Contents of /trunk/kernel-alx/patches-4.14/0170-4.14.71-all-fixes.patch
Parent Directory | Revision Log
Revision 3238 -
(show annotations)
(download)
Fri Nov 9 12:14:58 2018 UTC (5 years, 10 months ago) by niro
File size: 195836 byte(s)
Fri Nov 9 12:14:58 2018 UTC (5 years, 10 months ago) by niro
File size: 195836 byte(s)
-added up to patches-4.14.79
1 | diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt |
2 | index d499676890d8..a054b5ad410a 100644 |
3 | --- a/Documentation/networking/ip-sysctl.txt |
4 | +++ b/Documentation/networking/ip-sysctl.txt |
5 | @@ -133,14 +133,11 @@ min_adv_mss - INTEGER |
6 | |
7 | IP Fragmentation: |
8 | |
9 | -ipfrag_high_thresh - INTEGER |
10 | - Maximum memory used to reassemble IP fragments. When |
11 | - ipfrag_high_thresh bytes of memory is allocated for this purpose, |
12 | - the fragment handler will toss packets until ipfrag_low_thresh |
13 | - is reached. This also serves as a maximum limit to namespaces |
14 | - different from the initial one. |
15 | - |
16 | -ipfrag_low_thresh - INTEGER |
17 | +ipfrag_high_thresh - LONG INTEGER |
18 | + Maximum memory used to reassemble IP fragments. |
19 | + |
20 | +ipfrag_low_thresh - LONG INTEGER |
21 | + (Obsolete since linux-4.17) |
22 | Maximum memory used to reassemble IP fragments before the kernel |
23 | begins to remove incomplete fragment queues to free up resources. |
24 | The kernel still accepts new fragments for defragmentation. |
25 | diff --git a/Makefile b/Makefile |
26 | index aa458afa7fa2..dd4eaeeb2050 100644 |
27 | --- a/Makefile |
28 | +++ b/Makefile |
29 | @@ -1,7 +1,7 @@ |
30 | # SPDX-License-Identifier: GPL-2.0 |
31 | VERSION = 4 |
32 | PATCHLEVEL = 14 |
33 | -SUBLEVEL = 70 |
34 | +SUBLEVEL = 71 |
35 | EXTRAVERSION = |
36 | NAME = Petit Gorille |
37 | |
38 | diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig |
39 | index a8242362e551..ece78630d711 100644 |
40 | --- a/arch/arc/configs/axs101_defconfig |
41 | +++ b/arch/arc/configs/axs101_defconfig |
42 | @@ -1,5 +1,4 @@ |
43 | CONFIG_DEFAULT_HOSTNAME="ARCLinux" |
44 | -# CONFIG_SWAP is not set |
45 | CONFIG_SYSVIPC=y |
46 | CONFIG_POSIX_MQUEUE=y |
47 | # CONFIG_CROSS_MEMORY_ATTACH is not set |
48 | diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig |
49 | index ef3c31cd7737..240c9251a7d4 100644 |
50 | --- a/arch/arc/configs/axs103_defconfig |
51 | +++ b/arch/arc/configs/axs103_defconfig |
52 | @@ -1,5 +1,4 @@ |
53 | CONFIG_DEFAULT_HOSTNAME="ARCLinux" |
54 | -# CONFIG_SWAP is not set |
55 | CONFIG_SYSVIPC=y |
56 | CONFIG_POSIX_MQUEUE=y |
57 | # CONFIG_CROSS_MEMORY_ATTACH is not set |
58 | diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig |
59 | index 1757ac9cecbc..af54b96abee0 100644 |
60 | --- a/arch/arc/configs/axs103_smp_defconfig |
61 | +++ b/arch/arc/configs/axs103_smp_defconfig |
62 | @@ -1,5 +1,4 @@ |
63 | CONFIG_DEFAULT_HOSTNAME="ARCLinux" |
64 | -# CONFIG_SWAP is not set |
65 | CONFIG_SYSVIPC=y |
66 | CONFIG_POSIX_MQUEUE=y |
67 | # CONFIG_CROSS_MEMORY_ATTACH is not set |
68 | diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c |
69 | index 8505db478904..1d92efb82c37 100644 |
70 | --- a/arch/mips/cavium-octeon/octeon-platform.c |
71 | +++ b/arch/mips/cavium-octeon/octeon-platform.c |
72 | @@ -322,6 +322,7 @@ static int __init octeon_ehci_device_init(void) |
73 | return 0; |
74 | |
75 | pd = of_find_device_by_node(ehci_node); |
76 | + of_node_put(ehci_node); |
77 | if (!pd) |
78 | return 0; |
79 | |
80 | @@ -384,6 +385,7 @@ static int __init octeon_ohci_device_init(void) |
81 | return 0; |
82 | |
83 | pd = of_find_device_by_node(ohci_node); |
84 | + of_node_put(ohci_node); |
85 | if (!pd) |
86 | return 0; |
87 | |
88 | diff --git a/arch/mips/generic/init.c b/arch/mips/generic/init.c |
89 | index 5ba6fcc26fa7..94a78dbbc91f 100644 |
90 | --- a/arch/mips/generic/init.c |
91 | +++ b/arch/mips/generic/init.c |
92 | @@ -204,6 +204,7 @@ void __init arch_init_irq(void) |
93 | "mti,cpu-interrupt-controller"); |
94 | if (!cpu_has_veic && !intc_node) |
95 | mips_cpu_irq_init(); |
96 | + of_node_put(intc_node); |
97 | |
98 | irqchip_init(); |
99 | } |
100 | diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h |
101 | index cea8ad864b3f..57b34257be2b 100644 |
102 | --- a/arch/mips/include/asm/io.h |
103 | +++ b/arch/mips/include/asm/io.h |
104 | @@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address) |
105 | /* |
106 | * ISA I/O bus memory addresses are 1:1 with the physical address. |
107 | */ |
108 | -static inline unsigned long isa_virt_to_bus(volatile void * address) |
109 | +static inline unsigned long isa_virt_to_bus(volatile void *address) |
110 | { |
111 | - return (unsigned long)address - PAGE_OFFSET; |
112 | + return virt_to_phys(address); |
113 | } |
114 | |
115 | -static inline void * isa_bus_to_virt(unsigned long address) |
116 | +static inline void *isa_bus_to_virt(unsigned long address) |
117 | { |
118 | - return (void *)(address + PAGE_OFFSET); |
119 | + return phys_to_virt(address); |
120 | } |
121 | |
122 | #define isa_page_to_bus page_to_phys |
123 | diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c |
124 | index 019035d7225c..8f845f6e5f42 100644 |
125 | --- a/arch/mips/kernel/vdso.c |
126 | +++ b/arch/mips/kernel/vdso.c |
127 | @@ -13,6 +13,7 @@ |
128 | #include <linux/err.h> |
129 | #include <linux/init.h> |
130 | #include <linux/ioport.h> |
131 | +#include <linux/kernel.h> |
132 | #include <linux/mm.h> |
133 | #include <linux/sched.h> |
134 | #include <linux/slab.h> |
135 | @@ -20,6 +21,7 @@ |
136 | |
137 | #include <asm/abi.h> |
138 | #include <asm/mips-cps.h> |
139 | +#include <asm/page.h> |
140 | #include <asm/vdso.h> |
141 | |
142 | /* Kernel-provided data used by the VDSO. */ |
143 | @@ -128,12 +130,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) |
144 | vvar_size = gic_size + PAGE_SIZE; |
145 | size = vvar_size + image->size; |
146 | |
147 | + /* |
148 | + * Find a region that's large enough for us to perform the |
149 | + * colour-matching alignment below. |
150 | + */ |
151 | + if (cpu_has_dc_aliases) |
152 | + size += shm_align_mask + 1; |
153 | + |
154 | base = get_unmapped_area(NULL, 0, size, 0, 0); |
155 | if (IS_ERR_VALUE(base)) { |
156 | ret = base; |
157 | goto out; |
158 | } |
159 | |
160 | + /* |
161 | + * If we suffer from dcache aliasing, ensure that the VDSO data page |
162 | + * mapping is coloured the same as the kernel's mapping of that memory. |
163 | + * This ensures that when the kernel updates the VDSO data userland |
164 | + * will observe it without requiring cache invalidations. |
165 | + */ |
166 | + if (cpu_has_dc_aliases) { |
167 | + base = __ALIGN_MASK(base, shm_align_mask); |
168 | + base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask; |
169 | + } |
170 | + |
171 | data_addr = base + gic_size; |
172 | vdso_addr = data_addr + PAGE_SIZE; |
173 | |
174 | diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c |
175 | index e12dfa48b478..a5893b2cdc0e 100644 |
176 | --- a/arch/mips/mm/c-r4k.c |
177 | +++ b/arch/mips/mm/c-r4k.c |
178 | @@ -835,7 +835,8 @@ static void r4k_flush_icache_user_range(unsigned long start, unsigned long end) |
179 | static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) |
180 | { |
181 | /* Catch bad driver code */ |
182 | - BUG_ON(size == 0); |
183 | + if (WARN_ON(size == 0)) |
184 | + return; |
185 | |
186 | preempt_disable(); |
187 | if (cpu_has_inclusive_pcaches) { |
188 | @@ -871,7 +872,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) |
189 | static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) |
190 | { |
191 | /* Catch bad driver code */ |
192 | - BUG_ON(size == 0); |
193 | + if (WARN_ON(size == 0)) |
194 | + return; |
195 | |
196 | preempt_disable(); |
197 | if (cpu_has_inclusive_pcaches) { |
198 | diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c |
199 | index 63f007f2de7e..4b95bdde22aa 100644 |
200 | --- a/arch/powerpc/platforms/powernv/npu-dma.c |
201 | +++ b/arch/powerpc/platforms/powernv/npu-dma.c |
202 | @@ -427,8 +427,9 @@ static int get_mmio_atsd_reg(struct npu *npu) |
203 | int i; |
204 | |
205 | for (i = 0; i < npu->mmio_atsd_count; i++) { |
206 | - if (!test_and_set_bit_lock(i, &npu->mmio_atsd_usage)) |
207 | - return i; |
208 | + if (!test_bit(i, &npu->mmio_atsd_usage)) |
209 | + if (!test_and_set_bit_lock(i, &npu->mmio_atsd_usage)) |
210 | + return i; |
211 | } |
212 | |
213 | return -ENOSPC; |
214 | diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c |
215 | index 4f1f5fc8139d..061906f98dc5 100644 |
216 | --- a/arch/s390/kvm/vsie.c |
217 | +++ b/arch/s390/kvm/vsie.c |
218 | @@ -170,7 +170,8 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) |
219 | return set_validity_icpt(scb_s, 0x0039U); |
220 | |
221 | /* copy only the wrapping keys */ |
222 | - if (read_guest_real(vcpu, crycb_addr + 72, &vsie_page->crycb, 56)) |
223 | + if (read_guest_real(vcpu, crycb_addr + 72, |
224 | + vsie_page->crycb.dea_wrapping_key_mask, 56)) |
225 | return set_validity_icpt(scb_s, 0x0035U); |
226 | |
227 | scb_s->ecb3 |= ecb3_flags; |
228 | diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c |
229 | index 48179928ff38..9d33dbf2489e 100644 |
230 | --- a/arch/x86/kernel/cpu/microcode/amd.c |
231 | +++ b/arch/x86/kernel/cpu/microcode/amd.c |
232 | @@ -504,6 +504,7 @@ static enum ucode_state apply_microcode_amd(int cpu) |
233 | struct microcode_amd *mc_amd; |
234 | struct ucode_cpu_info *uci; |
235 | struct ucode_patch *p; |
236 | + enum ucode_state ret; |
237 | u32 rev, dummy; |
238 | |
239 | BUG_ON(raw_smp_processor_id() != cpu); |
240 | @@ -521,9 +522,8 @@ static enum ucode_state apply_microcode_amd(int cpu) |
241 | |
242 | /* need to apply patch? */ |
243 | if (rev >= mc_amd->hdr.patch_id) { |
244 | - c->microcode = rev; |
245 | - uci->cpu_sig.rev = rev; |
246 | - return UCODE_OK; |
247 | + ret = UCODE_OK; |
248 | + goto out; |
249 | } |
250 | |
251 | if (__apply_microcode_amd(mc_amd)) { |
252 | @@ -531,13 +531,21 @@ static enum ucode_state apply_microcode_amd(int cpu) |
253 | cpu, mc_amd->hdr.patch_id); |
254 | return UCODE_ERROR; |
255 | } |
256 | - pr_info("CPU%d: new patch_level=0x%08x\n", cpu, |
257 | - mc_amd->hdr.patch_id); |
258 | |
259 | - uci->cpu_sig.rev = mc_amd->hdr.patch_id; |
260 | - c->microcode = mc_amd->hdr.patch_id; |
261 | + rev = mc_amd->hdr.patch_id; |
262 | + ret = UCODE_UPDATED; |
263 | + |
264 | + pr_info("CPU%d: new patch_level=0x%08x\n", cpu, rev); |
265 | |
266 | - return UCODE_UPDATED; |
267 | +out: |
268 | + uci->cpu_sig.rev = rev; |
269 | + c->microcode = rev; |
270 | + |
271 | + /* Update boot_cpu_data's revision too, if we're on the BSP: */ |
272 | + if (c->cpu_index == boot_cpu_data.cpu_index) |
273 | + boot_cpu_data.microcode = rev; |
274 | + |
275 | + return ret; |
276 | } |
277 | |
278 | static int install_equiv_cpu_table(const u8 *buf) |
279 | diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c |
280 | index 97ccf4c3b45b..16936a24795c 100644 |
281 | --- a/arch/x86/kernel/cpu/microcode/intel.c |
282 | +++ b/arch/x86/kernel/cpu/microcode/intel.c |
283 | @@ -795,6 +795,7 @@ static enum ucode_state apply_microcode_intel(int cpu) |
284 | struct ucode_cpu_info *uci = ucode_cpu_info + cpu; |
285 | struct cpuinfo_x86 *c = &cpu_data(cpu); |
286 | struct microcode_intel *mc; |
287 | + enum ucode_state ret; |
288 | static int prev_rev; |
289 | u32 rev; |
290 | |
291 | @@ -817,9 +818,8 @@ static enum ucode_state apply_microcode_intel(int cpu) |
292 | */ |
293 | rev = intel_get_microcode_revision(); |
294 | if (rev >= mc->hdr.rev) { |
295 | - uci->cpu_sig.rev = rev; |
296 | - c->microcode = rev; |
297 | - return UCODE_OK; |
298 | + ret = UCODE_OK; |
299 | + goto out; |
300 | } |
301 | |
302 | /* |
303 | @@ -848,10 +848,17 @@ static enum ucode_state apply_microcode_intel(int cpu) |
304 | prev_rev = rev; |
305 | } |
306 | |
307 | + ret = UCODE_UPDATED; |
308 | + |
309 | +out: |
310 | uci->cpu_sig.rev = rev; |
311 | - c->microcode = rev; |
312 | + c->microcode = rev; |
313 | + |
314 | + /* Update boot_cpu_data's revision too, if we're on the BSP: */ |
315 | + if (c->cpu_index == boot_cpu_data.cpu_index) |
316 | + boot_cpu_data.microcode = rev; |
317 | |
318 | - return UCODE_UPDATED; |
319 | + return ret; |
320 | } |
321 | |
322 | static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, |
323 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
324 | index 4e5a8e30cc4e..fd46d890296c 100644 |
325 | --- a/arch/x86/kvm/vmx.c |
326 | +++ b/arch/x86/kvm/vmx.c |
327 | @@ -6965,8 +6965,8 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu) |
328 | if (!static_cpu_has(X86_FEATURE_HYPERVISOR)) |
329 | return kvm_skip_emulated_instruction(vcpu); |
330 | else |
331 | - return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP, |
332 | - NULL, 0) == EMULATE_DONE; |
333 | + return emulate_instruction(vcpu, EMULTYPE_SKIP) == |
334 | + EMULATE_DONE; |
335 | } |
336 | |
337 | ret = kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0); |
338 | diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c |
339 | index c2faff548f59..794c35c4ca73 100644 |
340 | --- a/arch/x86/mm/fault.c |
341 | +++ b/arch/x86/mm/fault.c |
342 | @@ -317,8 +317,6 @@ static noinline int vmalloc_fault(unsigned long address) |
343 | if (!(address >= VMALLOC_START && address < VMALLOC_END)) |
344 | return -1; |
345 | |
346 | - WARN_ON_ONCE(in_nmi()); |
347 | - |
348 | /* |
349 | * Synchronize this task's top level page-table |
350 | * with the 'reference' page table. |
351 | diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c |
352 | index 4b571f3ea009..afbbe5750a1f 100644 |
353 | --- a/block/bfq-cgroup.c |
354 | +++ b/block/bfq-cgroup.c |
355 | @@ -224,9 +224,9 @@ static void bfqg_and_blkg_get(struct bfq_group *bfqg) |
356 | |
357 | void bfqg_and_blkg_put(struct bfq_group *bfqg) |
358 | { |
359 | - bfqg_put(bfqg); |
360 | - |
361 | blkg_put(bfqg_to_blkg(bfqg)); |
362 | + |
363 | + bfqg_put(bfqg); |
364 | } |
365 | |
366 | void bfqg_stats_update_io_add(struct bfq_group *bfqg, struct bfq_queue *bfqq, |
367 | diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c |
368 | index 6714507aa6c7..3d2ab65d2dd1 100644 |
369 | --- a/block/blk-mq-tag.c |
370 | +++ b/block/blk-mq-tag.c |
371 | @@ -416,8 +416,6 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, |
372 | if (tdepth <= tags->nr_reserved_tags) |
373 | return -EINVAL; |
374 | |
375 | - tdepth -= tags->nr_reserved_tags; |
376 | - |
377 | /* |
378 | * If we are allowed to grow beyond the original size, allocate |
379 | * a new set of tags before freeing the old one. |
380 | @@ -437,7 +435,8 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, |
381 | if (tdepth > 16 * BLKDEV_MAX_RQ) |
382 | return -EINVAL; |
383 | |
384 | - new = blk_mq_alloc_rq_map(set, hctx->queue_num, tdepth, 0); |
385 | + new = blk_mq_alloc_rq_map(set, hctx->queue_num, tdepth, |
386 | + tags->nr_reserved_tags); |
387 | if (!new) |
388 | return -ENOMEM; |
389 | ret = blk_mq_alloc_rqs(set, new, hctx->queue_num, tdepth); |
390 | @@ -454,7 +453,8 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, |
391 | * Don't need (or can't) update reserved tags here, they |
392 | * remain static and should never need resizing. |
393 | */ |
394 | - sbitmap_queue_resize(&tags->bitmap_tags, tdepth); |
395 | + sbitmap_queue_resize(&tags->bitmap_tags, |
396 | + tdepth - tags->nr_reserved_tags); |
397 | } |
398 | |
399 | return 0; |
400 | diff --git a/block/partitions/aix.c b/block/partitions/aix.c |
401 | index 007f95eea0e1..903f3ed175d0 100644 |
402 | --- a/block/partitions/aix.c |
403 | +++ b/block/partitions/aix.c |
404 | @@ -178,7 +178,7 @@ int aix_partition(struct parsed_partitions *state) |
405 | u32 vgda_sector = 0; |
406 | u32 vgda_len = 0; |
407 | int numlvs = 0; |
408 | - struct pvd *pvd; |
409 | + struct pvd *pvd = NULL; |
410 | struct lv_info { |
411 | unsigned short pps_per_lv; |
412 | unsigned short pps_found; |
413 | @@ -232,10 +232,11 @@ int aix_partition(struct parsed_partitions *state) |
414 | if (lvip[i].pps_per_lv) |
415 | foundlvs += 1; |
416 | } |
417 | + /* pvd loops depend on n[].name and lvip[].pps_per_lv */ |
418 | + pvd = alloc_pvd(state, vgda_sector + 17); |
419 | } |
420 | put_dev_sector(sect); |
421 | } |
422 | - pvd = alloc_pvd(state, vgda_sector + 17); |
423 | if (pvd) { |
424 | int numpps = be16_to_cpu(pvd->pp_count); |
425 | int psn_part1 = be32_to_cpu(pvd->psn_part1); |
426 | @@ -282,10 +283,14 @@ int aix_partition(struct parsed_partitions *state) |
427 | next_lp_ix += 1; |
428 | } |
429 | for (i = 0; i < state->limit; i += 1) |
430 | - if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) |
431 | + if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) { |
432 | + char tmp[sizeof(n[i].name) + 1]; // null char |
433 | + |
434 | + snprintf(tmp, sizeof(tmp), "%s", n[i].name); |
435 | pr_warn("partition %s (%u pp's found) is " |
436 | "not contiguous\n", |
437 | - n[i].name, lvip[i].pps_found); |
438 | + tmp, lvip[i].pps_found); |
439 | + } |
440 | kfree(pvd); |
441 | } |
442 | kfree(n); |
443 | diff --git a/crypto/Makefile b/crypto/Makefile |
444 | index adaf2c63baeb..56282e2d75ad 100644 |
445 | --- a/crypto/Makefile |
446 | +++ b/crypto/Makefile |
447 | @@ -98,7 +98,7 @@ obj-$(CONFIG_CRYPTO_TWOFISH_COMMON) += twofish_common.o |
448 | obj-$(CONFIG_CRYPTO_SERPENT) += serpent_generic.o |
449 | CFLAGS_serpent_generic.o := $(call cc-option,-fsched-pressure) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 |
450 | obj-$(CONFIG_CRYPTO_AES) += aes_generic.o |
451 | -CFLAGS_aes_generic.o := $(call cc-ifversion, -ge, 0701, -Os) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83356 |
452 | +CFLAGS_aes_generic.o := $(call cc-option,-fno-code-hoisting) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83356 |
453 | obj-$(CONFIG_CRYPTO_AES_TI) += aes_ti.o |
454 | obj-$(CONFIG_CRYPTO_CAMELLIA) += camellia_generic.o |
455 | obj-$(CONFIG_CRYPTO_CAST_COMMON) += cast_common.o |
456 | diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c |
457 | index 6cb148268676..58e4658f9dd6 100644 |
458 | --- a/drivers/android/binder_alloc.c |
459 | +++ b/drivers/android/binder_alloc.c |
460 | @@ -324,6 +324,34 @@ err_no_vma: |
461 | return vma ? -ENOMEM : -ESRCH; |
462 | } |
463 | |
464 | +static inline void binder_alloc_set_vma(struct binder_alloc *alloc, |
465 | + struct vm_area_struct *vma) |
466 | +{ |
467 | + if (vma) |
468 | + alloc->vma_vm_mm = vma->vm_mm; |
469 | + /* |
470 | + * If we see alloc->vma is not NULL, buffer data structures set up |
471 | + * completely. Look at smp_rmb side binder_alloc_get_vma. |
472 | + * We also want to guarantee new alloc->vma_vm_mm is always visible |
473 | + * if alloc->vma is set. |
474 | + */ |
475 | + smp_wmb(); |
476 | + alloc->vma = vma; |
477 | +} |
478 | + |
479 | +static inline struct vm_area_struct *binder_alloc_get_vma( |
480 | + struct binder_alloc *alloc) |
481 | +{ |
482 | + struct vm_area_struct *vma = NULL; |
483 | + |
484 | + if (alloc->vma) { |
485 | + /* Look at description in binder_alloc_set_vma */ |
486 | + smp_rmb(); |
487 | + vma = alloc->vma; |
488 | + } |
489 | + return vma; |
490 | +} |
491 | + |
492 | struct binder_buffer *binder_alloc_new_buf_locked(struct binder_alloc *alloc, |
493 | size_t data_size, |
494 | size_t offsets_size, |
495 | @@ -339,7 +367,7 @@ struct binder_buffer *binder_alloc_new_buf_locked(struct binder_alloc *alloc, |
496 | size_t size, data_offsets_size; |
497 | int ret; |
498 | |
499 | - if (alloc->vma == NULL) { |
500 | + if (!binder_alloc_get_vma(alloc)) { |
501 | pr_err("%d: binder_alloc_buf, no vma\n", |
502 | alloc->pid); |
503 | return ERR_PTR(-ESRCH); |
504 | @@ -712,9 +740,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc, |
505 | buffer->free = 1; |
506 | binder_insert_free_buffer(alloc, buffer); |
507 | alloc->free_async_space = alloc->buffer_size / 2; |
508 | - barrier(); |
509 | - alloc->vma = vma; |
510 | - alloc->vma_vm_mm = vma->vm_mm; |
511 | + binder_alloc_set_vma(alloc, vma); |
512 | mmgrab(alloc->vma_vm_mm); |
513 | |
514 | return 0; |
515 | @@ -741,10 +767,10 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc) |
516 | int buffers, page_count; |
517 | struct binder_buffer *buffer; |
518 | |
519 | - BUG_ON(alloc->vma); |
520 | - |
521 | buffers = 0; |
522 | mutex_lock(&alloc->mutex); |
523 | + BUG_ON(alloc->vma); |
524 | + |
525 | while ((n = rb_first(&alloc->allocated_buffers))) { |
526 | buffer = rb_entry(n, struct binder_buffer, rb_node); |
527 | |
528 | @@ -886,7 +912,7 @@ int binder_alloc_get_allocated_count(struct binder_alloc *alloc) |
529 | */ |
530 | void binder_alloc_vma_close(struct binder_alloc *alloc) |
531 | { |
532 | - WRITE_ONCE(alloc->vma, NULL); |
533 | + binder_alloc_set_vma(alloc, NULL); |
534 | } |
535 | |
536 | /** |
537 | @@ -921,7 +947,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item, |
538 | |
539 | index = page - alloc->pages; |
540 | page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE; |
541 | - vma = alloc->vma; |
542 | + vma = binder_alloc_get_vma(alloc); |
543 | if (vma) { |
544 | if (!mmget_not_zero(alloc->vma_vm_mm)) |
545 | goto err_mmget; |
546 | diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c |
547 | index bc562fd2b0a0..cda9a0b5bdaa 100644 |
548 | --- a/drivers/ata/libahci.c |
549 | +++ b/drivers/ata/libahci.c |
550 | @@ -2096,7 +2096,7 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) |
551 | struct ahci_host_priv *hpriv = ap->host->private_data; |
552 | void __iomem *port_mmio = ahci_port_base(ap); |
553 | struct ata_device *dev = ap->link.device; |
554 | - u32 devslp, dm, dito, mdat, deto; |
555 | + u32 devslp, dm, dito, mdat, deto, dito_conf; |
556 | int rc; |
557 | unsigned int err_mask; |
558 | |
559 | @@ -2120,8 +2120,15 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) |
560 | return; |
561 | } |
562 | |
563 | - /* device sleep was already enabled */ |
564 | - if (devslp & PORT_DEVSLP_ADSE) |
565 | + dm = (devslp & PORT_DEVSLP_DM_MASK) >> PORT_DEVSLP_DM_OFFSET; |
566 | + dito = devslp_idle_timeout / (dm + 1); |
567 | + if (dito > 0x3ff) |
568 | + dito = 0x3ff; |
569 | + |
570 | + dito_conf = (devslp >> PORT_DEVSLP_DITO_OFFSET) & 0x3FF; |
571 | + |
572 | + /* device sleep was already enabled and same dito */ |
573 | + if ((devslp & PORT_DEVSLP_ADSE) && (dito_conf == dito)) |
574 | return; |
575 | |
576 | /* set DITO, MDAT, DETO and enable DevSlp, need to stop engine first */ |
577 | @@ -2129,11 +2136,6 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) |
578 | if (rc) |
579 | return; |
580 | |
581 | - dm = (devslp & PORT_DEVSLP_DM_MASK) >> PORT_DEVSLP_DM_OFFSET; |
582 | - dito = devslp_idle_timeout / (dm + 1); |
583 | - if (dito > 0x3ff) |
584 | - dito = 0x3ff; |
585 | - |
586 | /* Use the nominal value 10 ms if the read MDAT is zero, |
587 | * the nominal value of DETO is 20 ms. |
588 | */ |
589 | @@ -2151,6 +2153,8 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) |
590 | deto = 20; |
591 | } |
592 | |
593 | + /* Make dito, mdat, deto bits to 0s */ |
594 | + devslp &= ~GENMASK_ULL(24, 2); |
595 | devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) | |
596 | (mdat << PORT_DEVSLP_MDAT_OFFSET) | |
597 | (deto << PORT_DEVSLP_DETO_OFFSET) | |
598 | diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c |
599 | index 5e55d03d3d01..fe1414df0f33 100644 |
600 | --- a/drivers/block/nbd.c |
601 | +++ b/drivers/block/nbd.c |
602 | @@ -1228,6 +1228,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, |
603 | case NBD_SET_SOCK: |
604 | return nbd_add_socket(nbd, arg, false); |
605 | case NBD_SET_BLKSIZE: |
606 | + if (!arg || !is_power_of_2(arg) || arg < 512 || |
607 | + arg > PAGE_SIZE) |
608 | + return -EINVAL; |
609 | nbd_size_set(nbd, arg, |
610 | div_s64(config->bytesize, arg)); |
611 | return 0; |
612 | diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c |
613 | index 531a0915066b..11ec92e47455 100644 |
614 | --- a/drivers/block/pktcdvd.c |
615 | +++ b/drivers/block/pktcdvd.c |
616 | @@ -67,7 +67,7 @@ |
617 | #include <scsi/scsi.h> |
618 | #include <linux/debugfs.h> |
619 | #include <linux/device.h> |
620 | - |
621 | +#include <linux/nospec.h> |
622 | #include <linux/uaccess.h> |
623 | |
624 | #define DRIVER_NAME "pktcdvd" |
625 | @@ -2231,6 +2231,8 @@ static struct pktcdvd_device *pkt_find_dev_from_minor(unsigned int dev_minor) |
626 | { |
627 | if (dev_minor >= MAX_WRITERS) |
628 | return NULL; |
629 | + |
630 | + dev_minor = array_index_nospec(dev_minor, MAX_WRITERS); |
631 | return pkt_devs[dev_minor]; |
632 | } |
633 | |
634 | diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig |
635 | index b33c8d6eb8c7..500d4d632e48 100644 |
636 | --- a/drivers/bluetooth/Kconfig |
637 | +++ b/drivers/bluetooth/Kconfig |
638 | @@ -146,6 +146,7 @@ config BT_HCIUART_LL |
639 | config BT_HCIUART_3WIRE |
640 | bool "Three-wire UART (H5) protocol support" |
641 | depends on BT_HCIUART |
642 | + depends on BT_HCIUART_SERDEV |
643 | help |
644 | The HCI Three-wire UART Transport Layer makes it possible to |
645 | user the Bluetooth HCI over a serial port interface. The HCI |
646 | diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c |
647 | index 86b526b7d990..a2070ab86c82 100644 |
648 | --- a/drivers/char/tpm/tpm-interface.c |
649 | +++ b/drivers/char/tpm/tpm-interface.c |
650 | @@ -369,10 +369,13 @@ err_len: |
651 | return -EINVAL; |
652 | } |
653 | |
654 | -static int tpm_request_locality(struct tpm_chip *chip) |
655 | +static int tpm_request_locality(struct tpm_chip *chip, unsigned int flags) |
656 | { |
657 | int rc; |
658 | |
659 | + if (flags & TPM_TRANSMIT_RAW) |
660 | + return 0; |
661 | + |
662 | if (!chip->ops->request_locality) |
663 | return 0; |
664 | |
665 | @@ -385,10 +388,13 @@ static int tpm_request_locality(struct tpm_chip *chip) |
666 | return 0; |
667 | } |
668 | |
669 | -static void tpm_relinquish_locality(struct tpm_chip *chip) |
670 | +static void tpm_relinquish_locality(struct tpm_chip *chip, unsigned int flags) |
671 | { |
672 | int rc; |
673 | |
674 | + if (flags & TPM_TRANSMIT_RAW) |
675 | + return; |
676 | + |
677 | if (!chip->ops->relinquish_locality) |
678 | return; |
679 | |
680 | @@ -399,6 +405,28 @@ static void tpm_relinquish_locality(struct tpm_chip *chip) |
681 | chip->locality = -1; |
682 | } |
683 | |
684 | +static int tpm_cmd_ready(struct tpm_chip *chip, unsigned int flags) |
685 | +{ |
686 | + if (flags & TPM_TRANSMIT_RAW) |
687 | + return 0; |
688 | + |
689 | + if (!chip->ops->cmd_ready) |
690 | + return 0; |
691 | + |
692 | + return chip->ops->cmd_ready(chip); |
693 | +} |
694 | + |
695 | +static int tpm_go_idle(struct tpm_chip *chip, unsigned int flags) |
696 | +{ |
697 | + if (flags & TPM_TRANSMIT_RAW) |
698 | + return 0; |
699 | + |
700 | + if (!chip->ops->go_idle) |
701 | + return 0; |
702 | + |
703 | + return chip->ops->go_idle(chip); |
704 | +} |
705 | + |
706 | static ssize_t tpm_try_transmit(struct tpm_chip *chip, |
707 | struct tpm_space *space, |
708 | u8 *buf, size_t bufsiz, |
709 | @@ -449,14 +477,15 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, |
710 | /* Store the decision as chip->locality will be changed. */ |
711 | need_locality = chip->locality == -1; |
712 | |
713 | - if (!(flags & TPM_TRANSMIT_RAW) && need_locality) { |
714 | - rc = tpm_request_locality(chip); |
715 | + if (need_locality) { |
716 | + rc = tpm_request_locality(chip, flags); |
717 | if (rc < 0) |
718 | goto out_no_locality; |
719 | } |
720 | |
721 | - if (chip->dev.parent) |
722 | - pm_runtime_get_sync(chip->dev.parent); |
723 | + rc = tpm_cmd_ready(chip, flags); |
724 | + if (rc) |
725 | + goto out; |
726 | |
727 | rc = tpm2_prepare_space(chip, space, ordinal, buf); |
728 | if (rc) |
729 | @@ -516,13 +545,16 @@ out_recv: |
730 | } |
731 | |
732 | rc = tpm2_commit_space(chip, space, ordinal, buf, &len); |
733 | + if (rc) |
734 | + dev_err(&chip->dev, "tpm2_commit_space: error %d\n", rc); |
735 | |
736 | out: |
737 | - if (chip->dev.parent) |
738 | - pm_runtime_put_sync(chip->dev.parent); |
739 | + rc = tpm_go_idle(chip, flags); |
740 | + if (rc) |
741 | + goto out; |
742 | |
743 | if (need_locality) |
744 | - tpm_relinquish_locality(chip); |
745 | + tpm_relinquish_locality(chip, flags); |
746 | |
747 | out_no_locality: |
748 | if (chip->ops->clk_enable != NULL) |
749 | diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h |
750 | index b83b30a3eea5..4bb9b4aa9b49 100644 |
751 | --- a/drivers/char/tpm/tpm.h |
752 | +++ b/drivers/char/tpm/tpm.h |
753 | @@ -511,9 +511,17 @@ extern const struct file_operations tpm_fops; |
754 | extern const struct file_operations tpmrm_fops; |
755 | extern struct idr dev_nums_idr; |
756 | |
757 | +/** |
758 | + * enum tpm_transmit_flags |
759 | + * |
760 | + * @TPM_TRANSMIT_UNLOCKED: used to lock sequence of tpm_transmit calls. |
761 | + * @TPM_TRANSMIT_RAW: prevent recursive calls into setup steps |
762 | + * (go idle, locality,..). Always use with UNLOCKED |
763 | + * as it will fail on double locking. |
764 | + */ |
765 | enum tpm_transmit_flags { |
766 | - TPM_TRANSMIT_UNLOCKED = BIT(0), |
767 | - TPM_TRANSMIT_RAW = BIT(1), |
768 | + TPM_TRANSMIT_UNLOCKED = BIT(0), |
769 | + TPM_TRANSMIT_RAW = BIT(1), |
770 | }; |
771 | |
772 | ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, |
773 | diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c |
774 | index d26ea7513226..dabb2ae4e779 100644 |
775 | --- a/drivers/char/tpm/tpm2-space.c |
776 | +++ b/drivers/char/tpm/tpm2-space.c |
777 | @@ -39,7 +39,8 @@ static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space) |
778 | for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) { |
779 | if (space->session_tbl[i]) |
780 | tpm2_flush_context_cmd(chip, space->session_tbl[i], |
781 | - TPM_TRANSMIT_UNLOCKED); |
782 | + TPM_TRANSMIT_UNLOCKED | |
783 | + TPM_TRANSMIT_RAW); |
784 | } |
785 | } |
786 | |
787 | @@ -84,7 +85,7 @@ static int tpm2_load_context(struct tpm_chip *chip, u8 *buf, |
788 | tpm_buf_append(&tbuf, &buf[*offset], body_size); |
789 | |
790 | rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 4, |
791 | - TPM_TRANSMIT_UNLOCKED, NULL); |
792 | + TPM_TRANSMIT_UNLOCKED | TPM_TRANSMIT_RAW, NULL); |
793 | if (rc < 0) { |
794 | dev_warn(&chip->dev, "%s: failed with a system error %d\n", |
795 | __func__, rc); |
796 | @@ -133,7 +134,7 @@ static int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf, |
797 | tpm_buf_append_u32(&tbuf, handle); |
798 | |
799 | rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 0, |
800 | - TPM_TRANSMIT_UNLOCKED, NULL); |
801 | + TPM_TRANSMIT_UNLOCKED | TPM_TRANSMIT_RAW, NULL); |
802 | if (rc < 0) { |
803 | dev_warn(&chip->dev, "%s: failed with a system error %d\n", |
804 | __func__, rc); |
805 | @@ -170,7 +171,8 @@ static void tpm2_flush_space(struct tpm_chip *chip) |
806 | for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) |
807 | if (space->context_tbl[i] && ~space->context_tbl[i]) |
808 | tpm2_flush_context_cmd(chip, space->context_tbl[i], |
809 | - TPM_TRANSMIT_UNLOCKED); |
810 | + TPM_TRANSMIT_UNLOCKED | |
811 | + TPM_TRANSMIT_RAW); |
812 | |
813 | tpm2_flush_sessions(chip, space); |
814 | } |
815 | @@ -377,7 +379,8 @@ static int tpm2_map_response_header(struct tpm_chip *chip, u32 cc, u8 *rsp, |
816 | |
817 | return 0; |
818 | out_no_slots: |
819 | - tpm2_flush_context_cmd(chip, phandle, TPM_TRANSMIT_UNLOCKED); |
820 | + tpm2_flush_context_cmd(chip, phandle, |
821 | + TPM_TRANSMIT_UNLOCKED | TPM_TRANSMIT_RAW); |
822 | dev_warn(&chip->dev, "%s: out of slots for 0x%08X\n", __func__, |
823 | phandle); |
824 | return -ENOMEM; |
825 | @@ -465,7 +468,8 @@ static int tpm2_save_space(struct tpm_chip *chip) |
826 | return rc; |
827 | |
828 | tpm2_flush_context_cmd(chip, space->context_tbl[i], |
829 | - TPM_TRANSMIT_UNLOCKED); |
830 | + TPM_TRANSMIT_UNLOCKED | |
831 | + TPM_TRANSMIT_RAW); |
832 | space->context_tbl[i] = ~0; |
833 | } |
834 | |
835 | diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c |
836 | index bb756ad7897e..5c7ce5aaaf6f 100644 |
837 | --- a/drivers/char/tpm/tpm_crb.c |
838 | +++ b/drivers/char/tpm/tpm_crb.c |
839 | @@ -137,7 +137,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, |
840 | } |
841 | |
842 | /** |
843 | - * crb_go_idle - request tpm crb device to go the idle state |
844 | + * __crb_go_idle - request tpm crb device to go the idle state |
845 | * |
846 | * @dev: crb device |
847 | * @priv: crb private data |
848 | @@ -151,7 +151,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, |
849 | * |
850 | * Return: 0 always |
851 | */ |
852 | -static int crb_go_idle(struct device *dev, struct crb_priv *priv) |
853 | +static int __crb_go_idle(struct device *dev, struct crb_priv *priv) |
854 | { |
855 | if ((priv->flags & CRB_FL_ACPI_START) || |
856 | (priv->flags & CRB_FL_CRB_SMC_START)) |
857 | @@ -166,11 +166,20 @@ static int crb_go_idle(struct device *dev, struct crb_priv *priv) |
858 | dev_warn(dev, "goIdle timed out\n"); |
859 | return -ETIME; |
860 | } |
861 | + |
862 | return 0; |
863 | } |
864 | |
865 | +static int crb_go_idle(struct tpm_chip *chip) |
866 | +{ |
867 | + struct device *dev = &chip->dev; |
868 | + struct crb_priv *priv = dev_get_drvdata(dev); |
869 | + |
870 | + return __crb_go_idle(dev, priv); |
871 | +} |
872 | + |
873 | /** |
874 | - * crb_cmd_ready - request tpm crb device to enter ready state |
875 | + * __crb_cmd_ready - request tpm crb device to enter ready state |
876 | * |
877 | * @dev: crb device |
878 | * @priv: crb private data |
879 | @@ -183,7 +192,7 @@ static int crb_go_idle(struct device *dev, struct crb_priv *priv) |
880 | * |
881 | * Return: 0 on success -ETIME on timeout; |
882 | */ |
883 | -static int crb_cmd_ready(struct device *dev, struct crb_priv *priv) |
884 | +static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv) |
885 | { |
886 | if ((priv->flags & CRB_FL_ACPI_START) || |
887 | (priv->flags & CRB_FL_CRB_SMC_START)) |
888 | @@ -201,6 +210,14 @@ static int crb_cmd_ready(struct device *dev, struct crb_priv *priv) |
889 | return 0; |
890 | } |
891 | |
892 | +static int crb_cmd_ready(struct tpm_chip *chip) |
893 | +{ |
894 | + struct device *dev = &chip->dev; |
895 | + struct crb_priv *priv = dev_get_drvdata(dev); |
896 | + |
897 | + return __crb_cmd_ready(dev, priv); |
898 | +} |
899 | + |
900 | static int __crb_request_locality(struct device *dev, |
901 | struct crb_priv *priv, int loc) |
902 | { |
903 | @@ -393,6 +410,8 @@ static const struct tpm_class_ops tpm_crb = { |
904 | .send = crb_send, |
905 | .cancel = crb_cancel, |
906 | .req_canceled = crb_req_canceled, |
907 | + .go_idle = crb_go_idle, |
908 | + .cmd_ready = crb_cmd_ready, |
909 | .request_locality = crb_request_locality, |
910 | .relinquish_locality = crb_relinquish_locality, |
911 | .req_complete_mask = CRB_DRV_STS_COMPLETE, |
912 | @@ -508,7 +527,7 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, |
913 | * PTT HW bug w/a: wake up the device to access |
914 | * possibly not retained registers. |
915 | */ |
916 | - ret = crb_cmd_ready(dev, priv); |
917 | + ret = __crb_cmd_ready(dev, priv); |
918 | if (ret) |
919 | return ret; |
920 | |
921 | @@ -553,7 +572,7 @@ out: |
922 | if (!ret) |
923 | priv->cmd_size = cmd_size; |
924 | |
925 | - crb_go_idle(dev, priv); |
926 | + __crb_go_idle(dev, priv); |
927 | |
928 | __crb_relinquish_locality(dev, priv, 0); |
929 | |
930 | @@ -624,32 +643,7 @@ static int crb_acpi_add(struct acpi_device *device) |
931 | chip->acpi_dev_handle = device->handle; |
932 | chip->flags = TPM_CHIP_FLAG_TPM2; |
933 | |
934 | - rc = __crb_request_locality(dev, priv, 0); |
935 | - if (rc) |
936 | - return rc; |
937 | - |
938 | - rc = crb_cmd_ready(dev, priv); |
939 | - if (rc) |
940 | - goto out; |
941 | - |
942 | - pm_runtime_get_noresume(dev); |
943 | - pm_runtime_set_active(dev); |
944 | - pm_runtime_enable(dev); |
945 | - |
946 | - rc = tpm_chip_register(chip); |
947 | - if (rc) { |
948 | - crb_go_idle(dev, priv); |
949 | - pm_runtime_put_noidle(dev); |
950 | - pm_runtime_disable(dev); |
951 | - goto out; |
952 | - } |
953 | - |
954 | - pm_runtime_put_sync(dev); |
955 | - |
956 | -out: |
957 | - __crb_relinquish_locality(dev, priv, 0); |
958 | - |
959 | - return rc; |
960 | + return tpm_chip_register(chip); |
961 | } |
962 | |
963 | static int crb_acpi_remove(struct acpi_device *device) |
964 | @@ -659,52 +653,11 @@ static int crb_acpi_remove(struct acpi_device *device) |
965 | |
966 | tpm_chip_unregister(chip); |
967 | |
968 | - pm_runtime_disable(dev); |
969 | - |
970 | return 0; |
971 | } |
972 | |
973 | -static int __maybe_unused crb_pm_runtime_suspend(struct device *dev) |
974 | -{ |
975 | - struct tpm_chip *chip = dev_get_drvdata(dev); |
976 | - struct crb_priv *priv = dev_get_drvdata(&chip->dev); |
977 | - |
978 | - return crb_go_idle(dev, priv); |
979 | -} |
980 | - |
981 | -static int __maybe_unused crb_pm_runtime_resume(struct device *dev) |
982 | -{ |
983 | - struct tpm_chip *chip = dev_get_drvdata(dev); |
984 | - struct crb_priv *priv = dev_get_drvdata(&chip->dev); |
985 | - |
986 | - return crb_cmd_ready(dev, priv); |
987 | -} |
988 | - |
989 | -static int __maybe_unused crb_pm_suspend(struct device *dev) |
990 | -{ |
991 | - int ret; |
992 | - |
993 | - ret = tpm_pm_suspend(dev); |
994 | - if (ret) |
995 | - return ret; |
996 | - |
997 | - return crb_pm_runtime_suspend(dev); |
998 | -} |
999 | - |
1000 | -static int __maybe_unused crb_pm_resume(struct device *dev) |
1001 | -{ |
1002 | - int ret; |
1003 | - |
1004 | - ret = crb_pm_runtime_resume(dev); |
1005 | - if (ret) |
1006 | - return ret; |
1007 | - |
1008 | - return tpm_pm_resume(dev); |
1009 | -} |
1010 | - |
1011 | static const struct dev_pm_ops crb_pm = { |
1012 | - SET_SYSTEM_SLEEP_PM_OPS(crb_pm_suspend, crb_pm_resume) |
1013 | - SET_RUNTIME_PM_OPS(crb_pm_runtime_suspend, crb_pm_runtime_resume, NULL) |
1014 | + SET_SYSTEM_SLEEP_PM_OPS(tpm_pm_suspend, tpm_pm_resume) |
1015 | }; |
1016 | |
1017 | static const struct acpi_device_id crb_device_ids[] = { |
1018 | diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c |
1019 | index d5b44cadac56..c619e76ce827 100644 |
1020 | --- a/drivers/char/tpm/tpm_i2c_infineon.c |
1021 | +++ b/drivers/char/tpm/tpm_i2c_infineon.c |
1022 | @@ -117,7 +117,7 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len) |
1023 | /* Lock the adapter for the duration of the whole sequence. */ |
1024 | if (!tpm_dev.client->adapter->algo->master_xfer) |
1025 | return -EOPNOTSUPP; |
1026 | - i2c_lock_adapter(tpm_dev.client->adapter); |
1027 | + i2c_lock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT); |
1028 | |
1029 | if (tpm_dev.chip_type == SLB9645) { |
1030 | /* use a combined read for newer chips |
1031 | @@ -192,7 +192,7 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len) |
1032 | } |
1033 | |
1034 | out: |
1035 | - i2c_unlock_adapter(tpm_dev.client->adapter); |
1036 | + i2c_unlock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT); |
1037 | /* take care of 'guard time' */ |
1038 | usleep_range(SLEEP_DURATION_LOW, SLEEP_DURATION_HI); |
1039 | |
1040 | @@ -224,7 +224,7 @@ static int iic_tpm_write_generic(u8 addr, u8 *buffer, size_t len, |
1041 | |
1042 | if (!tpm_dev.client->adapter->algo->master_xfer) |
1043 | return -EOPNOTSUPP; |
1044 | - i2c_lock_adapter(tpm_dev.client->adapter); |
1045 | + i2c_lock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT); |
1046 | |
1047 | /* prepend the 'register address' to the buffer */ |
1048 | tpm_dev.buf[0] = addr; |
1049 | @@ -243,7 +243,7 @@ static int iic_tpm_write_generic(u8 addr, u8 *buffer, size_t len, |
1050 | usleep_range(sleep_low, sleep_hi); |
1051 | } |
1052 | |
1053 | - i2c_unlock_adapter(tpm_dev.client->adapter); |
1054 | + i2c_unlock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT); |
1055 | /* take care of 'guard time' */ |
1056 | usleep_range(SLEEP_DURATION_LOW, SLEEP_DURATION_HI); |
1057 | |
1058 | diff --git a/drivers/char/tpm/tpm_tis_spi.c b/drivers/char/tpm/tpm_tis_spi.c |
1059 | index 8ab0bd8445f6..b00388fc41c8 100644 |
1060 | --- a/drivers/char/tpm/tpm_tis_spi.c |
1061 | +++ b/drivers/char/tpm/tpm_tis_spi.c |
1062 | @@ -188,6 +188,7 @@ static const struct tpm_tis_phy_ops tpm_spi_phy_ops = { |
1063 | static int tpm_tis_spi_probe(struct spi_device *dev) |
1064 | { |
1065 | struct tpm_tis_spi_phy *phy; |
1066 | + int irq; |
1067 | |
1068 | phy = devm_kzalloc(&dev->dev, sizeof(struct tpm_tis_spi_phy), |
1069 | GFP_KERNEL); |
1070 | @@ -200,7 +201,13 @@ static int tpm_tis_spi_probe(struct spi_device *dev) |
1071 | if (!phy->iobuf) |
1072 | return -ENOMEM; |
1073 | |
1074 | - return tpm_tis_core_init(&dev->dev, &phy->priv, -1, &tpm_spi_phy_ops, |
1075 | + /* If the SPI device has an IRQ then use that */ |
1076 | + if (dev->irq > 0) |
1077 | + irq = dev->irq; |
1078 | + else |
1079 | + irq = -1; |
1080 | + |
1081 | + return tpm_tis_core_init(&dev->dev, &phy->priv, irq, &tpm_spi_phy_ops, |
1082 | NULL); |
1083 | } |
1084 | |
1085 | diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c |
1086 | index e4b40f2b4627..9c0f7cf920af 100644 |
1087 | --- a/drivers/firmware/google/vpd.c |
1088 | +++ b/drivers/firmware/google/vpd.c |
1089 | @@ -246,6 +246,7 @@ static int vpd_section_destroy(struct vpd_section *sec) |
1090 | sysfs_remove_bin_file(vpd_kobj, &sec->bin_attr); |
1091 | kfree(sec->raw_name); |
1092 | memunmap(sec->baseaddr); |
1093 | + sec->enabled = false; |
1094 | } |
1095 | |
1096 | return 0; |
1097 | @@ -279,8 +280,10 @@ static int vpd_sections_init(phys_addr_t physaddr) |
1098 | ret = vpd_section_init("rw", &rw_vpd, |
1099 | physaddr + sizeof(struct vpd_cbmem) + |
1100 | header.ro_size, header.rw_size); |
1101 | - if (ret) |
1102 | + if (ret) { |
1103 | + vpd_section_destroy(&ro_vpd); |
1104 | return ret; |
1105 | + } |
1106 | } |
1107 | |
1108 | return 0; |
1109 | diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c |
1110 | index 4b80e996d976..1022fe8d09c7 100644 |
1111 | --- a/drivers/gpio/gpio-ml-ioh.c |
1112 | +++ b/drivers/gpio/gpio-ml-ioh.c |
1113 | @@ -497,9 +497,10 @@ static int ioh_gpio_probe(struct pci_dev *pdev, |
1114 | return 0; |
1115 | |
1116 | err_gpiochip_add: |
1117 | + chip = chip_save; |
1118 | while (--i >= 0) { |
1119 | - chip--; |
1120 | gpiochip_remove(&chip->gpio); |
1121 | + chip++; |
1122 | } |
1123 | kfree(chip_save); |
1124 | |
1125 | diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c |
1126 | index fbaf974277df..1eb857e2f62f 100644 |
1127 | --- a/drivers/gpio/gpio-tegra.c |
1128 | +++ b/drivers/gpio/gpio-tegra.c |
1129 | @@ -728,4 +728,4 @@ static int __init tegra_gpio_init(void) |
1130 | { |
1131 | return platform_driver_register(&tegra_gpio_driver); |
1132 | } |
1133 | -postcore_initcall(tegra_gpio_init); |
1134 | +subsys_initcall(tegra_gpio_init); |
1135 | diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h |
1136 | index be813b2738c1..2e706f1abe64 100644 |
1137 | --- a/drivers/gpu/drm/i915/i915_reg.h |
1138 | +++ b/drivers/gpu/drm/i915/i915_reg.h |
1139 | @@ -8462,6 +8462,7 @@ enum skl_power_gate { |
1140 | #define TRANS_MSA_10_BPC (2<<5) |
1141 | #define TRANS_MSA_12_BPC (3<<5) |
1142 | #define TRANS_MSA_16_BPC (4<<5) |
1143 | +#define TRANS_MSA_CEA_RANGE (1<<3) |
1144 | |
1145 | /* LCPLL Control */ |
1146 | #define LCPLL_CTL _MMIO(0x130040) |
1147 | diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c |
1148 | index 5e5fe03b638c..3a4a581345c4 100644 |
1149 | --- a/drivers/gpu/drm/i915/intel_ddi.c |
1150 | +++ b/drivers/gpu/drm/i915/intel_ddi.c |
1151 | @@ -1396,6 +1396,10 @@ void intel_ddi_set_pipe_settings(const struct intel_crtc_state *crtc_state) |
1152 | WARN_ON(transcoder_is_dsi(cpu_transcoder)); |
1153 | |
1154 | temp = TRANS_MSA_SYNC_CLK; |
1155 | + |
1156 | + if (crtc_state->limited_color_range) |
1157 | + temp |= TRANS_MSA_CEA_RANGE; |
1158 | + |
1159 | switch (crtc_state->pipe_bpp) { |
1160 | case 18: |
1161 | temp |= TRANS_MSA_6_BPC; |
1162 | diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c |
1163 | index 658fa2d3e40c..2c8411b8d050 100644 |
1164 | --- a/drivers/gpu/ipu-v3/ipu-common.c |
1165 | +++ b/drivers/gpu/ipu-v3/ipu-common.c |
1166 | @@ -1401,6 +1401,8 @@ static int ipu_probe(struct platform_device *pdev) |
1167 | return -ENODEV; |
1168 | |
1169 | ipu->id = of_alias_get_id(np, "ipu"); |
1170 | + if (ipu->id < 0) |
1171 | + ipu->id = 0; |
1172 | |
1173 | if (of_device_is_compatible(np, "fsl,imx6qp-ipu") && |
1174 | IS_ENABLED(CONFIG_DRM)) { |
1175 | diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c |
1176 | index 8267439dd1ee..d8101cd28dfa 100644 |
1177 | --- a/drivers/hv/hv.c |
1178 | +++ b/drivers/hv/hv.c |
1179 | @@ -196,6 +196,10 @@ int hv_synic_alloc(void) |
1180 | |
1181 | return 0; |
1182 | err: |
1183 | + /* |
1184 | + * Any memory allocations that succeeded will be freed when |
1185 | + * the caller cleans up by calling hv_synic_free() |
1186 | + */ |
1187 | return -ENOMEM; |
1188 | } |
1189 | |
1190 | @@ -208,12 +212,10 @@ void hv_synic_free(void) |
1191 | struct hv_per_cpu_context *hv_cpu |
1192 | = per_cpu_ptr(hv_context.cpu_context, cpu); |
1193 | |
1194 | - if (hv_cpu->synic_event_page) |
1195 | - free_page((unsigned long)hv_cpu->synic_event_page); |
1196 | - if (hv_cpu->synic_message_page) |
1197 | - free_page((unsigned long)hv_cpu->synic_message_page); |
1198 | - if (hv_cpu->post_msg_page) |
1199 | - free_page((unsigned long)hv_cpu->post_msg_page); |
1200 | + kfree(hv_cpu->clk_evt); |
1201 | + free_page((unsigned long)hv_cpu->synic_event_page); |
1202 | + free_page((unsigned long)hv_cpu->synic_message_page); |
1203 | + free_page((unsigned long)hv_cpu->post_msg_page); |
1204 | } |
1205 | |
1206 | kfree(hv_context.hv_numa_map); |
1207 | diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c |
1208 | index 284f8670dbeb..2feae9a421e6 100644 |
1209 | --- a/drivers/i2c/busses/i2c-aspeed.c |
1210 | +++ b/drivers/i2c/busses/i2c-aspeed.c |
1211 | @@ -859,7 +859,7 @@ static int aspeed_i2c_probe_bus(struct platform_device *pdev) |
1212 | if (!match) |
1213 | bus->get_clk_reg_val = aspeed_i2c_24xx_get_clk_reg_val; |
1214 | else |
1215 | - bus->get_clk_reg_val = match->data; |
1216 | + bus->get_clk_reg_val = (u32 (*)(u32))match->data; |
1217 | |
1218 | /* Initialize the I2C adapter */ |
1219 | spin_lock_init(&bus->lock); |
1220 | diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c |
1221 | index ba8df2fde1b2..67cbd9f61acc 100644 |
1222 | --- a/drivers/i2c/busses/i2c-i801.c |
1223 | +++ b/drivers/i2c/busses/i2c-i801.c |
1224 | @@ -138,6 +138,7 @@ |
1225 | |
1226 | #define SBREG_BAR 0x10 |
1227 | #define SBREG_SMBCTRL 0xc6000c |
1228 | +#define SBREG_SMBCTRL_DNV 0xcf000c |
1229 | |
1230 | /* Host status bits for SMBPCISTS */ |
1231 | #define SMBPCISTS_INTS BIT(3) |
1232 | @@ -1395,7 +1396,11 @@ static void i801_add_tco(struct i801_priv *priv) |
1233 | spin_unlock(&p2sb_spinlock); |
1234 | |
1235 | res = &tco_res[ICH_RES_MEM_OFF]; |
1236 | - res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; |
1237 | + if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS) |
1238 | + res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV; |
1239 | + else |
1240 | + res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; |
1241 | + |
1242 | res->end = res->start + 3; |
1243 | res->flags = IORESOURCE_MEM; |
1244 | |
1245 | diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c |
1246 | index ae6ed254e01d..732d6c456a6f 100644 |
1247 | --- a/drivers/i2c/busses/i2c-xiic.c |
1248 | +++ b/drivers/i2c/busses/i2c-xiic.c |
1249 | @@ -538,6 +538,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) |
1250 | { |
1251 | u8 rx_watermark; |
1252 | struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg; |
1253 | + unsigned long flags; |
1254 | |
1255 | /* Clear and enable Rx full interrupt. */ |
1256 | xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK); |
1257 | @@ -553,6 +554,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) |
1258 | rx_watermark = IIC_RX_FIFO_DEPTH; |
1259 | xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1); |
1260 | |
1261 | + local_irq_save(flags); |
1262 | if (!(msg->flags & I2C_M_NOSTART)) |
1263 | /* write the address */ |
1264 | xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, |
1265 | @@ -563,6 +565,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c) |
1266 | |
1267 | xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, |
1268 | msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0)); |
1269 | + local_irq_restore(flags); |
1270 | + |
1271 | if (i2c->nmsgs == 1) |
1272 | /* very last, enable bus not busy as well */ |
1273 | xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK); |
1274 | diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c |
1275 | index 79843a3ca9dc..752dbc388c27 100644 |
1276 | --- a/drivers/infiniband/core/cma.c |
1277 | +++ b/drivers/infiniband/core/cma.c |
1278 | @@ -1459,9 +1459,16 @@ static bool cma_match_net_dev(const struct rdma_cm_id *id, |
1279 | (addr->src_addr.ss_family == AF_IB || |
1280 | cma_protocol_roce_dev_port(id->device, port_num)); |
1281 | |
1282 | - return !addr->dev_addr.bound_dev_if || |
1283 | - (net_eq(dev_net(net_dev), addr->dev_addr.net) && |
1284 | - addr->dev_addr.bound_dev_if == net_dev->ifindex); |
1285 | + /* |
1286 | + * Net namespaces must match, and if the listner is listening |
1287 | + * on a specific netdevice than netdevice must match as well. |
1288 | + */ |
1289 | + if (net_eq(dev_net(net_dev), addr->dev_addr.net) && |
1290 | + (!!addr->dev_addr.bound_dev_if == |
1291 | + (addr->dev_addr.bound_dev_if == net_dev->ifindex))) |
1292 | + return true; |
1293 | + else |
1294 | + return false; |
1295 | } |
1296 | |
1297 | static struct rdma_id_private *cma_find_listener( |
1298 | diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c |
1299 | index fc149ea64be7..59aaac43db91 100644 |
1300 | --- a/drivers/input/touchscreen/atmel_mxt_ts.c |
1301 | +++ b/drivers/input/touchscreen/atmel_mxt_ts.c |
1302 | @@ -1647,10 +1647,11 @@ static int mxt_parse_object_table(struct mxt_data *data, |
1303 | break; |
1304 | case MXT_TOUCH_MULTI_T9: |
1305 | data->multitouch = MXT_TOUCH_MULTI_T9; |
1306 | + /* Only handle messages from first T9 instance */ |
1307 | data->T9_reportid_min = min_id; |
1308 | - data->T9_reportid_max = max_id; |
1309 | - data->num_touchids = object->num_report_ids |
1310 | - * mxt_obj_instances(object); |
1311 | + data->T9_reportid_max = min_id + |
1312 | + object->num_report_ids - 1; |
1313 | + data->num_touchids = object->num_report_ids; |
1314 | break; |
1315 | case MXT_SPT_MESSAGECOUNT_T44: |
1316 | data->T44_address = object->start_address; |
1317 | diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c |
1318 | index 195d6e93ac71..5d0ba5f644c4 100644 |
1319 | --- a/drivers/iommu/ipmmu-vmsa.c |
1320 | +++ b/drivers/iommu/ipmmu-vmsa.c |
1321 | @@ -54,7 +54,7 @@ struct ipmmu_vmsa_domain { |
1322 | struct io_pgtable_ops *iop; |
1323 | |
1324 | unsigned int context_id; |
1325 | - spinlock_t lock; /* Protects mappings */ |
1326 | + struct mutex mutex; /* Protects mappings */ |
1327 | }; |
1328 | |
1329 | struct ipmmu_vmsa_iommu_priv { |
1330 | @@ -523,7 +523,7 @@ static struct iommu_domain *__ipmmu_domain_alloc(unsigned type) |
1331 | if (!domain) |
1332 | return NULL; |
1333 | |
1334 | - spin_lock_init(&domain->lock); |
1335 | + mutex_init(&domain->mutex); |
1336 | |
1337 | return &domain->io_domain; |
1338 | } |
1339 | @@ -548,7 +548,6 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, |
1340 | struct iommu_fwspec *fwspec = dev->iommu_fwspec; |
1341 | struct ipmmu_vmsa_device *mmu = priv->mmu; |
1342 | struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain); |
1343 | - unsigned long flags; |
1344 | unsigned int i; |
1345 | int ret = 0; |
1346 | |
1347 | @@ -557,7 +556,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, |
1348 | return -ENXIO; |
1349 | } |
1350 | |
1351 | - spin_lock_irqsave(&domain->lock, flags); |
1352 | + mutex_lock(&domain->mutex); |
1353 | |
1354 | if (!domain->mmu) { |
1355 | /* The domain hasn't been used yet, initialize it. */ |
1356 | @@ -574,7 +573,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, |
1357 | } else |
1358 | dev_info(dev, "Reusing IPMMU context %u\n", domain->context_id); |
1359 | |
1360 | - spin_unlock_irqrestore(&domain->lock, flags); |
1361 | + mutex_unlock(&domain->mutex); |
1362 | |
1363 | if (ret < 0) |
1364 | return ret; |
1365 | diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c |
1366 | index c4c2b3b85ebc..f6e040fcad9a 100644 |
1367 | --- a/drivers/macintosh/via-pmu.c |
1368 | +++ b/drivers/macintosh/via-pmu.c |
1369 | @@ -532,8 +532,9 @@ init_pmu(void) |
1370 | int timeout; |
1371 | struct adb_request req; |
1372 | |
1373 | - out_8(&via[B], via[B] | TREQ); /* negate TREQ */ |
1374 | - out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK); /* TACK in, TREQ out */ |
1375 | + /* Negate TREQ. Set TACK to input and TREQ to output. */ |
1376 | + out_8(&via[B], in_8(&via[B]) | TREQ); |
1377 | + out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK); |
1378 | |
1379 | pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask); |
1380 | timeout = 100000; |
1381 | @@ -1455,8 +1456,8 @@ pmu_sr_intr(void) |
1382 | struct adb_request *req; |
1383 | int bite = 0; |
1384 | |
1385 | - if (via[B] & TREQ) { |
1386 | - printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]); |
1387 | + if (in_8(&via[B]) & TREQ) { |
1388 | + printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B])); |
1389 | out_8(&via[IFR], SR_INT); |
1390 | return NULL; |
1391 | } |
1392 | diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c |
1393 | index 71c3507df9a0..a4b7c2698096 100644 |
1394 | --- a/drivers/md/dm-cache-target.c |
1395 | +++ b/drivers/md/dm-cache-target.c |
1396 | @@ -2330,7 +2330,7 @@ static int parse_features(struct cache_args *ca, struct dm_arg_set *as, |
1397 | {0, 2, "Invalid number of cache feature arguments"}, |
1398 | }; |
1399 | |
1400 | - int r; |
1401 | + int r, mode_ctr = 0; |
1402 | unsigned argc; |
1403 | const char *arg; |
1404 | struct cache_features *cf = &ca->features; |
1405 | @@ -2344,14 +2344,20 @@ static int parse_features(struct cache_args *ca, struct dm_arg_set *as, |
1406 | while (argc--) { |
1407 | arg = dm_shift_arg(as); |
1408 | |
1409 | - if (!strcasecmp(arg, "writeback")) |
1410 | + if (!strcasecmp(arg, "writeback")) { |
1411 | cf->io_mode = CM_IO_WRITEBACK; |
1412 | + mode_ctr++; |
1413 | + } |
1414 | |
1415 | - else if (!strcasecmp(arg, "writethrough")) |
1416 | + else if (!strcasecmp(arg, "writethrough")) { |
1417 | cf->io_mode = CM_IO_WRITETHROUGH; |
1418 | + mode_ctr++; |
1419 | + } |
1420 | |
1421 | - else if (!strcasecmp(arg, "passthrough")) |
1422 | + else if (!strcasecmp(arg, "passthrough")) { |
1423 | cf->io_mode = CM_IO_PASSTHROUGH; |
1424 | + mode_ctr++; |
1425 | + } |
1426 | |
1427 | else if (!strcasecmp(arg, "metadata2")) |
1428 | cf->metadata_version = 2; |
1429 | @@ -2362,6 +2368,11 @@ static int parse_features(struct cache_args *ca, struct dm_arg_set *as, |
1430 | } |
1431 | } |
1432 | |
1433 | + if (mode_ctr > 1) { |
1434 | + *error = "Duplicate cache io_mode features requested"; |
1435 | + return -EINVAL; |
1436 | + } |
1437 | + |
1438 | return 0; |
1439 | } |
1440 | |
1441 | diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c |
1442 | index 07ca2fd10189..5018fb2352c2 100644 |
1443 | --- a/drivers/md/raid5.c |
1444 | +++ b/drivers/md/raid5.c |
1445 | @@ -4516,6 +4516,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s) |
1446 | s->failed++; |
1447 | if (rdev && !test_bit(Faulty, &rdev->flags)) |
1448 | do_recovery = 1; |
1449 | + else if (!rdev) { |
1450 | + rdev = rcu_dereference( |
1451 | + conf->disks[i].replacement); |
1452 | + if (rdev && !test_bit(Faulty, &rdev->flags)) |
1453 | + do_recovery = 1; |
1454 | + } |
1455 | } |
1456 | |
1457 | if (test_bit(R5_InJournal, &dev->flags)) |
1458 | diff --git a/drivers/media/dvb-frontends/helene.c b/drivers/media/dvb-frontends/helene.c |
1459 | index 2ab8d83e5576..fcfe658a4328 100644 |
1460 | --- a/drivers/media/dvb-frontends/helene.c |
1461 | +++ b/drivers/media/dvb-frontends/helene.c |
1462 | @@ -897,7 +897,10 @@ static int helene_x_pon(struct helene_priv *priv) |
1463 | helene_write_regs(priv, 0x99, cdata, sizeof(cdata)); |
1464 | |
1465 | /* 0x81 - 0x94 */ |
1466 | - data[0] = 0x18; /* xtal 24 MHz */ |
1467 | + if (priv->xtal == SONY_HELENE_XTAL_16000) |
1468 | + data[0] = 0x10; /* xtal 16 MHz */ |
1469 | + else |
1470 | + data[0] = 0x18; /* xtal 24 MHz */ |
1471 | data[1] = (uint8_t)(0x80 | (0x04 & 0x1F)); /* 4 x 25 = 100uA */ |
1472 | data[2] = (uint8_t)(0x80 | (0x26 & 0x7F)); /* 38 x 0.25 = 9.5pF */ |
1473 | data[3] = 0x80; /* REFOUT signal output 500mVpp */ |
1474 | diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c |
1475 | index 56fe4e5b396e..4a65861433d6 100644 |
1476 | --- a/drivers/media/platform/davinci/vpif_display.c |
1477 | +++ b/drivers/media/platform/davinci/vpif_display.c |
1478 | @@ -1114,6 +1114,14 @@ vpif_init_free_channel_objects: |
1479 | return err; |
1480 | } |
1481 | |
1482 | +static void free_vpif_objs(void) |
1483 | +{ |
1484 | + int i; |
1485 | + |
1486 | + for (i = 0; i < VPIF_DISPLAY_MAX_DEVICES; i++) |
1487 | + kfree(vpif_obj.dev[i]); |
1488 | +} |
1489 | + |
1490 | static int vpif_async_bound(struct v4l2_async_notifier *notifier, |
1491 | struct v4l2_subdev *subdev, |
1492 | struct v4l2_async_subdev *asd) |
1493 | @@ -1250,11 +1258,6 @@ static __init int vpif_probe(struct platform_device *pdev) |
1494 | return -EINVAL; |
1495 | } |
1496 | |
1497 | - if (!pdev->dev.platform_data) { |
1498 | - dev_warn(&pdev->dev, "Missing platform data. Giving up.\n"); |
1499 | - return -EINVAL; |
1500 | - } |
1501 | - |
1502 | vpif_dev = &pdev->dev; |
1503 | err = initialize_vpif(); |
1504 | |
1505 | @@ -1266,7 +1269,7 @@ static __init int vpif_probe(struct platform_device *pdev) |
1506 | err = v4l2_device_register(vpif_dev, &vpif_obj.v4l2_dev); |
1507 | if (err) { |
1508 | v4l2_err(vpif_dev->driver, "Error registering v4l2 device\n"); |
1509 | - return err; |
1510 | + goto vpif_free; |
1511 | } |
1512 | |
1513 | while ((res = platform_get_resource(pdev, IORESOURCE_IRQ, res_idx))) { |
1514 | @@ -1309,7 +1312,10 @@ static __init int vpif_probe(struct platform_device *pdev) |
1515 | if (vpif_obj.sd[i]) |
1516 | vpif_obj.sd[i]->grp_id = 1 << i; |
1517 | } |
1518 | - vpif_probe_complete(); |
1519 | + err = vpif_probe_complete(); |
1520 | + if (err) { |
1521 | + goto probe_subdev_out; |
1522 | + } |
1523 | } else { |
1524 | vpif_obj.notifier.subdevs = vpif_obj.config->asd; |
1525 | vpif_obj.notifier.num_subdevs = vpif_obj.config->asd_sizes[0]; |
1526 | @@ -1330,6 +1336,8 @@ probe_subdev_out: |
1527 | kfree(vpif_obj.sd); |
1528 | vpif_unregister: |
1529 | v4l2_device_unregister(&vpif_obj.v4l2_dev); |
1530 | +vpif_free: |
1531 | + free_vpif_objs(); |
1532 | |
1533 | return err; |
1534 | } |
1535 | @@ -1351,8 +1359,8 @@ static int vpif_remove(struct platform_device *device) |
1536 | ch = vpif_obj.dev[i]; |
1537 | /* Unregister video device */ |
1538 | video_unregister_device(&ch->video_dev); |
1539 | - kfree(vpif_obj.dev[i]); |
1540 | } |
1541 | + free_vpif_objs(); |
1542 | |
1543 | return 0; |
1544 | } |
1545 | diff --git a/drivers/media/platform/qcom/camss-8x16/camss-csid.c b/drivers/media/platform/qcom/camss-8x16/camss-csid.c |
1546 | index 64df82817de3..4882ee25bd75 100644 |
1547 | --- a/drivers/media/platform/qcom/camss-8x16/camss-csid.c |
1548 | +++ b/drivers/media/platform/qcom/camss-8x16/camss-csid.c |
1549 | @@ -392,9 +392,6 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) |
1550 | !media_entity_remote_pad(&csid->pads[MSM_CSID_PAD_SINK])) |
1551 | return -ENOLINK; |
1552 | |
1553 | - dt = csid_get_fmt_entry(csid->fmt[MSM_CSID_PAD_SRC].code)-> |
1554 | - data_type; |
1555 | - |
1556 | if (tg->enabled) { |
1557 | /* Config Test Generator */ |
1558 | struct v4l2_mbus_framefmt *f = |
1559 | @@ -416,6 +413,9 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) |
1560 | writel_relaxed(val, csid->base + |
1561 | CAMSS_CSID_TG_DT_n_CGG_0(0)); |
1562 | |
1563 | + dt = csid_get_fmt_entry( |
1564 | + csid->fmt[MSM_CSID_PAD_SRC].code)->data_type; |
1565 | + |
1566 | /* 5:0 data type */ |
1567 | val = dt; |
1568 | writel_relaxed(val, csid->base + |
1569 | @@ -425,6 +425,9 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) |
1570 | val = tg->payload_mode; |
1571 | writel_relaxed(val, csid->base + |
1572 | CAMSS_CSID_TG_DT_n_CGG_2(0)); |
1573 | + |
1574 | + df = csid_get_fmt_entry( |
1575 | + csid->fmt[MSM_CSID_PAD_SRC].code)->decode_format; |
1576 | } else { |
1577 | struct csid_phy_config *phy = &csid->phy; |
1578 | |
1579 | @@ -439,13 +442,16 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) |
1580 | |
1581 | writel_relaxed(val, |
1582 | csid->base + CAMSS_CSID_CORE_CTRL_1); |
1583 | + |
1584 | + dt = csid_get_fmt_entry( |
1585 | + csid->fmt[MSM_CSID_PAD_SINK].code)->data_type; |
1586 | + df = csid_get_fmt_entry( |
1587 | + csid->fmt[MSM_CSID_PAD_SINK].code)->decode_format; |
1588 | } |
1589 | |
1590 | /* Config LUT */ |
1591 | |
1592 | dt_shift = (cid % 4) * 8; |
1593 | - df = csid_get_fmt_entry(csid->fmt[MSM_CSID_PAD_SINK].code)-> |
1594 | - decode_format; |
1595 | |
1596 | val = readl_relaxed(csid->base + CAMSS_CSID_CID_LUT_VC_n(vc)); |
1597 | val &= ~(0xff << dt_shift); |
1598 | diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c |
1599 | index 8e9531f7f83f..9942932ecbf9 100644 |
1600 | --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c |
1601 | +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c |
1602 | @@ -254,24 +254,24 @@ static void s5p_mfc_handle_frame_all_extracted(struct s5p_mfc_ctx *ctx) |
1603 | static void s5p_mfc_handle_frame_copy_time(struct s5p_mfc_ctx *ctx) |
1604 | { |
1605 | struct s5p_mfc_dev *dev = ctx->dev; |
1606 | - struct s5p_mfc_buf *dst_buf, *src_buf; |
1607 | - size_t dec_y_addr; |
1608 | + struct s5p_mfc_buf *dst_buf, *src_buf; |
1609 | + u32 dec_y_addr; |
1610 | unsigned int frame_type; |
1611 | |
1612 | /* Make sure we actually have a new frame before continuing. */ |
1613 | frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_dec_frame_type, dev); |
1614 | if (frame_type == S5P_FIMV_DECODE_FRAME_SKIPPED) |
1615 | return; |
1616 | - dec_y_addr = s5p_mfc_hw_call(dev->mfc_ops, get_dec_y_adr, dev); |
1617 | + dec_y_addr = (u32)s5p_mfc_hw_call(dev->mfc_ops, get_dec_y_adr, dev); |
1618 | |
1619 | /* Copy timestamp / timecode from decoded src to dst and set |
1620 | appropriate flags. */ |
1621 | src_buf = list_entry(ctx->src_queue.next, struct s5p_mfc_buf, list); |
1622 | list_for_each_entry(dst_buf, &ctx->dst_queue, list) { |
1623 | - if (vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0) |
1624 | - == dec_y_addr) { |
1625 | - dst_buf->b->timecode = |
1626 | - src_buf->b->timecode; |
1627 | + u32 addr = (u32)vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0); |
1628 | + |
1629 | + if (addr == dec_y_addr) { |
1630 | + dst_buf->b->timecode = src_buf->b->timecode; |
1631 | dst_buf->b->vb2_buf.timestamp = |
1632 | src_buf->b->vb2_buf.timestamp; |
1633 | dst_buf->b->flags &= |
1634 | @@ -307,10 +307,10 @@ static void s5p_mfc_handle_frame_new(struct s5p_mfc_ctx *ctx, unsigned int err) |
1635 | { |
1636 | struct s5p_mfc_dev *dev = ctx->dev; |
1637 | struct s5p_mfc_buf *dst_buf; |
1638 | - size_t dspl_y_addr; |
1639 | + u32 dspl_y_addr; |
1640 | unsigned int frame_type; |
1641 | |
1642 | - dspl_y_addr = s5p_mfc_hw_call(dev->mfc_ops, get_dspl_y_adr, dev); |
1643 | + dspl_y_addr = (u32)s5p_mfc_hw_call(dev->mfc_ops, get_dspl_y_adr, dev); |
1644 | if (IS_MFCV6_PLUS(dev)) |
1645 | frame_type = s5p_mfc_hw_call(dev->mfc_ops, |
1646 | get_disp_frame_type, ctx); |
1647 | @@ -329,9 +329,10 @@ static void s5p_mfc_handle_frame_new(struct s5p_mfc_ctx *ctx, unsigned int err) |
1648 | /* The MFC returns address of the buffer, now we have to |
1649 | * check which videobuf does it correspond to */ |
1650 | list_for_each_entry(dst_buf, &ctx->dst_queue, list) { |
1651 | + u32 addr = (u32)vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0); |
1652 | + |
1653 | /* Check if this is the buffer we're looking for */ |
1654 | - if (vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0) |
1655 | - == dspl_y_addr) { |
1656 | + if (addr == dspl_y_addr) { |
1657 | list_del(&dst_buf->list); |
1658 | ctx->dst_queue_cnt--; |
1659 | dst_buf->b->sequence = ctx->sequence; |
1660 | diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c |
1661 | index b421329b21fa..3d09e1c87921 100644 |
1662 | --- a/drivers/media/usb/dvb-usb/dw2102.c |
1663 | +++ b/drivers/media/usb/dvb-usb/dw2102.c |
1664 | @@ -2103,14 +2103,12 @@ static struct dvb_usb_device_properties s6x0_properties = { |
1665 | } |
1666 | }; |
1667 | |
1668 | -static struct dvb_usb_device_properties *p1100; |
1669 | static const struct dvb_usb_device_description d1100 = { |
1670 | "Prof 1100 USB ", |
1671 | {&dw2102_table[PROF_1100], NULL}, |
1672 | {NULL}, |
1673 | }; |
1674 | |
1675 | -static struct dvb_usb_device_properties *s660; |
1676 | static const struct dvb_usb_device_description d660 = { |
1677 | "TeVii S660 USB", |
1678 | {&dw2102_table[TEVII_S660], NULL}, |
1679 | @@ -2129,14 +2127,12 @@ static const struct dvb_usb_device_description d480_2 = { |
1680 | {NULL}, |
1681 | }; |
1682 | |
1683 | -static struct dvb_usb_device_properties *p7500; |
1684 | static const struct dvb_usb_device_description d7500 = { |
1685 | "Prof 7500 USB DVB-S2", |
1686 | {&dw2102_table[PROF_7500], NULL}, |
1687 | {NULL}, |
1688 | }; |
1689 | |
1690 | -static struct dvb_usb_device_properties *s421; |
1691 | static const struct dvb_usb_device_description d421 = { |
1692 | "TeVii S421 PCI", |
1693 | {&dw2102_table[TEVII_S421], NULL}, |
1694 | @@ -2336,6 +2332,11 @@ static int dw2102_probe(struct usb_interface *intf, |
1695 | const struct usb_device_id *id) |
1696 | { |
1697 | int retval = -ENOMEM; |
1698 | + struct dvb_usb_device_properties *p1100; |
1699 | + struct dvb_usb_device_properties *s660; |
1700 | + struct dvb_usb_device_properties *p7500; |
1701 | + struct dvb_usb_device_properties *s421; |
1702 | + |
1703 | p1100 = kmemdup(&s6x0_properties, |
1704 | sizeof(struct dvb_usb_device_properties), GFP_KERNEL); |
1705 | if (!p1100) |
1706 | @@ -2404,8 +2405,16 @@ static int dw2102_probe(struct usb_interface *intf, |
1707 | 0 == dvb_usb_device_init(intf, &t220_properties, |
1708 | THIS_MODULE, NULL, adapter_nr) || |
1709 | 0 == dvb_usb_device_init(intf, &tt_s2_4600_properties, |
1710 | - THIS_MODULE, NULL, adapter_nr)) |
1711 | + THIS_MODULE, NULL, adapter_nr)) { |
1712 | + |
1713 | + /* clean up copied properties */ |
1714 | + kfree(s421); |
1715 | + kfree(p7500); |
1716 | + kfree(s660); |
1717 | + kfree(p1100); |
1718 | + |
1719 | return 0; |
1720 | + } |
1721 | |
1722 | retval = -ENODEV; |
1723 | kfree(s421); |
1724 | diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c |
1725 | index 0f3fab47fe48..7dc1cbcd2fb8 100644 |
1726 | --- a/drivers/mfd/ti_am335x_tscadc.c |
1727 | +++ b/drivers/mfd/ti_am335x_tscadc.c |
1728 | @@ -210,14 +210,13 @@ static int ti_tscadc_probe(struct platform_device *pdev) |
1729 | * The TSC_ADC_SS controller design assumes the OCP clock is |
1730 | * at least 6x faster than the ADC clock. |
1731 | */ |
1732 | - clk = clk_get(&pdev->dev, "adc_tsc_fck"); |
1733 | + clk = devm_clk_get(&pdev->dev, "adc_tsc_fck"); |
1734 | if (IS_ERR(clk)) { |
1735 | dev_err(&pdev->dev, "failed to get TSC fck\n"); |
1736 | err = PTR_ERR(clk); |
1737 | goto err_disable_clk; |
1738 | } |
1739 | clock_rate = clk_get_rate(clk); |
1740 | - clk_put(clk); |
1741 | tscadc->clk_div = clock_rate / ADC_CLK; |
1742 | |
1743 | /* TSCADC_CLKDIV needs to be configured to the value minus 1 */ |
1744 | diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c |
1745 | index ddc9e4b08b5c..56efa9d18a9a 100644 |
1746 | --- a/drivers/misc/mic/scif/scif_api.c |
1747 | +++ b/drivers/misc/mic/scif/scif_api.c |
1748 | @@ -370,11 +370,10 @@ int scif_bind(scif_epd_t epd, u16 pn) |
1749 | goto scif_bind_exit; |
1750 | } |
1751 | } else { |
1752 | - pn = scif_get_new_port(); |
1753 | - if (!pn) { |
1754 | - ret = -ENOSPC; |
1755 | + ret = scif_get_new_port(); |
1756 | + if (ret < 0) |
1757 | goto scif_bind_exit; |
1758 | - } |
1759 | + pn = ret; |
1760 | } |
1761 | |
1762 | ep->state = SCIFEP_BOUND; |
1763 | @@ -648,13 +647,12 @@ int __scif_connect(scif_epd_t epd, struct scif_port_id *dst, bool non_block) |
1764 | err = -EISCONN; |
1765 | break; |
1766 | case SCIFEP_UNBOUND: |
1767 | - ep->port.port = scif_get_new_port(); |
1768 | - if (!ep->port.port) { |
1769 | - err = -ENOSPC; |
1770 | - } else { |
1771 | - ep->port.node = scif_info.nodeid; |
1772 | - ep->conn_async_state = ASYNC_CONN_IDLE; |
1773 | - } |
1774 | + err = scif_get_new_port(); |
1775 | + if (err < 0) |
1776 | + break; |
1777 | + ep->port.port = err; |
1778 | + ep->port.node = scif_info.nodeid; |
1779 | + ep->conn_async_state = ASYNC_CONN_IDLE; |
1780 | /* Fall through */ |
1781 | case SCIFEP_BOUND: |
1782 | /* |
1783 | diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c |
1784 | index b77aacafc3fc..dda3ed72d05b 100644 |
1785 | --- a/drivers/misc/ti-st/st_kim.c |
1786 | +++ b/drivers/misc/ti-st/st_kim.c |
1787 | @@ -756,14 +756,14 @@ static int kim_probe(struct platform_device *pdev) |
1788 | err = gpio_request(kim_gdata->nshutdown, "kim"); |
1789 | if (unlikely(err)) { |
1790 | pr_err(" gpio %d request failed ", kim_gdata->nshutdown); |
1791 | - return err; |
1792 | + goto err_sysfs_group; |
1793 | } |
1794 | |
1795 | /* Configure nShutdown GPIO as output=0 */ |
1796 | err = gpio_direction_output(kim_gdata->nshutdown, 0); |
1797 | if (unlikely(err)) { |
1798 | pr_err(" unable to configure gpio %d", kim_gdata->nshutdown); |
1799 | - return err; |
1800 | + goto err_sysfs_group; |
1801 | } |
1802 | /* get reference of pdev for request_firmware |
1803 | */ |
1804 | diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c |
1805 | index 23a6986d512b..a8f74d9bba4f 100644 |
1806 | --- a/drivers/mtd/ubi/wl.c |
1807 | +++ b/drivers/mtd/ubi/wl.c |
1808 | @@ -1615,8 +1615,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) |
1809 | cond_resched(); |
1810 | |
1811 | e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); |
1812 | - if (!e) |
1813 | + if (!e) { |
1814 | + err = -ENOMEM; |
1815 | goto out_free; |
1816 | + } |
1817 | |
1818 | e->pnum = aeb->pnum; |
1819 | e->ec = aeb->ec; |
1820 | @@ -1635,8 +1637,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) |
1821 | cond_resched(); |
1822 | |
1823 | e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); |
1824 | - if (!e) |
1825 | + if (!e) { |
1826 | + err = -ENOMEM; |
1827 | goto out_free; |
1828 | + } |
1829 | |
1830 | e->pnum = aeb->pnum; |
1831 | e->ec = aeb->ec; |
1832 | diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c |
1833 | index 3deaa3413313..074a5b79d691 100644 |
1834 | --- a/drivers/net/ethernet/marvell/mvneta.c |
1835 | +++ b/drivers/net/ethernet/marvell/mvneta.c |
1836 | @@ -3195,7 +3195,6 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) |
1837 | |
1838 | on_each_cpu(mvneta_percpu_enable, pp, true); |
1839 | mvneta_start_dev(pp); |
1840 | - mvneta_port_up(pp); |
1841 | |
1842 | netdev_update_features(dev); |
1843 | |
1844 | diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c |
1845 | index 0c5b68e7da51..9b3167054843 100644 |
1846 | --- a/drivers/net/phy/mdio-mux-bcm-iproc.c |
1847 | +++ b/drivers/net/phy/mdio-mux-bcm-iproc.c |
1848 | @@ -22,7 +22,7 @@ |
1849 | #include <linux/mdio-mux.h> |
1850 | #include <linux/delay.h> |
1851 | |
1852 | -#define MDIO_PARAM_OFFSET 0x00 |
1853 | +#define MDIO_PARAM_OFFSET 0x23c |
1854 | #define MDIO_PARAM_MIIM_CYCLE 29 |
1855 | #define MDIO_PARAM_INTERNAL_SEL 25 |
1856 | #define MDIO_PARAM_BUS_ID 22 |
1857 | @@ -30,20 +30,22 @@ |
1858 | #define MDIO_PARAM_PHY_ID 16 |
1859 | #define MDIO_PARAM_PHY_DATA 0 |
1860 | |
1861 | -#define MDIO_READ_OFFSET 0x04 |
1862 | +#define MDIO_READ_OFFSET 0x240 |
1863 | #define MDIO_READ_DATA_MASK 0xffff |
1864 | -#define MDIO_ADDR_OFFSET 0x08 |
1865 | +#define MDIO_ADDR_OFFSET 0x244 |
1866 | |
1867 | -#define MDIO_CTRL_OFFSET 0x0C |
1868 | +#define MDIO_CTRL_OFFSET 0x248 |
1869 | #define MDIO_CTRL_WRITE_OP 0x1 |
1870 | #define MDIO_CTRL_READ_OP 0x2 |
1871 | |
1872 | -#define MDIO_STAT_OFFSET 0x10 |
1873 | +#define MDIO_STAT_OFFSET 0x24c |
1874 | #define MDIO_STAT_DONE 1 |
1875 | |
1876 | #define BUS_MAX_ADDR 32 |
1877 | #define EXT_BUS_START_ADDR 16 |
1878 | |
1879 | +#define MDIO_REG_ADDR_SPACE_SIZE 0x250 |
1880 | + |
1881 | struct iproc_mdiomux_desc { |
1882 | void *mux_handle; |
1883 | void __iomem *base; |
1884 | @@ -169,6 +171,14 @@ static int mdio_mux_iproc_probe(struct platform_device *pdev) |
1885 | md->dev = &pdev->dev; |
1886 | |
1887 | res = platform_get_resource(pdev, IORESOURCE_MEM, 0); |
1888 | + if (res->start & 0xfff) { |
1889 | + /* For backward compatibility in case the |
1890 | + * base address is specified with an offset. |
1891 | + */ |
1892 | + dev_info(&pdev->dev, "fix base address in dt-blob\n"); |
1893 | + res->start &= ~0xfff; |
1894 | + res->end = res->start + MDIO_REG_ADDR_SPACE_SIZE - 1; |
1895 | + } |
1896 | md->base = devm_ioremap_resource(&pdev->dev, res); |
1897 | if (IS_ERR(md->base)) { |
1898 | dev_err(&pdev->dev, "failed to ioremap register\n"); |
1899 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c |
1900 | index cb17ffadfc30..e0baea2dfd3c 100644 |
1901 | --- a/drivers/net/tun.c |
1902 | +++ b/drivers/net/tun.c |
1903 | @@ -534,14 +534,6 @@ static void tun_queue_purge(struct tun_file *tfile) |
1904 | skb_queue_purge(&tfile->sk.sk_error_queue); |
1905 | } |
1906 | |
1907 | -static void tun_cleanup_tx_array(struct tun_file *tfile) |
1908 | -{ |
1909 | - if (tfile->tx_array.ring.queue) { |
1910 | - skb_array_cleanup(&tfile->tx_array); |
1911 | - memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); |
1912 | - } |
1913 | -} |
1914 | - |
1915 | static void __tun_detach(struct tun_file *tfile, bool clean) |
1916 | { |
1917 | struct tun_file *ntfile; |
1918 | @@ -583,7 +575,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean) |
1919 | tun->dev->reg_state == NETREG_REGISTERED) |
1920 | unregister_netdevice(tun->dev); |
1921 | } |
1922 | - tun_cleanup_tx_array(tfile); |
1923 | + skb_array_cleanup(&tfile->tx_array); |
1924 | sock_put(&tfile->sk); |
1925 | } |
1926 | } |
1927 | @@ -623,13 +615,11 @@ static void tun_detach_all(struct net_device *dev) |
1928 | /* Drop read queue */ |
1929 | tun_queue_purge(tfile); |
1930 | sock_put(&tfile->sk); |
1931 | - tun_cleanup_tx_array(tfile); |
1932 | } |
1933 | list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { |
1934 | tun_enable_queue(tfile); |
1935 | tun_queue_purge(tfile); |
1936 | sock_put(&tfile->sk); |
1937 | - tun_cleanup_tx_array(tfile); |
1938 | } |
1939 | BUG_ON(tun->numdisabled != 0); |
1940 | |
1941 | @@ -675,7 +665,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filte |
1942 | } |
1943 | |
1944 | if (!tfile->detached && |
1945 | - skb_array_init(&tfile->tx_array, dev->tx_queue_len, GFP_KERNEL)) { |
1946 | + skb_array_resize(&tfile->tx_array, dev->tx_queue_len, GFP_KERNEL)) { |
1947 | err = -ENOMEM; |
1948 | goto out; |
1949 | } |
1950 | @@ -2624,6 +2614,11 @@ static int tun_chr_open(struct inode *inode, struct file * file) |
1951 | &tun_proto, 0); |
1952 | if (!tfile) |
1953 | return -ENOMEM; |
1954 | + if (skb_array_init(&tfile->tx_array, 0, GFP_KERNEL)) { |
1955 | + sk_free(&tfile->sk); |
1956 | + return -ENOMEM; |
1957 | + } |
1958 | + |
1959 | RCU_INIT_POINTER(tfile->tun, NULL); |
1960 | tfile->flags = 0; |
1961 | tfile->ifindex = 0; |
1962 | @@ -2644,8 +2639,6 @@ static int tun_chr_open(struct inode *inode, struct file * file) |
1963 | |
1964 | sock_set_flag(&tfile->sk, SOCK_ZEROCOPY); |
1965 | |
1966 | - memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); |
1967 | - |
1968 | return 0; |
1969 | } |
1970 | |
1971 | diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c |
1972 | index 52ebed1f55a1..6fa9c223ff93 100644 |
1973 | --- a/drivers/net/wireless/ath/ath10k/mac.c |
1974 | +++ b/drivers/net/wireless/ath/ath10k/mac.c |
1975 | @@ -3074,6 +3074,13 @@ static int ath10k_update_channel_list(struct ath10k *ar) |
1976 | passive = channel->flags & IEEE80211_CHAN_NO_IR; |
1977 | ch->passive = passive; |
1978 | |
1979 | + /* the firmware is ignoring the "radar" flag of the |
1980 | + * channel and is scanning actively using Probe Requests |
1981 | + * on "Radar detection"/DFS channels which are not |
1982 | + * marked as "available" |
1983 | + */ |
1984 | + ch->passive |= ch->chan_radar; |
1985 | + |
1986 | ch->freq = channel->center_freq; |
1987 | ch->band_center_freq1 = channel->center_freq; |
1988 | ch->min_power = 0; |
1989 | diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c |
1990 | index 7616c1c4bbd3..baec856af90f 100644 |
1991 | --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c |
1992 | +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c |
1993 | @@ -1451,6 +1451,11 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) |
1994 | cfg->keep_alive_pattern_size = __cpu_to_le32(0); |
1995 | cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1); |
1996 | cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1); |
1997 | + cfg->wmi_send_separate = __cpu_to_le32(0); |
1998 | + cfg->num_ocb_vdevs = __cpu_to_le32(0); |
1999 | + cfg->num_ocb_channels = __cpu_to_le32(0); |
2000 | + cfg->num_ocb_schedules = __cpu_to_le32(0); |
2001 | + cfg->host_capab = __cpu_to_le32(0); |
2002 | |
2003 | ath10k_wmi_put_host_mem_chunks(ar, chunks); |
2004 | |
2005 | diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h |
2006 | index 22cf011e839a..e75bba0bbf67 100644 |
2007 | --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h |
2008 | +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h |
2009 | @@ -1228,6 +1228,11 @@ struct wmi_tlv_resource_config { |
2010 | __le32 keep_alive_pattern_size; |
2011 | __le32 max_tdls_concurrent_sleep_sta; |
2012 | __le32 max_tdls_concurrent_buffer_sta; |
2013 | + __le32 wmi_send_separate; |
2014 | + __le32 num_ocb_vdevs; |
2015 | + __le32 num_ocb_channels; |
2016 | + __le32 num_ocb_schedules; |
2017 | + __le32 host_capab; |
2018 | } __packed; |
2019 | |
2020 | struct wmi_tlv_init_cmd { |
2021 | diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c |
2022 | index 8c5c2dd8fa7f..a7f506eb7b36 100644 |
2023 | --- a/drivers/net/wireless/ath/ath9k/hw.c |
2024 | +++ b/drivers/net/wireless/ath/ath9k/hw.c |
2025 | @@ -2915,16 +2915,19 @@ void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan, |
2026 | struct ath_regulatory *reg = ath9k_hw_regulatory(ah); |
2027 | struct ieee80211_channel *channel; |
2028 | int chan_pwr, new_pwr; |
2029 | + u16 ctl = NO_CTL; |
2030 | |
2031 | if (!chan) |
2032 | return; |
2033 | |
2034 | + if (!test) |
2035 | + ctl = ath9k_regd_get_ctl(reg, chan); |
2036 | + |
2037 | channel = chan->chan; |
2038 | chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER); |
2039 | new_pwr = min_t(int, chan_pwr, reg->power_limit); |
2040 | |
2041 | - ah->eep_ops->set_txpower(ah, chan, |
2042 | - ath9k_regd_get_ctl(reg, chan), |
2043 | + ah->eep_ops->set_txpower(ah, chan, ctl, |
2044 | get_antenna_gain(ah, chan), new_pwr, test); |
2045 | } |
2046 | |
2047 | diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c |
2048 | index d8b041f48ca8..fa64c1cc94ae 100644 |
2049 | --- a/drivers/net/wireless/ath/ath9k/xmit.c |
2050 | +++ b/drivers/net/wireless/ath/ath9k/xmit.c |
2051 | @@ -86,7 +86,8 @@ static void ath_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb) |
2052 | struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); |
2053 | struct ieee80211_sta *sta = info->status.status_driver_data[0]; |
2054 | |
2055 | - if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) { |
2056 | + if (info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS | |
2057 | + IEEE80211_TX_STATUS_EOSP)) { |
2058 | ieee80211_tx_status(hw, skb); |
2059 | return; |
2060 | } |
2061 | diff --git a/drivers/net/wireless/ti/wlcore/rx.c b/drivers/net/wireless/ti/wlcore/rx.c |
2062 | index 0f15696195f8..078a4940bc5c 100644 |
2063 | --- a/drivers/net/wireless/ti/wlcore/rx.c |
2064 | +++ b/drivers/net/wireless/ti/wlcore/rx.c |
2065 | @@ -59,7 +59,7 @@ static u32 wlcore_rx_get_align_buf_size(struct wl1271 *wl, u32 pkt_len) |
2066 | static void wl1271_rx_status(struct wl1271 *wl, |
2067 | struct wl1271_rx_descriptor *desc, |
2068 | struct ieee80211_rx_status *status, |
2069 | - u8 beacon) |
2070 | + u8 beacon, u8 probe_rsp) |
2071 | { |
2072 | memset(status, 0, sizeof(struct ieee80211_rx_status)); |
2073 | |
2074 | @@ -106,6 +106,9 @@ static void wl1271_rx_status(struct wl1271 *wl, |
2075 | } |
2076 | } |
2077 | |
2078 | + if (beacon || probe_rsp) |
2079 | + status->boottime_ns = ktime_get_boot_ns(); |
2080 | + |
2081 | if (beacon) |
2082 | wlcore_set_pending_regdomain_ch(wl, (u16)desc->channel, |
2083 | status->band); |
2084 | @@ -191,7 +194,8 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length, |
2085 | if (ieee80211_is_data_present(hdr->frame_control)) |
2086 | is_data = 1; |
2087 | |
2088 | - wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon); |
2089 | + wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon, |
2090 | + ieee80211_is_probe_resp(hdr->frame_control)); |
2091 | wlcore_hw_set_rx_csum(wl, desc, skb); |
2092 | |
2093 | seq_num = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4; |
2094 | diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c |
2095 | index af81b2dec42e..620f5b995a12 100644 |
2096 | --- a/drivers/pci/switch/switchtec.c |
2097 | +++ b/drivers/pci/switch/switchtec.c |
2098 | @@ -24,6 +24,8 @@ |
2099 | #include <linux/cdev.h> |
2100 | #include <linux/wait.h> |
2101 | |
2102 | +#include <linux/nospec.h> |
2103 | + |
2104 | MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver"); |
2105 | MODULE_VERSION("0.1"); |
2106 | MODULE_LICENSE("GPL"); |
2107 | @@ -1173,6 +1175,8 @@ static int ioctl_port_to_pff(struct switchtec_dev *stdev, |
2108 | default: |
2109 | if (p.port > ARRAY_SIZE(pcfg->dsp_pff_inst_id)) |
2110 | return -EINVAL; |
2111 | + p.port = array_index_nospec(p.port, |
2112 | + ARRAY_SIZE(pcfg->dsp_pff_inst_id) + 1); |
2113 | p.pff = ioread32(&pcfg->dsp_pff_inst_id[p.port - 1]); |
2114 | break; |
2115 | } |
2116 | diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c |
2117 | index 6e472691d8ee..17f2c5a505b2 100644 |
2118 | --- a/drivers/pinctrl/freescale/pinctrl-imx.c |
2119 | +++ b/drivers/pinctrl/freescale/pinctrl-imx.c |
2120 | @@ -389,7 +389,7 @@ static void imx_pinconf_group_dbg_show(struct pinctrl_dev *pctldev, |
2121 | const char *name; |
2122 | int i, ret; |
2123 | |
2124 | - if (group > pctldev->num_groups) |
2125 | + if (group >= pctldev->num_groups) |
2126 | return; |
2127 | |
2128 | seq_printf(s, "\n"); |
2129 | diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c |
2130 | index 433af328d981..b78f42abff2f 100644 |
2131 | --- a/drivers/pinctrl/pinctrl-amd.c |
2132 | +++ b/drivers/pinctrl/pinctrl-amd.c |
2133 | @@ -530,7 +530,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id) |
2134 | /* Each status bit covers four pins */ |
2135 | for (i = 0; i < 4; i++) { |
2136 | regval = readl(regs + i); |
2137 | - if (!(regval & PIN_IRQ_PENDING)) |
2138 | + if (!(regval & PIN_IRQ_PENDING) || |
2139 | + !(regval & BIT(INTERRUPT_MASK_OFF))) |
2140 | continue; |
2141 | irq = irq_find_mapping(gc->irqdomain, irqnr + i); |
2142 | generic_handle_irq(irq); |
2143 | diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c |
2144 | index dffa3aab7178..cec4c3223044 100644 |
2145 | --- a/drivers/rpmsg/rpmsg_core.c |
2146 | +++ b/drivers/rpmsg/rpmsg_core.c |
2147 | @@ -23,6 +23,7 @@ |
2148 | #include <linux/module.h> |
2149 | #include <linux/rpmsg.h> |
2150 | #include <linux/of_device.h> |
2151 | +#include <linux/pm_domain.h> |
2152 | #include <linux/slab.h> |
2153 | |
2154 | #include "rpmsg_internal.h" |
2155 | @@ -418,6 +419,10 @@ static int rpmsg_dev_probe(struct device *dev) |
2156 | struct rpmsg_endpoint *ept = NULL; |
2157 | int err; |
2158 | |
2159 | + err = dev_pm_domain_attach(dev, true); |
2160 | + if (err) |
2161 | + goto out; |
2162 | + |
2163 | if (rpdrv->callback) { |
2164 | strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE); |
2165 | chinfo.src = rpdev->src; |
2166 | @@ -459,6 +464,8 @@ static int rpmsg_dev_remove(struct device *dev) |
2167 | |
2168 | rpdrv->remove(rpdev); |
2169 | |
2170 | + dev_pm_domain_detach(dev, true); |
2171 | + |
2172 | if (rpdev->ept) |
2173 | rpmsg_destroy_ept(rpdev->ept); |
2174 | |
2175 | diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c |
2176 | index a1388842e17e..dd342207095a 100644 |
2177 | --- a/drivers/scsi/3w-9xxx.c |
2178 | +++ b/drivers/scsi/3w-9xxx.c |
2179 | @@ -2042,6 +2042,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) |
2180 | |
2181 | if (twa_initialize_device_extension(tw_dev)) { |
2182 | TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension"); |
2183 | + retval = -ENOMEM; |
2184 | goto out_free_device_extension; |
2185 | } |
2186 | |
2187 | @@ -2064,6 +2065,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) |
2188 | tw_dev->base_addr = ioremap(mem_addr, mem_len); |
2189 | if (!tw_dev->base_addr) { |
2190 | TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap"); |
2191 | + retval = -ENOMEM; |
2192 | goto out_release_mem_region; |
2193 | } |
2194 | |
2195 | @@ -2071,8 +2073,10 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) |
2196 | TW_DISABLE_INTERRUPTS(tw_dev); |
2197 | |
2198 | /* Initialize the card */ |
2199 | - if (twa_reset_sequence(tw_dev, 0)) |
2200 | + if (twa_reset_sequence(tw_dev, 0)) { |
2201 | + retval = -ENOMEM; |
2202 | goto out_iounmap; |
2203 | + } |
2204 | |
2205 | /* Set host specific parameters */ |
2206 | if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) || |
2207 | diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c |
2208 | index b150e131b2e7..aa317d6909e8 100644 |
2209 | --- a/drivers/scsi/3w-sas.c |
2210 | +++ b/drivers/scsi/3w-sas.c |
2211 | @@ -1597,6 +1597,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) |
2212 | |
2213 | if (twl_initialize_device_extension(tw_dev)) { |
2214 | TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension"); |
2215 | + retval = -ENOMEM; |
2216 | goto out_free_device_extension; |
2217 | } |
2218 | |
2219 | @@ -1611,6 +1612,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) |
2220 | tw_dev->base_addr = pci_iomap(pdev, 1, 0); |
2221 | if (!tw_dev->base_addr) { |
2222 | TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap"); |
2223 | + retval = -ENOMEM; |
2224 | goto out_release_mem_region; |
2225 | } |
2226 | |
2227 | @@ -1620,6 +1622,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) |
2228 | /* Initialize the card */ |
2229 | if (twl_reset_sequence(tw_dev, 0)) { |
2230 | TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe"); |
2231 | + retval = -ENOMEM; |
2232 | goto out_iounmap; |
2233 | } |
2234 | |
2235 | diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c |
2236 | index f6179e3d6953..961ea6f7def8 100644 |
2237 | --- a/drivers/scsi/3w-xxxx.c |
2238 | +++ b/drivers/scsi/3w-xxxx.c |
2239 | @@ -2280,6 +2280,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) |
2240 | |
2241 | if (tw_initialize_device_extension(tw_dev)) { |
2242 | printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension."); |
2243 | + retval = -ENOMEM; |
2244 | goto out_free_device_extension; |
2245 | } |
2246 | |
2247 | @@ -2294,6 +2295,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) |
2248 | tw_dev->base_addr = pci_resource_start(pdev, 0); |
2249 | if (!tw_dev->base_addr) { |
2250 | printk(KERN_WARNING "3w-xxxx: Failed to get io address."); |
2251 | + retval = -ENOMEM; |
2252 | goto out_release_mem_region; |
2253 | } |
2254 | |
2255 | diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h |
2256 | index 8eb3f96fe068..bc61cc8bc6f0 100644 |
2257 | --- a/drivers/scsi/lpfc/lpfc.h |
2258 | +++ b/drivers/scsi/lpfc/lpfc.h |
2259 | @@ -676,7 +676,7 @@ struct lpfc_hba { |
2260 | #define LS_NPIV_FAB_SUPPORTED 0x2 /* Fabric supports NPIV */ |
2261 | #define LS_IGNORE_ERATT 0x4 /* intr handler should ignore ERATT */ |
2262 | #define LS_MDS_LINK_DOWN 0x8 /* MDS Diagnostics Link Down */ |
2263 | -#define LS_MDS_LOOPBACK 0x16 /* MDS Diagnostics Link Up (Loopback) */ |
2264 | +#define LS_MDS_LOOPBACK 0x10 /* MDS Diagnostics Link Up (Loopback) */ |
2265 | |
2266 | uint32_t hba_flag; /* hba generic flags */ |
2267 | #define HBA_ERATT_HANDLED 0x1 /* This flag is set when eratt handled */ |
2268 | diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c |
2269 | index e6d51135d105..0d0be7d8b9d6 100644 |
2270 | --- a/drivers/target/target_core_transport.c |
2271 | +++ b/drivers/target/target_core_transport.c |
2272 | @@ -317,6 +317,7 @@ void __transport_register_session( |
2273 | { |
2274 | const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo; |
2275 | unsigned char buf[PR_REG_ISID_LEN]; |
2276 | + unsigned long flags; |
2277 | |
2278 | se_sess->se_tpg = se_tpg; |
2279 | se_sess->fabric_sess_ptr = fabric_sess_ptr; |
2280 | @@ -353,7 +354,7 @@ void __transport_register_session( |
2281 | se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]); |
2282 | } |
2283 | |
2284 | - spin_lock_irq(&se_nacl->nacl_sess_lock); |
2285 | + spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); |
2286 | /* |
2287 | * The se_nacl->nacl_sess pointer will be set to the |
2288 | * last active I_T Nexus for each struct se_node_acl. |
2289 | @@ -362,7 +363,7 @@ void __transport_register_session( |
2290 | |
2291 | list_add_tail(&se_sess->sess_acl_list, |
2292 | &se_nacl->acl_sess_list); |
2293 | - spin_unlock_irq(&se_nacl->nacl_sess_lock); |
2294 | + spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); |
2295 | } |
2296 | list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list); |
2297 | |
2298 | diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c |
2299 | index 20d79a6007d5..070733ca94d5 100644 |
2300 | --- a/drivers/tty/rocket.c |
2301 | +++ b/drivers/tty/rocket.c |
2302 | @@ -1894,7 +1894,7 @@ static __init int register_PCI(int i, struct pci_dev *dev) |
2303 | ByteIO_t UPCIRingInd = 0; |
2304 | |
2305 | if (!dev || !pci_match_id(rocket_pci_ids, dev) || |
2306 | - pci_enable_device(dev)) |
2307 | + pci_enable_device(dev) || i >= NUM_BOARDS) |
2308 | return 0; |
2309 | |
2310 | rcktpt_io_addr[i] = pci_resource_start(dev, 0); |
2311 | diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c |
2312 | index ff04b7f8549f..41784798c789 100644 |
2313 | --- a/drivers/uio/uio.c |
2314 | +++ b/drivers/uio/uio.c |
2315 | @@ -841,8 +841,6 @@ int __uio_register_device(struct module *owner, |
2316 | if (ret) |
2317 | goto err_uio_dev_add_attributes; |
2318 | |
2319 | - info->uio_dev = idev; |
2320 | - |
2321 | if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { |
2322 | /* |
2323 | * Note that we deliberately don't use devm_request_irq |
2324 | @@ -858,6 +856,7 @@ int __uio_register_device(struct module *owner, |
2325 | goto err_request_irq; |
2326 | } |
2327 | |
2328 | + info->uio_dev = idev; |
2329 | return 0; |
2330 | |
2331 | err_request_irq: |
2332 | diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h |
2333 | index 4737615f0eaa..ce696d6c4641 100644 |
2334 | --- a/fs/autofs4/autofs_i.h |
2335 | +++ b/fs/autofs4/autofs_i.h |
2336 | @@ -26,6 +26,7 @@ |
2337 | #include <linux/list.h> |
2338 | #include <linux/completion.h> |
2339 | #include <asm/current.h> |
2340 | +#include <linux/magic.h> |
2341 | |
2342 | /* This is the range of ioctl() numbers we claim as ours */ |
2343 | #define AUTOFS_IOC_FIRST AUTOFS_IOC_READY |
2344 | @@ -124,7 +125,8 @@ struct autofs_sb_info { |
2345 | |
2346 | static inline struct autofs_sb_info *autofs4_sbi(struct super_block *sb) |
2347 | { |
2348 | - return (struct autofs_sb_info *)(sb->s_fs_info); |
2349 | + return sb->s_magic != AUTOFS_SUPER_MAGIC ? |
2350 | + NULL : (struct autofs_sb_info *)(sb->s_fs_info); |
2351 | } |
2352 | |
2353 | static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry) |
2354 | diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c |
2355 | index 09e7d68dff02..3c7e727612fa 100644 |
2356 | --- a/fs/autofs4/inode.c |
2357 | +++ b/fs/autofs4/inode.c |
2358 | @@ -14,7 +14,6 @@ |
2359 | #include <linux/pagemap.h> |
2360 | #include <linux/parser.h> |
2361 | #include <linux/bitops.h> |
2362 | -#include <linux/magic.h> |
2363 | #include "autofs_i.h" |
2364 | #include <linux/module.h> |
2365 | |
2366 | diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c |
2367 | index 7303ba108112..a507c0d25354 100644 |
2368 | --- a/fs/btrfs/ioctl.c |
2369 | +++ b/fs/btrfs/ioctl.c |
2370 | @@ -3158,6 +3158,25 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen, |
2371 | |
2372 | same_lock_start = min_t(u64, loff, dst_loff); |
2373 | same_lock_len = max_t(u64, loff, dst_loff) + len - same_lock_start; |
2374 | + } else { |
2375 | + /* |
2376 | + * If the source and destination inodes are different, the |
2377 | + * source's range end offset matches the source's i_size, that |
2378 | + * i_size is not a multiple of the sector size, and the |
2379 | + * destination range does not go past the destination's i_size, |
2380 | + * we must round down the length to the nearest sector size |
2381 | + * multiple. If we don't do this adjustment we end replacing |
2382 | + * with zeroes the bytes in the range that starts at the |
2383 | + * deduplication range's end offset and ends at the next sector |
2384 | + * size multiple. |
2385 | + */ |
2386 | + if (loff + olen == i_size_read(src) && |
2387 | + dst_loff + len < i_size_read(dst)) { |
2388 | + const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize; |
2389 | + |
2390 | + len = round_down(i_size_read(src), sz) - loff; |
2391 | + olen = len; |
2392 | + } |
2393 | } |
2394 | |
2395 | /* don't make the dst file partly checksummed */ |
2396 | diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c |
2397 | index caf9cf91b825..2cd0b3053439 100644 |
2398 | --- a/fs/cifs/inode.c |
2399 | +++ b/fs/cifs/inode.c |
2400 | @@ -467,6 +467,8 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path, |
2401 | oparms.cifs_sb = cifs_sb; |
2402 | oparms.desired_access = GENERIC_READ; |
2403 | oparms.create_options = CREATE_NOT_DIR; |
2404 | + if (backup_cred(cifs_sb)) |
2405 | + oparms.create_options |= CREATE_OPEN_BACKUP_INTENT; |
2406 | oparms.disposition = FILE_OPEN; |
2407 | oparms.path = path; |
2408 | oparms.fid = &fid; |
2409 | diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c |
2410 | index e9f246fe9d80..759cbbf7b1af 100644 |
2411 | --- a/fs/cifs/smb2ops.c |
2412 | +++ b/fs/cifs/smb2ops.c |
2413 | @@ -385,7 +385,10 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, |
2414 | oparms.tcon = tcon; |
2415 | oparms.desired_access = FILE_READ_ATTRIBUTES; |
2416 | oparms.disposition = FILE_OPEN; |
2417 | - oparms.create_options = 0; |
2418 | + if (backup_cred(cifs_sb)) |
2419 | + oparms.create_options = CREATE_OPEN_BACKUP_INTENT; |
2420 | + else |
2421 | + oparms.create_options = 0; |
2422 | oparms.fid = &fid; |
2423 | oparms.reconnect = false; |
2424 | |
2425 | @@ -534,7 +537,10 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon, |
2426 | oparms.tcon = tcon; |
2427 | oparms.desired_access = FILE_READ_EA; |
2428 | oparms.disposition = FILE_OPEN; |
2429 | - oparms.create_options = 0; |
2430 | + if (backup_cred(cifs_sb)) |
2431 | + oparms.create_options = CREATE_OPEN_BACKUP_INTENT; |
2432 | + else |
2433 | + oparms.create_options = 0; |
2434 | oparms.fid = &fid; |
2435 | oparms.reconnect = false; |
2436 | |
2437 | @@ -613,7 +619,10 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, |
2438 | oparms.tcon = tcon; |
2439 | oparms.desired_access = FILE_WRITE_EA; |
2440 | oparms.disposition = FILE_OPEN; |
2441 | - oparms.create_options = 0; |
2442 | + if (backup_cred(cifs_sb)) |
2443 | + oparms.create_options = CREATE_OPEN_BACKUP_INTENT; |
2444 | + else |
2445 | + oparms.create_options = 0; |
2446 | oparms.fid = &fid; |
2447 | oparms.reconnect = false; |
2448 | |
2449 | @@ -1215,7 +1224,10 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, |
2450 | oparms.tcon = tcon; |
2451 | oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; |
2452 | oparms.disposition = FILE_OPEN; |
2453 | - oparms.create_options = 0; |
2454 | + if (backup_cred(cifs_sb)) |
2455 | + oparms.create_options = CREATE_OPEN_BACKUP_INTENT; |
2456 | + else |
2457 | + oparms.create_options = 0; |
2458 | oparms.fid = fid; |
2459 | oparms.reconnect = false; |
2460 | |
2461 | @@ -1491,7 +1503,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, |
2462 | oparms.tcon = tcon; |
2463 | oparms.desired_access = FILE_READ_ATTRIBUTES; |
2464 | oparms.disposition = FILE_OPEN; |
2465 | - oparms.create_options = 0; |
2466 | + if (backup_cred(cifs_sb)) |
2467 | + oparms.create_options = CREATE_OPEN_BACKUP_INTENT; |
2468 | + else |
2469 | + oparms.create_options = 0; |
2470 | oparms.fid = &fid; |
2471 | oparms.reconnect = false; |
2472 | |
2473 | @@ -3200,7 +3215,7 @@ struct smb_version_values smb21_values = { |
2474 | struct smb_version_values smb3any_values = { |
2475 | .version_string = SMB3ANY_VERSION_STRING, |
2476 | .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */ |
2477 | - .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, |
2478 | + .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, |
2479 | .large_lock_type = 0, |
2480 | .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, |
2481 | .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, |
2482 | @@ -3220,7 +3235,7 @@ struct smb_version_values smb3any_values = { |
2483 | struct smb_version_values smbdefault_values = { |
2484 | .version_string = SMBDEFAULT_VERSION_STRING, |
2485 | .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */ |
2486 | - .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, |
2487 | + .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, |
2488 | .large_lock_type = 0, |
2489 | .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, |
2490 | .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, |
2491 | @@ -3240,7 +3255,7 @@ struct smb_version_values smbdefault_values = { |
2492 | struct smb_version_values smb30_values = { |
2493 | .version_string = SMB30_VERSION_STRING, |
2494 | .protocol_id = SMB30_PROT_ID, |
2495 | - .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, |
2496 | + .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, |
2497 | .large_lock_type = 0, |
2498 | .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, |
2499 | .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, |
2500 | @@ -3260,7 +3275,7 @@ struct smb_version_values smb30_values = { |
2501 | struct smb_version_values smb302_values = { |
2502 | .version_string = SMB302_VERSION_STRING, |
2503 | .protocol_id = SMB302_PROT_ID, |
2504 | - .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, |
2505 | + .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, |
2506 | .large_lock_type = 0, |
2507 | .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, |
2508 | .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, |
2509 | @@ -3281,7 +3296,7 @@ struct smb_version_values smb302_values = { |
2510 | struct smb_version_values smb311_values = { |
2511 | .version_string = SMB311_VERSION_STRING, |
2512 | .protocol_id = SMB311_PROT_ID, |
2513 | - .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, |
2514 | + .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, |
2515 | .large_lock_type = 0, |
2516 | .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, |
2517 | .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, |
2518 | diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c |
2519 | index 58842b36481d..078ec705a5cc 100644 |
2520 | --- a/fs/cifs/smb2pdu.c |
2521 | +++ b/fs/cifs/smb2pdu.c |
2522 | @@ -1816,6 +1816,9 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, |
2523 | if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || |
2524 | *oplock == SMB2_OPLOCK_LEVEL_NONE) |
2525 | req->RequestedOplockLevel = *oplock; |
2526 | + else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && |
2527 | + (oparms->create_options & CREATE_NOT_FILE)) |
2528 | + req->RequestedOplockLevel = *oplock; /* no srv lease support */ |
2529 | else { |
2530 | rc = add_lease_context(server, iov, &n_iov, oplock); |
2531 | if (rc) { |
2532 | diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h |
2533 | index 3b34004a71c1..54f8520ad7a2 100644 |
2534 | --- a/fs/f2fs/f2fs.h |
2535 | +++ b/fs/f2fs/f2fs.h |
2536 | @@ -1766,8 +1766,13 @@ static inline struct page *f2fs_grab_cache_page(struct address_space *mapping, |
2537 | pgoff_t index, bool for_write) |
2538 | { |
2539 | #ifdef CONFIG_F2FS_FAULT_INJECTION |
2540 | - struct page *page = find_lock_page(mapping, index); |
2541 | + struct page *page; |
2542 | |
2543 | + if (!for_write) |
2544 | + page = find_get_page_flags(mapping, index, |
2545 | + FGP_LOCK | FGP_ACCESSED); |
2546 | + else |
2547 | + page = find_lock_page(mapping, index); |
2548 | if (page) |
2549 | return page; |
2550 | |
2551 | diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c |
2552 | index 87e654c53c31..6f589730782d 100644 |
2553 | --- a/fs/f2fs/file.c |
2554 | +++ b/fs/f2fs/file.c |
2555 | @@ -1803,7 +1803,7 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) |
2556 | struct f2fs_sb_info *sbi = F2FS_I_SB(inode); |
2557 | struct super_block *sb = sbi->sb; |
2558 | __u32 in; |
2559 | - int ret; |
2560 | + int ret = 0; |
2561 | |
2562 | if (!capable(CAP_SYS_ADMIN)) |
2563 | return -EPERM; |
2564 | diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c |
2565 | index f2f897cd23c9..f22884418e92 100644 |
2566 | --- a/fs/f2fs/gc.c |
2567 | +++ b/fs/f2fs/gc.c |
2568 | @@ -958,7 +958,13 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, |
2569 | goto next; |
2570 | |
2571 | sum = page_address(sum_page); |
2572 | - f2fs_bug_on(sbi, type != GET_SUM_TYPE((&sum->footer))); |
2573 | + if (type != GET_SUM_TYPE((&sum->footer))) { |
2574 | + f2fs_msg(sbi->sb, KERN_ERR, "Inconsistent segment (%u) " |
2575 | + "type [%d, %d] in SSA and SIT", |
2576 | + segno, type, GET_SUM_TYPE((&sum->footer))); |
2577 | + set_sbi_flag(sbi, SBI_NEED_FSCK); |
2578 | + goto next; |
2579 | + } |
2580 | |
2581 | /* |
2582 | * this is to avoid deadlock: |
2583 | diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c |
2584 | index 8322e4e7bb3f..888a9dc13677 100644 |
2585 | --- a/fs/f2fs/inline.c |
2586 | +++ b/fs/f2fs/inline.c |
2587 | @@ -128,6 +128,16 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page) |
2588 | if (err) |
2589 | return err; |
2590 | |
2591 | + if (unlikely(dn->data_blkaddr != NEW_ADDR)) { |
2592 | + f2fs_put_dnode(dn); |
2593 | + set_sbi_flag(fio.sbi, SBI_NEED_FSCK); |
2594 | + f2fs_msg(fio.sbi->sb, KERN_WARNING, |
2595 | + "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, " |
2596 | + "run fsck to fix.", |
2597 | + __func__, dn->inode->i_ino, dn->data_blkaddr); |
2598 | + return -EINVAL; |
2599 | + } |
2600 | + |
2601 | f2fs_bug_on(F2FS_P_SB(page), PageWriteback(page)); |
2602 | |
2603 | read_inline_data(page, dn->inode_page); |
2604 | @@ -365,6 +375,17 @@ static int f2fs_move_inline_dirents(struct inode *dir, struct page *ipage, |
2605 | if (err) |
2606 | goto out; |
2607 | |
2608 | + if (unlikely(dn.data_blkaddr != NEW_ADDR)) { |
2609 | + f2fs_put_dnode(&dn); |
2610 | + set_sbi_flag(F2FS_P_SB(page), SBI_NEED_FSCK); |
2611 | + f2fs_msg(F2FS_P_SB(page)->sb, KERN_WARNING, |
2612 | + "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, " |
2613 | + "run fsck to fix.", |
2614 | + __func__, dir->i_ino, dn.data_blkaddr); |
2615 | + err = -EINVAL; |
2616 | + goto out; |
2617 | + } |
2618 | + |
2619 | f2fs_wait_on_page_writeback(page, DATA, true); |
2620 | zero_user_segment(page, MAX_INLINE_DATA(dir), PAGE_SIZE); |
2621 | |
2622 | @@ -481,6 +502,7 @@ static int f2fs_move_rehashed_dirents(struct inode *dir, struct page *ipage, |
2623 | return 0; |
2624 | recover: |
2625 | lock_page(ipage); |
2626 | + f2fs_wait_on_page_writeback(ipage, NODE, true); |
2627 | memcpy(inline_dentry, backup_dentry, MAX_INLINE_DATA(dir)); |
2628 | f2fs_i_depth_write(dir, 0); |
2629 | f2fs_i_size_write(dir, MAX_INLINE_DATA(dir)); |
2630 | diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c |
2631 | index f623da26159f..712505ec5de4 100644 |
2632 | --- a/fs/f2fs/node.c |
2633 | +++ b/fs/f2fs/node.c |
2634 | @@ -1610,7 +1610,9 @@ next_step: |
2635 | !is_cold_node(page))) |
2636 | continue; |
2637 | lock_node: |
2638 | - if (!trylock_page(page)) |
2639 | + if (wbc->sync_mode == WB_SYNC_ALL) |
2640 | + lock_page(page); |
2641 | + else if (!trylock_page(page)) |
2642 | continue; |
2643 | |
2644 | if (unlikely(page->mapping != NODE_MAPPING(sbi))) { |
2645 | diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h |
2646 | index 39ada30889b6..4dfb5080098f 100644 |
2647 | --- a/fs/f2fs/segment.h |
2648 | +++ b/fs/f2fs/segment.h |
2649 | @@ -414,6 +414,8 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, |
2650 | if (test_and_clear_bit(segno, free_i->free_segmap)) { |
2651 | free_i->free_segments++; |
2652 | |
2653 | + if (IS_CURSEC(sbi, secno)) |
2654 | + goto skip_free; |
2655 | next = find_next_bit(free_i->free_segmap, |
2656 | start_segno + sbi->segs_per_sec, start_segno); |
2657 | if (next >= start_segno + sbi->segs_per_sec) { |
2658 | @@ -421,6 +423,7 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, |
2659 | free_i->free_sections++; |
2660 | } |
2661 | } |
2662 | +skip_free: |
2663 | spin_unlock(&free_i->segmap_lock); |
2664 | } |
2665 | |
2666 | diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c |
2667 | index 400c00058bad..eae35909fa51 100644 |
2668 | --- a/fs/f2fs/super.c |
2669 | +++ b/fs/f2fs/super.c |
2670 | @@ -1883,12 +1883,17 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi) |
2671 | struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); |
2672 | unsigned int ovp_segments, reserved_segments; |
2673 | unsigned int main_segs, blocks_per_seg; |
2674 | + unsigned int sit_segs, nat_segs; |
2675 | + unsigned int sit_bitmap_size, nat_bitmap_size; |
2676 | + unsigned int log_blocks_per_seg; |
2677 | int i; |
2678 | |
2679 | total = le32_to_cpu(raw_super->segment_count); |
2680 | fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); |
2681 | - fsmeta += le32_to_cpu(raw_super->segment_count_sit); |
2682 | - fsmeta += le32_to_cpu(raw_super->segment_count_nat); |
2683 | + sit_segs = le32_to_cpu(raw_super->segment_count_sit); |
2684 | + fsmeta += sit_segs; |
2685 | + nat_segs = le32_to_cpu(raw_super->segment_count_nat); |
2686 | + fsmeta += nat_segs; |
2687 | fsmeta += le32_to_cpu(ckpt->rsvd_segment_count); |
2688 | fsmeta += le32_to_cpu(raw_super->segment_count_ssa); |
2689 | |
2690 | @@ -1919,6 +1924,18 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi) |
2691 | return 1; |
2692 | } |
2693 | |
2694 | + sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize); |
2695 | + nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize); |
2696 | + log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); |
2697 | + |
2698 | + if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 || |
2699 | + nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) { |
2700 | + f2fs_msg(sbi->sb, KERN_ERR, |
2701 | + "Wrong bitmap size: sit: %u, nat:%u", |
2702 | + sit_bitmap_size, nat_bitmap_size); |
2703 | + return 1; |
2704 | + } |
2705 | + |
2706 | if (unlikely(f2fs_cp_error(sbi))) { |
2707 | f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); |
2708 | return 1; |
2709 | diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c |
2710 | index e2c258f717cd..93af9d7dfcdc 100644 |
2711 | --- a/fs/f2fs/sysfs.c |
2712 | +++ b/fs/f2fs/sysfs.c |
2713 | @@ -9,6 +9,7 @@ |
2714 | * it under the terms of the GNU General Public License version 2 as |
2715 | * published by the Free Software Foundation. |
2716 | */ |
2717 | +#include <linux/compiler.h> |
2718 | #include <linux/proc_fs.h> |
2719 | #include <linux/f2fs_fs.h> |
2720 | #include <linux/seq_file.h> |
2721 | @@ -381,7 +382,8 @@ static struct kobject f2fs_feat = { |
2722 | .kset = &f2fs_kset, |
2723 | }; |
2724 | |
2725 | -static int segment_info_seq_show(struct seq_file *seq, void *offset) |
2726 | +static int __maybe_unused segment_info_seq_show(struct seq_file *seq, |
2727 | + void *offset) |
2728 | { |
2729 | struct super_block *sb = seq->private; |
2730 | struct f2fs_sb_info *sbi = F2FS_SB(sb); |
2731 | @@ -408,7 +410,8 @@ static int segment_info_seq_show(struct seq_file *seq, void *offset) |
2732 | return 0; |
2733 | } |
2734 | |
2735 | -static int segment_bits_seq_show(struct seq_file *seq, void *offset) |
2736 | +static int __maybe_unused segment_bits_seq_show(struct seq_file *seq, |
2737 | + void *offset) |
2738 | { |
2739 | struct super_block *sb = seq->private; |
2740 | struct f2fs_sb_info *sbi = F2FS_SB(sb); |
2741 | @@ -432,7 +435,8 @@ static int segment_bits_seq_show(struct seq_file *seq, void *offset) |
2742 | return 0; |
2743 | } |
2744 | |
2745 | -static int iostat_info_seq_show(struct seq_file *seq, void *offset) |
2746 | +static int __maybe_unused iostat_info_seq_show(struct seq_file *seq, |
2747 | + void *offset) |
2748 | { |
2749 | struct super_block *sb = seq->private; |
2750 | struct f2fs_sb_info *sbi = F2FS_SB(sb); |
2751 | diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c |
2752 | index 2c3f398995f6..b8d55da2f04d 100644 |
2753 | --- a/fs/nfs/callback_proc.c |
2754 | +++ b/fs/nfs/callback_proc.c |
2755 | @@ -213,9 +213,9 @@ static u32 pnfs_check_callback_stateid(struct pnfs_layout_hdr *lo, |
2756 | { |
2757 | u32 oldseq, newseq; |
2758 | |
2759 | - /* Is the stateid still not initialised? */ |
2760 | + /* Is the stateid not initialised? */ |
2761 | if (!pnfs_layout_is_valid(lo)) |
2762 | - return NFS4ERR_DELAY; |
2763 | + return NFS4ERR_NOMATCHING_LAYOUT; |
2764 | |
2765 | /* Mismatched stateid? */ |
2766 | if (!nfs4_stateid_match_other(&lo->plh_stateid, new)) |
2767 | diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c |
2768 | index 123c069429a7..57de914630bc 100644 |
2769 | --- a/fs/nfs/callback_xdr.c |
2770 | +++ b/fs/nfs/callback_xdr.c |
2771 | @@ -904,16 +904,21 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp) |
2772 | |
2773 | if (hdr_arg.minorversion == 0) { |
2774 | cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); |
2775 | - if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) |
2776 | + if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { |
2777 | + if (cps.clp) |
2778 | + nfs_put_client(cps.clp); |
2779 | goto out_invalidcred; |
2780 | + } |
2781 | } |
2782 | |
2783 | cps.minorversion = hdr_arg.minorversion; |
2784 | hdr_res.taglen = hdr_arg.taglen; |
2785 | hdr_res.tag = hdr_arg.tag; |
2786 | - if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) |
2787 | + if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { |
2788 | + if (cps.clp) |
2789 | + nfs_put_client(cps.clp); |
2790 | return rpc_system_err; |
2791 | - |
2792 | + } |
2793 | while (status == 0 && nops != hdr_arg.nops) { |
2794 | status = process_op(nops, rqstp, &xdr_in, |
2795 | rqstp->rq_argp, &xdr_out, rqstp->rq_resp, |
2796 | diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h |
2797 | index 9f0bb908e2b5..e41ef532c4ce 100644 |
2798 | --- a/include/linux/mm_types.h |
2799 | +++ b/include/linux/mm_types.h |
2800 | @@ -354,7 +354,7 @@ struct kioctx_table; |
2801 | struct mm_struct { |
2802 | struct vm_area_struct *mmap; /* list of VMAs */ |
2803 | struct rb_root mm_rb; |
2804 | - u32 vmacache_seqnum; /* per-thread vmacache */ |
2805 | + u64 vmacache_seqnum; /* per-thread vmacache */ |
2806 | #ifdef CONFIG_MMU |
2807 | unsigned long (*get_unmapped_area) (struct file *filp, |
2808 | unsigned long addr, unsigned long len, |
2809 | diff --git a/include/linux/mm_types_task.h b/include/linux/mm_types_task.h |
2810 | index 5fe87687664c..d7016dcb245e 100644 |
2811 | --- a/include/linux/mm_types_task.h |
2812 | +++ b/include/linux/mm_types_task.h |
2813 | @@ -32,7 +32,7 @@ |
2814 | #define VMACACHE_MASK (VMACACHE_SIZE - 1) |
2815 | |
2816 | struct vmacache { |
2817 | - u32 seqnum; |
2818 | + u64 seqnum; |
2819 | struct vm_area_struct *vmas[VMACACHE_SIZE]; |
2820 | }; |
2821 | |
2822 | diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h |
2823 | index 7fd514f36e74..a4be6388a980 100644 |
2824 | --- a/include/linux/rhashtable.h |
2825 | +++ b/include/linux/rhashtable.h |
2826 | @@ -152,25 +152,25 @@ struct rhashtable_params { |
2827 | /** |
2828 | * struct rhashtable - Hash table handle |
2829 | * @tbl: Bucket table |
2830 | - * @nelems: Number of elements in table |
2831 | * @key_len: Key length for hashfn |
2832 | - * @p: Configuration parameters |
2833 | * @max_elems: Maximum number of elements in table |
2834 | + * @p: Configuration parameters |
2835 | * @rhlist: True if this is an rhltable |
2836 | * @run_work: Deferred worker to expand/shrink asynchronously |
2837 | * @mutex: Mutex to protect current/future table swapping |
2838 | * @lock: Spin lock to protect walker list |
2839 | + * @nelems: Number of elements in table |
2840 | */ |
2841 | struct rhashtable { |
2842 | struct bucket_table __rcu *tbl; |
2843 | - atomic_t nelems; |
2844 | unsigned int key_len; |
2845 | - struct rhashtable_params p; |
2846 | unsigned int max_elems; |
2847 | + struct rhashtable_params p; |
2848 | bool rhlist; |
2849 | struct work_struct run_work; |
2850 | struct mutex mutex; |
2851 | spinlock_t lock; |
2852 | + atomic_t nelems; |
2853 | }; |
2854 | |
2855 | /** |
2856 | diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h |
2857 | index 6dd77767fd5b..f64e88444082 100644 |
2858 | --- a/include/linux/skbuff.h |
2859 | +++ b/include/linux/skbuff.h |
2860 | @@ -663,21 +663,26 @@ struct sk_buff { |
2861 | struct sk_buff *prev; |
2862 | |
2863 | union { |
2864 | - ktime_t tstamp; |
2865 | - u64 skb_mstamp; |
2866 | + struct net_device *dev; |
2867 | + /* Some protocols might use this space to store information, |
2868 | + * while device pointer would be NULL. |
2869 | + * UDP receive path is one user. |
2870 | + */ |
2871 | + unsigned long dev_scratch; |
2872 | }; |
2873 | }; |
2874 | - struct rb_node rbnode; /* used in netem & tcp stack */ |
2875 | + struct rb_node rbnode; /* used in netem, ip4 defrag, and tcp stack */ |
2876 | + struct list_head list; |
2877 | }; |
2878 | - struct sock *sk; |
2879 | |
2880 | union { |
2881 | - struct net_device *dev; |
2882 | - /* Some protocols might use this space to store information, |
2883 | - * while device pointer would be NULL. |
2884 | - * UDP receive path is one user. |
2885 | - */ |
2886 | - unsigned long dev_scratch; |
2887 | + struct sock *sk; |
2888 | + int ip_defrag_offset; |
2889 | + }; |
2890 | + |
2891 | + union { |
2892 | + ktime_t tstamp; |
2893 | + u64 skb_mstamp; |
2894 | }; |
2895 | /* |
2896 | * This is the control buffer. It is free to use for every |
2897 | @@ -2580,7 +2585,7 @@ static inline void __skb_queue_purge(struct sk_buff_head *list) |
2898 | kfree_skb(skb); |
2899 | } |
2900 | |
2901 | -void skb_rbtree_purge(struct rb_root *root); |
2902 | +unsigned int skb_rbtree_purge(struct rb_root *root); |
2903 | |
2904 | void *netdev_alloc_frag(unsigned int fragsz); |
2905 | |
2906 | @@ -3134,6 +3139,7 @@ static inline void *skb_push_rcsum(struct sk_buff *skb, unsigned int len) |
2907 | return skb->data; |
2908 | } |
2909 | |
2910 | +int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len); |
2911 | /** |
2912 | * pskb_trim_rcsum - trim received skb and update checksum |
2913 | * @skb: buffer to trim |
2914 | @@ -3147,9 +3153,7 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) |
2915 | { |
2916 | if (likely(len >= skb->len)) |
2917 | return 0; |
2918 | - if (skb->ip_summed == CHECKSUM_COMPLETE) |
2919 | - skb->ip_summed = CHECKSUM_NONE; |
2920 | - return __pskb_trim(skb, len); |
2921 | + return pskb_trim_rcsum_slow(skb, len); |
2922 | } |
2923 | |
2924 | static inline int __skb_trim_rcsum(struct sk_buff *skb, unsigned int len) |
2925 | @@ -3169,6 +3173,12 @@ static inline int __skb_grow_rcsum(struct sk_buff *skb, unsigned int len) |
2926 | |
2927 | #define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) |
2928 | |
2929 | +#define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) |
2930 | +#define skb_rb_first(root) rb_to_skb(rb_first(root)) |
2931 | +#define skb_rb_last(root) rb_to_skb(rb_last(root)) |
2932 | +#define skb_rb_next(skb) rb_to_skb(rb_next(&(skb)->rbnode)) |
2933 | +#define skb_rb_prev(skb) rb_to_skb(rb_prev(&(skb)->rbnode)) |
2934 | + |
2935 | #define skb_queue_walk(queue, skb) \ |
2936 | for (skb = (queue)->next; \ |
2937 | skb != (struct sk_buff *)(queue); \ |
2938 | @@ -3183,6 +3193,18 @@ static inline int __skb_grow_rcsum(struct sk_buff *skb, unsigned int len) |
2939 | for (; skb != (struct sk_buff *)(queue); \ |
2940 | skb = skb->next) |
2941 | |
2942 | +#define skb_rbtree_walk(skb, root) \ |
2943 | + for (skb = skb_rb_first(root); skb != NULL; \ |
2944 | + skb = skb_rb_next(skb)) |
2945 | + |
2946 | +#define skb_rbtree_walk_from(skb) \ |
2947 | + for (; skb != NULL; \ |
2948 | + skb = skb_rb_next(skb)) |
2949 | + |
2950 | +#define skb_rbtree_walk_from_safe(skb, tmp) \ |
2951 | + for (; tmp = skb ? skb_rb_next(skb) : NULL, (skb != NULL); \ |
2952 | + skb = tmp) |
2953 | + |
2954 | #define skb_queue_walk_from_safe(queue, skb, tmp) \ |
2955 | for (tmp = skb->next; \ |
2956 | skb != (struct sk_buff *)(queue); \ |
2957 | diff --git a/include/linux/tpm.h b/include/linux/tpm.h |
2958 | index 2a6c3d96b31f..7f7b29f86c59 100644 |
2959 | --- a/include/linux/tpm.h |
2960 | +++ b/include/linux/tpm.h |
2961 | @@ -48,6 +48,8 @@ struct tpm_class_ops { |
2962 | u8 (*status) (struct tpm_chip *chip); |
2963 | bool (*update_timeouts)(struct tpm_chip *chip, |
2964 | unsigned long *timeout_cap); |
2965 | + int (*go_idle)(struct tpm_chip *chip); |
2966 | + int (*cmd_ready)(struct tpm_chip *chip); |
2967 | int (*request_locality)(struct tpm_chip *chip, int loc); |
2968 | int (*relinquish_locality)(struct tpm_chip *chip, int loc); |
2969 | void (*clk_enable)(struct tpm_chip *chip, bool value); |
2970 | diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h |
2971 | index 5c7f010676a7..47a3441cf4c4 100644 |
2972 | --- a/include/linux/vm_event_item.h |
2973 | +++ b/include/linux/vm_event_item.h |
2974 | @@ -105,7 +105,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, |
2975 | #ifdef CONFIG_DEBUG_VM_VMACACHE |
2976 | VMACACHE_FIND_CALLS, |
2977 | VMACACHE_FIND_HITS, |
2978 | - VMACACHE_FULL_FLUSHES, |
2979 | #endif |
2980 | #ifdef CONFIG_SWAP |
2981 | SWAP_RA, |
2982 | diff --git a/include/linux/vmacache.h b/include/linux/vmacache.h |
2983 | index a5b3aa8d281f..a09b28f76460 100644 |
2984 | --- a/include/linux/vmacache.h |
2985 | +++ b/include/linux/vmacache.h |
2986 | @@ -16,7 +16,6 @@ static inline void vmacache_flush(struct task_struct *tsk) |
2987 | memset(tsk->vmacache.vmas, 0, sizeof(tsk->vmacache.vmas)); |
2988 | } |
2989 | |
2990 | -extern void vmacache_flush_all(struct mm_struct *mm); |
2991 | extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma); |
2992 | extern struct vm_area_struct *vmacache_find(struct mm_struct *mm, |
2993 | unsigned long addr); |
2994 | @@ -30,10 +29,6 @@ extern struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm, |
2995 | static inline void vmacache_invalidate(struct mm_struct *mm) |
2996 | { |
2997 | mm->vmacache_seqnum++; |
2998 | - |
2999 | - /* deal with overflows */ |
3000 | - if (unlikely(mm->vmacache_seqnum == 0)) |
3001 | - vmacache_flush_all(mm); |
3002 | } |
3003 | |
3004 | #endif /* __LINUX_VMACACHE_H */ |
3005 | diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h |
3006 | index a6e4edd8d4a2..335cf7851f12 100644 |
3007 | --- a/include/net/inet_frag.h |
3008 | +++ b/include/net/inet_frag.h |
3009 | @@ -2,14 +2,20 @@ |
3010 | #ifndef __NET_FRAG_H__ |
3011 | #define __NET_FRAG_H__ |
3012 | |
3013 | +#include <linux/rhashtable.h> |
3014 | + |
3015 | struct netns_frags { |
3016 | - /* Keep atomic mem on separate cachelines in structs that include it */ |
3017 | - atomic_t mem ____cacheline_aligned_in_smp; |
3018 | /* sysctls */ |
3019 | + long high_thresh; |
3020 | + long low_thresh; |
3021 | int timeout; |
3022 | - int high_thresh; |
3023 | - int low_thresh; |
3024 | int max_dist; |
3025 | + struct inet_frags *f; |
3026 | + |
3027 | + struct rhashtable rhashtable ____cacheline_aligned_in_smp; |
3028 | + |
3029 | + /* Keep atomic mem on separate cachelines in structs that include it */ |
3030 | + atomic_long_t mem ____cacheline_aligned_in_smp; |
3031 | }; |
3032 | |
3033 | /** |
3034 | @@ -25,130 +31,115 @@ enum { |
3035 | INET_FRAG_COMPLETE = BIT(2), |
3036 | }; |
3037 | |
3038 | +struct frag_v4_compare_key { |
3039 | + __be32 saddr; |
3040 | + __be32 daddr; |
3041 | + u32 user; |
3042 | + u32 vif; |
3043 | + __be16 id; |
3044 | + u16 protocol; |
3045 | +}; |
3046 | + |
3047 | +struct frag_v6_compare_key { |
3048 | + struct in6_addr saddr; |
3049 | + struct in6_addr daddr; |
3050 | + u32 user; |
3051 | + __be32 id; |
3052 | + u32 iif; |
3053 | +}; |
3054 | + |
3055 | /** |
3056 | * struct inet_frag_queue - fragment queue |
3057 | * |
3058 | - * @lock: spinlock protecting the queue |
3059 | + * @node: rhash node |
3060 | + * @key: keys identifying this frag. |
3061 | * @timer: queue expiration timer |
3062 | - * @list: hash bucket list |
3063 | + * @lock: spinlock protecting this frag |
3064 | * @refcnt: reference count of the queue |
3065 | * @fragments: received fragments head |
3066 | + * @rb_fragments: received fragments rb-tree root |
3067 | * @fragments_tail: received fragments tail |
3068 | + * @last_run_head: the head of the last "run". see ip_fragment.c |
3069 | * @stamp: timestamp of the last received fragment |
3070 | * @len: total length of the original datagram |
3071 | * @meat: length of received fragments so far |
3072 | * @flags: fragment queue flags |
3073 | * @max_size: maximum received fragment size |
3074 | * @net: namespace that this frag belongs to |
3075 | - * @list_evictor: list of queues to forcefully evict (e.g. due to low memory) |
3076 | + * @rcu: rcu head for freeing deferall |
3077 | */ |
3078 | struct inet_frag_queue { |
3079 | - spinlock_t lock; |
3080 | + struct rhash_head node; |
3081 | + union { |
3082 | + struct frag_v4_compare_key v4; |
3083 | + struct frag_v6_compare_key v6; |
3084 | + } key; |
3085 | struct timer_list timer; |
3086 | - struct hlist_node list; |
3087 | + spinlock_t lock; |
3088 | refcount_t refcnt; |
3089 | - struct sk_buff *fragments; |
3090 | + struct sk_buff *fragments; /* Used in IPv6. */ |
3091 | + struct rb_root rb_fragments; /* Used in IPv4. */ |
3092 | struct sk_buff *fragments_tail; |
3093 | + struct sk_buff *last_run_head; |
3094 | ktime_t stamp; |
3095 | int len; |
3096 | int meat; |
3097 | __u8 flags; |
3098 | u16 max_size; |
3099 | - struct netns_frags *net; |
3100 | - struct hlist_node list_evictor; |
3101 | -}; |
3102 | - |
3103 | -#define INETFRAGS_HASHSZ 1024 |
3104 | - |
3105 | -/* averaged: |
3106 | - * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ / |
3107 | - * rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or |
3108 | - * struct frag_queue)) |
3109 | - */ |
3110 | -#define INETFRAGS_MAXDEPTH 128 |
3111 | - |
3112 | -struct inet_frag_bucket { |
3113 | - struct hlist_head chain; |
3114 | - spinlock_t chain_lock; |
3115 | + struct netns_frags *net; |
3116 | + struct rcu_head rcu; |
3117 | }; |
3118 | |
3119 | struct inet_frags { |
3120 | - struct inet_frag_bucket hash[INETFRAGS_HASHSZ]; |
3121 | - |
3122 | - struct work_struct frags_work; |
3123 | - unsigned int next_bucket; |
3124 | - unsigned long last_rebuild_jiffies; |
3125 | - bool rebuild; |
3126 | - |
3127 | - /* The first call to hashfn is responsible to initialize |
3128 | - * rnd. This is best done with net_get_random_once. |
3129 | - * |
3130 | - * rnd_seqlock is used to let hash insertion detect |
3131 | - * when it needs to re-lookup the hash chain to use. |
3132 | - */ |
3133 | - u32 rnd; |
3134 | - seqlock_t rnd_seqlock; |
3135 | unsigned int qsize; |
3136 | |
3137 | - unsigned int (*hashfn)(const struct inet_frag_queue *); |
3138 | - bool (*match)(const struct inet_frag_queue *q, |
3139 | - const void *arg); |
3140 | void (*constructor)(struct inet_frag_queue *q, |
3141 | const void *arg); |
3142 | void (*destructor)(struct inet_frag_queue *); |
3143 | - void (*frag_expire)(unsigned long data); |
3144 | + void (*frag_expire)(struct timer_list *t); |
3145 | struct kmem_cache *frags_cachep; |
3146 | const char *frags_cache_name; |
3147 | + struct rhashtable_params rhash_params; |
3148 | }; |
3149 | |
3150 | int inet_frags_init(struct inet_frags *); |
3151 | void inet_frags_fini(struct inet_frags *); |
3152 | |
3153 | -static inline void inet_frags_init_net(struct netns_frags *nf) |
3154 | +static inline int inet_frags_init_net(struct netns_frags *nf) |
3155 | { |
3156 | - atomic_set(&nf->mem, 0); |
3157 | + atomic_long_set(&nf->mem, 0); |
3158 | + return rhashtable_init(&nf->rhashtable, &nf->f->rhash_params); |
3159 | } |
3160 | -void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f); |
3161 | +void inet_frags_exit_net(struct netns_frags *nf); |
3162 | |
3163 | -void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); |
3164 | -void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f); |
3165 | -struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, |
3166 | - struct inet_frags *f, void *key, unsigned int hash); |
3167 | +void inet_frag_kill(struct inet_frag_queue *q); |
3168 | +void inet_frag_destroy(struct inet_frag_queue *q); |
3169 | +struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key); |
3170 | |
3171 | -void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, |
3172 | - const char *prefix); |
3173 | +/* Free all skbs in the queue; return the sum of their truesizes. */ |
3174 | +unsigned int inet_frag_rbtree_purge(struct rb_root *root); |
3175 | |
3176 | -static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f) |
3177 | +static inline void inet_frag_put(struct inet_frag_queue *q) |
3178 | { |
3179 | if (refcount_dec_and_test(&q->refcnt)) |
3180 | - inet_frag_destroy(q, f); |
3181 | -} |
3182 | - |
3183 | -static inline bool inet_frag_evicting(struct inet_frag_queue *q) |
3184 | -{ |
3185 | - return !hlist_unhashed(&q->list_evictor); |
3186 | + inet_frag_destroy(q); |
3187 | } |
3188 | |
3189 | /* Memory Tracking Functions. */ |
3190 | |
3191 | -static inline int frag_mem_limit(struct netns_frags *nf) |
3192 | -{ |
3193 | - return atomic_read(&nf->mem); |
3194 | -} |
3195 | - |
3196 | -static inline void sub_frag_mem_limit(struct netns_frags *nf, int i) |
3197 | +static inline long frag_mem_limit(const struct netns_frags *nf) |
3198 | { |
3199 | - atomic_sub(i, &nf->mem); |
3200 | + return atomic_long_read(&nf->mem); |
3201 | } |
3202 | |
3203 | -static inline void add_frag_mem_limit(struct netns_frags *nf, int i) |
3204 | +static inline void sub_frag_mem_limit(struct netns_frags *nf, long val) |
3205 | { |
3206 | - atomic_add(i, &nf->mem); |
3207 | + atomic_long_sub(val, &nf->mem); |
3208 | } |
3209 | |
3210 | -static inline int sum_frag_mem_limit(struct netns_frags *nf) |
3211 | +static inline void add_frag_mem_limit(struct netns_frags *nf, long val) |
3212 | { |
3213 | - return atomic_read(&nf->mem); |
3214 | + atomic_long_add(val, &nf->mem); |
3215 | } |
3216 | |
3217 | /* RFC 3168 support : |
3218 | diff --git a/include/net/ip.h b/include/net/ip.h |
3219 | index 81da1123fc8e..7c430343176a 100644 |
3220 | --- a/include/net/ip.h |
3221 | +++ b/include/net/ip.h |
3222 | @@ -570,7 +570,6 @@ static inline struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *s |
3223 | return skb; |
3224 | } |
3225 | #endif |
3226 | -int ip_frag_mem(struct net *net); |
3227 | |
3228 | /* |
3229 | * Functions provided by ip_forward.c |
3230 | diff --git a/include/net/ipv6.h b/include/net/ipv6.h |
3231 | index f280c61e019a..fa87a62e9bd3 100644 |
3232 | --- a/include/net/ipv6.h |
3233 | +++ b/include/net/ipv6.h |
3234 | @@ -331,13 +331,6 @@ static inline bool ipv6_accept_ra(struct inet6_dev *idev) |
3235 | idev->cnf.accept_ra; |
3236 | } |
3237 | |
3238 | -#if IS_ENABLED(CONFIG_IPV6) |
3239 | -static inline int ip6_frag_mem(struct net *net) |
3240 | -{ |
3241 | - return sum_frag_mem_limit(&net->ipv6.frags); |
3242 | -} |
3243 | -#endif |
3244 | - |
3245 | #define IPV6_FRAG_HIGH_THRESH (4 * 1024*1024) /* 4194304 */ |
3246 | #define IPV6_FRAG_LOW_THRESH (3 * 1024*1024) /* 3145728 */ |
3247 | #define IPV6_FRAG_TIMEOUT (60 * HZ) /* 60 seconds */ |
3248 | @@ -531,17 +524,8 @@ enum ip6_defrag_users { |
3249 | __IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX, |
3250 | }; |
3251 | |
3252 | -struct ip6_create_arg { |
3253 | - __be32 id; |
3254 | - u32 user; |
3255 | - const struct in6_addr *src; |
3256 | - const struct in6_addr *dst; |
3257 | - int iif; |
3258 | - u8 ecn; |
3259 | -}; |
3260 | - |
3261 | void ip6_frag_init(struct inet_frag_queue *q, const void *a); |
3262 | -bool ip6_frag_match(const struct inet_frag_queue *q, const void *a); |
3263 | +extern const struct rhashtable_params ip6_rhash_params; |
3264 | |
3265 | /* |
3266 | * Equivalent of ipv4 struct ip |
3267 | @@ -549,19 +533,13 @@ bool ip6_frag_match(const struct inet_frag_queue *q, const void *a); |
3268 | struct frag_queue { |
3269 | struct inet_frag_queue q; |
3270 | |
3271 | - __be32 id; /* fragment id */ |
3272 | - u32 user; |
3273 | - struct in6_addr saddr; |
3274 | - struct in6_addr daddr; |
3275 | - |
3276 | int iif; |
3277 | unsigned int csum; |
3278 | __u16 nhoffset; |
3279 | u8 ecn; |
3280 | }; |
3281 | |
3282 | -void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq, |
3283 | - struct inet_frags *frags); |
3284 | +void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq); |
3285 | |
3286 | static inline bool ipv6_addr_any(const struct in6_addr *a) |
3287 | { |
3288 | diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h |
3289 | index ac71559314e7..9eae13eefc49 100644 |
3290 | --- a/include/uapi/linux/ethtool.h |
3291 | +++ b/include/uapi/linux/ethtool.h |
3292 | @@ -898,13 +898,13 @@ struct ethtool_rx_flow_spec { |
3293 | static inline __u64 ethtool_get_flow_spec_ring(__u64 ring_cookie) |
3294 | { |
3295 | return ETHTOOL_RX_FLOW_SPEC_RING & ring_cookie; |
3296 | -}; |
3297 | +} |
3298 | |
3299 | static inline __u64 ethtool_get_flow_spec_ring_vf(__u64 ring_cookie) |
3300 | { |
3301 | return (ETHTOOL_RX_FLOW_SPEC_RING_VF & ring_cookie) >> |
3302 | ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF; |
3303 | -}; |
3304 | +} |
3305 | |
3306 | /** |
3307 | * struct ethtool_rxnfc - command to get or set RX flow classification rules |
3308 | diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h |
3309 | index 0d941cdd8e8c..f5d753e60836 100644 |
3310 | --- a/include/uapi/linux/snmp.h |
3311 | +++ b/include/uapi/linux/snmp.h |
3312 | @@ -56,6 +56,7 @@ enum |
3313 | IPSTATS_MIB_ECT1PKTS, /* InECT1Pkts */ |
3314 | IPSTATS_MIB_ECT0PKTS, /* InECT0Pkts */ |
3315 | IPSTATS_MIB_CEPKTS, /* InCEPkts */ |
3316 | + IPSTATS_MIB_REASM_OVERLAPS, /* ReasmOverlaps */ |
3317 | __IPSTATS_MIB_MAX |
3318 | }; |
3319 | |
3320 | diff --git a/kernel/cpu.c b/kernel/cpu.c |
3321 | index 8f02f9b6e046..f3f389e33343 100644 |
3322 | --- a/kernel/cpu.c |
3323 | +++ b/kernel/cpu.c |
3324 | @@ -612,15 +612,15 @@ static void cpuhp_thread_fun(unsigned int cpu) |
3325 | bool bringup = st->bringup; |
3326 | enum cpuhp_state state; |
3327 | |
3328 | + if (WARN_ON_ONCE(!st->should_run)) |
3329 | + return; |
3330 | + |
3331 | /* |
3332 | * ACQUIRE for the cpuhp_should_run() load of ->should_run. Ensures |
3333 | * that if we see ->should_run we also see the rest of the state. |
3334 | */ |
3335 | smp_mb(); |
3336 | |
3337 | - if (WARN_ON_ONCE(!st->should_run)) |
3338 | - return; |
3339 | - |
3340 | cpuhp_lock_acquire(bringup); |
3341 | |
3342 | if (st->single) { |
3343 | @@ -932,7 +932,8 @@ static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st, |
3344 | ret = cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL); |
3345 | if (ret) { |
3346 | st->target = prev_state; |
3347 | - undo_cpu_down(cpu, st); |
3348 | + if (st->state < prev_state) |
3349 | + undo_cpu_down(cpu, st); |
3350 | break; |
3351 | } |
3352 | } |
3353 | @@ -985,7 +986,7 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen, |
3354 | * to do the further cleanups. |
3355 | */ |
3356 | ret = cpuhp_down_callbacks(cpu, st, target); |
3357 | - if (ret && st->state > CPUHP_TEARDOWN_CPU && st->state < prev_state) { |
3358 | + if (ret && st->state == CPUHP_TEARDOWN_CPU && st->state < prev_state) { |
3359 | cpuhp_reset_state(st, prev_state); |
3360 | __cpuhp_kick_ap(st); |
3361 | } |
3362 | diff --git a/kernel/time/timer.c b/kernel/time/timer.c |
3363 | index 9fe525f410bf..f17c76a1a05f 100644 |
3364 | --- a/kernel/time/timer.c |
3365 | +++ b/kernel/time/timer.c |
3366 | @@ -1609,6 +1609,22 @@ static inline void __run_timers(struct timer_base *base) |
3367 | |
3368 | raw_spin_lock_irq(&base->lock); |
3369 | |
3370 | + /* |
3371 | + * timer_base::must_forward_clk must be cleared before running |
3372 | + * timers so that any timer functions that call mod_timer() will |
3373 | + * not try to forward the base. Idle tracking / clock forwarding |
3374 | + * logic is only used with BASE_STD timers. |
3375 | + * |
3376 | + * The must_forward_clk flag is cleared unconditionally also for |
3377 | + * the deferrable base. The deferrable base is not affected by idle |
3378 | + * tracking and never forwarded, so clearing the flag is a NOOP. |
3379 | + * |
3380 | + * The fact that the deferrable base is never forwarded can cause |
3381 | + * large variations in granularity for deferrable timers, but they |
3382 | + * can be deferred for long periods due to idle anyway. |
3383 | + */ |
3384 | + base->must_forward_clk = false; |
3385 | + |
3386 | while (time_after_eq(jiffies, base->clk)) { |
3387 | |
3388 | levels = collect_expired_timers(base, heads); |
3389 | @@ -1628,19 +1644,6 @@ static __latent_entropy void run_timer_softirq(struct softirq_action *h) |
3390 | { |
3391 | struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]); |
3392 | |
3393 | - /* |
3394 | - * must_forward_clk must be cleared before running timers so that any |
3395 | - * timer functions that call mod_timer will not try to forward the |
3396 | - * base. idle trcking / clock forwarding logic is only used with |
3397 | - * BASE_STD timers. |
3398 | - * |
3399 | - * The deferrable base does not do idle tracking at all, so we do |
3400 | - * not forward it. This can result in very large variations in |
3401 | - * granularity for deferrable timers, but they can be deferred for |
3402 | - * long periods due to idle. |
3403 | - */ |
3404 | - base->must_forward_clk = false; |
3405 | - |
3406 | __run_timers(base); |
3407 | if (IS_ENABLED(CONFIG_NO_HZ_COMMON)) |
3408 | __run_timers(this_cpu_ptr(&timer_bases[BASE_DEF])); |
3409 | diff --git a/lib/rhashtable.c b/lib/rhashtable.c |
3410 | index 39215c724fc7..cebbcec877d7 100644 |
3411 | --- a/lib/rhashtable.c |
3412 | +++ b/lib/rhashtable.c |
3413 | @@ -364,6 +364,7 @@ static int rhashtable_rehash_table(struct rhashtable *ht) |
3414 | err = rhashtable_rehash_chain(ht, old_hash); |
3415 | if (err) |
3416 | return err; |
3417 | + cond_resched(); |
3418 | } |
3419 | |
3420 | /* Publish the new table pointer. */ |
3421 | @@ -1073,6 +1074,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht, |
3422 | for (i = 0; i < tbl->size; i++) { |
3423 | struct rhash_head *pos, *next; |
3424 | |
3425 | + cond_resched(); |
3426 | for (pos = rht_dereference(*rht_bucket(tbl, i), ht), |
3427 | next = !rht_is_a_nulls(pos) ? |
3428 | rht_dereference(pos->next, ht) : NULL; |
3429 | diff --git a/mm/debug.c b/mm/debug.c |
3430 | index 6726bec731c9..c55abc893fdc 100644 |
3431 | --- a/mm/debug.c |
3432 | +++ b/mm/debug.c |
3433 | @@ -100,7 +100,7 @@ EXPORT_SYMBOL(dump_vma); |
3434 | |
3435 | void dump_mm(const struct mm_struct *mm) |
3436 | { |
3437 | - pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n" |
3438 | + pr_emerg("mm %p mmap %p seqnum %llu task_size %lu\n" |
3439 | #ifdef CONFIG_MMU |
3440 | "get_unmapped_area %p\n" |
3441 | #endif |
3442 | @@ -128,7 +128,7 @@ void dump_mm(const struct mm_struct *mm) |
3443 | "tlb_flush_pending %d\n" |
3444 | "def_flags: %#lx(%pGv)\n", |
3445 | |
3446 | - mm, mm->mmap, mm->vmacache_seqnum, mm->task_size, |
3447 | + mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size, |
3448 | #ifdef CONFIG_MMU |
3449 | mm->get_unmapped_area, |
3450 | #endif |
3451 | diff --git a/mm/vmacache.c b/mm/vmacache.c |
3452 | index db7596eb6132..f1729617dc85 100644 |
3453 | --- a/mm/vmacache.c |
3454 | +++ b/mm/vmacache.c |
3455 | @@ -7,44 +7,6 @@ |
3456 | #include <linux/mm.h> |
3457 | #include <linux/vmacache.h> |
3458 | |
3459 | -/* |
3460 | - * Flush vma caches for threads that share a given mm. |
3461 | - * |
3462 | - * The operation is safe because the caller holds the mmap_sem |
3463 | - * exclusively and other threads accessing the vma cache will |
3464 | - * have mmap_sem held at least for read, so no extra locking |
3465 | - * is required to maintain the vma cache. |
3466 | - */ |
3467 | -void vmacache_flush_all(struct mm_struct *mm) |
3468 | -{ |
3469 | - struct task_struct *g, *p; |
3470 | - |
3471 | - count_vm_vmacache_event(VMACACHE_FULL_FLUSHES); |
3472 | - |
3473 | - /* |
3474 | - * Single threaded tasks need not iterate the entire |
3475 | - * list of process. We can avoid the flushing as well |
3476 | - * since the mm's seqnum was increased and don't have |
3477 | - * to worry about other threads' seqnum. Current's |
3478 | - * flush will occur upon the next lookup. |
3479 | - */ |
3480 | - if (atomic_read(&mm->mm_users) == 1) |
3481 | - return; |
3482 | - |
3483 | - rcu_read_lock(); |
3484 | - for_each_process_thread(g, p) { |
3485 | - /* |
3486 | - * Only flush the vmacache pointers as the |
3487 | - * mm seqnum is already set and curr's will |
3488 | - * be set upon invalidation when the next |
3489 | - * lookup is done. |
3490 | - */ |
3491 | - if (mm == p->mm) |
3492 | - vmacache_flush(p); |
3493 | - } |
3494 | - rcu_read_unlock(); |
3495 | -} |
3496 | - |
3497 | /* |
3498 | * This task may be accessing a foreign mm via (for example) |
3499 | * get_user_pages()->find_vma(). The vmacache is task-local and this |
3500 | diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c |
3501 | index cef3754408d4..b21fcc838784 100644 |
3502 | --- a/net/bluetooth/hidp/core.c |
3503 | +++ b/net/bluetooth/hidp/core.c |
3504 | @@ -775,7 +775,7 @@ static int hidp_setup_hid(struct hidp_session *session, |
3505 | hid->version = req->version; |
3506 | hid->country = req->country; |
3507 | |
3508 | - strncpy(hid->name, req->name, sizeof(req->name) - 1); |
3509 | + strncpy(hid->name, req->name, sizeof(hid->name)); |
3510 | |
3511 | snprintf(hid->phys, sizeof(hid->phys), "%pMR", |
3512 | &l2cap_pi(session->ctrl_sock->sk)->chan->src); |
3513 | diff --git a/net/core/skbuff.c b/net/core/skbuff.c |
3514 | index 2e5eeba97de9..168a3e8883d4 100644 |
3515 | --- a/net/core/skbuff.c |
3516 | +++ b/net/core/skbuff.c |
3517 | @@ -1839,6 +1839,20 @@ done: |
3518 | } |
3519 | EXPORT_SYMBOL(___pskb_trim); |
3520 | |
3521 | +/* Note : use pskb_trim_rcsum() instead of calling this directly |
3522 | + */ |
3523 | +int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) |
3524 | +{ |
3525 | + if (skb->ip_summed == CHECKSUM_COMPLETE) { |
3526 | + int delta = skb->len - len; |
3527 | + |
3528 | + skb->csum = csum_sub(skb->csum, |
3529 | + skb_checksum(skb, len, delta, 0)); |
3530 | + } |
3531 | + return __pskb_trim(skb, len); |
3532 | +} |
3533 | +EXPORT_SYMBOL(pskb_trim_rcsum_slow); |
3534 | + |
3535 | /** |
3536 | * __pskb_pull_tail - advance tail of skb header |
3537 | * @skb: buffer to reallocate |
3538 | @@ -2842,20 +2856,27 @@ EXPORT_SYMBOL(skb_queue_purge); |
3539 | /** |
3540 | * skb_rbtree_purge - empty a skb rbtree |
3541 | * @root: root of the rbtree to empty |
3542 | + * Return value: the sum of truesizes of all purged skbs. |
3543 | * |
3544 | * Delete all buffers on an &sk_buff rbtree. Each buffer is removed from |
3545 | * the list and one reference dropped. This function does not take |
3546 | * any lock. Synchronization should be handled by the caller (e.g., TCP |
3547 | * out-of-order queue is protected by the socket lock). |
3548 | */ |
3549 | -void skb_rbtree_purge(struct rb_root *root) |
3550 | +unsigned int skb_rbtree_purge(struct rb_root *root) |
3551 | { |
3552 | - struct sk_buff *skb, *next; |
3553 | + struct rb_node *p = rb_first(root); |
3554 | + unsigned int sum = 0; |
3555 | |
3556 | - rbtree_postorder_for_each_entry_safe(skb, next, root, rbnode) |
3557 | - kfree_skb(skb); |
3558 | + while (p) { |
3559 | + struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); |
3560 | |
3561 | - *root = RB_ROOT; |
3562 | + p = rb_next(p); |
3563 | + rb_erase(&skb->rbnode, root); |
3564 | + sum += skb->truesize; |
3565 | + kfree_skb(skb); |
3566 | + } |
3567 | + return sum; |
3568 | } |
3569 | |
3570 | /** |
3571 | diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c |
3572 | index bae7d78aa068..fbeacbc2be5d 100644 |
3573 | --- a/net/dcb/dcbnl.c |
3574 | +++ b/net/dcb/dcbnl.c |
3575 | @@ -1765,7 +1765,7 @@ static struct dcb_app_type *dcb_app_lookup(const struct dcb_app *app, |
3576 | if (itr->app.selector == app->selector && |
3577 | itr->app.protocol == app->protocol && |
3578 | itr->ifindex == ifindex && |
3579 | - (!prio || itr->app.priority == prio)) |
3580 | + ((prio == -1) || itr->app.priority == prio)) |
3581 | return itr; |
3582 | } |
3583 | |
3584 | @@ -1800,7 +1800,8 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app) |
3585 | u8 prio = 0; |
3586 | |
3587 | spin_lock_bh(&dcb_lock); |
3588 | - if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) |
3589 | + itr = dcb_app_lookup(app, dev->ifindex, -1); |
3590 | + if (itr) |
3591 | prio = itr->app.priority; |
3592 | spin_unlock_bh(&dcb_lock); |
3593 | |
3594 | @@ -1828,7 +1829,8 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new) |
3595 | |
3596 | spin_lock_bh(&dcb_lock); |
3597 | /* Search for existing match and replace */ |
3598 | - if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) { |
3599 | + itr = dcb_app_lookup(new, dev->ifindex, -1); |
3600 | + if (itr) { |
3601 | if (new->priority) |
3602 | itr->app.priority = new->priority; |
3603 | else { |
3604 | @@ -1861,7 +1863,8 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app) |
3605 | u8 prio = 0; |
3606 | |
3607 | spin_lock_bh(&dcb_lock); |
3608 | - if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) |
3609 | + itr = dcb_app_lookup(app, dev->ifindex, -1); |
3610 | + if (itr) |
3611 | prio |= 1 << itr->app.priority; |
3612 | spin_unlock_bh(&dcb_lock); |
3613 | |
3614 | diff --git a/net/ieee802154/6lowpan/6lowpan_i.h b/net/ieee802154/6lowpan/6lowpan_i.h |
3615 | index d8de3bcfb103..b8d95cb71c25 100644 |
3616 | --- a/net/ieee802154/6lowpan/6lowpan_i.h |
3617 | +++ b/net/ieee802154/6lowpan/6lowpan_i.h |
3618 | @@ -17,37 +17,19 @@ typedef unsigned __bitwise lowpan_rx_result; |
3619 | #define LOWPAN_DISPATCH_FRAG1 0xc0 |
3620 | #define LOWPAN_DISPATCH_FRAGN 0xe0 |
3621 | |
3622 | -struct lowpan_create_arg { |
3623 | +struct frag_lowpan_compare_key { |
3624 | u16 tag; |
3625 | u16 d_size; |
3626 | - const struct ieee802154_addr *src; |
3627 | - const struct ieee802154_addr *dst; |
3628 | + const struct ieee802154_addr src; |
3629 | + const struct ieee802154_addr dst; |
3630 | }; |
3631 | |
3632 | -/* Equivalent of ipv4 struct ip |
3633 | +/* Equivalent of ipv4 struct ipq |
3634 | */ |
3635 | struct lowpan_frag_queue { |
3636 | struct inet_frag_queue q; |
3637 | - |
3638 | - u16 tag; |
3639 | - u16 d_size; |
3640 | - struct ieee802154_addr saddr; |
3641 | - struct ieee802154_addr daddr; |
3642 | }; |
3643 | |
3644 | -static inline u32 ieee802154_addr_hash(const struct ieee802154_addr *a) |
3645 | -{ |
3646 | - switch (a->mode) { |
3647 | - case IEEE802154_ADDR_LONG: |
3648 | - return (((__force u64)a->extended_addr) >> 32) ^ |
3649 | - (((__force u64)a->extended_addr) & 0xffffffff); |
3650 | - case IEEE802154_ADDR_SHORT: |
3651 | - return (__force u32)(a->short_addr + (a->pan_id << 16)); |
3652 | - default: |
3653 | - return 0; |
3654 | - } |
3655 | -} |
3656 | - |
3657 | int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type); |
3658 | void lowpan_net_frag_exit(void); |
3659 | int lowpan_net_frag_init(void); |
3660 | diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c |
3661 | index f85b08baff16..1790b65944b3 100644 |
3662 | --- a/net/ieee802154/6lowpan/reassembly.c |
3663 | +++ b/net/ieee802154/6lowpan/reassembly.c |
3664 | @@ -37,55 +37,24 @@ static struct inet_frags lowpan_frags; |
3665 | static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, |
3666 | struct sk_buff *prev, struct net_device *ldev); |
3667 | |
3668 | -static unsigned int lowpan_hash_frag(u16 tag, u16 d_size, |
3669 | - const struct ieee802154_addr *saddr, |
3670 | - const struct ieee802154_addr *daddr) |
3671 | -{ |
3672 | - net_get_random_once(&lowpan_frags.rnd, sizeof(lowpan_frags.rnd)); |
3673 | - return jhash_3words(ieee802154_addr_hash(saddr), |
3674 | - ieee802154_addr_hash(daddr), |
3675 | - (__force u32)(tag + (d_size << 16)), |
3676 | - lowpan_frags.rnd); |
3677 | -} |
3678 | - |
3679 | -static unsigned int lowpan_hashfn(const struct inet_frag_queue *q) |
3680 | -{ |
3681 | - const struct lowpan_frag_queue *fq; |
3682 | - |
3683 | - fq = container_of(q, struct lowpan_frag_queue, q); |
3684 | - return lowpan_hash_frag(fq->tag, fq->d_size, &fq->saddr, &fq->daddr); |
3685 | -} |
3686 | - |
3687 | -static bool lowpan_frag_match(const struct inet_frag_queue *q, const void *a) |
3688 | -{ |
3689 | - const struct lowpan_frag_queue *fq; |
3690 | - const struct lowpan_create_arg *arg = a; |
3691 | - |
3692 | - fq = container_of(q, struct lowpan_frag_queue, q); |
3693 | - return fq->tag == arg->tag && fq->d_size == arg->d_size && |
3694 | - ieee802154_addr_equal(&fq->saddr, arg->src) && |
3695 | - ieee802154_addr_equal(&fq->daddr, arg->dst); |
3696 | -} |
3697 | - |
3698 | static void lowpan_frag_init(struct inet_frag_queue *q, const void *a) |
3699 | { |
3700 | - const struct lowpan_create_arg *arg = a; |
3701 | + const struct frag_lowpan_compare_key *key = a; |
3702 | struct lowpan_frag_queue *fq; |
3703 | |
3704 | fq = container_of(q, struct lowpan_frag_queue, q); |
3705 | |
3706 | - fq->tag = arg->tag; |
3707 | - fq->d_size = arg->d_size; |
3708 | - fq->saddr = *arg->src; |
3709 | - fq->daddr = *arg->dst; |
3710 | + BUILD_BUG_ON(sizeof(*key) > sizeof(q->key)); |
3711 | + memcpy(&q->key, key, sizeof(*key)); |
3712 | } |
3713 | |
3714 | -static void lowpan_frag_expire(unsigned long data) |
3715 | +static void lowpan_frag_expire(struct timer_list *t) |
3716 | { |
3717 | + struct inet_frag_queue *frag = from_timer(frag, t, timer); |
3718 | struct frag_queue *fq; |
3719 | struct net *net; |
3720 | |
3721 | - fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); |
3722 | + fq = container_of(frag, struct frag_queue, q); |
3723 | net = container_of(fq->q.net, struct net, ieee802154_lowpan.frags); |
3724 | |
3725 | spin_lock(&fq->q.lock); |
3726 | @@ -93,10 +62,10 @@ static void lowpan_frag_expire(unsigned long data) |
3727 | if (fq->q.flags & INET_FRAG_COMPLETE) |
3728 | goto out; |
3729 | |
3730 | - inet_frag_kill(&fq->q, &lowpan_frags); |
3731 | + inet_frag_kill(&fq->q); |
3732 | out: |
3733 | spin_unlock(&fq->q.lock); |
3734 | - inet_frag_put(&fq->q, &lowpan_frags); |
3735 | + inet_frag_put(&fq->q); |
3736 | } |
3737 | |
3738 | static inline struct lowpan_frag_queue * |
3739 | @@ -104,25 +73,20 @@ fq_find(struct net *net, const struct lowpan_802154_cb *cb, |
3740 | const struct ieee802154_addr *src, |
3741 | const struct ieee802154_addr *dst) |
3742 | { |
3743 | - struct inet_frag_queue *q; |
3744 | - struct lowpan_create_arg arg; |
3745 | - unsigned int hash; |
3746 | struct netns_ieee802154_lowpan *ieee802154_lowpan = |
3747 | net_ieee802154_lowpan(net); |
3748 | + struct frag_lowpan_compare_key key = { |
3749 | + .tag = cb->d_tag, |
3750 | + .d_size = cb->d_size, |
3751 | + .src = *src, |
3752 | + .dst = *dst, |
3753 | + }; |
3754 | + struct inet_frag_queue *q; |
3755 | |
3756 | - arg.tag = cb->d_tag; |
3757 | - arg.d_size = cb->d_size; |
3758 | - arg.src = src; |
3759 | - arg.dst = dst; |
3760 | - |
3761 | - hash = lowpan_hash_frag(cb->d_tag, cb->d_size, src, dst); |
3762 | - |
3763 | - q = inet_frag_find(&ieee802154_lowpan->frags, |
3764 | - &lowpan_frags, &arg, hash); |
3765 | - if (IS_ERR_OR_NULL(q)) { |
3766 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); |
3767 | + q = inet_frag_find(&ieee802154_lowpan->frags, &key); |
3768 | + if (!q) |
3769 | return NULL; |
3770 | - } |
3771 | + |
3772 | return container_of(q, struct lowpan_frag_queue, q); |
3773 | } |
3774 | |
3775 | @@ -229,7 +193,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev, |
3776 | struct sk_buff *fp, *head = fq->q.fragments; |
3777 | int sum_truesize; |
3778 | |
3779 | - inet_frag_kill(&fq->q, &lowpan_frags); |
3780 | + inet_frag_kill(&fq->q); |
3781 | |
3782 | /* Make the one we just received the head. */ |
3783 | if (prev) { |
3784 | @@ -437,7 +401,7 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type) |
3785 | ret = lowpan_frag_queue(fq, skb, frag_type); |
3786 | spin_unlock(&fq->q.lock); |
3787 | |
3788 | - inet_frag_put(&fq->q, &lowpan_frags); |
3789 | + inet_frag_put(&fq->q); |
3790 | return ret; |
3791 | } |
3792 | |
3793 | @@ -447,24 +411,22 @@ err: |
3794 | } |
3795 | |
3796 | #ifdef CONFIG_SYSCTL |
3797 | -static int zero; |
3798 | |
3799 | static struct ctl_table lowpan_frags_ns_ctl_table[] = { |
3800 | { |
3801 | .procname = "6lowpanfrag_high_thresh", |
3802 | .data = &init_net.ieee802154_lowpan.frags.high_thresh, |
3803 | - .maxlen = sizeof(int), |
3804 | + .maxlen = sizeof(unsigned long), |
3805 | .mode = 0644, |
3806 | - .proc_handler = proc_dointvec_minmax, |
3807 | + .proc_handler = proc_doulongvec_minmax, |
3808 | .extra1 = &init_net.ieee802154_lowpan.frags.low_thresh |
3809 | }, |
3810 | { |
3811 | .procname = "6lowpanfrag_low_thresh", |
3812 | .data = &init_net.ieee802154_lowpan.frags.low_thresh, |
3813 | - .maxlen = sizeof(int), |
3814 | + .maxlen = sizeof(unsigned long), |
3815 | .mode = 0644, |
3816 | - .proc_handler = proc_dointvec_minmax, |
3817 | - .extra1 = &zero, |
3818 | + .proc_handler = proc_doulongvec_minmax, |
3819 | .extra2 = &init_net.ieee802154_lowpan.frags.high_thresh |
3820 | }, |
3821 | { |
3822 | @@ -580,14 +542,20 @@ static int __net_init lowpan_frags_init_net(struct net *net) |
3823 | { |
3824 | struct netns_ieee802154_lowpan *ieee802154_lowpan = |
3825 | net_ieee802154_lowpan(net); |
3826 | + int res; |
3827 | |
3828 | ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH; |
3829 | ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH; |
3830 | ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT; |
3831 | + ieee802154_lowpan->frags.f = &lowpan_frags; |
3832 | |
3833 | - inet_frags_init_net(&ieee802154_lowpan->frags); |
3834 | - |
3835 | - return lowpan_frags_ns_sysctl_register(net); |
3836 | + res = inet_frags_init_net(&ieee802154_lowpan->frags); |
3837 | + if (res < 0) |
3838 | + return res; |
3839 | + res = lowpan_frags_ns_sysctl_register(net); |
3840 | + if (res < 0) |
3841 | + inet_frags_exit_net(&ieee802154_lowpan->frags); |
3842 | + return res; |
3843 | } |
3844 | |
3845 | static void __net_exit lowpan_frags_exit_net(struct net *net) |
3846 | @@ -596,7 +564,7 @@ static void __net_exit lowpan_frags_exit_net(struct net *net) |
3847 | net_ieee802154_lowpan(net); |
3848 | |
3849 | lowpan_frags_ns_sysctl_unregister(net); |
3850 | - inet_frags_exit_net(&ieee802154_lowpan->frags, &lowpan_frags); |
3851 | + inet_frags_exit_net(&ieee802154_lowpan->frags); |
3852 | } |
3853 | |
3854 | static struct pernet_operations lowpan_frags_ops = { |
3855 | @@ -604,32 +572,63 @@ static struct pernet_operations lowpan_frags_ops = { |
3856 | .exit = lowpan_frags_exit_net, |
3857 | }; |
3858 | |
3859 | -int __init lowpan_net_frag_init(void) |
3860 | +static u32 lowpan_key_hashfn(const void *data, u32 len, u32 seed) |
3861 | { |
3862 | - int ret; |
3863 | + return jhash2(data, |
3864 | + sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); |
3865 | +} |
3866 | |
3867 | - ret = lowpan_frags_sysctl_register(); |
3868 | - if (ret) |
3869 | - return ret; |
3870 | +static u32 lowpan_obj_hashfn(const void *data, u32 len, u32 seed) |
3871 | +{ |
3872 | + const struct inet_frag_queue *fq = data; |
3873 | |
3874 | - ret = register_pernet_subsys(&lowpan_frags_ops); |
3875 | - if (ret) |
3876 | - goto err_pernet; |
3877 | + return jhash2((const u32 *)&fq->key, |
3878 | + sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); |
3879 | +} |
3880 | + |
3881 | +static int lowpan_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) |
3882 | +{ |
3883 | + const struct frag_lowpan_compare_key *key = arg->key; |
3884 | + const struct inet_frag_queue *fq = ptr; |
3885 | + |
3886 | + return !!memcmp(&fq->key, key, sizeof(*key)); |
3887 | +} |
3888 | + |
3889 | +static const struct rhashtable_params lowpan_rhash_params = { |
3890 | + .head_offset = offsetof(struct inet_frag_queue, node), |
3891 | + .hashfn = lowpan_key_hashfn, |
3892 | + .obj_hashfn = lowpan_obj_hashfn, |
3893 | + .obj_cmpfn = lowpan_obj_cmpfn, |
3894 | + .automatic_shrinking = true, |
3895 | +}; |
3896 | + |
3897 | +int __init lowpan_net_frag_init(void) |
3898 | +{ |
3899 | + int ret; |
3900 | |
3901 | - lowpan_frags.hashfn = lowpan_hashfn; |
3902 | lowpan_frags.constructor = lowpan_frag_init; |
3903 | lowpan_frags.destructor = NULL; |
3904 | lowpan_frags.qsize = sizeof(struct frag_queue); |
3905 | - lowpan_frags.match = lowpan_frag_match; |
3906 | lowpan_frags.frag_expire = lowpan_frag_expire; |
3907 | lowpan_frags.frags_cache_name = lowpan_frags_cache_name; |
3908 | + lowpan_frags.rhash_params = lowpan_rhash_params; |
3909 | ret = inet_frags_init(&lowpan_frags); |
3910 | if (ret) |
3911 | - goto err_pernet; |
3912 | + goto out; |
3913 | |
3914 | + ret = lowpan_frags_sysctl_register(); |
3915 | + if (ret) |
3916 | + goto err_sysctl; |
3917 | + |
3918 | + ret = register_pernet_subsys(&lowpan_frags_ops); |
3919 | + if (ret) |
3920 | + goto err_pernet; |
3921 | +out: |
3922 | return ret; |
3923 | err_pernet: |
3924 | lowpan_frags_sysctl_unregister(); |
3925 | +err_sysctl: |
3926 | + inet_frags_fini(&lowpan_frags); |
3927 | return ret; |
3928 | } |
3929 | |
3930 | diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c |
3931 | index ba4454ecdf0f..f6764537148c 100644 |
3932 | --- a/net/ipv4/inet_fragment.c |
3933 | +++ b/net/ipv4/inet_fragment.c |
3934 | @@ -25,12 +25,6 @@ |
3935 | #include <net/inet_frag.h> |
3936 | #include <net/inet_ecn.h> |
3937 | |
3938 | -#define INETFRAGS_EVICT_BUCKETS 128 |
3939 | -#define INETFRAGS_EVICT_MAX 512 |
3940 | - |
3941 | -/* don't rebuild inetfrag table with new secret more often than this */ |
3942 | -#define INETFRAGS_MIN_REBUILD_INTERVAL (5 * HZ) |
3943 | - |
3944 | /* Given the OR values of all fragments, apply RFC 3168 5.3 requirements |
3945 | * Value : 0xff if frame should be dropped. |
3946 | * 0 or INET_ECN_CE value, to be ORed in to final iph->tos field |
3947 | @@ -52,157 +46,8 @@ const u8 ip_frag_ecn_table[16] = { |
3948 | }; |
3949 | EXPORT_SYMBOL(ip_frag_ecn_table); |
3950 | |
3951 | -static unsigned int |
3952 | -inet_frag_hashfn(const struct inet_frags *f, const struct inet_frag_queue *q) |
3953 | -{ |
3954 | - return f->hashfn(q) & (INETFRAGS_HASHSZ - 1); |
3955 | -} |
3956 | - |
3957 | -static bool inet_frag_may_rebuild(struct inet_frags *f) |
3958 | -{ |
3959 | - return time_after(jiffies, |
3960 | - f->last_rebuild_jiffies + INETFRAGS_MIN_REBUILD_INTERVAL); |
3961 | -} |
3962 | - |
3963 | -static void inet_frag_secret_rebuild(struct inet_frags *f) |
3964 | -{ |
3965 | - int i; |
3966 | - |
3967 | - write_seqlock_bh(&f->rnd_seqlock); |
3968 | - |
3969 | - if (!inet_frag_may_rebuild(f)) |
3970 | - goto out; |
3971 | - |
3972 | - get_random_bytes(&f->rnd, sizeof(u32)); |
3973 | - |
3974 | - for (i = 0; i < INETFRAGS_HASHSZ; i++) { |
3975 | - struct inet_frag_bucket *hb; |
3976 | - struct inet_frag_queue *q; |
3977 | - struct hlist_node *n; |
3978 | - |
3979 | - hb = &f->hash[i]; |
3980 | - spin_lock(&hb->chain_lock); |
3981 | - |
3982 | - hlist_for_each_entry_safe(q, n, &hb->chain, list) { |
3983 | - unsigned int hval = inet_frag_hashfn(f, q); |
3984 | - |
3985 | - if (hval != i) { |
3986 | - struct inet_frag_bucket *hb_dest; |
3987 | - |
3988 | - hlist_del(&q->list); |
3989 | - |
3990 | - /* Relink to new hash chain. */ |
3991 | - hb_dest = &f->hash[hval]; |
3992 | - |
3993 | - /* This is the only place where we take |
3994 | - * another chain_lock while already holding |
3995 | - * one. As this will not run concurrently, |
3996 | - * we cannot deadlock on hb_dest lock below, if its |
3997 | - * already locked it will be released soon since |
3998 | - * other caller cannot be waiting for hb lock |
3999 | - * that we've taken above. |
4000 | - */ |
4001 | - spin_lock_nested(&hb_dest->chain_lock, |
4002 | - SINGLE_DEPTH_NESTING); |
4003 | - hlist_add_head(&q->list, &hb_dest->chain); |
4004 | - spin_unlock(&hb_dest->chain_lock); |
4005 | - } |
4006 | - } |
4007 | - spin_unlock(&hb->chain_lock); |
4008 | - } |
4009 | - |
4010 | - f->rebuild = false; |
4011 | - f->last_rebuild_jiffies = jiffies; |
4012 | -out: |
4013 | - write_sequnlock_bh(&f->rnd_seqlock); |
4014 | -} |
4015 | - |
4016 | -static bool inet_fragq_should_evict(const struct inet_frag_queue *q) |
4017 | -{ |
4018 | - if (!hlist_unhashed(&q->list_evictor)) |
4019 | - return false; |
4020 | - |
4021 | - return q->net->low_thresh == 0 || |
4022 | - frag_mem_limit(q->net) >= q->net->low_thresh; |
4023 | -} |
4024 | - |
4025 | -static unsigned int |
4026 | -inet_evict_bucket(struct inet_frags *f, struct inet_frag_bucket *hb) |
4027 | -{ |
4028 | - struct inet_frag_queue *fq; |
4029 | - struct hlist_node *n; |
4030 | - unsigned int evicted = 0; |
4031 | - HLIST_HEAD(expired); |
4032 | - |
4033 | - spin_lock(&hb->chain_lock); |
4034 | - |
4035 | - hlist_for_each_entry_safe(fq, n, &hb->chain, list) { |
4036 | - if (!inet_fragq_should_evict(fq)) |
4037 | - continue; |
4038 | - |
4039 | - if (!del_timer(&fq->timer)) |
4040 | - continue; |
4041 | - |
4042 | - hlist_add_head(&fq->list_evictor, &expired); |
4043 | - ++evicted; |
4044 | - } |
4045 | - |
4046 | - spin_unlock(&hb->chain_lock); |
4047 | - |
4048 | - hlist_for_each_entry_safe(fq, n, &expired, list_evictor) |
4049 | - f->frag_expire((unsigned long) fq); |
4050 | - |
4051 | - return evicted; |
4052 | -} |
4053 | - |
4054 | -static void inet_frag_worker(struct work_struct *work) |
4055 | -{ |
4056 | - unsigned int budget = INETFRAGS_EVICT_BUCKETS; |
4057 | - unsigned int i, evicted = 0; |
4058 | - struct inet_frags *f; |
4059 | - |
4060 | - f = container_of(work, struct inet_frags, frags_work); |
4061 | - |
4062 | - BUILD_BUG_ON(INETFRAGS_EVICT_BUCKETS >= INETFRAGS_HASHSZ); |
4063 | - |
4064 | - local_bh_disable(); |
4065 | - |
4066 | - for (i = ACCESS_ONCE(f->next_bucket); budget; --budget) { |
4067 | - evicted += inet_evict_bucket(f, &f->hash[i]); |
4068 | - i = (i + 1) & (INETFRAGS_HASHSZ - 1); |
4069 | - if (evicted > INETFRAGS_EVICT_MAX) |
4070 | - break; |
4071 | - } |
4072 | - |
4073 | - f->next_bucket = i; |
4074 | - |
4075 | - local_bh_enable(); |
4076 | - |
4077 | - if (f->rebuild && inet_frag_may_rebuild(f)) |
4078 | - inet_frag_secret_rebuild(f); |
4079 | -} |
4080 | - |
4081 | -static void inet_frag_schedule_worker(struct inet_frags *f) |
4082 | -{ |
4083 | - if (unlikely(!work_pending(&f->frags_work))) |
4084 | - schedule_work(&f->frags_work); |
4085 | -} |
4086 | - |
4087 | int inet_frags_init(struct inet_frags *f) |
4088 | { |
4089 | - int i; |
4090 | - |
4091 | - INIT_WORK(&f->frags_work, inet_frag_worker); |
4092 | - |
4093 | - for (i = 0; i < INETFRAGS_HASHSZ; i++) { |
4094 | - struct inet_frag_bucket *hb = &f->hash[i]; |
4095 | - |
4096 | - spin_lock_init(&hb->chain_lock); |
4097 | - INIT_HLIST_HEAD(&hb->chain); |
4098 | - } |
4099 | - |
4100 | - seqlock_init(&f->rnd_seqlock); |
4101 | - f->last_rebuild_jiffies = 0; |
4102 | f->frags_cachep = kmem_cache_create(f->frags_cache_name, f->qsize, 0, 0, |
4103 | NULL); |
4104 | if (!f->frags_cachep) |
4105 | @@ -214,83 +59,75 @@ EXPORT_SYMBOL(inet_frags_init); |
4106 | |
4107 | void inet_frags_fini(struct inet_frags *f) |
4108 | { |
4109 | - cancel_work_sync(&f->frags_work); |
4110 | + /* We must wait that all inet_frag_destroy_rcu() have completed. */ |
4111 | + rcu_barrier(); |
4112 | + |
4113 | kmem_cache_destroy(f->frags_cachep); |
4114 | + f->frags_cachep = NULL; |
4115 | } |
4116 | EXPORT_SYMBOL(inet_frags_fini); |
4117 | |
4118 | -void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f) |
4119 | +static void inet_frags_free_cb(void *ptr, void *arg) |
4120 | { |
4121 | - unsigned int seq; |
4122 | - int i; |
4123 | - |
4124 | - nf->low_thresh = 0; |
4125 | + struct inet_frag_queue *fq = ptr; |
4126 | |
4127 | -evict_again: |
4128 | - local_bh_disable(); |
4129 | - seq = read_seqbegin(&f->rnd_seqlock); |
4130 | - |
4131 | - for (i = 0; i < INETFRAGS_HASHSZ ; i++) |
4132 | - inet_evict_bucket(f, &f->hash[i]); |
4133 | - |
4134 | - local_bh_enable(); |
4135 | - cond_resched(); |
4136 | - |
4137 | - if (read_seqretry(&f->rnd_seqlock, seq) || |
4138 | - sum_frag_mem_limit(nf)) |
4139 | - goto evict_again; |
4140 | -} |
4141 | -EXPORT_SYMBOL(inet_frags_exit_net); |
4142 | - |
4143 | -static struct inet_frag_bucket * |
4144 | -get_frag_bucket_locked(struct inet_frag_queue *fq, struct inet_frags *f) |
4145 | -__acquires(hb->chain_lock) |
4146 | -{ |
4147 | - struct inet_frag_bucket *hb; |
4148 | - unsigned int seq, hash; |
4149 | - |
4150 | - restart: |
4151 | - seq = read_seqbegin(&f->rnd_seqlock); |
4152 | - |
4153 | - hash = inet_frag_hashfn(f, fq); |
4154 | - hb = &f->hash[hash]; |
4155 | + /* If we can not cancel the timer, it means this frag_queue |
4156 | + * is already disappearing, we have nothing to do. |
4157 | + * Otherwise, we own a refcount until the end of this function. |
4158 | + */ |
4159 | + if (!del_timer(&fq->timer)) |
4160 | + return; |
4161 | |
4162 | - spin_lock(&hb->chain_lock); |
4163 | - if (read_seqretry(&f->rnd_seqlock, seq)) { |
4164 | - spin_unlock(&hb->chain_lock); |
4165 | - goto restart; |
4166 | + spin_lock_bh(&fq->lock); |
4167 | + if (!(fq->flags & INET_FRAG_COMPLETE)) { |
4168 | + fq->flags |= INET_FRAG_COMPLETE; |
4169 | + refcount_dec(&fq->refcnt); |
4170 | } |
4171 | + spin_unlock_bh(&fq->lock); |
4172 | |
4173 | - return hb; |
4174 | + inet_frag_put(fq); |
4175 | } |
4176 | |
4177 | -static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f) |
4178 | +void inet_frags_exit_net(struct netns_frags *nf) |
4179 | { |
4180 | - struct inet_frag_bucket *hb; |
4181 | + nf->low_thresh = 0; /* prevent creation of new frags */ |
4182 | |
4183 | - hb = get_frag_bucket_locked(fq, f); |
4184 | - hlist_del(&fq->list); |
4185 | - fq->flags |= INET_FRAG_COMPLETE; |
4186 | - spin_unlock(&hb->chain_lock); |
4187 | + rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL); |
4188 | } |
4189 | +EXPORT_SYMBOL(inet_frags_exit_net); |
4190 | |
4191 | -void inet_frag_kill(struct inet_frag_queue *fq, struct inet_frags *f) |
4192 | +void inet_frag_kill(struct inet_frag_queue *fq) |
4193 | { |
4194 | if (del_timer(&fq->timer)) |
4195 | refcount_dec(&fq->refcnt); |
4196 | |
4197 | if (!(fq->flags & INET_FRAG_COMPLETE)) { |
4198 | - fq_unlink(fq, f); |
4199 | + struct netns_frags *nf = fq->net; |
4200 | + |
4201 | + fq->flags |= INET_FRAG_COMPLETE; |
4202 | + rhashtable_remove_fast(&nf->rhashtable, &fq->node, nf->f->rhash_params); |
4203 | refcount_dec(&fq->refcnt); |
4204 | } |
4205 | } |
4206 | EXPORT_SYMBOL(inet_frag_kill); |
4207 | |
4208 | -void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f) |
4209 | +static void inet_frag_destroy_rcu(struct rcu_head *head) |
4210 | +{ |
4211 | + struct inet_frag_queue *q = container_of(head, struct inet_frag_queue, |
4212 | + rcu); |
4213 | + struct inet_frags *f = q->net->f; |
4214 | + |
4215 | + if (f->destructor) |
4216 | + f->destructor(q); |
4217 | + kmem_cache_free(f->frags_cachep, q); |
4218 | +} |
4219 | + |
4220 | +void inet_frag_destroy(struct inet_frag_queue *q) |
4221 | { |
4222 | struct sk_buff *fp; |
4223 | struct netns_frags *nf; |
4224 | unsigned int sum, sum_truesize = 0; |
4225 | + struct inet_frags *f; |
4226 | |
4227 | WARN_ON(!(q->flags & INET_FRAG_COMPLETE)); |
4228 | WARN_ON(del_timer(&q->timer) != 0); |
4229 | @@ -298,64 +135,35 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f) |
4230 | /* Release all fragment data. */ |
4231 | fp = q->fragments; |
4232 | nf = q->net; |
4233 | - while (fp) { |
4234 | - struct sk_buff *xp = fp->next; |
4235 | - |
4236 | - sum_truesize += fp->truesize; |
4237 | - kfree_skb(fp); |
4238 | - fp = xp; |
4239 | + f = nf->f; |
4240 | + if (fp) { |
4241 | + do { |
4242 | + struct sk_buff *xp = fp->next; |
4243 | + |
4244 | + sum_truesize += fp->truesize; |
4245 | + kfree_skb(fp); |
4246 | + fp = xp; |
4247 | + } while (fp); |
4248 | + } else { |
4249 | + sum_truesize = inet_frag_rbtree_purge(&q->rb_fragments); |
4250 | } |
4251 | sum = sum_truesize + f->qsize; |
4252 | |
4253 | - if (f->destructor) |
4254 | - f->destructor(q); |
4255 | - kmem_cache_free(f->frags_cachep, q); |
4256 | + call_rcu(&q->rcu, inet_frag_destroy_rcu); |
4257 | |
4258 | sub_frag_mem_limit(nf, sum); |
4259 | } |
4260 | EXPORT_SYMBOL(inet_frag_destroy); |
4261 | |
4262 | -static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf, |
4263 | - struct inet_frag_queue *qp_in, |
4264 | - struct inet_frags *f, |
4265 | - void *arg) |
4266 | -{ |
4267 | - struct inet_frag_bucket *hb = get_frag_bucket_locked(qp_in, f); |
4268 | - struct inet_frag_queue *qp; |
4269 | - |
4270 | -#ifdef CONFIG_SMP |
4271 | - /* With SMP race we have to recheck hash table, because |
4272 | - * such entry could have been created on other cpu before |
4273 | - * we acquired hash bucket lock. |
4274 | - */ |
4275 | - hlist_for_each_entry(qp, &hb->chain, list) { |
4276 | - if (qp->net == nf && f->match(qp, arg)) { |
4277 | - refcount_inc(&qp->refcnt); |
4278 | - spin_unlock(&hb->chain_lock); |
4279 | - qp_in->flags |= INET_FRAG_COMPLETE; |
4280 | - inet_frag_put(qp_in, f); |
4281 | - return qp; |
4282 | - } |
4283 | - } |
4284 | -#endif |
4285 | - qp = qp_in; |
4286 | - if (!mod_timer(&qp->timer, jiffies + nf->timeout)) |
4287 | - refcount_inc(&qp->refcnt); |
4288 | - |
4289 | - refcount_inc(&qp->refcnt); |
4290 | - hlist_add_head(&qp->list, &hb->chain); |
4291 | - |
4292 | - spin_unlock(&hb->chain_lock); |
4293 | - |
4294 | - return qp; |
4295 | -} |
4296 | - |
4297 | static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, |
4298 | struct inet_frags *f, |
4299 | void *arg) |
4300 | { |
4301 | struct inet_frag_queue *q; |
4302 | |
4303 | + if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) |
4304 | + return NULL; |
4305 | + |
4306 | q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); |
4307 | if (!q) |
4308 | return NULL; |
4309 | @@ -364,77 +172,53 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, |
4310 | f->constructor(q, arg); |
4311 | add_frag_mem_limit(nf, f->qsize); |
4312 | |
4313 | - setup_timer(&q->timer, f->frag_expire, (unsigned long)q); |
4314 | + timer_setup(&q->timer, f->frag_expire, 0); |
4315 | spin_lock_init(&q->lock); |
4316 | - refcount_set(&q->refcnt, 1); |
4317 | + refcount_set(&q->refcnt, 3); |
4318 | |
4319 | return q; |
4320 | } |
4321 | |
4322 | static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, |
4323 | - struct inet_frags *f, |
4324 | void *arg) |
4325 | { |
4326 | + struct inet_frags *f = nf->f; |
4327 | struct inet_frag_queue *q; |
4328 | + int err; |
4329 | |
4330 | q = inet_frag_alloc(nf, f, arg); |
4331 | if (!q) |
4332 | return NULL; |
4333 | |
4334 | - return inet_frag_intern(nf, q, f, arg); |
4335 | -} |
4336 | - |
4337 | -struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, |
4338 | - struct inet_frags *f, void *key, |
4339 | - unsigned int hash) |
4340 | -{ |
4341 | - struct inet_frag_bucket *hb; |
4342 | - struct inet_frag_queue *q; |
4343 | - int depth = 0; |
4344 | + mod_timer(&q->timer, jiffies + nf->timeout); |
4345 | |
4346 | - if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { |
4347 | - inet_frag_schedule_worker(f); |
4348 | + err = rhashtable_insert_fast(&nf->rhashtable, &q->node, |
4349 | + f->rhash_params); |
4350 | + if (err < 0) { |
4351 | + q->flags |= INET_FRAG_COMPLETE; |
4352 | + inet_frag_kill(q); |
4353 | + inet_frag_destroy(q); |
4354 | return NULL; |
4355 | } |
4356 | + return q; |
4357 | +} |
4358 | |
4359 | - if (frag_mem_limit(nf) > nf->low_thresh) |
4360 | - inet_frag_schedule_worker(f); |
4361 | - |
4362 | - hash &= (INETFRAGS_HASHSZ - 1); |
4363 | - hb = &f->hash[hash]; |
4364 | - |
4365 | - spin_lock(&hb->chain_lock); |
4366 | - hlist_for_each_entry(q, &hb->chain, list) { |
4367 | - if (q->net == nf && f->match(q, key)) { |
4368 | - refcount_inc(&q->refcnt); |
4369 | - spin_unlock(&hb->chain_lock); |
4370 | - return q; |
4371 | - } |
4372 | - depth++; |
4373 | - } |
4374 | - spin_unlock(&hb->chain_lock); |
4375 | +/* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */ |
4376 | +struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key) |
4377 | +{ |
4378 | + struct inet_frag_queue *fq; |
4379 | |
4380 | - if (depth <= INETFRAGS_MAXDEPTH) |
4381 | - return inet_frag_create(nf, f, key); |
4382 | + rcu_read_lock(); |
4383 | |
4384 | - if (inet_frag_may_rebuild(f)) { |
4385 | - if (!f->rebuild) |
4386 | - f->rebuild = true; |
4387 | - inet_frag_schedule_worker(f); |
4388 | + fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params); |
4389 | + if (fq) { |
4390 | + if (!refcount_inc_not_zero(&fq->refcnt)) |
4391 | + fq = NULL; |
4392 | + rcu_read_unlock(); |
4393 | + return fq; |
4394 | } |
4395 | + rcu_read_unlock(); |
4396 | |
4397 | - return ERR_PTR(-ENOBUFS); |
4398 | + return inet_frag_create(nf, key); |
4399 | } |
4400 | EXPORT_SYMBOL(inet_frag_find); |
4401 | - |
4402 | -void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, |
4403 | - const char *prefix) |
4404 | -{ |
4405 | - static const char msg[] = "inet_frag_find: Fragment hash bucket" |
4406 | - " list length grew over limit " __stringify(INETFRAGS_MAXDEPTH) |
4407 | - ". Dropping fragment.\n"; |
4408 | - |
4409 | - if (PTR_ERR(q) == -ENOBUFS) |
4410 | - net_dbg_ratelimited("%s%s", prefix, msg); |
4411 | -} |
4412 | -EXPORT_SYMBOL(inet_frag_maybe_warn_overflow); |
4413 | diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c |
4414 | index 4cb1befc3949..e7227128df2c 100644 |
4415 | --- a/net/ipv4/ip_fragment.c |
4416 | +++ b/net/ipv4/ip_fragment.c |
4417 | @@ -57,27 +57,64 @@ |
4418 | */ |
4419 | static const char ip_frag_cache_name[] = "ip4-frags"; |
4420 | |
4421 | -struct ipfrag_skb_cb |
4422 | -{ |
4423 | +/* Use skb->cb to track consecutive/adjacent fragments coming at |
4424 | + * the end of the queue. Nodes in the rb-tree queue will |
4425 | + * contain "runs" of one or more adjacent fragments. |
4426 | + * |
4427 | + * Invariants: |
4428 | + * - next_frag is NULL at the tail of a "run"; |
4429 | + * - the head of a "run" has the sum of all fragment lengths in frag_run_len. |
4430 | + */ |
4431 | +struct ipfrag_skb_cb { |
4432 | struct inet_skb_parm h; |
4433 | - int offset; |
4434 | + struct sk_buff *next_frag; |
4435 | + int frag_run_len; |
4436 | }; |
4437 | |
4438 | -#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) |
4439 | +#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) |
4440 | + |
4441 | +static void ip4_frag_init_run(struct sk_buff *skb) |
4442 | +{ |
4443 | + BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb)); |
4444 | + |
4445 | + FRAG_CB(skb)->next_frag = NULL; |
4446 | + FRAG_CB(skb)->frag_run_len = skb->len; |
4447 | +} |
4448 | + |
4449 | +/* Append skb to the last "run". */ |
4450 | +static void ip4_frag_append_to_last_run(struct inet_frag_queue *q, |
4451 | + struct sk_buff *skb) |
4452 | +{ |
4453 | + RB_CLEAR_NODE(&skb->rbnode); |
4454 | + FRAG_CB(skb)->next_frag = NULL; |
4455 | + |
4456 | + FRAG_CB(q->last_run_head)->frag_run_len += skb->len; |
4457 | + FRAG_CB(q->fragments_tail)->next_frag = skb; |
4458 | + q->fragments_tail = skb; |
4459 | +} |
4460 | + |
4461 | +/* Create a new "run" with the skb. */ |
4462 | +static void ip4_frag_create_run(struct inet_frag_queue *q, struct sk_buff *skb) |
4463 | +{ |
4464 | + if (q->last_run_head) |
4465 | + rb_link_node(&skb->rbnode, &q->last_run_head->rbnode, |
4466 | + &q->last_run_head->rbnode.rb_right); |
4467 | + else |
4468 | + rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node); |
4469 | + rb_insert_color(&skb->rbnode, &q->rb_fragments); |
4470 | + |
4471 | + ip4_frag_init_run(skb); |
4472 | + q->fragments_tail = skb; |
4473 | + q->last_run_head = skb; |
4474 | +} |
4475 | |
4476 | /* Describe an entry in the "incomplete datagrams" queue. */ |
4477 | struct ipq { |
4478 | struct inet_frag_queue q; |
4479 | |
4480 | - u32 user; |
4481 | - __be32 saddr; |
4482 | - __be32 daddr; |
4483 | - __be16 id; |
4484 | - u8 protocol; |
4485 | u8 ecn; /* RFC3168 support */ |
4486 | u16 max_df_size; /* largest frag with DF set seen */ |
4487 | int iif; |
4488 | - int vif; /* L3 master device index */ |
4489 | unsigned int rid; |
4490 | struct inet_peer *peer; |
4491 | }; |
4492 | @@ -89,49 +126,9 @@ static u8 ip4_frag_ecn(u8 tos) |
4493 | |
4494 | static struct inet_frags ip4_frags; |
4495 | |
4496 | -int ip_frag_mem(struct net *net) |
4497 | -{ |
4498 | - return sum_frag_mem_limit(&net->ipv4.frags); |
4499 | -} |
4500 | - |
4501 | -static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
4502 | - struct net_device *dev); |
4503 | - |
4504 | -struct ip4_create_arg { |
4505 | - struct iphdr *iph; |
4506 | - u32 user; |
4507 | - int vif; |
4508 | -}; |
4509 | +static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, |
4510 | + struct sk_buff *prev_tail, struct net_device *dev); |
4511 | |
4512 | -static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot) |
4513 | -{ |
4514 | - net_get_random_once(&ip4_frags.rnd, sizeof(ip4_frags.rnd)); |
4515 | - return jhash_3words((__force u32)id << 16 | prot, |
4516 | - (__force u32)saddr, (__force u32)daddr, |
4517 | - ip4_frags.rnd); |
4518 | -} |
4519 | - |
4520 | -static unsigned int ip4_hashfn(const struct inet_frag_queue *q) |
4521 | -{ |
4522 | - const struct ipq *ipq; |
4523 | - |
4524 | - ipq = container_of(q, struct ipq, q); |
4525 | - return ipqhashfn(ipq->id, ipq->saddr, ipq->daddr, ipq->protocol); |
4526 | -} |
4527 | - |
4528 | -static bool ip4_frag_match(const struct inet_frag_queue *q, const void *a) |
4529 | -{ |
4530 | - const struct ipq *qp; |
4531 | - const struct ip4_create_arg *arg = a; |
4532 | - |
4533 | - qp = container_of(q, struct ipq, q); |
4534 | - return qp->id == arg->iph->id && |
4535 | - qp->saddr == arg->iph->saddr && |
4536 | - qp->daddr == arg->iph->daddr && |
4537 | - qp->protocol == arg->iph->protocol && |
4538 | - qp->user == arg->user && |
4539 | - qp->vif == arg->vif; |
4540 | -} |
4541 | |
4542 | static void ip4_frag_init(struct inet_frag_queue *q, const void *a) |
4543 | { |
4544 | @@ -140,17 +137,12 @@ static void ip4_frag_init(struct inet_frag_queue *q, const void *a) |
4545 | frags); |
4546 | struct net *net = container_of(ipv4, struct net, ipv4); |
4547 | |
4548 | - const struct ip4_create_arg *arg = a; |
4549 | + const struct frag_v4_compare_key *key = a; |
4550 | |
4551 | - qp->protocol = arg->iph->protocol; |
4552 | - qp->id = arg->iph->id; |
4553 | - qp->ecn = ip4_frag_ecn(arg->iph->tos); |
4554 | - qp->saddr = arg->iph->saddr; |
4555 | - qp->daddr = arg->iph->daddr; |
4556 | - qp->vif = arg->vif; |
4557 | - qp->user = arg->user; |
4558 | + q->key.v4 = *key; |
4559 | + qp->ecn = 0; |
4560 | qp->peer = q->net->max_dist ? |
4561 | - inet_getpeer_v4(net->ipv4.peers, arg->iph->saddr, arg->vif, 1) : |
4562 | + inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) : |
4563 | NULL; |
4564 | } |
4565 | |
4566 | @@ -168,7 +160,7 @@ static void ip4_frag_free(struct inet_frag_queue *q) |
4567 | |
4568 | static void ipq_put(struct ipq *ipq) |
4569 | { |
4570 | - inet_frag_put(&ipq->q, &ip4_frags); |
4571 | + inet_frag_put(&ipq->q); |
4572 | } |
4573 | |
4574 | /* Kill ipq entry. It is not destroyed immediately, |
4575 | @@ -176,7 +168,7 @@ static void ipq_put(struct ipq *ipq) |
4576 | */ |
4577 | static void ipq_kill(struct ipq *ipq) |
4578 | { |
4579 | - inet_frag_kill(&ipq->q, &ip4_frags); |
4580 | + inet_frag_kill(&ipq->q); |
4581 | } |
4582 | |
4583 | static bool frag_expire_skip_icmp(u32 user) |
4584 | @@ -191,12 +183,16 @@ static bool frag_expire_skip_icmp(u32 user) |
4585 | /* |
4586 | * Oops, a fragment queue timed out. Kill it and send an ICMP reply. |
4587 | */ |
4588 | -static void ip_expire(unsigned long arg) |
4589 | +static void ip_expire(struct timer_list *t) |
4590 | { |
4591 | - struct ipq *qp; |
4592 | + struct inet_frag_queue *frag = from_timer(frag, t, timer); |
4593 | + const struct iphdr *iph; |
4594 | + struct sk_buff *head = NULL; |
4595 | struct net *net; |
4596 | + struct ipq *qp; |
4597 | + int err; |
4598 | |
4599 | - qp = container_of((struct inet_frag_queue *) arg, struct ipq, q); |
4600 | + qp = container_of(frag, struct ipq, q); |
4601 | net = container_of(qp->q.net, struct net, ipv4.frags); |
4602 | |
4603 | rcu_read_lock(); |
4604 | @@ -207,51 +203,65 @@ static void ip_expire(unsigned long arg) |
4605 | |
4606 | ipq_kill(qp); |
4607 | __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); |
4608 | + __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); |
4609 | |
4610 | - if (!inet_frag_evicting(&qp->q)) { |
4611 | - struct sk_buff *clone, *head = qp->q.fragments; |
4612 | - const struct iphdr *iph; |
4613 | - int err; |
4614 | - |
4615 | - __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); |
4616 | + if (!(qp->q.flags & INET_FRAG_FIRST_IN)) |
4617 | + goto out; |
4618 | |
4619 | - if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments) |
4620 | + /* sk_buff::dev and sk_buff::rbnode are unionized. So we |
4621 | + * pull the head out of the tree in order to be able to |
4622 | + * deal with head->dev. |
4623 | + */ |
4624 | + if (qp->q.fragments) { |
4625 | + head = qp->q.fragments; |
4626 | + qp->q.fragments = head->next; |
4627 | + } else { |
4628 | + head = skb_rb_first(&qp->q.rb_fragments); |
4629 | + if (!head) |
4630 | goto out; |
4631 | + if (FRAG_CB(head)->next_frag) |
4632 | + rb_replace_node(&head->rbnode, |
4633 | + &FRAG_CB(head)->next_frag->rbnode, |
4634 | + &qp->q.rb_fragments); |
4635 | + else |
4636 | + rb_erase(&head->rbnode, &qp->q.rb_fragments); |
4637 | + memset(&head->rbnode, 0, sizeof(head->rbnode)); |
4638 | + barrier(); |
4639 | + } |
4640 | + if (head == qp->q.fragments_tail) |
4641 | + qp->q.fragments_tail = NULL; |
4642 | |
4643 | - head->dev = dev_get_by_index_rcu(net, qp->iif); |
4644 | - if (!head->dev) |
4645 | - goto out; |
4646 | + sub_frag_mem_limit(qp->q.net, head->truesize); |
4647 | + |
4648 | + head->dev = dev_get_by_index_rcu(net, qp->iif); |
4649 | + if (!head->dev) |
4650 | + goto out; |
4651 | |
4652 | |
4653 | - /* skb has no dst, perform route lookup again */ |
4654 | - iph = ip_hdr(head); |
4655 | - err = ip_route_input_noref(head, iph->daddr, iph->saddr, |
4656 | + /* skb has no dst, perform route lookup again */ |
4657 | + iph = ip_hdr(head); |
4658 | + err = ip_route_input_noref(head, iph->daddr, iph->saddr, |
4659 | iph->tos, head->dev); |
4660 | - if (err) |
4661 | - goto out; |
4662 | + if (err) |
4663 | + goto out; |
4664 | |
4665 | - /* Only an end host needs to send an ICMP |
4666 | - * "Fragment Reassembly Timeout" message, per RFC792. |
4667 | - */ |
4668 | - if (frag_expire_skip_icmp(qp->user) && |
4669 | - (skb_rtable(head)->rt_type != RTN_LOCAL)) |
4670 | - goto out; |
4671 | + /* Only an end host needs to send an ICMP |
4672 | + * "Fragment Reassembly Timeout" message, per RFC792. |
4673 | + */ |
4674 | + if (frag_expire_skip_icmp(qp->q.key.v4.user) && |
4675 | + (skb_rtable(head)->rt_type != RTN_LOCAL)) |
4676 | + goto out; |
4677 | |
4678 | - clone = skb_clone(head, GFP_ATOMIC); |
4679 | + spin_unlock(&qp->q.lock); |
4680 | + icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); |
4681 | + goto out_rcu_unlock; |
4682 | |
4683 | - /* Send an ICMP "Fragment Reassembly Timeout" message. */ |
4684 | - if (clone) { |
4685 | - spin_unlock(&qp->q.lock); |
4686 | - icmp_send(clone, ICMP_TIME_EXCEEDED, |
4687 | - ICMP_EXC_FRAGTIME, 0); |
4688 | - consume_skb(clone); |
4689 | - goto out_rcu_unlock; |
4690 | - } |
4691 | - } |
4692 | out: |
4693 | spin_unlock(&qp->q.lock); |
4694 | out_rcu_unlock: |
4695 | rcu_read_unlock(); |
4696 | + if (head) |
4697 | + kfree_skb(head); |
4698 | ipq_put(qp); |
4699 | } |
4700 | |
4701 | @@ -261,21 +271,20 @@ out_rcu_unlock: |
4702 | static struct ipq *ip_find(struct net *net, struct iphdr *iph, |
4703 | u32 user, int vif) |
4704 | { |
4705 | + struct frag_v4_compare_key key = { |
4706 | + .saddr = iph->saddr, |
4707 | + .daddr = iph->daddr, |
4708 | + .user = user, |
4709 | + .vif = vif, |
4710 | + .id = iph->id, |
4711 | + .protocol = iph->protocol, |
4712 | + }; |
4713 | struct inet_frag_queue *q; |
4714 | - struct ip4_create_arg arg; |
4715 | - unsigned int hash; |
4716 | - |
4717 | - arg.iph = iph; |
4718 | - arg.user = user; |
4719 | - arg.vif = vif; |
4720 | |
4721 | - hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol); |
4722 | - |
4723 | - q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash); |
4724 | - if (IS_ERR_OR_NULL(q)) { |
4725 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); |
4726 | + q = inet_frag_find(&net->ipv4.frags, &key); |
4727 | + if (!q) |
4728 | return NULL; |
4729 | - } |
4730 | + |
4731 | return container_of(q, struct ipq, q); |
4732 | } |
4733 | |
4734 | @@ -295,7 +304,7 @@ static int ip_frag_too_far(struct ipq *qp) |
4735 | end = atomic_inc_return(&peer->rid); |
4736 | qp->rid = end; |
4737 | |
4738 | - rc = qp->q.fragments && (end - start) > max; |
4739 | + rc = qp->q.fragments_tail && (end - start) > max; |
4740 | |
4741 | if (rc) { |
4742 | struct net *net; |
4743 | @@ -309,7 +318,6 @@ static int ip_frag_too_far(struct ipq *qp) |
4744 | |
4745 | static int ip_frag_reinit(struct ipq *qp) |
4746 | { |
4747 | - struct sk_buff *fp; |
4748 | unsigned int sum_truesize = 0; |
4749 | |
4750 | if (!mod_timer(&qp->q.timer, jiffies + qp->q.net->timeout)) { |
4751 | @@ -317,21 +325,16 @@ static int ip_frag_reinit(struct ipq *qp) |
4752 | return -ETIMEDOUT; |
4753 | } |
4754 | |
4755 | - fp = qp->q.fragments; |
4756 | - do { |
4757 | - struct sk_buff *xp = fp->next; |
4758 | - |
4759 | - sum_truesize += fp->truesize; |
4760 | - kfree_skb(fp); |
4761 | - fp = xp; |
4762 | - } while (fp); |
4763 | + sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments); |
4764 | sub_frag_mem_limit(qp->q.net, sum_truesize); |
4765 | |
4766 | qp->q.flags = 0; |
4767 | qp->q.len = 0; |
4768 | qp->q.meat = 0; |
4769 | qp->q.fragments = NULL; |
4770 | + qp->q.rb_fragments = RB_ROOT; |
4771 | qp->q.fragments_tail = NULL; |
4772 | + qp->q.last_run_head = NULL; |
4773 | qp->iif = 0; |
4774 | qp->ecn = 0; |
4775 | |
4776 | @@ -341,7 +344,9 @@ static int ip_frag_reinit(struct ipq *qp) |
4777 | /* Add new segment to existing queue. */ |
4778 | static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) |
4779 | { |
4780 | - struct sk_buff *prev, *next; |
4781 | + struct net *net = container_of(qp->q.net, struct net, ipv4.frags); |
4782 | + struct rb_node **rbn, *parent; |
4783 | + struct sk_buff *skb1, *prev_tail; |
4784 | struct net_device *dev; |
4785 | unsigned int fragsize; |
4786 | int flags, offset; |
4787 | @@ -404,99 +409,61 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) |
4788 | if (err) |
4789 | goto err; |
4790 | |
4791 | - /* Find out which fragments are in front and at the back of us |
4792 | - * in the chain of fragments so far. We must know where to put |
4793 | - * this fragment, right? |
4794 | - */ |
4795 | - prev = qp->q.fragments_tail; |
4796 | - if (!prev || FRAG_CB(prev)->offset < offset) { |
4797 | - next = NULL; |
4798 | - goto found; |
4799 | - } |
4800 | - prev = NULL; |
4801 | - for (next = qp->q.fragments; next != NULL; next = next->next) { |
4802 | - if (FRAG_CB(next)->offset >= offset) |
4803 | - break; /* bingo! */ |
4804 | - prev = next; |
4805 | - } |
4806 | - |
4807 | -found: |
4808 | - /* We found where to put this one. Check for overlap with |
4809 | - * preceding fragment, and, if needed, align things so that |
4810 | - * any overlaps are eliminated. |
4811 | + /* Note : skb->rbnode and skb->dev share the same location. */ |
4812 | + dev = skb->dev; |
4813 | + /* Makes sure compiler wont do silly aliasing games */ |
4814 | + barrier(); |
4815 | + |
4816 | + /* RFC5722, Section 4, amended by Errata ID : 3089 |
4817 | + * When reassembling an IPv6 datagram, if |
4818 | + * one or more its constituent fragments is determined to be an |
4819 | + * overlapping fragment, the entire datagram (and any constituent |
4820 | + * fragments) MUST be silently discarded. |
4821 | + * |
4822 | + * We do the same here for IPv4 (and increment an snmp counter). |
4823 | */ |
4824 | - if (prev) { |
4825 | - int i = (FRAG_CB(prev)->offset + prev->len) - offset; |
4826 | |
4827 | - if (i > 0) { |
4828 | - offset += i; |
4829 | - err = -EINVAL; |
4830 | - if (end <= offset) |
4831 | - goto err; |
4832 | - err = -ENOMEM; |
4833 | - if (!pskb_pull(skb, i)) |
4834 | - goto err; |
4835 | - if (skb->ip_summed != CHECKSUM_UNNECESSARY) |
4836 | - skb->ip_summed = CHECKSUM_NONE; |
4837 | - } |
4838 | - } |
4839 | - |
4840 | - err = -ENOMEM; |
4841 | - |
4842 | - while (next && FRAG_CB(next)->offset < end) { |
4843 | - int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ |
4844 | - |
4845 | - if (i < next->len) { |
4846 | - int delta = -next->truesize; |
4847 | - |
4848 | - /* Eat head of the next overlapped fragment |
4849 | - * and leave the loop. The next ones cannot overlap. |
4850 | - */ |
4851 | - if (!pskb_pull(next, i)) |
4852 | - goto err; |
4853 | - delta += next->truesize; |
4854 | - if (delta) |
4855 | - add_frag_mem_limit(qp->q.net, delta); |
4856 | - FRAG_CB(next)->offset += i; |
4857 | - qp->q.meat -= i; |
4858 | - if (next->ip_summed != CHECKSUM_UNNECESSARY) |
4859 | - next->ip_summed = CHECKSUM_NONE; |
4860 | - break; |
4861 | - } else { |
4862 | - struct sk_buff *free_it = next; |
4863 | - |
4864 | - /* Old fragment is completely overridden with |
4865 | - * new one drop it. |
4866 | - */ |
4867 | - next = next->next; |
4868 | - |
4869 | - if (prev) |
4870 | - prev->next = next; |
4871 | - else |
4872 | - qp->q.fragments = next; |
4873 | - |
4874 | - qp->q.meat -= free_it->len; |
4875 | - sub_frag_mem_limit(qp->q.net, free_it->truesize); |
4876 | - kfree_skb(free_it); |
4877 | - } |
4878 | + /* Find out where to put this fragment. */ |
4879 | + prev_tail = qp->q.fragments_tail; |
4880 | + if (!prev_tail) |
4881 | + ip4_frag_create_run(&qp->q, skb); /* First fragment. */ |
4882 | + else if (prev_tail->ip_defrag_offset + prev_tail->len < end) { |
4883 | + /* This is the common case: skb goes to the end. */ |
4884 | + /* Detect and discard overlaps. */ |
4885 | + if (offset < prev_tail->ip_defrag_offset + prev_tail->len) |
4886 | + goto discard_qp; |
4887 | + if (offset == prev_tail->ip_defrag_offset + prev_tail->len) |
4888 | + ip4_frag_append_to_last_run(&qp->q, skb); |
4889 | + else |
4890 | + ip4_frag_create_run(&qp->q, skb); |
4891 | + } else { |
4892 | + /* Binary search. Note that skb can become the first fragment, |
4893 | + * but not the last (covered above). |
4894 | + */ |
4895 | + rbn = &qp->q.rb_fragments.rb_node; |
4896 | + do { |
4897 | + parent = *rbn; |
4898 | + skb1 = rb_to_skb(parent); |
4899 | + if (end <= skb1->ip_defrag_offset) |
4900 | + rbn = &parent->rb_left; |
4901 | + else if (offset >= skb1->ip_defrag_offset + |
4902 | + FRAG_CB(skb1)->frag_run_len) |
4903 | + rbn = &parent->rb_right; |
4904 | + else /* Found an overlap with skb1. */ |
4905 | + goto discard_qp; |
4906 | + } while (*rbn); |
4907 | + /* Here we have parent properly set, and rbn pointing to |
4908 | + * one of its NULL left/right children. Insert skb. |
4909 | + */ |
4910 | + ip4_frag_init_run(skb); |
4911 | + rb_link_node(&skb->rbnode, parent, rbn); |
4912 | + rb_insert_color(&skb->rbnode, &qp->q.rb_fragments); |
4913 | } |
4914 | |
4915 | - FRAG_CB(skb)->offset = offset; |
4916 | - |
4917 | - /* Insert this fragment in the chain of fragments. */ |
4918 | - skb->next = next; |
4919 | - if (!next) |
4920 | - qp->q.fragments_tail = skb; |
4921 | - if (prev) |
4922 | - prev->next = skb; |
4923 | - else |
4924 | - qp->q.fragments = skb; |
4925 | - |
4926 | - dev = skb->dev; |
4927 | - if (dev) { |
4928 | + if (dev) |
4929 | qp->iif = dev->ifindex; |
4930 | - skb->dev = NULL; |
4931 | - } |
4932 | + skb->ip_defrag_offset = offset; |
4933 | + |
4934 | qp->q.stamp = skb->tstamp; |
4935 | qp->q.meat += skb->len; |
4936 | qp->ecn |= ecn; |
4937 | @@ -518,7 +485,7 @@ found: |
4938 | unsigned long orefdst = skb->_skb_refdst; |
4939 | |
4940 | skb->_skb_refdst = 0UL; |
4941 | - err = ip_frag_reasm(qp, prev, dev); |
4942 | + err = ip_frag_reasm(qp, skb, prev_tail, dev); |
4943 | skb->_skb_refdst = orefdst; |
4944 | return err; |
4945 | } |
4946 | @@ -526,20 +493,24 @@ found: |
4947 | skb_dst_drop(skb); |
4948 | return -EINPROGRESS; |
4949 | |
4950 | +discard_qp: |
4951 | + inet_frag_kill(&qp->q); |
4952 | + err = -EINVAL; |
4953 | + __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS); |
4954 | err: |
4955 | kfree_skb(skb); |
4956 | return err; |
4957 | } |
4958 | |
4959 | - |
4960 | /* Build a new IP datagram from all its fragments. */ |
4961 | - |
4962 | -static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
4963 | - struct net_device *dev) |
4964 | +static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, |
4965 | + struct sk_buff *prev_tail, struct net_device *dev) |
4966 | { |
4967 | struct net *net = container_of(qp->q.net, struct net, ipv4.frags); |
4968 | struct iphdr *iph; |
4969 | - struct sk_buff *fp, *head = qp->q.fragments; |
4970 | + struct sk_buff *fp, *head = skb_rb_first(&qp->q.rb_fragments); |
4971 | + struct sk_buff **nextp; /* To build frag_list. */ |
4972 | + struct rb_node *rbn; |
4973 | int len; |
4974 | int ihlen; |
4975 | int err; |
4976 | @@ -553,26 +524,27 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
4977 | goto out_fail; |
4978 | } |
4979 | /* Make the one we just received the head. */ |
4980 | - if (prev) { |
4981 | - head = prev->next; |
4982 | - fp = skb_clone(head, GFP_ATOMIC); |
4983 | + if (head != skb) { |
4984 | + fp = skb_clone(skb, GFP_ATOMIC); |
4985 | if (!fp) |
4986 | goto out_nomem; |
4987 | - |
4988 | - fp->next = head->next; |
4989 | - if (!fp->next) |
4990 | + FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag; |
4991 | + if (RB_EMPTY_NODE(&skb->rbnode)) |
4992 | + FRAG_CB(prev_tail)->next_frag = fp; |
4993 | + else |
4994 | + rb_replace_node(&skb->rbnode, &fp->rbnode, |
4995 | + &qp->q.rb_fragments); |
4996 | + if (qp->q.fragments_tail == skb) |
4997 | qp->q.fragments_tail = fp; |
4998 | - prev->next = fp; |
4999 | - |
5000 | - skb_morph(head, qp->q.fragments); |
5001 | - head->next = qp->q.fragments->next; |
5002 | - |
5003 | - consume_skb(qp->q.fragments); |
5004 | - qp->q.fragments = head; |
5005 | + skb_morph(skb, head); |
5006 | + FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag; |
5007 | + rb_replace_node(&head->rbnode, &skb->rbnode, |
5008 | + &qp->q.rb_fragments); |
5009 | + consume_skb(head); |
5010 | + head = skb; |
5011 | } |
5012 | |
5013 | - WARN_ON(!head); |
5014 | - WARN_ON(FRAG_CB(head)->offset != 0); |
5015 | + WARN_ON(head->ip_defrag_offset != 0); |
5016 | |
5017 | /* Allocate a new buffer for the datagram. */ |
5018 | ihlen = ip_hdrlen(head); |
5019 | @@ -596,35 +568,61 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
5020 | clone = alloc_skb(0, GFP_ATOMIC); |
5021 | if (!clone) |
5022 | goto out_nomem; |
5023 | - clone->next = head->next; |
5024 | - head->next = clone; |
5025 | skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; |
5026 | skb_frag_list_init(head); |
5027 | for (i = 0; i < skb_shinfo(head)->nr_frags; i++) |
5028 | plen += skb_frag_size(&skb_shinfo(head)->frags[i]); |
5029 | clone->len = clone->data_len = head->data_len - plen; |
5030 | - head->data_len -= clone->len; |
5031 | - head->len -= clone->len; |
5032 | + head->truesize += clone->truesize; |
5033 | clone->csum = 0; |
5034 | clone->ip_summed = head->ip_summed; |
5035 | add_frag_mem_limit(qp->q.net, clone->truesize); |
5036 | + skb_shinfo(head)->frag_list = clone; |
5037 | + nextp = &clone->next; |
5038 | + } else { |
5039 | + nextp = &skb_shinfo(head)->frag_list; |
5040 | } |
5041 | |
5042 | - skb_shinfo(head)->frag_list = head->next; |
5043 | skb_push(head, head->data - skb_network_header(head)); |
5044 | |
5045 | - for (fp=head->next; fp; fp = fp->next) { |
5046 | - head->data_len += fp->len; |
5047 | - head->len += fp->len; |
5048 | - if (head->ip_summed != fp->ip_summed) |
5049 | - head->ip_summed = CHECKSUM_NONE; |
5050 | - else if (head->ip_summed == CHECKSUM_COMPLETE) |
5051 | - head->csum = csum_add(head->csum, fp->csum); |
5052 | - head->truesize += fp->truesize; |
5053 | + /* Traverse the tree in order, to build frag_list. */ |
5054 | + fp = FRAG_CB(head)->next_frag; |
5055 | + rbn = rb_next(&head->rbnode); |
5056 | + rb_erase(&head->rbnode, &qp->q.rb_fragments); |
5057 | + while (rbn || fp) { |
5058 | + /* fp points to the next sk_buff in the current run; |
5059 | + * rbn points to the next run. |
5060 | + */ |
5061 | + /* Go through the current run. */ |
5062 | + while (fp) { |
5063 | + *nextp = fp; |
5064 | + nextp = &fp->next; |
5065 | + fp->prev = NULL; |
5066 | + memset(&fp->rbnode, 0, sizeof(fp->rbnode)); |
5067 | + fp->sk = NULL; |
5068 | + head->data_len += fp->len; |
5069 | + head->len += fp->len; |
5070 | + if (head->ip_summed != fp->ip_summed) |
5071 | + head->ip_summed = CHECKSUM_NONE; |
5072 | + else if (head->ip_summed == CHECKSUM_COMPLETE) |
5073 | + head->csum = csum_add(head->csum, fp->csum); |
5074 | + head->truesize += fp->truesize; |
5075 | + fp = FRAG_CB(fp)->next_frag; |
5076 | + } |
5077 | + /* Move to the next run. */ |
5078 | + if (rbn) { |
5079 | + struct rb_node *rbnext = rb_next(rbn); |
5080 | + |
5081 | + fp = rb_to_skb(rbn); |
5082 | + rb_erase(rbn, &qp->q.rb_fragments); |
5083 | + rbn = rbnext; |
5084 | + } |
5085 | } |
5086 | sub_frag_mem_limit(qp->q.net, head->truesize); |
5087 | |
5088 | + *nextp = NULL; |
5089 | head->next = NULL; |
5090 | + head->prev = NULL; |
5091 | head->dev = dev; |
5092 | head->tstamp = qp->q.stamp; |
5093 | IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size); |
5094 | @@ -652,7 +650,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
5095 | |
5096 | __IP_INC_STATS(net, IPSTATS_MIB_REASMOKS); |
5097 | qp->q.fragments = NULL; |
5098 | + qp->q.rb_fragments = RB_ROOT; |
5099 | qp->q.fragments_tail = NULL; |
5100 | + qp->q.last_run_head = NULL; |
5101 | return 0; |
5102 | |
5103 | out_nomem: |
5104 | @@ -660,7 +660,7 @@ out_nomem: |
5105 | err = -ENOMEM; |
5106 | goto out_fail; |
5107 | out_oversize: |
5108 | - net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->saddr); |
5109 | + net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr); |
5110 | out_fail: |
5111 | __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); |
5112 | return err; |
5113 | @@ -734,25 +734,46 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user) |
5114 | } |
5115 | EXPORT_SYMBOL(ip_check_defrag); |
5116 | |
5117 | +unsigned int inet_frag_rbtree_purge(struct rb_root *root) |
5118 | +{ |
5119 | + struct rb_node *p = rb_first(root); |
5120 | + unsigned int sum = 0; |
5121 | + |
5122 | + while (p) { |
5123 | + struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); |
5124 | + |
5125 | + p = rb_next(p); |
5126 | + rb_erase(&skb->rbnode, root); |
5127 | + while (skb) { |
5128 | + struct sk_buff *next = FRAG_CB(skb)->next_frag; |
5129 | + |
5130 | + sum += skb->truesize; |
5131 | + kfree_skb(skb); |
5132 | + skb = next; |
5133 | + } |
5134 | + } |
5135 | + return sum; |
5136 | +} |
5137 | +EXPORT_SYMBOL(inet_frag_rbtree_purge); |
5138 | + |
5139 | #ifdef CONFIG_SYSCTL |
5140 | -static int zero; |
5141 | +static int dist_min; |
5142 | |
5143 | static struct ctl_table ip4_frags_ns_ctl_table[] = { |
5144 | { |
5145 | .procname = "ipfrag_high_thresh", |
5146 | .data = &init_net.ipv4.frags.high_thresh, |
5147 | - .maxlen = sizeof(int), |
5148 | + .maxlen = sizeof(unsigned long), |
5149 | .mode = 0644, |
5150 | - .proc_handler = proc_dointvec_minmax, |
5151 | + .proc_handler = proc_doulongvec_minmax, |
5152 | .extra1 = &init_net.ipv4.frags.low_thresh |
5153 | }, |
5154 | { |
5155 | .procname = "ipfrag_low_thresh", |
5156 | .data = &init_net.ipv4.frags.low_thresh, |
5157 | - .maxlen = sizeof(int), |
5158 | + .maxlen = sizeof(unsigned long), |
5159 | .mode = 0644, |
5160 | - .proc_handler = proc_dointvec_minmax, |
5161 | - .extra1 = &zero, |
5162 | + .proc_handler = proc_doulongvec_minmax, |
5163 | .extra2 = &init_net.ipv4.frags.high_thresh |
5164 | }, |
5165 | { |
5166 | @@ -768,7 +789,7 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = { |
5167 | .maxlen = sizeof(int), |
5168 | .mode = 0644, |
5169 | .proc_handler = proc_dointvec_minmax, |
5170 | - .extra1 = &zero |
5171 | + .extra1 = &dist_min, |
5172 | }, |
5173 | { } |
5174 | }; |
5175 | @@ -850,6 +871,8 @@ static void __init ip4_frags_ctl_register(void) |
5176 | |
5177 | static int __net_init ipv4_frags_init_net(struct net *net) |
5178 | { |
5179 | + int res; |
5180 | + |
5181 | /* Fragment cache limits. |
5182 | * |
5183 | * The fragment memory accounting code, (tries to) account for |
5184 | @@ -874,16 +897,21 @@ static int __net_init ipv4_frags_init_net(struct net *net) |
5185 | net->ipv4.frags.timeout = IP_FRAG_TIME; |
5186 | |
5187 | net->ipv4.frags.max_dist = 64; |
5188 | - |
5189 | - inet_frags_init_net(&net->ipv4.frags); |
5190 | - |
5191 | - return ip4_frags_ns_ctl_register(net); |
5192 | + net->ipv4.frags.f = &ip4_frags; |
5193 | + |
5194 | + res = inet_frags_init_net(&net->ipv4.frags); |
5195 | + if (res < 0) |
5196 | + return res; |
5197 | + res = ip4_frags_ns_ctl_register(net); |
5198 | + if (res < 0) |
5199 | + inet_frags_exit_net(&net->ipv4.frags); |
5200 | + return res; |
5201 | } |
5202 | |
5203 | static void __net_exit ipv4_frags_exit_net(struct net *net) |
5204 | { |
5205 | ip4_frags_ns_ctl_unregister(net); |
5206 | - inet_frags_exit_net(&net->ipv4.frags, &ip4_frags); |
5207 | + inet_frags_exit_net(&net->ipv4.frags); |
5208 | } |
5209 | |
5210 | static struct pernet_operations ip4_frags_ops = { |
5211 | @@ -891,17 +919,49 @@ static struct pernet_operations ip4_frags_ops = { |
5212 | .exit = ipv4_frags_exit_net, |
5213 | }; |
5214 | |
5215 | + |
5216 | +static u32 ip4_key_hashfn(const void *data, u32 len, u32 seed) |
5217 | +{ |
5218 | + return jhash2(data, |
5219 | + sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); |
5220 | +} |
5221 | + |
5222 | +static u32 ip4_obj_hashfn(const void *data, u32 len, u32 seed) |
5223 | +{ |
5224 | + const struct inet_frag_queue *fq = data; |
5225 | + |
5226 | + return jhash2((const u32 *)&fq->key.v4, |
5227 | + sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); |
5228 | +} |
5229 | + |
5230 | +static int ip4_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) |
5231 | +{ |
5232 | + const struct frag_v4_compare_key *key = arg->key; |
5233 | + const struct inet_frag_queue *fq = ptr; |
5234 | + |
5235 | + return !!memcmp(&fq->key, key, sizeof(*key)); |
5236 | +} |
5237 | + |
5238 | +static const struct rhashtable_params ip4_rhash_params = { |
5239 | + .head_offset = offsetof(struct inet_frag_queue, node), |
5240 | + .key_offset = offsetof(struct inet_frag_queue, key), |
5241 | + .key_len = sizeof(struct frag_v4_compare_key), |
5242 | + .hashfn = ip4_key_hashfn, |
5243 | + .obj_hashfn = ip4_obj_hashfn, |
5244 | + .obj_cmpfn = ip4_obj_cmpfn, |
5245 | + .automatic_shrinking = true, |
5246 | +}; |
5247 | + |
5248 | void __init ipfrag_init(void) |
5249 | { |
5250 | - ip4_frags_ctl_register(); |
5251 | - register_pernet_subsys(&ip4_frags_ops); |
5252 | - ip4_frags.hashfn = ip4_hashfn; |
5253 | ip4_frags.constructor = ip4_frag_init; |
5254 | ip4_frags.destructor = ip4_frag_free; |
5255 | ip4_frags.qsize = sizeof(struct ipq); |
5256 | - ip4_frags.match = ip4_frag_match; |
5257 | ip4_frags.frag_expire = ip_expire; |
5258 | ip4_frags.frags_cache_name = ip_frag_cache_name; |
5259 | + ip4_frags.rhash_params = ip4_rhash_params; |
5260 | if (inet_frags_init(&ip4_frags)) |
5261 | panic("IP: failed to allocate ip4_frags cache\n"); |
5262 | + ip4_frags_ctl_register(); |
5263 | + register_pernet_subsys(&ip4_frags_ops); |
5264 | } |
5265 | diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c |
5266 | index 127153f1ed8a..3fbf688a1943 100644 |
5267 | --- a/net/ipv4/proc.c |
5268 | +++ b/net/ipv4/proc.c |
5269 | @@ -54,7 +54,6 @@ |
5270 | static int sockstat_seq_show(struct seq_file *seq, void *v) |
5271 | { |
5272 | struct net *net = seq->private; |
5273 | - unsigned int frag_mem; |
5274 | int orphans, sockets; |
5275 | |
5276 | orphans = percpu_counter_sum_positive(&tcp_orphan_count); |
5277 | @@ -72,8 +71,9 @@ static int sockstat_seq_show(struct seq_file *seq, void *v) |
5278 | sock_prot_inuse_get(net, &udplite_prot)); |
5279 | seq_printf(seq, "RAW: inuse %d\n", |
5280 | sock_prot_inuse_get(net, &raw_prot)); |
5281 | - frag_mem = ip_frag_mem(net); |
5282 | - seq_printf(seq, "FRAG: inuse %u memory %u\n", !!frag_mem, frag_mem); |
5283 | + seq_printf(seq, "FRAG: inuse %u memory %lu\n", |
5284 | + atomic_read(&net->ipv4.frags.rhashtable.nelems), |
5285 | + frag_mem_limit(&net->ipv4.frags)); |
5286 | return 0; |
5287 | } |
5288 | |
5289 | @@ -132,6 +132,7 @@ static const struct snmp_mib snmp4_ipextstats_list[] = { |
5290 | SNMP_MIB_ITEM("InECT1Pkts", IPSTATS_MIB_ECT1PKTS), |
5291 | SNMP_MIB_ITEM("InECT0Pkts", IPSTATS_MIB_ECT0PKTS), |
5292 | SNMP_MIB_ITEM("InCEPkts", IPSTATS_MIB_CEPKTS), |
5293 | + SNMP_MIB_ITEM("ReasmOverlaps", IPSTATS_MIB_REASM_OVERLAPS), |
5294 | SNMP_MIB_SENTINEL |
5295 | }; |
5296 | |
5297 | diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c |
5298 | index fbbeda647774..0567edb76522 100644 |
5299 | --- a/net/ipv4/tcp_fastopen.c |
5300 | +++ b/net/ipv4/tcp_fastopen.c |
5301 | @@ -458,17 +458,15 @@ bool tcp_fastopen_active_should_disable(struct sock *sk) |
5302 | void tcp_fastopen_active_disable_ofo_check(struct sock *sk) |
5303 | { |
5304 | struct tcp_sock *tp = tcp_sk(sk); |
5305 | - struct rb_node *p; |
5306 | - struct sk_buff *skb; |
5307 | struct dst_entry *dst; |
5308 | + struct sk_buff *skb; |
5309 | |
5310 | if (!tp->syn_fastopen) |
5311 | return; |
5312 | |
5313 | if (!tp->data_segs_in) { |
5314 | - p = rb_first(&tp->out_of_order_queue); |
5315 | - if (p && !rb_next(p)) { |
5316 | - skb = rb_entry(p, struct sk_buff, rbnode); |
5317 | + skb = skb_rb_first(&tp->out_of_order_queue); |
5318 | + if (skb && !skb_rb_next(skb)) { |
5319 | if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) { |
5320 | tcp_fastopen_active_disable(sk); |
5321 | return; |
5322 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c |
5323 | index bdabd748f4bc..991f382afc1b 100644 |
5324 | --- a/net/ipv4/tcp_input.c |
5325 | +++ b/net/ipv4/tcp_input.c |
5326 | @@ -4372,7 +4372,7 @@ static void tcp_ofo_queue(struct sock *sk) |
5327 | |
5328 | p = rb_first(&tp->out_of_order_queue); |
5329 | while (p) { |
5330 | - skb = rb_entry(p, struct sk_buff, rbnode); |
5331 | + skb = rb_to_skb(p); |
5332 | if (after(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) |
5333 | break; |
5334 | |
5335 | @@ -4440,7 +4440,7 @@ static int tcp_try_rmem_schedule(struct sock *sk, struct sk_buff *skb, |
5336 | static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) |
5337 | { |
5338 | struct tcp_sock *tp = tcp_sk(sk); |
5339 | - struct rb_node **p, *q, *parent; |
5340 | + struct rb_node **p, *parent; |
5341 | struct sk_buff *skb1; |
5342 | u32 seq, end_seq; |
5343 | bool fragstolen; |
5344 | @@ -4503,7 +4503,7 @@ coalesce_done: |
5345 | parent = NULL; |
5346 | while (*p) { |
5347 | parent = *p; |
5348 | - skb1 = rb_entry(parent, struct sk_buff, rbnode); |
5349 | + skb1 = rb_to_skb(parent); |
5350 | if (before(seq, TCP_SKB_CB(skb1)->seq)) { |
5351 | p = &parent->rb_left; |
5352 | continue; |
5353 | @@ -4548,9 +4548,7 @@ insert: |
5354 | |
5355 | merge_right: |
5356 | /* Remove other segments covered by skb. */ |
5357 | - while ((q = rb_next(&skb->rbnode)) != NULL) { |
5358 | - skb1 = rb_entry(q, struct sk_buff, rbnode); |
5359 | - |
5360 | + while ((skb1 = skb_rb_next(skb)) != NULL) { |
5361 | if (!after(end_seq, TCP_SKB_CB(skb1)->seq)) |
5362 | break; |
5363 | if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) { |
5364 | @@ -4565,7 +4563,7 @@ merge_right: |
5365 | tcp_drop(sk, skb1); |
5366 | } |
5367 | /* If there is no skb after us, we are the last_skb ! */ |
5368 | - if (!q) |
5369 | + if (!skb1) |
5370 | tp->ooo_last_skb = skb; |
5371 | |
5372 | add_sack: |
5373 | @@ -4749,7 +4747,7 @@ static struct sk_buff *tcp_skb_next(struct sk_buff *skb, struct sk_buff_head *li |
5374 | if (list) |
5375 | return !skb_queue_is_last(list, skb) ? skb->next : NULL; |
5376 | |
5377 | - return rb_entry_safe(rb_next(&skb->rbnode), struct sk_buff, rbnode); |
5378 | + return skb_rb_next(skb); |
5379 | } |
5380 | |
5381 | static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb, |
5382 | @@ -4778,7 +4776,7 @@ static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb) |
5383 | |
5384 | while (*p) { |
5385 | parent = *p; |
5386 | - skb1 = rb_entry(parent, struct sk_buff, rbnode); |
5387 | + skb1 = rb_to_skb(parent); |
5388 | if (before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb1)->seq)) |
5389 | p = &parent->rb_left; |
5390 | else |
5391 | @@ -4898,19 +4896,12 @@ static void tcp_collapse_ofo_queue(struct sock *sk) |
5392 | struct tcp_sock *tp = tcp_sk(sk); |
5393 | u32 range_truesize, sum_tiny = 0; |
5394 | struct sk_buff *skb, *head; |
5395 | - struct rb_node *p; |
5396 | u32 start, end; |
5397 | |
5398 | - p = rb_first(&tp->out_of_order_queue); |
5399 | - skb = rb_entry_safe(p, struct sk_buff, rbnode); |
5400 | + skb = skb_rb_first(&tp->out_of_order_queue); |
5401 | new_range: |
5402 | if (!skb) { |
5403 | - p = rb_last(&tp->out_of_order_queue); |
5404 | - /* Note: This is possible p is NULL here. We do not |
5405 | - * use rb_entry_safe(), as ooo_last_skb is valid only |
5406 | - * if rbtree is not empty. |
5407 | - */ |
5408 | - tp->ooo_last_skb = rb_entry(p, struct sk_buff, rbnode); |
5409 | + tp->ooo_last_skb = skb_rb_last(&tp->out_of_order_queue); |
5410 | return; |
5411 | } |
5412 | start = TCP_SKB_CB(skb)->seq; |
5413 | @@ -4918,7 +4909,7 @@ new_range: |
5414 | range_truesize = skb->truesize; |
5415 | |
5416 | for (head = skb;;) { |
5417 | - skb = tcp_skb_next(skb, NULL); |
5418 | + skb = skb_rb_next(skb); |
5419 | |
5420 | /* Range is terminated when we see a gap or when |
5421 | * we are at the queue end. |
5422 | @@ -4974,7 +4965,7 @@ static bool tcp_prune_ofo_queue(struct sock *sk) |
5423 | prev = rb_prev(node); |
5424 | rb_erase(node, &tp->out_of_order_queue); |
5425 | goal -= rb_to_skb(node)->truesize; |
5426 | - tcp_drop(sk, rb_entry(node, struct sk_buff, rbnode)); |
5427 | + tcp_drop(sk, rb_to_skb(node)); |
5428 | if (!prev || goal <= 0) { |
5429 | sk_mem_reclaim(sk); |
5430 | if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && |
5431 | @@ -4984,7 +4975,7 @@ static bool tcp_prune_ofo_queue(struct sock *sk) |
5432 | } |
5433 | node = prev; |
5434 | } while (node); |
5435 | - tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode); |
5436 | + tp->ooo_last_skb = rb_to_skb(prev); |
5437 | |
5438 | /* Reset SACK state. A conforming SACK implementation will |
5439 | * do the same at a timeout based retransmit. When a connection |
5440 | diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c |
5441 | index ee33a6743f3b..2ed8536e10b6 100644 |
5442 | --- a/net/ipv6/netfilter/nf_conntrack_reasm.c |
5443 | +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c |
5444 | @@ -63,7 +63,6 @@ struct nf_ct_frag6_skb_cb |
5445 | static struct inet_frags nf_frags; |
5446 | |
5447 | #ifdef CONFIG_SYSCTL |
5448 | -static int zero; |
5449 | |
5450 | static struct ctl_table nf_ct_frag6_sysctl_table[] = { |
5451 | { |
5452 | @@ -76,18 +75,17 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = { |
5453 | { |
5454 | .procname = "nf_conntrack_frag6_low_thresh", |
5455 | .data = &init_net.nf_frag.frags.low_thresh, |
5456 | - .maxlen = sizeof(unsigned int), |
5457 | + .maxlen = sizeof(unsigned long), |
5458 | .mode = 0644, |
5459 | - .proc_handler = proc_dointvec_minmax, |
5460 | - .extra1 = &zero, |
5461 | + .proc_handler = proc_doulongvec_minmax, |
5462 | .extra2 = &init_net.nf_frag.frags.high_thresh |
5463 | }, |
5464 | { |
5465 | .procname = "nf_conntrack_frag6_high_thresh", |
5466 | .data = &init_net.nf_frag.frags.high_thresh, |
5467 | - .maxlen = sizeof(unsigned int), |
5468 | + .maxlen = sizeof(unsigned long), |
5469 | .mode = 0644, |
5470 | - .proc_handler = proc_dointvec_minmax, |
5471 | + .proc_handler = proc_doulongvec_minmax, |
5472 | .extra1 = &init_net.nf_frag.frags.low_thresh |
5473 | }, |
5474 | { } |
5475 | @@ -152,59 +150,35 @@ static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h) |
5476 | return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK); |
5477 | } |
5478 | |
5479 | -static unsigned int nf_hash_frag(__be32 id, const struct in6_addr *saddr, |
5480 | - const struct in6_addr *daddr) |
5481 | -{ |
5482 | - net_get_random_once(&nf_frags.rnd, sizeof(nf_frags.rnd)); |
5483 | - return jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), |
5484 | - (__force u32)id, nf_frags.rnd); |
5485 | -} |
5486 | - |
5487 | - |
5488 | -static unsigned int nf_hashfn(const struct inet_frag_queue *q) |
5489 | -{ |
5490 | - const struct frag_queue *nq; |
5491 | - |
5492 | - nq = container_of(q, struct frag_queue, q); |
5493 | - return nf_hash_frag(nq->id, &nq->saddr, &nq->daddr); |
5494 | -} |
5495 | - |
5496 | -static void nf_ct_frag6_expire(unsigned long data) |
5497 | +static void nf_ct_frag6_expire(struct timer_list *t) |
5498 | { |
5499 | + struct inet_frag_queue *frag = from_timer(frag, t, timer); |
5500 | struct frag_queue *fq; |
5501 | struct net *net; |
5502 | |
5503 | - fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); |
5504 | + fq = container_of(frag, struct frag_queue, q); |
5505 | net = container_of(fq->q.net, struct net, nf_frag.frags); |
5506 | |
5507 | - ip6_expire_frag_queue(net, fq, &nf_frags); |
5508 | + ip6_expire_frag_queue(net, fq); |
5509 | } |
5510 | |
5511 | /* Creation primitives. */ |
5512 | -static inline struct frag_queue *fq_find(struct net *net, __be32 id, |
5513 | - u32 user, struct in6_addr *src, |
5514 | - struct in6_addr *dst, int iif, u8 ecn) |
5515 | +static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user, |
5516 | + const struct ipv6hdr *hdr, int iif) |
5517 | { |
5518 | + struct frag_v6_compare_key key = { |
5519 | + .id = id, |
5520 | + .saddr = hdr->saddr, |
5521 | + .daddr = hdr->daddr, |
5522 | + .user = user, |
5523 | + .iif = iif, |
5524 | + }; |
5525 | struct inet_frag_queue *q; |
5526 | - struct ip6_create_arg arg; |
5527 | - unsigned int hash; |
5528 | - |
5529 | - arg.id = id; |
5530 | - arg.user = user; |
5531 | - arg.src = src; |
5532 | - arg.dst = dst; |
5533 | - arg.iif = iif; |
5534 | - arg.ecn = ecn; |
5535 | - |
5536 | - local_bh_disable(); |
5537 | - hash = nf_hash_frag(id, src, dst); |
5538 | - |
5539 | - q = inet_frag_find(&net->nf_frag.frags, &nf_frags, &arg, hash); |
5540 | - local_bh_enable(); |
5541 | - if (IS_ERR_OR_NULL(q)) { |
5542 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); |
5543 | + |
5544 | + q = inet_frag_find(&net->nf_frag.frags, &key); |
5545 | + if (!q) |
5546 | return NULL; |
5547 | - } |
5548 | + |
5549 | return container_of(q, struct frag_queue, q); |
5550 | } |
5551 | |
5552 | @@ -263,7 +237,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, |
5553 | * this case. -DaveM |
5554 | */ |
5555 | pr_debug("end of fragment not rounded to 8 bytes.\n"); |
5556 | - inet_frag_kill(&fq->q, &nf_frags); |
5557 | + inet_frag_kill(&fq->q); |
5558 | return -EPROTO; |
5559 | } |
5560 | if (end > fq->q.len) { |
5561 | @@ -356,7 +330,7 @@ found: |
5562 | return 0; |
5563 | |
5564 | discard_fq: |
5565 | - inet_frag_kill(&fq->q, &nf_frags); |
5566 | + inet_frag_kill(&fq->q); |
5567 | err: |
5568 | return -EINVAL; |
5569 | } |
5570 | @@ -378,7 +352,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic |
5571 | int payload_len; |
5572 | u8 ecn; |
5573 | |
5574 | - inet_frag_kill(&fq->q, &nf_frags); |
5575 | + inet_frag_kill(&fq->q); |
5576 | |
5577 | WARN_ON(head == NULL); |
5578 | WARN_ON(NFCT_FRAG6_CB(head)->offset != 0); |
5579 | @@ -479,6 +453,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic |
5580 | else if (head->ip_summed == CHECKSUM_COMPLETE) |
5581 | head->csum = csum_add(head->csum, fp->csum); |
5582 | head->truesize += fp->truesize; |
5583 | + fp->sk = NULL; |
5584 | } |
5585 | sub_frag_mem_limit(fq->q.net, head->truesize); |
5586 | |
5587 | @@ -497,6 +472,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic |
5588 | head->csum); |
5589 | |
5590 | fq->q.fragments = NULL; |
5591 | + fq->q.rb_fragments = RB_ROOT; |
5592 | fq->q.fragments_tail = NULL; |
5593 | |
5594 | return true; |
5595 | @@ -591,9 +567,13 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) |
5596 | hdr = ipv6_hdr(skb); |
5597 | fhdr = (struct frag_hdr *)skb_transport_header(skb); |
5598 | |
5599 | + if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU && |
5600 | + fhdr->frag_off & htons(IP6_MF)) |
5601 | + return -EINVAL; |
5602 | + |
5603 | skb_orphan(skb); |
5604 | - fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr, |
5605 | - skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); |
5606 | + fq = fq_find(net, fhdr->identification, user, hdr, |
5607 | + skb->dev ? skb->dev->ifindex : 0); |
5608 | if (fq == NULL) { |
5609 | pr_debug("Can't find and can't create new queue\n"); |
5610 | return -ENOMEM; |
5611 | @@ -623,25 +603,33 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) |
5612 | |
5613 | out_unlock: |
5614 | spin_unlock_bh(&fq->q.lock); |
5615 | - inet_frag_put(&fq->q, &nf_frags); |
5616 | + inet_frag_put(&fq->q); |
5617 | return ret; |
5618 | } |
5619 | EXPORT_SYMBOL_GPL(nf_ct_frag6_gather); |
5620 | |
5621 | static int nf_ct_net_init(struct net *net) |
5622 | { |
5623 | + int res; |
5624 | + |
5625 | net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; |
5626 | net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH; |
5627 | net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT; |
5628 | - inet_frags_init_net(&net->nf_frag.frags); |
5629 | - |
5630 | - return nf_ct_frag6_sysctl_register(net); |
5631 | + net->nf_frag.frags.f = &nf_frags; |
5632 | + |
5633 | + res = inet_frags_init_net(&net->nf_frag.frags); |
5634 | + if (res < 0) |
5635 | + return res; |
5636 | + res = nf_ct_frag6_sysctl_register(net); |
5637 | + if (res < 0) |
5638 | + inet_frags_exit_net(&net->nf_frag.frags); |
5639 | + return res; |
5640 | } |
5641 | |
5642 | static void nf_ct_net_exit(struct net *net) |
5643 | { |
5644 | nf_ct_frags6_sysctl_unregister(net); |
5645 | - inet_frags_exit_net(&net->nf_frag.frags, &nf_frags); |
5646 | + inet_frags_exit_net(&net->nf_frag.frags); |
5647 | } |
5648 | |
5649 | static struct pernet_operations nf_ct_net_ops = { |
5650 | @@ -653,13 +641,12 @@ int nf_ct_frag6_init(void) |
5651 | { |
5652 | int ret = 0; |
5653 | |
5654 | - nf_frags.hashfn = nf_hashfn; |
5655 | nf_frags.constructor = ip6_frag_init; |
5656 | nf_frags.destructor = NULL; |
5657 | nf_frags.qsize = sizeof(struct frag_queue); |
5658 | - nf_frags.match = ip6_frag_match; |
5659 | nf_frags.frag_expire = nf_ct_frag6_expire; |
5660 | nf_frags.frags_cache_name = nf_frags_cache_name; |
5661 | + nf_frags.rhash_params = ip6_rhash_params; |
5662 | ret = inet_frags_init(&nf_frags); |
5663 | if (ret) |
5664 | goto out; |
5665 | diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c |
5666 | index e88bcb8ff0fd..dc04c024986c 100644 |
5667 | --- a/net/ipv6/proc.c |
5668 | +++ b/net/ipv6/proc.c |
5669 | @@ -38,7 +38,6 @@ |
5670 | static int sockstat6_seq_show(struct seq_file *seq, void *v) |
5671 | { |
5672 | struct net *net = seq->private; |
5673 | - unsigned int frag_mem = ip6_frag_mem(net); |
5674 | |
5675 | seq_printf(seq, "TCP6: inuse %d\n", |
5676 | sock_prot_inuse_get(net, &tcpv6_prot)); |
5677 | @@ -48,7 +47,9 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v) |
5678 | sock_prot_inuse_get(net, &udplitev6_prot)); |
5679 | seq_printf(seq, "RAW6: inuse %d\n", |
5680 | sock_prot_inuse_get(net, &rawv6_prot)); |
5681 | - seq_printf(seq, "FRAG6: inuse %u memory %u\n", !!frag_mem, frag_mem); |
5682 | + seq_printf(seq, "FRAG6: inuse %u memory %lu\n", |
5683 | + atomic_read(&net->ipv6.frags.rhashtable.nelems), |
5684 | + frag_mem_limit(&net->ipv6.frags)); |
5685 | return 0; |
5686 | } |
5687 | |
5688 | diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c |
5689 | index 846012eae526..ede0061b6f5d 100644 |
5690 | --- a/net/ipv6/reassembly.c |
5691 | +++ b/net/ipv6/reassembly.c |
5692 | @@ -79,130 +79,93 @@ static struct inet_frags ip6_frags; |
5693 | static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
5694 | struct net_device *dev); |
5695 | |
5696 | -/* |
5697 | - * callers should be careful not to use the hash value outside the ipfrag_lock |
5698 | - * as doing so could race with ipfrag_hash_rnd being recalculated. |
5699 | - */ |
5700 | -static unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr, |
5701 | - const struct in6_addr *daddr) |
5702 | -{ |
5703 | - net_get_random_once(&ip6_frags.rnd, sizeof(ip6_frags.rnd)); |
5704 | - return jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), |
5705 | - (__force u32)id, ip6_frags.rnd); |
5706 | -} |
5707 | - |
5708 | -static unsigned int ip6_hashfn(const struct inet_frag_queue *q) |
5709 | -{ |
5710 | - const struct frag_queue *fq; |
5711 | - |
5712 | - fq = container_of(q, struct frag_queue, q); |
5713 | - return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr); |
5714 | -} |
5715 | - |
5716 | -bool ip6_frag_match(const struct inet_frag_queue *q, const void *a) |
5717 | -{ |
5718 | - const struct frag_queue *fq; |
5719 | - const struct ip6_create_arg *arg = a; |
5720 | - |
5721 | - fq = container_of(q, struct frag_queue, q); |
5722 | - return fq->id == arg->id && |
5723 | - fq->user == arg->user && |
5724 | - ipv6_addr_equal(&fq->saddr, arg->src) && |
5725 | - ipv6_addr_equal(&fq->daddr, arg->dst) && |
5726 | - (arg->iif == fq->iif || |
5727 | - !(ipv6_addr_type(arg->dst) & (IPV6_ADDR_MULTICAST | |
5728 | - IPV6_ADDR_LINKLOCAL))); |
5729 | -} |
5730 | -EXPORT_SYMBOL(ip6_frag_match); |
5731 | - |
5732 | void ip6_frag_init(struct inet_frag_queue *q, const void *a) |
5733 | { |
5734 | struct frag_queue *fq = container_of(q, struct frag_queue, q); |
5735 | - const struct ip6_create_arg *arg = a; |
5736 | + const struct frag_v6_compare_key *key = a; |
5737 | |
5738 | - fq->id = arg->id; |
5739 | - fq->user = arg->user; |
5740 | - fq->saddr = *arg->src; |
5741 | - fq->daddr = *arg->dst; |
5742 | - fq->ecn = arg->ecn; |
5743 | + q->key.v6 = *key; |
5744 | + fq->ecn = 0; |
5745 | } |
5746 | EXPORT_SYMBOL(ip6_frag_init); |
5747 | |
5748 | -void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq, |
5749 | - struct inet_frags *frags) |
5750 | +void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq) |
5751 | { |
5752 | struct net_device *dev = NULL; |
5753 | + struct sk_buff *head; |
5754 | |
5755 | + rcu_read_lock(); |
5756 | spin_lock(&fq->q.lock); |
5757 | |
5758 | if (fq->q.flags & INET_FRAG_COMPLETE) |
5759 | goto out; |
5760 | |
5761 | - inet_frag_kill(&fq->q, frags); |
5762 | + inet_frag_kill(&fq->q); |
5763 | |
5764 | - rcu_read_lock(); |
5765 | dev = dev_get_by_index_rcu(net, fq->iif); |
5766 | if (!dev) |
5767 | - goto out_rcu_unlock; |
5768 | + goto out; |
5769 | |
5770 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); |
5771 | - |
5772 | - if (inet_frag_evicting(&fq->q)) |
5773 | - goto out_rcu_unlock; |
5774 | - |
5775 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT); |
5776 | |
5777 | /* Don't send error if the first segment did not arrive. */ |
5778 | - if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !fq->q.fragments) |
5779 | - goto out_rcu_unlock; |
5780 | + head = fq->q.fragments; |
5781 | + if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !head) |
5782 | + goto out; |
5783 | |
5784 | /* But use as source device on which LAST ARRIVED |
5785 | * segment was received. And do not use fq->dev |
5786 | * pointer directly, device might already disappeared. |
5787 | */ |
5788 | - fq->q.fragments->dev = dev; |
5789 | - icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0); |
5790 | -out_rcu_unlock: |
5791 | - rcu_read_unlock(); |
5792 | + head->dev = dev; |
5793 | + skb_get(head); |
5794 | + spin_unlock(&fq->q.lock); |
5795 | + |
5796 | + icmpv6_send(head, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0); |
5797 | + kfree_skb(head); |
5798 | + goto out_rcu_unlock; |
5799 | + |
5800 | out: |
5801 | spin_unlock(&fq->q.lock); |
5802 | - inet_frag_put(&fq->q, frags); |
5803 | +out_rcu_unlock: |
5804 | + rcu_read_unlock(); |
5805 | + inet_frag_put(&fq->q); |
5806 | } |
5807 | EXPORT_SYMBOL(ip6_expire_frag_queue); |
5808 | |
5809 | -static void ip6_frag_expire(unsigned long data) |
5810 | +static void ip6_frag_expire(struct timer_list *t) |
5811 | { |
5812 | + struct inet_frag_queue *frag = from_timer(frag, t, timer); |
5813 | struct frag_queue *fq; |
5814 | struct net *net; |
5815 | |
5816 | - fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); |
5817 | + fq = container_of(frag, struct frag_queue, q); |
5818 | net = container_of(fq->q.net, struct net, ipv6.frags); |
5819 | |
5820 | - ip6_expire_frag_queue(net, fq, &ip6_frags); |
5821 | + ip6_expire_frag_queue(net, fq); |
5822 | } |
5823 | |
5824 | static struct frag_queue * |
5825 | -fq_find(struct net *net, __be32 id, const struct in6_addr *src, |
5826 | - const struct in6_addr *dst, int iif, u8 ecn) |
5827 | +fq_find(struct net *net, __be32 id, const struct ipv6hdr *hdr, int iif) |
5828 | { |
5829 | + struct frag_v6_compare_key key = { |
5830 | + .id = id, |
5831 | + .saddr = hdr->saddr, |
5832 | + .daddr = hdr->daddr, |
5833 | + .user = IP6_DEFRAG_LOCAL_DELIVER, |
5834 | + .iif = iif, |
5835 | + }; |
5836 | struct inet_frag_queue *q; |
5837 | - struct ip6_create_arg arg; |
5838 | - unsigned int hash; |
5839 | |
5840 | - arg.id = id; |
5841 | - arg.user = IP6_DEFRAG_LOCAL_DELIVER; |
5842 | - arg.src = src; |
5843 | - arg.dst = dst; |
5844 | - arg.iif = iif; |
5845 | - arg.ecn = ecn; |
5846 | + if (!(ipv6_addr_type(&hdr->daddr) & (IPV6_ADDR_MULTICAST | |
5847 | + IPV6_ADDR_LINKLOCAL))) |
5848 | + key.iif = 0; |
5849 | |
5850 | - hash = inet6_hash_frag(id, src, dst); |
5851 | - |
5852 | - q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash); |
5853 | - if (IS_ERR_OR_NULL(q)) { |
5854 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); |
5855 | + q = inet_frag_find(&net->ipv6.frags, &key); |
5856 | + if (!q) |
5857 | return NULL; |
5858 | - } |
5859 | + |
5860 | return container_of(q, struct frag_queue, q); |
5861 | } |
5862 | |
5863 | @@ -363,7 +326,7 @@ found: |
5864 | return -1; |
5865 | |
5866 | discard_fq: |
5867 | - inet_frag_kill(&fq->q, &ip6_frags); |
5868 | + inet_frag_kill(&fq->q); |
5869 | err: |
5870 | __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), |
5871 | IPSTATS_MIB_REASMFAILS); |
5872 | @@ -390,7 +353,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
5873 | int sum_truesize; |
5874 | u8 ecn; |
5875 | |
5876 | - inet_frag_kill(&fq->q, &ip6_frags); |
5877 | + inet_frag_kill(&fq->q); |
5878 | |
5879 | ecn = ip_frag_ecn_table[fq->ecn]; |
5880 | if (unlikely(ecn == 0xff)) |
5881 | @@ -509,6 +472,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
5882 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS); |
5883 | rcu_read_unlock(); |
5884 | fq->q.fragments = NULL; |
5885 | + fq->q.rb_fragments = RB_ROOT; |
5886 | fq->q.fragments_tail = NULL; |
5887 | return 1; |
5888 | |
5889 | @@ -530,6 +494,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
5890 | struct frag_queue *fq; |
5891 | const struct ipv6hdr *hdr = ipv6_hdr(skb); |
5892 | struct net *net = dev_net(skb_dst(skb)->dev); |
5893 | + int iif; |
5894 | |
5895 | if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED) |
5896 | goto fail_hdr; |
5897 | @@ -558,17 +523,22 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
5898 | return 1; |
5899 | } |
5900 | |
5901 | - fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr, |
5902 | - skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); |
5903 | + if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU && |
5904 | + fhdr->frag_off & htons(IP6_MF)) |
5905 | + goto fail_hdr; |
5906 | + |
5907 | + iif = skb->dev ? skb->dev->ifindex : 0; |
5908 | + fq = fq_find(net, fhdr->identification, hdr, iif); |
5909 | if (fq) { |
5910 | int ret; |
5911 | |
5912 | spin_lock(&fq->q.lock); |
5913 | |
5914 | + fq->iif = iif; |
5915 | ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff); |
5916 | |
5917 | spin_unlock(&fq->q.lock); |
5918 | - inet_frag_put(&fq->q, &ip6_frags); |
5919 | + inet_frag_put(&fq->q); |
5920 | return ret; |
5921 | } |
5922 | |
5923 | @@ -589,24 +559,22 @@ static const struct inet6_protocol frag_protocol = { |
5924 | }; |
5925 | |
5926 | #ifdef CONFIG_SYSCTL |
5927 | -static int zero; |
5928 | |
5929 | static struct ctl_table ip6_frags_ns_ctl_table[] = { |
5930 | { |
5931 | .procname = "ip6frag_high_thresh", |
5932 | .data = &init_net.ipv6.frags.high_thresh, |
5933 | - .maxlen = sizeof(int), |
5934 | + .maxlen = sizeof(unsigned long), |
5935 | .mode = 0644, |
5936 | - .proc_handler = proc_dointvec_minmax, |
5937 | + .proc_handler = proc_doulongvec_minmax, |
5938 | .extra1 = &init_net.ipv6.frags.low_thresh |
5939 | }, |
5940 | { |
5941 | .procname = "ip6frag_low_thresh", |
5942 | .data = &init_net.ipv6.frags.low_thresh, |
5943 | - .maxlen = sizeof(int), |
5944 | + .maxlen = sizeof(unsigned long), |
5945 | .mode = 0644, |
5946 | - .proc_handler = proc_dointvec_minmax, |
5947 | - .extra1 = &zero, |
5948 | + .proc_handler = proc_doulongvec_minmax, |
5949 | .extra2 = &init_net.ipv6.frags.high_thresh |
5950 | }, |
5951 | { |
5952 | @@ -649,10 +617,6 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net) |
5953 | table[1].data = &net->ipv6.frags.low_thresh; |
5954 | table[1].extra2 = &net->ipv6.frags.high_thresh; |
5955 | table[2].data = &net->ipv6.frags.timeout; |
5956 | - |
5957 | - /* Don't export sysctls to unprivileged users */ |
5958 | - if (net->user_ns != &init_user_ns) |
5959 | - table[0].procname = NULL; |
5960 | } |
5961 | |
5962 | hdr = register_net_sysctl(net, "net/ipv6", table); |
5963 | @@ -714,19 +678,27 @@ static void ip6_frags_sysctl_unregister(void) |
5964 | |
5965 | static int __net_init ipv6_frags_init_net(struct net *net) |
5966 | { |
5967 | + int res; |
5968 | + |
5969 | net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; |
5970 | net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH; |
5971 | net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT; |
5972 | + net->ipv6.frags.f = &ip6_frags; |
5973 | |
5974 | - inet_frags_init_net(&net->ipv6.frags); |
5975 | + res = inet_frags_init_net(&net->ipv6.frags); |
5976 | + if (res < 0) |
5977 | + return res; |
5978 | |
5979 | - return ip6_frags_ns_sysctl_register(net); |
5980 | + res = ip6_frags_ns_sysctl_register(net); |
5981 | + if (res < 0) |
5982 | + inet_frags_exit_net(&net->ipv6.frags); |
5983 | + return res; |
5984 | } |
5985 | |
5986 | static void __net_exit ipv6_frags_exit_net(struct net *net) |
5987 | { |
5988 | ip6_frags_ns_sysctl_unregister(net); |
5989 | - inet_frags_exit_net(&net->ipv6.frags, &ip6_frags); |
5990 | + inet_frags_exit_net(&net->ipv6.frags); |
5991 | } |
5992 | |
5993 | static struct pernet_operations ip6_frags_ops = { |
5994 | @@ -734,14 +706,55 @@ static struct pernet_operations ip6_frags_ops = { |
5995 | .exit = ipv6_frags_exit_net, |
5996 | }; |
5997 | |
5998 | +static u32 ip6_key_hashfn(const void *data, u32 len, u32 seed) |
5999 | +{ |
6000 | + return jhash2(data, |
6001 | + sizeof(struct frag_v6_compare_key) / sizeof(u32), seed); |
6002 | +} |
6003 | + |
6004 | +static u32 ip6_obj_hashfn(const void *data, u32 len, u32 seed) |
6005 | +{ |
6006 | + const struct inet_frag_queue *fq = data; |
6007 | + |
6008 | + return jhash2((const u32 *)&fq->key.v6, |
6009 | + sizeof(struct frag_v6_compare_key) / sizeof(u32), seed); |
6010 | +} |
6011 | + |
6012 | +static int ip6_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) |
6013 | +{ |
6014 | + const struct frag_v6_compare_key *key = arg->key; |
6015 | + const struct inet_frag_queue *fq = ptr; |
6016 | + |
6017 | + return !!memcmp(&fq->key, key, sizeof(*key)); |
6018 | +} |
6019 | + |
6020 | +const struct rhashtable_params ip6_rhash_params = { |
6021 | + .head_offset = offsetof(struct inet_frag_queue, node), |
6022 | + .hashfn = ip6_key_hashfn, |
6023 | + .obj_hashfn = ip6_obj_hashfn, |
6024 | + .obj_cmpfn = ip6_obj_cmpfn, |
6025 | + .automatic_shrinking = true, |
6026 | +}; |
6027 | +EXPORT_SYMBOL(ip6_rhash_params); |
6028 | + |
6029 | int __init ipv6_frag_init(void) |
6030 | { |
6031 | int ret; |
6032 | |
6033 | - ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
6034 | + ip6_frags.constructor = ip6_frag_init; |
6035 | + ip6_frags.destructor = NULL; |
6036 | + ip6_frags.qsize = sizeof(struct frag_queue); |
6037 | + ip6_frags.frag_expire = ip6_frag_expire; |
6038 | + ip6_frags.frags_cache_name = ip6_frag_cache_name; |
6039 | + ip6_frags.rhash_params = ip6_rhash_params; |
6040 | + ret = inet_frags_init(&ip6_frags); |
6041 | if (ret) |
6042 | goto out; |
6043 | |
6044 | + ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
6045 | + if (ret) |
6046 | + goto err_protocol; |
6047 | + |
6048 | ret = ip6_frags_sysctl_register(); |
6049 | if (ret) |
6050 | goto err_sysctl; |
6051 | @@ -750,16 +763,6 @@ int __init ipv6_frag_init(void) |
6052 | if (ret) |
6053 | goto err_pernet; |
6054 | |
6055 | - ip6_frags.hashfn = ip6_hashfn; |
6056 | - ip6_frags.constructor = ip6_frag_init; |
6057 | - ip6_frags.destructor = NULL; |
6058 | - ip6_frags.qsize = sizeof(struct frag_queue); |
6059 | - ip6_frags.match = ip6_frag_match; |
6060 | - ip6_frags.frag_expire = ip6_frag_expire; |
6061 | - ip6_frags.frags_cache_name = ip6_frag_cache_name; |
6062 | - ret = inet_frags_init(&ip6_frags); |
6063 | - if (ret) |
6064 | - goto err_pernet; |
6065 | out: |
6066 | return ret; |
6067 | |
6068 | @@ -767,6 +770,8 @@ err_pernet: |
6069 | ip6_frags_sysctl_unregister(); |
6070 | err_sysctl: |
6071 | inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
6072 | +err_protocol: |
6073 | + inet_frags_fini(&ip6_frags); |
6074 | goto out; |
6075 | } |
6076 | |
6077 | diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c |
6078 | index 8c8df75dbead..2a2ab6bfe5d8 100644 |
6079 | --- a/net/sched/sch_netem.c |
6080 | +++ b/net/sched/sch_netem.c |
6081 | @@ -149,12 +149,6 @@ struct netem_skb_cb { |
6082 | ktime_t tstamp_save; |
6083 | }; |
6084 | |
6085 | - |
6086 | -static struct sk_buff *netem_rb_to_skb(struct rb_node *rb) |
6087 | -{ |
6088 | - return rb_entry(rb, struct sk_buff, rbnode); |
6089 | -} |
6090 | - |
6091 | static inline struct netem_skb_cb *netem_skb_cb(struct sk_buff *skb) |
6092 | { |
6093 | /* we assume we can use skb next/prev/tstamp as storage for rb_node */ |
6094 | @@ -365,7 +359,7 @@ static void tfifo_reset(struct Qdisc *sch) |
6095 | struct rb_node *p; |
6096 | |
6097 | while ((p = rb_first(&q->t_root))) { |
6098 | - struct sk_buff *skb = netem_rb_to_skb(p); |
6099 | + struct sk_buff *skb = rb_to_skb(p); |
6100 | |
6101 | rb_erase(p, &q->t_root); |
6102 | rtnl_kfree_skbs(skb, skb); |
6103 | @@ -382,7 +376,7 @@ static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch) |
6104 | struct sk_buff *skb; |
6105 | |
6106 | parent = *p; |
6107 | - skb = netem_rb_to_skb(parent); |
6108 | + skb = rb_to_skb(parent); |
6109 | if (tnext >= netem_skb_cb(skb)->time_to_send) |
6110 | p = &parent->rb_right; |
6111 | else |
6112 | @@ -538,7 +532,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, |
6113 | struct sk_buff *t_skb; |
6114 | struct netem_skb_cb *t_last; |
6115 | |
6116 | - t_skb = netem_rb_to_skb(rb_last(&q->t_root)); |
6117 | + t_skb = skb_rb_last(&q->t_root); |
6118 | t_last = netem_skb_cb(t_skb); |
6119 | if (!last || |
6120 | t_last->time_to_send > last->time_to_send) { |
6121 | @@ -618,7 +612,7 @@ deliver: |
6122 | if (p) { |
6123 | psched_time_t time_to_send; |
6124 | |
6125 | - skb = netem_rb_to_skb(p); |
6126 | + skb = rb_to_skb(p); |
6127 | |
6128 | /* if more time remaining? */ |
6129 | time_to_send = netem_skb_cb(skb)->time_to_send; |
6130 | diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c |
6131 | index 417abbb1f72c..8a027973f2ad 100644 |
6132 | --- a/sound/pci/hda/hda_codec.c |
6133 | +++ b/sound/pci/hda/hda_codec.c |
6134 | @@ -3923,7 +3923,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus) |
6135 | |
6136 | list_for_each_codec(codec, bus) { |
6137 | /* FIXME: maybe a better way needed for forced reset */ |
6138 | - cancel_delayed_work_sync(&codec->jackpoll_work); |
6139 | + if (current_work() != &codec->jackpoll_work.work) |
6140 | + cancel_delayed_work_sync(&codec->jackpoll_work); |
6141 | #ifdef CONFIG_PM |
6142 | if (hda_codec_is_power_on(codec)) { |
6143 | hda_call_codec_suspend(codec); |
6144 | diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c |
6145 | index 3479a1bc7caa..fb76423022e8 100644 |
6146 | --- a/tools/perf/builtin-c2c.c |
6147 | +++ b/tools/perf/builtin-c2c.c |
6148 | @@ -2229,6 +2229,9 @@ static int perf_c2c__browse_cacheline(struct hist_entry *he) |
6149 | " s Togle full lenght of symbol and source line columns \n" |
6150 | " q Return back to cacheline list \n"; |
6151 | |
6152 | + if (!he) |
6153 | + return 0; |
6154 | + |
6155 | /* Display compact version first. */ |
6156 | c2c.symbol_full = false; |
6157 | |
6158 | diff --git a/tools/perf/perf.h b/tools/perf/perf.h |
6159 | index 55086389fc06..96f62dd7e3ed 100644 |
6160 | --- a/tools/perf/perf.h |
6161 | +++ b/tools/perf/perf.h |
6162 | @@ -24,7 +24,9 @@ static inline unsigned long long rdclock(void) |
6163 | return ts.tv_sec * 1000000000ULL + ts.tv_nsec; |
6164 | } |
6165 | |
6166 | +#ifndef MAX_NR_CPUS |
6167 | #define MAX_NR_CPUS 1024 |
6168 | +#endif |
6169 | |
6170 | extern const char *input_name; |
6171 | extern bool perf_host, perf_guest; |
6172 | diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c |
6173 | index 226a9245d1db..2227ee92d8e2 100644 |
6174 | --- a/tools/perf/util/evsel.c |
6175 | +++ b/tools/perf/util/evsel.c |
6176 | @@ -824,6 +824,12 @@ static void apply_config_terms(struct perf_evsel *evsel, |
6177 | } |
6178 | } |
6179 | |
6180 | +static bool is_dummy_event(struct perf_evsel *evsel) |
6181 | +{ |
6182 | + return (evsel->attr.type == PERF_TYPE_SOFTWARE) && |
6183 | + (evsel->attr.config == PERF_COUNT_SW_DUMMY); |
6184 | +} |
6185 | + |
6186 | /* |
6187 | * The enable_on_exec/disabled value strategy: |
6188 | * |
6189 | @@ -1054,6 +1060,14 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, |
6190 | else |
6191 | perf_evsel__reset_sample_bit(evsel, PERIOD); |
6192 | } |
6193 | + |
6194 | + /* |
6195 | + * For initial_delay, a dummy event is added implicitly. |
6196 | + * The software event will trigger -EOPNOTSUPP error out, |
6197 | + * if BRANCH_STACK bit is set. |
6198 | + */ |
6199 | + if (opts->initial_delay && is_dummy_event(evsel)) |
6200 | + perf_evsel__reset_sample_bit(evsel, BRANCH_STACK); |
6201 | } |
6202 | |
6203 | static int perf_evsel__alloc_fd(struct perf_evsel *evsel, int ncpus, int nthreads) |
6204 | diff --git a/tools/testing/nvdimm/pmem-dax.c b/tools/testing/nvdimm/pmem-dax.c |
6205 | index b53596ad601b..2e7fd8227969 100644 |
6206 | --- a/tools/testing/nvdimm/pmem-dax.c |
6207 | +++ b/tools/testing/nvdimm/pmem-dax.c |
6208 | @@ -31,17 +31,21 @@ long __pmem_direct_access(struct pmem_device *pmem, pgoff_t pgoff, |
6209 | if (get_nfit_res(pmem->phys_addr + offset)) { |
6210 | struct page *page; |
6211 | |
6212 | - *kaddr = pmem->virt_addr + offset; |
6213 | + if (kaddr) |
6214 | + *kaddr = pmem->virt_addr + offset; |
6215 | page = vmalloc_to_page(pmem->virt_addr + offset); |
6216 | - *pfn = page_to_pfn_t(page); |
6217 | + if (pfn) |
6218 | + *pfn = page_to_pfn_t(page); |
6219 | pr_debug_ratelimited("%s: pmem: %p pgoff: %#lx pfn: %#lx\n", |
6220 | __func__, pmem, pgoff, page_to_pfn(page)); |
6221 | |
6222 | return 1; |
6223 | } |
6224 | |
6225 | - *kaddr = pmem->virt_addr + offset; |
6226 | - *pfn = phys_to_pfn_t(pmem->phys_addr + offset, pmem->pfn_flags); |
6227 | + if (kaddr) |
6228 | + *kaddr = pmem->virt_addr + offset; |
6229 | + if (pfn) |
6230 | + *pfn = phys_to_pfn_t(pmem->phys_addr + offset, pmem->pfn_flags); |
6231 | |
6232 | /* |
6233 | * If badblocks are present, limit known good range to the |
6234 | diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c |
6235 | index 9167ee976314..041dbbb30ff0 100644 |
6236 | --- a/tools/testing/selftests/bpf/test_verifier.c |
6237 | +++ b/tools/testing/selftests/bpf/test_verifier.c |
6238 | @@ -5895,7 +5895,7 @@ static struct bpf_test tests[] = { |
6239 | BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), |
6240 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, |
6241 | BPF_FUNC_map_lookup_elem), |
6242 | - BPF_MOV64_REG(BPF_REG_0, 0), |
6243 | + BPF_MOV64_IMM(BPF_REG_0, 0), |
6244 | BPF_EXIT_INSN(), |
6245 | }, |
6246 | .fixup_map_in_map = { 3 }, |
6247 | @@ -5918,7 +5918,7 @@ static struct bpf_test tests[] = { |
6248 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), |
6249 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, |
6250 | BPF_FUNC_map_lookup_elem), |
6251 | - BPF_MOV64_REG(BPF_REG_0, 0), |
6252 | + BPF_MOV64_IMM(BPF_REG_0, 0), |
6253 | BPF_EXIT_INSN(), |
6254 | }, |
6255 | .fixup_map_in_map = { 3 }, |
6256 | @@ -5941,7 +5941,7 @@ static struct bpf_test tests[] = { |
6257 | BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), |
6258 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, |
6259 | BPF_FUNC_map_lookup_elem), |
6260 | - BPF_MOV64_REG(BPF_REG_0, 0), |
6261 | + BPF_MOV64_IMM(BPF_REG_0, 0), |
6262 | BPF_EXIT_INSN(), |
6263 | }, |
6264 | .fixup_map_in_map = { 3 }, |