Contents of /trunk/kernel-alx/patches-4.9/0277-4.9.178-all-fixes.patch
Parent Directory | Revision Log
Revision 3354 -
(show annotations)
(download)
Tue Jun 18 09:42:07 2019 UTC (5 years, 3 months ago) by niro
File size: 51787 byte(s)
Tue Jun 18 09:42:07 2019 UTC (5 years, 3 months ago) by niro
File size: 51787 byte(s)
-linux-4.9.178
1 | diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst |
2 | index 534e9baa4e1d..5d4330be200f 100644 |
3 | --- a/Documentation/x86/mds.rst |
4 | +++ b/Documentation/x86/mds.rst |
5 | @@ -142,45 +142,13 @@ Mitigation points |
6 | mds_user_clear. |
7 | |
8 | The mitigation is invoked in prepare_exit_to_usermode() which covers |
9 | - most of the kernel to user space transitions. There are a few exceptions |
10 | - which are not invoking prepare_exit_to_usermode() on return to user |
11 | - space. These exceptions use the paranoid exit code. |
12 | + all but one of the kernel to user space transitions. The exception |
13 | + is when we return from a Non Maskable Interrupt (NMI), which is |
14 | + handled directly in do_nmi(). |
15 | |
16 | - - Non Maskable Interrupt (NMI): |
17 | - |
18 | - Access to sensible data like keys, credentials in the NMI context is |
19 | - mostly theoretical: The CPU can do prefetching or execute a |
20 | - misspeculated code path and thereby fetching data which might end up |
21 | - leaking through a buffer. |
22 | - |
23 | - But for mounting other attacks the kernel stack address of the task is |
24 | - already valuable information. So in full mitigation mode, the NMI is |
25 | - mitigated on the return from do_nmi() to provide almost complete |
26 | - coverage. |
27 | - |
28 | - - Double fault (#DF): |
29 | - |
30 | - A double fault is usually fatal, but the ESPFIX workaround, which can |
31 | - be triggered from user space through modify_ldt(2) is a recoverable |
32 | - double fault. #DF uses the paranoid exit path, so explicit mitigation |
33 | - in the double fault handler is required. |
34 | - |
35 | - - Machine Check Exception (#MC): |
36 | - |
37 | - Another corner case is a #MC which hits between the CPU buffer clear |
38 | - invocation and the actual return to user. As this still is in kernel |
39 | - space it takes the paranoid exit path which does not clear the CPU |
40 | - buffers. So the #MC handler repopulates the buffers to some |
41 | - extent. Machine checks are not reliably controllable and the window is |
42 | - extremly small so mitigation would just tick a checkbox that this |
43 | - theoretical corner case is covered. To keep the amount of special |
44 | - cases small, ignore #MC. |
45 | - |
46 | - - Debug Exception (#DB): |
47 | - |
48 | - This takes the paranoid exit path only when the INT1 breakpoint is in |
49 | - kernel space. #DB on a user space address takes the regular exit path, |
50 | - so no extra mitigation required. |
51 | + (The reason that NMI is special is that prepare_exit_to_usermode() can |
52 | + enable IRQs. In NMI context, NMIs are blocked, and we don't want to |
53 | + enable IRQs with NMIs blocked.) |
54 | |
55 | |
56 | 2. C-State transition |
57 | diff --git a/Makefile b/Makefile |
58 | index ceb8f4bf6245..e9fae7a3c621 100644 |
59 | --- a/Makefile |
60 | +++ b/Makefile |
61 | @@ -1,6 +1,6 @@ |
62 | VERSION = 4 |
63 | PATCHLEVEL = 9 |
64 | -SUBLEVEL = 177 |
65 | +SUBLEVEL = 178 |
66 | EXTRAVERSION = |
67 | NAME = Roaring Lionus |
68 | |
69 | diff --git a/arch/arm/crypto/aesbs-glue.c b/arch/arm/crypto/aesbs-glue.c |
70 | index 5d934a0039d7..cb2486a526e6 100644 |
71 | --- a/arch/arm/crypto/aesbs-glue.c |
72 | +++ b/arch/arm/crypto/aesbs-glue.c |
73 | @@ -265,6 +265,8 @@ static int aesbs_xts_encrypt(struct blkcipher_desc *desc, |
74 | |
75 | blkcipher_walk_init(&walk, dst, src, nbytes); |
76 | err = blkcipher_walk_virt_block(desc, &walk, 8 * AES_BLOCK_SIZE); |
77 | + if (err) |
78 | + return err; |
79 | |
80 | /* generate the initial tweak */ |
81 | AES_encrypt(walk.iv, walk.iv, &ctx->twkey); |
82 | @@ -289,6 +291,8 @@ static int aesbs_xts_decrypt(struct blkcipher_desc *desc, |
83 | |
84 | blkcipher_walk_init(&walk, dst, src, nbytes); |
85 | err = blkcipher_walk_virt_block(desc, &walk, 8 * AES_BLOCK_SIZE); |
86 | + if (err) |
87 | + return err; |
88 | |
89 | /* generate the initial tweak */ |
90 | AES_encrypt(walk.iv, walk.iv, &ctx->twkey); |
91 | diff --git a/arch/arm/mach-exynos/firmware.c b/arch/arm/mach-exynos/firmware.c |
92 | index fd6da5419b51..2199c3adfd84 100644 |
93 | --- a/arch/arm/mach-exynos/firmware.c |
94 | +++ b/arch/arm/mach-exynos/firmware.c |
95 | @@ -205,6 +205,7 @@ void __init exynos_firmware_init(void) |
96 | return; |
97 | |
98 | addr = of_get_address(nd, 0, NULL, NULL); |
99 | + of_node_put(nd); |
100 | if (!addr) { |
101 | pr_err("%s: No address specified.\n", __func__); |
102 | return; |
103 | diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c |
104 | index 3e1430a886b2..81c935ce089b 100644 |
105 | --- a/arch/arm/mach-exynos/suspend.c |
106 | +++ b/arch/arm/mach-exynos/suspend.c |
107 | @@ -715,8 +715,10 @@ void __init exynos_pm_init(void) |
108 | |
109 | if (WARN_ON(!of_find_property(np, "interrupt-controller", NULL))) { |
110 | pr_warn("Outdated DT detected, suspend/resume will NOT work\n"); |
111 | + of_node_put(np); |
112 | return; |
113 | } |
114 | + of_node_put(np); |
115 | |
116 | pm_data = (const struct exynos_pm_data *) match->data; |
117 | |
118 | diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h |
119 | index 5917147af0c4..9ee660013e5c 100644 |
120 | --- a/arch/arm64/include/asm/processor.h |
121 | +++ b/arch/arm64/include/asm/processor.h |
122 | @@ -49,7 +49,15 @@ |
123 | * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area. |
124 | */ |
125 | #ifdef CONFIG_COMPAT |
126 | +#ifdef CONFIG_ARM64_64K_PAGES |
127 | +/* |
128 | + * With CONFIG_ARM64_64K_PAGES enabled, the last page is occupied |
129 | + * by the compat vectors page. |
130 | + */ |
131 | #define TASK_SIZE_32 UL(0x100000000) |
132 | +#else |
133 | +#define TASK_SIZE_32 (UL(0x100000000) - PAGE_SIZE) |
134 | +#endif /* CONFIG_ARM64_64K_PAGES */ |
135 | #define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \ |
136 | TASK_SIZE_32 : TASK_SIZE_64) |
137 | #define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \ |
138 | diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c |
139 | index 73ae90ef434c..9f1adca3c346 100644 |
140 | --- a/arch/arm64/kernel/debug-monitors.c |
141 | +++ b/arch/arm64/kernel/debug-monitors.c |
142 | @@ -132,6 +132,7 @@ NOKPROBE_SYMBOL(disable_debug_monitors); |
143 | */ |
144 | static int clear_os_lock(unsigned int cpu) |
145 | { |
146 | + write_sysreg(0, osdlr_el1); |
147 | write_sysreg(0, oslar_el1); |
148 | isb(); |
149 | return 0; |
150 | diff --git a/arch/x86/crypto/crct10dif-pclmul_glue.c b/arch/x86/crypto/crct10dif-pclmul_glue.c |
151 | index cd4df9322501..7bbfe7d35da7 100644 |
152 | --- a/arch/x86/crypto/crct10dif-pclmul_glue.c |
153 | +++ b/arch/x86/crypto/crct10dif-pclmul_glue.c |
154 | @@ -76,15 +76,14 @@ static int chksum_final(struct shash_desc *desc, u8 *out) |
155 | return 0; |
156 | } |
157 | |
158 | -static int __chksum_finup(__u16 *crcp, const u8 *data, unsigned int len, |
159 | - u8 *out) |
160 | +static int __chksum_finup(__u16 crc, const u8 *data, unsigned int len, u8 *out) |
161 | { |
162 | if (irq_fpu_usable()) { |
163 | kernel_fpu_begin(); |
164 | - *(__u16 *)out = crc_t10dif_pcl(*crcp, data, len); |
165 | + *(__u16 *)out = crc_t10dif_pcl(crc, data, len); |
166 | kernel_fpu_end(); |
167 | } else |
168 | - *(__u16 *)out = crc_t10dif_generic(*crcp, data, len); |
169 | + *(__u16 *)out = crc_t10dif_generic(crc, data, len); |
170 | return 0; |
171 | } |
172 | |
173 | @@ -93,15 +92,13 @@ static int chksum_finup(struct shash_desc *desc, const u8 *data, |
174 | { |
175 | struct chksum_desc_ctx *ctx = shash_desc_ctx(desc); |
176 | |
177 | - return __chksum_finup(&ctx->crc, data, len, out); |
178 | + return __chksum_finup(ctx->crc, data, len, out); |
179 | } |
180 | |
181 | static int chksum_digest(struct shash_desc *desc, const u8 *data, |
182 | unsigned int length, u8 *out) |
183 | { |
184 | - struct chksum_desc_ctx *ctx = shash_desc_ctx(desc); |
185 | - |
186 | - return __chksum_finup(&ctx->crc, data, length, out); |
187 | + return __chksum_finup(0, data, length, out); |
188 | } |
189 | |
190 | static struct shash_alg alg = { |
191 | diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S |
192 | index a76dc738ec61..1cf16760f5e3 100644 |
193 | --- a/arch/x86/entry/entry_32.S |
194 | +++ b/arch/x86/entry/entry_32.S |
195 | @@ -219,6 +219,7 @@ ENTRY(__switch_to_asm) |
196 | pushl %ebx |
197 | pushl %edi |
198 | pushl %esi |
199 | + pushfl |
200 | |
201 | /* switch stack */ |
202 | movl %esp, TASK_threadsp(%eax) |
203 | @@ -241,6 +242,7 @@ ENTRY(__switch_to_asm) |
204 | #endif |
205 | |
206 | /* restore callee-saved registers */ |
207 | + popfl |
208 | popl %esi |
209 | popl %edi |
210 | popl %ebx |
211 | diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S |
212 | index 870e941c1947..8252d9dc48eb 100644 |
213 | --- a/arch/x86/entry/entry_64.S |
214 | +++ b/arch/x86/entry/entry_64.S |
215 | @@ -313,6 +313,7 @@ ENTRY(__switch_to_asm) |
216 | pushq %r13 |
217 | pushq %r14 |
218 | pushq %r15 |
219 | + pushfq |
220 | |
221 | /* switch stack */ |
222 | movq %rsp, TASK_threadsp(%rdi) |
223 | @@ -335,6 +336,7 @@ ENTRY(__switch_to_asm) |
224 | #endif |
225 | |
226 | /* restore callee-saved registers */ |
227 | + popfq |
228 | popq %r15 |
229 | popq %r14 |
230 | popq %r13 |
231 | diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h |
232 | index 676e84f521ba..e959b8d40473 100644 |
233 | --- a/arch/x86/include/asm/switch_to.h |
234 | +++ b/arch/x86/include/asm/switch_to.h |
235 | @@ -35,6 +35,7 @@ asmlinkage void ret_from_fork(void); |
236 | |
237 | /* data that is pointed to by thread.sp */ |
238 | struct inactive_task_frame { |
239 | + unsigned long flags; |
240 | #ifdef CONFIG_X86_64 |
241 | unsigned long r15; |
242 | unsigned long r14; |
243 | diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c |
244 | index 912246fd6cd9..4ca26fc7aa89 100644 |
245 | --- a/arch/x86/kernel/process_32.c |
246 | +++ b/arch/x86/kernel/process_32.c |
247 | @@ -129,6 +129,13 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp, |
248 | struct task_struct *tsk; |
249 | int err; |
250 | |
251 | + /* |
252 | + * For a new task use the RESET flags value since there is no before. |
253 | + * All the status flags are zero; DF and all the system flags must also |
254 | + * be 0, specifically IF must be 0 because we context switch to the new |
255 | + * task with interrupts disabled. |
256 | + */ |
257 | + frame->flags = X86_EFLAGS_FIXED; |
258 | frame->bp = 0; |
259 | frame->ret_addr = (unsigned long) ret_from_fork; |
260 | p->thread.sp = (unsigned long) fork_frame; |
261 | diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c |
262 | index 81eec65fe053..6d6c15cd9b9a 100644 |
263 | --- a/arch/x86/kernel/process_64.c |
264 | +++ b/arch/x86/kernel/process_64.c |
265 | @@ -268,6 +268,14 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp, |
266 | childregs = task_pt_regs(p); |
267 | fork_frame = container_of(childregs, struct fork_frame, regs); |
268 | frame = &fork_frame->frame; |
269 | + |
270 | + /* |
271 | + * For a new task use the RESET flags value since there is no before. |
272 | + * All the status flags are zero; DF and all the system flags must also |
273 | + * be 0, specifically IF must be 0 because we context switch to the new |
274 | + * task with interrupts disabled. |
275 | + */ |
276 | + frame->flags = X86_EFLAGS_FIXED; |
277 | frame->bp = 0; |
278 | frame->ret_addr = (unsigned long) ret_from_fork; |
279 | p->thread.sp = (unsigned long) fork_frame; |
280 | diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c |
281 | index ef225fa8e928..5bbfa2f63b8c 100644 |
282 | --- a/arch/x86/kernel/traps.c |
283 | +++ b/arch/x86/kernel/traps.c |
284 | @@ -62,7 +62,6 @@ |
285 | #include <asm/alternative.h> |
286 | #include <asm/fpu/xstate.h> |
287 | #include <asm/trace/mpx.h> |
288 | -#include <asm/nospec-branch.h> |
289 | #include <asm/mpx.h> |
290 | #include <asm/vm86.h> |
291 | |
292 | @@ -341,13 +340,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code) |
293 | regs->ip = (unsigned long)general_protection; |
294 | regs->sp = (unsigned long)&normal_regs->orig_ax; |
295 | |
296 | - /* |
297 | - * This situation can be triggered by userspace via |
298 | - * modify_ldt(2) and the return does not take the regular |
299 | - * user space exit, so a CPU buffer clear is required when |
300 | - * MDS mitigation is enabled. |
301 | - */ |
302 | - mds_user_clear_cpu_buffers(); |
303 | return; |
304 | } |
305 | #endif |
306 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c |
307 | index 8285142556b5..1f32c4e32a00 100644 |
308 | --- a/arch/x86/kvm/x86.c |
309 | +++ b/arch/x86/kvm/x86.c |
310 | @@ -1073,11 +1073,8 @@ static int do_get_msr_feature(struct kvm_vcpu *vcpu, unsigned index, u64 *data) |
311 | return 0; |
312 | } |
313 | |
314 | -bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) |
315 | +static bool __kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) |
316 | { |
317 | - if (efer & efer_reserved_bits) |
318 | - return false; |
319 | - |
320 | if (efer & EFER_FFXSR) { |
321 | struct kvm_cpuid_entry2 *feat; |
322 | |
323 | @@ -1095,19 +1092,33 @@ bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) |
324 | } |
325 | |
326 | return true; |
327 | + |
328 | +} |
329 | +bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) |
330 | +{ |
331 | + if (efer & efer_reserved_bits) |
332 | + return false; |
333 | + |
334 | + return __kvm_valid_efer(vcpu, efer); |
335 | } |
336 | EXPORT_SYMBOL_GPL(kvm_valid_efer); |
337 | |
338 | -static int set_efer(struct kvm_vcpu *vcpu, u64 efer) |
339 | +static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info) |
340 | { |
341 | u64 old_efer = vcpu->arch.efer; |
342 | + u64 efer = msr_info->data; |
343 | |
344 | - if (!kvm_valid_efer(vcpu, efer)) |
345 | - return 1; |
346 | + if (efer & efer_reserved_bits) |
347 | + return false; |
348 | |
349 | - if (is_paging(vcpu) |
350 | - && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) |
351 | - return 1; |
352 | + if (!msr_info->host_initiated) { |
353 | + if (!__kvm_valid_efer(vcpu, efer)) |
354 | + return 1; |
355 | + |
356 | + if (is_paging(vcpu) && |
357 | + (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) |
358 | + return 1; |
359 | + } |
360 | |
361 | efer &= ~EFER_LMA; |
362 | efer |= vcpu->arch.efer & EFER_LMA; |
363 | @@ -2203,7 +2214,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) |
364 | vcpu->arch.arch_capabilities = data; |
365 | break; |
366 | case MSR_EFER: |
367 | - return set_efer(vcpu, data); |
368 | + return set_efer(vcpu, msr_info); |
369 | case MSR_K7_HWCR: |
370 | data &= ~(u64)0x40; /* ignore flush filter disable */ |
371 | data &= ~(u64)0x100; /* ignore ignne emulation enable */ |
372 | diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c |
373 | index cb1c3a3287b0..246905bf00aa 100644 |
374 | --- a/crypto/chacha20poly1305.c |
375 | +++ b/crypto/chacha20poly1305.c |
376 | @@ -647,8 +647,8 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb, |
377 | |
378 | err = -ENAMETOOLONG; |
379 | if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, |
380 | - "%s(%s,%s)", name, chacha_name, |
381 | - poly_name) >= CRYPTO_MAX_ALG_NAME) |
382 | + "%s(%s,%s)", name, chacha->base.cra_name, |
383 | + poly->cra_name) >= CRYPTO_MAX_ALG_NAME) |
384 | goto out_drop_chacha; |
385 | if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, |
386 | "%s(%s,%s)", name, chacha->base.cra_driver_name, |
387 | diff --git a/crypto/crct10dif_generic.c b/crypto/crct10dif_generic.c |
388 | index 8e94e29dc6fc..d08048ae5552 100644 |
389 | --- a/crypto/crct10dif_generic.c |
390 | +++ b/crypto/crct10dif_generic.c |
391 | @@ -65,10 +65,9 @@ static int chksum_final(struct shash_desc *desc, u8 *out) |
392 | return 0; |
393 | } |
394 | |
395 | -static int __chksum_finup(__u16 *crcp, const u8 *data, unsigned int len, |
396 | - u8 *out) |
397 | +static int __chksum_finup(__u16 crc, const u8 *data, unsigned int len, u8 *out) |
398 | { |
399 | - *(__u16 *)out = crc_t10dif_generic(*crcp, data, len); |
400 | + *(__u16 *)out = crc_t10dif_generic(crc, data, len); |
401 | return 0; |
402 | } |
403 | |
404 | @@ -77,15 +76,13 @@ static int chksum_finup(struct shash_desc *desc, const u8 *data, |
405 | { |
406 | struct chksum_desc_ctx *ctx = shash_desc_ctx(desc); |
407 | |
408 | - return __chksum_finup(&ctx->crc, data, len, out); |
409 | + return __chksum_finup(ctx->crc, data, len, out); |
410 | } |
411 | |
412 | static int chksum_digest(struct shash_desc *desc, const u8 *data, |
413 | unsigned int length, u8 *out) |
414 | { |
415 | - struct chksum_desc_ctx *ctx = shash_desc_ctx(desc); |
416 | - |
417 | - return __chksum_finup(&ctx->crc, data, length, out); |
418 | + return __chksum_finup(0, data, length, out); |
419 | } |
420 | |
421 | static struct shash_alg alg = { |
422 | diff --git a/crypto/gcm.c b/crypto/gcm.c |
423 | index dd33fbd2d868..398f048c452a 100644 |
424 | --- a/crypto/gcm.c |
425 | +++ b/crypto/gcm.c |
426 | @@ -616,7 +616,6 @@ static void crypto_gcm_free(struct aead_instance *inst) |
427 | |
428 | static int crypto_gcm_create_common(struct crypto_template *tmpl, |
429 | struct rtattr **tb, |
430 | - const char *full_name, |
431 | const char *ctr_name, |
432 | const char *ghash_name) |
433 | { |
434 | @@ -657,7 +656,8 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl, |
435 | goto err_free_inst; |
436 | |
437 | err = -EINVAL; |
438 | - if (ghash->digestsize != 16) |
439 | + if (strcmp(ghash->base.cra_name, "ghash") != 0 || |
440 | + ghash->digestsize != 16) |
441 | goto err_drop_ghash; |
442 | |
443 | crypto_set_skcipher_spawn(&ctx->ctr, aead_crypto_instance(inst)); |
444 | @@ -669,24 +669,24 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl, |
445 | |
446 | ctr = crypto_spawn_skcipher_alg(&ctx->ctr); |
447 | |
448 | - /* We only support 16-byte blocks. */ |
449 | - if (crypto_skcipher_alg_ivsize(ctr) != 16) |
450 | - goto out_put_ctr; |
451 | - |
452 | - /* Not a stream cipher? */ |
453 | + /* The skcipher algorithm must be CTR mode, using 16-byte blocks. */ |
454 | err = -EINVAL; |
455 | - if (ctr->base.cra_blocksize != 1) |
456 | + if (strncmp(ctr->base.cra_name, "ctr(", 4) != 0 || |
457 | + crypto_skcipher_alg_ivsize(ctr) != 16 || |
458 | + ctr->base.cra_blocksize != 1) |
459 | goto out_put_ctr; |
460 | |
461 | err = -ENAMETOOLONG; |
462 | + if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, |
463 | + "gcm(%s", ctr->base.cra_name + 4) >= CRYPTO_MAX_ALG_NAME) |
464 | + goto out_put_ctr; |
465 | + |
466 | if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, |
467 | "gcm_base(%s,%s)", ctr->base.cra_driver_name, |
468 | ghash_alg->cra_driver_name) >= |
469 | CRYPTO_MAX_ALG_NAME) |
470 | goto out_put_ctr; |
471 | |
472 | - memcpy(inst->alg.base.cra_name, full_name, CRYPTO_MAX_ALG_NAME); |
473 | - |
474 | inst->alg.base.cra_flags = (ghash->base.cra_flags | |
475 | ctr->base.cra_flags) & CRYPTO_ALG_ASYNC; |
476 | inst->alg.base.cra_priority = (ghash->base.cra_priority + |
477 | @@ -728,7 +728,6 @@ static int crypto_gcm_create(struct crypto_template *tmpl, struct rtattr **tb) |
478 | { |
479 | const char *cipher_name; |
480 | char ctr_name[CRYPTO_MAX_ALG_NAME]; |
481 | - char full_name[CRYPTO_MAX_ALG_NAME]; |
482 | |
483 | cipher_name = crypto_attr_alg_name(tb[1]); |
484 | if (IS_ERR(cipher_name)) |
485 | @@ -738,12 +737,7 @@ static int crypto_gcm_create(struct crypto_template *tmpl, struct rtattr **tb) |
486 | CRYPTO_MAX_ALG_NAME) |
487 | return -ENAMETOOLONG; |
488 | |
489 | - if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm(%s)", cipher_name) >= |
490 | - CRYPTO_MAX_ALG_NAME) |
491 | - return -ENAMETOOLONG; |
492 | - |
493 | - return crypto_gcm_create_common(tmpl, tb, full_name, |
494 | - ctr_name, "ghash"); |
495 | + return crypto_gcm_create_common(tmpl, tb, ctr_name, "ghash"); |
496 | } |
497 | |
498 | static struct crypto_template crypto_gcm_tmpl = { |
499 | @@ -757,7 +751,6 @@ static int crypto_gcm_base_create(struct crypto_template *tmpl, |
500 | { |
501 | const char *ctr_name; |
502 | const char *ghash_name; |
503 | - char full_name[CRYPTO_MAX_ALG_NAME]; |
504 | |
505 | ctr_name = crypto_attr_alg_name(tb[1]); |
506 | if (IS_ERR(ctr_name)) |
507 | @@ -767,12 +760,7 @@ static int crypto_gcm_base_create(struct crypto_template *tmpl, |
508 | if (IS_ERR(ghash_name)) |
509 | return PTR_ERR(ghash_name); |
510 | |
511 | - if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm_base(%s,%s)", |
512 | - ctr_name, ghash_name) >= CRYPTO_MAX_ALG_NAME) |
513 | - return -ENAMETOOLONG; |
514 | - |
515 | - return crypto_gcm_create_common(tmpl, tb, full_name, |
516 | - ctr_name, ghash_name); |
517 | + return crypto_gcm_create_common(tmpl, tb, ctr_name, ghash_name); |
518 | } |
519 | |
520 | static struct crypto_template crypto_gcm_base_tmpl = { |
521 | diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c |
522 | index d7da0eea5622..319d9962552e 100644 |
523 | --- a/crypto/salsa20_generic.c |
524 | +++ b/crypto/salsa20_generic.c |
525 | @@ -186,7 +186,7 @@ static int encrypt(struct blkcipher_desc *desc, |
526 | blkcipher_walk_init(&walk, dst, src, nbytes); |
527 | err = blkcipher_walk_virt_block(desc, &walk, 64); |
528 | |
529 | - salsa20_ivsetup(ctx, walk.iv); |
530 | + salsa20_ivsetup(ctx, desc->info); |
531 | |
532 | while (walk.nbytes >= 64) { |
533 | salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, |
534 | diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c |
535 | index dac36ef450ba..996b9ae15404 100644 |
536 | --- a/drivers/char/ipmi/ipmi_ssif.c |
537 | +++ b/drivers/char/ipmi/ipmi_ssif.c |
538 | @@ -699,12 +699,16 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, |
539 | /* End of read */ |
540 | len = ssif_info->multi_len; |
541 | data = ssif_info->data; |
542 | - } else if (blocknum != ssif_info->multi_pos) { |
543 | + } else if (blocknum + 1 != ssif_info->multi_pos) { |
544 | /* |
545 | * Out of sequence block, just abort. Block |
546 | * numbers start at zero for the second block, |
547 | * but multi_pos starts at one, so the +1. |
548 | */ |
549 | + if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) |
550 | + dev_dbg(&ssif_info->client->dev, |
551 | + "Received message out of sequence, expected %u, got %u\n", |
552 | + ssif_info->multi_pos - 1, blocknum); |
553 | result = -EIO; |
554 | } else { |
555 | ssif_inc_stat(ssif_info, received_message_parts); |
556 | diff --git a/drivers/crypto/vmx/aesp8-ppc.pl b/drivers/crypto/vmx/aesp8-ppc.pl |
557 | index 0b4a293b8a1e..d9281a28818d 100644 |
558 | --- a/drivers/crypto/vmx/aesp8-ppc.pl |
559 | +++ b/drivers/crypto/vmx/aesp8-ppc.pl |
560 | @@ -1815,7 +1815,7 @@ Lctr32_enc8x_three: |
561 | stvx_u $out1,$x10,$out |
562 | stvx_u $out2,$x20,$out |
563 | addi $out,$out,0x30 |
564 | - b Lcbc_dec8x_done |
565 | + b Lctr32_enc8x_done |
566 | |
567 | .align 5 |
568 | Lctr32_enc8x_two: |
569 | @@ -1827,7 +1827,7 @@ Lctr32_enc8x_two: |
570 | stvx_u $out0,$x00,$out |
571 | stvx_u $out1,$x10,$out |
572 | addi $out,$out,0x20 |
573 | - b Lcbc_dec8x_done |
574 | + b Lctr32_enc8x_done |
575 | |
576 | .align 5 |
577 | Lctr32_enc8x_one: |
578 | diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c |
579 | index 08f20b7cd199..c76a0176b5c6 100644 |
580 | --- a/drivers/md/bcache/journal.c |
581 | +++ b/drivers/md/bcache/journal.c |
582 | @@ -513,11 +513,11 @@ static void journal_reclaim(struct cache_set *c) |
583 | ca->sb.nr_this_dev); |
584 | } |
585 | |
586 | - bkey_init(k); |
587 | - SET_KEY_PTRS(k, n); |
588 | - |
589 | - if (n) |
590 | + if (n) { |
591 | + bkey_init(k); |
592 | + SET_KEY_PTRS(k, n); |
593 | c->journal.blocks_free = c->sb.bucket_size >> c->block_bits; |
594 | + } |
595 | out: |
596 | if (!journal_full(&c->journal)) |
597 | __closure_wake_up(&c->journal.wait); |
598 | @@ -642,6 +642,9 @@ static void journal_write_unlocked(struct closure *cl) |
599 | ca->journal.seq[ca->journal.cur_idx] = w->data->seq; |
600 | } |
601 | |
602 | + /* If KEY_PTRS(k) == 0, this jset gets lost in air */ |
603 | + BUG_ON(i == 0); |
604 | + |
605 | atomic_dec_bug(&fifo_back(&c->journal.pin)); |
606 | bch_journal_next(&c->journal); |
607 | journal_reclaim(c); |
608 | diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c |
609 | index 894992ae9be0..362efc8dd16f 100644 |
610 | --- a/drivers/md/bcache/super.c |
611 | +++ b/drivers/md/bcache/super.c |
612 | @@ -1357,6 +1357,7 @@ static void cache_set_free(struct closure *cl) |
613 | bch_btree_cache_free(c); |
614 | bch_journal_free(c); |
615 | |
616 | + mutex_lock(&bch_register_lock); |
617 | for_each_cache(ca, c, i) |
618 | if (ca) { |
619 | ca->set = NULL; |
620 | @@ -1379,7 +1380,6 @@ static void cache_set_free(struct closure *cl) |
621 | mempool_destroy(c->search); |
622 | kfree(c->devices); |
623 | |
624 | - mutex_lock(&bch_register_lock); |
625 | list_del(&c->list); |
626 | mutex_unlock(&bch_register_lock); |
627 | |
628 | diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c |
629 | index b4d8ccfd9f7c..200b41576526 100644 |
630 | --- a/drivers/pci/host/pci-hyperv.c |
631 | +++ b/drivers/pci/host/pci-hyperv.c |
632 | @@ -1620,6 +1620,7 @@ static void hv_eject_device_work(struct work_struct *work) |
633 | spin_unlock_irqrestore(&hpdev->hbus->device_list_lock, flags); |
634 | |
635 | put_pcichild(hpdev, hv_pcidev_ref_childlist); |
636 | + put_pcichild(hpdev, hv_pcidev_ref_initial); |
637 | put_pcichild(hpdev, hv_pcidev_ref_pnp); |
638 | put_hvpcibus(hpdev->hbus); |
639 | } |
640 | diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c |
641 | index 75b8e0c7402b..8a0a8fb915d6 100644 |
642 | --- a/drivers/power/supply/axp288_charger.c |
643 | +++ b/drivers/power/supply/axp288_charger.c |
644 | @@ -899,6 +899,10 @@ static int axp288_charger_probe(struct platform_device *pdev) |
645 | /* Register charger interrupts */ |
646 | for (i = 0; i < CHRG_INTR_END; i++) { |
647 | pirq = platform_get_irq(info->pdev, i); |
648 | + if (pirq < 0) { |
649 | + dev_err(&pdev->dev, "Failed to get IRQ: %d\n", pirq); |
650 | + return pirq; |
651 | + } |
652 | info->irq[i] = regmap_irq_get_virq(info->regmap_irqc, pirq); |
653 | if (info->irq[i] < 0) { |
654 | dev_warn(&info->pdev->dev, |
655 | diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c |
656 | index ece10e6b731b..e8a917a23ed9 100644 |
657 | --- a/drivers/tty/vt/keyboard.c |
658 | +++ b/drivers/tty/vt/keyboard.c |
659 | @@ -121,6 +121,7 @@ static const int NR_TYPES = ARRAY_SIZE(max_vals); |
660 | static struct input_handler kbd_handler; |
661 | static DEFINE_SPINLOCK(kbd_event_lock); |
662 | static DEFINE_SPINLOCK(led_lock); |
663 | +static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */ |
664 | static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */ |
665 | static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */ |
666 | static bool dead_key_next; |
667 | @@ -1959,11 +1960,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) |
668 | char *p; |
669 | u_char *q; |
670 | u_char __user *up; |
671 | - int sz; |
672 | + int sz, fnw_sz; |
673 | int delta; |
674 | char *first_free, *fj, *fnw; |
675 | int i, j, k; |
676 | int ret; |
677 | + unsigned long flags; |
678 | |
679 | if (!capable(CAP_SYS_TTY_CONFIG)) |
680 | perm = 0; |
681 | @@ -2006,7 +2008,14 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) |
682 | goto reterr; |
683 | } |
684 | |
685 | + fnw = NULL; |
686 | + fnw_sz = 0; |
687 | + /* race aginst other writers */ |
688 | + again: |
689 | + spin_lock_irqsave(&func_buf_lock, flags); |
690 | q = func_table[i]; |
691 | + |
692 | + /* fj pointer to next entry after 'q' */ |
693 | first_free = funcbufptr + (funcbufsize - funcbufleft); |
694 | for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) |
695 | ; |
696 | @@ -2014,10 +2023,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) |
697 | fj = func_table[j]; |
698 | else |
699 | fj = first_free; |
700 | - |
701 | + /* buffer usage increase by new entry */ |
702 | delta = (q ? -strlen(q) : 1) + strlen(kbs->kb_string); |
703 | + |
704 | if (delta <= funcbufleft) { /* it fits in current buf */ |
705 | if (j < MAX_NR_FUNC) { |
706 | + /* make enough space for new entry at 'fj' */ |
707 | memmove(fj + delta, fj, first_free - fj); |
708 | for (k = j; k < MAX_NR_FUNC; k++) |
709 | if (func_table[k]) |
710 | @@ -2030,20 +2041,28 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) |
711 | sz = 256; |
712 | while (sz < funcbufsize - funcbufleft + delta) |
713 | sz <<= 1; |
714 | - fnw = kmalloc(sz, GFP_KERNEL); |
715 | - if(!fnw) { |
716 | - ret = -ENOMEM; |
717 | - goto reterr; |
718 | + if (fnw_sz != sz) { |
719 | + spin_unlock_irqrestore(&func_buf_lock, flags); |
720 | + kfree(fnw); |
721 | + fnw = kmalloc(sz, GFP_KERNEL); |
722 | + fnw_sz = sz; |
723 | + if (!fnw) { |
724 | + ret = -ENOMEM; |
725 | + goto reterr; |
726 | + } |
727 | + goto again; |
728 | } |
729 | |
730 | if (!q) |
731 | func_table[i] = fj; |
732 | + /* copy data before insertion point to new location */ |
733 | if (fj > funcbufptr) |
734 | memmove(fnw, funcbufptr, fj - funcbufptr); |
735 | for (k = 0; k < j; k++) |
736 | if (func_table[k]) |
737 | func_table[k] = fnw + (func_table[k] - funcbufptr); |
738 | |
739 | + /* copy data after insertion point to new location */ |
740 | if (first_free > fj) { |
741 | memmove(fnw + (fj - funcbufptr) + delta, fj, first_free - fj); |
742 | for (k = j; k < MAX_NR_FUNC; k++) |
743 | @@ -2056,7 +2075,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) |
744 | funcbufleft = funcbufleft - delta + sz - funcbufsize; |
745 | funcbufsize = sz; |
746 | } |
747 | + /* finally insert item itself */ |
748 | strcpy(func_table[i], kbs->kb_string); |
749 | + spin_unlock_irqrestore(&func_buf_lock, flags); |
750 | break; |
751 | } |
752 | ret = 0; |
753 | diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c |
754 | index 85dc7ab8f89e..2973d256bb44 100644 |
755 | --- a/fs/btrfs/backref.c |
756 | +++ b/fs/btrfs/backref.c |
757 | @@ -2018,13 +2018,19 @@ int iterate_extent_inodes(struct btrfs_fs_info *fs_info, |
758 | extent_item_objectid); |
759 | |
760 | if (!search_commit_root) { |
761 | - trans = btrfs_join_transaction(fs_info->extent_root); |
762 | - if (IS_ERR(trans)) |
763 | - return PTR_ERR(trans); |
764 | + trans = btrfs_attach_transaction(fs_info->extent_root); |
765 | + if (IS_ERR(trans)) { |
766 | + if (PTR_ERR(trans) != -ENOENT && |
767 | + PTR_ERR(trans) != -EROFS) |
768 | + return PTR_ERR(trans); |
769 | + trans = NULL; |
770 | + } |
771 | + } |
772 | + |
773 | + if (trans) |
774 | btrfs_get_tree_mod_seq(fs_info, &tree_mod_seq_elem); |
775 | - } else { |
776 | + else |
777 | down_read(&fs_info->commit_root_sem); |
778 | - } |
779 | |
780 | ret = btrfs_find_all_leafs(trans, fs_info, extent_item_objectid, |
781 | tree_mod_seq_elem.seq, &refs, |
782 | @@ -2056,7 +2062,7 @@ int iterate_extent_inodes(struct btrfs_fs_info *fs_info, |
783 | |
784 | free_leaf_list(refs); |
785 | out: |
786 | - if (!search_commit_root) { |
787 | + if (trans) { |
788 | btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem); |
789 | btrfs_end_transaction(trans, fs_info->extent_root); |
790 | } else { |
791 | diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c |
792 | index 106a5bb3ae68..b2ba9955fa11 100644 |
793 | --- a/fs/ext4/extents.c |
794 | +++ b/fs/ext4/extents.c |
795 | @@ -1047,6 +1047,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, |
796 | __le32 border; |
797 | ext4_fsblk_t *ablocks = NULL; /* array of allocated blocks */ |
798 | int err = 0; |
799 | + size_t ext_size = 0; |
800 | |
801 | /* make decision: where to split? */ |
802 | /* FIXME: now decision is simplest: at current extent */ |
803 | @@ -1138,6 +1139,10 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, |
804 | le16_add_cpu(&neh->eh_entries, m); |
805 | } |
806 | |
807 | + /* zero out unused area in the extent block */ |
808 | + ext_size = sizeof(struct ext4_extent_header) + |
809 | + sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries); |
810 | + memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size); |
811 | ext4_extent_block_csum_set(inode, neh); |
812 | set_buffer_uptodate(bh); |
813 | unlock_buffer(bh); |
814 | @@ -1217,6 +1222,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, |
815 | sizeof(struct ext4_extent_idx) * m); |
816 | le16_add_cpu(&neh->eh_entries, m); |
817 | } |
818 | + /* zero out unused area in the extent block */ |
819 | + ext_size = sizeof(struct ext4_extent_header) + |
820 | + (sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries)); |
821 | + memset(bh->b_data + ext_size, 0, |
822 | + inode->i_sb->s_blocksize - ext_size); |
823 | ext4_extent_block_csum_set(inode, neh); |
824 | set_buffer_uptodate(bh); |
825 | unlock_buffer(bh); |
826 | @@ -1282,6 +1292,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode, |
827 | ext4_fsblk_t newblock, goal = 0; |
828 | struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es; |
829 | int err = 0; |
830 | + size_t ext_size = 0; |
831 | |
832 | /* Try to prepend new index to old one */ |
833 | if (ext_depth(inode)) |
834 | @@ -1307,9 +1318,11 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode, |
835 | goto out; |
836 | } |
837 | |
838 | + ext_size = sizeof(EXT4_I(inode)->i_data); |
839 | /* move top-level index/leaf into new block */ |
840 | - memmove(bh->b_data, EXT4_I(inode)->i_data, |
841 | - sizeof(EXT4_I(inode)->i_data)); |
842 | + memmove(bh->b_data, EXT4_I(inode)->i_data, ext_size); |
843 | + /* zero out unused area in the extent block */ |
844 | + memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size); |
845 | |
846 | /* set size of new block */ |
847 | neh = ext_block_hdr(bh); |
848 | diff --git a/fs/ext4/file.c b/fs/ext4/file.c |
849 | index fe76d0957a1f..59d3ea7094a0 100644 |
850 | --- a/fs/ext4/file.c |
851 | +++ b/fs/ext4/file.c |
852 | @@ -163,6 +163,13 @@ ext4_file_write_iter(struct kiocb *iocb, struct iov_iter *from) |
853 | } |
854 | |
855 | ret = __generic_file_write_iter(iocb, from); |
856 | + /* |
857 | + * Unaligned direct AIO must be the only IO in flight. Otherwise |
858 | + * overlapping aligned IO after unaligned might result in data |
859 | + * corruption. |
860 | + */ |
861 | + if (ret == -EIOCBQUEUED && unaligned_aio) |
862 | + ext4_unwritten_wait(inode); |
863 | inode_unlock(inode); |
864 | |
865 | if (ret > 0) |
866 | diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c |
867 | index 2ce73287b53c..baa2f6375226 100644 |
868 | --- a/fs/ext4/ioctl.c |
869 | +++ b/fs/ext4/ioctl.c |
870 | @@ -727,7 +727,7 @@ group_add_out: |
871 | if (err == 0) |
872 | err = err2; |
873 | mnt_drop_write_file(filp); |
874 | - if (!err && (o_group > EXT4_SB(sb)->s_groups_count) && |
875 | + if (!err && (o_group < EXT4_SB(sb)->s_groups_count) && |
876 | ext4_has_group_desc_csum(sb) && |
877 | test_opt(sb, INIT_INODE_TABLE)) |
878 | err = ext4_register_li_request(sb, o_group); |
879 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c |
880 | index a6c7ace9cfd1..3261478bfc32 100644 |
881 | --- a/fs/ext4/super.c |
882 | +++ b/fs/ext4/super.c |
883 | @@ -4034,7 +4034,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) |
884 | "data=, fs mounted w/o journal"); |
885 | goto failed_mount_wq; |
886 | } |
887 | - sbi->s_def_mount_opt &= EXT4_MOUNT_JOURNAL_CHECKSUM; |
888 | + sbi->s_def_mount_opt &= ~EXT4_MOUNT_JOURNAL_CHECKSUM; |
889 | clear_opt(sb, JOURNAL_CHECKSUM); |
890 | clear_opt(sb, DATA_FLAGS); |
891 | sbi->s_journal = NULL; |
892 | diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c |
893 | index f3aea1b8702c..8b93d4b98428 100644 |
894 | --- a/fs/fs-writeback.c |
895 | +++ b/fs/fs-writeback.c |
896 | @@ -331,11 +331,22 @@ struct inode_switch_wbs_context { |
897 | struct work_struct work; |
898 | }; |
899 | |
900 | +static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) |
901 | +{ |
902 | + down_write(&bdi->wb_switch_rwsem); |
903 | +} |
904 | + |
905 | +static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) |
906 | +{ |
907 | + up_write(&bdi->wb_switch_rwsem); |
908 | +} |
909 | + |
910 | static void inode_switch_wbs_work_fn(struct work_struct *work) |
911 | { |
912 | struct inode_switch_wbs_context *isw = |
913 | container_of(work, struct inode_switch_wbs_context, work); |
914 | struct inode *inode = isw->inode; |
915 | + struct backing_dev_info *bdi = inode_to_bdi(inode); |
916 | struct address_space *mapping = inode->i_mapping; |
917 | struct bdi_writeback *old_wb = inode->i_wb; |
918 | struct bdi_writeback *new_wb = isw->new_wb; |
919 | @@ -343,6 +354,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) |
920 | bool switched = false; |
921 | void **slot; |
922 | |
923 | + /* |
924 | + * If @inode switches cgwb membership while sync_inodes_sb() is |
925 | + * being issued, sync_inodes_sb() might miss it. Synchronize. |
926 | + */ |
927 | + down_read(&bdi->wb_switch_rwsem); |
928 | + |
929 | /* |
930 | * By the time control reaches here, RCU grace period has passed |
931 | * since I_WB_SWITCH assertion and all wb stat update transactions |
932 | @@ -435,6 +452,8 @@ skip_switch: |
933 | spin_unlock(&new_wb->list_lock); |
934 | spin_unlock(&old_wb->list_lock); |
935 | |
936 | + up_read(&bdi->wb_switch_rwsem); |
937 | + |
938 | if (switched) { |
939 | wb_wakeup(new_wb); |
940 | wb_put(old_wb); |
941 | @@ -475,9 +494,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) |
942 | if (inode->i_state & I_WB_SWITCH) |
943 | return; |
944 | |
945 | + /* |
946 | + * Avoid starting new switches while sync_inodes_sb() is in |
947 | + * progress. Otherwise, if the down_write protected issue path |
948 | + * blocks heavily, we might end up starting a large number of |
949 | + * switches which will block on the rwsem. |
950 | + */ |
951 | + if (!down_read_trylock(&bdi->wb_switch_rwsem)) |
952 | + return; |
953 | + |
954 | isw = kzalloc(sizeof(*isw), GFP_ATOMIC); |
955 | if (!isw) |
956 | - return; |
957 | + goto out_unlock; |
958 | |
959 | /* find and pin the new wb */ |
960 | rcu_read_lock(); |
961 | @@ -502,8 +530,6 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) |
962 | |
963 | isw->inode = inode; |
964 | |
965 | - atomic_inc(&isw_nr_in_flight); |
966 | - |
967 | /* |
968 | * In addition to synchronizing among switchers, I_WB_SWITCH tells |
969 | * the RCU protected stat update paths to grab the mapping's |
970 | @@ -511,12 +537,17 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) |
971 | * Let's continue after I_WB_SWITCH is guaranteed to be visible. |
972 | */ |
973 | call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn); |
974 | - return; |
975 | + |
976 | + atomic_inc(&isw_nr_in_flight); |
977 | + |
978 | + goto out_unlock; |
979 | |
980 | out_free: |
981 | if (isw->new_wb) |
982 | wb_put(isw->new_wb); |
983 | kfree(isw); |
984 | +out_unlock: |
985 | + up_read(&bdi->wb_switch_rwsem); |
986 | } |
987 | |
988 | /** |
989 | @@ -878,7 +909,11 @@ restart: |
990 | void cgroup_writeback_umount(void) |
991 | { |
992 | if (atomic_read(&isw_nr_in_flight)) { |
993 | - synchronize_rcu(); |
994 | + /* |
995 | + * Use rcu_barrier() to wait for all pending callbacks to |
996 | + * ensure that all in-flight wb switches are in the workqueue. |
997 | + */ |
998 | + rcu_barrier(); |
999 | flush_workqueue(isw_wq); |
1000 | } |
1001 | } |
1002 | @@ -894,6 +929,9 @@ fs_initcall(cgroup_writeback_init); |
1003 | |
1004 | #else /* CONFIG_CGROUP_WRITEBACK */ |
1005 | |
1006 | +static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } |
1007 | +static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } |
1008 | + |
1009 | static struct bdi_writeback * |
1010 | locked_inode_to_wb_and_lock_list(struct inode *inode) |
1011 | __releases(&inode->i_lock) |
1012 | @@ -2408,8 +2446,11 @@ void sync_inodes_sb(struct super_block *sb) |
1013 | return; |
1014 | WARN_ON(!rwsem_is_locked(&sb->s_umount)); |
1015 | |
1016 | + /* protect against inode wb switch, see inode_switch_wbs_work_fn() */ |
1017 | + bdi_down_write_wb_switch_rwsem(bdi); |
1018 | bdi_split_work_to_wbs(bdi, &work, false); |
1019 | wb_wait_for_completion(bdi, &done); |
1020 | + bdi_up_write_wb_switch_rwsem(bdi); |
1021 | |
1022 | wait_sb_inodes(sb); |
1023 | } |
1024 | diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c |
1025 | index d10bb2c30bf8..3cbcf649ac66 100644 |
1026 | --- a/fs/jbd2/journal.c |
1027 | +++ b/fs/jbd2/journal.c |
1028 | @@ -1339,6 +1339,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) |
1029 | journal_superblock_t *sb = journal->j_superblock; |
1030 | int ret; |
1031 | |
1032 | + /* Buffer got discarded which means block device got invalidated */ |
1033 | + if (!buffer_mapped(bh)) |
1034 | + return -EIO; |
1035 | + |
1036 | trace_jbd2_write_superblock(journal, write_flags); |
1037 | if (!(journal->j_flags & JBD2_BARRIER)) |
1038 | write_flags &= ~(REQ_FUA | REQ_PREFLUSH); |
1039 | diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c |
1040 | index 3494e220b510..bed15dec3c16 100644 |
1041 | --- a/fs/ocfs2/export.c |
1042 | +++ b/fs/ocfs2/export.c |
1043 | @@ -148,16 +148,24 @@ static struct dentry *ocfs2_get_parent(struct dentry *child) |
1044 | u64 blkno; |
1045 | struct dentry *parent; |
1046 | struct inode *dir = d_inode(child); |
1047 | + int set; |
1048 | |
1049 | trace_ocfs2_get_parent(child, child->d_name.len, child->d_name.name, |
1050 | (unsigned long long)OCFS2_I(dir)->ip_blkno); |
1051 | |
1052 | + status = ocfs2_nfs_sync_lock(OCFS2_SB(dir->i_sb), 1); |
1053 | + if (status < 0) { |
1054 | + mlog(ML_ERROR, "getting nfs sync lock(EX) failed %d\n", status); |
1055 | + parent = ERR_PTR(status); |
1056 | + goto bail; |
1057 | + } |
1058 | + |
1059 | status = ocfs2_inode_lock(dir, NULL, 0); |
1060 | if (status < 0) { |
1061 | if (status != -ENOENT) |
1062 | mlog_errno(status); |
1063 | parent = ERR_PTR(status); |
1064 | - goto bail; |
1065 | + goto unlock_nfs_sync; |
1066 | } |
1067 | |
1068 | status = ocfs2_lookup_ino_from_name(dir, "..", 2, &blkno); |
1069 | @@ -166,11 +174,31 @@ static struct dentry *ocfs2_get_parent(struct dentry *child) |
1070 | goto bail_unlock; |
1071 | } |
1072 | |
1073 | + status = ocfs2_test_inode_bit(OCFS2_SB(dir->i_sb), blkno, &set); |
1074 | + if (status < 0) { |
1075 | + if (status == -EINVAL) { |
1076 | + status = -ESTALE; |
1077 | + } else |
1078 | + mlog(ML_ERROR, "test inode bit failed %d\n", status); |
1079 | + parent = ERR_PTR(status); |
1080 | + goto bail_unlock; |
1081 | + } |
1082 | + |
1083 | + trace_ocfs2_get_dentry_test_bit(status, set); |
1084 | + if (!set) { |
1085 | + status = -ESTALE; |
1086 | + parent = ERR_PTR(status); |
1087 | + goto bail_unlock; |
1088 | + } |
1089 | + |
1090 | parent = d_obtain_alias(ocfs2_iget(OCFS2_SB(dir->i_sb), blkno, 0, 0)); |
1091 | |
1092 | bail_unlock: |
1093 | ocfs2_inode_unlock(dir, 0); |
1094 | |
1095 | +unlock_nfs_sync: |
1096 | + ocfs2_nfs_sync_unlock(OCFS2_SB(dir->i_sb), 1); |
1097 | + |
1098 | bail: |
1099 | trace_ocfs2_get_parent_end(parent); |
1100 | |
1101 | diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h |
1102 | index 4ea779b25a51..34056ec64c7c 100644 |
1103 | --- a/include/linux/backing-dev-defs.h |
1104 | +++ b/include/linux/backing-dev-defs.h |
1105 | @@ -157,6 +157,7 @@ struct backing_dev_info { |
1106 | struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */ |
1107 | struct rb_root cgwb_congested_tree; /* their congested states */ |
1108 | atomic_t usage_cnt; /* counts both cgwbs and cgwb_contested's */ |
1109 | + struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */ |
1110 | #else |
1111 | struct bdi_writeback_congested *wb_congested; |
1112 | #endif |
1113 | diff --git a/include/linux/list.h b/include/linux/list.h |
1114 | index 5809e9a2de5b..6f935018ea05 100644 |
1115 | --- a/include/linux/list.h |
1116 | +++ b/include/linux/list.h |
1117 | @@ -271,6 +271,36 @@ static inline void list_cut_position(struct list_head *list, |
1118 | __list_cut_position(list, head, entry); |
1119 | } |
1120 | |
1121 | +/** |
1122 | + * list_cut_before - cut a list into two, before given entry |
1123 | + * @list: a new list to add all removed entries |
1124 | + * @head: a list with entries |
1125 | + * @entry: an entry within head, could be the head itself |
1126 | + * |
1127 | + * This helper moves the initial part of @head, up to but |
1128 | + * excluding @entry, from @head to @list. You should pass |
1129 | + * in @entry an element you know is on @head. @list should |
1130 | + * be an empty list or a list you do not care about losing |
1131 | + * its data. |
1132 | + * If @entry == @head, all entries on @head are moved to |
1133 | + * @list. |
1134 | + */ |
1135 | +static inline void list_cut_before(struct list_head *list, |
1136 | + struct list_head *head, |
1137 | + struct list_head *entry) |
1138 | +{ |
1139 | + if (head->next == entry) { |
1140 | + INIT_LIST_HEAD(list); |
1141 | + return; |
1142 | + } |
1143 | + list->next = head->next; |
1144 | + list->next->prev = list; |
1145 | + list->prev = entry->prev; |
1146 | + list->prev->next = list; |
1147 | + head->next = entry; |
1148 | + entry->prev = head; |
1149 | +} |
1150 | + |
1151 | static inline void __list_splice(const struct list_head *list, |
1152 | struct list_head *prev, |
1153 | struct list_head *next) |
1154 | diff --git a/include/linux/mfd/da9063/registers.h b/include/linux/mfd/da9063/registers.h |
1155 | index 5d42859cb441..844fc2973392 100644 |
1156 | --- a/include/linux/mfd/da9063/registers.h |
1157 | +++ b/include/linux/mfd/da9063/registers.h |
1158 | @@ -215,9 +215,9 @@ |
1159 | |
1160 | /* DA9063 Configuration registers */ |
1161 | /* OTP */ |
1162 | -#define DA9063_REG_OPT_COUNT 0x101 |
1163 | -#define DA9063_REG_OPT_ADDR 0x102 |
1164 | -#define DA9063_REG_OPT_DATA 0x103 |
1165 | +#define DA9063_REG_OTP_CONT 0x101 |
1166 | +#define DA9063_REG_OTP_ADDR 0x102 |
1167 | +#define DA9063_REG_OTP_DATA 0x103 |
1168 | |
1169 | /* Customer Trim and Configuration */ |
1170 | #define DA9063_REG_T_OFFSET 0x104 |
1171 | diff --git a/include/linux/mfd/max77620.h b/include/linux/mfd/max77620.h |
1172 | index 3ca0af07fc78..0a68dc8fc25f 100644 |
1173 | --- a/include/linux/mfd/max77620.h |
1174 | +++ b/include/linux/mfd/max77620.h |
1175 | @@ -136,8 +136,8 @@ |
1176 | #define MAX77620_FPS_PERIOD_MIN_US 40 |
1177 | #define MAX20024_FPS_PERIOD_MIN_US 20 |
1178 | |
1179 | -#define MAX77620_FPS_PERIOD_MAX_US 2560 |
1180 | -#define MAX20024_FPS_PERIOD_MAX_US 5120 |
1181 | +#define MAX20024_FPS_PERIOD_MAX_US 2560 |
1182 | +#define MAX77620_FPS_PERIOD_MAX_US 5120 |
1183 | |
1184 | #define MAX77620_REG_FPS_GPIO1 0x54 |
1185 | #define MAX77620_REG_FPS_GPIO2 0x55 |
1186 | diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c |
1187 | index be06c45cbe4f..0cdbb636e316 100644 |
1188 | --- a/kernel/locking/rwsem-xadd.c |
1189 | +++ b/kernel/locking/rwsem-xadd.c |
1190 | @@ -127,6 +127,7 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, |
1191 | { |
1192 | struct rwsem_waiter *waiter, *tmp; |
1193 | long oldcount, woken = 0, adjustment = 0; |
1194 | + struct list_head wlist; |
1195 | |
1196 | /* |
1197 | * Take a peek at the queue head waiter such that we can determine |
1198 | @@ -185,18 +186,42 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, |
1199 | * of the queue. We know that woken will be at least 1 as we accounted |
1200 | * for above. Note we increment the 'active part' of the count by the |
1201 | * number of readers before waking any processes up. |
1202 | + * |
1203 | + * We have to do wakeup in 2 passes to prevent the possibility that |
1204 | + * the reader count may be decremented before it is incremented. It |
1205 | + * is because the to-be-woken waiter may not have slept yet. So it |
1206 | + * may see waiter->task got cleared, finish its critical section and |
1207 | + * do an unlock before the reader count increment. |
1208 | + * |
1209 | + * 1) Collect the read-waiters in a separate list, count them and |
1210 | + * fully increment the reader count in rwsem. |
1211 | + * 2) For each waiters in the new list, clear waiter->task and |
1212 | + * put them into wake_q to be woken up later. |
1213 | */ |
1214 | - list_for_each_entry_safe(waiter, tmp, &sem->wait_list, list) { |
1215 | - struct task_struct *tsk; |
1216 | - |
1217 | + list_for_each_entry(waiter, &sem->wait_list, list) { |
1218 | if (waiter->type == RWSEM_WAITING_FOR_WRITE) |
1219 | break; |
1220 | |
1221 | woken++; |
1222 | - tsk = waiter->task; |
1223 | + } |
1224 | + list_cut_before(&wlist, &sem->wait_list, &waiter->list); |
1225 | + |
1226 | + adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment; |
1227 | + if (list_empty(&sem->wait_list)) { |
1228 | + /* hit end of list above */ |
1229 | + adjustment -= RWSEM_WAITING_BIAS; |
1230 | + } |
1231 | + |
1232 | + if (adjustment) |
1233 | + atomic_long_add(adjustment, &sem->count); |
1234 | + |
1235 | + /* 2nd pass */ |
1236 | + list_for_each_entry_safe(waiter, tmp, &wlist, list) { |
1237 | + struct task_struct *tsk; |
1238 | |
1239 | + tsk = waiter->task; |
1240 | get_task_struct(tsk); |
1241 | - list_del(&waiter->list); |
1242 | + |
1243 | /* |
1244 | * Ensure calling get_task_struct() before setting the reader |
1245 | * waiter to nil such that rwsem_down_read_failed() cannot |
1246 | @@ -212,15 +237,6 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, |
1247 | /* wake_q_add() already take the task ref */ |
1248 | put_task_struct(tsk); |
1249 | } |
1250 | - |
1251 | - adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment; |
1252 | - if (list_empty(&sem->wait_list)) { |
1253 | - /* hit end of list above */ |
1254 | - adjustment -= RWSEM_WAITING_BIAS; |
1255 | - } |
1256 | - |
1257 | - if (adjustment) |
1258 | - atomic_long_add(adjustment, &sem->count); |
1259 | } |
1260 | |
1261 | /* |
1262 | diff --git a/mm/backing-dev.c b/mm/backing-dev.c |
1263 | index 6ff2d7744223..113b7d317079 100644 |
1264 | --- a/mm/backing-dev.c |
1265 | +++ b/mm/backing-dev.c |
1266 | @@ -669,6 +669,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi) |
1267 | INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC); |
1268 | bdi->cgwb_congested_tree = RB_ROOT; |
1269 | atomic_set(&bdi->usage_cnt, 1); |
1270 | + init_rwsem(&bdi->wb_switch_rwsem); |
1271 | |
1272 | ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL); |
1273 | if (!ret) { |
1274 | diff --git a/mm/mincore.c b/mm/mincore.c |
1275 | index bfb866435478..3b6a883d0926 100644 |
1276 | --- a/mm/mincore.c |
1277 | +++ b/mm/mincore.c |
1278 | @@ -167,6 +167,22 @@ out: |
1279 | return 0; |
1280 | } |
1281 | |
1282 | +static inline bool can_do_mincore(struct vm_area_struct *vma) |
1283 | +{ |
1284 | + if (vma_is_anonymous(vma)) |
1285 | + return true; |
1286 | + if (!vma->vm_file) |
1287 | + return false; |
1288 | + /* |
1289 | + * Reveal pagecache information only for non-anonymous mappings that |
1290 | + * correspond to the files the calling process could (if tried) open |
1291 | + * for writing; otherwise we'd be including shared non-exclusive |
1292 | + * mappings, which opens a side channel. |
1293 | + */ |
1294 | + return inode_owner_or_capable(file_inode(vma->vm_file)) || |
1295 | + inode_permission(file_inode(vma->vm_file), MAY_WRITE) == 0; |
1296 | +} |
1297 | + |
1298 | /* |
1299 | * Do a chunk of "sys_mincore()". We've already checked |
1300 | * all the arguments, we hold the mmap semaphore: we should |
1301 | @@ -187,8 +203,13 @@ static long do_mincore(unsigned long addr, unsigned long pages, unsigned char *v |
1302 | vma = find_vma(current->mm, addr); |
1303 | if (!vma || addr < vma->vm_start) |
1304 | return -ENOMEM; |
1305 | - mincore_walk.mm = vma->vm_mm; |
1306 | end = min(vma->vm_end, addr + (pages << PAGE_SHIFT)); |
1307 | + if (!can_do_mincore(vma)) { |
1308 | + unsigned long pages = DIV_ROUND_UP(end - addr, PAGE_SIZE); |
1309 | + memset(vec, 1, pages); |
1310 | + return pages; |
1311 | + } |
1312 | + mincore_walk.mm = vma->vm_mm; |
1313 | err = walk_page_range(addr, end, &mincore_walk); |
1314 | if (err < 0) |
1315 | return err; |
1316 | diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c |
1317 | index bb26457e8c21..c03dd2104d33 100644 |
1318 | --- a/net/core/fib_rules.c |
1319 | +++ b/net/core/fib_rules.c |
1320 | @@ -430,6 +430,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh) |
1321 | goto errout_free; |
1322 | |
1323 | if (rule_exists(ops, frh, tb, rule)) { |
1324 | + err = 0; |
1325 | if (nlh->nlmsg_flags & NLM_F_EXCL) |
1326 | err = -EEXIST; |
1327 | goto errout_free; |
1328 | diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c |
1329 | index 76ae627e3f93..7a2943a338bf 100644 |
1330 | --- a/sound/pci/hda/patch_hdmi.c |
1331 | +++ b/sound/pci/hda/patch_hdmi.c |
1332 | @@ -1447,9 +1447,11 @@ static bool hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin, |
1333 | ret = !repoll || !eld->monitor_present || eld->eld_valid; |
1334 | |
1335 | jack = snd_hda_jack_tbl_get(codec, pin_nid); |
1336 | - if (jack) |
1337 | + if (jack) { |
1338 | jack->block_report = !ret; |
1339 | - |
1340 | + jack->pin_sense = (eld->monitor_present && eld->eld_valid) ? |
1341 | + AC_PINSENSE_PRESENCE : 0; |
1342 | + } |
1343 | mutex_unlock(&per_pin->lock); |
1344 | return ret; |
1345 | } |
1346 | @@ -1554,6 +1556,11 @@ static void hdmi_repoll_eld(struct work_struct *work) |
1347 | container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work); |
1348 | struct hda_codec *codec = per_pin->codec; |
1349 | struct hdmi_spec *spec = codec->spec; |
1350 | + struct hda_jack_tbl *jack; |
1351 | + |
1352 | + jack = snd_hda_jack_tbl_get(codec, per_pin->pin_nid); |
1353 | + if (jack) |
1354 | + jack->jack_dirty = 1; |
1355 | |
1356 | if (per_pin->repoll_count++ > 6) |
1357 | per_pin->repoll_count = 0; |
1358 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
1359 | index 0fc05ebdf81a..822650d907fa 100644 |
1360 | --- a/sound/pci/hda/patch_realtek.c |
1361 | +++ b/sound/pci/hda/patch_realtek.c |
1362 | @@ -773,11 +773,10 @@ static int alc_init(struct hda_codec *codec) |
1363 | if (spec->init_hook) |
1364 | spec->init_hook(codec); |
1365 | |
1366 | + snd_hda_gen_init(codec); |
1367 | alc_fix_pll(codec); |
1368 | alc_auto_init_amp(codec, spec->init_amp); |
1369 | |
1370 | - snd_hda_gen_init(codec); |
1371 | - |
1372 | snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT); |
1373 | |
1374 | return 0; |
1375 | @@ -5855,7 +5854,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { |
1376 | SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), |
1377 | SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), |
1378 | SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), |
1379 | - SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), |
1380 | + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), |
1381 | SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), |
1382 | SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC), |
1383 | SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK), |
1384 | diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c |
1385 | index 584aab83e478..3e65dc74eb33 100644 |
1386 | --- a/sound/soc/codecs/max98090.c |
1387 | +++ b/sound/soc/codecs/max98090.c |
1388 | @@ -1209,14 +1209,14 @@ static const struct snd_soc_dapm_widget max98090_dapm_widgets[] = { |
1389 | &max98090_right_rcv_mixer_controls[0], |
1390 | ARRAY_SIZE(max98090_right_rcv_mixer_controls)), |
1391 | |
1392 | - SND_SOC_DAPM_MUX("LINMOD Mux", M98090_REG_LOUTR_MIXER, |
1393 | - M98090_LINMOD_SHIFT, 0, &max98090_linmod_mux), |
1394 | + SND_SOC_DAPM_MUX("LINMOD Mux", SND_SOC_NOPM, 0, 0, |
1395 | + &max98090_linmod_mux), |
1396 | |
1397 | - SND_SOC_DAPM_MUX("MIXHPLSEL Mux", M98090_REG_HP_CONTROL, |
1398 | - M98090_MIXHPLSEL_SHIFT, 0, &max98090_mixhplsel_mux), |
1399 | + SND_SOC_DAPM_MUX("MIXHPLSEL Mux", SND_SOC_NOPM, 0, 0, |
1400 | + &max98090_mixhplsel_mux), |
1401 | |
1402 | - SND_SOC_DAPM_MUX("MIXHPRSEL Mux", M98090_REG_HP_CONTROL, |
1403 | - M98090_MIXHPRSEL_SHIFT, 0, &max98090_mixhprsel_mux), |
1404 | + SND_SOC_DAPM_MUX("MIXHPRSEL Mux", SND_SOC_NOPM, 0, 0, |
1405 | + &max98090_mixhprsel_mux), |
1406 | |
1407 | SND_SOC_DAPM_PGA("HP Left Out", M98090_REG_OUTPUT_ENABLE, |
1408 | M98090_HPLEN_SHIFT, 0, NULL, 0), |
1409 | diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c |
1410 | index 91879ea95415..01aa75cde571 100644 |
1411 | --- a/sound/soc/codecs/rt5677-spi.c |
1412 | +++ b/sound/soc/codecs/rt5677-spi.c |
1413 | @@ -60,13 +60,15 @@ static DEFINE_MUTEX(spi_mutex); |
1414 | * RT5677_SPI_READ/WRITE_32: Transfer 4 bytes |
1415 | * RT5677_SPI_READ/WRITE_BURST: Transfer any multiples of 8 bytes |
1416 | * |
1417 | - * For example, reading 260 bytes at 0x60030002 uses the following commands: |
1418 | - * 0x60030002 RT5677_SPI_READ_16 2 bytes |
1419 | + * Note: |
1420 | + * 16 Bit writes and reads are restricted to the address range |
1421 | + * 0x18020000 ~ 0x18021000 |
1422 | + * |
1423 | + * For example, reading 256 bytes at 0x60030004 uses the following commands: |
1424 | * 0x60030004 RT5677_SPI_READ_32 4 bytes |
1425 | * 0x60030008 RT5677_SPI_READ_BURST 240 bytes |
1426 | * 0x600300F8 RT5677_SPI_READ_BURST 8 bytes |
1427 | * 0x60030100 RT5677_SPI_READ_32 4 bytes |
1428 | - * 0x60030104 RT5677_SPI_READ_16 2 bytes |
1429 | * |
1430 | * Input: |
1431 | * @read: true for read commands; false for write commands |
1432 | @@ -81,15 +83,13 @@ static u8 rt5677_spi_select_cmd(bool read, u32 align, u32 remain, u32 *len) |
1433 | { |
1434 | u8 cmd; |
1435 | |
1436 | - if (align == 2 || align == 6 || remain == 2) { |
1437 | - cmd = RT5677_SPI_READ_16; |
1438 | - *len = 2; |
1439 | - } else if (align == 4 || remain <= 6) { |
1440 | + if (align == 4 || remain <= 4) { |
1441 | cmd = RT5677_SPI_READ_32; |
1442 | *len = 4; |
1443 | } else { |
1444 | cmd = RT5677_SPI_READ_BURST; |
1445 | - *len = min_t(u32, remain & ~7, RT5677_SPI_BURST_LEN); |
1446 | + *len = (((remain - 1) >> 3) + 1) << 3; |
1447 | + *len = min_t(u32, *len, RT5677_SPI_BURST_LEN); |
1448 | } |
1449 | return read ? cmd : cmd + 1; |
1450 | } |
1451 | @@ -110,7 +110,7 @@ static void rt5677_spi_reverse(u8 *dst, u32 dstlen, const u8 *src, u32 srclen) |
1452 | } |
1453 | } |
1454 | |
1455 | -/* Read DSP address space using SPI. addr and len have to be 2-byte aligned. */ |
1456 | +/* Read DSP address space using SPI. addr and len have to be 4-byte aligned. */ |
1457 | int rt5677_spi_read(u32 addr, void *rxbuf, size_t len) |
1458 | { |
1459 | u32 offset; |
1460 | @@ -126,7 +126,7 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len) |
1461 | if (!g_spi) |
1462 | return -ENODEV; |
1463 | |
1464 | - if ((addr & 1) || (len & 1)) { |
1465 | + if ((addr & 3) || (len & 3)) { |
1466 | dev_err(&g_spi->dev, "Bad read align 0x%x(%zu)\n", addr, len); |
1467 | return -EACCES; |
1468 | } |
1469 | @@ -161,13 +161,13 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len) |
1470 | } |
1471 | EXPORT_SYMBOL_GPL(rt5677_spi_read); |
1472 | |
1473 | -/* Write DSP address space using SPI. addr has to be 2-byte aligned. |
1474 | - * If len is not 2-byte aligned, an extra byte of zero is written at the end |
1475 | +/* Write DSP address space using SPI. addr has to be 4-byte aligned. |
1476 | + * If len is not 4-byte aligned, then extra zeros are written at the end |
1477 | * as padding. |
1478 | */ |
1479 | int rt5677_spi_write(u32 addr, const void *txbuf, size_t len) |
1480 | { |
1481 | - u32 offset, len_with_pad = len; |
1482 | + u32 offset; |
1483 | int status = 0; |
1484 | struct spi_transfer t; |
1485 | struct spi_message m; |
1486 | @@ -180,22 +180,19 @@ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len) |
1487 | if (!g_spi) |
1488 | return -ENODEV; |
1489 | |
1490 | - if (addr & 1) { |
1491 | + if (addr & 3) { |
1492 | dev_err(&g_spi->dev, "Bad write align 0x%x(%zu)\n", addr, len); |
1493 | return -EACCES; |
1494 | } |
1495 | |
1496 | - if (len & 1) |
1497 | - len_with_pad = len + 1; |
1498 | - |
1499 | memset(&t, 0, sizeof(t)); |
1500 | t.tx_buf = buf; |
1501 | t.speed_hz = RT5677_SPI_FREQ; |
1502 | spi_message_init_with_transfers(&m, &t, 1); |
1503 | |
1504 | - for (offset = 0; offset < len_with_pad;) { |
1505 | + for (offset = 0; offset < len;) { |
1506 | spi_cmd = rt5677_spi_select_cmd(false, (addr + offset) & 7, |
1507 | - len_with_pad - offset, &t.len); |
1508 | + len - offset, &t.len); |
1509 | |
1510 | /* Construct SPI message header */ |
1511 | buf[0] = spi_cmd; |
1512 | diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c |
1513 | index 64b90b8ec661..248a4bd82397 100644 |
1514 | --- a/sound/usb/mixer.c |
1515 | +++ b/sound/usb/mixer.c |
1516 | @@ -2178,6 +2178,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, |
1517 | kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval); |
1518 | if (! kctl) { |
1519 | usb_audio_err(state->chip, "cannot malloc kcontrol\n"); |
1520 | + for (i = 0; i < desc->bNrInPins; i++) |
1521 | + kfree(namelist[i]); |
1522 | kfree(namelist); |
1523 | kfree(cval); |
1524 | return -ENOMEM; |
1525 | diff --git a/tools/objtool/check.c b/tools/objtool/check.c |
1526 | index 3ff025b64527..ae3446768181 100644 |
1527 | --- a/tools/objtool/check.c |
1528 | +++ b/tools/objtool/check.c |
1529 | @@ -1779,7 +1779,8 @@ static int validate_branch(struct objtool_file *file, struct instruction *first, |
1530 | return 1; |
1531 | } |
1532 | |
1533 | - func = insn->func ? insn->func->pfunc : NULL; |
1534 | + if (insn->func) |
1535 | + func = insn->func->pfunc; |
1536 | |
1537 | if (func && insn->ignore) { |
1538 | WARN_FUNC("BUG: why am I validating an ignored function?", |