Contents of /trunk/kernel-alx/patches-4.9/0247-4.9.148-all-fixes.patch
Parent Directory | Revision Log
Revision 3300 -
(show annotations)
(download)
Tue Mar 12 10:43:08 2019 UTC (5 years, 6 months ago) by niro
File size: 21178 byte(s)
Tue Mar 12 10:43:08 2019 UTC (5 years, 6 months ago) by niro
File size: 21178 byte(s)
-linux-4.9.148
1 | diff --git a/Makefile b/Makefile |
2 | index 3cccc51a57ce..1b71b11ea63e 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 147 |
9 | +SUBLEVEL = 148 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c |
14 | index 6d9b45549109..d5b2a08e2b66 100644 |
15 | --- a/arch/x86/kernel/cpu/mtrr/if.c |
16 | +++ b/arch/x86/kernel/cpu/mtrr/if.c |
17 | @@ -172,6 +172,8 @@ mtrr_ioctl(struct file *file, unsigned int cmd, unsigned long __arg) |
18 | struct mtrr_gentry gentry; |
19 | void __user *arg = (void __user *) __arg; |
20 | |
21 | + memset(&gentry, 0, sizeof(gentry)); |
22 | + |
23 | switch (cmd) { |
24 | case MTRRIOC_ADD_ENTRY: |
25 | case MTRRIOC_SET_ENTRY: |
26 | diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c |
27 | index ae52ef05d098..769831d9fd11 100644 |
28 | --- a/arch/x86/kernel/fpu/signal.c |
29 | +++ b/arch/x86/kernel/fpu/signal.c |
30 | @@ -342,10 +342,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) |
31 | sanitize_restored_xstate(tsk, &env, xfeatures, fx_only); |
32 | } |
33 | |
34 | + local_bh_disable(); |
35 | fpu->fpstate_active = 1; |
36 | - preempt_disable(); |
37 | fpu__restore(fpu); |
38 | - preempt_enable(); |
39 | + local_bh_enable(); |
40 | |
41 | return err; |
42 | } else { |
43 | diff --git a/block/blk-lib.c b/block/blk-lib.c |
44 | index 46fe9248410d..af1d26f79878 100644 |
45 | --- a/block/blk-lib.c |
46 | +++ b/block/blk-lib.c |
47 | @@ -63,10 +63,18 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, |
48 | unsigned int req_sects; |
49 | sector_t end_sect, tmp; |
50 | |
51 | - /* Make sure bi_size doesn't overflow */ |
52 | - req_sects = min_t(sector_t, nr_sects, UINT_MAX >> 9); |
53 | + /* |
54 | + * Issue in chunks of the user defined max discard setting, |
55 | + * ensuring that bi_size doesn't overflow |
56 | + */ |
57 | + req_sects = min_t(sector_t, nr_sects, |
58 | + q->limits.max_discard_sectors); |
59 | + if (!req_sects) |
60 | + goto fail; |
61 | + if (req_sects > UINT_MAX >> 9) |
62 | + req_sects = UINT_MAX >> 9; |
63 | |
64 | - /** |
65 | + /* |
66 | * If splitting a request, and the next starting sector would be |
67 | * misaligned, stop the discard at the previous aligned sector. |
68 | */ |
69 | @@ -100,6 +108,14 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, |
70 | |
71 | *biop = bio; |
72 | return 0; |
73 | + |
74 | +fail: |
75 | + if (bio) { |
76 | + submit_bio_wait(bio); |
77 | + bio_put(bio); |
78 | + } |
79 | + *biop = NULL; |
80 | + return -EOPNOTSUPP; |
81 | } |
82 | EXPORT_SYMBOL(__blkdev_issue_discard); |
83 | |
84 | diff --git a/drivers/gpio/gpio-max7301.c b/drivers/gpio/gpio-max7301.c |
85 | index 05813fbf3daf..647dfbbc4e1c 100644 |
86 | --- a/drivers/gpio/gpio-max7301.c |
87 | +++ b/drivers/gpio/gpio-max7301.c |
88 | @@ -25,7 +25,7 @@ static int max7301_spi_write(struct device *dev, unsigned int reg, |
89 | struct spi_device *spi = to_spi_device(dev); |
90 | u16 word = ((reg & 0x7F) << 8) | (val & 0xFF); |
91 | |
92 | - return spi_write(spi, (const u8 *)&word, sizeof(word)); |
93 | + return spi_write_then_read(spi, &word, sizeof(word), NULL, 0); |
94 | } |
95 | |
96 | /* A read from the MAX7301 means two transfers; here, one message each */ |
97 | @@ -37,14 +37,8 @@ static int max7301_spi_read(struct device *dev, unsigned int reg) |
98 | struct spi_device *spi = to_spi_device(dev); |
99 | |
100 | word = 0x8000 | (reg << 8); |
101 | - ret = spi_write(spi, (const u8 *)&word, sizeof(word)); |
102 | - if (ret) |
103 | - return ret; |
104 | - /* |
105 | - * This relies on the fact, that a transfer with NULL tx_buf shifts out |
106 | - * zero bytes (=NOOP for MAX7301) |
107 | - */ |
108 | - ret = spi_read(spi, (u8 *)&word, sizeof(word)); |
109 | + ret = spi_write_then_read(spi, &word, sizeof(word), &word, |
110 | + sizeof(word)); |
111 | if (ret) |
112 | return ret; |
113 | return word & 0xff; |
114 | diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c |
115 | index 71c3473476c7..04b26ca06180 100644 |
116 | --- a/drivers/gpu/drm/drm_ioctl.c |
117 | +++ b/drivers/gpu/drm/drm_ioctl.c |
118 | @@ -36,6 +36,7 @@ |
119 | |
120 | #include <linux/pci.h> |
121 | #include <linux/export.h> |
122 | +#include <linux/nospec.h> |
123 | |
124 | /** |
125 | * DOC: getunique and setversion story |
126 | @@ -668,13 +669,17 @@ long drm_ioctl(struct file *filp, |
127 | |
128 | if (is_driver_ioctl) { |
129 | /* driver ioctl */ |
130 | - if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls) |
131 | + unsigned int index = nr - DRM_COMMAND_BASE; |
132 | + |
133 | + if (index >= dev->driver->num_ioctls) |
134 | goto err_i1; |
135 | - ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE]; |
136 | + index = array_index_nospec(index, dev->driver->num_ioctls); |
137 | + ioctl = &dev->driver->ioctls[index]; |
138 | } else { |
139 | /* core ioctl */ |
140 | if (nr >= DRM_CORE_IOCTL_COUNT) |
141 | goto err_i1; |
142 | + nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT); |
143 | ioctl = &drm_ioctls[nr]; |
144 | } |
145 | |
146 | @@ -770,6 +775,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags) |
147 | |
148 | if (nr >= DRM_CORE_IOCTL_COUNT) |
149 | return false; |
150 | + nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT); |
151 | |
152 | *flags = drm_ioctls[nr].flags; |
153 | return true; |
154 | diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c |
155 | index 0276d2ef06ee..9a0d0d0ad6d0 100644 |
156 | --- a/drivers/hv/vmbus_drv.c |
157 | +++ b/drivers/hv/vmbus_drv.c |
158 | @@ -317,6 +317,8 @@ static ssize_t out_intr_mask_show(struct device *dev, |
159 | |
160 | if (!hv_dev->channel) |
161 | return -ENODEV; |
162 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
163 | + return -EINVAL; |
164 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); |
165 | return sprintf(buf, "%d\n", outbound.current_interrupt_mask); |
166 | } |
167 | @@ -330,6 +332,8 @@ static ssize_t out_read_index_show(struct device *dev, |
168 | |
169 | if (!hv_dev->channel) |
170 | return -ENODEV; |
171 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
172 | + return -EINVAL; |
173 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); |
174 | return sprintf(buf, "%d\n", outbound.current_read_index); |
175 | } |
176 | @@ -344,6 +348,8 @@ static ssize_t out_write_index_show(struct device *dev, |
177 | |
178 | if (!hv_dev->channel) |
179 | return -ENODEV; |
180 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
181 | + return -EINVAL; |
182 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); |
183 | return sprintf(buf, "%d\n", outbound.current_write_index); |
184 | } |
185 | @@ -358,6 +364,8 @@ static ssize_t out_read_bytes_avail_show(struct device *dev, |
186 | |
187 | if (!hv_dev->channel) |
188 | return -ENODEV; |
189 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
190 | + return -EINVAL; |
191 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); |
192 | return sprintf(buf, "%d\n", outbound.bytes_avail_toread); |
193 | } |
194 | @@ -372,6 +380,8 @@ static ssize_t out_write_bytes_avail_show(struct device *dev, |
195 | |
196 | if (!hv_dev->channel) |
197 | return -ENODEV; |
198 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
199 | + return -EINVAL; |
200 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); |
201 | return sprintf(buf, "%d\n", outbound.bytes_avail_towrite); |
202 | } |
203 | @@ -385,6 +395,8 @@ static ssize_t in_intr_mask_show(struct device *dev, |
204 | |
205 | if (!hv_dev->channel) |
206 | return -ENODEV; |
207 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
208 | + return -EINVAL; |
209 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); |
210 | return sprintf(buf, "%d\n", inbound.current_interrupt_mask); |
211 | } |
212 | @@ -398,6 +410,8 @@ static ssize_t in_read_index_show(struct device *dev, |
213 | |
214 | if (!hv_dev->channel) |
215 | return -ENODEV; |
216 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
217 | + return -EINVAL; |
218 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); |
219 | return sprintf(buf, "%d\n", inbound.current_read_index); |
220 | } |
221 | @@ -411,6 +425,8 @@ static ssize_t in_write_index_show(struct device *dev, |
222 | |
223 | if (!hv_dev->channel) |
224 | return -ENODEV; |
225 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
226 | + return -EINVAL; |
227 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); |
228 | return sprintf(buf, "%d\n", inbound.current_write_index); |
229 | } |
230 | @@ -425,6 +441,8 @@ static ssize_t in_read_bytes_avail_show(struct device *dev, |
231 | |
232 | if (!hv_dev->channel) |
233 | return -ENODEV; |
234 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
235 | + return -EINVAL; |
236 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); |
237 | return sprintf(buf, "%d\n", inbound.bytes_avail_toread); |
238 | } |
239 | @@ -439,6 +457,8 @@ static ssize_t in_write_bytes_avail_show(struct device *dev, |
240 | |
241 | if (!hv_dev->channel) |
242 | return -ENODEV; |
243 | + if (hv_dev->channel->state != CHANNEL_OPENED_STATE) |
244 | + return -EINVAL; |
245 | hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); |
246 | return sprintf(buf, "%d\n", inbound.bytes_avail_towrite); |
247 | } |
248 | diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c |
249 | index fe7c6ec67d98..2a44a2c3e859 100644 |
250 | --- a/drivers/infiniband/ulp/srpt/ib_srpt.c |
251 | +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c |
252 | @@ -1763,8 +1763,8 @@ static void __srpt_close_all_ch(struct srpt_device *sdev) |
253 | |
254 | list_for_each_entry(ch, &sdev->rch_list, list) { |
255 | if (srpt_disconnect_ch(ch) >= 0) |
256 | - pr_info("Closing channel %s-%d because target %s has been disabled\n", |
257 | - ch->sess_name, ch->qp->qp_num, |
258 | + pr_info("Closing channel %s because target %s has been disabled\n", |
259 | + ch->sess_name, |
260 | sdev->device->name); |
261 | srpt_close_ch(ch); |
262 | } |
263 | diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c |
264 | index 0c6de9f12ee8..97e51309d7af 100644 |
265 | --- a/drivers/mmc/core/mmc.c |
266 | +++ b/drivers/mmc/core/mmc.c |
267 | @@ -27,6 +27,7 @@ |
268 | #include "sd_ops.h" |
269 | |
270 | #define DEFAULT_CMD6_TIMEOUT_MS 500 |
271 | +#define MIN_CACHE_EN_TIMEOUT_MS 1600 |
272 | |
273 | static const unsigned int tran_exp[] = { |
274 | 10000, 100000, 1000000, 10000000, |
275 | @@ -522,8 +523,7 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd) |
276 | card->cid.year += 16; |
277 | |
278 | /* check whether the eMMC card supports BKOPS */ |
279 | - if (!mmc_card_broken_hpi(card) && |
280 | - ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) { |
281 | + if (ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) { |
282 | card->ext_csd.bkops = 1; |
283 | card->ext_csd.man_bkops_en = |
284 | (ext_csd[EXT_CSD_BKOPS_EN] & |
285 | @@ -1719,20 +1719,26 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, |
286 | if (err) { |
287 | pr_warn("%s: Enabling HPI failed\n", |
288 | mmc_hostname(card->host)); |
289 | + card->ext_csd.hpi_en = 0; |
290 | err = 0; |
291 | - } else |
292 | + } else { |
293 | card->ext_csd.hpi_en = 1; |
294 | + } |
295 | } |
296 | |
297 | /* |
298 | - * If cache size is higher than 0, this indicates |
299 | - * the existence of cache and it can be turned on. |
300 | + * If cache size is higher than 0, this indicates the existence of cache |
301 | + * and it can be turned on. Note that some eMMCs from Micron has been |
302 | + * reported to need ~800 ms timeout, while enabling the cache after |
303 | + * sudden power failure tests. Let's extend the timeout to a minimum of |
304 | + * DEFAULT_CACHE_EN_TIMEOUT_MS and do it for all cards. |
305 | */ |
306 | - if (!mmc_card_broken_hpi(card) && |
307 | - card->ext_csd.cache_size > 0) { |
308 | + if (card->ext_csd.cache_size > 0) { |
309 | + unsigned int timeout_ms = MIN_CACHE_EN_TIMEOUT_MS; |
310 | + |
311 | + timeout_ms = max(card->ext_csd.generic_cmd6_time, timeout_ms); |
312 | err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, |
313 | - EXT_CSD_CACHE_CTRL, 1, |
314 | - card->ext_csd.generic_cmd6_time); |
315 | + EXT_CSD_CACHE_CTRL, 1, timeout_ms); |
316 | if (err && err != -EBADMSG) |
317 | goto free_card; |
318 | |
319 | diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c |
320 | index f7d1c8c4e5ad..009242bcc7be 100644 |
321 | --- a/drivers/mmc/host/omap_hsmmc.c |
322 | +++ b/drivers/mmc/host/omap_hsmmc.c |
323 | @@ -2105,7 +2105,6 @@ static int omap_hsmmc_probe(struct platform_device *pdev) |
324 | mmc->max_blk_size = 512; /* Block Length at max can be 1024 */ |
325 | mmc->max_blk_count = 0xFFFF; /* No. of Blocks is 16 bits */ |
326 | mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count; |
327 | - mmc->max_seg_size = mmc->max_req_size; |
328 | |
329 | mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED | |
330 | MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE; |
331 | @@ -2135,6 +2134,17 @@ static int omap_hsmmc_probe(struct platform_device *pdev) |
332 | goto err_irq; |
333 | } |
334 | |
335 | + /* |
336 | + * Limit the maximum segment size to the lower of the request size |
337 | + * and the DMA engine device segment size limits. In reality, with |
338 | + * 32-bit transfers, the DMA engine can do longer segments than this |
339 | + * but there is no way to represent that in the DMA model - if we |
340 | + * increase this figure here, we get warnings from the DMA API debug. |
341 | + */ |
342 | + mmc->max_seg_size = min3(mmc->max_req_size, |
343 | + dma_get_max_seg_size(host->rx_chan->device->dev), |
344 | + dma_get_max_seg_size(host->tx_chan->device->dev)); |
345 | + |
346 | /* Request IRQ for MMC operations */ |
347 | ret = devm_request_irq(&pdev->dev, host->irq, omap_hsmmc_irq, 0, |
348 | mmc_hostname(mmc), host); |
349 | diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c |
350 | index e7b516342678..66ae647b712e 100644 |
351 | --- a/drivers/net/usb/hso.c |
352 | +++ b/drivers/net/usb/hso.c |
353 | @@ -2808,6 +2808,12 @@ static int hso_get_config_data(struct usb_interface *interface) |
354 | return -EIO; |
355 | } |
356 | |
357 | + /* check if we have a valid interface */ |
358 | + if (if_num > 16) { |
359 | + kfree(config_data); |
360 | + return -EINVAL; |
361 | + } |
362 | + |
363 | switch (config_data[if_num]) { |
364 | case 0x0: |
365 | result = 0; |
366 | @@ -2878,10 +2884,18 @@ static int hso_probe(struct usb_interface *interface, |
367 | |
368 | /* Get the interface/port specification from either driver_info or from |
369 | * the device itself */ |
370 | - if (id->driver_info) |
371 | + if (id->driver_info) { |
372 | + /* if_num is controlled by the device, driver_info is a 0 terminated |
373 | + * array. Make sure, the access is in bounds! */ |
374 | + for (i = 0; i <= if_num; ++i) |
375 | + if (((u32 *)(id->driver_info))[i] == 0) |
376 | + goto exit; |
377 | port_spec = ((u32 *)(id->driver_info))[if_num]; |
378 | - else |
379 | + } else { |
380 | port_spec = hso_get_config_data(interface); |
381 | + if (port_spec < 0) |
382 | + goto exit; |
383 | + } |
384 | |
385 | /* Check if we need to switch to alt interfaces prior to port |
386 | * configuration */ |
387 | diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c |
388 | index 00d10660ff14..39e2d3271035 100644 |
389 | --- a/drivers/usb/host/xhci-hub.c |
390 | +++ b/drivers/usb/host/xhci-hub.c |
391 | @@ -1353,7 +1353,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd) |
392 | portsc_buf[port_index] = 0; |
393 | |
394 | /* Bail out if a USB3 port has a new device in link training */ |
395 | - if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) { |
396 | + if ((hcd->speed >= HCD_USB3) && |
397 | + (t1 & PORT_PLS_MASK) == XDEV_POLLING) { |
398 | bus_state->bus_suspended = 0; |
399 | spin_unlock_irqrestore(&xhci->lock, flags); |
400 | xhci_dbg(xhci, "Bus suspend bailout, port in polling\n"); |
401 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
402 | index 2b81939fecd7..1e3445dd84b2 100644 |
403 | --- a/drivers/usb/serial/option.c |
404 | +++ b/drivers/usb/serial/option.c |
405 | @@ -1163,6 +1163,10 @@ static const struct usb_device_id option_ids[] = { |
406 | { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, |
407 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), |
408 | .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, |
409 | + { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */ |
410 | + .driver_info = NCTRL(0) | RSVD(1) }, |
411 | + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ |
412 | + .driver_info = NCTRL(0) }, |
413 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ |
414 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), |
415 | .driver_info = RSVD(1) }, |
416 | @@ -1327,6 +1331,7 @@ static const struct usb_device_id option_ids[] = { |
417 | .driver_info = RSVD(4) }, |
418 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) }, |
419 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) }, |
420 | + { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */ |
421 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), |
422 | .driver_info = RSVD(4) }, |
423 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), |
424 | @@ -1530,6 +1535,7 @@ static const struct usb_device_id option_ids[] = { |
425 | .driver_info = RSVD(2) }, |
426 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */ |
427 | .driver_info = RSVD(2) }, |
428 | + { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */ |
429 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, |
430 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, |
431 | { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) }, |
432 | @@ -1757,6 +1763,7 @@ static const struct usb_device_id option_ids[] = { |
433 | { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, |
434 | { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E), |
435 | .driver_info = RSVD(5) | RSVD(6) }, |
436 | + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ |
437 | { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), |
438 | .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, |
439 | { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), |
440 | @@ -1941,7 +1948,14 @@ static const struct usb_device_id option_ids[] = { |
441 | { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, |
442 | { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, |
443 | { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, |
444 | - { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ |
445 | + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ |
446 | + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) }, /* HP lt4132 (Huawei ME906s-158) */ |
447 | + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) }, |
448 | + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) }, |
449 | + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) }, |
450 | + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) }, |
451 | + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */ |
452 | + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, |
453 | { } /* Terminating entry */ |
454 | }; |
455 | MODULE_DEVICE_TABLE(usb, option_ids); |
456 | diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c |
457 | index 46cd2e1b055b..1999e85840d5 100644 |
458 | --- a/fs/proc/proc_sysctl.c |
459 | +++ b/fs/proc/proc_sysctl.c |
460 | @@ -466,7 +466,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb, |
461 | |
462 | inode = new_inode(sb); |
463 | if (!inode) |
464 | - goto out; |
465 | + return ERR_PTR(-ENOMEM); |
466 | |
467 | inode->i_ino = get_next_ino(); |
468 | |
469 | @@ -476,8 +476,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb, |
470 | if (unlikely(head->unregistering)) { |
471 | spin_unlock(&sysctl_lock); |
472 | iput(inode); |
473 | - inode = NULL; |
474 | - goto out; |
475 | + return ERR_PTR(-ENOENT); |
476 | } |
477 | ei->sysctl = head; |
478 | ei->sysctl_entry = table; |
479 | @@ -502,7 +501,6 @@ static struct inode *proc_sys_make_inode(struct super_block *sb, |
480 | if (root->set_ownership) |
481 | root->set_ownership(head, table, &inode->i_uid, &inode->i_gid); |
482 | |
483 | -out: |
484 | return inode; |
485 | } |
486 | |
487 | @@ -551,10 +549,11 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry, |
488 | goto out; |
489 | } |
490 | |
491 | - err = ERR_PTR(-ENOMEM); |
492 | inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p); |
493 | - if (!inode) |
494 | + if (IS_ERR(inode)) { |
495 | + err = ERR_CAST(inode); |
496 | goto out; |
497 | + } |
498 | |
499 | err = NULL; |
500 | d_set_d_op(dentry, &proc_sys_dentry_operations); |
501 | @@ -687,7 +686,7 @@ static bool proc_sys_fill_cache(struct file *file, |
502 | return false; |
503 | if (d_in_lookup(child)) { |
504 | inode = proc_sys_make_inode(dir->d_sb, head, table); |
505 | - if (!inode) { |
506 | + if (IS_ERR(inode)) { |
507 | d_lookup_done(child); |
508 | dput(child); |
509 | return false; |
510 | diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c |
511 | index fb0f44cd1e28..de7799a0a9d1 100644 |
512 | --- a/fs/ubifs/replay.c |
513 | +++ b/fs/ubifs/replay.c |
514 | @@ -209,6 +209,38 @@ static int trun_remove_range(struct ubifs_info *c, struct replay_entry *r) |
515 | return ubifs_tnc_remove_range(c, &min_key, &max_key); |
516 | } |
517 | |
518 | +/** |
519 | + * inode_still_linked - check whether inode in question will be re-linked. |
520 | + * @c: UBIFS file-system description object |
521 | + * @rino: replay entry to test |
522 | + * |
523 | + * O_TMPFILE files can be re-linked, this means link count goes from 0 to 1. |
524 | + * This case needs special care, otherwise all references to the inode will |
525 | + * be removed upon the first replay entry of an inode with link count 0 |
526 | + * is found. |
527 | + */ |
528 | +static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino) |
529 | +{ |
530 | + struct replay_entry *r; |
531 | + |
532 | + ubifs_assert(rino->deletion); |
533 | + ubifs_assert(key_type(c, &rino->key) == UBIFS_INO_KEY); |
534 | + |
535 | + /* |
536 | + * Find the most recent entry for the inode behind @rino and check |
537 | + * whether it is a deletion. |
538 | + */ |
539 | + list_for_each_entry_reverse(r, &c->replay_list, list) { |
540 | + ubifs_assert(r->sqnum >= rino->sqnum); |
541 | + if (key_inum(c, &r->key) == key_inum(c, &rino->key)) |
542 | + return r->deletion == 0; |
543 | + |
544 | + } |
545 | + |
546 | + ubifs_assert(0); |
547 | + return false; |
548 | +} |
549 | + |
550 | /** |
551 | * apply_replay_entry - apply a replay entry to the TNC. |
552 | * @c: UBIFS file-system description object |
553 | @@ -239,6 +271,11 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r) |
554 | { |
555 | ino_t inum = key_inum(c, &r->key); |
556 | |
557 | + if (inode_still_linked(c, r)) { |
558 | + err = 0; |
559 | + break; |
560 | + } |
561 | + |
562 | err = ubifs_tnc_remove_ino(c, inum); |
563 | break; |
564 | } |
565 | diff --git a/kernel/panic.c b/kernel/panic.c |
566 | index dbec387099b1..eb7bc6d60927 100644 |
567 | --- a/kernel/panic.c |
568 | +++ b/kernel/panic.c |
569 | @@ -13,6 +13,7 @@ |
570 | #include <linux/kmsg_dump.h> |
571 | #include <linux/kallsyms.h> |
572 | #include <linux/notifier.h> |
573 | +#include <linux/vt_kern.h> |
574 | #include <linux/module.h> |
575 | #include <linux/random.h> |
576 | #include <linux/ftrace.h> |
577 | @@ -228,7 +229,10 @@ void panic(const char *fmt, ...) |
578 | if (_crash_kexec_post_notifiers) |
579 | __crash_kexec(NULL); |
580 | |
581 | - bust_spinlocks(0); |
582 | +#ifdef CONFIG_VT |
583 | + unblank_screen(); |
584 | +#endif |
585 | + console_unblank(); |
586 | |
587 | /* |
588 | * We may have ended up stopping the CPU holding the lock (in |