Contents of /trunk/kernel-alx/patches-4.9/0284-4.9.185-all-fixes.patch
Parent Directory | Revision Log
Revision 3372 -
(show annotations)
(download)
Thu Jul 25 14:48:08 2019 UTC (5 years, 2 months ago) by niro
File size: 95019 byte(s)
Thu Jul 25 14:48:08 2019 UTC (5 years, 2 months ago) by niro
File size: 95019 byte(s)
-linux-4.9.185
1 | diff --git a/Makefile b/Makefile |
2 | index 3b0dd4e90c44..c80dad45334e 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 184 |
9 | +SUBLEVEL = 185 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | @@ -647,6 +647,7 @@ KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) |
14 | KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) |
15 | KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) |
16 | KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context) |
17 | +KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) |
18 | KBUILD_CFLAGS += $(call cc-disable-warning, attribute-alias) |
19 | |
20 | ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION |
21 | @@ -718,7 +719,6 @@ ifeq ($(cc-name),clang) |
22 | KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,) |
23 | KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier) |
24 | KBUILD_CFLAGS += $(call cc-disable-warning, gnu) |
25 | -KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) |
26 | # Quiet clang warning: comparison of unsigned expression < 0 is always false |
27 | KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare) |
28 | # CLANG uses a _MergedGlobals as optimization, but this breaks modpost, as the |
29 | diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig |
30 | index c7a081c583b9..2de75779a247 100644 |
31 | --- a/arch/arc/Kconfig |
32 | +++ b/arch/arc/Kconfig |
33 | @@ -23,7 +23,7 @@ config ARC |
34 | select GENERIC_SMP_IDLE_THREAD |
35 | select HAVE_ARCH_KGDB |
36 | select HAVE_ARCH_TRACEHOOK |
37 | - select HAVE_FUTEX_CMPXCHG |
38 | + select HAVE_FUTEX_CMPXCHG if FUTEX |
39 | select HAVE_IOREMAP_PROT |
40 | select HAVE_KPROBES |
41 | select HAVE_KRETPROBES |
42 | diff --git a/arch/arc/include/asm/bug.h b/arch/arc/include/asm/bug.h |
43 | index ea022d47896c..21ec82466d62 100644 |
44 | --- a/arch/arc/include/asm/bug.h |
45 | +++ b/arch/arc/include/asm/bug.h |
46 | @@ -23,7 +23,8 @@ void die(const char *str, struct pt_regs *regs, unsigned long address); |
47 | |
48 | #define BUG() do { \ |
49 | pr_warn("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ |
50 | - dump_stack(); \ |
51 | + barrier_before_unreachable(); \ |
52 | + __builtin_trap(); \ |
53 | } while (0) |
54 | |
55 | #define HAVE_ARCH_BUG |
56 | diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h |
57 | index d819de1c5d10..3ea4112c8302 100644 |
58 | --- a/arch/arc/include/asm/cmpxchg.h |
59 | +++ b/arch/arc/include/asm/cmpxchg.h |
60 | @@ -92,8 +92,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new) |
61 | |
62 | #endif /* CONFIG_ARC_HAS_LLSC */ |
63 | |
64 | -#define cmpxchg(ptr, o, n) ((typeof(*(ptr)))__cmpxchg((ptr), \ |
65 | - (unsigned long)(o), (unsigned long)(n))) |
66 | +#define cmpxchg(ptr, o, n) ({ \ |
67 | + (typeof(*(ptr)))__cmpxchg((ptr), \ |
68 | + (unsigned long)(o), \ |
69 | + (unsigned long)(n)); \ |
70 | +}) |
71 | |
72 | /* |
73 | * atomic_cmpxchg is same as cmpxchg |
74 | @@ -198,8 +201,11 @@ static inline unsigned long __xchg(unsigned long val, volatile void *ptr, |
75 | return __xchg_bad_pointer(); |
76 | } |
77 | |
78 | -#define xchg(ptr, with) ((typeof(*(ptr)))__xchg((unsigned long)(with), (ptr), \ |
79 | - sizeof(*(ptr)))) |
80 | +#define xchg(ptr, with) ({ \ |
81 | + (typeof(*(ptr)))__xchg((unsigned long)(with), \ |
82 | + (ptr), \ |
83 | + sizeof(*(ptr))); \ |
84 | +}) |
85 | |
86 | #endif /* CONFIG_ARC_PLAT_EZNPS */ |
87 | |
88 | diff --git a/arch/arc/kernel/traps.c b/arch/arc/kernel/traps.c |
89 | index c927aa84e652..2fb0cd39a31c 100644 |
90 | --- a/arch/arc/kernel/traps.c |
91 | +++ b/arch/arc/kernel/traps.c |
92 | @@ -155,3 +155,11 @@ void do_insterror_or_kprobe(unsigned long address, struct pt_regs *regs) |
93 | |
94 | insterror_is_error(address, regs); |
95 | } |
96 | + |
97 | +/* |
98 | + * abort() call generated by older gcc for __builtin_trap() |
99 | + */ |
100 | +void abort(void) |
101 | +{ |
102 | + __asm__ __volatile__("trap_s 5\n"); |
103 | +} |
104 | diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c |
105 | index a4dc881da277..3c88ccbe01af 100644 |
106 | --- a/arch/arc/mm/tlb.c |
107 | +++ b/arch/arc/mm/tlb.c |
108 | @@ -890,9 +890,11 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address, |
109 | struct pt_regs *regs) |
110 | { |
111 | struct cpuinfo_arc_mmu *mmu = &cpuinfo_arc700[smp_processor_id()].mmu; |
112 | - unsigned int pd0[mmu->ways]; |
113 | unsigned long flags; |
114 | - int set; |
115 | + int set, n_ways = mmu->ways; |
116 | + |
117 | + n_ways = min(n_ways, 4); |
118 | + BUG_ON(mmu->ways > 4); |
119 | |
120 | local_irq_save(flags); |
121 | |
122 | @@ -900,9 +902,10 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address, |
123 | for (set = 0; set < mmu->sets; set++) { |
124 | |
125 | int is_valid, way; |
126 | + unsigned int pd0[4]; |
127 | |
128 | /* read out all the ways of current set */ |
129 | - for (way = 0, is_valid = 0; way < mmu->ways; way++) { |
130 | + for (way = 0, is_valid = 0; way < n_ways; way++) { |
131 | write_aux_reg(ARC_REG_TLBINDEX, |
132 | SET_WAY_TO_IDX(mmu, set, way)); |
133 | write_aux_reg(ARC_REG_TLBCOMMAND, TLBRead); |
134 | @@ -916,14 +919,14 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address, |
135 | continue; |
136 | |
137 | /* Scan the set for duplicate ways: needs a nested loop */ |
138 | - for (way = 0; way < mmu->ways - 1; way++) { |
139 | + for (way = 0; way < n_ways - 1; way++) { |
140 | |
141 | int n; |
142 | |
143 | if (!pd0[way]) |
144 | continue; |
145 | |
146 | - for (n = way + 1; n < mmu->ways; n++) { |
147 | + for (n = way + 1; n < n_ways; n++) { |
148 | if (pd0[way] != pd0[n]) |
149 | continue; |
150 | |
151 | diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c |
152 | index edb888ac5ad3..c6aa77dfd00a 100644 |
153 | --- a/arch/arm/mach-imx/cpuidle-imx6sx.c |
154 | +++ b/arch/arm/mach-imx/cpuidle-imx6sx.c |
155 | @@ -15,6 +15,7 @@ |
156 | |
157 | #include "common.h" |
158 | #include "cpuidle.h" |
159 | +#include "hardware.h" |
160 | |
161 | static int imx6sx_idle_finish(unsigned long val) |
162 | { |
163 | @@ -108,7 +109,7 @@ int __init imx6sx_cpuidle_init(void) |
164 | * except for power up sw2iso which need to be |
165 | * larger than LDO ramp up time. |
166 | */ |
167 | - imx_gpc_set_arm_power_up_timing(0xf, 1); |
168 | + imx_gpc_set_arm_power_up_timing(cpu_is_imx6sx() ? 0xf : 0x2, 1); |
169 | imx_gpc_set_arm_power_down_timing(1, 1); |
170 | |
171 | return cpuidle_register(&imx6sx_cpuidle_driver, NULL); |
172 | diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c |
173 | index 7f316982ce00..4130f1f26852 100644 |
174 | --- a/arch/arm64/kernel/module.c |
175 | +++ b/arch/arm64/kernel/module.c |
176 | @@ -33,10 +33,14 @@ |
177 | void *module_alloc(unsigned long size) |
178 | { |
179 | void *p; |
180 | + u64 module_alloc_end = module_alloc_base + MODULES_VSIZE; |
181 | + |
182 | + if (IS_ENABLED(CONFIG_KASAN)) |
183 | + /* don't exceed the static module region - see below */ |
184 | + module_alloc_end = MODULES_END; |
185 | |
186 | p = __vmalloc_node_range(size, MODULE_ALIGN, module_alloc_base, |
187 | - module_alloc_base + MODULES_VSIZE, |
188 | - GFP_KERNEL, PAGE_KERNEL_EXEC, 0, |
189 | + module_alloc_end, GFP_KERNEL, PAGE_KERNEL_EXEC, 0, |
190 | NUMA_NO_NODE, __builtin_return_address(0)); |
191 | |
192 | if (!p && IS_ENABLED(CONFIG_ARM64_MODULE_PLTS) && |
193 | diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c |
194 | index c9b9a5a322eb..c0f315ecfa7c 100644 |
195 | --- a/arch/arm64/kernel/vdso.c |
196 | +++ b/arch/arm64/kernel/vdso.c |
197 | @@ -37,7 +37,7 @@ |
198 | #include <asm/vdso.h> |
199 | #include <asm/vdso_datapage.h> |
200 | |
201 | -extern char vdso_start, vdso_end; |
202 | +extern char vdso_start[], vdso_end[]; |
203 | static unsigned long vdso_pages __ro_after_init; |
204 | |
205 | /* |
206 | @@ -124,14 +124,14 @@ static int __init vdso_init(void) |
207 | int i; |
208 | struct page **vdso_pagelist; |
209 | |
210 | - if (memcmp(&vdso_start, "\177ELF", 4)) { |
211 | + if (memcmp(vdso_start, "\177ELF", 4)) { |
212 | pr_err("vDSO is not a valid ELF object!\n"); |
213 | return -EINVAL; |
214 | } |
215 | |
216 | - vdso_pages = (&vdso_end - &vdso_start) >> PAGE_SHIFT; |
217 | + vdso_pages = (vdso_end - vdso_start) >> PAGE_SHIFT; |
218 | pr_info("vdso: %ld pages (%ld code @ %p, %ld data @ %p)\n", |
219 | - vdso_pages + 1, vdso_pages, &vdso_start, 1L, vdso_data); |
220 | + vdso_pages + 1, vdso_pages, vdso_start, 1L, vdso_data); |
221 | |
222 | /* Allocate the vDSO pagelist, plus a page for the data. */ |
223 | vdso_pagelist = kcalloc(vdso_pages + 1, sizeof(struct page *), |
224 | @@ -144,7 +144,7 @@ static int __init vdso_init(void) |
225 | |
226 | /* Grab the vDSO code pages. */ |
227 | for (i = 0; i < vdso_pages; i++) |
228 | - vdso_pagelist[i + 1] = pfn_to_page(PHYS_PFN(__pa(&vdso_start)) + i); |
229 | + vdso_pagelist[i + 1] = pfn_to_page(PHYS_PFN(__pa(vdso_start)) + i); |
230 | |
231 | vdso_spec[0].pages = &vdso_pagelist[0]; |
232 | vdso_spec[1].pages = &vdso_pagelist[1]; |
233 | diff --git a/arch/ia64/include/asm/bug.h b/arch/ia64/include/asm/bug.h |
234 | index 823616b5020b..19067821249f 100644 |
235 | --- a/arch/ia64/include/asm/bug.h |
236 | +++ b/arch/ia64/include/asm/bug.h |
237 | @@ -3,7 +3,11 @@ |
238 | |
239 | #ifdef CONFIG_BUG |
240 | #define ia64_abort() __builtin_trap() |
241 | -#define BUG() do { printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); ia64_abort(); } while (0) |
242 | +#define BUG() do { \ |
243 | + printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ |
244 | + barrier_before_unreachable(); \ |
245 | + ia64_abort(); \ |
246 | +} while (0) |
247 | |
248 | /* should this BUG be made generic? */ |
249 | #define HAVE_ARCH_BUG |
250 | diff --git a/arch/m68k/include/asm/bug.h b/arch/m68k/include/asm/bug.h |
251 | index ef9a2e47352f..21ddbf925e22 100644 |
252 | --- a/arch/m68k/include/asm/bug.h |
253 | +++ b/arch/m68k/include/asm/bug.h |
254 | @@ -7,16 +7,19 @@ |
255 | #ifndef CONFIG_SUN3 |
256 | #define BUG() do { \ |
257 | printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ |
258 | + barrier_before_unreachable(); \ |
259 | __builtin_trap(); \ |
260 | } while (0) |
261 | #else |
262 | #define BUG() do { \ |
263 | printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ |
264 | + barrier_before_unreachable(); \ |
265 | panic("BUG!"); \ |
266 | } while (0) |
267 | #endif |
268 | #else |
269 | #define BUG() do { \ |
270 | + barrier_before_unreachable(); \ |
271 | __builtin_trap(); \ |
272 | } while (0) |
273 | #endif |
274 | diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig |
275 | index bb9940c6927e..6cd230434f32 100644 |
276 | --- a/arch/mips/Kconfig |
277 | +++ b/arch/mips/Kconfig |
278 | @@ -13,6 +13,7 @@ config MIPS |
279 | select HAVE_OPROFILE |
280 | select HAVE_PERF_EVENTS |
281 | select PERF_USE_VMALLOC |
282 | + select HAVE_ARCH_COMPILER_H |
283 | select HAVE_ARCH_KGDB |
284 | select HAVE_ARCH_SECCOMP_FILTER |
285 | select HAVE_ARCH_TRACEHOOK |
286 | diff --git a/arch/mips/include/asm/compiler.h b/arch/mips/include/asm/compiler.h |
287 | index e081a265f422..cc2eb1b06050 100644 |
288 | --- a/arch/mips/include/asm/compiler.h |
289 | +++ b/arch/mips/include/asm/compiler.h |
290 | @@ -8,6 +8,41 @@ |
291 | #ifndef _ASM_COMPILER_H |
292 | #define _ASM_COMPILER_H |
293 | |
294 | +/* |
295 | + * With GCC 4.5 onwards we can use __builtin_unreachable to indicate to the |
296 | + * compiler that a particular code path will never be hit. This allows it to be |
297 | + * optimised out of the generated binary. |
298 | + * |
299 | + * Unfortunately at least GCC 4.6.3 through 7.3.0 inclusive suffer from a bug |
300 | + * that can lead to instructions from beyond an unreachable statement being |
301 | + * incorrectly reordered into earlier delay slots if the unreachable statement |
302 | + * is the only content of a case in a switch statement. This can lead to |
303 | + * seemingly random behaviour, such as invalid memory accesses from incorrectly |
304 | + * reordered loads or stores. See this potential GCC fix for details: |
305 | + * |
306 | + * https://gcc.gnu.org/ml/gcc-patches/2015-09/msg00360.html |
307 | + * |
308 | + * It is unclear whether GCC 8 onwards suffer from the same issue - nothing |
309 | + * relevant is mentioned in GCC 8 release notes and nothing obviously relevant |
310 | + * stands out in GCC commit logs, but these newer GCC versions generate very |
311 | + * different code for the testcase which doesn't exhibit the bug. |
312 | + * |
313 | + * GCC also handles stack allocation suboptimally when calling noreturn |
314 | + * functions or calling __builtin_unreachable(): |
315 | + * |
316 | + * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365 |
317 | + * |
318 | + * We work around both of these issues by placing a volatile asm statement, |
319 | + * which GCC is prevented from reordering past, prior to __builtin_unreachable |
320 | + * calls. |
321 | + * |
322 | + * The .insn statement is required to ensure that any branches to the |
323 | + * statement, which sadly must be kept due to the asm statement, are known to |
324 | + * be branches to code and satisfy linker requirements for microMIPS kernels. |
325 | + */ |
326 | +#undef barrier_before_unreachable |
327 | +#define barrier_before_unreachable() asm volatile(".insn") |
328 | + |
329 | #if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4) |
330 | #define GCC_IMM_ASM() "n" |
331 | #define GCC_REG_ACCUM "$0" |
332 | diff --git a/arch/mips/include/asm/netlogic/xlr/fmn.h b/arch/mips/include/asm/netlogic/xlr/fmn.h |
333 | index 5604db3d1836..d79c68fa78d9 100644 |
334 | --- a/arch/mips/include/asm/netlogic/xlr/fmn.h |
335 | +++ b/arch/mips/include/asm/netlogic/xlr/fmn.h |
336 | @@ -301,8 +301,6 @@ static inline int nlm_fmn_send(unsigned int size, unsigned int code, |
337 | for (i = 0; i < 8; i++) { |
338 | nlm_msgsnd(dest); |
339 | status = nlm_read_c2_status0(); |
340 | - if ((status & 0x2) == 1) |
341 | - pr_info("Send pending fail!\n"); |
342 | if ((status & 0x4) == 0) |
343 | return 0; |
344 | } |
345 | diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c |
346 | index dbb917403131..ec951dde0999 100644 |
347 | --- a/arch/mips/kernel/uprobes.c |
348 | +++ b/arch/mips/kernel/uprobes.c |
349 | @@ -111,9 +111,6 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs) |
350 | */ |
351 | aup->resume_epc = regs->cp0_epc + 4; |
352 | if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) { |
353 | - unsigned long epc; |
354 | - |
355 | - epc = regs->cp0_epc; |
356 | __compute_return_epc_for_insn(regs, |
357 | (union mips_instruction) aup->insn[0]); |
358 | aup->resume_epc = regs->cp0_epc; |
359 | diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c |
360 | index 7f2519cfb5d2..15f788601b64 100644 |
361 | --- a/arch/mips/math-emu/cp1emu.c |
362 | +++ b/arch/mips/math-emu/cp1emu.c |
363 | @@ -828,12 +828,12 @@ do { \ |
364 | } while (0) |
365 | |
366 | #define DIFROMREG(di, x) \ |
367 | - ((di) = get_fpr64(&ctx->fpr[(x) & ~(cop1_64bit(xcp) == 0)], 0)) |
368 | + ((di) = get_fpr64(&ctx->fpr[(x) & ~(cop1_64bit(xcp) ^ 1)], 0)) |
369 | |
370 | #define DITOREG(di, x) \ |
371 | do { \ |
372 | unsigned fpr, i; \ |
373 | - fpr = (x) & ~(cop1_64bit(xcp) == 0); \ |
374 | + fpr = (x) & ~(cop1_64bit(xcp) ^ 1); \ |
375 | set_fpr64(&ctx->fpr[fpr], 0, di); \ |
376 | for (i = 1; i < ARRAY_SIZE(ctx->fpr[x].val64); i++) \ |
377 | set_fpr64(&ctx->fpr[fpr], i, 0); \ |
378 | diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c |
379 | index 2da5649fc545..3cc5b2e4263c 100644 |
380 | --- a/arch/mips/mm/tlbex.c |
381 | +++ b/arch/mips/mm/tlbex.c |
382 | @@ -386,6 +386,7 @@ static struct work_registers build_get_work_registers(u32 **p) |
383 | static void build_restore_work_registers(u32 **p) |
384 | { |
385 | if (scratch_reg >= 0) { |
386 | + uasm_i_ehb(p); |
387 | UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); |
388 | return; |
389 | } |
390 | @@ -674,10 +675,12 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r, |
391 | uasm_i_mtc0(p, 0, C0_PAGEMASK); |
392 | uasm_il_b(p, r, lid); |
393 | } |
394 | - if (scratch_reg >= 0) |
395 | + if (scratch_reg >= 0) { |
396 | + uasm_i_ehb(p); |
397 | UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); |
398 | - else |
399 | + } else { |
400 | UASM_i_LW(p, 1, scratchpad_offset(0), 0); |
401 | + } |
402 | } else { |
403 | /* Reset default page size */ |
404 | if (PM_DEFAULT_MASK >> 16) { |
405 | @@ -935,10 +938,12 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r, |
406 | uasm_i_jr(p, ptr); |
407 | |
408 | if (mode == refill_scratch) { |
409 | - if (scratch_reg >= 0) |
410 | + if (scratch_reg >= 0) { |
411 | + uasm_i_ehb(p); |
412 | UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); |
413 | - else |
414 | + } else { |
415 | UASM_i_LW(p, 1, scratchpad_offset(0), 0); |
416 | + } |
417 | } else { |
418 | uasm_i_nop(p); |
419 | } |
420 | @@ -1238,6 +1243,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l, |
421 | UASM_i_MTC0(p, odd, C0_ENTRYLO1); /* load it */ |
422 | |
423 | if (c0_scratch_reg >= 0) { |
424 | + uasm_i_ehb(p); |
425 | UASM_i_MFC0(p, scratch, c0_kscratch(), c0_scratch_reg); |
426 | build_tlb_write_entry(p, l, r, tlb_random); |
427 | uasm_l_leave(l, *p); |
428 | @@ -1592,15 +1598,17 @@ static void build_setup_pgd(void) |
429 | uasm_i_dinsm(&p, a0, 0, 29, 64 - 29); |
430 | uasm_l_tlbl_goaround1(&l, p); |
431 | UASM_i_SLL(&p, a0, a0, 11); |
432 | - uasm_i_jr(&p, 31); |
433 | UASM_i_MTC0(&p, a0, C0_CONTEXT); |
434 | + uasm_i_jr(&p, 31); |
435 | + uasm_i_ehb(&p); |
436 | } else { |
437 | /* PGD in c0_KScratch */ |
438 | - uasm_i_jr(&p, 31); |
439 | if (cpu_has_ldpte) |
440 | UASM_i_MTC0(&p, a0, C0_PWBASE); |
441 | else |
442 | UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg); |
443 | + uasm_i_jr(&p, 31); |
444 | + uasm_i_ehb(&p); |
445 | } |
446 | #else |
447 | #ifdef CONFIG_SMP |
448 | @@ -1614,13 +1622,16 @@ static void build_setup_pgd(void) |
449 | UASM_i_LA_mostly(&p, a2, pgdc); |
450 | UASM_i_SW(&p, a0, uasm_rel_lo(pgdc), a2); |
451 | #endif /* SMP */ |
452 | - uasm_i_jr(&p, 31); |
453 | |
454 | /* if pgd_reg is allocated, save PGD also to scratch register */ |
455 | - if (pgd_reg != -1) |
456 | + if (pgd_reg != -1) { |
457 | UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg); |
458 | - else |
459 | + uasm_i_jr(&p, 31); |
460 | + uasm_i_ehb(&p); |
461 | + } else { |
462 | + uasm_i_jr(&p, 31); |
463 | uasm_i_nop(&p); |
464 | + } |
465 | #endif |
466 | if (p >= tlbmiss_handler_setup_pgd_end) |
467 | panic("tlbmiss_handler_setup_pgd space exceeded"); |
468 | diff --git a/arch/parisc/math-emu/cnv_float.h b/arch/parisc/math-emu/cnv_float.h |
469 | index 933423fa5144..b0db61188a61 100644 |
470 | --- a/arch/parisc/math-emu/cnv_float.h |
471 | +++ b/arch/parisc/math-emu/cnv_float.h |
472 | @@ -60,19 +60,19 @@ |
473 | ((exponent < (SGL_P - 1)) ? \ |
474 | (Sall(sgl_value) << (SGL_EXP_LENGTH + 1 + exponent)) : FALSE) |
475 | |
476 | -#define Int_isinexact_to_sgl(int_value) (int_value << 33 - SGL_EXP_LENGTH) |
477 | +#define Int_isinexact_to_sgl(int_value) ((int_value << 33 - SGL_EXP_LENGTH) != 0) |
478 | |
479 | #define Sgl_roundnearest_from_int(int_value,sgl_value) \ |
480 | if (int_value & 1<<(SGL_EXP_LENGTH - 2)) /* round bit */ \ |
481 | - if ((int_value << 34 - SGL_EXP_LENGTH) || Slow(sgl_value)) \ |
482 | + if (((int_value << 34 - SGL_EXP_LENGTH) != 0) || Slow(sgl_value)) \ |
483 | Sall(sgl_value)++ |
484 | |
485 | #define Dint_isinexact_to_sgl(dint_valueA,dint_valueB) \ |
486 | - ((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) || Dintp2(dint_valueB)) |
487 | + (((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) != 0) || Dintp2(dint_valueB)) |
488 | |
489 | #define Sgl_roundnearest_from_dint(dint_valueA,dint_valueB,sgl_value) \ |
490 | if (Dintp1(dint_valueA) & 1<<(SGL_EXP_LENGTH - 2)) \ |
491 | - if ((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) || \ |
492 | + if (((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) != 0) || \ |
493 | Dintp2(dint_valueB) || Slow(sgl_value)) Sall(sgl_value)++ |
494 | |
495 | #define Dint_isinexact_to_dbl(dint_value) \ |
496 | diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h |
497 | index 48e8f1f14872..b7067590f15c 100644 |
498 | --- a/arch/powerpc/include/asm/ppc-opcode.h |
499 | +++ b/arch/powerpc/include/asm/ppc-opcode.h |
500 | @@ -261,6 +261,7 @@ |
501 | #define PPC_INST_MULLI 0x1c000000 |
502 | #define PPC_INST_DIVWU 0x7c000396 |
503 | #define PPC_INST_DIVD 0x7c0003d2 |
504 | +#define PPC_INST_DIVDU 0x7c000392 |
505 | #define PPC_INST_RLWINM 0x54000000 |
506 | #define PPC_INST_RLWIMI 0x50000000 |
507 | #define PPC_INST_RLDICL 0x78000000 |
508 | diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h |
509 | index 7b1d1721a26a..83e5b255d142 100644 |
510 | --- a/arch/powerpc/net/bpf_jit.h |
511 | +++ b/arch/powerpc/net/bpf_jit.h |
512 | @@ -116,7 +116,7 @@ |
513 | ___PPC_RA(a) | IMM_L(i)) |
514 | #define PPC_DIVWU(d, a, b) EMIT(PPC_INST_DIVWU | ___PPC_RT(d) | \ |
515 | ___PPC_RA(a) | ___PPC_RB(b)) |
516 | -#define PPC_DIVD(d, a, b) EMIT(PPC_INST_DIVD | ___PPC_RT(d) | \ |
517 | +#define PPC_DIVDU(d, a, b) EMIT(PPC_INST_DIVDU | ___PPC_RT(d) | \ |
518 | ___PPC_RA(a) | ___PPC_RB(b)) |
519 | #define PPC_AND(d, a, b) EMIT(PPC_INST_AND | ___PPC_RA(d) | \ |
520 | ___PPC_RS(a) | ___PPC_RB(b)) |
521 | diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c |
522 | index e7d78f9156ce..9f0810cfe5f3 100644 |
523 | --- a/arch/powerpc/net/bpf_jit_comp64.c |
524 | +++ b/arch/powerpc/net/bpf_jit_comp64.c |
525 | @@ -419,12 +419,12 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, |
526 | PPC_LI(b2p[BPF_REG_0], 0); |
527 | PPC_JMP(exit_addr); |
528 | if (BPF_OP(code) == BPF_MOD) { |
529 | - PPC_DIVD(b2p[TMP_REG_1], dst_reg, src_reg); |
530 | + PPC_DIVDU(b2p[TMP_REG_1], dst_reg, src_reg); |
531 | PPC_MULD(b2p[TMP_REG_1], src_reg, |
532 | b2p[TMP_REG_1]); |
533 | PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]); |
534 | } else |
535 | - PPC_DIVD(dst_reg, dst_reg, src_reg); |
536 | + PPC_DIVDU(dst_reg, dst_reg, src_reg); |
537 | break; |
538 | case BPF_ALU | BPF_MOD | BPF_K: /* (u32) dst %= (u32) imm */ |
539 | case BPF_ALU | BPF_DIV | BPF_K: /* (u32) dst /= (u32) imm */ |
540 | @@ -452,7 +452,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, |
541 | break; |
542 | case BPF_ALU64: |
543 | if (BPF_OP(code) == BPF_MOD) { |
544 | - PPC_DIVD(b2p[TMP_REG_2], dst_reg, |
545 | + PPC_DIVDU(b2p[TMP_REG_2], dst_reg, |
546 | b2p[TMP_REG_1]); |
547 | PPC_MULD(b2p[TMP_REG_1], |
548 | b2p[TMP_REG_1], |
549 | @@ -460,7 +460,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, |
550 | PPC_SUB(dst_reg, dst_reg, |
551 | b2p[TMP_REG_1]); |
552 | } else |
553 | - PPC_DIVD(dst_reg, dst_reg, |
554 | + PPC_DIVDU(dst_reg, dst_reg, |
555 | b2p[TMP_REG_1]); |
556 | break; |
557 | } |
558 | diff --git a/arch/sparc/include/asm/bug.h b/arch/sparc/include/asm/bug.h |
559 | index eaa8f8d38125..fa85cac0285c 100644 |
560 | --- a/arch/sparc/include/asm/bug.h |
561 | +++ b/arch/sparc/include/asm/bug.h |
562 | @@ -8,10 +8,14 @@ |
563 | void do_BUG(const char *file, int line); |
564 | #define BUG() do { \ |
565 | do_BUG(__FILE__, __LINE__); \ |
566 | + barrier_before_unreachable(); \ |
567 | __builtin_trap(); \ |
568 | } while (0) |
569 | #else |
570 | -#define BUG() __builtin_trap() |
571 | +#define BUG() do { \ |
572 | + barrier_before_unreachable(); \ |
573 | + __builtin_trap(); \ |
574 | +} while (0) |
575 | #endif |
576 | |
577 | #define HAVE_ARCH_BUG |
578 | diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c |
579 | index 71e7f77f6776..84a80cd004eb 100644 |
580 | --- a/arch/sparc/kernel/perf_event.c |
581 | +++ b/arch/sparc/kernel/perf_event.c |
582 | @@ -889,6 +889,10 @@ static int sparc_perf_event_set_period(struct perf_event *event, |
583 | s64 period = hwc->sample_period; |
584 | int ret = 0; |
585 | |
586 | + /* The period may have been changed by PERF_EVENT_IOC_PERIOD */ |
587 | + if (unlikely(period != hwc->last_period)) |
588 | + left = period - (hwc->last_period - left); |
589 | + |
590 | if (unlikely(left <= -period)) { |
591 | left = period; |
592 | local64_set(&hwc->period_left, left); |
593 | diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c |
594 | index 16970c39baea..07a6c1fa173b 100644 |
595 | --- a/arch/x86/kernel/cpu/bugs.c |
596 | +++ b/arch/x86/kernel/cpu/bugs.c |
597 | @@ -828,6 +828,16 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void) |
598 | break; |
599 | } |
600 | |
601 | + /* |
602 | + * If SSBD is controlled by the SPEC_CTRL MSR, then set the proper |
603 | + * bit in the mask to allow guests to use the mitigation even in the |
604 | + * case where the host does not enable it. |
605 | + */ |
606 | + if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || |
607 | + static_cpu_has(X86_FEATURE_AMD_SSBD)) { |
608 | + x86_spec_ctrl_mask |= SPEC_CTRL_SSBD; |
609 | + } |
610 | + |
611 | /* |
612 | * We have three CPU feature flags that are in play here: |
613 | * - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible. |
614 | @@ -845,7 +855,6 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void) |
615 | x86_amd_ssb_disable(); |
616 | } else { |
617 | x86_spec_ctrl_base |= SPEC_CTRL_SSBD; |
618 | - x86_spec_ctrl_mask |= SPEC_CTRL_SSBD; |
619 | wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); |
620 | } |
621 | } |
622 | diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c |
623 | index c8630569e392..cf32533225bb 100644 |
624 | --- a/arch/x86/kvm/lapic.c |
625 | +++ b/arch/x86/kvm/lapic.c |
626 | @@ -1992,7 +1992,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu) |
627 | struct kvm_lapic *apic = vcpu->arch.apic; |
628 | int highest_irr; |
629 | |
630 | - if (!apic_enabled(apic)) |
631 | + if (!kvm_apic_hw_enabled(apic)) |
632 | return -1; |
633 | |
634 | apic_update_ppr(apic); |
635 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c |
636 | index 72efecc4288b..8b06700d1676 100644 |
637 | --- a/arch/x86/kvm/x86.c |
638 | +++ b/arch/x86/kvm/x86.c |
639 | @@ -1365,7 +1365,7 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale) |
640 | vcpu->arch.tsc_always_catchup = 1; |
641 | return 0; |
642 | } else { |
643 | - WARN(1, "user requested TSC rate below hardware speed\n"); |
644 | + pr_warn_ratelimited("user requested TSC rate below hardware speed\n"); |
645 | return -1; |
646 | } |
647 | } |
648 | @@ -1375,8 +1375,8 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale) |
649 | user_tsc_khz, tsc_khz); |
650 | |
651 | if (ratio == 0 || ratio >= kvm_max_tsc_scaling_ratio) { |
652 | - WARN_ONCE(1, "Invalid TSC scaling ratio - virtual-tsc-khz=%u\n", |
653 | - user_tsc_khz); |
654 | + pr_warn_ratelimited("Invalid TSC scaling ratio - virtual-tsc-khz=%u\n", |
655 | + user_tsc_khz); |
656 | return -1; |
657 | } |
658 | |
659 | diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c |
660 | index 1c5705481c69..c90a1727cd2c 100644 |
661 | --- a/crypto/crypto_user.c |
662 | +++ b/crypto/crypto_user.c |
663 | @@ -55,6 +55,9 @@ static struct crypto_alg *crypto_alg_match(struct crypto_user_alg *p, int exact) |
664 | list_for_each_entry(q, &crypto_alg_list, cra_list) { |
665 | int match = 0; |
666 | |
667 | + if (crypto_is_larval(q)) |
668 | + continue; |
669 | + |
670 | if ((q->cra_flags ^ p->cru_type) & p->cru_mask) |
671 | continue; |
672 | |
673 | diff --git a/drivers/clk/sunxi/clk-sun8i-bus-gates.c b/drivers/clk/sunxi/clk-sun8i-bus-gates.c |
674 | index 63fdb790df29..bee305bdddbe 100644 |
675 | --- a/drivers/clk/sunxi/clk-sun8i-bus-gates.c |
676 | +++ b/drivers/clk/sunxi/clk-sun8i-bus-gates.c |
677 | @@ -78,6 +78,10 @@ static void __init sun8i_h3_bus_gates_init(struct device_node *node) |
678 | clk_parent = APB1; |
679 | else if (index >= 96 && index <= 127) |
680 | clk_parent = APB2; |
681 | + else { |
682 | + WARN_ON(true); |
683 | + continue; |
684 | + } |
685 | |
686 | clk_reg = reg + 4 * (index / 32); |
687 | clk_bit = index % 32; |
688 | diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c |
689 | index b9c29720aeb1..84856ac75a09 100644 |
690 | --- a/drivers/dma/imx-sdma.c |
691 | +++ b/drivers/dma/imx-sdma.c |
692 | @@ -632,7 +632,7 @@ static int sdma_load_script(struct sdma_engine *sdma, void *buf, int size, |
693 | spin_lock_irqsave(&sdma->channel_0_lock, flags); |
694 | |
695 | bd0->mode.command = C0_SETPM; |
696 | - bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD; |
697 | + bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD; |
698 | bd0->mode.count = size / 2; |
699 | bd0->buffer_addr = buf_phys; |
700 | bd0->ext_buffer_addr = address; |
701 | @@ -909,7 +909,7 @@ static int sdma_load_context(struct sdma_channel *sdmac) |
702 | context->gReg[7] = sdmac->watermark_level; |
703 | |
704 | bd0->mode.command = C0_SETDM; |
705 | - bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD; |
706 | + bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD; |
707 | bd0->mode.count = sizeof(*context) / 4; |
708 | bd0->buffer_addr = sdma->context_phys; |
709 | bd0->ext_buffer_addr = 2048 + (sizeof(*context) / 4) * channel; |
710 | diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c |
711 | index 28341b32067f..84dea276175b 100644 |
712 | --- a/drivers/gpu/drm/arm/hdlcd_crtc.c |
713 | +++ b/drivers/gpu/drm/arm/hdlcd_crtc.c |
714 | @@ -170,7 +170,8 @@ static int hdlcd_crtc_atomic_check(struct drm_crtc *crtc, |
715 | long rate, clk_rate = mode->clock * 1000; |
716 | |
717 | rate = clk_round_rate(hdlcd->clk, clk_rate); |
718 | - if (rate != clk_rate) { |
719 | + /* 0.1% seems a close enough tolerance for the TDA19988 on Juno */ |
720 | + if (abs(rate - clk_rate) * 1000 > clk_rate) { |
721 | /* clock required by mode not supported by hardware */ |
722 | return -EINVAL; |
723 | } |
724 | diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c |
725 | index 1ea0e1f43397..54d878cb458f 100644 |
726 | --- a/drivers/gpu/drm/i915/intel_csr.c |
727 | +++ b/drivers/gpu/drm/i915/intel_csr.c |
728 | @@ -280,10 +280,17 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv, |
729 | uint32_t i; |
730 | uint32_t *dmc_payload; |
731 | uint32_t required_version; |
732 | + size_t fsize; |
733 | |
734 | if (!fw) |
735 | return NULL; |
736 | |
737 | + fsize = sizeof(struct intel_css_header) + |
738 | + sizeof(struct intel_package_header) + |
739 | + sizeof(struct intel_dmc_header); |
740 | + if (fsize > fw->size) |
741 | + goto error_truncated; |
742 | + |
743 | /* Extract CSS Header information*/ |
744 | css_header = (struct intel_css_header *)fw->data; |
745 | if (sizeof(struct intel_css_header) != |
746 | @@ -349,6 +356,9 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv, |
747 | return NULL; |
748 | } |
749 | readcount += dmc_offset; |
750 | + fsize += dmc_offset; |
751 | + if (fsize > fw->size) |
752 | + goto error_truncated; |
753 | |
754 | /* Extract dmc_header information. */ |
755 | dmc_header = (struct intel_dmc_header *)&fw->data[readcount]; |
756 | @@ -379,6 +389,10 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv, |
757 | |
758 | /* fw_size is in dwords, so multiplied by 4 to convert into bytes. */ |
759 | nbytes = dmc_header->fw_size * 4; |
760 | + fsize += nbytes; |
761 | + if (fsize > fw->size) |
762 | + goto error_truncated; |
763 | + |
764 | if (nbytes > CSR_MAX_FW_SIZE) { |
765 | DRM_ERROR("CSR firmware too big (%u) bytes\n", nbytes); |
766 | return NULL; |
767 | @@ -392,6 +406,10 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv, |
768 | } |
769 | |
770 | return memcpy(dmc_payload, &fw->data[readcount], nbytes); |
771 | + |
772 | +error_truncated: |
773 | + DRM_ERROR("Truncated DMC firmware, rejecting.\n"); |
774 | + return NULL; |
775 | } |
776 | |
777 | static void csr_load_work_fn(struct work_struct *work) |
778 | diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c |
779 | index 8dbba61a2708..82114fe2a42a 100644 |
780 | --- a/drivers/gpu/drm/imx/ipuv3-crtc.c |
781 | +++ b/drivers/gpu/drm/imx/ipuv3-crtc.c |
782 | @@ -76,14 +76,14 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc, |
783 | drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, false); |
784 | ipu_dc_disable(ipu); |
785 | |
786 | + drm_crtc_vblank_off(crtc); |
787 | + |
788 | spin_lock_irq(&crtc->dev->event_lock); |
789 | - if (crtc->state->event) { |
790 | + if (crtc->state->event && !crtc->state->active) { |
791 | drm_crtc_send_vblank_event(crtc, crtc->state->event); |
792 | crtc->state->event = NULL; |
793 | } |
794 | spin_unlock_irq(&crtc->dev->event_lock); |
795 | - |
796 | - drm_crtc_vblank_off(crtc); |
797 | } |
798 | |
799 | static void imx_drm_crtc_reset(struct drm_crtc *crtc) |
800 | diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c |
801 | index eaa5a2240c0c..bdbf358697cd 100644 |
802 | --- a/drivers/gpu/drm/mediatek/mtk_dsi.c |
803 | +++ b/drivers/gpu/drm/mediatek/mtk_dsi.c |
804 | @@ -720,6 +720,8 @@ static void mtk_dsi_destroy_conn_enc(struct mtk_dsi *dsi) |
805 | /* Skip connector cleanup if creation was delegated to the bridge */ |
806 | if (dsi->conn.dev) |
807 | drm_connector_cleanup(&dsi->conn); |
808 | + if (dsi->panel) |
809 | + drm_panel_detach(dsi->panel); |
810 | } |
811 | |
812 | static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp) |
813 | diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c |
814 | index c00bad02761a..0d75bc7b5065 100644 |
815 | --- a/drivers/hwmon/pmbus/pmbus_core.c |
816 | +++ b/drivers/hwmon/pmbus/pmbus_core.c |
817 | @@ -1028,14 +1028,15 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client, |
818 | const struct pmbus_driver_info *info, |
819 | const char *name, |
820 | int index, int page, |
821 | - const struct pmbus_sensor_attr *attr) |
822 | + const struct pmbus_sensor_attr *attr, |
823 | + bool paged) |
824 | { |
825 | struct pmbus_sensor *base; |
826 | int ret; |
827 | |
828 | if (attr->label) { |
829 | ret = pmbus_add_label(data, name, index, attr->label, |
830 | - attr->paged ? page + 1 : 0); |
831 | + paged ? page + 1 : 0); |
832 | if (ret) |
833 | return ret; |
834 | } |
835 | @@ -1067,6 +1068,30 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client, |
836 | return 0; |
837 | } |
838 | |
839 | +static bool pmbus_sensor_is_paged(const struct pmbus_driver_info *info, |
840 | + const struct pmbus_sensor_attr *attr) |
841 | +{ |
842 | + int p; |
843 | + |
844 | + if (attr->paged) |
845 | + return true; |
846 | + |
847 | + /* |
848 | + * Some attributes may be present on more than one page despite |
849 | + * not being marked with the paged attribute. If that is the case, |
850 | + * then treat the sensor as being paged and add the page suffix to the |
851 | + * attribute name. |
852 | + * We don't just add the paged attribute to all such attributes, in |
853 | + * order to maintain the un-suffixed labels in the case where the |
854 | + * attribute is only on page 0. |
855 | + */ |
856 | + for (p = 1; p < info->pages; p++) { |
857 | + if (info->func[p] & attr->func) |
858 | + return true; |
859 | + } |
860 | + return false; |
861 | +} |
862 | + |
863 | static int pmbus_add_sensor_attrs(struct i2c_client *client, |
864 | struct pmbus_data *data, |
865 | const char *name, |
866 | @@ -1080,14 +1105,15 @@ static int pmbus_add_sensor_attrs(struct i2c_client *client, |
867 | index = 1; |
868 | for (i = 0; i < nattrs; i++) { |
869 | int page, pages; |
870 | + bool paged = pmbus_sensor_is_paged(info, attrs); |
871 | |
872 | - pages = attrs->paged ? info->pages : 1; |
873 | + pages = paged ? info->pages : 1; |
874 | for (page = 0; page < pages; page++) { |
875 | if (!(info->func[page] & attrs->func)) |
876 | continue; |
877 | ret = pmbus_add_sensor_attrs_one(client, data, info, |
878 | name, index, page, |
879 | - attrs); |
880 | + attrs, paged); |
881 | if (ret) |
882 | return ret; |
883 | index++; |
884 | diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c |
885 | index d30b3b908621..85db856047a9 100644 |
886 | --- a/drivers/infiniband/hw/hfi1/chip.c |
887 | +++ b/drivers/infiniband/hw/hfi1/chip.c |
888 | @@ -9620,6 +9620,7 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd) |
889 | |
890 | /* disable the port */ |
891 | clear_rcvctrl(dd, RCV_CTRL_RCV_PORT_ENABLE_SMASK); |
892 | + cancel_work_sync(&ppd->freeze_work); |
893 | } |
894 | |
895 | static inline int init_cpu_counters(struct hfi1_devdata *dd) |
896 | diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c |
897 | index 9cbe52d21077..76e63c88a87a 100644 |
898 | --- a/drivers/infiniband/hw/hfi1/sdma.c |
899 | +++ b/drivers/infiniband/hw/hfi1/sdma.c |
900 | @@ -410,10 +410,7 @@ static void sdma_flush(struct sdma_engine *sde) |
901 | sdma_flush_descq(sde); |
902 | spin_lock_irqsave(&sde->flushlist_lock, flags); |
903 | /* copy flush list */ |
904 | - list_for_each_entry_safe(txp, txp_next, &sde->flushlist, list) { |
905 | - list_del_init(&txp->list); |
906 | - list_add_tail(&txp->list, &flushlist); |
907 | - } |
908 | + list_splice_init(&sde->flushlist, &flushlist); |
909 | spin_unlock_irqrestore(&sde->flushlist_lock, flags); |
910 | /* flush from flush list */ |
911 | list_for_each_entry_safe(txp, txp_next, &flushlist, list) |
912 | @@ -2406,7 +2403,7 @@ unlock_noconn: |
913 | wait->tx_count++; |
914 | wait->count += tx->num_desc; |
915 | } |
916 | - schedule_work(&sde->flush_worker); |
917 | + queue_work_on(sde->cpu, system_highpri_wq, &sde->flush_worker); |
918 | ret = -ECOMM; |
919 | goto unlock; |
920 | nodesc: |
921 | @@ -2504,7 +2501,7 @@ unlock_noconn: |
922 | } |
923 | } |
924 | spin_unlock(&sde->flushlist_lock); |
925 | - schedule_work(&sde->flush_worker); |
926 | + queue_work_on(sde->cpu, system_highpri_wq, &sde->flush_worker); |
927 | ret = -ECOMM; |
928 | goto update_tail; |
929 | nodesc: |
930 | diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c |
931 | index 4c111162d552..098296aaa225 100644 |
932 | --- a/drivers/infiniband/hw/hfi1/user_sdma.c |
933 | +++ b/drivers/infiniband/hw/hfi1/user_sdma.c |
934 | @@ -260,7 +260,6 @@ struct user_sdma_txreq { |
935 | struct list_head list; |
936 | struct user_sdma_request *req; |
937 | u16 flags; |
938 | - unsigned busycount; |
939 | u64 seqnum; |
940 | }; |
941 | |
942 | @@ -323,25 +322,22 @@ static int defer_packet_queue( |
943 | struct hfi1_user_sdma_pkt_q *pq = |
944 | container_of(wait, struct hfi1_user_sdma_pkt_q, busy); |
945 | struct hfi1_ibdev *dev = &pq->dd->verbs_dev; |
946 | - struct user_sdma_txreq *tx = |
947 | - container_of(txreq, struct user_sdma_txreq, txreq); |
948 | |
949 | - if (sdma_progress(sde, seq, txreq)) { |
950 | - if (tx->busycount++ < MAX_DEFER_RETRY_COUNT) |
951 | - goto eagain; |
952 | - } |
953 | + write_seqlock(&dev->iowait_lock); |
954 | + if (sdma_progress(sde, seq, txreq)) |
955 | + goto eagain; |
956 | /* |
957 | * We are assuming that if the list is enqueued somewhere, it |
958 | * is to the dmawait list since that is the only place where |
959 | * it is supposed to be enqueued. |
960 | */ |
961 | xchg(&pq->state, SDMA_PKT_Q_DEFERRED); |
962 | - write_seqlock(&dev->iowait_lock); |
963 | if (list_empty(&pq->busy.list)) |
964 | list_add_tail(&pq->busy.list, &sde->dmawait); |
965 | write_sequnlock(&dev->iowait_lock); |
966 | return -EBUSY; |
967 | eagain: |
968 | + write_sequnlock(&dev->iowait_lock); |
969 | return -EAGAIN; |
970 | } |
971 | |
972 | @@ -925,7 +921,6 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts) |
973 | |
974 | tx->flags = 0; |
975 | tx->req = req; |
976 | - tx->busycount = 0; |
977 | INIT_LIST_HEAD(&tx->list); |
978 | |
979 | if (req->seqnum == req->info.npkts - 1) |
980 | diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c |
981 | index d9c71750e22d..15054a0cbf6d 100644 |
982 | --- a/drivers/infiniband/hw/hfi1/verbs.c |
983 | +++ b/drivers/infiniband/hw/hfi1/verbs.c |
984 | @@ -1344,8 +1344,6 @@ static void hfi1_fill_device_attr(struct hfi1_devdata *dd) |
985 | rdi->dparms.props.max_cq = hfi1_max_cqs; |
986 | rdi->dparms.props.max_ah = hfi1_max_ahs; |
987 | rdi->dparms.props.max_cqe = hfi1_max_cqes; |
988 | - rdi->dparms.props.max_mr = rdi->lkey_table.max; |
989 | - rdi->dparms.props.max_fmr = rdi->lkey_table.max; |
990 | rdi->dparms.props.max_map_per_fmr = 32767; |
991 | rdi->dparms.props.max_pd = hfi1_max_pds; |
992 | rdi->dparms.props.max_qp_rd_atom = HFI1_MAX_RDMA_ATOMIC; |
993 | diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.c b/drivers/infiniband/hw/hfi1/verbs_txreq.c |
994 | index d8a5bad49680..837729d0be46 100644 |
995 | --- a/drivers/infiniband/hw/hfi1/verbs_txreq.c |
996 | +++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c |
997 | @@ -100,7 +100,7 @@ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev, |
998 | if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) { |
999 | struct hfi1_qp_priv *priv; |
1000 | |
1001 | - tx = kmem_cache_alloc(dev->verbs_txreq_cache, GFP_ATOMIC); |
1002 | + tx = kmem_cache_alloc(dev->verbs_txreq_cache, VERBS_TXREQ_GFP); |
1003 | if (tx) |
1004 | goto out; |
1005 | priv = qp->priv; |
1006 | diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.h b/drivers/infiniband/hw/hfi1/verbs_txreq.h |
1007 | index 31ded57592ee..0bd58a0772e2 100644 |
1008 | --- a/drivers/infiniband/hw/hfi1/verbs_txreq.h |
1009 | +++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h |
1010 | @@ -71,6 +71,7 @@ struct hfi1_ibdev; |
1011 | struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev, |
1012 | struct rvt_qp *qp); |
1013 | |
1014 | +#define VERBS_TXREQ_GFP (GFP_ATOMIC | __GFP_NOWARN) |
1015 | static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev, |
1016 | struct rvt_qp *qp) |
1017 | __must_hold(&qp->slock) |
1018 | @@ -78,7 +79,7 @@ static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev, |
1019 | struct verbs_txreq *tx; |
1020 | struct hfi1_qp_priv *priv = qp->priv; |
1021 | |
1022 | - tx = kmem_cache_alloc(dev->verbs_txreq_cache, GFP_ATOMIC); |
1023 | + tx = kmem_cache_alloc(dev->verbs_txreq_cache, VERBS_TXREQ_GFP); |
1024 | if (unlikely(!tx)) { |
1025 | /* call slow path to get the lock */ |
1026 | tx = __get_txreq(dev, qp); |
1027 | diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c |
1028 | index 954f15064514..d6e183775e24 100644 |
1029 | --- a/drivers/infiniband/hw/qib/qib_verbs.c |
1030 | +++ b/drivers/infiniband/hw/qib/qib_verbs.c |
1031 | @@ -1568,8 +1568,6 @@ static void qib_fill_device_attr(struct qib_devdata *dd) |
1032 | rdi->dparms.props.max_cq = ib_qib_max_cqs; |
1033 | rdi->dparms.props.max_cqe = ib_qib_max_cqes; |
1034 | rdi->dparms.props.max_ah = ib_qib_max_ahs; |
1035 | - rdi->dparms.props.max_mr = rdi->lkey_table.max; |
1036 | - rdi->dparms.props.max_fmr = rdi->lkey_table.max; |
1037 | rdi->dparms.props.max_map_per_fmr = 32767; |
1038 | rdi->dparms.props.max_qp_rd_atom = QIB_MAX_RDMA_ATOMIC; |
1039 | rdi->dparms.props.max_qp_init_rd_atom = 255; |
1040 | diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c |
1041 | index 49d55a0322f6..dbd4c0d268e9 100644 |
1042 | --- a/drivers/infiniband/sw/rdmavt/mr.c |
1043 | +++ b/drivers/infiniband/sw/rdmavt/mr.c |
1044 | @@ -94,6 +94,8 @@ int rvt_driver_mr_init(struct rvt_dev_info *rdi) |
1045 | for (i = 0; i < rdi->lkey_table.max; i++) |
1046 | RCU_INIT_POINTER(rdi->lkey_table.table[i], NULL); |
1047 | |
1048 | + rdi->dparms.props.max_mr = rdi->lkey_table.max; |
1049 | + rdi->dparms.props.max_fmr = rdi->lkey_table.max; |
1050 | return 0; |
1051 | } |
1052 | |
1053 | diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c |
1054 | index 6500c3b5a89c..8b330b53d636 100644 |
1055 | --- a/drivers/infiniband/sw/rdmavt/qp.c |
1056 | +++ b/drivers/infiniband/sw/rdmavt/qp.c |
1057 | @@ -370,7 +370,8 @@ static int alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt, |
1058 | offset = qpt->incr | ((offset & 1) ^ 1); |
1059 | } |
1060 | /* there can be no set bits in low-order QoS bits */ |
1061 | - WARN_ON(offset & (BIT(rdi->dparms.qos_shift) - 1)); |
1062 | + WARN_ON(rdi->dparms.qos_shift > 1 && |
1063 | + offset & ((BIT(rdi->dparms.qos_shift - 1) - 1) << 1)); |
1064 | qpn = mk_qpn(qpt, map, offset); |
1065 | } |
1066 | |
1067 | diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c |
1068 | index a306453d40d2..89d37d0d45ed 100644 |
1069 | --- a/drivers/input/misc/uinput.c |
1070 | +++ b/drivers/input/misc/uinput.c |
1071 | @@ -991,13 +991,31 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg) |
1072 | |
1073 | #ifdef CONFIG_COMPAT |
1074 | |
1075 | -#define UI_SET_PHYS_COMPAT _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) |
1076 | +/* |
1077 | + * These IOCTLs change their size and thus their numbers between |
1078 | + * 32 and 64 bits. |
1079 | + */ |
1080 | +#define UI_SET_PHYS_COMPAT \ |
1081 | + _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) |
1082 | +#define UI_BEGIN_FF_UPLOAD_COMPAT \ |
1083 | + _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat) |
1084 | +#define UI_END_FF_UPLOAD_COMPAT \ |
1085 | + _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat) |
1086 | |
1087 | static long uinput_compat_ioctl(struct file *file, |
1088 | unsigned int cmd, unsigned long arg) |
1089 | { |
1090 | - if (cmd == UI_SET_PHYS_COMPAT) |
1091 | + switch (cmd) { |
1092 | + case UI_SET_PHYS_COMPAT: |
1093 | cmd = UI_SET_PHYS; |
1094 | + break; |
1095 | + case UI_BEGIN_FF_UPLOAD_COMPAT: |
1096 | + cmd = UI_BEGIN_FF_UPLOAD; |
1097 | + break; |
1098 | + case UI_END_FF_UPLOAD_COMPAT: |
1099 | + cmd = UI_END_FF_UPLOAD; |
1100 | + break; |
1101 | + } |
1102 | |
1103 | return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg)); |
1104 | } |
1105 | diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c |
1106 | index 9d167c9af2c6..e153276ed954 100644 |
1107 | --- a/drivers/mfd/omap-usb-tll.c |
1108 | +++ b/drivers/mfd/omap-usb-tll.c |
1109 | @@ -131,12 +131,12 @@ static inline u32 usbtll_read(void __iomem *base, u32 reg) |
1110 | return readl_relaxed(base + reg); |
1111 | } |
1112 | |
1113 | -static inline void usbtll_writeb(void __iomem *base, u8 reg, u8 val) |
1114 | +static inline void usbtll_writeb(void __iomem *base, u32 reg, u8 val) |
1115 | { |
1116 | writeb_relaxed(val, base + reg); |
1117 | } |
1118 | |
1119 | -static inline u8 usbtll_readb(void __iomem *base, u8 reg) |
1120 | +static inline u8 usbtll_readb(void __iomem *base, u32 reg) |
1121 | { |
1122 | return readb_relaxed(base + reg); |
1123 | } |
1124 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c |
1125 | index 93169729dfc9..fd01138c411e 100644 |
1126 | --- a/drivers/net/bonding/bond_main.c |
1127 | +++ b/drivers/net/bonding/bond_main.c |
1128 | @@ -4241,12 +4241,12 @@ void bond_setup(struct net_device *bond_dev) |
1129 | bond_dev->features |= NETIF_F_NETNS_LOCAL; |
1130 | |
1131 | bond_dev->hw_features = BOND_VLAN_FEATURES | |
1132 | - NETIF_F_HW_VLAN_CTAG_TX | |
1133 | NETIF_F_HW_VLAN_CTAG_RX | |
1134 | NETIF_F_HW_VLAN_CTAG_FILTER; |
1135 | |
1136 | bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL; |
1137 | bond_dev->features |= bond_dev->hw_features; |
1138 | + bond_dev->features |= NETIF_F_HW_VLAN_CTAG_TX; |
1139 | } |
1140 | |
1141 | /* Destroy a bonding device. |
1142 | diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c |
1143 | index 47f43bdecd51..baef09b9449f 100644 |
1144 | --- a/drivers/net/can/flexcan.c |
1145 | +++ b/drivers/net/can/flexcan.c |
1146 | @@ -171,7 +171,7 @@ |
1147 | #define FLEXCAN_MB_CNT_LENGTH(x) (((x) & 0xf) << 16) |
1148 | #define FLEXCAN_MB_CNT_TIMESTAMP(x) ((x) & 0xffff) |
1149 | |
1150 | -#define FLEXCAN_TIMEOUT_US (50) |
1151 | +#define FLEXCAN_TIMEOUT_US (250) |
1152 | |
1153 | /* FLEXCAN hardware feature flags |
1154 | * |
1155 | diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c |
1156 | index dc510069d37b..2edd193c96ab 100644 |
1157 | --- a/drivers/net/dsa/mv88e6xxx/chip.c |
1158 | +++ b/drivers/net/dsa/mv88e6xxx/chip.c |
1159 | @@ -1742,7 +1742,7 @@ static int _mv88e6xxx_vtu_get(struct mv88e6xxx_chip *chip, u16 vid, |
1160 | int err; |
1161 | |
1162 | if (!vid) |
1163 | - return -EINVAL; |
1164 | + return -EOPNOTSUPP; |
1165 | |
1166 | err = _mv88e6xxx_vtu_vid_write(chip, vid - 1); |
1167 | if (err) |
1168 | diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c |
1169 | index 4cd163390dcc..f38848c4f69d 100644 |
1170 | --- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c |
1171 | +++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c |
1172 | @@ -367,6 +367,7 @@ static int __lb_setup(struct net_device *ndev, |
1173 | static int __lb_up(struct net_device *ndev, |
1174 | enum hnae_loop loop_mode) |
1175 | { |
1176 | +#define NIC_LB_TEST_WAIT_PHY_LINK_TIME 300 |
1177 | struct hns_nic_priv *priv = netdev_priv(ndev); |
1178 | struct hnae_handle *h = priv->ae_handle; |
1179 | int speed, duplex; |
1180 | @@ -393,6 +394,9 @@ static int __lb_up(struct net_device *ndev, |
1181 | |
1182 | h->dev->ops->adjust_link(h, speed, duplex); |
1183 | |
1184 | + /* wait adjust link done and phy ready */ |
1185 | + msleep(NIC_LB_TEST_WAIT_PHY_LINK_TIME); |
1186 | + |
1187 | return 0; |
1188 | } |
1189 | |
1190 | diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c |
1191 | index 20de37a414fe..d10c8a8156bc 100644 |
1192 | --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c |
1193 | +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c |
1194 | @@ -1700,6 +1700,7 @@ static void mtk_poll_controller(struct net_device *dev) |
1195 | |
1196 | static int mtk_start_dma(struct mtk_eth *eth) |
1197 | { |
1198 | + u32 rx_2b_offset = (NET_IP_ALIGN == 2) ? MTK_RX_2B_OFFSET : 0; |
1199 | int err; |
1200 | |
1201 | err = mtk_dma_init(eth); |
1202 | @@ -1714,7 +1715,7 @@ static int mtk_start_dma(struct mtk_eth *eth) |
1203 | MTK_QDMA_GLO_CFG); |
1204 | |
1205 | mtk_w32(eth, |
1206 | - MTK_RX_DMA_EN | MTK_RX_2B_OFFSET | |
1207 | + MTK_RX_DMA_EN | rx_2b_offset | |
1208 | MTK_RX_BT_32DWORDS | MTK_MULTI_EN, |
1209 | MTK_PDMA_GLO_CFG); |
1210 | |
1211 | @@ -2175,13 +2176,13 @@ static int mtk_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, |
1212 | |
1213 | switch (cmd->cmd) { |
1214 | case ETHTOOL_GRXRINGS: |
1215 | - if (dev->features & NETIF_F_LRO) { |
1216 | + if (dev->hw_features & NETIF_F_LRO) { |
1217 | cmd->data = MTK_MAX_RX_RING_NUM; |
1218 | ret = 0; |
1219 | } |
1220 | break; |
1221 | case ETHTOOL_GRXCLSRLCNT: |
1222 | - if (dev->features & NETIF_F_LRO) { |
1223 | + if (dev->hw_features & NETIF_F_LRO) { |
1224 | struct mtk_mac *mac = netdev_priv(dev); |
1225 | |
1226 | cmd->rule_cnt = mac->hwlro_ip_cnt; |
1227 | @@ -2189,11 +2190,11 @@ static int mtk_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, |
1228 | } |
1229 | break; |
1230 | case ETHTOOL_GRXCLSRULE: |
1231 | - if (dev->features & NETIF_F_LRO) |
1232 | + if (dev->hw_features & NETIF_F_LRO) |
1233 | ret = mtk_hwlro_get_fdir_entry(dev, cmd); |
1234 | break; |
1235 | case ETHTOOL_GRXCLSRLALL: |
1236 | - if (dev->features & NETIF_F_LRO) |
1237 | + if (dev->hw_features & NETIF_F_LRO) |
1238 | ret = mtk_hwlro_get_fdir_all(dev, cmd, |
1239 | rule_locs); |
1240 | break; |
1241 | @@ -2210,11 +2211,11 @@ static int mtk_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd) |
1242 | |
1243 | switch (cmd->cmd) { |
1244 | case ETHTOOL_SRXCLSRLINS: |
1245 | - if (dev->features & NETIF_F_LRO) |
1246 | + if (dev->hw_features & NETIF_F_LRO) |
1247 | ret = mtk_hwlro_add_ipaddr(dev, cmd); |
1248 | break; |
1249 | case ETHTOOL_SRXCLSRLDEL: |
1250 | - if (dev->features & NETIF_F_LRO) |
1251 | + if (dev->hw_features & NETIF_F_LRO) |
1252 | ret = mtk_hwlro_del_ipaddr(dev, cmd); |
1253 | break; |
1254 | default: |
1255 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c |
1256 | index f4074e25fb71..25136941a964 100644 |
1257 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c |
1258 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c |
1259 | @@ -125,7 +125,7 @@ static int stmmac_adjust_systime(void __iomem *ioaddr, u32 sec, u32 nsec, |
1260 | * programmed with (2^32 – <new_sec_value>) |
1261 | */ |
1262 | if (gmac4) |
1263 | - sec = (100000000ULL - sec); |
1264 | + sec = -sec; |
1265 | |
1266 | value = readl(ioaddr + PTP_TCR); |
1267 | if (value & PTP_TCR_TSCTRLSSR) |
1268 | diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c |
1269 | index 3eb6d48c3148..0acdf73aa1b0 100644 |
1270 | --- a/drivers/net/team/team.c |
1271 | +++ b/drivers/net/team/team.c |
1272 | @@ -2136,12 +2136,12 @@ static void team_setup(struct net_device *dev) |
1273 | dev->features |= NETIF_F_NETNS_LOCAL; |
1274 | |
1275 | dev->hw_features = TEAM_VLAN_FEATURES | |
1276 | - NETIF_F_HW_VLAN_CTAG_TX | |
1277 | NETIF_F_HW_VLAN_CTAG_RX | |
1278 | NETIF_F_HW_VLAN_CTAG_FILTER; |
1279 | |
1280 | dev->hw_features |= NETIF_F_GSO_ENCAP_ALL; |
1281 | dev->features |= dev->hw_features; |
1282 | + dev->features |= NETIF_F_HW_VLAN_CTAG_TX; |
1283 | } |
1284 | |
1285 | static int team_newlink(struct net *src_net, struct net_device *dev, |
1286 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c |
1287 | index 88fe38d6a7ef..36136a147867 100644 |
1288 | --- a/drivers/net/tun.c |
1289 | +++ b/drivers/net/tun.c |
1290 | @@ -828,18 +828,8 @@ static void tun_net_uninit(struct net_device *dev) |
1291 | /* Net device open. */ |
1292 | static int tun_net_open(struct net_device *dev) |
1293 | { |
1294 | - struct tun_struct *tun = netdev_priv(dev); |
1295 | - int i; |
1296 | - |
1297 | netif_tx_start_all_queues(dev); |
1298 | |
1299 | - for (i = 0; i < tun->numqueues; i++) { |
1300 | - struct tun_file *tfile; |
1301 | - |
1302 | - tfile = rtnl_dereference(tun->tfiles[i]); |
1303 | - tfile->socket.sk->sk_write_space(tfile->socket.sk); |
1304 | - } |
1305 | - |
1306 | return 0; |
1307 | } |
1308 | |
1309 | @@ -2534,6 +2524,7 @@ static int tun_device_event(struct notifier_block *unused, |
1310 | { |
1311 | struct net_device *dev = netdev_notifier_info_to_dev(ptr); |
1312 | struct tun_struct *tun = netdev_priv(dev); |
1313 | + int i; |
1314 | |
1315 | if (dev->rtnl_link_ops != &tun_link_ops) |
1316 | return NOTIFY_DONE; |
1317 | @@ -2543,6 +2534,14 @@ static int tun_device_event(struct notifier_block *unused, |
1318 | if (tun_queue_resize(tun)) |
1319 | return NOTIFY_BAD; |
1320 | break; |
1321 | + case NETDEV_UP: |
1322 | + for (i = 0; i < tun->numqueues; i++) { |
1323 | + struct tun_file *tfile; |
1324 | + |
1325 | + tfile = rtnl_dereference(tun->tfiles[i]); |
1326 | + tfile->socket.sk->sk_write_space(tfile->socket.sk); |
1327 | + } |
1328 | + break; |
1329 | default: |
1330 | break; |
1331 | } |
1332 | diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c |
1333 | index 979c6ecc6446..8705bfe7bb73 100644 |
1334 | --- a/drivers/nvme/host/core.c |
1335 | +++ b/drivers/nvme/host/core.c |
1336 | @@ -1765,7 +1765,8 @@ static int nvme_scan_ns_list(struct nvme_ctrl *ctrl, unsigned nn) |
1337 | { |
1338 | struct nvme_ns *ns; |
1339 | __le32 *ns_list; |
1340 | - unsigned i, j, nsid, prev = 0, num_lists = DIV_ROUND_UP(nn, 1024); |
1341 | + unsigned i, j, nsid, prev = 0; |
1342 | + unsigned num_lists = DIV_ROUND_UP_ULL((u64)nn, 1024); |
1343 | int ret = 0; |
1344 | |
1345 | ns_list = kzalloc(0x1000, GFP_KERNEL); |
1346 | diff --git a/drivers/parport/share.c b/drivers/parport/share.c |
1347 | index 4399de34054a..daa2eb3050df 100644 |
1348 | --- a/drivers/parport/share.c |
1349 | +++ b/drivers/parport/share.c |
1350 | @@ -895,6 +895,7 @@ parport_register_dev_model(struct parport *port, const char *name, |
1351 | par_dev->devmodel = true; |
1352 | ret = device_register(&par_dev->dev); |
1353 | if (ret) { |
1354 | + kfree(par_dev->state); |
1355 | put_device(&par_dev->dev); |
1356 | goto err_put_port; |
1357 | } |
1358 | @@ -912,6 +913,7 @@ parport_register_dev_model(struct parport *port, const char *name, |
1359 | spin_unlock(&port->physport->pardevice_lock); |
1360 | pr_debug("%s: cannot grant exclusive access for device %s\n", |
1361 | port->name, name); |
1362 | + kfree(par_dev->state); |
1363 | device_unregister(&par_dev->dev); |
1364 | goto err_put_port; |
1365 | } |
1366 | diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c |
1367 | index 58404e69aa4b..6ba4e921d2fd 100644 |
1368 | --- a/drivers/s390/net/qeth_l2_main.c |
1369 | +++ b/drivers/s390/net/qeth_l2_main.c |
1370 | @@ -2124,7 +2124,7 @@ static void qeth_bridgeport_an_set_cb(void *priv, |
1371 | |
1372 | l2entry = (struct qdio_brinfo_entry_l2 *)entry; |
1373 | code = IPA_ADDR_CHANGE_CODE_MACADDR; |
1374 | - if (l2entry->addr_lnid.lnid) |
1375 | + if (l2entry->addr_lnid.lnid < VLAN_N_VID) |
1376 | code |= IPA_ADDR_CHANGE_CODE_VLANID; |
1377 | qeth_bridge_emit_host_event(card, anev_reg_unreg, code, |
1378 | (struct net_if_token *)&l2entry->nit, |
1379 | diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c |
1380 | index 0b8db8a74d50..9f98c7211ec2 100644 |
1381 | --- a/drivers/scsi/hpsa.c |
1382 | +++ b/drivers/scsi/hpsa.c |
1383 | @@ -4815,7 +4815,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, |
1384 | curr_sg->reserved[0] = 0; |
1385 | curr_sg->reserved[1] = 0; |
1386 | curr_sg->reserved[2] = 0; |
1387 | - curr_sg->chain_indicator = 0x80; |
1388 | + curr_sg->chain_indicator = IOACCEL2_CHAIN; |
1389 | |
1390 | curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex]; |
1391 | } |
1392 | @@ -4832,6 +4832,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, |
1393 | curr_sg++; |
1394 | } |
1395 | |
1396 | + /* |
1397 | + * Set the last s/g element bit |
1398 | + */ |
1399 | + (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG; |
1400 | + |
1401 | switch (cmd->sc_data_direction) { |
1402 | case DMA_TO_DEVICE: |
1403 | cp->direction &= ~IOACCEL2_DIRECTION_MASK; |
1404 | diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h |
1405 | index 5961705eef76..39bcbec93c60 100644 |
1406 | --- a/drivers/scsi/hpsa_cmd.h |
1407 | +++ b/drivers/scsi/hpsa_cmd.h |
1408 | @@ -516,6 +516,7 @@ struct ioaccel2_sg_element { |
1409 | u8 reserved[3]; |
1410 | u8 chain_indicator; |
1411 | #define IOACCEL2_CHAIN 0x80 |
1412 | +#define IOACCEL2_LAST_SG 0x40 |
1413 | }; |
1414 | |
1415 | /* |
1416 | diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c |
1417 | index a72a4ba78125..b47decc1fb5b 100644 |
1418 | --- a/drivers/scsi/ufs/ufshcd-pltfrm.c |
1419 | +++ b/drivers/scsi/ufs/ufshcd-pltfrm.c |
1420 | @@ -342,24 +342,21 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, |
1421 | goto dealloc_host; |
1422 | } |
1423 | |
1424 | - pm_runtime_set_active(&pdev->dev); |
1425 | - pm_runtime_enable(&pdev->dev); |
1426 | - |
1427 | ufshcd_init_lanes_per_dir(hba); |
1428 | |
1429 | err = ufshcd_init(hba, mmio_base, irq); |
1430 | if (err) { |
1431 | dev_err(dev, "Initialization failed\n"); |
1432 | - goto out_disable_rpm; |
1433 | + goto dealloc_host; |
1434 | } |
1435 | |
1436 | platform_set_drvdata(pdev, hba); |
1437 | |
1438 | + pm_runtime_set_active(&pdev->dev); |
1439 | + pm_runtime_enable(&pdev->dev); |
1440 | + |
1441 | return 0; |
1442 | |
1443 | -out_disable_rpm: |
1444 | - pm_runtime_disable(&pdev->dev); |
1445 | - pm_runtime_set_suspended(&pdev->dev); |
1446 | dealloc_host: |
1447 | ufshcd_dealloc_host(hba); |
1448 | out: |
1449 | diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c |
1450 | index 0fe4f8e8c8c9..a9c172692f21 100644 |
1451 | --- a/drivers/scsi/ufs/ufshcd.c |
1452 | +++ b/drivers/scsi/ufs/ufshcd.c |
1453 | @@ -941,7 +941,8 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) |
1454 | memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE); |
1455 | |
1456 | /* Get the descriptor */ |
1457 | - if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { |
1458 | + if (hba->dev_cmd.query.descriptor && |
1459 | + lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { |
1460 | u8 *descp = (u8 *)lrbp->ucd_rsp_ptr + |
1461 | GENERAL_UPIU_REQUEST_SIZE; |
1462 | u16 resp_len; |
1463 | diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c |
1464 | index fcfbe2dcd025..df6fabcce4f7 100644 |
1465 | --- a/drivers/scsi/vmw_pvscsi.c |
1466 | +++ b/drivers/scsi/vmw_pvscsi.c |
1467 | @@ -766,6 +766,7 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd |
1468 | struct pvscsi_adapter *adapter = shost_priv(host); |
1469 | struct pvscsi_ctx *ctx; |
1470 | unsigned long flags; |
1471 | + unsigned char op; |
1472 | |
1473 | spin_lock_irqsave(&adapter->hw_lock, flags); |
1474 | |
1475 | @@ -778,13 +779,14 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd |
1476 | } |
1477 | |
1478 | cmd->scsi_done = done; |
1479 | + op = cmd->cmnd[0]; |
1480 | |
1481 | dev_dbg(&cmd->device->sdev_gendev, |
1482 | - "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]); |
1483 | + "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op); |
1484 | |
1485 | spin_unlock_irqrestore(&adapter->hw_lock, flags); |
1486 | |
1487 | - pvscsi_kick_io(adapter, cmd->cmnd[0]); |
1488 | + pvscsi_kick_io(adapter, op); |
1489 | |
1490 | return 0; |
1491 | } |
1492 | diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c |
1493 | index 3aa9e6e3dac8..4ef54436b9d4 100644 |
1494 | --- a/drivers/spi/spi-bitbang.c |
1495 | +++ b/drivers/spi/spi-bitbang.c |
1496 | @@ -392,7 +392,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang) |
1497 | if (ret) |
1498 | spi_master_put(master); |
1499 | |
1500 | - return 0; |
1501 | + return ret; |
1502 | } |
1503 | EXPORT_SYMBOL_GPL(spi_bitbang_start); |
1504 | |
1505 | diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c |
1506 | index e8e8973939d3..447d791bde22 100644 |
1507 | --- a/drivers/tty/rocket.c |
1508 | +++ b/drivers/tty/rocket.c |
1509 | @@ -279,7 +279,7 @@ MODULE_PARM_DESC(pc104_3, "set interface types for ISA(PC104) board #3 (e.g. pc1 |
1510 | module_param_array(pc104_4, ulong, NULL, 0); |
1511 | MODULE_PARM_DESC(pc104_4, "set interface types for ISA(PC104) board #4 (e.g. pc104_4=232,232,485,485,..."); |
1512 | |
1513 | -static int rp_init(void); |
1514 | +static int __init rp_init(void); |
1515 | static void rp_cleanup_module(void); |
1516 | |
1517 | module_init(rp_init); |
1518 | diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c |
1519 | index 6a15b7250e9c..0f9859478649 100644 |
1520 | --- a/drivers/usb/chipidea/udc.c |
1521 | +++ b/drivers/usb/chipidea/udc.c |
1522 | @@ -1621,6 +1621,25 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on) |
1523 | static int ci_udc_start(struct usb_gadget *gadget, |
1524 | struct usb_gadget_driver *driver); |
1525 | static int ci_udc_stop(struct usb_gadget *gadget); |
1526 | + |
1527 | +/* Match ISOC IN from the highest endpoint */ |
1528 | +static struct usb_ep *ci_udc_match_ep(struct usb_gadget *gadget, |
1529 | + struct usb_endpoint_descriptor *desc, |
1530 | + struct usb_ss_ep_comp_descriptor *comp_desc) |
1531 | +{ |
1532 | + struct ci_hdrc *ci = container_of(gadget, struct ci_hdrc, gadget); |
1533 | + struct usb_ep *ep; |
1534 | + |
1535 | + if (usb_endpoint_xfer_isoc(desc) && usb_endpoint_dir_in(desc)) { |
1536 | + list_for_each_entry_reverse(ep, &ci->gadget.ep_list, ep_list) { |
1537 | + if (ep->caps.dir_in && !ep->claimed) |
1538 | + return ep; |
1539 | + } |
1540 | + } |
1541 | + |
1542 | + return NULL; |
1543 | +} |
1544 | + |
1545 | /** |
1546 | * Device operations part of the API to the USB controller hardware, |
1547 | * which don't involve endpoints (or i/o) |
1548 | @@ -1634,6 +1653,7 @@ static const struct usb_gadget_ops usb_gadget_ops = { |
1549 | .vbus_draw = ci_udc_vbus_draw, |
1550 | .udc_start = ci_udc_start, |
1551 | .udc_stop = ci_udc_stop, |
1552 | + .match_ep = ci_udc_match_ep, |
1553 | }; |
1554 | |
1555 | static int init_eps(struct ci_hdrc *ci) |
1556 | diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c |
1557 | index 948845c90e47..351012c498c5 100644 |
1558 | --- a/drivers/usb/gadget/udc/fusb300_udc.c |
1559 | +++ b/drivers/usb/gadget/udc/fusb300_udc.c |
1560 | @@ -1345,12 +1345,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = { |
1561 | static int fusb300_remove(struct platform_device *pdev) |
1562 | { |
1563 | struct fusb300 *fusb300 = platform_get_drvdata(pdev); |
1564 | + int i; |
1565 | |
1566 | usb_del_gadget_udc(&fusb300->gadget); |
1567 | iounmap(fusb300->reg); |
1568 | free_irq(platform_get_irq(pdev, 0), fusb300); |
1569 | |
1570 | fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); |
1571 | + for (i = 0; i < FUSB300_MAX_NUM_EP; i++) |
1572 | + kfree(fusb300->ep[i]); |
1573 | kfree(fusb300); |
1574 | |
1575 | return 0; |
1576 | @@ -1494,6 +1497,8 @@ clean_up: |
1577 | if (fusb300->ep0_req) |
1578 | fusb300_free_request(&fusb300->ep[0]->ep, |
1579 | fusb300->ep0_req); |
1580 | + for (i = 0; i < FUSB300_MAX_NUM_EP; i++) |
1581 | + kfree(fusb300->ep[i]); |
1582 | kfree(fusb300); |
1583 | } |
1584 | if (reg) |
1585 | diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c |
1586 | index 8f32b5ee7734..6df1aded4503 100644 |
1587 | --- a/drivers/usb/gadget/udc/lpc32xx_udc.c |
1588 | +++ b/drivers/usb/gadget/udc/lpc32xx_udc.c |
1589 | @@ -935,8 +935,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc) |
1590 | dma_addr_t dma; |
1591 | struct lpc32xx_usbd_dd_gad *dd; |
1592 | |
1593 | - dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc( |
1594 | - udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma); |
1595 | + dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma); |
1596 | if (dd) |
1597 | dd->this_dma = dma; |
1598 | |
1599 | diff --git a/fs/9p/acl.c b/fs/9p/acl.c |
1600 | index 082d227fa56b..6261719f6f2a 100644 |
1601 | --- a/fs/9p/acl.c |
1602 | +++ b/fs/9p/acl.c |
1603 | @@ -276,7 +276,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, |
1604 | switch (handler->flags) { |
1605 | case ACL_TYPE_ACCESS: |
1606 | if (acl) { |
1607 | - struct iattr iattr; |
1608 | + struct iattr iattr = { 0 }; |
1609 | struct posix_acl *old_acl = acl; |
1610 | |
1611 | retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl); |
1612 | diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c |
1613 | index 9b2917a30294..b18543b36ae1 100644 |
1614 | --- a/fs/binfmt_flat.c |
1615 | +++ b/fs/binfmt_flat.c |
1616 | @@ -859,9 +859,14 @@ err: |
1617 | |
1618 | static int load_flat_shared_library(int id, struct lib_info *libs) |
1619 | { |
1620 | + /* |
1621 | + * This is a fake bprm struct; only the members "buf", "file" and |
1622 | + * "filename" are actually used. |
1623 | + */ |
1624 | struct linux_binprm bprm; |
1625 | int res; |
1626 | char buf[16]; |
1627 | + loff_t pos = 0; |
1628 | |
1629 | memset(&bprm, 0, sizeof(bprm)); |
1630 | |
1631 | @@ -875,25 +880,11 @@ static int load_flat_shared_library(int id, struct lib_info *libs) |
1632 | if (IS_ERR(bprm.file)) |
1633 | return res; |
1634 | |
1635 | - bprm.cred = prepare_exec_creds(); |
1636 | - res = -ENOMEM; |
1637 | - if (!bprm.cred) |
1638 | - goto out; |
1639 | - |
1640 | - /* We don't really care about recalculating credentials at this point |
1641 | - * as we're past the point of no return and are dealing with shared |
1642 | - * libraries. |
1643 | - */ |
1644 | - bprm.cred_prepared = 1; |
1645 | + res = kernel_read(bprm.file, pos, bprm.buf, BINPRM_BUF_SIZE); |
1646 | |
1647 | - res = prepare_binprm(&bprm); |
1648 | - |
1649 | - if (!res) |
1650 | + if (res >= 0) |
1651 | res = load_flat_file(&bprm, libs, id, NULL); |
1652 | |
1653 | - abort_creds(bprm.cred); |
1654 | - |
1655 | -out: |
1656 | allow_write_access(bprm.file); |
1657 | fput(bprm.file); |
1658 | |
1659 | diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c |
1660 | index fb973cc0af66..395b07764269 100644 |
1661 | --- a/fs/btrfs/dev-replace.c |
1662 | +++ b/fs/btrfs/dev-replace.c |
1663 | @@ -511,18 +511,27 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, |
1664 | } |
1665 | btrfs_wait_ordered_roots(root->fs_info, -1, 0, (u64)-1); |
1666 | |
1667 | - trans = btrfs_start_transaction(root, 0); |
1668 | - if (IS_ERR(trans)) { |
1669 | - mutex_unlock(&dev_replace->lock_finishing_cancel_unmount); |
1670 | - return PTR_ERR(trans); |
1671 | + while (1) { |
1672 | + trans = btrfs_start_transaction(root, 0); |
1673 | + if (IS_ERR(trans)) { |
1674 | + mutex_unlock(&dev_replace->lock_finishing_cancel_unmount); |
1675 | + return PTR_ERR(trans); |
1676 | + } |
1677 | + ret = btrfs_commit_transaction(trans, root); |
1678 | + WARN_ON(ret); |
1679 | + mutex_lock(&uuid_mutex); |
1680 | + /* keep away write_all_supers() during the finishing procedure */ |
1681 | + mutex_lock(&root->fs_info->fs_devices->device_list_mutex); |
1682 | + mutex_lock(&root->fs_info->chunk_mutex); |
1683 | + if (src_device->has_pending_chunks) { |
1684 | + mutex_unlock(&root->fs_info->chunk_mutex); |
1685 | + mutex_unlock(&root->fs_info->fs_devices->device_list_mutex); |
1686 | + mutex_unlock(&uuid_mutex); |
1687 | + } else { |
1688 | + break; |
1689 | + } |
1690 | } |
1691 | - ret = btrfs_commit_transaction(trans, root); |
1692 | - WARN_ON(ret); |
1693 | |
1694 | - mutex_lock(&uuid_mutex); |
1695 | - /* keep away write_all_supers() during the finishing procedure */ |
1696 | - mutex_lock(&root->fs_info->fs_devices->device_list_mutex); |
1697 | - mutex_lock(&root->fs_info->chunk_mutex); |
1698 | btrfs_dev_replace_lock(dev_replace, 1); |
1699 | dev_replace->replace_state = |
1700 | scrub_ret ? BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED |
1701 | diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c |
1702 | index 75bab76739be..94441fdb1ecf 100644 |
1703 | --- a/fs/btrfs/reada.c |
1704 | +++ b/fs/btrfs/reada.c |
1705 | @@ -759,6 +759,7 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info) |
1706 | u64 total = 0; |
1707 | int i; |
1708 | |
1709 | +again: |
1710 | do { |
1711 | enqueued = 0; |
1712 | mutex_lock(&fs_devices->device_list_mutex); |
1713 | @@ -771,6 +772,10 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info) |
1714 | mutex_unlock(&fs_devices->device_list_mutex); |
1715 | total += enqueued; |
1716 | } while (enqueued && total < 10000); |
1717 | + if (fs_devices->seed) { |
1718 | + fs_devices = fs_devices->seed; |
1719 | + goto again; |
1720 | + } |
1721 | |
1722 | if (enqueued == 0) |
1723 | return; |
1724 | diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c |
1725 | index c063ac57c30e..94b61afe996c 100644 |
1726 | --- a/fs/btrfs/volumes.c |
1727 | +++ b/fs/btrfs/volumes.c |
1728 | @@ -4876,6 +4876,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, |
1729 | for (i = 0; i < map->num_stripes; i++) { |
1730 | num_bytes = map->stripes[i].dev->bytes_used + stripe_size; |
1731 | btrfs_device_set_bytes_used(map->stripes[i].dev, num_bytes); |
1732 | + map->stripes[i].dev->has_pending_chunks = true; |
1733 | } |
1734 | |
1735 | spin_lock(&extent_root->fs_info->free_chunk_lock); |
1736 | @@ -7250,6 +7251,7 @@ void btrfs_update_commit_device_bytes_used(struct btrfs_root *root, |
1737 | for (i = 0; i < map->num_stripes; i++) { |
1738 | dev = map->stripes[i].dev; |
1739 | dev->commit_bytes_used = dev->bytes_used; |
1740 | + dev->has_pending_chunks = false; |
1741 | } |
1742 | } |
1743 | unlock_chunks(root); |
1744 | diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h |
1745 | index 9c09aa29d6bd..663d66828cca 100644 |
1746 | --- a/fs/btrfs/volumes.h |
1747 | +++ b/fs/btrfs/volumes.h |
1748 | @@ -62,6 +62,11 @@ struct btrfs_device { |
1749 | |
1750 | spinlock_t io_lock ____cacheline_aligned; |
1751 | int running_pending; |
1752 | + /* When true means this device has pending chunk alloc in |
1753 | + * current transaction. Protected by chunk_mutex. |
1754 | + */ |
1755 | + bool has_pending_chunks; |
1756 | + |
1757 | /* regular prio bios */ |
1758 | struct btrfs_pending_bios pending_bios; |
1759 | /* WRITE_SYNC bios */ |
1760 | diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c |
1761 | index 90099896b838..c8863563c635 100644 |
1762 | --- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c |
1763 | +++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c |
1764 | @@ -17,7 +17,7 @@ |
1765 | |
1766 | #define NFSDBG_FACILITY NFSDBG_PNFS_LD |
1767 | |
1768 | -static unsigned int dataserver_timeo = NFS_DEF_TCP_RETRANS; |
1769 | +static unsigned int dataserver_timeo = NFS_DEF_TCP_TIMEO; |
1770 | static unsigned int dataserver_retrans; |
1771 | |
1772 | void nfs4_ff_layout_put_deviceid(struct nfs4_ff_layout_ds *mirror_ds) |
1773 | diff --git a/fs/proc/array.c b/fs/proc/array.c |
1774 | index 712b44c63701..9682bbf325d6 100644 |
1775 | --- a/fs/proc/array.c |
1776 | +++ b/fs/proc/array.c |
1777 | @@ -448,7 +448,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, |
1778 | * a program is not able to use ptrace(2) in that case. It is |
1779 | * safe because the task has stopped executing permanently. |
1780 | */ |
1781 | - if (permitted && (task->flags & PF_DUMPCORE)) { |
1782 | + if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE))) { |
1783 | if (try_get_task_stack(task)) { |
1784 | eip = KSTK_EIP(task); |
1785 | esp = KSTK_ESP(task); |
1786 | diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h |
1787 | index 6f96247226a4..89f079d6b41b 100644 |
1788 | --- a/include/asm-generic/bug.h |
1789 | +++ b/include/asm-generic/bug.h |
1790 | @@ -47,6 +47,7 @@ struct bug_entry { |
1791 | #ifndef HAVE_ARCH_BUG |
1792 | #define BUG() do { \ |
1793 | printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ |
1794 | + barrier_before_unreachable(); \ |
1795 | panic("BUG!"); \ |
1796 | } while (0) |
1797 | #endif |
1798 | diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h |
1799 | index 8e9b0cb8db41..61650c1830d4 100644 |
1800 | --- a/include/linux/compiler-gcc.h |
1801 | +++ b/include/linux/compiler-gcc.h |
1802 | @@ -233,6 +233,15 @@ |
1803 | #define annotate_unreachable() |
1804 | #endif |
1805 | |
1806 | +/* |
1807 | + * calling noreturn functions, __builtin_unreachable() and __builtin_trap() |
1808 | + * confuse the stack allocation in gcc, leading to overly large stack |
1809 | + * frames, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365 |
1810 | + * |
1811 | + * Adding an empty inline assembly before it works around the problem |
1812 | + */ |
1813 | +#define barrier_before_unreachable() asm volatile("") |
1814 | + |
1815 | /* |
1816 | * Mark a position in code as unreachable. This can be used to |
1817 | * suppress control flow warnings after asm blocks that transfer |
1818 | @@ -243,7 +252,11 @@ |
1819 | * unreleased. Really, we need to have autoconf for the kernel. |
1820 | */ |
1821 | #define unreachable() \ |
1822 | - do { annotate_unreachable(); __builtin_unreachable(); } while (0) |
1823 | + do { \ |
1824 | + annotate_unreachable(); \ |
1825 | + barrier_before_unreachable(); \ |
1826 | + __builtin_unreachable(); \ |
1827 | + } while (0) |
1828 | |
1829 | /* Mark a function definition as prohibited from being cloned. */ |
1830 | #define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) |
1831 | diff --git a/include/linux/compiler.h b/include/linux/compiler.h |
1832 | index 4f3dfabb680f..80a5bc623c47 100644 |
1833 | --- a/include/linux/compiler.h |
1834 | +++ b/include/linux/compiler.h |
1835 | @@ -177,6 +177,11 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); |
1836 | # define barrier_data(ptr) barrier() |
1837 | #endif |
1838 | |
1839 | +/* workaround for GCC PR82365 if needed */ |
1840 | +#ifndef barrier_before_unreachable |
1841 | +# define barrier_before_unreachable() do { } while (0) |
1842 | +#endif |
1843 | + |
1844 | /* Unreachable code */ |
1845 | #ifndef unreachable |
1846 | # define unreachable() do { } while (1) |
1847 | diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h |
1848 | index 4931787193c3..57a7dba49d29 100644 |
1849 | --- a/include/net/bluetooth/hci_core.h |
1850 | +++ b/include/net/bluetooth/hci_core.h |
1851 | @@ -176,6 +176,9 @@ struct adv_info { |
1852 | |
1853 | #define HCI_MAX_SHORT_NAME_LENGTH 10 |
1854 | |
1855 | +/* Min encryption key size to match with SMP */ |
1856 | +#define HCI_MIN_ENC_KEY_SIZE 7 |
1857 | + |
1858 | /* Default LE RPA expiry time, 15 minutes */ |
1859 | #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60) |
1860 | |
1861 | diff --git a/kernel/cpu.c b/kernel/cpu.c |
1862 | index be8cc6c9c87d..c947bb35b89f 100644 |
1863 | --- a/kernel/cpu.c |
1864 | +++ b/kernel/cpu.c |
1865 | @@ -2245,6 +2245,9 @@ static int __init mitigations_parse_cmdline(char *arg) |
1866 | cpu_mitigations = CPU_MITIGATIONS_AUTO; |
1867 | else if (!strcmp(arg, "auto,nosmt")) |
1868 | cpu_mitigations = CPU_MITIGATIONS_AUTO_NOSMT; |
1869 | + else |
1870 | + pr_crit("Unsupported mitigations=%s, system may still be vulnerable\n", |
1871 | + arg); |
1872 | |
1873 | return 0; |
1874 | } |
1875 | diff --git a/kernel/ptrace.c b/kernel/ptrace.c |
1876 | index f447f1e36185..ea3370e205fb 100644 |
1877 | --- a/kernel/ptrace.c |
1878 | +++ b/kernel/ptrace.c |
1879 | @@ -74,9 +74,7 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent, |
1880 | */ |
1881 | static void ptrace_link(struct task_struct *child, struct task_struct *new_parent) |
1882 | { |
1883 | - rcu_read_lock(); |
1884 | - __ptrace_link(child, new_parent, __task_cred(new_parent)); |
1885 | - rcu_read_unlock(); |
1886 | + __ptrace_link(child, new_parent, current_cred()); |
1887 | } |
1888 | |
1889 | /** |
1890 | diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c |
1891 | index fc59dd11090d..ea8a2760de24 100644 |
1892 | --- a/kernel/trace/trace.c |
1893 | +++ b/kernel/trace/trace.c |
1894 | @@ -7613,12 +7613,8 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) |
1895 | |
1896 | cnt++; |
1897 | |
1898 | - /* reset all but tr, trace, and overruns */ |
1899 | - memset(&iter.seq, 0, |
1900 | - sizeof(struct trace_iterator) - |
1901 | - offsetof(struct trace_iterator, seq)); |
1902 | + trace_iterator_reset(&iter); |
1903 | iter.iter_flags |= TRACE_FILE_LAT_FMT; |
1904 | - iter.pos = -1; |
1905 | |
1906 | if (trace_find_next_entry_inc(&iter) != NULL) { |
1907 | int ret; |
1908 | diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h |
1909 | index b0d8576c27ae..476c6c4204da 100644 |
1910 | --- a/kernel/trace/trace.h |
1911 | +++ b/kernel/trace/trace.h |
1912 | @@ -1673,4 +1673,22 @@ static inline void trace_event_enum_update(struct trace_enum_map **map, int len) |
1913 | |
1914 | extern struct trace_iterator *tracepoint_print_iter; |
1915 | |
1916 | +/* |
1917 | + * Reset the state of the trace_iterator so that it can read consumed data. |
1918 | + * Normally, the trace_iterator is used for reading the data when it is not |
1919 | + * consumed, and must retain state. |
1920 | + */ |
1921 | +static __always_inline void trace_iterator_reset(struct trace_iterator *iter) |
1922 | +{ |
1923 | + const size_t offset = offsetof(struct trace_iterator, seq); |
1924 | + |
1925 | + /* |
1926 | + * Keep gcc from complaining about overwriting more than just one |
1927 | + * member in the structure. |
1928 | + */ |
1929 | + memset((char *)iter + offset, 0, sizeof(struct trace_iterator) - offset); |
1930 | + |
1931 | + iter->pos = -1; |
1932 | +} |
1933 | + |
1934 | #endif /* _LINUX_KERNEL_TRACE_H */ |
1935 | diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c |
1936 | index 896458285fdd..cf6337dc41f4 100644 |
1937 | --- a/kernel/trace/trace_kdb.c |
1938 | +++ b/kernel/trace/trace_kdb.c |
1939 | @@ -40,12 +40,8 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file) |
1940 | |
1941 | kdb_printf("Dumping ftrace buffer:\n"); |
1942 | |
1943 | - /* reset all but tr, trace, and overruns */ |
1944 | - memset(&iter.seq, 0, |
1945 | - sizeof(struct trace_iterator) - |
1946 | - offsetof(struct trace_iterator, seq)); |
1947 | + trace_iterator_reset(&iter); |
1948 | iter.iter_flags |= TRACE_FILE_LAT_FMT; |
1949 | - iter.pos = -1; |
1950 | |
1951 | if (cpu_file == RING_BUFFER_ALL_CPUS) { |
1952 | for_each_tracing_cpu(cpu) { |
1953 | diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c |
1954 | index 468fb7cd1221..edf345b7f06b 100644 |
1955 | --- a/lib/mpi/mpi-pow.c |
1956 | +++ b/lib/mpi/mpi-pow.c |
1957 | @@ -37,6 +37,7 @@ |
1958 | int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) |
1959 | { |
1960 | mpi_ptr_t mp_marker = NULL, bp_marker = NULL, ep_marker = NULL; |
1961 | + struct karatsuba_ctx karactx = {}; |
1962 | mpi_ptr_t xp_marker = NULL; |
1963 | mpi_ptr_t tspace = NULL; |
1964 | mpi_ptr_t rp, ep, mp, bp; |
1965 | @@ -164,13 +165,11 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) |
1966 | int c; |
1967 | mpi_limb_t e; |
1968 | mpi_limb_t carry_limb; |
1969 | - struct karatsuba_ctx karactx; |
1970 | |
1971 | xp = xp_marker = mpi_alloc_limb_space(2 * (msize + 1)); |
1972 | if (!xp) |
1973 | goto enomem; |
1974 | |
1975 | - memset(&karactx, 0, sizeof karactx); |
1976 | negative_result = (ep[0] & 1) && base->sign; |
1977 | |
1978 | i = esize - 1; |
1979 | @@ -295,8 +294,6 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) |
1980 | if (mod_shift_cnt) |
1981 | mpihelp_rshift(rp, rp, rsize, mod_shift_cnt); |
1982 | MPN_NORMALIZE(rp, rsize); |
1983 | - |
1984 | - mpihelp_release_karatsuba_ctx(&karactx); |
1985 | } |
1986 | |
1987 | if (negative_result && rsize) { |
1988 | @@ -313,6 +310,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) |
1989 | leave: |
1990 | rc = 0; |
1991 | enomem: |
1992 | + mpihelp_release_karatsuba_ctx(&karactx); |
1993 | if (assign_rp) |
1994 | mpi_assign_limb_space(res, rp, size); |
1995 | if (mp_marker) |
1996 | diff --git a/mm/mlock.c b/mm/mlock.c |
1997 | index f0505692a5f4..3e7fe404bfb8 100644 |
1998 | --- a/mm/mlock.c |
1999 | +++ b/mm/mlock.c |
2000 | @@ -630,11 +630,11 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, |
2001 | * is also counted. |
2002 | * Return value: previously mlocked page counts |
2003 | */ |
2004 | -static int count_mm_mlocked_page_nr(struct mm_struct *mm, |
2005 | +static unsigned long count_mm_mlocked_page_nr(struct mm_struct *mm, |
2006 | unsigned long start, size_t len) |
2007 | { |
2008 | struct vm_area_struct *vma; |
2009 | - int count = 0; |
2010 | + unsigned long count = 0; |
2011 | |
2012 | if (mm == NULL) |
2013 | mm = current->mm; |
2014 | diff --git a/mm/page_idle.c b/mm/page_idle.c |
2015 | index ae11aa914e55..ded173d6c5b5 100644 |
2016 | --- a/mm/page_idle.c |
2017 | +++ b/mm/page_idle.c |
2018 | @@ -131,7 +131,7 @@ static ssize_t page_idle_bitmap_read(struct file *file, struct kobject *kobj, |
2019 | |
2020 | end_pfn = pfn + count * BITS_PER_BYTE; |
2021 | if (end_pfn > max_pfn) |
2022 | - end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS); |
2023 | + end_pfn = max_pfn; |
2024 | |
2025 | for (; pfn < end_pfn; pfn++) { |
2026 | bit = pfn % BITMAP_CHUNK_BITS; |
2027 | @@ -176,7 +176,7 @@ static ssize_t page_idle_bitmap_write(struct file *file, struct kobject *kobj, |
2028 | |
2029 | end_pfn = pfn + count * BITS_PER_BYTE; |
2030 | if (end_pfn > max_pfn) |
2031 | - end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS); |
2032 | + end_pfn = max_pfn; |
2033 | |
2034 | for (; pfn < end_pfn; pfn++) { |
2035 | bit = pfn % BITMAP_CHUNK_BITS; |
2036 | diff --git a/net/9p/protocol.c b/net/9p/protocol.c |
2037 | index 7f1b45c082c9..ed1e39ccaebf 100644 |
2038 | --- a/net/9p/protocol.c |
2039 | +++ b/net/9p/protocol.c |
2040 | @@ -622,13 +622,19 @@ int p9dirent_read(struct p9_client *clnt, char *buf, int len, |
2041 | if (ret) { |
2042 | p9_debug(P9_DEBUG_9P, "<<< p9dirent_read failed: %d\n", ret); |
2043 | trace_9p_protocol_dump(clnt, &fake_pdu); |
2044 | - goto out; |
2045 | + return ret; |
2046 | } |
2047 | |
2048 | - strcpy(dirent->d_name, nameptr); |
2049 | + ret = strscpy(dirent->d_name, nameptr, sizeof(dirent->d_name)); |
2050 | + if (ret < 0) { |
2051 | + p9_debug(P9_DEBUG_ERROR, |
2052 | + "On the wire dirent name too long: %s\n", |
2053 | + nameptr); |
2054 | + kfree(nameptr); |
2055 | + return ret; |
2056 | + } |
2057 | kfree(nameptr); |
2058 | |
2059 | -out: |
2060 | return fake_pdu.offset; |
2061 | } |
2062 | EXPORT_SYMBOL(p9dirent_read); |
2063 | diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c |
2064 | index 38aa6345bdfa..9c0c894b56f8 100644 |
2065 | --- a/net/9p/trans_common.c |
2066 | +++ b/net/9p/trans_common.c |
2067 | @@ -14,6 +14,7 @@ |
2068 | |
2069 | #include <linux/mm.h> |
2070 | #include <linux/module.h> |
2071 | +#include "trans_common.h" |
2072 | |
2073 | /** |
2074 | * p9_release_req_pages - Release pages after the transaction. |
2075 | diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c |
2076 | index 5a2ad4707463..8e4313ad3f02 100644 |
2077 | --- a/net/9p/trans_rdma.c |
2078 | +++ b/net/9p/trans_rdma.c |
2079 | @@ -254,8 +254,7 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) |
2080 | case RDMA_CM_EVENT_DISCONNECTED: |
2081 | if (rdma) |
2082 | rdma->state = P9_RDMA_CLOSED; |
2083 | - if (c) |
2084 | - c->status = Disconnected; |
2085 | + c->status = Disconnected; |
2086 | break; |
2087 | |
2088 | case RDMA_CM_EVENT_TIMEWAIT_EXIT: |
2089 | @@ -454,7 +453,7 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req) |
2090 | |
2091 | err = post_recv(client, rpl_context); |
2092 | if (err) { |
2093 | - p9_debug(P9_DEBUG_FCALL, "POST RECV failed\n"); |
2094 | + p9_debug(P9_DEBUG_ERROR, "POST RECV failed: %d\n", err); |
2095 | goto recv_error; |
2096 | } |
2097 | /* remove posted receive buffer from request structure */ |
2098 | @@ -523,7 +522,7 @@ dont_need_post_recv: |
2099 | recv_error: |
2100 | kfree(rpl_context); |
2101 | spin_lock_irqsave(&rdma->req_lock, flags); |
2102 | - if (rdma->state < P9_RDMA_CLOSING) { |
2103 | + if (err != -EINTR && rdma->state < P9_RDMA_CLOSING) { |
2104 | rdma->state = P9_RDMA_CLOSING; |
2105 | spin_unlock_irqrestore(&rdma->req_lock, flags); |
2106 | rdma_disconnect(rdma->cm_id); |
2107 | diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c |
2108 | index cc061495f653..bd41b78d131d 100644 |
2109 | --- a/net/bluetooth/hci_conn.c |
2110 | +++ b/net/bluetooth/hci_conn.c |
2111 | @@ -1281,8 +1281,16 @@ auth: |
2112 | return 0; |
2113 | |
2114 | encrypt: |
2115 | - if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) |
2116 | + if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) { |
2117 | + /* Ensure that the encryption key size has been read, |
2118 | + * otherwise stall the upper layer responses. |
2119 | + */ |
2120 | + if (!conn->enc_key_size) |
2121 | + return 0; |
2122 | + |
2123 | + /* Nothing else needed, all requirements are met */ |
2124 | return 1; |
2125 | + } |
2126 | |
2127 | hci_conn_encrypt(conn); |
2128 | return 0; |
2129 | diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c |
2130 | index d49aa4e6c916..ec9b5d159591 100644 |
2131 | --- a/net/bluetooth/l2cap_core.c |
2132 | +++ b/net/bluetooth/l2cap_core.c |
2133 | @@ -1340,6 +1340,21 @@ static void l2cap_request_info(struct l2cap_conn *conn) |
2134 | sizeof(req), &req); |
2135 | } |
2136 | |
2137 | +static bool l2cap_check_enc_key_size(struct hci_conn *hcon) |
2138 | +{ |
2139 | + /* The minimum encryption key size needs to be enforced by the |
2140 | + * host stack before establishing any L2CAP connections. The |
2141 | + * specification in theory allows a minimum of 1, but to align |
2142 | + * BR/EDR and LE transports, a minimum of 7 is chosen. |
2143 | + * |
2144 | + * This check might also be called for unencrypted connections |
2145 | + * that have no key size requirements. Ensure that the link is |
2146 | + * actually encrypted before enforcing a key size. |
2147 | + */ |
2148 | + return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || |
2149 | + hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE); |
2150 | +} |
2151 | + |
2152 | static void l2cap_do_start(struct l2cap_chan *chan) |
2153 | { |
2154 | struct l2cap_conn *conn = chan->conn; |
2155 | @@ -1357,9 +1372,14 @@ static void l2cap_do_start(struct l2cap_chan *chan) |
2156 | if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) |
2157 | return; |
2158 | |
2159 | - if (l2cap_chan_check_security(chan, true) && |
2160 | - __l2cap_no_conn_pending(chan)) |
2161 | + if (!l2cap_chan_check_security(chan, true) || |
2162 | + !__l2cap_no_conn_pending(chan)) |
2163 | + return; |
2164 | + |
2165 | + if (l2cap_check_enc_key_size(conn->hcon)) |
2166 | l2cap_start_connection(chan); |
2167 | + else |
2168 | + __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); |
2169 | } |
2170 | |
2171 | static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) |
2172 | @@ -1438,7 +1458,10 @@ static void l2cap_conn_start(struct l2cap_conn *conn) |
2173 | continue; |
2174 | } |
2175 | |
2176 | - l2cap_start_connection(chan); |
2177 | + if (l2cap_check_enc_key_size(conn->hcon)) |
2178 | + l2cap_start_connection(chan); |
2179 | + else |
2180 | + l2cap_chan_close(chan, ECONNREFUSED); |
2181 | |
2182 | } else if (chan->state == BT_CONNECT2) { |
2183 | struct l2cap_conn_rsp rsp; |
2184 | @@ -7447,7 +7470,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) |
2185 | } |
2186 | |
2187 | if (chan->state == BT_CONNECT) { |
2188 | - if (!status) |
2189 | + if (!status && l2cap_check_enc_key_size(hcon)) |
2190 | l2cap_start_connection(chan); |
2191 | else |
2192 | __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); |
2193 | @@ -7456,7 +7479,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) |
2194 | struct l2cap_conn_rsp rsp; |
2195 | __u16 res, stat; |
2196 | |
2197 | - if (!status) { |
2198 | + if (!status && l2cap_check_enc_key_size(hcon)) { |
2199 | if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { |
2200 | res = L2CAP_CR_PEND; |
2201 | stat = L2CAP_CS_AUTHOR_PEND; |
2202 | diff --git a/net/can/af_can.c b/net/can/af_can.c |
2203 | index ac1552d8b4ad..e5a9e3d76e26 100644 |
2204 | --- a/net/can/af_can.c |
2205 | +++ b/net/can/af_can.c |
2206 | @@ -113,6 +113,7 @@ EXPORT_SYMBOL(can_ioctl); |
2207 | static void can_sock_destruct(struct sock *sk) |
2208 | { |
2209 | skb_queue_purge(&sk->sk_receive_queue); |
2210 | + skb_queue_purge(&sk->sk_error_queue); |
2211 | } |
2212 | |
2213 | static const struct can_proto *can_get_proto(int protocol) |
2214 | diff --git a/net/core/dev.c b/net/core/dev.c |
2215 | index 4e10bae5e3da..f693afe608d7 100644 |
2216 | --- a/net/core/dev.c |
2217 | +++ b/net/core/dev.c |
2218 | @@ -5083,7 +5083,10 @@ bool sk_busy_loop(struct sock *sk, int nonblock) |
2219 | goto out; |
2220 | |
2221 | /* Note: ndo_busy_poll method is optional in linux-4.5 */ |
2222 | - busy_poll = napi->dev->netdev_ops->ndo_busy_poll; |
2223 | + if (napi->dev->netdev_ops) |
2224 | + busy_poll = napi->dev->netdev_ops->ndo_busy_poll; |
2225 | + else |
2226 | + busy_poll = NULL; |
2227 | |
2228 | do { |
2229 | rc = 0; |
2230 | diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c |
2231 | index 1d0e2284d8ad..ed53bf5d2b68 100644 |
2232 | --- a/net/ipv4/raw.c |
2233 | +++ b/net/ipv4/raw.c |
2234 | @@ -197,7 +197,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash) |
2235 | } |
2236 | sk = __raw_v4_lookup(net, sk_next(sk), iph->protocol, |
2237 | iph->saddr, iph->daddr, |
2238 | - skb->dev->ifindex); |
2239 | + dif); |
2240 | } |
2241 | out: |
2242 | read_unlock(&raw_v4_hashinfo.lock); |
2243 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
2244 | index 5d4b5e0f6b5e..1bb1e27d3d13 100644 |
2245 | --- a/net/ipv4/udp.c |
2246 | +++ b/net/ipv4/udp.c |
2247 | @@ -569,7 +569,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb, |
2248 | struct sock *udp4_lib_lookup_skb(struct sk_buff *skb, |
2249 | __be16 sport, __be16 dport) |
2250 | { |
2251 | - return __udp4_lib_lookup_skb(skb, sport, dport, &udp_table); |
2252 | + const struct iphdr *iph = ip_hdr(skb); |
2253 | + |
2254 | + return __udp4_lib_lookup(dev_net(skb->dev), iph->saddr, sport, |
2255 | + iph->daddr, dport, inet_iif(skb), |
2256 | + &udp_table, NULL); |
2257 | } |
2258 | EXPORT_SYMBOL_GPL(udp4_lib_lookup_skb); |
2259 | |
2260 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c |
2261 | index 4db5f541bca6..6a397e110b46 100644 |
2262 | --- a/net/ipv6/udp.c |
2263 | +++ b/net/ipv6/udp.c |
2264 | @@ -294,7 +294,7 @@ struct sock *udp6_lib_lookup_skb(struct sk_buff *skb, |
2265 | |
2266 | return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport, |
2267 | &iph->daddr, dport, inet6_iif(skb), |
2268 | - &udp_table, skb); |
2269 | + &udp_table, NULL); |
2270 | } |
2271 | EXPORT_SYMBOL_GPL(udp6_lib_lookup_skb); |
2272 | |
2273 | @@ -479,7 +479,7 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt, |
2274 | struct net *net = dev_net(skb->dev); |
2275 | |
2276 | sk = __udp6_lib_lookup(net, daddr, uh->dest, saddr, uh->source, |
2277 | - inet6_iif(skb), udptable, skb); |
2278 | + inet6_iif(skb), udptable, NULL); |
2279 | if (!sk) { |
2280 | __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), |
2281 | ICMP6_MIB_INERRORS); |
2282 | diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c |
2283 | index 23f6c8baae95..3b423c50ec8f 100644 |
2284 | --- a/net/mac80211/rx.c |
2285 | +++ b/net/mac80211/rx.c |
2286 | @@ -3568,6 +3568,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) |
2287 | case NL80211_IFTYPE_STATION: |
2288 | if (!bssid && !sdata->u.mgd.use_4addr) |
2289 | return false; |
2290 | + if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta) |
2291 | + return false; |
2292 | if (multicast) |
2293 | return true; |
2294 | return ether_addr_equal(sdata->vif.addr, hdr->addr1); |
2295 | diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c |
2296 | index caa5986cb2e4..c0529c4b60f8 100644 |
2297 | --- a/net/mac80211/wpa.c |
2298 | +++ b/net/mac80211/wpa.c |
2299 | @@ -1169,7 +1169,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx) |
2300 | struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); |
2301 | struct ieee80211_key *key = rx->key; |
2302 | struct ieee80211_mmie_16 *mmie; |
2303 | - u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LEN], ipn[6], nonce[GMAC_NONCE_LEN]; |
2304 | + u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN]; |
2305 | struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; |
2306 | |
2307 | if (!ieee80211_is_mgmt(hdr->frame_control)) |
2308 | @@ -1200,13 +1200,18 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx) |
2309 | memcpy(nonce, hdr->addr2, ETH_ALEN); |
2310 | memcpy(nonce + ETH_ALEN, ipn, 6); |
2311 | |
2312 | + mic = kmalloc(GMAC_MIC_LEN, GFP_ATOMIC); |
2313 | + if (!mic) |
2314 | + return RX_DROP_UNUSABLE; |
2315 | if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce, |
2316 | skb->data + 24, skb->len - 24, |
2317 | mic) < 0 || |
2318 | crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { |
2319 | key->u.aes_gmac.icverrors++; |
2320 | + kfree(mic); |
2321 | return RX_DROP_UNUSABLE; |
2322 | } |
2323 | + kfree(mic); |
2324 | } |
2325 | |
2326 | memcpy(key->u.aes_gmac.rx_pn, ipn, 6); |
2327 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
2328 | index dcf033fea2d2..3578121da79c 100644 |
2329 | --- a/net/packet/af_packet.c |
2330 | +++ b/net/packet/af_packet.c |
2331 | @@ -2399,6 +2399,9 @@ static void tpacket_destruct_skb(struct sk_buff *skb) |
2332 | |
2333 | ts = __packet_set_timestamp(po, ph, skb); |
2334 | __packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts); |
2335 | + |
2336 | + if (!packet_read_pending(&po->tx_ring)) |
2337 | + complete(&po->skb_completion); |
2338 | } |
2339 | |
2340 | sock_wfree(skb); |
2341 | @@ -2629,7 +2632,7 @@ static int tpacket_parse_header(struct packet_sock *po, void *frame, |
2342 | |
2343 | static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) |
2344 | { |
2345 | - struct sk_buff *skb; |
2346 | + struct sk_buff *skb = NULL; |
2347 | struct net_device *dev; |
2348 | struct virtio_net_hdr *vnet_hdr = NULL; |
2349 | struct sockcm_cookie sockc; |
2350 | @@ -2644,6 +2647,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) |
2351 | int len_sum = 0; |
2352 | int status = TP_STATUS_AVAILABLE; |
2353 | int hlen, tlen, copylen = 0; |
2354 | + long timeo = 0; |
2355 | |
2356 | mutex_lock(&po->pg_vec_lock); |
2357 | |
2358 | @@ -2690,12 +2694,21 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) |
2359 | if ((size_max > dev->mtu + reserve + VLAN_HLEN) && !po->has_vnet_hdr) |
2360 | size_max = dev->mtu + reserve + VLAN_HLEN; |
2361 | |
2362 | + reinit_completion(&po->skb_completion); |
2363 | + |
2364 | do { |
2365 | ph = packet_current_frame(po, &po->tx_ring, |
2366 | TP_STATUS_SEND_REQUEST); |
2367 | if (unlikely(ph == NULL)) { |
2368 | - if (need_wait && need_resched()) |
2369 | - schedule(); |
2370 | + if (need_wait && skb) { |
2371 | + timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT); |
2372 | + timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo); |
2373 | + if (timeo <= 0) { |
2374 | + err = !timeo ? -ETIMEDOUT : -ERESTARTSYS; |
2375 | + goto out_put; |
2376 | + } |
2377 | + } |
2378 | + /* check for additional frames */ |
2379 | continue; |
2380 | } |
2381 | |
2382 | @@ -3249,6 +3262,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, |
2383 | sock_init_data(sock, sk); |
2384 | |
2385 | po = pkt_sk(sk); |
2386 | + init_completion(&po->skb_completion); |
2387 | sk->sk_family = PF_PACKET; |
2388 | po->num = proto; |
2389 | po->xmit = dev_queue_xmit; |
2390 | diff --git a/net/packet/internal.h b/net/packet/internal.h |
2391 | index 1309e2a7baad..bbf8dd35df0d 100644 |
2392 | --- a/net/packet/internal.h |
2393 | +++ b/net/packet/internal.h |
2394 | @@ -125,6 +125,7 @@ struct packet_sock { |
2395 | unsigned int tp_hdrlen; |
2396 | unsigned int tp_reserve; |
2397 | unsigned int tp_tstamp; |
2398 | + struct completion skb_completion; |
2399 | struct net_device __rcu *cached_dev; |
2400 | int (*xmit)(struct sk_buff *skb); |
2401 | struct packet_type prot_hook ____cacheline_aligned_in_smp; |
2402 | diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c |
2403 | index 1f03065686fe..beae42bfa68f 100644 |
2404 | --- a/net/sctp/endpointola.c |
2405 | +++ b/net/sctp/endpointola.c |
2406 | @@ -125,10 +125,6 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, |
2407 | /* Initialize the bind addr area */ |
2408 | sctp_bind_addr_init(&ep->base.bind_addr, 0); |
2409 | |
2410 | - /* Remember who we are attached to. */ |
2411 | - ep->base.sk = sk; |
2412 | - sock_hold(ep->base.sk); |
2413 | - |
2414 | /* Create the lists of associations. */ |
2415 | INIT_LIST_HEAD(&ep->asocs); |
2416 | |
2417 | @@ -165,6 +161,10 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, |
2418 | ep->auth_chunk_list = auth_chunks; |
2419 | ep->prsctp_enable = net->sctp.prsctp_enable; |
2420 | |
2421 | + /* Remember who we are attached to. */ |
2422 | + ep->base.sk = sk; |
2423 | + sock_hold(ep->base.sk); |
2424 | + |
2425 | return ep; |
2426 | |
2427 | nomem_hmacs: |
2428 | diff --git a/net/tipc/core.c b/net/tipc/core.c |
2429 | index 816c125bfc13..59980dea2ad7 100644 |
2430 | --- a/net/tipc/core.c |
2431 | +++ b/net/tipc/core.c |
2432 | @@ -128,7 +128,7 @@ static int __init tipc_init(void) |
2433 | if (err) |
2434 | goto out_sysctl; |
2435 | |
2436 | - err = register_pernet_subsys(&tipc_net_ops); |
2437 | + err = register_pernet_device(&tipc_net_ops); |
2438 | if (err) |
2439 | goto out_pernet; |
2440 | |
2441 | @@ -136,7 +136,7 @@ static int __init tipc_init(void) |
2442 | if (err) |
2443 | goto out_socket; |
2444 | |
2445 | - err = register_pernet_subsys(&tipc_topsrv_net_ops); |
2446 | + err = register_pernet_device(&tipc_topsrv_net_ops); |
2447 | if (err) |
2448 | goto out_pernet_topsrv; |
2449 | |
2450 | @@ -147,11 +147,11 @@ static int __init tipc_init(void) |
2451 | pr_info("Started in single node mode\n"); |
2452 | return 0; |
2453 | out_bearer: |
2454 | - unregister_pernet_subsys(&tipc_topsrv_net_ops); |
2455 | + unregister_pernet_device(&tipc_topsrv_net_ops); |
2456 | out_pernet_topsrv: |
2457 | tipc_socket_stop(); |
2458 | out_socket: |
2459 | - unregister_pernet_subsys(&tipc_net_ops); |
2460 | + unregister_pernet_device(&tipc_net_ops); |
2461 | out_pernet: |
2462 | tipc_unregister_sysctl(); |
2463 | out_sysctl: |
2464 | @@ -166,9 +166,9 @@ out_netlink: |
2465 | static void __exit tipc_exit(void) |
2466 | { |
2467 | tipc_bearer_cleanup(); |
2468 | - unregister_pernet_subsys(&tipc_topsrv_net_ops); |
2469 | + unregister_pernet_device(&tipc_topsrv_net_ops); |
2470 | tipc_socket_stop(); |
2471 | - unregister_pernet_subsys(&tipc_net_ops); |
2472 | + unregister_pernet_device(&tipc_net_ops); |
2473 | tipc_netlink_stop(); |
2474 | tipc_netlink_compat_stop(); |
2475 | tipc_unregister_sysctl(); |
2476 | diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c |
2477 | index 0cf9403b4c44..b7c539a51da3 100644 |
2478 | --- a/net/tipc/netlink_compat.c |
2479 | +++ b/net/tipc/netlink_compat.c |
2480 | @@ -436,7 +436,11 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd, |
2481 | if (!bearer) |
2482 | return -EMSGSIZE; |
2483 | |
2484 | - len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME); |
2485 | + len = TLV_GET_DATA_LEN(msg->req); |
2486 | + if (len <= 0) |
2487 | + return -EINVAL; |
2488 | + |
2489 | + len = min_t(int, len, TIPC_MAX_BEARER_NAME); |
2490 | if (!string_is_valid(name, len)) |
2491 | return -EINVAL; |
2492 | |
2493 | @@ -528,7 +532,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, |
2494 | |
2495 | name = (char *)TLV_DATA(msg->req); |
2496 | |
2497 | - len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); |
2498 | + len = TLV_GET_DATA_LEN(msg->req); |
2499 | + if (len <= 0) |
2500 | + return -EINVAL; |
2501 | + |
2502 | + len = min_t(int, len, TIPC_MAX_BEARER_NAME); |
2503 | if (!string_is_valid(name, len)) |
2504 | return -EINVAL; |
2505 | |
2506 | @@ -806,7 +814,11 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, |
2507 | if (!link) |
2508 | return -EMSGSIZE; |
2509 | |
2510 | - len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); |
2511 | + len = TLV_GET_DATA_LEN(msg->req); |
2512 | + if (len <= 0) |
2513 | + return -EINVAL; |
2514 | + |
2515 | + len = min_t(int, len, TIPC_MAX_BEARER_NAME); |
2516 | if (!string_is_valid(name, len)) |
2517 | return -EINVAL; |
2518 | |
2519 | diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c |
2520 | index 133e72654e77..05033ab05b8f 100644 |
2521 | --- a/net/tipc/udp_media.c |
2522 | +++ b/net/tipc/udp_media.c |
2523 | @@ -174,7 +174,6 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb, |
2524 | goto tx_error; |
2525 | } |
2526 | |
2527 | - skb->dev = rt->dst.dev; |
2528 | ttl = ip4_dst_hoplimit(&rt->dst); |
2529 | udp_tunnel_xmit_skb(rt, ub->ubsock->sk, skb, src->ipv4.s_addr, |
2530 | dst->ipv4.s_addr, 0, ttl, 0, src->port, |
2531 | @@ -193,10 +192,9 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb, |
2532 | if (err) |
2533 | goto tx_error; |
2534 | ttl = ip6_dst_hoplimit(ndst); |
2535 | - err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, |
2536 | - ndst->dev, &src->ipv6, |
2537 | - &dst->ipv6, 0, ttl, 0, src->port, |
2538 | - dst->port, false); |
2539 | + err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, NULL, |
2540 | + &src->ipv6, &dst->ipv6, 0, ttl, 0, |
2541 | + src->port, dst->port, false); |
2542 | #endif |
2543 | } |
2544 | return err; |
2545 | diff --git a/net/wireless/core.c b/net/wireless/core.c |
2546 | index 7fbf4dd07277..74554bdd9a5b 100644 |
2547 | --- a/net/wireless/core.c |
2548 | +++ b/net/wireless/core.c |
2549 | @@ -478,7 +478,7 @@ use_default_name: |
2550 | &rdev->rfkill_ops, rdev); |
2551 | |
2552 | if (!rdev->rfkill) { |
2553 | - kfree(rdev); |
2554 | + wiphy_free(&rdev->wiphy); |
2555 | return NULL; |
2556 | } |
2557 | |
2558 | diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl |
2559 | index 12a6940741fe..b8f616545277 100755 |
2560 | --- a/scripts/checkstack.pl |
2561 | +++ b/scripts/checkstack.pl |
2562 | @@ -45,7 +45,7 @@ my (@stack, $re, $dre, $x, $xs, $funcre); |
2563 | $x = "[0-9a-f]"; # hex character |
2564 | $xs = "[0-9a-f ]"; # hex character or space |
2565 | $funcre = qr/^$x* <(.*)>:$/; |
2566 | - if ($arch eq 'aarch64') { |
2567 | + if ($arch =~ '^(aarch|arm)64$') { |
2568 | #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]! |
2569 | $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o; |
2570 | } elsif ($arch eq 'arm') { |
2571 | diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh |
2572 | index edde8250195c..381acfc4c59d 100755 |
2573 | --- a/scripts/decode_stacktrace.sh |
2574 | +++ b/scripts/decode_stacktrace.sh |
2575 | @@ -65,7 +65,7 @@ parse_symbol() { |
2576 | if [[ "${cache[$module,$address]+isset}" == "isset" ]]; then |
2577 | local code=${cache[$module,$address]} |
2578 | else |
2579 | - local code=$(addr2line -i -e "$objfile" "$address") |
2580 | + local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address") |
2581 | cache[$module,$address]=$code |
2582 | fi |
2583 | |
2584 | diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c |
2585 | index 138120698f83..96a8d7115120 100644 |
2586 | --- a/security/apparmor/policy_unpack.c |
2587 | +++ b/security/apparmor/policy_unpack.c |
2588 | @@ -177,7 +177,7 @@ static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name) |
2589 | char *tag = NULL; |
2590 | size_t size = unpack_u16_chunk(e, &tag); |
2591 | /* if a name is specified it must match. otherwise skip tag */ |
2592 | - if (name && (!size || strcmp(name, tag))) |
2593 | + if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag))) |
2594 | goto fail; |
2595 | } else if (name) { |
2596 | /* if a name is specified and there is no name tag fail */ |
2597 | diff --git a/sound/core/seq/oss/seq_oss_ioctl.c b/sound/core/seq/oss/seq_oss_ioctl.c |
2598 | index 5b8520177b0e..7d72e3d48ad5 100644 |
2599 | --- a/sound/core/seq/oss/seq_oss_ioctl.c |
2600 | +++ b/sound/core/seq/oss/seq_oss_ioctl.c |
2601 | @@ -62,7 +62,7 @@ static int snd_seq_oss_oob_user(struct seq_oss_devinfo *dp, void __user *arg) |
2602 | if (copy_from_user(ev, arg, 8)) |
2603 | return -EFAULT; |
2604 | memset(&tmpev, 0, sizeof(tmpev)); |
2605 | - snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.port, dp->addr.client); |
2606 | + snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.client, dp->addr.port); |
2607 | tmpev.time.tick = 0; |
2608 | if (! snd_seq_oss_process_event(dp, (union evrec *)ev, &tmpev)) { |
2609 | snd_seq_oss_dispatch(dp, &tmpev, 0, 0); |
2610 | diff --git a/sound/core/seq/oss/seq_oss_rw.c b/sound/core/seq/oss/seq_oss_rw.c |
2611 | index 6a7b6aceeca9..499f3e8f4949 100644 |
2612 | --- a/sound/core/seq/oss/seq_oss_rw.c |
2613 | +++ b/sound/core/seq/oss/seq_oss_rw.c |
2614 | @@ -174,7 +174,7 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt) |
2615 | memset(&event, 0, sizeof(event)); |
2616 | /* set dummy -- to be sure */ |
2617 | event.type = SNDRV_SEQ_EVENT_NOTEOFF; |
2618 | - snd_seq_oss_fill_addr(dp, &event, dp->addr.port, dp->addr.client); |
2619 | + snd_seq_oss_fill_addr(dp, &event, dp->addr.client, dp->addr.port); |
2620 | |
2621 | if (snd_seq_oss_process_event(dp, rec, &event)) |
2622 | return 0; /* invalid event - no need to insert queue */ |
2623 | diff --git a/sound/firewire/amdtp-am824.c b/sound/firewire/amdtp-am824.c |
2624 | index bebddc60fde8..99654e7eb2d4 100644 |
2625 | --- a/sound/firewire/amdtp-am824.c |
2626 | +++ b/sound/firewire/amdtp-am824.c |
2627 | @@ -388,7 +388,7 @@ static void read_midi_messages(struct amdtp_stream *s, |
2628 | u8 *b; |
2629 | |
2630 | for (f = 0; f < frames; f++) { |
2631 | - port = (s->data_block_counter + f) % 8; |
2632 | + port = (8 - s->tx_first_dbc + s->data_block_counter + f) % 8; |
2633 | b = (u8 *)&buffer[p->midi_position]; |
2634 | |
2635 | len = b[0] - 0x80; |
2636 | diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c |
2637 | index 6e8eb1f5a041..bed64723e5d9 100644 |
2638 | --- a/sound/soc/codecs/cs4265.c |
2639 | +++ b/sound/soc/codecs/cs4265.c |
2640 | @@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = { |
2641 | static bool cs4265_readable_register(struct device *dev, unsigned int reg) |
2642 | { |
2643 | switch (reg) { |
2644 | - case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2: |
2645 | + case CS4265_CHIP_ID ... CS4265_MAX_REGISTER: |
2646 | return true; |
2647 | default: |
2648 | return false; |
2649 | diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c |
2650 | index 3e65dc74eb33..e7aef841f87d 100644 |
2651 | --- a/sound/soc/codecs/max98090.c |
2652 | +++ b/sound/soc/codecs/max98090.c |
2653 | @@ -1924,6 +1924,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090, |
2654 | return 0; |
2655 | } |
2656 | |
2657 | +static int max98090_dai_startup(struct snd_pcm_substream *substream, |
2658 | + struct snd_soc_dai *dai) |
2659 | +{ |
2660 | + struct snd_soc_component *component = dai->component; |
2661 | + struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component); |
2662 | + unsigned int fmt = max98090->dai_fmt; |
2663 | + |
2664 | + /* Remove 24-bit format support if it is not in right justified mode. */ |
2665 | + if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) { |
2666 | + substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; |
2667 | + snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16); |
2668 | + } |
2669 | + return 0; |
2670 | +} |
2671 | + |
2672 | static int max98090_dai_hw_params(struct snd_pcm_substream *substream, |
2673 | struct snd_pcm_hw_params *params, |
2674 | struct snd_soc_dai *dai) |
2675 | @@ -2331,6 +2346,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect); |
2676 | #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE) |
2677 | |
2678 | static const struct snd_soc_dai_ops max98090_dai_ops = { |
2679 | + .startup = max98090_dai_startup, |
2680 | .set_sysclk = max98090_dai_set_sysclk, |
2681 | .set_fmt = max98090_dai_set_fmt, |
2682 | .set_tdm_slot = max98090_set_tdm_slot, |
2683 | diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c |
2684 | index 1dbcdc99dbe3..1d00f6e894ef 100644 |
2685 | --- a/sound/soc/soc-pcm.c |
2686 | +++ b/sound/soc/soc-pcm.c |
2687 | @@ -2247,7 +2247,8 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) |
2688 | |
2689 | if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) && |
2690 | (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) && |
2691 | - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) |
2692 | + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) && |
2693 | + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED)) |
2694 | continue; |
2695 | |
2696 | dev_dbg(be->dev, "ASoC: prepare BE %s\n", |
2697 | diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c |
2698 | index fab53f58d447..a9f99a6c3909 100644 |
2699 | --- a/sound/usb/line6/pcm.c |
2700 | +++ b/sound/usb/line6/pcm.c |
2701 | @@ -558,6 +558,11 @@ int line6_init_pcm(struct usb_line6 *line6, |
2702 | line6pcm->max_packet_size_out = |
2703 | usb_maxpacket(line6->usbdev, |
2704 | usb_sndisocpipe(line6->usbdev, ep_write), 1); |
2705 | + if (!line6pcm->max_packet_size_in || !line6pcm->max_packet_size_out) { |
2706 | + dev_err(line6pcm->line6->ifcdev, |
2707 | + "cannot get proper max packet size\n"); |
2708 | + return -EINVAL; |
2709 | + } |
2710 | |
2711 | spin_lock_init(&line6pcm->out.lock); |
2712 | spin_lock_init(&line6pcm->in.lock); |
2713 | diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c |
2714 | index 5d2fc5f58bfe..f4fd9548c529 100644 |
2715 | --- a/sound/usb/mixer_quirks.c |
2716 | +++ b/sound/usb/mixer_quirks.c |
2717 | @@ -753,7 +753,7 @@ static int snd_ni_control_init_val(struct usb_mixer_interface *mixer, |
2718 | return err; |
2719 | } |
2720 | |
2721 | - kctl->private_value |= (value << 24); |
2722 | + kctl->private_value |= ((unsigned int)value << 24); |
2723 | return 0; |
2724 | } |
2725 | |
2726 | @@ -914,7 +914,7 @@ static int snd_ftu_eff_switch_init(struct usb_mixer_interface *mixer, |
2727 | if (err < 0) |
2728 | return err; |
2729 | |
2730 | - kctl->private_value |= value[0] << 24; |
2731 | + kctl->private_value |= (unsigned int)value[0] << 24; |
2732 | return 0; |
2733 | } |
2734 | |
2735 | diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c |
2736 | index 3bdb2c78a21b..476e24cf97fa 100644 |
2737 | --- a/tools/perf/builtin-help.c |
2738 | +++ b/tools/perf/builtin-help.c |
2739 | @@ -186,7 +186,7 @@ static void add_man_viewer(const char *name) |
2740 | while (*p) |
2741 | p = &((*p)->next); |
2742 | *p = zalloc(sizeof(**p) + len + 1); |
2743 | - strncpy((*p)->name, name, len); |
2744 | + strcpy((*p)->name, name); |
2745 | } |
2746 | |
2747 | static int supported_man_viewer(const char *name, size_t len) |
2748 | diff --git a/tools/perf/ui/tui/helpline.c b/tools/perf/ui/tui/helpline.c |
2749 | index 88f5143a5981..3c97e27383a9 100644 |
2750 | --- a/tools/perf/ui/tui/helpline.c |
2751 | +++ b/tools/perf/ui/tui/helpline.c |
2752 | @@ -23,7 +23,7 @@ static void tui_helpline__push(const char *msg) |
2753 | SLsmg_set_color(0); |
2754 | SLsmg_write_nstring((char *)msg, SLtt_Screen_Cols); |
2755 | SLsmg_refresh(); |
2756 | - strncpy(ui_helpline__current, msg, sz)[sz - 1] = '\0'; |
2757 | + strlcpy(ui_helpline__current, msg, sz); |
2758 | } |
2759 | |
2760 | static int tui_helpline__show(const char *format, va_list ap) |
2761 | diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c |
2762 | index a11f6760cce8..de9b369d2d2e 100644 |
2763 | --- a/tools/perf/util/header.c |
2764 | +++ b/tools/perf/util/header.c |
2765 | @@ -3027,7 +3027,7 @@ perf_event__synthesize_event_update_name(struct perf_tool *tool, |
2766 | if (ev == NULL) |
2767 | return -ENOMEM; |
2768 | |
2769 | - strncpy(ev->data, evsel->name, len); |
2770 | + strlcpy(ev->data, evsel->name, len + 1); |
2771 | err = process(tool, (union perf_event*) ev, NULL, NULL); |
2772 | free(ev); |
2773 | return err; |