Annotation of /trunk/kernel-alx/patches-4.14/0172-4.14.73-all-fixes.patch
Parent Directory | Revision Log
Revision 3238 -
(hide annotations)
(download)
Fri Nov 9 12:14:58 2018 UTC (5 years, 10 months ago) by niro
File size: 62284 byte(s)
Fri Nov 9 12:14:58 2018 UTC (5 years, 10 months ago) by niro
File size: 62284 byte(s)
-added up to patches-4.14.79
1 | niro | 3238 | diff --git a/Makefile b/Makefile |
2 | index 734722bda173..89f30ca964b6 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,7 +1,7 @@ | ||
6 | # SPDX-License-Identifier: GPL-2.0 | ||
7 | VERSION = 4 | ||
8 | PATCHLEVEL = 14 | ||
9 | -SUBLEVEL = 72 | ||
10 | +SUBLEVEL = 73 | ||
11 | EXTRAVERSION = | ||
12 | NAME = Petit Gorille | ||
13 | |||
14 | diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c | ||
15 | index 7d00d4ad44d4..95997e6c0696 100644 | ||
16 | --- a/arch/x86/xen/pmu.c | ||
17 | +++ b/arch/x86/xen/pmu.c | ||
18 | @@ -478,7 +478,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs, | ||
19 | irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) | ||
20 | { | ||
21 | int err, ret = IRQ_NONE; | ||
22 | - struct pt_regs regs; | ||
23 | + struct pt_regs regs = {0}; | ||
24 | const struct xen_pmu_data *xenpmu_data = get_xenpmu_data(); | ||
25 | uint8_t xenpmu_flags = get_xenpmu_flags(); | ||
26 | |||
27 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | ||
28 | index fd435a96481c..e8d9479615c9 100644 | ||
29 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | ||
30 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | ||
31 | @@ -715,12 +715,14 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device, | ||
32 | break; | ||
33 | case CHIP_POLARIS10: | ||
34 | if (type == CGS_UCODE_ID_SMU) { | ||
35 | - if ((adev->pdev->device == 0x67df) && | ||
36 | - ((adev->pdev->revision == 0xe0) || | ||
37 | - (adev->pdev->revision == 0xe3) || | ||
38 | - (adev->pdev->revision == 0xe4) || | ||
39 | - (adev->pdev->revision == 0xe5) || | ||
40 | - (adev->pdev->revision == 0xe7) || | ||
41 | + if (((adev->pdev->device == 0x67df) && | ||
42 | + ((adev->pdev->revision == 0xe0) || | ||
43 | + (adev->pdev->revision == 0xe3) || | ||
44 | + (adev->pdev->revision == 0xe4) || | ||
45 | + (adev->pdev->revision == 0xe5) || | ||
46 | + (adev->pdev->revision == 0xe7) || | ||
47 | + (adev->pdev->revision == 0xef))) || | ||
48 | + ((adev->pdev->device == 0x6fdf) && | ||
49 | (adev->pdev->revision == 0xef))) { | ||
50 | info->is_kicker = true; | ||
51 | strcpy(fw_name, "amdgpu/polaris10_k_smc.bin"); | ||
52 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
53 | index 0f16986ec5bc..4dd68d821353 100644 | ||
54 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
55 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
56 | @@ -500,6 +500,7 @@ static const struct pci_device_id pciidlist[] = { | ||
57 | {0x1002, 0x67CA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10}, | ||
58 | {0x1002, 0x67CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10}, | ||
59 | {0x1002, 0x67CF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10}, | ||
60 | + {0x1002, 0x6FDF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10}, | ||
61 | /* Polaris12 */ | ||
62 | {0x1002, 0x6980, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12}, | ||
63 | {0x1002, 0x6981, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12}, | ||
64 | diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
65 | index 430830d63a33..2c6d19683688 100644 | ||
66 | --- a/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
67 | +++ b/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
68 | @@ -570,12 +570,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) | ||
69 | nv_connector->edid = NULL; | ||
70 | } | ||
71 | |||
72 | - /* Outputs are only polled while runtime active, so acquiring a | ||
73 | - * runtime PM ref here is unnecessary (and would deadlock upon | ||
74 | - * runtime suspend because it waits for polling to finish). | ||
75 | + /* Outputs are only polled while runtime active, so resuming the | ||
76 | + * device here is unnecessary (and would deadlock upon runtime suspend | ||
77 | + * because it waits for polling to finish). We do however, want to | ||
78 | + * prevent the autosuspend timer from elapsing during this operation | ||
79 | + * if possible. | ||
80 | */ | ||
81 | - if (!drm_kms_helper_is_poll_worker()) { | ||
82 | - ret = pm_runtime_get_sync(connector->dev->dev); | ||
83 | + if (drm_kms_helper_is_poll_worker()) { | ||
84 | + pm_runtime_get_noresume(dev->dev); | ||
85 | + } else { | ||
86 | + ret = pm_runtime_get_sync(dev->dev); | ||
87 | if (ret < 0 && ret != -EACCES) | ||
88 | return conn_status; | ||
89 | } | ||
90 | @@ -653,10 +657,8 @@ detect_analog: | ||
91 | |||
92 | out: | ||
93 | |||
94 | - if (!drm_kms_helper_is_poll_worker()) { | ||
95 | - pm_runtime_mark_last_busy(connector->dev->dev); | ||
96 | - pm_runtime_put_autosuspend(connector->dev->dev); | ||
97 | - } | ||
98 | + pm_runtime_mark_last_busy(dev->dev); | ||
99 | + pm_runtime_put_autosuspend(dev->dev); | ||
100 | |||
101 | return conn_status; | ||
102 | } | ||
103 | @@ -1120,6 +1122,26 @@ nouveau_connector_hotplug(struct nvif_notify *notify) | ||
104 | const struct nvif_notify_conn_rep_v0 *rep = notify->data; | ||
105 | const char *name = connector->name; | ||
106 | struct nouveau_encoder *nv_encoder; | ||
107 | + int ret; | ||
108 | + | ||
109 | + ret = pm_runtime_get(drm->dev->dev); | ||
110 | + if (ret == 0) { | ||
111 | + /* We can't block here if there's a pending PM request | ||
112 | + * running, as we'll deadlock nouveau_display_fini() when it | ||
113 | + * calls nvif_put() on our nvif_notify struct. So, simply | ||
114 | + * defer the hotplug event until the device finishes resuming | ||
115 | + */ | ||
116 | + NV_DEBUG(drm, "Deferring HPD on %s until runtime resume\n", | ||
117 | + name); | ||
118 | + schedule_work(&drm->hpd_work); | ||
119 | + | ||
120 | + pm_runtime_put_noidle(drm->dev->dev); | ||
121 | + return NVIF_NOTIFY_KEEP; | ||
122 | + } else if (ret != 1 && ret != -EACCES) { | ||
123 | + NV_WARN(drm, "HPD on %s dropped due to RPM failure: %d\n", | ||
124 | + name, ret); | ||
125 | + return NVIF_NOTIFY_DROP; | ||
126 | + } | ||
127 | |||
128 | if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) { | ||
129 | NV_DEBUG(drm, "service %s\n", name); | ||
130 | @@ -1137,6 +1159,8 @@ nouveau_connector_hotplug(struct nvif_notify *notify) | ||
131 | drm_helper_hpd_irq_event(connector->dev); | ||
132 | } | ||
133 | |||
134 | + pm_runtime_mark_last_busy(drm->dev->dev); | ||
135 | + pm_runtime_put_autosuspend(drm->dev->dev); | ||
136 | return NVIF_NOTIFY_KEEP; | ||
137 | } | ||
138 | |||
139 | diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c | ||
140 | index caf53503c0f7..2612702c3a3f 100644 | ||
141 | --- a/drivers/gpu/drm/nouveau/nouveau_display.c | ||
142 | +++ b/drivers/gpu/drm/nouveau/nouveau_display.c | ||
143 | @@ -356,8 +356,6 @@ nouveau_display_hpd_work(struct work_struct *work) | ||
144 | pm_runtime_get_sync(drm->dev->dev); | ||
145 | |||
146 | drm_helper_hpd_irq_event(drm->dev); | ||
147 | - /* enable polling for external displays */ | ||
148 | - drm_kms_helper_poll_enable(drm->dev); | ||
149 | |||
150 | pm_runtime_mark_last_busy(drm->dev->dev); | ||
151 | pm_runtime_put_sync(drm->dev->dev); | ||
152 | @@ -380,15 +378,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val, | ||
153 | { | ||
154 | struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb); | ||
155 | struct acpi_bus_event *info = data; | ||
156 | + int ret; | ||
157 | |||
158 | if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) { | ||
159 | if (info->type == ACPI_VIDEO_NOTIFY_PROBE) { | ||
160 | - /* | ||
161 | - * This may be the only indication we receive of a | ||
162 | - * connector hotplug on a runtime suspended GPU, | ||
163 | - * schedule hpd_work to check. | ||
164 | - */ | ||
165 | - schedule_work(&drm->hpd_work); | ||
166 | + ret = pm_runtime_get(drm->dev->dev); | ||
167 | + if (ret == 1 || ret == -EACCES) { | ||
168 | + /* If the GPU is already awake, or in a state | ||
169 | + * where we can't wake it up, it can handle | ||
170 | + * it's own hotplug events. | ||
171 | + */ | ||
172 | + pm_runtime_put_autosuspend(drm->dev->dev); | ||
173 | + } else if (ret == 0) { | ||
174 | + /* This may be the only indication we receive | ||
175 | + * of a connector hotplug on a runtime | ||
176 | + * suspended GPU, schedule hpd_work to check. | ||
177 | + */ | ||
178 | + NV_DEBUG(drm, "ACPI requested connector reprobe\n"); | ||
179 | + schedule_work(&drm->hpd_work); | ||
180 | + pm_runtime_put_noidle(drm->dev->dev); | ||
181 | + } else { | ||
182 | + NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n", | ||
183 | + ret); | ||
184 | + } | ||
185 | |||
186 | /* acpi-video should not generate keypresses for this */ | ||
187 | return NOTIFY_BAD; | ||
188 | @@ -412,6 +424,11 @@ nouveau_display_init(struct drm_device *dev) | ||
189 | if (ret) | ||
190 | return ret; | ||
191 | |||
192 | + /* enable connector detection and polling for connectors without HPD | ||
193 | + * support | ||
194 | + */ | ||
195 | + drm_kms_helper_poll_enable(dev); | ||
196 | + | ||
197 | /* enable hotplug interrupts */ | ||
198 | drm_connector_list_iter_begin(dev, &conn_iter); | ||
199 | nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) { | ||
200 | @@ -426,7 +443,7 @@ nouveau_display_init(struct drm_device *dev) | ||
201 | } | ||
202 | |||
203 | void | ||
204 | -nouveau_display_fini(struct drm_device *dev, bool suspend) | ||
205 | +nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime) | ||
206 | { | ||
207 | struct nouveau_display *disp = nouveau_display(dev); | ||
208 | struct nouveau_drm *drm = nouveau_drm(dev); | ||
209 | @@ -451,6 +468,9 @@ nouveau_display_fini(struct drm_device *dev, bool suspend) | ||
210 | } | ||
211 | drm_connector_list_iter_end(&conn_iter); | ||
212 | |||
213 | + if (!runtime) | ||
214 | + cancel_work_sync(&drm->hpd_work); | ||
215 | + | ||
216 | drm_kms_helper_poll_disable(dev); | ||
217 | disp->fini(dev); | ||
218 | } | ||
219 | @@ -640,11 +660,11 @@ nouveau_display_suspend(struct drm_device *dev, bool runtime) | ||
220 | } | ||
221 | } | ||
222 | |||
223 | - nouveau_display_fini(dev, true); | ||
224 | + nouveau_display_fini(dev, true, runtime); | ||
225 | return 0; | ||
226 | } | ||
227 | |||
228 | - nouveau_display_fini(dev, true); | ||
229 | + nouveau_display_fini(dev, true, runtime); | ||
230 | |||
231 | list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { | ||
232 | struct nouveau_framebuffer *nouveau_fb; | ||
233 | diff --git a/drivers/gpu/drm/nouveau/nouveau_display.h b/drivers/gpu/drm/nouveau/nouveau_display.h | ||
234 | index 34cd144681b9..5e7dae79c2ee 100644 | ||
235 | --- a/drivers/gpu/drm/nouveau/nouveau_display.h | ||
236 | +++ b/drivers/gpu/drm/nouveau/nouveau_display.h | ||
237 | @@ -64,7 +64,7 @@ nouveau_display(struct drm_device *dev) | ||
238 | int nouveau_display_create(struct drm_device *dev); | ||
239 | void nouveau_display_destroy(struct drm_device *dev); | ||
240 | int nouveau_display_init(struct drm_device *dev); | ||
241 | -void nouveau_display_fini(struct drm_device *dev, bool suspend); | ||
242 | +void nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime); | ||
243 | int nouveau_display_suspend(struct drm_device *dev, bool runtime); | ||
244 | void nouveau_display_resume(struct drm_device *dev, bool runtime); | ||
245 | int nouveau_display_vblank_enable(struct drm_device *, unsigned int); | ||
246 | diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c | ||
247 | index d6f13d7254de..7d3c7bb0ebfa 100644 | ||
248 | --- a/drivers/gpu/drm/nouveau/nouveau_drm.c | ||
249 | +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c | ||
250 | @@ -546,7 +546,7 @@ nouveau_drm_unload(struct drm_device *dev) | ||
251 | nouveau_debugfs_fini(drm); | ||
252 | |||
253 | if (dev->mode_config.num_crtc) | ||
254 | - nouveau_display_fini(dev, false); | ||
255 | + nouveau_display_fini(dev, false, false); | ||
256 | nouveau_display_destroy(dev); | ||
257 | |||
258 | nouveau_bios_takedown(dev); | ||
259 | diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c | ||
260 | index 8746eeeec44d..491f1892b50e 100644 | ||
261 | --- a/drivers/gpu/drm/udl/udl_fb.c | ||
262 | +++ b/drivers/gpu/drm/udl/udl_fb.c | ||
263 | @@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev, | ||
264 | { | ||
265 | drm_fb_helper_unregister_fbi(&ufbdev->helper); | ||
266 | drm_fb_helper_fini(&ufbdev->helper); | ||
267 | - drm_framebuffer_unregister_private(&ufbdev->ufb.base); | ||
268 | - drm_framebuffer_cleanup(&ufbdev->ufb.base); | ||
269 | - drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base); | ||
270 | + if (ufbdev->ufb.obj) { | ||
271 | + drm_framebuffer_unregister_private(&ufbdev->ufb.base); | ||
272 | + drm_framebuffer_cleanup(&ufbdev->ufb.base); | ||
273 | + drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base); | ||
274 | + } | ||
275 | } | ||
276 | |||
277 | int udl_fbdev_init(struct drm_device *dev) | ||
278 | diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c | ||
279 | index 17590cb2b80d..502c7eb708c2 100644 | ||
280 | --- a/drivers/gpu/drm/vc4/vc4_plane.c | ||
281 | +++ b/drivers/gpu/drm/vc4/vc4_plane.c | ||
282 | @@ -329,6 +329,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) | ||
283 | vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0], | ||
284 | vc4_state->crtc_h); | ||
285 | |||
286 | + vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && | ||
287 | + vc4_state->y_scaling[0] == VC4_SCALING_NONE); | ||
288 | + | ||
289 | if (num_planes > 1) { | ||
290 | vc4_state->is_yuv = true; | ||
291 | |||
292 | @@ -344,24 +347,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) | ||
293 | vc4_get_scaling_mode(vc4_state->src_h[1], | ||
294 | vc4_state->crtc_h); | ||
295 | |||
296 | - /* YUV conversion requires that scaling be enabled, | ||
297 | - * even on a plane that's otherwise 1:1. Choose TPZ | ||
298 | - * for simplicity. | ||
299 | + /* YUV conversion requires that horizontal scaling be enabled, | ||
300 | + * even on a plane that's otherwise 1:1. Looks like only PPF | ||
301 | + * works in that case, so let's pick that one. | ||
302 | */ | ||
303 | - if (vc4_state->x_scaling[0] == VC4_SCALING_NONE) | ||
304 | - vc4_state->x_scaling[0] = VC4_SCALING_TPZ; | ||
305 | - if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) | ||
306 | - vc4_state->y_scaling[0] = VC4_SCALING_TPZ; | ||
307 | + if (vc4_state->is_unity) | ||
308 | + vc4_state->x_scaling[0] = VC4_SCALING_PPF; | ||
309 | } else { | ||
310 | vc4_state->x_scaling[1] = VC4_SCALING_NONE; | ||
311 | vc4_state->y_scaling[1] = VC4_SCALING_NONE; | ||
312 | } | ||
313 | |||
314 | - vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && | ||
315 | - vc4_state->y_scaling[0] == VC4_SCALING_NONE && | ||
316 | - vc4_state->x_scaling[1] == VC4_SCALING_NONE && | ||
317 | - vc4_state->y_scaling[1] == VC4_SCALING_NONE); | ||
318 | - | ||
319 | /* No configuring scaling on the cursor plane, since it gets | ||
320 | non-vblank-synced updates, and scaling requires requires | ||
321 | LBM changes which have to be vblank-synced. | ||
322 | @@ -639,7 +635,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane, | ||
323 | vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5); | ||
324 | } | ||
325 | |||
326 | - if (!vc4_state->is_unity) { | ||
327 | + if (vc4_state->x_scaling[0] != VC4_SCALING_NONE || | ||
328 | + vc4_state->x_scaling[1] != VC4_SCALING_NONE || | ||
329 | + vc4_state->y_scaling[0] != VC4_SCALING_NONE || | ||
330 | + vc4_state->y_scaling[1] != VC4_SCALING_NONE) { | ||
331 | /* LBM Base Address. */ | ||
332 | if (vc4_state->y_scaling[0] != VC4_SCALING_NONE || | ||
333 | vc4_state->y_scaling[1] != VC4_SCALING_NONE) { | ||
334 | diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c | ||
335 | index a8a8f65a1e51..24952af51a54 100644 | ||
336 | --- a/drivers/infiniband/hw/cxgb4/qp.c | ||
337 | +++ b/drivers/infiniband/hw/cxgb4/qp.c | ||
338 | @@ -1395,6 +1395,12 @@ static void flush_qp(struct c4iw_qp *qhp) | ||
339 | schp = to_c4iw_cq(qhp->ibqp.send_cq); | ||
340 | |||
341 | if (qhp->ibqp.uobject) { | ||
342 | + | ||
343 | + /* for user qps, qhp->wq.flushed is protected by qhp->mutex */ | ||
344 | + if (qhp->wq.flushed) | ||
345 | + return; | ||
346 | + | ||
347 | + qhp->wq.flushed = 1; | ||
348 | t4_set_wq_in_error(&qhp->wq); | ||
349 | t4_set_cq_in_error(&rchp->cq); | ||
350 | spin_lock_irqsave(&rchp->comp_handler_lock, flag); | ||
351 | diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c | ||
352 | index 5f8b583c6e41..f74166aa9a0d 100644 | ||
353 | --- a/drivers/misc/vmw_balloon.c | ||
354 | +++ b/drivers/misc/vmw_balloon.c | ||
355 | @@ -45,6 +45,7 @@ | ||
356 | #include <linux/seq_file.h> | ||
357 | #include <linux/vmw_vmci_defs.h> | ||
358 | #include <linux/vmw_vmci_api.h> | ||
359 | +#include <linux/io.h> | ||
360 | #include <asm/hypervisor.h> | ||
361 | |||
362 | MODULE_AUTHOR("VMware, Inc."); | ||
363 | diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c | ||
364 | index 9375cef22420..3d27616d9c85 100644 | ||
365 | --- a/drivers/net/appletalk/ipddp.c | ||
366 | +++ b/drivers/net/appletalk/ipddp.c | ||
367 | @@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) | ||
368 | case SIOCFINDIPDDPRT: | ||
369 | spin_lock_bh(&ipddp_route_lock); | ||
370 | rp = __ipddp_find_route(&rcp); | ||
371 | - if (rp) | ||
372 | - memcpy(&rcp2, rp, sizeof(rcp2)); | ||
373 | + if (rp) { | ||
374 | + memset(&rcp2, 0, sizeof(rcp2)); | ||
375 | + rcp2.ip = rp->ip; | ||
376 | + rcp2.at = rp->at; | ||
377 | + rcp2.flags = rp->flags; | ||
378 | + } | ||
379 | spin_unlock_bh(&ipddp_route_lock); | ||
380 | |||
381 | if (rp) { | ||
382 | diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c | ||
383 | index c8c7ad2eff77..9b5a68b65432 100644 | ||
384 | --- a/drivers/net/ethernet/hp/hp100.c | ||
385 | +++ b/drivers/net/ethernet/hp/hp100.c | ||
386 | @@ -2634,7 +2634,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin) | ||
387 | /* Wait for link to drop */ | ||
388 | time = jiffies + (HZ / 10); | ||
389 | do { | ||
390 | - if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) | ||
391 | + if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) | ||
392 | break; | ||
393 | if (!in_interrupt()) | ||
394 | schedule_timeout_interruptible(1); | ||
395 | diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c | ||
396 | index 71e2aef6b7a1..951892da3352 100644 | ||
397 | --- a/drivers/net/ppp/pppoe.c | ||
398 | +++ b/drivers/net/ppp/pppoe.c | ||
399 | @@ -429,6 +429,9 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, | ||
400 | if (!skb) | ||
401 | goto out; | ||
402 | |||
403 | + if (skb_mac_header_len(skb) < ETH_HLEN) | ||
404 | + goto drop; | ||
405 | + | ||
406 | if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) | ||
407 | goto drop; | ||
408 | |||
409 | diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c | ||
410 | index 31684f3382f6..c5d4b35bb72a 100644 | ||
411 | --- a/drivers/net/usb/qmi_wwan.c | ||
412 | +++ b/drivers/net/usb/qmi_wwan.c | ||
413 | @@ -1205,13 +1205,13 @@ static const struct usb_device_id products[] = { | ||
414 | {QMI_FIXED_INTF(0x1199, 0x9061, 8)}, /* Sierra Wireless Modem */ | ||
415 | {QMI_FIXED_INTF(0x1199, 0x9063, 8)}, /* Sierra Wireless EM7305 */ | ||
416 | {QMI_FIXED_INTF(0x1199, 0x9063, 10)}, /* Sierra Wireless EM7305 */ | ||
417 | - {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */ | ||
418 | - {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx */ | ||
419 | - {QMI_FIXED_INTF(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */ | ||
420 | - {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */ | ||
421 | - {QMI_FIXED_INTF(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */ | ||
422 | - {QMI_FIXED_INTF(0x1199, 0x907b, 10)}, /* Sierra Wireless EM74xx */ | ||
423 | - {QMI_FIXED_INTF(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */ | ||
424 | + {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */ | ||
425 | + {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 10)},/* Sierra Wireless MC74xx */ | ||
426 | + {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */ | ||
427 | + {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 10)},/* Sierra Wireless EM74xx */ | ||
428 | + {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */ | ||
429 | + {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 10)},/* Sierra Wireless EM74xx */ | ||
430 | + {QMI_QUIRK_SET_DTR(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */ | ||
431 | {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ | ||
432 | {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ | ||
433 | {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ | ||
434 | diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c | ||
435 | index d80343429de5..1a40fc3517a8 100644 | ||
436 | --- a/drivers/net/xen-netfront.c | ||
437 | +++ b/drivers/net/xen-netfront.c | ||
438 | @@ -907,7 +907,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, | ||
439 | BUG_ON(pull_to <= skb_headlen(skb)); | ||
440 | __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); | ||
441 | } | ||
442 | - BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS); | ||
443 | + if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { | ||
444 | + queue->rx.rsp_cons = ++cons; | ||
445 | + kfree_skb(nskb); | ||
446 | + return ~0U; | ||
447 | + } | ||
448 | |||
449 | skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, | ||
450 | skb_frag_page(nfrag), | ||
451 | @@ -1044,6 +1048,8 @@ err: | ||
452 | skb->len += rx->status; | ||
453 | |||
454 | i = xennet_fill_frags(queue, skb, &tmpq); | ||
455 | + if (unlikely(i == ~0U)) | ||
456 | + goto err; | ||
457 | |||
458 | if (rx->flags & XEN_NETRXF_csum_blank) | ||
459 | skb->ip_summed = CHECKSUM_PARTIAL; | ||
460 | diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c | ||
461 | index 9bfc22b5da4b..5f3048e75bec 100644 | ||
462 | --- a/drivers/pci/host/pci-aardvark.c | ||
463 | +++ b/drivers/pci/host/pci-aardvark.c | ||
464 | @@ -954,6 +954,7 @@ static int advk_pcie_probe(struct platform_device *pdev) | ||
465 | |||
466 | bus = bridge->bus; | ||
467 | |||
468 | + pci_bus_size_bridges(bus); | ||
469 | pci_bus_assign_resources(bus); | ||
470 | |||
471 | list_for_each_entry(child, &bus->children, node) | ||
472 | diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c | ||
473 | index ec2911c4ee42..35c9b2f4b293 100644 | ||
474 | --- a/drivers/pci/quirks.c | ||
475 | +++ b/drivers/pci/quirks.c | ||
476 | @@ -4388,11 +4388,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags) | ||
477 | * | ||
478 | * 0x9d10-0x9d1b PCI Express Root port #{1-12} | ||
479 | * | ||
480 | - * The 300 series chipset suffers from the same bug so include those root | ||
481 | - * ports here as well. | ||
482 | - * | ||
483 | - * 0xa32c-0xa343 PCI Express Root port #{0-24} | ||
484 | - * | ||
485 | * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html | ||
486 | * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html | ||
487 | * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html | ||
488 | @@ -4410,7 +4405,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev) | ||
489 | case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */ | ||
490 | case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */ | ||
491 | case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */ | ||
492 | - case 0xa32c ... 0xa343: /* 300 series */ | ||
493 | return true; | ||
494 | } | ||
495 | |||
496 | diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c | ||
497 | index 4eb8e1a472b2..e335b18da20f 100644 | ||
498 | --- a/drivers/platform/x86/alienware-wmi.c | ||
499 | +++ b/drivers/platform/x86/alienware-wmi.c | ||
500 | @@ -519,6 +519,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args, | ||
501 | if (obj && obj->type == ACPI_TYPE_INTEGER) | ||
502 | *out_data = (u32) obj->integer.value; | ||
503 | } | ||
504 | + kfree(output.pointer); | ||
505 | return status; | ||
506 | |||
507 | } | ||
508 | diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c | ||
509 | index cec4c3223044..dffa3aab7178 100644 | ||
510 | --- a/drivers/rpmsg/rpmsg_core.c | ||
511 | +++ b/drivers/rpmsg/rpmsg_core.c | ||
512 | @@ -23,7 +23,6 @@ | ||
513 | #include <linux/module.h> | ||
514 | #include <linux/rpmsg.h> | ||
515 | #include <linux/of_device.h> | ||
516 | -#include <linux/pm_domain.h> | ||
517 | #include <linux/slab.h> | ||
518 | |||
519 | #include "rpmsg_internal.h" | ||
520 | @@ -419,10 +418,6 @@ static int rpmsg_dev_probe(struct device *dev) | ||
521 | struct rpmsg_endpoint *ept = NULL; | ||
522 | int err; | ||
523 | |||
524 | - err = dev_pm_domain_attach(dev, true); | ||
525 | - if (err) | ||
526 | - goto out; | ||
527 | - | ||
528 | if (rpdrv->callback) { | ||
529 | strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE); | ||
530 | chinfo.src = rpdev->src; | ||
531 | @@ -464,8 +459,6 @@ static int rpmsg_dev_remove(struct device *dev) | ||
532 | |||
533 | rpdrv->remove(rpdev); | ||
534 | |||
535 | - dev_pm_domain_detach(dev, true); | ||
536 | - | ||
537 | if (rpdev->ept) | ||
538 | rpmsg_destroy_ept(rpdev->ept); | ||
539 | |||
540 | diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c | ||
541 | index f85d30dc9187..670dbb7a8500 100644 | ||
542 | --- a/drivers/spi/spi.c | ||
543 | +++ b/drivers/spi/spi.c | ||
544 | @@ -2108,8 +2108,17 @@ int spi_register_controller(struct spi_controller *ctlr) | ||
545 | */ | ||
546 | if (ctlr->num_chipselect == 0) | ||
547 | return -EINVAL; | ||
548 | - /* allocate dynamic bus number using Linux idr */ | ||
549 | - if ((ctlr->bus_num < 0) && ctlr->dev.of_node) { | ||
550 | + if (ctlr->bus_num >= 0) { | ||
551 | + /* devices with a fixed bus num must check-in with the num */ | ||
552 | + mutex_lock(&board_lock); | ||
553 | + id = idr_alloc(&spi_master_idr, ctlr, ctlr->bus_num, | ||
554 | + ctlr->bus_num + 1, GFP_KERNEL); | ||
555 | + mutex_unlock(&board_lock); | ||
556 | + if (WARN(id < 0, "couldn't get idr")) | ||
557 | + return id == -ENOSPC ? -EBUSY : id; | ||
558 | + ctlr->bus_num = id; | ||
559 | + } else if (ctlr->dev.of_node) { | ||
560 | + /* allocate dynamic bus number using Linux idr */ | ||
561 | id = of_alias_get_id(ctlr->dev.of_node, "spi"); | ||
562 | if (id >= 0) { | ||
563 | ctlr->bus_num = id; | ||
564 | diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c | ||
565 | index 9518ffd8b8ba..4e680d753941 100644 | ||
566 | --- a/drivers/target/iscsi/iscsi_target_auth.c | ||
567 | +++ b/drivers/target/iscsi/iscsi_target_auth.c | ||
568 | @@ -26,27 +26,6 @@ | ||
569 | #include "iscsi_target_nego.h" | ||
570 | #include "iscsi_target_auth.h" | ||
571 | |||
572 | -static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len) | ||
573 | -{ | ||
574 | - int j = DIV_ROUND_UP(len, 2), rc; | ||
575 | - | ||
576 | - rc = hex2bin(dst, src, j); | ||
577 | - if (rc < 0) | ||
578 | - pr_debug("CHAP string contains non hex digit symbols\n"); | ||
579 | - | ||
580 | - dst[j] = '\0'; | ||
581 | - return j; | ||
582 | -} | ||
583 | - | ||
584 | -static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) | ||
585 | -{ | ||
586 | - int i; | ||
587 | - | ||
588 | - for (i = 0; i < src_len; i++) { | ||
589 | - sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff); | ||
590 | - } | ||
591 | -} | ||
592 | - | ||
593 | static int chap_gen_challenge( | ||
594 | struct iscsi_conn *conn, | ||
595 | int caller, | ||
596 | @@ -62,7 +41,7 @@ static int chap_gen_challenge( | ||
597 | ret = get_random_bytes_wait(chap->challenge, CHAP_CHALLENGE_LENGTH); | ||
598 | if (unlikely(ret)) | ||
599 | return ret; | ||
600 | - chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge, | ||
601 | + bin2hex(challenge_asciihex, chap->challenge, | ||
602 | CHAP_CHALLENGE_LENGTH); | ||
603 | /* | ||
604 | * Set CHAP_C, and copy the generated challenge into c_str. | ||
605 | @@ -248,9 +227,16 @@ static int chap_server_compute_md5( | ||
606 | pr_err("Could not find CHAP_R.\n"); | ||
607 | goto out; | ||
608 | } | ||
609 | + if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) { | ||
610 | + pr_err("Malformed CHAP_R\n"); | ||
611 | + goto out; | ||
612 | + } | ||
613 | + if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) { | ||
614 | + pr_err("Malformed CHAP_R\n"); | ||
615 | + goto out; | ||
616 | + } | ||
617 | |||
618 | pr_debug("[server] Got CHAP_R=%s\n", chap_r); | ||
619 | - chap_string_to_hex(client_digest, chap_r, strlen(chap_r)); | ||
620 | |||
621 | tfm = crypto_alloc_shash("md5", 0, 0); | ||
622 | if (IS_ERR(tfm)) { | ||
623 | @@ -294,7 +280,7 @@ static int chap_server_compute_md5( | ||
624 | goto out; | ||
625 | } | ||
626 | |||
627 | - chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE); | ||
628 | + bin2hex(response, server_digest, MD5_SIGNATURE_SIZE); | ||
629 | pr_debug("[server] MD5 Server Digest: %s\n", response); | ||
630 | |||
631 | if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) { | ||
632 | @@ -349,9 +335,7 @@ static int chap_server_compute_md5( | ||
633 | pr_err("Could not find CHAP_C.\n"); | ||
634 | goto out; | ||
635 | } | ||
636 | - pr_debug("[server] Got CHAP_C=%s\n", challenge); | ||
637 | - challenge_len = chap_string_to_hex(challenge_binhex, challenge, | ||
638 | - strlen(challenge)); | ||
639 | + challenge_len = DIV_ROUND_UP(strlen(challenge), 2); | ||
640 | if (!challenge_len) { | ||
641 | pr_err("Unable to convert incoming challenge\n"); | ||
642 | goto out; | ||
643 | @@ -360,6 +344,11 @@ static int chap_server_compute_md5( | ||
644 | pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n"); | ||
645 | goto out; | ||
646 | } | ||
647 | + if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) { | ||
648 | + pr_err("Malformed CHAP_C\n"); | ||
649 | + goto out; | ||
650 | + } | ||
651 | + pr_debug("[server] Got CHAP_C=%s\n", challenge); | ||
652 | /* | ||
653 | * During mutual authentication, the CHAP_C generated by the | ||
654 | * initiator must not match the original CHAP_C generated by | ||
655 | @@ -413,7 +402,7 @@ static int chap_server_compute_md5( | ||
656 | /* | ||
657 | * Convert response from binary hex to ascii hext. | ||
658 | */ | ||
659 | - chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE); | ||
660 | + bin2hex(response, digest, MD5_SIGNATURE_SIZE); | ||
661 | *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s", | ||
662 | response); | ||
663 | *nr_out_len += 1; | ||
664 | diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c | ||
665 | index 2d2b420598b2..7b34b0ddbf0e 100644 | ||
666 | --- a/drivers/tty/vt/vt_ioctl.c | ||
667 | +++ b/drivers/tty/vt/vt_ioctl.c | ||
668 | @@ -32,6 +32,8 @@ | ||
669 | #include <asm/io.h> | ||
670 | #include <linux/uaccess.h> | ||
671 | |||
672 | +#include <linux/nospec.h> | ||
673 | + | ||
674 | #include <linux/kbd_kern.h> | ||
675 | #include <linux/vt_kern.h> | ||
676 | #include <linux/kbd_diacr.h> | ||
677 | @@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty, | ||
678 | if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) | ||
679 | ret = -ENXIO; | ||
680 | else { | ||
681 | + vsa.console = array_index_nospec(vsa.console, | ||
682 | + MAX_NR_CONSOLES + 1); | ||
683 | vsa.console--; | ||
684 | console_lock(); | ||
685 | ret = vc_allocate(vsa.console); | ||
686 | diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c | ||
687 | index d5babc9f222b..dc676714454a 100644 | ||
688 | --- a/fs/ext4/dir.c | ||
689 | +++ b/fs/ext4/dir.c | ||
690 | @@ -75,7 +75,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, | ||
691 | else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len))) | ||
692 | error_msg = "rec_len is too small for name_len"; | ||
693 | else if (unlikely(((char *) de - buf) + rlen > size)) | ||
694 | - error_msg = "directory entry across range"; | ||
695 | + error_msg = "directory entry overrun"; | ||
696 | else if (unlikely(le32_to_cpu(de->inode) > | ||
697 | le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) | ||
698 | error_msg = "inode out of bounds"; | ||
699 | @@ -84,18 +84,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, | ||
700 | |||
701 | if (filp) | ||
702 | ext4_error_file(filp, function, line, bh->b_blocknr, | ||
703 | - "bad entry in directory: %s - offset=%u(%u), " | ||
704 | - "inode=%u, rec_len=%d, name_len=%d", | ||
705 | - error_msg, (unsigned) (offset % size), | ||
706 | - offset, le32_to_cpu(de->inode), | ||
707 | - rlen, de->name_len); | ||
708 | + "bad entry in directory: %s - offset=%u, " | ||
709 | + "inode=%u, rec_len=%d, name_len=%d, size=%d", | ||
710 | + error_msg, offset, le32_to_cpu(de->inode), | ||
711 | + rlen, de->name_len, size); | ||
712 | else | ||
713 | ext4_error_inode(dir, function, line, bh->b_blocknr, | ||
714 | - "bad entry in directory: %s - offset=%u(%u), " | ||
715 | - "inode=%u, rec_len=%d, name_len=%d", | ||
716 | - error_msg, (unsigned) (offset % size), | ||
717 | - offset, le32_to_cpu(de->inode), | ||
718 | - rlen, de->name_len); | ||
719 | + "bad entry in directory: %s - offset=%u, " | ||
720 | + "inode=%u, rec_len=%d, name_len=%d, size=%d", | ||
721 | + error_msg, offset, le32_to_cpu(de->inode), | ||
722 | + rlen, de->name_len, size); | ||
723 | |||
724 | return 1; | ||
725 | } | ||
726 | diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h | ||
727 | index 0abb30d19fa1..c96778c39885 100644 | ||
728 | --- a/fs/ext4/ext4.h | ||
729 | +++ b/fs/ext4/ext4.h | ||
730 | @@ -714,6 +714,9 @@ struct fsxattr { | ||
731 | /* Max physical block we can address w/o extents */ | ||
732 | #define EXT4_MAX_BLOCK_FILE_PHYS 0xFFFFFFFF | ||
733 | |||
734 | +/* Max logical block we can support */ | ||
735 | +#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFF | ||
736 | + | ||
737 | /* | ||
738 | * Structure of an inode on the disk | ||
739 | */ | ||
740 | diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c | ||
741 | index b549cfd2d7d3..4e1d62ba0703 100644 | ||
742 | --- a/fs/ext4/inline.c | ||
743 | +++ b/fs/ext4/inline.c | ||
744 | @@ -1759,6 +1759,7 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) | ||
745 | { | ||
746 | int err, inline_size; | ||
747 | struct ext4_iloc iloc; | ||
748 | + size_t inline_len; | ||
749 | void *inline_pos; | ||
750 | unsigned int offset; | ||
751 | struct ext4_dir_entry_2 *de; | ||
752 | @@ -1786,8 +1787,9 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) | ||
753 | goto out; | ||
754 | } | ||
755 | |||
756 | + inline_len = ext4_get_inline_size(dir); | ||
757 | offset = EXT4_INLINE_DOTDOT_SIZE; | ||
758 | - while (offset < dir->i_size) { | ||
759 | + while (offset < inline_len) { | ||
760 | de = ext4_get_inline_entry(dir, &iloc, offset, | ||
761 | &inline_pos, &inline_size); | ||
762 | if (ext4_check_dir_entry(dir, NULL, de, | ||
763 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c | ||
764 | index f9baa59de0e2..9808df52ceca 100644 | ||
765 | --- a/fs/ext4/inode.c | ||
766 | +++ b/fs/ext4/inode.c | ||
767 | @@ -3407,11 +3407,16 @@ static int ext4_iomap_begin(struct inode *inode, loff_t offset, loff_t length, | ||
768 | { | ||
769 | struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); | ||
770 | unsigned int blkbits = inode->i_blkbits; | ||
771 | - unsigned long first_block = offset >> blkbits; | ||
772 | - unsigned long last_block = (offset + length - 1) >> blkbits; | ||
773 | + unsigned long first_block, last_block; | ||
774 | struct ext4_map_blocks map; | ||
775 | int ret; | ||
776 | |||
777 | + if ((offset >> blkbits) > EXT4_MAX_LOGICAL_BLOCK) | ||
778 | + return -EINVAL; | ||
779 | + first_block = offset >> blkbits; | ||
780 | + last_block = min_t(loff_t, (offset + length - 1) >> blkbits, | ||
781 | + EXT4_MAX_LOGICAL_BLOCK); | ||
782 | + | ||
783 | if (WARN_ON_ONCE(ext4_has_inline_data(inode))) | ||
784 | return -ERANGE; | ||
785 | |||
786 | diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c | ||
787 | index 638ad4743477..38e6a846aac1 100644 | ||
788 | --- a/fs/ext4/mmp.c | ||
789 | +++ b/fs/ext4/mmp.c | ||
790 | @@ -49,7 +49,6 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh) | ||
791 | */ | ||
792 | sb_start_write(sb); | ||
793 | ext4_mmp_csum_set(sb, mmp); | ||
794 | - mark_buffer_dirty(bh); | ||
795 | lock_buffer(bh); | ||
796 | bh->b_end_io = end_buffer_write_sync; | ||
797 | get_bh(bh); | ||
798 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c | ||
799 | index 1db39e12e02b..eb0d8ee39827 100644 | ||
800 | --- a/fs/ext4/namei.c | ||
801 | +++ b/fs/ext4/namei.c | ||
802 | @@ -3514,6 +3514,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, | ||
803 | int credits; | ||
804 | u8 old_file_type; | ||
805 | |||
806 | + if (new.inode && new.inode->i_nlink == 0) { | ||
807 | + EXT4_ERROR_INODE(new.inode, | ||
808 | + "target of rename is already freed"); | ||
809 | + return -EFSCORRUPTED; | ||
810 | + } | ||
811 | + | ||
812 | if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT)) && | ||
813 | (!projid_eq(EXT4_I(new_dir)->i_projid, | ||
814 | EXT4_I(old_dentry->d_inode)->i_projid))) | ||
815 | diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c | ||
816 | index 823c0b82dfeb..e344e606c054 100644 | ||
817 | --- a/fs/ext4/resize.c | ||
818 | +++ b/fs/ext4/resize.c | ||
819 | @@ -19,6 +19,7 @@ | ||
820 | |||
821 | int ext4_resize_begin(struct super_block *sb) | ||
822 | { | ||
823 | + struct ext4_sb_info *sbi = EXT4_SB(sb); | ||
824 | int ret = 0; | ||
825 | |||
826 | if (!capable(CAP_SYS_RESOURCE)) | ||
827 | @@ -29,7 +30,7 @@ int ext4_resize_begin(struct super_block *sb) | ||
828 | * because the user tools have no way of handling this. Probably a | ||
829 | * bad time to do it anyways. | ||
830 | */ | ||
831 | - if (EXT4_SB(sb)->s_sbh->b_blocknr != | ||
832 | + if (EXT4_B2C(sbi, sbi->s_sbh->b_blocknr) != | ||
833 | le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) { | ||
834 | ext4_warning(sb, "won't resize using backup superblock at %llu", | ||
835 | (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr); | ||
836 | @@ -1956,6 +1957,26 @@ retry: | ||
837 | } | ||
838 | } | ||
839 | |||
840 | + /* | ||
841 | + * Make sure the last group has enough space so that it's | ||
842 | + * guaranteed to have enough space for all metadata blocks | ||
843 | + * that it might need to hold. (We might not need to store | ||
844 | + * the inode table blocks in the last block group, but there | ||
845 | + * will be cases where this might be needed.) | ||
846 | + */ | ||
847 | + if ((ext4_group_first_block_no(sb, n_group) + | ||
848 | + ext4_group_overhead_blocks(sb, n_group) + 2 + | ||
849 | + sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) { | ||
850 | + n_blocks_count = ext4_group_first_block_no(sb, n_group); | ||
851 | + n_group--; | ||
852 | + n_blocks_count_retry = 0; | ||
853 | + if (resize_inode) { | ||
854 | + iput(resize_inode); | ||
855 | + resize_inode = NULL; | ||
856 | + } | ||
857 | + goto retry; | ||
858 | + } | ||
859 | + | ||
860 | /* extend the last group */ | ||
861 | if (n_group == o_group) | ||
862 | add = n_blocks_count - o_blocks_count; | ||
863 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c | ||
864 | index b4fb085261fd..9dbd27f7b778 100644 | ||
865 | --- a/fs/ext4/super.c | ||
866 | +++ b/fs/ext4/super.c | ||
867 | @@ -2085,6 +2085,8 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, | ||
868 | SEQ_OPTS_PRINT("max_dir_size_kb=%u", sbi->s_max_dir_size_kb); | ||
869 | if (test_opt(sb, DATA_ERR_ABORT)) | ||
870 | SEQ_OPTS_PUTS("data_err=abort"); | ||
871 | + if (DUMMY_ENCRYPTION_ENABLED(sbi)) | ||
872 | + SEQ_OPTS_PUTS("test_dummy_encryption"); | ||
873 | |||
874 | ext4_show_quota_options(seq, sb); | ||
875 | return 0; | ||
876 | @@ -4311,11 +4313,13 @@ no_journal: | ||
877 | block = ext4_count_free_clusters(sb); | ||
878 | ext4_free_blocks_count_set(sbi->s_es, | ||
879 | EXT4_C2B(sbi, block)); | ||
880 | + ext4_superblock_csum_set(sb); | ||
881 | err = percpu_counter_init(&sbi->s_freeclusters_counter, block, | ||
882 | GFP_KERNEL); | ||
883 | if (!err) { | ||
884 | unsigned long freei = ext4_count_free_inodes(sb); | ||
885 | sbi->s_es->s_free_inodes_count = cpu_to_le32(freei); | ||
886 | + ext4_superblock_csum_set(sb); | ||
887 | err = percpu_counter_init(&sbi->s_freeinodes_counter, freei, | ||
888 | GFP_KERNEL); | ||
889 | } | ||
890 | diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c | ||
891 | index d9ebe11c8990..1d098c3c00e0 100644 | ||
892 | --- a/fs/ocfs2/buffer_head_io.c | ||
893 | +++ b/fs/ocfs2/buffer_head_io.c | ||
894 | @@ -342,6 +342,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, | ||
895 | * for this bh as it's not marked locally | ||
896 | * uptodate. */ | ||
897 | status = -EIO; | ||
898 | + clear_buffer_needs_validate(bh); | ||
899 | put_bh(bh); | ||
900 | bhs[i] = NULL; | ||
901 | continue; | ||
902 | diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c | ||
903 | index d47f16c0d582..c13eae819cbc 100644 | ||
904 | --- a/fs/ubifs/xattr.c | ||
905 | +++ b/fs/ubifs/xattr.c | ||
906 | @@ -152,12 +152,6 @@ static int create_xattr(struct ubifs_info *c, struct inode *host, | ||
907 | ui->data_len = size; | ||
908 | |||
909 | mutex_lock(&host_ui->ui_mutex); | ||
910 | - | ||
911 | - if (!host->i_nlink) { | ||
912 | - err = -ENOENT; | ||
913 | - goto out_noent; | ||
914 | - } | ||
915 | - | ||
916 | host->i_ctime = current_time(host); | ||
917 | host_ui->xattr_cnt += 1; | ||
918 | host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm)); | ||
919 | @@ -189,7 +183,6 @@ out_cancel: | ||
920 | host_ui->xattr_size -= CALC_XATTR_BYTES(size); | ||
921 | host_ui->xattr_names -= fname_len(nm); | ||
922 | host_ui->flags &= ~UBIFS_CRYPT_FL; | ||
923 | -out_noent: | ||
924 | mutex_unlock(&host_ui->ui_mutex); | ||
925 | out_free: | ||
926 | make_bad_inode(inode); | ||
927 | @@ -241,12 +234,6 @@ static int change_xattr(struct ubifs_info *c, struct inode *host, | ||
928 | mutex_unlock(&ui->ui_mutex); | ||
929 | |||
930 | mutex_lock(&host_ui->ui_mutex); | ||
931 | - | ||
932 | - if (!host->i_nlink) { | ||
933 | - err = -ENOENT; | ||
934 | - goto out_noent; | ||
935 | - } | ||
936 | - | ||
937 | host->i_ctime = current_time(host); | ||
938 | host_ui->xattr_size -= CALC_XATTR_BYTES(old_size); | ||
939 | host_ui->xattr_size += CALC_XATTR_BYTES(size); | ||
940 | @@ -268,7 +255,6 @@ static int change_xattr(struct ubifs_info *c, struct inode *host, | ||
941 | out_cancel: | ||
942 | host_ui->xattr_size -= CALC_XATTR_BYTES(size); | ||
943 | host_ui->xattr_size += CALC_XATTR_BYTES(old_size); | ||
944 | -out_noent: | ||
945 | mutex_unlock(&host_ui->ui_mutex); | ||
946 | make_bad_inode(inode); | ||
947 | out_free: | ||
948 | @@ -497,12 +483,6 @@ static int remove_xattr(struct ubifs_info *c, struct inode *host, | ||
949 | return err; | ||
950 | |||
951 | mutex_lock(&host_ui->ui_mutex); | ||
952 | - | ||
953 | - if (!host->i_nlink) { | ||
954 | - err = -ENOENT; | ||
955 | - goto out_noent; | ||
956 | - } | ||
957 | - | ||
958 | host->i_ctime = current_time(host); | ||
959 | host_ui->xattr_cnt -= 1; | ||
960 | host_ui->xattr_size -= CALC_DENT_SIZE(fname_len(nm)); | ||
961 | @@ -522,7 +502,6 @@ out_cancel: | ||
962 | host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm)); | ||
963 | host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len); | ||
964 | host_ui->xattr_names += fname_len(nm); | ||
965 | -out_noent: | ||
966 | mutex_unlock(&host_ui->ui_mutex); | ||
967 | ubifs_release_budget(c, &req); | ||
968 | make_bad_inode(inode); | ||
969 | @@ -562,9 +541,6 @@ static int ubifs_xattr_remove(struct inode *host, const char *name) | ||
970 | |||
971 | ubifs_assert(inode_is_locked(host)); | ||
972 | |||
973 | - if (!host->i_nlink) | ||
974 | - return -ENOENT; | ||
975 | - | ||
976 | if (fname_len(&nm) > UBIFS_MAX_NLEN) | ||
977 | return -ENAMETOOLONG; | ||
978 | |||
979 | diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h | ||
980 | index 316694dafa5b..008f466d1da7 100644 | ||
981 | --- a/include/net/nfc/hci.h | ||
982 | +++ b/include/net/nfc/hci.h | ||
983 | @@ -87,7 +87,7 @@ struct nfc_hci_pipe { | ||
984 | * According to specification 102 622 chapter 4.4 Pipes, | ||
985 | * the pipe identifier is 7 bits long. | ||
986 | */ | ||
987 | -#define NFC_HCI_MAX_PIPES 127 | ||
988 | +#define NFC_HCI_MAX_PIPES 128 | ||
989 | struct nfc_hci_init_data { | ||
990 | u8 gate_count; | ||
991 | struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES]; | ||
992 | diff --git a/include/net/tls.h b/include/net/tls.h | ||
993 | index 48940a883d9a..86ed3dd80fe7 100644 | ||
994 | --- a/include/net/tls.h | ||
995 | +++ b/include/net/tls.h | ||
996 | @@ -79,11 +79,13 @@ enum { | ||
997 | TLS_PENDING_CLOSED_RECORD | ||
998 | }; | ||
999 | |||
1000 | +union tls_crypto_context { | ||
1001 | + struct tls_crypto_info info; | ||
1002 | + struct tls12_crypto_info_aes_gcm_128 aes_gcm_128; | ||
1003 | +}; | ||
1004 | + | ||
1005 | struct tls_context { | ||
1006 | - union { | ||
1007 | - struct tls_crypto_info crypto_send; | ||
1008 | - struct tls12_crypto_info_aes_gcm_128 crypto_send_aes_gcm_128; | ||
1009 | - }; | ||
1010 | + union tls_crypto_context crypto_send; | ||
1011 | |||
1012 | void *priv_ctx; | ||
1013 | |||
1014 | @@ -208,8 +210,8 @@ static inline void tls_fill_prepend(struct tls_context *ctx, | ||
1015 | * size KTLS_DTLS_HEADER_SIZE + KTLS_DTLS_NONCE_EXPLICIT_SIZE | ||
1016 | */ | ||
1017 | buf[0] = record_type; | ||
1018 | - buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.version); | ||
1019 | - buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.version); | ||
1020 | + buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.info.version); | ||
1021 | + buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.info.version); | ||
1022 | /* we can use IV for nonce explicit according to spec */ | ||
1023 | buf[3] = pkt_len >> 8; | ||
1024 | buf[4] = pkt_len & 0xFF; | ||
1025 | diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h | ||
1026 | index 910cc4334b21..7b8c9e19bad1 100644 | ||
1027 | --- a/include/uapi/linux/keyctl.h | ||
1028 | +++ b/include/uapi/linux/keyctl.h | ||
1029 | @@ -65,7 +65,7 @@ | ||
1030 | |||
1031 | /* keyctl structures */ | ||
1032 | struct keyctl_dh_params { | ||
1033 | - __s32 dh_private; | ||
1034 | + __s32 private; | ||
1035 | __s32 prime; | ||
1036 | __s32 base; | ||
1037 | }; | ||
1038 | diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c | ||
1039 | index a5e20ceb0b5a..b2d699f28304 100644 | ||
1040 | --- a/kernel/sched/fair.c | ||
1041 | +++ b/kernel/sched/fair.c | ||
1042 | @@ -9137,7 +9137,8 @@ static inline bool vruntime_normalized(struct task_struct *p) | ||
1043 | * - A task which has been woken up by try_to_wake_up() and | ||
1044 | * waiting for actually being woken up by sched_ttwu_pending(). | ||
1045 | */ | ||
1046 | - if (!se->sum_exec_runtime || p->state == TASK_WAKING) | ||
1047 | + if (!se->sum_exec_runtime || | ||
1048 | + (p->state == TASK_WAKING && p->sched_remote_wakeup)) | ||
1049 | return true; | ||
1050 | |||
1051 | return false; | ||
1052 | diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c | ||
1053 | index ea3c062e7e1c..a8fa0a896b78 100644 | ||
1054 | --- a/kernel/time/tick-sched.c | ||
1055 | +++ b/kernel/time/tick-sched.c | ||
1056 | @@ -908,7 +908,7 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts) | ||
1057 | if (unlikely(local_softirq_pending() && cpu_online(cpu))) { | ||
1058 | static int ratelimit; | ||
1059 | |||
1060 | - if (ratelimit < 10 && | ||
1061 | + if (ratelimit < 10 && !in_softirq() && | ||
1062 | (local_softirq_pending() & SOFTIRQ_STOP_IDLE_MASK)) { | ||
1063 | pr_warn("NOHZ: local_softirq_pending %02x\n", | ||
1064 | (unsigned int) local_softirq_pending()); | ||
1065 | diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c | ||
1066 | index fd7809004297..a1d5e0949dcf 100644 | ||
1067 | --- a/kernel/trace/ring_buffer.c | ||
1068 | +++ b/kernel/trace/ring_buffer.c | ||
1069 | @@ -1479,6 +1479,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) | ||
1070 | tmp_iter_page = first_page; | ||
1071 | |||
1072 | do { | ||
1073 | + cond_resched(); | ||
1074 | + | ||
1075 | to_remove_page = tmp_iter_page; | ||
1076 | rb_inc_page(cpu_buffer, &tmp_iter_page); | ||
1077 | |||
1078 | diff --git a/mm/shmem.c b/mm/shmem.c | ||
1079 | index f383298b7280..ea786a504e1b 100644 | ||
1080 | --- a/mm/shmem.c | ||
1081 | +++ b/mm/shmem.c | ||
1082 | @@ -2207,6 +2207,8 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode | ||
1083 | mpol_shared_policy_init(&info->policy, NULL); | ||
1084 | break; | ||
1085 | } | ||
1086 | + | ||
1087 | + lockdep_annotate_inode_mutex_key(inode); | ||
1088 | } else | ||
1089 | shmem_free_inode(sb); | ||
1090 | return inode; | ||
1091 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c | ||
1092 | index 514d697d4691..dcb89cbc2730 100644 | ||
1093 | --- a/net/core/neighbour.c | ||
1094 | +++ b/net/core/neighbour.c | ||
1095 | @@ -1174,6 +1174,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, | ||
1096 | lladdr = neigh->ha; | ||
1097 | } | ||
1098 | |||
1099 | + /* Update confirmed timestamp for neighbour entry after we | ||
1100 | + * received ARP packet even if it doesn't change IP to MAC binding. | ||
1101 | + */ | ||
1102 | + if (new & NUD_CONNECTED) | ||
1103 | + neigh->confirmed = jiffies; | ||
1104 | + | ||
1105 | /* If entry was valid and address is not changed, | ||
1106 | do not change entry state, if new one is STALE. | ||
1107 | */ | ||
1108 | @@ -1195,15 +1201,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, | ||
1109 | } | ||
1110 | } | ||
1111 | |||
1112 | - /* Update timestamps only once we know we will make a change to the | ||
1113 | + /* Update timestamp only once we know we will make a change to the | ||
1114 | * neighbour entry. Otherwise we risk to move the locktime window with | ||
1115 | * noop updates and ignore relevant ARP updates. | ||
1116 | */ | ||
1117 | - if (new != old || lladdr != neigh->ha) { | ||
1118 | - if (new & NUD_CONNECTED) | ||
1119 | - neigh->confirmed = jiffies; | ||
1120 | + if (new != old || lladdr != neigh->ha) | ||
1121 | neigh->updated = jiffies; | ||
1122 | - } | ||
1123 | |||
1124 | if (new != old) { | ||
1125 | neigh_del_timer(neigh); | ||
1126 | diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c | ||
1127 | index b9d9a2b8792c..f31c09873d0f 100644 | ||
1128 | --- a/net/ipv4/af_inet.c | ||
1129 | +++ b/net/ipv4/af_inet.c | ||
1130 | @@ -1307,6 +1307,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, | ||
1131 | if (encap) | ||
1132 | skb_reset_inner_headers(skb); | ||
1133 | skb->network_header = (u8 *)iph - skb->head; | ||
1134 | + skb_reset_mac_len(skb); | ||
1135 | } while ((skb = skb->next)); | ||
1136 | |||
1137 | out: | ||
1138 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c | ||
1139 | index 5752bf7593dc..3de413867991 100644 | ||
1140 | --- a/net/ipv4/udp.c | ||
1141 | +++ b/net/ipv4/udp.c | ||
1142 | @@ -2049,6 +2049,28 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh, | ||
1143 | inet_compute_pseudo); | ||
1144 | } | ||
1145 | |||
1146 | +/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and | ||
1147 | + * return code conversion for ip layer consumption | ||
1148 | + */ | ||
1149 | +static int udp_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb, | ||
1150 | + struct udphdr *uh) | ||
1151 | +{ | ||
1152 | + int ret; | ||
1153 | + | ||
1154 | + if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) | ||
1155 | + skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, | ||
1156 | + inet_compute_pseudo); | ||
1157 | + | ||
1158 | + ret = udp_queue_rcv_skb(sk, skb); | ||
1159 | + | ||
1160 | + /* a return value > 0 means to resubmit the input, but | ||
1161 | + * it wants the return to be -protocol, or 0 | ||
1162 | + */ | ||
1163 | + if (ret > 0) | ||
1164 | + return -ret; | ||
1165 | + return 0; | ||
1166 | +} | ||
1167 | + | ||
1168 | /* | ||
1169 | * All we need to do is get the socket, and then do a checksum. | ||
1170 | */ | ||
1171 | @@ -2095,14 +2117,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | ||
1172 | if (unlikely(sk->sk_rx_dst != dst)) | ||
1173 | udp_sk_rx_dst_set(sk, dst); | ||
1174 | |||
1175 | - ret = udp_queue_rcv_skb(sk, skb); | ||
1176 | + ret = udp_unicast_rcv_skb(sk, skb, uh); | ||
1177 | sock_put(sk); | ||
1178 | - /* a return value > 0 means to resubmit the input, but | ||
1179 | - * it wants the return to be -protocol, or 0 | ||
1180 | - */ | ||
1181 | - if (ret > 0) | ||
1182 | - return -ret; | ||
1183 | - return 0; | ||
1184 | + return ret; | ||
1185 | } | ||
1186 | |||
1187 | if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST)) | ||
1188 | @@ -2110,22 +2127,8 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | ||
1189 | saddr, daddr, udptable, proto); | ||
1190 | |||
1191 | sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable); | ||
1192 | - if (sk) { | ||
1193 | - int ret; | ||
1194 | - | ||
1195 | - if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) | ||
1196 | - skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, | ||
1197 | - inet_compute_pseudo); | ||
1198 | - | ||
1199 | - ret = udp_queue_rcv_skb(sk, skb); | ||
1200 | - | ||
1201 | - /* a return value > 0 means to resubmit the input, but | ||
1202 | - * it wants the return to be -protocol, or 0 | ||
1203 | - */ | ||
1204 | - if (ret > 0) | ||
1205 | - return -ret; | ||
1206 | - return 0; | ||
1207 | - } | ||
1208 | + if (sk) | ||
1209 | + return udp_unicast_rcv_skb(sk, skb, uh); | ||
1210 | |||
1211 | if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) | ||
1212 | goto drop; | ||
1213 | diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c | ||
1214 | index 4a87f9428ca5..e3698b6d8231 100644 | ||
1215 | --- a/net/ipv6/ip6_offload.c | ||
1216 | +++ b/net/ipv6/ip6_offload.c | ||
1217 | @@ -113,6 +113,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, | ||
1218 | payload_len = skb->len - nhoff - sizeof(*ipv6h); | ||
1219 | ipv6h->payload_len = htons(payload_len); | ||
1220 | skb->network_header = (u8 *)ipv6h - skb->head; | ||
1221 | + skb_reset_mac_len(skb); | ||
1222 | |||
1223 | if (udpfrag) { | ||
1224 | int err = ip6_find_1stfragopt(skb, &prevhdr); | ||
1225 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c | ||
1226 | index 1da021527fcd..9ab1e0fcbc13 100644 | ||
1227 | --- a/net/ipv6/ip6_output.c | ||
1228 | +++ b/net/ipv6/ip6_output.c | ||
1229 | @@ -219,12 +219,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, | ||
1230 | kfree_skb(skb); | ||
1231 | return -ENOBUFS; | ||
1232 | } | ||
1233 | + if (skb->sk) | ||
1234 | + skb_set_owner_w(skb2, skb->sk); | ||
1235 | consume_skb(skb); | ||
1236 | skb = skb2; | ||
1237 | - /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically, | ||
1238 | - * it is safe to call in our context (socket lock not held) | ||
1239 | - */ | ||
1240 | - skb_set_owner_w(skb, (struct sock *)sk); | ||
1241 | } | ||
1242 | if (opt->opt_flen) | ||
1243 | ipv6_push_frag_opts(skb, opt, &proto); | ||
1244 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c | ||
1245 | index 330d5ea8451b..5cee941ab0a9 100644 | ||
1246 | --- a/net/ipv6/udp.c | ||
1247 | +++ b/net/ipv6/udp.c | ||
1248 | @@ -780,6 +780,28 @@ static void udp6_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst) | ||
1249 | } | ||
1250 | } | ||
1251 | |||
1252 | +/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and | ||
1253 | + * return code conversion for ip layer consumption | ||
1254 | + */ | ||
1255 | +static int udp6_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb, | ||
1256 | + struct udphdr *uh) | ||
1257 | +{ | ||
1258 | + int ret; | ||
1259 | + | ||
1260 | + if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) | ||
1261 | + skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, | ||
1262 | + ip6_compute_pseudo); | ||
1263 | + | ||
1264 | + ret = udpv6_queue_rcv_skb(sk, skb); | ||
1265 | + | ||
1266 | + /* a return value > 0 means to resubmit the input, but | ||
1267 | + * it wants the return to be -protocol, or 0 | ||
1268 | + */ | ||
1269 | + if (ret > 0) | ||
1270 | + return -ret; | ||
1271 | + return 0; | ||
1272 | +} | ||
1273 | + | ||
1274 | int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | ||
1275 | int proto) | ||
1276 | { | ||
1277 | @@ -831,13 +853,14 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | ||
1278 | if (unlikely(sk->sk_rx_dst != dst)) | ||
1279 | udp6_sk_rx_dst_set(sk, dst); | ||
1280 | |||
1281 | - ret = udpv6_queue_rcv_skb(sk, skb); | ||
1282 | - sock_put(sk); | ||
1283 | + if (!uh->check && !udp_sk(sk)->no_check6_rx) { | ||
1284 | + sock_put(sk); | ||
1285 | + goto report_csum_error; | ||
1286 | + } | ||
1287 | |||
1288 | - /* a return value > 0 means to resubmit the input */ | ||
1289 | - if (ret > 0) | ||
1290 | - return ret; | ||
1291 | - return 0; | ||
1292 | + ret = udp6_unicast_rcv_skb(sk, skb, uh); | ||
1293 | + sock_put(sk); | ||
1294 | + return ret; | ||
1295 | } | ||
1296 | |||
1297 | /* | ||
1298 | @@ -850,30 +873,13 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | ||
1299 | /* Unicast */ | ||
1300 | sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable); | ||
1301 | if (sk) { | ||
1302 | - int ret; | ||
1303 | - | ||
1304 | - if (!uh->check && !udp_sk(sk)->no_check6_rx) { | ||
1305 | - udp6_csum_zero_error(skb); | ||
1306 | - goto csum_error; | ||
1307 | - } | ||
1308 | - | ||
1309 | - if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) | ||
1310 | - skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, | ||
1311 | - ip6_compute_pseudo); | ||
1312 | - | ||
1313 | - ret = udpv6_queue_rcv_skb(sk, skb); | ||
1314 | - | ||
1315 | - /* a return value > 0 means to resubmit the input */ | ||
1316 | - if (ret > 0) | ||
1317 | - return ret; | ||
1318 | - | ||
1319 | - return 0; | ||
1320 | + if (!uh->check && !udp_sk(sk)->no_check6_rx) | ||
1321 | + goto report_csum_error; | ||
1322 | + return udp6_unicast_rcv_skb(sk, skb, uh); | ||
1323 | } | ||
1324 | |||
1325 | - if (!uh->check) { | ||
1326 | - udp6_csum_zero_error(skb); | ||
1327 | - goto csum_error; | ||
1328 | - } | ||
1329 | + if (!uh->check) | ||
1330 | + goto report_csum_error; | ||
1331 | |||
1332 | if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) | ||
1333 | goto discard; | ||
1334 | @@ -894,6 +900,9 @@ short_packet: | ||
1335 | ulen, skb->len, | ||
1336 | daddr, ntohs(uh->dest)); | ||
1337 | goto discard; | ||
1338 | + | ||
1339 | +report_csum_error: | ||
1340 | + udp6_csum_zero_error(skb); | ||
1341 | csum_error: | ||
1342 | __UDP6_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE); | ||
1343 | discard: | ||
1344 | diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c | ||
1345 | index b740fef0acc5..6bf14f4f4b42 100644 | ||
1346 | --- a/net/nfc/hci/core.c | ||
1347 | +++ b/net/nfc/hci/core.c | ||
1348 | @@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, | ||
1349 | } | ||
1350 | create_info = (struct hci_create_pipe_resp *)skb->data; | ||
1351 | |||
1352 | + if (create_info->pipe >= NFC_HCI_MAX_PIPES) { | ||
1353 | + status = NFC_HCI_ANY_E_NOK; | ||
1354 | + goto exit; | ||
1355 | + } | ||
1356 | + | ||
1357 | /* Save the new created pipe and bind with local gate, | ||
1358 | * the description for skb->data[3] is destination gate id | ||
1359 | * but since we received this cmd from host controller, we | ||
1360 | @@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, | ||
1361 | } | ||
1362 | delete_info = (struct hci_delete_pipe_noti *)skb->data; | ||
1363 | |||
1364 | + if (delete_info->pipe >= NFC_HCI_MAX_PIPES) { | ||
1365 | + status = NFC_HCI_ANY_E_NOK; | ||
1366 | + goto exit; | ||
1367 | + } | ||
1368 | + | ||
1369 | hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE; | ||
1370 | hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST; | ||
1371 | break; | ||
1372 | diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c | ||
1373 | index 53752b9327d0..a859b55d7899 100644 | ||
1374 | --- a/net/sched/act_sample.c | ||
1375 | +++ b/net/sched/act_sample.c | ||
1376 | @@ -64,7 +64,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, | ||
1377 | |||
1378 | if (!exists) { | ||
1379 | ret = tcf_idr_create(tn, parm->index, est, a, | ||
1380 | - &act_sample_ops, bind, false); | ||
1381 | + &act_sample_ops, bind, true); | ||
1382 | if (ret) | ||
1383 | return ret; | ||
1384 | ret = ACT_P_CREATED; | ||
1385 | diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c | ||
1386 | index 055b9992d8c7..efa2cdba99d3 100644 | ||
1387 | --- a/net/tls/tls_main.c | ||
1388 | +++ b/net/tls/tls_main.c | ||
1389 | @@ -218,6 +218,15 @@ static void tls_write_space(struct sock *sk) | ||
1390 | ctx->sk_write_space(sk); | ||
1391 | } | ||
1392 | |||
1393 | +static void tls_ctx_free(struct tls_context *ctx) | ||
1394 | +{ | ||
1395 | + if (!ctx) | ||
1396 | + return; | ||
1397 | + | ||
1398 | + memzero_explicit(&ctx->crypto_send, sizeof(ctx->crypto_send)); | ||
1399 | + kfree(ctx); | ||
1400 | +} | ||
1401 | + | ||
1402 | static void tls_sk_proto_close(struct sock *sk, long timeout) | ||
1403 | { | ||
1404 | struct tls_context *ctx = tls_get_ctx(sk); | ||
1405 | @@ -246,7 +255,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout) | ||
1406 | kfree(ctx->iv); | ||
1407 | |||
1408 | sk_proto_close = ctx->sk_proto_close; | ||
1409 | - kfree(ctx); | ||
1410 | + tls_ctx_free(ctx); | ||
1411 | |||
1412 | release_sock(sk); | ||
1413 | sk_proto_close(sk, timeout); | ||
1414 | @@ -274,7 +283,7 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval, | ||
1415 | } | ||
1416 | |||
1417 | /* get user crypto info */ | ||
1418 | - crypto_info = &ctx->crypto_send; | ||
1419 | + crypto_info = &ctx->crypto_send.info; | ||
1420 | |||
1421 | if (!TLS_CRYPTO_INFO_READY(crypto_info)) { | ||
1422 | rc = -EBUSY; | ||
1423 | @@ -371,7 +380,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval, | ||
1424 | } | ||
1425 | |||
1426 | /* get user crypto info */ | ||
1427 | - crypto_info = &ctx->crypto_send; | ||
1428 | + crypto_info = &ctx->crypto_send.info; | ||
1429 | |||
1430 | /* Currently we don't support set crypto info more than one time */ | ||
1431 | if (TLS_CRYPTO_INFO_READY(crypto_info)) { | ||
1432 | @@ -416,7 +425,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval, | ||
1433 | goto out; | ||
1434 | |||
1435 | err_crypto_info: | ||
1436 | - memset(crypto_info, 0, sizeof(*crypto_info)); | ||
1437 | + memzero_explicit(crypto_info, sizeof(union tls_crypto_context)); | ||
1438 | out: | ||
1439 | return rc; | ||
1440 | } | ||
1441 | diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c | ||
1442 | index b81aa6d7dc45..6ae9ca567d6c 100644 | ||
1443 | --- a/net/tls/tls_sw.c | ||
1444 | +++ b/net/tls/tls_sw.c | ||
1445 | @@ -661,7 +661,6 @@ static void tls_sw_free_resources(struct sock *sk) | ||
1446 | |||
1447 | int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx) | ||
1448 | { | ||
1449 | - char keyval[TLS_CIPHER_AES_GCM_128_KEY_SIZE]; | ||
1450 | struct tls_crypto_info *crypto_info; | ||
1451 | struct tls12_crypto_info_aes_gcm_128 *gcm_128_info; | ||
1452 | struct tls_sw_context *sw_ctx; | ||
1453 | @@ -688,7 +687,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx) | ||
1454 | ctx->priv_ctx = (struct tls_offload_context *)sw_ctx; | ||
1455 | ctx->free_resources = tls_sw_free_resources; | ||
1456 | |||
1457 | - crypto_info = &ctx->crypto_send; | ||
1458 | + crypto_info = &ctx->crypto_send.info; | ||
1459 | switch (crypto_info->cipher_type) { | ||
1460 | case TLS_CIPHER_AES_GCM_128: { | ||
1461 | nonce_size = TLS_CIPHER_AES_GCM_128_IV_SIZE; | ||
1462 | @@ -753,9 +752,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx) | ||
1463 | |||
1464 | ctx->push_pending_record = tls_sw_push_pending_record; | ||
1465 | |||
1466 | - memcpy(keyval, gcm_128_info->key, TLS_CIPHER_AES_GCM_128_KEY_SIZE); | ||
1467 | - | ||
1468 | - rc = crypto_aead_setkey(sw_ctx->aead_send, keyval, | ||
1469 | + rc = crypto_aead_setkey(sw_ctx->aead_send, gcm_128_info->key, | ||
1470 | TLS_CIPHER_AES_GCM_128_KEY_SIZE); | ||
1471 | if (rc) | ||
1472 | goto free_aead; | ||
1473 | diff --git a/security/keys/dh.c b/security/keys/dh.c | ||
1474 | index 35543f04e759..d1ea9f325f94 100644 | ||
1475 | --- a/security/keys/dh.c | ||
1476 | +++ b/security/keys/dh.c | ||
1477 | @@ -307,7 +307,7 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params, | ||
1478 | } | ||
1479 | dh_inputs.g_size = dlen; | ||
1480 | |||
1481 | - dlen = dh_data_from_key(pcopy.dh_private, &dh_inputs.key); | ||
1482 | + dlen = dh_data_from_key(pcopy.private, &dh_inputs.key); | ||
1483 | if (dlen < 0) { | ||
1484 | ret = dlen; | ||
1485 | goto out2; | ||
1486 | diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c | ||
1487 | index 730ea91d9be8..93676354f87f 100644 | ||
1488 | --- a/sound/firewire/bebob/bebob.c | ||
1489 | +++ b/sound/firewire/bebob/bebob.c | ||
1490 | @@ -263,6 +263,8 @@ do_registration(struct work_struct *work) | ||
1491 | error: | ||
1492 | mutex_unlock(&devices_mutex); | ||
1493 | snd_bebob_stream_destroy_duplex(bebob); | ||
1494 | + kfree(bebob->maudio_special_quirk); | ||
1495 | + bebob->maudio_special_quirk = NULL; | ||
1496 | snd_card_free(bebob->card); | ||
1497 | dev_info(&bebob->unit->device, | ||
1498 | "Sound card registration failed: %d\n", err); | ||
1499 | diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c | ||
1500 | index bd55620c6a47..c266997ad299 100644 | ||
1501 | --- a/sound/firewire/bebob/bebob_maudio.c | ||
1502 | +++ b/sound/firewire/bebob/bebob_maudio.c | ||
1503 | @@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) | ||
1504 | struct fw_device *device = fw_parent_device(unit); | ||
1505 | int err, rcode; | ||
1506 | u64 date; | ||
1507 | - __le32 cues[3] = { | ||
1508 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE1), | ||
1509 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE2), | ||
1510 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE3) | ||
1511 | - }; | ||
1512 | + __le32 *cues; | ||
1513 | |||
1514 | /* check date of software used to build */ | ||
1515 | err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE, | ||
1516 | &date, sizeof(u64)); | ||
1517 | if (err < 0) | ||
1518 | - goto end; | ||
1519 | + return err; | ||
1520 | /* | ||
1521 | * firmware version 5058 or later has date later than "20070401", but | ||
1522 | * 'date' is not null-terminated. | ||
1523 | @@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) | ||
1524 | if (date < 0x3230303730343031LL) { | ||
1525 | dev_err(&unit->device, | ||
1526 | "Use firmware version 5058 or later\n"); | ||
1527 | - err = -ENOSYS; | ||
1528 | - goto end; | ||
1529 | + return -ENXIO; | ||
1530 | } | ||
1531 | |||
1532 | + cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL); | ||
1533 | + if (!cues) | ||
1534 | + return -ENOMEM; | ||
1535 | + | ||
1536 | + cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1); | ||
1537 | + cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2); | ||
1538 | + cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3); | ||
1539 | + | ||
1540 | rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST, | ||
1541 | device->node_id, device->generation, | ||
1542 | device->max_speed, BEBOB_ADDR_REG_REQ, | ||
1543 | - cues, sizeof(cues)); | ||
1544 | + cues, 3 * sizeof(*cues)); | ||
1545 | + kfree(cues); | ||
1546 | if (rcode != RCODE_COMPLETE) { | ||
1547 | dev_err(&unit->device, | ||
1548 | "Failed to send a cue to load firmware\n"); | ||
1549 | err = -EIO; | ||
1550 | } | ||
1551 | -end: | ||
1552 | + | ||
1553 | return err; | ||
1554 | } | ||
1555 | |||
1556 | @@ -290,10 +294,6 @@ snd_bebob_maudio_special_discover(struct snd_bebob *bebob, bool is1814) | ||
1557 | bebob->midi_output_ports = 2; | ||
1558 | } | ||
1559 | end: | ||
1560 | - if (err < 0) { | ||
1561 | - kfree(params); | ||
1562 | - bebob->maudio_special_quirk = NULL; | ||
1563 | - } | ||
1564 | mutex_unlock(&bebob->mutex); | ||
1565 | return err; | ||
1566 | } | ||
1567 | diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c | ||
1568 | index 1f5e1d23f31a..ef689997d6a5 100644 | ||
1569 | --- a/sound/firewire/digi00x/digi00x.c | ||
1570 | +++ b/sound/firewire/digi00x/digi00x.c | ||
1571 | @@ -49,6 +49,7 @@ static void dg00x_free(struct snd_dg00x *dg00x) | ||
1572 | fw_unit_put(dg00x->unit); | ||
1573 | |||
1574 | mutex_destroy(&dg00x->mutex); | ||
1575 | + kfree(dg00x); | ||
1576 | } | ||
1577 | |||
1578 | static void dg00x_card_free(struct snd_card *card) | ||
1579 | diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c | ||
1580 | index 12aa15df435d..9f5036442ab9 100644 | ||
1581 | --- a/sound/firewire/fireface/ff-protocol-ff400.c | ||
1582 | +++ b/sound/firewire/fireface/ff-protocol-ff400.c | ||
1583 | @@ -146,6 +146,7 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable) | ||
1584 | { | ||
1585 | __le32 *reg; | ||
1586 | int i; | ||
1587 | + int err; | ||
1588 | |||
1589 | reg = kzalloc(sizeof(__le32) * 18, GFP_KERNEL); | ||
1590 | if (reg == NULL) | ||
1591 | @@ -163,9 +164,11 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable) | ||
1592 | reg[i] = cpu_to_le32(0x00000001); | ||
1593 | } | ||
1594 | |||
1595 | - return snd_fw_transaction(ff->unit, TCODE_WRITE_BLOCK_REQUEST, | ||
1596 | - FF400_FETCH_PCM_FRAMES, reg, | ||
1597 | - sizeof(__le32) * 18, 0); | ||
1598 | + err = snd_fw_transaction(ff->unit, TCODE_WRITE_BLOCK_REQUEST, | ||
1599 | + FF400_FETCH_PCM_FRAMES, reg, | ||
1600 | + sizeof(__le32) * 18, 0); | ||
1601 | + kfree(reg); | ||
1602 | + return err; | ||
1603 | } | ||
1604 | |||
1605 | static void ff400_dump_sync_status(struct snd_ff *ff, | ||
1606 | diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c | ||
1607 | index 71a0613d3da0..f2d073365cf6 100644 | ||
1608 | --- a/sound/firewire/fireworks/fireworks.c | ||
1609 | +++ b/sound/firewire/fireworks/fireworks.c | ||
1610 | @@ -301,6 +301,8 @@ error: | ||
1611 | snd_efw_transaction_remove_instance(efw); | ||
1612 | snd_efw_stream_destroy_duplex(efw); | ||
1613 | snd_card_free(efw->card); | ||
1614 | + kfree(efw->resp_buf); | ||
1615 | + efw->resp_buf = NULL; | ||
1616 | dev_info(&efw->unit->device, | ||
1617 | "Sound card registration failed: %d\n", err); | ||
1618 | } | ||
1619 | diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c | ||
1620 | index 413ab6313bb6..a315d5b6b86b 100644 | ||
1621 | --- a/sound/firewire/oxfw/oxfw.c | ||
1622 | +++ b/sound/firewire/oxfw/oxfw.c | ||
1623 | @@ -136,6 +136,7 @@ static void oxfw_free(struct snd_oxfw *oxfw) | ||
1624 | |||
1625 | kfree(oxfw->spec); | ||
1626 | mutex_destroy(&oxfw->mutex); | ||
1627 | + kfree(oxfw); | ||
1628 | } | ||
1629 | |||
1630 | /* | ||
1631 | @@ -213,6 +214,7 @@ static int detect_quirks(struct snd_oxfw *oxfw) | ||
1632 | static void do_registration(struct work_struct *work) | ||
1633 | { | ||
1634 | struct snd_oxfw *oxfw = container_of(work, struct snd_oxfw, dwork.work); | ||
1635 | + int i; | ||
1636 | int err; | ||
1637 | |||
1638 | if (oxfw->registered) | ||
1639 | @@ -275,7 +277,15 @@ error: | ||
1640 | snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream); | ||
1641 | if (oxfw->has_output) | ||
1642 | snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream); | ||
1643 | + for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; ++i) { | ||
1644 | + kfree(oxfw->tx_stream_formats[i]); | ||
1645 | + oxfw->tx_stream_formats[i] = NULL; | ||
1646 | + kfree(oxfw->rx_stream_formats[i]); | ||
1647 | + oxfw->rx_stream_formats[i] = NULL; | ||
1648 | + } | ||
1649 | snd_card_free(oxfw->card); | ||
1650 | + kfree(oxfw->spec); | ||
1651 | + oxfw->spec = NULL; | ||
1652 | dev_info(&oxfw->unit->device, | ||
1653 | "Sound card registration failed: %d\n", err); | ||
1654 | } | ||
1655 | diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c | ||
1656 | index 44ad41fb7374..d3fdc463a884 100644 | ||
1657 | --- a/sound/firewire/tascam/tascam.c | ||
1658 | +++ b/sound/firewire/tascam/tascam.c | ||
1659 | @@ -93,6 +93,7 @@ static void tscm_free(struct snd_tscm *tscm) | ||
1660 | fw_unit_put(tscm->unit); | ||
1661 | |||
1662 | mutex_destroy(&tscm->mutex); | ||
1663 | + kfree(tscm); | ||
1664 | } | ||
1665 | |||
1666 | static void tscm_card_free(struct snd_card *card) | ||
1667 | diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c | ||
1668 | index a2b56b188be4..d68bb40d3676 100644 | ||
1669 | --- a/sound/pci/emu10k1/emufx.c | ||
1670 | +++ b/sound/pci/emu10k1/emufx.c | ||
1671 | @@ -2547,7 +2547,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un | ||
1672 | emu->support_tlv = 1; | ||
1673 | return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp); | ||
1674 | case SNDRV_EMU10K1_IOCTL_INFO: | ||
1675 | - info = kmalloc(sizeof(*info), GFP_KERNEL); | ||
1676 | + info = kzalloc(sizeof(*info), GFP_KERNEL); | ||
1677 | if (!info) | ||
1678 | return -ENOMEM; | ||
1679 | snd_emu10k1_fx8010_info(emu, info); | ||
1680 | diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c | ||
1681 | index fd966bb851cb..6e8eb1f5a041 100644 | ||
1682 | --- a/sound/soc/codecs/cs4265.c | ||
1683 | +++ b/sound/soc/codecs/cs4265.c | ||
1684 | @@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = { | ||
1685 | SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2, | ||
1686 | 3, 1, 0), | ||
1687 | SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum), | ||
1688 | - SOC_SINGLE("MMTLR Data Switch", 0, | ||
1689 | - 1, 1, 0), | ||
1690 | + SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2, | ||
1691 | + 0, 1, 0), | ||
1692 | SOC_ENUM("Mono Channel Select", spdif_mono_select_enum), | ||
1693 | SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24), | ||
1694 | }; | ||
1695 | diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c | ||
1696 | index 107133297e8d..9896e736fa5c 100644 | ||
1697 | --- a/sound/soc/sh/rcar/core.c | ||
1698 | +++ b/sound/soc/sh/rcar/core.c | ||
1699 | @@ -925,12 +925,23 @@ static void rsnd_soc_dai_shutdown(struct snd_pcm_substream *substream, | ||
1700 | rsnd_dai_call(nolock_stop, io, priv); | ||
1701 | } | ||
1702 | |||
1703 | +static int rsnd_soc_dai_prepare(struct snd_pcm_substream *substream, | ||
1704 | + struct snd_soc_dai *dai) | ||
1705 | +{ | ||
1706 | + struct rsnd_priv *priv = rsnd_dai_to_priv(dai); | ||
1707 | + struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); | ||
1708 | + struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream); | ||
1709 | + | ||
1710 | + return rsnd_dai_call(prepare, io, priv); | ||
1711 | +} | ||
1712 | + | ||
1713 | static const struct snd_soc_dai_ops rsnd_soc_dai_ops = { | ||
1714 | .startup = rsnd_soc_dai_startup, | ||
1715 | .shutdown = rsnd_soc_dai_shutdown, | ||
1716 | .trigger = rsnd_soc_dai_trigger, | ||
1717 | .set_fmt = rsnd_soc_dai_set_fmt, | ||
1718 | .set_tdm_slot = rsnd_soc_set_dai_tdm_slot, | ||
1719 | + .prepare = rsnd_soc_dai_prepare, | ||
1720 | }; | ||
1721 | |||
1722 | void rsnd_parse_connect_common(struct rsnd_dai *rdai, | ||
1723 | diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h | ||
1724 | index c5de71f2dc8c..1768a0ae469d 100644 | ||
1725 | --- a/sound/soc/sh/rcar/rsnd.h | ||
1726 | +++ b/sound/soc/sh/rcar/rsnd.h | ||
1727 | @@ -283,6 +283,9 @@ struct rsnd_mod_ops { | ||
1728 | int (*nolock_stop)(struct rsnd_mod *mod, | ||
1729 | struct rsnd_dai_stream *io, | ||
1730 | struct rsnd_priv *priv); | ||
1731 | + int (*prepare)(struct rsnd_mod *mod, | ||
1732 | + struct rsnd_dai_stream *io, | ||
1733 | + struct rsnd_priv *priv); | ||
1734 | }; | ||
1735 | |||
1736 | struct rsnd_dai_stream; | ||
1737 | @@ -312,6 +315,7 @@ struct rsnd_mod { | ||
1738 | * H 0: fallback | ||
1739 | * H 0: hw_params | ||
1740 | * H 0: pointer | ||
1741 | + * H 0: prepare | ||
1742 | */ | ||
1743 | #define __rsnd_mod_shift_nolock_start 0 | ||
1744 | #define __rsnd_mod_shift_nolock_stop 0 | ||
1745 | @@ -326,6 +330,7 @@ struct rsnd_mod { | ||
1746 | #define __rsnd_mod_shift_fallback 28 /* always called */ | ||
1747 | #define __rsnd_mod_shift_hw_params 28 /* always called */ | ||
1748 | #define __rsnd_mod_shift_pointer 28 /* always called */ | ||
1749 | +#define __rsnd_mod_shift_prepare 28 /* always called */ | ||
1750 | |||
1751 | #define __rsnd_mod_add_probe 0 | ||
1752 | #define __rsnd_mod_add_remove 0 | ||
1753 | @@ -340,6 +345,7 @@ struct rsnd_mod { | ||
1754 | #define __rsnd_mod_add_fallback 0 | ||
1755 | #define __rsnd_mod_add_hw_params 0 | ||
1756 | #define __rsnd_mod_add_pointer 0 | ||
1757 | +#define __rsnd_mod_add_prepare 0 | ||
1758 | |||
1759 | #define __rsnd_mod_call_probe 0 | ||
1760 | #define __rsnd_mod_call_remove 0 | ||
1761 | @@ -354,6 +360,7 @@ struct rsnd_mod { | ||
1762 | #define __rsnd_mod_call_pointer 0 | ||
1763 | #define __rsnd_mod_call_nolock_start 0 | ||
1764 | #define __rsnd_mod_call_nolock_stop 1 | ||
1765 | +#define __rsnd_mod_call_prepare 0 | ||
1766 | |||
1767 | #define rsnd_mod_to_priv(mod) ((mod)->priv) | ||
1768 | #define rsnd_mod_id(mod) ((mod) ? (mod)->id : -1) | ||
1769 | diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c | ||
1770 | index f0fb85fda42d..34223c8c28a8 100644 | ||
1771 | --- a/sound/soc/sh/rcar/ssi.c | ||
1772 | +++ b/sound/soc/sh/rcar/ssi.c | ||
1773 | @@ -280,7 +280,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod, | ||
1774 | if (rsnd_ssi_is_multi_slave(mod, io)) | ||
1775 | return 0; | ||
1776 | |||
1777 | - if (ssi->usrcnt > 1) { | ||
1778 | + if (ssi->rate) { | ||
1779 | if (ssi->rate != rate) { | ||
1780 | dev_err(dev, "SSI parent/child should use same rate\n"); | ||
1781 | return -EINVAL; | ||
1782 | @@ -482,7 +482,6 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, | ||
1783 | struct rsnd_priv *priv) | ||
1784 | { | ||
1785 | struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod); | ||
1786 | - int ret; | ||
1787 | |||
1788 | if (!rsnd_ssi_is_run_mods(mod, io)) | ||
1789 | return 0; | ||
1790 | @@ -493,10 +492,6 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, | ||
1791 | |||
1792 | rsnd_mod_power_on(mod); | ||
1793 | |||
1794 | - ret = rsnd_ssi_master_clk_start(mod, io); | ||
1795 | - if (ret < 0) | ||
1796 | - return ret; | ||
1797 | - | ||
1798 | rsnd_ssi_config_init(mod, io); | ||
1799 | |||
1800 | rsnd_ssi_register_setup(mod); | ||
1801 | @@ -847,6 +842,13 @@ static int rsnd_ssi_pointer(struct rsnd_mod *mod, | ||
1802 | return 0; | ||
1803 | } | ||
1804 | |||
1805 | +static int rsnd_ssi_prepare(struct rsnd_mod *mod, | ||
1806 | + struct rsnd_dai_stream *io, | ||
1807 | + struct rsnd_priv *priv) | ||
1808 | +{ | ||
1809 | + return rsnd_ssi_master_clk_start(mod, io); | ||
1810 | +} | ||
1811 | + | ||
1812 | static struct rsnd_mod_ops rsnd_ssi_pio_ops = { | ||
1813 | .name = SSI_NAME, | ||
1814 | .probe = rsnd_ssi_common_probe, | ||
1815 | @@ -859,6 +861,7 @@ static struct rsnd_mod_ops rsnd_ssi_pio_ops = { | ||
1816 | .pointer= rsnd_ssi_pointer, | ||
1817 | .pcm_new = rsnd_ssi_pcm_new, | ||
1818 | .hw_params = rsnd_ssi_hw_params, | ||
1819 | + .prepare = rsnd_ssi_prepare, | ||
1820 | }; | ||
1821 | |||
1822 | static int rsnd_ssi_dma_probe(struct rsnd_mod *mod, | ||
1823 | @@ -935,6 +938,7 @@ static struct rsnd_mod_ops rsnd_ssi_dma_ops = { | ||
1824 | .pcm_new = rsnd_ssi_pcm_new, | ||
1825 | .fallback = rsnd_ssi_fallback, | ||
1826 | .hw_params = rsnd_ssi_hw_params, | ||
1827 | + .prepare = rsnd_ssi_prepare, | ||
1828 | }; | ||
1829 | |||
1830 | int rsnd_ssi_is_dma_mode(struct rsnd_mod *mod) |