Contents of /trunk/kernel-alx/patches-4.9/0229-4.9.130-all-fixes.patch
Parent Directory | Revision Log
Revision 3230 -
(show annotations)
(download)
Mon Oct 1 09:59:50 2018 UTC (5 years, 11 months ago) by niro
File size: 36931 byte(s)
Mon Oct 1 09:59:50 2018 UTC (5 years, 11 months ago) by niro
File size: 36931 byte(s)
-linux-4.9.130
1 | diff --git a/Makefile b/Makefile |
2 | index 3f3c340374c5..b98e04a5e1e5 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 129 |
9 | +SUBLEVEL = 130 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c |
14 | index b9fc52556bcc..0b29a43e09c8 100644 |
15 | --- a/arch/x86/xen/pmu.c |
16 | +++ b/arch/x86/xen/pmu.c |
17 | @@ -477,7 +477,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs, |
18 | irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) |
19 | { |
20 | int err, ret = IRQ_NONE; |
21 | - struct pt_regs regs; |
22 | + struct pt_regs regs = {0}; |
23 | const struct xen_pmu_data *xenpmu_data = get_xenpmu_data(); |
24 | uint8_t xenpmu_flags = get_xenpmu_flags(); |
25 | |
26 | diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c |
27 | index 56c288f78d8a..5bfae1f972c7 100644 |
28 | --- a/drivers/gpu/drm/nouveau/nouveau_connector.c |
29 | +++ b/drivers/gpu/drm/nouveau/nouveau_connector.c |
30 | @@ -271,12 +271,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) |
31 | nv_connector->edid = NULL; |
32 | } |
33 | |
34 | - /* Outputs are only polled while runtime active, so acquiring a |
35 | - * runtime PM ref here is unnecessary (and would deadlock upon |
36 | - * runtime suspend because it waits for polling to finish). |
37 | + /* Outputs are only polled while runtime active, so resuming the |
38 | + * device here is unnecessary (and would deadlock upon runtime suspend |
39 | + * because it waits for polling to finish). We do however, want to |
40 | + * prevent the autosuspend timer from elapsing during this operation |
41 | + * if possible. |
42 | */ |
43 | - if (!drm_kms_helper_is_poll_worker()) { |
44 | - ret = pm_runtime_get_sync(connector->dev->dev); |
45 | + if (drm_kms_helper_is_poll_worker()) { |
46 | + pm_runtime_get_noresume(dev->dev); |
47 | + } else { |
48 | + ret = pm_runtime_get_sync(dev->dev); |
49 | if (ret < 0 && ret != -EACCES) |
50 | return conn_status; |
51 | } |
52 | @@ -354,10 +358,8 @@ detect_analog: |
53 | |
54 | out: |
55 | |
56 | - if (!drm_kms_helper_is_poll_worker()) { |
57 | - pm_runtime_mark_last_busy(connector->dev->dev); |
58 | - pm_runtime_put_autosuspend(connector->dev->dev); |
59 | - } |
60 | + pm_runtime_mark_last_busy(dev->dev); |
61 | + pm_runtime_put_autosuspend(dev->dev); |
62 | |
63 | return conn_status; |
64 | } |
65 | diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c |
66 | index 6526a3366087..3ddd4096da2a 100644 |
67 | --- a/drivers/gpu/drm/nouveau/nouveau_display.c |
68 | +++ b/drivers/gpu/drm/nouveau/nouveau_display.c |
69 | @@ -367,8 +367,6 @@ nouveau_display_hpd_work(struct work_struct *work) |
70 | pm_runtime_get_sync(drm->dev->dev); |
71 | |
72 | drm_helper_hpd_irq_event(drm->dev); |
73 | - /* enable polling for external displays */ |
74 | - drm_kms_helper_poll_enable(drm->dev); |
75 | |
76 | pm_runtime_mark_last_busy(drm->dev->dev); |
77 | pm_runtime_put_sync(drm->dev->dev); |
78 | @@ -391,15 +389,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val, |
79 | { |
80 | struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb); |
81 | struct acpi_bus_event *info = data; |
82 | + int ret; |
83 | |
84 | if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) { |
85 | if (info->type == ACPI_VIDEO_NOTIFY_PROBE) { |
86 | - /* |
87 | - * This may be the only indication we receive of a |
88 | - * connector hotplug on a runtime suspended GPU, |
89 | - * schedule hpd_work to check. |
90 | - */ |
91 | - schedule_work(&drm->hpd_work); |
92 | + ret = pm_runtime_get(drm->dev->dev); |
93 | + if (ret == 1 || ret == -EACCES) { |
94 | + /* If the GPU is already awake, or in a state |
95 | + * where we can't wake it up, it can handle |
96 | + * it's own hotplug events. |
97 | + */ |
98 | + pm_runtime_put_autosuspend(drm->dev->dev); |
99 | + } else if (ret == 0) { |
100 | + /* This may be the only indication we receive |
101 | + * of a connector hotplug on a runtime |
102 | + * suspended GPU, schedule hpd_work to check. |
103 | + */ |
104 | + NV_DEBUG(drm, "ACPI requested connector reprobe\n"); |
105 | + schedule_work(&drm->hpd_work); |
106 | + pm_runtime_put_noidle(drm->dev->dev); |
107 | + } else { |
108 | + NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n", |
109 | + ret); |
110 | + } |
111 | |
112 | /* acpi-video should not generate keypresses for this */ |
113 | return NOTIFY_BAD; |
114 | @@ -422,6 +434,11 @@ nouveau_display_init(struct drm_device *dev) |
115 | if (ret) |
116 | return ret; |
117 | |
118 | + /* enable connector detection and polling for connectors without HPD |
119 | + * support |
120 | + */ |
121 | + drm_kms_helper_poll_enable(dev); |
122 | + |
123 | /* enable hotplug interrupts */ |
124 | list_for_each_entry(connector, &dev->mode_config.connector_list, head) { |
125 | struct nouveau_connector *conn = nouveau_connector(connector); |
126 | diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c |
127 | index f8c9f6f4f822..a2d8630058ed 100644 |
128 | --- a/drivers/gpu/drm/vc4/vc4_plane.c |
129 | +++ b/drivers/gpu/drm/vc4/vc4_plane.c |
130 | @@ -327,6 +327,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) |
131 | vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0], |
132 | vc4_state->crtc_h); |
133 | |
134 | + vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && |
135 | + vc4_state->y_scaling[0] == VC4_SCALING_NONE); |
136 | + |
137 | if (num_planes > 1) { |
138 | vc4_state->is_yuv = true; |
139 | |
140 | @@ -342,24 +345,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) |
141 | vc4_get_scaling_mode(vc4_state->src_h[1], |
142 | vc4_state->crtc_h); |
143 | |
144 | - /* YUV conversion requires that scaling be enabled, |
145 | - * even on a plane that's otherwise 1:1. Choose TPZ |
146 | - * for simplicity. |
147 | + /* YUV conversion requires that horizontal scaling be enabled, |
148 | + * even on a plane that's otherwise 1:1. Looks like only PPF |
149 | + * works in that case, so let's pick that one. |
150 | */ |
151 | - if (vc4_state->x_scaling[0] == VC4_SCALING_NONE) |
152 | - vc4_state->x_scaling[0] = VC4_SCALING_TPZ; |
153 | - if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) |
154 | - vc4_state->y_scaling[0] = VC4_SCALING_TPZ; |
155 | + if (vc4_state->is_unity) |
156 | + vc4_state->x_scaling[0] = VC4_SCALING_PPF; |
157 | } else { |
158 | vc4_state->x_scaling[1] = VC4_SCALING_NONE; |
159 | vc4_state->y_scaling[1] = VC4_SCALING_NONE; |
160 | } |
161 | |
162 | - vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && |
163 | - vc4_state->y_scaling[0] == VC4_SCALING_NONE && |
164 | - vc4_state->x_scaling[1] == VC4_SCALING_NONE && |
165 | - vc4_state->y_scaling[1] == VC4_SCALING_NONE); |
166 | - |
167 | /* No configuring scaling on the cursor plane, since it gets |
168 | non-vblank-synced updates, and scaling requires requires |
169 | LBM changes which have to be vblank-synced. |
170 | @@ -614,7 +610,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane, |
171 | vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5); |
172 | } |
173 | |
174 | - if (!vc4_state->is_unity) { |
175 | + if (vc4_state->x_scaling[0] != VC4_SCALING_NONE || |
176 | + vc4_state->x_scaling[1] != VC4_SCALING_NONE || |
177 | + vc4_state->y_scaling[0] != VC4_SCALING_NONE || |
178 | + vc4_state->y_scaling[1] != VC4_SCALING_NONE) { |
179 | /* LBM Base Address. */ |
180 | if (vc4_state->y_scaling[0] != VC4_SCALING_NONE || |
181 | vc4_state->y_scaling[1] != VC4_SCALING_NONE) { |
182 | diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c |
183 | index 7944a1f589eb..2248b330c047 100644 |
184 | --- a/drivers/hid/hid-core.c |
185 | +++ b/drivers/hid/hid-core.c |
186 | @@ -2059,6 +2059,9 @@ static const struct hid_device_id hid_have_special_driver[] = { |
187 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) }, |
188 | { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) }, |
189 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) }, |
190 | + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) }, |
191 | + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) }, |
192 | + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE) }, |
193 | { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) }, |
194 | { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) }, |
195 | { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER) }, |
196 | diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h |
197 | index 019ee9181f2b..de64cd33590a 100644 |
198 | --- a/drivers/hid/hid-ids.h |
199 | +++ b/drivers/hid/hid-ids.h |
200 | @@ -927,6 +927,8 @@ |
201 | #define USB_DEVICE_ID_SONY_PS3_BDREMOTE 0x0306 |
202 | #define USB_DEVICE_ID_SONY_PS3_CONTROLLER 0x0268 |
203 | #define USB_DEVICE_ID_SONY_PS4_CONTROLLER 0x05c4 |
204 | +#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_2 0x09cc |
205 | +#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE 0x0ba0 |
206 | #define USB_DEVICE_ID_SONY_MOTION_CONTROLLER 0x03d5 |
207 | #define USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER 0x042f |
208 | #define USB_DEVICE_ID_SONY_BUZZ_CONTROLLER 0x0002 |
209 | diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c |
210 | index 1b1dccd37fbd..eee58d15e745 100644 |
211 | --- a/drivers/hid/hid-sony.c |
212 | +++ b/drivers/hid/hid-sony.c |
213 | @@ -2581,6 +2581,12 @@ static const struct hid_device_id sony_devices[] = { |
214 | .driver_data = DUALSHOCK4_CONTROLLER_USB }, |
215 | { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER), |
216 | .driver_data = DUALSHOCK4_CONTROLLER_BT }, |
217 | + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2), |
218 | + .driver_data = DUALSHOCK4_CONTROLLER_USB }, |
219 | + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2), |
220 | + .driver_data = DUALSHOCK4_CONTROLLER_BT }, |
221 | + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE), |
222 | + .driver_data = DUALSHOCK4_CONTROLLER_USB }, |
223 | /* Nyko Core Controller for PS3 */ |
224 | { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER), |
225 | .driver_data = SIXAXIS_CONTROLLER_USB | SINO_LITE_CONTROLLER }, |
226 | diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c |
227 | index cc2243f6cc7f..bb45eb22ba1f 100644 |
228 | --- a/drivers/infiniband/hw/cxgb4/qp.c |
229 | +++ b/drivers/infiniband/hw/cxgb4/qp.c |
230 | @@ -1258,6 +1258,12 @@ static void flush_qp(struct c4iw_qp *qhp) |
231 | |
232 | t4_set_wq_in_error(&qhp->wq); |
233 | if (qhp->ibqp.uobject) { |
234 | + |
235 | + /* for user qps, qhp->wq.flushed is protected by qhp->mutex */ |
236 | + if (qhp->wq.flushed) |
237 | + return; |
238 | + |
239 | + qhp->wq.flushed = 1; |
240 | t4_set_cq_in_error(&rchp->cq); |
241 | spin_lock_irqsave(&rchp->comp_handler_lock, flag); |
242 | (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context); |
243 | diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c |
244 | index 518e2dec2aa2..5e9122cd3898 100644 |
245 | --- a/drivers/misc/vmw_balloon.c |
246 | +++ b/drivers/misc/vmw_balloon.c |
247 | @@ -45,6 +45,7 @@ |
248 | #include <linux/seq_file.h> |
249 | #include <linux/vmw_vmci_defs.h> |
250 | #include <linux/vmw_vmci_api.h> |
251 | +#include <linux/io.h> |
252 | #include <asm/hypervisor.h> |
253 | |
254 | MODULE_AUTHOR("VMware, Inc."); |
255 | diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c |
256 | index 2e4649655181..4e98e5aff7c5 100644 |
257 | --- a/drivers/net/appletalk/ipddp.c |
258 | +++ b/drivers/net/appletalk/ipddp.c |
259 | @@ -284,8 +284,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) |
260 | case SIOCFINDIPDDPRT: |
261 | spin_lock_bh(&ipddp_route_lock); |
262 | rp = __ipddp_find_route(&rcp); |
263 | - if (rp) |
264 | - memcpy(&rcp2, rp, sizeof(rcp2)); |
265 | + if (rp) { |
266 | + memset(&rcp2, 0, sizeof(rcp2)); |
267 | + rcp2.ip = rp->ip; |
268 | + rcp2.at = rp->at; |
269 | + rcp2.flags = rp->flags; |
270 | + } |
271 | spin_unlock_bh(&ipddp_route_lock); |
272 | |
273 | if (rp) { |
274 | diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c |
275 | index 631dbc7b4dbb..0988bf1a43c0 100644 |
276 | --- a/drivers/net/ethernet/hp/hp100.c |
277 | +++ b/drivers/net/ethernet/hp/hp100.c |
278 | @@ -2636,7 +2636,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin) |
279 | /* Wait for link to drop */ |
280 | time = jiffies + (HZ / 10); |
281 | do { |
282 | - if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) |
283 | + if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) |
284 | break; |
285 | if (!in_interrupt()) |
286 | schedule_timeout_interruptible(1); |
287 | diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c |
288 | index 7f6af10f09ee..3c1adb38412b 100644 |
289 | --- a/drivers/net/xen-netfront.c |
290 | +++ b/drivers/net/xen-netfront.c |
291 | @@ -906,7 +906,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, |
292 | BUG_ON(pull_to <= skb_headlen(skb)); |
293 | __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); |
294 | } |
295 | - BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS); |
296 | + if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { |
297 | + queue->rx.rsp_cons = ++cons; |
298 | + kfree_skb(nskb); |
299 | + return ~0U; |
300 | + } |
301 | |
302 | skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, |
303 | skb_frag_page(nfrag), |
304 | @@ -1043,6 +1047,8 @@ err: |
305 | skb->len += rx->status; |
306 | |
307 | i = xennet_fill_frags(queue, skb, &tmpq); |
308 | + if (unlikely(i == ~0U)) |
309 | + goto err; |
310 | |
311 | if (rx->flags & XEN_NETRXF_csum_blank) |
312 | skb->ip_summed = CHECKSUM_PARTIAL; |
313 | diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c |
314 | index 11bad826683e..1dbd09c91a7c 100644 |
315 | --- a/drivers/pci/host/pci-aardvark.c |
316 | +++ b/drivers/pci/host/pci-aardvark.c |
317 | @@ -976,6 +976,7 @@ static int advk_pcie_probe(struct platform_device *pdev) |
318 | return -ENOMEM; |
319 | } |
320 | |
321 | + pci_bus_size_bridges(bus); |
322 | pci_bus_assign_resources(bus); |
323 | |
324 | list_for_each_entry(child, &bus->children, node) |
325 | diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c |
326 | index a05d143ac43b..c7a695c2303a 100644 |
327 | --- a/drivers/pci/quirks.c |
328 | +++ b/drivers/pci/quirks.c |
329 | @@ -4236,11 +4236,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags) |
330 | * |
331 | * 0x9d10-0x9d1b PCI Express Root port #{1-12} |
332 | * |
333 | - * The 300 series chipset suffers from the same bug so include those root |
334 | - * ports here as well. |
335 | - * |
336 | - * 0xa32c-0xa343 PCI Express Root port #{0-24} |
337 | - * |
338 | * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html |
339 | * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html |
340 | * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html |
341 | @@ -4258,7 +4253,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev) |
342 | case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */ |
343 | case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */ |
344 | case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */ |
345 | - case 0xa32c ... 0xa343: /* 300 series */ |
346 | return true; |
347 | } |
348 | |
349 | diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c |
350 | index 005629447b0c..fe419935041c 100644 |
351 | --- a/drivers/platform/x86/alienware-wmi.c |
352 | +++ b/drivers/platform/x86/alienware-wmi.c |
353 | @@ -518,6 +518,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args, |
354 | if (obj && obj->type == ACPI_TYPE_INTEGER) |
355 | *out_data = (u32) obj->integer.value; |
356 | } |
357 | + kfree(output.pointer); |
358 | return status; |
359 | |
360 | } |
361 | diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c |
362 | index 98f75e5811c8..f06e74ea10d3 100644 |
363 | --- a/drivers/target/iscsi/iscsi_target_auth.c |
364 | +++ b/drivers/target/iscsi/iscsi_target_auth.c |
365 | @@ -26,18 +26,6 @@ |
366 | #include "iscsi_target_nego.h" |
367 | #include "iscsi_target_auth.h" |
368 | |
369 | -static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len) |
370 | -{ |
371 | - int j = DIV_ROUND_UP(len, 2), rc; |
372 | - |
373 | - rc = hex2bin(dst, src, j); |
374 | - if (rc < 0) |
375 | - pr_debug("CHAP string contains non hex digit symbols\n"); |
376 | - |
377 | - dst[j] = '\0'; |
378 | - return j; |
379 | -} |
380 | - |
381 | static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) |
382 | { |
383 | int i; |
384 | @@ -240,9 +228,16 @@ static int chap_server_compute_md5( |
385 | pr_err("Could not find CHAP_R.\n"); |
386 | goto out; |
387 | } |
388 | + if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) { |
389 | + pr_err("Malformed CHAP_R\n"); |
390 | + goto out; |
391 | + } |
392 | + if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) { |
393 | + pr_err("Malformed CHAP_R\n"); |
394 | + goto out; |
395 | + } |
396 | |
397 | pr_debug("[server] Got CHAP_R=%s\n", chap_r); |
398 | - chap_string_to_hex(client_digest, chap_r, strlen(chap_r)); |
399 | |
400 | tfm = crypto_alloc_shash("md5", 0, 0); |
401 | if (IS_ERR(tfm)) { |
402 | @@ -341,9 +336,7 @@ static int chap_server_compute_md5( |
403 | pr_err("Could not find CHAP_C.\n"); |
404 | goto out; |
405 | } |
406 | - pr_debug("[server] Got CHAP_C=%s\n", challenge); |
407 | - challenge_len = chap_string_to_hex(challenge_binhex, challenge, |
408 | - strlen(challenge)); |
409 | + challenge_len = DIV_ROUND_UP(strlen(challenge), 2); |
410 | if (!challenge_len) { |
411 | pr_err("Unable to convert incoming challenge\n"); |
412 | goto out; |
413 | @@ -352,6 +345,11 @@ static int chap_server_compute_md5( |
414 | pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n"); |
415 | goto out; |
416 | } |
417 | + if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) { |
418 | + pr_err("Malformed CHAP_C\n"); |
419 | + goto out; |
420 | + } |
421 | + pr_debug("[server] Got CHAP_C=%s\n", challenge); |
422 | /* |
423 | * During mutual authentication, the CHAP_C generated by the |
424 | * initiator must not match the original CHAP_C generated by |
425 | diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c |
426 | index f62c598810ff..638eb9bbd59f 100644 |
427 | --- a/drivers/tty/vt/vt_ioctl.c |
428 | +++ b/drivers/tty/vt/vt_ioctl.c |
429 | @@ -31,6 +31,8 @@ |
430 | #include <asm/io.h> |
431 | #include <asm/uaccess.h> |
432 | |
433 | +#include <linux/nospec.h> |
434 | + |
435 | #include <linux/kbd_kern.h> |
436 | #include <linux/vt_kern.h> |
437 | #include <linux/kbd_diacr.h> |
438 | @@ -703,6 +705,8 @@ int vt_ioctl(struct tty_struct *tty, |
439 | if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) |
440 | ret = -ENXIO; |
441 | else { |
442 | + vsa.console = array_index_nospec(vsa.console, |
443 | + MAX_NR_CONSOLES + 1); |
444 | vsa.console--; |
445 | console_lock(); |
446 | ret = vc_allocate(vsa.console); |
447 | diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c |
448 | index e8b365000d73..e16bc4cec62e 100644 |
449 | --- a/fs/ext4/dir.c |
450 | +++ b/fs/ext4/dir.c |
451 | @@ -74,7 +74,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, |
452 | else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len))) |
453 | error_msg = "rec_len is too small for name_len"; |
454 | else if (unlikely(((char *) de - buf) + rlen > size)) |
455 | - error_msg = "directory entry across range"; |
456 | + error_msg = "directory entry overrun"; |
457 | else if (unlikely(le32_to_cpu(de->inode) > |
458 | le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) |
459 | error_msg = "inode out of bounds"; |
460 | @@ -83,18 +83,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, |
461 | |
462 | if (filp) |
463 | ext4_error_file(filp, function, line, bh->b_blocknr, |
464 | - "bad entry in directory: %s - offset=%u(%u), " |
465 | - "inode=%u, rec_len=%d, name_len=%d", |
466 | - error_msg, (unsigned) (offset % size), |
467 | - offset, le32_to_cpu(de->inode), |
468 | - rlen, de->name_len); |
469 | + "bad entry in directory: %s - offset=%u, " |
470 | + "inode=%u, rec_len=%d, name_len=%d, size=%d", |
471 | + error_msg, offset, le32_to_cpu(de->inode), |
472 | + rlen, de->name_len, size); |
473 | else |
474 | ext4_error_inode(dir, function, line, bh->b_blocknr, |
475 | - "bad entry in directory: %s - offset=%u(%u), " |
476 | - "inode=%u, rec_len=%d, name_len=%d", |
477 | - error_msg, (unsigned) (offset % size), |
478 | - offset, le32_to_cpu(de->inode), |
479 | - rlen, de->name_len); |
480 | + "bad entry in directory: %s - offset=%u, " |
481 | + "inode=%u, rec_len=%d, name_len=%d, size=%d", |
482 | + error_msg, offset, le32_to_cpu(de->inode), |
483 | + rlen, de->name_len, size); |
484 | |
485 | return 1; |
486 | } |
487 | diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c |
488 | index 436baf7cdca3..211539a7adfc 100644 |
489 | --- a/fs/ext4/inline.c |
490 | +++ b/fs/ext4/inline.c |
491 | @@ -1754,6 +1754,7 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) |
492 | { |
493 | int err, inline_size; |
494 | struct ext4_iloc iloc; |
495 | + size_t inline_len; |
496 | void *inline_pos; |
497 | unsigned int offset; |
498 | struct ext4_dir_entry_2 *de; |
499 | @@ -1781,8 +1782,9 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) |
500 | goto out; |
501 | } |
502 | |
503 | + inline_len = ext4_get_inline_size(dir); |
504 | offset = EXT4_INLINE_DOTDOT_SIZE; |
505 | - while (offset < dir->i_size) { |
506 | + while (offset < inline_len) { |
507 | de = ext4_get_inline_entry(dir, &iloc, offset, |
508 | &inline_pos, &inline_size); |
509 | if (ext4_check_dir_entry(dir, NULL, de, |
510 | diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c |
511 | index d89754ef1aab..c2e830a6206d 100644 |
512 | --- a/fs/ext4/mmp.c |
513 | +++ b/fs/ext4/mmp.c |
514 | @@ -48,7 +48,6 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh) |
515 | */ |
516 | sb_start_write(sb); |
517 | ext4_mmp_csum_set(sb, mmp); |
518 | - mark_buffer_dirty(bh); |
519 | lock_buffer(bh); |
520 | bh->b_end_io = end_buffer_write_sync; |
521 | get_bh(bh); |
522 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c |
523 | index a225a21d04ad..bc727c393a89 100644 |
524 | --- a/fs/ext4/namei.c |
525 | +++ b/fs/ext4/namei.c |
526 | @@ -3527,6 +3527,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, |
527 | int credits; |
528 | u8 old_file_type; |
529 | |
530 | + if (new.inode && new.inode->i_nlink == 0) { |
531 | + EXT4_ERROR_INODE(new.inode, |
532 | + "target of rename is already freed"); |
533 | + return -EFSCORRUPTED; |
534 | + } |
535 | + |
536 | if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT)) && |
537 | (!projid_eq(EXT4_I(new_dir)->i_projid, |
538 | EXT4_I(old_dentry->d_inode)->i_projid))) |
539 | diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c |
540 | index eb720d9e2953..1da301ee78ce 100644 |
541 | --- a/fs/ext4/resize.c |
542 | +++ b/fs/ext4/resize.c |
543 | @@ -18,6 +18,7 @@ |
544 | |
545 | int ext4_resize_begin(struct super_block *sb) |
546 | { |
547 | + struct ext4_sb_info *sbi = EXT4_SB(sb); |
548 | int ret = 0; |
549 | |
550 | if (!capable(CAP_SYS_RESOURCE)) |
551 | @@ -28,7 +29,7 @@ int ext4_resize_begin(struct super_block *sb) |
552 | * because the user tools have no way of handling this. Probably a |
553 | * bad time to do it anyways. |
554 | */ |
555 | - if (EXT4_SB(sb)->s_sbh->b_blocknr != |
556 | + if (EXT4_B2C(sbi, sbi->s_sbh->b_blocknr) != |
557 | le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) { |
558 | ext4_warning(sb, "won't resize using backup superblock at %llu", |
559 | (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr); |
560 | @@ -1954,6 +1955,26 @@ retry: |
561 | } |
562 | } |
563 | |
564 | + /* |
565 | + * Make sure the last group has enough space so that it's |
566 | + * guaranteed to have enough space for all metadata blocks |
567 | + * that it might need to hold. (We might not need to store |
568 | + * the inode table blocks in the last block group, but there |
569 | + * will be cases where this might be needed.) |
570 | + */ |
571 | + if ((ext4_group_first_block_no(sb, n_group) + |
572 | + ext4_group_overhead_blocks(sb, n_group) + 2 + |
573 | + sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) { |
574 | + n_blocks_count = ext4_group_first_block_no(sb, n_group); |
575 | + n_group--; |
576 | + n_blocks_count_retry = 0; |
577 | + if (resize_inode) { |
578 | + iput(resize_inode); |
579 | + resize_inode = NULL; |
580 | + } |
581 | + goto retry; |
582 | + } |
583 | + |
584 | /* extend the last group */ |
585 | if (n_group == o_group) |
586 | add = n_blocks_count - o_blocks_count; |
587 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c |
588 | index 9d44b3683b46..f88d4804c3a8 100644 |
589 | --- a/fs/ext4/super.c |
590 | +++ b/fs/ext4/super.c |
591 | @@ -2015,6 +2015,8 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, |
592 | SEQ_OPTS_PRINT("max_dir_size_kb=%u", sbi->s_max_dir_size_kb); |
593 | if (test_opt(sb, DATA_ERR_ABORT)) |
594 | SEQ_OPTS_PUTS("data_err=abort"); |
595 | + if (DUMMY_ENCRYPTION_ENABLED(sbi)) |
596 | + SEQ_OPTS_PUTS("test_dummy_encryption"); |
597 | |
598 | ext4_show_quota_options(seq, sb); |
599 | return 0; |
600 | @@ -4187,11 +4189,13 @@ no_journal: |
601 | block = ext4_count_free_clusters(sb); |
602 | ext4_free_blocks_count_set(sbi->s_es, |
603 | EXT4_C2B(sbi, block)); |
604 | + ext4_superblock_csum_set(sb); |
605 | err = percpu_counter_init(&sbi->s_freeclusters_counter, block, |
606 | GFP_KERNEL); |
607 | if (!err) { |
608 | unsigned long freei = ext4_count_free_inodes(sb); |
609 | sbi->s_es->s_free_inodes_count = cpu_to_le32(freei); |
610 | + ext4_superblock_csum_set(sb); |
611 | err = percpu_counter_init(&sbi->s_freeinodes_counter, freei, |
612 | GFP_KERNEL); |
613 | } |
614 | diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c |
615 | index 8f040f88ade4..25c8b328c43d 100644 |
616 | --- a/fs/ocfs2/buffer_head_io.c |
617 | +++ b/fs/ocfs2/buffer_head_io.c |
618 | @@ -341,6 +341,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, |
619 | * for this bh as it's not marked locally |
620 | * uptodate. */ |
621 | status = -EIO; |
622 | + clear_buffer_needs_validate(bh); |
623 | put_bh(bh); |
624 | bhs[i] = NULL; |
625 | continue; |
626 | diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h |
627 | index 316694dafa5b..008f466d1da7 100644 |
628 | --- a/include/net/nfc/hci.h |
629 | +++ b/include/net/nfc/hci.h |
630 | @@ -87,7 +87,7 @@ struct nfc_hci_pipe { |
631 | * According to specification 102 622 chapter 4.4 Pipes, |
632 | * the pipe identifier is 7 bits long. |
633 | */ |
634 | -#define NFC_HCI_MAX_PIPES 127 |
635 | +#define NFC_HCI_MAX_PIPES 128 |
636 | struct nfc_hci_init_data { |
637 | u8 gate_count; |
638 | struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES]; |
639 | diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c |
640 | index f6e8727f7fa3..f81adb476c03 100644 |
641 | --- a/kernel/sched/fair.c |
642 | +++ b/kernel/sched/fair.c |
643 | @@ -8639,7 +8639,8 @@ static inline bool vruntime_normalized(struct task_struct *p) |
644 | * - A task which has been woken up by try_to_wake_up() and |
645 | * waiting for actually being woken up by sched_ttwu_pending(). |
646 | */ |
647 | - if (!se->sum_exec_runtime || p->state == TASK_WAKING) |
648 | + if (!se->sum_exec_runtime || |
649 | + (p->state == TASK_WAKING && p->sched_remote_wakeup)) |
650 | return true; |
651 | |
652 | return false; |
653 | diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c |
654 | index dc29b600d2cb..f316e90ad538 100644 |
655 | --- a/kernel/trace/ring_buffer.c |
656 | +++ b/kernel/trace/ring_buffer.c |
657 | @@ -1504,6 +1504,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) |
658 | tmp_iter_page = first_page; |
659 | |
660 | do { |
661 | + cond_resched(); |
662 | + |
663 | to_remove_page = tmp_iter_page; |
664 | rb_inc_page(cpu_buffer, &tmp_iter_page); |
665 | |
666 | diff --git a/mm/shmem.c b/mm/shmem.c |
667 | index 42ca5df2c0e3..4b5cca167baf 100644 |
668 | --- a/mm/shmem.c |
669 | +++ b/mm/shmem.c |
670 | @@ -2160,6 +2160,8 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode |
671 | mpol_shared_policy_init(&info->policy, NULL); |
672 | break; |
673 | } |
674 | + |
675 | + lockdep_annotate_inode_mutex_key(inode); |
676 | } else |
677 | shmem_free_inode(sb); |
678 | return inode; |
679 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c |
680 | index 128c811dcb1a..8eb1916b742c 100644 |
681 | --- a/net/core/neighbour.c |
682 | +++ b/net/core/neighbour.c |
683 | @@ -1138,6 +1138,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, |
684 | lladdr = neigh->ha; |
685 | } |
686 | |
687 | + /* Update confirmed timestamp for neighbour entry after we |
688 | + * received ARP packet even if it doesn't change IP to MAC binding. |
689 | + */ |
690 | + if (new & NUD_CONNECTED) |
691 | + neigh->confirmed = jiffies; |
692 | + |
693 | /* If entry was valid and address is not changed, |
694 | do not change entry state, if new one is STALE. |
695 | */ |
696 | @@ -1159,15 +1165,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, |
697 | } |
698 | } |
699 | |
700 | - /* Update timestamps only once we know we will make a change to the |
701 | + /* Update timestamp only once we know we will make a change to the |
702 | * neighbour entry. Otherwise we risk to move the locktime window with |
703 | * noop updates and ignore relevant ARP updates. |
704 | */ |
705 | - if (new != old || lladdr != neigh->ha) { |
706 | - if (new & NUD_CONNECTED) |
707 | - neigh->confirmed = jiffies; |
708 | + if (new != old || lladdr != neigh->ha) |
709 | neigh->updated = jiffies; |
710 | - } |
711 | |
712 | if (new != old) { |
713 | neigh_del_timer(neigh); |
714 | diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c |
715 | index b5116ec31757..689246d079ad 100644 |
716 | --- a/net/ipv4/af_inet.c |
717 | +++ b/net/ipv4/af_inet.c |
718 | @@ -1277,6 +1277,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, |
719 | if (encap) |
720 | skb_reset_inner_headers(skb); |
721 | skb->network_header = (u8 *)iph - skb->head; |
722 | + skb_reset_mac_len(skb); |
723 | } while ((skb = skb->next)); |
724 | |
725 | out: |
726 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
727 | index aa2a20e918fd..b9b2a9828d98 100644 |
728 | --- a/net/ipv4/udp.c |
729 | +++ b/net/ipv4/udp.c |
730 | @@ -1730,6 +1730,28 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh, |
731 | inet_compute_pseudo); |
732 | } |
733 | |
734 | +/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and |
735 | + * return code conversion for ip layer consumption |
736 | + */ |
737 | +static int udp_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb, |
738 | + struct udphdr *uh) |
739 | +{ |
740 | + int ret; |
741 | + |
742 | + if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) |
743 | + skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, |
744 | + inet_compute_pseudo); |
745 | + |
746 | + ret = udp_queue_rcv_skb(sk, skb); |
747 | + |
748 | + /* a return value > 0 means to resubmit the input, but |
749 | + * it wants the return to be -protocol, or 0 |
750 | + */ |
751 | + if (ret > 0) |
752 | + return -ret; |
753 | + return 0; |
754 | +} |
755 | + |
756 | /* |
757 | * All we need to do is get the socket, and then do a checksum. |
758 | */ |
759 | @@ -1776,14 +1798,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, |
760 | if (unlikely(sk->sk_rx_dst != dst)) |
761 | udp_sk_rx_dst_set(sk, dst); |
762 | |
763 | - ret = udp_queue_rcv_skb(sk, skb); |
764 | + ret = udp_unicast_rcv_skb(sk, skb, uh); |
765 | sock_put(sk); |
766 | - /* a return value > 0 means to resubmit the input, but |
767 | - * it wants the return to be -protocol, or 0 |
768 | - */ |
769 | - if (ret > 0) |
770 | - return -ret; |
771 | - return 0; |
772 | + return ret; |
773 | } |
774 | |
775 | if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST)) |
776 | @@ -1791,22 +1808,8 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, |
777 | saddr, daddr, udptable, proto); |
778 | |
779 | sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable); |
780 | - if (sk) { |
781 | - int ret; |
782 | - |
783 | - if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) |
784 | - skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, |
785 | - inet_compute_pseudo); |
786 | - |
787 | - ret = udp_queue_rcv_skb(sk, skb); |
788 | - |
789 | - /* a return value > 0 means to resubmit the input, but |
790 | - * it wants the return to be -protocol, or 0 |
791 | - */ |
792 | - if (ret > 0) |
793 | - return -ret; |
794 | - return 0; |
795 | - } |
796 | + if (sk) |
797 | + return udp_unicast_rcv_skb(sk, skb, uh); |
798 | |
799 | if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) |
800 | goto drop; |
801 | diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c |
802 | index 649f4d87b318..a36ae90bf613 100644 |
803 | --- a/net/ipv6/ip6_offload.c |
804 | +++ b/net/ipv6/ip6_offload.c |
805 | @@ -113,6 +113,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, |
806 | payload_len = skb->len - nhoff - sizeof(*ipv6h); |
807 | ipv6h->payload_len = htons(payload_len); |
808 | skb->network_header = (u8 *)ipv6h - skb->head; |
809 | + skb_reset_mac_len(skb); |
810 | |
811 | if (udpfrag) { |
812 | int err = ip6_find_1stfragopt(skb, &prevhdr); |
813 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c |
814 | index ea14466cdca8..8e77cecd2165 100644 |
815 | --- a/net/ipv6/ip6_output.c |
816 | +++ b/net/ipv6/ip6_output.c |
817 | @@ -201,12 +201,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, |
818 | kfree_skb(skb); |
819 | return -ENOBUFS; |
820 | } |
821 | + if (skb->sk) |
822 | + skb_set_owner_w(skb2, skb->sk); |
823 | consume_skb(skb); |
824 | skb = skb2; |
825 | - /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically, |
826 | - * it is safe to call in our context (socket lock not held) |
827 | - */ |
828 | - skb_set_owner_w(skb, (struct sock *)sk); |
829 | } |
830 | if (opt->opt_flen) |
831 | ipv6_push_frag_opts(skb, opt, &proto); |
832 | diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c |
833 | index 2b0f0ac498d2..5a58f9f38095 100644 |
834 | --- a/net/nfc/hci/core.c |
835 | +++ b/net/nfc/hci/core.c |
836 | @@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, |
837 | } |
838 | create_info = (struct hci_create_pipe_resp *)skb->data; |
839 | |
840 | + if (create_info->pipe >= NFC_HCI_MAX_PIPES) { |
841 | + status = NFC_HCI_ANY_E_NOK; |
842 | + goto exit; |
843 | + } |
844 | + |
845 | /* Save the new created pipe and bind with local gate, |
846 | * the description for skb->data[3] is destination gate id |
847 | * but since we received this cmd from host controller, we |
848 | @@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, |
849 | } |
850 | delete_info = (struct hci_delete_pipe_noti *)skb->data; |
851 | |
852 | + if (delete_info->pipe >= NFC_HCI_MAX_PIPES) { |
853 | + status = NFC_HCI_ANY_E_NOK; |
854 | + goto exit; |
855 | + } |
856 | + |
857 | hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE; |
858 | hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST; |
859 | break; |
860 | diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c |
861 | index 3469ac14c89c..d0dfa822266b 100644 |
862 | --- a/sound/firewire/bebob/bebob.c |
863 | +++ b/sound/firewire/bebob/bebob.c |
864 | @@ -263,6 +263,8 @@ do_registration(struct work_struct *work) |
865 | error: |
866 | mutex_unlock(&devices_mutex); |
867 | snd_bebob_stream_destroy_duplex(bebob); |
868 | + kfree(bebob->maudio_special_quirk); |
869 | + bebob->maudio_special_quirk = NULL; |
870 | snd_card_free(bebob->card); |
871 | dev_info(&bebob->unit->device, |
872 | "Sound card registration failed: %d\n", err); |
873 | diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c |
874 | index 07e5abdbceb5..6dbf047d4f75 100644 |
875 | --- a/sound/firewire/bebob/bebob_maudio.c |
876 | +++ b/sound/firewire/bebob/bebob_maudio.c |
877 | @@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) |
878 | struct fw_device *device = fw_parent_device(unit); |
879 | int err, rcode; |
880 | u64 date; |
881 | - __le32 cues[3] = { |
882 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE1), |
883 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE2), |
884 | - cpu_to_le32(MAUDIO_BOOTLOADER_CUE3) |
885 | - }; |
886 | + __le32 *cues; |
887 | |
888 | /* check date of software used to build */ |
889 | err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE, |
890 | &date, sizeof(u64)); |
891 | if (err < 0) |
892 | - goto end; |
893 | + return err; |
894 | /* |
895 | * firmware version 5058 or later has date later than "20070401", but |
896 | * 'date' is not null-terminated. |
897 | @@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) |
898 | if (date < 0x3230303730343031LL) { |
899 | dev_err(&unit->device, |
900 | "Use firmware version 5058 or later\n"); |
901 | - err = -ENOSYS; |
902 | - goto end; |
903 | + return -ENXIO; |
904 | } |
905 | |
906 | + cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL); |
907 | + if (!cues) |
908 | + return -ENOMEM; |
909 | + |
910 | + cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1); |
911 | + cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2); |
912 | + cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3); |
913 | + |
914 | rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST, |
915 | device->node_id, device->generation, |
916 | device->max_speed, BEBOB_ADDR_REG_REQ, |
917 | - cues, sizeof(cues)); |
918 | + cues, 3 * sizeof(*cues)); |
919 | + kfree(cues); |
920 | if (rcode != RCODE_COMPLETE) { |
921 | dev_err(&unit->device, |
922 | "Failed to send a cue to load firmware\n"); |
923 | err = -EIO; |
924 | } |
925 | -end: |
926 | + |
927 | return err; |
928 | } |
929 | |
930 | @@ -290,10 +294,6 @@ snd_bebob_maudio_special_discover(struct snd_bebob *bebob, bool is1814) |
931 | bebob->midi_output_ports = 2; |
932 | } |
933 | end: |
934 | - if (err < 0) { |
935 | - kfree(params); |
936 | - bebob->maudio_special_quirk = NULL; |
937 | - } |
938 | mutex_unlock(&bebob->mutex); |
939 | return err; |
940 | } |
941 | diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c |
942 | index 1f5e1d23f31a..ef689997d6a5 100644 |
943 | --- a/sound/firewire/digi00x/digi00x.c |
944 | +++ b/sound/firewire/digi00x/digi00x.c |
945 | @@ -49,6 +49,7 @@ static void dg00x_free(struct snd_dg00x *dg00x) |
946 | fw_unit_put(dg00x->unit); |
947 | |
948 | mutex_destroy(&dg00x->mutex); |
949 | + kfree(dg00x); |
950 | } |
951 | |
952 | static void dg00x_card_free(struct snd_card *card) |
953 | diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c |
954 | index 71a0613d3da0..f2d073365cf6 100644 |
955 | --- a/sound/firewire/fireworks/fireworks.c |
956 | +++ b/sound/firewire/fireworks/fireworks.c |
957 | @@ -301,6 +301,8 @@ error: |
958 | snd_efw_transaction_remove_instance(efw); |
959 | snd_efw_stream_destroy_duplex(efw); |
960 | snd_card_free(efw->card); |
961 | + kfree(efw->resp_buf); |
962 | + efw->resp_buf = NULL; |
963 | dev_info(&efw->unit->device, |
964 | "Sound card registration failed: %d\n", err); |
965 | } |
966 | diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c |
967 | index 474b06d8acd1..696b6cf35003 100644 |
968 | --- a/sound/firewire/oxfw/oxfw.c |
969 | +++ b/sound/firewire/oxfw/oxfw.c |
970 | @@ -135,6 +135,7 @@ static void oxfw_free(struct snd_oxfw *oxfw) |
971 | |
972 | kfree(oxfw->spec); |
973 | mutex_destroy(&oxfw->mutex); |
974 | + kfree(oxfw); |
975 | } |
976 | |
977 | /* |
978 | @@ -212,6 +213,7 @@ static int detect_quirks(struct snd_oxfw *oxfw) |
979 | static void do_registration(struct work_struct *work) |
980 | { |
981 | struct snd_oxfw *oxfw = container_of(work, struct snd_oxfw, dwork.work); |
982 | + int i; |
983 | int err; |
984 | |
985 | if (oxfw->registered) |
986 | @@ -274,7 +276,15 @@ error: |
987 | snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream); |
988 | if (oxfw->has_output) |
989 | snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream); |
990 | + for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; ++i) { |
991 | + kfree(oxfw->tx_stream_formats[i]); |
992 | + oxfw->tx_stream_formats[i] = NULL; |
993 | + kfree(oxfw->rx_stream_formats[i]); |
994 | + oxfw->rx_stream_formats[i] = NULL; |
995 | + } |
996 | snd_card_free(oxfw->card); |
997 | + kfree(oxfw->spec); |
998 | + oxfw->spec = NULL; |
999 | dev_info(&oxfw->unit->device, |
1000 | "Sound card registration failed: %d\n", err); |
1001 | } |
1002 | diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c |
1003 | index 9dc93a7eb9da..4c967ac1c0e8 100644 |
1004 | --- a/sound/firewire/tascam/tascam.c |
1005 | +++ b/sound/firewire/tascam/tascam.c |
1006 | @@ -93,6 +93,7 @@ static void tscm_free(struct snd_tscm *tscm) |
1007 | fw_unit_put(tscm->unit); |
1008 | |
1009 | mutex_destroy(&tscm->mutex); |
1010 | + kfree(tscm); |
1011 | } |
1012 | |
1013 | static void tscm_card_free(struct snd_card *card) |
1014 | diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c |
1015 | index 56fc47bd6dba..50b216fc369f 100644 |
1016 | --- a/sound/pci/emu10k1/emufx.c |
1017 | +++ b/sound/pci/emu10k1/emufx.c |
1018 | @@ -2520,7 +2520,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un |
1019 | emu->support_tlv = 1; |
1020 | return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp); |
1021 | case SNDRV_EMU10K1_IOCTL_INFO: |
1022 | - info = kmalloc(sizeof(*info), GFP_KERNEL); |
1023 | + info = kzalloc(sizeof(*info), GFP_KERNEL); |
1024 | if (!info) |
1025 | return -ENOMEM; |
1026 | snd_emu10k1_fx8010_info(emu, info); |
1027 | diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c |
1028 | index fd966bb851cb..6e8eb1f5a041 100644 |
1029 | --- a/sound/soc/codecs/cs4265.c |
1030 | +++ b/sound/soc/codecs/cs4265.c |
1031 | @@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = { |
1032 | SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2, |
1033 | 3, 1, 0), |
1034 | SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum), |
1035 | - SOC_SINGLE("MMTLR Data Switch", 0, |
1036 | - 1, 1, 0), |
1037 | + SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2, |
1038 | + 0, 1, 0), |
1039 | SOC_ENUM("Mono Channel Select", spdif_mono_select_enum), |
1040 | SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24), |
1041 | }; |