Contents of /trunk/kernel-alx/patches-4.19/0161-4.19.62-all-fixes.patch
Parent Directory | Revision Log
Revision 3440 -
(show annotations)
(download)
Fri Aug 2 11:48:07 2019 UTC (5 years, 1 month ago) by niro
File size: 74141 byte(s)
Fri Aug 2 11:48:07 2019 UTC (5 years, 1 month ago) by niro
File size: 74141 byte(s)
-linux-4.19.62
1 | diff --git a/Makefile b/Makefile |
2 | index b16485c580d7..a4463d880ae2 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,7 +1,7 @@ |
6 | # SPDX-License-Identifier: GPL-2.0 |
7 | VERSION = 4 |
8 | PATCHLEVEL = 19 |
9 | -SUBLEVEL = 61 |
10 | +SUBLEVEL = 62 |
11 | EXTRAVERSION = |
12 | NAME = "People's Front" |
13 | |
14 | diff --git a/arch/mips/jz4740/board-qi_lb60.c b/arch/mips/jz4740/board-qi_lb60.c |
15 | index 705593d40d12..05c60fa4fa06 100644 |
16 | --- a/arch/mips/jz4740/board-qi_lb60.c |
17 | +++ b/arch/mips/jz4740/board-qi_lb60.c |
18 | @@ -471,27 +471,27 @@ static unsigned long pin_cfg_bias_disable[] = { |
19 | static struct pinctrl_map pin_map[] __initdata = { |
20 | /* NAND pin configuration */ |
21 | PIN_MAP_MUX_GROUP_DEFAULT("jz4740-nand", |
22 | - "10010000.jz4740-pinctrl", "nand", "nand-cs1"), |
23 | + "10010000.pin-controller", "nand-cs1", "nand"), |
24 | |
25 | /* fbdev pin configuration */ |
26 | PIN_MAP_MUX_GROUP("jz4740-fb", PINCTRL_STATE_DEFAULT, |
27 | - "10010000.jz4740-pinctrl", "lcd", "lcd-8bit"), |
28 | + "10010000.pin-controller", "lcd-8bit", "lcd"), |
29 | PIN_MAP_MUX_GROUP("jz4740-fb", PINCTRL_STATE_SLEEP, |
30 | - "10010000.jz4740-pinctrl", "lcd", "lcd-no-pins"), |
31 | + "10010000.pin-controller", "lcd-no-pins", "lcd"), |
32 | |
33 | /* MMC pin configuration */ |
34 | PIN_MAP_MUX_GROUP_DEFAULT("jz4740-mmc.0", |
35 | - "10010000.jz4740-pinctrl", "mmc", "mmc-1bit"), |
36 | + "10010000.pin-controller", "mmc-1bit", "mmc"), |
37 | PIN_MAP_MUX_GROUP_DEFAULT("jz4740-mmc.0", |
38 | - "10010000.jz4740-pinctrl", "mmc", "mmc-4bit"), |
39 | + "10010000.pin-controller", "mmc-4bit", "mmc"), |
40 | PIN_MAP_CONFIGS_PIN_DEFAULT("jz4740-mmc.0", |
41 | - "10010000.jz4740-pinctrl", "PD0", pin_cfg_bias_disable), |
42 | + "10010000.pin-controller", "PD0", pin_cfg_bias_disable), |
43 | PIN_MAP_CONFIGS_PIN_DEFAULT("jz4740-mmc.0", |
44 | - "10010000.jz4740-pinctrl", "PD2", pin_cfg_bias_disable), |
45 | + "10010000.pin-controller", "PD2", pin_cfg_bias_disable), |
46 | |
47 | /* PWM pin configuration */ |
48 | PIN_MAP_MUX_GROUP_DEFAULT("jz4740-pwm", |
49 | - "10010000.jz4740-pinctrl", "pwm4", "pwm4"), |
50 | + "10010000.pin-controller", "pwm4", "pwm4"), |
51 | }; |
52 | |
53 | |
54 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
55 | index 73d6d585dd66..4cf16378dffe 100644 |
56 | --- a/arch/x86/kvm/vmx.c |
57 | +++ b/arch/x86/kvm/vmx.c |
58 | @@ -8457,6 +8457,7 @@ static void vmx_disable_shadow_vmcs(struct vcpu_vmx *vmx) |
59 | { |
60 | vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_SHADOW_VMCS); |
61 | vmcs_write64(VMCS_LINK_POINTER, -1ull); |
62 | + vmx->nested.sync_shadow_vmcs = false; |
63 | } |
64 | |
65 | static inline void nested_release_vmcs12(struct vcpu_vmx *vmx) |
66 | @@ -8468,7 +8469,6 @@ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx) |
67 | /* copy to memory all shadowed fields in case |
68 | they were modified */ |
69 | copy_shadow_to_vmcs12(vmx); |
70 | - vmx->nested.sync_shadow_vmcs = false; |
71 | vmx_disable_shadow_vmcs(vmx); |
72 | } |
73 | vmx->nested.posted_intr_nv = -1; |
74 | @@ -8490,6 +8490,8 @@ static void free_nested(struct vcpu_vmx *vmx) |
75 | if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon) |
76 | return; |
77 | |
78 | + kvm_clear_request(KVM_REQ_GET_VMCS12_PAGES, &vmx->vcpu); |
79 | + |
80 | hrtimer_cancel(&vmx->nested.preemption_timer); |
81 | vmx->nested.vmxon = false; |
82 | vmx->nested.smm.vmxon = false; |
83 | @@ -8668,6 +8670,9 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx) |
84 | u64 field_value; |
85 | struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs; |
86 | |
87 | + if (WARN_ON(!shadow_vmcs)) |
88 | + return; |
89 | + |
90 | preempt_disable(); |
91 | |
92 | vmcs_load(shadow_vmcs); |
93 | @@ -8706,6 +8711,9 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx) |
94 | u64 field_value = 0; |
95 | struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs; |
96 | |
97 | + if (WARN_ON(!shadow_vmcs)) |
98 | + return; |
99 | + |
100 | vmcs_load(shadow_vmcs); |
101 | |
102 | for (q = 0; q < ARRAY_SIZE(fields); q++) { |
103 | diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c |
104 | index 13884474d158..69842145c223 100644 |
105 | --- a/drivers/dma-buf/dma-buf.c |
106 | +++ b/drivers/dma-buf/dma-buf.c |
107 | @@ -1069,6 +1069,7 @@ static int dma_buf_debug_show(struct seq_file *s, void *unused) |
108 | fence->ops->get_driver_name(fence), |
109 | fence->ops->get_timeline_name(fence), |
110 | dma_fence_is_signaled(fence) ? "" : "un"); |
111 | + dma_fence_put(fence); |
112 | } |
113 | rcu_read_unlock(); |
114 | |
115 | diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c |
116 | index 6c95f61a32e7..49ab09468ba1 100644 |
117 | --- a/drivers/dma-buf/reservation.c |
118 | +++ b/drivers/dma-buf/reservation.c |
119 | @@ -416,6 +416,10 @@ int reservation_object_get_fences_rcu(struct reservation_object *obj, |
120 | GFP_NOWAIT | __GFP_NOWARN); |
121 | if (!nshared) { |
122 | rcu_read_unlock(); |
123 | + |
124 | + dma_fence_put(fence_excl); |
125 | + fence_excl = NULL; |
126 | + |
127 | nshared = krealloc(shared, sz, GFP_KERNEL); |
128 | if (nshared) { |
129 | shared = nshared; |
130 | diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c |
131 | index a5ece8ea79bc..abb332d15a13 100644 |
132 | --- a/drivers/gpio/gpio-davinci.c |
133 | +++ b/drivers/gpio/gpio-davinci.c |
134 | @@ -222,8 +222,9 @@ static int davinci_gpio_probe(struct platform_device *pdev) |
135 | for (i = 0; i < nirq; i++) { |
136 | chips->irqs[i] = platform_get_irq(pdev, i); |
137 | if (chips->irqs[i] < 0) { |
138 | - dev_info(dev, "IRQ not populated, err = %d\n", |
139 | - chips->irqs[i]); |
140 | + if (chips->irqs[i] != -EPROBE_DEFER) |
141 | + dev_info(dev, "IRQ not populated, err = %d\n", |
142 | + chips->irqs[i]); |
143 | return chips->irqs[i]; |
144 | } |
145 | } |
146 | diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c |
147 | index 433a14b9f731..253a1bbe37e8 100644 |
148 | --- a/drivers/net/caif/caif_hsi.c |
149 | +++ b/drivers/net/caif/caif_hsi.c |
150 | @@ -1455,7 +1455,7 @@ static void __exit cfhsi_exit_module(void) |
151 | rtnl_lock(); |
152 | list_for_each_safe(list_node, n, &cfhsi_list) { |
153 | cfhsi = list_entry(list_node, struct cfhsi, list); |
154 | - unregister_netdev(cfhsi->ndev); |
155 | + unregister_netdevice(cfhsi->ndev); |
156 | } |
157 | rtnl_unlock(); |
158 | } |
159 | diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c |
160 | index 411cfb806459..703e6bdaf0e1 100644 |
161 | --- a/drivers/net/dsa/mv88e6xxx/chip.c |
162 | +++ b/drivers/net/dsa/mv88e6xxx/chip.c |
163 | @@ -4816,6 +4816,8 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev) |
164 | err = PTR_ERR(chip->reset); |
165 | goto out; |
166 | } |
167 | + if (chip->reset) |
168 | + usleep_range(1000, 2000); |
169 | |
170 | err = mv88e6xxx_detect(chip); |
171 | if (err) |
172 | diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c |
173 | index e3ce29951c5e..3edb81a4f075 100644 |
174 | --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c |
175 | +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c |
176 | @@ -286,6 +286,9 @@ int bnx2x_tx_int(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata) |
177 | hw_cons = le16_to_cpu(*txdata->tx_cons_sb); |
178 | sw_cons = txdata->tx_pkt_cons; |
179 | |
180 | + /* Ensure subsequent loads occur after hw_cons */ |
181 | + smp_rmb(); |
182 | + |
183 | while (sw_cons != hw_cons) { |
184 | u16 pkt_cons; |
185 | |
186 | diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c |
187 | index 2d6f090bf644..fd587bed32eb 100644 |
188 | --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c |
189 | +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c |
190 | @@ -3086,39 +3086,42 @@ static void bcmgenet_timeout(struct net_device *dev) |
191 | netif_tx_wake_all_queues(dev); |
192 | } |
193 | |
194 | -#define MAX_MC_COUNT 16 |
195 | +#define MAX_MDF_FILTER 17 |
196 | |
197 | static inline void bcmgenet_set_mdf_addr(struct bcmgenet_priv *priv, |
198 | unsigned char *addr, |
199 | - int *i, |
200 | - int *mc) |
201 | + int *i) |
202 | { |
203 | - u32 reg; |
204 | - |
205 | bcmgenet_umac_writel(priv, addr[0] << 8 | addr[1], |
206 | UMAC_MDF_ADDR + (*i * 4)); |
207 | bcmgenet_umac_writel(priv, addr[2] << 24 | addr[3] << 16 | |
208 | addr[4] << 8 | addr[5], |
209 | UMAC_MDF_ADDR + ((*i + 1) * 4)); |
210 | - reg = bcmgenet_umac_readl(priv, UMAC_MDF_CTRL); |
211 | - reg |= (1 << (MAX_MC_COUNT - *mc)); |
212 | - bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL); |
213 | *i += 2; |
214 | - (*mc)++; |
215 | } |
216 | |
217 | static void bcmgenet_set_rx_mode(struct net_device *dev) |
218 | { |
219 | struct bcmgenet_priv *priv = netdev_priv(dev); |
220 | struct netdev_hw_addr *ha; |
221 | - int i, mc; |
222 | + int i, nfilter; |
223 | u32 reg; |
224 | |
225 | netif_dbg(priv, hw, dev, "%s: %08X\n", __func__, dev->flags); |
226 | |
227 | - /* Promiscuous mode */ |
228 | + /* Number of filters needed */ |
229 | + nfilter = netdev_uc_count(dev) + netdev_mc_count(dev) + 2; |
230 | + |
231 | + /* |
232 | + * Turn on promicuous mode for three scenarios |
233 | + * 1. IFF_PROMISC flag is set |
234 | + * 2. IFF_ALLMULTI flag is set |
235 | + * 3. The number of filters needed exceeds the number filters |
236 | + * supported by the hardware. |
237 | + */ |
238 | reg = bcmgenet_umac_readl(priv, UMAC_CMD); |
239 | - if (dev->flags & IFF_PROMISC) { |
240 | + if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) || |
241 | + (nfilter > MAX_MDF_FILTER)) { |
242 | reg |= CMD_PROMISC; |
243 | bcmgenet_umac_writel(priv, reg, UMAC_CMD); |
244 | bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL); |
245 | @@ -3128,32 +3131,24 @@ static void bcmgenet_set_rx_mode(struct net_device *dev) |
246 | bcmgenet_umac_writel(priv, reg, UMAC_CMD); |
247 | } |
248 | |
249 | - /* UniMac doesn't support ALLMULTI */ |
250 | - if (dev->flags & IFF_ALLMULTI) { |
251 | - netdev_warn(dev, "ALLMULTI is not supported\n"); |
252 | - return; |
253 | - } |
254 | - |
255 | /* update MDF filter */ |
256 | i = 0; |
257 | - mc = 0; |
258 | /* Broadcast */ |
259 | - bcmgenet_set_mdf_addr(priv, dev->broadcast, &i, &mc); |
260 | + bcmgenet_set_mdf_addr(priv, dev->broadcast, &i); |
261 | /* my own address.*/ |
262 | - bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i, &mc); |
263 | - /* Unicast list*/ |
264 | - if (netdev_uc_count(dev) > (MAX_MC_COUNT - mc)) |
265 | - return; |
266 | + bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i); |
267 | |
268 | - if (!netdev_uc_empty(dev)) |
269 | - netdev_for_each_uc_addr(ha, dev) |
270 | - bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc); |
271 | - /* Multicast */ |
272 | - if (netdev_mc_empty(dev) || netdev_mc_count(dev) >= (MAX_MC_COUNT - mc)) |
273 | - return; |
274 | + /* Unicast */ |
275 | + netdev_for_each_uc_addr(ha, dev) |
276 | + bcmgenet_set_mdf_addr(priv, ha->addr, &i); |
277 | |
278 | + /* Multicast */ |
279 | netdev_for_each_mc_addr(ha, dev) |
280 | - bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc); |
281 | + bcmgenet_set_mdf_addr(priv, ha->addr, &i); |
282 | + |
283 | + /* Enable filters */ |
284 | + reg = GENMASK(MAX_MDF_FILTER - 1, MAX_MDF_FILTER - nfilter); |
285 | + bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL); |
286 | } |
287 | |
288 | /* Set the hardware MAC address. */ |
289 | diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c |
290 | index 1485f66cf7b0..4ade864c8d53 100644 |
291 | --- a/drivers/net/ethernet/marvell/sky2.c |
292 | +++ b/drivers/net/ethernet/marvell/sky2.c |
293 | @@ -4947,6 +4947,13 @@ static const struct dmi_system_id msi_blacklist[] = { |
294 | DMI_MATCH(DMI_PRODUCT_NAME, "P-79"), |
295 | }, |
296 | }, |
297 | + { |
298 | + .ident = "ASUS P6T", |
299 | + .matches = { |
300 | + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), |
301 | + DMI_MATCH(DMI_BOARD_NAME, "P6T"), |
302 | + }, |
303 | + }, |
304 | {} |
305 | }; |
306 | |
307 | diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c |
308 | index 5b7fe8264144..db6aafcced0d 100644 |
309 | --- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c |
310 | +++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c |
311 | @@ -662,7 +662,9 @@ struct net_device *mlx5_rdma_netdev_alloc(struct mlx5_core_dev *mdev, |
312 | |
313 | profile->init(mdev, netdev, profile, ipriv); |
314 | |
315 | - mlx5e_attach_netdev(epriv); |
316 | + err = mlx5e_attach_netdev(epriv); |
317 | + if (err) |
318 | + goto detach; |
319 | netif_carrier_off(netdev); |
320 | |
321 | /* set rdma_netdev func pointers */ |
322 | @@ -678,6 +680,11 @@ struct net_device *mlx5_rdma_netdev_alloc(struct mlx5_core_dev *mdev, |
323 | |
324 | return netdev; |
325 | |
326 | +detach: |
327 | + profile->cleanup(epriv); |
328 | + if (ipriv->sub_interface) |
329 | + return NULL; |
330 | + mlx5e_destroy_mdev_resources(mdev); |
331 | destroy_ht: |
332 | mlx5i_pkey_qpn_ht_cleanup(netdev); |
333 | destroy_wq: |
334 | diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c |
335 | index 7a50b911b180..a6992c4c7313 100644 |
336 | --- a/drivers/net/ethernet/realtek/r8169.c |
337 | +++ b/drivers/net/ethernet/realtek/r8169.c |
338 | @@ -5202,6 +5202,143 @@ static void rtl_hw_start_8411_2(struct rtl8169_private *tp) |
339 | /* disable aspm and clock request before access ephy */ |
340 | rtl_hw_aspm_clkreq_enable(tp, false); |
341 | rtl_ephy_init(tp, e_info_8411_2, ARRAY_SIZE(e_info_8411_2)); |
342 | + |
343 | + /* The following Realtek-provided magic fixes an issue with the RX unit |
344 | + * getting confused after the PHY having been powered-down. |
345 | + */ |
346 | + r8168_mac_ocp_write(tp, 0xFC28, 0x0000); |
347 | + r8168_mac_ocp_write(tp, 0xFC2A, 0x0000); |
348 | + r8168_mac_ocp_write(tp, 0xFC2C, 0x0000); |
349 | + r8168_mac_ocp_write(tp, 0xFC2E, 0x0000); |
350 | + r8168_mac_ocp_write(tp, 0xFC30, 0x0000); |
351 | + r8168_mac_ocp_write(tp, 0xFC32, 0x0000); |
352 | + r8168_mac_ocp_write(tp, 0xFC34, 0x0000); |
353 | + r8168_mac_ocp_write(tp, 0xFC36, 0x0000); |
354 | + mdelay(3); |
355 | + r8168_mac_ocp_write(tp, 0xFC26, 0x0000); |
356 | + |
357 | + r8168_mac_ocp_write(tp, 0xF800, 0xE008); |
358 | + r8168_mac_ocp_write(tp, 0xF802, 0xE00A); |
359 | + r8168_mac_ocp_write(tp, 0xF804, 0xE00C); |
360 | + r8168_mac_ocp_write(tp, 0xF806, 0xE00E); |
361 | + r8168_mac_ocp_write(tp, 0xF808, 0xE027); |
362 | + r8168_mac_ocp_write(tp, 0xF80A, 0xE04F); |
363 | + r8168_mac_ocp_write(tp, 0xF80C, 0xE05E); |
364 | + r8168_mac_ocp_write(tp, 0xF80E, 0xE065); |
365 | + r8168_mac_ocp_write(tp, 0xF810, 0xC602); |
366 | + r8168_mac_ocp_write(tp, 0xF812, 0xBE00); |
367 | + r8168_mac_ocp_write(tp, 0xF814, 0x0000); |
368 | + r8168_mac_ocp_write(tp, 0xF816, 0xC502); |
369 | + r8168_mac_ocp_write(tp, 0xF818, 0xBD00); |
370 | + r8168_mac_ocp_write(tp, 0xF81A, 0x074C); |
371 | + r8168_mac_ocp_write(tp, 0xF81C, 0xC302); |
372 | + r8168_mac_ocp_write(tp, 0xF81E, 0xBB00); |
373 | + r8168_mac_ocp_write(tp, 0xF820, 0x080A); |
374 | + r8168_mac_ocp_write(tp, 0xF822, 0x6420); |
375 | + r8168_mac_ocp_write(tp, 0xF824, 0x48C2); |
376 | + r8168_mac_ocp_write(tp, 0xF826, 0x8C20); |
377 | + r8168_mac_ocp_write(tp, 0xF828, 0xC516); |
378 | + r8168_mac_ocp_write(tp, 0xF82A, 0x64A4); |
379 | + r8168_mac_ocp_write(tp, 0xF82C, 0x49C0); |
380 | + r8168_mac_ocp_write(tp, 0xF82E, 0xF009); |
381 | + r8168_mac_ocp_write(tp, 0xF830, 0x74A2); |
382 | + r8168_mac_ocp_write(tp, 0xF832, 0x8CA5); |
383 | + r8168_mac_ocp_write(tp, 0xF834, 0x74A0); |
384 | + r8168_mac_ocp_write(tp, 0xF836, 0xC50E); |
385 | + r8168_mac_ocp_write(tp, 0xF838, 0x9CA2); |
386 | + r8168_mac_ocp_write(tp, 0xF83A, 0x1C11); |
387 | + r8168_mac_ocp_write(tp, 0xF83C, 0x9CA0); |
388 | + r8168_mac_ocp_write(tp, 0xF83E, 0xE006); |
389 | + r8168_mac_ocp_write(tp, 0xF840, 0x74F8); |
390 | + r8168_mac_ocp_write(tp, 0xF842, 0x48C4); |
391 | + r8168_mac_ocp_write(tp, 0xF844, 0x8CF8); |
392 | + r8168_mac_ocp_write(tp, 0xF846, 0xC404); |
393 | + r8168_mac_ocp_write(tp, 0xF848, 0xBC00); |
394 | + r8168_mac_ocp_write(tp, 0xF84A, 0xC403); |
395 | + r8168_mac_ocp_write(tp, 0xF84C, 0xBC00); |
396 | + r8168_mac_ocp_write(tp, 0xF84E, 0x0BF2); |
397 | + r8168_mac_ocp_write(tp, 0xF850, 0x0C0A); |
398 | + r8168_mac_ocp_write(tp, 0xF852, 0xE434); |
399 | + r8168_mac_ocp_write(tp, 0xF854, 0xD3C0); |
400 | + r8168_mac_ocp_write(tp, 0xF856, 0x49D9); |
401 | + r8168_mac_ocp_write(tp, 0xF858, 0xF01F); |
402 | + r8168_mac_ocp_write(tp, 0xF85A, 0xC526); |
403 | + r8168_mac_ocp_write(tp, 0xF85C, 0x64A5); |
404 | + r8168_mac_ocp_write(tp, 0xF85E, 0x1400); |
405 | + r8168_mac_ocp_write(tp, 0xF860, 0xF007); |
406 | + r8168_mac_ocp_write(tp, 0xF862, 0x0C01); |
407 | + r8168_mac_ocp_write(tp, 0xF864, 0x8CA5); |
408 | + r8168_mac_ocp_write(tp, 0xF866, 0x1C15); |
409 | + r8168_mac_ocp_write(tp, 0xF868, 0xC51B); |
410 | + r8168_mac_ocp_write(tp, 0xF86A, 0x9CA0); |
411 | + r8168_mac_ocp_write(tp, 0xF86C, 0xE013); |
412 | + r8168_mac_ocp_write(tp, 0xF86E, 0xC519); |
413 | + r8168_mac_ocp_write(tp, 0xF870, 0x74A0); |
414 | + r8168_mac_ocp_write(tp, 0xF872, 0x48C4); |
415 | + r8168_mac_ocp_write(tp, 0xF874, 0x8CA0); |
416 | + r8168_mac_ocp_write(tp, 0xF876, 0xC516); |
417 | + r8168_mac_ocp_write(tp, 0xF878, 0x74A4); |
418 | + r8168_mac_ocp_write(tp, 0xF87A, 0x48C8); |
419 | + r8168_mac_ocp_write(tp, 0xF87C, 0x48CA); |
420 | + r8168_mac_ocp_write(tp, 0xF87E, 0x9CA4); |
421 | + r8168_mac_ocp_write(tp, 0xF880, 0xC512); |
422 | + r8168_mac_ocp_write(tp, 0xF882, 0x1B00); |
423 | + r8168_mac_ocp_write(tp, 0xF884, 0x9BA0); |
424 | + r8168_mac_ocp_write(tp, 0xF886, 0x1B1C); |
425 | + r8168_mac_ocp_write(tp, 0xF888, 0x483F); |
426 | + r8168_mac_ocp_write(tp, 0xF88A, 0x9BA2); |
427 | + r8168_mac_ocp_write(tp, 0xF88C, 0x1B04); |
428 | + r8168_mac_ocp_write(tp, 0xF88E, 0xC508); |
429 | + r8168_mac_ocp_write(tp, 0xF890, 0x9BA0); |
430 | + r8168_mac_ocp_write(tp, 0xF892, 0xC505); |
431 | + r8168_mac_ocp_write(tp, 0xF894, 0xBD00); |
432 | + r8168_mac_ocp_write(tp, 0xF896, 0xC502); |
433 | + r8168_mac_ocp_write(tp, 0xF898, 0xBD00); |
434 | + r8168_mac_ocp_write(tp, 0xF89A, 0x0300); |
435 | + r8168_mac_ocp_write(tp, 0xF89C, 0x051E); |
436 | + r8168_mac_ocp_write(tp, 0xF89E, 0xE434); |
437 | + r8168_mac_ocp_write(tp, 0xF8A0, 0xE018); |
438 | + r8168_mac_ocp_write(tp, 0xF8A2, 0xE092); |
439 | + r8168_mac_ocp_write(tp, 0xF8A4, 0xDE20); |
440 | + r8168_mac_ocp_write(tp, 0xF8A6, 0xD3C0); |
441 | + r8168_mac_ocp_write(tp, 0xF8A8, 0xC50F); |
442 | + r8168_mac_ocp_write(tp, 0xF8AA, 0x76A4); |
443 | + r8168_mac_ocp_write(tp, 0xF8AC, 0x49E3); |
444 | + r8168_mac_ocp_write(tp, 0xF8AE, 0xF007); |
445 | + r8168_mac_ocp_write(tp, 0xF8B0, 0x49C0); |
446 | + r8168_mac_ocp_write(tp, 0xF8B2, 0xF103); |
447 | + r8168_mac_ocp_write(tp, 0xF8B4, 0xC607); |
448 | + r8168_mac_ocp_write(tp, 0xF8B6, 0xBE00); |
449 | + r8168_mac_ocp_write(tp, 0xF8B8, 0xC606); |
450 | + r8168_mac_ocp_write(tp, 0xF8BA, 0xBE00); |
451 | + r8168_mac_ocp_write(tp, 0xF8BC, 0xC602); |
452 | + r8168_mac_ocp_write(tp, 0xF8BE, 0xBE00); |
453 | + r8168_mac_ocp_write(tp, 0xF8C0, 0x0C4C); |
454 | + r8168_mac_ocp_write(tp, 0xF8C2, 0x0C28); |
455 | + r8168_mac_ocp_write(tp, 0xF8C4, 0x0C2C); |
456 | + r8168_mac_ocp_write(tp, 0xF8C6, 0xDC00); |
457 | + r8168_mac_ocp_write(tp, 0xF8C8, 0xC707); |
458 | + r8168_mac_ocp_write(tp, 0xF8CA, 0x1D00); |
459 | + r8168_mac_ocp_write(tp, 0xF8CC, 0x8DE2); |
460 | + r8168_mac_ocp_write(tp, 0xF8CE, 0x48C1); |
461 | + r8168_mac_ocp_write(tp, 0xF8D0, 0xC502); |
462 | + r8168_mac_ocp_write(tp, 0xF8D2, 0xBD00); |
463 | + r8168_mac_ocp_write(tp, 0xF8D4, 0x00AA); |
464 | + r8168_mac_ocp_write(tp, 0xF8D6, 0xE0C0); |
465 | + r8168_mac_ocp_write(tp, 0xF8D8, 0xC502); |
466 | + r8168_mac_ocp_write(tp, 0xF8DA, 0xBD00); |
467 | + r8168_mac_ocp_write(tp, 0xF8DC, 0x0132); |
468 | + |
469 | + r8168_mac_ocp_write(tp, 0xFC26, 0x8000); |
470 | + |
471 | + r8168_mac_ocp_write(tp, 0xFC2A, 0x0743); |
472 | + r8168_mac_ocp_write(tp, 0xFC2C, 0x0801); |
473 | + r8168_mac_ocp_write(tp, 0xFC2E, 0x0BE9); |
474 | + r8168_mac_ocp_write(tp, 0xFC30, 0x02FD); |
475 | + r8168_mac_ocp_write(tp, 0xFC32, 0x0C25); |
476 | + r8168_mac_ocp_write(tp, 0xFC34, 0x00A9); |
477 | + r8168_mac_ocp_write(tp, 0xFC36, 0x012D); |
478 | + |
479 | rtl_hw_aspm_clkreq_enable(tp, true); |
480 | } |
481 | |
482 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
483 | index 5c18874614ba..0101ebaecf02 100644 |
484 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
485 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
486 | @@ -3036,17 +3036,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) |
487 | |
488 | /* Manage oversized TCP frames for GMAC4 device */ |
489 | if (skb_is_gso(skb) && priv->tso) { |
490 | - if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) { |
491 | - /* |
492 | - * There is no way to determine the number of TSO |
493 | - * capable Queues. Let's use always the Queue 0 |
494 | - * because if TSO is supported then at least this |
495 | - * one will be capable. |
496 | - */ |
497 | - skb_set_queue_mapping(skb, 0); |
498 | - |
499 | + if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) |
500 | return stmmac_tso_xmit(skb, dev); |
501 | - } |
502 | } |
503 | |
504 | if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) { |
505 | @@ -3855,6 +3846,23 @@ static int stmmac_setup_tc(struct net_device *ndev, enum tc_setup_type type, |
506 | } |
507 | } |
508 | |
509 | +static u16 stmmac_select_queue(struct net_device *dev, struct sk_buff *skb, |
510 | + struct net_device *sb_dev, |
511 | + select_queue_fallback_t fallback) |
512 | +{ |
513 | + if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) { |
514 | + /* |
515 | + * There is no way to determine the number of TSO |
516 | + * capable Queues. Let's use always the Queue 0 |
517 | + * because if TSO is supported then at least this |
518 | + * one will be capable. |
519 | + */ |
520 | + return 0; |
521 | + } |
522 | + |
523 | + return fallback(dev, skb, NULL) % dev->real_num_tx_queues; |
524 | +} |
525 | + |
526 | static int stmmac_set_mac_address(struct net_device *ndev, void *addr) |
527 | { |
528 | struct stmmac_priv *priv = netdev_priv(ndev); |
529 | @@ -4097,6 +4105,7 @@ static const struct net_device_ops stmmac_netdev_ops = { |
530 | .ndo_tx_timeout = stmmac_tx_timeout, |
531 | .ndo_do_ioctl = stmmac_ioctl, |
532 | .ndo_setup_tc = stmmac_setup_tc, |
533 | + .ndo_select_queue = stmmac_select_queue, |
534 | #ifdef CONFIG_NET_POLL_CONTROLLER |
535 | .ndo_poll_controller = stmmac_poll_controller, |
536 | #endif |
537 | diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c |
538 | index cf6b9b1771f1..cc60ef9634db 100644 |
539 | --- a/drivers/net/hyperv/netvsc_drv.c |
540 | +++ b/drivers/net/hyperv/netvsc_drv.c |
541 | @@ -847,7 +847,6 @@ int netvsc_recv_callback(struct net_device *net, |
542 | csum_info, vlan, data, len); |
543 | if (unlikely(!skb)) { |
544 | ++net_device_ctx->eth_stats.rx_no_memory; |
545 | - rcu_read_unlock(); |
546 | return NVSP_STAT_FAIL; |
547 | } |
548 | |
549 | diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c |
550 | index 7de88b33d5b9..2c971357e66c 100644 |
551 | --- a/drivers/net/macsec.c |
552 | +++ b/drivers/net/macsec.c |
553 | @@ -869,6 +869,7 @@ static void macsec_reset_skb(struct sk_buff *skb, struct net_device *dev) |
554 | |
555 | static void macsec_finalize_skb(struct sk_buff *skb, u8 icv_len, u8 hdr_len) |
556 | { |
557 | + skb->ip_summed = CHECKSUM_NONE; |
558 | memmove(skb->data + hdr_len, skb->data, 2 * ETH_ALEN); |
559 | skb_pull(skb, hdr_len); |
560 | pskb_trim_unique(skb, skb->len - icv_len); |
561 | @@ -1103,10 +1104,9 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) |
562 | } |
563 | |
564 | skb = skb_unshare(skb, GFP_ATOMIC); |
565 | - if (!skb) { |
566 | - *pskb = NULL; |
567 | + *pskb = skb; |
568 | + if (!skb) |
569 | return RX_HANDLER_CONSUMED; |
570 | - } |
571 | |
572 | pulled_sci = pskb_may_pull(skb, macsec_extra_len(true)); |
573 | if (!pulled_sci) { |
574 | diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c |
575 | index 418522aa2f71..998d08ae7431 100644 |
576 | --- a/drivers/net/phy/sfp.c |
577 | +++ b/drivers/net/phy/sfp.c |
578 | @@ -514,7 +514,7 @@ static int sfp_hwmon_read_sensor(struct sfp *sfp, int reg, long *value) |
579 | |
580 | static void sfp_hwmon_to_rx_power(long *value) |
581 | { |
582 | - *value = DIV_ROUND_CLOSEST(*value, 100); |
583 | + *value = DIV_ROUND_CLOSEST(*value, 10); |
584 | } |
585 | |
586 | static void sfp_hwmon_calibrate(struct sfp *sfp, unsigned int slope, int offset, |
587 | diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c |
588 | index 449fc52f9a89..9f895083bc0a 100644 |
589 | --- a/drivers/net/vrf.c |
590 | +++ b/drivers/net/vrf.c |
591 | @@ -169,23 +169,29 @@ static int vrf_ip6_local_out(struct net *net, struct sock *sk, |
592 | static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb, |
593 | struct net_device *dev) |
594 | { |
595 | - const struct ipv6hdr *iph = ipv6_hdr(skb); |
596 | + const struct ipv6hdr *iph; |
597 | struct net *net = dev_net(skb->dev); |
598 | - struct flowi6 fl6 = { |
599 | - /* needed to match OIF rule */ |
600 | - .flowi6_oif = dev->ifindex, |
601 | - .flowi6_iif = LOOPBACK_IFINDEX, |
602 | - .daddr = iph->daddr, |
603 | - .saddr = iph->saddr, |
604 | - .flowlabel = ip6_flowinfo(iph), |
605 | - .flowi6_mark = skb->mark, |
606 | - .flowi6_proto = iph->nexthdr, |
607 | - .flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF, |
608 | - }; |
609 | + struct flowi6 fl6; |
610 | int ret = NET_XMIT_DROP; |
611 | struct dst_entry *dst; |
612 | struct dst_entry *dst_null = &net->ipv6.ip6_null_entry->dst; |
613 | |
614 | + if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr))) |
615 | + goto err; |
616 | + |
617 | + iph = ipv6_hdr(skb); |
618 | + |
619 | + memset(&fl6, 0, sizeof(fl6)); |
620 | + /* needed to match OIF rule */ |
621 | + fl6.flowi6_oif = dev->ifindex; |
622 | + fl6.flowi6_iif = LOOPBACK_IFINDEX; |
623 | + fl6.daddr = iph->daddr; |
624 | + fl6.saddr = iph->saddr; |
625 | + fl6.flowlabel = ip6_flowinfo(iph); |
626 | + fl6.flowi6_mark = skb->mark; |
627 | + fl6.flowi6_proto = iph->nexthdr; |
628 | + fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF; |
629 | + |
630 | dst = ip6_route_output(net, NULL, &fl6); |
631 | if (dst == dst_null) |
632 | goto err; |
633 | @@ -241,21 +247,27 @@ static int vrf_ip_local_out(struct net *net, struct sock *sk, |
634 | static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb, |
635 | struct net_device *vrf_dev) |
636 | { |
637 | - struct iphdr *ip4h = ip_hdr(skb); |
638 | + struct iphdr *ip4h; |
639 | int ret = NET_XMIT_DROP; |
640 | - struct flowi4 fl4 = { |
641 | - /* needed to match OIF rule */ |
642 | - .flowi4_oif = vrf_dev->ifindex, |
643 | - .flowi4_iif = LOOPBACK_IFINDEX, |
644 | - .flowi4_tos = RT_TOS(ip4h->tos), |
645 | - .flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF, |
646 | - .flowi4_proto = ip4h->protocol, |
647 | - .daddr = ip4h->daddr, |
648 | - .saddr = ip4h->saddr, |
649 | - }; |
650 | + struct flowi4 fl4; |
651 | struct net *net = dev_net(vrf_dev); |
652 | struct rtable *rt; |
653 | |
654 | + if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr))) |
655 | + goto err; |
656 | + |
657 | + ip4h = ip_hdr(skb); |
658 | + |
659 | + memset(&fl4, 0, sizeof(fl4)); |
660 | + /* needed to match OIF rule */ |
661 | + fl4.flowi4_oif = vrf_dev->ifindex; |
662 | + fl4.flowi4_iif = LOOPBACK_IFINDEX; |
663 | + fl4.flowi4_tos = RT_TOS(ip4h->tos); |
664 | + fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF; |
665 | + fl4.flowi4_proto = ip4h->protocol; |
666 | + fl4.daddr = ip4h->daddr; |
667 | + fl4.saddr = ip4h->saddr; |
668 | + |
669 | rt = ip_route_output_flow(net, &fl4, NULL); |
670 | if (IS_ERR(rt)) |
671 | goto err; |
672 | diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c |
673 | index f93f9881ec18..46d5c40f2835 100644 |
674 | --- a/fs/ext4/dir.c |
675 | +++ b/fs/ext4/dir.c |
676 | @@ -108,7 +108,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) |
677 | struct inode *inode = file_inode(file); |
678 | struct super_block *sb = inode->i_sb; |
679 | struct buffer_head *bh = NULL; |
680 | - int dir_has_error = 0; |
681 | struct fscrypt_str fstr = FSTR_INIT(NULL, 0); |
682 | |
683 | if (ext4_encrypted_inode(inode)) { |
684 | @@ -144,8 +143,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) |
685 | return err; |
686 | } |
687 | |
688 | - offset = ctx->pos & (sb->s_blocksize - 1); |
689 | - |
690 | while (ctx->pos < inode->i_size) { |
691 | struct ext4_map_blocks map; |
692 | |
693 | @@ -154,9 +151,18 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) |
694 | goto errout; |
695 | } |
696 | cond_resched(); |
697 | + offset = ctx->pos & (sb->s_blocksize - 1); |
698 | map.m_lblk = ctx->pos >> EXT4_BLOCK_SIZE_BITS(sb); |
699 | map.m_len = 1; |
700 | err = ext4_map_blocks(NULL, inode, &map, 0); |
701 | + if (err == 0) { |
702 | + /* m_len should never be zero but let's avoid |
703 | + * an infinite loop if it somehow is */ |
704 | + if (map.m_len == 0) |
705 | + map.m_len = 1; |
706 | + ctx->pos += map.m_len * sb->s_blocksize; |
707 | + continue; |
708 | + } |
709 | if (err > 0) { |
710 | pgoff_t index = map.m_pblk >> |
711 | (PAGE_SHIFT - inode->i_blkbits); |
712 | @@ -175,13 +181,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) |
713 | } |
714 | |
715 | if (!bh) { |
716 | - if (!dir_has_error) { |
717 | - EXT4_ERROR_FILE(file, 0, |
718 | - "directory contains a " |
719 | - "hole at offset %llu", |
720 | - (unsigned long long) ctx->pos); |
721 | - dir_has_error = 1; |
722 | - } |
723 | /* corrupt size? Maybe no more blocks to read */ |
724 | if (ctx->pos > inode->i_blocks << 9) |
725 | break; |
726 | diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h |
727 | index df908ef79cce..402dc366117e 100644 |
728 | --- a/fs/ext4/ext4_jbd2.h |
729 | +++ b/fs/ext4/ext4_jbd2.h |
730 | @@ -361,20 +361,20 @@ static inline int ext4_journal_force_commit(journal_t *journal) |
731 | } |
732 | |
733 | static inline int ext4_jbd2_inode_add_write(handle_t *handle, |
734 | - struct inode *inode) |
735 | + struct inode *inode, loff_t start_byte, loff_t length) |
736 | { |
737 | if (ext4_handle_valid(handle)) |
738 | - return jbd2_journal_inode_add_write(handle, |
739 | - EXT4_I(inode)->jinode); |
740 | + return jbd2_journal_inode_ranged_write(handle, |
741 | + EXT4_I(inode)->jinode, start_byte, length); |
742 | return 0; |
743 | } |
744 | |
745 | static inline int ext4_jbd2_inode_add_wait(handle_t *handle, |
746 | - struct inode *inode) |
747 | + struct inode *inode, loff_t start_byte, loff_t length) |
748 | { |
749 | if (ext4_handle_valid(handle)) |
750 | - return jbd2_journal_inode_add_wait(handle, |
751 | - EXT4_I(inode)->jinode); |
752 | + return jbd2_journal_inode_ranged_wait(handle, |
753 | + EXT4_I(inode)->jinode, start_byte, length); |
754 | return 0; |
755 | } |
756 | |
757 | diff --git a/fs/ext4/file.c b/fs/ext4/file.c |
758 | index 2c5baa5e8291..f4a24a46245e 100644 |
759 | --- a/fs/ext4/file.c |
760 | +++ b/fs/ext4/file.c |
761 | @@ -165,6 +165,10 @@ static ssize_t ext4_write_checks(struct kiocb *iocb, struct iov_iter *from) |
762 | ret = generic_write_checks(iocb, from); |
763 | if (ret <= 0) |
764 | return ret; |
765 | + |
766 | + if (unlikely(IS_IMMUTABLE(inode))) |
767 | + return -EPERM; |
768 | + |
769 | /* |
770 | * If we have encountered a bitmap-format file, the size limit |
771 | * is smaller than s_maxbytes, which is for extent-mapped files. |
772 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c |
773 | index 05dc5a4ba481..e65559bf7728 100644 |
774 | --- a/fs/ext4/inode.c |
775 | +++ b/fs/ext4/inode.c |
776 | @@ -729,10 +729,16 @@ out_sem: |
777 | !(flags & EXT4_GET_BLOCKS_ZERO) && |
778 | !ext4_is_quota_file(inode) && |
779 | ext4_should_order_data(inode)) { |
780 | + loff_t start_byte = |
781 | + (loff_t)map->m_lblk << inode->i_blkbits; |
782 | + loff_t length = (loff_t)map->m_len << inode->i_blkbits; |
783 | + |
784 | if (flags & EXT4_GET_BLOCKS_IO_SUBMIT) |
785 | - ret = ext4_jbd2_inode_add_wait(handle, inode); |
786 | + ret = ext4_jbd2_inode_add_wait(handle, inode, |
787 | + start_byte, length); |
788 | else |
789 | - ret = ext4_jbd2_inode_add_write(handle, inode); |
790 | + ret = ext4_jbd2_inode_add_write(handle, inode, |
791 | + start_byte, length); |
792 | if (ret) |
793 | return ret; |
794 | } |
795 | @@ -4058,7 +4064,8 @@ static int __ext4_block_zero_page_range(handle_t *handle, |
796 | err = 0; |
797 | mark_buffer_dirty(bh); |
798 | if (ext4_should_order_data(inode)) |
799 | - err = ext4_jbd2_inode_add_write(handle, inode); |
800 | + err = ext4_jbd2_inode_add_write(handle, inode, from, |
801 | + length); |
802 | } |
803 | |
804 | unlock: |
805 | @@ -5491,6 +5498,14 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) |
806 | if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) |
807 | return -EIO; |
808 | |
809 | + if (unlikely(IS_IMMUTABLE(inode))) |
810 | + return -EPERM; |
811 | + |
812 | + if (unlikely(IS_APPEND(inode) && |
813 | + (ia_valid & (ATTR_MODE | ATTR_UID | |
814 | + ATTR_GID | ATTR_TIMES_SET)))) |
815 | + return -EPERM; |
816 | + |
817 | error = setattr_prepare(dentry, attr); |
818 | if (error) |
819 | return error; |
820 | @@ -6190,6 +6205,9 @@ int ext4_page_mkwrite(struct vm_fault *vmf) |
821 | get_block_t *get_block; |
822 | int retries = 0; |
823 | |
824 | + if (unlikely(IS_IMMUTABLE(inode))) |
825 | + return VM_FAULT_SIGBUS; |
826 | + |
827 | sb_start_pagefault(inode->i_sb); |
828 | file_update_time(vma->vm_file); |
829 | |
830 | diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c |
831 | index 53d57cdf3c4d..abb6fcff0a1d 100644 |
832 | --- a/fs/ext4/ioctl.c |
833 | +++ b/fs/ext4/ioctl.c |
834 | @@ -268,6 +268,29 @@ static int uuid_is_zero(__u8 u[16]) |
835 | } |
836 | #endif |
837 | |
838 | +/* |
839 | + * If immutable is set and we are not clearing it, we're not allowed to change |
840 | + * anything else in the inode. Don't error out if we're only trying to set |
841 | + * immutable on an immutable file. |
842 | + */ |
843 | +static int ext4_ioctl_check_immutable(struct inode *inode, __u32 new_projid, |
844 | + unsigned int flags) |
845 | +{ |
846 | + struct ext4_inode_info *ei = EXT4_I(inode); |
847 | + unsigned int oldflags = ei->i_flags; |
848 | + |
849 | + if (!(oldflags & EXT4_IMMUTABLE_FL) || !(flags & EXT4_IMMUTABLE_FL)) |
850 | + return 0; |
851 | + |
852 | + if ((oldflags & ~EXT4_IMMUTABLE_FL) != (flags & ~EXT4_IMMUTABLE_FL)) |
853 | + return -EPERM; |
854 | + if (ext4_has_feature_project(inode->i_sb) && |
855 | + __kprojid_val(ei->i_projid) != new_projid) |
856 | + return -EPERM; |
857 | + |
858 | + return 0; |
859 | +} |
860 | + |
861 | static int ext4_ioctl_setflags(struct inode *inode, |
862 | unsigned int flags) |
863 | { |
864 | @@ -321,6 +344,20 @@ static int ext4_ioctl_setflags(struct inode *inode, |
865 | goto flags_out; |
866 | } |
867 | |
868 | + /* |
869 | + * Wait for all pending directio and then flush all the dirty pages |
870 | + * for this file. The flush marks all the pages readonly, so any |
871 | + * subsequent attempt to write to the file (particularly mmap pages) |
872 | + * will come through the filesystem and fail. |
873 | + */ |
874 | + if (S_ISREG(inode->i_mode) && !IS_IMMUTABLE(inode) && |
875 | + (flags & EXT4_IMMUTABLE_FL)) { |
876 | + inode_dio_wait(inode); |
877 | + err = filemap_write_and_wait(inode->i_mapping); |
878 | + if (err) |
879 | + goto flags_out; |
880 | + } |
881 | + |
882 | handle = ext4_journal_start(inode, EXT4_HT_INODE, 1); |
883 | if (IS_ERR(handle)) { |
884 | err = PTR_ERR(handle); |
885 | @@ -750,7 +787,11 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) |
886 | return err; |
887 | |
888 | inode_lock(inode); |
889 | - err = ext4_ioctl_setflags(inode, flags); |
890 | + err = ext4_ioctl_check_immutable(inode, |
891 | + from_kprojid(&init_user_ns, ei->i_projid), |
892 | + flags); |
893 | + if (!err) |
894 | + err = ext4_ioctl_setflags(inode, flags); |
895 | inode_unlock(inode); |
896 | mnt_drop_write_file(filp); |
897 | return err; |
898 | @@ -1120,6 +1161,9 @@ resizefs_out: |
899 | goto out; |
900 | flags = (ei->i_flags & ~EXT4_FL_XFLAG_VISIBLE) | |
901 | (flags & EXT4_FL_XFLAG_VISIBLE); |
902 | + err = ext4_ioctl_check_immutable(inode, fa.fsx_projid, flags); |
903 | + if (err) |
904 | + goto out; |
905 | err = ext4_ioctl_setflags(inode, flags); |
906 | if (err) |
907 | goto out; |
908 | diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c |
909 | index 2f5be02fc6f6..287631bb09e7 100644 |
910 | --- a/fs/ext4/move_extent.c |
911 | +++ b/fs/ext4/move_extent.c |
912 | @@ -390,7 +390,8 @@ data_copy: |
913 | |
914 | /* Even in case of data=writeback it is reasonable to pin |
915 | * inode to transaction, to prevent unexpected data loss */ |
916 | - *err = ext4_jbd2_inode_add_write(handle, orig_inode); |
917 | + *err = ext4_jbd2_inode_add_write(handle, orig_inode, |
918 | + (loff_t)orig_page_offset << PAGE_SHIFT, replaced_size); |
919 | |
920 | unlock_pages: |
921 | unlock_page(pagep[0]); |
922 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c |
923 | index 4c5aa5df6573..61dc1b0e4465 100644 |
924 | --- a/fs/ext4/namei.c |
925 | +++ b/fs/ext4/namei.c |
926 | @@ -81,8 +81,18 @@ static struct buffer_head *ext4_append(handle_t *handle, |
927 | static int ext4_dx_csum_verify(struct inode *inode, |
928 | struct ext4_dir_entry *dirent); |
929 | |
930 | +/* |
931 | + * Hints to ext4_read_dirblock regarding whether we expect a directory |
932 | + * block being read to be an index block, or a block containing |
933 | + * directory entries (and if the latter, whether it was found via a |
934 | + * logical block in an htree index block). This is used to control |
935 | + * what sort of sanity checkinig ext4_read_dirblock() will do on the |
936 | + * directory block read from the storage device. EITHER will means |
937 | + * the caller doesn't know what kind of directory block will be read, |
938 | + * so no specific verification will be done. |
939 | + */ |
940 | typedef enum { |
941 | - EITHER, INDEX, DIRENT |
942 | + EITHER, INDEX, DIRENT, DIRENT_HTREE |
943 | } dirblock_type_t; |
944 | |
945 | #define ext4_read_dirblock(inode, block, type) \ |
946 | @@ -108,11 +118,14 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, |
947 | |
948 | return bh; |
949 | } |
950 | - if (!bh) { |
951 | + if (!bh && (type == INDEX || type == DIRENT_HTREE)) { |
952 | ext4_error_inode(inode, func, line, block, |
953 | - "Directory hole found"); |
954 | + "Directory hole found for htree %s block", |
955 | + (type == INDEX) ? "index" : "leaf"); |
956 | return ERR_PTR(-EFSCORRUPTED); |
957 | } |
958 | + if (!bh) |
959 | + return NULL; |
960 | dirent = (struct ext4_dir_entry *) bh->b_data; |
961 | /* Determine whether or not we have an index block */ |
962 | if (is_dx(inode)) { |
963 | @@ -979,7 +992,7 @@ static int htree_dirblock_to_tree(struct file *dir_file, |
964 | |
965 | dxtrace(printk(KERN_INFO "In htree dirblock_to_tree: block %lu\n", |
966 | (unsigned long)block)); |
967 | - bh = ext4_read_dirblock(dir, block, DIRENT); |
968 | + bh = ext4_read_dirblock(dir, block, DIRENT_HTREE); |
969 | if (IS_ERR(bh)) |
970 | return PTR_ERR(bh); |
971 | |
972 | @@ -1509,7 +1522,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir, |
973 | return (struct buffer_head *) frame; |
974 | do { |
975 | block = dx_get_block(frame->at); |
976 | - bh = ext4_read_dirblock(dir, block, DIRENT); |
977 | + bh = ext4_read_dirblock(dir, block, DIRENT_HTREE); |
978 | if (IS_ERR(bh)) |
979 | goto errout; |
980 | |
981 | @@ -2079,6 +2092,11 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, |
982 | blocks = dir->i_size >> sb->s_blocksize_bits; |
983 | for (block = 0; block < blocks; block++) { |
984 | bh = ext4_read_dirblock(dir, block, DIRENT); |
985 | + if (bh == NULL) { |
986 | + bh = ext4_bread(handle, dir, block, |
987 | + EXT4_GET_BLOCKS_CREATE); |
988 | + goto add_to_new_block; |
989 | + } |
990 | if (IS_ERR(bh)) { |
991 | retval = PTR_ERR(bh); |
992 | bh = NULL; |
993 | @@ -2099,6 +2117,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, |
994 | brelse(bh); |
995 | } |
996 | bh = ext4_append(handle, dir, &block); |
997 | +add_to_new_block: |
998 | if (IS_ERR(bh)) { |
999 | retval = PTR_ERR(bh); |
1000 | bh = NULL; |
1001 | @@ -2143,7 +2162,7 @@ again: |
1002 | return PTR_ERR(frame); |
1003 | entries = frame->entries; |
1004 | at = frame->at; |
1005 | - bh = ext4_read_dirblock(dir, dx_get_block(frame->at), DIRENT); |
1006 | + bh = ext4_read_dirblock(dir, dx_get_block(frame->at), DIRENT_HTREE); |
1007 | if (IS_ERR(bh)) { |
1008 | err = PTR_ERR(bh); |
1009 | bh = NULL; |
1010 | @@ -2691,7 +2710,10 @@ bool ext4_empty_dir(struct inode *inode) |
1011 | EXT4_ERROR_INODE(inode, "invalid size"); |
1012 | return true; |
1013 | } |
1014 | - bh = ext4_read_dirblock(inode, 0, EITHER); |
1015 | + /* The first directory block must not be a hole, |
1016 | + * so treat it as DIRENT_HTREE |
1017 | + */ |
1018 | + bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE); |
1019 | if (IS_ERR(bh)) |
1020 | return true; |
1021 | |
1022 | @@ -2713,6 +2735,10 @@ bool ext4_empty_dir(struct inode *inode) |
1023 | brelse(bh); |
1024 | lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb); |
1025 | bh = ext4_read_dirblock(inode, lblock, EITHER); |
1026 | + if (bh == NULL) { |
1027 | + offset += sb->s_blocksize; |
1028 | + continue; |
1029 | + } |
1030 | if (IS_ERR(bh)) |
1031 | return true; |
1032 | de = (struct ext4_dir_entry_2 *) bh->b_data; |
1033 | @@ -3256,7 +3282,10 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle, |
1034 | struct buffer_head *bh; |
1035 | |
1036 | if (!ext4_has_inline_data(inode)) { |
1037 | - bh = ext4_read_dirblock(inode, 0, EITHER); |
1038 | + /* The first directory block must not be a hole, so |
1039 | + * treat it as DIRENT_HTREE |
1040 | + */ |
1041 | + bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE); |
1042 | if (IS_ERR(bh)) { |
1043 | *retval = PTR_ERR(bh); |
1044 | return NULL; |
1045 | diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c |
1046 | index 65ea0355a4f6..24f86ffe11d7 100644 |
1047 | --- a/fs/jbd2/commit.c |
1048 | +++ b/fs/jbd2/commit.c |
1049 | @@ -187,14 +187,15 @@ static int journal_wait_on_commit_record(journal_t *journal, |
1050 | * use writepages() because with dealyed allocation we may be doing |
1051 | * block allocation in writepages(). |
1052 | */ |
1053 | -static int journal_submit_inode_data_buffers(struct address_space *mapping) |
1054 | +static int journal_submit_inode_data_buffers(struct address_space *mapping, |
1055 | + loff_t dirty_start, loff_t dirty_end) |
1056 | { |
1057 | int ret; |
1058 | struct writeback_control wbc = { |
1059 | .sync_mode = WB_SYNC_ALL, |
1060 | .nr_to_write = mapping->nrpages * 2, |
1061 | - .range_start = 0, |
1062 | - .range_end = i_size_read(mapping->host), |
1063 | + .range_start = dirty_start, |
1064 | + .range_end = dirty_end, |
1065 | }; |
1066 | |
1067 | ret = generic_writepages(mapping, &wbc); |
1068 | @@ -218,6 +219,9 @@ static int journal_submit_data_buffers(journal_t *journal, |
1069 | |
1070 | spin_lock(&journal->j_list_lock); |
1071 | list_for_each_entry(jinode, &commit_transaction->t_inode_list, i_list) { |
1072 | + loff_t dirty_start = jinode->i_dirty_start; |
1073 | + loff_t dirty_end = jinode->i_dirty_end; |
1074 | + |
1075 | if (!(jinode->i_flags & JI_WRITE_DATA)) |
1076 | continue; |
1077 | mapping = jinode->i_vfs_inode->i_mapping; |
1078 | @@ -230,7 +234,8 @@ static int journal_submit_data_buffers(journal_t *journal, |
1079 | * only allocated blocks here. |
1080 | */ |
1081 | trace_jbd2_submit_inode_data(jinode->i_vfs_inode); |
1082 | - err = journal_submit_inode_data_buffers(mapping); |
1083 | + err = journal_submit_inode_data_buffers(mapping, dirty_start, |
1084 | + dirty_end); |
1085 | if (!ret) |
1086 | ret = err; |
1087 | spin_lock(&journal->j_list_lock); |
1088 | @@ -257,12 +262,16 @@ static int journal_finish_inode_data_buffers(journal_t *journal, |
1089 | /* For locking, see the comment in journal_submit_data_buffers() */ |
1090 | spin_lock(&journal->j_list_lock); |
1091 | list_for_each_entry(jinode, &commit_transaction->t_inode_list, i_list) { |
1092 | + loff_t dirty_start = jinode->i_dirty_start; |
1093 | + loff_t dirty_end = jinode->i_dirty_end; |
1094 | + |
1095 | if (!(jinode->i_flags & JI_WAIT_DATA)) |
1096 | continue; |
1097 | jinode->i_flags |= JI_COMMIT_RUNNING; |
1098 | spin_unlock(&journal->j_list_lock); |
1099 | - err = filemap_fdatawait_keep_errors( |
1100 | - jinode->i_vfs_inode->i_mapping); |
1101 | + err = filemap_fdatawait_range_keep_errors( |
1102 | + jinode->i_vfs_inode->i_mapping, dirty_start, |
1103 | + dirty_end); |
1104 | if (!ret) |
1105 | ret = err; |
1106 | spin_lock(&journal->j_list_lock); |
1107 | @@ -282,6 +291,8 @@ static int journal_finish_inode_data_buffers(journal_t *journal, |
1108 | &jinode->i_transaction->t_inode_list); |
1109 | } else { |
1110 | jinode->i_transaction = NULL; |
1111 | + jinode->i_dirty_start = 0; |
1112 | + jinode->i_dirty_end = 0; |
1113 | } |
1114 | } |
1115 | spin_unlock(&journal->j_list_lock); |
1116 | diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c |
1117 | index e9cf88f0bc29..df390a69c49a 100644 |
1118 | --- a/fs/jbd2/journal.c |
1119 | +++ b/fs/jbd2/journal.c |
1120 | @@ -94,6 +94,8 @@ EXPORT_SYMBOL(jbd2_journal_try_to_free_buffers); |
1121 | EXPORT_SYMBOL(jbd2_journal_force_commit); |
1122 | EXPORT_SYMBOL(jbd2_journal_inode_add_write); |
1123 | EXPORT_SYMBOL(jbd2_journal_inode_add_wait); |
1124 | +EXPORT_SYMBOL(jbd2_journal_inode_ranged_write); |
1125 | +EXPORT_SYMBOL(jbd2_journal_inode_ranged_wait); |
1126 | EXPORT_SYMBOL(jbd2_journal_init_jbd_inode); |
1127 | EXPORT_SYMBOL(jbd2_journal_release_jbd_inode); |
1128 | EXPORT_SYMBOL(jbd2_journal_begin_ordered_truncate); |
1129 | @@ -2588,6 +2590,8 @@ void jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode) |
1130 | jinode->i_next_transaction = NULL; |
1131 | jinode->i_vfs_inode = inode; |
1132 | jinode->i_flags = 0; |
1133 | + jinode->i_dirty_start = 0; |
1134 | + jinode->i_dirty_end = 0; |
1135 | INIT_LIST_HEAD(&jinode->i_list); |
1136 | } |
1137 | |
1138 | diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c |
1139 | index e20a6703531f..911ff18249b7 100644 |
1140 | --- a/fs/jbd2/transaction.c |
1141 | +++ b/fs/jbd2/transaction.c |
1142 | @@ -2500,7 +2500,7 @@ void jbd2_journal_refile_buffer(journal_t *journal, struct journal_head *jh) |
1143 | * File inode in the inode list of the handle's transaction |
1144 | */ |
1145 | static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode, |
1146 | - unsigned long flags) |
1147 | + unsigned long flags, loff_t start_byte, loff_t end_byte) |
1148 | { |
1149 | transaction_t *transaction = handle->h_transaction; |
1150 | journal_t *journal; |
1151 | @@ -2512,26 +2512,17 @@ static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode, |
1152 | jbd_debug(4, "Adding inode %lu, tid:%d\n", jinode->i_vfs_inode->i_ino, |
1153 | transaction->t_tid); |
1154 | |
1155 | - /* |
1156 | - * First check whether inode isn't already on the transaction's |
1157 | - * lists without taking the lock. Note that this check is safe |
1158 | - * without the lock as we cannot race with somebody removing inode |
1159 | - * from the transaction. The reason is that we remove inode from the |
1160 | - * transaction only in journal_release_jbd_inode() and when we commit |
1161 | - * the transaction. We are guarded from the first case by holding |
1162 | - * a reference to the inode. We are safe against the second case |
1163 | - * because if jinode->i_transaction == transaction, commit code |
1164 | - * cannot touch the transaction because we hold reference to it, |
1165 | - * and if jinode->i_next_transaction == transaction, commit code |
1166 | - * will only file the inode where we want it. |
1167 | - */ |
1168 | - if ((jinode->i_transaction == transaction || |
1169 | - jinode->i_next_transaction == transaction) && |
1170 | - (jinode->i_flags & flags) == flags) |
1171 | - return 0; |
1172 | - |
1173 | spin_lock(&journal->j_list_lock); |
1174 | jinode->i_flags |= flags; |
1175 | + |
1176 | + if (jinode->i_dirty_end) { |
1177 | + jinode->i_dirty_start = min(jinode->i_dirty_start, start_byte); |
1178 | + jinode->i_dirty_end = max(jinode->i_dirty_end, end_byte); |
1179 | + } else { |
1180 | + jinode->i_dirty_start = start_byte; |
1181 | + jinode->i_dirty_end = end_byte; |
1182 | + } |
1183 | + |
1184 | /* Is inode already attached where we need it? */ |
1185 | if (jinode->i_transaction == transaction || |
1186 | jinode->i_next_transaction == transaction) |
1187 | @@ -2566,12 +2557,28 @@ done: |
1188 | int jbd2_journal_inode_add_write(handle_t *handle, struct jbd2_inode *jinode) |
1189 | { |
1190 | return jbd2_journal_file_inode(handle, jinode, |
1191 | - JI_WRITE_DATA | JI_WAIT_DATA); |
1192 | + JI_WRITE_DATA | JI_WAIT_DATA, 0, LLONG_MAX); |
1193 | } |
1194 | |
1195 | int jbd2_journal_inode_add_wait(handle_t *handle, struct jbd2_inode *jinode) |
1196 | { |
1197 | - return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA); |
1198 | + return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA, 0, |
1199 | + LLONG_MAX); |
1200 | +} |
1201 | + |
1202 | +int jbd2_journal_inode_ranged_write(handle_t *handle, |
1203 | + struct jbd2_inode *jinode, loff_t start_byte, loff_t length) |
1204 | +{ |
1205 | + return jbd2_journal_file_inode(handle, jinode, |
1206 | + JI_WRITE_DATA | JI_WAIT_DATA, start_byte, |
1207 | + start_byte + length - 1); |
1208 | +} |
1209 | + |
1210 | +int jbd2_journal_inode_ranged_wait(handle_t *handle, struct jbd2_inode *jinode, |
1211 | + loff_t start_byte, loff_t length) |
1212 | +{ |
1213 | + return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA, |
1214 | + start_byte, start_byte + length - 1); |
1215 | } |
1216 | |
1217 | /* |
1218 | diff --git a/include/linux/fs.h b/include/linux/fs.h |
1219 | index d4e1b43a53c3..92420009b9bc 100644 |
1220 | --- a/include/linux/fs.h |
1221 | +++ b/include/linux/fs.h |
1222 | @@ -2651,6 +2651,8 @@ extern int filemap_flush(struct address_space *); |
1223 | extern int filemap_fdatawait_keep_errors(struct address_space *mapping); |
1224 | extern int filemap_fdatawait_range(struct address_space *, loff_t lstart, |
1225 | loff_t lend); |
1226 | +extern int filemap_fdatawait_range_keep_errors(struct address_space *mapping, |
1227 | + loff_t start_byte, loff_t end_byte); |
1228 | |
1229 | static inline int filemap_fdatawait(struct address_space *mapping) |
1230 | { |
1231 | diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h |
1232 | index 583b82b5a1e9..1cf1b9b8e975 100644 |
1233 | --- a/include/linux/jbd2.h |
1234 | +++ b/include/linux/jbd2.h |
1235 | @@ -454,6 +454,22 @@ struct jbd2_inode { |
1236 | * @i_flags: Flags of inode [j_list_lock] |
1237 | */ |
1238 | unsigned long i_flags; |
1239 | + |
1240 | + /** |
1241 | + * @i_dirty_start: |
1242 | + * |
1243 | + * Offset in bytes where the dirty range for this inode starts. |
1244 | + * [j_list_lock] |
1245 | + */ |
1246 | + loff_t i_dirty_start; |
1247 | + |
1248 | + /** |
1249 | + * @i_dirty_end: |
1250 | + * |
1251 | + * Inclusive offset in bytes where the dirty range for this inode |
1252 | + * ends. [j_list_lock] |
1253 | + */ |
1254 | + loff_t i_dirty_end; |
1255 | }; |
1256 | |
1257 | struct jbd2_revoke_table_s; |
1258 | @@ -1399,6 +1415,12 @@ extern int jbd2_journal_force_commit(journal_t *); |
1259 | extern int jbd2_journal_force_commit_nested(journal_t *); |
1260 | extern int jbd2_journal_inode_add_write(handle_t *handle, struct jbd2_inode *inode); |
1261 | extern int jbd2_journal_inode_add_wait(handle_t *handle, struct jbd2_inode *inode); |
1262 | +extern int jbd2_journal_inode_ranged_write(handle_t *handle, |
1263 | + struct jbd2_inode *inode, loff_t start_byte, |
1264 | + loff_t length); |
1265 | +extern int jbd2_journal_inode_ranged_wait(handle_t *handle, |
1266 | + struct jbd2_inode *inode, loff_t start_byte, |
1267 | + loff_t length); |
1268 | extern int jbd2_journal_begin_ordered_truncate(journal_t *journal, |
1269 | struct jbd2_inode *inode, loff_t new_size); |
1270 | extern void jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode); |
1271 | diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h |
1272 | index 42fc852bf512..b22bc81f3669 100644 |
1273 | --- a/include/linux/perf_event.h |
1274 | +++ b/include/linux/perf_event.h |
1275 | @@ -1030,6 +1030,11 @@ static inline int in_software_context(struct perf_event *event) |
1276 | return event->ctx->pmu->task_ctx_nr == perf_sw_context; |
1277 | } |
1278 | |
1279 | +static inline int is_exclusive_pmu(struct pmu *pmu) |
1280 | +{ |
1281 | + return pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE; |
1282 | +} |
1283 | + |
1284 | extern struct static_key perf_swevent_enabled[PERF_COUNT_SW_MAX]; |
1285 | |
1286 | extern void ___perf_sw_event(u32, u64, struct pt_regs *, u64); |
1287 | diff --git a/include/net/dst.h b/include/net/dst.h |
1288 | index 6cf0870414c7..ffc8ee0ea5e5 100644 |
1289 | --- a/include/net/dst.h |
1290 | +++ b/include/net/dst.h |
1291 | @@ -313,8 +313,9 @@ static inline bool dst_hold_safe(struct dst_entry *dst) |
1292 | * @skb: buffer |
1293 | * |
1294 | * If dst is not yet refcounted and not destroyed, grab a ref on it. |
1295 | + * Returns true if dst is refcounted. |
1296 | */ |
1297 | -static inline void skb_dst_force(struct sk_buff *skb) |
1298 | +static inline bool skb_dst_force(struct sk_buff *skb) |
1299 | { |
1300 | if (skb_dst_is_noref(skb)) { |
1301 | struct dst_entry *dst = skb_dst(skb); |
1302 | @@ -325,6 +326,8 @@ static inline void skb_dst_force(struct sk_buff *skb) |
1303 | |
1304 | skb->_skb_refdst = (unsigned long)dst; |
1305 | } |
1306 | + |
1307 | + return skb->_skb_refdst != 0UL; |
1308 | } |
1309 | |
1310 | |
1311 | diff --git a/include/net/tcp.h b/include/net/tcp.h |
1312 | index e75661f92daa..abcf53a6db04 100644 |
1313 | --- a/include/net/tcp.h |
1314 | +++ b/include/net/tcp.h |
1315 | @@ -1054,7 +1054,8 @@ void tcp_get_default_congestion_control(struct net *net, char *name); |
1316 | void tcp_get_available_congestion_control(char *buf, size_t len); |
1317 | void tcp_get_allowed_congestion_control(char *buf, size_t len); |
1318 | int tcp_set_allowed_congestion_control(char *allowed); |
1319 | -int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit); |
1320 | +int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, |
1321 | + bool reinit, bool cap_net_admin); |
1322 | u32 tcp_slow_start(struct tcp_sock *tp, u32 acked); |
1323 | void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked); |
1324 | |
1325 | @@ -1646,6 +1647,11 @@ static inline struct sk_buff *tcp_rtx_queue_head(const struct sock *sk) |
1326 | return skb_rb_first(&sk->tcp_rtx_queue); |
1327 | } |
1328 | |
1329 | +static inline struct sk_buff *tcp_rtx_queue_tail(const struct sock *sk) |
1330 | +{ |
1331 | + return skb_rb_last(&sk->tcp_rtx_queue); |
1332 | +} |
1333 | + |
1334 | static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk) |
1335 | { |
1336 | return skb_peek(&sk->sk_write_queue); |
1337 | diff --git a/include/net/tls.h b/include/net/tls.h |
1338 | index 954110575891..98f5ad0319a2 100644 |
1339 | --- a/include/net/tls.h |
1340 | +++ b/include/net/tls.h |
1341 | @@ -234,6 +234,7 @@ struct tls_offload_context_rx { |
1342 | (ALIGN(sizeof(struct tls_offload_context_rx), sizeof(void *)) + \ |
1343 | TLS_DRIVER_STATE_SIZE) |
1344 | |
1345 | +void tls_ctx_free(struct tls_context *ctx); |
1346 | int wait_on_pending_writer(struct sock *sk, long *timeo); |
1347 | int tls_sk_query(struct sock *sk, int optname, char __user *optval, |
1348 | int __user *optlen); |
1349 | diff --git a/kernel/events/core.c b/kernel/events/core.c |
1350 | index 3b61ff40bfe2..e8979c72514b 100644 |
1351 | --- a/kernel/events/core.c |
1352 | +++ b/kernel/events/core.c |
1353 | @@ -2541,6 +2541,9 @@ unlock: |
1354 | return ret; |
1355 | } |
1356 | |
1357 | +static bool exclusive_event_installable(struct perf_event *event, |
1358 | + struct perf_event_context *ctx); |
1359 | + |
1360 | /* |
1361 | * Attach a performance event to a context. |
1362 | * |
1363 | @@ -2555,6 +2558,8 @@ perf_install_in_context(struct perf_event_context *ctx, |
1364 | |
1365 | lockdep_assert_held(&ctx->mutex); |
1366 | |
1367 | + WARN_ON_ONCE(!exclusive_event_installable(event, ctx)); |
1368 | + |
1369 | if (event->cpu != -1) |
1370 | event->cpu = cpu; |
1371 | |
1372 | @@ -4341,7 +4346,7 @@ static int exclusive_event_init(struct perf_event *event) |
1373 | { |
1374 | struct pmu *pmu = event->pmu; |
1375 | |
1376 | - if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE)) |
1377 | + if (!is_exclusive_pmu(pmu)) |
1378 | return 0; |
1379 | |
1380 | /* |
1381 | @@ -4372,7 +4377,7 @@ static void exclusive_event_destroy(struct perf_event *event) |
1382 | { |
1383 | struct pmu *pmu = event->pmu; |
1384 | |
1385 | - if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE)) |
1386 | + if (!is_exclusive_pmu(pmu)) |
1387 | return; |
1388 | |
1389 | /* see comment in exclusive_event_init() */ |
1390 | @@ -4392,14 +4397,15 @@ static bool exclusive_event_match(struct perf_event *e1, struct perf_event *e2) |
1391 | return false; |
1392 | } |
1393 | |
1394 | -/* Called under the same ctx::mutex as perf_install_in_context() */ |
1395 | static bool exclusive_event_installable(struct perf_event *event, |
1396 | struct perf_event_context *ctx) |
1397 | { |
1398 | struct perf_event *iter_event; |
1399 | struct pmu *pmu = event->pmu; |
1400 | |
1401 | - if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE)) |
1402 | + lockdep_assert_held(&ctx->mutex); |
1403 | + |
1404 | + if (!is_exclusive_pmu(pmu)) |
1405 | return true; |
1406 | |
1407 | list_for_each_entry(iter_event, &ctx->event_list, event_entry) { |
1408 | @@ -4446,12 +4452,20 @@ static void _free_event(struct perf_event *event) |
1409 | if (event->destroy) |
1410 | event->destroy(event); |
1411 | |
1412 | - if (event->ctx) |
1413 | - put_ctx(event->ctx); |
1414 | - |
1415 | + /* |
1416 | + * Must be after ->destroy(), due to uprobe_perf_close() using |
1417 | + * hw.target. |
1418 | + */ |
1419 | if (event->hw.target) |
1420 | put_task_struct(event->hw.target); |
1421 | |
1422 | + /* |
1423 | + * perf_event_free_task() relies on put_ctx() being 'last', in particular |
1424 | + * all task references must be cleaned up. |
1425 | + */ |
1426 | + if (event->ctx) |
1427 | + put_ctx(event->ctx); |
1428 | + |
1429 | exclusive_event_destroy(event); |
1430 | module_put(event->pmu->module); |
1431 | |
1432 | @@ -4631,8 +4645,17 @@ again: |
1433 | mutex_unlock(&event->child_mutex); |
1434 | |
1435 | list_for_each_entry_safe(child, tmp, &free_list, child_list) { |
1436 | + void *var = &child->ctx->refcount; |
1437 | + |
1438 | list_del(&child->child_list); |
1439 | free_event(child); |
1440 | + |
1441 | + /* |
1442 | + * Wake any perf_event_free_task() waiting for this event to be |
1443 | + * freed. |
1444 | + */ |
1445 | + smp_mb(); /* pairs with wait_var_event() */ |
1446 | + wake_up_var(var); |
1447 | } |
1448 | |
1449 | no_ctx: |
1450 | @@ -10613,11 +10636,6 @@ SYSCALL_DEFINE5(perf_event_open, |
1451 | goto err_alloc; |
1452 | } |
1453 | |
1454 | - if ((pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE) && group_leader) { |
1455 | - err = -EBUSY; |
1456 | - goto err_context; |
1457 | - } |
1458 | - |
1459 | /* |
1460 | * Look up the group leader (we will attach this event to it): |
1461 | */ |
1462 | @@ -10705,6 +10723,18 @@ SYSCALL_DEFINE5(perf_event_open, |
1463 | move_group = 0; |
1464 | } |
1465 | } |
1466 | + |
1467 | + /* |
1468 | + * Failure to create exclusive events returns -EBUSY. |
1469 | + */ |
1470 | + err = -EBUSY; |
1471 | + if (!exclusive_event_installable(group_leader, ctx)) |
1472 | + goto err_locked; |
1473 | + |
1474 | + for_each_sibling_event(sibling, group_leader) { |
1475 | + if (!exclusive_event_installable(sibling, ctx)) |
1476 | + goto err_locked; |
1477 | + } |
1478 | } else { |
1479 | mutex_lock(&ctx->mutex); |
1480 | } |
1481 | @@ -10741,9 +10771,6 @@ SYSCALL_DEFINE5(perf_event_open, |
1482 | * because we need to serialize with concurrent event creation. |
1483 | */ |
1484 | if (!exclusive_event_installable(event, ctx)) { |
1485 | - /* exclusive and group stuff are assumed mutually exclusive */ |
1486 | - WARN_ON_ONCE(move_group); |
1487 | - |
1488 | err = -EBUSY; |
1489 | goto err_locked; |
1490 | } |
1491 | @@ -11210,11 +11237,11 @@ static void perf_free_event(struct perf_event *event, |
1492 | } |
1493 | |
1494 | /* |
1495 | - * Free an unexposed, unused context as created by inheritance by |
1496 | - * perf_event_init_task below, used by fork() in case of fail. |
1497 | + * Free a context as created by inheritance by perf_event_init_task() below, |
1498 | + * used by fork() in case of fail. |
1499 | * |
1500 | - * Not all locks are strictly required, but take them anyway to be nice and |
1501 | - * help out with the lockdep assertions. |
1502 | + * Even though the task has never lived, the context and events have been |
1503 | + * exposed through the child_list, so we must take care tearing it all down. |
1504 | */ |
1505 | void perf_event_free_task(struct task_struct *task) |
1506 | { |
1507 | @@ -11244,7 +11271,23 @@ void perf_event_free_task(struct task_struct *task) |
1508 | perf_free_event(event, ctx); |
1509 | |
1510 | mutex_unlock(&ctx->mutex); |
1511 | - put_ctx(ctx); |
1512 | + |
1513 | + /* |
1514 | + * perf_event_release_kernel() could've stolen some of our |
1515 | + * child events and still have them on its free_list. In that |
1516 | + * case we must wait for these events to have been freed (in |
1517 | + * particular all their references to this task must've been |
1518 | + * dropped). |
1519 | + * |
1520 | + * Without this copy_process() will unconditionally free this |
1521 | + * task (irrespective of its reference count) and |
1522 | + * _free_event()'s put_task_struct(event->hw.target) will be a |
1523 | + * use-after-free. |
1524 | + * |
1525 | + * Wait for all events to drop their context reference. |
1526 | + */ |
1527 | + wait_var_event(&ctx->refcount, atomic_read(&ctx->refcount) == 1); |
1528 | + put_ctx(ctx); /* must be last */ |
1529 | } |
1530 | } |
1531 | |
1532 | diff --git a/mm/filemap.c b/mm/filemap.c |
1533 | index 52517f28e6f4..287f3fa02e5e 100644 |
1534 | --- a/mm/filemap.c |
1535 | +++ b/mm/filemap.c |
1536 | @@ -561,6 +561,28 @@ int filemap_fdatawait_range(struct address_space *mapping, loff_t start_byte, |
1537 | } |
1538 | EXPORT_SYMBOL(filemap_fdatawait_range); |
1539 | |
1540 | +/** |
1541 | + * filemap_fdatawait_range_keep_errors - wait for writeback to complete |
1542 | + * @mapping: address space structure to wait for |
1543 | + * @start_byte: offset in bytes where the range starts |
1544 | + * @end_byte: offset in bytes where the range ends (inclusive) |
1545 | + * |
1546 | + * Walk the list of under-writeback pages of the given address space in the |
1547 | + * given range and wait for all of them. Unlike filemap_fdatawait_range(), |
1548 | + * this function does not clear error status of the address space. |
1549 | + * |
1550 | + * Use this function if callers don't handle errors themselves. Expected |
1551 | + * call sites are system-wide / filesystem-wide data flushers: e.g. sync(2), |
1552 | + * fsfreeze(8) |
1553 | + */ |
1554 | +int filemap_fdatawait_range_keep_errors(struct address_space *mapping, |
1555 | + loff_t start_byte, loff_t end_byte) |
1556 | +{ |
1557 | + __filemap_fdatawait_range(mapping, start_byte, end_byte); |
1558 | + return filemap_check_and_keep_errors(mapping); |
1559 | +} |
1560 | +EXPORT_SYMBOL(filemap_fdatawait_range_keep_errors); |
1561 | + |
1562 | /** |
1563 | * file_fdatawait_range - wait for writeback to complete |
1564 | * @file: file pointing to address space structure to wait for |
1565 | diff --git a/mm/vmscan.c b/mm/vmscan.c |
1566 | index e42f44cf7b43..576379e87421 100644 |
1567 | --- a/mm/vmscan.c |
1568 | +++ b/mm/vmscan.c |
1569 | @@ -2190,7 +2190,7 @@ static void shrink_active_list(unsigned long nr_to_scan, |
1570 | * 10TB 320 32GB |
1571 | */ |
1572 | static bool inactive_list_is_low(struct lruvec *lruvec, bool file, |
1573 | - struct scan_control *sc, bool actual_reclaim) |
1574 | + struct scan_control *sc, bool trace) |
1575 | { |
1576 | enum lru_list active_lru = file * LRU_FILE + LRU_ACTIVE; |
1577 | struct pglist_data *pgdat = lruvec_pgdat(lruvec); |
1578 | @@ -2216,7 +2216,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file, |
1579 | * rid of the stale workingset quickly. |
1580 | */ |
1581 | refaults = lruvec_page_state(lruvec, WORKINGSET_ACTIVATE); |
1582 | - if (file && actual_reclaim && lruvec->refaults != refaults) { |
1583 | + if (file && lruvec->refaults != refaults) { |
1584 | inactive_ratio = 0; |
1585 | } else { |
1586 | gb = (inactive + active) >> (30 - PAGE_SHIFT); |
1587 | @@ -2226,7 +2226,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file, |
1588 | inactive_ratio = 1; |
1589 | } |
1590 | |
1591 | - if (actual_reclaim) |
1592 | + if (trace) |
1593 | trace_mm_vmscan_inactive_list_is_low(pgdat->node_id, sc->reclaim_idx, |
1594 | lruvec_lru_size(lruvec, inactive_lru, MAX_NR_ZONES), inactive, |
1595 | lruvec_lru_size(lruvec, active_lru, MAX_NR_ZONES), active, |
1596 | diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c |
1597 | index fed0ff446abb..2532c1a19645 100644 |
1598 | --- a/net/bridge/br_input.c |
1599 | +++ b/net/bridge/br_input.c |
1600 | @@ -79,7 +79,6 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb |
1601 | struct net_bridge_fdb_entry *dst = NULL; |
1602 | struct net_bridge_mdb_entry *mdst; |
1603 | bool local_rcv, mcast_hit = false; |
1604 | - const unsigned char *dest; |
1605 | struct net_bridge *br; |
1606 | u16 vid = 0; |
1607 | |
1608 | @@ -97,10 +96,9 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb |
1609 | br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false); |
1610 | |
1611 | local_rcv = !!(br->dev->flags & IFF_PROMISC); |
1612 | - dest = eth_hdr(skb)->h_dest; |
1613 | - if (is_multicast_ether_addr(dest)) { |
1614 | + if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) { |
1615 | /* by definition the broadcast is also a multicast address */ |
1616 | - if (is_broadcast_ether_addr(dest)) { |
1617 | + if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) { |
1618 | pkt_type = BR_PKT_BROADCAST; |
1619 | local_rcv = true; |
1620 | } else { |
1621 | @@ -150,7 +148,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb |
1622 | } |
1623 | break; |
1624 | case BR_PKT_UNICAST: |
1625 | - dst = br_fdb_find_rcu(br, dest, vid); |
1626 | + dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid); |
1627 | default: |
1628 | break; |
1629 | } |
1630 | diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c |
1631 | index 75901c4641b1..fb54d32321ec 100644 |
1632 | --- a/net/bridge/br_multicast.c |
1633 | +++ b/net/bridge/br_multicast.c |
1634 | @@ -1147,6 +1147,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, |
1635 | int type; |
1636 | int err = 0; |
1637 | __be32 group; |
1638 | + u16 nsrcs; |
1639 | |
1640 | ih = igmpv3_report_hdr(skb); |
1641 | num = ntohs(ih->ngrec); |
1642 | @@ -1160,8 +1161,9 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, |
1643 | grec = (void *)(skb->data + len - sizeof(*grec)); |
1644 | group = grec->grec_mca; |
1645 | type = grec->grec_type; |
1646 | + nsrcs = ntohs(grec->grec_nsrcs); |
1647 | |
1648 | - len += ntohs(grec->grec_nsrcs) * 4; |
1649 | + len += nsrcs * 4; |
1650 | if (!pskb_may_pull(skb, len)) |
1651 | return -EINVAL; |
1652 | |
1653 | @@ -1182,7 +1184,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, |
1654 | src = eth_hdr(skb)->h_source; |
1655 | if ((type == IGMPV3_CHANGE_TO_INCLUDE || |
1656 | type == IGMPV3_MODE_IS_INCLUDE) && |
1657 | - ntohs(grec->grec_nsrcs) == 0) { |
1658 | + nsrcs == 0) { |
1659 | br_ip4_multicast_leave_group(br, port, group, vid, src); |
1660 | } else { |
1661 | err = br_ip4_multicast_add_group(br, port, group, vid, |
1662 | @@ -1217,23 +1219,26 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, |
1663 | len = skb_transport_offset(skb) + sizeof(*icmp6h); |
1664 | |
1665 | for (i = 0; i < num; i++) { |
1666 | - __be16 *nsrcs, _nsrcs; |
1667 | - |
1668 | - nsrcs = skb_header_pointer(skb, |
1669 | - len + offsetof(struct mld2_grec, |
1670 | - grec_nsrcs), |
1671 | - sizeof(_nsrcs), &_nsrcs); |
1672 | - if (!nsrcs) |
1673 | + __be16 *_nsrcs, __nsrcs; |
1674 | + u16 nsrcs; |
1675 | + |
1676 | + _nsrcs = skb_header_pointer(skb, |
1677 | + len + offsetof(struct mld2_grec, |
1678 | + grec_nsrcs), |
1679 | + sizeof(__nsrcs), &__nsrcs); |
1680 | + if (!_nsrcs) |
1681 | return -EINVAL; |
1682 | |
1683 | + nsrcs = ntohs(*_nsrcs); |
1684 | + |
1685 | if (!pskb_may_pull(skb, |
1686 | len + sizeof(*grec) + |
1687 | - sizeof(struct in6_addr) * ntohs(*nsrcs))) |
1688 | + sizeof(struct in6_addr) * nsrcs)) |
1689 | return -EINVAL; |
1690 | |
1691 | grec = (struct mld2_grec *)(skb->data + len); |
1692 | len += sizeof(*grec) + |
1693 | - sizeof(struct in6_addr) * ntohs(*nsrcs); |
1694 | + sizeof(struct in6_addr) * nsrcs; |
1695 | |
1696 | /* We treat these as MLDv1 reports for now. */ |
1697 | switch (grec->grec_type) { |
1698 | @@ -1252,7 +1257,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, |
1699 | src = eth_hdr(skb)->h_source; |
1700 | if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE || |
1701 | grec->grec_type == MLD2_MODE_IS_INCLUDE) && |
1702 | - ntohs(*nsrcs) == 0) { |
1703 | + nsrcs == 0) { |
1704 | br_ip6_multicast_leave_group(br, port, &grec->grec_mca, |
1705 | vid, src); |
1706 | } else { |
1707 | @@ -1505,7 +1510,6 @@ static int br_ip6_multicast_query(struct net_bridge *br, |
1708 | struct sk_buff *skb, |
1709 | u16 vid) |
1710 | { |
1711 | - const struct ipv6hdr *ip6h = ipv6_hdr(skb); |
1712 | struct mld_msg *mld; |
1713 | struct net_bridge_mdb_entry *mp; |
1714 | struct mld2_query *mld2q; |
1715 | @@ -1549,7 +1553,7 @@ static int br_ip6_multicast_query(struct net_bridge *br, |
1716 | |
1717 | if (is_general_query) { |
1718 | saddr.proto = htons(ETH_P_IPV6); |
1719 | - saddr.u.ip6 = ip6h->saddr; |
1720 | + saddr.u.ip6 = ipv6_hdr(skb)->saddr; |
1721 | |
1722 | br_multicast_query_received(br, port, &br->ip6_other_query, |
1723 | &saddr, max_delay); |
1724 | diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c |
1725 | index 1b75d6bf12bd..37ddcea3fc96 100644 |
1726 | --- a/net/bridge/br_stp_bpdu.c |
1727 | +++ b/net/bridge/br_stp_bpdu.c |
1728 | @@ -147,7 +147,6 @@ void br_send_tcn_bpdu(struct net_bridge_port *p) |
1729 | void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb, |
1730 | struct net_device *dev) |
1731 | { |
1732 | - const unsigned char *dest = eth_hdr(skb)->h_dest; |
1733 | struct net_bridge_port *p; |
1734 | struct net_bridge *br; |
1735 | const unsigned char *buf; |
1736 | @@ -176,7 +175,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb, |
1737 | if (p->state == BR_STATE_DISABLED) |
1738 | goto out; |
1739 | |
1740 | - if (!ether_addr_equal(dest, br->group_addr)) |
1741 | + if (!ether_addr_equal(eth_hdr(skb)->h_dest, br->group_addr)) |
1742 | goto out; |
1743 | |
1744 | if (p->flags & BR_BPDU_GUARD) { |
1745 | diff --git a/net/core/filter.c b/net/core/filter.c |
1746 | index 34ec9324737b..c996380f2959 100644 |
1747 | --- a/net/core/filter.c |
1748 | +++ b/net/core/filter.c |
1749 | @@ -3991,7 +3991,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, |
1750 | TCP_CA_NAME_MAX-1)); |
1751 | name[TCP_CA_NAME_MAX-1] = 0; |
1752 | ret = tcp_set_congestion_control(sk, name, false, |
1753 | - reinit); |
1754 | + reinit, true); |
1755 | } else { |
1756 | struct tcp_sock *tp = tcp_sk(sk); |
1757 | |
1758 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c |
1759 | index cd9e991f21d7..c52d6e6b341c 100644 |
1760 | --- a/net/core/neighbour.c |
1761 | +++ b/net/core/neighbour.c |
1762 | @@ -1021,6 +1021,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) |
1763 | |
1764 | atomic_set(&neigh->probes, |
1765 | NEIGH_VAR(neigh->parms, UCAST_PROBES)); |
1766 | + neigh_del_timer(neigh); |
1767 | neigh->nud_state = NUD_INCOMPLETE; |
1768 | neigh->updated = now; |
1769 | next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME), |
1770 | @@ -1037,6 +1038,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) |
1771 | } |
1772 | } else if (neigh->nud_state & NUD_STALE) { |
1773 | neigh_dbg(2, "neigh %p is delayed\n", neigh); |
1774 | + neigh_del_timer(neigh); |
1775 | neigh->nud_state = NUD_DELAY; |
1776 | neigh->updated = jiffies; |
1777 | neigh_add_timer(neigh, jiffies + |
1778 | diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c |
1779 | index ea4bd8a52422..d23746143cd2 100644 |
1780 | --- a/net/ipv4/devinet.c |
1781 | +++ b/net/ipv4/devinet.c |
1782 | @@ -66,6 +66,11 @@ |
1783 | #include <net/net_namespace.h> |
1784 | #include <net/addrconf.h> |
1785 | |
1786 | +#define IPV6ONLY_FLAGS \ |
1787 | + (IFA_F_NODAD | IFA_F_OPTIMISTIC | IFA_F_DADFAILED | \ |
1788 | + IFA_F_HOMEADDRESS | IFA_F_TENTATIVE | \ |
1789 | + IFA_F_MANAGETEMPADDR | IFA_F_STABLE_PRIVACY) |
1790 | + |
1791 | static struct ipv4_devconf ipv4_devconf = { |
1792 | .data = { |
1793 | [IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1, |
1794 | @@ -462,6 +467,9 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh, |
1795 | ifa->ifa_flags &= ~IFA_F_SECONDARY; |
1796 | last_primary = &in_dev->ifa_list; |
1797 | |
1798 | + /* Don't set IPv6 only flags to IPv4 addresses */ |
1799 | + ifa->ifa_flags &= ~IPV6ONLY_FLAGS; |
1800 | + |
1801 | for (ifap = &in_dev->ifa_list; (ifa1 = *ifap) != NULL; |
1802 | ifap = &ifa1->ifa_next) { |
1803 | if (!(ifa1->ifa_flags & IFA_F_SECONDARY) && |
1804 | diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c |
1805 | index d187ee8156a1..b2240b7f225d 100644 |
1806 | --- a/net/ipv4/igmp.c |
1807 | +++ b/net/ipv4/igmp.c |
1808 | @@ -1218,12 +1218,8 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im) |
1809 | if (pmc) { |
1810 | im->interface = pmc->interface; |
1811 | if (im->sfmode == MCAST_INCLUDE) { |
1812 | - im->tomb = pmc->tomb; |
1813 | - pmc->tomb = NULL; |
1814 | - |
1815 | - im->sources = pmc->sources; |
1816 | - pmc->sources = NULL; |
1817 | - |
1818 | + swap(im->tomb, pmc->tomb); |
1819 | + swap(im->sources, pmc->sources); |
1820 | for (psf = im->sources; psf; psf = psf->sf_next) |
1821 | psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv; |
1822 | } else { |
1823 | diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c |
1824 | index 364e6fdaa38f..b7ef367fe6a1 100644 |
1825 | --- a/net/ipv4/tcp.c |
1826 | +++ b/net/ipv4/tcp.c |
1827 | @@ -2594,6 +2594,8 @@ int tcp_disconnect(struct sock *sk, int flags) |
1828 | tcp_saved_syn_free(tp); |
1829 | tp->compressed_ack = 0; |
1830 | tp->bytes_sent = 0; |
1831 | + tp->bytes_acked = 0; |
1832 | + tp->bytes_received = 0; |
1833 | tp->bytes_retrans = 0; |
1834 | tp->dsack_dups = 0; |
1835 | tp->reord_seen = 0; |
1836 | @@ -2729,7 +2731,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level, |
1837 | name[val] = 0; |
1838 | |
1839 | lock_sock(sk); |
1840 | - err = tcp_set_congestion_control(sk, name, true, true); |
1841 | + err = tcp_set_congestion_control(sk, name, true, true, |
1842 | + ns_capable(sock_net(sk)->user_ns, |
1843 | + CAP_NET_ADMIN)); |
1844 | release_sock(sk); |
1845 | return err; |
1846 | } |
1847 | diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c |
1848 | index bc6c02f16243..48f79db446a0 100644 |
1849 | --- a/net/ipv4/tcp_cong.c |
1850 | +++ b/net/ipv4/tcp_cong.c |
1851 | @@ -332,7 +332,8 @@ out: |
1852 | * tcp_reinit_congestion_control (if the current congestion control was |
1853 | * already initialized. |
1854 | */ |
1855 | -int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit) |
1856 | +int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, |
1857 | + bool reinit, bool cap_net_admin) |
1858 | { |
1859 | struct inet_connection_sock *icsk = inet_csk(sk); |
1860 | const struct tcp_congestion_ops *ca; |
1861 | @@ -368,8 +369,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, boo |
1862 | } else { |
1863 | err = -EBUSY; |
1864 | } |
1865 | - } else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) || |
1866 | - ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))) { |
1867 | + } else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) || cap_net_admin)) { |
1868 | err = -EPERM; |
1869 | } else if (!try_module_get(ca->owner)) { |
1870 | err = -EBUSY; |
1871 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
1872 | index 221d9b72423b..88c7e821fd11 100644 |
1873 | --- a/net/ipv4/tcp_output.c |
1874 | +++ b/net/ipv4/tcp_output.c |
1875 | @@ -1289,6 +1289,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue, |
1876 | struct tcp_sock *tp = tcp_sk(sk); |
1877 | struct sk_buff *buff; |
1878 | int nsize, old_factor; |
1879 | + long limit; |
1880 | int nlen; |
1881 | u8 flags; |
1882 | |
1883 | @@ -1299,8 +1300,16 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue, |
1884 | if (nsize < 0) |
1885 | nsize = 0; |
1886 | |
1887 | - if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf && |
1888 | - tcp_queue != TCP_FRAG_IN_WRITE_QUEUE)) { |
1889 | + /* tcp_sendmsg() can overshoot sk_wmem_queued by one full size skb. |
1890 | + * We need some allowance to not penalize applications setting small |
1891 | + * SO_SNDBUF values. |
1892 | + * Also allow first and last skb in retransmit queue to be split. |
1893 | + */ |
1894 | + limit = sk->sk_sndbuf + 2 * SKB_TRUESIZE(GSO_MAX_SIZE); |
1895 | + if (unlikely((sk->sk_wmem_queued >> 1) > limit && |
1896 | + tcp_queue != TCP_FRAG_IN_WRITE_QUEUE && |
1897 | + skb != tcp_rtx_queue_head(sk) && |
1898 | + skb != tcp_rtx_queue_tail(sk))) { |
1899 | NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG); |
1900 | return -ENOMEM; |
1901 | } |
1902 | diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c |
1903 | index a6c0479c1d55..bbb5ffb3397d 100644 |
1904 | --- a/net/ipv6/ip6_fib.c |
1905 | +++ b/net/ipv6/ip6_fib.c |
1906 | @@ -1081,8 +1081,24 @@ add: |
1907 | err = call_fib6_entry_notifiers(info->nl_net, |
1908 | FIB_EVENT_ENTRY_ADD, |
1909 | rt, extack); |
1910 | - if (err) |
1911 | + if (err) { |
1912 | + struct fib6_info *sibling, *next_sibling; |
1913 | + |
1914 | + /* If the route has siblings, then it first |
1915 | + * needs to be unlinked from them. |
1916 | + */ |
1917 | + if (!rt->fib6_nsiblings) |
1918 | + return err; |
1919 | + |
1920 | + list_for_each_entry_safe(sibling, next_sibling, |
1921 | + &rt->fib6_siblings, |
1922 | + fib6_siblings) |
1923 | + sibling->fib6_nsiblings--; |
1924 | + rt->fib6_nsiblings = 0; |
1925 | + list_del_init(&rt->fib6_siblings); |
1926 | + rt6_multipath_rebalance(next_sibling); |
1927 | return err; |
1928 | + } |
1929 | |
1930 | rcu_assign_pointer(rt->fib6_next, iter); |
1931 | atomic_inc(&rt->fib6_ref); |
1932 | diff --git a/net/ipv6/route.c b/net/ipv6/route.c |
1933 | index 24f7b2cf504b..81220077d62f 100644 |
1934 | --- a/net/ipv6/route.c |
1935 | +++ b/net/ipv6/route.c |
1936 | @@ -2214,7 +2214,7 @@ static struct dst_entry *rt6_check(struct rt6_info *rt, |
1937 | { |
1938 | u32 rt_cookie = 0; |
1939 | |
1940 | - if ((from && !fib6_get_cookie_safe(from, &rt_cookie)) || |
1941 | + if (!from || !fib6_get_cookie_safe(from, &rt_cookie) || |
1942 | rt_cookie != cookie) |
1943 | return NULL; |
1944 | |
1945 | diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c |
1946 | index 7569ba00e732..a96a8c16baf9 100644 |
1947 | --- a/net/netfilter/nf_queue.c |
1948 | +++ b/net/netfilter/nf_queue.c |
1949 | @@ -174,6 +174,11 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, |
1950 | goto err; |
1951 | } |
1952 | |
1953 | + if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) { |
1954 | + status = -ENETDOWN; |
1955 | + goto err; |
1956 | + } |
1957 | + |
1958 | *entry = (struct nf_queue_entry) { |
1959 | .skb = skb, |
1960 | .state = *state, |
1961 | @@ -182,7 +187,6 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, |
1962 | }; |
1963 | |
1964 | nf_queue_entry_get_refs(entry); |
1965 | - skb_dst_force(skb); |
1966 | |
1967 | switch (entry->state.pf) { |
1968 | case AF_INET: |
1969 | diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c |
1970 | index 71ffd1a6dc7c..43910e50752c 100644 |
1971 | --- a/net/netrom/af_netrom.c |
1972 | +++ b/net/netrom/af_netrom.c |
1973 | @@ -872,7 +872,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) |
1974 | unsigned short frametype, flags, window, timeout; |
1975 | int ret; |
1976 | |
1977 | - skb->sk = NULL; /* Initially we don't know who it's for */ |
1978 | + skb_orphan(skb); |
1979 | |
1980 | /* |
1981 | * skb->data points to the netrom frame start |
1982 | @@ -970,7 +970,9 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) |
1983 | |
1984 | window = skb->data[20]; |
1985 | |
1986 | + sock_hold(make); |
1987 | skb->sk = make; |
1988 | + skb->destructor = sock_efree; |
1989 | make->sk_state = TCP_ESTABLISHED; |
1990 | |
1991 | /* Fill in his circuit details */ |
1992 | diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c |
1993 | index 908f25e3773e..5405d073804c 100644 |
1994 | --- a/net/nfc/nci/data.c |
1995 | +++ b/net/nfc/nci/data.c |
1996 | @@ -119,7 +119,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev, |
1997 | conn_info = nci_get_conn_info_by_conn_id(ndev, conn_id); |
1998 | if (!conn_info) { |
1999 | rc = -EPROTO; |
2000 | - goto free_exit; |
2001 | + goto exit; |
2002 | } |
2003 | |
2004 | __skb_queue_head_init(&frags_q); |
2005 | diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c |
2006 | index 85ae53d8fd09..8211e8e97c96 100644 |
2007 | --- a/net/openvswitch/actions.c |
2008 | +++ b/net/openvswitch/actions.c |
2009 | @@ -175,8 +175,7 @@ static void update_ethertype(struct sk_buff *skb, struct ethhdr *hdr, |
2010 | if (skb->ip_summed == CHECKSUM_COMPLETE) { |
2011 | __be16 diff[] = { ~(hdr->h_proto), ethertype }; |
2012 | |
2013 | - skb->csum = ~csum_partial((char *)diff, sizeof(diff), |
2014 | - ~skb->csum); |
2015 | + skb->csum = csum_partial((char *)diff, sizeof(diff), skb->csum); |
2016 | } |
2017 | |
2018 | hdr->h_proto = ethertype; |
2019 | @@ -268,8 +267,7 @@ static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key, |
2020 | if (skb->ip_summed == CHECKSUM_COMPLETE) { |
2021 | __be32 diff[] = { ~(stack->label_stack_entry), lse }; |
2022 | |
2023 | - skb->csum = ~csum_partial((char *)diff, sizeof(diff), |
2024 | - ~skb->csum); |
2025 | + skb->csum = csum_partial((char *)diff, sizeof(diff), skb->csum); |
2026 | } |
2027 | |
2028 | stack->label_stack_entry = lse; |
2029 | diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c |
2030 | index 3c39b8805d01..d76e5e58905d 100644 |
2031 | --- a/net/rxrpc/af_rxrpc.c |
2032 | +++ b/net/rxrpc/af_rxrpc.c |
2033 | @@ -552,6 +552,7 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len) |
2034 | |
2035 | switch (rx->sk.sk_state) { |
2036 | case RXRPC_UNBOUND: |
2037 | + case RXRPC_CLIENT_UNBOUND: |
2038 | rx->srx.srx_family = AF_RXRPC; |
2039 | rx->srx.srx_service = 0; |
2040 | rx->srx.transport_type = SOCK_DGRAM; |
2041 | @@ -576,10 +577,9 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len) |
2042 | } |
2043 | |
2044 | rx->local = local; |
2045 | - rx->sk.sk_state = RXRPC_CLIENT_UNBOUND; |
2046 | + rx->sk.sk_state = RXRPC_CLIENT_BOUND; |
2047 | /* Fall through */ |
2048 | |
2049 | - case RXRPC_CLIENT_UNBOUND: |
2050 | case RXRPC_CLIENT_BOUND: |
2051 | if (!m->msg_name && |
2052 | test_bit(RXRPC_SOCK_CONNECTED, &rx->flags)) { |
2053 | diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c |
2054 | index 2167c6ca55e3..4159bcb479c6 100644 |
2055 | --- a/net/sched/cls_api.c |
2056 | +++ b/net/sched/cls_api.c |
2057 | @@ -1325,6 +1325,9 @@ replay: |
2058 | tcf_chain_tp_insert(chain, &chain_info, tp); |
2059 | tfilter_notify(net, skb, n, tp, block, q, parent, fh, |
2060 | RTM_NEWTFILTER, false); |
2061 | + /* q pointer is NULL for shared blocks */ |
2062 | + if (q) |
2063 | + q->flags &= ~TCQ_F_CAN_BYPASS; |
2064 | } else { |
2065 | if (tp_created) |
2066 | tcf_proto_destroy(tp, NULL); |
2067 | diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c |
2068 | index 6c0a9d5dbf94..137692cb8b4f 100644 |
2069 | --- a/net/sched/sch_fq_codel.c |
2070 | +++ b/net/sched/sch_fq_codel.c |
2071 | @@ -600,8 +600,6 @@ static unsigned long fq_codel_find(struct Qdisc *sch, u32 classid) |
2072 | static unsigned long fq_codel_bind(struct Qdisc *sch, unsigned long parent, |
2073 | u32 classid) |
2074 | { |
2075 | - /* we cannot bypass queue discipline anymore */ |
2076 | - sch->flags &= ~TCQ_F_CAN_BYPASS; |
2077 | return 0; |
2078 | } |
2079 | |
2080 | diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c |
2081 | index 2f2678197760..650f21463853 100644 |
2082 | --- a/net/sched/sch_sfq.c |
2083 | +++ b/net/sched/sch_sfq.c |
2084 | @@ -828,8 +828,6 @@ static unsigned long sfq_find(struct Qdisc *sch, u32 classid) |
2085 | static unsigned long sfq_bind(struct Qdisc *sch, unsigned long parent, |
2086 | u32 classid) |
2087 | { |
2088 | - /* we cannot bypass queue discipline anymore */ |
2089 | - sch->flags &= ~TCQ_F_CAN_BYPASS; |
2090 | return 0; |
2091 | } |
2092 | |
2093 | diff --git a/net/sctp/socket.c b/net/sctp/socket.c |
2094 | index 8c00a7ef1bcd..9f5b4e547b63 100644 |
2095 | --- a/net/sctp/socket.c |
2096 | +++ b/net/sctp/socket.c |
2097 | @@ -4507,34 +4507,18 @@ out_nounlock: |
2098 | static int sctp_connect(struct sock *sk, struct sockaddr *addr, |
2099 | int addr_len, int flags) |
2100 | { |
2101 | - struct inet_sock *inet = inet_sk(sk); |
2102 | struct sctp_af *af; |
2103 | - int err = 0; |
2104 | + int err = -EINVAL; |
2105 | |
2106 | lock_sock(sk); |
2107 | |
2108 | pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk, |
2109 | addr, addr_len); |
2110 | |
2111 | - /* We may need to bind the socket. */ |
2112 | - if (!inet->inet_num) { |
2113 | - if (sk->sk_prot->get_port(sk, 0)) { |
2114 | - release_sock(sk); |
2115 | - return -EAGAIN; |
2116 | - } |
2117 | - inet->inet_sport = htons(inet->inet_num); |
2118 | - } |
2119 | - |
2120 | /* Validate addr_len before calling common connect/connectx routine. */ |
2121 | af = sctp_get_af_specific(addr->sa_family); |
2122 | - if (!af || addr_len < af->sockaddr_len) { |
2123 | - err = -EINVAL; |
2124 | - } else { |
2125 | - /* Pass correct addr len to common routine (so it knows there |
2126 | - * is only one address being passed. |
2127 | - */ |
2128 | + if (af && addr_len >= af->sockaddr_len) |
2129 | err = __sctp_connect(sk, addr, af->sockaddr_len, flags, NULL); |
2130 | - } |
2131 | |
2132 | release_sock(sk); |
2133 | return err; |
2134 | diff --git a/net/sctp/stream.c b/net/sctp/stream.c |
2135 | index 3b47457862cc..0da57938a6c5 100644 |
2136 | --- a/net/sctp/stream.c |
2137 | +++ b/net/sctp/stream.c |
2138 | @@ -253,13 +253,20 @@ out: |
2139 | int sctp_stream_init_ext(struct sctp_stream *stream, __u16 sid) |
2140 | { |
2141 | struct sctp_stream_out_ext *soute; |
2142 | + int ret; |
2143 | |
2144 | soute = kzalloc(sizeof(*soute), GFP_KERNEL); |
2145 | if (!soute) |
2146 | return -ENOMEM; |
2147 | SCTP_SO(stream, sid)->ext = soute; |
2148 | |
2149 | - return sctp_sched_init_sid(stream, sid, GFP_KERNEL); |
2150 | + ret = sctp_sched_init_sid(stream, sid, GFP_KERNEL); |
2151 | + if (ret) { |
2152 | + kfree(SCTP_SO(stream, sid)->ext); |
2153 | + SCTP_SO(stream, sid)->ext = NULL; |
2154 | + } |
2155 | + |
2156 | + return ret; |
2157 | } |
2158 | |
2159 | void sctp_stream_free(struct sctp_stream *stream) |
2160 | diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c |
2161 | index ead29c2aefa7..0a613e0ef3bf 100644 |
2162 | --- a/net/tls/tls_device.c |
2163 | +++ b/net/tls/tls_device.c |
2164 | @@ -61,7 +61,7 @@ static void tls_device_free_ctx(struct tls_context *ctx) |
2165 | if (ctx->rx_conf == TLS_HW) |
2166 | kfree(tls_offload_ctx_rx(ctx)); |
2167 | |
2168 | - kfree(ctx); |
2169 | + tls_ctx_free(ctx); |
2170 | } |
2171 | |
2172 | static void tls_device_gc_task(struct work_struct *work) |
2173 | diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c |
2174 | index 25b3fb585777..4c0ac79f82d4 100644 |
2175 | --- a/net/tls/tls_main.c |
2176 | +++ b/net/tls/tls_main.c |
2177 | @@ -241,7 +241,7 @@ static void tls_write_space(struct sock *sk) |
2178 | ctx->sk_write_space(sk); |
2179 | } |
2180 | |
2181 | -static void tls_ctx_free(struct tls_context *ctx) |
2182 | +void tls_ctx_free(struct tls_context *ctx) |
2183 | { |
2184 | if (!ctx) |
2185 | return; |