Contents of /trunk/kernel-alx/patches-5.4/0194-5.4.95-all-fixes.patch
Parent Directory | Revision Log
Revision 3635 -
(show annotations)
(download)
Mon Oct 24 12:34:12 2022 UTC (23 months ago) by niro
File size: 59944 byte(s)
Mon Oct 24 12:34:12 2022 UTC (23 months ago) by niro
File size: 59944 byte(s)
-sync kernel patches
1 | diff --git a/Documentation/virt/kvm/api.txt b/Documentation/virt/kvm/api.txt |
2 | index a18e996fa54b0..7064efd3b5ea3 100644 |
3 | --- a/Documentation/virt/kvm/api.txt |
4 | +++ b/Documentation/virt/kvm/api.txt |
5 | @@ -1132,6 +1132,9 @@ field userspace_addr, which must point at user addressable memory for |
6 | the entire memory slot size. Any object may back this memory, including |
7 | anonymous memory, ordinary files, and hugetlbfs. |
8 | |
9 | +On architectures that support a form of address tagging, userspace_addr must |
10 | +be an untagged address. |
11 | + |
12 | It is recommended that the lower 21 bits of guest_phys_addr and userspace_addr |
13 | be identical. This allows large pages in the guest to be backed by large |
14 | pages in the host. |
15 | diff --git a/Makefile b/Makefile |
16 | index ad1b8dc6e462a..aa3c2e834442e 100644 |
17 | --- a/Makefile |
18 | +++ b/Makefile |
19 | @@ -1,7 +1,7 @@ |
20 | # SPDX-License-Identifier: GPL-2.0 |
21 | VERSION = 5 |
22 | PATCHLEVEL = 4 |
23 | -SUBLEVEL = 94 |
24 | +SUBLEVEL = 95 |
25 | EXTRAVERSION = |
26 | NAME = Kleptomaniac Octopus |
27 | |
28 | diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi |
29 | index 1a9a9d98f2848..14d6fec50dee2 100644 |
30 | --- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi |
31 | +++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi |
32 | @@ -273,7 +273,7 @@ |
33 | |
34 | /* VDD_AUD_1P8: Audio codec */ |
35 | reg_aud_1p8v: ldo3 { |
36 | - regulator-name = "vdd1p8"; |
37 | + regulator-name = "vdd1p8a"; |
38 | regulator-min-microvolt = <1800000>; |
39 | regulator-max-microvolt = <1800000>; |
40 | regulator-boot-on; |
41 | diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi |
42 | index 6acc8591219a7..eea317b41020d 100644 |
43 | --- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi |
44 | +++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi |
45 | @@ -167,7 +167,7 @@ |
46 | i2c-gpio,delay-us = <2>; /* ~100 kHz */ |
47 | #address-cells = <1>; |
48 | #size-cells = <0>; |
49 | - status = "disabld"; |
50 | + status = "disabled"; |
51 | }; |
52 | |
53 | i2c_cam: i2c-gpio-cam { |
54 | @@ -179,7 +179,7 @@ |
55 | i2c-gpio,delay-us = <2>; /* ~100 kHz */ |
56 | #address-cells = <1>; |
57 | #size-cells = <0>; |
58 | - status = "disabld"; |
59 | + status = "disabled"; |
60 | }; |
61 | }; |
62 | |
63 | diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S |
64 | index 1eabf2d2834be..e06f946b75b96 100644 |
65 | --- a/arch/arm/mach-imx/suspend-imx6.S |
66 | +++ b/arch/arm/mach-imx/suspend-imx6.S |
67 | @@ -67,6 +67,7 @@ |
68 | #define MX6Q_CCM_CCR 0x0 |
69 | |
70 | .align 3 |
71 | + .arm |
72 | |
73 | .macro sync_l2_cache |
74 | |
75 | diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi |
76 | index aef8f2b00778d..5401a646c8406 100644 |
77 | --- a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi |
78 | +++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi |
79 | @@ -4,11 +4,16 @@ |
80 | */ |
81 | usb { |
82 | compatible = "simple-bus"; |
83 | - dma-ranges; |
84 | #address-cells = <2>; |
85 | #size-cells = <2>; |
86 | ranges = <0x0 0x0 0x0 0x68500000 0x0 0x00400000>; |
87 | |
88 | + /* |
89 | + * Internally, USB bus to the interconnect can only address up |
90 | + * to 40-bit |
91 | + */ |
92 | + dma-ranges = <0 0 0 0 0x100 0x0>; |
93 | + |
94 | usbphy0: usb-phy@0 { |
95 | compatible = "brcm,sr-usb-combo-phy"; |
96 | reg = <0x0 0x00000000 0x0 0x100>; |
97 | diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi |
98 | index 795d6ca4bbd1f..bd99fa68b7630 100644 |
99 | --- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi |
100 | +++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi |
101 | @@ -103,7 +103,7 @@ |
102 | reboot { |
103 | compatible ="syscon-reboot"; |
104 | regmap = <&rst>; |
105 | - offset = <0xb0>; |
106 | + offset = <0>; |
107 | mask = <0x02>; |
108 | }; |
109 | |
110 | diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c |
111 | index 08e1e7544f823..e32e8bcf94553 100644 |
112 | --- a/arch/x86/kvm/vmx/nested.c |
113 | +++ b/arch/x86/kvm/vmx/nested.c |
114 | @@ -5579,11 +5579,14 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu, |
115 | if (is_guest_mode(vcpu)) { |
116 | sync_vmcs02_to_vmcs12(vcpu, vmcs12); |
117 | sync_vmcs02_to_vmcs12_rare(vcpu, vmcs12); |
118 | - } else if (!vmx->nested.need_vmcs12_to_shadow_sync) { |
119 | - if (vmx->nested.hv_evmcs) |
120 | - copy_enlightened_to_vmcs12(vmx); |
121 | - else if (enable_shadow_vmcs) |
122 | - copy_shadow_to_vmcs12(vmx); |
123 | + } else { |
124 | + copy_vmcs02_to_vmcs12_rare(vcpu, get_vmcs12(vcpu)); |
125 | + if (!vmx->nested.need_vmcs12_to_shadow_sync) { |
126 | + if (vmx->nested.hv_evmcs) |
127 | + copy_enlightened_to_vmcs12(vmx); |
128 | + else if (enable_shadow_vmcs) |
129 | + copy_shadow_to_vmcs12(vmx); |
130 | + } |
131 | } |
132 | |
133 | BUILD_BUG_ON(sizeof(user_vmx_nested_state->vmcs12) < VMCS12_SIZE); |
134 | diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c |
135 | index f8998a7bc7d56..181e352d38de4 100644 |
136 | --- a/arch/x86/kvm/vmx/pmu_intel.c |
137 | +++ b/arch/x86/kvm/vmx/pmu_intel.c |
138 | @@ -26,7 +26,7 @@ static struct kvm_event_hw_type_mapping intel_arch_events[] = { |
139 | [4] = { 0x2e, 0x41, PERF_COUNT_HW_CACHE_MISSES }, |
140 | [5] = { 0xc4, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS }, |
141 | [6] = { 0xc5, 0x00, PERF_COUNT_HW_BRANCH_MISSES }, |
142 | - [7] = { 0x00, 0x30, PERF_COUNT_HW_REF_CPU_CYCLES }, |
143 | + [7] = { 0x00, 0x03, PERF_COUNT_HW_REF_CPU_CYCLES }, |
144 | }; |
145 | |
146 | /* mapping between fixed pmc index and intel_arch_events array */ |
147 | @@ -296,7 +296,9 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu) |
148 | |
149 | pmu->nr_arch_gp_counters = min_t(int, eax.split.num_counters, |
150 | x86_pmu.num_counters_gp); |
151 | + eax.split.bit_width = min_t(int, eax.split.bit_width, x86_pmu.bit_width_gp); |
152 | pmu->counter_bitmask[KVM_PMC_GP] = ((u64)1 << eax.split.bit_width) - 1; |
153 | + eax.split.mask_length = min_t(int, eax.split.mask_length, x86_pmu.events_mask_len); |
154 | pmu->available_event_types = ~entry->ebx & |
155 | ((1ull << eax.split.mask_length) - 1); |
156 | |
157 | @@ -306,6 +308,8 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu) |
158 | pmu->nr_arch_fixed_counters = |
159 | min_t(int, edx.split.num_counters_fixed, |
160 | x86_pmu.num_counters_fixed); |
161 | + edx.split.bit_width_fixed = min_t(int, |
162 | + edx.split.bit_width_fixed, x86_pmu.bit_width_fixed); |
163 | pmu->counter_bitmask[KVM_PMC_FIXED] = |
164 | ((u64)1 << edx.split.bit_width_fixed) - 1; |
165 | } |
166 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c |
167 | index 72990c3c6faf7..73095d7213993 100644 |
168 | --- a/arch/x86/kvm/x86.c |
169 | +++ b/arch/x86/kvm/x86.c |
170 | @@ -102,6 +102,7 @@ static u64 __read_mostly cr4_reserved_bits = CR4_RESERVED_BITS; |
171 | |
172 | static void update_cr8_intercept(struct kvm_vcpu *vcpu); |
173 | static void process_nmi(struct kvm_vcpu *vcpu); |
174 | +static void process_smi(struct kvm_vcpu *vcpu); |
175 | static void enter_smm(struct kvm_vcpu *vcpu); |
176 | static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags); |
177 | static void store_regs(struct kvm_vcpu *vcpu); |
178 | @@ -3772,6 +3773,10 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu, |
179 | { |
180 | process_nmi(vcpu); |
181 | |
182 | + |
183 | + if (kvm_check_request(KVM_REQ_SMI, vcpu)) |
184 | + process_smi(vcpu); |
185 | + |
186 | /* |
187 | * The API doesn't provide the instruction length for software |
188 | * exceptions, so don't report them. As long as the guest RIP |
189 | diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c |
190 | index 96869f1538b93..bfca116482b8b 100644 |
191 | --- a/drivers/acpi/device_sysfs.c |
192 | +++ b/drivers/acpi/device_sysfs.c |
193 | @@ -251,20 +251,12 @@ int __acpi_device_uevent_modalias(struct acpi_device *adev, |
194 | if (add_uevent_var(env, "MODALIAS=")) |
195 | return -ENOMEM; |
196 | |
197 | - len = create_pnp_modalias(adev, &env->buf[env->buflen - 1], |
198 | - sizeof(env->buf) - env->buflen); |
199 | - if (len < 0) |
200 | - return len; |
201 | - |
202 | - env->buflen += len; |
203 | - if (!adev->data.of_compatible) |
204 | - return 0; |
205 | - |
206 | - if (len > 0 && add_uevent_var(env, "MODALIAS=")) |
207 | - return -ENOMEM; |
208 | - |
209 | - len = create_of_modalias(adev, &env->buf[env->buflen - 1], |
210 | - sizeof(env->buf) - env->buflen); |
211 | + if (adev->data.of_compatible) |
212 | + len = create_of_modalias(adev, &env->buf[env->buflen - 1], |
213 | + sizeof(env->buf) - env->buflen); |
214 | + else |
215 | + len = create_pnp_modalias(adev, &env->buf[env->buflen - 1], |
216 | + sizeof(env->buf) - env->buflen); |
217 | if (len < 0) |
218 | return len; |
219 | |
220 | diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c |
221 | index a3037fe54c3ab..f068bb5d650eb 100644 |
222 | --- a/drivers/block/nbd.c |
223 | +++ b/drivers/block/nbd.c |
224 | @@ -1014,6 +1014,12 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, |
225 | if (!sock) |
226 | return err; |
227 | |
228 | + /* |
229 | + * We need to make sure we don't get any errant requests while we're |
230 | + * reallocating the ->socks array. |
231 | + */ |
232 | + blk_mq_freeze_queue(nbd->disk->queue); |
233 | + |
234 | if (!netlink && !nbd->task_setup && |
235 | !test_bit(NBD_RT_BOUND, &config->runtime_flags)) |
236 | nbd->task_setup = current; |
237 | @@ -1052,10 +1058,12 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, |
238 | nsock->cookie = 0; |
239 | socks[config->num_connections++] = nsock; |
240 | atomic_inc(&config->live_connections); |
241 | + blk_mq_unfreeze_queue(nbd->disk->queue); |
242 | |
243 | return 0; |
244 | |
245 | put_socket: |
246 | + blk_mq_unfreeze_queue(nbd->disk->queue); |
247 | sockfd_put(sock); |
248 | return err; |
249 | } |
250 | diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c |
251 | index ab5482202cfb3..def41e1bd7364 100644 |
252 | --- a/drivers/block/xen-blkfront.c |
253 | +++ b/drivers/block/xen-blkfront.c |
254 | @@ -936,7 +936,8 @@ static void blkif_set_queue_limits(struct blkfront_info *info) |
255 | if (info->feature_discard) { |
256 | blk_queue_flag_set(QUEUE_FLAG_DISCARD, rq); |
257 | blk_queue_max_discard_sectors(rq, get_capacity(gd)); |
258 | - rq->limits.discard_granularity = info->discard_granularity; |
259 | + rq->limits.discard_granularity = info->discard_granularity ?: |
260 | + info->physical_sector_size; |
261 | rq->limits.discard_alignment = info->discard_alignment; |
262 | if (info->feature_secdiscard) |
263 | blk_queue_flag_set(QUEUE_FLAG_SECERASE, rq); |
264 | @@ -2169,19 +2170,12 @@ static void blkfront_closing(struct blkfront_info *info) |
265 | |
266 | static void blkfront_setup_discard(struct blkfront_info *info) |
267 | { |
268 | - int err; |
269 | - unsigned int discard_granularity; |
270 | - unsigned int discard_alignment; |
271 | - |
272 | info->feature_discard = 1; |
273 | - err = xenbus_gather(XBT_NIL, info->xbdev->otherend, |
274 | - "discard-granularity", "%u", &discard_granularity, |
275 | - "discard-alignment", "%u", &discard_alignment, |
276 | - NULL); |
277 | - if (!err) { |
278 | - info->discard_granularity = discard_granularity; |
279 | - info->discard_alignment = discard_alignment; |
280 | - } |
281 | + info->discard_granularity = xenbus_read_unsigned(info->xbdev->otherend, |
282 | + "discard-granularity", |
283 | + 0); |
284 | + info->discard_alignment = xenbus_read_unsigned(info->xbdev->otherend, |
285 | + "discard-alignment", 0); |
286 | info->feature_secdiscard = |
287 | !!xenbus_read_unsigned(info->xbdev->otherend, "discard-secure", |
288 | 0); |
289 | diff --git a/drivers/firmware/imx/Kconfig b/drivers/firmware/imx/Kconfig |
290 | index 0dbee32da4c6d..5d995fe64b5ca 100644 |
291 | --- a/drivers/firmware/imx/Kconfig |
292 | +++ b/drivers/firmware/imx/Kconfig |
293 | @@ -13,6 +13,7 @@ config IMX_DSP |
294 | config IMX_SCU |
295 | bool "IMX SCU Protocol driver" |
296 | depends on IMX_MBOX |
297 | + select SOC_BUS |
298 | help |
299 | The System Controller Firmware (SCFW) is a low-level system function |
300 | which runs on a dedicated Cortex-M core to provide power, clock, and |
301 | diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h |
302 | index 126a0eb6e0542..00335a1c02b0e 100644 |
303 | --- a/drivers/gpu/drm/i915/i915_drv.h |
304 | +++ b/drivers/gpu/drm/i915/i915_drv.h |
305 | @@ -1894,7 +1894,7 @@ intel_subplatform(const struct intel_runtime_info *info, enum intel_platform p) |
306 | { |
307 | const unsigned int pi = __platform_mask_index(info, p); |
308 | |
309 | - return info->platform_mask[pi] & INTEL_SUBPLATFORM_BITS; |
310 | + return info->platform_mask[pi] & ((1 << INTEL_SUBPLATFORM_BITS) - 1); |
311 | } |
312 | |
313 | static __always_inline bool |
314 | diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c |
315 | index 0be4668c780bf..8556804e96efd 100644 |
316 | --- a/drivers/gpu/drm/nouveau/nouveau_svm.c |
317 | +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c |
318 | @@ -306,6 +306,10 @@ nouveau_svmm_init(struct drm_device *dev, void *data, |
319 | struct drm_nouveau_svm_init *args = data; |
320 | int ret; |
321 | |
322 | + /* We need to fail if svm is disabled */ |
323 | + if (!cli->drm->svm) |
324 | + return -ENOSYS; |
325 | + |
326 | /* Allocate tracking for SVM-enabled VMM. */ |
327 | if (!(svmm = kzalloc(sizeof(*svmm), GFP_KERNEL))) |
328 | return -ENOMEM; |
329 | diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c |
330 | index 89ac2f9ae6dd8..e7472f0da59d2 100644 |
331 | --- a/drivers/infiniband/hw/cxgb4/qp.c |
332 | +++ b/drivers/infiniband/hw/cxgb4/qp.c |
333 | @@ -2471,7 +2471,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, |
334 | init_attr->cap.max_send_wr = qhp->attr.sq_num_entries; |
335 | init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries; |
336 | init_attr->cap.max_send_sge = qhp->attr.sq_max_sges; |
337 | - init_attr->cap.max_recv_sge = qhp->attr.sq_max_sges; |
338 | + init_attr->cap.max_recv_sge = qhp->attr.rq_max_sges; |
339 | init_attr->cap.max_inline_data = T4_MAX_SEND_INLINE; |
340 | init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0; |
341 | return 0; |
342 | diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c |
343 | index 30ac0ba55864e..1b9795743276d 100644 |
344 | --- a/drivers/iommu/dmar.c |
345 | +++ b/drivers/iommu/dmar.c |
346 | @@ -1020,8 +1020,8 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd) |
347 | { |
348 | struct intel_iommu *iommu; |
349 | u32 ver, sts; |
350 | - int agaw = 0; |
351 | - int msagaw = 0; |
352 | + int agaw = -1; |
353 | + int msagaw = -1; |
354 | int err; |
355 | |
356 | if (!drhd->reg_base_addr) { |
357 | @@ -1046,17 +1046,28 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd) |
358 | } |
359 | |
360 | err = -EINVAL; |
361 | - agaw = iommu_calculate_agaw(iommu); |
362 | - if (agaw < 0) { |
363 | - pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n", |
364 | - iommu->seq_id); |
365 | - goto err_unmap; |
366 | + if (cap_sagaw(iommu->cap) == 0) { |
367 | + pr_info("%s: No supported address widths. Not attempting DMA translation.\n", |
368 | + iommu->name); |
369 | + drhd->ignored = 1; |
370 | } |
371 | - msagaw = iommu_calculate_max_sagaw(iommu); |
372 | - if (msagaw < 0) { |
373 | - pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n", |
374 | - iommu->seq_id); |
375 | - goto err_unmap; |
376 | + |
377 | + if (!drhd->ignored) { |
378 | + agaw = iommu_calculate_agaw(iommu); |
379 | + if (agaw < 0) { |
380 | + pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n", |
381 | + iommu->seq_id); |
382 | + drhd->ignored = 1; |
383 | + } |
384 | + } |
385 | + if (!drhd->ignored) { |
386 | + msagaw = iommu_calculate_max_sagaw(iommu); |
387 | + if (msagaw < 0) { |
388 | + pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n", |
389 | + iommu->seq_id); |
390 | + drhd->ignored = 1; |
391 | + agaw = -1; |
392 | + } |
393 | } |
394 | iommu->agaw = agaw; |
395 | iommu->msagaw = msagaw; |
396 | @@ -1083,7 +1094,12 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd) |
397 | |
398 | raw_spin_lock_init(&iommu->register_lock); |
399 | |
400 | - if (intel_iommu_enabled) { |
401 | + /* |
402 | + * This is only for hotplug; at boot time intel_iommu_enabled won't |
403 | + * be set yet. When intel_iommu_init() runs, it registers the units |
404 | + * present at boot time, then sets intel_iommu_enabled. |
405 | + */ |
406 | + if (intel_iommu_enabled && !drhd->ignored) { |
407 | err = iommu_device_sysfs_add(&iommu->iommu, NULL, |
408 | intel_iommu_groups, |
409 | "%s", iommu->name); |
410 | @@ -1098,6 +1114,7 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd) |
411 | } |
412 | |
413 | drhd->iommu = iommu; |
414 | + iommu->drhd = drhd; |
415 | |
416 | return 0; |
417 | |
418 | @@ -1112,7 +1129,7 @@ error: |
419 | |
420 | static void free_iommu(struct intel_iommu *iommu) |
421 | { |
422 | - if (intel_iommu_enabled) { |
423 | + if (intel_iommu_enabled && !iommu->drhd->ignored) { |
424 | iommu_device_unregister(&iommu->iommu); |
425 | iommu_device_sysfs_remove(&iommu->iommu); |
426 | } |
427 | diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c |
428 | index 23963e5cb5d6a..0d59763e40de1 100644 |
429 | --- a/drivers/leds/led-triggers.c |
430 | +++ b/drivers/leds/led-triggers.c |
431 | @@ -318,14 +318,15 @@ void led_trigger_event(struct led_trigger *trig, |
432 | enum led_brightness brightness) |
433 | { |
434 | struct led_classdev *led_cdev; |
435 | + unsigned long flags; |
436 | |
437 | if (!trig) |
438 | return; |
439 | |
440 | - read_lock(&trig->leddev_list_lock); |
441 | + read_lock_irqsave(&trig->leddev_list_lock, flags); |
442 | list_for_each_entry(led_cdev, &trig->led_cdevs, trig_list) |
443 | led_set_brightness(led_cdev, brightness); |
444 | - read_unlock(&trig->leddev_list_lock); |
445 | + read_unlock_irqrestore(&trig->leddev_list_lock, flags); |
446 | } |
447 | EXPORT_SYMBOL_GPL(led_trigger_event); |
448 | |
449 | @@ -336,11 +337,12 @@ static void led_trigger_blink_setup(struct led_trigger *trig, |
450 | int invert) |
451 | { |
452 | struct led_classdev *led_cdev; |
453 | + unsigned long flags; |
454 | |
455 | if (!trig) |
456 | return; |
457 | |
458 | - read_lock(&trig->leddev_list_lock); |
459 | + read_lock_irqsave(&trig->leddev_list_lock, flags); |
460 | list_for_each_entry(led_cdev, &trig->led_cdevs, trig_list) { |
461 | if (oneshot) |
462 | led_blink_set_oneshot(led_cdev, delay_on, delay_off, |
463 | @@ -348,7 +350,7 @@ static void led_trigger_blink_setup(struct led_trigger *trig, |
464 | else |
465 | led_blink_set(led_cdev, delay_on, delay_off); |
466 | } |
467 | - read_unlock(&trig->leddev_list_lock); |
468 | + read_unlock_irqrestore(&trig->leddev_list_lock, flags); |
469 | } |
470 | |
471 | void led_trigger_blink(struct led_trigger *trig, |
472 | diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c |
473 | index e84f9dccf448a..c4d7e06974d2c 100644 |
474 | --- a/drivers/media/rc/rc-main.c |
475 | +++ b/drivers/media/rc/rc-main.c |
476 | @@ -1892,6 +1892,8 @@ int rc_register_device(struct rc_dev *dev) |
477 | goto out_raw; |
478 | } |
479 | |
480 | + dev->registered = true; |
481 | + |
482 | rc = device_add(&dev->dev); |
483 | if (rc) |
484 | goto out_rx_free; |
485 | @@ -1901,8 +1903,6 @@ int rc_register_device(struct rc_dev *dev) |
486 | dev->device_name ?: "Unspecified device", path ?: "N/A"); |
487 | kfree(path); |
488 | |
489 | - dev->registered = true; |
490 | - |
491 | /* |
492 | * once the the input device is registered in rc_setup_rx_device, |
493 | * userspace can open the input device and rc_open() will be called |
494 | diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c |
495 | index 247aeacb3a440..2ae9feb99a07d 100644 |
496 | --- a/drivers/net/can/dev.c |
497 | +++ b/drivers/net/can/dev.c |
498 | @@ -1134,7 +1134,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev) |
499 | { |
500 | struct can_priv *priv = netdev_priv(dev); |
501 | struct can_ctrlmode cm = {.flags = priv->ctrlmode}; |
502 | - struct can_berr_counter bec; |
503 | + struct can_berr_counter bec = { }; |
504 | enum can_state state = priv->state; |
505 | |
506 | if (priv->do_get_state) |
507 | diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c |
508 | index c952212900fcf..c20dc689698ed 100644 |
509 | --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c |
510 | +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c |
511 | @@ -3980,20 +3980,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac) |
512 | goto error_param; |
513 | |
514 | vf = &pf->vf[vf_id]; |
515 | - vsi = pf->vsi[vf->lan_vsi_idx]; |
516 | |
517 | /* When the VF is resetting wait until it is done. |
518 | * It can take up to 200 milliseconds, |
519 | * but wait for up to 300 milliseconds to be safe. |
520 | - * If the VF is indeed in reset, the vsi pointer has |
521 | - * to show on the newly loaded vsi under pf->vsi[id]. |
522 | + * Acquire the VSI pointer only after the VF has been |
523 | + * properly initialized. |
524 | */ |
525 | for (i = 0; i < 15; i++) { |
526 | - if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) { |
527 | - if (i > 0) |
528 | - vsi = pf->vsi[vf->lan_vsi_idx]; |
529 | + if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) |
530 | break; |
531 | - } |
532 | msleep(20); |
533 | } |
534 | if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) { |
535 | @@ -4002,6 +3998,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac) |
536 | ret = -EAGAIN; |
537 | goto error_param; |
538 | } |
539 | + vsi = pf->vsi[vf->lan_vsi_idx]; |
540 | |
541 | if (is_multicast_ether_addr(mac)) { |
542 | dev_err(&pf->pdev->dev, |
543 | diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c |
544 | index ac98f1d968921..0303eeb760505 100644 |
545 | --- a/drivers/net/ethernet/intel/igc/igc_ethtool.c |
546 | +++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c |
547 | @@ -1670,12 +1670,18 @@ static int igc_get_link_ksettings(struct net_device *netdev, |
548 | cmd->base.phy_address = hw->phy.addr; |
549 | |
550 | /* advertising link modes */ |
551 | - ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); |
552 | - ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); |
553 | - ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); |
554 | - ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); |
555 | - ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); |
556 | - ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full); |
557 | + if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF) |
558 | + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); |
559 | + if (hw->phy.autoneg_advertised & ADVERTISE_10_FULL) |
560 | + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); |
561 | + if (hw->phy.autoneg_advertised & ADVERTISE_100_HALF) |
562 | + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); |
563 | + if (hw->phy.autoneg_advertised & ADVERTISE_100_FULL) |
564 | + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); |
565 | + if (hw->phy.autoneg_advertised & ADVERTISE_1000_FULL) |
566 | + ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); |
567 | + if (hw->phy.autoneg_advertised & ADVERTISE_2500_FULL) |
568 | + ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full); |
569 | |
570 | /* set autoneg settings */ |
571 | if (hw->mac.autoneg == 1) { |
572 | @@ -1786,6 +1792,12 @@ static int igc_set_link_ksettings(struct net_device *netdev, |
573 | |
574 | ethtool_convert_link_mode_to_legacy_u32(&advertising, |
575 | cmd->link_modes.advertising); |
576 | + /* Converting to legacy u32 drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT. |
577 | + * We have to check this and convert it to ADVERTISE_2500_FULL |
578 | + * (aka ETHTOOL_LINK_MODE_2500baseX_Full_BIT) explicitly. |
579 | + */ |
580 | + if (ethtool_link_ksettings_test_link_mode(cmd, advertising, 2500baseT_Full)) |
581 | + advertising |= ADVERTISE_2500_FULL; |
582 | |
583 | if (cmd->base.autoneg == AUTONEG_ENABLE) { |
584 | hw->mac.autoneg = 1; |
585 | diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c |
586 | index ec117e4414250..6495c26d95969 100644 |
587 | --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c |
588 | +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c |
589 | @@ -57,6 +57,7 @@ |
590 | #include "lib/devcom.h" |
591 | #include "lib/geneve.h" |
592 | #include "diag/en_tc_tracepoint.h" |
593 | +#include <asm/div64.h> |
594 | |
595 | struct mlx5_nic_flow_attr { |
596 | u32 action; |
597 | @@ -1837,8 +1838,8 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, |
598 | BIT(FLOW_DISSECTOR_KEY_ENC_IP) | |
599 | BIT(FLOW_DISSECTOR_KEY_ENC_OPTS))) { |
600 | NL_SET_ERR_MSG_MOD(extack, "Unsupported key"); |
601 | - netdev_warn(priv->netdev, "Unsupported key used: 0x%x\n", |
602 | - dissector->used_keys); |
603 | + netdev_dbg(priv->netdev, "Unsupported key used: 0x%x\n", |
604 | + dissector->used_keys); |
605 | return -EOPNOTSUPP; |
606 | } |
607 | |
608 | @@ -3943,13 +3944,13 @@ errout: |
609 | return err; |
610 | } |
611 | |
612 | -static int apply_police_params(struct mlx5e_priv *priv, u32 rate, |
613 | +static int apply_police_params(struct mlx5e_priv *priv, u64 rate, |
614 | struct netlink_ext_ack *extack) |
615 | { |
616 | struct mlx5e_rep_priv *rpriv = priv->ppriv; |
617 | struct mlx5_eswitch *esw; |
618 | + u32 rate_mbps = 0; |
619 | u16 vport_num; |
620 | - u32 rate_mbps; |
621 | int err; |
622 | |
623 | vport_num = rpriv->rep->vport; |
624 | @@ -3966,7 +3967,11 @@ static int apply_police_params(struct mlx5e_priv *priv, u32 rate, |
625 | * Moreover, if rate is non zero we choose to configure to a minimum of |
626 | * 1 mbit/sec. |
627 | */ |
628 | - rate_mbps = rate ? max_t(u32, (rate * 8 + 500000) / 1000000, 1) : 0; |
629 | + if (rate) { |
630 | + rate = (rate * BITS_PER_BYTE) + 500000; |
631 | + rate_mbps = max_t(u32, do_div(rate, 1000000), 1); |
632 | + } |
633 | + |
634 | err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps); |
635 | if (err) |
636 | NL_SET_ERR_MSG_MOD(extack, "failed applying action to hardware"); |
637 | diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c |
638 | index 2eceb72f0f647..4944c40436f08 100644 |
639 | --- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c |
640 | +++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c |
641 | @@ -1068,6 +1068,7 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa |
642 | destroy_ft: |
643 | root->cmds->destroy_flow_table(root, ft); |
644 | free_ft: |
645 | + rhltable_destroy(&ft->fgs_hash); |
646 | kfree(ft); |
647 | unlock_root: |
648 | mutex_unlock(&root->chain_lock); |
649 | diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c |
650 | index 606fee99221b8..0eb894b7c0bda 100644 |
651 | --- a/drivers/net/team/team.c |
652 | +++ b/drivers/net/team/team.c |
653 | @@ -991,7 +991,8 @@ static void __team_compute_features(struct team *team) |
654 | unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE | |
655 | IFF_XMIT_DST_RELEASE_PERM; |
656 | |
657 | - list_for_each_entry(port, &team->port_list, list) { |
658 | + rcu_read_lock(); |
659 | + list_for_each_entry_rcu(port, &team->port_list, list) { |
660 | vlan_features = netdev_increment_features(vlan_features, |
661 | port->dev->vlan_features, |
662 | TEAM_VLAN_FEATURES); |
663 | @@ -1005,6 +1006,7 @@ static void __team_compute_features(struct team *team) |
664 | if (port->dev->hard_header_len > max_hard_header_len) |
665 | max_hard_header_len = port->dev->hard_header_len; |
666 | } |
667 | + rcu_read_unlock(); |
668 | |
669 | team->dev->vlan_features = vlan_features; |
670 | team->dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL | |
671 | @@ -1020,9 +1022,7 @@ static void __team_compute_features(struct team *team) |
672 | |
673 | static void team_compute_features(struct team *team) |
674 | { |
675 | - mutex_lock(&team->lock); |
676 | __team_compute_features(team); |
677 | - mutex_unlock(&team->lock); |
678 | netdev_change_features(team->dev); |
679 | } |
680 | |
681 | diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c |
682 | index b0d748a614a9e..72a3a5dc51319 100644 |
683 | --- a/drivers/net/usb/qmi_wwan.c |
684 | +++ b/drivers/net/usb/qmi_wwan.c |
685 | @@ -1347,6 +1347,7 @@ static const struct usb_device_id products[] = { |
686 | {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */ |
687 | {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ |
688 | {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ |
689 | + {QMI_QUIRK_SET_DTR(0x1e2d, 0x006f, 8)}, /* Cinterion PLS83/PLS63 */ |
690 | {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ |
691 | {QMI_FIXED_INTF(0x1e2d, 0x0063, 10)}, /* Cinterion ALASxx (1 RmNet) */ |
692 | {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */ |
693 | diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
694 | index ef5a8ecabc60a..0581f082301e0 100644 |
695 | --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
696 | +++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
697 | @@ -2183,7 +2183,8 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr, |
698 | |
699 | while (offs < dwords) { |
700 | /* limit the time we spin here under lock to 1/2s */ |
701 | - ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC); |
702 | + unsigned long end = jiffies + HZ / 2; |
703 | + bool resched = false; |
704 | |
705 | if (iwl_trans_grab_nic_access(trans, &flags)) { |
706 | iwl_write32(trans, HBUS_TARG_MEM_RADDR, |
707 | @@ -2194,14 +2195,15 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr, |
708 | HBUS_TARG_MEM_RDAT); |
709 | offs++; |
710 | |
711 | - /* calling ktime_get is expensive so |
712 | - * do it once in 128 reads |
713 | - */ |
714 | - if (offs % 128 == 0 && ktime_after(ktime_get(), |
715 | - timeout)) |
716 | + if (time_after(jiffies, end)) { |
717 | + resched = true; |
718 | break; |
719 | + } |
720 | } |
721 | iwl_trans_release_nic_access(trans, &flags); |
722 | + |
723 | + if (resched) |
724 | + cond_resched(); |
725 | } else { |
726 | return -EBUSY; |
727 | } |
728 | diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c |
729 | index f6a0454abe044..6f2172be7b66a 100644 |
730 | --- a/drivers/net/wireless/mediatek/mt7601u/dma.c |
731 | +++ b/drivers/net/wireless/mediatek/mt7601u/dma.c |
732 | @@ -152,8 +152,7 @@ mt7601u_rx_process_entry(struct mt7601u_dev *dev, struct mt7601u_dma_buf_rx *e) |
733 | |
734 | if (new_p) { |
735 | /* we have one extra ref from the allocator */ |
736 | - __free_pages(e->p, MT_RX_ORDER); |
737 | - |
738 | + put_page(e->p); |
739 | e->p = new_p; |
740 | } |
741 | } |
742 | @@ -310,7 +309,6 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev, |
743 | } |
744 | |
745 | e = &q->e[q->end]; |
746 | - e->skb = skb; |
747 | usb_fill_bulk_urb(e->urb, usb_dev, snd_pipe, skb->data, skb->len, |
748 | mt7601u_complete_tx, q); |
749 | ret = usb_submit_urb(e->urb, GFP_ATOMIC); |
750 | @@ -328,6 +326,7 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev, |
751 | |
752 | q->end = (q->end + 1) % q->entries; |
753 | q->used++; |
754 | + e->skb = skb; |
755 | |
756 | if (q->used >= q->entries) |
757 | ieee80211_stop_queue(dev->hw, skb_get_queue_mapping(skb)); |
758 | diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c |
759 | index 3968f89f7855a..0ac0bd4c65c4c 100644 |
760 | --- a/drivers/nvme/host/multipath.c |
761 | +++ b/drivers/nvme/host/multipath.c |
762 | @@ -233,7 +233,7 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head, |
763 | } |
764 | |
765 | for (ns = nvme_next_ns(head, old); |
766 | - ns != old; |
767 | + ns && ns != old; |
768 | ns = nvme_next_ns(head, ns)) { |
769 | if (nvme_path_is_disabled(ns)) |
770 | continue; |
771 | diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c |
772 | index be2520cc010be..7dc72cb718b0e 100644 |
773 | --- a/drivers/s390/crypto/vfio_ap_drv.c |
774 | +++ b/drivers/s390/crypto/vfio_ap_drv.c |
775 | @@ -71,15 +71,11 @@ static int vfio_ap_queue_dev_probe(struct ap_device *apdev) |
776 | static void vfio_ap_queue_dev_remove(struct ap_device *apdev) |
777 | { |
778 | struct vfio_ap_queue *q; |
779 | - int apid, apqi; |
780 | |
781 | mutex_lock(&matrix_dev->lock); |
782 | q = dev_get_drvdata(&apdev->device); |
783 | + vfio_ap_mdev_reset_queue(q, 1); |
784 | dev_set_drvdata(&apdev->device, NULL); |
785 | - apid = AP_QID_CARD(q->apqn); |
786 | - apqi = AP_QID_QUEUE(q->apqn); |
787 | - vfio_ap_mdev_reset_queue(apid, apqi, 1); |
788 | - vfio_ap_irq_disable(q); |
789 | kfree(q); |
790 | mutex_unlock(&matrix_dev->lock); |
791 | } |
792 | diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c |
793 | index 5c0f53c6dde75..790b0b2b36272 100644 |
794 | --- a/drivers/s390/crypto/vfio_ap_ops.c |
795 | +++ b/drivers/s390/crypto/vfio_ap_ops.c |
796 | @@ -25,6 +25,7 @@ |
797 | #define VFIO_AP_MDEV_NAME_HWVIRT "VFIO AP Passthrough Device" |
798 | |
799 | static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev); |
800 | +static struct vfio_ap_queue *vfio_ap_find_queue(int apqn); |
801 | |
802 | static int match_apqn(struct device *dev, const void *data) |
803 | { |
804 | @@ -49,20 +50,15 @@ static struct vfio_ap_queue *vfio_ap_get_queue( |
805 | int apqn) |
806 | { |
807 | struct vfio_ap_queue *q; |
808 | - struct device *dev; |
809 | |
810 | if (!test_bit_inv(AP_QID_CARD(apqn), matrix_mdev->matrix.apm)) |
811 | return NULL; |
812 | if (!test_bit_inv(AP_QID_QUEUE(apqn), matrix_mdev->matrix.aqm)) |
813 | return NULL; |
814 | |
815 | - dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL, |
816 | - &apqn, match_apqn); |
817 | - if (!dev) |
818 | - return NULL; |
819 | - q = dev_get_drvdata(dev); |
820 | - q->matrix_mdev = matrix_mdev; |
821 | - put_device(dev); |
822 | + q = vfio_ap_find_queue(apqn); |
823 | + if (q) |
824 | + q->matrix_mdev = matrix_mdev; |
825 | |
826 | return q; |
827 | } |
828 | @@ -119,13 +115,18 @@ static void vfio_ap_wait_for_irqclear(int apqn) |
829 | */ |
830 | static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q) |
831 | { |
832 | - if (q->saved_isc != VFIO_AP_ISC_INVALID && q->matrix_mdev) |
833 | + if (!q) |
834 | + return; |
835 | + if (q->saved_isc != VFIO_AP_ISC_INVALID && |
836 | + !WARN_ON(!(q->matrix_mdev && q->matrix_mdev->kvm))) { |
837 | kvm_s390_gisc_unregister(q->matrix_mdev->kvm, q->saved_isc); |
838 | - if (q->saved_pfn && q->matrix_mdev) |
839 | + q->saved_isc = VFIO_AP_ISC_INVALID; |
840 | + } |
841 | + if (q->saved_pfn && !WARN_ON(!q->matrix_mdev)) { |
842 | vfio_unpin_pages(mdev_dev(q->matrix_mdev->mdev), |
843 | &q->saved_pfn, 1); |
844 | - q->saved_pfn = 0; |
845 | - q->saved_isc = VFIO_AP_ISC_INVALID; |
846 | + q->saved_pfn = 0; |
847 | + } |
848 | } |
849 | |
850 | /** |
851 | @@ -144,7 +145,7 @@ static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q) |
852 | * Returns if ap_aqic function failed with invalid, deconfigured or |
853 | * checkstopped AP. |
854 | */ |
855 | -struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q) |
856 | +static struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q) |
857 | { |
858 | struct ap_qirq_ctrl aqic_gisa = {}; |
859 | struct ap_queue_status status; |
860 | @@ -1114,48 +1115,70 @@ static int vfio_ap_mdev_group_notifier(struct notifier_block *nb, |
861 | return NOTIFY_OK; |
862 | } |
863 | |
864 | -static void vfio_ap_irq_disable_apqn(int apqn) |
865 | +static struct vfio_ap_queue *vfio_ap_find_queue(int apqn) |
866 | { |
867 | struct device *dev; |
868 | - struct vfio_ap_queue *q; |
869 | + struct vfio_ap_queue *q = NULL; |
870 | |
871 | dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL, |
872 | &apqn, match_apqn); |
873 | if (dev) { |
874 | q = dev_get_drvdata(dev); |
875 | - vfio_ap_irq_disable(q); |
876 | put_device(dev); |
877 | } |
878 | + |
879 | + return q; |
880 | } |
881 | |
882 | -int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi, |
883 | +int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q, |
884 | unsigned int retry) |
885 | { |
886 | struct ap_queue_status status; |
887 | + int ret; |
888 | int retry2 = 2; |
889 | - int apqn = AP_MKQID(apid, apqi); |
890 | |
891 | - do { |
892 | - status = ap_zapq(apqn); |
893 | - switch (status.response_code) { |
894 | - case AP_RESPONSE_NORMAL: |
895 | - while (!status.queue_empty && retry2--) { |
896 | - msleep(20); |
897 | - status = ap_tapq(apqn, NULL); |
898 | - } |
899 | - WARN_ON_ONCE(retry2 <= 0); |
900 | - return 0; |
901 | - case AP_RESPONSE_RESET_IN_PROGRESS: |
902 | - case AP_RESPONSE_BUSY: |
903 | + if (!q) |
904 | + return 0; |
905 | + |
906 | +retry_zapq: |
907 | + status = ap_zapq(q->apqn); |
908 | + switch (status.response_code) { |
909 | + case AP_RESPONSE_NORMAL: |
910 | + ret = 0; |
911 | + break; |
912 | + case AP_RESPONSE_RESET_IN_PROGRESS: |
913 | + if (retry--) { |
914 | msleep(20); |
915 | - break; |
916 | - default: |
917 | - /* things are really broken, give up */ |
918 | - return -EIO; |
919 | + goto retry_zapq; |
920 | } |
921 | - } while (retry--); |
922 | + ret = -EBUSY; |
923 | + break; |
924 | + case AP_RESPONSE_Q_NOT_AVAIL: |
925 | + case AP_RESPONSE_DECONFIGURED: |
926 | + case AP_RESPONSE_CHECKSTOPPED: |
927 | + WARN_ON_ONCE(status.irq_enabled); |
928 | + ret = -EBUSY; |
929 | + goto free_resources; |
930 | + default: |
931 | + /* things are really broken, give up */ |
932 | + WARN(true, "PQAP/ZAPQ completed with invalid rc (%x)\n", |
933 | + status.response_code); |
934 | + return -EIO; |
935 | + } |
936 | + |
937 | + /* wait for the reset to take effect */ |
938 | + while (retry2--) { |
939 | + if (status.queue_empty && !status.irq_enabled) |
940 | + break; |
941 | + msleep(20); |
942 | + status = ap_tapq(q->apqn, NULL); |
943 | + } |
944 | + WARN_ON_ONCE(retry2 <= 0); |
945 | |
946 | - return -EBUSY; |
947 | +free_resources: |
948 | + vfio_ap_free_aqic_resources(q); |
949 | + |
950 | + return ret; |
951 | } |
952 | |
953 | static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev) |
954 | @@ -1163,13 +1186,15 @@ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev) |
955 | int ret; |
956 | int rc = 0; |
957 | unsigned long apid, apqi; |
958 | + struct vfio_ap_queue *q; |
959 | struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev); |
960 | |
961 | for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, |
962 | matrix_mdev->matrix.apm_max + 1) { |
963 | for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, |
964 | matrix_mdev->matrix.aqm_max + 1) { |
965 | - ret = vfio_ap_mdev_reset_queue(apid, apqi, 1); |
966 | + q = vfio_ap_find_queue(AP_MKQID(apid, apqi)); |
967 | + ret = vfio_ap_mdev_reset_queue(q, 1); |
968 | /* |
969 | * Regardless whether a queue turns out to be busy, or |
970 | * is not operational, we need to continue resetting |
971 | @@ -1177,7 +1202,6 @@ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev) |
972 | */ |
973 | if (ret) |
974 | rc = ret; |
975 | - vfio_ap_irq_disable_apqn(AP_MKQID(apid, apqi)); |
976 | } |
977 | } |
978 | |
979 | diff --git a/drivers/s390/crypto/vfio_ap_private.h b/drivers/s390/crypto/vfio_ap_private.h |
980 | index f46dde56b4644..28e9d99897682 100644 |
981 | --- a/drivers/s390/crypto/vfio_ap_private.h |
982 | +++ b/drivers/s390/crypto/vfio_ap_private.h |
983 | @@ -88,11 +88,6 @@ struct ap_matrix_mdev { |
984 | struct mdev_device *mdev; |
985 | }; |
986 | |
987 | -extern int vfio_ap_mdev_register(void); |
988 | -extern void vfio_ap_mdev_unregister(void); |
989 | -int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi, |
990 | - unsigned int retry); |
991 | - |
992 | struct vfio_ap_queue { |
993 | struct ap_matrix_mdev *matrix_mdev; |
994 | unsigned long saved_pfn; |
995 | @@ -100,5 +95,10 @@ struct vfio_ap_queue { |
996 | #define VFIO_AP_ISC_INVALID 0xff |
997 | unsigned char saved_isc; |
998 | }; |
999 | -struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q); |
1000 | + |
1001 | +int vfio_ap_mdev_register(void); |
1002 | +void vfio_ap_mdev_unregister(void); |
1003 | +int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q, |
1004 | + unsigned int retry); |
1005 | + |
1006 | #endif /* _VFIO_AP_PRIVATE_H_ */ |
1007 | diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c |
1008 | index 096a83cf0caf3..4b4174597150d 100644 |
1009 | --- a/drivers/soc/atmel/soc.c |
1010 | +++ b/drivers/soc/atmel/soc.c |
1011 | @@ -264,8 +264,21 @@ struct soc_device * __init at91_soc_init(const struct at91_soc *socs) |
1012 | return soc_dev; |
1013 | } |
1014 | |
1015 | +static const struct of_device_id at91_soc_allowed_list[] __initconst = { |
1016 | + { .compatible = "atmel,at91rm9200", }, |
1017 | + { .compatible = "atmel,at91sam9", }, |
1018 | + { .compatible = "atmel,sama5", }, |
1019 | + { .compatible = "atmel,samv7", }, |
1020 | + { } |
1021 | +}; |
1022 | + |
1023 | static int __init atmel_soc_device_init(void) |
1024 | { |
1025 | + struct device_node *np = of_find_node_by_path("/"); |
1026 | + |
1027 | + if (!of_match_node(at91_soc_allowed_list, np)) |
1028 | + return 0; |
1029 | + |
1030 | at91_soc_init(socs); |
1031 | |
1032 | return 0; |
1033 | diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c |
1034 | index aadedec3bfe7b..ea79482ebda46 100644 |
1035 | --- a/drivers/tee/optee/call.c |
1036 | +++ b/drivers/tee/optee/call.c |
1037 | @@ -7,6 +7,7 @@ |
1038 | #include <linux/err.h> |
1039 | #include <linux/errno.h> |
1040 | #include <linux/mm.h> |
1041 | +#include <linux/sched.h> |
1042 | #include <linux/slab.h> |
1043 | #include <linux/tee_drv.h> |
1044 | #include <linux/types.h> |
1045 | @@ -148,7 +149,8 @@ u32 optee_do_call_with_arg(struct tee_context *ctx, phys_addr_t parg) |
1046 | */ |
1047 | optee_cq_wait_for_completion(&optee->call_queue, &w); |
1048 | } else if (OPTEE_SMC_RETURN_IS_RPC(res.a0)) { |
1049 | - might_sleep(); |
1050 | + if (need_resched()) |
1051 | + cond_resched(); |
1052 | param.a0 = res.a0; |
1053 | param.a1 = res.a1; |
1054 | param.a2 = res.a2; |
1055 | diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c |
1056 | index 14ccf13ab8fa1..786494bb7f20b 100644 |
1057 | --- a/drivers/xen/xenbus/xenbus_probe.c |
1058 | +++ b/drivers/xen/xenbus/xenbus_probe.c |
1059 | @@ -714,6 +714,23 @@ static bool xs_hvm_defer_init_for_callback(void) |
1060 | #endif |
1061 | } |
1062 | |
1063 | +static int xenbus_probe_thread(void *unused) |
1064 | +{ |
1065 | + DEFINE_WAIT(w); |
1066 | + |
1067 | + /* |
1068 | + * We actually just want to wait for *any* trigger of xb_waitq, |
1069 | + * and run xenbus_probe() the moment it occurs. |
1070 | + */ |
1071 | + prepare_to_wait(&xb_waitq, &w, TASK_INTERRUPTIBLE); |
1072 | + schedule(); |
1073 | + finish_wait(&xb_waitq, &w); |
1074 | + |
1075 | + DPRINTK("probing"); |
1076 | + xenbus_probe(); |
1077 | + return 0; |
1078 | +} |
1079 | + |
1080 | static int __init xenbus_probe_initcall(void) |
1081 | { |
1082 | /* |
1083 | @@ -725,6 +742,20 @@ static int __init xenbus_probe_initcall(void) |
1084 | !xs_hvm_defer_init_for_callback())) |
1085 | xenbus_probe(); |
1086 | |
1087 | + /* |
1088 | + * For XS_LOCAL, spawn a thread which will wait for xenstored |
1089 | + * or a xenstore-stubdom to be started, then probe. It will be |
1090 | + * triggered when communication starts happening, by waiting |
1091 | + * on xb_waitq. |
1092 | + */ |
1093 | + if (xen_store_domain_type == XS_LOCAL) { |
1094 | + struct task_struct *probe_task; |
1095 | + |
1096 | + probe_task = kthread_run(xenbus_probe_thread, NULL, |
1097 | + "xenbus_probe"); |
1098 | + if (IS_ERR(probe_task)) |
1099 | + return PTR_ERR(probe_task); |
1100 | + } |
1101 | return 0; |
1102 | } |
1103 | device_initcall(xenbus_probe_initcall); |
1104 | diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c |
1105 | index 59e7a2ad440fc..a32f23981f60f 100644 |
1106 | --- a/fs/btrfs/block-group.c |
1107 | +++ b/fs/btrfs/block-group.c |
1108 | @@ -640,7 +640,15 @@ static noinline void caching_thread(struct btrfs_work *work) |
1109 | mutex_lock(&caching_ctl->mutex); |
1110 | down_read(&fs_info->commit_root_sem); |
1111 | |
1112 | - if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE)) |
1113 | + /* |
1114 | + * If we are in the transaction that populated the free space tree we |
1115 | + * can't actually cache from the free space tree as our commit root and |
1116 | + * real root are the same, so we could change the contents of the blocks |
1117 | + * while caching. Instead do the slow caching in this case, and after |
1118 | + * the transaction has committed we will be safe. |
1119 | + */ |
1120 | + if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE) && |
1121 | + !(test_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags))) |
1122 | ret = load_free_space_tree(caching_ctl); |
1123 | else |
1124 | ret = load_extent_tree_free(caching_ctl); |
1125 | diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h |
1126 | index 27128164fac97..cda5534d3d0e3 100644 |
1127 | --- a/fs/btrfs/ctree.h |
1128 | +++ b/fs/btrfs/ctree.h |
1129 | @@ -136,6 +136,9 @@ enum { |
1130 | BTRFS_FS_STATE_DEV_REPLACING, |
1131 | /* The btrfs_fs_info created for self-tests */ |
1132 | BTRFS_FS_STATE_DUMMY_FS_INFO, |
1133 | + |
1134 | + /* Indicate that we can't trust the free space tree for caching yet */ |
1135 | + BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, |
1136 | }; |
1137 | |
1138 | #define BTRFS_BACKREF_REV_MAX 256 |
1139 | diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c |
1140 | index 48a03f5240f59..dfabbbfc94ccb 100644 |
1141 | --- a/fs/btrfs/free-space-tree.c |
1142 | +++ b/fs/btrfs/free-space-tree.c |
1143 | @@ -1149,6 +1149,7 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info) |
1144 | return PTR_ERR(trans); |
1145 | |
1146 | set_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags); |
1147 | + set_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags); |
1148 | free_space_root = btrfs_create_tree(trans, |
1149 | BTRFS_FREE_SPACE_TREE_OBJECTID); |
1150 | if (IS_ERR(free_space_root)) { |
1151 | @@ -1170,11 +1171,18 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info) |
1152 | btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE); |
1153 | btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE_VALID); |
1154 | clear_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags); |
1155 | + ret = btrfs_commit_transaction(trans); |
1156 | |
1157 | - return btrfs_commit_transaction(trans); |
1158 | + /* |
1159 | + * Now that we've committed the transaction any reading of our commit |
1160 | + * root will be safe, so we can cache from the free space tree now. |
1161 | + */ |
1162 | + clear_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags); |
1163 | + return ret; |
1164 | |
1165 | abort: |
1166 | clear_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags); |
1167 | + clear_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags); |
1168 | btrfs_abort_transaction(trans, ret); |
1169 | btrfs_end_transaction(trans); |
1170 | return ret; |
1171 | diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c |
1172 | index 4232f956bdac0..ca1d98f274d12 100644 |
1173 | --- a/fs/nfs/pnfs.c |
1174 | +++ b/fs/nfs/pnfs.c |
1175 | @@ -2388,6 +2388,7 @@ out_forget: |
1176 | spin_unlock(&ino->i_lock); |
1177 | lseg->pls_layout = lo; |
1178 | NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg); |
1179 | + pnfs_free_lseg_list(&free_me); |
1180 | return ERR_PTR(-EAGAIN); |
1181 | } |
1182 | |
1183 | diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h |
1184 | index 6b559d25a84ee..88ac8edf44e31 100644 |
1185 | --- a/include/linux/intel-iommu.h |
1186 | +++ b/include/linux/intel-iommu.h |
1187 | @@ -556,6 +556,8 @@ struct intel_iommu { |
1188 | struct iommu_device iommu; /* IOMMU core code handle */ |
1189 | int node; |
1190 | u32 flags; /* Software defined flags */ |
1191 | + |
1192 | + struct dmar_drhd_unit *drhd; |
1193 | }; |
1194 | |
1195 | /* PCI domain-device relationship */ |
1196 | diff --git a/include/net/tcp.h b/include/net/tcp.h |
1197 | index 377179283c46c..4b38ba101b9b7 100644 |
1198 | --- a/include/net/tcp.h |
1199 | +++ b/include/net/tcp.h |
1200 | @@ -2030,7 +2030,7 @@ void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb); |
1201 | void tcp_newreno_mark_lost(struct sock *sk, bool snd_una_advanced); |
1202 | extern s32 tcp_rack_skb_timeout(struct tcp_sock *tp, struct sk_buff *skb, |
1203 | u32 reo_wnd); |
1204 | -extern void tcp_rack_mark_lost(struct sock *sk); |
1205 | +extern bool tcp_rack_mark_lost(struct sock *sk); |
1206 | extern void tcp_rack_advance(struct tcp_sock *tp, u8 sacked, u32 end_seq, |
1207 | u64 xmit_time); |
1208 | extern void tcp_rack_reo_timeout(struct sock *sk); |
1209 | diff --git a/include/uapi/linux/icmpv6.h b/include/uapi/linux/icmpv6.h |
1210 | index 2622b5a3e6163..9a31ea2ad1cfc 100644 |
1211 | --- a/include/uapi/linux/icmpv6.h |
1212 | +++ b/include/uapi/linux/icmpv6.h |
1213 | @@ -137,6 +137,7 @@ struct icmp6hdr { |
1214 | #define ICMPV6_HDR_FIELD 0 |
1215 | #define ICMPV6_UNK_NEXTHDR 1 |
1216 | #define ICMPV6_UNK_OPTION 2 |
1217 | +#define ICMPV6_HDR_INCOMP 3 |
1218 | |
1219 | /* |
1220 | * constants for (set|get)sockopt |
1221 | diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c |
1222 | index 15d70a90b50dc..d65b0fc8fb48b 100644 |
1223 | --- a/kernel/kexec_core.c |
1224 | +++ b/kernel/kexec_core.c |
1225 | @@ -1129,7 +1129,6 @@ int kernel_kexec(void) |
1226 | |
1227 | #ifdef CONFIG_KEXEC_JUMP |
1228 | if (kexec_image->preserve_context) { |
1229 | - lock_system_sleep(); |
1230 | pm_prepare_console(); |
1231 | error = freeze_processes(); |
1232 | if (error) { |
1233 | @@ -1192,7 +1191,6 @@ int kernel_kexec(void) |
1234 | thaw_processes(); |
1235 | Restore_console: |
1236 | pm_restore_console(); |
1237 | - unlock_system_sleep(); |
1238 | } |
1239 | #endif |
1240 | |
1241 | diff --git a/kernel/power/swap.c b/kernel/power/swap.c |
1242 | index ca0fcb5ced714..0516c422206d8 100644 |
1243 | --- a/kernel/power/swap.c |
1244 | +++ b/kernel/power/swap.c |
1245 | @@ -489,10 +489,10 @@ static int swap_writer_finish(struct swap_map_handle *handle, |
1246 | unsigned int flags, int error) |
1247 | { |
1248 | if (!error) { |
1249 | - flush_swap_writer(handle); |
1250 | pr_info("S"); |
1251 | error = mark_swapfiles(handle, flags); |
1252 | pr_cont("|\n"); |
1253 | + flush_swap_writer(handle); |
1254 | } |
1255 | |
1256 | if (error) |
1257 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c |
1258 | index 7411a43134629..26305aa88651f 100644 |
1259 | --- a/net/ipv4/tcp_input.c |
1260 | +++ b/net/ipv4/tcp_input.c |
1261 | @@ -2764,7 +2764,8 @@ static void tcp_identify_packet_loss(struct sock *sk, int *ack_flag) |
1262 | } else if (tcp_is_rack(sk)) { |
1263 | u32 prior_retrans = tp->retrans_out; |
1264 | |
1265 | - tcp_rack_mark_lost(sk); |
1266 | + if (tcp_rack_mark_lost(sk)) |
1267 | + *ack_flag &= ~FLAG_SET_XMIT_TIMER; |
1268 | if (prior_retrans > tp->retrans_out) |
1269 | *ack_flag |= FLAG_LOST_RETRANS; |
1270 | } |
1271 | @@ -3713,9 +3714,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) |
1272 | |
1273 | if (tp->tlp_high_seq) |
1274 | tcp_process_tlp_ack(sk, ack, flag); |
1275 | - /* If needed, reset TLP/RTO timer; RACK may later override this. */ |
1276 | - if (flag & FLAG_SET_XMIT_TIMER) |
1277 | - tcp_set_xmit_timer(sk); |
1278 | |
1279 | if (tcp_ack_is_dubious(sk, flag)) { |
1280 | if (!(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP))) { |
1281 | @@ -3728,6 +3726,10 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) |
1282 | &rexmit); |
1283 | } |
1284 | |
1285 | + /* If needed, reset TLP/RTO timer when RACK doesn't set. */ |
1286 | + if (flag & FLAG_SET_XMIT_TIMER) |
1287 | + tcp_set_xmit_timer(sk); |
1288 | + |
1289 | if ((flag & FLAG_FORWARD_PROGRESS) || !(flag & FLAG_NOT_DUP)) |
1290 | sk_dst_confirm(sk); |
1291 | |
1292 | diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c |
1293 | index fdb715bdd2d11..8757bb6cb1d93 100644 |
1294 | --- a/net/ipv4/tcp_recovery.c |
1295 | +++ b/net/ipv4/tcp_recovery.c |
1296 | @@ -110,13 +110,13 @@ static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout) |
1297 | } |
1298 | } |
1299 | |
1300 | -void tcp_rack_mark_lost(struct sock *sk) |
1301 | +bool tcp_rack_mark_lost(struct sock *sk) |
1302 | { |
1303 | struct tcp_sock *tp = tcp_sk(sk); |
1304 | u32 timeout; |
1305 | |
1306 | if (!tp->rack.advanced) |
1307 | - return; |
1308 | + return false; |
1309 | |
1310 | /* Reset the advanced flag to avoid unnecessary queue scanning */ |
1311 | tp->rack.advanced = 0; |
1312 | @@ -126,6 +126,7 @@ void tcp_rack_mark_lost(struct sock *sk) |
1313 | inet_csk_reset_xmit_timer(sk, ICSK_TIME_REO_TIMEOUT, |
1314 | timeout, inet_csk(sk)->icsk_rto); |
1315 | } |
1316 | + return !!timeout; |
1317 | } |
1318 | |
1319 | /* Record the most recently (re)sent time among the (s)acked packets |
1320 | diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c |
1321 | index 7d3a3894f785c..e9bb89131e02a 100644 |
1322 | --- a/net/ipv6/icmp.c |
1323 | +++ b/net/ipv6/icmp.c |
1324 | @@ -158,7 +158,13 @@ static bool is_ineligible(const struct sk_buff *skb) |
1325 | tp = skb_header_pointer(skb, |
1326 | ptr+offsetof(struct icmp6hdr, icmp6_type), |
1327 | sizeof(_type), &_type); |
1328 | - if (!tp || !(*tp & ICMPV6_INFOMSG_MASK)) |
1329 | + |
1330 | + /* Based on RFC 8200, Section 4.5 Fragment Header, return |
1331 | + * false if this is a fragment packet with no icmp header info. |
1332 | + */ |
1333 | + if (!tp && frag_off != 0) |
1334 | + return false; |
1335 | + else if (!tp || !(*tp & ICMPV6_INFOMSG_MASK)) |
1336 | return true; |
1337 | } |
1338 | return false; |
1339 | diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c |
1340 | index 1f5d4d196dcce..c8cf1bbad74a2 100644 |
1341 | --- a/net/ipv6/reassembly.c |
1342 | +++ b/net/ipv6/reassembly.c |
1343 | @@ -42,6 +42,8 @@ |
1344 | #include <linux/skbuff.h> |
1345 | #include <linux/slab.h> |
1346 | #include <linux/export.h> |
1347 | +#include <linux/tcp.h> |
1348 | +#include <linux/udp.h> |
1349 | |
1350 | #include <net/sock.h> |
1351 | #include <net/snmp.h> |
1352 | @@ -322,7 +324,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
1353 | struct frag_queue *fq; |
1354 | const struct ipv6hdr *hdr = ipv6_hdr(skb); |
1355 | struct net *net = dev_net(skb_dst(skb)->dev); |
1356 | - int iif; |
1357 | + __be16 frag_off; |
1358 | + int iif, offset; |
1359 | + u8 nexthdr; |
1360 | |
1361 | if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED) |
1362 | goto fail_hdr; |
1363 | @@ -351,6 +355,33 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
1364 | return 1; |
1365 | } |
1366 | |
1367 | + /* RFC 8200, Section 4.5 Fragment Header: |
1368 | + * If the first fragment does not include all headers through an |
1369 | + * Upper-Layer header, then that fragment should be discarded and |
1370 | + * an ICMP Parameter Problem, Code 3, message should be sent to |
1371 | + * the source of the fragment, with the Pointer field set to zero. |
1372 | + */ |
1373 | + nexthdr = hdr->nexthdr; |
1374 | + offset = ipv6_skip_exthdr(skb, skb_transport_offset(skb), &nexthdr, &frag_off); |
1375 | + if (offset >= 0) { |
1376 | + /* Check some common protocols' header */ |
1377 | + if (nexthdr == IPPROTO_TCP) |
1378 | + offset += sizeof(struct tcphdr); |
1379 | + else if (nexthdr == IPPROTO_UDP) |
1380 | + offset += sizeof(struct udphdr); |
1381 | + else if (nexthdr == IPPROTO_ICMPV6) |
1382 | + offset += sizeof(struct icmp6hdr); |
1383 | + else |
1384 | + offset += 1; |
1385 | + |
1386 | + if (!(frag_off & htons(IP6_OFFSET)) && offset > skb->len) { |
1387 | + __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev), |
1388 | + IPSTATS_MIB_INHDRERRORS); |
1389 | + icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0); |
1390 | + return -1; |
1391 | + } |
1392 | + } |
1393 | + |
1394 | iif = skb->dev ? skb->dev->ifindex : 0; |
1395 | fq = fq_find(net, fhdr->identification, hdr, iif); |
1396 | if (fq) { |
1397 | diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h |
1398 | index 05406e9c05b32..268f1d8f440ba 100644 |
1399 | --- a/net/mac80211/ieee80211_i.h |
1400 | +++ b/net/mac80211/ieee80211_i.h |
1401 | @@ -1061,6 +1061,7 @@ enum queue_stop_reason { |
1402 | IEEE80211_QUEUE_STOP_REASON_FLUSH, |
1403 | IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN, |
1404 | IEEE80211_QUEUE_STOP_REASON_RESERVE_TID, |
1405 | + IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE, |
1406 | |
1407 | IEEE80211_QUEUE_STOP_REASONS, |
1408 | }; |
1409 | diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c |
1410 | index af8b09214786d..6089b09ec13b6 100644 |
1411 | --- a/net/mac80211/iface.c |
1412 | +++ b/net/mac80211/iface.c |
1413 | @@ -1537,6 +1537,10 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata, |
1414 | if (ret) |
1415 | return ret; |
1416 | |
1417 | + ieee80211_stop_vif_queues(local, sdata, |
1418 | + IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE); |
1419 | + synchronize_net(); |
1420 | + |
1421 | ieee80211_do_stop(sdata, false); |
1422 | |
1423 | ieee80211_teardown_sdata(sdata); |
1424 | @@ -1557,6 +1561,8 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata, |
1425 | err = ieee80211_do_open(&sdata->wdev, false); |
1426 | WARN(err, "type change: do_open returned %d", err); |
1427 | |
1428 | + ieee80211_wake_vif_queues(local, sdata, |
1429 | + IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE); |
1430 | return ret; |
1431 | } |
1432 | |
1433 | diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c |
1434 | index 60236cc316d03..95415d2b81c93 100644 |
1435 | --- a/net/netfilter/nft_dynset.c |
1436 | +++ b/net/netfilter/nft_dynset.c |
1437 | @@ -233,8 +233,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx, |
1438 | nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_EXPR, |
1439 | priv->expr->ops->size); |
1440 | if (set->flags & NFT_SET_TIMEOUT) { |
1441 | - if (timeout || set->timeout) |
1442 | + if (timeout || set->timeout) { |
1443 | + nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_TIMEOUT); |
1444 | nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_EXPIRATION); |
1445 | + } |
1446 | } |
1447 | |
1448 | priv->timeout = timeout; |
1449 | diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c |
1450 | index 4170acc2dc282..99b06a16b8086 100644 |
1451 | --- a/net/nfc/netlink.c |
1452 | +++ b/net/nfc/netlink.c |
1453 | @@ -860,6 +860,7 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info) |
1454 | |
1455 | if (!dev->polling) { |
1456 | device_unlock(&dev->dev); |
1457 | + nfc_put_device(dev); |
1458 | return -EINVAL; |
1459 | } |
1460 | |
1461 | diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c |
1462 | index b5c867fe32324..23d5e56306a4c 100644 |
1463 | --- a/net/nfc/rawsock.c |
1464 | +++ b/net/nfc/rawsock.c |
1465 | @@ -105,7 +105,7 @@ static int rawsock_connect(struct socket *sock, struct sockaddr *_addr, |
1466 | if (addr->target_idx > dev->target_next_idx - 1 || |
1467 | addr->target_idx < dev->target_next_idx - dev->n_targets) { |
1468 | rc = -EINVAL; |
1469 | - goto error; |
1470 | + goto put_dev; |
1471 | } |
1472 | |
1473 | rc = nfc_activate_target(dev, addr->target_idx, addr->nfc_protocol); |
1474 | diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c |
1475 | index 032ed76c0166d..55fb3744552de 100644 |
1476 | --- a/net/rxrpc/call_accept.c |
1477 | +++ b/net/rxrpc/call_accept.c |
1478 | @@ -207,6 +207,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx) |
1479 | tail = b->peer_backlog_tail; |
1480 | while (CIRC_CNT(head, tail, size) > 0) { |
1481 | struct rxrpc_peer *peer = b->peer_backlog[tail]; |
1482 | + rxrpc_put_local(peer->local); |
1483 | kfree(peer); |
1484 | tail = (tail + 1) & (size - 1); |
1485 | } |
1486 | diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c |
1487 | index 69102fda9ebd4..76a80a41615be 100644 |
1488 | --- a/net/wireless/wext-core.c |
1489 | +++ b/net/wireless/wext-core.c |
1490 | @@ -896,8 +896,9 @@ out: |
1491 | int call_commit_handler(struct net_device *dev) |
1492 | { |
1493 | #ifdef CONFIG_WIRELESS_EXT |
1494 | - if ((netif_running(dev)) && |
1495 | - (dev->wireless_handlers->standard[0] != NULL)) |
1496 | + if (netif_running(dev) && |
1497 | + dev->wireless_handlers && |
1498 | + dev->wireless_handlers->standard[0]) |
1499 | /* Call the commit handler on the driver */ |
1500 | return dev->wireless_handlers->standard[0](dev, NULL, |
1501 | NULL, NULL); |
1502 | diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c |
1503 | index 7a84745477919..e120df0a6da13 100644 |
1504 | --- a/net/xfrm/xfrm_input.c |
1505 | +++ b/net/xfrm/xfrm_input.c |
1506 | @@ -656,7 +656,7 @@ resume: |
1507 | /* only the first xfrm gets the encap type */ |
1508 | encap_type = 0; |
1509 | |
1510 | - if (async && x->repl->recheck(x, skb, seq)) { |
1511 | + if (x->repl->recheck(x, skb, seq)) { |
1512 | XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR); |
1513 | goto drop_unlock; |
1514 | } |
1515 | diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c |
1516 | index 2917711ff8ab6..32c8163427970 100644 |
1517 | --- a/net/xfrm/xfrm_policy.c |
1518 | +++ b/net/xfrm/xfrm_policy.c |
1519 | @@ -790,15 +790,22 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a, |
1520 | const xfrm_address_t *b, |
1521 | u8 prefixlen, u16 family) |
1522 | { |
1523 | + u32 ma, mb, mask; |
1524 | unsigned int pdw, pbi; |
1525 | int delta = 0; |
1526 | |
1527 | switch (family) { |
1528 | case AF_INET: |
1529 | - if (sizeof(long) == 4 && prefixlen == 0) |
1530 | - return ntohl(a->a4) - ntohl(b->a4); |
1531 | - return (ntohl(a->a4) & ((~0UL << (32 - prefixlen)))) - |
1532 | - (ntohl(b->a4) & ((~0UL << (32 - prefixlen)))); |
1533 | + if (prefixlen == 0) |
1534 | + return 0; |
1535 | + mask = ~0U << (32 - prefixlen); |
1536 | + ma = ntohl(a->a4) & mask; |
1537 | + mb = ntohl(b->a4) & mask; |
1538 | + if (ma < mb) |
1539 | + delta = -1; |
1540 | + else if (ma > mb) |
1541 | + delta = 1; |
1542 | + break; |
1543 | case AF_INET6: |
1544 | pdw = prefixlen >> 5; |
1545 | pbi = prefixlen & 0x1f; |
1546 | @@ -809,10 +816,13 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a, |
1547 | return delta; |
1548 | } |
1549 | if (pbi) { |
1550 | - u32 mask = ~0u << (32 - pbi); |
1551 | - |
1552 | - delta = (ntohl(a->a6[pdw]) & mask) - |
1553 | - (ntohl(b->a6[pdw]) & mask); |
1554 | + mask = ~0U << (32 - pbi); |
1555 | + ma = ntohl(a->a6[pdw]) & mask; |
1556 | + mb = ntohl(b->a6[pdw]) & mask; |
1557 | + if (ma < mb) |
1558 | + delta = -1; |
1559 | + else if (ma > mb) |
1560 | + delta = 1; |
1561 | } |
1562 | break; |
1563 | default: |
1564 | @@ -3065,8 +3075,8 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net, |
1565 | xflo.flags = flags; |
1566 | |
1567 | /* To accelerate a bit... */ |
1568 | - if ((dst_orig->flags & DST_NOXFRM) || |
1569 | - !net->xfrm.policy_count[XFRM_POLICY_OUT]) |
1570 | + if (!if_id && ((dst_orig->flags & DST_NOXFRM) || |
1571 | + !net->xfrm.policy_count[XFRM_POLICY_OUT])) |
1572 | goto nopol; |
1573 | |
1574 | xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id); |
1575 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
1576 | index 8adbe45a54c11..f548bd48bf729 100644 |
1577 | --- a/sound/pci/hda/patch_realtek.c |
1578 | +++ b/sound/pci/hda/patch_realtek.c |
1579 | @@ -7907,6 +7907,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { |
1580 | SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), |
1581 | SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC), |
1582 | SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE), |
1583 | + SND_PCI_QUIRK(0x1043, 0x1982, "ASUS B1400CEPE", ALC256_FIXUP_ASUS_HPE), |
1584 | SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), |
1585 | SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE), |
1586 | SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), |
1587 | diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c |
1588 | index 834367dd54e1b..a5c1a2c4eae4e 100644 |
1589 | --- a/sound/pci/hda/patch_via.c |
1590 | +++ b/sound/pci/hda/patch_via.c |
1591 | @@ -1043,7 +1043,7 @@ static const struct hda_fixup via_fixups[] = { |
1592 | static const struct snd_pci_quirk vt2002p_fixups[] = { |
1593 | SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75), |
1594 | SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST), |
1595 | - SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", VIA_FIXUP_POWER_SAVE), |
1596 | + SND_PCI_QUIRK_VENDOR(0x1558, "Clevo", VIA_FIXUP_POWER_SAVE), |
1597 | {} |
1598 | }; |
1599 | |
1600 | diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c |
1601 | index aa5833001fde5..2cb719893324a 100644 |
1602 | --- a/sound/soc/intel/skylake/skl-topology.c |
1603 | +++ b/sound/soc/intel/skylake/skl-topology.c |
1604 | @@ -3619,15 +3619,16 @@ static void skl_tplg_complete(struct snd_soc_component *component) |
1605 | |
1606 | list_for_each_entry(dobj, &component->dobj_list, list) { |
1607 | struct snd_kcontrol *kcontrol = dobj->control.kcontrol; |
1608 | - struct soc_enum *se = |
1609 | - (struct soc_enum *)kcontrol->private_value; |
1610 | - char **texts = dobj->control.dtexts; |
1611 | + struct soc_enum *se; |
1612 | + char **texts; |
1613 | char chan_text[4]; |
1614 | |
1615 | - if (dobj->type != SND_SOC_DOBJ_ENUM || |
1616 | - dobj->control.kcontrol->put != |
1617 | - skl_tplg_multi_config_set_dmic) |
1618 | + if (dobj->type != SND_SOC_DOBJ_ENUM || !kcontrol || |
1619 | + kcontrol->put != skl_tplg_multi_config_set_dmic) |
1620 | continue; |
1621 | + |
1622 | + se = (struct soc_enum *)kcontrol->private_value; |
1623 | + texts = dobj->control.dtexts; |
1624 | sprintf(chan_text, "c%d", mach->mach_params.dmic_num); |
1625 | |
1626 | for (i = 0; i < se->items; i++) { |
1627 | diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c |
1628 | index 0100f123484e6..c367609433bfc 100644 |
1629 | --- a/sound/soc/soc-topology.c |
1630 | +++ b/sound/soc/soc-topology.c |
1631 | @@ -982,7 +982,7 @@ static int soc_tplg_denum_create_values(struct soc_enum *se, |
1632 | return -EINVAL; |
1633 | |
1634 | se->dobj.control.dvalues = kzalloc(le32_to_cpu(ec->items) * |
1635 | - sizeof(u32), |
1636 | + sizeof(*se->dobj.control.dvalues), |
1637 | GFP_KERNEL); |
1638 | if (!se->dobj.control.dvalues) |
1639 | return -ENOMEM; |
1640 | diff --git a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh |
1641 | index cf3d26c233e8e..7fcc42bc076fa 100755 |
1642 | --- a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh |
1643 | +++ b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh |
1644 | @@ -197,7 +197,7 @@ multipath4_test() |
1645 | t0_rp12=$(link_stats_tx_packets_get $rp12) |
1646 | t0_rp13=$(link_stats_tx_packets_get $rp13) |
1647 | |
1648 | - ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \ |
1649 | + ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \ |
1650 | -d 1msec -t udp "sp=1024,dp=0-32768" |
1651 | |
1652 | t1_rp12=$(link_stats_tx_packets_get $rp12) |
1653 | diff --git a/tools/testing/selftests/net/forwarding/router_multipath.sh b/tools/testing/selftests/net/forwarding/router_multipath.sh |
1654 | index 79a2099279621..464821c587a5e 100755 |
1655 | --- a/tools/testing/selftests/net/forwarding/router_multipath.sh |
1656 | +++ b/tools/testing/selftests/net/forwarding/router_multipath.sh |
1657 | @@ -178,7 +178,7 @@ multipath4_test() |
1658 | t0_rp12=$(link_stats_tx_packets_get $rp12) |
1659 | t0_rp13=$(link_stats_tx_packets_get $rp13) |
1660 | |
1661 | - ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \ |
1662 | + ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \ |
1663 | -d 1msec -t udp "sp=1024,dp=0-32768" |
1664 | |
1665 | t1_rp12=$(link_stats_tx_packets_get $rp12) |
1666 | diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh |
1667 | index 7a1bf94c5bd38..bdf450eaf60cf 100755 |
1668 | --- a/tools/testing/selftests/net/xfrm_policy.sh |
1669 | +++ b/tools/testing/selftests/net/xfrm_policy.sh |
1670 | @@ -202,7 +202,7 @@ check_xfrm() { |
1671 | # 1: iptables -m policy rule count != 0 |
1672 | rval=$1 |
1673 | ip=$2 |
1674 | - lret=0 |
1675 | + local lret=0 |
1676 | |
1677 | ip netns exec ns1 ping -q -c 1 10.0.2.$ip > /dev/null |
1678 | |
1679 | @@ -287,6 +287,47 @@ check_hthresh_repeat() |
1680 | return 0 |
1681 | } |
1682 | |
1683 | +# insert non-overlapping policies in a random order and check that |
1684 | +# all of them can be fetched using the traffic selectors. |
1685 | +check_random_order() |
1686 | +{ |
1687 | + local ns=$1 |
1688 | + local log=$2 |
1689 | + |
1690 | + for i in $(seq 100); do |
1691 | + ip -net $ns xfrm policy flush |
1692 | + for j in $(seq 0 16 255 | sort -R); do |
1693 | + ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow |
1694 | + done |
1695 | + for j in $(seq 0 16 255); do |
1696 | + if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then |
1697 | + echo "FAIL: $log" 1>&2 |
1698 | + return 1 |
1699 | + fi |
1700 | + done |
1701 | + done |
1702 | + |
1703 | + for i in $(seq 100); do |
1704 | + ip -net $ns xfrm policy flush |
1705 | + for j in $(seq 0 16 255 | sort -R); do |
1706 | + local addr=$(printf "e000:0000:%02x00::/56" $j) |
1707 | + ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow |
1708 | + done |
1709 | + for j in $(seq 0 16 255); do |
1710 | + local addr=$(printf "e000:0000:%02x00::/56" $j) |
1711 | + if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then |
1712 | + echo "FAIL: $log" 1>&2 |
1713 | + return 1 |
1714 | + fi |
1715 | + done |
1716 | + done |
1717 | + |
1718 | + ip -net $ns xfrm policy flush |
1719 | + |
1720 | + echo "PASS: $log" |
1721 | + return 0 |
1722 | +} |
1723 | + |
1724 | #check for needed privileges |
1725 | if [ "$(id -u)" -ne 0 ];then |
1726 | echo "SKIP: Need root privileges" |
1727 | @@ -438,6 +479,8 @@ check_exceptions "exceptions and block policies after htresh change to normal" |
1728 | |
1729 | check_hthresh_repeat "policies with repeated htresh change" |
1730 | |
1731 | +check_random_order ns3 "policies inserted in random order" |
1732 | + |
1733 | for i in 1 2 3 4;do ip netns del ns$i;done |
1734 | |
1735 | exit $ret |
1736 | diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c |
1737 | index 8f3b40ec02b77..f25b5043cbcae 100644 |
1738 | --- a/virt/kvm/kvm_main.c |
1739 | +++ b/virt/kvm/kvm_main.c |
1740 | @@ -1017,6 +1017,7 @@ int __kvm_set_memory_region(struct kvm *kvm, |
1741 | /* We can read the guest memory with __xxx_user() later on. */ |
1742 | if ((id < KVM_USER_MEM_SLOTS) && |
1743 | ((mem->userspace_addr & (PAGE_SIZE - 1)) || |
1744 | + (mem->userspace_addr != untagged_addr(mem->userspace_addr)) || |
1745 | !access_ok((void __user *)(unsigned long)mem->userspace_addr, |
1746 | mem->memory_size))) |
1747 | goto out; |