Annotation of /trunk/kernel-alx/patches-4.14/0160-4.14.61-all-fixes.patch
Parent Directory | Revision Log
Revision 3238 -
(hide annotations)
(download)
Fri Nov 9 12:14:58 2018 UTC (5 years, 10 months ago) by niro
File size: 33745 byte(s)
Fri Nov 9 12:14:58 2018 UTC (5 years, 10 months ago) by niro
File size: 33745 byte(s)
-added up to patches-4.14.79
1 | niro | 3238 | diff --git a/Makefile b/Makefile |
2 | index 5b48ec630990..4bd65eabd298 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,7 +1,7 @@ | ||
6 | # SPDX-License-Identifier: GPL-2.0 | ||
7 | VERSION = 4 | ||
8 | PATCHLEVEL = 14 | ||
9 | -SUBLEVEL = 60 | ||
10 | +SUBLEVEL = 61 | ||
11 | EXTRAVERSION = | ||
12 | NAME = Petit Gorille | ||
13 | |||
14 | diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S | ||
15 | index f7bfa701219b..0fae7096ae23 100644 | ||
16 | --- a/arch/x86/entry/entry_64.S | ||
17 | +++ b/arch/x86/entry/entry_64.S | ||
18 | @@ -933,7 +933,7 @@ ENTRY(\sym) | ||
19 | |||
20 | call \do_sym | ||
21 | |||
22 | - jmp error_exit /* %ebx: no swapgs flag */ | ||
23 | + jmp error_exit | ||
24 | .endif | ||
25 | END(\sym) | ||
26 | .endm | ||
27 | @@ -1166,7 +1166,6 @@ END(paranoid_exit) | ||
28 | |||
29 | /* | ||
30 | * Save all registers in pt_regs, and switch GS if needed. | ||
31 | - * Return: EBX=0: came from user mode; EBX=1: otherwise | ||
32 | */ | ||
33 | ENTRY(error_entry) | ||
34 | UNWIND_HINT_FUNC | ||
35 | @@ -1213,7 +1212,6 @@ ENTRY(error_entry) | ||
36 | * for these here too. | ||
37 | */ | ||
38 | .Lerror_kernelspace: | ||
39 | - incl %ebx | ||
40 | leaq native_irq_return_iret(%rip), %rcx | ||
41 | cmpq %rcx, RIP+8(%rsp) | ||
42 | je .Lerror_bad_iret | ||
43 | @@ -1247,28 +1245,20 @@ ENTRY(error_entry) | ||
44 | |||
45 | /* | ||
46 | * Pretend that the exception came from user mode: set up pt_regs | ||
47 | - * as if we faulted immediately after IRET and clear EBX so that | ||
48 | - * error_exit knows that we will be returning to user mode. | ||
49 | + * as if we faulted immediately after IRET. | ||
50 | */ | ||
51 | mov %rsp, %rdi | ||
52 | call fixup_bad_iret | ||
53 | mov %rax, %rsp | ||
54 | - decl %ebx | ||
55 | jmp .Lerror_entry_from_usermode_after_swapgs | ||
56 | END(error_entry) | ||
57 | |||
58 | - | ||
59 | -/* | ||
60 | - * On entry, EBX is a "return to kernel mode" flag: | ||
61 | - * 1: already in kernel mode, don't need SWAPGS | ||
62 | - * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode | ||
63 | - */ | ||
64 | ENTRY(error_exit) | ||
65 | UNWIND_HINT_REGS | ||
66 | DISABLE_INTERRUPTS(CLBR_ANY) | ||
67 | TRACE_IRQS_OFF | ||
68 | - testl %ebx, %ebx | ||
69 | - jnz retint_kernel | ||
70 | + testb $3, CS(%rsp) | ||
71 | + jz retint_kernel | ||
72 | jmp retint_user | ||
73 | END(error_exit) | ||
74 | |||
75 | diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c | ||
76 | index ebdcc368a2d3..f48a51335538 100644 | ||
77 | --- a/arch/x86/kernel/apic/apic.c | ||
78 | +++ b/arch/x86/kernel/apic/apic.c | ||
79 | @@ -580,6 +580,9 @@ static u32 skx_deadline_rev(void) | ||
80 | case 0x04: return 0x02000014; | ||
81 | } | ||
82 | |||
83 | + if (boot_cpu_data.x86_stepping > 4) | ||
84 | + return 0; | ||
85 | + | ||
86 | return ~0U; | ||
87 | } | ||
88 | |||
89 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c | ||
90 | index 90747865205d..8d000fde1414 100644 | ||
91 | --- a/arch/x86/kvm/vmx.c | ||
92 | +++ b/arch/x86/kvm/vmx.c | ||
93 | @@ -7354,6 +7354,8 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu) | ||
94 | HRTIMER_MODE_REL_PINNED); | ||
95 | vmx->nested.preemption_timer.function = vmx_preemption_timer_fn; | ||
96 | |||
97 | + vmx->nested.vpid02 = allocate_vpid(); | ||
98 | + | ||
99 | vmx->nested.vmxon = true; | ||
100 | return 0; | ||
101 | |||
102 | @@ -9802,10 +9804,8 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) | ||
103 | goto free_vmcs; | ||
104 | } | ||
105 | |||
106 | - if (nested) { | ||
107 | + if (nested) | ||
108 | nested_vmx_setup_ctls_msrs(vmx); | ||
109 | - vmx->nested.vpid02 = allocate_vpid(); | ||
110 | - } | ||
111 | |||
112 | vmx->nested.posted_intr_nv = -1; | ||
113 | vmx->nested.current_vmptr = -1ull; | ||
114 | @@ -9822,7 +9822,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) | ||
115 | return &vmx->vcpu; | ||
116 | |||
117 | free_vmcs: | ||
118 | - free_vpid(vmx->nested.vpid02); | ||
119 | free_loaded_vmcs(vmx->loaded_vmcs); | ||
120 | free_msrs: | ||
121 | kfree(vmx->guest_msrs); | ||
122 | diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c | ||
123 | index c939f18f70cc..7685f557dcc0 100644 | ||
124 | --- a/drivers/crypto/padlock-aes.c | ||
125 | +++ b/drivers/crypto/padlock-aes.c | ||
126 | @@ -266,6 +266,8 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key, | ||
127 | return; | ||
128 | } | ||
129 | |||
130 | + count -= initial; | ||
131 | + | ||
132 | if (initial) | ||
133 | asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */ | ||
134 | : "+S"(input), "+D"(output) | ||
135 | @@ -273,7 +275,7 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key, | ||
136 | |||
137 | asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */ | ||
138 | : "+S"(input), "+D"(output) | ||
139 | - : "d"(control_word), "b"(key), "c"(count - initial)); | ||
140 | + : "d"(control_word), "b"(key), "c"(count)); | ||
141 | } | ||
142 | |||
143 | static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, | ||
144 | @@ -284,6 +286,8 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, | ||
145 | if (count < cbc_fetch_blocks) | ||
146 | return cbc_crypt(input, output, key, iv, control_word, count); | ||
147 | |||
148 | + count -= initial; | ||
149 | + | ||
150 | if (initial) | ||
151 | asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */ | ||
152 | : "+S" (input), "+D" (output), "+a" (iv) | ||
153 | @@ -291,7 +295,7 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, | ||
154 | |||
155 | asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */ | ||
156 | : "+S" (input), "+D" (output), "+a" (iv) | ||
157 | - : "d" (control_word), "b" (key), "c" (count-initial)); | ||
158 | + : "d" (control_word), "b" (key), "c" (count)); | ||
159 | return iv; | ||
160 | } | ||
161 | |||
162 | diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c | ||
163 | index 77c56264c05b..17590cb2b80d 100644 | ||
164 | --- a/drivers/gpu/drm/vc4/vc4_plane.c | ||
165 | +++ b/drivers/gpu/drm/vc4/vc4_plane.c | ||
166 | @@ -352,6 +352,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) | ||
167 | vc4_state->x_scaling[0] = VC4_SCALING_TPZ; | ||
168 | if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) | ||
169 | vc4_state->y_scaling[0] = VC4_SCALING_TPZ; | ||
170 | + } else { | ||
171 | + vc4_state->x_scaling[1] = VC4_SCALING_NONE; | ||
172 | + vc4_state->y_scaling[1] = VC4_SCALING_NONE; | ||
173 | } | ||
174 | |||
175 | vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && | ||
176 | diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c | ||
177 | index b8229d7b0ff5..f836ed1dd300 100644 | ||
178 | --- a/drivers/infiniband/core/uverbs_cmd.c | ||
179 | +++ b/drivers/infiniband/core/uverbs_cmd.c | ||
180 | @@ -1981,15 +1981,64 @@ static int modify_qp(struct ib_uverbs_file *file, | ||
181 | goto release_qp; | ||
182 | } | ||
183 | |||
184 | - if ((cmd->base.attr_mask & IB_QP_AV) && | ||
185 | - !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) { | ||
186 | - ret = -EINVAL; | ||
187 | - goto release_qp; | ||
188 | + if ((cmd->base.attr_mask & IB_QP_AV)) { | ||
189 | + if (!rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) { | ||
190 | + ret = -EINVAL; | ||
191 | + goto release_qp; | ||
192 | + } | ||
193 | + | ||
194 | + if (cmd->base.attr_mask & IB_QP_STATE && | ||
195 | + cmd->base.qp_state == IB_QPS_RTR) { | ||
196 | + /* We are in INIT->RTR TRANSITION (if we are not, | ||
197 | + * this transition will be rejected in subsequent checks). | ||
198 | + * In the INIT->RTR transition, we cannot have IB_QP_PORT set, | ||
199 | + * but the IB_QP_STATE flag is required. | ||
200 | + * | ||
201 | + * Since kernel 3.14 (commit dbf727de7440), the uverbs driver, | ||
202 | + * when IB_QP_AV is set, has required inclusion of a valid | ||
203 | + * port number in the primary AV. (AVs are created and handled | ||
204 | + * differently for infiniband and ethernet (RoCE) ports). | ||
205 | + * | ||
206 | + * Check the port number included in the primary AV against | ||
207 | + * the port number in the qp struct, which was set (and saved) | ||
208 | + * in the RST->INIT transition. | ||
209 | + */ | ||
210 | + if (cmd->base.dest.port_num != qp->real_qp->port) { | ||
211 | + ret = -EINVAL; | ||
212 | + goto release_qp; | ||
213 | + } | ||
214 | + } else { | ||
215 | + /* We are in SQD->SQD. (If we are not, this transition will | ||
216 | + * be rejected later in the verbs layer checks). | ||
217 | + * Check for both IB_QP_PORT and IB_QP_AV, these can be set | ||
218 | + * together in the SQD->SQD transition. | ||
219 | + * | ||
220 | + * If only IP_QP_AV was set, add in IB_QP_PORT as well (the | ||
221 | + * verbs layer driver does not track primary port changes | ||
222 | + * resulting from path migration. Thus, in SQD, if the primary | ||
223 | + * AV is modified, the primary port should also be modified). | ||
224 | + * | ||
225 | + * Note that in this transition, the IB_QP_STATE flag | ||
226 | + * is not allowed. | ||
227 | + */ | ||
228 | + if (((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT)) | ||
229 | + == (IB_QP_AV | IB_QP_PORT)) && | ||
230 | + cmd->base.port_num != cmd->base.dest.port_num) { | ||
231 | + ret = -EINVAL; | ||
232 | + goto release_qp; | ||
233 | + } | ||
234 | + if ((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT)) | ||
235 | + == IB_QP_AV) { | ||
236 | + cmd->base.attr_mask |= IB_QP_PORT; | ||
237 | + cmd->base.port_num = cmd->base.dest.port_num; | ||
238 | + } | ||
239 | + } | ||
240 | } | ||
241 | |||
242 | if ((cmd->base.attr_mask & IB_QP_ALT_PATH) && | ||
243 | (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) || | ||
244 | - !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) { | ||
245 | + !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num) || | ||
246 | + cmd->base.alt_port_num != cmd->base.alt_dest.port_num)) { | ||
247 | ret = -EINVAL; | ||
248 | goto release_qp; | ||
249 | } | ||
250 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c | ||
251 | index 00245b73c224..15aedb64a02b 100644 | ||
252 | --- a/drivers/net/bonding/bond_main.c | ||
253 | +++ b/drivers/net/bonding/bond_main.c | ||
254 | @@ -1687,6 +1687,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) | ||
255 | goto err_upper_unlink; | ||
256 | } | ||
257 | |||
258 | + bond->nest_level = dev_get_nest_level(bond_dev) + 1; | ||
259 | + | ||
260 | /* If the mode uses primary, then the following is handled by | ||
261 | * bond_change_active_slave(). | ||
262 | */ | ||
263 | @@ -1734,7 +1736,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) | ||
264 | if (bond_mode_uses_xmit_hash(bond)) | ||
265 | bond_update_slave_arr(bond, NULL); | ||
266 | |||
267 | - bond->nest_level = dev_get_nest_level(bond_dev); | ||
268 | |||
269 | netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n", | ||
270 | slave_dev->name, | ||
271 | @@ -3379,6 +3380,13 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res, | ||
272 | } | ||
273 | } | ||
274 | |||
275 | +static int bond_get_nest_level(struct net_device *bond_dev) | ||
276 | +{ | ||
277 | + struct bonding *bond = netdev_priv(bond_dev); | ||
278 | + | ||
279 | + return bond->nest_level; | ||
280 | +} | ||
281 | + | ||
282 | static void bond_get_stats(struct net_device *bond_dev, | ||
283 | struct rtnl_link_stats64 *stats) | ||
284 | { | ||
285 | @@ -3387,7 +3395,7 @@ static void bond_get_stats(struct net_device *bond_dev, | ||
286 | struct list_head *iter; | ||
287 | struct slave *slave; | ||
288 | |||
289 | - spin_lock(&bond->stats_lock); | ||
290 | + spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev)); | ||
291 | memcpy(stats, &bond->bond_stats, sizeof(*stats)); | ||
292 | |||
293 | rcu_read_lock(); | ||
294 | @@ -4182,6 +4190,7 @@ static const struct net_device_ops bond_netdev_ops = { | ||
295 | .ndo_neigh_setup = bond_neigh_setup, | ||
296 | .ndo_vlan_rx_add_vid = bond_vlan_rx_add_vid, | ||
297 | .ndo_vlan_rx_kill_vid = bond_vlan_rx_kill_vid, | ||
298 | + .ndo_get_lock_subclass = bond_get_nest_level, | ||
299 | #ifdef CONFIG_NET_POLL_CONTROLLER | ||
300 | .ndo_netpoll_setup = bond_netpoll_setup, | ||
301 | .ndo_netpoll_cleanup = bond_netpoll_cleanup, | ||
302 | @@ -4680,6 +4689,7 @@ static int bond_init(struct net_device *bond_dev) | ||
303 | if (!bond->wq) | ||
304 | return -ENOMEM; | ||
305 | |||
306 | + bond->nest_level = SINGLE_DEPTH_NESTING; | ||
307 | netdev_lockdep_set_classes(bond_dev); | ||
308 | |||
309 | list_add_tail(&bond->bond_list, &bn->dev_list); | ||
310 | diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c | ||
311 | index b00358297424..d0846ae9e0e4 100644 | ||
312 | --- a/drivers/net/can/usb/ems_usb.c | ||
313 | +++ b/drivers/net/can/usb/ems_usb.c | ||
314 | @@ -1071,6 +1071,7 @@ static void ems_usb_disconnect(struct usb_interface *intf) | ||
315 | usb_free_urb(dev->intr_urb); | ||
316 | |||
317 | kfree(dev->intr_in_buffer); | ||
318 | + kfree(dev->tx_msg_buffer); | ||
319 | } | ||
320 | } | ||
321 | |||
322 | diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | ||
323 | index 667415301066..f697084937c3 100644 | ||
324 | --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | ||
325 | +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | ||
326 | @@ -1616,7 +1616,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) | ||
327 | int vport_num; | ||
328 | int err; | ||
329 | |||
330 | - if (!MLX5_VPORT_MANAGER(dev)) | ||
331 | + if (!MLX5_ESWITCH_MANAGER(dev)) | ||
332 | return 0; | ||
333 | |||
334 | esw_info(dev, | ||
335 | @@ -1689,7 +1689,7 @@ abort: | ||
336 | |||
337 | void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw) | ||
338 | { | ||
339 | - if (!esw || !MLX5_VPORT_MANAGER(esw->dev)) | ||
340 | + if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev)) | ||
341 | return; | ||
342 | |||
343 | esw_info(esw->dev, "cleanup\n"); | ||
344 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | ||
345 | index 8d375e51a526..6a393b16a1fc 100644 | ||
346 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | ||
347 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | ||
348 | @@ -257,7 +257,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev, | ||
349 | return -ENOMEM; | ||
350 | |||
351 | /* Enable pci device */ | ||
352 | - ret = pcim_enable_device(pdev); | ||
353 | + ret = pci_enable_device(pdev); | ||
354 | if (ret) { | ||
355 | dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n", | ||
356 | __func__); | ||
357 | @@ -300,9 +300,45 @@ static int stmmac_pci_probe(struct pci_dev *pdev, | ||
358 | static void stmmac_pci_remove(struct pci_dev *pdev) | ||
359 | { | ||
360 | stmmac_dvr_remove(&pdev->dev); | ||
361 | + pci_disable_device(pdev); | ||
362 | } | ||
363 | |||
364 | -static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_suspend, stmmac_resume); | ||
365 | +static int stmmac_pci_suspend(struct device *dev) | ||
366 | +{ | ||
367 | + struct pci_dev *pdev = to_pci_dev(dev); | ||
368 | + int ret; | ||
369 | + | ||
370 | + ret = stmmac_suspend(dev); | ||
371 | + if (ret) | ||
372 | + return ret; | ||
373 | + | ||
374 | + ret = pci_save_state(pdev); | ||
375 | + if (ret) | ||
376 | + return ret; | ||
377 | + | ||
378 | + pci_disable_device(pdev); | ||
379 | + pci_wake_from_d3(pdev, true); | ||
380 | + return 0; | ||
381 | +} | ||
382 | + | ||
383 | +static int stmmac_pci_resume(struct device *dev) | ||
384 | +{ | ||
385 | + struct pci_dev *pdev = to_pci_dev(dev); | ||
386 | + int ret; | ||
387 | + | ||
388 | + pci_restore_state(pdev); | ||
389 | + pci_set_power_state(pdev, PCI_D0); | ||
390 | + | ||
391 | + ret = pci_enable_device(pdev); | ||
392 | + if (ret) | ||
393 | + return ret; | ||
394 | + | ||
395 | + pci_set_master(pdev); | ||
396 | + | ||
397 | + return stmmac_resume(dev); | ||
398 | +} | ||
399 | + | ||
400 | +static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_pci_suspend, stmmac_pci_resume); | ||
401 | |||
402 | /* synthetic ID, no official vendor */ | ||
403 | #define PCI_VENDOR_ID_STMMAC 0x700 | ||
404 | diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c | ||
405 | index 73da5e63a609..2c80c722feca 100644 | ||
406 | --- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c | ||
407 | +++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c | ||
408 | @@ -177,6 +177,17 @@ const struct iwl_cfg iwl9260_2ac_cfg = { | ||
409 | .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, | ||
410 | }; | ||
411 | |||
412 | +const struct iwl_cfg iwl9260_killer_2ac_cfg = { | ||
413 | + .name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)", | ||
414 | + .fw_name_pre = IWL9260A_FW_PRE, | ||
415 | + .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE, | ||
416 | + IWL_DEVICE_9000, | ||
417 | + .ht_params = &iwl9000_ht_params, | ||
418 | + .nvm_ver = IWL9000_NVM_VERSION, | ||
419 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, | ||
420 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, | ||
421 | +}; | ||
422 | + | ||
423 | const struct iwl_cfg iwl9270_2ac_cfg = { | ||
424 | .name = "Intel(R) Dual Band Wireless AC 9270", | ||
425 | .fw_name_pre = IWL9260A_FW_PRE, | ||
426 | @@ -266,6 +277,34 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = { | ||
427 | .soc_latency = 5000, | ||
428 | }; | ||
429 | |||
430 | +const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = { | ||
431 | + .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)", | ||
432 | + .fw_name_pre = IWL9000A_FW_PRE, | ||
433 | + .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, | ||
434 | + .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, | ||
435 | + IWL_DEVICE_9000, | ||
436 | + .ht_params = &iwl9000_ht_params, | ||
437 | + .nvm_ver = IWL9000_NVM_VERSION, | ||
438 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, | ||
439 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, | ||
440 | + .integrated = true, | ||
441 | + .soc_latency = 5000, | ||
442 | +}; | ||
443 | + | ||
444 | +const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = { | ||
445 | + .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)", | ||
446 | + .fw_name_pre = IWL9000A_FW_PRE, | ||
447 | + .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, | ||
448 | + .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, | ||
449 | + IWL_DEVICE_9000, | ||
450 | + .ht_params = &iwl9000_ht_params, | ||
451 | + .nvm_ver = IWL9000_NVM_VERSION, | ||
452 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, | ||
453 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, | ||
454 | + .integrated = true, | ||
455 | + .soc_latency = 5000, | ||
456 | +}; | ||
457 | + | ||
458 | const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = { | ||
459 | .name = "Intel(R) Dual Band Wireless AC 9460", | ||
460 | .fw_name_pre = IWL9000A_FW_PRE, | ||
461 | @@ -326,6 +365,36 @@ const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = { | ||
462 | .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK | ||
463 | }; | ||
464 | |||
465 | +const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = { | ||
466 | + .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)", | ||
467 | + .fw_name_pre = IWL9000A_FW_PRE, | ||
468 | + .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, | ||
469 | + .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, | ||
470 | + IWL_DEVICE_9000, | ||
471 | + .ht_params = &iwl9000_ht_params, | ||
472 | + .nvm_ver = IWL9000_NVM_VERSION, | ||
473 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, | ||
474 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, | ||
475 | + .integrated = true, | ||
476 | + .soc_latency = 5000, | ||
477 | + .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK | ||
478 | +}; | ||
479 | + | ||
480 | +const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = { | ||
481 | + .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)", | ||
482 | + .fw_name_pre = IWL9000A_FW_PRE, | ||
483 | + .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, | ||
484 | + .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, | ||
485 | + IWL_DEVICE_9000, | ||
486 | + .ht_params = &iwl9000_ht_params, | ||
487 | + .nvm_ver = IWL9000_NVM_VERSION, | ||
488 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, | ||
489 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, | ||
490 | + .integrated = true, | ||
491 | + .soc_latency = 5000, | ||
492 | + .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK | ||
493 | +}; | ||
494 | + | ||
495 | MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); | ||
496 | MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); | ||
497 | MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); | ||
498 | diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h | ||
499 | index 85fe1a928adc..70f3c327eb4a 100644 | ||
500 | --- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h | ||
501 | +++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h | ||
502 | @@ -470,6 +470,7 @@ extern const struct iwl_cfg iwl8265_2ac_sdio_cfg; | ||
503 | extern const struct iwl_cfg iwl4165_2ac_sdio_cfg; | ||
504 | extern const struct iwl_cfg iwl9160_2ac_cfg; | ||
505 | extern const struct iwl_cfg iwl9260_2ac_cfg; | ||
506 | +extern const struct iwl_cfg iwl9260_killer_2ac_cfg; | ||
507 | extern const struct iwl_cfg iwl9270_2ac_cfg; | ||
508 | extern const struct iwl_cfg iwl9460_2ac_cfg; | ||
509 | extern const struct iwl_cfg iwl9560_2ac_cfg; | ||
510 | @@ -477,10 +478,14 @@ extern const struct iwl_cfg iwl9460_2ac_cfg_soc; | ||
511 | extern const struct iwl_cfg iwl9461_2ac_cfg_soc; | ||
512 | extern const struct iwl_cfg iwl9462_2ac_cfg_soc; | ||
513 | extern const struct iwl_cfg iwl9560_2ac_cfg_soc; | ||
514 | +extern const struct iwl_cfg iwl9560_killer_2ac_cfg_soc; | ||
515 | +extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc; | ||
516 | extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk; | ||
517 | extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk; | ||
518 | extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk; | ||
519 | extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk; | ||
520 | +extern const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk; | ||
521 | +extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk; | ||
522 | extern const struct iwl_cfg iwla000_2ac_cfg_hr; | ||
523 | extern const struct iwl_cfg iwla000_2ac_cfg_hr_cdb; | ||
524 | extern const struct iwl_cfg iwla000_2ac_cfg_jf; | ||
525 | diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c | ||
526 | index 9a8605abb00a..4cbc6cb8bf89 100644 | ||
527 | --- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c | ||
528 | +++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c | ||
529 | @@ -543,6 +543,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
530 | {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)}, | ||
531 | {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)}, | ||
532 | {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)}, | ||
533 | + {IWL_PCI_DEVICE(0x2526, 0x1550, iwl9260_killer_2ac_cfg)}, | ||
534 | + {IWL_PCI_DEVICE(0x2526, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
535 | + {IWL_PCI_DEVICE(0x2526, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
536 | {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)}, | ||
537 | {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
538 | {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
539 | @@ -552,6 +555,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
540 | {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)}, | ||
541 | {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)}, | ||
542 | {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)}, | ||
543 | + {IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_cfg)}, | ||
544 | {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)}, | ||
545 | {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)}, | ||
546 | {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)}, | ||
547 | @@ -576,6 +580,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
548 | {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)}, | ||
549 | {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)}, | ||
550 | {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)}, | ||
551 | + {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
552 | + {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
553 | {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
554 | {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
555 | {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)}, | ||
556 | @@ -602,6 +608,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
557 | {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)}, | ||
558 | {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)}, | ||
559 | {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)}, | ||
560 | + {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
561 | + {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
562 | {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
563 | {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
564 | {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)}, | ||
565 | @@ -628,6 +636,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
566 | {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)}, | ||
567 | {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)}, | ||
568 | {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)}, | ||
569 | + {IWL_PCI_DEVICE(0x31DC, 0x1551, iwl9560_killer_s_2ac_cfg_shared_clk)}, | ||
570 | + {IWL_PCI_DEVICE(0x31DC, 0x1552, iwl9560_killer_2ac_cfg_shared_clk)}, | ||
571 | {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)}, | ||
572 | {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)}, | ||
573 | {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)}, | ||
574 | @@ -654,6 +664,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
575 | {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)}, | ||
576 | {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)}, | ||
577 | {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)}, | ||
578 | + {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
579 | + {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
580 | {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
581 | {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
582 | {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)}, | ||
583 | @@ -680,6 +692,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
584 | {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)}, | ||
585 | {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)}, | ||
586 | {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)}, | ||
587 | + {IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
588 | + {IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
589 | {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
590 | {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
591 | {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)}, | ||
592 | @@ -706,6 +720,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
593 | {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)}, | ||
594 | {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)}, | ||
595 | {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)}, | ||
596 | + {IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
597 | + {IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
598 | {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
599 | {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
600 | {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)}, | ||
601 | @@ -741,6 +757,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
602 | {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)}, | ||
603 | {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)}, | ||
604 | {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)}, | ||
605 | + {IWL_PCI_DEVICE(0x9DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
606 | + {IWL_PCI_DEVICE(0x9DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
607 | {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)}, | ||
608 | {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
609 | {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
610 | @@ -769,6 +787,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
611 | {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)}, | ||
612 | {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)}, | ||
613 | {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)}, | ||
614 | + {IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
615 | + {IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
616 | {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
617 | {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
618 | {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)}, | ||
619 | @@ -795,6 +815,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { | ||
620 | {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)}, | ||
621 | {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)}, | ||
622 | {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)}, | ||
623 | + {IWL_PCI_DEVICE(0xA370, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, | ||
624 | + {IWL_PCI_DEVICE(0xA370, 0x1552, iwl9560_killer_2ac_cfg_soc)}, | ||
625 | {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)}, | ||
626 | {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)}, | ||
627 | {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)}, | ||
628 | diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c | ||
629 | index 4d49fb8f2bbc..3a406b40f150 100644 | ||
630 | --- a/drivers/scsi/sg.c | ||
631 | +++ b/drivers/scsi/sg.c | ||
632 | @@ -2186,6 +2186,7 @@ sg_add_sfp(Sg_device * sdp) | ||
633 | write_lock_irqsave(&sdp->sfd_lock, iflags); | ||
634 | if (atomic_read(&sdp->detaching)) { | ||
635 | write_unlock_irqrestore(&sdp->sfd_lock, iflags); | ||
636 | + kfree(sfp); | ||
637 | return ERR_PTR(-ENODEV); | ||
638 | } | ||
639 | list_add_tail(&sfp->sfd_siblings, &sdp->sfds); | ||
640 | diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c | ||
641 | index f0b3a0b9d42f..36c9fbf70d44 100644 | ||
642 | --- a/drivers/virtio/virtio_balloon.c | ||
643 | +++ b/drivers/virtio/virtio_balloon.c | ||
644 | @@ -490,7 +490,9 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, | ||
645 | tell_host(vb, vb->inflate_vq); | ||
646 | |||
647 | /* balloon's page migration 2nd step -- deflate "page" */ | ||
648 | + spin_lock_irqsave(&vb_dev_info->pages_lock, flags); | ||
649 | balloon_page_delete(page); | ||
650 | + spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags); | ||
651 | vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE; | ||
652 | set_page_pfns(vb, vb->pfns, page); | ||
653 | tell_host(vb, vb->deflate_vq); | ||
654 | diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c | ||
655 | index 2751476e6b6e..f098b9f1c396 100644 | ||
656 | --- a/fs/squashfs/block.c | ||
657 | +++ b/fs/squashfs/block.c | ||
658 | @@ -167,6 +167,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length, | ||
659 | } | ||
660 | |||
661 | if (compressed) { | ||
662 | + if (!msblk->stream) | ||
663 | + goto read_failure; | ||
664 | length = squashfs_decompress(msblk, bh, b, offset, length, | ||
665 | output); | ||
666 | if (length < 0) | ||
667 | diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c | ||
668 | index 86ad9a4b8c36..0681feab4a84 100644 | ||
669 | --- a/fs/squashfs/fragment.c | ||
670 | +++ b/fs/squashfs/fragment.c | ||
671 | @@ -49,11 +49,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment, | ||
672 | u64 *fragment_block) | ||
673 | { | ||
674 | struct squashfs_sb_info *msblk = sb->s_fs_info; | ||
675 | - int block = SQUASHFS_FRAGMENT_INDEX(fragment); | ||
676 | - int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment); | ||
677 | - u64 start_block = le64_to_cpu(msblk->fragment_index[block]); | ||
678 | + int block, offset, size; | ||
679 | struct squashfs_fragment_entry fragment_entry; | ||
680 | - int size; | ||
681 | + u64 start_block; | ||
682 | + | ||
683 | + if (fragment >= msblk->fragments) | ||
684 | + return -EIO; | ||
685 | + block = SQUASHFS_FRAGMENT_INDEX(fragment); | ||
686 | + offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment); | ||
687 | + | ||
688 | + start_block = le64_to_cpu(msblk->fragment_index[block]); | ||
689 | |||
690 | size = squashfs_read_metadata(sb, &fragment_entry, &start_block, | ||
691 | &offset, sizeof(fragment_entry)); | ||
692 | diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h | ||
693 | index 1da565cb50c3..ef69c31947bf 100644 | ||
694 | --- a/fs/squashfs/squashfs_fs_sb.h | ||
695 | +++ b/fs/squashfs/squashfs_fs_sb.h | ||
696 | @@ -75,6 +75,7 @@ struct squashfs_sb_info { | ||
697 | unsigned short block_log; | ||
698 | long long bytes_used; | ||
699 | unsigned int inodes; | ||
700 | + unsigned int fragments; | ||
701 | int xattr_ids; | ||
702 | }; | ||
703 | #endif | ||
704 | diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c | ||
705 | index cf01e15a7b16..1516bb779b8d 100644 | ||
706 | --- a/fs/squashfs/super.c | ||
707 | +++ b/fs/squashfs/super.c | ||
708 | @@ -175,6 +175,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) | ||
709 | msblk->inode_table = le64_to_cpu(sblk->inode_table_start); | ||
710 | msblk->directory_table = le64_to_cpu(sblk->directory_table_start); | ||
711 | msblk->inodes = le32_to_cpu(sblk->inodes); | ||
712 | + msblk->fragments = le32_to_cpu(sblk->fragments); | ||
713 | flags = le16_to_cpu(sblk->flags); | ||
714 | |||
715 | TRACE("Found valid superblock on %pg\n", sb->s_bdev); | ||
716 | @@ -185,7 +186,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) | ||
717 | TRACE("Filesystem size %lld bytes\n", msblk->bytes_used); | ||
718 | TRACE("Block size %d\n", msblk->block_size); | ||
719 | TRACE("Number of inodes %d\n", msblk->inodes); | ||
720 | - TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments)); | ||
721 | + TRACE("Number of fragments %d\n", msblk->fragments); | ||
722 | TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids)); | ||
723 | TRACE("sblk->inode_table_start %llx\n", msblk->inode_table); | ||
724 | TRACE("sblk->directory_table_start %llx\n", msblk->directory_table); | ||
725 | @@ -272,7 +273,7 @@ allocate_id_index_table: | ||
726 | sb->s_export_op = &squashfs_export_ops; | ||
727 | |||
728 | handle_fragments: | ||
729 | - fragments = le32_to_cpu(sblk->fragments); | ||
730 | + fragments = msblk->fragments; | ||
731 | if (fragments == 0) | ||
732 | goto check_directory_table; | ||
733 | |||
734 | diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c | ||
735 | index f6ed92524a03..3eda623e4cb4 100644 | ||
736 | --- a/fs/userfaultfd.c | ||
737 | +++ b/fs/userfaultfd.c | ||
738 | @@ -628,8 +628,10 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx, | ||
739 | /* the various vma->vm_userfaultfd_ctx still points to it */ | ||
740 | down_write(&mm->mmap_sem); | ||
741 | for (vma = mm->mmap; vma; vma = vma->vm_next) | ||
742 | - if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) | ||
743 | + if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) { | ||
744 | vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; | ||
745 | + vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING); | ||
746 | + } | ||
747 | up_write(&mm->mmap_sem); | ||
748 | |||
749 | userfaultfd_ctx_put(release_new_ctx); | ||
750 | diff --git a/kernel/auditsc.c b/kernel/auditsc.c | ||
751 | index 677053a2fb57..76d789d6cea0 100644 | ||
752 | --- a/kernel/auditsc.c | ||
753 | +++ b/kernel/auditsc.c | ||
754 | @@ -1274,8 +1274,12 @@ static void show_special(struct audit_context *context, int *call_panic) | ||
755 | break; | ||
756 | case AUDIT_KERN_MODULE: | ||
757 | audit_log_format(ab, "name="); | ||
758 | - audit_log_untrustedstring(ab, context->module.name); | ||
759 | - kfree(context->module.name); | ||
760 | + if (context->module.name) { | ||
761 | + audit_log_untrustedstring(ab, context->module.name); | ||
762 | + kfree(context->module.name); | ||
763 | + } else | ||
764 | + audit_log_format(ab, "(null)"); | ||
765 | + | ||
766 | break; | ||
767 | } | ||
768 | audit_log_end(ab); | ||
769 | @@ -2387,8 +2391,9 @@ void __audit_log_kern_module(char *name) | ||
770 | { | ||
771 | struct audit_context *context = current->audit_context; | ||
772 | |||
773 | - context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL); | ||
774 | - strcpy(context->module.name, name); | ||
775 | + context->module.name = kstrdup(name, GFP_KERNEL); | ||
776 | + if (!context->module.name) | ||
777 | + audit_log_lost("out of memory in __audit_log_kern_module"); | ||
778 | context->type = AUDIT_KERN_MODULE; | ||
779 | } | ||
780 | |||
781 | diff --git a/net/dsa/slave.c b/net/dsa/slave.c | ||
782 | index 865e29e62bad..242e74b9d454 100644 | ||
783 | --- a/net/dsa/slave.c | ||
784 | +++ b/net/dsa/slave.c | ||
785 | @@ -1219,6 +1219,9 @@ int dsa_slave_suspend(struct net_device *slave_dev) | ||
786 | { | ||
787 | struct dsa_slave_priv *p = netdev_priv(slave_dev); | ||
788 | |||
789 | + if (!netif_running(slave_dev)) | ||
790 | + return 0; | ||
791 | + | ||
792 | netif_device_detach(slave_dev); | ||
793 | |||
794 | if (p->phy) { | ||
795 | @@ -1236,6 +1239,9 @@ int dsa_slave_resume(struct net_device *slave_dev) | ||
796 | { | ||
797 | struct dsa_slave_priv *p = netdev_priv(slave_dev); | ||
798 | |||
799 | + if (!netif_running(slave_dev)) | ||
800 | + return 0; | ||
801 | + | ||
802 | netif_device_attach(slave_dev); | ||
803 | |||
804 | if (p->phy) { | ||
805 | diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c | ||
806 | index e691705f0a85..ba4454ecdf0f 100644 | ||
807 | --- a/net/ipv4/inet_fragment.c | ||
808 | +++ b/net/ipv4/inet_fragment.c | ||
809 | @@ -356,11 +356,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, | ||
810 | { | ||
811 | struct inet_frag_queue *q; | ||
812 | |||
813 | - if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { | ||
814 | - inet_frag_schedule_worker(f); | ||
815 | - return NULL; | ||
816 | - } | ||
817 | - | ||
818 | q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); | ||
819 | if (!q) | ||
820 | return NULL; | ||
821 | @@ -397,6 +392,11 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, | ||
822 | struct inet_frag_queue *q; | ||
823 | int depth = 0; | ||
824 | |||
825 | + if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { | ||
826 | + inet_frag_schedule_worker(f); | ||
827 | + return NULL; | ||
828 | + } | ||
829 | + | ||
830 | if (frag_mem_limit(nf) > nf->low_thresh) | ||
831 | inet_frag_schedule_worker(f); | ||
832 | |||
833 | diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c | ||
834 | index df8fe0503de0..4cb1befc3949 100644 | ||
835 | --- a/net/ipv4/ip_fragment.c | ||
836 | +++ b/net/ipv4/ip_fragment.c | ||
837 | @@ -447,11 +447,16 @@ found: | ||
838 | int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ | ||
839 | |||
840 | if (i < next->len) { | ||
841 | + int delta = -next->truesize; | ||
842 | + | ||
843 | /* Eat head of the next overlapped fragment | ||
844 | * and leave the loop. The next ones cannot overlap. | ||
845 | */ | ||
846 | if (!pskb_pull(next, i)) | ||
847 | goto err; | ||
848 | + delta += next->truesize; | ||
849 | + if (delta) | ||
850 | + add_frag_mem_limit(qp->q.net, delta); | ||
851 | FRAG_CB(next)->offset += i; | ||
852 | qp->q.meat -= i; | ||
853 | if (next->ip_summed != CHECKSUM_UNNECESSARY) | ||
854 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c | ||
855 | index b2fcbf012056..68c9d1833b95 100644 | ||
856 | --- a/net/netlink/af_netlink.c | ||
857 | +++ b/net/netlink/af_netlink.c | ||
858 | @@ -63,6 +63,7 @@ | ||
859 | #include <linux/hash.h> | ||
860 | #include <linux/genetlink.h> | ||
861 | #include <linux/net_namespace.h> | ||
862 | +#include <linux/nospec.h> | ||
863 | |||
864 | #include <net/net_namespace.h> | ||
865 | #include <net/sock.h> | ||
866 | @@ -647,6 +648,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol, | ||
867 | |||
868 | if (protocol < 0 || protocol >= MAX_LINKS) | ||
869 | return -EPROTONOSUPPORT; | ||
870 | + protocol = array_index_nospec(protocol, MAX_LINKS); | ||
871 | |||
872 | netlink_lock_table(); | ||
873 | #ifdef CONFIG_MODULES | ||
874 | diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c | ||
875 | index 3028298ca561..62b1581d44a5 100644 | ||
876 | --- a/net/rxrpc/call_accept.c | ||
877 | +++ b/net/rxrpc/call_accept.c | ||
878 | @@ -115,9 +115,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, | ||
879 | while (*pp) { | ||
880 | parent = *pp; | ||
881 | xcall = rb_entry(parent, struct rxrpc_call, sock_node); | ||
882 | - if (user_call_ID < call->user_call_ID) | ||
883 | + if (user_call_ID < xcall->user_call_ID) | ||
884 | pp = &(*pp)->rb_left; | ||
885 | - else if (user_call_ID > call->user_call_ID) | ||
886 | + else if (user_call_ID > xcall->user_call_ID) | ||
887 | pp = &(*pp)->rb_right; | ||
888 | else | ||
889 | goto id_in_use; | ||
890 | diff --git a/net/socket.c b/net/socket.c | ||
891 | index 8b2bef6cfe42..d27922639a20 100644 | ||
892 | --- a/net/socket.c | ||
893 | +++ b/net/socket.c | ||
894 | @@ -89,6 +89,7 @@ | ||
895 | #include <linux/magic.h> | ||
896 | #include <linux/slab.h> | ||
897 | #include <linux/xattr.h> | ||
898 | +#include <linux/nospec.h> | ||
899 | |||
900 | #include <linux/uaccess.h> | ||
901 | #include <asm/unistd.h> | ||
902 | @@ -2443,6 +2444,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args) | ||
903 | |||
904 | if (call < 1 || call > SYS_SENDMMSG) | ||
905 | return -EINVAL; | ||
906 | + call = array_index_nospec(call, SYS_SENDMMSG + 1); | ||
907 | |||
908 | len = nargs[call]; | ||
909 | if (len > sizeof(a)) |