Annotation of /trunk/kernel-alx/patches-4.9/0326-4.9.227-all-fixes.patch
Parent Directory | Revision Log
Revision 3601 -
(hide annotations)
(download)
Thu Aug 13 10:21:41 2020 UTC (4 years, 1 month ago) by niro
File size: 58848 byte(s)
Thu Aug 13 10:21:41 2020 UTC (4 years, 1 month ago) by niro
File size: 58848 byte(s)
linux-227
1 | niro | 3601 | diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu |
2 | index b41046b5713b..a5225df4a070 100644 | ||
3 | --- a/Documentation/ABI/testing/sysfs-devices-system-cpu | ||
4 | +++ b/Documentation/ABI/testing/sysfs-devices-system-cpu | ||
5 | @@ -358,6 +358,7 @@ What: /sys/devices/system/cpu/vulnerabilities | ||
6 | /sys/devices/system/cpu/vulnerabilities/spec_store_bypass | ||
7 | /sys/devices/system/cpu/vulnerabilities/l1tf | ||
8 | /sys/devices/system/cpu/vulnerabilities/mds | ||
9 | + /sys/devices/system/cpu/vulnerabilities/srbds | ||
10 | /sys/devices/system/cpu/vulnerabilities/tsx_async_abort | ||
11 | /sys/devices/system/cpu/vulnerabilities/itlb_multihit | ||
12 | Date: January 2018 | ||
13 | diff --git a/Documentation/hw-vuln/index.rst b/Documentation/hw-vuln/index.rst | ||
14 | index 24f53c501366..b5fbc6ae9d5f 100644 | ||
15 | --- a/Documentation/hw-vuln/index.rst | ||
16 | +++ b/Documentation/hw-vuln/index.rst | ||
17 | @@ -12,4 +12,5 @@ are configurable at compile, boot or run time. | ||
18 | l1tf | ||
19 | mds | ||
20 | tsx_async_abort | ||
21 | - multihit.rst | ||
22 | + multihit | ||
23 | + special-register-buffer-data-sampling | ||
24 | diff --git a/Documentation/hw-vuln/special-register-buffer-data-sampling.rst b/Documentation/hw-vuln/special-register-buffer-data-sampling.rst | ||
25 | new file mode 100644 | ||
26 | index 000000000000..47b1b3afac99 | ||
27 | --- /dev/null | ||
28 | +++ b/Documentation/hw-vuln/special-register-buffer-data-sampling.rst | ||
29 | @@ -0,0 +1,149 @@ | ||
30 | +.. SPDX-License-Identifier: GPL-2.0 | ||
31 | + | ||
32 | +SRBDS - Special Register Buffer Data Sampling | ||
33 | +============================================= | ||
34 | + | ||
35 | +SRBDS is a hardware vulnerability that allows MDS :doc:`mds` techniques to | ||
36 | +infer values returned from special register accesses. Special register | ||
37 | +accesses are accesses to off core registers. According to Intel's evaluation, | ||
38 | +the special register reads that have a security expectation of privacy are | ||
39 | +RDRAND, RDSEED and SGX EGETKEY. | ||
40 | + | ||
41 | +When RDRAND, RDSEED and EGETKEY instructions are used, the data is moved | ||
42 | +to the core through the special register mechanism that is susceptible | ||
43 | +to MDS attacks. | ||
44 | + | ||
45 | +Affected processors | ||
46 | +-------------------- | ||
47 | +Core models (desktop, mobile, Xeon-E3) that implement RDRAND and/or RDSEED may | ||
48 | +be affected. | ||
49 | + | ||
50 | +A processor is affected by SRBDS if its Family_Model and stepping is | ||
51 | +in the following list, with the exception of the listed processors | ||
52 | +exporting MDS_NO while Intel TSX is available yet not enabled. The | ||
53 | +latter class of processors are only affected when Intel TSX is enabled | ||
54 | +by software using TSX_CTRL_MSR otherwise they are not affected. | ||
55 | + | ||
56 | + ============= ============ ======== | ||
57 | + common name Family_Model Stepping | ||
58 | + ============= ============ ======== | ||
59 | + IvyBridge 06_3AH All | ||
60 | + | ||
61 | + Haswell 06_3CH All | ||
62 | + Haswell_L 06_45H All | ||
63 | + Haswell_G 06_46H All | ||
64 | + | ||
65 | + Broadwell_G 06_47H All | ||
66 | + Broadwell 06_3DH All | ||
67 | + | ||
68 | + Skylake_L 06_4EH All | ||
69 | + Skylake 06_5EH All | ||
70 | + | ||
71 | + Kabylake_L 06_8EH <= 0xC | ||
72 | + Kabylake 06_9EH <= 0xD | ||
73 | + ============= ============ ======== | ||
74 | + | ||
75 | +Related CVEs | ||
76 | +------------ | ||
77 | + | ||
78 | +The following CVE entry is related to this SRBDS issue: | ||
79 | + | ||
80 | + ============== ===== ===================================== | ||
81 | + CVE-2020-0543 SRBDS Special Register Buffer Data Sampling | ||
82 | + ============== ===== ===================================== | ||
83 | + | ||
84 | +Attack scenarios | ||
85 | +---------------- | ||
86 | +An unprivileged user can extract values returned from RDRAND and RDSEED | ||
87 | +executed on another core or sibling thread using MDS techniques. | ||
88 | + | ||
89 | + | ||
90 | +Mitigation mechanism | ||
91 | +------------------- | ||
92 | +Intel will release microcode updates that modify the RDRAND, RDSEED, and | ||
93 | +EGETKEY instructions to overwrite secret special register data in the shared | ||
94 | +staging buffer before the secret data can be accessed by another logical | ||
95 | +processor. | ||
96 | + | ||
97 | +During execution of the RDRAND, RDSEED, or EGETKEY instructions, off-core | ||
98 | +accesses from other logical processors will be delayed until the special | ||
99 | +register read is complete and the secret data in the shared staging buffer is | ||
100 | +overwritten. | ||
101 | + | ||
102 | +This has three effects on performance: | ||
103 | + | ||
104 | +#. RDRAND, RDSEED, or EGETKEY instructions have higher latency. | ||
105 | + | ||
106 | +#. Executing RDRAND at the same time on multiple logical processors will be | ||
107 | + serialized, resulting in an overall reduction in the maximum RDRAND | ||
108 | + bandwidth. | ||
109 | + | ||
110 | +#. Executing RDRAND, RDSEED or EGETKEY will delay memory accesses from other | ||
111 | + logical processors that miss their core caches, with an impact similar to | ||
112 | + legacy locked cache-line-split accesses. | ||
113 | + | ||
114 | +The microcode updates provide an opt-out mechanism (RNGDS_MITG_DIS) to disable | ||
115 | +the mitigation for RDRAND and RDSEED instructions executed outside of Intel | ||
116 | +Software Guard Extensions (Intel SGX) enclaves. On logical processors that | ||
117 | +disable the mitigation using this opt-out mechanism, RDRAND and RDSEED do not | ||
118 | +take longer to execute and do not impact performance of sibling logical | ||
119 | +processors memory accesses. The opt-out mechanism does not affect Intel SGX | ||
120 | +enclaves (including execution of RDRAND or RDSEED inside an enclave, as well | ||
121 | +as EGETKEY execution). | ||
122 | + | ||
123 | +IA32_MCU_OPT_CTRL MSR Definition | ||
124 | +-------------------------------- | ||
125 | +Along with the mitigation for this issue, Intel added a new thread-scope | ||
126 | +IA32_MCU_OPT_CTRL MSR, (address 0x123). The presence of this MSR and | ||
127 | +RNGDS_MITG_DIS (bit 0) is enumerated by CPUID.(EAX=07H,ECX=0).EDX[SRBDS_CTRL = | ||
128 | +9]==1. This MSR is introduced through the microcode update. | ||
129 | + | ||
130 | +Setting IA32_MCU_OPT_CTRL[0] (RNGDS_MITG_DIS) to 1 for a logical processor | ||
131 | +disables the mitigation for RDRAND and RDSEED executed outside of an Intel SGX | ||
132 | +enclave on that logical processor. Opting out of the mitigation for a | ||
133 | +particular logical processor does not affect the RDRAND and RDSEED mitigations | ||
134 | +for other logical processors. | ||
135 | + | ||
136 | +Note that inside of an Intel SGX enclave, the mitigation is applied regardless | ||
137 | +of the value of RNGDS_MITG_DS. | ||
138 | + | ||
139 | +Mitigation control on the kernel command line | ||
140 | +--------------------------------------------- | ||
141 | +The kernel command line allows control over the SRBDS mitigation at boot time | ||
142 | +with the option "srbds=". The option for this is: | ||
143 | + | ||
144 | + ============= ============================================================= | ||
145 | + off This option disables SRBDS mitigation for RDRAND and RDSEED on | ||
146 | + affected platforms. | ||
147 | + ============= ============================================================= | ||
148 | + | ||
149 | +SRBDS System Information | ||
150 | +----------------------- | ||
151 | +The Linux kernel provides vulnerability status information through sysfs. For | ||
152 | +SRBDS this can be accessed by the following sysfs file: | ||
153 | +/sys/devices/system/cpu/vulnerabilities/srbds | ||
154 | + | ||
155 | +The possible values contained in this file are: | ||
156 | + | ||
157 | + ============================== ============================================= | ||
158 | + Not affected Processor not vulnerable | ||
159 | + Vulnerable Processor vulnerable and mitigation disabled | ||
160 | + Vulnerable: No microcode Processor vulnerable and microcode is missing | ||
161 | + mitigation | ||
162 | + Mitigation: Microcode Processor is vulnerable and mitigation is in | ||
163 | + effect. | ||
164 | + Mitigation: TSX disabled Processor is only vulnerable when TSX is | ||
165 | + enabled while this system was booted with TSX | ||
166 | + disabled. | ||
167 | + Unknown: Dependent on | ||
168 | + hypervisor status Running on virtual guest processor that is | ||
169 | + affected but with no way to know if host | ||
170 | + processor is mitigated or vulnerable. | ||
171 | + ============================== ============================================= | ||
172 | + | ||
173 | +SRBDS Default mitigation | ||
174 | +------------------------ | ||
175 | +This new microcode serializes processor access during execution of RDRAND, | ||
176 | +RDSEED ensures that the shared buffer is overwritten before it is released for | ||
177 | +reuse. Use the "srbds=off" kernel command line to disable the mitigation for | ||
178 | +RDRAND and RDSEED. | ||
179 | diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt | ||
180 | index e05d65d6fcb6..40602517ca52 100644 | ||
181 | --- a/Documentation/kernel-parameters.txt | ||
182 | +++ b/Documentation/kernel-parameters.txt | ||
183 | @@ -4262,6 +4262,26 @@ bytes respectively. Such letter suffixes can also be entirely omitted. | ||
184 | spia_pedr= | ||
185 | spia_peddr= | ||
186 | |||
187 | + srbds= [X86,INTEL] | ||
188 | + Control the Special Register Buffer Data Sampling | ||
189 | + (SRBDS) mitigation. | ||
190 | + | ||
191 | + Certain CPUs are vulnerable to an MDS-like | ||
192 | + exploit which can leak bits from the random | ||
193 | + number generator. | ||
194 | + | ||
195 | + By default, this issue is mitigated by | ||
196 | + microcode. However, the microcode fix can cause | ||
197 | + the RDRAND and RDSEED instructions to become | ||
198 | + much slower. Among other effects, this will | ||
199 | + result in reduced throughput from /dev/urandom. | ||
200 | + | ||
201 | + The microcode mitigation can be disabled with | ||
202 | + the following option: | ||
203 | + | ||
204 | + off: Disable mitigation and remove | ||
205 | + performance impact to RDRAND and RDSEED | ||
206 | + | ||
207 | ssbd= [ARM64,HW] | ||
208 | Speculative Store Bypass Disable control | ||
209 | |||
210 | diff --git a/Makefile b/Makefile | ||
211 | index b0e1162fddfa..6c3c6e193621 100644 | ||
212 | --- a/Makefile | ||
213 | +++ b/Makefile | ||
214 | @@ -1,6 +1,6 @@ | ||
215 | VERSION = 4 | ||
216 | PATCHLEVEL = 9 | ||
217 | -SUBLEVEL = 226 | ||
218 | +SUBLEVEL = 227 | ||
219 | EXTRAVERSION = | ||
220 | NAME = Roaring Lionus | ||
221 | |||
222 | diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c | ||
223 | index 9f96120eee6e..82464fae7772 100644 | ||
224 | --- a/arch/arc/kernel/setup.c | ||
225 | +++ b/arch/arc/kernel/setup.c | ||
226 | @@ -12,6 +12,7 @@ | ||
227 | #include <linux/root_dev.h> | ||
228 | #include <linux/console.h> | ||
229 | #include <linux/module.h> | ||
230 | +#include <linux/sizes.h> | ||
231 | #include <linux/cpu.h> | ||
232 | #include <linux/of_fdt.h> | ||
233 | #include <linux/of.h> | ||
234 | @@ -333,12 +334,12 @@ static void arc_chk_core_config(void) | ||
235 | if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr) | ||
236 | panic("Linux built with incorrect DCCM Base address\n"); | ||
237 | |||
238 | - if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz) | ||
239 | + if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz) | ||
240 | panic("Linux built with incorrect DCCM Size\n"); | ||
241 | #endif | ||
242 | |||
243 | #ifdef CONFIG_ARC_HAS_ICCM | ||
244 | - if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz) | ||
245 | + if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz) | ||
246 | panic("Linux built with incorrect ICCM Size\n"); | ||
247 | #endif | ||
248 | |||
249 | diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S | ||
250 | index 802a4ded9a62..e9df35249f9f 100644 | ||
251 | --- a/arch/s390/kernel/mcount.S | ||
252 | +++ b/arch/s390/kernel/mcount.S | ||
253 | @@ -39,6 +39,7 @@ EXPORT_SYMBOL(_mcount) | ||
254 | ENTRY(ftrace_caller) | ||
255 | .globl ftrace_regs_caller | ||
256 | .set ftrace_regs_caller,ftrace_caller | ||
257 | + stg %r14,(__SF_GPRS+8*8)(%r15) # save traced function caller | ||
258 | lgr %r1,%r15 | ||
259 | #ifndef CC_USING_HOTPATCH | ||
260 | aghi %r0,MCOUNT_RETURN_FIXUP | ||
261 | diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h | ||
262 | index ff501e511d91..b9473858c6b6 100644 | ||
263 | --- a/arch/x86/include/asm/cpu_device_id.h | ||
264 | +++ b/arch/x86/include/asm/cpu_device_id.h | ||
265 | @@ -8,6 +8,33 @@ | ||
266 | |||
267 | #include <linux/mod_devicetable.h> | ||
268 | |||
269 | +#define X86_STEPPINGS(mins, maxs) GENMASK(maxs, mins) | ||
270 | + | ||
271 | +/** | ||
272 | + * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching | ||
273 | + * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY | ||
274 | + * The name is expanded to X86_VENDOR_@_vendor | ||
275 | + * @_family: The family number or X86_FAMILY_ANY | ||
276 | + * @_model: The model number, model constant or X86_MODEL_ANY | ||
277 | + * @_steppings: Bitmask for steppings, stepping constant or X86_STEPPING_ANY | ||
278 | + * @_feature: A X86_FEATURE bit or X86_FEATURE_ANY | ||
279 | + * @_data: Driver specific data or NULL. The internal storage | ||
280 | + * format is unsigned long. The supplied value, pointer | ||
281 | + * etc. is casted to unsigned long internally. | ||
282 | + * | ||
283 | + * Backport version to keep the SRBDS pile consistant. No shorter variants | ||
284 | + * required for this. | ||
285 | + */ | ||
286 | +#define X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(_vendor, _family, _model, \ | ||
287 | + _steppings, _feature, _data) { \ | ||
288 | + .vendor = X86_VENDOR_##_vendor, \ | ||
289 | + .family = _family, \ | ||
290 | + .model = _model, \ | ||
291 | + .steppings = _steppings, \ | ||
292 | + .feature = _feature, \ | ||
293 | + .driver_data = (unsigned long) _data \ | ||
294 | +} | ||
295 | + | ||
296 | extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match); | ||
297 | |||
298 | #endif | ||
299 | diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h | ||
300 | index fb457ba8ccc6..2cd5d12a842c 100644 | ||
301 | --- a/arch/x86/include/asm/cpufeatures.h | ||
302 | +++ b/arch/x86/include/asm/cpufeatures.h | ||
303 | @@ -316,6 +316,7 @@ | ||
304 | /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ | ||
305 | #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */ | ||
306 | #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */ | ||
307 | +#define X86_FEATURE_SRBDS_CTRL (18*32+ 9) /* "" SRBDS mitigation MSR available */ | ||
308 | #define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */ | ||
309 | #define X86_FEATURE_MD_CLEAR (18*32+10) /* VERW clears CPU buffers */ | ||
310 | #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */ | ||
311 | @@ -346,19 +347,20 @@ | ||
312 | */ | ||
313 | #define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */ | ||
314 | #endif | ||
315 | -#define X86_BUG_NULL_SEG X86_BUG(10) /* Nulling a selector preserves the base */ | ||
316 | -#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */ | ||
317 | -#define X86_BUG_MONITOR X86_BUG(12) /* IPI required to wake up remote CPU */ | ||
318 | -#define X86_BUG_AMD_E400 X86_BUG(13) /* CPU is among the affected by Erratum 400 */ | ||
319 | -#define X86_BUG_CPU_MELTDOWN X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */ | ||
320 | -#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */ | ||
321 | -#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */ | ||
322 | -#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */ | ||
323 | -#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */ | ||
324 | -#define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */ | ||
325 | -#define X86_BUG_MSBDS_ONLY X86_BUG(20) /* CPU is only affected by the MSDBS variant of BUG_MDS */ | ||
326 | -#define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */ | ||
327 | -#define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */ | ||
328 | -#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */ | ||
329 | +#define X86_BUG_NULL_SEG X86_BUG(10) /* Nulling a selector preserves the base */ | ||
330 | +#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */ | ||
331 | +#define X86_BUG_MONITOR X86_BUG(12) /* IPI required to wake up remote CPU */ | ||
332 | +#define X86_BUG_AMD_E400 X86_BUG(13) /* CPU is among the affected by Erratum 400 */ | ||
333 | +#define X86_BUG_CPU_MELTDOWN X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */ | ||
334 | +#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */ | ||
335 | +#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */ | ||
336 | +#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */ | ||
337 | +#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */ | ||
338 | +#define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */ | ||
339 | +#define X86_BUG_MSBDS_ONLY X86_BUG(20) /* CPU is only affected by the MSDBS variant of BUG_MDS */ | ||
340 | +#define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */ | ||
341 | +#define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */ | ||
342 | +#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */ | ||
343 | +#define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */ | ||
344 | |||
345 | #endif /* _ASM_X86_CPUFEATURES_H */ | ||
346 | diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h | ||
347 | index 8d162e0f2881..b12b0a50ad1f 100644 | ||
348 | --- a/arch/x86/include/asm/msr-index.h | ||
349 | +++ b/arch/x86/include/asm/msr-index.h | ||
350 | @@ -103,6 +103,10 @@ | ||
351 | #define TSX_CTRL_RTM_DISABLE BIT(0) /* Disable RTM feature */ | ||
352 | #define TSX_CTRL_CPUID_CLEAR BIT(1) /* Disable TSX enumeration */ | ||
353 | |||
354 | +/* SRBDS support */ | ||
355 | +#define MSR_IA32_MCU_OPT_CTRL 0x00000123 | ||
356 | +#define RNGDS_MITG_DIS BIT(0) | ||
357 | + | ||
358 | #define MSR_IA32_SYSENTER_CS 0x00000174 | ||
359 | #define MSR_IA32_SYSENTER_ESP 0x00000175 | ||
360 | #define MSR_IA32_SYSENTER_EIP 0x00000176 | ||
361 | diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h | ||
362 | index 5736306bdaab..e638e3bc3cb8 100644 | ||
363 | --- a/arch/x86/include/asm/pgtable.h | ||
364 | +++ b/arch/x86/include/asm/pgtable.h | ||
365 | @@ -203,6 +203,7 @@ static inline int pmd_large(pmd_t pte) | ||
366 | } | ||
367 | |||
368 | #ifdef CONFIG_TRANSPARENT_HUGEPAGE | ||
369 | +/* NOTE: when predicate huge page, consider also pmd_devmap, or use pmd_large */ | ||
370 | static inline int pmd_trans_huge(pmd_t pmd) | ||
371 | { | ||
372 | return (pmd_val(pmd) & (_PAGE_PSE|_PAGE_DEVMAP)) == _PAGE_PSE; | ||
373 | diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c | ||
374 | index 24307d5bb4b8..5ef0a2b34261 100644 | ||
375 | --- a/arch/x86/kernel/cpu/bugs.c | ||
376 | +++ b/arch/x86/kernel/cpu/bugs.c | ||
377 | @@ -40,6 +40,7 @@ static void __init l1tf_select_mitigation(void); | ||
378 | static void __init mds_select_mitigation(void); | ||
379 | static void __init mds_print_mitigation(void); | ||
380 | static void __init taa_select_mitigation(void); | ||
381 | +static void __init srbds_select_mitigation(void); | ||
382 | |||
383 | /* The base value of the SPEC_CTRL MSR that always has to be preserved. */ | ||
384 | u64 x86_spec_ctrl_base; | ||
385 | @@ -107,6 +108,7 @@ void __init check_bugs(void) | ||
386 | l1tf_select_mitigation(); | ||
387 | mds_select_mitigation(); | ||
388 | taa_select_mitigation(); | ||
389 | + srbds_select_mitigation(); | ||
390 | |||
391 | /* | ||
392 | * As MDS and TAA mitigations are inter-related, print MDS | ||
393 | @@ -389,6 +391,97 @@ static int __init tsx_async_abort_parse_cmdline(char *str) | ||
394 | } | ||
395 | early_param("tsx_async_abort", tsx_async_abort_parse_cmdline); | ||
396 | |||
397 | +#undef pr_fmt | ||
398 | +#define pr_fmt(fmt) "SRBDS: " fmt | ||
399 | + | ||
400 | +enum srbds_mitigations { | ||
401 | + SRBDS_MITIGATION_OFF, | ||
402 | + SRBDS_MITIGATION_UCODE_NEEDED, | ||
403 | + SRBDS_MITIGATION_FULL, | ||
404 | + SRBDS_MITIGATION_TSX_OFF, | ||
405 | + SRBDS_MITIGATION_HYPERVISOR, | ||
406 | +}; | ||
407 | + | ||
408 | +static enum srbds_mitigations srbds_mitigation __ro_after_init = SRBDS_MITIGATION_FULL; | ||
409 | + | ||
410 | +static const char * const srbds_strings[] = { | ||
411 | + [SRBDS_MITIGATION_OFF] = "Vulnerable", | ||
412 | + [SRBDS_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode", | ||
413 | + [SRBDS_MITIGATION_FULL] = "Mitigation: Microcode", | ||
414 | + [SRBDS_MITIGATION_TSX_OFF] = "Mitigation: TSX disabled", | ||
415 | + [SRBDS_MITIGATION_HYPERVISOR] = "Unknown: Dependent on hypervisor status", | ||
416 | +}; | ||
417 | + | ||
418 | +static bool srbds_off; | ||
419 | + | ||
420 | +void update_srbds_msr(void) | ||
421 | +{ | ||
422 | + u64 mcu_ctrl; | ||
423 | + | ||
424 | + if (!boot_cpu_has_bug(X86_BUG_SRBDS)) | ||
425 | + return; | ||
426 | + | ||
427 | + if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) | ||
428 | + return; | ||
429 | + | ||
430 | + if (srbds_mitigation == SRBDS_MITIGATION_UCODE_NEEDED) | ||
431 | + return; | ||
432 | + | ||
433 | + rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl); | ||
434 | + | ||
435 | + switch (srbds_mitigation) { | ||
436 | + case SRBDS_MITIGATION_OFF: | ||
437 | + case SRBDS_MITIGATION_TSX_OFF: | ||
438 | + mcu_ctrl |= RNGDS_MITG_DIS; | ||
439 | + break; | ||
440 | + case SRBDS_MITIGATION_FULL: | ||
441 | + mcu_ctrl &= ~RNGDS_MITG_DIS; | ||
442 | + break; | ||
443 | + default: | ||
444 | + break; | ||
445 | + } | ||
446 | + | ||
447 | + wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl); | ||
448 | +} | ||
449 | + | ||
450 | +static void __init srbds_select_mitigation(void) | ||
451 | +{ | ||
452 | + u64 ia32_cap; | ||
453 | + | ||
454 | + if (!boot_cpu_has_bug(X86_BUG_SRBDS)) | ||
455 | + return; | ||
456 | + | ||
457 | + /* | ||
458 | + * Check to see if this is one of the MDS_NO systems supporting | ||
459 | + * TSX that are only exposed to SRBDS when TSX is enabled. | ||
460 | + */ | ||
461 | + ia32_cap = x86_read_arch_cap_msr(); | ||
462 | + if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM)) | ||
463 | + srbds_mitigation = SRBDS_MITIGATION_TSX_OFF; | ||
464 | + else if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) | ||
465 | + srbds_mitigation = SRBDS_MITIGATION_HYPERVISOR; | ||
466 | + else if (!boot_cpu_has(X86_FEATURE_SRBDS_CTRL)) | ||
467 | + srbds_mitigation = SRBDS_MITIGATION_UCODE_NEEDED; | ||
468 | + else if (cpu_mitigations_off() || srbds_off) | ||
469 | + srbds_mitigation = SRBDS_MITIGATION_OFF; | ||
470 | + | ||
471 | + update_srbds_msr(); | ||
472 | + pr_info("%s\n", srbds_strings[srbds_mitigation]); | ||
473 | +} | ||
474 | + | ||
475 | +static int __init srbds_parse_cmdline(char *str) | ||
476 | +{ | ||
477 | + if (!str) | ||
478 | + return -EINVAL; | ||
479 | + | ||
480 | + if (!boot_cpu_has_bug(X86_BUG_SRBDS)) | ||
481 | + return 0; | ||
482 | + | ||
483 | + srbds_off = !strcmp(str, "off"); | ||
484 | + return 0; | ||
485 | +} | ||
486 | +early_param("srbds", srbds_parse_cmdline); | ||
487 | + | ||
488 | #undef pr_fmt | ||
489 | #define pr_fmt(fmt) "Spectre V1 : " fmt | ||
490 | |||
491 | @@ -1501,6 +1594,11 @@ static char *ibpb_state(void) | ||
492 | return ""; | ||
493 | } | ||
494 | |||
495 | +static ssize_t srbds_show_state(char *buf) | ||
496 | +{ | ||
497 | + return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]); | ||
498 | +} | ||
499 | + | ||
500 | static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, | ||
501 | char *buf, unsigned int bug) | ||
502 | { | ||
503 | @@ -1542,6 +1640,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr | ||
504 | case X86_BUG_ITLB_MULTIHIT: | ||
505 | return itlb_multihit_show_state(buf); | ||
506 | |||
507 | + case X86_BUG_SRBDS: | ||
508 | + return srbds_show_state(buf); | ||
509 | + | ||
510 | default: | ||
511 | break; | ||
512 | } | ||
513 | @@ -1588,4 +1689,9 @@ ssize_t cpu_show_itlb_multihit(struct device *dev, struct device_attribute *attr | ||
514 | { | ||
515 | return cpu_show_common(dev, attr, buf, X86_BUG_ITLB_MULTIHIT); | ||
516 | } | ||
517 | + | ||
518 | +ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *buf) | ||
519 | +{ | ||
520 | + return cpu_show_common(dev, attr, buf, X86_BUG_SRBDS); | ||
521 | +} | ||
522 | #endif | ||
523 | diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c | ||
524 | index f490a4fab2f7..b16b6176738b 100644 | ||
525 | --- a/arch/x86/kernel/cpu/common.c | ||
526 | +++ b/arch/x86/kernel/cpu/common.c | ||
527 | @@ -956,9 +956,30 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { | ||
528 | {} | ||
529 | }; | ||
530 | |||
531 | -static bool __init cpu_matches(unsigned long which) | ||
532 | +#define VULNBL_INTEL_STEPPINGS(model, steppings, issues) \ | ||
533 | + X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, \ | ||
534 | + INTEL_FAM6_##model, steppings, \ | ||
535 | + X86_FEATURE_ANY, issues) | ||
536 | + | ||
537 | +#define SRBDS BIT(0) | ||
538 | + | ||
539 | +static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { | ||
540 | + VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), | ||
541 | + VULNBL_INTEL_STEPPINGS(HASWELL_CORE, X86_STEPPING_ANY, SRBDS), | ||
542 | + VULNBL_INTEL_STEPPINGS(HASWELL_ULT, X86_STEPPING_ANY, SRBDS), | ||
543 | + VULNBL_INTEL_STEPPINGS(HASWELL_GT3E, X86_STEPPING_ANY, SRBDS), | ||
544 | + VULNBL_INTEL_STEPPINGS(BROADWELL_GT3E, X86_STEPPING_ANY, SRBDS), | ||
545 | + VULNBL_INTEL_STEPPINGS(BROADWELL_CORE, X86_STEPPING_ANY, SRBDS), | ||
546 | + VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS), | ||
547 | + VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS), | ||
548 | + VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x0, 0xC), SRBDS), | ||
549 | + VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0xD), SRBDS), | ||
550 | + {} | ||
551 | +}; | ||
552 | + | ||
553 | +static bool __init cpu_matches(const struct x86_cpu_id *table, unsigned long which) | ||
554 | { | ||
555 | - const struct x86_cpu_id *m = x86_match_cpu(cpu_vuln_whitelist); | ||
556 | + const struct x86_cpu_id *m = x86_match_cpu(table); | ||
557 | |||
558 | return m && !!(m->driver_data & which); | ||
559 | } | ||
560 | @@ -978,29 +999,32 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) | ||
561 | u64 ia32_cap = x86_read_arch_cap_msr(); | ||
562 | |||
563 | /* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */ | ||
564 | - if (!cpu_matches(NO_ITLB_MULTIHIT) && !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO)) | ||
565 | + if (!cpu_matches(cpu_vuln_whitelist, NO_ITLB_MULTIHIT) && | ||
566 | + !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO)) | ||
567 | setup_force_cpu_bug(X86_BUG_ITLB_MULTIHIT); | ||
568 | |||
569 | - if (cpu_matches(NO_SPECULATION)) | ||
570 | + if (cpu_matches(cpu_vuln_whitelist, NO_SPECULATION)) | ||
571 | return; | ||
572 | |||
573 | setup_force_cpu_bug(X86_BUG_SPECTRE_V1); | ||
574 | setup_force_cpu_bug(X86_BUG_SPECTRE_V2); | ||
575 | |||
576 | - if (!cpu_matches(NO_SSB) && !(ia32_cap & ARCH_CAP_SSB_NO) && | ||
577 | + if (!cpu_matches(cpu_vuln_whitelist, NO_SSB) && | ||
578 | + !(ia32_cap & ARCH_CAP_SSB_NO) && | ||
579 | !cpu_has(c, X86_FEATURE_AMD_SSB_NO)) | ||
580 | setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS); | ||
581 | |||
582 | if (ia32_cap & ARCH_CAP_IBRS_ALL) | ||
583 | setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED); | ||
584 | |||
585 | - if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO)) { | ||
586 | + if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) && | ||
587 | + !(ia32_cap & ARCH_CAP_MDS_NO)) { | ||
588 | setup_force_cpu_bug(X86_BUG_MDS); | ||
589 | - if (cpu_matches(MSBDS_ONLY)) | ||
590 | + if (cpu_matches(cpu_vuln_whitelist, MSBDS_ONLY)) | ||
591 | setup_force_cpu_bug(X86_BUG_MSBDS_ONLY); | ||
592 | } | ||
593 | |||
594 | - if (!cpu_matches(NO_SWAPGS)) | ||
595 | + if (!cpu_matches(cpu_vuln_whitelist, NO_SWAPGS)) | ||
596 | setup_force_cpu_bug(X86_BUG_SWAPGS); | ||
597 | |||
598 | /* | ||
599 | @@ -1018,7 +1042,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) | ||
600 | (ia32_cap & ARCH_CAP_TSX_CTRL_MSR))) | ||
601 | setup_force_cpu_bug(X86_BUG_TAA); | ||
602 | |||
603 | - if (cpu_matches(NO_MELTDOWN)) | ||
604 | + /* | ||
605 | + * SRBDS affects CPUs which support RDRAND or RDSEED and are listed | ||
606 | + * in the vulnerability blacklist. | ||
607 | + */ | ||
608 | + if ((cpu_has(c, X86_FEATURE_RDRAND) || | ||
609 | + cpu_has(c, X86_FEATURE_RDSEED)) && | ||
610 | + cpu_matches(cpu_vuln_blacklist, SRBDS)) | ||
611 | + setup_force_cpu_bug(X86_BUG_SRBDS); | ||
612 | + | ||
613 | + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) | ||
614 | return; | ||
615 | |||
616 | /* Rogue Data Cache Load? No! */ | ||
617 | @@ -1027,7 +1060,7 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) | ||
618 | |||
619 | setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); | ||
620 | |||
621 | - if (cpu_matches(NO_L1TF)) | ||
622 | + if (cpu_matches(cpu_vuln_whitelist, NO_L1TF)) | ||
623 | return; | ||
624 | |||
625 | setup_force_cpu_bug(X86_BUG_L1TF); | ||
626 | @@ -1450,6 +1483,7 @@ void identify_secondary_cpu(struct cpuinfo_x86 *c) | ||
627 | mtrr_ap_init(); | ||
628 | validate_apic_and_package_id(c); | ||
629 | x86_spec_ctrl_setup_ap(); | ||
630 | + update_srbds_msr(); | ||
631 | } | ||
632 | |||
633 | struct msr_range { | ||
634 | diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h | ||
635 | index 4350f50b5deb..fdeeab6b158c 100644 | ||
636 | --- a/arch/x86/kernel/cpu/cpu.h | ||
637 | +++ b/arch/x86/kernel/cpu/cpu.h | ||
638 | @@ -66,6 +66,7 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c); | ||
639 | extern int detect_ht_early(struct cpuinfo_x86 *c); | ||
640 | |||
641 | extern void x86_spec_ctrl_setup_ap(void); | ||
642 | +extern void update_srbds_msr(void); | ||
643 | |||
644 | extern u64 x86_read_arch_cap_msr(void); | ||
645 | |||
646 | diff --git a/arch/x86/kernel/cpu/match.c b/arch/x86/kernel/cpu/match.c | ||
647 | index e42117d5f4d7..f46ffb3b295f 100644 | ||
648 | --- a/arch/x86/kernel/cpu/match.c | ||
649 | +++ b/arch/x86/kernel/cpu/match.c | ||
650 | @@ -33,13 +33,18 @@ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match) | ||
651 | const struct x86_cpu_id *m; | ||
652 | struct cpuinfo_x86 *c = &boot_cpu_data; | ||
653 | |||
654 | - for (m = match; m->vendor | m->family | m->model | m->feature; m++) { | ||
655 | + for (m = match; | ||
656 | + m->vendor | m->family | m->model | m->steppings | m->feature; | ||
657 | + m++) { | ||
658 | if (m->vendor != X86_VENDOR_ANY && c->x86_vendor != m->vendor) | ||
659 | continue; | ||
660 | if (m->family != X86_FAMILY_ANY && c->x86 != m->family) | ||
661 | continue; | ||
662 | if (m->model != X86_MODEL_ANY && c->x86_model != m->model) | ||
663 | continue; | ||
664 | + if (m->steppings != X86_STEPPING_ANY && | ||
665 | + !(BIT(c->x86_stepping) & m->steppings)) | ||
666 | + continue; | ||
667 | if (m->feature != X86_FEATURE_ANY && !cpu_has(c, m->feature)) | ||
668 | continue; | ||
669 | return m; | ||
670 | diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c | ||
671 | index bef36622e408..abd4fa587ca4 100644 | ||
672 | --- a/arch/x86/mm/mmio-mod.c | ||
673 | +++ b/arch/x86/mm/mmio-mod.c | ||
674 | @@ -385,7 +385,7 @@ static void enter_uniprocessor(void) | ||
675 | int cpu; | ||
676 | int err; | ||
677 | |||
678 | - if (downed_cpus == NULL && | ||
679 | + if (!cpumask_available(downed_cpus) && | ||
680 | !alloc_cpumask_var(&downed_cpus, GFP_KERNEL)) { | ||
681 | pr_notice("Failed to allocate mask\n"); | ||
682 | goto out; | ||
683 | @@ -415,7 +415,7 @@ static void leave_uniprocessor(void) | ||
684 | int cpu; | ||
685 | int err; | ||
686 | |||
687 | - if (downed_cpus == NULL || cpumask_weight(downed_cpus) == 0) | ||
688 | + if (!cpumask_available(downed_cpus) || cpumask_weight(downed_cpus) == 0) | ||
689 | return; | ||
690 | pr_notice("Re-enabling CPUs...\n"); | ||
691 | for_each_cpu(cpu, downed_cpus) { | ||
692 | diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c | ||
693 | index 677c5f36674b..100850398dd3 100644 | ||
694 | --- a/drivers/base/cpu.c | ||
695 | +++ b/drivers/base/cpu.c | ||
696 | @@ -550,6 +550,12 @@ ssize_t __weak cpu_show_itlb_multihit(struct device *dev, | ||
697 | return sprintf(buf, "Not affected\n"); | ||
698 | } | ||
699 | |||
700 | +ssize_t __weak cpu_show_srbds(struct device *dev, | ||
701 | + struct device_attribute *attr, char *buf) | ||
702 | +{ | ||
703 | + return sprintf(buf, "Not affected\n"); | ||
704 | +} | ||
705 | + | ||
706 | static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); | ||
707 | static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); | ||
708 | static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); | ||
709 | @@ -558,6 +564,7 @@ static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL); | ||
710 | static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL); | ||
711 | static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL); | ||
712 | static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL); | ||
713 | +static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL); | ||
714 | |||
715 | static struct attribute *cpu_root_vulnerabilities_attrs[] = { | ||
716 | &dev_attr_meltdown.attr, | ||
717 | @@ -568,6 +575,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { | ||
718 | &dev_attr_mds.attr, | ||
719 | &dev_attr_tsx_async_abort.attr, | ||
720 | &dev_attr_itlb_multihit.attr, | ||
721 | + &dev_attr_srbds.attr, | ||
722 | NULL | ||
723 | }; | ||
724 | |||
725 | diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | ||
726 | index 95052373a828..681ac9bc68b3 100644 | ||
727 | --- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | ||
728 | +++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | ||
729 | @@ -381,6 +381,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { | ||
730 | }, | ||
731 | .driver_data = (void *)&sipodev_desc | ||
732 | }, | ||
733 | + { | ||
734 | + .ident = "Schneider SCL142ALM", | ||
735 | + .matches = { | ||
736 | + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SCHNEIDER"), | ||
737 | + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SCL142ALM"), | ||
738 | + }, | ||
739 | + .driver_data = (void *)&sipodev_desc | ||
740 | + }, | ||
741 | { } /* Terminate list */ | ||
742 | }; | ||
743 | |||
744 | diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c | ||
745 | index 360b6e98137a..5a3a532937ba 100644 | ||
746 | --- a/drivers/iio/light/vcnl4000.c | ||
747 | +++ b/drivers/iio/light/vcnl4000.c | ||
748 | @@ -61,7 +61,6 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask, | ||
749 | u8 rdy_mask, u8 data_reg, int *val) | ||
750 | { | ||
751 | int tries = 20; | ||
752 | - __be16 buf; | ||
753 | int ret; | ||
754 | |||
755 | mutex_lock(&data->lock); | ||
756 | @@ -88,13 +87,12 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask, | ||
757 | goto fail; | ||
758 | } | ||
759 | |||
760 | - ret = i2c_smbus_read_i2c_block_data(data->client, | ||
761 | - data_reg, sizeof(buf), (u8 *) &buf); | ||
762 | + ret = i2c_smbus_read_word_swapped(data->client, data_reg); | ||
763 | if (ret < 0) | ||
764 | goto fail; | ||
765 | |||
766 | mutex_unlock(&data->lock); | ||
767 | - *val = be16_to_cpu(buf); | ||
768 | + *val = ret; | ||
769 | |||
770 | return 0; | ||
771 | |||
772 | diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c | ||
773 | index d0435c7631ff..9c938f9892b2 100644 | ||
774 | --- a/drivers/net/can/slcan.c | ||
775 | +++ b/drivers/net/can/slcan.c | ||
776 | @@ -618,10 +618,9 @@ err_free_chan: | ||
777 | sl->tty = NULL; | ||
778 | tty->disc_data = NULL; | ||
779 | clear_bit(SLF_INUSE, &sl->flags); | ||
780 | - slc_free_netdev(sl->dev); | ||
781 | /* do not call free_netdev before rtnl_unlock */ | ||
782 | rtnl_unlock(); | ||
783 | - free_netdev(sl->dev); | ||
784 | + slc_free_netdev(sl->dev); | ||
785 | return err; | ||
786 | |||
787 | err_exit: | ||
788 | diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c | ||
789 | index a65d7a60f116..ffa7e7e6d18d 100644 | ||
790 | --- a/drivers/net/ethernet/apple/bmac.c | ||
791 | +++ b/drivers/net/ethernet/apple/bmac.c | ||
792 | @@ -1187,7 +1187,7 @@ bmac_get_station_address(struct net_device *dev, unsigned char *ea) | ||
793 | int i; | ||
794 | unsigned short data; | ||
795 | |||
796 | - for (i = 0; i < 6; i++) | ||
797 | + for (i = 0; i < 3; i++) | ||
798 | { | ||
799 | reset_and_select_srom(dev); | ||
800 | data = read_srom(dev, i + EnetAddressOffset/2, SROMAddressBits); | ||
801 | diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c | ||
802 | index 714593023bbc..af922bac19ae 100644 | ||
803 | --- a/drivers/net/ethernet/freescale/ucc_geth.c | ||
804 | +++ b/drivers/net/ethernet/freescale/ucc_geth.c | ||
805 | @@ -45,6 +45,7 @@ | ||
806 | #include <soc/fsl/qe/ucc.h> | ||
807 | #include <soc/fsl/qe/ucc_fast.h> | ||
808 | #include <asm/machdep.h> | ||
809 | +#include <net/sch_generic.h> | ||
810 | |||
811 | #include "ucc_geth.h" | ||
812 | |||
813 | @@ -1551,11 +1552,8 @@ static int ugeth_disable(struct ucc_geth_private *ugeth, enum comm_dir mode) | ||
814 | |||
815 | static void ugeth_quiesce(struct ucc_geth_private *ugeth) | ||
816 | { | ||
817 | - /* Prevent any further xmits, plus detach the device. */ | ||
818 | - netif_device_detach(ugeth->ndev); | ||
819 | - | ||
820 | - /* Wait for any current xmits to finish. */ | ||
821 | - netif_tx_disable(ugeth->ndev); | ||
822 | + /* Prevent any further xmits */ | ||
823 | + netif_tx_stop_all_queues(ugeth->ndev); | ||
824 | |||
825 | /* Disable the interrupt to avoid NAPI rescheduling. */ | ||
826 | disable_irq(ugeth->ug_info->uf_info.irq); | ||
827 | @@ -1568,7 +1566,10 @@ static void ugeth_activate(struct ucc_geth_private *ugeth) | ||
828 | { | ||
829 | napi_enable(&ugeth->napi); | ||
830 | enable_irq(ugeth->ug_info->uf_info.irq); | ||
831 | - netif_device_attach(ugeth->ndev); | ||
832 | + | ||
833 | + /* allow to xmit again */ | ||
834 | + netif_tx_wake_all_queues(ugeth->ndev); | ||
835 | + __netdev_watchdog_up(ugeth->ndev); | ||
836 | } | ||
837 | |||
838 | /* Called every time the controller might need to be made | ||
839 | diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c | ||
840 | index 4143659615e1..264136dba674 100644 | ||
841 | --- a/drivers/net/ethernet/smsc/smsc911x.c | ||
842 | +++ b/drivers/net/ethernet/smsc/smsc911x.c | ||
843 | @@ -2506,20 +2506,20 @@ static int smsc911x_drv_probe(struct platform_device *pdev) | ||
844 | |||
845 | retval = smsc911x_init(dev); | ||
846 | if (retval < 0) | ||
847 | - goto out_disable_resources; | ||
848 | + goto out_init_fail; | ||
849 | |||
850 | netif_carrier_off(dev); | ||
851 | |||
852 | retval = smsc911x_mii_init(pdev, dev); | ||
853 | if (retval) { | ||
854 | SMSC_WARN(pdata, probe, "Error %i initialising mii", retval); | ||
855 | - goto out_disable_resources; | ||
856 | + goto out_init_fail; | ||
857 | } | ||
858 | |||
859 | retval = register_netdev(dev); | ||
860 | if (retval) { | ||
861 | SMSC_WARN(pdata, probe, "Error %i registering device", retval); | ||
862 | - goto out_disable_resources; | ||
863 | + goto out_init_fail; | ||
864 | } else { | ||
865 | SMSC_TRACE(pdata, probe, | ||
866 | "Network interface: \"%s\"", dev->name); | ||
867 | @@ -2560,9 +2560,10 @@ static int smsc911x_drv_probe(struct platform_device *pdev) | ||
868 | |||
869 | return 0; | ||
870 | |||
871 | -out_disable_resources: | ||
872 | +out_init_fail: | ||
873 | pm_runtime_put(&pdev->dev); | ||
874 | pm_runtime_disable(&pdev->dev); | ||
875 | +out_disable_resources: | ||
876 | (void)smsc911x_disable_resources(pdev); | ||
877 | out_enable_resources_fail: | ||
878 | smsc911x_free_resources(pdev); | ||
879 | diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | ||
880 | index 11a4a81b0397..bcc5d1e16ce2 100644 | ||
881 | --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | ||
882 | +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | ||
883 | @@ -330,6 +330,19 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) | ||
884 | /* Enable PTP clock */ | ||
885 | regmap_read(gmac->nss_common, NSS_COMMON_CLK_GATE, &val); | ||
886 | val |= NSS_COMMON_CLK_GATE_PTP_EN(gmac->id); | ||
887 | + switch (gmac->phy_mode) { | ||
888 | + case PHY_INTERFACE_MODE_RGMII: | ||
889 | + val |= NSS_COMMON_CLK_GATE_RGMII_RX_EN(gmac->id) | | ||
890 | + NSS_COMMON_CLK_GATE_RGMII_TX_EN(gmac->id); | ||
891 | + break; | ||
892 | + case PHY_INTERFACE_MODE_SGMII: | ||
893 | + val |= NSS_COMMON_CLK_GATE_GMII_RX_EN(gmac->id) | | ||
894 | + NSS_COMMON_CLK_GATE_GMII_TX_EN(gmac->id); | ||
895 | + break; | ||
896 | + default: | ||
897 | + /* We don't get here; the switch above will have errored out */ | ||
898 | + unreachable(); | ||
899 | + } | ||
900 | regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val); | ||
901 | |||
902 | if (gmac->phy_mode == PHY_INTERFACE_MODE_SGMII) { | ||
903 | diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c | ||
904 | index fa8f7c40a384..804c52c35f07 100644 | ||
905 | --- a/drivers/net/ppp/pppoe.c | ||
906 | +++ b/drivers/net/ppp/pppoe.c | ||
907 | @@ -494,6 +494,9 @@ static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, | ||
908 | if (!skb) | ||
909 | goto out; | ||
910 | |||
911 | + if (skb->pkt_type != PACKET_HOST) | ||
912 | + goto abort; | ||
913 | + | ||
914 | if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) | ||
915 | goto abort; | ||
916 | |||
917 | diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c | ||
918 | index cc841126147e..f870396e05e1 100644 | ||
919 | --- a/drivers/net/slip/slip.c | ||
920 | +++ b/drivers/net/slip/slip.c | ||
921 | @@ -867,7 +867,10 @@ err_free_chan: | ||
922 | sl->tty = NULL; | ||
923 | tty->disc_data = NULL; | ||
924 | clear_bit(SLF_INUSE, &sl->flags); | ||
925 | + /* do not call free_netdev before rtnl_unlock */ | ||
926 | + rtnl_unlock(); | ||
927 | sl_free_netdev(sl->dev); | ||
928 | + return err; | ||
929 | |||
930 | err_exit: | ||
931 | rtnl_unlock(); | ||
932 | diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c | ||
933 | index 5755eec00d7f..9a873616dd27 100644 | ||
934 | --- a/drivers/net/usb/qmi_wwan.c | ||
935 | +++ b/drivers/net/usb/qmi_wwan.c | ||
936 | @@ -921,6 +921,7 @@ static const struct usb_device_id products[] = { | ||
937 | {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ | ||
938 | {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ | ||
939 | {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ | ||
940 | + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ | ||
941 | {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ | ||
942 | {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ | ||
943 | {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ | ||
944 | diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c | ||
945 | index a8d470010f5e..ea609dc7f081 100644 | ||
946 | --- a/drivers/net/wireless/cisco/airo.c | ||
947 | +++ b/drivers/net/wireless/cisco/airo.c | ||
948 | @@ -1928,6 +1928,10 @@ static netdev_tx_t mpi_start_xmit(struct sk_buff *skb, | ||
949 | airo_print_err(dev->name, "%s: skb == NULL!",__func__); | ||
950 | return NETDEV_TX_OK; | ||
951 | } | ||
952 | + if (skb_padto(skb, ETH_ZLEN)) { | ||
953 | + dev->stats.tx_dropped++; | ||
954 | + return NETDEV_TX_OK; | ||
955 | + } | ||
956 | npacks = skb_queue_len (&ai->txq); | ||
957 | |||
958 | if (npacks >= MAXTXQ - 1) { | ||
959 | @@ -2130,6 +2134,10 @@ static netdev_tx_t airo_start_xmit(struct sk_buff *skb, | ||
960 | airo_print_err(dev->name, "%s: skb == NULL!", __func__); | ||
961 | return NETDEV_TX_OK; | ||
962 | } | ||
963 | + if (skb_padto(skb, ETH_ZLEN)) { | ||
964 | + dev->stats.tx_dropped++; | ||
965 | + return NETDEV_TX_OK; | ||
966 | + } | ||
967 | |||
968 | /* Find a vacant FID */ | ||
969 | for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ ); | ||
970 | @@ -2204,6 +2212,10 @@ static netdev_tx_t airo_start_xmit11(struct sk_buff *skb, | ||
971 | airo_print_err(dev->name, "%s: skb == NULL!", __func__); | ||
972 | return NETDEV_TX_OK; | ||
973 | } | ||
974 | + if (skb_padto(skb, ETH_ZLEN)) { | ||
975 | + dev->stats.tx_dropped++; | ||
976 | + return NETDEV_TX_OK; | ||
977 | + } | ||
978 | |||
979 | /* Find a vacant FID */ | ||
980 | for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ ); | ||
981 | diff --git a/drivers/net/wireless/intersil/p54/p54usb.c b/drivers/net/wireless/intersil/p54/p54usb.c | ||
982 | index 4a197a32d78c..979fcef1d848 100644 | ||
983 | --- a/drivers/net/wireless/intersil/p54/p54usb.c | ||
984 | +++ b/drivers/net/wireless/intersil/p54/p54usb.c | ||
985 | @@ -64,6 +64,7 @@ static struct usb_device_id p54u_table[] = { | ||
986 | {USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */ | ||
987 | {USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */ | ||
988 | {USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */ | ||
989 | + {USB_DEVICE(0x124a, 0x4026)}, /* AirVasT USB wireless device */ | ||
990 | {USB_DEVICE(0x1435, 0x0210)}, /* Inventel UR054G */ | ||
991 | {USB_DEVICE(0x15a9, 0x0002)}, /* Gemtek WUBI-100GW 802.11g */ | ||
992 | {USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */ | ||
993 | diff --git a/drivers/nfc/st21nfca/dep.c b/drivers/nfc/st21nfca/dep.c | ||
994 | index 798a32bbac5d..e023a679bdea 100644 | ||
995 | --- a/drivers/nfc/st21nfca/dep.c | ||
996 | +++ b/drivers/nfc/st21nfca/dep.c | ||
997 | @@ -184,8 +184,10 @@ static int st21nfca_tm_send_atr_res(struct nfc_hci_dev *hdev, | ||
998 | memcpy(atr_res->gbi, atr_req->gbi, gb_len); | ||
999 | r = nfc_set_remote_general_bytes(hdev->ndev, atr_res->gbi, | ||
1000 | gb_len); | ||
1001 | - if (r < 0) | ||
1002 | + if (r < 0) { | ||
1003 | + kfree_skb(skb); | ||
1004 | return r; | ||
1005 | + } | ||
1006 | } | ||
1007 | |||
1008 | info->dep_info.curr_nfc_dep_pni = 0; | ||
1009 | diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c | ||
1010 | index b5305f08b184..05b1c4f36b7b 100644 | ||
1011 | --- a/drivers/nvmem/qfprom.c | ||
1012 | +++ b/drivers/nvmem/qfprom.c | ||
1013 | @@ -30,19 +30,6 @@ static int qfprom_reg_read(void *context, | ||
1014 | return 0; | ||
1015 | } | ||
1016 | |||
1017 | -static int qfprom_reg_write(void *context, | ||
1018 | - unsigned int reg, void *_val, size_t bytes) | ||
1019 | -{ | ||
1020 | - void __iomem *base = context; | ||
1021 | - u32 *val = _val; | ||
1022 | - int i = 0, words = bytes / 4; | ||
1023 | - | ||
1024 | - while (words--) | ||
1025 | - writel(*val++, base + reg + (i++ * 4)); | ||
1026 | - | ||
1027 | - return 0; | ||
1028 | -} | ||
1029 | - | ||
1030 | static int qfprom_remove(struct platform_device *pdev) | ||
1031 | { | ||
1032 | struct nvmem_device *nvmem = platform_get_drvdata(pdev); | ||
1033 | @@ -56,7 +43,6 @@ static struct nvmem_config econfig = { | ||
1034 | .stride = 4, | ||
1035 | .word_size = 1, | ||
1036 | .reg_read = qfprom_reg_read, | ||
1037 | - .reg_write = qfprom_reg_write, | ||
1038 | }; | ||
1039 | |||
1040 | static int qfprom_probe(struct platform_device *pdev) | ||
1041 | diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c | ||
1042 | index 9d555b63d2e2..d596b76eea64 100644 | ||
1043 | --- a/drivers/scsi/scsi_devinfo.c | ||
1044 | +++ b/drivers/scsi/scsi_devinfo.c | ||
1045 | @@ -394,8 +394,8 @@ EXPORT_SYMBOL(scsi_dev_info_list_add_keyed); | ||
1046 | |||
1047 | /** | ||
1048 | * scsi_dev_info_list_find - find a matching dev_info list entry. | ||
1049 | - * @vendor: vendor string | ||
1050 | - * @model: model (product) string | ||
1051 | + * @vendor: full vendor string | ||
1052 | + * @model: full model (product) string | ||
1053 | * @key: specify list to use | ||
1054 | * | ||
1055 | * Description: | ||
1056 | @@ -410,7 +410,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, | ||
1057 | struct scsi_dev_info_list *devinfo; | ||
1058 | struct scsi_dev_info_list_table *devinfo_table = | ||
1059 | scsi_devinfo_lookup_by_key(key); | ||
1060 | - size_t vmax, mmax; | ||
1061 | + size_t vmax, mmax, mlen; | ||
1062 | const char *vskip, *mskip; | ||
1063 | |||
1064 | if (IS_ERR(devinfo_table)) | ||
1065 | @@ -449,15 +449,18 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, | ||
1066 | dev_info_list) { | ||
1067 | if (devinfo->compatible) { | ||
1068 | /* | ||
1069 | - * Behave like the older version of get_device_flags. | ||
1070 | + * vendor strings must be an exact match | ||
1071 | */ | ||
1072 | - if (memcmp(devinfo->vendor, vskip, vmax) || | ||
1073 | - (vmax < sizeof(devinfo->vendor) && | ||
1074 | - devinfo->vendor[vmax])) | ||
1075 | + if (vmax != strlen(devinfo->vendor) || | ||
1076 | + memcmp(devinfo->vendor, vskip, vmax)) | ||
1077 | continue; | ||
1078 | - if (memcmp(devinfo->model, mskip, mmax) || | ||
1079 | - (mmax < sizeof(devinfo->model) && | ||
1080 | - devinfo->model[mmax])) | ||
1081 | + | ||
1082 | + /* | ||
1083 | + * @model specifies the full string, and | ||
1084 | + * must be larger or equal to devinfo->model | ||
1085 | + */ | ||
1086 | + mlen = strlen(devinfo->model); | ||
1087 | + if (mmax < mlen || memcmp(devinfo->model, mskip, mlen)) | ||
1088 | continue; | ||
1089 | return devinfo; | ||
1090 | } else { | ||
1091 | diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c | ||
1092 | index 50d15748084a..af4b0a2021d6 100644 | ||
1093 | --- a/drivers/scsi/ufs/ufshcd.c | ||
1094 | +++ b/drivers/scsi/ufs/ufshcd.c | ||
1095 | @@ -1512,6 +1512,7 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd) | ||
1096 | |||
1097 | err = ufshcd_map_sg(hba, lrbp); | ||
1098 | if (err) { | ||
1099 | + ufshcd_release(hba); | ||
1100 | lrbp->cmd = NULL; | ||
1101 | clear_bit_unlock(tag, &hba->lrb_in_use); | ||
1102 | goto out; | ||
1103 | diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c | ||
1104 | index 16f0def9df82..babf0a337e96 100644 | ||
1105 | --- a/drivers/spi/spi-dw.c | ||
1106 | +++ b/drivers/spi/spi-dw.c | ||
1107 | @@ -305,6 +305,9 @@ static int dw_spi_transfer_one(struct spi_master *master, | ||
1108 | dws->len = transfer->len; | ||
1109 | spin_unlock_irqrestore(&dws->buf_lock, flags); | ||
1110 | |||
1111 | + /* Ensure dw->rx and dw->rx_end are visible */ | ||
1112 | + smp_mb(); | ||
1113 | + | ||
1114 | spi_enable_chip(dws, 0); | ||
1115 | |||
1116 | /* Handle per transfer options for bpw and speed */ | ||
1117 | diff --git a/drivers/staging/rtl8712/wifi.h b/drivers/staging/rtl8712/wifi.h | ||
1118 | index b8af9656e6da..f97275b90177 100644 | ||
1119 | --- a/drivers/staging/rtl8712/wifi.h | ||
1120 | +++ b/drivers/staging/rtl8712/wifi.h | ||
1121 | @@ -471,7 +471,7 @@ static inline unsigned char *get_hdr_bssid(unsigned char *pframe) | ||
1122 | /* block-ack parameters */ | ||
1123 | #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 | ||
1124 | #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C | ||
1125 | -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 | ||
1126 | +#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0 | ||
1127 | #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000 | ||
1128 | #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800 | ||
1129 | |||
1130 | @@ -565,13 +565,6 @@ struct ieee80211_ht_addt_info { | ||
1131 | #define IEEE80211_HT_IE_NON_GF_STA_PRSNT 0x0004 | ||
1132 | #define IEEE80211_HT_IE_NON_HT_STA_PRSNT 0x0010 | ||
1133 | |||
1134 | -/* block-ack parameters */ | ||
1135 | -#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 | ||
1136 | -#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C | ||
1137 | -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 | ||
1138 | -#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000 | ||
1139 | -#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800 | ||
1140 | - | ||
1141 | /* | ||
1142 | * A-PMDU buffer sizes | ||
1143 | * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) | ||
1144 | diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c | ||
1145 | index f8964247c4c3..985f49a65906 100644 | ||
1146 | --- a/drivers/tty/hvc/hvc_console.c | ||
1147 | +++ b/drivers/tty/hvc/hvc_console.c | ||
1148 | @@ -358,15 +358,14 @@ static int hvc_open(struct tty_struct *tty, struct file * filp) | ||
1149 | * tty fields and return the kref reference. | ||
1150 | */ | ||
1151 | if (rc) { | ||
1152 | - tty_port_tty_set(&hp->port, NULL); | ||
1153 | - tty->driver_data = NULL; | ||
1154 | - tty_port_put(&hp->port); | ||
1155 | printk(KERN_ERR "hvc_open: request_irq failed with rc %d.\n", rc); | ||
1156 | - } else | ||
1157 | + } else { | ||
1158 | /* We are ready... raise DTR/RTS */ | ||
1159 | if (C_BAUD(tty)) | ||
1160 | if (hp->ops->dtr_rts) | ||
1161 | hp->ops->dtr_rts(hp, 1); | ||
1162 | + tty_port_set_initialized(&hp->port, true); | ||
1163 | + } | ||
1164 | |||
1165 | /* Force wakeup of the polling thread */ | ||
1166 | hvc_kick(); | ||
1167 | @@ -376,22 +375,12 @@ static int hvc_open(struct tty_struct *tty, struct file * filp) | ||
1168 | |||
1169 | static void hvc_close(struct tty_struct *tty, struct file * filp) | ||
1170 | { | ||
1171 | - struct hvc_struct *hp; | ||
1172 | + struct hvc_struct *hp = tty->driver_data; | ||
1173 | unsigned long flags; | ||
1174 | |||
1175 | if (tty_hung_up_p(filp)) | ||
1176 | return; | ||
1177 | |||
1178 | - /* | ||
1179 | - * No driver_data means that this close was issued after a failed | ||
1180 | - * hvc_open by the tty layer's release_dev() function and we can just | ||
1181 | - * exit cleanly because the kref reference wasn't made. | ||
1182 | - */ | ||
1183 | - if (!tty->driver_data) | ||
1184 | - return; | ||
1185 | - | ||
1186 | - hp = tty->driver_data; | ||
1187 | - | ||
1188 | spin_lock_irqsave(&hp->port.lock, flags); | ||
1189 | |||
1190 | if (--hp->port.count == 0) { | ||
1191 | @@ -399,6 +388,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp) | ||
1192 | /* We are done with the tty pointer now. */ | ||
1193 | tty_port_tty_set(&hp->port, NULL); | ||
1194 | |||
1195 | + if (!tty_port_initialized(&hp->port)) | ||
1196 | + return; | ||
1197 | + | ||
1198 | if (C_HUPCL(tty)) | ||
1199 | if (hp->ops->dtr_rts) | ||
1200 | hp->ops->dtr_rts(hp, 0); | ||
1201 | @@ -415,6 +407,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp) | ||
1202 | * waking periodically to check chars_in_buffer(). | ||
1203 | */ | ||
1204 | tty_wait_until_sent(tty, HVC_CLOSE_WAIT); | ||
1205 | + tty_port_set_initialized(&hp->port, false); | ||
1206 | } else { | ||
1207 | if (hp->port.count < 0) | ||
1208 | printk(KERN_ERR "hvc_close %X: oops, count is %d\n", | ||
1209 | diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c | ||
1210 | index b4e7a7317713..d9eba7938917 100644 | ||
1211 | --- a/drivers/tty/vt/keyboard.c | ||
1212 | +++ b/drivers/tty/vt/keyboard.c | ||
1213 | @@ -125,7 +125,11 @@ static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */ | ||
1214 | static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */ | ||
1215 | static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */ | ||
1216 | static bool dead_key_next; | ||
1217 | -static int npadch = -1; /* -1 or number assembled on pad */ | ||
1218 | + | ||
1219 | +/* Handles a number being assembled on the number pad */ | ||
1220 | +static bool npadch_active; | ||
1221 | +static unsigned int npadch_value; | ||
1222 | + | ||
1223 | static unsigned int diacr; | ||
1224 | static char rep; /* flag telling character repeat */ | ||
1225 | |||
1226 | @@ -815,12 +819,12 @@ static void k_shift(struct vc_data *vc, unsigned char value, char up_flag) | ||
1227 | shift_state &= ~(1 << value); | ||
1228 | |||
1229 | /* kludge */ | ||
1230 | - if (up_flag && shift_state != old_state && npadch != -1) { | ||
1231 | + if (up_flag && shift_state != old_state && npadch_active) { | ||
1232 | if (kbd->kbdmode == VC_UNICODE) | ||
1233 | - to_utf8(vc, npadch); | ||
1234 | + to_utf8(vc, npadch_value); | ||
1235 | else | ||
1236 | - put_queue(vc, npadch & 0xff); | ||
1237 | - npadch = -1; | ||
1238 | + put_queue(vc, npadch_value & 0xff); | ||
1239 | + npadch_active = false; | ||
1240 | } | ||
1241 | } | ||
1242 | |||
1243 | @@ -838,7 +842,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag) | ||
1244 | |||
1245 | static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag) | ||
1246 | { | ||
1247 | - int base; | ||
1248 | + unsigned int base; | ||
1249 | |||
1250 | if (up_flag) | ||
1251 | return; | ||
1252 | @@ -852,10 +856,12 @@ static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag) | ||
1253 | base = 16; | ||
1254 | } | ||
1255 | |||
1256 | - if (npadch == -1) | ||
1257 | - npadch = value; | ||
1258 | - else | ||
1259 | - npadch = npadch * base + value; | ||
1260 | + if (!npadch_active) { | ||
1261 | + npadch_value = 0; | ||
1262 | + npadch_active = true; | ||
1263 | + } | ||
1264 | + | ||
1265 | + npadch_value = npadch_value * base + value; | ||
1266 | } | ||
1267 | |||
1268 | static void k_lock(struct vc_data *vc, unsigned char value, char up_flag) | ||
1269 | diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c | ||
1270 | index f4bd08cfac11..a631975e050d 100644 | ||
1271 | --- a/drivers/usb/gadget/function/f_uac2.c | ||
1272 | +++ b/drivers/usb/gadget/function/f_uac2.c | ||
1273 | @@ -1069,13 +1069,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) | ||
1274 | agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc); | ||
1275 | if (!agdev->out_ep) { | ||
1276 | dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); | ||
1277 | - return ret; | ||
1278 | + return -ENODEV; | ||
1279 | } | ||
1280 | |||
1281 | agdev->in_ep = usb_ep_autoconfig(gadget, &fs_epin_desc); | ||
1282 | if (!agdev->in_ep) { | ||
1283 | dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); | ||
1284 | - return ret; | ||
1285 | + return -ENODEV; | ||
1286 | } | ||
1287 | |||
1288 | uac2->p_prm.uac2 = uac2; | ||
1289 | diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c | ||
1290 | index 534a3f6fa89c..474bb13b7dbb 100644 | ||
1291 | --- a/drivers/usb/musb/musb_debugfs.c | ||
1292 | +++ b/drivers/usb/musb/musb_debugfs.c | ||
1293 | @@ -200,6 +200,11 @@ static ssize_t musb_test_mode_write(struct file *file, | ||
1294 | u8 test; | ||
1295 | char buf[18]; | ||
1296 | |||
1297 | + memset(buf, 0x00, sizeof(buf)); | ||
1298 | + | ||
1299 | + if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) | ||
1300 | + return -EFAULT; | ||
1301 | + | ||
1302 | pm_runtime_get_sync(musb->controller); | ||
1303 | test = musb_readb(musb->mregs, MUSB_TESTMODE); | ||
1304 | if (test) { | ||
1305 | @@ -208,11 +213,6 @@ static ssize_t musb_test_mode_write(struct file *file, | ||
1306 | goto ret; | ||
1307 | } | ||
1308 | |||
1309 | - memset(buf, 0x00, sizeof(buf)); | ||
1310 | - | ||
1311 | - if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) | ||
1312 | - return -EFAULT; | ||
1313 | - | ||
1314 | if (strstarts(buf, "force host")) | ||
1315 | test = MUSB_TEST_FORCE_HOST; | ||
1316 | |||
1317 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c | ||
1318 | index 737b6652a0b5..326e7109b8f8 100644 | ||
1319 | --- a/drivers/usb/serial/option.c | ||
1320 | +++ b/drivers/usb/serial/option.c | ||
1321 | @@ -1146,6 +1146,10 @@ static const struct usb_device_id option_ids[] = { | ||
1322 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, | ||
1323 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, | ||
1324 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, | ||
1325 | + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1031, 0xff), /* Telit LE910C1-EUX */ | ||
1326 | + .driver_info = NCTRL(0) | RSVD(3) }, | ||
1327 | + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */ | ||
1328 | + .driver_info = NCTRL(0) }, | ||
1329 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), | ||
1330 | .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) }, | ||
1331 | { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), | ||
1332 | diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c | ||
1333 | index 06916ddc3159..c59e6d4a8a61 100644 | ||
1334 | --- a/drivers/usb/serial/qcserial.c | ||
1335 | +++ b/drivers/usb/serial/qcserial.c | ||
1336 | @@ -177,6 +177,7 @@ static const struct usb_device_id id_table[] = { | ||
1337 | {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ | ||
1338 | {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ | ||
1339 | {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ | ||
1340 | + {DEVICE_SWI(0x413c, 0x81cb)}, /* Dell Wireless 5816e QDL */ | ||
1341 | {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */ | ||
1342 | {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */ | ||
1343 | {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */ | ||
1344 | diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c | ||
1345 | index 93c696e2131f..0fbb34fcbddf 100644 | ||
1346 | --- a/drivers/usb/serial/usb_wwan.c | ||
1347 | +++ b/drivers/usb/serial/usb_wwan.c | ||
1348 | @@ -305,6 +305,10 @@ static void usb_wwan_indat_callback(struct urb *urb) | ||
1349 | if (status) { | ||
1350 | dev_dbg(dev, "%s: nonzero status: %d on endpoint %02x.\n", | ||
1351 | __func__, status, endpoint); | ||
1352 | + | ||
1353 | + /* don't resubmit on fatal errors */ | ||
1354 | + if (status == -ESHUTDOWN || status == -ENOENT) | ||
1355 | + return; | ||
1356 | } else { | ||
1357 | if (urb->actual_length) { | ||
1358 | tty_insert_flip_string(&port->port, data, | ||
1359 | diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h | ||
1360 | index 1abfe37314a0..df841a72b804 100644 | ||
1361 | --- a/include/linux/mod_devicetable.h | ||
1362 | +++ b/include/linux/mod_devicetable.h | ||
1363 | @@ -572,6 +572,10 @@ struct mips_cdmm_device_id { | ||
1364 | /* | ||
1365 | * MODULE_DEVICE_TABLE expects this struct to be called x86cpu_device_id. | ||
1366 | * Although gcc seems to ignore this error, clang fails without this define. | ||
1367 | + * | ||
1368 | + * Note: The ordering of the struct is different from upstream because the | ||
1369 | + * static initializers in kernels < 5.7 still use C89 style while upstream | ||
1370 | + * has been converted to proper C99 initializers. | ||
1371 | */ | ||
1372 | #define x86cpu_device_id x86_cpu_id | ||
1373 | struct x86_cpu_id { | ||
1374 | @@ -580,6 +584,7 @@ struct x86_cpu_id { | ||
1375 | __u16 model; | ||
1376 | __u16 feature; /* bit index */ | ||
1377 | kernel_ulong_t driver_data; | ||
1378 | + __u16 steppings; | ||
1379 | }; | ||
1380 | |||
1381 | #define X86_FEATURE_MATCH(x) \ | ||
1382 | @@ -588,6 +593,7 @@ struct x86_cpu_id { | ||
1383 | #define X86_VENDOR_ANY 0xffff | ||
1384 | #define X86_FAMILY_ANY 0 | ||
1385 | #define X86_MODEL_ANY 0 | ||
1386 | +#define X86_STEPPING_ANY 0 | ||
1387 | #define X86_FEATURE_ANY 0 /* Same as FPU, you can't test for that */ | ||
1388 | |||
1389 | /* | ||
1390 | diff --git a/include/uapi/linux/mmc/ioctl.h b/include/uapi/linux/mmc/ioctl.h | ||
1391 | index 7e385b83b9d8..fe4b6b69d79a 100644 | ||
1392 | --- a/include/uapi/linux/mmc/ioctl.h | ||
1393 | +++ b/include/uapi/linux/mmc/ioctl.h | ||
1394 | @@ -2,6 +2,7 @@ | ||
1395 | #define LINUX_MMC_IOCTL_H | ||
1396 | |||
1397 | #include <linux/types.h> | ||
1398 | +#include <linux/major.h> | ||
1399 | |||
1400 | struct mmc_ioc_cmd { | ||
1401 | /* Implies direction of data. true = write, false = read */ | ||
1402 | diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c | ||
1403 | index 8ddd29476c0d..1fcaa174ed32 100644 | ||
1404 | --- a/kernel/events/uprobes.c | ||
1405 | +++ b/kernel/events/uprobes.c | ||
1406 | @@ -604,10 +604,6 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file, | ||
1407 | if (ret) | ||
1408 | goto out; | ||
1409 | |||
1410 | - /* uprobe_write_opcode() assumes we don't cross page boundary */ | ||
1411 | - BUG_ON((uprobe->offset & ~PAGE_MASK) + | ||
1412 | - UPROBE_SWBP_INSN_SIZE > PAGE_SIZE); | ||
1413 | - | ||
1414 | smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */ | ||
1415 | set_bit(UPROBE_COPY_INSN, &uprobe->flags); | ||
1416 | |||
1417 | @@ -886,6 +882,13 @@ int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer * | ||
1418 | if (offset > i_size_read(inode)) | ||
1419 | return -EINVAL; | ||
1420 | |||
1421 | + /* | ||
1422 | + * This ensures that copy_from_page() and copy_to_page() | ||
1423 | + * can't cross page boundary. | ||
1424 | + */ | ||
1425 | + if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE)) | ||
1426 | + return -EINVAL; | ||
1427 | + | ||
1428 | retry: | ||
1429 | uprobe = alloc_uprobe(inode, offset); | ||
1430 | if (!uprobe) | ||
1431 | @@ -1696,6 +1699,9 @@ static int is_trap_at_addr(struct mm_struct *mm, unsigned long vaddr) | ||
1432 | uprobe_opcode_t opcode; | ||
1433 | int result; | ||
1434 | |||
1435 | + if (WARN_ON_ONCE(!IS_ALIGNED(vaddr, UPROBE_SWBP_INSN_SIZE))) | ||
1436 | + return -EINVAL; | ||
1437 | + | ||
1438 | pagefault_disable(); | ||
1439 | result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr); | ||
1440 | pagefault_enable(); | ||
1441 | diff --git a/kernel/relay.c b/kernel/relay.c | ||
1442 | index 91e8fbf8aff3..5034cb3a339f 100644 | ||
1443 | --- a/kernel/relay.c | ||
1444 | +++ b/kernel/relay.c | ||
1445 | @@ -578,6 +578,11 @@ struct rchan *relay_open(const char *base_filename, | ||
1446 | return NULL; | ||
1447 | |||
1448 | chan->buf = alloc_percpu(struct rchan_buf *); | ||
1449 | + if (!chan->buf) { | ||
1450 | + kfree(chan); | ||
1451 | + return NULL; | ||
1452 | + } | ||
1453 | + | ||
1454 | chan->version = RELAYFS_CHANNEL_VERSION; | ||
1455 | chan->n_subbufs = n_subbufs; | ||
1456 | chan->subbuf_size = subbuf_size; | ||
1457 | diff --git a/mm/mremap.c b/mm/mremap.c | ||
1458 | index 9e6035969d7b..b5d8d25173c6 100644 | ||
1459 | --- a/mm/mremap.c | ||
1460 | +++ b/mm/mremap.c | ||
1461 | @@ -212,7 +212,7 @@ unsigned long move_page_tables(struct vm_area_struct *vma, | ||
1462 | new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr); | ||
1463 | if (!new_pmd) | ||
1464 | break; | ||
1465 | - if (pmd_trans_huge(*old_pmd)) { | ||
1466 | + if (pmd_trans_huge(*old_pmd) || pmd_devmap(*old_pmd)) { | ||
1467 | if (extent == HPAGE_PMD_SIZE) { | ||
1468 | bool moved; | ||
1469 | /* See comment in move_ptes() */ | ||
1470 | diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c | ||
1471 | index af3363f4543f..6f3c52943186 100644 | ||
1472 | --- a/net/ipv4/devinet.c | ||
1473 | +++ b/net/ipv4/devinet.c | ||
1474 | @@ -262,6 +262,7 @@ static struct in_device *inetdev_init(struct net_device *dev) | ||
1475 | err = devinet_sysctl_register(in_dev); | ||
1476 | if (err) { | ||
1477 | in_dev->dead = 1; | ||
1478 | + neigh_parms_release(&arp_tbl, in_dev->arp_parms); | ||
1479 | in_dev_put(in_dev); | ||
1480 | in_dev = NULL; | ||
1481 | goto out; | ||
1482 | diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c | ||
1483 | index 6a924be66e37..da158a3acac4 100644 | ||
1484 | --- a/net/ipv6/esp6.c | ||
1485 | +++ b/net/ipv6/esp6.c | ||
1486 | @@ -426,8 +426,10 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb) | ||
1487 | |||
1488 | sg_init_table(sg, nfrags); | ||
1489 | ret = skb_to_sgvec(skb, sg, 0, skb->len); | ||
1490 | - if (unlikely(ret < 0)) | ||
1491 | + if (unlikely(ret < 0)) { | ||
1492 | + kfree(tmp); | ||
1493 | goto out; | ||
1494 | + } | ||
1495 | |||
1496 | aead_request_set_crypt(req, sg, sg, elen + ivlen, iv); | ||
1497 | aead_request_set_ad(req, assoclen); | ||
1498 | diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c | ||
1499 | index 36c7f616294a..fdc1de1cb4fa 100644 | ||
1500 | --- a/net/l2tp/l2tp_core.c | ||
1501 | +++ b/net/l2tp/l2tp_core.c | ||
1502 | @@ -1568,6 +1568,8 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 | ||
1503 | tunnel_id, fd); | ||
1504 | goto err; | ||
1505 | } | ||
1506 | + if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6) | ||
1507 | + goto err; | ||
1508 | switch (encap) { | ||
1509 | case L2TP_ENCAPTYPE_UDP: | ||
1510 | if (sk->sk_protocol != IPPROTO_UDP) { | ||
1511 | diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c | ||
1512 | index 4a88c4eb2301..3817c3554641 100644 | ||
1513 | --- a/net/l2tp/l2tp_ip.c | ||
1514 | +++ b/net/l2tp/l2tp_ip.c | ||
1515 | @@ -24,7 +24,6 @@ | ||
1516 | #include <net/icmp.h> | ||
1517 | #include <net/udp.h> | ||
1518 | #include <net/inet_common.h> | ||
1519 | -#include <net/inet_hashtables.h> | ||
1520 | #include <net/tcp_states.h> | ||
1521 | #include <net/protocol.h> | ||
1522 | #include <net/xfrm.h> | ||
1523 | @@ -208,15 +207,31 @@ discard: | ||
1524 | return 0; | ||
1525 | } | ||
1526 | |||
1527 | -static int l2tp_ip_open(struct sock *sk) | ||
1528 | +static int l2tp_ip_hash(struct sock *sk) | ||
1529 | { | ||
1530 | - /* Prevent autobind. We don't have ports. */ | ||
1531 | - inet_sk(sk)->inet_num = IPPROTO_L2TP; | ||
1532 | + if (sk_unhashed(sk)) { | ||
1533 | + write_lock_bh(&l2tp_ip_lock); | ||
1534 | + sk_add_node(sk, &l2tp_ip_table); | ||
1535 | + write_unlock_bh(&l2tp_ip_lock); | ||
1536 | + } | ||
1537 | + return 0; | ||
1538 | +} | ||
1539 | |||
1540 | +static void l2tp_ip_unhash(struct sock *sk) | ||
1541 | +{ | ||
1542 | + if (sk_unhashed(sk)) | ||
1543 | + return; | ||
1544 | write_lock_bh(&l2tp_ip_lock); | ||
1545 | - sk_add_node(sk, &l2tp_ip_table); | ||
1546 | + sk_del_node_init(sk); | ||
1547 | write_unlock_bh(&l2tp_ip_lock); | ||
1548 | +} | ||
1549 | + | ||
1550 | +static int l2tp_ip_open(struct sock *sk) | ||
1551 | +{ | ||
1552 | + /* Prevent autobind. We don't have ports. */ | ||
1553 | + inet_sk(sk)->inet_num = IPPROTO_L2TP; | ||
1554 | |||
1555 | + l2tp_ip_hash(sk); | ||
1556 | return 0; | ||
1557 | } | ||
1558 | |||
1559 | @@ -598,8 +613,8 @@ static struct proto l2tp_ip_prot = { | ||
1560 | .sendmsg = l2tp_ip_sendmsg, | ||
1561 | .recvmsg = l2tp_ip_recvmsg, | ||
1562 | .backlog_rcv = l2tp_ip_backlog_recv, | ||
1563 | - .hash = inet_hash, | ||
1564 | - .unhash = inet_unhash, | ||
1565 | + .hash = l2tp_ip_hash, | ||
1566 | + .unhash = l2tp_ip_unhash, | ||
1567 | .obj_size = sizeof(struct l2tp_ip_sock), | ||
1568 | #ifdef CONFIG_COMPAT | ||
1569 | .compat_setsockopt = compat_ip_setsockopt, | ||
1570 | diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c | ||
1571 | index 28274f397c55..76ef758db112 100644 | ||
1572 | --- a/net/l2tp/l2tp_ip6.c | ||
1573 | +++ b/net/l2tp/l2tp_ip6.c | ||
1574 | @@ -24,8 +24,6 @@ | ||
1575 | #include <net/icmp.h> | ||
1576 | #include <net/udp.h> | ||
1577 | #include <net/inet_common.h> | ||
1578 | -#include <net/inet_hashtables.h> | ||
1579 | -#include <net/inet6_hashtables.h> | ||
1580 | #include <net/tcp_states.h> | ||
1581 | #include <net/protocol.h> | ||
1582 | #include <net/xfrm.h> | ||
1583 | @@ -221,15 +219,31 @@ discard: | ||
1584 | return 0; | ||
1585 | } | ||
1586 | |||
1587 | -static int l2tp_ip6_open(struct sock *sk) | ||
1588 | +static int l2tp_ip6_hash(struct sock *sk) | ||
1589 | { | ||
1590 | - /* Prevent autobind. We don't have ports. */ | ||
1591 | - inet_sk(sk)->inet_num = IPPROTO_L2TP; | ||
1592 | + if (sk_unhashed(sk)) { | ||
1593 | + write_lock_bh(&l2tp_ip6_lock); | ||
1594 | + sk_add_node(sk, &l2tp_ip6_table); | ||
1595 | + write_unlock_bh(&l2tp_ip6_lock); | ||
1596 | + } | ||
1597 | + return 0; | ||
1598 | +} | ||
1599 | |||
1600 | +static void l2tp_ip6_unhash(struct sock *sk) | ||
1601 | +{ | ||
1602 | + if (sk_unhashed(sk)) | ||
1603 | + return; | ||
1604 | write_lock_bh(&l2tp_ip6_lock); | ||
1605 | - sk_add_node(sk, &l2tp_ip6_table); | ||
1606 | + sk_del_node_init(sk); | ||
1607 | write_unlock_bh(&l2tp_ip6_lock); | ||
1608 | +} | ||
1609 | + | ||
1610 | +static int l2tp_ip6_open(struct sock *sk) | ||
1611 | +{ | ||
1612 | + /* Prevent autobind. We don't have ports. */ | ||
1613 | + inet_sk(sk)->inet_num = IPPROTO_L2TP; | ||
1614 | |||
1615 | + l2tp_ip6_hash(sk); | ||
1616 | return 0; | ||
1617 | } | ||
1618 | |||
1619 | @@ -732,8 +746,8 @@ static struct proto l2tp_ip6_prot = { | ||
1620 | .sendmsg = l2tp_ip6_sendmsg, | ||
1621 | .recvmsg = l2tp_ip6_recvmsg, | ||
1622 | .backlog_rcv = l2tp_ip6_backlog_recv, | ||
1623 | - .hash = inet6_hash, | ||
1624 | - .unhash = inet_unhash, | ||
1625 | + .hash = l2tp_ip6_hash, | ||
1626 | + .unhash = l2tp_ip6_unhash, | ||
1627 | .obj_size = sizeof(struct l2tp_ip6_sock), | ||
1628 | #ifdef CONFIG_COMPAT | ||
1629 | .compat_setsockopt = compat_ipv6_setsockopt, | ||
1630 | diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c | ||
1631 | index 18f377306884..d6473b8d9a81 100644 | ||
1632 | --- a/net/vmw_vsock/af_vsock.c | ||
1633 | +++ b/net/vmw_vsock/af_vsock.c | ||
1634 | @@ -1296,7 +1296,7 @@ static int vsock_accept(struct socket *sock, struct socket *newsock, int flags) | ||
1635 | /* Wait for children sockets to appear; these are the new sockets | ||
1636 | * created upon connection establishment. | ||
1637 | */ | ||
1638 | - timeout = sock_sndtimeo(listener, flags & O_NONBLOCK); | ||
1639 | + timeout = sock_rcvtimeo(listener, flags & O_NONBLOCK); | ||
1640 | prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE); | ||
1641 | |||
1642 | while ((connected = vsock_dequeue_accept(listener)) == NULL && |