Contents of /trunk/kernel-alx/patches-4.9/0240-4.9.141-all-fixes.patch
Parent Directory | Revision Log
Revision 3293 -
(show annotations)
(download)
Tue Mar 12 10:43:04 2019 UTC (5 years, 6 months ago) by niro
File size: 44075 byte(s)
Tue Mar 12 10:43:04 2019 UTC (5 years, 6 months ago) by niro
File size: 44075 byte(s)
-linux-4.9.141
1 | diff --git a/Makefile b/Makefile |
2 | index a9aed2326233..8eba73521a7f 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 140 |
9 | +SUBLEVEL = 141 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h |
14 | index 0d551576eb57..4724b8f0b625 100644 |
15 | --- a/arch/arm64/include/asm/percpu.h |
16 | +++ b/arch/arm64/include/asm/percpu.h |
17 | @@ -92,6 +92,7 @@ static inline unsigned long __percpu_##op(void *ptr, \ |
18 | : [val] "Ir" (val)); \ |
19 | break; \ |
20 | default: \ |
21 | + ret = 0; \ |
22 | BUILD_BUG(); \ |
23 | } \ |
24 | \ |
25 | @@ -121,6 +122,7 @@ static inline unsigned long __percpu_read(void *ptr, int size) |
26 | ret = ACCESS_ONCE(*(u64 *)ptr); |
27 | break; |
28 | default: |
29 | + ret = 0; |
30 | BUILD_BUG(); |
31 | } |
32 | |
33 | @@ -190,6 +192,7 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val, |
34 | : [val] "r" (val)); |
35 | break; |
36 | default: |
37 | + ret = 0; |
38 | BUILD_BUG(); |
39 | } |
40 | |
41 | diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile |
42 | index 6cc947896c77..ca7c3c34f94b 100644 |
43 | --- a/arch/s390/kernel/vdso32/Makefile |
44 | +++ b/arch/s390/kernel/vdso32/Makefile |
45 | @@ -32,7 +32,7 @@ UBSAN_SANITIZE := n |
46 | $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so |
47 | |
48 | # link rule for the .so file, .lds has to be first |
49 | -$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) |
50 | +$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE |
51 | $(call if_changed,vdso32ld) |
52 | |
53 | # strip rule for the .so file |
54 | @@ -41,12 +41,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE |
55 | $(call if_changed,objcopy) |
56 | |
57 | # assembly rules for the .S files |
58 | -$(obj-vdso32): %.o: %.S |
59 | +$(obj-vdso32): %.o: %.S FORCE |
60 | $(call if_changed_dep,vdso32as) |
61 | |
62 | # actual build commands |
63 | quiet_cmd_vdso32ld = VDSO32L $@ |
64 | - cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ |
65 | + cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ |
66 | quiet_cmd_vdso32as = VDSO32A $@ |
67 | cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $< |
68 | |
69 | diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile |
70 | index 2d54c18089eb..84af2b6b64c4 100644 |
71 | --- a/arch/s390/kernel/vdso64/Makefile |
72 | +++ b/arch/s390/kernel/vdso64/Makefile |
73 | @@ -32,7 +32,7 @@ UBSAN_SANITIZE := n |
74 | $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so |
75 | |
76 | # link rule for the .so file, .lds has to be first |
77 | -$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) |
78 | +$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE |
79 | $(call if_changed,vdso64ld) |
80 | |
81 | # strip rule for the .so file |
82 | @@ -41,12 +41,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE |
83 | $(call if_changed,objcopy) |
84 | |
85 | # assembly rules for the .S files |
86 | -$(obj-vdso64): %.o: %.S |
87 | +$(obj-vdso64): %.o: %.S FORCE |
88 | $(call if_changed_dep,vdso64as) |
89 | |
90 | # actual build commands |
91 | quiet_cmd_vdso64ld = VDSO64L $@ |
92 | - cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ |
93 | + cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ |
94 | quiet_cmd_vdso64as = VDSO64A $@ |
95 | cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $< |
96 | |
97 | diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c |
98 | index 0dac2640c3a7..e73a1165d261 100644 |
99 | --- a/arch/s390/numa/numa.c |
100 | +++ b/arch/s390/numa/numa.c |
101 | @@ -53,6 +53,7 @@ int __node_distance(int a, int b) |
102 | { |
103 | return mode->distance ? mode->distance(a, b) : 0; |
104 | } |
105 | +EXPORT_SYMBOL(__node_distance); |
106 | |
107 | int numa_debug_enabled; |
108 | |
109 | diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c |
110 | index 23025d645160..0a99d4515065 100644 |
111 | --- a/arch/um/os-Linux/skas/process.c |
112 | +++ b/arch/um/os-Linux/skas/process.c |
113 | @@ -578,6 +578,11 @@ int start_idle_thread(void *stack, jmp_buf *switch_buf) |
114 | fatal_sigsegv(); |
115 | } |
116 | longjmp(*switch_buf, 1); |
117 | + |
118 | + /* unreachable */ |
119 | + printk(UM_KERN_ERR "impossible long jump!"); |
120 | + fatal_sigsegv(); |
121 | + return 0; |
122 | } |
123 | |
124 | void initial_thread_cb_skas(void (*proc)(void *), void *arg) |
125 | diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c |
126 | index 03250e1f1103..d92eacaef231 100644 |
127 | --- a/drivers/acpi/acpi_platform.c |
128 | +++ b/drivers/acpi/acpi_platform.c |
129 | @@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = { |
130 | {"PNP0200", 0}, /* AT DMA Controller */ |
131 | {"ACPI0009", 0}, /* IOxAPIC */ |
132 | {"ACPI000A", 0}, /* IOAPIC */ |
133 | + {"SMB0001", 0}, /* ACPI SMBUS virtual device */ |
134 | {"", 0}, |
135 | }; |
136 | |
137 | diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c |
138 | index ce8fc680785b..396e358c2cee 100644 |
139 | --- a/drivers/acpi/acpi_watchdog.c |
140 | +++ b/drivers/acpi/acpi_watchdog.c |
141 | @@ -17,18 +17,77 @@ |
142 | |
143 | #include "internal.h" |
144 | |
145 | +#ifdef CONFIG_RTC_MC146818_LIB |
146 | +#include <linux/mc146818rtc.h> |
147 | + |
148 | +/* |
149 | + * There are several systems where the WDAT table is accessing RTC SRAM to |
150 | + * store persistent information. This does not work well with the Linux RTC |
151 | + * driver so on those systems we skip WDAT driver and prefer iTCO_wdt |
152 | + * instead. |
153 | + * |
154 | + * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033. |
155 | + */ |
156 | +static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat) |
157 | +{ |
158 | + const struct acpi_wdat_entry *entries; |
159 | + int i; |
160 | + |
161 | + entries = (struct acpi_wdat_entry *)(wdat + 1); |
162 | + for (i = 0; i < wdat->entries; i++) { |
163 | + const struct acpi_generic_address *gas; |
164 | + |
165 | + gas = &entries[i].register_region; |
166 | + if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) { |
167 | + switch (gas->address) { |
168 | + case RTC_PORT(0): |
169 | + case RTC_PORT(1): |
170 | + case RTC_PORT(2): |
171 | + case RTC_PORT(3): |
172 | + return true; |
173 | + } |
174 | + } |
175 | + } |
176 | + |
177 | + return false; |
178 | +} |
179 | +#else |
180 | +static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat) |
181 | +{ |
182 | + return false; |
183 | +} |
184 | +#endif |
185 | + |
186 | +static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void) |
187 | +{ |
188 | + const struct acpi_table_wdat *wdat = NULL; |
189 | + acpi_status status; |
190 | + |
191 | + if (acpi_disabled) |
192 | + return NULL; |
193 | + |
194 | + status = acpi_get_table(ACPI_SIG_WDAT, 0, |
195 | + (struct acpi_table_header **)&wdat); |
196 | + if (ACPI_FAILURE(status)) { |
197 | + /* It is fine if there is no WDAT */ |
198 | + return NULL; |
199 | + } |
200 | + |
201 | + if (acpi_watchdog_uses_rtc(wdat)) { |
202 | + pr_info("Skipping WDAT on this system because it uses RTC SRAM\n"); |
203 | + return NULL; |
204 | + } |
205 | + |
206 | + return wdat; |
207 | +} |
208 | + |
209 | /** |
210 | * Returns true if this system should prefer ACPI based watchdog instead of |
211 | * the native one (which are typically the same hardware). |
212 | */ |
213 | bool acpi_has_watchdog(void) |
214 | { |
215 | - struct acpi_table_header hdr; |
216 | - |
217 | - if (acpi_disabled) |
218 | - return false; |
219 | - |
220 | - return ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_WDAT, 0, &hdr)); |
221 | + return !!acpi_watchdog_get_wdat(); |
222 | } |
223 | EXPORT_SYMBOL_GPL(acpi_has_watchdog); |
224 | |
225 | @@ -41,12 +100,10 @@ void __init acpi_watchdog_init(void) |
226 | struct platform_device *pdev; |
227 | struct resource *resources; |
228 | size_t nresources = 0; |
229 | - acpi_status status; |
230 | int i; |
231 | |
232 | - status = acpi_get_table(ACPI_SIG_WDAT, 0, |
233 | - (struct acpi_table_header **)&wdat); |
234 | - if (ACPI_FAILURE(status)) { |
235 | + wdat = acpi_watchdog_get_wdat(); |
236 | + if (!wdat) { |
237 | /* It is fine if there is no WDAT */ |
238 | return; |
239 | } |
240 | diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c |
241 | index b7c0b69a02f5..d64a53d3270a 100644 |
242 | --- a/drivers/block/zram/zram_drv.c |
243 | +++ b/drivers/block/zram/zram_drv.c |
244 | @@ -1223,6 +1223,11 @@ static struct attribute_group zram_disk_attr_group = { |
245 | .attrs = zram_disk_attrs, |
246 | }; |
247 | |
248 | +static const struct attribute_group *zram_disk_attr_groups[] = { |
249 | + &zram_disk_attr_group, |
250 | + NULL, |
251 | +}; |
252 | + |
253 | /* |
254 | * Allocate and initialize new zram device. the function returns |
255 | * '>= 0' device_id upon success, and negative value otherwise. |
256 | @@ -1303,24 +1308,15 @@ static int zram_add(void) |
257 | zram->disk->queue->limits.discard_zeroes_data = 0; |
258 | queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, zram->disk->queue); |
259 | |
260 | + disk_to_dev(zram->disk)->groups = zram_disk_attr_groups; |
261 | add_disk(zram->disk); |
262 | |
263 | - ret = sysfs_create_group(&disk_to_dev(zram->disk)->kobj, |
264 | - &zram_disk_attr_group); |
265 | - if (ret < 0) { |
266 | - pr_err("Error creating sysfs group for device %d\n", |
267 | - device_id); |
268 | - goto out_free_disk; |
269 | - } |
270 | strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor)); |
271 | zram->meta = NULL; |
272 | |
273 | pr_info("Added device: %s\n", zram->disk->disk_name); |
274 | return device_id; |
275 | |
276 | -out_free_disk: |
277 | - del_gendisk(zram->disk); |
278 | - put_disk(zram->disk); |
279 | out_free_queue: |
280 | blk_cleanup_queue(queue); |
281 | out_free_idr: |
282 | @@ -1348,16 +1344,6 @@ static int zram_remove(struct zram *zram) |
283 | zram->claim = true; |
284 | mutex_unlock(&bdev->bd_mutex); |
285 | |
286 | - /* |
287 | - * Remove sysfs first, so no one will perform a disksize |
288 | - * store while we destroy the devices. This also helps during |
289 | - * hot_remove -- zram_reset_device() is the last holder of |
290 | - * ->init_lock, no later/concurrent disksize_store() or any |
291 | - * other sysfs handlers are possible. |
292 | - */ |
293 | - sysfs_remove_group(&disk_to_dev(zram->disk)->kobj, |
294 | - &zram_disk_attr_group); |
295 | - |
296 | /* Make sure all the pending I/O are finished */ |
297 | fsync_bdev(bdev); |
298 | zram_reset_device(zram); |
299 | diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig |
300 | index 4a9493a4159f..3cc9bff9d99d 100644 |
301 | --- a/drivers/bluetooth/Kconfig |
302 | +++ b/drivers/bluetooth/Kconfig |
303 | @@ -125,7 +125,6 @@ config BT_HCIUART_LL |
304 | config BT_HCIUART_3WIRE |
305 | bool "Three-wire UART (H5) protocol support" |
306 | depends on BT_HCIUART |
307 | - depends on BT_HCIUART_SERDEV |
308 | help |
309 | The HCI Three-wire UART Transport Layer makes it possible to |
310 | user the Bluetooth HCI over a serial port interface. The HCI |
311 | diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c |
312 | index 20724abd38bd..7df6b5b1e7ee 100644 |
313 | --- a/drivers/clk/clk-fixed-factor.c |
314 | +++ b/drivers/clk/clk-fixed-factor.c |
315 | @@ -210,6 +210,7 @@ static int of_fixed_factor_clk_remove(struct platform_device *pdev) |
316 | { |
317 | struct clk *clk = platform_get_drvdata(pdev); |
318 | |
319 | + of_clk_del_provider(pdev->dev.of_node); |
320 | clk_unregister_fixed_factor(clk); |
321 | |
322 | return 0; |
323 | diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c |
324 | index b5c46b3f8764..6d6475c32ee5 100644 |
325 | --- a/drivers/clk/clk-fixed-rate.c |
326 | +++ b/drivers/clk/clk-fixed-rate.c |
327 | @@ -200,6 +200,7 @@ static int of_fixed_clk_remove(struct platform_device *pdev) |
328 | { |
329 | struct clk *clk = platform_get_drvdata(pdev); |
330 | |
331 | + of_clk_del_provider(pdev->dev.of_node); |
332 | clk_unregister_fixed_rate(clk); |
333 | |
334 | return 0; |
335 | diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c |
336 | index 07fb667e258f..13c09a740840 100644 |
337 | --- a/drivers/clk/samsung/clk-exynos5420.c |
338 | +++ b/drivers/clk/samsung/clk-exynos5420.c |
339 | @@ -280,6 +280,7 @@ static const struct samsung_clk_reg_dump exynos5420_set_clksrc[] = { |
340 | { .offset = GATE_BUS_TOP, .value = 0xffffffff, }, |
341 | { .offset = GATE_BUS_DISP1, .value = 0xffffffff, }, |
342 | { .offset = GATE_IP_PERIC, .value = 0xffffffff, }, |
343 | + { .offset = GATE_IP_PERIS, .value = 0xffffffff, }, |
344 | }; |
345 | |
346 | static int exynos5420_clk_suspend(void) |
347 | diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c |
348 | index 83d2f43b5a2f..c93dcfedc219 100644 |
349 | --- a/drivers/gpu/drm/drm_edid.c |
350 | +++ b/drivers/gpu/drm/drm_edid.c |
351 | @@ -116,6 +116,9 @@ static const struct edid_quirk { |
352 | /* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */ |
353 | { "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC }, |
354 | |
355 | + /* BOE model 0x0771 reports 8 bpc, but is a 6 bpc panel */ |
356 | + { "BOE", 0x0771, EDID_QUIRK_FORCE_6BPC }, |
357 | + |
358 | /* Belinea 10 15 55 */ |
359 | { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 }, |
360 | { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 }, |
361 | diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c |
362 | index 7f8ff39ed44b..d02ee5304217 100644 |
363 | --- a/drivers/hid/uhid.c |
364 | +++ b/drivers/hid/uhid.c |
365 | @@ -12,6 +12,7 @@ |
366 | |
367 | #include <linux/atomic.h> |
368 | #include <linux/compat.h> |
369 | +#include <linux/cred.h> |
370 | #include <linux/device.h> |
371 | #include <linux/fs.h> |
372 | #include <linux/hid.h> |
373 | @@ -24,6 +25,7 @@ |
374 | #include <linux/spinlock.h> |
375 | #include <linux/uhid.h> |
376 | #include <linux/wait.h> |
377 | +#include <linux/uaccess.h> |
378 | |
379 | #define UHID_NAME "uhid" |
380 | #define UHID_BUFSIZE 32 |
381 | @@ -721,6 +723,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer, |
382 | |
383 | switch (uhid->input_buf.type) { |
384 | case UHID_CREATE: |
385 | + /* |
386 | + * 'struct uhid_create_req' contains a __user pointer which is |
387 | + * copied from, so it's unsafe to allow this with elevated |
388 | + * privileges (e.g. from a setuid binary) or via kernel_write(). |
389 | + */ |
390 | + if (file->f_cred != current_cred() || uaccess_kernel()) { |
391 | + pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n", |
392 | + task_tgid_vnr(current), current->comm); |
393 | + ret = -EACCES; |
394 | + goto unlock; |
395 | + } |
396 | ret = uhid_dev_create(uhid, &uhid->input_buf); |
397 | break; |
398 | case UHID_CREATE2: |
399 | diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c |
400 | index 6d2e6605751c..18b3c8f258bf 100644 |
401 | --- a/drivers/hwmon/ibmpowernv.c |
402 | +++ b/drivers/hwmon/ibmpowernv.c |
403 | @@ -114,7 +114,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr, |
404 | return sprintf(buf, "%s\n", sdata->label); |
405 | } |
406 | |
407 | -static int __init get_logical_cpu(int hwcpu) |
408 | +static int get_logical_cpu(int hwcpu) |
409 | { |
410 | int cpu; |
411 | |
412 | @@ -125,9 +125,8 @@ static int __init get_logical_cpu(int hwcpu) |
413 | return -ENOENT; |
414 | } |
415 | |
416 | -static void __init make_sensor_label(struct device_node *np, |
417 | - struct sensor_data *sdata, |
418 | - const char *label) |
419 | +static void make_sensor_label(struct device_node *np, |
420 | + struct sensor_data *sdata, const char *label) |
421 | { |
422 | u32 id; |
423 | size_t n; |
424 | diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c |
425 | index 567d86835f00..1fda2873375f 100644 |
426 | --- a/drivers/media/v4l2-core/v4l2-event.c |
427 | +++ b/drivers/media/v4l2-core/v4l2-event.c |
428 | @@ -197,6 +197,22 @@ int v4l2_event_pending(struct v4l2_fh *fh) |
429 | } |
430 | EXPORT_SYMBOL_GPL(v4l2_event_pending); |
431 | |
432 | +static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev) |
433 | +{ |
434 | + struct v4l2_fh *fh = sev->fh; |
435 | + unsigned int i; |
436 | + |
437 | + lockdep_assert_held(&fh->subscribe_lock); |
438 | + assert_spin_locked(&fh->vdev->fh_lock); |
439 | + |
440 | + /* Remove any pending events for this subscription */ |
441 | + for (i = 0; i < sev->in_use; i++) { |
442 | + list_del(&sev->events[sev_pos(sev, i)].list); |
443 | + fh->navailable--; |
444 | + } |
445 | + list_del(&sev->list); |
446 | +} |
447 | + |
448 | int v4l2_event_subscribe(struct v4l2_fh *fh, |
449 | const struct v4l2_event_subscription *sub, unsigned elems, |
450 | const struct v4l2_subscribed_event_ops *ops) |
451 | @@ -228,27 +244,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, |
452 | |
453 | spin_lock_irqsave(&fh->vdev->fh_lock, flags); |
454 | found_ev = v4l2_event_subscribed(fh, sub->type, sub->id); |
455 | + if (!found_ev) |
456 | + list_add(&sev->list, &fh->subscribed); |
457 | spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); |
458 | |
459 | if (found_ev) { |
460 | /* Already listening */ |
461 | kfree(sev); |
462 | - goto out_unlock; |
463 | - } |
464 | - |
465 | - if (sev->ops && sev->ops->add) { |
466 | + } else if (sev->ops && sev->ops->add) { |
467 | ret = sev->ops->add(sev, elems); |
468 | if (ret) { |
469 | + spin_lock_irqsave(&fh->vdev->fh_lock, flags); |
470 | + __v4l2_event_unsubscribe(sev); |
471 | + spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); |
472 | kfree(sev); |
473 | - goto out_unlock; |
474 | } |
475 | } |
476 | |
477 | - spin_lock_irqsave(&fh->vdev->fh_lock, flags); |
478 | - list_add(&sev->list, &fh->subscribed); |
479 | - spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); |
480 | - |
481 | -out_unlock: |
482 | mutex_unlock(&fh->subscribe_lock); |
483 | |
484 | return ret; |
485 | @@ -283,7 +295,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, |
486 | { |
487 | struct v4l2_subscribed_event *sev; |
488 | unsigned long flags; |
489 | - int i; |
490 | |
491 | if (sub->type == V4L2_EVENT_ALL) { |
492 | v4l2_event_unsubscribe_all(fh); |
493 | @@ -295,14 +306,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, |
494 | spin_lock_irqsave(&fh->vdev->fh_lock, flags); |
495 | |
496 | sev = v4l2_event_subscribed(fh, sub->type, sub->id); |
497 | - if (sev != NULL) { |
498 | - /* Remove any pending events for this subscription */ |
499 | - for (i = 0; i < sev->in_use; i++) { |
500 | - list_del(&sev->events[sev_pos(sev, i)].list); |
501 | - fh->navailable--; |
502 | - } |
503 | - list_del(&sev->list); |
504 | - } |
505 | + if (sev != NULL) |
506 | + __v4l2_event_unsubscribe(sev); |
507 | |
508 | spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); |
509 | |
510 | diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c |
511 | index f7ca1fab4808..4df4a1f402be 100644 |
512 | --- a/drivers/media/v4l2-core/videobuf2-core.c |
513 | +++ b/drivers/media/v4l2-core/videobuf2-core.c |
514 | @@ -914,12 +914,9 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state) |
515 | dprintk(4, "done processing on buffer %d, state: %d\n", |
516 | vb->index, state); |
517 | |
518 | - if (state != VB2_BUF_STATE_QUEUED && |
519 | - state != VB2_BUF_STATE_REQUEUEING) { |
520 | - /* sync buffers */ |
521 | - for (plane = 0; plane < vb->num_planes; ++plane) |
522 | - call_void_memop(vb, finish, vb->planes[plane].mem_priv); |
523 | - } |
524 | + /* sync buffers */ |
525 | + for (plane = 0; plane < vb->num_planes; ++plane) |
526 | + call_void_memop(vb, finish, vb->planes[plane].mem_priv); |
527 | |
528 | spin_lock_irqsave(&q->done_lock, flags); |
529 | if (state == VB2_BUF_STATE_QUEUED || |
530 | diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c |
531 | index 0516ecda54d3..3a6e4ec21c87 100644 |
532 | --- a/drivers/misc/atmel-ssc.c |
533 | +++ b/drivers/misc/atmel-ssc.c |
534 | @@ -130,7 +130,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = { |
535 | MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids); |
536 | #endif |
537 | |
538 | -static inline const struct atmel_ssc_platform_data * __init |
539 | +static inline const struct atmel_ssc_platform_data * |
540 | atmel_ssc_get_driver_data(struct platform_device *pdev) |
541 | { |
542 | if (pdev->dev.of_node) { |
543 | diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c |
544 | index 313da3150262..1540a7785e14 100644 |
545 | --- a/drivers/misc/sgi-gru/grukdump.c |
546 | +++ b/drivers/misc/sgi-gru/grukdump.c |
547 | @@ -27,6 +27,9 @@ |
548 | #include <linux/delay.h> |
549 | #include <linux/bitops.h> |
550 | #include <asm/uv/uv_hub.h> |
551 | + |
552 | +#include <linux/nospec.h> |
553 | + |
554 | #include "gru.h" |
555 | #include "grutables.h" |
556 | #include "gruhandles.h" |
557 | @@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg) |
558 | /* Currently, only dump by gid is implemented */ |
559 | if (req.gid >= gru_max_gids) |
560 | return -EINVAL; |
561 | + req.gid = array_index_nospec(req.gid, gru_max_gids); |
562 | |
563 | gru = GID_TO_GRU(req.gid); |
564 | ubuf = req.buf; |
565 | diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h |
566 | index b2c08e4d2a9b..bae7b7f9b1cf 100644 |
567 | --- a/drivers/net/ethernet/qlogic/qed/qed_sp.h |
568 | +++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h |
569 | @@ -132,6 +132,9 @@ struct qed_spq_entry { |
570 | enum spq_mode comp_mode; |
571 | struct qed_spq_comp_cb comp_cb; |
572 | struct qed_spq_comp_done comp_done; /* SPQ_MODE_EBLOCK */ |
573 | + |
574 | + /* Posted entry for unlimited list entry in EBLOCK mode */ |
575 | + struct qed_spq_entry *post_ent; |
576 | }; |
577 | |
578 | struct qed_eq { |
579 | diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c |
580 | index 2888eb0628f8..ac69ff3f7c5c 100644 |
581 | --- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c |
582 | +++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c |
583 | @@ -56,7 +56,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, |
584 | |
585 | case QED_SPQ_MODE_BLOCK: |
586 | if (!p_data->p_comp_data) |
587 | - return -EINVAL; |
588 | + goto err; |
589 | |
590 | p_ent->comp_cb.cookie = p_data->p_comp_data->cookie; |
591 | break; |
592 | @@ -71,7 +71,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, |
593 | default: |
594 | DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n", |
595 | p_ent->comp_mode); |
596 | - return -EINVAL; |
597 | + goto err; |
598 | } |
599 | |
600 | DP_VERBOSE(p_hwfn, QED_MSG_SPQ, |
601 | @@ -85,6 +85,18 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, |
602 | memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod)); |
603 | |
604 | return 0; |
605 | + |
606 | +err: |
607 | + /* qed_spq_get_entry() can either get an entry from the free_pool, |
608 | + * or, if no entries are left, allocate a new entry and add it to |
609 | + * the unlimited_pending list. |
610 | + */ |
611 | + if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending) |
612 | + kfree(p_ent); |
613 | + else |
614 | + qed_spq_return_entry(p_hwfn, p_ent); |
615 | + |
616 | + return -EINVAL; |
617 | } |
618 | |
619 | static enum tunnel_clss qed_tunn_get_clss_type(u8 type) |
620 | diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c |
621 | index 9fbaf9429fd0..80c8c7f0d932 100644 |
622 | --- a/drivers/net/ethernet/qlogic/qed/qed_spq.c |
623 | +++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c |
624 | @@ -595,6 +595,8 @@ static int qed_spq_add_entry(struct qed_hwfn *p_hwfn, |
625 | /* EBLOCK responsible to free the allocated p_ent */ |
626 | if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK) |
627 | kfree(p_ent); |
628 | + else |
629 | + p_ent->post_ent = p_en2; |
630 | |
631 | p_ent = p_en2; |
632 | } |
633 | @@ -678,6 +680,25 @@ static int qed_spq_pend_post(struct qed_hwfn *p_hwfn) |
634 | SPQ_HIGH_PRI_RESERVE_DEFAULT); |
635 | } |
636 | |
637 | +/* Avoid overriding of SPQ entries when getting out-of-order completions, by |
638 | + * marking the completions in a bitmap and increasing the chain consumer only |
639 | + * for the first successive completed entries. |
640 | + */ |
641 | +static void qed_spq_comp_bmap_update(struct qed_hwfn *p_hwfn, __le16 echo) |
642 | +{ |
643 | + u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE; |
644 | + struct qed_spq *p_spq = p_hwfn->p_spq; |
645 | + |
646 | + __set_bit(pos, p_spq->p_comp_bitmap); |
647 | + while (test_bit(p_spq->comp_bitmap_idx, |
648 | + p_spq->p_comp_bitmap)) { |
649 | + __clear_bit(p_spq->comp_bitmap_idx, |
650 | + p_spq->p_comp_bitmap); |
651 | + p_spq->comp_bitmap_idx++; |
652 | + qed_chain_return_produced(&p_spq->chain); |
653 | + } |
654 | +} |
655 | + |
656 | int qed_spq_post(struct qed_hwfn *p_hwfn, |
657 | struct qed_spq_entry *p_ent, u8 *fw_return_code) |
658 | { |
659 | @@ -728,11 +749,12 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, |
660 | rc = qed_spq_block(p_hwfn, p_ent, fw_return_code); |
661 | |
662 | if (p_ent->queue == &p_spq->unlimited_pending) { |
663 | - /* This is an allocated p_ent which does not need to |
664 | - * return to pool. |
665 | - */ |
666 | + struct qed_spq_entry *p_post_ent = p_ent->post_ent; |
667 | + |
668 | kfree(p_ent); |
669 | - return rc; |
670 | + |
671 | + /* Return the entry which was actually posted */ |
672 | + p_ent = p_post_ent; |
673 | } |
674 | |
675 | if (rc) |
676 | @@ -746,7 +768,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, |
677 | spq_post_fail2: |
678 | spin_lock_bh(&p_spq->lock); |
679 | list_del(&p_ent->list); |
680 | - qed_chain_return_produced(&p_spq->chain); |
681 | + qed_spq_comp_bmap_update(p_hwfn, p_ent->elem.hdr.echo); |
682 | |
683 | spq_post_fail: |
684 | /* return to the free pool */ |
685 | @@ -778,25 +800,8 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, |
686 | spin_lock_bh(&p_spq->lock); |
687 | list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending, list) { |
688 | if (p_ent->elem.hdr.echo == echo) { |
689 | - u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE; |
690 | - |
691 | list_del(&p_ent->list); |
692 | - |
693 | - /* Avoid overriding of SPQ entries when getting |
694 | - * out-of-order completions, by marking the completions |
695 | - * in a bitmap and increasing the chain consumer only |
696 | - * for the first successive completed entries. |
697 | - */ |
698 | - __set_bit(pos, p_spq->p_comp_bitmap); |
699 | - |
700 | - while (test_bit(p_spq->comp_bitmap_idx, |
701 | - p_spq->p_comp_bitmap)) { |
702 | - __clear_bit(p_spq->comp_bitmap_idx, |
703 | - p_spq->p_comp_bitmap); |
704 | - p_spq->comp_bitmap_idx++; |
705 | - qed_chain_return_produced(&p_spq->chain); |
706 | - } |
707 | - |
708 | + qed_spq_comp_bmap_update(p_hwfn, echo); |
709 | p_spq->comp_count++; |
710 | found = p_ent; |
711 | break; |
712 | @@ -835,11 +840,9 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, |
713 | QED_MSG_SPQ, |
714 | "Got a completion without a callback function\n"); |
715 | |
716 | - if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) || |
717 | - (found->queue == &p_spq->unlimited_pending)) |
718 | + if (found->comp_mode != QED_SPQ_MODE_EBLOCK) |
719 | /* EBLOCK is responsible for returning its own entry into the |
720 | - * free list, unless it originally added the entry into the |
721 | - * unlimited pending list. |
722 | + * free list. |
723 | */ |
724 | qed_spq_return_entry(p_hwfn, found); |
725 | |
726 | diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c |
727 | index 2acdb0d6ea89..a0533e4e52d7 100644 |
728 | --- a/drivers/platform/x86/acerhdf.c |
729 | +++ b/drivers/platform/x86/acerhdf.c |
730 | @@ -233,6 +233,7 @@ static const struct bios_settings bios_tbl[] = { |
731 | {"Gateway", "LT31", "v1.3201", 0x55, 0x58, {0x9e, 0x00}, 0}, |
732 | {"Gateway", "LT31", "v1.3302", 0x55, 0x58, {0x9e, 0x00}, 0}, |
733 | {"Gateway", "LT31", "v1.3303t", 0x55, 0x58, {0x9e, 0x00}, 0}, |
734 | + {"Gateway", "LT31", "v1.3307", 0x55, 0x58, {0x9e, 0x00}, 0}, |
735 | /* Packard Bell */ |
736 | {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00}, 0}, |
737 | {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00}, 0}, |
738 | diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c |
739 | index ef29f18b1951..4069433a0ec6 100644 |
740 | --- a/drivers/platform/x86/intel_telemetry_debugfs.c |
741 | +++ b/drivers/platform/x86/intel_telemetry_debugfs.c |
742 | @@ -953,12 +953,16 @@ static int __init telemetry_debugfs_init(void) |
743 | debugfs_conf = (struct telemetry_debugfs_conf *)id->driver_data; |
744 | |
745 | err = telemetry_pltconfig_valid(); |
746 | - if (err < 0) |
747 | + if (err < 0) { |
748 | + pr_info("Invalid pltconfig, ensure IPC1 device is enabled in BIOS\n"); |
749 | return -ENODEV; |
750 | + } |
751 | |
752 | err = telemetry_debugfs_check_evts(); |
753 | - if (err < 0) |
754 | + if (err < 0) { |
755 | + pr_info("telemetry_debugfs_check_evts failed\n"); |
756 | return -EINVAL; |
757 | + } |
758 | |
759 | |
760 | #ifdef CONFIG_PM_SLEEP |
761 | diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c |
762 | index efefe075557f..6e6ba1baf9c4 100644 |
763 | --- a/drivers/s390/net/qeth_l3_main.c |
764 | +++ b/drivers/s390/net/qeth_l3_main.c |
765 | @@ -363,9 +363,6 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover) |
766 | |
767 | QETH_CARD_TEXT(card, 4, "clearip"); |
768 | |
769 | - if (recover && card->options.sniffer) |
770 | - return; |
771 | - |
772 | spin_lock_bh(&card->ip_lock); |
773 | |
774 | hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) { |
775 | @@ -823,6 +820,8 @@ static int qeth_l3_register_addr_entry(struct qeth_card *card, |
776 | int rc = 0; |
777 | int cnt = 3; |
778 | |
779 | + if (card->options.sniffer) |
780 | + return 0; |
781 | |
782 | if (addr->proto == QETH_PROT_IPV4) { |
783 | QETH_CARD_TEXT(card, 2, "setaddr4"); |
784 | @@ -858,6 +857,9 @@ static int qeth_l3_deregister_addr_entry(struct qeth_card *card, |
785 | { |
786 | int rc = 0; |
787 | |
788 | + if (card->options.sniffer) |
789 | + return 0; |
790 | + |
791 | if (addr->proto == QETH_PROT_IPV4) { |
792 | QETH_CARD_TEXT(card, 2, "deladdr4"); |
793 | QETH_CARD_HEX(card, 3, &addr->u.a4.addr, sizeof(int)); |
794 | diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c |
795 | index cfbfef08c94a..e6b20716e8e0 100644 |
796 | --- a/drivers/uio/uio.c |
797 | +++ b/drivers/uio/uio.c |
798 | @@ -850,6 +850,8 @@ int __uio_register_device(struct module *owner, |
799 | if (ret) |
800 | goto err_uio_dev_add_attributes; |
801 | |
802 | + info->uio_dev = idev; |
803 | + |
804 | if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { |
805 | /* |
806 | * Note that we deliberately don't use devm_request_irq |
807 | @@ -861,11 +863,12 @@ int __uio_register_device(struct module *owner, |
808 | */ |
809 | ret = request_irq(info->irq, uio_interrupt, |
810 | info->irq_flags, info->name, idev); |
811 | - if (ret) |
812 | + if (ret) { |
813 | + info->uio_dev = NULL; |
814 | goto err_request_irq; |
815 | + } |
816 | } |
817 | |
818 | - info->uio_dev = idev; |
819 | return 0; |
820 | |
821 | err_request_irq: |
822 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
823 | index dbe44e890c99..cd4f96354fa8 100644 |
824 | --- a/drivers/usb/class/cdc-acm.c |
825 | +++ b/drivers/usb/class/cdc-acm.c |
826 | @@ -1659,6 +1659,9 @@ static const struct usb_device_id acm_ids[] = { |
827 | { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ |
828 | .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ |
829 | }, |
830 | + { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */ |
831 | + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ |
832 | + }, |
833 | { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ |
834 | .driver_info = QUIRK_CONTROL_LINE_STATE, }, |
835 | { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ |
836 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c |
837 | index 37a5e07b3488..1e8f68960014 100644 |
838 | --- a/drivers/usb/core/quirks.c |
839 | +++ b/drivers/usb/core/quirks.c |
840 | @@ -243,6 +243,9 @@ static const struct usb_device_id usb_quirk_list[] = { |
841 | { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | |
842 | USB_QUIRK_DELAY_CTRL_MSG }, |
843 | |
844 | + /* Corsair K70 LUX RGB */ |
845 | + { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT }, |
846 | + |
847 | /* Corsair K70 LUX */ |
848 | { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, |
849 | |
850 | @@ -263,6 +266,11 @@ static const struct usb_device_id usb_quirk_list[] = { |
851 | { USB_DEVICE(0x2040, 0x7200), .driver_info = |
852 | USB_QUIRK_CONFIG_INTF_STRINGS }, |
853 | |
854 | + /* Raydium Touchscreen */ |
855 | + { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM }, |
856 | + |
857 | + { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, |
858 | + |
859 | /* DJI CineSSD */ |
860 | { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, |
861 | |
862 | diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c |
863 | index da5ff401a354..2d3c656e0bff 100644 |
864 | --- a/drivers/usb/misc/appledisplay.c |
865 | +++ b/drivers/usb/misc/appledisplay.c |
866 | @@ -63,6 +63,7 @@ static const struct usb_device_id appledisplay_table[] = { |
867 | { APPLEDISPLAY_DEVICE(0x9219) }, |
868 | { APPLEDISPLAY_DEVICE(0x921c) }, |
869 | { APPLEDISPLAY_DEVICE(0x921d) }, |
870 | + { APPLEDISPLAY_DEVICE(0x9222) }, |
871 | { APPLEDISPLAY_DEVICE(0x9236) }, |
872 | |
873 | /* Terminating entry */ |
874 | diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c |
875 | index 18d05323ca53..57d375c68e46 100644 |
876 | --- a/fs/btrfs/disk-io.c |
877 | +++ b/fs/btrfs/disk-io.c |
878 | @@ -4491,6 +4491,7 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root, |
879 | static int btrfs_destroy_pinned_extent(struct btrfs_root *root, |
880 | struct extent_io_tree *pinned_extents) |
881 | { |
882 | + struct btrfs_fs_info *fs_info = root->fs_info; |
883 | struct extent_io_tree *unpin; |
884 | u64 start; |
885 | u64 end; |
886 | @@ -4500,21 +4501,31 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root, |
887 | unpin = pinned_extents; |
888 | again: |
889 | while (1) { |
890 | + /* |
891 | + * The btrfs_finish_extent_commit() may get the same range as |
892 | + * ours between find_first_extent_bit and clear_extent_dirty. |
893 | + * Hence, hold the unused_bg_unpin_mutex to avoid double unpin |
894 | + * the same extent range. |
895 | + */ |
896 | + mutex_lock(&fs_info->unused_bg_unpin_mutex); |
897 | ret = find_first_extent_bit(unpin, 0, &start, &end, |
898 | EXTENT_DIRTY, NULL); |
899 | - if (ret) |
900 | + if (ret) { |
901 | + mutex_unlock(&fs_info->unused_bg_unpin_mutex); |
902 | break; |
903 | + } |
904 | |
905 | clear_extent_dirty(unpin, start, end); |
906 | btrfs_error_unpin_extent_range(root, start, end); |
907 | + mutex_unlock(&fs_info->unused_bg_unpin_mutex); |
908 | cond_resched(); |
909 | } |
910 | |
911 | if (loop) { |
912 | - if (unpin == &root->fs_info->freed_extents[0]) |
913 | - unpin = &root->fs_info->freed_extents[1]; |
914 | + if (unpin == &fs_info->freed_extents[0]) |
915 | + unpin = &fs_info->freed_extents[1]; |
916 | else |
917 | - unpin = &root->fs_info->freed_extents[0]; |
918 | + unpin = &fs_info->freed_extents[0]; |
919 | loop = false; |
920 | goto again; |
921 | } |
922 | diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c |
923 | index 163b61a92b59..a775307f3b6b 100644 |
924 | --- a/fs/btrfs/extent-tree.c |
925 | +++ b/fs/btrfs/extent-tree.c |
926 | @@ -11140,6 +11140,15 @@ static int btrfs_trim_free_extents(struct btrfs_device *device, |
927 | return ret; |
928 | } |
929 | |
930 | +/* |
931 | + * Trim the whole filesystem by: |
932 | + * 1) trimming the free space in each block group |
933 | + * 2) trimming the unallocated space on each device |
934 | + * |
935 | + * This will also continue trimming even if a block group or device encounters |
936 | + * an error. The return value will be the last error, or 0 if nothing bad |
937 | + * happens. |
938 | + */ |
939 | int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) |
940 | { |
941 | struct btrfs_fs_info *fs_info = root->fs_info; |
942 | @@ -11150,18 +11159,14 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) |
943 | u64 start; |
944 | u64 end; |
945 | u64 trimmed = 0; |
946 | - u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy); |
947 | + u64 bg_failed = 0; |
948 | + u64 dev_failed = 0; |
949 | + int bg_ret = 0; |
950 | + int dev_ret = 0; |
951 | int ret = 0; |
952 | |
953 | - /* |
954 | - * try to trim all FS space, our block group may start from non-zero. |
955 | - */ |
956 | - if (range->len == total_bytes) |
957 | - cache = btrfs_lookup_first_block_group(fs_info, range->start); |
958 | - else |
959 | - cache = btrfs_lookup_block_group(fs_info, range->start); |
960 | - |
961 | - while (cache) { |
962 | + cache = btrfs_lookup_first_block_group(fs_info, range->start); |
963 | + for (; cache; cache = next_block_group(fs_info->tree_root, cache)) { |
964 | if (cache->key.objectid >= (range->start + range->len)) { |
965 | btrfs_put_block_group(cache); |
966 | break; |
967 | @@ -11175,13 +11180,15 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) |
968 | if (!block_group_cache_done(cache)) { |
969 | ret = cache_block_group(cache, 0); |
970 | if (ret) { |
971 | - btrfs_put_block_group(cache); |
972 | - break; |
973 | + bg_failed++; |
974 | + bg_ret = ret; |
975 | + continue; |
976 | } |
977 | ret = wait_block_group_cache_done(cache); |
978 | if (ret) { |
979 | - btrfs_put_block_group(cache); |
980 | - break; |
981 | + bg_failed++; |
982 | + bg_ret = ret; |
983 | + continue; |
984 | } |
985 | } |
986 | ret = btrfs_trim_block_group(cache, |
987 | @@ -11192,28 +11199,40 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) |
988 | |
989 | trimmed += group_trimmed; |
990 | if (ret) { |
991 | - btrfs_put_block_group(cache); |
992 | - break; |
993 | + bg_failed++; |
994 | + bg_ret = ret; |
995 | + continue; |
996 | } |
997 | } |
998 | - |
999 | - cache = next_block_group(fs_info->tree_root, cache); |
1000 | } |
1001 | |
1002 | - mutex_lock(&root->fs_info->fs_devices->device_list_mutex); |
1003 | - devices = &root->fs_info->fs_devices->devices; |
1004 | + if (bg_failed) |
1005 | + btrfs_warn(fs_info, |
1006 | + "failed to trim %llu block group(s), last error %d", |
1007 | + bg_failed, bg_ret); |
1008 | + mutex_lock(&fs_info->fs_devices->device_list_mutex); |
1009 | + devices = &fs_info->fs_devices->devices; |
1010 | list_for_each_entry(device, devices, dev_list) { |
1011 | ret = btrfs_trim_free_extents(device, range->minlen, |
1012 | &group_trimmed); |
1013 | - if (ret) |
1014 | + if (ret) { |
1015 | + dev_failed++; |
1016 | + dev_ret = ret; |
1017 | break; |
1018 | + } |
1019 | |
1020 | trimmed += group_trimmed; |
1021 | } |
1022 | mutex_unlock(&root->fs_info->fs_devices->device_list_mutex); |
1023 | |
1024 | + if (dev_failed) |
1025 | + btrfs_warn(fs_info, |
1026 | + "failed to trim %llu device(s), last error %d", |
1027 | + dev_failed, dev_ret); |
1028 | range->len = trimmed; |
1029 | - return ret; |
1030 | + if (bg_ret) |
1031 | + return bg_ret; |
1032 | + return dev_ret; |
1033 | } |
1034 | |
1035 | /* |
1036 | diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c |
1037 | index 96ad2778405b..242584a0d3b5 100644 |
1038 | --- a/fs/btrfs/ioctl.c |
1039 | +++ b/fs/btrfs/ioctl.c |
1040 | @@ -380,7 +380,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) |
1041 | struct fstrim_range range; |
1042 | u64 minlen = ULLONG_MAX; |
1043 | u64 num_devices = 0; |
1044 | - u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy); |
1045 | int ret; |
1046 | |
1047 | if (!capable(CAP_SYS_ADMIN)) |
1048 | @@ -404,11 +403,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) |
1049 | return -EOPNOTSUPP; |
1050 | if (copy_from_user(&range, arg, sizeof(range))) |
1051 | return -EFAULT; |
1052 | - if (range.start > total_bytes || |
1053 | - range.len < fs_info->sb->s_blocksize) |
1054 | + |
1055 | + /* |
1056 | + * NOTE: Don't truncate the range using super->total_bytes. Bytenr of |
1057 | + * block group is in the logical address space, which can be any |
1058 | + * sectorsize aligned bytenr in the range [0, U64_MAX]. |
1059 | + */ |
1060 | + if (range.len < fs_info->sb->s_blocksize) |
1061 | return -EINVAL; |
1062 | |
1063 | - range.len = min(range.len, total_bytes - range.start); |
1064 | range.minlen = max(range.minlen, minlen); |
1065 | ret = btrfs_trim_fs(fs_info->tree_root, &range); |
1066 | if (ret < 0) |
1067 | diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c |
1068 | index 87658f63b374..be84d49f2406 100644 |
1069 | --- a/fs/cifs/cifsfs.c |
1070 | +++ b/fs/cifs/cifsfs.c |
1071 | @@ -927,8 +927,8 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off, |
1072 | struct inode *src_inode = file_inode(src_file); |
1073 | struct inode *target_inode = file_inode(dst_file); |
1074 | struct cifsFileInfo *smb_file_src = src_file->private_data; |
1075 | - struct cifsFileInfo *smb_file_target = dst_file->private_data; |
1076 | - struct cifs_tcon *target_tcon = tlink_tcon(smb_file_target->tlink); |
1077 | + struct cifsFileInfo *smb_file_target; |
1078 | + struct cifs_tcon *target_tcon; |
1079 | unsigned int xid; |
1080 | int rc; |
1081 | |
1082 | @@ -942,6 +942,9 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off, |
1083 | goto out; |
1084 | } |
1085 | |
1086 | + smb_file_target = dst_file->private_data; |
1087 | + target_tcon = tlink_tcon(smb_file_target->tlink); |
1088 | + |
1089 | /* |
1090 | * Note: cifs case is easier than btrfs since server responsible for |
1091 | * checks for proper open modes and file type and if it wants |
1092 | diff --git a/fs/exofs/super.c b/fs/exofs/super.c |
1093 | index 1076a4233b39..0c48138486dc 100644 |
1094 | --- a/fs/exofs/super.c |
1095 | +++ b/fs/exofs/super.c |
1096 | @@ -100,6 +100,7 @@ static int parse_options(char *options, struct exofs_mountopt *opts) |
1097 | token = match_token(p, tokens, args); |
1098 | switch (token) { |
1099 | case Opt_name: |
1100 | + kfree(opts->dev_name); |
1101 | opts->dev_name = match_strdup(&args[0]); |
1102 | if (unlikely(!opts->dev_name)) { |
1103 | EXOFS_ERR("Error allocating dev_name"); |
1104 | @@ -868,8 +869,10 @@ static struct dentry *exofs_mount(struct file_system_type *type, |
1105 | int ret; |
1106 | |
1107 | ret = parse_options(data, &opts); |
1108 | - if (ret) |
1109 | + if (ret) { |
1110 | + kfree(opts.dev_name); |
1111 | return ERR_PTR(ret); |
1112 | + } |
1113 | |
1114 | if (!opts.dev_name) |
1115 | opts.dev_name = dev_name; |
1116 | diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c |
1117 | index 832824994aae..073126707270 100644 |
1118 | --- a/fs/gfs2/rgrp.c |
1119 | +++ b/fs/gfs2/rgrp.c |
1120 | @@ -715,6 +715,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) |
1121 | spin_lock(&gl->gl_lockref.lock); |
1122 | gl->gl_object = NULL; |
1123 | spin_unlock(&gl->gl_lockref.lock); |
1124 | + gfs2_rgrp_brelse(rgd); |
1125 | gfs2_glock_add_to_lru(gl); |
1126 | gfs2_glock_put(gl); |
1127 | } |
1128 | @@ -1125,7 +1126,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd) |
1129 | * @rgd: the struct gfs2_rgrpd describing the RG to read in |
1130 | * |
1131 | * Read in all of a Resource Group's header and bitmap blocks. |
1132 | - * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps. |
1133 | + * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps. |
1134 | * |
1135 | * Returns: errno |
1136 | */ |
1137 | diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c |
1138 | index 2a6f3c67cb3f..2e713673df42 100644 |
1139 | --- a/fs/hfs/brec.c |
1140 | +++ b/fs/hfs/brec.c |
1141 | @@ -424,6 +424,10 @@ skip: |
1142 | if (new_node) { |
1143 | __be32 cnid; |
1144 | |
1145 | + if (!new_node->parent) { |
1146 | + hfs_btree_inc_height(tree); |
1147 | + new_node->parent = tree->root; |
1148 | + } |
1149 | fd->bnode = hfs_bnode_find(tree, new_node->parent); |
1150 | /* create index key and entry */ |
1151 | hfs_bnode_read_key(new_node, fd->search_key, 14); |
1152 | diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c |
1153 | index 754fdf8c6356..1002a0c08319 100644 |
1154 | --- a/fs/hfsplus/brec.c |
1155 | +++ b/fs/hfsplus/brec.c |
1156 | @@ -427,6 +427,10 @@ skip: |
1157 | if (new_node) { |
1158 | __be32 cnid; |
1159 | |
1160 | + if (!new_node->parent) { |
1161 | + hfs_btree_inc_height(tree); |
1162 | + new_node->parent = tree->root; |
1163 | + } |
1164 | fd->bnode = hfs_bnode_find(tree, new_node->parent); |
1165 | /* create index key and entry */ |
1166 | hfs_bnode_read_key(new_node, fd->search_key, 14); |
1167 | diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c |
1168 | index 06a9fae202a7..9e313fc7fdc7 100644 |
1169 | --- a/fs/reiserfs/xattr.c |
1170 | +++ b/fs/reiserfs/xattr.c |
1171 | @@ -184,6 +184,7 @@ struct reiserfs_dentry_buf { |
1172 | struct dir_context ctx; |
1173 | struct dentry *xadir; |
1174 | int count; |
1175 | + int err; |
1176 | struct dentry *dentries[8]; |
1177 | }; |
1178 | |
1179 | @@ -206,6 +207,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, |
1180 | |
1181 | dentry = lookup_one_len(name, dbuf->xadir, namelen); |
1182 | if (IS_ERR(dentry)) { |
1183 | + dbuf->err = PTR_ERR(dentry); |
1184 | return PTR_ERR(dentry); |
1185 | } else if (d_really_is_negative(dentry)) { |
1186 | /* A directory entry exists, but no file? */ |
1187 | @@ -214,6 +216,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, |
1188 | "not found for file %pd.\n", |
1189 | dentry, dbuf->xadir); |
1190 | dput(dentry); |
1191 | + dbuf->err = -EIO; |
1192 | return -EIO; |
1193 | } |
1194 | |
1195 | @@ -261,6 +264,10 @@ static int reiserfs_for_each_xattr(struct inode *inode, |
1196 | err = reiserfs_readdir_inode(d_inode(dir), &buf.ctx); |
1197 | if (err) |
1198 | break; |
1199 | + if (buf.err) { |
1200 | + err = buf.err; |
1201 | + break; |
1202 | + } |
1203 | if (!buf.count) |
1204 | break; |
1205 | for (i = 0; !err && i < buf.count && buf.dentries[i]; i++) { |
1206 | diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h |
1207 | index 8d0248525957..9f34204978e4 100644 |
1208 | --- a/include/linux/netfilter/ipset/ip_set_comment.h |
1209 | +++ b/include/linux/netfilter/ipset/ip_set_comment.h |
1210 | @@ -41,11 +41,11 @@ ip_set_init_comment(struct ip_set_comment *comment, |
1211 | rcu_assign_pointer(comment->c, c); |
1212 | } |
1213 | |
1214 | -/* Used only when dumping a set, protected by rcu_read_lock_bh() */ |
1215 | +/* Used only when dumping a set, protected by rcu_read_lock() */ |
1216 | static inline int |
1217 | ip_set_put_comment(struct sk_buff *skb, struct ip_set_comment *comment) |
1218 | { |
1219 | - struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c); |
1220 | + struct ip_set_comment_rcu *c = rcu_dereference(comment->c); |
1221 | |
1222 | if (!c) |
1223 | return 0; |
1224 | diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h |
1225 | index f30c187ed785..9442423979c1 100644 |
1226 | --- a/include/linux/uaccess.h |
1227 | +++ b/include/linux/uaccess.h |
1228 | @@ -2,6 +2,9 @@ |
1229 | #define __LINUX_UACCESS_H__ |
1230 | |
1231 | #include <linux/sched.h> |
1232 | + |
1233 | +#define uaccess_kernel() segment_eq(get_fs(), KERNEL_DS) |
1234 | + |
1235 | #include <asm/uaccess.h> |
1236 | |
1237 | static __always_inline void pagefault_disabled_inc(void) |
1238 | diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile |
1239 | index 2c7b60edea04..1faeef0c30b9 100644 |
1240 | --- a/lib/raid6/test/Makefile |
1241 | +++ b/lib/raid6/test/Makefile |
1242 | @@ -26,7 +26,7 @@ ifeq ($(ARCH),arm) |
1243 | CFLAGS += -I../../../arch/arm/include -mfpu=neon |
1244 | HAS_NEON = yes |
1245 | endif |
1246 | -ifeq ($(ARCH),arm64) |
1247 | +ifeq ($(ARCH),aarch64) |
1248 | CFLAGS += -I../../../arch/arm64/include |
1249 | HAS_NEON = yes |
1250 | endif |
1251 | @@ -40,7 +40,7 @@ ifeq ($(IS_X86),yes) |
1252 | gcc -c -x assembler - >&/dev/null && \ |
1253 | rm ./-.o && echo -DCONFIG_AS_AVX512=1) |
1254 | else ifeq ($(HAS_NEON),yes) |
1255 | - OBJS += neon.o neon1.o neon2.o neon4.o neon8.o |
1256 | + OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o |
1257 | CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 |
1258 | else |
1259 | HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\ |
1260 | diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c |
1261 | index 98ea28dc03f9..68acf94fae72 100644 |
1262 | --- a/net/ceph/messenger.c |
1263 | +++ b/net/ceph/messenger.c |
1264 | @@ -588,9 +588,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page, |
1265 | int ret; |
1266 | struct kvec iov; |
1267 | |
1268 | - /* sendpage cannot properly handle pages with page_count == 0, |
1269 | - * we need to fallback to sendmsg if that's the case */ |
1270 | - if (page_count(page) >= 1) |
1271 | + /* |
1272 | + * sendpage cannot properly handle pages with page_count == 0, |
1273 | + * we need to fall back to sendmsg if that's the case. |
1274 | + * |
1275 | + * Same goes for slab pages: skb_can_coalesce() allows |
1276 | + * coalescing neighboring slab objects into a single frag which |
1277 | + * triggers one of hardened usercopy checks. |
1278 | + */ |
1279 | + if (page_count(page) >= 1 && !PageSlab(page)) |
1280 | return __ceph_tcp_sendpage(sock, page, offset, size, more); |
1281 | |
1282 | iov.iov_base = kmap(page) + offset; |
1283 | diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c |
1284 | index 9a14c237830f..b259a5814965 100644 |
1285 | --- a/net/netfilter/ipset/ip_set_hash_netportnet.c |
1286 | +++ b/net/netfilter/ipset/ip_set_hash_netportnet.c |
1287 | @@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], |
1288 | |
1289 | if (tb[IPSET_ATTR_CIDR]) { |
1290 | e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); |
1291 | - if (!e.cidr[0] || e.cidr[0] > HOST_MASK) |
1292 | + if (e.cidr[0] > HOST_MASK) |
1293 | return -IPSET_ERR_INVALID_CIDR; |
1294 | } |
1295 | |
1296 | if (tb[IPSET_ATTR_CIDR2]) { |
1297 | e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); |
1298 | - if (!e.cidr[1] || e.cidr[1] > HOST_MASK) |
1299 | + if (e.cidr[1] > HOST_MASK) |
1300 | return -IPSET_ERR_INVALID_CIDR; |
1301 | } |
1302 | |
1303 | @@ -492,13 +492,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], |
1304 | |
1305 | if (tb[IPSET_ATTR_CIDR]) { |
1306 | e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); |
1307 | - if (!e.cidr[0] || e.cidr[0] > HOST_MASK) |
1308 | + if (e.cidr[0] > HOST_MASK) |
1309 | return -IPSET_ERR_INVALID_CIDR; |
1310 | } |
1311 | |
1312 | if (tb[IPSET_ATTR_CIDR2]) { |
1313 | e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); |
1314 | - if (!e.cidr[1] || e.cidr[1] > HOST_MASK) |
1315 | + if (e.cidr[1] > HOST_MASK) |
1316 | return -IPSET_ERR_INVALID_CIDR; |
1317 | } |
1318 | |
1319 | diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c |
1320 | index bb5d6a058fb7..921c9bd7e1e7 100644 |
1321 | --- a/net/netfilter/xt_IDLETIMER.c |
1322 | +++ b/net/netfilter/xt_IDLETIMER.c |
1323 | @@ -116,6 +116,22 @@ static void idletimer_tg_expired(unsigned long data) |
1324 | schedule_work(&timer->work); |
1325 | } |
1326 | |
1327 | +static int idletimer_check_sysfs_name(const char *name, unsigned int size) |
1328 | +{ |
1329 | + int ret; |
1330 | + |
1331 | + ret = xt_check_proc_name(name, size); |
1332 | + if (ret < 0) |
1333 | + return ret; |
1334 | + |
1335 | + if (!strcmp(name, "power") || |
1336 | + !strcmp(name, "subsystem") || |
1337 | + !strcmp(name, "uevent")) |
1338 | + return -EINVAL; |
1339 | + |
1340 | + return 0; |
1341 | +} |
1342 | + |
1343 | static int idletimer_tg_create(struct idletimer_tg_info *info) |
1344 | { |
1345 | int ret; |
1346 | @@ -126,6 +142,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) |
1347 | goto out; |
1348 | } |
1349 | |
1350 | + ret = idletimer_check_sysfs_name(info->label, sizeof(info->label)); |
1351 | + if (ret < 0) |
1352 | + goto out_free_timer; |
1353 | + |
1354 | sysfs_attr_init(&info->timer->attr.attr); |
1355 | info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL); |
1356 | if (!info->timer->attr.attr.name) { |
1357 | diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c |
1358 | index 1b38fc486351..69846c6574ef 100644 |
1359 | --- a/net/sunrpc/xdr.c |
1360 | +++ b/net/sunrpc/xdr.c |
1361 | @@ -512,7 +512,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode); |
1362 | static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr, |
1363 | size_t nbytes) |
1364 | { |
1365 | - static __be32 *p; |
1366 | + __be32 *p; |
1367 | int space_left; |
1368 | int frag1bytes, frag2bytes; |
1369 |