Contents of /trunk/kernel-alx/patches-4.14/0160-4.14.61-all-fixes.patch
Parent Directory | Revision Log
Revision 3238 -
(show annotations)
(download)
Fri Nov 9 12:14:58 2018 UTC (5 years, 10 months ago) by niro
File size: 33745 byte(s)
Fri Nov 9 12:14:58 2018 UTC (5 years, 10 months ago) by niro
File size: 33745 byte(s)
-added up to patches-4.14.79
1 | diff --git a/Makefile b/Makefile |
2 | index 5b48ec630990..4bd65eabd298 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,7 +1,7 @@ |
6 | # SPDX-License-Identifier: GPL-2.0 |
7 | VERSION = 4 |
8 | PATCHLEVEL = 14 |
9 | -SUBLEVEL = 60 |
10 | +SUBLEVEL = 61 |
11 | EXTRAVERSION = |
12 | NAME = Petit Gorille |
13 | |
14 | diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S |
15 | index f7bfa701219b..0fae7096ae23 100644 |
16 | --- a/arch/x86/entry/entry_64.S |
17 | +++ b/arch/x86/entry/entry_64.S |
18 | @@ -933,7 +933,7 @@ ENTRY(\sym) |
19 | |
20 | call \do_sym |
21 | |
22 | - jmp error_exit /* %ebx: no swapgs flag */ |
23 | + jmp error_exit |
24 | .endif |
25 | END(\sym) |
26 | .endm |
27 | @@ -1166,7 +1166,6 @@ END(paranoid_exit) |
28 | |
29 | /* |
30 | * Save all registers in pt_regs, and switch GS if needed. |
31 | - * Return: EBX=0: came from user mode; EBX=1: otherwise |
32 | */ |
33 | ENTRY(error_entry) |
34 | UNWIND_HINT_FUNC |
35 | @@ -1213,7 +1212,6 @@ ENTRY(error_entry) |
36 | * for these here too. |
37 | */ |
38 | .Lerror_kernelspace: |
39 | - incl %ebx |
40 | leaq native_irq_return_iret(%rip), %rcx |
41 | cmpq %rcx, RIP+8(%rsp) |
42 | je .Lerror_bad_iret |
43 | @@ -1247,28 +1245,20 @@ ENTRY(error_entry) |
44 | |
45 | /* |
46 | * Pretend that the exception came from user mode: set up pt_regs |
47 | - * as if we faulted immediately after IRET and clear EBX so that |
48 | - * error_exit knows that we will be returning to user mode. |
49 | + * as if we faulted immediately after IRET. |
50 | */ |
51 | mov %rsp, %rdi |
52 | call fixup_bad_iret |
53 | mov %rax, %rsp |
54 | - decl %ebx |
55 | jmp .Lerror_entry_from_usermode_after_swapgs |
56 | END(error_entry) |
57 | |
58 | - |
59 | -/* |
60 | - * On entry, EBX is a "return to kernel mode" flag: |
61 | - * 1: already in kernel mode, don't need SWAPGS |
62 | - * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode |
63 | - */ |
64 | ENTRY(error_exit) |
65 | UNWIND_HINT_REGS |
66 | DISABLE_INTERRUPTS(CLBR_ANY) |
67 | TRACE_IRQS_OFF |
68 | - testl %ebx, %ebx |
69 | - jnz retint_kernel |
70 | + testb $3, CS(%rsp) |
71 | + jz retint_kernel |
72 | jmp retint_user |
73 | END(error_exit) |
74 | |
75 | diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c |
76 | index ebdcc368a2d3..f48a51335538 100644 |
77 | --- a/arch/x86/kernel/apic/apic.c |
78 | +++ b/arch/x86/kernel/apic/apic.c |
79 | @@ -580,6 +580,9 @@ static u32 skx_deadline_rev(void) |
80 | case 0x04: return 0x02000014; |
81 | } |
82 | |
83 | + if (boot_cpu_data.x86_stepping > 4) |
84 | + return 0; |
85 | + |
86 | return ~0U; |
87 | } |
88 | |
89 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
90 | index 90747865205d..8d000fde1414 100644 |
91 | --- a/arch/x86/kvm/vmx.c |
92 | +++ b/arch/x86/kvm/vmx.c |
93 | @@ -7354,6 +7354,8 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu) |
94 | HRTIMER_MODE_REL_PINNED); |
95 | vmx->nested.preemption_timer.function = vmx_preemption_timer_fn; |
96 | |
97 | + vmx->nested.vpid02 = allocate_vpid(); |
98 | + |
99 | vmx->nested.vmxon = true; |
100 | return 0; |
101 | |
102 | @@ -9802,10 +9804,8 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) |
103 | goto free_vmcs; |
104 | } |
105 | |
106 | - if (nested) { |
107 | + if (nested) |
108 | nested_vmx_setup_ctls_msrs(vmx); |
109 | - vmx->nested.vpid02 = allocate_vpid(); |
110 | - } |
111 | |
112 | vmx->nested.posted_intr_nv = -1; |
113 | vmx->nested.current_vmptr = -1ull; |
114 | @@ -9822,7 +9822,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) |
115 | return &vmx->vcpu; |
116 | |
117 | free_vmcs: |
118 | - free_vpid(vmx->nested.vpid02); |
119 | free_loaded_vmcs(vmx->loaded_vmcs); |
120 | free_msrs: |
121 | kfree(vmx->guest_msrs); |
122 | diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c |
123 | index c939f18f70cc..7685f557dcc0 100644 |
124 | --- a/drivers/crypto/padlock-aes.c |
125 | +++ b/drivers/crypto/padlock-aes.c |
126 | @@ -266,6 +266,8 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key, |
127 | return; |
128 | } |
129 | |
130 | + count -= initial; |
131 | + |
132 | if (initial) |
133 | asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */ |
134 | : "+S"(input), "+D"(output) |
135 | @@ -273,7 +275,7 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key, |
136 | |
137 | asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */ |
138 | : "+S"(input), "+D"(output) |
139 | - : "d"(control_word), "b"(key), "c"(count - initial)); |
140 | + : "d"(control_word), "b"(key), "c"(count)); |
141 | } |
142 | |
143 | static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, |
144 | @@ -284,6 +286,8 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, |
145 | if (count < cbc_fetch_blocks) |
146 | return cbc_crypt(input, output, key, iv, control_word, count); |
147 | |
148 | + count -= initial; |
149 | + |
150 | if (initial) |
151 | asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */ |
152 | : "+S" (input), "+D" (output), "+a" (iv) |
153 | @@ -291,7 +295,7 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, |
154 | |
155 | asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */ |
156 | : "+S" (input), "+D" (output), "+a" (iv) |
157 | - : "d" (control_word), "b" (key), "c" (count-initial)); |
158 | + : "d" (control_word), "b" (key), "c" (count)); |
159 | return iv; |
160 | } |
161 | |
162 | diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c |
163 | index 77c56264c05b..17590cb2b80d 100644 |
164 | --- a/drivers/gpu/drm/vc4/vc4_plane.c |
165 | +++ b/drivers/gpu/drm/vc4/vc4_plane.c |
166 | @@ -352,6 +352,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) |
167 | vc4_state->x_scaling[0] = VC4_SCALING_TPZ; |
168 | if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) |
169 | vc4_state->y_scaling[0] = VC4_SCALING_TPZ; |
170 | + } else { |
171 | + vc4_state->x_scaling[1] = VC4_SCALING_NONE; |
172 | + vc4_state->y_scaling[1] = VC4_SCALING_NONE; |
173 | } |
174 | |
175 | vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && |
176 | diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c |
177 | index b8229d7b0ff5..f836ed1dd300 100644 |
178 | --- a/drivers/infiniband/core/uverbs_cmd.c |
179 | +++ b/drivers/infiniband/core/uverbs_cmd.c |
180 | @@ -1981,15 +1981,64 @@ static int modify_qp(struct ib_uverbs_file *file, |
181 | goto release_qp; |
182 | } |
183 | |
184 | - if ((cmd->base.attr_mask & IB_QP_AV) && |
185 | - !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) { |
186 | - ret = -EINVAL; |
187 | - goto release_qp; |
188 | + if ((cmd->base.attr_mask & IB_QP_AV)) { |
189 | + if (!rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) { |
190 | + ret = -EINVAL; |
191 | + goto release_qp; |
192 | + } |
193 | + |
194 | + if (cmd->base.attr_mask & IB_QP_STATE && |
195 | + cmd->base.qp_state == IB_QPS_RTR) { |
196 | + /* We are in INIT->RTR TRANSITION (if we are not, |
197 | + * this transition will be rejected in subsequent checks). |
198 | + * In the INIT->RTR transition, we cannot have IB_QP_PORT set, |
199 | + * but the IB_QP_STATE flag is required. |
200 | + * |
201 | + * Since kernel 3.14 (commit dbf727de7440), the uverbs driver, |
202 | + * when IB_QP_AV is set, has required inclusion of a valid |
203 | + * port number in the primary AV. (AVs are created and handled |
204 | + * differently for infiniband and ethernet (RoCE) ports). |
205 | + * |
206 | + * Check the port number included in the primary AV against |
207 | + * the port number in the qp struct, which was set (and saved) |
208 | + * in the RST->INIT transition. |
209 | + */ |
210 | + if (cmd->base.dest.port_num != qp->real_qp->port) { |
211 | + ret = -EINVAL; |
212 | + goto release_qp; |
213 | + } |
214 | + } else { |
215 | + /* We are in SQD->SQD. (If we are not, this transition will |
216 | + * be rejected later in the verbs layer checks). |
217 | + * Check for both IB_QP_PORT and IB_QP_AV, these can be set |
218 | + * together in the SQD->SQD transition. |
219 | + * |
220 | + * If only IP_QP_AV was set, add in IB_QP_PORT as well (the |
221 | + * verbs layer driver does not track primary port changes |
222 | + * resulting from path migration. Thus, in SQD, if the primary |
223 | + * AV is modified, the primary port should also be modified). |
224 | + * |
225 | + * Note that in this transition, the IB_QP_STATE flag |
226 | + * is not allowed. |
227 | + */ |
228 | + if (((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT)) |
229 | + == (IB_QP_AV | IB_QP_PORT)) && |
230 | + cmd->base.port_num != cmd->base.dest.port_num) { |
231 | + ret = -EINVAL; |
232 | + goto release_qp; |
233 | + } |
234 | + if ((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT)) |
235 | + == IB_QP_AV) { |
236 | + cmd->base.attr_mask |= IB_QP_PORT; |
237 | + cmd->base.port_num = cmd->base.dest.port_num; |
238 | + } |
239 | + } |
240 | } |
241 | |
242 | if ((cmd->base.attr_mask & IB_QP_ALT_PATH) && |
243 | (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) || |
244 | - !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) { |
245 | + !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num) || |
246 | + cmd->base.alt_port_num != cmd->base.alt_dest.port_num)) { |
247 | ret = -EINVAL; |
248 | goto release_qp; |
249 | } |
250 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c |
251 | index 00245b73c224..15aedb64a02b 100644 |
252 | --- a/drivers/net/bonding/bond_main.c |
253 | +++ b/drivers/net/bonding/bond_main.c |
254 | @@ -1687,6 +1687,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) |
255 | goto err_upper_unlink; |
256 | } |
257 | |
258 | + bond->nest_level = dev_get_nest_level(bond_dev) + 1; |
259 | + |
260 | /* If the mode uses primary, then the following is handled by |
261 | * bond_change_active_slave(). |
262 | */ |
263 | @@ -1734,7 +1736,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) |
264 | if (bond_mode_uses_xmit_hash(bond)) |
265 | bond_update_slave_arr(bond, NULL); |
266 | |
267 | - bond->nest_level = dev_get_nest_level(bond_dev); |
268 | |
269 | netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n", |
270 | slave_dev->name, |
271 | @@ -3379,6 +3380,13 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res, |
272 | } |
273 | } |
274 | |
275 | +static int bond_get_nest_level(struct net_device *bond_dev) |
276 | +{ |
277 | + struct bonding *bond = netdev_priv(bond_dev); |
278 | + |
279 | + return bond->nest_level; |
280 | +} |
281 | + |
282 | static void bond_get_stats(struct net_device *bond_dev, |
283 | struct rtnl_link_stats64 *stats) |
284 | { |
285 | @@ -3387,7 +3395,7 @@ static void bond_get_stats(struct net_device *bond_dev, |
286 | struct list_head *iter; |
287 | struct slave *slave; |
288 | |
289 | - spin_lock(&bond->stats_lock); |
290 | + spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev)); |
291 | memcpy(stats, &bond->bond_stats, sizeof(*stats)); |
292 | |
293 | rcu_read_lock(); |
294 | @@ -4182,6 +4190,7 @@ static const struct net_device_ops bond_netdev_ops = { |
295 | .ndo_neigh_setup = bond_neigh_setup, |
296 | .ndo_vlan_rx_add_vid = bond_vlan_rx_add_vid, |
297 | .ndo_vlan_rx_kill_vid = bond_vlan_rx_kill_vid, |
298 | + .ndo_get_lock_subclass = bond_get_nest_level, |
299 | #ifdef CONFIG_NET_POLL_CONTROLLER |
300 | .ndo_netpoll_setup = bond_netpoll_setup, |
301 | .ndo_netpoll_cleanup = bond_netpoll_cleanup, |
302 | @@ -4680,6 +4689,7 @@ static int bond_init(struct net_device *bond_dev) |
303 | if (!bond->wq) |
304 | return -ENOMEM; |
305 | |
306 | + bond->nest_level = SINGLE_DEPTH_NESTING; |
307 | netdev_lockdep_set_classes(bond_dev); |
308 | |
309 | list_add_tail(&bond->bond_list, &bn->dev_list); |
310 | diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c |
311 | index b00358297424..d0846ae9e0e4 100644 |
312 | --- a/drivers/net/can/usb/ems_usb.c |
313 | +++ b/drivers/net/can/usb/ems_usb.c |
314 | @@ -1071,6 +1071,7 @@ static void ems_usb_disconnect(struct usb_interface *intf) |
315 | usb_free_urb(dev->intr_urb); |
316 | |
317 | kfree(dev->intr_in_buffer); |
318 | + kfree(dev->tx_msg_buffer); |
319 | } |
320 | } |
321 | |
322 | diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c |
323 | index 667415301066..f697084937c3 100644 |
324 | --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c |
325 | +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c |
326 | @@ -1616,7 +1616,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) |
327 | int vport_num; |
328 | int err; |
329 | |
330 | - if (!MLX5_VPORT_MANAGER(dev)) |
331 | + if (!MLX5_ESWITCH_MANAGER(dev)) |
332 | return 0; |
333 | |
334 | esw_info(dev, |
335 | @@ -1689,7 +1689,7 @@ abort: |
336 | |
337 | void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw) |
338 | { |
339 | - if (!esw || !MLX5_VPORT_MANAGER(esw->dev)) |
340 | + if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev)) |
341 | return; |
342 | |
343 | esw_info(esw->dev, "cleanup\n"); |
344 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c |
345 | index 8d375e51a526..6a393b16a1fc 100644 |
346 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c |
347 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c |
348 | @@ -257,7 +257,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev, |
349 | return -ENOMEM; |
350 | |
351 | /* Enable pci device */ |
352 | - ret = pcim_enable_device(pdev); |
353 | + ret = pci_enable_device(pdev); |
354 | if (ret) { |
355 | dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n", |
356 | __func__); |
357 | @@ -300,9 +300,45 @@ static int stmmac_pci_probe(struct pci_dev *pdev, |
358 | static void stmmac_pci_remove(struct pci_dev *pdev) |
359 | { |
360 | stmmac_dvr_remove(&pdev->dev); |
361 | + pci_disable_device(pdev); |
362 | } |
363 | |
364 | -static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_suspend, stmmac_resume); |
365 | +static int stmmac_pci_suspend(struct device *dev) |
366 | +{ |
367 | + struct pci_dev *pdev = to_pci_dev(dev); |
368 | + int ret; |
369 | + |
370 | + ret = stmmac_suspend(dev); |
371 | + if (ret) |
372 | + return ret; |
373 | + |
374 | + ret = pci_save_state(pdev); |
375 | + if (ret) |
376 | + return ret; |
377 | + |
378 | + pci_disable_device(pdev); |
379 | + pci_wake_from_d3(pdev, true); |
380 | + return 0; |
381 | +} |
382 | + |
383 | +static int stmmac_pci_resume(struct device *dev) |
384 | +{ |
385 | + struct pci_dev *pdev = to_pci_dev(dev); |
386 | + int ret; |
387 | + |
388 | + pci_restore_state(pdev); |
389 | + pci_set_power_state(pdev, PCI_D0); |
390 | + |
391 | + ret = pci_enable_device(pdev); |
392 | + if (ret) |
393 | + return ret; |
394 | + |
395 | + pci_set_master(pdev); |
396 | + |
397 | + return stmmac_resume(dev); |
398 | +} |
399 | + |
400 | +static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_pci_suspend, stmmac_pci_resume); |
401 | |
402 | /* synthetic ID, no official vendor */ |
403 | #define PCI_VENDOR_ID_STMMAC 0x700 |
404 | diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c |
405 | index 73da5e63a609..2c80c722feca 100644 |
406 | --- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c |
407 | +++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c |
408 | @@ -177,6 +177,17 @@ const struct iwl_cfg iwl9260_2ac_cfg = { |
409 | .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, |
410 | }; |
411 | |
412 | +const struct iwl_cfg iwl9260_killer_2ac_cfg = { |
413 | + .name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)", |
414 | + .fw_name_pre = IWL9260A_FW_PRE, |
415 | + .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE, |
416 | + IWL_DEVICE_9000, |
417 | + .ht_params = &iwl9000_ht_params, |
418 | + .nvm_ver = IWL9000_NVM_VERSION, |
419 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, |
420 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, |
421 | +}; |
422 | + |
423 | const struct iwl_cfg iwl9270_2ac_cfg = { |
424 | .name = "Intel(R) Dual Band Wireless AC 9270", |
425 | .fw_name_pre = IWL9260A_FW_PRE, |
426 | @@ -266,6 +277,34 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = { |
427 | .soc_latency = 5000, |
428 | }; |
429 | |
430 | +const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = { |
431 | + .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)", |
432 | + .fw_name_pre = IWL9000A_FW_PRE, |
433 | + .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, |
434 | + .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, |
435 | + IWL_DEVICE_9000, |
436 | + .ht_params = &iwl9000_ht_params, |
437 | + .nvm_ver = IWL9000_NVM_VERSION, |
438 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, |
439 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, |
440 | + .integrated = true, |
441 | + .soc_latency = 5000, |
442 | +}; |
443 | + |
444 | +const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = { |
445 | + .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)", |
446 | + .fw_name_pre = IWL9000A_FW_PRE, |
447 | + .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, |
448 | + .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, |
449 | + IWL_DEVICE_9000, |
450 | + .ht_params = &iwl9000_ht_params, |
451 | + .nvm_ver = IWL9000_NVM_VERSION, |
452 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, |
453 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, |
454 | + .integrated = true, |
455 | + .soc_latency = 5000, |
456 | +}; |
457 | + |
458 | const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = { |
459 | .name = "Intel(R) Dual Band Wireless AC 9460", |
460 | .fw_name_pre = IWL9000A_FW_PRE, |
461 | @@ -326,6 +365,36 @@ const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = { |
462 | .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK |
463 | }; |
464 | |
465 | +const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = { |
466 | + .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)", |
467 | + .fw_name_pre = IWL9000A_FW_PRE, |
468 | + .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, |
469 | + .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, |
470 | + IWL_DEVICE_9000, |
471 | + .ht_params = &iwl9000_ht_params, |
472 | + .nvm_ver = IWL9000_NVM_VERSION, |
473 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, |
474 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, |
475 | + .integrated = true, |
476 | + .soc_latency = 5000, |
477 | + .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK |
478 | +}; |
479 | + |
480 | +const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = { |
481 | + .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)", |
482 | + .fw_name_pre = IWL9000A_FW_PRE, |
483 | + .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, |
484 | + .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, |
485 | + IWL_DEVICE_9000, |
486 | + .ht_params = &iwl9000_ht_params, |
487 | + .nvm_ver = IWL9000_NVM_VERSION, |
488 | + .nvm_calib_ver = IWL9000_TX_POWER_VERSION, |
489 | + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, |
490 | + .integrated = true, |
491 | + .soc_latency = 5000, |
492 | + .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK |
493 | +}; |
494 | + |
495 | MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); |
496 | MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); |
497 | MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); |
498 | diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h |
499 | index 85fe1a928adc..70f3c327eb4a 100644 |
500 | --- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h |
501 | +++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h |
502 | @@ -470,6 +470,7 @@ extern const struct iwl_cfg iwl8265_2ac_sdio_cfg; |
503 | extern const struct iwl_cfg iwl4165_2ac_sdio_cfg; |
504 | extern const struct iwl_cfg iwl9160_2ac_cfg; |
505 | extern const struct iwl_cfg iwl9260_2ac_cfg; |
506 | +extern const struct iwl_cfg iwl9260_killer_2ac_cfg; |
507 | extern const struct iwl_cfg iwl9270_2ac_cfg; |
508 | extern const struct iwl_cfg iwl9460_2ac_cfg; |
509 | extern const struct iwl_cfg iwl9560_2ac_cfg; |
510 | @@ -477,10 +478,14 @@ extern const struct iwl_cfg iwl9460_2ac_cfg_soc; |
511 | extern const struct iwl_cfg iwl9461_2ac_cfg_soc; |
512 | extern const struct iwl_cfg iwl9462_2ac_cfg_soc; |
513 | extern const struct iwl_cfg iwl9560_2ac_cfg_soc; |
514 | +extern const struct iwl_cfg iwl9560_killer_2ac_cfg_soc; |
515 | +extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc; |
516 | extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk; |
517 | extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk; |
518 | extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk; |
519 | extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk; |
520 | +extern const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk; |
521 | +extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk; |
522 | extern const struct iwl_cfg iwla000_2ac_cfg_hr; |
523 | extern const struct iwl_cfg iwla000_2ac_cfg_hr_cdb; |
524 | extern const struct iwl_cfg iwla000_2ac_cfg_jf; |
525 | diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c |
526 | index 9a8605abb00a..4cbc6cb8bf89 100644 |
527 | --- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c |
528 | +++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c |
529 | @@ -543,6 +543,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
530 | {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)}, |
531 | {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)}, |
532 | {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)}, |
533 | + {IWL_PCI_DEVICE(0x2526, 0x1550, iwl9260_killer_2ac_cfg)}, |
534 | + {IWL_PCI_DEVICE(0x2526, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
535 | + {IWL_PCI_DEVICE(0x2526, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
536 | {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)}, |
537 | {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)}, |
538 | {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)}, |
539 | @@ -552,6 +555,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
540 | {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)}, |
541 | {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)}, |
542 | {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)}, |
543 | + {IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_cfg)}, |
544 | {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)}, |
545 | {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)}, |
546 | {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)}, |
547 | @@ -576,6 +580,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
548 | {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)}, |
549 | {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)}, |
550 | {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)}, |
551 | + {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
552 | + {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
553 | {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)}, |
554 | {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)}, |
555 | {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)}, |
556 | @@ -602,6 +608,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
557 | {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)}, |
558 | {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)}, |
559 | {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)}, |
560 | + {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
561 | + {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
562 | {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)}, |
563 | {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)}, |
564 | {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)}, |
565 | @@ -628,6 +636,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
566 | {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)}, |
567 | {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)}, |
568 | {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)}, |
569 | + {IWL_PCI_DEVICE(0x31DC, 0x1551, iwl9560_killer_s_2ac_cfg_shared_clk)}, |
570 | + {IWL_PCI_DEVICE(0x31DC, 0x1552, iwl9560_killer_2ac_cfg_shared_clk)}, |
571 | {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)}, |
572 | {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)}, |
573 | {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)}, |
574 | @@ -654,6 +664,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
575 | {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)}, |
576 | {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)}, |
577 | {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)}, |
578 | + {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
579 | + {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
580 | {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)}, |
581 | {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)}, |
582 | {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)}, |
583 | @@ -680,6 +692,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
584 | {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)}, |
585 | {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)}, |
586 | {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)}, |
587 | + {IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
588 | + {IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
589 | {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)}, |
590 | {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)}, |
591 | {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)}, |
592 | @@ -706,6 +720,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
593 | {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)}, |
594 | {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)}, |
595 | {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)}, |
596 | + {IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
597 | + {IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
598 | {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)}, |
599 | {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)}, |
600 | {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)}, |
601 | @@ -741,6 +757,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
602 | {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)}, |
603 | {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)}, |
604 | {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)}, |
605 | + {IWL_PCI_DEVICE(0x9DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
606 | + {IWL_PCI_DEVICE(0x9DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
607 | {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)}, |
608 | {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)}, |
609 | {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)}, |
610 | @@ -769,6 +787,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
611 | {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)}, |
612 | {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)}, |
613 | {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)}, |
614 | + {IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
615 | + {IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
616 | {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)}, |
617 | {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)}, |
618 | {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)}, |
619 | @@ -795,6 +815,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { |
620 | {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)}, |
621 | {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)}, |
622 | {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)}, |
623 | + {IWL_PCI_DEVICE(0xA370, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, |
624 | + {IWL_PCI_DEVICE(0xA370, 0x1552, iwl9560_killer_2ac_cfg_soc)}, |
625 | {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)}, |
626 | {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)}, |
627 | {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)}, |
628 | diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c |
629 | index 4d49fb8f2bbc..3a406b40f150 100644 |
630 | --- a/drivers/scsi/sg.c |
631 | +++ b/drivers/scsi/sg.c |
632 | @@ -2186,6 +2186,7 @@ sg_add_sfp(Sg_device * sdp) |
633 | write_lock_irqsave(&sdp->sfd_lock, iflags); |
634 | if (atomic_read(&sdp->detaching)) { |
635 | write_unlock_irqrestore(&sdp->sfd_lock, iflags); |
636 | + kfree(sfp); |
637 | return ERR_PTR(-ENODEV); |
638 | } |
639 | list_add_tail(&sfp->sfd_siblings, &sdp->sfds); |
640 | diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c |
641 | index f0b3a0b9d42f..36c9fbf70d44 100644 |
642 | --- a/drivers/virtio/virtio_balloon.c |
643 | +++ b/drivers/virtio/virtio_balloon.c |
644 | @@ -490,7 +490,9 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, |
645 | tell_host(vb, vb->inflate_vq); |
646 | |
647 | /* balloon's page migration 2nd step -- deflate "page" */ |
648 | + spin_lock_irqsave(&vb_dev_info->pages_lock, flags); |
649 | balloon_page_delete(page); |
650 | + spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags); |
651 | vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE; |
652 | set_page_pfns(vb, vb->pfns, page); |
653 | tell_host(vb, vb->deflate_vq); |
654 | diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c |
655 | index 2751476e6b6e..f098b9f1c396 100644 |
656 | --- a/fs/squashfs/block.c |
657 | +++ b/fs/squashfs/block.c |
658 | @@ -167,6 +167,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length, |
659 | } |
660 | |
661 | if (compressed) { |
662 | + if (!msblk->stream) |
663 | + goto read_failure; |
664 | length = squashfs_decompress(msblk, bh, b, offset, length, |
665 | output); |
666 | if (length < 0) |
667 | diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c |
668 | index 86ad9a4b8c36..0681feab4a84 100644 |
669 | --- a/fs/squashfs/fragment.c |
670 | +++ b/fs/squashfs/fragment.c |
671 | @@ -49,11 +49,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment, |
672 | u64 *fragment_block) |
673 | { |
674 | struct squashfs_sb_info *msblk = sb->s_fs_info; |
675 | - int block = SQUASHFS_FRAGMENT_INDEX(fragment); |
676 | - int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment); |
677 | - u64 start_block = le64_to_cpu(msblk->fragment_index[block]); |
678 | + int block, offset, size; |
679 | struct squashfs_fragment_entry fragment_entry; |
680 | - int size; |
681 | + u64 start_block; |
682 | + |
683 | + if (fragment >= msblk->fragments) |
684 | + return -EIO; |
685 | + block = SQUASHFS_FRAGMENT_INDEX(fragment); |
686 | + offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment); |
687 | + |
688 | + start_block = le64_to_cpu(msblk->fragment_index[block]); |
689 | |
690 | size = squashfs_read_metadata(sb, &fragment_entry, &start_block, |
691 | &offset, sizeof(fragment_entry)); |
692 | diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h |
693 | index 1da565cb50c3..ef69c31947bf 100644 |
694 | --- a/fs/squashfs/squashfs_fs_sb.h |
695 | +++ b/fs/squashfs/squashfs_fs_sb.h |
696 | @@ -75,6 +75,7 @@ struct squashfs_sb_info { |
697 | unsigned short block_log; |
698 | long long bytes_used; |
699 | unsigned int inodes; |
700 | + unsigned int fragments; |
701 | int xattr_ids; |
702 | }; |
703 | #endif |
704 | diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c |
705 | index cf01e15a7b16..1516bb779b8d 100644 |
706 | --- a/fs/squashfs/super.c |
707 | +++ b/fs/squashfs/super.c |
708 | @@ -175,6 +175,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) |
709 | msblk->inode_table = le64_to_cpu(sblk->inode_table_start); |
710 | msblk->directory_table = le64_to_cpu(sblk->directory_table_start); |
711 | msblk->inodes = le32_to_cpu(sblk->inodes); |
712 | + msblk->fragments = le32_to_cpu(sblk->fragments); |
713 | flags = le16_to_cpu(sblk->flags); |
714 | |
715 | TRACE("Found valid superblock on %pg\n", sb->s_bdev); |
716 | @@ -185,7 +186,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) |
717 | TRACE("Filesystem size %lld bytes\n", msblk->bytes_used); |
718 | TRACE("Block size %d\n", msblk->block_size); |
719 | TRACE("Number of inodes %d\n", msblk->inodes); |
720 | - TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments)); |
721 | + TRACE("Number of fragments %d\n", msblk->fragments); |
722 | TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids)); |
723 | TRACE("sblk->inode_table_start %llx\n", msblk->inode_table); |
724 | TRACE("sblk->directory_table_start %llx\n", msblk->directory_table); |
725 | @@ -272,7 +273,7 @@ allocate_id_index_table: |
726 | sb->s_export_op = &squashfs_export_ops; |
727 | |
728 | handle_fragments: |
729 | - fragments = le32_to_cpu(sblk->fragments); |
730 | + fragments = msblk->fragments; |
731 | if (fragments == 0) |
732 | goto check_directory_table; |
733 | |
734 | diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c |
735 | index f6ed92524a03..3eda623e4cb4 100644 |
736 | --- a/fs/userfaultfd.c |
737 | +++ b/fs/userfaultfd.c |
738 | @@ -628,8 +628,10 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx, |
739 | /* the various vma->vm_userfaultfd_ctx still points to it */ |
740 | down_write(&mm->mmap_sem); |
741 | for (vma = mm->mmap; vma; vma = vma->vm_next) |
742 | - if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) |
743 | + if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) { |
744 | vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; |
745 | + vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING); |
746 | + } |
747 | up_write(&mm->mmap_sem); |
748 | |
749 | userfaultfd_ctx_put(release_new_ctx); |
750 | diff --git a/kernel/auditsc.c b/kernel/auditsc.c |
751 | index 677053a2fb57..76d789d6cea0 100644 |
752 | --- a/kernel/auditsc.c |
753 | +++ b/kernel/auditsc.c |
754 | @@ -1274,8 +1274,12 @@ static void show_special(struct audit_context *context, int *call_panic) |
755 | break; |
756 | case AUDIT_KERN_MODULE: |
757 | audit_log_format(ab, "name="); |
758 | - audit_log_untrustedstring(ab, context->module.name); |
759 | - kfree(context->module.name); |
760 | + if (context->module.name) { |
761 | + audit_log_untrustedstring(ab, context->module.name); |
762 | + kfree(context->module.name); |
763 | + } else |
764 | + audit_log_format(ab, "(null)"); |
765 | + |
766 | break; |
767 | } |
768 | audit_log_end(ab); |
769 | @@ -2387,8 +2391,9 @@ void __audit_log_kern_module(char *name) |
770 | { |
771 | struct audit_context *context = current->audit_context; |
772 | |
773 | - context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL); |
774 | - strcpy(context->module.name, name); |
775 | + context->module.name = kstrdup(name, GFP_KERNEL); |
776 | + if (!context->module.name) |
777 | + audit_log_lost("out of memory in __audit_log_kern_module"); |
778 | context->type = AUDIT_KERN_MODULE; |
779 | } |
780 | |
781 | diff --git a/net/dsa/slave.c b/net/dsa/slave.c |
782 | index 865e29e62bad..242e74b9d454 100644 |
783 | --- a/net/dsa/slave.c |
784 | +++ b/net/dsa/slave.c |
785 | @@ -1219,6 +1219,9 @@ int dsa_slave_suspend(struct net_device *slave_dev) |
786 | { |
787 | struct dsa_slave_priv *p = netdev_priv(slave_dev); |
788 | |
789 | + if (!netif_running(slave_dev)) |
790 | + return 0; |
791 | + |
792 | netif_device_detach(slave_dev); |
793 | |
794 | if (p->phy) { |
795 | @@ -1236,6 +1239,9 @@ int dsa_slave_resume(struct net_device *slave_dev) |
796 | { |
797 | struct dsa_slave_priv *p = netdev_priv(slave_dev); |
798 | |
799 | + if (!netif_running(slave_dev)) |
800 | + return 0; |
801 | + |
802 | netif_device_attach(slave_dev); |
803 | |
804 | if (p->phy) { |
805 | diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c |
806 | index e691705f0a85..ba4454ecdf0f 100644 |
807 | --- a/net/ipv4/inet_fragment.c |
808 | +++ b/net/ipv4/inet_fragment.c |
809 | @@ -356,11 +356,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, |
810 | { |
811 | struct inet_frag_queue *q; |
812 | |
813 | - if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { |
814 | - inet_frag_schedule_worker(f); |
815 | - return NULL; |
816 | - } |
817 | - |
818 | q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); |
819 | if (!q) |
820 | return NULL; |
821 | @@ -397,6 +392,11 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, |
822 | struct inet_frag_queue *q; |
823 | int depth = 0; |
824 | |
825 | + if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { |
826 | + inet_frag_schedule_worker(f); |
827 | + return NULL; |
828 | + } |
829 | + |
830 | if (frag_mem_limit(nf) > nf->low_thresh) |
831 | inet_frag_schedule_worker(f); |
832 | |
833 | diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c |
834 | index df8fe0503de0..4cb1befc3949 100644 |
835 | --- a/net/ipv4/ip_fragment.c |
836 | +++ b/net/ipv4/ip_fragment.c |
837 | @@ -447,11 +447,16 @@ found: |
838 | int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ |
839 | |
840 | if (i < next->len) { |
841 | + int delta = -next->truesize; |
842 | + |
843 | /* Eat head of the next overlapped fragment |
844 | * and leave the loop. The next ones cannot overlap. |
845 | */ |
846 | if (!pskb_pull(next, i)) |
847 | goto err; |
848 | + delta += next->truesize; |
849 | + if (delta) |
850 | + add_frag_mem_limit(qp->q.net, delta); |
851 | FRAG_CB(next)->offset += i; |
852 | qp->q.meat -= i; |
853 | if (next->ip_summed != CHECKSUM_UNNECESSARY) |
854 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c |
855 | index b2fcbf012056..68c9d1833b95 100644 |
856 | --- a/net/netlink/af_netlink.c |
857 | +++ b/net/netlink/af_netlink.c |
858 | @@ -63,6 +63,7 @@ |
859 | #include <linux/hash.h> |
860 | #include <linux/genetlink.h> |
861 | #include <linux/net_namespace.h> |
862 | +#include <linux/nospec.h> |
863 | |
864 | #include <net/net_namespace.h> |
865 | #include <net/sock.h> |
866 | @@ -647,6 +648,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol, |
867 | |
868 | if (protocol < 0 || protocol >= MAX_LINKS) |
869 | return -EPROTONOSUPPORT; |
870 | + protocol = array_index_nospec(protocol, MAX_LINKS); |
871 | |
872 | netlink_lock_table(); |
873 | #ifdef CONFIG_MODULES |
874 | diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c |
875 | index 3028298ca561..62b1581d44a5 100644 |
876 | --- a/net/rxrpc/call_accept.c |
877 | +++ b/net/rxrpc/call_accept.c |
878 | @@ -115,9 +115,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, |
879 | while (*pp) { |
880 | parent = *pp; |
881 | xcall = rb_entry(parent, struct rxrpc_call, sock_node); |
882 | - if (user_call_ID < call->user_call_ID) |
883 | + if (user_call_ID < xcall->user_call_ID) |
884 | pp = &(*pp)->rb_left; |
885 | - else if (user_call_ID > call->user_call_ID) |
886 | + else if (user_call_ID > xcall->user_call_ID) |
887 | pp = &(*pp)->rb_right; |
888 | else |
889 | goto id_in_use; |
890 | diff --git a/net/socket.c b/net/socket.c |
891 | index 8b2bef6cfe42..d27922639a20 100644 |
892 | --- a/net/socket.c |
893 | +++ b/net/socket.c |
894 | @@ -89,6 +89,7 @@ |
895 | #include <linux/magic.h> |
896 | #include <linux/slab.h> |
897 | #include <linux/xattr.h> |
898 | +#include <linux/nospec.h> |
899 | |
900 | #include <linux/uaccess.h> |
901 | #include <asm/unistd.h> |
902 | @@ -2443,6 +2444,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args) |
903 | |
904 | if (call < 1 || call > SYS_SENDMMSG) |
905 | return -EINVAL; |
906 | + call = array_index_nospec(call, SYS_SENDMMSG + 1); |
907 | |
908 | len = nargs[call]; |
909 | if (len > sizeof(a)) |