Contents of /trunk/kernel-alx/patches-4.9/0251-4.9.152-all-fixes.patch
Parent Directory | Revision Log
Revision 3304 -
(show annotations)
(download)
Tue Mar 12 10:43:11 2019 UTC (5 years, 6 months ago) by niro
File size: 50373 byte(s)
Tue Mar 12 10:43:11 2019 UTC (5 years, 6 months ago) by niro
File size: 50373 byte(s)
-linux-4.9.152
1 | diff --git a/Makefile b/Makefile |
2 | index f1aeb98f9ace..27a9292fc0ed 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 151 |
9 | +SUBLEVEL = 152 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h |
14 | index 68dedca5a47e..a11c8c2915c9 100644 |
15 | --- a/arch/arm64/include/asm/kvm_arm.h |
16 | +++ b/arch/arm64/include/asm/kvm_arm.h |
17 | @@ -23,6 +23,8 @@ |
18 | #include <asm/types.h> |
19 | |
20 | /* Hyp Configuration Register (HCR) bits */ |
21 | +#define HCR_API (UL(1) << 41) |
22 | +#define HCR_APK (UL(1) << 40) |
23 | #define HCR_E2H (UL(1) << 34) |
24 | #define HCR_ID (UL(1) << 33) |
25 | #define HCR_CD (UL(1) << 32) |
26 | @@ -82,6 +84,7 @@ |
27 | HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW) |
28 | #define HCR_VIRT_EXCP_MASK (HCR_VSE | HCR_VI | HCR_VF) |
29 | #define HCR_INT_OVERRIDE (HCR_FMO | HCR_IMO) |
30 | +#define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK) |
31 | #define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H) |
32 | |
33 | /* TCR_EL2 Registers bits */ |
34 | diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S |
35 | index fa52817d84c5..3289d1458791 100644 |
36 | --- a/arch/arm64/kernel/head.S |
37 | +++ b/arch/arm64/kernel/head.S |
38 | @@ -517,10 +517,9 @@ CPU_LE( bic x0, x0, #(3 << 24) ) // Clear the EE and E0E bits for EL1 |
39 | #endif |
40 | |
41 | /* Hyp configuration. */ |
42 | - mov x0, #HCR_RW // 64-bit EL1 |
43 | + mov_q x0, HCR_HOST_NVHE_FLAGS |
44 | cbz x2, set_hcr |
45 | - orr x0, x0, #HCR_TGE // Enable Host Extensions |
46 | - orr x0, x0, #HCR_E2H |
47 | + mov_q x0, HCR_HOST_VHE_FLAGS |
48 | set_hcr: |
49 | msr hcr_el2, x0 |
50 | isb |
51 | diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c |
52 | index d7e90d97f5c4..2a21318fed1d 100644 |
53 | --- a/arch/arm64/kernel/kaslr.c |
54 | +++ b/arch/arm64/kernel/kaslr.c |
55 | @@ -14,6 +14,7 @@ |
56 | #include <linux/sched.h> |
57 | #include <linux/types.h> |
58 | |
59 | +#include <asm/cacheflush.h> |
60 | #include <asm/fixmap.h> |
61 | #include <asm/kernel-pgtable.h> |
62 | #include <asm/memory.h> |
63 | @@ -43,7 +44,7 @@ static __init u64 get_kaslr_seed(void *fdt) |
64 | return ret; |
65 | } |
66 | |
67 | -static __init const u8 *get_cmdline(void *fdt) |
68 | +static __init const u8 *kaslr_get_cmdline(void *fdt) |
69 | { |
70 | static __initconst const u8 default_cmdline[] = CONFIG_CMDLINE; |
71 | |
72 | @@ -109,7 +110,7 @@ u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset) |
73 | * Check if 'nokaslr' appears on the command line, and |
74 | * return 0 if that is the case. |
75 | */ |
76 | - cmdline = get_cmdline(fdt); |
77 | + cmdline = kaslr_get_cmdline(fdt); |
78 | str = strstr(cmdline, "nokaslr"); |
79 | if (str == cmdline || (str > cmdline && *(str - 1) == ' ')) |
80 | return 0; |
81 | @@ -178,5 +179,8 @@ u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset) |
82 | module_alloc_base += (module_range * (seed & ((1 << 21) - 1))) >> 21; |
83 | module_alloc_base &= PAGE_MASK; |
84 | |
85 | + __flush_dcache_area(&module_alloc_base, sizeof(module_alloc_base)); |
86 | + __flush_dcache_area(&memstart_offset_seed, sizeof(memstart_offset_seed)); |
87 | + |
88 | return offset; |
89 | } |
90 | diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c |
91 | index 12f9d1ecdf4c..115b0955715f 100644 |
92 | --- a/arch/arm64/kvm/hyp/switch.c |
93 | +++ b/arch/arm64/kvm/hyp/switch.c |
94 | @@ -112,7 +112,7 @@ static void __hyp_text __deactivate_traps_vhe(void) |
95 | |
96 | static void __hyp_text __deactivate_traps_nvhe(void) |
97 | { |
98 | - write_sysreg(HCR_RW, hcr_el2); |
99 | + write_sysreg(HCR_HOST_NVHE_FLAGS, hcr_el2); |
100 | write_sysreg(CPTR_EL2_DEFAULT, cptr_el2); |
101 | } |
102 | |
103 | diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig |
104 | index 34fbbf8fdeaa..1d987061d1a1 100644 |
105 | --- a/arch/mips/Kconfig |
106 | +++ b/arch/mips/Kconfig |
107 | @@ -3135,6 +3135,7 @@ config MIPS32_O32 |
108 | config MIPS32_N32 |
109 | bool "Kernel support for n32 binaries" |
110 | depends on 64BIT |
111 | + select ARCH_WANT_COMPAT_IPC_PARSE_VERSION |
112 | select COMPAT |
113 | select MIPS32_COMPAT |
114 | select SYSVIPC_COMPAT if SYSVIPC |
115 | diff --git a/arch/mips/pci/msi-octeon.c b/arch/mips/pci/msi-octeon.c |
116 | index 2a5bb849b10e..288b58b00dc8 100644 |
117 | --- a/arch/mips/pci/msi-octeon.c |
118 | +++ b/arch/mips/pci/msi-octeon.c |
119 | @@ -369,7 +369,9 @@ int __init octeon_msi_initialize(void) |
120 | int irq; |
121 | struct irq_chip *msi; |
122 | |
123 | - if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) { |
124 | + if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_INVALID) { |
125 | + return 0; |
126 | + } else if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) { |
127 | msi_rcv_reg[0] = CVMX_PEXP_NPEI_MSI_RCV0; |
128 | msi_rcv_reg[1] = CVMX_PEXP_NPEI_MSI_RCV1; |
129 | msi_rcv_reg[2] = CVMX_PEXP_NPEI_MSI_RCV2; |
130 | diff --git a/crypto/authenc.c b/crypto/authenc.c |
131 | index c3180eb6d1ee..6bfec690ca5b 100644 |
132 | --- a/crypto/authenc.c |
133 | +++ b/crypto/authenc.c |
134 | @@ -58,14 +58,22 @@ int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key, |
135 | return -EINVAL; |
136 | if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM) |
137 | return -EINVAL; |
138 | - if (RTA_PAYLOAD(rta) < sizeof(*param)) |
139 | + |
140 | + /* |
141 | + * RTA_OK() didn't align the rtattr's payload when validating that it |
142 | + * fits in the buffer. Yet, the keys should start on the next 4-byte |
143 | + * aligned boundary. To avoid confusion, require that the rtattr |
144 | + * payload be exactly the param struct, which has a 4-byte aligned size. |
145 | + */ |
146 | + if (RTA_PAYLOAD(rta) != sizeof(*param)) |
147 | return -EINVAL; |
148 | + BUILD_BUG_ON(sizeof(*param) % RTA_ALIGNTO); |
149 | |
150 | param = RTA_DATA(rta); |
151 | keys->enckeylen = be32_to_cpu(param->enckeylen); |
152 | |
153 | - key += RTA_ALIGN(rta->rta_len); |
154 | - keylen -= RTA_ALIGN(rta->rta_len); |
155 | + key += rta->rta_len; |
156 | + keylen -= rta->rta_len; |
157 | |
158 | if (keylen < keys->enckeylen) |
159 | return -EINVAL; |
160 | diff --git a/crypto/authencesn.c b/crypto/authencesn.c |
161 | index 49e7e85a23d5..73b12f128ae5 100644 |
162 | --- a/crypto/authencesn.c |
163 | +++ b/crypto/authencesn.c |
164 | @@ -279,7 +279,7 @@ static void authenc_esn_verify_ahash_done(struct crypto_async_request *areq, |
165 | struct aead_request *req = areq->data; |
166 | |
167 | err = err ?: crypto_authenc_esn_decrypt_tail(req, 0); |
168 | - aead_request_complete(req, err); |
169 | + authenc_esn_request_complete(req, err); |
170 | } |
171 | |
172 | static int crypto_authenc_esn_decrypt(struct aead_request *req) |
173 | diff --git a/drivers/block/loop.c b/drivers/block/loop.c |
174 | index 9f840d9fdfcb..344f34746c10 100644 |
175 | --- a/drivers/block/loop.c |
176 | +++ b/drivers/block/loop.c |
177 | @@ -81,7 +81,7 @@ |
178 | #include <asm/uaccess.h> |
179 | |
180 | static DEFINE_IDR(loop_index_idr); |
181 | -static DEFINE_MUTEX(loop_index_mutex); |
182 | +static DEFINE_MUTEX(loop_ctl_mutex); |
183 | |
184 | static int max_part; |
185 | static int part_shift; |
186 | @@ -1033,7 +1033,7 @@ static int loop_clr_fd(struct loop_device *lo) |
187 | */ |
188 | if (atomic_read(&lo->lo_refcnt) > 1) { |
189 | lo->lo_flags |= LO_FLAGS_AUTOCLEAR; |
190 | - mutex_unlock(&lo->lo_ctl_mutex); |
191 | + mutex_unlock(&loop_ctl_mutex); |
192 | return 0; |
193 | } |
194 | |
195 | @@ -1082,12 +1082,12 @@ static int loop_clr_fd(struct loop_device *lo) |
196 | if (!part_shift) |
197 | lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN; |
198 | loop_unprepare_queue(lo); |
199 | - mutex_unlock(&lo->lo_ctl_mutex); |
200 | + mutex_unlock(&loop_ctl_mutex); |
201 | /* |
202 | - * Need not hold lo_ctl_mutex to fput backing file. |
203 | - * Calling fput holding lo_ctl_mutex triggers a circular |
204 | + * Need not hold loop_ctl_mutex to fput backing file. |
205 | + * Calling fput holding loop_ctl_mutex triggers a circular |
206 | * lock dependency possibility warning as fput can take |
207 | - * bd_mutex which is usually taken before lo_ctl_mutex. |
208 | + * bd_mutex which is usually taken before loop_ctl_mutex. |
209 | */ |
210 | fput(filp); |
211 | return 0; |
212 | @@ -1350,7 +1350,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, |
213 | struct loop_device *lo = bdev->bd_disk->private_data; |
214 | int err; |
215 | |
216 | - mutex_lock_nested(&lo->lo_ctl_mutex, 1); |
217 | + mutex_lock_nested(&loop_ctl_mutex, 1); |
218 | switch (cmd) { |
219 | case LOOP_SET_FD: |
220 | err = loop_set_fd(lo, mode, bdev, arg); |
221 | @@ -1359,7 +1359,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, |
222 | err = loop_change_fd(lo, bdev, arg); |
223 | break; |
224 | case LOOP_CLR_FD: |
225 | - /* loop_clr_fd would have unlocked lo_ctl_mutex on success */ |
226 | + /* loop_clr_fd would have unlocked loop_ctl_mutex on success */ |
227 | err = loop_clr_fd(lo); |
228 | if (!err) |
229 | goto out_unlocked; |
230 | @@ -1395,7 +1395,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, |
231 | default: |
232 | err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL; |
233 | } |
234 | - mutex_unlock(&lo->lo_ctl_mutex); |
235 | + mutex_unlock(&loop_ctl_mutex); |
236 | |
237 | out_unlocked: |
238 | return err; |
239 | @@ -1528,16 +1528,16 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, |
240 | |
241 | switch(cmd) { |
242 | case LOOP_SET_STATUS: |
243 | - mutex_lock(&lo->lo_ctl_mutex); |
244 | + mutex_lock(&loop_ctl_mutex); |
245 | err = loop_set_status_compat( |
246 | lo, (const struct compat_loop_info __user *) arg); |
247 | - mutex_unlock(&lo->lo_ctl_mutex); |
248 | + mutex_unlock(&loop_ctl_mutex); |
249 | break; |
250 | case LOOP_GET_STATUS: |
251 | - mutex_lock(&lo->lo_ctl_mutex); |
252 | + mutex_lock(&loop_ctl_mutex); |
253 | err = loop_get_status_compat( |
254 | lo, (struct compat_loop_info __user *) arg); |
255 | - mutex_unlock(&lo->lo_ctl_mutex); |
256 | + mutex_unlock(&loop_ctl_mutex); |
257 | break; |
258 | case LOOP_SET_CAPACITY: |
259 | case LOOP_CLR_FD: |
260 | @@ -1559,9 +1559,11 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, |
261 | static int lo_open(struct block_device *bdev, fmode_t mode) |
262 | { |
263 | struct loop_device *lo; |
264 | - int err = 0; |
265 | + int err; |
266 | |
267 | - mutex_lock(&loop_index_mutex); |
268 | + err = mutex_lock_killable(&loop_ctl_mutex); |
269 | + if (err) |
270 | + return err; |
271 | lo = bdev->bd_disk->private_data; |
272 | if (!lo) { |
273 | err = -ENXIO; |
274 | @@ -1570,18 +1572,20 @@ static int lo_open(struct block_device *bdev, fmode_t mode) |
275 | |
276 | atomic_inc(&lo->lo_refcnt); |
277 | out: |
278 | - mutex_unlock(&loop_index_mutex); |
279 | + mutex_unlock(&loop_ctl_mutex); |
280 | return err; |
281 | } |
282 | |
283 | -static void __lo_release(struct loop_device *lo) |
284 | +static void lo_release(struct gendisk *disk, fmode_t mode) |
285 | { |
286 | + struct loop_device *lo; |
287 | int err; |
288 | |
289 | + mutex_lock(&loop_ctl_mutex); |
290 | + lo = disk->private_data; |
291 | if (atomic_dec_return(&lo->lo_refcnt)) |
292 | - return; |
293 | + goto out_unlock; |
294 | |
295 | - mutex_lock(&lo->lo_ctl_mutex); |
296 | if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) { |
297 | /* |
298 | * In autoclear mode, stop the loop thread |
299 | @@ -1598,14 +1602,8 @@ static void __lo_release(struct loop_device *lo) |
300 | loop_flush(lo); |
301 | } |
302 | |
303 | - mutex_unlock(&lo->lo_ctl_mutex); |
304 | -} |
305 | - |
306 | -static void lo_release(struct gendisk *disk, fmode_t mode) |
307 | -{ |
308 | - mutex_lock(&loop_index_mutex); |
309 | - __lo_release(disk->private_data); |
310 | - mutex_unlock(&loop_index_mutex); |
311 | +out_unlock: |
312 | + mutex_unlock(&loop_ctl_mutex); |
313 | } |
314 | |
315 | static const struct block_device_operations lo_fops = { |
316 | @@ -1644,10 +1642,10 @@ static int unregister_transfer_cb(int id, void *ptr, void *data) |
317 | struct loop_device *lo = ptr; |
318 | struct loop_func_table *xfer = data; |
319 | |
320 | - mutex_lock(&lo->lo_ctl_mutex); |
321 | + mutex_lock(&loop_ctl_mutex); |
322 | if (lo->lo_encryption == xfer) |
323 | loop_release_xfer(lo); |
324 | - mutex_unlock(&lo->lo_ctl_mutex); |
325 | + mutex_unlock(&loop_ctl_mutex); |
326 | return 0; |
327 | } |
328 | |
329 | @@ -1813,7 +1811,6 @@ static int loop_add(struct loop_device **l, int i) |
330 | if (!part_shift) |
331 | disk->flags |= GENHD_FL_NO_PART_SCAN; |
332 | disk->flags |= GENHD_FL_EXT_DEVT; |
333 | - mutex_init(&lo->lo_ctl_mutex); |
334 | atomic_set(&lo->lo_refcnt, 0); |
335 | lo->lo_number = i; |
336 | spin_lock_init(&lo->lo_lock); |
337 | @@ -1892,7 +1889,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) |
338 | struct kobject *kobj; |
339 | int err; |
340 | |
341 | - mutex_lock(&loop_index_mutex); |
342 | + mutex_lock(&loop_ctl_mutex); |
343 | err = loop_lookup(&lo, MINOR(dev) >> part_shift); |
344 | if (err < 0) |
345 | err = loop_add(&lo, MINOR(dev) >> part_shift); |
346 | @@ -1900,7 +1897,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) |
347 | kobj = NULL; |
348 | else |
349 | kobj = get_disk(lo->lo_disk); |
350 | - mutex_unlock(&loop_index_mutex); |
351 | + mutex_unlock(&loop_ctl_mutex); |
352 | |
353 | *part = 0; |
354 | return kobj; |
355 | @@ -1910,9 +1907,13 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, |
356 | unsigned long parm) |
357 | { |
358 | struct loop_device *lo; |
359 | - int ret = -ENOSYS; |
360 | + int ret; |
361 | + |
362 | + ret = mutex_lock_killable(&loop_ctl_mutex); |
363 | + if (ret) |
364 | + return ret; |
365 | |
366 | - mutex_lock(&loop_index_mutex); |
367 | + ret = -ENOSYS; |
368 | switch (cmd) { |
369 | case LOOP_CTL_ADD: |
370 | ret = loop_lookup(&lo, parm); |
371 | @@ -1926,19 +1927,15 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, |
372 | ret = loop_lookup(&lo, parm); |
373 | if (ret < 0) |
374 | break; |
375 | - mutex_lock(&lo->lo_ctl_mutex); |
376 | if (lo->lo_state != Lo_unbound) { |
377 | ret = -EBUSY; |
378 | - mutex_unlock(&lo->lo_ctl_mutex); |
379 | break; |
380 | } |
381 | if (atomic_read(&lo->lo_refcnt) > 0) { |
382 | ret = -EBUSY; |
383 | - mutex_unlock(&lo->lo_ctl_mutex); |
384 | break; |
385 | } |
386 | lo->lo_disk->private_data = NULL; |
387 | - mutex_unlock(&lo->lo_ctl_mutex); |
388 | idr_remove(&loop_index_idr, lo->lo_number); |
389 | loop_remove(lo); |
390 | break; |
391 | @@ -1948,7 +1945,7 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, |
392 | break; |
393 | ret = loop_add(&lo, -1); |
394 | } |
395 | - mutex_unlock(&loop_index_mutex); |
396 | + mutex_unlock(&loop_ctl_mutex); |
397 | |
398 | return ret; |
399 | } |
400 | @@ -2031,10 +2028,10 @@ static int __init loop_init(void) |
401 | THIS_MODULE, loop_probe, NULL, NULL); |
402 | |
403 | /* pre-create number of devices given by config or max_loop */ |
404 | - mutex_lock(&loop_index_mutex); |
405 | + mutex_lock(&loop_ctl_mutex); |
406 | for (i = 0; i < nr; i++) |
407 | loop_add(&lo, i); |
408 | - mutex_unlock(&loop_index_mutex); |
409 | + mutex_unlock(&loop_ctl_mutex); |
410 | |
411 | printk(KERN_INFO "loop: module loaded\n"); |
412 | return 0; |
413 | diff --git a/drivers/block/loop.h b/drivers/block/loop.h |
414 | index 60f0fd2c0c65..a923e74495ce 100644 |
415 | --- a/drivers/block/loop.h |
416 | +++ b/drivers/block/loop.h |
417 | @@ -55,7 +55,6 @@ struct loop_device { |
418 | |
419 | spinlock_t lo_lock; |
420 | int lo_state; |
421 | - struct mutex lo_ctl_mutex; |
422 | struct kthread_worker worker; |
423 | struct task_struct *worker_task; |
424 | bool use_dio; |
425 | diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c |
426 | index 42a53956aefe..394f8ec83cf0 100644 |
427 | --- a/drivers/block/nbd.c |
428 | +++ b/drivers/block/nbd.c |
429 | @@ -108,7 +108,7 @@ static const char *nbdcmd_to_ascii(int cmd) |
430 | |
431 | static int nbd_size_clear(struct nbd_device *nbd, struct block_device *bdev) |
432 | { |
433 | - bdev->bd_inode->i_size = 0; |
434 | + bd_set_size(bdev, 0); |
435 | set_capacity(nbd->disk, 0); |
436 | kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE); |
437 | |
438 | @@ -117,29 +117,21 @@ static int nbd_size_clear(struct nbd_device *nbd, struct block_device *bdev) |
439 | |
440 | static void nbd_size_update(struct nbd_device *nbd, struct block_device *bdev) |
441 | { |
442 | - if (!nbd_is_connected(nbd)) |
443 | - return; |
444 | - |
445 | - bdev->bd_inode->i_size = nbd->bytesize; |
446 | + blk_queue_logical_block_size(nbd->disk->queue, nbd->blksize); |
447 | + blk_queue_physical_block_size(nbd->disk->queue, nbd->blksize); |
448 | + bd_set_size(bdev, nbd->bytesize); |
449 | + set_blocksize(bdev, nbd->blksize); |
450 | set_capacity(nbd->disk, nbd->bytesize >> 9); |
451 | kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE); |
452 | } |
453 | |
454 | -static int nbd_size_set(struct nbd_device *nbd, struct block_device *bdev, |
455 | +static void nbd_size_set(struct nbd_device *nbd, struct block_device *bdev, |
456 | loff_t blocksize, loff_t nr_blocks) |
457 | { |
458 | - int ret; |
459 | - |
460 | - ret = set_blocksize(bdev, blocksize); |
461 | - if (ret) |
462 | - return ret; |
463 | - |
464 | nbd->blksize = blocksize; |
465 | nbd->bytesize = blocksize * nr_blocks; |
466 | - |
467 | - nbd_size_update(nbd, bdev); |
468 | - |
469 | - return 0; |
470 | + if (nbd_is_connected(nbd)) |
471 | + nbd_size_update(nbd, bdev); |
472 | } |
473 | |
474 | static void nbd_end_request(struct nbd_cmd *cmd) |
475 | @@ -655,16 +647,17 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, |
476 | case NBD_SET_BLKSIZE: { |
477 | loff_t bsize = div_s64(nbd->bytesize, arg); |
478 | |
479 | - return nbd_size_set(nbd, bdev, arg, bsize); |
480 | + nbd_size_set(nbd, bdev, arg, bsize); |
481 | + return 0; |
482 | } |
483 | |
484 | case NBD_SET_SIZE: |
485 | - return nbd_size_set(nbd, bdev, nbd->blksize, |
486 | - div_s64(arg, nbd->blksize)); |
487 | - |
488 | + nbd_size_set(nbd, bdev, nbd->blksize, |
489 | + div_s64(arg, nbd->blksize)); |
490 | + return 0; |
491 | case NBD_SET_SIZE_BLOCKS: |
492 | - return nbd_size_set(nbd, bdev, nbd->blksize, arg); |
493 | - |
494 | + nbd_size_set(nbd, bdev, nbd->blksize, arg); |
495 | + return 0; |
496 | case NBD_SET_TIMEOUT: |
497 | if (arg) { |
498 | nbd->tag_set.timeout = arg * HZ; |
499 | diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c |
500 | index 631337c2e4a7..9eac4dcb9971 100644 |
501 | --- a/drivers/crypto/caam/caamhash.c |
502 | +++ b/drivers/crypto/caam/caamhash.c |
503 | @@ -1232,13 +1232,16 @@ static int ahash_final_no_ctx(struct ahash_request *req) |
504 | |
505 | desc = edesc->hw_desc; |
506 | |
507 | - state->buf_dma = dma_map_single(jrdev, buf, buflen, DMA_TO_DEVICE); |
508 | - if (dma_mapping_error(jrdev, state->buf_dma)) { |
509 | - dev_err(jrdev, "unable to map src\n"); |
510 | - goto unmap; |
511 | - } |
512 | + if (buflen) { |
513 | + state->buf_dma = dma_map_single(jrdev, buf, buflen, |
514 | + DMA_TO_DEVICE); |
515 | + if (dma_mapping_error(jrdev, state->buf_dma)) { |
516 | + dev_err(jrdev, "unable to map src\n"); |
517 | + goto unmap; |
518 | + } |
519 | |
520 | - append_seq_in_ptr(desc, state->buf_dma, buflen, 0); |
521 | + append_seq_in_ptr(desc, state->buf_dma, buflen, 0); |
522 | + } |
523 | |
524 | edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result, |
525 | digestsize); |
526 | diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c |
527 | index 7c71722be395..463033b4db1d 100644 |
528 | --- a/drivers/crypto/talitos.c |
529 | +++ b/drivers/crypto/talitos.c |
530 | @@ -1347,23 +1347,18 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, |
531 | struct talitos_private *priv = dev_get_drvdata(dev); |
532 | bool is_sec1 = has_ftr_sec1(priv); |
533 | int max_len = is_sec1 ? TALITOS1_MAX_DATA_LEN : TALITOS2_MAX_DATA_LEN; |
534 | - void *err; |
535 | |
536 | if (cryptlen + authsize > max_len) { |
537 | dev_err(dev, "length exceeds h/w max limit\n"); |
538 | return ERR_PTR(-EINVAL); |
539 | } |
540 | |
541 | - if (ivsize) |
542 | - iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE); |
543 | - |
544 | if (!dst || dst == src) { |
545 | src_len = assoclen + cryptlen + authsize; |
546 | src_nents = sg_nents_for_len(src, src_len); |
547 | if (src_nents < 0) { |
548 | dev_err(dev, "Invalid number of src SG.\n"); |
549 | - err = ERR_PTR(-EINVAL); |
550 | - goto error_sg; |
551 | + return ERR_PTR(-EINVAL); |
552 | } |
553 | src_nents = (src_nents == 1) ? 0 : src_nents; |
554 | dst_nents = dst ? src_nents : 0; |
555 | @@ -1373,16 +1368,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, |
556 | src_nents = sg_nents_for_len(src, src_len); |
557 | if (src_nents < 0) { |
558 | dev_err(dev, "Invalid number of src SG.\n"); |
559 | - err = ERR_PTR(-EINVAL); |
560 | - goto error_sg; |
561 | + return ERR_PTR(-EINVAL); |
562 | } |
563 | src_nents = (src_nents == 1) ? 0 : src_nents; |
564 | dst_len = assoclen + cryptlen + (encrypt ? authsize : 0); |
565 | dst_nents = sg_nents_for_len(dst, dst_len); |
566 | if (dst_nents < 0) { |
567 | dev_err(dev, "Invalid number of dst SG.\n"); |
568 | - err = ERR_PTR(-EINVAL); |
569 | - goto error_sg; |
570 | + return ERR_PTR(-EINVAL); |
571 | } |
572 | dst_nents = (dst_nents == 1) ? 0 : dst_nents; |
573 | } |
574 | @@ -1405,12 +1398,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, |
575 | dma_len = 0; |
576 | alloc_len += icv_stashing ? authsize : 0; |
577 | } |
578 | + alloc_len += ivsize; |
579 | |
580 | edesc = kmalloc(alloc_len, GFP_DMA | flags); |
581 | - if (!edesc) { |
582 | - dev_err(dev, "could not allocate edescriptor\n"); |
583 | - err = ERR_PTR(-ENOMEM); |
584 | - goto error_sg; |
585 | + if (!edesc) |
586 | + return ERR_PTR(-ENOMEM); |
587 | + if (ivsize) { |
588 | + iv = memcpy(((u8 *)edesc) + alloc_len - ivsize, iv, ivsize); |
589 | + iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE); |
590 | } |
591 | |
592 | edesc->src_nents = src_nents; |
593 | @@ -1423,10 +1418,6 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, |
594 | DMA_BIDIRECTIONAL); |
595 | |
596 | return edesc; |
597 | -error_sg: |
598 | - if (iv_dma) |
599 | - dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE); |
600 | - return err; |
601 | } |
602 | |
603 | static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv, |
604 | diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c |
605 | index 6a48d6637e5c..2e85e609f125 100644 |
606 | --- a/drivers/gpu/drm/drm_fb_helper.c |
607 | +++ b/drivers/gpu/drm/drm_fb_helper.c |
608 | @@ -1238,9 +1238,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, |
609 | struct drm_framebuffer *fb = fb_helper->fb; |
610 | int depth; |
611 | |
612 | - if (var->pixclock != 0 || in_dbg_master()) |
613 | + if (in_dbg_master()) |
614 | return -EINVAL; |
615 | |
616 | + if (var->pixclock != 0) { |
617 | + DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n"); |
618 | + var->pixclock = 0; |
619 | + } |
620 | + |
621 | /* Need to resize the fb object !!! */ |
622 | if (var->bits_per_pixel > fb->bits_per_pixel || |
623 | var->xres > fb->width || var->yres > fb->height || |
624 | diff --git a/drivers/media/platform/vivid/vivid-kthread-cap.c b/drivers/media/platform/vivid/vivid-kthread-cap.c |
625 | index 6ca71aabb576..d300e5e7eadc 100644 |
626 | --- a/drivers/media/platform/vivid/vivid-kthread-cap.c |
627 | +++ b/drivers/media/platform/vivid/vivid-kthread-cap.c |
628 | @@ -877,8 +877,11 @@ int vivid_start_generating_vid_cap(struct vivid_dev *dev, bool *pstreaming) |
629 | "%s-vid-cap", dev->v4l2_dev.name); |
630 | |
631 | if (IS_ERR(dev->kthread_vid_cap)) { |
632 | + int err = PTR_ERR(dev->kthread_vid_cap); |
633 | + |
634 | + dev->kthread_vid_cap = NULL; |
635 | v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n"); |
636 | - return PTR_ERR(dev->kthread_vid_cap); |
637 | + return err; |
638 | } |
639 | *pstreaming = true; |
640 | vivid_grab_controls(dev, true); |
641 | diff --git a/drivers/media/platform/vivid/vivid-kthread-out.c b/drivers/media/platform/vivid/vivid-kthread-out.c |
642 | index 98eed5889bc1..7c8d75852816 100644 |
643 | --- a/drivers/media/platform/vivid/vivid-kthread-out.c |
644 | +++ b/drivers/media/platform/vivid/vivid-kthread-out.c |
645 | @@ -248,8 +248,11 @@ int vivid_start_generating_vid_out(struct vivid_dev *dev, bool *pstreaming) |
646 | "%s-vid-out", dev->v4l2_dev.name); |
647 | |
648 | if (IS_ERR(dev->kthread_vid_out)) { |
649 | + int err = PTR_ERR(dev->kthread_vid_out); |
650 | + |
651 | + dev->kthread_vid_out = NULL; |
652 | v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n"); |
653 | - return PTR_ERR(dev->kthread_vid_out); |
654 | + return err; |
655 | } |
656 | *pstreaming = true; |
657 | vivid_grab_controls(dev, true); |
658 | diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c |
659 | index fcda3ae4e6b0..f9a810e3f521 100644 |
660 | --- a/drivers/media/platform/vivid/vivid-vid-common.c |
661 | +++ b/drivers/media/platform/vivid/vivid-vid-common.c |
662 | @@ -33,7 +33,7 @@ const struct v4l2_dv_timings_cap vivid_dv_timings_cap = { |
663 | .type = V4L2_DV_BT_656_1120, |
664 | /* keep this initialization for compatibility with GCC < 4.4.6 */ |
665 | .reserved = { 0 }, |
666 | - V4L2_INIT_BT_TIMINGS(0, MAX_WIDTH, 0, MAX_HEIGHT, 14000000, 775000000, |
667 | + V4L2_INIT_BT_TIMINGS(16, MAX_WIDTH, 16, MAX_HEIGHT, 14000000, 775000000, |
668 | V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | |
669 | V4L2_DV_BT_STD_CVT | V4L2_DV_BT_STD_GTF, |
670 | V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_INTERLACED) |
671 | diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c |
672 | index 1ed7ba3dfdbe..ae959e01042a 100644 |
673 | --- a/drivers/media/usb/em28xx/em28xx-video.c |
674 | +++ b/drivers/media/usb/em28xx/em28xx-video.c |
675 | @@ -1062,6 +1062,8 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count) |
676 | |
677 | em28xx_videodbg("%s\n", __func__); |
678 | |
679 | + dev->v4l2->field_count = 0; |
680 | + |
681 | /* Make sure streaming is not already in progress for this type |
682 | of filehandle (e.g. video, vbi) */ |
683 | rc = res_get(dev, vq->type); |
684 | @@ -1290,8 +1292,6 @@ static void em28xx_ctrl_notify(struct v4l2_ctrl *ctrl, void *priv) |
685 | { |
686 | struct em28xx *dev = priv; |
687 | |
688 | - dev->v4l2->field_count = 0; |
689 | - |
690 | /* |
691 | * In the case of non-AC97 volume controls, we still need |
692 | * to do some setups at em28xx, in order to mute/unmute |
693 | diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c |
694 | index 4df4a1f402be..b1a4d4e2341b 100644 |
695 | --- a/drivers/media/v4l2-core/videobuf2-core.c |
696 | +++ b/drivers/media/v4l2-core/videobuf2-core.c |
697 | @@ -1916,9 +1916,13 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) |
698 | return -EINVAL; |
699 | } |
700 | } |
701 | + |
702 | + mutex_lock(&q->mmap_lock); |
703 | + |
704 | if (vb2_fileio_is_active(q)) { |
705 | dprintk(1, "mmap: file io in progress\n"); |
706 | - return -EBUSY; |
707 | + ret = -EBUSY; |
708 | + goto unlock; |
709 | } |
710 | |
711 | /* |
712 | @@ -1926,7 +1930,7 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) |
713 | */ |
714 | ret = __find_plane_by_offset(q, off, &buffer, &plane); |
715 | if (ret) |
716 | - return ret; |
717 | + goto unlock; |
718 | |
719 | vb = q->bufs[buffer]; |
720 | |
721 | @@ -1939,11 +1943,13 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) |
722 | if (length < (vma->vm_end - vma->vm_start)) { |
723 | dprintk(1, |
724 | "MMAP invalid, as it would overflow buffer length\n"); |
725 | - return -EINVAL; |
726 | + ret = -EINVAL; |
727 | + goto unlock; |
728 | } |
729 | |
730 | - mutex_lock(&q->mmap_lock); |
731 | ret = call_memop(vb, mmap, vb->planes[plane].mem_priv, vma); |
732 | + |
733 | +unlock: |
734 | mutex_unlock(&q->mmap_lock); |
735 | if (ret) |
736 | return ret; |
737 | diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c |
738 | index 5628a6b5b19b..c5c320efc7b4 100644 |
739 | --- a/drivers/mfd/tps6586x.c |
740 | +++ b/drivers/mfd/tps6586x.c |
741 | @@ -594,6 +594,29 @@ static int tps6586x_i2c_remove(struct i2c_client *client) |
742 | return 0; |
743 | } |
744 | |
745 | +static int __maybe_unused tps6586x_i2c_suspend(struct device *dev) |
746 | +{ |
747 | + struct tps6586x *tps6586x = dev_get_drvdata(dev); |
748 | + |
749 | + if (tps6586x->client->irq) |
750 | + disable_irq(tps6586x->client->irq); |
751 | + |
752 | + return 0; |
753 | +} |
754 | + |
755 | +static int __maybe_unused tps6586x_i2c_resume(struct device *dev) |
756 | +{ |
757 | + struct tps6586x *tps6586x = dev_get_drvdata(dev); |
758 | + |
759 | + if (tps6586x->client->irq) |
760 | + enable_irq(tps6586x->client->irq); |
761 | + |
762 | + return 0; |
763 | +} |
764 | + |
765 | +static SIMPLE_DEV_PM_OPS(tps6586x_pm_ops, tps6586x_i2c_suspend, |
766 | + tps6586x_i2c_resume); |
767 | + |
768 | static const struct i2c_device_id tps6586x_id_table[] = { |
769 | { "tps6586x", 0 }, |
770 | { }, |
771 | @@ -604,6 +627,7 @@ static struct i2c_driver tps6586x_driver = { |
772 | .driver = { |
773 | .name = "tps6586x", |
774 | .of_match_table = of_match_ptr(tps6586x_of_match), |
775 | + .pm = &tps6586x_pm_ops, |
776 | }, |
777 | .probe = tps6586x_i2c_probe, |
778 | .remove = tps6586x_i2c_remove, |
779 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c |
780 | index 389d1db69a32..24a3433f3944 100644 |
781 | --- a/drivers/net/bonding/bond_main.c |
782 | +++ b/drivers/net/bonding/bond_main.c |
783 | @@ -1900,6 +1900,9 @@ static int __bond_release_one(struct net_device *bond_dev, |
784 | if (!bond_has_slaves(bond)) { |
785 | bond_set_carrier(bond); |
786 | eth_hw_addr_random(bond_dev); |
787 | + bond->nest_level = SINGLE_DEPTH_NESTING; |
788 | + } else { |
789 | + bond->nest_level = dev_get_nest_level(bond_dev) + 1; |
790 | } |
791 | |
792 | unblock_netpoll_tx(); |
793 | diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c |
794 | index b44c1bb687a2..ebc193f7f7dd 100644 |
795 | --- a/drivers/scsi/scsi_pm.c |
796 | +++ b/drivers/scsi/scsi_pm.c |
797 | @@ -79,8 +79,22 @@ static int scsi_dev_type_resume(struct device *dev, |
798 | |
799 | if (err == 0) { |
800 | pm_runtime_disable(dev); |
801 | - pm_runtime_set_active(dev); |
802 | + err = pm_runtime_set_active(dev); |
803 | pm_runtime_enable(dev); |
804 | + |
805 | + /* |
806 | + * Forcibly set runtime PM status of request queue to "active" |
807 | + * to make sure we can again get requests from the queue |
808 | + * (see also blk_pm_peek_request()). |
809 | + * |
810 | + * The resume hook will correct runtime PM status of the disk. |
811 | + */ |
812 | + if (!err && scsi_is_sdev_device(dev)) { |
813 | + struct scsi_device *sdev = to_scsi_device(dev); |
814 | + |
815 | + if (sdev->request_queue->dev) |
816 | + blk_set_runtime_active(sdev->request_queue); |
817 | + } |
818 | } |
819 | |
820 | return err; |
821 | @@ -139,16 +153,6 @@ static int scsi_bus_resume_common(struct device *dev, |
822 | else |
823 | fn = NULL; |
824 | |
825 | - /* |
826 | - * Forcibly set runtime PM status of request queue to "active" to |
827 | - * make sure we can again get requests from the queue (see also |
828 | - * blk_pm_peek_request()). |
829 | - * |
830 | - * The resume hook will correct runtime PM status of the disk. |
831 | - */ |
832 | - if (scsi_is_sdev_device(dev) && pm_runtime_suspended(dev)) |
833 | - blk_set_runtime_active(to_scsi_device(dev)->request_queue); |
834 | - |
835 | if (fn) { |
836 | async_schedule_domain(fn, dev, &scsi_sd_pm_domain); |
837 | |
838 | diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c |
839 | index ab999c4444b8..867ae76f93f2 100644 |
840 | --- a/drivers/scsi/sd.c |
841 | +++ b/drivers/scsi/sd.c |
842 | @@ -208,6 +208,12 @@ cache_type_store(struct device *dev, struct device_attribute *attr, |
843 | sp = buffer_data[0] & 0x80 ? 1 : 0; |
844 | buffer_data[0] &= ~0x80; |
845 | |
846 | + /* |
847 | + * Ensure WP, DPOFUA, and RESERVED fields are cleared in |
848 | + * received mode parameter buffer before doing MODE SELECT. |
849 | + */ |
850 | + data.device_specific = 0; |
851 | + |
852 | if (scsi_mode_select(sdp, 1, sp, 8, buffer_data, len, SD_TIMEOUT, |
853 | SD_MAX_RETRIES, &data, &sshdr)) { |
854 | if (scsi_sense_valid(&sshdr)) |
855 | diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c |
856 | index e6c4321d695c..f61f8650665f 100644 |
857 | --- a/drivers/tty/tty_io.c |
858 | +++ b/drivers/tty/tty_io.c |
859 | @@ -1475,7 +1475,8 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct * |
860 | static int tty_reopen(struct tty_struct *tty) |
861 | { |
862 | struct tty_driver *driver = tty->driver; |
863 | - int retval; |
864 | + struct tty_ldisc *ld; |
865 | + int retval = 0; |
866 | |
867 | if (driver->type == TTY_DRIVER_TYPE_PTY && |
868 | driver->subtype == PTY_TYPE_MASTER) |
869 | @@ -1487,14 +1488,21 @@ static int tty_reopen(struct tty_struct *tty) |
870 | if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN)) |
871 | return -EBUSY; |
872 | |
873 | - tty->count++; |
874 | + ld = tty_ldisc_ref_wait(tty); |
875 | + if (ld) { |
876 | + tty_ldisc_deref(ld); |
877 | + } else { |
878 | + retval = tty_ldisc_lock(tty, 5 * HZ); |
879 | + if (retval) |
880 | + return retval; |
881 | |
882 | - if (tty->ldisc) |
883 | - return 0; |
884 | + if (!tty->ldisc) |
885 | + retval = tty_ldisc_reinit(tty, tty->termios.c_line); |
886 | + tty_ldisc_unlock(tty); |
887 | + } |
888 | |
889 | - retval = tty_ldisc_reinit(tty, tty->termios.c_line); |
890 | - if (retval) |
891 | - tty->count--; |
892 | + if (retval == 0) |
893 | + tty->count++; |
894 | |
895 | return retval; |
896 | } |
897 | diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c |
898 | index 1bf8ed13f827..dbd7ba32caac 100644 |
899 | --- a/drivers/tty/tty_ldsem.c |
900 | +++ b/drivers/tty/tty_ldsem.c |
901 | @@ -307,6 +307,16 @@ down_write_failed(struct ld_semaphore *sem, long count, long timeout) |
902 | if (!locked) |
903 | ldsem_atomic_update(-LDSEM_WAIT_BIAS, sem); |
904 | list_del(&waiter.list); |
905 | + |
906 | + /* |
907 | + * In case of timeout, wake up every reader who gave the right of way |
908 | + * to writer. Prevent separation readers into two groups: |
909 | + * one that helds semaphore and another that sleeps. |
910 | + * (in case of no contention with a writer) |
911 | + */ |
912 | + if (!locked && list_empty(&sem->write_wait)) |
913 | + __ldsem_wake_readers(sem); |
914 | + |
915 | raw_spin_unlock_irq(&sem->wait_lock); |
916 | |
917 | __set_task_state(tsk, TASK_RUNNING); |
918 | diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c |
919 | index a3edb20ea4c3..a846d32ee653 100644 |
920 | --- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c |
921 | +++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c |
922 | @@ -609,6 +609,8 @@ int omapfb_ioctl(struct fb_info *fbi, unsigned int cmd, unsigned long arg) |
923 | |
924 | int r = 0; |
925 | |
926 | + memset(&p, 0, sizeof(p)); |
927 | + |
928 | switch (cmd) { |
929 | case OMAPFB_SYNC_GFX: |
930 | DBG("ioctl SYNC_GFX\n"); |
931 | diff --git a/fs/block_dev.c b/fs/block_dev.c |
932 | index cb936c90ae82..8a894cd4875b 100644 |
933 | --- a/fs/block_dev.c |
934 | +++ b/fs/block_dev.c |
935 | @@ -114,6 +114,20 @@ void invalidate_bdev(struct block_device *bdev) |
936 | } |
937 | EXPORT_SYMBOL(invalidate_bdev); |
938 | |
939 | +static void set_init_blocksize(struct block_device *bdev) |
940 | +{ |
941 | + unsigned bsize = bdev_logical_block_size(bdev); |
942 | + loff_t size = i_size_read(bdev->bd_inode); |
943 | + |
944 | + while (bsize < PAGE_SIZE) { |
945 | + if (size & bsize) |
946 | + break; |
947 | + bsize <<= 1; |
948 | + } |
949 | + bdev->bd_block_size = bsize; |
950 | + bdev->bd_inode->i_blkbits = blksize_bits(bsize); |
951 | +} |
952 | + |
953 | int set_blocksize(struct block_device *bdev, int size) |
954 | { |
955 | /* Size must be a power of two, and between 512 and PAGE_SIZE */ |
956 | @@ -1209,18 +1223,9 @@ EXPORT_SYMBOL(check_disk_change); |
957 | |
958 | void bd_set_size(struct block_device *bdev, loff_t size) |
959 | { |
960 | - unsigned bsize = bdev_logical_block_size(bdev); |
961 | - |
962 | inode_lock(bdev->bd_inode); |
963 | i_size_write(bdev->bd_inode, size); |
964 | inode_unlock(bdev->bd_inode); |
965 | - while (bsize < PAGE_SIZE) { |
966 | - if (size & bsize) |
967 | - break; |
968 | - bsize <<= 1; |
969 | - } |
970 | - bdev->bd_block_size = bsize; |
971 | - bdev->bd_inode->i_blkbits = blksize_bits(bsize); |
972 | } |
973 | EXPORT_SYMBOL(bd_set_size); |
974 | |
975 | @@ -1297,8 +1302,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) |
976 | } |
977 | } |
978 | |
979 | - if (!ret) |
980 | + if (!ret) { |
981 | bd_set_size(bdev,(loff_t)get_capacity(disk)<<9); |
982 | + set_init_blocksize(bdev); |
983 | + } |
984 | |
985 | /* |
986 | * If the device is invalidated, rescan partition |
987 | @@ -1333,6 +1340,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) |
988 | goto out_clear; |
989 | } |
990 | bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9); |
991 | + set_init_blocksize(bdev); |
992 | } |
993 | } else { |
994 | if (bdev->bd_contains == bdev) { |
995 | diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c |
996 | index 77b32415d9f2..9d3352fe8dc9 100644 |
997 | --- a/fs/btrfs/disk-io.c |
998 | +++ b/fs/btrfs/disk-io.c |
999 | @@ -4193,6 +4193,14 @@ static void btrfs_destroy_all_ordered_extents(struct btrfs_fs_info *fs_info) |
1000 | spin_lock(&fs_info->ordered_root_lock); |
1001 | } |
1002 | spin_unlock(&fs_info->ordered_root_lock); |
1003 | + |
1004 | + /* |
1005 | + * We need this here because if we've been flipped read-only we won't |
1006 | + * get sync() from the umount, so we need to make sure any ordered |
1007 | + * extents that haven't had their dirty pages IO start writeout yet |
1008 | + * actually get run and error out properly. |
1009 | + */ |
1010 | + btrfs_wait_ordered_roots(fs_info, -1, 0, (u64)-1); |
1011 | } |
1012 | |
1013 | static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans, |
1014 | diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c |
1015 | index ab4cbb4be423..e59eeaf02eaa 100644 |
1016 | --- a/fs/f2fs/recovery.c |
1017 | +++ b/fs/f2fs/recovery.c |
1018 | @@ -196,32 +196,6 @@ static void recover_inode(struct inode *inode, struct page *page) |
1019 | ino_of_node(page), name); |
1020 | } |
1021 | |
1022 | -static bool is_same_inode(struct inode *inode, struct page *ipage) |
1023 | -{ |
1024 | - struct f2fs_inode *ri = F2FS_INODE(ipage); |
1025 | - struct timespec disk; |
1026 | - |
1027 | - if (!IS_INODE(ipage)) |
1028 | - return true; |
1029 | - |
1030 | - disk.tv_sec = le64_to_cpu(ri->i_ctime); |
1031 | - disk.tv_nsec = le32_to_cpu(ri->i_ctime_nsec); |
1032 | - if (timespec_compare(&inode->i_ctime, &disk) > 0) |
1033 | - return false; |
1034 | - |
1035 | - disk.tv_sec = le64_to_cpu(ri->i_atime); |
1036 | - disk.tv_nsec = le32_to_cpu(ri->i_atime_nsec); |
1037 | - if (timespec_compare(&inode->i_atime, &disk) > 0) |
1038 | - return false; |
1039 | - |
1040 | - disk.tv_sec = le64_to_cpu(ri->i_mtime); |
1041 | - disk.tv_nsec = le32_to_cpu(ri->i_mtime_nsec); |
1042 | - if (timespec_compare(&inode->i_mtime, &disk) > 0) |
1043 | - return false; |
1044 | - |
1045 | - return true; |
1046 | -} |
1047 | - |
1048 | static int find_fsync_dnodes(struct f2fs_sb_info *sbi, struct list_head *head) |
1049 | { |
1050 | struct curseg_info *curseg; |
1051 | @@ -248,10 +222,7 @@ static int find_fsync_dnodes(struct f2fs_sb_info *sbi, struct list_head *head) |
1052 | goto next; |
1053 | |
1054 | entry = get_fsync_inode(head, ino_of_node(page)); |
1055 | - if (entry) { |
1056 | - if (!is_same_inode(entry->inode, page)) |
1057 | - goto next; |
1058 | - } else { |
1059 | + if (!entry) { |
1060 | if (IS_INODE(page) && is_dent_dnode(page)) { |
1061 | err = recover_inode_page(sbi, page); |
1062 | if (err) |
1063 | diff --git a/fs/proc/array.c b/fs/proc/array.c |
1064 | index 94f83e74db24..712b44c63701 100644 |
1065 | --- a/fs/proc/array.c |
1066 | +++ b/fs/proc/array.c |
1067 | @@ -346,8 +346,9 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p) |
1068 | { |
1069 | #ifdef CONFIG_SECCOMP |
1070 | seq_put_decimal_ull(m, "Seccomp:\t", p->seccomp.mode); |
1071 | + seq_putc(m, '\n'); |
1072 | #endif |
1073 | - seq_printf(m, "\nSpeculation_Store_Bypass:\t"); |
1074 | + seq_printf(m, "Speculation_Store_Bypass:\t"); |
1075 | switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) { |
1076 | case -EINVAL: |
1077 | seq_printf(m, "unknown"); |
1078 | diff --git a/mm/memory.c b/mm/memory.c |
1079 | index f3fef1df7402..35d8217bb046 100644 |
1080 | --- a/mm/memory.c |
1081 | +++ b/mm/memory.c |
1082 | @@ -2823,6 +2823,28 @@ static int __do_fault(struct fault_env *fe, pgoff_t pgoff, |
1083 | struct vm_fault vmf; |
1084 | int ret; |
1085 | |
1086 | + /* |
1087 | + * Preallocate pte before we take page_lock because this might lead to |
1088 | + * deadlocks for memcg reclaim which waits for pages under writeback: |
1089 | + * lock_page(A) |
1090 | + * SetPageWriteback(A) |
1091 | + * unlock_page(A) |
1092 | + * lock_page(B) |
1093 | + * lock_page(B) |
1094 | + * pte_alloc_pne |
1095 | + * shrink_page_list |
1096 | + * wait_on_page_writeback(A) |
1097 | + * SetPageWriteback(B) |
1098 | + * unlock_page(B) |
1099 | + * # flush A, B to clear the writeback |
1100 | + */ |
1101 | + if (pmd_none(*fe->pmd) && !fe->prealloc_pte) { |
1102 | + fe->prealloc_pte = pte_alloc_one(vma->vm_mm, fe->address); |
1103 | + if (!fe->prealloc_pte) |
1104 | + return VM_FAULT_OOM; |
1105 | + smp_wmb(); /* See comment in __pte_alloc() */ |
1106 | + } |
1107 | + |
1108 | vmf.virtual_address = (void __user *)(fe->address & PAGE_MASK); |
1109 | vmf.pgoff = pgoff; |
1110 | vmf.flags = fe->flags; |
1111 | diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c |
1112 | index 82ce5713f744..7e42c0d1f55b 100644 |
1113 | --- a/net/bridge/br_netfilter_hooks.c |
1114 | +++ b/net/bridge/br_netfilter_hooks.c |
1115 | @@ -275,7 +275,7 @@ int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_ |
1116 | struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); |
1117 | int ret; |
1118 | |
1119 | - if (neigh->hh.hh_len) { |
1120 | + if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) { |
1121 | neigh_hh_bridge(&neigh->hh, skb); |
1122 | skb->dev = nf_bridge->physindev; |
1123 | ret = br_handle_frame_finish(net, sk, skb); |
1124 | diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c |
1125 | index 18c1f07e4f3b..c7e5aaf2eeb8 100644 |
1126 | --- a/net/bridge/netfilter/ebtables.c |
1127 | +++ b/net/bridge/netfilter/ebtables.c |
1128 | @@ -1147,14 +1147,16 @@ static int do_replace(struct net *net, const void __user *user, |
1129 | tmp.name[sizeof(tmp.name) - 1] = 0; |
1130 | |
1131 | countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; |
1132 | - newinfo = vmalloc(sizeof(*newinfo) + countersize); |
1133 | + newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT, |
1134 | + PAGE_KERNEL); |
1135 | if (!newinfo) |
1136 | return -ENOMEM; |
1137 | |
1138 | if (countersize) |
1139 | memset(newinfo->counters, 0, countersize); |
1140 | |
1141 | - newinfo->entries = vmalloc(tmp.entries_size); |
1142 | + newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT, |
1143 | + PAGE_KERNEL); |
1144 | if (!newinfo->entries) { |
1145 | ret = -ENOMEM; |
1146 | goto free_newinfo; |
1147 | diff --git a/net/can/gw.c b/net/can/gw.c |
1148 | index 77c8af4047ef..81650affa3fa 100644 |
1149 | --- a/net/can/gw.c |
1150 | +++ b/net/can/gw.c |
1151 | @@ -418,13 +418,29 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) |
1152 | while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx]) |
1153 | (*gwj->mod.modfunc[modidx++])(cf, &gwj->mod); |
1154 | |
1155 | - /* check for checksum updates when the CAN frame has been modified */ |
1156 | + /* Has the CAN frame been modified? */ |
1157 | if (modidx) { |
1158 | - if (gwj->mod.csumfunc.crc8) |
1159 | + /* get available space for the processed CAN frame type */ |
1160 | + int max_len = nskb->len - offsetof(struct can_frame, data); |
1161 | + |
1162 | + /* dlc may have changed, make sure it fits to the CAN frame */ |
1163 | + if (cf->can_dlc > max_len) |
1164 | + goto out_delete; |
1165 | + |
1166 | + /* check for checksum updates in classic CAN length only */ |
1167 | + if (gwj->mod.csumfunc.crc8) { |
1168 | + if (cf->can_dlc > 8) |
1169 | + goto out_delete; |
1170 | + |
1171 | (*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8); |
1172 | + } |
1173 | + |
1174 | + if (gwj->mod.csumfunc.xor) { |
1175 | + if (cf->can_dlc > 8) |
1176 | + goto out_delete; |
1177 | |
1178 | - if (gwj->mod.csumfunc.xor) |
1179 | (*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor); |
1180 | + } |
1181 | } |
1182 | |
1183 | /* clear the skb timestamp if not configured the other way */ |
1184 | @@ -436,6 +452,14 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) |
1185 | gwj->dropped_frames++; |
1186 | else |
1187 | gwj->handled_frames++; |
1188 | + |
1189 | + return; |
1190 | + |
1191 | + out_delete: |
1192 | + /* delete frame due to misconfiguration */ |
1193 | + gwj->deleted_frames++; |
1194 | + kfree_skb(nskb); |
1195 | + return; |
1196 | } |
1197 | |
1198 | static inline int cgw_register_filter(struct cgw_job *gwj) |
1199 | diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c |
1200 | index a5851c0bc278..e39895ea1b77 100644 |
1201 | --- a/net/ipv4/ip_sockglue.c |
1202 | +++ b/net/ipv4/ip_sockglue.c |
1203 | @@ -133,19 +133,17 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) |
1204 | |
1205 | static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) |
1206 | { |
1207 | + __be16 _ports[2], *ports; |
1208 | struct sockaddr_in sin; |
1209 | - __be16 *ports; |
1210 | - int end; |
1211 | - |
1212 | - end = skb_transport_offset(skb) + 4; |
1213 | - if (end > 0 && !pskb_may_pull(skb, end)) |
1214 | - return; |
1215 | |
1216 | /* All current transport protocols have the port numbers in the |
1217 | * first four bytes of the transport header and this function is |
1218 | * written with this assumption in mind. |
1219 | */ |
1220 | - ports = (__be16 *)skb_transport_header(skb); |
1221 | + ports = skb_header_pointer(skb, skb_transport_offset(skb), |
1222 | + sizeof(_ports), &_ports); |
1223 | + if (!ports) |
1224 | + return; |
1225 | |
1226 | sin.sin_family = AF_INET; |
1227 | sin.sin_addr.s_addr = ip_hdr(skb)->daddr; |
1228 | diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c |
1229 | index 2d3c8fe27583..956af11e9ba3 100644 |
1230 | --- a/net/ipv6/datagram.c |
1231 | +++ b/net/ipv6/datagram.c |
1232 | @@ -335,6 +335,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info) |
1233 | skb_reset_network_header(skb); |
1234 | iph = ipv6_hdr(skb); |
1235 | iph->daddr = fl6->daddr; |
1236 | + ip6_flow_hdr(iph, 0, 0); |
1237 | |
1238 | serr = SKB_EXT_ERR(skb); |
1239 | serr->ee.ee_errno = err; |
1240 | @@ -694,17 +695,15 @@ void ip6_datagram_recv_specific_ctl(struct sock *sk, struct msghdr *msg, |
1241 | } |
1242 | if (np->rxopt.bits.rxorigdstaddr) { |
1243 | struct sockaddr_in6 sin6; |
1244 | - __be16 *ports; |
1245 | - int end; |
1246 | + __be16 _ports[2], *ports; |
1247 | |
1248 | - end = skb_transport_offset(skb) + 4; |
1249 | - if (end <= 0 || pskb_may_pull(skb, end)) { |
1250 | + ports = skb_header_pointer(skb, skb_transport_offset(skb), |
1251 | + sizeof(_ports), &_ports); |
1252 | + if (ports) { |
1253 | /* All current transport protocols have the port numbers in the |
1254 | * first four bytes of the transport header and this function is |
1255 | * written with this assumption in mind. |
1256 | */ |
1257 | - ports = (__be16 *)skb_transport_header(skb); |
1258 | - |
1259 | sin6.sin6_family = AF_INET6; |
1260 | sin6.sin6_addr = ipv6_hdr(skb)->daddr; |
1261 | sin6.sin6_port = ports[1]; |
1262 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
1263 | index a9d0358d4f3b..82e222cd4845 100644 |
1264 | --- a/net/packet/af_packet.c |
1265 | +++ b/net/packet/af_packet.c |
1266 | @@ -2663,7 +2663,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) |
1267 | addr = saddr->sll_halen ? saddr->sll_addr : NULL; |
1268 | dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); |
1269 | if (addr && dev && saddr->sll_halen < dev->addr_len) |
1270 | - goto out; |
1271 | + goto out_put; |
1272 | } |
1273 | |
1274 | err = -ENXIO; |
1275 | @@ -2862,7 +2862,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
1276 | addr = saddr->sll_halen ? saddr->sll_addr : NULL; |
1277 | dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); |
1278 | if (addr && dev && saddr->sll_halen < dev->addr_len) |
1279 | - goto out; |
1280 | + goto out_unlock; |
1281 | } |
1282 | |
1283 | err = -ENXIO; |
1284 | diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c |
1285 | index e7866d47934d..31f461f955ec 100644 |
1286 | --- a/net/sctp/ipv6.c |
1287 | +++ b/net/sctp/ipv6.c |
1288 | @@ -97,11 +97,9 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev, |
1289 | |
1290 | switch (ev) { |
1291 | case NETDEV_UP: |
1292 | - addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC); |
1293 | + addr = kzalloc(sizeof(*addr), GFP_ATOMIC); |
1294 | if (addr) { |
1295 | addr->a.v6.sin6_family = AF_INET6; |
1296 | - addr->a.v6.sin6_port = 0; |
1297 | - addr->a.v6.sin6_flowinfo = 0; |
1298 | addr->a.v6.sin6_addr = ifa->addr; |
1299 | addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex; |
1300 | addr->valid = 1; |
1301 | @@ -413,7 +411,6 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist, |
1302 | addr = kzalloc(sizeof(*addr), GFP_ATOMIC); |
1303 | if (addr) { |
1304 | addr->a.v6.sin6_family = AF_INET6; |
1305 | - addr->a.v6.sin6_port = 0; |
1306 | addr->a.v6.sin6_addr = ifp->addr; |
1307 | addr->a.v6.sin6_scope_id = dev->ifindex; |
1308 | addr->valid = 1; |
1309 | diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c |
1310 | index fb7b7632316a..8ea8217db960 100644 |
1311 | --- a/net/sctp/protocol.c |
1312 | +++ b/net/sctp/protocol.c |
1313 | @@ -151,7 +151,6 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist, |
1314 | addr = kzalloc(sizeof(*addr), GFP_ATOMIC); |
1315 | if (addr) { |
1316 | addr->a.v4.sin_family = AF_INET; |
1317 | - addr->a.v4.sin_port = 0; |
1318 | addr->a.v4.sin_addr.s_addr = ifa->ifa_local; |
1319 | addr->valid = 1; |
1320 | INIT_LIST_HEAD(&addr->list); |
1321 | @@ -777,10 +776,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev, |
1322 | |
1323 | switch (ev) { |
1324 | case NETDEV_UP: |
1325 | - addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC); |
1326 | + addr = kzalloc(sizeof(*addr), GFP_ATOMIC); |
1327 | if (addr) { |
1328 | addr->a.v4.sin_family = AF_INET; |
1329 | - addr->a.v4.sin_port = 0; |
1330 | addr->a.v4.sin_addr.s_addr = ifa->ifa_local; |
1331 | addr->valid = 1; |
1332 | spin_lock_bh(&net->sctp.local_addr_lock); |
1333 | diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c |
1334 | index 5b30603596d0..eafc78e063f1 100644 |
1335 | --- a/net/sunrpc/rpcb_clnt.c |
1336 | +++ b/net/sunrpc/rpcb_clnt.c |
1337 | @@ -770,6 +770,12 @@ void rpcb_getport_async(struct rpc_task *task) |
1338 | case RPCBVERS_3: |
1339 | map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID]; |
1340 | map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC); |
1341 | + if (!map->r_addr) { |
1342 | + status = -ENOMEM; |
1343 | + dprintk("RPC: %5u %s: no memory available\n", |
1344 | + task->tk_pid, __func__); |
1345 | + goto bailout_free_args; |
1346 | + } |
1347 | map->r_owner = ""; |
1348 | break; |
1349 | case RPCBVERS_2: |
1350 | @@ -792,6 +798,8 @@ void rpcb_getport_async(struct rpc_task *task) |
1351 | rpc_put_task(child); |
1352 | return; |
1353 | |
1354 | +bailout_free_args: |
1355 | + kfree(map); |
1356 | bailout_release_client: |
1357 | rpc_release_client(rpcb_clnt); |
1358 | bailout_nofree: |
1359 | diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c |
1360 | index aedc476fac02..d947b8210399 100644 |
1361 | --- a/net/tipc/netlink_compat.c |
1362 | +++ b/net/tipc/netlink_compat.c |
1363 | @@ -87,6 +87,11 @@ static int tipc_skb_tailroom(struct sk_buff *skb) |
1364 | return limit; |
1365 | } |
1366 | |
1367 | +static inline int TLV_GET_DATA_LEN(struct tlv_desc *tlv) |
1368 | +{ |
1369 | + return TLV_GET_LEN(tlv) - TLV_SPACE(0); |
1370 | +} |
1371 | + |
1372 | static int tipc_add_tlv(struct sk_buff *skb, u16 type, void *data, u16 len) |
1373 | { |
1374 | struct tlv_desc *tlv = (struct tlv_desc *)skb_tail_pointer(skb); |
1375 | @@ -166,6 +171,11 @@ static struct sk_buff *tipc_get_err_tlv(char *str) |
1376 | return buf; |
1377 | } |
1378 | |
1379 | +static inline bool string_is_valid(char *s, int len) |
1380 | +{ |
1381 | + return memchr(s, '\0', len) ? true : false; |
1382 | +} |
1383 | + |
1384 | static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, |
1385 | struct tipc_nl_compat_msg *msg, |
1386 | struct sk_buff *arg) |
1387 | @@ -370,6 +380,7 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd, |
1388 | struct nlattr *prop; |
1389 | struct nlattr *bearer; |
1390 | struct tipc_bearer_config *b; |
1391 | + int len; |
1392 | |
1393 | b = (struct tipc_bearer_config *)TLV_DATA(msg->req); |
1394 | |
1395 | @@ -377,6 +388,10 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd, |
1396 | if (!bearer) |
1397 | return -EMSGSIZE; |
1398 | |
1399 | + len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME); |
1400 | + if (!string_is_valid(b->name, len)) |
1401 | + return -EINVAL; |
1402 | + |
1403 | if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, b->name)) |
1404 | return -EMSGSIZE; |
1405 | |
1406 | @@ -402,6 +417,7 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd, |
1407 | { |
1408 | char *name; |
1409 | struct nlattr *bearer; |
1410 | + int len; |
1411 | |
1412 | name = (char *)TLV_DATA(msg->req); |
1413 | |
1414 | @@ -409,6 +425,10 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd, |
1415 | if (!bearer) |
1416 | return -EMSGSIZE; |
1417 | |
1418 | + len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME); |
1419 | + if (!string_is_valid(name, len)) |
1420 | + return -EINVAL; |
1421 | + |
1422 | if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, name)) |
1423 | return -EMSGSIZE; |
1424 | |
1425 | @@ -469,6 +489,7 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, |
1426 | struct nlattr *prop[TIPC_NLA_PROP_MAX + 1]; |
1427 | struct nlattr *stats[TIPC_NLA_STATS_MAX + 1]; |
1428 | int err; |
1429 | + int len; |
1430 | |
1431 | if (!attrs[TIPC_NLA_LINK]) |
1432 | return -EINVAL; |
1433 | @@ -495,6 +516,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, |
1434 | return err; |
1435 | |
1436 | name = (char *)TLV_DATA(msg->req); |
1437 | + |
1438 | + len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); |
1439 | + if (!string_is_valid(name, len)) |
1440 | + return -EINVAL; |
1441 | + |
1442 | if (strcmp(name, nla_data(link[TIPC_NLA_LINK_NAME])) != 0) |
1443 | return 0; |
1444 | |
1445 | @@ -635,6 +661,7 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb, |
1446 | struct nlattr *prop; |
1447 | struct nlattr *media; |
1448 | struct tipc_link_config *lc; |
1449 | + int len; |
1450 | |
1451 | lc = (struct tipc_link_config *)TLV_DATA(msg->req); |
1452 | |
1453 | @@ -642,6 +669,10 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb, |
1454 | if (!media) |
1455 | return -EMSGSIZE; |
1456 | |
1457 | + len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME); |
1458 | + if (!string_is_valid(lc->name, len)) |
1459 | + return -EINVAL; |
1460 | + |
1461 | if (nla_put_string(skb, TIPC_NLA_MEDIA_NAME, lc->name)) |
1462 | return -EMSGSIZE; |
1463 | |
1464 | @@ -662,6 +693,7 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb, |
1465 | struct nlattr *prop; |
1466 | struct nlattr *bearer; |
1467 | struct tipc_link_config *lc; |
1468 | + int len; |
1469 | |
1470 | lc = (struct tipc_link_config *)TLV_DATA(msg->req); |
1471 | |
1472 | @@ -669,6 +701,10 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb, |
1473 | if (!bearer) |
1474 | return -EMSGSIZE; |
1475 | |
1476 | + len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME); |
1477 | + if (!string_is_valid(lc->name, len)) |
1478 | + return -EINVAL; |
1479 | + |
1480 | if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, lc->name)) |
1481 | return -EMSGSIZE; |
1482 | |
1483 | @@ -717,9 +753,14 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd, |
1484 | struct tipc_link_config *lc; |
1485 | struct tipc_bearer *bearer; |
1486 | struct tipc_media *media; |
1487 | + int len; |
1488 | |
1489 | lc = (struct tipc_link_config *)TLV_DATA(msg->req); |
1490 | |
1491 | + len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); |
1492 | + if (!string_is_valid(lc->name, len)) |
1493 | + return -EINVAL; |
1494 | + |
1495 | media = tipc_media_find(lc->name); |
1496 | if (media) { |
1497 | cmd->doit = &tipc_nl_media_set; |
1498 | @@ -741,6 +782,7 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, |
1499 | { |
1500 | char *name; |
1501 | struct nlattr *link; |
1502 | + int len; |
1503 | |
1504 | name = (char *)TLV_DATA(msg->req); |
1505 | |
1506 | @@ -748,6 +790,10 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, |
1507 | if (!link) |
1508 | return -EMSGSIZE; |
1509 | |
1510 | + len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); |
1511 | + if (!string_is_valid(name, len)) |
1512 | + return -EINVAL; |
1513 | + |
1514 | if (nla_put_string(skb, TIPC_NLA_LINK_NAME, name)) |
1515 | return -EMSGSIZE; |
1516 | |
1517 | @@ -769,6 +815,8 @@ static int tipc_nl_compat_name_table_dump_header(struct tipc_nl_compat_msg *msg) |
1518 | }; |
1519 | |
1520 | ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req); |
1521 | + if (TLV_GET_DATA_LEN(msg->req) < sizeof(struct tipc_name_table_query)) |
1522 | + return -EINVAL; |
1523 | |
1524 | depth = ntohl(ntq->depth); |
1525 | |
1526 | @@ -1192,7 +1240,7 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info) |
1527 | } |
1528 | |
1529 | len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN); |
1530 | - if (len && !TLV_OK(msg.req, len)) { |
1531 | + if (!len || !TLV_OK(msg.req, len)) { |
1532 | msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED); |
1533 | err = -EOPNOTSUPP; |
1534 | goto send; |
1535 | diff --git a/security/security.c b/security/security.c |
1536 | index f825304f04a7..112df16be770 100644 |
1537 | --- a/security/security.c |
1538 | +++ b/security/security.c |
1539 | @@ -904,6 +904,13 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) |
1540 | |
1541 | void security_cred_free(struct cred *cred) |
1542 | { |
1543 | + /* |
1544 | + * There is a failure case in prepare_creds() that |
1545 | + * may result in a call here with ->security being NULL. |
1546 | + */ |
1547 | + if (unlikely(cred->security == NULL)) |
1548 | + return; |
1549 | + |
1550 | call_void_hook(cred_free, cred); |
1551 | } |
1552 | |
1553 | diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c |
1554 | index 175e4dce58df..c483de590ba3 100644 |
1555 | --- a/security/selinux/ss/policydb.c |
1556 | +++ b/security/selinux/ss/policydb.c |
1557 | @@ -726,7 +726,8 @@ static int sens_destroy(void *key, void *datum, void *p) |
1558 | kfree(key); |
1559 | if (datum) { |
1560 | levdatum = datum; |
1561 | - ebitmap_destroy(&levdatum->level->cat); |
1562 | + if (levdatum->level) |
1563 | + ebitmap_destroy(&levdatum->level->cat); |
1564 | kfree(levdatum->level); |
1565 | } |
1566 | kfree(datum); |
1567 | diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c |
1568 | index 0309f2111c70..5367f854fadc 100644 |
1569 | --- a/security/yama/yama_lsm.c |
1570 | +++ b/security/yama/yama_lsm.c |
1571 | @@ -359,7 +359,9 @@ static int yama_ptrace_access_check(struct task_struct *child, |
1572 | break; |
1573 | case YAMA_SCOPE_RELATIONAL: |
1574 | rcu_read_lock(); |
1575 | - if (!task_is_descendant(current, child) && |
1576 | + if (!pid_alive(child)) |
1577 | + rc = -EPERM; |
1578 | + if (!rc && !task_is_descendant(current, child) && |
1579 | !ptracer_exception_found(current, child) && |
1580 | !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE)) |
1581 | rc = -EPERM; |