Contents of /trunk/kernel-alx/patches-4.9/0154-4.9.55-all-fixes.patch
Parent Directory | Revision Log
Revision 3039 -
(show annotations)
(download)
Wed Dec 20 11:48:53 2017 UTC (6 years, 9 months ago) by niro
File size: 126211 byte(s)
Wed Dec 20 11:48:53 2017 UTC (6 years, 9 months ago) by niro
File size: 126211 byte(s)
-linux-4.9.55
1 | diff --git a/Makefile b/Makefile |
2 | index 8370937bbb22..2a995675d6bf 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 54 |
9 | +SUBLEVEL = 55 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S |
14 | index 2e2fc1e37715..fd68e19b9ef7 100644 |
15 | --- a/arch/powerpc/kernel/exceptions-64s.S |
16 | +++ b/arch/powerpc/kernel/exceptions-64s.S |
17 | @@ -764,7 +764,29 @@ EXC_REAL(program_check, 0x700, 0x800) |
18 | EXC_VIRT(program_check, 0x4700, 0x4800, 0x700) |
19 | TRAMP_KVM(PACA_EXGEN, 0x700) |
20 | EXC_COMMON_BEGIN(program_check_common) |
21 | - EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN) |
22 | + /* |
23 | + * It's possible to receive a TM Bad Thing type program check with |
24 | + * userspace register values (in particular r1), but with SRR1 reporting |
25 | + * that we came from the kernel. Normally that would confuse the bad |
26 | + * stack logic, and we would report a bad kernel stack pointer. Instead |
27 | + * we switch to the emergency stack if we're taking a TM Bad Thing from |
28 | + * the kernel. |
29 | + */ |
30 | + li r10,MSR_PR /* Build a mask of MSR_PR .. */ |
31 | + oris r10,r10,0x200000@h /* .. and SRR1_PROGTM */ |
32 | + and r10,r10,r12 /* Mask SRR1 with that. */ |
33 | + srdi r10,r10,8 /* Shift it so we can compare */ |
34 | + cmpldi r10,(0x200000 >> 8) /* .. with an immediate. */ |
35 | + bne 1f /* If != go to normal path. */ |
36 | + |
37 | + /* SRR1 had PR=0 and SRR1_PROGTM=1, so use the emergency stack */ |
38 | + andi. r10,r12,MSR_PR; /* Set CR0 correctly for label */ |
39 | + /* 3 in EXCEPTION_PROLOG_COMMON */ |
40 | + mr r10,r1 /* Save r1 */ |
41 | + ld r1,PACAEMERGSP(r13) /* Use emergency stack */ |
42 | + subi r1,r1,INT_FRAME_SIZE /* alloc stack frame */ |
43 | + b 3f /* Jump into the macro !! */ |
44 | +1: EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN) |
45 | bl save_nvgprs |
46 | RECONCILE_IRQ_STATE(r10, r11) |
47 | addi r3,r1,STACK_FRAME_OVERHEAD |
48 | diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c |
49 | index 96698fdf93b4..04e92257fd69 100644 |
50 | --- a/arch/powerpc/kernel/signal_64.c |
51 | +++ b/arch/powerpc/kernel/signal_64.c |
52 | @@ -452,9 +452,20 @@ static long restore_tm_sigcontexts(struct task_struct *tsk, |
53 | if (MSR_TM_RESV(msr)) |
54 | return -EINVAL; |
55 | |
56 | - /* pull in MSR TM from user context */ |
57 | + /* pull in MSR TS bits from user context */ |
58 | regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK); |
59 | |
60 | + /* |
61 | + * Ensure that TM is enabled in regs->msr before we leave the signal |
62 | + * handler. It could be the case that (a) user disabled the TM bit |
63 | + * through the manipulation of the MSR bits in uc_mcontext or (b) the |
64 | + * TM bit was disabled because a sufficient number of context switches |
65 | + * happened whilst in the signal handler and load_tm overflowed, |
66 | + * disabling the TM bit. In either case we can end up with an illegal |
67 | + * TM state leading to a TM Bad Thing when we return to userspace. |
68 | + */ |
69 | + regs->msr |= MSR_TM; |
70 | + |
71 | /* pull in MSR LE from user context */ |
72 | regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE); |
73 | |
74 | diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h |
75 | index 19d14ac23ef9..fc3c7e49c8e4 100644 |
76 | --- a/arch/x86/include/asm/kvm_emulate.h |
77 | +++ b/arch/x86/include/asm/kvm_emulate.h |
78 | @@ -296,6 +296,7 @@ struct x86_emulate_ctxt { |
79 | |
80 | bool perm_ok; /* do not check permissions if true */ |
81 | bool ud; /* inject an #UD if host doesn't support insn */ |
82 | + bool tf; /* TF value before instruction (after for syscall/sysret) */ |
83 | |
84 | bool have_exception; |
85 | struct x86_exception exception; |
86 | diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c |
87 | index de36660751b5..72b737b8c9d6 100644 |
88 | --- a/arch/x86/kvm/emulate.c |
89 | +++ b/arch/x86/kvm/emulate.c |
90 | @@ -2738,6 +2738,7 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt) |
91 | ctxt->eflags &= ~(X86_EFLAGS_VM | X86_EFLAGS_IF); |
92 | } |
93 | |
94 | + ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0; |
95 | return X86EMUL_CONTINUE; |
96 | } |
97 | |
98 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c |
99 | index 3dbcb09c19cf..595f8149c0d9 100644 |
100 | --- a/arch/x86/kvm/x86.c |
101 | +++ b/arch/x86/kvm/x86.c |
102 | @@ -5250,6 +5250,8 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu) |
103 | kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l); |
104 | |
105 | ctxt->eflags = kvm_get_rflags(vcpu); |
106 | + ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0; |
107 | + |
108 | ctxt->eip = kvm_rip_read(vcpu); |
109 | ctxt->mode = (!is_protmode(vcpu)) ? X86EMUL_MODE_REAL : |
110 | (ctxt->eflags & X86_EFLAGS_VM) ? X86EMUL_MODE_VM86 : |
111 | @@ -5465,37 +5467,26 @@ static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7, |
112 | return dr6; |
113 | } |
114 | |
115 | -static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, unsigned long rflags, int *r) |
116 | +static void kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu, int *r) |
117 | { |
118 | struct kvm_run *kvm_run = vcpu->run; |
119 | |
120 | - /* |
121 | - * rflags is the old, "raw" value of the flags. The new value has |
122 | - * not been saved yet. |
123 | - * |
124 | - * This is correct even for TF set by the guest, because "the |
125 | - * processor will not generate this exception after the instruction |
126 | - * that sets the TF flag". |
127 | - */ |
128 | - if (unlikely(rflags & X86_EFLAGS_TF)) { |
129 | - if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { |
130 | - kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | |
131 | - DR6_RTM; |
132 | - kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip; |
133 | - kvm_run->debug.arch.exception = DB_VECTOR; |
134 | - kvm_run->exit_reason = KVM_EXIT_DEBUG; |
135 | - *r = EMULATE_USER_EXIT; |
136 | - } else { |
137 | - vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF; |
138 | - /* |
139 | - * "Certain debug exceptions may clear bit 0-3. The |
140 | - * remaining contents of the DR6 register are never |
141 | - * cleared by the processor". |
142 | - */ |
143 | - vcpu->arch.dr6 &= ~15; |
144 | - vcpu->arch.dr6 |= DR6_BS | DR6_RTM; |
145 | - kvm_queue_exception(vcpu, DB_VECTOR); |
146 | - } |
147 | + if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { |
148 | + kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | DR6_RTM; |
149 | + kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip; |
150 | + kvm_run->debug.arch.exception = DB_VECTOR; |
151 | + kvm_run->exit_reason = KVM_EXIT_DEBUG; |
152 | + *r = EMULATE_USER_EXIT; |
153 | + } else { |
154 | + vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF; |
155 | + /* |
156 | + * "Certain debug exceptions may clear bit 0-3. The |
157 | + * remaining contents of the DR6 register are never |
158 | + * cleared by the processor". |
159 | + */ |
160 | + vcpu->arch.dr6 &= ~15; |
161 | + vcpu->arch.dr6 |= DR6_BS | DR6_RTM; |
162 | + kvm_queue_exception(vcpu, DB_VECTOR); |
163 | } |
164 | } |
165 | |
166 | @@ -5650,8 +5641,9 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, |
167 | toggle_interruptibility(vcpu, ctxt->interruptibility); |
168 | vcpu->arch.emulate_regs_need_sync_to_vcpu = false; |
169 | kvm_rip_write(vcpu, ctxt->eip); |
170 | - if (r == EMULATE_DONE) |
171 | - kvm_vcpu_check_singlestep(vcpu, rflags, &r); |
172 | + if (r == EMULATE_DONE && |
173 | + (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP))) |
174 | + kvm_vcpu_do_singlestep(vcpu, &r); |
175 | if (!ctxt->have_exception || |
176 | exception_type(ctxt->exception.vector) == EXCPT_TRAP) |
177 | __kvm_set_rflags(vcpu, ctxt->eflags); |
178 | diff --git a/drivers/base/platform.c b/drivers/base/platform.c |
179 | index 5eba47815bb6..14ff40371f01 100644 |
180 | --- a/drivers/base/platform.c |
181 | +++ b/drivers/base/platform.c |
182 | @@ -858,7 +858,8 @@ static ssize_t driver_override_store(struct device *dev, |
183 | struct platform_device *pdev = to_platform_device(dev); |
184 | char *driver_override, *old, *cp; |
185 | |
186 | - if (count > PATH_MAX) |
187 | + /* We need to keep extra room for a newline */ |
188 | + if (count >= (PAGE_SIZE - 1)) |
189 | return -EINVAL; |
190 | |
191 | driver_override = kstrndup(buf, count, GFP_KERNEL); |
192 | diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c |
193 | index 4ac36e3c341f..8aeb7f8ee59c 100644 |
194 | --- a/drivers/gpu/drm/i915/intel_bios.c |
195 | +++ b/drivers/gpu/drm/i915/intel_bios.c |
196 | @@ -1152,6 +1152,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port, |
197 | is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0; |
198 | is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR); |
199 | |
200 | + if (port == PORT_A && is_dvi) { |
201 | + DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n", |
202 | + is_hdmi ? "/HDMI" : ""); |
203 | + is_dvi = false; |
204 | + is_hdmi = false; |
205 | + } |
206 | + |
207 | info->supports_dvi = is_dvi; |
208 | info->supports_hdmi = is_hdmi; |
209 | info->supports_dp = is_dp; |
210 | diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c |
211 | index 8008e06b7efe..865e7c262322 100644 |
212 | --- a/drivers/hid/i2c-hid/i2c-hid.c |
213 | +++ b/drivers/hid/i2c-hid/i2c-hid.c |
214 | @@ -604,7 +604,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size) |
215 | { |
216 | /* the worst case is computed from the set_report command with a |
217 | * reportID > 15 and the maximum report length */ |
218 | - int args_len = sizeof(__u8) + /* optional ReportID byte */ |
219 | + int args_len = sizeof(__u8) + /* ReportID */ |
220 | + sizeof(__u8) + /* optional ReportID byte */ |
221 | sizeof(__u16) + /* data register */ |
222 | sizeof(__u16) + /* size of the report */ |
223 | report_size; /* report */ |
224 | diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c |
225 | index 53ac19b3727a..d72dfb2bbdb8 100644 |
226 | --- a/drivers/hid/wacom_sys.c |
227 | +++ b/drivers/hid/wacom_sys.c |
228 | @@ -611,8 +611,10 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev) |
229 | |
230 | /* Try to find an already-probed interface from the same device */ |
231 | list_for_each_entry(data, &wacom_udev_list, list) { |
232 | - if (compare_device_paths(hdev, data->dev, '/')) |
233 | + if (compare_device_paths(hdev, data->dev, '/')) { |
234 | + kref_get(&data->kref); |
235 | return data; |
236 | + } |
237 | } |
238 | |
239 | /* Fallback to finding devices that appear to be "siblings" */ |
240 | @@ -712,6 +714,9 @@ static int wacom_led_control(struct wacom *wacom) |
241 | if (!wacom->led.groups) |
242 | return -ENOTSUPP; |
243 | |
244 | + if (wacom->wacom_wac.features.type == REMOTE) |
245 | + return -ENOTSUPP; |
246 | + |
247 | if (wacom->wacom_wac.pid) { /* wireless connected */ |
248 | report_id = WAC_CMD_WL_LED_CONTROL; |
249 | buf_size = 13; |
250 | diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c |
251 | index c6a922ee5d3b..db951c4fd6dd 100644 |
252 | --- a/drivers/hid/wacom_wac.c |
253 | +++ b/drivers/hid/wacom_wac.c |
254 | @@ -559,8 +559,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom) |
255 | keys = data[9] & 0x07; |
256 | } |
257 | } else { |
258 | - buttons = ((data[6] & 0x10) << 10) | |
259 | - ((data[5] & 0x10) << 9) | |
260 | + buttons = ((data[6] & 0x10) << 5) | |
261 | + ((data[5] & 0x10) << 4) | |
262 | ((data[6] & 0x0F) << 4) | |
263 | (data[5] & 0x0F); |
264 | } |
265 | diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c |
266 | index e47d8c9db03a..75126e4e3f05 100644 |
267 | --- a/drivers/hv/hv_fcopy.c |
268 | +++ b/drivers/hv/hv_fcopy.c |
269 | @@ -161,6 +161,10 @@ static void fcopy_send_data(struct work_struct *dummy) |
270 | out_src = smsg_out; |
271 | break; |
272 | |
273 | + case WRITE_TO_FILE: |
274 | + out_src = fcopy_transaction.fcopy_msg; |
275 | + out_len = sizeof(struct hv_do_fcopy); |
276 | + break; |
277 | default: |
278 | out_src = fcopy_transaction.fcopy_msg; |
279 | out_len = fcopy_transaction.recv_len; |
280 | diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c |
281 | index a6ea387b5b00..877a0ed76abf 100644 |
282 | --- a/drivers/hwtracing/stm/core.c |
283 | +++ b/drivers/hwtracing/stm/core.c |
284 | @@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data) |
285 | |
286 | stm_source_link_drop(src); |
287 | |
288 | - device_destroy(&stm_source_class, src->dev.devt); |
289 | + device_unregister(&src->dev); |
290 | } |
291 | EXPORT_SYMBOL_GPL(stm_source_unregister_device); |
292 | |
293 | diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c |
294 | index e6706a09e100..47c3d7f32900 100644 |
295 | --- a/drivers/iio/adc/ad7793.c |
296 | +++ b/drivers/iio/adc/ad7793.c |
297 | @@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, |
298 | unsigned int vref_mv) |
299 | { |
300 | struct ad7793_state *st = iio_priv(indio_dev); |
301 | - int i, ret = -1; |
302 | + int i, ret; |
303 | unsigned long long scale_uv; |
304 | u32 id; |
305 | |
306 | @@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, |
307 | return ret; |
308 | |
309 | /* reset the serial interface */ |
310 | - ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret)); |
311 | + ret = ad_sd_reset(&st->sd, 32); |
312 | if (ret < 0) |
313 | goto out; |
314 | usleep_range(500, 2000); /* Wait for at least 500us */ |
315 | diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c |
316 | index d10bd0c97233..22c4c17cd996 100644 |
317 | --- a/drivers/iio/adc/ad_sigma_delta.c |
318 | +++ b/drivers/iio/adc/ad_sigma_delta.c |
319 | @@ -177,6 +177,34 @@ int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, |
320 | } |
321 | EXPORT_SYMBOL_GPL(ad_sd_read_reg); |
322 | |
323 | +/** |
324 | + * ad_sd_reset() - Reset the serial interface |
325 | + * |
326 | + * @sigma_delta: The sigma delta device |
327 | + * @reset_length: Number of SCLKs with DIN = 1 |
328 | + * |
329 | + * Returns 0 on success, an error code otherwise. |
330 | + **/ |
331 | +int ad_sd_reset(struct ad_sigma_delta *sigma_delta, |
332 | + unsigned int reset_length) |
333 | +{ |
334 | + uint8_t *buf; |
335 | + unsigned int size; |
336 | + int ret; |
337 | + |
338 | + size = DIV_ROUND_UP(reset_length, 8); |
339 | + buf = kcalloc(size, sizeof(*buf), GFP_KERNEL); |
340 | + if (!buf) |
341 | + return -ENOMEM; |
342 | + |
343 | + memset(buf, 0xff, size); |
344 | + ret = spi_write(sigma_delta->spi, buf, size); |
345 | + kfree(buf); |
346 | + |
347 | + return ret; |
348 | +} |
349 | +EXPORT_SYMBOL_GPL(ad_sd_reset); |
350 | + |
351 | static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta, |
352 | unsigned int mode, unsigned int channel) |
353 | { |
354 | diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c |
355 | index 634717ae12f3..071dd23a33d9 100644 |
356 | --- a/drivers/iio/adc/mcp320x.c |
357 | +++ b/drivers/iio/adc/mcp320x.c |
358 | @@ -17,6 +17,8 @@ |
359 | * MCP3204 |
360 | * MCP3208 |
361 | * ------------ |
362 | + * 13 bit converter |
363 | + * MCP3301 |
364 | * |
365 | * Datasheet can be found here: |
366 | * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf mcp3001 |
367 | @@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(int device_index, |
368 | } |
369 | |
370 | static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, |
371 | - bool differential, int device_index) |
372 | + bool differential, int device_index, int *val) |
373 | { |
374 | int ret; |
375 | |
376 | @@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, |
377 | |
378 | switch (device_index) { |
379 | case mcp3001: |
380 | - return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); |
381 | + *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); |
382 | + return 0; |
383 | case mcp3002: |
384 | case mcp3004: |
385 | case mcp3008: |
386 | - return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); |
387 | + *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); |
388 | + return 0; |
389 | case mcp3201: |
390 | - return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); |
391 | + *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); |
392 | + return 0; |
393 | case mcp3202: |
394 | case mcp3204: |
395 | case mcp3208: |
396 | - return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); |
397 | + *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); |
398 | + return 0; |
399 | case mcp3301: |
400 | - return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12); |
401 | + *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8 |
402 | + | adc->rx_buf[1], 12); |
403 | + return 0; |
404 | default: |
405 | return -EINVAL; |
406 | } |
407 | @@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev, |
408 | switch (mask) { |
409 | case IIO_CHAN_INFO_RAW: |
410 | ret = mcp320x_adc_conversion(adc, channel->address, |
411 | - channel->differential, device_index); |
412 | - |
413 | + channel->differential, device_index, val); |
414 | if (ret < 0) |
415 | goto out; |
416 | |
417 | - *val = ret; |
418 | ret = IIO_VAL_INT; |
419 | break; |
420 | |
421 | @@ -312,6 +318,7 @@ static int mcp320x_probe(struct spi_device *spi) |
422 | indio_dev->name = spi_get_device_id(spi)->name; |
423 | indio_dev->modes = INDIO_DIRECT_MODE; |
424 | indio_dev->info = &mcp320x_info; |
425 | + spi_set_drvdata(spi, indio_dev); |
426 | |
427 | chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data]; |
428 | indio_dev->channels = chip_info->channels; |
429 | diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c |
430 | index 0c74869a540a..7ffc5db4d7ee 100644 |
431 | --- a/drivers/iio/adc/twl4030-madc.c |
432 | +++ b/drivers/iio/adc/twl4030-madc.c |
433 | @@ -866,8 +866,10 @@ static int twl4030_madc_probe(struct platform_device *pdev) |
434 | |
435 | /* Enable 3v1 bias regulator for MADC[3:6] */ |
436 | madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1"); |
437 | - if (IS_ERR(madc->usb3v1)) |
438 | - return -ENODEV; |
439 | + if (IS_ERR(madc->usb3v1)) { |
440 | + ret = -ENODEV; |
441 | + goto err_i2c; |
442 | + } |
443 | |
444 | ret = regulator_enable(madc->usb3v1); |
445 | if (ret) |
446 | @@ -876,11 +878,13 @@ static int twl4030_madc_probe(struct platform_device *pdev) |
447 | ret = iio_device_register(iio_dev); |
448 | if (ret) { |
449 | dev_err(&pdev->dev, "could not register iio device\n"); |
450 | - goto err_i2c; |
451 | + goto err_usb3v1; |
452 | } |
453 | |
454 | return 0; |
455 | |
456 | +err_usb3v1: |
457 | + regulator_disable(madc->usb3v1); |
458 | err_i2c: |
459 | twl4030_madc_set_current_generator(madc, 0, 0); |
460 | err_current_generator: |
461 | diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c |
462 | index fc340ed3dca1..c5bc73135436 100644 |
463 | --- a/drivers/iio/industrialio-core.c |
464 | +++ b/drivers/iio/industrialio-core.c |
465 | @@ -306,8 +306,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf, |
466 | ret = indio_dev->info->debugfs_reg_access(indio_dev, |
467 | indio_dev->cached_reg_addr, |
468 | 0, &val); |
469 | - if (ret) |
470 | + if (ret) { |
471 | dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__); |
472 | + return ret; |
473 | + } |
474 | |
475 | len = snprintf(buf, sizeof(buf), "0x%X\n", val); |
476 | |
477 | diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c |
478 | index f762eb8b174a..19aa957bd454 100644 |
479 | --- a/drivers/iio/pressure/bmp280-core.c |
480 | +++ b/drivers/iio/pressure/bmp280-core.c |
481 | @@ -558,7 +558,7 @@ static int bmp280_chip_config(struct bmp280_data *data) |
482 | u8 osrs = BMP280_OSRS_TEMP_X(data->oversampling_temp + 1) | |
483 | BMP280_OSRS_PRESS_X(data->oversampling_press + 1); |
484 | |
485 | - ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_MEAS, |
486 | + ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS, |
487 | BMP280_OSRS_TEMP_MASK | |
488 | BMP280_OSRS_PRESS_MASK | |
489 | BMP280_MODE_MASK, |
490 | diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c |
491 | index bf3fbd00a091..64b586458d3d 100644 |
492 | --- a/drivers/isdn/i4l/isdn_ppp.c |
493 | +++ b/drivers/isdn/i4l/isdn_ppp.c |
494 | @@ -828,7 +828,6 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) |
495 | isdn_net_local *lp; |
496 | struct ippp_struct *is; |
497 | int proto; |
498 | - unsigned char protobuf[4]; |
499 | |
500 | is = file->private_data; |
501 | |
502 | @@ -842,24 +841,28 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) |
503 | if (!lp) |
504 | printk(KERN_DEBUG "isdn_ppp_write: lp == NULL\n"); |
505 | else { |
506 | - /* |
507 | - * Don't reset huptimer for |
508 | - * LCP packets. (Echo requests). |
509 | - */ |
510 | - if (copy_from_user(protobuf, buf, 4)) |
511 | - return -EFAULT; |
512 | - proto = PPP_PROTOCOL(protobuf); |
513 | - if (proto != PPP_LCP) |
514 | - lp->huptimer = 0; |
515 | + if (lp->isdn_device < 0 || lp->isdn_channel < 0) { |
516 | + unsigned char protobuf[4]; |
517 | + /* |
518 | + * Don't reset huptimer for |
519 | + * LCP packets. (Echo requests). |
520 | + */ |
521 | + if (copy_from_user(protobuf, buf, 4)) |
522 | + return -EFAULT; |
523 | + |
524 | + proto = PPP_PROTOCOL(protobuf); |
525 | + if (proto != PPP_LCP) |
526 | + lp->huptimer = 0; |
527 | |
528 | - if (lp->isdn_device < 0 || lp->isdn_channel < 0) |
529 | return 0; |
530 | + } |
531 | |
532 | if ((dev->drv[lp->isdn_device]->flags & DRV_FLAG_RUNNING) && |
533 | lp->dialstate == 0 && |
534 | (lp->flags & ISDN_NET_CONNECTED)) { |
535 | unsigned short hl; |
536 | struct sk_buff *skb; |
537 | + unsigned char *cpy_buf; |
538 | /* |
539 | * we need to reserve enough space in front of |
540 | * sk_buff. old call to dev_alloc_skb only reserved |
541 | @@ -872,11 +875,21 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) |
542 | return count; |
543 | } |
544 | skb_reserve(skb, hl); |
545 | - if (copy_from_user(skb_put(skb, count), buf, count)) |
546 | + cpy_buf = skb_put(skb, count); |
547 | + if (copy_from_user(cpy_buf, buf, count)) |
548 | { |
549 | kfree_skb(skb); |
550 | return -EFAULT; |
551 | } |
552 | + |
553 | + /* |
554 | + * Don't reset huptimer for |
555 | + * LCP packets. (Echo requests). |
556 | + */ |
557 | + proto = PPP_PROTOCOL(cpy_buf); |
558 | + if (proto != PPP_LCP) |
559 | + lp->huptimer = 0; |
560 | + |
561 | if (is->debug & 0x40) { |
562 | printk(KERN_DEBUG "ppp xmit: len %d\n", (int) skb->len); |
563 | isdn_ppp_frame_log("xmit", skb->data, skb->len, 32, is->unit, lp->ppp_slot); |
564 | diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c |
565 | index b2ca10c4d2a5..4f4a627f6b20 100644 |
566 | --- a/drivers/mmc/core/mmc.c |
567 | +++ b/drivers/mmc/core/mmc.c |
568 | @@ -1255,6 +1255,23 @@ int mmc_hs400_to_hs200(struct mmc_card *card) |
569 | return err; |
570 | } |
571 | |
572 | +static void mmc_select_driver_type(struct mmc_card *card) |
573 | +{ |
574 | + int card_drv_type, drive_strength, drv_type; |
575 | + |
576 | + card_drv_type = card->ext_csd.raw_driver_strength | |
577 | + mmc_driver_type_mask(0); |
578 | + |
579 | + drive_strength = mmc_select_drive_strength(card, |
580 | + card->ext_csd.hs200_max_dtr, |
581 | + card_drv_type, &drv_type); |
582 | + |
583 | + card->drive_strength = drive_strength; |
584 | + |
585 | + if (drv_type) |
586 | + mmc_set_driver_type(card->host, drv_type); |
587 | +} |
588 | + |
589 | static int mmc_select_hs400es(struct mmc_card *card) |
590 | { |
591 | struct mmc_host *host = card->host; |
592 | @@ -1303,6 +1320,8 @@ static int mmc_select_hs400es(struct mmc_card *card) |
593 | goto out_err; |
594 | } |
595 | |
596 | + mmc_select_driver_type(card); |
597 | + |
598 | /* Switch card to HS400 */ |
599 | val = EXT_CSD_TIMING_HS400 | |
600 | card->drive_strength << EXT_CSD_DRV_STR_SHIFT; |
601 | @@ -1336,23 +1355,6 @@ static int mmc_select_hs400es(struct mmc_card *card) |
602 | return err; |
603 | } |
604 | |
605 | -static void mmc_select_driver_type(struct mmc_card *card) |
606 | -{ |
607 | - int card_drv_type, drive_strength, drv_type; |
608 | - |
609 | - card_drv_type = card->ext_csd.raw_driver_strength | |
610 | - mmc_driver_type_mask(0); |
611 | - |
612 | - drive_strength = mmc_select_drive_strength(card, |
613 | - card->ext_csd.hs200_max_dtr, |
614 | - card_drv_type, &drv_type); |
615 | - |
616 | - card->drive_strength = drive_strength; |
617 | - |
618 | - if (drv_type) |
619 | - mmc_set_driver_type(card->host, drv_type); |
620 | -} |
621 | - |
622 | /* |
623 | * For device supporting HS200 mode, the following sequence |
624 | * should be done before executing the tuning process. |
625 | diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c |
626 | index aaf6fec566b5..3660a3d51731 100644 |
627 | --- a/drivers/net/ethernet/ibm/emac/mal.c |
628 | +++ b/drivers/net/ethernet/ibm/emac/mal.c |
629 | @@ -402,7 +402,7 @@ static int mal_poll(struct napi_struct *napi, int budget) |
630 | unsigned long flags; |
631 | |
632 | MAL_DBG2(mal, "poll(%d)" NL, budget); |
633 | - again: |
634 | + |
635 | /* Process TX skbs */ |
636 | list_for_each(l, &mal->poll_list) { |
637 | struct mal_commac *mc = |
638 | @@ -451,7 +451,6 @@ static int mal_poll(struct napi_struct *napi, int budget) |
639 | spin_lock_irqsave(&mal->lock, flags); |
640 | mal_disable_eob_irq(mal); |
641 | spin_unlock_irqrestore(&mal->lock, flags); |
642 | - goto again; |
643 | } |
644 | mc->ops->poll_tx(mc->dev); |
645 | } |
646 | diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c |
647 | index 1806b1fc6e4c..d50350c7adc4 100644 |
648 | --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c |
649 | +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c |
650 | @@ -249,15 +249,14 @@ static void mlxsw_sp_span_entry_destroy(struct mlxsw_sp *mlxsw_sp, |
651 | } |
652 | |
653 | static struct mlxsw_sp_span_entry * |
654 | -mlxsw_sp_span_entry_find(struct mlxsw_sp_port *port) |
655 | +mlxsw_sp_span_entry_find(struct mlxsw_sp *mlxsw_sp, u8 local_port) |
656 | { |
657 | - struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp; |
658 | int i; |
659 | |
660 | for (i = 0; i < mlxsw_sp->span.entries_count; i++) { |
661 | struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i]; |
662 | |
663 | - if (curr->used && curr->local_port == port->local_port) |
664 | + if (curr->used && curr->local_port == local_port) |
665 | return curr; |
666 | } |
667 | return NULL; |
668 | @@ -268,7 +267,8 @@ static struct mlxsw_sp_span_entry |
669 | { |
670 | struct mlxsw_sp_span_entry *span_entry; |
671 | |
672 | - span_entry = mlxsw_sp_span_entry_find(port); |
673 | + span_entry = mlxsw_sp_span_entry_find(port->mlxsw_sp, |
674 | + port->local_port); |
675 | if (span_entry) { |
676 | /* Already exists, just take a reference */ |
677 | span_entry->ref_count++; |
678 | @@ -453,12 +453,13 @@ static int mlxsw_sp_span_mirror_add(struct mlxsw_sp_port *from, |
679 | } |
680 | |
681 | static void mlxsw_sp_span_mirror_remove(struct mlxsw_sp_port *from, |
682 | - struct mlxsw_sp_port *to, |
683 | + u8 destination_port, |
684 | enum mlxsw_sp_span_type type) |
685 | { |
686 | struct mlxsw_sp_span_entry *span_entry; |
687 | |
688 | - span_entry = mlxsw_sp_span_entry_find(to); |
689 | + span_entry = mlxsw_sp_span_entry_find(from->mlxsw_sp, |
690 | + destination_port); |
691 | if (!span_entry) { |
692 | netdev_err(from->dev, "no span entry found\n"); |
693 | return; |
694 | @@ -1255,10 +1256,8 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port, |
695 | static void mlxsw_sp_port_del_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port, |
696 | struct tc_cls_matchall_offload *cls) |
697 | { |
698 | - struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; |
699 | struct mlxsw_sp_port_mall_tc_entry *mall_tc_entry; |
700 | enum mlxsw_sp_span_type span_type; |
701 | - struct mlxsw_sp_port *to_port; |
702 | |
703 | mall_tc_entry = mlxsw_sp_port_mirror_entry_find(mlxsw_sp_port, |
704 | cls->cookie); |
705 | @@ -1269,11 +1268,12 @@ static void mlxsw_sp_port_del_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port, |
706 | |
707 | switch (mall_tc_entry->type) { |
708 | case MLXSW_SP_PORT_MALL_MIRROR: |
709 | - to_port = mlxsw_sp->ports[mall_tc_entry->mirror.to_local_port]; |
710 | span_type = mall_tc_entry->mirror.ingress ? |
711 | MLXSW_SP_SPAN_INGRESS : MLXSW_SP_SPAN_EGRESS; |
712 | |
713 | - mlxsw_sp_span_mirror_remove(mlxsw_sp_port, to_port, span_type); |
714 | + mlxsw_sp_span_mirror_remove(mlxsw_sp_port, |
715 | + mall_tc_entry->mirror.to_local_port, |
716 | + span_type); |
717 | break; |
718 | default: |
719 | WARN_ON(1); |
720 | diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c |
721 | index 0b4deb31e742..f683bfbd9986 100644 |
722 | --- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c |
723 | +++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c |
724 | @@ -932,7 +932,8 @@ static void emac_mac_rx_descs_refill(struct emac_adapter *adpt, |
725 | |
726 | curr_rxbuf->dma_addr = |
727 | dma_map_single(adpt->netdev->dev.parent, skb->data, |
728 | - curr_rxbuf->length, DMA_FROM_DEVICE); |
729 | + adpt->rxbuf_size, DMA_FROM_DEVICE); |
730 | + |
731 | ret = dma_mapping_error(adpt->netdev->dev.parent, |
732 | curr_rxbuf->dma_addr); |
733 | if (ret) { |
734 | diff --git a/drivers/net/ethernet/rocker/rocker_tlv.h b/drivers/net/ethernet/rocker/rocker_tlv.h |
735 | index a63ef82e7c72..dfae3c9d57c6 100644 |
736 | --- a/drivers/net/ethernet/rocker/rocker_tlv.h |
737 | +++ b/drivers/net/ethernet/rocker/rocker_tlv.h |
738 | @@ -139,40 +139,52 @@ rocker_tlv_start(struct rocker_desc_info *desc_info) |
739 | int rocker_tlv_put(struct rocker_desc_info *desc_info, |
740 | int attrtype, int attrlen, const void *data); |
741 | |
742 | -static inline int rocker_tlv_put_u8(struct rocker_desc_info *desc_info, |
743 | - int attrtype, u8 value) |
744 | +static inline int |
745 | +rocker_tlv_put_u8(struct rocker_desc_info *desc_info, int attrtype, u8 value) |
746 | { |
747 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &value); |
748 | + u8 tmp = value; /* work around GCC PR81715 */ |
749 | + |
750 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &tmp); |
751 | } |
752 | |
753 | -static inline int rocker_tlv_put_u16(struct rocker_desc_info *desc_info, |
754 | - int attrtype, u16 value) |
755 | +static inline int |
756 | +rocker_tlv_put_u16(struct rocker_desc_info *desc_info, int attrtype, u16 value) |
757 | { |
758 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &value); |
759 | + u16 tmp = value; |
760 | + |
761 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &tmp); |
762 | } |
763 | |
764 | -static inline int rocker_tlv_put_be16(struct rocker_desc_info *desc_info, |
765 | - int attrtype, __be16 value) |
766 | +static inline int |
767 | +rocker_tlv_put_be16(struct rocker_desc_info *desc_info, int attrtype, __be16 value) |
768 | { |
769 | - return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &value); |
770 | + __be16 tmp = value; |
771 | + |
772 | + return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &tmp); |
773 | } |
774 | |
775 | -static inline int rocker_tlv_put_u32(struct rocker_desc_info *desc_info, |
776 | - int attrtype, u32 value) |
777 | +static inline int |
778 | +rocker_tlv_put_u32(struct rocker_desc_info *desc_info, int attrtype, u32 value) |
779 | { |
780 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &value); |
781 | + u32 tmp = value; |
782 | + |
783 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &tmp); |
784 | } |
785 | |
786 | -static inline int rocker_tlv_put_be32(struct rocker_desc_info *desc_info, |
787 | - int attrtype, __be32 value) |
788 | +static inline int |
789 | +rocker_tlv_put_be32(struct rocker_desc_info *desc_info, int attrtype, __be32 value) |
790 | { |
791 | - return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &value); |
792 | + __be32 tmp = value; |
793 | + |
794 | + return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &tmp); |
795 | } |
796 | |
797 | -static inline int rocker_tlv_put_u64(struct rocker_desc_info *desc_info, |
798 | - int attrtype, u64 value) |
799 | +static inline int |
800 | +rocker_tlv_put_u64(struct rocker_desc_info *desc_info, int attrtype, u64 value) |
801 | { |
802 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &value); |
803 | + u64 tmp = value; |
804 | + |
805 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &tmp); |
806 | } |
807 | |
808 | static inline struct rocker_tlv * |
809 | diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c |
810 | index d15dd3938ba8..2e5150b0b8d5 100644 |
811 | --- a/drivers/net/phy/xilinx_gmii2rgmii.c |
812 | +++ b/drivers/net/phy/xilinx_gmii2rgmii.c |
813 | @@ -44,7 +44,7 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev) |
814 | priv->phy_drv->read_status(phydev); |
815 | |
816 | val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG); |
817 | - val &= XILINX_GMII2RGMII_SPEED_MASK; |
818 | + val &= ~XILINX_GMII2RGMII_SPEED_MASK; |
819 | |
820 | if (phydev->speed == SPEED_1000) |
821 | val |= BMCR_SPEED1000; |
822 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c |
823 | index a931b73393c8..ba7f9e054c4a 100644 |
824 | --- a/drivers/net/tun.c |
825 | +++ b/drivers/net/tun.c |
826 | @@ -1279,11 +1279,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, |
827 | switch (tun->flags & TUN_TYPE_MASK) { |
828 | case IFF_TUN: |
829 | if (tun->flags & IFF_NO_PI) { |
830 | - switch (skb->data[0] & 0xf0) { |
831 | - case 0x40: |
832 | + u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0; |
833 | + |
834 | + switch (ip_version) { |
835 | + case 4: |
836 | pi.proto = htons(ETH_P_IP); |
837 | break; |
838 | - case 0x60: |
839 | + case 6: |
840 | pi.proto = htons(ETH_P_IPV6); |
841 | break; |
842 | default: |
843 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c |
844 | index 1d4352e1ac81..27960b0bfbcd 100644 |
845 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c |
846 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c |
847 | @@ -978,7 +978,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, |
848 | |
849 | eth_broadcast_addr(params_le->bssid); |
850 | params_le->bss_type = DOT11_BSSTYPE_ANY; |
851 | - params_le->scan_type = 0; |
852 | + params_le->scan_type = BRCMF_SCANTYPE_ACTIVE; |
853 | params_le->channel_num = 0; |
854 | params_le->nprobes = cpu_to_le32(-1); |
855 | params_le->active_time = cpu_to_le32(-1); |
856 | @@ -986,12 +986,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, |
857 | params_le->home_time = cpu_to_le32(-1); |
858 | memset(¶ms_le->ssid_le, 0, sizeof(params_le->ssid_le)); |
859 | |
860 | - /* if request is null exit so it will be all channel broadcast scan */ |
861 | - if (!request) |
862 | - return; |
863 | - |
864 | n_ssids = request->n_ssids; |
865 | n_channels = request->n_channels; |
866 | + |
867 | /* Copy channel array if applicable */ |
868 | brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n", |
869 | n_channels); |
870 | @@ -1028,16 +1025,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, |
871 | ptr += sizeof(ssid_le); |
872 | } |
873 | } else { |
874 | - brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids); |
875 | - if ((request->ssids) && request->ssids->ssid_len) { |
876 | - brcmf_dbg(SCAN, "SSID %s len=%d\n", |
877 | - params_le->ssid_le.SSID, |
878 | - request->ssids->ssid_len); |
879 | - params_le->ssid_le.SSID_len = |
880 | - cpu_to_le32(request->ssids->ssid_len); |
881 | - memcpy(¶ms_le->ssid_le.SSID, request->ssids->ssid, |
882 | - request->ssids->ssid_len); |
883 | - } |
884 | + brcmf_dbg(SCAN, "Performing passive scan\n"); |
885 | + params_le->scan_type = BRCMF_SCANTYPE_PASSIVE; |
886 | } |
887 | /* Adding mask to channel numbers */ |
888 | params_le->channel_num = |
889 | @@ -3097,6 +3086,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, |
890 | struct brcmf_cfg80211_info *cfg = ifp->drvr->config; |
891 | s32 status; |
892 | struct brcmf_escan_result_le *escan_result_le; |
893 | + u32 escan_buflen; |
894 | struct brcmf_bss_info_le *bss_info_le; |
895 | struct brcmf_bss_info_le *bss = NULL; |
896 | u32 bi_length; |
897 | @@ -3113,11 +3103,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, |
898 | |
899 | if (status == BRCMF_E_STATUS_PARTIAL) { |
900 | brcmf_dbg(SCAN, "ESCAN Partial result\n"); |
901 | + if (e->datalen < sizeof(*escan_result_le)) { |
902 | + brcmf_err("invalid event data length\n"); |
903 | + goto exit; |
904 | + } |
905 | escan_result_le = (struct brcmf_escan_result_le *) data; |
906 | if (!escan_result_le) { |
907 | brcmf_err("Invalid escan result (NULL pointer)\n"); |
908 | goto exit; |
909 | } |
910 | + escan_buflen = le32_to_cpu(escan_result_le->buflen); |
911 | + if (escan_buflen > BRCMF_ESCAN_BUF_SIZE || |
912 | + escan_buflen > e->datalen || |
913 | + escan_buflen < sizeof(*escan_result_le)) { |
914 | + brcmf_err("Invalid escan buffer length: %d\n", |
915 | + escan_buflen); |
916 | + goto exit; |
917 | + } |
918 | if (le16_to_cpu(escan_result_le->bss_count) != 1) { |
919 | brcmf_err("Invalid bss_count %d: ignoring\n", |
920 | escan_result_le->bss_count); |
921 | @@ -3134,9 +3136,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, |
922 | } |
923 | |
924 | bi_length = le32_to_cpu(bss_info_le->length); |
925 | - if (bi_length != (le32_to_cpu(escan_result_le->buflen) - |
926 | - WL_ESCAN_RESULTS_FIXED_SIZE)) { |
927 | - brcmf_err("Invalid bss_info length %d: ignoring\n", |
928 | + if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) { |
929 | + brcmf_err("Ignoring invalid bss_info length: %d\n", |
930 | bi_length); |
931 | goto exit; |
932 | } |
933 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h |
934 | index a4118c0ef6ca..59013572fbe3 100644 |
935 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h |
936 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h |
937 | @@ -45,6 +45,11 @@ |
938 | #define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff |
939 | #define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16 |
940 | |
941 | +/* scan type definitions */ |
942 | +#define BRCMF_SCANTYPE_DEFAULT 0xFF |
943 | +#define BRCMF_SCANTYPE_ACTIVE 0 |
944 | +#define BRCMF_SCANTYPE_PASSIVE 1 |
945 | + |
946 | /* primary (ie tx) key */ |
947 | #define BRCMF_PRIMARY_KEY (1 << 1) |
948 | #define DOT11_BSSTYPE_ANY 2 |
949 | diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c |
950 | index 3bd6fc1b76d4..33f4d7c7b53a 100644 |
951 | --- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c |
952 | +++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c |
953 | @@ -78,6 +78,7 @@ |
954 | /* NVM offsets (in words) definitions */ |
955 | enum wkp_nvm_offsets { |
956 | /* NVM HW-Section offset (in words) definitions */ |
957 | + SUBSYSTEM_ID = 0x0A, |
958 | HW_ADDR = 0x15, |
959 | |
960 | /* NVM SW-Section offset (in words) definitions */ |
961 | @@ -262,13 +263,12 @@ static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, bool is_5ghz, |
962 | static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, |
963 | struct iwl_nvm_data *data, |
964 | const __le16 * const nvm_ch_flags, |
965 | - bool lar_supported) |
966 | + bool lar_supported, bool no_wide_in_5ghz) |
967 | { |
968 | int ch_idx; |
969 | int n_channels = 0; |
970 | struct ieee80211_channel *channel; |
971 | u16 ch_flags; |
972 | - bool is_5ghz; |
973 | int num_of_ch, num_2ghz_channels; |
974 | const u8 *nvm_chan; |
975 | |
976 | @@ -283,12 +283,20 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, |
977 | } |
978 | |
979 | for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) { |
980 | + bool is_5ghz = (ch_idx >= num_2ghz_channels); |
981 | + |
982 | ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx); |
983 | |
984 | - if (ch_idx >= num_2ghz_channels && |
985 | - !data->sku_cap_band_52GHz_enable) |
986 | + if (is_5ghz && !data->sku_cap_band_52GHz_enable) |
987 | continue; |
988 | |
989 | + /* workaround to disable wide channels in 5GHz */ |
990 | + if (no_wide_in_5ghz && is_5ghz) { |
991 | + ch_flags &= ~(NVM_CHANNEL_40MHZ | |
992 | + NVM_CHANNEL_80MHZ | |
993 | + NVM_CHANNEL_160MHZ); |
994 | + } |
995 | + |
996 | if (ch_flags & NVM_CHANNEL_160MHZ) |
997 | data->vht160_supported = true; |
998 | |
999 | @@ -311,8 +319,8 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, |
1000 | n_channels++; |
1001 | |
1002 | channel->hw_value = nvm_chan[ch_idx]; |
1003 | - channel->band = (ch_idx < num_2ghz_channels) ? |
1004 | - NL80211_BAND_2GHZ : NL80211_BAND_5GHZ; |
1005 | + channel->band = is_5ghz ? |
1006 | + NL80211_BAND_5GHZ : NL80211_BAND_2GHZ; |
1007 | channel->center_freq = |
1008 | ieee80211_channel_to_frequency( |
1009 | channel->hw_value, channel->band); |
1010 | @@ -324,7 +332,6 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, |
1011 | * is not used in mvm, and is used for backwards compatibility |
1012 | */ |
1013 | channel->max_power = IWL_DEFAULT_MAX_TX_POWER; |
1014 | - is_5ghz = channel->band == NL80211_BAND_5GHZ; |
1015 | |
1016 | /* don't put limitations in case we're using LAR */ |
1017 | if (!lar_supported) |
1018 | @@ -441,7 +448,8 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg, |
1019 | static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg, |
1020 | struct iwl_nvm_data *data, |
1021 | const __le16 *ch_section, |
1022 | - u8 tx_chains, u8 rx_chains, bool lar_supported) |
1023 | + u8 tx_chains, u8 rx_chains, bool lar_supported, |
1024 | + bool no_wide_in_5ghz) |
1025 | { |
1026 | int n_channels; |
1027 | int n_used = 0; |
1028 | @@ -450,12 +458,14 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg, |
1029 | if (cfg->device_family != IWL_DEVICE_FAMILY_8000) |
1030 | n_channels = iwl_init_channel_map( |
1031 | dev, cfg, data, |
1032 | - &ch_section[NVM_CHANNELS], lar_supported); |
1033 | + &ch_section[NVM_CHANNELS], lar_supported, |
1034 | + no_wide_in_5ghz); |
1035 | else |
1036 | n_channels = iwl_init_channel_map( |
1037 | dev, cfg, data, |
1038 | &ch_section[NVM_CHANNELS_FAMILY_8000], |
1039 | - lar_supported); |
1040 | + lar_supported, |
1041 | + no_wide_in_5ghz); |
1042 | |
1043 | sband = &data->bands[NL80211_BAND_2GHZ]; |
1044 | sband->band = NL80211_BAND_2GHZ; |
1045 | @@ -658,6 +668,39 @@ static int iwl_set_hw_address(struct iwl_trans *trans, |
1046 | return 0; |
1047 | } |
1048 | |
1049 | +static bool |
1050 | +iwl_nvm_no_wide_in_5ghz(struct device *dev, const struct iwl_cfg *cfg, |
1051 | + const __le16 *nvm_hw) |
1052 | +{ |
1053 | + /* |
1054 | + * Workaround a bug in Indonesia SKUs where the regulatory in |
1055 | + * some 7000-family OTPs erroneously allow wide channels in |
1056 | + * 5GHz. To check for Indonesia, we take the SKU value from |
1057 | + * bits 1-4 in the subsystem ID and check if it is either 5 or |
1058 | + * 9. In those cases, we need to force-disable wide channels |
1059 | + * in 5GHz otherwise the FW will throw a sysassert when we try |
1060 | + * to use them. |
1061 | + */ |
1062 | + if (cfg->device_family == IWL_DEVICE_FAMILY_7000) { |
1063 | + /* |
1064 | + * Unlike the other sections in the NVM, the hw |
1065 | + * section uses big-endian. |
1066 | + */ |
1067 | + u16 subsystem_id = be16_to_cpup((const __be16 *)nvm_hw |
1068 | + + SUBSYSTEM_ID); |
1069 | + u8 sku = (subsystem_id & 0x1e) >> 1; |
1070 | + |
1071 | + if (sku == 5 || sku == 9) { |
1072 | + IWL_DEBUG_EEPROM(dev, |
1073 | + "disabling wide channels in 5GHz (0x%0x %d)\n", |
1074 | + subsystem_id, sku); |
1075 | + return true; |
1076 | + } |
1077 | + } |
1078 | + |
1079 | + return false; |
1080 | +} |
1081 | + |
1082 | struct iwl_nvm_data * |
1083 | iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg, |
1084 | const __le16 *nvm_hw, const __le16 *nvm_sw, |
1085 | @@ -668,6 +711,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg, |
1086 | struct device *dev = trans->dev; |
1087 | struct iwl_nvm_data *data; |
1088 | bool lar_enabled; |
1089 | + bool no_wide_in_5ghz = iwl_nvm_no_wide_in_5ghz(dev, cfg, nvm_hw); |
1090 | u32 sku, radio_cfg; |
1091 | u16 lar_config; |
1092 | const __le16 *ch_section; |
1093 | @@ -738,7 +782,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg, |
1094 | } |
1095 | |
1096 | iwl_init_sbands(dev, cfg, data, ch_section, tx_chains, rx_chains, |
1097 | - lar_fw_supported && lar_enabled); |
1098 | + lar_fw_supported && lar_enabled, no_wide_in_5ghz); |
1099 | data->calib_version = 255; |
1100 | |
1101 | return data; |
1102 | diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
1103 | index 1db1dc13e988..9789f3c5a785 100644 |
1104 | --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
1105 | +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
1106 | @@ -1548,6 +1548,11 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac, |
1107 | struct iwl_mvm_mc_iter_data *data = _data; |
1108 | struct iwl_mvm *mvm = data->mvm; |
1109 | struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd; |
1110 | + struct iwl_host_cmd hcmd = { |
1111 | + .id = MCAST_FILTER_CMD, |
1112 | + .flags = CMD_ASYNC, |
1113 | + .dataflags[0] = IWL_HCMD_DFL_NOCOPY, |
1114 | + }; |
1115 | int ret, len; |
1116 | |
1117 | /* if we don't have free ports, mcast frames will be dropped */ |
1118 | @@ -1562,7 +1567,10 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac, |
1119 | memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN); |
1120 | len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4); |
1121 | |
1122 | - ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd); |
1123 | + hcmd.len[0] = len; |
1124 | + hcmd.data[0] = cmd; |
1125 | + |
1126 | + ret = iwl_mvm_send_cmd(mvm, &hcmd); |
1127 | if (ret) |
1128 | IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret); |
1129 | } |
1130 | diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c |
1131 | index 14eac73e8dbc..54ea90f89b70 100644 |
1132 | --- a/drivers/nvme/host/pci.c |
1133 | +++ b/drivers/nvme/host/pci.c |
1134 | @@ -96,7 +96,7 @@ struct nvme_dev { |
1135 | struct mutex shutdown_lock; |
1136 | bool subsystem; |
1137 | void __iomem *cmb; |
1138 | - dma_addr_t cmb_dma_addr; |
1139 | + pci_bus_addr_t cmb_bus_addr; |
1140 | u64 cmb_size; |
1141 | u32 cmbsz; |
1142 | u32 cmbloc; |
1143 | @@ -1037,7 +1037,7 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq, |
1144 | if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) { |
1145 | unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth), |
1146 | dev->ctrl.page_size); |
1147 | - nvmeq->sq_dma_addr = dev->cmb_dma_addr + offset; |
1148 | + nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset; |
1149 | nvmeq->sq_cmds_io = dev->cmb + offset; |
1150 | } else { |
1151 | nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth), |
1152 | @@ -1343,7 +1343,7 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) |
1153 | resource_size_t bar_size; |
1154 | struct pci_dev *pdev = to_pci_dev(dev->dev); |
1155 | void __iomem *cmb; |
1156 | - dma_addr_t dma_addr; |
1157 | + int bar; |
1158 | |
1159 | dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ); |
1160 | if (!(NVME_CMB_SZ(dev->cmbsz))) |
1161 | @@ -1356,7 +1356,8 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) |
1162 | szu = (u64)1 << (12 + 4 * NVME_CMB_SZU(dev->cmbsz)); |
1163 | size = szu * NVME_CMB_SZ(dev->cmbsz); |
1164 | offset = szu * NVME_CMB_OFST(dev->cmbloc); |
1165 | - bar_size = pci_resource_len(pdev, NVME_CMB_BIR(dev->cmbloc)); |
1166 | + bar = NVME_CMB_BIR(dev->cmbloc); |
1167 | + bar_size = pci_resource_len(pdev, bar); |
1168 | |
1169 | if (offset > bar_size) |
1170 | return NULL; |
1171 | @@ -1369,12 +1370,11 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) |
1172 | if (size > bar_size - offset) |
1173 | size = bar_size - offset; |
1174 | |
1175 | - dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(dev->cmbloc)) + offset; |
1176 | - cmb = ioremap_wc(dma_addr, size); |
1177 | + cmb = ioremap_wc(pci_resource_start(pdev, bar) + offset, size); |
1178 | if (!cmb) |
1179 | return NULL; |
1180 | |
1181 | - dev->cmb_dma_addr = dma_addr; |
1182 | + dev->cmb_bus_addr = pci_bus_address(pdev, bar) + offset; |
1183 | dev->cmb_size = size; |
1184 | return cmb; |
1185 | } |
1186 | diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c |
1187 | index 13ac7e57a35d..09fa1fd0c4ce 100644 |
1188 | --- a/drivers/scsi/sd.c |
1189 | +++ b/drivers/scsi/sd.c |
1190 | @@ -2867,8 +2867,6 @@ static int sd_revalidate_disk(struct gendisk *disk) |
1191 | sd_read_write_same(sdkp, buffer); |
1192 | } |
1193 | |
1194 | - sdkp->first_scan = 0; |
1195 | - |
1196 | /* |
1197 | * We now have all cache related info, determine how we deal |
1198 | * with flush requests. |
1199 | @@ -2883,7 +2881,7 @@ static int sd_revalidate_disk(struct gendisk *disk) |
1200 | q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max); |
1201 | |
1202 | /* |
1203 | - * Use the device's preferred I/O size for reads and writes |
1204 | + * Determine the device's preferred I/O size for reads and writes |
1205 | * unless the reported value is unreasonably small, large, or |
1206 | * garbage. |
1207 | */ |
1208 | @@ -2897,8 +2895,19 @@ static int sd_revalidate_disk(struct gendisk *disk) |
1209 | rw_max = min_not_zero(logical_to_sectors(sdp, dev_max), |
1210 | (sector_t)BLK_DEF_MAX_SECTORS); |
1211 | |
1212 | - /* Combine with controller limits */ |
1213 | - q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); |
1214 | + /* Do not exceed controller limit */ |
1215 | + rw_max = min(rw_max, queue_max_hw_sectors(q)); |
1216 | + |
1217 | + /* |
1218 | + * Only update max_sectors if previously unset or if the current value |
1219 | + * exceeds the capabilities of the hardware. |
1220 | + */ |
1221 | + if (sdkp->first_scan || |
1222 | + q->limits.max_sectors > q->limits.max_dev_sectors || |
1223 | + q->limits.max_sectors > q->limits.max_hw_sectors) |
1224 | + q->limits.max_sectors = rw_max; |
1225 | + |
1226 | + sdkp->first_scan = 0; |
1227 | |
1228 | set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); |
1229 | sd_config_write_same(sdkp); |
1230 | diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c |
1231 | index 1cf6b79801a9..eeacb0e55db7 100644 |
1232 | --- a/drivers/staging/iio/adc/ad7192.c |
1233 | +++ b/drivers/staging/iio/adc/ad7192.c |
1234 | @@ -222,11 +222,9 @@ static int ad7192_setup(struct ad7192_state *st, |
1235 | struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi); |
1236 | unsigned long long scale_uv; |
1237 | int i, ret, id; |
1238 | - u8 ones[6]; |
1239 | |
1240 | /* reset the serial interface */ |
1241 | - memset(&ones, 0xFF, 6); |
1242 | - ret = spi_write(st->sd.spi, &ones, 6); |
1243 | + ret = ad_sd_reset(&st->sd, 48); |
1244 | if (ret < 0) |
1245 | goto out; |
1246 | usleep_range(500, 1000); /* Wait for at least 500us */ |
1247 | diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c |
1248 | index 1091b9f1dd07..6d459ef8c121 100644 |
1249 | --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c |
1250 | +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c |
1251 | @@ -538,18 +538,20 @@ free_pagelist(PAGELIST_T *pagelist, int actual) |
1252 | if (head_bytes > actual) |
1253 | head_bytes = actual; |
1254 | |
1255 | - memcpy((char *)page_address(pages[0]) + |
1256 | + memcpy((char *)kmap(pages[0]) + |
1257 | pagelist->offset, |
1258 | fragments, |
1259 | head_bytes); |
1260 | + kunmap(pages[0]); |
1261 | } |
1262 | if ((actual >= 0) && (head_bytes < actual) && |
1263 | (tail_bytes != 0)) { |
1264 | - memcpy((char *)page_address(pages[num_pages - 1]) + |
1265 | + memcpy((char *)kmap(pages[num_pages - 1]) + |
1266 | ((pagelist->offset + actual) & |
1267 | (PAGE_SIZE - 1) & ~(g_cache_line_size - 1)), |
1268 | fragments + g_cache_line_size, |
1269 | tail_bytes); |
1270 | + kunmap(pages[num_pages - 1]); |
1271 | } |
1272 | |
1273 | down(&g_free_fragments_mutex); |
1274 | diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c |
1275 | index 0b845e550fbd..9f001659807a 100644 |
1276 | --- a/drivers/usb/class/cdc-wdm.c |
1277 | +++ b/drivers/usb/class/cdc-wdm.c |
1278 | @@ -194,8 +194,10 @@ static void wdm_in_callback(struct urb *urb) |
1279 | /* |
1280 | * only set a new error if there is no previous error. |
1281 | * Errors are only cleared during read/open |
1282 | + * Avoid propagating -EPIPE (stall) to userspace since it is |
1283 | + * better handled as an empty read |
1284 | */ |
1285 | - if (desc->rerr == 0) |
1286 | + if (desc->rerr == 0 && status != -EPIPE) |
1287 | desc->rerr = status; |
1288 | |
1289 | if (length + desc->length > desc->wMaxCommand) { |
1290 | diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c |
1291 | index eef716bdc259..11793386b4e9 100644 |
1292 | --- a/drivers/usb/core/config.c |
1293 | +++ b/drivers/usb/core/config.c |
1294 | @@ -638,15 +638,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, |
1295 | |
1296 | } else if (header->bDescriptorType == |
1297 | USB_DT_INTERFACE_ASSOCIATION) { |
1298 | + struct usb_interface_assoc_descriptor *d; |
1299 | + |
1300 | + d = (struct usb_interface_assoc_descriptor *)header; |
1301 | + if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) { |
1302 | + dev_warn(ddev, |
1303 | + "config %d has an invalid interface association descriptor of length %d, skipping\n", |
1304 | + cfgno, d->bLength); |
1305 | + continue; |
1306 | + } |
1307 | + |
1308 | if (iad_num == USB_MAXIADS) { |
1309 | dev_warn(ddev, "found more Interface " |
1310 | "Association Descriptors " |
1311 | "than allocated for in " |
1312 | "configuration %d\n", cfgno); |
1313 | } else { |
1314 | - config->intf_assoc[iad_num] = |
1315 | - (struct usb_interface_assoc_descriptor |
1316 | - *)header; |
1317 | + config->intf_assoc[iad_num] = d; |
1318 | iad_num++; |
1319 | } |
1320 | |
1321 | @@ -847,7 +855,7 @@ int usb_get_configuration(struct usb_device *dev) |
1322 | } |
1323 | |
1324 | if (dev->quirks & USB_QUIRK_DELAY_INIT) |
1325 | - msleep(100); |
1326 | + msleep(200); |
1327 | |
1328 | result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, |
1329 | bigbuffer, length); |
1330 | diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c |
1331 | index c8075eb3db26..860108c46e9a 100644 |
1332 | --- a/drivers/usb/core/devio.c |
1333 | +++ b/drivers/usb/core/devio.c |
1334 | @@ -1577,7 +1577,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb |
1335 | totlen += isopkt[u].length; |
1336 | } |
1337 | u *= sizeof(struct usb_iso_packet_descriptor); |
1338 | - uurb->buffer_length = totlen; |
1339 | + if (totlen <= uurb->buffer_length) |
1340 | + uurb->buffer_length = totlen; |
1341 | + else |
1342 | + WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d", |
1343 | + totlen, uurb->buffer_length); |
1344 | break; |
1345 | |
1346 | default: |
1347 | diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c |
1348 | index 80d4ef31ba8d..8127f112958e 100644 |
1349 | --- a/drivers/usb/core/hub.c |
1350 | +++ b/drivers/usb/core/hub.c |
1351 | @@ -4828,7 +4828,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, |
1352 | goto loop; |
1353 | |
1354 | if (udev->quirks & USB_QUIRK_DELAY_INIT) |
1355 | - msleep(1000); |
1356 | + msleep(2000); |
1357 | |
1358 | /* consecutive bus-powered hubs aren't reliable; they can |
1359 | * violate the voltage drop budget. if the new child has |
1360 | diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c |
1361 | index 3a4707746157..4c388451f31f 100644 |
1362 | --- a/drivers/usb/core/message.c |
1363 | +++ b/drivers/usb/core/message.c |
1364 | @@ -2068,6 +2068,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, |
1365 | elength = 1; |
1366 | goto next_desc; |
1367 | } |
1368 | + if ((buflen < elength) || (elength < 3)) { |
1369 | + dev_err(&intf->dev, "invalid descriptor buffer length\n"); |
1370 | + break; |
1371 | + } |
1372 | if (buffer[1] != USB_DT_CS_INTERFACE) { |
1373 | dev_err(&intf->dev, "skipping garbage\n"); |
1374 | goto next_desc; |
1375 | diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c |
1376 | index ccd93c9e26ab..d2fc237cd87a 100644 |
1377 | --- a/drivers/usb/gadget/function/f_mass_storage.c |
1378 | +++ b/drivers/usb/gadget/function/f_mass_storage.c |
1379 | @@ -306,8 +306,6 @@ struct fsg_common { |
1380 | struct completion thread_notifier; |
1381 | struct task_struct *thread_task; |
1382 | |
1383 | - /* Callback functions. */ |
1384 | - const struct fsg_operations *ops; |
1385 | /* Gadget's private data. */ |
1386 | void *private_data; |
1387 | |
1388 | @@ -2505,6 +2503,7 @@ static void handle_exception(struct fsg_common *common) |
1389 | static int fsg_main_thread(void *common_) |
1390 | { |
1391 | struct fsg_common *common = common_; |
1392 | + int i; |
1393 | |
1394 | /* |
1395 | * Allow the thread to be killed by a signal, but set the signal mask |
1396 | @@ -2566,21 +2565,16 @@ static int fsg_main_thread(void *common_) |
1397 | common->thread_task = NULL; |
1398 | spin_unlock_irq(&common->lock); |
1399 | |
1400 | - if (!common->ops || !common->ops->thread_exits |
1401 | - || common->ops->thread_exits(common) < 0) { |
1402 | - int i; |
1403 | + /* Eject media from all LUNs */ |
1404 | |
1405 | - down_write(&common->filesem); |
1406 | - for (i = 0; i < ARRAY_SIZE(common->luns); --i) { |
1407 | - struct fsg_lun *curlun = common->luns[i]; |
1408 | - if (!curlun || !fsg_lun_is_open(curlun)) |
1409 | - continue; |
1410 | + down_write(&common->filesem); |
1411 | + for (i = 0; i < ARRAY_SIZE(common->luns); i++) { |
1412 | + struct fsg_lun *curlun = common->luns[i]; |
1413 | |
1414 | + if (curlun && fsg_lun_is_open(curlun)) |
1415 | fsg_lun_close(curlun); |
1416 | - curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT; |
1417 | - } |
1418 | - up_write(&common->filesem); |
1419 | } |
1420 | + up_write(&common->filesem); |
1421 | |
1422 | /* Let fsg_unbind() know the thread has exited */ |
1423 | complete_and_exit(&common->thread_notifier, 0); |
1424 | @@ -2770,13 +2764,6 @@ void fsg_common_remove_luns(struct fsg_common *common) |
1425 | } |
1426 | EXPORT_SYMBOL_GPL(fsg_common_remove_luns); |
1427 | |
1428 | -void fsg_common_set_ops(struct fsg_common *common, |
1429 | - const struct fsg_operations *ops) |
1430 | -{ |
1431 | - common->ops = ops; |
1432 | -} |
1433 | -EXPORT_SYMBOL_GPL(fsg_common_set_ops); |
1434 | - |
1435 | void fsg_common_free_buffers(struct fsg_common *common) |
1436 | { |
1437 | _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers); |
1438 | diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h |
1439 | index d3902313b8ac..dc05ca0c4359 100644 |
1440 | --- a/drivers/usb/gadget/function/f_mass_storage.h |
1441 | +++ b/drivers/usb/gadget/function/f_mass_storage.h |
1442 | @@ -60,17 +60,6 @@ struct fsg_module_parameters { |
1443 | struct fsg_common; |
1444 | |
1445 | /* FSF callback functions */ |
1446 | -struct fsg_operations { |
1447 | - /* |
1448 | - * Callback function to call when thread exits. If no |
1449 | - * callback is set or it returns value lower then zero MSF |
1450 | - * will force eject all LUNs it operates on (including those |
1451 | - * marked as non-removable or with prevent_medium_removal flag |
1452 | - * set). |
1453 | - */ |
1454 | - int (*thread_exits)(struct fsg_common *common); |
1455 | -}; |
1456 | - |
1457 | struct fsg_lun_opts { |
1458 | struct config_group group; |
1459 | struct fsg_lun *lun; |
1460 | @@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun); |
1461 | |
1462 | void fsg_common_remove_luns(struct fsg_common *common); |
1463 | |
1464 | -void fsg_common_set_ops(struct fsg_common *common, |
1465 | - const struct fsg_operations *ops); |
1466 | - |
1467 | int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg, |
1468 | unsigned int id, const char *name, |
1469 | const char **name_pfx); |
1470 | diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c |
1471 | index f959c42ecace..f69dbd4bcd18 100644 |
1472 | --- a/drivers/usb/gadget/legacy/inode.c |
1473 | +++ b/drivers/usb/gadget/legacy/inode.c |
1474 | @@ -27,7 +27,7 @@ |
1475 | #include <linux/mmu_context.h> |
1476 | #include <linux/aio.h> |
1477 | #include <linux/uio.h> |
1478 | - |
1479 | +#include <linux/delay.h> |
1480 | #include <linux/device.h> |
1481 | #include <linux/moduleparam.h> |
1482 | |
1483 | @@ -116,6 +116,7 @@ enum ep0_state { |
1484 | struct dev_data { |
1485 | spinlock_t lock; |
1486 | atomic_t count; |
1487 | + int udc_usage; |
1488 | enum ep0_state state; /* P: lock */ |
1489 | struct usb_gadgetfs_event event [N_EVENT]; |
1490 | unsigned ev_next; |
1491 | @@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) |
1492 | INIT_WORK(&priv->work, ep_user_copy_worker); |
1493 | schedule_work(&priv->work); |
1494 | } |
1495 | - spin_unlock(&epdata->dev->lock); |
1496 | |
1497 | usb_ep_free_request(ep, req); |
1498 | + spin_unlock(&epdata->dev->lock); |
1499 | put_ep(epdata); |
1500 | } |
1501 | |
1502 | @@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) |
1503 | struct usb_request *req = dev->req; |
1504 | |
1505 | if ((retval = setup_req (ep, req, 0)) == 0) { |
1506 | + ++dev->udc_usage; |
1507 | spin_unlock_irq (&dev->lock); |
1508 | retval = usb_ep_queue (ep, req, GFP_KERNEL); |
1509 | spin_lock_irq (&dev->lock); |
1510 | + --dev->udc_usage; |
1511 | } |
1512 | dev->state = STATE_DEV_CONNECTED; |
1513 | |
1514 | @@ -983,11 +986,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) |
1515 | retval = -EIO; |
1516 | else { |
1517 | len = min (len, (size_t)dev->req->actual); |
1518 | -// FIXME don't call this with the spinlock held ... |
1519 | + ++dev->udc_usage; |
1520 | + spin_unlock_irq(&dev->lock); |
1521 | if (copy_to_user (buf, dev->req->buf, len)) |
1522 | retval = -EFAULT; |
1523 | else |
1524 | retval = len; |
1525 | + spin_lock_irq(&dev->lock); |
1526 | + --dev->udc_usage; |
1527 | clean_req (dev->gadget->ep0, dev->req); |
1528 | /* NOTE userspace can't yet choose to stall */ |
1529 | } |
1530 | @@ -1131,6 +1137,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) |
1531 | retval = setup_req (dev->gadget->ep0, dev->req, len); |
1532 | if (retval == 0) { |
1533 | dev->state = STATE_DEV_CONNECTED; |
1534 | + ++dev->udc_usage; |
1535 | spin_unlock_irq (&dev->lock); |
1536 | if (copy_from_user (dev->req->buf, buf, len)) |
1537 | retval = -EFAULT; |
1538 | @@ -1142,6 +1149,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) |
1539 | GFP_KERNEL); |
1540 | } |
1541 | spin_lock_irq(&dev->lock); |
1542 | + --dev->udc_usage; |
1543 | if (retval < 0) { |
1544 | clean_req (dev->gadget->ep0, dev->req); |
1545 | } else |
1546 | @@ -1243,9 +1251,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value) |
1547 | struct usb_gadget *gadget = dev->gadget; |
1548 | long ret = -ENOTTY; |
1549 | |
1550 | - if (gadget->ops->ioctl) |
1551 | + spin_lock_irq(&dev->lock); |
1552 | + if (dev->state == STATE_DEV_OPENED || |
1553 | + dev->state == STATE_DEV_UNBOUND) { |
1554 | + /* Not bound to a UDC */ |
1555 | + } else if (gadget->ops->ioctl) { |
1556 | + ++dev->udc_usage; |
1557 | + spin_unlock_irq(&dev->lock); |
1558 | + |
1559 | ret = gadget->ops->ioctl (gadget, code, value); |
1560 | |
1561 | + spin_lock_irq(&dev->lock); |
1562 | + --dev->udc_usage; |
1563 | + } |
1564 | + spin_unlock_irq(&dev->lock); |
1565 | + |
1566 | return ret; |
1567 | } |
1568 | |
1569 | @@ -1463,10 +1483,12 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) |
1570 | if (value < 0) |
1571 | break; |
1572 | |
1573 | + ++dev->udc_usage; |
1574 | spin_unlock (&dev->lock); |
1575 | value = usb_ep_queue (gadget->ep0, dev->req, |
1576 | GFP_KERNEL); |
1577 | spin_lock (&dev->lock); |
1578 | + --dev->udc_usage; |
1579 | if (value < 0) { |
1580 | clean_req (gadget->ep0, dev->req); |
1581 | break; |
1582 | @@ -1490,8 +1512,12 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) |
1583 | req->length = value; |
1584 | req->zero = value < w_length; |
1585 | |
1586 | + ++dev->udc_usage; |
1587 | spin_unlock (&dev->lock); |
1588 | value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); |
1589 | + spin_lock(&dev->lock); |
1590 | + --dev->udc_usage; |
1591 | + spin_unlock(&dev->lock); |
1592 | if (value < 0) { |
1593 | DBG (dev, "ep_queue --> %d\n", value); |
1594 | req->status = 0; |
1595 | @@ -1518,21 +1544,24 @@ static void destroy_ep_files (struct dev_data *dev) |
1596 | /* break link to FS */ |
1597 | ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); |
1598 | list_del_init (&ep->epfiles); |
1599 | + spin_unlock_irq (&dev->lock); |
1600 | + |
1601 | dentry = ep->dentry; |
1602 | ep->dentry = NULL; |
1603 | parent = d_inode(dentry->d_parent); |
1604 | |
1605 | /* break link to controller */ |
1606 | + mutex_lock(&ep->lock); |
1607 | if (ep->state == STATE_EP_ENABLED) |
1608 | (void) usb_ep_disable (ep->ep); |
1609 | ep->state = STATE_EP_UNBOUND; |
1610 | usb_ep_free_request (ep->ep, ep->req); |
1611 | ep->ep = NULL; |
1612 | + mutex_unlock(&ep->lock); |
1613 | + |
1614 | wake_up (&ep->wait); |
1615 | put_ep (ep); |
1616 | |
1617 | - spin_unlock_irq (&dev->lock); |
1618 | - |
1619 | /* break link to dcache */ |
1620 | inode_lock(parent); |
1621 | d_delete (dentry); |
1622 | @@ -1603,6 +1632,11 @@ gadgetfs_unbind (struct usb_gadget *gadget) |
1623 | |
1624 | spin_lock_irq (&dev->lock); |
1625 | dev->state = STATE_DEV_UNBOUND; |
1626 | + while (dev->udc_usage > 0) { |
1627 | + spin_unlock_irq(&dev->lock); |
1628 | + usleep_range(1000, 2000); |
1629 | + spin_lock_irq(&dev->lock); |
1630 | + } |
1631 | spin_unlock_irq (&dev->lock); |
1632 | |
1633 | destroy_ep_files (dev); |
1634 | diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c |
1635 | index 125974f32f50..fcba59782f26 100644 |
1636 | --- a/drivers/usb/gadget/legacy/mass_storage.c |
1637 | +++ b/drivers/usb/gadget/legacy/mass_storage.c |
1638 | @@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS; |
1639 | |
1640 | FSG_MODULE_PARAMETERS(/* no prefix */, mod_data); |
1641 | |
1642 | -static unsigned long msg_registered; |
1643 | -static void msg_cleanup(void); |
1644 | - |
1645 | -static int msg_thread_exits(struct fsg_common *common) |
1646 | -{ |
1647 | - msg_cleanup(); |
1648 | - return 0; |
1649 | -} |
1650 | - |
1651 | static int msg_do_config(struct usb_configuration *c) |
1652 | { |
1653 | struct fsg_opts *opts; |
1654 | @@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = { |
1655 | |
1656 | static int msg_bind(struct usb_composite_dev *cdev) |
1657 | { |
1658 | - static const struct fsg_operations ops = { |
1659 | - .thread_exits = msg_thread_exits, |
1660 | - }; |
1661 | struct fsg_opts *opts; |
1662 | struct fsg_config config; |
1663 | int status; |
1664 | @@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev) |
1665 | if (status) |
1666 | goto fail; |
1667 | |
1668 | - fsg_common_set_ops(opts->common, &ops); |
1669 | - |
1670 | status = fsg_common_set_cdev(opts->common, cdev, config.can_stall); |
1671 | if (status) |
1672 | goto fail_set_cdev; |
1673 | @@ -210,7 +196,6 @@ static int msg_bind(struct usb_composite_dev *cdev) |
1674 | usb_composite_overwrite_options(cdev, &coverwrite); |
1675 | dev_info(&cdev->gadget->dev, |
1676 | DRIVER_DESC ", version: " DRIVER_VERSION "\n"); |
1677 | - set_bit(0, &msg_registered); |
1678 | return 0; |
1679 | |
1680 | fail_otg_desc: |
1681 | @@ -261,9 +246,8 @@ static int __init msg_init(void) |
1682 | } |
1683 | module_init(msg_init); |
1684 | |
1685 | -static void msg_cleanup(void) |
1686 | +static void __exit msg_cleanup(void) |
1687 | { |
1688 | - if (test_and_clear_bit(0, &msg_registered)) |
1689 | - usb_composite_unregister(&msg_driver); |
1690 | + usb_composite_unregister(&msg_driver); |
1691 | } |
1692 | module_exit(msg_cleanup); |
1693 | diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c |
1694 | index a95b3e75f750..ad8402906f77 100644 |
1695 | --- a/drivers/usb/gadget/udc/atmel_usba_udc.c |
1696 | +++ b/drivers/usb/gadget/udc/atmel_usba_udc.c |
1697 | @@ -28,6 +28,8 @@ |
1698 | #include <linux/of_gpio.h> |
1699 | |
1700 | #include "atmel_usba_udc.h" |
1701 | +#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \ |
1702 | + | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING) |
1703 | |
1704 | #ifdef CONFIG_USB_GADGET_DEBUG_FS |
1705 | #include <linux/debugfs.h> |
1706 | @@ -2172,7 +2174,7 @@ static int usba_udc_probe(struct platform_device *pdev) |
1707 | IRQ_NOAUTOEN); |
1708 | ret = devm_request_threaded_irq(&pdev->dev, |
1709 | gpio_to_irq(udc->vbus_pin), NULL, |
1710 | - usba_vbus_irq_thread, IRQF_ONESHOT, |
1711 | + usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS, |
1712 | "atmel_usba_udc", udc); |
1713 | if (ret) { |
1714 | udc->vbus_pin = -ENODEV; |
1715 | diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c |
1716 | index 94c8a9f6cbf1..fb17fb23fa9a 100644 |
1717 | --- a/drivers/usb/gadget/udc/dummy_hcd.c |
1718 | +++ b/drivers/usb/gadget/udc/dummy_hcd.c |
1719 | @@ -237,6 +237,8 @@ struct dummy_hcd { |
1720 | |
1721 | struct usb_device *udev; |
1722 | struct list_head urbp_list; |
1723 | + struct urbp *next_frame_urbp; |
1724 | + |
1725 | u32 stream_en_ep; |
1726 | u8 num_stream[30 / 2]; |
1727 | |
1728 | @@ -253,11 +255,13 @@ struct dummy { |
1729 | */ |
1730 | struct dummy_ep ep[DUMMY_ENDPOINTS]; |
1731 | int address; |
1732 | + int callback_usage; |
1733 | struct usb_gadget gadget; |
1734 | struct usb_gadget_driver *driver; |
1735 | struct dummy_request fifo_req; |
1736 | u8 fifo_buf[FIFO_SIZE]; |
1737 | u16 devstatus; |
1738 | + unsigned ints_enabled:1; |
1739 | unsigned udc_suspended:1; |
1740 | unsigned pullup:1; |
1741 | |
1742 | @@ -440,18 +444,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd) |
1743 | (~dum_hcd->old_status) & dum_hcd->port_status; |
1744 | |
1745 | /* Report reset and disconnect events to the driver */ |
1746 | - if (dum->driver && (disconnect || reset)) { |
1747 | + if (dum->ints_enabled && (disconnect || reset)) { |
1748 | stop_activity(dum); |
1749 | + ++dum->callback_usage; |
1750 | + spin_unlock(&dum->lock); |
1751 | if (reset) |
1752 | usb_gadget_udc_reset(&dum->gadget, dum->driver); |
1753 | else |
1754 | dum->driver->disconnect(&dum->gadget); |
1755 | + spin_lock(&dum->lock); |
1756 | + --dum->callback_usage; |
1757 | } |
1758 | - } else if (dum_hcd->active != dum_hcd->old_active) { |
1759 | + } else if (dum_hcd->active != dum_hcd->old_active && |
1760 | + dum->ints_enabled) { |
1761 | + ++dum->callback_usage; |
1762 | + spin_unlock(&dum->lock); |
1763 | if (dum_hcd->old_active && dum->driver->suspend) |
1764 | dum->driver->suspend(&dum->gadget); |
1765 | else if (!dum_hcd->old_active && dum->driver->resume) |
1766 | dum->driver->resume(&dum->gadget); |
1767 | + spin_lock(&dum->lock); |
1768 | + --dum->callback_usage; |
1769 | } |
1770 | |
1771 | dum_hcd->old_status = dum_hcd->port_status; |
1772 | @@ -965,8 +978,11 @@ static int dummy_udc_start(struct usb_gadget *g, |
1773 | * can't enumerate without help from the driver we're binding. |
1774 | */ |
1775 | |
1776 | + spin_lock_irq(&dum->lock); |
1777 | dum->devstatus = 0; |
1778 | dum->driver = driver; |
1779 | + dum->ints_enabled = 1; |
1780 | + spin_unlock_irq(&dum->lock); |
1781 | |
1782 | return 0; |
1783 | } |
1784 | @@ -977,6 +993,16 @@ static int dummy_udc_stop(struct usb_gadget *g) |
1785 | struct dummy *dum = dum_hcd->dum; |
1786 | |
1787 | spin_lock_irq(&dum->lock); |
1788 | + dum->ints_enabled = 0; |
1789 | + stop_activity(dum); |
1790 | + |
1791 | + /* emulate synchronize_irq(): wait for callbacks to finish */ |
1792 | + while (dum->callback_usage > 0) { |
1793 | + spin_unlock_irq(&dum->lock); |
1794 | + usleep_range(1000, 2000); |
1795 | + spin_lock_irq(&dum->lock); |
1796 | + } |
1797 | + |
1798 | dum->driver = NULL; |
1799 | spin_unlock_irq(&dum->lock); |
1800 | |
1801 | @@ -1030,7 +1056,12 @@ static int dummy_udc_probe(struct platform_device *pdev) |
1802 | memzero_explicit(&dum->gadget, sizeof(struct usb_gadget)); |
1803 | dum->gadget.name = gadget_name; |
1804 | dum->gadget.ops = &dummy_ops; |
1805 | - dum->gadget.max_speed = USB_SPEED_SUPER; |
1806 | + if (mod_data.is_super_speed) |
1807 | + dum->gadget.max_speed = USB_SPEED_SUPER; |
1808 | + else if (mod_data.is_high_speed) |
1809 | + dum->gadget.max_speed = USB_SPEED_HIGH; |
1810 | + else |
1811 | + dum->gadget.max_speed = USB_SPEED_FULL; |
1812 | |
1813 | dum->gadget.dev.parent = &pdev->dev; |
1814 | init_dummy_udc_hw(dum); |
1815 | @@ -1239,6 +1270,8 @@ static int dummy_urb_enqueue( |
1816 | |
1817 | list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list); |
1818 | urb->hcpriv = urbp; |
1819 | + if (!dum_hcd->next_frame_urbp) |
1820 | + dum_hcd->next_frame_urbp = urbp; |
1821 | if (usb_pipetype(urb->pipe) == PIPE_CONTROL) |
1822 | urb->error_count = 1; /* mark as a new urb */ |
1823 | |
1824 | @@ -1515,6 +1548,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address) |
1825 | if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ? |
1826 | dum->ss_hcd : dum->hs_hcd))) |
1827 | return NULL; |
1828 | + if (!dum->ints_enabled) |
1829 | + return NULL; |
1830 | if ((address & ~USB_DIR_IN) == 0) |
1831 | return &dum->ep[0]; |
1832 | for (i = 1; i < DUMMY_ENDPOINTS; i++) { |
1833 | @@ -1756,6 +1791,7 @@ static void dummy_timer(unsigned long _dum_hcd) |
1834 | spin_unlock_irqrestore(&dum->lock, flags); |
1835 | return; |
1836 | } |
1837 | + dum_hcd->next_frame_urbp = NULL; |
1838 | |
1839 | for (i = 0; i < DUMMY_ENDPOINTS; i++) { |
1840 | if (!ep_info[i].name) |
1841 | @@ -1772,6 +1808,10 @@ static void dummy_timer(unsigned long _dum_hcd) |
1842 | int type; |
1843 | int status = -EINPROGRESS; |
1844 | |
1845 | + /* stop when we reach URBs queued after the timer interrupt */ |
1846 | + if (urbp == dum_hcd->next_frame_urbp) |
1847 | + break; |
1848 | + |
1849 | urb = urbp->urb; |
1850 | if (urb->unlinked) |
1851 | goto return_urb; |
1852 | @@ -1851,10 +1891,12 @@ static void dummy_timer(unsigned long _dum_hcd) |
1853 | * until setup() returns; no reentrancy issues etc. |
1854 | */ |
1855 | if (value > 0) { |
1856 | + ++dum->callback_usage; |
1857 | spin_unlock(&dum->lock); |
1858 | value = dum->driver->setup(&dum->gadget, |
1859 | &setup); |
1860 | spin_lock(&dum->lock); |
1861 | + --dum->callback_usage; |
1862 | |
1863 | if (value >= 0) { |
1864 | /* no delays (max 64KB data stage) */ |
1865 | @@ -2559,8 +2601,6 @@ static struct hc_driver dummy_hcd = { |
1866 | .product_desc = "Dummy host controller", |
1867 | .hcd_priv_size = sizeof(struct dummy_hcd), |
1868 | |
1869 | - .flags = HCD_USB3 | HCD_SHARED, |
1870 | - |
1871 | .reset = dummy_setup, |
1872 | .start = dummy_start, |
1873 | .stop = dummy_stop, |
1874 | @@ -2589,8 +2629,12 @@ static int dummy_hcd_probe(struct platform_device *pdev) |
1875 | dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc); |
1876 | dum = *((void **)dev_get_platdata(&pdev->dev)); |
1877 | |
1878 | - if (!mod_data.is_super_speed) |
1879 | + if (mod_data.is_super_speed) |
1880 | + dummy_hcd.flags = HCD_USB3 | HCD_SHARED; |
1881 | + else if (mod_data.is_high_speed) |
1882 | dummy_hcd.flags = HCD_USB2; |
1883 | + else |
1884 | + dummy_hcd.flags = HCD_USB11; |
1885 | hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev)); |
1886 | if (!hs_hcd) |
1887 | return -ENOMEM; |
1888 | diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c |
1889 | index d2cfefadca3c..bb89e24c48b4 100644 |
1890 | --- a/drivers/usb/gadget/udc/renesas_usb3.c |
1891 | +++ b/drivers/usb/gadget/udc/renesas_usb3.c |
1892 | @@ -879,7 +879,7 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep, |
1893 | usb3_ep->ep.maxpacket); |
1894 | u8 *buf = usb3_req->req.buf + usb3_req->req.actual; |
1895 | u32 tmp = 0; |
1896 | - bool is_last; |
1897 | + bool is_last = !len ? true : false; |
1898 | |
1899 | if (usb3_wait_pipe_status(usb3_ep, PX_STA_BUFSTS) < 0) |
1900 | return -EBUSY; |
1901 | @@ -900,7 +900,8 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep, |
1902 | usb3_write(usb3, tmp, fifo_reg); |
1903 | } |
1904 | |
1905 | - is_last = usb3_is_transfer_complete(usb3_ep, usb3_req); |
1906 | + if (!is_last) |
1907 | + is_last = usb3_is_transfer_complete(usb3_ep, usb3_req); |
1908 | /* Send the data */ |
1909 | usb3_set_px_con_send(usb3_ep, len, is_last); |
1910 | |
1911 | @@ -991,7 +992,8 @@ static void usb3_start_pipe0(struct renesas_usb3_ep *usb3_ep, |
1912 | usb3_set_p0_con_for_ctrl_read_data(usb3); |
1913 | } else { |
1914 | usb3_clear_bit(usb3, P0_MOD_DIR, USB3_P0_MOD); |
1915 | - usb3_set_p0_con_for_ctrl_write_data(usb3); |
1916 | + if (usb3_req->req.length) |
1917 | + usb3_set_p0_con_for_ctrl_write_data(usb3); |
1918 | } |
1919 | |
1920 | usb3_p0_xfer(usb3_ep, usb3_req); |
1921 | @@ -1568,7 +1570,16 @@ static u32 usb3_calc_ramarea(int ram_size) |
1922 | static u32 usb3_calc_rammap_val(struct renesas_usb3_ep *usb3_ep, |
1923 | const struct usb_endpoint_descriptor *desc) |
1924 | { |
1925 | - return usb3_ep->rammap_val | PN_RAMMAP_MPKT(usb_endpoint_maxp(desc)); |
1926 | + int i; |
1927 | + const u32 max_packet_array[] = {8, 16, 32, 64, 512}; |
1928 | + u32 mpkt = PN_RAMMAP_MPKT(1024); |
1929 | + |
1930 | + for (i = 0; i < ARRAY_SIZE(max_packet_array); i++) { |
1931 | + if (usb_endpoint_maxp(desc) <= max_packet_array[i]) |
1932 | + mpkt = PN_RAMMAP_MPKT(max_packet_array[i]); |
1933 | + } |
1934 | + |
1935 | + return usb3_ep->rammap_val | mpkt; |
1936 | } |
1937 | |
1938 | static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep, |
1939 | diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c |
1940 | index 58b9685eb21f..ee213c5f4107 100644 |
1941 | --- a/drivers/usb/host/pci-quirks.c |
1942 | +++ b/drivers/usb/host/pci-quirks.c |
1943 | @@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(struct pci_dev *pdev) |
1944 | if ((value & ASMT_CONTROL_WRITE_BIT) == 0) |
1945 | return 0; |
1946 | |
1947 | - usleep_range(40, 60); |
1948 | + udelay(50); |
1949 | } |
1950 | |
1951 | dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__); |
1952 | @@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports); |
1953 | * |
1954 | * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS. |
1955 | * It signals to the BIOS that the OS wants control of the host controller, |
1956 | - * and then waits 5 seconds for the BIOS to hand over control. |
1957 | + * and then waits 1 second for the BIOS to hand over control. |
1958 | * If we timeout, assume the BIOS is broken and take control anyway. |
1959 | */ |
1960 | static void quirk_usb_handoff_xhci(struct pci_dev *pdev) |
1961 | @@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) |
1962 | if (val & XHCI_HC_BIOS_OWNED) { |
1963 | writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset); |
1964 | |
1965 | - /* Wait for 5 seconds with 10 microsecond polling interval */ |
1966 | + /* Wait for 1 second with 10 microsecond polling interval */ |
1967 | timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED, |
1968 | - 0, 5000, 10); |
1969 | + 0, 1000000, 10); |
1970 | |
1971 | /* Assume a buggy BIOS and take HC ownership anyway */ |
1972 | if (timeout) { |
1973 | @@ -1100,7 +1100,7 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) |
1974 | * operational or runtime registers. Wait 5 seconds and no more. |
1975 | */ |
1976 | timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0, |
1977 | - 5000, 10); |
1978 | + 5000000, 10); |
1979 | /* Assume a buggy HC and start HC initialization anyway */ |
1980 | if (timeout) { |
1981 | val = readl(op_reg_base + XHCI_STS_OFFSET); |
1982 | diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c |
1983 | index 36b7789f8f22..4a02c5c7df0d 100644 |
1984 | --- a/drivers/usb/host/xhci-hub.c |
1985 | +++ b/drivers/usb/host/xhci-hub.c |
1986 | @@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, |
1987 | |
1988 | /* If PSI table exists, add the custom speed attributes from it */ |
1989 | if (usb3_1 && xhci->usb3_rhub.psi_count) { |
1990 | - u32 ssp_cap_base, bm_attrib, psi; |
1991 | + u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp; |
1992 | int offset; |
1993 | |
1994 | ssp_cap_base = USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE; |
1995 | @@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, |
1996 | for (i = 0; i < xhci->usb3_rhub.psi_count; i++) { |
1997 | psi = xhci->usb3_rhub.psi[i]; |
1998 | psi &= ~USB_SSP_SUBLINK_SPEED_RSVD; |
1999 | + psi_exp = XHCI_EXT_PORT_PSIE(psi); |
2000 | + psi_mant = XHCI_EXT_PORT_PSIM(psi); |
2001 | + |
2002 | + /* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */ |
2003 | + for (; psi_exp < 3; psi_exp++) |
2004 | + psi_mant /= 1000; |
2005 | + if (psi_mant >= 10) |
2006 | + psi |= BIT(14); |
2007 | + |
2008 | if ((psi & PLT_MASK) == PLT_SYM) { |
2009 | /* Symmetric, create SSA RX and TX from one PSI entry */ |
2010 | put_unaligned_le32(psi, &buf[offset]); |
2011 | @@ -1351,9 +1360,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd) |
2012 | t2 |= PORT_WKOC_E | PORT_WKCONN_E; |
2013 | t2 &= ~PORT_WKDISC_E; |
2014 | } |
2015 | - if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) && |
2016 | - (hcd->speed < HCD_USB3)) |
2017 | - t2 &= ~PORT_WAKE_BITS; |
2018 | } else |
2019 | t2 &= ~PORT_WAKE_BITS; |
2020 | |
2021 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c |
2022 | index 23833448e602..c87ef38e7416 100644 |
2023 | --- a/drivers/usb/host/xhci-pci.c |
2024 | +++ b/drivers/usb/host/xhci-pci.c |
2025 | @@ -54,11 +54,6 @@ |
2026 | #define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 |
2027 | #define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0 |
2028 | |
2029 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 |
2030 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba |
2031 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb |
2032 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc |
2033 | - |
2034 | #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 |
2035 | |
2036 | static const char hcd_name[] = "xhci_hcd"; |
2037 | @@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
2038 | if (pdev->vendor == PCI_VENDOR_ID_AMD) |
2039 | xhci->quirks |= XHCI_TRUST_TX_LENGTH; |
2040 | |
2041 | - if ((pdev->vendor == PCI_VENDOR_ID_AMD) && |
2042 | - ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) || |
2043 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) || |
2044 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) || |
2045 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1))) |
2046 | - xhci->quirks |= XHCI_U2_DISABLE_WAKE; |
2047 | - |
2048 | if (pdev->vendor == PCI_VENDOR_ID_INTEL) { |
2049 | xhci->quirks |= XHCI_LPM_SUPPORT; |
2050 | xhci->quirks |= XHCI_INTEL_HOST; |
2051 | diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h |
2052 | index a0f4a9feb058..836398ade58d 100644 |
2053 | --- a/drivers/usb/host/xhci.h |
2054 | +++ b/drivers/usb/host/xhci.h |
2055 | @@ -1509,7 +1509,7 @@ struct xhci_bus_state { |
2056 | |
2057 | static inline unsigned int hcd_index(struct usb_hcd *hcd) |
2058 | { |
2059 | - if (hcd->speed == HCD_USB3) |
2060 | + if (hcd->speed >= HCD_USB3) |
2061 | return 0; |
2062 | else |
2063 | return 1; |
2064 | @@ -1660,7 +1660,7 @@ struct xhci_hcd { |
2065 | /* For controller with a broken Port Disable implementation */ |
2066 | #define XHCI_BROKEN_PORT_PED (1 << 25) |
2067 | #define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26) |
2068 | -#define XHCI_U2_DISABLE_WAKE (1 << 27) |
2069 | +/* Reserved. It was XHCI_U2_DISABLE_WAKE */ |
2070 | #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28) |
2071 | |
2072 | unsigned int num_active_eps; |
2073 | diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c |
2074 | index 857e78337324..8897195396b2 100644 |
2075 | --- a/drivers/usb/renesas_usbhs/fifo.c |
2076 | +++ b/drivers/usb/renesas_usbhs/fifo.c |
2077 | @@ -285,11 +285,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe, |
2078 | struct usbhs_fifo *fifo) |
2079 | { |
2080 | struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); |
2081 | + int ret = 0; |
2082 | |
2083 | - if (!usbhs_pipe_is_dcp(pipe)) |
2084 | - usbhsf_fifo_barrier(priv, fifo); |
2085 | + if (!usbhs_pipe_is_dcp(pipe)) { |
2086 | + /* |
2087 | + * This driver checks the pipe condition first to avoid -EBUSY |
2088 | + * from usbhsf_fifo_barrier() with about 10 msec delay in |
2089 | + * the interrupt handler if the pipe is RX direction and empty. |
2090 | + */ |
2091 | + if (usbhs_pipe_is_dir_in(pipe)) |
2092 | + ret = usbhs_pipe_is_accessible(pipe); |
2093 | + if (!ret) |
2094 | + ret = usbhsf_fifo_barrier(priv, fifo); |
2095 | + } |
2096 | |
2097 | - usbhs_write(priv, fifo->ctr, BCLR); |
2098 | + /* |
2099 | + * if non-DCP pipe, this driver should set BCLR when |
2100 | + * usbhsf_fifo_barrier() returns 0. |
2101 | + */ |
2102 | + if (!ret) |
2103 | + usbhs_write(priv, fifo->ctr, BCLR); |
2104 | } |
2105 | |
2106 | static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv, |
2107 | diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c |
2108 | index 1a59f335b063..a3ccb899df60 100644 |
2109 | --- a/drivers/usb/storage/transport.c |
2110 | +++ b/drivers/usb/storage/transport.c |
2111 | @@ -834,13 +834,25 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us) |
2112 | if (result == USB_STOR_TRANSPORT_GOOD) { |
2113 | srb->result = SAM_STAT_GOOD; |
2114 | srb->sense_buffer[0] = 0x0; |
2115 | + } |
2116 | + |
2117 | + /* |
2118 | + * ATA-passthru commands use sense data to report |
2119 | + * the command completion status, and often devices |
2120 | + * return Check Condition status when nothing is |
2121 | + * wrong. |
2122 | + */ |
2123 | + else if (srb->cmnd[0] == ATA_16 || |
2124 | + srb->cmnd[0] == ATA_12) { |
2125 | + /* leave the data alone */ |
2126 | + } |
2127 | |
2128 | /* |
2129 | * If there was a problem, report an unspecified |
2130 | * hardware error to prevent the higher layers from |
2131 | * entering an infinite retry loop. |
2132 | */ |
2133 | - } else { |
2134 | + else { |
2135 | srb->result = DID_ERROR << 16; |
2136 | if ((sshdr.response_code & 0x72) == 0x72) |
2137 | srb->sense_buffer[1] = HARDWARE_ERROR; |
2138 | diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h |
2139 | index f58caa9e6a27..a155cd02bce2 100644 |
2140 | --- a/drivers/usb/storage/uas-detect.h |
2141 | +++ b/drivers/usb/storage/uas-detect.h |
2142 | @@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf) |
2143 | intf->desc.bInterfaceProtocol == USB_PR_UAS); |
2144 | } |
2145 | |
2146 | -static int uas_find_uas_alt_setting(struct usb_interface *intf) |
2147 | +static struct usb_host_interface *uas_find_uas_alt_setting( |
2148 | + struct usb_interface *intf) |
2149 | { |
2150 | int i; |
2151 | |
2152 | @@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf) |
2153 | struct usb_host_interface *alt = &intf->altsetting[i]; |
2154 | |
2155 | if (uas_is_interface(alt)) |
2156 | - return alt->desc.bAlternateSetting; |
2157 | + return alt; |
2158 | } |
2159 | |
2160 | - return -ENODEV; |
2161 | + return NULL; |
2162 | } |
2163 | |
2164 | static int uas_find_endpoints(struct usb_host_interface *alt, |
2165 | @@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf, |
2166 | struct usb_device *udev = interface_to_usbdev(intf); |
2167 | struct usb_hcd *hcd = bus_to_hcd(udev->bus); |
2168 | unsigned long flags = id->driver_info; |
2169 | - int r, alt; |
2170 | - |
2171 | + struct usb_host_interface *alt; |
2172 | + int r; |
2173 | |
2174 | alt = uas_find_uas_alt_setting(intf); |
2175 | - if (alt < 0) |
2176 | + if (!alt) |
2177 | return 0; |
2178 | |
2179 | - r = uas_find_endpoints(&intf->altsetting[alt], eps); |
2180 | + r = uas_find_endpoints(alt, eps); |
2181 | if (r < 0) |
2182 | return 0; |
2183 | |
2184 | diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c |
2185 | index 5ef014ba6ae8..9876af4ab64e 100644 |
2186 | --- a/drivers/usb/storage/uas.c |
2187 | +++ b/drivers/usb/storage/uas.c |
2188 | @@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids); |
2189 | static int uas_switch_interface(struct usb_device *udev, |
2190 | struct usb_interface *intf) |
2191 | { |
2192 | - int alt; |
2193 | + struct usb_host_interface *alt; |
2194 | |
2195 | alt = uas_find_uas_alt_setting(intf); |
2196 | - if (alt < 0) |
2197 | - return alt; |
2198 | + if (!alt) |
2199 | + return -ENODEV; |
2200 | |
2201 | - return usb_set_interface(udev, |
2202 | - intf->altsetting[0].desc.bInterfaceNumber, alt); |
2203 | + return usb_set_interface(udev, alt->desc.bInterfaceNumber, |
2204 | + alt->desc.bAlternateSetting); |
2205 | } |
2206 | |
2207 | static int uas_configure_endpoints(struct uas_dev_info *devinfo) |
2208 | diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h |
2209 | index 9129f6cb8230..2572fd5cd2bb 100644 |
2210 | --- a/drivers/usb/storage/unusual_devs.h |
2211 | +++ b/drivers/usb/storage/unusual_devs.h |
2212 | @@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000, |
2213 | USB_SC_DEVICE, USB_PR_DEVICE, NULL, |
2214 | US_FL_SANE_SENSE ), |
2215 | |
2216 | +/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */ |
2217 | +UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999, |
2218 | + "Seagate", |
2219 | + "External", |
2220 | + USB_SC_DEVICE, USB_PR_DEVICE, NULL, |
2221 | + US_FL_NO_WP_DETECT ), |
2222 | + |
2223 | UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, |
2224 | "Maxtor", |
2225 | "USB to SATA", |
2226 | diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c |
2227 | index 35a1e777b449..9a53912bdfe9 100644 |
2228 | --- a/drivers/uwb/hwa-rc.c |
2229 | +++ b/drivers/uwb/hwa-rc.c |
2230 | @@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interface *iface, |
2231 | |
2232 | if (iface->cur_altsetting->desc.bNumEndpoints < 1) |
2233 | return -ENODEV; |
2234 | + if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc)) |
2235 | + return -ENODEV; |
2236 | |
2237 | result = -ENOMEM; |
2238 | uwb_rc = uwb_rc_alloc(); |
2239 | diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c |
2240 | index 01c20a260a8b..39dd4ef53c77 100644 |
2241 | --- a/drivers/uwb/uwbd.c |
2242 | +++ b/drivers/uwb/uwbd.c |
2243 | @@ -302,18 +302,22 @@ static int uwbd(void *param) |
2244 | /** Start the UWB daemon */ |
2245 | void uwbd_start(struct uwb_rc *rc) |
2246 | { |
2247 | - rc->uwbd.task = kthread_run(uwbd, rc, "uwbd"); |
2248 | - if (rc->uwbd.task == NULL) |
2249 | + struct task_struct *task = kthread_run(uwbd, rc, "uwbd"); |
2250 | + if (IS_ERR(task)) { |
2251 | + rc->uwbd.task = NULL; |
2252 | printk(KERN_ERR "UWB: Cannot start management daemon; " |
2253 | "UWB won't work\n"); |
2254 | - else |
2255 | + } else { |
2256 | + rc->uwbd.task = task; |
2257 | rc->uwbd.pid = rc->uwbd.task->pid; |
2258 | + } |
2259 | } |
2260 | |
2261 | /* Stop the UWB daemon and free any unprocessed events */ |
2262 | void uwbd_stop(struct uwb_rc *rc) |
2263 | { |
2264 | - kthread_stop(rc->uwbd.task); |
2265 | + if (rc->uwbd.task) |
2266 | + kthread_stop(rc->uwbd.task); |
2267 | uwbd_flush(rc); |
2268 | } |
2269 | |
2270 | diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c |
2271 | index dfa519979038..dfd01ca1a60a 100644 |
2272 | --- a/fs/ext4/acl.c |
2273 | +++ b/fs/ext4/acl.c |
2274 | @@ -192,13 +192,6 @@ __ext4_set_acl(handle_t *handle, struct inode *inode, int type, |
2275 | switch (type) { |
2276 | case ACL_TYPE_ACCESS: |
2277 | name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS; |
2278 | - if (acl) { |
2279 | - error = posix_acl_update_mode(inode, &inode->i_mode, &acl); |
2280 | - if (error) |
2281 | - return error; |
2282 | - inode->i_ctime = ext4_current_time(inode); |
2283 | - ext4_mark_inode_dirty(handle, inode); |
2284 | - } |
2285 | break; |
2286 | |
2287 | case ACL_TYPE_DEFAULT: |
2288 | @@ -231,6 +224,8 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type) |
2289 | { |
2290 | handle_t *handle; |
2291 | int error, retries = 0; |
2292 | + umode_t mode = inode->i_mode; |
2293 | + int update_mode = 0; |
2294 | |
2295 | retry: |
2296 | handle = ext4_journal_start(inode, EXT4_HT_XATTR, |
2297 | @@ -238,7 +233,20 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type) |
2298 | if (IS_ERR(handle)) |
2299 | return PTR_ERR(handle); |
2300 | |
2301 | + if ((type == ACL_TYPE_ACCESS) && acl) { |
2302 | + error = posix_acl_update_mode(inode, &mode, &acl); |
2303 | + if (error) |
2304 | + goto out_stop; |
2305 | + update_mode = 1; |
2306 | + } |
2307 | + |
2308 | error = __ext4_set_acl(handle, inode, type, acl); |
2309 | + if (!error && update_mode) { |
2310 | + inode->i_mode = mode; |
2311 | + inode->i_ctime = ext4_current_time(inode); |
2312 | + ext4_mark_inode_dirty(handle, inode); |
2313 | + } |
2314 | +out_stop: |
2315 | ext4_journal_stop(handle); |
2316 | if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries)) |
2317 | goto retry; |
2318 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c |
2319 | index 1b29efcab3dc..ec28e8ebb984 100644 |
2320 | --- a/fs/ext4/inode.c |
2321 | +++ b/fs/ext4/inode.c |
2322 | @@ -2107,15 +2107,29 @@ static int ext4_writepage(struct page *page, |
2323 | static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page) |
2324 | { |
2325 | int len; |
2326 | - loff_t size = i_size_read(mpd->inode); |
2327 | + loff_t size; |
2328 | int err; |
2329 | |
2330 | BUG_ON(page->index != mpd->first_page); |
2331 | + clear_page_dirty_for_io(page); |
2332 | + /* |
2333 | + * We have to be very careful here! Nothing protects writeback path |
2334 | + * against i_size changes and the page can be writeably mapped into |
2335 | + * page tables. So an application can be growing i_size and writing |
2336 | + * data through mmap while writeback runs. clear_page_dirty_for_io() |
2337 | + * write-protects our page in page tables and the page cannot get |
2338 | + * written to again until we release page lock. So only after |
2339 | + * clear_page_dirty_for_io() we are safe to sample i_size for |
2340 | + * ext4_bio_write_page() to zero-out tail of the written page. We rely |
2341 | + * on the barrier provided by TestClearPageDirty in |
2342 | + * clear_page_dirty_for_io() to make sure i_size is really sampled only |
2343 | + * after page tables are updated. |
2344 | + */ |
2345 | + size = i_size_read(mpd->inode); |
2346 | if (page->index == size >> PAGE_SHIFT) |
2347 | len = size & ~PAGE_MASK; |
2348 | else |
2349 | len = PAGE_SIZE; |
2350 | - clear_page_dirty_for_io(page); |
2351 | err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false); |
2352 | if (!err) |
2353 | mpd->wbc->nr_to_write--; |
2354 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c |
2355 | index 423a21cd077c..00b8a5a66961 100644 |
2356 | --- a/fs/ext4/namei.c |
2357 | +++ b/fs/ext4/namei.c |
2358 | @@ -3527,6 +3527,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, |
2359 | EXT4_I(old_dentry->d_inode)->i_projid))) |
2360 | return -EXDEV; |
2361 | |
2362 | + if ((ext4_encrypted_inode(old_dir) && |
2363 | + !fscrypt_has_encryption_key(old_dir)) || |
2364 | + (ext4_encrypted_inode(new_dir) && |
2365 | + !fscrypt_has_encryption_key(new_dir))) |
2366 | + return -ENOKEY; |
2367 | + |
2368 | retval = dquot_initialize(old.dir); |
2369 | if (retval) |
2370 | return retval; |
2371 | @@ -3726,6 +3732,12 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry, |
2372 | u8 new_file_type; |
2373 | int retval; |
2374 | |
2375 | + if ((ext4_encrypted_inode(old_dir) && |
2376 | + !fscrypt_has_encryption_key(old_dir)) || |
2377 | + (ext4_encrypted_inode(new_dir) && |
2378 | + !fscrypt_has_encryption_key(new_dir))) |
2379 | + return -ENOKEY; |
2380 | + |
2381 | if ((ext4_encrypted_inode(old_dir) || |
2382 | ext4_encrypted_inode(new_dir)) && |
2383 | (old_dir != new_dir) && |
2384 | diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c |
2385 | index 489fa0d5f914..08d7dc99042e 100644 |
2386 | --- a/fs/f2fs/namei.c |
2387 | +++ b/fs/f2fs/namei.c |
2388 | @@ -663,6 +663,12 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, |
2389 | bool is_old_inline = f2fs_has_inline_dentry(old_dir); |
2390 | int err = -ENOENT; |
2391 | |
2392 | + if ((f2fs_encrypted_inode(old_dir) && |
2393 | + !fscrypt_has_encryption_key(old_dir)) || |
2394 | + (f2fs_encrypted_inode(new_dir) && |
2395 | + !fscrypt_has_encryption_key(new_dir))) |
2396 | + return -ENOKEY; |
2397 | + |
2398 | if ((old_dir != new_dir) && f2fs_encrypted_inode(new_dir) && |
2399 | !fscrypt_has_permitted_context(new_dir, old_inode)) { |
2400 | err = -EPERM; |
2401 | @@ -843,6 +849,12 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, |
2402 | int old_nlink = 0, new_nlink = 0; |
2403 | int err = -ENOENT; |
2404 | |
2405 | + if ((f2fs_encrypted_inode(old_dir) && |
2406 | + !fscrypt_has_encryption_key(old_dir)) || |
2407 | + (f2fs_encrypted_inode(new_dir) && |
2408 | + !fscrypt_has_encryption_key(new_dir))) |
2409 | + return -ENOKEY; |
2410 | + |
2411 | if ((f2fs_encrypted_inode(old_dir) || f2fs_encrypted_inode(new_dir)) && |
2412 | (old_dir != new_dir) && |
2413 | (!fscrypt_has_permitted_context(new_dir, old_inode) || |
2414 | diff --git a/fs/read_write.c b/fs/read_write.c |
2415 | index 09a8757efd34..ba280596ec78 100644 |
2416 | --- a/fs/read_write.c |
2417 | +++ b/fs/read_write.c |
2418 | @@ -1518,6 +1518,11 @@ ssize_t vfs_copy_file_range(struct file *file_in, loff_t pos_in, |
2419 | if (flags != 0) |
2420 | return -EINVAL; |
2421 | |
2422 | + if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode)) |
2423 | + return -EISDIR; |
2424 | + if (!S_ISREG(inode_in->i_mode) || !S_ISREG(inode_out->i_mode)) |
2425 | + return -EINVAL; |
2426 | + |
2427 | ret = rw_verify_area(READ, file_in, &pos_in, len); |
2428 | if (unlikely(ret)) |
2429 | return ret; |
2430 | diff --git a/fs/xattr.c b/fs/xattr.c |
2431 | index ed8c374570ed..932b9061a3a2 100644 |
2432 | --- a/fs/xattr.c |
2433 | +++ b/fs/xattr.c |
2434 | @@ -249,7 +249,7 @@ xattr_getsecurity(struct inode *inode, const char *name, void *value, |
2435 | } |
2436 | memcpy(value, buffer, len); |
2437 | out: |
2438 | - security_release_secctx(buffer, len); |
2439 | + kfree(buffer); |
2440 | out_noalloc: |
2441 | return len; |
2442 | } |
2443 | diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h |
2444 | index 0504ef8f3aa3..976f8ac26665 100644 |
2445 | --- a/include/asm-generic/percpu.h |
2446 | +++ b/include/asm-generic/percpu.h |
2447 | @@ -115,15 +115,35 @@ do { \ |
2448 | (__ret); \ |
2449 | }) |
2450 | |
2451 | -#define this_cpu_generic_read(pcp) \ |
2452 | +#define __this_cpu_generic_read_nopreempt(pcp) \ |
2453 | ({ \ |
2454 | typeof(pcp) __ret; \ |
2455 | preempt_disable_notrace(); \ |
2456 | - __ret = raw_cpu_generic_read(pcp); \ |
2457 | + __ret = READ_ONCE(*raw_cpu_ptr(&(pcp))); \ |
2458 | preempt_enable_notrace(); \ |
2459 | __ret; \ |
2460 | }) |
2461 | |
2462 | +#define __this_cpu_generic_read_noirq(pcp) \ |
2463 | +({ \ |
2464 | + typeof(pcp) __ret; \ |
2465 | + unsigned long __flags; \ |
2466 | + raw_local_irq_save(__flags); \ |
2467 | + __ret = raw_cpu_generic_read(pcp); \ |
2468 | + raw_local_irq_restore(__flags); \ |
2469 | + __ret; \ |
2470 | +}) |
2471 | + |
2472 | +#define this_cpu_generic_read(pcp) \ |
2473 | +({ \ |
2474 | + typeof(pcp) __ret; \ |
2475 | + if (__native_word(pcp)) \ |
2476 | + __ret = __this_cpu_generic_read_nopreempt(pcp); \ |
2477 | + else \ |
2478 | + __ret = __this_cpu_generic_read_noirq(pcp); \ |
2479 | + __ret; \ |
2480 | +}) |
2481 | + |
2482 | #define this_cpu_generic_to_op(pcp, val, op) \ |
2483 | do { \ |
2484 | unsigned long __flags; \ |
2485 | diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h |
2486 | index cd32a49ae81e..d807fa9b2051 100644 |
2487 | --- a/include/linux/cpuset.h |
2488 | +++ b/include/linux/cpuset.h |
2489 | @@ -55,7 +55,9 @@ static inline void cpuset_dec(void) |
2490 | |
2491 | extern int cpuset_init(void); |
2492 | extern void cpuset_init_smp(void); |
2493 | +extern void cpuset_force_rebuild(void); |
2494 | extern void cpuset_update_active_cpus(bool cpu_online); |
2495 | +extern void cpuset_wait_for_hotplug(void); |
2496 | extern void cpuset_cpus_allowed(struct task_struct *p, struct cpumask *mask); |
2497 | extern void cpuset_cpus_allowed_fallback(struct task_struct *p); |
2498 | extern nodemask_t cpuset_mems_allowed(struct task_struct *p); |
2499 | @@ -168,11 +170,15 @@ static inline bool cpusets_enabled(void) { return false; } |
2500 | static inline int cpuset_init(void) { return 0; } |
2501 | static inline void cpuset_init_smp(void) {} |
2502 | |
2503 | +static inline void cpuset_force_rebuild(void) { } |
2504 | + |
2505 | static inline void cpuset_update_active_cpus(bool cpu_online) |
2506 | { |
2507 | partition_sched_domains(1, NULL, NULL); |
2508 | } |
2509 | |
2510 | +static inline void cpuset_wait_for_hotplug(void) { } |
2511 | + |
2512 | static inline void cpuset_cpus_allowed(struct task_struct *p, |
2513 | struct cpumask *mask) |
2514 | { |
2515 | diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h |
2516 | index e7fdec4db9da..6cc48ac55fd2 100644 |
2517 | --- a/include/linux/iio/adc/ad_sigma_delta.h |
2518 | +++ b/include/linux/iio/adc/ad_sigma_delta.h |
2519 | @@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, |
2520 | int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, |
2521 | unsigned int size, unsigned int *val); |
2522 | |
2523 | +int ad_sd_reset(struct ad_sigma_delta *sigma_delta, |
2524 | + unsigned int reset_length); |
2525 | + |
2526 | int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev, |
2527 | const struct iio_chan_spec *chan, int *val); |
2528 | int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta, |
2529 | diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h |
2530 | index a1a210d59961..25c0dc31f084 100644 |
2531 | --- a/include/linux/mmu_notifier.h |
2532 | +++ b/include/linux/mmu_notifier.h |
2533 | @@ -419,6 +419,11 @@ extern void mmu_notifier_synchronize(void); |
2534 | |
2535 | #else /* CONFIG_MMU_NOTIFIER */ |
2536 | |
2537 | +static inline int mm_has_notifiers(struct mm_struct *mm) |
2538 | +{ |
2539 | + return 0; |
2540 | +} |
2541 | + |
2542 | static inline void mmu_notifier_release(struct mm_struct *mm) |
2543 | { |
2544 | } |
2545 | diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h |
2546 | index be007610ceb0..ba57266d9e80 100644 |
2547 | --- a/include/linux/trace_events.h |
2548 | +++ b/include/linux/trace_events.h |
2549 | @@ -273,6 +273,7 @@ struct trace_event_call { |
2550 | int perf_refcount; |
2551 | struct hlist_head __percpu *perf_events; |
2552 | struct bpf_prog *prog; |
2553 | + struct perf_event *bpf_prog_owner; |
2554 | |
2555 | int (*perf_perm)(struct trace_event_call *, |
2556 | struct perf_event *); |
2557 | diff --git a/include/net/netlink.h b/include/net/netlink.h |
2558 | index 254a0fc01800..42adccd6739d 100644 |
2559 | --- a/include/net/netlink.h |
2560 | +++ b/include/net/netlink.h |
2561 | @@ -756,7 +756,10 @@ static inline int nla_parse_nested(struct nlattr *tb[], int maxtype, |
2562 | */ |
2563 | static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value) |
2564 | { |
2565 | - return nla_put(skb, attrtype, sizeof(u8), &value); |
2566 | + /* temporary variables to work around GCC PR81715 with asan-stack=1 */ |
2567 | + u8 tmp = value; |
2568 | + |
2569 | + return nla_put(skb, attrtype, sizeof(u8), &tmp); |
2570 | } |
2571 | |
2572 | /** |
2573 | @@ -767,7 +770,9 @@ static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value) |
2574 | */ |
2575 | static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value) |
2576 | { |
2577 | - return nla_put(skb, attrtype, sizeof(u16), &value); |
2578 | + u16 tmp = value; |
2579 | + |
2580 | + return nla_put(skb, attrtype, sizeof(u16), &tmp); |
2581 | } |
2582 | |
2583 | /** |
2584 | @@ -778,7 +783,9 @@ static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value) |
2585 | */ |
2586 | static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value) |
2587 | { |
2588 | - return nla_put(skb, attrtype, sizeof(__be16), &value); |
2589 | + __be16 tmp = value; |
2590 | + |
2591 | + return nla_put(skb, attrtype, sizeof(__be16), &tmp); |
2592 | } |
2593 | |
2594 | /** |
2595 | @@ -789,7 +796,9 @@ static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value) |
2596 | */ |
2597 | static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value) |
2598 | { |
2599 | - return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, value); |
2600 | + __be16 tmp = value; |
2601 | + |
2602 | + return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, tmp); |
2603 | } |
2604 | |
2605 | /** |
2606 | @@ -800,7 +809,9 @@ static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value) |
2607 | */ |
2608 | static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value) |
2609 | { |
2610 | - return nla_put(skb, attrtype, sizeof(__le16), &value); |
2611 | + __le16 tmp = value; |
2612 | + |
2613 | + return nla_put(skb, attrtype, sizeof(__le16), &tmp); |
2614 | } |
2615 | |
2616 | /** |
2617 | @@ -811,7 +822,9 @@ static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value) |
2618 | */ |
2619 | static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value) |
2620 | { |
2621 | - return nla_put(skb, attrtype, sizeof(u32), &value); |
2622 | + u32 tmp = value; |
2623 | + |
2624 | + return nla_put(skb, attrtype, sizeof(u32), &tmp); |
2625 | } |
2626 | |
2627 | /** |
2628 | @@ -822,7 +835,9 @@ static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value) |
2629 | */ |
2630 | static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value) |
2631 | { |
2632 | - return nla_put(skb, attrtype, sizeof(__be32), &value); |
2633 | + __be32 tmp = value; |
2634 | + |
2635 | + return nla_put(skb, attrtype, sizeof(__be32), &tmp); |
2636 | } |
2637 | |
2638 | /** |
2639 | @@ -833,7 +848,9 @@ static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value) |
2640 | */ |
2641 | static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value) |
2642 | { |
2643 | - return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, value); |
2644 | + __be32 tmp = value; |
2645 | + |
2646 | + return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, tmp); |
2647 | } |
2648 | |
2649 | /** |
2650 | @@ -844,7 +861,9 @@ static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value) |
2651 | */ |
2652 | static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value) |
2653 | { |
2654 | - return nla_put(skb, attrtype, sizeof(__le32), &value); |
2655 | + __le32 tmp = value; |
2656 | + |
2657 | + return nla_put(skb, attrtype, sizeof(__le32), &tmp); |
2658 | } |
2659 | |
2660 | /** |
2661 | @@ -857,7 +876,9 @@ static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value) |
2662 | static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype, |
2663 | u64 value, int padattr) |
2664 | { |
2665 | - return nla_put_64bit(skb, attrtype, sizeof(u64), &value, padattr); |
2666 | + u64 tmp = value; |
2667 | + |
2668 | + return nla_put_64bit(skb, attrtype, sizeof(u64), &tmp, padattr); |
2669 | } |
2670 | |
2671 | /** |
2672 | @@ -870,7 +891,9 @@ static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype, |
2673 | static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value, |
2674 | int padattr) |
2675 | { |
2676 | - return nla_put_64bit(skb, attrtype, sizeof(__be64), &value, padattr); |
2677 | + __be64 tmp = value; |
2678 | + |
2679 | + return nla_put_64bit(skb, attrtype, sizeof(__be64), &tmp, padattr); |
2680 | } |
2681 | |
2682 | /** |
2683 | @@ -883,7 +906,9 @@ static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value, |
2684 | static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value, |
2685 | int padattr) |
2686 | { |
2687 | - return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, value, |
2688 | + __be64 tmp = value; |
2689 | + |
2690 | + return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, tmp, |
2691 | padattr); |
2692 | } |
2693 | |
2694 | @@ -897,7 +922,9 @@ static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value, |
2695 | static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value, |
2696 | int padattr) |
2697 | { |
2698 | - return nla_put_64bit(skb, attrtype, sizeof(__le64), &value, padattr); |
2699 | + __le64 tmp = value; |
2700 | + |
2701 | + return nla_put_64bit(skb, attrtype, sizeof(__le64), &tmp, padattr); |
2702 | } |
2703 | |
2704 | /** |
2705 | @@ -908,7 +935,9 @@ static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value, |
2706 | */ |
2707 | static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value) |
2708 | { |
2709 | - return nla_put(skb, attrtype, sizeof(s8), &value); |
2710 | + s8 tmp = value; |
2711 | + |
2712 | + return nla_put(skb, attrtype, sizeof(s8), &tmp); |
2713 | } |
2714 | |
2715 | /** |
2716 | @@ -919,7 +948,9 @@ static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value) |
2717 | */ |
2718 | static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value) |
2719 | { |
2720 | - return nla_put(skb, attrtype, sizeof(s16), &value); |
2721 | + s16 tmp = value; |
2722 | + |
2723 | + return nla_put(skb, attrtype, sizeof(s16), &tmp); |
2724 | } |
2725 | |
2726 | /** |
2727 | @@ -930,7 +961,9 @@ static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value) |
2728 | */ |
2729 | static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value) |
2730 | { |
2731 | - return nla_put(skb, attrtype, sizeof(s32), &value); |
2732 | + s32 tmp = value; |
2733 | + |
2734 | + return nla_put(skb, attrtype, sizeof(s32), &tmp); |
2735 | } |
2736 | |
2737 | /** |
2738 | @@ -943,7 +976,9 @@ static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value) |
2739 | static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value, |
2740 | int padattr) |
2741 | { |
2742 | - return nla_put_64bit(skb, attrtype, sizeof(s64), &value, padattr); |
2743 | + s64 tmp = value; |
2744 | + |
2745 | + return nla_put_64bit(skb, attrtype, sizeof(s64), &tmp, padattr); |
2746 | } |
2747 | |
2748 | /** |
2749 | @@ -993,7 +1028,9 @@ static inline int nla_put_msecs(struct sk_buff *skb, int attrtype, |
2750 | static inline int nla_put_in_addr(struct sk_buff *skb, int attrtype, |
2751 | __be32 addr) |
2752 | { |
2753 | - return nla_put_be32(skb, attrtype, addr); |
2754 | + __be32 tmp = addr; |
2755 | + |
2756 | + return nla_put_be32(skb, attrtype, tmp); |
2757 | } |
2758 | |
2759 | /** |
2760 | diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h |
2761 | index 2c098cd7e7e2..231df4fc8423 100644 |
2762 | --- a/include/net/sctp/ulpevent.h |
2763 | +++ b/include/net/sctp/ulpevent.h |
2764 | @@ -141,8 +141,12 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event); |
2765 | static inline int sctp_ulpevent_type_enabled(__u16 sn_type, |
2766 | struct sctp_event_subscribe *mask) |
2767 | { |
2768 | + int offset = sn_type - SCTP_SN_TYPE_BASE; |
2769 | char *amask = (char *) mask; |
2770 | - return amask[sn_type - SCTP_SN_TYPE_BASE]; |
2771 | + |
2772 | + if (offset >= sizeof(struct sctp_event_subscribe)) |
2773 | + return 0; |
2774 | + return amask[offset]; |
2775 | } |
2776 | |
2777 | /* Given an event subscription, is this event enabled? */ |
2778 | diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h |
2779 | index a8acc24765fe..5e64a86989a5 100644 |
2780 | --- a/include/uapi/linux/usb/ch9.h |
2781 | +++ b/include/uapi/linux/usb/ch9.h |
2782 | @@ -759,6 +759,7 @@ struct usb_interface_assoc_descriptor { |
2783 | __u8 iFunction; |
2784 | } __attribute__ ((packed)); |
2785 | |
2786 | +#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8 |
2787 | |
2788 | /*-------------------------------------------------------------------------*/ |
2789 | |
2790 | diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c |
2791 | index 779c871c5dcd..372454aa7f37 100644 |
2792 | --- a/kernel/bpf/verifier.c |
2793 | +++ b/kernel/bpf/verifier.c |
2794 | @@ -1720,7 +1720,8 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) |
2795 | } |
2796 | } else { |
2797 | if (insn->src_reg != BPF_REG_0 || insn->off != 0 || |
2798 | - (insn->imm != 16 && insn->imm != 32 && insn->imm != 64)) { |
2799 | + (insn->imm != 16 && insn->imm != 32 && insn->imm != 64) || |
2800 | + BPF_CLASS(insn->code) == BPF_ALU64) { |
2801 | verbose("BPF_END uses reserved fields\n"); |
2802 | return -EINVAL; |
2803 | } |
2804 | diff --git a/kernel/cpuset.c b/kernel/cpuset.c |
2805 | index 03a3a6e94eb9..511b1dd8ff09 100644 |
2806 | --- a/kernel/cpuset.c |
2807 | +++ b/kernel/cpuset.c |
2808 | @@ -2276,6 +2276,13 @@ static void cpuset_hotplug_update_tasks(struct cpuset *cs) |
2809 | mutex_unlock(&cpuset_mutex); |
2810 | } |
2811 | |
2812 | +static bool force_rebuild; |
2813 | + |
2814 | +void cpuset_force_rebuild(void) |
2815 | +{ |
2816 | + force_rebuild = true; |
2817 | +} |
2818 | + |
2819 | /** |
2820 | * cpuset_hotplug_workfn - handle CPU/memory hotunplug for a cpuset |
2821 | * |
2822 | @@ -2350,8 +2357,10 @@ static void cpuset_hotplug_workfn(struct work_struct *work) |
2823 | } |
2824 | |
2825 | /* rebuild sched domains if cpus_allowed has changed */ |
2826 | - if (cpus_updated) |
2827 | + if (cpus_updated || force_rebuild) { |
2828 | + force_rebuild = false; |
2829 | rebuild_sched_domains(); |
2830 | + } |
2831 | } |
2832 | |
2833 | void cpuset_update_active_cpus(bool cpu_online) |
2834 | @@ -2370,6 +2379,11 @@ void cpuset_update_active_cpus(bool cpu_online) |
2835 | schedule_work(&cpuset_hotplug_work); |
2836 | } |
2837 | |
2838 | +void cpuset_wait_for_hotplug(void) |
2839 | +{ |
2840 | + flush_work(&cpuset_hotplug_work); |
2841 | +} |
2842 | + |
2843 | /* |
2844 | * Keep top_cpuset.mems_allowed tracking node_states[N_MEMORY]. |
2845 | * Call this routine anytime after node_states[N_MEMORY] changes. |
2846 | diff --git a/kernel/events/core.c b/kernel/events/core.c |
2847 | index c774773ac3a4..36ff2d93f222 100644 |
2848 | --- a/kernel/events/core.c |
2849 | +++ b/kernel/events/core.c |
2850 | @@ -7871,6 +7871,7 @@ static int perf_event_set_bpf_prog(struct perf_event *event, u32 prog_fd) |
2851 | } |
2852 | } |
2853 | event->tp_event->prog = prog; |
2854 | + event->tp_event->bpf_prog_owner = event; |
2855 | |
2856 | return 0; |
2857 | } |
2858 | @@ -7885,7 +7886,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) |
2859 | return; |
2860 | |
2861 | prog = event->tp_event->prog; |
2862 | - if (prog) { |
2863 | + if (prog && event->tp_event->bpf_prog_owner == event) { |
2864 | event->tp_event->prog = NULL; |
2865 | bpf_prog_put(prog); |
2866 | } |
2867 | diff --git a/kernel/power/process.c b/kernel/power/process.c |
2868 | index 2fba066e125f..8ea24ded1dab 100644 |
2869 | --- a/kernel/power/process.c |
2870 | +++ b/kernel/power/process.c |
2871 | @@ -18,8 +18,9 @@ |
2872 | #include <linux/workqueue.h> |
2873 | #include <linux/kmod.h> |
2874 | #include <trace/events/power.h> |
2875 | +#include <linux/cpuset.h> |
2876 | |
2877 | -/* |
2878 | +/* |
2879 | * Timeout for stopping processes |
2880 | */ |
2881 | unsigned int __read_mostly freeze_timeout_msecs = 20 * MSEC_PER_SEC; |
2882 | @@ -200,6 +201,8 @@ void thaw_processes(void) |
2883 | __usermodehelper_set_disable_depth(UMH_FREEZING); |
2884 | thaw_workqueues(); |
2885 | |
2886 | + cpuset_wait_for_hotplug(); |
2887 | + |
2888 | read_lock(&tasklist_lock); |
2889 | for_each_process_thread(g, p) { |
2890 | /* No other threads should have PF_SUSPEND_TASK set */ |
2891 | diff --git a/kernel/sched/core.c b/kernel/sched/core.c |
2892 | index 2098954c690f..d7dda36fbc7b 100644 |
2893 | --- a/kernel/sched/core.c |
2894 | +++ b/kernel/sched/core.c |
2895 | @@ -7292,16 +7292,15 @@ static void cpuset_cpu_active(void) |
2896 | * operation in the resume sequence, just build a single sched |
2897 | * domain, ignoring cpusets. |
2898 | */ |
2899 | - num_cpus_frozen--; |
2900 | - if (likely(num_cpus_frozen)) { |
2901 | - partition_sched_domains(1, NULL, NULL); |
2902 | + partition_sched_domains(1, NULL, NULL); |
2903 | + if (--num_cpus_frozen) |
2904 | return; |
2905 | - } |
2906 | /* |
2907 | * This is the last CPU online operation. So fall through and |
2908 | * restore the original sched domains by considering the |
2909 | * cpuset configurations. |
2910 | */ |
2911 | + cpuset_force_rebuild(); |
2912 | } |
2913 | cpuset_update_active_cpus(true); |
2914 | } |
2915 | diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c |
2916 | index 53ed8ae5de1c..5b8d7189e147 100644 |
2917 | --- a/kernel/trace/ftrace.c |
2918 | +++ b/kernel/trace/ftrace.c |
2919 | @@ -4381,9 +4381,6 @@ static char ftrace_graph_buf[FTRACE_FILTER_SIZE] __initdata; |
2920 | static char ftrace_graph_notrace_buf[FTRACE_FILTER_SIZE] __initdata; |
2921 | static int ftrace_set_func(unsigned long *array, int *idx, int size, char *buffer); |
2922 | |
2923 | -static unsigned long save_global_trampoline; |
2924 | -static unsigned long save_global_flags; |
2925 | - |
2926 | static int __init set_graph_function(char *str) |
2927 | { |
2928 | strlcpy(ftrace_graph_buf, str, FTRACE_FILTER_SIZE); |
2929 | @@ -5981,17 +5978,6 @@ void unregister_ftrace_graph(void) |
2930 | unregister_pm_notifier(&ftrace_suspend_notifier); |
2931 | unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL); |
2932 | |
2933 | -#ifdef CONFIG_DYNAMIC_FTRACE |
2934 | - /* |
2935 | - * Function graph does not allocate the trampoline, but |
2936 | - * other global_ops do. We need to reset the ALLOC_TRAMP flag |
2937 | - * if one was used. |
2938 | - */ |
2939 | - global_ops.trampoline = save_global_trampoline; |
2940 | - if (save_global_flags & FTRACE_OPS_FL_ALLOC_TRAMP) |
2941 | - global_ops.flags |= FTRACE_OPS_FL_ALLOC_TRAMP; |
2942 | -#endif |
2943 | - |
2944 | out: |
2945 | mutex_unlock(&ftrace_lock); |
2946 | } |
2947 | diff --git a/lib/ratelimit.c b/lib/ratelimit.c |
2948 | index 08f8043cac61..d01f47135239 100644 |
2949 | --- a/lib/ratelimit.c |
2950 | +++ b/lib/ratelimit.c |
2951 | @@ -48,7 +48,9 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func) |
2952 | if (time_is_before_jiffies(rs->begin + rs->interval)) { |
2953 | if (rs->missed) { |
2954 | if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) { |
2955 | - pr_warn("%s: %d callbacks suppressed\n", func, rs->missed); |
2956 | + printk_deferred(KERN_WARNING |
2957 | + "%s: %d callbacks suppressed\n", |
2958 | + func, rs->missed); |
2959 | rs->missed = 0; |
2960 | } |
2961 | } |
2962 | diff --git a/mm/oom_kill.c b/mm/oom_kill.c |
2963 | index ec9f11d4f094..d631d251c150 100644 |
2964 | --- a/mm/oom_kill.c |
2965 | +++ b/mm/oom_kill.c |
2966 | @@ -37,6 +37,7 @@ |
2967 | #include <linux/ratelimit.h> |
2968 | #include <linux/kthread.h> |
2969 | #include <linux/init.h> |
2970 | +#include <linux/mmu_notifier.h> |
2971 | |
2972 | #include <asm/tlb.h> |
2973 | #include "internal.h" |
2974 | @@ -490,6 +491,21 @@ static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) |
2975 | goto unlock_oom; |
2976 | } |
2977 | |
2978 | + /* |
2979 | + * If the mm has notifiers then we would need to invalidate them around |
2980 | + * unmap_page_range and that is risky because notifiers can sleep and |
2981 | + * what they do is basically undeterministic. So let's have a short |
2982 | + * sleep to give the oom victim some more time. |
2983 | + * TODO: we really want to get rid of this ugly hack and make sure that |
2984 | + * notifiers cannot block for unbounded amount of time and add |
2985 | + * mmu_notifier_invalidate_range_{start,end} around unmap_page_range |
2986 | + */ |
2987 | + if (mm_has_notifiers(mm)) { |
2988 | + up_read(&mm->mmap_sem); |
2989 | + schedule_timeout_idle(HZ); |
2990 | + goto unlock_oom; |
2991 | + } |
2992 | + |
2993 | /* |
2994 | * increase mm_users only after we know we will reap something so |
2995 | * that the mmput_async is called only when we have reaped something |
2996 | diff --git a/net/core/filter.c b/net/core/filter.c |
2997 | index 4eb4ce0aeef4..bfeedbbde214 100644 |
2998 | --- a/net/core/filter.c |
2999 | +++ b/net/core/filter.c |
3000 | @@ -937,20 +937,31 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp) |
3001 | /* try to charge the socket memory if there is space available |
3002 | * return true on success |
3003 | */ |
3004 | -bool sk_filter_charge(struct sock *sk, struct sk_filter *fp) |
3005 | +static bool __sk_filter_charge(struct sock *sk, struct sk_filter *fp) |
3006 | { |
3007 | u32 filter_size = bpf_prog_size(fp->prog->len); |
3008 | |
3009 | /* same check as in sock_kmalloc() */ |
3010 | if (filter_size <= sysctl_optmem_max && |
3011 | atomic_read(&sk->sk_omem_alloc) + filter_size < sysctl_optmem_max) { |
3012 | - atomic_inc(&fp->refcnt); |
3013 | atomic_add(filter_size, &sk->sk_omem_alloc); |
3014 | return true; |
3015 | } |
3016 | return false; |
3017 | } |
3018 | |
3019 | +bool sk_filter_charge(struct sock *sk, struct sk_filter *fp) |
3020 | +{ |
3021 | + if (!atomic_inc_not_zero(&fp->refcnt)) |
3022 | + return false; |
3023 | + |
3024 | + if (!__sk_filter_charge(sk, fp)) { |
3025 | + sk_filter_release(fp); |
3026 | + return false; |
3027 | + } |
3028 | + return true; |
3029 | +} |
3030 | + |
3031 | static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp) |
3032 | { |
3033 | struct sock_filter *old_prog; |
3034 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
3035 | index 4d2629781e8b..c2339b865164 100644 |
3036 | --- a/net/core/rtnetlink.c |
3037 | +++ b/net/core/rtnetlink.c |
3038 | @@ -3758,6 +3758,9 @@ static int rtnl_fill_statsinfo(struct sk_buff *skb, struct net_device *dev, |
3039 | return -EMSGSIZE; |
3040 | |
3041 | ifsm = nlmsg_data(nlh); |
3042 | + ifsm->family = PF_UNSPEC; |
3043 | + ifsm->pad1 = 0; |
3044 | + ifsm->pad2 = 0; |
3045 | ifsm->ifindex = dev->ifindex; |
3046 | ifsm->filter_mask = filter_mask; |
3047 | |
3048 | diff --git a/net/core/sock.c b/net/core/sock.c |
3049 | index 1989b3dd6d17..2a77cc50f021 100644 |
3050 | --- a/net/core/sock.c |
3051 | +++ b/net/core/sock.c |
3052 | @@ -1493,6 +1493,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) |
3053 | |
3054 | sock_copy(newsk, sk); |
3055 | |
3056 | + newsk->sk_prot_creator = sk->sk_prot; |
3057 | + |
3058 | /* SANITY */ |
3059 | if (likely(newsk->sk_net_refcnt)) |
3060 | get_net(sock_net(newsk)); |
3061 | @@ -1526,13 +1528,16 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) |
3062 | sock_reset_flag(newsk, SOCK_DONE); |
3063 | skb_queue_head_init(&newsk->sk_error_queue); |
3064 | |
3065 | - filter = rcu_dereference_protected(newsk->sk_filter, 1); |
3066 | + rcu_read_lock(); |
3067 | + filter = rcu_dereference(sk->sk_filter); |
3068 | if (filter != NULL) |
3069 | /* though it's an empty new sock, the charging may fail |
3070 | * if sysctl_optmem_max was changed between creation of |
3071 | * original socket and cloning |
3072 | */ |
3073 | is_charged = sk_filter_charge(newsk, filter); |
3074 | + RCU_INIT_POINTER(newsk->sk_filter, filter); |
3075 | + rcu_read_unlock(); |
3076 | |
3077 | if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) { |
3078 | /* We need to make sure that we don't uncharge the new |
3079 | diff --git a/net/dsa/slave.c b/net/dsa/slave.c |
3080 | index 079d76bc204c..5000e6f20f4a 100644 |
3081 | --- a/net/dsa/slave.c |
3082 | +++ b/net/dsa/slave.c |
3083 | @@ -1269,26 +1269,32 @@ int dsa_slave_create(struct dsa_switch *ds, struct device *parent, |
3084 | p->old_duplex = -1; |
3085 | |
3086 | ds->ports[port].netdev = slave_dev; |
3087 | - ret = register_netdev(slave_dev); |
3088 | - if (ret) { |
3089 | - netdev_err(master, "error %d registering interface %s\n", |
3090 | - ret, slave_dev->name); |
3091 | - ds->ports[port].netdev = NULL; |
3092 | - free_netdev(slave_dev); |
3093 | - return ret; |
3094 | - } |
3095 | |
3096 | netif_carrier_off(slave_dev); |
3097 | |
3098 | ret = dsa_slave_phy_setup(p, slave_dev); |
3099 | if (ret) { |
3100 | netdev_err(master, "error %d setting up slave phy\n", ret); |
3101 | - unregister_netdev(slave_dev); |
3102 | - free_netdev(slave_dev); |
3103 | - return ret; |
3104 | + goto out_free; |
3105 | + } |
3106 | + |
3107 | + ret = register_netdev(slave_dev); |
3108 | + if (ret) { |
3109 | + netdev_err(master, "error %d registering interface %s\n", |
3110 | + ret, slave_dev->name); |
3111 | + goto out_phy; |
3112 | } |
3113 | |
3114 | return 0; |
3115 | + |
3116 | +out_phy: |
3117 | + phy_disconnect(p->phy); |
3118 | + if (of_phy_is_fixed_link(ds->ports[port].dn)) |
3119 | + of_phy_deregister_fixed_link(ds->ports[port].dn); |
3120 | +out_free: |
3121 | + free_netdev(slave_dev); |
3122 | + ds->ports[port].netdev = NULL; |
3123 | + return ret; |
3124 | } |
3125 | |
3126 | void dsa_slave_destroy(struct net_device *slave_dev) |
3127 | diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c |
3128 | index 5d7944f394d9..b120b9b11402 100644 |
3129 | --- a/net/ipv4/ip_vti.c |
3130 | +++ b/net/ipv4/ip_vti.c |
3131 | @@ -168,6 +168,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, |
3132 | struct ip_tunnel_parm *parms = &tunnel->parms; |
3133 | struct dst_entry *dst = skb_dst(skb); |
3134 | struct net_device *tdev; /* Device to other host */ |
3135 | + int pkt_len = skb->len; |
3136 | int err; |
3137 | int mtu; |
3138 | |
3139 | @@ -229,7 +230,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, |
3140 | |
3141 | err = dst_output(tunnel->net, skb->sk, skb); |
3142 | if (net_xmit_eval(err) == 0) |
3143 | - err = skb->len; |
3144 | + err = pkt_len; |
3145 | iptunnel_xmit_stats(dev, err); |
3146 | return NETDEV_TX_OK; |
3147 | |
3148 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
3149 | index 5d836b037442..85920707c4d3 100644 |
3150 | --- a/net/ipv4/tcp_output.c |
3151 | +++ b/net/ipv4/tcp_output.c |
3152 | @@ -914,6 +914,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, |
3153 | struct tcp_skb_cb *tcb; |
3154 | struct tcp_out_options opts; |
3155 | unsigned int tcp_options_size, tcp_header_size; |
3156 | + struct sk_buff *oskb = NULL; |
3157 | struct tcp_md5sig_key *md5; |
3158 | struct tcphdr *th; |
3159 | int err; |
3160 | @@ -922,11 +923,9 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, |
3161 | tp = tcp_sk(sk); |
3162 | |
3163 | if (clone_it) { |
3164 | - skb_mstamp_get(&skb->skb_mstamp); |
3165 | TCP_SKB_CB(skb)->tx.in_flight = TCP_SKB_CB(skb)->end_seq |
3166 | - tp->snd_una; |
3167 | - tcp_rate_skb_sent(sk, skb); |
3168 | - |
3169 | + oskb = skb; |
3170 | if (unlikely(skb_cloned(skb))) |
3171 | skb = pskb_copy(skb, gfp_mask); |
3172 | else |
3173 | @@ -934,6 +933,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, |
3174 | if (unlikely(!skb)) |
3175 | return -ENOBUFS; |
3176 | } |
3177 | + skb_mstamp_get(&skb->skb_mstamp); |
3178 | |
3179 | inet = inet_sk(sk); |
3180 | tcb = TCP_SKB_CB(skb); |
3181 | @@ -1035,12 +1035,15 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, |
3182 | |
3183 | err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl); |
3184 | |
3185 | - if (likely(err <= 0)) |
3186 | - return err; |
3187 | - |
3188 | - tcp_enter_cwr(sk); |
3189 | - |
3190 | - return net_xmit_eval(err); |
3191 | + if (unlikely(err > 0)) { |
3192 | + tcp_enter_cwr(sk); |
3193 | + err = net_xmit_eval(err); |
3194 | + } |
3195 | + if (!err && oskb) { |
3196 | + skb_mstamp_get(&oskb->skb_mstamp); |
3197 | + tcp_rate_skb_sent(sk, oskb); |
3198 | + } |
3199 | + return err; |
3200 | } |
3201 | |
3202 | /* This routine just queues the buffer for sending. |
3203 | @@ -2709,10 +2712,11 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) |
3204 | skb_headroom(skb) >= 0xFFFF)) { |
3205 | struct sk_buff *nskb; |
3206 | |
3207 | - skb_mstamp_get(&skb->skb_mstamp); |
3208 | nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC); |
3209 | err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) : |
3210 | -ENOBUFS; |
3211 | + if (!err) |
3212 | + skb_mstamp_get(&skb->skb_mstamp); |
3213 | } else { |
3214 | err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC); |
3215 | } |
3216 | @@ -3325,6 +3329,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) |
3217 | goto done; |
3218 | } |
3219 | |
3220 | + /* data was not sent, this is our new send_head */ |
3221 | + sk->sk_send_head = syn_data; |
3222 | + tp->packets_out -= tcp_skb_pcount(syn_data); |
3223 | + |
3224 | fallback: |
3225 | /* Send a regular SYN with Fast Open cookie request option */ |
3226 | if (fo->cookie.len > 0) |
3227 | @@ -3374,6 +3382,11 @@ int tcp_connect(struct sock *sk) |
3228 | */ |
3229 | tp->snd_nxt = tp->write_seq; |
3230 | tp->pushed_seq = tp->write_seq; |
3231 | + buff = tcp_send_head(sk); |
3232 | + if (unlikely(buff)) { |
3233 | + tp->snd_nxt = TCP_SKB_CB(buff)->seq; |
3234 | + tp->pushed_seq = TCP_SKB_CB(buff)->seq; |
3235 | + } |
3236 | TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS); |
3237 | |
3238 | /* Timer for repeating the SYN until an answer. */ |
3239 | diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c |
3240 | index f78afe43bdff..41c10486cf7e 100644 |
3241 | --- a/net/ipv6/ip6_gre.c |
3242 | +++ b/net/ipv6/ip6_gre.c |
3243 | @@ -936,24 +936,25 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev, |
3244 | } |
3245 | |
3246 | static int ip6gre_header(struct sk_buff *skb, struct net_device *dev, |
3247 | - unsigned short type, |
3248 | - const void *daddr, const void *saddr, unsigned int len) |
3249 | + unsigned short type, const void *daddr, |
3250 | + const void *saddr, unsigned int len) |
3251 | { |
3252 | struct ip6_tnl *t = netdev_priv(dev); |
3253 | - struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb_push(skb, t->hlen); |
3254 | - __be16 *p = (__be16 *)(ipv6h+1); |
3255 | + struct ipv6hdr *ipv6h; |
3256 | + __be16 *p; |
3257 | |
3258 | - ip6_flow_hdr(ipv6h, 0, |
3259 | - ip6_make_flowlabel(dev_net(dev), skb, |
3260 | - t->fl.u.ip6.flowlabel, true, |
3261 | - &t->fl.u.ip6)); |
3262 | + ipv6h = (struct ipv6hdr *)skb_push(skb, t->hlen + sizeof(*ipv6h)); |
3263 | + ip6_flow_hdr(ipv6h, 0, ip6_make_flowlabel(dev_net(dev), skb, |
3264 | + t->fl.u.ip6.flowlabel, |
3265 | + true, &t->fl.u.ip6)); |
3266 | ipv6h->hop_limit = t->parms.hop_limit; |
3267 | ipv6h->nexthdr = NEXTHDR_GRE; |
3268 | ipv6h->saddr = t->parms.laddr; |
3269 | ipv6h->daddr = t->parms.raddr; |
3270 | |
3271 | - p[0] = t->parms.o_flags; |
3272 | - p[1] = htons(type); |
3273 | + p = (__be16 *)(ipv6h + 1); |
3274 | + p[0] = t->parms.o_flags; |
3275 | + p[1] = htons(type); |
3276 | |
3277 | /* |
3278 | * Set the source hardware address. |
3279 | @@ -1297,6 +1298,7 @@ static void ip6gre_tap_setup(struct net_device *dev) |
3280 | dev->features |= NETIF_F_NETNS_LOCAL; |
3281 | dev->priv_flags &= ~IFF_TX_SKB_SHARING; |
3282 | dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; |
3283 | + netif_keep_dst(dev); |
3284 | } |
3285 | |
3286 | static bool ip6gre_netlink_encap_parms(struct nlattr *data[], |
3287 | diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c |
3288 | index 1fc9daa7b1d6..12b2fd512f32 100644 |
3289 | --- a/net/ipv6/ip6_tunnel.c |
3290 | +++ b/net/ipv6/ip6_tunnel.c |
3291 | @@ -1042,6 +1042,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, |
3292 | struct dst_entry *dst = NULL, *ndst = NULL; |
3293 | struct net_device *tdev; |
3294 | int mtu; |
3295 | + unsigned int eth_hlen = t->dev->type == ARPHRD_ETHER ? ETH_HLEN : 0; |
3296 | unsigned int psh_hlen = sizeof(struct ipv6hdr) + t->encap_hlen; |
3297 | unsigned int max_headroom = psh_hlen; |
3298 | bool use_cache = false; |
3299 | @@ -1120,7 +1121,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, |
3300 | t->parms.name); |
3301 | goto tx_err_dst_release; |
3302 | } |
3303 | - mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen; |
3304 | + mtu = dst_mtu(dst) - eth_hlen - psh_hlen - t->tun_hlen; |
3305 | if (encap_limit >= 0) { |
3306 | max_headroom += 8; |
3307 | mtu -= 8; |
3308 | @@ -1129,7 +1130,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, |
3309 | mtu = IPV6_MIN_MTU; |
3310 | if (skb_dst(skb) && !t->parms.collect_md) |
3311 | skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); |
3312 | - if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) { |
3313 | + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { |
3314 | *pmtu = mtu; |
3315 | err = -EMSGSIZE; |
3316 | goto tx_err_dst_release; |
3317 | @@ -2231,6 +2232,9 @@ static int __init ip6_tunnel_init(void) |
3318 | { |
3319 | int err; |
3320 | |
3321 | + if (!ipv6_mod_enabled()) |
3322 | + return -EOPNOTSUPP; |
3323 | + |
3324 | err = register_pernet_device(&ip6_tnl_net_ops); |
3325 | if (err < 0) |
3326 | goto out_pernet; |
3327 | diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c |
3328 | index 66c2b4b41793..816f79d1a8a3 100644 |
3329 | --- a/net/ipv6/ip6_vti.c |
3330 | +++ b/net/ipv6/ip6_vti.c |
3331 | @@ -445,6 +445,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) |
3332 | struct dst_entry *dst = skb_dst(skb); |
3333 | struct net_device *tdev; |
3334 | struct xfrm_state *x; |
3335 | + int pkt_len = skb->len; |
3336 | int err = -1; |
3337 | int mtu; |
3338 | |
3339 | @@ -498,7 +499,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) |
3340 | struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); |
3341 | |
3342 | u64_stats_update_begin(&tstats->syncp); |
3343 | - tstats->tx_bytes += skb->len; |
3344 | + tstats->tx_bytes += pkt_len; |
3345 | tstats->tx_packets++; |
3346 | u64_stats_update_end(&tstats->syncp); |
3347 | } else { |
3348 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c |
3349 | index 2497f62fa4c2..4db5f541bca6 100644 |
3350 | --- a/net/ipv6/udp.c |
3351 | +++ b/net/ipv6/udp.c |
3352 | @@ -915,6 +915,7 @@ static void udp6_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb, |
3353 | */ |
3354 | offset = skb_transport_offset(skb); |
3355 | skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); |
3356 | + csum = skb->csum; |
3357 | |
3358 | skb->ip_summed = CHECKSUM_NONE; |
3359 | |
3360 | diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c |
3361 | index 3bce65183c95..b06acd0f400d 100644 |
3362 | --- a/net/l2tp/l2tp_core.c |
3363 | +++ b/net/l2tp/l2tp_core.c |
3364 | @@ -1415,6 +1415,9 @@ static void l2tp_tunnel_del_work(struct work_struct *work) |
3365 | struct sock *sk = NULL; |
3366 | |
3367 | tunnel = container_of(work, struct l2tp_tunnel, del_work); |
3368 | + |
3369 | + l2tp_tunnel_closeall(tunnel); |
3370 | + |
3371 | sk = l2tp_tunnel_sock_lookup(tunnel); |
3372 | if (!sk) |
3373 | goto out; |
3374 | @@ -1734,15 +1737,12 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); |
3375 | |
3376 | /* This function is used by the netlink TUNNEL_DELETE command. |
3377 | */ |
3378 | -int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) |
3379 | +void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) |
3380 | { |
3381 | - l2tp_tunnel_inc_refcount(tunnel); |
3382 | - l2tp_tunnel_closeall(tunnel); |
3383 | - if (false == queue_work(l2tp_wq, &tunnel->del_work)) { |
3384 | - l2tp_tunnel_dec_refcount(tunnel); |
3385 | - return 1; |
3386 | + if (!test_and_set_bit(0, &tunnel->dead)) { |
3387 | + l2tp_tunnel_inc_refcount(tunnel); |
3388 | + queue_work(l2tp_wq, &tunnel->del_work); |
3389 | } |
3390 | - return 0; |
3391 | } |
3392 | EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); |
3393 | |
3394 | diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h |
3395 | index 0095012509ac..42419f1c24cf 100644 |
3396 | --- a/net/l2tp/l2tp_core.h |
3397 | +++ b/net/l2tp/l2tp_core.h |
3398 | @@ -169,6 +169,9 @@ struct l2tp_tunnel_cfg { |
3399 | |
3400 | struct l2tp_tunnel { |
3401 | int magic; /* Should be L2TP_TUNNEL_MAGIC */ |
3402 | + |
3403 | + unsigned long dead; |
3404 | + |
3405 | struct rcu_head rcu; |
3406 | rwlock_t hlist_lock; /* protect session_hlist */ |
3407 | struct hlist_head session_hlist[L2TP_HASH_SIZE]; |
3408 | @@ -257,7 +260,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, |
3409 | u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, |
3410 | struct l2tp_tunnel **tunnelp); |
3411 | void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel); |
3412 | -int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); |
3413 | +void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); |
3414 | struct l2tp_session *l2tp_session_create(int priv_size, |
3415 | struct l2tp_tunnel *tunnel, |
3416 | u32 session_id, u32 peer_session_id, |
3417 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c |
3418 | index 246f29d365c0..2a5775f8a6ca 100644 |
3419 | --- a/net/netlink/af_netlink.c |
3420 | +++ b/net/netlink/af_netlink.c |
3421 | @@ -2211,10 +2211,13 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, |
3422 | |
3423 | mutex_unlock(nlk->cb_mutex); |
3424 | |
3425 | + ret = 0; |
3426 | if (cb->start) |
3427 | - cb->start(cb); |
3428 | + ret = cb->start(cb); |
3429 | + |
3430 | + if (!ret) |
3431 | + ret = netlink_dump(sk); |
3432 | |
3433 | - ret = netlink_dump(sk); |
3434 | sock_put(sk); |
3435 | |
3436 | if (ret) |
3437 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
3438 | index 9c92c6cb6a4f..b17f9097c6fe 100644 |
3439 | --- a/net/packet/af_packet.c |
3440 | +++ b/net/packet/af_packet.c |
3441 | @@ -1648,10 +1648,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) |
3442 | |
3443 | mutex_lock(&fanout_mutex); |
3444 | |
3445 | - err = -EINVAL; |
3446 | - if (!po->running) |
3447 | - goto out; |
3448 | - |
3449 | err = -EALREADY; |
3450 | if (po->fanout) |
3451 | goto out; |
3452 | @@ -1700,7 +1696,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) |
3453 | list_add(&match->list, &fanout_list); |
3454 | } |
3455 | err = -EINVAL; |
3456 | - if (match->type == type && |
3457 | + |
3458 | + spin_lock(&po->bind_lock); |
3459 | + if (po->running && |
3460 | + match->type == type && |
3461 | match->prot_hook.type == po->prot_hook.type && |
3462 | match->prot_hook.dev == po->prot_hook.dev) { |
3463 | err = -ENOSPC; |
3464 | @@ -1712,6 +1711,13 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) |
3465 | err = 0; |
3466 | } |
3467 | } |
3468 | + spin_unlock(&po->bind_lock); |
3469 | + |
3470 | + if (err && !atomic_read(&match->sk_ref)) { |
3471 | + list_del(&match->list); |
3472 | + kfree(match); |
3473 | + } |
3474 | + |
3475 | out: |
3476 | if (err && rollover) { |
3477 | kfree(rollover); |
3478 | @@ -2832,6 +2838,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
3479 | struct virtio_net_hdr vnet_hdr = { 0 }; |
3480 | int offset = 0; |
3481 | struct packet_sock *po = pkt_sk(sk); |
3482 | + bool has_vnet_hdr = false; |
3483 | int hlen, tlen, linear; |
3484 | int extra_len = 0; |
3485 | |
3486 | @@ -2875,6 +2882,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
3487 | err = packet_snd_vnet_parse(msg, &len, &vnet_hdr); |
3488 | if (err) |
3489 | goto out_unlock; |
3490 | + has_vnet_hdr = true; |
3491 | } |
3492 | |
3493 | if (unlikely(sock_flag(sk, SOCK_NOFCS))) { |
3494 | @@ -2935,7 +2943,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
3495 | |
3496 | packet_pick_tx_queue(dev, skb); |
3497 | |
3498 | - if (po->has_vnet_hdr) { |
3499 | + if (has_vnet_hdr) { |
3500 | err = packet_snd_vnet_gso(skb, &vnet_hdr); |
3501 | if (err) |
3502 | goto out_free; |
3503 | @@ -3063,13 +3071,15 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, |
3504 | int ret = 0; |
3505 | bool unlisted = false; |
3506 | |
3507 | - if (po->fanout) |
3508 | - return -EINVAL; |
3509 | - |
3510 | lock_sock(sk); |
3511 | spin_lock(&po->bind_lock); |
3512 | rcu_read_lock(); |
3513 | |
3514 | + if (po->fanout) { |
3515 | + ret = -EINVAL; |
3516 | + goto out_unlock; |
3517 | + } |
3518 | + |
3519 | if (name) { |
3520 | dev = dev_get_by_name_rcu(sock_net(sk), name); |
3521 | if (!dev) { |
3522 | diff --git a/net/sched/act_api.c b/net/sched/act_api.c |
3523 | index c651cfce9be6..f3117324146a 100644 |
3524 | --- a/net/sched/act_api.c |
3525 | +++ b/net/sched/act_api.c |
3526 | @@ -141,7 +141,7 @@ static int tcf_del_walker(struct tcf_hashinfo *hinfo, struct sk_buff *skb, |
3527 | hlist_for_each_entry_safe(p, n, head, tcfa_head) { |
3528 | ret = __tcf_hash_release(p, false, true); |
3529 | if (ret == ACT_P_DELETED) { |
3530 | - module_put(p->ops->owner); |
3531 | + module_put(ops->owner); |
3532 | n_i++; |
3533 | } else if (ret < 0) |
3534 | goto nla_put_failure; |
3535 | @@ -450,13 +450,15 @@ EXPORT_SYMBOL(tcf_action_exec); |
3536 | |
3537 | int tcf_action_destroy(struct list_head *actions, int bind) |
3538 | { |
3539 | + const struct tc_action_ops *ops; |
3540 | struct tc_action *a, *tmp; |
3541 | int ret = 0; |
3542 | |
3543 | list_for_each_entry_safe(a, tmp, actions, list) { |
3544 | + ops = a->ops; |
3545 | ret = __tcf_hash_release(a, bind, true); |
3546 | if (ret == ACT_P_DELETED) |
3547 | - module_put(a->ops->owner); |
3548 | + module_put(ops->owner); |
3549 | else if (ret < 0) |
3550 | return ret; |
3551 | } |
3552 | diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c |
3553 | index b12bc2abea93..e75fb65037d7 100644 |
3554 | --- a/net/sched/cls_matchall.c |
3555 | +++ b/net/sched/cls_matchall.c |
3556 | @@ -32,6 +32,7 @@ static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp, |
3557 | if (tc_skip_sw(head->flags)) |
3558 | return -1; |
3559 | |
3560 | + *res = head->res; |
3561 | return tcf_exts_exec(skb, &head->exts, res); |
3562 | } |
3563 | |
3564 | diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c |
3565 | index 6cfb6e9038c2..9016c8baf2aa 100644 |
3566 | --- a/net/sched/sch_generic.c |
3567 | +++ b/net/sched/sch_generic.c |
3568 | @@ -681,6 +681,7 @@ void qdisc_reset(struct Qdisc *qdisc) |
3569 | qdisc->gso_skb = NULL; |
3570 | } |
3571 | qdisc->q.qlen = 0; |
3572 | + qdisc->qstats.backlog = 0; |
3573 | } |
3574 | EXPORT_SYMBOL(qdisc_reset); |
3575 | |
3576 | diff --git a/net/tipc/msg.c b/net/tipc/msg.c |
3577 | index 56ea0adcd285..912f1fb97c06 100644 |
3578 | --- a/net/tipc/msg.c |
3579 | +++ b/net/tipc/msg.c |
3580 | @@ -547,7 +547,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err) |
3581 | return false; |
3582 | if (msg_errcode(msg)) |
3583 | return false; |
3584 | - *err = -TIPC_ERR_NO_NAME; |
3585 | + *err = TIPC_ERR_NO_NAME; |
3586 | if (skb_linearize(skb)) |
3587 | return false; |
3588 | msg = buf_msg(skb); |
3589 | diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c |
3590 | index 1cb060293505..a8a7fbc377f6 100644 |
3591 | --- a/security/smack/smack_lsm.c |
3592 | +++ b/security/smack/smack_lsm.c |
3593 | @@ -1486,7 +1486,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) |
3594 | * @inode: the object |
3595 | * @name: attribute name |
3596 | * @buffer: where to put the result |
3597 | - * @alloc: unused |
3598 | + * @alloc: duplicate memory |
3599 | * |
3600 | * Returns the size of the attribute or an error code |
3601 | */ |
3602 | @@ -1499,43 +1499,38 @@ static int smack_inode_getsecurity(struct inode *inode, |
3603 | struct super_block *sbp; |
3604 | struct inode *ip = (struct inode *)inode; |
3605 | struct smack_known *isp; |
3606 | - int ilen; |
3607 | - int rc = 0; |
3608 | |
3609 | - if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { |
3610 | + if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) |
3611 | isp = smk_of_inode(inode); |
3612 | - ilen = strlen(isp->smk_known); |
3613 | - *buffer = isp->smk_known; |
3614 | - return ilen; |
3615 | - } |
3616 | + else { |
3617 | + /* |
3618 | + * The rest of the Smack xattrs are only on sockets. |
3619 | + */ |
3620 | + sbp = ip->i_sb; |
3621 | + if (sbp->s_magic != SOCKFS_MAGIC) |
3622 | + return -EOPNOTSUPP; |
3623 | |
3624 | - /* |
3625 | - * The rest of the Smack xattrs are only on sockets. |
3626 | - */ |
3627 | - sbp = ip->i_sb; |
3628 | - if (sbp->s_magic != SOCKFS_MAGIC) |
3629 | - return -EOPNOTSUPP; |
3630 | + sock = SOCKET_I(ip); |
3631 | + if (sock == NULL || sock->sk == NULL) |
3632 | + return -EOPNOTSUPP; |
3633 | |
3634 | - sock = SOCKET_I(ip); |
3635 | - if (sock == NULL || sock->sk == NULL) |
3636 | - return -EOPNOTSUPP; |
3637 | - |
3638 | - ssp = sock->sk->sk_security; |
3639 | + ssp = sock->sk->sk_security; |
3640 | |
3641 | - if (strcmp(name, XATTR_SMACK_IPIN) == 0) |
3642 | - isp = ssp->smk_in; |
3643 | - else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) |
3644 | - isp = ssp->smk_out; |
3645 | - else |
3646 | - return -EOPNOTSUPP; |
3647 | + if (strcmp(name, XATTR_SMACK_IPIN) == 0) |
3648 | + isp = ssp->smk_in; |
3649 | + else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) |
3650 | + isp = ssp->smk_out; |
3651 | + else |
3652 | + return -EOPNOTSUPP; |
3653 | + } |
3654 | |
3655 | - ilen = strlen(isp->smk_known); |
3656 | - if (rc == 0) { |
3657 | - *buffer = isp->smk_known; |
3658 | - rc = ilen; |
3659 | + if (alloc) { |
3660 | + *buffer = kstrdup(isp->smk_known, GFP_KERNEL); |
3661 | + if (*buffer == NULL) |
3662 | + return -ENOMEM; |
3663 | } |
3664 | |
3665 | - return rc; |
3666 | + return strlen(isp->smk_known); |
3667 | } |
3668 | |
3669 | |
3670 | diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c |
3671 | index fec1dfdb14ad..4490a699030b 100644 |
3672 | --- a/sound/core/compress_offload.c |
3673 | +++ b/sound/core/compress_offload.c |
3674 | @@ -948,14 +948,13 @@ static const struct file_operations snd_compr_file_ops = { |
3675 | static int snd_compress_dev_register(struct snd_device *device) |
3676 | { |
3677 | int ret = -EINVAL; |
3678 | - char str[16]; |
3679 | struct snd_compr *compr; |
3680 | |
3681 | if (snd_BUG_ON(!device || !device->device_data)) |
3682 | return -EBADFD; |
3683 | compr = device->device_data; |
3684 | |
3685 | - pr_debug("reg %s for device %s, direction %d\n", str, compr->name, |
3686 | + pr_debug("reg device %s, direction %d\n", compr->name, |
3687 | compr->direction); |
3688 | /* register compressed device */ |
3689 | ret = snd_register_device(SNDRV_DEVICE_TYPE_COMPRESS, |
3690 | diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c |
3691 | index 937071760bc4..286f5e3686a3 100644 |
3692 | --- a/sound/pci/echoaudio/echoaudio.c |
3693 | +++ b/sound/pci/echoaudio/echoaudio.c |
3694 | @@ -1272,11 +1272,11 @@ static int snd_echo_mixer_info(struct snd_kcontrol *kcontrol, |
3695 | |
3696 | chip = snd_kcontrol_chip(kcontrol); |
3697 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; |
3698 | + uinfo->count = 1; |
3699 | uinfo->value.integer.min = ECHOGAIN_MINOUT; |
3700 | uinfo->value.integer.max = ECHOGAIN_MAXOUT; |
3701 | uinfo->dimen.d[0] = num_busses_out(chip); |
3702 | uinfo->dimen.d[1] = num_busses_in(chip); |
3703 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1]; |
3704 | return 0; |
3705 | } |
3706 | |
3707 | @@ -1344,11 +1344,11 @@ static int snd_echo_vmixer_info(struct snd_kcontrol *kcontrol, |
3708 | |
3709 | chip = snd_kcontrol_chip(kcontrol); |
3710 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; |
3711 | + uinfo->count = 1; |
3712 | uinfo->value.integer.min = ECHOGAIN_MINOUT; |
3713 | uinfo->value.integer.max = ECHOGAIN_MAXOUT; |
3714 | uinfo->dimen.d[0] = num_busses_out(chip); |
3715 | uinfo->dimen.d[1] = num_pipes_out(chip); |
3716 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1]; |
3717 | return 0; |
3718 | } |
3719 | |
3720 | @@ -1728,6 +1728,7 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol, |
3721 | struct snd_ctl_elem_info *uinfo) |
3722 | { |
3723 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; |
3724 | + uinfo->count = 96; |
3725 | uinfo->value.integer.min = ECHOGAIN_MINOUT; |
3726 | uinfo->value.integer.max = 0; |
3727 | #ifdef ECHOCARD_HAS_VMIXER |
3728 | @@ -1737,7 +1738,6 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol, |
3729 | #endif |
3730 | uinfo->dimen.d[1] = 16; /* 16 channels */ |
3731 | uinfo->dimen.d[2] = 2; /* 0=level, 1=peak */ |
3732 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1] * uinfo->dimen.d[2]; |
3733 | return 0; |
3734 | } |
3735 | |
3736 | diff --git a/sound/usb/card.c b/sound/usb/card.c |
3737 | index f36cb068dad3..8906199a83e6 100644 |
3738 | --- a/sound/usb/card.c |
3739 | +++ b/sound/usb/card.c |
3740 | @@ -221,6 +221,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) |
3741 | struct usb_interface_descriptor *altsd; |
3742 | void *control_header; |
3743 | int i, protocol; |
3744 | + int rest_bytes; |
3745 | |
3746 | /* find audiocontrol interface */ |
3747 | host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0]; |
3748 | @@ -235,6 +236,15 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) |
3749 | return -EINVAL; |
3750 | } |
3751 | |
3752 | + rest_bytes = (void *)(host_iface->extra + host_iface->extralen) - |
3753 | + control_header; |
3754 | + |
3755 | + /* just to be sure -- this shouldn't hit at all */ |
3756 | + if (rest_bytes <= 0) { |
3757 | + dev_err(&dev->dev, "invalid control header\n"); |
3758 | + return -EINVAL; |
3759 | + } |
3760 | + |
3761 | switch (protocol) { |
3762 | default: |
3763 | dev_warn(&dev->dev, |
3764 | @@ -245,11 +255,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) |
3765 | case UAC_VERSION_1: { |
3766 | struct uac1_ac_header_descriptor *h1 = control_header; |
3767 | |
3768 | + if (rest_bytes < sizeof(*h1)) { |
3769 | + dev_err(&dev->dev, "too short v1 buffer descriptor\n"); |
3770 | + return -EINVAL; |
3771 | + } |
3772 | + |
3773 | if (!h1->bInCollection) { |
3774 | dev_info(&dev->dev, "skipping empty audio interface (v1)\n"); |
3775 | return -EINVAL; |
3776 | } |
3777 | |
3778 | + if (rest_bytes < h1->bLength) { |
3779 | + dev_err(&dev->dev, "invalid buffer length (v1)\n"); |
3780 | + return -EINVAL; |
3781 | + } |
3782 | + |
3783 | if (h1->bLength < sizeof(*h1) + h1->bInCollection) { |
3784 | dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n"); |
3785 | return -EINVAL; |
3786 | diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c |
3787 | index bf618e1500ac..e7b934f4d837 100644 |
3788 | --- a/sound/usb/usx2y/usb_stream.c |
3789 | +++ b/sound/usb/usx2y/usb_stream.c |
3790 | @@ -191,7 +191,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, |
3791 | } |
3792 | |
3793 | pg = get_order(read_size); |
3794 | - sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); |
3795 | + sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| |
3796 | + __GFP_NOWARN, pg); |
3797 | if (!sk->s) { |
3798 | snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); |
3799 | goto out; |
3800 | @@ -211,7 +212,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, |
3801 | pg = get_order(write_size); |
3802 | |
3803 | sk->write_page = |
3804 | - (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); |
3805 | + (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| |
3806 | + __GFP_NOWARN, pg); |
3807 | if (!sk->write_page) { |
3808 | snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); |
3809 | usb_stream_free(sk); |