Annotation of /trunk/kernel-alx/patches-4.9/0229-4.9.130-all-fixes.patch
Parent Directory | Revision Log
Revision 3230 -
(hide annotations)
(download)
Mon Oct 1 09:59:50 2018 UTC (5 years, 11 months ago) by niro
File size: 36931 byte(s)
Mon Oct 1 09:59:50 2018 UTC (5 years, 11 months ago) by niro
File size: 36931 byte(s)
-linux-4.9.130
1 | niro | 3230 | diff --git a/Makefile b/Makefile |
2 | index 3f3c340374c5..b98e04a5e1e5 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 9 | ||
8 | -SUBLEVEL = 129 | ||
9 | +SUBLEVEL = 130 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Roaring Lionus | ||
12 | |||
13 | diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c | ||
14 | index b9fc52556bcc..0b29a43e09c8 100644 | ||
15 | --- a/arch/x86/xen/pmu.c | ||
16 | +++ b/arch/x86/xen/pmu.c | ||
17 | @@ -477,7 +477,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs, | ||
18 | irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) | ||
19 | { | ||
20 | int err, ret = IRQ_NONE; | ||
21 | - struct pt_regs regs; | ||
22 | + struct pt_regs regs = {0}; | ||
23 | const struct xen_pmu_data *xenpmu_data = get_xenpmu_data(); | ||
24 | uint8_t xenpmu_flags = get_xenpmu_flags(); | ||
25 | |||
26 | diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
27 | index 56c288f78d8a..5bfae1f972c7 100644 | ||
28 | --- a/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
29 | +++ b/drivers/gpu/drm/nouveau/nouveau_connector.c | ||
30 | @@ -271,12 +271,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) | ||
31 | nv_connector->edid = NULL; | ||
32 | } | ||
33 | |||
34 | - /* Outputs are only polled while runtime active, so acquiring a | ||
35 | - * runtime PM ref here is unnecessary (and would deadlock upon | ||
36 | - * runtime suspend because it waits for polling to finish). | ||
37 | + /* Outputs are only polled while runtime active, so resuming the | ||
38 | + * device here is unnecessary (and would deadlock upon runtime suspend | ||
39 | + * because it waits for polling to finish). We do however, want to | ||
40 | + * prevent the autosuspend timer from elapsing during this operation | ||
41 | + * if possible. | ||
42 | */ | ||
43 | - if (!drm_kms_helper_is_poll_worker()) { | ||
44 | - ret = pm_runtime_get_sync(connector->dev->dev); | ||
45 | + if (drm_kms_helper_is_poll_worker()) { | ||
46 | + pm_runtime_get_noresume(dev->dev); | ||
47 | + } else { | ||
48 | + ret = pm_runtime_get_sync(dev->dev); | ||
49 | if (ret < 0 && ret != -EACCES) | ||
50 | return conn_status; | ||
51 | } | ||
52 | @@ -354,10 +358,8 @@ detect_analog: | ||
53 | |||
54 | out: | ||
55 | |||
56 | - if (!drm_kms_helper_is_poll_worker()) { | ||
57 | - pm_runtime_mark_last_busy(connector->dev->dev); | ||
58 | - pm_runtime_put_autosuspend(connector->dev->dev); | ||
59 | - } | ||
60 | + pm_runtime_mark_last_busy(dev->dev); | ||
61 | + pm_runtime_put_autosuspend(dev->dev); | ||
62 | |||
63 | return conn_status; | ||
64 | } | ||
65 | diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c | ||
66 | index 6526a3366087..3ddd4096da2a 100644 | ||
67 | --- a/drivers/gpu/drm/nouveau/nouveau_display.c | ||
68 | +++ b/drivers/gpu/drm/nouveau/nouveau_display.c | ||
69 | @@ -367,8 +367,6 @@ nouveau_display_hpd_work(struct work_struct *work) | ||
70 | pm_runtime_get_sync(drm->dev->dev); | ||
71 | |||
72 | drm_helper_hpd_irq_event(drm->dev); | ||
73 | - /* enable polling for external displays */ | ||
74 | - drm_kms_helper_poll_enable(drm->dev); | ||
75 | |||
76 | pm_runtime_mark_last_busy(drm->dev->dev); | ||
77 | pm_runtime_put_sync(drm->dev->dev); | ||
78 | @@ -391,15 +389,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val, | ||
79 | { | ||
80 | struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb); | ||
81 | struct acpi_bus_event *info = data; | ||
82 | + int ret; | ||
83 | |||
84 | if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) { | ||
85 | if (info->type == ACPI_VIDEO_NOTIFY_PROBE) { | ||
86 | - /* | ||
87 | - * This may be the only indication we receive of a | ||
88 | - * connector hotplug on a runtime suspended GPU, | ||
89 | - * schedule hpd_work to check. | ||
90 | - */ | ||
91 | - schedule_work(&drm->hpd_work); | ||
92 | + ret = pm_runtime_get(drm->dev->dev); | ||
93 | + if (ret == 1 || ret == -EACCES) { | ||
94 | + /* If the GPU is already awake, or in a state | ||
95 | + * where we can't wake it up, it can handle | ||
96 | + * it's own hotplug events. | ||
97 | + */ | ||
98 | + pm_runtime_put_autosuspend(drm->dev->dev); | ||
99 | + } else if (ret == 0) { | ||
100 | + /* This may be the only indication we receive | ||
101 | + * of a connector hotplug on a runtime | ||
102 | + * suspended GPU, schedule hpd_work to check. | ||
103 | + */ | ||
104 | + NV_DEBUG(drm, "ACPI requested connector reprobe\n"); | ||
105 | + schedule_work(&drm->hpd_work); | ||
106 | + pm_runtime_put_noidle(drm->dev->dev); | ||
107 | + } else { | ||
108 | + NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n", | ||
109 | + ret); | ||
110 | + } | ||
111 | |||
112 | /* acpi-video should not generate keypresses for this */ | ||
113 | return NOTIFY_BAD; | ||
114 | @@ -422,6 +434,11 @@ nouveau_display_init(struct drm_device *dev) | ||
115 | if (ret) | ||
116 | return ret; | ||
117 | |||
118 | + /* enable connector detection and polling for connectors without HPD | ||
119 | + * support | ||
120 | + */ | ||
121 | + drm_kms_helper_poll_enable(dev); | ||
122 | + | ||
123 | /* enable hotplug interrupts */ | ||
124 | list_for_each_entry(connector, &dev->mode_config.connector_list, head) { | ||
125 | struct nouveau_connector *conn = nouveau_connector(connector); | ||
126 | diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c | ||
127 | index f8c9f6f4f822..a2d8630058ed 100644 | ||
128 | --- a/drivers/gpu/drm/vc4/vc4_plane.c | ||
129 | +++ b/drivers/gpu/drm/vc4/vc4_plane.c | ||
130 | @@ -327,6 +327,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) | ||
131 | vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0], | ||
132 | vc4_state->crtc_h); | ||
133 | |||
134 | + vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && | ||
135 | + vc4_state->y_scaling[0] == VC4_SCALING_NONE); | ||
136 | + | ||
137 | if (num_planes > 1) { | ||
138 | vc4_state->is_yuv = true; | ||
139 | |||
140 | @@ -342,24 +345,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) | ||
141 | vc4_get_scaling_mode(vc4_state->src_h[1], | ||
142 | vc4_state->crtc_h); | ||
143 | |||
144 | - /* YUV conversion requires that scaling be enabled, | ||
145 | - * even on a plane that's otherwise 1:1. Choose TPZ | ||
146 | - * for simplicity. | ||
147 | + /* YUV conversion requires that horizontal scaling be enabled, | ||
148 | + * even on a plane that's otherwise 1:1. Looks like only PPF | ||
149 | + * works in that case, so let's pick that one. | ||
150 | */ | ||
151 | - if (vc4_state->x_scaling[0] == VC4_SCALING_NONE) | ||
152 | - vc4_state->x_scaling[0] = VC4_SCALING_TPZ; | ||
153 | - if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) | ||
154 | - vc4_state->y_scaling[0] = VC4_SCALING_TPZ; | ||
155 | + if (vc4_state->is_unity) | ||
156 | + vc4_state->x_scaling[0] = VC4_SCALING_PPF; | ||
157 | } else { | ||
158 | vc4_state->x_scaling[1] = VC4_SCALING_NONE; | ||
159 | vc4_state->y_scaling[1] = VC4_SCALING_NONE; | ||
160 | } | ||
161 | |||
162 | - vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && | ||
163 | - vc4_state->y_scaling[0] == VC4_SCALING_NONE && | ||
164 | - vc4_state->x_scaling[1] == VC4_SCALING_NONE && | ||
165 | - vc4_state->y_scaling[1] == VC4_SCALING_NONE); | ||
166 | - | ||
167 | /* No configuring scaling on the cursor plane, since it gets | ||
168 | non-vblank-synced updates, and scaling requires requires | ||
169 | LBM changes which have to be vblank-synced. | ||
170 | @@ -614,7 +610,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane, | ||
171 | vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5); | ||
172 | } | ||
173 | |||
174 | - if (!vc4_state->is_unity) { | ||
175 | + if (vc4_state->x_scaling[0] != VC4_SCALING_NONE || | ||
176 | + vc4_state->x_scaling[1] != VC4_SCALING_NONE || | ||
177 | + vc4_state->y_scaling[0] != VC4_SCALING_NONE || | ||
178 | + vc4_state->y_scaling[1] != VC4_SCALING_NONE) { | ||
179 | /* LBM Base Address. */ | ||
180 | if (vc4_state->y_scaling[0] != VC4_SCALING_NONE || | ||
181 | vc4_state->y_scaling[1] != VC4_SCALING_NONE) { | ||
182 | diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c | ||
183 | index 7944a1f589eb..2248b330c047 100644 | ||
184 | --- a/drivers/hid/hid-core.c | ||
185 | +++ b/drivers/hid/hid-core.c | ||
186 | @@ -2059,6 +2059,9 @@ static const struct hid_device_id hid_have_special_driver[] = { | ||
187 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) }, | ||
188 | { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) }, | ||
189 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) }, | ||
190 | + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) }, | ||
191 | + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) }, | ||
192 | + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE) }, | ||
193 | { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) }, | ||
194 | { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) }, | ||
195 | { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER) }, | ||
196 | diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h | ||
197 | index 019ee9181f2b..de64cd33590a 100644 | ||
198 | --- a/drivers/hid/hid-ids.h | ||
199 | +++ b/drivers/hid/hid-ids.h | ||
200 | @@ -927,6 +927,8 @@ | ||
201 | #define USB_DEVICE_ID_SONY_PS3_BDREMOTE 0x0306 | ||
202 | #define USB_DEVICE_ID_SONY_PS3_CONTROLLER 0x0268 | ||
203 | #define USB_DEVICE_ID_SONY_PS4_CONTROLLER 0x05c4 | ||
204 | +#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_2 0x09cc | ||
205 | +#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE 0x0ba0 | ||
206 | #define USB_DEVICE_ID_SONY_MOTION_CONTROLLER 0x03d5 | ||
207 | #define USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER 0x042f | ||
208 | #define USB_DEVICE_ID_SONY_BUZZ_CONTROLLER 0x0002 | ||
209 | diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c | ||
210 | index 1b1dccd37fbd..eee58d15e745 100644 | ||
211 | --- a/drivers/hid/hid-sony.c | ||
212 | +++ b/drivers/hid/hid-sony.c | ||
213 | @@ -2581,6 +2581,12 @@ static const struct hid_device_id sony_devices[] = { | ||
214 | .driver_data = DUALSHOCK4_CONTROLLER_USB }, | ||
215 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER), | ||
216 | .driver_data = DUALSHOCK4_CONTROLLER_BT }, | ||
217 | + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2), | ||
218 | + .driver_data = DUALSHOCK4_CONTROLLER_USB }, | ||
219 | + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2), | ||
220 | + .driver_data = DUALSHOCK4_CONTROLLER_BT }, | ||
221 | + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE), | ||
222 | + .driver_data = DUALSHOCK4_CONTROLLER_USB }, | ||
223 | /* Nyko Core Controller for PS3 */ | ||
224 | { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER), | ||
225 | .driver_data = SIXAXIS_CONTROLLER_USB | SINO_LITE_CONTROLLER }, | ||
226 | diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c | ||
227 | index cc2243f6cc7f..bb45eb22ba1f 100644 | ||
228 | --- a/drivers/infiniband/hw/cxgb4/qp.c | ||
229 | +++ b/drivers/infiniband/hw/cxgb4/qp.c | ||
230 | @@ -1258,6 +1258,12 @@ static void flush_qp(struct c4iw_qp *qhp) | ||
231 | |||
232 | t4_set_wq_in_error(&qhp->wq); | ||
233 | if (qhp->ibqp.uobject) { | ||
234 | + | ||
235 | + /* for user qps, qhp->wq.flushed is protected by qhp->mutex */ | ||
236 | + if (qhp->wq.flushed) | ||
237 | + return; | ||
238 | + | ||
239 | + qhp->wq.flushed = 1; | ||
240 | t4_set_cq_in_error(&rchp->cq); | ||
241 | spin_lock_irqsave(&rchp->comp_handler_lock, flag); | ||
242 | (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context); | ||
243 | diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c | ||
244 | index 518e2dec2aa2..5e9122cd3898 100644 | ||
245 | --- a/drivers/misc/vmw_balloon.c | ||
246 | +++ b/drivers/misc/vmw_balloon.c | ||
247 | @@ -45,6 +45,7 @@ | ||
248 | #include <linux/seq_file.h> | ||
249 | #include <linux/vmw_vmci_defs.h> | ||
250 | #include <linux/vmw_vmci_api.h> | ||
251 | +#include <linux/io.h> | ||
252 | #include <asm/hypervisor.h> | ||
253 | |||
254 | MODULE_AUTHOR("VMware, Inc."); | ||
255 | diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c | ||
256 | index 2e4649655181..4e98e5aff7c5 100644 | ||
257 | --- a/drivers/net/appletalk/ipddp.c | ||
258 | +++ b/drivers/net/appletalk/ipddp.c | ||
259 | @@ -284,8 +284,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) | ||
260 | case SIOCFINDIPDDPRT: | ||
261 | spin_lock_bh(&ipddp_route_lock); | ||
262 | rp = __ipddp_find_route(&rcp); | ||
263 | - if (rp) | ||
264 | - memcpy(&rcp2, rp, sizeof(rcp2)); | ||
265 | + if (rp) { | ||
266 | + memset(&rcp2, 0, sizeof(rcp2)); | ||
267 | + rcp2.ip = rp->ip; | ||
268 | + rcp2.at = rp->at; | ||
269 | + rcp2.flags = rp->flags; | ||
270 | + } | ||
271 | spin_unlock_bh(&ipddp_route_lock); | ||
272 | |||
273 | if (rp) { | ||
274 | diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c | ||
275 | index 631dbc7b4dbb..0988bf1a43c0 100644 | ||
276 | --- a/drivers/net/ethernet/hp/hp100.c | ||
277 | +++ b/drivers/net/ethernet/hp/hp100.c | ||
278 | @@ -2636,7 +2636,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin) | ||
279 | /* Wait for link to drop */ | ||
280 | time = jiffies + (HZ / 10); | ||
281 | do { | ||
282 | - if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) | ||
283 | + if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) | ||
284 | break; | ||
285 | if (!in_interrupt()) | ||
286 | schedule_timeout_interruptible(1); | ||
287 | diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c | ||
288 | index 7f6af10f09ee..3c1adb38412b 100644 | ||
289 | --- a/drivers/net/xen-netfront.c | ||
290 | +++ b/drivers/net/xen-netfront.c | ||
291 | @@ -906,7 +906,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, | ||
292 | BUG_ON(pull_to <= skb_headlen(skb)); | ||
293 | __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); | ||
294 | } | ||
295 | - BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS); | ||
296 | + if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { | ||
297 | + queue->rx.rsp_cons = ++cons; | ||
298 | + kfree_skb(nskb); | ||
299 | + return ~0U; | ||
300 | + } | ||
301 | |||
302 | skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, | ||
303 | skb_frag_page(nfrag), | ||
304 | @@ -1043,6 +1047,8 @@ err: | ||
305 | skb->len += rx->status; | ||
306 | |||
307 | i = xennet_fill_frags(queue, skb, &tmpq); | ||
308 | + if (unlikely(i == ~0U)) | ||
309 | + goto err; | ||
310 | |||
311 | if (rx->flags & XEN_NETRXF_csum_blank) | ||
312 | skb->ip_summed = CHECKSUM_PARTIAL; | ||
313 | diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c | ||
314 | index 11bad826683e..1dbd09c91a7c 100644 | ||
315 | --- a/drivers/pci/host/pci-aardvark.c | ||
316 | +++ b/drivers/pci/host/pci-aardvark.c | ||
317 | @@ -976,6 +976,7 @@ static int advk_pcie_probe(struct platform_device *pdev) | ||
318 | return -ENOMEM; | ||
319 | } | ||
320 | |||
321 | + pci_bus_size_bridges(bus); | ||
322 | pci_bus_assign_resources(bus); | ||
323 | |||
324 | list_for_each_entry(child, &bus->children, node) | ||
325 | diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c | ||
326 | index a05d143ac43b..c7a695c2303a 100644 | ||
327 | --- a/drivers/pci/quirks.c | ||
328 | +++ b/drivers/pci/quirks.c | ||
329 | @@ -4236,11 +4236,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags) | ||
330 | * | ||
331 | * 0x9d10-0x9d1b PCI Express Root port #{1-12} | ||
332 | * | ||
333 | - * The 300 series chipset suffers from the same bug so include those root | ||
334 | - * ports here as well. | ||
335 | - * | ||
336 | - * 0xa32c-0xa343 PCI Express Root port #{0-24} | ||
337 | - * | ||
338 | * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html | ||
339 | * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html | ||
340 | * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html | ||
341 | @@ -4258,7 +4253,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev) | ||
342 | case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */ | ||
343 | case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */ | ||
344 | case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */ | ||
345 | - case 0xa32c ... 0xa343: /* 300 series */ | ||
346 | return true; | ||
347 | } | ||
348 | |||
349 | diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c | ||
350 | index 005629447b0c..fe419935041c 100644 | ||
351 | --- a/drivers/platform/x86/alienware-wmi.c | ||
352 | +++ b/drivers/platform/x86/alienware-wmi.c | ||
353 | @@ -518,6 +518,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args, | ||
354 | if (obj && obj->type == ACPI_TYPE_INTEGER) | ||
355 | *out_data = (u32) obj->integer.value; | ||
356 | } | ||
357 | + kfree(output.pointer); | ||
358 | return status; | ||
359 | |||
360 | } | ||
361 | diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c | ||
362 | index 98f75e5811c8..f06e74ea10d3 100644 | ||
363 | --- a/drivers/target/iscsi/iscsi_target_auth.c | ||
364 | +++ b/drivers/target/iscsi/iscsi_target_auth.c | ||
365 | @@ -26,18 +26,6 @@ | ||
366 | #include "iscsi_target_nego.h" | ||
367 | #include "iscsi_target_auth.h" | ||
368 | |||
369 | -static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len) | ||
370 | -{ | ||
371 | - int j = DIV_ROUND_UP(len, 2), rc; | ||
372 | - | ||
373 | - rc = hex2bin(dst, src, j); | ||
374 | - if (rc < 0) | ||
375 | - pr_debug("CHAP string contains non hex digit symbols\n"); | ||
376 | - | ||
377 | - dst[j] = '\0'; | ||
378 | - return j; | ||
379 | -} | ||
380 | - | ||
381 | static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) | ||
382 | { | ||
383 | int i; | ||
384 | @@ -240,9 +228,16 @@ static int chap_server_compute_md5( | ||
385 | pr_err("Could not find CHAP_R.\n"); | ||
386 | goto out; | ||
387 | } | ||
388 | + if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) { | ||
389 | + pr_err("Malformed CHAP_R\n"); | ||
390 | + goto out; | ||
391 | + } | ||
392 | + if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) { | ||
393 | + pr_err("Malformed CHAP_R\n"); | ||
394 | + goto out; | ||
395 | + } | ||
396 | |||
397 | pr_debug("[server] Got CHAP_R=%s\n", chap_r); | ||
398 | - chap_string_to_hex(client_digest, chap_r, strlen(chap_r)); | ||
399 | |||
400 | tfm = crypto_alloc_shash("md5", 0, 0); | ||
401 | if (IS_ERR(tfm)) { | ||
402 | @@ -341,9 +336,7 @@ static int chap_server_compute_md5( | ||
403 | pr_err("Could not find CHAP_C.\n"); | ||
404 | goto out; | ||
405 | } | ||
406 | - pr_debug("[server] Got CHAP_C=%s\n", challenge); | ||
407 | - challenge_len = chap_string_to_hex(challenge_binhex, challenge, | ||
408 | - strlen(challenge)); | ||
409 | + challenge_len = DIV_ROUND_UP(strlen(challenge), 2); | ||
410 | if (!challenge_len) { | ||
411 | pr_err("Unable to convert incoming challenge\n"); | ||
412 | goto out; | ||
413 | @@ -352,6 +345,11 @@ static int chap_server_compute_md5( | ||
414 | pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n"); | ||
415 | goto out; | ||
416 | } | ||
417 | + if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) { | ||
418 | + pr_err("Malformed CHAP_C\n"); | ||
419 | + goto out; | ||
420 | + } | ||
421 | + pr_debug("[server] Got CHAP_C=%s\n", challenge); | ||
422 | /* | ||
423 | * During mutual authentication, the CHAP_C generated by the | ||
424 | * initiator must not match the original CHAP_C generated by | ||
425 | diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c | ||
426 | index f62c598810ff..638eb9bbd59f 100644 | ||
427 | --- a/drivers/tty/vt/vt_ioctl.c | ||
428 | +++ b/drivers/tty/vt/vt_ioctl.c | ||
429 | @@ -31,6 +31,8 @@ | ||
430 | #include <asm/io.h> | ||
431 | #include <asm/uaccess.h> | ||
432 | |||
433 | +#include <linux/nospec.h> | ||
434 | + | ||
435 | #include <linux/kbd_kern.h> | ||
436 | #include <linux/vt_kern.h> | ||
437 | #include <linux/kbd_diacr.h> | ||
438 | @@ -703,6 +705,8 @@ int vt_ioctl(struct tty_struct *tty, | ||
439 | if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) | ||
440 | ret = -ENXIO; | ||
441 | else { | ||
442 | + vsa.console = array_index_nospec(vsa.console, | ||
443 | + MAX_NR_CONSOLES + 1); | ||
444 | vsa.console--; | ||
445 | console_lock(); | ||
446 | ret = vc_allocate(vsa.console); | ||
447 | diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c | ||
448 | index e8b365000d73..e16bc4cec62e 100644 | ||
449 | --- a/fs/ext4/dir.c | ||
450 | +++ b/fs/ext4/dir.c | ||
451 | @@ -74,7 +74,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, | ||
452 | else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len))) | ||
453 | error_msg = "rec_len is too small for name_len"; | ||
454 | else if (unlikely(((char *) de - buf) + rlen > size)) | ||
455 | - error_msg = "directory entry across range"; | ||
456 | + error_msg = "directory entry overrun"; | ||
457 | else if (unlikely(le32_to_cpu(de->inode) > | ||
458 | le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) | ||
459 | error_msg = "inode out of bounds"; | ||
460 | @@ -83,18 +83,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, | ||
461 | |||
462 | if (filp) | ||
463 | ext4_error_file(filp, function, line, bh->b_blocknr, | ||
464 | - "bad entry in directory: %s - offset=%u(%u), " | ||
465 | - "inode=%u, rec_len=%d, name_len=%d", | ||
466 | - error_msg, (unsigned) (offset % size), | ||
467 | - offset, le32_to_cpu(de->inode), | ||
468 | - rlen, de->name_len); | ||
469 | + "bad entry in directory: %s - offset=%u, " | ||
470 | + "inode=%u, rec_len=%d, name_len=%d, size=%d", | ||
471 | + error_msg, offset, le32_to_cpu(de->inode), | ||
472 | + rlen, de->name_len, size); | ||
473 | else | ||
474 | ext4_error_inode(dir, function, line, bh->b_blocknr, | ||
475 | - "bad entry in directory: %s - offset=%u(%u), " | ||
476 | - "inode=%u, rec_len=%d, name_len=%d", | ||
477 | - error_msg, (unsigned) (offset % size), | ||
478 | - offset, le32_to_cpu(de->inode), | ||
479 | - rlen, de->name_len); | ||
480 | + "bad entry in directory: %s - offset=%u, " | ||
481 | + "inode=%u, rec_len=%d, name_len=%d, size=%d", | ||
482 | + error_msg, offset, le32_to_cpu(de->inode), | ||
483 | + rlen, de->name_len, size); | ||
484 | |||
485 | return 1; | ||
486 | } | ||
487 | diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c | ||
488 | index 436baf7cdca3..211539a7adfc 100644 | ||
489 | --- a/fs/ext4/inline.c | ||
490 | +++ b/fs/ext4/inline.c | ||
491 | @@ -1754,6 +1754,7 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) | ||
492 | { | ||
493 | int err, inline_size; | ||
494 | struct ext4_iloc iloc; | ||
495 | + size_t inline_len; | ||
496 | void *inline_pos; | ||
497 | unsigned int offset; | ||
498 | struct ext4_dir_entry_2 *de; | ||
499 | @@ -1781,8 +1782,9 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) | ||
500 | goto out; | ||
501 | } | ||
502 | |||
503 | + inline_len = ext4_get_inline_size(dir); | ||
504 | offset = EXT4_INLINE_DOTDOT_SIZE; | ||
505 | - while (offset < dir->i_size) { | ||
506 | + while (offset < inline_len) { | ||
507 | de = ext4_get_inline_entry(dir, &iloc, offset, | ||
508 | &inline_pos, &inline_size); | ||
509 | if (ext4_check_dir_entry(dir, NULL, de, | ||
510 | diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c | ||
511 | index d89754ef1aab..c2e830a6206d 100644 | ||
512 | --- a/fs/ext4/mmp.c | ||
513 | +++ b/fs/ext4/mmp.c | ||
514 | @@ -48,7 +48,6 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh) | ||
515 | */ | ||
516 | sb_start_write(sb); | ||
517 | ext4_mmp_csum_set(sb, mmp); | ||
518 | - mark_buffer_dirty(bh); | ||
519 | lock_buffer(bh); | ||
520 | bh->b_end_io = end_buffer_write_sync; | ||
521 | get_bh(bh); | ||
522 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c | ||
523 | index a225a21d04ad..bc727c393a89 100644 | ||
524 | --- a/fs/ext4/namei.c | ||
525 | +++ b/fs/ext4/namei.c | ||
526 | @@ -3527,6 +3527,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, | ||
527 | int credits; | ||
528 | u8 old_file_type; | ||
529 | |||
530 | + if (new.inode && new.inode->i_nlink == 0) { | ||
531 | + EXT4_ERROR_INODE(new.inode, | ||
532 | + "target of rename is already freed"); | ||
533 | + return -EFSCORRUPTED; | ||
534 | + } | ||
535 | + | ||
536 | if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT)) && | ||
537 | (!projid_eq(EXT4_I(new_dir)->i_projid, | ||
538 | EXT4_I(old_dentry->d_inode)->i_projid))) | ||
539 | diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c | ||
540 | index eb720d9e2953..1da301ee78ce 100644 | ||
541 | --- a/fs/ext4/resize.c | ||
542 | +++ b/fs/ext4/resize.c | ||
543 | @@ -18,6 +18,7 @@ | ||
544 | |||
545 | int ext4_resize_begin(struct super_block *sb) | ||
546 | { | ||
547 | + struct ext4_sb_info *sbi = EXT4_SB(sb); | ||
548 | int ret = 0; | ||
549 | |||
550 | if (!capable(CAP_SYS_RESOURCE)) | ||
551 | @@ -28,7 +29,7 @@ int ext4_resize_begin(struct super_block *sb) | ||
552 | * because the user tools have no way of handling this. Probably a | ||
553 | * bad time to do it anyways. | ||
554 | */ | ||
555 | - if (EXT4_SB(sb)->s_sbh->b_blocknr != | ||
556 | + if (EXT4_B2C(sbi, sbi->s_sbh->b_blocknr) != | ||
557 | le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) { | ||
558 | ext4_warning(sb, "won't resize using backup superblock at %llu", | ||
559 | (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr); | ||
560 | @@ -1954,6 +1955,26 @@ retry: | ||
561 | } | ||
562 | } | ||
563 | |||
564 | + /* | ||
565 | + * Make sure the last group has enough space so that it's | ||
566 | + * guaranteed to have enough space for all metadata blocks | ||
567 | + * that it might need to hold. (We might not need to store | ||
568 | + * the inode table blocks in the last block group, but there | ||
569 | + * will be cases where this might be needed.) | ||
570 | + */ | ||
571 | + if ((ext4_group_first_block_no(sb, n_group) + | ||
572 | + ext4_group_overhead_blocks(sb, n_group) + 2 + | ||
573 | + sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) { | ||
574 | + n_blocks_count = ext4_group_first_block_no(sb, n_group); | ||
575 | + n_group--; | ||
576 | + n_blocks_count_retry = 0; | ||
577 | + if (resize_inode) { | ||
578 | + iput(resize_inode); | ||
579 | + resize_inode = NULL; | ||
580 | + } | ||
581 | + goto retry; | ||
582 | + } | ||
583 | + | ||
584 | /* extend the last group */ | ||
585 | if (n_group == o_group) | ||
586 | add = n_blocks_count - o_blocks_count; | ||
587 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c | ||
588 | index 9d44b3683b46..f88d4804c3a8 100644 | ||
589 | --- a/fs/ext4/super.c | ||
590 | +++ b/fs/ext4/super.c | ||
591 | @@ -2015,6 +2015,8 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, | ||
592 | SEQ_OPTS_PRINT("max_dir_size_kb=%u", sbi->s_max_dir_size_kb); | ||
593 | if (test_opt(sb, DATA_ERR_ABORT)) | ||
594 | SEQ_OPTS_PUTS("data_err=abort"); | ||
595 | + if (DUMMY_ENCRYPTION_ENABLED(sbi)) | ||
596 | + SEQ_OPTS_PUTS("test_dummy_encryption"); | ||
597 | |||
598 | ext4_show_quota_options(seq, sb); | ||
599 | return 0; | ||
600 | @@ -4187,11 +4189,13 @@ no_journal: | ||
601 | block = ext4_count_free_clusters(sb); | ||
602 | ext4_free_blocks_count_set(sbi->s_es, | ||
603 | EXT4_C2B(sbi, block)); | ||
604 | + ext4_superblock_csum_set(sb); | ||
605 | err = percpu_counter_init(&sbi->s_freeclusters_counter, block, | ||
606 | GFP_KERNEL); | ||
607 | if (!err) { | ||
608 | unsigned long freei = ext4_count_free_inodes(sb); | ||
609 | sbi->s_es->s_free_inodes_count = cpu_to_le32(freei); | ||
610 | + ext4_superblock_csum_set(sb); | ||
611 | err = percpu_counter_init(&sbi->s_freeinodes_counter, freei, | ||
612 | GFP_KERNEL); | ||
613 | } | ||
614 | diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c | ||
615 | index 8f040f88ade4..25c8b328c43d 100644 | ||
616 | --- a/fs/ocfs2/buffer_head_io.c | ||
617 | +++ b/fs/ocfs2/buffer_head_io.c | ||
618 | @@ -341,6 +341,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, | ||
619 | * for this bh as it's not marked locally | ||
620 | * uptodate. */ | ||
621 | status = -EIO; | ||
622 | + clear_buffer_needs_validate(bh); | ||
623 | put_bh(bh); | ||
624 | bhs[i] = NULL; | ||
625 | continue; | ||
626 | diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h | ||
627 | index 316694dafa5b..008f466d1da7 100644 | ||
628 | --- a/include/net/nfc/hci.h | ||
629 | +++ b/include/net/nfc/hci.h | ||
630 | @@ -87,7 +87,7 @@ struct nfc_hci_pipe { | ||
631 | * According to specification 102 622 chapter 4.4 Pipes, | ||
632 | * the pipe identifier is 7 bits long. | ||
633 | */ | ||
634 | -#define NFC_HCI_MAX_PIPES 127 | ||
635 | +#define NFC_HCI_MAX_PIPES 128 | ||
636 | struct nfc_hci_init_data { | ||
637 | u8 gate_count; | ||
638 | struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES]; | ||
639 | diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c | ||
640 | index f6e8727f7fa3..f81adb476c03 100644 | ||
641 | --- a/kernel/sched/fair.c | ||
642 | +++ b/kernel/sched/fair.c | ||
643 | @@ -8639,7 +8639,8 @@ static inline bool vruntime_normalized(struct task_struct *p) | ||
644 | * - A task which has been woken up by try_to_wake_up() and | ||
645 | * waiting for actually being woken up by sched_ttwu_pending(). | ||
646 | */ | ||
647 | - if (!se->sum_exec_runtime || p->state == TASK_WAKING) | ||
648 | + if (!se->sum_exec_runtime || | ||
649 | + (p->state == TASK_WAKING && p->sched_remote_wakeup)) | ||
650 | return true; | ||
651 | |||
652 | return false; | ||
653 | diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c | ||
654 | index dc29b600d2cb..f316e90ad538 100644 | ||
655 | --- a/kernel/trace/ring_buffer.c | ||
656 | +++ b/kernel/trace/ring_buffer.c | ||
657 | @@ -1504,6 +1504,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) | ||
658 | tmp_iter_page = first_page; | ||
659 | |||
660 | do { | ||
661 | + cond_resched(); | ||
662 | + | ||
663 | to_remove_page = tmp_iter_page; | ||
664 | rb_inc_page(cpu_buffer, &tmp_iter_page); | ||
665 | |||
666 | diff --git a/mm/shmem.c b/mm/shmem.c | ||
667 | index 42ca5df2c0e3..4b5cca167baf 100644 | ||
668 | --- a/mm/shmem.c | ||
669 | +++ b/mm/shmem.c | ||
670 | @@ -2160,6 +2160,8 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode | ||
671 | mpol_shared_policy_init(&info->policy, NULL); | ||
672 | break; | ||
673 | } | ||
674 | + | ||
675 | + lockdep_annotate_inode_mutex_key(inode); | ||
676 | } else | ||
677 | shmem_free_inode(sb); | ||
678 | return inode; | ||
679 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c | ||
680 | index 128c811dcb1a..8eb1916b742c 100644 | ||
681 | --- a/net/core/neighbour.c | ||
682 | +++ b/net/core/neighbour.c | ||
683 | @@ -1138,6 +1138,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, | ||
684 | lladdr = neigh->ha; | ||
685 | } | ||
686 | |||
687 | + /* Update confirmed timestamp for neighbour entry after we | ||
688 | + * received ARP packet even if it doesn't change IP to MAC binding. | ||
689 | + */ | ||
690 | + if (new & NUD_CONNECTED) | ||
691 | + neigh->confirmed = jiffies; | ||
692 | + | ||
693 | /* If entry was valid and address is not changed, | ||
694 | do not change entry state, if new one is STALE. | ||
695 | */ | ||
696 | @@ -1159,15 +1165,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, | ||
697 | } | ||
698 | } | ||
699 | |||
700 | - /* Update timestamps only once we know we will make a change to the | ||
701 | + /* Update timestamp only once we know we will make a change to the | ||
702 | * neighbour entry. Otherwise we risk to move the locktime window with | ||
703 | * noop updates and ignore relevant ARP updates. | ||
704 | */ | ||
705 | - if (new != old || lladdr != neigh->ha) { | ||
706 | - if (new & NUD_CONNECTED) | ||
707 | - neigh->confirmed = jiffies; | ||
708 | + if (new != old || lladdr != neigh->ha) | ||
709 | neigh->updated = jiffies; | ||
710 | - } | ||
711 | |||
712 | if (new != old) { | ||
713 | neigh_del_timer(neigh); | ||
714 | diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c | ||
715 | index b5116ec31757..689246d079ad 100644 | ||
716 | --- a/net/ipv4/af_inet.c | ||
717 | +++ b/net/ipv4/af_inet.c | ||
718 | @@ -1277,6 +1277,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, | ||
719 | if (encap) | ||
720 | skb_reset_inner_headers(skb); | ||
721 | skb->network_header = (u8 *)iph - skb->head; | ||
722 | + skb_reset_mac_len(skb); | ||
723 | } while ((skb = skb->next)); | ||
724 | |||
725 | out: | ||
726 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c | ||
727 | index aa2a20e918fd..b9b2a9828d98 100644 | ||
728 | --- a/net/ipv4/udp.c | ||
729 | +++ b/net/ipv4/udp.c | ||
730 | @@ -1730,6 +1730,28 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh, | ||
731 | inet_compute_pseudo); | ||
732 | } | ||
733 | |||
734 | +/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and | ||
735 | + * return code conversion for ip layer consumption | ||
736 | + */ | ||
737 | +static int udp_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb, | ||
738 | + struct udphdr *uh) | ||
739 | +{ | ||
740 | + int ret; | ||
741 | + | ||
742 | + if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) | ||
743 | + skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, | ||
744 | + inet_compute_pseudo); | ||
745 | + | ||
746 | + ret = udp_queue_rcv_skb(sk, skb); | ||
747 | + | ||
748 | + /* a return value > 0 means to resubmit the input, but | ||
749 | + * it wants the return to be -protocol, or 0 | ||
750 | + */ | ||
751 | + if (ret > 0) | ||
752 | + return -ret; | ||
753 | + return 0; | ||
754 | +} | ||
755 | + | ||
756 | /* | ||
757 | * All we need to do is get the socket, and then do a checksum. | ||
758 | */ | ||
759 | @@ -1776,14 +1798,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | ||
760 | if (unlikely(sk->sk_rx_dst != dst)) | ||
761 | udp_sk_rx_dst_set(sk, dst); | ||
762 | |||
763 | - ret = udp_queue_rcv_skb(sk, skb); | ||
764 | + ret = udp_unicast_rcv_skb(sk, skb, uh); | ||
765 | sock_put(sk); | ||
766 | - /* a return value > 0 means to resubmit the input, but | ||
767 | - * it wants the return to be -protocol, or 0 | ||
768 | - */ | ||
769 | - if (ret > 0) | ||
770 | - return -ret; | ||
771 | - return 0; | ||
772 | + return ret; | ||
773 | } | ||
774 | |||
775 | if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST)) | ||
776 | @@ -1791,22 +1808,8 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | ||
777 | saddr, daddr, udptable, proto); | ||
778 | |||
779 | sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable); | ||
780 | - if (sk) { | ||
781 | - int ret; | ||
782 | - | ||
783 | - if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) | ||
784 | - skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, | ||
785 | - inet_compute_pseudo); | ||
786 | - | ||
787 | - ret = udp_queue_rcv_skb(sk, skb); | ||
788 | - | ||
789 | - /* a return value > 0 means to resubmit the input, but | ||
790 | - * it wants the return to be -protocol, or 0 | ||
791 | - */ | ||
792 | - if (ret > 0) | ||
793 | - return -ret; | ||
794 | - return 0; | ||
795 | - } | ||
796 | + if (sk) | ||
797 | + return udp_unicast_rcv_skb(sk, skb, uh); | ||
798 | |||
799 | if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) | ||
800 | goto drop; | ||
801 | diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c | ||
802 | index 649f4d87b318..a36ae90bf613 100644 | ||
803 | --- a/net/ipv6/ip6_offload.c | ||
804 | +++ b/net/ipv6/ip6_offload.c | ||
805 | @@ -113,6 +113,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, | ||
806 | payload_len = skb->len - nhoff - sizeof(*ipv6h); | ||
807 | ipv6h->payload_len = htons(payload_len); | ||
808 | skb->network_header = (u8 *)ipv6h - skb->head; | ||
809 | + skb_reset_mac_len(skb); | ||
810 | |||
811 | if (udpfrag) { | ||
812 | int err = ip6_find_1stfragopt(skb, &prevhdr); | ||
813 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c | ||
814 | index ea14466cdca8..8e77cecd2165 100644 | ||
815 | --- a/net/ipv6/ip6_output.c | ||
816 | +++ b/net/ipv6/ip6_output.c | ||
817 | @@ -201,12 +201,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, | ||
818 | kfree_skb(skb); | ||
819 | return -ENOBUFS; | ||
820 | } | ||
821 | + if (skb->sk) | ||
822 | + skb_set_owner_w(skb2, skb->sk); | ||
823 | consume_skb(skb); | ||
824 | skb = skb2; | ||
825 | - /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically, | ||
826 | - * it is safe to call in our context (socket lock not held) | ||
827 | - */ | ||
828 | - skb_set_owner_w(skb, (struct sock *)sk); | ||
829 | } | ||
830 | if (opt->opt_flen) | ||
831 | ipv6_push_frag_opts(skb, opt, &proto); | ||
832 | diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c | ||
833 | index 2b0f0ac498d2..5a58f9f38095 100644 | ||
834 | --- a/net/nfc/hci/core.c | ||
835 | +++ b/net/nfc/hci/core.c | ||
836 | @@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, | ||
837 | } | ||
838 | create_info = (struct hci_create_pipe_resp *)skb->data; | ||
839 | |||
840 | + if (create_info->pipe >= NFC_HCI_MAX_PIPES) { | ||
841 | + status = NFC_HCI_ANY_E_NOK; | ||
842 | + goto exit; | ||
843 | + } | ||
844 | + | ||
845 | /* Save the new created pipe and bind with local gate, | ||
846 | * the description for skb->data[3] is destination gate id | ||
847 | * but since we received this cmd from host controller, we | ||
848 | @@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, | ||
849 | } | ||
850 | delete_info = (struct hci_delete_pipe_noti *)skb->data; | ||
851 | |||
852 | + if (delete_info->pipe >= NFC_HCI_MAX_PIPES) { | ||
853 | + status = NFC_HCI_ANY_E_NOK; | ||
854 | + goto exit; | ||
855 | + } | ||
856 | + | ||
857 | hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE; | ||
858 | hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST; | ||
859 | break; | ||
860 | diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c | ||
861 | index 3469ac14c89c..d0dfa822266b 100644 | ||
862 | --- a/sound/firewire/bebob/bebob.c | ||
863 | +++ b/sound/firewire/bebob/bebob.c | ||
864 | @@ -263,6 +263,8 @@ do_registration(struct work_struct *work) | ||
865 | error: | ||
866 | mutex_unlock(&devices_mutex); | ||
867 | snd_bebob_stream_destroy_duplex(bebob); | ||
868 | + kfree(bebob->maudio_special_quirk); | ||
869 | + bebob->maudio_special_quirk = NULL; | ||
870 | snd_card_free(bebob->card); | ||
871 | dev_info(&bebob->unit->device, | ||
872 | "Sound card registration failed: %d\n", err); | ||
873 | diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c | ||
874 | index 07e5abdbceb5..6dbf047d4f75 100644 | ||
875 | --- a/sound/firewire/bebob/bebob_maudio.c | ||
876 | +++ b/sound/firewire/bebob/bebob_maudio.c | ||
877 | @@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) | ||
878 | struct fw_device *device = fw_parent_device(unit); | ||
879 | int err, rcode; | ||
880 | u64 date; | ||
881 | - __le32 cues[3] = { | ||
882 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE1), | ||
883 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE2), | ||
884 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE3) | ||
885 | - }; | ||
886 | + __le32 *cues; | ||
887 | |||
888 | /* check date of software used to build */ | ||
889 | err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE, | ||
890 | &date, sizeof(u64)); | ||
891 | if (err < 0) | ||
892 | - goto end; | ||
893 | + return err; | ||
894 | /* | ||
895 | * firmware version 5058 or later has date later than "20070401", but | ||
896 | * 'date' is not null-terminated. | ||
897 | @@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) | ||
898 | if (date < 0x3230303730343031LL) { | ||
899 | dev_err(&unit->device, | ||
900 | "Use firmware version 5058 or later\n"); | ||
901 | - err = -ENOSYS; | ||
902 | - goto end; | ||
903 | + return -ENXIO; | ||
904 | } | ||
905 | |||
906 | + cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL); | ||
907 | + if (!cues) | ||
908 | + return -ENOMEM; | ||
909 | + | ||
910 | + cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1); | ||
911 | + cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2); | ||
912 | + cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3); | ||
913 | + | ||
914 | rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST, | ||
915 | device->node_id, device->generation, | ||
916 | device->max_speed, BEBOB_ADDR_REG_REQ, | ||
917 | - cues, sizeof(cues)); | ||
918 | + cues, 3 * sizeof(*cues)); | ||
919 | + kfree(cues); | ||
920 | if (rcode != RCODE_COMPLETE) { | ||
921 | dev_err(&unit->device, | ||
922 | "Failed to send a cue to load firmware\n"); | ||
923 | err = -EIO; | ||
924 | } | ||
925 | -end: | ||
926 | + | ||
927 | return err; | ||
928 | } | ||
929 | |||
930 | @@ -290,10 +294,6 @@ snd_bebob_maudio_special_discover(struct snd_bebob *bebob, bool is1814) | ||
931 | bebob->midi_output_ports = 2; | ||
932 | } | ||
933 | end: | ||
934 | - if (err < 0) { | ||
935 | - kfree(params); | ||
936 | - bebob->maudio_special_quirk = NULL; | ||
937 | - } | ||
938 | mutex_unlock(&bebob->mutex); | ||
939 | return err; | ||
940 | } | ||
941 | diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c | ||
942 | index 1f5e1d23f31a..ef689997d6a5 100644 | ||
943 | --- a/sound/firewire/digi00x/digi00x.c | ||
944 | +++ b/sound/firewire/digi00x/digi00x.c | ||
945 | @@ -49,6 +49,7 @@ static void dg00x_free(struct snd_dg00x *dg00x) | ||
946 | fw_unit_put(dg00x->unit); | ||
947 | |||
948 | mutex_destroy(&dg00x->mutex); | ||
949 | + kfree(dg00x); | ||
950 | } | ||
951 | |||
952 | static void dg00x_card_free(struct snd_card *card) | ||
953 | diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c | ||
954 | index 71a0613d3da0..f2d073365cf6 100644 | ||
955 | --- a/sound/firewire/fireworks/fireworks.c | ||
956 | +++ b/sound/firewire/fireworks/fireworks.c | ||
957 | @@ -301,6 +301,8 @@ error: | ||
958 | snd_efw_transaction_remove_instance(efw); | ||
959 | snd_efw_stream_destroy_duplex(efw); | ||
960 | snd_card_free(efw->card); | ||
961 | + kfree(efw->resp_buf); | ||
962 | + efw->resp_buf = NULL; | ||
963 | dev_info(&efw->unit->device, | ||
964 | "Sound card registration failed: %d\n", err); | ||
965 | } | ||
966 | diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c | ||
967 | index 474b06d8acd1..696b6cf35003 100644 | ||
968 | --- a/sound/firewire/oxfw/oxfw.c | ||
969 | +++ b/sound/firewire/oxfw/oxfw.c | ||
970 | @@ -135,6 +135,7 @@ static void oxfw_free(struct snd_oxfw *oxfw) | ||
971 | |||
972 | kfree(oxfw->spec); | ||
973 | mutex_destroy(&oxfw->mutex); | ||
974 | + kfree(oxfw); | ||
975 | } | ||
976 | |||
977 | /* | ||
978 | @@ -212,6 +213,7 @@ static int detect_quirks(struct snd_oxfw *oxfw) | ||
979 | static void do_registration(struct work_struct *work) | ||
980 | { | ||
981 | struct snd_oxfw *oxfw = container_of(work, struct snd_oxfw, dwork.work); | ||
982 | + int i; | ||
983 | int err; | ||
984 | |||
985 | if (oxfw->registered) | ||
986 | @@ -274,7 +276,15 @@ error: | ||
987 | snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream); | ||
988 | if (oxfw->has_output) | ||
989 | snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream); | ||
990 | + for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; ++i) { | ||
991 | + kfree(oxfw->tx_stream_formats[i]); | ||
992 | + oxfw->tx_stream_formats[i] = NULL; | ||
993 | + kfree(oxfw->rx_stream_formats[i]); | ||
994 | + oxfw->rx_stream_formats[i] = NULL; | ||
995 | + } | ||
996 | snd_card_free(oxfw->card); | ||
997 | + kfree(oxfw->spec); | ||
998 | + oxfw->spec = NULL; | ||
999 | dev_info(&oxfw->unit->device, | ||
1000 | "Sound card registration failed: %d\n", err); | ||
1001 | } | ||
1002 | diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c | ||
1003 | index 9dc93a7eb9da..4c967ac1c0e8 100644 | ||
1004 | --- a/sound/firewire/tascam/tascam.c | ||
1005 | +++ b/sound/firewire/tascam/tascam.c | ||
1006 | @@ -93,6 +93,7 @@ static void tscm_free(struct snd_tscm *tscm) | ||
1007 | fw_unit_put(tscm->unit); | ||
1008 | |||
1009 | mutex_destroy(&tscm->mutex); | ||
1010 | + kfree(tscm); | ||
1011 | } | ||
1012 | |||
1013 | static void tscm_card_free(struct snd_card *card) | ||
1014 | diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c | ||
1015 | index 56fc47bd6dba..50b216fc369f 100644 | ||
1016 | --- a/sound/pci/emu10k1/emufx.c | ||
1017 | +++ b/sound/pci/emu10k1/emufx.c | ||
1018 | @@ -2520,7 +2520,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un | ||
1019 | emu->support_tlv = 1; | ||
1020 | return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp); | ||
1021 | case SNDRV_EMU10K1_IOCTL_INFO: | ||
1022 | - info = kmalloc(sizeof(*info), GFP_KERNEL); | ||
1023 | + info = kzalloc(sizeof(*info), GFP_KERNEL); | ||
1024 | if (!info) | ||
1025 | return -ENOMEM; | ||
1026 | snd_emu10k1_fx8010_info(emu, info); | ||
1027 | diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c | ||
1028 | index fd966bb851cb..6e8eb1f5a041 100644 | ||
1029 | --- a/sound/soc/codecs/cs4265.c | ||
1030 | +++ b/sound/soc/codecs/cs4265.c | ||
1031 | @@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = { | ||
1032 | SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2, | ||
1033 | 3, 1, 0), | ||
1034 | SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum), | ||
1035 | - SOC_SINGLE("MMTLR Data Switch", 0, | ||
1036 | - 1, 1, 0), | ||
1037 | + SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2, | ||
1038 | + 0, 1, 0), | ||
1039 | SOC_ENUM("Mono Channel Select", spdif_mono_select_enum), | ||
1040 | SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24), | ||
1041 | }; |