Annotation of /trunk/kernel-alx/patches-4.9/0211-4.9.112-all-fixes.patch
Parent Directory | Revision Log
Revision 3188 -
(hide annotations)
(download)
Wed Aug 8 14:17:38 2018 UTC (6 years, 1 month ago) by niro
File size: 68426 byte(s)
Wed Aug 8 14:17:38 2018 UTC (6 years, 1 month ago) by niro
File size: 68426 byte(s)
-linux-4.9.112
1 | niro | 3188 | diff --git a/Makefile b/Makefile |
2 | index b10646531fcd..c4544293db10 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 9 | ||
8 | -SUBLEVEL = 111 | ||
9 | +SUBLEVEL = 112 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Roaring Lionus | ||
12 | |||
13 | diff --git a/arch/arm/boot/dts/imx6q.dtsi b/arch/arm/boot/dts/imx6q.dtsi | ||
14 | index e9a5d0b8c7b0..908b269a016b 100644 | ||
15 | --- a/arch/arm/boot/dts/imx6q.dtsi | ||
16 | +++ b/arch/arm/boot/dts/imx6q.dtsi | ||
17 | @@ -96,7 +96,7 @@ | ||
18 | clocks = <&clks IMX6Q_CLK_ECSPI5>, | ||
19 | <&clks IMX6Q_CLK_ECSPI5>; | ||
20 | clock-names = "ipg", "per"; | ||
21 | - dmas = <&sdma 11 7 1>, <&sdma 12 7 2>; | ||
22 | + dmas = <&sdma 11 8 1>, <&sdma 12 8 2>; | ||
23 | dma-names = "rx", "tx"; | ||
24 | status = "disabled"; | ||
25 | }; | ||
26 | diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S | ||
27 | index a4fd00064c80..771cfd2e1e6d 100644 | ||
28 | --- a/arch/s390/kernel/entry.S | ||
29 | +++ b/arch/s390/kernel/entry.S | ||
30 | @@ -1187,7 +1187,7 @@ cleanup_critical: | ||
31 | jl 0f | ||
32 | clg %r9,BASED(.Lcleanup_table+104) # .Lload_fpu_regs_end | ||
33 | jl .Lcleanup_load_fpu_regs | ||
34 | -0: BR_EX %r14 | ||
35 | +0: BR_EX %r14,%r11 | ||
36 | |||
37 | .align 8 | ||
38 | .Lcleanup_table: | ||
39 | @@ -1217,7 +1217,7 @@ cleanup_critical: | ||
40 | ni __SIE_PROG0C+3(%r9),0xfe # no longer in SIE | ||
41 | lctlg %c1,%c1,__LC_USER_ASCE # load primary asce | ||
42 | larl %r9,sie_exit # skip forward to sie_exit | ||
43 | - BR_EX %r14 | ||
44 | + BR_EX %r14,%r11 | ||
45 | #endif | ||
46 | |||
47 | .Lcleanup_system_call: | ||
48 | diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c | ||
49 | index b0fd028b2eee..7a4279d8a902 100644 | ||
50 | --- a/arch/x86/kernel/cpu/common.c | ||
51 | +++ b/arch/x86/kernel/cpu/common.c | ||
52 | @@ -848,6 +848,13 @@ void get_cpu_cap(struct cpuinfo_x86 *c) | ||
53 | |||
54 | init_scattered_cpuid_features(c); | ||
55 | init_speculation_control(c); | ||
56 | + | ||
57 | + /* | ||
58 | + * Clear/Set all flags overridden by options, after probe. | ||
59 | + * This needs to happen each time we re-probe, which may happen | ||
60 | + * several times during CPU initialization. | ||
61 | + */ | ||
62 | + apply_forced_caps(c); | ||
63 | } | ||
64 | |||
65 | static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c) | ||
66 | diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c | ||
67 | index 91c48cdfe81f..516be613bd41 100644 | ||
68 | --- a/arch/x86/kernel/kprobes/core.c | ||
69 | +++ b/arch/x86/kernel/kprobes/core.c | ||
70 | @@ -414,25 +414,38 @@ void free_insn_page(void *page) | ||
71 | module_memfree(page); | ||
72 | } | ||
73 | |||
74 | +/* Prepare reljump right after instruction to boost */ | ||
75 | +static void prepare_boost(struct kprobe *p, int length) | ||
76 | +{ | ||
77 | + if (can_boost(p->ainsn.insn, p->addr) && | ||
78 | + MAX_INSN_SIZE - length >= RELATIVEJUMP_SIZE) { | ||
79 | + /* | ||
80 | + * These instructions can be executed directly if it | ||
81 | + * jumps back to correct address. | ||
82 | + */ | ||
83 | + synthesize_reljump(p->ainsn.insn + length, p->addr + length); | ||
84 | + p->ainsn.boostable = 1; | ||
85 | + } else { | ||
86 | + p->ainsn.boostable = -1; | ||
87 | + } | ||
88 | +} | ||
89 | + | ||
90 | static int arch_copy_kprobe(struct kprobe *p) | ||
91 | { | ||
92 | - int ret; | ||
93 | + int len; | ||
94 | |||
95 | set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1); | ||
96 | |||
97 | /* Copy an instruction with recovering if other optprobe modifies it.*/ | ||
98 | - ret = __copy_instruction(p->ainsn.insn, p->addr); | ||
99 | - if (!ret) | ||
100 | + len = __copy_instruction(p->ainsn.insn, p->addr); | ||
101 | + if (!len) | ||
102 | return -EINVAL; | ||
103 | |||
104 | /* | ||
105 | * __copy_instruction can modify the displacement of the instruction, | ||
106 | * but it doesn't affect boostable check. | ||
107 | */ | ||
108 | - if (can_boost(p->ainsn.insn, p->addr)) | ||
109 | - p->ainsn.boostable = 0; | ||
110 | - else | ||
111 | - p->ainsn.boostable = -1; | ||
112 | + prepare_boost(p, len); | ||
113 | |||
114 | set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1); | ||
115 | |||
116 | @@ -897,21 +910,6 @@ static void resume_execution(struct kprobe *p, struct pt_regs *regs, | ||
117 | break; | ||
118 | } | ||
119 | |||
120 | - if (p->ainsn.boostable == 0) { | ||
121 | - if ((regs->ip > copy_ip) && | ||
122 | - (regs->ip - copy_ip) + 5 < MAX_INSN_SIZE) { | ||
123 | - /* | ||
124 | - * These instructions can be executed directly if it | ||
125 | - * jumps back to correct address. | ||
126 | - */ | ||
127 | - synthesize_reljump((void *)regs->ip, | ||
128 | - (void *)orig_ip + (regs->ip - copy_ip)); | ||
129 | - p->ainsn.boostable = 1; | ||
130 | - } else { | ||
131 | - p->ainsn.boostable = -1; | ||
132 | - } | ||
133 | - } | ||
134 | - | ||
135 | regs->ip += orig_ip - copy_ip; | ||
136 | |||
137 | no_change: | ||
138 | diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c | ||
139 | index a11540e51f62..8eca26ef6471 100644 | ||
140 | --- a/arch/x86/xen/smp.c | ||
141 | +++ b/arch/x86/xen/smp.c | ||
142 | @@ -28,6 +28,7 @@ | ||
143 | #include <xen/interface/vcpu.h> | ||
144 | #include <xen/interface/xenpmu.h> | ||
145 | |||
146 | +#include <asm/spec-ctrl.h> | ||
147 | #include <asm/xen/interface.h> | ||
148 | #include <asm/xen/hypercall.h> | ||
149 | |||
150 | @@ -87,6 +88,8 @@ static void cpu_bringup(void) | ||
151 | cpu_data(cpu).x86_max_cores = 1; | ||
152 | set_cpu_sibling_map(cpu); | ||
153 | |||
154 | + speculative_store_bypass_ht_init(); | ||
155 | + | ||
156 | xen_setup_cpu_clockevents(); | ||
157 | |||
158 | notify_cpu_starting(cpu); | ||
159 | @@ -375,6 +378,8 @@ static void __init xen_smp_prepare_cpus(unsigned int max_cpus) | ||
160 | } | ||
161 | set_cpu_sibling_map(0); | ||
162 | |||
163 | + speculative_store_bypass_ht_init(); | ||
164 | + | ||
165 | xen_pmu_init(0); | ||
166 | |||
167 | if (xen_smp_intr_init(0)) | ||
168 | diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c | ||
169 | index a7c5b79371a7..23ee46a0c78c 100644 | ||
170 | --- a/drivers/base/power/opp/core.c | ||
171 | +++ b/drivers/base/power/opp/core.c | ||
172 | @@ -651,7 +651,7 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq) | ||
173 | rcu_read_unlock(); | ||
174 | |||
175 | /* Scaling up? Scale voltage before frequency */ | ||
176 | - if (freq > old_freq) { | ||
177 | + if (freq >= old_freq) { | ||
178 | ret = _set_opp_voltage(dev, reg, u_volt, u_volt_min, | ||
179 | u_volt_max); | ||
180 | if (ret) | ||
181 | diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c | ||
182 | index c6755c9a0aea..51c233c4e058 100644 | ||
183 | --- a/drivers/block/drbd/drbd_worker.c | ||
184 | +++ b/drivers/block/drbd/drbd_worker.c | ||
185 | @@ -269,8 +269,8 @@ void drbd_request_endio(struct bio *bio) | ||
186 | what = COMPLETED_OK; | ||
187 | } | ||
188 | |||
189 | - bio_put(req->private_bio); | ||
190 | req->private_bio = ERR_PTR(bio->bi_error); | ||
191 | + bio_put(bio); | ||
192 | |||
193 | /* not req_mod(), we need irqsave here! */ | ||
194 | spin_lock_irqsave(&device->resource->req_lock, flags); | ||
195 | diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c | ||
196 | index 67ea2ce03a23..39d0fdcb17d2 100644 | ||
197 | --- a/drivers/gpu/drm/udl/udl_fb.c | ||
198 | +++ b/drivers/gpu/drm/udl/udl_fb.c | ||
199 | @@ -136,7 +136,10 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y, | ||
200 | |||
201 | if (cmd > (char *) urb->transfer_buffer) { | ||
202 | /* Send partial buffer remaining before exiting */ | ||
203 | - int len = cmd - (char *) urb->transfer_buffer; | ||
204 | + int len; | ||
205 | + if (cmd < (char *) urb->transfer_buffer + urb->transfer_buffer_length) | ||
206 | + *cmd++ = 0xAF; | ||
207 | + len = cmd - (char *) urb->transfer_buffer; | ||
208 | ret = udl_submit_urb(dev, urb, len); | ||
209 | bytes_sent += len; | ||
210 | } else | ||
211 | diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c | ||
212 | index 917dcb978c2c..9259a2f8bf3a 100644 | ||
213 | --- a/drivers/gpu/drm/udl/udl_transfer.c | ||
214 | +++ b/drivers/gpu/drm/udl/udl_transfer.c | ||
215 | @@ -152,11 +152,11 @@ static void udl_compress_hline16( | ||
216 | raw_pixels_count_byte = cmd++; /* we'll know this later */ | ||
217 | raw_pixel_start = pixel; | ||
218 | |||
219 | - cmd_pixel_end = pixel + (min(MAX_CMD_PIXELS + 1, | ||
220 | - min((int)(pixel_end - pixel) / bpp, | ||
221 | - (int)(cmd_buffer_end - cmd) / 2))) * bpp; | ||
222 | + cmd_pixel_end = pixel + min3(MAX_CMD_PIXELS + 1UL, | ||
223 | + (unsigned long)(pixel_end - pixel) / bpp, | ||
224 | + (unsigned long)(cmd_buffer_end - 1 - cmd) / 2) * bpp; | ||
225 | |||
226 | - prefetch_range((void *) pixel, (cmd_pixel_end - pixel) * bpp); | ||
227 | + prefetch_range((void *) pixel, cmd_pixel_end - pixel); | ||
228 | pixel_val16 = get_pixel_val16(pixel, bpp); | ||
229 | |||
230 | while (pixel < cmd_pixel_end) { | ||
231 | @@ -192,6 +192,9 @@ static void udl_compress_hline16( | ||
232 | if (pixel > raw_pixel_start) { | ||
233 | /* finalize last RAW span */ | ||
234 | *raw_pixels_count_byte = ((pixel-raw_pixel_start) / bpp) & 0xFF; | ||
235 | + } else { | ||
236 | + /* undo unused byte */ | ||
237 | + cmd--; | ||
238 | } | ||
239 | |||
240 | *cmd_pixels_count_byte = ((pixel - cmd_pixel_start) / bpp) & 0xFF; | ||
241 | diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c | ||
242 | index acfb522a432a..29423691c105 100644 | ||
243 | --- a/drivers/hid/hid-debug.c | ||
244 | +++ b/drivers/hid/hid-debug.c | ||
245 | @@ -1152,6 +1152,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, | ||
246 | goto out; | ||
247 | if (list->tail > list->head) { | ||
248 | len = list->tail - list->head; | ||
249 | + if (len > count) | ||
250 | + len = count; | ||
251 | |||
252 | if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) { | ||
253 | ret = -EFAULT; | ||
254 | @@ -1161,6 +1163,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, | ||
255 | list->head += len; | ||
256 | } else { | ||
257 | len = HID_DEBUG_BUFSIZE - list->head; | ||
258 | + if (len > count) | ||
259 | + len = count; | ||
260 | |||
261 | if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) { | ||
262 | ret = -EFAULT; | ||
263 | @@ -1168,7 +1172,9 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, | ||
264 | } | ||
265 | list->head = 0; | ||
266 | ret += len; | ||
267 | - goto copy_rest; | ||
268 | + count -= len; | ||
269 | + if (count > 0) | ||
270 | + goto copy_rest; | ||
271 | } | ||
272 | |||
273 | } | ||
274 | diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c | ||
275 | index 2548c5dbdc75..00bce002b357 100644 | ||
276 | --- a/drivers/hid/i2c-hid/i2c-hid.c | ||
277 | +++ b/drivers/hid/i2c-hid/i2c-hid.c | ||
278 | @@ -477,7 +477,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid) | ||
279 | return; | ||
280 | } | ||
281 | |||
282 | - if ((ret_size > size) || (ret_size <= 2)) { | ||
283 | + if ((ret_size > size) || (ret_size < 2)) { | ||
284 | dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n", | ||
285 | __func__, size, ret_size); | ||
286 | return; | ||
287 | diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c | ||
288 | index 700145b15088..b59b15d4caa9 100644 | ||
289 | --- a/drivers/hid/usbhid/hiddev.c | ||
290 | +++ b/drivers/hid/usbhid/hiddev.c | ||
291 | @@ -35,6 +35,7 @@ | ||
292 | #include <linux/hiddev.h> | ||
293 | #include <linux/compat.h> | ||
294 | #include <linux/vmalloc.h> | ||
295 | +#include <linux/nospec.h> | ||
296 | #include "usbhid.h" | ||
297 | |||
298 | #ifdef CONFIG_USB_DYNAMIC_MINORS | ||
299 | @@ -478,10 +479,14 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, | ||
300 | |||
301 | if (uref->field_index >= report->maxfield) | ||
302 | goto inval; | ||
303 | + uref->field_index = array_index_nospec(uref->field_index, | ||
304 | + report->maxfield); | ||
305 | |||
306 | field = report->field[uref->field_index]; | ||
307 | if (uref->usage_index >= field->maxusage) | ||
308 | goto inval; | ||
309 | + uref->usage_index = array_index_nospec(uref->usage_index, | ||
310 | + field->maxusage); | ||
311 | |||
312 | uref->usage_code = field->usage[uref->usage_index].hid; | ||
313 | |||
314 | @@ -508,6 +513,8 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, | ||
315 | |||
316 | if (uref->field_index >= report->maxfield) | ||
317 | goto inval; | ||
318 | + uref->field_index = array_index_nospec(uref->field_index, | ||
319 | + report->maxfield); | ||
320 | |||
321 | field = report->field[uref->field_index]; | ||
322 | |||
323 | @@ -761,6 +768,8 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) | ||
324 | |||
325 | if (finfo.field_index >= report->maxfield) | ||
326 | break; | ||
327 | + finfo.field_index = array_index_nospec(finfo.field_index, | ||
328 | + report->maxfield); | ||
329 | |||
330 | field = report->field[finfo.field_index]; | ||
331 | memset(&finfo, 0, sizeof(finfo)); | ||
332 | @@ -801,6 +810,8 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) | ||
333 | |||
334 | if (cinfo.index >= hid->maxcollection) | ||
335 | break; | ||
336 | + cinfo.index = array_index_nospec(cinfo.index, | ||
337 | + hid->maxcollection); | ||
338 | |||
339 | cinfo.type = hid->collection[cinfo.index].type; | ||
340 | cinfo.usage = hid->collection[cinfo.index].usage; | ||
341 | diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c | ||
342 | index 726615e54f2a..c7592fe30e6e 100644 | ||
343 | --- a/drivers/i2c/busses/i2c-rcar.c | ||
344 | +++ b/drivers/i2c/busses/i2c-rcar.c | ||
345 | @@ -700,6 +700,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap, | ||
346 | |||
347 | pm_runtime_get_sync(dev); | ||
348 | |||
349 | + rcar_i2c_init(priv); | ||
350 | + | ||
351 | ret = rcar_i2c_bus_barrier(priv); | ||
352 | if (ret < 0) | ||
353 | goto out; | ||
354 | @@ -857,8 +859,6 @@ static int rcar_i2c_probe(struct platform_device *pdev) | ||
355 | if (ret < 0) | ||
356 | goto out_pm_put; | ||
357 | |||
358 | - rcar_i2c_init(priv); | ||
359 | - | ||
360 | /* Don't suspend when multi-master to keep arbitration working */ | ||
361 | if (of_property_read_bool(dev->of_node, "multi-master")) | ||
362 | priv->flags |= ID_P_PM_BLOCKED; | ||
363 | diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c | ||
364 | index 148b313c6471..d30b3b908621 100644 | ||
365 | --- a/drivers/infiniband/hw/hfi1/chip.c | ||
366 | +++ b/drivers/infiniband/hw/hfi1/chip.c | ||
367 | @@ -6717,7 +6717,7 @@ static void rxe_kernel_unfreeze(struct hfi1_devdata *dd) | ||
368 | for (i = 0; i < dd->n_krcv_queues; i++) { | ||
369 | rcvmask = HFI1_RCVCTRL_CTXT_ENB; | ||
370 | /* HFI1_RCVCTRL_TAILUPD_[ENB|DIS] needs to be set explicitly */ | ||
371 | - rcvmask |= HFI1_CAP_KGET_MASK(dd->rcd[i]->flags, DMA_RTAIL) ? | ||
372 | + rcvmask |= dd->rcd[i]->rcvhdrtail_kvaddr ? | ||
373 | HFI1_RCVCTRL_TAILUPD_ENB : HFI1_RCVCTRL_TAILUPD_DIS; | ||
374 | hfi1_rcvctrl(dd, rcvmask, i); | ||
375 | } | ||
376 | @@ -8211,7 +8211,7 @@ static inline int check_packet_present(struct hfi1_ctxtdata *rcd) | ||
377 | u32 tail; | ||
378 | int present; | ||
379 | |||
380 | - if (!HFI1_CAP_IS_KSET(DMA_RTAIL)) | ||
381 | + if (!rcd->rcvhdrtail_kvaddr) | ||
382 | present = (rcd->seq_cnt == | ||
383 | rhf_rcv_seq(rhf_to_cpu(get_rhf_addr(rcd)))); | ||
384 | else /* is RDMA rtail */ | ||
385 | @@ -11550,7 +11550,7 @@ void hfi1_rcvctrl(struct hfi1_devdata *dd, unsigned int op, int ctxt) | ||
386 | /* reset the tail and hdr addresses, and sequence count */ | ||
387 | write_kctxt_csr(dd, ctxt, RCV_HDR_ADDR, | ||
388 | rcd->rcvhdrq_dma); | ||
389 | - if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) | ||
390 | + if (rcd->rcvhdrtail_kvaddr) | ||
391 | write_kctxt_csr(dd, ctxt, RCV_HDR_TAIL_ADDR, | ||
392 | rcd->rcvhdrqtailaddr_dma); | ||
393 | rcd->seq_cnt = 1; | ||
394 | @@ -11630,7 +11630,7 @@ void hfi1_rcvctrl(struct hfi1_devdata *dd, unsigned int op, int ctxt) | ||
395 | rcvctrl |= RCV_CTXT_CTRL_INTR_AVAIL_SMASK; | ||
396 | if (op & HFI1_RCVCTRL_INTRAVAIL_DIS) | ||
397 | rcvctrl &= ~RCV_CTXT_CTRL_INTR_AVAIL_SMASK; | ||
398 | - if (op & HFI1_RCVCTRL_TAILUPD_ENB && rcd->rcvhdrqtailaddr_dma) | ||
399 | + if ((op & HFI1_RCVCTRL_TAILUPD_ENB) && rcd->rcvhdrtail_kvaddr) | ||
400 | rcvctrl |= RCV_CTXT_CTRL_TAIL_UPD_SMASK; | ||
401 | if (op & HFI1_RCVCTRL_TAILUPD_DIS) { | ||
402 | /* See comment on RcvCtxtCtrl.TailUpd above */ | ||
403 | diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c | ||
404 | index bb729764a799..d612f9d94083 100644 | ||
405 | --- a/drivers/infiniband/hw/hfi1/file_ops.c | ||
406 | +++ b/drivers/infiniband/hw/hfi1/file_ops.c | ||
407 | @@ -609,7 +609,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma) | ||
408 | ret = -EINVAL; | ||
409 | goto done; | ||
410 | } | ||
411 | - if (flags & VM_WRITE) { | ||
412 | + if ((flags & VM_WRITE) || !uctxt->rcvhdrtail_kvaddr) { | ||
413 | ret = -EPERM; | ||
414 | goto done; | ||
415 | } | ||
416 | diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c | ||
417 | index c81c44525dd5..9dc8cf096e2e 100644 | ||
418 | --- a/drivers/infiniband/hw/hfi1/init.c | ||
419 | +++ b/drivers/infiniband/hw/hfi1/init.c | ||
420 | @@ -1618,7 +1618,6 @@ int hfi1_create_rcvhdrq(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd) | ||
421 | u64 reg; | ||
422 | |||
423 | if (!rcd->rcvhdrq) { | ||
424 | - dma_addr_t dma_hdrqtail; | ||
425 | gfp_t gfp_flags; | ||
426 | |||
427 | /* | ||
428 | @@ -1641,13 +1640,13 @@ int hfi1_create_rcvhdrq(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd) | ||
429 | goto bail; | ||
430 | } | ||
431 | |||
432 | - if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) { | ||
433 | + if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL) || | ||
434 | + HFI1_CAP_UGET_MASK(rcd->flags, DMA_RTAIL)) { | ||
435 | rcd->rcvhdrtail_kvaddr = dma_zalloc_coherent( | ||
436 | - &dd->pcidev->dev, PAGE_SIZE, &dma_hdrqtail, | ||
437 | - gfp_flags); | ||
438 | + &dd->pcidev->dev, PAGE_SIZE, | ||
439 | + &rcd->rcvhdrqtailaddr_dma, gfp_flags); | ||
440 | if (!rcd->rcvhdrtail_kvaddr) | ||
441 | goto bail_free; | ||
442 | - rcd->rcvhdrqtailaddr_dma = dma_hdrqtail; | ||
443 | } | ||
444 | |||
445 | rcd->rcvhdrq_size = amt; | ||
446 | diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c | ||
447 | index 35fd57fdeba9..c837defb5e4d 100644 | ||
448 | --- a/drivers/md/dm-bufio.c | ||
449 | +++ b/drivers/md/dm-bufio.c | ||
450 | @@ -819,12 +819,14 @@ enum new_flag { | ||
451 | static struct dm_buffer *__alloc_buffer_wait_no_callback(struct dm_bufio_client *c, enum new_flag nf) | ||
452 | { | ||
453 | struct dm_buffer *b; | ||
454 | + bool tried_noio_alloc = false; | ||
455 | |||
456 | /* | ||
457 | * dm-bufio is resistant to allocation failures (it just keeps | ||
458 | * one buffer reserved in cases all the allocations fail). | ||
459 | * So set flags to not try too hard: | ||
460 | - * GFP_NOIO: don't recurse into the I/O layer | ||
461 | + * GFP_NOWAIT: don't wait; if we need to sleep we'll release our | ||
462 | + * mutex and wait ourselves. | ||
463 | * __GFP_NORETRY: don't retry and rather return failure | ||
464 | * __GFP_NOMEMALLOC: don't use emergency reserves | ||
465 | * __GFP_NOWARN: don't print a warning in case of failure | ||
466 | @@ -834,7 +836,7 @@ static struct dm_buffer *__alloc_buffer_wait_no_callback(struct dm_bufio_client | ||
467 | */ | ||
468 | while (1) { | ||
469 | if (dm_bufio_cache_size_latch != 1) { | ||
470 | - b = alloc_buffer(c, GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN); | ||
471 | + b = alloc_buffer(c, GFP_NOWAIT | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN); | ||
472 | if (b) | ||
473 | return b; | ||
474 | } | ||
475 | @@ -842,6 +844,15 @@ static struct dm_buffer *__alloc_buffer_wait_no_callback(struct dm_bufio_client | ||
476 | if (nf == NF_PREFETCH) | ||
477 | return NULL; | ||
478 | |||
479 | + if (dm_bufio_cache_size_latch != 1 && !tried_noio_alloc) { | ||
480 | + dm_bufio_unlock(c); | ||
481 | + b = alloc_buffer(c, GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN); | ||
482 | + dm_bufio_lock(c); | ||
483 | + if (b) | ||
484 | + return b; | ||
485 | + tried_noio_alloc = true; | ||
486 | + } | ||
487 | + | ||
488 | if (!list_empty(&c->reserved_buffers)) { | ||
489 | b = list_entry(c->reserved_buffers.next, | ||
490 | struct dm_buffer, lru_list); | ||
491 | @@ -1587,19 +1598,11 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) | ||
492 | static unsigned long | ||
493 | dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc) | ||
494 | { | ||
495 | - struct dm_bufio_client *c; | ||
496 | - unsigned long count; | ||
497 | - unsigned long retain_target; | ||
498 | - | ||
499 | - c = container_of(shrink, struct dm_bufio_client, shrinker); | ||
500 | - if (sc->gfp_mask & __GFP_FS) | ||
501 | - dm_bufio_lock(c); | ||
502 | - else if (!dm_bufio_trylock(c)) | ||
503 | - return 0; | ||
504 | + struct dm_bufio_client *c = container_of(shrink, struct dm_bufio_client, shrinker); | ||
505 | + unsigned long count = READ_ONCE(c->n_buffers[LIST_CLEAN]) + | ||
506 | + READ_ONCE(c->n_buffers[LIST_DIRTY]); | ||
507 | + unsigned long retain_target = get_retain_buffers(c); | ||
508 | |||
509 | - count = c->n_buffers[LIST_CLEAN] + c->n_buffers[LIST_DIRTY]; | ||
510 | - retain_target = get_retain_buffers(c); | ||
511 | - dm_bufio_unlock(c); | ||
512 | return (count < retain_target) ? 0 : (count - retain_target); | ||
513 | } | ||
514 | |||
515 | diff --git a/drivers/media/i2c/cx25840/cx25840-core.c b/drivers/media/i2c/cx25840/cx25840-core.c | ||
516 | index d558ed3e59c6..cc5666050282 100644 | ||
517 | --- a/drivers/media/i2c/cx25840/cx25840-core.c | ||
518 | +++ b/drivers/media/i2c/cx25840/cx25840-core.c | ||
519 | @@ -467,8 +467,13 @@ static void cx23885_initialize(struct i2c_client *client) | ||
520 | { | ||
521 | DEFINE_WAIT(wait); | ||
522 | struct cx25840_state *state = to_state(i2c_get_clientdata(client)); | ||
523 | + u32 clk_freq = 0; | ||
524 | struct workqueue_struct *q; | ||
525 | |||
526 | + /* cx23885 sets hostdata to clk_freq pointer */ | ||
527 | + if (v4l2_get_subdev_hostdata(&state->sd)) | ||
528 | + clk_freq = *((u32 *)v4l2_get_subdev_hostdata(&state->sd)); | ||
529 | + | ||
530 | /* | ||
531 | * Come out of digital power down | ||
532 | * The CX23888, at least, needs this, otherwise registers aside from | ||
533 | @@ -504,8 +509,13 @@ static void cx23885_initialize(struct i2c_client *client) | ||
534 | * 50.0 MHz * (0xb + 0xe8ba26/0x2000000)/4 = 5 * 28.636363 MHz | ||
535 | * 572.73 MHz before post divide | ||
536 | */ | ||
537 | - /* HVR1850 or 50MHz xtal */ | ||
538 | - cx25840_write(client, 0x2, 0x71); | ||
539 | + if (clk_freq == 25000000) { | ||
540 | + /* 888/ImpactVCBe or 25Mhz xtal */ | ||
541 | + ; /* nothing to do */ | ||
542 | + } else { | ||
543 | + /* HVR1850 or 50MHz xtal */ | ||
544 | + cx25840_write(client, 0x2, 0x71); | ||
545 | + } | ||
546 | cx25840_write4(client, 0x11c, 0x01d1744c); | ||
547 | cx25840_write4(client, 0x118, 0x00000416); | ||
548 | cx25840_write4(client, 0x404, 0x0010253e); | ||
549 | @@ -548,9 +558,15 @@ static void cx23885_initialize(struct i2c_client *client) | ||
550 | /* HVR1850 */ | ||
551 | switch (state->id) { | ||
552 | case CX23888_AV: | ||
553 | - /* 888/HVR1250 specific */ | ||
554 | - cx25840_write4(client, 0x10c, 0x13333333); | ||
555 | - cx25840_write4(client, 0x108, 0x00000515); | ||
556 | + if (clk_freq == 25000000) { | ||
557 | + /* 888/ImpactVCBe or 25MHz xtal */ | ||
558 | + cx25840_write4(client, 0x10c, 0x01b6db7b); | ||
559 | + cx25840_write4(client, 0x108, 0x00000512); | ||
560 | + } else { | ||
561 | + /* 888/HVR1250 or 50MHz xtal */ | ||
562 | + cx25840_write4(client, 0x10c, 0x13333333); | ||
563 | + cx25840_write4(client, 0x108, 0x00000515); | ||
564 | + } | ||
565 | break; | ||
566 | default: | ||
567 | cx25840_write4(client, 0x10c, 0x002be2c9); | ||
568 | @@ -580,7 +596,7 @@ static void cx23885_initialize(struct i2c_client *client) | ||
569 | * 368.64 MHz before post divide | ||
570 | * 122.88 MHz / 0xa = 12.288 MHz | ||
571 | */ | ||
572 | - /* HVR1850 or 50MHz xtal */ | ||
573 | + /* HVR1850 or 50MHz xtal or 25MHz xtal */ | ||
574 | cx25840_write4(client, 0x114, 0x017dbf48); | ||
575 | cx25840_write4(client, 0x110, 0x000a030e); | ||
576 | break; | ||
577 | diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c | ||
578 | index 33d025e42793..de35a2a362f9 100644 | ||
579 | --- a/drivers/mtd/chips/cfi_cmdset_0002.c | ||
580 | +++ b/drivers/mtd/chips/cfi_cmdset_0002.c | ||
581 | @@ -42,7 +42,7 @@ | ||
582 | #define AMD_BOOTLOC_BUG | ||
583 | #define FORCE_WORD_WRITE 0 | ||
584 | |||
585 | -#define MAX_WORD_RETRIES 3 | ||
586 | +#define MAX_RETRIES 3 | ||
587 | |||
588 | #define SST49LF004B 0x0060 | ||
589 | #define SST49LF040B 0x0050 | ||
590 | @@ -1643,7 +1643,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip, | ||
591 | map_write( map, CMD(0xF0), chip->start ); | ||
592 | /* FIXME - should have reset delay before continuing */ | ||
593 | |||
594 | - if (++retry_cnt <= MAX_WORD_RETRIES) | ||
595 | + if (++retry_cnt <= MAX_RETRIES) | ||
596 | goto retry; | ||
597 | |||
598 | ret = -EIO; | ||
599 | @@ -2102,7 +2102,7 @@ static int do_panic_write_oneword(struct map_info *map, struct flchip *chip, | ||
600 | map_write(map, CMD(0xF0), chip->start); | ||
601 | /* FIXME - should have reset delay before continuing */ | ||
602 | |||
603 | - if (++retry_cnt <= MAX_WORD_RETRIES) | ||
604 | + if (++retry_cnt <= MAX_RETRIES) | ||
605 | goto retry; | ||
606 | |||
607 | ret = -EIO; | ||
608 | @@ -2237,6 +2237,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) | ||
609 | unsigned long int adr; | ||
610 | DECLARE_WAITQUEUE(wait, current); | ||
611 | int ret = 0; | ||
612 | + int retry_cnt = 0; | ||
613 | |||
614 | adr = cfi->addr_unlock1; | ||
615 | |||
616 | @@ -2254,6 +2255,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) | ||
617 | ENABLE_VPP(map); | ||
618 | xip_disable(map, chip, adr); | ||
619 | |||
620 | + retry: | ||
621 | cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); | ||
622 | cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL); | ||
623 | cfi_send_gen_cmd(0x80, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); | ||
624 | @@ -2290,12 +2292,13 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) | ||
625 | chip->erase_suspended = 0; | ||
626 | } | ||
627 | |||
628 | - if (chip_ready(map, adr)) | ||
629 | + if (chip_good(map, adr, map_word_ff(map))) | ||
630 | break; | ||
631 | |||
632 | if (time_after(jiffies, timeo)) { | ||
633 | printk(KERN_WARNING "MTD %s(): software timeout\n", | ||
634 | __func__ ); | ||
635 | + ret = -EIO; | ||
636 | break; | ||
637 | } | ||
638 | |||
639 | @@ -2303,12 +2306,15 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) | ||
640 | UDELAY(map, chip, adr, 1000000/HZ); | ||
641 | } | ||
642 | /* Did we succeed? */ | ||
643 | - if (!chip_good(map, adr, map_word_ff(map))) { | ||
644 | + if (ret) { | ||
645 | /* reset on all failures. */ | ||
646 | map_write( map, CMD(0xF0), chip->start ); | ||
647 | /* FIXME - should have reset delay before continuing */ | ||
648 | |||
649 | - ret = -EIO; | ||
650 | + if (++retry_cnt <= MAX_RETRIES) { | ||
651 | + ret = 0; | ||
652 | + goto retry; | ||
653 | + } | ||
654 | } | ||
655 | |||
656 | chip->state = FL_READY; | ||
657 | @@ -2327,6 +2333,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, | ||
658 | unsigned long timeo = jiffies + HZ; | ||
659 | DECLARE_WAITQUEUE(wait, current); | ||
660 | int ret = 0; | ||
661 | + int retry_cnt = 0; | ||
662 | |||
663 | adr += chip->start; | ||
664 | |||
665 | @@ -2344,6 +2351,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, | ||
666 | ENABLE_VPP(map); | ||
667 | xip_disable(map, chip, adr); | ||
668 | |||
669 | + retry: | ||
670 | cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); | ||
671 | cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL); | ||
672 | cfi_send_gen_cmd(0x80, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); | ||
673 | @@ -2380,7 +2388,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, | ||
674 | chip->erase_suspended = 0; | ||
675 | } | ||
676 | |||
677 | - if (chip_ready(map, adr)) { | ||
678 | + if (chip_good(map, adr, map_word_ff(map))) { | ||
679 | xip_enable(map, chip, adr); | ||
680 | break; | ||
681 | } | ||
682 | @@ -2389,6 +2397,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, | ||
683 | xip_enable(map, chip, adr); | ||
684 | printk(KERN_WARNING "MTD %s(): software timeout\n", | ||
685 | __func__ ); | ||
686 | + ret = -EIO; | ||
687 | break; | ||
688 | } | ||
689 | |||
690 | @@ -2396,12 +2405,15 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, | ||
691 | UDELAY(map, chip, adr, 1000000/HZ); | ||
692 | } | ||
693 | /* Did we succeed? */ | ||
694 | - if (!chip_good(map, adr, map_word_ff(map))) { | ||
695 | + if (ret) { | ||
696 | /* reset on all failures. */ | ||
697 | map_write( map, CMD(0xF0), chip->start ); | ||
698 | /* FIXME - should have reset delay before continuing */ | ||
699 | |||
700 | - ret = -EIO; | ||
701 | + if (++retry_cnt <= MAX_RETRIES) { | ||
702 | + ret = 0; | ||
703 | + goto retry; | ||
704 | + } | ||
705 | } | ||
706 | |||
707 | chip->state = FL_READY; | ||
708 | diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c | ||
709 | index 0c84ee80e5b6..5c44eb57885b 100644 | ||
710 | --- a/drivers/mtd/nand/mxc_nand.c | ||
711 | +++ b/drivers/mtd/nand/mxc_nand.c | ||
712 | @@ -48,7 +48,7 @@ | ||
713 | #define NFC_V1_V2_CONFIG (host->regs + 0x0a) | ||
714 | #define NFC_V1_V2_ECC_STATUS_RESULT (host->regs + 0x0c) | ||
715 | #define NFC_V1_V2_RSLTMAIN_AREA (host->regs + 0x0e) | ||
716 | -#define NFC_V1_V2_RSLTSPARE_AREA (host->regs + 0x10) | ||
717 | +#define NFC_V21_RSLTSPARE_AREA (host->regs + 0x10) | ||
718 | #define NFC_V1_V2_WRPROT (host->regs + 0x12) | ||
719 | #define NFC_V1_UNLOCKSTART_BLKADDR (host->regs + 0x14) | ||
720 | #define NFC_V1_UNLOCKEND_BLKADDR (host->regs + 0x16) | ||
721 | @@ -1121,6 +1121,9 @@ static void preset_v2(struct mtd_info *mtd) | ||
722 | writew(config1, NFC_V1_V2_CONFIG1); | ||
723 | /* preset operation */ | ||
724 | |||
725 | + /* spare area size in 16-bit half-words */ | ||
726 | + writew(mtd->oobsize / 2, NFC_V21_RSLTSPARE_AREA); | ||
727 | + | ||
728 | /* Unlock the internal RAM Buffer */ | ||
729 | writew(0x2, NFC_V1_V2_CONFIG); | ||
730 | |||
731 | diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c | ||
732 | index d50350c7adc4..22a5916e477e 100644 | ||
733 | --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c | ||
734 | +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c | ||
735 | @@ -4187,10 +4187,6 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *dev, | ||
736 | if (netif_is_lag_port(dev) && is_vlan_dev(upper_dev) && | ||
737 | !netif_is_lag_master(vlan_dev_real_dev(upper_dev))) | ||
738 | return -EINVAL; | ||
739 | - if (!info->linking) | ||
740 | - break; | ||
741 | - if (netdev_has_any_upper_dev(upper_dev)) | ||
742 | - return -EINVAL; | ||
743 | break; | ||
744 | case NETDEV_CHANGEUPPER: | ||
745 | upper_dev = info->upper_dev; | ||
746 | @@ -4566,6 +4562,8 @@ static int mlxsw_sp_netdevice_vport_event(struct net_device *dev, | ||
747 | return -EINVAL; | ||
748 | if (!info->linking) | ||
749 | break; | ||
750 | + if (netdev_has_any_upper_dev(upper_dev)) | ||
751 | + return -EINVAL; | ||
752 | /* We can't have multiple VLAN interfaces configured on | ||
753 | * the same port and being members in the same bridge. | ||
754 | */ | ||
755 | diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c | ||
756 | index 2032a6de026b..707190d3ada0 100644 | ||
757 | --- a/drivers/net/phy/micrel.c | ||
758 | +++ b/drivers/net/phy/micrel.c | ||
759 | @@ -801,9 +801,6 @@ static struct phy_driver ksphy_driver[] = { | ||
760 | .read_status = genphy_read_status, | ||
761 | .ack_interrupt = kszphy_ack_interrupt, | ||
762 | .config_intr = kszphy_config_intr, | ||
763 | - .get_sset_count = kszphy_get_sset_count, | ||
764 | - .get_strings = kszphy_get_strings, | ||
765 | - .get_stats = kszphy_get_stats, | ||
766 | .suspend = genphy_suspend, | ||
767 | .resume = genphy_resume, | ||
768 | }, { | ||
769 | @@ -948,9 +945,6 @@ static struct phy_driver ksphy_driver[] = { | ||
770 | .read_status = genphy_read_status, | ||
771 | .ack_interrupt = kszphy_ack_interrupt, | ||
772 | .config_intr = kszphy_config_intr, | ||
773 | - .get_sset_count = kszphy_get_sset_count, | ||
774 | - .get_strings = kszphy_get_strings, | ||
775 | - .get_stats = kszphy_get_stats, | ||
776 | .suspend = genphy_suspend, | ||
777 | .resume = genphy_resume, | ||
778 | }, { | ||
779 | @@ -960,6 +954,7 @@ static struct phy_driver ksphy_driver[] = { | ||
780 | .features = (PHY_GBIT_FEATURES | SUPPORTED_Pause), | ||
781 | .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT, | ||
782 | .driver_data = &ksz9021_type, | ||
783 | + .probe = kszphy_probe, | ||
784 | .config_init = ksz9021_config_init, | ||
785 | .config_aneg = genphy_config_aneg, | ||
786 | .read_status = genphy_read_status, | ||
787 | @@ -979,6 +974,7 @@ static struct phy_driver ksphy_driver[] = { | ||
788 | .features = (PHY_GBIT_FEATURES | SUPPORTED_Pause), | ||
789 | .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT, | ||
790 | .driver_data = &ksz9021_type, | ||
791 | + .probe = kszphy_probe, | ||
792 | .config_init = ksz9031_config_init, | ||
793 | .config_aneg = genphy_config_aneg, | ||
794 | .read_status = ksz9031_read_status, | ||
795 | @@ -998,9 +994,6 @@ static struct phy_driver ksphy_driver[] = { | ||
796 | .config_init = kszphy_config_init, | ||
797 | .config_aneg = ksz8873mll_config_aneg, | ||
798 | .read_status = ksz8873mll_read_status, | ||
799 | - .get_sset_count = kszphy_get_sset_count, | ||
800 | - .get_strings = kszphy_get_strings, | ||
801 | - .get_stats = kszphy_get_stats, | ||
802 | .suspend = genphy_suspend, | ||
803 | .resume = genphy_resume, | ||
804 | }, { | ||
805 | @@ -1012,9 +1005,6 @@ static struct phy_driver ksphy_driver[] = { | ||
806 | .config_init = kszphy_config_init, | ||
807 | .config_aneg = genphy_config_aneg, | ||
808 | .read_status = genphy_read_status, | ||
809 | - .get_sset_count = kszphy_get_sset_count, | ||
810 | - .get_strings = kszphy_get_strings, | ||
811 | - .get_stats = kszphy_get_stats, | ||
812 | .suspend = genphy_suspend, | ||
813 | .resume = genphy_resume, | ||
814 | }, { | ||
815 | @@ -1026,9 +1016,6 @@ static struct phy_driver ksphy_driver[] = { | ||
816 | .config_init = kszphy_config_init, | ||
817 | .config_aneg = ksz8873mll_config_aneg, | ||
818 | .read_status = ksz8873mll_read_status, | ||
819 | - .get_sset_count = kszphy_get_sset_count, | ||
820 | - .get_strings = kszphy_get_strings, | ||
821 | - .get_stats = kszphy_get_stats, | ||
822 | .suspend = genphy_suspend, | ||
823 | .resume = genphy_resume, | ||
824 | } }; | ||
825 | diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c | ||
826 | index 0f81d739f9e9..2065a0f9dca6 100644 | ||
827 | --- a/drivers/scsi/sg.c | ||
828 | +++ b/drivers/scsi/sg.c | ||
829 | @@ -51,6 +51,7 @@ static int sg_version_num = 30536; /* 2 digits for each component */ | ||
830 | #include <linux/atomic.h> | ||
831 | #include <linux/ratelimit.h> | ||
832 | #include <linux/uio.h> | ||
833 | +#include <linux/cred.h> /* for sg_check_file_access() */ | ||
834 | |||
835 | #include "scsi.h" | ||
836 | #include <scsi/scsi_dbg.h> | ||
837 | @@ -210,6 +211,33 @@ static void sg_device_destroy(struct kref *kref); | ||
838 | sdev_prefix_printk(prefix, (sdp)->device, \ | ||
839 | (sdp)->disk->disk_name, fmt, ##a) | ||
840 | |||
841 | +/* | ||
842 | + * The SCSI interfaces that use read() and write() as an asynchronous variant of | ||
843 | + * ioctl(..., SG_IO, ...) are fundamentally unsafe, since there are lots of ways | ||
844 | + * to trigger read() and write() calls from various contexts with elevated | ||
845 | + * privileges. This can lead to kernel memory corruption (e.g. if these | ||
846 | + * interfaces are called through splice()) and privilege escalation inside | ||
847 | + * userspace (e.g. if a process with access to such a device passes a file | ||
848 | + * descriptor to a SUID binary as stdin/stdout/stderr). | ||
849 | + * | ||
850 | + * This function provides protection for the legacy API by restricting the | ||
851 | + * calling context. | ||
852 | + */ | ||
853 | +static int sg_check_file_access(struct file *filp, const char *caller) | ||
854 | +{ | ||
855 | + if (filp->f_cred != current_real_cred()) { | ||
856 | + pr_err_once("%s: process %d (%s) changed security contexts after opening file descriptor, this is not allowed.\n", | ||
857 | + caller, task_tgid_vnr(current), current->comm); | ||
858 | + return -EPERM; | ||
859 | + } | ||
860 | + if (unlikely(segment_eq(get_fs(), KERNEL_DS))) { | ||
861 | + pr_err_once("%s: process %d (%s) called from kernel context, this is not allowed.\n", | ||
862 | + caller, task_tgid_vnr(current), current->comm); | ||
863 | + return -EACCES; | ||
864 | + } | ||
865 | + return 0; | ||
866 | +} | ||
867 | + | ||
868 | static int sg_allow_access(struct file *filp, unsigned char *cmd) | ||
869 | { | ||
870 | struct sg_fd *sfp = filp->private_data; | ||
871 | @@ -394,6 +422,14 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) | ||
872 | struct sg_header *old_hdr = NULL; | ||
873 | int retval = 0; | ||
874 | |||
875 | + /* | ||
876 | + * This could cause a response to be stranded. Close the associated | ||
877 | + * file descriptor to free up any resources being held. | ||
878 | + */ | ||
879 | + retval = sg_check_file_access(filp, __func__); | ||
880 | + if (retval) | ||
881 | + return retval; | ||
882 | + | ||
883 | if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))) | ||
884 | return -ENXIO; | ||
885 | SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, | ||
886 | @@ -581,9 +617,11 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) | ||
887 | struct sg_header old_hdr; | ||
888 | sg_io_hdr_t *hp; | ||
889 | unsigned char cmnd[SG_MAX_CDB_SIZE]; | ||
890 | + int retval; | ||
891 | |||
892 | - if (unlikely(segment_eq(get_fs(), KERNEL_DS))) | ||
893 | - return -EINVAL; | ||
894 | + retval = sg_check_file_access(filp, __func__); | ||
895 | + if (retval) | ||
896 | + return retval; | ||
897 | |||
898 | if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))) | ||
899 | return -ENXIO; | ||
900 | diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c | ||
901 | index 4e5c0f17f579..c2a7cb95725b 100644 | ||
902 | --- a/drivers/staging/android/ion/ion_heap.c | ||
903 | +++ b/drivers/staging/android/ion/ion_heap.c | ||
904 | @@ -38,7 +38,7 @@ void *ion_heap_map_kernel(struct ion_heap *heap, | ||
905 | struct page **tmp = pages; | ||
906 | |||
907 | if (!pages) | ||
908 | - return NULL; | ||
909 | + return ERR_PTR(-ENOMEM); | ||
910 | |||
911 | if (buffer->flags & ION_FLAG_CACHED) | ||
912 | pgprot = PAGE_KERNEL; | ||
913 | diff --git a/drivers/staging/comedi/drivers/quatech_daqp_cs.c b/drivers/staging/comedi/drivers/quatech_daqp_cs.c | ||
914 | index 802f51e46405..171960568356 100644 | ||
915 | --- a/drivers/staging/comedi/drivers/quatech_daqp_cs.c | ||
916 | +++ b/drivers/staging/comedi/drivers/quatech_daqp_cs.c | ||
917 | @@ -642,7 +642,7 @@ static int daqp_ao_insn_write(struct comedi_device *dev, | ||
918 | /* Make sure D/A update mode is direct update */ | ||
919 | outb(0, dev->iobase + DAQP_AUX_REG); | ||
920 | |||
921 | - for (i = 0; i > insn->n; i++) { | ||
922 | + for (i = 0; i < insn->n; i++) { | ||
923 | unsigned int val = data[i]; | ||
924 | int ret; | ||
925 | |||
926 | diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c | ||
927 | index 1c70541a1467..0475f9685a41 100644 | ||
928 | --- a/drivers/tty/n_tty.c | ||
929 | +++ b/drivers/tty/n_tty.c | ||
930 | @@ -126,6 +126,8 @@ struct n_tty_data { | ||
931 | struct mutex output_lock; | ||
932 | }; | ||
933 | |||
934 | +#define MASK(x) ((x) & (N_TTY_BUF_SIZE - 1)) | ||
935 | + | ||
936 | static inline size_t read_cnt(struct n_tty_data *ldata) | ||
937 | { | ||
938 | return ldata->read_head - ldata->read_tail; | ||
939 | @@ -143,6 +145,7 @@ static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i) | ||
940 | |||
941 | static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i) | ||
942 | { | ||
943 | + smp_rmb(); /* Matches smp_wmb() in add_echo_byte(). */ | ||
944 | return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)]; | ||
945 | } | ||
946 | |||
947 | @@ -318,9 +321,7 @@ static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata) | ||
948 | static void reset_buffer_flags(struct n_tty_data *ldata) | ||
949 | { | ||
950 | ldata->read_head = ldata->canon_head = ldata->read_tail = 0; | ||
951 | - ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0; | ||
952 | ldata->commit_head = 0; | ||
953 | - ldata->echo_mark = 0; | ||
954 | ldata->line_start = 0; | ||
955 | |||
956 | ldata->erasing = 0; | ||
957 | @@ -619,12 +620,19 @@ static size_t __process_echoes(struct tty_struct *tty) | ||
958 | old_space = space = tty_write_room(tty); | ||
959 | |||
960 | tail = ldata->echo_tail; | ||
961 | - while (ldata->echo_commit != tail) { | ||
962 | + while (MASK(ldata->echo_commit) != MASK(tail)) { | ||
963 | c = echo_buf(ldata, tail); | ||
964 | if (c == ECHO_OP_START) { | ||
965 | unsigned char op; | ||
966 | int no_space_left = 0; | ||
967 | |||
968 | + /* | ||
969 | + * Since add_echo_byte() is called without holding | ||
970 | + * output_lock, we might see only portion of multi-byte | ||
971 | + * operation. | ||
972 | + */ | ||
973 | + if (MASK(ldata->echo_commit) == MASK(tail + 1)) | ||
974 | + goto not_yet_stored; | ||
975 | /* | ||
976 | * If the buffer byte is the start of a multi-byte | ||
977 | * operation, get the next byte, which is either the | ||
978 | @@ -636,6 +644,8 @@ static size_t __process_echoes(struct tty_struct *tty) | ||
979 | unsigned int num_chars, num_bs; | ||
980 | |||
981 | case ECHO_OP_ERASE_TAB: | ||
982 | + if (MASK(ldata->echo_commit) == MASK(tail + 2)) | ||
983 | + goto not_yet_stored; | ||
984 | num_chars = echo_buf(ldata, tail + 2); | ||
985 | |||
986 | /* | ||
987 | @@ -730,7 +740,8 @@ static size_t __process_echoes(struct tty_struct *tty) | ||
988 | /* If the echo buffer is nearly full (so that the possibility exists | ||
989 | * of echo overrun before the next commit), then discard enough | ||
990 | * data at the tail to prevent a subsequent overrun */ | ||
991 | - while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) { | ||
992 | + while (ldata->echo_commit > tail && | ||
993 | + ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) { | ||
994 | if (echo_buf(ldata, tail) == ECHO_OP_START) { | ||
995 | if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB) | ||
996 | tail += 3; | ||
997 | @@ -740,6 +751,7 @@ static size_t __process_echoes(struct tty_struct *tty) | ||
998 | tail++; | ||
999 | } | ||
1000 | |||
1001 | + not_yet_stored: | ||
1002 | ldata->echo_tail = tail; | ||
1003 | return old_space - space; | ||
1004 | } | ||
1005 | @@ -750,6 +762,7 @@ static void commit_echoes(struct tty_struct *tty) | ||
1006 | size_t nr, old, echoed; | ||
1007 | size_t head; | ||
1008 | |||
1009 | + mutex_lock(&ldata->output_lock); | ||
1010 | head = ldata->echo_head; | ||
1011 | ldata->echo_mark = head; | ||
1012 | old = ldata->echo_commit - ldata->echo_tail; | ||
1013 | @@ -758,10 +771,12 @@ static void commit_echoes(struct tty_struct *tty) | ||
1014 | * is over the threshold (and try again each time another | ||
1015 | * block is accumulated) */ | ||
1016 | nr = head - ldata->echo_tail; | ||
1017 | - if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK)) | ||
1018 | + if (nr < ECHO_COMMIT_WATERMARK || | ||
1019 | + (nr % ECHO_BLOCK > old % ECHO_BLOCK)) { | ||
1020 | + mutex_unlock(&ldata->output_lock); | ||
1021 | return; | ||
1022 | + } | ||
1023 | |||
1024 | - mutex_lock(&ldata->output_lock); | ||
1025 | ldata->echo_commit = head; | ||
1026 | echoed = __process_echoes(tty); | ||
1027 | mutex_unlock(&ldata->output_lock); | ||
1028 | @@ -812,7 +827,9 @@ static void flush_echoes(struct tty_struct *tty) | ||
1029 | |||
1030 | static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata) | ||
1031 | { | ||
1032 | - *echo_buf_addr(ldata, ldata->echo_head++) = c; | ||
1033 | + *echo_buf_addr(ldata, ldata->echo_head) = c; | ||
1034 | + smp_wmb(); /* Matches smp_rmb() in echo_buf(). */ | ||
1035 | + ldata->echo_head++; | ||
1036 | } | ||
1037 | |||
1038 | /** | ||
1039 | @@ -980,14 +997,15 @@ static void eraser(unsigned char c, struct tty_struct *tty) | ||
1040 | } | ||
1041 | |||
1042 | seen_alnums = 0; | ||
1043 | - while (ldata->read_head != ldata->canon_head) { | ||
1044 | + while (MASK(ldata->read_head) != MASK(ldata->canon_head)) { | ||
1045 | head = ldata->read_head; | ||
1046 | |||
1047 | /* erase a single possibly multibyte character */ | ||
1048 | do { | ||
1049 | head--; | ||
1050 | c = read_buf(ldata, head); | ||
1051 | - } while (is_continuation(c, tty) && head != ldata->canon_head); | ||
1052 | + } while (is_continuation(c, tty) && | ||
1053 | + MASK(head) != MASK(ldata->canon_head)); | ||
1054 | |||
1055 | /* do not partially erase */ | ||
1056 | if (is_continuation(c, tty)) | ||
1057 | @@ -1029,7 +1047,7 @@ static void eraser(unsigned char c, struct tty_struct *tty) | ||
1058 | * This info is used to go back the correct | ||
1059 | * number of columns. | ||
1060 | */ | ||
1061 | - while (tail != ldata->canon_head) { | ||
1062 | + while (MASK(tail) != MASK(ldata->canon_head)) { | ||
1063 | tail--; | ||
1064 | c = read_buf(ldata, tail); | ||
1065 | if (c == '\t') { | ||
1066 | @@ -1304,7 +1322,7 @@ n_tty_receive_char_special(struct tty_struct *tty, unsigned char c) | ||
1067 | finish_erasing(ldata); | ||
1068 | echo_char(c, tty); | ||
1069 | echo_char_raw('\n', ldata); | ||
1070 | - while (tail != ldata->read_head) { | ||
1071 | + while (MASK(tail) != MASK(ldata->read_head)) { | ||
1072 | echo_char(read_buf(ldata, tail), tty); | ||
1073 | tail++; | ||
1074 | } | ||
1075 | @@ -1880,30 +1898,21 @@ static int n_tty_open(struct tty_struct *tty) | ||
1076 | struct n_tty_data *ldata; | ||
1077 | |||
1078 | /* Currently a malloc failure here can panic */ | ||
1079 | - ldata = vmalloc(sizeof(*ldata)); | ||
1080 | + ldata = vzalloc(sizeof(*ldata)); | ||
1081 | if (!ldata) | ||
1082 | - goto err; | ||
1083 | + return -ENOMEM; | ||
1084 | |||
1085 | ldata->overrun_time = jiffies; | ||
1086 | mutex_init(&ldata->atomic_read_lock); | ||
1087 | mutex_init(&ldata->output_lock); | ||
1088 | |||
1089 | tty->disc_data = ldata; | ||
1090 | - reset_buffer_flags(tty->disc_data); | ||
1091 | - ldata->column = 0; | ||
1092 | - ldata->canon_column = 0; | ||
1093 | - ldata->num_overrun = 0; | ||
1094 | - ldata->no_room = 0; | ||
1095 | - ldata->lnext = 0; | ||
1096 | tty->closing = 0; | ||
1097 | /* indicate buffer work may resume */ | ||
1098 | clear_bit(TTY_LDISC_HALTED, &tty->flags); | ||
1099 | n_tty_set_termios(tty, NULL); | ||
1100 | tty_unthrottle(tty); | ||
1101 | - | ||
1102 | return 0; | ||
1103 | -err: | ||
1104 | - return -ENOMEM; | ||
1105 | } | ||
1106 | |||
1107 | static inline int input_available_p(struct tty_struct *tty, int poll) | ||
1108 | @@ -2413,7 +2422,7 @@ static unsigned long inq_canon(struct n_tty_data *ldata) | ||
1109 | tail = ldata->read_tail; | ||
1110 | nr = head - tail; | ||
1111 | /* Skip EOF-chars.. */ | ||
1112 | - while (head != tail) { | ||
1113 | + while (MASK(head) != MASK(tail)) { | ||
1114 | if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) && | ||
1115 | read_buf(ldata, tail) == __DISABLED_CHAR) | ||
1116 | nr--; | ||
1117 | diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c | ||
1118 | index 9e1ac58e269e..9d3e413f48c6 100644 | ||
1119 | --- a/drivers/tty/vt/vt.c | ||
1120 | +++ b/drivers/tty/vt/vt.c | ||
1121 | @@ -785,7 +785,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */ | ||
1122 | if (!*vc->vc_uni_pagedir_loc) | ||
1123 | con_set_default_unimap(vc); | ||
1124 | |||
1125 | - vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size, GFP_KERNEL); | ||
1126 | + vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL); | ||
1127 | if (!vc->vc_screenbuf) | ||
1128 | goto err_free; | ||
1129 | |||
1130 | @@ -872,7 +872,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, | ||
1131 | |||
1132 | if (new_screen_size > (4 << 20)) | ||
1133 | return -EINVAL; | ||
1134 | - newscreen = kmalloc(new_screen_size, GFP_USER); | ||
1135 | + newscreen = kzalloc(new_screen_size, GFP_USER); | ||
1136 | if (!newscreen) | ||
1137 | return -ENOMEM; | ||
1138 | |||
1139 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c | ||
1140 | index fe22ac7c760a..08bef18372ea 100644 | ||
1141 | --- a/drivers/usb/class/cdc-acm.c | ||
1142 | +++ b/drivers/usb/class/cdc-acm.c | ||
1143 | @@ -1712,6 +1712,9 @@ static const struct usb_device_id acm_ids[] = { | ||
1144 | { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */ | ||
1145 | .driver_info = SINGLE_RX_URB, | ||
1146 | }, | ||
1147 | + { USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */ | ||
1148 | + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ | ||
1149 | + }, | ||
1150 | { USB_DEVICE(0x22b8, 0x7000), /* Motorola Q Phone */ | ||
1151 | .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ | ||
1152 | }, | ||
1153 | diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c | ||
1154 | index 13754353251f..9669184fb1fe 100644 | ||
1155 | --- a/drivers/usb/dwc2/hcd_queue.c | ||
1156 | +++ b/drivers/usb/dwc2/hcd_queue.c | ||
1157 | @@ -479,7 +479,7 @@ static unsigned long *dwc2_get_ls_map(struct dwc2_hsotg *hsotg, | ||
1158 | /* Get the map and adjust if this is a multi_tt hub */ | ||
1159 | map = qh->dwc_tt->periodic_bitmaps; | ||
1160 | if (qh->dwc_tt->usb_tt->multi) | ||
1161 | - map += DWC2_ELEMENTS_PER_LS_BITMAP * qh->ttport; | ||
1162 | + map += DWC2_ELEMENTS_PER_LS_BITMAP * (qh->ttport - 1); | ||
1163 | |||
1164 | return map; | ||
1165 | } | ||
1166 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c | ||
1167 | index 46b4dea7a0ec..6f2c77a7c08e 100644 | ||
1168 | --- a/drivers/usb/serial/cp210x.c | ||
1169 | +++ b/drivers/usb/serial/cp210x.c | ||
1170 | @@ -92,6 +92,9 @@ static const struct usb_device_id id_table[] = { | ||
1171 | { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */ | ||
1172 | { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */ | ||
1173 | { USB_DEVICE(0x10C4, 0x815F) }, /* Timewave HamLinkUSB */ | ||
1174 | + { USB_DEVICE(0x10C4, 0x817C) }, /* CESINEL MEDCAL N Power Quality Monitor */ | ||
1175 | + { USB_DEVICE(0x10C4, 0x817D) }, /* CESINEL MEDCAL NT Power Quality Monitor */ | ||
1176 | + { USB_DEVICE(0x10C4, 0x817E) }, /* CESINEL MEDCAL S Power Quality Monitor */ | ||
1177 | { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */ | ||
1178 | { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */ | ||
1179 | { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */ | ||
1180 | @@ -109,6 +112,9 @@ static const struct usb_device_id id_table[] = { | ||
1181 | { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */ | ||
1182 | { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */ | ||
1183 | { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */ | ||
1184 | + { USB_DEVICE(0x10C4, 0x82EF) }, /* CESINEL FALCO 6105 AC Power Supply */ | ||
1185 | + { USB_DEVICE(0x10C4, 0x82F1) }, /* CESINEL MEDCAL EFD Earth Fault Detector */ | ||
1186 | + { USB_DEVICE(0x10C4, 0x82F2) }, /* CESINEL MEDCAL ST Network Analyzer */ | ||
1187 | { USB_DEVICE(0x10C4, 0x82F4) }, /* Starizona MicroTouch */ | ||
1188 | { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */ | ||
1189 | { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */ | ||
1190 | @@ -121,7 +127,9 @@ static const struct usb_device_id id_table[] = { | ||
1191 | { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ | ||
1192 | { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ | ||
1193 | { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ | ||
1194 | + { USB_DEVICE(0x10C4, 0x851E) }, /* CESINEL MEDCAL PT Network Analyzer */ | ||
1195 | { USB_DEVICE(0x10C4, 0x85A7) }, /* LifeScan OneTouch Verio IQ */ | ||
1196 | + { USB_DEVICE(0x10C4, 0x85B8) }, /* CESINEL ReCon T Energy Logger */ | ||
1197 | { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ | ||
1198 | { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ | ||
1199 | { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ | ||
1200 | @@ -131,17 +139,23 @@ static const struct usb_device_id id_table[] = { | ||
1201 | { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ | ||
1202 | { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ | ||
1203 | { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ | ||
1204 | + { USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer */ | ||
1205 | + { USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer */ | ||
1206 | { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ | ||
1207 | { USB_DEVICE(0x10C4, 0x8962) }, /* Brim Brothers charging dock */ | ||
1208 | { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ | ||
1209 | { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ | ||
1210 | + { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */ | ||
1211 | { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ | ||
1212 | { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ | ||
1213 | { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ | ||
1214 | { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ | ||
1215 | { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ | ||
1216 | + { USB_DEVICE(0x10C4, 0xEA63) }, /* Silicon Labs Windows Update (CP2101-4/CP2102N) */ | ||
1217 | { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ | ||
1218 | { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ | ||
1219 | + { USB_DEVICE(0x10C4, 0xEA7A) }, /* Silicon Labs Windows Update (CP2105) */ | ||
1220 | + { USB_DEVICE(0x10C4, 0xEA7B) }, /* Silicon Labs Windows Update (CP2108) */ | ||
1221 | { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */ | ||
1222 | { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */ | ||
1223 | { USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */ | ||
1224 | diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c | ||
1225 | index d57222894892..8407b07428a6 100644 | ||
1226 | --- a/fs/cifs/cifssmb.c | ||
1227 | +++ b/fs/cifs/cifssmb.c | ||
1228 | @@ -150,8 +150,14 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) | ||
1229 | * greater than cifs socket timeout which is 7 seconds | ||
1230 | */ | ||
1231 | while (server->tcpStatus == CifsNeedReconnect) { | ||
1232 | - wait_event_interruptible_timeout(server->response_q, | ||
1233 | - (server->tcpStatus != CifsNeedReconnect), 10 * HZ); | ||
1234 | + rc = wait_event_interruptible_timeout(server->response_q, | ||
1235 | + (server->tcpStatus != CifsNeedReconnect), | ||
1236 | + 10 * HZ); | ||
1237 | + if (rc < 0) { | ||
1238 | + cifs_dbg(FYI, "%s: aborting reconnect due to a received" | ||
1239 | + " signal by the process\n", __func__); | ||
1240 | + return -ERESTARTSYS; | ||
1241 | + } | ||
1242 | |||
1243 | /* are we still trying to reconnect? */ | ||
1244 | if (server->tcpStatus != CifsNeedReconnect) | ||
1245 | diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c | ||
1246 | index e0214334769b..4ded64b8b43b 100644 | ||
1247 | --- a/fs/cifs/smb2pdu.c | ||
1248 | +++ b/fs/cifs/smb2pdu.c | ||
1249 | @@ -155,7 +155,7 @@ smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ , | ||
1250 | static int | ||
1251 | smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) | ||
1252 | { | ||
1253 | - int rc = 0; | ||
1254 | + int rc; | ||
1255 | struct nls_table *nls_codepage; | ||
1256 | struct cifs_ses *ses; | ||
1257 | struct TCP_Server_Info *server; | ||
1258 | @@ -166,10 +166,10 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) | ||
1259 | * for those three - in the calling routine. | ||
1260 | */ | ||
1261 | if (tcon == NULL) | ||
1262 | - return rc; | ||
1263 | + return 0; | ||
1264 | |||
1265 | if (smb2_command == SMB2_TREE_CONNECT) | ||
1266 | - return rc; | ||
1267 | + return 0; | ||
1268 | |||
1269 | if (tcon->tidStatus == CifsExiting) { | ||
1270 | /* | ||
1271 | @@ -212,8 +212,14 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) | ||
1272 | return -EAGAIN; | ||
1273 | } | ||
1274 | |||
1275 | - wait_event_interruptible_timeout(server->response_q, | ||
1276 | - (server->tcpStatus != CifsNeedReconnect), 10 * HZ); | ||
1277 | + rc = wait_event_interruptible_timeout(server->response_q, | ||
1278 | + (server->tcpStatus != CifsNeedReconnect), | ||
1279 | + 10 * HZ); | ||
1280 | + if (rc < 0) { | ||
1281 | + cifs_dbg(FYI, "%s: aborting reconnect due to a received" | ||
1282 | + " signal by the process\n", __func__); | ||
1283 | + return -ERESTARTSYS; | ||
1284 | + } | ||
1285 | |||
1286 | /* are we still trying to reconnect? */ | ||
1287 | if (server->tcpStatus != CifsNeedReconnect) | ||
1288 | @@ -231,7 +237,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) | ||
1289 | } | ||
1290 | |||
1291 | if (!tcon->ses->need_reconnect && !tcon->need_reconnect) | ||
1292 | - return rc; | ||
1293 | + return 0; | ||
1294 | |||
1295 | nls_codepage = load_nls_default(); | ||
1296 | |||
1297 | diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c | ||
1298 | index 6776f4aa3d12..ad13f07cf0d3 100644 | ||
1299 | --- a/fs/ext4/balloc.c | ||
1300 | +++ b/fs/ext4/balloc.c | ||
1301 | @@ -183,7 +183,6 @@ static int ext4_init_block_bitmap(struct super_block *sb, | ||
1302 | unsigned int bit, bit_max; | ||
1303 | struct ext4_sb_info *sbi = EXT4_SB(sb); | ||
1304 | ext4_fsblk_t start, tmp; | ||
1305 | - int flex_bg = 0; | ||
1306 | struct ext4_group_info *grp; | ||
1307 | |||
1308 | J_ASSERT_BH(bh, buffer_locked(bh)); | ||
1309 | @@ -216,22 +215,19 @@ static int ext4_init_block_bitmap(struct super_block *sb, | ||
1310 | |||
1311 | start = ext4_group_first_block_no(sb, block_group); | ||
1312 | |||
1313 | - if (ext4_has_feature_flex_bg(sb)) | ||
1314 | - flex_bg = 1; | ||
1315 | - | ||
1316 | /* Set bits for block and inode bitmaps, and inode table */ | ||
1317 | tmp = ext4_block_bitmap(sb, gdp); | ||
1318 | - if (!flex_bg || ext4_block_in_group(sb, tmp, block_group)) | ||
1319 | + if (ext4_block_in_group(sb, tmp, block_group)) | ||
1320 | ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data); | ||
1321 | |||
1322 | tmp = ext4_inode_bitmap(sb, gdp); | ||
1323 | - if (!flex_bg || ext4_block_in_group(sb, tmp, block_group)) | ||
1324 | + if (ext4_block_in_group(sb, tmp, block_group)) | ||
1325 | ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data); | ||
1326 | |||
1327 | tmp = ext4_inode_table(sb, gdp); | ||
1328 | for (; tmp < ext4_inode_table(sb, gdp) + | ||
1329 | sbi->s_itb_per_group; tmp++) { | ||
1330 | - if (!flex_bg || ext4_block_in_group(sb, tmp, block_group)) | ||
1331 | + if (ext4_block_in_group(sb, tmp, block_group)) | ||
1332 | ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data); | ||
1333 | } | ||
1334 | |||
1335 | @@ -454,7 +450,16 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group) | ||
1336 | goto verify; | ||
1337 | } | ||
1338 | ext4_lock_group(sb, block_group); | ||
1339 | - if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { | ||
1340 | + if (ext4_has_group_desc_csum(sb) && | ||
1341 | + (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { | ||
1342 | + if (block_group == 0) { | ||
1343 | + ext4_unlock_group(sb, block_group); | ||
1344 | + unlock_buffer(bh); | ||
1345 | + ext4_error(sb, "Block bitmap for bg 0 marked " | ||
1346 | + "uninitialized"); | ||
1347 | + err = -EFSCORRUPTED; | ||
1348 | + goto out; | ||
1349 | + } | ||
1350 | err = ext4_init_block_bitmap(sb, bh, block_group, desc); | ||
1351 | set_bitmap_uptodate(bh); | ||
1352 | set_buffer_uptodate(bh); | ||
1353 | diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h | ||
1354 | index a8a750f59621..43e27d8ec770 100644 | ||
1355 | --- a/fs/ext4/ext4.h | ||
1356 | +++ b/fs/ext4/ext4.h | ||
1357 | @@ -1542,11 +1542,6 @@ static inline struct timespec ext4_current_time(struct inode *inode) | ||
1358 | static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino) | ||
1359 | { | ||
1360 | return ino == EXT4_ROOT_INO || | ||
1361 | - ino == EXT4_USR_QUOTA_INO || | ||
1362 | - ino == EXT4_GRP_QUOTA_INO || | ||
1363 | - ino == EXT4_BOOT_LOADER_INO || | ||
1364 | - ino == EXT4_JOURNAL_INO || | ||
1365 | - ino == EXT4_RESIZE_INO || | ||
1366 | (ino >= EXT4_FIRST_INO(sb) && | ||
1367 | ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)); | ||
1368 | } | ||
1369 | diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h | ||
1370 | index 8ecf84b8f5a1..a284fb28944b 100644 | ||
1371 | --- a/fs/ext4/ext4_extents.h | ||
1372 | +++ b/fs/ext4/ext4_extents.h | ||
1373 | @@ -103,6 +103,7 @@ struct ext4_extent_header { | ||
1374 | }; | ||
1375 | |||
1376 | #define EXT4_EXT_MAGIC cpu_to_le16(0xf30a) | ||
1377 | +#define EXT4_MAX_EXTENT_DEPTH 5 | ||
1378 | |||
1379 | #define EXT4_EXTENT_TAIL_OFFSET(hdr) \ | ||
1380 | (sizeof(struct ext4_extent_header) + \ | ||
1381 | diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c | ||
1382 | index 63c702b4b24c..106a5bb3ae68 100644 | ||
1383 | --- a/fs/ext4/extents.c | ||
1384 | +++ b/fs/ext4/extents.c | ||
1385 | @@ -881,6 +881,12 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, | ||
1386 | |||
1387 | eh = ext_inode_hdr(inode); | ||
1388 | depth = ext_depth(inode); | ||
1389 | + if (depth < 0 || depth > EXT4_MAX_EXTENT_DEPTH) { | ||
1390 | + EXT4_ERROR_INODE(inode, "inode has invalid extent depth: %d", | ||
1391 | + depth); | ||
1392 | + ret = -EFSCORRUPTED; | ||
1393 | + goto err; | ||
1394 | + } | ||
1395 | |||
1396 | if (path) { | ||
1397 | ext4_ext_drop_refs(path); | ||
1398 | diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c | ||
1399 | index dcf63daefee0..460866b2166d 100644 | ||
1400 | --- a/fs/ext4/ialloc.c | ||
1401 | +++ b/fs/ext4/ialloc.c | ||
1402 | @@ -152,7 +152,16 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group) | ||
1403 | } | ||
1404 | |||
1405 | ext4_lock_group(sb, block_group); | ||
1406 | - if (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)) { | ||
1407 | + if (ext4_has_group_desc_csum(sb) && | ||
1408 | + (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT))) { | ||
1409 | + if (block_group == 0) { | ||
1410 | + ext4_unlock_group(sb, block_group); | ||
1411 | + unlock_buffer(bh); | ||
1412 | + ext4_error(sb, "Inode bitmap for bg 0 marked " | ||
1413 | + "uninitialized"); | ||
1414 | + err = -EFSCORRUPTED; | ||
1415 | + goto out; | ||
1416 | + } | ||
1417 | memset(bh->b_data, 0, (EXT4_INODES_PER_GROUP(sb) + 7) / 8); | ||
1418 | ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), | ||
1419 | sb->s_blocksize * 8, bh->b_data); | ||
1420 | @@ -926,7 +935,8 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir, | ||
1421 | |||
1422 | /* recheck and clear flag under lock if we still need to */ | ||
1423 | ext4_lock_group(sb, group); | ||
1424 | - if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { | ||
1425 | + if (ext4_has_group_desc_csum(sb) && | ||
1426 | + (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { | ||
1427 | gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT); | ||
1428 | ext4_free_group_clusters_set(sb, gdp, | ||
1429 | ext4_free_clusters_after_init(sb, group, gdp)); | ||
1430 | diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c | ||
1431 | index 73cbc01ef5ad..e6ac24de119d 100644 | ||
1432 | --- a/fs/ext4/inline.c | ||
1433 | +++ b/fs/ext4/inline.c | ||
1434 | @@ -434,6 +434,7 @@ static int ext4_destroy_inline_data_nolock(handle_t *handle, | ||
1435 | |||
1436 | memset((void *)ext4_raw_inode(&is.iloc)->i_block, | ||
1437 | 0, EXT4_MIN_INLINE_DATA_SIZE); | ||
1438 | + memset(ei->i_data, 0, EXT4_MIN_INLINE_DATA_SIZE); | ||
1439 | |||
1440 | if (ext4_has_feature_extents(inode->i_sb)) { | ||
1441 | if (S_ISDIR(inode->i_mode) || | ||
1442 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c | ||
1443 | index 7c025ee1276f..5c4c9af4aaf4 100644 | ||
1444 | --- a/fs/ext4/inode.c | ||
1445 | +++ b/fs/ext4/inode.c | ||
1446 | @@ -377,9 +377,9 @@ static int __check_block_validity(struct inode *inode, const char *func, | ||
1447 | if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), map->m_pblk, | ||
1448 | map->m_len)) { | ||
1449 | ext4_error_inode(inode, func, line, map->m_pblk, | ||
1450 | - "lblock %lu mapped to illegal pblock " | ||
1451 | + "lblock %lu mapped to illegal pblock %llu " | ||
1452 | "(length %d)", (unsigned long) map->m_lblk, | ||
1453 | - map->m_len); | ||
1454 | + map->m_pblk, map->m_len); | ||
1455 | return -EFSCORRUPTED; | ||
1456 | } | ||
1457 | return 0; | ||
1458 | @@ -4242,7 +4242,8 @@ static int __ext4_get_inode_loc(struct inode *inode, | ||
1459 | int inodes_per_block, inode_offset; | ||
1460 | |||
1461 | iloc->bh = NULL; | ||
1462 | - if (!ext4_valid_inum(sb, inode->i_ino)) | ||
1463 | + if (inode->i_ino < EXT4_ROOT_INO || | ||
1464 | + inode->i_ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)) | ||
1465 | return -EFSCORRUPTED; | ||
1466 | |||
1467 | iloc->block_group = (inode->i_ino - 1) / EXT4_INODES_PER_GROUP(sb); | ||
1468 | diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c | ||
1469 | index 14bd37041e1a..53e1890660a2 100644 | ||
1470 | --- a/fs/ext4/mballoc.c | ||
1471 | +++ b/fs/ext4/mballoc.c | ||
1472 | @@ -2444,7 +2444,8 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group, | ||
1473 | * initialize bb_free to be able to skip | ||
1474 | * empty groups without initialization | ||
1475 | */ | ||
1476 | - if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { | ||
1477 | + if (ext4_has_group_desc_csum(sb) && | ||
1478 | + (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { | ||
1479 | meta_group_info[i]->bb_free = | ||
1480 | ext4_free_clusters_after_init(sb, group, desc); | ||
1481 | } else { | ||
1482 | @@ -2969,7 +2970,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, | ||
1483 | #endif | ||
1484 | ext4_set_bits(bitmap_bh->b_data, ac->ac_b_ex.fe_start, | ||
1485 | ac->ac_b_ex.fe_len); | ||
1486 | - if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { | ||
1487 | + if (ext4_has_group_desc_csum(sb) && | ||
1488 | + (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { | ||
1489 | gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT); | ||
1490 | ext4_free_group_clusters_set(sb, gdp, | ||
1491 | ext4_free_clusters_after_init(sb, | ||
1492 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c | ||
1493 | index bfb83d76d128..41ef83471ea5 100644 | ||
1494 | --- a/fs/ext4/super.c | ||
1495 | +++ b/fs/ext4/super.c | ||
1496 | @@ -2231,6 +2231,7 @@ static int ext4_check_descriptors(struct super_block *sb, | ||
1497 | struct ext4_sb_info *sbi = EXT4_SB(sb); | ||
1498 | ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block); | ||
1499 | ext4_fsblk_t last_block; | ||
1500 | + ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1; | ||
1501 | ext4_fsblk_t block_bitmap; | ||
1502 | ext4_fsblk_t inode_bitmap; | ||
1503 | ext4_fsblk_t inode_table; | ||
1504 | @@ -2263,6 +2264,14 @@ static int ext4_check_descriptors(struct super_block *sb, | ||
1505 | if (!(sb->s_flags & MS_RDONLY)) | ||
1506 | return 0; | ||
1507 | } | ||
1508 | + if (block_bitmap >= sb_block + 1 && | ||
1509 | + block_bitmap <= last_bg_block) { | ||
1510 | + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " | ||
1511 | + "Block bitmap for group %u overlaps " | ||
1512 | + "block group descriptors", i); | ||
1513 | + if (!(sb->s_flags & MS_RDONLY)) | ||
1514 | + return 0; | ||
1515 | + } | ||
1516 | if (block_bitmap < first_block || block_bitmap > last_block) { | ||
1517 | ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " | ||
1518 | "Block bitmap for group %u not in group " | ||
1519 | @@ -2277,6 +2286,14 @@ static int ext4_check_descriptors(struct super_block *sb, | ||
1520 | if (!(sb->s_flags & MS_RDONLY)) | ||
1521 | return 0; | ||
1522 | } | ||
1523 | + if (inode_bitmap >= sb_block + 1 && | ||
1524 | + inode_bitmap <= last_bg_block) { | ||
1525 | + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " | ||
1526 | + "Inode bitmap for group %u overlaps " | ||
1527 | + "block group descriptors", i); | ||
1528 | + if (!(sb->s_flags & MS_RDONLY)) | ||
1529 | + return 0; | ||
1530 | + } | ||
1531 | if (inode_bitmap < first_block || inode_bitmap > last_block) { | ||
1532 | ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " | ||
1533 | "Inode bitmap for group %u not in group " | ||
1534 | @@ -2291,6 +2308,14 @@ static int ext4_check_descriptors(struct super_block *sb, | ||
1535 | if (!(sb->s_flags & MS_RDONLY)) | ||
1536 | return 0; | ||
1537 | } | ||
1538 | + if (inode_table >= sb_block + 1 && | ||
1539 | + inode_table <= last_bg_block) { | ||
1540 | + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " | ||
1541 | + "Inode table for group %u overlaps " | ||
1542 | + "block group descriptors", i); | ||
1543 | + if (!(sb->s_flags & MS_RDONLY)) | ||
1544 | + return 0; | ||
1545 | + } | ||
1546 | if (inode_table < first_block || | ||
1547 | inode_table + sbi->s_itb_per_group - 1 > last_block) { | ||
1548 | ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " | ||
1549 | @@ -2998,13 +3023,22 @@ static ext4_group_t ext4_has_uninit_itable(struct super_block *sb) | ||
1550 | ext4_group_t group, ngroups = EXT4_SB(sb)->s_groups_count; | ||
1551 | struct ext4_group_desc *gdp = NULL; | ||
1552 | |||
1553 | + if (!ext4_has_group_desc_csum(sb)) | ||
1554 | + return ngroups; | ||
1555 | + | ||
1556 | for (group = 0; group < ngroups; group++) { | ||
1557 | gdp = ext4_get_group_desc(sb, group, NULL); | ||
1558 | if (!gdp) | ||
1559 | continue; | ||
1560 | |||
1561 | - if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))) | ||
1562 | + if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)) | ||
1563 | + continue; | ||
1564 | + if (group != 0) | ||
1565 | break; | ||
1566 | + ext4_error(sb, "Inode table for bg 0 marked as " | ||
1567 | + "needing zeroing"); | ||
1568 | + if (sb->s_flags & MS_RDONLY) | ||
1569 | + return ngroups; | ||
1570 | } | ||
1571 | |||
1572 | return group; | ||
1573 | @@ -3622,6 +3656,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) | ||
1574 | le32_to_cpu(es->s_log_block_size)); | ||
1575 | goto failed_mount; | ||
1576 | } | ||
1577 | + if (le32_to_cpu(es->s_log_cluster_size) > | ||
1578 | + (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { | ||
1579 | + ext4_msg(sb, KERN_ERR, | ||
1580 | + "Invalid log cluster size: %u", | ||
1581 | + le32_to_cpu(es->s_log_cluster_size)); | ||
1582 | + goto failed_mount; | ||
1583 | + } | ||
1584 | |||
1585 | if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) { | ||
1586 | ext4_msg(sb, KERN_ERR, | ||
1587 | @@ -3679,6 +3720,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) | ||
1588 | } else { | ||
1589 | sbi->s_inode_size = le16_to_cpu(es->s_inode_size); | ||
1590 | sbi->s_first_ino = le32_to_cpu(es->s_first_ino); | ||
1591 | + if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) { | ||
1592 | + ext4_msg(sb, KERN_ERR, "invalid first ino: %u", | ||
1593 | + sbi->s_first_ino); | ||
1594 | + goto failed_mount; | ||
1595 | + } | ||
1596 | if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) || | ||
1597 | (!is_power_of_2(sbi->s_inode_size)) || | ||
1598 | (sbi->s_inode_size > blocksize)) { | ||
1599 | @@ -3755,13 +3801,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) | ||
1600 | "block size (%d)", clustersize, blocksize); | ||
1601 | goto failed_mount; | ||
1602 | } | ||
1603 | - if (le32_to_cpu(es->s_log_cluster_size) > | ||
1604 | - (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { | ||
1605 | - ext4_msg(sb, KERN_ERR, | ||
1606 | - "Invalid log cluster size: %u", | ||
1607 | - le32_to_cpu(es->s_log_cluster_size)); | ||
1608 | - goto failed_mount; | ||
1609 | - } | ||
1610 | sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) - | ||
1611 | le32_to_cpu(es->s_log_block_size); | ||
1612 | sbi->s_clusters_per_group = | ||
1613 | @@ -3782,10 +3821,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) | ||
1614 | } | ||
1615 | } else { | ||
1616 | if (clustersize != blocksize) { | ||
1617 | - ext4_warning(sb, "fragment/cluster size (%d) != " | ||
1618 | - "block size (%d)", clustersize, | ||
1619 | - blocksize); | ||
1620 | - clustersize = blocksize; | ||
1621 | + ext4_msg(sb, KERN_ERR, | ||
1622 | + "fragment/cluster size (%d) != " | ||
1623 | + "block size (%d)", clustersize, blocksize); | ||
1624 | + goto failed_mount; | ||
1625 | } | ||
1626 | if (sbi->s_blocks_per_group > blocksize * 8) { | ||
1627 | ext4_msg(sb, KERN_ERR, | ||
1628 | @@ -3839,6 +3878,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) | ||
1629 | ext4_blocks_count(es)); | ||
1630 | goto failed_mount; | ||
1631 | } | ||
1632 | + if ((es->s_first_data_block == 0) && (es->s_log_block_size == 0) && | ||
1633 | + (sbi->s_cluster_ratio == 1)) { | ||
1634 | + ext4_msg(sb, KERN_WARNING, "bad geometry: first data " | ||
1635 | + "block is 0 with a 1k block and cluster size"); | ||
1636 | + goto failed_mount; | ||
1637 | + } | ||
1638 | + | ||
1639 | blocks_count = (ext4_blocks_count(es) - | ||
1640 | le32_to_cpu(es->s_first_data_block) + | ||
1641 | EXT4_BLOCKS_PER_GROUP(sb) - 1); | ||
1642 | @@ -3874,6 +3920,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) | ||
1643 | ret = -ENOMEM; | ||
1644 | goto failed_mount; | ||
1645 | } | ||
1646 | + if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != | ||
1647 | + le32_to_cpu(es->s_inodes_count)) { | ||
1648 | + ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", | ||
1649 | + le32_to_cpu(es->s_inodes_count), | ||
1650 | + ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); | ||
1651 | + ret = -EINVAL; | ||
1652 | + goto failed_mount; | ||
1653 | + } | ||
1654 | |||
1655 | bgl_lock_init(sbi->s_blockgroup_lock); | ||
1656 | |||
1657 | @@ -4575,6 +4629,14 @@ static int ext4_commit_super(struct super_block *sb, int sync) | ||
1658 | |||
1659 | if (!sbh || block_device_ejected(sb)) | ||
1660 | return error; | ||
1661 | + | ||
1662 | + /* | ||
1663 | + * The superblock bh should be mapped, but it might not be if the | ||
1664 | + * device was hot-removed. Not much we can do but fail the I/O. | ||
1665 | + */ | ||
1666 | + if (!buffer_mapped(sbh)) | ||
1667 | + return error; | ||
1668 | + | ||
1669 | /* | ||
1670 | * If the file system is mounted read-only, don't update the | ||
1671 | * superblock write time. This avoids updating the superblock | ||
1672 | diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c | ||
1673 | index 9e9e0936138b..b320c1ba7fdc 100644 | ||
1674 | --- a/fs/jbd2/transaction.c | ||
1675 | +++ b/fs/jbd2/transaction.c | ||
1676 | @@ -1353,6 +1353,13 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) | ||
1677 | if (jh->b_transaction == transaction && | ||
1678 | jh->b_jlist != BJ_Metadata) { | ||
1679 | jbd_lock_bh_state(bh); | ||
1680 | + if (jh->b_transaction == transaction && | ||
1681 | + jh->b_jlist != BJ_Metadata) | ||
1682 | + pr_err("JBD2: assertion failure: h_type=%u " | ||
1683 | + "h_line_no=%u block_no=%llu jlist=%u\n", | ||
1684 | + handle->h_type, handle->h_line_no, | ||
1685 | + (unsigned long long) bh->b_blocknr, | ||
1686 | + jh->b_jlist); | ||
1687 | J_ASSERT_JH(jh, jh->b_transaction != transaction || | ||
1688 | jh->b_jlist == BJ_Metadata); | ||
1689 | jbd_unlock_bh_state(bh); | ||
1690 | @@ -1372,11 +1379,11 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) | ||
1691 | * of the transaction. This needs to be done | ||
1692 | * once a transaction -bzzz | ||
1693 | */ | ||
1694 | - jh->b_modified = 1; | ||
1695 | if (handle->h_buffer_credits <= 0) { | ||
1696 | ret = -ENOSPC; | ||
1697 | goto out_unlock_bh; | ||
1698 | } | ||
1699 | + jh->b_modified = 1; | ||
1700 | handle->h_buffer_credits--; | ||
1701 | } | ||
1702 | |||
1703 | diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c | ||
1704 | index a17cb1d8415c..01e71812e174 100644 | ||
1705 | --- a/kernel/trace/trace_functions_graph.c | ||
1706 | +++ b/kernel/trace/trace_functions_graph.c | ||
1707 | @@ -830,6 +830,7 @@ print_graph_entry_leaf(struct trace_iterator *iter, | ||
1708 | struct ftrace_graph_ret *graph_ret; | ||
1709 | struct ftrace_graph_ent *call; | ||
1710 | unsigned long long duration; | ||
1711 | + int cpu = iter->cpu; | ||
1712 | int i; | ||
1713 | |||
1714 | graph_ret = &ret_entry->ret; | ||
1715 | @@ -838,7 +839,6 @@ print_graph_entry_leaf(struct trace_iterator *iter, | ||
1716 | |||
1717 | if (data) { | ||
1718 | struct fgraph_cpu_data *cpu_data; | ||
1719 | - int cpu = iter->cpu; | ||
1720 | |||
1721 | cpu_data = per_cpu_ptr(data->cpu_data, cpu); | ||
1722 | |||
1723 | @@ -868,6 +868,9 @@ print_graph_entry_leaf(struct trace_iterator *iter, | ||
1724 | |||
1725 | trace_seq_printf(s, "%ps();\n", (void *)call->func); | ||
1726 | |||
1727 | + print_graph_irq(iter, graph_ret->func, TRACE_GRAPH_RET, | ||
1728 | + cpu, iter->ent->pid, flags); | ||
1729 | + | ||
1730 | return trace_handle_return(s); | ||
1731 | } | ||
1732 | |||
1733 | diff --git a/mm/hugetlb.c b/mm/hugetlb.c | ||
1734 | index 6ff65c405243..f9e735537c37 100644 | ||
1735 | --- a/mm/hugetlb.c | ||
1736 | +++ b/mm/hugetlb.c | ||
1737 | @@ -2171,6 +2171,7 @@ static void __init gather_bootmem_prealloc(void) | ||
1738 | */ | ||
1739 | if (hstate_is_gigantic(h)) | ||
1740 | adjust_managed_page_count(page, 1 << h->order); | ||
1741 | + cond_resched(); | ||
1742 | } | ||
1743 | } | ||
1744 | |||
1745 | diff --git a/mm/page_alloc.c b/mm/page_alloc.c | ||
1746 | index 94018ea5f935..28240ce475d6 100644 | ||
1747 | --- a/mm/page_alloc.c | ||
1748 | +++ b/mm/page_alloc.c | ||
1749 | @@ -3642,7 +3642,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, | ||
1750 | * orientated. | ||
1751 | */ | ||
1752 | if (!(alloc_flags & ALLOC_CPUSET) || (alloc_flags & ALLOC_NO_WATERMARKS)) { | ||
1753 | - ac->zonelist = node_zonelist(numa_node_id(), gfp_mask); | ||
1754 | ac->preferred_zoneref = first_zones_zonelist(ac->zonelist, | ||
1755 | ac->high_zoneidx, ac->nodemask); | ||
1756 | } | ||
1757 | diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c | ||
1758 | index d476b7950adf..a88dab33cdf6 100644 | ||
1759 | --- a/net/ipv4/fib_semantics.c | ||
1760 | +++ b/net/ipv4/fib_semantics.c | ||
1761 | @@ -980,7 +980,7 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg) | ||
1762 | return -EINVAL; | ||
1763 | } else { | ||
1764 | if (nla_len(nla) != sizeof(u32)) | ||
1765 | - return false; | ||
1766 | + return -EINVAL; | ||
1767 | val = nla_get_u32(nla); | ||
1768 | } | ||
1769 | if (type == RTAX_ADVMSS && val > 65535 - 40) | ||
1770 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c | ||
1771 | index ae0485d776f4..fc7ca1e46908 100644 | ||
1772 | --- a/net/ipv6/sit.c | ||
1773 | +++ b/net/ipv6/sit.c | ||
1774 | @@ -659,7 +659,6 @@ static int ipip6_rcv(struct sk_buff *skb) | ||
1775 | if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6), | ||
1776 | !net_eq(tunnel->net, dev_net(tunnel->dev)))) | ||
1777 | goto out; | ||
1778 | - iph = ip_hdr(skb); | ||
1779 | |||
1780 | err = IP_ECN_decapsulate(iph, skb); | ||
1781 | if (unlikely(err)) { | ||
1782 | diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c | ||
1783 | index ffb9e8ada899..e02fed784cd0 100644 | ||
1784 | --- a/net/netfilter/nf_log.c | ||
1785 | +++ b/net/netfilter/nf_log.c | ||
1786 | @@ -444,14 +444,17 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write, | ||
1787 | rcu_assign_pointer(net->nf.nf_loggers[tindex], logger); | ||
1788 | mutex_unlock(&nf_log_mutex); | ||
1789 | } else { | ||
1790 | + struct ctl_table tmp = *table; | ||
1791 | + | ||
1792 | + tmp.data = buf; | ||
1793 | mutex_lock(&nf_log_mutex); | ||
1794 | logger = nft_log_dereference(net->nf.nf_loggers[tindex]); | ||
1795 | if (!logger) | ||
1796 | - table->data = "NONE"; | ||
1797 | + strlcpy(buf, "NONE", sizeof(buf)); | ||
1798 | else | ||
1799 | - table->data = logger->name; | ||
1800 | - r = proc_dostring(table, write, buffer, lenp, ppos); | ||
1801 | + strlcpy(buf, logger->name, sizeof(buf)); | ||
1802 | mutex_unlock(&nf_log_mutex); | ||
1803 | + r = proc_dostring(&tmp, write, buffer, lenp, ppos); | ||
1804 | } | ||
1805 | |||
1806 | return r; | ||
1807 | diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c | ||
1808 | index 0dd5c695482f..9d593ecd8e87 100644 | ||
1809 | --- a/net/netfilter/nf_tables_core.c | ||
1810 | +++ b/net/netfilter/nf_tables_core.c | ||
1811 | @@ -185,7 +185,8 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) | ||
1812 | |||
1813 | switch (regs.verdict.code) { | ||
1814 | case NFT_JUMP: | ||
1815 | - BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE); | ||
1816 | + if (WARN_ON_ONCE(stackptr >= NFT_JUMP_STACK_SIZE)) | ||
1817 | + return NF_DROP; | ||
1818 | jumpstack[stackptr].chain = chain; | ||
1819 | jumpstack[stackptr].rule = rule; | ||
1820 | jumpstack[stackptr].rulenum = rulenum; | ||
1821 | diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include | ||
1822 | index 179219845dfc..63774307a751 100644 | ||
1823 | --- a/scripts/Kbuild.include | ||
1824 | +++ b/scripts/Kbuild.include | ||
1825 | @@ -8,6 +8,7 @@ squote := ' | ||
1826 | empty := | ||
1827 | space := $(empty) $(empty) | ||
1828 | space_escape := _-_SPACE_-_ | ||
1829 | +pound := \# | ||
1830 | |||
1831 | ### | ||
1832 | # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o | ||
1833 | @@ -241,11 +242,11 @@ endif | ||
1834 | |||
1835 | # Replace >$< with >$$< to preserve $ when reloading the .cmd file | ||
1836 | # (needed for make) | ||
1837 | -# Replace >#< with >\#< to avoid starting a comment in the .cmd file | ||
1838 | +# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file | ||
1839 | # (needed for make) | ||
1840 | # Replace >'< with >'\''< to be able to enclose the whole string in '...' | ||
1841 | # (needed for the shell) | ||
1842 | -make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1))))) | ||
1843 | +make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1))))) | ||
1844 | |||
1845 | # Find any prerequisites that is newer than target or that does not exist. | ||
1846 | # PHONY targets skipped in both cases. | ||
1847 | diff --git a/tools/build/Build.include b/tools/build/Build.include | ||
1848 | index 1dcb95e76f70..b8165545ddf6 100644 | ||
1849 | --- a/tools/build/Build.include | ||
1850 | +++ b/tools/build/Build.include | ||
1851 | @@ -12,6 +12,7 @@ | ||
1852 | # Convenient variables | ||
1853 | comma := , | ||
1854 | squote := ' | ||
1855 | +pound := \# | ||
1856 | |||
1857 | ### | ||
1858 | # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o | ||
1859 | @@ -43,11 +44,11 @@ echo-cmd = $(if $($(quiet)cmd_$(1)),\ | ||
1860 | ### | ||
1861 | # Replace >$< with >$$< to preserve $ when reloading the .cmd file | ||
1862 | # (needed for make) | ||
1863 | -# Replace >#< with >\#< to avoid starting a comment in the .cmd file | ||
1864 | +# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file | ||
1865 | # (needed for make) | ||
1866 | # Replace >'< with >'\''< to be able to enclose the whole string in '...' | ||
1867 | # (needed for the shell) | ||
1868 | -make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1))))) | ||
1869 | +make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1))))) | ||
1870 | |||
1871 | ### | ||
1872 | # Find any prerequisites that is newer than target or that does not exist. | ||
1873 | diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile | ||
1874 | index e6acc281dd37..8ae824dbfca3 100644 | ||
1875 | --- a/tools/objtool/Makefile | ||
1876 | +++ b/tools/objtool/Makefile | ||
1877 | @@ -35,7 +35,7 @@ CFLAGS += -Wall -Werror $(WARNINGS) -fomit-frame-pointer -O2 -g $(INCLUDES) | ||
1878 | LDFLAGS += -lelf $(LIBSUBCMD) | ||
1879 | |||
1880 | # Allow old libelf to be used: | ||
1881 | -elfshdr := $(shell echo '\#include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr) | ||
1882 | +elfshdr := $(shell echo '$(pound)include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr) | ||
1883 | CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED) | ||
1884 | |||
1885 | AWK = awk | ||
1886 | diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include | ||
1887 | index 19edc1a7a232..7ea4438b801d 100644 | ||
1888 | --- a/tools/scripts/Makefile.include | ||
1889 | +++ b/tools/scripts/Makefile.include | ||
1890 | @@ -92,3 +92,5 @@ ifneq ($(silent),1) | ||
1891 | QUIET_INSTALL = @printf ' INSTALL %s\n' $1; | ||
1892 | endif | ||
1893 | endif | ||
1894 | + | ||
1895 | +pound := \# |