Contents of /trunk/kernel-alx/patches-4.4/0114-4.4.15-all-fixes.patch
Parent Directory | Revision Log
Revision 2823 -
(show annotations)
(download)
Tue Sep 13 07:17:58 2016 UTC (8 years ago) by niro
File size: 40581 byte(s)
Tue Sep 13 07:17:58 2016 UTC (8 years ago) by niro
File size: 40581 byte(s)
-linux-4.4.15
1 | diff --git a/Makefile b/Makefile |
2 | index fadbb9d73c6d..979088079338 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 4 |
8 | -SUBLEVEL = 14 |
9 | +SUBLEVEL = 15 |
10 | EXTRAVERSION = |
11 | NAME = Blurry Fish Butt |
12 | |
13 | diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c |
14 | index 43fe85f20d57..7097a3395b25 100644 |
15 | --- a/crypto/crypto_user.c |
16 | +++ b/crypto/crypto_user.c |
17 | @@ -455,6 +455,7 @@ static const int crypto_msg_min[CRYPTO_NR_MSGTYPES] = { |
18 | [CRYPTO_MSG_NEWALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), |
19 | [CRYPTO_MSG_DELALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), |
20 | [CRYPTO_MSG_UPDATEALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), |
21 | + [CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), |
22 | [CRYPTO_MSG_DELRNG - CRYPTO_MSG_BASE] = 0, |
23 | }; |
24 | |
25 | diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c |
26 | index 66b1c3313e2e..cd4398498495 100644 |
27 | --- a/drivers/crypto/ux500/hash/hash_core.c |
28 | +++ b/drivers/crypto/ux500/hash/hash_core.c |
29 | @@ -797,7 +797,7 @@ static int hash_process_data(struct hash_device_data *device_data, |
30 | &device_data->state); |
31 | memmove(req_ctx->state.buffer, |
32 | device_data->state.buffer, |
33 | - HASH_BLOCK_SIZE / sizeof(u32)); |
34 | + HASH_BLOCK_SIZE); |
35 | if (ret) { |
36 | dev_err(device_data->dev, |
37 | "%s: hash_resume_state() failed!\n", |
38 | @@ -848,7 +848,7 @@ static int hash_process_data(struct hash_device_data *device_data, |
39 | |
40 | memmove(device_data->state.buffer, |
41 | req_ctx->state.buffer, |
42 | - HASH_BLOCK_SIZE / sizeof(u32)); |
43 | + HASH_BLOCK_SIZE); |
44 | if (ret) { |
45 | dev_err(device_data->dev, "%s: hash_save_state() failed!\n", |
46 | __func__); |
47 | diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c |
48 | index 0b8fe2ec5315..f3801b983f42 100644 |
49 | --- a/drivers/crypto/vmx/aes_cbc.c |
50 | +++ b/drivers/crypto/vmx/aes_cbc.c |
51 | @@ -182,7 +182,7 @@ struct crypto_alg p8_aes_cbc_alg = { |
52 | .cra_name = "cbc(aes)", |
53 | .cra_driver_name = "p8_aes_cbc", |
54 | .cra_module = THIS_MODULE, |
55 | - .cra_priority = 1000, |
56 | + .cra_priority = 2000, |
57 | .cra_type = &crypto_blkcipher_type, |
58 | .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK, |
59 | .cra_alignmask = 0, |
60 | diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c |
61 | index ee1306cd8f59..404a1b69a3ab 100644 |
62 | --- a/drivers/crypto/vmx/aes_ctr.c |
63 | +++ b/drivers/crypto/vmx/aes_ctr.c |
64 | @@ -166,7 +166,7 @@ struct crypto_alg p8_aes_ctr_alg = { |
65 | .cra_name = "ctr(aes)", |
66 | .cra_driver_name = "p8_aes_ctr", |
67 | .cra_module = THIS_MODULE, |
68 | - .cra_priority = 1000, |
69 | + .cra_priority = 2000, |
70 | .cra_type = &crypto_blkcipher_type, |
71 | .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK, |
72 | .cra_alignmask = 0, |
73 | diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c |
74 | index bd377a6b067d..df54475d163b 100644 |
75 | --- a/drivers/net/ethernet/atheros/alx/main.c |
76 | +++ b/drivers/net/ethernet/atheros/alx/main.c |
77 | @@ -86,9 +86,14 @@ static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp) |
78 | while (!cur_buf->skb && next != rxq->read_idx) { |
79 | struct alx_rfd *rfd = &rxq->rfd[cur]; |
80 | |
81 | - skb = __netdev_alloc_skb(alx->dev, alx->rxbuf_size, gfp); |
82 | + skb = __netdev_alloc_skb(alx->dev, alx->rxbuf_size + 64, gfp); |
83 | if (!skb) |
84 | break; |
85 | + |
86 | + /* Workround for the HW RX DMA overflow issue */ |
87 | + if (((unsigned long)skb->data & 0xfff) == 0xfc0) |
88 | + skb_reserve(skb, 64); |
89 | + |
90 | dma = dma_map_single(&alx->hw.pdev->dev, |
91 | skb->data, alx->rxbuf_size, |
92 | DMA_FROM_DEVICE); |
93 | diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c |
94 | index 169059c92f80..8d54e7b41bbf 100644 |
95 | --- a/drivers/net/ethernet/cadence/macb.c |
96 | +++ b/drivers/net/ethernet/cadence/macb.c |
97 | @@ -2405,9 +2405,9 @@ static int macb_init(struct platform_device *pdev) |
98 | if (bp->phy_interface == PHY_INTERFACE_MODE_RGMII) |
99 | val = GEM_BIT(RGMII); |
100 | else if (bp->phy_interface == PHY_INTERFACE_MODE_RMII && |
101 | - (bp->caps & MACB_CAPS_USRIO_DEFAULT_IS_MII)) |
102 | + (bp->caps & MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII)) |
103 | val = MACB_BIT(RMII); |
104 | - else if (!(bp->caps & MACB_CAPS_USRIO_DEFAULT_IS_MII)) |
105 | + else if (!(bp->caps & MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII)) |
106 | val = MACB_BIT(MII); |
107 | |
108 | if (bp->caps & MACB_CAPS_USRIO_HAS_CLKEN) |
109 | @@ -2738,7 +2738,7 @@ static int at91ether_init(struct platform_device *pdev) |
110 | } |
111 | |
112 | static const struct macb_config at91sam9260_config = { |
113 | - .caps = MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII, |
114 | + .caps = MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII, |
115 | .clk_init = macb_clk_init, |
116 | .init = macb_init, |
117 | }; |
118 | @@ -2751,21 +2751,22 @@ static const struct macb_config pc302gem_config = { |
119 | }; |
120 | |
121 | static const struct macb_config sama5d2_config = { |
122 | - .caps = 0, |
123 | + .caps = MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII, |
124 | .dma_burst_length = 16, |
125 | .clk_init = macb_clk_init, |
126 | .init = macb_init, |
127 | }; |
128 | |
129 | static const struct macb_config sama5d3_config = { |
130 | - .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE, |
131 | + .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE |
132 | + | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII, |
133 | .dma_burst_length = 16, |
134 | .clk_init = macb_clk_init, |
135 | .init = macb_init, |
136 | }; |
137 | |
138 | static const struct macb_config sama5d4_config = { |
139 | - .caps = 0, |
140 | + .caps = MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII, |
141 | .dma_burst_length = 4, |
142 | .clk_init = macb_clk_init, |
143 | .init = macb_init, |
144 | diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h |
145 | index d83b0db77821..3f385ab94988 100644 |
146 | --- a/drivers/net/ethernet/cadence/macb.h |
147 | +++ b/drivers/net/ethernet/cadence/macb.h |
148 | @@ -398,7 +398,7 @@ |
149 | /* Capability mask bits */ |
150 | #define MACB_CAPS_ISR_CLEAR_ON_WRITE 0x00000001 |
151 | #define MACB_CAPS_USRIO_HAS_CLKEN 0x00000002 |
152 | -#define MACB_CAPS_USRIO_DEFAULT_IS_MII 0x00000004 |
153 | +#define MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII 0x00000004 |
154 | #define MACB_CAPS_NO_GIGABIT_HALF 0x00000008 |
155 | #define MACB_CAPS_FIFO_MODE 0x10000000 |
156 | #define MACB_CAPS_GIGABIT_MODE_AVAILABLE 0x20000000 |
157 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c |
158 | index 6dc810bce295..944a6dca0fcb 100644 |
159 | --- a/drivers/usb/core/quirks.c |
160 | +++ b/drivers/usb/core/quirks.c |
161 | @@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = { |
162 | /* Creative SB Audigy 2 NX */ |
163 | { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME }, |
164 | |
165 | + /* USB3503 */ |
166 | + { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME }, |
167 | + |
168 | /* Microsoft Wireless Laser Mouse 6000 Receiver */ |
169 | { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME }, |
170 | |
171 | @@ -173,6 +176,10 @@ static const struct usb_device_id usb_quirk_list[] = { |
172 | /* MAYA44USB sound device */ |
173 | { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME }, |
174 | |
175 | + /* ASUS Base Station(T100) */ |
176 | + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = |
177 | + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, |
178 | + |
179 | /* Action Semiconductor flash disk */ |
180 | { USB_DEVICE(0x10d6, 0x2200), .driver_info = |
181 | USB_QUIRK_STRING_FETCH_255 }, |
182 | @@ -188,26 +195,22 @@ static const struct usb_device_id usb_quirk_list[] = { |
183 | { USB_DEVICE(0x1908, 0x1315), .driver_info = |
184 | USB_QUIRK_HONOR_BNUMINTERFACES }, |
185 | |
186 | - /* INTEL VALUE SSD */ |
187 | - { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, |
188 | - |
189 | - /* USB3503 */ |
190 | - { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME }, |
191 | - |
192 | - /* ASUS Base Station(T100) */ |
193 | - { USB_DEVICE(0x0b05, 0x17e0), .driver_info = |
194 | - USB_QUIRK_IGNORE_REMOTE_WAKEUP }, |
195 | - |
196 | /* Protocol and OTG Electrical Test Device */ |
197 | { USB_DEVICE(0x1a0a, 0x0200), .driver_info = |
198 | USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, |
199 | |
200 | + /* Acer C120 LED Projector */ |
201 | + { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM }, |
202 | + |
203 | /* Blackmagic Design Intensity Shuttle */ |
204 | { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM }, |
205 | |
206 | /* Blackmagic Design UltraStudio SDI */ |
207 | { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, |
208 | |
209 | + /* INTEL VALUE SSD */ |
210 | + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, |
211 | + |
212 | { } /* terminating entry must be last */ |
213 | }; |
214 | |
215 | diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c |
216 | index dd5cb5577dca..2f1fb7e7aa54 100644 |
217 | --- a/drivers/usb/dwc3/dwc3-exynos.c |
218 | +++ b/drivers/usb/dwc3/dwc3-exynos.c |
219 | @@ -128,12 +128,6 @@ static int dwc3_exynos_probe(struct platform_device *pdev) |
220 | |
221 | platform_set_drvdata(pdev, exynos); |
222 | |
223 | - ret = dwc3_exynos_register_phys(exynos); |
224 | - if (ret) { |
225 | - dev_err(dev, "couldn't register PHYs\n"); |
226 | - return ret; |
227 | - } |
228 | - |
229 | exynos->dev = dev; |
230 | |
231 | exynos->clk = devm_clk_get(dev, "usbdrd30"); |
232 | @@ -183,20 +177,29 @@ static int dwc3_exynos_probe(struct platform_device *pdev) |
233 | goto err3; |
234 | } |
235 | |
236 | + ret = dwc3_exynos_register_phys(exynos); |
237 | + if (ret) { |
238 | + dev_err(dev, "couldn't register PHYs\n"); |
239 | + goto err4; |
240 | + } |
241 | + |
242 | if (node) { |
243 | ret = of_platform_populate(node, NULL, NULL, dev); |
244 | if (ret) { |
245 | dev_err(dev, "failed to add dwc3 core\n"); |
246 | - goto err4; |
247 | + goto err5; |
248 | } |
249 | } else { |
250 | dev_err(dev, "no device node, failed to add dwc3 core\n"); |
251 | ret = -ENODEV; |
252 | - goto err4; |
253 | + goto err5; |
254 | } |
255 | |
256 | return 0; |
257 | |
258 | +err5: |
259 | + platform_device_unregister(exynos->usb2_phy); |
260 | + platform_device_unregister(exynos->usb3_phy); |
261 | err4: |
262 | regulator_disable(exynos->vdd10); |
263 | err3: |
264 | diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c |
265 | index f454c7af489c..55386619a0f1 100644 |
266 | --- a/drivers/usb/gadget/legacy/inode.c |
267 | +++ b/drivers/usb/gadget/legacy/inode.c |
268 | @@ -937,8 +937,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) |
269 | struct usb_ep *ep = dev->gadget->ep0; |
270 | struct usb_request *req = dev->req; |
271 | |
272 | - if ((retval = setup_req (ep, req, 0)) == 0) |
273 | - retval = usb_ep_queue (ep, req, GFP_ATOMIC); |
274 | + if ((retval = setup_req (ep, req, 0)) == 0) { |
275 | + spin_unlock_irq (&dev->lock); |
276 | + retval = usb_ep_queue (ep, req, GFP_KERNEL); |
277 | + spin_lock_irq (&dev->lock); |
278 | + } |
279 | dev->state = STATE_DEV_CONNECTED; |
280 | |
281 | /* assume that was SET_CONFIGURATION */ |
282 | @@ -1456,8 +1459,11 @@ delegate: |
283 | w_length); |
284 | if (value < 0) |
285 | break; |
286 | + |
287 | + spin_unlock (&dev->lock); |
288 | value = usb_ep_queue (gadget->ep0, dev->req, |
289 | - GFP_ATOMIC); |
290 | + GFP_KERNEL); |
291 | + spin_lock (&dev->lock); |
292 | if (value < 0) { |
293 | clean_req (gadget->ep0, dev->req); |
294 | break; |
295 | @@ -1480,11 +1486,14 @@ delegate: |
296 | if (value >= 0 && dev->state != STATE_DEV_SETUP) { |
297 | req->length = value; |
298 | req->zero = value < w_length; |
299 | - value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC); |
300 | + |
301 | + spin_unlock (&dev->lock); |
302 | + value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); |
303 | if (value < 0) { |
304 | DBG (dev, "ep_queue --> %d\n", value); |
305 | req->status = 0; |
306 | } |
307 | + return value; |
308 | } |
309 | |
310 | /* device stalls when value < 0 */ |
311 | diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c |
312 | index 4031b372008e..c1c1024a054c 100644 |
313 | --- a/drivers/usb/host/ehci-tegra.c |
314 | +++ b/drivers/usb/host/ehci-tegra.c |
315 | @@ -89,7 +89,7 @@ static int tegra_reset_usb_controller(struct platform_device *pdev) |
316 | if (!usb1_reset_attempted) { |
317 | struct reset_control *usb1_reset; |
318 | |
319 | - usb1_reset = of_reset_control_get(phy_np, "usb"); |
320 | + usb1_reset = of_reset_control_get(phy_np, "utmi-pads"); |
321 | if (IS_ERR(usb1_reset)) { |
322 | dev_warn(&pdev->dev, |
323 | "can't get utmi-pads reset from the PHY\n"); |
324 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c |
325 | index ea4fb4b0cd44..de644e56aa3b 100644 |
326 | --- a/drivers/usb/host/xhci-pci.c |
327 | +++ b/drivers/usb/host/xhci-pci.c |
328 | @@ -37,6 +37,7 @@ |
329 | /* Device for a quirk */ |
330 | #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 |
331 | #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000 |
332 | +#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009 |
333 | #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400 |
334 | |
335 | #define PCI_VENDOR_ID_ETRON 0x1b6f |
336 | @@ -115,6 +116,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
337 | xhci->quirks |= XHCI_TRUST_TX_LENGTH; |
338 | } |
339 | |
340 | + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && |
341 | + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009) |
342 | + xhci->quirks |= XHCI_BROKEN_STREAMS; |
343 | + |
344 | if (pdev->vendor == PCI_VENDOR_ID_NEC) |
345 | xhci->quirks |= XHCI_NEC_HOST; |
346 | |
347 | diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c |
348 | index 05647e6753cd..4fe7c9b56bc0 100644 |
349 | --- a/drivers/usb/host/xhci-plat.c |
350 | +++ b/drivers/usb/host/xhci-plat.c |
351 | @@ -132,6 +132,9 @@ static int xhci_plat_probe(struct platform_device *pdev) |
352 | ret = clk_prepare_enable(clk); |
353 | if (ret) |
354 | goto put_hcd; |
355 | + } else if (PTR_ERR(clk) == -EPROBE_DEFER) { |
356 | + ret = -EPROBE_DEFER; |
357 | + goto put_hcd; |
358 | } |
359 | |
360 | if (of_device_is_compatible(pdev->dev.of_node, |
361 | diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c |
362 | index 2b63969c2bbf..34cd23724bed 100644 |
363 | --- a/drivers/usb/host/xhci-ring.c |
364 | +++ b/drivers/usb/host/xhci-ring.c |
365 | @@ -289,6 +289,14 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci) |
366 | |
367 | temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring); |
368 | xhci->cmd_ring_state = CMD_RING_STATE_ABORTED; |
369 | + |
370 | + /* |
371 | + * Writing the CMD_RING_ABORT bit should cause a cmd completion event, |
372 | + * however on some host hw the CMD_RING_RUNNING bit is correctly cleared |
373 | + * but the completion event in never sent. Use the cmd timeout timer to |
374 | + * handle those cases. Use twice the time to cover the bit polling retry |
375 | + */ |
376 | + mod_timer(&xhci->cmd_timer, jiffies + (2 * XHCI_CMD_DEFAULT_TIMEOUT)); |
377 | xhci_write_64(xhci, temp_64 | CMD_RING_ABORT, |
378 | &xhci->op_regs->cmd_ring); |
379 | |
380 | @@ -313,6 +321,7 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci) |
381 | |
382 | xhci_err(xhci, "Stopped the command ring failed, " |
383 | "maybe the host is dead\n"); |
384 | + del_timer(&xhci->cmd_timer); |
385 | xhci->xhc_state |= XHCI_STATE_DYING; |
386 | xhci_quiesce(xhci); |
387 | xhci_halt(xhci); |
388 | @@ -1252,22 +1261,21 @@ void xhci_handle_command_timeout(unsigned long data) |
389 | int ret; |
390 | unsigned long flags; |
391 | u64 hw_ring_state; |
392 | - struct xhci_command *cur_cmd = NULL; |
393 | + bool second_timeout = false; |
394 | xhci = (struct xhci_hcd *) data; |
395 | |
396 | /* mark this command to be cancelled */ |
397 | spin_lock_irqsave(&xhci->lock, flags); |
398 | if (xhci->current_cmd) { |
399 | - cur_cmd = xhci->current_cmd; |
400 | - cur_cmd->status = COMP_CMD_ABORT; |
401 | + if (xhci->current_cmd->status == COMP_CMD_ABORT) |
402 | + second_timeout = true; |
403 | + xhci->current_cmd->status = COMP_CMD_ABORT; |
404 | } |
405 | |
406 | - |
407 | /* Make sure command ring is running before aborting it */ |
408 | hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring); |
409 | if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) && |
410 | (hw_ring_state & CMD_RING_RUNNING)) { |
411 | - |
412 | spin_unlock_irqrestore(&xhci->lock, flags); |
413 | xhci_dbg(xhci, "Command timeout\n"); |
414 | ret = xhci_abort_cmd_ring(xhci); |
415 | @@ -1279,6 +1287,15 @@ void xhci_handle_command_timeout(unsigned long data) |
416 | } |
417 | return; |
418 | } |
419 | + |
420 | + /* command ring failed to restart, or host removed. Bail out */ |
421 | + if (second_timeout || xhci->xhc_state & XHCI_STATE_REMOVING) { |
422 | + spin_unlock_irqrestore(&xhci->lock, flags); |
423 | + xhci_dbg(xhci, "command timed out twice, ring start fail?\n"); |
424 | + xhci_cleanup_command_queue(xhci); |
425 | + return; |
426 | + } |
427 | + |
428 | /* command timeout on stopped ring, ring can't be aborted */ |
429 | xhci_dbg(xhci, "Command timeout on stopped ring\n"); |
430 | xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd); |
431 | @@ -2727,7 +2744,8 @@ hw_died: |
432 | writel(irq_pending, &xhci->ir_set->irq_pending); |
433 | } |
434 | |
435 | - if (xhci->xhc_state & XHCI_STATE_DYING) { |
436 | + if (xhci->xhc_state & XHCI_STATE_DYING || |
437 | + xhci->xhc_state & XHCI_STATE_HALTED) { |
438 | xhci_dbg(xhci, "xHCI dying, ignoring interrupt. " |
439 | "Shouldn't IRQs be disabled?\n"); |
440 | /* Clear the event handler busy flag (RW1C); |
441 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c |
442 | index ec9e758d5fcd..6fe0174da226 100644 |
443 | --- a/drivers/usb/host/xhci.c |
444 | +++ b/drivers/usb/host/xhci.c |
445 | @@ -680,20 +680,23 @@ void xhci_stop(struct usb_hcd *hcd) |
446 | u32 temp; |
447 | struct xhci_hcd *xhci = hcd_to_xhci(hcd); |
448 | |
449 | - if (xhci->xhc_state & XHCI_STATE_HALTED) |
450 | - return; |
451 | - |
452 | mutex_lock(&xhci->mutex); |
453 | - spin_lock_irq(&xhci->lock); |
454 | - xhci->xhc_state |= XHCI_STATE_HALTED; |
455 | - xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; |
456 | |
457 | - /* Make sure the xHC is halted for a USB3 roothub |
458 | - * (xhci_stop() could be called as part of failed init). |
459 | - */ |
460 | - xhci_halt(xhci); |
461 | - xhci_reset(xhci); |
462 | - spin_unlock_irq(&xhci->lock); |
463 | + if (!(xhci->xhc_state & XHCI_STATE_HALTED)) { |
464 | + spin_lock_irq(&xhci->lock); |
465 | + |
466 | + xhci->xhc_state |= XHCI_STATE_HALTED; |
467 | + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; |
468 | + xhci_halt(xhci); |
469 | + xhci_reset(xhci); |
470 | + |
471 | + spin_unlock_irq(&xhci->lock); |
472 | + } |
473 | + |
474 | + if (!usb_hcd_is_primary_hcd(hcd)) { |
475 | + mutex_unlock(&xhci->mutex); |
476 | + return; |
477 | + } |
478 | |
479 | xhci_cleanup_msix(xhci); |
480 | |
481 | diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c |
482 | index ee9ff7028b92..00eed5d66fda 100644 |
483 | --- a/drivers/usb/musb/musb_core.c |
484 | +++ b/drivers/usb/musb/musb_core.c |
485 | @@ -2401,7 +2401,8 @@ static void musb_restore_context(struct musb *musb) |
486 | musb_writew(musb_base, MUSB_INTRTXE, musb->intrtxe); |
487 | musb_writew(musb_base, MUSB_INTRRXE, musb->intrrxe); |
488 | musb_writeb(musb_base, MUSB_INTRUSBE, musb->context.intrusbe); |
489 | - musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl); |
490 | + if (musb->context.devctl & MUSB_DEVCTL_SESSION) |
491 | + musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl); |
492 | |
493 | for (i = 0; i < musb->config->num_eps; ++i) { |
494 | struct musb_hw_ep *hw_ep; |
495 | diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c |
496 | index 795a45b1b25b..59a63a0b7985 100644 |
497 | --- a/drivers/usb/musb/musb_host.c |
498 | +++ b/drivers/usb/musb/musb_host.c |
499 | @@ -594,14 +594,13 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, u8 epnum) |
500 | musb_writew(ep->regs, MUSB_TXCSR, 0); |
501 | |
502 | /* scrub all previous state, clearing toggle */ |
503 | - } else { |
504 | - csr = musb_readw(ep->regs, MUSB_RXCSR); |
505 | - if (csr & MUSB_RXCSR_RXPKTRDY) |
506 | - WARNING("rx%d, packet/%d ready?\n", ep->epnum, |
507 | - musb_readw(ep->regs, MUSB_RXCOUNT)); |
508 | - |
509 | - musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG); |
510 | } |
511 | + csr = musb_readw(ep->regs, MUSB_RXCSR); |
512 | + if (csr & MUSB_RXCSR_RXPKTRDY) |
513 | + WARNING("rx%d, packet/%d ready?\n", ep->epnum, |
514 | + musb_readw(ep->regs, MUSB_RXCOUNT)); |
515 | + |
516 | + musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG); |
517 | |
518 | /* target addr and (for multipoint) hub addr/port */ |
519 | if (musb->is_multipoint) { |
520 | @@ -995,9 +994,15 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep, |
521 | if (is_in) { |
522 | dma = is_dma_capable() ? ep->rx_channel : NULL; |
523 | |
524 | - /* clear nak timeout bit */ |
525 | + /* |
526 | + * Need to stop the transaction by clearing REQPKT first |
527 | + * then the NAK Timeout bit ref MUSBMHDRC USB 2.0 HIGH-SPEED |
528 | + * DUAL-ROLE CONTROLLER Programmer's Guide, section 9.2.2 |
529 | + */ |
530 | rx_csr = musb_readw(epio, MUSB_RXCSR); |
531 | rx_csr |= MUSB_RXCSR_H_WZC_BITS; |
532 | + rx_csr &= ~MUSB_RXCSR_H_REQPKT; |
533 | + musb_writew(epio, MUSB_RXCSR, rx_csr); |
534 | rx_csr &= ~MUSB_RXCSR_DATAERROR; |
535 | musb_writew(epio, MUSB_RXCSR, rx_csr); |
536 | |
537 | @@ -1551,7 +1556,7 @@ static int musb_rx_dma_iso_cppi41(struct dma_controller *dma, |
538 | struct urb *urb, |
539 | size_t len) |
540 | { |
541 | - struct dma_channel *channel = hw_ep->tx_channel; |
542 | + struct dma_channel *channel = hw_ep->rx_channel; |
543 | void __iomem *epio = hw_ep->regs; |
544 | dma_addr_t *buf; |
545 | u32 length, res; |
546 | diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c |
547 | index 78b4f64c6b00..06c7dbc1c802 100644 |
548 | --- a/drivers/usb/serial/mos7720.c |
549 | +++ b/drivers/usb/serial/mos7720.c |
550 | @@ -2007,6 +2007,7 @@ static void mos7720_release(struct usb_serial *serial) |
551 | urblist_entry) |
552 | usb_unlink_urb(urbtrack->urb); |
553 | spin_unlock_irqrestore(&mos_parport->listlock, flags); |
554 | + parport_del_port(mos_parport->pp); |
555 | |
556 | kref_put(&mos_parport->ref_count, destroy_mos_parport); |
557 | } |
558 | diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c |
559 | index 9baf081174ce..e26e32169a36 100644 |
560 | --- a/drivers/usb/storage/uas.c |
561 | +++ b/drivers/usb/storage/uas.c |
562 | @@ -811,6 +811,7 @@ static int uas_slave_configure(struct scsi_device *sdev) |
563 | if (devinfo->flags & US_FL_BROKEN_FUA) |
564 | sdev->broken_fua = 1; |
565 | |
566 | + scsi_change_queue_depth(sdev, devinfo->qdepth - 2); |
567 | return 0; |
568 | } |
569 | |
570 | diff --git a/include/linux/bpf.h b/include/linux/bpf.h |
571 | index 67bc2da5d233..4f6d29c8e3d8 100644 |
572 | --- a/include/linux/bpf.h |
573 | +++ b/include/linux/bpf.h |
574 | @@ -198,6 +198,10 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd) |
575 | static inline void bpf_prog_put(struct bpf_prog *prog) |
576 | { |
577 | } |
578 | + |
579 | +static inline void bpf_prog_put_rcu(struct bpf_prog *prog) |
580 | +{ |
581 | +} |
582 | #endif /* CONFIG_BPF_SYSCALL */ |
583 | |
584 | /* verifier prototypes for helper functions called from eBPF programs */ |
585 | diff --git a/include/linux/net.h b/include/linux/net.h |
586 | index 25ef630f1bd6..c00b8d182226 100644 |
587 | --- a/include/linux/net.h |
588 | +++ b/include/linux/net.h |
589 | @@ -251,7 +251,8 @@ do { \ |
590 | DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \ |
591 | if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) && \ |
592 | net_ratelimit()) \ |
593 | - __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__); \ |
594 | + __dynamic_pr_debug(&descriptor, pr_fmt(fmt), \ |
595 | + ##__VA_ARGS__); \ |
596 | } while (0) |
597 | #elif defined(DEBUG) |
598 | #define net_dbg_ratelimited(fmt, ...) \ |
599 | diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h |
600 | index 4fde61804191..1716f9395010 100644 |
601 | --- a/include/linux/skbuff.h |
602 | +++ b/include/linux/skbuff.h |
603 | @@ -2564,6 +2564,13 @@ static inline int skb_clone_writable(const struct sk_buff *skb, unsigned int len |
604 | skb_headroom(skb) + len <= skb->hdr_len; |
605 | } |
606 | |
607 | +static inline int skb_try_make_writable(struct sk_buff *skb, |
608 | + unsigned int write_len) |
609 | +{ |
610 | + return skb_cloned(skb) && !skb_clone_writable(skb, write_len) && |
611 | + pskb_expand_head(skb, 0, 0, GFP_ATOMIC); |
612 | +} |
613 | + |
614 | static inline int __skb_cow(struct sk_buff *skb, unsigned int headroom, |
615 | int cloned) |
616 | { |
617 | diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h |
618 | index fddebc617469..8ff34ed1ae8a 100644 |
619 | --- a/include/linux/sock_diag.h |
620 | +++ b/include/linux/sock_diag.h |
621 | @@ -35,6 +35,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk) |
622 | { |
623 | switch (sk->sk_family) { |
624 | case AF_INET: |
625 | + if (sk->sk_type == SOCK_RAW) |
626 | + return SKNLGRP_NONE; |
627 | + |
628 | switch (sk->sk_protocol) { |
629 | case IPPROTO_TCP: |
630 | return SKNLGRP_INET_TCP_DESTROY; |
631 | @@ -44,6 +47,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk) |
632 | return SKNLGRP_NONE; |
633 | } |
634 | case AF_INET6: |
635 | + if (sk->sk_type == SOCK_RAW) |
636 | + return SKNLGRP_NONE; |
637 | + |
638 | switch (sk->sk_protocol) { |
639 | case IPPROTO_TCP: |
640 | return SKNLGRP_INET6_TCP_DESTROY; |
641 | diff --git a/kernel/events/core.c b/kernel/events/core.c |
642 | index 95e47d2f2c67..12ecd4f0329f 100644 |
643 | --- a/kernel/events/core.c |
644 | +++ b/kernel/events/core.c |
645 | @@ -7101,7 +7101,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) |
646 | prog = event->tp_event->prog; |
647 | if (prog) { |
648 | event->tp_event->prog = NULL; |
649 | - bpf_prog_put(prog); |
650 | + bpf_prog_put_rcu(prog); |
651 | } |
652 | } |
653 | |
654 | diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c |
655 | index fbd0acf80b13..2fdebabbfacd 100644 |
656 | --- a/net/ax25/af_ax25.c |
657 | +++ b/net/ax25/af_ax25.c |
658 | @@ -976,7 +976,8 @@ static int ax25_release(struct socket *sock) |
659 | release_sock(sk); |
660 | ax25_disconnect(ax25, 0); |
661 | lock_sock(sk); |
662 | - ax25_destroy_socket(ax25); |
663 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) |
664 | + ax25_destroy_socket(ax25); |
665 | break; |
666 | |
667 | case AX25_STATE_3: |
668 | diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c |
669 | index 951cd57bb07d..5237dff6941d 100644 |
670 | --- a/net/ax25/ax25_ds_timer.c |
671 | +++ b/net/ax25/ax25_ds_timer.c |
672 | @@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25) |
673 | switch (ax25->state) { |
674 | |
675 | case AX25_STATE_0: |
676 | + case AX25_STATE_2: |
677 | /* Magic here: If we listen() and a new link dies before it |
678 | is accepted() it isn't 'dead' so doesn't get removed. */ |
679 | if (!sk || sock_flag(sk, SOCK_DESTROY) || |
680 | @@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25) |
681 | sock_hold(sk); |
682 | ax25_destroy_socket(ax25); |
683 | bh_unlock_sock(sk); |
684 | + /* Ungrab socket and destroy it */ |
685 | sock_put(sk); |
686 | } else |
687 | ax25_destroy_socket(ax25); |
688 | @@ -213,7 +215,8 @@ void ax25_ds_t1_timeout(ax25_cb *ax25) |
689 | case AX25_STATE_2: |
690 | if (ax25->n2count == ax25->n2) { |
691 | ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND); |
692 | - ax25_disconnect(ax25, ETIMEDOUT); |
693 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) |
694 | + ax25_disconnect(ax25, ETIMEDOUT); |
695 | return; |
696 | } else { |
697 | ax25->n2count++; |
698 | diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c |
699 | index 004467c9e6e1..2c0d6ef66f9d 100644 |
700 | --- a/net/ax25/ax25_std_timer.c |
701 | +++ b/net/ax25/ax25_std_timer.c |
702 | @@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25) |
703 | |
704 | switch (ax25->state) { |
705 | case AX25_STATE_0: |
706 | + case AX25_STATE_2: |
707 | /* Magic here: If we listen() and a new link dies before it |
708 | is accepted() it isn't 'dead' so doesn't get removed. */ |
709 | if (!sk || sock_flag(sk, SOCK_DESTROY) || |
710 | @@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25) |
711 | sock_hold(sk); |
712 | ax25_destroy_socket(ax25); |
713 | bh_unlock_sock(sk); |
714 | + /* Ungrab socket and destroy it */ |
715 | sock_put(sk); |
716 | } else |
717 | ax25_destroy_socket(ax25); |
718 | @@ -144,7 +146,8 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25) |
719 | case AX25_STATE_2: |
720 | if (ax25->n2count == ax25->n2) { |
721 | ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND); |
722 | - ax25_disconnect(ax25, ETIMEDOUT); |
723 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) |
724 | + ax25_disconnect(ax25, ETIMEDOUT); |
725 | return; |
726 | } else { |
727 | ax25->n2count++; |
728 | diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c |
729 | index 3b78e8473a01..655a7d4c96e1 100644 |
730 | --- a/net/ax25/ax25_subr.c |
731 | +++ b/net/ax25/ax25_subr.c |
732 | @@ -264,7 +264,8 @@ void ax25_disconnect(ax25_cb *ax25, int reason) |
733 | { |
734 | ax25_clear_queues(ax25); |
735 | |
736 | - ax25_stop_heartbeat(ax25); |
737 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) |
738 | + ax25_stop_heartbeat(ax25); |
739 | ax25_stop_t1timer(ax25); |
740 | ax25_stop_t2timer(ax25); |
741 | ax25_stop_t3timer(ax25); |
742 | diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c |
743 | index ea9893743a0f..7173a685309a 100644 |
744 | --- a/net/bridge/br_multicast.c |
745 | +++ b/net/bridge/br_multicast.c |
746 | @@ -464,8 +464,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br, |
747 | if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, |
748 | &ip6h->saddr)) { |
749 | kfree_skb(skb); |
750 | + br->has_ipv6_addr = 0; |
751 | return NULL; |
752 | } |
753 | + |
754 | + br->has_ipv6_addr = 1; |
755 | ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); |
756 | |
757 | hopopt = (u8 *)(ip6h + 1); |
758 | @@ -1736,6 +1739,7 @@ void br_multicast_init(struct net_bridge *br) |
759 | br->ip6_other_query.delay_time = 0; |
760 | br->ip6_querier.port = NULL; |
761 | #endif |
762 | + br->has_ipv6_addr = 1; |
763 | |
764 | spin_lock_init(&br->multicast_lock); |
765 | setup_timer(&br->multicast_router_timer, |
766 | diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h |
767 | index 216018c76018..1001a1b7df9b 100644 |
768 | --- a/net/bridge/br_private.h |
769 | +++ b/net/bridge/br_private.h |
770 | @@ -301,6 +301,7 @@ struct net_bridge |
771 | u8 multicast_disabled:1; |
772 | u8 multicast_querier:1; |
773 | u8 multicast_query_use_ifaddr:1; |
774 | + u8 has_ipv6_addr:1; |
775 | |
776 | u32 hash_elasticity; |
777 | u32 hash_max; |
778 | @@ -574,10 +575,22 @@ static inline bool br_multicast_is_router(struct net_bridge *br) |
779 | |
780 | static inline bool |
781 | __br_multicast_querier_exists(struct net_bridge *br, |
782 | - struct bridge_mcast_other_query *querier) |
783 | + struct bridge_mcast_other_query *querier, |
784 | + const bool is_ipv6) |
785 | { |
786 | + bool own_querier_enabled; |
787 | + |
788 | + if (br->multicast_querier) { |
789 | + if (is_ipv6 && !br->has_ipv6_addr) |
790 | + own_querier_enabled = false; |
791 | + else |
792 | + own_querier_enabled = true; |
793 | + } else { |
794 | + own_querier_enabled = false; |
795 | + } |
796 | + |
797 | return time_is_before_jiffies(querier->delay_time) && |
798 | - (br->multicast_querier || timer_pending(&querier->timer)); |
799 | + (own_querier_enabled || timer_pending(&querier->timer)); |
800 | } |
801 | |
802 | static inline bool br_multicast_querier_exists(struct net_bridge *br, |
803 | @@ -585,10 +598,12 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br, |
804 | { |
805 | switch (eth->h_proto) { |
806 | case (htons(ETH_P_IP)): |
807 | - return __br_multicast_querier_exists(br, &br->ip4_other_query); |
808 | + return __br_multicast_querier_exists(br, |
809 | + &br->ip4_other_query, false); |
810 | #if IS_ENABLED(CONFIG_IPV6) |
811 | case (htons(ETH_P_IPV6)): |
812 | - return __br_multicast_querier_exists(br, &br->ip6_other_query); |
813 | + return __br_multicast_querier_exists(br, |
814 | + &br->ip6_other_query, true); |
815 | #endif |
816 | default: |
817 | return false; |
818 | diff --git a/net/core/filter.c b/net/core/filter.c |
819 | index f393a22b9d50..75e9b2b2336d 100644 |
820 | --- a/net/core/filter.c |
821 | +++ b/net/core/filter.c |
822 | @@ -1275,9 +1275,7 @@ static u64 bpf_skb_store_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 flags) |
823 | */ |
824 | if (unlikely((u32) offset > 0xffff || len > sizeof(buf))) |
825 | return -EFAULT; |
826 | - |
827 | - if (unlikely(skb_cloned(skb) && |
828 | - !skb_clone_writable(skb, offset + len))) |
829 | + if (unlikely(skb_try_make_writable(skb, offset + len))) |
830 | return -EFAULT; |
831 | |
832 | ptr = skb_header_pointer(skb, offset, len, buf); |
833 | @@ -1321,8 +1319,7 @@ static u64 bpf_l3_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags) |
834 | if (unlikely((u32) offset > 0xffff)) |
835 | return -EFAULT; |
836 | |
837 | - if (unlikely(skb_cloned(skb) && |
838 | - !skb_clone_writable(skb, offset + sizeof(sum)))) |
839 | + if (unlikely(skb_try_make_writable(skb, offset + sizeof(sum)))) |
840 | return -EFAULT; |
841 | |
842 | ptr = skb_header_pointer(skb, offset, sizeof(sum), &sum); |
843 | @@ -1367,9 +1364,7 @@ static u64 bpf_l4_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags) |
844 | |
845 | if (unlikely((u32) offset > 0xffff)) |
846 | return -EFAULT; |
847 | - |
848 | - if (unlikely(skb_cloned(skb) && |
849 | - !skb_clone_writable(skb, offset + sizeof(sum)))) |
850 | + if (unlikely(skb_try_make_writable(skb, offset + sizeof(sum)))) |
851 | return -EFAULT; |
852 | |
853 | ptr = skb_header_pointer(skb, offset, sizeof(sum), &sum); |
854 | @@ -1554,6 +1549,13 @@ bool bpf_helper_changes_skb_data(void *func) |
855 | return true; |
856 | if (func == bpf_skb_vlan_pop) |
857 | return true; |
858 | + if (func == bpf_skb_store_bytes) |
859 | + return true; |
860 | + if (func == bpf_l3_csum_replace) |
861 | + return true; |
862 | + if (func == bpf_l4_csum_replace) |
863 | + return true; |
864 | + |
865 | return false; |
866 | } |
867 | |
868 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c |
869 | index f18ae91b652e..769cece9b00b 100644 |
870 | --- a/net/core/neighbour.c |
871 | +++ b/net/core/neighbour.c |
872 | @@ -2467,13 +2467,17 @@ int neigh_xmit(int index, struct net_device *dev, |
873 | tbl = neigh_tables[index]; |
874 | if (!tbl) |
875 | goto out; |
876 | + rcu_read_lock_bh(); |
877 | neigh = __neigh_lookup_noref(tbl, addr, dev); |
878 | if (!neigh) |
879 | neigh = __neigh_create(tbl, addr, dev, false); |
880 | err = PTR_ERR(neigh); |
881 | - if (IS_ERR(neigh)) |
882 | + if (IS_ERR(neigh)) { |
883 | + rcu_read_unlock_bh(); |
884 | goto out_kfree_skb; |
885 | + } |
886 | err = neigh->output(neigh, skb); |
887 | + rcu_read_unlock_bh(); |
888 | } |
889 | else if (index == NEIGH_LINK_TABLE) { |
890 | err = dev_hard_header(skb, dev, ntohs(skb->protocol), |
891 | diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c |
892 | index 477937465a20..d95631d09248 100644 |
893 | --- a/net/ipv4/esp4.c |
894 | +++ b/net/ipv4/esp4.c |
895 | @@ -23,6 +23,11 @@ struct esp_skb_cb { |
896 | void *tmp; |
897 | }; |
898 | |
899 | +struct esp_output_extra { |
900 | + __be32 seqhi; |
901 | + u32 esphoff; |
902 | +}; |
903 | + |
904 | #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0])) |
905 | |
906 | static u32 esp4_get_mtu(struct xfrm_state *x, int mtu); |
907 | @@ -35,11 +40,11 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu); |
908 | * |
909 | * TODO: Use spare space in skb for this where possible. |
910 | */ |
911 | -static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen) |
912 | +static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int extralen) |
913 | { |
914 | unsigned int len; |
915 | |
916 | - len = seqhilen; |
917 | + len = extralen; |
918 | |
919 | len += crypto_aead_ivsize(aead); |
920 | |
921 | @@ -57,15 +62,16 @@ static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen) |
922 | return kmalloc(len, GFP_ATOMIC); |
923 | } |
924 | |
925 | -static inline __be32 *esp_tmp_seqhi(void *tmp) |
926 | +static inline void *esp_tmp_extra(void *tmp) |
927 | { |
928 | - return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32)); |
929 | + return PTR_ALIGN(tmp, __alignof__(struct esp_output_extra)); |
930 | } |
931 | -static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen) |
932 | + |
933 | +static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int extralen) |
934 | { |
935 | return crypto_aead_ivsize(aead) ? |
936 | - PTR_ALIGN((u8 *)tmp + seqhilen, |
937 | - crypto_aead_alignmask(aead) + 1) : tmp + seqhilen; |
938 | + PTR_ALIGN((u8 *)tmp + extralen, |
939 | + crypto_aead_alignmask(aead) + 1) : tmp + extralen; |
940 | } |
941 | |
942 | static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv) |
943 | @@ -99,7 +105,7 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset) |
944 | { |
945 | struct ip_esp_hdr *esph = (void *)(skb->data + offset); |
946 | void *tmp = ESP_SKB_CB(skb)->tmp; |
947 | - __be32 *seqhi = esp_tmp_seqhi(tmp); |
948 | + __be32 *seqhi = esp_tmp_extra(tmp); |
949 | |
950 | esph->seq_no = esph->spi; |
951 | esph->spi = *seqhi; |
952 | @@ -107,7 +113,11 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset) |
953 | |
954 | static void esp_output_restore_header(struct sk_buff *skb) |
955 | { |
956 | - esp_restore_header(skb, skb_transport_offset(skb) - sizeof(__be32)); |
957 | + void *tmp = ESP_SKB_CB(skb)->tmp; |
958 | + struct esp_output_extra *extra = esp_tmp_extra(tmp); |
959 | + |
960 | + esp_restore_header(skb, skb_transport_offset(skb) + extra->esphoff - |
961 | + sizeof(__be32)); |
962 | } |
963 | |
964 | static void esp_output_done_esn(struct crypto_async_request *base, int err) |
965 | @@ -121,6 +131,7 @@ static void esp_output_done_esn(struct crypto_async_request *base, int err) |
966 | static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
967 | { |
968 | int err; |
969 | + struct esp_output_extra *extra; |
970 | struct ip_esp_hdr *esph; |
971 | struct crypto_aead *aead; |
972 | struct aead_request *req; |
973 | @@ -137,8 +148,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
974 | int tfclen; |
975 | int nfrags; |
976 | int assoclen; |
977 | - int seqhilen; |
978 | - __be32 *seqhi; |
979 | + int extralen; |
980 | __be64 seqno; |
981 | |
982 | /* skb is pure payload to encrypt */ |
983 | @@ -166,21 +176,21 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
984 | nfrags = err; |
985 | |
986 | assoclen = sizeof(*esph); |
987 | - seqhilen = 0; |
988 | + extralen = 0; |
989 | |
990 | if (x->props.flags & XFRM_STATE_ESN) { |
991 | - seqhilen += sizeof(__be32); |
992 | - assoclen += seqhilen; |
993 | + extralen += sizeof(*extra); |
994 | + assoclen += sizeof(__be32); |
995 | } |
996 | |
997 | - tmp = esp_alloc_tmp(aead, nfrags, seqhilen); |
998 | + tmp = esp_alloc_tmp(aead, nfrags, extralen); |
999 | if (!tmp) { |
1000 | err = -ENOMEM; |
1001 | goto error; |
1002 | } |
1003 | |
1004 | - seqhi = esp_tmp_seqhi(tmp); |
1005 | - iv = esp_tmp_iv(aead, tmp, seqhilen); |
1006 | + extra = esp_tmp_extra(tmp); |
1007 | + iv = esp_tmp_iv(aead, tmp, extralen); |
1008 | req = esp_tmp_req(aead, iv); |
1009 | sg = esp_req_sg(aead, req); |
1010 | |
1011 | @@ -247,8 +257,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
1012 | * encryption. |
1013 | */ |
1014 | if ((x->props.flags & XFRM_STATE_ESN)) { |
1015 | - esph = (void *)(skb_transport_header(skb) - sizeof(__be32)); |
1016 | - *seqhi = esph->spi; |
1017 | + extra->esphoff = (unsigned char *)esph - |
1018 | + skb_transport_header(skb); |
1019 | + esph = (struct ip_esp_hdr *)((unsigned char *)esph - 4); |
1020 | + extra->seqhi = esph->spi; |
1021 | esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.hi); |
1022 | aead_request_set_callback(req, 0, esp_output_done_esn, skb); |
1023 | } |
1024 | @@ -445,7 +457,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) |
1025 | goto out; |
1026 | |
1027 | ESP_SKB_CB(skb)->tmp = tmp; |
1028 | - seqhi = esp_tmp_seqhi(tmp); |
1029 | + seqhi = esp_tmp_extra(tmp); |
1030 | iv = esp_tmp_iv(aead, tmp, seqhilen); |
1031 | req = esp_tmp_req(aead, iv); |
1032 | sg = esp_req_sg(aead, req); |
1033 | diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c |
1034 | index c3a38353f5dc..9d1e555496e3 100644 |
1035 | --- a/net/ipv4/ipmr.c |
1036 | +++ b/net/ipv4/ipmr.c |
1037 | @@ -882,8 +882,10 @@ static struct mfc_cache *ipmr_cache_alloc(void) |
1038 | { |
1039 | struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL); |
1040 | |
1041 | - if (c) |
1042 | + if (c) { |
1043 | + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1; |
1044 | c->mfc_un.res.minvif = MAXVIFS; |
1045 | + } |
1046 | return c; |
1047 | } |
1048 | |
1049 | diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c |
1050 | index a10e77103c88..e207cb2468da 100644 |
1051 | --- a/net/ipv6/ip6mr.c |
1052 | +++ b/net/ipv6/ip6mr.c |
1053 | @@ -1074,6 +1074,7 @@ static struct mfc6_cache *ip6mr_cache_alloc(void) |
1054 | struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL); |
1055 | if (!c) |
1056 | return NULL; |
1057 | + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1; |
1058 | c->mfc_un.res.minvif = MAXMIFS; |
1059 | return c; |
1060 | } |
1061 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c |
1062 | index dcccae86190f..ba3d2f3d66d2 100644 |
1063 | --- a/net/ipv6/sit.c |
1064 | +++ b/net/ipv6/sit.c |
1065 | @@ -560,13 +560,13 @@ static int ipip6_err(struct sk_buff *skb, u32 info) |
1066 | |
1067 | if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { |
1068 | ipv4_update_pmtu(skb, dev_net(skb->dev), info, |
1069 | - t->parms.link, 0, IPPROTO_IPV6, 0); |
1070 | + t->parms.link, 0, iph->protocol, 0); |
1071 | err = 0; |
1072 | goto out; |
1073 | } |
1074 | if (type == ICMP_REDIRECT) { |
1075 | ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, |
1076 | - IPPROTO_IPV6, 0); |
1077 | + iph->protocol, 0); |
1078 | err = 0; |
1079 | goto out; |
1080 | } |
1081 | diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c |
1082 | index b07c535ba8e7..eeb3eb3ea9eb 100644 |
1083 | --- a/net/sched/act_csum.c |
1084 | +++ b/net/sched/act_csum.c |
1085 | @@ -105,9 +105,7 @@ static void *tcf_csum_skb_nextlayer(struct sk_buff *skb, |
1086 | int hl = ihl + jhl; |
1087 | |
1088 | if (!pskb_may_pull(skb, ipl + ntkoff) || (ipl < hl) || |
1089 | - (skb_cloned(skb) && |
1090 | - !skb_clone_writable(skb, hl + ntkoff) && |
1091 | - pskb_expand_head(skb, 0, 0, GFP_ATOMIC))) |
1092 | + skb_try_make_writable(skb, hl + ntkoff)) |
1093 | return NULL; |
1094 | else |
1095 | return (void *)(skb_network_header(skb) + ihl); |
1096 | @@ -365,9 +363,7 @@ static int tcf_csum_ipv4(struct sk_buff *skb, u32 update_flags) |
1097 | } |
1098 | |
1099 | if (update_flags & TCA_CSUM_UPDATE_FLAG_IPV4HDR) { |
1100 | - if (skb_cloned(skb) && |
1101 | - !skb_clone_writable(skb, sizeof(*iph) + ntkoff) && |
1102 | - pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) |
1103 | + if (skb_try_make_writable(skb, sizeof(*iph) + ntkoff)) |
1104 | goto fail; |
1105 | |
1106 | ip_send_check(ip_hdr(skb)); |
1107 | diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c |
1108 | index b7c4ead8b5a8..27607b863aba 100644 |
1109 | --- a/net/sched/act_nat.c |
1110 | +++ b/net/sched/act_nat.c |
1111 | @@ -126,9 +126,7 @@ static int tcf_nat(struct sk_buff *skb, const struct tc_action *a, |
1112 | addr = iph->daddr; |
1113 | |
1114 | if (!((old_addr ^ addr) & mask)) { |
1115 | - if (skb_cloned(skb) && |
1116 | - !skb_clone_writable(skb, sizeof(*iph) + noff) && |
1117 | - pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) |
1118 | + if (skb_try_make_writable(skb, sizeof(*iph) + noff)) |
1119 | goto drop; |
1120 | |
1121 | new_addr &= mask; |
1122 | @@ -156,9 +154,7 @@ static int tcf_nat(struct sk_buff *skb, const struct tc_action *a, |
1123 | struct tcphdr *tcph; |
1124 | |
1125 | if (!pskb_may_pull(skb, ihl + sizeof(*tcph) + noff) || |
1126 | - (skb_cloned(skb) && |
1127 | - !skb_clone_writable(skb, ihl + sizeof(*tcph) + noff) && |
1128 | - pskb_expand_head(skb, 0, 0, GFP_ATOMIC))) |
1129 | + skb_try_make_writable(skb, ihl + sizeof(*tcph) + noff)) |
1130 | goto drop; |
1131 | |
1132 | tcph = (void *)(skb_network_header(skb) + ihl); |
1133 | @@ -171,9 +167,7 @@ static int tcf_nat(struct sk_buff *skb, const struct tc_action *a, |
1134 | struct udphdr *udph; |
1135 | |
1136 | if (!pskb_may_pull(skb, ihl + sizeof(*udph) + noff) || |
1137 | - (skb_cloned(skb) && |
1138 | - !skb_clone_writable(skb, ihl + sizeof(*udph) + noff) && |
1139 | - pskb_expand_head(skb, 0, 0, GFP_ATOMIC))) |
1140 | + skb_try_make_writable(skb, ihl + sizeof(*udph) + noff)) |
1141 | goto drop; |
1142 | |
1143 | udph = (void *)(skb_network_header(skb) + ihl); |
1144 | @@ -213,10 +207,8 @@ static int tcf_nat(struct sk_buff *skb, const struct tc_action *a, |
1145 | if ((old_addr ^ addr) & mask) |
1146 | break; |
1147 | |
1148 | - if (skb_cloned(skb) && |
1149 | - !skb_clone_writable(skb, ihl + sizeof(*icmph) + |
1150 | - sizeof(*iph) + noff) && |
1151 | - pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) |
1152 | + if (skb_try_make_writable(skb, ihl + sizeof(*icmph) + |
1153 | + sizeof(*iph) + noff)) |
1154 | goto drop; |
1155 | |
1156 | icmph = (void *)(skb_network_header(skb) + ihl); |
1157 | diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c |
1158 | index 2177eac0a61e..2e4bd2c0a50c 100644 |
1159 | --- a/net/sched/sch_fifo.c |
1160 | +++ b/net/sched/sch_fifo.c |
1161 | @@ -37,14 +37,18 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch) |
1162 | |
1163 | static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch) |
1164 | { |
1165 | + unsigned int prev_backlog; |
1166 | + |
1167 | if (likely(skb_queue_len(&sch->q) < sch->limit)) |
1168 | return qdisc_enqueue_tail(skb, sch); |
1169 | |
1170 | + prev_backlog = sch->qstats.backlog; |
1171 | /* queue full, remove one skb to fulfill the limit */ |
1172 | __qdisc_queue_drop_head(sch, &sch->q); |
1173 | qdisc_qstats_drop(sch); |
1174 | qdisc_enqueue_tail(skb, sch); |
1175 | |
1176 | + qdisc_tree_reduce_backlog(sch, 0, prev_backlog - sch->qstats.backlog); |
1177 | return NET_XMIT_CN; |
1178 | } |
1179 | |
1180 | diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c |
1181 | index 4befe97a9034..b7c29d5b6f04 100644 |
1182 | --- a/net/sched/sch_netem.c |
1183 | +++ b/net/sched/sch_netem.c |
1184 | @@ -650,14 +650,14 @@ deliver: |
1185 | #endif |
1186 | |
1187 | if (q->qdisc) { |
1188 | + unsigned int pkt_len = qdisc_pkt_len(skb); |
1189 | int err = qdisc_enqueue(skb, q->qdisc); |
1190 | |
1191 | - if (unlikely(err != NET_XMIT_SUCCESS)) { |
1192 | - if (net_xmit_drop_count(err)) { |
1193 | - qdisc_qstats_drop(sch); |
1194 | - qdisc_tree_reduce_backlog(sch, 1, |
1195 | - qdisc_pkt_len(skb)); |
1196 | - } |
1197 | + if (err != NET_XMIT_SUCCESS && |
1198 | + net_xmit_drop_count(err)) { |
1199 | + qdisc_qstats_drop(sch); |
1200 | + qdisc_tree_reduce_backlog(sch, 1, |
1201 | + pkt_len); |
1202 | } |
1203 | goto tfifo_dequeue; |
1204 | } |