Annotation of /trunk/kernel-alx/patches-4.9/0273-4.9.174-all-fixes.patch
Parent Directory | Revision Log
Revision 3350 -
(hide annotations)
(download)
Tue Jun 18 09:42:03 2019 UTC (5 years, 3 months ago) by niro
File size: 83462 byte(s)
Tue Jun 18 09:42:03 2019 UTC (5 years, 3 months ago) by niro
File size: 83462 byte(s)
-linux-4.9.174
1 | niro | 3350 | diff --git a/Documentation/usb/power-management.txt b/Documentation/usb/power-management.txt |
2 | index 0a94ffe17ab6..b13e031beaa6 100644 | ||
3 | --- a/Documentation/usb/power-management.txt | ||
4 | +++ b/Documentation/usb/power-management.txt | ||
5 | @@ -365,11 +365,15 @@ autosuspend the interface's device. When the usage counter is = 0 | ||
6 | then the interface is considered to be idle, and the kernel may | ||
7 | autosuspend the device. | ||
8 | |||
9 | -Drivers need not be concerned about balancing changes to the usage | ||
10 | -counter; the USB core will undo any remaining "get"s when a driver | ||
11 | -is unbound from its interface. As a corollary, drivers must not call | ||
12 | -any of the usb_autopm_* functions after their disconnect() routine has | ||
13 | -returned. | ||
14 | +Drivers must be careful to balance their overall changes to the usage | ||
15 | +counter. Unbalanced "get"s will remain in effect when a driver is | ||
16 | +unbound from its interface, preventing the device from going into | ||
17 | +runtime suspend should the interface be bound to a driver again. On | ||
18 | +the other hand, drivers are allowed to achieve this balance by calling | ||
19 | +the ``usb_autopm_*`` functions even after their ``disconnect`` routine | ||
20 | +has returned -- say from within a work-queue routine -- provided they | ||
21 | +retain an active reference to the interface (via ``usb_get_intf`` and | ||
22 | +``usb_put_intf``). | ||
23 | |||
24 | Drivers using the async routines are responsible for their own | ||
25 | synchronization and mutual exclusion. | ||
26 | diff --git a/Makefile b/Makefile | ||
27 | index a4e35453f9e4..f5836837df15 100644 | ||
28 | --- a/Makefile | ||
29 | +++ b/Makefile | ||
30 | @@ -1,6 +1,6 @@ | ||
31 | VERSION = 4 | ||
32 | PATCHLEVEL = 9 | ||
33 | -SUBLEVEL = 173 | ||
34 | +SUBLEVEL = 174 | ||
35 | EXTRAVERSION = | ||
36 | NAME = Roaring Lionus | ||
37 | |||
38 | diff --git a/arch/arm/mach-iop13xx/setup.c b/arch/arm/mach-iop13xx/setup.c | ||
39 | index 53c316f7301e..fe4932fda01d 100644 | ||
40 | --- a/arch/arm/mach-iop13xx/setup.c | ||
41 | +++ b/arch/arm/mach-iop13xx/setup.c | ||
42 | @@ -300,7 +300,7 @@ static struct resource iop13xx_adma_2_resources[] = { | ||
43 | } | ||
44 | }; | ||
45 | |||
46 | -static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(64); | ||
47 | +static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(32); | ||
48 | static struct iop_adma_platform_data iop13xx_adma_0_data = { | ||
49 | .hw_id = 0, | ||
50 | .pool_size = PAGE_SIZE, | ||
51 | @@ -324,7 +324,7 @@ static struct platform_device iop13xx_adma_0_channel = { | ||
52 | .resource = iop13xx_adma_0_resources, | ||
53 | .dev = { | ||
54 | .dma_mask = &iop13xx_adma_dmamask, | ||
55 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
56 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
57 | .platform_data = (void *) &iop13xx_adma_0_data, | ||
58 | }, | ||
59 | }; | ||
60 | @@ -336,7 +336,7 @@ static struct platform_device iop13xx_adma_1_channel = { | ||
61 | .resource = iop13xx_adma_1_resources, | ||
62 | .dev = { | ||
63 | .dma_mask = &iop13xx_adma_dmamask, | ||
64 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
65 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
66 | .platform_data = (void *) &iop13xx_adma_1_data, | ||
67 | }, | ||
68 | }; | ||
69 | @@ -348,7 +348,7 @@ static struct platform_device iop13xx_adma_2_channel = { | ||
70 | .resource = iop13xx_adma_2_resources, | ||
71 | .dev = { | ||
72 | .dma_mask = &iop13xx_adma_dmamask, | ||
73 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
74 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
75 | .platform_data = (void *) &iop13xx_adma_2_data, | ||
76 | }, | ||
77 | }; | ||
78 | diff --git a/arch/arm/mach-iop13xx/tpmi.c b/arch/arm/mach-iop13xx/tpmi.c | ||
79 | index db511ec2b1df..116feb6b261e 100644 | ||
80 | --- a/arch/arm/mach-iop13xx/tpmi.c | ||
81 | +++ b/arch/arm/mach-iop13xx/tpmi.c | ||
82 | @@ -152,7 +152,7 @@ static struct resource iop13xx_tpmi_3_resources[] = { | ||
83 | } | ||
84 | }; | ||
85 | |||
86 | -u64 iop13xx_tpmi_mask = DMA_BIT_MASK(64); | ||
87 | +u64 iop13xx_tpmi_mask = DMA_BIT_MASK(32); | ||
88 | static struct platform_device iop13xx_tpmi_0_device = { | ||
89 | .name = "iop-tpmi", | ||
90 | .id = 0, | ||
91 | @@ -160,7 +160,7 @@ static struct platform_device iop13xx_tpmi_0_device = { | ||
92 | .resource = iop13xx_tpmi_0_resources, | ||
93 | .dev = { | ||
94 | .dma_mask = &iop13xx_tpmi_mask, | ||
95 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
96 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
97 | }, | ||
98 | }; | ||
99 | |||
100 | @@ -171,7 +171,7 @@ static struct platform_device iop13xx_tpmi_1_device = { | ||
101 | .resource = iop13xx_tpmi_1_resources, | ||
102 | .dev = { | ||
103 | .dma_mask = &iop13xx_tpmi_mask, | ||
104 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
105 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
106 | }, | ||
107 | }; | ||
108 | |||
109 | @@ -182,7 +182,7 @@ static struct platform_device iop13xx_tpmi_2_device = { | ||
110 | .resource = iop13xx_tpmi_2_resources, | ||
111 | .dev = { | ||
112 | .dma_mask = &iop13xx_tpmi_mask, | ||
113 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
114 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
115 | }, | ||
116 | }; | ||
117 | |||
118 | @@ -193,7 +193,7 @@ static struct platform_device iop13xx_tpmi_3_device = { | ||
119 | .resource = iop13xx_tpmi_3_resources, | ||
120 | .dev = { | ||
121 | .dma_mask = &iop13xx_tpmi_mask, | ||
122 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
123 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
124 | }, | ||
125 | }; | ||
126 | |||
127 | diff --git a/arch/arm/plat-iop/adma.c b/arch/arm/plat-iop/adma.c | ||
128 | index a4d1f8de3b5b..d9612221e484 100644 | ||
129 | --- a/arch/arm/plat-iop/adma.c | ||
130 | +++ b/arch/arm/plat-iop/adma.c | ||
131 | @@ -143,7 +143,7 @@ struct platform_device iop3xx_dma_0_channel = { | ||
132 | .resource = iop3xx_dma_0_resources, | ||
133 | .dev = { | ||
134 | .dma_mask = &iop3xx_adma_dmamask, | ||
135 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
136 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
137 | .platform_data = (void *) &iop3xx_dma_0_data, | ||
138 | }, | ||
139 | }; | ||
140 | @@ -155,7 +155,7 @@ struct platform_device iop3xx_dma_1_channel = { | ||
141 | .resource = iop3xx_dma_1_resources, | ||
142 | .dev = { | ||
143 | .dma_mask = &iop3xx_adma_dmamask, | ||
144 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
145 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
146 | .platform_data = (void *) &iop3xx_dma_1_data, | ||
147 | }, | ||
148 | }; | ||
149 | @@ -167,7 +167,7 @@ struct platform_device iop3xx_aau_channel = { | ||
150 | .resource = iop3xx_aau_resources, | ||
151 | .dev = { | ||
152 | .dma_mask = &iop3xx_adma_dmamask, | ||
153 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
154 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
155 | .platform_data = (void *) &iop3xx_aau_data, | ||
156 | }, | ||
157 | }; | ||
158 | diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c | ||
159 | index 272f49b2c68f..bb29e6ebdc0d 100644 | ||
160 | --- a/arch/arm/plat-orion/common.c | ||
161 | +++ b/arch/arm/plat-orion/common.c | ||
162 | @@ -605,7 +605,7 @@ static struct platform_device orion_xor0_shared = { | ||
163 | .resource = orion_xor0_shared_resources, | ||
164 | .dev = { | ||
165 | .dma_mask = &orion_xor_dmamask, | ||
166 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
167 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
168 | .platform_data = &orion_xor0_pdata, | ||
169 | }, | ||
170 | }; | ||
171 | @@ -666,7 +666,7 @@ static struct platform_device orion_xor1_shared = { | ||
172 | .resource = orion_xor1_shared_resources, | ||
173 | .dev = { | ||
174 | .dma_mask = &orion_xor_dmamask, | ||
175 | - .coherent_dma_mask = DMA_BIT_MASK(64), | ||
176 | + .coherent_dma_mask = DMA_BIT_MASK(32), | ||
177 | .platform_data = &orion_xor1_pdata, | ||
178 | }, | ||
179 | }; | ||
180 | diff --git a/arch/arm64/include/asm/system_misc.h b/arch/arm64/include/asm/system_misc.h | ||
181 | index bc812435bc76..d0beefeb6d25 100644 | ||
182 | --- a/arch/arm64/include/asm/system_misc.h | ||
183 | +++ b/arch/arm64/include/asm/system_misc.h | ||
184 | @@ -40,7 +40,7 @@ void hook_debug_fault_code(int nr, int (*fn)(unsigned long, unsigned int, | ||
185 | int sig, int code, const char *name); | ||
186 | |||
187 | struct mm_struct; | ||
188 | -extern void show_pte(struct mm_struct *mm, unsigned long addr); | ||
189 | +extern void show_pte(unsigned long addr); | ||
190 | extern void __show_regs(struct pt_regs *); | ||
191 | |||
192 | extern void (*arm_pm_restart)(enum reboot_mode reboot_mode, const char *cmd); | ||
193 | diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c | ||
194 | index 051b32084776..575c11a6f9b6 100644 | ||
195 | --- a/arch/arm64/mm/fault.c | ||
196 | +++ b/arch/arm64/mm/fault.c | ||
197 | @@ -79,18 +79,33 @@ static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr) | ||
198 | #endif | ||
199 | |||
200 | /* | ||
201 | - * Dump out the page tables associated with 'addr' in mm 'mm'. | ||
202 | + * Dump out the page tables associated with 'addr' in the currently active mm. | ||
203 | */ | ||
204 | -void show_pte(struct mm_struct *mm, unsigned long addr) | ||
205 | +void show_pte(unsigned long addr) | ||
206 | { | ||
207 | + struct mm_struct *mm; | ||
208 | pgd_t *pgd; | ||
209 | |||
210 | - if (!mm) | ||
211 | + if (addr < TASK_SIZE) { | ||
212 | + /* TTBR0 */ | ||
213 | + mm = current->active_mm; | ||
214 | + if (mm == &init_mm) { | ||
215 | + pr_alert("[%016lx] user address but active_mm is swapper\n", | ||
216 | + addr); | ||
217 | + return; | ||
218 | + } | ||
219 | + } else if (addr >= VA_START) { | ||
220 | + /* TTBR1 */ | ||
221 | mm = &init_mm; | ||
222 | + } else { | ||
223 | + pr_alert("[%016lx] address between user and kernel address ranges\n", | ||
224 | + addr); | ||
225 | + return; | ||
226 | + } | ||
227 | |||
228 | pr_alert("pgd = %p\n", mm->pgd); | ||
229 | pgd = pgd_offset(mm, addr); | ||
230 | - pr_alert("[%08lx] *pgd=%016llx", addr, pgd_val(*pgd)); | ||
231 | + pr_alert("[%016lx] *pgd=%016llx", addr, pgd_val(*pgd)); | ||
232 | |||
233 | do { | ||
234 | pud_t *pud; | ||
235 | @@ -176,8 +191,8 @@ static bool is_el1_instruction_abort(unsigned int esr) | ||
236 | /* | ||
237 | * The kernel tried to access some page that wasn't present. | ||
238 | */ | ||
239 | -static void __do_kernel_fault(struct mm_struct *mm, unsigned long addr, | ||
240 | - unsigned int esr, struct pt_regs *regs) | ||
241 | +static void __do_kernel_fault(unsigned long addr, unsigned int esr, | ||
242 | + struct pt_regs *regs) | ||
243 | { | ||
244 | /* | ||
245 | * Are we prepared to handle this kernel fault? | ||
246 | @@ -194,7 +209,7 @@ static void __do_kernel_fault(struct mm_struct *mm, unsigned long addr, | ||
247 | (addr < PAGE_SIZE) ? "NULL pointer dereference" : | ||
248 | "paging request", addr); | ||
249 | |||
250 | - show_pte(mm, addr); | ||
251 | + show_pte(addr); | ||
252 | die("Oops", regs, esr); | ||
253 | bust_spinlocks(0); | ||
254 | do_exit(SIGKILL); | ||
255 | @@ -216,7 +231,6 @@ static void __do_user_fault(struct task_struct *tsk, unsigned long addr, | ||
256 | pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n", | ||
257 | tsk->comm, task_pid_nr(tsk), inf->name, sig, | ||
258 | addr, esr); | ||
259 | - show_pte(tsk->mm, addr); | ||
260 | show_regs(regs); | ||
261 | } | ||
262 | |||
263 | @@ -232,7 +246,6 @@ static void __do_user_fault(struct task_struct *tsk, unsigned long addr, | ||
264 | static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs) | ||
265 | { | ||
266 | struct task_struct *tsk = current; | ||
267 | - struct mm_struct *mm = tsk->active_mm; | ||
268 | const struct fault_info *inf; | ||
269 | |||
270 | /* | ||
271 | @@ -243,7 +256,7 @@ static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *re | ||
272 | inf = esr_to_fault_info(esr); | ||
273 | __do_user_fault(tsk, addr, esr, inf->sig, inf->code, regs); | ||
274 | } else | ||
275 | - __do_kernel_fault(mm, addr, esr, regs); | ||
276 | + __do_kernel_fault(addr, esr, regs); | ||
277 | } | ||
278 | |||
279 | #define VM_FAULT_BADMAP 0x010000 | ||
280 | @@ -454,7 +467,7 @@ retry: | ||
281 | return 0; | ||
282 | |||
283 | no_context: | ||
284 | - __do_kernel_fault(mm, addr, esr, regs); | ||
285 | + __do_kernel_fault(addr, esr, regs); | ||
286 | return 0; | ||
287 | } | ||
288 | |||
289 | diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c | ||
290 | index 757009daa9ed..ff43da269fe8 100644 | ||
291 | --- a/arch/arm64/mm/kasan_init.c | ||
292 | +++ b/arch/arm64/mm/kasan_init.c | ||
293 | @@ -153,7 +153,7 @@ void __init kasan_init(void) | ||
294 | clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END); | ||
295 | |||
296 | vmemmap_populate(kimg_shadow_start, kimg_shadow_end, | ||
297 | - pfn_to_nid(virt_to_pfn(_text))); | ||
298 | + pfn_to_nid(virt_to_pfn(lm_alias(_text)))); | ||
299 | |||
300 | /* | ||
301 | * vmemmap_populate() has populated the shadow region that covers the | ||
302 | diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S | ||
303 | index 18d96d349a8b..f5fde8d389c9 100644 | ||
304 | --- a/arch/arm64/mm/proc.S | ||
305 | +++ b/arch/arm64/mm/proc.S | ||
306 | @@ -181,7 +181,8 @@ ENDPROC(idmap_cpu_replace_ttbr1) | ||
307 | dc cvac, cur_\()\type\()p // Ensure any existing dirty | ||
308 | dmb sy // lines are written back before | ||
309 | ldr \type, [cur_\()\type\()p] // loading the entry | ||
310 | - tbz \type, #0, next_\()\type // Skip invalid entries | ||
311 | + tbz \type, #0, skip_\()\type // Skip invalid and | ||
312 | + tbnz \type, #11, skip_\()\type // non-global entries | ||
313 | .endm | ||
314 | |||
315 | .macro __idmap_kpti_put_pgtable_ent_ng, type | ||
316 | @@ -241,8 +242,9 @@ ENTRY(idmap_kpti_install_ng_mappings) | ||
317 | add end_pgdp, cur_pgdp, #(PTRS_PER_PGD * 8) | ||
318 | do_pgd: __idmap_kpti_get_pgtable_ent pgd | ||
319 | tbnz pgd, #1, walk_puds | ||
320 | - __idmap_kpti_put_pgtable_ent_ng pgd | ||
321 | next_pgd: | ||
322 | + __idmap_kpti_put_pgtable_ent_ng pgd | ||
323 | +skip_pgd: | ||
324 | add cur_pgdp, cur_pgdp, #8 | ||
325 | cmp cur_pgdp, end_pgdp | ||
326 | b.ne do_pgd | ||
327 | @@ -270,8 +272,9 @@ walk_puds: | ||
328 | add end_pudp, cur_pudp, #(PTRS_PER_PUD * 8) | ||
329 | do_pud: __idmap_kpti_get_pgtable_ent pud | ||
330 | tbnz pud, #1, walk_pmds | ||
331 | - __idmap_kpti_put_pgtable_ent_ng pud | ||
332 | next_pud: | ||
333 | + __idmap_kpti_put_pgtable_ent_ng pud | ||
334 | +skip_pud: | ||
335 | add cur_pudp, cur_pudp, 8 | ||
336 | cmp cur_pudp, end_pudp | ||
337 | b.ne do_pud | ||
338 | @@ -290,8 +293,9 @@ walk_pmds: | ||
339 | add end_pmdp, cur_pmdp, #(PTRS_PER_PMD * 8) | ||
340 | do_pmd: __idmap_kpti_get_pgtable_ent pmd | ||
341 | tbnz pmd, #1, walk_ptes | ||
342 | - __idmap_kpti_put_pgtable_ent_ng pmd | ||
343 | next_pmd: | ||
344 | + __idmap_kpti_put_pgtable_ent_ng pmd | ||
345 | +skip_pmd: | ||
346 | add cur_pmdp, cur_pmdp, #8 | ||
347 | cmp cur_pmdp, end_pmdp | ||
348 | b.ne do_pmd | ||
349 | @@ -309,7 +313,7 @@ walk_ptes: | ||
350 | add end_ptep, cur_ptep, #(PTRS_PER_PTE * 8) | ||
351 | do_pte: __idmap_kpti_get_pgtable_ent pte | ||
352 | __idmap_kpti_put_pgtable_ent_ng pte | ||
353 | -next_pte: | ||
354 | +skip_pte: | ||
355 | add cur_ptep, cur_ptep, #8 | ||
356 | cmp cur_ptep, end_ptep | ||
357 | b.ne do_pte | ||
358 | diff --git a/arch/sh/boards/of-generic.c b/arch/sh/boards/of-generic.c | ||
359 | index 1fb6d5714bae..fd00566677c9 100644 | ||
360 | --- a/arch/sh/boards/of-generic.c | ||
361 | +++ b/arch/sh/boards/of-generic.c | ||
362 | @@ -180,10 +180,10 @@ static struct sh_machine_vector __initmv sh_of_generic_mv = { | ||
363 | |||
364 | struct sh_clk_ops; | ||
365 | |||
366 | -void __init arch_init_clk_ops(struct sh_clk_ops **ops, int idx) | ||
367 | +void __init __weak arch_init_clk_ops(struct sh_clk_ops **ops, int idx) | ||
368 | { | ||
369 | } | ||
370 | |||
371 | -void __init plat_irq_setup(void) | ||
372 | +void __init __weak plat_irq_setup(void) | ||
373 | { | ||
374 | } | ||
375 | diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c | ||
376 | index de050d5a4506..00b56cc69d37 100644 | ||
377 | --- a/arch/x86/events/amd/core.c | ||
378 | +++ b/arch/x86/events/amd/core.c | ||
379 | @@ -112,6 +112,110 @@ static __initconst const u64 amd_hw_cache_event_ids | ||
380 | }, | ||
381 | }; | ||
382 | |||
383 | +static __initconst const u64 amd_hw_cache_event_ids_f17h | ||
384 | + [PERF_COUNT_HW_CACHE_MAX] | ||
385 | + [PERF_COUNT_HW_CACHE_OP_MAX] | ||
386 | + [PERF_COUNT_HW_CACHE_RESULT_MAX] = { | ||
387 | +[C(L1D)] = { | ||
388 | + [C(OP_READ)] = { | ||
389 | + [C(RESULT_ACCESS)] = 0x0040, /* Data Cache Accesses */ | ||
390 | + [C(RESULT_MISS)] = 0xc860, /* L2$ access from DC Miss */ | ||
391 | + }, | ||
392 | + [C(OP_WRITE)] = { | ||
393 | + [C(RESULT_ACCESS)] = 0, | ||
394 | + [C(RESULT_MISS)] = 0, | ||
395 | + }, | ||
396 | + [C(OP_PREFETCH)] = { | ||
397 | + [C(RESULT_ACCESS)] = 0xff5a, /* h/w prefetch DC Fills */ | ||
398 | + [C(RESULT_MISS)] = 0, | ||
399 | + }, | ||
400 | +}, | ||
401 | +[C(L1I)] = { | ||
402 | + [C(OP_READ)] = { | ||
403 | + [C(RESULT_ACCESS)] = 0x0080, /* Instruction cache fetches */ | ||
404 | + [C(RESULT_MISS)] = 0x0081, /* Instruction cache misses */ | ||
405 | + }, | ||
406 | + [C(OP_WRITE)] = { | ||
407 | + [C(RESULT_ACCESS)] = -1, | ||
408 | + [C(RESULT_MISS)] = -1, | ||
409 | + }, | ||
410 | + [C(OP_PREFETCH)] = { | ||
411 | + [C(RESULT_ACCESS)] = 0, | ||
412 | + [C(RESULT_MISS)] = 0, | ||
413 | + }, | ||
414 | +}, | ||
415 | +[C(LL)] = { | ||
416 | + [C(OP_READ)] = { | ||
417 | + [C(RESULT_ACCESS)] = 0, | ||
418 | + [C(RESULT_MISS)] = 0, | ||
419 | + }, | ||
420 | + [C(OP_WRITE)] = { | ||
421 | + [C(RESULT_ACCESS)] = 0, | ||
422 | + [C(RESULT_MISS)] = 0, | ||
423 | + }, | ||
424 | + [C(OP_PREFETCH)] = { | ||
425 | + [C(RESULT_ACCESS)] = 0, | ||
426 | + [C(RESULT_MISS)] = 0, | ||
427 | + }, | ||
428 | +}, | ||
429 | +[C(DTLB)] = { | ||
430 | + [C(OP_READ)] = { | ||
431 | + [C(RESULT_ACCESS)] = 0xff45, /* All L2 DTLB accesses */ | ||
432 | + [C(RESULT_MISS)] = 0xf045, /* L2 DTLB misses (PT walks) */ | ||
433 | + }, | ||
434 | + [C(OP_WRITE)] = { | ||
435 | + [C(RESULT_ACCESS)] = 0, | ||
436 | + [C(RESULT_MISS)] = 0, | ||
437 | + }, | ||
438 | + [C(OP_PREFETCH)] = { | ||
439 | + [C(RESULT_ACCESS)] = 0, | ||
440 | + [C(RESULT_MISS)] = 0, | ||
441 | + }, | ||
442 | +}, | ||
443 | +[C(ITLB)] = { | ||
444 | + [C(OP_READ)] = { | ||
445 | + [C(RESULT_ACCESS)] = 0x0084, /* L1 ITLB misses, L2 ITLB hits */ | ||
446 | + [C(RESULT_MISS)] = 0xff85, /* L1 ITLB misses, L2 misses */ | ||
447 | + }, | ||
448 | + [C(OP_WRITE)] = { | ||
449 | + [C(RESULT_ACCESS)] = -1, | ||
450 | + [C(RESULT_MISS)] = -1, | ||
451 | + }, | ||
452 | + [C(OP_PREFETCH)] = { | ||
453 | + [C(RESULT_ACCESS)] = -1, | ||
454 | + [C(RESULT_MISS)] = -1, | ||
455 | + }, | ||
456 | +}, | ||
457 | +[C(BPU)] = { | ||
458 | + [C(OP_READ)] = { | ||
459 | + [C(RESULT_ACCESS)] = 0x00c2, /* Retired Branch Instr. */ | ||
460 | + [C(RESULT_MISS)] = 0x00c3, /* Retired Mispredicted BI */ | ||
461 | + }, | ||
462 | + [C(OP_WRITE)] = { | ||
463 | + [C(RESULT_ACCESS)] = -1, | ||
464 | + [C(RESULT_MISS)] = -1, | ||
465 | + }, | ||
466 | + [C(OP_PREFETCH)] = { | ||
467 | + [C(RESULT_ACCESS)] = -1, | ||
468 | + [C(RESULT_MISS)] = -1, | ||
469 | + }, | ||
470 | +}, | ||
471 | +[C(NODE)] = { | ||
472 | + [C(OP_READ)] = { | ||
473 | + [C(RESULT_ACCESS)] = 0, | ||
474 | + [C(RESULT_MISS)] = 0, | ||
475 | + }, | ||
476 | + [C(OP_WRITE)] = { | ||
477 | + [C(RESULT_ACCESS)] = -1, | ||
478 | + [C(RESULT_MISS)] = -1, | ||
479 | + }, | ||
480 | + [C(OP_PREFETCH)] = { | ||
481 | + [C(RESULT_ACCESS)] = -1, | ||
482 | + [C(RESULT_MISS)] = -1, | ||
483 | + }, | ||
484 | +}, | ||
485 | +}; | ||
486 | + | ||
487 | /* | ||
488 | * AMD Performance Monitor K7 and later, up to and including Family 16h: | ||
489 | */ | ||
490 | @@ -731,9 +835,10 @@ __init int amd_pmu_init(void) | ||
491 | x86_pmu.amd_nb_constraints = 0; | ||
492 | } | ||
493 | |||
494 | - /* Events are common for all AMDs */ | ||
495 | - memcpy(hw_cache_event_ids, amd_hw_cache_event_ids, | ||
496 | - sizeof(hw_cache_event_ids)); | ||
497 | + if (boot_cpu_data.x86 >= 0x17) | ||
498 | + memcpy(hw_cache_event_ids, amd_hw_cache_event_ids_f17h, sizeof(hw_cache_event_ids)); | ||
499 | + else | ||
500 | + memcpy(hw_cache_event_ids, amd_hw_cache_event_ids, sizeof(hw_cache_event_ids)); | ||
501 | |||
502 | return 0; | ||
503 | } | ||
504 | diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h | ||
505 | index 37f2e0b377ad..4141ead86879 100644 | ||
506 | --- a/arch/x86/include/asm/stacktrace.h | ||
507 | +++ b/arch/x86/include/asm/stacktrace.h | ||
508 | @@ -55,13 +55,16 @@ extern int kstack_depth_to_print; | ||
509 | static inline unsigned long * | ||
510 | get_frame_pointer(struct task_struct *task, struct pt_regs *regs) | ||
511 | { | ||
512 | + struct inactive_task_frame *frame; | ||
513 | + | ||
514 | if (regs) | ||
515 | return (unsigned long *)regs->bp; | ||
516 | |||
517 | if (task == current) | ||
518 | return __builtin_frame_address(0); | ||
519 | |||
520 | - return (unsigned long *)((struct inactive_task_frame *)task->thread.sp)->bp; | ||
521 | + frame = (struct inactive_task_frame *)task->thread.sp; | ||
522 | + return (unsigned long *)READ_ONCE_NOCHECK(frame->bp); | ||
523 | } | ||
524 | #else | ||
525 | static inline unsigned long * | ||
526 | diff --git a/arch/x86/kernel/acpi/wakeup_64.S b/arch/x86/kernel/acpi/wakeup_64.S | ||
527 | index 169963f471bb..50b8ed0317a3 100644 | ||
528 | --- a/arch/x86/kernel/acpi/wakeup_64.S | ||
529 | +++ b/arch/x86/kernel/acpi/wakeup_64.S | ||
530 | @@ -109,6 +109,15 @@ ENTRY(do_suspend_lowlevel) | ||
531 | movq pt_regs_r14(%rax), %r14 | ||
532 | movq pt_regs_r15(%rax), %r15 | ||
533 | |||
534 | +#ifdef CONFIG_KASAN | ||
535 | + /* | ||
536 | + * The suspend path may have poisoned some areas deeper in the stack, | ||
537 | + * which we now need to unpoison. | ||
538 | + */ | ||
539 | + movq %rsp, %rdi | ||
540 | + call kasan_unpoison_task_stack_below | ||
541 | +#endif | ||
542 | + | ||
543 | xorl %eax, %eax | ||
544 | addq $8, %rsp | ||
545 | FRAME_END | ||
546 | diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c | ||
547 | index 3e0199ee5a2f..0372913e0134 100644 | ||
548 | --- a/arch/x86/kernel/cpu/mcheck/mce-severity.c | ||
549 | +++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c | ||
550 | @@ -148,6 +148,11 @@ static struct severity { | ||
551 | SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR|MCACOD_DATA), | ||
552 | KERNEL | ||
553 | ), | ||
554 | + MCESEV( | ||
555 | + PANIC, "Instruction fetch error in kernel", | ||
556 | + SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR|MCACOD_INSTR), | ||
557 | + KERNEL | ||
558 | + ), | ||
559 | #endif | ||
560 | MCESEV( | ||
561 | PANIC, "Action required: unknown MCACOD", | ||
562 | diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c | ||
563 | index a2456d4d286a..9b8b3cb2e934 100644 | ||
564 | --- a/arch/x86/kernel/unwind_frame.c | ||
565 | +++ b/arch/x86/kernel/unwind_frame.c | ||
566 | @@ -6,6 +6,21 @@ | ||
567 | |||
568 | #define FRAME_HEADER_SIZE (sizeof(long) * 2) | ||
569 | |||
570 | +/* | ||
571 | + * This disables KASAN checking when reading a value from another task's stack, | ||
572 | + * since the other task could be running on another CPU and could have poisoned | ||
573 | + * the stack in the meantime. | ||
574 | + */ | ||
575 | +#define READ_ONCE_TASK_STACK(task, x) \ | ||
576 | +({ \ | ||
577 | + unsigned long val; \ | ||
578 | + if (task == current) \ | ||
579 | + val = READ_ONCE(x); \ | ||
580 | + else \ | ||
581 | + val = READ_ONCE_NOCHECK(x); \ | ||
582 | + val; \ | ||
583 | +}) | ||
584 | + | ||
585 | unsigned long unwind_get_return_address(struct unwind_state *state) | ||
586 | { | ||
587 | unsigned long addr; | ||
588 | @@ -14,7 +29,8 @@ unsigned long unwind_get_return_address(struct unwind_state *state) | ||
589 | if (unwind_done(state)) | ||
590 | return 0; | ||
591 | |||
592 | - addr = ftrace_graph_ret_addr(state->task, &state->graph_idx, *addr_p, | ||
593 | + addr = READ_ONCE_TASK_STACK(state->task, *addr_p); | ||
594 | + addr = ftrace_graph_ret_addr(state->task, &state->graph_idx, addr, | ||
595 | addr_p); | ||
596 | |||
597 | return __kernel_text_address(addr) ? addr : 0; | ||
598 | @@ -48,7 +64,7 @@ bool unwind_next_frame(struct unwind_state *state) | ||
599 | if (unwind_done(state)) | ||
600 | return false; | ||
601 | |||
602 | - next_bp = (unsigned long *)*state->bp; | ||
603 | + next_bp = (unsigned long *)READ_ONCE_TASK_STACK(state->task,*state->bp); | ||
604 | |||
605 | /* make sure the next frame's data is accessible */ | ||
606 | if (!update_stack_state(state, next_bp, FRAME_HEADER_SIZE)) | ||
607 | diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c | ||
608 | index c4328d9d9981..f838119d12b2 100644 | ||
609 | --- a/drivers/block/xsysace.c | ||
610 | +++ b/drivers/block/xsysace.c | ||
611 | @@ -1062,6 +1062,8 @@ static int ace_setup(struct ace_device *ace) | ||
612 | return 0; | ||
613 | |||
614 | err_read: | ||
615 | + /* prevent double queue cleanup */ | ||
616 | + ace->gd->queue = NULL; | ||
617 | put_disk(ace->gd); | ||
618 | err_alloc_disk: | ||
619 | blk_cleanup_queue(ace->queue); | ||
620 | diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c | ||
621 | index d7179dd3c9ef..3cafa1d28fed 100644 | ||
622 | --- a/drivers/hid/hid-debug.c | ||
623 | +++ b/drivers/hid/hid-debug.c | ||
624 | @@ -1058,10 +1058,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p) | ||
625 | seq_printf(f, "\n\n"); | ||
626 | |||
627 | /* dump parsed data and input mappings */ | ||
628 | + if (down_interruptible(&hdev->driver_input_lock)) | ||
629 | + return 0; | ||
630 | + | ||
631 | hid_dump_device(hdev, f); | ||
632 | seq_printf(f, "\n"); | ||
633 | hid_dump_input_mapping(hdev, f); | ||
634 | |||
635 | + up(&hdev->driver_input_lock); | ||
636 | + | ||
637 | return 0; | ||
638 | } | ||
639 | |||
640 | diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c | ||
641 | index 2e2515a4c070..3198faf5cff4 100644 | ||
642 | --- a/drivers/hid/hid-logitech-hidpp.c | ||
643 | +++ b/drivers/hid/hid-logitech-hidpp.c | ||
644 | @@ -1282,6 +1282,13 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index) | ||
645 | kfree(data); | ||
646 | return -ENOMEM; | ||
647 | } | ||
648 | + data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue"); | ||
649 | + if (!data->wq) { | ||
650 | + kfree(data->effect_ids); | ||
651 | + kfree(data); | ||
652 | + return -ENOMEM; | ||
653 | + } | ||
654 | + | ||
655 | data->hidpp = hidpp; | ||
656 | data->feature_index = feature_index; | ||
657 | data->version = version; | ||
658 | @@ -1326,7 +1333,6 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index) | ||
659 | /* ignore boost value at response.fap.params[2] */ | ||
660 | |||
661 | /* init the hardware command queue */ | ||
662 | - data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue"); | ||
663 | atomic_set(&data->workqueue_size, 0); | ||
664 | |||
665 | /* initialize with zero autocenter to get wheel in usable state */ | ||
666 | diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c | ||
667 | index 2a44a2c3e859..6914cc18b4a1 100644 | ||
668 | --- a/drivers/infiniband/ulp/srpt/ib_srpt.c | ||
669 | +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c | ||
670 | @@ -2368,8 +2368,19 @@ static void srpt_queue_tm_rsp(struct se_cmd *cmd) | ||
671 | srpt_queue_response(cmd); | ||
672 | } | ||
673 | |||
674 | +/* | ||
675 | + * This function is called for aborted commands if no response is sent to the | ||
676 | + * initiator. Make sure that the credits freed by aborting a command are | ||
677 | + * returned to the initiator the next time a response is sent by incrementing | ||
678 | + * ch->req_lim_delta. | ||
679 | + */ | ||
680 | static void srpt_aborted_task(struct se_cmd *cmd) | ||
681 | { | ||
682 | + struct srpt_send_ioctx *ioctx = container_of(cmd, | ||
683 | + struct srpt_send_ioctx, cmd); | ||
684 | + struct srpt_rdma_ch *ch = ioctx->ch; | ||
685 | + | ||
686 | + atomic_inc(&ch->req_lim_delta); | ||
687 | } | ||
688 | |||
689 | static int srpt_queue_status(struct se_cmd *cmd) | ||
690 | diff --git a/drivers/input/keyboard/snvs_pwrkey.c b/drivers/input/keyboard/snvs_pwrkey.c | ||
691 | index 7544888c4749..b8dbde746b4e 100644 | ||
692 | --- a/drivers/input/keyboard/snvs_pwrkey.c | ||
693 | +++ b/drivers/input/keyboard/snvs_pwrkey.c | ||
694 | @@ -156,6 +156,9 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev) | ||
695 | return error; | ||
696 | } | ||
697 | |||
698 | + pdata->input = input; | ||
699 | + platform_set_drvdata(pdev, pdata); | ||
700 | + | ||
701 | error = devm_request_irq(&pdev->dev, pdata->irq, | ||
702 | imx_snvs_pwrkey_interrupt, | ||
703 | 0, pdev->name, pdev); | ||
704 | @@ -171,9 +174,6 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev) | ||
705 | return error; | ||
706 | } | ||
707 | |||
708 | - pdata->input = input; | ||
709 | - platform_set_drvdata(pdev, pdata); | ||
710 | - | ||
711 | device_init_wakeup(&pdev->dev, pdata->wakeup); | ||
712 | |||
713 | return 0; | ||
714 | diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c | ||
715 | index 56cfb5ca9c95..0a72228734ae 100644 | ||
716 | --- a/drivers/media/i2c/ov7670.c | ||
717 | +++ b/drivers/media/i2c/ov7670.c | ||
718 | @@ -155,10 +155,10 @@ MODULE_PARM_DESC(debug, "Debug level (0-1)"); | ||
719 | #define REG_GFIX 0x69 /* Fix gain control */ | ||
720 | |||
721 | #define REG_DBLV 0x6b /* PLL control an debugging */ | ||
722 | -#define DBLV_BYPASS 0x00 /* Bypass PLL */ | ||
723 | -#define DBLV_X4 0x01 /* clock x4 */ | ||
724 | -#define DBLV_X6 0x10 /* clock x6 */ | ||
725 | -#define DBLV_X8 0x11 /* clock x8 */ | ||
726 | +#define DBLV_BYPASS 0x0a /* Bypass PLL */ | ||
727 | +#define DBLV_X4 0x4a /* clock x4 */ | ||
728 | +#define DBLV_X6 0x8a /* clock x6 */ | ||
729 | +#define DBLV_X8 0xca /* clock x8 */ | ||
730 | |||
731 | #define REG_REG76 0x76 /* OV's name */ | ||
732 | #define R76_BLKPCOR 0x80 /* Black pixel correction enable */ | ||
733 | @@ -833,7 +833,7 @@ static int ov7675_set_framerate(struct v4l2_subdev *sd, | ||
734 | if (ret < 0) | ||
735 | return ret; | ||
736 | |||
737 | - return ov7670_write(sd, REG_DBLV, DBLV_X4); | ||
738 | + return 0; | ||
739 | } | ||
740 | |||
741 | static void ov7670_get_framerate_legacy(struct v4l2_subdev *sd, | ||
742 | @@ -1578,11 +1578,7 @@ static int ov7670_probe(struct i2c_client *client, | ||
743 | if (config->clock_speed) | ||
744 | info->clock_speed = config->clock_speed; | ||
745 | |||
746 | - /* | ||
747 | - * It should be allowed for ov7670 too when it is migrated to | ||
748 | - * the new frame rate formula. | ||
749 | - */ | ||
750 | - if (config->pll_bypass && id->driver_data != MODEL_OV7670) | ||
751 | + if (config->pll_bypass) | ||
752 | info->pll_bypass = true; | ||
753 | |||
754 | if (config->pclk_hb_disable) | ||
755 | diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c | ||
756 | index 7d16c51e6913..641a532b67cb 100644 | ||
757 | --- a/drivers/net/bonding/bond_sysfs_slave.c | ||
758 | +++ b/drivers/net/bonding/bond_sysfs_slave.c | ||
759 | @@ -55,7 +55,9 @@ static SLAVE_ATTR_RO(link_failure_count); | ||
760 | |||
761 | static ssize_t perm_hwaddr_show(struct slave *slave, char *buf) | ||
762 | { | ||
763 | - return sprintf(buf, "%pM\n", slave->perm_hwaddr); | ||
764 | + return sprintf(buf, "%*phC\n", | ||
765 | + slave->dev->addr_len, | ||
766 | + slave->perm_hwaddr); | ||
767 | } | ||
768 | static SLAVE_ATTR_RO(perm_hwaddr); | ||
769 | |||
770 | diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
771 | index 45ea2718c65d..620a470eb4c8 100644 | ||
772 | --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
773 | +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
774 | @@ -5954,8 +5954,15 @@ static int bnxt_cfg_rx_mode(struct bnxt *bp) | ||
775 | |||
776 | skip_uc: | ||
777 | rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0); | ||
778 | + if (rc && vnic->mc_list_count) { | ||
779 | + netdev_info(bp->dev, "Failed setting MC filters rc: %d, turning on ALL_MCAST mode\n", | ||
780 | + rc); | ||
781 | + vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST; | ||
782 | + vnic->mc_list_count = 0; | ||
783 | + rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0); | ||
784 | + } | ||
785 | if (rc) | ||
786 | - netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %x\n", | ||
787 | + netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %d\n", | ||
788 | rc); | ||
789 | |||
790 | return rc; | ||
791 | diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c | ||
792 | index 06bc8638501e..66e7a5fd4249 100644 | ||
793 | --- a/drivers/net/ethernet/hisilicon/hns/hnae.c | ||
794 | +++ b/drivers/net/ethernet/hisilicon/hns/hnae.c | ||
795 | @@ -146,7 +146,6 @@ out_buffer_fail: | ||
796 | /* free desc along with its attached buffer */ | ||
797 | static void hnae_free_desc(struct hnae_ring *ring) | ||
798 | { | ||
799 | - hnae_free_buffers(ring); | ||
800 | dma_unmap_single(ring_to_dev(ring), ring->desc_dma_addr, | ||
801 | ring->desc_num * sizeof(ring->desc[0]), | ||
802 | ring_to_dma_dir(ring)); | ||
803 | @@ -179,6 +178,9 @@ static int hnae_alloc_desc(struct hnae_ring *ring) | ||
804 | /* fini ring, also free the buffer for the ring */ | ||
805 | static void hnae_fini_ring(struct hnae_ring *ring) | ||
806 | { | ||
807 | + if (is_rx_ring(ring)) | ||
808 | + hnae_free_buffers(ring); | ||
809 | + | ||
810 | hnae_free_desc(ring); | ||
811 | kfree(ring->desc_cb); | ||
812 | ring->desc_cb = NULL; | ||
813 | diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c | ||
814 | index ad8681cf5ef0..24a815997ec5 100644 | ||
815 | --- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c | ||
816 | +++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c | ||
817 | @@ -28,9 +28,6 @@ | ||
818 | |||
819 | #define SERVICE_TIMER_HZ (1 * HZ) | ||
820 | |||
821 | -#define NIC_TX_CLEAN_MAX_NUM 256 | ||
822 | -#define NIC_RX_CLEAN_MAX_NUM 64 | ||
823 | - | ||
824 | #define RCB_IRQ_NOT_INITED 0 | ||
825 | #define RCB_IRQ_INITED 1 | ||
826 | #define HNS_BUFFER_SIZE_2048 2048 | ||
827 | @@ -375,8 +372,6 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, | ||
828 | wmb(); /* commit all data before submit */ | ||
829 | assert(skb->queue_mapping < priv->ae_handle->q_num); | ||
830 | hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num); | ||
831 | - ring->stats.tx_pkts++; | ||
832 | - ring->stats.tx_bytes += skb->len; | ||
833 | |||
834 | return NETDEV_TX_OK; | ||
835 | |||
836 | @@ -916,6 +911,9 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data, | ||
837 | /* issue prefetch for next Tx descriptor */ | ||
838 | prefetch(&ring->desc_cb[ring->next_to_clean]); | ||
839 | } | ||
840 | + /* update tx ring statistics. */ | ||
841 | + ring->stats.tx_pkts += pkts; | ||
842 | + ring->stats.tx_bytes += bytes; | ||
843 | |||
844 | NETIF_TX_UNLOCK(ndev); | ||
845 | |||
846 | @@ -1821,7 +1819,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv) | ||
847 | hns_nic_tx_fini_pro_v2; | ||
848 | |||
849 | netif_napi_add(priv->netdev, &rd->napi, | ||
850 | - hns_nic_common_poll, NIC_TX_CLEAN_MAX_NUM); | ||
851 | + hns_nic_common_poll, NAPI_POLL_WEIGHT); | ||
852 | rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED; | ||
853 | } | ||
854 | for (i = h->q_num; i < h->q_num * 2; i++) { | ||
855 | @@ -1834,7 +1832,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv) | ||
856 | hns_nic_rx_fini_pro_v2; | ||
857 | |||
858 | netif_napi_add(priv->netdev, &rd->napi, | ||
859 | - hns_nic_common_poll, NIC_RX_CLEAN_MAX_NUM); | ||
860 | + hns_nic_common_poll, NAPI_POLL_WEIGHT); | ||
861 | rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED; | ||
862 | } | ||
863 | |||
864 | diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h | ||
865 | index 2688180a7acd..f948eec7b35f 100644 | ||
866 | --- a/drivers/net/ethernet/intel/igb/e1000_defines.h | ||
867 | +++ b/drivers/net/ethernet/intel/igb/e1000_defines.h | ||
868 | @@ -193,6 +193,8 @@ | ||
869 | /* enable link status from external LINK_0 and LINK_1 pins */ | ||
870 | #define E1000_CTRL_SWDPIN0 0x00040000 /* SWDPIN 0 value */ | ||
871 | #define E1000_CTRL_SWDPIN1 0x00080000 /* SWDPIN 1 value */ | ||
872 | +#define E1000_CTRL_ADVD3WUC 0x00100000 /* D3 WUC */ | ||
873 | +#define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000 /* PHY PM enable */ | ||
874 | #define E1000_CTRL_SDP0_DIR 0x00400000 /* SDP0 Data direction */ | ||
875 | #define E1000_CTRL_SDP1_DIR 0x00800000 /* SDP1 Data direction */ | ||
876 | #define E1000_CTRL_RST 0x04000000 /* Global reset */ | ||
877 | diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c | ||
878 | index 82e48e355fb9..7956176c2c73 100644 | ||
879 | --- a/drivers/net/ethernet/intel/igb/igb_main.c | ||
880 | +++ b/drivers/net/ethernet/intel/igb/igb_main.c | ||
881 | @@ -7548,9 +7548,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, | ||
882 | struct e1000_hw *hw = &adapter->hw; | ||
883 | u32 ctrl, rctl, status; | ||
884 | u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol; | ||
885 | -#ifdef CONFIG_PM | ||
886 | - int retval = 0; | ||
887 | -#endif | ||
888 | + bool wake; | ||
889 | |||
890 | rtnl_lock(); | ||
891 | netif_device_detach(netdev); | ||
892 | @@ -7563,14 +7561,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, | ||
893 | igb_clear_interrupt_scheme(adapter); | ||
894 | rtnl_unlock(); | ||
895 | |||
896 | -#ifdef CONFIG_PM | ||
897 | - if (!runtime) { | ||
898 | - retval = pci_save_state(pdev); | ||
899 | - if (retval) | ||
900 | - return retval; | ||
901 | - } | ||
902 | -#endif | ||
903 | - | ||
904 | status = rd32(E1000_STATUS); | ||
905 | if (status & E1000_STATUS_LU) | ||
906 | wufc &= ~E1000_WUFC_LNKC; | ||
907 | @@ -7587,10 +7577,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, | ||
908 | } | ||
909 | |||
910 | ctrl = rd32(E1000_CTRL); | ||
911 | - /* advertise wake from D3Cold */ | ||
912 | - #define E1000_CTRL_ADVD3WUC 0x00100000 | ||
913 | - /* phy power management enable */ | ||
914 | - #define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000 | ||
915 | ctrl |= E1000_CTRL_ADVD3WUC; | ||
916 | wr32(E1000_CTRL, ctrl); | ||
917 | |||
918 | @@ -7604,12 +7590,15 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, | ||
919 | wr32(E1000_WUFC, 0); | ||
920 | } | ||
921 | |||
922 | - *enable_wake = wufc || adapter->en_mng_pt; | ||
923 | - if (!*enable_wake) | ||
924 | + wake = wufc || adapter->en_mng_pt; | ||
925 | + if (!wake) | ||
926 | igb_power_down_link(adapter); | ||
927 | else | ||
928 | igb_power_up_link(adapter); | ||
929 | |||
930 | + if (enable_wake) | ||
931 | + *enable_wake = wake; | ||
932 | + | ||
933 | /* Release control of h/w to f/w. If f/w is AMT enabled, this | ||
934 | * would have already happened in close and is redundant. | ||
935 | */ | ||
936 | @@ -7624,22 +7613,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, | ||
937 | #ifdef CONFIG_PM_SLEEP | ||
938 | static int igb_suspend(struct device *dev) | ||
939 | { | ||
940 | - int retval; | ||
941 | - bool wake; | ||
942 | - struct pci_dev *pdev = to_pci_dev(dev); | ||
943 | - | ||
944 | - retval = __igb_shutdown(pdev, &wake, 0); | ||
945 | - if (retval) | ||
946 | - return retval; | ||
947 | - | ||
948 | - if (wake) { | ||
949 | - pci_prepare_to_sleep(pdev); | ||
950 | - } else { | ||
951 | - pci_wake_from_d3(pdev, false); | ||
952 | - pci_set_power_state(pdev, PCI_D3hot); | ||
953 | - } | ||
954 | - | ||
955 | - return 0; | ||
956 | + return __igb_shutdown(to_pci_dev(dev), NULL, 0); | ||
957 | } | ||
958 | #endif /* CONFIG_PM_SLEEP */ | ||
959 | |||
960 | @@ -7707,22 +7681,7 @@ static int igb_runtime_idle(struct device *dev) | ||
961 | |||
962 | static int igb_runtime_suspend(struct device *dev) | ||
963 | { | ||
964 | - struct pci_dev *pdev = to_pci_dev(dev); | ||
965 | - int retval; | ||
966 | - bool wake; | ||
967 | - | ||
968 | - retval = __igb_shutdown(pdev, &wake, 1); | ||
969 | - if (retval) | ||
970 | - return retval; | ||
971 | - | ||
972 | - if (wake) { | ||
973 | - pci_prepare_to_sleep(pdev); | ||
974 | - } else { | ||
975 | - pci_wake_from_d3(pdev, false); | ||
976 | - pci_set_power_state(pdev, PCI_D3hot); | ||
977 | - } | ||
978 | - | ||
979 | - return 0; | ||
980 | + return __igb_shutdown(to_pci_dev(dev), NULL, 1); | ||
981 | } | ||
982 | |||
983 | static int igb_runtime_resume(struct device *dev) | ||
984 | diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | ||
985 | index da9246f6c31e..d1a3a35ba87b 100644 | ||
986 | --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | ||
987 | +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | ||
988 | @@ -92,8 +92,7 @@ static int arm_vport_context_events_cmd(struct mlx5_core_dev *dev, u16 vport, | ||
989 | opcode, MLX5_CMD_OP_MODIFY_NIC_VPORT_CONTEXT); | ||
990 | MLX5_SET(modify_nic_vport_context_in, in, field_select.change_event, 1); | ||
991 | MLX5_SET(modify_nic_vport_context_in, in, vport_number, vport); | ||
992 | - if (vport) | ||
993 | - MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1); | ||
994 | + MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1); | ||
995 | nic_vport_ctx = MLX5_ADDR_OF(modify_nic_vport_context_in, | ||
996 | in, nic_vport_context); | ||
997 | |||
998 | @@ -121,8 +120,7 @@ static int modify_esw_vport_context_cmd(struct mlx5_core_dev *dev, u16 vport, | ||
999 | MLX5_SET(modify_esw_vport_context_in, in, opcode, | ||
1000 | MLX5_CMD_OP_MODIFY_ESW_VPORT_CONTEXT); | ||
1001 | MLX5_SET(modify_esw_vport_context_in, in, vport_number, vport); | ||
1002 | - if (vport) | ||
1003 | - MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1); | ||
1004 | + MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1); | ||
1005 | return mlx5_cmd_exec(dev, in, inlen, out, sizeof(out)); | ||
1006 | } | ||
1007 | |||
1008 | diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c | ||
1009 | index ce97e522566a..77dc5842bd0b 100644 | ||
1010 | --- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c | ||
1011 | +++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c | ||
1012 | @@ -205,6 +205,11 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x, | ||
1013 | if (unlikely(rdes0 & RDES0_OWN)) | ||
1014 | return dma_own; | ||
1015 | |||
1016 | + if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) { | ||
1017 | + stats->rx_length_errors++; | ||
1018 | + return discard_frame; | ||
1019 | + } | ||
1020 | + | ||
1021 | if (unlikely(rdes0 & RDES0_ERROR_SUMMARY)) { | ||
1022 | if (unlikely(rdes0 & RDES0_DESCRIPTOR_ERROR)) { | ||
1023 | x->rx_desc++; | ||
1024 | @@ -235,9 +240,10 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x, | ||
1025 | * It doesn't match with the information reported into the databook. | ||
1026 | * At any rate, we need to understand if the CSUM hw computation is ok | ||
1027 | * and report this info to the upper layers. */ | ||
1028 | - ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR), | ||
1029 | - !!(rdes0 & RDES0_FRAME_TYPE), | ||
1030 | - !!(rdes0 & ERDES0_RX_MAC_ADDR)); | ||
1031 | + if (likely(ret == good_frame)) | ||
1032 | + ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR), | ||
1033 | + !!(rdes0 & RDES0_FRAME_TYPE), | ||
1034 | + !!(rdes0 & ERDES0_RX_MAC_ADDR)); | ||
1035 | |||
1036 | if (unlikely(rdes0 & RDES0_DRIBBLING)) | ||
1037 | x->dribbling_bit++; | ||
1038 | diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c | ||
1039 | index fd78406e2e9a..01f8f2e94c0f 100644 | ||
1040 | --- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c | ||
1041 | +++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c | ||
1042 | @@ -95,8 +95,6 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x, | ||
1043 | return dma_own; | ||
1044 | |||
1045 | if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) { | ||
1046 | - pr_warn("%s: Oversized frame spanned multiple buffers\n", | ||
1047 | - __func__); | ||
1048 | stats->rx_length_errors++; | ||
1049 | return discard_frame; | ||
1050 | } | ||
1051 | diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c | ||
1052 | index 520352327104..77357b07f6c9 100644 | ||
1053 | --- a/drivers/net/phy/marvell.c | ||
1054 | +++ b/drivers/net/phy/marvell.c | ||
1055 | @@ -1429,9 +1429,10 @@ static int marvell_get_sset_count(struct phy_device *phydev) | ||
1056 | |||
1057 | static void marvell_get_strings(struct phy_device *phydev, u8 *data) | ||
1058 | { | ||
1059 | + int count = marvell_get_sset_count(phydev); | ||
1060 | int i; | ||
1061 | |||
1062 | - for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) { | ||
1063 | + for (i = 0; i < count; i++) { | ||
1064 | memcpy(data + i * ETH_GSTRING_LEN, | ||
1065 | marvell_hw_stats[i].string, ETH_GSTRING_LEN); | ||
1066 | } | ||
1067 | @@ -1470,9 +1471,10 @@ static u64 marvell_get_stat(struct phy_device *phydev, int i) | ||
1068 | static void marvell_get_stats(struct phy_device *phydev, | ||
1069 | struct ethtool_stats *stats, u64 *data) | ||
1070 | { | ||
1071 | + int count = marvell_get_sset_count(phydev); | ||
1072 | int i; | ||
1073 | |||
1074 | - for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) | ||
1075 | + for (i = 0; i < count; i++) | ||
1076 | data[i] = marvell_get_stat(phydev, i); | ||
1077 | } | ||
1078 | |||
1079 | diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c | ||
1080 | index f12753eb3216..96ea6c76be6e 100644 | ||
1081 | --- a/drivers/nvme/target/core.c | ||
1082 | +++ b/drivers/nvme/target/core.c | ||
1083 | @@ -709,6 +709,15 @@ bool nvmet_host_allowed(struct nvmet_req *req, struct nvmet_subsys *subsys, | ||
1084 | return __nvmet_host_allowed(subsys, hostnqn); | ||
1085 | } | ||
1086 | |||
1087 | +static void nvmet_fatal_error_handler(struct work_struct *work) | ||
1088 | +{ | ||
1089 | + struct nvmet_ctrl *ctrl = | ||
1090 | + container_of(work, struct nvmet_ctrl, fatal_err_work); | ||
1091 | + | ||
1092 | + pr_err("ctrl %d fatal error occurred!\n", ctrl->cntlid); | ||
1093 | + ctrl->ops->delete_ctrl(ctrl); | ||
1094 | +} | ||
1095 | + | ||
1096 | u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, | ||
1097 | struct nvmet_req *req, u32 kato, struct nvmet_ctrl **ctrlp) | ||
1098 | { | ||
1099 | @@ -747,6 +756,7 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, | ||
1100 | |||
1101 | INIT_WORK(&ctrl->async_event_work, nvmet_async_event_work); | ||
1102 | INIT_LIST_HEAD(&ctrl->async_events); | ||
1103 | + INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler); | ||
1104 | |||
1105 | memcpy(ctrl->subsysnqn, subsysnqn, NVMF_NQN_SIZE); | ||
1106 | memcpy(ctrl->hostnqn, hostnqn, NVMF_NQN_SIZE); | ||
1107 | @@ -849,21 +859,11 @@ void nvmet_ctrl_put(struct nvmet_ctrl *ctrl) | ||
1108 | kref_put(&ctrl->ref, nvmet_ctrl_free); | ||
1109 | } | ||
1110 | |||
1111 | -static void nvmet_fatal_error_handler(struct work_struct *work) | ||
1112 | -{ | ||
1113 | - struct nvmet_ctrl *ctrl = | ||
1114 | - container_of(work, struct nvmet_ctrl, fatal_err_work); | ||
1115 | - | ||
1116 | - pr_err("ctrl %d fatal error occurred!\n", ctrl->cntlid); | ||
1117 | - ctrl->ops->delete_ctrl(ctrl); | ||
1118 | -} | ||
1119 | - | ||
1120 | void nvmet_ctrl_fatal_error(struct nvmet_ctrl *ctrl) | ||
1121 | { | ||
1122 | mutex_lock(&ctrl->lock); | ||
1123 | if (!(ctrl->csts & NVME_CSTS_CFS)) { | ||
1124 | ctrl->csts |= NVME_CSTS_CFS; | ||
1125 | - INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler); | ||
1126 | schedule_work(&ctrl->fatal_err_work); | ||
1127 | } | ||
1128 | mutex_unlock(&ctrl->lock); | ||
1129 | diff --git a/drivers/rtc/rtc-da9063.c b/drivers/rtc/rtc-da9063.c | ||
1130 | index f85cae240f12..7e92e491c2e7 100644 | ||
1131 | --- a/drivers/rtc/rtc-da9063.c | ||
1132 | +++ b/drivers/rtc/rtc-da9063.c | ||
1133 | @@ -480,6 +480,13 @@ static int da9063_rtc_probe(struct platform_device *pdev) | ||
1134 | da9063_data_to_tm(data, &rtc->alarm_time, rtc); | ||
1135 | rtc->rtc_sync = false; | ||
1136 | |||
1137 | + /* | ||
1138 | + * TODO: some models have alarms on a minute boundary but still support | ||
1139 | + * real hardware interrupts. Add this once the core supports it. | ||
1140 | + */ | ||
1141 | + if (config->rtc_data_start != RTC_SEC) | ||
1142 | + rtc->rtc_dev->uie_unsupported = 1; | ||
1143 | + | ||
1144 | irq_alarm = platform_get_irq_byname(pdev, "ALARM"); | ||
1145 | ret = devm_request_threaded_irq(&pdev->dev, irq_alarm, NULL, | ||
1146 | da9063_alarm_event, | ||
1147 | diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c | ||
1148 | index 17b6235d67a5..600fb7f93939 100644 | ||
1149 | --- a/drivers/rtc/rtc-sh.c | ||
1150 | +++ b/drivers/rtc/rtc-sh.c | ||
1151 | @@ -454,7 +454,7 @@ static int sh_rtc_set_time(struct device *dev, struct rtc_time *tm) | ||
1152 | static inline int sh_rtc_read_alarm_value(struct sh_rtc *rtc, int reg_off) | ||
1153 | { | ||
1154 | unsigned int byte; | ||
1155 | - int value = 0xff; /* return 0xff for ignored values */ | ||
1156 | + int value = -1; /* return -1 for ignored values */ | ||
1157 | |||
1158 | byte = readb(rtc->regbase + reg_off); | ||
1159 | if (byte & AR_ENB) { | ||
1160 | diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c | ||
1161 | index 282ea00d0f87..9d555b63d2e2 100644 | ||
1162 | --- a/drivers/scsi/scsi_devinfo.c | ||
1163 | +++ b/drivers/scsi/scsi_devinfo.c | ||
1164 | @@ -249,6 +249,7 @@ static struct { | ||
1165 | {"NETAPP", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, | ||
1166 | {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, | ||
1167 | {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, | ||
1168 | + {"LENOVO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, | ||
1169 | {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36}, | ||
1170 | {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN}, | ||
1171 | {"SONY", "TSL", NULL, BLIST_FORCELUN}, /* DDS3 & DDS4 autoloaders */ | ||
1172 | diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c | ||
1173 | index 375cede0c534..c9bc6f058424 100644 | ||
1174 | --- a/drivers/scsi/scsi_dh.c | ||
1175 | +++ b/drivers/scsi/scsi_dh.c | ||
1176 | @@ -75,6 +75,7 @@ static const struct scsi_dh_blist scsi_dh_blist[] = { | ||
1177 | {"NETAPP", "INF-01-00", "rdac", }, | ||
1178 | {"LSI", "INF-01-00", "rdac", }, | ||
1179 | {"ENGENIO", "INF-01-00", "rdac", }, | ||
1180 | + {"LENOVO", "DE_Series", "rdac", }, | ||
1181 | {NULL, NULL, NULL }, | ||
1182 | }; | ||
1183 | |||
1184 | diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c | ||
1185 | index d92b2808d191..6df34d68737f 100644 | ||
1186 | --- a/drivers/scsi/storvsc_drv.c | ||
1187 | +++ b/drivers/scsi/storvsc_drv.c | ||
1188 | @@ -641,13 +641,22 @@ static void handle_sc_creation(struct vmbus_channel *new_sc) | ||
1189 | static void handle_multichannel_storage(struct hv_device *device, int max_chns) | ||
1190 | { | ||
1191 | struct storvsc_device *stor_device; | ||
1192 | - int num_cpus = num_online_cpus(); | ||
1193 | int num_sc; | ||
1194 | struct storvsc_cmd_request *request; | ||
1195 | struct vstor_packet *vstor_packet; | ||
1196 | int ret, t; | ||
1197 | |||
1198 | - num_sc = ((max_chns > num_cpus) ? num_cpus : max_chns); | ||
1199 | + /* | ||
1200 | + * If the number of CPUs is artificially restricted, such as | ||
1201 | + * with maxcpus=1 on the kernel boot line, Hyper-V could offer | ||
1202 | + * sub-channels >= the number of CPUs. These sub-channels | ||
1203 | + * should not be created. The primary channel is already created | ||
1204 | + * and assigned to one CPU, so check against # CPUs - 1. | ||
1205 | + */ | ||
1206 | + num_sc = min((int)(num_online_cpus() - 1), max_chns); | ||
1207 | + if (!num_sc) | ||
1208 | + return; | ||
1209 | + | ||
1210 | stor_device = get_out_stor_device(device); | ||
1211 | if (!stor_device) | ||
1212 | return; | ||
1213 | diff --git a/drivers/staging/iio/addac/adt7316.c b/drivers/staging/iio/addac/adt7316.c | ||
1214 | index 3faffe59c933..95f5be1cd498 100644 | ||
1215 | --- a/drivers/staging/iio/addac/adt7316.c | ||
1216 | +++ b/drivers/staging/iio/addac/adt7316.c | ||
1217 | @@ -47,6 +47,8 @@ | ||
1218 | #define ADT7516_MSB_AIN3 0xA | ||
1219 | #define ADT7516_MSB_AIN4 0xB | ||
1220 | #define ADT7316_DA_DATA_BASE 0x10 | ||
1221 | +#define ADT7316_DA_10_BIT_LSB_SHIFT 6 | ||
1222 | +#define ADT7316_DA_12_BIT_LSB_SHIFT 4 | ||
1223 | #define ADT7316_DA_MSB_DATA_REGS 4 | ||
1224 | #define ADT7316_LSB_DAC_A 0x10 | ||
1225 | #define ADT7316_MSB_DAC_A 0x11 | ||
1226 | @@ -1089,7 +1091,7 @@ static ssize_t adt7316_store_DAC_internal_Vref(struct device *dev, | ||
1227 | ldac_config = chip->ldac_config & (~ADT7516_DAC_IN_VREF_MASK); | ||
1228 | if (data & 0x1) | ||
1229 | ldac_config |= ADT7516_DAC_AB_IN_VREF; | ||
1230 | - else if (data & 0x2) | ||
1231 | + if (data & 0x2) | ||
1232 | ldac_config |= ADT7516_DAC_CD_IN_VREF; | ||
1233 | } else { | ||
1234 | ret = kstrtou8(buf, 16, &data); | ||
1235 | @@ -1411,7 +1413,7 @@ static IIO_DEVICE_ATTR(ex_analog_temp_offset, S_IRUGO | S_IWUSR, | ||
1236 | static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, | ||
1237 | int channel, char *buf) | ||
1238 | { | ||
1239 | - u16 data; | ||
1240 | + u16 data = 0; | ||
1241 | u8 msb, lsb, offset; | ||
1242 | int ret; | ||
1243 | |||
1244 | @@ -1436,7 +1438,11 @@ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, | ||
1245 | if (ret) | ||
1246 | return -EIO; | ||
1247 | |||
1248 | - data = (msb << offset) + (lsb & ((1 << offset) - 1)); | ||
1249 | + if (chip->dac_bits == 12) | ||
1250 | + data = lsb >> ADT7316_DA_12_BIT_LSB_SHIFT; | ||
1251 | + else if (chip->dac_bits == 10) | ||
1252 | + data = lsb >> ADT7316_DA_10_BIT_LSB_SHIFT; | ||
1253 | + data |= msb << offset; | ||
1254 | |||
1255 | return sprintf(buf, "%d\n", data); | ||
1256 | } | ||
1257 | @@ -1444,7 +1450,7 @@ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, | ||
1258 | static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip, | ||
1259 | int channel, const char *buf, size_t len) | ||
1260 | { | ||
1261 | - u8 msb, lsb, offset; | ||
1262 | + u8 msb, lsb, lsb_reg, offset; | ||
1263 | u16 data; | ||
1264 | int ret; | ||
1265 | |||
1266 | @@ -1462,9 +1468,13 @@ static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip, | ||
1267 | return -EINVAL; | ||
1268 | |||
1269 | if (chip->dac_bits > 8) { | ||
1270 | - lsb = data & (1 << offset); | ||
1271 | + lsb = data & ((1 << offset) - 1); | ||
1272 | + if (chip->dac_bits == 12) | ||
1273 | + lsb_reg = lsb << ADT7316_DA_12_BIT_LSB_SHIFT; | ||
1274 | + else | ||
1275 | + lsb_reg = lsb << ADT7316_DA_10_BIT_LSB_SHIFT; | ||
1276 | ret = chip->bus.write(chip->bus.client, | ||
1277 | - ADT7316_DA_DATA_BASE + channel * 2, lsb); | ||
1278 | + ADT7316_DA_DATA_BASE + channel * 2, lsb_reg); | ||
1279 | if (ret) | ||
1280 | return -EIO; | ||
1281 | } | ||
1282 | diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c | ||
1283 | index c17b254e4f64..654199c6a36c 100644 | ||
1284 | --- a/drivers/usb/core/driver.c | ||
1285 | +++ b/drivers/usb/core/driver.c | ||
1286 | @@ -470,11 +470,6 @@ static int usb_unbind_interface(struct device *dev) | ||
1287 | pm_runtime_disable(dev); | ||
1288 | pm_runtime_set_suspended(dev); | ||
1289 | |||
1290 | - /* Undo any residual pm_autopm_get_interface_* calls */ | ||
1291 | - for (r = atomic_read(&intf->pm_usage_cnt); r > 0; --r) | ||
1292 | - usb_autopm_put_interface_no_suspend(intf); | ||
1293 | - atomic_set(&intf->pm_usage_cnt, 0); | ||
1294 | - | ||
1295 | if (!error) | ||
1296 | usb_autosuspend_device(udev); | ||
1297 | |||
1298 | @@ -1625,7 +1620,6 @@ void usb_autopm_put_interface(struct usb_interface *intf) | ||
1299 | int status; | ||
1300 | |||
1301 | usb_mark_last_busy(udev); | ||
1302 | - atomic_dec(&intf->pm_usage_cnt); | ||
1303 | status = pm_runtime_put_sync(&intf->dev); | ||
1304 | dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n", | ||
1305 | __func__, atomic_read(&intf->dev.power.usage_count), | ||
1306 | @@ -1654,7 +1648,6 @@ void usb_autopm_put_interface_async(struct usb_interface *intf) | ||
1307 | int status; | ||
1308 | |||
1309 | usb_mark_last_busy(udev); | ||
1310 | - atomic_dec(&intf->pm_usage_cnt); | ||
1311 | status = pm_runtime_put(&intf->dev); | ||
1312 | dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n", | ||
1313 | __func__, atomic_read(&intf->dev.power.usage_count), | ||
1314 | @@ -1676,7 +1669,6 @@ void usb_autopm_put_interface_no_suspend(struct usb_interface *intf) | ||
1315 | struct usb_device *udev = interface_to_usbdev(intf); | ||
1316 | |||
1317 | usb_mark_last_busy(udev); | ||
1318 | - atomic_dec(&intf->pm_usage_cnt); | ||
1319 | pm_runtime_put_noidle(&intf->dev); | ||
1320 | } | ||
1321 | EXPORT_SYMBOL_GPL(usb_autopm_put_interface_no_suspend); | ||
1322 | @@ -1707,8 +1699,6 @@ int usb_autopm_get_interface(struct usb_interface *intf) | ||
1323 | status = pm_runtime_get_sync(&intf->dev); | ||
1324 | if (status < 0) | ||
1325 | pm_runtime_put_sync(&intf->dev); | ||
1326 | - else | ||
1327 | - atomic_inc(&intf->pm_usage_cnt); | ||
1328 | dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n", | ||
1329 | __func__, atomic_read(&intf->dev.power.usage_count), | ||
1330 | status); | ||
1331 | @@ -1742,8 +1732,6 @@ int usb_autopm_get_interface_async(struct usb_interface *intf) | ||
1332 | status = pm_runtime_get(&intf->dev); | ||
1333 | if (status < 0 && status != -EINPROGRESS) | ||
1334 | pm_runtime_put_noidle(&intf->dev); | ||
1335 | - else | ||
1336 | - atomic_inc(&intf->pm_usage_cnt); | ||
1337 | dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n", | ||
1338 | __func__, atomic_read(&intf->dev.power.usage_count), | ||
1339 | status); | ||
1340 | @@ -1767,7 +1755,6 @@ void usb_autopm_get_interface_no_resume(struct usb_interface *intf) | ||
1341 | struct usb_device *udev = interface_to_usbdev(intf); | ||
1342 | |||
1343 | usb_mark_last_busy(udev); | ||
1344 | - atomic_inc(&intf->pm_usage_cnt); | ||
1345 | pm_runtime_get_noresume(&intf->dev); | ||
1346 | } | ||
1347 | EXPORT_SYMBOL_GPL(usb_autopm_get_interface_no_resume); | ||
1348 | diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c | ||
1349 | index 0e6ab0a17c08..955cd6552e95 100644 | ||
1350 | --- a/drivers/usb/core/message.c | ||
1351 | +++ b/drivers/usb/core/message.c | ||
1352 | @@ -817,9 +817,11 @@ int usb_string(struct usb_device *dev, int index, char *buf, size_t size) | ||
1353 | |||
1354 | if (dev->state == USB_STATE_SUSPENDED) | ||
1355 | return -EHOSTUNREACH; | ||
1356 | - if (size <= 0 || !buf || !index) | ||
1357 | + if (size <= 0 || !buf) | ||
1358 | return -EINVAL; | ||
1359 | buf[0] = 0; | ||
1360 | + if (index <= 0 || index >= 256) | ||
1361 | + return -EINVAL; | ||
1362 | tbuf = kmalloc(256, GFP_NOIO); | ||
1363 | if (!tbuf) | ||
1364 | return -ENOMEM; | ||
1365 | diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c | ||
1366 | index 1e672343bcd6..efa3c86bd262 100644 | ||
1367 | --- a/drivers/usb/misc/yurex.c | ||
1368 | +++ b/drivers/usb/misc/yurex.c | ||
1369 | @@ -324,6 +324,7 @@ static void yurex_disconnect(struct usb_interface *interface) | ||
1370 | usb_deregister_dev(interface, &yurex_class); | ||
1371 | |||
1372 | /* prevent more I/O from starting */ | ||
1373 | + usb_poison_urb(dev->urb); | ||
1374 | mutex_lock(&dev->io_mutex); | ||
1375 | dev->interface = NULL; | ||
1376 | mutex_unlock(&dev->io_mutex); | ||
1377 | diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c | ||
1378 | index 4176d1af9bf2..fac3447021b2 100644 | ||
1379 | --- a/drivers/usb/storage/realtek_cr.c | ||
1380 | +++ b/drivers/usb/storage/realtek_cr.c | ||
1381 | @@ -776,18 +776,16 @@ static void rts51x_suspend_timer_fn(unsigned long data) | ||
1382 | break; | ||
1383 | case RTS51X_STAT_IDLE: | ||
1384 | case RTS51X_STAT_SS: | ||
1385 | - usb_stor_dbg(us, "RTS51X_STAT_SS, intf->pm_usage_cnt:%d, power.usage:%d\n", | ||
1386 | - atomic_read(&us->pusb_intf->pm_usage_cnt), | ||
1387 | + usb_stor_dbg(us, "RTS51X_STAT_SS, power.usage:%d\n", | ||
1388 | atomic_read(&us->pusb_intf->dev.power.usage_count)); | ||
1389 | |||
1390 | - if (atomic_read(&us->pusb_intf->pm_usage_cnt) > 0) { | ||
1391 | + if (atomic_read(&us->pusb_intf->dev.power.usage_count) > 0) { | ||
1392 | usb_stor_dbg(us, "Ready to enter SS state\n"); | ||
1393 | rts51x_set_stat(chip, RTS51X_STAT_SS); | ||
1394 | /* ignore mass storage interface's children */ | ||
1395 | pm_suspend_ignore_children(&us->pusb_intf->dev, true); | ||
1396 | usb_autopm_put_interface_async(us->pusb_intf); | ||
1397 | - usb_stor_dbg(us, "RTS51X_STAT_SS 01, intf->pm_usage_cnt:%d, power.usage:%d\n", | ||
1398 | - atomic_read(&us->pusb_intf->pm_usage_cnt), | ||
1399 | + usb_stor_dbg(us, "RTS51X_STAT_SS 01, power.usage:%d\n", | ||
1400 | atomic_read(&us->pusb_intf->dev.power.usage_count)); | ||
1401 | } | ||
1402 | break; | ||
1403 | @@ -820,11 +818,10 @@ static void rts51x_invoke_transport(struct scsi_cmnd *srb, struct us_data *us) | ||
1404 | int ret; | ||
1405 | |||
1406 | if (working_scsi(srb)) { | ||
1407 | - usb_stor_dbg(us, "working scsi, intf->pm_usage_cnt:%d, power.usage:%d\n", | ||
1408 | - atomic_read(&us->pusb_intf->pm_usage_cnt), | ||
1409 | + usb_stor_dbg(us, "working scsi, power.usage:%d\n", | ||
1410 | atomic_read(&us->pusb_intf->dev.power.usage_count)); | ||
1411 | |||
1412 | - if (atomic_read(&us->pusb_intf->pm_usage_cnt) <= 0) { | ||
1413 | + if (atomic_read(&us->pusb_intf->dev.power.usage_count) <= 0) { | ||
1414 | ret = usb_autopm_get_interface(us->pusb_intf); | ||
1415 | usb_stor_dbg(us, "working scsi, ret=%d\n", ret); | ||
1416 | } | ||
1417 | diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c | ||
1418 | index 5b807185f79e..777a4058c407 100644 | ||
1419 | --- a/drivers/usb/usbip/stub_rx.c | ||
1420 | +++ b/drivers/usb/usbip/stub_rx.c | ||
1421 | @@ -383,16 +383,10 @@ static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu) | ||
1422 | } | ||
1423 | |||
1424 | if (usb_endpoint_xfer_isoc(epd)) { | ||
1425 | - /* validate packet size and number of packets */ | ||
1426 | - unsigned int maxp, packets, bytes; | ||
1427 | - | ||
1428 | - maxp = usb_endpoint_maxp(epd); | ||
1429 | - maxp *= usb_endpoint_maxp_mult(epd); | ||
1430 | - bytes = pdu->u.cmd_submit.transfer_buffer_length; | ||
1431 | - packets = DIV_ROUND_UP(bytes, maxp); | ||
1432 | - | ||
1433 | + /* validate number of packets */ | ||
1434 | if (pdu->u.cmd_submit.number_of_packets < 0 || | ||
1435 | - pdu->u.cmd_submit.number_of_packets > packets) { | ||
1436 | + pdu->u.cmd_submit.number_of_packets > | ||
1437 | + USBIP_MAX_ISO_PACKETS) { | ||
1438 | dev_err(&sdev->udev->dev, | ||
1439 | "CMD_SUBMIT: isoc invalid num packets %d\n", | ||
1440 | pdu->u.cmd_submit.number_of_packets); | ||
1441 | diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h | ||
1442 | index 109e65ba01a0..0b199a2664c0 100644 | ||
1443 | --- a/drivers/usb/usbip/usbip_common.h | ||
1444 | +++ b/drivers/usb/usbip/usbip_common.h | ||
1445 | @@ -136,6 +136,13 @@ extern struct device_attribute dev_attr_usbip_debug; | ||
1446 | #define USBIP_DIR_OUT 0x00 | ||
1447 | #define USBIP_DIR_IN 0x01 | ||
1448 | |||
1449 | +/* | ||
1450 | + * Arbitrary limit for the maximum number of isochronous packets in an URB, | ||
1451 | + * compare for example the uhci_submit_isochronous function in | ||
1452 | + * drivers/usb/host/uhci-q.c | ||
1453 | + */ | ||
1454 | +#define USBIP_MAX_ISO_PACKETS 1024 | ||
1455 | + | ||
1456 | /** | ||
1457 | * struct usbip_header_basic - data pertinent to every request | ||
1458 | * @command: the usbip request type | ||
1459 | diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c | ||
1460 | index 7338e43faa17..f9a75df2d22d 100644 | ||
1461 | --- a/drivers/vfio/pci/vfio_pci.c | ||
1462 | +++ b/drivers/vfio/pci/vfio_pci.c | ||
1463 | @@ -1467,11 +1467,11 @@ static void __init vfio_pci_fill_ids(void) | ||
1464 | rc = pci_add_dynid(&vfio_pci_driver, vendor, device, | ||
1465 | subvendor, subdevice, class, class_mask, 0); | ||
1466 | if (rc) | ||
1467 | - pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n", | ||
1468 | + pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n", | ||
1469 | vendor, device, subvendor, subdevice, | ||
1470 | class, class_mask, rc); | ||
1471 | else | ||
1472 | - pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n", | ||
1473 | + pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n", | ||
1474 | vendor, device, subvendor, subdevice, | ||
1475 | class, class_mask); | ||
1476 | } | ||
1477 | diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c | ||
1478 | index 59d74d1b47a8..2287e1be0e55 100644 | ||
1479 | --- a/drivers/w1/masters/ds2490.c | ||
1480 | +++ b/drivers/w1/masters/ds2490.c | ||
1481 | @@ -1039,15 +1039,15 @@ static int ds_probe(struct usb_interface *intf, | ||
1482 | /* alternative 3, 1ms interrupt (greatly speeds search), 64 byte bulk */ | ||
1483 | alt = 3; | ||
1484 | err = usb_set_interface(dev->udev, | ||
1485 | - intf->altsetting[alt].desc.bInterfaceNumber, alt); | ||
1486 | + intf->cur_altsetting->desc.bInterfaceNumber, alt); | ||
1487 | if (err) { | ||
1488 | dev_err(&dev->udev->dev, "Failed to set alternative setting %d " | ||
1489 | "for %d interface: err=%d.\n", alt, | ||
1490 | - intf->altsetting[alt].desc.bInterfaceNumber, err); | ||
1491 | + intf->cur_altsetting->desc.bInterfaceNumber, err); | ||
1492 | goto err_out_clear; | ||
1493 | } | ||
1494 | |||
1495 | - iface_desc = &intf->altsetting[alt]; | ||
1496 | + iface_desc = intf->cur_altsetting; | ||
1497 | if (iface_desc->desc.bNumEndpoints != NUM_EP-1) { | ||
1498 | pr_info("Num endpoints=%d. It is not DS9490R.\n", | ||
1499 | iface_desc->desc.bNumEndpoints); | ||
1500 | diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c | ||
1501 | index 77e9cd7a0137..20ee612017bf 100644 | ||
1502 | --- a/fs/debugfs/inode.c | ||
1503 | +++ b/fs/debugfs/inode.c | ||
1504 | @@ -170,19 +170,24 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root) | ||
1505 | return 0; | ||
1506 | } | ||
1507 | |||
1508 | -static void debugfs_evict_inode(struct inode *inode) | ||
1509 | +static void debugfs_i_callback(struct rcu_head *head) | ||
1510 | { | ||
1511 | - truncate_inode_pages_final(&inode->i_data); | ||
1512 | - clear_inode(inode); | ||
1513 | + struct inode *inode = container_of(head, struct inode, i_rcu); | ||
1514 | if (S_ISLNK(inode->i_mode)) | ||
1515 | kfree(inode->i_link); | ||
1516 | + free_inode_nonrcu(inode); | ||
1517 | +} | ||
1518 | + | ||
1519 | +static void debugfs_destroy_inode(struct inode *inode) | ||
1520 | +{ | ||
1521 | + call_rcu(&inode->i_rcu, debugfs_i_callback); | ||
1522 | } | ||
1523 | |||
1524 | static const struct super_operations debugfs_super_operations = { | ||
1525 | .statfs = simple_statfs, | ||
1526 | .remount_fs = debugfs_remount, | ||
1527 | .show_options = debugfs_show_options, | ||
1528 | - .evict_inode = debugfs_evict_inode, | ||
1529 | + .destroy_inode = debugfs_destroy_inode, | ||
1530 | }; | ||
1531 | |||
1532 | static struct vfsmount *debugfs_automount(struct path *path) | ||
1533 | diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c | ||
1534 | index 001487b230b5..4acc677ac8fb 100644 | ||
1535 | --- a/fs/hugetlbfs/inode.c | ||
1536 | +++ b/fs/hugetlbfs/inode.c | ||
1537 | @@ -746,11 +746,17 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb, | ||
1538 | umode_t mode, dev_t dev) | ||
1539 | { | ||
1540 | struct inode *inode; | ||
1541 | - struct resv_map *resv_map; | ||
1542 | + struct resv_map *resv_map = NULL; | ||
1543 | |||
1544 | - resv_map = resv_map_alloc(); | ||
1545 | - if (!resv_map) | ||
1546 | - return NULL; | ||
1547 | + /* | ||
1548 | + * Reserve maps are only needed for inodes that can have associated | ||
1549 | + * page allocations. | ||
1550 | + */ | ||
1551 | + if (S_ISREG(mode) || S_ISLNK(mode)) { | ||
1552 | + resv_map = resv_map_alloc(); | ||
1553 | + if (!resv_map) | ||
1554 | + return NULL; | ||
1555 | + } | ||
1556 | |||
1557 | inode = new_inode(sb); | ||
1558 | if (inode) { | ||
1559 | @@ -782,8 +788,10 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb, | ||
1560 | break; | ||
1561 | } | ||
1562 | lockdep_annotate_inode_mutex_key(inode); | ||
1563 | - } else | ||
1564 | - kref_put(&resv_map->refs, resv_map_release); | ||
1565 | + } else { | ||
1566 | + if (resv_map) | ||
1567 | + kref_put(&resv_map->refs, resv_map_release); | ||
1568 | + } | ||
1569 | |||
1570 | return inode; | ||
1571 | } | ||
1572 | diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c | ||
1573 | index 06a71dbd4833..2f236cca6095 100644 | ||
1574 | --- a/fs/jffs2/readinode.c | ||
1575 | +++ b/fs/jffs2/readinode.c | ||
1576 | @@ -1414,11 +1414,6 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f) | ||
1577 | |||
1578 | jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL); | ||
1579 | |||
1580 | - if (f->target) { | ||
1581 | - kfree(f->target); | ||
1582 | - f->target = NULL; | ||
1583 | - } | ||
1584 | - | ||
1585 | fds = f->dents; | ||
1586 | while(fds) { | ||
1587 | fd = fds; | ||
1588 | diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c | ||
1589 | index 226640563df3..76aedbc97773 100644 | ||
1590 | --- a/fs/jffs2/super.c | ||
1591 | +++ b/fs/jffs2/super.c | ||
1592 | @@ -47,7 +47,10 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb) | ||
1593 | static void jffs2_i_callback(struct rcu_head *head) | ||
1594 | { | ||
1595 | struct inode *inode = container_of(head, struct inode, i_rcu); | ||
1596 | - kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode)); | ||
1597 | + struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode); | ||
1598 | + | ||
1599 | + kfree(f->target); | ||
1600 | + kmem_cache_free(jffs2_inode_cachep, f); | ||
1601 | } | ||
1602 | |||
1603 | static void jffs2_destroy_inode(struct inode *inode) | ||
1604 | diff --git a/include/linux/kasan.h b/include/linux/kasan.h | ||
1605 | index 820c0ad54a01..c9df9e180610 100644 | ||
1606 | --- a/include/linux/kasan.h | ||
1607 | +++ b/include/linux/kasan.h | ||
1608 | @@ -7,6 +7,7 @@ | ||
1609 | struct kmem_cache; | ||
1610 | struct page; | ||
1611 | struct vm_struct; | ||
1612 | +struct task_struct; | ||
1613 | |||
1614 | #ifdef CONFIG_KASAN | ||
1615 | |||
1616 | diff --git a/include/linux/usb.h b/include/linux/usb.h | ||
1617 | index 346665a0c49d..9b5ca59271d9 100644 | ||
1618 | --- a/include/linux/usb.h | ||
1619 | +++ b/include/linux/usb.h | ||
1620 | @@ -129,7 +129,6 @@ enum usb_interface_condition { | ||
1621 | * @dev: driver model's view of this device | ||
1622 | * @usb_dev: if an interface is bound to the USB major, this will point | ||
1623 | * to the sysfs representation for that device. | ||
1624 | - * @pm_usage_cnt: PM usage counter for this interface | ||
1625 | * @reset_ws: Used for scheduling resets from atomic context. | ||
1626 | * @resetting_device: USB core reset the device, so use alt setting 0 as | ||
1627 | * current; needs bandwidth alloc after reset. | ||
1628 | @@ -186,7 +185,6 @@ struct usb_interface { | ||
1629 | |||
1630 | struct device dev; /* interface specific device info */ | ||
1631 | struct device *usb_dev; | ||
1632 | - atomic_t pm_usage_cnt; /* usage counter for autosuspend */ | ||
1633 | struct work_struct reset_ws; /* for resets in atomic context */ | ||
1634 | }; | ||
1635 | #define to_usb_interface(d) container_of(d, struct usb_interface, dev) | ||
1636 | diff --git a/include/net/caif/cfpkt.h b/include/net/caif/cfpkt.h | ||
1637 | index fe328c52c46b..801489bb14c3 100644 | ||
1638 | --- a/include/net/caif/cfpkt.h | ||
1639 | +++ b/include/net/caif/cfpkt.h | ||
1640 | @@ -32,6 +32,33 @@ void cfpkt_destroy(struct cfpkt *pkt); | ||
1641 | */ | ||
1642 | int cfpkt_extr_head(struct cfpkt *pkt, void *data, u16 len); | ||
1643 | |||
1644 | +static inline u8 cfpkt_extr_head_u8(struct cfpkt *pkt) | ||
1645 | +{ | ||
1646 | + u8 tmp; | ||
1647 | + | ||
1648 | + cfpkt_extr_head(pkt, &tmp, 1); | ||
1649 | + | ||
1650 | + return tmp; | ||
1651 | +} | ||
1652 | + | ||
1653 | +static inline u16 cfpkt_extr_head_u16(struct cfpkt *pkt) | ||
1654 | +{ | ||
1655 | + __le16 tmp; | ||
1656 | + | ||
1657 | + cfpkt_extr_head(pkt, &tmp, 2); | ||
1658 | + | ||
1659 | + return le16_to_cpu(tmp); | ||
1660 | +} | ||
1661 | + | ||
1662 | +static inline u32 cfpkt_extr_head_u32(struct cfpkt *pkt) | ||
1663 | +{ | ||
1664 | + __le32 tmp; | ||
1665 | + | ||
1666 | + cfpkt_extr_head(pkt, &tmp, 4); | ||
1667 | + | ||
1668 | + return le32_to_cpu(tmp); | ||
1669 | +} | ||
1670 | + | ||
1671 | /* | ||
1672 | * Peek header from packet. | ||
1673 | * Reads data from packet without changing packet. | ||
1674 | diff --git a/lib/Makefile b/lib/Makefile | ||
1675 | index 50144a3aeebd..2447a218fff8 100644 | ||
1676 | --- a/lib/Makefile | ||
1677 | +++ b/lib/Makefile | ||
1678 | @@ -46,6 +46,7 @@ obj-$(CONFIG_TEST_BPF) += test_bpf.o | ||
1679 | obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o | ||
1680 | obj-$(CONFIG_TEST_HASH) += test_hash.o | ||
1681 | obj-$(CONFIG_TEST_KASAN) += test_kasan.o | ||
1682 | +CFLAGS_test_kasan.o += -fno-builtin | ||
1683 | obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o | ||
1684 | obj-$(CONFIG_TEST_LKM) += test_module.o | ||
1685 | obj-$(CONFIG_TEST_RHASHTABLE) += test_rhashtable.o | ||
1686 | diff --git a/lib/test_kasan.c b/lib/test_kasan.c | ||
1687 | index fbdf87920093..4ba4cbe169a8 100644 | ||
1688 | --- a/lib/test_kasan.c | ||
1689 | +++ b/lib/test_kasan.c | ||
1690 | @@ -355,7 +355,7 @@ static noinline void __init kasan_stack_oob(void) | ||
1691 | static noinline void __init ksize_unpoisons_memory(void) | ||
1692 | { | ||
1693 | char *ptr; | ||
1694 | - size_t size = 123, real_size = size; | ||
1695 | + size_t size = 123, real_size; | ||
1696 | |||
1697 | pr_info("ksize() unpoisons the whole allocated chunk\n"); | ||
1698 | ptr = kmalloc(size, GFP_KERNEL); | ||
1699 | diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c | ||
1700 | index 4ce386c44cf1..1169c1fe941f 100644 | ||
1701 | --- a/mm/kasan/kasan.c | ||
1702 | +++ b/mm/kasan/kasan.c | ||
1703 | @@ -80,7 +80,14 @@ void kasan_unpoison_task_stack(struct task_struct *task) | ||
1704 | /* Unpoison the stack for the current task beyond a watermark sp value. */ | ||
1705 | asmlinkage void kasan_unpoison_task_stack_below(const void *watermark) | ||
1706 | { | ||
1707 | - __kasan_unpoison_stack(current, watermark); | ||
1708 | + /* | ||
1709 | + * Calculate the task stack base address. Avoid using 'current' | ||
1710 | + * because this function is called by early resume code which hasn't | ||
1711 | + * yet set up the percpu register (%gs). | ||
1712 | + */ | ||
1713 | + void *base = (void *)((unsigned long)watermark & ~(THREAD_SIZE - 1)); | ||
1714 | + | ||
1715 | + kasan_unpoison_shadow(base, watermark - base); | ||
1716 | } | ||
1717 | |||
1718 | /* | ||
1719 | diff --git a/mm/kasan/kasan_init.c b/mm/kasan/kasan_init.c | ||
1720 | index 3f9a41cf0ac6..31238dad85fb 100644 | ||
1721 | --- a/mm/kasan/kasan_init.c | ||
1722 | +++ b/mm/kasan/kasan_init.c | ||
1723 | @@ -15,6 +15,7 @@ | ||
1724 | #include <linux/kasan.h> | ||
1725 | #include <linux/kernel.h> | ||
1726 | #include <linux/memblock.h> | ||
1727 | +#include <linux/mm.h> | ||
1728 | #include <linux/pfn.h> | ||
1729 | |||
1730 | #include <asm/page.h> | ||
1731 | @@ -49,7 +50,7 @@ static void __init zero_pte_populate(pmd_t *pmd, unsigned long addr, | ||
1732 | pte_t *pte = pte_offset_kernel(pmd, addr); | ||
1733 | pte_t zero_pte; | ||
1734 | |||
1735 | - zero_pte = pfn_pte(PFN_DOWN(__pa(kasan_zero_page)), PAGE_KERNEL); | ||
1736 | + zero_pte = pfn_pte(PFN_DOWN(__pa_symbol(kasan_zero_page)), PAGE_KERNEL); | ||
1737 | zero_pte = pte_wrprotect(zero_pte); | ||
1738 | |||
1739 | while (addr + PAGE_SIZE <= end) { | ||
1740 | @@ -69,7 +70,7 @@ static void __init zero_pmd_populate(pud_t *pud, unsigned long addr, | ||
1741 | next = pmd_addr_end(addr, end); | ||
1742 | |||
1743 | if (IS_ALIGNED(addr, PMD_SIZE) && end - addr >= PMD_SIZE) { | ||
1744 | - pmd_populate_kernel(&init_mm, pmd, kasan_zero_pte); | ||
1745 | + pmd_populate_kernel(&init_mm, pmd, lm_alias(kasan_zero_pte)); | ||
1746 | continue; | ||
1747 | } | ||
1748 | |||
1749 | @@ -92,9 +93,9 @@ static void __init zero_pud_populate(pgd_t *pgd, unsigned long addr, | ||
1750 | if (IS_ALIGNED(addr, PUD_SIZE) && end - addr >= PUD_SIZE) { | ||
1751 | pmd_t *pmd; | ||
1752 | |||
1753 | - pud_populate(&init_mm, pud, kasan_zero_pmd); | ||
1754 | + pud_populate(&init_mm, pud, lm_alias(kasan_zero_pmd)); | ||
1755 | pmd = pmd_offset(pud, addr); | ||
1756 | - pmd_populate_kernel(&init_mm, pmd, kasan_zero_pte); | ||
1757 | + pmd_populate_kernel(&init_mm, pmd, lm_alias(kasan_zero_pte)); | ||
1758 | continue; | ||
1759 | } | ||
1760 | |||
1761 | @@ -135,11 +136,11 @@ void __init kasan_populate_zero_shadow(const void *shadow_start, | ||
1762 | * puds,pmds, so pgd_populate(), pud_populate() | ||
1763 | * is noops. | ||
1764 | */ | ||
1765 | - pgd_populate(&init_mm, pgd, kasan_zero_pud); | ||
1766 | + pgd_populate(&init_mm, pgd, lm_alias(kasan_zero_pud)); | ||
1767 | pud = pud_offset(pgd, addr); | ||
1768 | - pud_populate(&init_mm, pud, kasan_zero_pmd); | ||
1769 | + pud_populate(&init_mm, pud, lm_alias(kasan_zero_pmd)); | ||
1770 | pmd = pmd_offset(pud, addr); | ||
1771 | - pmd_populate_kernel(&init_mm, pmd, kasan_zero_pte); | ||
1772 | + pmd_populate_kernel(&init_mm, pmd, lm_alias(kasan_zero_pte)); | ||
1773 | continue; | ||
1774 | } | ||
1775 | |||
1776 | diff --git a/mm/kasan/report.c b/mm/kasan/report.c | ||
1777 | index 8ca412aebcf1..c505ac5b2d46 100644 | ||
1778 | --- a/mm/kasan/report.c | ||
1779 | +++ b/mm/kasan/report.c | ||
1780 | @@ -302,6 +302,7 @@ void kasan_report(unsigned long addr, size_t size, | ||
1781 | disable_trace_on_warning(); | ||
1782 | |||
1783 | info.access_addr = (void *)addr; | ||
1784 | + info.first_bad_addr = (void *)addr; | ||
1785 | info.access_size = size; | ||
1786 | info.is_write = is_write; | ||
1787 | info.ip = ip; | ||
1788 | diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c | ||
1789 | index 8b6f654bc85d..00123064eb26 100644 | ||
1790 | --- a/net/batman-adv/bridge_loop_avoidance.c | ||
1791 | +++ b/net/batman-adv/bridge_loop_avoidance.c | ||
1792 | @@ -802,6 +802,8 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv, | ||
1793 | const u8 *mac, const unsigned short vid) | ||
1794 | { | ||
1795 | struct batadv_bla_claim search_claim, *claim; | ||
1796 | + struct batadv_bla_claim *claim_removed_entry; | ||
1797 | + struct hlist_node *claim_removed_node; | ||
1798 | |||
1799 | ether_addr_copy(search_claim.addr, mac); | ||
1800 | search_claim.vid = vid; | ||
1801 | @@ -812,10 +814,18 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv, | ||
1802 | batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_del_claim(): %pM, vid %d\n", | ||
1803 | mac, BATADV_PRINT_VID(vid)); | ||
1804 | |||
1805 | - batadv_hash_remove(bat_priv->bla.claim_hash, batadv_compare_claim, | ||
1806 | - batadv_choose_claim, claim); | ||
1807 | - batadv_claim_put(claim); /* reference from the hash is gone */ | ||
1808 | + claim_removed_node = batadv_hash_remove(bat_priv->bla.claim_hash, | ||
1809 | + batadv_compare_claim, | ||
1810 | + batadv_choose_claim, claim); | ||
1811 | + if (!claim_removed_node) | ||
1812 | + goto free_claim; | ||
1813 | |||
1814 | + /* reference from the hash is gone */ | ||
1815 | + claim_removed_entry = hlist_entry(claim_removed_node, | ||
1816 | + struct batadv_bla_claim, hash_entry); | ||
1817 | + batadv_claim_put(claim_removed_entry); | ||
1818 | + | ||
1819 | +free_claim: | ||
1820 | /* don't need the reference from hash_find() anymore */ | ||
1821 | batadv_claim_put(claim); | ||
1822 | } | ||
1823 | diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c | ||
1824 | index b9f9a310eb78..af4a02ad8503 100644 | ||
1825 | --- a/net/batman-adv/translation-table.c | ||
1826 | +++ b/net/batman-adv/translation-table.c | ||
1827 | @@ -615,14 +615,26 @@ static void batadv_tt_global_free(struct batadv_priv *bat_priv, | ||
1828 | struct batadv_tt_global_entry *tt_global, | ||
1829 | const char *message) | ||
1830 | { | ||
1831 | + struct batadv_tt_global_entry *tt_removed_entry; | ||
1832 | + struct hlist_node *tt_removed_node; | ||
1833 | + | ||
1834 | batadv_dbg(BATADV_DBG_TT, bat_priv, | ||
1835 | "Deleting global tt entry %pM (vid: %d): %s\n", | ||
1836 | tt_global->common.addr, | ||
1837 | BATADV_PRINT_VID(tt_global->common.vid), message); | ||
1838 | |||
1839 | - batadv_hash_remove(bat_priv->tt.global_hash, batadv_compare_tt, | ||
1840 | - batadv_choose_tt, &tt_global->common); | ||
1841 | - batadv_tt_global_entry_put(tt_global); | ||
1842 | + tt_removed_node = batadv_hash_remove(bat_priv->tt.global_hash, | ||
1843 | + batadv_compare_tt, | ||
1844 | + batadv_choose_tt, | ||
1845 | + &tt_global->common); | ||
1846 | + if (!tt_removed_node) | ||
1847 | + return; | ||
1848 | + | ||
1849 | + /* drop reference of remove hash entry */ | ||
1850 | + tt_removed_entry = hlist_entry(tt_removed_node, | ||
1851 | + struct batadv_tt_global_entry, | ||
1852 | + common.hash_entry); | ||
1853 | + batadv_tt_global_entry_put(tt_removed_entry); | ||
1854 | } | ||
1855 | |||
1856 | /** | ||
1857 | @@ -1308,9 +1320,10 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr, | ||
1858 | unsigned short vid, const char *message, | ||
1859 | bool roaming) | ||
1860 | { | ||
1861 | + struct batadv_tt_local_entry *tt_removed_entry; | ||
1862 | struct batadv_tt_local_entry *tt_local_entry; | ||
1863 | u16 flags, curr_flags = BATADV_NO_FLAGS; | ||
1864 | - void *tt_entry_exists; | ||
1865 | + struct hlist_node *tt_removed_node; | ||
1866 | |||
1867 | tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid); | ||
1868 | if (!tt_local_entry) | ||
1869 | @@ -1339,15 +1352,18 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr, | ||
1870 | */ | ||
1871 | batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL); | ||
1872 | |||
1873 | - tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash, | ||
1874 | + tt_removed_node = batadv_hash_remove(bat_priv->tt.local_hash, | ||
1875 | batadv_compare_tt, | ||
1876 | batadv_choose_tt, | ||
1877 | &tt_local_entry->common); | ||
1878 | - if (!tt_entry_exists) | ||
1879 | + if (!tt_removed_node) | ||
1880 | goto out; | ||
1881 | |||
1882 | - /* extra call to free the local tt entry */ | ||
1883 | - batadv_tt_local_entry_put(tt_local_entry); | ||
1884 | + /* drop reference of remove hash entry */ | ||
1885 | + tt_removed_entry = hlist_entry(tt_removed_node, | ||
1886 | + struct batadv_tt_local_entry, | ||
1887 | + common.hash_entry); | ||
1888 | + batadv_tt_local_entry_put(tt_removed_entry); | ||
1889 | |||
1890 | out: | ||
1891 | if (tt_local_entry) | ||
1892 | diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c | ||
1893 | index f5afda1abc76..4dc82e9a855d 100644 | ||
1894 | --- a/net/caif/cfctrl.c | ||
1895 | +++ b/net/caif/cfctrl.c | ||
1896 | @@ -352,15 +352,14 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) | ||
1897 | u8 cmdrsp; | ||
1898 | u8 cmd; | ||
1899 | int ret = -1; | ||
1900 | - u16 tmp16; | ||
1901 | u8 len; | ||
1902 | u8 param[255]; | ||
1903 | - u8 linkid; | ||
1904 | + u8 linkid = 0; | ||
1905 | struct cfctrl *cfctrl = container_obj(layer); | ||
1906 | struct cfctrl_request_info rsp, *req; | ||
1907 | |||
1908 | |||
1909 | - cfpkt_extr_head(pkt, &cmdrsp, 1); | ||
1910 | + cmdrsp = cfpkt_extr_head_u8(pkt); | ||
1911 | cmd = cmdrsp & CFCTRL_CMD_MASK; | ||
1912 | if (cmd != CFCTRL_CMD_LINK_ERR | ||
1913 | && CFCTRL_RSP_BIT != (CFCTRL_RSP_BIT & cmdrsp) | ||
1914 | @@ -378,13 +377,12 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) | ||
1915 | u8 physlinkid; | ||
1916 | u8 prio; | ||
1917 | u8 tmp; | ||
1918 | - u32 tmp32; | ||
1919 | u8 *cp; | ||
1920 | int i; | ||
1921 | struct cfctrl_link_param linkparam; | ||
1922 | memset(&linkparam, 0, sizeof(linkparam)); | ||
1923 | |||
1924 | - cfpkt_extr_head(pkt, &tmp, 1); | ||
1925 | + tmp = cfpkt_extr_head_u8(pkt); | ||
1926 | |||
1927 | serv = tmp & CFCTRL_SRV_MASK; | ||
1928 | linkparam.linktype = serv; | ||
1929 | @@ -392,13 +390,13 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) | ||
1930 | servtype = tmp >> 4; | ||
1931 | linkparam.chtype = servtype; | ||
1932 | |||
1933 | - cfpkt_extr_head(pkt, &tmp, 1); | ||
1934 | + tmp = cfpkt_extr_head_u8(pkt); | ||
1935 | physlinkid = tmp & 0x07; | ||
1936 | prio = tmp >> 3; | ||
1937 | |||
1938 | linkparam.priority = prio; | ||
1939 | linkparam.phyid = physlinkid; | ||
1940 | - cfpkt_extr_head(pkt, &endpoint, 1); | ||
1941 | + endpoint = cfpkt_extr_head_u8(pkt); | ||
1942 | linkparam.endpoint = endpoint & 0x03; | ||
1943 | |||
1944 | switch (serv) { | ||
1945 | @@ -407,45 +405,43 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) | ||
1946 | if (CFCTRL_ERR_BIT & cmdrsp) | ||
1947 | break; | ||
1948 | /* Link ID */ | ||
1949 | - cfpkt_extr_head(pkt, &linkid, 1); | ||
1950 | + linkid = cfpkt_extr_head_u8(pkt); | ||
1951 | break; | ||
1952 | case CFCTRL_SRV_VIDEO: | ||
1953 | - cfpkt_extr_head(pkt, &tmp, 1); | ||
1954 | + tmp = cfpkt_extr_head_u8(pkt); | ||
1955 | linkparam.u.video.connid = tmp; | ||
1956 | if (CFCTRL_ERR_BIT & cmdrsp) | ||
1957 | break; | ||
1958 | /* Link ID */ | ||
1959 | - cfpkt_extr_head(pkt, &linkid, 1); | ||
1960 | + linkid = cfpkt_extr_head_u8(pkt); | ||
1961 | break; | ||
1962 | |||
1963 | case CFCTRL_SRV_DATAGRAM: | ||
1964 | - cfpkt_extr_head(pkt, &tmp32, 4); | ||
1965 | linkparam.u.datagram.connid = | ||
1966 | - le32_to_cpu(tmp32); | ||
1967 | + cfpkt_extr_head_u32(pkt); | ||
1968 | if (CFCTRL_ERR_BIT & cmdrsp) | ||
1969 | break; | ||
1970 | /* Link ID */ | ||
1971 | - cfpkt_extr_head(pkt, &linkid, 1); | ||
1972 | + linkid = cfpkt_extr_head_u8(pkt); | ||
1973 | break; | ||
1974 | case CFCTRL_SRV_RFM: | ||
1975 | /* Construct a frame, convert | ||
1976 | * DatagramConnectionID | ||
1977 | * to network format long and copy it out... | ||
1978 | */ | ||
1979 | - cfpkt_extr_head(pkt, &tmp32, 4); | ||
1980 | linkparam.u.rfm.connid = | ||
1981 | - le32_to_cpu(tmp32); | ||
1982 | + cfpkt_extr_head_u32(pkt); | ||
1983 | cp = (u8 *) linkparam.u.rfm.volume; | ||
1984 | - for (cfpkt_extr_head(pkt, &tmp, 1); | ||
1985 | + for (tmp = cfpkt_extr_head_u8(pkt); | ||
1986 | cfpkt_more(pkt) && tmp != '\0'; | ||
1987 | - cfpkt_extr_head(pkt, &tmp, 1)) | ||
1988 | + tmp = cfpkt_extr_head_u8(pkt)) | ||
1989 | *cp++ = tmp; | ||
1990 | *cp = '\0'; | ||
1991 | |||
1992 | if (CFCTRL_ERR_BIT & cmdrsp) | ||
1993 | break; | ||
1994 | /* Link ID */ | ||
1995 | - cfpkt_extr_head(pkt, &linkid, 1); | ||
1996 | + linkid = cfpkt_extr_head_u8(pkt); | ||
1997 | |||
1998 | break; | ||
1999 | case CFCTRL_SRV_UTIL: | ||
2000 | @@ -454,13 +450,11 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) | ||
2001 | * to network format long and copy it out... | ||
2002 | */ | ||
2003 | /* Fifosize KB */ | ||
2004 | - cfpkt_extr_head(pkt, &tmp16, 2); | ||
2005 | linkparam.u.utility.fifosize_kb = | ||
2006 | - le16_to_cpu(tmp16); | ||
2007 | + cfpkt_extr_head_u16(pkt); | ||
2008 | /* Fifosize bufs */ | ||
2009 | - cfpkt_extr_head(pkt, &tmp16, 2); | ||
2010 | linkparam.u.utility.fifosize_bufs = | ||
2011 | - le16_to_cpu(tmp16); | ||
2012 | + cfpkt_extr_head_u16(pkt); | ||
2013 | /* name */ | ||
2014 | cp = (u8 *) linkparam.u.utility.name; | ||
2015 | caif_assert(sizeof(linkparam.u.utility.name) | ||
2016 | @@ -468,24 +462,24 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) | ||
2017 | for (i = 0; | ||
2018 | i < UTILITY_NAME_LENGTH | ||
2019 | && cfpkt_more(pkt); i++) { | ||
2020 | - cfpkt_extr_head(pkt, &tmp, 1); | ||
2021 | + tmp = cfpkt_extr_head_u8(pkt); | ||
2022 | *cp++ = tmp; | ||
2023 | } | ||
2024 | /* Length */ | ||
2025 | - cfpkt_extr_head(pkt, &len, 1); | ||
2026 | + len = cfpkt_extr_head_u8(pkt); | ||
2027 | linkparam.u.utility.paramlen = len; | ||
2028 | /* Param Data */ | ||
2029 | cp = linkparam.u.utility.params; | ||
2030 | while (cfpkt_more(pkt) && len--) { | ||
2031 | - cfpkt_extr_head(pkt, &tmp, 1); | ||
2032 | + tmp = cfpkt_extr_head_u8(pkt); | ||
2033 | *cp++ = tmp; | ||
2034 | } | ||
2035 | if (CFCTRL_ERR_BIT & cmdrsp) | ||
2036 | break; | ||
2037 | /* Link ID */ | ||
2038 | - cfpkt_extr_head(pkt, &linkid, 1); | ||
2039 | + linkid = cfpkt_extr_head_u8(pkt); | ||
2040 | /* Length */ | ||
2041 | - cfpkt_extr_head(pkt, &len, 1); | ||
2042 | + len = cfpkt_extr_head_u8(pkt); | ||
2043 | /* Param Data */ | ||
2044 | cfpkt_extr_head(pkt, ¶m, len); | ||
2045 | break; | ||
2046 | @@ -522,7 +516,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) | ||
2047 | } | ||
2048 | break; | ||
2049 | case CFCTRL_CMD_LINK_DESTROY: | ||
2050 | - cfpkt_extr_head(pkt, &linkid, 1); | ||
2051 | + linkid = cfpkt_extr_head_u8(pkt); | ||
2052 | cfctrl->res.linkdestroy_rsp(cfctrl->serv.layer.up, linkid); | ||
2053 | break; | ||
2054 | case CFCTRL_CMD_LINK_ERR: | ||
2055 | diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c | ||
2056 | index 100c86f1f547..7f1a85c6a614 100644 | ||
2057 | --- a/net/ipv4/ip_output.c | ||
2058 | +++ b/net/ipv4/ip_output.c | ||
2059 | @@ -492,6 +492,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) | ||
2060 | to->pkt_type = from->pkt_type; | ||
2061 | to->priority = from->priority; | ||
2062 | to->protocol = from->protocol; | ||
2063 | + to->skb_iif = from->skb_iif; | ||
2064 | skb_dst_drop(to); | ||
2065 | skb_dst_copy(to, from); | ||
2066 | to->dev = from->dev; | ||
2067 | diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c | ||
2068 | index b82e439804d1..8c2f9aedc2af 100644 | ||
2069 | --- a/net/ipv6/ip6_flowlabel.c | ||
2070 | +++ b/net/ipv6/ip6_flowlabel.c | ||
2071 | @@ -94,15 +94,21 @@ static struct ip6_flowlabel *fl_lookup(struct net *net, __be32 label) | ||
2072 | return fl; | ||
2073 | } | ||
2074 | |||
2075 | +static void fl_free_rcu(struct rcu_head *head) | ||
2076 | +{ | ||
2077 | + struct ip6_flowlabel *fl = container_of(head, struct ip6_flowlabel, rcu); | ||
2078 | + | ||
2079 | + if (fl->share == IPV6_FL_S_PROCESS) | ||
2080 | + put_pid(fl->owner.pid); | ||
2081 | + kfree(fl->opt); | ||
2082 | + kfree(fl); | ||
2083 | +} | ||
2084 | + | ||
2085 | |||
2086 | static void fl_free(struct ip6_flowlabel *fl) | ||
2087 | { | ||
2088 | - if (fl) { | ||
2089 | - if (fl->share == IPV6_FL_S_PROCESS) | ||
2090 | - put_pid(fl->owner.pid); | ||
2091 | - kfree(fl->opt); | ||
2092 | - kfree_rcu(fl, rcu); | ||
2093 | - } | ||
2094 | + if (fl) | ||
2095 | + call_rcu(&fl->rcu, fl_free_rcu); | ||
2096 | } | ||
2097 | |||
2098 | static void fl_release(struct ip6_flowlabel *fl) | ||
2099 | @@ -634,9 +640,9 @@ recheck: | ||
2100 | if (fl1->share == IPV6_FL_S_EXCL || | ||
2101 | fl1->share != fl->share || | ||
2102 | ((fl1->share == IPV6_FL_S_PROCESS) && | ||
2103 | - (fl1->owner.pid == fl->owner.pid)) || | ||
2104 | + (fl1->owner.pid != fl->owner.pid)) || | ||
2105 | ((fl1->share == IPV6_FL_S_USER) && | ||
2106 | - uid_eq(fl1->owner.uid, fl->owner.uid))) | ||
2107 | + !uid_eq(fl1->owner.uid, fl->owner.uid))) | ||
2108 | goto release; | ||
2109 | |||
2110 | err = -ENOMEM; | ||
2111 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c | ||
2112 | index 522d4ca715c9..ea37160d5ae2 100644 | ||
2113 | --- a/net/packet/af_packet.c | ||
2114 | +++ b/net/packet/af_packet.c | ||
2115 | @@ -2638,8 +2638,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) | ||
2116 | void *ph; | ||
2117 | DECLARE_SOCKADDR(struct sockaddr_ll *, saddr, msg->msg_name); | ||
2118 | bool need_wait = !(msg->msg_flags & MSG_DONTWAIT); | ||
2119 | + unsigned char *addr = NULL; | ||
2120 | int tp_len, size_max; | ||
2121 | - unsigned char *addr; | ||
2122 | void *data; | ||
2123 | int len_sum = 0; | ||
2124 | int status = TP_STATUS_AVAILABLE; | ||
2125 | @@ -2650,7 +2650,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) | ||
2126 | if (likely(saddr == NULL)) { | ||
2127 | dev = packet_cached_dev_get(po); | ||
2128 | proto = po->num; | ||
2129 | - addr = NULL; | ||
2130 | } else { | ||
2131 | err = -EINVAL; | ||
2132 | if (msg->msg_namelen < sizeof(struct sockaddr_ll)) | ||
2133 | @@ -2660,10 +2659,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) | ||
2134 | sll_addr))) | ||
2135 | goto out; | ||
2136 | proto = saddr->sll_protocol; | ||
2137 | - addr = saddr->sll_halen ? saddr->sll_addr : NULL; | ||
2138 | dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); | ||
2139 | - if (addr && dev && saddr->sll_halen < dev->addr_len) | ||
2140 | - goto out_put; | ||
2141 | + if (po->sk.sk_socket->type == SOCK_DGRAM) { | ||
2142 | + if (dev && msg->msg_namelen < dev->addr_len + | ||
2143 | + offsetof(struct sockaddr_ll, sll_addr)) | ||
2144 | + goto out_put; | ||
2145 | + addr = saddr->sll_addr; | ||
2146 | + } | ||
2147 | } | ||
2148 | |||
2149 | err = -ENXIO; | ||
2150 | @@ -2834,7 +2836,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
2151 | struct sk_buff *skb; | ||
2152 | struct net_device *dev; | ||
2153 | __be16 proto; | ||
2154 | - unsigned char *addr; | ||
2155 | + unsigned char *addr = NULL; | ||
2156 | int err, reserve = 0; | ||
2157 | struct sockcm_cookie sockc; | ||
2158 | struct virtio_net_hdr vnet_hdr = { 0 }; | ||
2159 | @@ -2851,7 +2853,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
2160 | if (likely(saddr == NULL)) { | ||
2161 | dev = packet_cached_dev_get(po); | ||
2162 | proto = po->num; | ||
2163 | - addr = NULL; | ||
2164 | } else { | ||
2165 | err = -EINVAL; | ||
2166 | if (msg->msg_namelen < sizeof(struct sockaddr_ll)) | ||
2167 | @@ -2859,10 +2860,13 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) | ||
2168 | if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr))) | ||
2169 | goto out; | ||
2170 | proto = saddr->sll_protocol; | ||
2171 | - addr = saddr->sll_halen ? saddr->sll_addr : NULL; | ||
2172 | dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); | ||
2173 | - if (addr && dev && saddr->sll_halen < dev->addr_len) | ||
2174 | - goto out_unlock; | ||
2175 | + if (sock->type == SOCK_DGRAM) { | ||
2176 | + if (dev && msg->msg_namelen < dev->addr_len + | ||
2177 | + offsetof(struct sockaddr_ll, sll_addr)) | ||
2178 | + goto out_unlock; | ||
2179 | + addr = saddr->sll_addr; | ||
2180 | + } | ||
2181 | } | ||
2182 | |||
2183 | err = -ENXIO; | ||
2184 | diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c | ||
2185 | index 9bd6f97ccd21..772df402c495 100644 | ||
2186 | --- a/security/selinux/hooks.c | ||
2187 | +++ b/security/selinux/hooks.c | ||
2188 | @@ -467,21 +467,43 @@ static int may_context_mount_inode_relabel(u32 sid, | ||
2189 | return rc; | ||
2190 | } | ||
2191 | |||
2192 | -static int selinux_is_sblabel_mnt(struct super_block *sb) | ||
2193 | +static int selinux_is_genfs_special_handling(struct super_block *sb) | ||
2194 | { | ||
2195 | - struct superblock_security_struct *sbsec = sb->s_security; | ||
2196 | - | ||
2197 | - return sbsec->behavior == SECURITY_FS_USE_XATTR || | ||
2198 | - sbsec->behavior == SECURITY_FS_USE_TRANS || | ||
2199 | - sbsec->behavior == SECURITY_FS_USE_TASK || | ||
2200 | - sbsec->behavior == SECURITY_FS_USE_NATIVE || | ||
2201 | - /* Special handling. Genfs but also in-core setxattr handler */ | ||
2202 | - !strcmp(sb->s_type->name, "sysfs") || | ||
2203 | + /* Special handling. Genfs but also in-core setxattr handler */ | ||
2204 | + return !strcmp(sb->s_type->name, "sysfs") || | ||
2205 | !strcmp(sb->s_type->name, "pstore") || | ||
2206 | !strcmp(sb->s_type->name, "debugfs") || | ||
2207 | !strcmp(sb->s_type->name, "rootfs"); | ||
2208 | } | ||
2209 | |||
2210 | +static int selinux_is_sblabel_mnt(struct super_block *sb) | ||
2211 | +{ | ||
2212 | + struct superblock_security_struct *sbsec = sb->s_security; | ||
2213 | + | ||
2214 | + /* | ||
2215 | + * IMPORTANT: Double-check logic in this function when adding a new | ||
2216 | + * SECURITY_FS_USE_* definition! | ||
2217 | + */ | ||
2218 | + BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7); | ||
2219 | + | ||
2220 | + switch (sbsec->behavior) { | ||
2221 | + case SECURITY_FS_USE_XATTR: | ||
2222 | + case SECURITY_FS_USE_TRANS: | ||
2223 | + case SECURITY_FS_USE_TASK: | ||
2224 | + case SECURITY_FS_USE_NATIVE: | ||
2225 | + return 1; | ||
2226 | + | ||
2227 | + case SECURITY_FS_USE_GENFS: | ||
2228 | + return selinux_is_genfs_special_handling(sb); | ||
2229 | + | ||
2230 | + /* Never allow relabeling on context mounts */ | ||
2231 | + case SECURITY_FS_USE_MNTPOINT: | ||
2232 | + case SECURITY_FS_USE_NONE: | ||
2233 | + default: | ||
2234 | + return 0; | ||
2235 | + } | ||
2236 | +} | ||
2237 | + | ||
2238 | static int sb_finish_set_opts(struct super_block *sb) | ||
2239 | { | ||
2240 | struct superblock_security_struct *sbsec = sb->s_security; | ||
2241 | diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c | ||
2242 | index 58d624938a9f..09189249d0d1 100644 | ||
2243 | --- a/sound/usb/line6/driver.c | ||
2244 | +++ b/sound/usb/line6/driver.c | ||
2245 | @@ -337,12 +337,16 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, | ||
2246 | { | ||
2247 | struct usb_device *usbdev = line6->usbdev; | ||
2248 | int ret; | ||
2249 | - unsigned char len; | ||
2250 | + unsigned char *len; | ||
2251 | unsigned count; | ||
2252 | |||
2253 | if (address > 0xffff || datalen > 0xff) | ||
2254 | return -EINVAL; | ||
2255 | |||
2256 | + len = kmalloc(sizeof(*len), GFP_KERNEL); | ||
2257 | + if (!len) | ||
2258 | + return -ENOMEM; | ||
2259 | + | ||
2260 | /* query the serial number: */ | ||
2261 | ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, | ||
2262 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, | ||
2263 | @@ -351,7 +355,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, | ||
2264 | |||
2265 | if (ret < 0) { | ||
2266 | dev_err(line6->ifcdev, "read request failed (error %d)\n", ret); | ||
2267 | - return ret; | ||
2268 | + goto exit; | ||
2269 | } | ||
2270 | |||
2271 | /* Wait for data length. We'll get 0xff until length arrives. */ | ||
2272 | @@ -361,28 +365,29 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, | ||
2273 | ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, | ||
2274 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | | ||
2275 | USB_DIR_IN, | ||
2276 | - 0x0012, 0x0000, &len, 1, | ||
2277 | + 0x0012, 0x0000, len, 1, | ||
2278 | LINE6_TIMEOUT * HZ); | ||
2279 | if (ret < 0) { | ||
2280 | dev_err(line6->ifcdev, | ||
2281 | "receive length failed (error %d)\n", ret); | ||
2282 | - return ret; | ||
2283 | + goto exit; | ||
2284 | } | ||
2285 | |||
2286 | - if (len != 0xff) | ||
2287 | + if (*len != 0xff) | ||
2288 | break; | ||
2289 | } | ||
2290 | |||
2291 | - if (len == 0xff) { | ||
2292 | + ret = -EIO; | ||
2293 | + if (*len == 0xff) { | ||
2294 | dev_err(line6->ifcdev, "read failed after %d retries\n", | ||
2295 | count); | ||
2296 | - return -EIO; | ||
2297 | - } else if (len != datalen) { | ||
2298 | + goto exit; | ||
2299 | + } else if (*len != datalen) { | ||
2300 | /* should be equal or something went wrong */ | ||
2301 | dev_err(line6->ifcdev, | ||
2302 | "length mismatch (expected %d, got %d)\n", | ||
2303 | - (int)datalen, (int)len); | ||
2304 | - return -EIO; | ||
2305 | + (int)datalen, (int)*len); | ||
2306 | + goto exit; | ||
2307 | } | ||
2308 | |||
2309 | /* receive the result: */ | ||
2310 | @@ -391,12 +396,12 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, | ||
2311 | 0x0013, 0x0000, data, datalen, | ||
2312 | LINE6_TIMEOUT * HZ); | ||
2313 | |||
2314 | - if (ret < 0) { | ||
2315 | + if (ret < 0) | ||
2316 | dev_err(line6->ifcdev, "read failed (error %d)\n", ret); | ||
2317 | - return ret; | ||
2318 | - } | ||
2319 | |||
2320 | - return 0; | ||
2321 | +exit: | ||
2322 | + kfree(len); | ||
2323 | + return ret; | ||
2324 | } | ||
2325 | EXPORT_SYMBOL_GPL(line6_read_data); | ||
2326 | |||
2327 | @@ -408,12 +413,16 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, | ||
2328 | { | ||
2329 | struct usb_device *usbdev = line6->usbdev; | ||
2330 | int ret; | ||
2331 | - unsigned char status; | ||
2332 | + unsigned char *status; | ||
2333 | int count; | ||
2334 | |||
2335 | if (address > 0xffff || datalen > 0xffff) | ||
2336 | return -EINVAL; | ||
2337 | |||
2338 | + status = kmalloc(sizeof(*status), GFP_KERNEL); | ||
2339 | + if (!status) | ||
2340 | + return -ENOMEM; | ||
2341 | + | ||
2342 | ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, | ||
2343 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, | ||
2344 | 0x0022, address, data, datalen, | ||
2345 | @@ -422,7 +431,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, | ||
2346 | if (ret < 0) { | ||
2347 | dev_err(line6->ifcdev, | ||
2348 | "write request failed (error %d)\n", ret); | ||
2349 | - return ret; | ||
2350 | + goto exit; | ||
2351 | } | ||
2352 | |||
2353 | for (count = 0; count < LINE6_READ_WRITE_MAX_RETRIES; count++) { | ||
2354 | @@ -433,28 +442,29 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, | ||
2355 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | | ||
2356 | USB_DIR_IN, | ||
2357 | 0x0012, 0x0000, | ||
2358 | - &status, 1, LINE6_TIMEOUT * HZ); | ||
2359 | + status, 1, LINE6_TIMEOUT * HZ); | ||
2360 | |||
2361 | if (ret < 0) { | ||
2362 | dev_err(line6->ifcdev, | ||
2363 | "receiving status failed (error %d)\n", ret); | ||
2364 | - return ret; | ||
2365 | + goto exit; | ||
2366 | } | ||
2367 | |||
2368 | - if (status != 0xff) | ||
2369 | + if (*status != 0xff) | ||
2370 | break; | ||
2371 | } | ||
2372 | |||
2373 | - if (status == 0xff) { | ||
2374 | + if (*status == 0xff) { | ||
2375 | dev_err(line6->ifcdev, "write failed after %d retries\n", | ||
2376 | count); | ||
2377 | - return -EIO; | ||
2378 | - } else if (status != 0) { | ||
2379 | + ret = -EIO; | ||
2380 | + } else if (*status != 0) { | ||
2381 | dev_err(line6->ifcdev, "write failed (error %d)\n", ret); | ||
2382 | - return -EIO; | ||
2383 | + ret = -EIO; | ||
2384 | } | ||
2385 | - | ||
2386 | - return 0; | ||
2387 | +exit: | ||
2388 | + kfree(status); | ||
2389 | + return ret; | ||
2390 | } | ||
2391 | EXPORT_SYMBOL_GPL(line6_write_data); | ||
2392 | |||
2393 | diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c | ||
2394 | index 5ab9e0c89211..c0b6733c0623 100644 | ||
2395 | --- a/sound/usb/line6/podhd.c | ||
2396 | +++ b/sound/usb/line6/podhd.c | ||
2397 | @@ -221,28 +221,32 @@ static void podhd_startup_start_workqueue(unsigned long data) | ||
2398 | static int podhd_dev_start(struct usb_line6_podhd *pod) | ||
2399 | { | ||
2400 | int ret; | ||
2401 | - u8 init_bytes[8]; | ||
2402 | + u8 *init_bytes; | ||
2403 | int i; | ||
2404 | struct usb_device *usbdev = pod->line6.usbdev; | ||
2405 | |||
2406 | + init_bytes = kmalloc(8, GFP_KERNEL); | ||
2407 | + if (!init_bytes) | ||
2408 | + return -ENOMEM; | ||
2409 | + | ||
2410 | ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), | ||
2411 | 0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, | ||
2412 | 0x11, 0, | ||
2413 | NULL, 0, LINE6_TIMEOUT * HZ); | ||
2414 | if (ret < 0) { | ||
2415 | dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret); | ||
2416 | - return ret; | ||
2417 | + goto exit; | ||
2418 | } | ||
2419 | |||
2420 | /* NOTE: looks like some kind of ping message */ | ||
2421 | ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, | ||
2422 | USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, | ||
2423 | 0x11, 0x0, | ||
2424 | - &init_bytes, 3, LINE6_TIMEOUT * HZ); | ||
2425 | + init_bytes, 3, LINE6_TIMEOUT * HZ); | ||
2426 | if (ret < 0) { | ||
2427 | dev_err(pod->line6.ifcdev, | ||
2428 | "receive length failed (error %d)\n", ret); | ||
2429 | - return ret; | ||
2430 | + goto exit; | ||
2431 | } | ||
2432 | |||
2433 | pod->firmware_version = | ||
2434 | @@ -251,7 +255,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) | ||
2435 | for (i = 0; i <= 16; i++) { | ||
2436 | ret = line6_read_data(&pod->line6, 0xf000 + 0x08 * i, init_bytes, 8); | ||
2437 | if (ret < 0) | ||
2438 | - return ret; | ||
2439 | + goto exit; | ||
2440 | } | ||
2441 | |||
2442 | ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), | ||
2443 | @@ -259,10 +263,9 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) | ||
2444 | USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT, | ||
2445 | 1, 0, | ||
2446 | NULL, 0, LINE6_TIMEOUT * HZ); | ||
2447 | - if (ret < 0) | ||
2448 | - return ret; | ||
2449 | - | ||
2450 | - return 0; | ||
2451 | +exit: | ||
2452 | + kfree(init_bytes); | ||
2453 | + return ret; | ||
2454 | } | ||
2455 | |||
2456 | static void podhd_startup_workqueue(struct work_struct *work) | ||
2457 | diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c | ||
2458 | index 8e22f430d700..d3871d99ade4 100644 | ||
2459 | --- a/sound/usb/line6/toneport.c | ||
2460 | +++ b/sound/usb/line6/toneport.c | ||
2461 | @@ -365,15 +365,20 @@ static bool toneport_has_source_select(struct usb_line6_toneport *toneport) | ||
2462 | /* | ||
2463 | Setup Toneport device. | ||
2464 | */ | ||
2465 | -static void toneport_setup(struct usb_line6_toneport *toneport) | ||
2466 | +static int toneport_setup(struct usb_line6_toneport *toneport) | ||
2467 | { | ||
2468 | - int ticks; | ||
2469 | + int *ticks; | ||
2470 | struct usb_line6 *line6 = &toneport->line6; | ||
2471 | struct usb_device *usbdev = line6->usbdev; | ||
2472 | |||
2473 | + ticks = kmalloc(sizeof(*ticks), GFP_KERNEL); | ||
2474 | + if (!ticks) | ||
2475 | + return -ENOMEM; | ||
2476 | + | ||
2477 | /* sync time on device with host: */ | ||
2478 | - ticks = (int)get_seconds(); | ||
2479 | - line6_write_data(line6, 0x80c6, &ticks, 4); | ||
2480 | + *ticks = (int)get_seconds(); | ||
2481 | + line6_write_data(line6, 0x80c6, ticks, 4); | ||
2482 | + kfree(ticks); | ||
2483 | |||
2484 | /* enable device: */ | ||
2485 | toneport_send_cmd(usbdev, 0x0301, 0x0000); | ||
2486 | @@ -388,6 +393,7 @@ static void toneport_setup(struct usb_line6_toneport *toneport) | ||
2487 | toneport_update_led(toneport); | ||
2488 | |||
2489 | mod_timer(&toneport->timer, jiffies + TONEPORT_PCM_DELAY * HZ); | ||
2490 | + return 0; | ||
2491 | } | ||
2492 | |||
2493 | /* | ||
2494 | @@ -451,7 +457,9 @@ static int toneport_init(struct usb_line6 *line6, | ||
2495 | return err; | ||
2496 | } | ||
2497 | |||
2498 | - toneport_setup(toneport); | ||
2499 | + err = toneport_setup(toneport); | ||
2500 | + if (err) | ||
2501 | + return err; | ||
2502 | |||
2503 | /* register audio system: */ | ||
2504 | return snd_card_register(line6->card); | ||
2505 | @@ -463,7 +471,11 @@ static int toneport_init(struct usb_line6 *line6, | ||
2506 | */ | ||
2507 | static int toneport_reset_resume(struct usb_interface *interface) | ||
2508 | { | ||
2509 | - toneport_setup(usb_get_intfdata(interface)); | ||
2510 | + int err; | ||
2511 | + | ||
2512 | + err = toneport_setup(usb_get_intfdata(interface)); | ||
2513 | + if (err) | ||
2514 | + return err; | ||
2515 | return line6_resume(interface); | ||
2516 | } | ||
2517 | #endif |