Annotation of /trunk/kernel-magellan/patches-4.15/0105-4.15.6-all-fixes.patch
Parent Directory | Revision Log
Revision 3089 -
(hide annotations)
(download)
Wed Mar 21 14:52:34 2018 UTC (6 years, 2 months ago) by niro
File size: 48432 byte(s)
Wed Mar 21 14:52:34 2018 UTC (6 years, 2 months ago) by niro
File size: 48432 byte(s)
-linux-4.15.6
1 | niro | 3089 | diff --git a/Makefile b/Makefile |
2 | index 28c537fbe328..51563c76bdf6 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,7 +1,7 @@ | ||
6 | # SPDX-License-Identifier: GPL-2.0 | ||
7 | VERSION = 4 | ||
8 | PATCHLEVEL = 15 | ||
9 | -SUBLEVEL = 5 | ||
10 | +SUBLEVEL = 6 | ||
11 | EXTRAVERSION = | ||
12 | NAME = Fearless Coyote | ||
13 | |||
14 | diff --git a/arch/arm/common/bL_switcher_dummy_if.c b/arch/arm/common/bL_switcher_dummy_if.c | ||
15 | index 4c10c6452678..f4dc1714a79e 100644 | ||
16 | --- a/arch/arm/common/bL_switcher_dummy_if.c | ||
17 | +++ b/arch/arm/common/bL_switcher_dummy_if.c | ||
18 | @@ -57,3 +57,7 @@ static struct miscdevice bL_switcher_device = { | ||
19 | &bL_switcher_fops | ||
20 | }; | ||
21 | module_misc_device(bL_switcher_device); | ||
22 | + | ||
23 | +MODULE_AUTHOR("Nicolas Pitre <nico@linaro.org>"); | ||
24 | +MODULE_LICENSE("GPL v2"); | ||
25 | +MODULE_DESCRIPTION("big.LITTLE switcher dummy user interface"); | ||
26 | diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi | ||
27 | index 26396ef53bde..ea407aff1251 100644 | ||
28 | --- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi | ||
29 | +++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi | ||
30 | @@ -81,6 +81,7 @@ | ||
31 | reg = <0x000>; | ||
32 | enable-method = "psci"; | ||
33 | cpu-idle-states = <&CPU_SLEEP_0>; | ||
34 | + #cooling-cells = <2>; | ||
35 | }; | ||
36 | |||
37 | cpu1: cpu@1 { | ||
38 | @@ -97,6 +98,7 @@ | ||
39 | reg = <0x100>; | ||
40 | enable-method = "psci"; | ||
41 | cpu-idle-states = <&CPU_SLEEP_0>; | ||
42 | + #cooling-cells = <2>; | ||
43 | }; | ||
44 | |||
45 | cpu3: cpu@101 { | ||
46 | diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S | ||
47 | index 1c3b7ceb36d2..e7273a606a07 100644 | ||
48 | --- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S | ||
49 | +++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S | ||
50 | @@ -55,29 +55,31 @@ | ||
51 | #define RAB1bl %bl | ||
52 | #define RAB2bl %cl | ||
53 | |||
54 | +#define CD0 0x0(%rsp) | ||
55 | +#define CD1 0x8(%rsp) | ||
56 | +#define CD2 0x10(%rsp) | ||
57 | + | ||
58 | +# used only before/after all rounds | ||
59 | #define RCD0 %r8 | ||
60 | #define RCD1 %r9 | ||
61 | #define RCD2 %r10 | ||
62 | |||
63 | -#define RCD0d %r8d | ||
64 | -#define RCD1d %r9d | ||
65 | -#define RCD2d %r10d | ||
66 | - | ||
67 | -#define RX0 %rbp | ||
68 | -#define RX1 %r11 | ||
69 | -#define RX2 %r12 | ||
70 | +# used only during rounds | ||
71 | +#define RX0 %r8 | ||
72 | +#define RX1 %r9 | ||
73 | +#define RX2 %r10 | ||
74 | |||
75 | -#define RX0d %ebp | ||
76 | -#define RX1d %r11d | ||
77 | -#define RX2d %r12d | ||
78 | +#define RX0d %r8d | ||
79 | +#define RX1d %r9d | ||
80 | +#define RX2d %r10d | ||
81 | |||
82 | -#define RY0 %r13 | ||
83 | -#define RY1 %r14 | ||
84 | -#define RY2 %r15 | ||
85 | +#define RY0 %r11 | ||
86 | +#define RY1 %r12 | ||
87 | +#define RY2 %r13 | ||
88 | |||
89 | -#define RY0d %r13d | ||
90 | -#define RY1d %r14d | ||
91 | -#define RY2d %r15d | ||
92 | +#define RY0d %r11d | ||
93 | +#define RY1d %r12d | ||
94 | +#define RY2d %r13d | ||
95 | |||
96 | #define RT0 %rdx | ||
97 | #define RT1 %rsi | ||
98 | @@ -85,6 +87,8 @@ | ||
99 | #define RT0d %edx | ||
100 | #define RT1d %esi | ||
101 | |||
102 | +#define RT1bl %sil | ||
103 | + | ||
104 | #define do16bit_ror(rot, op1, op2, T0, T1, tmp1, tmp2, ab, dst) \ | ||
105 | movzbl ab ## bl, tmp2 ## d; \ | ||
106 | movzbl ab ## bh, tmp1 ## d; \ | ||
107 | @@ -92,6 +96,11 @@ | ||
108 | op1##l T0(CTX, tmp2, 4), dst ## d; \ | ||
109 | op2##l T1(CTX, tmp1, 4), dst ## d; | ||
110 | |||
111 | +#define swap_ab_with_cd(ab, cd, tmp) \ | ||
112 | + movq cd, tmp; \ | ||
113 | + movq ab, cd; \ | ||
114 | + movq tmp, ab; | ||
115 | + | ||
116 | /* | ||
117 | * Combined G1 & G2 function. Reordered with help of rotates to have moves | ||
118 | * at begining. | ||
119 | @@ -110,15 +119,15 @@ | ||
120 | /* G1,2 && G2,2 */ \ | ||
121 | do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 0, x ## 0); \ | ||
122 | do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 0, y ## 0); \ | ||
123 | - xchgq cd ## 0, ab ## 0; \ | ||
124 | + swap_ab_with_cd(ab ## 0, cd ## 0, RT0); \ | ||
125 | \ | ||
126 | do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 1, x ## 1); \ | ||
127 | do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 1, y ## 1); \ | ||
128 | - xchgq cd ## 1, ab ## 1; \ | ||
129 | + swap_ab_with_cd(ab ## 1, cd ## 1, RT0); \ | ||
130 | \ | ||
131 | do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 2, x ## 2); \ | ||
132 | do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 2, y ## 2); \ | ||
133 | - xchgq cd ## 2, ab ## 2; | ||
134 | + swap_ab_with_cd(ab ## 2, cd ## 2, RT0); | ||
135 | |||
136 | #define enc_round_end(ab, x, y, n) \ | ||
137 | addl y ## d, x ## d; \ | ||
138 | @@ -168,6 +177,16 @@ | ||
139 | decrypt_round3(ba, dc, (n*2)+1); \ | ||
140 | decrypt_round3(ba, dc, (n*2)); | ||
141 | |||
142 | +#define push_cd() \ | ||
143 | + pushq RCD2; \ | ||
144 | + pushq RCD1; \ | ||
145 | + pushq RCD0; | ||
146 | + | ||
147 | +#define pop_cd() \ | ||
148 | + popq RCD0; \ | ||
149 | + popq RCD1; \ | ||
150 | + popq RCD2; | ||
151 | + | ||
152 | #define inpack3(in, n, xy, m) \ | ||
153 | movq 4*(n)(in), xy ## 0; \ | ||
154 | xorq w+4*m(CTX), xy ## 0; \ | ||
155 | @@ -223,11 +242,8 @@ ENTRY(__twofish_enc_blk_3way) | ||
156 | * %rdx: src, RIO | ||
157 | * %rcx: bool, if true: xor output | ||
158 | */ | ||
159 | - pushq %r15; | ||
160 | - pushq %r14; | ||
161 | pushq %r13; | ||
162 | pushq %r12; | ||
163 | - pushq %rbp; | ||
164 | pushq %rbx; | ||
165 | |||
166 | pushq %rcx; /* bool xor */ | ||
167 | @@ -235,40 +251,36 @@ ENTRY(__twofish_enc_blk_3way) | ||
168 | |||
169 | inpack_enc3(); | ||
170 | |||
171 | - encrypt_cycle3(RAB, RCD, 0); | ||
172 | - encrypt_cycle3(RAB, RCD, 1); | ||
173 | - encrypt_cycle3(RAB, RCD, 2); | ||
174 | - encrypt_cycle3(RAB, RCD, 3); | ||
175 | - encrypt_cycle3(RAB, RCD, 4); | ||
176 | - encrypt_cycle3(RAB, RCD, 5); | ||
177 | - encrypt_cycle3(RAB, RCD, 6); | ||
178 | - encrypt_cycle3(RAB, RCD, 7); | ||
179 | + push_cd(); | ||
180 | + encrypt_cycle3(RAB, CD, 0); | ||
181 | + encrypt_cycle3(RAB, CD, 1); | ||
182 | + encrypt_cycle3(RAB, CD, 2); | ||
183 | + encrypt_cycle3(RAB, CD, 3); | ||
184 | + encrypt_cycle3(RAB, CD, 4); | ||
185 | + encrypt_cycle3(RAB, CD, 5); | ||
186 | + encrypt_cycle3(RAB, CD, 6); | ||
187 | + encrypt_cycle3(RAB, CD, 7); | ||
188 | + pop_cd(); | ||
189 | |||
190 | popq RIO; /* dst */ | ||
191 | - popq %rbp; /* bool xor */ | ||
192 | + popq RT1; /* bool xor */ | ||
193 | |||
194 | - testb %bpl, %bpl; | ||
195 | + testb RT1bl, RT1bl; | ||
196 | jnz .L__enc_xor3; | ||
197 | |||
198 | outunpack_enc3(mov); | ||
199 | |||
200 | popq %rbx; | ||
201 | - popq %rbp; | ||
202 | popq %r12; | ||
203 | popq %r13; | ||
204 | - popq %r14; | ||
205 | - popq %r15; | ||
206 | ret; | ||
207 | |||
208 | .L__enc_xor3: | ||
209 | outunpack_enc3(xor); | ||
210 | |||
211 | popq %rbx; | ||
212 | - popq %rbp; | ||
213 | popq %r12; | ||
214 | popq %r13; | ||
215 | - popq %r14; | ||
216 | - popq %r15; | ||
217 | ret; | ||
218 | ENDPROC(__twofish_enc_blk_3way) | ||
219 | |||
220 | @@ -278,35 +290,31 @@ ENTRY(twofish_dec_blk_3way) | ||
221 | * %rsi: dst | ||
222 | * %rdx: src, RIO | ||
223 | */ | ||
224 | - pushq %r15; | ||
225 | - pushq %r14; | ||
226 | pushq %r13; | ||
227 | pushq %r12; | ||
228 | - pushq %rbp; | ||
229 | pushq %rbx; | ||
230 | |||
231 | pushq %rsi; /* dst */ | ||
232 | |||
233 | inpack_dec3(); | ||
234 | |||
235 | - decrypt_cycle3(RAB, RCD, 7); | ||
236 | - decrypt_cycle3(RAB, RCD, 6); | ||
237 | - decrypt_cycle3(RAB, RCD, 5); | ||
238 | - decrypt_cycle3(RAB, RCD, 4); | ||
239 | - decrypt_cycle3(RAB, RCD, 3); | ||
240 | - decrypt_cycle3(RAB, RCD, 2); | ||
241 | - decrypt_cycle3(RAB, RCD, 1); | ||
242 | - decrypt_cycle3(RAB, RCD, 0); | ||
243 | + push_cd(); | ||
244 | + decrypt_cycle3(RAB, CD, 7); | ||
245 | + decrypt_cycle3(RAB, CD, 6); | ||
246 | + decrypt_cycle3(RAB, CD, 5); | ||
247 | + decrypt_cycle3(RAB, CD, 4); | ||
248 | + decrypt_cycle3(RAB, CD, 3); | ||
249 | + decrypt_cycle3(RAB, CD, 2); | ||
250 | + decrypt_cycle3(RAB, CD, 1); | ||
251 | + decrypt_cycle3(RAB, CD, 0); | ||
252 | + pop_cd(); | ||
253 | |||
254 | popq RIO; /* dst */ | ||
255 | |||
256 | outunpack_dec3(); | ||
257 | |||
258 | popq %rbx; | ||
259 | - popq %rbp; | ||
260 | popq %r12; | ||
261 | popq %r13; | ||
262 | - popq %r14; | ||
263 | - popq %r15; | ||
264 | ret; | ||
265 | ENDPROC(twofish_dec_blk_3way) | ||
266 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c | ||
267 | index ac381437c291..17f4eca37d22 100644 | ||
268 | --- a/arch/x86/kvm/x86.c | ||
269 | +++ b/arch/x86/kvm/x86.c | ||
270 | @@ -2939,6 +2939,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) | ||
271 | pagefault_enable(); | ||
272 | kvm_x86_ops->vcpu_put(vcpu); | ||
273 | vcpu->arch.last_host_tsc = rdtsc(); | ||
274 | + /* | ||
275 | + * If userspace has set any breakpoints or watchpoints, dr6 is restored | ||
276 | + * on every vmexit, but if not, we might have a stale dr6 from the | ||
277 | + * guest. do_debug expects dr6 to be cleared after it runs, do the same. | ||
278 | + */ | ||
279 | + set_debugreg(0, 6); | ||
280 | } | ||
281 | |||
282 | static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu, | ||
283 | diff --git a/block/blk-map.c b/block/blk-map.c | ||
284 | index d3a94719f03f..db9373bd31ac 100644 | ||
285 | --- a/block/blk-map.c | ||
286 | +++ b/block/blk-map.c | ||
287 | @@ -119,7 +119,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, | ||
288 | unsigned long align = q->dma_pad_mask | queue_dma_alignment(q); | ||
289 | struct bio *bio = NULL; | ||
290 | struct iov_iter i; | ||
291 | - int ret; | ||
292 | + int ret = -EINVAL; | ||
293 | |||
294 | if (!iter_is_iovec(iter)) | ||
295 | goto fail; | ||
296 | @@ -148,7 +148,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, | ||
297 | __blk_rq_unmap_user(bio); | ||
298 | fail: | ||
299 | rq->bio = NULL; | ||
300 | - return -EINVAL; | ||
301 | + return ret; | ||
302 | } | ||
303 | EXPORT_SYMBOL(blk_rq_map_user_iov); | ||
304 | |||
305 | diff --git a/drivers/android/binder.c b/drivers/android/binder.c | ||
306 | index ec0917fb7cca..255eabdca2a4 100644 | ||
307 | --- a/drivers/android/binder.c | ||
308 | +++ b/drivers/android/binder.c | ||
309 | @@ -1933,8 +1933,14 @@ static void binder_send_failed_reply(struct binder_transaction *t, | ||
310 | &target_thread->todo); | ||
311 | wake_up_interruptible(&target_thread->wait); | ||
312 | } else { | ||
313 | - WARN(1, "Unexpected reply error: %u\n", | ||
314 | - target_thread->reply_error.cmd); | ||
315 | + /* | ||
316 | + * Cannot get here for normal operation, but | ||
317 | + * we can if multiple synchronous transactions | ||
318 | + * are sent without blocking for responses. | ||
319 | + * Just ignore the 2nd error in this case. | ||
320 | + */ | ||
321 | + pr_warn("Unexpected reply error: %u\n", | ||
322 | + target_thread->reply_error.cmd); | ||
323 | } | ||
324 | binder_inner_proc_unlock(target_thread->proc); | ||
325 | binder_thread_dec_tmpref(target_thread); | ||
326 | @@ -2135,7 +2141,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, | ||
327 | int debug_id = buffer->debug_id; | ||
328 | |||
329 | binder_debug(BINDER_DEBUG_TRANSACTION, | ||
330 | - "%d buffer release %d, size %zd-%zd, failed at %p\n", | ||
331 | + "%d buffer release %d, size %zd-%zd, failed at %pK\n", | ||
332 | proc->pid, buffer->debug_id, | ||
333 | buffer->data_size, buffer->offsets_size, failed_at); | ||
334 | |||
335 | @@ -3647,7 +3653,7 @@ static int binder_thread_write(struct binder_proc *proc, | ||
336 | } | ||
337 | } | ||
338 | binder_debug(BINDER_DEBUG_DEAD_BINDER, | ||
339 | - "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", | ||
340 | + "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", | ||
341 | proc->pid, thread->pid, (u64)cookie, | ||
342 | death); | ||
343 | if (death == NULL) { | ||
344 | @@ -4316,6 +4322,15 @@ static int binder_thread_release(struct binder_proc *proc, | ||
345 | |||
346 | binder_inner_proc_unlock(thread->proc); | ||
347 | |||
348 | + /* | ||
349 | + * This is needed to avoid races between wake_up_poll() above and | ||
350 | + * and ep_remove_waitqueue() called for other reasons (eg the epoll file | ||
351 | + * descriptor being closed); ep_remove_waitqueue() holds an RCU read | ||
352 | + * lock, so we can be sure it's done after calling synchronize_rcu(). | ||
353 | + */ | ||
354 | + if (thread->looper & BINDER_LOOPER_STATE_POLL) | ||
355 | + synchronize_rcu(); | ||
356 | + | ||
357 | if (send_reply) | ||
358 | binder_send_failed_reply(send_reply, BR_DEAD_REPLY); | ||
359 | binder_release_work(proc, &thread->todo); | ||
360 | @@ -4331,6 +4346,8 @@ static unsigned int binder_poll(struct file *filp, | ||
361 | bool wait_for_proc_work; | ||
362 | |||
363 | thread = binder_get_thread(proc); | ||
364 | + if (!thread) | ||
365 | + return POLLERR; | ||
366 | |||
367 | binder_inner_proc_lock(thread->proc); | ||
368 | thread->looper |= BINDER_LOOPER_STATE_POLL; | ||
369 | @@ -4974,7 +4991,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m, | ||
370 | spin_lock(&t->lock); | ||
371 | to_proc = t->to_proc; | ||
372 | seq_printf(m, | ||
373 | - "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", | ||
374 | + "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d", | ||
375 | prefix, t->debug_id, t, | ||
376 | t->from ? t->from->proc->pid : 0, | ||
377 | t->from ? t->from->pid : 0, | ||
378 | @@ -4998,7 +5015,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m, | ||
379 | } | ||
380 | if (buffer->target_node) | ||
381 | seq_printf(m, " node %d", buffer->target_node->debug_id); | ||
382 | - seq_printf(m, " size %zd:%zd data %p\n", | ||
383 | + seq_printf(m, " size %zd:%zd data %pK\n", | ||
384 | buffer->data_size, buffer->offsets_size, | ||
385 | buffer->data); | ||
386 | } | ||
387 | diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c | ||
388 | index 142c6020cec7..5c0496d1ed41 100644 | ||
389 | --- a/drivers/crypto/s5p-sss.c | ||
390 | +++ b/drivers/crypto/s5p-sss.c | ||
391 | @@ -1926,15 +1926,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) | ||
392 | uint32_t aes_control; | ||
393 | unsigned long flags; | ||
394 | int err; | ||
395 | + u8 *iv; | ||
396 | |||
397 | aes_control = SSS_AES_KEY_CHANGE_MODE; | ||
398 | if (mode & FLAGS_AES_DECRYPT) | ||
399 | aes_control |= SSS_AES_MODE_DECRYPT; | ||
400 | |||
401 | - if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) | ||
402 | + if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) { | ||
403 | aes_control |= SSS_AES_CHAIN_MODE_CBC; | ||
404 | - else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) | ||
405 | + iv = req->info; | ||
406 | + } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) { | ||
407 | aes_control |= SSS_AES_CHAIN_MODE_CTR; | ||
408 | + iv = req->info; | ||
409 | + } else { | ||
410 | + iv = NULL; /* AES_ECB */ | ||
411 | + } | ||
412 | |||
413 | if (dev->ctx->keylen == AES_KEYSIZE_192) | ||
414 | aes_control |= SSS_AES_KEY_SIZE_192; | ||
415 | @@ -1965,7 +1971,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) | ||
416 | goto outdata_error; | ||
417 | |||
418 | SSS_AES_WRITE(dev, AES_CONTROL, aes_control); | ||
419 | - s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen); | ||
420 | + s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen); | ||
421 | |||
422 | s5p_set_dma_indata(dev, dev->sg_src); | ||
423 | s5p_set_dma_outdata(dev, dev->sg_dst); | ||
424 | diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c | ||
425 | index 8289ee482f49..09bd6c6c176c 100644 | ||
426 | --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c | ||
427 | +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c | ||
428 | @@ -3648,6 +3648,12 @@ static int pvr2_send_request_ex(struct pvr2_hdw *hdw, | ||
429 | hdw); | ||
430 | hdw->ctl_write_urb->actual_length = 0; | ||
431 | hdw->ctl_write_pend_flag = !0; | ||
432 | + if (usb_urb_ep_type_check(hdw->ctl_write_urb)) { | ||
433 | + pvr2_trace( | ||
434 | + PVR2_TRACE_ERROR_LEGS, | ||
435 | + "Invalid write control endpoint"); | ||
436 | + return -EINVAL; | ||
437 | + } | ||
438 | status = usb_submit_urb(hdw->ctl_write_urb,GFP_KERNEL); | ||
439 | if (status < 0) { | ||
440 | pvr2_trace(PVR2_TRACE_ERROR_LEGS, | ||
441 | @@ -3672,6 +3678,12 @@ status); | ||
442 | hdw); | ||
443 | hdw->ctl_read_urb->actual_length = 0; | ||
444 | hdw->ctl_read_pend_flag = !0; | ||
445 | + if (usb_urb_ep_type_check(hdw->ctl_read_urb)) { | ||
446 | + pvr2_trace( | ||
447 | + PVR2_TRACE_ERROR_LEGS, | ||
448 | + "Invalid read control endpoint"); | ||
449 | + return -EINVAL; | ||
450 | + } | ||
451 | status = usb_submit_urb(hdw->ctl_read_urb,GFP_KERNEL); | ||
452 | if (status < 0) { | ||
453 | pvr2_trace(PVR2_TRACE_ERROR_LEGS, | ||
454 | diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h | ||
455 | index 0ccccbaf530d..e4b10b2d1a08 100644 | ||
456 | --- a/drivers/misc/mei/hw-me-regs.h | ||
457 | +++ b/drivers/misc/mei/hw-me-regs.h | ||
458 | @@ -132,6 +132,11 @@ | ||
459 | #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */ | ||
460 | #define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */ | ||
461 | |||
462 | +#define MEI_DEV_ID_CNP_LP 0x9DE0 /* Cannon Point LP */ | ||
463 | +#define MEI_DEV_ID_CNP_LP_4 0x9DE4 /* Cannon Point LP 4 (iTouch) */ | ||
464 | +#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */ | ||
465 | +#define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */ | ||
466 | + | ||
467 | /* | ||
468 | * MEI HW Section | ||
469 | */ | ||
470 | diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c | ||
471 | index 4a0ccda4d04b..ea4e152270a3 100644 | ||
472 | --- a/drivers/misc/mei/pci-me.c | ||
473 | +++ b/drivers/misc/mei/pci-me.c | ||
474 | @@ -98,6 +98,11 @@ static const struct pci_device_id mei_me_pci_tbl[] = { | ||
475 | {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)}, | ||
476 | {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)}, | ||
477 | |||
478 | + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)}, | ||
479 | + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)}, | ||
480 | + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)}, | ||
481 | + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)}, | ||
482 | + | ||
483 | /* required last entry */ | ||
484 | {0, } | ||
485 | }; | ||
486 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c | ||
487 | index a8ec589d1359..e29cd5c7d39f 100644 | ||
488 | --- a/drivers/net/tun.c | ||
489 | +++ b/drivers/net/tun.c | ||
490 | @@ -1317,27 +1317,23 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile, | ||
491 | skb->truesize += skb->data_len; | ||
492 | |||
493 | for (i = 1; i < it->nr_segs; i++) { | ||
494 | + struct page_frag *pfrag = ¤t->task_frag; | ||
495 | size_t fragsz = it->iov[i].iov_len; | ||
496 | - unsigned long offset; | ||
497 | - struct page *page; | ||
498 | - void *data; | ||
499 | |||
500 | if (fragsz == 0 || fragsz > PAGE_SIZE) { | ||
501 | err = -EINVAL; | ||
502 | goto free; | ||
503 | } | ||
504 | |||
505 | - local_bh_disable(); | ||
506 | - data = napi_alloc_frag(fragsz); | ||
507 | - local_bh_enable(); | ||
508 | - if (!data) { | ||
509 | + if (!skb_page_frag_refill(fragsz, pfrag, GFP_KERNEL)) { | ||
510 | err = -ENOMEM; | ||
511 | goto free; | ||
512 | } | ||
513 | |||
514 | - page = virt_to_head_page(data); | ||
515 | - offset = data - page_address(page); | ||
516 | - skb_fill_page_desc(skb, i - 1, page, offset, fragsz); | ||
517 | + skb_fill_page_desc(skb, i - 1, pfrag->page, | ||
518 | + pfrag->offset, fragsz); | ||
519 | + page_ref_inc(pfrag->page); | ||
520 | + pfrag->offset += fragsz; | ||
521 | } | ||
522 | |||
523 | return skb; | ||
524 | diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c | ||
525 | index ce35ff748adf..0a43b2e8906f 100644 | ||
526 | --- a/drivers/soc/qcom/rmtfs_mem.c | ||
527 | +++ b/drivers/soc/qcom/rmtfs_mem.c | ||
528 | @@ -267,3 +267,7 @@ static void qcom_rmtfs_mem_exit(void) | ||
529 | unregister_chrdev_region(qcom_rmtfs_mem_major, QCOM_RMTFS_MEM_DEV_MAX); | ||
530 | } | ||
531 | module_exit(qcom_rmtfs_mem_exit); | ||
532 | + | ||
533 | +MODULE_AUTHOR("Linaro Ltd"); | ||
534 | +MODULE_DESCRIPTION("Qualcomm Remote Filesystem memory driver"); | ||
535 | +MODULE_LICENSE("GPL v2"); | ||
536 | diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c | ||
537 | index 372ce9913e6d..e7541dc90473 100644 | ||
538 | --- a/drivers/staging/android/ashmem.c | ||
539 | +++ b/drivers/staging/android/ashmem.c | ||
540 | @@ -710,30 +710,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, | ||
541 | size_t pgstart, pgend; | ||
542 | int ret = -EINVAL; | ||
543 | |||
544 | + mutex_lock(&ashmem_mutex); | ||
545 | + | ||
546 | if (unlikely(!asma->file)) | ||
547 | - return -EINVAL; | ||
548 | + goto out_unlock; | ||
549 | |||
550 | - if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) | ||
551 | - return -EFAULT; | ||
552 | + if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) { | ||
553 | + ret = -EFAULT; | ||
554 | + goto out_unlock; | ||
555 | + } | ||
556 | |||
557 | /* per custom, you can pass zero for len to mean "everything onward" */ | ||
558 | if (!pin.len) | ||
559 | pin.len = PAGE_ALIGN(asma->size) - pin.offset; | ||
560 | |||
561 | if (unlikely((pin.offset | pin.len) & ~PAGE_MASK)) | ||
562 | - return -EINVAL; | ||
563 | + goto out_unlock; | ||
564 | |||
565 | if (unlikely(((__u32)-1) - pin.offset < pin.len)) | ||
566 | - return -EINVAL; | ||
567 | + goto out_unlock; | ||
568 | |||
569 | if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len)) | ||
570 | - return -EINVAL; | ||
571 | + goto out_unlock; | ||
572 | |||
573 | pgstart = pin.offset / PAGE_SIZE; | ||
574 | pgend = pgstart + (pin.len / PAGE_SIZE) - 1; | ||
575 | |||
576 | - mutex_lock(&ashmem_mutex); | ||
577 | - | ||
578 | switch (cmd) { | ||
579 | case ASHMEM_PIN: | ||
580 | ret = ashmem_pin(asma, pgstart, pgend); | ||
581 | @@ -746,6 +748,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, | ||
582 | break; | ||
583 | } | ||
584 | |||
585 | +out_unlock: | ||
586 | mutex_unlock(&ashmem_mutex); | ||
587 | |||
588 | return ret; | ||
589 | diff --git a/drivers/staging/android/ion/ion-ioctl.c b/drivers/staging/android/ion/ion-ioctl.c | ||
590 | index c78989351f9c..6cfed48f376e 100644 | ||
591 | --- a/drivers/staging/android/ion/ion-ioctl.c | ||
592 | +++ b/drivers/staging/android/ion/ion-ioctl.c | ||
593 | @@ -70,8 +70,10 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) | ||
594 | return -EFAULT; | ||
595 | |||
596 | ret = validate_ioctl_arg(cmd, &data); | ||
597 | - if (WARN_ON_ONCE(ret)) | ||
598 | + if (ret) { | ||
599 | + pr_warn_once("%s: ioctl validate failed\n", __func__); | ||
600 | return ret; | ||
601 | + } | ||
602 | |||
603 | if (!(dir & _IOC_WRITE)) | ||
604 | memset(&data, 0, sizeof(data)); | ||
605 | diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c | ||
606 | index 4dc5d7a589c2..b6ece18e6a88 100644 | ||
607 | --- a/drivers/staging/android/ion/ion_system_heap.c | ||
608 | +++ b/drivers/staging/android/ion/ion_system_heap.c | ||
609 | @@ -371,7 +371,7 @@ static int ion_system_contig_heap_allocate(struct ion_heap *heap, | ||
610 | unsigned long i; | ||
611 | int ret; | ||
612 | |||
613 | - page = alloc_pages(low_order_gfp_flags, order); | ||
614 | + page = alloc_pages(low_order_gfp_flags | __GFP_NOWARN, order); | ||
615 | if (!page) | ||
616 | return -ENOMEM; | ||
617 | |||
618 | diff --git a/drivers/staging/fsl-mc/bus/Kconfig b/drivers/staging/fsl-mc/bus/Kconfig | ||
619 | index 504c987447f2..eee1c1b277fa 100644 | ||
620 | --- a/drivers/staging/fsl-mc/bus/Kconfig | ||
621 | +++ b/drivers/staging/fsl-mc/bus/Kconfig | ||
622 | @@ -8,7 +8,7 @@ | ||
623 | |||
624 | config FSL_MC_BUS | ||
625 | bool "QorIQ DPAA2 fsl-mc bus driver" | ||
626 | - depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86 || PPC))) | ||
627 | + depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86_LOCAL_APIC || PPC))) | ||
628 | select GENERIC_MSI_IRQ_DOMAIN | ||
629 | help | ||
630 | Driver to enable the bus infrastructure for the QorIQ DPAA2 | ||
631 | diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c | ||
632 | index cadfb96734ed..d4da2807eb55 100644 | ||
633 | --- a/drivers/staging/iio/adc/ad7192.c | ||
634 | +++ b/drivers/staging/iio/adc/ad7192.c | ||
635 | @@ -141,6 +141,8 @@ | ||
636 | #define AD7192_GPOCON_P1DAT BIT(1) /* P1 state */ | ||
637 | #define AD7192_GPOCON_P0DAT BIT(0) /* P0 state */ | ||
638 | |||
639 | +#define AD7192_EXT_FREQ_MHZ_MIN 2457600 | ||
640 | +#define AD7192_EXT_FREQ_MHZ_MAX 5120000 | ||
641 | #define AD7192_INT_FREQ_MHZ 4915200 | ||
642 | |||
643 | /* NOTE: | ||
644 | @@ -218,6 +220,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st) | ||
645 | ARRAY_SIZE(ad7192_calib_arr)); | ||
646 | } | ||
647 | |||
648 | +static inline bool ad7192_valid_external_frequency(u32 freq) | ||
649 | +{ | ||
650 | + return (freq >= AD7192_EXT_FREQ_MHZ_MIN && | ||
651 | + freq <= AD7192_EXT_FREQ_MHZ_MAX); | ||
652 | +} | ||
653 | + | ||
654 | static int ad7192_setup(struct ad7192_state *st, | ||
655 | const struct ad7192_platform_data *pdata) | ||
656 | { | ||
657 | @@ -243,17 +251,20 @@ static int ad7192_setup(struct ad7192_state *st, | ||
658 | id); | ||
659 | |||
660 | switch (pdata->clock_source_sel) { | ||
661 | - case AD7192_CLK_EXT_MCLK1_2: | ||
662 | - case AD7192_CLK_EXT_MCLK2: | ||
663 | - st->mclk = AD7192_INT_FREQ_MHZ; | ||
664 | - break; | ||
665 | case AD7192_CLK_INT: | ||
666 | case AD7192_CLK_INT_CO: | ||
667 | - if (pdata->ext_clk_hz) | ||
668 | - st->mclk = pdata->ext_clk_hz; | ||
669 | - else | ||
670 | - st->mclk = AD7192_INT_FREQ_MHZ; | ||
671 | + st->mclk = AD7192_INT_FREQ_MHZ; | ||
672 | break; | ||
673 | + case AD7192_CLK_EXT_MCLK1_2: | ||
674 | + case AD7192_CLK_EXT_MCLK2: | ||
675 | + if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) { | ||
676 | + st->mclk = pdata->ext_clk_hz; | ||
677 | + break; | ||
678 | + } | ||
679 | + dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n", | ||
680 | + pdata->ext_clk_hz); | ||
681 | + ret = -EINVAL; | ||
682 | + goto out; | ||
683 | default: | ||
684 | ret = -EINVAL; | ||
685 | goto out; | ||
686 | diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c | ||
687 | index 2b28fb9c0048..3bcf49466361 100644 | ||
688 | --- a/drivers/staging/iio/impedance-analyzer/ad5933.c | ||
689 | +++ b/drivers/staging/iio/impedance-analyzer/ad5933.c | ||
690 | @@ -648,8 +648,6 @@ static int ad5933_register_ring_funcs_and_init(struct iio_dev *indio_dev) | ||
691 | /* Ring buffer functions - here trigger setup related */ | ||
692 | indio_dev->setup_ops = &ad5933_ring_setup_ops; | ||
693 | |||
694 | - indio_dev->modes |= INDIO_BUFFER_HARDWARE; | ||
695 | - | ||
696 | return 0; | ||
697 | } | ||
698 | |||
699 | @@ -762,7 +760,7 @@ static int ad5933_probe(struct i2c_client *client, | ||
700 | indio_dev->dev.parent = &client->dev; | ||
701 | indio_dev->info = &ad5933_info; | ||
702 | indio_dev->name = id->name; | ||
703 | - indio_dev->modes = INDIO_DIRECT_MODE; | ||
704 | + indio_dev->modes = (INDIO_BUFFER_SOFTWARE | INDIO_DIRECT_MODE); | ||
705 | indio_dev->channels = ad5933_channels; | ||
706 | indio_dev->num_channels = ARRAY_SIZE(ad5933_channels); | ||
707 | |||
708 | diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c | ||
709 | index e26e685d8a57..5851052d4668 100644 | ||
710 | --- a/drivers/usb/host/xhci-debugfs.c | ||
711 | +++ b/drivers/usb/host/xhci-debugfs.c | ||
712 | @@ -211,7 +211,7 @@ static void xhci_ring_dump_segment(struct seq_file *s, | ||
713 | static int xhci_ring_trb_show(struct seq_file *s, void *unused) | ||
714 | { | ||
715 | int i; | ||
716 | - struct xhci_ring *ring = s->private; | ||
717 | + struct xhci_ring *ring = *(struct xhci_ring **)s->private; | ||
718 | struct xhci_segment *seg = ring->first_seg; | ||
719 | |||
720 | for (i = 0; i < ring->num_segs; i++) { | ||
721 | @@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci, | ||
722 | |||
723 | snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index); | ||
724 | epriv->root = xhci_debugfs_create_ring_dir(xhci, | ||
725 | - &dev->eps[ep_index].new_ring, | ||
726 | + &dev->eps[ep_index].ring, | ||
727 | epriv->name, | ||
728 | spriv->root); | ||
729 | spriv->eps[ep_index] = epriv; | ||
730 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c | ||
731 | index da6dbe3ebd8b..5c1326154e66 100644 | ||
732 | --- a/drivers/usb/host/xhci.c | ||
733 | +++ b/drivers/usb/host/xhci.c | ||
734 | @@ -652,8 +652,6 @@ static void xhci_stop(struct usb_hcd *hcd) | ||
735 | return; | ||
736 | } | ||
737 | |||
738 | - xhci_debugfs_exit(xhci); | ||
739 | - | ||
740 | spin_lock_irq(&xhci->lock); | ||
741 | xhci->xhc_state |= XHCI_STATE_HALTED; | ||
742 | xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; | ||
743 | @@ -685,6 +683,7 @@ static void xhci_stop(struct usb_hcd *hcd) | ||
744 | |||
745 | xhci_dbg_trace(xhci, trace_xhci_dbg_init, "cleaning up memory"); | ||
746 | xhci_mem_cleanup(xhci); | ||
747 | + xhci_debugfs_exit(xhci); | ||
748 | xhci_dbg_trace(xhci, trace_xhci_dbg_init, | ||
749 | "xhci_stop completed - status = %x", | ||
750 | readl(&xhci->op_regs->status)); | ||
751 | @@ -1018,6 +1017,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) | ||
752 | |||
753 | xhci_dbg(xhci, "cleaning up memory\n"); | ||
754 | xhci_mem_cleanup(xhci); | ||
755 | + xhci_debugfs_exit(xhci); | ||
756 | xhci_dbg(xhci, "xhci_stop completed - status = %x\n", | ||
757 | readl(&xhci->op_regs->status)); | ||
758 | |||
759 | @@ -3551,12 +3551,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) | ||
760 | virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING; | ||
761 | del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); | ||
762 | } | ||
763 | - | ||
764 | + xhci_debugfs_remove_slot(xhci, udev->slot_id); | ||
765 | ret = xhci_disable_slot(xhci, udev->slot_id); | ||
766 | - if (ret) { | ||
767 | - xhci_debugfs_remove_slot(xhci, udev->slot_id); | ||
768 | + if (ret) | ||
769 | xhci_free_virt_device(xhci, udev->slot_id); | ||
770 | - } | ||
771 | } | ||
772 | |||
773 | int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) | ||
774 | diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c | ||
775 | index e31a6f204397..86037e5b1101 100644 | ||
776 | --- a/drivers/usb/usbip/stub_dev.c | ||
777 | +++ b/drivers/usb/usbip/stub_dev.c | ||
778 | @@ -73,6 +73,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr, | ||
779 | goto err; | ||
780 | |||
781 | sdev->ud.tcp_socket = socket; | ||
782 | + sdev->ud.sockfd = sockfd; | ||
783 | |||
784 | spin_unlock_irq(&sdev->ud.lock); | ||
785 | |||
786 | @@ -172,6 +173,7 @@ static void stub_shutdown_connection(struct usbip_device *ud) | ||
787 | if (ud->tcp_socket) { | ||
788 | sockfd_put(ud->tcp_socket); | ||
789 | ud->tcp_socket = NULL; | ||
790 | + ud->sockfd = -1; | ||
791 | } | ||
792 | |||
793 | /* 3. free used data */ | ||
794 | @@ -266,6 +268,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev) | ||
795 | sdev->ud.status = SDEV_ST_AVAILABLE; | ||
796 | spin_lock_init(&sdev->ud.lock); | ||
797 | sdev->ud.tcp_socket = NULL; | ||
798 | + sdev->ud.sockfd = -1; | ||
799 | |||
800 | INIT_LIST_HEAD(&sdev->priv_init); | ||
801 | INIT_LIST_HEAD(&sdev->priv_tx); | ||
802 | diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c | ||
803 | index c3e1008aa491..20e3d4609583 100644 | ||
804 | --- a/drivers/usb/usbip/vhci_hcd.c | ||
805 | +++ b/drivers/usb/usbip/vhci_hcd.c | ||
806 | @@ -984,6 +984,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud) | ||
807 | if (vdev->ud.tcp_socket) { | ||
808 | sockfd_put(vdev->ud.tcp_socket); | ||
809 | vdev->ud.tcp_socket = NULL; | ||
810 | + vdev->ud.sockfd = -1; | ||
811 | } | ||
812 | pr_info("release socket\n"); | ||
813 | |||
814 | @@ -1030,6 +1031,7 @@ static void vhci_device_reset(struct usbip_device *ud) | ||
815 | if (ud->tcp_socket) { | ||
816 | sockfd_put(ud->tcp_socket); | ||
817 | ud->tcp_socket = NULL; | ||
818 | + ud->sockfd = -1; | ||
819 | } | ||
820 | ud->status = VDEV_ST_NULL; | ||
821 | |||
822 | diff --git a/drivers/video/fbdev/mmp/core.c b/drivers/video/fbdev/mmp/core.c | ||
823 | index a0f496049db7..3a6bb6561ba0 100644 | ||
824 | --- a/drivers/video/fbdev/mmp/core.c | ||
825 | +++ b/drivers/video/fbdev/mmp/core.c | ||
826 | @@ -23,6 +23,7 @@ | ||
827 | #include <linux/slab.h> | ||
828 | #include <linux/dma-mapping.h> | ||
829 | #include <linux/export.h> | ||
830 | +#include <linux/module.h> | ||
831 | #include <video/mmp_disp.h> | ||
832 | |||
833 | static struct mmp_overlay *path_get_overlay(struct mmp_path *path, | ||
834 | @@ -249,3 +250,7 @@ void mmp_unregister_path(struct mmp_path *path) | ||
835 | mutex_unlock(&disp_lock); | ||
836 | } | ||
837 | EXPORT_SYMBOL_GPL(mmp_unregister_path); | ||
838 | + | ||
839 | +MODULE_AUTHOR("Zhou Zhu <zzhu3@marvell.com>"); | ||
840 | +MODULE_DESCRIPTION("Marvell MMP display framework"); | ||
841 | +MODULE_LICENSE("GPL"); | ||
842 | diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h | ||
843 | index d72b2e7dd500..59c77c1388ae 100644 | ||
844 | --- a/include/linux/ptr_ring.h | ||
845 | +++ b/include/linux/ptr_ring.h | ||
846 | @@ -451,9 +451,14 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r, | ||
847 | __PTR_RING_PEEK_CALL_v; \ | ||
848 | }) | ||
849 | |||
850 | +/* Not all gfp_t flags (besides GFP_KERNEL) are allowed. See | ||
851 | + * documentation for vmalloc for which of them are legal. | ||
852 | + */ | ||
853 | static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp) | ||
854 | { | ||
855 | - return kcalloc(size, sizeof(void *), gfp); | ||
856 | + if (size * sizeof(void *) > KMALLOC_MAX_SIZE) | ||
857 | + return NULL; | ||
858 | + return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO); | ||
859 | } | ||
860 | |||
861 | static inline void __ptr_ring_set_size(struct ptr_ring *r, int size) | ||
862 | @@ -586,7 +591,7 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp, | ||
863 | spin_unlock(&(r)->producer_lock); | ||
864 | spin_unlock_irqrestore(&(r)->consumer_lock, flags); | ||
865 | |||
866 | - kfree(old); | ||
867 | + kvfree(old); | ||
868 | |||
869 | return 0; | ||
870 | } | ||
871 | @@ -626,7 +631,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, | ||
872 | } | ||
873 | |||
874 | for (i = 0; i < nrings; ++i) | ||
875 | - kfree(queues[i]); | ||
876 | + kvfree(queues[i]); | ||
877 | |||
878 | kfree(queues); | ||
879 | |||
880 | @@ -634,7 +639,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, | ||
881 | |||
882 | nomem: | ||
883 | while (--i >= 0) | ||
884 | - kfree(queues[i]); | ||
885 | + kvfree(queues[i]); | ||
886 | |||
887 | kfree(queues); | ||
888 | |||
889 | @@ -649,7 +654,7 @@ static inline void ptr_ring_cleanup(struct ptr_ring *r, void (*destroy)(void *)) | ||
890 | if (destroy) | ||
891 | while ((ptr = ptr_ring_consume(r))) | ||
892 | destroy(ptr); | ||
893 | - kfree(r->queue); | ||
894 | + kvfree(r->queue); | ||
895 | } | ||
896 | |||
897 | #endif /* _LINUX_PTR_RING_H */ | ||
898 | diff --git a/kernel/kcov.c b/kernel/kcov.c | ||
899 | index 7594c033d98a..2c16f1ab5e10 100644 | ||
900 | --- a/kernel/kcov.c | ||
901 | +++ b/kernel/kcov.c | ||
902 | @@ -358,7 +358,8 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd, | ||
903 | */ | ||
904 | if (kcov->mode != KCOV_MODE_INIT || !kcov->area) | ||
905 | return -EINVAL; | ||
906 | - if (kcov->t != NULL) | ||
907 | + t = current; | ||
908 | + if (kcov->t != NULL || t->kcov != NULL) | ||
909 | return -EBUSY; | ||
910 | if (arg == KCOV_TRACE_PC) | ||
911 | kcov->mode = KCOV_MODE_TRACE_PC; | ||
912 | @@ -370,7 +371,6 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd, | ||
913 | #endif | ||
914 | else | ||
915 | return -EINVAL; | ||
916 | - t = current; | ||
917 | /* Cache in task struct for performance. */ | ||
918 | t->kcov_size = kcov->size; | ||
919 | t->kcov_area = kcov->area; | ||
920 | diff --git a/mm/vmalloc.c b/mm/vmalloc.c | ||
921 | index 673942094328..ebff729cc956 100644 | ||
922 | --- a/mm/vmalloc.c | ||
923 | +++ b/mm/vmalloc.c | ||
924 | @@ -1943,11 +1943,15 @@ void *vmalloc_exec(unsigned long size) | ||
925 | } | ||
926 | |||
927 | #if defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA32) | ||
928 | -#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL | ||
929 | +#define GFP_VMALLOC32 (GFP_DMA32 | GFP_KERNEL) | ||
930 | #elif defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA) | ||
931 | -#define GFP_VMALLOC32 GFP_DMA | GFP_KERNEL | ||
932 | +#define GFP_VMALLOC32 (GFP_DMA | GFP_KERNEL) | ||
933 | #else | ||
934 | -#define GFP_VMALLOC32 GFP_KERNEL | ||
935 | +/* | ||
936 | + * 64b systems should always have either DMA or DMA32 zones. For others | ||
937 | + * GFP_DMA32 should do the right thing and use the normal zone. | ||
938 | + */ | ||
939 | +#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL | ||
940 | #endif | ||
941 | |||
942 | /** | ||
943 | diff --git a/net/core/dev.c b/net/core/dev.c | ||
944 | index 613fb4066be7..c8c102a3467f 100644 | ||
945 | --- a/net/core/dev.c | ||
946 | +++ b/net/core/dev.c | ||
947 | @@ -2815,7 +2815,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb, | ||
948 | |||
949 | segs = skb_mac_gso_segment(skb, features); | ||
950 | |||
951 | - if (unlikely(skb_needs_check(skb, tx_path))) | ||
952 | + if (unlikely(skb_needs_check(skb, tx_path) && !IS_ERR(segs))) | ||
953 | skb_warn_bad_offload(skb); | ||
954 | |||
955 | return segs; | ||
956 | diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c | ||
957 | index 9834cfa21b21..0a3f88f08727 100644 | ||
958 | --- a/net/core/gen_estimator.c | ||
959 | +++ b/net/core/gen_estimator.c | ||
960 | @@ -159,7 +159,11 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats, | ||
961 | est->intvl_log = intvl_log; | ||
962 | est->cpu_bstats = cpu_bstats; | ||
963 | |||
964 | + if (stats_lock) | ||
965 | + local_bh_disable(); | ||
966 | est_fetch_counters(est, &b); | ||
967 | + if (stats_lock) | ||
968 | + local_bh_enable(); | ||
969 | est->last_bytes = b.bytes; | ||
970 | est->last_packets = b.packets; | ||
971 | old = rcu_dereference_protected(*rate_est, 1); | ||
972 | diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c | ||
973 | index 518cea17b811..ea9b55309483 100644 | ||
974 | --- a/net/decnet/af_decnet.c | ||
975 | +++ b/net/decnet/af_decnet.c | ||
976 | @@ -1338,6 +1338,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use | ||
977 | lock_sock(sk); | ||
978 | err = __dn_setsockopt(sock, level, optname, optval, optlen, 0); | ||
979 | release_sock(sk); | ||
980 | +#ifdef CONFIG_NETFILTER | ||
981 | + /* we need to exclude all possible ENOPROTOOPTs except default case */ | ||
982 | + if (err == -ENOPROTOOPT && optname != DSO_LINKINFO && | ||
983 | + optname != DSO_STREAM && optname != DSO_SEQPACKET) | ||
984 | + err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen); | ||
985 | +#endif | ||
986 | |||
987 | return err; | ||
988 | } | ||
989 | @@ -1445,15 +1451,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us | ||
990 | dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation); | ||
991 | break; | ||
992 | |||
993 | - default: | ||
994 | -#ifdef CONFIG_NETFILTER | ||
995 | - return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen); | ||
996 | -#endif | ||
997 | - case DSO_LINKINFO: | ||
998 | - case DSO_STREAM: | ||
999 | - case DSO_SEQPACKET: | ||
1000 | - return -ENOPROTOOPT; | ||
1001 | - | ||
1002 | case DSO_MAXWINDOW: | ||
1003 | if (optlen != sizeof(unsigned long)) | ||
1004 | return -EINVAL; | ||
1005 | @@ -1501,6 +1498,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us | ||
1006 | return -EINVAL; | ||
1007 | scp->info_loc = u.info; | ||
1008 | break; | ||
1009 | + | ||
1010 | + case DSO_LINKINFO: | ||
1011 | + case DSO_STREAM: | ||
1012 | + case DSO_SEQPACKET: | ||
1013 | + default: | ||
1014 | + return -ENOPROTOOPT; | ||
1015 | } | ||
1016 | |||
1017 | return 0; | ||
1018 | @@ -1514,6 +1517,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use | ||
1019 | lock_sock(sk); | ||
1020 | err = __dn_getsockopt(sock, level, optname, optval, optlen, 0); | ||
1021 | release_sock(sk); | ||
1022 | +#ifdef CONFIG_NETFILTER | ||
1023 | + if (err == -ENOPROTOOPT && optname != DSO_STREAM && | ||
1024 | + optname != DSO_SEQPACKET && optname != DSO_CONACCEPT && | ||
1025 | + optname != DSO_CONREJECT) { | ||
1026 | + int len; | ||
1027 | + | ||
1028 | + if (get_user(len, optlen)) | ||
1029 | + return -EFAULT; | ||
1030 | + | ||
1031 | + err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len); | ||
1032 | + if (err >= 0) | ||
1033 | + err = put_user(len, optlen); | ||
1034 | + } | ||
1035 | +#endif | ||
1036 | |||
1037 | return err; | ||
1038 | } | ||
1039 | @@ -1579,26 +1596,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us | ||
1040 | r_data = &link; | ||
1041 | break; | ||
1042 | |||
1043 | - default: | ||
1044 | -#ifdef CONFIG_NETFILTER | ||
1045 | - { | ||
1046 | - int ret, len; | ||
1047 | - | ||
1048 | - if (get_user(len, optlen)) | ||
1049 | - return -EFAULT; | ||
1050 | - | ||
1051 | - ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len); | ||
1052 | - if (ret >= 0) | ||
1053 | - ret = put_user(len, optlen); | ||
1054 | - return ret; | ||
1055 | - } | ||
1056 | -#endif | ||
1057 | - case DSO_STREAM: | ||
1058 | - case DSO_SEQPACKET: | ||
1059 | - case DSO_CONACCEPT: | ||
1060 | - case DSO_CONREJECT: | ||
1061 | - return -ENOPROTOOPT; | ||
1062 | - | ||
1063 | case DSO_MAXWINDOW: | ||
1064 | if (r_len > sizeof(unsigned long)) | ||
1065 | r_len = sizeof(unsigned long); | ||
1066 | @@ -1630,6 +1627,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us | ||
1067 | r_len = sizeof(unsigned char); | ||
1068 | r_data = &scp->info_rem; | ||
1069 | break; | ||
1070 | + | ||
1071 | + case DSO_STREAM: | ||
1072 | + case DSO_SEQPACKET: | ||
1073 | + case DSO_CONACCEPT: | ||
1074 | + case DSO_CONREJECT: | ||
1075 | + default: | ||
1076 | + return -ENOPROTOOPT; | ||
1077 | } | ||
1078 | |||
1079 | if (r_data) { | ||
1080 | diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c | ||
1081 | index 60fb1eb7d7d8..c7df4969f80a 100644 | ||
1082 | --- a/net/ipv4/ip_sockglue.c | ||
1083 | +++ b/net/ipv4/ip_sockglue.c | ||
1084 | @@ -1251,11 +1251,8 @@ int ip_setsockopt(struct sock *sk, int level, | ||
1085 | if (err == -ENOPROTOOPT && optname != IP_HDRINCL && | ||
1086 | optname != IP_IPSEC_POLICY && | ||
1087 | optname != IP_XFRM_POLICY && | ||
1088 | - !ip_mroute_opt(optname)) { | ||
1089 | - lock_sock(sk); | ||
1090 | + !ip_mroute_opt(optname)) | ||
1091 | err = nf_setsockopt(sk, PF_INET, optname, optval, optlen); | ||
1092 | - release_sock(sk); | ||
1093 | - } | ||
1094 | #endif | ||
1095 | return err; | ||
1096 | } | ||
1097 | @@ -1280,12 +1277,9 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, | ||
1098 | if (err == -ENOPROTOOPT && optname != IP_HDRINCL && | ||
1099 | optname != IP_IPSEC_POLICY && | ||
1100 | optname != IP_XFRM_POLICY && | ||
1101 | - !ip_mroute_opt(optname)) { | ||
1102 | - lock_sock(sk); | ||
1103 | - err = compat_nf_setsockopt(sk, PF_INET, optname, | ||
1104 | - optval, optlen); | ||
1105 | - release_sock(sk); | ||
1106 | - } | ||
1107 | + !ip_mroute_opt(optname)) | ||
1108 | + err = compat_nf_setsockopt(sk, PF_INET, optname, optval, | ||
1109 | + optlen); | ||
1110 | #endif | ||
1111 | return err; | ||
1112 | } | ||
1113 | diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c | ||
1114 | index 69060e3abe85..1e4a7209a3d2 100644 | ||
1115 | --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c | ||
1116 | +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c | ||
1117 | @@ -431,7 +431,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) | ||
1118 | struct ipt_clusterip_tgt_info *cipinfo = par->targinfo; | ||
1119 | const struct ipt_entry *e = par->entryinfo; | ||
1120 | struct clusterip_config *config; | ||
1121 | - int ret; | ||
1122 | + int ret, i; | ||
1123 | |||
1124 | if (par->nft_compat) { | ||
1125 | pr_err("cannot use CLUSTERIP target from nftables compat\n"); | ||
1126 | @@ -450,8 +450,18 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) | ||
1127 | pr_info("Please specify destination IP\n"); | ||
1128 | return -EINVAL; | ||
1129 | } | ||
1130 | - | ||
1131 | - /* FIXME: further sanity checks */ | ||
1132 | + if (cipinfo->num_local_nodes > ARRAY_SIZE(cipinfo->local_nodes)) { | ||
1133 | + pr_info("bad num_local_nodes %u\n", cipinfo->num_local_nodes); | ||
1134 | + return -EINVAL; | ||
1135 | + } | ||
1136 | + for (i = 0; i < cipinfo->num_local_nodes; i++) { | ||
1137 | + if (cipinfo->local_nodes[i] - 1 >= | ||
1138 | + sizeof(config->local_nodes) * 8) { | ||
1139 | + pr_info("bad local_nodes[%d] %u\n", | ||
1140 | + i, cipinfo->local_nodes[i]); | ||
1141 | + return -EINVAL; | ||
1142 | + } | ||
1143 | + } | ||
1144 | |||
1145 | config = clusterip_config_find_get(par->net, e->ip.dst.s_addr, 1); | ||
1146 | if (!config) { | ||
1147 | diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | ||
1148 | index 89af9d88ca21..a5727036a8a8 100644 | ||
1149 | --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | ||
1150 | +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | ||
1151 | @@ -218,15 +218,19 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len) | ||
1152 | struct nf_conntrack_tuple tuple; | ||
1153 | |||
1154 | memset(&tuple, 0, sizeof(tuple)); | ||
1155 | + | ||
1156 | + lock_sock(sk); | ||
1157 | tuple.src.u3.ip = inet->inet_rcv_saddr; | ||
1158 | tuple.src.u.tcp.port = inet->inet_sport; | ||
1159 | tuple.dst.u3.ip = inet->inet_daddr; | ||
1160 | tuple.dst.u.tcp.port = inet->inet_dport; | ||
1161 | tuple.src.l3num = PF_INET; | ||
1162 | tuple.dst.protonum = sk->sk_protocol; | ||
1163 | + release_sock(sk); | ||
1164 | |||
1165 | /* We only do TCP and SCTP at the moment: is there a better way? */ | ||
1166 | - if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) { | ||
1167 | + if (tuple.dst.protonum != IPPROTO_TCP && | ||
1168 | + tuple.dst.protonum != IPPROTO_SCTP) { | ||
1169 | pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n"); | ||
1170 | return -ENOPROTOOPT; | ||
1171 | } | ||
1172 | diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c | ||
1173 | index e8ffb5b5d84e..d78d41fc4b1a 100644 | ||
1174 | --- a/net/ipv6/ipv6_sockglue.c | ||
1175 | +++ b/net/ipv6/ipv6_sockglue.c | ||
1176 | @@ -923,12 +923,8 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname, | ||
1177 | #ifdef CONFIG_NETFILTER | ||
1178 | /* we need to exclude all possible ENOPROTOOPTs except default case */ | ||
1179 | if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY && | ||
1180 | - optname != IPV6_XFRM_POLICY) { | ||
1181 | - lock_sock(sk); | ||
1182 | - err = nf_setsockopt(sk, PF_INET6, optname, optval, | ||
1183 | - optlen); | ||
1184 | - release_sock(sk); | ||
1185 | - } | ||
1186 | + optname != IPV6_XFRM_POLICY) | ||
1187 | + err = nf_setsockopt(sk, PF_INET6, optname, optval, optlen); | ||
1188 | #endif | ||
1189 | return err; | ||
1190 | } | ||
1191 | @@ -958,12 +954,9 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, | ||
1192 | #ifdef CONFIG_NETFILTER | ||
1193 | /* we need to exclude all possible ENOPROTOOPTs except default case */ | ||
1194 | if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY && | ||
1195 | - optname != IPV6_XFRM_POLICY) { | ||
1196 | - lock_sock(sk); | ||
1197 | - err = compat_nf_setsockopt(sk, PF_INET6, optname, | ||
1198 | - optval, optlen); | ||
1199 | - release_sock(sk); | ||
1200 | - } | ||
1201 | + optname != IPV6_XFRM_POLICY) | ||
1202 | + err = compat_nf_setsockopt(sk, PF_INET6, optname, optval, | ||
1203 | + optlen); | ||
1204 | #endif | ||
1205 | return err; | ||
1206 | } | ||
1207 | diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | ||
1208 | index 3b80a38f62b8..5863579800c1 100644 | ||
1209 | --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | ||
1210 | +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | ||
1211 | @@ -226,20 +226,27 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = { | ||
1212 | static int | ||
1213 | ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len) | ||
1214 | { | ||
1215 | - const struct inet_sock *inet = inet_sk(sk); | ||
1216 | + struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 }; | ||
1217 | const struct ipv6_pinfo *inet6 = inet6_sk(sk); | ||
1218 | + const struct inet_sock *inet = inet_sk(sk); | ||
1219 | const struct nf_conntrack_tuple_hash *h; | ||
1220 | struct sockaddr_in6 sin6; | ||
1221 | - struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 }; | ||
1222 | struct nf_conn *ct; | ||
1223 | + __be32 flow_label; | ||
1224 | + int bound_dev_if; | ||
1225 | |||
1226 | + lock_sock(sk); | ||
1227 | tuple.src.u3.in6 = sk->sk_v6_rcv_saddr; | ||
1228 | tuple.src.u.tcp.port = inet->inet_sport; | ||
1229 | tuple.dst.u3.in6 = sk->sk_v6_daddr; | ||
1230 | tuple.dst.u.tcp.port = inet->inet_dport; | ||
1231 | tuple.dst.protonum = sk->sk_protocol; | ||
1232 | + bound_dev_if = sk->sk_bound_dev_if; | ||
1233 | + flow_label = inet6->flow_label; | ||
1234 | + release_sock(sk); | ||
1235 | |||
1236 | - if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) | ||
1237 | + if (tuple.dst.protonum != IPPROTO_TCP && | ||
1238 | + tuple.dst.protonum != IPPROTO_SCTP) | ||
1239 | return -ENOPROTOOPT; | ||
1240 | |||
1241 | if (*len < 0 || (unsigned int) *len < sizeof(sin6)) | ||
1242 | @@ -257,14 +264,13 @@ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len) | ||
1243 | |||
1244 | sin6.sin6_family = AF_INET6; | ||
1245 | sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port; | ||
1246 | - sin6.sin6_flowinfo = inet6->flow_label & IPV6_FLOWINFO_MASK; | ||
1247 | + sin6.sin6_flowinfo = flow_label & IPV6_FLOWINFO_MASK; | ||
1248 | memcpy(&sin6.sin6_addr, | ||
1249 | &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6, | ||
1250 | sizeof(sin6.sin6_addr)); | ||
1251 | |||
1252 | nf_ct_put(ct); | ||
1253 | - sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, | ||
1254 | - sk->sk_bound_dev_if); | ||
1255 | + sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, bound_dev_if); | ||
1256 | return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0; | ||
1257 | } | ||
1258 | |||
1259 | diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c | ||
1260 | index 55802e97f906..d7070d18db20 100644 | ||
1261 | --- a/net/netfilter/x_tables.c | ||
1262 | +++ b/net/netfilter/x_tables.c | ||
1263 | @@ -39,7 +39,6 @@ MODULE_LICENSE("GPL"); | ||
1264 | MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); | ||
1265 | MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); | ||
1266 | |||
1267 | -#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) | ||
1268 | #define XT_PCPU_BLOCK_SIZE 4096 | ||
1269 | |||
1270 | struct compat_delta { | ||
1271 | @@ -210,6 +209,9 @@ xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision) | ||
1272 | { | ||
1273 | struct xt_match *match; | ||
1274 | |||
1275 | + if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN) | ||
1276 | + return ERR_PTR(-EINVAL); | ||
1277 | + | ||
1278 | match = xt_find_match(nfproto, name, revision); | ||
1279 | if (IS_ERR(match)) { | ||
1280 | request_module("%st_%s", xt_prefix[nfproto], name); | ||
1281 | @@ -252,6 +254,9 @@ struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision) | ||
1282 | { | ||
1283 | struct xt_target *target; | ||
1284 | |||
1285 | + if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN) | ||
1286 | + return ERR_PTR(-EINVAL); | ||
1287 | + | ||
1288 | target = xt_find_target(af, name, revision); | ||
1289 | if (IS_ERR(target)) { | ||
1290 | request_module("%st_%s", xt_prefix[af], name); | ||
1291 | @@ -1000,7 +1005,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) | ||
1292 | return NULL; | ||
1293 | |||
1294 | /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ | ||
1295 | - if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) | ||
1296 | + if ((size >> PAGE_SHIFT) + 2 > totalram_pages) | ||
1297 | return NULL; | ||
1298 | |||
1299 | info = kvmalloc(sz, GFP_KERNEL); | ||
1300 | diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c | ||
1301 | index 498b54fd04d7..141c295191f6 100644 | ||
1302 | --- a/net/netfilter/xt_RATEEST.c | ||
1303 | +++ b/net/netfilter/xt_RATEEST.c | ||
1304 | @@ -39,23 +39,31 @@ static void xt_rateest_hash_insert(struct xt_rateest *est) | ||
1305 | hlist_add_head(&est->list, &rateest_hash[h]); | ||
1306 | } | ||
1307 | |||
1308 | -struct xt_rateest *xt_rateest_lookup(const char *name) | ||
1309 | +static struct xt_rateest *__xt_rateest_lookup(const char *name) | ||
1310 | { | ||
1311 | struct xt_rateest *est; | ||
1312 | unsigned int h; | ||
1313 | |||
1314 | h = xt_rateest_hash(name); | ||
1315 | - mutex_lock(&xt_rateest_mutex); | ||
1316 | hlist_for_each_entry(est, &rateest_hash[h], list) { | ||
1317 | if (strcmp(est->name, name) == 0) { | ||
1318 | est->refcnt++; | ||
1319 | - mutex_unlock(&xt_rateest_mutex); | ||
1320 | return est; | ||
1321 | } | ||
1322 | } | ||
1323 | - mutex_unlock(&xt_rateest_mutex); | ||
1324 | + | ||
1325 | return NULL; | ||
1326 | } | ||
1327 | + | ||
1328 | +struct xt_rateest *xt_rateest_lookup(const char *name) | ||
1329 | +{ | ||
1330 | + struct xt_rateest *est; | ||
1331 | + | ||
1332 | + mutex_lock(&xt_rateest_mutex); | ||
1333 | + est = __xt_rateest_lookup(name); | ||
1334 | + mutex_unlock(&xt_rateest_mutex); | ||
1335 | + return est; | ||
1336 | +} | ||
1337 | EXPORT_SYMBOL_GPL(xt_rateest_lookup); | ||
1338 | |||
1339 | void xt_rateest_put(struct xt_rateest *est) | ||
1340 | @@ -100,8 +108,10 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) | ||
1341 | |||
1342 | net_get_random_once(&jhash_rnd, sizeof(jhash_rnd)); | ||
1343 | |||
1344 | - est = xt_rateest_lookup(info->name); | ||
1345 | + mutex_lock(&xt_rateest_mutex); | ||
1346 | + est = __xt_rateest_lookup(info->name); | ||
1347 | if (est) { | ||
1348 | + mutex_unlock(&xt_rateest_mutex); | ||
1349 | /* | ||
1350 | * If estimator parameters are specified, they must match the | ||
1351 | * existing estimator. | ||
1352 | @@ -139,11 +149,13 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) | ||
1353 | |||
1354 | info->est = est; | ||
1355 | xt_rateest_hash_insert(est); | ||
1356 | + mutex_unlock(&xt_rateest_mutex); | ||
1357 | return 0; | ||
1358 | |||
1359 | err2: | ||
1360 | kfree(est); | ||
1361 | err1: | ||
1362 | + mutex_unlock(&xt_rateest_mutex); | ||
1363 | return ret; | ||
1364 | } | ||
1365 | |||
1366 | diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c | ||
1367 | index 1db1ce59079f..891f4e7e8ea7 100644 | ||
1368 | --- a/net/netfilter/xt_cgroup.c | ||
1369 | +++ b/net/netfilter/xt_cgroup.c | ||
1370 | @@ -52,6 +52,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par) | ||
1371 | return -EINVAL; | ||
1372 | } | ||
1373 | |||
1374 | + info->priv = NULL; | ||
1375 | if (info->has_path) { | ||
1376 | cgrp = cgroup_get_from_path(info->path); | ||
1377 | if (IS_ERR(cgrp)) { | ||
1378 | diff --git a/net/rds/connection.c b/net/rds/connection.c | ||
1379 | index 7ee2d5d68b78..9efc82c665b5 100644 | ||
1380 | --- a/net/rds/connection.c | ||
1381 | +++ b/net/rds/connection.c | ||
1382 | @@ -366,6 +366,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) | ||
1383 | * to the conn hash, so we never trigger a reconnect on this | ||
1384 | * conn - the reconnect is always triggered by the active peer. */ | ||
1385 | cancel_delayed_work_sync(&cp->cp_conn_w); | ||
1386 | + if (conn->c_destroy_in_prog) | ||
1387 | + return; | ||
1388 | rcu_read_lock(); | ||
1389 | if (!hlist_unhashed(&conn->c_hash_node)) { | ||
1390 | rcu_read_unlock(); | ||
1391 | @@ -445,7 +447,6 @@ void rds_conn_destroy(struct rds_connection *conn) | ||
1392 | */ | ||
1393 | rds_cong_remove_conn(conn); | ||
1394 | |||
1395 | - put_net(conn->c_net); | ||
1396 | kfree(conn->c_path); | ||
1397 | kmem_cache_free(rds_conn_slab, conn); | ||
1398 | |||
1399 | diff --git a/net/rds/rds.h b/net/rds/rds.h | ||
1400 | index c349c71babff..d09f6c1facb4 100644 | ||
1401 | --- a/net/rds/rds.h | ||
1402 | +++ b/net/rds/rds.h | ||
1403 | @@ -150,7 +150,7 @@ struct rds_connection { | ||
1404 | |||
1405 | /* Protocol version */ | ||
1406 | unsigned int c_version; | ||
1407 | - struct net *c_net; | ||
1408 | + possible_net_t c_net; | ||
1409 | |||
1410 | struct list_head c_map_item; | ||
1411 | unsigned long c_map_queued; | ||
1412 | @@ -165,13 +165,13 @@ struct rds_connection { | ||
1413 | static inline | ||
1414 | struct net *rds_conn_net(struct rds_connection *conn) | ||
1415 | { | ||
1416 | - return conn->c_net; | ||
1417 | + return read_pnet(&conn->c_net); | ||
1418 | } | ||
1419 | |||
1420 | static inline | ||
1421 | void rds_conn_net_set(struct rds_connection *conn, struct net *net) | ||
1422 | { | ||
1423 | - conn->c_net = get_net(net); | ||
1424 | + write_pnet(&conn->c_net, net); | ||
1425 | } | ||
1426 | |||
1427 | #define RDS_FLAG_CONG_BITMAP 0x01 | ||
1428 | diff --git a/net/rds/tcp.c b/net/rds/tcp.c | ||
1429 | index ab7356e0ba83..4df21e47d2ab 100644 | ||
1430 | --- a/net/rds/tcp.c | ||
1431 | +++ b/net/rds/tcp.c | ||
1432 | @@ -307,7 +307,8 @@ static void rds_tcp_conn_free(void *arg) | ||
1433 | rdsdebug("freeing tc %p\n", tc); | ||
1434 | |||
1435 | spin_lock_irqsave(&rds_tcp_conn_lock, flags); | ||
1436 | - list_del(&tc->t_tcp_node); | ||
1437 | + if (!tc->t_tcp_node_detached) | ||
1438 | + list_del(&tc->t_tcp_node); | ||
1439 | spin_unlock_irqrestore(&rds_tcp_conn_lock, flags); | ||
1440 | |||
1441 | kmem_cache_free(rds_tcp_conn_slab, tc); | ||
1442 | @@ -528,12 +529,16 @@ static void rds_tcp_kill_sock(struct net *net) | ||
1443 | rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w); | ||
1444 | spin_lock_irq(&rds_tcp_conn_lock); | ||
1445 | list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) { | ||
1446 | - struct net *c_net = tc->t_cpath->cp_conn->c_net; | ||
1447 | + struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net); | ||
1448 | |||
1449 | if (net != c_net || !tc->t_sock) | ||
1450 | continue; | ||
1451 | - if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) | ||
1452 | + if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) { | ||
1453 | list_move_tail(&tc->t_tcp_node, &tmp_list); | ||
1454 | + } else { | ||
1455 | + list_del(&tc->t_tcp_node); | ||
1456 | + tc->t_tcp_node_detached = true; | ||
1457 | + } | ||
1458 | } | ||
1459 | spin_unlock_irq(&rds_tcp_conn_lock); | ||
1460 | list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) { | ||
1461 | @@ -587,7 +592,7 @@ static void rds_tcp_sysctl_reset(struct net *net) | ||
1462 | |||
1463 | spin_lock_irq(&rds_tcp_conn_lock); | ||
1464 | list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) { | ||
1465 | - struct net *c_net = tc->t_cpath->cp_conn->c_net; | ||
1466 | + struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net); | ||
1467 | |||
1468 | if (net != c_net || !tc->t_sock) | ||
1469 | continue; | ||
1470 | diff --git a/net/rds/tcp.h b/net/rds/tcp.h | ||
1471 | index 864ca7d8f019..c6fa080e9b6d 100644 | ||
1472 | --- a/net/rds/tcp.h | ||
1473 | +++ b/net/rds/tcp.h | ||
1474 | @@ -12,6 +12,7 @@ struct rds_tcp_incoming { | ||
1475 | struct rds_tcp_connection { | ||
1476 | |||
1477 | struct list_head t_tcp_node; | ||
1478 | + bool t_tcp_node_detached; | ||
1479 | struct rds_conn_path *t_cpath; | ||
1480 | /* t_conn_path_lock synchronizes the connection establishment between | ||
1481 | * rds_tcp_accept_one and rds_tcp_conn_path_connect | ||
1482 | diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c | ||
1483 | index 33cfe5d3d6cb..8900ea5cbabf 100644 | ||
1484 | --- a/security/selinux/ss/services.c | ||
1485 | +++ b/security/selinux/ss/services.c | ||
1486 | @@ -867,6 +867,9 @@ int security_bounded_transition(u32 old_sid, u32 new_sid) | ||
1487 | int index; | ||
1488 | int rc; | ||
1489 | |||
1490 | + if (!ss_initialized) | ||
1491 | + return 0; | ||
1492 | + | ||
1493 | read_lock(&policy_rwlock); | ||
1494 | |||
1495 | rc = -EINVAL; | ||
1496 | @@ -1413,27 +1416,25 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len, | ||
1497 | if (!scontext_len) | ||
1498 | return -EINVAL; | ||
1499 | |||
1500 | + /* Copy the string to allow changes and ensure a NUL terminator */ | ||
1501 | + scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags); | ||
1502 | + if (!scontext2) | ||
1503 | + return -ENOMEM; | ||
1504 | + | ||
1505 | if (!ss_initialized) { | ||
1506 | int i; | ||
1507 | |||
1508 | for (i = 1; i < SECINITSID_NUM; i++) { | ||
1509 | - if (!strcmp(initial_sid_to_string[i], scontext)) { | ||
1510 | + if (!strcmp(initial_sid_to_string[i], scontext2)) { | ||
1511 | *sid = i; | ||
1512 | - return 0; | ||
1513 | + goto out; | ||
1514 | } | ||
1515 | } | ||
1516 | *sid = SECINITSID_KERNEL; | ||
1517 | - return 0; | ||
1518 | + goto out; | ||
1519 | } | ||
1520 | *sid = SECSID_NULL; | ||
1521 | |||
1522 | - /* Copy the string so that we can modify the copy as we parse it. */ | ||
1523 | - scontext2 = kmalloc(scontext_len + 1, gfp_flags); | ||
1524 | - if (!scontext2) | ||
1525 | - return -ENOMEM; | ||
1526 | - memcpy(scontext2, scontext, scontext_len); | ||
1527 | - scontext2[scontext_len] = 0; | ||
1528 | - | ||
1529 | if (force) { | ||
1530 | /* Save another copy for storing in uninterpreted form */ | ||
1531 | rc = -ENOMEM; | ||
1532 | diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c | ||
1533 | index 070a6880980e..c60a57797640 100644 | ||
1534 | --- a/sound/soc/ux500/mop500.c | ||
1535 | +++ b/sound/soc/ux500/mop500.c | ||
1536 | @@ -163,3 +163,7 @@ static struct platform_driver snd_soc_mop500_driver = { | ||
1537 | }; | ||
1538 | |||
1539 | module_platform_driver(snd_soc_mop500_driver); | ||
1540 | + | ||
1541 | +MODULE_LICENSE("GPL v2"); | ||
1542 | +MODULE_DESCRIPTION("ASoC MOP500 board driver"); | ||
1543 | +MODULE_AUTHOR("Ola Lilja"); | ||
1544 | diff --git a/sound/soc/ux500/ux500_pcm.c b/sound/soc/ux500/ux500_pcm.c | ||
1545 | index f12c01dddc8d..d35ba7700f46 100644 | ||
1546 | --- a/sound/soc/ux500/ux500_pcm.c | ||
1547 | +++ b/sound/soc/ux500/ux500_pcm.c | ||
1548 | @@ -165,3 +165,8 @@ int ux500_pcm_unregister_platform(struct platform_device *pdev) | ||
1549 | return 0; | ||
1550 | } | ||
1551 | EXPORT_SYMBOL_GPL(ux500_pcm_unregister_platform); | ||
1552 | + | ||
1553 | +MODULE_AUTHOR("Ola Lilja"); | ||
1554 | +MODULE_AUTHOR("Roger Nilsson"); | ||
1555 | +MODULE_DESCRIPTION("ASoC UX500 driver"); | ||
1556 | +MODULE_LICENSE("GPL v2"); |