Contents of /trunk/kernel-alx/patches-4.9/0133-4.9.34-all-fixes.patch
Parent Directory | Revision Log
Revision 2956 -
(show annotations)
(download)
Mon Jul 24 12:03:46 2017 UTC (7 years, 2 months ago) by niro
File size: 82864 byte(s)
Mon Jul 24 12:03:46 2017 UTC (7 years, 2 months ago) by niro
File size: 82864 byte(s)
-added patches-4.9
1 | diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt |
2 | index a6fadef92d6d..86a6746f6833 100644 |
3 | --- a/Documentation/kernel-parameters.txt |
4 | +++ b/Documentation/kernel-parameters.txt |
5 | @@ -3932,6 +3932,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. |
6 | spia_pedr= |
7 | spia_peddr= |
8 | |
9 | + stack_guard_gap= [MM] |
10 | + override the default stack gap protection. The value |
11 | + is in page units and it defines how many pages prior |
12 | + to (for stacks growing down) resp. after (for stacks |
13 | + growing up) the main stack are reserved for no other |
14 | + mapping. Default value is 256 pages. |
15 | + |
16 | stacktrace [FTRACE] |
17 | Enabled the stack tracer on boot up. |
18 | |
19 | diff --git a/Makefile b/Makefile |
20 | index 8470d81d5cc2..a40b373eba3a 100644 |
21 | --- a/Makefile |
22 | +++ b/Makefile |
23 | @@ -1,6 +1,6 @@ |
24 | VERSION = 4 |
25 | PATCHLEVEL = 9 |
26 | -SUBLEVEL = 33 |
27 | +SUBLEVEL = 34 |
28 | EXTRAVERSION = |
29 | NAME = Roaring Lionus |
30 | |
31 | diff --git a/arch/arc/mm/mmap.c b/arch/arc/mm/mmap.c |
32 | index 2e06d56e987b..cf4ae6958240 100644 |
33 | --- a/arch/arc/mm/mmap.c |
34 | +++ b/arch/arc/mm/mmap.c |
35 | @@ -64,7 +64,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, |
36 | |
37 | vma = find_vma(mm, addr); |
38 | if (TASK_SIZE - len >= addr && |
39 | - (!vma || addr + len <= vma->vm_start)) |
40 | + (!vma || addr + len <= vm_start_gap(vma))) |
41 | return addr; |
42 | } |
43 | |
44 | diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c |
45 | index 66353caa35b9..641334ebf46d 100644 |
46 | --- a/arch/arm/mm/mmap.c |
47 | +++ b/arch/arm/mm/mmap.c |
48 | @@ -89,7 +89,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, |
49 | |
50 | vma = find_vma(mm, addr); |
51 | if (TASK_SIZE - len >= addr && |
52 | - (!vma || addr + len <= vma->vm_start)) |
53 | + (!vma || addr + len <= vm_start_gap(vma))) |
54 | return addr; |
55 | } |
56 | |
57 | @@ -140,7 +140,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
58 | addr = PAGE_ALIGN(addr); |
59 | vma = find_vma(mm, addr); |
60 | if (TASK_SIZE - len >= addr && |
61 | - (!vma || addr + len <= vma->vm_start)) |
62 | + (!vma || addr + len <= vm_start_gap(vma))) |
63 | return addr; |
64 | } |
65 | |
66 | diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c |
67 | index 836f14707a62..efa59f1f8022 100644 |
68 | --- a/arch/frv/mm/elf-fdpic.c |
69 | +++ b/arch/frv/mm/elf-fdpic.c |
70 | @@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi |
71 | addr = PAGE_ALIGN(addr); |
72 | vma = find_vma(current->mm, addr); |
73 | if (TASK_SIZE - len >= addr && |
74 | - (!vma || addr + len <= vma->vm_start)) |
75 | + (!vma || addr + len <= vm_start_gap(vma))) |
76 | goto success; |
77 | } |
78 | |
79 | diff --git a/arch/mips/boot/Makefile b/arch/mips/boot/Makefile |
80 | index 2728a9a9c7c5..145b5ce8eb7e 100644 |
81 | --- a/arch/mips/boot/Makefile |
82 | +++ b/arch/mips/boot/Makefile |
83 | @@ -128,19 +128,19 @@ quiet_cmd_cpp_its_S = ITS $@ |
84 | -DADDR_BITS=$(ADDR_BITS) \ |
85 | -DADDR_CELLS=$(itb_addr_cells) |
86 | |
87 | -$(obj)/vmlinux.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE |
88 | +$(obj)/vmlinux.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE |
89 | $(call if_changed_dep,cpp_its_S,none,vmlinux.bin) |
90 | |
91 | -$(obj)/vmlinux.gz.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE |
92 | +$(obj)/vmlinux.gz.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE |
93 | $(call if_changed_dep,cpp_its_S,gzip,vmlinux.bin.gz) |
94 | |
95 | -$(obj)/vmlinux.bz2.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE |
96 | +$(obj)/vmlinux.bz2.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE |
97 | $(call if_changed_dep,cpp_its_S,bzip2,vmlinux.bin.bz2) |
98 | |
99 | -$(obj)/vmlinux.lzma.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE |
100 | +$(obj)/vmlinux.lzma.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE |
101 | $(call if_changed_dep,cpp_its_S,lzma,vmlinux.bin.lzma) |
102 | |
103 | -$(obj)/vmlinux.lzo.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE |
104 | +$(obj)/vmlinux.lzo.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE |
105 | $(call if_changed_dep,cpp_its_S,lzo,vmlinux.bin.lzo) |
106 | |
107 | quiet_cmd_itb-image = ITB $@ |
108 | diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c |
109 | index 12c718181e5e..c86b66b57fc6 100644 |
110 | --- a/arch/mips/kernel/branch.c |
111 | +++ b/arch/mips/kernel/branch.c |
112 | @@ -804,8 +804,10 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, |
113 | break; |
114 | } |
115 | /* Compact branch: BNEZC || JIALC */ |
116 | - if (insn.i_format.rs) |
117 | + if (!insn.i_format.rs) { |
118 | + /* JIALC: set $31/ra */ |
119 | regs->regs[31] = epc + 4; |
120 | + } |
121 | regs->cp0_epc += 8; |
122 | break; |
123 | #endif |
124 | diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c |
125 | index d08ea3ff0f53..a44052c05f93 100644 |
126 | --- a/arch/mips/mm/mmap.c |
127 | +++ b/arch/mips/mm/mmap.c |
128 | @@ -92,7 +92,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, |
129 | |
130 | vma = find_vma(mm, addr); |
131 | if (TASK_SIZE - len >= addr && |
132 | - (!vma || addr + len <= vma->vm_start)) |
133 | + (!vma || addr + len <= vm_start_gap(vma))) |
134 | return addr; |
135 | } |
136 | |
137 | diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c |
138 | index 0a393a04e891..1d7691fa8ab2 100644 |
139 | --- a/arch/parisc/kernel/sys_parisc.c |
140 | +++ b/arch/parisc/kernel/sys_parisc.c |
141 | @@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, |
142 | unsigned long len, unsigned long pgoff, unsigned long flags) |
143 | { |
144 | struct mm_struct *mm = current->mm; |
145 | - struct vm_area_struct *vma; |
146 | + struct vm_area_struct *vma, *prev; |
147 | unsigned long task_size = TASK_SIZE; |
148 | int do_color_align, last_mmap; |
149 | struct vm_unmapped_area_info info; |
150 | @@ -115,9 +115,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, |
151 | else |
152 | addr = PAGE_ALIGN(addr); |
153 | |
154 | - vma = find_vma(mm, addr); |
155 | + vma = find_vma_prev(mm, addr, &prev); |
156 | if (task_size - len >= addr && |
157 | - (!vma || addr + len <= vma->vm_start)) |
158 | + (!vma || addr + len <= vm_start_gap(vma)) && |
159 | + (!prev || addr >= vm_end_gap(prev))) |
160 | goto found_addr; |
161 | } |
162 | |
163 | @@ -141,7 +142,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
164 | const unsigned long len, const unsigned long pgoff, |
165 | const unsigned long flags) |
166 | { |
167 | - struct vm_area_struct *vma; |
168 | + struct vm_area_struct *vma, *prev; |
169 | struct mm_struct *mm = current->mm; |
170 | unsigned long addr = addr0; |
171 | int do_color_align, last_mmap; |
172 | @@ -175,9 +176,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
173 | addr = COLOR_ALIGN(addr, last_mmap, pgoff); |
174 | else |
175 | addr = PAGE_ALIGN(addr); |
176 | - vma = find_vma(mm, addr); |
177 | + |
178 | + vma = find_vma_prev(mm, addr, &prev); |
179 | if (TASK_SIZE - len >= addr && |
180 | - (!vma || addr + len <= vma->vm_start)) |
181 | + (!vma || addr + len <= vm_start_gap(vma)) && |
182 | + (!prev || addr >= vm_end_gap(prev))) |
183 | goto found_addr; |
184 | } |
185 | |
186 | diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c |
187 | index 35254a678456..a2b2d97f7eda 100644 |
188 | --- a/arch/powerpc/mm/hugetlbpage-radix.c |
189 | +++ b/arch/powerpc/mm/hugetlbpage-radix.c |
190 | @@ -65,7 +65,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr, |
191 | addr = ALIGN(addr, huge_page_size(h)); |
192 | vma = find_vma(mm, addr); |
193 | if (TASK_SIZE - len >= addr && |
194 | - (!vma || addr + len <= vma->vm_start)) |
195 | + (!vma || addr + len <= vm_start_gap(vma))) |
196 | return addr; |
197 | } |
198 | /* |
199 | diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c |
200 | index 2f1e44362198..5bc2845cddf4 100644 |
201 | --- a/arch/powerpc/mm/mmap.c |
202 | +++ b/arch/powerpc/mm/mmap.c |
203 | @@ -106,7 +106,7 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr, |
204 | addr = PAGE_ALIGN(addr); |
205 | vma = find_vma(mm, addr); |
206 | if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && |
207 | - (!vma || addr + len <= vma->vm_start)) |
208 | + (!vma || addr + len <= vm_start_gap(vma))) |
209 | return addr; |
210 | } |
211 | |
212 | @@ -142,7 +142,7 @@ radix__arch_get_unmapped_area_topdown(struct file *filp, |
213 | addr = PAGE_ALIGN(addr); |
214 | vma = find_vma(mm, addr); |
215 | if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && |
216 | - (!vma || addr + len <= vma->vm_start)) |
217 | + (!vma || addr + len <= vm_start_gap(vma))) |
218 | return addr; |
219 | } |
220 | |
221 | diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c |
222 | index 2b27458902ee..c4d5c9c61e0f 100644 |
223 | --- a/arch/powerpc/mm/slice.c |
224 | +++ b/arch/powerpc/mm/slice.c |
225 | @@ -105,7 +105,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr, |
226 | if ((mm->task_size - len) < addr) |
227 | return 0; |
228 | vma = find_vma(mm, addr); |
229 | - return (!vma || (addr + len) <= vma->vm_start); |
230 | + return (!vma || (addr + len) <= vm_start_gap(vma)); |
231 | } |
232 | |
233 | static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice) |
234 | diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c |
235 | index eb9df2822da1..812368f274c9 100644 |
236 | --- a/arch/s390/mm/mmap.c |
237 | +++ b/arch/s390/mm/mmap.c |
238 | @@ -98,7 +98,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, |
239 | addr = PAGE_ALIGN(addr); |
240 | vma = find_vma(mm, addr); |
241 | if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && |
242 | - (!vma || addr + len <= vma->vm_start)) |
243 | + (!vma || addr + len <= vm_start_gap(vma))) |
244 | return addr; |
245 | } |
246 | |
247 | @@ -136,7 +136,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
248 | addr = PAGE_ALIGN(addr); |
249 | vma = find_vma(mm, addr); |
250 | if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && |
251 | - (!vma || addr + len <= vma->vm_start)) |
252 | + (!vma || addr + len <= vm_start_gap(vma))) |
253 | return addr; |
254 | } |
255 | |
256 | diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c |
257 | index 6777177807c2..7df7d5944188 100644 |
258 | --- a/arch/sh/mm/mmap.c |
259 | +++ b/arch/sh/mm/mmap.c |
260 | @@ -63,7 +63,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, |
261 | |
262 | vma = find_vma(mm, addr); |
263 | if (TASK_SIZE - len >= addr && |
264 | - (!vma || addr + len <= vma->vm_start)) |
265 | + (!vma || addr + len <= vm_start_gap(vma))) |
266 | return addr; |
267 | } |
268 | |
269 | @@ -113,7 +113,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
270 | |
271 | vma = find_vma(mm, addr); |
272 | if (TASK_SIZE - len >= addr && |
273 | - (!vma || addr + len <= vma->vm_start)) |
274 | + (!vma || addr + len <= vm_start_gap(vma))) |
275 | return addr; |
276 | } |
277 | |
278 | diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c |
279 | index fe8b8ee8e660..02e05e221b94 100644 |
280 | --- a/arch/sparc/kernel/sys_sparc_64.c |
281 | +++ b/arch/sparc/kernel/sys_sparc_64.c |
282 | @@ -118,7 +118,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi |
283 | |
284 | vma = find_vma(mm, addr); |
285 | if (task_size - len >= addr && |
286 | - (!vma || addr + len <= vma->vm_start)) |
287 | + (!vma || addr + len <= vm_start_gap(vma))) |
288 | return addr; |
289 | } |
290 | |
291 | @@ -181,7 +181,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
292 | |
293 | vma = find_vma(mm, addr); |
294 | if (task_size - len >= addr && |
295 | - (!vma || addr + len <= vma->vm_start)) |
296 | + (!vma || addr + len <= vm_start_gap(vma))) |
297 | return addr; |
298 | } |
299 | |
300 | diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c |
301 | index 988acc8b1b80..58cde8d9be8a 100644 |
302 | --- a/arch/sparc/mm/hugetlbpage.c |
303 | +++ b/arch/sparc/mm/hugetlbpage.c |
304 | @@ -116,7 +116,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, |
305 | addr = ALIGN(addr, HPAGE_SIZE); |
306 | vma = find_vma(mm, addr); |
307 | if (task_size - len >= addr && |
308 | - (!vma || addr + len <= vma->vm_start)) |
309 | + (!vma || addr + len <= vm_start_gap(vma))) |
310 | return addr; |
311 | } |
312 | if (mm->get_unmapped_area == arch_get_unmapped_area) |
313 | diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c |
314 | index 77ceaa343fce..67508b249ede 100644 |
315 | --- a/arch/tile/mm/hugetlbpage.c |
316 | +++ b/arch/tile/mm/hugetlbpage.c |
317 | @@ -232,7 +232,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, |
318 | addr = ALIGN(addr, huge_page_size(h)); |
319 | vma = find_vma(mm, addr); |
320 | if (TASK_SIZE - len >= addr && |
321 | - (!vma || addr + len <= vma->vm_start)) |
322 | + (!vma || addr + len <= vm_start_gap(vma))) |
323 | return addr; |
324 | } |
325 | if (current->mm->get_unmapped_area == arch_get_unmapped_area) |
326 | diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c |
327 | index a55ed63b9f91..1119414ab419 100644 |
328 | --- a/arch/x86/kernel/sys_x86_64.c |
329 | +++ b/arch/x86/kernel/sys_x86_64.c |
330 | @@ -140,7 +140,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, |
331 | addr = PAGE_ALIGN(addr); |
332 | vma = find_vma(mm, addr); |
333 | if (end - len >= addr && |
334 | - (!vma || addr + len <= vma->vm_start)) |
335 | + (!vma || addr + len <= vm_start_gap(vma))) |
336 | return addr; |
337 | } |
338 | |
339 | @@ -183,7 +183,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
340 | addr = PAGE_ALIGN(addr); |
341 | vma = find_vma(mm, addr); |
342 | if (TASK_SIZE - len >= addr && |
343 | - (!vma || addr + len <= vma->vm_start)) |
344 | + (!vma || addr + len <= vm_start_gap(vma))) |
345 | return addr; |
346 | } |
347 | |
348 | diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c |
349 | index 2ae8584b44c7..fe342e8ed529 100644 |
350 | --- a/arch/x86/mm/hugetlbpage.c |
351 | +++ b/arch/x86/mm/hugetlbpage.c |
352 | @@ -144,7 +144,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, |
353 | addr = ALIGN(addr, huge_page_size(h)); |
354 | vma = find_vma(mm, addr); |
355 | if (TASK_SIZE - len >= addr && |
356 | - (!vma || addr + len <= vma->vm_start)) |
357 | + (!vma || addr + len <= vm_start_gap(vma))) |
358 | return addr; |
359 | } |
360 | if (mm->get_unmapped_area == arch_get_unmapped_area) |
361 | diff --git a/arch/x86/mm/numa_32.c b/arch/x86/mm/numa_32.c |
362 | index 6b7ce6279133..aca6295350f3 100644 |
363 | --- a/arch/x86/mm/numa_32.c |
364 | +++ b/arch/x86/mm/numa_32.c |
365 | @@ -100,5 +100,6 @@ void __init initmem_init(void) |
366 | printk(KERN_DEBUG "High memory starts at vaddr %08lx\n", |
367 | (ulong) pfn_to_kaddr(highstart_pfn)); |
368 | |
369 | + __vmalloc_start_set = true; |
370 | setup_bootmem_allocator(); |
371 | } |
372 | diff --git a/arch/xtensa/kernel/syscall.c b/arch/xtensa/kernel/syscall.c |
373 | index 83cf49685373..3aaaae18417c 100644 |
374 | --- a/arch/xtensa/kernel/syscall.c |
375 | +++ b/arch/xtensa/kernel/syscall.c |
376 | @@ -87,7 +87,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, |
377 | /* At this point: (!vmm || addr < vmm->vm_end). */ |
378 | if (TASK_SIZE - len < addr) |
379 | return -ENOMEM; |
380 | - if (!vmm || addr + len <= vmm->vm_start) |
381 | + if (!vmm || addr + len <= vm_start_gap(vmm)) |
382 | return addr; |
383 | addr = vmm->vm_end; |
384 | if (flags & MAP_SHARED) |
385 | diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c |
386 | index 946025a7413b..84eca4f93b82 100644 |
387 | --- a/drivers/char/tpm/tpm_ibmvtpm.c |
388 | +++ b/drivers/char/tpm/tpm_ibmvtpm.c |
389 | @@ -295,6 +295,8 @@ static int tpm_ibmvtpm_remove(struct vio_dev *vdev) |
390 | } |
391 | |
392 | kfree(ibmvtpm); |
393 | + /* For tpm_ibmvtpm_get_desired_dma */ |
394 | + dev_set_drvdata(&vdev->dev, NULL); |
395 | |
396 | return 0; |
397 | } |
398 | @@ -309,13 +311,16 @@ static int tpm_ibmvtpm_remove(struct vio_dev *vdev) |
399 | static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev) |
400 | { |
401 | struct tpm_chip *chip = dev_get_drvdata(&vdev->dev); |
402 | - struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev); |
403 | + struct ibmvtpm_dev *ibmvtpm; |
404 | |
405 | - /* ibmvtpm initializes at probe time, so the data we are |
406 | - * asking for may not be set yet. Estimate that 4K required |
407 | - * for TCE-mapped buffer in addition to CRQ. |
408 | - */ |
409 | - if (!ibmvtpm) |
410 | + /* |
411 | + * ibmvtpm initializes at probe time, so the data we are |
412 | + * asking for may not be set yet. Estimate that 4K required |
413 | + * for TCE-mapped buffer in addition to CRQ. |
414 | + */ |
415 | + if (chip) |
416 | + ibmvtpm = dev_get_drvdata(&chip->dev); |
417 | + else |
418 | return CRQ_RES_BUF_SIZE + PAGE_SIZE; |
419 | |
420 | return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size; |
421 | diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c |
422 | index 13475890d792..00a74351f623 100644 |
423 | --- a/drivers/cpufreq/cpufreq_conservative.c |
424 | +++ b/drivers/cpufreq/cpufreq_conservative.c |
425 | @@ -169,8 +169,8 @@ static ssize_t store_down_threshold(struct gov_attr_set *attr_set, |
426 | int ret; |
427 | ret = sscanf(buf, "%u", &input); |
428 | |
429 | - /* cannot be lower than 11 otherwise freq will not fall */ |
430 | - if (ret != 1 || input < 11 || input > 100 || |
431 | + /* cannot be lower than 1 otherwise freq will not fall */ |
432 | + if (ret != 1 || input < 1 || input > 100 || |
433 | input >= dbs_data->up_threshold) |
434 | return -EINVAL; |
435 | |
436 | diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c |
437 | index 42448c7c5ff5..db9b79a8b160 100644 |
438 | --- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c |
439 | +++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c |
440 | @@ -1290,8 +1290,11 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev, |
441 | u32 tmp, wm_mask, lb_vblank_lead_lines = 0; |
442 | |
443 | if (amdgpu_crtc->base.enabled && num_heads && mode) { |
444 | - active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; |
445 | - line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); |
446 | + active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000, |
447 | + (u32)mode->clock); |
448 | + line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000, |
449 | + (u32)mode->clock); |
450 | + line_time = min(line_time, (u32)65535); |
451 | |
452 | /* watermark for high clocks */ |
453 | if (adev->pm.dpm_enabled) { |
454 | diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c |
455 | index 904dabdc3a1e..36d5128a2aad 100644 |
456 | --- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c |
457 | +++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c |
458 | @@ -1257,8 +1257,11 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev, |
459 | u32 tmp, wm_mask, lb_vblank_lead_lines = 0; |
460 | |
461 | if (amdgpu_crtc->base.enabled && num_heads && mode) { |
462 | - active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; |
463 | - line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); |
464 | + active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000, |
465 | + (u32)mode->clock); |
466 | + line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000, |
467 | + (u32)mode->clock); |
468 | + line_time = min(line_time, (u32)65535); |
469 | |
470 | /* watermark for high clocks */ |
471 | if (adev->pm.dpm_enabled) { |
472 | diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c |
473 | index 6d02bdb25d98..75689a2c2de6 100644 |
474 | --- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c |
475 | +++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c |
476 | @@ -1054,8 +1054,11 @@ static void dce_v6_0_program_watermarks(struct amdgpu_device *adev, |
477 | fixed20_12 a, b, c; |
478 | |
479 | if (amdgpu_crtc->base.enabled && num_heads && mode) { |
480 | - active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; |
481 | - line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); |
482 | + active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000, |
483 | + (u32)mode->clock); |
484 | + line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000, |
485 | + (u32)mode->clock); |
486 | + line_time = min(line_time, (u32)65535); |
487 | priority_a_cnt = 0; |
488 | priority_b_cnt = 0; |
489 | |
490 | diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c |
491 | index b1fb60107cfa..ba2321ea800e 100644 |
492 | --- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c |
493 | +++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c |
494 | @@ -1211,8 +1211,11 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev, |
495 | u32 tmp, wm_mask, lb_vblank_lead_lines = 0; |
496 | |
497 | if (amdgpu_crtc->base.enabled && num_heads && mode) { |
498 | - active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; |
499 | - line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); |
500 | + active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000, |
501 | + (u32)mode->clock); |
502 | + line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000, |
503 | + (u32)mode->clock); |
504 | + line_time = min(line_time, (u32)65535); |
505 | |
506 | /* watermark for high clocks */ |
507 | if (adev->pm.dpm_enabled) { |
508 | diff --git a/drivers/gpu/drm/i915/i915_pvinfo.h b/drivers/gpu/drm/i915/i915_pvinfo.h |
509 | index c0cb2974caac..2cfe96d3e5d1 100644 |
510 | --- a/drivers/gpu/drm/i915/i915_pvinfo.h |
511 | +++ b/drivers/gpu/drm/i915/i915_pvinfo.h |
512 | @@ -36,10 +36,6 @@ |
513 | #define VGT_VERSION_MAJOR 1 |
514 | #define VGT_VERSION_MINOR 0 |
515 | |
516 | -#define INTEL_VGT_IF_VERSION_ENCODE(major, minor) ((major) << 16 | (minor)) |
517 | -#define INTEL_VGT_IF_VERSION \ |
518 | - INTEL_VGT_IF_VERSION_ENCODE(VGT_VERSION_MAJOR, VGT_VERSION_MINOR) |
519 | - |
520 | /* |
521 | * notifications from guest to vgpu device model |
522 | */ |
523 | @@ -55,8 +51,8 @@ enum vgt_g2v_type { |
524 | |
525 | struct vgt_if { |
526 | u64 magic; /* VGT_MAGIC */ |
527 | - uint16_t version_major; |
528 | - uint16_t version_minor; |
529 | + u16 version_major; |
530 | + u16 version_minor; |
531 | u32 vgt_id; /* ID of vGT instance */ |
532 | u32 rsv1[12]; /* pad to offset 0x40 */ |
533 | /* |
534 | diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c |
535 | index dae340cfc6c7..125adcc6d6ca 100644 |
536 | --- a/drivers/gpu/drm/i915/i915_vgpu.c |
537 | +++ b/drivers/gpu/drm/i915/i915_vgpu.c |
538 | @@ -60,8 +60,8 @@ |
539 | */ |
540 | void i915_check_vgpu(struct drm_i915_private *dev_priv) |
541 | { |
542 | - uint64_t magic; |
543 | - uint32_t version; |
544 | + u64 magic; |
545 | + u16 version_major; |
546 | |
547 | BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE); |
548 | |
549 | @@ -69,10 +69,8 @@ void i915_check_vgpu(struct drm_i915_private *dev_priv) |
550 | if (magic != VGT_MAGIC) |
551 | return; |
552 | |
553 | - version = INTEL_VGT_IF_VERSION_ENCODE( |
554 | - __raw_i915_read16(dev_priv, vgtif_reg(version_major)), |
555 | - __raw_i915_read16(dev_priv, vgtif_reg(version_minor))); |
556 | - if (version != INTEL_VGT_IF_VERSION) { |
557 | + version_major = __raw_i915_read16(dev_priv, vgtif_reg(version_major)); |
558 | + if (version_major < VGT_VERSION_MAJOR) { |
559 | DRM_INFO("VGT interface version mismatch!\n"); |
560 | return; |
561 | } |
562 | diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c |
563 | index 0e8c4d9af340..e097780752f6 100644 |
564 | --- a/drivers/gpu/drm/mediatek/mtk_hdmi.c |
565 | +++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c |
566 | @@ -1061,7 +1061,7 @@ static int mtk_hdmi_setup_vendor_specific_infoframe(struct mtk_hdmi *hdmi, |
567 | } |
568 | |
569 | err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer)); |
570 | - if (err) { |
571 | + if (err < 0) { |
572 | dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n", |
573 | err); |
574 | return err; |
575 | diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c |
576 | index 3f6704cf6608..ec9023bd935b 100644 |
577 | --- a/drivers/gpu/drm/vc4/vc4_bo.c |
578 | +++ b/drivers/gpu/drm/vc4/vc4_bo.c |
579 | @@ -313,6 +313,14 @@ void vc4_free_object(struct drm_gem_object *gem_bo) |
580 | goto out; |
581 | } |
582 | |
583 | + /* If this object was partially constructed but CMA allocation |
584 | + * had failed, just free it. |
585 | + */ |
586 | + if (!bo->base.vaddr) { |
587 | + vc4_bo_destroy(bo); |
588 | + goto out; |
589 | + } |
590 | + |
591 | cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size); |
592 | if (!cache_list) { |
593 | vc4_bo_destroy(bo); |
594 | diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c |
595 | index 2de1f52f1b19..62b0dec6d777 100644 |
596 | --- a/drivers/iio/adc/ti_am335x_adc.c |
597 | +++ b/drivers/iio/adc/ti_am335x_adc.c |
598 | @@ -484,7 +484,7 @@ static int tiadc_probe(struct platform_device *pdev) |
599 | return -EINVAL; |
600 | } |
601 | |
602 | - indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*indio_dev)); |
603 | + indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev)); |
604 | if (indio_dev == NULL) { |
605 | dev_err(&pdev->dev, "failed to allocate iio device\n"); |
606 | return -ENOMEM; |
607 | diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c |
608 | index b9fcbf18aa99..5faea370ab57 100644 |
609 | --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c |
610 | +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c |
611 | @@ -41,6 +41,7 @@ static const int accel_scale[] = {598, 1196, 2392, 4785}; |
612 | static const struct inv_mpu6050_reg_map reg_set_6500 = { |
613 | .sample_rate_div = INV_MPU6050_REG_SAMPLE_RATE_DIV, |
614 | .lpf = INV_MPU6050_REG_CONFIG, |
615 | + .accel_lpf = INV_MPU6500_REG_ACCEL_CONFIG_2, |
616 | .user_ctrl = INV_MPU6050_REG_USER_CTRL, |
617 | .fifo_en = INV_MPU6050_REG_FIFO_EN, |
618 | .gyro_config = INV_MPU6050_REG_GYRO_CONFIG, |
619 | @@ -205,6 +206,37 @@ int inv_mpu6050_set_power_itg(struct inv_mpu6050_state *st, bool power_on) |
620 | EXPORT_SYMBOL_GPL(inv_mpu6050_set_power_itg); |
621 | |
622 | /** |
623 | + * inv_mpu6050_set_lpf_regs() - set low pass filter registers, chip dependent |
624 | + * |
625 | + * MPU60xx/MPU9150 use only 1 register for accelerometer + gyroscope |
626 | + * MPU6500 and above have a dedicated register for accelerometer |
627 | + */ |
628 | +static int inv_mpu6050_set_lpf_regs(struct inv_mpu6050_state *st, |
629 | + enum inv_mpu6050_filter_e val) |
630 | +{ |
631 | + int result; |
632 | + |
633 | + result = regmap_write(st->map, st->reg->lpf, val); |
634 | + if (result) |
635 | + return result; |
636 | + |
637 | + switch (st->chip_type) { |
638 | + case INV_MPU6050: |
639 | + case INV_MPU6000: |
640 | + case INV_MPU9150: |
641 | + /* old chips, nothing to do */ |
642 | + result = 0; |
643 | + break; |
644 | + default: |
645 | + /* set accel lpf */ |
646 | + result = regmap_write(st->map, st->reg->accel_lpf, val); |
647 | + break; |
648 | + } |
649 | + |
650 | + return result; |
651 | +} |
652 | + |
653 | +/** |
654 | * inv_mpu6050_init_config() - Initialize hardware, disable FIFO. |
655 | * |
656 | * Initial configuration: |
657 | @@ -227,8 +259,7 @@ static int inv_mpu6050_init_config(struct iio_dev *indio_dev) |
658 | if (result) |
659 | return result; |
660 | |
661 | - d = INV_MPU6050_FILTER_20HZ; |
662 | - result = regmap_write(st->map, st->reg->lpf, d); |
663 | + result = inv_mpu6050_set_lpf_regs(st, INV_MPU6050_FILTER_20HZ); |
664 | if (result) |
665 | return result; |
666 | |
667 | @@ -531,6 +562,8 @@ static int inv_mpu6050_write_raw(struct iio_dev *indio_dev, |
668 | * would be alising. This function basically search for the |
669 | * correct low pass parameters based on the fifo rate, e.g, |
670 | * sampling frequency. |
671 | + * |
672 | + * lpf is set automatically when setting sampling rate to avoid any aliases. |
673 | */ |
674 | static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate) |
675 | { |
676 | @@ -546,7 +579,7 @@ static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate) |
677 | while ((h < hz[i]) && (i < ARRAY_SIZE(d) - 1)) |
678 | i++; |
679 | data = d[i]; |
680 | - result = regmap_write(st->map, st->reg->lpf, data); |
681 | + result = inv_mpu6050_set_lpf_regs(st, data); |
682 | if (result) |
683 | return result; |
684 | st->chip_config.lpf = data; |
685 | diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h |
686 | index f0e8c5dd9fae..d851581bb0b8 100644 |
687 | --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h |
688 | +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h |
689 | @@ -28,6 +28,7 @@ |
690 | * struct inv_mpu6050_reg_map - Notable registers. |
691 | * @sample_rate_div: Divider applied to gyro output rate. |
692 | * @lpf: Configures internal low pass filter. |
693 | + * @accel_lpf: Configures accelerometer low pass filter. |
694 | * @user_ctrl: Enables/resets the FIFO. |
695 | * @fifo_en: Determines which data will appear in FIFO. |
696 | * @gyro_config: gyro config register. |
697 | @@ -47,6 +48,7 @@ |
698 | struct inv_mpu6050_reg_map { |
699 | u8 sample_rate_div; |
700 | u8 lpf; |
701 | + u8 accel_lpf; |
702 | u8 user_ctrl; |
703 | u8 fifo_en; |
704 | u8 gyro_config; |
705 | @@ -187,6 +189,7 @@ struct inv_mpu6050_state { |
706 | #define INV_MPU6050_FIFO_THRESHOLD 500 |
707 | |
708 | /* mpu6500 registers */ |
709 | +#define INV_MPU6500_REG_ACCEL_CONFIG_2 0x1D |
710 | #define INV_MPU6500_REG_ACCEL_OFFSET 0x77 |
711 | |
712 | /* delay time in milliseconds */ |
713 | diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c |
714 | index 55df9a75eb3a..44e46c159a7e 100644 |
715 | --- a/drivers/iio/pressure/st_pressure_core.c |
716 | +++ b/drivers/iio/pressure/st_pressure_core.c |
717 | @@ -227,7 +227,7 @@ static const struct iio_chan_spec st_press_1_channels[] = { |
718 | .address = ST_PRESS_1_OUT_XL_ADDR, |
719 | .scan_index = 0, |
720 | .scan_type = { |
721 | - .sign = 'u', |
722 | + .sign = 's', |
723 | .realbits = 24, |
724 | .storagebits = 32, |
725 | .endianness = IIO_LE, |
726 | @@ -240,7 +240,7 @@ static const struct iio_chan_spec st_press_1_channels[] = { |
727 | .address = ST_TEMP_1_OUT_L_ADDR, |
728 | .scan_index = 1, |
729 | .scan_type = { |
730 | - .sign = 'u', |
731 | + .sign = 's', |
732 | .realbits = 16, |
733 | .storagebits = 16, |
734 | .endianness = IIO_LE, |
735 | @@ -259,7 +259,7 @@ static const struct iio_chan_spec st_press_lps001wp_channels[] = { |
736 | .address = ST_PRESS_LPS001WP_OUT_L_ADDR, |
737 | .scan_index = 0, |
738 | .scan_type = { |
739 | - .sign = 'u', |
740 | + .sign = 's', |
741 | .realbits = 16, |
742 | .storagebits = 16, |
743 | .endianness = IIO_LE, |
744 | @@ -273,7 +273,7 @@ static const struct iio_chan_spec st_press_lps001wp_channels[] = { |
745 | .address = ST_TEMP_LPS001WP_OUT_L_ADDR, |
746 | .scan_index = 1, |
747 | .scan_type = { |
748 | - .sign = 'u', |
749 | + .sign = 's', |
750 | .realbits = 16, |
751 | .storagebits = 16, |
752 | .endianness = IIO_LE, |
753 | @@ -291,7 +291,7 @@ static const struct iio_chan_spec st_press_lps22hb_channels[] = { |
754 | .address = ST_PRESS_1_OUT_XL_ADDR, |
755 | .scan_index = 0, |
756 | .scan_type = { |
757 | - .sign = 'u', |
758 | + .sign = 's', |
759 | .realbits = 24, |
760 | .storagebits = 32, |
761 | .endianness = IIO_LE, |
762 | diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c |
763 | index 268210ea4990..24fb54398a3b 100644 |
764 | --- a/drivers/iio/proximity/as3935.c |
765 | +++ b/drivers/iio/proximity/as3935.c |
766 | @@ -269,8 +269,6 @@ static irqreturn_t as3935_interrupt_handler(int irq, void *private) |
767 | |
768 | static void calibrate_as3935(struct as3935_state *st) |
769 | { |
770 | - mutex_lock(&st->lock); |
771 | - |
772 | /* mask disturber interrupt bit */ |
773 | as3935_write(st, AS3935_INT, BIT(5)); |
774 | |
775 | @@ -280,8 +278,6 @@ static void calibrate_as3935(struct as3935_state *st) |
776 | |
777 | mdelay(2); |
778 | as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV)); |
779 | - |
780 | - mutex_unlock(&st->lock); |
781 | } |
782 | |
783 | #ifdef CONFIG_PM_SLEEP |
784 | @@ -318,6 +314,8 @@ static int as3935_resume(struct device *dev) |
785 | val &= ~AS3935_AFE_PWR_BIT; |
786 | ret = as3935_write(st, AS3935_AFE_GAIN, val); |
787 | |
788 | + calibrate_as3935(st); |
789 | + |
790 | err_resume: |
791 | mutex_unlock(&st->lock); |
792 | |
793 | diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c |
794 | index 11bfa27b022c..282c9fb0ba95 100644 |
795 | --- a/drivers/infiniband/hw/mlx5/main.c |
796 | +++ b/drivers/infiniband/hw/mlx5/main.c |
797 | @@ -1105,13 +1105,13 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev, |
798 | * pretend we don't support reading the HCA's core clock. This is also |
799 | * forced by mmap function. |
800 | */ |
801 | - if (PAGE_SIZE <= 4096 && |
802 | - field_avail(typeof(resp), hca_core_clock_offset, udata->outlen)) { |
803 | - resp.comp_mask |= |
804 | - MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_CORE_CLOCK_OFFSET; |
805 | - resp.hca_core_clock_offset = |
806 | - offsetof(struct mlx5_init_seg, internal_timer_h) % |
807 | - PAGE_SIZE; |
808 | + if (field_avail(typeof(resp), hca_core_clock_offset, udata->outlen)) { |
809 | + if (PAGE_SIZE <= 4096) { |
810 | + resp.comp_mask |= |
811 | + MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_CORE_CLOCK_OFFSET; |
812 | + resp.hca_core_clock_offset = |
813 | + offsetof(struct mlx5_init_seg, internal_timer_h) % PAGE_SIZE; |
814 | + } |
815 | resp.response_length += sizeof(resp.hca_core_clock_offset) + |
816 | sizeof(resp.reserved2); |
817 | } |
818 | diff --git a/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c b/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c |
819 | index e1907cd0c3b7..7613d1fee104 100644 |
820 | --- a/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c |
821 | +++ b/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c |
822 | @@ -123,15 +123,10 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw) |
823 | memset(&tvdata,0,sizeof(tvdata)); |
824 | |
825 | eeprom = pvr2_eeprom_fetch(hdw); |
826 | - if (!eeprom) return -EINVAL; |
827 | - |
828 | - { |
829 | - struct i2c_client fake_client; |
830 | - /* Newer version expects a useless client interface */ |
831 | - fake_client.addr = hdw->eeprom_addr; |
832 | - fake_client.adapter = &hdw->i2c_adap; |
833 | - tveeprom_hauppauge_analog(&fake_client,&tvdata,eeprom); |
834 | - } |
835 | + if (!eeprom) |
836 | + return -EINVAL; |
837 | + |
838 | + tveeprom_hauppauge_analog(NULL, &tvdata, eeprom); |
839 | |
840 | trace_eeprom("eeprom assumed v4l tveeprom module"); |
841 | trace_eeprom("eeprom direct call results:"); |
842 | diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c |
843 | index 21900202ff83..9ccf7f5e0e2e 100644 |
844 | --- a/drivers/media/v4l2-core/videobuf2-core.c |
845 | +++ b/drivers/media/v4l2-core/videobuf2-core.c |
846 | @@ -868,7 +868,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs); |
847 | |
848 | void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no) |
849 | { |
850 | - if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv) |
851 | + if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv) |
852 | return NULL; |
853 | |
854 | return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv); |
855 | diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c |
856 | index 1aa74c4c3ced..9d167c9af2c6 100644 |
857 | --- a/drivers/mfd/omap-usb-tll.c |
858 | +++ b/drivers/mfd/omap-usb-tll.c |
859 | @@ -377,8 +377,8 @@ int omap_tll_init(struct usbhs_omap_platform_data *pdata) |
860 | * and use SDR Mode |
861 | */ |
862 | reg &= ~(OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE |
863 | - | OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF |
864 | | OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE); |
865 | + reg |= OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF; |
866 | } else if (pdata->port_mode[i] == |
867 | OMAP_EHCI_PORT_MODE_HSIC) { |
868 | /* |
869 | diff --git a/drivers/misc/c2port/c2port-duramar2150.c b/drivers/misc/c2port/c2port-duramar2150.c |
870 | index 5484301d57d9..3dc61ea7dc64 100644 |
871 | --- a/drivers/misc/c2port/c2port-duramar2150.c |
872 | +++ b/drivers/misc/c2port/c2port-duramar2150.c |
873 | @@ -129,8 +129,8 @@ static int __init duramar2150_c2port_init(void) |
874 | |
875 | duramar2150_c2port_dev = c2port_device_register("uc", |
876 | &duramar2150_c2port_ops, NULL); |
877 | - if (!duramar2150_c2port_dev) { |
878 | - ret = -ENODEV; |
879 | + if (IS_ERR(duramar2150_c2port_dev)) { |
880 | + ret = PTR_ERR(duramar2150_c2port_dev); |
881 | goto free_region; |
882 | } |
883 | |
884 | diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c |
885 | index 88e45234d527..fed992e2c258 100644 |
886 | --- a/drivers/misc/mic/vop/vop_vringh.c |
887 | +++ b/drivers/misc/mic/vop/vop_vringh.c |
888 | @@ -292,7 +292,6 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, |
889 | if (ret) { |
890 | dev_err(vop_dev(vdev), "%s %d err %d\n", |
891 | __func__, __LINE__, ret); |
892 | - kfree(vdev); |
893 | return ret; |
894 | } |
895 | |
896 | diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c |
897 | index 7ab24c5262f3..05369dc9dd09 100644 |
898 | --- a/drivers/net/can/usb/gs_usb.c |
899 | +++ b/drivers/net/can/usb/gs_usb.c |
900 | @@ -265,6 +265,8 @@ static int gs_cmd_reset(struct gs_usb *gsusb, struct gs_can *gsdev) |
901 | sizeof(*dm), |
902 | 1000); |
903 | |
904 | + kfree(dm); |
905 | + |
906 | return rc; |
907 | } |
908 | |
909 | diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c |
910 | index 0457e315d336..6063cf439d3d 100644 |
911 | --- a/drivers/net/wireless/ath/ath10k/pci.c |
912 | +++ b/drivers/net/wireless/ath/ath10k/pci.c |
913 | @@ -1647,6 +1647,8 @@ static int ath10k_pci_hif_start(struct ath10k *ar) |
914 | |
915 | ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n"); |
916 | |
917 | + napi_enable(&ar->napi); |
918 | + |
919 | ath10k_pci_irq_enable(ar); |
920 | ath10k_pci_rx_post(ar); |
921 | |
922 | @@ -2531,7 +2533,6 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar) |
923 | ath10k_err(ar, "could not wake up target CPU: %d\n", ret); |
924 | goto err_ce; |
925 | } |
926 | - napi_enable(&ar->napi); |
927 | |
928 | return 0; |
929 | |
930 | diff --git a/drivers/staging/iio/light/tsl2x7x_core.c b/drivers/staging/iio/light/tsl2x7x_core.c |
931 | index ea15bc1c300c..197201a70d59 100644 |
932 | --- a/drivers/staging/iio/light/tsl2x7x_core.c |
933 | +++ b/drivers/staging/iio/light/tsl2x7x_core.c |
934 | @@ -854,7 +854,7 @@ void tsl2x7x_prox_calculate(int *data, int length, |
935 | tmp = data[i] - statP->mean; |
936 | sample_sum += tmp * tmp; |
937 | } |
938 | - statP->stddev = int_sqrt((long)sample_sum) / length; |
939 | + statP->stddev = int_sqrt((long)sample_sum / length); |
940 | } |
941 | |
942 | /** |
943 | diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c |
944 | index 553e8d50352f..6513ace1fce6 100644 |
945 | --- a/drivers/staging/rtl8188eu/core/rtw_ap.c |
946 | +++ b/drivers/staging/rtl8188eu/core/rtw_ap.c |
947 | @@ -890,7 +890,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len) |
948 | return _FAIL; |
949 | |
950 | |
951 | - if (len > MAX_IE_SZ) |
952 | + if (len < 0 || len > MAX_IE_SZ) |
953 | return _FAIL; |
954 | |
955 | pbss_network->IELength = len; |
956 | diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c |
957 | index 195acc868763..5d476916191b 100644 |
958 | --- a/drivers/tty/serial/efm32-uart.c |
959 | +++ b/drivers/tty/serial/efm32-uart.c |
960 | @@ -27,6 +27,7 @@ |
961 | #define UARTn_FRAME 0x04 |
962 | #define UARTn_FRAME_DATABITS__MASK 0x000f |
963 | #define UARTn_FRAME_DATABITS(n) ((n) - 3) |
964 | +#define UARTn_FRAME_PARITY__MASK 0x0300 |
965 | #define UARTn_FRAME_PARITY_NONE 0x0000 |
966 | #define UARTn_FRAME_PARITY_EVEN 0x0200 |
967 | #define UARTn_FRAME_PARITY_ODD 0x0300 |
968 | @@ -572,12 +573,16 @@ static void efm32_uart_console_get_options(struct efm32_uart_port *efm_port, |
969 | 16 * (4 + (clkdiv >> 6))); |
970 | |
971 | frame = efm32_uart_read32(efm_port, UARTn_FRAME); |
972 | - if (frame & UARTn_FRAME_PARITY_ODD) |
973 | + switch (frame & UARTn_FRAME_PARITY__MASK) { |
974 | + case UARTn_FRAME_PARITY_ODD: |
975 | *parity = 'o'; |
976 | - else if (frame & UARTn_FRAME_PARITY_EVEN) |
977 | + break; |
978 | + case UARTn_FRAME_PARITY_EVEN: |
979 | *parity = 'e'; |
980 | - else |
981 | + break; |
982 | + default: |
983 | *parity = 'n'; |
984 | + } |
985 | |
986 | *bits = (frame & UARTn_FRAME_DATABITS__MASK) - |
987 | UARTn_FRAME_DATABITS(4) + 4; |
988 | diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c |
989 | index ee84f89391ca..7e97a1ccab23 100644 |
990 | --- a/drivers/tty/serial/sh-sci.c |
991 | +++ b/drivers/tty/serial/sh-sci.c |
992 | @@ -2366,6 +2366,10 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios, |
993 | */ |
994 | udelay(DIV_ROUND_UP(10 * 1000000, baud)); |
995 | } |
996 | + if (port->flags & UPF_HARD_FLOW) { |
997 | + /* Refresh (Auto) RTS */ |
998 | + sci_set_mctrl(port, port->mctrl); |
999 | + } |
1000 | |
1001 | #ifdef CONFIG_SERIAL_SH_SCI_DMA |
1002 | /* |
1003 | diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c |
1004 | index 3b9735abf2e0..8a7c6bbaed7e 100644 |
1005 | --- a/drivers/usb/core/hcd.c |
1006 | +++ b/drivers/usb/core/hcd.c |
1007 | @@ -2535,6 +2535,7 @@ struct usb_hcd *usb_create_shared_hcd(const struct hc_driver *driver, |
1008 | hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex), |
1009 | GFP_KERNEL); |
1010 | if (!hcd->bandwidth_mutex) { |
1011 | + kfree(hcd->address0_mutex); |
1012 | kfree(hcd); |
1013 | dev_dbg(dev, "hcd bandwidth mutex alloc failed\n"); |
1014 | return NULL; |
1015 | diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c |
1016 | index 8714b352e57f..f953d6d647f2 100644 |
1017 | --- a/drivers/usb/core/hub.c |
1018 | +++ b/drivers/usb/core/hub.c |
1019 | @@ -1334,7 +1334,13 @@ static int hub_configure(struct usb_hub *hub, |
1020 | if (ret < 0) { |
1021 | message = "can't read hub descriptor"; |
1022 | goto fail; |
1023 | - } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) { |
1024 | + } |
1025 | + |
1026 | + maxchild = USB_MAXCHILDREN; |
1027 | + if (hub_is_superspeed(hdev)) |
1028 | + maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS); |
1029 | + |
1030 | + if (hub->descriptor->bNbrPorts > maxchild) { |
1031 | message = "hub has too many ports!"; |
1032 | ret = -ENODEV; |
1033 | goto fail; |
1034 | diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c |
1035 | index 2f1fb7e7aa54..9eba51b92f72 100644 |
1036 | --- a/drivers/usb/dwc3/dwc3-exynos.c |
1037 | +++ b/drivers/usb/dwc3/dwc3-exynos.c |
1038 | @@ -148,7 +148,8 @@ static int dwc3_exynos_probe(struct platform_device *pdev) |
1039 | exynos->axius_clk = devm_clk_get(dev, "usbdrd30_axius_clk"); |
1040 | if (IS_ERR(exynos->axius_clk)) { |
1041 | dev_err(dev, "no AXI UpScaler clk specified\n"); |
1042 | - return -ENODEV; |
1043 | + ret = -ENODEV; |
1044 | + goto axius_clk_err; |
1045 | } |
1046 | clk_prepare_enable(exynos->axius_clk); |
1047 | } else { |
1048 | @@ -206,6 +207,7 @@ static int dwc3_exynos_probe(struct platform_device *pdev) |
1049 | regulator_disable(exynos->vdd33); |
1050 | err2: |
1051 | clk_disable_unprepare(exynos->axius_clk); |
1052 | +axius_clk_err: |
1053 | clk_disable_unprepare(exynos->susp_clk); |
1054 | clk_disable_unprepare(exynos->clk); |
1055 | return ret; |
1056 | diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c |
1057 | index c3c5b87b35b3..baa7cdcc0ebc 100644 |
1058 | --- a/drivers/usb/gadget/composite.c |
1059 | +++ b/drivers/usb/gadget/composite.c |
1060 | @@ -2147,7 +2147,7 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev, |
1061 | cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL); |
1062 | if (!cdev->os_desc_req->buf) { |
1063 | ret = -ENOMEM; |
1064 | - kfree(cdev->os_desc_req); |
1065 | + usb_ep_free_request(ep0, cdev->os_desc_req); |
1066 | goto end; |
1067 | } |
1068 | cdev->os_desc_req->context = cdev; |
1069 | diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c |
1070 | index 1468d8f085a3..f959c42ecace 100644 |
1071 | --- a/drivers/usb/gadget/legacy/inode.c |
1072 | +++ b/drivers/usb/gadget/legacy/inode.c |
1073 | @@ -1183,8 +1183,10 @@ dev_release (struct inode *inode, struct file *fd) |
1074 | |
1075 | /* closing ep0 === shutdown all */ |
1076 | |
1077 | - if (dev->gadget_registered) |
1078 | + if (dev->gadget_registered) { |
1079 | usb_gadget_unregister_driver (&gadgetfs_driver); |
1080 | + dev->gadget_registered = false; |
1081 | + } |
1082 | |
1083 | /* at this point "good" hardware has disconnected the |
1084 | * device from USB; the host won't see it any more. |
1085 | @@ -1677,9 +1679,10 @@ static void |
1086 | gadgetfs_suspend (struct usb_gadget *gadget) |
1087 | { |
1088 | struct dev_data *dev = get_gadget_data (gadget); |
1089 | + unsigned long flags; |
1090 | |
1091 | INFO (dev, "suspended from state %d\n", dev->state); |
1092 | - spin_lock (&dev->lock); |
1093 | + spin_lock_irqsave(&dev->lock, flags); |
1094 | switch (dev->state) { |
1095 | case STATE_DEV_SETUP: // VERY odd... host died?? |
1096 | case STATE_DEV_CONNECTED: |
1097 | @@ -1690,7 +1693,7 @@ gadgetfs_suspend (struct usb_gadget *gadget) |
1098 | default: |
1099 | break; |
1100 | } |
1101 | - spin_unlock (&dev->lock); |
1102 | + spin_unlock_irqrestore(&dev->lock, flags); |
1103 | } |
1104 | |
1105 | static struct usb_gadget_driver gadgetfs_driver = { |
1106 | diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c |
1107 | index 4fa5de2eb501..94c8a9f6cbf1 100644 |
1108 | --- a/drivers/usb/gadget/udc/dummy_hcd.c |
1109 | +++ b/drivers/usb/gadget/udc/dummy_hcd.c |
1110 | @@ -442,23 +442,16 @@ static void set_link_state(struct dummy_hcd *dum_hcd) |
1111 | /* Report reset and disconnect events to the driver */ |
1112 | if (dum->driver && (disconnect || reset)) { |
1113 | stop_activity(dum); |
1114 | - spin_unlock(&dum->lock); |
1115 | if (reset) |
1116 | usb_gadget_udc_reset(&dum->gadget, dum->driver); |
1117 | else |
1118 | dum->driver->disconnect(&dum->gadget); |
1119 | - spin_lock(&dum->lock); |
1120 | } |
1121 | } else if (dum_hcd->active != dum_hcd->old_active) { |
1122 | - if (dum_hcd->old_active && dum->driver->suspend) { |
1123 | - spin_unlock(&dum->lock); |
1124 | + if (dum_hcd->old_active && dum->driver->suspend) |
1125 | dum->driver->suspend(&dum->gadget); |
1126 | - spin_lock(&dum->lock); |
1127 | - } else if (!dum_hcd->old_active && dum->driver->resume) { |
1128 | - spin_unlock(&dum->lock); |
1129 | + else if (!dum_hcd->old_active && dum->driver->resume) |
1130 | dum->driver->resume(&dum->gadget); |
1131 | - spin_lock(&dum->lock); |
1132 | - } |
1133 | } |
1134 | |
1135 | dum_hcd->old_status = dum_hcd->port_status; |
1136 | @@ -983,7 +976,9 @@ static int dummy_udc_stop(struct usb_gadget *g) |
1137 | struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g); |
1138 | struct dummy *dum = dum_hcd->dum; |
1139 | |
1140 | + spin_lock_irq(&dum->lock); |
1141 | dum->driver = NULL; |
1142 | + spin_unlock_irq(&dum->lock); |
1143 | |
1144 | return 0; |
1145 | } |
1146 | @@ -2009,7 +2004,7 @@ ss_hub_descriptor(struct usb_hub_descriptor *desc) |
1147 | HUB_CHAR_COMMON_OCPM); |
1148 | desc->bNbrPorts = 1; |
1149 | desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/ |
1150 | - desc->u.ss.DeviceRemovable = 0xffff; |
1151 | + desc->u.ss.DeviceRemovable = 0; |
1152 | } |
1153 | |
1154 | static inline void hub_descriptor(struct usb_hub_descriptor *desc) |
1155 | @@ -2021,8 +2016,8 @@ static inline void hub_descriptor(struct usb_hub_descriptor *desc) |
1156 | HUB_CHAR_INDV_PORT_LPSM | |
1157 | HUB_CHAR_COMMON_OCPM); |
1158 | desc->bNbrPorts = 1; |
1159 | - desc->u.hs.DeviceRemovable[0] = 0xff; |
1160 | - desc->u.hs.DeviceRemovable[1] = 0xff; |
1161 | + desc->u.hs.DeviceRemovable[0] = 0; |
1162 | + desc->u.hs.DeviceRemovable[1] = 0xff; /* PortPwrCtrlMask */ |
1163 | } |
1164 | |
1165 | static int dummy_hub_control( |
1166 | diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c |
1167 | index 61c938c36d88..33f3987218f7 100644 |
1168 | --- a/drivers/usb/gadget/udc/net2280.c |
1169 | +++ b/drivers/usb/gadget/udc/net2280.c |
1170 | @@ -2469,11 +2469,8 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) |
1171 | nuke(&dev->ep[i]); |
1172 | |
1173 | /* report disconnect; the driver is already quiesced */ |
1174 | - if (driver) { |
1175 | - spin_unlock(&dev->lock); |
1176 | + if (driver) |
1177 | driver->disconnect(&dev->gadget); |
1178 | - spin_lock(&dev->lock); |
1179 | - } |
1180 | |
1181 | usb_reinit(dev); |
1182 | } |
1183 | @@ -3347,8 +3344,6 @@ static void handle_stat0_irqs(struct net2280 *dev, u32 stat) |
1184 | BIT(PCI_RETRY_ABORT_INTERRUPT)) |
1185 | |
1186 | static void handle_stat1_irqs(struct net2280 *dev, u32 stat) |
1187 | -__releases(dev->lock) |
1188 | -__acquires(dev->lock) |
1189 | { |
1190 | struct net2280_ep *ep; |
1191 | u32 tmp, num, mask, scratch; |
1192 | @@ -3389,14 +3384,12 @@ __acquires(dev->lock) |
1193 | if (disconnect || reset) { |
1194 | stop_activity(dev, dev->driver); |
1195 | ep0_start(dev); |
1196 | - spin_unlock(&dev->lock); |
1197 | if (reset) |
1198 | usb_gadget_udc_reset |
1199 | (&dev->gadget, dev->driver); |
1200 | else |
1201 | (dev->driver->disconnect) |
1202 | (&dev->gadget); |
1203 | - spin_lock(&dev->lock); |
1204 | return; |
1205 | } |
1206 | } |
1207 | diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c |
1208 | index fb8fc34827ab..ba78e3f7aea8 100644 |
1209 | --- a/drivers/usb/gadget/udc/renesas_usb3.c |
1210 | +++ b/drivers/usb/gadget/udc/renesas_usb3.c |
1211 | @@ -1401,7 +1401,13 @@ static void usb3_request_done_pipen(struct renesas_usb3 *usb3, |
1212 | struct renesas_usb3_request *usb3_req, |
1213 | int status) |
1214 | { |
1215 | - usb3_pn_stop(usb3); |
1216 | + unsigned long flags; |
1217 | + |
1218 | + spin_lock_irqsave(&usb3->lock, flags); |
1219 | + if (usb3_pn_change(usb3, usb3_ep->num)) |
1220 | + usb3_pn_stop(usb3); |
1221 | + spin_unlock_irqrestore(&usb3->lock, flags); |
1222 | + |
1223 | usb3_disable_pipe_irq(usb3, usb3_ep->num); |
1224 | usb3_request_done(usb3_ep, usb3_req, status); |
1225 | |
1226 | @@ -1430,30 +1436,46 @@ static void usb3_irq_epc_pipen_bfrdy(struct renesas_usb3 *usb3, int num) |
1227 | { |
1228 | struct renesas_usb3_ep *usb3_ep = usb3_get_ep(usb3, num); |
1229 | struct renesas_usb3_request *usb3_req = usb3_get_request(usb3_ep); |
1230 | + bool done = false; |
1231 | |
1232 | if (!usb3_req) |
1233 | return; |
1234 | |
1235 | + spin_lock(&usb3->lock); |
1236 | + if (usb3_pn_change(usb3, num)) |
1237 | + goto out; |
1238 | + |
1239 | if (usb3_ep->dir_in) { |
1240 | /* Do not stop the IN pipe here to detect LSTTR interrupt */ |
1241 | if (!usb3_write_pipe(usb3_ep, usb3_req, USB3_PN_WRITE)) |
1242 | usb3_clear_bit(usb3, PN_INT_BFRDY, USB3_PN_INT_ENA); |
1243 | } else { |
1244 | if (!usb3_read_pipe(usb3_ep, usb3_req, USB3_PN_READ)) |
1245 | - usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0); |
1246 | + done = true; |
1247 | } |
1248 | + |
1249 | +out: |
1250 | + /* need to unlock because usb3_request_done_pipen() locks it */ |
1251 | + spin_unlock(&usb3->lock); |
1252 | + |
1253 | + if (done) |
1254 | + usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0); |
1255 | } |
1256 | |
1257 | static void usb3_irq_epc_pipen(struct renesas_usb3 *usb3, int num) |
1258 | { |
1259 | u32 pn_int_sta; |
1260 | |
1261 | - if (usb3_pn_change(usb3, num) < 0) |
1262 | + spin_lock(&usb3->lock); |
1263 | + if (usb3_pn_change(usb3, num) < 0) { |
1264 | + spin_unlock(&usb3->lock); |
1265 | return; |
1266 | + } |
1267 | |
1268 | pn_int_sta = usb3_read(usb3, USB3_PN_INT_STA); |
1269 | pn_int_sta &= usb3_read(usb3, USB3_PN_INT_ENA); |
1270 | usb3_write(usb3, pn_int_sta, USB3_PN_INT_STA); |
1271 | + spin_unlock(&usb3->lock); |
1272 | if (pn_int_sta & PN_INT_LSTTR) |
1273 | usb3_irq_epc_pipen_lsttr(usb3, num); |
1274 | if (pn_int_sta & PN_INT_BFRDY) |
1275 | @@ -1707,6 +1729,9 @@ static int renesas_usb3_start(struct usb_gadget *gadget, |
1276 | /* hook up the driver */ |
1277 | usb3->driver = driver; |
1278 | |
1279 | + pm_runtime_enable(usb3_to_dev(usb3)); |
1280 | + pm_runtime_get_sync(usb3_to_dev(usb3)); |
1281 | + |
1282 | renesas_usb3_init_controller(usb3); |
1283 | |
1284 | return 0; |
1285 | @@ -1715,14 +1740,14 @@ static int renesas_usb3_start(struct usb_gadget *gadget, |
1286 | static int renesas_usb3_stop(struct usb_gadget *gadget) |
1287 | { |
1288 | struct renesas_usb3 *usb3 = gadget_to_renesas_usb3(gadget); |
1289 | - unsigned long flags; |
1290 | |
1291 | - spin_lock_irqsave(&usb3->lock, flags); |
1292 | usb3->softconnect = false; |
1293 | usb3->gadget.speed = USB_SPEED_UNKNOWN; |
1294 | usb3->driver = NULL; |
1295 | renesas_usb3_stop_controller(usb3); |
1296 | - spin_unlock_irqrestore(&usb3->lock, flags); |
1297 | + |
1298 | + pm_runtime_put(usb3_to_dev(usb3)); |
1299 | + pm_runtime_disable(usb3_to_dev(usb3)); |
1300 | |
1301 | return 0; |
1302 | } |
1303 | @@ -1761,9 +1786,6 @@ static int renesas_usb3_remove(struct platform_device *pdev) |
1304 | { |
1305 | struct renesas_usb3 *usb3 = platform_get_drvdata(pdev); |
1306 | |
1307 | - pm_runtime_put(&pdev->dev); |
1308 | - pm_runtime_disable(&pdev->dev); |
1309 | - |
1310 | usb_del_gadget_udc(&usb3->gadget); |
1311 | |
1312 | __renesas_usb3_ep_free_request(usb3->ep0_req); |
1313 | @@ -1948,9 +1970,6 @@ static int renesas_usb3_probe(struct platform_device *pdev) |
1314 | |
1315 | usb3->workaround_for_vbus = priv->workaround_for_vbus; |
1316 | |
1317 | - pm_runtime_enable(&pdev->dev); |
1318 | - pm_runtime_get_sync(&pdev->dev); |
1319 | - |
1320 | dev_info(&pdev->dev, "probed\n"); |
1321 | |
1322 | return 0; |
1323 | diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c |
1324 | index bfa7fa3d2eea..7bf78be1fd32 100644 |
1325 | --- a/drivers/usb/host/r8a66597-hcd.c |
1326 | +++ b/drivers/usb/host/r8a66597-hcd.c |
1327 | @@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td) |
1328 | time = 30; |
1329 | break; |
1330 | default: |
1331 | - time = 300; |
1332 | + time = 50; |
1333 | break; |
1334 | } |
1335 | |
1336 | @@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned long _r8a66597) |
1337 | pipe = td->pipe; |
1338 | pipe_stop(r8a66597, pipe); |
1339 | |
1340 | + /* Select a different address or endpoint */ |
1341 | new_td = td; |
1342 | do { |
1343 | list_move_tail(&new_td->queue, |
1344 | @@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned long _r8a66597) |
1345 | new_td = td; |
1346 | break; |
1347 | } |
1348 | - } while (td != new_td && td->address == new_td->address); |
1349 | + } while (td != new_td && td->address == new_td->address && |
1350 | + td->pipe->info.epnum == new_td->pipe->info.epnum); |
1351 | |
1352 | start_transfer(r8a66597, new_td); |
1353 | |
1354 | diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c |
1355 | index 8c6eafe8966c..b7114c3f52aa 100644 |
1356 | --- a/drivers/usb/host/xhci-mem.c |
1357 | +++ b/drivers/usb/host/xhci-mem.c |
1358 | @@ -2123,11 +2123,12 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports, |
1359 | { |
1360 | u32 temp, port_offset, port_count; |
1361 | int i; |
1362 | - u8 major_revision; |
1363 | + u8 major_revision, minor_revision; |
1364 | struct xhci_hub *rhub; |
1365 | |
1366 | temp = readl(addr); |
1367 | major_revision = XHCI_EXT_PORT_MAJOR(temp); |
1368 | + minor_revision = XHCI_EXT_PORT_MINOR(temp); |
1369 | |
1370 | if (major_revision == 0x03) { |
1371 | rhub = &xhci->usb3_rhub; |
1372 | @@ -2141,7 +2142,9 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports, |
1373 | return; |
1374 | } |
1375 | rhub->maj_rev = XHCI_EXT_PORT_MAJOR(temp); |
1376 | - rhub->min_rev = XHCI_EXT_PORT_MINOR(temp); |
1377 | + |
1378 | + if (rhub->min_rev < minor_revision) |
1379 | + rhub->min_rev = minor_revision; |
1380 | |
1381 | /* Port offset and count in the third dword, see section 7.2 */ |
1382 | temp = readl(addr + 2); |
1383 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c |
1384 | index e7d6752eff32..69864ba38698 100644 |
1385 | --- a/drivers/usb/host/xhci-pci.c |
1386 | +++ b/drivers/usb/host/xhci-pci.c |
1387 | @@ -201,6 +201,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
1388 | if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && |
1389 | pdev->device == 0x1042) |
1390 | xhci->quirks |= XHCI_BROKEN_STREAMS; |
1391 | + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && |
1392 | + pdev->device == 0x1142) |
1393 | + xhci->quirks |= XHCI_TRUST_TX_LENGTH; |
1394 | |
1395 | if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241) |
1396 | xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7; |
1397 | diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c |
1398 | index 9f125e179acd..39666fb911b0 100644 |
1399 | --- a/drivers/usb/musb/musb_dsps.c |
1400 | +++ b/drivers/usb/musb/musb_dsps.c |
1401 | @@ -213,6 +213,12 @@ static int dsps_check_status(struct musb *musb, void *unused) |
1402 | msecs_to_jiffies(wrp->poll_timeout)); |
1403 | break; |
1404 | case OTG_STATE_A_WAIT_BCON: |
1405 | + /* keep VBUS on for host-only mode */ |
1406 | + if (musb->port_mode == MUSB_PORT_MODE_HOST) { |
1407 | + mod_timer(&glue->timer, jiffies + |
1408 | + msecs_to_jiffies(wrp->poll_timeout)); |
1409 | + break; |
1410 | + } |
1411 | musb_writeb(musb->mregs, MUSB_DEVCTL, 0); |
1412 | skip_session = 1; |
1413 | /* fall */ |
1414 | diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c |
1415 | index 03eccf29ace0..d6dc165e924b 100644 |
1416 | --- a/drivers/usb/usbip/vhci_hcd.c |
1417 | +++ b/drivers/usb/usbip/vhci_hcd.c |
1418 | @@ -235,14 +235,19 @@ static int vhci_hub_status(struct usb_hcd *hcd, char *buf) |
1419 | |
1420 | static inline void hub_descriptor(struct usb_hub_descriptor *desc) |
1421 | { |
1422 | + int width; |
1423 | + |
1424 | memset(desc, 0, sizeof(*desc)); |
1425 | desc->bDescriptorType = USB_DT_HUB; |
1426 | - desc->bDescLength = 9; |
1427 | desc->wHubCharacteristics = cpu_to_le16( |
1428 | HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM); |
1429 | + |
1430 | desc->bNbrPorts = VHCI_HC_PORTS; |
1431 | - desc->u.hs.DeviceRemovable[0] = 0xff; |
1432 | - desc->u.hs.DeviceRemovable[1] = 0xff; |
1433 | + BUILD_BUG_ON(VHCI_HC_PORTS > USB_MAXCHILDREN); |
1434 | + width = desc->bNbrPorts / 8 + 1; |
1435 | + desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width; |
1436 | + memset(&desc->u.hs.DeviceRemovable[0], 0, width); |
1437 | + memset(&desc->u.hs.DeviceRemovable[width], 0xff, width); |
1438 | } |
1439 | |
1440 | static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
1441 | diff --git a/fs/btrfs/hash.c b/fs/btrfs/hash.c |
1442 | index a97fdc156a03..baacc1866861 100644 |
1443 | --- a/fs/btrfs/hash.c |
1444 | +++ b/fs/btrfs/hash.c |
1445 | @@ -38,6 +38,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length) |
1446 | { |
1447 | SHASH_DESC_ON_STACK(shash, tfm); |
1448 | u32 *ctx = (u32 *)shash_desc_ctx(shash); |
1449 | + u32 retval; |
1450 | int err; |
1451 | |
1452 | shash->tfm = tfm; |
1453 | @@ -47,5 +48,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length) |
1454 | err = crypto_shash_update(shash, address, length); |
1455 | BUG_ON(err); |
1456 | |
1457 | - return *ctx; |
1458 | + retval = *ctx; |
1459 | + barrier_data(ctx); |
1460 | + return retval; |
1461 | } |
1462 | diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c |
1463 | index db6d69289608..314b4edac72b 100644 |
1464 | --- a/fs/configfs/symlink.c |
1465 | +++ b/fs/configfs/symlink.c |
1466 | @@ -83,14 +83,13 @@ static int create_link(struct config_item *parent_item, |
1467 | ret = -ENOMEM; |
1468 | sl = kmalloc(sizeof(struct configfs_symlink), GFP_KERNEL); |
1469 | if (sl) { |
1470 | - sl->sl_target = config_item_get(item); |
1471 | spin_lock(&configfs_dirent_lock); |
1472 | if (target_sd->s_type & CONFIGFS_USET_DROPPING) { |
1473 | spin_unlock(&configfs_dirent_lock); |
1474 | - config_item_put(item); |
1475 | kfree(sl); |
1476 | return -ENOENT; |
1477 | } |
1478 | + sl->sl_target = config_item_get(item); |
1479 | list_add(&sl->sl_list, &target_sd->s_links); |
1480 | spin_unlock(&configfs_dirent_lock); |
1481 | ret = configfs_create_link(sl, parent_item->ci_dentry, |
1482 | diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h |
1483 | index c12f695923b6..88e111ab068b 100644 |
1484 | --- a/fs/f2fs/f2fs.h |
1485 | +++ b/fs/f2fs/f2fs.h |
1486 | @@ -948,6 +948,7 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address, |
1487 | { |
1488 | SHASH_DESC_ON_STACK(shash, sbi->s_chksum_driver); |
1489 | u32 *ctx = (u32 *)shash_desc_ctx(shash); |
1490 | + u32 retval; |
1491 | int err; |
1492 | |
1493 | shash->tfm = sbi->s_chksum_driver; |
1494 | @@ -957,7 +958,9 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address, |
1495 | err = crypto_shash_update(shash, address, length); |
1496 | BUG_ON(err); |
1497 | |
1498 | - return *ctx; |
1499 | + retval = *ctx; |
1500 | + barrier_data(ctx); |
1501 | + return retval; |
1502 | } |
1503 | |
1504 | static inline bool f2fs_crc_valid(struct f2fs_sb_info *sbi, __u32 blk_crc, |
1505 | diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c |
1506 | index 4fb7b10f3a05..704fa0b17309 100644 |
1507 | --- a/fs/hugetlbfs/inode.c |
1508 | +++ b/fs/hugetlbfs/inode.c |
1509 | @@ -191,7 +191,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, |
1510 | addr = ALIGN(addr, huge_page_size(h)); |
1511 | vma = find_vma(mm, addr); |
1512 | if (TASK_SIZE - len >= addr && |
1513 | - (!vma || addr + len <= vma->vm_start)) |
1514 | + (!vma || addr + len <= vm_start_gap(vma))) |
1515 | return addr; |
1516 | } |
1517 | |
1518 | diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c |
1519 | index b1517b6dcbdd..5138e781737a 100644 |
1520 | --- a/fs/proc/task_mmu.c |
1521 | +++ b/fs/proc/task_mmu.c |
1522 | @@ -299,11 +299,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) |
1523 | |
1524 | /* We don't show the stack guard page in /proc/maps */ |
1525 | start = vma->vm_start; |
1526 | - if (stack_guard_page_start(vma, start)) |
1527 | - start += PAGE_SIZE; |
1528 | end = vma->vm_end; |
1529 | - if (stack_guard_page_end(vma, end)) |
1530 | - end -= PAGE_SIZE; |
1531 | |
1532 | seq_setwidth(m, 25 + sizeof(void *) * 6 - 1); |
1533 | seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ", |
1534 | diff --git a/fs/read_write.c b/fs/read_write.c |
1535 | index 190e0d362581..e479e24dcd4c 100644 |
1536 | --- a/fs/read_write.c |
1537 | +++ b/fs/read_write.c |
1538 | @@ -1232,7 +1232,7 @@ static size_t compat_writev(struct file *file, |
1539 | if (!(file->f_mode & FMODE_CAN_WRITE)) |
1540 | goto out; |
1541 | |
1542 | - ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, 0); |
1543 | + ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, flags); |
1544 | |
1545 | out: |
1546 | if (ret > 0) |
1547 | diff --git a/include/linux/mm.h b/include/linux/mm.h |
1548 | index 0b5b2e4df14e..6c9e1ad12831 100644 |
1549 | --- a/include/linux/mm.h |
1550 | +++ b/include/linux/mm.h |
1551 | @@ -1356,39 +1356,11 @@ int clear_page_dirty_for_io(struct page *page); |
1552 | |
1553 | int get_cmdline(struct task_struct *task, char *buffer, int buflen); |
1554 | |
1555 | -/* Is the vma a continuation of the stack vma above it? */ |
1556 | -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr) |
1557 | -{ |
1558 | - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN); |
1559 | -} |
1560 | - |
1561 | static inline bool vma_is_anonymous(struct vm_area_struct *vma) |
1562 | { |
1563 | return !vma->vm_ops; |
1564 | } |
1565 | |
1566 | -static inline int stack_guard_page_start(struct vm_area_struct *vma, |
1567 | - unsigned long addr) |
1568 | -{ |
1569 | - return (vma->vm_flags & VM_GROWSDOWN) && |
1570 | - (vma->vm_start == addr) && |
1571 | - !vma_growsdown(vma->vm_prev, addr); |
1572 | -} |
1573 | - |
1574 | -/* Is the vma a continuation of the stack vma below it? */ |
1575 | -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr) |
1576 | -{ |
1577 | - return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP); |
1578 | -} |
1579 | - |
1580 | -static inline int stack_guard_page_end(struct vm_area_struct *vma, |
1581 | - unsigned long addr) |
1582 | -{ |
1583 | - return (vma->vm_flags & VM_GROWSUP) && |
1584 | - (vma->vm_end == addr) && |
1585 | - !vma_growsup(vma->vm_next, addr); |
1586 | -} |
1587 | - |
1588 | int vma_is_stack_for_current(struct vm_area_struct *vma); |
1589 | |
1590 | extern unsigned long move_page_tables(struct vm_area_struct *vma, |
1591 | @@ -2127,6 +2099,7 @@ void page_cache_async_readahead(struct address_space *mapping, |
1592 | pgoff_t offset, |
1593 | unsigned long size); |
1594 | |
1595 | +extern unsigned long stack_guard_gap; |
1596 | /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */ |
1597 | extern int expand_stack(struct vm_area_struct *vma, unsigned long address); |
1598 | |
1599 | @@ -2155,6 +2128,30 @@ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * m |
1600 | return vma; |
1601 | } |
1602 | |
1603 | +static inline unsigned long vm_start_gap(struct vm_area_struct *vma) |
1604 | +{ |
1605 | + unsigned long vm_start = vma->vm_start; |
1606 | + |
1607 | + if (vma->vm_flags & VM_GROWSDOWN) { |
1608 | + vm_start -= stack_guard_gap; |
1609 | + if (vm_start > vma->vm_start) |
1610 | + vm_start = 0; |
1611 | + } |
1612 | + return vm_start; |
1613 | +} |
1614 | + |
1615 | +static inline unsigned long vm_end_gap(struct vm_area_struct *vma) |
1616 | +{ |
1617 | + unsigned long vm_end = vma->vm_end; |
1618 | + |
1619 | + if (vma->vm_flags & VM_GROWSUP) { |
1620 | + vm_end += stack_guard_gap; |
1621 | + if (vm_end < vma->vm_end) |
1622 | + vm_end = -PAGE_SIZE; |
1623 | + } |
1624 | + return vm_end; |
1625 | +} |
1626 | + |
1627 | static inline unsigned long vma_pages(struct vm_area_struct *vma) |
1628 | { |
1629 | return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT; |
1630 | diff --git a/include/uapi/linux/usb/ch11.h b/include/uapi/linux/usb/ch11.h |
1631 | index 361297e96f58..576c704e3fb8 100644 |
1632 | --- a/include/uapi/linux/usb/ch11.h |
1633 | +++ b/include/uapi/linux/usb/ch11.h |
1634 | @@ -22,6 +22,9 @@ |
1635 | */ |
1636 | #define USB_MAXCHILDREN 31 |
1637 | |
1638 | +/* See USB 3.1 spec Table 10-5 */ |
1639 | +#define USB_SS_MAXPORTS 15 |
1640 | + |
1641 | /* |
1642 | * Hub request types |
1643 | */ |
1644 | diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c |
1645 | index 6b669593e7eb..ea41820ab12e 100644 |
1646 | --- a/kernel/irq/manage.c |
1647 | +++ b/kernel/irq/manage.c |
1648 | @@ -1308,8 +1308,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) |
1649 | ret = __irq_set_trigger(desc, |
1650 | new->flags & IRQF_TRIGGER_MASK); |
1651 | |
1652 | - if (ret) |
1653 | + if (ret) { |
1654 | + irq_release_resources(desc); |
1655 | goto out_mask; |
1656 | + } |
1657 | } |
1658 | |
1659 | desc->istate &= ~(IRQS_AUTODETECT | IRQS_SPURIOUS_DISABLED | \ |
1660 | diff --git a/kernel/sched/core.c b/kernel/sched/core.c |
1661 | index 154fd689fe02..692c948ae333 100644 |
1662 | --- a/kernel/sched/core.c |
1663 | +++ b/kernel/sched/core.c |
1664 | @@ -5469,7 +5469,7 @@ void idle_task_exit(void) |
1665 | BUG_ON(cpu_online(smp_processor_id())); |
1666 | |
1667 | if (mm != &init_mm) { |
1668 | - switch_mm_irqs_off(mm, &init_mm, current); |
1669 | + switch_mm(mm, &init_mm, current); |
1670 | finish_arch_post_lock_switch(); |
1671 | } |
1672 | mmdrop(mm); |
1673 | diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c |
1674 | index 12dd190634ab..9ba04aa740b9 100644 |
1675 | --- a/kernel/time/alarmtimer.c |
1676 | +++ b/kernel/time/alarmtimer.c |
1677 | @@ -354,7 +354,7 @@ void alarm_start_relative(struct alarm *alarm, ktime_t start) |
1678 | { |
1679 | struct alarm_base *base = &alarm_bases[alarm->type]; |
1680 | |
1681 | - start = ktime_add(start, base->gettime()); |
1682 | + start = ktime_add_safe(start, base->gettime()); |
1683 | alarm_start(alarm, start); |
1684 | } |
1685 | EXPORT_SYMBOL_GPL(alarm_start_relative); |
1686 | @@ -440,7 +440,7 @@ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval) |
1687 | overrun++; |
1688 | } |
1689 | |
1690 | - alarm->node.expires = ktime_add(alarm->node.expires, interval); |
1691 | + alarm->node.expires = ktime_add_safe(alarm->node.expires, interval); |
1692 | return overrun; |
1693 | } |
1694 | EXPORT_SYMBOL_GPL(alarm_forward); |
1695 | @@ -624,13 +624,21 @@ static int alarm_timer_set(struct k_itimer *timr, int flags, |
1696 | |
1697 | /* start the timer */ |
1698 | timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval); |
1699 | + |
1700 | + /* |
1701 | + * Rate limit to the tick as a hot fix to prevent DOS. Will be |
1702 | + * mopped up later. |
1703 | + */ |
1704 | + if (ktime_to_ns(timr->it.alarm.interval) < TICK_NSEC) |
1705 | + timr->it.alarm.interval = ktime_set(0, TICK_NSEC); |
1706 | + |
1707 | exp = timespec_to_ktime(new_setting->it_value); |
1708 | /* Convert (if necessary) to absolute time */ |
1709 | if (flags != TIMER_ABSTIME) { |
1710 | ktime_t now; |
1711 | |
1712 | now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime(); |
1713 | - exp = ktime_add(now, exp); |
1714 | + exp = ktime_add_safe(now, exp); |
1715 | } |
1716 | |
1717 | alarm_start(&timr->it.alarm.alarmtimer, exp); |
1718 | diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c |
1719 | index 74a54b7f2562..9f79547d1b97 100644 |
1720 | --- a/lib/libcrc32c.c |
1721 | +++ b/lib/libcrc32c.c |
1722 | @@ -43,7 +43,7 @@ static struct crypto_shash *tfm; |
1723 | u32 crc32c(u32 crc, const void *address, unsigned int length) |
1724 | { |
1725 | SHASH_DESC_ON_STACK(shash, tfm); |
1726 | - u32 *ctx = (u32 *)shash_desc_ctx(shash); |
1727 | + u32 ret, *ctx = (u32 *)shash_desc_ctx(shash); |
1728 | int err; |
1729 | |
1730 | shash->tfm = tfm; |
1731 | @@ -53,7 +53,9 @@ u32 crc32c(u32 crc, const void *address, unsigned int length) |
1732 | err = crypto_shash_update(shash, address, length); |
1733 | BUG_ON(err); |
1734 | |
1735 | - return *ctx; |
1736 | + ret = *ctx; |
1737 | + barrier_data(ctx); |
1738 | + return ret; |
1739 | } |
1740 | |
1741 | EXPORT_SYMBOL(crc32c); |
1742 | diff --git a/mm/gup.c b/mm/gup.c |
1743 | index ec4f82704b6f..c63a0341ae38 100644 |
1744 | --- a/mm/gup.c |
1745 | +++ b/mm/gup.c |
1746 | @@ -370,11 +370,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma, |
1747 | /* mlock all present pages, but do not fault in new pages */ |
1748 | if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK) |
1749 | return -ENOENT; |
1750 | - /* For mm_populate(), just skip the stack guard page. */ |
1751 | - if ((*flags & FOLL_POPULATE) && |
1752 | - (stack_guard_page_start(vma, address) || |
1753 | - stack_guard_page_end(vma, address + PAGE_SIZE))) |
1754 | - return -ENOENT; |
1755 | if (*flags & FOLL_WRITE) |
1756 | fault_flags |= FAULT_FLAG_WRITE; |
1757 | if (*flags & FOLL_REMOTE) |
1758 | diff --git a/mm/memory-failure.c b/mm/memory-failure.c |
1759 | index 4bd44803e366..ce7d416edab7 100644 |
1760 | --- a/mm/memory-failure.c |
1761 | +++ b/mm/memory-failure.c |
1762 | @@ -1176,7 +1176,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags) |
1763 | * page_remove_rmap() in try_to_unmap_one(). So to determine page status |
1764 | * correctly, we save a copy of the page flags at this time. |
1765 | */ |
1766 | - page_flags = p->flags; |
1767 | + if (PageHuge(p)) |
1768 | + page_flags = hpage->flags; |
1769 | + else |
1770 | + page_flags = p->flags; |
1771 | |
1772 | /* |
1773 | * unpoison always clear PG_hwpoison inside page lock |
1774 | diff --git a/mm/memory.c b/mm/memory.c |
1775 | index cbb1e5e5f791..e6a5a1f20492 100644 |
1776 | --- a/mm/memory.c |
1777 | +++ b/mm/memory.c |
1778 | @@ -2699,40 +2699,6 @@ int do_swap_page(struct fault_env *fe, pte_t orig_pte) |
1779 | } |
1780 | |
1781 | /* |
1782 | - * This is like a special single-page "expand_{down|up}wards()", |
1783 | - * except we must first make sure that 'address{-|+}PAGE_SIZE' |
1784 | - * doesn't hit another vma. |
1785 | - */ |
1786 | -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address) |
1787 | -{ |
1788 | - address &= PAGE_MASK; |
1789 | - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) { |
1790 | - struct vm_area_struct *prev = vma->vm_prev; |
1791 | - |
1792 | - /* |
1793 | - * Is there a mapping abutting this one below? |
1794 | - * |
1795 | - * That's only ok if it's the same stack mapping |
1796 | - * that has gotten split.. |
1797 | - */ |
1798 | - if (prev && prev->vm_end == address) |
1799 | - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM; |
1800 | - |
1801 | - return expand_downwards(vma, address - PAGE_SIZE); |
1802 | - } |
1803 | - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) { |
1804 | - struct vm_area_struct *next = vma->vm_next; |
1805 | - |
1806 | - /* As VM_GROWSDOWN but s/below/above/ */ |
1807 | - if (next && next->vm_start == address + PAGE_SIZE) |
1808 | - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM; |
1809 | - |
1810 | - return expand_upwards(vma, address + PAGE_SIZE); |
1811 | - } |
1812 | - return 0; |
1813 | -} |
1814 | - |
1815 | -/* |
1816 | * We enter with non-exclusive mmap_sem (to exclude vma changes, |
1817 | * but allow concurrent faults), and pte mapped but not yet locked. |
1818 | * We return with mmap_sem still held, but pte unmapped and unlocked. |
1819 | @@ -2748,10 +2714,6 @@ static int do_anonymous_page(struct fault_env *fe) |
1820 | if (vma->vm_flags & VM_SHARED) |
1821 | return VM_FAULT_SIGBUS; |
1822 | |
1823 | - /* Check if we need to add a guard page to the stack */ |
1824 | - if (check_stack_guard_page(vma, fe->address) < 0) |
1825 | - return VM_FAULT_SIGSEGV; |
1826 | - |
1827 | /* |
1828 | * Use pte_alloc() instead of pte_alloc_map(). We can't run |
1829 | * pte_offset_map() on pmds where a huge pmd might be created |
1830 | diff --git a/mm/mmap.c b/mm/mmap.c |
1831 | index 1af87c14183d..145d3d5253e8 100644 |
1832 | --- a/mm/mmap.c |
1833 | +++ b/mm/mmap.c |
1834 | @@ -183,6 +183,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) |
1835 | unsigned long retval; |
1836 | unsigned long newbrk, oldbrk; |
1837 | struct mm_struct *mm = current->mm; |
1838 | + struct vm_area_struct *next; |
1839 | unsigned long min_brk; |
1840 | bool populate; |
1841 | |
1842 | @@ -228,7 +229,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) |
1843 | } |
1844 | |
1845 | /* Check against existing mmap mappings. */ |
1846 | - if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE)) |
1847 | + next = find_vma(mm, oldbrk); |
1848 | + if (next && newbrk + PAGE_SIZE > vm_start_gap(next)) |
1849 | goto out; |
1850 | |
1851 | /* Ok, looks good - let it rip. */ |
1852 | @@ -251,10 +253,22 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) |
1853 | |
1854 | static long vma_compute_subtree_gap(struct vm_area_struct *vma) |
1855 | { |
1856 | - unsigned long max, subtree_gap; |
1857 | - max = vma->vm_start; |
1858 | - if (vma->vm_prev) |
1859 | - max -= vma->vm_prev->vm_end; |
1860 | + unsigned long max, prev_end, subtree_gap; |
1861 | + |
1862 | + /* |
1863 | + * Note: in the rare case of a VM_GROWSDOWN above a VM_GROWSUP, we |
1864 | + * allow two stack_guard_gaps between them here, and when choosing |
1865 | + * an unmapped area; whereas when expanding we only require one. |
1866 | + * That's a little inconsistent, but keeps the code here simpler. |
1867 | + */ |
1868 | + max = vm_start_gap(vma); |
1869 | + if (vma->vm_prev) { |
1870 | + prev_end = vm_end_gap(vma->vm_prev); |
1871 | + if (max > prev_end) |
1872 | + max -= prev_end; |
1873 | + else |
1874 | + max = 0; |
1875 | + } |
1876 | if (vma->vm_rb.rb_left) { |
1877 | subtree_gap = rb_entry(vma->vm_rb.rb_left, |
1878 | struct vm_area_struct, vm_rb)->rb_subtree_gap; |
1879 | @@ -350,7 +364,7 @@ static void validate_mm(struct mm_struct *mm) |
1880 | anon_vma_unlock_read(anon_vma); |
1881 | } |
1882 | |
1883 | - highest_address = vma->vm_end; |
1884 | + highest_address = vm_end_gap(vma); |
1885 | vma = vma->vm_next; |
1886 | i++; |
1887 | } |
1888 | @@ -539,7 +553,7 @@ void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma, |
1889 | if (vma->vm_next) |
1890 | vma_gap_update(vma->vm_next); |
1891 | else |
1892 | - mm->highest_vm_end = vma->vm_end; |
1893 | + mm->highest_vm_end = vm_end_gap(vma); |
1894 | |
1895 | /* |
1896 | * vma->vm_prev wasn't known when we followed the rbtree to find the |
1897 | @@ -854,7 +868,7 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, |
1898 | vma_gap_update(vma); |
1899 | if (end_changed) { |
1900 | if (!next) |
1901 | - mm->highest_vm_end = end; |
1902 | + mm->highest_vm_end = vm_end_gap(vma); |
1903 | else if (!adjust_next) |
1904 | vma_gap_update(next); |
1905 | } |
1906 | @@ -939,7 +953,7 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, |
1907 | * mm->highest_vm_end doesn't need any update |
1908 | * in remove_next == 1 case. |
1909 | */ |
1910 | - VM_WARN_ON(mm->highest_vm_end != end); |
1911 | + VM_WARN_ON(mm->highest_vm_end != vm_end_gap(vma)); |
1912 | } |
1913 | } |
1914 | if (insert && file) |
1915 | @@ -1783,7 +1797,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) |
1916 | |
1917 | while (true) { |
1918 | /* Visit left subtree if it looks promising */ |
1919 | - gap_end = vma->vm_start; |
1920 | + gap_end = vm_start_gap(vma); |
1921 | if (gap_end >= low_limit && vma->vm_rb.rb_left) { |
1922 | struct vm_area_struct *left = |
1923 | rb_entry(vma->vm_rb.rb_left, |
1924 | @@ -1794,12 +1808,13 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) |
1925 | } |
1926 | } |
1927 | |
1928 | - gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0; |
1929 | + gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0; |
1930 | check_current: |
1931 | /* Check if current node has a suitable gap */ |
1932 | if (gap_start > high_limit) |
1933 | return -ENOMEM; |
1934 | - if (gap_end >= low_limit && gap_end - gap_start >= length) |
1935 | + if (gap_end >= low_limit && |
1936 | + gap_end > gap_start && gap_end - gap_start >= length) |
1937 | goto found; |
1938 | |
1939 | /* Visit right subtree if it looks promising */ |
1940 | @@ -1821,8 +1836,8 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) |
1941 | vma = rb_entry(rb_parent(prev), |
1942 | struct vm_area_struct, vm_rb); |
1943 | if (prev == vma->vm_rb.rb_left) { |
1944 | - gap_start = vma->vm_prev->vm_end; |
1945 | - gap_end = vma->vm_start; |
1946 | + gap_start = vm_end_gap(vma->vm_prev); |
1947 | + gap_end = vm_start_gap(vma); |
1948 | goto check_current; |
1949 | } |
1950 | } |
1951 | @@ -1886,7 +1901,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) |
1952 | |
1953 | while (true) { |
1954 | /* Visit right subtree if it looks promising */ |
1955 | - gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0; |
1956 | + gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0; |
1957 | if (gap_start <= high_limit && vma->vm_rb.rb_right) { |
1958 | struct vm_area_struct *right = |
1959 | rb_entry(vma->vm_rb.rb_right, |
1960 | @@ -1899,10 +1914,11 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) |
1961 | |
1962 | check_current: |
1963 | /* Check if current node has a suitable gap */ |
1964 | - gap_end = vma->vm_start; |
1965 | + gap_end = vm_start_gap(vma); |
1966 | if (gap_end < low_limit) |
1967 | return -ENOMEM; |
1968 | - if (gap_start <= high_limit && gap_end - gap_start >= length) |
1969 | + if (gap_start <= high_limit && |
1970 | + gap_end > gap_start && gap_end - gap_start >= length) |
1971 | goto found; |
1972 | |
1973 | /* Visit left subtree if it looks promising */ |
1974 | @@ -1925,7 +1941,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) |
1975 | struct vm_area_struct, vm_rb); |
1976 | if (prev == vma->vm_rb.rb_right) { |
1977 | gap_start = vma->vm_prev ? |
1978 | - vma->vm_prev->vm_end : 0; |
1979 | + vm_end_gap(vma->vm_prev) : 0; |
1980 | goto check_current; |
1981 | } |
1982 | } |
1983 | @@ -1963,7 +1979,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, |
1984 | unsigned long len, unsigned long pgoff, unsigned long flags) |
1985 | { |
1986 | struct mm_struct *mm = current->mm; |
1987 | - struct vm_area_struct *vma; |
1988 | + struct vm_area_struct *vma, *prev; |
1989 | struct vm_unmapped_area_info info; |
1990 | |
1991 | if (len > TASK_SIZE - mmap_min_addr) |
1992 | @@ -1974,9 +1990,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, |
1993 | |
1994 | if (addr) { |
1995 | addr = PAGE_ALIGN(addr); |
1996 | - vma = find_vma(mm, addr); |
1997 | + vma = find_vma_prev(mm, addr, &prev); |
1998 | if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && |
1999 | - (!vma || addr + len <= vma->vm_start)) |
2000 | + (!vma || addr + len <= vm_start_gap(vma)) && |
2001 | + (!prev || addr >= vm_end_gap(prev))) |
2002 | return addr; |
2003 | } |
2004 | |
2005 | @@ -1999,7 +2016,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
2006 | const unsigned long len, const unsigned long pgoff, |
2007 | const unsigned long flags) |
2008 | { |
2009 | - struct vm_area_struct *vma; |
2010 | + struct vm_area_struct *vma, *prev; |
2011 | struct mm_struct *mm = current->mm; |
2012 | unsigned long addr = addr0; |
2013 | struct vm_unmapped_area_info info; |
2014 | @@ -2014,9 +2031,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, |
2015 | /* requesting a specific address */ |
2016 | if (addr) { |
2017 | addr = PAGE_ALIGN(addr); |
2018 | - vma = find_vma(mm, addr); |
2019 | + vma = find_vma_prev(mm, addr, &prev); |
2020 | if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && |
2021 | - (!vma || addr + len <= vma->vm_start)) |
2022 | + (!vma || addr + len <= vm_start_gap(vma)) && |
2023 | + (!prev || addr >= vm_end_gap(prev))) |
2024 | return addr; |
2025 | } |
2026 | |
2027 | @@ -2151,21 +2169,19 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr, |
2028 | * update accounting. This is shared with both the |
2029 | * grow-up and grow-down cases. |
2030 | */ |
2031 | -static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, unsigned long grow) |
2032 | +static int acct_stack_growth(struct vm_area_struct *vma, |
2033 | + unsigned long size, unsigned long grow) |
2034 | { |
2035 | struct mm_struct *mm = vma->vm_mm; |
2036 | struct rlimit *rlim = current->signal->rlim; |
2037 | - unsigned long new_start, actual_size; |
2038 | + unsigned long new_start; |
2039 | |
2040 | /* address space limit tests */ |
2041 | if (!may_expand_vm(mm, vma->vm_flags, grow)) |
2042 | return -ENOMEM; |
2043 | |
2044 | /* Stack limit test */ |
2045 | - actual_size = size; |
2046 | - if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN))) |
2047 | - actual_size -= PAGE_SIZE; |
2048 | - if (actual_size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur)) |
2049 | + if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur)) |
2050 | return -ENOMEM; |
2051 | |
2052 | /* mlock limit tests */ |
2053 | @@ -2203,16 +2219,32 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns |
2054 | int expand_upwards(struct vm_area_struct *vma, unsigned long address) |
2055 | { |
2056 | struct mm_struct *mm = vma->vm_mm; |
2057 | + struct vm_area_struct *next; |
2058 | + unsigned long gap_addr; |
2059 | int error = 0; |
2060 | |
2061 | if (!(vma->vm_flags & VM_GROWSUP)) |
2062 | return -EFAULT; |
2063 | |
2064 | - /* Guard against wrapping around to address 0. */ |
2065 | - if (address < PAGE_ALIGN(address+4)) |
2066 | - address = PAGE_ALIGN(address+4); |
2067 | - else |
2068 | + /* Guard against exceeding limits of the address space. */ |
2069 | + address &= PAGE_MASK; |
2070 | + if (address >= TASK_SIZE) |
2071 | return -ENOMEM; |
2072 | + address += PAGE_SIZE; |
2073 | + |
2074 | + /* Enforce stack_guard_gap */ |
2075 | + gap_addr = address + stack_guard_gap; |
2076 | + |
2077 | + /* Guard against overflow */ |
2078 | + if (gap_addr < address || gap_addr > TASK_SIZE) |
2079 | + gap_addr = TASK_SIZE; |
2080 | + |
2081 | + next = vma->vm_next; |
2082 | + if (next && next->vm_start < gap_addr) { |
2083 | + if (!(next->vm_flags & VM_GROWSUP)) |
2084 | + return -ENOMEM; |
2085 | + /* Check that both stack segments have the same anon_vma? */ |
2086 | + } |
2087 | |
2088 | /* We must make sure the anon_vma is allocated. */ |
2089 | if (unlikely(anon_vma_prepare(vma))) |
2090 | @@ -2257,7 +2289,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) |
2091 | if (vma->vm_next) |
2092 | vma_gap_update(vma->vm_next); |
2093 | else |
2094 | - mm->highest_vm_end = address; |
2095 | + mm->highest_vm_end = vm_end_gap(vma); |
2096 | spin_unlock(&mm->page_table_lock); |
2097 | |
2098 | perf_event_mmap(vma); |
2099 | @@ -2278,6 +2310,8 @@ int expand_downwards(struct vm_area_struct *vma, |
2100 | unsigned long address) |
2101 | { |
2102 | struct mm_struct *mm = vma->vm_mm; |
2103 | + struct vm_area_struct *prev; |
2104 | + unsigned long gap_addr; |
2105 | int error; |
2106 | |
2107 | address &= PAGE_MASK; |
2108 | @@ -2285,6 +2319,17 @@ int expand_downwards(struct vm_area_struct *vma, |
2109 | if (error) |
2110 | return error; |
2111 | |
2112 | + /* Enforce stack_guard_gap */ |
2113 | + gap_addr = address - stack_guard_gap; |
2114 | + if (gap_addr > address) |
2115 | + return -ENOMEM; |
2116 | + prev = vma->vm_prev; |
2117 | + if (prev && prev->vm_end > gap_addr) { |
2118 | + if (!(prev->vm_flags & VM_GROWSDOWN)) |
2119 | + return -ENOMEM; |
2120 | + /* Check that both stack segments have the same anon_vma? */ |
2121 | + } |
2122 | + |
2123 | /* We must make sure the anon_vma is allocated. */ |
2124 | if (unlikely(anon_vma_prepare(vma))) |
2125 | return -ENOMEM; |
2126 | @@ -2339,28 +2384,25 @@ int expand_downwards(struct vm_area_struct *vma, |
2127 | return error; |
2128 | } |
2129 | |
2130 | -/* |
2131 | - * Note how expand_stack() refuses to expand the stack all the way to |
2132 | - * abut the next virtual mapping, *unless* that mapping itself is also |
2133 | - * a stack mapping. We want to leave room for a guard page, after all |
2134 | - * (the guard page itself is not added here, that is done by the |
2135 | - * actual page faulting logic) |
2136 | - * |
2137 | - * This matches the behavior of the guard page logic (see mm/memory.c: |
2138 | - * check_stack_guard_page()), which only allows the guard page to be |
2139 | - * removed under these circumstances. |
2140 | - */ |
2141 | +/* enforced gap between the expanding stack and other mappings. */ |
2142 | +unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT; |
2143 | + |
2144 | +static int __init cmdline_parse_stack_guard_gap(char *p) |
2145 | +{ |
2146 | + unsigned long val; |
2147 | + char *endptr; |
2148 | + |
2149 | + val = simple_strtoul(p, &endptr, 10); |
2150 | + if (!*endptr) |
2151 | + stack_guard_gap = val << PAGE_SHIFT; |
2152 | + |
2153 | + return 0; |
2154 | +} |
2155 | +__setup("stack_guard_gap=", cmdline_parse_stack_guard_gap); |
2156 | + |
2157 | #ifdef CONFIG_STACK_GROWSUP |
2158 | int expand_stack(struct vm_area_struct *vma, unsigned long address) |
2159 | { |
2160 | - struct vm_area_struct *next; |
2161 | - |
2162 | - address &= PAGE_MASK; |
2163 | - next = vma->vm_next; |
2164 | - if (next && next->vm_start == address + PAGE_SIZE) { |
2165 | - if (!(next->vm_flags & VM_GROWSUP)) |
2166 | - return -ENOMEM; |
2167 | - } |
2168 | return expand_upwards(vma, address); |
2169 | } |
2170 | |
2171 | @@ -2382,14 +2424,6 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) |
2172 | #else |
2173 | int expand_stack(struct vm_area_struct *vma, unsigned long address) |
2174 | { |
2175 | - struct vm_area_struct *prev; |
2176 | - |
2177 | - address &= PAGE_MASK; |
2178 | - prev = vma->vm_prev; |
2179 | - if (prev && prev->vm_end == address) { |
2180 | - if (!(prev->vm_flags & VM_GROWSDOWN)) |
2181 | - return -ENOMEM; |
2182 | - } |
2183 | return expand_downwards(vma, address); |
2184 | } |
2185 | |
2186 | @@ -2487,7 +2521,7 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma, |
2187 | vma->vm_prev = prev; |
2188 | vma_gap_update(vma); |
2189 | } else |
2190 | - mm->highest_vm_end = prev ? prev->vm_end : 0; |
2191 | + mm->highest_vm_end = prev ? vm_end_gap(prev) : 0; |
2192 | tail_vma->vm_next = NULL; |
2193 | |
2194 | /* Kill the cache */ |
2195 | diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c |
2196 | index 310ac0b8f974..454d6d7509ed 100644 |
2197 | --- a/mm/swap_cgroup.c |
2198 | +++ b/mm/swap_cgroup.c |
2199 | @@ -48,6 +48,9 @@ static int swap_cgroup_prepare(int type) |
2200 | if (!page) |
2201 | goto not_enough_page; |
2202 | ctrl->map[idx] = page; |
2203 | + |
2204 | + if (!(idx % SWAP_CLUSTER_MAX)) |
2205 | + cond_resched(); |
2206 | } |
2207 | return 0; |
2208 | not_enough_page: |
2209 | diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c |
2210 | index e604013dd814..7a5b9812af10 100644 |
2211 | --- a/net/ipv6/ila/ila_xlat.c |
2212 | +++ b/net/ipv6/ila/ila_xlat.c |
2213 | @@ -68,6 +68,7 @@ static inline u32 ila_locator_hash(struct ila_locator loc) |
2214 | { |
2215 | u32 *v = (u32 *)loc.v32; |
2216 | |
2217 | + __ila_hash_secret_init(); |
2218 | return jhash_2words(v[0], v[1], hashrnd); |
2219 | } |
2220 | |
2221 | diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c |
2222 | index fd6541f3ade3..07001b6d36cc 100644 |
2223 | --- a/net/mac80211/cfg.c |
2224 | +++ b/net/mac80211/cfg.c |
2225 | @@ -865,6 +865,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev, |
2226 | default: |
2227 | return -EINVAL; |
2228 | } |
2229 | + sdata->u.ap.req_smps = sdata->smps_mode; |
2230 | + |
2231 | sdata->needed_rx_chains = sdata->local->rx_chains; |
2232 | |
2233 | mutex_lock(&local->mtx); |
2234 | diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c |
2235 | index a31d30713d08..62d13eabe17f 100644 |
2236 | --- a/net/mac80211/ibss.c |
2237 | +++ b/net/mac80211/ibss.c |
2238 | @@ -66,6 +66,8 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata, |
2239 | 2 + (IEEE80211_MAX_SUPP_RATES - 8) + |
2240 | 2 + sizeof(struct ieee80211_ht_cap) + |
2241 | 2 + sizeof(struct ieee80211_ht_operation) + |
2242 | + 2 + sizeof(struct ieee80211_vht_cap) + |
2243 | + 2 + sizeof(struct ieee80211_vht_operation) + |
2244 | ifibss->ie_len; |
2245 | presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL); |
2246 | if (!presp) |
2247 | @@ -487,14 +489,14 @@ int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata, |
2248 | struct beacon_data *presp, *old_presp; |
2249 | struct cfg80211_bss *cbss; |
2250 | const struct cfg80211_bss_ies *ies; |
2251 | - u16 capability = 0; |
2252 | + u16 capability = WLAN_CAPABILITY_IBSS; |
2253 | u64 tsf; |
2254 | int ret = 0; |
2255 | |
2256 | sdata_assert_lock(sdata); |
2257 | |
2258 | if (ifibss->privacy) |
2259 | - capability = WLAN_CAPABILITY_PRIVACY; |
2260 | + capability |= WLAN_CAPABILITY_PRIVACY; |
2261 | |
2262 | cbss = cfg80211_get_bss(sdata->local->hw.wiphy, ifibss->chandef.chan, |
2263 | ifibss->bssid, ifibss->ssid, |
2264 | diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c |
2265 | index acaaf616da71..c45a0fcfb3e7 100644 |
2266 | --- a/net/mac80211/rx.c |
2267 | +++ b/net/mac80211/rx.c |
2268 | @@ -1585,12 +1585,16 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) |
2269 | */ |
2270 | if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) && |
2271 | !ieee80211_has_morefrags(hdr->frame_control) && |
2272 | + !ieee80211_is_back_req(hdr->frame_control) && |
2273 | !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && |
2274 | (rx->sdata->vif.type == NL80211_IFTYPE_AP || |
2275 | rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && |
2276 | - /* PM bit is only checked in frames where it isn't reserved, |
2277 | + /* |
2278 | + * PM bit is only checked in frames where it isn't reserved, |
2279 | * in AP mode it's reserved in non-bufferable management frames |
2280 | * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field) |
2281 | + * BAR frames should be ignored as specified in |
2282 | + * IEEE 802.11-2012 10.2.1.2. |
2283 | */ |
2284 | (!ieee80211_is_mgmt(hdr->frame_control) || |
2285 | ieee80211_is_bufferable_mmpdu(hdr->frame_control))) { |
2286 | @@ -2467,7 +2471,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) |
2287 | if (is_multicast_ether_addr(hdr->addr1)) { |
2288 | mpp_addr = hdr->addr3; |
2289 | proxied_addr = mesh_hdr->eaddr1; |
2290 | - } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) { |
2291 | + } else if ((mesh_hdr->flags & MESH_FLAGS_AE) == |
2292 | + MESH_FLAGS_AE_A5_A6) { |
2293 | /* has_a4 already checked in ieee80211_rx_mesh_check */ |
2294 | mpp_addr = hdr->addr4; |
2295 | proxied_addr = mesh_hdr->eaddr2; |
2296 | @@ -3949,6 +3954,7 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, |
2297 | stats->last_rate = sta_stats_encode_rate(status); |
2298 | |
2299 | stats->fragments++; |
2300 | + stats->packets++; |
2301 | |
2302 | if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { |
2303 | stats->last_signal = status->signal; |
2304 | diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c |
2305 | index 8e05032689f0..b2c823ffad74 100644 |
2306 | --- a/net/mac80211/sta_info.c |
2307 | +++ b/net/mac80211/sta_info.c |
2308 | @@ -2148,7 +2148,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo) |
2309 | struct ieee80211_sta_rx_stats *cpurxs; |
2310 | |
2311 | cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu); |
2312 | - sinfo->rx_packets += cpurxs->dropped; |
2313 | + sinfo->rx_dropped_misc += cpurxs->dropped; |
2314 | } |
2315 | } |
2316 | |
2317 | diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c |
2318 | index 42ce9bd4426f..5c71d60f3a64 100644 |
2319 | --- a/net/mac80211/wpa.c |
2320 | +++ b/net/mac80211/wpa.c |
2321 | @@ -17,6 +17,7 @@ |
2322 | #include <asm/unaligned.h> |
2323 | #include <net/mac80211.h> |
2324 | #include <crypto/aes.h> |
2325 | +#include <crypto/algapi.h> |
2326 | |
2327 | #include "ieee80211_i.h" |
2328 | #include "michael.h" |
2329 | @@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) |
2330 | data_len = skb->len - hdrlen - MICHAEL_MIC_LEN; |
2331 | key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY]; |
2332 | michael_mic(key, hdr, data, data_len, mic); |
2333 | - if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0) |
2334 | + if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN)) |
2335 | goto mic_fail; |
2336 | |
2337 | /* remove Michael MIC from payload */ |
2338 | @@ -1047,7 +1048,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx) |
2339 | bip_aad(skb, aad); |
2340 | ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad, |
2341 | skb->data + 24, skb->len - 24, mic); |
2342 | - if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { |
2343 | + if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { |
2344 | key->u.aes_cmac.icverrors++; |
2345 | return RX_DROP_UNUSABLE; |
2346 | } |
2347 | @@ -1097,7 +1098,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx) |
2348 | bip_aad(skb, aad); |
2349 | ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad, |
2350 | skb->data + 24, skb->len - 24, mic); |
2351 | - if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { |
2352 | + if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { |
2353 | key->u.aes_cmac.icverrors++; |
2354 | return RX_DROP_UNUSABLE; |
2355 | } |
2356 | @@ -1201,7 +1202,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx) |
2357 | if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce, |
2358 | skb->data + 24, skb->len - 24, |
2359 | mic) < 0 || |
2360 | - memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { |
2361 | + crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { |
2362 | key->u.aes_gmac.icverrors++; |
2363 | return RX_DROP_UNUSABLE; |
2364 | } |
2365 | diff --git a/net/wireless/util.c b/net/wireless/util.c |
2366 | index 659b507b347d..c921c2eed15d 100644 |
2367 | --- a/net/wireless/util.c |
2368 | +++ b/net/wireless/util.c |
2369 | @@ -454,6 +454,8 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, |
2370 | if (iftype == NL80211_IFTYPE_MESH_POINT) |
2371 | skb_copy_bits(skb, hdrlen, &mesh_flags, 1); |
2372 | |
2373 | + mesh_flags &= MESH_FLAGS_AE; |
2374 | + |
2375 | switch (hdr->frame_control & |
2376 | cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) { |
2377 | case cpu_to_le16(IEEE80211_FCTL_TODS): |
2378 | @@ -469,9 +471,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, |
2379 | iftype != NL80211_IFTYPE_STATION)) |
2380 | return -1; |
2381 | if (iftype == NL80211_IFTYPE_MESH_POINT) { |
2382 | - if (mesh_flags & MESH_FLAGS_AE_A4) |
2383 | + if (mesh_flags == MESH_FLAGS_AE_A4) |
2384 | return -1; |
2385 | - if (mesh_flags & MESH_FLAGS_AE_A5_A6) { |
2386 | + if (mesh_flags == MESH_FLAGS_AE_A5_A6) { |
2387 | skb_copy_bits(skb, hdrlen + |
2388 | offsetof(struct ieee80211s_hdr, eaddr1), |
2389 | tmp.h_dest, 2 * ETH_ALEN); |
2390 | @@ -487,9 +489,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, |
2391 | ether_addr_equal(tmp.h_source, addr))) |
2392 | return -1; |
2393 | if (iftype == NL80211_IFTYPE_MESH_POINT) { |
2394 | - if (mesh_flags & MESH_FLAGS_AE_A5_A6) |
2395 | + if (mesh_flags == MESH_FLAGS_AE_A5_A6) |
2396 | return -1; |
2397 | - if (mesh_flags & MESH_FLAGS_AE_A4) |
2398 | + if (mesh_flags == MESH_FLAGS_AE_A4) |
2399 | skb_copy_bits(skb, hdrlen + |
2400 | offsetof(struct ieee80211s_hdr, eaddr1), |
2401 | tmp.h_source, ETH_ALEN); |