Contents of /trunk/kernel-alx/patches-4.1/0115-4.1.16-all-fixes.patch
Parent Directory | Revision Log
Revision 2757 -
(show annotations)
(download)
Wed Jan 27 10:46:59 2016 UTC (8 years, 8 months ago) by niro
File size: 45588 byte(s)
Wed Jan 27 10:46:59 2016 UTC (8 years, 8 months ago) by niro
File size: 45588 byte(s)
-linux-4.1.16
1 | diff --git a/Makefile b/Makefile |
2 | index cf35f6bcffd8..7609f1dcdcb9 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 1 |
8 | -SUBLEVEL = 15 |
9 | +SUBLEVEL = 16 |
10 | EXTRAVERSION = |
11 | NAME = Series 4800 |
12 | |
13 | diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h |
14 | index f8319a0860fd..39be5acc9c48 100644 |
15 | --- a/drivers/char/tpm/tpm.h |
16 | +++ b/drivers/char/tpm/tpm.h |
17 | @@ -115,6 +115,13 @@ enum tpm2_startup_types { |
18 | TPM2_SU_STATE = 0x0001, |
19 | }; |
20 | |
21 | +enum tpm2_start_method { |
22 | + TPM2_START_ACPI = 2, |
23 | + TPM2_START_FIFO = 6, |
24 | + TPM2_START_CRB = 7, |
25 | + TPM2_START_CRB_WITH_ACPI = 8, |
26 | +}; |
27 | + |
28 | struct tpm_chip; |
29 | |
30 | struct tpm_vendor_specific { |
31 | diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c |
32 | index 1267322595da..2b971b3e5c1c 100644 |
33 | --- a/drivers/char/tpm/tpm_crb.c |
34 | +++ b/drivers/char/tpm/tpm_crb.c |
35 | @@ -34,12 +34,6 @@ enum crb_defaults { |
36 | CRB_ACPI_START_INDEX = 1, |
37 | }; |
38 | |
39 | -enum crb_start_method { |
40 | - CRB_SM_ACPI_START = 2, |
41 | - CRB_SM_CRB = 7, |
42 | - CRB_SM_CRB_WITH_ACPI_START = 8, |
43 | -}; |
44 | - |
45 | struct acpi_tpm2 { |
46 | struct acpi_table_header hdr; |
47 | u16 platform_class; |
48 | @@ -220,12 +214,6 @@ static int crb_acpi_add(struct acpi_device *device) |
49 | u64 pa; |
50 | int rc; |
51 | |
52 | - chip = tpmm_chip_alloc(dev, &tpm_crb); |
53 | - if (IS_ERR(chip)) |
54 | - return PTR_ERR(chip); |
55 | - |
56 | - chip->flags = TPM_CHIP_FLAG_TPM2; |
57 | - |
58 | status = acpi_get_table(ACPI_SIG_TPM2, 1, |
59 | (struct acpi_table_header **) &buf); |
60 | if (ACPI_FAILURE(status)) { |
61 | @@ -233,13 +221,15 @@ static int crb_acpi_add(struct acpi_device *device) |
62 | return -ENODEV; |
63 | } |
64 | |
65 | - /* At least some versions of AMI BIOS have a bug that TPM2 table has |
66 | - * zero address for the control area and therefore we must fail. |
67 | - */ |
68 | - if (!buf->control_area_pa) { |
69 | - dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n"); |
70 | - return -EINVAL; |
71 | - } |
72 | + /* Should the FIFO driver handle this? */ |
73 | + if (buf->start_method == TPM2_START_FIFO) |
74 | + return -ENODEV; |
75 | + |
76 | + chip = tpmm_chip_alloc(dev, &tpm_crb); |
77 | + if (IS_ERR(chip)) |
78 | + return PTR_ERR(chip); |
79 | + |
80 | + chip->flags = TPM_CHIP_FLAG_TPM2; |
81 | |
82 | if (buf->hdr.length < sizeof(struct acpi_tpm2)) { |
83 | dev_err(dev, "TPM2 ACPI table has wrong size"); |
84 | @@ -259,11 +249,11 @@ static int crb_acpi_add(struct acpi_device *device) |
85 | * report only ACPI start but in practice seems to require both |
86 | * ACPI start and CRB start. |
87 | */ |
88 | - if (sm == CRB_SM_CRB || sm == CRB_SM_CRB_WITH_ACPI_START || |
89 | + if (sm == TPM2_START_CRB || sm == TPM2_START_FIFO || |
90 | !strcmp(acpi_device_hid(device), "MSFT0101")) |
91 | priv->flags |= CRB_FL_CRB_START; |
92 | |
93 | - if (sm == CRB_SM_ACPI_START || sm == CRB_SM_CRB_WITH_ACPI_START) |
94 | + if (sm == TPM2_START_ACPI || sm == TPM2_START_CRB_WITH_ACPI) |
95 | priv->flags |= CRB_FL_ACPI_START; |
96 | |
97 | priv->cca = (struct crb_control_area __iomem *) |
98 | diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c |
99 | index f2dffa770b8e..696ef1d56b4f 100644 |
100 | --- a/drivers/char/tpm/tpm_tis.c |
101 | +++ b/drivers/char/tpm/tpm_tis.c |
102 | @@ -1,6 +1,6 @@ |
103 | /* |
104 | * Copyright (C) 2005, 2006 IBM Corporation |
105 | - * Copyright (C) 2014 Intel Corporation |
106 | + * Copyright (C) 2014, 2015 Intel Corporation |
107 | * |
108 | * Authors: |
109 | * Leendert van Doorn <leendert@watson.ibm.com> |
110 | @@ -28,6 +28,7 @@ |
111 | #include <linux/wait.h> |
112 | #include <linux/acpi.h> |
113 | #include <linux/freezer.h> |
114 | +#include <acpi/actbl2.h> |
115 | #include "tpm.h" |
116 | |
117 | enum tis_access { |
118 | @@ -65,6 +66,17 @@ enum tis_defaults { |
119 | TIS_LONG_TIMEOUT = 2000, /* 2 sec */ |
120 | }; |
121 | |
122 | +struct tpm_info { |
123 | + unsigned long start; |
124 | + unsigned long len; |
125 | + unsigned int irq; |
126 | +}; |
127 | + |
128 | +static struct tpm_info tis_default_info = { |
129 | + .start = TIS_MEM_BASE, |
130 | + .len = TIS_MEM_LEN, |
131 | + .irq = 0, |
132 | +}; |
133 | |
134 | /* Some timeout values are needed before it is known whether the chip is |
135 | * TPM 1.0 or TPM 2.0. |
136 | @@ -91,26 +103,54 @@ struct priv_data { |
137 | }; |
138 | |
139 | #if defined(CONFIG_PNP) && defined(CONFIG_ACPI) |
140 | -static int is_itpm(struct pnp_dev *dev) |
141 | +static int has_hid(struct acpi_device *dev, const char *hid) |
142 | { |
143 | - struct acpi_device *acpi = pnp_acpi_device(dev); |
144 | struct acpi_hardware_id *id; |
145 | |
146 | - if (!acpi) |
147 | - return 0; |
148 | - |
149 | - list_for_each_entry(id, &acpi->pnp.ids, list) { |
150 | - if (!strcmp("INTC0102", id->id)) |
151 | + list_for_each_entry(id, &dev->pnp.ids, list) |
152 | + if (!strcmp(hid, id->id)) |
153 | return 1; |
154 | - } |
155 | |
156 | return 0; |
157 | } |
158 | + |
159 | +static inline int is_itpm(struct acpi_device *dev) |
160 | +{ |
161 | + return has_hid(dev, "INTC0102"); |
162 | +} |
163 | + |
164 | +static inline int is_fifo(struct acpi_device *dev) |
165 | +{ |
166 | + struct acpi_table_tpm2 *tbl; |
167 | + acpi_status st; |
168 | + |
169 | + /* TPM 1.2 FIFO */ |
170 | + if (!has_hid(dev, "MSFT0101")) |
171 | + return 1; |
172 | + |
173 | + st = acpi_get_table(ACPI_SIG_TPM2, 1, |
174 | + (struct acpi_table_header **) &tbl); |
175 | + if (ACPI_FAILURE(st)) { |
176 | + dev_err(&dev->dev, "failed to get TPM2 ACPI table\n"); |
177 | + return 0; |
178 | + } |
179 | + |
180 | + if (le32_to_cpu(tbl->start_method) != TPM2_START_FIFO) |
181 | + return 0; |
182 | + |
183 | + /* TPM 2.0 FIFO */ |
184 | + return 1; |
185 | +} |
186 | #else |
187 | -static inline int is_itpm(struct pnp_dev *dev) |
188 | +static inline int is_itpm(struct acpi_device *dev) |
189 | { |
190 | return 0; |
191 | } |
192 | + |
193 | +static inline int is_fifo(struct acpi_device *dev) |
194 | +{ |
195 | + return 1; |
196 | +} |
197 | #endif |
198 | |
199 | /* Before we attempt to access the TPM we must see that the valid bit is set. |
200 | @@ -600,9 +640,8 @@ static void tpm_tis_remove(struct tpm_chip *chip) |
201 | release_locality(chip, chip->vendor.locality, 1); |
202 | } |
203 | |
204 | -static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle, |
205 | - resource_size_t start, resource_size_t len, |
206 | - unsigned int irq) |
207 | +static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info, |
208 | + acpi_handle acpi_dev_handle) |
209 | { |
210 | u32 vendor, intfcaps, intmask; |
211 | int rc, i, irq_s, irq_e, probe; |
212 | @@ -622,7 +661,7 @@ static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle, |
213 | chip->acpi_dev_handle = acpi_dev_handle; |
214 | #endif |
215 | |
216 | - chip->vendor.iobase = devm_ioremap(dev, start, len); |
217 | + chip->vendor.iobase = devm_ioremap(dev, tpm_info->start, tpm_info->len); |
218 | if (!chip->vendor.iobase) |
219 | return -EIO; |
220 | |
221 | @@ -707,7 +746,7 @@ static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle, |
222 | chip->vendor.iobase + |
223 | TPM_INT_ENABLE(chip->vendor.locality)); |
224 | if (interrupts) |
225 | - chip->vendor.irq = irq; |
226 | + chip->vendor.irq = tpm_info->irq; |
227 | if (interrupts && !chip->vendor.irq) { |
228 | irq_s = |
229 | ioread8(chip->vendor.iobase + |
230 | @@ -890,27 +929,27 @@ static SIMPLE_DEV_PM_OPS(tpm_tis_pm, tpm_pm_suspend, tpm_tis_resume); |
231 | static int tpm_tis_pnp_init(struct pnp_dev *pnp_dev, |
232 | const struct pnp_device_id *pnp_id) |
233 | { |
234 | - resource_size_t start, len; |
235 | - unsigned int irq = 0; |
236 | + struct tpm_info tpm_info = tis_default_info; |
237 | acpi_handle acpi_dev_handle = NULL; |
238 | |
239 | - start = pnp_mem_start(pnp_dev, 0); |
240 | - len = pnp_mem_len(pnp_dev, 0); |
241 | + tpm_info.start = pnp_mem_start(pnp_dev, 0); |
242 | + tpm_info.len = pnp_mem_len(pnp_dev, 0); |
243 | |
244 | if (pnp_irq_valid(pnp_dev, 0)) |
245 | - irq = pnp_irq(pnp_dev, 0); |
246 | + tpm_info.irq = pnp_irq(pnp_dev, 0); |
247 | else |
248 | interrupts = false; |
249 | |
250 | - if (is_itpm(pnp_dev)) |
251 | - itpm = true; |
252 | - |
253 | #ifdef CONFIG_ACPI |
254 | - if (pnp_acpi_device(pnp_dev)) |
255 | + if (pnp_acpi_device(pnp_dev)) { |
256 | + if (is_itpm(pnp_acpi_device(pnp_dev))) |
257 | + itpm = true; |
258 | + |
259 | acpi_dev_handle = pnp_acpi_device(pnp_dev)->handle; |
260 | + } |
261 | #endif |
262 | |
263 | - return tpm_tis_init(&pnp_dev->dev, acpi_dev_handle, start, len, irq); |
264 | + return tpm_tis_init(&pnp_dev->dev, &tpm_info, acpi_dev_handle); |
265 | } |
266 | |
267 | static struct pnp_device_id tpm_pnp_tbl[] = { |
268 | @@ -930,6 +969,7 @@ MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl); |
269 | static void tpm_tis_pnp_remove(struct pnp_dev *dev) |
270 | { |
271 | struct tpm_chip *chip = pnp_get_drvdata(dev); |
272 | + |
273 | tpm_chip_unregister(chip); |
274 | tpm_tis_remove(chip); |
275 | } |
276 | @@ -950,6 +990,79 @@ module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id, |
277 | MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe"); |
278 | #endif |
279 | |
280 | +#ifdef CONFIG_ACPI |
281 | +static int tpm_check_resource(struct acpi_resource *ares, void *data) |
282 | +{ |
283 | + struct tpm_info *tpm_info = (struct tpm_info *) data; |
284 | + struct resource res; |
285 | + |
286 | + if (acpi_dev_resource_interrupt(ares, 0, &res)) { |
287 | + tpm_info->irq = res.start; |
288 | + } else if (acpi_dev_resource_memory(ares, &res)) { |
289 | + tpm_info->start = res.start; |
290 | + tpm_info->len = resource_size(&res); |
291 | + } |
292 | + |
293 | + return 1; |
294 | +} |
295 | + |
296 | +static int tpm_tis_acpi_init(struct acpi_device *acpi_dev) |
297 | +{ |
298 | + struct list_head resources; |
299 | + struct tpm_info tpm_info = tis_default_info; |
300 | + int ret; |
301 | + |
302 | + if (!is_fifo(acpi_dev)) |
303 | + return -ENODEV; |
304 | + |
305 | + INIT_LIST_HEAD(&resources); |
306 | + ret = acpi_dev_get_resources(acpi_dev, &resources, tpm_check_resource, |
307 | + &tpm_info); |
308 | + if (ret < 0) |
309 | + return ret; |
310 | + |
311 | + acpi_dev_free_resource_list(&resources); |
312 | + |
313 | + if (!tpm_info.irq) |
314 | + interrupts = false; |
315 | + |
316 | + if (is_itpm(acpi_dev)) |
317 | + itpm = true; |
318 | + |
319 | + return tpm_tis_init(&acpi_dev->dev, &tpm_info, acpi_dev->handle); |
320 | +} |
321 | + |
322 | +static int tpm_tis_acpi_remove(struct acpi_device *dev) |
323 | +{ |
324 | + struct tpm_chip *chip = dev_get_drvdata(&dev->dev); |
325 | + |
326 | + tpm_chip_unregister(chip); |
327 | + tpm_tis_remove(chip); |
328 | + |
329 | + return 0; |
330 | +} |
331 | + |
332 | +static struct acpi_device_id tpm_acpi_tbl[] = { |
333 | + {"MSFT0101", 0}, /* TPM 2.0 */ |
334 | + /* Add new here */ |
335 | + {"", 0}, /* User Specified */ |
336 | + {"", 0} /* Terminator */ |
337 | +}; |
338 | +MODULE_DEVICE_TABLE(acpi, tpm_acpi_tbl); |
339 | + |
340 | +static struct acpi_driver tis_acpi_driver = { |
341 | + .name = "tpm_tis", |
342 | + .ids = tpm_acpi_tbl, |
343 | + .ops = { |
344 | + .add = tpm_tis_acpi_init, |
345 | + .remove = tpm_tis_acpi_remove, |
346 | + }, |
347 | + .drv = { |
348 | + .pm = &tpm_tis_pm, |
349 | + }, |
350 | +}; |
351 | +#endif |
352 | + |
353 | static struct platform_driver tis_drv = { |
354 | .driver = { |
355 | .name = "tpm_tis", |
356 | @@ -966,9 +1079,25 @@ static int __init init_tis(void) |
357 | { |
358 | int rc; |
359 | #ifdef CONFIG_PNP |
360 | - if (!force) |
361 | - return pnp_register_driver(&tis_pnp_driver); |
362 | + if (!force) { |
363 | + rc = pnp_register_driver(&tis_pnp_driver); |
364 | + if (rc) |
365 | + return rc; |
366 | + } |
367 | +#endif |
368 | +#ifdef CONFIG_ACPI |
369 | + if (!force) { |
370 | + rc = acpi_bus_register_driver(&tis_acpi_driver); |
371 | + if (rc) { |
372 | +#ifdef CONFIG_PNP |
373 | + pnp_unregister_driver(&tis_pnp_driver); |
374 | #endif |
375 | + return rc; |
376 | + } |
377 | + } |
378 | +#endif |
379 | + if (!force) |
380 | + return 0; |
381 | |
382 | rc = platform_driver_register(&tis_drv); |
383 | if (rc < 0) |
384 | @@ -978,7 +1107,7 @@ static int __init init_tis(void) |
385 | rc = PTR_ERR(pdev); |
386 | goto err_dev; |
387 | } |
388 | - rc = tpm_tis_init(&pdev->dev, NULL, TIS_MEM_BASE, TIS_MEM_LEN, 0); |
389 | + rc = tpm_tis_init(&pdev->dev, &tis_default_info, NULL); |
390 | if (rc) |
391 | goto err_init; |
392 | return 0; |
393 | @@ -992,9 +1121,14 @@ err_dev: |
394 | static void __exit cleanup_tis(void) |
395 | { |
396 | struct tpm_chip *chip; |
397 | -#ifdef CONFIG_PNP |
398 | +#if defined(CONFIG_PNP) || defined(CONFIG_ACPI) |
399 | if (!force) { |
400 | +#ifdef CONFIG_ACPI |
401 | + acpi_bus_unregister_driver(&tis_acpi_driver); |
402 | +#endif |
403 | +#ifdef CONFIG_PNP |
404 | pnp_unregister_driver(&tis_pnp_driver); |
405 | +#endif |
406 | return; |
407 | } |
408 | #endif |
409 | diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c |
410 | index 932bd1862f7a..6e9036a06515 100644 |
411 | --- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c |
412 | +++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c |
413 | @@ -1014,13 +1014,12 @@ static int atl1c_setup_ring_resources(struct atl1c_adapter *adapter) |
414 | sizeof(struct atl1c_recv_ret_status) * rx_desc_count + |
415 | 8 * 4; |
416 | |
417 | - ring_header->desc = pci_alloc_consistent(pdev, ring_header->size, |
418 | - &ring_header->dma); |
419 | + ring_header->desc = dma_zalloc_coherent(&pdev->dev, ring_header->size, |
420 | + &ring_header->dma, GFP_KERNEL); |
421 | if (unlikely(!ring_header->desc)) { |
422 | - dev_err(&pdev->dev, "pci_alloc_consistend failed\n"); |
423 | + dev_err(&pdev->dev, "could not get memory for DMA buffer\n"); |
424 | goto err_nomem; |
425 | } |
426 | - memset(ring_header->desc, 0, ring_header->size); |
427 | /* init TPD ring */ |
428 | |
429 | tpd_ring[0].dma = roundup(ring_header->dma, 8); |
430 | diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c |
431 | index 6af028d5f9bc..97e4df9bf407 100644 |
432 | --- a/drivers/net/ethernet/qualcomm/qca_spi.c |
433 | +++ b/drivers/net/ethernet/qualcomm/qca_spi.c |
434 | @@ -736,9 +736,8 @@ qcaspi_netdev_tx_timeout(struct net_device *dev) |
435 | netdev_info(qca->net_dev, "Transmit timeout at %ld, latency %ld\n", |
436 | jiffies, jiffies - dev->trans_start); |
437 | qca->net_dev->stats.tx_errors++; |
438 | - /* wake the queue if there is room */ |
439 | - if (qcaspi_tx_ring_has_space(&qca->txr)) |
440 | - netif_wake_queue(dev); |
441 | + /* Trigger tx queue flush and QCA7000 reset */ |
442 | + qca->sync = QCASPI_SYNC_UNKNOWN; |
443 | } |
444 | |
445 | static int |
446 | diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c |
447 | index 7fb244f565b2..13463c4acc86 100644 |
448 | --- a/drivers/net/ethernet/renesas/sh_eth.c |
449 | +++ b/drivers/net/ethernet/renesas/sh_eth.c |
450 | @@ -1481,6 +1481,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota) |
451 | if (mdp->cd->shift_rd0) |
452 | desc_status >>= 16; |
453 | |
454 | + skb = mdp->rx_skbuff[entry]; |
455 | if (desc_status & (RD_RFS1 | RD_RFS2 | RD_RFS3 | RD_RFS4 | |
456 | RD_RFS5 | RD_RFS6 | RD_RFS10)) { |
457 | ndev->stats.rx_errors++; |
458 | @@ -1496,12 +1497,11 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota) |
459 | ndev->stats.rx_missed_errors++; |
460 | if (desc_status & RD_RFS10) |
461 | ndev->stats.rx_over_errors++; |
462 | - } else { |
463 | + } else if (skb) { |
464 | if (!mdp->cd->hw_swap) |
465 | sh_eth_soft_swap( |
466 | phys_to_virt(ALIGN(rxdesc->addr, 4)), |
467 | pkt_len + 2); |
468 | - skb = mdp->rx_skbuff[entry]; |
469 | mdp->rx_skbuff[entry] = NULL; |
470 | if (mdp->cd->rpadir) |
471 | skb_reserve(skb, NET_IP_ALIGN); |
472 | diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c |
473 | index ab33262ed826..9c8fabed4444 100644 |
474 | --- a/drivers/net/ppp/pppoe.c |
475 | +++ b/drivers/net/ppp/pppoe.c |
476 | @@ -568,6 +568,9 @@ static int pppoe_create(struct net *net, struct socket *sock) |
477 | sk->sk_family = PF_PPPOX; |
478 | sk->sk_protocol = PX_PROTO_OE; |
479 | |
480 | + INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, |
481 | + pppoe_unbind_sock_work); |
482 | + |
483 | return 0; |
484 | } |
485 | |
486 | @@ -632,8 +635,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, |
487 | |
488 | lock_sock(sk); |
489 | |
490 | - INIT_WORK(&po->proto.pppoe.padt_work, pppoe_unbind_sock_work); |
491 | - |
492 | error = -EINVAL; |
493 | if (sp->sa_protocol != PX_PROTO_OE) |
494 | goto end; |
495 | @@ -663,8 +664,13 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, |
496 | po->pppoe_dev = NULL; |
497 | } |
498 | |
499 | - memset(sk_pppox(po) + 1, 0, |
500 | - sizeof(struct pppox_sock) - sizeof(struct sock)); |
501 | + po->pppoe_ifindex = 0; |
502 | + memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa)); |
503 | + memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay)); |
504 | + memset(&po->chan, 0, sizeof(po->chan)); |
505 | + po->next = NULL; |
506 | + po->num = 0; |
507 | + |
508 | sk->sk_state = PPPOX_NONE; |
509 | } |
510 | |
511 | diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c |
512 | index e3bfbd4d0136..0bacabfa486e 100644 |
513 | --- a/drivers/net/ppp/pptp.c |
514 | +++ b/drivers/net/ppp/pptp.c |
515 | @@ -420,6 +420,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr, |
516 | struct pptp_opt *opt = &po->proto.pptp; |
517 | int error = 0; |
518 | |
519 | + if (sockaddr_len < sizeof(struct sockaddr_pppox)) |
520 | + return -EINVAL; |
521 | + |
522 | lock_sock(sk); |
523 | |
524 | opt->src_addr = sp->sa_addr.pptp; |
525 | @@ -441,6 +444,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, |
526 | struct flowi4 fl4; |
527 | int error = 0; |
528 | |
529 | + if (sockaddr_len < sizeof(struct sockaddr_pppox)) |
530 | + return -EINVAL; |
531 | + |
532 | if (sp->sa_protocol != PX_PROTO_PPTP) |
533 | return -EINVAL; |
534 | |
535 | diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c |
536 | index aafa1a1898e4..ce6fad1c43e6 100644 |
537 | --- a/drivers/net/usb/r8152.c |
538 | +++ b/drivers/net/usb/r8152.c |
539 | @@ -3006,17 +3006,6 @@ static int rtl8152_open(struct net_device *netdev) |
540 | |
541 | mutex_lock(&tp->control); |
542 | |
543 | - /* The WORK_ENABLE may be set when autoresume occurs */ |
544 | - if (test_bit(WORK_ENABLE, &tp->flags)) { |
545 | - clear_bit(WORK_ENABLE, &tp->flags); |
546 | - usb_kill_urb(tp->intr_urb); |
547 | - cancel_delayed_work_sync(&tp->schedule); |
548 | - |
549 | - /* disable the tx/rx, if the workqueue has enabled them. */ |
550 | - if (netif_carrier_ok(netdev)) |
551 | - tp->rtl_ops.disable(tp); |
552 | - } |
553 | - |
554 | tp->rtl_ops.up(tp); |
555 | |
556 | rtl8152_set_speed(tp, AUTONEG_ENABLE, |
557 | @@ -3063,12 +3052,6 @@ static int rtl8152_close(struct net_device *netdev) |
558 | } else { |
559 | mutex_lock(&tp->control); |
560 | |
561 | - /* The autosuspend may have been enabled and wouldn't |
562 | - * be disable when autoresume occurs, because the |
563 | - * netif_running() would be false. |
564 | - */ |
565 | - rtl_runtime_suspend_enable(tp, false); |
566 | - |
567 | tp->rtl_ops.down(tp); |
568 | |
569 | mutex_unlock(&tp->control); |
570 | @@ -3369,7 +3352,7 @@ static int rtl8152_resume(struct usb_interface *intf) |
571 | netif_device_attach(tp->netdev); |
572 | } |
573 | |
574 | - if (netif_running(tp->netdev)) { |
575 | + if (netif_running(tp->netdev) && tp->netdev->flags & IFF_UP) { |
576 | if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) { |
577 | rtl_runtime_suspend_enable(tp, false); |
578 | clear_bit(SELECTIVE_SUSPEND, &tp->flags); |
579 | @@ -3387,6 +3370,8 @@ static int rtl8152_resume(struct usb_interface *intf) |
580 | } |
581 | usb_submit_urb(tp->intr_urb, GFP_KERNEL); |
582 | } else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) { |
583 | + if (tp->netdev->flags & IFF_UP) |
584 | + rtl_runtime_suspend_enable(tp, false); |
585 | clear_bit(SELECTIVE_SUSPEND, &tp->flags); |
586 | } |
587 | |
588 | diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c |
589 | index 93e54a0f471a..35882dd690a6 100644 |
590 | --- a/drivers/platform/x86/toshiba_acpi.c |
591 | +++ b/drivers/platform/x86/toshiba_acpi.c |
592 | @@ -2764,6 +2764,7 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev) |
593 | ret = toshiba_function_keys_get(dev, &special_functions); |
594 | dev->kbd_function_keys_supported = !ret; |
595 | |
596 | + dev->hotkey_event_type = 0; |
597 | if (toshiba_acpi_setup_keyboard(dev)) |
598 | pr_info("Unable to activate hotkeys\n"); |
599 | |
600 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
601 | index a086e1d69bc7..0fe15aec7ed0 100644 |
602 | --- a/drivers/usb/class/cdc-acm.c |
603 | +++ b/drivers/usb/class/cdc-acm.c |
604 | @@ -1848,6 +1848,11 @@ static const struct usb_device_id acm_ids[] = { |
605 | }, |
606 | #endif |
607 | |
608 | + /* Exclude Infineon Flash Loader utility */ |
609 | + { USB_DEVICE(0x058b, 0x0041), |
610 | + .driver_info = IGNORE_DEVICE, |
611 | + }, |
612 | + |
613 | /* control interfaces without any protocol set */ |
614 | { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, |
615 | USB_CDC_PROTO_NONE) }, |
616 | diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c |
617 | index b9ddf0c1ffe5..894894f2ff93 100644 |
618 | --- a/drivers/usb/core/config.c |
619 | +++ b/drivers/usb/core/config.c |
620 | @@ -115,7 +115,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, |
621 | USB_SS_MULT(desc->bmAttributes) > 3) { |
622 | dev_warn(ddev, "Isoc endpoint has Mult of %d in " |
623 | "config %d interface %d altsetting %d ep %d: " |
624 | - "setting to 3\n", desc->bmAttributes + 1, |
625 | + "setting to 3\n", |
626 | + USB_SS_MULT(desc->bmAttributes), |
627 | cfgno, inum, asnum, ep->desc.bEndpointAddress); |
628 | ep->ss_ep_comp.bmAttributes = 2; |
629 | } |
630 | diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c |
631 | index 1e9a8c9aa531..d68c4a4db682 100644 |
632 | --- a/drivers/usb/core/hub.c |
633 | +++ b/drivers/usb/core/hub.c |
634 | @@ -124,6 +124,10 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev) |
635 | |
636 | int usb_device_supports_lpm(struct usb_device *udev) |
637 | { |
638 | + /* Some devices have trouble with LPM */ |
639 | + if (udev->quirks & USB_QUIRK_NO_LPM) |
640 | + return 0; |
641 | + |
642 | /* USB 2.1 (and greater) devices indicate LPM support through |
643 | * their USB 2.0 Extended Capabilities BOS descriptor. |
644 | */ |
645 | @@ -4493,6 +4497,8 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1, |
646 | goto fail; |
647 | } |
648 | |
649 | + usb_detect_quirks(udev); |
650 | + |
651 | if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) { |
652 | retval = usb_get_bos_descriptor(udev); |
653 | if (!retval) { |
654 | @@ -4691,7 +4697,6 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, |
655 | if (status < 0) |
656 | goto loop; |
657 | |
658 | - usb_detect_quirks(udev); |
659 | if (udev->quirks & USB_QUIRK_DELAY_INIT) |
660 | msleep(1000); |
661 | |
662 | @@ -5307,9 +5312,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev) |
663 | if (udev->usb2_hw_lpm_enabled == 1) |
664 | usb_set_usb2_hardware_lpm(udev, 0); |
665 | |
666 | - bos = udev->bos; |
667 | - udev->bos = NULL; |
668 | - |
669 | /* Disable LPM and LTM while we reset the device and reinstall the alt |
670 | * settings. Device-initiated LPM settings, and system exit latency |
671 | * settings are cleared when the device is reset, so we have to set |
672 | @@ -5318,15 +5320,18 @@ static int usb_reset_and_verify_device(struct usb_device *udev) |
673 | ret = usb_unlocked_disable_lpm(udev); |
674 | if (ret) { |
675 | dev_err(&udev->dev, "%s Failed to disable LPM\n.", __func__); |
676 | - goto re_enumerate; |
677 | + goto re_enumerate_no_bos; |
678 | } |
679 | ret = usb_disable_ltm(udev); |
680 | if (ret) { |
681 | dev_err(&udev->dev, "%s Failed to disable LTM\n.", |
682 | __func__); |
683 | - goto re_enumerate; |
684 | + goto re_enumerate_no_bos; |
685 | } |
686 | |
687 | + bos = udev->bos; |
688 | + udev->bos = NULL; |
689 | + |
690 | for (i = 0; i < SET_CONFIG_TRIES; ++i) { |
691 | |
692 | /* ep0 maxpacket size may change; let the HCD know about it. |
693 | @@ -5423,10 +5428,11 @@ done: |
694 | return 0; |
695 | |
696 | re_enumerate: |
697 | - /* LPM state doesn't matter when we're about to destroy the device. */ |
698 | - hub_port_logical_disconnect(parent_hub, port1); |
699 | usb_release_bos_descriptor(udev); |
700 | udev->bos = bos; |
701 | +re_enumerate_no_bos: |
702 | + /* LPM state doesn't matter when we're about to destroy the device. */ |
703 | + hub_port_logical_disconnect(parent_hub, port1); |
704 | return -ENODEV; |
705 | } |
706 | |
707 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c |
708 | index f5a381945db2..017c1de53aa5 100644 |
709 | --- a/drivers/usb/core/quirks.c |
710 | +++ b/drivers/usb/core/quirks.c |
711 | @@ -199,6 +199,12 @@ static const struct usb_device_id usb_quirk_list[] = { |
712 | { USB_DEVICE(0x1a0a, 0x0200), .driver_info = |
713 | USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, |
714 | |
715 | + /* Blackmagic Design Intensity Shuttle */ |
716 | + { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM }, |
717 | + |
718 | + /* Blackmagic Design UltraStudio SDI */ |
719 | + { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, |
720 | + |
721 | { } /* terminating entry must be last */ |
722 | }; |
723 | |
724 | diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c |
725 | index b51226abade6..7a454708e948 100644 |
726 | --- a/drivers/usb/gadget/udc/pxa27x_udc.c |
727 | +++ b/drivers/usb/gadget/udc/pxa27x_udc.c |
728 | @@ -2535,6 +2535,9 @@ static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state) |
729 | udc->pullup_resume = udc->pullup_on; |
730 | dplus_pullup(udc, 0); |
731 | |
732 | + if (udc->driver) |
733 | + udc->driver->disconnect(&udc->gadget); |
734 | + |
735 | return 0; |
736 | } |
737 | |
738 | diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c |
739 | index dc31c425ce01..9f1c0538b211 100644 |
740 | --- a/drivers/usb/host/whci/qset.c |
741 | +++ b/drivers/usb/host/whci/qset.c |
742 | @@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f |
743 | if (std->pl_virt == NULL) |
744 | return -ENOMEM; |
745 | std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE); |
746 | + if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) { |
747 | + kfree(std->pl_virt); |
748 | + return -EFAULT; |
749 | + } |
750 | |
751 | for (p = 0; p < std->num_pointers; p++) { |
752 | std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr); |
753 | diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig |
754 | index 39db8b603627..d1b9e0c7fb0d 100644 |
755 | --- a/drivers/usb/musb/Kconfig |
756 | +++ b/drivers/usb/musb/Kconfig |
757 | @@ -147,7 +147,7 @@ config USB_TI_CPPI_DMA |
758 | |
759 | config USB_TI_CPPI41_DMA |
760 | bool 'TI CPPI 4.1 (AM335x)' |
761 | - depends on ARCH_OMAP |
762 | + depends on ARCH_OMAP && DMADEVICES |
763 | select TI_CPPI41 |
764 | |
765 | config USB_TUSB_OMAP_DMA |
766 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c |
767 | index eac7ccaa3c85..7d4f51a32e66 100644 |
768 | --- a/drivers/usb/serial/cp210x.c |
769 | +++ b/drivers/usb/serial/cp210x.c |
770 | @@ -132,7 +132,6 @@ static const struct usb_device_id id_table[] = { |
771 | { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ |
772 | { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ |
773 | { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ |
774 | - { USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */ |
775 | { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ |
776 | { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */ |
777 | { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */ |
778 | diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c |
779 | index 3658662898fc..a204782ae530 100644 |
780 | --- a/drivers/usb/serial/usb-serial-simple.c |
781 | +++ b/drivers/usb/serial/usb-serial-simple.c |
782 | @@ -53,6 +53,7 @@ DEVICE(funsoft, FUNSOFT_IDS); |
783 | |
784 | /* Infineon Flashloader driver */ |
785 | #define FLASHLOADER_IDS() \ |
786 | + { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \ |
787 | { USB_DEVICE(0x8087, 0x0716) } |
788 | DEVICE(flashloader, FLASHLOADER_IDS); |
789 | |
790 | diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c |
791 | index 6d3122afeed3..75e4979e6c15 100644 |
792 | --- a/drivers/usb/storage/uas.c |
793 | +++ b/drivers/usb/storage/uas.c |
794 | @@ -796,6 +796,10 @@ static int uas_slave_configure(struct scsi_device *sdev) |
795 | if (devinfo->flags & US_FL_NO_REPORT_OPCODES) |
796 | sdev->no_report_opcodes = 1; |
797 | |
798 | + /* A few buggy USB-ATA bridges don't understand FUA */ |
799 | + if (devinfo->flags & US_FL_BROKEN_FUA) |
800 | + sdev->broken_fua = 1; |
801 | + |
802 | scsi_change_queue_depth(sdev, devinfo->qdepth - 2); |
803 | return 0; |
804 | } |
805 | diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h |
806 | index 87898ca2ed17..4095824c8c6d 100644 |
807 | --- a/drivers/usb/storage/unusual_devs.h |
808 | +++ b/drivers/usb/storage/unusual_devs.h |
809 | @@ -1987,7 +1987,7 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201, |
810 | US_FL_IGNORE_RESIDUE ), |
811 | |
812 | /* Reported by Michael Büsch <m@bues.ch> */ |
813 | -UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0114, |
814 | +UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0116, |
815 | "JMicron", |
816 | "USB to ATA/ATAPI Bridge", |
817 | USB_SC_DEVICE, USB_PR_DEVICE, NULL, |
818 | diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h |
819 | index c85ea530085f..ccc113e83d88 100644 |
820 | --- a/drivers/usb/storage/unusual_uas.h |
821 | +++ b/drivers/usb/storage/unusual_uas.h |
822 | @@ -132,7 +132,7 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999, |
823 | "JMicron", |
824 | "JMS567", |
825 | USB_SC_DEVICE, USB_PR_DEVICE, NULL, |
826 | - US_FL_NO_REPORT_OPCODES), |
827 | + US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES), |
828 | |
829 | /* Reported-by: Hans de Goede <hdegoede@redhat.com> */ |
830 | UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, |
831 | diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h |
832 | index 9948c874e3f1..1d0043dc34e4 100644 |
833 | --- a/include/linux/usb/quirks.h |
834 | +++ b/include/linux/usb/quirks.h |
835 | @@ -47,4 +47,7 @@ |
836 | /* device generates spurious wakeup, ignore remote wakeup capability */ |
837 | #define USB_QUIRK_IGNORE_REMOTE_WAKEUP BIT(9) |
838 | |
839 | +/* device can't handle Link Power Management */ |
840 | +#define USB_QUIRK_NO_LPM BIT(10) |
841 | + |
842 | #endif /* __LINUX_USB_QUIRKS_H */ |
843 | diff --git a/include/net/dst.h b/include/net/dst.h |
844 | index 0fb99a26e973..182b812d45e1 100644 |
845 | --- a/include/net/dst.h |
846 | +++ b/include/net/dst.h |
847 | @@ -312,6 +312,39 @@ static inline void skb_dst_force(struct sk_buff *skb) |
848 | } |
849 | } |
850 | |
851 | +/** |
852 | + * dst_hold_safe - Take a reference on a dst if possible |
853 | + * @dst: pointer to dst entry |
854 | + * |
855 | + * This helper returns false if it could not safely |
856 | + * take a reference on a dst. |
857 | + */ |
858 | +static inline bool dst_hold_safe(struct dst_entry *dst) |
859 | +{ |
860 | + if (dst->flags & DST_NOCACHE) |
861 | + return atomic_inc_not_zero(&dst->__refcnt); |
862 | + dst_hold(dst); |
863 | + return true; |
864 | +} |
865 | + |
866 | +/** |
867 | + * skb_dst_force_safe - makes sure skb dst is refcounted |
868 | + * @skb: buffer |
869 | + * |
870 | + * If dst is not yet refcounted and not destroyed, grab a ref on it. |
871 | + */ |
872 | +static inline void skb_dst_force_safe(struct sk_buff *skb) |
873 | +{ |
874 | + if (skb_dst_is_noref(skb)) { |
875 | + struct dst_entry *dst = skb_dst(skb); |
876 | + |
877 | + if (!dst_hold_safe(dst)) |
878 | + dst = NULL; |
879 | + |
880 | + skb->_skb_refdst = (unsigned long)dst; |
881 | + } |
882 | +} |
883 | + |
884 | |
885 | /** |
886 | * __skb_tunnel_rx - prepare skb for rx reinsert |
887 | diff --git a/include/net/sock.h b/include/net/sock.h |
888 | index ed01a012f8d5..4c4b21c00828 100644 |
889 | --- a/include/net/sock.h |
890 | +++ b/include/net/sock.h |
891 | @@ -386,6 +386,7 @@ struct sock { |
892 | sk_no_check_rx : 1, |
893 | sk_userlocks : 4, |
894 | sk_protocol : 8, |
895 | +#define SK_PROTOCOL_MAX U8_MAX |
896 | sk_type : 16; |
897 | kmemcheck_bitfield_end(flags); |
898 | int sk_wmem_queued; |
899 | @@ -722,6 +723,8 @@ enum sock_flags { |
900 | SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */ |
901 | }; |
902 | |
903 | +#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)) |
904 | + |
905 | static inline void sock_copy_flags(struct sock *nsk, struct sock *osk) |
906 | { |
907 | nsk->sk_flags = osk->sk_flags; |
908 | @@ -796,7 +799,7 @@ void sk_stream_write_space(struct sock *sk); |
909 | static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb) |
910 | { |
911 | /* dont let skb dst not refcounted, we are going to leave rcu lock */ |
912 | - skb_dst_force(skb); |
913 | + skb_dst_force_safe(skb); |
914 | |
915 | if (!sk->sk_backlog.tail) |
916 | sk->sk_backlog.head = skb; |
917 | diff --git a/include/net/vxlan.h b/include/net/vxlan.h |
918 | index 0082b5d33d7d..7ef9272a405a 100644 |
919 | --- a/include/net/vxlan.h |
920 | +++ b/include/net/vxlan.h |
921 | @@ -78,7 +78,7 @@ struct vxlanhdr { |
922 | }; |
923 | |
924 | /* VXLAN header flags. */ |
925 | -#define VXLAN_HF_RCO BIT(24) |
926 | +#define VXLAN_HF_RCO BIT(21) |
927 | #define VXLAN_HF_VNI BIT(27) |
928 | #define VXLAN_HF_GBP BIT(31) |
929 | |
930 | diff --git a/lib/rhashtable.c b/lib/rhashtable.c |
931 | index cf910e48f8f2..5b17447efa8b 100644 |
932 | --- a/lib/rhashtable.c |
933 | +++ b/lib/rhashtable.c |
934 | @@ -506,10 +506,11 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter) |
935 | if (!iter->walker) |
936 | return -ENOMEM; |
937 | |
938 | - mutex_lock(&ht->mutex); |
939 | - iter->walker->tbl = rht_dereference(ht->tbl, ht); |
940 | + spin_lock(&ht->lock); |
941 | + iter->walker->tbl = |
942 | + rcu_dereference_protected(ht->tbl, lockdep_is_held(&ht->lock)); |
943 | list_add(&iter->walker->list, &iter->walker->tbl->walkers); |
944 | - mutex_unlock(&ht->mutex); |
945 | + spin_unlock(&ht->lock); |
946 | |
947 | return 0; |
948 | } |
949 | @@ -523,10 +524,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init); |
950 | */ |
951 | void rhashtable_walk_exit(struct rhashtable_iter *iter) |
952 | { |
953 | - mutex_lock(&iter->ht->mutex); |
954 | + spin_lock(&iter->ht->lock); |
955 | if (iter->walker->tbl) |
956 | list_del(&iter->walker->list); |
957 | - mutex_unlock(&iter->ht->mutex); |
958 | + spin_unlock(&iter->ht->lock); |
959 | kfree(iter->walker); |
960 | } |
961 | EXPORT_SYMBOL_GPL(rhashtable_walk_exit); |
962 | @@ -550,14 +551,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter) |
963 | { |
964 | struct rhashtable *ht = iter->ht; |
965 | |
966 | - mutex_lock(&ht->mutex); |
967 | + rcu_read_lock(); |
968 | |
969 | + spin_lock(&ht->lock); |
970 | if (iter->walker->tbl) |
971 | list_del(&iter->walker->list); |
972 | - |
973 | - rcu_read_lock(); |
974 | - |
975 | - mutex_unlock(&ht->mutex); |
976 | + spin_unlock(&ht->lock); |
977 | |
978 | if (!iter->walker->tbl) { |
979 | iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht); |
980 | @@ -730,9 +729,6 @@ int rhashtable_init(struct rhashtable *ht, |
981 | if (params->nulls_base && params->nulls_base < (1U << RHT_BASE_SHIFT)) |
982 | return -EINVAL; |
983 | |
984 | - if (params->nelem_hint) |
985 | - size = rounded_hashtable_size(params); |
986 | - |
987 | memset(ht, 0, sizeof(*ht)); |
988 | mutex_init(&ht->mutex); |
989 | spin_lock_init(&ht->lock); |
990 | @@ -752,6 +748,9 @@ int rhashtable_init(struct rhashtable *ht, |
991 | |
992 | ht->p.min_size = max(ht->p.min_size, HASH_MIN_SIZE); |
993 | |
994 | + if (params->nelem_hint) |
995 | + size = rounded_hashtable_size(&ht->p); |
996 | + |
997 | /* The maximum (not average) chain length grows with the |
998 | * size of the hash table, at a rate of (log N)/(log log N). |
999 | * The value of 16 is selected so that even if the hash |
1000 | diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c |
1001 | index 330c1f4a5a0b..a64884bbf0ce 100644 |
1002 | --- a/net/ax25/af_ax25.c |
1003 | +++ b/net/ax25/af_ax25.c |
1004 | @@ -806,6 +806,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol, |
1005 | struct sock *sk; |
1006 | ax25_cb *ax25; |
1007 | |
1008 | + if (protocol < 0 || protocol > SK_PROTOCOL_MAX) |
1009 | + return -EINVAL; |
1010 | + |
1011 | if (!net_eq(net, &init_net)) |
1012 | return -EAFNOSUPPORT; |
1013 | |
1014 | diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c |
1015 | index 4322c833e748..8611bc7bdd32 100644 |
1016 | --- a/net/bluetooth/sco.c |
1017 | +++ b/net/bluetooth/sco.c |
1018 | @@ -520,6 +520,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le |
1019 | if (!addr || addr->sa_family != AF_BLUETOOTH) |
1020 | return -EINVAL; |
1021 | |
1022 | + if (addr_len < sizeof(struct sockaddr_sco)) |
1023 | + return -EINVAL; |
1024 | + |
1025 | lock_sock(sk); |
1026 | |
1027 | if (sk->sk_state != BT_OPEN) { |
1028 | diff --git a/net/core/skbuff.c b/net/core/skbuff.c |
1029 | index 075d2e78c87e..2e5fcda16570 100644 |
1030 | --- a/net/core/skbuff.c |
1031 | +++ b/net/core/skbuff.c |
1032 | @@ -3661,7 +3661,8 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb, |
1033 | serr->ee.ee_info = tstype; |
1034 | if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) { |
1035 | serr->ee.ee_data = skb_shinfo(skb)->tskey; |
1036 | - if (sk->sk_protocol == IPPROTO_TCP) |
1037 | + if (sk->sk_protocol == IPPROTO_TCP && |
1038 | + sk->sk_type == SOCK_STREAM) |
1039 | serr->ee.ee_data -= sk->sk_tskey; |
1040 | } |
1041 | |
1042 | @@ -4200,7 +4201,8 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb) |
1043 | return NULL; |
1044 | } |
1045 | |
1046 | - memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN); |
1047 | + memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN, |
1048 | + 2 * ETH_ALEN); |
1049 | skb->mac_header += VLAN_HLEN; |
1050 | return skb; |
1051 | } |
1052 | diff --git a/net/core/sock.c b/net/core/sock.c |
1053 | index dc30dc5bb1b8..47fc8bb3b946 100644 |
1054 | --- a/net/core/sock.c |
1055 | +++ b/net/core/sock.c |
1056 | @@ -421,8 +421,6 @@ static void sock_warn_obsolete_bsdism(const char *name) |
1057 | } |
1058 | } |
1059 | |
1060 | -#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)) |
1061 | - |
1062 | static void sock_disable_timestamp(struct sock *sk, unsigned long flags) |
1063 | { |
1064 | if (sk->sk_flags & flags) { |
1065 | @@ -861,7 +859,8 @@ set_rcvbuf: |
1066 | |
1067 | if (val & SOF_TIMESTAMPING_OPT_ID && |
1068 | !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) { |
1069 | - if (sk->sk_protocol == IPPROTO_TCP) { |
1070 | + if (sk->sk_protocol == IPPROTO_TCP && |
1071 | + sk->sk_type == SOCK_STREAM) { |
1072 | if (sk->sk_state != TCP_ESTABLISHED) { |
1073 | ret = -EINVAL; |
1074 | break; |
1075 | diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c |
1076 | index 754484b3cd0e..2783c538ec19 100644 |
1077 | --- a/net/decnet/af_decnet.c |
1078 | +++ b/net/decnet/af_decnet.c |
1079 | @@ -678,6 +678,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol, |
1080 | { |
1081 | struct sock *sk; |
1082 | |
1083 | + if (protocol < 0 || protocol > SK_PROTOCOL_MAX) |
1084 | + return -EINVAL; |
1085 | + |
1086 | if (!net_eq(net, &init_net)) |
1087 | return -EAFNOSUPPORT; |
1088 | |
1089 | diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c |
1090 | index a5aa54ea6533..0cc98b135b8f 100644 |
1091 | --- a/net/ipv4/af_inet.c |
1092 | +++ b/net/ipv4/af_inet.c |
1093 | @@ -259,6 +259,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, |
1094 | int try_loading_module = 0; |
1095 | int err; |
1096 | |
1097 | + if (protocol < 0 || protocol >= IPPROTO_MAX) |
1098 | + return -EINVAL; |
1099 | + |
1100 | sock->state = SS_UNCONNECTED; |
1101 | |
1102 | /* Look for the requested type/protocol pair. */ |
1103 | diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c |
1104 | index 34968cd5c146..4b67937692c9 100644 |
1105 | --- a/net/ipv4/fou.c |
1106 | +++ b/net/ipv4/fou.c |
1107 | @@ -24,6 +24,7 @@ struct fou { |
1108 | u16 type; |
1109 | struct udp_offload udp_offloads; |
1110 | struct list_head list; |
1111 | + struct rcu_head rcu; |
1112 | }; |
1113 | |
1114 | #define FOU_F_REMCSUM_NOPARTIAL BIT(0) |
1115 | @@ -421,7 +422,7 @@ static void fou_release(struct fou *fou) |
1116 | list_del(&fou->list); |
1117 | udp_tunnel_sock_release(sock); |
1118 | |
1119 | - kfree(fou); |
1120 | + kfree_rcu(fou, rcu); |
1121 | } |
1122 | |
1123 | static int fou_encap_init(struct sock *sk, struct fou *fou, struct fou_cfg *cfg) |
1124 | diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c |
1125 | index 88203e755af8..cd18c3d3251e 100644 |
1126 | --- a/net/ipv4/tcp_ipv4.c |
1127 | +++ b/net/ipv4/tcp_ipv4.c |
1128 | @@ -1509,7 +1509,7 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb) |
1129 | if (likely(sk->sk_rx_dst)) |
1130 | skb_dst_drop(skb); |
1131 | else |
1132 | - skb_dst_force(skb); |
1133 | + skb_dst_force_safe(skb); |
1134 | |
1135 | __skb_queue_tail(&tp->ucopy.prequeue, skb); |
1136 | tp->ucopy.memory += skb->truesize; |
1137 | @@ -1714,8 +1714,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) |
1138 | { |
1139 | struct dst_entry *dst = skb_dst(skb); |
1140 | |
1141 | - if (dst) { |
1142 | - dst_hold(dst); |
1143 | + if (dst && dst_hold_safe(dst)) { |
1144 | sk->sk_rx_dst = dst; |
1145 | inet_sk(sk)->rx_dst_ifindex = skb->skb_iif; |
1146 | } |
1147 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
1148 | index 986440b24978..1ea4322c3b0c 100644 |
1149 | --- a/net/ipv4/tcp_output.c |
1150 | +++ b/net/ipv4/tcp_output.c |
1151 | @@ -3143,7 +3143,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) |
1152 | { |
1153 | struct tcp_sock *tp = tcp_sk(sk); |
1154 | struct tcp_fastopen_request *fo = tp->fastopen_req; |
1155 | - int syn_loss = 0, space, err = 0, copied; |
1156 | + int syn_loss = 0, space, err = 0; |
1157 | unsigned long last_syn_loss = 0; |
1158 | struct sk_buff *syn_data; |
1159 | |
1160 | @@ -3181,17 +3181,18 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) |
1161 | goto fallback; |
1162 | syn_data->ip_summed = CHECKSUM_PARTIAL; |
1163 | memcpy(syn_data->cb, syn->cb, sizeof(syn->cb)); |
1164 | - copied = copy_from_iter(skb_put(syn_data, space), space, |
1165 | - &fo->data->msg_iter); |
1166 | - if (unlikely(!copied)) { |
1167 | - kfree_skb(syn_data); |
1168 | - goto fallback; |
1169 | - } |
1170 | - if (copied != space) { |
1171 | - skb_trim(syn_data, copied); |
1172 | - space = copied; |
1173 | + if (space) { |
1174 | + int copied = copy_from_iter(skb_put(syn_data, space), space, |
1175 | + &fo->data->msg_iter); |
1176 | + if (unlikely(!copied)) { |
1177 | + kfree_skb(syn_data); |
1178 | + goto fallback; |
1179 | + } |
1180 | + if (copied != space) { |
1181 | + skb_trim(syn_data, copied); |
1182 | + space = copied; |
1183 | + } |
1184 | } |
1185 | - |
1186 | /* No more data pending in inet_wait_for_connect() */ |
1187 | if (space == fo->size) |
1188 | fo->data = NULL; |
1189 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c |
1190 | index fd3aa6148dd1..a2d685030a34 100644 |
1191 | --- a/net/ipv6/addrconf.c |
1192 | +++ b/net/ipv6/addrconf.c |
1193 | @@ -343,6 +343,12 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev) |
1194 | setup_timer(&ndev->rs_timer, addrconf_rs_timer, |
1195 | (unsigned long)ndev); |
1196 | memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf)); |
1197 | + |
1198 | + if (ndev->cnf.stable_secret.initialized) |
1199 | + ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY; |
1200 | + else |
1201 | + ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_EUI64; |
1202 | + |
1203 | ndev->cnf.mtu6 = dev->mtu; |
1204 | ndev->cnf.sysctl = NULL; |
1205 | ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl); |
1206 | @@ -2384,7 +2390,7 @@ ok: |
1207 | #ifdef CONFIG_IPV6_OPTIMISTIC_DAD |
1208 | if (in6_dev->cnf.optimistic_dad && |
1209 | !net->ipv6.devconf_all->forwarding && sllao) |
1210 | - addr_flags = IFA_F_OPTIMISTIC; |
1211 | + addr_flags |= IFA_F_OPTIMISTIC; |
1212 | #endif |
1213 | |
1214 | /* Do not allow to create too much of autoconfigured |
1215 | diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c |
1216 | index 2d044d2a2ccf..bad62fa5e70f 100644 |
1217 | --- a/net/ipv6/af_inet6.c |
1218 | +++ b/net/ipv6/af_inet6.c |
1219 | @@ -109,6 +109,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, |
1220 | int try_loading_module = 0; |
1221 | int err; |
1222 | |
1223 | + if (protocol < 0 || protocol >= IPPROTO_MAX) |
1224 | + return -EINVAL; |
1225 | + |
1226 | /* Look for the requested type/protocol pair. */ |
1227 | lookup_protocol: |
1228 | err = -ESOCKTNOSUPPORT; |
1229 | diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c |
1230 | index 69f4f689f06a..76be7d311cc4 100644 |
1231 | --- a/net/ipv6/ip6_gre.c |
1232 | +++ b/net/ipv6/ip6_gre.c |
1233 | @@ -1553,13 +1553,11 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[], |
1234 | return -EEXIST; |
1235 | } else { |
1236 | t = nt; |
1237 | - |
1238 | - ip6gre_tunnel_unlink(ign, t); |
1239 | - ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]); |
1240 | - ip6gre_tunnel_link(ign, t); |
1241 | - netdev_state_change(dev); |
1242 | } |
1243 | |
1244 | + ip6gre_tunnel_unlink(ign, t); |
1245 | + ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]); |
1246 | + ip6gre_tunnel_link(ign, t); |
1247 | return 0; |
1248 | } |
1249 | |
1250 | diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c |
1251 | index cfb27f56c62f..c1938ad39f8c 100644 |
1252 | --- a/net/ipv6/tcp_ipv6.c |
1253 | +++ b/net/ipv6/tcp_ipv6.c |
1254 | @@ -93,10 +93,9 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) |
1255 | { |
1256 | struct dst_entry *dst = skb_dst(skb); |
1257 | |
1258 | - if (dst) { |
1259 | + if (dst && dst_hold_safe(dst)) { |
1260 | const struct rt6_info *rt = (const struct rt6_info *)dst; |
1261 | |
1262 | - dst_hold(dst); |
1263 | sk->sk_rx_dst = dst; |
1264 | inet_sk(sk)->rx_dst_ifindex = skb->skb_iif; |
1265 | if (rt->rt6i_node) |
1266 | diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c |
1267 | index ee0ea25c8e7a..9a1edcde4ba5 100644 |
1268 | --- a/net/irda/af_irda.c |
1269 | +++ b/net/irda/af_irda.c |
1270 | @@ -1086,6 +1086,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol, |
1271 | struct sock *sk; |
1272 | struct irda_sock *self; |
1273 | |
1274 | + if (protocol < 0 || protocol > SK_PROTOCOL_MAX) |
1275 | + return -EINVAL; |
1276 | + |
1277 | if (net != &init_net) |
1278 | return -EAFNOSUPPORT; |
1279 | |
1280 | diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c |
1281 | index d4b6f3682c14..68c599a5e1d1 100644 |
1282 | --- a/net/sched/sch_api.c |
1283 | +++ b/net/sched/sch_api.c |
1284 | @@ -950,7 +950,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue, |
1285 | } |
1286 | lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock); |
1287 | if (!netif_is_multiqueue(dev)) |
1288 | - sch->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT; |
1289 | + sch->flags |= TCQ_F_ONETXQUEUE; |
1290 | } |
1291 | |
1292 | sch->handle = handle; |
1293 | diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c |
1294 | index 0e4198ee2370..3267a5cbb3e8 100644 |
1295 | --- a/net/sctp/ipv6.c |
1296 | +++ b/net/sctp/ipv6.c |
1297 | @@ -634,6 +634,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, |
1298 | struct sock *newsk; |
1299 | struct ipv6_pinfo *newnp, *np = inet6_sk(sk); |
1300 | struct sctp6_sock *newsctp6sk; |
1301 | + struct ipv6_txoptions *opt; |
1302 | |
1303 | newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot); |
1304 | if (!newsk) |
1305 | @@ -653,6 +654,13 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, |
1306 | |
1307 | memcpy(newnp, np, sizeof(struct ipv6_pinfo)); |
1308 | |
1309 | + rcu_read_lock(); |
1310 | + opt = rcu_dereference(np->opt); |
1311 | + if (opt) |
1312 | + opt = ipv6_dup_options(newsk, opt); |
1313 | + RCU_INIT_POINTER(newnp->opt, opt); |
1314 | + rcu_read_unlock(); |
1315 | + |
1316 | /* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname() |
1317 | * and getpeername(). |
1318 | */ |
1319 | diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c |
1320 | index 06320c8c1c86..83a07d468644 100644 |
1321 | --- a/net/sctp/sm_make_chunk.c |
1322 | +++ b/net/sctp/sm_make_chunk.c |
1323 | @@ -1652,7 +1652,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep, |
1324 | |
1325 | /* Set an expiration time for the cookie. */ |
1326 | cookie->c.expiration = ktime_add(asoc->cookie_life, |
1327 | - ktime_get()); |
1328 | + ktime_get_real()); |
1329 | |
1330 | /* Copy the peer's init packet. */ |
1331 | memcpy(&cookie->c.peer_init[0], init_chunk->chunk_hdr, |
1332 | @@ -1780,7 +1780,7 @@ no_hmac: |
1333 | if (sock_flag(ep->base.sk, SOCK_TIMESTAMP)) |
1334 | kt = skb_get_ktime(skb); |
1335 | else |
1336 | - kt = ktime_get(); |
1337 | + kt = ktime_get_real(); |
1338 | |
1339 | if (!asoc && ktime_before(bear_cookie->expiration, kt)) { |
1340 | /* |
1341 | diff --git a/net/sctp/socket.c b/net/sctp/socket.c |
1342 | index 66d796075050..a63c2c87a0c6 100644 |
1343 | --- a/net/sctp/socket.c |
1344 | +++ b/net/sctp/socket.c |
1345 | @@ -7175,6 +7175,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk, |
1346 | newsk->sk_type = sk->sk_type; |
1347 | newsk->sk_bound_dev_if = sk->sk_bound_dev_if; |
1348 | newsk->sk_flags = sk->sk_flags; |
1349 | + newsk->sk_tsflags = sk->sk_tsflags; |
1350 | newsk->sk_no_check_tx = sk->sk_no_check_tx; |
1351 | newsk->sk_no_check_rx = sk->sk_no_check_rx; |
1352 | newsk->sk_reuse = sk->sk_reuse; |
1353 | @@ -7207,6 +7208,9 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk, |
1354 | newinet->mc_ttl = 1; |
1355 | newinet->mc_index = 0; |
1356 | newinet->mc_list = NULL; |
1357 | + |
1358 | + if (newsk->sk_flags & SK_FLAGS_TIMESTAMP) |
1359 | + net_enable_timestamp(); |
1360 | } |
1361 | |
1362 | static inline void sctp_copy_descendant(struct sock *sk_to, |
1363 | diff --git a/net/socket.c b/net/socket.c |
1364 | index 884e32997698..dcbfa868e398 100644 |
1365 | --- a/net/socket.c |
1366 | +++ b/net/socket.c |
1367 | @@ -1705,6 +1705,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, |
1368 | msg.msg_name = addr ? (struct sockaddr *)&address : NULL; |
1369 | /* We assume all kernel code knows the size of sockaddr_storage */ |
1370 | msg.msg_namelen = 0; |
1371 | + msg.msg_iocb = NULL; |
1372 | if (sock->file->f_flags & O_NONBLOCK) |
1373 | flags |= MSG_DONTWAIT; |
1374 | err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags); |
1375 | diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c |
1376 | index 1975fd8d1c10..a398f624c28d 100644 |
1377 | --- a/net/unix/af_unix.c |
1378 | +++ b/net/unix/af_unix.c |
1379 | @@ -2072,14 +2072,7 @@ static int unix_stream_recvmsg(struct socket *sock, struct msghdr *msg, |
1380 | |
1381 | memset(&scm, 0, sizeof(scm)); |
1382 | |
1383 | - err = mutex_lock_interruptible(&u->readlock); |
1384 | - if (unlikely(err)) { |
1385 | - /* recvmsg() in non blocking mode is supposed to return -EAGAIN |
1386 | - * sk_rcvtimeo is not honored by mutex_lock_interruptible() |
1387 | - */ |
1388 | - err = noblock ? -EAGAIN : -ERESTARTSYS; |
1389 | - goto out; |
1390 | - } |
1391 | + mutex_lock(&u->readlock); |
1392 | |
1393 | if (flags & MSG_PEEK) |
1394 | skip = sk_peek_offset(sk, flags); |
1395 | @@ -2120,12 +2113,12 @@ again: |
1396 | |
1397 | timeo = unix_stream_data_wait(sk, timeo, last); |
1398 | |
1399 | - if (signal_pending(current) |
1400 | - || mutex_lock_interruptible(&u->readlock)) { |
1401 | + if (signal_pending(current)) { |
1402 | err = sock_intr_errno(timeo); |
1403 | goto out; |
1404 | } |
1405 | |
1406 | + mutex_lock(&u->readlock); |
1407 | continue; |
1408 | unlock: |
1409 | unix_state_unlock(sk); |
1410 | diff --git a/security/keys/gc.c b/security/keys/gc.c |
1411 | index c7952375ac53..addf060399e0 100644 |
1412 | --- a/security/keys/gc.c |
1413 | +++ b/security/keys/gc.c |
1414 | @@ -134,6 +134,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys) |
1415 | kdebug("- %u", key->serial); |
1416 | key_check(key); |
1417 | |
1418 | + /* Throw away the key data if the key is instantiated */ |
1419 | + if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) && |
1420 | + !test_bit(KEY_FLAG_NEGATIVE, &key->flags) && |
1421 | + key->type->destroy) |
1422 | + key->type->destroy(key); |
1423 | + |
1424 | security_key_free(key); |
1425 | |
1426 | /* deal with the user's key tracking and quota */ |
1427 | @@ -148,10 +154,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys) |
1428 | if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) |
1429 | atomic_dec(&key->user->nikeys); |
1430 | |
1431 | - /* now throw away the key memory */ |
1432 | - if (key->type->destroy) |
1433 | - key->type->destroy(key); |
1434 | - |
1435 | key_user_put(key->user); |
1436 | |
1437 | kfree(key->description); |
1438 | diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c |
1439 | index 0b9ec78a7a7a..26f0e0a11ed6 100644 |
1440 | --- a/security/keys/keyctl.c |
1441 | +++ b/security/keys/keyctl.c |
1442 | @@ -757,16 +757,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) |
1443 | |
1444 | /* the key is probably readable - now try to read it */ |
1445 | can_read_key: |
1446 | - ret = key_validate(key); |
1447 | - if (ret == 0) { |
1448 | - ret = -EOPNOTSUPP; |
1449 | - if (key->type->read) { |
1450 | - /* read the data with the semaphore held (since we |
1451 | - * might sleep) */ |
1452 | - down_read(&key->sem); |
1453 | + ret = -EOPNOTSUPP; |
1454 | + if (key->type->read) { |
1455 | + /* Read the data with the semaphore held (since we might sleep) |
1456 | + * to protect against the key being updated or revoked. |
1457 | + */ |
1458 | + down_read(&key->sem); |
1459 | + ret = key_validate(key); |
1460 | + if (ret == 0) |
1461 | ret = key->type->read(key, buffer, buflen); |
1462 | - up_read(&key->sem); |
1463 | - } |
1464 | + up_read(&key->sem); |
1465 | } |
1466 | |
1467 | error2: |
1468 | diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c |
1469 | index bd536cb221e2..db91639c81e3 100644 |
1470 | --- a/security/keys/process_keys.c |
1471 | +++ b/security/keys/process_keys.c |
1472 | @@ -794,6 +794,7 @@ long join_session_keyring(const char *name) |
1473 | ret = PTR_ERR(keyring); |
1474 | goto error2; |
1475 | } else if (keyring == new->session_keyring) { |
1476 | + key_put(keyring); |
1477 | ret = 0; |
1478 | goto error2; |
1479 | } |