Annotation of /trunk/kernel-alx/patches-4.9/0240-4.9.141-all-fixes.patch
Parent Directory | Revision Log
Revision 3293 -
(hide annotations)
(download)
Tue Mar 12 10:43:04 2019 UTC (5 years, 6 months ago) by niro
File size: 44075 byte(s)
Tue Mar 12 10:43:04 2019 UTC (5 years, 6 months ago) by niro
File size: 44075 byte(s)
-linux-4.9.141
1 | niro | 3293 | diff --git a/Makefile b/Makefile |
2 | index a9aed2326233..8eba73521a7f 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 9 | ||
8 | -SUBLEVEL = 140 | ||
9 | +SUBLEVEL = 141 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Roaring Lionus | ||
12 | |||
13 | diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h | ||
14 | index 0d551576eb57..4724b8f0b625 100644 | ||
15 | --- a/arch/arm64/include/asm/percpu.h | ||
16 | +++ b/arch/arm64/include/asm/percpu.h | ||
17 | @@ -92,6 +92,7 @@ static inline unsigned long __percpu_##op(void *ptr, \ | ||
18 | : [val] "Ir" (val)); \ | ||
19 | break; \ | ||
20 | default: \ | ||
21 | + ret = 0; \ | ||
22 | BUILD_BUG(); \ | ||
23 | } \ | ||
24 | \ | ||
25 | @@ -121,6 +122,7 @@ static inline unsigned long __percpu_read(void *ptr, int size) | ||
26 | ret = ACCESS_ONCE(*(u64 *)ptr); | ||
27 | break; | ||
28 | default: | ||
29 | + ret = 0; | ||
30 | BUILD_BUG(); | ||
31 | } | ||
32 | |||
33 | @@ -190,6 +192,7 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val, | ||
34 | : [val] "r" (val)); | ||
35 | break; | ||
36 | default: | ||
37 | + ret = 0; | ||
38 | BUILD_BUG(); | ||
39 | } | ||
40 | |||
41 | diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile | ||
42 | index 6cc947896c77..ca7c3c34f94b 100644 | ||
43 | --- a/arch/s390/kernel/vdso32/Makefile | ||
44 | +++ b/arch/s390/kernel/vdso32/Makefile | ||
45 | @@ -32,7 +32,7 @@ UBSAN_SANITIZE := n | ||
46 | $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so | ||
47 | |||
48 | # link rule for the .so file, .lds has to be first | ||
49 | -$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) | ||
50 | +$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE | ||
51 | $(call if_changed,vdso32ld) | ||
52 | |||
53 | # strip rule for the .so file | ||
54 | @@ -41,12 +41,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE | ||
55 | $(call if_changed,objcopy) | ||
56 | |||
57 | # assembly rules for the .S files | ||
58 | -$(obj-vdso32): %.o: %.S | ||
59 | +$(obj-vdso32): %.o: %.S FORCE | ||
60 | $(call if_changed_dep,vdso32as) | ||
61 | |||
62 | # actual build commands | ||
63 | quiet_cmd_vdso32ld = VDSO32L $@ | ||
64 | - cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ | ||
65 | + cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ | ||
66 | quiet_cmd_vdso32as = VDSO32A $@ | ||
67 | cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $< | ||
68 | |||
69 | diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile | ||
70 | index 2d54c18089eb..84af2b6b64c4 100644 | ||
71 | --- a/arch/s390/kernel/vdso64/Makefile | ||
72 | +++ b/arch/s390/kernel/vdso64/Makefile | ||
73 | @@ -32,7 +32,7 @@ UBSAN_SANITIZE := n | ||
74 | $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so | ||
75 | |||
76 | # link rule for the .so file, .lds has to be first | ||
77 | -$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) | ||
78 | +$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE | ||
79 | $(call if_changed,vdso64ld) | ||
80 | |||
81 | # strip rule for the .so file | ||
82 | @@ -41,12 +41,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE | ||
83 | $(call if_changed,objcopy) | ||
84 | |||
85 | # assembly rules for the .S files | ||
86 | -$(obj-vdso64): %.o: %.S | ||
87 | +$(obj-vdso64): %.o: %.S FORCE | ||
88 | $(call if_changed_dep,vdso64as) | ||
89 | |||
90 | # actual build commands | ||
91 | quiet_cmd_vdso64ld = VDSO64L $@ | ||
92 | - cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ | ||
93 | + cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ | ||
94 | quiet_cmd_vdso64as = VDSO64A $@ | ||
95 | cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $< | ||
96 | |||
97 | diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c | ||
98 | index 0dac2640c3a7..e73a1165d261 100644 | ||
99 | --- a/arch/s390/numa/numa.c | ||
100 | +++ b/arch/s390/numa/numa.c | ||
101 | @@ -53,6 +53,7 @@ int __node_distance(int a, int b) | ||
102 | { | ||
103 | return mode->distance ? mode->distance(a, b) : 0; | ||
104 | } | ||
105 | +EXPORT_SYMBOL(__node_distance); | ||
106 | |||
107 | int numa_debug_enabled; | ||
108 | |||
109 | diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c | ||
110 | index 23025d645160..0a99d4515065 100644 | ||
111 | --- a/arch/um/os-Linux/skas/process.c | ||
112 | +++ b/arch/um/os-Linux/skas/process.c | ||
113 | @@ -578,6 +578,11 @@ int start_idle_thread(void *stack, jmp_buf *switch_buf) | ||
114 | fatal_sigsegv(); | ||
115 | } | ||
116 | longjmp(*switch_buf, 1); | ||
117 | + | ||
118 | + /* unreachable */ | ||
119 | + printk(UM_KERN_ERR "impossible long jump!"); | ||
120 | + fatal_sigsegv(); | ||
121 | + return 0; | ||
122 | } | ||
123 | |||
124 | void initial_thread_cb_skas(void (*proc)(void *), void *arg) | ||
125 | diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c | ||
126 | index 03250e1f1103..d92eacaef231 100644 | ||
127 | --- a/drivers/acpi/acpi_platform.c | ||
128 | +++ b/drivers/acpi/acpi_platform.c | ||
129 | @@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = { | ||
130 | {"PNP0200", 0}, /* AT DMA Controller */ | ||
131 | {"ACPI0009", 0}, /* IOxAPIC */ | ||
132 | {"ACPI000A", 0}, /* IOAPIC */ | ||
133 | + {"SMB0001", 0}, /* ACPI SMBUS virtual device */ | ||
134 | {"", 0}, | ||
135 | }; | ||
136 | |||
137 | diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c | ||
138 | index ce8fc680785b..396e358c2cee 100644 | ||
139 | --- a/drivers/acpi/acpi_watchdog.c | ||
140 | +++ b/drivers/acpi/acpi_watchdog.c | ||
141 | @@ -17,18 +17,77 @@ | ||
142 | |||
143 | #include "internal.h" | ||
144 | |||
145 | +#ifdef CONFIG_RTC_MC146818_LIB | ||
146 | +#include <linux/mc146818rtc.h> | ||
147 | + | ||
148 | +/* | ||
149 | + * There are several systems where the WDAT table is accessing RTC SRAM to | ||
150 | + * store persistent information. This does not work well with the Linux RTC | ||
151 | + * driver so on those systems we skip WDAT driver and prefer iTCO_wdt | ||
152 | + * instead. | ||
153 | + * | ||
154 | + * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033. | ||
155 | + */ | ||
156 | +static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat) | ||
157 | +{ | ||
158 | + const struct acpi_wdat_entry *entries; | ||
159 | + int i; | ||
160 | + | ||
161 | + entries = (struct acpi_wdat_entry *)(wdat + 1); | ||
162 | + for (i = 0; i < wdat->entries; i++) { | ||
163 | + const struct acpi_generic_address *gas; | ||
164 | + | ||
165 | + gas = &entries[i].register_region; | ||
166 | + if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) { | ||
167 | + switch (gas->address) { | ||
168 | + case RTC_PORT(0): | ||
169 | + case RTC_PORT(1): | ||
170 | + case RTC_PORT(2): | ||
171 | + case RTC_PORT(3): | ||
172 | + return true; | ||
173 | + } | ||
174 | + } | ||
175 | + } | ||
176 | + | ||
177 | + return false; | ||
178 | +} | ||
179 | +#else | ||
180 | +static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat) | ||
181 | +{ | ||
182 | + return false; | ||
183 | +} | ||
184 | +#endif | ||
185 | + | ||
186 | +static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void) | ||
187 | +{ | ||
188 | + const struct acpi_table_wdat *wdat = NULL; | ||
189 | + acpi_status status; | ||
190 | + | ||
191 | + if (acpi_disabled) | ||
192 | + return NULL; | ||
193 | + | ||
194 | + status = acpi_get_table(ACPI_SIG_WDAT, 0, | ||
195 | + (struct acpi_table_header **)&wdat); | ||
196 | + if (ACPI_FAILURE(status)) { | ||
197 | + /* It is fine if there is no WDAT */ | ||
198 | + return NULL; | ||
199 | + } | ||
200 | + | ||
201 | + if (acpi_watchdog_uses_rtc(wdat)) { | ||
202 | + pr_info("Skipping WDAT on this system because it uses RTC SRAM\n"); | ||
203 | + return NULL; | ||
204 | + } | ||
205 | + | ||
206 | + return wdat; | ||
207 | +} | ||
208 | + | ||
209 | /** | ||
210 | * Returns true if this system should prefer ACPI based watchdog instead of | ||
211 | * the native one (which are typically the same hardware). | ||
212 | */ | ||
213 | bool acpi_has_watchdog(void) | ||
214 | { | ||
215 | - struct acpi_table_header hdr; | ||
216 | - | ||
217 | - if (acpi_disabled) | ||
218 | - return false; | ||
219 | - | ||
220 | - return ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_WDAT, 0, &hdr)); | ||
221 | + return !!acpi_watchdog_get_wdat(); | ||
222 | } | ||
223 | EXPORT_SYMBOL_GPL(acpi_has_watchdog); | ||
224 | |||
225 | @@ -41,12 +100,10 @@ void __init acpi_watchdog_init(void) | ||
226 | struct platform_device *pdev; | ||
227 | struct resource *resources; | ||
228 | size_t nresources = 0; | ||
229 | - acpi_status status; | ||
230 | int i; | ||
231 | |||
232 | - status = acpi_get_table(ACPI_SIG_WDAT, 0, | ||
233 | - (struct acpi_table_header **)&wdat); | ||
234 | - if (ACPI_FAILURE(status)) { | ||
235 | + wdat = acpi_watchdog_get_wdat(); | ||
236 | + if (!wdat) { | ||
237 | /* It is fine if there is no WDAT */ | ||
238 | return; | ||
239 | } | ||
240 | diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c | ||
241 | index b7c0b69a02f5..d64a53d3270a 100644 | ||
242 | --- a/drivers/block/zram/zram_drv.c | ||
243 | +++ b/drivers/block/zram/zram_drv.c | ||
244 | @@ -1223,6 +1223,11 @@ static struct attribute_group zram_disk_attr_group = { | ||
245 | .attrs = zram_disk_attrs, | ||
246 | }; | ||
247 | |||
248 | +static const struct attribute_group *zram_disk_attr_groups[] = { | ||
249 | + &zram_disk_attr_group, | ||
250 | + NULL, | ||
251 | +}; | ||
252 | + | ||
253 | /* | ||
254 | * Allocate and initialize new zram device. the function returns | ||
255 | * '>= 0' device_id upon success, and negative value otherwise. | ||
256 | @@ -1303,24 +1308,15 @@ static int zram_add(void) | ||
257 | zram->disk->queue->limits.discard_zeroes_data = 0; | ||
258 | queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, zram->disk->queue); | ||
259 | |||
260 | + disk_to_dev(zram->disk)->groups = zram_disk_attr_groups; | ||
261 | add_disk(zram->disk); | ||
262 | |||
263 | - ret = sysfs_create_group(&disk_to_dev(zram->disk)->kobj, | ||
264 | - &zram_disk_attr_group); | ||
265 | - if (ret < 0) { | ||
266 | - pr_err("Error creating sysfs group for device %d\n", | ||
267 | - device_id); | ||
268 | - goto out_free_disk; | ||
269 | - } | ||
270 | strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor)); | ||
271 | zram->meta = NULL; | ||
272 | |||
273 | pr_info("Added device: %s\n", zram->disk->disk_name); | ||
274 | return device_id; | ||
275 | |||
276 | -out_free_disk: | ||
277 | - del_gendisk(zram->disk); | ||
278 | - put_disk(zram->disk); | ||
279 | out_free_queue: | ||
280 | blk_cleanup_queue(queue); | ||
281 | out_free_idr: | ||
282 | @@ -1348,16 +1344,6 @@ static int zram_remove(struct zram *zram) | ||
283 | zram->claim = true; | ||
284 | mutex_unlock(&bdev->bd_mutex); | ||
285 | |||
286 | - /* | ||
287 | - * Remove sysfs first, so no one will perform a disksize | ||
288 | - * store while we destroy the devices. This also helps during | ||
289 | - * hot_remove -- zram_reset_device() is the last holder of | ||
290 | - * ->init_lock, no later/concurrent disksize_store() or any | ||
291 | - * other sysfs handlers are possible. | ||
292 | - */ | ||
293 | - sysfs_remove_group(&disk_to_dev(zram->disk)->kobj, | ||
294 | - &zram_disk_attr_group); | ||
295 | - | ||
296 | /* Make sure all the pending I/O are finished */ | ||
297 | fsync_bdev(bdev); | ||
298 | zram_reset_device(zram); | ||
299 | diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig | ||
300 | index 4a9493a4159f..3cc9bff9d99d 100644 | ||
301 | --- a/drivers/bluetooth/Kconfig | ||
302 | +++ b/drivers/bluetooth/Kconfig | ||
303 | @@ -125,7 +125,6 @@ config BT_HCIUART_LL | ||
304 | config BT_HCIUART_3WIRE | ||
305 | bool "Three-wire UART (H5) protocol support" | ||
306 | depends on BT_HCIUART | ||
307 | - depends on BT_HCIUART_SERDEV | ||
308 | help | ||
309 | The HCI Three-wire UART Transport Layer makes it possible to | ||
310 | user the Bluetooth HCI over a serial port interface. The HCI | ||
311 | diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c | ||
312 | index 20724abd38bd..7df6b5b1e7ee 100644 | ||
313 | --- a/drivers/clk/clk-fixed-factor.c | ||
314 | +++ b/drivers/clk/clk-fixed-factor.c | ||
315 | @@ -210,6 +210,7 @@ static int of_fixed_factor_clk_remove(struct platform_device *pdev) | ||
316 | { | ||
317 | struct clk *clk = platform_get_drvdata(pdev); | ||
318 | |||
319 | + of_clk_del_provider(pdev->dev.of_node); | ||
320 | clk_unregister_fixed_factor(clk); | ||
321 | |||
322 | return 0; | ||
323 | diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c | ||
324 | index b5c46b3f8764..6d6475c32ee5 100644 | ||
325 | --- a/drivers/clk/clk-fixed-rate.c | ||
326 | +++ b/drivers/clk/clk-fixed-rate.c | ||
327 | @@ -200,6 +200,7 @@ static int of_fixed_clk_remove(struct platform_device *pdev) | ||
328 | { | ||
329 | struct clk *clk = platform_get_drvdata(pdev); | ||
330 | |||
331 | + of_clk_del_provider(pdev->dev.of_node); | ||
332 | clk_unregister_fixed_rate(clk); | ||
333 | |||
334 | return 0; | ||
335 | diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c | ||
336 | index 07fb667e258f..13c09a740840 100644 | ||
337 | --- a/drivers/clk/samsung/clk-exynos5420.c | ||
338 | +++ b/drivers/clk/samsung/clk-exynos5420.c | ||
339 | @@ -280,6 +280,7 @@ static const struct samsung_clk_reg_dump exynos5420_set_clksrc[] = { | ||
340 | { .offset = GATE_BUS_TOP, .value = 0xffffffff, }, | ||
341 | { .offset = GATE_BUS_DISP1, .value = 0xffffffff, }, | ||
342 | { .offset = GATE_IP_PERIC, .value = 0xffffffff, }, | ||
343 | + { .offset = GATE_IP_PERIS, .value = 0xffffffff, }, | ||
344 | }; | ||
345 | |||
346 | static int exynos5420_clk_suspend(void) | ||
347 | diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c | ||
348 | index 83d2f43b5a2f..c93dcfedc219 100644 | ||
349 | --- a/drivers/gpu/drm/drm_edid.c | ||
350 | +++ b/drivers/gpu/drm/drm_edid.c | ||
351 | @@ -116,6 +116,9 @@ static const struct edid_quirk { | ||
352 | /* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */ | ||
353 | { "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC }, | ||
354 | |||
355 | + /* BOE model 0x0771 reports 8 bpc, but is a 6 bpc panel */ | ||
356 | + { "BOE", 0x0771, EDID_QUIRK_FORCE_6BPC }, | ||
357 | + | ||
358 | /* Belinea 10 15 55 */ | ||
359 | { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 }, | ||
360 | { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 }, | ||
361 | diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c | ||
362 | index 7f8ff39ed44b..d02ee5304217 100644 | ||
363 | --- a/drivers/hid/uhid.c | ||
364 | +++ b/drivers/hid/uhid.c | ||
365 | @@ -12,6 +12,7 @@ | ||
366 | |||
367 | #include <linux/atomic.h> | ||
368 | #include <linux/compat.h> | ||
369 | +#include <linux/cred.h> | ||
370 | #include <linux/device.h> | ||
371 | #include <linux/fs.h> | ||
372 | #include <linux/hid.h> | ||
373 | @@ -24,6 +25,7 @@ | ||
374 | #include <linux/spinlock.h> | ||
375 | #include <linux/uhid.h> | ||
376 | #include <linux/wait.h> | ||
377 | +#include <linux/uaccess.h> | ||
378 | |||
379 | #define UHID_NAME "uhid" | ||
380 | #define UHID_BUFSIZE 32 | ||
381 | @@ -721,6 +723,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer, | ||
382 | |||
383 | switch (uhid->input_buf.type) { | ||
384 | case UHID_CREATE: | ||
385 | + /* | ||
386 | + * 'struct uhid_create_req' contains a __user pointer which is | ||
387 | + * copied from, so it's unsafe to allow this with elevated | ||
388 | + * privileges (e.g. from a setuid binary) or via kernel_write(). | ||
389 | + */ | ||
390 | + if (file->f_cred != current_cred() || uaccess_kernel()) { | ||
391 | + pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n", | ||
392 | + task_tgid_vnr(current), current->comm); | ||
393 | + ret = -EACCES; | ||
394 | + goto unlock; | ||
395 | + } | ||
396 | ret = uhid_dev_create(uhid, &uhid->input_buf); | ||
397 | break; | ||
398 | case UHID_CREATE2: | ||
399 | diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c | ||
400 | index 6d2e6605751c..18b3c8f258bf 100644 | ||
401 | --- a/drivers/hwmon/ibmpowernv.c | ||
402 | +++ b/drivers/hwmon/ibmpowernv.c | ||
403 | @@ -114,7 +114,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr, | ||
404 | return sprintf(buf, "%s\n", sdata->label); | ||
405 | } | ||
406 | |||
407 | -static int __init get_logical_cpu(int hwcpu) | ||
408 | +static int get_logical_cpu(int hwcpu) | ||
409 | { | ||
410 | int cpu; | ||
411 | |||
412 | @@ -125,9 +125,8 @@ static int __init get_logical_cpu(int hwcpu) | ||
413 | return -ENOENT; | ||
414 | } | ||
415 | |||
416 | -static void __init make_sensor_label(struct device_node *np, | ||
417 | - struct sensor_data *sdata, | ||
418 | - const char *label) | ||
419 | +static void make_sensor_label(struct device_node *np, | ||
420 | + struct sensor_data *sdata, const char *label) | ||
421 | { | ||
422 | u32 id; | ||
423 | size_t n; | ||
424 | diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c | ||
425 | index 567d86835f00..1fda2873375f 100644 | ||
426 | --- a/drivers/media/v4l2-core/v4l2-event.c | ||
427 | +++ b/drivers/media/v4l2-core/v4l2-event.c | ||
428 | @@ -197,6 +197,22 @@ int v4l2_event_pending(struct v4l2_fh *fh) | ||
429 | } | ||
430 | EXPORT_SYMBOL_GPL(v4l2_event_pending); | ||
431 | |||
432 | +static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev) | ||
433 | +{ | ||
434 | + struct v4l2_fh *fh = sev->fh; | ||
435 | + unsigned int i; | ||
436 | + | ||
437 | + lockdep_assert_held(&fh->subscribe_lock); | ||
438 | + assert_spin_locked(&fh->vdev->fh_lock); | ||
439 | + | ||
440 | + /* Remove any pending events for this subscription */ | ||
441 | + for (i = 0; i < sev->in_use; i++) { | ||
442 | + list_del(&sev->events[sev_pos(sev, i)].list); | ||
443 | + fh->navailable--; | ||
444 | + } | ||
445 | + list_del(&sev->list); | ||
446 | +} | ||
447 | + | ||
448 | int v4l2_event_subscribe(struct v4l2_fh *fh, | ||
449 | const struct v4l2_event_subscription *sub, unsigned elems, | ||
450 | const struct v4l2_subscribed_event_ops *ops) | ||
451 | @@ -228,27 +244,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, | ||
452 | |||
453 | spin_lock_irqsave(&fh->vdev->fh_lock, flags); | ||
454 | found_ev = v4l2_event_subscribed(fh, sub->type, sub->id); | ||
455 | + if (!found_ev) | ||
456 | + list_add(&sev->list, &fh->subscribed); | ||
457 | spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); | ||
458 | |||
459 | if (found_ev) { | ||
460 | /* Already listening */ | ||
461 | kfree(sev); | ||
462 | - goto out_unlock; | ||
463 | - } | ||
464 | - | ||
465 | - if (sev->ops && sev->ops->add) { | ||
466 | + } else if (sev->ops && sev->ops->add) { | ||
467 | ret = sev->ops->add(sev, elems); | ||
468 | if (ret) { | ||
469 | + spin_lock_irqsave(&fh->vdev->fh_lock, flags); | ||
470 | + __v4l2_event_unsubscribe(sev); | ||
471 | + spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); | ||
472 | kfree(sev); | ||
473 | - goto out_unlock; | ||
474 | } | ||
475 | } | ||
476 | |||
477 | - spin_lock_irqsave(&fh->vdev->fh_lock, flags); | ||
478 | - list_add(&sev->list, &fh->subscribed); | ||
479 | - spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); | ||
480 | - | ||
481 | -out_unlock: | ||
482 | mutex_unlock(&fh->subscribe_lock); | ||
483 | |||
484 | return ret; | ||
485 | @@ -283,7 +295,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, | ||
486 | { | ||
487 | struct v4l2_subscribed_event *sev; | ||
488 | unsigned long flags; | ||
489 | - int i; | ||
490 | |||
491 | if (sub->type == V4L2_EVENT_ALL) { | ||
492 | v4l2_event_unsubscribe_all(fh); | ||
493 | @@ -295,14 +306,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, | ||
494 | spin_lock_irqsave(&fh->vdev->fh_lock, flags); | ||
495 | |||
496 | sev = v4l2_event_subscribed(fh, sub->type, sub->id); | ||
497 | - if (sev != NULL) { | ||
498 | - /* Remove any pending events for this subscription */ | ||
499 | - for (i = 0; i < sev->in_use; i++) { | ||
500 | - list_del(&sev->events[sev_pos(sev, i)].list); | ||
501 | - fh->navailable--; | ||
502 | - } | ||
503 | - list_del(&sev->list); | ||
504 | - } | ||
505 | + if (sev != NULL) | ||
506 | + __v4l2_event_unsubscribe(sev); | ||
507 | |||
508 | spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); | ||
509 | |||
510 | diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c | ||
511 | index f7ca1fab4808..4df4a1f402be 100644 | ||
512 | --- a/drivers/media/v4l2-core/videobuf2-core.c | ||
513 | +++ b/drivers/media/v4l2-core/videobuf2-core.c | ||
514 | @@ -914,12 +914,9 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state) | ||
515 | dprintk(4, "done processing on buffer %d, state: %d\n", | ||
516 | vb->index, state); | ||
517 | |||
518 | - if (state != VB2_BUF_STATE_QUEUED && | ||
519 | - state != VB2_BUF_STATE_REQUEUEING) { | ||
520 | - /* sync buffers */ | ||
521 | - for (plane = 0; plane < vb->num_planes; ++plane) | ||
522 | - call_void_memop(vb, finish, vb->planes[plane].mem_priv); | ||
523 | - } | ||
524 | + /* sync buffers */ | ||
525 | + for (plane = 0; plane < vb->num_planes; ++plane) | ||
526 | + call_void_memop(vb, finish, vb->planes[plane].mem_priv); | ||
527 | |||
528 | spin_lock_irqsave(&q->done_lock, flags); | ||
529 | if (state == VB2_BUF_STATE_QUEUED || | ||
530 | diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c | ||
531 | index 0516ecda54d3..3a6e4ec21c87 100644 | ||
532 | --- a/drivers/misc/atmel-ssc.c | ||
533 | +++ b/drivers/misc/atmel-ssc.c | ||
534 | @@ -130,7 +130,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = { | ||
535 | MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids); | ||
536 | #endif | ||
537 | |||
538 | -static inline const struct atmel_ssc_platform_data * __init | ||
539 | +static inline const struct atmel_ssc_platform_data * | ||
540 | atmel_ssc_get_driver_data(struct platform_device *pdev) | ||
541 | { | ||
542 | if (pdev->dev.of_node) { | ||
543 | diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c | ||
544 | index 313da3150262..1540a7785e14 100644 | ||
545 | --- a/drivers/misc/sgi-gru/grukdump.c | ||
546 | +++ b/drivers/misc/sgi-gru/grukdump.c | ||
547 | @@ -27,6 +27,9 @@ | ||
548 | #include <linux/delay.h> | ||
549 | #include <linux/bitops.h> | ||
550 | #include <asm/uv/uv_hub.h> | ||
551 | + | ||
552 | +#include <linux/nospec.h> | ||
553 | + | ||
554 | #include "gru.h" | ||
555 | #include "grutables.h" | ||
556 | #include "gruhandles.h" | ||
557 | @@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg) | ||
558 | /* Currently, only dump by gid is implemented */ | ||
559 | if (req.gid >= gru_max_gids) | ||
560 | return -EINVAL; | ||
561 | + req.gid = array_index_nospec(req.gid, gru_max_gids); | ||
562 | |||
563 | gru = GID_TO_GRU(req.gid); | ||
564 | ubuf = req.buf; | ||
565 | diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h | ||
566 | index b2c08e4d2a9b..bae7b7f9b1cf 100644 | ||
567 | --- a/drivers/net/ethernet/qlogic/qed/qed_sp.h | ||
568 | +++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h | ||
569 | @@ -132,6 +132,9 @@ struct qed_spq_entry { | ||
570 | enum spq_mode comp_mode; | ||
571 | struct qed_spq_comp_cb comp_cb; | ||
572 | struct qed_spq_comp_done comp_done; /* SPQ_MODE_EBLOCK */ | ||
573 | + | ||
574 | + /* Posted entry for unlimited list entry in EBLOCK mode */ | ||
575 | + struct qed_spq_entry *post_ent; | ||
576 | }; | ||
577 | |||
578 | struct qed_eq { | ||
579 | diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c | ||
580 | index 2888eb0628f8..ac69ff3f7c5c 100644 | ||
581 | --- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c | ||
582 | +++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c | ||
583 | @@ -56,7 +56,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, | ||
584 | |||
585 | case QED_SPQ_MODE_BLOCK: | ||
586 | if (!p_data->p_comp_data) | ||
587 | - return -EINVAL; | ||
588 | + goto err; | ||
589 | |||
590 | p_ent->comp_cb.cookie = p_data->p_comp_data->cookie; | ||
591 | break; | ||
592 | @@ -71,7 +71,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, | ||
593 | default: | ||
594 | DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n", | ||
595 | p_ent->comp_mode); | ||
596 | - return -EINVAL; | ||
597 | + goto err; | ||
598 | } | ||
599 | |||
600 | DP_VERBOSE(p_hwfn, QED_MSG_SPQ, | ||
601 | @@ -85,6 +85,18 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, | ||
602 | memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod)); | ||
603 | |||
604 | return 0; | ||
605 | + | ||
606 | +err: | ||
607 | + /* qed_spq_get_entry() can either get an entry from the free_pool, | ||
608 | + * or, if no entries are left, allocate a new entry and add it to | ||
609 | + * the unlimited_pending list. | ||
610 | + */ | ||
611 | + if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending) | ||
612 | + kfree(p_ent); | ||
613 | + else | ||
614 | + qed_spq_return_entry(p_hwfn, p_ent); | ||
615 | + | ||
616 | + return -EINVAL; | ||
617 | } | ||
618 | |||
619 | static enum tunnel_clss qed_tunn_get_clss_type(u8 type) | ||
620 | diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c | ||
621 | index 9fbaf9429fd0..80c8c7f0d932 100644 | ||
622 | --- a/drivers/net/ethernet/qlogic/qed/qed_spq.c | ||
623 | +++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c | ||
624 | @@ -595,6 +595,8 @@ static int qed_spq_add_entry(struct qed_hwfn *p_hwfn, | ||
625 | /* EBLOCK responsible to free the allocated p_ent */ | ||
626 | if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK) | ||
627 | kfree(p_ent); | ||
628 | + else | ||
629 | + p_ent->post_ent = p_en2; | ||
630 | |||
631 | p_ent = p_en2; | ||
632 | } | ||
633 | @@ -678,6 +680,25 @@ static int qed_spq_pend_post(struct qed_hwfn *p_hwfn) | ||
634 | SPQ_HIGH_PRI_RESERVE_DEFAULT); | ||
635 | } | ||
636 | |||
637 | +/* Avoid overriding of SPQ entries when getting out-of-order completions, by | ||
638 | + * marking the completions in a bitmap and increasing the chain consumer only | ||
639 | + * for the first successive completed entries. | ||
640 | + */ | ||
641 | +static void qed_spq_comp_bmap_update(struct qed_hwfn *p_hwfn, __le16 echo) | ||
642 | +{ | ||
643 | + u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE; | ||
644 | + struct qed_spq *p_spq = p_hwfn->p_spq; | ||
645 | + | ||
646 | + __set_bit(pos, p_spq->p_comp_bitmap); | ||
647 | + while (test_bit(p_spq->comp_bitmap_idx, | ||
648 | + p_spq->p_comp_bitmap)) { | ||
649 | + __clear_bit(p_spq->comp_bitmap_idx, | ||
650 | + p_spq->p_comp_bitmap); | ||
651 | + p_spq->comp_bitmap_idx++; | ||
652 | + qed_chain_return_produced(&p_spq->chain); | ||
653 | + } | ||
654 | +} | ||
655 | + | ||
656 | int qed_spq_post(struct qed_hwfn *p_hwfn, | ||
657 | struct qed_spq_entry *p_ent, u8 *fw_return_code) | ||
658 | { | ||
659 | @@ -728,11 +749,12 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, | ||
660 | rc = qed_spq_block(p_hwfn, p_ent, fw_return_code); | ||
661 | |||
662 | if (p_ent->queue == &p_spq->unlimited_pending) { | ||
663 | - /* This is an allocated p_ent which does not need to | ||
664 | - * return to pool. | ||
665 | - */ | ||
666 | + struct qed_spq_entry *p_post_ent = p_ent->post_ent; | ||
667 | + | ||
668 | kfree(p_ent); | ||
669 | - return rc; | ||
670 | + | ||
671 | + /* Return the entry which was actually posted */ | ||
672 | + p_ent = p_post_ent; | ||
673 | } | ||
674 | |||
675 | if (rc) | ||
676 | @@ -746,7 +768,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, | ||
677 | spq_post_fail2: | ||
678 | spin_lock_bh(&p_spq->lock); | ||
679 | list_del(&p_ent->list); | ||
680 | - qed_chain_return_produced(&p_spq->chain); | ||
681 | + qed_spq_comp_bmap_update(p_hwfn, p_ent->elem.hdr.echo); | ||
682 | |||
683 | spq_post_fail: | ||
684 | /* return to the free pool */ | ||
685 | @@ -778,25 +800,8 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, | ||
686 | spin_lock_bh(&p_spq->lock); | ||
687 | list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending, list) { | ||
688 | if (p_ent->elem.hdr.echo == echo) { | ||
689 | - u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE; | ||
690 | - | ||
691 | list_del(&p_ent->list); | ||
692 | - | ||
693 | - /* Avoid overriding of SPQ entries when getting | ||
694 | - * out-of-order completions, by marking the completions | ||
695 | - * in a bitmap and increasing the chain consumer only | ||
696 | - * for the first successive completed entries. | ||
697 | - */ | ||
698 | - __set_bit(pos, p_spq->p_comp_bitmap); | ||
699 | - | ||
700 | - while (test_bit(p_spq->comp_bitmap_idx, | ||
701 | - p_spq->p_comp_bitmap)) { | ||
702 | - __clear_bit(p_spq->comp_bitmap_idx, | ||
703 | - p_spq->p_comp_bitmap); | ||
704 | - p_spq->comp_bitmap_idx++; | ||
705 | - qed_chain_return_produced(&p_spq->chain); | ||
706 | - } | ||
707 | - | ||
708 | + qed_spq_comp_bmap_update(p_hwfn, echo); | ||
709 | p_spq->comp_count++; | ||
710 | found = p_ent; | ||
711 | break; | ||
712 | @@ -835,11 +840,9 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, | ||
713 | QED_MSG_SPQ, | ||
714 | "Got a completion without a callback function\n"); | ||
715 | |||
716 | - if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) || | ||
717 | - (found->queue == &p_spq->unlimited_pending)) | ||
718 | + if (found->comp_mode != QED_SPQ_MODE_EBLOCK) | ||
719 | /* EBLOCK is responsible for returning its own entry into the | ||
720 | - * free list, unless it originally added the entry into the | ||
721 | - * unlimited pending list. | ||
722 | + * free list. | ||
723 | */ | ||
724 | qed_spq_return_entry(p_hwfn, found); | ||
725 | |||
726 | diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c | ||
727 | index 2acdb0d6ea89..a0533e4e52d7 100644 | ||
728 | --- a/drivers/platform/x86/acerhdf.c | ||
729 | +++ b/drivers/platform/x86/acerhdf.c | ||
730 | @@ -233,6 +233,7 @@ static const struct bios_settings bios_tbl[] = { | ||
731 | {"Gateway", "LT31", "v1.3201", 0x55, 0x58, {0x9e, 0x00}, 0}, | ||
732 | {"Gateway", "LT31", "v1.3302", 0x55, 0x58, {0x9e, 0x00}, 0}, | ||
733 | {"Gateway", "LT31", "v1.3303t", 0x55, 0x58, {0x9e, 0x00}, 0}, | ||
734 | + {"Gateway", "LT31", "v1.3307", 0x55, 0x58, {0x9e, 0x00}, 0}, | ||
735 | /* Packard Bell */ | ||
736 | {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00}, 0}, | ||
737 | {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00}, 0}, | ||
738 | diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c | ||
739 | index ef29f18b1951..4069433a0ec6 100644 | ||
740 | --- a/drivers/platform/x86/intel_telemetry_debugfs.c | ||
741 | +++ b/drivers/platform/x86/intel_telemetry_debugfs.c | ||
742 | @@ -953,12 +953,16 @@ static int __init telemetry_debugfs_init(void) | ||
743 | debugfs_conf = (struct telemetry_debugfs_conf *)id->driver_data; | ||
744 | |||
745 | err = telemetry_pltconfig_valid(); | ||
746 | - if (err < 0) | ||
747 | + if (err < 0) { | ||
748 | + pr_info("Invalid pltconfig, ensure IPC1 device is enabled in BIOS\n"); | ||
749 | return -ENODEV; | ||
750 | + } | ||
751 | |||
752 | err = telemetry_debugfs_check_evts(); | ||
753 | - if (err < 0) | ||
754 | + if (err < 0) { | ||
755 | + pr_info("telemetry_debugfs_check_evts failed\n"); | ||
756 | return -EINVAL; | ||
757 | + } | ||
758 | |||
759 | |||
760 | #ifdef CONFIG_PM_SLEEP | ||
761 | diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c | ||
762 | index efefe075557f..6e6ba1baf9c4 100644 | ||
763 | --- a/drivers/s390/net/qeth_l3_main.c | ||
764 | +++ b/drivers/s390/net/qeth_l3_main.c | ||
765 | @@ -363,9 +363,6 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover) | ||
766 | |||
767 | QETH_CARD_TEXT(card, 4, "clearip"); | ||
768 | |||
769 | - if (recover && card->options.sniffer) | ||
770 | - return; | ||
771 | - | ||
772 | spin_lock_bh(&card->ip_lock); | ||
773 | |||
774 | hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) { | ||
775 | @@ -823,6 +820,8 @@ static int qeth_l3_register_addr_entry(struct qeth_card *card, | ||
776 | int rc = 0; | ||
777 | int cnt = 3; | ||
778 | |||
779 | + if (card->options.sniffer) | ||
780 | + return 0; | ||
781 | |||
782 | if (addr->proto == QETH_PROT_IPV4) { | ||
783 | QETH_CARD_TEXT(card, 2, "setaddr4"); | ||
784 | @@ -858,6 +857,9 @@ static int qeth_l3_deregister_addr_entry(struct qeth_card *card, | ||
785 | { | ||
786 | int rc = 0; | ||
787 | |||
788 | + if (card->options.sniffer) | ||
789 | + return 0; | ||
790 | + | ||
791 | if (addr->proto == QETH_PROT_IPV4) { | ||
792 | QETH_CARD_TEXT(card, 2, "deladdr4"); | ||
793 | QETH_CARD_HEX(card, 3, &addr->u.a4.addr, sizeof(int)); | ||
794 | diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c | ||
795 | index cfbfef08c94a..e6b20716e8e0 100644 | ||
796 | --- a/drivers/uio/uio.c | ||
797 | +++ b/drivers/uio/uio.c | ||
798 | @@ -850,6 +850,8 @@ int __uio_register_device(struct module *owner, | ||
799 | if (ret) | ||
800 | goto err_uio_dev_add_attributes; | ||
801 | |||
802 | + info->uio_dev = idev; | ||
803 | + | ||
804 | if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { | ||
805 | /* | ||
806 | * Note that we deliberately don't use devm_request_irq | ||
807 | @@ -861,11 +863,12 @@ int __uio_register_device(struct module *owner, | ||
808 | */ | ||
809 | ret = request_irq(info->irq, uio_interrupt, | ||
810 | info->irq_flags, info->name, idev); | ||
811 | - if (ret) | ||
812 | + if (ret) { | ||
813 | + info->uio_dev = NULL; | ||
814 | goto err_request_irq; | ||
815 | + } | ||
816 | } | ||
817 | |||
818 | - info->uio_dev = idev; | ||
819 | return 0; | ||
820 | |||
821 | err_request_irq: | ||
822 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c | ||
823 | index dbe44e890c99..cd4f96354fa8 100644 | ||
824 | --- a/drivers/usb/class/cdc-acm.c | ||
825 | +++ b/drivers/usb/class/cdc-acm.c | ||
826 | @@ -1659,6 +1659,9 @@ static const struct usb_device_id acm_ids[] = { | ||
827 | { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ | ||
828 | .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ | ||
829 | }, | ||
830 | + { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */ | ||
831 | + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ | ||
832 | + }, | ||
833 | { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ | ||
834 | .driver_info = QUIRK_CONTROL_LINE_STATE, }, | ||
835 | { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ | ||
836 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c | ||
837 | index 37a5e07b3488..1e8f68960014 100644 | ||
838 | --- a/drivers/usb/core/quirks.c | ||
839 | +++ b/drivers/usb/core/quirks.c | ||
840 | @@ -243,6 +243,9 @@ static const struct usb_device_id usb_quirk_list[] = { | ||
841 | { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | | ||
842 | USB_QUIRK_DELAY_CTRL_MSG }, | ||
843 | |||
844 | + /* Corsair K70 LUX RGB */ | ||
845 | + { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT }, | ||
846 | + | ||
847 | /* Corsair K70 LUX */ | ||
848 | { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, | ||
849 | |||
850 | @@ -263,6 +266,11 @@ static const struct usb_device_id usb_quirk_list[] = { | ||
851 | { USB_DEVICE(0x2040, 0x7200), .driver_info = | ||
852 | USB_QUIRK_CONFIG_INTF_STRINGS }, | ||
853 | |||
854 | + /* Raydium Touchscreen */ | ||
855 | + { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM }, | ||
856 | + | ||
857 | + { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, | ||
858 | + | ||
859 | /* DJI CineSSD */ | ||
860 | { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, | ||
861 | |||
862 | diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c | ||
863 | index da5ff401a354..2d3c656e0bff 100644 | ||
864 | --- a/drivers/usb/misc/appledisplay.c | ||
865 | +++ b/drivers/usb/misc/appledisplay.c | ||
866 | @@ -63,6 +63,7 @@ static const struct usb_device_id appledisplay_table[] = { | ||
867 | { APPLEDISPLAY_DEVICE(0x9219) }, | ||
868 | { APPLEDISPLAY_DEVICE(0x921c) }, | ||
869 | { APPLEDISPLAY_DEVICE(0x921d) }, | ||
870 | + { APPLEDISPLAY_DEVICE(0x9222) }, | ||
871 | { APPLEDISPLAY_DEVICE(0x9236) }, | ||
872 | |||
873 | /* Terminating entry */ | ||
874 | diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c | ||
875 | index 18d05323ca53..57d375c68e46 100644 | ||
876 | --- a/fs/btrfs/disk-io.c | ||
877 | +++ b/fs/btrfs/disk-io.c | ||
878 | @@ -4491,6 +4491,7 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root, | ||
879 | static int btrfs_destroy_pinned_extent(struct btrfs_root *root, | ||
880 | struct extent_io_tree *pinned_extents) | ||
881 | { | ||
882 | + struct btrfs_fs_info *fs_info = root->fs_info; | ||
883 | struct extent_io_tree *unpin; | ||
884 | u64 start; | ||
885 | u64 end; | ||
886 | @@ -4500,21 +4501,31 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root, | ||
887 | unpin = pinned_extents; | ||
888 | again: | ||
889 | while (1) { | ||
890 | + /* | ||
891 | + * The btrfs_finish_extent_commit() may get the same range as | ||
892 | + * ours between find_first_extent_bit and clear_extent_dirty. | ||
893 | + * Hence, hold the unused_bg_unpin_mutex to avoid double unpin | ||
894 | + * the same extent range. | ||
895 | + */ | ||
896 | + mutex_lock(&fs_info->unused_bg_unpin_mutex); | ||
897 | ret = find_first_extent_bit(unpin, 0, &start, &end, | ||
898 | EXTENT_DIRTY, NULL); | ||
899 | - if (ret) | ||
900 | + if (ret) { | ||
901 | + mutex_unlock(&fs_info->unused_bg_unpin_mutex); | ||
902 | break; | ||
903 | + } | ||
904 | |||
905 | clear_extent_dirty(unpin, start, end); | ||
906 | btrfs_error_unpin_extent_range(root, start, end); | ||
907 | + mutex_unlock(&fs_info->unused_bg_unpin_mutex); | ||
908 | cond_resched(); | ||
909 | } | ||
910 | |||
911 | if (loop) { | ||
912 | - if (unpin == &root->fs_info->freed_extents[0]) | ||
913 | - unpin = &root->fs_info->freed_extents[1]; | ||
914 | + if (unpin == &fs_info->freed_extents[0]) | ||
915 | + unpin = &fs_info->freed_extents[1]; | ||
916 | else | ||
917 | - unpin = &root->fs_info->freed_extents[0]; | ||
918 | + unpin = &fs_info->freed_extents[0]; | ||
919 | loop = false; | ||
920 | goto again; | ||
921 | } | ||
922 | diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c | ||
923 | index 163b61a92b59..a775307f3b6b 100644 | ||
924 | --- a/fs/btrfs/extent-tree.c | ||
925 | +++ b/fs/btrfs/extent-tree.c | ||
926 | @@ -11140,6 +11140,15 @@ static int btrfs_trim_free_extents(struct btrfs_device *device, | ||
927 | return ret; | ||
928 | } | ||
929 | |||
930 | +/* | ||
931 | + * Trim the whole filesystem by: | ||
932 | + * 1) trimming the free space in each block group | ||
933 | + * 2) trimming the unallocated space on each device | ||
934 | + * | ||
935 | + * This will also continue trimming even if a block group or device encounters | ||
936 | + * an error. The return value will be the last error, or 0 if nothing bad | ||
937 | + * happens. | ||
938 | + */ | ||
939 | int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) | ||
940 | { | ||
941 | struct btrfs_fs_info *fs_info = root->fs_info; | ||
942 | @@ -11150,18 +11159,14 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) | ||
943 | u64 start; | ||
944 | u64 end; | ||
945 | u64 trimmed = 0; | ||
946 | - u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy); | ||
947 | + u64 bg_failed = 0; | ||
948 | + u64 dev_failed = 0; | ||
949 | + int bg_ret = 0; | ||
950 | + int dev_ret = 0; | ||
951 | int ret = 0; | ||
952 | |||
953 | - /* | ||
954 | - * try to trim all FS space, our block group may start from non-zero. | ||
955 | - */ | ||
956 | - if (range->len == total_bytes) | ||
957 | - cache = btrfs_lookup_first_block_group(fs_info, range->start); | ||
958 | - else | ||
959 | - cache = btrfs_lookup_block_group(fs_info, range->start); | ||
960 | - | ||
961 | - while (cache) { | ||
962 | + cache = btrfs_lookup_first_block_group(fs_info, range->start); | ||
963 | + for (; cache; cache = next_block_group(fs_info->tree_root, cache)) { | ||
964 | if (cache->key.objectid >= (range->start + range->len)) { | ||
965 | btrfs_put_block_group(cache); | ||
966 | break; | ||
967 | @@ -11175,13 +11180,15 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) | ||
968 | if (!block_group_cache_done(cache)) { | ||
969 | ret = cache_block_group(cache, 0); | ||
970 | if (ret) { | ||
971 | - btrfs_put_block_group(cache); | ||
972 | - break; | ||
973 | + bg_failed++; | ||
974 | + bg_ret = ret; | ||
975 | + continue; | ||
976 | } | ||
977 | ret = wait_block_group_cache_done(cache); | ||
978 | if (ret) { | ||
979 | - btrfs_put_block_group(cache); | ||
980 | - break; | ||
981 | + bg_failed++; | ||
982 | + bg_ret = ret; | ||
983 | + continue; | ||
984 | } | ||
985 | } | ||
986 | ret = btrfs_trim_block_group(cache, | ||
987 | @@ -11192,28 +11199,40 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) | ||
988 | |||
989 | trimmed += group_trimmed; | ||
990 | if (ret) { | ||
991 | - btrfs_put_block_group(cache); | ||
992 | - break; | ||
993 | + bg_failed++; | ||
994 | + bg_ret = ret; | ||
995 | + continue; | ||
996 | } | ||
997 | } | ||
998 | - | ||
999 | - cache = next_block_group(fs_info->tree_root, cache); | ||
1000 | } | ||
1001 | |||
1002 | - mutex_lock(&root->fs_info->fs_devices->device_list_mutex); | ||
1003 | - devices = &root->fs_info->fs_devices->devices; | ||
1004 | + if (bg_failed) | ||
1005 | + btrfs_warn(fs_info, | ||
1006 | + "failed to trim %llu block group(s), last error %d", | ||
1007 | + bg_failed, bg_ret); | ||
1008 | + mutex_lock(&fs_info->fs_devices->device_list_mutex); | ||
1009 | + devices = &fs_info->fs_devices->devices; | ||
1010 | list_for_each_entry(device, devices, dev_list) { | ||
1011 | ret = btrfs_trim_free_extents(device, range->minlen, | ||
1012 | &group_trimmed); | ||
1013 | - if (ret) | ||
1014 | + if (ret) { | ||
1015 | + dev_failed++; | ||
1016 | + dev_ret = ret; | ||
1017 | break; | ||
1018 | + } | ||
1019 | |||
1020 | trimmed += group_trimmed; | ||
1021 | } | ||
1022 | mutex_unlock(&root->fs_info->fs_devices->device_list_mutex); | ||
1023 | |||
1024 | + if (dev_failed) | ||
1025 | + btrfs_warn(fs_info, | ||
1026 | + "failed to trim %llu device(s), last error %d", | ||
1027 | + dev_failed, dev_ret); | ||
1028 | range->len = trimmed; | ||
1029 | - return ret; | ||
1030 | + if (bg_ret) | ||
1031 | + return bg_ret; | ||
1032 | + return dev_ret; | ||
1033 | } | ||
1034 | |||
1035 | /* | ||
1036 | diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c | ||
1037 | index 96ad2778405b..242584a0d3b5 100644 | ||
1038 | --- a/fs/btrfs/ioctl.c | ||
1039 | +++ b/fs/btrfs/ioctl.c | ||
1040 | @@ -380,7 +380,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) | ||
1041 | struct fstrim_range range; | ||
1042 | u64 minlen = ULLONG_MAX; | ||
1043 | u64 num_devices = 0; | ||
1044 | - u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy); | ||
1045 | int ret; | ||
1046 | |||
1047 | if (!capable(CAP_SYS_ADMIN)) | ||
1048 | @@ -404,11 +403,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) | ||
1049 | return -EOPNOTSUPP; | ||
1050 | if (copy_from_user(&range, arg, sizeof(range))) | ||
1051 | return -EFAULT; | ||
1052 | - if (range.start > total_bytes || | ||
1053 | - range.len < fs_info->sb->s_blocksize) | ||
1054 | + | ||
1055 | + /* | ||
1056 | + * NOTE: Don't truncate the range using super->total_bytes. Bytenr of | ||
1057 | + * block group is in the logical address space, which can be any | ||
1058 | + * sectorsize aligned bytenr in the range [0, U64_MAX]. | ||
1059 | + */ | ||
1060 | + if (range.len < fs_info->sb->s_blocksize) | ||
1061 | return -EINVAL; | ||
1062 | |||
1063 | - range.len = min(range.len, total_bytes - range.start); | ||
1064 | range.minlen = max(range.minlen, minlen); | ||
1065 | ret = btrfs_trim_fs(fs_info->tree_root, &range); | ||
1066 | if (ret < 0) | ||
1067 | diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c | ||
1068 | index 87658f63b374..be84d49f2406 100644 | ||
1069 | --- a/fs/cifs/cifsfs.c | ||
1070 | +++ b/fs/cifs/cifsfs.c | ||
1071 | @@ -927,8 +927,8 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off, | ||
1072 | struct inode *src_inode = file_inode(src_file); | ||
1073 | struct inode *target_inode = file_inode(dst_file); | ||
1074 | struct cifsFileInfo *smb_file_src = src_file->private_data; | ||
1075 | - struct cifsFileInfo *smb_file_target = dst_file->private_data; | ||
1076 | - struct cifs_tcon *target_tcon = tlink_tcon(smb_file_target->tlink); | ||
1077 | + struct cifsFileInfo *smb_file_target; | ||
1078 | + struct cifs_tcon *target_tcon; | ||
1079 | unsigned int xid; | ||
1080 | int rc; | ||
1081 | |||
1082 | @@ -942,6 +942,9 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off, | ||
1083 | goto out; | ||
1084 | } | ||
1085 | |||
1086 | + smb_file_target = dst_file->private_data; | ||
1087 | + target_tcon = tlink_tcon(smb_file_target->tlink); | ||
1088 | + | ||
1089 | /* | ||
1090 | * Note: cifs case is easier than btrfs since server responsible for | ||
1091 | * checks for proper open modes and file type and if it wants | ||
1092 | diff --git a/fs/exofs/super.c b/fs/exofs/super.c | ||
1093 | index 1076a4233b39..0c48138486dc 100644 | ||
1094 | --- a/fs/exofs/super.c | ||
1095 | +++ b/fs/exofs/super.c | ||
1096 | @@ -100,6 +100,7 @@ static int parse_options(char *options, struct exofs_mountopt *opts) | ||
1097 | token = match_token(p, tokens, args); | ||
1098 | switch (token) { | ||
1099 | case Opt_name: | ||
1100 | + kfree(opts->dev_name); | ||
1101 | opts->dev_name = match_strdup(&args[0]); | ||
1102 | if (unlikely(!opts->dev_name)) { | ||
1103 | EXOFS_ERR("Error allocating dev_name"); | ||
1104 | @@ -868,8 +869,10 @@ static struct dentry *exofs_mount(struct file_system_type *type, | ||
1105 | int ret; | ||
1106 | |||
1107 | ret = parse_options(data, &opts); | ||
1108 | - if (ret) | ||
1109 | + if (ret) { | ||
1110 | + kfree(opts.dev_name); | ||
1111 | return ERR_PTR(ret); | ||
1112 | + } | ||
1113 | |||
1114 | if (!opts.dev_name) | ||
1115 | opts.dev_name = dev_name; | ||
1116 | diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c | ||
1117 | index 832824994aae..073126707270 100644 | ||
1118 | --- a/fs/gfs2/rgrp.c | ||
1119 | +++ b/fs/gfs2/rgrp.c | ||
1120 | @@ -715,6 +715,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) | ||
1121 | spin_lock(&gl->gl_lockref.lock); | ||
1122 | gl->gl_object = NULL; | ||
1123 | spin_unlock(&gl->gl_lockref.lock); | ||
1124 | + gfs2_rgrp_brelse(rgd); | ||
1125 | gfs2_glock_add_to_lru(gl); | ||
1126 | gfs2_glock_put(gl); | ||
1127 | } | ||
1128 | @@ -1125,7 +1126,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd) | ||
1129 | * @rgd: the struct gfs2_rgrpd describing the RG to read in | ||
1130 | * | ||
1131 | * Read in all of a Resource Group's header and bitmap blocks. | ||
1132 | - * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps. | ||
1133 | + * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps. | ||
1134 | * | ||
1135 | * Returns: errno | ||
1136 | */ | ||
1137 | diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c | ||
1138 | index 2a6f3c67cb3f..2e713673df42 100644 | ||
1139 | --- a/fs/hfs/brec.c | ||
1140 | +++ b/fs/hfs/brec.c | ||
1141 | @@ -424,6 +424,10 @@ skip: | ||
1142 | if (new_node) { | ||
1143 | __be32 cnid; | ||
1144 | |||
1145 | + if (!new_node->parent) { | ||
1146 | + hfs_btree_inc_height(tree); | ||
1147 | + new_node->parent = tree->root; | ||
1148 | + } | ||
1149 | fd->bnode = hfs_bnode_find(tree, new_node->parent); | ||
1150 | /* create index key and entry */ | ||
1151 | hfs_bnode_read_key(new_node, fd->search_key, 14); | ||
1152 | diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c | ||
1153 | index 754fdf8c6356..1002a0c08319 100644 | ||
1154 | --- a/fs/hfsplus/brec.c | ||
1155 | +++ b/fs/hfsplus/brec.c | ||
1156 | @@ -427,6 +427,10 @@ skip: | ||
1157 | if (new_node) { | ||
1158 | __be32 cnid; | ||
1159 | |||
1160 | + if (!new_node->parent) { | ||
1161 | + hfs_btree_inc_height(tree); | ||
1162 | + new_node->parent = tree->root; | ||
1163 | + } | ||
1164 | fd->bnode = hfs_bnode_find(tree, new_node->parent); | ||
1165 | /* create index key and entry */ | ||
1166 | hfs_bnode_read_key(new_node, fd->search_key, 14); | ||
1167 | diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c | ||
1168 | index 06a9fae202a7..9e313fc7fdc7 100644 | ||
1169 | --- a/fs/reiserfs/xattr.c | ||
1170 | +++ b/fs/reiserfs/xattr.c | ||
1171 | @@ -184,6 +184,7 @@ struct reiserfs_dentry_buf { | ||
1172 | struct dir_context ctx; | ||
1173 | struct dentry *xadir; | ||
1174 | int count; | ||
1175 | + int err; | ||
1176 | struct dentry *dentries[8]; | ||
1177 | }; | ||
1178 | |||
1179 | @@ -206,6 +207,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, | ||
1180 | |||
1181 | dentry = lookup_one_len(name, dbuf->xadir, namelen); | ||
1182 | if (IS_ERR(dentry)) { | ||
1183 | + dbuf->err = PTR_ERR(dentry); | ||
1184 | return PTR_ERR(dentry); | ||
1185 | } else if (d_really_is_negative(dentry)) { | ||
1186 | /* A directory entry exists, but no file? */ | ||
1187 | @@ -214,6 +216,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, | ||
1188 | "not found for file %pd.\n", | ||
1189 | dentry, dbuf->xadir); | ||
1190 | dput(dentry); | ||
1191 | + dbuf->err = -EIO; | ||
1192 | return -EIO; | ||
1193 | } | ||
1194 | |||
1195 | @@ -261,6 +264,10 @@ static int reiserfs_for_each_xattr(struct inode *inode, | ||
1196 | err = reiserfs_readdir_inode(d_inode(dir), &buf.ctx); | ||
1197 | if (err) | ||
1198 | break; | ||
1199 | + if (buf.err) { | ||
1200 | + err = buf.err; | ||
1201 | + break; | ||
1202 | + } | ||
1203 | if (!buf.count) | ||
1204 | break; | ||
1205 | for (i = 0; !err && i < buf.count && buf.dentries[i]; i++) { | ||
1206 | diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h | ||
1207 | index 8d0248525957..9f34204978e4 100644 | ||
1208 | --- a/include/linux/netfilter/ipset/ip_set_comment.h | ||
1209 | +++ b/include/linux/netfilter/ipset/ip_set_comment.h | ||
1210 | @@ -41,11 +41,11 @@ ip_set_init_comment(struct ip_set_comment *comment, | ||
1211 | rcu_assign_pointer(comment->c, c); | ||
1212 | } | ||
1213 | |||
1214 | -/* Used only when dumping a set, protected by rcu_read_lock_bh() */ | ||
1215 | +/* Used only when dumping a set, protected by rcu_read_lock() */ | ||
1216 | static inline int | ||
1217 | ip_set_put_comment(struct sk_buff *skb, struct ip_set_comment *comment) | ||
1218 | { | ||
1219 | - struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c); | ||
1220 | + struct ip_set_comment_rcu *c = rcu_dereference(comment->c); | ||
1221 | |||
1222 | if (!c) | ||
1223 | return 0; | ||
1224 | diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h | ||
1225 | index f30c187ed785..9442423979c1 100644 | ||
1226 | --- a/include/linux/uaccess.h | ||
1227 | +++ b/include/linux/uaccess.h | ||
1228 | @@ -2,6 +2,9 @@ | ||
1229 | #define __LINUX_UACCESS_H__ | ||
1230 | |||
1231 | #include <linux/sched.h> | ||
1232 | + | ||
1233 | +#define uaccess_kernel() segment_eq(get_fs(), KERNEL_DS) | ||
1234 | + | ||
1235 | #include <asm/uaccess.h> | ||
1236 | |||
1237 | static __always_inline void pagefault_disabled_inc(void) | ||
1238 | diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile | ||
1239 | index 2c7b60edea04..1faeef0c30b9 100644 | ||
1240 | --- a/lib/raid6/test/Makefile | ||
1241 | +++ b/lib/raid6/test/Makefile | ||
1242 | @@ -26,7 +26,7 @@ ifeq ($(ARCH),arm) | ||
1243 | CFLAGS += -I../../../arch/arm/include -mfpu=neon | ||
1244 | HAS_NEON = yes | ||
1245 | endif | ||
1246 | -ifeq ($(ARCH),arm64) | ||
1247 | +ifeq ($(ARCH),aarch64) | ||
1248 | CFLAGS += -I../../../arch/arm64/include | ||
1249 | HAS_NEON = yes | ||
1250 | endif | ||
1251 | @@ -40,7 +40,7 @@ ifeq ($(IS_X86),yes) | ||
1252 | gcc -c -x assembler - >&/dev/null && \ | ||
1253 | rm ./-.o && echo -DCONFIG_AS_AVX512=1) | ||
1254 | else ifeq ($(HAS_NEON),yes) | ||
1255 | - OBJS += neon.o neon1.o neon2.o neon4.o neon8.o | ||
1256 | + OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o | ||
1257 | CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 | ||
1258 | else | ||
1259 | HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\ | ||
1260 | diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c | ||
1261 | index 98ea28dc03f9..68acf94fae72 100644 | ||
1262 | --- a/net/ceph/messenger.c | ||
1263 | +++ b/net/ceph/messenger.c | ||
1264 | @@ -588,9 +588,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page, | ||
1265 | int ret; | ||
1266 | struct kvec iov; | ||
1267 | |||
1268 | - /* sendpage cannot properly handle pages with page_count == 0, | ||
1269 | - * we need to fallback to sendmsg if that's the case */ | ||
1270 | - if (page_count(page) >= 1) | ||
1271 | + /* | ||
1272 | + * sendpage cannot properly handle pages with page_count == 0, | ||
1273 | + * we need to fall back to sendmsg if that's the case. | ||
1274 | + * | ||
1275 | + * Same goes for slab pages: skb_can_coalesce() allows | ||
1276 | + * coalescing neighboring slab objects into a single frag which | ||
1277 | + * triggers one of hardened usercopy checks. | ||
1278 | + */ | ||
1279 | + if (page_count(page) >= 1 && !PageSlab(page)) | ||
1280 | return __ceph_tcp_sendpage(sock, page, offset, size, more); | ||
1281 | |||
1282 | iov.iov_base = kmap(page) + offset; | ||
1283 | diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c | ||
1284 | index 9a14c237830f..b259a5814965 100644 | ||
1285 | --- a/net/netfilter/ipset/ip_set_hash_netportnet.c | ||
1286 | +++ b/net/netfilter/ipset/ip_set_hash_netportnet.c | ||
1287 | @@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], | ||
1288 | |||
1289 | if (tb[IPSET_ATTR_CIDR]) { | ||
1290 | e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); | ||
1291 | - if (!e.cidr[0] || e.cidr[0] > HOST_MASK) | ||
1292 | + if (e.cidr[0] > HOST_MASK) | ||
1293 | return -IPSET_ERR_INVALID_CIDR; | ||
1294 | } | ||
1295 | |||
1296 | if (tb[IPSET_ATTR_CIDR2]) { | ||
1297 | e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); | ||
1298 | - if (!e.cidr[1] || e.cidr[1] > HOST_MASK) | ||
1299 | + if (e.cidr[1] > HOST_MASK) | ||
1300 | return -IPSET_ERR_INVALID_CIDR; | ||
1301 | } | ||
1302 | |||
1303 | @@ -492,13 +492,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], | ||
1304 | |||
1305 | if (tb[IPSET_ATTR_CIDR]) { | ||
1306 | e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); | ||
1307 | - if (!e.cidr[0] || e.cidr[0] > HOST_MASK) | ||
1308 | + if (e.cidr[0] > HOST_MASK) | ||
1309 | return -IPSET_ERR_INVALID_CIDR; | ||
1310 | } | ||
1311 | |||
1312 | if (tb[IPSET_ATTR_CIDR2]) { | ||
1313 | e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); | ||
1314 | - if (!e.cidr[1] || e.cidr[1] > HOST_MASK) | ||
1315 | + if (e.cidr[1] > HOST_MASK) | ||
1316 | return -IPSET_ERR_INVALID_CIDR; | ||
1317 | } | ||
1318 | |||
1319 | diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c | ||
1320 | index bb5d6a058fb7..921c9bd7e1e7 100644 | ||
1321 | --- a/net/netfilter/xt_IDLETIMER.c | ||
1322 | +++ b/net/netfilter/xt_IDLETIMER.c | ||
1323 | @@ -116,6 +116,22 @@ static void idletimer_tg_expired(unsigned long data) | ||
1324 | schedule_work(&timer->work); | ||
1325 | } | ||
1326 | |||
1327 | +static int idletimer_check_sysfs_name(const char *name, unsigned int size) | ||
1328 | +{ | ||
1329 | + int ret; | ||
1330 | + | ||
1331 | + ret = xt_check_proc_name(name, size); | ||
1332 | + if (ret < 0) | ||
1333 | + return ret; | ||
1334 | + | ||
1335 | + if (!strcmp(name, "power") || | ||
1336 | + !strcmp(name, "subsystem") || | ||
1337 | + !strcmp(name, "uevent")) | ||
1338 | + return -EINVAL; | ||
1339 | + | ||
1340 | + return 0; | ||
1341 | +} | ||
1342 | + | ||
1343 | static int idletimer_tg_create(struct idletimer_tg_info *info) | ||
1344 | { | ||
1345 | int ret; | ||
1346 | @@ -126,6 +142,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) | ||
1347 | goto out; | ||
1348 | } | ||
1349 | |||
1350 | + ret = idletimer_check_sysfs_name(info->label, sizeof(info->label)); | ||
1351 | + if (ret < 0) | ||
1352 | + goto out_free_timer; | ||
1353 | + | ||
1354 | sysfs_attr_init(&info->timer->attr.attr); | ||
1355 | info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL); | ||
1356 | if (!info->timer->attr.attr.name) { | ||
1357 | diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c | ||
1358 | index 1b38fc486351..69846c6574ef 100644 | ||
1359 | --- a/net/sunrpc/xdr.c | ||
1360 | +++ b/net/sunrpc/xdr.c | ||
1361 | @@ -512,7 +512,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode); | ||
1362 | static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr, | ||
1363 | size_t nbytes) | ||
1364 | { | ||
1365 | - static __be32 *p; | ||
1366 | + __be32 *p; | ||
1367 | int space_left; | ||
1368 | int frag1bytes, frag2bytes; | ||
1369 |