Contents of /trunk/kernel-magellan/patches-3.17/0106-3.17.7-all-fixes.patch
Parent Directory | Revision Log
Revision 2537 -
(show annotations)
(download)
Fri Jan 30 10:05:41 2015 UTC (9 years, 4 months ago) by niro
File size: 35154 byte(s)
Fri Jan 30 10:05:41 2015 UTC (9 years, 4 months ago) by niro
File size: 35154 byte(s)
-linux-3.17.7
1 | diff --git a/Makefile b/Makefile |
2 | index bb43e9e6a79c..267f8936ff69 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 3 |
7 | PATCHLEVEL = 17 |
8 | -SUBLEVEL = 6 |
9 | +SUBLEVEL = 7 |
10 | EXTRAVERSION = |
11 | NAME = Shuffling Zombie Juror |
12 | |
13 | diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c |
14 | index 9f7ecbda250c..1588716e32be 100644 |
15 | --- a/arch/mips/net/bpf_jit.c |
16 | +++ b/arch/mips/net/bpf_jit.c |
17 | @@ -430,7 +430,7 @@ static inline void emit_mod(unsigned int dst, unsigned int src, |
18 | u32 *p = &ctx->target[ctx->idx]; |
19 | uasm_i_divu(&p, dst, src); |
20 | p = &ctx->target[ctx->idx + 1]; |
21 | - uasm_i_mflo(&p, dst); |
22 | + uasm_i_mfhi(&p, dst); |
23 | } |
24 | ctx->idx += 2; /* 2 insts */ |
25 | } |
26 | @@ -1006,7 +1006,7 @@ load_ind: |
27 | break; |
28 | case BPF_ALU | BPF_MOD | BPF_K: |
29 | /* A %= k */ |
30 | - if (k == 1 || optimize_div(&k)) { |
31 | + if (k == 1) { |
32 | ctx->flags |= SEEN_A; |
33 | emit_jit_reg_move(r_A, r_zero, ctx); |
34 | } else { |
35 | diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile |
36 | index 14fe7cba21d1..b5bb49866bcc 100644 |
37 | --- a/arch/x86/boot/compressed/Makefile |
38 | +++ b/arch/x86/boot/compressed/Makefile |
39 | @@ -75,7 +75,7 @@ suffix-$(CONFIG_KERNEL_XZ) := xz |
40 | suffix-$(CONFIG_KERNEL_LZO) := lzo |
41 | suffix-$(CONFIG_KERNEL_LZ4) := lz4 |
42 | |
43 | -RUN_SIZE = $(shell objdump -h vmlinux | \ |
44 | +RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \ |
45 | perl $(srctree)/arch/x86/tools/calc_run_size.pl) |
46 | quiet_cmd_mkpiggy = MKPIGGY $@ |
47 | cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false ) |
48 | diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c |
49 | index cf79c4cdf955..c874859b4565 100644 |
50 | --- a/drivers/acpi/ec.c |
51 | +++ b/drivers/acpi/ec.c |
52 | @@ -299,11 +299,11 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, |
53 | /* following two actions should be kept atomic */ |
54 | ec->curr = t; |
55 | start_transaction(ec); |
56 | - if (ec->curr->command == ACPI_EC_COMMAND_QUERY) |
57 | - clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); |
58 | spin_unlock_irqrestore(&ec->lock, tmp); |
59 | ret = ec_poll(ec); |
60 | spin_lock_irqsave(&ec->lock, tmp); |
61 | + if (ec->curr->command == ACPI_EC_COMMAND_QUERY) |
62 | + clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); |
63 | ec->curr = NULL; |
64 | spin_unlock_irqrestore(&ec->lock, tmp); |
65 | return ret; |
66 | diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c |
67 | index 597b15e7f6e5..363a2576553a 100644 |
68 | --- a/drivers/ata/ahci.c |
69 | +++ b/drivers/ata/ahci.c |
70 | @@ -321,6 +321,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { |
71 | { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ |
72 | { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ |
73 | { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */ |
74 | + { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */ |
75 | + { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */ |
76 | + { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */ |
77 | { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */ |
78 | { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */ |
79 | { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */ |
80 | @@ -492,6 +495,7 @@ static const struct pci_device_id ahci_pci_tbl[] = { |
81 | * enabled. https://bugzilla.kernel.org/show_bug.cgi?id=60731 |
82 | */ |
83 | { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi }, |
84 | + { PCI_VDEVICE(SAMSUNG, 0xa800), board_ahci_nomsi }, |
85 | |
86 | /* Enmotus */ |
87 | { PCI_DEVICE(0x1c44, 0x8000), board_ahci }, |
88 | diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c |
89 | index 07bc7e4dbd04..65071591b143 100644 |
90 | --- a/drivers/ata/sata_fsl.c |
91 | +++ b/drivers/ata/sata_fsl.c |
92 | @@ -1488,7 +1488,7 @@ static int sata_fsl_probe(struct platform_device *ofdev) |
93 | host_priv->csr_base = csr_base; |
94 | |
95 | irq = irq_of_parse_and_map(ofdev->dev.of_node, 0); |
96 | - if (irq < 0) { |
97 | + if (!irq) { |
98 | dev_err(&ofdev->dev, "invalid irq from platform\n"); |
99 | goto error_exit_with_cleanup; |
100 | } |
101 | diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c |
102 | index 7bd17b3ee95c..8663c21093d1 100644 |
103 | --- a/drivers/gpu/drm/i915/intel_display.c |
104 | +++ b/drivers/gpu/drm/i915/intel_display.c |
105 | @@ -4209,7 +4209,6 @@ static void ironlake_crtc_disable(struct drm_crtc *crtc) |
106 | ironlake_fdi_disable(crtc); |
107 | |
108 | ironlake_disable_pch_transcoder(dev_priv, pipe); |
109 | - intel_set_pch_fifo_underrun_reporting(dev, pipe, true); |
110 | |
111 | if (HAS_PCH_CPT(dev)) { |
112 | /* disable TRANS_DP_CTL */ |
113 | @@ -4274,7 +4273,6 @@ static void haswell_crtc_disable(struct drm_crtc *crtc) |
114 | |
115 | if (intel_crtc->config.has_pch_encoder) { |
116 | lpt_disable_pch_transcoder(dev_priv); |
117 | - intel_set_pch_fifo_underrun_reporting(dev, TRANSCODER_A, true); |
118 | intel_ddi_fdi_disable(crtc); |
119 | } |
120 | |
121 | diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c |
122 | index fdf40267249c..4cc77e74e1f6 100644 |
123 | --- a/drivers/gpu/drm/i915/intel_lvds.c |
124 | +++ b/drivers/gpu/drm/i915/intel_lvds.c |
125 | @@ -900,6 +900,17 @@ void intel_lvds_init(struct drm_device *dev) |
126 | int pipe; |
127 | u8 pin; |
128 | |
129 | + /* |
130 | + * Unlock registers and just leave them unlocked. Do this before |
131 | + * checking quirk lists to avoid bogus WARNINGs. |
132 | + */ |
133 | + if (HAS_PCH_SPLIT(dev)) { |
134 | + I915_WRITE(PCH_PP_CONTROL, |
135 | + I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS); |
136 | + } else { |
137 | + I915_WRITE(PP_CONTROL, |
138 | + I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS); |
139 | + } |
140 | if (!intel_lvds_supported(dev)) |
141 | return; |
142 | |
143 | @@ -1098,17 +1109,6 @@ out: |
144 | lvds_encoder->a3_power = I915_READ(lvds_encoder->reg) & |
145 | LVDS_A3_POWER_MASK; |
146 | |
147 | - /* |
148 | - * Unlock registers and just |
149 | - * leave them unlocked |
150 | - */ |
151 | - if (HAS_PCH_SPLIT(dev)) { |
152 | - I915_WRITE(PCH_PP_CONTROL, |
153 | - I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS); |
154 | - } else { |
155 | - I915_WRITE(PP_CONTROL, |
156 | - I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS); |
157 | - } |
158 | lvds_connector->lid_notifier.notifier_call = intel_lid_notify; |
159 | if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) { |
160 | DRM_DEBUG_KMS("lid notifier registration failed\n"); |
161 | diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c |
162 | index da153a2cb6b5..f01d019edbfd 100644 |
163 | --- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c |
164 | +++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c |
165 | @@ -212,7 +212,6 @@ nvc0_identify(struct nouveau_device *device) |
166 | device->oclass[NVDEV_ENGINE_BSP ] = &nvc0_bsp_oclass; |
167 | device->oclass[NVDEV_ENGINE_PPP ] = &nvc0_ppp_oclass; |
168 | device->oclass[NVDEV_ENGINE_COPY0 ] = &nvc0_copy0_oclass; |
169 | - device->oclass[NVDEV_ENGINE_COPY1 ] = &nvc0_copy1_oclass; |
170 | device->oclass[NVDEV_ENGINE_DISP ] = nva3_disp_oclass; |
171 | device->oclass[NVDEV_ENGINE_PERFMON] = &nvc0_perfmon_oclass; |
172 | break; |
173 | diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c |
174 | index 3ed32dd90303..ace7524e631c 100644 |
175 | --- a/drivers/gpu/drm/nouveau/nouveau_drm.c |
176 | +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c |
177 | @@ -626,7 +626,6 @@ int nouveau_pmops_suspend(struct device *dev) |
178 | |
179 | pci_save_state(pdev); |
180 | pci_disable_device(pdev); |
181 | - pci_ignore_hotplug(pdev); |
182 | pci_set_power_state(pdev, PCI_D3hot); |
183 | return 0; |
184 | } |
185 | @@ -930,6 +929,7 @@ static int nouveau_pmops_runtime_suspend(struct device *dev) |
186 | ret = nouveau_do_suspend(drm_dev, true); |
187 | pci_save_state(pdev); |
188 | pci_disable_device(pdev); |
189 | + pci_ignore_hotplug(pdev); |
190 | pci_set_power_state(pdev, PCI_D3cold); |
191 | drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF; |
192 | return ret; |
193 | diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c |
194 | index e244c2d72730..67f91571ae79 100644 |
195 | --- a/drivers/gpu/drm/radeon/radeon_cs.c |
196 | +++ b/drivers/gpu/drm/radeon/radeon_cs.c |
197 | @@ -226,14 +226,11 @@ static int radeon_cs_get_ring(struct radeon_cs_parser *p, u32 ring, s32 priority |
198 | |
199 | static void radeon_cs_sync_rings(struct radeon_cs_parser *p) |
200 | { |
201 | - int i; |
202 | - |
203 | - for (i = 0; i < p->nrelocs; i++) { |
204 | - if (!p->relocs[i].robj) |
205 | - continue; |
206 | + struct radeon_cs_reloc *reloc; |
207 | |
208 | + list_for_each_entry(reloc, &p->validated, tv.head) { |
209 | radeon_semaphore_sync_to(p->ib.semaphore, |
210 | - p->relocs[i].robj->tbo.sync_obj); |
211 | + reloc->robj->tbo.sync_obj); |
212 | } |
213 | } |
214 | |
215 | diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c |
216 | index eb7164d07985..82941bd8ca46 100644 |
217 | --- a/drivers/gpu/drm/radeon/radeon_kms.c |
218 | +++ b/drivers/gpu/drm/radeon/radeon_kms.c |
219 | @@ -795,6 +795,8 @@ int radeon_get_vblank_timestamp_kms(struct drm_device *dev, int crtc, |
220 | |
221 | /* Get associated drm_crtc: */ |
222 | drmcrtc = &rdev->mode_info.crtcs[crtc]->base; |
223 | + if (!drmcrtc) |
224 | + return -EINVAL; |
225 | |
226 | /* Helper routine in DRM core does all the work: */ |
227 | return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error, |
228 | diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c |
229 | index 480c87d8edc5..835f402a9faf 100644 |
230 | --- a/drivers/gpu/drm/radeon/radeon_object.c |
231 | +++ b/drivers/gpu/drm/radeon/radeon_object.c |
232 | @@ -187,6 +187,13 @@ int radeon_bo_create(struct radeon_device *rdev, |
233 | if (!(rdev->flags & RADEON_IS_PCIE)) |
234 | bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC); |
235 | |
236 | +#ifdef CONFIG_X86_32 |
237 | + /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit |
238 | + * See https://bugs.freedesktop.org/show_bug.cgi?id=84627 |
239 | + */ |
240 | + bo->flags &= ~RADEON_GEM_GTT_WC; |
241 | +#endif |
242 | + |
243 | radeon_ttm_placement_from_domain(bo, domain); |
244 | /* Kernel allocation are uninterruptible */ |
245 | down_read(&rdev->pm.mclk_lock); |
246 | diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c |
247 | index 63f3f03ecc9b..c604f4c3ac0d 100644 |
248 | --- a/drivers/i2c/busses/i2c-cadence.c |
249 | +++ b/drivers/i2c/busses/i2c-cadence.c |
250 | @@ -111,6 +111,8 @@ |
251 | #define CDNS_I2C_DIVA_MAX 4 |
252 | #define CDNS_I2C_DIVB_MAX 64 |
253 | |
254 | +#define CDNS_I2C_TIMEOUT_MAX 0xFF |
255 | + |
256 | #define cdns_i2c_readreg(offset) readl_relaxed(id->membase + offset) |
257 | #define cdns_i2c_writereg(val, offset) writel_relaxed(val, id->membase + offset) |
258 | |
259 | @@ -852,6 +854,15 @@ static int cdns_i2c_probe(struct platform_device *pdev) |
260 | goto err_clk_dis; |
261 | } |
262 | |
263 | + /* |
264 | + * Cadence I2C controller has a bug wherein it generates |
265 | + * invalid read transaction after HW timeout in master receiver mode. |
266 | + * HW timeout is not used by this driver and the interrupt is disabled. |
267 | + * But the feature itself cannot be disabled. Hence maximum value |
268 | + * is written to this register to reduce the chances of error. |
269 | + */ |
270 | + cdns_i2c_writereg(CDNS_I2C_TIMEOUT_MAX, CDNS_I2C_TIME_OUT_OFFSET); |
271 | + |
272 | dev_info(&pdev->dev, "%u kHz mmio %08lx irq %d\n", |
273 | id->i2c_clk / 1000, (unsigned long)r_mem->start, id->irq); |
274 | |
275 | diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c |
276 | index 4d9614719128..82be5e2da7cf 100644 |
277 | --- a/drivers/i2c/busses/i2c-davinci.c |
278 | +++ b/drivers/i2c/busses/i2c-davinci.c |
279 | @@ -411,11 +411,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop) |
280 | if (dev->cmd_err & DAVINCI_I2C_STR_NACK) { |
281 | if (msg->flags & I2C_M_IGNORE_NAK) |
282 | return msg->len; |
283 | - if (stop) { |
284 | - w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG); |
285 | - w |= DAVINCI_I2C_MDR_STP; |
286 | - davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w); |
287 | - } |
288 | + w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG); |
289 | + w |= DAVINCI_I2C_MDR_STP; |
290 | + davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w); |
291 | return -EREMOTEIO; |
292 | } |
293 | return -EIO; |
294 | diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c |
295 | index 0dffb0e62c3b..493574ee87f5 100644 |
296 | --- a/drivers/i2c/busses/i2c-omap.c |
297 | +++ b/drivers/i2c/busses/i2c-omap.c |
298 | @@ -926,14 +926,12 @@ omap_i2c_isr_thread(int this_irq, void *dev_id) |
299 | if (stat & OMAP_I2C_STAT_NACK) { |
300 | err |= OMAP_I2C_STAT_NACK; |
301 | omap_i2c_ack_stat(dev, OMAP_I2C_STAT_NACK); |
302 | - break; |
303 | } |
304 | |
305 | if (stat & OMAP_I2C_STAT_AL) { |
306 | dev_err(dev->dev, "Arbitration lost\n"); |
307 | err |= OMAP_I2C_STAT_AL; |
308 | omap_i2c_ack_stat(dev, OMAP_I2C_STAT_AL); |
309 | - break; |
310 | } |
311 | |
312 | /* |
313 | @@ -958,11 +956,13 @@ omap_i2c_isr_thread(int this_irq, void *dev_id) |
314 | if (dev->fifo_size) |
315 | num_bytes = dev->buf_len; |
316 | |
317 | - omap_i2c_receive_data(dev, num_bytes, true); |
318 | - |
319 | - if (dev->errata & I2C_OMAP_ERRATA_I207) |
320 | + if (dev->errata & I2C_OMAP_ERRATA_I207) { |
321 | i2c_omap_errata_i207(dev, stat); |
322 | + num_bytes = (omap_i2c_read_reg(dev, |
323 | + OMAP_I2C_BUFSTAT_REG) >> 8) & 0x3F; |
324 | + } |
325 | |
326 | + omap_i2c_receive_data(dev, num_bytes, true); |
327 | omap_i2c_ack_stat(dev, OMAP_I2C_STAT_RDR); |
328 | continue; |
329 | } |
330 | diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c |
331 | index de055451d1af..b535322a36db 100644 |
332 | --- a/drivers/input/evdev.c |
333 | +++ b/drivers/input/evdev.c |
334 | @@ -421,7 +421,7 @@ static int evdev_open(struct inode *inode, struct file *file) |
335 | |
336 | err_free_client: |
337 | evdev_detach_client(evdev, client); |
338 | - kfree(client); |
339 | + kvfree(client); |
340 | return error; |
341 | } |
342 | |
343 | diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c |
344 | index 62acb10630f9..818b48d3ac28 100644 |
345 | --- a/drivers/media/i2c/smiapp/smiapp-core.c |
346 | +++ b/drivers/media/i2c/smiapp/smiapp-core.c |
347 | @@ -2133,7 +2133,7 @@ static int smiapp_set_selection(struct v4l2_subdev *subdev, |
348 | ret = smiapp_set_compose(subdev, fh, sel); |
349 | break; |
350 | default: |
351 | - BUG(); |
352 | + ret = -EINVAL; |
353 | } |
354 | |
355 | mutex_unlock(&sensor->mutex); |
356 | diff --git a/drivers/media/rc/ir-rc6-decoder.c b/drivers/media/rc/ir-rc6-decoder.c |
357 | index f1f098e22f7e..d16bc67af732 100644 |
358 | --- a/drivers/media/rc/ir-rc6-decoder.c |
359 | +++ b/drivers/media/rc/ir-rc6-decoder.c |
360 | @@ -259,8 +259,8 @@ again: |
361 | case 32: |
362 | if ((scancode & RC6_6A_LCC_MASK) == RC6_6A_MCE_CC) { |
363 | protocol = RC_TYPE_RC6_MCE; |
364 | - scancode &= ~RC6_6A_MCE_TOGGLE_MASK; |
365 | toggle = !!(scancode & RC6_6A_MCE_TOGGLE_MASK); |
366 | + scancode &= ~RC6_6A_MCE_TOGGLE_MASK; |
367 | } else { |
368 | protocol = RC_BIT_RC6_6A_32; |
369 | toggle = 0; |
370 | diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c |
371 | index 2c901861034a..efcaa90529ba 100644 |
372 | --- a/drivers/media/usb/s2255/s2255drv.c |
373 | +++ b/drivers/media/usb/s2255/s2255drv.c |
374 | @@ -632,7 +632,7 @@ static void s2255_fillbuff(struct s2255_vc *vc, |
375 | break; |
376 | case V4L2_PIX_FMT_JPEG: |
377 | case V4L2_PIX_FMT_MJPEG: |
378 | - buf->vb.v4l2_buf.length = jpgsize; |
379 | + vb2_set_plane_payload(&buf->vb, 0, jpgsize); |
380 | memcpy(vbuf, tmpbuf, jpgsize); |
381 | break; |
382 | case V4L2_PIX_FMT_YUV422P: |
383 | diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c |
384 | index d163e112f04c..fc061c3a6485 100644 |
385 | --- a/drivers/net/bonding/bond_netlink.c |
386 | +++ b/drivers/net/bonding/bond_netlink.c |
387 | @@ -194,7 +194,12 @@ static int bond_changelink(struct net_device *bond_dev, |
388 | |
389 | bond_option_arp_ip_targets_clear(bond); |
390 | nla_for_each_nested(attr, data[IFLA_BOND_ARP_IP_TARGET], rem) { |
391 | - __be32 target = nla_get_be32(attr); |
392 | + __be32 target; |
393 | + |
394 | + if (nla_len(attr) < sizeof(target)) |
395 | + return -EINVAL; |
396 | + |
397 | + target = nla_get_be32(attr); |
398 | |
399 | bond_opt_initval(&newval, (__force u64)target); |
400 | err = __bond_opt_set(bond, BOND_OPT_ARP_TARGETS, |
401 | diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c |
402 | index ba499489969a..cbfa4ff9f3bd 100644 |
403 | --- a/drivers/net/ethernet/broadcom/tg3.c |
404 | +++ b/drivers/net/ethernet/broadcom/tg3.c |
405 | @@ -8561,7 +8561,8 @@ static int tg3_init_rings(struct tg3 *tp) |
406 | if (tnapi->rx_rcb) |
407 | memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp)); |
408 | |
409 | - if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) { |
410 | + if (tnapi->prodring.rx_std && |
411 | + tg3_rx_prodring_alloc(tp, &tnapi->prodring)) { |
412 | tg3_free_rings(tp); |
413 | return -ENOMEM; |
414 | } |
415 | diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c |
416 | index ade067de1689..67a84cfaefa1 100644 |
417 | --- a/drivers/net/ethernet/marvell/mvneta.c |
418 | +++ b/drivers/net/ethernet/marvell/mvneta.c |
419 | @@ -216,7 +216,7 @@ |
420 | /* Various constants */ |
421 | |
422 | /* Coalescing */ |
423 | -#define MVNETA_TXDONE_COAL_PKTS 16 |
424 | +#define MVNETA_TXDONE_COAL_PKTS 1 |
425 | #define MVNETA_RX_COAL_PKTS 32 |
426 | #define MVNETA_RX_COAL_USEC 100 |
427 | |
428 | @@ -1721,6 +1721,7 @@ static int mvneta_tx(struct sk_buff *skb, struct net_device *dev) |
429 | u16 txq_id = skb_get_queue_mapping(skb); |
430 | struct mvneta_tx_queue *txq = &pp->txqs[txq_id]; |
431 | struct mvneta_tx_desc *tx_desc; |
432 | + int len = skb->len; |
433 | int frags = 0; |
434 | u32 tx_cmd; |
435 | |
436 | @@ -1788,7 +1789,7 @@ out: |
437 | |
438 | u64_stats_update_begin(&stats->syncp); |
439 | stats->tx_packets++; |
440 | - stats->tx_bytes += skb->len; |
441 | + stats->tx_bytes += len; |
442 | u64_stats_update_end(&stats->syncp); |
443 | } else { |
444 | dev->stats.tx_dropped++; |
445 | diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c |
446 | index 5d2498dcf536..cd5cf6d957c7 100644 |
447 | --- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c |
448 | +++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c |
449 | @@ -1546,7 +1546,7 @@ static int qp_alloc_res(struct mlx4_dev *dev, int slave, int op, int cmd, |
450 | |
451 | switch (op) { |
452 | case RES_OP_RESERVE: |
453 | - count = get_param_l(&in_param); |
454 | + count = get_param_l(&in_param) & 0xffffff; |
455 | align = get_param_h(&in_param); |
456 | err = mlx4_grant_resource(dev, slave, RES_QP, count, 0); |
457 | if (err) |
458 | diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c |
459 | index 81a8a296a582..2aa3a8db5334 100644 |
460 | --- a/drivers/net/vxlan.c |
461 | +++ b/drivers/net/vxlan.c |
462 | @@ -2050,9 +2050,8 @@ static int vxlan_init(struct net_device *dev) |
463 | spin_lock(&vn->sock_lock); |
464 | vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET, |
465 | vxlan->dst_port); |
466 | - if (vs) { |
467 | + if (vs && atomic_add_unless(&vs->refcnt, 1, 0)) { |
468 | /* If we have a socket with same port already, reuse it */ |
469 | - atomic_inc(&vs->refcnt); |
470 | vxlan_vs_add_dev(vs, vxlan); |
471 | } else { |
472 | /* otherwise make new socket outside of RTNL */ |
473 | @@ -2362,9 +2361,9 @@ static struct socket *vxlan_create_sock(struct net *net, bool ipv6, |
474 | if (ipv6) { |
475 | udp_conf.family = AF_INET6; |
476 | udp_conf.use_udp6_tx_checksums = |
477 | - !!(flags & VXLAN_F_UDP_ZERO_CSUM6_TX); |
478 | + !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX); |
479 | udp_conf.use_udp6_rx_checksums = |
480 | - !!(flags & VXLAN_F_UDP_ZERO_CSUM6_RX); |
481 | + !(flags & VXLAN_F_UDP_ZERO_CSUM6_RX); |
482 | } else { |
483 | udp_conf.family = AF_INET; |
484 | udp_conf.local_ip.s_addr = INADDR_ANY; |
485 | @@ -2459,12 +2458,9 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port, |
486 | |
487 | spin_lock(&vn->sock_lock); |
488 | vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port); |
489 | - if (vs) { |
490 | - if (vs->rcv == rcv) |
491 | - atomic_inc(&vs->refcnt); |
492 | - else |
493 | + if (vs && ((vs->rcv != rcv) || |
494 | + !atomic_add_unless(&vs->refcnt, 1, 0))) |
495 | vs = ERR_PTR(-EBUSY); |
496 | - } |
497 | spin_unlock(&vn->sock_lock); |
498 | |
499 | if (!vs) |
500 | diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c |
501 | index ca82f545ec2c..646e2dec699c 100644 |
502 | --- a/drivers/net/xen-netfront.c |
503 | +++ b/drivers/net/xen-netfront.c |
504 | @@ -496,9 +496,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue, |
505 | len = skb_frag_size(frag); |
506 | offset = frag->page_offset; |
507 | |
508 | - /* Data must not cross a page boundary. */ |
509 | - BUG_ON(len + offset > PAGE_SIZE<<compound_order(page)); |
510 | - |
511 | /* Skip unused frames from start of page */ |
512 | page += offset >> PAGE_SHIFT; |
513 | offset &= ~PAGE_MASK; |
514 | @@ -506,8 +503,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue, |
515 | while (len > 0) { |
516 | unsigned long bytes; |
517 | |
518 | - BUG_ON(offset >= PAGE_SIZE); |
519 | - |
520 | bytes = PAGE_SIZE - offset; |
521 | if (bytes > len) |
522 | bytes = len; |
523 | @@ -632,6 +627,9 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) |
524 | slots, skb->len); |
525 | if (skb_linearize(skb)) |
526 | goto drop; |
527 | + data = skb->data; |
528 | + offset = offset_in_page(data); |
529 | + len = skb_headlen(skb); |
530 | } |
531 | |
532 | spin_lock_irqsave(&queue->tx_lock, flags); |
533 | diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c |
534 | index 30e97bcc4f88..d134710de96d 100644 |
535 | --- a/drivers/of/fdt.c |
536 | +++ b/drivers/of/fdt.c |
537 | @@ -964,8 +964,6 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size) |
538 | int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base, |
539 | phys_addr_t size, bool nomap) |
540 | { |
541 | - if (memblock_is_region_reserved(base, size)) |
542 | - return -EBUSY; |
543 | if (nomap) |
544 | return memblock_remove(base, size); |
545 | return memblock_reserve(base, size); |
546 | diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c |
547 | index 6df8d3d885e5..b8b92c2f9683 100644 |
548 | --- a/fs/fat/namei_vfat.c |
549 | +++ b/fs/fat/namei_vfat.c |
550 | @@ -736,7 +736,12 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry, |
551 | } |
552 | |
553 | alias = d_find_alias(inode); |
554 | - if (alias && !vfat_d_anon_disconn(alias)) { |
555 | + /* |
556 | + * Checking "alias->d_parent == dentry->d_parent" to make sure |
557 | + * FS is not corrupted (especially double linked dir). |
558 | + */ |
559 | + if (alias && alias->d_parent == dentry->d_parent && |
560 | + !vfat_d_anon_disconn(alias)) { |
561 | /* |
562 | * This inode has non anonymous-DCACHE_DISCONNECTED |
563 | * dentry. This means, the user did ->lookup() by an |
564 | @@ -755,12 +760,9 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry, |
565 | |
566 | out: |
567 | mutex_unlock(&MSDOS_SB(sb)->s_lock); |
568 | - dentry->d_time = dentry->d_parent->d_inode->i_version; |
569 | - dentry = d_splice_alias(inode, dentry); |
570 | - if (dentry) |
571 | - dentry->d_time = dentry->d_parent->d_inode->i_version; |
572 | - return dentry; |
573 | - |
574 | + if (!inode) |
575 | + dentry->d_time = dir->i_version; |
576 | + return d_splice_alias(inode, dentry); |
577 | error: |
578 | mutex_unlock(&MSDOS_SB(sb)->s_lock); |
579 | return ERR_PTR(err); |
580 | @@ -793,7 +795,6 @@ static int vfat_create(struct inode *dir, struct dentry *dentry, umode_t mode, |
581 | inode->i_mtime = inode->i_atime = inode->i_ctime = ts; |
582 | /* timestamp is already written, so mark_inode_dirty() is unneeded. */ |
583 | |
584 | - dentry->d_time = dentry->d_parent->d_inode->i_version; |
585 | d_instantiate(dentry, inode); |
586 | out: |
587 | mutex_unlock(&MSDOS_SB(sb)->s_lock); |
588 | @@ -824,6 +825,7 @@ static int vfat_rmdir(struct inode *dir, struct dentry *dentry) |
589 | clear_nlink(inode); |
590 | inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC; |
591 | fat_detach(inode); |
592 | + dentry->d_time = dir->i_version; |
593 | out: |
594 | mutex_unlock(&MSDOS_SB(sb)->s_lock); |
595 | |
596 | @@ -849,6 +851,7 @@ static int vfat_unlink(struct inode *dir, struct dentry *dentry) |
597 | clear_nlink(inode); |
598 | inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC; |
599 | fat_detach(inode); |
600 | + dentry->d_time = dir->i_version; |
601 | out: |
602 | mutex_unlock(&MSDOS_SB(sb)->s_lock); |
603 | |
604 | @@ -889,7 +892,6 @@ static int vfat_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) |
605 | inode->i_mtime = inode->i_atime = inode->i_ctime = ts; |
606 | /* timestamp is already written, so mark_inode_dirty() is unneeded. */ |
607 | |
608 | - dentry->d_time = dentry->d_parent->d_inode->i_version; |
609 | d_instantiate(dentry, inode); |
610 | |
611 | mutex_unlock(&MSDOS_SB(sb)->s_lock); |
612 | diff --git a/include/net/inet_common.h b/include/net/inet_common.h |
613 | index fe7994c48b75..b2828a06a5a6 100644 |
614 | --- a/include/net/inet_common.h |
615 | +++ b/include/net/inet_common.h |
616 | @@ -37,6 +37,8 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg); |
617 | int inet_ctl_sock_create(struct sock **sk, unsigned short family, |
618 | unsigned short type, unsigned char protocol, |
619 | struct net *net); |
620 | +int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, |
621 | + int *addr_len); |
622 | |
623 | static inline void inet_ctl_sock_destroy(struct sock *sk) |
624 | { |
625 | diff --git a/mm/frontswap.c b/mm/frontswap.c |
626 | index c30eec536f03..f2a3571c6e22 100644 |
627 | --- a/mm/frontswap.c |
628 | +++ b/mm/frontswap.c |
629 | @@ -244,8 +244,10 @@ int __frontswap_store(struct page *page) |
630 | the (older) page from frontswap |
631 | */ |
632 | inc_frontswap_failed_stores(); |
633 | - if (dup) |
634 | + if (dup) { |
635 | __frontswap_clear(sis, offset); |
636 | + frontswap_ops->invalidate_page(type, offset); |
637 | + } |
638 | } |
639 | if (frontswap_writethrough_enabled) |
640 | /* report failure so swap also writes to swap device */ |
641 | diff --git a/mm/memory.c b/mm/memory.c |
642 | index 37b80fc3a9b6..e497defd663e 100644 |
643 | --- a/mm/memory.c |
644 | +++ b/mm/memory.c |
645 | @@ -815,20 +815,20 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm, |
646 | if (!pte_file(pte)) { |
647 | swp_entry_t entry = pte_to_swp_entry(pte); |
648 | |
649 | - if (swap_duplicate(entry) < 0) |
650 | - return entry.val; |
651 | - |
652 | - /* make sure dst_mm is on swapoff's mmlist. */ |
653 | - if (unlikely(list_empty(&dst_mm->mmlist))) { |
654 | - spin_lock(&mmlist_lock); |
655 | - if (list_empty(&dst_mm->mmlist)) |
656 | - list_add(&dst_mm->mmlist, |
657 | - &src_mm->mmlist); |
658 | - spin_unlock(&mmlist_lock); |
659 | - } |
660 | - if (likely(!non_swap_entry(entry))) |
661 | + if (likely(!non_swap_entry(entry))) { |
662 | + if (swap_duplicate(entry) < 0) |
663 | + return entry.val; |
664 | + |
665 | + /* make sure dst_mm is on swapoff's mmlist. */ |
666 | + if (unlikely(list_empty(&dst_mm->mmlist))) { |
667 | + spin_lock(&mmlist_lock); |
668 | + if (list_empty(&dst_mm->mmlist)) |
669 | + list_add(&dst_mm->mmlist, |
670 | + &src_mm->mmlist); |
671 | + spin_unlock(&mmlist_lock); |
672 | + } |
673 | rss[MM_SWAPENTS]++; |
674 | - else if (is_migration_entry(entry)) { |
675 | + } else if (is_migration_entry(entry)) { |
676 | page = migration_entry_to_page(entry); |
677 | |
678 | if (PageAnon(page)) |
679 | diff --git a/mm/mmap.c b/mm/mmap.c |
680 | index ebc25fab1545..a226d31a2395 100644 |
681 | --- a/mm/mmap.c |
682 | +++ b/mm/mmap.c |
683 | @@ -752,8 +752,11 @@ again: remove_next = 1 + (end > next->vm_end); |
684 | * shrinking vma had, to cover any anon pages imported. |
685 | */ |
686 | if (exporter && exporter->anon_vma && !importer->anon_vma) { |
687 | - if (anon_vma_clone(importer, exporter)) |
688 | - return -ENOMEM; |
689 | + int error; |
690 | + |
691 | + error = anon_vma_clone(importer, exporter); |
692 | + if (error) |
693 | + return error; |
694 | importer->anon_vma = exporter->anon_vma; |
695 | } |
696 | } |
697 | @@ -2453,7 +2456,8 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, |
698 | if (err) |
699 | goto out_free_vma; |
700 | |
701 | - if (anon_vma_clone(new, vma)) |
702 | + err = anon_vma_clone(new, vma); |
703 | + if (err) |
704 | goto out_free_mpol; |
705 | |
706 | if (new->vm_file) |
707 | diff --git a/mm/rmap.c b/mm/rmap.c |
708 | index e01318d4b07e..1807ca3f8731 100644 |
709 | --- a/mm/rmap.c |
710 | +++ b/mm/rmap.c |
711 | @@ -274,6 +274,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) |
712 | { |
713 | struct anon_vma_chain *avc; |
714 | struct anon_vma *anon_vma; |
715 | + int error; |
716 | |
717 | /* Don't bother if the parent process has no anon_vma here. */ |
718 | if (!pvma->anon_vma) |
719 | @@ -283,8 +284,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) |
720 | * First, attach the new VMA to the parent VMA's anon_vmas, |
721 | * so rmap can find non-COWed pages in child processes. |
722 | */ |
723 | - if (anon_vma_clone(vma, pvma)) |
724 | - return -ENOMEM; |
725 | + error = anon_vma_clone(vma, pvma); |
726 | + if (error) |
727 | + return error; |
728 | |
729 | /* Then add our own anon_vma. */ |
730 | anon_vma = anon_vma_alloc(); |
731 | diff --git a/mm/slab.c b/mm/slab.c |
732 | index 7c52b3890d25..cc91c1ef4e8a 100644 |
733 | --- a/mm/slab.c |
734 | +++ b/mm/slab.c |
735 | @@ -3108,7 +3108,7 @@ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, |
736 | void *obj; |
737 | int x; |
738 | |
739 | - VM_BUG_ON(nodeid > num_online_nodes()); |
740 | + VM_BUG_ON(nodeid < 0 || nodeid >= MAX_NUMNODES); |
741 | n = get_node(cachep, nodeid); |
742 | BUG_ON(!n); |
743 | |
744 | diff --git a/mm/vmpressure.c b/mm/vmpressure.c |
745 | index d4042e75f7c7..c5afd573d7da 100644 |
746 | --- a/mm/vmpressure.c |
747 | +++ b/mm/vmpressure.c |
748 | @@ -165,6 +165,7 @@ static void vmpressure_work_fn(struct work_struct *work) |
749 | unsigned long scanned; |
750 | unsigned long reclaimed; |
751 | |
752 | + spin_lock(&vmpr->sr_lock); |
753 | /* |
754 | * Several contexts might be calling vmpressure(), so it is |
755 | * possible that the work was rescheduled again before the old |
756 | @@ -173,11 +174,12 @@ static void vmpressure_work_fn(struct work_struct *work) |
757 | * here. No need for any locks here since we don't care if |
758 | * vmpr->reclaimed is in sync. |
759 | */ |
760 | - if (!vmpr->scanned) |
761 | + scanned = vmpr->scanned; |
762 | + if (!scanned) { |
763 | + spin_unlock(&vmpr->sr_lock); |
764 | return; |
765 | + } |
766 | |
767 | - spin_lock(&vmpr->sr_lock); |
768 | - scanned = vmpr->scanned; |
769 | reclaimed = vmpr->reclaimed; |
770 | vmpr->scanned = 0; |
771 | vmpr->reclaimed = 0; |
772 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
773 | index f0493e3b7471..4921b6536ea5 100644 |
774 | --- a/net/core/rtnetlink.c |
775 | +++ b/net/core/rtnetlink.c |
776 | @@ -1495,6 +1495,7 @@ static int do_setlink(const struct sk_buff *skb, |
777 | goto errout; |
778 | } |
779 | if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) { |
780 | + put_net(net); |
781 | err = -EPERM; |
782 | goto errout; |
783 | } |
784 | diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c |
785 | index d156b3c5f363..bf78bc365481 100644 |
786 | --- a/net/ipv4/af_inet.c |
787 | +++ b/net/ipv4/af_inet.c |
788 | @@ -1421,6 +1421,17 @@ out: |
789 | return pp; |
790 | } |
791 | |
792 | +int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) |
793 | +{ |
794 | + if (sk->sk_family == AF_INET) |
795 | + return ip_recv_error(sk, msg, len, addr_len); |
796 | +#if IS_ENABLED(CONFIG_IPV6) |
797 | + if (sk->sk_family == AF_INET6) |
798 | + return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len); |
799 | +#endif |
800 | + return -EINVAL; |
801 | +} |
802 | + |
803 | static int inet_gro_complete(struct sk_buff *skb, int nhoff) |
804 | { |
805 | __be16 newlen = htons(skb->len - nhoff); |
806 | diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c |
807 | index dd73bea2a65f..657d80c0931a 100644 |
808 | --- a/net/ipv4/gre_offload.c |
809 | +++ b/net/ipv4/gre_offload.c |
810 | @@ -279,6 +279,9 @@ static int gre_gro_complete(struct sk_buff *skb, int nhoff) |
811 | err = ptype->callbacks.gro_complete(skb, nhoff + grehlen); |
812 | |
813 | rcu_read_unlock(); |
814 | + |
815 | + skb_set_inner_mac_header(skb, nhoff + grehlen); |
816 | + |
817 | return err; |
818 | } |
819 | |
820 | diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c |
821 | index e453cb724a95..607395236c95 100644 |
822 | --- a/net/ipv4/ip_vti.c |
823 | +++ b/net/ipv4/ip_vti.c |
824 | @@ -528,6 +528,7 @@ static struct rtnl_link_ops vti_link_ops __read_mostly = { |
825 | .validate = vti_tunnel_validate, |
826 | .newlink = vti_newlink, |
827 | .changelink = vti_changelink, |
828 | + .dellink = ip_tunnel_dellink, |
829 | .get_size = vti_get_size, |
830 | .fill_info = vti_fill_info, |
831 | }; |
832 | diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c |
833 | index 352476233608..b503a3021a71 100644 |
834 | --- a/net/ipv4/ping.c |
835 | +++ b/net/ipv4/ping.c |
836 | @@ -855,16 +855,8 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, |
837 | if (flags & MSG_OOB) |
838 | goto out; |
839 | |
840 | - if (flags & MSG_ERRQUEUE) { |
841 | - if (family == AF_INET) { |
842 | - return ip_recv_error(sk, msg, len, addr_len); |
843 | -#if IS_ENABLED(CONFIG_IPV6) |
844 | - } else if (family == AF_INET6) { |
845 | - return pingv6_ops.ipv6_recv_error(sk, msg, len, |
846 | - addr_len); |
847 | -#endif |
848 | - } |
849 | - } |
850 | + if (flags & MSG_ERRQUEUE) |
851 | + return inet_recv_error(sk, msg, len, addr_len); |
852 | |
853 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
854 | if (!skb) |
855 | diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c |
856 | index 6b0b38fdf4fc..9cbf8b1df165 100644 |
857 | --- a/net/ipv4/tcp.c |
858 | +++ b/net/ipv4/tcp.c |
859 | @@ -1633,7 +1633,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, |
860 | u32 urg_hole = 0; |
861 | |
862 | if (unlikely(flags & MSG_ERRQUEUE)) |
863 | - return ip_recv_error(sk, msg, len, addr_len); |
864 | + return inet_recv_error(sk, msg, len, addr_len); |
865 | |
866 | if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) && |
867 | (sk->sk_state == TCP_ESTABLISHED)) |
868 | diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c |
869 | index cacb493a133d..33d08abe43db 100644 |
870 | --- a/net/ipv6/ip6_gre.c |
871 | +++ b/net/ipv6/ip6_gre.c |
872 | @@ -502,11 +502,11 @@ static int ip6gre_rcv(struct sk_buff *skb) |
873 | |
874 | skb->protocol = gre_proto; |
875 | /* WCCP version 1 and 2 protocol decoding. |
876 | - * - Change protocol to IP |
877 | + * - Change protocol to IPv6 |
878 | * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header |
879 | */ |
880 | if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) { |
881 | - skb->protocol = htons(ETH_P_IP); |
882 | + skb->protocol = htons(ETH_P_IPV6); |
883 | if ((*(h + offset) & 0xF0) != 0x40) |
884 | offset += 4; |
885 | } |
886 | diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c |
887 | index 99c9487f236a..3abcd4afeaaf 100644 |
888 | --- a/net/ipv6/ip6_vti.c |
889 | +++ b/net/ipv6/ip6_vti.c |
890 | @@ -905,6 +905,15 @@ static int vti6_newlink(struct net *src_net, struct net_device *dev, |
891 | return vti6_tnl_create2(dev); |
892 | } |
893 | |
894 | +static void vti6_dellink(struct net_device *dev, struct list_head *head) |
895 | +{ |
896 | + struct net *net = dev_net(dev); |
897 | + struct vti6_net *ip6n = net_generic(net, vti6_net_id); |
898 | + |
899 | + if (dev != ip6n->fb_tnl_dev) |
900 | + unregister_netdevice_queue(dev, head); |
901 | +} |
902 | + |
903 | static int vti6_changelink(struct net_device *dev, struct nlattr *tb[], |
904 | struct nlattr *data[]) |
905 | { |
906 | @@ -980,6 +989,7 @@ static struct rtnl_link_ops vti6_link_ops __read_mostly = { |
907 | .setup = vti6_dev_setup, |
908 | .validate = vti6_validate, |
909 | .newlink = vti6_newlink, |
910 | + .dellink = vti6_dellink, |
911 | .changelink = vti6_changelink, |
912 | .get_size = vti6_get_size, |
913 | .fill_info = vti6_fill_info, |
914 | @@ -1020,6 +1030,7 @@ static int __net_init vti6_init_net(struct net *net) |
915 | if (!ip6n->fb_tnl_dev) |
916 | goto err_alloc_dev; |
917 | dev_net_set(ip6n->fb_tnl_dev, net); |
918 | + ip6n->fb_tnl_dev->rtnl_link_ops = &vti6_link_ops; |
919 | |
920 | err = vti6_fb_tnl_dev_init(ip6n->fb_tnl_dev); |
921 | if (err < 0) |
922 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c |
923 | index 0007b8180397..b6bf8e8caec7 100644 |
924 | --- a/net/netlink/af_netlink.c |
925 | +++ b/net/netlink/af_netlink.c |
926 | @@ -3130,7 +3130,7 @@ static int __init netlink_proto_init(void) |
927 | .head_offset = offsetof(struct netlink_sock, node), |
928 | .key_offset = offsetof(struct netlink_sock, portid), |
929 | .key_len = sizeof(u32), /* portid */ |
930 | - .hashfn = arch_fast_hash, |
931 | + .hashfn = jhash, |
932 | .max_shift = 16, /* 64K */ |
933 | .grow_decision = rht_grow_above_75, |
934 | .shrink_decision = rht_shrink_below_30, |
935 | diff --git a/net/sctp/output.c b/net/sctp/output.c |
936 | index 42dffd428389..fc5e45b8a832 100644 |
937 | --- a/net/sctp/output.c |
938 | +++ b/net/sctp/output.c |
939 | @@ -401,12 +401,12 @@ int sctp_packet_transmit(struct sctp_packet *packet) |
940 | sk = chunk->skb->sk; |
941 | |
942 | /* Allocate the new skb. */ |
943 | - nskb = alloc_skb(packet->size + LL_MAX_HEADER, GFP_ATOMIC); |
944 | + nskb = alloc_skb(packet->size + MAX_HEADER, GFP_ATOMIC); |
945 | if (!nskb) |
946 | goto nomem; |
947 | |
948 | /* Make sure the outbound skb has enough header room reserved. */ |
949 | - skb_reserve(nskb, packet->overhead + LL_MAX_HEADER); |
950 | + skb_reserve(nskb, packet->overhead + MAX_HEADER); |
951 | |
952 | /* Set the owning socket so that we know where to get the |
953 | * destination IP address. |
954 | diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c |
955 | index 06275f8807a8..4714ff92f15e 100644 |
956 | --- a/sound/pci/hda/patch_analog.c |
957 | +++ b/sound/pci/hda/patch_analog.c |
958 | @@ -332,6 +332,7 @@ static const struct hda_fixup ad1986a_fixups[] = { |
959 | |
960 | static const struct snd_pci_quirk ad1986a_fixup_tbl[] = { |
961 | SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC), |
962 | + SND_PCI_QUIRK(0x1043, 0x1443, "ASUS Z99He", AD1986A_FIXUP_EAPD), |
963 | SND_PCI_QUIRK(0x1043, 0x1447, "ASUS A8JN", AD1986A_FIXUP_EAPD), |
964 | SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8100, "ASUS P5", AD1986A_FIXUP_3STACK), |
965 | SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8200, "ASUS M2", AD1986A_FIXUP_3STACK), |
966 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
967 | index 623a9d0c8d52..71a2350a974d 100644 |
968 | --- a/sound/pci/hda/patch_realtek.c |
969 | +++ b/sound/pci/hda/patch_realtek.c |
970 | @@ -5087,6 +5087,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { |
971 | SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), |
972 | SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), |
973 | SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), |
974 | + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), |
975 | SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), |
976 | SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), |
977 | SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC), |
978 | diff --git a/sound/usb/midi.c b/sound/usb/midi.c |
979 | index 7b166c2be0f7..3ee6f8815fc6 100644 |
980 | --- a/sound/usb/midi.c |
981 | +++ b/sound/usb/midi.c |
982 | @@ -365,6 +365,8 @@ static void snd_usbmidi_error_timer(unsigned long data) |
983 | if (in && in->error_resubmit) { |
984 | in->error_resubmit = 0; |
985 | for (j = 0; j < INPUT_URBS; ++j) { |
986 | + if (atomic_read(&in->urbs[j]->use_count)) |
987 | + continue; |
988 | in->urbs[j]->dev = umidi->dev; |
989 | snd_usbmidi_submit_urb(in->urbs[j], GFP_ATOMIC); |
990 | } |