Contents of /trunk/kernel-magellan/patches-4.13/0105-4.13.6-all-fixes.patch
Parent Directory | Revision Log
Revision 3009 -
(show annotations)
(download)
Wed Oct 25 09:41:34 2017 UTC (6 years, 11 months ago) by niro
File size: 188568 byte(s)
Wed Oct 25 09:41:34 2017 UTC (6 years, 11 months ago) by niro
File size: 188568 byte(s)
-linux-4.13.6
1 | diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt |
2 | index 36f528a7fdd6..8caa60734647 100644 |
3 | --- a/Documentation/filesystems/overlayfs.txt |
4 | +++ b/Documentation/filesystems/overlayfs.txt |
5 | @@ -210,8 +210,11 @@ path as another overlay mount and it may use a lower layer path that is |
6 | beneath or above the path of another overlay lower layer path. |
7 | |
8 | Using an upper layer path and/or a workdir path that are already used by |
9 | -another overlay mount is not allowed and will fail with EBUSY. Using |
10 | +another overlay mount is not allowed and may fail with EBUSY. Using |
11 | partially overlapping paths is not allowed but will not fail with EBUSY. |
12 | +If files are accessed from two overlayfs mounts which share or overlap the |
13 | +upper layer and/or workdir path the behavior of the overlay is undefined, |
14 | +though it will not result in a crash or deadlock. |
15 | |
16 | Mounting an overlay using an upper layer path, where the upper layer path |
17 | was previously used by another mounted overlay in combination with a |
18 | diff --git a/Makefile b/Makefile |
19 | index 189f1a748e4c..9e1af1af327b 100644 |
20 | --- a/Makefile |
21 | +++ b/Makefile |
22 | @@ -1,6 +1,6 @@ |
23 | VERSION = 4 |
24 | PATCHLEVEL = 13 |
25 | -SUBLEVEL = 5 |
26 | +SUBLEVEL = 6 |
27 | EXTRAVERSION = |
28 | NAME = Fearless Coyote |
29 | |
30 | diff --git a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi |
31 | index 4d360713ed12..30d48ecf46e0 100644 |
32 | --- a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi |
33 | +++ b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi |
34 | @@ -254,7 +254,7 @@ |
35 | |
36 | ap_syscon: system-controller@6f4000 { |
37 | compatible = "syscon", "simple-mfd"; |
38 | - reg = <0x6f4000 0x1000>; |
39 | + reg = <0x6f4000 0x2000>; |
40 | |
41 | ap_clk: clock { |
42 | compatible = "marvell,ap806-clock"; |
43 | @@ -265,7 +265,7 @@ |
44 | compatible = "marvell,ap806-pinctrl"; |
45 | }; |
46 | |
47 | - ap_gpio: gpio { |
48 | + ap_gpio: gpio@1040 { |
49 | compatible = "marvell,armada-8k-gpio"; |
50 | offset = <0x1040>; |
51 | ngpios = <20>; |
52 | diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c |
53 | index f0e6d717885b..d06fbe4cd38d 100644 |
54 | --- a/arch/arm64/kernel/armv8_deprecated.c |
55 | +++ b/arch/arm64/kernel/armv8_deprecated.c |
56 | @@ -649,4 +649,4 @@ static int __init armv8_deprecated_init(void) |
57 | return 0; |
58 | } |
59 | |
60 | -late_initcall(armv8_deprecated_init); |
61 | +core_initcall(armv8_deprecated_init); |
62 | diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c |
63 | index 9f9e0064c8c1..276eecab6cea 100644 |
64 | --- a/arch/arm64/kernel/cpufeature.c |
65 | +++ b/arch/arm64/kernel/cpufeature.c |
66 | @@ -1294,4 +1294,4 @@ static int __init enable_mrs_emulation(void) |
67 | return 0; |
68 | } |
69 | |
70 | -late_initcall(enable_mrs_emulation); |
71 | +core_initcall(enable_mrs_emulation); |
72 | diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c |
73 | index 1df770e8cbe0..7275fed271af 100644 |
74 | --- a/arch/powerpc/kernel/dt_cpu_ftrs.c |
75 | +++ b/arch/powerpc/kernel/dt_cpu_ftrs.c |
76 | @@ -102,10 +102,10 @@ static void cpufeatures_flush_tlb(void) |
77 | case PVR_POWER8: |
78 | case PVR_POWER8E: |
79 | case PVR_POWER8NVL: |
80 | - __flush_tlb_power8(POWER8_TLB_SETS); |
81 | + __flush_tlb_power8(TLB_INVAL_SCOPE_GLOBAL); |
82 | break; |
83 | case PVR_POWER9: |
84 | - __flush_tlb_power9(POWER9_TLB_SETS_HASH); |
85 | + __flush_tlb_power9(TLB_INVAL_SCOPE_GLOBAL); |
86 | break; |
87 | default: |
88 | pr_err("unknown CPU version for boot TLB flush\n"); |
89 | diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S |
90 | index f14f3c04ec7e..d9dfdf7ede45 100644 |
91 | --- a/arch/powerpc/kernel/exceptions-64s.S |
92 | +++ b/arch/powerpc/kernel/exceptions-64s.S |
93 | @@ -734,7 +734,29 @@ EXC_REAL(program_check, 0x700, 0x100) |
94 | EXC_VIRT(program_check, 0x4700, 0x100, 0x700) |
95 | TRAMP_KVM(PACA_EXGEN, 0x700) |
96 | EXC_COMMON_BEGIN(program_check_common) |
97 | - EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN) |
98 | + /* |
99 | + * It's possible to receive a TM Bad Thing type program check with |
100 | + * userspace register values (in particular r1), but with SRR1 reporting |
101 | + * that we came from the kernel. Normally that would confuse the bad |
102 | + * stack logic, and we would report a bad kernel stack pointer. Instead |
103 | + * we switch to the emergency stack if we're taking a TM Bad Thing from |
104 | + * the kernel. |
105 | + */ |
106 | + li r10,MSR_PR /* Build a mask of MSR_PR .. */ |
107 | + oris r10,r10,0x200000@h /* .. and SRR1_PROGTM */ |
108 | + and r10,r10,r12 /* Mask SRR1 with that. */ |
109 | + srdi r10,r10,8 /* Shift it so we can compare */ |
110 | + cmpldi r10,(0x200000 >> 8) /* .. with an immediate. */ |
111 | + bne 1f /* If != go to normal path. */ |
112 | + |
113 | + /* SRR1 had PR=0 and SRR1_PROGTM=1, so use the emergency stack */ |
114 | + andi. r10,r12,MSR_PR; /* Set CR0 correctly for label */ |
115 | + /* 3 in EXCEPTION_PROLOG_COMMON */ |
116 | + mr r10,r1 /* Save r1 */ |
117 | + ld r1,PACAEMERGSP(r13) /* Use emergency stack */ |
118 | + subi r1,r1,INT_FRAME_SIZE /* alloc stack frame */ |
119 | + b 3f /* Jump into the macro !! */ |
120 | +1: EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN) |
121 | bl save_nvgprs |
122 | RECONCILE_IRQ_STATE(r10, r11) |
123 | addi r3,r1,STACK_FRAME_OVERHEAD |
124 | diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c |
125 | index c83c115858c1..b2c002993d78 100644 |
126 | --- a/arch/powerpc/kernel/signal_64.c |
127 | +++ b/arch/powerpc/kernel/signal_64.c |
128 | @@ -452,9 +452,20 @@ static long restore_tm_sigcontexts(struct task_struct *tsk, |
129 | if (MSR_TM_RESV(msr)) |
130 | return -EINVAL; |
131 | |
132 | - /* pull in MSR TM from user context */ |
133 | + /* pull in MSR TS bits from user context */ |
134 | regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK); |
135 | |
136 | + /* |
137 | + * Ensure that TM is enabled in regs->msr before we leave the signal |
138 | + * handler. It could be the case that (a) user disabled the TM bit |
139 | + * through the manipulation of the MSR bits in uc_mcontext or (b) the |
140 | + * TM bit was disabled because a sufficient number of context switches |
141 | + * happened whilst in the signal handler and load_tm overflowed, |
142 | + * disabling the TM bit. In either case we can end up with an illegal |
143 | + * TM state leading to a TM Bad Thing when we return to userspace. |
144 | + */ |
145 | + regs->msr |= MSR_TM; |
146 | + |
147 | /* pull in MSR LE from user context */ |
148 | regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE); |
149 | |
150 | diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c |
151 | index 13304622ab1c..bf457843e032 100644 |
152 | --- a/arch/powerpc/kvm/book3s_xive.c |
153 | +++ b/arch/powerpc/kvm/book3s_xive.c |
154 | @@ -622,7 +622,7 @@ int kvmppc_xive_get_xive(struct kvm *kvm, u32 irq, u32 *server, |
155 | return -EINVAL; |
156 | state = &sb->irq_state[idx]; |
157 | arch_spin_lock(&sb->lock); |
158 | - *server = state->guest_server; |
159 | + *server = state->act_server; |
160 | *priority = state->guest_priority; |
161 | arch_spin_unlock(&sb->lock); |
162 | |
163 | @@ -1331,7 +1331,7 @@ static int xive_get_source(struct kvmppc_xive *xive, long irq, u64 addr) |
164 | xive->saved_src_count++; |
165 | |
166 | /* Convert saved state into something compatible with xics */ |
167 | - val = state->guest_server; |
168 | + val = state->act_server; |
169 | prio = state->saved_scan_prio; |
170 | |
171 | if (prio == MASKED) { |
172 | @@ -1507,7 +1507,6 @@ static int xive_set_source(struct kvmppc_xive *xive, long irq, u64 addr) |
173 | /* First convert prio and mark interrupt as untargetted */ |
174 | act_prio = xive_prio_from_guest(guest_prio); |
175 | state->act_priority = MASKED; |
176 | - state->guest_server = server; |
177 | |
178 | /* |
179 | * We need to drop the lock due to the mutex below. Hopefully |
180 | diff --git a/arch/powerpc/kvm/book3s_xive.h b/arch/powerpc/kvm/book3s_xive.h |
181 | index 5938f7644dc1..6ba63f8e8a61 100644 |
182 | --- a/arch/powerpc/kvm/book3s_xive.h |
183 | +++ b/arch/powerpc/kvm/book3s_xive.h |
184 | @@ -35,7 +35,6 @@ struct kvmppc_xive_irq_state { |
185 | struct xive_irq_data *pt_data; /* XIVE Pass-through associated data */ |
186 | |
187 | /* Targetting as set by guest */ |
188 | - u32 guest_server; /* Current guest selected target */ |
189 | u8 guest_priority; /* Guest set priority */ |
190 | u8 saved_priority; /* Saved priority when masking */ |
191 | |
192 | diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c |
193 | index 897aa1400eb8..bbb73aa0eb8f 100644 |
194 | --- a/arch/powerpc/platforms/powernv/setup.c |
195 | +++ b/arch/powerpc/platforms/powernv/setup.c |
196 | @@ -272,7 +272,15 @@ static void pnv_kexec_cpu_down(int crash_shutdown, int secondary) |
197 | #ifdef CONFIG_MEMORY_HOTPLUG_SPARSE |
198 | static unsigned long pnv_memory_block_size(void) |
199 | { |
200 | - return 256UL * 1024 * 1024; |
201 | + /* |
202 | + * We map the kernel linear region with 1GB large pages on radix. For |
203 | + * memory hot unplug to work our memory block size must be at least |
204 | + * this size. |
205 | + */ |
206 | + if (radix_enabled()) |
207 | + return 1UL * 1024 * 1024 * 1024; |
208 | + else |
209 | + return 256UL * 1024 * 1024; |
210 | } |
211 | #endif |
212 | |
213 | diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h |
214 | index bc62e7cbf1b1..59ad3d132353 100644 |
215 | --- a/arch/x86/include/asm/kvm_para.h |
216 | +++ b/arch/x86/include/asm/kvm_para.h |
217 | @@ -88,7 +88,7 @@ static inline long kvm_hypercall4(unsigned int nr, unsigned long p1, |
218 | bool kvm_para_available(void); |
219 | unsigned int kvm_arch_para_features(void); |
220 | void __init kvm_guest_init(void); |
221 | -void kvm_async_pf_task_wait(u32 token); |
222 | +void kvm_async_pf_task_wait(u32 token, int interrupt_kernel); |
223 | void kvm_async_pf_task_wake(u32 token); |
224 | u32 kvm_read_and_reset_pf_reason(void); |
225 | extern void kvm_disable_steal_time(void); |
226 | @@ -103,7 +103,7 @@ static inline void kvm_spinlock_init(void) |
227 | |
228 | #else /* CONFIG_KVM_GUEST */ |
229 | #define kvm_guest_init() do {} while (0) |
230 | -#define kvm_async_pf_task_wait(T) do {} while(0) |
231 | +#define kvm_async_pf_task_wait(T, I) do {} while(0) |
232 | #define kvm_async_pf_task_wake(T) do {} while(0) |
233 | |
234 | static inline bool kvm_para_available(void) |
235 | diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c |
236 | index 58590a698a1a..e5e4306e4546 100644 |
237 | --- a/arch/x86/kernel/kvm.c |
238 | +++ b/arch/x86/kernel/kvm.c |
239 | @@ -117,7 +117,11 @@ static struct kvm_task_sleep_node *_find_apf_task(struct kvm_task_sleep_head *b, |
240 | return NULL; |
241 | } |
242 | |
243 | -void kvm_async_pf_task_wait(u32 token) |
244 | +/* |
245 | + * @interrupt_kernel: Is this called from a routine which interrupts the kernel |
246 | + * (other than user space)? |
247 | + */ |
248 | +void kvm_async_pf_task_wait(u32 token, int interrupt_kernel) |
249 | { |
250 | u32 key = hash_32(token, KVM_TASK_SLEEP_HASHBITS); |
251 | struct kvm_task_sleep_head *b = &async_pf_sleepers[key]; |
252 | @@ -140,8 +144,10 @@ void kvm_async_pf_task_wait(u32 token) |
253 | |
254 | n.token = token; |
255 | n.cpu = smp_processor_id(); |
256 | - n.halted = is_idle_task(current) || preempt_count() > 1 || |
257 | - rcu_preempt_depth(); |
258 | + n.halted = is_idle_task(current) || |
259 | + (IS_ENABLED(CONFIG_PREEMPT_COUNT) |
260 | + ? preempt_count() > 1 || rcu_preempt_depth() |
261 | + : interrupt_kernel); |
262 | init_swait_queue_head(&n.wq); |
263 | hlist_add_head(&n.link, &b->list); |
264 | raw_spin_unlock(&b->lock); |
265 | @@ -269,7 +275,7 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code) |
266 | case KVM_PV_REASON_PAGE_NOT_PRESENT: |
267 | /* page is swapped out by the host. */ |
268 | prev_state = exception_enter(); |
269 | - kvm_async_pf_task_wait((u32)read_cr2()); |
270 | + kvm_async_pf_task_wait((u32)read_cr2(), !user_mode(regs)); |
271 | exception_exit(prev_state); |
272 | break; |
273 | case KVM_PV_REASON_PAGE_READY: |
274 | diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c |
275 | index 56e68dfac974..7558531c1215 100644 |
276 | --- a/arch/x86/kvm/mmu.c |
277 | +++ b/arch/x86/kvm/mmu.c |
278 | @@ -3799,7 +3799,7 @@ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code, |
279 | case KVM_PV_REASON_PAGE_NOT_PRESENT: |
280 | vcpu->arch.apf.host_apf_reason = 0; |
281 | local_irq_disable(); |
282 | - kvm_async_pf_task_wait(fault_address); |
283 | + kvm_async_pf_task_wait(fault_address, 0); |
284 | local_irq_enable(); |
285 | break; |
286 | case KVM_PV_REASON_PAGE_READY: |
287 | diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c |
288 | index e1324f280e06..4d50ced94686 100644 |
289 | --- a/arch/x86/net/bpf_jit_comp.c |
290 | +++ b/arch/x86/net/bpf_jit_comp.c |
291 | @@ -282,9 +282,9 @@ static void emit_bpf_tail_call(u8 **pprog) |
292 | /* if (index >= array->map.max_entries) |
293 | * goto out; |
294 | */ |
295 | - EMIT4(0x48, 0x8B, 0x46, /* mov rax, qword ptr [rsi + 16] */ |
296 | + EMIT2(0x89, 0xD2); /* mov edx, edx */ |
297 | + EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */ |
298 | offsetof(struct bpf_array, map.max_entries)); |
299 | - EMIT3(0x48, 0x39, 0xD0); /* cmp rax, rdx */ |
300 | #define OFFSET1 47 /* number of bytes to jump */ |
301 | EMIT2(X86_JBE, OFFSET1); /* jbe out */ |
302 | label1 = cnt; |
303 | diff --git a/block/bsg-lib.c b/block/bsg-lib.c |
304 | index c587c71d78af..82ddfcd23939 100644 |
305 | --- a/block/bsg-lib.c |
306 | +++ b/block/bsg-lib.c |
307 | @@ -207,20 +207,34 @@ static int bsg_init_rq(struct request_queue *q, struct request *req, gfp_t gfp) |
308 | struct bsg_job *job = blk_mq_rq_to_pdu(req); |
309 | struct scsi_request *sreq = &job->sreq; |
310 | |
311 | + /* called right after the request is allocated for the request_queue */ |
312 | + |
313 | + sreq->sense = kzalloc(SCSI_SENSE_BUFFERSIZE, gfp); |
314 | + if (!sreq->sense) |
315 | + return -ENOMEM; |
316 | + |
317 | + return 0; |
318 | +} |
319 | + |
320 | +static void bsg_initialize_rq(struct request *req) |
321 | +{ |
322 | + struct bsg_job *job = blk_mq_rq_to_pdu(req); |
323 | + struct scsi_request *sreq = &job->sreq; |
324 | + void *sense = sreq->sense; |
325 | + |
326 | + /* called right before the request is given to the request_queue user */ |
327 | + |
328 | memset(job, 0, sizeof(*job)); |
329 | |
330 | scsi_req_init(sreq); |
331 | + |
332 | + sreq->sense = sense; |
333 | sreq->sense_len = SCSI_SENSE_BUFFERSIZE; |
334 | - sreq->sense = kzalloc(sreq->sense_len, gfp); |
335 | - if (!sreq->sense) |
336 | - return -ENOMEM; |
337 | |
338 | job->req = req; |
339 | - job->reply = sreq->sense; |
340 | + job->reply = sense; |
341 | job->reply_len = sreq->sense_len; |
342 | job->dd_data = job + 1; |
343 | - |
344 | - return 0; |
345 | } |
346 | |
347 | static void bsg_exit_rq(struct request_queue *q, struct request *req) |
348 | @@ -250,6 +264,7 @@ struct request_queue *bsg_setup_queue(struct device *dev, char *name, |
349 | q->cmd_size = sizeof(struct bsg_job) + dd_job_size; |
350 | q->init_rq_fn = bsg_init_rq; |
351 | q->exit_rq_fn = bsg_exit_rq; |
352 | + q->initialize_rq_fn = bsg_initialize_rq; |
353 | q->request_fn = bsg_request_fn; |
354 | |
355 | ret = blk_init_allocated_queue(q); |
356 | diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c |
357 | index cfeb049a01ef..642afd88870b 100644 |
358 | --- a/drivers/auxdisplay/charlcd.c |
359 | +++ b/drivers/auxdisplay/charlcd.c |
360 | @@ -647,18 +647,25 @@ static ssize_t charlcd_write(struct file *file, const char __user *buf, |
361 | static int charlcd_open(struct inode *inode, struct file *file) |
362 | { |
363 | struct charlcd_priv *priv = to_priv(the_charlcd); |
364 | + int ret; |
365 | |
366 | + ret = -EBUSY; |
367 | if (!atomic_dec_and_test(&charlcd_available)) |
368 | - return -EBUSY; /* open only once at a time */ |
369 | + goto fail; /* open only once at a time */ |
370 | |
371 | + ret = -EPERM; |
372 | if (file->f_mode & FMODE_READ) /* device is write-only */ |
373 | - return -EPERM; |
374 | + goto fail; |
375 | |
376 | if (priv->must_clear) { |
377 | charlcd_clear_display(&priv->lcd); |
378 | priv->must_clear = false; |
379 | } |
380 | return nonseekable_open(inode, file); |
381 | + |
382 | + fail: |
383 | + atomic_inc(&charlcd_available); |
384 | + return ret; |
385 | } |
386 | |
387 | static int charlcd_release(struct inode *inode, struct file *file) |
388 | diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c |
389 | index 7a8b8fb2f572..c54c20700d37 100644 |
390 | --- a/drivers/auxdisplay/panel.c |
391 | +++ b/drivers/auxdisplay/panel.c |
392 | @@ -1105,14 +1105,21 @@ static ssize_t keypad_read(struct file *file, |
393 | |
394 | static int keypad_open(struct inode *inode, struct file *file) |
395 | { |
396 | + int ret; |
397 | + |
398 | + ret = -EBUSY; |
399 | if (!atomic_dec_and_test(&keypad_available)) |
400 | - return -EBUSY; /* open only once at a time */ |
401 | + goto fail; /* open only once at a time */ |
402 | |
403 | + ret = -EPERM; |
404 | if (file->f_mode & FMODE_WRITE) /* device is read-only */ |
405 | - return -EPERM; |
406 | + goto fail; |
407 | |
408 | keypad_buflen = 0; /* flush the buffer on opening */ |
409 | return 0; |
410 | + fail: |
411 | + atomic_inc(&keypad_available); |
412 | + return ret; |
413 | } |
414 | |
415 | static int keypad_release(struct inode *inode, struct file *file) |
416 | diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c |
417 | index d1c33a85059e..df8945d7f009 100644 |
418 | --- a/drivers/base/arch_topology.c |
419 | +++ b/drivers/base/arch_topology.c |
420 | @@ -160,12 +160,12 @@ int __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu) |
421 | } |
422 | |
423 | #ifdef CONFIG_CPU_FREQ |
424 | -static cpumask_var_t cpus_to_visit; |
425 | -static bool cap_parsing_done; |
426 | -static void parsing_done_workfn(struct work_struct *work); |
427 | -static DECLARE_WORK(parsing_done_work, parsing_done_workfn); |
428 | +static bool cap_parsing_done __initdata; |
429 | +static cpumask_var_t cpus_to_visit __initdata; |
430 | +static void __init parsing_done_workfn(struct work_struct *work); |
431 | +static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn); |
432 | |
433 | -static int |
434 | +static int __init |
435 | init_cpu_capacity_callback(struct notifier_block *nb, |
436 | unsigned long val, |
437 | void *data) |
438 | @@ -200,7 +200,7 @@ init_cpu_capacity_callback(struct notifier_block *nb, |
439 | return 0; |
440 | } |
441 | |
442 | -static struct notifier_block init_cpu_capacity_notifier = { |
443 | +static struct notifier_block init_cpu_capacity_notifier __initdata = { |
444 | .notifier_call = init_cpu_capacity_callback, |
445 | }; |
446 | |
447 | @@ -226,7 +226,7 @@ static int __init register_cpufreq_notifier(void) |
448 | } |
449 | core_initcall(register_cpufreq_notifier); |
450 | |
451 | -static void parsing_done_workfn(struct work_struct *work) |
452 | +static void __init parsing_done_workfn(struct work_struct *work) |
453 | { |
454 | cpufreq_unregister_notifier(&init_cpu_capacity_notifier, |
455 | CPUFREQ_POLICY_NOTIFIER); |
456 | diff --git a/drivers/base/platform.c b/drivers/base/platform.c |
457 | index d1bd99271066..9045c5f3734e 100644 |
458 | --- a/drivers/base/platform.c |
459 | +++ b/drivers/base/platform.c |
460 | @@ -868,7 +868,8 @@ static ssize_t driver_override_store(struct device *dev, |
461 | struct platform_device *pdev = to_platform_device(dev); |
462 | char *driver_override, *old, *cp; |
463 | |
464 | - if (count > PATH_MAX) |
465 | + /* We need to keep extra room for a newline */ |
466 | + if (count >= (PAGE_SIZE - 1)) |
467 | return -EINVAL; |
468 | |
469 | driver_override = kstrndup(buf, count, GFP_KERNEL); |
470 | diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c |
471 | index e40b77583c47..d8d3cb67b402 100644 |
472 | --- a/drivers/clk/samsung/clk-exynos4.c |
473 | +++ b/drivers/clk/samsung/clk-exynos4.c |
474 | @@ -294,6 +294,18 @@ static const struct samsung_clk_reg_dump src_mask_suspend_e4210[] = { |
475 | #define PLL_ENABLED (1 << 31) |
476 | #define PLL_LOCKED (1 << 29) |
477 | |
478 | +static void exynos4_clk_enable_pll(u32 reg) |
479 | +{ |
480 | + u32 pll_con = readl(reg_base + reg); |
481 | + pll_con |= PLL_ENABLED; |
482 | + writel(pll_con, reg_base + reg); |
483 | + |
484 | + while (!(pll_con & PLL_LOCKED)) { |
485 | + cpu_relax(); |
486 | + pll_con = readl(reg_base + reg); |
487 | + } |
488 | +} |
489 | + |
490 | static void exynos4_clk_wait_for_pll(u32 reg) |
491 | { |
492 | u32 pll_con; |
493 | @@ -315,6 +327,9 @@ static int exynos4_clk_suspend(void) |
494 | samsung_clk_save(reg_base, exynos4_save_pll, |
495 | ARRAY_SIZE(exynos4_clk_pll_regs)); |
496 | |
497 | + exynos4_clk_enable_pll(EPLL_CON0); |
498 | + exynos4_clk_enable_pll(VPLL_CON0); |
499 | + |
500 | if (exynos4_soc == EXYNOS4210) { |
501 | samsung_clk_save(reg_base, exynos4_save_soc, |
502 | ARRAY_SIZE(exynos4210_clk_save)); |
503 | diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c |
504 | index d805b6e6fe71..27743be5b768 100644 |
505 | --- a/drivers/gpu/drm/i915/intel_audio.c |
506 | +++ b/drivers/gpu/drm/i915/intel_audio.c |
507 | @@ -606,11 +606,6 @@ void intel_audio_codec_enable(struct intel_encoder *intel_encoder, |
508 | connector->encoder->base.id, |
509 | connector->encoder->name); |
510 | |
511 | - /* ELD Conn_Type */ |
512 | - connector->eld[5] &= ~(3 << 2); |
513 | - if (intel_crtc_has_dp_encoder(crtc_state)) |
514 | - connector->eld[5] |= (1 << 2); |
515 | - |
516 | connector->eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2; |
517 | |
518 | if (dev_priv->display.audio_codec_enable) |
519 | diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c |
520 | index 7ea7fd1e8856..645488071944 100644 |
521 | --- a/drivers/gpu/drm/i915/intel_bios.c |
522 | +++ b/drivers/gpu/drm/i915/intel_bios.c |
523 | @@ -1163,6 +1163,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port, |
524 | is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0; |
525 | is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR); |
526 | |
527 | + if (port == PORT_A && is_dvi) { |
528 | + DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n", |
529 | + is_hdmi ? "/HDMI" : ""); |
530 | + is_dvi = false; |
531 | + is_hdmi = false; |
532 | + } |
533 | + |
534 | info->supports_dvi = is_dvi; |
535 | info->supports_hdmi = is_hdmi; |
536 | info->supports_dp = is_dp; |
537 | diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c |
538 | index 951e834dd274..28a778b785ac 100644 |
539 | --- a/drivers/gpu/drm/i915/intel_modes.c |
540 | +++ b/drivers/gpu/drm/i915/intel_modes.c |
541 | @@ -30,6 +30,21 @@ |
542 | #include "intel_drv.h" |
543 | #include "i915_drv.h" |
544 | |
545 | +static void intel_connector_update_eld_conn_type(struct drm_connector *connector) |
546 | +{ |
547 | + u8 conn_type; |
548 | + |
549 | + if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort || |
550 | + connector->connector_type == DRM_MODE_CONNECTOR_eDP) { |
551 | + conn_type = DRM_ELD_CONN_TYPE_DP; |
552 | + } else { |
553 | + conn_type = DRM_ELD_CONN_TYPE_HDMI; |
554 | + } |
555 | + |
556 | + connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] &= ~DRM_ELD_CONN_TYPE_MASK; |
557 | + connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= conn_type; |
558 | +} |
559 | + |
560 | /** |
561 | * intel_connector_update_modes - update connector from edid |
562 | * @connector: DRM connector device to use |
563 | @@ -44,6 +59,8 @@ int intel_connector_update_modes(struct drm_connector *connector, |
564 | ret = drm_add_edid_modes(connector, edid); |
565 | drm_edid_to_eld(connector, edid); |
566 | |
567 | + intel_connector_update_eld_conn_type(connector); |
568 | + |
569 | return ret; |
570 | } |
571 | |
572 | diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c |
573 | index 5b40c2614599..ef241d66562e 100644 |
574 | --- a/drivers/hid/hid-rmi.c |
575 | +++ b/drivers/hid/hid-rmi.c |
576 | @@ -436,17 +436,24 @@ static int rmi_post_resume(struct hid_device *hdev) |
577 | if (!(data->device_flags & RMI_DEVICE)) |
578 | return 0; |
579 | |
580 | - ret = rmi_reset_attn_mode(hdev); |
581 | + /* Make sure the HID device is ready to receive events */ |
582 | + ret = hid_hw_open(hdev); |
583 | if (ret) |
584 | return ret; |
585 | |
586 | + ret = rmi_reset_attn_mode(hdev); |
587 | + if (ret) |
588 | + goto out; |
589 | + |
590 | ret = rmi_driver_resume(rmi_dev, false); |
591 | if (ret) { |
592 | hid_warn(hdev, "Failed to resume device: %d\n", ret); |
593 | - return ret; |
594 | + goto out; |
595 | } |
596 | |
597 | - return 0; |
598 | +out: |
599 | + hid_hw_close(hdev); |
600 | + return ret; |
601 | } |
602 | #endif /* CONFIG_PM */ |
603 | |
604 | diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c |
605 | index 046f692fd0a2..364150435c62 100644 |
606 | --- a/drivers/hid/i2c-hid/i2c-hid.c |
607 | +++ b/drivers/hid/i2c-hid/i2c-hid.c |
608 | @@ -543,7 +543,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size) |
609 | { |
610 | /* the worst case is computed from the set_report command with a |
611 | * reportID > 15 and the maximum report length */ |
612 | - int args_len = sizeof(__u8) + /* optional ReportID byte */ |
613 | + int args_len = sizeof(__u8) + /* ReportID */ |
614 | + sizeof(__u8) + /* optional ReportID byte */ |
615 | sizeof(__u16) + /* data register */ |
616 | sizeof(__u16) + /* size of the report */ |
617 | report_size; /* report */ |
618 | diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c |
619 | index 838c1ebfffa9..a805ee2989cb 100644 |
620 | --- a/drivers/hid/wacom_sys.c |
621 | +++ b/drivers/hid/wacom_sys.c |
622 | @@ -668,8 +668,10 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev) |
623 | |
624 | /* Try to find an already-probed interface from the same device */ |
625 | list_for_each_entry(data, &wacom_udev_list, list) { |
626 | - if (compare_device_paths(hdev, data->dev, '/')) |
627 | + if (compare_device_paths(hdev, data->dev, '/')) { |
628 | + kref_get(&data->kref); |
629 | return data; |
630 | + } |
631 | } |
632 | |
633 | /* Fallback to finding devices that appear to be "siblings" */ |
634 | @@ -766,6 +768,9 @@ static int wacom_led_control(struct wacom *wacom) |
635 | if (!wacom->led.groups) |
636 | return -ENOTSUPP; |
637 | |
638 | + if (wacom->wacom_wac.features.type == REMOTE) |
639 | + return -ENOTSUPP; |
640 | + |
641 | if (wacom->wacom_wac.pid) { /* wireless connected */ |
642 | report_id = WAC_CMD_WL_LED_CONTROL; |
643 | buf_size = 13; |
644 | diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c |
645 | index bb17d7bbefd3..aa692e28b2cd 100644 |
646 | --- a/drivers/hid/wacom_wac.c |
647 | +++ b/drivers/hid/wacom_wac.c |
648 | @@ -567,8 +567,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom) |
649 | keys = data[9] & 0x07; |
650 | } |
651 | } else { |
652 | - buttons = ((data[6] & 0x10) << 10) | |
653 | - ((data[5] & 0x10) << 9) | |
654 | + buttons = ((data[6] & 0x10) << 5) | |
655 | + ((data[5] & 0x10) << 4) | |
656 | ((data[6] & 0x0F) << 4) | |
657 | (data[5] & 0x0F); |
658 | } |
659 | @@ -1227,11 +1227,17 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom) |
660 | continue; |
661 | |
662 | if (range) { |
663 | + /* Fix rotation alignment: userspace expects zero at left */ |
664 | + int16_t rotation = (int16_t)get_unaligned_le16(&frame[9]); |
665 | + rotation += 1800/4; |
666 | + if (rotation > 899) |
667 | + rotation -= 1800; |
668 | + |
669 | input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1])); |
670 | input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3])); |
671 | - input_report_abs(pen_input, ABS_TILT_X, frame[7]); |
672 | - input_report_abs(pen_input, ABS_TILT_Y, frame[8]); |
673 | - input_report_abs(pen_input, ABS_Z, get_unaligned_le16(&frame[9])); |
674 | + input_report_abs(pen_input, ABS_TILT_X, (char)frame[7]); |
675 | + input_report_abs(pen_input, ABS_TILT_Y, (char)frame[8]); |
676 | + input_report_abs(pen_input, ABS_Z, rotation); |
677 | input_report_abs(pen_input, ABS_WHEEL, get_unaligned_le16(&frame[11])); |
678 | } |
679 | input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5])); |
680 | @@ -1319,12 +1325,19 @@ static void wacom_intuos_pro2_bt_pad(struct wacom_wac *wacom) |
681 | unsigned char *data = wacom->data; |
682 | |
683 | int buttons = (data[282] << 1) | ((data[281] >> 6) & 0x01); |
684 | - int ring = data[285]; |
685 | - int prox = buttons | (ring & 0x80); |
686 | + int ring = data[285] & 0x7F; |
687 | + bool ringstatus = data[285] & 0x80; |
688 | + bool prox = buttons || ringstatus; |
689 | + |
690 | + /* Fix touchring data: userspace expects 0 at left and increasing clockwise */ |
691 | + ring = 71 - ring; |
692 | + ring += 3*72/16; |
693 | + if (ring > 71) |
694 | + ring -= 72; |
695 | |
696 | wacom_report_numbered_buttons(pad_input, 9, buttons); |
697 | |
698 | - input_report_abs(pad_input, ABS_WHEEL, (ring & 0x80) ? (ring & 0x7f) : 0); |
699 | + input_report_abs(pad_input, ABS_WHEEL, ringstatus ? ring : 0); |
700 | |
701 | input_report_key(pad_input, wacom->tool[1], prox ? 1 : 0); |
702 | input_report_abs(pad_input, ABS_MISC, prox ? PAD_DEVICE_ID : 0); |
703 | @@ -1616,6 +1629,20 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len) |
704 | return 0; |
705 | } |
706 | |
707 | +static int wacom_offset_rotation(struct input_dev *input, struct hid_usage *usage, |
708 | + int value, int num, int denom) |
709 | +{ |
710 | + struct input_absinfo *abs = &input->absinfo[usage->code]; |
711 | + int range = (abs->maximum - abs->minimum + 1); |
712 | + |
713 | + value += num*range/denom; |
714 | + if (value > abs->maximum) |
715 | + value -= range; |
716 | + else if (value < abs->minimum) |
717 | + value += range; |
718 | + return value; |
719 | +} |
720 | + |
721 | int wacom_equivalent_usage(int usage) |
722 | { |
723 | if ((usage & HID_USAGE_PAGE) == WACOM_HID_UP_WACOMDIGITIZER) { |
724 | @@ -1898,6 +1925,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field |
725 | unsigned equivalent_usage = wacom_equivalent_usage(usage->hid); |
726 | int i; |
727 | bool is_touch_on = value; |
728 | + bool do_report = false; |
729 | |
730 | /* |
731 | * Avoid reporting this event and setting inrange_state if this usage |
732 | @@ -1912,6 +1940,29 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field |
733 | } |
734 | |
735 | switch (equivalent_usage) { |
736 | + case WACOM_HID_WD_TOUCHRING: |
737 | + /* |
738 | + * Userspace expects touchrings to increase in value with |
739 | + * clockwise gestures and have their zero point at the |
740 | + * tablet's left. HID events "should" be clockwise- |
741 | + * increasing and zero at top, though the MobileStudio |
742 | + * Pro and 2nd-gen Intuos Pro don't do this... |
743 | + */ |
744 | + if (hdev->vendor == 0x56a && |
745 | + (hdev->product == 0x34d || hdev->product == 0x34e || /* MobileStudio Pro */ |
746 | + hdev->product == 0x357 || hdev->product == 0x358)) { /* Intuos Pro 2 */ |
747 | + value = (field->logical_maximum - value); |
748 | + |
749 | + if (hdev->product == 0x357 || hdev->product == 0x358) |
750 | + value = wacom_offset_rotation(input, usage, value, 3, 16); |
751 | + else if (hdev->product == 0x34d || hdev->product == 0x34e) |
752 | + value = wacom_offset_rotation(input, usage, value, 1, 2); |
753 | + } |
754 | + else { |
755 | + value = wacom_offset_rotation(input, usage, value, 1, 4); |
756 | + } |
757 | + do_report = true; |
758 | + break; |
759 | case WACOM_HID_WD_TOUCHRINGSTATUS: |
760 | if (!value) |
761 | input_event(input, usage->type, usage->code, 0); |
762 | @@ -1945,10 +1996,14 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field |
763 | value, i); |
764 | /* fall through*/ |
765 | default: |
766 | + do_report = true; |
767 | + break; |
768 | + } |
769 | + |
770 | + if (do_report) { |
771 | input_event(input, usage->type, usage->code, value); |
772 | if (value) |
773 | wacom_wac->hid_data.pad_input_event_flag = true; |
774 | - break; |
775 | } |
776 | } |
777 | |
778 | @@ -2086,22 +2141,34 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field |
779 | wacom_wac->hid_data.tipswitch |= value; |
780 | return; |
781 | case HID_DG_TOOLSERIALNUMBER: |
782 | - wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL); |
783 | - wacom_wac->serial[0] |= (__u32)value; |
784 | + if (value) { |
785 | + wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL); |
786 | + wacom_wac->serial[0] |= (__u32)value; |
787 | + } |
788 | return; |
789 | + case HID_DG_TWIST: |
790 | + /* |
791 | + * Userspace expects pen twist to have its zero point when |
792 | + * the buttons/finger is on the tablet's left. HID values |
793 | + * are zero when buttons are toward the top. |
794 | + */ |
795 | + value = wacom_offset_rotation(input, usage, value, 1, 4); |
796 | + break; |
797 | case WACOM_HID_WD_SENSE: |
798 | wacom_wac->hid_data.sense_state = value; |
799 | return; |
800 | case WACOM_HID_WD_SERIALHI: |
801 | - wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF); |
802 | - wacom_wac->serial[0] |= ((__u64)value) << 32; |
803 | - /* |
804 | - * Non-USI EMR devices may contain additional tool type |
805 | - * information here. See WACOM_HID_WD_TOOLTYPE case for |
806 | - * more details. |
807 | - */ |
808 | - if (value >> 20 == 1) { |
809 | - wacom_wac->id[0] |= value & 0xFFFFF; |
810 | + if (value) { |
811 | + wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF); |
812 | + wacom_wac->serial[0] |= ((__u64)value) << 32; |
813 | + /* |
814 | + * Non-USI EMR devices may contain additional tool type |
815 | + * information here. See WACOM_HID_WD_TOOLTYPE case for |
816 | + * more details. |
817 | + */ |
818 | + if (value >> 20 == 1) { |
819 | + wacom_wac->id[0] |= value & 0xFFFFF; |
820 | + } |
821 | } |
822 | return; |
823 | case WACOM_HID_WD_TOOLTYPE: |
824 | @@ -2205,7 +2272,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev, |
825 | input_report_key(input, wacom_wac->tool[0], prox); |
826 | if (wacom_wac->serial[0]) { |
827 | input_event(input, EV_MSC, MSC_SERIAL, wacom_wac->serial[0]); |
828 | - input_report_abs(input, ABS_MISC, id); |
829 | + input_report_abs(input, ABS_MISC, prox ? id : 0); |
830 | } |
831 | |
832 | wacom_wac->hid_data.tipswitch = false; |
833 | @@ -2216,6 +2283,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev, |
834 | if (!prox) { |
835 | wacom_wac->tool[0] = 0; |
836 | wacom_wac->id[0] = 0; |
837 | + wacom_wac->serial[0] = 0; |
838 | } |
839 | } |
840 | |
841 | diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c |
842 | index 4bbb8dea4727..037361158074 100644 |
843 | --- a/drivers/hv/channel_mgmt.c |
844 | +++ b/drivers/hv/channel_mgmt.c |
845 | @@ -922,14 +922,10 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) |
846 | |
847 | void vmbus_hvsock_device_unregister(struct vmbus_channel *channel) |
848 | { |
849 | - mutex_lock(&vmbus_connection.channel_mutex); |
850 | - |
851 | BUG_ON(!is_hvsock_channel(channel)); |
852 | |
853 | channel->rescind = true; |
854 | vmbus_device_unregister(channel->device_obj); |
855 | - |
856 | - mutex_unlock(&vmbus_connection.channel_mutex); |
857 | } |
858 | EXPORT_SYMBOL_GPL(vmbus_hvsock_device_unregister); |
859 | |
860 | diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c |
861 | index daa75bd41f86..2364281d8593 100644 |
862 | --- a/drivers/hv/hv_fcopy.c |
863 | +++ b/drivers/hv/hv_fcopy.c |
864 | @@ -170,6 +170,10 @@ static void fcopy_send_data(struct work_struct *dummy) |
865 | out_src = smsg_out; |
866 | break; |
867 | |
868 | + case WRITE_TO_FILE: |
869 | + out_src = fcopy_transaction.fcopy_msg; |
870 | + out_len = sizeof(struct hv_do_fcopy); |
871 | + break; |
872 | default: |
873 | out_src = fcopy_transaction.fcopy_msg; |
874 | out_len = fcopy_transaction.recv_len; |
875 | diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c |
876 | index da40df2ff27d..ed6262be3643 100644 |
877 | --- a/drivers/hwtracing/intel_th/pci.c |
878 | +++ b/drivers/hwtracing/intel_th/pci.c |
879 | @@ -90,6 +90,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { |
880 | PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x19e1), |
881 | .driver_data = (kernel_ulong_t)0, |
882 | }, |
883 | + { |
884 | + /* Lewisburg PCH */ |
885 | + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6), |
886 | + .driver_data = (kernel_ulong_t)0, |
887 | + }, |
888 | { |
889 | /* Gemini Lake */ |
890 | PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e), |
891 | diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c |
892 | index 0e731143f6a4..08b8305fee44 100644 |
893 | --- a/drivers/hwtracing/stm/core.c |
894 | +++ b/drivers/hwtracing/stm/core.c |
895 | @@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data) |
896 | |
897 | stm_source_link_drop(src); |
898 | |
899 | - device_destroy(&stm_source_class, src->dev.devt); |
900 | + device_unregister(&src->dev); |
901 | } |
902 | EXPORT_SYMBOL_GPL(stm_source_unregister_device); |
903 | |
904 | diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c |
905 | index e6706a09e100..47c3d7f32900 100644 |
906 | --- a/drivers/iio/adc/ad7793.c |
907 | +++ b/drivers/iio/adc/ad7793.c |
908 | @@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, |
909 | unsigned int vref_mv) |
910 | { |
911 | struct ad7793_state *st = iio_priv(indio_dev); |
912 | - int i, ret = -1; |
913 | + int i, ret; |
914 | unsigned long long scale_uv; |
915 | u32 id; |
916 | |
917 | @@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, |
918 | return ret; |
919 | |
920 | /* reset the serial interface */ |
921 | - ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret)); |
922 | + ret = ad_sd_reset(&st->sd, 32); |
923 | if (ret < 0) |
924 | goto out; |
925 | usleep_range(500, 2000); /* Wait for at least 500us */ |
926 | diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c |
927 | index d10bd0c97233..22c4c17cd996 100644 |
928 | --- a/drivers/iio/adc/ad_sigma_delta.c |
929 | +++ b/drivers/iio/adc/ad_sigma_delta.c |
930 | @@ -177,6 +177,34 @@ int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, |
931 | } |
932 | EXPORT_SYMBOL_GPL(ad_sd_read_reg); |
933 | |
934 | +/** |
935 | + * ad_sd_reset() - Reset the serial interface |
936 | + * |
937 | + * @sigma_delta: The sigma delta device |
938 | + * @reset_length: Number of SCLKs with DIN = 1 |
939 | + * |
940 | + * Returns 0 on success, an error code otherwise. |
941 | + **/ |
942 | +int ad_sd_reset(struct ad_sigma_delta *sigma_delta, |
943 | + unsigned int reset_length) |
944 | +{ |
945 | + uint8_t *buf; |
946 | + unsigned int size; |
947 | + int ret; |
948 | + |
949 | + size = DIV_ROUND_UP(reset_length, 8); |
950 | + buf = kcalloc(size, sizeof(*buf), GFP_KERNEL); |
951 | + if (!buf) |
952 | + return -ENOMEM; |
953 | + |
954 | + memset(buf, 0xff, size); |
955 | + ret = spi_write(sigma_delta->spi, buf, size); |
956 | + kfree(buf); |
957 | + |
958 | + return ret; |
959 | +} |
960 | +EXPORT_SYMBOL_GPL(ad_sd_reset); |
961 | + |
962 | static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta, |
963 | unsigned int mode, unsigned int channel) |
964 | { |
965 | diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c |
966 | index 634717ae12f3..071dd23a33d9 100644 |
967 | --- a/drivers/iio/adc/mcp320x.c |
968 | +++ b/drivers/iio/adc/mcp320x.c |
969 | @@ -17,6 +17,8 @@ |
970 | * MCP3204 |
971 | * MCP3208 |
972 | * ------------ |
973 | + * 13 bit converter |
974 | + * MCP3301 |
975 | * |
976 | * Datasheet can be found here: |
977 | * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf mcp3001 |
978 | @@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(int device_index, |
979 | } |
980 | |
981 | static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, |
982 | - bool differential, int device_index) |
983 | + bool differential, int device_index, int *val) |
984 | { |
985 | int ret; |
986 | |
987 | @@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, |
988 | |
989 | switch (device_index) { |
990 | case mcp3001: |
991 | - return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); |
992 | + *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); |
993 | + return 0; |
994 | case mcp3002: |
995 | case mcp3004: |
996 | case mcp3008: |
997 | - return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); |
998 | + *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); |
999 | + return 0; |
1000 | case mcp3201: |
1001 | - return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); |
1002 | + *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); |
1003 | + return 0; |
1004 | case mcp3202: |
1005 | case mcp3204: |
1006 | case mcp3208: |
1007 | - return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); |
1008 | + *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); |
1009 | + return 0; |
1010 | case mcp3301: |
1011 | - return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12); |
1012 | + *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8 |
1013 | + | adc->rx_buf[1], 12); |
1014 | + return 0; |
1015 | default: |
1016 | return -EINVAL; |
1017 | } |
1018 | @@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev, |
1019 | switch (mask) { |
1020 | case IIO_CHAN_INFO_RAW: |
1021 | ret = mcp320x_adc_conversion(adc, channel->address, |
1022 | - channel->differential, device_index); |
1023 | - |
1024 | + channel->differential, device_index, val); |
1025 | if (ret < 0) |
1026 | goto out; |
1027 | |
1028 | - *val = ret; |
1029 | ret = IIO_VAL_INT; |
1030 | break; |
1031 | |
1032 | @@ -312,6 +318,7 @@ static int mcp320x_probe(struct spi_device *spi) |
1033 | indio_dev->name = spi_get_device_id(spi)->name; |
1034 | indio_dev->modes = INDIO_DIRECT_MODE; |
1035 | indio_dev->info = &mcp320x_info; |
1036 | + spi_set_drvdata(spi, indio_dev); |
1037 | |
1038 | chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data]; |
1039 | indio_dev->channels = chip_info->channels; |
1040 | diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c |
1041 | index 5bfcc1f13105..10e1d8328461 100644 |
1042 | --- a/drivers/iio/adc/stm32-adc.c |
1043 | +++ b/drivers/iio/adc/stm32-adc.c |
1044 | @@ -1543,7 +1543,7 @@ static int stm32_adc_chan_of_init(struct iio_dev *indio_dev) |
1045 | |
1046 | num_channels = of_property_count_u32_elems(node, "st,adc-channels"); |
1047 | if (num_channels < 0 || |
1048 | - num_channels >= adc_info->max_channels) { |
1049 | + num_channels > adc_info->max_channels) { |
1050 | dev_err(&indio_dev->dev, "Bad st,adc-channels?\n"); |
1051 | return num_channels < 0 ? num_channels : -EINVAL; |
1052 | } |
1053 | diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c |
1054 | index bd3d37fc2144..0c86fbb3033e 100644 |
1055 | --- a/drivers/iio/adc/twl4030-madc.c |
1056 | +++ b/drivers/iio/adc/twl4030-madc.c |
1057 | @@ -887,8 +887,10 @@ static int twl4030_madc_probe(struct platform_device *pdev) |
1058 | |
1059 | /* Enable 3v1 bias regulator for MADC[3:6] */ |
1060 | madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1"); |
1061 | - if (IS_ERR(madc->usb3v1)) |
1062 | - return -ENODEV; |
1063 | + if (IS_ERR(madc->usb3v1)) { |
1064 | + ret = -ENODEV; |
1065 | + goto err_i2c; |
1066 | + } |
1067 | |
1068 | ret = regulator_enable(madc->usb3v1); |
1069 | if (ret) |
1070 | @@ -897,11 +899,13 @@ static int twl4030_madc_probe(struct platform_device *pdev) |
1071 | ret = iio_device_register(iio_dev); |
1072 | if (ret) { |
1073 | dev_err(&pdev->dev, "could not register iio device\n"); |
1074 | - goto err_i2c; |
1075 | + goto err_usb3v1; |
1076 | } |
1077 | |
1078 | return 0; |
1079 | |
1080 | +err_usb3v1: |
1081 | + regulator_disable(madc->usb3v1); |
1082 | err_i2c: |
1083 | twl4030_madc_set_current_generator(madc, 0, 0); |
1084 | err_current_generator: |
1085 | diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c |
1086 | index 17ec4cee51dc..a47428b4d31b 100644 |
1087 | --- a/drivers/iio/industrialio-core.c |
1088 | +++ b/drivers/iio/industrialio-core.c |
1089 | @@ -310,8 +310,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf, |
1090 | ret = indio_dev->info->debugfs_reg_access(indio_dev, |
1091 | indio_dev->cached_reg_addr, |
1092 | 0, &val); |
1093 | - if (ret) |
1094 | + if (ret) { |
1095 | dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__); |
1096 | + return ret; |
1097 | + } |
1098 | |
1099 | len = snprintf(buf, sizeof(buf), "0x%X\n", val); |
1100 | |
1101 | diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c |
1102 | index 0d2ea3ee371b..8f26428804a2 100644 |
1103 | --- a/drivers/iio/pressure/bmp280-core.c |
1104 | +++ b/drivers/iio/pressure/bmp280-core.c |
1105 | @@ -573,7 +573,7 @@ static int bmp280_chip_config(struct bmp280_data *data) |
1106 | u8 osrs = BMP280_OSRS_TEMP_X(data->oversampling_temp + 1) | |
1107 | BMP280_OSRS_PRESS_X(data->oversampling_press + 1); |
1108 | |
1109 | - ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_MEAS, |
1110 | + ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS, |
1111 | BMP280_OSRS_TEMP_MASK | |
1112 | BMP280_OSRS_PRESS_MASK | |
1113 | BMP280_MODE_MASK, |
1114 | diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c |
1115 | index 25ad6abfee22..ea128bd82a28 100644 |
1116 | --- a/drivers/iio/trigger/stm32-timer-trigger.c |
1117 | +++ b/drivers/iio/trigger/stm32-timer-trigger.c |
1118 | @@ -138,6 +138,7 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv) |
1119 | clk_disable(priv->clk); |
1120 | |
1121 | /* Stop timer */ |
1122 | + regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0); |
1123 | regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0); |
1124 | regmap_write(priv->regmap, TIM_PSC, 0); |
1125 | regmap_write(priv->regmap, TIM_ARR, 0); |
1126 | @@ -679,8 +680,9 @@ static ssize_t stm32_count_set_preset(struct iio_dev *indio_dev, |
1127 | if (ret) |
1128 | return ret; |
1129 | |
1130 | + /* TIMx_ARR register shouldn't be buffered (ARPE=0) */ |
1131 | + regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0); |
1132 | regmap_write(priv->regmap, TIM_ARR, preset); |
1133 | - regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE); |
1134 | |
1135 | return len; |
1136 | } |
1137 | diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c |
1138 | index 6c44609fd83a..cd2b3c69771a 100644 |
1139 | --- a/drivers/isdn/i4l/isdn_ppp.c |
1140 | +++ b/drivers/isdn/i4l/isdn_ppp.c |
1141 | @@ -825,7 +825,6 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) |
1142 | isdn_net_local *lp; |
1143 | struct ippp_struct *is; |
1144 | int proto; |
1145 | - unsigned char protobuf[4]; |
1146 | |
1147 | is = file->private_data; |
1148 | |
1149 | @@ -839,24 +838,28 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) |
1150 | if (!lp) |
1151 | printk(KERN_DEBUG "isdn_ppp_write: lp == NULL\n"); |
1152 | else { |
1153 | - /* |
1154 | - * Don't reset huptimer for |
1155 | - * LCP packets. (Echo requests). |
1156 | - */ |
1157 | - if (copy_from_user(protobuf, buf, 4)) |
1158 | - return -EFAULT; |
1159 | - proto = PPP_PROTOCOL(protobuf); |
1160 | - if (proto != PPP_LCP) |
1161 | - lp->huptimer = 0; |
1162 | + if (lp->isdn_device < 0 || lp->isdn_channel < 0) { |
1163 | + unsigned char protobuf[4]; |
1164 | + /* |
1165 | + * Don't reset huptimer for |
1166 | + * LCP packets. (Echo requests). |
1167 | + */ |
1168 | + if (copy_from_user(protobuf, buf, 4)) |
1169 | + return -EFAULT; |
1170 | + |
1171 | + proto = PPP_PROTOCOL(protobuf); |
1172 | + if (proto != PPP_LCP) |
1173 | + lp->huptimer = 0; |
1174 | |
1175 | - if (lp->isdn_device < 0 || lp->isdn_channel < 0) |
1176 | return 0; |
1177 | + } |
1178 | |
1179 | if ((dev->drv[lp->isdn_device]->flags & DRV_FLAG_RUNNING) && |
1180 | lp->dialstate == 0 && |
1181 | (lp->flags & ISDN_NET_CONNECTED)) { |
1182 | unsigned short hl; |
1183 | struct sk_buff *skb; |
1184 | + unsigned char *cpy_buf; |
1185 | /* |
1186 | * we need to reserve enough space in front of |
1187 | * sk_buff. old call to dev_alloc_skb only reserved |
1188 | @@ -869,11 +872,21 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) |
1189 | return count; |
1190 | } |
1191 | skb_reserve(skb, hl); |
1192 | - if (copy_from_user(skb_put(skb, count), buf, count)) |
1193 | + cpy_buf = skb_put(skb, count); |
1194 | + if (copy_from_user(cpy_buf, buf, count)) |
1195 | { |
1196 | kfree_skb(skb); |
1197 | return -EFAULT; |
1198 | } |
1199 | + |
1200 | + /* |
1201 | + * Don't reset huptimer for |
1202 | + * LCP packets. (Echo requests). |
1203 | + */ |
1204 | + proto = PPP_PROTOCOL(cpy_buf); |
1205 | + if (proto != PPP_LCP) |
1206 | + lp->huptimer = 0; |
1207 | + |
1208 | if (is->debug & 0x40) { |
1209 | printk(KERN_DEBUG "ppp xmit: len %d\n", (int) skb->len); |
1210 | isdn_ppp_frame_log("xmit", skb->data, skb->len, 32, is->unit, lp->ppp_slot); |
1211 | diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h |
1212 | index 24eddbdf2ab4..203144762f36 100644 |
1213 | --- a/drivers/md/dm-core.h |
1214 | +++ b/drivers/md/dm-core.h |
1215 | @@ -149,5 +149,6 @@ static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen |
1216 | |
1217 | extern atomic_t dm_global_event_nr; |
1218 | extern wait_queue_head_t dm_global_eventq; |
1219 | +void dm_issue_global_event(void); |
1220 | |
1221 | #endif |
1222 | diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c |
1223 | index cdf6b1e12460..e3dd64a12f55 100644 |
1224 | --- a/drivers/md/dm-crypt.c |
1225 | +++ b/drivers/md/dm-crypt.c |
1226 | @@ -2470,6 +2470,7 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key |
1227 | kfree(cipher_api); |
1228 | return ret; |
1229 | } |
1230 | + kfree(cipher_api); |
1231 | |
1232 | return 0; |
1233 | bad_mem: |
1234 | @@ -2588,6 +2589,10 @@ static int crypt_ctr_optional(struct dm_target *ti, unsigned int argc, char **ar |
1235 | ti->error = "Invalid feature value for sector_size"; |
1236 | return -EINVAL; |
1237 | } |
1238 | + if (ti->len & ((cc->sector_size >> SECTOR_SHIFT) - 1)) { |
1239 | + ti->error = "Device size is not multiple of sector_size feature"; |
1240 | + return -EINVAL; |
1241 | + } |
1242 | cc->sector_shift = __ffs(cc->sector_size) - SECTOR_SHIFT; |
1243 | } else if (!strcasecmp(opt_string, "iv_large_sectors")) |
1244 | set_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags); |
1245 | diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c |
1246 | index e06f0ef7d2ec..e9f9884b66a8 100644 |
1247 | --- a/drivers/md/dm-ioctl.c |
1248 | +++ b/drivers/md/dm-ioctl.c |
1249 | @@ -477,9 +477,13 @@ static int remove_all(struct file *filp, struct dm_ioctl *param, size_t param_si |
1250 | * Round up the ptr to an 8-byte boundary. |
1251 | */ |
1252 | #define ALIGN_MASK 7 |
1253 | +static inline size_t align_val(size_t val) |
1254 | +{ |
1255 | + return (val + ALIGN_MASK) & ~ALIGN_MASK; |
1256 | +} |
1257 | static inline void *align_ptr(void *ptr) |
1258 | { |
1259 | - return (void *) (((size_t) (ptr + ALIGN_MASK)) & ~ALIGN_MASK); |
1260 | + return (void *)align_val((size_t)ptr); |
1261 | } |
1262 | |
1263 | /* |
1264 | @@ -505,7 +509,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_ |
1265 | struct hash_cell *hc; |
1266 | size_t len, needed = 0; |
1267 | struct gendisk *disk; |
1268 | - struct dm_name_list *nl, *old_nl = NULL; |
1269 | + struct dm_name_list *orig_nl, *nl, *old_nl = NULL; |
1270 | uint32_t *event_nr; |
1271 | |
1272 | down_write(&_hash_lock); |
1273 | @@ -516,17 +520,15 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_ |
1274 | */ |
1275 | for (i = 0; i < NUM_BUCKETS; i++) { |
1276 | list_for_each_entry (hc, _name_buckets + i, name_list) { |
1277 | - needed += sizeof(struct dm_name_list); |
1278 | - needed += strlen(hc->name) + 1; |
1279 | - needed += ALIGN_MASK; |
1280 | - needed += (sizeof(uint32_t) + ALIGN_MASK) & ~ALIGN_MASK; |
1281 | + needed += align_val(offsetof(struct dm_name_list, name) + strlen(hc->name) + 1); |
1282 | + needed += align_val(sizeof(uint32_t)); |
1283 | } |
1284 | } |
1285 | |
1286 | /* |
1287 | * Grab our output buffer. |
1288 | */ |
1289 | - nl = get_result_buffer(param, param_size, &len); |
1290 | + nl = orig_nl = get_result_buffer(param, param_size, &len); |
1291 | if (len < needed) { |
1292 | param->flags |= DM_BUFFER_FULL_FLAG; |
1293 | goto out; |
1294 | @@ -549,11 +551,16 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_ |
1295 | strcpy(nl->name, hc->name); |
1296 | |
1297 | old_nl = nl; |
1298 | - event_nr = align_ptr(((void *) (nl + 1)) + strlen(hc->name) + 1); |
1299 | + event_nr = align_ptr(nl->name + strlen(hc->name) + 1); |
1300 | *event_nr = dm_get_event_nr(hc->md); |
1301 | nl = align_ptr(event_nr + 1); |
1302 | } |
1303 | } |
1304 | + /* |
1305 | + * If mismatch happens, security may be compromised due to buffer |
1306 | + * overflow, so it's better to crash. |
1307 | + */ |
1308 | + BUG_ON((char *)nl - (char *)orig_nl != needed); |
1309 | |
1310 | out: |
1311 | up_write(&_hash_lock); |
1312 | @@ -1621,7 +1628,8 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para |
1313 | * which has a variable size, is not used by the function processing |
1314 | * the ioctl. |
1315 | */ |
1316 | -#define IOCTL_FLAGS_NO_PARAMS 1 |
1317 | +#define IOCTL_FLAGS_NO_PARAMS 1 |
1318 | +#define IOCTL_FLAGS_ISSUE_GLOBAL_EVENT 2 |
1319 | |
1320 | /*----------------------------------------------------------------- |
1321 | * Implementation of open/close/ioctl on the special char |
1322 | @@ -1635,12 +1643,12 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) |
1323 | ioctl_fn fn; |
1324 | } _ioctls[] = { |
1325 | {DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */ |
1326 | - {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS, remove_all}, |
1327 | + {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, remove_all}, |
1328 | {DM_LIST_DEVICES_CMD, 0, list_devices}, |
1329 | |
1330 | - {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_create}, |
1331 | - {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_remove}, |
1332 | - {DM_DEV_RENAME_CMD, 0, dev_rename}, |
1333 | + {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_create}, |
1334 | + {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_remove}, |
1335 | + {DM_DEV_RENAME_CMD, IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_rename}, |
1336 | {DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend}, |
1337 | {DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status}, |
1338 | {DM_DEV_WAIT_CMD, 0, dev_wait}, |
1339 | @@ -1869,6 +1877,9 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us |
1340 | unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS)) |
1341 | DMERR("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set", cmd); |
1342 | |
1343 | + if (!r && ioctl_flags & IOCTL_FLAGS_ISSUE_GLOBAL_EVENT) |
1344 | + dm_issue_global_event(); |
1345 | + |
1346 | /* |
1347 | * Copy the results back to userland. |
1348 | */ |
1349 | diff --git a/drivers/md/dm.c b/drivers/md/dm.c |
1350 | index 825eaffc24da..eed539a4eec2 100644 |
1351 | --- a/drivers/md/dm.c |
1352 | +++ b/drivers/md/dm.c |
1353 | @@ -52,6 +52,12 @@ static struct workqueue_struct *deferred_remove_workqueue; |
1354 | atomic_t dm_global_event_nr = ATOMIC_INIT(0); |
1355 | DECLARE_WAIT_QUEUE_HEAD(dm_global_eventq); |
1356 | |
1357 | +void dm_issue_global_event(void) |
1358 | +{ |
1359 | + atomic_inc(&dm_global_event_nr); |
1360 | + wake_up(&dm_global_eventq); |
1361 | +} |
1362 | + |
1363 | /* |
1364 | * One of these is allocated per bio. |
1365 | */ |
1366 | @@ -1865,9 +1871,8 @@ static void event_callback(void *context) |
1367 | dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj); |
1368 | |
1369 | atomic_inc(&md->event_nr); |
1370 | - atomic_inc(&dm_global_event_nr); |
1371 | wake_up(&md->eventq); |
1372 | - wake_up(&dm_global_eventq); |
1373 | + dm_issue_global_event(); |
1374 | } |
1375 | |
1376 | /* |
1377 | @@ -2283,6 +2288,7 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table) |
1378 | } |
1379 | |
1380 | map = __bind(md, table, &limits); |
1381 | + dm_issue_global_event(); |
1382 | |
1383 | out: |
1384 | mutex_unlock(&md->suspend_lock); |
1385 | diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c |
1386 | index 2bae69e39544..b64be0ba1222 100644 |
1387 | --- a/drivers/mmc/core/mmc.c |
1388 | +++ b/drivers/mmc/core/mmc.c |
1389 | @@ -1286,6 +1286,23 @@ int mmc_hs400_to_hs200(struct mmc_card *card) |
1390 | return err; |
1391 | } |
1392 | |
1393 | +static void mmc_select_driver_type(struct mmc_card *card) |
1394 | +{ |
1395 | + int card_drv_type, drive_strength, drv_type; |
1396 | + |
1397 | + card_drv_type = card->ext_csd.raw_driver_strength | |
1398 | + mmc_driver_type_mask(0); |
1399 | + |
1400 | + drive_strength = mmc_select_drive_strength(card, |
1401 | + card->ext_csd.hs200_max_dtr, |
1402 | + card_drv_type, &drv_type); |
1403 | + |
1404 | + card->drive_strength = drive_strength; |
1405 | + |
1406 | + if (drv_type) |
1407 | + mmc_set_driver_type(card->host, drv_type); |
1408 | +} |
1409 | + |
1410 | static int mmc_select_hs400es(struct mmc_card *card) |
1411 | { |
1412 | struct mmc_host *host = card->host; |
1413 | @@ -1341,6 +1358,8 @@ static int mmc_select_hs400es(struct mmc_card *card) |
1414 | goto out_err; |
1415 | } |
1416 | |
1417 | + mmc_select_driver_type(card); |
1418 | + |
1419 | /* Switch card to HS400 */ |
1420 | val = EXT_CSD_TIMING_HS400 | |
1421 | card->drive_strength << EXT_CSD_DRV_STR_SHIFT; |
1422 | @@ -1374,23 +1393,6 @@ static int mmc_select_hs400es(struct mmc_card *card) |
1423 | return err; |
1424 | } |
1425 | |
1426 | -static void mmc_select_driver_type(struct mmc_card *card) |
1427 | -{ |
1428 | - int card_drv_type, drive_strength, drv_type; |
1429 | - |
1430 | - card_drv_type = card->ext_csd.raw_driver_strength | |
1431 | - mmc_driver_type_mask(0); |
1432 | - |
1433 | - drive_strength = mmc_select_drive_strength(card, |
1434 | - card->ext_csd.hs200_max_dtr, |
1435 | - card_drv_type, &drv_type); |
1436 | - |
1437 | - card->drive_strength = drive_strength; |
1438 | - |
1439 | - if (drv_type) |
1440 | - mmc_set_driver_type(card->host, drv_type); |
1441 | -} |
1442 | - |
1443 | /* |
1444 | * For device supporting HS200 mode, the following sequence |
1445 | * should be done before executing the tuning process. |
1446 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c |
1447 | index fc63992ab0e0..c99dc59d729b 100644 |
1448 | --- a/drivers/net/bonding/bond_main.c |
1449 | +++ b/drivers/net/bonding/bond_main.c |
1450 | @@ -4289,7 +4289,7 @@ static int bond_check_params(struct bond_params *params) |
1451 | int bond_mode = BOND_MODE_ROUNDROBIN; |
1452 | int xmit_hashtype = BOND_XMIT_POLICY_LAYER2; |
1453 | int lacp_fast = 0; |
1454 | - int tlb_dynamic_lb = 0; |
1455 | + int tlb_dynamic_lb; |
1456 | |
1457 | /* Convert string parameters. */ |
1458 | if (mode) { |
1459 | @@ -4601,16 +4601,13 @@ static int bond_check_params(struct bond_params *params) |
1460 | } |
1461 | ad_user_port_key = valptr->value; |
1462 | |
1463 | - if ((bond_mode == BOND_MODE_TLB) || (bond_mode == BOND_MODE_ALB)) { |
1464 | - bond_opt_initstr(&newval, "default"); |
1465 | - valptr = bond_opt_parse(bond_opt_get(BOND_OPT_TLB_DYNAMIC_LB), |
1466 | - &newval); |
1467 | - if (!valptr) { |
1468 | - pr_err("Error: No tlb_dynamic_lb default value"); |
1469 | - return -EINVAL; |
1470 | - } |
1471 | - tlb_dynamic_lb = valptr->value; |
1472 | + bond_opt_initstr(&newval, "default"); |
1473 | + valptr = bond_opt_parse(bond_opt_get(BOND_OPT_TLB_DYNAMIC_LB), &newval); |
1474 | + if (!valptr) { |
1475 | + pr_err("Error: No tlb_dynamic_lb default value"); |
1476 | + return -EINVAL; |
1477 | } |
1478 | + tlb_dynamic_lb = valptr->value; |
1479 | |
1480 | if (lp_interval == 0) { |
1481 | pr_warn("Warning: ip_interval must be between 1 and %d, so it was reset to %d\n", |
1482 | diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c |
1483 | index a12d603d41c6..5931aa2fe997 100644 |
1484 | --- a/drivers/net/bonding/bond_options.c |
1485 | +++ b/drivers/net/bonding/bond_options.c |
1486 | @@ -754,6 +754,9 @@ static int bond_option_mode_set(struct bonding *bond, |
1487 | bond->params.miimon); |
1488 | } |
1489 | |
1490 | + if (newval->value == BOND_MODE_ALB) |
1491 | + bond->params.tlb_dynamic_lb = 1; |
1492 | + |
1493 | /* don't cache arp_validate between modes */ |
1494 | bond->params.arp_validate = BOND_ARP_VALIDATE_NONE; |
1495 | bond->params.mode = newval->value; |
1496 | diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c |
1497 | index 5bcdd33101b0..c75271c722a7 100644 |
1498 | --- a/drivers/net/dsa/mv88e6xxx/chip.c |
1499 | +++ b/drivers/net/dsa/mv88e6xxx/chip.c |
1500 | @@ -1184,6 +1184,10 @@ static int mv88e6xxx_port_check_hw_vlan(struct dsa_switch *ds, int port, |
1501 | }; |
1502 | int i, err; |
1503 | |
1504 | + /* DSA and CPU ports have to be members of multiple vlans */ |
1505 | + if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port)) |
1506 | + return 0; |
1507 | + |
1508 | if (!vid_begin) |
1509 | return -EOPNOTSUPP; |
1510 | |
1511 | @@ -4015,7 +4019,9 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev) |
1512 | if (chip->irq > 0) { |
1513 | if (mv88e6xxx_has(chip, MV88E6XXX_FLAG_G2_INT)) |
1514 | mv88e6xxx_g2_irq_free(chip); |
1515 | + mutex_lock(&chip->reg_lock); |
1516 | mv88e6xxx_g1_irq_free(chip); |
1517 | + mutex_unlock(&chip->reg_lock); |
1518 | } |
1519 | } |
1520 | |
1521 | diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c |
1522 | index 91b1a558f37d..248888328232 100644 |
1523 | --- a/drivers/net/ethernet/ibm/emac/mal.c |
1524 | +++ b/drivers/net/ethernet/ibm/emac/mal.c |
1525 | @@ -402,7 +402,7 @@ static int mal_poll(struct napi_struct *napi, int budget) |
1526 | unsigned long flags; |
1527 | |
1528 | MAL_DBG2(mal, "poll(%d)" NL, budget); |
1529 | - again: |
1530 | + |
1531 | /* Process TX skbs */ |
1532 | list_for_each(l, &mal->poll_list) { |
1533 | struct mal_commac *mc = |
1534 | @@ -451,7 +451,6 @@ static int mal_poll(struct napi_struct *napi, int budget) |
1535 | spin_lock_irqsave(&mal->lock, flags); |
1536 | mal_disable_eob_irq(mal); |
1537 | spin_unlock_irqrestore(&mal->lock, flags); |
1538 | - goto again; |
1539 | } |
1540 | mc->ops->poll_tx(mc->dev); |
1541 | } |
1542 | diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c |
1543 | index 85298051a3e4..145e392ab849 100644 |
1544 | --- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c |
1545 | +++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c |
1546 | @@ -572,12 +572,13 @@ void mlx5_rdma_netdev_free(struct net_device *netdev) |
1547 | { |
1548 | struct mlx5e_priv *priv = mlx5i_epriv(netdev); |
1549 | const struct mlx5e_profile *profile = priv->profile; |
1550 | + struct mlx5_core_dev *mdev = priv->mdev; |
1551 | |
1552 | mlx5e_detach_netdev(priv); |
1553 | profile->cleanup(priv); |
1554 | destroy_workqueue(priv->wq); |
1555 | free_netdev(netdev); |
1556 | |
1557 | - mlx5e_destroy_mdev_resources(priv->mdev); |
1558 | + mlx5e_destroy_mdev_resources(mdev); |
1559 | } |
1560 | EXPORT_SYMBOL(mlx5_rdma_netdev_free); |
1561 | diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c |
1562 | index c6a3e61b53bd..73390f90b581 100644 |
1563 | --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c |
1564 | +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c |
1565 | @@ -572,15 +572,14 @@ static void mlxsw_sp_span_entry_destroy(struct mlxsw_sp *mlxsw_sp, |
1566 | } |
1567 | |
1568 | static struct mlxsw_sp_span_entry * |
1569 | -mlxsw_sp_span_entry_find(struct mlxsw_sp_port *port) |
1570 | +mlxsw_sp_span_entry_find(struct mlxsw_sp *mlxsw_sp, u8 local_port) |
1571 | { |
1572 | - struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp; |
1573 | int i; |
1574 | |
1575 | for (i = 0; i < mlxsw_sp->span.entries_count; i++) { |
1576 | struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i]; |
1577 | |
1578 | - if (curr->used && curr->local_port == port->local_port) |
1579 | + if (curr->used && curr->local_port == local_port) |
1580 | return curr; |
1581 | } |
1582 | return NULL; |
1583 | @@ -591,7 +590,8 @@ static struct mlxsw_sp_span_entry |
1584 | { |
1585 | struct mlxsw_sp_span_entry *span_entry; |
1586 | |
1587 | - span_entry = mlxsw_sp_span_entry_find(port); |
1588 | + span_entry = mlxsw_sp_span_entry_find(port->mlxsw_sp, |
1589 | + port->local_port); |
1590 | if (span_entry) { |
1591 | /* Already exists, just take a reference */ |
1592 | span_entry->ref_count++; |
1593 | @@ -780,12 +780,13 @@ static int mlxsw_sp_span_mirror_add(struct mlxsw_sp_port *from, |
1594 | } |
1595 | |
1596 | static void mlxsw_sp_span_mirror_remove(struct mlxsw_sp_port *from, |
1597 | - struct mlxsw_sp_port *to, |
1598 | + u8 destination_port, |
1599 | enum mlxsw_sp_span_type type) |
1600 | { |
1601 | struct mlxsw_sp_span_entry *span_entry; |
1602 | |
1603 | - span_entry = mlxsw_sp_span_entry_find(to); |
1604 | + span_entry = mlxsw_sp_span_entry_find(from->mlxsw_sp, |
1605 | + destination_port); |
1606 | if (!span_entry) { |
1607 | netdev_err(from->dev, "no span entry found\n"); |
1608 | return; |
1609 | @@ -1560,14 +1561,12 @@ static void |
1610 | mlxsw_sp_port_del_cls_matchall_mirror(struct mlxsw_sp_port *mlxsw_sp_port, |
1611 | struct mlxsw_sp_port_mall_mirror_tc_entry *mirror) |
1612 | { |
1613 | - struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; |
1614 | enum mlxsw_sp_span_type span_type; |
1615 | - struct mlxsw_sp_port *to_port; |
1616 | |
1617 | - to_port = mlxsw_sp->ports[mirror->to_local_port]; |
1618 | span_type = mirror->ingress ? |
1619 | MLXSW_SP_SPAN_INGRESS : MLXSW_SP_SPAN_EGRESS; |
1620 | - mlxsw_sp_span_mirror_remove(mlxsw_sp_port, to_port, span_type); |
1621 | + mlxsw_sp_span_mirror_remove(mlxsw_sp_port, mirror->to_local_port, |
1622 | + span_type); |
1623 | } |
1624 | |
1625 | static int |
1626 | @@ -2519,7 +2518,9 @@ static int mlxsw_sp_flash_device(struct net_device *dev, |
1627 | return err; |
1628 | } |
1629 | |
1630 | -#define MLXSW_SP_QSFP_I2C_ADDR 0x50 |
1631 | +#define MLXSW_SP_I2C_ADDR_LOW 0x50 |
1632 | +#define MLXSW_SP_I2C_ADDR_HIGH 0x51 |
1633 | +#define MLXSW_SP_EEPROM_PAGE_LENGTH 256 |
1634 | |
1635 | static int mlxsw_sp_query_module_eeprom(struct mlxsw_sp_port *mlxsw_sp_port, |
1636 | u16 offset, u16 size, void *data, |
1637 | @@ -2528,12 +2529,25 @@ static int mlxsw_sp_query_module_eeprom(struct mlxsw_sp_port *mlxsw_sp_port, |
1638 | struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; |
1639 | char eeprom_tmp[MLXSW_SP_REG_MCIA_EEPROM_SIZE]; |
1640 | char mcia_pl[MLXSW_REG_MCIA_LEN]; |
1641 | + u16 i2c_addr; |
1642 | int status; |
1643 | int err; |
1644 | |
1645 | size = min_t(u16, size, MLXSW_SP_REG_MCIA_EEPROM_SIZE); |
1646 | + |
1647 | + if (offset < MLXSW_SP_EEPROM_PAGE_LENGTH && |
1648 | + offset + size > MLXSW_SP_EEPROM_PAGE_LENGTH) |
1649 | + /* Cross pages read, read until offset 256 in low page */ |
1650 | + size = MLXSW_SP_EEPROM_PAGE_LENGTH - offset; |
1651 | + |
1652 | + i2c_addr = MLXSW_SP_I2C_ADDR_LOW; |
1653 | + if (offset >= MLXSW_SP_EEPROM_PAGE_LENGTH) { |
1654 | + i2c_addr = MLXSW_SP_I2C_ADDR_HIGH; |
1655 | + offset -= MLXSW_SP_EEPROM_PAGE_LENGTH; |
1656 | + } |
1657 | + |
1658 | mlxsw_reg_mcia_pack(mcia_pl, mlxsw_sp_port->mapping.module, |
1659 | - 0, 0, offset, size, MLXSW_SP_QSFP_I2C_ADDR); |
1660 | + 0, 0, offset, size, i2c_addr); |
1661 | |
1662 | err = mlxsw_reg_query(mlxsw_sp->core, MLXSW_REG(mcia), mcia_pl); |
1663 | if (err) |
1664 | diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c |
1665 | index bcd4708b3745..97f18cdc9516 100644 |
1666 | --- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c |
1667 | +++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c |
1668 | @@ -876,7 +876,8 @@ static void emac_mac_rx_descs_refill(struct emac_adapter *adpt, |
1669 | |
1670 | curr_rxbuf->dma_addr = |
1671 | dma_map_single(adpt->netdev->dev.parent, skb->data, |
1672 | - curr_rxbuf->length, DMA_FROM_DEVICE); |
1673 | + adpt->rxbuf_size, DMA_FROM_DEVICE); |
1674 | + |
1675 | ret = dma_mapping_error(adpt->netdev->dev.parent, |
1676 | curr_rxbuf->dma_addr); |
1677 | if (ret) { |
1678 | diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c |
1679 | index ca22f2898664..d24b47b8e0b2 100644 |
1680 | --- a/drivers/net/ethernet/realtek/8139too.c |
1681 | +++ b/drivers/net/ethernet/realtek/8139too.c |
1682 | @@ -2135,11 +2135,12 @@ static int rtl8139_poll(struct napi_struct *napi, int budget) |
1683 | if (likely(RTL_R16(IntrStatus) & RxAckBits)) |
1684 | work_done += rtl8139_rx(dev, tp, budget); |
1685 | |
1686 | - if (work_done < budget && napi_complete_done(napi, work_done)) { |
1687 | + if (work_done < budget) { |
1688 | unsigned long flags; |
1689 | |
1690 | spin_lock_irqsave(&tp->lock, flags); |
1691 | - RTL_W16_F(IntrMask, rtl8139_intr_mask); |
1692 | + if (napi_complete_done(napi, work_done)) |
1693 | + RTL_W16_F(IntrMask, rtl8139_intr_mask); |
1694 | spin_unlock_irqrestore(&tp->lock, flags); |
1695 | } |
1696 | spin_unlock(&tp->rx_lock); |
1697 | diff --git a/drivers/net/ethernet/rocker/rocker_tlv.h b/drivers/net/ethernet/rocker/rocker_tlv.h |
1698 | index a63ef82e7c72..dfae3c9d57c6 100644 |
1699 | --- a/drivers/net/ethernet/rocker/rocker_tlv.h |
1700 | +++ b/drivers/net/ethernet/rocker/rocker_tlv.h |
1701 | @@ -139,40 +139,52 @@ rocker_tlv_start(struct rocker_desc_info *desc_info) |
1702 | int rocker_tlv_put(struct rocker_desc_info *desc_info, |
1703 | int attrtype, int attrlen, const void *data); |
1704 | |
1705 | -static inline int rocker_tlv_put_u8(struct rocker_desc_info *desc_info, |
1706 | - int attrtype, u8 value) |
1707 | +static inline int |
1708 | +rocker_tlv_put_u8(struct rocker_desc_info *desc_info, int attrtype, u8 value) |
1709 | { |
1710 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &value); |
1711 | + u8 tmp = value; /* work around GCC PR81715 */ |
1712 | + |
1713 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &tmp); |
1714 | } |
1715 | |
1716 | -static inline int rocker_tlv_put_u16(struct rocker_desc_info *desc_info, |
1717 | - int attrtype, u16 value) |
1718 | +static inline int |
1719 | +rocker_tlv_put_u16(struct rocker_desc_info *desc_info, int attrtype, u16 value) |
1720 | { |
1721 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &value); |
1722 | + u16 tmp = value; |
1723 | + |
1724 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &tmp); |
1725 | } |
1726 | |
1727 | -static inline int rocker_tlv_put_be16(struct rocker_desc_info *desc_info, |
1728 | - int attrtype, __be16 value) |
1729 | +static inline int |
1730 | +rocker_tlv_put_be16(struct rocker_desc_info *desc_info, int attrtype, __be16 value) |
1731 | { |
1732 | - return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &value); |
1733 | + __be16 tmp = value; |
1734 | + |
1735 | + return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &tmp); |
1736 | } |
1737 | |
1738 | -static inline int rocker_tlv_put_u32(struct rocker_desc_info *desc_info, |
1739 | - int attrtype, u32 value) |
1740 | +static inline int |
1741 | +rocker_tlv_put_u32(struct rocker_desc_info *desc_info, int attrtype, u32 value) |
1742 | { |
1743 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &value); |
1744 | + u32 tmp = value; |
1745 | + |
1746 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &tmp); |
1747 | } |
1748 | |
1749 | -static inline int rocker_tlv_put_be32(struct rocker_desc_info *desc_info, |
1750 | - int attrtype, __be32 value) |
1751 | +static inline int |
1752 | +rocker_tlv_put_be32(struct rocker_desc_info *desc_info, int attrtype, __be32 value) |
1753 | { |
1754 | - return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &value); |
1755 | + __be32 tmp = value; |
1756 | + |
1757 | + return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &tmp); |
1758 | } |
1759 | |
1760 | -static inline int rocker_tlv_put_u64(struct rocker_desc_info *desc_info, |
1761 | - int attrtype, u64 value) |
1762 | +static inline int |
1763 | +rocker_tlv_put_u64(struct rocker_desc_info *desc_info, int attrtype, u64 value) |
1764 | { |
1765 | - return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &value); |
1766 | + u64 tmp = value; |
1767 | + |
1768 | + return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &tmp); |
1769 | } |
1770 | |
1771 | static inline struct rocker_tlv * |
1772 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c |
1773 | index a366b3747eeb..8a280b48e3a9 100644 |
1774 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c |
1775 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c |
1776 | @@ -315,6 +315,7 @@ static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, |
1777 | { .compatible = "allwinner,sun8i-h3-emac" }, |
1778 | { .compatible = "allwinner,sun8i-v3s-emac" }, |
1779 | { .compatible = "allwinner,sun50i-a64-emac" }, |
1780 | + {}, |
1781 | }; |
1782 | |
1783 | /* If phy-handle property is passed from DT, use it as the PHY */ |
1784 | diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c |
1785 | index d15dd3938ba8..2e5150b0b8d5 100644 |
1786 | --- a/drivers/net/phy/xilinx_gmii2rgmii.c |
1787 | +++ b/drivers/net/phy/xilinx_gmii2rgmii.c |
1788 | @@ -44,7 +44,7 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev) |
1789 | priv->phy_drv->read_status(phydev); |
1790 | |
1791 | val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG); |
1792 | - val &= XILINX_GMII2RGMII_SPEED_MASK; |
1793 | + val &= ~XILINX_GMII2RGMII_SPEED_MASK; |
1794 | |
1795 | if (phydev->speed == SPEED_1000) |
1796 | val |= BMCR_SPEED1000; |
1797 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c |
1798 | index 0a2c0a42283f..cb1f7747adad 100644 |
1799 | --- a/drivers/net/tun.c |
1800 | +++ b/drivers/net/tun.c |
1801 | @@ -1298,11 +1298,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, |
1802 | switch (tun->flags & TUN_TYPE_MASK) { |
1803 | case IFF_TUN: |
1804 | if (tun->flags & IFF_NO_PI) { |
1805 | - switch (skb->data[0] & 0xf0) { |
1806 | - case 0x40: |
1807 | + u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0; |
1808 | + |
1809 | + switch (ip_version) { |
1810 | + case 4: |
1811 | pi.proto = htons(ETH_P_IP); |
1812 | break; |
1813 | - case 0x60: |
1814 | + case 6: |
1815 | pi.proto = htons(ETH_P_IPV6); |
1816 | break; |
1817 | default: |
1818 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c |
1819 | index 7e689c86d565..f27d6fe4d5c0 100644 |
1820 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c |
1821 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c |
1822 | @@ -980,7 +980,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, |
1823 | |
1824 | eth_broadcast_addr(params_le->bssid); |
1825 | params_le->bss_type = DOT11_BSSTYPE_ANY; |
1826 | - params_le->scan_type = 0; |
1827 | + params_le->scan_type = BRCMF_SCANTYPE_ACTIVE; |
1828 | params_le->channel_num = 0; |
1829 | params_le->nprobes = cpu_to_le32(-1); |
1830 | params_le->active_time = cpu_to_le32(-1); |
1831 | @@ -988,12 +988,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, |
1832 | params_le->home_time = cpu_to_le32(-1); |
1833 | memset(¶ms_le->ssid_le, 0, sizeof(params_le->ssid_le)); |
1834 | |
1835 | - /* if request is null exit so it will be all channel broadcast scan */ |
1836 | - if (!request) |
1837 | - return; |
1838 | - |
1839 | n_ssids = request->n_ssids; |
1840 | n_channels = request->n_channels; |
1841 | + |
1842 | /* Copy channel array if applicable */ |
1843 | brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n", |
1844 | n_channels); |
1845 | @@ -1030,16 +1027,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, |
1846 | ptr += sizeof(ssid_le); |
1847 | } |
1848 | } else { |
1849 | - brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids); |
1850 | - if ((request->ssids) && request->ssids->ssid_len) { |
1851 | - brcmf_dbg(SCAN, "SSID %s len=%d\n", |
1852 | - params_le->ssid_le.SSID, |
1853 | - request->ssids->ssid_len); |
1854 | - params_le->ssid_le.SSID_len = |
1855 | - cpu_to_le32(request->ssids->ssid_len); |
1856 | - memcpy(¶ms_le->ssid_le.SSID, request->ssids->ssid, |
1857 | - request->ssids->ssid_len); |
1858 | - } |
1859 | + brcmf_dbg(SCAN, "Performing passive scan\n"); |
1860 | + params_le->scan_type = BRCMF_SCANTYPE_PASSIVE; |
1861 | } |
1862 | /* Adding mask to channel numbers */ |
1863 | params_le->channel_num = |
1864 | @@ -3162,6 +3151,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, |
1865 | struct brcmf_cfg80211_info *cfg = ifp->drvr->config; |
1866 | s32 status; |
1867 | struct brcmf_escan_result_le *escan_result_le; |
1868 | + u32 escan_buflen; |
1869 | struct brcmf_bss_info_le *bss_info_le; |
1870 | struct brcmf_bss_info_le *bss = NULL; |
1871 | u32 bi_length; |
1872 | @@ -3181,11 +3171,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, |
1873 | |
1874 | if (status == BRCMF_E_STATUS_PARTIAL) { |
1875 | brcmf_dbg(SCAN, "ESCAN Partial result\n"); |
1876 | + if (e->datalen < sizeof(*escan_result_le)) { |
1877 | + brcmf_err("invalid event data length\n"); |
1878 | + goto exit; |
1879 | + } |
1880 | escan_result_le = (struct brcmf_escan_result_le *) data; |
1881 | if (!escan_result_le) { |
1882 | brcmf_err("Invalid escan result (NULL pointer)\n"); |
1883 | goto exit; |
1884 | } |
1885 | + escan_buflen = le32_to_cpu(escan_result_le->buflen); |
1886 | + if (escan_buflen > BRCMF_ESCAN_BUF_SIZE || |
1887 | + escan_buflen > e->datalen || |
1888 | + escan_buflen < sizeof(*escan_result_le)) { |
1889 | + brcmf_err("Invalid escan buffer length: %d\n", |
1890 | + escan_buflen); |
1891 | + goto exit; |
1892 | + } |
1893 | if (le16_to_cpu(escan_result_le->bss_count) != 1) { |
1894 | brcmf_err("Invalid bss_count %d: ignoring\n", |
1895 | escan_result_le->bss_count); |
1896 | @@ -3202,9 +3204,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, |
1897 | } |
1898 | |
1899 | bi_length = le32_to_cpu(bss_info_le->length); |
1900 | - if (bi_length != (le32_to_cpu(escan_result_le->buflen) - |
1901 | - WL_ESCAN_RESULTS_FIXED_SIZE)) { |
1902 | - brcmf_err("Invalid bss_info length %d: ignoring\n", |
1903 | + if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) { |
1904 | + brcmf_err("Ignoring invalid bss_info length: %d\n", |
1905 | bi_length); |
1906 | goto exit; |
1907 | } |
1908 | diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h |
1909 | index 8391989b1882..e0d22fedb2b4 100644 |
1910 | --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h |
1911 | +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h |
1912 | @@ -45,6 +45,11 @@ |
1913 | #define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff |
1914 | #define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16 |
1915 | |
1916 | +/* scan type definitions */ |
1917 | +#define BRCMF_SCANTYPE_DEFAULT 0xFF |
1918 | +#define BRCMF_SCANTYPE_ACTIVE 0 |
1919 | +#define BRCMF_SCANTYPE_PASSIVE 1 |
1920 | + |
1921 | #define BRCMF_WSEC_MAX_PSK_LEN 32 |
1922 | #define BRCMF_WSEC_PASSPHRASE BIT(0) |
1923 | |
1924 | diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
1925 | index ce901be5fba8..f0132c492a79 100644 |
1926 | --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
1927 | +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |
1928 | @@ -1589,6 +1589,11 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac, |
1929 | struct iwl_mvm_mc_iter_data *data = _data; |
1930 | struct iwl_mvm *mvm = data->mvm; |
1931 | struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd; |
1932 | + struct iwl_host_cmd hcmd = { |
1933 | + .id = MCAST_FILTER_CMD, |
1934 | + .flags = CMD_ASYNC, |
1935 | + .dataflags[0] = IWL_HCMD_DFL_NOCOPY, |
1936 | + }; |
1937 | int ret, len; |
1938 | |
1939 | /* if we don't have free ports, mcast frames will be dropped */ |
1940 | @@ -1603,7 +1608,10 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac, |
1941 | memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN); |
1942 | len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4); |
1943 | |
1944 | - ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd); |
1945 | + hcmd.len[0] = len; |
1946 | + hcmd.data[0] = cmd; |
1947 | + |
1948 | + ret = iwl_mvm_send_cmd(mvm, &hcmd); |
1949 | if (ret) |
1950 | IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret); |
1951 | } |
1952 | diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c |
1953 | index cdf4c0e471b9..ba41b660b259 100644 |
1954 | --- a/drivers/nvme/host/pci.c |
1955 | +++ b/drivers/nvme/host/pci.c |
1956 | @@ -93,7 +93,7 @@ struct nvme_dev { |
1957 | struct mutex shutdown_lock; |
1958 | bool subsystem; |
1959 | void __iomem *cmb; |
1960 | - dma_addr_t cmb_dma_addr; |
1961 | + pci_bus_addr_t cmb_bus_addr; |
1962 | u64 cmb_size; |
1963 | u32 cmbsz; |
1964 | u32 cmbloc; |
1965 | @@ -1218,7 +1218,7 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq, |
1966 | if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) { |
1967 | unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth), |
1968 | dev->ctrl.page_size); |
1969 | - nvmeq->sq_dma_addr = dev->cmb_dma_addr + offset; |
1970 | + nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset; |
1971 | nvmeq->sq_cmds_io = dev->cmb + offset; |
1972 | } else { |
1973 | nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth), |
1974 | @@ -1517,7 +1517,7 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) |
1975 | resource_size_t bar_size; |
1976 | struct pci_dev *pdev = to_pci_dev(dev->dev); |
1977 | void __iomem *cmb; |
1978 | - dma_addr_t dma_addr; |
1979 | + int bar; |
1980 | |
1981 | dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ); |
1982 | if (!(NVME_CMB_SZ(dev->cmbsz))) |
1983 | @@ -1530,7 +1530,8 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) |
1984 | szu = (u64)1 << (12 + 4 * NVME_CMB_SZU(dev->cmbsz)); |
1985 | size = szu * NVME_CMB_SZ(dev->cmbsz); |
1986 | offset = szu * NVME_CMB_OFST(dev->cmbloc); |
1987 | - bar_size = pci_resource_len(pdev, NVME_CMB_BIR(dev->cmbloc)); |
1988 | + bar = NVME_CMB_BIR(dev->cmbloc); |
1989 | + bar_size = pci_resource_len(pdev, bar); |
1990 | |
1991 | if (offset > bar_size) |
1992 | return NULL; |
1993 | @@ -1543,12 +1544,11 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev) |
1994 | if (size > bar_size - offset) |
1995 | size = bar_size - offset; |
1996 | |
1997 | - dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(dev->cmbloc)) + offset; |
1998 | - cmb = ioremap_wc(dma_addr, size); |
1999 | + cmb = ioremap_wc(pci_resource_start(pdev, bar) + offset, size); |
2000 | if (!cmb) |
2001 | return NULL; |
2002 | |
2003 | - dev->cmb_dma_addr = dma_addr; |
2004 | + dev->cmb_bus_addr = pci_bus_address(pdev, bar) + offset; |
2005 | dev->cmb_size = size; |
2006 | return cmb; |
2007 | } |
2008 | diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c |
2009 | index fd88dabd599d..9f1d53e18956 100644 |
2010 | --- a/drivers/scsi/scsi_scan.c |
2011 | +++ b/drivers/scsi/scsi_scan.c |
2012 | @@ -956,6 +956,9 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result, |
2013 | if (*bflags & BLIST_NO_DIF) |
2014 | sdev->no_dif = 1; |
2015 | |
2016 | + if (*bflags & BLIST_UNMAP_LIMIT_WS) |
2017 | + sdev->unmap_limit_for_ws = 1; |
2018 | + |
2019 | sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT; |
2020 | |
2021 | if (*bflags & BLIST_TRY_VPD_PAGES) |
2022 | diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c |
2023 | index e2647f2d4430..b93d92572c01 100644 |
2024 | --- a/drivers/scsi/sd.c |
2025 | +++ b/drivers/scsi/sd.c |
2026 | @@ -715,13 +715,21 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode) |
2027 | break; |
2028 | |
2029 | case SD_LBP_WS16: |
2030 | - max_blocks = min_not_zero(sdkp->max_ws_blocks, |
2031 | - (u32)SD_MAX_WS16_BLOCKS); |
2032 | + if (sdkp->device->unmap_limit_for_ws) |
2033 | + max_blocks = sdkp->max_unmap_blocks; |
2034 | + else |
2035 | + max_blocks = sdkp->max_ws_blocks; |
2036 | + |
2037 | + max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS16_BLOCKS); |
2038 | break; |
2039 | |
2040 | case SD_LBP_WS10: |
2041 | - max_blocks = min_not_zero(sdkp->max_ws_blocks, |
2042 | - (u32)SD_MAX_WS10_BLOCKS); |
2043 | + if (sdkp->device->unmap_limit_for_ws) |
2044 | + max_blocks = sdkp->max_unmap_blocks; |
2045 | + else |
2046 | + max_blocks = sdkp->max_ws_blocks; |
2047 | + |
2048 | + max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS10_BLOCKS); |
2049 | break; |
2050 | |
2051 | case SD_LBP_ZERO: |
2052 | @@ -3101,8 +3109,6 @@ static int sd_revalidate_disk(struct gendisk *disk) |
2053 | sd_read_security(sdkp, buffer); |
2054 | } |
2055 | |
2056 | - sdkp->first_scan = 0; |
2057 | - |
2058 | /* |
2059 | * We now have all cache related info, determine how we deal |
2060 | * with flush requests. |
2061 | @@ -3117,7 +3123,7 @@ static int sd_revalidate_disk(struct gendisk *disk) |
2062 | q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max); |
2063 | |
2064 | /* |
2065 | - * Use the device's preferred I/O size for reads and writes |
2066 | + * Determine the device's preferred I/O size for reads and writes |
2067 | * unless the reported value is unreasonably small, large, or |
2068 | * garbage. |
2069 | */ |
2070 | @@ -3131,8 +3137,19 @@ static int sd_revalidate_disk(struct gendisk *disk) |
2071 | rw_max = min_not_zero(logical_to_sectors(sdp, dev_max), |
2072 | (sector_t)BLK_DEF_MAX_SECTORS); |
2073 | |
2074 | - /* Combine with controller limits */ |
2075 | - q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); |
2076 | + /* Do not exceed controller limit */ |
2077 | + rw_max = min(rw_max, queue_max_hw_sectors(q)); |
2078 | + |
2079 | + /* |
2080 | + * Only update max_sectors if previously unset or if the current value |
2081 | + * exceeds the capabilities of the hardware. |
2082 | + */ |
2083 | + if (sdkp->first_scan || |
2084 | + q->limits.max_sectors > q->limits.max_dev_sectors || |
2085 | + q->limits.max_sectors > q->limits.max_hw_sectors) |
2086 | + q->limits.max_sectors = rw_max; |
2087 | + |
2088 | + sdkp->first_scan = 0; |
2089 | |
2090 | set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); |
2091 | sd_config_write_same(sdkp); |
2092 | diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c |
2093 | index d11c6de9c777..6150d2780e22 100644 |
2094 | --- a/drivers/staging/iio/adc/ad7192.c |
2095 | +++ b/drivers/staging/iio/adc/ad7192.c |
2096 | @@ -223,11 +223,9 @@ static int ad7192_setup(struct ad7192_state *st, |
2097 | struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi); |
2098 | unsigned long long scale_uv; |
2099 | int i, ret, id; |
2100 | - u8 ones[6]; |
2101 | |
2102 | /* reset the serial interface */ |
2103 | - memset(&ones, 0xFF, 6); |
2104 | - ret = spi_write(st->sd.spi, &ones, 6); |
2105 | + ret = ad_sd_reset(&st->sd, 48); |
2106 | if (ret < 0) |
2107 | goto out; |
2108 | usleep_range(500, 1000); /* Wait for at least 500us */ |
2109 | diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c |
2110 | index b026fe66467c..90e7e702a411 100644 |
2111 | --- a/drivers/staging/media/imx/imx-media-of.c |
2112 | +++ b/drivers/staging/media/imx/imx-media-of.c |
2113 | @@ -167,7 +167,7 @@ of_parse_subdev(struct imx_media_dev *imxmd, struct device_node *sd_np, |
2114 | of_parse_sensor(imxmd, imxsd, sd_np); |
2115 | |
2116 | for (i = 0; i < num_pads; i++) { |
2117 | - struct device_node *epnode = NULL, *port, *remote_np; |
2118 | + struct device_node *epnode = NULL, *port, *remote_np = NULL; |
2119 | struct imx_media_subdev *remote_imxsd; |
2120 | struct imx_media_pad *pad; |
2121 | int remote_pad; |
2122 | diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c |
2123 | index 0159ca4407d8..be08849175ea 100644 |
2124 | --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c |
2125 | +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c |
2126 | @@ -612,18 +612,20 @@ free_pagelist(struct vchiq_pagelist_info *pagelistinfo, |
2127 | if (head_bytes > actual) |
2128 | head_bytes = actual; |
2129 | |
2130 | - memcpy((char *)page_address(pages[0]) + |
2131 | + memcpy((char *)kmap(pages[0]) + |
2132 | pagelist->offset, |
2133 | fragments, |
2134 | head_bytes); |
2135 | + kunmap(pages[0]); |
2136 | } |
2137 | if ((actual >= 0) && (head_bytes < actual) && |
2138 | (tail_bytes != 0)) { |
2139 | - memcpy((char *)page_address(pages[num_pages - 1]) + |
2140 | + memcpy((char *)kmap(pages[num_pages - 1]) + |
2141 | ((pagelist->offset + actual) & |
2142 | (PAGE_SIZE - 1) & ~(g_cache_line_size - 1)), |
2143 | fragments + g_cache_line_size, |
2144 | tail_bytes); |
2145 | + kunmap(pages[num_pages - 1]); |
2146 | } |
2147 | |
2148 | down(&g_free_fragments_mutex); |
2149 | diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c |
2150 | index 8f972247b1c1..6499391695b7 100644 |
2151 | --- a/drivers/usb/class/cdc-wdm.c |
2152 | +++ b/drivers/usb/class/cdc-wdm.c |
2153 | @@ -194,8 +194,10 @@ static void wdm_in_callback(struct urb *urb) |
2154 | /* |
2155 | * only set a new error if there is no previous error. |
2156 | * Errors are only cleared during read/open |
2157 | + * Avoid propagating -EPIPE (stall) to userspace since it is |
2158 | + * better handled as an empty read |
2159 | */ |
2160 | - if (desc->rerr == 0) |
2161 | + if (desc->rerr == 0 && status != -EPIPE) |
2162 | desc->rerr = status; |
2163 | |
2164 | if (length + desc->length > desc->wMaxCommand) { |
2165 | diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c |
2166 | index 4be52c602e9b..68b54bd88d1e 100644 |
2167 | --- a/drivers/usb/core/config.c |
2168 | +++ b/drivers/usb/core/config.c |
2169 | @@ -643,15 +643,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, |
2170 | |
2171 | } else if (header->bDescriptorType == |
2172 | USB_DT_INTERFACE_ASSOCIATION) { |
2173 | + struct usb_interface_assoc_descriptor *d; |
2174 | + |
2175 | + d = (struct usb_interface_assoc_descriptor *)header; |
2176 | + if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) { |
2177 | + dev_warn(ddev, |
2178 | + "config %d has an invalid interface association descriptor of length %d, skipping\n", |
2179 | + cfgno, d->bLength); |
2180 | + continue; |
2181 | + } |
2182 | + |
2183 | if (iad_num == USB_MAXIADS) { |
2184 | dev_warn(ddev, "found more Interface " |
2185 | "Association Descriptors " |
2186 | "than allocated for in " |
2187 | "configuration %d\n", cfgno); |
2188 | } else { |
2189 | - config->intf_assoc[iad_num] = |
2190 | - (struct usb_interface_assoc_descriptor |
2191 | - *)header; |
2192 | + config->intf_assoc[iad_num] = d; |
2193 | iad_num++; |
2194 | } |
2195 | |
2196 | @@ -852,7 +860,7 @@ int usb_get_configuration(struct usb_device *dev) |
2197 | } |
2198 | |
2199 | if (dev->quirks & USB_QUIRK_DELAY_INIT) |
2200 | - msleep(100); |
2201 | + msleep(200); |
2202 | |
2203 | result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, |
2204 | bigbuffer, length); |
2205 | diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c |
2206 | index 0ff0feddfd1f..1d4dfdeb61c1 100644 |
2207 | --- a/drivers/usb/core/devio.c |
2208 | +++ b/drivers/usb/core/devio.c |
2209 | @@ -140,6 +140,9 @@ module_param(usbfs_memory_mb, uint, 0644); |
2210 | MODULE_PARM_DESC(usbfs_memory_mb, |
2211 | "maximum MB allowed for usbfs buffers (0 = no limit)"); |
2212 | |
2213 | +/* Hard limit, necessary to avoid arithmetic overflow */ |
2214 | +#define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000) |
2215 | + |
2216 | static atomic64_t usbfs_memory_usage; /* Total memory currently allocated */ |
2217 | |
2218 | /* Check whether it's okay to allocate more memory for a transfer */ |
2219 | @@ -1460,6 +1463,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb |
2220 | USBDEVFS_URB_ZERO_PACKET | |
2221 | USBDEVFS_URB_NO_INTERRUPT)) |
2222 | return -EINVAL; |
2223 | + if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX) |
2224 | + return -EINVAL; |
2225 | if (uurb->buffer_length > 0 && !uurb->buffer) |
2226 | return -EINVAL; |
2227 | if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL && |
2228 | @@ -1571,7 +1576,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb |
2229 | totlen += isopkt[u].length; |
2230 | } |
2231 | u *= sizeof(struct usb_iso_packet_descriptor); |
2232 | - uurb->buffer_length = totlen; |
2233 | + if (totlen <= uurb->buffer_length) |
2234 | + uurb->buffer_length = totlen; |
2235 | + else |
2236 | + WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d", |
2237 | + totlen, uurb->buffer_length); |
2238 | break; |
2239 | |
2240 | default: |
2241 | diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c |
2242 | index 822f8c50e423..78c2aca5b0fc 100644 |
2243 | --- a/drivers/usb/core/hub.c |
2244 | +++ b/drivers/usb/core/hub.c |
2245 | @@ -4825,7 +4825,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, |
2246 | goto loop; |
2247 | |
2248 | if (udev->quirks & USB_QUIRK_DELAY_INIT) |
2249 | - msleep(1000); |
2250 | + msleep(2000); |
2251 | |
2252 | /* consecutive bus-powered hubs aren't reliable; they can |
2253 | * violate the voltage drop budget. if the new child has |
2254 | diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c |
2255 | index 4c38ea41ae96..371a07d874a3 100644 |
2256 | --- a/drivers/usb/core/message.c |
2257 | +++ b/drivers/usb/core/message.c |
2258 | @@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, |
2259 | elength = 1; |
2260 | goto next_desc; |
2261 | } |
2262 | + if ((buflen < elength) || (elength < 3)) { |
2263 | + dev_err(&intf->dev, "invalid descriptor buffer length\n"); |
2264 | + break; |
2265 | + } |
2266 | if (buffer[1] != USB_DT_CS_INTERFACE) { |
2267 | dev_err(&intf->dev, "skipping garbage\n"); |
2268 | goto next_desc; |
2269 | diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c |
2270 | index 827e376bfa97..75e6cb044eb2 100644 |
2271 | --- a/drivers/usb/dwc3/ep0.c |
2272 | +++ b/drivers/usb/dwc3/ep0.c |
2273 | @@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, |
2274 | DWC3_TRBCTL_CONTROL_DATA, |
2275 | true); |
2276 | |
2277 | + req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1]; |
2278 | + |
2279 | /* Now prepare one extra TRB to align transfer size */ |
2280 | dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr, |
2281 | maxpacket - rem, |
2282 | @@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, |
2283 | DWC3_TRBCTL_CONTROL_DATA, |
2284 | true); |
2285 | |
2286 | + req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1]; |
2287 | + |
2288 | /* Now prepare one extra TRB to align transfer size */ |
2289 | dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr, |
2290 | 0, DWC3_TRBCTL_CONTROL_DATA, |
2291 | @@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, |
2292 | dwc3_ep0_prepare_one_trb(dep, req->request.dma, |
2293 | req->request.length, DWC3_TRBCTL_CONTROL_DATA, |
2294 | false); |
2295 | + |
2296 | + req->trb = &dwc->ep0_trb[dep->trb_enqueue]; |
2297 | + |
2298 | ret = dwc3_ep0_start_trans(dep); |
2299 | } |
2300 | |
2301 | diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c |
2302 | index f95bddd6513f..daf3a07e3ffb 100644 |
2303 | --- a/drivers/usb/gadget/function/f_mass_storage.c |
2304 | +++ b/drivers/usb/gadget/function/f_mass_storage.c |
2305 | @@ -307,8 +307,6 @@ struct fsg_common { |
2306 | struct completion thread_notifier; |
2307 | struct task_struct *thread_task; |
2308 | |
2309 | - /* Callback functions. */ |
2310 | - const struct fsg_operations *ops; |
2311 | /* Gadget's private data. */ |
2312 | void *private_data; |
2313 | |
2314 | @@ -2440,6 +2438,7 @@ static void handle_exception(struct fsg_common *common) |
2315 | static int fsg_main_thread(void *common_) |
2316 | { |
2317 | struct fsg_common *common = common_; |
2318 | + int i; |
2319 | |
2320 | /* |
2321 | * Allow the thread to be killed by a signal, but set the signal mask |
2322 | @@ -2485,21 +2484,16 @@ static int fsg_main_thread(void *common_) |
2323 | common->thread_task = NULL; |
2324 | spin_unlock_irq(&common->lock); |
2325 | |
2326 | - if (!common->ops || !common->ops->thread_exits |
2327 | - || common->ops->thread_exits(common) < 0) { |
2328 | - int i; |
2329 | + /* Eject media from all LUNs */ |
2330 | |
2331 | - down_write(&common->filesem); |
2332 | - for (i = 0; i < ARRAY_SIZE(common->luns); i++) { |
2333 | - struct fsg_lun *curlun = common->luns[i]; |
2334 | - if (!curlun || !fsg_lun_is_open(curlun)) |
2335 | - continue; |
2336 | + down_write(&common->filesem); |
2337 | + for (i = 0; i < ARRAY_SIZE(common->luns); i++) { |
2338 | + struct fsg_lun *curlun = common->luns[i]; |
2339 | |
2340 | + if (curlun && fsg_lun_is_open(curlun)) |
2341 | fsg_lun_close(curlun); |
2342 | - curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT; |
2343 | - } |
2344 | - up_write(&common->filesem); |
2345 | } |
2346 | + up_write(&common->filesem); |
2347 | |
2348 | /* Let fsg_unbind() know the thread has exited */ |
2349 | complete_and_exit(&common->thread_notifier, 0); |
2350 | @@ -2690,13 +2684,6 @@ void fsg_common_remove_luns(struct fsg_common *common) |
2351 | } |
2352 | EXPORT_SYMBOL_GPL(fsg_common_remove_luns); |
2353 | |
2354 | -void fsg_common_set_ops(struct fsg_common *common, |
2355 | - const struct fsg_operations *ops) |
2356 | -{ |
2357 | - common->ops = ops; |
2358 | -} |
2359 | -EXPORT_SYMBOL_GPL(fsg_common_set_ops); |
2360 | - |
2361 | void fsg_common_free_buffers(struct fsg_common *common) |
2362 | { |
2363 | _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers); |
2364 | diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h |
2365 | index d3902313b8ac..dc05ca0c4359 100644 |
2366 | --- a/drivers/usb/gadget/function/f_mass_storage.h |
2367 | +++ b/drivers/usb/gadget/function/f_mass_storage.h |
2368 | @@ -60,17 +60,6 @@ struct fsg_module_parameters { |
2369 | struct fsg_common; |
2370 | |
2371 | /* FSF callback functions */ |
2372 | -struct fsg_operations { |
2373 | - /* |
2374 | - * Callback function to call when thread exits. If no |
2375 | - * callback is set or it returns value lower then zero MSF |
2376 | - * will force eject all LUNs it operates on (including those |
2377 | - * marked as non-removable or with prevent_medium_removal flag |
2378 | - * set). |
2379 | - */ |
2380 | - int (*thread_exits)(struct fsg_common *common); |
2381 | -}; |
2382 | - |
2383 | struct fsg_lun_opts { |
2384 | struct config_group group; |
2385 | struct fsg_lun *lun; |
2386 | @@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun); |
2387 | |
2388 | void fsg_common_remove_luns(struct fsg_common *common); |
2389 | |
2390 | -void fsg_common_set_ops(struct fsg_common *common, |
2391 | - const struct fsg_operations *ops); |
2392 | - |
2393 | int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg, |
2394 | unsigned int id, const char *name, |
2395 | const char **name_pfx); |
2396 | diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c |
2397 | index 684900fcfe24..5c28bee327e1 100644 |
2398 | --- a/drivers/usb/gadget/legacy/inode.c |
2399 | +++ b/drivers/usb/gadget/legacy/inode.c |
2400 | @@ -28,7 +28,7 @@ |
2401 | #include <linux/aio.h> |
2402 | #include <linux/uio.h> |
2403 | #include <linux/refcount.h> |
2404 | - |
2405 | +#include <linux/delay.h> |
2406 | #include <linux/device.h> |
2407 | #include <linux/moduleparam.h> |
2408 | |
2409 | @@ -116,6 +116,7 @@ enum ep0_state { |
2410 | struct dev_data { |
2411 | spinlock_t lock; |
2412 | refcount_t count; |
2413 | + int udc_usage; |
2414 | enum ep0_state state; /* P: lock */ |
2415 | struct usb_gadgetfs_event event [N_EVENT]; |
2416 | unsigned ev_next; |
2417 | @@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) |
2418 | INIT_WORK(&priv->work, ep_user_copy_worker); |
2419 | schedule_work(&priv->work); |
2420 | } |
2421 | - spin_unlock(&epdata->dev->lock); |
2422 | |
2423 | usb_ep_free_request(ep, req); |
2424 | + spin_unlock(&epdata->dev->lock); |
2425 | put_ep(epdata); |
2426 | } |
2427 | |
2428 | @@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) |
2429 | struct usb_request *req = dev->req; |
2430 | |
2431 | if ((retval = setup_req (ep, req, 0)) == 0) { |
2432 | + ++dev->udc_usage; |
2433 | spin_unlock_irq (&dev->lock); |
2434 | retval = usb_ep_queue (ep, req, GFP_KERNEL); |
2435 | spin_lock_irq (&dev->lock); |
2436 | + --dev->udc_usage; |
2437 | } |
2438 | dev->state = STATE_DEV_CONNECTED; |
2439 | |
2440 | @@ -983,11 +986,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) |
2441 | retval = -EIO; |
2442 | else { |
2443 | len = min (len, (size_t)dev->req->actual); |
2444 | -// FIXME don't call this with the spinlock held ... |
2445 | + ++dev->udc_usage; |
2446 | + spin_unlock_irq(&dev->lock); |
2447 | if (copy_to_user (buf, dev->req->buf, len)) |
2448 | retval = -EFAULT; |
2449 | else |
2450 | retval = len; |
2451 | + spin_lock_irq(&dev->lock); |
2452 | + --dev->udc_usage; |
2453 | clean_req (dev->gadget->ep0, dev->req); |
2454 | /* NOTE userspace can't yet choose to stall */ |
2455 | } |
2456 | @@ -1131,6 +1137,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) |
2457 | retval = setup_req (dev->gadget->ep0, dev->req, len); |
2458 | if (retval == 0) { |
2459 | dev->state = STATE_DEV_CONNECTED; |
2460 | + ++dev->udc_usage; |
2461 | spin_unlock_irq (&dev->lock); |
2462 | if (copy_from_user (dev->req->buf, buf, len)) |
2463 | retval = -EFAULT; |
2464 | @@ -1142,6 +1149,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) |
2465 | GFP_KERNEL); |
2466 | } |
2467 | spin_lock_irq(&dev->lock); |
2468 | + --dev->udc_usage; |
2469 | if (retval < 0) { |
2470 | clean_req (dev->gadget->ep0, dev->req); |
2471 | } else |
2472 | @@ -1243,9 +1251,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value) |
2473 | struct usb_gadget *gadget = dev->gadget; |
2474 | long ret = -ENOTTY; |
2475 | |
2476 | - if (gadget->ops->ioctl) |
2477 | + spin_lock_irq(&dev->lock); |
2478 | + if (dev->state == STATE_DEV_OPENED || |
2479 | + dev->state == STATE_DEV_UNBOUND) { |
2480 | + /* Not bound to a UDC */ |
2481 | + } else if (gadget->ops->ioctl) { |
2482 | + ++dev->udc_usage; |
2483 | + spin_unlock_irq(&dev->lock); |
2484 | + |
2485 | ret = gadget->ops->ioctl (gadget, code, value); |
2486 | |
2487 | + spin_lock_irq(&dev->lock); |
2488 | + --dev->udc_usage; |
2489 | + } |
2490 | + spin_unlock_irq(&dev->lock); |
2491 | + |
2492 | return ret; |
2493 | } |
2494 | |
2495 | @@ -1463,10 +1483,12 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) |
2496 | if (value < 0) |
2497 | break; |
2498 | |
2499 | + ++dev->udc_usage; |
2500 | spin_unlock (&dev->lock); |
2501 | value = usb_ep_queue (gadget->ep0, dev->req, |
2502 | GFP_KERNEL); |
2503 | spin_lock (&dev->lock); |
2504 | + --dev->udc_usage; |
2505 | if (value < 0) { |
2506 | clean_req (gadget->ep0, dev->req); |
2507 | break; |
2508 | @@ -1490,8 +1512,12 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) |
2509 | req->length = value; |
2510 | req->zero = value < w_length; |
2511 | |
2512 | + ++dev->udc_usage; |
2513 | spin_unlock (&dev->lock); |
2514 | value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); |
2515 | + spin_lock(&dev->lock); |
2516 | + --dev->udc_usage; |
2517 | + spin_unlock(&dev->lock); |
2518 | if (value < 0) { |
2519 | DBG (dev, "ep_queue --> %d\n", value); |
2520 | req->status = 0; |
2521 | @@ -1518,21 +1544,24 @@ static void destroy_ep_files (struct dev_data *dev) |
2522 | /* break link to FS */ |
2523 | ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); |
2524 | list_del_init (&ep->epfiles); |
2525 | + spin_unlock_irq (&dev->lock); |
2526 | + |
2527 | dentry = ep->dentry; |
2528 | ep->dentry = NULL; |
2529 | parent = d_inode(dentry->d_parent); |
2530 | |
2531 | /* break link to controller */ |
2532 | + mutex_lock(&ep->lock); |
2533 | if (ep->state == STATE_EP_ENABLED) |
2534 | (void) usb_ep_disable (ep->ep); |
2535 | ep->state = STATE_EP_UNBOUND; |
2536 | usb_ep_free_request (ep->ep, ep->req); |
2537 | ep->ep = NULL; |
2538 | + mutex_unlock(&ep->lock); |
2539 | + |
2540 | wake_up (&ep->wait); |
2541 | put_ep (ep); |
2542 | |
2543 | - spin_unlock_irq (&dev->lock); |
2544 | - |
2545 | /* break link to dcache */ |
2546 | inode_lock(parent); |
2547 | d_delete (dentry); |
2548 | @@ -1603,6 +1632,11 @@ gadgetfs_unbind (struct usb_gadget *gadget) |
2549 | |
2550 | spin_lock_irq (&dev->lock); |
2551 | dev->state = STATE_DEV_UNBOUND; |
2552 | + while (dev->udc_usage > 0) { |
2553 | + spin_unlock_irq(&dev->lock); |
2554 | + usleep_range(1000, 2000); |
2555 | + spin_lock_irq(&dev->lock); |
2556 | + } |
2557 | spin_unlock_irq (&dev->lock); |
2558 | |
2559 | destroy_ep_files (dev); |
2560 | diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c |
2561 | index e99ab57ee3e5..fcba59782f26 100644 |
2562 | --- a/drivers/usb/gadget/legacy/mass_storage.c |
2563 | +++ b/drivers/usb/gadget/legacy/mass_storage.c |
2564 | @@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS; |
2565 | |
2566 | FSG_MODULE_PARAMETERS(/* no prefix */, mod_data); |
2567 | |
2568 | -static unsigned long msg_registered; |
2569 | -static void msg_cleanup(void); |
2570 | - |
2571 | -static int msg_thread_exits(struct fsg_common *common) |
2572 | -{ |
2573 | - msg_cleanup(); |
2574 | - return 0; |
2575 | -} |
2576 | - |
2577 | static int msg_do_config(struct usb_configuration *c) |
2578 | { |
2579 | struct fsg_opts *opts; |
2580 | @@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = { |
2581 | |
2582 | static int msg_bind(struct usb_composite_dev *cdev) |
2583 | { |
2584 | - static const struct fsg_operations ops = { |
2585 | - .thread_exits = msg_thread_exits, |
2586 | - }; |
2587 | struct fsg_opts *opts; |
2588 | struct fsg_config config; |
2589 | int status; |
2590 | @@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev) |
2591 | if (status) |
2592 | goto fail; |
2593 | |
2594 | - fsg_common_set_ops(opts->common, &ops); |
2595 | - |
2596 | status = fsg_common_set_cdev(opts->common, cdev, config.can_stall); |
2597 | if (status) |
2598 | goto fail_set_cdev; |
2599 | @@ -256,18 +242,12 @@ MODULE_LICENSE("GPL"); |
2600 | |
2601 | static int __init msg_init(void) |
2602 | { |
2603 | - int ret; |
2604 | - |
2605 | - ret = usb_composite_probe(&msg_driver); |
2606 | - set_bit(0, &msg_registered); |
2607 | - |
2608 | - return ret; |
2609 | + return usb_composite_probe(&msg_driver); |
2610 | } |
2611 | module_init(msg_init); |
2612 | |
2613 | -static void msg_cleanup(void) |
2614 | +static void __exit msg_cleanup(void) |
2615 | { |
2616 | - if (test_and_clear_bit(0, &msg_registered)) |
2617 | - usb_composite_unregister(&msg_driver); |
2618 | + usb_composite_unregister(&msg_driver); |
2619 | } |
2620 | module_exit(msg_cleanup); |
2621 | diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c |
2622 | index 98d71400f8a1..a884c022df7a 100644 |
2623 | --- a/drivers/usb/gadget/udc/atmel_usba_udc.c |
2624 | +++ b/drivers/usb/gadget/udc/atmel_usba_udc.c |
2625 | @@ -29,6 +29,8 @@ |
2626 | #include <linux/of_gpio.h> |
2627 | |
2628 | #include "atmel_usba_udc.h" |
2629 | +#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \ |
2630 | + | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING) |
2631 | |
2632 | #ifdef CONFIG_USB_GADGET_DEBUG_FS |
2633 | #include <linux/debugfs.h> |
2634 | @@ -2361,7 +2363,7 @@ static int usba_udc_probe(struct platform_device *pdev) |
2635 | IRQ_NOAUTOEN); |
2636 | ret = devm_request_threaded_irq(&pdev->dev, |
2637 | gpio_to_irq(udc->vbus_pin), NULL, |
2638 | - usba_vbus_irq_thread, IRQF_ONESHOT, |
2639 | + usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS, |
2640 | "atmel_usba_udc", udc); |
2641 | if (ret) { |
2642 | udc->vbus_pin = -ENODEV; |
2643 | diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c |
2644 | index e6f04eee95c4..63c5fe6f7bd4 100644 |
2645 | --- a/drivers/usb/gadget/udc/core.c |
2646 | +++ b/drivers/usb/gadget/udc/core.c |
2647 | @@ -1314,8 +1314,7 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri |
2648 | udc->dev.driver = &driver->driver; |
2649 | udc->gadget->dev.driver = &driver->driver; |
2650 | |
2651 | - if (driver->max_speed < udc->gadget->max_speed) |
2652 | - usb_gadget_udc_set_speed(udc, driver->max_speed); |
2653 | + usb_gadget_udc_set_speed(udc, driver->max_speed); |
2654 | |
2655 | ret = driver->bind(udc->gadget, driver); |
2656 | if (ret) |
2657 | diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c |
2658 | index 3c3760315910..374f85f612d9 100644 |
2659 | --- a/drivers/usb/gadget/udc/dummy_hcd.c |
2660 | +++ b/drivers/usb/gadget/udc/dummy_hcd.c |
2661 | @@ -237,6 +237,8 @@ struct dummy_hcd { |
2662 | |
2663 | struct usb_device *udev; |
2664 | struct list_head urbp_list; |
2665 | + struct urbp *next_frame_urbp; |
2666 | + |
2667 | u32 stream_en_ep; |
2668 | u8 num_stream[30 / 2]; |
2669 | |
2670 | @@ -253,11 +255,13 @@ struct dummy { |
2671 | */ |
2672 | struct dummy_ep ep[DUMMY_ENDPOINTS]; |
2673 | int address; |
2674 | + int callback_usage; |
2675 | struct usb_gadget gadget; |
2676 | struct usb_gadget_driver *driver; |
2677 | struct dummy_request fifo_req; |
2678 | u8 fifo_buf[FIFO_SIZE]; |
2679 | u16 devstatus; |
2680 | + unsigned ints_enabled:1; |
2681 | unsigned udc_suspended:1; |
2682 | unsigned pullup:1; |
2683 | |
2684 | @@ -440,18 +444,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd) |
2685 | (~dum_hcd->old_status) & dum_hcd->port_status; |
2686 | |
2687 | /* Report reset and disconnect events to the driver */ |
2688 | - if (dum->driver && (disconnect || reset)) { |
2689 | + if (dum->ints_enabled && (disconnect || reset)) { |
2690 | stop_activity(dum); |
2691 | + ++dum->callback_usage; |
2692 | + spin_unlock(&dum->lock); |
2693 | if (reset) |
2694 | usb_gadget_udc_reset(&dum->gadget, dum->driver); |
2695 | else |
2696 | dum->driver->disconnect(&dum->gadget); |
2697 | + spin_lock(&dum->lock); |
2698 | + --dum->callback_usage; |
2699 | } |
2700 | - } else if (dum_hcd->active != dum_hcd->old_active) { |
2701 | + } else if (dum_hcd->active != dum_hcd->old_active && |
2702 | + dum->ints_enabled) { |
2703 | + ++dum->callback_usage; |
2704 | + spin_unlock(&dum->lock); |
2705 | if (dum_hcd->old_active && dum->driver->suspend) |
2706 | dum->driver->suspend(&dum->gadget); |
2707 | else if (!dum_hcd->old_active && dum->driver->resume) |
2708 | dum->driver->resume(&dum->gadget); |
2709 | + spin_lock(&dum->lock); |
2710 | + --dum->callback_usage; |
2711 | } |
2712 | |
2713 | dum_hcd->old_status = dum_hcd->port_status; |
2714 | @@ -972,8 +985,11 @@ static int dummy_udc_start(struct usb_gadget *g, |
2715 | * can't enumerate without help from the driver we're binding. |
2716 | */ |
2717 | |
2718 | + spin_lock_irq(&dum->lock); |
2719 | dum->devstatus = 0; |
2720 | dum->driver = driver; |
2721 | + dum->ints_enabled = 1; |
2722 | + spin_unlock_irq(&dum->lock); |
2723 | |
2724 | return 0; |
2725 | } |
2726 | @@ -984,6 +1000,16 @@ static int dummy_udc_stop(struct usb_gadget *g) |
2727 | struct dummy *dum = dum_hcd->dum; |
2728 | |
2729 | spin_lock_irq(&dum->lock); |
2730 | + dum->ints_enabled = 0; |
2731 | + stop_activity(dum); |
2732 | + |
2733 | + /* emulate synchronize_irq(): wait for callbacks to finish */ |
2734 | + while (dum->callback_usage > 0) { |
2735 | + spin_unlock_irq(&dum->lock); |
2736 | + usleep_range(1000, 2000); |
2737 | + spin_lock_irq(&dum->lock); |
2738 | + } |
2739 | + |
2740 | dum->driver = NULL; |
2741 | spin_unlock_irq(&dum->lock); |
2742 | |
2743 | @@ -1037,7 +1063,12 @@ static int dummy_udc_probe(struct platform_device *pdev) |
2744 | memzero_explicit(&dum->gadget, sizeof(struct usb_gadget)); |
2745 | dum->gadget.name = gadget_name; |
2746 | dum->gadget.ops = &dummy_ops; |
2747 | - dum->gadget.max_speed = USB_SPEED_SUPER; |
2748 | + if (mod_data.is_super_speed) |
2749 | + dum->gadget.max_speed = USB_SPEED_SUPER; |
2750 | + else if (mod_data.is_high_speed) |
2751 | + dum->gadget.max_speed = USB_SPEED_HIGH; |
2752 | + else |
2753 | + dum->gadget.max_speed = USB_SPEED_FULL; |
2754 | |
2755 | dum->gadget.dev.parent = &pdev->dev; |
2756 | init_dummy_udc_hw(dum); |
2757 | @@ -1246,6 +1277,8 @@ static int dummy_urb_enqueue( |
2758 | |
2759 | list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list); |
2760 | urb->hcpriv = urbp; |
2761 | + if (!dum_hcd->next_frame_urbp) |
2762 | + dum_hcd->next_frame_urbp = urbp; |
2763 | if (usb_pipetype(urb->pipe) == PIPE_CONTROL) |
2764 | urb->error_count = 1; /* mark as a new urb */ |
2765 | |
2766 | @@ -1521,6 +1554,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address) |
2767 | if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ? |
2768 | dum->ss_hcd : dum->hs_hcd))) |
2769 | return NULL; |
2770 | + if (!dum->ints_enabled) |
2771 | + return NULL; |
2772 | if ((address & ~USB_DIR_IN) == 0) |
2773 | return &dum->ep[0]; |
2774 | for (i = 1; i < DUMMY_ENDPOINTS; i++) { |
2775 | @@ -1762,6 +1797,7 @@ static void dummy_timer(unsigned long _dum_hcd) |
2776 | spin_unlock_irqrestore(&dum->lock, flags); |
2777 | return; |
2778 | } |
2779 | + dum_hcd->next_frame_urbp = NULL; |
2780 | |
2781 | for (i = 0; i < DUMMY_ENDPOINTS; i++) { |
2782 | if (!ep_info[i].name) |
2783 | @@ -1778,6 +1814,10 @@ static void dummy_timer(unsigned long _dum_hcd) |
2784 | int type; |
2785 | int status = -EINPROGRESS; |
2786 | |
2787 | + /* stop when we reach URBs queued after the timer interrupt */ |
2788 | + if (urbp == dum_hcd->next_frame_urbp) |
2789 | + break; |
2790 | + |
2791 | urb = urbp->urb; |
2792 | if (urb->unlinked) |
2793 | goto return_urb; |
2794 | @@ -1857,10 +1897,12 @@ static void dummy_timer(unsigned long _dum_hcd) |
2795 | * until setup() returns; no reentrancy issues etc. |
2796 | */ |
2797 | if (value > 0) { |
2798 | + ++dum->callback_usage; |
2799 | spin_unlock(&dum->lock); |
2800 | value = dum->driver->setup(&dum->gadget, |
2801 | &setup); |
2802 | spin_lock(&dum->lock); |
2803 | + --dum->callback_usage; |
2804 | |
2805 | if (value >= 0) { |
2806 | /* no delays (max 64KB data stage) */ |
2807 | @@ -2561,8 +2603,6 @@ static struct hc_driver dummy_hcd = { |
2808 | .product_desc = "Dummy host controller", |
2809 | .hcd_priv_size = sizeof(struct dummy_hcd), |
2810 | |
2811 | - .flags = HCD_USB3 | HCD_SHARED, |
2812 | - |
2813 | .reset = dummy_setup, |
2814 | .start = dummy_start, |
2815 | .stop = dummy_stop, |
2816 | @@ -2591,8 +2631,12 @@ static int dummy_hcd_probe(struct platform_device *pdev) |
2817 | dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc); |
2818 | dum = *((void **)dev_get_platdata(&pdev->dev)); |
2819 | |
2820 | - if (!mod_data.is_super_speed) |
2821 | + if (mod_data.is_super_speed) |
2822 | + dummy_hcd.flags = HCD_USB3 | HCD_SHARED; |
2823 | + else if (mod_data.is_high_speed) |
2824 | dummy_hcd.flags = HCD_USB2; |
2825 | + else |
2826 | + dummy_hcd.flags = HCD_USB11; |
2827 | hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev)); |
2828 | if (!hs_hcd) |
2829 | return -ENOMEM; |
2830 | diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c |
2831 | index e1de8fe599a3..89ce1eddfe77 100644 |
2832 | --- a/drivers/usb/gadget/udc/renesas_usb3.c |
2833 | +++ b/drivers/usb/gadget/udc/renesas_usb3.c |
2834 | @@ -1032,7 +1032,7 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep, |
2835 | usb3_ep->ep.maxpacket); |
2836 | u8 *buf = usb3_req->req.buf + usb3_req->req.actual; |
2837 | u32 tmp = 0; |
2838 | - bool is_last; |
2839 | + bool is_last = !len ? true : false; |
2840 | |
2841 | if (usb3_wait_pipe_status(usb3_ep, PX_STA_BUFSTS) < 0) |
2842 | return -EBUSY; |
2843 | @@ -1053,7 +1053,8 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep, |
2844 | usb3_write(usb3, tmp, fifo_reg); |
2845 | } |
2846 | |
2847 | - is_last = usb3_is_transfer_complete(usb3_ep, usb3_req); |
2848 | + if (!is_last) |
2849 | + is_last = usb3_is_transfer_complete(usb3_ep, usb3_req); |
2850 | /* Send the data */ |
2851 | usb3_set_px_con_send(usb3_ep, len, is_last); |
2852 | |
2853 | @@ -1144,7 +1145,8 @@ static void usb3_start_pipe0(struct renesas_usb3_ep *usb3_ep, |
2854 | usb3_set_p0_con_for_ctrl_read_data(usb3); |
2855 | } else { |
2856 | usb3_clear_bit(usb3, P0_MOD_DIR, USB3_P0_MOD); |
2857 | - usb3_set_p0_con_for_ctrl_write_data(usb3); |
2858 | + if (usb3_req->req.length) |
2859 | + usb3_set_p0_con_for_ctrl_write_data(usb3); |
2860 | } |
2861 | |
2862 | usb3_p0_xfer(usb3_ep, usb3_req); |
2863 | @@ -2047,7 +2049,16 @@ static u32 usb3_calc_ramarea(int ram_size) |
2864 | static u32 usb3_calc_rammap_val(struct renesas_usb3_ep *usb3_ep, |
2865 | const struct usb_endpoint_descriptor *desc) |
2866 | { |
2867 | - return usb3_ep->rammap_val | PN_RAMMAP_MPKT(usb_endpoint_maxp(desc)); |
2868 | + int i; |
2869 | + const u32 max_packet_array[] = {8, 16, 32, 64, 512}; |
2870 | + u32 mpkt = PN_RAMMAP_MPKT(1024); |
2871 | + |
2872 | + for (i = 0; i < ARRAY_SIZE(max_packet_array); i++) { |
2873 | + if (usb_endpoint_maxp(desc) <= max_packet_array[i]) |
2874 | + mpkt = PN_RAMMAP_MPKT(max_packet_array[i]); |
2875 | + } |
2876 | + |
2877 | + return usb3_ep->rammap_val | mpkt; |
2878 | } |
2879 | |
2880 | static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep, |
2881 | diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c |
2882 | index 658d9d1f9ea3..6dda3623a276 100644 |
2883 | --- a/drivers/usb/host/pci-quirks.c |
2884 | +++ b/drivers/usb/host/pci-quirks.c |
2885 | @@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(struct pci_dev *pdev) |
2886 | if ((value & ASMT_CONTROL_WRITE_BIT) == 0) |
2887 | return 0; |
2888 | |
2889 | - usleep_range(40, 60); |
2890 | + udelay(50); |
2891 | } |
2892 | |
2893 | dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__); |
2894 | @@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports); |
2895 | * |
2896 | * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS. |
2897 | * It signals to the BIOS that the OS wants control of the host controller, |
2898 | - * and then waits 5 seconds for the BIOS to hand over control. |
2899 | + * and then waits 1 second for the BIOS to hand over control. |
2900 | * If we timeout, assume the BIOS is broken and take control anyway. |
2901 | */ |
2902 | static void quirk_usb_handoff_xhci(struct pci_dev *pdev) |
2903 | @@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) |
2904 | if (val & XHCI_HC_BIOS_OWNED) { |
2905 | writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset); |
2906 | |
2907 | - /* Wait for 5 seconds with 10 microsecond polling interval */ |
2908 | + /* Wait for 1 second with 10 microsecond polling interval */ |
2909 | timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED, |
2910 | - 0, 5000, 10); |
2911 | + 0, 1000000, 10); |
2912 | |
2913 | /* Assume a buggy BIOS and take HC ownership anyway */ |
2914 | if (timeout) { |
2915 | @@ -1100,7 +1100,7 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) |
2916 | * operational or runtime registers. Wait 5 seconds and no more. |
2917 | */ |
2918 | timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0, |
2919 | - 5000, 10); |
2920 | + 5000000, 10); |
2921 | /* Assume a buggy HC and start HC initialization anyway */ |
2922 | if (timeout) { |
2923 | val = readl(op_reg_base + XHCI_STS_OFFSET); |
2924 | diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c |
2925 | index 00721e8807ab..950dee33bfcc 100644 |
2926 | --- a/drivers/usb/host/xhci-hub.c |
2927 | +++ b/drivers/usb/host/xhci-hub.c |
2928 | @@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, |
2929 | |
2930 | /* If PSI table exists, add the custom speed attributes from it */ |
2931 | if (usb3_1 && xhci->usb3_rhub.psi_count) { |
2932 | - u32 ssp_cap_base, bm_attrib, psi; |
2933 | + u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp; |
2934 | int offset; |
2935 | |
2936 | ssp_cap_base = USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE; |
2937 | @@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, |
2938 | for (i = 0; i < xhci->usb3_rhub.psi_count; i++) { |
2939 | psi = xhci->usb3_rhub.psi[i]; |
2940 | psi &= ~USB_SSP_SUBLINK_SPEED_RSVD; |
2941 | + psi_exp = XHCI_EXT_PORT_PSIE(psi); |
2942 | + psi_mant = XHCI_EXT_PORT_PSIM(psi); |
2943 | + |
2944 | + /* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */ |
2945 | + for (; psi_exp < 3; psi_exp++) |
2946 | + psi_mant /= 1000; |
2947 | + if (psi_mant >= 10) |
2948 | + psi |= BIT(14); |
2949 | + |
2950 | if ((psi & PLT_MASK) == PLT_SYM) { |
2951 | /* Symmetric, create SSA RX and TX from one PSI entry */ |
2952 | put_unaligned_le32(psi, &buf[offset]); |
2953 | @@ -1473,9 +1482,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd) |
2954 | t2 |= PORT_WKOC_E | PORT_WKCONN_E; |
2955 | t2 &= ~PORT_WKDISC_E; |
2956 | } |
2957 | - if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) && |
2958 | - (hcd->speed < HCD_USB3)) |
2959 | - t2 &= ~PORT_WAKE_BITS; |
2960 | } else |
2961 | t2 &= ~PORT_WAKE_BITS; |
2962 | |
2963 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c |
2964 | index 8071c8fdd15e..76f392954733 100644 |
2965 | --- a/drivers/usb/host/xhci-pci.c |
2966 | +++ b/drivers/usb/host/xhci-pci.c |
2967 | @@ -54,11 +54,6 @@ |
2968 | #define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 |
2969 | #define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0 |
2970 | |
2971 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 |
2972 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba |
2973 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb |
2974 | -#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc |
2975 | - |
2976 | #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 |
2977 | |
2978 | static const char hcd_name[] = "xhci_hcd"; |
2979 | @@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
2980 | if (pdev->vendor == PCI_VENDOR_ID_AMD) |
2981 | xhci->quirks |= XHCI_TRUST_TX_LENGTH; |
2982 | |
2983 | - if ((pdev->vendor == PCI_VENDOR_ID_AMD) && |
2984 | - ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) || |
2985 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) || |
2986 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) || |
2987 | - (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1))) |
2988 | - xhci->quirks |= XHCI_U2_DISABLE_WAKE; |
2989 | - |
2990 | if (pdev->vendor == PCI_VENDOR_ID_INTEL) { |
2991 | xhci->quirks |= XHCI_LPM_SUPPORT; |
2992 | xhci->quirks |= XHCI_INTEL_HOST; |
2993 | diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c |
2994 | index c04144b25a67..208740771ff9 100644 |
2995 | --- a/drivers/usb/host/xhci-plat.c |
2996 | +++ b/drivers/usb/host/xhci-plat.c |
2997 | @@ -186,14 +186,18 @@ static int xhci_plat_probe(struct platform_device *pdev) |
2998 | * 2. xhci_plat is child of a device from firmware (dwc3-plat) |
2999 | * 3. xhci_plat is grandchild of a pci device (dwc3-pci) |
3000 | */ |
3001 | - sysdev = &pdev->dev; |
3002 | - if (sysdev->parent && !sysdev->of_node && sysdev->parent->of_node) |
3003 | - sysdev = sysdev->parent; |
3004 | + for (sysdev = &pdev->dev; sysdev; sysdev = sysdev->parent) { |
3005 | + if (is_of_node(sysdev->fwnode) || |
3006 | + is_acpi_device_node(sysdev->fwnode)) |
3007 | + break; |
3008 | #ifdef CONFIG_PCI |
3009 | - else if (sysdev->parent && sysdev->parent->parent && |
3010 | - sysdev->parent->parent->bus == &pci_bus_type) |
3011 | - sysdev = sysdev->parent->parent; |
3012 | + else if (sysdev->bus == &pci_bus_type) |
3013 | + break; |
3014 | #endif |
3015 | + } |
3016 | + |
3017 | + if (!sysdev) |
3018 | + sysdev = &pdev->dev; |
3019 | |
3020 | /* Try to set 64-bit DMA first */ |
3021 | if (WARN_ON(!sysdev->dma_mask)) |
3022 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c |
3023 | index b2ff1ff1a02f..ee198ea47f49 100644 |
3024 | --- a/drivers/usb/host/xhci.c |
3025 | +++ b/drivers/usb/host/xhci.c |
3026 | @@ -1703,7 +1703,8 @@ static int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev, |
3027 | if (xhci->quirks & XHCI_MTK_HOST) { |
3028 | ret = xhci_mtk_add_ep_quirk(hcd, udev, ep); |
3029 | if (ret < 0) { |
3030 | - xhci_free_endpoint_ring(xhci, virt_dev, ep_index); |
3031 | + xhci_ring_free(xhci, virt_dev->eps[ep_index].new_ring); |
3032 | + virt_dev->eps[ep_index].new_ring = NULL; |
3033 | return ret; |
3034 | } |
3035 | } |
3036 | diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h |
3037 | index e3e935291ed6..d7420bb9f2e2 100644 |
3038 | --- a/drivers/usb/host/xhci.h |
3039 | +++ b/drivers/usb/host/xhci.h |
3040 | @@ -728,6 +728,8 @@ struct xhci_ep_ctx { |
3041 | #define EP_MAXPSTREAMS(p) (((p) << 10) & EP_MAXPSTREAMS_MASK) |
3042 | /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */ |
3043 | #define EP_HAS_LSA (1 << 15) |
3044 | +/* hosts with LEC=1 use bits 31:24 as ESIT high bits. */ |
3045 | +#define CTX_TO_MAX_ESIT_PAYLOAD_HI(p) (((p) >> 24) & 0xff) |
3046 | |
3047 | /* ep_info2 bitmasks */ |
3048 | /* |
3049 | @@ -1674,7 +1676,7 @@ struct xhci_bus_state { |
3050 | |
3051 | static inline unsigned int hcd_index(struct usb_hcd *hcd) |
3052 | { |
3053 | - if (hcd->speed == HCD_USB3) |
3054 | + if (hcd->speed >= HCD_USB3) |
3055 | return 0; |
3056 | else |
3057 | return 1; |
3058 | @@ -1819,7 +1821,7 @@ struct xhci_hcd { |
3059 | /* For controller with a broken Port Disable implementation */ |
3060 | #define XHCI_BROKEN_PORT_PED (1 << 25) |
3061 | #define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26) |
3062 | -#define XHCI_U2_DISABLE_WAKE (1 << 27) |
3063 | +/* Reserved. It was XHCI_U2_DISABLE_WAKE */ |
3064 | #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28) |
3065 | |
3066 | unsigned int num_active_eps; |
3067 | @@ -2452,8 +2454,8 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq, |
3068 | u8 lsa; |
3069 | u8 hid; |
3070 | |
3071 | - esit = EP_MAX_ESIT_PAYLOAD_HI(info) << 16 | |
3072 | - EP_MAX_ESIT_PAYLOAD_LO(tx_info); |
3073 | + esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 | |
3074 | + CTX_TO_MAX_ESIT_PAYLOAD(tx_info); |
3075 | |
3076 | ep_state = info & EP_STATE_MASK; |
3077 | max_pstr = info & EP_MAXPSTREAMS_MASK; |
3078 | diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c |
3079 | index d1af831f43eb..68f26904c316 100644 |
3080 | --- a/drivers/usb/renesas_usbhs/fifo.c |
3081 | +++ b/drivers/usb/renesas_usbhs/fifo.c |
3082 | @@ -282,11 +282,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe, |
3083 | struct usbhs_fifo *fifo) |
3084 | { |
3085 | struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); |
3086 | + int ret = 0; |
3087 | |
3088 | - if (!usbhs_pipe_is_dcp(pipe)) |
3089 | - usbhsf_fifo_barrier(priv, fifo); |
3090 | + if (!usbhs_pipe_is_dcp(pipe)) { |
3091 | + /* |
3092 | + * This driver checks the pipe condition first to avoid -EBUSY |
3093 | + * from usbhsf_fifo_barrier() with about 10 msec delay in |
3094 | + * the interrupt handler if the pipe is RX direction and empty. |
3095 | + */ |
3096 | + if (usbhs_pipe_is_dir_in(pipe)) |
3097 | + ret = usbhs_pipe_is_accessible(pipe); |
3098 | + if (!ret) |
3099 | + ret = usbhsf_fifo_barrier(priv, fifo); |
3100 | + } |
3101 | |
3102 | - usbhs_write(priv, fifo->ctr, BCLR); |
3103 | + /* |
3104 | + * if non-DCP pipe, this driver should set BCLR when |
3105 | + * usbhsf_fifo_barrier() returns 0. |
3106 | + */ |
3107 | + if (!ret) |
3108 | + usbhs_write(priv, fifo->ctr, BCLR); |
3109 | } |
3110 | |
3111 | static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv, |
3112 | diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c |
3113 | index 1a59f335b063..a3ccb899df60 100644 |
3114 | --- a/drivers/usb/storage/transport.c |
3115 | +++ b/drivers/usb/storage/transport.c |
3116 | @@ -834,13 +834,25 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us) |
3117 | if (result == USB_STOR_TRANSPORT_GOOD) { |
3118 | srb->result = SAM_STAT_GOOD; |
3119 | srb->sense_buffer[0] = 0x0; |
3120 | + } |
3121 | + |
3122 | + /* |
3123 | + * ATA-passthru commands use sense data to report |
3124 | + * the command completion status, and often devices |
3125 | + * return Check Condition status when nothing is |
3126 | + * wrong. |
3127 | + */ |
3128 | + else if (srb->cmnd[0] == ATA_16 || |
3129 | + srb->cmnd[0] == ATA_12) { |
3130 | + /* leave the data alone */ |
3131 | + } |
3132 | |
3133 | /* |
3134 | * If there was a problem, report an unspecified |
3135 | * hardware error to prevent the higher layers from |
3136 | * entering an infinite retry loop. |
3137 | */ |
3138 | - } else { |
3139 | + else { |
3140 | srb->result = DID_ERROR << 16; |
3141 | if ((sshdr.response_code & 0x72) == 0x72) |
3142 | srb->sense_buffer[1] = HARDWARE_ERROR; |
3143 | diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h |
3144 | index f58caa9e6a27..a155cd02bce2 100644 |
3145 | --- a/drivers/usb/storage/uas-detect.h |
3146 | +++ b/drivers/usb/storage/uas-detect.h |
3147 | @@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf) |
3148 | intf->desc.bInterfaceProtocol == USB_PR_UAS); |
3149 | } |
3150 | |
3151 | -static int uas_find_uas_alt_setting(struct usb_interface *intf) |
3152 | +static struct usb_host_interface *uas_find_uas_alt_setting( |
3153 | + struct usb_interface *intf) |
3154 | { |
3155 | int i; |
3156 | |
3157 | @@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf) |
3158 | struct usb_host_interface *alt = &intf->altsetting[i]; |
3159 | |
3160 | if (uas_is_interface(alt)) |
3161 | - return alt->desc.bAlternateSetting; |
3162 | + return alt; |
3163 | } |
3164 | |
3165 | - return -ENODEV; |
3166 | + return NULL; |
3167 | } |
3168 | |
3169 | static int uas_find_endpoints(struct usb_host_interface *alt, |
3170 | @@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf, |
3171 | struct usb_device *udev = interface_to_usbdev(intf); |
3172 | struct usb_hcd *hcd = bus_to_hcd(udev->bus); |
3173 | unsigned long flags = id->driver_info; |
3174 | - int r, alt; |
3175 | - |
3176 | + struct usb_host_interface *alt; |
3177 | + int r; |
3178 | |
3179 | alt = uas_find_uas_alt_setting(intf); |
3180 | - if (alt < 0) |
3181 | + if (!alt) |
3182 | return 0; |
3183 | |
3184 | - r = uas_find_endpoints(&intf->altsetting[alt], eps); |
3185 | + r = uas_find_endpoints(alt, eps); |
3186 | if (r < 0) |
3187 | return 0; |
3188 | |
3189 | diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c |
3190 | index 5ef014ba6ae8..9876af4ab64e 100644 |
3191 | --- a/drivers/usb/storage/uas.c |
3192 | +++ b/drivers/usb/storage/uas.c |
3193 | @@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids); |
3194 | static int uas_switch_interface(struct usb_device *udev, |
3195 | struct usb_interface *intf) |
3196 | { |
3197 | - int alt; |
3198 | + struct usb_host_interface *alt; |
3199 | |
3200 | alt = uas_find_uas_alt_setting(intf); |
3201 | - if (alt < 0) |
3202 | - return alt; |
3203 | + if (!alt) |
3204 | + return -ENODEV; |
3205 | |
3206 | - return usb_set_interface(udev, |
3207 | - intf->altsetting[0].desc.bInterfaceNumber, alt); |
3208 | + return usb_set_interface(udev, alt->desc.bInterfaceNumber, |
3209 | + alt->desc.bAlternateSetting); |
3210 | } |
3211 | |
3212 | static int uas_configure_endpoints(struct uas_dev_info *devinfo) |
3213 | diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h |
3214 | index 5a70c33ef0e0..eb06d88b41d6 100644 |
3215 | --- a/drivers/usb/storage/unusual_devs.h |
3216 | +++ b/drivers/usb/storage/unusual_devs.h |
3217 | @@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000, |
3218 | USB_SC_DEVICE, USB_PR_DEVICE, NULL, |
3219 | US_FL_SANE_SENSE ), |
3220 | |
3221 | +/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */ |
3222 | +UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999, |
3223 | + "Seagate", |
3224 | + "External", |
3225 | + USB_SC_DEVICE, USB_PR_DEVICE, NULL, |
3226 | + US_FL_NO_WP_DETECT ), |
3227 | + |
3228 | UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, |
3229 | "Maxtor", |
3230 | "USB to SATA", |
3231 | diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c |
3232 | index 35a1e777b449..9a53912bdfe9 100644 |
3233 | --- a/drivers/uwb/hwa-rc.c |
3234 | +++ b/drivers/uwb/hwa-rc.c |
3235 | @@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interface *iface, |
3236 | |
3237 | if (iface->cur_altsetting->desc.bNumEndpoints < 1) |
3238 | return -ENODEV; |
3239 | + if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc)) |
3240 | + return -ENODEV; |
3241 | |
3242 | result = -ENOMEM; |
3243 | uwb_rc = uwb_rc_alloc(); |
3244 | diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c |
3245 | index 01c20a260a8b..39dd4ef53c77 100644 |
3246 | --- a/drivers/uwb/uwbd.c |
3247 | +++ b/drivers/uwb/uwbd.c |
3248 | @@ -302,18 +302,22 @@ static int uwbd(void *param) |
3249 | /** Start the UWB daemon */ |
3250 | void uwbd_start(struct uwb_rc *rc) |
3251 | { |
3252 | - rc->uwbd.task = kthread_run(uwbd, rc, "uwbd"); |
3253 | - if (rc->uwbd.task == NULL) |
3254 | + struct task_struct *task = kthread_run(uwbd, rc, "uwbd"); |
3255 | + if (IS_ERR(task)) { |
3256 | + rc->uwbd.task = NULL; |
3257 | printk(KERN_ERR "UWB: Cannot start management daemon; " |
3258 | "UWB won't work\n"); |
3259 | - else |
3260 | + } else { |
3261 | + rc->uwbd.task = task; |
3262 | rc->uwbd.pid = rc->uwbd.task->pid; |
3263 | + } |
3264 | } |
3265 | |
3266 | /* Stop the UWB daemon and free any unprocessed events */ |
3267 | void uwbd_stop(struct uwb_rc *rc) |
3268 | { |
3269 | - kthread_stop(rc->uwbd.task); |
3270 | + if (rc->uwbd.task) |
3271 | + kthread_stop(rc->uwbd.task); |
3272 | uwbd_flush(rc); |
3273 | } |
3274 | |
3275 | diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h |
3276 | index 3f3eb7b17cac..806eb85343fb 100644 |
3277 | --- a/fs/btrfs/ctree.h |
3278 | +++ b/fs/btrfs/ctree.h |
3279 | @@ -723,7 +723,7 @@ struct btrfs_delayed_root; |
3280 | * Indicate that a whole-filesystem exclusive operation is running |
3281 | * (device replace, resize, device add/delete, balance) |
3282 | */ |
3283 | -#define BTRFS_FS_EXCL_OP 14 |
3284 | +#define BTRFS_FS_EXCL_OP 16 |
3285 | |
3286 | struct btrfs_fs_info { |
3287 | u8 fsid[BTRFS_FSID_SIZE]; |
3288 | diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c |
3289 | index 0aff9b278c19..4aa3d4c27dfe 100644 |
3290 | --- a/fs/btrfs/extent_io.c |
3291 | +++ b/fs/btrfs/extent_io.c |
3292 | @@ -2799,7 +2799,7 @@ static int submit_extent_page(int op, int op_flags, struct extent_io_tree *tree, |
3293 | } |
3294 | } |
3295 | |
3296 | - bio = btrfs_bio_alloc(bdev, sector << 9); |
3297 | + bio = btrfs_bio_alloc(bdev, (u64)sector << 9); |
3298 | bio_add_page(bio, page, page_size, offset); |
3299 | bio->bi_end_io = end_io_func; |
3300 | bio->bi_private = tree; |
3301 | diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c |
3302 | index acb6f97deb97..196a07a87179 100644 |
3303 | --- a/fs/overlayfs/copy_up.c |
3304 | +++ b/fs/overlayfs/copy_up.c |
3305 | @@ -561,10 +561,8 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) |
3306 | c->tmpfile = true; |
3307 | err = ovl_copy_up_locked(c); |
3308 | } else { |
3309 | - err = -EIO; |
3310 | - if (lock_rename(c->workdir, c->destdir) != NULL) { |
3311 | - pr_err("overlayfs: failed to lock workdir+upperdir\n"); |
3312 | - } else { |
3313 | + err = ovl_lock_rename_workdir(c->workdir, c->destdir); |
3314 | + if (!err) { |
3315 | err = ovl_copy_up_locked(c); |
3316 | unlock_rename(c->workdir, c->destdir); |
3317 | } |
3318 | diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c |
3319 | index 48b70e6490f3..9b97b35b39c8 100644 |
3320 | --- a/fs/overlayfs/dir.c |
3321 | +++ b/fs/overlayfs/dir.c |
3322 | @@ -216,26 +216,6 @@ static int ovl_create_upper(struct dentry *dentry, struct inode *inode, |
3323 | return err; |
3324 | } |
3325 | |
3326 | -static int ovl_lock_rename_workdir(struct dentry *workdir, |
3327 | - struct dentry *upperdir) |
3328 | -{ |
3329 | - /* Workdir should not be the same as upperdir */ |
3330 | - if (workdir == upperdir) |
3331 | - goto err; |
3332 | - |
3333 | - /* Workdir should not be subdir of upperdir and vice versa */ |
3334 | - if (lock_rename(workdir, upperdir) != NULL) |
3335 | - goto err_unlock; |
3336 | - |
3337 | - return 0; |
3338 | - |
3339 | -err_unlock: |
3340 | - unlock_rename(workdir, upperdir); |
3341 | -err: |
3342 | - pr_err("overlayfs: failed to lock workdir+upperdir\n"); |
3343 | - return -EIO; |
3344 | -} |
3345 | - |
3346 | static struct dentry *ovl_clear_empty(struct dentry *dentry, |
3347 | struct list_head *list) |
3348 | { |
3349 | diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c |
3350 | index 8aef2b304b2d..9deec68075dc 100644 |
3351 | --- a/fs/overlayfs/namei.c |
3352 | +++ b/fs/overlayfs/namei.c |
3353 | @@ -506,6 +506,7 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry, |
3354 | |
3355 | index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len); |
3356 | if (IS_ERR(index)) { |
3357 | + err = PTR_ERR(index); |
3358 | pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n" |
3359 | "overlayfs: mount with '-o index=off' to disable inodes index.\n", |
3360 | d_inode(origin)->i_ino, name.len, name.name, |
3361 | diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h |
3362 | index e927a62c97ae..f57f47742f5f 100644 |
3363 | --- a/fs/overlayfs/overlayfs.h |
3364 | +++ b/fs/overlayfs/overlayfs.h |
3365 | @@ -234,6 +234,7 @@ bool ovl_inuse_trylock(struct dentry *dentry); |
3366 | void ovl_inuse_unlock(struct dentry *dentry); |
3367 | int ovl_nlink_start(struct dentry *dentry, bool *locked); |
3368 | void ovl_nlink_end(struct dentry *dentry, bool locked); |
3369 | +int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir); |
3370 | |
3371 | static inline bool ovl_is_impuredir(struct dentry *dentry) |
3372 | { |
3373 | diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h |
3374 | index 878a750986dd..25d9b5adcd42 100644 |
3375 | --- a/fs/overlayfs/ovl_entry.h |
3376 | +++ b/fs/overlayfs/ovl_entry.h |
3377 | @@ -37,6 +37,9 @@ struct ovl_fs { |
3378 | bool noxattr; |
3379 | /* sb common to all layers */ |
3380 | struct super_block *same_sb; |
3381 | + /* Did we take the inuse lock? */ |
3382 | + bool upperdir_locked; |
3383 | + bool workdir_locked; |
3384 | }; |
3385 | |
3386 | /* private information held for every overlayfs dentry */ |
3387 | diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c |
3388 | index 3d424a51cabb..74f7ead442f0 100644 |
3389 | --- a/fs/overlayfs/readdir.c |
3390 | +++ b/fs/overlayfs/readdir.c |
3391 | @@ -672,6 +672,7 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt, |
3392 | struct path *lowerstack, unsigned int numlower) |
3393 | { |
3394 | int err; |
3395 | + struct dentry *index = NULL; |
3396 | struct inode *dir = dentry->d_inode; |
3397 | struct path path = { .mnt = mnt, .dentry = dentry }; |
3398 | LIST_HEAD(list); |
3399 | @@ -690,8 +691,6 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt, |
3400 | |
3401 | inode_lock_nested(dir, I_MUTEX_PARENT); |
3402 | list_for_each_entry(p, &list, l_node) { |
3403 | - struct dentry *index; |
3404 | - |
3405 | if (p->name[0] == '.') { |
3406 | if (p->len == 1) |
3407 | continue; |
3408 | @@ -701,6 +700,7 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt, |
3409 | index = lookup_one_len(p->name, dentry, p->len); |
3410 | if (IS_ERR(index)) { |
3411 | err = PTR_ERR(index); |
3412 | + index = NULL; |
3413 | break; |
3414 | } |
3415 | err = ovl_verify_index(index, lowerstack, numlower); |
3416 | @@ -712,7 +712,9 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt, |
3417 | break; |
3418 | } |
3419 | dput(index); |
3420 | + index = NULL; |
3421 | } |
3422 | + dput(index); |
3423 | inode_unlock(dir); |
3424 | out: |
3425 | ovl_cache_free(&list); |
3426 | diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c |
3427 | index d86e89f97201..a1464905c1ea 100644 |
3428 | --- a/fs/overlayfs/super.c |
3429 | +++ b/fs/overlayfs/super.c |
3430 | @@ -210,9 +210,10 @@ static void ovl_put_super(struct super_block *sb) |
3431 | |
3432 | dput(ufs->indexdir); |
3433 | dput(ufs->workdir); |
3434 | - ovl_inuse_unlock(ufs->workbasedir); |
3435 | + if (ufs->workdir_locked) |
3436 | + ovl_inuse_unlock(ufs->workbasedir); |
3437 | dput(ufs->workbasedir); |
3438 | - if (ufs->upper_mnt) |
3439 | + if (ufs->upper_mnt && ufs->upperdir_locked) |
3440 | ovl_inuse_unlock(ufs->upper_mnt->mnt_root); |
3441 | mntput(ufs->upper_mnt); |
3442 | for (i = 0; i < ufs->numlower; i++) |
3443 | @@ -880,9 +881,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) |
3444 | goto out_put_upperpath; |
3445 | |
3446 | err = -EBUSY; |
3447 | - if (!ovl_inuse_trylock(upperpath.dentry)) { |
3448 | - pr_err("overlayfs: upperdir is in-use by another mount\n"); |
3449 | + if (ovl_inuse_trylock(upperpath.dentry)) { |
3450 | + ufs->upperdir_locked = true; |
3451 | + } else if (ufs->config.index) { |
3452 | + pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n"); |
3453 | goto out_put_upperpath; |
3454 | + } else { |
3455 | + pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n"); |
3456 | } |
3457 | |
3458 | err = ovl_mount_dir(ufs->config.workdir, &workpath); |
3459 | @@ -900,9 +905,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) |
3460 | } |
3461 | |
3462 | err = -EBUSY; |
3463 | - if (!ovl_inuse_trylock(workpath.dentry)) { |
3464 | - pr_err("overlayfs: workdir is in-use by another mount\n"); |
3465 | + if (ovl_inuse_trylock(workpath.dentry)) { |
3466 | + ufs->workdir_locked = true; |
3467 | + } else if (ufs->config.index) { |
3468 | + pr_err("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n"); |
3469 | goto out_put_workpath; |
3470 | + } else { |
3471 | + pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n"); |
3472 | } |
3473 | |
3474 | ufs->workbasedir = workpath.dentry; |
3475 | @@ -1155,11 +1164,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) |
3476 | out_free_lowertmp: |
3477 | kfree(lowertmp); |
3478 | out_unlock_workdentry: |
3479 | - ovl_inuse_unlock(workpath.dentry); |
3480 | + if (ufs->workdir_locked) |
3481 | + ovl_inuse_unlock(workpath.dentry); |
3482 | out_put_workpath: |
3483 | path_put(&workpath); |
3484 | out_unlock_upperdentry: |
3485 | - ovl_inuse_unlock(upperpath.dentry); |
3486 | + if (ufs->upperdir_locked) |
3487 | + ovl_inuse_unlock(upperpath.dentry); |
3488 | out_put_upperpath: |
3489 | path_put(&upperpath); |
3490 | out_free_config: |
3491 | diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c |
3492 | index f46ad75dc96a..8bff64f14190 100644 |
3493 | --- a/fs/overlayfs/util.c |
3494 | +++ b/fs/overlayfs/util.c |
3495 | @@ -418,7 +418,7 @@ void ovl_inuse_unlock(struct dentry *dentry) |
3496 | } |
3497 | } |
3498 | |
3499 | -/* Called must hold OVL_I(inode)->oi_lock */ |
3500 | +/* Caller must hold OVL_I(inode)->lock */ |
3501 | static void ovl_cleanup_index(struct dentry *dentry) |
3502 | { |
3503 | struct inode *dir = ovl_indexdir(dentry->d_sb)->d_inode; |
3504 | @@ -457,6 +457,9 @@ static void ovl_cleanup_index(struct dentry *dentry) |
3505 | err = PTR_ERR(index); |
3506 | if (!IS_ERR(index)) |
3507 | err = ovl_cleanup(dir, index); |
3508 | + else |
3509 | + index = NULL; |
3510 | + |
3511 | inode_unlock(dir); |
3512 | if (err) |
3513 | goto fail; |
3514 | @@ -545,3 +548,22 @@ void ovl_nlink_end(struct dentry *dentry, bool locked) |
3515 | mutex_unlock(&OVL_I(d_inode(dentry))->lock); |
3516 | } |
3517 | } |
3518 | + |
3519 | +int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir) |
3520 | +{ |
3521 | + /* Workdir should not be the same as upperdir */ |
3522 | + if (workdir == upperdir) |
3523 | + goto err; |
3524 | + |
3525 | + /* Workdir should not be subdir of upperdir and vice versa */ |
3526 | + if (lock_rename(workdir, upperdir) != NULL) |
3527 | + goto err_unlock; |
3528 | + |
3529 | + return 0; |
3530 | + |
3531 | +err_unlock: |
3532 | + unlock_rename(workdir, upperdir); |
3533 | +err: |
3534 | + pr_err("overlayfs: failed to lock workdir+upperdir\n"); |
3535 | + return -EIO; |
3536 | +} |
3537 | diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c |
3538 | index b0d5897bc4e6..be795bf20147 100644 |
3539 | --- a/fs/userfaultfd.c |
3540 | +++ b/fs/userfaultfd.c |
3541 | @@ -566,6 +566,12 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx, |
3542 | break; |
3543 | if (ACCESS_ONCE(ctx->released) || |
3544 | fatal_signal_pending(current)) { |
3545 | + /* |
3546 | + * &ewq->wq may be queued in fork_event, but |
3547 | + * __remove_wait_queue ignores the head |
3548 | + * parameter. It would be a problem if it |
3549 | + * didn't. |
3550 | + */ |
3551 | __remove_wait_queue(&ctx->event_wqh, &ewq->wq); |
3552 | if (ewq->msg.event == UFFD_EVENT_FORK) { |
3553 | struct userfaultfd_ctx *new; |
3554 | @@ -1039,6 +1045,12 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait, |
3555 | (unsigned long) |
3556 | uwq->msg.arg.reserved.reserved1; |
3557 | list_move(&uwq->wq.entry, &fork_event); |
3558 | + /* |
3559 | + * fork_nctx can be freed as soon as |
3560 | + * we drop the lock, unless we take a |
3561 | + * reference on it. |
3562 | + */ |
3563 | + userfaultfd_ctx_get(fork_nctx); |
3564 | spin_unlock(&ctx->event_wqh.lock); |
3565 | ret = 0; |
3566 | break; |
3567 | @@ -1069,19 +1081,53 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait, |
3568 | |
3569 | if (!ret && msg->event == UFFD_EVENT_FORK) { |
3570 | ret = resolve_userfault_fork(ctx, fork_nctx, msg); |
3571 | + spin_lock(&ctx->event_wqh.lock); |
3572 | + if (!list_empty(&fork_event)) { |
3573 | + /* |
3574 | + * The fork thread didn't abort, so we can |
3575 | + * drop the temporary refcount. |
3576 | + */ |
3577 | + userfaultfd_ctx_put(fork_nctx); |
3578 | + |
3579 | + uwq = list_first_entry(&fork_event, |
3580 | + typeof(*uwq), |
3581 | + wq.entry); |
3582 | + /* |
3583 | + * If fork_event list wasn't empty and in turn |
3584 | + * the event wasn't already released by fork |
3585 | + * (the event is allocated on fork kernel |
3586 | + * stack), put the event back to its place in |
3587 | + * the event_wq. fork_event head will be freed |
3588 | + * as soon as we return so the event cannot |
3589 | + * stay queued there no matter the current |
3590 | + * "ret" value. |
3591 | + */ |
3592 | + list_del(&uwq->wq.entry); |
3593 | + __add_wait_queue(&ctx->event_wqh, &uwq->wq); |
3594 | |
3595 | - if (!ret) { |
3596 | - spin_lock(&ctx->event_wqh.lock); |
3597 | - if (!list_empty(&fork_event)) { |
3598 | - uwq = list_first_entry(&fork_event, |
3599 | - typeof(*uwq), |
3600 | - wq.entry); |
3601 | - list_del(&uwq->wq.entry); |
3602 | - __add_wait_queue(&ctx->event_wqh, &uwq->wq); |
3603 | + /* |
3604 | + * Leave the event in the waitqueue and report |
3605 | + * error to userland if we failed to resolve |
3606 | + * the userfault fork. |
3607 | + */ |
3608 | + if (likely(!ret)) |
3609 | userfaultfd_event_complete(ctx, uwq); |
3610 | - } |
3611 | - spin_unlock(&ctx->event_wqh.lock); |
3612 | + } else { |
3613 | + /* |
3614 | + * Here the fork thread aborted and the |
3615 | + * refcount from the fork thread on fork_nctx |
3616 | + * has already been released. We still hold |
3617 | + * the reference we took before releasing the |
3618 | + * lock above. If resolve_userfault_fork |
3619 | + * failed we've to drop it because the |
3620 | + * fork_nctx has to be freed in such case. If |
3621 | + * it succeeded we'll hold it because the new |
3622 | + * uffd references it. |
3623 | + */ |
3624 | + if (ret) |
3625 | + userfaultfd_ctx_put(fork_nctx); |
3626 | } |
3627 | + spin_unlock(&ctx->event_wqh.lock); |
3628 | } |
3629 | |
3630 | return ret; |
3631 | diff --git a/fs/xattr.c b/fs/xattr.c |
3632 | index 464c94bf65f9..5441a6d95396 100644 |
3633 | --- a/fs/xattr.c |
3634 | +++ b/fs/xattr.c |
3635 | @@ -249,7 +249,7 @@ xattr_getsecurity(struct inode *inode, const char *name, void *value, |
3636 | } |
3637 | memcpy(value, buffer, len); |
3638 | out: |
3639 | - security_release_secctx(buffer, len); |
3640 | + kfree(buffer); |
3641 | out_noalloc: |
3642 | return len; |
3643 | } |
3644 | diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h |
3645 | index 0504ef8f3aa3..976f8ac26665 100644 |
3646 | --- a/include/asm-generic/percpu.h |
3647 | +++ b/include/asm-generic/percpu.h |
3648 | @@ -115,15 +115,35 @@ do { \ |
3649 | (__ret); \ |
3650 | }) |
3651 | |
3652 | -#define this_cpu_generic_read(pcp) \ |
3653 | +#define __this_cpu_generic_read_nopreempt(pcp) \ |
3654 | ({ \ |
3655 | typeof(pcp) __ret; \ |
3656 | preempt_disable_notrace(); \ |
3657 | - __ret = raw_cpu_generic_read(pcp); \ |
3658 | + __ret = READ_ONCE(*raw_cpu_ptr(&(pcp))); \ |
3659 | preempt_enable_notrace(); \ |
3660 | __ret; \ |
3661 | }) |
3662 | |
3663 | +#define __this_cpu_generic_read_noirq(pcp) \ |
3664 | +({ \ |
3665 | + typeof(pcp) __ret; \ |
3666 | + unsigned long __flags; \ |
3667 | + raw_local_irq_save(__flags); \ |
3668 | + __ret = raw_cpu_generic_read(pcp); \ |
3669 | + raw_local_irq_restore(__flags); \ |
3670 | + __ret; \ |
3671 | +}) |
3672 | + |
3673 | +#define this_cpu_generic_read(pcp) \ |
3674 | +({ \ |
3675 | + typeof(pcp) __ret; \ |
3676 | + if (__native_word(pcp)) \ |
3677 | + __ret = __this_cpu_generic_read_nopreempt(pcp); \ |
3678 | + else \ |
3679 | + __ret = __this_cpu_generic_read_noirq(pcp); \ |
3680 | + __ret; \ |
3681 | +}) |
3682 | + |
3683 | #define this_cpu_generic_to_op(pcp, val, op) \ |
3684 | do { \ |
3685 | unsigned long __flags; \ |
3686 | diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h |
3687 | index 5ba430cc9a87..1fc7abd28b0b 100644 |
3688 | --- a/include/linux/iio/adc/ad_sigma_delta.h |
3689 | +++ b/include/linux/iio/adc/ad_sigma_delta.h |
3690 | @@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, |
3691 | int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, |
3692 | unsigned int size, unsigned int *val); |
3693 | |
3694 | +int ad_sd_reset(struct ad_sigma_delta *sigma_delta, |
3695 | + unsigned int reset_length); |
3696 | + |
3697 | int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev, |
3698 | const struct iio_chan_spec *chan, int *val); |
3699 | int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta, |
3700 | diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h |
3701 | index 7b2e31b1745a..6866e8126982 100644 |
3702 | --- a/include/linux/mmu_notifier.h |
3703 | +++ b/include/linux/mmu_notifier.h |
3704 | @@ -400,6 +400,11 @@ extern void mmu_notifier_synchronize(void); |
3705 | |
3706 | #else /* CONFIG_MMU_NOTIFIER */ |
3707 | |
3708 | +static inline int mm_has_notifiers(struct mm_struct *mm) |
3709 | +{ |
3710 | + return 0; |
3711 | +} |
3712 | + |
3713 | static inline void mmu_notifier_release(struct mm_struct *mm) |
3714 | { |
3715 | } |
3716 | diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h |
3717 | index 5012b524283d..60248d644b6f 100644 |
3718 | --- a/include/linux/trace_events.h |
3719 | +++ b/include/linux/trace_events.h |
3720 | @@ -277,6 +277,7 @@ struct trace_event_call { |
3721 | int perf_refcount; |
3722 | struct hlist_head __percpu *perf_events; |
3723 | struct bpf_prog *prog; |
3724 | + struct perf_event *bpf_prog_owner; |
3725 | |
3726 | int (*perf_perm)(struct trace_event_call *, |
3727 | struct perf_event *); |
3728 | diff --git a/include/net/netlink.h b/include/net/netlink.h |
3729 | index ef8e6c3a80a6..4c72c7866da5 100644 |
3730 | --- a/include/net/netlink.h |
3731 | +++ b/include/net/netlink.h |
3732 | @@ -768,7 +768,10 @@ static inline int nla_parse_nested(struct nlattr *tb[], int maxtype, |
3733 | */ |
3734 | static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value) |
3735 | { |
3736 | - return nla_put(skb, attrtype, sizeof(u8), &value); |
3737 | + /* temporary variables to work around GCC PR81715 with asan-stack=1 */ |
3738 | + u8 tmp = value; |
3739 | + |
3740 | + return nla_put(skb, attrtype, sizeof(u8), &tmp); |
3741 | } |
3742 | |
3743 | /** |
3744 | @@ -779,7 +782,9 @@ static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value) |
3745 | */ |
3746 | static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value) |
3747 | { |
3748 | - return nla_put(skb, attrtype, sizeof(u16), &value); |
3749 | + u16 tmp = value; |
3750 | + |
3751 | + return nla_put(skb, attrtype, sizeof(u16), &tmp); |
3752 | } |
3753 | |
3754 | /** |
3755 | @@ -790,7 +795,9 @@ static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value) |
3756 | */ |
3757 | static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value) |
3758 | { |
3759 | - return nla_put(skb, attrtype, sizeof(__be16), &value); |
3760 | + __be16 tmp = value; |
3761 | + |
3762 | + return nla_put(skb, attrtype, sizeof(__be16), &tmp); |
3763 | } |
3764 | |
3765 | /** |
3766 | @@ -801,7 +808,9 @@ static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value) |
3767 | */ |
3768 | static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value) |
3769 | { |
3770 | - return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, value); |
3771 | + __be16 tmp = value; |
3772 | + |
3773 | + return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, tmp); |
3774 | } |
3775 | |
3776 | /** |
3777 | @@ -812,7 +821,9 @@ static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value) |
3778 | */ |
3779 | static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value) |
3780 | { |
3781 | - return nla_put(skb, attrtype, sizeof(__le16), &value); |
3782 | + __le16 tmp = value; |
3783 | + |
3784 | + return nla_put(skb, attrtype, sizeof(__le16), &tmp); |
3785 | } |
3786 | |
3787 | /** |
3788 | @@ -823,7 +834,9 @@ static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value) |
3789 | */ |
3790 | static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value) |
3791 | { |
3792 | - return nla_put(skb, attrtype, sizeof(u32), &value); |
3793 | + u32 tmp = value; |
3794 | + |
3795 | + return nla_put(skb, attrtype, sizeof(u32), &tmp); |
3796 | } |
3797 | |
3798 | /** |
3799 | @@ -834,7 +847,9 @@ static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value) |
3800 | */ |
3801 | static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value) |
3802 | { |
3803 | - return nla_put(skb, attrtype, sizeof(__be32), &value); |
3804 | + __be32 tmp = value; |
3805 | + |
3806 | + return nla_put(skb, attrtype, sizeof(__be32), &tmp); |
3807 | } |
3808 | |
3809 | /** |
3810 | @@ -845,7 +860,9 @@ static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value) |
3811 | */ |
3812 | static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value) |
3813 | { |
3814 | - return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, value); |
3815 | + __be32 tmp = value; |
3816 | + |
3817 | + return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, tmp); |
3818 | } |
3819 | |
3820 | /** |
3821 | @@ -856,7 +873,9 @@ static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value) |
3822 | */ |
3823 | static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value) |
3824 | { |
3825 | - return nla_put(skb, attrtype, sizeof(__le32), &value); |
3826 | + __le32 tmp = value; |
3827 | + |
3828 | + return nla_put(skb, attrtype, sizeof(__le32), &tmp); |
3829 | } |
3830 | |
3831 | /** |
3832 | @@ -869,7 +888,9 @@ static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value) |
3833 | static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype, |
3834 | u64 value, int padattr) |
3835 | { |
3836 | - return nla_put_64bit(skb, attrtype, sizeof(u64), &value, padattr); |
3837 | + u64 tmp = value; |
3838 | + |
3839 | + return nla_put_64bit(skb, attrtype, sizeof(u64), &tmp, padattr); |
3840 | } |
3841 | |
3842 | /** |
3843 | @@ -882,7 +903,9 @@ static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype, |
3844 | static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value, |
3845 | int padattr) |
3846 | { |
3847 | - return nla_put_64bit(skb, attrtype, sizeof(__be64), &value, padattr); |
3848 | + __be64 tmp = value; |
3849 | + |
3850 | + return nla_put_64bit(skb, attrtype, sizeof(__be64), &tmp, padattr); |
3851 | } |
3852 | |
3853 | /** |
3854 | @@ -895,7 +918,9 @@ static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value, |
3855 | static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value, |
3856 | int padattr) |
3857 | { |
3858 | - return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, value, |
3859 | + __be64 tmp = value; |
3860 | + |
3861 | + return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, tmp, |
3862 | padattr); |
3863 | } |
3864 | |
3865 | @@ -909,7 +934,9 @@ static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value, |
3866 | static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value, |
3867 | int padattr) |
3868 | { |
3869 | - return nla_put_64bit(skb, attrtype, sizeof(__le64), &value, padattr); |
3870 | + __le64 tmp = value; |
3871 | + |
3872 | + return nla_put_64bit(skb, attrtype, sizeof(__le64), &tmp, padattr); |
3873 | } |
3874 | |
3875 | /** |
3876 | @@ -920,7 +947,9 @@ static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value, |
3877 | */ |
3878 | static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value) |
3879 | { |
3880 | - return nla_put(skb, attrtype, sizeof(s8), &value); |
3881 | + s8 tmp = value; |
3882 | + |
3883 | + return nla_put(skb, attrtype, sizeof(s8), &tmp); |
3884 | } |
3885 | |
3886 | /** |
3887 | @@ -931,7 +960,9 @@ static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value) |
3888 | */ |
3889 | static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value) |
3890 | { |
3891 | - return nla_put(skb, attrtype, sizeof(s16), &value); |
3892 | + s16 tmp = value; |
3893 | + |
3894 | + return nla_put(skb, attrtype, sizeof(s16), &tmp); |
3895 | } |
3896 | |
3897 | /** |
3898 | @@ -942,7 +973,9 @@ static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value) |
3899 | */ |
3900 | static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value) |
3901 | { |
3902 | - return nla_put(skb, attrtype, sizeof(s32), &value); |
3903 | + s32 tmp = value; |
3904 | + |
3905 | + return nla_put(skb, attrtype, sizeof(s32), &tmp); |
3906 | } |
3907 | |
3908 | /** |
3909 | @@ -955,7 +988,9 @@ static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value) |
3910 | static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value, |
3911 | int padattr) |
3912 | { |
3913 | - return nla_put_64bit(skb, attrtype, sizeof(s64), &value, padattr); |
3914 | + s64 tmp = value; |
3915 | + |
3916 | + return nla_put_64bit(skb, attrtype, sizeof(s64), &tmp, padattr); |
3917 | } |
3918 | |
3919 | /** |
3920 | @@ -1005,7 +1040,9 @@ static inline int nla_put_msecs(struct sk_buff *skb, int attrtype, |
3921 | static inline int nla_put_in_addr(struct sk_buff *skb, int attrtype, |
3922 | __be32 addr) |
3923 | { |
3924 | - return nla_put_be32(skb, attrtype, addr); |
3925 | + __be32 tmp = addr; |
3926 | + |
3927 | + return nla_put_be32(skb, attrtype, tmp); |
3928 | } |
3929 | |
3930 | /** |
3931 | diff --git a/include/net/protocol.h b/include/net/protocol.h |
3932 | index 65ba335b0e7e..4fc75f7ae23b 100644 |
3933 | --- a/include/net/protocol.h |
3934 | +++ b/include/net/protocol.h |
3935 | @@ -39,8 +39,8 @@ |
3936 | |
3937 | /* This is used to register protocols. */ |
3938 | struct net_protocol { |
3939 | - void (*early_demux)(struct sk_buff *skb); |
3940 | - void (*early_demux_handler)(struct sk_buff *skb); |
3941 | + int (*early_demux)(struct sk_buff *skb); |
3942 | + int (*early_demux_handler)(struct sk_buff *skb); |
3943 | int (*handler)(struct sk_buff *skb); |
3944 | void (*err_handler)(struct sk_buff *skb, u32 info); |
3945 | unsigned int no_policy:1, |
3946 | diff --git a/include/net/route.h b/include/net/route.h |
3947 | index cb0a76d9dde1..58458966e31e 100644 |
3948 | --- a/include/net/route.h |
3949 | +++ b/include/net/route.h |
3950 | @@ -175,7 +175,9 @@ static inline struct rtable *ip_route_output_gre(struct net *net, struct flowi4 |
3951 | fl4->fl4_gre_key = gre_key; |
3952 | return ip_route_output_key(net, fl4); |
3953 | } |
3954 | - |
3955 | +int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr, |
3956 | + u8 tos, struct net_device *dev, |
3957 | + struct in_device *in_dev, u32 *itag); |
3958 | int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 src, |
3959 | u8 tos, struct net_device *devin); |
3960 | int ip_route_input_rcu(struct sk_buff *skb, __be32 dst, __be32 src, |
3961 | diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h |
3962 | index 1060494ac230..b8c86ec1a8f5 100644 |
3963 | --- a/include/net/sctp/ulpevent.h |
3964 | +++ b/include/net/sctp/ulpevent.h |
3965 | @@ -153,8 +153,12 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event); |
3966 | static inline int sctp_ulpevent_type_enabled(__u16 sn_type, |
3967 | struct sctp_event_subscribe *mask) |
3968 | { |
3969 | + int offset = sn_type - SCTP_SN_TYPE_BASE; |
3970 | char *amask = (char *) mask; |
3971 | - return amask[sn_type - SCTP_SN_TYPE_BASE]; |
3972 | + |
3973 | + if (offset >= sizeof(struct sctp_event_subscribe)) |
3974 | + return 0; |
3975 | + return amask[offset]; |
3976 | } |
3977 | |
3978 | /* Given an event subscription, is this event enabled? */ |
3979 | diff --git a/include/net/tcp.h b/include/net/tcp.h |
3980 | index f642a39f9eee..48978125947b 100644 |
3981 | --- a/include/net/tcp.h |
3982 | +++ b/include/net/tcp.h |
3983 | @@ -347,7 +347,7 @@ void tcp_v4_err(struct sk_buff *skb, u32); |
3984 | |
3985 | void tcp_shutdown(struct sock *sk, int how); |
3986 | |
3987 | -void tcp_v4_early_demux(struct sk_buff *skb); |
3988 | +int tcp_v4_early_demux(struct sk_buff *skb); |
3989 | int tcp_v4_rcv(struct sk_buff *skb); |
3990 | |
3991 | int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw); |
3992 | diff --git a/include/net/udp.h b/include/net/udp.h |
3993 | index 626c2d8a70c5..1e6b2476d427 100644 |
3994 | --- a/include/net/udp.h |
3995 | +++ b/include/net/udp.h |
3996 | @@ -259,7 +259,7 @@ static inline struct sk_buff *skb_recv_udp(struct sock *sk, unsigned int flags, |
3997 | return __skb_recv_udp(sk, flags, noblock, &peeked, &off, err); |
3998 | } |
3999 | |
4000 | -void udp_v4_early_demux(struct sk_buff *skb); |
4001 | +int udp_v4_early_demux(struct sk_buff *skb); |
4002 | bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst); |
4003 | int udp_get_port(struct sock *sk, unsigned short snum, |
4004 | int (*saddr_cmp)(const struct sock *, |
4005 | diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h |
4006 | index 0979a5f3b69a..6ff1bab23679 100644 |
4007 | --- a/include/scsi/scsi_device.h |
4008 | +++ b/include/scsi/scsi_device.h |
4009 | @@ -182,6 +182,7 @@ struct scsi_device { |
4010 | unsigned no_dif:1; /* T10 PI (DIF) should be disabled */ |
4011 | unsigned broken_fua:1; /* Don't set FUA bit */ |
4012 | unsigned lun_in_cdb:1; /* Store LUN bits in CDB[1] */ |
4013 | + unsigned unmap_limit_for_ws:1; /* Use the UNMAP limit for WRITE SAME */ |
4014 | |
4015 | atomic_t disk_events_disable_depth; /* disable depth for disk events */ |
4016 | |
4017 | diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h |
4018 | index 9592570e092a..36b03013d629 100644 |
4019 | --- a/include/scsi/scsi_devinfo.h |
4020 | +++ b/include/scsi/scsi_devinfo.h |
4021 | @@ -29,5 +29,6 @@ |
4022 | #define BLIST_TRY_VPD_PAGES 0x10000000 /* Attempt to read VPD pages */ |
4023 | #define BLIST_NO_RSOC 0x20000000 /* don't try to issue RSOC */ |
4024 | #define BLIST_MAX_1024 0x40000000 /* maximum 1024 sector cdb length */ |
4025 | +#define BLIST_UNMAP_LIMIT_WS 0x80000000 /* Use UNMAP limit for WRITE SAME */ |
4026 | |
4027 | #endif |
4028 | diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h |
4029 | index e99e3e6f8b37..f0add86219f0 100644 |
4030 | --- a/include/uapi/linux/bpf.h |
4031 | +++ b/include/uapi/linux/bpf.h |
4032 | @@ -294,7 +294,7 @@ union bpf_attr { |
4033 | * jump into another BPF program |
4034 | * @ctx: context pointer passed to next program |
4035 | * @prog_array_map: pointer to map which type is BPF_MAP_TYPE_PROG_ARRAY |
4036 | - * @index: index inside array that selects specific program to run |
4037 | + * @index: 32-bit index inside array that selects specific program to run |
4038 | * Return: 0 on success or negative error |
4039 | * |
4040 | * int bpf_clone_redirect(skb, ifindex, flags) |
4041 | diff --git a/include/uapi/linux/dm-ioctl.h b/include/uapi/linux/dm-ioctl.h |
4042 | index 412c06a624c8..ccaea525340b 100644 |
4043 | --- a/include/uapi/linux/dm-ioctl.h |
4044 | +++ b/include/uapi/linux/dm-ioctl.h |
4045 | @@ -269,9 +269,9 @@ enum { |
4046 | #define DM_DEV_SET_GEOMETRY _IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl) |
4047 | |
4048 | #define DM_VERSION_MAJOR 4 |
4049 | -#define DM_VERSION_MINOR 36 |
4050 | +#define DM_VERSION_MINOR 37 |
4051 | #define DM_VERSION_PATCHLEVEL 0 |
4052 | -#define DM_VERSION_EXTRA "-ioctl (2017-06-09)" |
4053 | +#define DM_VERSION_EXTRA "-ioctl (2017-09-20)" |
4054 | |
4055 | /* Status bits */ |
4056 | #define DM_READONLY_FLAG (1 << 0) /* In/Out */ |
4057 | diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h |
4058 | index ce1169af39d7..2a5d63040a0b 100644 |
4059 | --- a/include/uapi/linux/usb/ch9.h |
4060 | +++ b/include/uapi/linux/usb/ch9.h |
4061 | @@ -780,6 +780,7 @@ struct usb_interface_assoc_descriptor { |
4062 | __u8 iFunction; |
4063 | } __attribute__ ((packed)); |
4064 | |
4065 | +#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8 |
4066 | |
4067 | /*-------------------------------------------------------------------------*/ |
4068 | |
4069 | diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c |
4070 | index ad5f55922a13..9a1bed1f3029 100644 |
4071 | --- a/kernel/bpf/core.c |
4072 | +++ b/kernel/bpf/core.c |
4073 | @@ -1010,7 +1010,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, |
4074 | struct bpf_map *map = (struct bpf_map *) (unsigned long) BPF_R2; |
4075 | struct bpf_array *array = container_of(map, struct bpf_array, map); |
4076 | struct bpf_prog *prog; |
4077 | - u64 index = BPF_R3; |
4078 | + u32 index = BPF_R3; |
4079 | |
4080 | if (unlikely(index >= array->map.max_entries)) |
4081 | goto out; |
4082 | diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c |
4083 | index 6c772adabad2..1939d91da1f8 100644 |
4084 | --- a/kernel/bpf/syscall.c |
4085 | +++ b/kernel/bpf/syscall.c |
4086 | @@ -144,15 +144,17 @@ static int bpf_map_alloc_id(struct bpf_map *map) |
4087 | |
4088 | static void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock) |
4089 | { |
4090 | + unsigned long flags; |
4091 | + |
4092 | if (do_idr_lock) |
4093 | - spin_lock_bh(&map_idr_lock); |
4094 | + spin_lock_irqsave(&map_idr_lock, flags); |
4095 | else |
4096 | __acquire(&map_idr_lock); |
4097 | |
4098 | idr_remove(&map_idr, map->id); |
4099 | |
4100 | if (do_idr_lock) |
4101 | - spin_unlock_bh(&map_idr_lock); |
4102 | + spin_unlock_irqrestore(&map_idr_lock, flags); |
4103 | else |
4104 | __release(&map_idr_lock); |
4105 | } |
4106 | diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c |
4107 | index 664d93972373..3940019b9740 100644 |
4108 | --- a/kernel/bpf/verifier.c |
4109 | +++ b/kernel/bpf/verifier.c |
4110 | @@ -1978,7 +1978,8 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) |
4111 | } |
4112 | } else { |
4113 | if (insn->src_reg != BPF_REG_0 || insn->off != 0 || |
4114 | - (insn->imm != 16 && insn->imm != 32 && insn->imm != 64)) { |
4115 | + (insn->imm != 16 && insn->imm != 32 && insn->imm != 64) || |
4116 | + BPF_CLASS(insn->code) == BPF_ALU64) { |
4117 | verbose("BPF_END uses reserved fields\n"); |
4118 | return -EINVAL; |
4119 | } |
4120 | diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c |
4121 | index df2e0f14a95d..6d60aafbe8c1 100644 |
4122 | --- a/kernel/cgroup/cgroup.c |
4123 | +++ b/kernel/cgroup/cgroup.c |
4124 | @@ -2168,6 +2168,14 @@ static int cgroup_migrate_execute(struct cgroup_mgctx *mgctx) |
4125 | list_del_init(&cset->mg_node); |
4126 | } |
4127 | spin_unlock_irq(&css_set_lock); |
4128 | + |
4129 | + /* |
4130 | + * Re-initialize the cgroup_taskset structure in case it is reused |
4131 | + * again in another cgroup_migrate_add_task()/cgroup_migrate_execute() |
4132 | + * iteration. |
4133 | + */ |
4134 | + tset->nr_tasks = 0; |
4135 | + tset->csets = &tset->src_csets; |
4136 | return ret; |
4137 | } |
4138 | |
4139 | diff --git a/kernel/events/core.c b/kernel/events/core.c |
4140 | index 03ac9c8b02fb..7242a6e1ec76 100644 |
4141 | --- a/kernel/events/core.c |
4142 | +++ b/kernel/events/core.c |
4143 | @@ -8121,6 +8121,7 @@ static int perf_event_set_bpf_prog(struct perf_event *event, u32 prog_fd) |
4144 | } |
4145 | } |
4146 | event->tp_event->prog = prog; |
4147 | + event->tp_event->bpf_prog_owner = event; |
4148 | |
4149 | return 0; |
4150 | } |
4151 | @@ -8135,7 +8136,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) |
4152 | return; |
4153 | |
4154 | prog = event->tp_event->prog; |
4155 | - if (prog) { |
4156 | + if (prog && event->tp_event->bpf_prog_owner == event) { |
4157 | event->tp_event->prog = NULL; |
4158 | bpf_prog_put(prog); |
4159 | } |
4160 | diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c |
4161 | index 725819569fa7..2ee3e3345ff3 100644 |
4162 | --- a/kernel/trace/ftrace.c |
4163 | +++ b/kernel/trace/ftrace.c |
4164 | @@ -4954,9 +4954,6 @@ static char ftrace_graph_buf[FTRACE_FILTER_SIZE] __initdata; |
4165 | static char ftrace_graph_notrace_buf[FTRACE_FILTER_SIZE] __initdata; |
4166 | static int ftrace_graph_set_hash(struct ftrace_hash *hash, char *buffer); |
4167 | |
4168 | -static unsigned long save_global_trampoline; |
4169 | -static unsigned long save_global_flags; |
4170 | - |
4171 | static int __init set_graph_function(char *str) |
4172 | { |
4173 | strlcpy(ftrace_graph_buf, str, FTRACE_FILTER_SIZE); |
4174 | @@ -6756,17 +6753,6 @@ void unregister_ftrace_graph(void) |
4175 | unregister_pm_notifier(&ftrace_suspend_notifier); |
4176 | unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL); |
4177 | |
4178 | -#ifdef CONFIG_DYNAMIC_FTRACE |
4179 | - /* |
4180 | - * Function graph does not allocate the trampoline, but |
4181 | - * other global_ops do. We need to reset the ALLOC_TRAMP flag |
4182 | - * if one was used. |
4183 | - */ |
4184 | - global_ops.trampoline = save_global_trampoline; |
4185 | - if (save_global_flags & FTRACE_OPS_FL_ALLOC_TRAMP) |
4186 | - global_ops.flags |= FTRACE_OPS_FL_ALLOC_TRAMP; |
4187 | -#endif |
4188 | - |
4189 | out: |
4190 | mutex_unlock(&ftrace_lock); |
4191 | } |
4192 | diff --git a/lib/ratelimit.c b/lib/ratelimit.c |
4193 | index 08f8043cac61..d01f47135239 100644 |
4194 | --- a/lib/ratelimit.c |
4195 | +++ b/lib/ratelimit.c |
4196 | @@ -48,7 +48,9 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func) |
4197 | if (time_is_before_jiffies(rs->begin + rs->interval)) { |
4198 | if (rs->missed) { |
4199 | if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) { |
4200 | - pr_warn("%s: %d callbacks suppressed\n", func, rs->missed); |
4201 | + printk_deferred(KERN_WARNING |
4202 | + "%s: %d callbacks suppressed\n", |
4203 | + func, rs->missed); |
4204 | rs->missed = 0; |
4205 | } |
4206 | } |
4207 | diff --git a/mm/ksm.c b/mm/ksm.c |
4208 | index db20f8436bc3..86f0db3d6cdb 100644 |
4209 | --- a/mm/ksm.c |
4210 | +++ b/mm/ksm.c |
4211 | @@ -1990,6 +1990,7 @@ static void stable_tree_append(struct rmap_item *rmap_item, |
4212 | */ |
4213 | static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item) |
4214 | { |
4215 | + struct mm_struct *mm = rmap_item->mm; |
4216 | struct rmap_item *tree_rmap_item; |
4217 | struct page *tree_page = NULL; |
4218 | struct stable_node *stable_node; |
4219 | @@ -2062,9 +2063,11 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item) |
4220 | if (ksm_use_zero_pages && (checksum == zero_checksum)) { |
4221 | struct vm_area_struct *vma; |
4222 | |
4223 | - vma = find_mergeable_vma(rmap_item->mm, rmap_item->address); |
4224 | + down_read(&mm->mmap_sem); |
4225 | + vma = find_mergeable_vma(mm, rmap_item->address); |
4226 | err = try_to_merge_one_page(vma, page, |
4227 | ZERO_PAGE(rmap_item->address)); |
4228 | + up_read(&mm->mmap_sem); |
4229 | /* |
4230 | * In case of failure, the page was not really empty, so we |
4231 | * need to continue. Otherwise we're done. |
4232 | diff --git a/mm/madvise.c b/mm/madvise.c |
4233 | index 4d7d1e5ddba9..4edca1d86339 100644 |
4234 | --- a/mm/madvise.c |
4235 | +++ b/mm/madvise.c |
4236 | @@ -614,18 +614,26 @@ static int madvise_inject_error(int behavior, |
4237 | { |
4238 | struct page *page; |
4239 | struct zone *zone; |
4240 | + unsigned int order; |
4241 | |
4242 | if (!capable(CAP_SYS_ADMIN)) |
4243 | return -EPERM; |
4244 | |
4245 | - for (; start < end; start += PAGE_SIZE << |
4246 | - compound_order(compound_head(page))) { |
4247 | + |
4248 | + for (; start < end; start += PAGE_SIZE << order) { |
4249 | int ret; |
4250 | |
4251 | ret = get_user_pages_fast(start, 1, 0, &page); |
4252 | if (ret != 1) |
4253 | return ret; |
4254 | |
4255 | + /* |
4256 | + * When soft offlining hugepages, after migrating the page |
4257 | + * we dissolve it, therefore in the second loop "page" will |
4258 | + * no longer be a compound page, and order will be 0. |
4259 | + */ |
4260 | + order = compound_order(compound_head(page)); |
4261 | + |
4262 | if (PageHWPoison(page)) { |
4263 | put_page(page); |
4264 | continue; |
4265 | diff --git a/mm/oom_kill.c b/mm/oom_kill.c |
4266 | index 9e8b4f030c1c..5f6a52903770 100644 |
4267 | --- a/mm/oom_kill.c |
4268 | +++ b/mm/oom_kill.c |
4269 | @@ -40,6 +40,7 @@ |
4270 | #include <linux/ratelimit.h> |
4271 | #include <linux/kthread.h> |
4272 | #include <linux/init.h> |
4273 | +#include <linux/mmu_notifier.h> |
4274 | |
4275 | #include <asm/tlb.h> |
4276 | #include "internal.h" |
4277 | @@ -494,6 +495,21 @@ static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) |
4278 | goto unlock_oom; |
4279 | } |
4280 | |
4281 | + /* |
4282 | + * If the mm has notifiers then we would need to invalidate them around |
4283 | + * unmap_page_range and that is risky because notifiers can sleep and |
4284 | + * what they do is basically undeterministic. So let's have a short |
4285 | + * sleep to give the oom victim some more time. |
4286 | + * TODO: we really want to get rid of this ugly hack and make sure that |
4287 | + * notifiers cannot block for unbounded amount of time and add |
4288 | + * mmu_notifier_invalidate_range_{start,end} around unmap_page_range |
4289 | + */ |
4290 | + if (mm_has_notifiers(mm)) { |
4291 | + up_read(&mm->mmap_sem); |
4292 | + schedule_timeout_idle(HZ); |
4293 | + goto unlock_oom; |
4294 | + } |
4295 | + |
4296 | /* |
4297 | * increase mm_users only after we know we will reap something so |
4298 | * that the mmput_async is called only when we have reaped something |
4299 | diff --git a/mm/rodata_test.c b/mm/rodata_test.c |
4300 | index 6bb4deb12e78..d908c8769b48 100644 |
4301 | --- a/mm/rodata_test.c |
4302 | +++ b/mm/rodata_test.c |
4303 | @@ -14,7 +14,7 @@ |
4304 | #include <linux/uaccess.h> |
4305 | #include <asm/sections.h> |
4306 | |
4307 | -const int rodata_test_data = 0xC3; |
4308 | +static const int rodata_test_data = 0xC3; |
4309 | |
4310 | void rodata_test(void) |
4311 | { |
4312 | diff --git a/mm/swap.c b/mm/swap.c |
4313 | index 60b1d2a75852..ea84f04d75a4 100644 |
4314 | --- a/mm/swap.c |
4315 | +++ b/mm/swap.c |
4316 | @@ -575,7 +575,7 @@ static void lru_lazyfree_fn(struct page *page, struct lruvec *lruvec, |
4317 | void *arg) |
4318 | { |
4319 | if (PageLRU(page) && PageAnon(page) && PageSwapBacked(page) && |
4320 | - !PageUnevictable(page)) { |
4321 | + !PageSwapCache(page) && !PageUnevictable(page)) { |
4322 | bool active = PageActive(page); |
4323 | |
4324 | del_page_from_lru_list(page, lruvec, |
4325 | @@ -665,7 +665,7 @@ void deactivate_file_page(struct page *page) |
4326 | void mark_page_lazyfree(struct page *page) |
4327 | { |
4328 | if (PageLRU(page) && PageAnon(page) && PageSwapBacked(page) && |
4329 | - !PageUnevictable(page)) { |
4330 | + !PageSwapCache(page) && !PageUnevictable(page)) { |
4331 | struct pagevec *pvec = &get_cpu_var(lru_lazyfree_pvecs); |
4332 | |
4333 | get_page(page); |
4334 | diff --git a/mm/swap_state.c b/mm/swap_state.c |
4335 | index b68c93014f50..fe9309ba948c 100644 |
4336 | --- a/mm/swap_state.c |
4337 | +++ b/mm/swap_state.c |
4338 | @@ -219,6 +219,17 @@ int add_to_swap(struct page *page) |
4339 | * clear SWAP_HAS_CACHE flag. |
4340 | */ |
4341 | goto fail; |
4342 | + /* |
4343 | + * Normally the page will be dirtied in unmap because its pte should be |
4344 | + * dirty. A special case is MADV_FREE page. The page'e pte could have |
4345 | + * dirty bit cleared but the page's SwapBacked bit is still set because |
4346 | + * clearing the dirty bit and SwapBacked bit has no lock protected. For |
4347 | + * such page, unmap will not set dirty bit for it, so page reclaim will |
4348 | + * not write the page out. This can cause data corruption when the page |
4349 | + * is swap in later. Always setting the dirty bit for the page solves |
4350 | + * the problem. |
4351 | + */ |
4352 | + set_page_dirty(page); |
4353 | |
4354 | return 1; |
4355 | |
4356 | diff --git a/net/core/dev.c b/net/core/dev.c |
4357 | index 86b4b0a79e7a..6fa30a4c60ef 100644 |
4358 | --- a/net/core/dev.c |
4359 | +++ b/net/core/dev.c |
4360 | @@ -4408,6 +4408,7 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb, |
4361 | __skb_pull(skb, off); |
4362 | else if (off < 0) |
4363 | __skb_push(skb, -off); |
4364 | + skb->mac_header += off; |
4365 | |
4366 | switch (act) { |
4367 | case XDP_TX: |
4368 | diff --git a/net/core/filter.c b/net/core/filter.c |
4369 | index 169974998c76..18d591f1ae5a 100644 |
4370 | --- a/net/core/filter.c |
4371 | +++ b/net/core/filter.c |
4372 | @@ -975,10 +975,14 @@ static bool __sk_filter_charge(struct sock *sk, struct sk_filter *fp) |
4373 | |
4374 | bool sk_filter_charge(struct sock *sk, struct sk_filter *fp) |
4375 | { |
4376 | - bool ret = __sk_filter_charge(sk, fp); |
4377 | - if (ret) |
4378 | - refcount_inc(&fp->refcnt); |
4379 | - return ret; |
4380 | + if (!refcount_inc_not_zero(&fp->refcnt)) |
4381 | + return false; |
4382 | + |
4383 | + if (!__sk_filter_charge(sk, fp)) { |
4384 | + sk_filter_release(fp); |
4385 | + return false; |
4386 | + } |
4387 | + return true; |
4388 | } |
4389 | |
4390 | static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp) |
4391 | diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c |
4392 | index 0385dece1f6f..7c1ffd6f9501 100644 |
4393 | --- a/net/core/gen_estimator.c |
4394 | +++ b/net/core/gen_estimator.c |
4395 | @@ -83,10 +83,10 @@ static void est_timer(unsigned long arg) |
4396 | u64 rate, brate; |
4397 | |
4398 | est_fetch_counters(est, &b); |
4399 | - brate = (b.bytes - est->last_bytes) << (8 - est->ewma_log); |
4400 | + brate = (b.bytes - est->last_bytes) << (10 - est->ewma_log - est->intvl_log); |
4401 | brate -= (est->avbps >> est->ewma_log); |
4402 | |
4403 | - rate = (u64)(b.packets - est->last_packets) << (8 - est->ewma_log); |
4404 | + rate = (u64)(b.packets - est->last_packets) << (10 - est->ewma_log - est->intvl_log); |
4405 | rate -= (est->avpps >> est->ewma_log); |
4406 | |
4407 | write_seqcount_begin(&est->seq); |
4408 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
4409 | index 9201e3621351..e07c8847c6cf 100644 |
4410 | --- a/net/core/rtnetlink.c |
4411 | +++ b/net/core/rtnetlink.c |
4412 | @@ -3867,6 +3867,9 @@ static int rtnl_fill_statsinfo(struct sk_buff *skb, struct net_device *dev, |
4413 | return -EMSGSIZE; |
4414 | |
4415 | ifsm = nlmsg_data(nlh); |
4416 | + ifsm->family = PF_UNSPEC; |
4417 | + ifsm->pad1 = 0; |
4418 | + ifsm->pad2 = 0; |
4419 | ifsm->ifindex = dev->ifindex; |
4420 | ifsm->filter_mask = filter_mask; |
4421 | |
4422 | diff --git a/net/core/sock.c b/net/core/sock.c |
4423 | index ac2a404c73eb..0967da925022 100644 |
4424 | --- a/net/core/sock.c |
4425 | +++ b/net/core/sock.c |
4426 | @@ -1646,6 +1646,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) |
4427 | |
4428 | sock_copy(newsk, sk); |
4429 | |
4430 | + newsk->sk_prot_creator = sk->sk_prot; |
4431 | + |
4432 | /* SANITY */ |
4433 | if (likely(newsk->sk_net_refcnt)) |
4434 | get_net(sock_net(newsk)); |
4435 | @@ -1673,13 +1675,16 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) |
4436 | |
4437 | sock_reset_flag(newsk, SOCK_DONE); |
4438 | |
4439 | - filter = rcu_dereference_protected(newsk->sk_filter, 1); |
4440 | + rcu_read_lock(); |
4441 | + filter = rcu_dereference(sk->sk_filter); |
4442 | if (filter != NULL) |
4443 | /* though it's an empty new sock, the charging may fail |
4444 | * if sysctl_optmem_max was changed between creation of |
4445 | * original socket and cloning |
4446 | */ |
4447 | is_charged = sk_filter_charge(newsk, filter); |
4448 | + RCU_INIT_POINTER(newsk->sk_filter, filter); |
4449 | + rcu_read_unlock(); |
4450 | |
4451 | if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) { |
4452 | /* We need to make sure that we don't uncharge the new |
4453 | diff --git a/net/dsa/slave.c b/net/dsa/slave.c |
4454 | index 9507bd38cf04..07677540129a 100644 |
4455 | --- a/net/dsa/slave.c |
4456 | +++ b/net/dsa/slave.c |
4457 | @@ -1180,26 +1180,32 @@ int dsa_slave_create(struct dsa_switch *ds, struct device *parent, |
4458 | p->old_duplex = -1; |
4459 | |
4460 | ds->ports[port].netdev = slave_dev; |
4461 | - ret = register_netdev(slave_dev); |
4462 | - if (ret) { |
4463 | - netdev_err(master, "error %d registering interface %s\n", |
4464 | - ret, slave_dev->name); |
4465 | - ds->ports[port].netdev = NULL; |
4466 | - free_netdev(slave_dev); |
4467 | - return ret; |
4468 | - } |
4469 | |
4470 | netif_carrier_off(slave_dev); |
4471 | |
4472 | ret = dsa_slave_phy_setup(p, slave_dev); |
4473 | if (ret) { |
4474 | netdev_err(master, "error %d setting up slave phy\n", ret); |
4475 | - unregister_netdev(slave_dev); |
4476 | - free_netdev(slave_dev); |
4477 | - return ret; |
4478 | + goto out_free; |
4479 | + } |
4480 | + |
4481 | + ret = register_netdev(slave_dev); |
4482 | + if (ret) { |
4483 | + netdev_err(master, "error %d registering interface %s\n", |
4484 | + ret, slave_dev->name); |
4485 | + goto out_phy; |
4486 | } |
4487 | |
4488 | return 0; |
4489 | + |
4490 | +out_phy: |
4491 | + phy_disconnect(p->phy); |
4492 | + if (of_phy_is_fixed_link(p->dp->dn)) |
4493 | + of_phy_deregister_fixed_link(p->dp->dn); |
4494 | +out_free: |
4495 | + free_netdev(slave_dev); |
4496 | + ds->ports[port].netdev = NULL; |
4497 | + return ret; |
4498 | } |
4499 | |
4500 | void dsa_slave_destroy(struct net_device *slave_dev) |
4501 | diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c |
4502 | index fa2dc8f692c6..57fc13c6ab2b 100644 |
4503 | --- a/net/ipv4/ip_input.c |
4504 | +++ b/net/ipv4/ip_input.c |
4505 | @@ -311,9 +311,10 @@ static inline bool ip_rcv_options(struct sk_buff *skb) |
4506 | static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb) |
4507 | { |
4508 | const struct iphdr *iph = ip_hdr(skb); |
4509 | - struct rtable *rt; |
4510 | + int (*edemux)(struct sk_buff *skb); |
4511 | struct net_device *dev = skb->dev; |
4512 | - void (*edemux)(struct sk_buff *skb); |
4513 | + struct rtable *rt; |
4514 | + int err; |
4515 | |
4516 | /* if ingress device is enslaved to an L3 master device pass the |
4517 | * skb to its handler for processing |
4518 | @@ -331,7 +332,9 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb) |
4519 | |
4520 | ipprot = rcu_dereference(inet_protos[protocol]); |
4521 | if (ipprot && (edemux = READ_ONCE(ipprot->early_demux))) { |
4522 | - edemux(skb); |
4523 | + err = edemux(skb); |
4524 | + if (unlikely(err)) |
4525 | + goto drop_error; |
4526 | /* must reload iph, skb->head might have changed */ |
4527 | iph = ip_hdr(skb); |
4528 | } |
4529 | @@ -342,13 +345,10 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb) |
4530 | * how the packet travels inside Linux networking. |
4531 | */ |
4532 | if (!skb_valid_dst(skb)) { |
4533 | - int err = ip_route_input_noref(skb, iph->daddr, iph->saddr, |
4534 | - iph->tos, dev); |
4535 | - if (unlikely(err)) { |
4536 | - if (err == -EXDEV) |
4537 | - __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER); |
4538 | - goto drop; |
4539 | - } |
4540 | + err = ip_route_input_noref(skb, iph->daddr, iph->saddr, |
4541 | + iph->tos, dev); |
4542 | + if (unlikely(err)) |
4543 | + goto drop_error; |
4544 | } |
4545 | |
4546 | #ifdef CONFIG_IP_ROUTE_CLASSID |
4547 | @@ -399,6 +399,11 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb) |
4548 | drop: |
4549 | kfree_skb(skb); |
4550 | return NET_RX_DROP; |
4551 | + |
4552 | +drop_error: |
4553 | + if (err == -EXDEV) |
4554 | + __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER); |
4555 | + goto drop; |
4556 | } |
4557 | |
4558 | /* |
4559 | diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c |
4560 | index 0192c255e508..74bd46c5bda7 100644 |
4561 | --- a/net/ipv4/ip_vti.c |
4562 | +++ b/net/ipv4/ip_vti.c |
4563 | @@ -168,6 +168,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, |
4564 | struct ip_tunnel_parm *parms = &tunnel->parms; |
4565 | struct dst_entry *dst = skb_dst(skb); |
4566 | struct net_device *tdev; /* Device to other host */ |
4567 | + int pkt_len = skb->len; |
4568 | int err; |
4569 | int mtu; |
4570 | |
4571 | @@ -229,7 +230,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, |
4572 | |
4573 | err = dst_output(tunnel->net, skb->sk, skb); |
4574 | if (net_xmit_eval(err) == 0) |
4575 | - err = skb->len; |
4576 | + err = pkt_len; |
4577 | iptunnel_xmit_stats(dev, err); |
4578 | return NETDEV_TX_OK; |
4579 | |
4580 | diff --git a/net/ipv4/route.c b/net/ipv4/route.c |
4581 | index 2331de20ca50..c5aa25be7108 100644 |
4582 | --- a/net/ipv4/route.c |
4583 | +++ b/net/ipv4/route.c |
4584 | @@ -1520,43 +1520,56 @@ struct rtable *rt_dst_alloc(struct net_device *dev, |
4585 | EXPORT_SYMBOL(rt_dst_alloc); |
4586 | |
4587 | /* called in rcu_read_lock() section */ |
4588 | -static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr, |
4589 | - u8 tos, struct net_device *dev, int our) |
4590 | +int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr, |
4591 | + u8 tos, struct net_device *dev, |
4592 | + struct in_device *in_dev, u32 *itag) |
4593 | { |
4594 | - struct rtable *rth; |
4595 | - struct in_device *in_dev = __in_dev_get_rcu(dev); |
4596 | - unsigned int flags = RTCF_MULTICAST; |
4597 | - u32 itag = 0; |
4598 | int err; |
4599 | |
4600 | /* Primary sanity checks. */ |
4601 | - |
4602 | if (!in_dev) |
4603 | return -EINVAL; |
4604 | |
4605 | if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) || |
4606 | skb->protocol != htons(ETH_P_IP)) |
4607 | - goto e_inval; |
4608 | + return -EINVAL; |
4609 | |
4610 | if (ipv4_is_loopback(saddr) && !IN_DEV_ROUTE_LOCALNET(in_dev)) |
4611 | - goto e_inval; |
4612 | + return -EINVAL; |
4613 | |
4614 | if (ipv4_is_zeronet(saddr)) { |
4615 | if (!ipv4_is_local_multicast(daddr)) |
4616 | - goto e_inval; |
4617 | + return -EINVAL; |
4618 | } else { |
4619 | err = fib_validate_source(skb, saddr, 0, tos, 0, dev, |
4620 | - in_dev, &itag); |
4621 | + in_dev, itag); |
4622 | if (err < 0) |
4623 | - goto e_err; |
4624 | + return err; |
4625 | } |
4626 | + return 0; |
4627 | +} |
4628 | + |
4629 | +/* called in rcu_read_lock() section */ |
4630 | +static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr, |
4631 | + u8 tos, struct net_device *dev, int our) |
4632 | +{ |
4633 | + struct in_device *in_dev = __in_dev_get_rcu(dev); |
4634 | + unsigned int flags = RTCF_MULTICAST; |
4635 | + struct rtable *rth; |
4636 | + u32 itag = 0; |
4637 | + int err; |
4638 | + |
4639 | + err = ip_mc_validate_source(skb, daddr, saddr, tos, dev, in_dev, &itag); |
4640 | + if (err) |
4641 | + return err; |
4642 | + |
4643 | if (our) |
4644 | flags |= RTCF_LOCAL; |
4645 | |
4646 | rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST, |
4647 | IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false); |
4648 | if (!rth) |
4649 | - goto e_nobufs; |
4650 | + return -ENOBUFS; |
4651 | |
4652 | #ifdef CONFIG_IP_ROUTE_CLASSID |
4653 | rth->dst.tclassid = itag; |
4654 | @@ -1572,13 +1585,6 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr, |
4655 | |
4656 | skb_dst_set(skb, &rth->dst); |
4657 | return 0; |
4658 | - |
4659 | -e_nobufs: |
4660 | - return -ENOBUFS; |
4661 | -e_inval: |
4662 | - return -EINVAL; |
4663 | -e_err: |
4664 | - return err; |
4665 | } |
4666 | |
4667 | |
4668 | diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c |
4669 | index 21022db7a2a6..b1441bc8192f 100644 |
4670 | --- a/net/ipv4/tcp_ipv4.c |
4671 | +++ b/net/ipv4/tcp_ipv4.c |
4672 | @@ -1504,23 +1504,23 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) |
4673 | } |
4674 | EXPORT_SYMBOL(tcp_v4_do_rcv); |
4675 | |
4676 | -void tcp_v4_early_demux(struct sk_buff *skb) |
4677 | +int tcp_v4_early_demux(struct sk_buff *skb) |
4678 | { |
4679 | const struct iphdr *iph; |
4680 | const struct tcphdr *th; |
4681 | struct sock *sk; |
4682 | |
4683 | if (skb->pkt_type != PACKET_HOST) |
4684 | - return; |
4685 | + return 0; |
4686 | |
4687 | if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr))) |
4688 | - return; |
4689 | + return 0; |
4690 | |
4691 | iph = ip_hdr(skb); |
4692 | th = tcp_hdr(skb); |
4693 | |
4694 | if (th->doff < sizeof(struct tcphdr) / 4) |
4695 | - return; |
4696 | + return 0; |
4697 | |
4698 | sk = __inet_lookup_established(dev_net(skb->dev), &tcp_hashinfo, |
4699 | iph->saddr, th->source, |
4700 | @@ -1539,6 +1539,7 @@ void tcp_v4_early_demux(struct sk_buff *skb) |
4701 | skb_dst_set_noref(skb, dst); |
4702 | } |
4703 | } |
4704 | + return 0; |
4705 | } |
4706 | |
4707 | /* Packet is added to VJ-style prequeue for processing in process |
4708 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
4709 | index b7661a68d498..40f7c8ee9ba6 100644 |
4710 | --- a/net/ipv4/tcp_output.c |
4711 | +++ b/net/ipv4/tcp_output.c |
4712 | @@ -991,6 +991,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, |
4713 | struct tcp_skb_cb *tcb; |
4714 | struct tcp_out_options opts; |
4715 | unsigned int tcp_options_size, tcp_header_size; |
4716 | + struct sk_buff *oskb = NULL; |
4717 | struct tcp_md5sig_key *md5; |
4718 | struct tcphdr *th; |
4719 | int err; |
4720 | @@ -998,12 +999,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, |
4721 | BUG_ON(!skb || !tcp_skb_pcount(skb)); |
4722 | tp = tcp_sk(sk); |
4723 | |
4724 | - skb->skb_mstamp = tp->tcp_mstamp; |
4725 | if (clone_it) { |
4726 | TCP_SKB_CB(skb)->tx.in_flight = TCP_SKB_CB(skb)->end_seq |
4727 | - tp->snd_una; |
4728 | - tcp_rate_skb_sent(sk, skb); |
4729 | - |
4730 | + oskb = skb; |
4731 | if (unlikely(skb_cloned(skb))) |
4732 | skb = pskb_copy(skb, gfp_mask); |
4733 | else |
4734 | @@ -1011,6 +1010,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, |
4735 | if (unlikely(!skb)) |
4736 | return -ENOBUFS; |
4737 | } |
4738 | + skb->skb_mstamp = tp->tcp_mstamp; |
4739 | |
4740 | inet = inet_sk(sk); |
4741 | tcb = TCP_SKB_CB(skb); |
4742 | @@ -1122,12 +1122,15 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, |
4743 | |
4744 | err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl); |
4745 | |
4746 | - if (likely(err <= 0)) |
4747 | - return err; |
4748 | - |
4749 | - tcp_enter_cwr(sk); |
4750 | - |
4751 | - return net_xmit_eval(err); |
4752 | + if (unlikely(err > 0)) { |
4753 | + tcp_enter_cwr(sk); |
4754 | + err = net_xmit_eval(err); |
4755 | + } |
4756 | + if (!err && oskb) { |
4757 | + oskb->skb_mstamp = tp->tcp_mstamp; |
4758 | + tcp_rate_skb_sent(sk, oskb); |
4759 | + } |
4760 | + return err; |
4761 | } |
4762 | |
4763 | /* This routine just queues the buffer for sending. |
4764 | @@ -2866,10 +2869,11 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) |
4765 | skb_headroom(skb) >= 0xFFFF)) { |
4766 | struct sk_buff *nskb; |
4767 | |
4768 | - skb->skb_mstamp = tp->tcp_mstamp; |
4769 | nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC); |
4770 | err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) : |
4771 | -ENOBUFS; |
4772 | + if (!err) |
4773 | + skb->skb_mstamp = tp->tcp_mstamp; |
4774 | } else { |
4775 | err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC); |
4776 | } |
4777 | @@ -3416,6 +3420,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) |
4778 | goto done; |
4779 | } |
4780 | |
4781 | + /* data was not sent, this is our new send_head */ |
4782 | + sk->sk_send_head = syn_data; |
4783 | + tp->packets_out -= tcp_skb_pcount(syn_data); |
4784 | + |
4785 | fallback: |
4786 | /* Send a regular SYN with Fast Open cookie request option */ |
4787 | if (fo->cookie.len > 0) |
4788 | @@ -3468,6 +3476,11 @@ int tcp_connect(struct sock *sk) |
4789 | */ |
4790 | tp->snd_nxt = tp->write_seq; |
4791 | tp->pushed_seq = tp->write_seq; |
4792 | + buff = tcp_send_head(sk); |
4793 | + if (unlikely(buff)) { |
4794 | + tp->snd_nxt = TCP_SKB_CB(buff)->seq; |
4795 | + tp->pushed_seq = TCP_SKB_CB(buff)->seq; |
4796 | + } |
4797 | TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS); |
4798 | |
4799 | /* Timer for repeating the SYN until an answer. */ |
4800 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
4801 | index 979e4d8526ba..84861d71face 100644 |
4802 | --- a/net/ipv4/udp.c |
4803 | +++ b/net/ipv4/udp.c |
4804 | @@ -2217,9 +2217,10 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net, |
4805 | return NULL; |
4806 | } |
4807 | |
4808 | -void udp_v4_early_demux(struct sk_buff *skb) |
4809 | +int udp_v4_early_demux(struct sk_buff *skb) |
4810 | { |
4811 | struct net *net = dev_net(skb->dev); |
4812 | + struct in_device *in_dev = NULL; |
4813 | const struct iphdr *iph; |
4814 | const struct udphdr *uh; |
4815 | struct sock *sk = NULL; |
4816 | @@ -2229,25 +2230,21 @@ void udp_v4_early_demux(struct sk_buff *skb) |
4817 | |
4818 | /* validate the packet */ |
4819 | if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr))) |
4820 | - return; |
4821 | + return 0; |
4822 | |
4823 | iph = ip_hdr(skb); |
4824 | uh = udp_hdr(skb); |
4825 | |
4826 | - if (skb->pkt_type == PACKET_BROADCAST || |
4827 | - skb->pkt_type == PACKET_MULTICAST) { |
4828 | - struct in_device *in_dev = __in_dev_get_rcu(skb->dev); |
4829 | + if (skb->pkt_type == PACKET_MULTICAST) { |
4830 | + in_dev = __in_dev_get_rcu(skb->dev); |
4831 | |
4832 | if (!in_dev) |
4833 | - return; |
4834 | + return 0; |
4835 | |
4836 | - /* we are supposed to accept bcast packets */ |
4837 | - if (skb->pkt_type == PACKET_MULTICAST) { |
4838 | - ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, |
4839 | - iph->protocol); |
4840 | - if (!ours) |
4841 | - return; |
4842 | - } |
4843 | + ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, |
4844 | + iph->protocol); |
4845 | + if (!ours) |
4846 | + return 0; |
4847 | |
4848 | sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr, |
4849 | uh->source, iph->saddr, dif); |
4850 | @@ -2257,7 +2254,7 @@ void udp_v4_early_demux(struct sk_buff *skb) |
4851 | } |
4852 | |
4853 | if (!sk || !refcount_inc_not_zero(&sk->sk_refcnt)) |
4854 | - return; |
4855 | + return 0; |
4856 | |
4857 | skb->sk = sk; |
4858 | skb->destructor = sock_efree; |
4859 | @@ -2266,12 +2263,23 @@ void udp_v4_early_demux(struct sk_buff *skb) |
4860 | if (dst) |
4861 | dst = dst_check(dst, 0); |
4862 | if (dst) { |
4863 | + u32 itag = 0; |
4864 | + |
4865 | /* set noref for now. |
4866 | * any place which wants to hold dst has to call |
4867 | * dst_hold_safe() |
4868 | */ |
4869 | skb_dst_set_noref(skb, dst); |
4870 | + |
4871 | + /* for unconnected multicast sockets we need to validate |
4872 | + * the source on each packet |
4873 | + */ |
4874 | + if (!inet_sk(sk)->inet_daddr && in_dev) |
4875 | + return ip_mc_validate_source(skb, iph->daddr, |
4876 | + iph->saddr, iph->tos, |
4877 | + skb->dev, in_dev, &itag); |
4878 | } |
4879 | + return 0; |
4880 | } |
4881 | |
4882 | int udp_rcv(struct sk_buff *skb) |
4883 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c |
4884 | index 936e9ab4dda5..ba757c28a301 100644 |
4885 | --- a/net/ipv6/addrconf.c |
4886 | +++ b/net/ipv6/addrconf.c |
4887 | @@ -4982,9 +4982,10 @@ static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa) |
4888 | |
4889 | /* Don't send DELADDR notification for TENTATIVE address, |
4890 | * since NEWADDR notification is sent only after removing |
4891 | - * TENTATIVE flag. |
4892 | + * TENTATIVE flag, if DAD has not failed. |
4893 | */ |
4894 | - if (ifa->flags & IFA_F_TENTATIVE && event == RTM_DELADDR) |
4895 | + if (ifa->flags & IFA_F_TENTATIVE && !(ifa->flags & IFA_F_DADFAILED) && |
4896 | + event == RTM_DELADDR) |
4897 | return; |
4898 | |
4899 | skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC); |
4900 | diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c |
4901 | index b7a72d409334..1602b491b281 100644 |
4902 | --- a/net/ipv6/ip6_gre.c |
4903 | +++ b/net/ipv6/ip6_gre.c |
4904 | @@ -940,24 +940,25 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev, |
4905 | } |
4906 | |
4907 | static int ip6gre_header(struct sk_buff *skb, struct net_device *dev, |
4908 | - unsigned short type, |
4909 | - const void *daddr, const void *saddr, unsigned int len) |
4910 | + unsigned short type, const void *daddr, |
4911 | + const void *saddr, unsigned int len) |
4912 | { |
4913 | struct ip6_tnl *t = netdev_priv(dev); |
4914 | - struct ipv6hdr *ipv6h = skb_push(skb, t->hlen); |
4915 | - __be16 *p = (__be16 *)(ipv6h+1); |
4916 | + struct ipv6hdr *ipv6h; |
4917 | + __be16 *p; |
4918 | |
4919 | - ip6_flow_hdr(ipv6h, 0, |
4920 | - ip6_make_flowlabel(dev_net(dev), skb, |
4921 | - t->fl.u.ip6.flowlabel, true, |
4922 | - &t->fl.u.ip6)); |
4923 | + ipv6h = skb_push(skb, t->hlen + sizeof(*ipv6h)); |
4924 | + ip6_flow_hdr(ipv6h, 0, ip6_make_flowlabel(dev_net(dev), skb, |
4925 | + t->fl.u.ip6.flowlabel, |
4926 | + true, &t->fl.u.ip6)); |
4927 | ipv6h->hop_limit = t->parms.hop_limit; |
4928 | ipv6h->nexthdr = NEXTHDR_GRE; |
4929 | ipv6h->saddr = t->parms.laddr; |
4930 | ipv6h->daddr = t->parms.raddr; |
4931 | |
4932 | - p[0] = t->parms.o_flags; |
4933 | - p[1] = htons(type); |
4934 | + p = (__be16 *)(ipv6h + 1); |
4935 | + p[0] = t->parms.o_flags; |
4936 | + p[1] = htons(type); |
4937 | |
4938 | /* |
4939 | * Set the source hardware address. |
4940 | @@ -1310,6 +1311,7 @@ static void ip6gre_tap_setup(struct net_device *dev) |
4941 | dev->features |= NETIF_F_NETNS_LOCAL; |
4942 | dev->priv_flags &= ~IFF_TX_SKB_SHARING; |
4943 | dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; |
4944 | + netif_keep_dst(dev); |
4945 | } |
4946 | |
4947 | static bool ip6gre_netlink_encap_parms(struct nlattr *data[], |
4948 | diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c |
4949 | index 3a0ba2ae4b0f..4425b4411bb9 100644 |
4950 | --- a/net/ipv6/ip6_tunnel.c |
4951 | +++ b/net/ipv6/ip6_tunnel.c |
4952 | @@ -1043,6 +1043,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, |
4953 | struct dst_entry *dst = NULL, *ndst = NULL; |
4954 | struct net_device *tdev; |
4955 | int mtu; |
4956 | + unsigned int eth_hlen = t->dev->type == ARPHRD_ETHER ? ETH_HLEN : 0; |
4957 | unsigned int psh_hlen = sizeof(struct ipv6hdr) + t->encap_hlen; |
4958 | unsigned int max_headroom = psh_hlen; |
4959 | bool use_cache = false; |
4960 | @@ -1124,7 +1125,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, |
4961 | t->parms.name); |
4962 | goto tx_err_dst_release; |
4963 | } |
4964 | - mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen; |
4965 | + mtu = dst_mtu(dst) - eth_hlen - psh_hlen - t->tun_hlen; |
4966 | if (encap_limit >= 0) { |
4967 | max_headroom += 8; |
4968 | mtu -= 8; |
4969 | @@ -1133,7 +1134,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, |
4970 | mtu = IPV6_MIN_MTU; |
4971 | if (skb_dst(skb) && !t->parms.collect_md) |
4972 | skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); |
4973 | - if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) { |
4974 | + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { |
4975 | *pmtu = mtu; |
4976 | err = -EMSGSIZE; |
4977 | goto tx_err_dst_release; |
4978 | @@ -2258,6 +2259,9 @@ static int __init ip6_tunnel_init(void) |
4979 | { |
4980 | int err; |
4981 | |
4982 | + if (!ipv6_mod_enabled()) |
4983 | + return -EOPNOTSUPP; |
4984 | + |
4985 | err = register_pernet_device(&ip6_tnl_net_ops); |
4986 | if (err < 0) |
4987 | goto out_pernet; |
4988 | diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c |
4989 | index 486c2305f53c..e3e3ea655464 100644 |
4990 | --- a/net/ipv6/ip6_vti.c |
4991 | +++ b/net/ipv6/ip6_vti.c |
4992 | @@ -445,6 +445,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) |
4993 | struct dst_entry *dst = skb_dst(skb); |
4994 | struct net_device *tdev; |
4995 | struct xfrm_state *x; |
4996 | + int pkt_len = skb->len; |
4997 | int err = -1; |
4998 | int mtu; |
4999 | |
5000 | @@ -502,7 +503,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) |
5001 | struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); |
5002 | |
5003 | u64_stats_update_begin(&tstats->syncp); |
5004 | - tstats->tx_bytes += skb->len; |
5005 | + tstats->tx_bytes += pkt_len; |
5006 | tstats->tx_packets++; |
5007 | u64_stats_update_end(&tstats->syncp); |
5008 | } else { |
5009 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c |
5010 | index d6886228e1d0..30b4d55e88f3 100644 |
5011 | --- a/net/ipv6/udp.c |
5012 | +++ b/net/ipv6/udp.c |
5013 | @@ -1011,6 +1011,7 @@ static void udp6_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb, |
5014 | */ |
5015 | offset = skb_transport_offset(skb); |
5016 | skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); |
5017 | + csum = skb->csum; |
5018 | |
5019 | skb->ip_summed = CHECKSUM_NONE; |
5020 | |
5021 | diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c |
5022 | index 90165a6874bc..525c66f1121a 100644 |
5023 | --- a/net/l2tp/l2tp_core.c |
5024 | +++ b/net/l2tp/l2tp_core.c |
5025 | @@ -1665,14 +1665,12 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); |
5026 | |
5027 | /* This function is used by the netlink TUNNEL_DELETE command. |
5028 | */ |
5029 | -int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) |
5030 | +void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) |
5031 | { |
5032 | - l2tp_tunnel_inc_refcount(tunnel); |
5033 | - if (false == queue_work(l2tp_wq, &tunnel->del_work)) { |
5034 | - l2tp_tunnel_dec_refcount(tunnel); |
5035 | - return 1; |
5036 | + if (!test_and_set_bit(0, &tunnel->dead)) { |
5037 | + l2tp_tunnel_inc_refcount(tunnel); |
5038 | + queue_work(l2tp_wq, &tunnel->del_work); |
5039 | } |
5040 | - return 0; |
5041 | } |
5042 | EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); |
5043 | |
5044 | diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h |
5045 | index 9101297f27ad..7c5a51f62afc 100644 |
5046 | --- a/net/l2tp/l2tp_core.h |
5047 | +++ b/net/l2tp/l2tp_core.h |
5048 | @@ -160,6 +160,9 @@ struct l2tp_tunnel_cfg { |
5049 | |
5050 | struct l2tp_tunnel { |
5051 | int magic; /* Should be L2TP_TUNNEL_MAGIC */ |
5052 | + |
5053 | + unsigned long dead; |
5054 | + |
5055 | struct rcu_head rcu; |
5056 | rwlock_t hlist_lock; /* protect session_hlist */ |
5057 | struct hlist_head session_hlist[L2TP_HASH_SIZE]; |
5058 | @@ -248,7 +251,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, |
5059 | u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, |
5060 | struct l2tp_tunnel **tunnelp); |
5061 | void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel); |
5062 | -int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); |
5063 | +void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); |
5064 | struct l2tp_session *l2tp_session_create(int priv_size, |
5065 | struct l2tp_tunnel *tunnel, |
5066 | u32 session_id, u32 peer_session_id, |
5067 | diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c |
5068 | index 4de2ec94b08c..cf456720930c 100644 |
5069 | --- a/net/l2tp/l2tp_eth.c |
5070 | +++ b/net/l2tp/l2tp_eth.c |
5071 | @@ -44,7 +44,6 @@ struct l2tp_eth { |
5072 | struct net_device *dev; |
5073 | struct sock *tunnel_sock; |
5074 | struct l2tp_session *session; |
5075 | - struct list_head list; |
5076 | atomic_long_t tx_bytes; |
5077 | atomic_long_t tx_packets; |
5078 | atomic_long_t tx_dropped; |
5079 | @@ -58,17 +57,6 @@ struct l2tp_eth_sess { |
5080 | struct net_device *dev; |
5081 | }; |
5082 | |
5083 | -/* per-net private data for this module */ |
5084 | -static unsigned int l2tp_eth_net_id; |
5085 | -struct l2tp_eth_net { |
5086 | - struct list_head l2tp_eth_dev_list; |
5087 | - spinlock_t l2tp_eth_lock; |
5088 | -}; |
5089 | - |
5090 | -static inline struct l2tp_eth_net *l2tp_eth_pernet(struct net *net) |
5091 | -{ |
5092 | - return net_generic(net, l2tp_eth_net_id); |
5093 | -} |
5094 | |
5095 | static int l2tp_eth_dev_init(struct net_device *dev) |
5096 | { |
5097 | @@ -84,12 +72,6 @@ static int l2tp_eth_dev_init(struct net_device *dev) |
5098 | |
5099 | static void l2tp_eth_dev_uninit(struct net_device *dev) |
5100 | { |
5101 | - struct l2tp_eth *priv = netdev_priv(dev); |
5102 | - struct l2tp_eth_net *pn = l2tp_eth_pernet(dev_net(dev)); |
5103 | - |
5104 | - spin_lock(&pn->l2tp_eth_lock); |
5105 | - list_del_init(&priv->list); |
5106 | - spin_unlock(&pn->l2tp_eth_lock); |
5107 | dev_put(dev); |
5108 | } |
5109 | |
5110 | @@ -272,7 +254,6 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p |
5111 | struct l2tp_eth *priv; |
5112 | struct l2tp_eth_sess *spriv; |
5113 | int rc; |
5114 | - struct l2tp_eth_net *pn; |
5115 | |
5116 | tunnel = l2tp_tunnel_find(net, tunnel_id); |
5117 | if (!tunnel) { |
5118 | @@ -310,7 +291,6 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p |
5119 | priv = netdev_priv(dev); |
5120 | priv->dev = dev; |
5121 | priv->session = session; |
5122 | - INIT_LIST_HEAD(&priv->list); |
5123 | |
5124 | priv->tunnel_sock = tunnel->sock; |
5125 | session->recv_skb = l2tp_eth_dev_recv; |
5126 | @@ -331,10 +311,6 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p |
5127 | strlcpy(session->ifname, dev->name, IFNAMSIZ); |
5128 | |
5129 | dev_hold(dev); |
5130 | - pn = l2tp_eth_pernet(dev_net(dev)); |
5131 | - spin_lock(&pn->l2tp_eth_lock); |
5132 | - list_add(&priv->list, &pn->l2tp_eth_dev_list); |
5133 | - spin_unlock(&pn->l2tp_eth_lock); |
5134 | |
5135 | return 0; |
5136 | |
5137 | @@ -347,22 +323,6 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p |
5138 | return rc; |
5139 | } |
5140 | |
5141 | -static __net_init int l2tp_eth_init_net(struct net *net) |
5142 | -{ |
5143 | - struct l2tp_eth_net *pn = net_generic(net, l2tp_eth_net_id); |
5144 | - |
5145 | - INIT_LIST_HEAD(&pn->l2tp_eth_dev_list); |
5146 | - spin_lock_init(&pn->l2tp_eth_lock); |
5147 | - |
5148 | - return 0; |
5149 | -} |
5150 | - |
5151 | -static struct pernet_operations l2tp_eth_net_ops = { |
5152 | - .init = l2tp_eth_init_net, |
5153 | - .id = &l2tp_eth_net_id, |
5154 | - .size = sizeof(struct l2tp_eth_net), |
5155 | -}; |
5156 | - |
5157 | |
5158 | static const struct l2tp_nl_cmd_ops l2tp_eth_nl_cmd_ops = { |
5159 | .session_create = l2tp_eth_create, |
5160 | @@ -376,25 +336,18 @@ static int __init l2tp_eth_init(void) |
5161 | |
5162 | err = l2tp_nl_register_ops(L2TP_PWTYPE_ETH, &l2tp_eth_nl_cmd_ops); |
5163 | if (err) |
5164 | - goto out; |
5165 | - |
5166 | - err = register_pernet_device(&l2tp_eth_net_ops); |
5167 | - if (err) |
5168 | - goto out_unreg; |
5169 | + goto err; |
5170 | |
5171 | pr_info("L2TP ethernet pseudowire support (L2TPv3)\n"); |
5172 | |
5173 | return 0; |
5174 | |
5175 | -out_unreg: |
5176 | - l2tp_nl_unregister_ops(L2TP_PWTYPE_ETH); |
5177 | -out: |
5178 | +err: |
5179 | return err; |
5180 | } |
5181 | |
5182 | static void __exit l2tp_eth_exit(void) |
5183 | { |
5184 | - unregister_pernet_device(&l2tp_eth_net_ops); |
5185 | l2tp_nl_unregister_ops(L2TP_PWTYPE_ETH); |
5186 | } |
5187 | |
5188 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c |
5189 | index 5acee49db90b..7e794ad50cb0 100644 |
5190 | --- a/net/netlink/af_netlink.c |
5191 | +++ b/net/netlink/af_netlink.c |
5192 | @@ -2262,10 +2262,13 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, |
5193 | |
5194 | mutex_unlock(nlk->cb_mutex); |
5195 | |
5196 | + ret = 0; |
5197 | if (cb->start) |
5198 | - cb->start(cb); |
5199 | + ret = cb->start(cb); |
5200 | + |
5201 | + if (!ret) |
5202 | + ret = netlink_dump(sk); |
5203 | |
5204 | - ret = netlink_dump(sk); |
5205 | sock_put(sk); |
5206 | |
5207 | if (ret) |
5208 | diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c |
5209 | index 6b44fe405282..294444bb075c 100644 |
5210 | --- a/net/openvswitch/datapath.c |
5211 | +++ b/net/openvswitch/datapath.c |
5212 | @@ -1126,7 +1126,8 @@ static int ovs_nla_init_match_and_action(struct net *net, |
5213 | if (!a[OVS_FLOW_ATTR_KEY]) { |
5214 | OVS_NLERR(log, |
5215 | "Flow key attribute not present in set flow."); |
5216 | - return -EINVAL; |
5217 | + error = -EINVAL; |
5218 | + goto error; |
5219 | } |
5220 | |
5221 | *acts = get_flow_actions(net, a[OVS_FLOW_ATTR_ACTIONS], key, |
5222 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
5223 | index 1c61af9af67d..29d7b7e5b128 100644 |
5224 | --- a/net/packet/af_packet.c |
5225 | +++ b/net/packet/af_packet.c |
5226 | @@ -1686,10 +1686,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) |
5227 | |
5228 | mutex_lock(&fanout_mutex); |
5229 | |
5230 | - err = -EINVAL; |
5231 | - if (!po->running) |
5232 | - goto out; |
5233 | - |
5234 | err = -EALREADY; |
5235 | if (po->fanout) |
5236 | goto out; |
5237 | @@ -1751,7 +1747,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) |
5238 | list_add(&match->list, &fanout_list); |
5239 | } |
5240 | err = -EINVAL; |
5241 | - if (match->type == type && |
5242 | + |
5243 | + spin_lock(&po->bind_lock); |
5244 | + if (po->running && |
5245 | + match->type == type && |
5246 | match->prot_hook.type == po->prot_hook.type && |
5247 | match->prot_hook.dev == po->prot_hook.dev) { |
5248 | err = -ENOSPC; |
5249 | @@ -1763,6 +1762,13 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) |
5250 | err = 0; |
5251 | } |
5252 | } |
5253 | + spin_unlock(&po->bind_lock); |
5254 | + |
5255 | + if (err && !refcount_read(&match->sk_ref)) { |
5256 | + list_del(&match->list); |
5257 | + kfree(match); |
5258 | + } |
5259 | + |
5260 | out: |
5261 | if (err && rollover) { |
5262 | kfree(rollover); |
5263 | @@ -2836,6 +2842,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
5264 | struct virtio_net_hdr vnet_hdr = { 0 }; |
5265 | int offset = 0; |
5266 | struct packet_sock *po = pkt_sk(sk); |
5267 | + bool has_vnet_hdr = false; |
5268 | int hlen, tlen, linear; |
5269 | int extra_len = 0; |
5270 | |
5271 | @@ -2879,6 +2886,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
5272 | err = packet_snd_vnet_parse(msg, &len, &vnet_hdr); |
5273 | if (err) |
5274 | goto out_unlock; |
5275 | + has_vnet_hdr = true; |
5276 | } |
5277 | |
5278 | if (unlikely(sock_flag(sk, SOCK_NOFCS))) { |
5279 | @@ -2937,7 +2945,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
5280 | skb->priority = sk->sk_priority; |
5281 | skb->mark = sockc.mark; |
5282 | |
5283 | - if (po->has_vnet_hdr) { |
5284 | + if (has_vnet_hdr) { |
5285 | err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le()); |
5286 | if (err) |
5287 | goto out_free; |
5288 | @@ -3065,13 +3073,15 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, |
5289 | int ret = 0; |
5290 | bool unlisted = false; |
5291 | |
5292 | - if (po->fanout) |
5293 | - return -EINVAL; |
5294 | - |
5295 | lock_sock(sk); |
5296 | spin_lock(&po->bind_lock); |
5297 | rcu_read_lock(); |
5298 | |
5299 | + if (po->fanout) { |
5300 | + ret = -EINVAL; |
5301 | + goto out_unlock; |
5302 | + } |
5303 | + |
5304 | if (name) { |
5305 | dev = dev_get_by_name_rcu(sock_net(sk), name); |
5306 | if (!dev) { |
5307 | diff --git a/net/sched/act_api.c b/net/sched/act_api.c |
5308 | index f2e9ed34a963..0c5dbb172437 100644 |
5309 | --- a/net/sched/act_api.c |
5310 | +++ b/net/sched/act_api.c |
5311 | @@ -174,7 +174,7 @@ static int tcf_del_walker(struct tcf_hashinfo *hinfo, struct sk_buff *skb, |
5312 | hlist_for_each_entry_safe(p, n, head, tcfa_head) { |
5313 | ret = __tcf_hash_release(p, false, true); |
5314 | if (ret == ACT_P_DELETED) { |
5315 | - module_put(p->ops->owner); |
5316 | + module_put(ops->owner); |
5317 | n_i++; |
5318 | } else if (ret < 0) |
5319 | goto nla_put_failure; |
5320 | @@ -506,13 +506,15 @@ EXPORT_SYMBOL(tcf_action_exec); |
5321 | |
5322 | int tcf_action_destroy(struct list_head *actions, int bind) |
5323 | { |
5324 | + const struct tc_action_ops *ops; |
5325 | struct tc_action *a, *tmp; |
5326 | int ret = 0; |
5327 | |
5328 | list_for_each_entry_safe(a, tmp, actions, list) { |
5329 | + ops = a->ops; |
5330 | ret = __tcf_hash_release(a, bind, true); |
5331 | if (ret == ACT_P_DELETED) |
5332 | - module_put(a->ops->owner); |
5333 | + module_put(ops->owner); |
5334 | else if (ret < 0) |
5335 | return ret; |
5336 | } |
5337 | diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c |
5338 | index 9dc26c32cf32..d720f9376add 100644 |
5339 | --- a/net/sched/cls_matchall.c |
5340 | +++ b/net/sched/cls_matchall.c |
5341 | @@ -32,6 +32,7 @@ static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp, |
5342 | if (tc_skip_sw(head->flags)) |
5343 | return -1; |
5344 | |
5345 | + *res = head->res; |
5346 | return tcf_exts_exec(skb, &head->exts, res); |
5347 | } |
5348 | |
5349 | diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c |
5350 | index 4ba6da5fb254..ff49421ee48a 100644 |
5351 | --- a/net/sched/sch_generic.c |
5352 | +++ b/net/sched/sch_generic.c |
5353 | @@ -681,6 +681,7 @@ void qdisc_reset(struct Qdisc *qdisc) |
5354 | qdisc->gso_skb = NULL; |
5355 | } |
5356 | qdisc->q.qlen = 0; |
5357 | + qdisc->qstats.backlog = 0; |
5358 | } |
5359 | EXPORT_SYMBOL(qdisc_reset); |
5360 | |
5361 | diff --git a/net/tipc/msg.c b/net/tipc/msg.c |
5362 | index 6ef379f004ac..121e59a1d0e7 100644 |
5363 | --- a/net/tipc/msg.c |
5364 | +++ b/net/tipc/msg.c |
5365 | @@ -551,7 +551,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err) |
5366 | return false; |
5367 | if (msg_errcode(msg)) |
5368 | return false; |
5369 | - *err = -TIPC_ERR_NO_NAME; |
5370 | + *err = TIPC_ERR_NO_NAME; |
5371 | if (skb_linearize(skb)) |
5372 | return false; |
5373 | msg = buf_msg(skb); |
5374 | diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c |
5375 | index 750ba5d24a49..359b1f34c805 100644 |
5376 | --- a/net/wireless/nl80211.c |
5377 | +++ b/net/wireless/nl80211.c |
5378 | @@ -549,6 +549,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { |
5379 | [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, |
5380 | }; |
5381 | |
5382 | +/* policy for packet pattern attributes */ |
5383 | +static const struct nla_policy |
5384 | +nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { |
5385 | + [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, |
5386 | + [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, |
5387 | + [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, |
5388 | +}; |
5389 | + |
5390 | static int nl80211_prepare_wdev_dump(struct sk_buff *skb, |
5391 | struct netlink_callback *cb, |
5392 | struct cfg80211_registered_device **rdev, |
5393 | @@ -10529,7 +10537,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) |
5394 | u8 *mask_pat; |
5395 | |
5396 | nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, |
5397 | - NULL, info->extack); |
5398 | + nl80211_packet_pattern_policy, |
5399 | + info->extack); |
5400 | err = -EINVAL; |
5401 | if (!pat_tb[NL80211_PKTPAT_MASK] || |
5402 | !pat_tb[NL80211_PKTPAT_PATTERN]) |
5403 | @@ -10778,7 +10787,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, |
5404 | rem) { |
5405 | u8 *mask_pat; |
5406 | |
5407 | - nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL, NULL); |
5408 | + nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, |
5409 | + nl80211_packet_pattern_policy, NULL); |
5410 | if (!pat_tb[NL80211_PKTPAT_MASK] || |
5411 | !pat_tb[NL80211_PKTPAT_PATTERN]) |
5412 | return -EINVAL; |
5413 | diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c |
5414 | index 463af86812c7..a9e89177a346 100644 |
5415 | --- a/security/smack/smack_lsm.c |
5416 | +++ b/security/smack/smack_lsm.c |
5417 | @@ -1499,7 +1499,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) |
5418 | * @inode: the object |
5419 | * @name: attribute name |
5420 | * @buffer: where to put the result |
5421 | - * @alloc: unused |
5422 | + * @alloc: duplicate memory |
5423 | * |
5424 | * Returns the size of the attribute or an error code |
5425 | */ |
5426 | @@ -1512,43 +1512,38 @@ static int smack_inode_getsecurity(struct inode *inode, |
5427 | struct super_block *sbp; |
5428 | struct inode *ip = (struct inode *)inode; |
5429 | struct smack_known *isp; |
5430 | - int ilen; |
5431 | - int rc = 0; |
5432 | |
5433 | - if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { |
5434 | + if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) |
5435 | isp = smk_of_inode(inode); |
5436 | - ilen = strlen(isp->smk_known); |
5437 | - *buffer = isp->smk_known; |
5438 | - return ilen; |
5439 | - } |
5440 | + else { |
5441 | + /* |
5442 | + * The rest of the Smack xattrs are only on sockets. |
5443 | + */ |
5444 | + sbp = ip->i_sb; |
5445 | + if (sbp->s_magic != SOCKFS_MAGIC) |
5446 | + return -EOPNOTSUPP; |
5447 | |
5448 | - /* |
5449 | - * The rest of the Smack xattrs are only on sockets. |
5450 | - */ |
5451 | - sbp = ip->i_sb; |
5452 | - if (sbp->s_magic != SOCKFS_MAGIC) |
5453 | - return -EOPNOTSUPP; |
5454 | + sock = SOCKET_I(ip); |
5455 | + if (sock == NULL || sock->sk == NULL) |
5456 | + return -EOPNOTSUPP; |
5457 | |
5458 | - sock = SOCKET_I(ip); |
5459 | - if (sock == NULL || sock->sk == NULL) |
5460 | - return -EOPNOTSUPP; |
5461 | - |
5462 | - ssp = sock->sk->sk_security; |
5463 | + ssp = sock->sk->sk_security; |
5464 | |
5465 | - if (strcmp(name, XATTR_SMACK_IPIN) == 0) |
5466 | - isp = ssp->smk_in; |
5467 | - else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) |
5468 | - isp = ssp->smk_out; |
5469 | - else |
5470 | - return -EOPNOTSUPP; |
5471 | + if (strcmp(name, XATTR_SMACK_IPIN) == 0) |
5472 | + isp = ssp->smk_in; |
5473 | + else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) |
5474 | + isp = ssp->smk_out; |
5475 | + else |
5476 | + return -EOPNOTSUPP; |
5477 | + } |
5478 | |
5479 | - ilen = strlen(isp->smk_known); |
5480 | - if (rc == 0) { |
5481 | - *buffer = isp->smk_known; |
5482 | - rc = ilen; |
5483 | + if (alloc) { |
5484 | + *buffer = kstrdup(isp->smk_known, GFP_KERNEL); |
5485 | + if (*buffer == NULL) |
5486 | + return -ENOMEM; |
5487 | } |
5488 | |
5489 | - return rc; |
5490 | + return strlen(isp->smk_known); |
5491 | } |
5492 | |
5493 | |
5494 | diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c |
5495 | index fec1dfdb14ad..4490a699030b 100644 |
5496 | --- a/sound/core/compress_offload.c |
5497 | +++ b/sound/core/compress_offload.c |
5498 | @@ -948,14 +948,13 @@ static const struct file_operations snd_compr_file_ops = { |
5499 | static int snd_compress_dev_register(struct snd_device *device) |
5500 | { |
5501 | int ret = -EINVAL; |
5502 | - char str[16]; |
5503 | struct snd_compr *compr; |
5504 | |
5505 | if (snd_BUG_ON(!device || !device->device_data)) |
5506 | return -EBADFD; |
5507 | compr = device->device_data; |
5508 | |
5509 | - pr_debug("reg %s for device %s, direction %d\n", str, compr->name, |
5510 | + pr_debug("reg device %s, direction %d\n", compr->name, |
5511 | compr->direction); |
5512 | /* register compressed device */ |
5513 | ret = snd_register_device(SNDRV_DEVICE_TYPE_COMPRESS, |
5514 | diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c |
5515 | index d15ecf9febbf..e54f5f549e38 100644 |
5516 | --- a/sound/pci/echoaudio/echoaudio.c |
5517 | +++ b/sound/pci/echoaudio/echoaudio.c |
5518 | @@ -1272,11 +1272,11 @@ static int snd_echo_mixer_info(struct snd_kcontrol *kcontrol, |
5519 | |
5520 | chip = snd_kcontrol_chip(kcontrol); |
5521 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; |
5522 | + uinfo->count = 1; |
5523 | uinfo->value.integer.min = ECHOGAIN_MINOUT; |
5524 | uinfo->value.integer.max = ECHOGAIN_MAXOUT; |
5525 | uinfo->dimen.d[0] = num_busses_out(chip); |
5526 | uinfo->dimen.d[1] = num_busses_in(chip); |
5527 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1]; |
5528 | return 0; |
5529 | } |
5530 | |
5531 | @@ -1344,11 +1344,11 @@ static int snd_echo_vmixer_info(struct snd_kcontrol *kcontrol, |
5532 | |
5533 | chip = snd_kcontrol_chip(kcontrol); |
5534 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; |
5535 | + uinfo->count = 1; |
5536 | uinfo->value.integer.min = ECHOGAIN_MINOUT; |
5537 | uinfo->value.integer.max = ECHOGAIN_MAXOUT; |
5538 | uinfo->dimen.d[0] = num_busses_out(chip); |
5539 | uinfo->dimen.d[1] = num_pipes_out(chip); |
5540 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1]; |
5541 | return 0; |
5542 | } |
5543 | |
5544 | @@ -1728,6 +1728,7 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol, |
5545 | struct snd_ctl_elem_info *uinfo) |
5546 | { |
5547 | uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; |
5548 | + uinfo->count = 96; |
5549 | uinfo->value.integer.min = ECHOGAIN_MINOUT; |
5550 | uinfo->value.integer.max = 0; |
5551 | #ifdef ECHOCARD_HAS_VMIXER |
5552 | @@ -1737,7 +1738,6 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol, |
5553 | #endif |
5554 | uinfo->dimen.d[1] = 16; /* 16 channels */ |
5555 | uinfo->dimen.d[2] = 2; /* 0=level, 1=peak */ |
5556 | - uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1] * uinfo->dimen.d[2]; |
5557 | return 0; |
5558 | } |
5559 | |
5560 | diff --git a/sound/usb/card.c b/sound/usb/card.c |
5561 | index 6640277a725b..383facf2dc11 100644 |
5562 | --- a/sound/usb/card.c |
5563 | +++ b/sound/usb/card.c |
5564 | @@ -221,6 +221,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) |
5565 | struct usb_interface_descriptor *altsd; |
5566 | void *control_header; |
5567 | int i, protocol; |
5568 | + int rest_bytes; |
5569 | |
5570 | /* find audiocontrol interface */ |
5571 | host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0]; |
5572 | @@ -235,6 +236,15 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) |
5573 | return -EINVAL; |
5574 | } |
5575 | |
5576 | + rest_bytes = (void *)(host_iface->extra + host_iface->extralen) - |
5577 | + control_header; |
5578 | + |
5579 | + /* just to be sure -- this shouldn't hit at all */ |
5580 | + if (rest_bytes <= 0) { |
5581 | + dev_err(&dev->dev, "invalid control header\n"); |
5582 | + return -EINVAL; |
5583 | + } |
5584 | + |
5585 | switch (protocol) { |
5586 | default: |
5587 | dev_warn(&dev->dev, |
5588 | @@ -245,11 +255,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) |
5589 | case UAC_VERSION_1: { |
5590 | struct uac1_ac_header_descriptor *h1 = control_header; |
5591 | |
5592 | + if (rest_bytes < sizeof(*h1)) { |
5593 | + dev_err(&dev->dev, "too short v1 buffer descriptor\n"); |
5594 | + return -EINVAL; |
5595 | + } |
5596 | + |
5597 | if (!h1->bInCollection) { |
5598 | dev_info(&dev->dev, "skipping empty audio interface (v1)\n"); |
5599 | return -EINVAL; |
5600 | } |
5601 | |
5602 | + if (rest_bytes < h1->bLength) { |
5603 | + dev_err(&dev->dev, "invalid buffer length (v1)\n"); |
5604 | + return -EINVAL; |
5605 | + } |
5606 | + |
5607 | if (h1->bLength < sizeof(*h1) + h1->bInCollection) { |
5608 | dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n"); |
5609 | return -EINVAL; |
5610 | diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c |
5611 | index bf618e1500ac..e7b934f4d837 100644 |
5612 | --- a/sound/usb/usx2y/usb_stream.c |
5613 | +++ b/sound/usb/usx2y/usb_stream.c |
5614 | @@ -191,7 +191,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, |
5615 | } |
5616 | |
5617 | pg = get_order(read_size); |
5618 | - sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); |
5619 | + sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| |
5620 | + __GFP_NOWARN, pg); |
5621 | if (!sk->s) { |
5622 | snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); |
5623 | goto out; |
5624 | @@ -211,7 +212,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, |
5625 | pg = get_order(write_size); |
5626 | |
5627 | sk->write_page = |
5628 | - (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); |
5629 | + (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| |
5630 | + __GFP_NOWARN, pg); |
5631 | if (!sk->write_page) { |
5632 | snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); |
5633 | usb_stream_free(sk); |
5634 | diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c |
5635 | index d3ed7324105e..48c145eeeaf7 100644 |
5636 | --- a/tools/testing/selftests/bpf/test_verifier.c |
5637 | +++ b/tools/testing/selftests/bpf/test_verifier.c |
5638 | @@ -6009,6 +6009,22 @@ static struct bpf_test tests[] = { |
5639 | .result = REJECT, |
5640 | .result_unpriv = REJECT, |
5641 | }, |
5642 | + { |
5643 | + "invalid 64-bit BPF_END", |
5644 | + .insns = { |
5645 | + BPF_MOV32_IMM(BPF_REG_0, 0), |
5646 | + { |
5647 | + .code = BPF_ALU64 | BPF_END | BPF_TO_LE, |
5648 | + .dst_reg = BPF_REG_0, |
5649 | + .src_reg = 0, |
5650 | + .off = 0, |
5651 | + .imm = 32, |
5652 | + }, |
5653 | + BPF_EXIT_INSN(), |
5654 | + }, |
5655 | + .errstr = "BPF_END uses reserved fields", |
5656 | + .result = REJECT, |
5657 | + }, |
5658 | }; |
5659 | |
5660 | static int probe_filter_length(const struct bpf_insn *fp) |