Annotation of /trunk/kernel-alx/patches-4.19/0139-4.19.40-all-fixes.patch
Parent Directory | Revision Log
Revision 3418 -
(hide annotations)
(download)
Fri Aug 2 11:47:48 2019 UTC (5 years, 1 month ago) by niro
File size: 32373 byte(s)
Fri Aug 2 11:47:48 2019 UTC (5 years, 1 month ago) by niro
File size: 32373 byte(s)
-linux-4.19.40
1 | niro | 3418 | diff --git a/Makefile b/Makefile |
2 | index be1bd297bca9..3822720a8a1c 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,7 +1,7 @@ | ||
6 | # SPDX-License-Identifier: GPL-2.0 | ||
7 | VERSION = 4 | ||
8 | PATCHLEVEL = 19 | ||
9 | -SUBLEVEL = 39 | ||
10 | +SUBLEVEL = 40 | ||
11 | EXTRAVERSION = | ||
12 | NAME = "People's Front" | ||
13 | |||
14 | diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h | ||
15 | index fd23d5778ea1..f1645578d9d0 100644 | ||
16 | --- a/arch/x86/include/uapi/asm/kvm.h | ||
17 | +++ b/arch/x86/include/uapi/asm/kvm.h | ||
18 | @@ -378,6 +378,7 @@ struct kvm_sync_regs { | ||
19 | #define KVM_X86_QUIRK_LINT0_REENABLED (1 << 0) | ||
20 | #define KVM_X86_QUIRK_CD_NW_CLEARED (1 << 1) | ||
21 | #define KVM_X86_QUIRK_LAPIC_MMIO_HOLE (1 << 2) | ||
22 | +#define KVM_X86_QUIRK_OUT_7E_INC_RIP (1 << 3) | ||
23 | |||
24 | #define KVM_STATE_NESTED_GUEST_MODE 0x00000001 | ||
25 | #define KVM_STATE_NESTED_RUN_PENDING 0x00000002 | ||
26 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c | ||
27 | index 3380a312d186..215339c7d161 100644 | ||
28 | --- a/arch/x86/kvm/vmx.c | ||
29 | +++ b/arch/x86/kvm/vmx.c | ||
30 | @@ -14236,7 +14236,7 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu, | ||
31 | return ret; | ||
32 | |||
33 | /* Empty 'VMXON' state is permitted */ | ||
34 | - if (kvm_state->size < sizeof(kvm_state) + sizeof(*vmcs12)) | ||
35 | + if (kvm_state->size < sizeof(*kvm_state) + sizeof(*vmcs12)) | ||
36 | return 0; | ||
37 | |||
38 | if (kvm_state->vmx.vmcs_pa == kvm_state->vmx.vmxon_pa || | ||
39 | @@ -14269,7 +14269,7 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu, | ||
40 | if (nested_cpu_has_shadow_vmcs(vmcs12) && | ||
41 | vmcs12->vmcs_link_pointer != -1ull) { | ||
42 | struct vmcs12 *shadow_vmcs12 = get_shadow_vmcs12(vcpu); | ||
43 | - if (kvm_state->size < sizeof(kvm_state) + 2 * sizeof(*vmcs12)) | ||
44 | + if (kvm_state->size < sizeof(*kvm_state) + 2 * sizeof(*vmcs12)) | ||
45 | return -EINVAL; | ||
46 | |||
47 | if (copy_from_user(shadow_vmcs12, | ||
48 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c | ||
49 | index 4a61e1609c97..f3337adaf9b3 100644 | ||
50 | --- a/arch/x86/kvm/x86.c | ||
51 | +++ b/arch/x86/kvm/x86.c | ||
52 | @@ -6328,6 +6328,12 @@ int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu, | ||
53 | } | ||
54 | EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer); | ||
55 | |||
56 | +static int complete_fast_pio_out_port_0x7e(struct kvm_vcpu *vcpu) | ||
57 | +{ | ||
58 | + vcpu->arch.pio.count = 0; | ||
59 | + return 1; | ||
60 | +} | ||
61 | + | ||
62 | static int complete_fast_pio_out(struct kvm_vcpu *vcpu) | ||
63 | { | ||
64 | vcpu->arch.pio.count = 0; | ||
65 | @@ -6344,12 +6350,23 @@ static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size, | ||
66 | unsigned long val = kvm_register_read(vcpu, VCPU_REGS_RAX); | ||
67 | int ret = emulator_pio_out_emulated(&vcpu->arch.emulate_ctxt, | ||
68 | size, port, &val, 1); | ||
69 | + if (ret) | ||
70 | + return ret; | ||
71 | |||
72 | - if (!ret) { | ||
73 | + /* | ||
74 | + * Workaround userspace that relies on old KVM behavior of %rip being | ||
75 | + * incremented prior to exiting to userspace to handle "OUT 0x7e". | ||
76 | + */ | ||
77 | + if (port == 0x7e && | ||
78 | + kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_OUT_7E_INC_RIP)) { | ||
79 | + vcpu->arch.complete_userspace_io = | ||
80 | + complete_fast_pio_out_port_0x7e; | ||
81 | + kvm_skip_emulated_instruction(vcpu); | ||
82 | + } else { | ||
83 | vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu); | ||
84 | vcpu->arch.complete_userspace_io = complete_fast_pio_out; | ||
85 | } | ||
86 | - return ret; | ||
87 | + return 0; | ||
88 | } | ||
89 | |||
90 | static int complete_fast_pio_in(struct kvm_vcpu *vcpu) | ||
91 | diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c | ||
92 | index 47c5f272a084..21db1804e85d 100644 | ||
93 | --- a/drivers/net/dsa/bcm_sf2_cfp.c | ||
94 | +++ b/drivers/net/dsa/bcm_sf2_cfp.c | ||
95 | @@ -742,6 +742,9 @@ static int bcm_sf2_cfp_rule_set(struct dsa_switch *ds, int port, | ||
96 | fs->m_ext.data[1])) | ||
97 | return -EINVAL; | ||
98 | |||
99 | + if (fs->location != RX_CLS_LOC_ANY && fs->location >= CFP_NUM_RULES) | ||
100 | + return -EINVAL; | ||
101 | + | ||
102 | if (fs->location != RX_CLS_LOC_ANY && | ||
103 | test_bit(fs->location, priv->cfp.used)) | ||
104 | return -EBUSY; | ||
105 | @@ -836,6 +839,9 @@ static int bcm_sf2_cfp_rule_del(struct bcm_sf2_priv *priv, int port, | ||
106 | u32 next_loc = 0; | ||
107 | int ret; | ||
108 | |||
109 | + if (loc >= CFP_NUM_RULES) | ||
110 | + return -EINVAL; | ||
111 | + | ||
112 | /* Refuse deleting unused rules, and those that are not unique since | ||
113 | * that could leave IPv6 rules with one of the chained rule in the | ||
114 | * table. | ||
115 | diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
116 | index 581ad0a17d0c..de46331aefc1 100644 | ||
117 | --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
118 | +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
119 | @@ -1584,7 +1584,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons, | ||
120 | netdev_warn(bp->dev, "RX buffer error %x\n", rx_err); | ||
121 | bnxt_sched_reset(bp, rxr); | ||
122 | } | ||
123 | - goto next_rx; | ||
124 | + goto next_rx_no_len; | ||
125 | } | ||
126 | |||
127 | len = le32_to_cpu(rxcmp->rx_cmp_len_flags_type) >> RX_CMP_LEN_SHIFT; | ||
128 | @@ -1665,12 +1665,13 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons, | ||
129 | rc = 1; | ||
130 | |||
131 | next_rx: | ||
132 | - rxr->rx_prod = NEXT_RX(prod); | ||
133 | - rxr->rx_next_cons = NEXT_RX(cons); | ||
134 | - | ||
135 | cpr->rx_packets += 1; | ||
136 | cpr->rx_bytes += len; | ||
137 | |||
138 | +next_rx_no_len: | ||
139 | + rxr->rx_prod = NEXT_RX(prod); | ||
140 | + rxr->rx_next_cons = NEXT_RX(cons); | ||
141 | + | ||
142 | next_rx_no_prod_no_len: | ||
143 | *raw_cons = tmp_raw_cons; | ||
144 | |||
145 | @@ -7441,8 +7442,15 @@ static int bnxt_cfg_rx_mode(struct bnxt *bp) | ||
146 | |||
147 | skip_uc: | ||
148 | rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0); | ||
149 | + if (rc && vnic->mc_list_count) { | ||
150 | + netdev_info(bp->dev, "Failed setting MC filters rc: %d, turning on ALL_MCAST mode\n", | ||
151 | + rc); | ||
152 | + vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST; | ||
153 | + vnic->mc_list_count = 0; | ||
154 | + rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0); | ||
155 | + } | ||
156 | if (rc) | ||
157 | - netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %x\n", | ||
158 | + netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %d\n", | ||
159 | rc); | ||
160 | |||
161 | return rc; | ||
162 | @@ -9077,6 +9085,7 @@ init_err_cleanup_tc: | ||
163 | bnxt_clear_int_mode(bp); | ||
164 | |||
165 | init_err_pci_clean: | ||
166 | + bnxt_free_hwrm_short_cmd_req(bp); | ||
167 | bnxt_free_hwrm_resources(bp); | ||
168 | bnxt_cleanup_pci(bp); | ||
169 | |||
170 | diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c | ||
171 | index 73813c7afa49..bb6107f3b947 100644 | ||
172 | --- a/drivers/net/phy/marvell.c | ||
173 | +++ b/drivers/net/phy/marvell.c | ||
174 | @@ -1513,9 +1513,10 @@ static int marvell_get_sset_count(struct phy_device *phydev) | ||
175 | |||
176 | static void marvell_get_strings(struct phy_device *phydev, u8 *data) | ||
177 | { | ||
178 | + int count = marvell_get_sset_count(phydev); | ||
179 | int i; | ||
180 | |||
181 | - for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) { | ||
182 | + for (i = 0; i < count; i++) { | ||
183 | strlcpy(data + i * ETH_GSTRING_LEN, | ||
184 | marvell_hw_stats[i].string, ETH_GSTRING_LEN); | ||
185 | } | ||
186 | @@ -1543,9 +1544,10 @@ static u64 marvell_get_stat(struct phy_device *phydev, int i) | ||
187 | static void marvell_get_stats(struct phy_device *phydev, | ||
188 | struct ethtool_stats *stats, u64 *data) | ||
189 | { | ||
190 | + int count = marvell_get_sset_count(phydev); | ||
191 | int i; | ||
192 | |||
193 | - for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) | ||
194 | + for (i = 0; i < count; i++) | ||
195 | data[i] = marvell_get_stat(phydev, i); | ||
196 | } | ||
197 | |||
198 | diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c | ||
199 | index 90f9372dec25..f3b1cfacfe9d 100644 | ||
200 | --- a/drivers/net/wireless/ath/ath10k/mac.c | ||
201 | +++ b/drivers/net/wireless/ath/ath10k/mac.c | ||
202 | @@ -5622,7 +5622,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw, | ||
203 | } | ||
204 | |||
205 | if (changed & BSS_CHANGED_MCAST_RATE && | ||
206 | - !WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def))) { | ||
207 | + !ath10k_mac_vif_chan(arvif->vif, &def)) { | ||
208 | band = def.chan->band; | ||
209 | rateidx = vif->bss_conf.mcast_rate[band] - 1; | ||
210 | |||
211 | diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h | ||
212 | index 6640f84fe536..6d5beac29bc1 100644 | ||
213 | --- a/include/net/sctp/command.h | ||
214 | +++ b/include/net/sctp/command.h | ||
215 | @@ -105,7 +105,6 @@ enum sctp_verb { | ||
216 | SCTP_CMD_T1_RETRAN, /* Mark for retransmission after T1 timeout */ | ||
217 | SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */ | ||
218 | SCTP_CMD_SEND_MSG, /* Send the whole use message */ | ||
219 | - SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */ | ||
220 | SCTP_CMD_PURGE_ASCONF_QUEUE, /* Purge all asconf queues.*/ | ||
221 | SCTP_CMD_SET_ASOC, /* Restore association context */ | ||
222 | SCTP_CMD_LAST | ||
223 | diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c | ||
224 | index 9c4e72e9c60a..73894ed12a70 100644 | ||
225 | --- a/net/ipv4/ip_output.c | ||
226 | +++ b/net/ipv4/ip_output.c | ||
227 | @@ -519,6 +519,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) | ||
228 | to->pkt_type = from->pkt_type; | ||
229 | to->priority = from->priority; | ||
230 | to->protocol = from->protocol; | ||
231 | + to->skb_iif = from->skb_iif; | ||
232 | skb_dst_drop(to); | ||
233 | skb_dst_copy(to, from); | ||
234 | to->dev = from->dev; | ||
235 | diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c | ||
236 | index cbe46175bb59..3e2a9bd3459c 100644 | ||
237 | --- a/net/ipv6/ip6_fib.c | ||
238 | +++ b/net/ipv6/ip6_fib.c | ||
239 | @@ -889,9 +889,7 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i, | ||
240 | if (pcpu_rt) { | ||
241 | struct fib6_info *from; | ||
242 | |||
243 | - from = rcu_dereference_protected(pcpu_rt->from, | ||
244 | - lockdep_is_held(&table->tb6_lock)); | ||
245 | - rcu_assign_pointer(pcpu_rt->from, NULL); | ||
246 | + from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL); | ||
247 | fib6_info_release(from); | ||
248 | } | ||
249 | } | ||
250 | diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c | ||
251 | index cb54a8a3c273..be5f3d7ceb96 100644 | ||
252 | --- a/net/ipv6/ip6_flowlabel.c | ||
253 | +++ b/net/ipv6/ip6_flowlabel.c | ||
254 | @@ -94,15 +94,21 @@ static struct ip6_flowlabel *fl_lookup(struct net *net, __be32 label) | ||
255 | return fl; | ||
256 | } | ||
257 | |||
258 | +static void fl_free_rcu(struct rcu_head *head) | ||
259 | +{ | ||
260 | + struct ip6_flowlabel *fl = container_of(head, struct ip6_flowlabel, rcu); | ||
261 | + | ||
262 | + if (fl->share == IPV6_FL_S_PROCESS) | ||
263 | + put_pid(fl->owner.pid); | ||
264 | + kfree(fl->opt); | ||
265 | + kfree(fl); | ||
266 | +} | ||
267 | + | ||
268 | |||
269 | static void fl_free(struct ip6_flowlabel *fl) | ||
270 | { | ||
271 | - if (fl) { | ||
272 | - if (fl->share == IPV6_FL_S_PROCESS) | ||
273 | - put_pid(fl->owner.pid); | ||
274 | - kfree(fl->opt); | ||
275 | - kfree_rcu(fl, rcu); | ||
276 | - } | ||
277 | + if (fl) | ||
278 | + call_rcu(&fl->rcu, fl_free_rcu); | ||
279 | } | ||
280 | |||
281 | static void fl_release(struct ip6_flowlabel *fl) | ||
282 | @@ -633,9 +639,9 @@ recheck: | ||
283 | if (fl1->share == IPV6_FL_S_EXCL || | ||
284 | fl1->share != fl->share || | ||
285 | ((fl1->share == IPV6_FL_S_PROCESS) && | ||
286 | - (fl1->owner.pid == fl->owner.pid)) || | ||
287 | + (fl1->owner.pid != fl->owner.pid)) || | ||
288 | ((fl1->share == IPV6_FL_S_USER) && | ||
289 | - uid_eq(fl1->owner.uid, fl->owner.uid))) | ||
290 | + !uid_eq(fl1->owner.uid, fl->owner.uid))) | ||
291 | goto release; | ||
292 | |||
293 | err = -ENOMEM; | ||
294 | diff --git a/net/ipv6/route.c b/net/ipv6/route.c | ||
295 | index 06fa8425d82c..2e519f7b983c 100644 | ||
296 | --- a/net/ipv6/route.c | ||
297 | +++ b/net/ipv6/route.c | ||
298 | @@ -382,11 +382,8 @@ static void ip6_dst_destroy(struct dst_entry *dst) | ||
299 | in6_dev_put(idev); | ||
300 | } | ||
301 | |||
302 | - rcu_read_lock(); | ||
303 | - from = rcu_dereference(rt->from); | ||
304 | - rcu_assign_pointer(rt->from, NULL); | ||
305 | + from = xchg((__force struct fib6_info **)&rt->from, NULL); | ||
306 | fib6_info_release(from); | ||
307 | - rcu_read_unlock(); | ||
308 | } | ||
309 | |||
310 | static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev, | ||
311 | @@ -1296,9 +1293,7 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket, | ||
312 | /* purge completely the exception to allow releasing the held resources: | ||
313 | * some [sk] cache may keep the dst around for unlimited time | ||
314 | */ | ||
315 | - from = rcu_dereference_protected(rt6_ex->rt6i->from, | ||
316 | - lockdep_is_held(&rt6_exception_lock)); | ||
317 | - rcu_assign_pointer(rt6_ex->rt6i->from, NULL); | ||
318 | + from = xchg((__force struct fib6_info **)&rt6_ex->rt6i->from, NULL); | ||
319 | fib6_info_release(from); | ||
320 | dst_dev_put(&rt6_ex->rt6i->dst); | ||
321 | |||
322 | @@ -3454,11 +3449,8 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu | ||
323 | |||
324 | rcu_read_lock(); | ||
325 | from = rcu_dereference(rt->from); | ||
326 | - /* This fib6_info_hold() is safe here because we hold reference to rt | ||
327 | - * and rt already holds reference to fib6_info. | ||
328 | - */ | ||
329 | - fib6_info_hold(from); | ||
330 | - rcu_read_unlock(); | ||
331 | + if (!from) | ||
332 | + goto out; | ||
333 | |||
334 | nrt = ip6_rt_cache_alloc(from, &msg->dest, NULL); | ||
335 | if (!nrt) | ||
336 | @@ -3470,10 +3462,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu | ||
337 | |||
338 | nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key; | ||
339 | |||
340 | - /* No need to remove rt from the exception table if rt is | ||
341 | - * a cached route because rt6_insert_exception() will | ||
342 | - * takes care of it | ||
343 | - */ | ||
344 | + /* rt6_insert_exception() will take care of duplicated exceptions */ | ||
345 | if (rt6_insert_exception(nrt, from)) { | ||
346 | dst_release_immediate(&nrt->dst); | ||
347 | goto out; | ||
348 | @@ -3486,7 +3475,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu | ||
349 | call_netevent_notifiers(NETEVENT_REDIRECT, &netevent); | ||
350 | |||
351 | out: | ||
352 | - fib6_info_release(from); | ||
353 | + rcu_read_unlock(); | ||
354 | neigh_release(neigh); | ||
355 | } | ||
356 | |||
357 | @@ -4991,16 +4980,20 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, | ||
358 | |||
359 | rcu_read_lock(); | ||
360 | from = rcu_dereference(rt->from); | ||
361 | - | ||
362 | - if (fibmatch) | ||
363 | - err = rt6_fill_node(net, skb, from, NULL, NULL, NULL, iif, | ||
364 | - RTM_NEWROUTE, NETLINK_CB(in_skb).portid, | ||
365 | - nlh->nlmsg_seq, 0); | ||
366 | - else | ||
367 | - err = rt6_fill_node(net, skb, from, dst, &fl6.daddr, | ||
368 | - &fl6.saddr, iif, RTM_NEWROUTE, | ||
369 | - NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, | ||
370 | - 0); | ||
371 | + if (from) { | ||
372 | + if (fibmatch) | ||
373 | + err = rt6_fill_node(net, skb, from, NULL, NULL, NULL, | ||
374 | + iif, RTM_NEWROUTE, | ||
375 | + NETLINK_CB(in_skb).portid, | ||
376 | + nlh->nlmsg_seq, 0); | ||
377 | + else | ||
378 | + err = rt6_fill_node(net, skb, from, dst, &fl6.daddr, | ||
379 | + &fl6.saddr, iif, RTM_NEWROUTE, | ||
380 | + NETLINK_CB(in_skb).portid, | ||
381 | + nlh->nlmsg_seq, 0); | ||
382 | + } else { | ||
383 | + err = -ENETUNREACH; | ||
384 | + } | ||
385 | rcu_read_unlock(); | ||
386 | |||
387 | if (err < 0) { | ||
388 | diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c | ||
389 | index fed6becc5daf..52b5a2797c0c 100644 | ||
390 | --- a/net/l2tp/l2tp_core.c | ||
391 | +++ b/net/l2tp/l2tp_core.c | ||
392 | @@ -169,8 +169,8 @@ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id) | ||
393 | |||
394 | rcu_read_lock_bh(); | ||
395 | list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { | ||
396 | - if (tunnel->tunnel_id == tunnel_id) { | ||
397 | - l2tp_tunnel_inc_refcount(tunnel); | ||
398 | + if (tunnel->tunnel_id == tunnel_id && | ||
399 | + refcount_inc_not_zero(&tunnel->ref_count)) { | ||
400 | rcu_read_unlock_bh(); | ||
401 | |||
402 | return tunnel; | ||
403 | @@ -190,8 +190,8 @@ struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth) | ||
404 | |||
405 | rcu_read_lock_bh(); | ||
406 | list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { | ||
407 | - if (++count > nth) { | ||
408 | - l2tp_tunnel_inc_refcount(tunnel); | ||
409 | + if (++count > nth && | ||
410 | + refcount_inc_not_zero(&tunnel->ref_count)) { | ||
411 | rcu_read_unlock_bh(); | ||
412 | return tunnel; | ||
413 | } | ||
414 | @@ -909,7 +909,7 @@ int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) | ||
415 | { | ||
416 | struct l2tp_tunnel *tunnel; | ||
417 | |||
418 | - tunnel = l2tp_tunnel(sk); | ||
419 | + tunnel = rcu_dereference_sk_user_data(sk); | ||
420 | if (tunnel == NULL) | ||
421 | goto pass_up; | ||
422 | |||
423 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c | ||
424 | index a0d295478e69..ebbb30064251 100644 | ||
425 | --- a/net/packet/af_packet.c | ||
426 | +++ b/net/packet/af_packet.c | ||
427 | @@ -2603,8 +2603,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) | ||
428 | void *ph; | ||
429 | DECLARE_SOCKADDR(struct sockaddr_ll *, saddr, msg->msg_name); | ||
430 | bool need_wait = !(msg->msg_flags & MSG_DONTWAIT); | ||
431 | + unsigned char *addr = NULL; | ||
432 | int tp_len, size_max; | ||
433 | - unsigned char *addr; | ||
434 | void *data; | ||
435 | int len_sum = 0; | ||
436 | int status = TP_STATUS_AVAILABLE; | ||
437 | @@ -2615,7 +2615,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) | ||
438 | if (likely(saddr == NULL)) { | ||
439 | dev = packet_cached_dev_get(po); | ||
440 | proto = po->num; | ||
441 | - addr = NULL; | ||
442 | } else { | ||
443 | err = -EINVAL; | ||
444 | if (msg->msg_namelen < sizeof(struct sockaddr_ll)) | ||
445 | @@ -2625,10 +2624,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) | ||
446 | sll_addr))) | ||
447 | goto out; | ||
448 | proto = saddr->sll_protocol; | ||
449 | - addr = saddr->sll_halen ? saddr->sll_addr : NULL; | ||
450 | dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); | ||
451 | - if (addr && dev && saddr->sll_halen < dev->addr_len) | ||
452 | - goto out_put; | ||
453 | + if (po->sk.sk_socket->type == SOCK_DGRAM) { | ||
454 | + if (dev && msg->msg_namelen < dev->addr_len + | ||
455 | + offsetof(struct sockaddr_ll, sll_addr)) | ||
456 | + goto out_put; | ||
457 | + addr = saddr->sll_addr; | ||
458 | + } | ||
459 | } | ||
460 | |||
461 | err = -ENXIO; | ||
462 | @@ -2800,7 +2802,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
463 | struct sk_buff *skb; | ||
464 | struct net_device *dev; | ||
465 | __be16 proto; | ||
466 | - unsigned char *addr; | ||
467 | + unsigned char *addr = NULL; | ||
468 | int err, reserve = 0; | ||
469 | struct sockcm_cookie sockc; | ||
470 | struct virtio_net_hdr vnet_hdr = { 0 }; | ||
471 | @@ -2817,7 +2819,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
472 | if (likely(saddr == NULL)) { | ||
473 | dev = packet_cached_dev_get(po); | ||
474 | proto = po->num; | ||
475 | - addr = NULL; | ||
476 | } else { | ||
477 | err = -EINVAL; | ||
478 | if (msg->msg_namelen < sizeof(struct sockaddr_ll)) | ||
479 | @@ -2825,10 +2826,13 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
480 | if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr))) | ||
481 | goto out; | ||
482 | proto = saddr->sll_protocol; | ||
483 | - addr = saddr->sll_halen ? saddr->sll_addr : NULL; | ||
484 | dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); | ||
485 | - if (addr && dev && saddr->sll_halen < dev->addr_len) | ||
486 | - goto out_unlock; | ||
487 | + if (sock->type == SOCK_DGRAM) { | ||
488 | + if (dev && msg->msg_namelen < dev->addr_len + | ||
489 | + offsetof(struct sockaddr_ll, sll_addr)) | ||
490 | + goto out_unlock; | ||
491 | + addr = saddr->sll_addr; | ||
492 | + } | ||
493 | } | ||
494 | |||
495 | err = -ENXIO; | ||
496 | diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c | ||
497 | index 8f1a8f85b1f9..215f4d98baa0 100644 | ||
498 | --- a/net/rxrpc/call_object.c | ||
499 | +++ b/net/rxrpc/call_object.c | ||
500 | @@ -701,30 +701,30 @@ void rxrpc_destroy_all_calls(struct rxrpc_net *rxnet) | ||
501 | |||
502 | _enter(""); | ||
503 | |||
504 | - if (list_empty(&rxnet->calls)) | ||
505 | - return; | ||
506 | + if (!list_empty(&rxnet->calls)) { | ||
507 | + write_lock(&rxnet->call_lock); | ||
508 | |||
509 | - write_lock(&rxnet->call_lock); | ||
510 | + while (!list_empty(&rxnet->calls)) { | ||
511 | + call = list_entry(rxnet->calls.next, | ||
512 | + struct rxrpc_call, link); | ||
513 | + _debug("Zapping call %p", call); | ||
514 | |||
515 | - while (!list_empty(&rxnet->calls)) { | ||
516 | - call = list_entry(rxnet->calls.next, struct rxrpc_call, link); | ||
517 | - _debug("Zapping call %p", call); | ||
518 | + rxrpc_see_call(call); | ||
519 | + list_del_init(&call->link); | ||
520 | |||
521 | - rxrpc_see_call(call); | ||
522 | - list_del_init(&call->link); | ||
523 | + pr_err("Call %p still in use (%d,%s,%lx,%lx)!\n", | ||
524 | + call, atomic_read(&call->usage), | ||
525 | + rxrpc_call_states[call->state], | ||
526 | + call->flags, call->events); | ||
527 | |||
528 | - pr_err("Call %p still in use (%d,%s,%lx,%lx)!\n", | ||
529 | - call, atomic_read(&call->usage), | ||
530 | - rxrpc_call_states[call->state], | ||
531 | - call->flags, call->events); | ||
532 | + write_unlock(&rxnet->call_lock); | ||
533 | + cond_resched(); | ||
534 | + write_lock(&rxnet->call_lock); | ||
535 | + } | ||
536 | |||
537 | write_unlock(&rxnet->call_lock); | ||
538 | - cond_resched(); | ||
539 | - write_lock(&rxnet->call_lock); | ||
540 | } | ||
541 | |||
542 | - write_unlock(&rxnet->call_lock); | ||
543 | - | ||
544 | atomic_dec(&rxnet->nr_calls); | ||
545 | wait_var_event(&rxnet->nr_calls, !atomic_read(&rxnet->nr_calls)); | ||
546 | } | ||
547 | diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c | ||
548 | index 85d393090238..48fe8f01265f 100644 | ||
549 | --- a/net/sctp/sm_sideeffect.c | ||
550 | +++ b/net/sctp/sm_sideeffect.c | ||
551 | @@ -1112,32 +1112,6 @@ static void sctp_cmd_send_msg(struct sctp_association *asoc, | ||
552 | } | ||
553 | |||
554 | |||
555 | -/* Sent the next ASCONF packet currently stored in the association. | ||
556 | - * This happens after the ASCONF_ACK was succeffully processed. | ||
557 | - */ | ||
558 | -static void sctp_cmd_send_asconf(struct sctp_association *asoc) | ||
559 | -{ | ||
560 | - struct net *net = sock_net(asoc->base.sk); | ||
561 | - | ||
562 | - /* Send the next asconf chunk from the addip chunk | ||
563 | - * queue. | ||
564 | - */ | ||
565 | - if (!list_empty(&asoc->addip_chunk_list)) { | ||
566 | - struct list_head *entry = asoc->addip_chunk_list.next; | ||
567 | - struct sctp_chunk *asconf = list_entry(entry, | ||
568 | - struct sctp_chunk, list); | ||
569 | - list_del_init(entry); | ||
570 | - | ||
571 | - /* Hold the chunk until an ASCONF_ACK is received. */ | ||
572 | - sctp_chunk_hold(asconf); | ||
573 | - if (sctp_primitive_ASCONF(net, asoc, asconf)) | ||
574 | - sctp_chunk_free(asconf); | ||
575 | - else | ||
576 | - asoc->addip_last_asconf = asconf; | ||
577 | - } | ||
578 | -} | ||
579 | - | ||
580 | - | ||
581 | /* These three macros allow us to pull the debugging code out of the | ||
582 | * main flow of sctp_do_sm() to keep attention focused on the real | ||
583 | * functionality there. | ||
584 | @@ -1783,9 +1757,6 @@ static int sctp_cmd_interpreter(enum sctp_event event_type, | ||
585 | } | ||
586 | sctp_cmd_send_msg(asoc, cmd->obj.msg, gfp); | ||
587 | break; | ||
588 | - case SCTP_CMD_SEND_NEXT_ASCONF: | ||
589 | - sctp_cmd_send_asconf(asoc); | ||
590 | - break; | ||
591 | case SCTP_CMD_PURGE_ASCONF_QUEUE: | ||
592 | sctp_asconf_queue_teardown(asoc); | ||
593 | break; | ||
594 | diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c | ||
595 | index c9ae3404b1bb..713a669d2058 100644 | ||
596 | --- a/net/sctp/sm_statefuns.c | ||
597 | +++ b/net/sctp/sm_statefuns.c | ||
598 | @@ -3824,6 +3824,29 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net, | ||
599 | return SCTP_DISPOSITION_CONSUME; | ||
600 | } | ||
601 | |||
602 | +static enum sctp_disposition sctp_send_next_asconf( | ||
603 | + struct net *net, | ||
604 | + const struct sctp_endpoint *ep, | ||
605 | + struct sctp_association *asoc, | ||
606 | + const union sctp_subtype type, | ||
607 | + struct sctp_cmd_seq *commands) | ||
608 | +{ | ||
609 | + struct sctp_chunk *asconf; | ||
610 | + struct list_head *entry; | ||
611 | + | ||
612 | + if (list_empty(&asoc->addip_chunk_list)) | ||
613 | + return SCTP_DISPOSITION_CONSUME; | ||
614 | + | ||
615 | + entry = asoc->addip_chunk_list.next; | ||
616 | + asconf = list_entry(entry, struct sctp_chunk, list); | ||
617 | + | ||
618 | + list_del_init(entry); | ||
619 | + sctp_chunk_hold(asconf); | ||
620 | + asoc->addip_last_asconf = asconf; | ||
621 | + | ||
622 | + return sctp_sf_do_prm_asconf(net, ep, asoc, type, asconf, commands); | ||
623 | +} | ||
624 | + | ||
625 | /* | ||
626 | * ADDIP Section 4.3 General rules for address manipulation | ||
627 | * When building TLV parameters for the ASCONF Chunk that will add or | ||
628 | @@ -3915,14 +3938,10 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net, | ||
629 | SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO)); | ||
630 | |||
631 | if (!sctp_process_asconf_ack((struct sctp_association *)asoc, | ||
632 | - asconf_ack)) { | ||
633 | - /* Successfully processed ASCONF_ACK. We can | ||
634 | - * release the next asconf if we have one. | ||
635 | - */ | ||
636 | - sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF, | ||
637 | - SCTP_NULL()); | ||
638 | - return SCTP_DISPOSITION_CONSUME; | ||
639 | - } | ||
640 | + asconf_ack)) | ||
641 | + return sctp_send_next_asconf(net, ep, | ||
642 | + (struct sctp_association *)asoc, | ||
643 | + type, commands); | ||
644 | |||
645 | abort = sctp_make_abort(asoc, asconf_ack, | ||
646 | sizeof(struct sctp_errhdr)); | ||
647 | diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c | ||
648 | index c9588b682db4..f4a19eac975d 100644 | ||
649 | --- a/net/tls/tls_device.c | ||
650 | +++ b/net/tls/tls_device.c | ||
651 | @@ -569,7 +569,7 @@ void handle_device_resync(struct sock *sk, u32 seq, u64 rcd_sn) | ||
652 | static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb) | ||
653 | { | ||
654 | struct strp_msg *rxm = strp_msg(skb); | ||
655 | - int err = 0, offset = rxm->offset, copy, nsg; | ||
656 | + int err = 0, offset = rxm->offset, copy, nsg, data_len, pos; | ||
657 | struct sk_buff *skb_iter, *unused; | ||
658 | struct scatterlist sg[1]; | ||
659 | char *orig_buf, *buf; | ||
660 | @@ -600,25 +600,42 @@ static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb) | ||
661 | else | ||
662 | err = 0; | ||
663 | |||
664 | - copy = min_t(int, skb_pagelen(skb) - offset, | ||
665 | - rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE); | ||
666 | + data_len = rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE; | ||
667 | |||
668 | - if (skb->decrypted) | ||
669 | - skb_store_bits(skb, offset, buf, copy); | ||
670 | + if (skb_pagelen(skb) > offset) { | ||
671 | + copy = min_t(int, skb_pagelen(skb) - offset, data_len); | ||
672 | |||
673 | - offset += copy; | ||
674 | - buf += copy; | ||
675 | + if (skb->decrypted) | ||
676 | + skb_store_bits(skb, offset, buf, copy); | ||
677 | |||
678 | + offset += copy; | ||
679 | + buf += copy; | ||
680 | + } | ||
681 | + | ||
682 | + pos = skb_pagelen(skb); | ||
683 | skb_walk_frags(skb, skb_iter) { | ||
684 | - copy = min_t(int, skb_iter->len, | ||
685 | - rxm->full_len - offset + rxm->offset - | ||
686 | - TLS_CIPHER_AES_GCM_128_TAG_SIZE); | ||
687 | + int frag_pos; | ||
688 | + | ||
689 | + /* Practically all frags must belong to msg if reencrypt | ||
690 | + * is needed with current strparser and coalescing logic, | ||
691 | + * but strparser may "get optimized", so let's be safe. | ||
692 | + */ | ||
693 | + if (pos + skb_iter->len <= offset) | ||
694 | + goto done_with_frag; | ||
695 | + if (pos >= data_len + rxm->offset) | ||
696 | + break; | ||
697 | + | ||
698 | + frag_pos = offset - pos; | ||
699 | + copy = min_t(int, skb_iter->len - frag_pos, | ||
700 | + data_len + rxm->offset - offset); | ||
701 | |||
702 | if (skb_iter->decrypted) | ||
703 | - skb_store_bits(skb_iter, offset, buf, copy); | ||
704 | + skb_store_bits(skb_iter, frag_pos, buf, copy); | ||
705 | |||
706 | offset += copy; | ||
707 | buf += copy; | ||
708 | +done_with_frag: | ||
709 | + pos += skb_iter->len; | ||
710 | } | ||
711 | |||
712 | free_buf: | ||
713 | diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c | ||
714 | index ef8934fd8698..426dd97725e4 100644 | ||
715 | --- a/net/tls/tls_device_fallback.c | ||
716 | +++ b/net/tls/tls_device_fallback.c | ||
717 | @@ -200,13 +200,14 @@ static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln) | ||
718 | |||
719 | skb_put(nskb, skb->len); | ||
720 | memcpy(nskb->data, skb->data, headln); | ||
721 | - update_chksum(nskb, headln); | ||
722 | |||
723 | nskb->destructor = skb->destructor; | ||
724 | nskb->sk = sk; | ||
725 | skb->destructor = NULL; | ||
726 | skb->sk = NULL; | ||
727 | |||
728 | + update_chksum(nskb, headln); | ||
729 | + | ||
730 | delta = nskb->truesize - skb->truesize; | ||
731 | if (likely(delta < 0)) | ||
732 | WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc)); | ||
733 | diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c | ||
734 | index c1376bfdc90b..aa28510d23ad 100644 | ||
735 | --- a/sound/usb/line6/driver.c | ||
736 | +++ b/sound/usb/line6/driver.c | ||
737 | @@ -351,12 +351,16 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, | ||
738 | { | ||
739 | struct usb_device *usbdev = line6->usbdev; | ||
740 | int ret; | ||
741 | - unsigned char len; | ||
742 | + unsigned char *len; | ||
743 | unsigned count; | ||
744 | |||
745 | if (address > 0xffff || datalen > 0xff) | ||
746 | return -EINVAL; | ||
747 | |||
748 | + len = kmalloc(sizeof(*len), GFP_KERNEL); | ||
749 | + if (!len) | ||
750 | + return -ENOMEM; | ||
751 | + | ||
752 | /* query the serial number: */ | ||
753 | ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, | ||
754 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, | ||
755 | @@ -365,7 +369,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, | ||
756 | |||
757 | if (ret < 0) { | ||
758 | dev_err(line6->ifcdev, "read request failed (error %d)\n", ret); | ||
759 | - return ret; | ||
760 | + goto exit; | ||
761 | } | ||
762 | |||
763 | /* Wait for data length. We'll get 0xff until length arrives. */ | ||
764 | @@ -375,28 +379,29 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, | ||
765 | ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, | ||
766 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | | ||
767 | USB_DIR_IN, | ||
768 | - 0x0012, 0x0000, &len, 1, | ||
769 | + 0x0012, 0x0000, len, 1, | ||
770 | LINE6_TIMEOUT * HZ); | ||
771 | if (ret < 0) { | ||
772 | dev_err(line6->ifcdev, | ||
773 | "receive length failed (error %d)\n", ret); | ||
774 | - return ret; | ||
775 | + goto exit; | ||
776 | } | ||
777 | |||
778 | - if (len != 0xff) | ||
779 | + if (*len != 0xff) | ||
780 | break; | ||
781 | } | ||
782 | |||
783 | - if (len == 0xff) { | ||
784 | + ret = -EIO; | ||
785 | + if (*len == 0xff) { | ||
786 | dev_err(line6->ifcdev, "read failed after %d retries\n", | ||
787 | count); | ||
788 | - return -EIO; | ||
789 | - } else if (len != datalen) { | ||
790 | + goto exit; | ||
791 | + } else if (*len != datalen) { | ||
792 | /* should be equal or something went wrong */ | ||
793 | dev_err(line6->ifcdev, | ||
794 | "length mismatch (expected %d, got %d)\n", | ||
795 | - (int)datalen, (int)len); | ||
796 | - return -EIO; | ||
797 | + (int)datalen, (int)*len); | ||
798 | + goto exit; | ||
799 | } | ||
800 | |||
801 | /* receive the result: */ | ||
802 | @@ -405,12 +410,12 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, | ||
803 | 0x0013, 0x0000, data, datalen, | ||
804 | LINE6_TIMEOUT * HZ); | ||
805 | |||
806 | - if (ret < 0) { | ||
807 | + if (ret < 0) | ||
808 | dev_err(line6->ifcdev, "read failed (error %d)\n", ret); | ||
809 | - return ret; | ||
810 | - } | ||
811 | |||
812 | - return 0; | ||
813 | +exit: | ||
814 | + kfree(len); | ||
815 | + return ret; | ||
816 | } | ||
817 | EXPORT_SYMBOL_GPL(line6_read_data); | ||
818 | |||
819 | @@ -422,12 +427,16 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, | ||
820 | { | ||
821 | struct usb_device *usbdev = line6->usbdev; | ||
822 | int ret; | ||
823 | - unsigned char status; | ||
824 | + unsigned char *status; | ||
825 | int count; | ||
826 | |||
827 | if (address > 0xffff || datalen > 0xffff) | ||
828 | return -EINVAL; | ||
829 | |||
830 | + status = kmalloc(sizeof(*status), GFP_KERNEL); | ||
831 | + if (!status) | ||
832 | + return -ENOMEM; | ||
833 | + | ||
834 | ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, | ||
835 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, | ||
836 | 0x0022, address, data, datalen, | ||
837 | @@ -436,7 +445,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, | ||
838 | if (ret < 0) { | ||
839 | dev_err(line6->ifcdev, | ||
840 | "write request failed (error %d)\n", ret); | ||
841 | - return ret; | ||
842 | + goto exit; | ||
843 | } | ||
844 | |||
845 | for (count = 0; count < LINE6_READ_WRITE_MAX_RETRIES; count++) { | ||
846 | @@ -447,28 +456,29 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, | ||
847 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | | ||
848 | USB_DIR_IN, | ||
849 | 0x0012, 0x0000, | ||
850 | - &status, 1, LINE6_TIMEOUT * HZ); | ||
851 | + status, 1, LINE6_TIMEOUT * HZ); | ||
852 | |||
853 | if (ret < 0) { | ||
854 | dev_err(line6->ifcdev, | ||
855 | "receiving status failed (error %d)\n", ret); | ||
856 | - return ret; | ||
857 | + goto exit; | ||
858 | } | ||
859 | |||
860 | - if (status != 0xff) | ||
861 | + if (*status != 0xff) | ||
862 | break; | ||
863 | } | ||
864 | |||
865 | - if (status == 0xff) { | ||
866 | + if (*status == 0xff) { | ||
867 | dev_err(line6->ifcdev, "write failed after %d retries\n", | ||
868 | count); | ||
869 | - return -EIO; | ||
870 | - } else if (status != 0) { | ||
871 | + ret = -EIO; | ||
872 | + } else if (*status != 0) { | ||
873 | dev_err(line6->ifcdev, "write failed (error %d)\n", ret); | ||
874 | - return -EIO; | ||
875 | + ret = -EIO; | ||
876 | } | ||
877 | - | ||
878 | - return 0; | ||
879 | +exit: | ||
880 | + kfree(status); | ||
881 | + return ret; | ||
882 | } | ||
883 | EXPORT_SYMBOL_GPL(line6_write_data); | ||
884 | |||
885 | diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c | ||
886 | index 36ed9c85c0eb..5f3c87264e66 100644 | ||
887 | --- a/sound/usb/line6/podhd.c | ||
888 | +++ b/sound/usb/line6/podhd.c | ||
889 | @@ -225,28 +225,32 @@ static void podhd_startup_start_workqueue(struct timer_list *t) | ||
890 | static int podhd_dev_start(struct usb_line6_podhd *pod) | ||
891 | { | ||
892 | int ret; | ||
893 | - u8 init_bytes[8]; | ||
894 | + u8 *init_bytes; | ||
895 | int i; | ||
896 | struct usb_device *usbdev = pod->line6.usbdev; | ||
897 | |||
898 | + init_bytes = kmalloc(8, GFP_KERNEL); | ||
899 | + if (!init_bytes) | ||
900 | + return -ENOMEM; | ||
901 | + | ||
902 | ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), | ||
903 | 0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, | ||
904 | 0x11, 0, | ||
905 | NULL, 0, LINE6_TIMEOUT * HZ); | ||
906 | if (ret < 0) { | ||
907 | dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret); | ||
908 | - return ret; | ||
909 | + goto exit; | ||
910 | } | ||
911 | |||
912 | /* NOTE: looks like some kind of ping message */ | ||
913 | ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, | ||
914 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, | ||
915 | 0x11, 0x0, | ||
916 | - &init_bytes, 3, LINE6_TIMEOUT * HZ); | ||
917 | + init_bytes, 3, LINE6_TIMEOUT * HZ); | ||
918 | if (ret < 0) { | ||
919 | dev_err(pod->line6.ifcdev, | ||
920 | "receive length failed (error %d)\n", ret); | ||
921 | - return ret; | ||
922 | + goto exit; | ||
923 | } | ||
924 | |||
925 | pod->firmware_version = | ||
926 | @@ -255,7 +259,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) | ||
927 | for (i = 0; i <= 16; i++) { | ||
928 | ret = line6_read_data(&pod->line6, 0xf000 + 0x08 * i, init_bytes, 8); | ||
929 | if (ret < 0) | ||
930 | - return ret; | ||
931 | + goto exit; | ||
932 | } | ||
933 | |||
934 | ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), | ||
935 | @@ -263,10 +267,9 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) | ||
936 | USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT, | ||
937 | 1, 0, | ||
938 | NULL, 0, LINE6_TIMEOUT * HZ); | ||
939 | - if (ret < 0) | ||
940 | - return ret; | ||
941 | - | ||
942 | - return 0; | ||
943 | +exit: | ||
944 | + kfree(init_bytes); | ||
945 | + return ret; | ||
946 | } | ||
947 | |||
948 | static void podhd_startup_workqueue(struct work_struct *work) | ||
949 | diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c | ||
950 | index f47ba94e6f4a..19bee725de00 100644 | ||
951 | --- a/sound/usb/line6/toneport.c | ||
952 | +++ b/sound/usb/line6/toneport.c | ||
953 | @@ -365,16 +365,21 @@ static bool toneport_has_source_select(struct usb_line6_toneport *toneport) | ||
954 | /* | ||
955 | Setup Toneport device. | ||
956 | */ | ||
957 | -static void toneport_setup(struct usb_line6_toneport *toneport) | ||
958 | +static int toneport_setup(struct usb_line6_toneport *toneport) | ||
959 | { | ||
960 | - u32 ticks; | ||
961 | + u32 *ticks; | ||
962 | struct usb_line6 *line6 = &toneport->line6; | ||
963 | struct usb_device *usbdev = line6->usbdev; | ||
964 | |||
965 | + ticks = kmalloc(sizeof(*ticks), GFP_KERNEL); | ||
966 | + if (!ticks) | ||
967 | + return -ENOMEM; | ||
968 | + | ||
969 | /* sync time on device with host: */ | ||
970 | /* note: 32-bit timestamps overflow in year 2106 */ | ||
971 | - ticks = (u32)ktime_get_real_seconds(); | ||
972 | - line6_write_data(line6, 0x80c6, &ticks, 4); | ||
973 | + *ticks = (u32)ktime_get_real_seconds(); | ||
974 | + line6_write_data(line6, 0x80c6, ticks, 4); | ||
975 | + kfree(ticks); | ||
976 | |||
977 | /* enable device: */ | ||
978 | toneport_send_cmd(usbdev, 0x0301, 0x0000); | ||
979 | @@ -389,6 +394,7 @@ static void toneport_setup(struct usb_line6_toneport *toneport) | ||
980 | toneport_update_led(toneport); | ||
981 | |||
982 | mod_timer(&toneport->timer, jiffies + TONEPORT_PCM_DELAY * HZ); | ||
983 | + return 0; | ||
984 | } | ||
985 | |||
986 | /* | ||
987 | @@ -451,7 +457,9 @@ static int toneport_init(struct usb_line6 *line6, | ||
988 | return err; | ||
989 | } | ||
990 | |||
991 | - toneport_setup(toneport); | ||
992 | + err = toneport_setup(toneport); | ||
993 | + if (err) | ||
994 | + return err; | ||
995 | |||
996 | /* register audio system: */ | ||
997 | return snd_card_register(line6->card); | ||
998 | @@ -463,7 +471,11 @@ static int toneport_init(struct usb_line6 *line6, | ||
999 | */ | ||
1000 | static int toneport_reset_resume(struct usb_interface *interface) | ||
1001 | { | ||
1002 | - toneport_setup(usb_get_intfdata(interface)); | ||
1003 | + int err; | ||
1004 | + | ||
1005 | + err = toneport_setup(usb_get_intfdata(interface)); | ||
1006 | + if (err) | ||
1007 | + return err; | ||
1008 | return line6_resume(interface); | ||
1009 | } | ||
1010 | #endif | ||
1011 | diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh | ||
1012 | index d4cfb6a7a086..d84193bdc307 100755 | ||
1013 | --- a/tools/testing/selftests/net/fib_rule_tests.sh | ||
1014 | +++ b/tools/testing/selftests/net/fib_rule_tests.sh | ||
1015 | @@ -27,6 +27,7 @@ log_test() | ||
1016 | nsuccess=$((nsuccess+1)) | ||
1017 | printf "\n TEST: %-50s [ OK ]\n" "${msg}" | ||
1018 | else | ||
1019 | + ret=1 | ||
1020 | nfail=$((nfail+1)) | ||
1021 | printf "\n TEST: %-50s [FAIL]\n" "${msg}" | ||
1022 | if [ "${PAUSE_ON_FAIL}" = "yes" ]; then | ||
1023 | @@ -245,4 +246,9 @@ setup | ||
1024 | run_fibrule_tests | ||
1025 | cleanup | ||
1026 | |||
1027 | +if [ "$TESTS" != "none" ]; then | ||
1028 | + printf "\nTests passed: %3d\n" ${nsuccess} | ||
1029 | + printf "Tests failed: %3d\n" ${nfail} | ||
1030 | +fi | ||
1031 | + | ||
1032 | exit $ret |