Annotation of /trunk/kernel-alx/patches-4.9/0217-4.9.118-all-fixes.patch
Parent Directory | Revision Log
Revision 3194 -
(hide annotations)
(download)
Wed Aug 8 14:17:43 2018 UTC (6 years, 1 month ago) by niro
File size: 27736 byte(s)
Wed Aug 8 14:17:43 2018 UTC (6 years, 1 month ago) by niro
File size: 27736 byte(s)
-linux-4.9.118
1 | niro | 3194 | diff --git a/Makefile b/Makefile |
2 | index 773c26c95d98..0940f11fa071 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 9 | ||
8 | -SUBLEVEL = 117 | ||
9 | +SUBLEVEL = 118 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Roaring Lionus | ||
12 | |||
13 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c | ||
14 | index 4e0292e0aafb..30b74b491909 100644 | ||
15 | --- a/arch/x86/kvm/vmx.c | ||
16 | +++ b/arch/x86/kvm/vmx.c | ||
17 | @@ -7085,6 +7085,8 @@ static int handle_vmon(struct kvm_vcpu *vcpu) | ||
18 | HRTIMER_MODE_REL_PINNED); | ||
19 | vmx->nested.preemption_timer.function = vmx_preemption_timer_fn; | ||
20 | |||
21 | + vmx->nested.vpid02 = allocate_vpid(); | ||
22 | + | ||
23 | vmx->nested.vmxon = true; | ||
24 | |||
25 | skip_emulated_instruction(vcpu); | ||
26 | @@ -9264,10 +9266,8 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) | ||
27 | goto free_vmcs; | ||
28 | } | ||
29 | |||
30 | - if (nested) { | ||
31 | + if (nested) | ||
32 | nested_vmx_setup_ctls_msrs(vmx); | ||
33 | - vmx->nested.vpid02 = allocate_vpid(); | ||
34 | - } | ||
35 | |||
36 | vmx->nested.posted_intr_nv = -1; | ||
37 | vmx->nested.current_vmptr = -1ull; | ||
38 | @@ -9285,7 +9285,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) | ||
39 | return &vmx->vcpu; | ||
40 | |||
41 | free_vmcs: | ||
42 | - free_vpid(vmx->nested.vpid02); | ||
43 | free_loaded_vmcs(vmx->loaded_vmcs); | ||
44 | free_msrs: | ||
45 | kfree(vmx->guest_msrs); | ||
46 | diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c | ||
47 | index 9126627cbf4d..75f2bef79718 100644 | ||
48 | --- a/drivers/crypto/padlock-aes.c | ||
49 | +++ b/drivers/crypto/padlock-aes.c | ||
50 | @@ -266,6 +266,8 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key, | ||
51 | return; | ||
52 | } | ||
53 | |||
54 | + count -= initial; | ||
55 | + | ||
56 | if (initial) | ||
57 | asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */ | ||
58 | : "+S"(input), "+D"(output) | ||
59 | @@ -273,7 +275,7 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key, | ||
60 | |||
61 | asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */ | ||
62 | : "+S"(input), "+D"(output) | ||
63 | - : "d"(control_word), "b"(key), "c"(count - initial)); | ||
64 | + : "d"(control_word), "b"(key), "c"(count)); | ||
65 | } | ||
66 | |||
67 | static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, | ||
68 | @@ -284,6 +286,8 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, | ||
69 | if (count < cbc_fetch_blocks) | ||
70 | return cbc_crypt(input, output, key, iv, control_word, count); | ||
71 | |||
72 | + count -= initial; | ||
73 | + | ||
74 | if (initial) | ||
75 | asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */ | ||
76 | : "+S" (input), "+D" (output), "+a" (iv) | ||
77 | @@ -291,7 +295,7 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, | ||
78 | |||
79 | asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */ | ||
80 | : "+S" (input), "+D" (output), "+a" (iv) | ||
81 | - : "d" (control_word), "b" (key), "c" (count-initial)); | ||
82 | + : "d" (control_word), "b" (key), "c" (count)); | ||
83 | return iv; | ||
84 | } | ||
85 | |||
86 | diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c | ||
87 | index 75056553b06c..f8c9f6f4f822 100644 | ||
88 | --- a/drivers/gpu/drm/vc4/vc4_plane.c | ||
89 | +++ b/drivers/gpu/drm/vc4/vc4_plane.c | ||
90 | @@ -350,6 +350,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) | ||
91 | vc4_state->x_scaling[0] = VC4_SCALING_TPZ; | ||
92 | if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) | ||
93 | vc4_state->y_scaling[0] = VC4_SCALING_TPZ; | ||
94 | + } else { | ||
95 | + vc4_state->x_scaling[1] = VC4_SCALING_NONE; | ||
96 | + vc4_state->y_scaling[1] = VC4_SCALING_NONE; | ||
97 | } | ||
98 | |||
99 | vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && | ||
100 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c | ||
101 | index f5fcc0850dac..8a5e0ae4e4c0 100644 | ||
102 | --- a/drivers/net/bonding/bond_main.c | ||
103 | +++ b/drivers/net/bonding/bond_main.c | ||
104 | @@ -1682,6 +1682,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) | ||
105 | goto err_upper_unlink; | ||
106 | } | ||
107 | |||
108 | + bond->nest_level = dev_get_nest_level(bond_dev) + 1; | ||
109 | + | ||
110 | /* If the mode uses primary, then the following is handled by | ||
111 | * bond_change_active_slave(). | ||
112 | */ | ||
113 | @@ -1729,7 +1731,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) | ||
114 | if (bond_mode_uses_xmit_hash(bond)) | ||
115 | bond_update_slave_arr(bond, NULL); | ||
116 | |||
117 | - bond->nest_level = dev_get_nest_level(bond_dev); | ||
118 | |||
119 | netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n", | ||
120 | slave_dev->name, | ||
121 | @@ -3359,6 +3360,13 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res, | ||
122 | } | ||
123 | } | ||
124 | |||
125 | +static int bond_get_nest_level(struct net_device *bond_dev) | ||
126 | +{ | ||
127 | + struct bonding *bond = netdev_priv(bond_dev); | ||
128 | + | ||
129 | + return bond->nest_level; | ||
130 | +} | ||
131 | + | ||
132 | static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, | ||
133 | struct rtnl_link_stats64 *stats) | ||
134 | { | ||
135 | @@ -3367,7 +3375,7 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, | ||
136 | struct list_head *iter; | ||
137 | struct slave *slave; | ||
138 | |||
139 | - spin_lock(&bond->stats_lock); | ||
140 | + spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev)); | ||
141 | memcpy(stats, &bond->bond_stats, sizeof(*stats)); | ||
142 | |||
143 | rcu_read_lock(); | ||
144 | @@ -4163,6 +4171,7 @@ static const struct net_device_ops bond_netdev_ops = { | ||
145 | .ndo_neigh_setup = bond_neigh_setup, | ||
146 | .ndo_vlan_rx_add_vid = bond_vlan_rx_add_vid, | ||
147 | .ndo_vlan_rx_kill_vid = bond_vlan_rx_kill_vid, | ||
148 | + .ndo_get_lock_subclass = bond_get_nest_level, | ||
149 | #ifdef CONFIG_NET_POLL_CONTROLLER | ||
150 | .ndo_netpoll_setup = bond_netpoll_setup, | ||
151 | .ndo_netpoll_cleanup = bond_netpoll_cleanup, | ||
152 | @@ -4655,6 +4664,7 @@ static int bond_init(struct net_device *bond_dev) | ||
153 | if (!bond->wq) | ||
154 | return -ENOMEM; | ||
155 | |||
156 | + bond->nest_level = SINGLE_DEPTH_NESTING; | ||
157 | netdev_lockdep_set_classes(bond_dev); | ||
158 | |||
159 | list_add_tail(&bond->bond_list, &bn->dev_list); | ||
160 | diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c | ||
161 | index b00358297424..d0846ae9e0e4 100644 | ||
162 | --- a/drivers/net/can/usb/ems_usb.c | ||
163 | +++ b/drivers/net/can/usb/ems_usb.c | ||
164 | @@ -1071,6 +1071,7 @@ static void ems_usb_disconnect(struct usb_interface *intf) | ||
165 | usb_free_urb(dev->intr_urb); | ||
166 | |||
167 | kfree(dev->intr_in_buffer); | ||
168 | + kfree(dev->tx_msg_buffer); | ||
169 | } | ||
170 | } | ||
171 | |||
172 | diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c | ||
173 | index e13c9cd45dc0..bcd993140f84 100644 | ||
174 | --- a/drivers/net/ethernet/amazon/ena/ena_com.c | ||
175 | +++ b/drivers/net/ethernet/amazon/ena/ena_com.c | ||
176 | @@ -331,6 +331,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev, | ||
177 | |||
178 | memset(&io_sq->desc_addr, 0x0, sizeof(struct ena_com_io_desc_addr)); | ||
179 | |||
180 | + io_sq->dma_addr_bits = ena_dev->dma_addr_bits; | ||
181 | io_sq->desc_entry_size = | ||
182 | (io_sq->direction == ENA_COM_IO_QUEUE_DIRECTION_TX) ? | ||
183 | sizeof(struct ena_eth_io_tx_desc) : | ||
184 | diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | ||
185 | index 84c5d296d13e..684835833fe3 100644 | ||
186 | --- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | ||
187 | +++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | ||
188 | @@ -877,14 +877,14 @@ static void xgbe_phy_adjust_link(struct xgbe_prv_data *pdata) | ||
189 | |||
190 | if (pdata->tx_pause != pdata->phy.tx_pause) { | ||
191 | new_state = 1; | ||
192 | - pdata->hw_if.config_tx_flow_control(pdata); | ||
193 | pdata->tx_pause = pdata->phy.tx_pause; | ||
194 | + pdata->hw_if.config_tx_flow_control(pdata); | ||
195 | } | ||
196 | |||
197 | if (pdata->rx_pause != pdata->phy.rx_pause) { | ||
198 | new_state = 1; | ||
199 | - pdata->hw_if.config_rx_flow_control(pdata); | ||
200 | pdata->rx_pause = pdata->phy.rx_pause; | ||
201 | + pdata->hw_if.config_rx_flow_control(pdata); | ||
202 | } | ||
203 | |||
204 | /* Speed support */ | ||
205 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | ||
206 | index b3bc1287b2a7..0df71865fab1 100644 | ||
207 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | ||
208 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | ||
209 | @@ -55,7 +55,7 @@ | ||
210 | #include <linux/of_mdio.h> | ||
211 | #include "dwmac1000.h" | ||
212 | |||
213 | -#define STMMAC_ALIGN(x) L1_CACHE_ALIGN(x) | ||
214 | +#define STMMAC_ALIGN(x) __ALIGN_KERNEL(x, SMP_CACHE_BYTES) | ||
215 | #define TSO_MAX_BUFF_SIZE (SZ_16K - 1) | ||
216 | |||
217 | /* Module parameters */ | ||
218 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | ||
219 | index 56c8a2342c14..eafc28142cd2 100644 | ||
220 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | ||
221 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | ||
222 | @@ -183,7 +183,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev, | ||
223 | return -ENOMEM; | ||
224 | |||
225 | /* Enable pci device */ | ||
226 | - ret = pcim_enable_device(pdev); | ||
227 | + ret = pci_enable_device(pdev); | ||
228 | if (ret) { | ||
229 | dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n", | ||
230 | __func__); | ||
231 | @@ -232,9 +232,45 @@ static int stmmac_pci_probe(struct pci_dev *pdev, | ||
232 | static void stmmac_pci_remove(struct pci_dev *pdev) | ||
233 | { | ||
234 | stmmac_dvr_remove(&pdev->dev); | ||
235 | + pci_disable_device(pdev); | ||
236 | } | ||
237 | |||
238 | -static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_suspend, stmmac_resume); | ||
239 | +static int stmmac_pci_suspend(struct device *dev) | ||
240 | +{ | ||
241 | + struct pci_dev *pdev = to_pci_dev(dev); | ||
242 | + int ret; | ||
243 | + | ||
244 | + ret = stmmac_suspend(dev); | ||
245 | + if (ret) | ||
246 | + return ret; | ||
247 | + | ||
248 | + ret = pci_save_state(pdev); | ||
249 | + if (ret) | ||
250 | + return ret; | ||
251 | + | ||
252 | + pci_disable_device(pdev); | ||
253 | + pci_wake_from_d3(pdev, true); | ||
254 | + return 0; | ||
255 | +} | ||
256 | + | ||
257 | +static int stmmac_pci_resume(struct device *dev) | ||
258 | +{ | ||
259 | + struct pci_dev *pdev = to_pci_dev(dev); | ||
260 | + int ret; | ||
261 | + | ||
262 | + pci_restore_state(pdev); | ||
263 | + pci_set_power_state(pdev, PCI_D0); | ||
264 | + | ||
265 | + ret = pci_enable_device(pdev); | ||
266 | + if (ret) | ||
267 | + return ret; | ||
268 | + | ||
269 | + pci_set_master(pdev); | ||
270 | + | ||
271 | + return stmmac_resume(dev); | ||
272 | +} | ||
273 | + | ||
274 | +static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_pci_suspend, stmmac_pci_resume); | ||
275 | |||
276 | #define STMMAC_VENDOR_ID 0x700 | ||
277 | #define STMMAC_QUARK_ID 0x0937 | ||
278 | diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c | ||
279 | index 0a5f62e0efcc..487bf5b8f545 100644 | ||
280 | --- a/drivers/net/phy/mdio-mux-bcm-iproc.c | ||
281 | +++ b/drivers/net/phy/mdio-mux-bcm-iproc.c | ||
282 | @@ -218,7 +218,7 @@ out: | ||
283 | |||
284 | static int mdio_mux_iproc_remove(struct platform_device *pdev) | ||
285 | { | ||
286 | - struct iproc_mdiomux_desc *md = dev_get_platdata(&pdev->dev); | ||
287 | + struct iproc_mdiomux_desc *md = platform_get_drvdata(pdev); | ||
288 | |||
289 | mdio_mux_uninit(md->mux_handle); | ||
290 | mdiobus_unregister(md->mii_bus); | ||
291 | diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c | ||
292 | index 5e0626c80b81..c5e04d1ad73a 100644 | ||
293 | --- a/drivers/net/usb/lan78xx.c | ||
294 | +++ b/drivers/net/usb/lan78xx.c | ||
295 | @@ -1170,6 +1170,8 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) | ||
296 | mod_timer(&dev->stat_monitor, | ||
297 | jiffies + STAT_UPDATE_TIMER); | ||
298 | } | ||
299 | + | ||
300 | + tasklet_schedule(&dev->bh); | ||
301 | } | ||
302 | |||
303 | return ret; | ||
304 | diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c | ||
305 | index a5908e4c06cb..681256f97cb3 100644 | ||
306 | --- a/drivers/net/xen-netfront.c | ||
307 | +++ b/drivers/net/xen-netfront.c | ||
308 | @@ -86,6 +86,7 @@ struct netfront_cb { | ||
309 | /* IRQ name is queue name with "-tx" or "-rx" appended */ | ||
310 | #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) | ||
311 | |||
312 | +static DECLARE_WAIT_QUEUE_HEAD(module_load_q); | ||
313 | static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); | ||
314 | |||
315 | struct netfront_stats { | ||
316 | @@ -1349,6 +1350,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) | ||
317 | netif_carrier_off(netdev); | ||
318 | |||
319 | xenbus_switch_state(dev, XenbusStateInitialising); | ||
320 | + wait_event(module_load_q, | ||
321 | + xenbus_read_driver_state(dev->otherend) != | ||
322 | + XenbusStateClosed && | ||
323 | + xenbus_read_driver_state(dev->otherend) != | ||
324 | + XenbusStateUnknown); | ||
325 | return netdev; | ||
326 | |||
327 | exit: | ||
328 | diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c | ||
329 | index b40a074822cf..15aeeb2159cc 100644 | ||
330 | --- a/drivers/pinctrl/intel/pinctrl-intel.c | ||
331 | +++ b/drivers/pinctrl/intel/pinctrl-intel.c | ||
332 | @@ -604,12 +604,17 @@ static int intel_gpio_get(struct gpio_chip *chip, unsigned offset) | ||
333 | { | ||
334 | struct intel_pinctrl *pctrl = gpiochip_get_data(chip); | ||
335 | void __iomem *reg; | ||
336 | + u32 padcfg0; | ||
337 | |||
338 | reg = intel_get_padcfg(pctrl, offset, PADCFG0); | ||
339 | if (!reg) | ||
340 | return -EINVAL; | ||
341 | |||
342 | - return !!(readl(reg) & PADCFG0_GPIORXSTATE); | ||
343 | + padcfg0 = readl(reg); | ||
344 | + if (!(padcfg0 & PADCFG0_GPIOTXDIS)) | ||
345 | + return !!(padcfg0 & PADCFG0_GPIOTXSTATE); | ||
346 | + | ||
347 | + return !!(padcfg0 & PADCFG0_GPIORXSTATE); | ||
348 | } | ||
349 | |||
350 | static void intel_gpio_set(struct gpio_chip *chip, unsigned offset, int value) | ||
351 | diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c | ||
352 | index 2065a0f9dca6..8d9b416399f9 100644 | ||
353 | --- a/drivers/scsi/sg.c | ||
354 | +++ b/drivers/scsi/sg.c | ||
355 | @@ -2185,6 +2185,7 @@ sg_add_sfp(Sg_device * sdp) | ||
356 | write_lock_irqsave(&sdp->sfd_lock, iflags); | ||
357 | if (atomic_read(&sdp->detaching)) { | ||
358 | write_unlock_irqrestore(&sdp->sfd_lock, iflags); | ||
359 | + kfree(sfp); | ||
360 | return ERR_PTR(-ENODEV); | ||
361 | } | ||
362 | list_add_tail(&sfp->sfd_siblings, &sdp->sfds); | ||
363 | diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c | ||
364 | index a7c08cc4c1b7..30076956a096 100644 | ||
365 | --- a/drivers/virtio/virtio_balloon.c | ||
366 | +++ b/drivers/virtio/virtio_balloon.c | ||
367 | @@ -493,7 +493,9 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, | ||
368 | tell_host(vb, vb->inflate_vq); | ||
369 | |||
370 | /* balloon's page migration 2nd step -- deflate "page" */ | ||
371 | + spin_lock_irqsave(&vb_dev_info->pages_lock, flags); | ||
372 | balloon_page_delete(page); | ||
373 | + spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags); | ||
374 | vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE; | ||
375 | set_page_pfns(vb, vb->pfns, page); | ||
376 | tell_host(vb, vb->deflate_vq); | ||
377 | diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c | ||
378 | index ce62a380314f..cec0fa208078 100644 | ||
379 | --- a/fs/squashfs/block.c | ||
380 | +++ b/fs/squashfs/block.c | ||
381 | @@ -166,6 +166,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length, | ||
382 | } | ||
383 | |||
384 | if (compressed) { | ||
385 | + if (!msblk->stream) | ||
386 | + goto read_failure; | ||
387 | length = squashfs_decompress(msblk, bh, b, offset, length, | ||
388 | output); | ||
389 | if (length < 0) | ||
390 | diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c | ||
391 | index 86ad9a4b8c36..0681feab4a84 100644 | ||
392 | --- a/fs/squashfs/fragment.c | ||
393 | +++ b/fs/squashfs/fragment.c | ||
394 | @@ -49,11 +49,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment, | ||
395 | u64 *fragment_block) | ||
396 | { | ||
397 | struct squashfs_sb_info *msblk = sb->s_fs_info; | ||
398 | - int block = SQUASHFS_FRAGMENT_INDEX(fragment); | ||
399 | - int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment); | ||
400 | - u64 start_block = le64_to_cpu(msblk->fragment_index[block]); | ||
401 | + int block, offset, size; | ||
402 | struct squashfs_fragment_entry fragment_entry; | ||
403 | - int size; | ||
404 | + u64 start_block; | ||
405 | + | ||
406 | + if (fragment >= msblk->fragments) | ||
407 | + return -EIO; | ||
408 | + block = SQUASHFS_FRAGMENT_INDEX(fragment); | ||
409 | + offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment); | ||
410 | + | ||
411 | + start_block = le64_to_cpu(msblk->fragment_index[block]); | ||
412 | |||
413 | size = squashfs_read_metadata(sb, &fragment_entry, &start_block, | ||
414 | &offset, sizeof(fragment_entry)); | ||
415 | diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h | ||
416 | index 1da565cb50c3..ef69c31947bf 100644 | ||
417 | --- a/fs/squashfs/squashfs_fs_sb.h | ||
418 | +++ b/fs/squashfs/squashfs_fs_sb.h | ||
419 | @@ -75,6 +75,7 @@ struct squashfs_sb_info { | ||
420 | unsigned short block_log; | ||
421 | long long bytes_used; | ||
422 | unsigned int inodes; | ||
423 | + unsigned int fragments; | ||
424 | int xattr_ids; | ||
425 | }; | ||
426 | #endif | ||
427 | diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c | ||
428 | index cf01e15a7b16..1516bb779b8d 100644 | ||
429 | --- a/fs/squashfs/super.c | ||
430 | +++ b/fs/squashfs/super.c | ||
431 | @@ -175,6 +175,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) | ||
432 | msblk->inode_table = le64_to_cpu(sblk->inode_table_start); | ||
433 | msblk->directory_table = le64_to_cpu(sblk->directory_table_start); | ||
434 | msblk->inodes = le32_to_cpu(sblk->inodes); | ||
435 | + msblk->fragments = le32_to_cpu(sblk->fragments); | ||
436 | flags = le16_to_cpu(sblk->flags); | ||
437 | |||
438 | TRACE("Found valid superblock on %pg\n", sb->s_bdev); | ||
439 | @@ -185,7 +186,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) | ||
440 | TRACE("Filesystem size %lld bytes\n", msblk->bytes_used); | ||
441 | TRACE("Block size %d\n", msblk->block_size); | ||
442 | TRACE("Number of inodes %d\n", msblk->inodes); | ||
443 | - TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments)); | ||
444 | + TRACE("Number of fragments %d\n", msblk->fragments); | ||
445 | TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids)); | ||
446 | TRACE("sblk->inode_table_start %llx\n", msblk->inode_table); | ||
447 | TRACE("sblk->directory_table_start %llx\n", msblk->directory_table); | ||
448 | @@ -272,7 +273,7 @@ allocate_id_index_table: | ||
449 | sb->s_export_op = &squashfs_export_ops; | ||
450 | |||
451 | handle_fragments: | ||
452 | - fragments = le32_to_cpu(sblk->fragments); | ||
453 | + fragments = msblk->fragments; | ||
454 | if (fragments == 0) | ||
455 | goto check_directory_table; | ||
456 | |||
457 | diff --git a/include/net/tcp.h b/include/net/tcp.h | ||
458 | index 5d440bb0e409..97d210535cdd 100644 | ||
459 | --- a/include/net/tcp.h | ||
460 | +++ b/include/net/tcp.h | ||
461 | @@ -363,7 +363,7 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos, | ||
462 | struct pipe_inode_info *pipe, size_t len, | ||
463 | unsigned int flags); | ||
464 | |||
465 | -void tcp_enter_quickack_mode(struct sock *sk); | ||
466 | +void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks); | ||
467 | static inline void tcp_dec_quickack_mode(struct sock *sk, | ||
468 | const unsigned int pkts) | ||
469 | { | ||
470 | diff --git a/kernel/sched/swait.c b/kernel/sched/swait.c | ||
471 | index 82f0dff90030..9c2da06a8869 100644 | ||
472 | --- a/kernel/sched/swait.c | ||
473 | +++ b/kernel/sched/swait.c | ||
474 | @@ -33,9 +33,6 @@ void swake_up(struct swait_queue_head *q) | ||
475 | { | ||
476 | unsigned long flags; | ||
477 | |||
478 | - if (!swait_active(q)) | ||
479 | - return; | ||
480 | - | ||
481 | raw_spin_lock_irqsave(&q->lock, flags); | ||
482 | swake_up_locked(q); | ||
483 | raw_spin_unlock_irqrestore(&q->lock, flags); | ||
484 | @@ -51,9 +48,6 @@ void swake_up_all(struct swait_queue_head *q) | ||
485 | struct swait_queue *curr; | ||
486 | LIST_HEAD(tmp); | ||
487 | |||
488 | - if (!swait_active(q)) | ||
489 | - return; | ||
490 | - | ||
491 | raw_spin_lock_irq(&q->lock); | ||
492 | list_splice_init(&q->task_list, &tmp); | ||
493 | while (!list_empty(&tmp)) { | ||
494 | diff --git a/net/dsa/slave.c b/net/dsa/slave.c | ||
495 | index 5000e6f20f4a..339d9c678d3e 100644 | ||
496 | --- a/net/dsa/slave.c | ||
497 | +++ b/net/dsa/slave.c | ||
498 | @@ -1199,6 +1199,9 @@ int dsa_slave_suspend(struct net_device *slave_dev) | ||
499 | { | ||
500 | struct dsa_slave_priv *p = netdev_priv(slave_dev); | ||
501 | |||
502 | + if (!netif_running(slave_dev)) | ||
503 | + return 0; | ||
504 | + | ||
505 | netif_device_detach(slave_dev); | ||
506 | |||
507 | if (p->phy) { | ||
508 | @@ -1216,6 +1219,9 @@ int dsa_slave_resume(struct net_device *slave_dev) | ||
509 | { | ||
510 | struct dsa_slave_priv *p = netdev_priv(slave_dev); | ||
511 | |||
512 | + if (!netif_running(slave_dev)) | ||
513 | + return 0; | ||
514 | + | ||
515 | netif_device_attach(slave_dev); | ||
516 | |||
517 | if (p->phy) { | ||
518 | diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c | ||
519 | index 7bdd89354db5..6a2ef162088d 100644 | ||
520 | --- a/net/ipv4/fib_frontend.c | ||
521 | +++ b/net/ipv4/fib_frontend.c | ||
522 | @@ -282,19 +282,19 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) | ||
523 | return ip_hdr(skb)->daddr; | ||
524 | |||
525 | in_dev = __in_dev_get_rcu(dev); | ||
526 | - BUG_ON(!in_dev); | ||
527 | |||
528 | net = dev_net(dev); | ||
529 | |||
530 | scope = RT_SCOPE_UNIVERSE; | ||
531 | if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) { | ||
532 | + bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev); | ||
533 | struct flowi4 fl4 = { | ||
534 | .flowi4_iif = LOOPBACK_IFINDEX, | ||
535 | .flowi4_oif = l3mdev_master_ifindex_rcu(dev), | ||
536 | .daddr = ip_hdr(skb)->saddr, | ||
537 | .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), | ||
538 | .flowi4_scope = scope, | ||
539 | - .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0, | ||
540 | + .flowi4_mark = vmark ? skb->mark : 0, | ||
541 | }; | ||
542 | if (!fib_lookup(net, &fl4, &res, 0)) | ||
543 | return FIB_RES_PREFSRC(net, res); | ||
544 | diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c | ||
545 | index 8effac0f2219..f8b41aaac76f 100644 | ||
546 | --- a/net/ipv4/inet_fragment.c | ||
547 | +++ b/net/ipv4/inet_fragment.c | ||
548 | @@ -356,11 +356,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, | ||
549 | { | ||
550 | struct inet_frag_queue *q; | ||
551 | |||
552 | - if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { | ||
553 | - inet_frag_schedule_worker(f); | ||
554 | - return NULL; | ||
555 | - } | ||
556 | - | ||
557 | q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); | ||
558 | if (!q) | ||
559 | return NULL; | ||
560 | @@ -397,6 +392,11 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, | ||
561 | struct inet_frag_queue *q; | ||
562 | int depth = 0; | ||
563 | |||
564 | + if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { | ||
565 | + inet_frag_schedule_worker(f); | ||
566 | + return NULL; | ||
567 | + } | ||
568 | + | ||
569 | if (frag_mem_limit(nf) > nf->low_thresh) | ||
570 | inet_frag_schedule_worker(f); | ||
571 | |||
572 | diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c | ||
573 | index 4bf3b8af0257..752711cd4834 100644 | ||
574 | --- a/net/ipv4/ip_fragment.c | ||
575 | +++ b/net/ipv4/ip_fragment.c | ||
576 | @@ -446,11 +446,16 @@ found: | ||
577 | int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ | ||
578 | |||
579 | if (i < next->len) { | ||
580 | + int delta = -next->truesize; | ||
581 | + | ||
582 | /* Eat head of the next overlapped fragment | ||
583 | * and leave the loop. The next ones cannot overlap. | ||
584 | */ | ||
585 | if (!pskb_pull(next, i)) | ||
586 | goto err; | ||
587 | + delta += next->truesize; | ||
588 | + if (delta) | ||
589 | + add_frag_mem_limit(qp->q.net, delta); | ||
590 | FRAG_CB(next)->offset += i; | ||
591 | qp->q.meat -= i; | ||
592 | if (next->ip_summed != CHECKSUM_UNNECESSARY) | ||
593 | diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c | ||
594 | index 9169859506b7..7e44d23b0328 100644 | ||
595 | --- a/net/ipv4/tcp_bbr.c | ||
596 | +++ b/net/ipv4/tcp_bbr.c | ||
597 | @@ -324,6 +324,10 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain) | ||
598 | /* Reduce delayed ACKs by rounding up cwnd to the next even number. */ | ||
599 | cwnd = (cwnd + 1) & ~1U; | ||
600 | |||
601 | + /* Ensure gain cycling gets inflight above BDP even for small BDPs. */ | ||
602 | + if (bbr->mode == BBR_PROBE_BW && gain > BBR_UNIT) | ||
603 | + cwnd += 2; | ||
604 | + | ||
605 | return cwnd; | ||
606 | } | ||
607 | |||
608 | diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c | ||
609 | index dd52ccb812ea..8905a0aec8ee 100644 | ||
610 | --- a/net/ipv4/tcp_dctcp.c | ||
611 | +++ b/net/ipv4/tcp_dctcp.c | ||
612 | @@ -138,7 +138,7 @@ static void dctcp_ce_state_0_to_1(struct sock *sk) | ||
613 | */ | ||
614 | if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) | ||
615 | __tcp_send_ack(sk, ca->prior_rcv_nxt); | ||
616 | - tcp_enter_quickack_mode(sk); | ||
617 | + tcp_enter_quickack_mode(sk, 1); | ||
618 | } | ||
619 | |||
620 | ca->prior_rcv_nxt = tp->rcv_nxt; | ||
621 | @@ -159,7 +159,7 @@ static void dctcp_ce_state_1_to_0(struct sock *sk) | ||
622 | */ | ||
623 | if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) | ||
624 | __tcp_send_ack(sk, ca->prior_rcv_nxt); | ||
625 | - tcp_enter_quickack_mode(sk); | ||
626 | + tcp_enter_quickack_mode(sk, 1); | ||
627 | } | ||
628 | |||
629 | ca->prior_rcv_nxt = tp->rcv_nxt; | ||
630 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c | ||
631 | index 44d136fd2af5..a9be8df108b4 100644 | ||
632 | --- a/net/ipv4/tcp_input.c | ||
633 | +++ b/net/ipv4/tcp_input.c | ||
634 | @@ -198,21 +198,23 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb) | ||
635 | } | ||
636 | } | ||
637 | |||
638 | -static void tcp_incr_quickack(struct sock *sk) | ||
639 | +static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks) | ||
640 | { | ||
641 | struct inet_connection_sock *icsk = inet_csk(sk); | ||
642 | unsigned int quickacks = tcp_sk(sk)->rcv_wnd / (2 * icsk->icsk_ack.rcv_mss); | ||
643 | |||
644 | if (quickacks == 0) | ||
645 | quickacks = 2; | ||
646 | + quickacks = min(quickacks, max_quickacks); | ||
647 | if (quickacks > icsk->icsk_ack.quick) | ||
648 | - icsk->icsk_ack.quick = min(quickacks, TCP_MAX_QUICKACKS); | ||
649 | + icsk->icsk_ack.quick = quickacks; | ||
650 | } | ||
651 | |||
652 | -void tcp_enter_quickack_mode(struct sock *sk) | ||
653 | +void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) | ||
654 | { | ||
655 | struct inet_connection_sock *icsk = inet_csk(sk); | ||
656 | - tcp_incr_quickack(sk); | ||
657 | + | ||
658 | + tcp_incr_quickack(sk, max_quickacks); | ||
659 | icsk->icsk_ack.pingpong = 0; | ||
660 | icsk->icsk_ack.ato = TCP_ATO_MIN; | ||
661 | } | ||
662 | @@ -248,8 +250,10 @@ static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp) | ||
663 | tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR; | ||
664 | } | ||
665 | |||
666 | -static void __tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb) | ||
667 | +static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb) | ||
668 | { | ||
669 | + struct tcp_sock *tp = tcp_sk(sk); | ||
670 | + | ||
671 | switch (TCP_SKB_CB(skb)->ip_dsfield & INET_ECN_MASK) { | ||
672 | case INET_ECN_NOT_ECT: | ||
673 | /* Funny extension: if ECT is not set on a segment, | ||
674 | @@ -257,31 +261,31 @@ static void __tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb) | ||
675 | * it is probably a retransmit. | ||
676 | */ | ||
677 | if (tp->ecn_flags & TCP_ECN_SEEN) | ||
678 | - tcp_enter_quickack_mode((struct sock *)tp); | ||
679 | + tcp_enter_quickack_mode(sk, 2); | ||
680 | break; | ||
681 | case INET_ECN_CE: | ||
682 | - if (tcp_ca_needs_ecn((struct sock *)tp)) | ||
683 | - tcp_ca_event((struct sock *)tp, CA_EVENT_ECN_IS_CE); | ||
684 | + if (tcp_ca_needs_ecn(sk)) | ||
685 | + tcp_ca_event(sk, CA_EVENT_ECN_IS_CE); | ||
686 | |||
687 | if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) { | ||
688 | /* Better not delay acks, sender can have a very low cwnd */ | ||
689 | - tcp_enter_quickack_mode((struct sock *)tp); | ||
690 | + tcp_enter_quickack_mode(sk, 2); | ||
691 | tp->ecn_flags |= TCP_ECN_DEMAND_CWR; | ||
692 | } | ||
693 | tp->ecn_flags |= TCP_ECN_SEEN; | ||
694 | break; | ||
695 | default: | ||
696 | - if (tcp_ca_needs_ecn((struct sock *)tp)) | ||
697 | - tcp_ca_event((struct sock *)tp, CA_EVENT_ECN_NO_CE); | ||
698 | + if (tcp_ca_needs_ecn(sk)) | ||
699 | + tcp_ca_event(sk, CA_EVENT_ECN_NO_CE); | ||
700 | tp->ecn_flags |= TCP_ECN_SEEN; | ||
701 | break; | ||
702 | } | ||
703 | } | ||
704 | |||
705 | -static void tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb) | ||
706 | +static void tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb) | ||
707 | { | ||
708 | - if (tp->ecn_flags & TCP_ECN_OK) | ||
709 | - __tcp_ecn_check_ce(tp, skb); | ||
710 | + if (tcp_sk(sk)->ecn_flags & TCP_ECN_OK) | ||
711 | + __tcp_ecn_check_ce(sk, skb); | ||
712 | } | ||
713 | |||
714 | static void tcp_ecn_rcv_synack(struct tcp_sock *tp, const struct tcphdr *th) | ||
715 | @@ -675,7 +679,7 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb) | ||
716 | /* The _first_ data packet received, initialize | ||
717 | * delayed ACK engine. | ||
718 | */ | ||
719 | - tcp_incr_quickack(sk); | ||
720 | + tcp_incr_quickack(sk, TCP_MAX_QUICKACKS); | ||
721 | icsk->icsk_ack.ato = TCP_ATO_MIN; | ||
722 | } else { | ||
723 | int m = now - icsk->icsk_ack.lrcvtime; | ||
724 | @@ -691,13 +695,13 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb) | ||
725 | /* Too long gap. Apparently sender failed to | ||
726 | * restart window, so that we send ACKs quickly. | ||
727 | */ | ||
728 | - tcp_incr_quickack(sk); | ||
729 | + tcp_incr_quickack(sk, TCP_MAX_QUICKACKS); | ||
730 | sk_mem_reclaim(sk); | ||
731 | } | ||
732 | } | ||
733 | icsk->icsk_ack.lrcvtime = now; | ||
734 | |||
735 | - tcp_ecn_check_ce(tp, skb); | ||
736 | + tcp_ecn_check_ce(sk, skb); | ||
737 | |||
738 | if (skb->len >= 128) | ||
739 | tcp_grow_window(sk, skb); | ||
740 | @@ -4210,7 +4214,7 @@ static void tcp_send_dupack(struct sock *sk, const struct sk_buff *skb) | ||
741 | if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq && | ||
742 | before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) { | ||
743 | NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOST); | ||
744 | - tcp_enter_quickack_mode(sk); | ||
745 | + tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); | ||
746 | |||
747 | if (tcp_is_sack(tp) && sysctl_tcp_dsack) { | ||
748 | u32 end_seq = TCP_SKB_CB(skb)->end_seq; | ||
749 | @@ -4454,7 +4458,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) | ||
750 | u32 seq, end_seq; | ||
751 | bool fragstolen; | ||
752 | |||
753 | - tcp_ecn_check_ce(tp, skb); | ||
754 | + tcp_ecn_check_ce(sk, skb); | ||
755 | |||
756 | if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) { | ||
757 | NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPOFODROP); | ||
758 | @@ -4734,7 +4738,7 @@ queue_and_out: | ||
759 | tcp_dsack_set(sk, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq); | ||
760 | |||
761 | out_of_window: | ||
762 | - tcp_enter_quickack_mode(sk); | ||
763 | + tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); | ||
764 | inet_csk_schedule_ack(sk); | ||
765 | drop: | ||
766 | tcp_drop(sk, skb); | ||
767 | @@ -4745,8 +4749,6 @@ drop: | ||
768 | if (!before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt + tcp_receive_window(tp))) | ||
769 | goto out_of_window; | ||
770 | |||
771 | - tcp_enter_quickack_mode(sk); | ||
772 | - | ||
773 | if (before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) { | ||
774 | /* Partial packet, seq < rcv_next < end_seq */ | ||
775 | SOCK_DEBUG(sk, "partial packet: rcv_next %X seq %X - %X\n", | ||
776 | @@ -5830,7 +5832,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, | ||
777 | * to stand against the temptation 8) --ANK | ||
778 | */ | ||
779 | inet_csk_schedule_ack(sk); | ||
780 | - tcp_enter_quickack_mode(sk); | ||
781 | + tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); | ||
782 | inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK, | ||
783 | TCP_DELACK_MAX, TCP_RTO_MAX); | ||
784 | |||
785 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c | ||
786 | index 15e6e7b9fd2b..8d0aafbdbbc3 100644 | ||
787 | --- a/net/netlink/af_netlink.c | ||
788 | +++ b/net/netlink/af_netlink.c | ||
789 | @@ -62,6 +62,7 @@ | ||
790 | #include <asm/cacheflush.h> | ||
791 | #include <linux/hash.h> | ||
792 | #include <linux/genetlink.h> | ||
793 | +#include <linux/nospec.h> | ||
794 | |||
795 | #include <net/net_namespace.h> | ||
796 | #include <net/sock.h> | ||
797 | @@ -654,6 +655,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol, | ||
798 | |||
799 | if (protocol < 0 || protocol >= MAX_LINKS) | ||
800 | return -EPROTONOSUPPORT; | ||
801 | + protocol = array_index_nospec(protocol, MAX_LINKS); | ||
802 | |||
803 | netlink_lock_table(); | ||
804 | #ifdef CONFIG_MODULES | ||
805 | diff --git a/net/socket.c b/net/socket.c | ||
806 | index bd3b33988ee0..35fa349ba274 100644 | ||
807 | --- a/net/socket.c | ||
808 | +++ b/net/socket.c | ||
809 | @@ -89,6 +89,7 @@ | ||
810 | #include <linux/magic.h> | ||
811 | #include <linux/slab.h> | ||
812 | #include <linux/xattr.h> | ||
813 | +#include <linux/nospec.h> | ||
814 | |||
815 | #include <asm/uaccess.h> | ||
816 | #include <asm/unistd.h> | ||
817 | @@ -2338,6 +2339,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args) | ||
818 | |||
819 | if (call < 1 || call > SYS_SENDMMSG) | ||
820 | return -EINVAL; | ||
821 | + call = array_index_nospec(call, SYS_SENDMMSG + 1); | ||
822 | |||
823 | len = nargs[call]; | ||
824 | if (len > sizeof(a)) |