Annotation of /trunk/kernel-alx/patches-4.9/0266-4.9.167-all-fixes.patch
Parent Directory | Revision Log
Revision 3343 -
(hide annotations)
(download)
Tue Jun 18 09:41:57 2019 UTC (5 years ago) by niro
File size: 64432 byte(s)
Tue Jun 18 09:41:57 2019 UTC (5 years ago) by niro
File size: 64432 byte(s)
-linux-4.9.167
1 | niro | 3343 | diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt |
2 | index 3ff58a8ffabb..d1908e50b506 100644 | ||
3 | --- a/Documentation/virtual/kvm/api.txt | ||
4 | +++ b/Documentation/virtual/kvm/api.txt | ||
5 | @@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes | ||
6 | |||
7 | - VM ioctls: These query and set attributes that affect an entire virtual | ||
8 | machine, for example memory layout. In addition a VM ioctl is used to | ||
9 | - create virtual cpus (vcpus). | ||
10 | + create virtual cpus (vcpus) and devices. | ||
11 | |||
12 | Only run VM ioctls from the same process (address space) that was used | ||
13 | to create the VM. | ||
14 | @@ -24,6 +24,11 @@ of a virtual machine. The ioctls belong to three classes | ||
15 | Only run vcpu ioctls from the same thread that was used to create the | ||
16 | vcpu. | ||
17 | |||
18 | + - device ioctls: These query and set attributes that control the operation | ||
19 | + of a single device. | ||
20 | + | ||
21 | + device ioctls must be issued from the same process (address space) that | ||
22 | + was used to create the VM. | ||
23 | |||
24 | 2. File descriptors | ||
25 | ------------------- | ||
26 | @@ -32,10 +37,11 @@ The kvm API is centered around file descriptors. An initial | ||
27 | open("/dev/kvm") obtains a handle to the kvm subsystem; this handle | ||
28 | can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this | ||
29 | handle will create a VM file descriptor which can be used to issue VM | ||
30 | -ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu | ||
31 | -and return a file descriptor pointing to it. Finally, ioctls on a vcpu | ||
32 | -fd can be used to control the vcpu, including the important task of | ||
33 | -actually running guest code. | ||
34 | +ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will | ||
35 | +create a virtual cpu or device and return a file descriptor pointing to | ||
36 | +the new resource. Finally, ioctls on a vcpu or device fd can be used | ||
37 | +to control the vcpu or device. For vcpus, this includes the important | ||
38 | +task of actually running guest code. | ||
39 | |||
40 | In general file descriptors can be migrated among processes by means | ||
41 | of fork() and the SCM_RIGHTS facility of unix domain socket. These | ||
42 | diff --git a/Makefile b/Makefile | ||
43 | index 90478086eff5..2f030baeb162 100644 | ||
44 | --- a/Makefile | ||
45 | +++ b/Makefile | ||
46 | @@ -1,6 +1,6 @@ | ||
47 | VERSION = 4 | ||
48 | PATCHLEVEL = 9 | ||
49 | -SUBLEVEL = 166 | ||
50 | +SUBLEVEL = 167 | ||
51 | EXTRAVERSION = | ||
52 | NAME = Roaring Lionus | ||
53 | |||
54 | diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c b/arch/arm/mach-imx/cpuidle-imx6q.c | ||
55 | index bfeb25aaf9a2..326e870d7123 100644 | ||
56 | --- a/arch/arm/mach-imx/cpuidle-imx6q.c | ||
57 | +++ b/arch/arm/mach-imx/cpuidle-imx6q.c | ||
58 | @@ -16,30 +16,23 @@ | ||
59 | #include "cpuidle.h" | ||
60 | #include "hardware.h" | ||
61 | |||
62 | -static atomic_t master = ATOMIC_INIT(0); | ||
63 | -static DEFINE_SPINLOCK(master_lock); | ||
64 | +static int num_idle_cpus = 0; | ||
65 | +static DEFINE_SPINLOCK(cpuidle_lock); | ||
66 | |||
67 | static int imx6q_enter_wait(struct cpuidle_device *dev, | ||
68 | struct cpuidle_driver *drv, int index) | ||
69 | { | ||
70 | - if (atomic_inc_return(&master) == num_online_cpus()) { | ||
71 | - /* | ||
72 | - * With this lock, we prevent other cpu to exit and enter | ||
73 | - * this function again and become the master. | ||
74 | - */ | ||
75 | - if (!spin_trylock(&master_lock)) | ||
76 | - goto idle; | ||
77 | + spin_lock(&cpuidle_lock); | ||
78 | + if (++num_idle_cpus == num_online_cpus()) | ||
79 | imx6_set_lpm(WAIT_UNCLOCKED); | ||
80 | - cpu_do_idle(); | ||
81 | - imx6_set_lpm(WAIT_CLOCKED); | ||
82 | - spin_unlock(&master_lock); | ||
83 | - goto done; | ||
84 | - } | ||
85 | + spin_unlock(&cpuidle_lock); | ||
86 | |||
87 | -idle: | ||
88 | cpu_do_idle(); | ||
89 | -done: | ||
90 | - atomic_dec(&master); | ||
91 | + | ||
92 | + spin_lock(&cpuidle_lock); | ||
93 | + if (num_idle_cpus-- == num_online_cpus()) | ||
94 | + imx6_set_lpm(WAIT_CLOCKED); | ||
95 | + spin_unlock(&cpuidle_lock); | ||
96 | |||
97 | return index; | ||
98 | } | ||
99 | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig | ||
100 | index 3e43874568f9..2eb8ae1b2d03 100644 | ||
101 | --- a/arch/arm64/Kconfig | ||
102 | +++ b/arch/arm64/Kconfig | ||
103 | @@ -1079,6 +1079,10 @@ config SYSVIPC_COMPAT | ||
104 | def_bool y | ||
105 | depends on COMPAT && SYSVIPC | ||
106 | |||
107 | +config KEYS_COMPAT | ||
108 | + def_bool y | ||
109 | + depends on COMPAT && KEYS | ||
110 | + | ||
111 | endmenu | ||
112 | |||
113 | menu "Power management options" | ||
114 | diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h | ||
115 | index c4ced1d01d57..48e8f1f14872 100644 | ||
116 | --- a/arch/powerpc/include/asm/ppc-opcode.h | ||
117 | +++ b/arch/powerpc/include/asm/ppc-opcode.h | ||
118 | @@ -225,6 +225,7 @@ | ||
119 | /* Misc instructions for BPF compiler */ | ||
120 | #define PPC_INST_LBZ 0x88000000 | ||
121 | #define PPC_INST_LD 0xe8000000 | ||
122 | +#define PPC_INST_LDX 0x7c00002a | ||
123 | #define PPC_INST_LHZ 0xa0000000 | ||
124 | #define PPC_INST_LWZ 0x80000000 | ||
125 | #define PPC_INST_LHBRX 0x7c00062c | ||
126 | @@ -232,6 +233,7 @@ | ||
127 | #define PPC_INST_STB 0x98000000 | ||
128 | #define PPC_INST_STH 0xb0000000 | ||
129 | #define PPC_INST_STD 0xf8000000 | ||
130 | +#define PPC_INST_STDX 0x7c00012a | ||
131 | #define PPC_INST_STDU 0xf8000001 | ||
132 | #define PPC_INST_STW 0x90000000 | ||
133 | #define PPC_INST_STWU 0x94000000 | ||
134 | diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h | ||
135 | index 89f70073dec8..7b1d1721a26a 100644 | ||
136 | --- a/arch/powerpc/net/bpf_jit.h | ||
137 | +++ b/arch/powerpc/net/bpf_jit.h | ||
138 | @@ -51,6 +51,8 @@ | ||
139 | #define PPC_LIS(r, i) PPC_ADDIS(r, 0, i) | ||
140 | #define PPC_STD(r, base, i) EMIT(PPC_INST_STD | ___PPC_RS(r) | \ | ||
141 | ___PPC_RA(base) | ((i) & 0xfffc)) | ||
142 | +#define PPC_STDX(r, base, b) EMIT(PPC_INST_STDX | ___PPC_RS(r) | \ | ||
143 | + ___PPC_RA(base) | ___PPC_RB(b)) | ||
144 | #define PPC_STDU(r, base, i) EMIT(PPC_INST_STDU | ___PPC_RS(r) | \ | ||
145 | ___PPC_RA(base) | ((i) & 0xfffc)) | ||
146 | #define PPC_STW(r, base, i) EMIT(PPC_INST_STW | ___PPC_RS(r) | \ | ||
147 | @@ -65,7 +67,9 @@ | ||
148 | #define PPC_LBZ(r, base, i) EMIT(PPC_INST_LBZ | ___PPC_RT(r) | \ | ||
149 | ___PPC_RA(base) | IMM_L(i)) | ||
150 | #define PPC_LD(r, base, i) EMIT(PPC_INST_LD | ___PPC_RT(r) | \ | ||
151 | - ___PPC_RA(base) | IMM_L(i)) | ||
152 | + ___PPC_RA(base) | ((i) & 0xfffc)) | ||
153 | +#define PPC_LDX(r, base, b) EMIT(PPC_INST_LDX | ___PPC_RT(r) | \ | ||
154 | + ___PPC_RA(base) | ___PPC_RB(b)) | ||
155 | #define PPC_LWZ(r, base, i) EMIT(PPC_INST_LWZ | ___PPC_RT(r) | \ | ||
156 | ___PPC_RA(base) | IMM_L(i)) | ||
157 | #define PPC_LHZ(r, base, i) EMIT(PPC_INST_LHZ | ___PPC_RT(r) | \ | ||
158 | @@ -85,17 +89,6 @@ | ||
159 | ___PPC_RA(a) | ___PPC_RB(b)) | ||
160 | #define PPC_BPF_STDCX(s, a, b) EMIT(PPC_INST_STDCX | ___PPC_RS(s) | \ | ||
161 | ___PPC_RA(a) | ___PPC_RB(b)) | ||
162 | - | ||
163 | -#ifdef CONFIG_PPC64 | ||
164 | -#define PPC_BPF_LL(r, base, i) do { PPC_LD(r, base, i); } while(0) | ||
165 | -#define PPC_BPF_STL(r, base, i) do { PPC_STD(r, base, i); } while(0) | ||
166 | -#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0) | ||
167 | -#else | ||
168 | -#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0) | ||
169 | -#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0) | ||
170 | -#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0) | ||
171 | -#endif | ||
172 | - | ||
173 | #define PPC_CMPWI(a, i) EMIT(PPC_INST_CMPWI | ___PPC_RA(a) | IMM_L(i)) | ||
174 | #define PPC_CMPDI(a, i) EMIT(PPC_INST_CMPDI | ___PPC_RA(a) | IMM_L(i)) | ||
175 | #define PPC_CMPW(a, b) EMIT(PPC_INST_CMPW | ___PPC_RA(a) | \ | ||
176 | diff --git a/arch/powerpc/net/bpf_jit32.h b/arch/powerpc/net/bpf_jit32.h | ||
177 | index a8cd7e289ecd..81a9045d8410 100644 | ||
178 | --- a/arch/powerpc/net/bpf_jit32.h | ||
179 | +++ b/arch/powerpc/net/bpf_jit32.h | ||
180 | @@ -122,6 +122,10 @@ DECLARE_LOAD_FUNC(sk_load_byte_msh); | ||
181 | #define PPC_NTOHS_OFFS(r, base, i) PPC_LHZ_OFFS(r, base, i) | ||
182 | #endif | ||
183 | |||
184 | +#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0) | ||
185 | +#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0) | ||
186 | +#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0) | ||
187 | + | ||
188 | #define SEEN_DATAREF 0x10000 /* might call external helpers */ | ||
189 | #define SEEN_XREG 0x20000 /* X reg is used */ | ||
190 | #define SEEN_MEM 0x40000 /* SEEN_MEM+(1<<n) = use mem[n] for temporary | ||
191 | diff --git a/arch/powerpc/net/bpf_jit64.h b/arch/powerpc/net/bpf_jit64.h | ||
192 | index 62fa7589db2b..bb944b6018d7 100644 | ||
193 | --- a/arch/powerpc/net/bpf_jit64.h | ||
194 | +++ b/arch/powerpc/net/bpf_jit64.h | ||
195 | @@ -86,6 +86,26 @@ DECLARE_LOAD_FUNC(sk_load_byte); | ||
196 | (imm >= SKF_LL_OFF ? func##_negative_offset : func) : \ | ||
197 | func##_positive_offset) | ||
198 | |||
199 | +/* | ||
200 | + * WARNING: These can use TMP_REG_2 if the offset is not at word boundary, | ||
201 | + * so ensure that it isn't in use already. | ||
202 | + */ | ||
203 | +#define PPC_BPF_LL(r, base, i) do { \ | ||
204 | + if ((i) % 4) { \ | ||
205 | + PPC_LI(b2p[TMP_REG_2], (i)); \ | ||
206 | + PPC_LDX(r, base, b2p[TMP_REG_2]); \ | ||
207 | + } else \ | ||
208 | + PPC_LD(r, base, i); \ | ||
209 | + } while(0) | ||
210 | +#define PPC_BPF_STL(r, base, i) do { \ | ||
211 | + if ((i) % 4) { \ | ||
212 | + PPC_LI(b2p[TMP_REG_2], (i)); \ | ||
213 | + PPC_STDX(r, base, b2p[TMP_REG_2]); \ | ||
214 | + } else \ | ||
215 | + PPC_STD(r, base, i); \ | ||
216 | + } while(0) | ||
217 | +#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0) | ||
218 | + | ||
219 | #define SEEN_FUNC 0x1000 /* might call external helpers */ | ||
220 | #define SEEN_STACK 0x2000 /* uses BPF stack */ | ||
221 | #define SEEN_SKB 0x4000 /* uses sk_buff */ | ||
222 | diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c | ||
223 | index bdbbc320b006..e7d78f9156ce 100644 | ||
224 | --- a/arch/powerpc/net/bpf_jit_comp64.c | ||
225 | +++ b/arch/powerpc/net/bpf_jit_comp64.c | ||
226 | @@ -265,7 +265,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 | ||
227 | * if (tail_call_cnt > MAX_TAIL_CALL_CNT) | ||
228 | * goto out; | ||
229 | */ | ||
230 | - PPC_LD(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx)); | ||
231 | + PPC_BPF_LL(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx)); | ||
232 | PPC_CMPLWI(b2p[TMP_REG_1], MAX_TAIL_CALL_CNT); | ||
233 | PPC_BCC(COND_GT, out); | ||
234 | |||
235 | @@ -278,7 +278,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 | ||
236 | /* prog = array->ptrs[index]; */ | ||
237 | PPC_MULI(b2p[TMP_REG_1], b2p_index, 8); | ||
238 | PPC_ADD(b2p[TMP_REG_1], b2p[TMP_REG_1], b2p_bpf_array); | ||
239 | - PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs)); | ||
240 | + PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs)); | ||
241 | |||
242 | /* | ||
243 | * if (prog == NULL) | ||
244 | @@ -288,7 +288,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 | ||
245 | PPC_BCC(COND_EQ, out); | ||
246 | |||
247 | /* goto *(prog->bpf_func + prologue_size); */ | ||
248 | - PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func)); | ||
249 | + PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func)); | ||
250 | #ifdef PPC64_ELF_ABI_v1 | ||
251 | /* skip past the function descriptor */ | ||
252 | PPC_ADDI(b2p[TMP_REG_1], b2p[TMP_REG_1], | ||
253 | @@ -620,7 +620,7 @@ bpf_alu32_trunc: | ||
254 | * the instructions generated will remain the | ||
255 | * same across all passes | ||
256 | */ | ||
257 | - PPC_STD(dst_reg, 1, bpf_jit_stack_local(ctx)); | ||
258 | + PPC_BPF_STL(dst_reg, 1, bpf_jit_stack_local(ctx)); | ||
259 | PPC_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx)); | ||
260 | PPC_LDBRX(dst_reg, 0, b2p[TMP_REG_1]); | ||
261 | break; | ||
262 | @@ -676,7 +676,7 @@ emit_clear: | ||
263 | PPC_LI32(b2p[TMP_REG_1], imm); | ||
264 | src_reg = b2p[TMP_REG_1]; | ||
265 | } | ||
266 | - PPC_STD(src_reg, dst_reg, off); | ||
267 | + PPC_BPF_STL(src_reg, dst_reg, off); | ||
268 | break; | ||
269 | |||
270 | /* | ||
271 | @@ -723,7 +723,7 @@ emit_clear: | ||
272 | break; | ||
273 | /* dst = *(u64 *)(ul) (src + off) */ | ||
274 | case BPF_LDX | BPF_MEM | BPF_DW: | ||
275 | - PPC_LD(dst_reg, src_reg, off); | ||
276 | + PPC_BPF_LL(dst_reg, src_reg, off); | ||
277 | break; | ||
278 | |||
279 | /* | ||
280 | diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig | ||
281 | index e31001ec4c07..5a4591ff8407 100644 | ||
282 | --- a/arch/x86/Kconfig | ||
283 | +++ b/arch/x86/Kconfig | ||
284 | @@ -2051,14 +2051,8 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING | ||
285 | If unsure, leave at the default value. | ||
286 | |||
287 | config HOTPLUG_CPU | ||
288 | - bool "Support for hot-pluggable CPUs" | ||
289 | + def_bool y | ||
290 | depends on SMP | ||
291 | - ---help--- | ||
292 | - Say Y here to allow turning CPUs off and on. CPUs can be | ||
293 | - controlled through /sys/devices/system/cpu. | ||
294 | - ( Note: power management support will enable this option | ||
295 | - automatically on SMP systems. ) | ||
296 | - Say N if you want to disable CPU hotplug. | ||
297 | |||
298 | config BOOTPARAM_HOTPLUG_CPU0 | ||
299 | bool "Set default setting of cpu0_hotpluggable" | ||
300 | diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h | ||
301 | index 9a8167b175d5..83b5b2990b49 100644 | ||
302 | --- a/arch/x86/include/asm/kvm_host.h | ||
303 | +++ b/arch/x86/include/asm/kvm_host.h | ||
304 | @@ -487,6 +487,7 @@ struct kvm_vcpu_arch { | ||
305 | bool tpr_access_reporting; | ||
306 | u64 ia32_xss; | ||
307 | u64 microcode_version; | ||
308 | + u64 arch_capabilities; | ||
309 | |||
310 | /* | ||
311 | * Paging state of the vcpu | ||
312 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c | ||
313 | index a34fb7284024..75466d9417b8 100644 | ||
314 | --- a/arch/x86/kvm/vmx.c | ||
315 | +++ b/arch/x86/kvm/vmx.c | ||
316 | @@ -714,7 +714,6 @@ struct vcpu_vmx { | ||
317 | u64 msr_guest_kernel_gs_base; | ||
318 | #endif | ||
319 | |||
320 | - u64 arch_capabilities; | ||
321 | u64 spec_ctrl; | ||
322 | |||
323 | u32 vm_entry_controls_shadow; | ||
324 | @@ -3209,12 +3208,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) | ||
325 | |||
326 | msr_info->data = to_vmx(vcpu)->spec_ctrl; | ||
327 | break; | ||
328 | - case MSR_IA32_ARCH_CAPABILITIES: | ||
329 | - if (!msr_info->host_initiated && | ||
330 | - !guest_cpuid_has_arch_capabilities(vcpu)) | ||
331 | - return 1; | ||
332 | - msr_info->data = to_vmx(vcpu)->arch_capabilities; | ||
333 | - break; | ||
334 | case MSR_IA32_SYSENTER_CS: | ||
335 | msr_info->data = vmcs_read32(GUEST_SYSENTER_CS); | ||
336 | break; | ||
337 | @@ -3376,11 +3369,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) | ||
338 | vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, | ||
339 | MSR_TYPE_W); | ||
340 | break; | ||
341 | - case MSR_IA32_ARCH_CAPABILITIES: | ||
342 | - if (!msr_info->host_initiated) | ||
343 | - return 1; | ||
344 | - vmx->arch_capabilities = data; | ||
345 | - break; | ||
346 | case MSR_IA32_CR_PAT: | ||
347 | if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { | ||
348 | if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data)) | ||
349 | @@ -5468,8 +5456,6 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) | ||
350 | ++vmx->nmsrs; | ||
351 | } | ||
352 | |||
353 | - vmx->arch_capabilities = kvm_get_arch_capabilities(); | ||
354 | - | ||
355 | vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl); | ||
356 | |||
357 | /* 22.2.1, 20.8.1 */ | ||
358 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c | ||
359 | index a29df9ccbfde..8285142556b5 100644 | ||
360 | --- a/arch/x86/kvm/x86.c | ||
361 | +++ b/arch/x86/kvm/x86.c | ||
362 | @@ -2197,6 +2197,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) | ||
363 | if (msr_info->host_initiated) | ||
364 | vcpu->arch.microcode_version = data; | ||
365 | break; | ||
366 | + case MSR_IA32_ARCH_CAPABILITIES: | ||
367 | + if (!msr_info->host_initiated) | ||
368 | + return 1; | ||
369 | + vcpu->arch.arch_capabilities = data; | ||
370 | + break; | ||
371 | case MSR_EFER: | ||
372 | return set_efer(vcpu, data); | ||
373 | case MSR_K7_HWCR: | ||
374 | @@ -2473,6 +2478,12 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) | ||
375 | case MSR_IA32_UCODE_REV: | ||
376 | msr_info->data = vcpu->arch.microcode_version; | ||
377 | break; | ||
378 | + case MSR_IA32_ARCH_CAPABILITIES: | ||
379 | + if (!msr_info->host_initiated && | ||
380 | + !guest_cpuid_has_arch_capabilities(vcpu)) | ||
381 | + return 1; | ||
382 | + msr_info->data = vcpu->arch.arch_capabilities; | ||
383 | + break; | ||
384 | case MSR_MTRRcap: | ||
385 | case 0x200 ... 0x2ff: | ||
386 | return kvm_mtrr_get_msr(vcpu, msr_info->index, &msr_info->data); | ||
387 | @@ -7672,6 +7683,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu) | ||
388 | { | ||
389 | int r; | ||
390 | |||
391 | + vcpu->arch.arch_capabilities = kvm_get_arch_capabilities(); | ||
392 | kvm_vcpu_mtrr_init(vcpu); | ||
393 | r = vcpu_load(vcpu); | ||
394 | if (r) | ||
395 | diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c | ||
396 | index 8ff7b0d3eac6..3b68c03a281d 100644 | ||
397 | --- a/drivers/gpio/gpio-adnp.c | ||
398 | +++ b/drivers/gpio/gpio-adnp.c | ||
399 | @@ -132,8 +132,10 @@ static int adnp_gpio_direction_input(struct gpio_chip *chip, unsigned offset) | ||
400 | if (err < 0) | ||
401 | goto out; | ||
402 | |||
403 | - if (err & BIT(pos)) | ||
404 | - err = -EACCES; | ||
405 | + if (value & BIT(pos)) { | ||
406 | + err = -EPERM; | ||
407 | + goto out; | ||
408 | + } | ||
409 | |||
410 | err = 0; | ||
411 | |||
412 | diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c | ||
413 | index 480c2d7794eb..8feb8e9e29a6 100644 | ||
414 | --- a/drivers/isdn/hardware/mISDN/hfcmulti.c | ||
415 | +++ b/drivers/isdn/hardware/mISDN/hfcmulti.c | ||
416 | @@ -4370,7 +4370,8 @@ setup_pci(struct hfc_multi *hc, struct pci_dev *pdev, | ||
417 | if (m->clock2) | ||
418 | test_and_set_bit(HFC_CHIP_CLOCK2, &hc->chip); | ||
419 | |||
420 | - if (ent->device == 0xB410) { | ||
421 | + if (ent->vendor == PCI_VENDOR_ID_DIGIUM && | ||
422 | + ent->device == PCI_DEVICE_ID_DIGIUM_HFC4S) { | ||
423 | test_and_set_bit(HFC_CHIP_B410P, &hc->chip); | ||
424 | test_and_set_bit(HFC_CHIP_PCM_MASTER, &hc->chip); | ||
425 | test_and_clear_bit(HFC_CHIP_PCM_SLAVE, &hc->chip); | ||
426 | diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c | ||
427 | index 7f64a76acd37..ebfbaf8597f4 100644 | ||
428 | --- a/drivers/net/dsa/qca8k.c | ||
429 | +++ b/drivers/net/dsa/qca8k.c | ||
430 | @@ -630,22 +630,6 @@ qca8k_adjust_link(struct dsa_switch *ds, int port, struct phy_device *phy) | ||
431 | qca8k_port_set_status(priv, port, 1); | ||
432 | } | ||
433 | |||
434 | -static int | ||
435 | -qca8k_phy_read(struct dsa_switch *ds, int phy, int regnum) | ||
436 | -{ | ||
437 | - struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv; | ||
438 | - | ||
439 | - return mdiobus_read(priv->bus, phy, regnum); | ||
440 | -} | ||
441 | - | ||
442 | -static int | ||
443 | -qca8k_phy_write(struct dsa_switch *ds, int phy, int regnum, u16 val) | ||
444 | -{ | ||
445 | - struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv; | ||
446 | - | ||
447 | - return mdiobus_write(priv->bus, phy, regnum, val); | ||
448 | -} | ||
449 | - | ||
450 | static void | ||
451 | qca8k_get_strings(struct dsa_switch *ds, int port, uint8_t *data) | ||
452 | { | ||
453 | @@ -961,8 +945,6 @@ static struct dsa_switch_ops qca8k_switch_ops = { | ||
454 | .setup = qca8k_setup, | ||
455 | .adjust_link = qca8k_adjust_link, | ||
456 | .get_strings = qca8k_get_strings, | ||
457 | - .phy_read = qca8k_phy_read, | ||
458 | - .phy_write = qca8k_phy_write, | ||
459 | .get_ethtool_stats = qca8k_get_ethtool_stats, | ||
460 | .get_sset_count = qca8k_get_sset_count, | ||
461 | .get_eee = qca8k_get_eee, | ||
462 | diff --git a/drivers/net/ethernet/8390/mac8390.c b/drivers/net/ethernet/8390/mac8390.c | ||
463 | index b9283901136e..0fdc9ad32a2e 100644 | ||
464 | --- a/drivers/net/ethernet/8390/mac8390.c | ||
465 | +++ b/drivers/net/ethernet/8390/mac8390.c | ||
466 | @@ -156,8 +156,6 @@ static void dayna_block_output(struct net_device *dev, int count, | ||
467 | #define memcpy_fromio(a, b, c) memcpy((a), (void *)(b), (c)) | ||
468 | #define memcpy_toio(a, b, c) memcpy((void *)(a), (b), (c)) | ||
469 | |||
470 | -#define memcmp_withio(a, b, c) memcmp((a), (void *)(b), (c)) | ||
471 | - | ||
472 | /* Slow Sane (16-bit chunk memory read/write) Cabletron uses this */ | ||
473 | static void slow_sane_get_8390_hdr(struct net_device *dev, | ||
474 | struct e8390_pkt_hdr *hdr, int ring_page); | ||
475 | @@ -237,19 +235,26 @@ static enum mac8390_type __init mac8390_ident(struct nubus_dev *dev) | ||
476 | |||
477 | static enum mac8390_access __init mac8390_testio(volatile unsigned long membase) | ||
478 | { | ||
479 | - unsigned long outdata = 0xA5A0B5B0; | ||
480 | - unsigned long indata = 0x00000000; | ||
481 | + u32 outdata = 0xA5A0B5B0; | ||
482 | + u32 indata = 0; | ||
483 | + | ||
484 | /* Try writing 32 bits */ | ||
485 | - memcpy_toio(membase, &outdata, 4); | ||
486 | - /* Now compare them */ | ||
487 | - if (memcmp_withio(&outdata, membase, 4) == 0) | ||
488 | + nubus_writel(outdata, membase); | ||
489 | + /* Now read it back */ | ||
490 | + indata = nubus_readl(membase); | ||
491 | + if (outdata == indata) | ||
492 | return ACCESS_32; | ||
493 | + | ||
494 | + outdata = 0xC5C0D5D0; | ||
495 | + indata = 0; | ||
496 | + | ||
497 | /* Write 16 bit output */ | ||
498 | word_memcpy_tocard(membase, &outdata, 4); | ||
499 | /* Now read it back */ | ||
500 | word_memcpy_fromcard(&indata, membase, 4); | ||
501 | if (outdata == indata) | ||
502 | return ACCESS_16; | ||
503 | + | ||
504 | return ACCESS_UNKNOWN; | ||
505 | } | ||
506 | |||
507 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | ||
508 | index 20a2b01b392c..fc437d75ac76 100644 | ||
509 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | ||
510 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | ||
511 | @@ -2931,6 +2931,20 @@ static int stmmac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) | ||
512 | return ret; | ||
513 | } | ||
514 | |||
515 | +static int stmmac_set_mac_address(struct net_device *ndev, void *addr) | ||
516 | +{ | ||
517 | + struct stmmac_priv *priv = netdev_priv(ndev); | ||
518 | + int ret = 0; | ||
519 | + | ||
520 | + ret = eth_mac_addr(ndev, addr); | ||
521 | + if (ret) | ||
522 | + return ret; | ||
523 | + | ||
524 | + priv->hw->mac->set_umac_addr(priv->hw, ndev->dev_addr, 0); | ||
525 | + | ||
526 | + return ret; | ||
527 | +} | ||
528 | + | ||
529 | #ifdef CONFIG_DEBUG_FS | ||
530 | static struct dentry *stmmac_fs_dir; | ||
531 | |||
532 | @@ -3137,7 +3151,7 @@ static const struct net_device_ops stmmac_netdev_ops = { | ||
533 | #ifdef CONFIG_NET_POLL_CONTROLLER | ||
534 | .ndo_poll_controller = stmmac_poll_controller, | ||
535 | #endif | ||
536 | - .ndo_set_mac_address = eth_mac_addr, | ||
537 | + .ndo_set_mac_address = stmmac_set_mac_address, | ||
538 | }; | ||
539 | |||
540 | /** | ||
541 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c | ||
542 | index 24cc94453d38..88fe38d6a7ef 100644 | ||
543 | --- a/drivers/net/tun.c | ||
544 | +++ b/drivers/net/tun.c | ||
545 | @@ -1194,9 +1194,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, | ||
546 | u32 rxhash; | ||
547 | ssize_t n; | ||
548 | |||
549 | - if (!(tun->dev->flags & IFF_UP)) | ||
550 | - return -EIO; | ||
551 | - | ||
552 | if (!(tun->flags & IFF_NO_PI)) { | ||
553 | if (len < sizeof(pi)) | ||
554 | return -EINVAL; | ||
555 | @@ -1273,9 +1270,11 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, | ||
556 | err = skb_copy_datagram_from_iter(skb, 0, from, len); | ||
557 | |||
558 | if (err) { | ||
559 | + err = -EFAULT; | ||
560 | +drop: | ||
561 | this_cpu_inc(tun->pcpu_stats->rx_dropped); | ||
562 | kfree_skb(skb); | ||
563 | - return -EFAULT; | ||
564 | + return err; | ||
565 | } | ||
566 | |||
567 | err = virtio_net_hdr_to_skb(skb, &gso, tun_is_little_endian(tun)); | ||
568 | @@ -1327,7 +1326,16 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, | ||
569 | skb_probe_transport_header(skb, 0); | ||
570 | |||
571 | rxhash = skb_get_hash(skb); | ||
572 | + | ||
573 | + rcu_read_lock(); | ||
574 | + if (unlikely(!(tun->dev->flags & IFF_UP))) { | ||
575 | + err = -EIO; | ||
576 | + rcu_read_unlock(); | ||
577 | + goto drop; | ||
578 | + } | ||
579 | + | ||
580 | netif_rx_ni(skb); | ||
581 | + rcu_read_unlock(); | ||
582 | |||
583 | stats = get_cpu_ptr(tun->pcpu_stats); | ||
584 | u64_stats_update_begin(&stats->syncp); | ||
585 | diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c | ||
586 | index 016f5da425ab..b6ee0c1690d8 100644 | ||
587 | --- a/drivers/net/vxlan.c | ||
588 | +++ b/drivers/net/vxlan.c | ||
589 | @@ -3375,10 +3375,8 @@ static void __net_exit vxlan_exit_net(struct net *net) | ||
590 | /* If vxlan->dev is in the same netns, it has already been added | ||
591 | * to the list by the previous loop. | ||
592 | */ | ||
593 | - if (!net_eq(dev_net(vxlan->dev), net)) { | ||
594 | - gro_cells_destroy(&vxlan->gro_cells); | ||
595 | + if (!net_eq(dev_net(vxlan->dev), net)) | ||
596 | unregister_netdevice_queue(vxlan->dev, &list); | ||
597 | - } | ||
598 | } | ||
599 | |||
600 | unregister_netdevice_many(&list); | ||
601 | diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c | ||
602 | index 2abcd331b05d..abe460eac712 100644 | ||
603 | --- a/drivers/s390/scsi/zfcp_erp.c | ||
604 | +++ b/drivers/s390/scsi/zfcp_erp.c | ||
605 | @@ -652,6 +652,20 @@ static void zfcp_erp_strategy_memwait(struct zfcp_erp_action *erp_action) | ||
606 | add_timer(&erp_action->timer); | ||
607 | } | ||
608 | |||
609 | +void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter, | ||
610 | + int clear, char *dbftag) | ||
611 | +{ | ||
612 | + unsigned long flags; | ||
613 | + struct zfcp_port *port; | ||
614 | + | ||
615 | + write_lock_irqsave(&adapter->erp_lock, flags); | ||
616 | + read_lock(&adapter->port_list_lock); | ||
617 | + list_for_each_entry(port, &adapter->port_list, list) | ||
618 | + _zfcp_erp_port_forced_reopen(port, clear, dbftag); | ||
619 | + read_unlock(&adapter->port_list_lock); | ||
620 | + write_unlock_irqrestore(&adapter->erp_lock, flags); | ||
621 | +} | ||
622 | + | ||
623 | static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter, | ||
624 | int clear, char *id) | ||
625 | { | ||
626 | @@ -1306,6 +1320,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port) | ||
627 | struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev); | ||
628 | int lun_status; | ||
629 | |||
630 | + if (sdev->sdev_state == SDEV_DEL || | ||
631 | + sdev->sdev_state == SDEV_CANCEL) | ||
632 | + continue; | ||
633 | if (zsdev->port != port) | ||
634 | continue; | ||
635 | /* LUN under port of interest */ | ||
636 | diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h | ||
637 | index b326f05c7f89..a39a74500e23 100644 | ||
638 | --- a/drivers/s390/scsi/zfcp_ext.h | ||
639 | +++ b/drivers/s390/scsi/zfcp_ext.h | ||
640 | @@ -68,6 +68,8 @@ extern void zfcp_erp_clear_port_status(struct zfcp_port *, u32); | ||
641 | extern int zfcp_erp_port_reopen(struct zfcp_port *, int, char *); | ||
642 | extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *); | ||
643 | extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *); | ||
644 | +extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter, | ||
645 | + int clear, char *dbftag); | ||
646 | extern void zfcp_erp_set_lun_status(struct scsi_device *, u32); | ||
647 | extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32); | ||
648 | extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *); | ||
649 | diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c | ||
650 | index 3afb200b2829..bdb257eaa2e5 100644 | ||
651 | --- a/drivers/s390/scsi/zfcp_scsi.c | ||
652 | +++ b/drivers/s390/scsi/zfcp_scsi.c | ||
653 | @@ -326,6 +326,10 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt) | ||
654 | struct zfcp_adapter *adapter = zfcp_sdev->port->adapter; | ||
655 | int ret = SUCCESS, fc_ret; | ||
656 | |||
657 | + if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) { | ||
658 | + zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p"); | ||
659 | + zfcp_erp_wait(adapter); | ||
660 | + } | ||
661 | zfcp_erp_adapter_reopen(adapter, 0, "schrh_1"); | ||
662 | zfcp_erp_wait(adapter); | ||
663 | fc_ret = fc_block_scsi_eh(scpnt); | ||
664 | diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c | ||
665 | index 3e9cbba41464..58345d3d4682 100644 | ||
666 | --- a/drivers/scsi/sd.c | ||
667 | +++ b/drivers/scsi/sd.c | ||
668 | @@ -1284,11 +1284,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode) | ||
669 | scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW); | ||
670 | } | ||
671 | |||
672 | - /* | ||
673 | - * XXX and what if there are packets in flight and this close() | ||
674 | - * XXX is followed by a "rmmod sd_mod"? | ||
675 | - */ | ||
676 | - | ||
677 | scsi_disk_put(sdkp); | ||
678 | } | ||
679 | |||
680 | @@ -2846,6 +2841,9 @@ static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp, | ||
681 | unsigned int opt_xfer_bytes = | ||
682 | logical_to_bytes(sdp, sdkp->opt_xfer_blocks); | ||
683 | |||
684 | + if (sdkp->opt_xfer_blocks == 0) | ||
685 | + return false; | ||
686 | + | ||
687 | if (sdkp->opt_xfer_blocks > dev_max) { | ||
688 | sd_first_printk(KERN_WARNING, sdkp, | ||
689 | "Optimal transfer size %u logical blocks " \ | ||
690 | @@ -3257,11 +3255,23 @@ static void scsi_disk_release(struct device *dev) | ||
691 | { | ||
692 | struct scsi_disk *sdkp = to_scsi_disk(dev); | ||
693 | struct gendisk *disk = sdkp->disk; | ||
694 | - | ||
695 | + struct request_queue *q = disk->queue; | ||
696 | + | ||
697 | spin_lock(&sd_index_lock); | ||
698 | ida_remove(&sd_index_ida, sdkp->index); | ||
699 | spin_unlock(&sd_index_lock); | ||
700 | |||
701 | + /* | ||
702 | + * Wait until all requests that are in progress have completed. | ||
703 | + * This is necessary to avoid that e.g. scsi_end_request() crashes | ||
704 | + * due to clearing the disk->private_data pointer. Wait from inside | ||
705 | + * scsi_disk_release() instead of from sd_release() to avoid that | ||
706 | + * freezing and unfreezing the request queue affects user space I/O | ||
707 | + * in case multiple processes open a /dev/sd... node concurrently. | ||
708 | + */ | ||
709 | + blk_mq_freeze_queue(q); | ||
710 | + blk_mq_unfreeze_queue(q); | ||
711 | + | ||
712 | disk->private_data = NULL; | ||
713 | put_disk(disk); | ||
714 | put_device(&sdkp->device->sdev_gendev); | ||
715 | diff --git a/drivers/staging/comedi/comedidev.h b/drivers/staging/comedi/comedidev.h | ||
716 | index dcb637665eb7..35432fbd6551 100644 | ||
717 | --- a/drivers/staging/comedi/comedidev.h | ||
718 | +++ b/drivers/staging/comedi/comedidev.h | ||
719 | @@ -984,6 +984,8 @@ int comedi_dio_insn_config(struct comedi_device *, struct comedi_subdevice *, | ||
720 | unsigned int mask); | ||
721 | unsigned int comedi_dio_update_state(struct comedi_subdevice *, | ||
722 | unsigned int *data); | ||
723 | +unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, | ||
724 | + struct comedi_cmd *cmd); | ||
725 | unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s); | ||
726 | unsigned int comedi_nscans_left(struct comedi_subdevice *s, | ||
727 | unsigned int nscans); | ||
728 | diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c | ||
729 | index 1736248bc5b8..8ca5493c66fe 100644 | ||
730 | --- a/drivers/staging/comedi/drivers.c | ||
731 | +++ b/drivers/staging/comedi/drivers.c | ||
732 | @@ -390,11 +390,13 @@ unsigned int comedi_dio_update_state(struct comedi_subdevice *s, | ||
733 | EXPORT_SYMBOL_GPL(comedi_dio_update_state); | ||
734 | |||
735 | /** | ||
736 | - * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes | ||
737 | + * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in | ||
738 | + * bytes | ||
739 | * @s: COMEDI subdevice. | ||
740 | + * @cmd: COMEDI command. | ||
741 | * | ||
742 | * Determines the overall scan length according to the subdevice type and the | ||
743 | - * number of channels in the scan. | ||
744 | + * number of channels in the scan for the specified command. | ||
745 | * | ||
746 | * For digital input, output or input/output subdevices, samples for | ||
747 | * multiple channels are assumed to be packed into one or more unsigned | ||
748 | @@ -404,9 +406,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_state); | ||
749 | * | ||
750 | * Returns the overall scan length in bytes. | ||
751 | */ | ||
752 | -unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) | ||
753 | +unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, | ||
754 | + struct comedi_cmd *cmd) | ||
755 | { | ||
756 | - struct comedi_cmd *cmd = &s->async->cmd; | ||
757 | unsigned int num_samples; | ||
758 | unsigned int bits_per_sample; | ||
759 | |||
760 | @@ -423,6 +425,29 @@ unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) | ||
761 | } | ||
762 | return comedi_samples_to_bytes(s, num_samples); | ||
763 | } | ||
764 | +EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd); | ||
765 | + | ||
766 | +/** | ||
767 | + * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes | ||
768 | + * @s: COMEDI subdevice. | ||
769 | + * | ||
770 | + * Determines the overall scan length according to the subdevice type and the | ||
771 | + * number of channels in the scan for the current command. | ||
772 | + * | ||
773 | + * For digital input, output or input/output subdevices, samples for | ||
774 | + * multiple channels are assumed to be packed into one or more unsigned | ||
775 | + * short or unsigned int values according to the subdevice's %SDF_LSAMPL | ||
776 | + * flag. For other types of subdevice, samples are assumed to occupy a | ||
777 | + * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag. | ||
778 | + * | ||
779 | + * Returns the overall scan length in bytes. | ||
780 | + */ | ||
781 | +unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) | ||
782 | +{ | ||
783 | + struct comedi_cmd *cmd = &s->async->cmd; | ||
784 | + | ||
785 | + return comedi_bytes_per_scan_cmd(s, cmd); | ||
786 | +} | ||
787 | EXPORT_SYMBOL_GPL(comedi_bytes_per_scan); | ||
788 | |||
789 | static unsigned int __comedi_nscans_left(struct comedi_subdevice *s, | ||
790 | diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c | ||
791 | index 0fa85d55c82f..fe03a41dc5cf 100644 | ||
792 | --- a/drivers/staging/comedi/drivers/ni_mio_common.c | ||
793 | +++ b/drivers/staging/comedi/drivers/ni_mio_common.c | ||
794 | @@ -3477,6 +3477,7 @@ static int ni_cdio_check_chanlist(struct comedi_device *dev, | ||
795 | static int ni_cdio_cmdtest(struct comedi_device *dev, | ||
796 | struct comedi_subdevice *s, struct comedi_cmd *cmd) | ||
797 | { | ||
798 | + unsigned int bytes_per_scan; | ||
799 | int err = 0; | ||
800 | int tmp; | ||
801 | |||
802 | @@ -3506,9 +3507,12 @@ static int ni_cdio_cmdtest(struct comedi_device *dev, | ||
803 | err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0); | ||
804 | err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg, | ||
805 | cmd->chanlist_len); | ||
806 | - err |= comedi_check_trigger_arg_max(&cmd->stop_arg, | ||
807 | - s->async->prealloc_bufsz / | ||
808 | - comedi_bytes_per_scan(s)); | ||
809 | + bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd); | ||
810 | + if (bytes_per_scan) { | ||
811 | + err |= comedi_check_trigger_arg_max(&cmd->stop_arg, | ||
812 | + s->async->prealloc_bufsz / | ||
813 | + bytes_per_scan); | ||
814 | + } | ||
815 | |||
816 | if (err) | ||
817 | return 3; | ||
818 | diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c | ||
819 | index ab96629b7889..22e5116e74f8 100644 | ||
820 | --- a/drivers/staging/vt6655/device_main.c | ||
821 | +++ b/drivers/staging/vt6655/device_main.c | ||
822 | @@ -977,8 +977,6 @@ static void vnt_interrupt_process(struct vnt_private *priv) | ||
823 | return; | ||
824 | } | ||
825 | |||
826 | - MACvIntDisable(priv->PortOffset); | ||
827 | - | ||
828 | spin_lock_irqsave(&priv->lock, flags); | ||
829 | |||
830 | /* Read low level stats */ | ||
831 | @@ -1067,8 +1065,6 @@ static void vnt_interrupt_process(struct vnt_private *priv) | ||
832 | } | ||
833 | |||
834 | spin_unlock_irqrestore(&priv->lock, flags); | ||
835 | - | ||
836 | - MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); | ||
837 | } | ||
838 | |||
839 | static void vnt_interrupt_work(struct work_struct *work) | ||
840 | @@ -1078,14 +1074,17 @@ static void vnt_interrupt_work(struct work_struct *work) | ||
841 | |||
842 | if (priv->vif) | ||
843 | vnt_interrupt_process(priv); | ||
844 | + | ||
845 | + MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); | ||
846 | } | ||
847 | |||
848 | static irqreturn_t vnt_interrupt(int irq, void *arg) | ||
849 | { | ||
850 | struct vnt_private *priv = arg; | ||
851 | |||
852 | - if (priv->vif) | ||
853 | - schedule_work(&priv->interrupt_work); | ||
854 | + schedule_work(&priv->interrupt_work); | ||
855 | + | ||
856 | + MACvIntDisable(priv->PortOffset); | ||
857 | |||
858 | return IRQ_HANDLED; | ||
859 | } | ||
860 | diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c | ||
861 | index 5a341b1c65c3..d8e1945cb627 100644 | ||
862 | --- a/drivers/tty/serial/atmel_serial.c | ||
863 | +++ b/drivers/tty/serial/atmel_serial.c | ||
864 | @@ -1166,6 +1166,10 @@ static int atmel_prepare_rx_dma(struct uart_port *port) | ||
865 | sg_dma_len(&atmel_port->sg_rx)/2, | ||
866 | DMA_DEV_TO_MEM, | ||
867 | DMA_PREP_INTERRUPT); | ||
868 | + if (!desc) { | ||
869 | + dev_err(port->dev, "Preparing DMA cyclic failed\n"); | ||
870 | + goto chan_err; | ||
871 | + } | ||
872 | desc->callback = atmel_complete_rx_dma; | ||
873 | desc->callback_param = port; | ||
874 | atmel_port->desc_rx = desc; | ||
875 | diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c | ||
876 | index f2b0d8cee8ef..0314e78e31ff 100644 | ||
877 | --- a/drivers/tty/serial/kgdboc.c | ||
878 | +++ b/drivers/tty/serial/kgdboc.c | ||
879 | @@ -148,8 +148,10 @@ static int configure_kgdboc(void) | ||
880 | char *cptr = config; | ||
881 | struct console *cons; | ||
882 | |||
883 | - if (!strlen(config) || isspace(config[0])) | ||
884 | + if (!strlen(config) || isspace(config[0])) { | ||
885 | + err = 0; | ||
886 | goto noconfig; | ||
887 | + } | ||
888 | |||
889 | kgdboc_io_ops.is_console = 0; | ||
890 | kgdb_tty_driver = NULL; | ||
891 | diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c | ||
892 | index 8a3e92638e10..5331baf3f699 100644 | ||
893 | --- a/drivers/tty/serial/max310x.c | ||
894 | +++ b/drivers/tty/serial/max310x.c | ||
895 | @@ -1323,6 +1323,8 @@ static int max310x_spi_probe(struct spi_device *spi) | ||
896 | if (spi->dev.of_node) { | ||
897 | const struct of_device_id *of_id = | ||
898 | of_match_device(max310x_dt_ids, &spi->dev); | ||
899 | + if (!of_id) | ||
900 | + return -ENODEV; | ||
901 | |||
902 | devtype = (struct max310x_devtype *)of_id->data; | ||
903 | } else { | ||
904 | diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c | ||
905 | index 6ff53b604ff6..bcb997935c5e 100644 | ||
906 | --- a/drivers/tty/serial/sh-sci.c | ||
907 | +++ b/drivers/tty/serial/sh-sci.c | ||
908 | @@ -834,19 +834,9 @@ static void sci_transmit_chars(struct uart_port *port) | ||
909 | |||
910 | if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) | ||
911 | uart_write_wakeup(port); | ||
912 | - if (uart_circ_empty(xmit)) { | ||
913 | + if (uart_circ_empty(xmit)) | ||
914 | sci_stop_tx(port); | ||
915 | - } else { | ||
916 | - ctrl = serial_port_in(port, SCSCR); | ||
917 | - | ||
918 | - if (port->type != PORT_SCI) { | ||
919 | - serial_port_in(port, SCxSR); /* Dummy read */ | ||
920 | - sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port)); | ||
921 | - } | ||
922 | |||
923 | - ctrl |= SCSCR_TIE; | ||
924 | - serial_port_out(port, SCSCR, ctrl); | ||
925 | - } | ||
926 | } | ||
927 | |||
928 | /* On SH3, SCIF may read end-of-break as a space->mark char */ | ||
929 | diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c | ||
930 | index 5ef8da6e67c3..64c76403a542 100644 | ||
931 | --- a/drivers/usb/common/common.c | ||
932 | +++ b/drivers/usb/common/common.c | ||
933 | @@ -148,6 +148,8 @@ enum usb_dr_mode of_usb_get_dr_mode_by_phy(struct device_node *np, int arg0) | ||
934 | |||
935 | do { | ||
936 | controller = of_find_node_with_property(controller, "phys"); | ||
937 | + if (!of_device_is_available(controller)) | ||
938 | + continue; | ||
939 | index = 0; | ||
940 | do { | ||
941 | if (arg0 == -1) { | ||
942 | diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c | ||
943 | index c6578b321838..5e6136d2ed71 100644 | ||
944 | --- a/drivers/usb/core/config.c | ||
945 | +++ b/drivers/usb/core/config.c | ||
946 | @@ -763,21 +763,18 @@ void usb_destroy_configuration(struct usb_device *dev) | ||
947 | return; | ||
948 | |||
949 | if (dev->rawdescriptors) { | ||
950 | - for (i = 0; i < dev->descriptor.bNumConfigurations && | ||
951 | - i < USB_MAXCONFIG; i++) | ||
952 | + for (i = 0; i < dev->descriptor.bNumConfigurations; i++) | ||
953 | kfree(dev->rawdescriptors[i]); | ||
954 | |||
955 | kfree(dev->rawdescriptors); | ||
956 | dev->rawdescriptors = NULL; | ||
957 | } | ||
958 | |||
959 | - for (c = 0; c < dev->descriptor.bNumConfigurations && | ||
960 | - c < USB_MAXCONFIG; c++) { | ||
961 | + for (c = 0; c < dev->descriptor.bNumConfigurations; c++) { | ||
962 | struct usb_host_config *cf = &dev->config[c]; | ||
963 | |||
964 | kfree(cf->string); | ||
965 | - for (i = 0; i < cf->desc.bNumInterfaces && | ||
966 | - i < USB_MAXINTERFACES; i++) { | ||
967 | + for (i = 0; i < cf->desc.bNumInterfaces; i++) { | ||
968 | if (cf->intf_cache[i]) | ||
969 | kref_put(&cf->intf_cache[i]->ref, | ||
970 | usb_release_interface_cache); | ||
971 | diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c | ||
972 | index 5815120c0402..8e83649f77ce 100644 | ||
973 | --- a/drivers/usb/gadget/function/f_hid.c | ||
974 | +++ b/drivers/usb/gadget/function/f_hid.c | ||
975 | @@ -340,20 +340,20 @@ try_again: | ||
976 | req->complete = f_hidg_req_complete; | ||
977 | req->context = hidg; | ||
978 | |||
979 | + spin_unlock_irqrestore(&hidg->write_spinlock, flags); | ||
980 | + | ||
981 | status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC); | ||
982 | if (status < 0) { | ||
983 | ERROR(hidg->func.config->cdev, | ||
984 | "usb_ep_queue error on int endpoint %zd\n", status); | ||
985 | - goto release_write_pending_unlocked; | ||
986 | + goto release_write_pending; | ||
987 | } else { | ||
988 | status = count; | ||
989 | } | ||
990 | - spin_unlock_irqrestore(&hidg->write_spinlock, flags); | ||
991 | |||
992 | return status; | ||
993 | release_write_pending: | ||
994 | spin_lock_irqsave(&hidg->write_spinlock, flags); | ||
995 | -release_write_pending_unlocked: | ||
996 | hidg->write_pending = 0; | ||
997 | spin_unlock_irqrestore(&hidg->write_spinlock, flags); | ||
998 | |||
999 | diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c | ||
1000 | index 0e4535e632ec..64ee8154f2bb 100644 | ||
1001 | --- a/drivers/usb/host/xhci-rcar.c | ||
1002 | +++ b/drivers/usb/host/xhci-rcar.c | ||
1003 | @@ -192,5 +192,6 @@ int xhci_rcar_init_quirk(struct usb_hcd *hcd) | ||
1004 | xhci_rcar_is_gen3(hcd->self.controller)) | ||
1005 | xhci->quirks |= XHCI_NO_64BIT_SUPPORT; | ||
1006 | |||
1007 | + xhci->quirks |= XHCI_TRUST_TX_LENGTH; | ||
1008 | return xhci_rcar_download_firmware(hcd); | ||
1009 | } | ||
1010 | diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c | ||
1011 | index f4e34a75d413..879d82223068 100644 | ||
1012 | --- a/drivers/usb/host/xhci-ring.c | ||
1013 | +++ b/drivers/usb/host/xhci-ring.c | ||
1014 | @@ -1645,10 +1645,13 @@ static void handle_port_status(struct xhci_hcd *xhci, | ||
1015 | } | ||
1016 | } | ||
1017 | |||
1018 | - if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_U0 && | ||
1019 | - DEV_SUPERSPEED_ANY(temp)) { | ||
1020 | + if ((temp & PORT_PLC) && | ||
1021 | + DEV_SUPERSPEED_ANY(temp) && | ||
1022 | + ((temp & PORT_PLS_MASK) == XDEV_U0 || | ||
1023 | + (temp & PORT_PLS_MASK) == XDEV_U1 || | ||
1024 | + (temp & PORT_PLS_MASK) == XDEV_U2)) { | ||
1025 | xhci_dbg(xhci, "resume SS port %d finished\n", port_id); | ||
1026 | - /* We've just brought the device into U0 through either the | ||
1027 | + /* We've just brought the device into U0/1/2 through either the | ||
1028 | * Resume state after a device remote wakeup, or through the | ||
1029 | * U3Exit state after a host-initiated resume. If it's a device | ||
1030 | * initiated remote wake, don't pass up the link state change, | ||
1031 | diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h | ||
1032 | index e679fec9ce3a..de4771ce0df6 100644 | ||
1033 | --- a/drivers/usb/host/xhci.h | ||
1034 | +++ b/drivers/usb/host/xhci.h | ||
1035 | @@ -311,6 +311,7 @@ struct xhci_op_regs { | ||
1036 | */ | ||
1037 | #define PORT_PLS_MASK (0xf << 5) | ||
1038 | #define XDEV_U0 (0x0 << 5) | ||
1039 | +#define XDEV_U1 (0x1 << 5) | ||
1040 | #define XDEV_U2 (0x2 << 5) | ||
1041 | #define XDEV_U3 (0x3 << 5) | ||
1042 | #define XDEV_INACTIVE (0x6 << 5) | ||
1043 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c | ||
1044 | index 7bbf2ca73f68..40c58145bf80 100644 | ||
1045 | --- a/drivers/usb/serial/cp210x.c | ||
1046 | +++ b/drivers/usb/serial/cp210x.c | ||
1047 | @@ -77,6 +77,7 @@ static const struct usb_device_id id_table[] = { | ||
1048 | { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ | ||
1049 | { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ | ||
1050 | { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ | ||
1051 | + { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */ | ||
1052 | { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ | ||
1053 | { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ | ||
1054 | { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ | ||
1055 | diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c | ||
1056 | index b88a72220acd..f54931aa7528 100644 | ||
1057 | --- a/drivers/usb/serial/ftdi_sio.c | ||
1058 | +++ b/drivers/usb/serial/ftdi_sio.c | ||
1059 | @@ -604,6 +604,8 @@ static const struct usb_device_id id_table_combined[] = { | ||
1060 | .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, | ||
1061 | { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), | ||
1062 | .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, | ||
1063 | + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, | ||
1064 | + { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, | ||
1065 | { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, | ||
1066 | { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, | ||
1067 | { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, | ||
1068 | diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h | ||
1069 | index ddf5ab983dc9..15d220eaf6e6 100644 | ||
1070 | --- a/drivers/usb/serial/ftdi_sio_ids.h | ||
1071 | +++ b/drivers/usb/serial/ftdi_sio_ids.h | ||
1072 | @@ -566,7 +566,9 @@ | ||
1073 | /* | ||
1074 | * NovaTech product ids (FTDI_VID) | ||
1075 | */ | ||
1076 | -#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ | ||
1077 | +#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ | ||
1078 | +#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */ | ||
1079 | +#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */ | ||
1080 | |||
1081 | /* | ||
1082 | * Synapse Wireless product ids (FTDI_VID) | ||
1083 | diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c | ||
1084 | index 135eb04368f9..ea20322e1416 100644 | ||
1085 | --- a/drivers/usb/serial/mos7720.c | ||
1086 | +++ b/drivers/usb/serial/mos7720.c | ||
1087 | @@ -368,8 +368,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, | ||
1088 | if (!urbtrack) | ||
1089 | return -ENOMEM; | ||
1090 | |||
1091 | - kref_get(&mos_parport->ref_count); | ||
1092 | - urbtrack->mos_parport = mos_parport; | ||
1093 | urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC); | ||
1094 | if (!urbtrack->urb) { | ||
1095 | kfree(urbtrack); | ||
1096 | @@ -390,6 +388,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, | ||
1097 | usb_sndctrlpipe(usbdev, 0), | ||
1098 | (unsigned char *)urbtrack->setup, | ||
1099 | NULL, 0, async_complete, urbtrack); | ||
1100 | + kref_get(&mos_parport->ref_count); | ||
1101 | + urbtrack->mos_parport = mos_parport; | ||
1102 | kref_init(&urbtrack->ref_count); | ||
1103 | INIT_LIST_HEAD(&urbtrack->urblist_entry); | ||
1104 | |||
1105 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c | ||
1106 | index b2b7c12e5c86..9f96dd274370 100644 | ||
1107 | --- a/drivers/usb/serial/option.c | ||
1108 | +++ b/drivers/usb/serial/option.c | ||
1109 | @@ -1066,7 +1066,8 @@ static const struct usb_device_id option_ids[] = { | ||
1110 | .driver_info = RSVD(3) }, | ||
1111 | { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ | ||
1112 | { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ | ||
1113 | - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ | ||
1114 | + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */ | ||
1115 | + .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) }, | ||
1116 | /* Quectel products using Qualcomm vendor ID */ | ||
1117 | { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, | ||
1118 | { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), | ||
1119 | @@ -1941,10 +1942,12 @@ static const struct usb_device_id option_ids[] = { | ||
1120 | .driver_info = RSVD(4) }, | ||
1121 | { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ | ||
1122 | .driver_info = RSVD(4) }, | ||
1123 | - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ | ||
1124 | - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ | ||
1125 | - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ | ||
1126 | - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ | ||
1127 | + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ | ||
1128 | + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ | ||
1129 | + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ | ||
1130 | + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ | ||
1131 | + .driver_info = RSVD(4) }, | ||
1132 | + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ | ||
1133 | { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, | ||
1134 | { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, | ||
1135 | { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, | ||
1136 | diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c | ||
1137 | index 14a93cb21310..66d58e93bc32 100644 | ||
1138 | --- a/drivers/video/fbdev/goldfishfb.c | ||
1139 | +++ b/drivers/video/fbdev/goldfishfb.c | ||
1140 | @@ -234,7 +234,7 @@ static int goldfish_fb_probe(struct platform_device *pdev) | ||
1141 | fb->fb.var.activate = FB_ACTIVATE_NOW; | ||
1142 | fb->fb.var.height = readl(fb->reg_base + FB_GET_PHYS_HEIGHT); | ||
1143 | fb->fb.var.width = readl(fb->reg_base + FB_GET_PHYS_WIDTH); | ||
1144 | - fb->fb.var.pixclock = 10000; | ||
1145 | + fb->fb.var.pixclock = 0; | ||
1146 | |||
1147 | fb->fb.var.red.offset = 11; | ||
1148 | fb->fb.var.red.length = 5; | ||
1149 | diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c | ||
1150 | index af6a776fa18c..5aa07de5750e 100644 | ||
1151 | --- a/fs/btrfs/raid56.c | ||
1152 | +++ b/fs/btrfs/raid56.c | ||
1153 | @@ -2395,8 +2395,9 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, | ||
1154 | bitmap_clear(rbio->dbitmap, pagenr, 1); | ||
1155 | kunmap(p); | ||
1156 | |||
1157 | - for (stripe = 0; stripe < rbio->real_stripes; stripe++) | ||
1158 | + for (stripe = 0; stripe < nr_data; stripe++) | ||
1159 | kunmap(page_in_rbio(rbio, stripe, pagenr, 0)); | ||
1160 | + kunmap(p_page); | ||
1161 | } | ||
1162 | |||
1163 | __free_page(p_page); | ||
1164 | diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c | ||
1165 | index 47d11a30bee7..a36bb75383dc 100644 | ||
1166 | --- a/fs/btrfs/tree-log.c | ||
1167 | +++ b/fs/btrfs/tree-log.c | ||
1168 | @@ -3343,9 +3343,16 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, | ||
1169 | } | ||
1170 | btrfs_release_path(path); | ||
1171 | |||
1172 | - /* find the first key from this transaction again */ | ||
1173 | + /* | ||
1174 | + * Find the first key from this transaction again. See the note for | ||
1175 | + * log_new_dir_dentries, if we're logging a directory recursively we | ||
1176 | + * won't be holding its i_mutex, which means we can modify the directory | ||
1177 | + * while we're logging it. If we remove an entry between our first | ||
1178 | + * search and this search we'll not find the key again and can just | ||
1179 | + * bail. | ||
1180 | + */ | ||
1181 | ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0); | ||
1182 | - if (WARN_ON(ret != 0)) | ||
1183 | + if (ret != 0) | ||
1184 | goto done; | ||
1185 | |||
1186 | /* | ||
1187 | diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c | ||
1188 | index eb55ab6930b5..6d0d94fc243d 100644 | ||
1189 | --- a/fs/nfs/nfs4proc.c | ||
1190 | +++ b/fs/nfs/nfs4proc.c | ||
1191 | @@ -2748,7 +2748,8 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, | ||
1192 | nfs4_schedule_stateid_recovery(server, state); | ||
1193 | } | ||
1194 | out: | ||
1195 | - nfs4_sequence_free_slot(&opendata->o_res.seq_res); | ||
1196 | + if (!opendata->cancelled) | ||
1197 | + nfs4_sequence_free_slot(&opendata->o_res.seq_res); | ||
1198 | return ret; | ||
1199 | } | ||
1200 | |||
1201 | diff --git a/fs/open.c b/fs/open.c | ||
1202 | index a6c6244f4993..f1deb36ee1b7 100644 | ||
1203 | --- a/fs/open.c | ||
1204 | +++ b/fs/open.c | ||
1205 | @@ -717,6 +717,12 @@ static int do_dentry_open(struct file *f, | ||
1206 | return 0; | ||
1207 | } | ||
1208 | |||
1209 | + /* Any file opened for execve()/uselib() has to be a regular file. */ | ||
1210 | + if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) { | ||
1211 | + error = -EACCES; | ||
1212 | + goto cleanup_file; | ||
1213 | + } | ||
1214 | + | ||
1215 | if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { | ||
1216 | error = get_write_access(inode); | ||
1217 | if (unlikely(error)) | ||
1218 | diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c | ||
1219 | index 1999e85840d5..6f30cf8ef7a1 100644 | ||
1220 | --- a/fs/proc/proc_sysctl.c | ||
1221 | +++ b/fs/proc/proc_sysctl.c | ||
1222 | @@ -1604,7 +1604,8 @@ static void drop_sysctl_table(struct ctl_table_header *header) | ||
1223 | if (--header->nreg) | ||
1224 | return; | ||
1225 | |||
1226 | - put_links(header); | ||
1227 | + if (parent) | ||
1228 | + put_links(header); | ||
1229 | start_unregistering(header); | ||
1230 | if (!--header->count) | ||
1231 | kfree_rcu(header, rcu); | ||
1232 | diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h | ||
1233 | index 4a5b9a306c69..803fc26ef0ba 100644 | ||
1234 | --- a/include/net/sctp/checksum.h | ||
1235 | +++ b/include/net/sctp/checksum.h | ||
1236 | @@ -60,7 +60,7 @@ static inline __wsum sctp_csum_combine(__wsum csum, __wsum csum2, | ||
1237 | static inline __le32 sctp_compute_cksum(const struct sk_buff *skb, | ||
1238 | unsigned int offset) | ||
1239 | { | ||
1240 | - struct sctphdr *sh = sctp_hdr(skb); | ||
1241 | + struct sctphdr *sh = (struct sctphdr *)(skb->data + offset); | ||
1242 | __le32 ret, old = sh->checksum; | ||
1243 | const struct skb_checksum_ops ops = { | ||
1244 | .update = sctp_csum_update, | ||
1245 | diff --git a/include/net/sock.h b/include/net/sock.h | ||
1246 | index 15bb04dec40e..116308632fae 100644 | ||
1247 | --- a/include/net/sock.h | ||
1248 | +++ b/include/net/sock.h | ||
1249 | @@ -650,6 +650,12 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list) | ||
1250 | hlist_add_head_rcu(&sk->sk_node, list); | ||
1251 | } | ||
1252 | |||
1253 | +static inline void sk_add_node_tail_rcu(struct sock *sk, struct hlist_head *list) | ||
1254 | +{ | ||
1255 | + sock_hold(sk); | ||
1256 | + hlist_add_tail_rcu(&sk->sk_node, list); | ||
1257 | +} | ||
1258 | + | ||
1259 | static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) | ||
1260 | { | ||
1261 | hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); | ||
1262 | diff --git a/kernel/cpu.c b/kernel/cpu.c | ||
1263 | index b5a0165b7300..bf24e8400903 100644 | ||
1264 | --- a/kernel/cpu.c | ||
1265 | +++ b/kernel/cpu.c | ||
1266 | @@ -591,6 +591,20 @@ static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st) | ||
1267 | } | ||
1268 | } | ||
1269 | |||
1270 | +static inline bool can_rollback_cpu(struct cpuhp_cpu_state *st) | ||
1271 | +{ | ||
1272 | + if (IS_ENABLED(CONFIG_HOTPLUG_CPU)) | ||
1273 | + return true; | ||
1274 | + /* | ||
1275 | + * When CPU hotplug is disabled, then taking the CPU down is not | ||
1276 | + * possible because takedown_cpu() and the architecture and | ||
1277 | + * subsystem specific mechanisms are not available. So the CPU | ||
1278 | + * which would be completely unplugged again needs to stay around | ||
1279 | + * in the current state. | ||
1280 | + */ | ||
1281 | + return st->state <= CPUHP_BRINGUP_CPU; | ||
1282 | +} | ||
1283 | + | ||
1284 | static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st, | ||
1285 | enum cpuhp_state target) | ||
1286 | { | ||
1287 | @@ -601,8 +615,10 @@ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st, | ||
1288 | st->state++; | ||
1289 | ret = cpuhp_invoke_callback(cpu, st->state, true, NULL); | ||
1290 | if (ret) { | ||
1291 | - st->target = prev_state; | ||
1292 | - undo_cpu_up(cpu, st); | ||
1293 | + if (can_rollback_cpu(st)) { | ||
1294 | + st->target = prev_state; | ||
1295 | + undo_cpu_up(cpu, st); | ||
1296 | + } | ||
1297 | break; | ||
1298 | } | ||
1299 | } | ||
1300 | diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c | ||
1301 | index 1fc23cb4a3e0..d49aa4e6c916 100644 | ||
1302 | --- a/net/bluetooth/l2cap_core.c | ||
1303 | +++ b/net/bluetooth/l2cap_core.c | ||
1304 | @@ -3326,16 +3326,22 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data | ||
1305 | |||
1306 | while (len >= L2CAP_CONF_OPT_SIZE) { | ||
1307 | len -= l2cap_get_conf_opt(&req, &type, &olen, &val); | ||
1308 | + if (len < 0) | ||
1309 | + break; | ||
1310 | |||
1311 | hint = type & L2CAP_CONF_HINT; | ||
1312 | type &= L2CAP_CONF_MASK; | ||
1313 | |||
1314 | switch (type) { | ||
1315 | case L2CAP_CONF_MTU: | ||
1316 | + if (olen != 2) | ||
1317 | + break; | ||
1318 | mtu = val; | ||
1319 | break; | ||
1320 | |||
1321 | case L2CAP_CONF_FLUSH_TO: | ||
1322 | + if (olen != 2) | ||
1323 | + break; | ||
1324 | chan->flush_to = val; | ||
1325 | break; | ||
1326 | |||
1327 | @@ -3343,26 +3349,30 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data | ||
1328 | break; | ||
1329 | |||
1330 | case L2CAP_CONF_RFC: | ||
1331 | - if (olen == sizeof(rfc)) | ||
1332 | - memcpy(&rfc, (void *) val, olen); | ||
1333 | + if (olen != sizeof(rfc)) | ||
1334 | + break; | ||
1335 | + memcpy(&rfc, (void *) val, olen); | ||
1336 | break; | ||
1337 | |||
1338 | case L2CAP_CONF_FCS: | ||
1339 | + if (olen != 1) | ||
1340 | + break; | ||
1341 | if (val == L2CAP_FCS_NONE) | ||
1342 | set_bit(CONF_RECV_NO_FCS, &chan->conf_state); | ||
1343 | break; | ||
1344 | |||
1345 | case L2CAP_CONF_EFS: | ||
1346 | - if (olen == sizeof(efs)) { | ||
1347 | - remote_efs = 1; | ||
1348 | - memcpy(&efs, (void *) val, olen); | ||
1349 | - } | ||
1350 | + if (olen != sizeof(efs)) | ||
1351 | + break; | ||
1352 | + remote_efs = 1; | ||
1353 | + memcpy(&efs, (void *) val, olen); | ||
1354 | break; | ||
1355 | |||
1356 | case L2CAP_CONF_EWS: | ||
1357 | + if (olen != 2) | ||
1358 | + break; | ||
1359 | if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP)) | ||
1360 | return -ECONNREFUSED; | ||
1361 | - | ||
1362 | set_bit(FLAG_EXT_CTRL, &chan->flags); | ||
1363 | set_bit(CONF_EWS_RECV, &chan->conf_state); | ||
1364 | chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; | ||
1365 | @@ -3372,7 +3382,6 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data | ||
1366 | default: | ||
1367 | if (hint) | ||
1368 | break; | ||
1369 | - | ||
1370 | result = L2CAP_CONF_UNKNOWN; | ||
1371 | *((u8 *) ptr++) = type; | ||
1372 | break; | ||
1373 | @@ -3537,58 +3546,65 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, | ||
1374 | |||
1375 | while (len >= L2CAP_CONF_OPT_SIZE) { | ||
1376 | len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); | ||
1377 | + if (len < 0) | ||
1378 | + break; | ||
1379 | |||
1380 | switch (type) { | ||
1381 | case L2CAP_CONF_MTU: | ||
1382 | + if (olen != 2) | ||
1383 | + break; | ||
1384 | if (val < L2CAP_DEFAULT_MIN_MTU) { | ||
1385 | *result = L2CAP_CONF_UNACCEPT; | ||
1386 | chan->imtu = L2CAP_DEFAULT_MIN_MTU; | ||
1387 | } else | ||
1388 | chan->imtu = val; | ||
1389 | - l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); | ||
1390 | + l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, | ||
1391 | + endptr - ptr); | ||
1392 | break; | ||
1393 | |||
1394 | case L2CAP_CONF_FLUSH_TO: | ||
1395 | + if (olen != 2) | ||
1396 | + break; | ||
1397 | chan->flush_to = val; | ||
1398 | - l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, | ||
1399 | - 2, chan->flush_to, endptr - ptr); | ||
1400 | + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, | ||
1401 | + chan->flush_to, endptr - ptr); | ||
1402 | break; | ||
1403 | |||
1404 | case L2CAP_CONF_RFC: | ||
1405 | - if (olen == sizeof(rfc)) | ||
1406 | - memcpy(&rfc, (void *)val, olen); | ||
1407 | - | ||
1408 | + if (olen != sizeof(rfc)) | ||
1409 | + break; | ||
1410 | + memcpy(&rfc, (void *)val, olen); | ||
1411 | if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && | ||
1412 | rfc.mode != chan->mode) | ||
1413 | return -ECONNREFUSED; | ||
1414 | - | ||
1415 | chan->fcs = 0; | ||
1416 | - | ||
1417 | - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, | ||
1418 | - sizeof(rfc), (unsigned long) &rfc, endptr - ptr); | ||
1419 | + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), | ||
1420 | + (unsigned long) &rfc, endptr - ptr); | ||
1421 | break; | ||
1422 | |||
1423 | case L2CAP_CONF_EWS: | ||
1424 | + if (olen != 2) | ||
1425 | + break; | ||
1426 | chan->ack_win = min_t(u16, val, chan->ack_win); | ||
1427 | l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, | ||
1428 | chan->tx_win, endptr - ptr); | ||
1429 | break; | ||
1430 | |||
1431 | case L2CAP_CONF_EFS: | ||
1432 | - if (olen == sizeof(efs)) { | ||
1433 | - memcpy(&efs, (void *)val, olen); | ||
1434 | - | ||
1435 | - if (chan->local_stype != L2CAP_SERV_NOTRAFIC && | ||
1436 | - efs.stype != L2CAP_SERV_NOTRAFIC && | ||
1437 | - efs.stype != chan->local_stype) | ||
1438 | - return -ECONNREFUSED; | ||
1439 | - | ||
1440 | - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), | ||
1441 | - (unsigned long) &efs, endptr - ptr); | ||
1442 | - } | ||
1443 | + if (olen != sizeof(efs)) | ||
1444 | + break; | ||
1445 | + memcpy(&efs, (void *)val, olen); | ||
1446 | + if (chan->local_stype != L2CAP_SERV_NOTRAFIC && | ||
1447 | + efs.stype != L2CAP_SERV_NOTRAFIC && | ||
1448 | + efs.stype != chan->local_stype) | ||
1449 | + return -ECONNREFUSED; | ||
1450 | + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), | ||
1451 | + (unsigned long) &efs, endptr - ptr); | ||
1452 | break; | ||
1453 | |||
1454 | case L2CAP_CONF_FCS: | ||
1455 | + if (olen != 1) | ||
1456 | + break; | ||
1457 | if (*result == L2CAP_CONF_PENDING) | ||
1458 | if (val == L2CAP_FCS_NONE) | ||
1459 | set_bit(CONF_RECV_NO_FCS, | ||
1460 | @@ -3717,13 +3733,18 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) | ||
1461 | |||
1462 | while (len >= L2CAP_CONF_OPT_SIZE) { | ||
1463 | len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); | ||
1464 | + if (len < 0) | ||
1465 | + break; | ||
1466 | |||
1467 | switch (type) { | ||
1468 | case L2CAP_CONF_RFC: | ||
1469 | - if (olen == sizeof(rfc)) | ||
1470 | - memcpy(&rfc, (void *)val, olen); | ||
1471 | + if (olen != sizeof(rfc)) | ||
1472 | + break; | ||
1473 | + memcpy(&rfc, (void *)val, olen); | ||
1474 | break; | ||
1475 | case L2CAP_CONF_EWS: | ||
1476 | + if (olen != 2) | ||
1477 | + break; | ||
1478 | txwin_ext = val; | ||
1479 | break; | ||
1480 | } | ||
1481 | diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c | ||
1482 | index 93c706172f40..87c513b5ff2e 100644 | ||
1483 | --- a/net/dccp/ipv6.c | ||
1484 | +++ b/net/dccp/ipv6.c | ||
1485 | @@ -431,8 +431,8 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk, | ||
1486 | newnp->ipv6_mc_list = NULL; | ||
1487 | newnp->ipv6_ac_list = NULL; | ||
1488 | newnp->ipv6_fl_list = NULL; | ||
1489 | - newnp->mcast_oif = inet6_iif(skb); | ||
1490 | - newnp->mcast_hops = ipv6_hdr(skb)->hop_limit; | ||
1491 | + newnp->mcast_oif = inet_iif(skb); | ||
1492 | + newnp->mcast_hops = ip_hdr(skb)->ttl; | ||
1493 | |||
1494 | /* | ||
1495 | * No need to charge this sock to the relevant IPv6 refcnt debug socks count | ||
1496 | diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c | ||
1497 | index 0a69d39880f2..4953466cf98f 100644 | ||
1498 | --- a/net/ipv6/tcp_ipv6.c | ||
1499 | +++ b/net/ipv6/tcp_ipv6.c | ||
1500 | @@ -1056,11 +1056,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * | ||
1501 | newnp->ipv6_fl_list = NULL; | ||
1502 | newnp->pktoptions = NULL; | ||
1503 | newnp->opt = NULL; | ||
1504 | - newnp->mcast_oif = tcp_v6_iif(skb); | ||
1505 | - newnp->mcast_hops = ipv6_hdr(skb)->hop_limit; | ||
1506 | - newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb)); | ||
1507 | + newnp->mcast_oif = inet_iif(skb); | ||
1508 | + newnp->mcast_hops = ip_hdr(skb)->ttl; | ||
1509 | + newnp->rcv_flowinfo = 0; | ||
1510 | if (np->repflow) | ||
1511 | - newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb)); | ||
1512 | + newnp->flow_label = 0; | ||
1513 | |||
1514 | /* | ||
1515 | * No need to charge this sock to the relevant IPv6 refcnt debug socks count | ||
1516 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c | ||
1517 | index 14df2fcf6138..522d4ca715c9 100644 | ||
1518 | --- a/net/packet/af_packet.c | ||
1519 | +++ b/net/packet/af_packet.c | ||
1520 | @@ -3278,7 +3278,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, | ||
1521 | } | ||
1522 | |||
1523 | mutex_lock(&net->packet.sklist_lock); | ||
1524 | - sk_add_node_rcu(sk, &net->packet.sklist); | ||
1525 | + sk_add_node_tail_rcu(sk, &net->packet.sklist); | ||
1526 | mutex_unlock(&net->packet.sklist_lock); | ||
1527 | |||
1528 | preempt_disable(); | ||
1529 | @@ -4229,7 +4229,7 @@ static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order) | ||
1530 | struct pgv *pg_vec; | ||
1531 | int i; | ||
1532 | |||
1533 | - pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL); | ||
1534 | + pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN); | ||
1535 | if (unlikely(!pg_vec)) | ||
1536 | goto out; | ||
1537 | |||
1538 | diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c | ||
1539 | index 7ca57741b2fb..7849f286bb93 100644 | ||
1540 | --- a/net/rose/rose_subr.c | ||
1541 | +++ b/net/rose/rose_subr.c | ||
1542 | @@ -105,16 +105,17 @@ void rose_write_internal(struct sock *sk, int frametype) | ||
1543 | struct sk_buff *skb; | ||
1544 | unsigned char *dptr; | ||
1545 | unsigned char lci1, lci2; | ||
1546 | - char buffer[100]; | ||
1547 | - int len, faclen = 0; | ||
1548 | + int maxfaclen = 0; | ||
1549 | + int len, faclen; | ||
1550 | + int reserve; | ||
1551 | |||
1552 | - len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1; | ||
1553 | + reserve = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1; | ||
1554 | + len = ROSE_MIN_LEN; | ||
1555 | |||
1556 | switch (frametype) { | ||
1557 | case ROSE_CALL_REQUEST: | ||
1558 | len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN; | ||
1559 | - faclen = rose_create_facilities(buffer, rose); | ||
1560 | - len += faclen; | ||
1561 | + maxfaclen = 256; | ||
1562 | break; | ||
1563 | case ROSE_CALL_ACCEPTED: | ||
1564 | case ROSE_CLEAR_REQUEST: | ||
1565 | @@ -123,15 +124,16 @@ void rose_write_internal(struct sock *sk, int frametype) | ||
1566 | break; | ||
1567 | } | ||
1568 | |||
1569 | - if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL) | ||
1570 | + skb = alloc_skb(reserve + len + maxfaclen, GFP_ATOMIC); | ||
1571 | + if (!skb) | ||
1572 | return; | ||
1573 | |||
1574 | /* | ||
1575 | * Space for AX.25 header and PID. | ||
1576 | */ | ||
1577 | - skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1); | ||
1578 | + skb_reserve(skb, reserve); | ||
1579 | |||
1580 | - dptr = skb_put(skb, skb_tailroom(skb)); | ||
1581 | + dptr = skb_put(skb, len); | ||
1582 | |||
1583 | lci1 = (rose->lci >> 8) & 0x0F; | ||
1584 | lci2 = (rose->lci >> 0) & 0xFF; | ||
1585 | @@ -146,7 +148,8 @@ void rose_write_internal(struct sock *sk, int frametype) | ||
1586 | dptr += ROSE_ADDR_LEN; | ||
1587 | memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN); | ||
1588 | dptr += ROSE_ADDR_LEN; | ||
1589 | - memcpy(dptr, buffer, faclen); | ||
1590 | + faclen = rose_create_facilities(dptr, rose); | ||
1591 | + skb_put(skb, faclen); | ||
1592 | dptr += faclen; | ||
1593 | break; | ||
1594 | |||
1595 | diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c | ||
1596 | index 549d0a4083b3..09a353c6373a 100644 | ||
1597 | --- a/net/wireless/nl80211.c | ||
1598 | +++ b/net/wireless/nl80211.c | ||
1599 | @@ -12942,7 +12942,7 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, | ||
1600 | struct sk_buff *msg; | ||
1601 | void *hdr; | ||
1602 | |||
1603 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); | ||
1604 | + msg = nlmsg_new(100 + len, gfp); | ||
1605 | if (!msg) | ||
1606 | return; | ||
1607 | |||
1608 | @@ -13094,7 +13094,7 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, | ||
1609 | struct sk_buff *msg; | ||
1610 | void *hdr; | ||
1611 | |||
1612 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); | ||
1613 | + msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp); | ||
1614 | if (!msg) | ||
1615 | return; | ||
1616 | |||
1617 | @@ -13136,7 +13136,7 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev, | ||
1618 | struct sk_buff *msg; | ||
1619 | void *hdr; | ||
1620 | |||
1621 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); | ||
1622 | + msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp); | ||
1623 | if (!msg) | ||
1624 | return; | ||
1625 | |||
1626 | @@ -13173,7 +13173,7 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, | ||
1627 | struct sk_buff *msg; | ||
1628 | void *hdr; | ||
1629 | |||
1630 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); | ||
1631 | + msg = nlmsg_new(100 + ie_len, GFP_KERNEL); | ||
1632 | if (!msg) | ||
1633 | return; | ||
1634 | |||
1635 | @@ -13249,7 +13249,7 @@ void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, | ||
1636 | |||
1637 | trace_cfg80211_notify_new_peer_candidate(dev, addr); | ||
1638 | |||
1639 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); | ||
1640 | + msg = nlmsg_new(100 + ie_len, gfp); | ||
1641 | if (!msg) | ||
1642 | return; | ||
1643 | |||
1644 | @@ -13620,7 +13620,7 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, | ||
1645 | struct sk_buff *msg; | ||
1646 | void *hdr; | ||
1647 | |||
1648 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); | ||
1649 | + msg = nlmsg_new(100 + len, gfp); | ||
1650 | if (!msg) | ||
1651 | return -ENOMEM; | ||
1652 | |||
1653 | @@ -13664,7 +13664,7 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, | ||
1654 | |||
1655 | trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); | ||
1656 | |||
1657 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); | ||
1658 | + msg = nlmsg_new(100 + len, gfp); | ||
1659 | if (!msg) | ||
1660 | return; | ||
1661 | |||
1662 | @@ -14473,7 +14473,7 @@ void cfg80211_ft_event(struct net_device *netdev, | ||
1663 | if (!ft_event->target_ap) | ||
1664 | return; | ||
1665 | |||
1666 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); | ||
1667 | + msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); | ||
1668 | if (!msg) | ||
1669 | return; | ||
1670 | |||
1671 | diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c | ||
1672 | index cfb8f5896787..824097571467 100644 | ||
1673 | --- a/sound/core/oss/pcm_oss.c | ||
1674 | +++ b/sound/core/oss/pcm_oss.c | ||
1675 | @@ -951,6 +951,28 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) | ||
1676 | oss_frame_size = snd_pcm_format_physical_width(params_format(params)) * | ||
1677 | params_channels(params) / 8; | ||
1678 | |||
1679 | + err = snd_pcm_oss_period_size(substream, params, sparams); | ||
1680 | + if (err < 0) | ||
1681 | + goto failure; | ||
1682 | + | ||
1683 | + n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); | ||
1684 | + err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); | ||
1685 | + if (err < 0) | ||
1686 | + goto failure; | ||
1687 | + | ||
1688 | + err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, | ||
1689 | + runtime->oss.periods, NULL); | ||
1690 | + if (err < 0) | ||
1691 | + goto failure; | ||
1692 | + | ||
1693 | + snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); | ||
1694 | + | ||
1695 | + err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams); | ||
1696 | + if (err < 0) { | ||
1697 | + pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); | ||
1698 | + goto failure; | ||
1699 | + } | ||
1700 | + | ||
1701 | #ifdef CONFIG_SND_PCM_OSS_PLUGINS | ||
1702 | snd_pcm_oss_plugin_clear(substream); | ||
1703 | if (!direct) { | ||
1704 | @@ -985,27 +1007,6 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) | ||
1705 | } | ||
1706 | #endif | ||
1707 | |||
1708 | - err = snd_pcm_oss_period_size(substream, params, sparams); | ||
1709 | - if (err < 0) | ||
1710 | - goto failure; | ||
1711 | - | ||
1712 | - n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); | ||
1713 | - err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); | ||
1714 | - if (err < 0) | ||
1715 | - goto failure; | ||
1716 | - | ||
1717 | - err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, | ||
1718 | - runtime->oss.periods, NULL); | ||
1719 | - if (err < 0) | ||
1720 | - goto failure; | ||
1721 | - | ||
1722 | - snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); | ||
1723 | - | ||
1724 | - if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) { | ||
1725 | - pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); | ||
1726 | - goto failure; | ||
1727 | - } | ||
1728 | - | ||
1729 | if (runtime->oss.trigger) { | ||
1730 | sw_params->start_threshold = 1; | ||
1731 | } else { | ||
1732 | diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c | ||
1733 | index 3586ab41dec4..e1138e70dbb3 100644 | ||
1734 | --- a/sound/core/pcm_native.c | ||
1735 | +++ b/sound/core/pcm_native.c | ||
1736 | @@ -1258,8 +1258,15 @@ static int snd_pcm_pause(struct snd_pcm_substream *substream, int push) | ||
1737 | static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state) | ||
1738 | { | ||
1739 | struct snd_pcm_runtime *runtime = substream->runtime; | ||
1740 | - if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) | ||
1741 | + switch (runtime->status->state) { | ||
1742 | + case SNDRV_PCM_STATE_SUSPENDED: | ||
1743 | return -EBUSY; | ||
1744 | + /* unresumable PCM state; return -EBUSY for skipping suspend */ | ||
1745 | + case SNDRV_PCM_STATE_OPEN: | ||
1746 | + case SNDRV_PCM_STATE_SETUP: | ||
1747 | + case SNDRV_PCM_STATE_DISCONNECTED: | ||
1748 | + return -EBUSY; | ||
1749 | + } | ||
1750 | runtime->trigger_master = substream; | ||
1751 | return 0; | ||
1752 | } | ||
1753 | diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c | ||
1754 | index 59111cadaec2..c8b2309352d7 100644 | ||
1755 | --- a/sound/core/rawmidi.c | ||
1756 | +++ b/sound/core/rawmidi.c | ||
1757 | @@ -29,6 +29,7 @@ | ||
1758 | #include <linux/mutex.h> | ||
1759 | #include <linux/module.h> | ||
1760 | #include <linux/delay.h> | ||
1761 | +#include <linux/nospec.h> | ||
1762 | #include <sound/rawmidi.h> | ||
1763 | #include <sound/info.h> | ||
1764 | #include <sound/control.h> | ||
1765 | @@ -591,6 +592,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card, | ||
1766 | return -ENXIO; | ||
1767 | if (info->stream < 0 || info->stream > 1) | ||
1768 | return -EINVAL; | ||
1769 | + info->stream = array_index_nospec(info->stream, 2); | ||
1770 | pstr = &rmidi->streams[info->stream]; | ||
1771 | if (pstr->substream_count == 0) | ||
1772 | return -ENOENT; | ||
1773 | diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c | ||
1774 | index 278ebb993122..c93945917235 100644 | ||
1775 | --- a/sound/core/seq/oss/seq_oss_synth.c | ||
1776 | +++ b/sound/core/seq/oss/seq_oss_synth.c | ||
1777 | @@ -617,13 +617,14 @@ int | ||
1778 | snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf) | ||
1779 | { | ||
1780 | struct seq_oss_synth *rec; | ||
1781 | + struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev); | ||
1782 | |||
1783 | - if (dev < 0 || dev >= dp->max_synthdev) | ||
1784 | + if (!info) | ||
1785 | return -ENXIO; | ||
1786 | |||
1787 | - if (dp->synths[dev].is_midi) { | ||
1788 | + if (info->is_midi) { | ||
1789 | struct midi_info minf; | ||
1790 | - snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf); | ||
1791 | + snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf); | ||
1792 | inf->synth_type = SYNTH_TYPE_MIDI; | ||
1793 | inf->synth_subtype = 0; | ||
1794 | inf->nr_voices = 16; | ||
1795 | diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | ||
1796 | index 94764efb0a6a..3c1372655c33 100644 | ||
1797 | --- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | ||
1798 | +++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | ||
1799 | @@ -240,19 +240,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params) | ||
1800 | if (!(decoder->tsc_ctc_ratio_n % decoder->tsc_ctc_ratio_d)) | ||
1801 | decoder->tsc_ctc_mult = decoder->tsc_ctc_ratio_n / | ||
1802 | decoder->tsc_ctc_ratio_d; | ||
1803 | - | ||
1804 | - /* | ||
1805 | - * Allow for timestamps appearing to backwards because a TSC | ||
1806 | - * packet has slipped past a MTC packet, so allow 2 MTC ticks | ||
1807 | - * or ... | ||
1808 | - */ | ||
1809 | - decoder->tsc_slip = multdiv(2 << decoder->mtc_shift, | ||
1810 | - decoder->tsc_ctc_ratio_n, | ||
1811 | - decoder->tsc_ctc_ratio_d); | ||
1812 | } | ||
1813 | - /* ... or 0x100 paranoia */ | ||
1814 | - if (decoder->tsc_slip < 0x100) | ||
1815 | - decoder->tsc_slip = 0x100; | ||
1816 | + | ||
1817 | + /* | ||
1818 | + * A TSC packet can slip past MTC packets so that the timestamp appears | ||
1819 | + * to go backwards. One estimate is that can be up to about 40 CPU | ||
1820 | + * cycles, which is certainly less than 0x1000 TSC ticks, but accept | ||
1821 | + * slippage an order of magnitude more to be on the safe side. | ||
1822 | + */ | ||
1823 | + decoder->tsc_slip = 0x10000; | ||
1824 | |||
1825 | intel_pt_log("timestamp: mtc_shift %u\n", decoder->mtc_shift); | ||
1826 | intel_pt_log("timestamp: tsc_ctc_ratio_n %u\n", decoder->tsc_ctc_ratio_n); | ||
1827 | diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c | ||
1828 | index 60de4c337f0a..c72586a094ed 100644 | ||
1829 | --- a/virt/kvm/kvm_main.c | ||
1830 | +++ b/virt/kvm/kvm_main.c | ||
1831 | @@ -2793,6 +2793,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, | ||
1832 | { | ||
1833 | struct kvm_device *dev = filp->private_data; | ||
1834 | |||
1835 | + if (dev->kvm->mm != current->mm) | ||
1836 | + return -EIO; | ||
1837 | + | ||
1838 | switch (ioctl) { | ||
1839 | case KVM_SET_DEVICE_ATTR: | ||
1840 | return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg); |