Contents of /trunk/kernel-alx/patches-4.9/0266-4.9.167-all-fixes.patch
Parent Directory | Revision Log
Revision 3343 -
(show annotations)
(download)
Tue Jun 18 09:41:57 2019 UTC (5 years, 3 months ago) by niro
File size: 64432 byte(s)
Tue Jun 18 09:41:57 2019 UTC (5 years, 3 months ago) by niro
File size: 64432 byte(s)
-linux-4.9.167
1 | diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt |
2 | index 3ff58a8ffabb..d1908e50b506 100644 |
3 | --- a/Documentation/virtual/kvm/api.txt |
4 | +++ b/Documentation/virtual/kvm/api.txt |
5 | @@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes |
6 | |
7 | - VM ioctls: These query and set attributes that affect an entire virtual |
8 | machine, for example memory layout. In addition a VM ioctl is used to |
9 | - create virtual cpus (vcpus). |
10 | + create virtual cpus (vcpus) and devices. |
11 | |
12 | Only run VM ioctls from the same process (address space) that was used |
13 | to create the VM. |
14 | @@ -24,6 +24,11 @@ of a virtual machine. The ioctls belong to three classes |
15 | Only run vcpu ioctls from the same thread that was used to create the |
16 | vcpu. |
17 | |
18 | + - device ioctls: These query and set attributes that control the operation |
19 | + of a single device. |
20 | + |
21 | + device ioctls must be issued from the same process (address space) that |
22 | + was used to create the VM. |
23 | |
24 | 2. File descriptors |
25 | ------------------- |
26 | @@ -32,10 +37,11 @@ The kvm API is centered around file descriptors. An initial |
27 | open("/dev/kvm") obtains a handle to the kvm subsystem; this handle |
28 | can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this |
29 | handle will create a VM file descriptor which can be used to issue VM |
30 | -ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu |
31 | -and return a file descriptor pointing to it. Finally, ioctls on a vcpu |
32 | -fd can be used to control the vcpu, including the important task of |
33 | -actually running guest code. |
34 | +ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will |
35 | +create a virtual cpu or device and return a file descriptor pointing to |
36 | +the new resource. Finally, ioctls on a vcpu or device fd can be used |
37 | +to control the vcpu or device. For vcpus, this includes the important |
38 | +task of actually running guest code. |
39 | |
40 | In general file descriptors can be migrated among processes by means |
41 | of fork() and the SCM_RIGHTS facility of unix domain socket. These |
42 | diff --git a/Makefile b/Makefile |
43 | index 90478086eff5..2f030baeb162 100644 |
44 | --- a/Makefile |
45 | +++ b/Makefile |
46 | @@ -1,6 +1,6 @@ |
47 | VERSION = 4 |
48 | PATCHLEVEL = 9 |
49 | -SUBLEVEL = 166 |
50 | +SUBLEVEL = 167 |
51 | EXTRAVERSION = |
52 | NAME = Roaring Lionus |
53 | |
54 | diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c b/arch/arm/mach-imx/cpuidle-imx6q.c |
55 | index bfeb25aaf9a2..326e870d7123 100644 |
56 | --- a/arch/arm/mach-imx/cpuidle-imx6q.c |
57 | +++ b/arch/arm/mach-imx/cpuidle-imx6q.c |
58 | @@ -16,30 +16,23 @@ |
59 | #include "cpuidle.h" |
60 | #include "hardware.h" |
61 | |
62 | -static atomic_t master = ATOMIC_INIT(0); |
63 | -static DEFINE_SPINLOCK(master_lock); |
64 | +static int num_idle_cpus = 0; |
65 | +static DEFINE_SPINLOCK(cpuidle_lock); |
66 | |
67 | static int imx6q_enter_wait(struct cpuidle_device *dev, |
68 | struct cpuidle_driver *drv, int index) |
69 | { |
70 | - if (atomic_inc_return(&master) == num_online_cpus()) { |
71 | - /* |
72 | - * With this lock, we prevent other cpu to exit and enter |
73 | - * this function again and become the master. |
74 | - */ |
75 | - if (!spin_trylock(&master_lock)) |
76 | - goto idle; |
77 | + spin_lock(&cpuidle_lock); |
78 | + if (++num_idle_cpus == num_online_cpus()) |
79 | imx6_set_lpm(WAIT_UNCLOCKED); |
80 | - cpu_do_idle(); |
81 | - imx6_set_lpm(WAIT_CLOCKED); |
82 | - spin_unlock(&master_lock); |
83 | - goto done; |
84 | - } |
85 | + spin_unlock(&cpuidle_lock); |
86 | |
87 | -idle: |
88 | cpu_do_idle(); |
89 | -done: |
90 | - atomic_dec(&master); |
91 | + |
92 | + spin_lock(&cpuidle_lock); |
93 | + if (num_idle_cpus-- == num_online_cpus()) |
94 | + imx6_set_lpm(WAIT_CLOCKED); |
95 | + spin_unlock(&cpuidle_lock); |
96 | |
97 | return index; |
98 | } |
99 | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig |
100 | index 3e43874568f9..2eb8ae1b2d03 100644 |
101 | --- a/arch/arm64/Kconfig |
102 | +++ b/arch/arm64/Kconfig |
103 | @@ -1079,6 +1079,10 @@ config SYSVIPC_COMPAT |
104 | def_bool y |
105 | depends on COMPAT && SYSVIPC |
106 | |
107 | +config KEYS_COMPAT |
108 | + def_bool y |
109 | + depends on COMPAT && KEYS |
110 | + |
111 | endmenu |
112 | |
113 | menu "Power management options" |
114 | diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h |
115 | index c4ced1d01d57..48e8f1f14872 100644 |
116 | --- a/arch/powerpc/include/asm/ppc-opcode.h |
117 | +++ b/arch/powerpc/include/asm/ppc-opcode.h |
118 | @@ -225,6 +225,7 @@ |
119 | /* Misc instructions for BPF compiler */ |
120 | #define PPC_INST_LBZ 0x88000000 |
121 | #define PPC_INST_LD 0xe8000000 |
122 | +#define PPC_INST_LDX 0x7c00002a |
123 | #define PPC_INST_LHZ 0xa0000000 |
124 | #define PPC_INST_LWZ 0x80000000 |
125 | #define PPC_INST_LHBRX 0x7c00062c |
126 | @@ -232,6 +233,7 @@ |
127 | #define PPC_INST_STB 0x98000000 |
128 | #define PPC_INST_STH 0xb0000000 |
129 | #define PPC_INST_STD 0xf8000000 |
130 | +#define PPC_INST_STDX 0x7c00012a |
131 | #define PPC_INST_STDU 0xf8000001 |
132 | #define PPC_INST_STW 0x90000000 |
133 | #define PPC_INST_STWU 0x94000000 |
134 | diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h |
135 | index 89f70073dec8..7b1d1721a26a 100644 |
136 | --- a/arch/powerpc/net/bpf_jit.h |
137 | +++ b/arch/powerpc/net/bpf_jit.h |
138 | @@ -51,6 +51,8 @@ |
139 | #define PPC_LIS(r, i) PPC_ADDIS(r, 0, i) |
140 | #define PPC_STD(r, base, i) EMIT(PPC_INST_STD | ___PPC_RS(r) | \ |
141 | ___PPC_RA(base) | ((i) & 0xfffc)) |
142 | +#define PPC_STDX(r, base, b) EMIT(PPC_INST_STDX | ___PPC_RS(r) | \ |
143 | + ___PPC_RA(base) | ___PPC_RB(b)) |
144 | #define PPC_STDU(r, base, i) EMIT(PPC_INST_STDU | ___PPC_RS(r) | \ |
145 | ___PPC_RA(base) | ((i) & 0xfffc)) |
146 | #define PPC_STW(r, base, i) EMIT(PPC_INST_STW | ___PPC_RS(r) | \ |
147 | @@ -65,7 +67,9 @@ |
148 | #define PPC_LBZ(r, base, i) EMIT(PPC_INST_LBZ | ___PPC_RT(r) | \ |
149 | ___PPC_RA(base) | IMM_L(i)) |
150 | #define PPC_LD(r, base, i) EMIT(PPC_INST_LD | ___PPC_RT(r) | \ |
151 | - ___PPC_RA(base) | IMM_L(i)) |
152 | + ___PPC_RA(base) | ((i) & 0xfffc)) |
153 | +#define PPC_LDX(r, base, b) EMIT(PPC_INST_LDX | ___PPC_RT(r) | \ |
154 | + ___PPC_RA(base) | ___PPC_RB(b)) |
155 | #define PPC_LWZ(r, base, i) EMIT(PPC_INST_LWZ | ___PPC_RT(r) | \ |
156 | ___PPC_RA(base) | IMM_L(i)) |
157 | #define PPC_LHZ(r, base, i) EMIT(PPC_INST_LHZ | ___PPC_RT(r) | \ |
158 | @@ -85,17 +89,6 @@ |
159 | ___PPC_RA(a) | ___PPC_RB(b)) |
160 | #define PPC_BPF_STDCX(s, a, b) EMIT(PPC_INST_STDCX | ___PPC_RS(s) | \ |
161 | ___PPC_RA(a) | ___PPC_RB(b)) |
162 | - |
163 | -#ifdef CONFIG_PPC64 |
164 | -#define PPC_BPF_LL(r, base, i) do { PPC_LD(r, base, i); } while(0) |
165 | -#define PPC_BPF_STL(r, base, i) do { PPC_STD(r, base, i); } while(0) |
166 | -#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0) |
167 | -#else |
168 | -#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0) |
169 | -#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0) |
170 | -#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0) |
171 | -#endif |
172 | - |
173 | #define PPC_CMPWI(a, i) EMIT(PPC_INST_CMPWI | ___PPC_RA(a) | IMM_L(i)) |
174 | #define PPC_CMPDI(a, i) EMIT(PPC_INST_CMPDI | ___PPC_RA(a) | IMM_L(i)) |
175 | #define PPC_CMPW(a, b) EMIT(PPC_INST_CMPW | ___PPC_RA(a) | \ |
176 | diff --git a/arch/powerpc/net/bpf_jit32.h b/arch/powerpc/net/bpf_jit32.h |
177 | index a8cd7e289ecd..81a9045d8410 100644 |
178 | --- a/arch/powerpc/net/bpf_jit32.h |
179 | +++ b/arch/powerpc/net/bpf_jit32.h |
180 | @@ -122,6 +122,10 @@ DECLARE_LOAD_FUNC(sk_load_byte_msh); |
181 | #define PPC_NTOHS_OFFS(r, base, i) PPC_LHZ_OFFS(r, base, i) |
182 | #endif |
183 | |
184 | +#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0) |
185 | +#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0) |
186 | +#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0) |
187 | + |
188 | #define SEEN_DATAREF 0x10000 /* might call external helpers */ |
189 | #define SEEN_XREG 0x20000 /* X reg is used */ |
190 | #define SEEN_MEM 0x40000 /* SEEN_MEM+(1<<n) = use mem[n] for temporary |
191 | diff --git a/arch/powerpc/net/bpf_jit64.h b/arch/powerpc/net/bpf_jit64.h |
192 | index 62fa7589db2b..bb944b6018d7 100644 |
193 | --- a/arch/powerpc/net/bpf_jit64.h |
194 | +++ b/arch/powerpc/net/bpf_jit64.h |
195 | @@ -86,6 +86,26 @@ DECLARE_LOAD_FUNC(sk_load_byte); |
196 | (imm >= SKF_LL_OFF ? func##_negative_offset : func) : \ |
197 | func##_positive_offset) |
198 | |
199 | +/* |
200 | + * WARNING: These can use TMP_REG_2 if the offset is not at word boundary, |
201 | + * so ensure that it isn't in use already. |
202 | + */ |
203 | +#define PPC_BPF_LL(r, base, i) do { \ |
204 | + if ((i) % 4) { \ |
205 | + PPC_LI(b2p[TMP_REG_2], (i)); \ |
206 | + PPC_LDX(r, base, b2p[TMP_REG_2]); \ |
207 | + } else \ |
208 | + PPC_LD(r, base, i); \ |
209 | + } while(0) |
210 | +#define PPC_BPF_STL(r, base, i) do { \ |
211 | + if ((i) % 4) { \ |
212 | + PPC_LI(b2p[TMP_REG_2], (i)); \ |
213 | + PPC_STDX(r, base, b2p[TMP_REG_2]); \ |
214 | + } else \ |
215 | + PPC_STD(r, base, i); \ |
216 | + } while(0) |
217 | +#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0) |
218 | + |
219 | #define SEEN_FUNC 0x1000 /* might call external helpers */ |
220 | #define SEEN_STACK 0x2000 /* uses BPF stack */ |
221 | #define SEEN_SKB 0x4000 /* uses sk_buff */ |
222 | diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c |
223 | index bdbbc320b006..e7d78f9156ce 100644 |
224 | --- a/arch/powerpc/net/bpf_jit_comp64.c |
225 | +++ b/arch/powerpc/net/bpf_jit_comp64.c |
226 | @@ -265,7 +265,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 |
227 | * if (tail_call_cnt > MAX_TAIL_CALL_CNT) |
228 | * goto out; |
229 | */ |
230 | - PPC_LD(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx)); |
231 | + PPC_BPF_LL(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx)); |
232 | PPC_CMPLWI(b2p[TMP_REG_1], MAX_TAIL_CALL_CNT); |
233 | PPC_BCC(COND_GT, out); |
234 | |
235 | @@ -278,7 +278,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 |
236 | /* prog = array->ptrs[index]; */ |
237 | PPC_MULI(b2p[TMP_REG_1], b2p_index, 8); |
238 | PPC_ADD(b2p[TMP_REG_1], b2p[TMP_REG_1], b2p_bpf_array); |
239 | - PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs)); |
240 | + PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs)); |
241 | |
242 | /* |
243 | * if (prog == NULL) |
244 | @@ -288,7 +288,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 |
245 | PPC_BCC(COND_EQ, out); |
246 | |
247 | /* goto *(prog->bpf_func + prologue_size); */ |
248 | - PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func)); |
249 | + PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func)); |
250 | #ifdef PPC64_ELF_ABI_v1 |
251 | /* skip past the function descriptor */ |
252 | PPC_ADDI(b2p[TMP_REG_1], b2p[TMP_REG_1], |
253 | @@ -620,7 +620,7 @@ bpf_alu32_trunc: |
254 | * the instructions generated will remain the |
255 | * same across all passes |
256 | */ |
257 | - PPC_STD(dst_reg, 1, bpf_jit_stack_local(ctx)); |
258 | + PPC_BPF_STL(dst_reg, 1, bpf_jit_stack_local(ctx)); |
259 | PPC_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx)); |
260 | PPC_LDBRX(dst_reg, 0, b2p[TMP_REG_1]); |
261 | break; |
262 | @@ -676,7 +676,7 @@ emit_clear: |
263 | PPC_LI32(b2p[TMP_REG_1], imm); |
264 | src_reg = b2p[TMP_REG_1]; |
265 | } |
266 | - PPC_STD(src_reg, dst_reg, off); |
267 | + PPC_BPF_STL(src_reg, dst_reg, off); |
268 | break; |
269 | |
270 | /* |
271 | @@ -723,7 +723,7 @@ emit_clear: |
272 | break; |
273 | /* dst = *(u64 *)(ul) (src + off) */ |
274 | case BPF_LDX | BPF_MEM | BPF_DW: |
275 | - PPC_LD(dst_reg, src_reg, off); |
276 | + PPC_BPF_LL(dst_reg, src_reg, off); |
277 | break; |
278 | |
279 | /* |
280 | diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig |
281 | index e31001ec4c07..5a4591ff8407 100644 |
282 | --- a/arch/x86/Kconfig |
283 | +++ b/arch/x86/Kconfig |
284 | @@ -2051,14 +2051,8 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING |
285 | If unsure, leave at the default value. |
286 | |
287 | config HOTPLUG_CPU |
288 | - bool "Support for hot-pluggable CPUs" |
289 | + def_bool y |
290 | depends on SMP |
291 | - ---help--- |
292 | - Say Y here to allow turning CPUs off and on. CPUs can be |
293 | - controlled through /sys/devices/system/cpu. |
294 | - ( Note: power management support will enable this option |
295 | - automatically on SMP systems. ) |
296 | - Say N if you want to disable CPU hotplug. |
297 | |
298 | config BOOTPARAM_HOTPLUG_CPU0 |
299 | bool "Set default setting of cpu0_hotpluggable" |
300 | diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h |
301 | index 9a8167b175d5..83b5b2990b49 100644 |
302 | --- a/arch/x86/include/asm/kvm_host.h |
303 | +++ b/arch/x86/include/asm/kvm_host.h |
304 | @@ -487,6 +487,7 @@ struct kvm_vcpu_arch { |
305 | bool tpr_access_reporting; |
306 | u64 ia32_xss; |
307 | u64 microcode_version; |
308 | + u64 arch_capabilities; |
309 | |
310 | /* |
311 | * Paging state of the vcpu |
312 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
313 | index a34fb7284024..75466d9417b8 100644 |
314 | --- a/arch/x86/kvm/vmx.c |
315 | +++ b/arch/x86/kvm/vmx.c |
316 | @@ -714,7 +714,6 @@ struct vcpu_vmx { |
317 | u64 msr_guest_kernel_gs_base; |
318 | #endif |
319 | |
320 | - u64 arch_capabilities; |
321 | u64 spec_ctrl; |
322 | |
323 | u32 vm_entry_controls_shadow; |
324 | @@ -3209,12 +3208,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) |
325 | |
326 | msr_info->data = to_vmx(vcpu)->spec_ctrl; |
327 | break; |
328 | - case MSR_IA32_ARCH_CAPABILITIES: |
329 | - if (!msr_info->host_initiated && |
330 | - !guest_cpuid_has_arch_capabilities(vcpu)) |
331 | - return 1; |
332 | - msr_info->data = to_vmx(vcpu)->arch_capabilities; |
333 | - break; |
334 | case MSR_IA32_SYSENTER_CS: |
335 | msr_info->data = vmcs_read32(GUEST_SYSENTER_CS); |
336 | break; |
337 | @@ -3376,11 +3369,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) |
338 | vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, |
339 | MSR_TYPE_W); |
340 | break; |
341 | - case MSR_IA32_ARCH_CAPABILITIES: |
342 | - if (!msr_info->host_initiated) |
343 | - return 1; |
344 | - vmx->arch_capabilities = data; |
345 | - break; |
346 | case MSR_IA32_CR_PAT: |
347 | if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { |
348 | if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data)) |
349 | @@ -5468,8 +5456,6 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) |
350 | ++vmx->nmsrs; |
351 | } |
352 | |
353 | - vmx->arch_capabilities = kvm_get_arch_capabilities(); |
354 | - |
355 | vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl); |
356 | |
357 | /* 22.2.1, 20.8.1 */ |
358 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c |
359 | index a29df9ccbfde..8285142556b5 100644 |
360 | --- a/arch/x86/kvm/x86.c |
361 | +++ b/arch/x86/kvm/x86.c |
362 | @@ -2197,6 +2197,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) |
363 | if (msr_info->host_initiated) |
364 | vcpu->arch.microcode_version = data; |
365 | break; |
366 | + case MSR_IA32_ARCH_CAPABILITIES: |
367 | + if (!msr_info->host_initiated) |
368 | + return 1; |
369 | + vcpu->arch.arch_capabilities = data; |
370 | + break; |
371 | case MSR_EFER: |
372 | return set_efer(vcpu, data); |
373 | case MSR_K7_HWCR: |
374 | @@ -2473,6 +2478,12 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) |
375 | case MSR_IA32_UCODE_REV: |
376 | msr_info->data = vcpu->arch.microcode_version; |
377 | break; |
378 | + case MSR_IA32_ARCH_CAPABILITIES: |
379 | + if (!msr_info->host_initiated && |
380 | + !guest_cpuid_has_arch_capabilities(vcpu)) |
381 | + return 1; |
382 | + msr_info->data = vcpu->arch.arch_capabilities; |
383 | + break; |
384 | case MSR_MTRRcap: |
385 | case 0x200 ... 0x2ff: |
386 | return kvm_mtrr_get_msr(vcpu, msr_info->index, &msr_info->data); |
387 | @@ -7672,6 +7683,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu) |
388 | { |
389 | int r; |
390 | |
391 | + vcpu->arch.arch_capabilities = kvm_get_arch_capabilities(); |
392 | kvm_vcpu_mtrr_init(vcpu); |
393 | r = vcpu_load(vcpu); |
394 | if (r) |
395 | diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c |
396 | index 8ff7b0d3eac6..3b68c03a281d 100644 |
397 | --- a/drivers/gpio/gpio-adnp.c |
398 | +++ b/drivers/gpio/gpio-adnp.c |
399 | @@ -132,8 +132,10 @@ static int adnp_gpio_direction_input(struct gpio_chip *chip, unsigned offset) |
400 | if (err < 0) |
401 | goto out; |
402 | |
403 | - if (err & BIT(pos)) |
404 | - err = -EACCES; |
405 | + if (value & BIT(pos)) { |
406 | + err = -EPERM; |
407 | + goto out; |
408 | + } |
409 | |
410 | err = 0; |
411 | |
412 | diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c |
413 | index 480c2d7794eb..8feb8e9e29a6 100644 |
414 | --- a/drivers/isdn/hardware/mISDN/hfcmulti.c |
415 | +++ b/drivers/isdn/hardware/mISDN/hfcmulti.c |
416 | @@ -4370,7 +4370,8 @@ setup_pci(struct hfc_multi *hc, struct pci_dev *pdev, |
417 | if (m->clock2) |
418 | test_and_set_bit(HFC_CHIP_CLOCK2, &hc->chip); |
419 | |
420 | - if (ent->device == 0xB410) { |
421 | + if (ent->vendor == PCI_VENDOR_ID_DIGIUM && |
422 | + ent->device == PCI_DEVICE_ID_DIGIUM_HFC4S) { |
423 | test_and_set_bit(HFC_CHIP_B410P, &hc->chip); |
424 | test_and_set_bit(HFC_CHIP_PCM_MASTER, &hc->chip); |
425 | test_and_clear_bit(HFC_CHIP_PCM_SLAVE, &hc->chip); |
426 | diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c |
427 | index 7f64a76acd37..ebfbaf8597f4 100644 |
428 | --- a/drivers/net/dsa/qca8k.c |
429 | +++ b/drivers/net/dsa/qca8k.c |
430 | @@ -630,22 +630,6 @@ qca8k_adjust_link(struct dsa_switch *ds, int port, struct phy_device *phy) |
431 | qca8k_port_set_status(priv, port, 1); |
432 | } |
433 | |
434 | -static int |
435 | -qca8k_phy_read(struct dsa_switch *ds, int phy, int regnum) |
436 | -{ |
437 | - struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv; |
438 | - |
439 | - return mdiobus_read(priv->bus, phy, regnum); |
440 | -} |
441 | - |
442 | -static int |
443 | -qca8k_phy_write(struct dsa_switch *ds, int phy, int regnum, u16 val) |
444 | -{ |
445 | - struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv; |
446 | - |
447 | - return mdiobus_write(priv->bus, phy, regnum, val); |
448 | -} |
449 | - |
450 | static void |
451 | qca8k_get_strings(struct dsa_switch *ds, int port, uint8_t *data) |
452 | { |
453 | @@ -961,8 +945,6 @@ static struct dsa_switch_ops qca8k_switch_ops = { |
454 | .setup = qca8k_setup, |
455 | .adjust_link = qca8k_adjust_link, |
456 | .get_strings = qca8k_get_strings, |
457 | - .phy_read = qca8k_phy_read, |
458 | - .phy_write = qca8k_phy_write, |
459 | .get_ethtool_stats = qca8k_get_ethtool_stats, |
460 | .get_sset_count = qca8k_get_sset_count, |
461 | .get_eee = qca8k_get_eee, |
462 | diff --git a/drivers/net/ethernet/8390/mac8390.c b/drivers/net/ethernet/8390/mac8390.c |
463 | index b9283901136e..0fdc9ad32a2e 100644 |
464 | --- a/drivers/net/ethernet/8390/mac8390.c |
465 | +++ b/drivers/net/ethernet/8390/mac8390.c |
466 | @@ -156,8 +156,6 @@ static void dayna_block_output(struct net_device *dev, int count, |
467 | #define memcpy_fromio(a, b, c) memcpy((a), (void *)(b), (c)) |
468 | #define memcpy_toio(a, b, c) memcpy((void *)(a), (b), (c)) |
469 | |
470 | -#define memcmp_withio(a, b, c) memcmp((a), (void *)(b), (c)) |
471 | - |
472 | /* Slow Sane (16-bit chunk memory read/write) Cabletron uses this */ |
473 | static void slow_sane_get_8390_hdr(struct net_device *dev, |
474 | struct e8390_pkt_hdr *hdr, int ring_page); |
475 | @@ -237,19 +235,26 @@ static enum mac8390_type __init mac8390_ident(struct nubus_dev *dev) |
476 | |
477 | static enum mac8390_access __init mac8390_testio(volatile unsigned long membase) |
478 | { |
479 | - unsigned long outdata = 0xA5A0B5B0; |
480 | - unsigned long indata = 0x00000000; |
481 | + u32 outdata = 0xA5A0B5B0; |
482 | + u32 indata = 0; |
483 | + |
484 | /* Try writing 32 bits */ |
485 | - memcpy_toio(membase, &outdata, 4); |
486 | - /* Now compare them */ |
487 | - if (memcmp_withio(&outdata, membase, 4) == 0) |
488 | + nubus_writel(outdata, membase); |
489 | + /* Now read it back */ |
490 | + indata = nubus_readl(membase); |
491 | + if (outdata == indata) |
492 | return ACCESS_32; |
493 | + |
494 | + outdata = 0xC5C0D5D0; |
495 | + indata = 0; |
496 | + |
497 | /* Write 16 bit output */ |
498 | word_memcpy_tocard(membase, &outdata, 4); |
499 | /* Now read it back */ |
500 | word_memcpy_fromcard(&indata, membase, 4); |
501 | if (outdata == indata) |
502 | return ACCESS_16; |
503 | + |
504 | return ACCESS_UNKNOWN; |
505 | } |
506 | |
507 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
508 | index 20a2b01b392c..fc437d75ac76 100644 |
509 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
510 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
511 | @@ -2931,6 +2931,20 @@ static int stmmac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) |
512 | return ret; |
513 | } |
514 | |
515 | +static int stmmac_set_mac_address(struct net_device *ndev, void *addr) |
516 | +{ |
517 | + struct stmmac_priv *priv = netdev_priv(ndev); |
518 | + int ret = 0; |
519 | + |
520 | + ret = eth_mac_addr(ndev, addr); |
521 | + if (ret) |
522 | + return ret; |
523 | + |
524 | + priv->hw->mac->set_umac_addr(priv->hw, ndev->dev_addr, 0); |
525 | + |
526 | + return ret; |
527 | +} |
528 | + |
529 | #ifdef CONFIG_DEBUG_FS |
530 | static struct dentry *stmmac_fs_dir; |
531 | |
532 | @@ -3137,7 +3151,7 @@ static const struct net_device_ops stmmac_netdev_ops = { |
533 | #ifdef CONFIG_NET_POLL_CONTROLLER |
534 | .ndo_poll_controller = stmmac_poll_controller, |
535 | #endif |
536 | - .ndo_set_mac_address = eth_mac_addr, |
537 | + .ndo_set_mac_address = stmmac_set_mac_address, |
538 | }; |
539 | |
540 | /** |
541 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c |
542 | index 24cc94453d38..88fe38d6a7ef 100644 |
543 | --- a/drivers/net/tun.c |
544 | +++ b/drivers/net/tun.c |
545 | @@ -1194,9 +1194,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, |
546 | u32 rxhash; |
547 | ssize_t n; |
548 | |
549 | - if (!(tun->dev->flags & IFF_UP)) |
550 | - return -EIO; |
551 | - |
552 | if (!(tun->flags & IFF_NO_PI)) { |
553 | if (len < sizeof(pi)) |
554 | return -EINVAL; |
555 | @@ -1273,9 +1270,11 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, |
556 | err = skb_copy_datagram_from_iter(skb, 0, from, len); |
557 | |
558 | if (err) { |
559 | + err = -EFAULT; |
560 | +drop: |
561 | this_cpu_inc(tun->pcpu_stats->rx_dropped); |
562 | kfree_skb(skb); |
563 | - return -EFAULT; |
564 | + return err; |
565 | } |
566 | |
567 | err = virtio_net_hdr_to_skb(skb, &gso, tun_is_little_endian(tun)); |
568 | @@ -1327,7 +1326,16 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, |
569 | skb_probe_transport_header(skb, 0); |
570 | |
571 | rxhash = skb_get_hash(skb); |
572 | + |
573 | + rcu_read_lock(); |
574 | + if (unlikely(!(tun->dev->flags & IFF_UP))) { |
575 | + err = -EIO; |
576 | + rcu_read_unlock(); |
577 | + goto drop; |
578 | + } |
579 | + |
580 | netif_rx_ni(skb); |
581 | + rcu_read_unlock(); |
582 | |
583 | stats = get_cpu_ptr(tun->pcpu_stats); |
584 | u64_stats_update_begin(&stats->syncp); |
585 | diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c |
586 | index 016f5da425ab..b6ee0c1690d8 100644 |
587 | --- a/drivers/net/vxlan.c |
588 | +++ b/drivers/net/vxlan.c |
589 | @@ -3375,10 +3375,8 @@ static void __net_exit vxlan_exit_net(struct net *net) |
590 | /* If vxlan->dev is in the same netns, it has already been added |
591 | * to the list by the previous loop. |
592 | */ |
593 | - if (!net_eq(dev_net(vxlan->dev), net)) { |
594 | - gro_cells_destroy(&vxlan->gro_cells); |
595 | + if (!net_eq(dev_net(vxlan->dev), net)) |
596 | unregister_netdevice_queue(vxlan->dev, &list); |
597 | - } |
598 | } |
599 | |
600 | unregister_netdevice_many(&list); |
601 | diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c |
602 | index 2abcd331b05d..abe460eac712 100644 |
603 | --- a/drivers/s390/scsi/zfcp_erp.c |
604 | +++ b/drivers/s390/scsi/zfcp_erp.c |
605 | @@ -652,6 +652,20 @@ static void zfcp_erp_strategy_memwait(struct zfcp_erp_action *erp_action) |
606 | add_timer(&erp_action->timer); |
607 | } |
608 | |
609 | +void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter, |
610 | + int clear, char *dbftag) |
611 | +{ |
612 | + unsigned long flags; |
613 | + struct zfcp_port *port; |
614 | + |
615 | + write_lock_irqsave(&adapter->erp_lock, flags); |
616 | + read_lock(&adapter->port_list_lock); |
617 | + list_for_each_entry(port, &adapter->port_list, list) |
618 | + _zfcp_erp_port_forced_reopen(port, clear, dbftag); |
619 | + read_unlock(&adapter->port_list_lock); |
620 | + write_unlock_irqrestore(&adapter->erp_lock, flags); |
621 | +} |
622 | + |
623 | static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter, |
624 | int clear, char *id) |
625 | { |
626 | @@ -1306,6 +1320,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port) |
627 | struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev); |
628 | int lun_status; |
629 | |
630 | + if (sdev->sdev_state == SDEV_DEL || |
631 | + sdev->sdev_state == SDEV_CANCEL) |
632 | + continue; |
633 | if (zsdev->port != port) |
634 | continue; |
635 | /* LUN under port of interest */ |
636 | diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h |
637 | index b326f05c7f89..a39a74500e23 100644 |
638 | --- a/drivers/s390/scsi/zfcp_ext.h |
639 | +++ b/drivers/s390/scsi/zfcp_ext.h |
640 | @@ -68,6 +68,8 @@ extern void zfcp_erp_clear_port_status(struct zfcp_port *, u32); |
641 | extern int zfcp_erp_port_reopen(struct zfcp_port *, int, char *); |
642 | extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *); |
643 | extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *); |
644 | +extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter, |
645 | + int clear, char *dbftag); |
646 | extern void zfcp_erp_set_lun_status(struct scsi_device *, u32); |
647 | extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32); |
648 | extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *); |
649 | diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c |
650 | index 3afb200b2829..bdb257eaa2e5 100644 |
651 | --- a/drivers/s390/scsi/zfcp_scsi.c |
652 | +++ b/drivers/s390/scsi/zfcp_scsi.c |
653 | @@ -326,6 +326,10 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt) |
654 | struct zfcp_adapter *adapter = zfcp_sdev->port->adapter; |
655 | int ret = SUCCESS, fc_ret; |
656 | |
657 | + if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) { |
658 | + zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p"); |
659 | + zfcp_erp_wait(adapter); |
660 | + } |
661 | zfcp_erp_adapter_reopen(adapter, 0, "schrh_1"); |
662 | zfcp_erp_wait(adapter); |
663 | fc_ret = fc_block_scsi_eh(scpnt); |
664 | diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c |
665 | index 3e9cbba41464..58345d3d4682 100644 |
666 | --- a/drivers/scsi/sd.c |
667 | +++ b/drivers/scsi/sd.c |
668 | @@ -1284,11 +1284,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode) |
669 | scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW); |
670 | } |
671 | |
672 | - /* |
673 | - * XXX and what if there are packets in flight and this close() |
674 | - * XXX is followed by a "rmmod sd_mod"? |
675 | - */ |
676 | - |
677 | scsi_disk_put(sdkp); |
678 | } |
679 | |
680 | @@ -2846,6 +2841,9 @@ static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp, |
681 | unsigned int opt_xfer_bytes = |
682 | logical_to_bytes(sdp, sdkp->opt_xfer_blocks); |
683 | |
684 | + if (sdkp->opt_xfer_blocks == 0) |
685 | + return false; |
686 | + |
687 | if (sdkp->opt_xfer_blocks > dev_max) { |
688 | sd_first_printk(KERN_WARNING, sdkp, |
689 | "Optimal transfer size %u logical blocks " \ |
690 | @@ -3257,11 +3255,23 @@ static void scsi_disk_release(struct device *dev) |
691 | { |
692 | struct scsi_disk *sdkp = to_scsi_disk(dev); |
693 | struct gendisk *disk = sdkp->disk; |
694 | - |
695 | + struct request_queue *q = disk->queue; |
696 | + |
697 | spin_lock(&sd_index_lock); |
698 | ida_remove(&sd_index_ida, sdkp->index); |
699 | spin_unlock(&sd_index_lock); |
700 | |
701 | + /* |
702 | + * Wait until all requests that are in progress have completed. |
703 | + * This is necessary to avoid that e.g. scsi_end_request() crashes |
704 | + * due to clearing the disk->private_data pointer. Wait from inside |
705 | + * scsi_disk_release() instead of from sd_release() to avoid that |
706 | + * freezing and unfreezing the request queue affects user space I/O |
707 | + * in case multiple processes open a /dev/sd... node concurrently. |
708 | + */ |
709 | + blk_mq_freeze_queue(q); |
710 | + blk_mq_unfreeze_queue(q); |
711 | + |
712 | disk->private_data = NULL; |
713 | put_disk(disk); |
714 | put_device(&sdkp->device->sdev_gendev); |
715 | diff --git a/drivers/staging/comedi/comedidev.h b/drivers/staging/comedi/comedidev.h |
716 | index dcb637665eb7..35432fbd6551 100644 |
717 | --- a/drivers/staging/comedi/comedidev.h |
718 | +++ b/drivers/staging/comedi/comedidev.h |
719 | @@ -984,6 +984,8 @@ int comedi_dio_insn_config(struct comedi_device *, struct comedi_subdevice *, |
720 | unsigned int mask); |
721 | unsigned int comedi_dio_update_state(struct comedi_subdevice *, |
722 | unsigned int *data); |
723 | +unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, |
724 | + struct comedi_cmd *cmd); |
725 | unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s); |
726 | unsigned int comedi_nscans_left(struct comedi_subdevice *s, |
727 | unsigned int nscans); |
728 | diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c |
729 | index 1736248bc5b8..8ca5493c66fe 100644 |
730 | --- a/drivers/staging/comedi/drivers.c |
731 | +++ b/drivers/staging/comedi/drivers.c |
732 | @@ -390,11 +390,13 @@ unsigned int comedi_dio_update_state(struct comedi_subdevice *s, |
733 | EXPORT_SYMBOL_GPL(comedi_dio_update_state); |
734 | |
735 | /** |
736 | - * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes |
737 | + * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in |
738 | + * bytes |
739 | * @s: COMEDI subdevice. |
740 | + * @cmd: COMEDI command. |
741 | * |
742 | * Determines the overall scan length according to the subdevice type and the |
743 | - * number of channels in the scan. |
744 | + * number of channels in the scan for the specified command. |
745 | * |
746 | * For digital input, output or input/output subdevices, samples for |
747 | * multiple channels are assumed to be packed into one or more unsigned |
748 | @@ -404,9 +406,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_state); |
749 | * |
750 | * Returns the overall scan length in bytes. |
751 | */ |
752 | -unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) |
753 | +unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, |
754 | + struct comedi_cmd *cmd) |
755 | { |
756 | - struct comedi_cmd *cmd = &s->async->cmd; |
757 | unsigned int num_samples; |
758 | unsigned int bits_per_sample; |
759 | |
760 | @@ -423,6 +425,29 @@ unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) |
761 | } |
762 | return comedi_samples_to_bytes(s, num_samples); |
763 | } |
764 | +EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd); |
765 | + |
766 | +/** |
767 | + * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes |
768 | + * @s: COMEDI subdevice. |
769 | + * |
770 | + * Determines the overall scan length according to the subdevice type and the |
771 | + * number of channels in the scan for the current command. |
772 | + * |
773 | + * For digital input, output or input/output subdevices, samples for |
774 | + * multiple channels are assumed to be packed into one or more unsigned |
775 | + * short or unsigned int values according to the subdevice's %SDF_LSAMPL |
776 | + * flag. For other types of subdevice, samples are assumed to occupy a |
777 | + * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag. |
778 | + * |
779 | + * Returns the overall scan length in bytes. |
780 | + */ |
781 | +unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) |
782 | +{ |
783 | + struct comedi_cmd *cmd = &s->async->cmd; |
784 | + |
785 | + return comedi_bytes_per_scan_cmd(s, cmd); |
786 | +} |
787 | EXPORT_SYMBOL_GPL(comedi_bytes_per_scan); |
788 | |
789 | static unsigned int __comedi_nscans_left(struct comedi_subdevice *s, |
790 | diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c |
791 | index 0fa85d55c82f..fe03a41dc5cf 100644 |
792 | --- a/drivers/staging/comedi/drivers/ni_mio_common.c |
793 | +++ b/drivers/staging/comedi/drivers/ni_mio_common.c |
794 | @@ -3477,6 +3477,7 @@ static int ni_cdio_check_chanlist(struct comedi_device *dev, |
795 | static int ni_cdio_cmdtest(struct comedi_device *dev, |
796 | struct comedi_subdevice *s, struct comedi_cmd *cmd) |
797 | { |
798 | + unsigned int bytes_per_scan; |
799 | int err = 0; |
800 | int tmp; |
801 | |
802 | @@ -3506,9 +3507,12 @@ static int ni_cdio_cmdtest(struct comedi_device *dev, |
803 | err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0); |
804 | err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg, |
805 | cmd->chanlist_len); |
806 | - err |= comedi_check_trigger_arg_max(&cmd->stop_arg, |
807 | - s->async->prealloc_bufsz / |
808 | - comedi_bytes_per_scan(s)); |
809 | + bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd); |
810 | + if (bytes_per_scan) { |
811 | + err |= comedi_check_trigger_arg_max(&cmd->stop_arg, |
812 | + s->async->prealloc_bufsz / |
813 | + bytes_per_scan); |
814 | + } |
815 | |
816 | if (err) |
817 | return 3; |
818 | diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c |
819 | index ab96629b7889..22e5116e74f8 100644 |
820 | --- a/drivers/staging/vt6655/device_main.c |
821 | +++ b/drivers/staging/vt6655/device_main.c |
822 | @@ -977,8 +977,6 @@ static void vnt_interrupt_process(struct vnt_private *priv) |
823 | return; |
824 | } |
825 | |
826 | - MACvIntDisable(priv->PortOffset); |
827 | - |
828 | spin_lock_irqsave(&priv->lock, flags); |
829 | |
830 | /* Read low level stats */ |
831 | @@ -1067,8 +1065,6 @@ static void vnt_interrupt_process(struct vnt_private *priv) |
832 | } |
833 | |
834 | spin_unlock_irqrestore(&priv->lock, flags); |
835 | - |
836 | - MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); |
837 | } |
838 | |
839 | static void vnt_interrupt_work(struct work_struct *work) |
840 | @@ -1078,14 +1074,17 @@ static void vnt_interrupt_work(struct work_struct *work) |
841 | |
842 | if (priv->vif) |
843 | vnt_interrupt_process(priv); |
844 | + |
845 | + MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); |
846 | } |
847 | |
848 | static irqreturn_t vnt_interrupt(int irq, void *arg) |
849 | { |
850 | struct vnt_private *priv = arg; |
851 | |
852 | - if (priv->vif) |
853 | - schedule_work(&priv->interrupt_work); |
854 | + schedule_work(&priv->interrupt_work); |
855 | + |
856 | + MACvIntDisable(priv->PortOffset); |
857 | |
858 | return IRQ_HANDLED; |
859 | } |
860 | diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c |
861 | index 5a341b1c65c3..d8e1945cb627 100644 |
862 | --- a/drivers/tty/serial/atmel_serial.c |
863 | +++ b/drivers/tty/serial/atmel_serial.c |
864 | @@ -1166,6 +1166,10 @@ static int atmel_prepare_rx_dma(struct uart_port *port) |
865 | sg_dma_len(&atmel_port->sg_rx)/2, |
866 | DMA_DEV_TO_MEM, |
867 | DMA_PREP_INTERRUPT); |
868 | + if (!desc) { |
869 | + dev_err(port->dev, "Preparing DMA cyclic failed\n"); |
870 | + goto chan_err; |
871 | + } |
872 | desc->callback = atmel_complete_rx_dma; |
873 | desc->callback_param = port; |
874 | atmel_port->desc_rx = desc; |
875 | diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c |
876 | index f2b0d8cee8ef..0314e78e31ff 100644 |
877 | --- a/drivers/tty/serial/kgdboc.c |
878 | +++ b/drivers/tty/serial/kgdboc.c |
879 | @@ -148,8 +148,10 @@ static int configure_kgdboc(void) |
880 | char *cptr = config; |
881 | struct console *cons; |
882 | |
883 | - if (!strlen(config) || isspace(config[0])) |
884 | + if (!strlen(config) || isspace(config[0])) { |
885 | + err = 0; |
886 | goto noconfig; |
887 | + } |
888 | |
889 | kgdboc_io_ops.is_console = 0; |
890 | kgdb_tty_driver = NULL; |
891 | diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c |
892 | index 8a3e92638e10..5331baf3f699 100644 |
893 | --- a/drivers/tty/serial/max310x.c |
894 | +++ b/drivers/tty/serial/max310x.c |
895 | @@ -1323,6 +1323,8 @@ static int max310x_spi_probe(struct spi_device *spi) |
896 | if (spi->dev.of_node) { |
897 | const struct of_device_id *of_id = |
898 | of_match_device(max310x_dt_ids, &spi->dev); |
899 | + if (!of_id) |
900 | + return -ENODEV; |
901 | |
902 | devtype = (struct max310x_devtype *)of_id->data; |
903 | } else { |
904 | diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c |
905 | index 6ff53b604ff6..bcb997935c5e 100644 |
906 | --- a/drivers/tty/serial/sh-sci.c |
907 | +++ b/drivers/tty/serial/sh-sci.c |
908 | @@ -834,19 +834,9 @@ static void sci_transmit_chars(struct uart_port *port) |
909 | |
910 | if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) |
911 | uart_write_wakeup(port); |
912 | - if (uart_circ_empty(xmit)) { |
913 | + if (uart_circ_empty(xmit)) |
914 | sci_stop_tx(port); |
915 | - } else { |
916 | - ctrl = serial_port_in(port, SCSCR); |
917 | - |
918 | - if (port->type != PORT_SCI) { |
919 | - serial_port_in(port, SCxSR); /* Dummy read */ |
920 | - sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port)); |
921 | - } |
922 | |
923 | - ctrl |= SCSCR_TIE; |
924 | - serial_port_out(port, SCSCR, ctrl); |
925 | - } |
926 | } |
927 | |
928 | /* On SH3, SCIF may read end-of-break as a space->mark char */ |
929 | diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c |
930 | index 5ef8da6e67c3..64c76403a542 100644 |
931 | --- a/drivers/usb/common/common.c |
932 | +++ b/drivers/usb/common/common.c |
933 | @@ -148,6 +148,8 @@ enum usb_dr_mode of_usb_get_dr_mode_by_phy(struct device_node *np, int arg0) |
934 | |
935 | do { |
936 | controller = of_find_node_with_property(controller, "phys"); |
937 | + if (!of_device_is_available(controller)) |
938 | + continue; |
939 | index = 0; |
940 | do { |
941 | if (arg0 == -1) { |
942 | diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c |
943 | index c6578b321838..5e6136d2ed71 100644 |
944 | --- a/drivers/usb/core/config.c |
945 | +++ b/drivers/usb/core/config.c |
946 | @@ -763,21 +763,18 @@ void usb_destroy_configuration(struct usb_device *dev) |
947 | return; |
948 | |
949 | if (dev->rawdescriptors) { |
950 | - for (i = 0; i < dev->descriptor.bNumConfigurations && |
951 | - i < USB_MAXCONFIG; i++) |
952 | + for (i = 0; i < dev->descriptor.bNumConfigurations; i++) |
953 | kfree(dev->rawdescriptors[i]); |
954 | |
955 | kfree(dev->rawdescriptors); |
956 | dev->rawdescriptors = NULL; |
957 | } |
958 | |
959 | - for (c = 0; c < dev->descriptor.bNumConfigurations && |
960 | - c < USB_MAXCONFIG; c++) { |
961 | + for (c = 0; c < dev->descriptor.bNumConfigurations; c++) { |
962 | struct usb_host_config *cf = &dev->config[c]; |
963 | |
964 | kfree(cf->string); |
965 | - for (i = 0; i < cf->desc.bNumInterfaces && |
966 | - i < USB_MAXINTERFACES; i++) { |
967 | + for (i = 0; i < cf->desc.bNumInterfaces; i++) { |
968 | if (cf->intf_cache[i]) |
969 | kref_put(&cf->intf_cache[i]->ref, |
970 | usb_release_interface_cache); |
971 | diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c |
972 | index 5815120c0402..8e83649f77ce 100644 |
973 | --- a/drivers/usb/gadget/function/f_hid.c |
974 | +++ b/drivers/usb/gadget/function/f_hid.c |
975 | @@ -340,20 +340,20 @@ try_again: |
976 | req->complete = f_hidg_req_complete; |
977 | req->context = hidg; |
978 | |
979 | + spin_unlock_irqrestore(&hidg->write_spinlock, flags); |
980 | + |
981 | status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC); |
982 | if (status < 0) { |
983 | ERROR(hidg->func.config->cdev, |
984 | "usb_ep_queue error on int endpoint %zd\n", status); |
985 | - goto release_write_pending_unlocked; |
986 | + goto release_write_pending; |
987 | } else { |
988 | status = count; |
989 | } |
990 | - spin_unlock_irqrestore(&hidg->write_spinlock, flags); |
991 | |
992 | return status; |
993 | release_write_pending: |
994 | spin_lock_irqsave(&hidg->write_spinlock, flags); |
995 | -release_write_pending_unlocked: |
996 | hidg->write_pending = 0; |
997 | spin_unlock_irqrestore(&hidg->write_spinlock, flags); |
998 | |
999 | diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c |
1000 | index 0e4535e632ec..64ee8154f2bb 100644 |
1001 | --- a/drivers/usb/host/xhci-rcar.c |
1002 | +++ b/drivers/usb/host/xhci-rcar.c |
1003 | @@ -192,5 +192,6 @@ int xhci_rcar_init_quirk(struct usb_hcd *hcd) |
1004 | xhci_rcar_is_gen3(hcd->self.controller)) |
1005 | xhci->quirks |= XHCI_NO_64BIT_SUPPORT; |
1006 | |
1007 | + xhci->quirks |= XHCI_TRUST_TX_LENGTH; |
1008 | return xhci_rcar_download_firmware(hcd); |
1009 | } |
1010 | diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c |
1011 | index f4e34a75d413..879d82223068 100644 |
1012 | --- a/drivers/usb/host/xhci-ring.c |
1013 | +++ b/drivers/usb/host/xhci-ring.c |
1014 | @@ -1645,10 +1645,13 @@ static void handle_port_status(struct xhci_hcd *xhci, |
1015 | } |
1016 | } |
1017 | |
1018 | - if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_U0 && |
1019 | - DEV_SUPERSPEED_ANY(temp)) { |
1020 | + if ((temp & PORT_PLC) && |
1021 | + DEV_SUPERSPEED_ANY(temp) && |
1022 | + ((temp & PORT_PLS_MASK) == XDEV_U0 || |
1023 | + (temp & PORT_PLS_MASK) == XDEV_U1 || |
1024 | + (temp & PORT_PLS_MASK) == XDEV_U2)) { |
1025 | xhci_dbg(xhci, "resume SS port %d finished\n", port_id); |
1026 | - /* We've just brought the device into U0 through either the |
1027 | + /* We've just brought the device into U0/1/2 through either the |
1028 | * Resume state after a device remote wakeup, or through the |
1029 | * U3Exit state after a host-initiated resume. If it's a device |
1030 | * initiated remote wake, don't pass up the link state change, |
1031 | diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h |
1032 | index e679fec9ce3a..de4771ce0df6 100644 |
1033 | --- a/drivers/usb/host/xhci.h |
1034 | +++ b/drivers/usb/host/xhci.h |
1035 | @@ -311,6 +311,7 @@ struct xhci_op_regs { |
1036 | */ |
1037 | #define PORT_PLS_MASK (0xf << 5) |
1038 | #define XDEV_U0 (0x0 << 5) |
1039 | +#define XDEV_U1 (0x1 << 5) |
1040 | #define XDEV_U2 (0x2 << 5) |
1041 | #define XDEV_U3 (0x3 << 5) |
1042 | #define XDEV_INACTIVE (0x6 << 5) |
1043 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c |
1044 | index 7bbf2ca73f68..40c58145bf80 100644 |
1045 | --- a/drivers/usb/serial/cp210x.c |
1046 | +++ b/drivers/usb/serial/cp210x.c |
1047 | @@ -77,6 +77,7 @@ static const struct usb_device_id id_table[] = { |
1048 | { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ |
1049 | { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ |
1050 | { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ |
1051 | + { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */ |
1052 | { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ |
1053 | { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ |
1054 | { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ |
1055 | diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c |
1056 | index b88a72220acd..f54931aa7528 100644 |
1057 | --- a/drivers/usb/serial/ftdi_sio.c |
1058 | +++ b/drivers/usb/serial/ftdi_sio.c |
1059 | @@ -604,6 +604,8 @@ static const struct usb_device_id id_table_combined[] = { |
1060 | .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, |
1061 | { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), |
1062 | .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, |
1063 | + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, |
1064 | + { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, |
1065 | { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, |
1066 | { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, |
1067 | { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, |
1068 | diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h |
1069 | index ddf5ab983dc9..15d220eaf6e6 100644 |
1070 | --- a/drivers/usb/serial/ftdi_sio_ids.h |
1071 | +++ b/drivers/usb/serial/ftdi_sio_ids.h |
1072 | @@ -566,7 +566,9 @@ |
1073 | /* |
1074 | * NovaTech product ids (FTDI_VID) |
1075 | */ |
1076 | -#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ |
1077 | +#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ |
1078 | +#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */ |
1079 | +#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */ |
1080 | |
1081 | /* |
1082 | * Synapse Wireless product ids (FTDI_VID) |
1083 | diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c |
1084 | index 135eb04368f9..ea20322e1416 100644 |
1085 | --- a/drivers/usb/serial/mos7720.c |
1086 | +++ b/drivers/usb/serial/mos7720.c |
1087 | @@ -368,8 +368,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, |
1088 | if (!urbtrack) |
1089 | return -ENOMEM; |
1090 | |
1091 | - kref_get(&mos_parport->ref_count); |
1092 | - urbtrack->mos_parport = mos_parport; |
1093 | urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC); |
1094 | if (!urbtrack->urb) { |
1095 | kfree(urbtrack); |
1096 | @@ -390,6 +388,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, |
1097 | usb_sndctrlpipe(usbdev, 0), |
1098 | (unsigned char *)urbtrack->setup, |
1099 | NULL, 0, async_complete, urbtrack); |
1100 | + kref_get(&mos_parport->ref_count); |
1101 | + urbtrack->mos_parport = mos_parport; |
1102 | kref_init(&urbtrack->ref_count); |
1103 | INIT_LIST_HEAD(&urbtrack->urblist_entry); |
1104 | |
1105 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
1106 | index b2b7c12e5c86..9f96dd274370 100644 |
1107 | --- a/drivers/usb/serial/option.c |
1108 | +++ b/drivers/usb/serial/option.c |
1109 | @@ -1066,7 +1066,8 @@ static const struct usb_device_id option_ids[] = { |
1110 | .driver_info = RSVD(3) }, |
1111 | { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ |
1112 | { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ |
1113 | - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ |
1114 | + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */ |
1115 | + .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) }, |
1116 | /* Quectel products using Qualcomm vendor ID */ |
1117 | { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, |
1118 | { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), |
1119 | @@ -1941,10 +1942,12 @@ static const struct usb_device_id option_ids[] = { |
1120 | .driver_info = RSVD(4) }, |
1121 | { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ |
1122 | .driver_info = RSVD(4) }, |
1123 | - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ |
1124 | - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ |
1125 | - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ |
1126 | - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ |
1127 | + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ |
1128 | + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ |
1129 | + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ |
1130 | + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ |
1131 | + .driver_info = RSVD(4) }, |
1132 | + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ |
1133 | { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, |
1134 | { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, |
1135 | { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, |
1136 | diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c |
1137 | index 14a93cb21310..66d58e93bc32 100644 |
1138 | --- a/drivers/video/fbdev/goldfishfb.c |
1139 | +++ b/drivers/video/fbdev/goldfishfb.c |
1140 | @@ -234,7 +234,7 @@ static int goldfish_fb_probe(struct platform_device *pdev) |
1141 | fb->fb.var.activate = FB_ACTIVATE_NOW; |
1142 | fb->fb.var.height = readl(fb->reg_base + FB_GET_PHYS_HEIGHT); |
1143 | fb->fb.var.width = readl(fb->reg_base + FB_GET_PHYS_WIDTH); |
1144 | - fb->fb.var.pixclock = 10000; |
1145 | + fb->fb.var.pixclock = 0; |
1146 | |
1147 | fb->fb.var.red.offset = 11; |
1148 | fb->fb.var.red.length = 5; |
1149 | diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c |
1150 | index af6a776fa18c..5aa07de5750e 100644 |
1151 | --- a/fs/btrfs/raid56.c |
1152 | +++ b/fs/btrfs/raid56.c |
1153 | @@ -2395,8 +2395,9 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, |
1154 | bitmap_clear(rbio->dbitmap, pagenr, 1); |
1155 | kunmap(p); |
1156 | |
1157 | - for (stripe = 0; stripe < rbio->real_stripes; stripe++) |
1158 | + for (stripe = 0; stripe < nr_data; stripe++) |
1159 | kunmap(page_in_rbio(rbio, stripe, pagenr, 0)); |
1160 | + kunmap(p_page); |
1161 | } |
1162 | |
1163 | __free_page(p_page); |
1164 | diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c |
1165 | index 47d11a30bee7..a36bb75383dc 100644 |
1166 | --- a/fs/btrfs/tree-log.c |
1167 | +++ b/fs/btrfs/tree-log.c |
1168 | @@ -3343,9 +3343,16 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, |
1169 | } |
1170 | btrfs_release_path(path); |
1171 | |
1172 | - /* find the first key from this transaction again */ |
1173 | + /* |
1174 | + * Find the first key from this transaction again. See the note for |
1175 | + * log_new_dir_dentries, if we're logging a directory recursively we |
1176 | + * won't be holding its i_mutex, which means we can modify the directory |
1177 | + * while we're logging it. If we remove an entry between our first |
1178 | + * search and this search we'll not find the key again and can just |
1179 | + * bail. |
1180 | + */ |
1181 | ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0); |
1182 | - if (WARN_ON(ret != 0)) |
1183 | + if (ret != 0) |
1184 | goto done; |
1185 | |
1186 | /* |
1187 | diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c |
1188 | index eb55ab6930b5..6d0d94fc243d 100644 |
1189 | --- a/fs/nfs/nfs4proc.c |
1190 | +++ b/fs/nfs/nfs4proc.c |
1191 | @@ -2748,7 +2748,8 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, |
1192 | nfs4_schedule_stateid_recovery(server, state); |
1193 | } |
1194 | out: |
1195 | - nfs4_sequence_free_slot(&opendata->o_res.seq_res); |
1196 | + if (!opendata->cancelled) |
1197 | + nfs4_sequence_free_slot(&opendata->o_res.seq_res); |
1198 | return ret; |
1199 | } |
1200 | |
1201 | diff --git a/fs/open.c b/fs/open.c |
1202 | index a6c6244f4993..f1deb36ee1b7 100644 |
1203 | --- a/fs/open.c |
1204 | +++ b/fs/open.c |
1205 | @@ -717,6 +717,12 @@ static int do_dentry_open(struct file *f, |
1206 | return 0; |
1207 | } |
1208 | |
1209 | + /* Any file opened for execve()/uselib() has to be a regular file. */ |
1210 | + if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) { |
1211 | + error = -EACCES; |
1212 | + goto cleanup_file; |
1213 | + } |
1214 | + |
1215 | if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { |
1216 | error = get_write_access(inode); |
1217 | if (unlikely(error)) |
1218 | diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c |
1219 | index 1999e85840d5..6f30cf8ef7a1 100644 |
1220 | --- a/fs/proc/proc_sysctl.c |
1221 | +++ b/fs/proc/proc_sysctl.c |
1222 | @@ -1604,7 +1604,8 @@ static void drop_sysctl_table(struct ctl_table_header *header) |
1223 | if (--header->nreg) |
1224 | return; |
1225 | |
1226 | - put_links(header); |
1227 | + if (parent) |
1228 | + put_links(header); |
1229 | start_unregistering(header); |
1230 | if (!--header->count) |
1231 | kfree_rcu(header, rcu); |
1232 | diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h |
1233 | index 4a5b9a306c69..803fc26ef0ba 100644 |
1234 | --- a/include/net/sctp/checksum.h |
1235 | +++ b/include/net/sctp/checksum.h |
1236 | @@ -60,7 +60,7 @@ static inline __wsum sctp_csum_combine(__wsum csum, __wsum csum2, |
1237 | static inline __le32 sctp_compute_cksum(const struct sk_buff *skb, |
1238 | unsigned int offset) |
1239 | { |
1240 | - struct sctphdr *sh = sctp_hdr(skb); |
1241 | + struct sctphdr *sh = (struct sctphdr *)(skb->data + offset); |
1242 | __le32 ret, old = sh->checksum; |
1243 | const struct skb_checksum_ops ops = { |
1244 | .update = sctp_csum_update, |
1245 | diff --git a/include/net/sock.h b/include/net/sock.h |
1246 | index 15bb04dec40e..116308632fae 100644 |
1247 | --- a/include/net/sock.h |
1248 | +++ b/include/net/sock.h |
1249 | @@ -650,6 +650,12 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list) |
1250 | hlist_add_head_rcu(&sk->sk_node, list); |
1251 | } |
1252 | |
1253 | +static inline void sk_add_node_tail_rcu(struct sock *sk, struct hlist_head *list) |
1254 | +{ |
1255 | + sock_hold(sk); |
1256 | + hlist_add_tail_rcu(&sk->sk_node, list); |
1257 | +} |
1258 | + |
1259 | static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) |
1260 | { |
1261 | hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); |
1262 | diff --git a/kernel/cpu.c b/kernel/cpu.c |
1263 | index b5a0165b7300..bf24e8400903 100644 |
1264 | --- a/kernel/cpu.c |
1265 | +++ b/kernel/cpu.c |
1266 | @@ -591,6 +591,20 @@ static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st) |
1267 | } |
1268 | } |
1269 | |
1270 | +static inline bool can_rollback_cpu(struct cpuhp_cpu_state *st) |
1271 | +{ |
1272 | + if (IS_ENABLED(CONFIG_HOTPLUG_CPU)) |
1273 | + return true; |
1274 | + /* |
1275 | + * When CPU hotplug is disabled, then taking the CPU down is not |
1276 | + * possible because takedown_cpu() and the architecture and |
1277 | + * subsystem specific mechanisms are not available. So the CPU |
1278 | + * which would be completely unplugged again needs to stay around |
1279 | + * in the current state. |
1280 | + */ |
1281 | + return st->state <= CPUHP_BRINGUP_CPU; |
1282 | +} |
1283 | + |
1284 | static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st, |
1285 | enum cpuhp_state target) |
1286 | { |
1287 | @@ -601,8 +615,10 @@ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st, |
1288 | st->state++; |
1289 | ret = cpuhp_invoke_callback(cpu, st->state, true, NULL); |
1290 | if (ret) { |
1291 | - st->target = prev_state; |
1292 | - undo_cpu_up(cpu, st); |
1293 | + if (can_rollback_cpu(st)) { |
1294 | + st->target = prev_state; |
1295 | + undo_cpu_up(cpu, st); |
1296 | + } |
1297 | break; |
1298 | } |
1299 | } |
1300 | diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c |
1301 | index 1fc23cb4a3e0..d49aa4e6c916 100644 |
1302 | --- a/net/bluetooth/l2cap_core.c |
1303 | +++ b/net/bluetooth/l2cap_core.c |
1304 | @@ -3326,16 +3326,22 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data |
1305 | |
1306 | while (len >= L2CAP_CONF_OPT_SIZE) { |
1307 | len -= l2cap_get_conf_opt(&req, &type, &olen, &val); |
1308 | + if (len < 0) |
1309 | + break; |
1310 | |
1311 | hint = type & L2CAP_CONF_HINT; |
1312 | type &= L2CAP_CONF_MASK; |
1313 | |
1314 | switch (type) { |
1315 | case L2CAP_CONF_MTU: |
1316 | + if (olen != 2) |
1317 | + break; |
1318 | mtu = val; |
1319 | break; |
1320 | |
1321 | case L2CAP_CONF_FLUSH_TO: |
1322 | + if (olen != 2) |
1323 | + break; |
1324 | chan->flush_to = val; |
1325 | break; |
1326 | |
1327 | @@ -3343,26 +3349,30 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data |
1328 | break; |
1329 | |
1330 | case L2CAP_CONF_RFC: |
1331 | - if (olen == sizeof(rfc)) |
1332 | - memcpy(&rfc, (void *) val, olen); |
1333 | + if (olen != sizeof(rfc)) |
1334 | + break; |
1335 | + memcpy(&rfc, (void *) val, olen); |
1336 | break; |
1337 | |
1338 | case L2CAP_CONF_FCS: |
1339 | + if (olen != 1) |
1340 | + break; |
1341 | if (val == L2CAP_FCS_NONE) |
1342 | set_bit(CONF_RECV_NO_FCS, &chan->conf_state); |
1343 | break; |
1344 | |
1345 | case L2CAP_CONF_EFS: |
1346 | - if (olen == sizeof(efs)) { |
1347 | - remote_efs = 1; |
1348 | - memcpy(&efs, (void *) val, olen); |
1349 | - } |
1350 | + if (olen != sizeof(efs)) |
1351 | + break; |
1352 | + remote_efs = 1; |
1353 | + memcpy(&efs, (void *) val, olen); |
1354 | break; |
1355 | |
1356 | case L2CAP_CONF_EWS: |
1357 | + if (olen != 2) |
1358 | + break; |
1359 | if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP)) |
1360 | return -ECONNREFUSED; |
1361 | - |
1362 | set_bit(FLAG_EXT_CTRL, &chan->flags); |
1363 | set_bit(CONF_EWS_RECV, &chan->conf_state); |
1364 | chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; |
1365 | @@ -3372,7 +3382,6 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data |
1366 | default: |
1367 | if (hint) |
1368 | break; |
1369 | - |
1370 | result = L2CAP_CONF_UNKNOWN; |
1371 | *((u8 *) ptr++) = type; |
1372 | break; |
1373 | @@ -3537,58 +3546,65 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, |
1374 | |
1375 | while (len >= L2CAP_CONF_OPT_SIZE) { |
1376 | len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); |
1377 | + if (len < 0) |
1378 | + break; |
1379 | |
1380 | switch (type) { |
1381 | case L2CAP_CONF_MTU: |
1382 | + if (olen != 2) |
1383 | + break; |
1384 | if (val < L2CAP_DEFAULT_MIN_MTU) { |
1385 | *result = L2CAP_CONF_UNACCEPT; |
1386 | chan->imtu = L2CAP_DEFAULT_MIN_MTU; |
1387 | } else |
1388 | chan->imtu = val; |
1389 | - l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); |
1390 | + l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, |
1391 | + endptr - ptr); |
1392 | break; |
1393 | |
1394 | case L2CAP_CONF_FLUSH_TO: |
1395 | + if (olen != 2) |
1396 | + break; |
1397 | chan->flush_to = val; |
1398 | - l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, |
1399 | - 2, chan->flush_to, endptr - ptr); |
1400 | + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, |
1401 | + chan->flush_to, endptr - ptr); |
1402 | break; |
1403 | |
1404 | case L2CAP_CONF_RFC: |
1405 | - if (olen == sizeof(rfc)) |
1406 | - memcpy(&rfc, (void *)val, olen); |
1407 | - |
1408 | + if (olen != sizeof(rfc)) |
1409 | + break; |
1410 | + memcpy(&rfc, (void *)val, olen); |
1411 | if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && |
1412 | rfc.mode != chan->mode) |
1413 | return -ECONNREFUSED; |
1414 | - |
1415 | chan->fcs = 0; |
1416 | - |
1417 | - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, |
1418 | - sizeof(rfc), (unsigned long) &rfc, endptr - ptr); |
1419 | + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), |
1420 | + (unsigned long) &rfc, endptr - ptr); |
1421 | break; |
1422 | |
1423 | case L2CAP_CONF_EWS: |
1424 | + if (olen != 2) |
1425 | + break; |
1426 | chan->ack_win = min_t(u16, val, chan->ack_win); |
1427 | l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, |
1428 | chan->tx_win, endptr - ptr); |
1429 | break; |
1430 | |
1431 | case L2CAP_CONF_EFS: |
1432 | - if (olen == sizeof(efs)) { |
1433 | - memcpy(&efs, (void *)val, olen); |
1434 | - |
1435 | - if (chan->local_stype != L2CAP_SERV_NOTRAFIC && |
1436 | - efs.stype != L2CAP_SERV_NOTRAFIC && |
1437 | - efs.stype != chan->local_stype) |
1438 | - return -ECONNREFUSED; |
1439 | - |
1440 | - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), |
1441 | - (unsigned long) &efs, endptr - ptr); |
1442 | - } |
1443 | + if (olen != sizeof(efs)) |
1444 | + break; |
1445 | + memcpy(&efs, (void *)val, olen); |
1446 | + if (chan->local_stype != L2CAP_SERV_NOTRAFIC && |
1447 | + efs.stype != L2CAP_SERV_NOTRAFIC && |
1448 | + efs.stype != chan->local_stype) |
1449 | + return -ECONNREFUSED; |
1450 | + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), |
1451 | + (unsigned long) &efs, endptr - ptr); |
1452 | break; |
1453 | |
1454 | case L2CAP_CONF_FCS: |
1455 | + if (olen != 1) |
1456 | + break; |
1457 | if (*result == L2CAP_CONF_PENDING) |
1458 | if (val == L2CAP_FCS_NONE) |
1459 | set_bit(CONF_RECV_NO_FCS, |
1460 | @@ -3717,13 +3733,18 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) |
1461 | |
1462 | while (len >= L2CAP_CONF_OPT_SIZE) { |
1463 | len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); |
1464 | + if (len < 0) |
1465 | + break; |
1466 | |
1467 | switch (type) { |
1468 | case L2CAP_CONF_RFC: |
1469 | - if (olen == sizeof(rfc)) |
1470 | - memcpy(&rfc, (void *)val, olen); |
1471 | + if (olen != sizeof(rfc)) |
1472 | + break; |
1473 | + memcpy(&rfc, (void *)val, olen); |
1474 | break; |
1475 | case L2CAP_CONF_EWS: |
1476 | + if (olen != 2) |
1477 | + break; |
1478 | txwin_ext = val; |
1479 | break; |
1480 | } |
1481 | diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c |
1482 | index 93c706172f40..87c513b5ff2e 100644 |
1483 | --- a/net/dccp/ipv6.c |
1484 | +++ b/net/dccp/ipv6.c |
1485 | @@ -431,8 +431,8 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk, |
1486 | newnp->ipv6_mc_list = NULL; |
1487 | newnp->ipv6_ac_list = NULL; |
1488 | newnp->ipv6_fl_list = NULL; |
1489 | - newnp->mcast_oif = inet6_iif(skb); |
1490 | - newnp->mcast_hops = ipv6_hdr(skb)->hop_limit; |
1491 | + newnp->mcast_oif = inet_iif(skb); |
1492 | + newnp->mcast_hops = ip_hdr(skb)->ttl; |
1493 | |
1494 | /* |
1495 | * No need to charge this sock to the relevant IPv6 refcnt debug socks count |
1496 | diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c |
1497 | index 0a69d39880f2..4953466cf98f 100644 |
1498 | --- a/net/ipv6/tcp_ipv6.c |
1499 | +++ b/net/ipv6/tcp_ipv6.c |
1500 | @@ -1056,11 +1056,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * |
1501 | newnp->ipv6_fl_list = NULL; |
1502 | newnp->pktoptions = NULL; |
1503 | newnp->opt = NULL; |
1504 | - newnp->mcast_oif = tcp_v6_iif(skb); |
1505 | - newnp->mcast_hops = ipv6_hdr(skb)->hop_limit; |
1506 | - newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb)); |
1507 | + newnp->mcast_oif = inet_iif(skb); |
1508 | + newnp->mcast_hops = ip_hdr(skb)->ttl; |
1509 | + newnp->rcv_flowinfo = 0; |
1510 | if (np->repflow) |
1511 | - newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb)); |
1512 | + newnp->flow_label = 0; |
1513 | |
1514 | /* |
1515 | * No need to charge this sock to the relevant IPv6 refcnt debug socks count |
1516 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
1517 | index 14df2fcf6138..522d4ca715c9 100644 |
1518 | --- a/net/packet/af_packet.c |
1519 | +++ b/net/packet/af_packet.c |
1520 | @@ -3278,7 +3278,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, |
1521 | } |
1522 | |
1523 | mutex_lock(&net->packet.sklist_lock); |
1524 | - sk_add_node_rcu(sk, &net->packet.sklist); |
1525 | + sk_add_node_tail_rcu(sk, &net->packet.sklist); |
1526 | mutex_unlock(&net->packet.sklist_lock); |
1527 | |
1528 | preempt_disable(); |
1529 | @@ -4229,7 +4229,7 @@ static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order) |
1530 | struct pgv *pg_vec; |
1531 | int i; |
1532 | |
1533 | - pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL); |
1534 | + pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN); |
1535 | if (unlikely(!pg_vec)) |
1536 | goto out; |
1537 | |
1538 | diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c |
1539 | index 7ca57741b2fb..7849f286bb93 100644 |
1540 | --- a/net/rose/rose_subr.c |
1541 | +++ b/net/rose/rose_subr.c |
1542 | @@ -105,16 +105,17 @@ void rose_write_internal(struct sock *sk, int frametype) |
1543 | struct sk_buff *skb; |
1544 | unsigned char *dptr; |
1545 | unsigned char lci1, lci2; |
1546 | - char buffer[100]; |
1547 | - int len, faclen = 0; |
1548 | + int maxfaclen = 0; |
1549 | + int len, faclen; |
1550 | + int reserve; |
1551 | |
1552 | - len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1; |
1553 | + reserve = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1; |
1554 | + len = ROSE_MIN_LEN; |
1555 | |
1556 | switch (frametype) { |
1557 | case ROSE_CALL_REQUEST: |
1558 | len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN; |
1559 | - faclen = rose_create_facilities(buffer, rose); |
1560 | - len += faclen; |
1561 | + maxfaclen = 256; |
1562 | break; |
1563 | case ROSE_CALL_ACCEPTED: |
1564 | case ROSE_CLEAR_REQUEST: |
1565 | @@ -123,15 +124,16 @@ void rose_write_internal(struct sock *sk, int frametype) |
1566 | break; |
1567 | } |
1568 | |
1569 | - if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL) |
1570 | + skb = alloc_skb(reserve + len + maxfaclen, GFP_ATOMIC); |
1571 | + if (!skb) |
1572 | return; |
1573 | |
1574 | /* |
1575 | * Space for AX.25 header and PID. |
1576 | */ |
1577 | - skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1); |
1578 | + skb_reserve(skb, reserve); |
1579 | |
1580 | - dptr = skb_put(skb, skb_tailroom(skb)); |
1581 | + dptr = skb_put(skb, len); |
1582 | |
1583 | lci1 = (rose->lci >> 8) & 0x0F; |
1584 | lci2 = (rose->lci >> 0) & 0xFF; |
1585 | @@ -146,7 +148,8 @@ void rose_write_internal(struct sock *sk, int frametype) |
1586 | dptr += ROSE_ADDR_LEN; |
1587 | memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN); |
1588 | dptr += ROSE_ADDR_LEN; |
1589 | - memcpy(dptr, buffer, faclen); |
1590 | + faclen = rose_create_facilities(dptr, rose); |
1591 | + skb_put(skb, faclen); |
1592 | dptr += faclen; |
1593 | break; |
1594 | |
1595 | diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c |
1596 | index 549d0a4083b3..09a353c6373a 100644 |
1597 | --- a/net/wireless/nl80211.c |
1598 | +++ b/net/wireless/nl80211.c |
1599 | @@ -12942,7 +12942,7 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, |
1600 | struct sk_buff *msg; |
1601 | void *hdr; |
1602 | |
1603 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); |
1604 | + msg = nlmsg_new(100 + len, gfp); |
1605 | if (!msg) |
1606 | return; |
1607 | |
1608 | @@ -13094,7 +13094,7 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, |
1609 | struct sk_buff *msg; |
1610 | void *hdr; |
1611 | |
1612 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); |
1613 | + msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp); |
1614 | if (!msg) |
1615 | return; |
1616 | |
1617 | @@ -13136,7 +13136,7 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev, |
1618 | struct sk_buff *msg; |
1619 | void *hdr; |
1620 | |
1621 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); |
1622 | + msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp); |
1623 | if (!msg) |
1624 | return; |
1625 | |
1626 | @@ -13173,7 +13173,7 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, |
1627 | struct sk_buff *msg; |
1628 | void *hdr; |
1629 | |
1630 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
1631 | + msg = nlmsg_new(100 + ie_len, GFP_KERNEL); |
1632 | if (!msg) |
1633 | return; |
1634 | |
1635 | @@ -13249,7 +13249,7 @@ void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, |
1636 | |
1637 | trace_cfg80211_notify_new_peer_candidate(dev, addr); |
1638 | |
1639 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); |
1640 | + msg = nlmsg_new(100 + ie_len, gfp); |
1641 | if (!msg) |
1642 | return; |
1643 | |
1644 | @@ -13620,7 +13620,7 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, |
1645 | struct sk_buff *msg; |
1646 | void *hdr; |
1647 | |
1648 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); |
1649 | + msg = nlmsg_new(100 + len, gfp); |
1650 | if (!msg) |
1651 | return -ENOMEM; |
1652 | |
1653 | @@ -13664,7 +13664,7 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, |
1654 | |
1655 | trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); |
1656 | |
1657 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); |
1658 | + msg = nlmsg_new(100 + len, gfp); |
1659 | if (!msg) |
1660 | return; |
1661 | |
1662 | @@ -14473,7 +14473,7 @@ void cfg80211_ft_event(struct net_device *netdev, |
1663 | if (!ft_event->target_ap) |
1664 | return; |
1665 | |
1666 | - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
1667 | + msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); |
1668 | if (!msg) |
1669 | return; |
1670 | |
1671 | diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c |
1672 | index cfb8f5896787..824097571467 100644 |
1673 | --- a/sound/core/oss/pcm_oss.c |
1674 | +++ b/sound/core/oss/pcm_oss.c |
1675 | @@ -951,6 +951,28 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) |
1676 | oss_frame_size = snd_pcm_format_physical_width(params_format(params)) * |
1677 | params_channels(params) / 8; |
1678 | |
1679 | + err = snd_pcm_oss_period_size(substream, params, sparams); |
1680 | + if (err < 0) |
1681 | + goto failure; |
1682 | + |
1683 | + n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); |
1684 | + err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); |
1685 | + if (err < 0) |
1686 | + goto failure; |
1687 | + |
1688 | + err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, |
1689 | + runtime->oss.periods, NULL); |
1690 | + if (err < 0) |
1691 | + goto failure; |
1692 | + |
1693 | + snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); |
1694 | + |
1695 | + err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams); |
1696 | + if (err < 0) { |
1697 | + pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); |
1698 | + goto failure; |
1699 | + } |
1700 | + |
1701 | #ifdef CONFIG_SND_PCM_OSS_PLUGINS |
1702 | snd_pcm_oss_plugin_clear(substream); |
1703 | if (!direct) { |
1704 | @@ -985,27 +1007,6 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) |
1705 | } |
1706 | #endif |
1707 | |
1708 | - err = snd_pcm_oss_period_size(substream, params, sparams); |
1709 | - if (err < 0) |
1710 | - goto failure; |
1711 | - |
1712 | - n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); |
1713 | - err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); |
1714 | - if (err < 0) |
1715 | - goto failure; |
1716 | - |
1717 | - err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, |
1718 | - runtime->oss.periods, NULL); |
1719 | - if (err < 0) |
1720 | - goto failure; |
1721 | - |
1722 | - snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); |
1723 | - |
1724 | - if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) { |
1725 | - pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); |
1726 | - goto failure; |
1727 | - } |
1728 | - |
1729 | if (runtime->oss.trigger) { |
1730 | sw_params->start_threshold = 1; |
1731 | } else { |
1732 | diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c |
1733 | index 3586ab41dec4..e1138e70dbb3 100644 |
1734 | --- a/sound/core/pcm_native.c |
1735 | +++ b/sound/core/pcm_native.c |
1736 | @@ -1258,8 +1258,15 @@ static int snd_pcm_pause(struct snd_pcm_substream *substream, int push) |
1737 | static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state) |
1738 | { |
1739 | struct snd_pcm_runtime *runtime = substream->runtime; |
1740 | - if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) |
1741 | + switch (runtime->status->state) { |
1742 | + case SNDRV_PCM_STATE_SUSPENDED: |
1743 | return -EBUSY; |
1744 | + /* unresumable PCM state; return -EBUSY for skipping suspend */ |
1745 | + case SNDRV_PCM_STATE_OPEN: |
1746 | + case SNDRV_PCM_STATE_SETUP: |
1747 | + case SNDRV_PCM_STATE_DISCONNECTED: |
1748 | + return -EBUSY; |
1749 | + } |
1750 | runtime->trigger_master = substream; |
1751 | return 0; |
1752 | } |
1753 | diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c |
1754 | index 59111cadaec2..c8b2309352d7 100644 |
1755 | --- a/sound/core/rawmidi.c |
1756 | +++ b/sound/core/rawmidi.c |
1757 | @@ -29,6 +29,7 @@ |
1758 | #include <linux/mutex.h> |
1759 | #include <linux/module.h> |
1760 | #include <linux/delay.h> |
1761 | +#include <linux/nospec.h> |
1762 | #include <sound/rawmidi.h> |
1763 | #include <sound/info.h> |
1764 | #include <sound/control.h> |
1765 | @@ -591,6 +592,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card, |
1766 | return -ENXIO; |
1767 | if (info->stream < 0 || info->stream > 1) |
1768 | return -EINVAL; |
1769 | + info->stream = array_index_nospec(info->stream, 2); |
1770 | pstr = &rmidi->streams[info->stream]; |
1771 | if (pstr->substream_count == 0) |
1772 | return -ENOENT; |
1773 | diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c |
1774 | index 278ebb993122..c93945917235 100644 |
1775 | --- a/sound/core/seq/oss/seq_oss_synth.c |
1776 | +++ b/sound/core/seq/oss/seq_oss_synth.c |
1777 | @@ -617,13 +617,14 @@ int |
1778 | snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf) |
1779 | { |
1780 | struct seq_oss_synth *rec; |
1781 | + struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev); |
1782 | |
1783 | - if (dev < 0 || dev >= dp->max_synthdev) |
1784 | + if (!info) |
1785 | return -ENXIO; |
1786 | |
1787 | - if (dp->synths[dev].is_midi) { |
1788 | + if (info->is_midi) { |
1789 | struct midi_info minf; |
1790 | - snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf); |
1791 | + snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf); |
1792 | inf->synth_type = SYNTH_TYPE_MIDI; |
1793 | inf->synth_subtype = 0; |
1794 | inf->nr_voices = 16; |
1795 | diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c |
1796 | index 94764efb0a6a..3c1372655c33 100644 |
1797 | --- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c |
1798 | +++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c |
1799 | @@ -240,19 +240,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params) |
1800 | if (!(decoder->tsc_ctc_ratio_n % decoder->tsc_ctc_ratio_d)) |
1801 | decoder->tsc_ctc_mult = decoder->tsc_ctc_ratio_n / |
1802 | decoder->tsc_ctc_ratio_d; |
1803 | - |
1804 | - /* |
1805 | - * Allow for timestamps appearing to backwards because a TSC |
1806 | - * packet has slipped past a MTC packet, so allow 2 MTC ticks |
1807 | - * or ... |
1808 | - */ |
1809 | - decoder->tsc_slip = multdiv(2 << decoder->mtc_shift, |
1810 | - decoder->tsc_ctc_ratio_n, |
1811 | - decoder->tsc_ctc_ratio_d); |
1812 | } |
1813 | - /* ... or 0x100 paranoia */ |
1814 | - if (decoder->tsc_slip < 0x100) |
1815 | - decoder->tsc_slip = 0x100; |
1816 | + |
1817 | + /* |
1818 | + * A TSC packet can slip past MTC packets so that the timestamp appears |
1819 | + * to go backwards. One estimate is that can be up to about 40 CPU |
1820 | + * cycles, which is certainly less than 0x1000 TSC ticks, but accept |
1821 | + * slippage an order of magnitude more to be on the safe side. |
1822 | + */ |
1823 | + decoder->tsc_slip = 0x10000; |
1824 | |
1825 | intel_pt_log("timestamp: mtc_shift %u\n", decoder->mtc_shift); |
1826 | intel_pt_log("timestamp: tsc_ctc_ratio_n %u\n", decoder->tsc_ctc_ratio_n); |
1827 | diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c |
1828 | index 60de4c337f0a..c72586a094ed 100644 |
1829 | --- a/virt/kvm/kvm_main.c |
1830 | +++ b/virt/kvm/kvm_main.c |
1831 | @@ -2793,6 +2793,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, |
1832 | { |
1833 | struct kvm_device *dev = filp->private_data; |
1834 | |
1835 | + if (dev->kvm->mm != current->mm) |
1836 | + return -EIO; |
1837 | + |
1838 | switch (ioctl) { |
1839 | case KVM_SET_DEVICE_ATTR: |
1840 | return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg); |