Contents of /trunk/kernel-alx/patches-5.4/0256-5.4.157-all-fixes.patch
Parent Directory | Revision Log
Revision 3635 -
(show annotations)
(download)
Mon Oct 24 12:34:12 2022 UTC (23 months ago) by niro
File size: 54691 byte(s)
Mon Oct 24 12:34:12 2022 UTC (23 months ago) by niro
File size: 54691 byte(s)
-sync kernel patches
1 | diff --git a/Makefile b/Makefile |
2 | index ced1f0fd48dc6..49d639fe5a801 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,7 +1,7 @@ |
6 | # SPDX-License-Identifier: GPL-2.0 |
7 | VERSION = 5 |
8 | PATCHLEVEL = 4 |
9 | -SUBLEVEL = 156 |
10 | +SUBLEVEL = 157 |
11 | EXTRAVERSION = |
12 | NAME = Kleptomaniac Octopus |
13 | |
14 | diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c |
15 | index aa075d8372ea2..74255e8198314 100644 |
16 | --- a/arch/arm/boot/compressed/decompress.c |
17 | +++ b/arch/arm/boot/compressed/decompress.c |
18 | @@ -47,7 +47,10 @@ extern char * strchrnul(const char *, int); |
19 | #endif |
20 | |
21 | #ifdef CONFIG_KERNEL_XZ |
22 | +/* Prevent KASAN override of string helpers in decompressor */ |
23 | +#undef memmove |
24 | #define memmove memmove |
25 | +#undef memcpy |
26 | #define memcpy memcpy |
27 | #include "../../../../lib/decompress_unxz.c" |
28 | #endif |
29 | diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S |
30 | index 8c74037ade229..b1f366df620b0 100644 |
31 | --- a/arch/arm/kernel/vmlinux-xip.lds.S |
32 | +++ b/arch/arm/kernel/vmlinux-xip.lds.S |
33 | @@ -180,7 +180,7 @@ ASSERT(__hyp_idmap_text_end - (__hyp_idmap_text_start & PAGE_MASK) <= PAGE_SIZE, |
34 | ASSERT((_end - __bss_start) >= 12288, ".bss too small for CONFIG_XIP_DEFLATED_DATA") |
35 | #endif |
36 | |
37 | -#ifdef CONFIG_ARM_MPU |
38 | +#if defined(CONFIG_ARM_MPU) && !defined(CONFIG_COMPILE_TEST) |
39 | /* |
40 | * Due to PMSAv7 restriction on base address and size we have to |
41 | * enforce minimal alignment restrictions. It was seen that weaker |
42 | diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S |
43 | index 60ac7c5999a98..86e54447dc916 100644 |
44 | --- a/arch/arm/mm/proc-macros.S |
45 | +++ b/arch/arm/mm/proc-macros.S |
46 | @@ -342,6 +342,7 @@ ENTRY(\name\()_cache_fns) |
47 | |
48 | .macro define_tlb_functions name:req, flags_up:req, flags_smp |
49 | .type \name\()_tlb_fns, #object |
50 | + .align 2 |
51 | ENTRY(\name\()_tlb_fns) |
52 | .long \name\()_flush_user_tlb_range |
53 | .long \name\()_flush_kern_tlb_range |
54 | diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c |
55 | index 90b5bc723c83f..0a783bd4641c5 100644 |
56 | --- a/arch/arm/probes/kprobes/core.c |
57 | +++ b/arch/arm/probes/kprobes/core.c |
58 | @@ -534,7 +534,7 @@ static struct undef_hook kprobes_arm_break_hook = { |
59 | |
60 | #endif /* !CONFIG_THUMB2_KERNEL */ |
61 | |
62 | -int __init arch_init_kprobes() |
63 | +int __init arch_init_kprobes(void) |
64 | { |
65 | arm_probes_decode_init(); |
66 | #ifdef CONFIG_THUMB2_KERNEL |
67 | diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts |
68 | index 57a6f45036c1f..d7177465b0968 100644 |
69 | --- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts |
70 | +++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts |
71 | @@ -114,7 +114,7 @@ |
72 | pinctrl-0 = <&emac_rgmii_pins>; |
73 | phy-supply = <®_gmac_3v3>; |
74 | phy-handle = <&ext_rgmii_phy>; |
75 | - phy-mode = "rgmii"; |
76 | + phy-mode = "rgmii-id"; |
77 | status = "okay"; |
78 | }; |
79 | |
80 | diff --git a/arch/nios2/platform/Kconfig.platform b/arch/nios2/platform/Kconfig.platform |
81 | index 9e32fb7f3d4ce..e849daff6fd16 100644 |
82 | --- a/arch/nios2/platform/Kconfig.platform |
83 | +++ b/arch/nios2/platform/Kconfig.platform |
84 | @@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR |
85 | |
86 | config NIOS2_DTB_SOURCE_BOOL |
87 | bool "Compile and link device tree into kernel image" |
88 | + depends on !COMPILE_TEST |
89 | help |
90 | This allows you to specify a dts (device tree source) file |
91 | which will be compiled and linked into the kernel image. |
92 | diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c |
93 | index 20bfd753bcba6..81e6279c9874f 100644 |
94 | --- a/arch/powerpc/net/bpf_jit_comp64.c |
95 | +++ b/arch/powerpc/net/bpf_jit_comp64.c |
96 | @@ -408,8 +408,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, |
97 | case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */ |
98 | if (imm == 0) |
99 | return -EINVAL; |
100 | - else if (imm == 1) |
101 | - goto bpf_alu32_trunc; |
102 | + if (imm == 1) { |
103 | + if (BPF_OP(code) == BPF_DIV) { |
104 | + goto bpf_alu32_trunc; |
105 | + } else { |
106 | + PPC_LI(dst_reg, 0); |
107 | + break; |
108 | + } |
109 | + } |
110 | |
111 | PPC_LI32(b2p[TMP_REG_1], imm); |
112 | switch (BPF_CLASS(code)) { |
113 | diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c |
114 | index fa9483aa4f575..fd73a8aa89d23 100644 |
115 | --- a/arch/s390/kvm/interrupt.c |
116 | +++ b/arch/s390/kvm/interrupt.c |
117 | @@ -2987,13 +2987,14 @@ static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask) |
118 | int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus); |
119 | struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int; |
120 | struct kvm_vcpu *vcpu; |
121 | + u8 vcpu_isc_mask; |
122 | |
123 | for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) { |
124 | vcpu = kvm_get_vcpu(kvm, vcpu_idx); |
125 | if (psw_ioint_disabled(vcpu)) |
126 | continue; |
127 | - deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24); |
128 | - if (deliverable_mask) { |
129 | + vcpu_isc_mask = (u8)(vcpu->arch.sie_block->gcr[6] >> 24); |
130 | + if (deliverable_mask & vcpu_isc_mask) { |
131 | /* lately kicked but not yet running */ |
132 | if (test_and_set_bit(vcpu_idx, gi->kicked_mask)) |
133 | return; |
134 | diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c |
135 | index 9ed2fee612297..b286818d8d54d 100644 |
136 | --- a/arch/s390/kvm/kvm-s390.c |
137 | +++ b/arch/s390/kvm/kvm-s390.c |
138 | @@ -3092,6 +3092,7 @@ out: |
139 | |
140 | int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) |
141 | { |
142 | + clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.gisa_int.kicked_mask); |
143 | return kvm_s390_vcpu_has_irq(vcpu, 0); |
144 | } |
145 | |
146 | diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c |
147 | index d1ed9679c7177..3fca3e13ed6ae 100644 |
148 | --- a/drivers/ata/sata_mv.c |
149 | +++ b/drivers/ata/sata_mv.c |
150 | @@ -3892,8 +3892,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx) |
151 | break; |
152 | |
153 | default: |
154 | - dev_err(host->dev, "BUG: invalid board index %u\n", board_idx); |
155 | - return 1; |
156 | + dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx); |
157 | + return -EINVAL; |
158 | } |
159 | |
160 | hpriv->hp_flags = hp_flags; |
161 | diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c |
162 | index cfa29dc89bbff..fabf87058d80b 100644 |
163 | --- a/drivers/base/regmap/regcache-rbtree.c |
164 | +++ b/drivers/base/regmap/regcache-rbtree.c |
165 | @@ -281,14 +281,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, |
166 | if (!blk) |
167 | return -ENOMEM; |
168 | |
169 | + rbnode->block = blk; |
170 | + |
171 | if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { |
172 | present = krealloc(rbnode->cache_present, |
173 | BITS_TO_LONGS(blklen) * sizeof(*present), |
174 | GFP_KERNEL); |
175 | - if (!present) { |
176 | - kfree(blk); |
177 | + if (!present) |
178 | return -ENOMEM; |
179 | - } |
180 | |
181 | memset(present + BITS_TO_LONGS(rbnode->blklen), 0, |
182 | (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen)) |
183 | @@ -305,7 +305,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, |
184 | } |
185 | |
186 | /* update the rbnode block, its size and the base register */ |
187 | - rbnode->block = blk; |
188 | rbnode->blklen = blklen; |
189 | rbnode->base_reg = base_reg; |
190 | rbnode->cache_present = present; |
191 | diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c |
192 | index fe81c565e7ef8..a7b88ca8b97b3 100644 |
193 | --- a/drivers/gpu/drm/ttm/ttm_bo_util.c |
194 | +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c |
195 | @@ -463,6 +463,7 @@ static void ttm_transfered_destroy(struct ttm_buffer_object *bo) |
196 | struct ttm_transfer_obj *fbo; |
197 | |
198 | fbo = container_of(bo, struct ttm_transfer_obj, base); |
199 | + dma_resv_fini(&fbo->base.base._resv); |
200 | ttm_bo_put(fbo->bo); |
201 | kfree(fbo); |
202 | } |
203 | diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c |
204 | index d2d70c89193ff..11ab6390eda4d 100644 |
205 | --- a/drivers/infiniband/core/sa_query.c |
206 | +++ b/drivers/infiniband/core/sa_query.c |
207 | @@ -760,8 +760,9 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb, |
208 | |
209 | /* Construct the family header first */ |
210 | header = skb_put(skb, NLMSG_ALIGN(sizeof(*header))); |
211 | - memcpy(header->device_name, dev_name(&query->port->agent->device->dev), |
212 | - LS_DEVICE_NAME_MAX); |
213 | + strscpy_pad(header->device_name, |
214 | + dev_name(&query->port->agent->device->dev), |
215 | + LS_DEVICE_NAME_MAX); |
216 | header->port_num = query->port->port_num; |
217 | |
218 | if ((comp_mask & IB_SA_PATH_REC_REVERSIBLE) && |
219 | diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c |
220 | index 79126b2b14ab0..1a82ea73a0fc2 100644 |
221 | --- a/drivers/infiniband/hw/hfi1/pio.c |
222 | +++ b/drivers/infiniband/hw/hfi1/pio.c |
223 | @@ -920,6 +920,7 @@ void sc_disable(struct send_context *sc) |
224 | { |
225 | u64 reg; |
226 | struct pio_buf *pbuf; |
227 | + LIST_HEAD(wake_list); |
228 | |
229 | if (!sc) |
230 | return; |
231 | @@ -954,19 +955,21 @@ void sc_disable(struct send_context *sc) |
232 | spin_unlock(&sc->release_lock); |
233 | |
234 | write_seqlock(&sc->waitlock); |
235 | - while (!list_empty(&sc->piowait)) { |
236 | + if (!list_empty(&sc->piowait)) |
237 | + list_move(&sc->piowait, &wake_list); |
238 | + write_sequnlock(&sc->waitlock); |
239 | + while (!list_empty(&wake_list)) { |
240 | struct iowait *wait; |
241 | struct rvt_qp *qp; |
242 | struct hfi1_qp_priv *priv; |
243 | |
244 | - wait = list_first_entry(&sc->piowait, struct iowait, list); |
245 | + wait = list_first_entry(&wake_list, struct iowait, list); |
246 | qp = iowait_to_qp(wait); |
247 | priv = qp->priv; |
248 | list_del_init(&priv->s_iowait.list); |
249 | priv->s_iowait.lock = NULL; |
250 | hfi1_qp_wakeup(qp, RVT_S_WAIT_PIO | HFI1_S_WAIT_PIO_DRAIN); |
251 | } |
252 | - write_sequnlock(&sc->waitlock); |
253 | |
254 | spin_unlock_irq(&sc->alloc_lock); |
255 | } |
256 | diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c |
257 | index 4540835e05bda..634f29cb7395c 100644 |
258 | --- a/drivers/infiniband/hw/mlx5/qp.c |
259 | +++ b/drivers/infiniband/hw/mlx5/qp.c |
260 | @@ -3865,6 +3865,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, |
261 | MLX5_SET(dctc, dctc, mtu, attr->path_mtu); |
262 | MLX5_SET(dctc, dctc, my_addr_index, attr->ah_attr.grh.sgid_index); |
263 | MLX5_SET(dctc, dctc, hop_limit, attr->ah_attr.grh.hop_limit); |
264 | + if (attr->ah_attr.type == RDMA_AH_ATTR_TYPE_ROCE) |
265 | + MLX5_SET(dctc, dctc, eth_prio, attr->ah_attr.sl & 0x7); |
266 | |
267 | err = mlx5_core_create_dct(dev->mdev, &qp->dct.mdct, qp->dct.in, |
268 | MLX5_ST_SZ_BYTES(create_dct_in), out, |
269 | diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c |
270 | index 05190edc2611e..5fd28574124fb 100644 |
271 | --- a/drivers/infiniband/hw/qib/qib_user_sdma.c |
272 | +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c |
273 | @@ -602,7 +602,7 @@ done: |
274 | /* |
275 | * How many pages in this iovec element? |
276 | */ |
277 | -static int qib_user_sdma_num_pages(const struct iovec *iov) |
278 | +static size_t qib_user_sdma_num_pages(const struct iovec *iov) |
279 | { |
280 | const unsigned long addr = (unsigned long) iov->iov_base; |
281 | const unsigned long len = iov->iov_len; |
282 | @@ -658,7 +658,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev, |
283 | static int qib_user_sdma_pin_pages(const struct qib_devdata *dd, |
284 | struct qib_user_sdma_queue *pq, |
285 | struct qib_user_sdma_pkt *pkt, |
286 | - unsigned long addr, int tlen, int npages) |
287 | + unsigned long addr, int tlen, size_t npages) |
288 | { |
289 | struct page *pages[8]; |
290 | int i, j; |
291 | @@ -722,7 +722,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd, |
292 | unsigned long idx; |
293 | |
294 | for (idx = 0; idx < niov; idx++) { |
295 | - const int npages = qib_user_sdma_num_pages(iov + idx); |
296 | + const size_t npages = qib_user_sdma_num_pages(iov + idx); |
297 | const unsigned long addr = (unsigned long) iov[idx].iov_base; |
298 | |
299 | ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr, |
300 | @@ -824,8 +824,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, |
301 | unsigned pktnw; |
302 | unsigned pktnwc; |
303 | int nfrags = 0; |
304 | - int npages = 0; |
305 | - int bytes_togo = 0; |
306 | + size_t npages = 0; |
307 | + size_t bytes_togo = 0; |
308 | int tiddma = 0; |
309 | int cfur; |
310 | |
311 | @@ -885,7 +885,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, |
312 | |
313 | npages += qib_user_sdma_num_pages(&iov[idx]); |
314 | |
315 | - bytes_togo += slen; |
316 | + if (check_add_overflow(bytes_togo, slen, &bytes_togo) || |
317 | + bytes_togo > type_max(typeof(pkt->bytes_togo))) { |
318 | + ret = -EINVAL; |
319 | + goto free_pbc; |
320 | + } |
321 | pktnwc += slen >> 2; |
322 | idx++; |
323 | nfrags++; |
324 | @@ -904,8 +908,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, |
325 | } |
326 | |
327 | if (frag_size) { |
328 | - int tidsmsize, n; |
329 | - size_t pktsize; |
330 | + size_t tidsmsize, n, pktsize, sz, addrlimit; |
331 | |
332 | n = npages*((2*PAGE_SIZE/frag_size)+1); |
333 | pktsize = struct_size(pkt, addr, n); |
334 | @@ -923,14 +926,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, |
335 | else |
336 | tidsmsize = 0; |
337 | |
338 | - pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL); |
339 | + if (check_add_overflow(pktsize, tidsmsize, &sz)) { |
340 | + ret = -EINVAL; |
341 | + goto free_pbc; |
342 | + } |
343 | + pkt = kmalloc(sz, GFP_KERNEL); |
344 | if (!pkt) { |
345 | ret = -ENOMEM; |
346 | goto free_pbc; |
347 | } |
348 | pkt->largepkt = 1; |
349 | pkt->frag_size = frag_size; |
350 | - pkt->addrlimit = n + ARRAY_SIZE(pkt->addr); |
351 | + if (check_add_overflow(n, ARRAY_SIZE(pkt->addr), |
352 | + &addrlimit) || |
353 | + addrlimit > type_max(typeof(pkt->addrlimit))) { |
354 | + ret = -EINVAL; |
355 | + goto free_pbc; |
356 | + } |
357 | + pkt->addrlimit = addrlimit; |
358 | |
359 | if (tiddma) { |
360 | char *tidsm = (char *)pkt + pktsize; |
361 | diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c |
362 | index 2d65b32d205a5..ec56464eaf23e 100644 |
363 | --- a/drivers/mmc/host/cqhci.c |
364 | +++ b/drivers/mmc/host/cqhci.c |
365 | @@ -273,6 +273,9 @@ static void __cqhci_enable(struct cqhci_host *cq_host) |
366 | |
367 | cqhci_writel(cq_host, cqcfg, CQHCI_CFG); |
368 | |
369 | + if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT) |
370 | + cqhci_writel(cq_host, 0, CQHCI_CTL); |
371 | + |
372 | mmc->cqe_on = true; |
373 | |
374 | if (cq_host->ops->enable) |
375 | diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c |
376 | index 5e3d95b636769..ae2c74186e1d2 100644 |
377 | --- a/drivers/mmc/host/dw_mmc-exynos.c |
378 | +++ b/drivers/mmc/host/dw_mmc-exynos.c |
379 | @@ -462,6 +462,18 @@ static s8 dw_mci_exynos_get_best_clksmpl(u8 candiates) |
380 | } |
381 | } |
382 | |
383 | + /* |
384 | + * If there is no cadiates value, then it needs to return -EIO. |
385 | + * If there are candiates values and don't find bset clk sample value, |
386 | + * then use a first candiates clock sample value. |
387 | + */ |
388 | + for (i = 0; i < iter; i++) { |
389 | + __c = ror8(candiates, i); |
390 | + if ((__c & 0x1) == 0x1) { |
391 | + loc = i; |
392 | + goto out; |
393 | + } |
394 | + } |
395 | out: |
396 | return loc; |
397 | } |
398 | @@ -492,6 +504,8 @@ static int dw_mci_exynos_execute_tuning(struct dw_mci_slot *slot, u32 opcode) |
399 | priv->tuned_sample = found; |
400 | } else { |
401 | ret = -EIO; |
402 | + dev_warn(&mmc->class_dev, |
403 | + "There is no candiates value about clksmpl!\n"); |
404 | } |
405 | |
406 | return ret; |
407 | diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c |
408 | index 771676209005b..2c01e2ebef7aa 100644 |
409 | --- a/drivers/mmc/host/sdhci-esdhc-imx.c |
410 | +++ b/drivers/mmc/host/sdhci-esdhc-imx.c |
411 | @@ -24,6 +24,7 @@ |
412 | #include <linux/pinctrl/consumer.h> |
413 | #include <linux/platform_data/mmc-esdhc-imx.h> |
414 | #include <linux/pm_runtime.h> |
415 | +#include <linux/iopoll.h> |
416 | #include "sdhci-pltfm.h" |
417 | #include "sdhci-esdhc.h" |
418 | #include "cqhci.h" |
419 | @@ -1022,6 +1023,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host) |
420 | struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); |
421 | struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); |
422 | u32 ctrl; |
423 | + int ret; |
424 | |
425 | /* Reset the tuning circuit */ |
426 | if (esdhc_is_usdhc(imx_data)) { |
427 | @@ -1034,7 +1036,22 @@ static void esdhc_reset_tuning(struct sdhci_host *host) |
428 | } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) { |
429 | ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS); |
430 | ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL; |
431 | + ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE; |
432 | writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS); |
433 | + /* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */ |
434 | + ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS, |
435 | + ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50); |
436 | + if (ret == -ETIMEDOUT) |
437 | + dev_warn(mmc_dev(host->mmc), |
438 | + "Warning! clear execute tuning bit failed\n"); |
439 | + /* |
440 | + * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the |
441 | + * usdhc IP internal logic flag execute_tuning_with_clr_buf, which |
442 | + * will finally make sure the normal data transfer logic correct. |
443 | + */ |
444 | + ctrl = readl(host->ioaddr + SDHCI_INT_STATUS); |
445 | + ctrl |= SDHCI_INT_DATA_AVAIL; |
446 | + writel(ctrl, host->ioaddr + SDHCI_INT_STATUS); |
447 | } |
448 | } |
449 | } |
450 | diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c |
451 | index 2ecd9acebb2f0..cb54fa2120d72 100644 |
452 | --- a/drivers/mmc/host/sdhci.c |
453 | +++ b/drivers/mmc/host/sdhci.c |
454 | @@ -1741,6 +1741,12 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode, |
455 | break; |
456 | case MMC_VDD_32_33: |
457 | case MMC_VDD_33_34: |
458 | + /* |
459 | + * 3.4 ~ 3.6V are valid only for those platforms where it's |
460 | + * known that the voltage range is supported by hardware. |
461 | + */ |
462 | + case MMC_VDD_34_35: |
463 | + case MMC_VDD_35_36: |
464 | pwr = SDHCI_POWER_330; |
465 | break; |
466 | default: |
467 | diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c |
468 | index 156046e56a584..5e1d7025dbf78 100644 |
469 | --- a/drivers/mmc/host/vub300.c |
470 | +++ b/drivers/mmc/host/vub300.c |
471 | @@ -576,7 +576,7 @@ static void check_vub300_port_status(struct vub300_mmc_host *vub300) |
472 | GET_SYSTEM_PORT_STATUS, |
473 | USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, |
474 | 0x0000, 0x0000, &vub300->system_port_status, |
475 | - sizeof(vub300->system_port_status), HZ); |
476 | + sizeof(vub300->system_port_status), 1000); |
477 | if (sizeof(vub300->system_port_status) == retval) |
478 | new_system_port_status(vub300); |
479 | } |
480 | @@ -1241,7 +1241,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300, |
481 | SET_INTERRUPT_PSEUDOCODE, |
482 | USB_DIR_OUT | USB_TYPE_VENDOR | |
483 | USB_RECIP_DEVICE, 0x0000, 0x0000, |
484 | - xfer_buffer, xfer_length, HZ); |
485 | + xfer_buffer, xfer_length, 1000); |
486 | kfree(xfer_buffer); |
487 | if (retval < 0) |
488 | goto copy_error_message; |
489 | @@ -1284,7 +1284,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300, |
490 | SET_TRANSFER_PSEUDOCODE, |
491 | USB_DIR_OUT | USB_TYPE_VENDOR | |
492 | USB_RECIP_DEVICE, 0x0000, 0x0000, |
493 | - xfer_buffer, xfer_length, HZ); |
494 | + xfer_buffer, xfer_length, 1000); |
495 | kfree(xfer_buffer); |
496 | if (retval < 0) |
497 | goto copy_error_message; |
498 | @@ -1991,7 +1991,7 @@ static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8], |
499 | usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), |
500 | SET_CLOCK_SPEED, |
501 | USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, |
502 | - 0x00, 0x00, buf, buf_array_size, HZ); |
503 | + 0x00, 0x00, buf, buf_array_size, 1000); |
504 | if (retval != 8) { |
505 | dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED" |
506 | " %dkHz failed with retval=%d\n", kHzClock, retval); |
507 | @@ -2013,14 +2013,14 @@ static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) |
508 | usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), |
509 | SET_SD_POWER, |
510 | USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, |
511 | - 0x0000, 0x0000, NULL, 0, HZ); |
512 | + 0x0000, 0x0000, NULL, 0, 1000); |
513 | /* must wait for the VUB300 u-proc to boot up */ |
514 | msleep(600); |
515 | } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) { |
516 | usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), |
517 | SET_SD_POWER, |
518 | USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, |
519 | - 0x0001, 0x0000, NULL, 0, HZ); |
520 | + 0x0001, 0x0000, NULL, 0, 1000); |
521 | msleep(600); |
522 | vub300->card_powered = 1; |
523 | } else if (ios->power_mode == MMC_POWER_ON) { |
524 | @@ -2282,14 +2282,14 @@ static int vub300_probe(struct usb_interface *interface, |
525 | GET_HC_INF0, |
526 | USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, |
527 | 0x0000, 0x0000, &vub300->hc_info, |
528 | - sizeof(vub300->hc_info), HZ); |
529 | + sizeof(vub300->hc_info), 1000); |
530 | if (retval < 0) |
531 | goto error5; |
532 | retval = |
533 | usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), |
534 | SET_ROM_WAIT_STATES, |
535 | USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, |
536 | - firmware_rom_wait_states, 0x0000, NULL, 0, HZ); |
537 | + firmware_rom_wait_states, 0x0000, NULL, 0, 1000); |
538 | if (retval < 0) |
539 | goto error5; |
540 | dev_info(&vub300->udev->dev, |
541 | @@ -2304,7 +2304,7 @@ static int vub300_probe(struct usb_interface *interface, |
542 | GET_SYSTEM_PORT_STATUS, |
543 | USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, |
544 | 0x0000, 0x0000, &vub300->system_port_status, |
545 | - sizeof(vub300->system_port_status), HZ); |
546 | + sizeof(vub300->system_port_status), 1000); |
547 | if (retval < 0) { |
548 | goto error4; |
549 | } else if (sizeof(vub300->system_port_status) == retval) { |
550 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c |
551 | index 1949f631e1bc5..a7eaf80f500c0 100644 |
552 | --- a/drivers/net/bonding/bond_main.c |
553 | +++ b/drivers/net/bonding/bond_main.c |
554 | @@ -1219,7 +1219,7 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb) |
555 | skb->dev = bond->dev; |
556 | |
557 | if (BOND_MODE(bond) == BOND_MODE_ALB && |
558 | - bond->dev->priv_flags & IFF_BRIDGE_PORT && |
559 | + netif_is_bridge_port(bond->dev) && |
560 | skb->pkt_type == PACKET_HOST) { |
561 | |
562 | if (unlikely(skb_cow_head(skb, |
563 | diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c |
564 | index 7dc451fdaf35e..2431723bc2fb4 100644 |
565 | --- a/drivers/net/ethernet/micrel/ksz884x.c |
566 | +++ b/drivers/net/ethernet/micrel/ksz884x.c |
567 | @@ -5693,7 +5693,7 @@ static void dev_set_promiscuous(struct net_device *dev, struct dev_priv *priv, |
568 | * from the bridge. |
569 | */ |
570 | if ((hw->features & STP_SUPPORT) && !promiscuous && |
571 | - (dev->priv_flags & IFF_BRIDGE_PORT)) { |
572 | + netif_is_bridge_port(dev)) { |
573 | struct ksz_switch *sw = hw->ksz_switch; |
574 | int port = priv->port.first_port; |
575 | |
576 | diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c |
577 | index dfa0ded169ee9..a109120da0e7c 100644 |
578 | --- a/drivers/net/ethernet/microchip/lan743x_main.c |
579 | +++ b/drivers/net/ethernet/microchip/lan743x_main.c |
580 | @@ -1706,6 +1706,16 @@ static int lan743x_tx_ring_init(struct lan743x_tx *tx) |
581 | ret = -EINVAL; |
582 | goto cleanup; |
583 | } |
584 | + if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev, |
585 | + DMA_BIT_MASK(64))) { |
586 | + if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev, |
587 | + DMA_BIT_MASK(32))) { |
588 | + dev_warn(&tx->adapter->pdev->dev, |
589 | + "lan743x_: No suitable DMA available\n"); |
590 | + ret = -ENOMEM; |
591 | + goto cleanup; |
592 | + } |
593 | + } |
594 | ring_allocation_size = ALIGN(tx->ring_size * |
595 | sizeof(struct lan743x_tx_descriptor), |
596 | PAGE_SIZE); |
597 | @@ -2256,6 +2266,16 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx) |
598 | ret = -EINVAL; |
599 | goto cleanup; |
600 | } |
601 | + if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev, |
602 | + DMA_BIT_MASK(64))) { |
603 | + if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev, |
604 | + DMA_BIT_MASK(32))) { |
605 | + dev_warn(&rx->adapter->pdev->dev, |
606 | + "lan743x_: No suitable DMA available\n"); |
607 | + ret = -ENOMEM; |
608 | + goto cleanup; |
609 | + } |
610 | + } |
611 | ring_allocation_size = ALIGN(rx->ring_size * |
612 | sizeof(struct lan743x_rx_descriptor), |
613 | PAGE_SIZE); |
614 | @@ -3001,6 +3021,8 @@ static int lan743x_pm_resume(struct device *dev) |
615 | if (ret) { |
616 | netif_err(adapter, probe, adapter->netdev, |
617 | "lan743x_hardware_init returned %d\n", ret); |
618 | + lan743x_pci_cleanup(adapter); |
619 | + return ret; |
620 | } |
621 | |
622 | /* open netdev when netdev is at running state while resume. |
623 | diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c |
624 | index 1d59ef367a85c..3b177421651f1 100644 |
625 | --- a/drivers/net/ethernet/nxp/lpc_eth.c |
626 | +++ b/drivers/net/ethernet/nxp/lpc_eth.c |
627 | @@ -1007,9 +1007,6 @@ static int lpc_eth_close(struct net_device *ndev) |
628 | napi_disable(&pldat->napi); |
629 | netif_stop_queue(ndev); |
630 | |
631 | - if (ndev->phydev) |
632 | - phy_stop(ndev->phydev); |
633 | - |
634 | spin_lock_irqsave(&pldat->lock, flags); |
635 | __lpc_eth_reset(pldat); |
636 | netif_carrier_off(ndev); |
637 | @@ -1017,6 +1014,8 @@ static int lpc_eth_close(struct net_device *ndev) |
638 | writel(0, LPC_ENET_MAC2(pldat->net_base)); |
639 | spin_unlock_irqrestore(&pldat->lock, flags); |
640 | |
641 | + if (ndev->phydev) |
642 | + phy_stop(ndev->phydev); |
643 | clk_disable_unprepare(pldat->clk); |
644 | |
645 | return 0; |
646 | diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c |
647 | index 8377ff229a303..bec73f0640d03 100644 |
648 | --- a/drivers/net/phy/mdio_bus.c |
649 | +++ b/drivers/net/phy/mdio_bus.c |
650 | @@ -395,7 +395,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) |
651 | err = device_register(&bus->dev); |
652 | if (err) { |
653 | pr_err("mii_bus %s failed to register\n", bus->id); |
654 | - put_device(&bus->dev); |
655 | return -EINVAL; |
656 | } |
657 | |
658 | diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c |
659 | index b0b8a3ce82b68..6c52ff8c0d2eb 100644 |
660 | --- a/drivers/net/phy/phy.c |
661 | +++ b/drivers/net/phy/phy.c |
662 | @@ -367,6 +367,7 @@ EXPORT_SYMBOL(phy_ethtool_ksettings_set); |
663 | void phy_ethtool_ksettings_get(struct phy_device *phydev, |
664 | struct ethtool_link_ksettings *cmd) |
665 | { |
666 | + mutex_lock(&phydev->lock); |
667 | linkmode_copy(cmd->link_modes.supported, phydev->supported); |
668 | linkmode_copy(cmd->link_modes.advertising, phydev->advertising); |
669 | linkmode_copy(cmd->link_modes.lp_advertising, phydev->lp_advertising); |
670 | @@ -383,6 +384,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev, |
671 | cmd->base.autoneg = phydev->autoneg; |
672 | cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl; |
673 | cmd->base.eth_tp_mdix = phydev->mdix; |
674 | + mutex_unlock(&phydev->lock); |
675 | } |
676 | EXPORT_SYMBOL(phy_ethtool_ksettings_get); |
677 | |
678 | @@ -553,7 +555,7 @@ static int phy_check_link_status(struct phy_device *phydev) |
679 | } |
680 | |
681 | /** |
682 | - * phy_start_aneg - start auto-negotiation for this PHY device |
683 | + * _phy_start_aneg - start auto-negotiation for this PHY device |
684 | * @phydev: the phy_device struct |
685 | * |
686 | * Description: Sanitizes the settings (if we're not autonegotiating |
687 | @@ -561,25 +563,43 @@ static int phy_check_link_status(struct phy_device *phydev) |
688 | * If the PHYCONTROL Layer is operating, we change the state to |
689 | * reflect the beginning of Auto-negotiation or forcing. |
690 | */ |
691 | -int phy_start_aneg(struct phy_device *phydev) |
692 | +static int _phy_start_aneg(struct phy_device *phydev) |
693 | { |
694 | int err; |
695 | |
696 | + lockdep_assert_held(&phydev->lock); |
697 | + |
698 | if (!phydev->drv) |
699 | return -EIO; |
700 | |
701 | - mutex_lock(&phydev->lock); |
702 | - |
703 | if (AUTONEG_DISABLE == phydev->autoneg) |
704 | phy_sanitize_settings(phydev); |
705 | |
706 | err = phy_config_aneg(phydev); |
707 | if (err < 0) |
708 | - goto out_unlock; |
709 | + return err; |
710 | |
711 | if (phy_is_started(phydev)) |
712 | err = phy_check_link_status(phydev); |
713 | -out_unlock: |
714 | + |
715 | + return err; |
716 | +} |
717 | + |
718 | +/** |
719 | + * phy_start_aneg - start auto-negotiation for this PHY device |
720 | + * @phydev: the phy_device struct |
721 | + * |
722 | + * Description: Sanitizes the settings (if we're not autonegotiating |
723 | + * them), and then calls the driver's config_aneg function. |
724 | + * If the PHYCONTROL Layer is operating, we change the state to |
725 | + * reflect the beginning of Auto-negotiation or forcing. |
726 | + */ |
727 | +int phy_start_aneg(struct phy_device *phydev) |
728 | +{ |
729 | + int err; |
730 | + |
731 | + mutex_lock(&phydev->lock); |
732 | + err = _phy_start_aneg(phydev); |
733 | mutex_unlock(&phydev->lock); |
734 | |
735 | return err; |
736 | diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c |
737 | index 92d9d3407b79b..fe830b72c3b0f 100644 |
738 | --- a/drivers/net/usb/lan78xx.c |
739 | +++ b/drivers/net/usb/lan78xx.c |
740 | @@ -3753,6 +3753,12 @@ static int lan78xx_probe(struct usb_interface *intf, |
741 | |
742 | dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1); |
743 | |
744 | + /* Reject broken descriptors. */ |
745 | + if (dev->maxpacket == 0) { |
746 | + ret = -ENODEV; |
747 | + goto out4; |
748 | + } |
749 | + |
750 | /* driver requires remote-wakeup capability during autosuspend. */ |
751 | intf->needs_remote_wakeup = 1; |
752 | |
753 | diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c |
754 | index dde05e2fdc3e6..b8b9df82f51ef 100644 |
755 | --- a/drivers/net/usb/usbnet.c |
756 | +++ b/drivers/net/usb/usbnet.c |
757 | @@ -1773,6 +1773,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) |
758 | if (!dev->rx_urb_size) |
759 | dev->rx_urb_size = dev->hard_mtu; |
760 | dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1); |
761 | + if (dev->maxpacket == 0) { |
762 | + /* that is a broken device */ |
763 | + status = -ENODEV; |
764 | + goto out4; |
765 | + } |
766 | |
767 | /* let userspace know we have a random address */ |
768 | if (ether_addr_equal(net->dev_addr, node_id)) |
769 | diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c |
770 | index 8e4d355dc3aec..1caebefb25ff1 100644 |
771 | --- a/drivers/nfc/port100.c |
772 | +++ b/drivers/nfc/port100.c |
773 | @@ -1003,11 +1003,11 @@ static u64 port100_get_command_type_mask(struct port100 *dev) |
774 | |
775 | skb = port100_alloc_skb(dev, 0); |
776 | if (!skb) |
777 | - return -ENOMEM; |
778 | + return 0; |
779 | |
780 | resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb); |
781 | if (IS_ERR(resp)) |
782 | - return PTR_ERR(resp); |
783 | + return 0; |
784 | |
785 | if (resp->len < 8) |
786 | mask = 0; |
787 | diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c |
788 | index 38bbbbbc6f47f..ff0d06e8ebb53 100644 |
789 | --- a/drivers/nvme/host/tcp.c |
790 | +++ b/drivers/nvme/host/tcp.c |
791 | @@ -962,7 +962,7 @@ static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req) |
792 | int ret; |
793 | struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_EOR }; |
794 | struct kvec iov = { |
795 | - .iov_base = &req->ddgst + req->offset, |
796 | + .iov_base = (u8 *)&req->ddgst + req->offset, |
797 | .iov_len = NVME_TCP_DIGEST_LENGTH - req->offset |
798 | }; |
799 | |
800 | diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c |
801 | index 2ae846297d7ca..2f4e512bd449f 100644 |
802 | --- a/drivers/nvme/target/tcp.c |
803 | +++ b/drivers/nvme/target/tcp.c |
804 | @@ -633,7 +633,7 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd) |
805 | struct nvmet_tcp_queue *queue = cmd->queue; |
806 | struct msghdr msg = { .msg_flags = MSG_DONTWAIT }; |
807 | struct kvec iov = { |
808 | - .iov_base = &cmd->exp_ddgst + cmd->offset, |
809 | + .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset, |
810 | .iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset |
811 | }; |
812 | int ret; |
813 | diff --git a/drivers/pinctrl/bcm/pinctrl-ns.c b/drivers/pinctrl/bcm/pinctrl-ns.c |
814 | index e79690bd8b85f..d7f8175d2c1c8 100644 |
815 | --- a/drivers/pinctrl/bcm/pinctrl-ns.c |
816 | +++ b/drivers/pinctrl/bcm/pinctrl-ns.c |
817 | @@ -5,7 +5,6 @@ |
818 | |
819 | #include <linux/err.h> |
820 | #include <linux/io.h> |
821 | -#include <linux/mfd/syscon.h> |
822 | #include <linux/module.h> |
823 | #include <linux/of.h> |
824 | #include <linux/of_device.h> |
825 | @@ -13,7 +12,6 @@ |
826 | #include <linux/pinctrl/pinctrl.h> |
827 | #include <linux/pinctrl/pinmux.h> |
828 | #include <linux/platform_device.h> |
829 | -#include <linux/regmap.h> |
830 | #include <linux/slab.h> |
831 | |
832 | #define FLAG_BCM4708 BIT(1) |
833 | @@ -24,8 +22,7 @@ struct ns_pinctrl { |
834 | struct device *dev; |
835 | unsigned int chipset_flag; |
836 | struct pinctrl_dev *pctldev; |
837 | - struct regmap *regmap; |
838 | - u32 offset; |
839 | + void __iomem *base; |
840 | |
841 | struct pinctrl_desc pctldesc; |
842 | struct ns_pinctrl_group *groups; |
843 | @@ -232,9 +229,9 @@ static int ns_pinctrl_set_mux(struct pinctrl_dev *pctrl_dev, |
844 | unset |= BIT(pin_number); |
845 | } |
846 | |
847 | - regmap_read(ns_pinctrl->regmap, ns_pinctrl->offset, &tmp); |
848 | + tmp = readl(ns_pinctrl->base); |
849 | tmp &= ~unset; |
850 | - regmap_write(ns_pinctrl->regmap, ns_pinctrl->offset, tmp); |
851 | + writel(tmp, ns_pinctrl->base); |
852 | |
853 | return 0; |
854 | } |
855 | @@ -266,13 +263,13 @@ static const struct of_device_id ns_pinctrl_of_match_table[] = { |
856 | static int ns_pinctrl_probe(struct platform_device *pdev) |
857 | { |
858 | struct device *dev = &pdev->dev; |
859 | - struct device_node *np = dev->of_node; |
860 | const struct of_device_id *of_id; |
861 | struct ns_pinctrl *ns_pinctrl; |
862 | struct pinctrl_desc *pctldesc; |
863 | struct pinctrl_pin_desc *pin; |
864 | struct ns_pinctrl_group *group; |
865 | struct ns_pinctrl_function *function; |
866 | + struct resource *res; |
867 | int i; |
868 | |
869 | ns_pinctrl = devm_kzalloc(dev, sizeof(*ns_pinctrl), GFP_KERNEL); |
870 | @@ -290,18 +287,12 @@ static int ns_pinctrl_probe(struct platform_device *pdev) |
871 | return -EINVAL; |
872 | ns_pinctrl->chipset_flag = (uintptr_t)of_id->data; |
873 | |
874 | - ns_pinctrl->regmap = syscon_node_to_regmap(of_get_parent(np)); |
875 | - if (IS_ERR(ns_pinctrl->regmap)) { |
876 | - int err = PTR_ERR(ns_pinctrl->regmap); |
877 | - |
878 | - dev_err(dev, "Failed to map pinctrl regs: %d\n", err); |
879 | - |
880 | - return err; |
881 | - } |
882 | - |
883 | - if (of_property_read_u32(np, "offset", &ns_pinctrl->offset)) { |
884 | - dev_err(dev, "Failed to get register offset\n"); |
885 | - return -ENOENT; |
886 | + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, |
887 | + "cru_gpio_control"); |
888 | + ns_pinctrl->base = devm_ioremap_resource(dev, res); |
889 | + if (IS_ERR(ns_pinctrl->base)) { |
890 | + dev_err(dev, "Failed to map pinctrl regs\n"); |
891 | + return PTR_ERR(ns_pinctrl->base); |
892 | } |
893 | |
894 | memcpy(pctldesc, &ns_pinctrl_desc, sizeof(*pctldesc)); |
895 | diff --git a/include/net/tls.h b/include/net/tls.h |
896 | index 697df45c0bcee..7f220e03ebb2d 100644 |
897 | --- a/include/net/tls.h |
898 | +++ b/include/net/tls.h |
899 | @@ -360,6 +360,7 @@ int tls_sk_query(struct sock *sk, int optname, char __user *optval, |
900 | int __user *optlen); |
901 | int tls_sk_attach(struct sock *sk, int optname, char __user *optval, |
902 | unsigned int optlen); |
903 | +void tls_err_abort(struct sock *sk, int err); |
904 | |
905 | int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx); |
906 | void tls_sw_strparser_arm(struct sock *sk, struct tls_context *ctx); |
907 | @@ -465,12 +466,6 @@ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk) |
908 | #endif |
909 | } |
910 | |
911 | -static inline void tls_err_abort(struct sock *sk, int err) |
912 | -{ |
913 | - sk->sk_err = err; |
914 | - sk->sk_error_report(sk); |
915 | -} |
916 | - |
917 | static inline bool tls_bigint_increment(unsigned char *seq, int len) |
918 | { |
919 | int i; |
920 | @@ -499,7 +494,7 @@ static inline void tls_advance_record_sn(struct sock *sk, |
921 | struct cipher_context *ctx) |
922 | { |
923 | if (tls_bigint_increment(ctx->rec_seq, prot->rec_seq_size)) |
924 | - tls_err_abort(sk, EBADMSG); |
925 | + tls_err_abort(sk, -EBADMSG); |
926 | |
927 | if (prot->version != TLS_1_3_VERSION) |
928 | tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, |
929 | diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c |
930 | index a6b26ca5c6973..2e818eca3e1c6 100644 |
931 | --- a/net/batman-adv/bridge_loop_avoidance.c |
932 | +++ b/net/batman-adv/bridge_loop_avoidance.c |
933 | @@ -1561,10 +1561,14 @@ int batadv_bla_init(struct batadv_priv *bat_priv) |
934 | return 0; |
935 | |
936 | bat_priv->bla.claim_hash = batadv_hash_new(128); |
937 | - bat_priv->bla.backbone_hash = batadv_hash_new(32); |
938 | + if (!bat_priv->bla.claim_hash) |
939 | + return -ENOMEM; |
940 | |
941 | - if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash) |
942 | + bat_priv->bla.backbone_hash = batadv_hash_new(32); |
943 | + if (!bat_priv->bla.backbone_hash) { |
944 | + batadv_hash_destroy(bat_priv->bla.claim_hash); |
945 | return -ENOMEM; |
946 | + } |
947 | |
948 | batadv_hash_set_lock_class(bat_priv->bla.claim_hash, |
949 | &batadv_claim_hash_lock_class_key); |
950 | diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c |
951 | index 4a89177def647..6a183c94cdeb4 100644 |
952 | --- a/net/batman-adv/main.c |
953 | +++ b/net/batman-adv/main.c |
954 | @@ -197,29 +197,41 @@ int batadv_mesh_init(struct net_device *soft_iface) |
955 | |
956 | bat_priv->gw.generation = 0; |
957 | |
958 | - ret = batadv_v_mesh_init(bat_priv); |
959 | - if (ret < 0) |
960 | - goto err; |
961 | - |
962 | ret = batadv_originator_init(bat_priv); |
963 | - if (ret < 0) |
964 | - goto err; |
965 | + if (ret < 0) { |
966 | + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); |
967 | + goto err_orig; |
968 | + } |
969 | |
970 | ret = batadv_tt_init(bat_priv); |
971 | - if (ret < 0) |
972 | - goto err; |
973 | + if (ret < 0) { |
974 | + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); |
975 | + goto err_tt; |
976 | + } |
977 | + |
978 | + ret = batadv_v_mesh_init(bat_priv); |
979 | + if (ret < 0) { |
980 | + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); |
981 | + goto err_v; |
982 | + } |
983 | |
984 | ret = batadv_bla_init(bat_priv); |
985 | - if (ret < 0) |
986 | - goto err; |
987 | + if (ret < 0) { |
988 | + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); |
989 | + goto err_bla; |
990 | + } |
991 | |
992 | ret = batadv_dat_init(bat_priv); |
993 | - if (ret < 0) |
994 | - goto err; |
995 | + if (ret < 0) { |
996 | + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); |
997 | + goto err_dat; |
998 | + } |
999 | |
1000 | ret = batadv_nc_mesh_init(bat_priv); |
1001 | - if (ret < 0) |
1002 | - goto err; |
1003 | + if (ret < 0) { |
1004 | + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); |
1005 | + goto err_nc; |
1006 | + } |
1007 | |
1008 | batadv_gw_init(bat_priv); |
1009 | batadv_mcast_init(bat_priv); |
1010 | @@ -229,8 +241,20 @@ int batadv_mesh_init(struct net_device *soft_iface) |
1011 | |
1012 | return 0; |
1013 | |
1014 | -err: |
1015 | - batadv_mesh_free(soft_iface); |
1016 | +err_nc: |
1017 | + batadv_dat_free(bat_priv); |
1018 | +err_dat: |
1019 | + batadv_bla_free(bat_priv); |
1020 | +err_bla: |
1021 | + batadv_v_mesh_free(bat_priv); |
1022 | +err_v: |
1023 | + batadv_tt_free(bat_priv); |
1024 | +err_tt: |
1025 | + batadv_originator_free(bat_priv); |
1026 | +err_orig: |
1027 | + batadv_purge_outstanding_packets(bat_priv, NULL); |
1028 | + atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE); |
1029 | + |
1030 | return ret; |
1031 | } |
1032 | |
1033 | diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c |
1034 | index 70e3b161c6635..850f927f33de2 100644 |
1035 | --- a/net/batman-adv/network-coding.c |
1036 | +++ b/net/batman-adv/network-coding.c |
1037 | @@ -155,8 +155,10 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv) |
1038 | &batadv_nc_coding_hash_lock_class_key); |
1039 | |
1040 | bat_priv->nc.decoding_hash = batadv_hash_new(128); |
1041 | - if (!bat_priv->nc.decoding_hash) |
1042 | + if (!bat_priv->nc.decoding_hash) { |
1043 | + batadv_hash_destroy(bat_priv->nc.coding_hash); |
1044 | goto err; |
1045 | + } |
1046 | |
1047 | batadv_hash_set_lock_class(bat_priv->nc.decoding_hash, |
1048 | &batadv_nc_decoding_hash_lock_class_key); |
1049 | diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c |
1050 | index c5271ea4dc832..515205d7b650f 100644 |
1051 | --- a/net/batman-adv/translation-table.c |
1052 | +++ b/net/batman-adv/translation-table.c |
1053 | @@ -4405,8 +4405,10 @@ int batadv_tt_init(struct batadv_priv *bat_priv) |
1054 | return ret; |
1055 | |
1056 | ret = batadv_tt_global_init(bat_priv); |
1057 | - if (ret < 0) |
1058 | + if (ret < 0) { |
1059 | + batadv_tt_local_table_free(bat_priv); |
1060 | return ret; |
1061 | + } |
1062 | |
1063 | batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1, |
1064 | batadv_tt_tvlv_unicast_handler_v1, |
1065 | diff --git a/net/core/dev.c b/net/core/dev.c |
1066 | index 3810eaf89b266..e4e492bf72af0 100644 |
1067 | --- a/net/core/dev.c |
1068 | +++ b/net/core/dev.c |
1069 | @@ -2787,6 +2787,12 @@ static u16 skb_tx_hash(const struct net_device *dev, |
1070 | |
1071 | qoffset = sb_dev->tc_to_txq[tc].offset; |
1072 | qcount = sb_dev->tc_to_txq[tc].count; |
1073 | + if (unlikely(!qcount)) { |
1074 | + net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n", |
1075 | + sb_dev->name, qoffset, tc); |
1076 | + qoffset = 0; |
1077 | + qcount = dev->real_num_tx_queues; |
1078 | + } |
1079 | } |
1080 | |
1081 | if (skb_rx_queue_recorded(skb)) { |
1082 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
1083 | index a53b101ce41ae..55c0f32b9375b 100644 |
1084 | --- a/net/core/rtnetlink.c |
1085 | +++ b/net/core/rtnetlink.c |
1086 | @@ -3729,7 +3729,7 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, |
1087 | |
1088 | /* Support fdb on master device the net/bridge default case */ |
1089 | if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) && |
1090 | - (dev->priv_flags & IFF_BRIDGE_PORT)) { |
1091 | + netif_is_bridge_port(dev)) { |
1092 | struct net_device *br_dev = netdev_master_upper_dev_get(dev); |
1093 | const struct net_device_ops *ops = br_dev->netdev_ops; |
1094 | |
1095 | @@ -3840,7 +3840,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, |
1096 | |
1097 | /* Support fdb on master device the net/bridge default case */ |
1098 | if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) && |
1099 | - (dev->priv_flags & IFF_BRIDGE_PORT)) { |
1100 | + netif_is_bridge_port(dev)) { |
1101 | struct net_device *br_dev = netdev_master_upper_dev_get(dev); |
1102 | const struct net_device_ops *ops = br_dev->netdev_ops; |
1103 | |
1104 | @@ -4066,13 +4066,13 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb) |
1105 | continue; |
1106 | |
1107 | if (!br_idx) { /* user did not specify a specific bridge */ |
1108 | - if (dev->priv_flags & IFF_BRIDGE_PORT) { |
1109 | + if (netif_is_bridge_port(dev)) { |
1110 | br_dev = netdev_master_upper_dev_get(dev); |
1111 | cops = br_dev->netdev_ops; |
1112 | } |
1113 | } else { |
1114 | if (dev != br_dev && |
1115 | - !(dev->priv_flags & IFF_BRIDGE_PORT)) |
1116 | + !netif_is_bridge_port(dev)) |
1117 | continue; |
1118 | |
1119 | if (br_dev != netdev_master_upper_dev_get(dev) && |
1120 | @@ -4084,7 +4084,7 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb) |
1121 | if (idx < s_idx) |
1122 | goto cont; |
1123 | |
1124 | - if (dev->priv_flags & IFF_BRIDGE_PORT) { |
1125 | + if (netif_is_bridge_port(dev)) { |
1126 | if (cops && cops->ndo_fdb_dump) { |
1127 | err = cops->ndo_fdb_dump(skb, cb, |
1128 | br_dev, dev, |
1129 | @@ -4234,7 +4234,7 @@ static int rtnl_fdb_get(struct sk_buff *in_skb, struct nlmsghdr *nlh, |
1130 | |
1131 | if (dev) { |
1132 | if (!ndm_flags || (ndm_flags & NTF_MASTER)) { |
1133 | - if (!(dev->priv_flags & IFF_BRIDGE_PORT)) { |
1134 | + if (!netif_is_bridge_port(dev)) { |
1135 | NL_SET_ERR_MSG(extack, "Device is not a bridge port"); |
1136 | return -EINVAL; |
1137 | } |
1138 | diff --git a/net/ipv4/route.c b/net/ipv4/route.c |
1139 | index 539492998864e..d1feec97fa062 100644 |
1140 | --- a/net/ipv4/route.c |
1141 | +++ b/net/ipv4/route.c |
1142 | @@ -631,14 +631,14 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash) |
1143 | kfree_rcu(oldest, rcu); |
1144 | } |
1145 | |
1146 | -static inline u32 fnhe_hashfun(__be32 daddr) |
1147 | +static u32 fnhe_hashfun(__be32 daddr) |
1148 | { |
1149 | - static u32 fnhe_hashrnd __read_mostly; |
1150 | - u32 hval; |
1151 | + static siphash_key_t fnhe_hash_key __read_mostly; |
1152 | + u64 hval; |
1153 | |
1154 | - net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd)); |
1155 | - hval = jhash_1word((__force u32) daddr, fnhe_hashrnd); |
1156 | - return hash_32(hval, FNHE_HASH_SHIFT); |
1157 | + net_get_random_once(&fnhe_hash_key, sizeof(fnhe_hash_key)); |
1158 | + hval = siphash_1u32((__force u32)daddr, &fnhe_hash_key); |
1159 | + return hash_64(hval, FNHE_HASH_SHIFT); |
1160 | } |
1161 | |
1162 | static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe) |
1163 | diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c |
1164 | index 6a0c4326d9cf2..7df7ec74807ac 100644 |
1165 | --- a/net/ipv4/tcp_bpf.c |
1166 | +++ b/net/ipv4/tcp_bpf.c |
1167 | @@ -313,6 +313,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, |
1168 | bool cork = false, enospc = sk_msg_full(msg); |
1169 | struct sock *sk_redir; |
1170 | u32 tosend, delta = 0; |
1171 | + u32 eval = __SK_NONE; |
1172 | int ret; |
1173 | |
1174 | more_data: |
1175 | @@ -356,13 +357,24 @@ more_data: |
1176 | case __SK_REDIRECT: |
1177 | sk_redir = psock->sk_redir; |
1178 | sk_msg_apply_bytes(psock, tosend); |
1179 | + if (!psock->apply_bytes) { |
1180 | + /* Clean up before releasing the sock lock. */ |
1181 | + eval = psock->eval; |
1182 | + psock->eval = __SK_NONE; |
1183 | + psock->sk_redir = NULL; |
1184 | + } |
1185 | if (psock->cork) { |
1186 | cork = true; |
1187 | psock->cork = NULL; |
1188 | } |
1189 | sk_msg_return(sk, msg, tosend); |
1190 | release_sock(sk); |
1191 | + |
1192 | ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); |
1193 | + |
1194 | + if (eval == __SK_REDIRECT) |
1195 | + sock_put(sk_redir); |
1196 | + |
1197 | lock_sock(sk); |
1198 | if (unlikely(ret < 0)) { |
1199 | int free = sk_msg_free_nocharge(sk, msg); |
1200 | diff --git a/net/ipv6/route.c b/net/ipv6/route.c |
1201 | index 3fb259c20546e..daa876c6ae8db 100644 |
1202 | --- a/net/ipv6/route.c |
1203 | +++ b/net/ipv6/route.c |
1204 | @@ -41,6 +41,7 @@ |
1205 | #include <linux/nsproxy.h> |
1206 | #include <linux/slab.h> |
1207 | #include <linux/jhash.h> |
1208 | +#include <linux/siphash.h> |
1209 | #include <net/net_namespace.h> |
1210 | #include <net/snmp.h> |
1211 | #include <net/ipv6.h> |
1212 | @@ -1502,17 +1503,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket) |
1213 | static u32 rt6_exception_hash(const struct in6_addr *dst, |
1214 | const struct in6_addr *src) |
1215 | { |
1216 | - static u32 seed __read_mostly; |
1217 | - u32 val; |
1218 | + static siphash_key_t rt6_exception_key __read_mostly; |
1219 | + struct { |
1220 | + struct in6_addr dst; |
1221 | + struct in6_addr src; |
1222 | + } __aligned(SIPHASH_ALIGNMENT) combined = { |
1223 | + .dst = *dst, |
1224 | + }; |
1225 | + u64 val; |
1226 | |
1227 | - net_get_random_once(&seed, sizeof(seed)); |
1228 | - val = jhash(dst, sizeof(*dst), seed); |
1229 | + net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key)); |
1230 | |
1231 | #ifdef CONFIG_IPV6_SUBTREES |
1232 | if (src) |
1233 | - val = jhash(src, sizeof(*src), val); |
1234 | + combined.src = *src; |
1235 | #endif |
1236 | - return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT); |
1237 | + val = siphash(&combined, sizeof(combined), &rt6_exception_key); |
1238 | + |
1239 | + return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT); |
1240 | } |
1241 | |
1242 | /* Helper function to find the cached rt in the hash table |
1243 | diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c |
1244 | index 82a202d71a31e..7c6dcbc8e98ba 100644 |
1245 | --- a/net/sctp/sm_statefuns.c |
1246 | +++ b/net/sctp/sm_statefuns.c |
1247 | @@ -697,6 +697,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, |
1248 | struct sock *sk; |
1249 | int error = 0; |
1250 | |
1251 | + if (asoc && !sctp_vtag_verify(chunk, asoc)) |
1252 | + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1253 | + |
1254 | /* If the packet is an OOTB packet which is temporarily on the |
1255 | * control endpoint, respond with an ABORT. |
1256 | */ |
1257 | @@ -711,7 +714,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, |
1258 | * in sctp_unpack_cookie(). |
1259 | */ |
1260 | if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) |
1261 | - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1262 | + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, |
1263 | + commands); |
1264 | |
1265 | /* If the endpoint is not listening or if the number of associations |
1266 | * on the TCP-style socket exceed the max backlog, respond with an |
1267 | @@ -2141,9 +2145,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook( |
1268 | * enough for the chunk header. Cookie length verification is |
1269 | * done later. |
1270 | */ |
1271 | - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) |
1272 | - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, |
1273 | - commands); |
1274 | + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) { |
1275 | + if (!sctp_vtag_verify(chunk, asoc)) |
1276 | + asoc = NULL; |
1277 | + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands); |
1278 | + } |
1279 | |
1280 | /* "Decode" the chunk. We have no optional parameters so we |
1281 | * are in good shape. |
1282 | @@ -2280,7 +2286,7 @@ enum sctp_disposition sctp_sf_shutdown_pending_abort( |
1283 | */ |
1284 | if (SCTP_ADDR_DEL == |
1285 | sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) |
1286 | - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); |
1287 | + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1288 | |
1289 | if (!sctp_err_chunk_valid(chunk)) |
1290 | return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1291 | @@ -2326,7 +2332,7 @@ enum sctp_disposition sctp_sf_shutdown_sent_abort( |
1292 | */ |
1293 | if (SCTP_ADDR_DEL == |
1294 | sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) |
1295 | - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); |
1296 | + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1297 | |
1298 | if (!sctp_err_chunk_valid(chunk)) |
1299 | return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1300 | @@ -2596,7 +2602,7 @@ enum sctp_disposition sctp_sf_do_9_1_abort( |
1301 | */ |
1302 | if (SCTP_ADDR_DEL == |
1303 | sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) |
1304 | - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); |
1305 | + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1306 | |
1307 | if (!sctp_err_chunk_valid(chunk)) |
1308 | return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1309 | @@ -3562,6 +3568,9 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, |
1310 | |
1311 | SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES); |
1312 | |
1313 | + if (asoc && !sctp_vtag_verify(chunk, asoc)) |
1314 | + asoc = NULL; |
1315 | + |
1316 | ch = (struct sctp_chunkhdr *)chunk->chunk_hdr; |
1317 | do { |
1318 | /* Report violation if the chunk is less then minimal */ |
1319 | @@ -3677,12 +3686,6 @@ static enum sctp_disposition sctp_sf_shut_8_4_5( |
1320 | |
1321 | SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); |
1322 | |
1323 | - /* If the chunk length is invalid, we don't want to process |
1324 | - * the reset of the packet. |
1325 | - */ |
1326 | - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) |
1327 | - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1328 | - |
1329 | /* We need to discard the rest of the packet to prevent |
1330 | * potential bomming attacks from additional bundled chunks. |
1331 | * This is documented in SCTP Threats ID. |
1332 | @@ -3710,6 +3713,9 @@ enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net, |
1333 | { |
1334 | struct sctp_chunk *chunk = arg; |
1335 | |
1336 | + if (!sctp_vtag_verify(chunk, asoc)) |
1337 | + asoc = NULL; |
1338 | + |
1339 | /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */ |
1340 | if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) |
1341 | return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, |
1342 | @@ -3745,6 +3751,11 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net, |
1343 | return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1344 | } |
1345 | |
1346 | + /* Make sure that the ASCONF ADDIP chunk has a valid length. */ |
1347 | + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) |
1348 | + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, |
1349 | + commands); |
1350 | + |
1351 | /* ADD-IP: Section 4.1.1 |
1352 | * This chunk MUST be sent in an authenticated way by using |
1353 | * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk |
1354 | @@ -3753,13 +3764,7 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net, |
1355 | */ |
1356 | if (!asoc->peer.asconf_capable || |
1357 | (!net->sctp.addip_noauth && !chunk->auth)) |
1358 | - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, |
1359 | - commands); |
1360 | - |
1361 | - /* Make sure that the ASCONF ADDIP chunk has a valid length. */ |
1362 | - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) |
1363 | - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, |
1364 | - commands); |
1365 | + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1366 | |
1367 | hdr = (struct sctp_addiphdr *)chunk->skb->data; |
1368 | serial = ntohl(hdr->serial); |
1369 | @@ -3888,6 +3893,12 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net, |
1370 | return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1371 | } |
1372 | |
1373 | + /* Make sure that the ADDIP chunk has a valid length. */ |
1374 | + if (!sctp_chunk_length_valid(asconf_ack, |
1375 | + sizeof(struct sctp_addip_chunk))) |
1376 | + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, |
1377 | + commands); |
1378 | + |
1379 | /* ADD-IP, Section 4.1.2: |
1380 | * This chunk MUST be sent in an authenticated way by using |
1381 | * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk |
1382 | @@ -3896,14 +3907,7 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net, |
1383 | */ |
1384 | if (!asoc->peer.asconf_capable || |
1385 | (!net->sctp.addip_noauth && !asconf_ack->auth)) |
1386 | - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, |
1387 | - commands); |
1388 | - |
1389 | - /* Make sure that the ADDIP chunk has a valid length. */ |
1390 | - if (!sctp_chunk_length_valid(asconf_ack, |
1391 | - sizeof(struct sctp_addip_chunk))) |
1392 | - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, |
1393 | - commands); |
1394 | + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1395 | |
1396 | addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data; |
1397 | rcvd_serial = ntohl(addip_hdr->serial); |
1398 | @@ -4475,6 +4479,9 @@ enum sctp_disposition sctp_sf_discard_chunk(struct net *net, |
1399 | { |
1400 | struct sctp_chunk *chunk = arg; |
1401 | |
1402 | + if (asoc && !sctp_vtag_verify(chunk, asoc)) |
1403 | + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1404 | + |
1405 | /* Make sure that the chunk has a valid length. |
1406 | * Since we don't know the chunk type, we use a general |
1407 | * chunkhdr structure to make a comparison. |
1408 | @@ -4542,6 +4549,9 @@ enum sctp_disposition sctp_sf_violation(struct net *net, |
1409 | { |
1410 | struct sctp_chunk *chunk = arg; |
1411 | |
1412 | + if (!sctp_vtag_verify(chunk, asoc)) |
1413 | + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); |
1414 | + |
1415 | /* Make sure that the chunk has a valid length. */ |
1416 | if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) |
1417 | return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, |
1418 | @@ -6248,6 +6258,7 @@ static struct sctp_packet *sctp_ootb_pkt_new( |
1419 | * yet. |
1420 | */ |
1421 | switch (chunk->chunk_hdr->type) { |
1422 | + case SCTP_CID_INIT: |
1423 | case SCTP_CID_INIT_ACK: |
1424 | { |
1425 | struct sctp_initack_chunk *initack; |
1426 | diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c |
1427 | index 7fb5c067f4293..02821b9140546 100644 |
1428 | --- a/net/tls/tls_sw.c |
1429 | +++ b/net/tls/tls_sw.c |
1430 | @@ -35,6 +35,7 @@ |
1431 | * SOFTWARE. |
1432 | */ |
1433 | |
1434 | +#include <linux/bug.h> |
1435 | #include <linux/sched/signal.h> |
1436 | #include <linux/module.h> |
1437 | #include <linux/splice.h> |
1438 | @@ -43,6 +44,14 @@ |
1439 | #include <net/strparser.h> |
1440 | #include <net/tls.h> |
1441 | |
1442 | +noinline void tls_err_abort(struct sock *sk, int err) |
1443 | +{ |
1444 | + WARN_ON_ONCE(err >= 0); |
1445 | + /* sk->sk_err should contain a positive error code. */ |
1446 | + sk->sk_err = -err; |
1447 | + sk->sk_error_report(sk); |
1448 | +} |
1449 | + |
1450 | static int __skb_nsg(struct sk_buff *skb, int offset, int len, |
1451 | unsigned int recursion_level) |
1452 | { |
1453 | @@ -416,7 +425,7 @@ int tls_tx_records(struct sock *sk, int flags) |
1454 | |
1455 | tx_err: |
1456 | if (rc < 0 && rc != -EAGAIN) |
1457 | - tls_err_abort(sk, EBADMSG); |
1458 | + tls_err_abort(sk, -EBADMSG); |
1459 | |
1460 | return rc; |
1461 | } |
1462 | @@ -447,7 +456,7 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err) |
1463 | |
1464 | /* If err is already set on socket, return the same code */ |
1465 | if (sk->sk_err) { |
1466 | - ctx->async_wait.err = sk->sk_err; |
1467 | + ctx->async_wait.err = -sk->sk_err; |
1468 | } else { |
1469 | ctx->async_wait.err = err; |
1470 | tls_err_abort(sk, err); |
1471 | @@ -761,7 +770,7 @@ static int tls_push_record(struct sock *sk, int flags, |
1472 | msg_pl->sg.size + prot->tail_size, i); |
1473 | if (rc < 0) { |
1474 | if (rc != -EINPROGRESS) { |
1475 | - tls_err_abort(sk, EBADMSG); |
1476 | + tls_err_abort(sk, -EBADMSG); |
1477 | if (split) { |
1478 | tls_ctx->pending_open_record_frags = true; |
1479 | tls_merge_open_record(sk, rec, tmp, orig_end); |
1480 | @@ -1822,7 +1831,7 @@ int tls_sw_recvmsg(struct sock *sk, |
1481 | err = decrypt_skb_update(sk, skb, &msg->msg_iter, |
1482 | &chunk, &zc, async_capable); |
1483 | if (err < 0 && err != -EINPROGRESS) { |
1484 | - tls_err_abort(sk, EBADMSG); |
1485 | + tls_err_abort(sk, -EBADMSG); |
1486 | goto recv_end; |
1487 | } |
1488 | |
1489 | @@ -2002,7 +2011,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, |
1490 | } |
1491 | |
1492 | if (err < 0) { |
1493 | - tls_err_abort(sk, EBADMSG); |
1494 | + tls_err_abort(sk, -EBADMSG); |
1495 | goto splice_read_end; |
1496 | } |
1497 | ctx->decrypted = true; |
1498 | diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c |
1499 | index 7b170ed6923e7..7633d6a74bc2b 100644 |
1500 | --- a/net/wireless/nl80211.c |
1501 | +++ b/net/wireless/nl80211.c |
1502 | @@ -3480,7 +3480,7 @@ static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, |
1503 | enum nl80211_iftype iftype) |
1504 | { |
1505 | if (!use_4addr) { |
1506 | - if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT)) |
1507 | + if (netdev && netif_is_bridge_port(netdev)) |
1508 | return -EBUSY; |
1509 | return 0; |
1510 | } |
1511 | diff --git a/net/wireless/scan.c b/net/wireless/scan.c |
1512 | index 1580535d53f86..6cefaad3b7f84 100644 |
1513 | --- a/net/wireless/scan.c |
1514 | +++ b/net/wireless/scan.c |
1515 | @@ -379,14 +379,17 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss, |
1516 | } |
1517 | ssid_len = ssid[1]; |
1518 | ssid = ssid + 2; |
1519 | - rcu_read_unlock(); |
1520 | |
1521 | /* check if nontrans_bss is in the list */ |
1522 | list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) { |
1523 | - if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) |
1524 | + if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) { |
1525 | + rcu_read_unlock(); |
1526 | return 0; |
1527 | + } |
1528 | } |
1529 | |
1530 | + rcu_read_unlock(); |
1531 | + |
1532 | /* add to the list */ |
1533 | list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list); |
1534 | return 0; |
1535 | diff --git a/net/wireless/util.c b/net/wireless/util.c |
1536 | index f0247eab5bc94..aaefaf3422a1a 100644 |
1537 | --- a/net/wireless/util.c |
1538 | +++ b/net/wireless/util.c |
1539 | @@ -975,14 +975,14 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, |
1540 | !(rdev->wiphy.interface_modes & (1 << ntype))) |
1541 | return -EOPNOTSUPP; |
1542 | |
1543 | - /* if it's part of a bridge, reject changing type to station/ibss */ |
1544 | - if ((dev->priv_flags & IFF_BRIDGE_PORT) && |
1545 | - (ntype == NL80211_IFTYPE_ADHOC || |
1546 | - ntype == NL80211_IFTYPE_STATION || |
1547 | - ntype == NL80211_IFTYPE_P2P_CLIENT)) |
1548 | - return -EBUSY; |
1549 | - |
1550 | if (ntype != otype) { |
1551 | + /* if it's part of a bridge, reject changing type to station/ibss */ |
1552 | + if (netif_is_bridge_port(dev) && |
1553 | + (ntype == NL80211_IFTYPE_ADHOC || |
1554 | + ntype == NL80211_IFTYPE_STATION || |
1555 | + ntype == NL80211_IFTYPE_P2P_CLIENT)) |
1556 | + return -EBUSY; |
1557 | + |
1558 | dev->ieee80211_ptr->use_4addr = false; |
1559 | dev->ieee80211_ptr->mesh_id_up_len = 0; |
1560 | wdev_lock(dev->ieee80211_ptr); |
1561 | diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c |
1562 | index f3ff825d9dd33..3a169a026635d 100644 |
1563 | --- a/tools/perf/builtin-script.c |
1564 | +++ b/tools/perf/builtin-script.c |
1565 | @@ -3779,11 +3779,15 @@ int cmd_script(int argc, const char **argv) |
1566 | goto out_delete; |
1567 | |
1568 | uname(&uts); |
1569 | - if (data.is_pipe || /* assume pipe_mode indicates native_arch */ |
1570 | - !strcmp(uts.machine, session->header.env.arch) || |
1571 | - (!strcmp(uts.machine, "x86_64") && |
1572 | - !strcmp(session->header.env.arch, "i386"))) |
1573 | + if (data.is_pipe) { /* Assume pipe_mode indicates native_arch */ |
1574 | native_arch = true; |
1575 | + } else if (session->header.env.arch) { |
1576 | + if (!strcmp(uts.machine, session->header.env.arch)) |
1577 | + native_arch = true; |
1578 | + else if (!strcmp(uts.machine, "x86_64") && |
1579 | + !strcmp(session->header.env.arch, "i386")) |
1580 | + native_arch = true; |
1581 | + } |
1582 | |
1583 | script.session = session; |
1584 | script__setup_sample_type(&script); |