Contents of /trunk/kernel-lts/patches-3.4/0171-3.4.72-all-fixes.patch
Parent Directory | Revision Log
Revision 2336 -
(show annotations)
(download)
Thu Dec 12 08:43:38 2013 UTC (10 years, 9 months ago) by niro
File size: 53718 byte(s)
Thu Dec 12 08:43:38 2013 UTC (10 years, 9 months ago) by niro
File size: 53718 byte(s)
-linux-3.4.72
1 | diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt |
2 | index 6d78841f..99d8ab9d 100644 |
3 | --- a/Documentation/sysctl/kernel.txt |
4 | +++ b/Documentation/sysctl/kernel.txt |
5 | @@ -284,13 +284,24 @@ Default value is "/sbin/hotplug". |
6 | kptr_restrict: |
7 | |
8 | This toggle indicates whether restrictions are placed on |
9 | -exposing kernel addresses via /proc and other interfaces. When |
10 | -kptr_restrict is set to (0), there are no restrictions. When |
11 | -kptr_restrict is set to (1), the default, kernel pointers |
12 | -printed using the %pK format specifier will be replaced with 0's |
13 | -unless the user has CAP_SYSLOG. When kptr_restrict is set to |
14 | -(2), kernel pointers printed using %pK will be replaced with 0's |
15 | -regardless of privileges. |
16 | +exposing kernel addresses via /proc and other interfaces. |
17 | + |
18 | +When kptr_restrict is set to (0), the default, there are no restrictions. |
19 | + |
20 | +When kptr_restrict is set to (1), kernel pointers printed using the %pK |
21 | +format specifier will be replaced with 0's unless the user has CAP_SYSLOG |
22 | +and effective user and group ids are equal to the real ids. This is |
23 | +because %pK checks are done at read() time rather than open() time, so |
24 | +if permissions are elevated between the open() and the read() (e.g via |
25 | +a setuid binary) then %pK will not leak kernel pointers to unprivileged |
26 | +users. Note, this is a temporary solution only. The correct long-term |
27 | +solution is to do the permission checks at open() time. Consider removing |
28 | +world read permissions from files that use %pK, and using dmesg_restrict |
29 | +to protect against uses of %pK in dmesg(8) if leaking kernel pointer |
30 | +values to unprivileged users is a concern. |
31 | + |
32 | +When kptr_restrict is set to (2), kernel pointers printed using |
33 | +%pK will be replaced with 0's regardless of privileges. |
34 | |
35 | ============================================================== |
36 | |
37 | diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c |
38 | index 48a115a9..ecc33bc4 100644 |
39 | --- a/arch/arm/mach-integrator/integrator_cp.c |
40 | +++ b/arch/arm/mach-integrator/integrator_cp.c |
41 | @@ -366,7 +366,8 @@ static AMBA_APB_DEVICE(aaci, "mb:1d", 0, INTEGRATOR_CP_AACI_BASE, |
42 | static void cp_clcd_enable(struct clcd_fb *fb) |
43 | { |
44 | struct fb_var_screeninfo *var = &fb->fb.var; |
45 | - u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2; |
46 | + u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2 |
47 | + | CM_CTRL_LCDEN0 | CM_CTRL_LCDEN1; |
48 | |
49 | if (var->bits_per_pixel <= 8 || |
50 | (var->bits_per_pixel == 16 && var->green.length == 5)) |
51 | diff --git a/arch/arm/mach-sa1100/assabet.c b/arch/arm/mach-sa1100/assabet.c |
52 | index 375d3f77..82636701 100644 |
53 | --- a/arch/arm/mach-sa1100/assabet.c |
54 | +++ b/arch/arm/mach-sa1100/assabet.c |
55 | @@ -509,6 +509,9 @@ static void __init assabet_map_io(void) |
56 | * Its called GPCLKR0 in my SA1110 manual. |
57 | */ |
58 | Ser1SDCR0 |= SDCR0_SUS; |
59 | + MSC1 = (MSC1 & ~0xffff) | |
60 | + MSC_NonBrst | MSC_32BitStMem | |
61 | + MSC_RdAcc(2) | MSC_WrAcc(2) | MSC_Rec(0); |
62 | |
63 | if (!machine_has_neponset()) |
64 | sa1100_register_uart_fns(&assabet_port_fns); |
65 | diff --git a/arch/avr32/boot/u-boot/head.S b/arch/avr32/boot/u-boot/head.S |
66 | index 4488fa27..2ffc298f 100644 |
67 | --- a/arch/avr32/boot/u-boot/head.S |
68 | +++ b/arch/avr32/boot/u-boot/head.S |
69 | @@ -8,6 +8,8 @@ |
70 | * published by the Free Software Foundation. |
71 | */ |
72 | #include <asm/setup.h> |
73 | +#include <asm/thread_info.h> |
74 | +#include <asm/sysreg.h> |
75 | |
76 | /* |
77 | * The kernel is loaded where we want it to be and all caches |
78 | @@ -20,11 +22,6 @@ |
79 | .section .init.text,"ax" |
80 | .global _start |
81 | _start: |
82 | - /* Check if the boot loader actually provided a tag table */ |
83 | - lddpc r0, magic_number |
84 | - cp.w r12, r0 |
85 | - brne no_tag_table |
86 | - |
87 | /* Initialize .bss */ |
88 | lddpc r2, bss_start_addr |
89 | lddpc r3, end_addr |
90 | @@ -34,6 +31,25 @@ _start: |
91 | cp r2, r3 |
92 | brlo 1b |
93 | |
94 | + /* Initialize status register */ |
95 | + lddpc r0, init_sr |
96 | + mtsr SYSREG_SR, r0 |
97 | + |
98 | + /* Set initial stack pointer */ |
99 | + lddpc sp, stack_addr |
100 | + sub sp, -THREAD_SIZE |
101 | + |
102 | +#ifdef CONFIG_FRAME_POINTER |
103 | + /* Mark last stack frame */ |
104 | + mov lr, 0 |
105 | + mov r7, 0 |
106 | +#endif |
107 | + |
108 | + /* Check if the boot loader actually provided a tag table */ |
109 | + lddpc r0, magic_number |
110 | + cp.w r12, r0 |
111 | + brne no_tag_table |
112 | + |
113 | /* |
114 | * Save the tag table address for later use. This must be done |
115 | * _after_ .bss has been initialized... |
116 | @@ -53,8 +69,15 @@ bss_start_addr: |
117 | .long __bss_start |
118 | end_addr: |
119 | .long _end |
120 | +init_sr: |
121 | + .long 0x007f0000 /* Supervisor mode, everything masked */ |
122 | +stack_addr: |
123 | + .long init_thread_union |
124 | +panic_addr: |
125 | + .long panic |
126 | |
127 | no_tag_table: |
128 | sub r12, pc, (. - 2f) |
129 | - bral panic |
130 | + /* branch to panic() which can be far away with that construct */ |
131 | + lddpc pc, panic_addr |
132 | 2: .asciz "Boot loader didn't provide correct magic number\n" |
133 | diff --git a/arch/avr32/kernel/entry-avr32b.S b/arch/avr32/kernel/entry-avr32b.S |
134 | index 169268c4..a91e8980 100644 |
135 | --- a/arch/avr32/kernel/entry-avr32b.S |
136 | +++ b/arch/avr32/kernel/entry-avr32b.S |
137 | @@ -399,9 +399,10 @@ handle_critical: |
138 | /* We should never get here... */ |
139 | bad_return: |
140 | sub r12, pc, (. - 1f) |
141 | - bral panic |
142 | + lddpc pc, 2f |
143 | .align 2 |
144 | 1: .asciz "Return from critical exception!" |
145 | +2: .long panic |
146 | |
147 | .align 1 |
148 | do_bus_error_write: |
149 | diff --git a/arch/avr32/kernel/head.S b/arch/avr32/kernel/head.S |
150 | index 6163bd0a..59eae6df 100644 |
151 | --- a/arch/avr32/kernel/head.S |
152 | +++ b/arch/avr32/kernel/head.S |
153 | @@ -10,33 +10,13 @@ |
154 | #include <linux/linkage.h> |
155 | |
156 | #include <asm/page.h> |
157 | -#include <asm/thread_info.h> |
158 | -#include <asm/sysreg.h> |
159 | |
160 | .section .init.text,"ax" |
161 | .global kernel_entry |
162 | kernel_entry: |
163 | - /* Initialize status register */ |
164 | - lddpc r0, init_sr |
165 | - mtsr SYSREG_SR, r0 |
166 | - |
167 | - /* Set initial stack pointer */ |
168 | - lddpc sp, stack_addr |
169 | - sub sp, -THREAD_SIZE |
170 | - |
171 | -#ifdef CONFIG_FRAME_POINTER |
172 | - /* Mark last stack frame */ |
173 | - mov lr, 0 |
174 | - mov r7, 0 |
175 | -#endif |
176 | - |
177 | /* Start the show */ |
178 | lddpc pc, kernel_start_addr |
179 | |
180 | .align 2 |
181 | -init_sr: |
182 | - .long 0x007f0000 /* Supervisor mode, everything masked */ |
183 | -stack_addr: |
184 | - .long init_thread_union |
185 | kernel_start_addr: |
186 | .long start_kernel |
187 | diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c |
188 | index e6de7879..32e2c811 100644 |
189 | --- a/arch/powerpc/kernel/signal_32.c |
190 | +++ b/arch/powerpc/kernel/signal_32.c |
191 | @@ -447,6 +447,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame, |
192 | #endif /* CONFIG_ALTIVEC */ |
193 | if (copy_fpr_to_user(&frame->mc_fregs, current)) |
194 | return 1; |
195 | + |
196 | + /* |
197 | + * Clear the MSR VSX bit to indicate there is no valid state attached |
198 | + * to this context, except in the specific case below where we set it. |
199 | + */ |
200 | + msr &= ~MSR_VSX; |
201 | #ifdef CONFIG_VSX |
202 | /* |
203 | * Copy VSR 0-31 upper half from thread_struct to local |
204 | @@ -459,15 +465,7 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame, |
205 | if (copy_vsx_to_user(&frame->mc_vsregs, current)) |
206 | return 1; |
207 | msr |= MSR_VSX; |
208 | - } else if (!ctx_has_vsx_region) |
209 | - /* |
210 | - * With a small context structure we can't hold the VSX |
211 | - * registers, hence clear the MSR value to indicate the state |
212 | - * was not saved. |
213 | - */ |
214 | - msr &= ~MSR_VSX; |
215 | - |
216 | - |
217 | + } |
218 | #endif /* CONFIG_VSX */ |
219 | #ifdef CONFIG_SPE |
220 | /* save spe registers */ |
221 | diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c |
222 | index 2692efdb..3ad1b508 100644 |
223 | --- a/arch/powerpc/kernel/signal_64.c |
224 | +++ b/arch/powerpc/kernel/signal_64.c |
225 | @@ -117,6 +117,12 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs, |
226 | flush_fp_to_thread(current); |
227 | /* copy fpr regs and fpscr */ |
228 | err |= copy_fpr_to_user(&sc->fp_regs, current); |
229 | + |
230 | + /* |
231 | + * Clear the MSR VSX bit to indicate there is no valid state attached |
232 | + * to this context, except in the specific case below where we set it. |
233 | + */ |
234 | + msr &= ~MSR_VSX; |
235 | #ifdef CONFIG_VSX |
236 | /* |
237 | * Copy VSX low doubleword to local buffer for formatting, |
238 | diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c |
239 | index aeb82200..60662545 100644 |
240 | --- a/drivers/ata/ahci.c |
241 | +++ b/drivers/ata/ahci.c |
242 | @@ -402,6 +402,8 @@ static const struct pci_device_id ahci_pci_tbl[] = { |
243 | .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */ |
244 | { PCI_DEVICE(0x1b4b, 0x91a3), |
245 | .driver_data = board_ahci_yes_fbs }, |
246 | + { PCI_DEVICE(0x1b4b, 0x9230), |
247 | + .driver_data = board_ahci_yes_fbs }, |
248 | |
249 | /* Promise */ |
250 | { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */ |
251 | diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c |
252 | index 47a1fb85..60f41cd2 100644 |
253 | --- a/drivers/ata/libahci.c |
254 | +++ b/drivers/ata/libahci.c |
255 | @@ -1249,9 +1249,11 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class, |
256 | { |
257 | struct ata_port *ap = link->ap; |
258 | struct ahci_host_priv *hpriv = ap->host->private_data; |
259 | + struct ahci_port_priv *pp = ap->private_data; |
260 | const char *reason = NULL; |
261 | unsigned long now, msecs; |
262 | struct ata_taskfile tf; |
263 | + bool fbs_disabled = false; |
264 | int rc; |
265 | |
266 | DPRINTK("ENTER\n"); |
267 | @@ -1261,6 +1263,16 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class, |
268 | if (rc && rc != -EOPNOTSUPP) |
269 | ata_link_warn(link, "failed to reset engine (errno=%d)\n", rc); |
270 | |
271 | + /* |
272 | + * According to AHCI-1.2 9.3.9: if FBS is enable, software shall |
273 | + * clear PxFBS.EN to '0' prior to issuing software reset to devices |
274 | + * that is attached to port multiplier. |
275 | + */ |
276 | + if (!ata_is_host_link(link) && pp->fbs_enabled) { |
277 | + ahci_disable_fbs(ap); |
278 | + fbs_disabled = true; |
279 | + } |
280 | + |
281 | ata_tf_init(link->device, &tf); |
282 | |
283 | /* issue the first D2H Register FIS */ |
284 | @@ -1301,6 +1313,10 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class, |
285 | } else |
286 | *class = ahci_dev_classify(ap); |
287 | |
288 | + /* re-enable FBS if disabled before */ |
289 | + if (fbs_disabled) |
290 | + ahci_enable_fbs(ap); |
291 | + |
292 | DPRINTK("EXIT, class=%u\n", *class); |
293 | return 0; |
294 | |
295 | diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c |
296 | index 9cf09ae8..cd20cf1e 100644 |
297 | --- a/drivers/ata/libata-core.c |
298 | +++ b/drivers/ata/libata-core.c |
299 | @@ -4074,6 +4074,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { |
300 | { "TORiSAN DVD-ROM DRD-N216", NULL, ATA_HORKAGE_MAX_SEC_128 }, |
301 | { "QUANTUM DAT DAT72-000", NULL, ATA_HORKAGE_ATAPI_MOD16_DMA }, |
302 | { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 }, |
303 | + { "Slimtype DVD A DS8A9SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 }, |
304 | |
305 | /* Devices we expect to fail diagnostics */ |
306 | |
307 | diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c |
308 | index c3419048..92156774 100644 |
309 | --- a/drivers/ata/libata-transport.c |
310 | +++ b/drivers/ata/libata-transport.c |
311 | @@ -319,25 +319,25 @@ int ata_tport_add(struct device *parent, |
312 | /* |
313 | * ATA link attributes |
314 | */ |
315 | +static int noop(int x) { return x; } |
316 | |
317 | - |
318 | -#define ata_link_show_linkspeed(field) \ |
319 | +#define ata_link_show_linkspeed(field, format) \ |
320 | static ssize_t \ |
321 | show_ata_link_##field(struct device *dev, \ |
322 | struct device_attribute *attr, char *buf) \ |
323 | { \ |
324 | struct ata_link *link = transport_class_to_link(dev); \ |
325 | \ |
326 | - return sprintf(buf,"%s\n", sata_spd_string(fls(link->field))); \ |
327 | + return sprintf(buf, "%s\n", sata_spd_string(format(link->field))); \ |
328 | } |
329 | |
330 | -#define ata_link_linkspeed_attr(field) \ |
331 | - ata_link_show_linkspeed(field) \ |
332 | +#define ata_link_linkspeed_attr(field, format) \ |
333 | + ata_link_show_linkspeed(field, format) \ |
334 | static DEVICE_ATTR(field, S_IRUGO, show_ata_link_##field, NULL) |
335 | |
336 | -ata_link_linkspeed_attr(hw_sata_spd_limit); |
337 | -ata_link_linkspeed_attr(sata_spd_limit); |
338 | -ata_link_linkspeed_attr(sata_spd); |
339 | +ata_link_linkspeed_attr(hw_sata_spd_limit, fls); |
340 | +ata_link_linkspeed_attr(sata_spd_limit, fls); |
341 | +ata_link_linkspeed_attr(sata_spd, noop); |
342 | |
343 | |
344 | static DECLARE_TRANSPORT_CLASS(ata_link_class, |
345 | diff --git a/drivers/block/loop.c b/drivers/block/loop.c |
346 | index a4ddbae2..462fd182 100644 |
347 | --- a/drivers/block/loop.c |
348 | +++ b/drivers/block/loop.c |
349 | @@ -1636,7 +1636,7 @@ static int loop_add(struct loop_device **l, int i) |
350 | |
351 | lo->lo_queue = blk_alloc_queue(GFP_KERNEL); |
352 | if (!lo->lo_queue) |
353 | - goto out_free_dev; |
354 | + goto out_free_idr; |
355 | |
356 | disk = lo->lo_disk = alloc_disk(1 << part_shift); |
357 | if (!disk) |
358 | @@ -1680,6 +1680,8 @@ static int loop_add(struct loop_device **l, int i) |
359 | |
360 | out_free_queue: |
361 | blk_cleanup_queue(lo->lo_queue); |
362 | +out_free_idr: |
363 | + idr_remove(&loop_index_idr, i); |
364 | out_free_dev: |
365 | kfree(lo); |
366 | out: |
367 | diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c |
368 | index 4ed7bf9b..0ed5df4d 100644 |
369 | --- a/drivers/block/xen-blkback/blkback.c |
370 | +++ b/drivers/block/xen-blkback/blkback.c |
371 | @@ -401,6 +401,8 @@ static int dispatch_discard_io(struct xen_blkif *blkif, |
372 | unsigned long secure; |
373 | struct phys_req preq; |
374 | |
375 | + xen_blkif_get(blkif); |
376 | + |
377 | preq.sector_number = req->u.discard.sector_number; |
378 | preq.nr_sects = req->u.discard.nr_sectors; |
379 | |
380 | @@ -413,7 +415,6 @@ static int dispatch_discard_io(struct xen_blkif *blkif, |
381 | } |
382 | blkif->st_ds_req++; |
383 | |
384 | - xen_blkif_get(blkif); |
385 | secure = (blkif->vbd.discard_secure && |
386 | (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ? |
387 | BLKDEV_DISCARD_SECURE : 0; |
388 | diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c |
389 | index 0e359225..5647ce4b 100644 |
390 | --- a/drivers/gpu/drm/i915/intel_display.c |
391 | +++ b/drivers/gpu/drm/i915/intel_display.c |
392 | @@ -6377,7 +6377,9 @@ static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base) |
393 | intel_crtc->cursor_visible = visible; |
394 | } |
395 | /* and commit changes on next vblank */ |
396 | + POSTING_READ(CURCNTR(pipe)); |
397 | I915_WRITE(CURBASE(pipe), base); |
398 | + POSTING_READ(CURBASE(pipe)); |
399 | } |
400 | |
401 | static void ivb_update_cursor(struct drm_crtc *crtc, u32 base) |
402 | @@ -6402,7 +6404,9 @@ static void ivb_update_cursor(struct drm_crtc *crtc, u32 base) |
403 | intel_crtc->cursor_visible = visible; |
404 | } |
405 | /* and commit changes on next vblank */ |
406 | + POSTING_READ(CURCNTR_IVB(pipe)); |
407 | I915_WRITE(CURBASE_IVB(pipe), base); |
408 | + POSTING_READ(CURBASE_IVB(pipe)); |
409 | } |
410 | |
411 | /* If no-part of the cursor is visible on the framebuffer, then the GPU may hang... */ |
412 | diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c |
413 | index ed52a6f4..2f46bbfb 100644 |
414 | --- a/drivers/gpu/drm/nouveau/nouveau_gem.c |
415 | +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c |
416 | @@ -281,7 +281,8 @@ validate_fini_list(struct list_head *list, struct nouveau_fence *fence) |
417 | list_for_each_safe(entry, tmp, list) { |
418 | nvbo = list_entry(entry, struct nouveau_bo, entry); |
419 | |
420 | - nouveau_bo_fence(nvbo, fence); |
421 | + if (likely(fence)) |
422 | + nouveau_bo_fence(nvbo, fence); |
423 | |
424 | if (unlikely(nvbo->validate_mapped)) { |
425 | ttm_bo_kunmap(&nvbo->kmap); |
426 | diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c |
427 | index 9760e5ad..b44bbf50 100644 |
428 | --- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c |
429 | +++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c |
430 | @@ -416,6 +416,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc, |
431 | /* Pin framebuffer & get tilling informations */ |
432 | obj = radeon_fb->obj; |
433 | rbo = gem_to_radeon_bo(obj); |
434 | +retry: |
435 | r = radeon_bo_reserve(rbo, false); |
436 | if (unlikely(r != 0)) |
437 | return r; |
438 | @@ -424,6 +425,33 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc, |
439 | &base); |
440 | if (unlikely(r != 0)) { |
441 | radeon_bo_unreserve(rbo); |
442 | + |
443 | + /* On old GPU like RN50 with little vram pining can fails because |
444 | + * current fb is taking all space needed. So instead of unpining |
445 | + * the old buffer after pining the new one, first unpin old one |
446 | + * and then retry pining new one. |
447 | + * |
448 | + * As only master can set mode only master can pin and it is |
449 | + * unlikely the master client will race with itself especialy |
450 | + * on those old gpu with single crtc. |
451 | + * |
452 | + * We don't shutdown the display controller because new buffer |
453 | + * will end up in same spot. |
454 | + */ |
455 | + if (!atomic && fb && fb != crtc->fb) { |
456 | + struct radeon_bo *old_rbo; |
457 | + unsigned long nsize, osize; |
458 | + |
459 | + old_rbo = gem_to_radeon_bo(to_radeon_framebuffer(fb)->obj); |
460 | + osize = radeon_bo_size(old_rbo); |
461 | + nsize = radeon_bo_size(rbo); |
462 | + if (nsize <= osize && !radeon_bo_reserve(old_rbo, false)) { |
463 | + radeon_bo_unpin(old_rbo); |
464 | + radeon_bo_unreserve(old_rbo); |
465 | + fb = NULL; |
466 | + goto retry; |
467 | + } |
468 | + } |
469 | return -EINVAL; |
470 | } |
471 | radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL); |
472 | diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h |
473 | index 1767ae7f..a9fcbe44 100644 |
474 | --- a/drivers/gpu/drm/radeon/sid.h |
475 | +++ b/drivers/gpu/drm/radeon/sid.h |
476 | @@ -165,7 +165,7 @@ |
477 | #define NOOFGROUPS_SHIFT 12 |
478 | #define NOOFGROUPS_MASK 0x00001000 |
479 | |
480 | -#define MC_SEQ_TRAIN_WAKEUP_CNTL 0x2808 |
481 | +#define MC_SEQ_TRAIN_WAKEUP_CNTL 0x28e8 |
482 | #define TRAIN_DONE_D0 (1 << 30) |
483 | #define TRAIN_DONE_D1 (1 << 31) |
484 | |
485 | diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c |
486 | index f8187ead..2d692626 100644 |
487 | --- a/drivers/gpu/drm/ttm/ttm_bo_util.c |
488 | +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c |
489 | @@ -342,7 +342,9 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo, |
490 | if (old_iomap == NULL && ttm == NULL) |
491 | goto out2; |
492 | |
493 | - if (ttm->state == tt_unpopulated) { |
494 | + /* TTM might be null for moves within the same region. |
495 | + */ |
496 | + if (ttm && ttm->state == tt_unpopulated) { |
497 | ret = ttm->bdev->driver->ttm_tt_populate(ttm); |
498 | if (ret) |
499 | goto out1; |
500 | diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c |
501 | index 899c7120..9421f643 100644 |
502 | --- a/drivers/hid/hid-apple.c |
503 | +++ b/drivers/hid/hid-apple.c |
504 | @@ -48,6 +48,12 @@ module_param(iso_layout, uint, 0644); |
505 | MODULE_PARM_DESC(iso_layout, "Enable/Disable hardcoded ISO-layout of the keyboard. " |
506 | "(0 = disabled, [1] = enabled)"); |
507 | |
508 | +static unsigned int swap_opt_cmd = 0; |
509 | +module_param(swap_opt_cmd, uint, 0644); |
510 | +MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") keys. " |
511 | + "(For people who want to keep Windows PC keyboard muscle memory. " |
512 | + "[0] = as-is, Mac layout. 1 = swapped, Windows layout.)"); |
513 | + |
514 | struct apple_sc { |
515 | unsigned long quirks; |
516 | unsigned int fn_on; |
517 | @@ -152,6 +158,14 @@ static const struct apple_key_translation apple_iso_keyboard[] = { |
518 | { } |
519 | }; |
520 | |
521 | +static const struct apple_key_translation swapped_option_cmd_keys[] = { |
522 | + { KEY_LEFTALT, KEY_LEFTMETA }, |
523 | + { KEY_LEFTMETA, KEY_LEFTALT }, |
524 | + { KEY_RIGHTALT, KEY_RIGHTMETA }, |
525 | + { KEY_RIGHTMETA,KEY_RIGHTALT }, |
526 | + { } |
527 | +}; |
528 | + |
529 | static const struct apple_key_translation *apple_find_translation( |
530 | const struct apple_key_translation *table, u16 from) |
531 | { |
532 | @@ -244,6 +258,14 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, |
533 | } |
534 | } |
535 | |
536 | + if (swap_opt_cmd) { |
537 | + trans = apple_find_translation(swapped_option_cmd_keys, usage->code); |
538 | + if (trans) { |
539 | + input_event(input, usage->type, trans->to, value); |
540 | + return 1; |
541 | + } |
542 | + } |
543 | + |
544 | return 0; |
545 | } |
546 | |
547 | diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c |
548 | index 112d9341..1973cff8 100644 |
549 | --- a/drivers/hid/hid-roccat-kovaplus.c |
550 | +++ b/drivers/hid/hid-roccat-kovaplus.c |
551 | @@ -623,9 +623,13 @@ static void kovaplus_keep_values_up_to_date(struct kovaplus_device *kovaplus, |
552 | break; |
553 | case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_CPI: |
554 | kovaplus->actual_cpi = kovaplus_convert_event_cpi(button_report->data1); |
555 | + break; |
556 | case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_SENSITIVITY: |
557 | kovaplus->actual_x_sensitivity = button_report->data1; |
558 | kovaplus->actual_y_sensitivity = button_report->data2; |
559 | + break; |
560 | + default: |
561 | + break; |
562 | } |
563 | } |
564 | |
565 | diff --git a/drivers/infiniband/hw/ipath/ipath_user_sdma.c b/drivers/infiniband/hw/ipath/ipath_user_sdma.c |
566 | index f5cb13b2..cc04b7ba 100644 |
567 | --- a/drivers/infiniband/hw/ipath/ipath_user_sdma.c |
568 | +++ b/drivers/infiniband/hw/ipath/ipath_user_sdma.c |
569 | @@ -280,9 +280,7 @@ static int ipath_user_sdma_pin_pages(const struct ipath_devdata *dd, |
570 | int j; |
571 | int ret; |
572 | |
573 | - ret = get_user_pages(current, current->mm, addr, |
574 | - npages, 0, 1, pages, NULL); |
575 | - |
576 | + ret = get_user_pages_fast(addr, npages, 0, pages); |
577 | if (ret != npages) { |
578 | int i; |
579 | |
580 | @@ -811,10 +809,7 @@ int ipath_user_sdma_writev(struct ipath_devdata *dd, |
581 | while (dim) { |
582 | const int mxp = 8; |
583 | |
584 | - down_write(¤t->mm->mmap_sem); |
585 | ret = ipath_user_sdma_queue_pkts(dd, pq, &list, iov, dim, mxp); |
586 | - up_write(¤t->mm->mmap_sem); |
587 | - |
588 | if (ret <= 0) |
589 | goto done_unlock; |
590 | else { |
591 | diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h |
592 | index 5f306f79..0ec9abbe 100644 |
593 | --- a/drivers/input/serio/i8042-x86ia64io.h |
594 | +++ b/drivers/input/serio/i8042-x86ia64io.h |
595 | @@ -765,6 +765,7 @@ static struct pnp_device_id pnp_kbd_devids[] = { |
596 | { .id = "CPQA0D7", .driver_data = 0 }, |
597 | { .id = "", }, |
598 | }; |
599 | +MODULE_DEVICE_TABLE(pnp, pnp_kbd_devids); |
600 | |
601 | static struct pnp_driver i8042_pnp_kbd_driver = { |
602 | .name = "i8042 kbd", |
603 | @@ -786,6 +787,7 @@ static struct pnp_device_id pnp_aux_devids[] = { |
604 | { .id = "SYN0801", .driver_data = 0 }, |
605 | { .id = "", }, |
606 | }; |
607 | +MODULE_DEVICE_TABLE(pnp, pnp_aux_devids); |
608 | |
609 | static struct pnp_driver i8042_pnp_aux_driver = { |
610 | .name = "i8042 aux", |
611 | diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c |
612 | index f220a695..d509f236 100644 |
613 | --- a/drivers/md/dm-table.c |
614 | +++ b/drivers/md/dm-table.c |
615 | @@ -581,14 +581,28 @@ static int adjoin(struct dm_table *table, struct dm_target *ti) |
616 | |
617 | /* |
618 | * Used to dynamically allocate the arg array. |
619 | + * |
620 | + * We do first allocation with GFP_NOIO because dm-mpath and dm-thin must |
621 | + * process messages even if some device is suspended. These messages have a |
622 | + * small fixed number of arguments. |
623 | + * |
624 | + * On the other hand, dm-switch needs to process bulk data using messages and |
625 | + * excessive use of GFP_NOIO could cause trouble. |
626 | */ |
627 | static char **realloc_argv(unsigned *array_size, char **old_argv) |
628 | { |
629 | char **argv; |
630 | unsigned new_size; |
631 | + gfp_t gfp; |
632 | |
633 | - new_size = *array_size ? *array_size * 2 : 64; |
634 | - argv = kmalloc(new_size * sizeof(*argv), GFP_KERNEL); |
635 | + if (*array_size) { |
636 | + new_size = *array_size * 2; |
637 | + gfp = GFP_KERNEL; |
638 | + } else { |
639 | + new_size = 8; |
640 | + gfp = GFP_NOIO; |
641 | + } |
642 | + argv = kmalloc(new_size * sizeof(*argv), gfp); |
643 | if (argv) { |
644 | memcpy(argv, old_argv, *array_size * sizeof(*argv)); |
645 | *array_size = new_size; |
646 | diff --git a/drivers/md/md.c b/drivers/md/md.c |
647 | index 7b45b5e1..e63ca864 100644 |
648 | --- a/drivers/md/md.c |
649 | +++ b/drivers/md/md.c |
650 | @@ -3507,6 +3507,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len) |
651 | mddev->in_sync = 1; |
652 | del_timer_sync(&mddev->safemode_timer); |
653 | } |
654 | + blk_set_stacking_limits(&mddev->queue->limits); |
655 | pers->run(mddev); |
656 | mddev_resume(mddev); |
657 | set_bit(MD_CHANGE_DEVS, &mddev->flags); |
658 | diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c |
659 | index 9ec51cec..0f000e60 100644 |
660 | --- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c |
661 | +++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c |
662 | @@ -227,8 +227,6 @@ static void dma_irq_callback(void *param) |
663 | struct gpmi_nand_data *this = param; |
664 | struct completion *dma_c = &this->dma_done; |
665 | |
666 | - complete(dma_c); |
667 | - |
668 | switch (this->dma_type) { |
669 | case DMA_FOR_COMMAND: |
670 | dma_unmap_sg(this->dev, &this->cmd_sgl, 1, DMA_TO_DEVICE); |
671 | @@ -253,6 +251,8 @@ static void dma_irq_callback(void *param) |
672 | default: |
673 | pr_err("in wrong DMA operation.\n"); |
674 | } |
675 | + |
676 | + complete(dma_c); |
677 | } |
678 | |
679 | int start_dma_without_bch_irq(struct gpmi_nand_data *this, |
680 | diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c |
681 | index eb9f5fb0..e50a0b48 100644 |
682 | --- a/drivers/mtd/nand/nand_base.c |
683 | +++ b/drivers/mtd/nand/nand_base.c |
684 | @@ -2888,10 +2888,21 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip, |
685 | sanitize_string(p->model, sizeof(p->model)); |
686 | if (!mtd->name) |
687 | mtd->name = p->model; |
688 | + |
689 | mtd->writesize = le32_to_cpu(p->byte_per_page); |
690 | - mtd->erasesize = le32_to_cpu(p->pages_per_block) * mtd->writesize; |
691 | + |
692 | + /* |
693 | + * pages_per_block and blocks_per_lun may not be a power-of-2 size |
694 | + * (don't ask me who thought of this...). MTD assumes that these |
695 | + * dimensions will be power-of-2, so just truncate the remaining area. |
696 | + */ |
697 | + mtd->erasesize = 1 << (fls(le32_to_cpu(p->pages_per_block)) - 1); |
698 | + mtd->erasesize *= mtd->writesize; |
699 | + |
700 | mtd->oobsize = le16_to_cpu(p->spare_bytes_per_page); |
701 | - chip->chipsize = le32_to_cpu(p->blocks_per_lun); |
702 | + |
703 | + /* See erasesize comment */ |
704 | + chip->chipsize = 1 << (fls(le32_to_cpu(p->blocks_per_lun)) - 1); |
705 | chip->chipsize *= (uint64_t)mtd->erasesize * p->lun_count; |
706 | *busw = 0; |
707 | if (le16_to_cpu(p->features) & 1) |
708 | diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c |
709 | index e2131ca6..eb4014a2 100644 |
710 | --- a/drivers/net/can/flexcan.c |
711 | +++ b/drivers/net/can/flexcan.c |
712 | @@ -667,7 +667,6 @@ static int flexcan_chip_start(struct net_device *dev) |
713 | { |
714 | struct flexcan_priv *priv = netdev_priv(dev); |
715 | struct flexcan_regs __iomem *regs = priv->base; |
716 | - unsigned int i; |
717 | int err; |
718 | u32 reg_mcr, reg_ctrl; |
719 | |
720 | @@ -735,17 +734,6 @@ static int flexcan_chip_start(struct net_device *dev) |
721 | netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl); |
722 | flexcan_write(reg_ctrl, ®s->ctrl); |
723 | |
724 | - for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) { |
725 | - flexcan_write(0, ®s->cantxfg[i].can_ctrl); |
726 | - flexcan_write(0, ®s->cantxfg[i].can_id); |
727 | - flexcan_write(0, ®s->cantxfg[i].data[0]); |
728 | - flexcan_write(0, ®s->cantxfg[i].data[1]); |
729 | - |
730 | - /* put MB into rx queue */ |
731 | - flexcan_write(FLEXCAN_MB_CNT_CODE(0x4), |
732 | - ®s->cantxfg[i].can_ctrl); |
733 | - } |
734 | - |
735 | /* Abort any pending TX, mark Mailbox as INACTIVE */ |
736 | flexcan_write(FLEXCAN_MB_CNT_CODE(0x4), |
737 | ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl); |
738 | diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c |
739 | index 4be8ccc8..daf55ba8 100644 |
740 | --- a/drivers/net/wireless/mwifiex/sdio.c |
741 | +++ b/drivers/net/wireless/mwifiex/sdio.c |
742 | @@ -938,7 +938,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter, |
743 | struct sk_buff *skb, u32 upld_typ) |
744 | { |
745 | u8 *cmd_buf; |
746 | + __le16 *curr_ptr = (__le16 *)skb->data; |
747 | + u16 pkt_len = le16_to_cpu(*curr_ptr); |
748 | |
749 | + skb_trim(skb, pkt_len); |
750 | skb_pull(skb, INTF_HEADER_LEN); |
751 | |
752 | switch (upld_typ) { |
753 | diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c |
754 | index 5970ff6f..d498b02f 100644 |
755 | --- a/drivers/net/wireless/prism54/islpci_dev.c |
756 | +++ b/drivers/net/wireless/prism54/islpci_dev.c |
757 | @@ -811,6 +811,10 @@ static const struct net_device_ops islpci_netdev_ops = { |
758 | .ndo_validate_addr = eth_validate_addr, |
759 | }; |
760 | |
761 | +static struct device_type wlan_type = { |
762 | + .name = "wlan", |
763 | +}; |
764 | + |
765 | struct net_device * |
766 | islpci_setup(struct pci_dev *pdev) |
767 | { |
768 | @@ -821,9 +825,8 @@ islpci_setup(struct pci_dev *pdev) |
769 | return ndev; |
770 | |
771 | pci_set_drvdata(pdev, ndev); |
772 | -#if defined(SET_NETDEV_DEV) |
773 | SET_NETDEV_DEV(ndev, &pdev->dev); |
774 | -#endif |
775 | + SET_NETDEV_DEVTYPE(ndev, &wlan_type); |
776 | |
777 | /* setup the structure members */ |
778 | ndev->base_addr = pci_resource_start(pdev, 0); |
779 | diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c |
780 | index 0ea85f46..131b22b8 100644 |
781 | --- a/drivers/net/wireless/rt2x00/rt2400pci.c |
782 | +++ b/drivers/net/wireless/rt2x00/rt2400pci.c |
783 | @@ -1253,7 +1253,7 @@ static void rt2400pci_fill_rxdone(struct queue_entry *entry, |
784 | */ |
785 | rxdesc->timestamp = ((u64)rx_high << 32) | rx_low; |
786 | rxdesc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL) & ~0x08; |
787 | - rxdesc->rssi = rt2x00_get_field32(word2, RXD_W3_RSSI) - |
788 | + rxdesc->rssi = rt2x00_get_field32(word3, RXD_W3_RSSI) - |
789 | entry->queue->rt2x00dev->rssi_offset; |
790 | rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT); |
791 | |
792 | diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c |
793 | index 025bdc2e..4f7f822b 100644 |
794 | --- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c |
795 | +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c |
796 | @@ -762,7 +762,7 @@ static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw, |
797 | |
798 | static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw, |
799 | struct rtl_stats *pstats, |
800 | - struct rx_desc_92c *pdesc, |
801 | + struct rx_desc_92c *p_desc, |
802 | struct rx_fwinfo_92c *p_drvinfo, |
803 | bool packet_match_bssid, |
804 | bool packet_toself, |
805 | @@ -777,11 +777,11 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw, |
806 | u32 rssi, total_rssi = 0; |
807 | bool in_powersavemode = false; |
808 | bool is_cck_rate; |
809 | + u8 *pdesc = (u8 *)p_desc; |
810 | |
811 | - is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc); |
812 | + is_cck_rate = RX_HAL_IS_CCK_RATE(p_desc); |
813 | pstats->packet_matchbssid = packet_match_bssid; |
814 | pstats->packet_toself = packet_toself; |
815 | - pstats->is_cck = is_cck_rate; |
816 | pstats->packet_beacon = packet_beacon; |
817 | pstats->is_cck = is_cck_rate; |
818 | pstats->RX_SIGQ[0] = -1; |
819 | diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |
820 | index 9adb21a1..2fd82970 100644 |
821 | --- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |
822 | +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |
823 | @@ -303,10 +303,10 @@ out: |
824 | bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw, |
825 | struct rtl_stats *stats, |
826 | struct ieee80211_rx_status *rx_status, |
827 | - u8 *p_desc, struct sk_buff *skb) |
828 | + u8 *pdesc, struct sk_buff *skb) |
829 | { |
830 | struct rx_fwinfo_92c *p_drvinfo; |
831 | - struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc; |
832 | + struct rx_desc_92c *p_desc = (struct rx_desc_92c *)pdesc; |
833 | u32 phystatus = GET_RX_DESC_PHY_STATUS(pdesc); |
834 | |
835 | stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc); |
836 | @@ -345,11 +345,11 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw, |
837 | if (phystatus) { |
838 | p_drvinfo = (struct rx_fwinfo_92c *)(skb->data + |
839 | stats->rx_bufshift); |
840 | - rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc, |
841 | + rtl92c_translate_rx_signal_stuff(hw, skb, stats, p_desc, |
842 | p_drvinfo); |
843 | } |
844 | /*rx_status->qual = stats->signal; */ |
845 | - rx_status->signal = stats->rssi + 10; |
846 | + rx_status->signal = stats->recvsignalpower + 10; |
847 | /*rx_status->noise = -stats->noise; */ |
848 | return true; |
849 | } |
850 | diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c |
851 | index a7f6126e..1a2bbc2b 100644 |
852 | --- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c |
853 | +++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c |
854 | @@ -529,7 +529,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats, |
855 | p_drvinfo); |
856 | } |
857 | /*rx_status->qual = stats->signal; */ |
858 | - rx_status->signal = stats->rssi + 10; |
859 | + rx_status->signal = stats->recvsignalpower + 10; |
860 | /*rx_status->noise = -stats->noise; */ |
861 | return true; |
862 | } |
863 | diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c |
864 | index 08c2f562..c405f967 100644 |
865 | --- a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c |
866 | +++ b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c |
867 | @@ -268,7 +268,7 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw, |
868 | rtlefuse->pwrgroup_ht40 |
869 | [RF90_PATH_A][chnl - 1]) { |
870 | pwrdiff_limit[i] = |
871 | - rtlefuse->pwrgroup_ht20 |
872 | + rtlefuse->pwrgroup_ht40 |
873 | [RF90_PATH_A][chnl - 1]; |
874 | } |
875 | } else { |
876 | diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c |
877 | index 2fd3d13b..94bbce82 100644 |
878 | --- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c |
879 | +++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c |
880 | @@ -582,7 +582,7 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats, |
881 | } |
882 | |
883 | /*rx_status->qual = stats->signal; */ |
884 | - rx_status->signal = stats->rssi + 10; |
885 | + rx_status->signal = stats->recvsignalpower + 10; |
886 | /*rx_status->noise = -stats->noise; */ |
887 | |
888 | return true; |
889 | diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c |
890 | index e0610bda..7e41b70a 100644 |
891 | --- a/drivers/pci/pcie/portdrv_pci.c |
892 | +++ b/drivers/pci/pcie/portdrv_pci.c |
893 | @@ -151,7 +151,6 @@ static int __devinit pcie_portdrv_probe(struct pci_dev *dev, |
894 | static void pcie_portdrv_remove(struct pci_dev *dev) |
895 | { |
896 | pcie_port_device_remove(dev); |
897 | - pci_disable_device(dev); |
898 | } |
899 | |
900 | static int error_detected_iter(struct device *device, void *data) |
901 | diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c |
902 | index 8334dadc..be56590b 100644 |
903 | --- a/drivers/s390/net/qeth_core_main.c |
904 | +++ b/drivers/s390/net/qeth_core_main.c |
905 | @@ -4357,7 +4357,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata) |
906 | struct qeth_cmd_buffer *iob; |
907 | struct qeth_ipa_cmd *cmd; |
908 | struct qeth_snmp_ureq *ureq; |
909 | - int req_len; |
910 | + unsigned int req_len; |
911 | struct qeth_arp_query_info qinfo = {0, }; |
912 | int rc = 0; |
913 | |
914 | @@ -4373,6 +4373,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata) |
915 | /* skip 4 bytes (data_len struct member) to get req_len */ |
916 | if (copy_from_user(&req_len, udata + sizeof(int), sizeof(int))) |
917 | return -EFAULT; |
918 | + if (req_len > (QETH_BUFSIZE - IPA_PDU_HEADER_SIZE - |
919 | + sizeof(struct qeth_ipacmd_hdr) - |
920 | + sizeof(struct qeth_ipacmd_setadpparms_hdr))) |
921 | + return -EINVAL; |
922 | ureq = memdup_user(udata, req_len + sizeof(struct qeth_snmp_ureq_hdr)); |
923 | if (IS_ERR(ureq)) { |
924 | QETH_CARD_TEXT(card, 2, "snmpnome"); |
925 | diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c |
926 | index 76ea4a8f..56a96d32 100644 |
927 | --- a/drivers/staging/media/lirc/lirc_zilog.c |
928 | +++ b/drivers/staging/media/lirc/lirc_zilog.c |
929 | @@ -61,6 +61,9 @@ |
930 | #include <media/lirc_dev.h> |
931 | #include <media/lirc.h> |
932 | |
933 | +/* Max transfer size done by I2C transfer functions */ |
934 | +#define MAX_XFER_SIZE 64 |
935 | + |
936 | struct IR; |
937 | |
938 | struct IR_rx { |
939 | @@ -942,7 +945,14 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos) |
940 | schedule(); |
941 | set_current_state(TASK_INTERRUPTIBLE); |
942 | } else { |
943 | - unsigned char buf[rbuf->chunk_size]; |
944 | + unsigned char buf[MAX_XFER_SIZE]; |
945 | + |
946 | + if (rbuf->chunk_size > sizeof(buf)) { |
947 | + zilog_error("chunk_size is too big (%d)!\n", |
948 | + rbuf->chunk_size); |
949 | + ret = -EINVAL; |
950 | + break; |
951 | + } |
952 | m = lirc_buffer_read(rbuf, buf); |
953 | if (m == rbuf->chunk_size) { |
954 | ret = copy_to_user((void *)outbuf+written, buf, |
955 | diff --git a/drivers/staging/tidspbridge/Kconfig b/drivers/staging/tidspbridge/Kconfig |
956 | index 0dd479f5..f67c78e5 100644 |
957 | --- a/drivers/staging/tidspbridge/Kconfig |
958 | +++ b/drivers/staging/tidspbridge/Kconfig |
959 | @@ -4,7 +4,7 @@ |
960 | |
961 | menuconfig TIDSPBRIDGE |
962 | tristate "DSP Bridge driver" |
963 | - depends on ARCH_OMAP3 |
964 | + depends on ARCH_OMAP3 && BROKEN |
965 | select OMAP_MBOX_FWK |
966 | help |
967 | DSP/BIOS Bridge is designed for platforms that contain a GPP and |
968 | diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c |
969 | index 06f27f62..858e2a8e 100644 |
970 | --- a/drivers/staging/vt6656/baseband.c |
971 | +++ b/drivers/staging/vt6656/baseband.c |
972 | @@ -976,6 +976,7 @@ BOOL BBbVT3184Init(PSDevice pDevice) |
973 | PBYTE pbyAgc; |
974 | WORD wLengthAgc; |
975 | BYTE abyArray[256]; |
976 | + u8 data; |
977 | |
978 | ntStatus = CONTROLnsRequestIn(pDevice, |
979 | MESSAGE_TYPE_READ, |
980 | @@ -1144,6 +1145,16 @@ else { |
981 | ControlvWriteByte(pDevice,MESSAGE_REQUEST_BBREG,0x0D,0x01); |
982 | |
983 | RFbRFTableDownload(pDevice); |
984 | + |
985 | + /* Fix for TX USB resets from vendors driver */ |
986 | + CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, USB_REG4, |
987 | + MESSAGE_REQUEST_MEM, sizeof(data), &data); |
988 | + |
989 | + data |= 0x2; |
990 | + |
991 | + CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, USB_REG4, |
992 | + MESSAGE_REQUEST_MEM, sizeof(data), &data); |
993 | + |
994 | return TRUE;//ntStatus; |
995 | } |
996 | |
997 | diff --git a/drivers/staging/vt6656/rndis.h b/drivers/staging/vt6656/rndis.h |
998 | index fccf7e98..dcf7bf54 100644 |
999 | --- a/drivers/staging/vt6656/rndis.h |
1000 | +++ b/drivers/staging/vt6656/rndis.h |
1001 | @@ -69,6 +69,7 @@ |
1002 | |
1003 | #define VIAUSB20_PACKET_HEADER 0x04 |
1004 | |
1005 | +#define USB_REG4 0x604 |
1006 | |
1007 | /*--------------------- Export Classes ----------------------------*/ |
1008 | |
1009 | diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c |
1010 | index a0fc7b9e..b54f6ecf 100644 |
1011 | --- a/drivers/target/iscsi/iscsi_target_auth.c |
1012 | +++ b/drivers/target/iscsi/iscsi_target_auth.c |
1013 | @@ -174,6 +174,7 @@ static int chap_server_compute_md5( |
1014 | unsigned char client_digest[MD5_SIGNATURE_SIZE]; |
1015 | unsigned char server_digest[MD5_SIGNATURE_SIZE]; |
1016 | unsigned char chap_n[MAX_CHAP_N_SIZE], chap_r[MAX_RESPONSE_LENGTH]; |
1017 | + size_t compare_len; |
1018 | struct iscsi_chap *chap = conn->auth_protocol; |
1019 | struct crypto_hash *tfm; |
1020 | struct hash_desc desc; |
1021 | @@ -212,7 +213,9 @@ static int chap_server_compute_md5( |
1022 | goto out; |
1023 | } |
1024 | |
1025 | - if (memcmp(chap_n, auth->userid, strlen(auth->userid)) != 0) { |
1026 | + /* Include the terminating NULL in the compare */ |
1027 | + compare_len = strlen(auth->userid) + 1; |
1028 | + if (strncmp(chap_n, auth->userid, compare_len) != 0) { |
1029 | pr_err("CHAP_N values do not match!\n"); |
1030 | goto out; |
1031 | } |
1032 | diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c |
1033 | index 2dba448c..60470ee9 100644 |
1034 | --- a/drivers/target/iscsi/iscsi_target_nego.c |
1035 | +++ b/drivers/target/iscsi/iscsi_target_nego.c |
1036 | @@ -89,7 +89,7 @@ int extract_param( |
1037 | if (len < 0) |
1038 | return -1; |
1039 | |
1040 | - if (len > max_length) { |
1041 | + if (len >= max_length) { |
1042 | pr_err("Length of input: %d exceeds max_length:" |
1043 | " %d\n", len, max_length); |
1044 | return -1; |
1045 | diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c |
1046 | index 0443a4f7..4d2bbd89 100644 |
1047 | --- a/drivers/video/backlight/atmel-pwm-bl.c |
1048 | +++ b/drivers/video/backlight/atmel-pwm-bl.c |
1049 | @@ -70,7 +70,7 @@ static int atmel_pwm_bl_set_intensity(struct backlight_device *bd) |
1050 | static int atmel_pwm_bl_get_intensity(struct backlight_device *bd) |
1051 | { |
1052 | struct atmel_pwm_bl *pwmbl = bl_get_data(bd); |
1053 | - u8 intensity; |
1054 | + u32 intensity; |
1055 | |
1056 | if (pwmbl->pdata->pwm_active_low) { |
1057 | intensity = pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY) - |
1058 | @@ -80,7 +80,7 @@ static int atmel_pwm_bl_get_intensity(struct backlight_device *bd) |
1059 | pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY); |
1060 | } |
1061 | |
1062 | - return intensity; |
1063 | + return intensity & 0xffff; |
1064 | } |
1065 | |
1066 | static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl) |
1067 | diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c |
1068 | index 10f5e0b4..901c3d74 100644 |
1069 | --- a/fs/devpts/inode.c |
1070 | +++ b/fs/devpts/inode.c |
1071 | @@ -475,6 +475,7 @@ static void devpts_kill_sb(struct super_block *sb) |
1072 | { |
1073 | struct pts_fs_info *fsi = DEVPTS_SB(sb); |
1074 | |
1075 | + ida_destroy(&fsi->allocated_ptys); |
1076 | kfree(fsi); |
1077 | kill_litter_super(sb); |
1078 | } |
1079 | diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c |
1080 | index b1aa7fd4..01f2cf34 100644 |
1081 | --- a/fs/ext4/xattr.c |
1082 | +++ b/fs/ext4/xattr.c |
1083 | @@ -1270,6 +1270,7 @@ retry: |
1084 | new_extra_isize = s_min_extra_isize; |
1085 | kfree(is); is = NULL; |
1086 | kfree(bs); bs = NULL; |
1087 | + brelse(bh); |
1088 | goto retry; |
1089 | } |
1090 | error = -1; |
1091 | diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h |
1092 | index 3595a023..292645fc 100644 |
1093 | --- a/include/linux/mtd/map.h |
1094 | +++ b/include/linux/mtd/map.h |
1095 | @@ -362,7 +362,7 @@ static inline map_word map_word_load_partial(struct map_info *map, map_word orig |
1096 | bitpos = (map_bankwidth(map)-1-i)*8; |
1097 | #endif |
1098 | orig.x[0] &= ~(0xff << bitpos); |
1099 | - orig.x[0] |= buf[i-start] << bitpos; |
1100 | + orig.x[0] |= (unsigned long)buf[i-start] << bitpos; |
1101 | } |
1102 | } |
1103 | return orig; |
1104 | @@ -381,7 +381,7 @@ static inline map_word map_word_ff(struct map_info *map) |
1105 | |
1106 | if (map_bankwidth(map) < MAP_FF_LIMIT) { |
1107 | int bw = 8 * map_bankwidth(map); |
1108 | - r.x[0] = (1 << bw) - 1; |
1109 | + r.x[0] = (1UL << bw) - 1; |
1110 | } else { |
1111 | for (i=0; i<map_words(map); i++) |
1112 | r.x[i] = ~0UL; |
1113 | diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h |
1114 | index 76972494..763bf05c 100644 |
1115 | --- a/include/trace/ftrace.h |
1116 | +++ b/include/trace/ftrace.h |
1117 | @@ -379,7 +379,8 @@ ftrace_define_fields_##call(struct ftrace_event_call *event_call) \ |
1118 | __data_size += (len) * sizeof(type); |
1119 | |
1120 | #undef __string |
1121 | -#define __string(item, src) __dynamic_array(char, item, strlen(src) + 1) |
1122 | +#define __string(item, src) __dynamic_array(char, item, \ |
1123 | + strlen((src) ? (const char *)(src) : "(null)") + 1) |
1124 | |
1125 | #undef DECLARE_EVENT_CLASS |
1126 | #define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \ |
1127 | @@ -504,7 +505,7 @@ static inline notrace int ftrace_get_offsets_##call( \ |
1128 | |
1129 | #undef __assign_str |
1130 | #define __assign_str(dst, src) \ |
1131 | - strcpy(__get_str(dst), src); |
1132 | + strcpy(__get_str(dst), (src) ? (const char *)(src) : "(null)"); |
1133 | |
1134 | #undef TP_fast_assign |
1135 | #define TP_fast_assign(args...) args |
1136 | diff --git a/kernel/audit.c b/kernel/audit.c |
1137 | index 1c7f2c61..4478f7b2 100644 |
1138 | --- a/kernel/audit.c |
1139 | +++ b/kernel/audit.c |
1140 | @@ -625,7 +625,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type, |
1141 | char *ctx = NULL; |
1142 | u32 len; |
1143 | |
1144 | - if (!audit_enabled) { |
1145 | + if (!audit_enabled && msg_type != AUDIT_USER_AVC) { |
1146 | *ab = NULL; |
1147 | return rc; |
1148 | } |
1149 | @@ -684,6 +684,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) |
1150 | |
1151 | switch (msg_type) { |
1152 | case AUDIT_GET: |
1153 | + status_set.mask = 0; |
1154 | status_set.enabled = audit_enabled; |
1155 | status_set.failure = audit_failure; |
1156 | status_set.pid = audit_pid; |
1157 | @@ -695,7 +696,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) |
1158 | &status_set, sizeof(status_set)); |
1159 | break; |
1160 | case AUDIT_SET: |
1161 | - if (nlh->nlmsg_len < sizeof(struct audit_status)) |
1162 | + if (nlmsg_len(nlh) < sizeof(struct audit_status)) |
1163 | return -EINVAL; |
1164 | status_get = (struct audit_status *)data; |
1165 | if (status_get->mask & AUDIT_STATUS_ENABLED) { |
1166 | diff --git a/kernel/cpuset.c b/kernel/cpuset.c |
1167 | index 8fe6f6b6..e372d949 100644 |
1168 | --- a/kernel/cpuset.c |
1169 | +++ b/kernel/cpuset.c |
1170 | @@ -983,8 +983,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk, |
1171 | need_loop = task_has_mempolicy(tsk) || |
1172 | !nodes_intersects(*newmems, tsk->mems_allowed); |
1173 | |
1174 | - if (need_loop) |
1175 | + if (need_loop) { |
1176 | + local_irq_disable(); |
1177 | write_seqcount_begin(&tsk->mems_allowed_seq); |
1178 | + } |
1179 | |
1180 | nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems); |
1181 | mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1); |
1182 | @@ -992,8 +994,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk, |
1183 | mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP2); |
1184 | tsk->mems_allowed = *newmems; |
1185 | |
1186 | - if (need_loop) |
1187 | + if (need_loop) { |
1188 | write_seqcount_end(&tsk->mems_allowed_seq); |
1189 | + local_irq_enable(); |
1190 | + } |
1191 | |
1192 | task_unlock(tsk); |
1193 | } |
1194 | diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c |
1195 | index 0de28576..91c04f16 100644 |
1196 | --- a/kernel/power/snapshot.c |
1197 | +++ b/kernel/power/snapshot.c |
1198 | @@ -1398,7 +1398,11 @@ int hibernate_preallocate_memory(void) |
1199 | * highmem and non-highmem zones separately. |
1200 | */ |
1201 | pages_highmem = preallocate_image_highmem(highmem / 2); |
1202 | - alloc = (count - max_size) - pages_highmem; |
1203 | + alloc = count - max_size; |
1204 | + if (alloc > pages_highmem) |
1205 | + alloc -= pages_highmem; |
1206 | + else |
1207 | + alloc = 0; |
1208 | pages = preallocate_image_memory(alloc, avail_normal); |
1209 | if (pages < alloc) { |
1210 | /* We have exhausted non-highmem pages, try highmem. */ |
1211 | diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c |
1212 | index 8a538c55..877aa733 100644 |
1213 | --- a/kernel/time/alarmtimer.c |
1214 | +++ b/kernel/time/alarmtimer.c |
1215 | @@ -474,7 +474,7 @@ static int alarm_clock_getres(const clockid_t which_clock, struct timespec *tp) |
1216 | clockid_t baseid = alarm_bases[clock2alarm(which_clock)].base_clockid; |
1217 | |
1218 | if (!alarmtimer_get_rtcdev()) |
1219 | - return -ENOTSUPP; |
1220 | + return -EINVAL; |
1221 | |
1222 | return hrtimer_get_res(baseid, tp); |
1223 | } |
1224 | @@ -491,7 +491,7 @@ static int alarm_clock_get(clockid_t which_clock, struct timespec *tp) |
1225 | struct alarm_base *base = &alarm_bases[clock2alarm(which_clock)]; |
1226 | |
1227 | if (!alarmtimer_get_rtcdev()) |
1228 | - return -ENOTSUPP; |
1229 | + return -EINVAL; |
1230 | |
1231 | *tp = ktime_to_timespec(base->gettime()); |
1232 | return 0; |
1233 | diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c |
1234 | index e101cf9a..8c8169bf 100644 |
1235 | --- a/kernel/trace/ftrace.c |
1236 | +++ b/kernel/trace/ftrace.c |
1237 | @@ -312,9 +312,6 @@ static int remove_ftrace_list_ops(struct ftrace_ops **list, |
1238 | |
1239 | static int __register_ftrace_function(struct ftrace_ops *ops) |
1240 | { |
1241 | - if (ftrace_disabled) |
1242 | - return -ENODEV; |
1243 | - |
1244 | if (FTRACE_WARN_ON(ops == &global_ops)) |
1245 | return -EINVAL; |
1246 | |
1247 | @@ -348,9 +345,6 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops) |
1248 | { |
1249 | int ret; |
1250 | |
1251 | - if (ftrace_disabled) |
1252 | - return -ENODEV; |
1253 | - |
1254 | if (WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))) |
1255 | return -EBUSY; |
1256 | |
1257 | @@ -1940,10 +1934,15 @@ static void ftrace_startup_enable(int command) |
1258 | static int ftrace_startup(struct ftrace_ops *ops, int command) |
1259 | { |
1260 | bool hash_enable = true; |
1261 | + int ret; |
1262 | |
1263 | if (unlikely(ftrace_disabled)) |
1264 | return -ENODEV; |
1265 | |
1266 | + ret = __register_ftrace_function(ops); |
1267 | + if (ret) |
1268 | + return ret; |
1269 | + |
1270 | ftrace_start_up++; |
1271 | command |= FTRACE_UPDATE_CALLS; |
1272 | |
1273 | @@ -1965,12 +1964,17 @@ static int ftrace_startup(struct ftrace_ops *ops, int command) |
1274 | return 0; |
1275 | } |
1276 | |
1277 | -static void ftrace_shutdown(struct ftrace_ops *ops, int command) |
1278 | +static int ftrace_shutdown(struct ftrace_ops *ops, int command) |
1279 | { |
1280 | bool hash_disable = true; |
1281 | + int ret; |
1282 | |
1283 | if (unlikely(ftrace_disabled)) |
1284 | - return; |
1285 | + return -ENODEV; |
1286 | + |
1287 | + ret = __unregister_ftrace_function(ops); |
1288 | + if (ret) |
1289 | + return ret; |
1290 | |
1291 | ftrace_start_up--; |
1292 | /* |
1293 | @@ -2005,9 +2009,10 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command) |
1294 | } |
1295 | |
1296 | if (!command || !ftrace_enabled) |
1297 | - return; |
1298 | + return 0; |
1299 | |
1300 | ftrace_run_update_code(command); |
1301 | + return 0; |
1302 | } |
1303 | |
1304 | static void ftrace_startup_sysctl(void) |
1305 | @@ -2873,16 +2878,13 @@ static void __enable_ftrace_function_probe(void) |
1306 | if (i == FTRACE_FUNC_HASHSIZE) |
1307 | return; |
1308 | |
1309 | - ret = __register_ftrace_function(&trace_probe_ops); |
1310 | - if (!ret) |
1311 | - ret = ftrace_startup(&trace_probe_ops, 0); |
1312 | + ret = ftrace_startup(&trace_probe_ops, 0); |
1313 | |
1314 | ftrace_probe_registered = 1; |
1315 | } |
1316 | |
1317 | static void __disable_ftrace_function_probe(void) |
1318 | { |
1319 | - int ret; |
1320 | int i; |
1321 | |
1322 | if (!ftrace_probe_registered) |
1323 | @@ -2895,9 +2897,7 @@ static void __disable_ftrace_function_probe(void) |
1324 | } |
1325 | |
1326 | /* no more funcs left */ |
1327 | - ret = __unregister_ftrace_function(&trace_probe_ops); |
1328 | - if (!ret) |
1329 | - ftrace_shutdown(&trace_probe_ops, 0); |
1330 | + ftrace_shutdown(&trace_probe_ops, 0); |
1331 | |
1332 | ftrace_probe_registered = 0; |
1333 | } |
1334 | @@ -3948,12 +3948,15 @@ device_initcall(ftrace_nodyn_init); |
1335 | static inline int ftrace_init_dyn_debugfs(struct dentry *d_tracer) { return 0; } |
1336 | static inline void ftrace_startup_enable(int command) { } |
1337 | /* Keep as macros so we do not need to define the commands */ |
1338 | -# define ftrace_startup(ops, command) \ |
1339 | - ({ \ |
1340 | - (ops)->flags |= FTRACE_OPS_FL_ENABLED; \ |
1341 | - 0; \ |
1342 | +# define ftrace_startup(ops, command) \ |
1343 | + ({ \ |
1344 | + int ___ret = __register_ftrace_function(ops); \ |
1345 | + if (!___ret) \ |
1346 | + (ops)->flags |= FTRACE_OPS_FL_ENABLED; \ |
1347 | + ___ret; \ |
1348 | }) |
1349 | -# define ftrace_shutdown(ops, command) do { } while (0) |
1350 | +# define ftrace_shutdown(ops, command) __unregister_ftrace_function(ops) |
1351 | + |
1352 | # define ftrace_startup_sysctl() do { } while (0) |
1353 | # define ftrace_shutdown_sysctl() do { } while (0) |
1354 | |
1355 | @@ -4323,15 +4326,8 @@ int register_ftrace_function(struct ftrace_ops *ops) |
1356 | |
1357 | mutex_lock(&ftrace_lock); |
1358 | |
1359 | - if (unlikely(ftrace_disabled)) |
1360 | - goto out_unlock; |
1361 | - |
1362 | - ret = __register_ftrace_function(ops); |
1363 | - if (!ret) |
1364 | - ret = ftrace_startup(ops, 0); |
1365 | - |
1366 | + ret = ftrace_startup(ops, 0); |
1367 | |
1368 | - out_unlock: |
1369 | mutex_unlock(&ftrace_lock); |
1370 | return ret; |
1371 | } |
1372 | @@ -4348,9 +4344,7 @@ int unregister_ftrace_function(struct ftrace_ops *ops) |
1373 | int ret; |
1374 | |
1375 | mutex_lock(&ftrace_lock); |
1376 | - ret = __unregister_ftrace_function(ops); |
1377 | - if (!ret) |
1378 | - ftrace_shutdown(ops, 0); |
1379 | + ret = ftrace_shutdown(ops, 0); |
1380 | mutex_unlock(&ftrace_lock); |
1381 | |
1382 | return ret; |
1383 | @@ -4544,6 +4538,12 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state, |
1384 | return NOTIFY_DONE; |
1385 | } |
1386 | |
1387 | +/* Just a place holder for function graph */ |
1388 | +static struct ftrace_ops fgraph_ops __read_mostly = { |
1389 | + .func = ftrace_stub, |
1390 | + .flags = FTRACE_OPS_FL_GLOBAL, |
1391 | +}; |
1392 | + |
1393 | int register_ftrace_graph(trace_func_graph_ret_t retfunc, |
1394 | trace_func_graph_ent_t entryfunc) |
1395 | { |
1396 | @@ -4570,7 +4570,7 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc, |
1397 | ftrace_graph_return = retfunc; |
1398 | ftrace_graph_entry = entryfunc; |
1399 | |
1400 | - ret = ftrace_startup(&global_ops, FTRACE_START_FUNC_RET); |
1401 | + ret = ftrace_startup(&fgraph_ops, FTRACE_START_FUNC_RET); |
1402 | |
1403 | out: |
1404 | mutex_unlock(&ftrace_lock); |
1405 | @@ -4587,7 +4587,7 @@ void unregister_ftrace_graph(void) |
1406 | ftrace_graph_active--; |
1407 | ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub; |
1408 | ftrace_graph_entry = ftrace_graph_entry_stub; |
1409 | - ftrace_shutdown(&global_ops, FTRACE_STOP_FUNC_RET); |
1410 | + ftrace_shutdown(&fgraph_ops, FTRACE_STOP_FUNC_RET); |
1411 | unregister_pm_notifier(&ftrace_suspend_notifier); |
1412 | unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL); |
1413 | |
1414 | diff --git a/lib/vsprintf.c b/lib/vsprintf.c |
1415 | index abbabec9..73e2c45a 100644 |
1416 | --- a/lib/vsprintf.c |
1417 | +++ b/lib/vsprintf.c |
1418 | @@ -25,6 +25,7 @@ |
1419 | #include <linux/kallsyms.h> |
1420 | #include <linux/uaccess.h> |
1421 | #include <linux/ioport.h> |
1422 | +#include <linux/cred.h> |
1423 | #include <net/addrconf.h> |
1424 | |
1425 | #include <asm/page.h> /* for PAGE_SIZE */ |
1426 | @@ -930,11 +931,37 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, |
1427 | spec.field_width = 2 * sizeof(void *); |
1428 | return string(buf, end, "pK-error", spec); |
1429 | } |
1430 | - if (!((kptr_restrict == 0) || |
1431 | - (kptr_restrict == 1 && |
1432 | - has_capability_noaudit(current, CAP_SYSLOG)))) |
1433 | + |
1434 | + switch (kptr_restrict) { |
1435 | + case 0: |
1436 | + /* Always print %pK values */ |
1437 | + break; |
1438 | + case 1: { |
1439 | + /* |
1440 | + * Only print the real pointer value if the current |
1441 | + * process has CAP_SYSLOG and is running with the |
1442 | + * same credentials it started with. This is because |
1443 | + * access to files is checked at open() time, but %pK |
1444 | + * checks permission at read() time. We don't want to |
1445 | + * leak pointer values if a binary opens a file using |
1446 | + * %pK and then elevates privileges before reading it. |
1447 | + */ |
1448 | + const struct cred *cred = current_cred(); |
1449 | + |
1450 | + if (!has_capability_noaudit(current, CAP_SYSLOG) || |
1451 | + (cred->euid != cred->uid) || |
1452 | + (cred->egid != cred->gid)) |
1453 | + ptr = NULL; |
1454 | + break; |
1455 | + } |
1456 | + case 2: |
1457 | + default: |
1458 | + /* Always print 0's for %pK */ |
1459 | ptr = NULL; |
1460 | + break; |
1461 | + } |
1462 | break; |
1463 | + |
1464 | case 'N': |
1465 | switch (fmt[1]) { |
1466 | case 'F': |
1467 | diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c |
1468 | index da4b8b23..6235d052 100644 |
1469 | --- a/security/selinux/netlabel.c |
1470 | +++ b/security/selinux/netlabel.c |
1471 | @@ -442,8 +442,7 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr) |
1472 | sksec->nlbl_state != NLBL_CONNLABELED) |
1473 | return 0; |
1474 | |
1475 | - local_bh_disable(); |
1476 | - bh_lock_sock_nested(sk); |
1477 | + lock_sock(sk); |
1478 | |
1479 | /* connected sockets are allowed to disconnect when the address family |
1480 | * is set to AF_UNSPEC, if that is what is happening we want to reset |
1481 | @@ -464,7 +463,6 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr) |
1482 | sksec->nlbl_state = NLBL_CONNLABELED; |
1483 | |
1484 | socket_connect_return: |
1485 | - bh_unlock_sock(sk); |
1486 | - local_bh_enable(); |
1487 | + release_sock(sk); |
1488 | return rc; |
1489 | } |
1490 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
1491 | index 810f1fc2..c32ae4d5 100644 |
1492 | --- a/sound/pci/hda/patch_realtek.c |
1493 | +++ b/sound/pci/hda/patch_realtek.c |
1494 | @@ -6969,6 +6969,7 @@ static int patch_alc662(struct hda_codec *codec) |
1495 | case 0x10ec0272: |
1496 | case 0x10ec0663: |
1497 | case 0x10ec0665: |
1498 | + case 0x10ec0668: |
1499 | set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT); |
1500 | break; |
1501 | case 0x10ec0273: |
1502 | diff --git a/sound/soc/blackfin/bf5xx-i2s.c b/sound/soc/blackfin/bf5xx-i2s.c |
1503 | index 4dccf037..f59a961b 100644 |
1504 | --- a/sound/soc/blackfin/bf5xx-i2s.c |
1505 | +++ b/sound/soc/blackfin/bf5xx-i2s.c |
1506 | @@ -111,6 +111,7 @@ static int bf5xx_i2s_hw_params(struct snd_pcm_substream *substream, |
1507 | bf5xx_i2s->tcr2 |= 7; |
1508 | bf5xx_i2s->rcr2 |= 7; |
1509 | sport_handle->wdsize = 1; |
1510 | + break; |
1511 | case SNDRV_PCM_FORMAT_S16_LE: |
1512 | bf5xx_i2s->tcr2 |= 15; |
1513 | bf5xx_i2s->rcr2 |= 15; |
1514 | diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c |
1515 | index b3e24f28..7e4245f1 100644 |
1516 | --- a/sound/soc/codecs/ak4642.c |
1517 | +++ b/sound/soc/codecs/ak4642.c |
1518 | @@ -262,7 +262,7 @@ static int ak4642_dai_startup(struct snd_pcm_substream *substream, |
1519 | * This operation came from example code of |
1520 | * "ASAHI KASEI AK4642" (japanese) manual p94. |
1521 | */ |
1522 | - snd_soc_write(codec, SG_SL1, PMMP | MGAIN0); |
1523 | + snd_soc_update_bits(codec, SG_SL1, PMMP | MGAIN0, PMMP | MGAIN0); |
1524 | snd_soc_write(codec, TIMER, ZTM(0x3) | WTM(0x3)); |
1525 | snd_soc_write(codec, ALC_CTL1, ALC | LMTH0); |
1526 | snd_soc_update_bits(codec, PW_MGMT1, PMADL, PMADL); |
1527 | diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c |
1528 | index e96c6ede..0b5132f7 100644 |
1529 | --- a/sound/soc/codecs/wm8962.c |
1530 | +++ b/sound/soc/codecs/wm8962.c |
1531 | @@ -3675,6 +3675,8 @@ static __devinit int wm8962_i2c_probe(struct i2c_client *i2c, |
1532 | if (ret < 0) |
1533 | goto err_regmap; |
1534 | |
1535 | + regcache_cache_only(wm8962->regmap, true); |
1536 | + |
1537 | /* The drivers should power up as needed */ |
1538 | regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies); |
1539 | |
1540 | diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c |
1541 | index bdfbc1be..91a0a2f8 100644 |
1542 | --- a/virt/kvm/kvm_main.c |
1543 | +++ b/virt/kvm/kvm_main.c |
1544 | @@ -774,7 +774,7 @@ int __kvm_set_memory_region(struct kvm *kvm, |
1545 | /* destroy any largepage mappings for dirty tracking */ |
1546 | } |
1547 | |
1548 | - if (!npages) { |
1549 | + if (!npages || base_gfn != old.base_gfn) { |
1550 | struct kvm_memory_slot *slot; |
1551 | |
1552 | r = -ENOMEM; |
1553 | @@ -790,8 +790,10 @@ int __kvm_set_memory_region(struct kvm *kvm, |
1554 | old_memslots = kvm->memslots; |
1555 | rcu_assign_pointer(kvm->memslots, slots); |
1556 | synchronize_srcu_expedited(&kvm->srcu); |
1557 | - /* From this point no new shadow pages pointing to a deleted |
1558 | - * memslot will be created. |
1559 | + /* slot was deleted or moved, clear iommu mapping */ |
1560 | + kvm_iommu_unmap_pages(kvm, &old); |
1561 | + /* From this point no new shadow pages pointing to a deleted, |
1562 | + * or moved, memslot will be created. |
1563 | * |
1564 | * validation of sp->gfn happens in: |
1565 | * - gfn_to_hva (kvm_read_guest, gfn_to_pfn) |
1566 | @@ -805,20 +807,19 @@ int __kvm_set_memory_region(struct kvm *kvm, |
1567 | if (r) |
1568 | goto out_free; |
1569 | |
1570 | - /* map/unmap the pages in iommu page table */ |
1571 | - if (npages) { |
1572 | - r = kvm_iommu_map_pages(kvm, &new); |
1573 | - if (r) |
1574 | - goto out_free; |
1575 | - } else |
1576 | - kvm_iommu_unmap_pages(kvm, &old); |
1577 | - |
1578 | r = -ENOMEM; |
1579 | slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots), |
1580 | GFP_KERNEL); |
1581 | if (!slots) |
1582 | goto out_free; |
1583 | |
1584 | + /* map new memory slot into the iommu */ |
1585 | + if (npages) { |
1586 | + r = kvm_iommu_map_pages(kvm, &new); |
1587 | + if (r) |
1588 | + goto out_slots; |
1589 | + } |
1590 | + |
1591 | /* actual memory is freed via old in kvm_free_physmem_slot below */ |
1592 | if (!npages) { |
1593 | new.rmap = NULL; |
1594 | @@ -845,6 +846,8 @@ int __kvm_set_memory_region(struct kvm *kvm, |
1595 | |
1596 | return 0; |
1597 | |
1598 | +out_slots: |
1599 | + kfree(slots); |
1600 | out_free: |
1601 | kvm_free_physmem_slot(&new, &old); |
1602 | out: |