203 | if (!has_sha1) |
4204 | return -EINVAL; |
4205 | |
4206 | - memcpy(ep->auth_hmacs_list->hmac_ids, &hmacs->shmac_idents[0], |
4207 | - hmacs->shmac_num_idents * sizeof(__u16)); |
4208 | + for (i = 0; i < hmacs->shmac_num_idents; i++) |
4209 | + ep->auth_hmacs_list->hmac_ids[i] = htons(hmacs->shmac_idents[i]); |
4210 | ep->auth_hmacs_list->param_hdr.length = htons(sizeof(sctp_paramhdr_t) + |
4211 | hmacs->shmac_num_idents * sizeof(__u16)); |
4212 | return 0; |
4213 | diff --git a/net/sctp/socket.c b/net/sctp/socket.c |
4214 | index 99e640c46ab2..fb082aa4d656 100644 |
4215 | --- a/net/sctp/socket.c |
4216 | +++ b/net/sctp/socket.c |
4217 | @@ -7393,6 +7393,13 @@ struct proto sctp_prot = { |
4218 | |
4219 | #if IS_ENABLED(CONFIG_IPV6) |
4220 | |
4221 | +#include <net/transp_v6.h> |
4222 | +static void sctp_v6_destroy_sock(struct sock *sk) |
4223 | +{ |
4224 | + sctp_destroy_sock(sk); |
4225 | + inet6_destroy_sock(sk); |
4226 | +} |
4227 | + |
4228 | struct proto sctpv6_prot = { |
4229 | .name = "SCTPv6", |
4230 | .owner = THIS_MODULE, |
4231 | @@ -7402,7 +7409,7 @@ struct proto sctpv6_prot = { |
4232 | .accept = sctp_accept, |
4233 | .ioctl = sctp_ioctl, |
4234 | .init = sctp_init_sock, |
4235 | - .destroy = sctp_destroy_sock, |
4236 | + .destroy = sctp_v6_destroy_sock, |
4237 | .shutdown = sctp_shutdown, |
4238 | .setsockopt = sctp_setsockopt, |
4239 | .getsockopt = sctp_getsockopt, |
4240 | diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c |
4241 | index 8232118b3f82..2ae4a5915aa7 100644 |
4242 | --- a/net/unix/af_unix.c |
4243 | +++ b/net/unix/af_unix.c |
4244 | @@ -1962,6 +1962,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, |
4245 | goto out; |
4246 | } |
4247 | |
4248 | + if (flags & MSG_PEEK) |
4249 | + skip = sk_peek_offset(sk, flags); |
4250 | + else |
4251 | + skip = 0; |
4252 | + |
4253 | do { |
4254 | int chunk; |
4255 | struct sk_buff *skb, *last; |
4256 | @@ -2008,7 +2013,6 @@ again: |
4257 | break; |
4258 | } |
4259 | |
4260 | - skip = sk_peek_offset(sk, flags); |
4261 | while (skip >= unix_skb_len(skb)) { |
4262 | skip -= unix_skb_len(skb); |
4263 | last = skb; |
4264 | @@ -2072,6 +2076,16 @@ again: |
4265 | |
4266 | sk_peek_offset_fwd(sk, chunk); |
4267 | |
4268 | + if (UNIXCB(skb).fp) |
4269 | + break; |
4270 | + |
4271 | + skip = 0; |
4272 | + last = skb; |
4273 | + unix_state_lock(sk); |
4274 | + skb = skb_peek_next(skb, &sk->sk_receive_queue); |
4275 | + if (skb) |
4276 | + goto again; |
4277 | + unix_state_unlock(sk); |
4278 | break; |
4279 | } |
4280 | } while (size); |
4281 | diff --git a/security/keys/gc.c b/security/keys/gc.c |
4282 | index c7952375ac53..addf060399e0 100644 |
4283 | --- a/security/keys/gc.c |
4284 | +++ b/security/keys/gc.c |
4285 | @@ -134,6 +134,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys) |
4286 | kdebug("- %u", key->serial); |
4287 | key_check(key); |
4288 | |
4289 | + /* Throw away the key data if the key is instantiated */ |
4290 | + if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) && |
4291 | + !test_bit(KEY_FLAG_NEGATIVE, &key->flags) && |
4292 | + key->type->destroy) |
4293 | + key->type->destroy(key); |
4294 | + |
4295 | security_key_free(key); |
4296 | |
4297 | /* deal with the user's key tracking and quota */ |
4298 | @@ -148,10 +154,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys) |
4299 | if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) |
4300 | atomic_dec(&key->user->nikeys); |
4301 | |
4302 | - /* now throw away the key memory */ |
4303 | - if (key->type->destroy) |
4304 | - key->type->destroy(key); |
4305 | - |
4306 | key_user_put(key->user); |
4307 | |
4308 | kfree(key->description); |
4309 | diff --git a/tools/net/Makefile b/tools/net/Makefile |
4310 | index ee577ea03ba5..ddf888010652 100644 |
4311 | --- a/tools/net/Makefile |
4312 | +++ b/tools/net/Makefile |
4313 | @@ -4,6 +4,9 @@ CC = gcc |
4314 | LEX = flex |
4315 | YACC = bison |
4316 | |
4317 | +CFLAGS += -Wall -O2 |
4318 | +CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include |
4319 | + |
4320 | %.yacc.c: %.y |
4321 | $(YACC) -o $@ -d $< |
4322 | |
4323 | @@ -12,15 +15,13 @@ YACC = bison |
4324 | |
4325 | all : bpf_jit_disasm bpf_dbg bpf_asm |
4326 | |
4327 | -bpf_jit_disasm : CFLAGS = -Wall -O2 -DPACKAGE='bpf_jit_disasm' |
4328 | +bpf_jit_disasm : CFLAGS += -DPACKAGE='bpf_jit_disasm' |
4329 | bpf_jit_disasm : LDLIBS = -lopcodes -lbfd -ldl |
4330 | bpf_jit_disasm : bpf_jit_disasm.o |
4331 | |
4332 | -bpf_dbg : CFLAGS = -Wall -O2 |
4333 | bpf_dbg : LDLIBS = -lreadline |
4334 | bpf_dbg : bpf_dbg.o |
4335 | |
4336 | -bpf_asm : CFLAGS = -Wall -O2 -I. |
4337 | bpf_asm : LDLIBS = |
4338 | bpf_asm : bpf_asm.o bpf_exp.yacc.o bpf_exp.lex.o |
4339 | bpf_exp.lex.o : bpf_exp.yacc.c |