Annotation of /trunk/kernel-alx/patches-4.9/0154-4.9.55-all-fixes.patch
Parent Directory | Revision Log
Revision 3039 -
(hide annotations)
(download)
Wed Dec 20 11:48:53 2017 UTC (6 years, 9 months ago) by niro
File size: 126211 byte(s)
Wed Dec 20 11:48:53 2017 UTC (6 years, 9 months ago) by niro
File size: 126211 byte(s)
-linux-4.9.55
1 | niro | 3039 | diff --git a/Makefile b/Makefile |
2 | index 8370937bbb22..2a995675d6bf 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 9 | ||
8 | -SUBLEVEL = 54 | ||
9 | +SUBLEVEL = 55 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Roaring Lionus | ||
12 | |||
13 | diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S | ||
14 | index 2e2fc1e37715..fd68e19b9ef7 100644 | ||
15 | --- a/arch/powerpc/kernel/exceptions-64s.S | ||
16 | +++ b/arch/powerpc/kernel/exceptions-64s.S | ||
17 | @@ -764,7 +764,29 @@ EXC_REAL(program_check, 0x700, 0x800) | ||
18 | EXC_VIRT(program_check, 0x4700, 0x4800, 0x700) | ||
19 | TRAMP_KVM(PACA_EXGEN, 0x700) | ||
20 | EXC_COMMON_BEGIN(program_check_common) | ||
21 | - EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN) | ||
22 | + /* | ||
23 | + * It's possible to receive a TM Bad Thing type program check with | ||
24 | + * userspace register values (in particular r1), but with SRR1 reporting | ||
25 | + * that we came from the kernel. Normally that would confuse the bad | ||
26 | + * stack logic, and we would report a bad kernel stack pointer. Instead | ||
27 | + * we switch to the emergency stack if we're taking a TM Bad Thing from | ||
28 | + * the kernel. | ||
29 | + */ | ||
30 | + li r10,MSR_PR /* Build a mask of MSR_PR .. */ | ||
31 | + oris r10,r10,0x200000@h /* .. and SRR1_PROGTM */ | ||
32 | + and r10,r10,r12 /* Mask SRR1 with that. */ | ||
33 | + srdi r10,r10,8 /* Shift it so we can compare */ | ||
34 | + cmpldi r10,(0x200000 >> 8) /* .. with an immediate. */ | ||
35 | + bne 1f /* If != go to normal path. */ | ||
36 | + | ||
37 | + /* SRR1 had PR=0 and SRR1_PROGTM=1, so use the emergency stack */ | ||
38 | + andi. r10,r12,MSR_PR; /* Set CR0 correctly for label */ | ||
39 | + /* 3 in EXCEPTION_PROLOG_COMMON */ | ||
40 | + mr r10,r1 /* Save r1 */ | ||
41 | + ld r1,PACAEMERGSP(r13) /* Use emergency stack */ | ||
42 | + subi r1,r1,INT_FRAME_SIZE /* alloc stack frame */ | ||
43 | + b 3f /* Jump into the macro !! */ | ||
44 | +1: EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN) | ||
45 | bl save_nvgprs | ||
46 | RECONCILE_IRQ_STATE(r10, r11) | ||
47 | addi r3,r1,STACK_FRAME_OVERHEAD | ||
48 | diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c | ||
49 | index 96698fdf93b4..04e92257fd69 100644 | ||
50 | --- a/arch/powerpc/kernel/signal_64.c | ||
51 | +++ b/arch/powerpc/kernel/signal_64.c | ||
52 | @@ -452,9 +452,20 @@ static long restore_tm_sigcontexts(struct task_struct *tsk, | ||
53 | if (MSR_TM_RESV(msr)) | ||
54 | return -EINVAL; | ||
55 | |||
56 | - /* pull in MSR TM from user context */ | ||
57 | + /* pull in MSR TS bits from user context */ | ||
58 | regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK); | ||
59 | |||
60 | + /* | ||
61 | + * Ensure that TM is enabled in regs->msr before we leave the signal | ||
62 | + * handler. It could be the case that (a) user disabled the TM bit | ||
63 | + * through the manipulation of the MSR bits in uc_mcontext or (b) the | ||
64 | + * TM bit was disabled because a sufficient number of context switches | ||
65 | + * happened whilst in the signal handler and load_tm overflowed, | ||
66 | + * disabling the TM bit. In either case we can end up with an illegal | ||
67 | + * TM state leading to a TM Bad Thing when we return to userspace. | ||
68 | + */ | ||
69 | + regs->msr |= MSR_TM; | ||
70 | + | ||
71 | /* pull in MSR LE from user context */ | ||
72 | regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE); | ||
73 | |||
74 | diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h | ||
75 | index 19d14ac23ef9..fc3c7e49c8e4 100644 | ||
76 | --- a/arch/x86/include/asm/kvm_emulate.h | ||
77 | +++ b/arch/x86/include/asm/kvm_emulate.h | ||
78 | @@ -296,6 +296,7 @@ struct x86_emulate_ctxt { | ||
79 | |||
80 | bool perm_ok; /* do not check permissions if true */ | ||
81 | bool ud; /* inject an #UD if host doesn't support insn */ | ||
82 | + bool tf; /* TF value before instruction (after for syscall/sysret) */ | ||
83 | |||
84 | bool have_exception; | ||
85 | struct x86_exception exception; | ||
86 | diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c | ||
87 | index de36660751b5..72b737b8c9d6 100644 | ||
88 | --- a/arch/x86/kvm/emulate.c | ||
89 | +++ b/arch/x86/kvm/emulate.c | ||
90 | @@ -2738,6 +2738,7 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt) | ||
91 | ctxt->eflags &= ~(X86_EFLAGS_VM | X86_EFLAGS_IF); | ||
92 | } | ||
93 | |||
94 | + ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0; | ||
95 | return X86EMUL_CONTINUE; | ||
96 | } | ||
97 | |||
98 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c | ||
99 | index 3dbcb09c19cf..595f8149c0d9 100644 | ||
100 | --- a/arch/x86/kvm/x86.c | ||
101 | +++ b/arch/x86/kvm/x86.c | ||
102 | @@ -5250,6 +5250,8 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu) | ||
103 | kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l); | ||
104 | |||
105 | ctxt->eflags = kvm_get_rflags(vcpu); | ||
106 | + ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0; | ||
107 | + | ||
108 | ctxt->eip = kvm_rip_read(vcpu); | ||
109 | ctxt->mode = (!is_protmode(vcpu)) ? X86EMUL_MODE_REAL : | ||
110 | (ctxt->eflags & X86_EFLAGS_VM) ? X86EMUL_MODE_VM86 : | ||
111 | @@ -5465,37 +5467,26 @@ static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7, | ||
112 | return dr6; | ||
113 | } | ||
114 | |||
115 | -static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, unsigned long rflags, int *r) | ||
116 | +static void kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu, int *r) | ||
117 | { | ||
118 | struct kvm_run *kvm_run = vcpu->run; | ||
119 | |||
120 | - /* | ||
121 | - * rflags is the old, "raw" value of the flags. The new value has | ||
122 | - * not been saved yet. | ||
123 | - * | ||
124 | - * This is correct even for TF set by the guest, because "the | ||
125 | - * processor will not generate this exception after the instruction | ||
126 | - * that sets the TF flag". | ||
127 | - */ | ||
128 | - if (unlikely(rflags & X86_EFLAGS_TF)) { | ||
129 | - if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { | ||
130 | - kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | | ||
131 | - DR6_RTM; | ||
132 | - kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip; | ||
133 | - kvm_run->debug.arch.exception = DB_VECTOR; | ||
134 | - kvm_run->exit_reason = KVM_EXIT_DEBUG; | ||
135 | - *r = EMULATE_USER_EXIT; | ||
136 | - } else { | ||
137 | - vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF; | ||
138 | - /* | ||
139 | - * "Certain debug exceptions may clear bit 0-3. The | ||
140 | - * remaining contents of the DR6 register are never | ||
141 | - * cleared by the processor". | ||
142 | - */ | ||
143 | - vcpu->arch.dr6 &= ~15; | ||
144 | - vcpu->arch.dr6 |= DR6_BS | DR6_RTM; | ||
145 | - kvm_queue_exception(vcpu, DB_VECTOR); | ||
146 | - } | ||
147 | + if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { | ||
148 | + kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | DR6_RTM; | ||
149 | + kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip; | ||
150 | + kvm_run->debug.arch.exception = DB_VECTOR; | ||
151 | + kvm_run->exit_reason = KVM_EXIT_DEBUG; | ||
152 | + *r = EMULATE_USER_EXIT; | ||
153 | + } else { | ||
154 | + vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF; | ||
155 | + /* | ||
156 | + * "Certain debug exceptions may clear bit 0-3. The | ||
157 | + * remaining contents of the DR6 register are never | ||
158 | + * cleared by the processor". | ||
159 | + */ | ||
160 | + vcpu->arch.dr6 &= ~15; | ||
161 | + vcpu->arch.dr6 |= DR6_BS | DR6_RTM; | ||
162 | + kvm_queue_exception(vcpu, DB_VECTOR); | ||
163 | } | ||
164 | } | ||
165 | |||
166 | @@ -5650,8 +5641,9 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, | ||
167 | toggle_interruptibility(vcpu, ctxt->interruptibility); | ||
168 | vcpu->arch.emulate_regs_need_sync_to_vcpu = false; | ||
169 | kvm_rip_write(vcpu, ctxt->eip); | ||
170 | - if (r == EMULATE_DONE) | ||
171 | - kvm_vcpu_check_singlestep(vcpu, rflags, &r); | ||
172 | + if (r == EMULATE_DONE && | ||
173 | + (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP))) | ||
174 | + kvm_vcpu_do_singlestep(vcpu, &r); | ||
175 | if (!ctxt->have_exception || | ||
176 | exception_type(ctxt->exception.vector) == EXCPT_TRAP) | ||
177 | __kvm_set_rflags(vcpu, ctxt->eflags); | ||
178 | diff --git a/drivers/base/platform.c b/drivers/base/platform.c | ||
179 | index 5eba47815bb6..14ff40371f01 100644 | ||
180 | --- a/drivers/base/platform.c | ||
181 | +++ b/drivers/base/platform.c | ||
182 | @@ -858,7 +858,8 @@ static ssize_t driver_override_store(struct device *dev, | ||
183 | struct platform_device *pdev = to_platform_device(dev); | ||
184 | char *driver_override, *old, *cp; | ||
185 | |||
186 | - if (count > PATH_MAX) | ||
187 | + /* We need to keep extra room for a newline */ | ||
188 | + if (count >= (PAGE_SIZE - 1)) | ||
189 | return -EINVAL; | ||
190 | |||
191 | driver_override = kstrndup(buf, count, GFP_KERNEL); | ||
192 | diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c | ||
193 | index 4ac36e3c341f..8aeb7f8ee59c 100644 | ||
194 | --- a/drivers/gpu/drm/i915/intel_bios.c | ||
195 | +++ b/drivers/gpu/drm/i915/intel_bios.c | ||
196 | @@ -1152,6 +1152,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port, | ||
197 | is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0; | ||
198 | is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR); | ||
199 | |||
200 | + if (port == PORT_A && is_dvi) { | ||
201 | + DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n", | ||
202 | + is_hdmi ? "/HDMI" : ""); | ||
203 | + is_dvi = false; | ||
204 | + is_hdmi = false; | ||
205 | + } | ||
206 | + | ||
207 | info->supports_dvi = is_dvi; | ||
208 | info->supports_hdmi = is_hdmi; | ||
209 | info->supports_dp = is_dp; | ||
210 | diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c | ||
211 | index 8008e06b7efe..865e7c262322 100644 | ||
212 | --- a/drivers/hid/i2c-hid/i2c-hid.c | ||
213 | +++ b/drivers/hid/i2c-hid/i2c-hid.c | ||
214 | @@ -604,7 +604,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size) | ||
215 | { | ||
216 | /* the worst case is computed from the set_report command with a | ||
217 | * reportID > 15 and the maximum report length */ | ||
218 | - int args_len = sizeof(__u8) + /* optional ReportID byte */ | ||
219 | + int args_len = sizeof(__u8) + /* ReportID */ | ||
220 | + sizeof(__u8) + /* optional ReportID byte */ | ||
221 | sizeof(__u16) + /* data register */ | ||
222 | sizeof(__u16) + /* size of the report */ | ||
223 | report_size; /* report */ | ||
224 | diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c | ||
225 | index 53ac19b3727a..d72dfb2bbdb8 100644 | ||
226 | --- a/drivers/hid/wacom_sys.c | ||
227 | +++ b/drivers/hid/wacom_sys.c | ||
228 | @@ -611,8 +611,10 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev) | ||
229 | |||
230 | /* Try to find an already-probed interface from the same device */ | ||
231 | list_for_each_entry(data, &wacom_udev_list, list) { | ||
232 | - if (compare_device_paths(hdev, data->dev, '/')) | ||
233 | + if (compare_device_paths(hdev, data->dev, '/')) { | ||
234 | + kref_get(&data->kref); | ||
235 | return data; | ||
236 | + } | ||
237 | } | ||
238 | |||
239 | /* Fallback to finding devices that appear to be "siblings" */ | ||
240 | @@ -712,6 +714,9 @@ static int wacom_led_control(struct wacom *wacom) | ||
241 | if (!wacom->led.groups) | ||
242 | return -ENOTSUPP; | ||
243 | |||
244 | + if (wacom->wacom_wac.features.type == REMOTE) | ||
245 | + return -ENOTSUPP; | ||
246 | + | ||
247 | if (wacom->wacom_wac.pid) { /* wireless connected */ | ||
248 | report_id = WAC_CMD_WL_LED_CONTROL; | ||
249 | buf_size = 13; | ||
250 | diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c | ||
251 | index c6a922ee5d3b..db951c4fd6dd 100644 | ||
252 | --- a/drivers/hid/wacom_wac.c | ||
253 | +++ b/drivers/hid/wacom_wac.c | ||
254 | @@ -559,8 +559,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom) | ||
255 | keys = data[9] & 0x07; | ||
256 | } | ||
257 | } else { | ||
258 | - buttons = ((data[6] & 0x10) << 10) | | ||
259 | - ((data[5] & 0x10) << 9) | | ||
260 | + buttons = ((data[6] & 0x10) << 5) | | ||
261 | + ((data[5] & 0x10) << 4) | | ||
262 | ((data[6] & 0x0F) << 4) | | ||
263 | (data[5] & 0x0F); | ||
264 | } | ||
265 | diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c | ||
266 | index e47d8c9db03a..75126e4e3f05 100644 | ||
267 | --- a/drivers/hv/hv_fcopy.c | ||
268 | +++ b/drivers/hv/hv_fcopy.c | ||
269 | @@ -161,6 +161,10 @@ static void fcopy_send_data(struct work_struct *dummy) | ||
270 | out_src = smsg_out; | ||
271 | break; | ||
272 | |||
273 | + case WRITE_TO_FILE: | ||
274 | + out_src = fcopy_transaction.fcopy_msg; | ||
275 | + out_len = sizeof(struct hv_do_fcopy); | ||
276 | + break; | ||
277 | default: | ||
278 | out_src = fcopy_transaction.fcopy_msg; | ||
279 | out_len = fcopy_transaction.recv_len; | ||
280 | diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c | ||
281 | index a6ea387b5b00..877a0ed76abf 100644 | ||
282 | --- a/drivers/hwtracing/stm/core.c | ||
283 | +++ b/drivers/hwtracing/stm/core.c | ||
284 | @@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data) | ||
285 | |||
286 | stm_source_link_drop(src); | ||
287 | |||
288 | - device_destroy(&stm_source_class, src->dev.devt); | ||
289 | + device_unregister(&src->dev); | ||
290 | } | ||
291 | EXPORT_SYMBOL_GPL(stm_source_unregister_device); | ||
292 | |||
293 | diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c | ||
294 | index e6706a09e100..47c3d7f32900 100644 | ||
295 | --- a/drivers/iio/adc/ad7793.c | ||
296 | +++ b/drivers/iio/adc/ad7793.c | ||
297 | @@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, | ||
298 | unsigned int vref_mv) | ||
299 | { | ||
300 | struct ad7793_state *st = iio_priv(indio_dev); | ||
301 | - int i, ret = -1; | ||
302 | + int i, ret; | ||
303 | unsigned long long scale_uv; | ||
304 | u32 id; | ||
305 | |||
306 | @@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, | ||
307 | return ret; | ||
308 | |||
309 | /* reset the serial interface */ | ||
310 | - ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret)); | ||
311 | + ret = ad_sd_reset(&st->sd, 32); | ||
312 | if (ret < 0) | ||
313 | goto out; | ||
314 | usleep_range(500, 2000); /* Wait for at least 500us */ | ||
315 | diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c | ||
316 | index d10bd0c97233..22c4c17cd996 100644 | ||
317 | --- a/drivers/iio/adc/ad_sigma_delta.c | ||
318 | +++ b/drivers/iio/adc/ad_sigma_delta.c | ||
319 | @@ -177,6 +177,34 @@ int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, | ||
320 | } | ||
321 | EXPORT_SYMBOL_GPL(ad_sd_read_reg); | ||
322 | |||
323 | +/** | ||
324 | + * ad_sd_reset() - Reset the serial interface | ||
325 | + * | ||
326 | + * @sigma_delta: The sigma delta device | ||
327 | + * @reset_length: Number of SCLKs with DIN = 1 | ||
328 | + * | ||
329 | + * Returns 0 on success, an error code otherwise. | ||
330 | + **/ | ||
331 | +int ad_sd_reset(struct ad_sigma_delta *sigma_delta, | ||
332 | + unsigned int reset_length) | ||
333 | +{ | ||
334 | + uint8_t *buf; | ||
335 | + unsigned int size; | ||
336 | + int ret; | ||
337 | + | ||
338 | + size = DIV_ROUND_UP(reset_length, 8); | ||
339 | + buf = kcalloc(size, sizeof(*buf), GFP_KERNEL); | ||
340 | + if (!buf) | ||
341 | + return -ENOMEM; | ||
342 | + | ||
343 | + memset(buf, 0xff, size); | ||
344 | + ret = spi_write(sigma_delta->spi, buf, size); | ||
345 | + kfree(buf); | ||
346 | + | ||
347 | + return ret; | ||
348 | +} | ||
349 | +EXPORT_SYMBOL_GPL(ad_sd_reset); | ||
350 | + | ||
351 | static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta, | ||
352 | unsigned int mode, unsigned int channel) | ||
353 | { | ||
354 | diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c | ||
355 | index 634717ae12f3..071dd23a33d9 100644 | ||
356 | --- a/drivers/iio/adc/mcp320x.c | ||
357 | +++ b/drivers/iio/adc/mcp320x.c | ||
358 | @@ -17,6 +17,8 @@ | ||
359 | * MCP3204 | ||
360 | * MCP3208 | ||
361 | * ------------ | ||
362 | + * 13 bit converter | ||
363 | + * MCP3301 | ||
364 | * | ||
365 | * Datasheet can be found here: | ||
366 | * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf mcp3001 | ||
367 | @@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(int device_index, | ||
368 | } | ||
369 | |||
370 | static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, | ||
371 | - bool differential, int device_index) | ||
372 | + bool differential, int device_index, int *val) | ||
373 | { | ||
374 | int ret; | ||
375 | |||
376 | @@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, | ||
377 | |||
378 | switch (device_index) { | ||
379 | case mcp3001: | ||
380 | - return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); | ||
381 | + *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); | ||
382 | + return 0; | ||
383 | case mcp3002: | ||
384 | case mcp3004: | ||
385 | case mcp3008: | ||
386 | - return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); | ||
387 | + *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); | ||
388 | + return 0; | ||
389 | case mcp3201: | ||
390 | - return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); | ||
391 | + *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); | ||
392 | + return 0; | ||
393 | case mcp3202: | ||
394 | case mcp3204: | ||
395 | case mcp3208: | ||
396 | - return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); | ||
397 | + *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); | ||
398 | + return 0; | ||
399 | case mcp3301: | ||
400 | - return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12); | ||
401 | + *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | ||
402 | + | adc->rx_buf[1], 12); | ||
403 | + return 0; | ||
404 | default: | ||
405 | return -EINVAL; | ||
406 | } | ||
407 | @@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev, | ||
408 | switch (mask) { | ||
409 | case IIO_CHAN_INFO_RAW: | ||
410 | ret = mcp320x_adc_conversion(adc, channel->address, | ||
411 | - channel->differential, device_index); | ||
412 | - | ||
413 | + channel->differential, device_index, val); | ||
414 | if (ret < 0) | ||
415 | goto out; | ||
416 | |||
417 | - *val = ret; | ||
418 | ret = IIO_VAL_INT; | ||
419 | break; | ||
420 | |||
421 | @@ -312,6 +318,7 @@ static int mcp320x_probe(struct spi_device *spi) | ||
422 | indio_dev->name = spi_get_device_id(spi)->name; | ||
423 | indio_dev->modes = INDIO_DIRECT_MODE; | ||
424 | indio_dev->info = &mcp320x_info; | ||
425 | + spi_set_drvdata(spi, indio_dev); | ||
426 | |||
427 | chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data]; | ||
428 | indio_dev->channels = chip_info->channels; | ||
429 | diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c | ||
430 | index 0c74869a540a..7ffc5db4d7ee 100644 | ||
431 | --- a/drivers/iio/adc/twl4030-madc.c | ||
432 | +++ b/drivers/iio/adc/twl4030-madc.c | ||
433 | @@ -866,8 +866,10 @@ static int twl4030_madc_probe(struct platform_device *pdev) | ||
434 | |||
435 | /* Enable 3v1 bias regulator for MADC[3:6] */ | ||
436 | madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1"); | ||
437 | - if (IS_ERR(madc->usb3v1)) | ||
438 | - return -ENODEV; | ||
439 | + if (IS_ERR(madc->usb3v1)) { | ||
440 | + ret = -ENODEV; | ||
441 | + goto err_i2c; | ||
442 | + } | ||
443 | |||
444 | ret = regulator_enable(madc->usb3v1); | ||
445 | if (ret) | ||
446 | @@ -876,11 +878,13 @@ static int twl4030_madc_probe(struct platform_device *pdev) | ||
447 | ret = iio_device_register(iio_dev); | ||
448 | if (ret) { | ||
449 | dev_err(&pdev->dev, "could not register iio device\n"); | ||
450 | - goto err_i2c; | ||
451 | + goto err_usb3v1; | ||
452 | } | ||
453 | |||
454 | return 0; | ||
455 | |||
456 | +err_usb3v1: | ||
457 | + regulator_disable(madc->usb3v1); | ||
458 | err_i2c: | ||
459 | twl4030_madc_set_current_generator(madc, 0, 0); | ||
460 | err_current_generator: | ||
461 | diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c | ||
462 | index fc340ed3dca1..c5bc73135436 100644 | ||
463 | --- a/drivers/iio/industrialio-core.c | ||
464 | +++ b/drivers/iio/industrialio-core.c | ||
465 | @@ -306,8 +306,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf, | ||
466 | ret = indio_dev->info->debugfs_reg_access(indio_dev, | ||
467 | indio_dev->cached_reg_addr, | ||
468 | 0, &val); | ||
469 | - if (ret) | ||
470 | + if (ret) { | ||
471 | dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__); | ||
472 | + return ret; | ||
473 | + } | ||
474 | |||
475 | len = snprintf(buf, sizeof(buf), "0x%X\n", val); | ||
476 | |||
477 | diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c | ||
478 | index f762eb8b174a..19aa957bd454 100644 | ||
479 | --- a/drivers/iio/pressure/bmp280-core.c | ||
480 | +++ b/drivers/iio/pressure/bmp280-core.c | ||
481 | @@ -558,7 +558,7 @@ static int bmp280_chip_config(struct bmp280_data *data) | ||
482 | u8 osrs = BMP280_OSRS_TEMP_X(data->oversampling_temp + 1) | | ||
483 | BMP280_OSRS_PRESS_X(data->oversampling_press + 1); | ||
484 | |||
485 | - ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_MEAS, | ||
486 | + ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS, | ||
487 | BMP280_OSRS_TEMP_MASK | | ||
488 | BMP280_OSRS_PRESS_MASK | | ||
489 | BMP280_MODE_MASK, | ||
490 | diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c | ||
491 | index bf3fbd00a091..64b586458d3d 100644 | ||
492 | --- a/drivers/isdn/i4l/isdn_ppp.c | ||
493 | +++ b/drivers/isdn/i4l/isdn_ppp.c | ||
494 | @@ -828,7 +828,6 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) | ||
495 | isdn_net_local *lp; | ||
496 | struct ippp_struct *is; | ||
497 | int proto; | ||
498 | - unsigned char protobuf[4]; | ||
499 | |||
500 | is = file->private_data; | ||
501 | |||
502 | @@ -842,24 +841,28 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) | ||
503 | if (!lp) | ||
504 | printk(KERN_DEBUG "isdn_ppp_write: lp == NULL\n"); | ||
505 | else { | ||
506 | - /* | ||
507 | - * Don't reset huptimer for | ||
508 | - * LCP packets. (Echo requests). | ||
509 | - */ | ||
510 | - if (copy_from_user(protobuf, buf, 4)) | ||
511 | - return -EFAULT; | ||
512 | - proto = PPP_PROTOCOL(protobuf); | ||
513 | - if (proto != PPP_LCP) | ||
514 | - lp->huptimer = 0; | ||
515 | + if (lp->isdn_device < 0 || lp->isdn_channel < 0) { | ||
516 | + unsigned char protobuf[4]; | ||
517 | + /* | ||
518 | + * Don't reset huptimer for | ||
519 | + * LCP packets. (Echo requests). | ||
520 | + */ | ||
521 | + if (copy_from_user(protobuf, buf, 4)) | ||
522 | + return -EFAULT; | ||
523 | + | ||
524 | + proto = PPP_PROTOCOL(protobuf); | ||
525 | + if (proto != PPP_LCP) | ||
526 | + lp->huptimer = 0; | ||
527 | |||
528 | - if (lp->isdn_device < 0 || lp->isdn_channel < 0) | ||
529 | return 0; | ||
530 | + } | ||
531 | |||
532 | if ((dev->drv[lp->isdn_device]->flags & DRV_FLAG_RUNNING) && | ||
533 | lp->dialstate == 0 && | ||
534 | (lp->flags & ISDN_NET_CONNECTED)) { | ||
535 | unsigned short hl; | ||
536 | struct sk_buff *skb; | ||
537 | + unsigned char *cpy_buf; | ||
538 | /* | ||
539 | * we need to reserve enough space in front of | ||
540 | * sk_buff. old call to dev_alloc_skb only reserved | ||
541 | @@ -872,11 +875,21 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) | ||
542 | return count; | ||
543 | } | ||
544 | skb_reserve(skb, hl); | ||
545 | - if (copy_from_user(skb_put(skb, count), buf, count)) | ||
546 | + cpy_buf = skb_put(skb, count); | ||
547 | + if (copy_from_user(cpy_buf, buf, count)) | ||
548 | { | ||
549 | kfree_skb(skb); | ||
550 | return -EFAULT; | ||
551 | } | ||
552 | + | ||
553 | + /* | ||
554 | + * Don't reset huptimer for | ||
555 | + * LCP packets. (Echo requests). | ||
556 | + */ | ||
557 | + proto = PPP_PROTOCOL(cpy_buf); | ||
558 | + if (proto != PPP_LCP) | ||
559 | + lp->huptimer = 0; | ||
560 | + | ||
561 | if (is->debug & 0x40) { | ||
562 | printk(KERN_DEBUG "ppp xmit: len %d\n", (int) skb->len); | ||
563 | isdn_ppp_frame_log("xmit", skb->data, skb->len, 32, is->unit, lp->ppp_slot); | ||
564 | diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c | ||
565 | index b2ca10c4d2a5..4f4a627f6b20 100644 | ||
566 | --- a/drivers/mmc/core/mmc.c | ||
567 | +++ b/drivers/mmc/core/mmc.c | ||
568 | @@ -1255,6 +1255,23 @@ int mmc_hs400_to_hs200(struct mmc_card *card) | ||
569 | return err; | ||
570 | } | ||
571 | |||
572 | +static void mmc_select_driver_type(struct mmc_card *card) | ||
573 | +{ | ||
574 | + int card_drv_type, drive_strength, drv_type; | ||
575 | + | ||
576 | + card_drv_type = card->ext_csd.raw_driver_strength | | ||
577 | + mmc_driver_type_mask(0); | ||
578 | + | ||
579 | + drive_strength = mmc_select_drive_strength(card, | ||
580 | + card->ext_csd.hs200_max_dtr, | ||
581 | + card_drv_type, &drv_type); | ||
582 | + | ||
583 | + card->drive_strength = drive_strength; | ||
584 | + | ||
585 | + if (drv_type) | ||
586 | + mmc_set_driver_type(card->host, drv_type); | ||
587 | +} | ||
588 | + | ||
589 | static int mmc_select_hs400es(struct mmc_card *card) | ||
590 | { | ||
591 | struct mmc_host *host = card->host; | ||
592 | @@ -1303,6 +1320,8 @@ static int mmc_select_hs400es(struct mmc_card *card) | ||
593 | goto out_err; | ||
594 | } | ||
595 | |||
596 | + mmc_select_driver_type(card); | ||
597 | + | ||
598 | /* Switch card to HS400 */ | ||
599 | val = EXT_CSD_TIMING_HS400 | | ||
600 | card->drive_strength << EXT_CSD_DRV_STR_SHIFT; | ||
601 | @@ -1336,23 +1355,6 @@ static int mmc_select_hs400es(struct mmc_card *card) | ||
602 | return err; | ||
603 | } | ||
604 | |||
605 | -static void mmc_select_driver_type(struct mmc_card *card) | ||
606 | -{ | ||
607 | - int card_drv_type, drive_strength, drv_type; | ||
608 | - | ||
609 | - card_drv_type = card->ext_csd.raw_driver_strength | | ||
610 | - mmc_driver_type_mask(0); | ||
611 | - | ||
612 | - drive_strength = mmc_select_drive_strength(card, | ||
613 | - card->ext_csd.hs200_max_dtr, | ||
614 | - card_drv_type, &drv_type); | ||
615 | - | ||
616 | - card->drive_strength = drive_strength; | ||
617 | - | ||
618 | - if (drv_type) | ||
619 | - mmc_set_driver_type(card->host, drv_type); | ||
620 | -} | ||
621 | - | ||
622 | /* | ||
623 | * For device supporting HS200 mode, the following sequence | ||
624 | * should be done before executing the tuning process. | ||
625 | diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c | ||
626 | index aaf6fec566b5..3660a3d51731 100644 | ||
627 | --- a/drivers/net/ethernet/ibm/emac/mal.c | ||
628 | +++ b/drivers/net/ethernet/ibm/emac/mal.c | ||
629 | @@ -402,7 +402,7 @@ static int mal_poll(struct napi_struct *napi, int budget) | ||
630 | unsigned long flags; | ||
631 | |||
632 | MAL_DBG2(mal, "poll(%d)" NL, budget); | ||
633 | - again: | ||
634 | + | ||
635 | /* Process TX skbs */ | ||
636 | list_for_each(l, &mal->poll_list) { | ||
637 | struct mal_commac *mc = | ||
638 | @@ -451,7 +451,6 @@ static int mal_poll(struct napi_struct *napi, int budget) | ||
639 | spin_lock_irqsave(&mal->lock, flags); | ||
640 | mal_disable_eob_irq(mal); | ||
641 | spin_unlock_irqrestore(&mal->lock, flags); | ||
642 | - goto again; | ||
643 | } | ||
644 | mc->ops->poll_tx(mc->dev); | ||
645 | } | ||
646 | diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c | ||
647 | index 1806b1fc6e4c..d50350c7adc4 100644 | ||
648 | --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c | ||
649 | +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c | ||
650 | @@ -249,15 +249,14 @@ static void mlxsw_sp_span_entry_destroy(struct mlxsw_sp *mlxsw_sp, | ||
651 | } | ||
652 | |||
653 | static struct mlxsw_sp_span_entry * | ||
654 | -mlxsw_sp_span_entry_find(struct mlxsw_sp_port *port) | ||
655 | +mlxsw_sp_span_entry_find(struct mlxsw_sp *mlxsw_sp, u8 local_port) | ||
656 | { | ||
657 | - struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp; | ||
658 | int i; | ||
659 | |||
660 | for (i = 0; i < mlxsw_sp->span.entries_count; i++) { | ||
661 | struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i]; | ||
662 | |||
663 | - if (curr->used && curr->local_port == port->local_port) | ||
664 | + if (curr->used && curr->local_port == local_port) | ||
665 | return curr; | ||
666 | } | ||
667 | return NULL; | ||
668 | @@ -268,7 +267,8 @@ static struct mlxsw_sp_span_entry | ||
669 | { | ||
670 | struct mlxsw_sp_span_entry *span_entry; | ||
671 | |||
672 | - span_entry = mlxsw_sp_span_entry_find(port); | ||
673 | + span_entry = mlxsw_sp_span_entry_find(port->mlxsw_sp, | ||
674 | + port->local_port); | ||
675 | if (span_entry) { | ||
676 | /* Already exists, just take a reference */ | ||
677 | span_entry->ref_count++; | ||
678 | @@ -453,12 +453,13 @@ static int mlxsw_sp_span_mirror_add(struct mlxsw_sp_port *from, | ||
679 | } | ||
680 | |||
681 | static void mlxsw_sp_span_mirror_remove(struct mlxsw_sp_port *from, | ||
682 | - struct mlxsw_sp_port *to, | ||
683 | + u8 destination_port, | ||
684 | enum mlxsw_sp_span_type type) | ||
685 | { | ||
686 | struct mlxsw_sp_span_entry *span_entry; | ||
687 | |||
688 | - span_entry = mlxsw_sp_span_entry_find(to); | ||
689 | + span_entry = mlxsw_sp_span_entry_find(from->mlxsw_sp, | ||
690 | + destination_port); | ||
691 | if (!span_entry) { | ||
692 | netdev_err(from->dev, "no span entry found\n"); | ||
693 | return; | ||
694 | @@ -1255,10 +1256,8 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port, | ||
695 | static void mlxsw_sp_port_del_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port, | ||
696 | struct tc_cls_matchall_offload *cls) | ||
697 | { | ||
698 | - struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; | ||
699 | struct mlxsw_sp_port_mall_tc_entry *mall_tc_entry; | ||
700 | enum mlxsw_sp_span_type span_type; | ||
701 | - struct mlxsw_sp_port *to_port; | ||
702 | |||
703 | mall_tc_entry = mlxsw_sp_port_mirror_entry_find(mlxsw_sp_port, | ||
704 | cls->cookie); | ||
705 | @@ -1269,11 +1268,12 @@ static void mlxsw_sp_port_del_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port, | ||
706 | |||
707 | switch (mall_tc_entry->type) { | ||
708 | case MLXSW_SP_PORT_MALL_MIRROR: | ||
709 | - to_port = mlxsw_sp->ports[mall_tc_entry->mirror.to_local_port]; | ||
710 | span_type = mall_tc_entry->mirror.ingress ? | ||
711 | MLXSW_SP_SPAN_INGRESS : MLXSW_SP_SPAN_EGRESS; | ||
712 | |||
713 | - mlxsw_sp_span_mirror_remove(mlxsw_sp_port, to_port, span_type); | ||
714 | + mlxsw_sp_span_mirror_remove(mlxsw_sp_port, | ||
715 | + mall_tc_entry->mirror.to_local_port, | ||
716 | + span_type); | ||
717 | break; | ||
718 | default: | ||
719 | WARN_ON(1); | ||
720 | diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c | ||
721 | index 0b4deb31e742..f683bfbd9986 100644 | ||
722 | --- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c | ||
723 | +++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c | ||
724 | @@ -932,7 +932,8 @@ static void emac_mac_rx_descs_refill(struct emac_adapter *adpt, | ||
725 | |||
726 | curr_rxbuf->dma_addr = | ||
727 | dma_map_single(adpt->netdev->dev.parent, skb->data, | ||
728 | - curr_rxbuf->length, DMA_FROM_DEVICE); | ||
729 | + adpt->rxbuf_size, DMA_FROM_DEVICE); | ||
730 | + | ||
731 | ret = dma_mapping_error(adpt->netdev->dev.parent, | ||
732 | curr_rxbuf->dma_addr); | ||
733 | if (ret) { | ||
734 | diff --git a/drivers/net/ethernet/rocker/rocker_tlv.h b/drivers/net/ethernet/rocker/rocker_tlv.h | ||
735 | index a63ef82e7c72..dfae3c9d57c6 100644 | ||
736 | --- a/drivers/net/ethernet/rocker/rocker_tlv.h | ||
737 | +++ b/drivers/net/ethernet/rocker/rocker_tlv.h | ||
738 | @@ -139,40 +139,52 @@ rocker_tlv_start(struct rocker_desc_info *desc_info) | ||
739 | int rocker_tlv_put(struct rocker_desc_info *desc_info, | ||
740 | int attrtype, int attrlen, const void *data); | ||
741 | |||
742 | -static inline int rocker_tlv_put_u8(struct rocker_desc_info *desc_info, | ||
743 | - int attrtype, u8 value) | ||
744 | +static inline int | ||
745 | +rocker_tlv_put_u8(struct rocker_desc_info *desc_info, int attrtype, u8 value) | ||
746 | { | ||
747 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &value); | ||
748 | + u8 tmp = value; /* work around GCC PR81715 */ | ||
749 | + | ||
750 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &tmp); | ||
751 | } | ||
752 | |||
753 | -static inline int rocker_tlv_put_u16(struct rocker_desc_info *desc_info, | ||
754 | - int attrtype, u16 value) | ||
755 | +static inline int | ||
756 | +rocker_tlv_put_u16(struct rocker_desc_info *desc_info, int attrtype, u16 value) | ||
757 | { | ||
758 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &value); | ||
759 | + u16 tmp = value; | ||
760 | + | ||
761 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &tmp); | ||
762 | } | ||
763 | |||
764 | -static inline int rocker_tlv_put_be16(struct rocker_desc_info *desc_info, | ||
765 | - int attrtype, __be16 value) | ||
766 | +static inline int | ||
767 | +rocker_tlv_put_be16(struct rocker_desc_info *desc_info, int attrtype, __be16 value) | ||
768 | { | ||
769 | - return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &value); | ||
770 | + __be16 tmp = value; | ||
771 | + | ||
772 | + return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &tmp); | ||
773 | } | ||
774 | |||
775 | -static inline int rocker_tlv_put_u32(struct rocker_desc_info *desc_info, | ||
776 | - int attrtype, u32 value) | ||
777 | +static inline int | ||
778 | +rocker_tlv_put_u32(struct rocker_desc_info *desc_info, int attrtype, u32 value) | ||
779 | { | ||
780 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &value); | ||
781 | + u32 tmp = value; | ||
782 | + | ||
783 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &tmp); | ||
784 | } | ||
785 | |||
786 | -static inline int rocker_tlv_put_be32(struct rocker_desc_info *desc_info, | ||
787 | - int attrtype, __be32 value) | ||
788 | +static inline int | ||
789 | +rocker_tlv_put_be32(struct rocker_desc_info *desc_info, int attrtype, __be32 value) | ||
790 | { | ||
791 | - return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &value); | ||
792 | + __be32 tmp = value; | ||
793 | + | ||
794 | + return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &tmp); | ||
795 | } | ||
796 | |||
797 | -static inline int rocker_tlv_put_u64(struct rocker_desc_info *desc_info, | ||
798 | - int attrtype, u64 value) | ||
799 | +static inline int | ||
800 | +rocker_tlv_put_u64(struct rocker_desc_info *desc_info, int attrtype, u64 value) | ||
801 | { | ||
802 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &value); | ||
803 | + u64 tmp = value; | ||
804 | + | ||
805 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &tmp); | ||
806 | } | ||
807 | |||
808 | static inline struct rocker_tlv * | ||
809 | diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c | ||
810 | index d15dd3938ba8..2e5150b0b8d5 100644 | ||
811 | --- a/drivers/net/phy/xilinx_gmii2rgmii.c | ||
812 | +++ b/drivers/net/phy/xilinx_gmii2rgmii.c | ||
813 | @@ -44,7 +44,7 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev) | ||
814 | priv->phy_drv->read_status(phydev); | ||
815 | |||
816 | val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG); | ||
817 | - val &= XILINX_GMII2RGMII_SPEED_MASK; | ||
818 | + val &= ~XILINX_GMII2RGMII_SPEED_MASK; | ||
819 | |||
820 | if (phydev->speed == SPEED_1000) | ||
821 | val |= BMCR_SPEED1000; | ||
822 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c | ||
823 | index a931b73393c8..ba7f9e054c4a 100644 | ||
824 | --- a/drivers/net/tun.c | ||
825 | +++ b/drivers/net/tun.c | ||
826 | @@ -1279,11 +1279,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, | ||
827 | switch (tun->flags & TUN_TYPE_MASK) { | ||
828 | case IFF_TUN: | ||
829 | if (tun->flags & IFF_NO_PI) { | ||
830 | - switch (skb->data[0] & 0xf0) { | ||
831 | - case 0x40: | ||
832 | + u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0; | ||
833 | + | ||
834 | + switch (ip_version) { | ||
835 | + case 4: | ||
836 | pi.proto = htons(ETH_P_IP); | ||
837 | break; | ||
838 | - case 0x60: | ||
839 | + case 6: | ||
840 | pi.proto = htons(ETH_P_IPV6); | ||
841 | break; | ||
842 | default: | ||
843 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | ||
844 | index 1d4352e1ac81..27960b0bfbcd 100644 | ||
845 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | ||
846 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | ||
847 | @@ -978,7 +978,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, | ||
848 | |||
849 | eth_broadcast_addr(params_le->bssid); | ||
850 | params_le->bss_type = DOT11_BSSTYPE_ANY; | ||
851 | - params_le->scan_type = 0; | ||
852 | + params_le->scan_type = BRCMF_SCANTYPE_ACTIVE; | ||
853 | params_le->channel_num = 0; | ||
854 | params_le->nprobes = cpu_to_le32(-1); | ||
855 | params_le->active_time = cpu_to_le32(-1); | ||
856 | @@ -986,12 +986,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, | ||
857 | params_le->home_time = cpu_to_le32(-1); | ||
858 | memset(¶ms_le->ssid_le, 0, sizeof(params_le->ssid_le)); | ||
859 | |||
860 | - /* if request is null exit so it will be all channel broadcast scan */ | ||
861 | - if (!request) | ||
862 | - return; | ||
863 | - | ||
864 | n_ssids = request->n_ssids; | ||
865 | n_channels = request->n_channels; | ||
866 | + | ||
867 | /* Copy channel array if applicable */ | ||
868 | brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n", | ||
869 | n_channels); | ||
870 | @@ -1028,16 +1025,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, | ||
871 | ptr += sizeof(ssid_le); | ||
872 | } | ||
873 | } else { | ||
874 | - brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids); | ||
875 | - if ((request->ssids) && request->ssids->ssid_len) { | ||
876 | - brcmf_dbg(SCAN, "SSID %s len=%d\n", | ||
877 | - params_le->ssid_le.SSID, | ||
878 | - request->ssids->ssid_len); | ||
879 | - params_le->ssid_le.SSID_len = | ||
880 | - cpu_to_le32(request->ssids->ssid_len); | ||
881 | - memcpy(¶ms_le->ssid_le.SSID, request->ssids->ssid, | ||
882 | - request->ssids->ssid_len); | ||
883 | - } | ||
884 | + brcmf_dbg(SCAN, "Performing passive scan\n"); | ||
885 | + params_le->scan_type = BRCMF_SCANTYPE_PASSIVE; | ||
886 | } | ||
887 | /* Adding mask to channel numbers */ | ||
888 | params_le->channel_num = | ||
889 | @@ -3097,6 +3086,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, | ||
890 | struct brcmf_cfg80211_info *cfg = ifp->drvr->config; | ||
891 | s32 status; | ||
892 | struct brcmf_escan_result_le *escan_result_le; | ||
893 | + u32 escan_buflen; | ||
894 | struct brcmf_bss_info_le *bss_info_le; | ||
895 | struct brcmf_bss_info_le *bss = NULL; | ||
896 | u32 bi_length; | ||
897 | @@ -3113,11 +3103,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, | ||
898 | |||
899 | if (status == BRCMF_E_STATUS_PARTIAL) { | ||
900 | brcmf_dbg(SCAN, "ESCAN Partial result\n"); | ||
901 | + if (e->datalen < sizeof(*escan_result_le)) { | ||
902 | + brcmf_err("invalid event data length\n"); | ||
903 | + goto exit; | ||
904 | + } | ||
905 | escan_result_le = (struct brcmf_escan_result_le *) data; | ||
906 | if (!escan_result_le) { | ||
907 | brcmf_err("Invalid escan result (NULL pointer)\n"); | ||
908 | goto exit; | ||
909 | } | ||
910 | + escan_buflen = le32_to_cpu(escan_result_le->buflen); | ||
911 | + if (escan_buflen > BRCMF_ESCAN_BUF_SIZE || | ||
912 | + escan_buflen > e->datalen || | ||
913 | + escan_buflen < sizeof(*escan_result_le)) { | ||
914 | + brcmf_err("Invalid escan buffer length: %d\n", | ||
915 | + escan_buflen); | ||
916 | + goto exit; | ||
917 | + } | ||
918 | if (le16_to_cpu(escan_result_le->bss_count) != 1) { | ||
919 | brcmf_err("Invalid bss_count %d: ignoring\n", | ||
920 | escan_result_le->bss_count); | ||
921 | @@ -3134,9 +3136,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, | ||
922 | } | ||
923 | |||
924 | bi_length = le32_to_cpu(bss_info_le->length); | ||
925 | - if (bi_length != (le32_to_cpu(escan_result_le->buflen) - | ||
926 | - WL_ESCAN_RESULTS_FIXED_SIZE)) { | ||
927 | - brcmf_err("Invalid bss_info length %d: ignoring\n", | ||
928 | + if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) { | ||
929 | + brcmf_err("Ignoring invalid bss_info length: %d\n", | ||
930 | bi_length); | ||
931 | goto exit; | ||
932 | } | ||
933 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | ||
934 | index a4118c0ef6ca..59013572fbe3 100644 | ||
935 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | ||
936 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | ||
937 | @@ -45,6 +45,11 @@ | ||
938 | #define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff | ||
939 | #define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16 | ||
940 | |||
941 | +/* scan type definitions */ | ||
942 | +#define BRCMF_SCANTYPE_DEFAULT 0xFF | ||
943 | +#define BRCMF_SCANTYPE_ACTIVE 0 | ||
944 | +#define BRCMF_SCANTYPE_PASSIVE 1 | ||
945 | + | ||
946 | /* primary (ie tx) key */ | ||
947 | #define BRCMF_PRIMARY_KEY (1 << 1) | ||
948 | #define DOT11_BSSTYPE_ANY 2 | ||
949 | diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | ||
950 | index 3bd6fc1b76d4..33f4d7c7b53a 100644 | ||
951 | --- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | ||
952 | +++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | ||
953 | @@ -78,6 +78,7 @@ | ||
954 | /* NVM offsets (in words) definitions */ | ||
955 | enum wkp_nvm_offsets { | ||
956 | /* NVM HW-Section offset (in words) definitions */ | ||
957 | + SUBSYSTEM_ID = 0x0A, | ||
958 | HW_ADDR = 0x15, | ||
959 | |||
960 | /* NVM SW-Section offset (in words) definitions */ | ||
961 | @@ -262,13 +263,12 @@ static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, bool is_5ghz, | ||
962 | static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, | ||
963 | struct iwl_nvm_data *data, | ||
964 | const __le16 * const nvm_ch_flags, | ||
965 | - bool lar_supported) | ||
966 | + bool lar_supported, bool no_wide_in_5ghz) | ||
967 | { | ||
968 | int ch_idx; | ||
969 | int n_channels = 0; | ||
970 | struct ieee80211_channel *channel; | ||
971 | u16 ch_flags; | ||
972 | - bool is_5ghz; | ||
973 | int num_of_ch, num_2ghz_channels; | ||
974 | const u8 *nvm_chan; | ||
975 | |||
976 | @@ -283,12 +283,20 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, | ||
977 | } | ||
978 | |||
979 | for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) { | ||
980 | + bool is_5ghz = (ch_idx >= num_2ghz_channels); | ||
981 | + | ||
982 | ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx); | ||
983 | |||
984 | - if (ch_idx >= num_2ghz_channels && | ||
985 | - !data->sku_cap_band_52GHz_enable) | ||
986 | + if (is_5ghz && !data->sku_cap_band_52GHz_enable) | ||
987 | continue; | ||
988 | |||
989 | + /* workaround to disable wide channels in 5GHz */ | ||
990 | + if (no_wide_in_5ghz && is_5ghz) { | ||
991 | + ch_flags &= ~(NVM_CHANNEL_40MHZ | | ||
992 | + NVM_CHANNEL_80MHZ | | ||
993 | + NVM_CHANNEL_160MHZ); | ||
994 | + } | ||
995 | + | ||
996 | if (ch_flags & NVM_CHANNEL_160MHZ) | ||
997 | data->vht160_supported = true; | ||
998 | |||
999 | @@ -311,8 +319,8 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, | ||
1000 | n_channels++; | ||
1001 | |||
1002 | channel->hw_value = nvm_chan[ch_idx]; | ||
1003 | - channel->band = (ch_idx < num_2ghz_channels) ? | ||
1004 | - NL80211_BAND_2GHZ : NL80211_BAND_5GHZ; | ||
1005 | + channel->band = is_5ghz ? | ||
1006 | + NL80211_BAND_5GHZ : NL80211_BAND_2GHZ; | ||
1007 | channel->center_freq = | ||
1008 | ieee80211_channel_to_frequency( | ||
1009 | channel->hw_value, channel->band); | ||
1010 | @@ -324,7 +332,6 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, | ||
1011 | * is not used in mvm, and is used for backwards compatibility | ||
1012 | */ | ||
1013 | channel->max_power = IWL_DEFAULT_MAX_TX_POWER; | ||
1014 | - is_5ghz = channel->band == NL80211_BAND_5GHZ; | ||
1015 | |||
1016 | /* don't put limitations in case we're using LAR */ | ||
1017 | if (!lar_supported) | ||
1018 | @@ -441,7 +448,8 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg, | ||
1019 | static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg, | ||
1020 | struct iwl_nvm_data *data, | ||
1021 | const __le16 *ch_section, | ||
1022 | - u8 tx_chains, u8 rx_chains, bool lar_supported) | ||
1023 | + u8 tx_chains, u8 rx_chains, bool lar_supported, | ||
1024 | + bool no_wide_in_5ghz) | ||
1025 | { | ||
1026 | int n_channels; | ||
1027 | int n_used = 0; | ||
1028 | @@ -450,12 +458,14 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg, | ||
1029 | if (cfg->device_family != IWL_DEVICE_FAMILY_8000) | ||
1030 | n_channels = iwl_init_channel_map( | ||
1031 | dev, cfg, data, | ||
1032 | - &ch_section[NVM_CHANNELS], lar_supported); | ||
1033 | + &ch_section[NVM_CHANNELS], lar_supported, | ||
1034 | + no_wide_in_5ghz); | ||
1035 | else | ||
1036 | n_channels = iwl_init_channel_map( | ||
1037 | dev, cfg, data, | ||
1038 | &ch_section[NVM_CHANNELS_FAMILY_8000], | ||
1039 | - lar_supported); | ||
1040 | + lar_supported, | ||
1041 | + no_wide_in_5ghz); | ||
1042 | |||
1043 | sband = &data->bands[NL80211_BAND_2GHZ]; | ||
1044 | sband->band = NL80211_BAND_2GHZ; | ||
1045 | @@ -658,6 +668,39 @@ static int iwl_set_hw_address(struct iwl_trans *trans, | ||
1046 | return 0; | ||
1047 | } | ||
1048 | |||
1049 | +static bool | ||
1050 | +iwl_nvm_no_wide_in_5ghz(struct device *dev, const struct iwl_cfg *cfg, | ||
1051 | + const __le16 *nvm_hw) | ||
1052 | +{ | ||
1053 | + /* | ||
1054 | + * Workaround a bug in Indonesia SKUs where the regulatory in | ||
1055 | + * some 7000-family OTPs erroneously allow wide channels in | ||
1056 | + * 5GHz. To check for Indonesia, we take the SKU value from | ||
1057 | + * bits 1-4 in the subsystem ID and check if it is either 5 or | ||
1058 | + * 9. In those cases, we need to force-disable wide channels | ||
1059 | + * in 5GHz otherwise the FW will throw a sysassert when we try | ||
1060 | + * to use them. | ||
1061 | + */ | ||
1062 | + if (cfg->device_family == IWL_DEVICE_FAMILY_7000) { | ||
1063 | + /* | ||
1064 | + * Unlike the other sections in the NVM, the hw | ||
1065 | + * section uses big-endian. | ||
1066 | + */ | ||
1067 | + u16 subsystem_id = be16_to_cpup((const __be16 *)nvm_hw | ||
1068 | + + SUBSYSTEM_ID); | ||
1069 | + u8 sku = (subsystem_id & 0x1e) >> 1; | ||
1070 | + | ||
1071 | + if (sku == 5 || sku == 9) { | ||
1072 | + IWL_DEBUG_EEPROM(dev, | ||
1073 | + "disabling wide channels in 5GHz (0x%0x %d)\n", | ||
1074 | + subsystem_id, sku); | ||
1075 | + return true; | ||
1076 | + } | ||
1077 | + } | ||
1078 | + | ||
1079 | + return false; | ||
1080 | +} | ||
1081 | + | ||
1082 | struct iwl_nvm_data * | ||
1083 | iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg, | ||
1084 | const __le16 *nvm_hw, const __le16 *nvm_sw, | ||
1085 | @@ -668,6 +711,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg, | ||
1086 | struct device *dev = trans->dev; | ||
1087 | struct iwl_nvm_data *data; | ||
1088 | bool lar_enabled; | ||
1089 | + bool no_wide_in_5ghz = iwl_nvm_no_wide_in_5ghz(dev, cfg, nvm_hw); | ||
1090 | u32 sku, radio_cfg; | ||
1091 | u16 lar_config; | ||
1092 | const __le16 *ch_section; | ||
1093 | @@ -738,7 +782,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg, | ||
1094 | } | ||
1095 | |||
1096 | iwl_init_sbands(dev, cfg, data, ch_section, tx_chains, rx_chains, | ||
1097 | - lar_fw_supported && lar_enabled); | ||
1098 | + lar_fw_supported && lar_enabled, no_wide_in_5ghz); | ||
1099 | data->calib_version = 255; | ||
1100 | |||
1101 | return data; | ||
1102 | diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
1103 | index 1db1dc13e988..9789f3c5a785 100644 | ||
1104 | --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
1105 | +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
1106 | @@ -1548,6 +1548,11 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac, | ||
1107 | struct iwl_mvm_mc_iter_data *data = _data; | ||
1108 | struct iwl_mvm *mvm = data->mvm; | ||
1109 | struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd; | ||
1110 | + struct iwl_host_cmd hcmd = { | ||
1111 | + .id = MCAST_FILTER_CMD, | ||
1112 | + .flags = CMD_ASYNC, | ||
1113 | + .dataflags[0] = IWL_HCMD_DFL_NOCOPY, | ||
1114 | + }; | ||
1115 | int ret, len; | ||
1116 | |||
1117 | /* if we don't have free ports, mcast frames will be dropped */ | ||
1118 | @@ -1562,7 +1567,10 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac, | ||
1119 | memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN); | ||
1120 | len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4); | ||
1121 | |||
1122 | - ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd); | ||
1123 | + hcmd.len[0] = len; | ||
1124 | + hcmd.data[0] = cmd; | ||
1125 | + | ||
1126 | + ret = iwl_mvm_send_cmd(mvm, &hcmd); | ||
1127 | if (ret) | ||
1128 | IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret); | ||
1129 | } | ||
1130 | diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c | ||
1131 | index 14eac73e8dbc..54ea90f89b70 100644 | ||
1132 | --- a/drivers/nvme/host/pci.c | ||
1133 | +++ b/drivers/nvme/host/pci.c | ||
1134 | @@ -96,7 +96,7 @@ struct nvme_dev { | ||
1135 | struct mutex shutdown_lock; | ||
1136 | bool subsystem; | ||
1137 | void __iomem *cmb; | ||
1138 | - dma_addr_t cmb_dma_addr; | ||
1139 | + pci_bus_addr_t cmb_bus_addr; | ||
1140 | u64 cmb_size; | ||
1141 | u32 cmbsz; | ||
1142 | u32 cmbloc; | ||
1143 | @@ -1037,7 +1037,7 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq, | ||
1144 | if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) { | ||
1145 | unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth), | ||
1146 | dev->ctrl.page_size); | ||
1147 | - nvmeq->sq_dma_addr = dev->cmb_dma_addr + offset; | ||
1148 | + nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset; | ||
1149 | nvmeq->sq_cmds_io = dev->cmb + offset; | ||
1150 | } else { | ||
1151 | nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth), | ||
1152 | @@ -1343,7 +1343,7 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) | ||
1153 | resource_size_t bar_size; | ||
1154 | struct pci_dev *pdev = to_pci_dev(dev->dev); | ||
1155 | void __iomem *cmb; | ||
1156 | - dma_addr_t dma_addr; | ||
1157 | + int bar; | ||
1158 | |||
1159 | dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ); | ||
1160 | if (!(NVME_CMB_SZ(dev->cmbsz))) | ||
1161 | @@ -1356,7 +1356,8 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) | ||
1162 | szu = (u64)1 << (12 + 4 * NVME_CMB_SZU(dev->cmbsz)); | ||
1163 | size = szu * NVME_CMB_SZ(dev->cmbsz); | ||
1164 | offset = szu * NVME_CMB_OFST(dev->cmbloc); | ||
1165 | - bar_size = pci_resource_len(pdev, NVME_CMB_BIR(dev->cmbloc)); | ||
1166 | + bar = NVME_CMB_BIR(dev->cmbloc); | ||
1167 | + bar_size = pci_resource_len(pdev, bar); | ||
1168 | |||
1169 | if (offset > bar_size) | ||
1170 | return NULL; | ||
1171 | @@ -1369,12 +1370,11 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) | ||
1172 | if (size > bar_size - offset) | ||
1173 | size = bar_size - offset; | ||
1174 | |||
1175 | - dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(dev->cmbloc)) + offset; | ||
1176 | - cmb = ioremap_wc(dma_addr, size); | ||
1177 | + cmb = ioremap_wc(pci_resource_start(pdev, bar) + offset, size); | ||
1178 | if (!cmb) | ||
1179 | return NULL; | ||
1180 | |||
1181 | - dev->cmb_dma_addr = dma_addr; | ||
1182 | + dev->cmb_bus_addr = pci_bus_address(pdev, bar) + offset; | ||
1183 | dev->cmb_size = size; | ||
1184 | return cmb; | ||
1185 | } | ||
1186 | diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c | ||
1187 | index 13ac7e57a35d..09fa1fd0c4ce 100644 | ||
1188 | --- a/drivers/scsi/sd.c | ||
1189 | +++ b/drivers/scsi/sd.c | ||
1190 | @@ -2867,8 +2867,6 @@ static int sd_revalidate_disk(struct gendisk *disk) | ||
1191 | sd_read_write_same(sdkp, buffer); | ||
1192 | } | ||
1193 | |||
1194 | - sdkp->first_scan = 0; | ||
1195 | - | ||
1196 | /* | ||
1197 | * We now have all cache related info, determine how we deal | ||
1198 | * with flush requests. | ||
1199 | @@ -2883,7 +2881,7 @@ static int sd_revalidate_disk(struct gendisk *disk) | ||
1200 | q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max); | ||
1201 | |||
1202 | /* | ||
1203 | - * Use the device's preferred I/O size for reads and writes | ||
1204 | + * Determine the device's preferred I/O size for reads and writes | ||
1205 | * unless the reported value is unreasonably small, large, or | ||
1206 | * garbage. | ||
1207 | */ | ||
1208 | @@ -2897,8 +2895,19 @@ static int sd_revalidate_disk(struct gendisk *disk) | ||
1209 | rw_max = min_not_zero(logical_to_sectors(sdp, dev_max), | ||
1210 | (sector_t)BLK_DEF_MAX_SECTORS); | ||
1211 | |||
1212 | - /* Combine with controller limits */ | ||
1213 | - q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); | ||
1214 | + /* Do not exceed controller limit */ | ||
1215 | + rw_max = min(rw_max, queue_max_hw_sectors(q)); | ||
1216 | + | ||
1217 | + /* | ||
1218 | + * Only update max_sectors if previously unset or if the current value | ||
1219 | + * exceeds the capabilities of the hardware. | ||
1220 | + */ | ||
1221 | + if (sdkp->first_scan || | ||
1222 | + q->limits.max_sectors > q->limits.max_dev_sectors || | ||
1223 | + q->limits.max_sectors > q->limits.max_hw_sectors) | ||
1224 | + q->limits.max_sectors = rw_max; | ||
1225 | + | ||
1226 | + sdkp->first_scan = 0; | ||
1227 | |||
1228 | set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); | ||
1229 | sd_config_write_same(sdkp); | ||
1230 | diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c | ||
1231 | index 1cf6b79801a9..eeacb0e55db7 100644 | ||
1232 | --- a/drivers/staging/iio/adc/ad7192.c | ||
1233 | +++ b/drivers/staging/iio/adc/ad7192.c | ||
1234 | @@ -222,11 +222,9 @@ static int ad7192_setup(struct ad7192_state *st, | ||
1235 | struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi); | ||
1236 | unsigned long long scale_uv; | ||
1237 | int i, ret, id; | ||
1238 | - u8 ones[6]; | ||
1239 | |||
1240 | /* reset the serial interface */ | ||
1241 | - memset(&ones, 0xFF, 6); | ||
1242 | - ret = spi_write(st->sd.spi, &ones, 6); | ||
1243 | + ret = ad_sd_reset(&st->sd, 48); | ||
1244 | if (ret < 0) | ||
1245 | goto out; | ||
1246 | usleep_range(500, 1000); /* Wait for at least 500us */ | ||
1247 | diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | ||
1248 | index 1091b9f1dd07..6d459ef8c121 100644 | ||
1249 | --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | ||
1250 | +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | ||
1251 | @@ -538,18 +538,20 @@ free_pagelist(PAGELIST_T *pagelist, int actual) | ||
1252 | if (head_bytes > actual) | ||
1253 | head_bytes = actual; | ||
1254 | |||
1255 | - memcpy((char *)page_address(pages[0]) + | ||
1256 | + memcpy((char *)kmap(pages[0]) + | ||
1257 | pagelist->offset, | ||
1258 | fragments, | ||
1259 | head_bytes); | ||
1260 | + kunmap(pages[0]); | ||
1261 | } | ||
1262 | if ((actual >= 0) && (head_bytes < actual) && | ||
1263 | (tail_bytes != 0)) { | ||
1264 | - memcpy((char *)page_address(pages[num_pages - 1]) + | ||
1265 | + memcpy((char *)kmap(pages[num_pages - 1]) + | ||
1266 | ((pagelist->offset + actual) & | ||
1267 | (PAGE_SIZE - 1) & ~(g_cache_line_size - 1)), | ||
1268 | fragments + g_cache_line_size, | ||
1269 | tail_bytes); | ||
1270 | + kunmap(pages[num_pages - 1]); | ||
1271 | } | ||
1272 | |||
1273 | down(&g_free_fragments_mutex); | ||
1274 | diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c | ||
1275 | index 0b845e550fbd..9f001659807a 100644 | ||
1276 | --- a/drivers/usb/class/cdc-wdm.c | ||
1277 | +++ b/drivers/usb/class/cdc-wdm.c | ||
1278 | @@ -194,8 +194,10 @@ static void wdm_in_callback(struct urb *urb) | ||
1279 | /* | ||
1280 | * only set a new error if there is no previous error. | ||
1281 | * Errors are only cleared during read/open | ||
1282 | + * Avoid propagating -EPIPE (stall) to userspace since it is | ||
1283 | + * better handled as an empty read | ||
1284 | */ | ||
1285 | - if (desc->rerr == 0) | ||
1286 | + if (desc->rerr == 0 && status != -EPIPE) | ||
1287 | desc->rerr = status; | ||
1288 | |||
1289 | if (length + desc->length > desc->wMaxCommand) { | ||
1290 | diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c | ||
1291 | index eef716bdc259..11793386b4e9 100644 | ||
1292 | --- a/drivers/usb/core/config.c | ||
1293 | +++ b/drivers/usb/core/config.c | ||
1294 | @@ -638,15 +638,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, | ||
1295 | |||
1296 | } else if (header->bDescriptorType == | ||
1297 | USB_DT_INTERFACE_ASSOCIATION) { | ||
1298 | + struct usb_interface_assoc_descriptor *d; | ||
1299 | + | ||
1300 | + d = (struct usb_interface_assoc_descriptor *)header; | ||
1301 | + if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) { | ||
1302 | + dev_warn(ddev, | ||
1303 | + "config %d has an invalid interface association descriptor of length %d, skipping\n", | ||
1304 | + cfgno, d->bLength); | ||
1305 | + continue; | ||
1306 | + } | ||
1307 | + | ||
1308 | if (iad_num == USB_MAXIADS) { | ||
1309 | dev_warn(ddev, "found more Interface " | ||
1310 | "Association Descriptors " | ||
1311 | "than allocated for in " | ||
1312 | "configuration %d\n", cfgno); | ||
1313 | } else { | ||
1314 | - config->intf_assoc[iad_num] = | ||
1315 | - (struct usb_interface_assoc_descriptor | ||
1316 | - *)header; | ||
1317 | + config->intf_assoc[iad_num] = d; | ||
1318 | iad_num++; | ||
1319 | } | ||
1320 | |||
1321 | @@ -847,7 +855,7 @@ int usb_get_configuration(struct usb_device *dev) | ||
1322 | } | ||
1323 | |||
1324 | if (dev->quirks & USB_QUIRK_DELAY_INIT) | ||
1325 | - msleep(100); | ||
1326 | + msleep(200); | ||
1327 | |||
1328 | result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, | ||
1329 | bigbuffer, length); | ||
1330 | diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c | ||
1331 | index c8075eb3db26..860108c46e9a 100644 | ||
1332 | --- a/drivers/usb/core/devio.c | ||
1333 | +++ b/drivers/usb/core/devio.c | ||
1334 | @@ -1577,7 +1577,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb | ||
1335 | totlen += isopkt[u].length; | ||
1336 | } | ||
1337 | u *= sizeof(struct usb_iso_packet_descriptor); | ||
1338 | - uurb->buffer_length = totlen; | ||
1339 | + if (totlen <= uurb->buffer_length) | ||
1340 | + uurb->buffer_length = totlen; | ||
1341 | + else | ||
1342 | + WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d", | ||
1343 | + totlen, uurb->buffer_length); | ||
1344 | break; | ||
1345 | |||
1346 | default: | ||
1347 | diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c | ||
1348 | index 80d4ef31ba8d..8127f112958e 100644 | ||
1349 | --- a/drivers/usb/core/hub.c | ||
1350 | +++ b/drivers/usb/core/hub.c | ||
1351 | @@ -4828,7 +4828,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, | ||
1352 | goto loop; | ||
1353 | |||
1354 | if (udev->quirks & USB_QUIRK_DELAY_INIT) | ||
1355 | - msleep(1000); | ||
1356 | + msleep(2000); | ||
1357 | |||
1358 | /* consecutive bus-powered hubs aren't reliable; they can | ||
1359 | * violate the voltage drop budget. if the new child has | ||
1360 | diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c | ||
1361 | index 3a4707746157..4c388451f31f 100644 | ||
1362 | --- a/drivers/usb/core/message.c | ||
1363 | +++ b/drivers/usb/core/message.c | ||
1364 | @@ -2068,6 +2068,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, | ||
1365 | elength = 1; | ||
1366 | goto next_desc; | ||
1367 | } | ||
1368 | + if ((buflen < elength) || (elength < 3)) { | ||
1369 | + dev_err(&intf->dev, "invalid descriptor buffer length\n"); | ||
1370 | + break; | ||
1371 | + } | ||
1372 | if (buffer[1] != USB_DT_CS_INTERFACE) { | ||
1373 | dev_err(&intf->dev, "skipping garbage\n"); | ||
1374 | goto next_desc; | ||
1375 | diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c | ||
1376 | index ccd93c9e26ab..d2fc237cd87a 100644 | ||
1377 | --- a/drivers/usb/gadget/function/f_mass_storage.c | ||
1378 | +++ b/drivers/usb/gadget/function/f_mass_storage.c | ||
1379 | @@ -306,8 +306,6 @@ struct fsg_common { | ||
1380 | struct completion thread_notifier; | ||
1381 | struct task_struct *thread_task; | ||
1382 | |||
1383 | - /* Callback functions. */ | ||
1384 | - const struct fsg_operations *ops; | ||
1385 | /* Gadget's private data. */ | ||
1386 | void *private_data; | ||
1387 | |||
1388 | @@ -2505,6 +2503,7 @@ static void handle_exception(struct fsg_common *common) | ||
1389 | static int fsg_main_thread(void *common_) | ||
1390 | { | ||
1391 | struct fsg_common *common = common_; | ||
1392 | + int i; | ||
1393 | |||
1394 | /* | ||
1395 | * Allow the thread to be killed by a signal, but set the signal mask | ||
1396 | @@ -2566,21 +2565,16 @@ static int fsg_main_thread(void *common_) | ||
1397 | common->thread_task = NULL; | ||
1398 | spin_unlock_irq(&common->lock); | ||
1399 | |||
1400 | - if (!common->ops || !common->ops->thread_exits | ||
1401 | - || common->ops->thread_exits(common) < 0) { | ||
1402 | - int i; | ||
1403 | + /* Eject media from all LUNs */ | ||
1404 | |||
1405 | - down_write(&common->filesem); | ||
1406 | - for (i = 0; i < ARRAY_SIZE(common->luns); --i) { | ||
1407 | - struct fsg_lun *curlun = common->luns[i]; | ||
1408 | - if (!curlun || !fsg_lun_is_open(curlun)) | ||
1409 | - continue; | ||
1410 | + down_write(&common->filesem); | ||
1411 | + for (i = 0; i < ARRAY_SIZE(common->luns); i++) { | ||
1412 | + struct fsg_lun *curlun = common->luns[i]; | ||
1413 | |||
1414 | + if (curlun && fsg_lun_is_open(curlun)) | ||
1415 | fsg_lun_close(curlun); | ||
1416 | - curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT; | ||
1417 | - } | ||
1418 | - up_write(&common->filesem); | ||
1419 | } | ||
1420 | + up_write(&common->filesem); | ||
1421 | |||
1422 | /* Let fsg_unbind() know the thread has exited */ | ||
1423 | complete_and_exit(&common->thread_notifier, 0); | ||
1424 | @@ -2770,13 +2764,6 @@ void fsg_common_remove_luns(struct fsg_common *common) | ||
1425 | } | ||
1426 | EXPORT_SYMBOL_GPL(fsg_common_remove_luns); | ||
1427 | |||
1428 | -void fsg_common_set_ops(struct fsg_common *common, | ||
1429 | - const struct fsg_operations *ops) | ||
1430 | -{ | ||
1431 | - common->ops = ops; | ||
1432 | -} | ||
1433 | -EXPORT_SYMBOL_GPL(fsg_common_set_ops); | ||
1434 | - | ||
1435 | void fsg_common_free_buffers(struct fsg_common *common) | ||
1436 | { | ||
1437 | _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers); | ||
1438 | diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h | ||
1439 | index d3902313b8ac..dc05ca0c4359 100644 | ||
1440 | --- a/drivers/usb/gadget/function/f_mass_storage.h | ||
1441 | +++ b/drivers/usb/gadget/function/f_mass_storage.h | ||
1442 | @@ -60,17 +60,6 @@ struct fsg_module_parameters { | ||
1443 | struct fsg_common; | ||
1444 | |||
1445 | /* FSF callback functions */ | ||
1446 | -struct fsg_operations { | ||
1447 | - /* | ||
1448 | - * Callback function to call when thread exits. If no | ||
1449 | - * callback is set or it returns value lower then zero MSF | ||
1450 | - * will force eject all LUNs it operates on (including those | ||
1451 | - * marked as non-removable or with prevent_medium_removal flag | ||
1452 | - * set). | ||
1453 | - */ | ||
1454 | - int (*thread_exits)(struct fsg_common *common); | ||
1455 | -}; | ||
1456 | - | ||
1457 | struct fsg_lun_opts { | ||
1458 | struct config_group group; | ||
1459 | struct fsg_lun *lun; | ||
1460 | @@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun); | ||
1461 | |||
1462 | void fsg_common_remove_luns(struct fsg_common *common); | ||
1463 | |||
1464 | -void fsg_common_set_ops(struct fsg_common *common, | ||
1465 | - const struct fsg_operations *ops); | ||
1466 | - | ||
1467 | int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg, | ||
1468 | unsigned int id, const char *name, | ||
1469 | const char **name_pfx); | ||
1470 | diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c | ||
1471 | index f959c42ecace..f69dbd4bcd18 100644 | ||
1472 | --- a/drivers/usb/gadget/legacy/inode.c | ||
1473 | +++ b/drivers/usb/gadget/legacy/inode.c | ||
1474 | @@ -27,7 +27,7 @@ | ||
1475 | #include <linux/mmu_context.h> | ||
1476 | #include <linux/aio.h> | ||
1477 | #include <linux/uio.h> | ||
1478 | - | ||
1479 | +#include <linux/delay.h> | ||
1480 | #include <linux/device.h> | ||
1481 | #include <linux/moduleparam.h> | ||
1482 | |||
1483 | @@ -116,6 +116,7 @@ enum ep0_state { | ||
1484 | struct dev_data { | ||
1485 | spinlock_t lock; | ||
1486 | atomic_t count; | ||
1487 | + int udc_usage; | ||
1488 | enum ep0_state state; /* P: lock */ | ||
1489 | struct usb_gadgetfs_event event [N_EVENT]; | ||
1490 | unsigned ev_next; | ||
1491 | @@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) | ||
1492 | INIT_WORK(&priv->work, ep_user_copy_worker); | ||
1493 | schedule_work(&priv->work); | ||
1494 | } | ||
1495 | - spin_unlock(&epdata->dev->lock); | ||
1496 | |||
1497 | usb_ep_free_request(ep, req); | ||
1498 | + spin_unlock(&epdata->dev->lock); | ||
1499 | put_ep(epdata); | ||
1500 | } | ||
1501 | |||
1502 | @@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) | ||
1503 | struct usb_request *req = dev->req; | ||
1504 | |||
1505 | if ((retval = setup_req (ep, req, 0)) == 0) { | ||
1506 | + ++dev->udc_usage; | ||
1507 | spin_unlock_irq (&dev->lock); | ||
1508 | retval = usb_ep_queue (ep, req, GFP_KERNEL); | ||
1509 | spin_lock_irq (&dev->lock); | ||
1510 | + --dev->udc_usage; | ||
1511 | } | ||
1512 | dev->state = STATE_DEV_CONNECTED; | ||
1513 | |||
1514 | @@ -983,11 +986,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) | ||
1515 | retval = -EIO; | ||
1516 | else { | ||
1517 | len = min (len, (size_t)dev->req->actual); | ||
1518 | -// FIXME don't call this with the spinlock held ... | ||
1519 | + ++dev->udc_usage; | ||
1520 | + spin_unlock_irq(&dev->lock); | ||
1521 | if (copy_to_user (buf, dev->req->buf, len)) | ||
1522 | retval = -EFAULT; | ||
1523 | else | ||
1524 | retval = len; | ||
1525 | + spin_lock_irq(&dev->lock); | ||
1526 | + --dev->udc_usage; | ||
1527 | clean_req (dev->gadget->ep0, dev->req); | ||
1528 | /* NOTE userspace can't yet choose to stall */ | ||
1529 | } | ||
1530 | @@ -1131,6 +1137,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) | ||
1531 | retval = setup_req (dev->gadget->ep0, dev->req, len); | ||
1532 | if (retval == 0) { | ||
1533 | dev->state = STATE_DEV_CONNECTED; | ||
1534 | + ++dev->udc_usage; | ||
1535 | spin_unlock_irq (&dev->lock); | ||
1536 | if (copy_from_user (dev->req->buf, buf, len)) | ||
1537 | retval = -EFAULT; | ||
1538 | @@ -1142,6 +1149,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) | ||
1539 | GFP_KERNEL); | ||
1540 | } | ||
1541 | spin_lock_irq(&dev->lock); | ||
1542 | + --dev->udc_usage; | ||
1543 | if (retval < 0) { | ||
1544 | clean_req (dev->gadget->ep0, dev->req); | ||
1545 | } else | ||
1546 | @@ -1243,9 +1251,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value) | ||
1547 | struct usb_gadget *gadget = dev->gadget; | ||
1548 | long ret = -ENOTTY; | ||
1549 | |||
1550 | - if (gadget->ops->ioctl) | ||
1551 | + spin_lock_irq(&dev->lock); | ||
1552 | + if (dev->state == STATE_DEV_OPENED || | ||
1553 | + dev->state == STATE_DEV_UNBOUND) { | ||
1554 | + /* Not bound to a UDC */ | ||
1555 | + } else if (gadget->ops->ioctl) { | ||
1556 | + ++dev->udc_usage; | ||
1557 | + spin_unlock_irq(&dev->lock); | ||
1558 | + | ||
1559 | ret = gadget->ops->ioctl (gadget, code, value); | ||
1560 | |||
1561 | + spin_lock_irq(&dev->lock); | ||
1562 | + --dev->udc_usage; | ||
1563 | + } | ||
1564 | + spin_unlock_irq(&dev->lock); | ||
1565 | + | ||
1566 | return ret; | ||
1567 | } | ||
1568 | |||
1569 | @@ -1463,10 +1483,12 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) | ||
1570 | if (value < 0) | ||
1571 | break; | ||
1572 | |||
1573 | + ++dev->udc_usage; | ||
1574 | spin_unlock (&dev->lock); | ||
1575 | value = usb_ep_queue (gadget->ep0, dev->req, | ||
1576 | GFP_KERNEL); | ||
1577 | spin_lock (&dev->lock); | ||
1578 | + --dev->udc_usage; | ||
1579 | if (value < 0) { | ||
1580 | clean_req (gadget->ep0, dev->req); | ||
1581 | break; | ||
1582 | @@ -1490,8 +1512,12 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) | ||
1583 | req->length = value; | ||
1584 | req->zero = value < w_length; | ||
1585 | |||
1586 | + ++dev->udc_usage; | ||
1587 | spin_unlock (&dev->lock); | ||
1588 | value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); | ||
1589 | + spin_lock(&dev->lock); | ||
1590 | + --dev->udc_usage; | ||
1591 | + spin_unlock(&dev->lock); | ||
1592 | if (value < 0) { | ||
1593 | DBG (dev, "ep_queue --> %d\n", value); | ||
1594 | req->status = 0; | ||
1595 | @@ -1518,21 +1544,24 @@ static void destroy_ep_files (struct dev_data *dev) | ||
1596 | /* break link to FS */ | ||
1597 | ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); | ||
1598 | list_del_init (&ep->epfiles); | ||
1599 | + spin_unlock_irq (&dev->lock); | ||
1600 | + | ||
1601 | dentry = ep->dentry; | ||
1602 | ep->dentry = NULL; | ||
1603 | parent = d_inode(dentry->d_parent); | ||
1604 | |||
1605 | /* break link to controller */ | ||
1606 | + mutex_lock(&ep->lock); | ||
1607 | if (ep->state == STATE_EP_ENABLED) | ||
1608 | (void) usb_ep_disable (ep->ep); | ||
1609 | ep->state = STATE_EP_UNBOUND; | ||
1610 | usb_ep_free_request (ep->ep, ep->req); | ||
1611 | ep->ep = NULL; | ||
1612 | + mutex_unlock(&ep->lock); | ||
1613 | + | ||
1614 | wake_up (&ep->wait); | ||
1615 | put_ep (ep); | ||
1616 | |||
1617 | - spin_unlock_irq (&dev->lock); | ||
1618 | - | ||
1619 | /* break link to dcache */ | ||
1620 | inode_lock(parent); | ||
1621 | d_delete (dentry); | ||
1622 | @@ -1603,6 +1632,11 @@ gadgetfs_unbind (struct usb_gadget *gadget) | ||
1623 | |||
1624 | spin_lock_irq (&dev->lock); | ||
1625 | dev->state = STATE_DEV_UNBOUND; | ||
1626 | + while (dev->udc_usage > 0) { | ||
1627 | + spin_unlock_irq(&dev->lock); | ||
1628 | + usleep_range(1000, 2000); | ||
1629 | + spin_lock_irq(&dev->lock); | ||
1630 | + } | ||
1631 | spin_unlock_irq (&dev->lock); | ||
1632 | |||
1633 | destroy_ep_files (dev); | ||
1634 | diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c | ||
1635 | index 125974f32f50..fcba59782f26 100644 | ||
1636 | --- a/drivers/usb/gadget/legacy/mass_storage.c | ||
1637 | +++ b/drivers/usb/gadget/legacy/mass_storage.c | ||
1638 | @@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS; | ||
1639 | |||
1640 | FSG_MODULE_PARAMETERS(/* no prefix */, mod_data); | ||
1641 | |||
1642 | -static unsigned long msg_registered; | ||
1643 | -static void msg_cleanup(void); | ||
1644 | - | ||
1645 | -static int msg_thread_exits(struct fsg_common *common) | ||
1646 | -{ | ||
1647 | - msg_cleanup(); | ||
1648 | - return 0; | ||
1649 | -} | ||
1650 | - | ||
1651 | static int msg_do_config(struct usb_configuration *c) | ||
1652 | { | ||
1653 | struct fsg_opts *opts; | ||
1654 | @@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = { | ||
1655 | |||
1656 | static int msg_bind(struct usb_composite_dev *cdev) | ||
1657 | { | ||
1658 | - static const struct fsg_operations ops = { | ||
1659 | - .thread_exits = msg_thread_exits, | ||
1660 | - }; | ||
1661 | struct fsg_opts *opts; | ||
1662 | struct fsg_config config; | ||
1663 | int status; | ||
1664 | @@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev) | ||
1665 | if (status) | ||
1666 | goto fail; | ||
1667 | |||
1668 | - fsg_common_set_ops(opts->common, &ops); | ||
1669 | - | ||
1670 | status = fsg_common_set_cdev(opts->common, cdev, config.can_stall); | ||
1671 | if (status) | ||
1672 | goto fail_set_cdev; | ||
1673 | @@ -210,7 +196,6 @@ static int msg_bind(struct usb_composite_dev *cdev) | ||
1674 | usb_composite_overwrite_options(cdev, &coverwrite); | ||
1675 | dev_info(&cdev->gadget->dev, | ||
1676 | DRIVER_DESC ", version: " DRIVER_VERSION "\n"); | ||
1677 | - set_bit(0, &msg_registered); | ||
1678 | return 0; | ||
1679 | |||
1680 | fail_otg_desc: | ||
1681 | @@ -261,9 +246,8 @@ static int __init msg_init(void) | ||
1682 | } | ||
1683 | module_init(msg_init); | ||
1684 | |||
1685 | -static void msg_cleanup(void) | ||
1686 | +static void __exit msg_cleanup(void) | ||
1687 | { | ||
1688 | - if (test_and_clear_bit(0, &msg_registered)) | ||
1689 | - usb_composite_unregister(&msg_driver); | ||
1690 | + usb_composite_unregister(&msg_driver); | ||
1691 | } | ||
1692 | module_exit(msg_cleanup); | ||
1693 | diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c | ||
1694 | index a95b3e75f750..ad8402906f77 100644 | ||
1695 | --- a/drivers/usb/gadget/udc/atmel_usba_udc.c | ||
1696 | +++ b/drivers/usb/gadget/udc/atmel_usba_udc.c | ||
1697 | @@ -28,6 +28,8 @@ | ||
1698 | #include <linux/of_gpio.h> | ||
1699 | |||
1700 | #include "atmel_usba_udc.h" | ||
1701 | +#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \ | ||
1702 | + | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING) | ||
1703 | |||
1704 | #ifdef CONFIG_USB_GADGET_DEBUG_FS | ||
1705 | #include <linux/debugfs.h> | ||
1706 | @@ -2172,7 +2174,7 @@ static int usba_udc_probe(struct platform_device *pdev) | ||
1707 | IRQ_NOAUTOEN); | ||
1708 | ret = devm_request_threaded_irq(&pdev->dev, | ||
1709 | gpio_to_irq(udc->vbus_pin), NULL, | ||
1710 | - usba_vbus_irq_thread, IRQF_ONESHOT, | ||
1711 | + usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS, | ||
1712 | "atmel_usba_udc", udc); | ||
1713 | if (ret) { | ||
1714 | udc->vbus_pin = -ENODEV; | ||
1715 | diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c | ||
1716 | index 94c8a9f6cbf1..fb17fb23fa9a 100644 | ||
1717 | --- a/drivers/usb/gadget/udc/dummy_hcd.c | ||
1718 | +++ b/drivers/usb/gadget/udc/dummy_hcd.c | ||
1719 | @@ -237,6 +237,8 @@ struct dummy_hcd { | ||
1720 | |||
1721 | struct usb_device *udev; | ||
1722 | struct list_head urbp_list; | ||
1723 | + struct urbp *next_frame_urbp; | ||
1724 | + | ||
1725 | u32 stream_en_ep; | ||
1726 | u8 num_stream[30 / 2]; | ||
1727 | |||
1728 | @@ -253,11 +255,13 @@ struct dummy { | ||
1729 | */ | ||
1730 | struct dummy_ep ep[DUMMY_ENDPOINTS]; | ||
1731 | int address; | ||
1732 | + int callback_usage; | ||
1733 | struct usb_gadget gadget; | ||
1734 | struct usb_gadget_driver *driver; | ||
1735 | struct dummy_request fifo_req; | ||
1736 | u8 fifo_buf[FIFO_SIZE]; | ||
1737 | u16 devstatus; | ||
1738 | + unsigned ints_enabled:1; | ||
1739 | unsigned udc_suspended:1; | ||
1740 | unsigned pullup:1; | ||
1741 | |||
1742 | @@ -440,18 +444,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd) | ||
1743 | (~dum_hcd->old_status) & dum_hcd->port_status; | ||
1744 | |||
1745 | /* Report reset and disconnect events to the driver */ | ||
1746 | - if (dum->driver && (disconnect || reset)) { | ||
1747 | + if (dum->ints_enabled && (disconnect || reset)) { | ||
1748 | stop_activity(dum); | ||
1749 | + ++dum->callback_usage; | ||
1750 | + spin_unlock(&dum->lock); | ||
1751 | if (reset) | ||
1752 | usb_gadget_udc_reset(&dum->gadget, dum->driver); | ||
1753 | else | ||
1754 | dum->driver->disconnect(&dum->gadget); | ||
1755 | + spin_lock(&dum->lock); | ||
1756 | + --dum->callback_usage; | ||
1757 | } | ||
1758 | - } else if (dum_hcd->active != dum_hcd->old_active) { | ||
1759 | + } else if (dum_hcd->active != dum_hcd->old_active && | ||
1760 | + dum->ints_enabled) { | ||
1761 | + ++dum->callback_usage; | ||
1762 | + spin_unlock(&dum->lock); | ||
1763 | if (dum_hcd->old_active && dum->driver->suspend) | ||
1764 | dum->driver->suspend(&dum->gadget); | ||
1765 | else if (!dum_hcd->old_active && dum->driver->resume) | ||
1766 | dum->driver->resume(&dum->gadget); | ||
1767 | + spin_lock(&dum->lock); | ||
1768 | + --dum->callback_usage; | ||
1769 | } | ||
1770 | |||
1771 | dum_hcd->old_status = dum_hcd->port_status; | ||
1772 | @@ -965,8 +978,11 @@ static int dummy_udc_start(struct usb_gadget *g, | ||
1773 | * can't enumerate without help from the driver we're binding. | ||
1774 | */ | ||
1775 | |||
1776 | + spin_lock_irq(&dum->lock); | ||
1777 | dum->devstatus = 0; | ||
1778 | dum->driver = driver; | ||
1779 | + dum->ints_enabled = 1; | ||
1780 | + spin_unlock_irq(&dum->lock); | ||
1781 | |||
1782 | return 0; | ||
1783 | } | ||
1784 | @@ -977,6 +993,16 @@ static int dummy_udc_stop(struct usb_gadget *g) | ||
1785 | struct dummy *dum = dum_hcd->dum; | ||
1786 | |||
1787 | spin_lock_irq(&dum->lock); | ||
1788 | + dum->ints_enabled = 0; | ||
1789 | + stop_activity(dum); | ||
1790 | + | ||
1791 | + /* emulate synchronize_irq(): wait for callbacks to finish */ | ||
1792 | + while (dum->callback_usage > 0) { | ||
1793 | + spin_unlock_irq(&dum->lock); | ||
1794 | + usleep_range(1000, 2000); | ||
1795 | + spin_lock_irq(&dum->lock); | ||
1796 | + } | ||
1797 | + | ||
1798 | dum->driver = NULL; | ||
1799 | spin_unlock_irq(&dum->lock); | ||
1800 | |||
1801 | @@ -1030,7 +1056,12 @@ static int dummy_udc_probe(struct platform_device *pdev) | ||
1802 | memzero_explicit(&dum->gadget, sizeof(struct usb_gadget)); | ||
1803 | dum->gadget.name = gadget_name; | ||
1804 | dum->gadget.ops = &dummy_ops; | ||
1805 | - dum->gadget.max_speed = USB_SPEED_SUPER; | ||
1806 | + if (mod_data.is_super_speed) | ||
1807 | + dum->gadget.max_speed = USB_SPEED_SUPER; | ||
1808 | + else if (mod_data.is_high_speed) | ||
1809 | + dum->gadget.max_speed = USB_SPEED_HIGH; | ||
1810 | + else | ||
1811 | + dum->gadget.max_speed = USB_SPEED_FULL; | ||
1812 | |||
1813 | dum->gadget.dev.parent = &pdev->dev; | ||
1814 | init_dummy_udc_hw(dum); | ||
1815 | @@ -1239,6 +1270,8 @@ static int dummy_urb_enqueue( | ||
1816 | |||
1817 | list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list); | ||
1818 | urb->hcpriv = urbp; | ||
1819 | + if (!dum_hcd->next_frame_urbp) | ||
1820 | + dum_hcd->next_frame_urbp = urbp; | ||
1821 | if (usb_pipetype(urb->pipe) == PIPE_CONTROL) | ||
1822 | urb->error_count = 1; /* mark as a new urb */ | ||
1823 | |||
1824 | @@ -1515,6 +1548,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address) | ||
1825 | if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ? | ||
1826 | dum->ss_hcd : dum->hs_hcd))) | ||
1827 | return NULL; | ||
1828 | + if (!dum->ints_enabled) | ||
1829 | + return NULL; | ||
1830 | if ((address & ~USB_DIR_IN) == 0) | ||
1831 | return &dum->ep[0]; | ||
1832 | for (i = 1; i < DUMMY_ENDPOINTS; i++) { | ||
1833 | @@ -1756,6 +1791,7 @@ static void dummy_timer(unsigned long _dum_hcd) | ||
1834 | spin_unlock_irqrestore(&dum->lock, flags); | ||
1835 | return; | ||
1836 | } | ||
1837 | + dum_hcd->next_frame_urbp = NULL; | ||
1838 | |||
1839 | for (i = 0; i < DUMMY_ENDPOINTS; i++) { | ||
1840 | if (!ep_info[i].name) | ||
1841 | @@ -1772,6 +1808,10 @@ static void dummy_timer(unsigned long _dum_hcd) | ||
1842 | int type; | ||
1843 | int status = -EINPROGRESS; | ||
1844 | |||
1845 | + /* stop when we reach URBs queued after the timer interrupt */ | ||
1846 | + if (urbp == dum_hcd->next_frame_urbp) | ||
1847 | + break; | ||
1848 | + | ||
1849 | urb = urbp->urb; | ||
1850 | if (urb->unlinked) | ||
1851 | goto return_urb; | ||
1852 | @@ -1851,10 +1891,12 @@ static void dummy_timer(unsigned long _dum_hcd) | ||
1853 | * until setup() returns; no reentrancy issues etc. | ||
1854 | */ | ||
1855 | if (value > 0) { | ||
1856 | + ++dum->callback_usage; | ||
1857 | spin_unlock(&dum->lock); | ||
1858 | value = dum->driver->setup(&dum->gadget, | ||
1859 | &setup); | ||
1860 | spin_lock(&dum->lock); | ||
1861 | + --dum->callback_usage; | ||
1862 | |||
1863 | if (value >= 0) { | ||
1864 | /* no delays (max 64KB data stage) */ | ||
1865 | @@ -2559,8 +2601,6 @@ static struct hc_driver dummy_hcd = { | ||
1866 | .product_desc = "Dummy host controller", | ||
1867 | .hcd_priv_size = sizeof(struct dummy_hcd), | ||
1868 | |||
1869 | - .flags = HCD_USB3 | HCD_SHARED, | ||
1870 | - | ||
1871 | .reset = dummy_setup, | ||
1872 | .start = dummy_start, | ||
1873 | .stop = dummy_stop, | ||
1874 | @@ -2589,8 +2629,12 @@ static int dummy_hcd_probe(struct platform_device *pdev) | ||
1875 | dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc); | ||
1876 | dum = *((void **)dev_get_platdata(&pdev->dev)); | ||
1877 | |||
1878 | - if (!mod_data.is_super_speed) | ||
1879 | + if (mod_data.is_super_speed) | ||
1880 | + dummy_hcd.flags = HCD_USB3 | HCD_SHARED; | ||
1881 | + else if (mod_data.is_high_speed) | ||
1882 | dummy_hcd.flags = HCD_USB2; | ||
1883 | + else | ||
1884 | + dummy_hcd.flags = HCD_USB11; | ||
1885 | hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev)); | ||
1886 | if (!hs_hcd) | ||
1887 | return -ENOMEM; | ||
1888 | diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c | ||
1889 | index d2cfefadca3c..bb89e24c48b4 100644 | ||
1890 | --- a/drivers/usb/gadget/udc/renesas_usb3.c | ||
1891 | +++ b/drivers/usb/gadget/udc/renesas_usb3.c | ||
1892 | @@ -879,7 +879,7 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep, | ||
1893 | usb3_ep->ep.maxpacket); | ||
1894 | u8 *buf = usb3_req->req.buf + usb3_req->req.actual; | ||
1895 | u32 tmp = 0; | ||
1896 | - bool is_last; | ||
1897 | + bool is_last = !len ? true : false; | ||
1898 | |||
1899 | if (usb3_wait_pipe_status(usb3_ep, PX_STA_BUFSTS) < 0) | ||
1900 | return -EBUSY; | ||
1901 | @@ -900,7 +900,8 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep, | ||
1902 | usb3_write(usb3, tmp, fifo_reg); | ||
1903 | } | ||
1904 | |||
1905 | - is_last = usb3_is_transfer_complete(usb3_ep, usb3_req); | ||
1906 | + if (!is_last) | ||
1907 | + is_last = usb3_is_transfer_complete(usb3_ep, usb3_req); | ||
1908 | /* Send the data */ | ||
1909 | usb3_set_px_con_send(usb3_ep, len, is_last); | ||
1910 | |||
1911 | @@ -991,7 +992,8 @@ static void usb3_start_pipe0(struct renesas_usb3_ep *usb3_ep, | ||
1912 | usb3_set_p0_con_for_ctrl_read_data(usb3); | ||
1913 | } else { | ||
1914 | usb3_clear_bit(usb3, P0_MOD_DIR, USB3_P0_MOD); | ||
1915 | - usb3_set_p0_con_for_ctrl_write_data(usb3); | ||
1916 | + if (usb3_req->req.length) | ||
1917 | + usb3_set_p0_con_for_ctrl_write_data(usb3); | ||
1918 | } | ||
1919 | |||
1920 | usb3_p0_xfer(usb3_ep, usb3_req); | ||
1921 | @@ -1568,7 +1570,16 @@ static u32 usb3_calc_ramarea(int ram_size) | ||
1922 | static u32 usb3_calc_rammap_val(struct renesas_usb3_ep *usb3_ep, | ||
1923 | const struct usb_endpoint_descriptor *desc) | ||
1924 | { | ||
1925 | - return usb3_ep->rammap_val | PN_RAMMAP_MPKT(usb_endpoint_maxp(desc)); | ||
1926 | + int i; | ||
1927 | + const u32 max_packet_array[] = {8, 16, 32, 64, 512}; | ||
1928 | + u32 mpkt = PN_RAMMAP_MPKT(1024); | ||
1929 | + | ||
1930 | + for (i = 0; i < ARRAY_SIZE(max_packet_array); i++) { | ||
1931 | + if (usb_endpoint_maxp(desc) <= max_packet_array[i]) | ||
1932 | + mpkt = PN_RAMMAP_MPKT(max_packet_array[i]); | ||
1933 | + } | ||
1934 | + | ||
1935 | + return usb3_ep->rammap_val | mpkt; | ||
1936 | } | ||
1937 | |||
1938 | static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep, | ||
1939 | diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c | ||
1940 | index 58b9685eb21f..ee213c5f4107 100644 | ||
1941 | --- a/drivers/usb/host/pci-quirks.c | ||
1942 | +++ b/drivers/usb/host/pci-quirks.c | ||
1943 | @@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(struct pci_dev *pdev) | ||
1944 | if ((value & ASMT_CONTROL_WRITE_BIT) == 0) | ||
1945 | return 0; | ||
1946 | |||
1947 | - usleep_range(40, 60); | ||
1948 | + udelay(50); | ||
1949 | } | ||
1950 | |||
1951 | dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__); | ||
1952 | @@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports); | ||
1953 | * | ||
1954 | * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS. | ||
1955 | * It signals to the BIOS that the OS wants control of the host controller, | ||
1956 | - * and then waits 5 seconds for the BIOS to hand over control. | ||
1957 | + * and then waits 1 second for the BIOS to hand over control. | ||
1958 | * If we timeout, assume the BIOS is broken and take control anyway. | ||
1959 | */ | ||
1960 | static void quirk_usb_handoff_xhci(struct pci_dev *pdev) | ||
1961 | @@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) | ||
1962 | if (val & XHCI_HC_BIOS_OWNED) { | ||
1963 | writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset); | ||
1964 | |||
1965 | - /* Wait for 5 seconds with 10 microsecond polling interval */ | ||
1966 | + /* Wait for 1 second with 10 microsecond polling interval */ | ||
1967 | timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED, | ||
1968 | - 0, 5000, 10); | ||
1969 | + 0, 1000000, 10); | ||
1970 | |||
1971 | /* Assume a buggy BIOS and take HC ownership anyway */ | ||
1972 | if (timeout) { | ||
1973 | @@ -1100,7 +1100,7 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) | ||
1974 | * operational or runtime registers. Wait 5 seconds and no more. | ||
1975 | */ | ||
1976 | timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0, | ||
1977 | - 5000, 10); | ||
1978 | + 5000000, 10); | ||
1979 | /* Assume a buggy HC and start HC initialization anyway */ | ||
1980 | if (timeout) { | ||
1981 | val = readl(op_reg_base + XHCI_STS_OFFSET); | ||
1982 | diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c | ||
1983 | index 36b7789f8f22..4a02c5c7df0d 100644 | ||
1984 | --- a/drivers/usb/host/xhci-hub.c | ||
1985 | +++ b/drivers/usb/host/xhci-hub.c | ||
1986 | @@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, | ||
1987 | |||
1988 | /* If PSI table exists, add the custom speed attributes from it */ | ||
1989 | if (usb3_1 && xhci->usb3_rhub.psi_count) { | ||
1990 | - u32 ssp_cap_base, bm_attrib, psi; | ||
1991 | + u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp; | ||
1992 | int offset; | ||
1993 | |||
1994 | ssp_cap_base = USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE; | ||
1995 | @@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, | ||
1996 | for (i = 0; i < xhci->usb3_rhub.psi_count; i++) { | ||
1997 | psi = xhci->usb3_rhub.psi[i]; | ||
1998 | psi &= ~USB_SSP_SUBLINK_SPEED_RSVD; | ||
1999 | + psi_exp = XHCI_EXT_PORT_PSIE(psi); | ||
2000 | + psi_mant = XHCI_EXT_PORT_PSIM(psi); | ||
2001 | + | ||
2002 | + /* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */ | ||
2003 | + for (; psi_exp < 3; psi_exp++) | ||
2004 | + psi_mant /= 1000; | ||
2005 | + if (psi_mant >= 10) | ||
2006 | + psi |= BIT(14); | ||
2007 | + | ||
2008 | if ((psi & PLT_MASK) == PLT_SYM) { | ||
2009 | /* Symmetric, create SSA RX and TX from one PSI entry */ | ||
2010 | put_unaligned_le32(psi, &buf[offset]); | ||
2011 | @@ -1351,9 +1360,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd) | ||
2012 | t2 |= PORT_WKOC_E | PORT_WKCONN_E; | ||
2013 | t2 &= ~PORT_WKDISC_E; | ||
2014 | } | ||
2015 | - if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) && | ||
2016 | - (hcd->speed < HCD_USB3)) | ||
2017 | - t2 &= ~PORT_WAKE_BITS; | ||
2018 | } else | ||
2019 | t2 &= ~PORT_WAKE_BITS; | ||
2020 | |||
2021 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c | ||
2022 | index 23833448e602..c87ef38e7416 100644 | ||
2023 | --- a/drivers/usb/host/xhci-pci.c | ||
2024 | +++ b/drivers/usb/host/xhci-pci.c | ||
2025 | @@ -54,11 +54,6 @@ | ||
2026 | #define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 | ||
2027 | #define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0 | ||
2028 | |||
2029 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 | ||
2030 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba | ||
2031 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb | ||
2032 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc | ||
2033 | - | ||
2034 | #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 | ||
2035 | |||
2036 | static const char hcd_name[] = "xhci_hcd"; | ||
2037 | @@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) | ||
2038 | if (pdev->vendor == PCI_VENDOR_ID_AMD) | ||
2039 | xhci->quirks |= XHCI_TRUST_TX_LENGTH; | ||
2040 | |||
2041 | - if ((pdev->vendor == PCI_VENDOR_ID_AMD) && | ||
2042 | - ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) || | ||
2043 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) || | ||
2044 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) || | ||
2045 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1))) | ||
2046 | - xhci->quirks |= XHCI_U2_DISABLE_WAKE; | ||
2047 | - | ||
2048 | if (pdev->vendor == PCI_VENDOR_ID_INTEL) { | ||
2049 | xhci->quirks |= XHCI_LPM_SUPPORT; | ||
2050 | xhci->quirks |= XHCI_INTEL_HOST; | ||
2051 | diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h | ||
2052 | index a0f4a9feb058..836398ade58d 100644 | ||
2053 | --- a/drivers/usb/host/xhci.h | ||
2054 | +++ b/drivers/usb/host/xhci.h | ||
2055 | @@ -1509,7 +1509,7 @@ struct xhci_bus_state { | ||
2056 | |||
2057 | static inline unsigned int hcd_index(struct usb_hcd *hcd) | ||
2058 | { | ||
2059 | - if (hcd->speed == HCD_USB3) | ||
2060 | + if (hcd->speed >= HCD_USB3) | ||
2061 | return 0; | ||
2062 | else | ||
2063 | return 1; | ||
2064 | @@ -1660,7 +1660,7 @@ struct xhci_hcd { | ||
2065 | /* For controller with a broken Port Disable implementation */ | ||
2066 | #define XHCI_BROKEN_PORT_PED (1 << 25) | ||
2067 | #define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26) | ||
2068 | -#define XHCI_U2_DISABLE_WAKE (1 << 27) | ||
2069 | +/* Reserved. It was XHCI_U2_DISABLE_WAKE */ | ||
2070 | #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28) | ||
2071 | |||
2072 | unsigned int num_active_eps; | ||
2073 | diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c | ||
2074 | index 857e78337324..8897195396b2 100644 | ||
2075 | --- a/drivers/usb/renesas_usbhs/fifo.c | ||
2076 | +++ b/drivers/usb/renesas_usbhs/fifo.c | ||
2077 | @@ -285,11 +285,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe, | ||
2078 | struct usbhs_fifo *fifo) | ||
2079 | { | ||
2080 | struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); | ||
2081 | + int ret = 0; | ||
2082 | |||
2083 | - if (!usbhs_pipe_is_dcp(pipe)) | ||
2084 | - usbhsf_fifo_barrier(priv, fifo); | ||
2085 | + if (!usbhs_pipe_is_dcp(pipe)) { | ||
2086 | + /* | ||
2087 | + * This driver checks the pipe condition first to avoid -EBUSY | ||
2088 | + * from usbhsf_fifo_barrier() with about 10 msec delay in | ||
2089 | + * the interrupt handler if the pipe is RX direction and empty. | ||
2090 | + */ | ||
2091 | + if (usbhs_pipe_is_dir_in(pipe)) | ||
2092 | + ret = usbhs_pipe_is_accessible(pipe); | ||
2093 | + if (!ret) | ||
2094 | + ret = usbhsf_fifo_barrier(priv, fifo); | ||
2095 | + } | ||
2096 | |||
2097 | - usbhs_write(priv, fifo->ctr, BCLR); | ||
2098 | + /* | ||
2099 | + * if non-DCP pipe, this driver should set BCLR when | ||
2100 | + * usbhsf_fifo_barrier() returns 0. | ||
2101 | + */ | ||
2102 | + if (!ret) | ||
2103 | + usbhs_write(priv, fifo->ctr, BCLR); | ||
2104 | } | ||
2105 | |||
2106 | static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv, | ||
2107 | diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c | ||
2108 | index 1a59f335b063..a3ccb899df60 100644 | ||
2109 | --- a/drivers/usb/storage/transport.c | ||
2110 | +++ b/drivers/usb/storage/transport.c | ||
2111 | @@ -834,13 +834,25 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us) | ||
2112 | if (result == USB_STOR_TRANSPORT_GOOD) { | ||
2113 | srb->result = SAM_STAT_GOOD; | ||
2114 | srb->sense_buffer[0] = 0x0; | ||
2115 | + } | ||
2116 | + | ||
2117 | + /* | ||
2118 | + * ATA-passthru commands use sense data to report | ||
2119 | + * the command completion status, and often devices | ||
2120 | + * return Check Condition status when nothing is | ||
2121 | + * wrong. | ||
2122 | + */ | ||
2123 | + else if (srb->cmnd[0] == ATA_16 || | ||
2124 | + srb->cmnd[0] == ATA_12) { | ||
2125 | + /* leave the data alone */ | ||
2126 | + } | ||
2127 | |||
2128 | /* | ||
2129 | * If there was a problem, report an unspecified | ||
2130 | * hardware error to prevent the higher layers from | ||
2131 | * entering an infinite retry loop. | ||
2132 | */ | ||
2133 | - } else { | ||
2134 | + else { | ||
2135 | srb->result = DID_ERROR << 16; | ||
2136 | if ((sshdr.response_code & 0x72) == 0x72) | ||
2137 | srb->sense_buffer[1] = HARDWARE_ERROR; | ||
2138 | diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h | ||
2139 | index f58caa9e6a27..a155cd02bce2 100644 | ||
2140 | --- a/drivers/usb/storage/uas-detect.h | ||
2141 | +++ b/drivers/usb/storage/uas-detect.h | ||
2142 | @@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf) | ||
2143 | intf->desc.bInterfaceProtocol == USB_PR_UAS); | ||
2144 | } | ||
2145 | |||
2146 | -static int uas_find_uas_alt_setting(struct usb_interface *intf) | ||
2147 | +static struct usb_host_interface *uas_find_uas_alt_setting( | ||
2148 | + struct usb_interface *intf) | ||
2149 | { | ||
2150 | int i; | ||
2151 | |||
2152 | @@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf) | ||
2153 | struct usb_host_interface *alt = &intf->altsetting[i]; | ||
2154 | |||
2155 | if (uas_is_interface(alt)) | ||
2156 | - return alt->desc.bAlternateSetting; | ||
2157 | + return alt; | ||
2158 | } | ||
2159 | |||
2160 | - return -ENODEV; | ||
2161 | + return NULL; | ||
2162 | } | ||
2163 | |||
2164 | static int uas_find_endpoints(struct usb_host_interface *alt, | ||
2165 | @@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf, | ||
2166 | struct usb_device *udev = interface_to_usbdev(intf); | ||
2167 | struct usb_hcd *hcd = bus_to_hcd(udev->bus); | ||
2168 | unsigned long flags = id->driver_info; | ||
2169 | - int r, alt; | ||
2170 | - | ||
2171 | + struct usb_host_interface *alt; | ||
2172 | + int r; | ||
2173 | |||
2174 | alt = uas_find_uas_alt_setting(intf); | ||
2175 | - if (alt < 0) | ||
2176 | + if (!alt) | ||
2177 | return 0; | ||
2178 | |||
2179 | - r = uas_find_endpoints(&intf->altsetting[alt], eps); | ||
2180 | + r = uas_find_endpoints(alt, eps); | ||
2181 | if (r < 0) | ||
2182 | return 0; | ||
2183 | |||
2184 | diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c | ||
2185 | index 5ef014ba6ae8..9876af4ab64e 100644 | ||
2186 | --- a/drivers/usb/storage/uas.c | ||
2187 | +++ b/drivers/usb/storage/uas.c | ||
2188 | @@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids); | ||
2189 | static int uas_switch_interface(struct usb_device *udev, | ||
2190 | struct usb_interface *intf) | ||
2191 | { | ||
2192 | - int alt; | ||
2193 | + struct usb_host_interface *alt; | ||
2194 | |||
2195 | alt = uas_find_uas_alt_setting(intf); | ||
2196 | - if (alt < 0) | ||
2197 | - return alt; | ||
2198 | + if (!alt) | ||
2199 | + return -ENODEV; | ||
2200 | |||
2201 | - return usb_set_interface(udev, | ||
2202 | - intf->altsetting[0].desc.bInterfaceNumber, alt); | ||
2203 | + return usb_set_interface(udev, alt->desc.bInterfaceNumber, | ||
2204 | + alt->desc.bAlternateSetting); | ||
2205 | } | ||
2206 | |||
2207 | static int uas_configure_endpoints(struct uas_dev_info *devinfo) | ||
2208 | diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h | ||
2209 | index 9129f6cb8230..2572fd5cd2bb 100644 | ||
2210 | --- a/drivers/usb/storage/unusual_devs.h | ||
2211 | +++ b/drivers/usb/storage/unusual_devs.h | ||
2212 | @@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000, | ||
2213 | USB_SC_DEVICE, USB_PR_DEVICE, NULL, | ||
2214 | US_FL_SANE_SENSE ), | ||
2215 | |||
2216 | +/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */ | ||
2217 | +UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999, | ||
2218 | + "Seagate", | ||
2219 | + "External", | ||
2220 | + USB_SC_DEVICE, USB_PR_DEVICE, NULL, | ||
2221 | + US_FL_NO_WP_DETECT ), | ||
2222 | + | ||
2223 | UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, | ||
2224 | "Maxtor", | ||
2225 | "USB to SATA", | ||
2226 | diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c | ||
2227 | index 35a1e777b449..9a53912bdfe9 100644 | ||
2228 | --- a/drivers/uwb/hwa-rc.c | ||
2229 | +++ b/drivers/uwb/hwa-rc.c | ||
2230 | @@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interface *iface, | ||
2231 | |||
2232 | if (iface->cur_altsetting->desc.bNumEndpoints < 1) | ||
2233 | return -ENODEV; | ||
2234 | + if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc)) | ||
2235 | + return -ENODEV; | ||
2236 | |||
2237 | result = -ENOMEM; | ||
2238 | uwb_rc = uwb_rc_alloc(); | ||
2239 | diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c | ||
2240 | index 01c20a260a8b..39dd4ef53c77 100644 | ||
2241 | --- a/drivers/uwb/uwbd.c | ||
2242 | +++ b/drivers/uwb/uwbd.c | ||
2243 | @@ -302,18 +302,22 @@ static int uwbd(void *param) | ||
2244 | /** Start the UWB daemon */ | ||
2245 | void uwbd_start(struct uwb_rc *rc) | ||
2246 | { | ||
2247 | - rc->uwbd.task = kthread_run(uwbd, rc, "uwbd"); | ||
2248 | - if (rc->uwbd.task == NULL) | ||
2249 | + struct task_struct *task = kthread_run(uwbd, rc, "uwbd"); | ||
2250 | + if (IS_ERR(task)) { | ||
2251 | + rc->uwbd.task = NULL; | ||
2252 | printk(KERN_ERR "UWB: Cannot start management daemon; " | ||
2253 | "UWB won't work\n"); | ||
2254 | - else | ||
2255 | + } else { | ||
2256 | + rc->uwbd.task = task; | ||
2257 | rc->uwbd.pid = rc->uwbd.task->pid; | ||
2258 | + } | ||
2259 | } | ||
2260 | |||
2261 | /* Stop the UWB daemon and free any unprocessed events */ | ||
2262 | void uwbd_stop(struct uwb_rc *rc) | ||
2263 | { | ||
2264 | - kthread_stop(rc->uwbd.task); | ||
2265 | + if (rc->uwbd.task) | ||
2266 | + kthread_stop(rc->uwbd.task); | ||
2267 | uwbd_flush(rc); | ||
2268 | } | ||
2269 | |||
2270 | diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c | ||
2271 | index dfa519979038..dfd01ca1a60a 100644 | ||
2272 | --- a/fs/ext4/acl.c | ||
2273 | +++ b/fs/ext4/acl.c | ||
2274 | @@ -192,13 +192,6 @@ __ext4_set_acl(handle_t *handle, struct inode *inode, int type, | ||
2275 | switch (type) { | ||
2276 | case ACL_TYPE_ACCESS: | ||
2277 | name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS; | ||
2278 | - if (acl) { | ||
2279 | - error = posix_acl_update_mode(inode, &inode->i_mode, &acl); | ||
2280 | - if (error) | ||
2281 | - return error; | ||
2282 | - inode->i_ctime = ext4_current_time(inode); | ||
2283 | - ext4_mark_inode_dirty(handle, inode); | ||
2284 | - } | ||
2285 | break; | ||
2286 | |||
2287 | case ACL_TYPE_DEFAULT: | ||
2288 | @@ -231,6 +224,8 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type) | ||
2289 | { | ||
2290 | handle_t *handle; | ||
2291 | int error, retries = 0; | ||
2292 | + umode_t mode = inode->i_mode; | ||
2293 | + int update_mode = 0; | ||
2294 | |||
2295 | retry: | ||
2296 | handle = ext4_journal_start(inode, EXT4_HT_XATTR, | ||
2297 | @@ -238,7 +233,20 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type) | ||
2298 | if (IS_ERR(handle)) | ||
2299 | return PTR_ERR(handle); | ||
2300 | |||
2301 | + if ((type == ACL_TYPE_ACCESS) && acl) { | ||
2302 | + error = posix_acl_update_mode(inode, &mode, &acl); | ||
2303 | + if (error) | ||
2304 | + goto out_stop; | ||
2305 | + update_mode = 1; | ||
2306 | + } | ||
2307 | + | ||
2308 | error = __ext4_set_acl(handle, inode, type, acl); | ||
2309 | + if (!error && update_mode) { | ||
2310 | + inode->i_mode = mode; | ||
2311 | + inode->i_ctime = ext4_current_time(inode); | ||
2312 | + ext4_mark_inode_dirty(handle, inode); | ||
2313 | + } | ||
2314 | +out_stop: | ||
2315 | ext4_journal_stop(handle); | ||
2316 | if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries)) | ||
2317 | goto retry; | ||
2318 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c | ||
2319 | index 1b29efcab3dc..ec28e8ebb984 100644 | ||
2320 | --- a/fs/ext4/inode.c | ||
2321 | +++ b/fs/ext4/inode.c | ||
2322 | @@ -2107,15 +2107,29 @@ static int ext4_writepage(struct page *page, | ||
2323 | static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page) | ||
2324 | { | ||
2325 | int len; | ||
2326 | - loff_t size = i_size_read(mpd->inode); | ||
2327 | + loff_t size; | ||
2328 | int err; | ||
2329 | |||
2330 | BUG_ON(page->index != mpd->first_page); | ||
2331 | + clear_page_dirty_for_io(page); | ||
2332 | + /* | ||
2333 | + * We have to be very careful here! Nothing protects writeback path | ||
2334 | + * against i_size changes and the page can be writeably mapped into | ||
2335 | + * page tables. So an application can be growing i_size and writing | ||
2336 | + * data through mmap while writeback runs. clear_page_dirty_for_io() | ||
2337 | + * write-protects our page in page tables and the page cannot get | ||
2338 | + * written to again until we release page lock. So only after | ||
2339 | + * clear_page_dirty_for_io() we are safe to sample i_size for | ||
2340 | + * ext4_bio_write_page() to zero-out tail of the written page. We rely | ||
2341 | + * on the barrier provided by TestClearPageDirty in | ||
2342 | + * clear_page_dirty_for_io() to make sure i_size is really sampled only | ||
2343 | + * after page tables are updated. | ||
2344 | + */ | ||
2345 | + size = i_size_read(mpd->inode); | ||
2346 | if (page->index == size >> PAGE_SHIFT) | ||
2347 | len = size & ~PAGE_MASK; | ||
2348 | else | ||
2349 | len = PAGE_SIZE; | ||
2350 | - clear_page_dirty_for_io(page); | ||
2351 | err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false); | ||
2352 | if (!err) | ||
2353 | mpd->wbc->nr_to_write--; | ||
2354 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c | ||
2355 | index 423a21cd077c..00b8a5a66961 100644 | ||
2356 | --- a/fs/ext4/namei.c | ||
2357 | +++ b/fs/ext4/namei.c | ||
2358 | @@ -3527,6 +3527,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, | ||
2359 | EXT4_I(old_dentry->d_inode)->i_projid))) | ||
2360 | return -EXDEV; | ||
2361 | |||
2362 | + if ((ext4_encrypted_inode(old_dir) && | ||
2363 | + !fscrypt_has_encryption_key(old_dir)) || | ||
2364 | + (ext4_encrypted_inode(new_dir) && | ||
2365 | + !fscrypt_has_encryption_key(new_dir))) | ||
2366 | + return -ENOKEY; | ||
2367 | + | ||
2368 | retval = dquot_initialize(old.dir); | ||
2369 | if (retval) | ||
2370 | return retval; | ||
2371 | @@ -3726,6 +3732,12 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry, | ||
2372 | u8 new_file_type; | ||
2373 | int retval; | ||
2374 | |||
2375 | + if ((ext4_encrypted_inode(old_dir) && | ||
2376 | + !fscrypt_has_encryption_key(old_dir)) || | ||
2377 | + (ext4_encrypted_inode(new_dir) && | ||
2378 | + !fscrypt_has_encryption_key(new_dir))) | ||
2379 | + return -ENOKEY; | ||
2380 | + | ||
2381 | if ((ext4_encrypted_inode(old_dir) || | ||
2382 | ext4_encrypted_inode(new_dir)) && | ||
2383 | (old_dir != new_dir) && | ||
2384 | diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c | ||
2385 | index 489fa0d5f914..08d7dc99042e 100644 | ||
2386 | --- a/fs/f2fs/namei.c | ||
2387 | +++ b/fs/f2fs/namei.c | ||
2388 | @@ -663,6 +663,12 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, | ||
2389 | bool is_old_inline = f2fs_has_inline_dentry(old_dir); | ||
2390 | int err = -ENOENT; | ||
2391 | |||
2392 | + if ((f2fs_encrypted_inode(old_dir) && | ||
2393 | + !fscrypt_has_encryption_key(old_dir)) || | ||
2394 | + (f2fs_encrypted_inode(new_dir) && | ||
2395 | + !fscrypt_has_encryption_key(new_dir))) | ||
2396 | + return -ENOKEY; | ||
2397 | + | ||
2398 | if ((old_dir != new_dir) && f2fs_encrypted_inode(new_dir) && | ||
2399 | !fscrypt_has_permitted_context(new_dir, old_inode)) { | ||
2400 | err = -EPERM; | ||
2401 | @@ -843,6 +849,12 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, | ||
2402 | int old_nlink = 0, new_nlink = 0; | ||
2403 | int err = -ENOENT; | ||
2404 | |||
2405 | + if ((f2fs_encrypted_inode(old_dir) && | ||
2406 | + !fscrypt_has_encryption_key(old_dir)) || | ||
2407 | + (f2fs_encrypted_inode(new_dir) && | ||
2408 | + !fscrypt_has_encryption_key(new_dir))) | ||
2409 | + return -ENOKEY; | ||
2410 | + | ||
2411 | if ((f2fs_encrypted_inode(old_dir) || f2fs_encrypted_inode(new_dir)) && | ||
2412 | (old_dir != new_dir) && | ||
2413 | (!fscrypt_has_permitted_context(new_dir, old_inode) || | ||
2414 | diff --git a/fs/read_write.c b/fs/read_write.c | ||
2415 | index 09a8757efd34..ba280596ec78 100644 | ||
2416 | --- a/fs/read_write.c | ||
2417 | +++ b/fs/read_write.c | ||
2418 | @@ -1518,6 +1518,11 @@ ssize_t vfs_copy_file_range(struct file *file_in, loff_t pos_in, | ||
2419 | if (flags != 0) | ||
2420 | return -EINVAL; | ||
2421 | |||
2422 | + if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode)) | ||
2423 | + return -EISDIR; | ||
2424 | + if (!S_ISREG(inode_in->i_mode) || !S_ISREG(inode_out->i_mode)) | ||
2425 | + return -EINVAL; | ||
2426 | + | ||
2427 | ret = rw_verify_area(READ, file_in, &pos_in, len); | ||
2428 | if (unlikely(ret)) | ||
2429 | return ret; | ||
2430 | diff --git a/fs/xattr.c b/fs/xattr.c | ||
2431 | index ed8c374570ed..932b9061a3a2 100644 | ||
2432 | --- a/fs/xattr.c | ||
2433 | +++ b/fs/xattr.c | ||
2434 | @@ -249,7 +249,7 @@ xattr_getsecurity(struct inode *inode, const char *name, void *value, | ||
2435 | } | ||
2436 | memcpy(value, buffer, len); | ||
2437 | out: | ||
2438 | - security_release_secctx(buffer, len); | ||
2439 | + kfree(buffer); | ||
2440 | out_noalloc: | ||
2441 | return len; | ||
2442 | } | ||
2443 | diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h | ||
2444 | index 0504ef8f3aa3..976f8ac26665 100644 | ||
2445 | --- a/include/asm-generic/percpu.h | ||
2446 | +++ b/include/asm-generic/percpu.h | ||
2447 | @@ -115,15 +115,35 @@ do { \ | ||
2448 | (__ret); \ | ||
2449 | }) | ||
2450 | |||
2451 | -#define this_cpu_generic_read(pcp) \ | ||
2452 | +#define __this_cpu_generic_read_nopreempt(pcp) \ | ||
2453 | ({ \ | ||
2454 | typeof(pcp) __ret; \ | ||
2455 | preempt_disable_notrace(); \ | ||
2456 | - __ret = raw_cpu_generic_read(pcp); \ | ||
2457 | + __ret = READ_ONCE(*raw_cpu_ptr(&(pcp))); \ | ||
2458 | preempt_enable_notrace(); \ | ||
2459 | __ret; \ | ||
2460 | }) | ||
2461 | |||
2462 | +#define __this_cpu_generic_read_noirq(pcp) \ | ||
2463 | +({ \ | ||
2464 | + typeof(pcp) __ret; \ | ||
2465 | + unsigned long __flags; \ | ||
2466 | + raw_local_irq_save(__flags); \ | ||
2467 | + __ret = raw_cpu_generic_read(pcp); \ | ||
2468 | + raw_local_irq_restore(__flags); \ | ||
2469 | + __ret; \ | ||
2470 | +}) | ||
2471 | + | ||
2472 | +#define this_cpu_generic_read(pcp) \ | ||
2473 | +({ \ | ||
2474 | + typeof(pcp) __ret; \ | ||
2475 | + if (__native_word(pcp)) \ | ||
2476 | + __ret = __this_cpu_generic_read_nopreempt(pcp); \ | ||
2477 | + else \ | ||
2478 | + __ret = __this_cpu_generic_read_noirq(pcp); \ | ||
2479 | + __ret; \ | ||
2480 | +}) | ||
2481 | + | ||
2482 | #define this_cpu_generic_to_op(pcp, val, op) \ | ||
2483 | do { \ | ||
2484 | unsigned long __flags; \ | ||
2485 | diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h | ||
2486 | index cd32a49ae81e..d807fa9b2051 100644 | ||
2487 | --- a/include/linux/cpuset.h | ||
2488 | +++ b/include/linux/cpuset.h | ||
2489 | @@ -55,7 +55,9 @@ static inline void cpuset_dec(void) | ||
2490 | |||
2491 | extern int cpuset_init(void); | ||
2492 | extern void cpuset_init_smp(void); | ||
2493 | +extern void cpuset_force_rebuild(void); | ||
2494 | extern void cpuset_update_active_cpus(bool cpu_online); | ||
2495 | +extern void cpuset_wait_for_hotplug(void); | ||
2496 | extern void cpuset_cpus_allowed(struct task_struct *p, struct cpumask *mask); | ||
2497 | extern void cpuset_cpus_allowed_fallback(struct task_struct *p); | ||
2498 | extern nodemask_t cpuset_mems_allowed(struct task_struct *p); | ||
2499 | @@ -168,11 +170,15 @@ static inline bool cpusets_enabled(void) { return false; } | ||
2500 | static inline int cpuset_init(void) { return 0; } | ||
2501 | static inline void cpuset_init_smp(void) {} | ||
2502 | |||
2503 | +static inline void cpuset_force_rebuild(void) { } | ||
2504 | + | ||
2505 | static inline void cpuset_update_active_cpus(bool cpu_online) | ||
2506 | { | ||
2507 | partition_sched_domains(1, NULL, NULL); | ||
2508 | } | ||
2509 | |||
2510 | +static inline void cpuset_wait_for_hotplug(void) { } | ||
2511 | + | ||
2512 | static inline void cpuset_cpus_allowed(struct task_struct *p, | ||
2513 | struct cpumask *mask) | ||
2514 | { | ||
2515 | diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h | ||
2516 | index e7fdec4db9da..6cc48ac55fd2 100644 | ||
2517 | --- a/include/linux/iio/adc/ad_sigma_delta.h | ||
2518 | +++ b/include/linux/iio/adc/ad_sigma_delta.h | ||
2519 | @@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, | ||
2520 | int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, | ||
2521 | unsigned int size, unsigned int *val); | ||
2522 | |||
2523 | +int ad_sd_reset(struct ad_sigma_delta *sigma_delta, | ||
2524 | + unsigned int reset_length); | ||
2525 | + | ||
2526 | int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev, | ||
2527 | const struct iio_chan_spec *chan, int *val); | ||
2528 | int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta, | ||
2529 | diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h | ||
2530 | index a1a210d59961..25c0dc31f084 100644 | ||
2531 | --- a/include/linux/mmu_notifier.h | ||
2532 | +++ b/include/linux/mmu_notifier.h | ||
2533 | @@ -419,6 +419,11 @@ extern void mmu_notifier_synchronize(void); | ||
2534 | |||
2535 | #else /* CONFIG_MMU_NOTIFIER */ | ||
2536 | |||
2537 | +static inline int mm_has_notifiers(struct mm_struct *mm) | ||
2538 | +{ | ||
2539 | + return 0; | ||
2540 | +} | ||
2541 | + | ||
2542 | static inline void mmu_notifier_release(struct mm_struct *mm) | ||
2543 | { | ||
2544 | } | ||
2545 | diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h | ||
2546 | index be007610ceb0..ba57266d9e80 100644 | ||
2547 | --- a/include/linux/trace_events.h | ||
2548 | +++ b/include/linux/trace_events.h | ||
2549 | @@ -273,6 +273,7 @@ struct trace_event_call { | ||
2550 | int perf_refcount; | ||
2551 | struct hlist_head __percpu *perf_events; | ||
2552 | struct bpf_prog *prog; | ||
2553 | + struct perf_event *bpf_prog_owner; | ||
2554 | |||
2555 | int (*perf_perm)(struct trace_event_call *, | ||
2556 | struct perf_event *); | ||
2557 | diff --git a/include/net/netlink.h b/include/net/netlink.h | ||
2558 | index 254a0fc01800..42adccd6739d 100644 | ||
2559 | --- a/include/net/netlink.h | ||
2560 | +++ b/include/net/netlink.h | ||
2561 | @@ -756,7 +756,10 @@ static inline int nla_parse_nested(struct nlattr *tb[], int maxtype, | ||
2562 | */ | ||
2563 | static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value) | ||
2564 | { | ||
2565 | - return nla_put(skb, attrtype, sizeof(u8), &value); | ||
2566 | + /* temporary variables to work around GCC PR81715 with asan-stack=1 */ | ||
2567 | + u8 tmp = value; | ||
2568 | + | ||
2569 | + return nla_put(skb, attrtype, sizeof(u8), &tmp); | ||
2570 | } | ||
2571 | |||
2572 | /** | ||
2573 | @@ -767,7 +770,9 @@ static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value) | ||
2574 | */ | ||
2575 | static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value) | ||
2576 | { | ||
2577 | - return nla_put(skb, attrtype, sizeof(u16), &value); | ||
2578 | + u16 tmp = value; | ||
2579 | + | ||
2580 | + return nla_put(skb, attrtype, sizeof(u16), &tmp); | ||
2581 | } | ||
2582 | |||
2583 | /** | ||
2584 | @@ -778,7 +783,9 @@ static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value) | ||
2585 | */ | ||
2586 | static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value) | ||
2587 | { | ||
2588 | - return nla_put(skb, attrtype, sizeof(__be16), &value); | ||
2589 | + __be16 tmp = value; | ||
2590 | + | ||
2591 | + return nla_put(skb, attrtype, sizeof(__be16), &tmp); | ||
2592 | } | ||
2593 | |||
2594 | /** | ||
2595 | @@ -789,7 +796,9 @@ static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value) | ||
2596 | */ | ||
2597 | static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value) | ||
2598 | { | ||
2599 | - return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, value); | ||
2600 | + __be16 tmp = value; | ||
2601 | + | ||
2602 | + return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, tmp); | ||
2603 | } | ||
2604 | |||
2605 | /** | ||
2606 | @@ -800,7 +809,9 @@ static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value) | ||
2607 | */ | ||
2608 | static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value) | ||
2609 | { | ||
2610 | - return nla_put(skb, attrtype, sizeof(__le16), &value); | ||
2611 | + __le16 tmp = value; | ||
2612 | + | ||
2613 | + return nla_put(skb, attrtype, sizeof(__le16), &tmp); | ||
2614 | } | ||
2615 | |||
2616 | /** | ||
2617 | @@ -811,7 +822,9 @@ static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value) | ||
2618 | */ | ||
2619 | static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value) | ||
2620 | { | ||
2621 | - return nla_put(skb, attrtype, sizeof(u32), &value); | ||
2622 | + u32 tmp = value; | ||
2623 | + | ||
2624 | + return nla_put(skb, attrtype, sizeof(u32), &tmp); | ||
2625 | } | ||
2626 | |||
2627 | /** | ||
2628 | @@ -822,7 +835,9 @@ static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value) | ||
2629 | */ | ||
2630 | static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value) | ||
2631 | { | ||
2632 | - return nla_put(skb, attrtype, sizeof(__be32), &value); | ||
2633 | + __be32 tmp = value; | ||
2634 | + | ||
2635 | + return nla_put(skb, attrtype, sizeof(__be32), &tmp); | ||
2636 | } | ||
2637 | |||
2638 | /** | ||
2639 | @@ -833,7 +848,9 @@ static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value) | ||
2640 | */ | ||
2641 | static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value) | ||
2642 | { | ||
2643 | - return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, value); | ||
2644 | + __be32 tmp = value; | ||
2645 | + | ||
2646 | + return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, tmp); | ||
2647 | } | ||
2648 | |||
2649 | /** | ||
2650 | @@ -844,7 +861,9 @@ static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value) | ||
2651 | */ | ||
2652 | static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value) | ||
2653 | { | ||
2654 | - return nla_put(skb, attrtype, sizeof(__le32), &value); | ||
2655 | + __le32 tmp = value; | ||
2656 | + | ||
2657 | + return nla_put(skb, attrtype, sizeof(__le32), &tmp); | ||
2658 | } | ||
2659 | |||
2660 | /** | ||
2661 | @@ -857,7 +876,9 @@ static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value) | ||
2662 | static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype, | ||
2663 | u64 value, int padattr) | ||
2664 | { | ||
2665 | - return nla_put_64bit(skb, attrtype, sizeof(u64), &value, padattr); | ||
2666 | + u64 tmp = value; | ||
2667 | + | ||
2668 | + return nla_put_64bit(skb, attrtype, sizeof(u64), &tmp, padattr); | ||
2669 | } | ||
2670 | |||
2671 | /** | ||
2672 | @@ -870,7 +891,9 @@ static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype, | ||
2673 | static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value, | ||
2674 | int padattr) | ||
2675 | { | ||
2676 | - return nla_put_64bit(skb, attrtype, sizeof(__be64), &value, padattr); | ||
2677 | + __be64 tmp = value; | ||
2678 | + | ||
2679 | + return nla_put_64bit(skb, attrtype, sizeof(__be64), &tmp, padattr); | ||
2680 | } | ||
2681 | |||
2682 | /** | ||
2683 | @@ -883,7 +906,9 @@ static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value, | ||
2684 | static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value, | ||
2685 | int padattr) | ||
2686 | { | ||
2687 | - return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, value, | ||
2688 | + __be64 tmp = value; | ||
2689 | + | ||
2690 | + return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, tmp, | ||
2691 | padattr); | ||
2692 | } | ||
2693 | |||
2694 | @@ -897,7 +922,9 @@ static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value, | ||
2695 | static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value, | ||
2696 | int padattr) | ||
2697 | { | ||
2698 | - return nla_put_64bit(skb, attrtype, sizeof(__le64), &value, padattr); | ||
2699 | + __le64 tmp = value; | ||
2700 | + | ||
2701 | + return nla_put_64bit(skb, attrtype, sizeof(__le64), &tmp, padattr); | ||
2702 | } | ||
2703 | |||
2704 | /** | ||
2705 | @@ -908,7 +935,9 @@ static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value, | ||
2706 | */ | ||
2707 | static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value) | ||
2708 | { | ||
2709 | - return nla_put(skb, attrtype, sizeof(s8), &value); | ||
2710 | + s8 tmp = value; | ||
2711 | + | ||
2712 | + return nla_put(skb, attrtype, sizeof(s8), &tmp); | ||
2713 | } | ||
2714 | |||
2715 | /** | ||
2716 | @@ -919,7 +948,9 @@ static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value) | ||
2717 | */ | ||
2718 | static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value) | ||
2719 | { | ||
2720 | - return nla_put(skb, attrtype, sizeof(s16), &value); | ||
2721 | + s16 tmp = value; | ||
2722 | + | ||
2723 | + return nla_put(skb, attrtype, sizeof(s16), &tmp); | ||
2724 | } | ||
2725 | |||
2726 | /** | ||
2727 | @@ -930,7 +961,9 @@ static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value) | ||
2728 | */ | ||
2729 | static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value) | ||
2730 | { | ||
2731 | - return nla_put(skb, attrtype, sizeof(s32), &value); | ||
2732 | + s32 tmp = value; | ||
2733 | + | ||
2734 | + return nla_put(skb, attrtype, sizeof(s32), &tmp); | ||
2735 | } | ||
2736 | |||
2737 | /** | ||
2738 | @@ -943,7 +976,9 @@ static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value) | ||
2739 | static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value, | ||
2740 | int padattr) | ||
2741 | { | ||
2742 | - return nla_put_64bit(skb, attrtype, sizeof(s64), &value, padattr); | ||
2743 | + s64 tmp = value; | ||
2744 | + | ||
2745 | + return nla_put_64bit(skb, attrtype, sizeof(s64), &tmp, padattr); | ||
2746 | } | ||
2747 | |||
2748 | /** | ||
2749 | @@ -993,7 +1028,9 @@ static inline int nla_put_msecs(struct sk_buff *skb, int attrtype, | ||
2750 | static inline int nla_put_in_addr(struct sk_buff *skb, int attrtype, | ||
2751 | __be32 addr) | ||
2752 | { | ||
2753 | - return nla_put_be32(skb, attrtype, addr); | ||
2754 | + __be32 tmp = addr; | ||
2755 | + | ||
2756 | + return nla_put_be32(skb, attrtype, tmp); | ||
2757 | } | ||
2758 | |||
2759 | /** | ||
2760 | diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h | ||
2761 | index 2c098cd7e7e2..231df4fc8423 100644 | ||
2762 | --- a/include/net/sctp/ulpevent.h | ||
2763 | +++ b/include/net/sctp/ulpevent.h | ||
2764 | @@ -141,8 +141,12 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event); | ||
2765 | static inline int sctp_ulpevent_type_enabled(__u16 sn_type, | ||
2766 | struct sctp_event_subscribe *mask) | ||
2767 | { | ||
2768 | + int offset = sn_type - SCTP_SN_TYPE_BASE; | ||
2769 | char *amask = (char *) mask; | ||
2770 | - return amask[sn_type - SCTP_SN_TYPE_BASE]; | ||
2771 | + | ||
2772 | + if (offset >= sizeof(struct sctp_event_subscribe)) | ||
2773 | + return 0; | ||
2774 | + return amask[offset]; | ||
2775 | } | ||
2776 | |||
2777 | /* Given an event subscription, is this event enabled? */ | ||
2778 | diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h | ||
2779 | index a8acc24765fe..5e64a86989a5 100644 | ||
2780 | --- a/include/uapi/linux/usb/ch9.h | ||
2781 | +++ b/include/uapi/linux/usb/ch9.h | ||
2782 | @@ -759,6 +759,7 @@ struct usb_interface_assoc_descriptor { | ||
2783 | __u8 iFunction; | ||
2784 | } __attribute__ ((packed)); | ||
2785 | |||
2786 | +#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8 | ||
2787 | |||
2788 | /*-------------------------------------------------------------------------*/ | ||
2789 | |||
2790 | diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c | ||
2791 | index 779c871c5dcd..372454aa7f37 100644 | ||
2792 | --- a/kernel/bpf/verifier.c | ||
2793 | +++ b/kernel/bpf/verifier.c | ||
2794 | @@ -1720,7 +1720,8 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) | ||
2795 | } | ||
2796 | } else { | ||
2797 | if (insn->src_reg != BPF_REG_0 || insn->off != 0 || | ||
2798 | - (insn->imm != 16 && insn->imm != 32 && insn->imm != 64)) { | ||
2799 | + (insn->imm != 16 && insn->imm != 32 && insn->imm != 64) || | ||
2800 | + BPF_CLASS(insn->code) == BPF_ALU64) { | ||
2801 | verbose("BPF_END uses reserved fields\n"); | ||
2802 | return -EINVAL; | ||
2803 | } | ||
2804 | diff --git a/kernel/cpuset.c b/kernel/cpuset.c | ||
2805 | index 03a3a6e94eb9..511b1dd8ff09 100644 | ||
2806 | --- a/kernel/cpuset.c | ||
2807 | +++ b/kernel/cpuset.c | ||
2808 | @@ -2276,6 +2276,13 @@ static void cpuset_hotplug_update_tasks(struct cpuset *cs) | ||
2809 | mutex_unlock(&cpuset_mutex); | ||
2810 | } | ||
2811 | |||
2812 | +static bool force_rebuild; | ||
2813 | + | ||
2814 | +void cpuset_force_rebuild(void) | ||
2815 | +{ | ||
2816 | + force_rebuild = true; | ||
2817 | +} | ||
2818 | + | ||
2819 | /** | ||
2820 | * cpuset_hotplug_workfn - handle CPU/memory hotunplug for a cpuset | ||
2821 | * | ||
2822 | @@ -2350,8 +2357,10 @@ static void cpuset_hotplug_workfn(struct work_struct *work) | ||
2823 | } | ||
2824 | |||
2825 | /* rebuild sched domains if cpus_allowed has changed */ | ||
2826 | - if (cpus_updated) | ||
2827 | + if (cpus_updated || force_rebuild) { | ||
2828 | + force_rebuild = false; | ||
2829 | rebuild_sched_domains(); | ||
2830 | + } | ||
2831 | } | ||
2832 | |||
2833 | void cpuset_update_active_cpus(bool cpu_online) | ||
2834 | @@ -2370,6 +2379,11 @@ void cpuset_update_active_cpus(bool cpu_online) | ||
2835 | schedule_work(&cpuset_hotplug_work); | ||
2836 | } | ||
2837 | |||
2838 | +void cpuset_wait_for_hotplug(void) | ||
2839 | +{ | ||
2840 | + flush_work(&cpuset_hotplug_work); | ||
2841 | +} | ||
2842 | + | ||
2843 | /* | ||
2844 | * Keep top_cpuset.mems_allowed tracking node_states[N_MEMORY]. | ||
2845 | * Call this routine anytime after node_states[N_MEMORY] changes. | ||
2846 | diff --git a/kernel/events/core.c b/kernel/events/core.c | ||
2847 | index c774773ac3a4..36ff2d93f222 100644 | ||
2848 | --- a/kernel/events/core.c | ||
2849 | +++ b/kernel/events/core.c | ||
2850 | @@ -7871,6 +7871,7 @@ static int perf_event_set_bpf_prog(struct perf_event *event, u32 prog_fd) | ||
2851 | } | ||
2852 | } | ||
2853 | event->tp_event->prog = prog; | ||
2854 | + event->tp_event->bpf_prog_owner = event; | ||
2855 | |||
2856 | return 0; | ||
2857 | } | ||
2858 | @@ -7885,7 +7886,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) | ||
2859 | return; | ||
2860 | |||
2861 | prog = event->tp_event->prog; | ||
2862 | - if (prog) { | ||
2863 | + if (prog && event->tp_event->bpf_prog_owner == event) { | ||
2864 | event->tp_event->prog = NULL; | ||
2865 | bpf_prog_put(prog); | ||
2866 | } | ||
2867 | diff --git a/kernel/power/process.c b/kernel/power/process.c | ||
2868 | index 2fba066e125f..8ea24ded1dab 100644 | ||
2869 | --- a/kernel/power/process.c | ||
2870 | +++ b/kernel/power/process.c | ||
2871 | @@ -18,8 +18,9 @@ | ||
2872 | #include <linux/workqueue.h> | ||
2873 | #include <linux/kmod.h> | ||
2874 | #include <trace/events/power.h> | ||
2875 | +#include <linux/cpuset.h> | ||
2876 | |||
2877 | -/* | ||
2878 | +/* | ||
2879 | * Timeout for stopping processes | ||
2880 | */ | ||
2881 | unsigned int __read_mostly freeze_timeout_msecs = 20 * MSEC_PER_SEC; | ||
2882 | @@ -200,6 +201,8 @@ void thaw_processes(void) | ||
2883 | __usermodehelper_set_disable_depth(UMH_FREEZING); | ||
2884 | thaw_workqueues(); | ||
2885 | |||
2886 | + cpuset_wait_for_hotplug(); | ||
2887 | + | ||
2888 | read_lock(&tasklist_lock); | ||
2889 | for_each_process_thread(g, p) { | ||
2890 | /* No other threads should have PF_SUSPEND_TASK set */ | ||
2891 | diff --git a/kernel/sched/core.c b/kernel/sched/core.c | ||
2892 | index 2098954c690f..d7dda36fbc7b 100644 | ||
2893 | --- a/kernel/sched/core.c | ||
2894 | +++ b/kernel/sched/core.c | ||
2895 | @@ -7292,16 +7292,15 @@ static void cpuset_cpu_active(void) | ||
2896 | * operation in the resume sequence, just build a single sched | ||
2897 | * domain, ignoring cpusets. | ||
2898 | */ | ||
2899 | - num_cpus_frozen--; | ||
2900 | - if (likely(num_cpus_frozen)) { | ||
2901 | - partition_sched_domains(1, NULL, NULL); | ||
2902 | + partition_sched_domains(1, NULL, NULL); | ||
2903 | + if (--num_cpus_frozen) | ||
2904 | return; | ||
2905 | - } | ||
2906 | /* | ||
2907 | * This is the last CPU online operation. So fall through and | ||
2908 | * restore the original sched domains by considering the | ||
2909 | * cpuset configurations. | ||
2910 | */ | ||
2911 | + cpuset_force_rebuild(); | ||
2912 | } | ||
2913 | cpuset_update_active_cpus(true); | ||
2914 | } | ||
2915 | diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c | ||
2916 | index 53ed8ae5de1c..5b8d7189e147 100644 | ||
2917 | --- a/kernel/trace/ftrace.c | ||
2918 | +++ b/kernel/trace/ftrace.c | ||
2919 | @@ -4381,9 +4381,6 @@ static char ftrace_graph_buf[FTRACE_FILTER_SIZE] __initdata; | ||
2920 | static char ftrace_graph_notrace_buf[FTRACE_FILTER_SIZE] __initdata; | ||
2921 | static int ftrace_set_func(unsigned long *array, int *idx, int size, char *buffer); | ||
2922 | |||
2923 | -static unsigned long save_global_trampoline; | ||
2924 | -static unsigned long save_global_flags; | ||
2925 | - | ||
2926 | static int __init set_graph_function(char *str) | ||
2927 | { | ||
2928 | strlcpy(ftrace_graph_buf, str, FTRACE_FILTER_SIZE); | ||
2929 | @@ -5981,17 +5978,6 @@ void unregister_ftrace_graph(void) | ||
2930 | unregister_pm_notifier(&ftrace_suspend_notifier); | ||
2931 | unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL); | ||
2932 | |||
2933 | -#ifdef CONFIG_DYNAMIC_FTRACE | ||
2934 | - /* | ||
2935 | - * Function graph does not allocate the trampoline, but | ||
2936 | - * other global_ops do. We need to reset the ALLOC_TRAMP flag | ||
2937 | - * if one was used. | ||
2938 | - */ | ||
2939 | - global_ops.trampoline = save_global_trampoline; | ||
2940 | - if (save_global_flags & FTRACE_OPS_FL_ALLOC_TRAMP) | ||
2941 | - global_ops.flags |= FTRACE_OPS_FL_ALLOC_TRAMP; | ||
2942 | -#endif | ||
2943 | - | ||
2944 | out: | ||
2945 | mutex_unlock(&ftrace_lock); | ||
2946 | } | ||
2947 | diff --git a/lib/ratelimit.c b/lib/ratelimit.c | ||
2948 | index 08f8043cac61..d01f47135239 100644 | ||
2949 | --- a/lib/ratelimit.c | ||
2950 | +++ b/lib/ratelimit.c | ||
2951 | @@ -48,7 +48,9 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func) | ||
2952 | if (time_is_before_jiffies(rs->begin + rs->interval)) { | ||
2953 | if (rs->missed) { | ||
2954 | if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) { | ||
2955 | - pr_warn("%s: %d callbacks suppressed\n", func, rs->missed); | ||
2956 | + printk_deferred(KERN_WARNING | ||
2957 | + "%s: %d callbacks suppressed\n", | ||
2958 | + func, rs->missed); | ||
2959 | rs->missed = 0; | ||
2960 | } | ||
2961 | } | ||
2962 | diff --git a/mm/oom_kill.c b/mm/oom_kill.c | ||
2963 | index ec9f11d4f094..d631d251c150 100644 | ||
2964 | --- a/mm/oom_kill.c | ||
2965 | +++ b/mm/oom_kill.c | ||
2966 | @@ -37,6 +37,7 @@ | ||
2967 | #include <linux/ratelimit.h> | ||
2968 | #include <linux/kthread.h> | ||
2969 | #include <linux/init.h> | ||
2970 | +#include <linux/mmu_notifier.h> | ||
2971 | |||
2972 | #include <asm/tlb.h> | ||
2973 | #include "internal.h" | ||
2974 | @@ -490,6 +491,21 @@ static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) | ||
2975 | goto unlock_oom; | ||
2976 | } | ||
2977 | |||
2978 | + /* | ||
2979 | + * If the mm has notifiers then we would need to invalidate them around | ||
2980 | + * unmap_page_range and that is risky because notifiers can sleep and | ||
2981 | + * what they do is basically undeterministic. So let's have a short | ||
2982 | + * sleep to give the oom victim some more time. | ||
2983 | + * TODO: we really want to get rid of this ugly hack and make sure that | ||
2984 | + * notifiers cannot block for unbounded amount of time and add | ||
2985 | + * mmu_notifier_invalidate_range_{start,end} around unmap_page_range | ||
2986 | + */ | ||
2987 | + if (mm_has_notifiers(mm)) { | ||
2988 | + up_read(&mm->mmap_sem); | ||
2989 | + schedule_timeout_idle(HZ); | ||
2990 | + goto unlock_oom; | ||
2991 | + } | ||
2992 | + | ||
2993 | /* | ||
2994 | * increase mm_users only after we know we will reap something so | ||
2995 | * that the mmput_async is called only when we have reaped something | ||
2996 | diff --git a/net/core/filter.c b/net/core/filter.c | ||
2997 | index 4eb4ce0aeef4..bfeedbbde214 100644 | ||
2998 | --- a/net/core/filter.c | ||
2999 | +++ b/net/core/filter.c | ||
3000 | @@ -937,20 +937,31 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp) | ||
3001 | /* try to charge the socket memory if there is space available | ||
3002 | * return true on success | ||
3003 | */ | ||
3004 | -bool sk_filter_charge(struct sock *sk, struct sk_filter *fp) | ||
3005 | +static bool __sk_filter_charge(struct sock *sk, struct sk_filter *fp) | ||
3006 | { | ||
3007 | u32 filter_size = bpf_prog_size(fp->prog->len); | ||
3008 | |||
3009 | /* same check as in sock_kmalloc() */ | ||
3010 | if (filter_size <= sysctl_optmem_max && | ||
3011 | atomic_read(&sk->sk_omem_alloc) + filter_size < sysctl_optmem_max) { | ||
3012 | - atomic_inc(&fp->refcnt); | ||
3013 | atomic_add(filter_size, &sk->sk_omem_alloc); | ||
3014 | return true; | ||
3015 | } | ||
3016 | return false; | ||
3017 | } | ||
3018 | |||
3019 | +bool sk_filter_charge(struct sock *sk, struct sk_filter *fp) | ||
3020 | +{ | ||
3021 | + if (!atomic_inc_not_zero(&fp->refcnt)) | ||
3022 | + return false; | ||
3023 | + | ||
3024 | + if (!__sk_filter_charge(sk, fp)) { | ||
3025 | + sk_filter_release(fp); | ||
3026 | + return false; | ||
3027 | + } | ||
3028 | + return true; | ||
3029 | +} | ||
3030 | + | ||
3031 | static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp) | ||
3032 | { | ||
3033 | struct sock_filter *old_prog; | ||
3034 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c | ||
3035 | index 4d2629781e8b..c2339b865164 100644 | ||
3036 | --- a/net/core/rtnetlink.c | ||
3037 | +++ b/net/core/rtnetlink.c | ||
3038 | @@ -3758,6 +3758,9 @@ static int rtnl_fill_statsinfo(struct sk_buff *skb, struct net_device *dev, | ||
3039 | return -EMSGSIZE; | ||
3040 | |||
3041 | ifsm = nlmsg_data(nlh); | ||
3042 | + ifsm->family = PF_UNSPEC; | ||
3043 | + ifsm->pad1 = 0; | ||
3044 | + ifsm->pad2 = 0; | ||
3045 | ifsm->ifindex = dev->ifindex; | ||
3046 | ifsm->filter_mask = filter_mask; | ||
3047 | |||
3048 | diff --git a/net/core/sock.c b/net/core/sock.c | ||
3049 | index 1989b3dd6d17..2a77cc50f021 100644 | ||
3050 | --- a/net/core/sock.c | ||
3051 | +++ b/net/core/sock.c | ||
3052 | @@ -1493,6 +1493,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) | ||
3053 | |||
3054 | sock_copy(newsk, sk); | ||
3055 | |||
3056 | + newsk->sk_prot_creator = sk->sk_prot; | ||
3057 | + | ||
3058 | /* SANITY */ | ||
3059 | if (likely(newsk->sk_net_refcnt)) | ||
3060 | get_net(sock_net(newsk)); | ||
3061 | @@ -1526,13 +1528,16 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) | ||
3062 | sock_reset_flag(newsk, SOCK_DONE); | ||
3063 | skb_queue_head_init(&newsk->sk_error_queue); | ||
3064 | |||
3065 | - filter = rcu_dereference_protected(newsk->sk_filter, 1); | ||
3066 | + rcu_read_lock(); | ||
3067 | + filter = rcu_dereference(sk->sk_filter); | ||
3068 | if (filter != NULL) | ||
3069 | /* though it's an empty new sock, the charging may fail | ||
3070 | * if sysctl_optmem_max was changed between creation of | ||
3071 | * original socket and cloning | ||
3072 | */ | ||
3073 | is_charged = sk_filter_charge(newsk, filter); | ||
3074 | + RCU_INIT_POINTER(newsk->sk_filter, filter); | ||
3075 | + rcu_read_unlock(); | ||
3076 | |||
3077 | if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) { | ||
3078 | /* We need to make sure that we don't uncharge the new | ||
3079 | diff --git a/net/dsa/slave.c b/net/dsa/slave.c | ||
3080 | index 079d76bc204c..5000e6f20f4a 100644 | ||
3081 | --- a/net/dsa/slave.c | ||
3082 | +++ b/net/dsa/slave.c | ||
3083 | @@ -1269,26 +1269,32 @@ int dsa_slave_create(struct dsa_switch *ds, struct device *parent, | ||
3084 | p->old_duplex = -1; | ||
3085 | |||
3086 | ds->ports[port].netdev = slave_dev; | ||
3087 | - ret = register_netdev(slave_dev); | ||
3088 | - if (ret) { | ||
3089 | - netdev_err(master, "error %d registering interface %s\n", | ||
3090 | - ret, slave_dev->name); | ||
3091 | - ds->ports[port].netdev = NULL; | ||
3092 | - free_netdev(slave_dev); | ||
3093 | - return ret; | ||
3094 | - } | ||
3095 | |||
3096 | netif_carrier_off(slave_dev); | ||
3097 | |||
3098 | ret = dsa_slave_phy_setup(p, slave_dev); | ||
3099 | if (ret) { | ||
3100 | netdev_err(master, "error %d setting up slave phy\n", ret); | ||
3101 | - unregister_netdev(slave_dev); | ||
3102 | - free_netdev(slave_dev); | ||
3103 | - return ret; | ||
3104 | + goto out_free; | ||
3105 | + } | ||
3106 | + | ||
3107 | + ret = register_netdev(slave_dev); | ||
3108 | + if (ret) { | ||
3109 | + netdev_err(master, "error %d registering interface %s\n", | ||
3110 | + ret, slave_dev->name); | ||
3111 | + goto out_phy; | ||
3112 | } | ||
3113 | |||
3114 | return 0; | ||
3115 | + | ||
3116 | +out_phy: | ||
3117 | + phy_disconnect(p->phy); | ||
3118 | + if (of_phy_is_fixed_link(ds->ports[port].dn)) | ||
3119 | + of_phy_deregister_fixed_link(ds->ports[port].dn); | ||
3120 | +out_free: | ||
3121 | + free_netdev(slave_dev); | ||
3122 | + ds->ports[port].netdev = NULL; | ||
3123 | + return ret; | ||
3124 | } | ||
3125 | |||
3126 | void dsa_slave_destroy(struct net_device *slave_dev) | ||
3127 | diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c | ||
3128 | index 5d7944f394d9..b120b9b11402 100644 | ||
3129 | --- a/net/ipv4/ip_vti.c | ||
3130 | +++ b/net/ipv4/ip_vti.c | ||
3131 | @@ -168,6 +168,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, | ||
3132 | struct ip_tunnel_parm *parms = &tunnel->parms; | ||
3133 | struct dst_entry *dst = skb_dst(skb); | ||
3134 | struct net_device *tdev; /* Device to other host */ | ||
3135 | + int pkt_len = skb->len; | ||
3136 | int err; | ||
3137 | int mtu; | ||
3138 | |||
3139 | @@ -229,7 +230,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, | ||
3140 | |||
3141 | err = dst_output(tunnel->net, skb->sk, skb); | ||
3142 | if (net_xmit_eval(err) == 0) | ||
3143 | - err = skb->len; | ||
3144 | + err = pkt_len; | ||
3145 | iptunnel_xmit_stats(dev, err); | ||
3146 | return NETDEV_TX_OK; | ||
3147 | |||
3148 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c | ||
3149 | index 5d836b037442..85920707c4d3 100644 | ||
3150 | --- a/net/ipv4/tcp_output.c | ||
3151 | +++ b/net/ipv4/tcp_output.c | ||
3152 | @@ -914,6 +914,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, | ||
3153 | struct tcp_skb_cb *tcb; | ||
3154 | struct tcp_out_options opts; | ||
3155 | unsigned int tcp_options_size, tcp_header_size; | ||
3156 | + struct sk_buff *oskb = NULL; | ||
3157 | struct tcp_md5sig_key *md5; | ||
3158 | struct tcphdr *th; | ||
3159 | int err; | ||
3160 | @@ -922,11 +923,9 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, | ||
3161 | tp = tcp_sk(sk); | ||
3162 | |||
3163 | if (clone_it) { | ||
3164 | - skb_mstamp_get(&skb->skb_mstamp); | ||
3165 | TCP_SKB_CB(skb)->tx.in_flight = TCP_SKB_CB(skb)->end_seq | ||
3166 | - tp->snd_una; | ||
3167 | - tcp_rate_skb_sent(sk, skb); | ||
3168 | - | ||
3169 | + oskb = skb; | ||
3170 | if (unlikely(skb_cloned(skb))) | ||
3171 | skb = pskb_copy(skb, gfp_mask); | ||
3172 | else | ||
3173 | @@ -934,6 +933,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, | ||
3174 | if (unlikely(!skb)) | ||
3175 | return -ENOBUFS; | ||
3176 | } | ||
3177 | + skb_mstamp_get(&skb->skb_mstamp); | ||
3178 | |||
3179 | inet = inet_sk(sk); | ||
3180 | tcb = TCP_SKB_CB(skb); | ||
3181 | @@ -1035,12 +1035,15 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, | ||
3182 | |||
3183 | err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl); | ||
3184 | |||
3185 | - if (likely(err <= 0)) | ||
3186 | - return err; | ||
3187 | - | ||
3188 | - tcp_enter_cwr(sk); | ||
3189 | - | ||
3190 | - return net_xmit_eval(err); | ||
3191 | + if (unlikely(err > 0)) { | ||
3192 | + tcp_enter_cwr(sk); | ||
3193 | + err = net_xmit_eval(err); | ||
3194 | + } | ||
3195 | + if (!err && oskb) { | ||
3196 | + skb_mstamp_get(&oskb->skb_mstamp); | ||
3197 | + tcp_rate_skb_sent(sk, oskb); | ||
3198 | + } | ||
3199 | + return err; | ||
3200 | } | ||
3201 | |||
3202 | /* This routine just queues the buffer for sending. | ||
3203 | @@ -2709,10 +2712,11 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) | ||
3204 | skb_headroom(skb) >= 0xFFFF)) { | ||
3205 | struct sk_buff *nskb; | ||
3206 | |||
3207 | - skb_mstamp_get(&skb->skb_mstamp); | ||
3208 | nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC); | ||
3209 | err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) : | ||
3210 | -ENOBUFS; | ||
3211 | + if (!err) | ||
3212 | + skb_mstamp_get(&skb->skb_mstamp); | ||
3213 | } else { | ||
3214 | err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC); | ||
3215 | } | ||
3216 | @@ -3325,6 +3329,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) | ||
3217 | goto done; | ||
3218 | } | ||
3219 | |||
3220 | + /* data was not sent, this is our new send_head */ | ||
3221 | + sk->sk_send_head = syn_data; | ||
3222 | + tp->packets_out -= tcp_skb_pcount(syn_data); | ||
3223 | + | ||
3224 | fallback: | ||
3225 | /* Send a regular SYN with Fast Open cookie request option */ | ||
3226 | if (fo->cookie.len > 0) | ||
3227 | @@ -3374,6 +3382,11 @@ int tcp_connect(struct sock *sk) | ||
3228 | */ | ||
3229 | tp->snd_nxt = tp->write_seq; | ||
3230 | tp->pushed_seq = tp->write_seq; | ||
3231 | + buff = tcp_send_head(sk); | ||
3232 | + if (unlikely(buff)) { | ||
3233 | + tp->snd_nxt = TCP_SKB_CB(buff)->seq; | ||
3234 | + tp->pushed_seq = TCP_SKB_CB(buff)->seq; | ||
3235 | + } | ||
3236 | TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS); | ||
3237 | |||
3238 | /* Timer for repeating the SYN until an answer. */ | ||
3239 | diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c | ||
3240 | index f78afe43bdff..41c10486cf7e 100644 | ||
3241 | --- a/net/ipv6/ip6_gre.c | ||
3242 | +++ b/net/ipv6/ip6_gre.c | ||
3243 | @@ -936,24 +936,25 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev, | ||
3244 | } | ||
3245 | |||
3246 | static int ip6gre_header(struct sk_buff *skb, struct net_device *dev, | ||
3247 | - unsigned short type, | ||
3248 | - const void *daddr, const void *saddr, unsigned int len) | ||
3249 | + unsigned short type, const void *daddr, | ||
3250 | + const void *saddr, unsigned int len) | ||
3251 | { | ||
3252 | struct ip6_tnl *t = netdev_priv(dev); | ||
3253 | - struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb_push(skb, t->hlen); | ||
3254 | - __be16 *p = (__be16 *)(ipv6h+1); | ||
3255 | + struct ipv6hdr *ipv6h; | ||
3256 | + __be16 *p; | ||
3257 | |||
3258 | - ip6_flow_hdr(ipv6h, 0, | ||
3259 | - ip6_make_flowlabel(dev_net(dev), skb, | ||
3260 | - t->fl.u.ip6.flowlabel, true, | ||
3261 | - &t->fl.u.ip6)); | ||
3262 | + ipv6h = (struct ipv6hdr *)skb_push(skb, t->hlen + sizeof(*ipv6h)); | ||
3263 | + ip6_flow_hdr(ipv6h, 0, ip6_make_flowlabel(dev_net(dev), skb, | ||
3264 | + t->fl.u.ip6.flowlabel, | ||
3265 | + true, &t->fl.u.ip6)); | ||
3266 | ipv6h->hop_limit = t->parms.hop_limit; | ||
3267 | ipv6h->nexthdr = NEXTHDR_GRE; | ||
3268 | ipv6h->saddr = t->parms.laddr; | ||
3269 | ipv6h->daddr = t->parms.raddr; | ||
3270 | |||
3271 | - p[0] = t->parms.o_flags; | ||
3272 | - p[1] = htons(type); | ||
3273 | + p = (__be16 *)(ipv6h + 1); | ||
3274 | + p[0] = t->parms.o_flags; | ||
3275 | + p[1] = htons(type); | ||
3276 | |||
3277 | /* | ||
3278 | * Set the source hardware address. | ||
3279 | @@ -1297,6 +1298,7 @@ static void ip6gre_tap_setup(struct net_device *dev) | ||
3280 | dev->features |= NETIF_F_NETNS_LOCAL; | ||
3281 | dev->priv_flags &= ~IFF_TX_SKB_SHARING; | ||
3282 | dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; | ||
3283 | + netif_keep_dst(dev); | ||
3284 | } | ||
3285 | |||
3286 | static bool ip6gre_netlink_encap_parms(struct nlattr *data[], | ||
3287 | diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c | ||
3288 | index 1fc9daa7b1d6..12b2fd512f32 100644 | ||
3289 | --- a/net/ipv6/ip6_tunnel.c | ||
3290 | +++ b/net/ipv6/ip6_tunnel.c | ||
3291 | @@ -1042,6 +1042,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, | ||
3292 | struct dst_entry *dst = NULL, *ndst = NULL; | ||
3293 | struct net_device *tdev; | ||
3294 | int mtu; | ||
3295 | + unsigned int eth_hlen = t->dev->type == ARPHRD_ETHER ? ETH_HLEN : 0; | ||
3296 | unsigned int psh_hlen = sizeof(struct ipv6hdr) + t->encap_hlen; | ||
3297 | unsigned int max_headroom = psh_hlen; | ||
3298 | bool use_cache = false; | ||
3299 | @@ -1120,7 +1121,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, | ||
3300 | t->parms.name); | ||
3301 | goto tx_err_dst_release; | ||
3302 | } | ||
3303 | - mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen; | ||
3304 | + mtu = dst_mtu(dst) - eth_hlen - psh_hlen - t->tun_hlen; | ||
3305 | if (encap_limit >= 0) { | ||
3306 | max_headroom += 8; | ||
3307 | mtu -= 8; | ||
3308 | @@ -1129,7 +1130,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, | ||
3309 | mtu = IPV6_MIN_MTU; | ||
3310 | if (skb_dst(skb) && !t->parms.collect_md) | ||
3311 | skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); | ||
3312 | - if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) { | ||
3313 | + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { | ||
3314 | *pmtu = mtu; | ||
3315 | err = -EMSGSIZE; | ||
3316 | goto tx_err_dst_release; | ||
3317 | @@ -2231,6 +2232,9 @@ static int __init ip6_tunnel_init(void) | ||
3318 | { | ||
3319 | int err; | ||
3320 | |||
3321 | + if (!ipv6_mod_enabled()) | ||
3322 | + return -EOPNOTSUPP; | ||
3323 | + | ||
3324 | err = register_pernet_device(&ip6_tnl_net_ops); | ||
3325 | if (err < 0) | ||
3326 | goto out_pernet; | ||
3327 | diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c | ||
3328 | index 66c2b4b41793..816f79d1a8a3 100644 | ||
3329 | --- a/net/ipv6/ip6_vti.c | ||
3330 | +++ b/net/ipv6/ip6_vti.c | ||
3331 | @@ -445,6 +445,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) | ||
3332 | struct dst_entry *dst = skb_dst(skb); | ||
3333 | struct net_device *tdev; | ||
3334 | struct xfrm_state *x; | ||
3335 | + int pkt_len = skb->len; | ||
3336 | int err = -1; | ||
3337 | int mtu; | ||
3338 | |||
3339 | @@ -498,7 +499,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) | ||
3340 | struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); | ||
3341 | |||
3342 | u64_stats_update_begin(&tstats->syncp); | ||
3343 | - tstats->tx_bytes += skb->len; | ||
3344 | + tstats->tx_bytes += pkt_len; | ||
3345 | tstats->tx_packets++; | ||
3346 | u64_stats_update_end(&tstats->syncp); | ||
3347 | } else { | ||
3348 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c | ||
3349 | index 2497f62fa4c2..4db5f541bca6 100644 | ||
3350 | --- a/net/ipv6/udp.c | ||
3351 | +++ b/net/ipv6/udp.c | ||
3352 | @@ -915,6 +915,7 @@ static void udp6_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb, | ||
3353 | */ | ||
3354 | offset = skb_transport_offset(skb); | ||
3355 | skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); | ||
3356 | + csum = skb->csum; | ||
3357 | |||
3358 | skb->ip_summed = CHECKSUM_NONE; | ||
3359 | |||
3360 | diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c | ||
3361 | index 3bce65183c95..b06acd0f400d 100644 | ||
3362 | --- a/net/l2tp/l2tp_core.c | ||
3363 | +++ b/net/l2tp/l2tp_core.c | ||
3364 | @@ -1415,6 +1415,9 @@ static void l2tp_tunnel_del_work(struct work_struct *work) | ||
3365 | struct sock *sk = NULL; | ||
3366 | |||
3367 | tunnel = container_of(work, struct l2tp_tunnel, del_work); | ||
3368 | + | ||
3369 | + l2tp_tunnel_closeall(tunnel); | ||
3370 | + | ||
3371 | sk = l2tp_tunnel_sock_lookup(tunnel); | ||
3372 | if (!sk) | ||
3373 | goto out; | ||
3374 | @@ -1734,15 +1737,12 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); | ||
3375 | |||
3376 | /* This function is used by the netlink TUNNEL_DELETE command. | ||
3377 | */ | ||
3378 | -int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) | ||
3379 | +void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) | ||
3380 | { | ||
3381 | - l2tp_tunnel_inc_refcount(tunnel); | ||
3382 | - l2tp_tunnel_closeall(tunnel); | ||
3383 | - if (false == queue_work(l2tp_wq, &tunnel->del_work)) { | ||
3384 | - l2tp_tunnel_dec_refcount(tunnel); | ||
3385 | - return 1; | ||
3386 | + if (!test_and_set_bit(0, &tunnel->dead)) { | ||
3387 | + l2tp_tunnel_inc_refcount(tunnel); | ||
3388 | + queue_work(l2tp_wq, &tunnel->del_work); | ||
3389 | } | ||
3390 | - return 0; | ||
3391 | } | ||
3392 | EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); | ||
3393 | |||
3394 | diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h | ||
3395 | index 0095012509ac..42419f1c24cf 100644 | ||
3396 | --- a/net/l2tp/l2tp_core.h | ||
3397 | +++ b/net/l2tp/l2tp_core.h | ||
3398 | @@ -169,6 +169,9 @@ struct l2tp_tunnel_cfg { | ||
3399 | |||
3400 | struct l2tp_tunnel { | ||
3401 | int magic; /* Should be L2TP_TUNNEL_MAGIC */ | ||
3402 | + | ||
3403 | + unsigned long dead; | ||
3404 | + | ||
3405 | struct rcu_head rcu; | ||
3406 | rwlock_t hlist_lock; /* protect session_hlist */ | ||
3407 | struct hlist_head session_hlist[L2TP_HASH_SIZE]; | ||
3408 | @@ -257,7 +260,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, | ||
3409 | u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, | ||
3410 | struct l2tp_tunnel **tunnelp); | ||
3411 | void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel); | ||
3412 | -int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); | ||
3413 | +void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); | ||
3414 | struct l2tp_session *l2tp_session_create(int priv_size, | ||
3415 | struct l2tp_tunnel *tunnel, | ||
3416 | u32 session_id, u32 peer_session_id, | ||
3417 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c | ||
3418 | index 246f29d365c0..2a5775f8a6ca 100644 | ||
3419 | --- a/net/netlink/af_netlink.c | ||
3420 | +++ b/net/netlink/af_netlink.c | ||
3421 | @@ -2211,10 +2211,13 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, | ||
3422 | |||
3423 | mutex_unlock(nlk->cb_mutex); | ||
3424 | |||
3425 | + ret = 0; | ||
3426 | if (cb->start) | ||
3427 | - cb->start(cb); | ||
3428 | + ret = cb->start(cb); | ||
3429 | + | ||
3430 | + if (!ret) | ||
3431 | + ret = netlink_dump(sk); | ||
3432 | |||
3433 | - ret = netlink_dump(sk); | ||
3434 | sock_put(sk); | ||
3435 | |||
3436 | if (ret) | ||
3437 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c | ||
3438 | index 9c92c6cb6a4f..b17f9097c6fe 100644 | ||
3439 | --- a/net/packet/af_packet.c | ||
3440 | +++ b/net/packet/af_packet.c | ||
3441 | @@ -1648,10 +1648,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) | ||
3442 | |||
3443 | mutex_lock(&fanout_mutex); | ||
3444 | |||
3445 | - err = -EINVAL; | ||
3446 | - if (!po->running) | ||
3447 | - goto out; | ||
3448 | - | ||
3449 | err = -EALREADY; | ||
3450 | if (po->fanout) | ||
3451 | goto out; | ||
3452 | @@ -1700,7 +1696,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) | ||
3453 | list_add(&match->list, &fanout_list); | ||
3454 | } | ||
3455 | err = -EINVAL; | ||
3456 | - if (match->type == type && | ||
3457 | + | ||
3458 | + spin_lock(&po->bind_lock); | ||
3459 | + if (po->running && | ||
3460 | + match->type == type && | ||
3461 | match->prot_hook.type == po->prot_hook.type && | ||
3462 | match->prot_hook.dev == po->prot_hook.dev) { | ||
3463 | err = -ENOSPC; | ||
3464 | @@ -1712,6 +1711,13 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) | ||
3465 | err = 0; | ||
3466 | } | ||
3467 | } | ||
3468 | + spin_unlock(&po->bind_lock); | ||
3469 | + | ||
3470 | + if (err && !atomic_read(&match->sk_ref)) { | ||
3471 | + list_del(&match->list); | ||
3472 | + kfree(match); | ||
3473 | + } | ||
3474 | + | ||
3475 | out: | ||
3476 | if (err && rollover) { | ||
3477 | kfree(rollover); | ||
3478 | @@ -2832,6 +2838,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
3479 | struct virtio_net_hdr vnet_hdr = { 0 }; | ||
3480 | int offset = 0; | ||
3481 | struct packet_sock *po = pkt_sk(sk); | ||
3482 | + bool has_vnet_hdr = false; | ||
3483 | int hlen, tlen, linear; | ||
3484 | int extra_len = 0; | ||
3485 | |||
3486 | @@ -2875,6 +2882,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
3487 | err = packet_snd_vnet_parse(msg, &len, &vnet_hdr); | ||
3488 | if (err) | ||
3489 | goto out_unlock; | ||
3490 | + has_vnet_hdr = true; | ||
3491 | } | ||
3492 | |||
3493 | if (unlikely(sock_flag(sk, SOCK_NOFCS))) { | ||
3494 | @@ -2935,7 +2943,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
3495 | |||
3496 | packet_pick_tx_queue(dev, skb); | ||
3497 | |||
3498 | - if (po->has_vnet_hdr) { | ||
3499 | + if (has_vnet_hdr) { | ||
3500 | err = packet_snd_vnet_gso(skb, &vnet_hdr); | ||
3501 | if (err) | ||
3502 | goto out_free; | ||
3503 | @@ -3063,13 +3071,15 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, | ||
3504 | int ret = 0; | ||
3505 | bool unlisted = false; | ||
3506 | |||
3507 | - if (po->fanout) | ||
3508 | - return -EINVAL; | ||
3509 | - | ||
3510 | lock_sock(sk); | ||
3511 | spin_lock(&po->bind_lock); | ||
3512 | rcu_read_lock(); | ||
3513 | |||
3514 | + if (po->fanout) { | ||
3515 | + ret = -EINVAL; | ||
3516 | + goto out_unlock; | ||
3517 | + } | ||
3518 | + | ||
3519 | if (name) { | ||
3520 | dev = dev_get_by_name_rcu(sock_net(sk), name); | ||
3521 | if (!dev) { | ||
3522 | diff --git a/net/sched/act_api.c b/net/sched/act_api.c | ||
3523 | index c651cfce9be6..f3117324146a 100644 | ||
3524 | --- a/net/sched/act_api.c | ||
3525 | +++ b/net/sched/act_api.c | ||
3526 | @@ -141,7 +141,7 @@ static int tcf_del_walker(struct tcf_hashinfo *hinfo, struct sk_buff *skb, | ||
3527 | hlist_for_each_entry_safe(p, n, head, tcfa_head) { | ||
3528 | ret = __tcf_hash_release(p, false, true); | ||
3529 | if (ret == ACT_P_DELETED) { | ||
3530 | - module_put(p->ops->owner); | ||
3531 | + module_put(ops->owner); | ||
3532 | n_i++; | ||
3533 | } else if (ret < 0) | ||
3534 | goto nla_put_failure; | ||
3535 | @@ -450,13 +450,15 @@ EXPORT_SYMBOL(tcf_action_exec); | ||
3536 | |||
3537 | int tcf_action_destroy(struct list_head *actions, int bind) | ||
3538 | { | ||
3539 | + const struct tc_action_ops *ops; | ||
3540 | struct tc_action *a, *tmp; | ||
3541 | int ret = 0; | ||
3542 | |||
3543 | list_for_each_entry_safe(a, tmp, actions, list) { | ||
3544 | + ops = a->ops; | ||
3545 | ret = __tcf_hash_release(a, bind, true); | ||
3546 | if (ret == ACT_P_DELETED) | ||
3547 | - module_put(a->ops->owner); | ||
3548 | + module_put(ops->owner); | ||
3549 | else if (ret < 0) | ||
3550 | return ret; | ||
3551 | } | ||
3552 | diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c | ||
3553 | index b12bc2abea93..e75fb65037d7 100644 | ||
3554 | --- a/net/sched/cls_matchall.c | ||
3555 | +++ b/net/sched/cls_matchall.c | ||
3556 | @@ -32,6 +32,7 @@ static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp, | ||
3557 | if (tc_skip_sw(head->flags)) | ||
3558 | return -1; | ||
3559 | |||
3560 | + *res = head->res; | ||
3561 | return tcf_exts_exec(skb, &head->exts, res); | ||
3562 | } | ||
3563 | |||
3564 | diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c | ||
3565 | index 6cfb6e9038c2..9016c8baf2aa 100644 | ||
3566 | --- a/net/sched/sch_generic.c | ||
3567 | +++ b/net/sched/sch_generic.c | ||
3568 | @@ -681,6 +681,7 @@ void qdisc_reset(struct Qdisc *qdisc) | ||
3569 | qdisc->gso_skb = NULL; | ||
3570 | } | ||
3571 | qdisc->q.qlen = 0; | ||
3572 | + qdisc->qstats.backlog = 0; | ||
3573 | } | ||
3574 | EXPORT_SYMBOL(qdisc_reset); | ||
3575 | |||
3576 | diff --git a/net/tipc/msg.c b/net/tipc/msg.c | ||
3577 | index 56ea0adcd285..912f1fb97c06 100644 | ||
3578 | --- a/net/tipc/msg.c | ||
3579 | +++ b/net/tipc/msg.c | ||
3580 | @@ -547,7 +547,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err) | ||
3581 | return false; | ||
3582 | if (msg_errcode(msg)) | ||
3583 | return false; | ||
3584 | - *err = -TIPC_ERR_NO_NAME; | ||
3585 | + *err = TIPC_ERR_NO_NAME; | ||
3586 | if (skb_linearize(skb)) | ||
3587 | return false; | ||
3588 | msg = buf_msg(skb); | ||
3589 | diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c | ||
3590 | index 1cb060293505..a8a7fbc377f6 100644 | ||
3591 | --- a/security/smack/smack_lsm.c | ||
3592 | +++ b/security/smack/smack_lsm.c | ||
3593 | @@ -1486,7 +1486,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) | ||
3594 | * @inode: the object | ||
3595 | * @name: attribute name | ||
3596 | * @buffer: where to put the result | ||
3597 | - * @alloc: unused | ||
3598 | + * @alloc: duplicate memory | ||
3599 | * | ||
3600 | * Returns the size of the attribute or an error code | ||
3601 | */ | ||
3602 | @@ -1499,43 +1499,38 @@ static int smack_inode_getsecurity(struct inode *inode, | ||
3603 | struct super_block *sbp; | ||
3604 | struct inode *ip = (struct inode *)inode; | ||
3605 | struct smack_known *isp; | ||
3606 | - int ilen; | ||
3607 | - int rc = 0; | ||
3608 | |||
3609 | - if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { | ||
3610 | + if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) | ||
3611 | isp = smk_of_inode(inode); | ||
3612 | - ilen = strlen(isp->smk_known); | ||
3613 | - *buffer = isp->smk_known; | ||
3614 | - return ilen; | ||
3615 | - } | ||
3616 | + else { | ||
3617 | + /* | ||
3618 | + * The rest of the Smack xattrs are only on sockets. | ||
3619 | + */ | ||
3620 | + sbp = ip->i_sb; | ||
3621 | + if (sbp->s_magic != SOCKFS_MAGIC) | ||
3622 | + return -EOPNOTSUPP; | ||
3623 | |||
3624 | - /* | ||
3625 | - * The rest of the Smack xattrs are only on sockets. | ||
3626 | - */ | ||
3627 | - sbp = ip->i_sb; | ||
3628 | - if (sbp->s_magic != SOCKFS_MAGIC) | ||
3629 | - return -EOPNOTSUPP; | ||
3630 | + sock = SOCKET_I(ip); | ||
3631 | + if (sock == NULL || sock->sk == NULL) | ||
3632 | + return -EOPNOTSUPP; | ||
3633 | |||
3634 | - sock = SOCKET_I(ip); | ||
3635 | - if (sock == NULL || sock->sk == NULL) | ||
3636 | - return -EOPNOTSUPP; | ||
3637 | - | ||
3638 | - ssp = sock->sk->sk_security; | ||
3639 | + ssp = sock->sk->sk_security; | ||
3640 | |||
3641 | - if (strcmp(name, XATTR_SMACK_IPIN) == 0) | ||
3642 | - isp = ssp->smk_in; | ||
3643 | - else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) | ||
3644 | - isp = ssp->smk_out; | ||
3645 | - else | ||
3646 | - return -EOPNOTSUPP; | ||
3647 | + if (strcmp(name, XATTR_SMACK_IPIN) == 0) | ||
3648 | + isp = ssp->smk_in; | ||
3649 | + else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) | ||
3650 | + isp = ssp->smk_out; | ||
3651 | + else | ||
3652 | + return -EOPNOTSUPP; | ||
3653 | + } | ||
3654 | |||
3655 | - ilen = strlen(isp->smk_known); | ||
3656 | - if (rc == 0) { | ||
3657 | - *buffer = isp->smk_known; | ||
3658 | - rc = ilen; | ||
3659 | + if (alloc) { | ||
3660 | + *buffer = kstrdup(isp->smk_known, GFP_KERNEL); | ||
3661 | + if (*buffer == NULL) | ||
3662 | + return -ENOMEM; | ||
3663 | } | ||
3664 | |||
3665 | - return rc; | ||
3666 | + return strlen(isp->smk_known); | ||
3667 | } | ||
3668 | |||
3669 | |||
3670 | diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c | ||
3671 | index fec1dfdb14ad..4490a699030b 100644 | ||
3672 | --- a/sound/core/compress_offload.c | ||
3673 | +++ b/sound/core/compress_offload.c | ||
3674 | @@ -948,14 +948,13 @@ static const struct file_operations snd_compr_file_ops = { | ||
3675 | static int snd_compress_dev_register(struct snd_device *device) | ||
3676 | { | ||
3677 | int ret = -EINVAL; | ||
3678 | - char str[16]; | ||
3679 | struct snd_compr *compr; | ||
3680 | |||
3681 | if (snd_BUG_ON(!device || !device->device_data)) | ||
3682 | return -EBADFD; | ||
3683 | compr = device->device_data; | ||
3684 | |||
3685 | - pr_debug("reg %s for device %s, direction %d\n", str, compr->name, | ||
3686 | + pr_debug("reg device %s, direction %d\n", compr->name, | ||
3687 | compr->direction); | ||
3688 | /* register compressed device */ | ||
3689 | ret = snd_register_device(SNDRV_DEVICE_TYPE_COMPRESS, | ||
3690 | diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c | ||
3691 | index 937071760bc4..286f5e3686a3 100644 | ||
3692 | --- a/sound/pci/echoaudio/echoaudio.c | ||
3693 | +++ b/sound/pci/echoaudio/echoaudio.c | ||
3694 | @@ -1272,11 +1272,11 @@ static int snd_echo_mixer_info(struct snd_kcontrol *kcontrol, | ||
3695 | |||
3696 | chip = snd_kcontrol_chip(kcontrol); | ||
3697 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; | ||
3698 | + uinfo->count = 1; | ||
3699 | uinfo->value.integer.min = ECHOGAIN_MINOUT; | ||
3700 | uinfo->value.integer.max = ECHOGAIN_MAXOUT; | ||
3701 | uinfo->dimen.d[0] = num_busses_out(chip); | ||
3702 | uinfo->dimen.d[1] = num_busses_in(chip); | ||
3703 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1]; | ||
3704 | return 0; | ||
3705 | } | ||
3706 | |||
3707 | @@ -1344,11 +1344,11 @@ static int snd_echo_vmixer_info(struct snd_kcontrol *kcontrol, | ||
3708 | |||
3709 | chip = snd_kcontrol_chip(kcontrol); | ||
3710 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; | ||
3711 | + uinfo->count = 1; | ||
3712 | uinfo->value.integer.min = ECHOGAIN_MINOUT; | ||
3713 | uinfo->value.integer.max = ECHOGAIN_MAXOUT; | ||
3714 | uinfo->dimen.d[0] = num_busses_out(chip); | ||
3715 | uinfo->dimen.d[1] = num_pipes_out(chip); | ||
3716 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1]; | ||
3717 | return 0; | ||
3718 | } | ||
3719 | |||
3720 | @@ -1728,6 +1728,7 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol, | ||
3721 | struct snd_ctl_elem_info *uinfo) | ||
3722 | { | ||
3723 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; | ||
3724 | + uinfo->count = 96; | ||
3725 | uinfo->value.integer.min = ECHOGAIN_MINOUT; | ||
3726 | uinfo->value.integer.max = 0; | ||
3727 | #ifdef ECHOCARD_HAS_VMIXER | ||
3728 | @@ -1737,7 +1738,6 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol, | ||
3729 | #endif | ||
3730 | uinfo->dimen.d[1] = 16; /* 16 channels */ | ||
3731 | uinfo->dimen.d[2] = 2; /* 0=level, 1=peak */ | ||
3732 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1] * uinfo->dimen.d[2]; | ||
3733 | return 0; | ||
3734 | } | ||
3735 | |||
3736 | diff --git a/sound/usb/card.c b/sound/usb/card.c | ||
3737 | index f36cb068dad3..8906199a83e6 100644 | ||
3738 | --- a/sound/usb/card.c | ||
3739 | +++ b/sound/usb/card.c | ||
3740 | @@ -221,6 +221,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) | ||
3741 | struct usb_interface_descriptor *altsd; | ||
3742 | void *control_header; | ||
3743 | int i, protocol; | ||
3744 | + int rest_bytes; | ||
3745 | |||
3746 | /* find audiocontrol interface */ | ||
3747 | host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0]; | ||
3748 | @@ -235,6 +236,15 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) | ||
3749 | return -EINVAL; | ||
3750 | } | ||
3751 | |||
3752 | + rest_bytes = (void *)(host_iface->extra + host_iface->extralen) - | ||
3753 | + control_header; | ||
3754 | + | ||
3755 | + /* just to be sure -- this shouldn't hit at all */ | ||
3756 | + if (rest_bytes <= 0) { | ||
3757 | + dev_err(&dev->dev, "invalid control header\n"); | ||
3758 | + return -EINVAL; | ||
3759 | + } | ||
3760 | + | ||
3761 | switch (protocol) { | ||
3762 | default: | ||
3763 | dev_warn(&dev->dev, | ||
3764 | @@ -245,11 +255,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) | ||
3765 | case UAC_VERSION_1: { | ||
3766 | struct uac1_ac_header_descriptor *h1 = control_header; | ||
3767 | |||
3768 | + if (rest_bytes < sizeof(*h1)) { | ||
3769 | + dev_err(&dev->dev, "too short v1 buffer descriptor\n"); | ||
3770 | + return -EINVAL; | ||
3771 | + } | ||
3772 | + | ||
3773 | if (!h1->bInCollection) { | ||
3774 | dev_info(&dev->dev, "skipping empty audio interface (v1)\n"); | ||
3775 | return -EINVAL; | ||
3776 | } | ||
3777 | |||
3778 | + if (rest_bytes < h1->bLength) { | ||
3779 | + dev_err(&dev->dev, "invalid buffer length (v1)\n"); | ||
3780 | + return -EINVAL; | ||
3781 | + } | ||
3782 | + | ||
3783 | if (h1->bLength < sizeof(*h1) + h1->bInCollection) { | ||
3784 | dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n"); | ||
3785 | return -EINVAL; | ||
3786 | diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c | ||
3787 | index bf618e1500ac..e7b934f4d837 100644 | ||
3788 | --- a/sound/usb/usx2y/usb_stream.c | ||
3789 | +++ b/sound/usb/usx2y/usb_stream.c | ||
3790 | @@ -191,7 +191,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, | ||
3791 | } | ||
3792 | |||
3793 | pg = get_order(read_size); | ||
3794 | - sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); | ||
3795 | + sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| | ||
3796 | + __GFP_NOWARN, pg); | ||
3797 | if (!sk->s) { | ||
3798 | snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); | ||
3799 | goto out; | ||
3800 | @@ -211,7 +212,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, | ||
3801 | pg = get_order(write_size); | ||
3802 | |||
3803 | sk->write_page = | ||
3804 | - (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); | ||
3805 | + (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| | ||
3806 | + __GFP_NOWARN, pg); | ||
3807 | if (!sk->write_page) { | ||
3808 | snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); | ||
3809 | usb_stream_free(sk); |