Contents of /trunk/kernel-magellan/patches-4.15/0105-4.15.6-all-fixes.patch
Parent Directory | Revision Log
Revision 3089 -
(show annotations)
(download)
Wed Mar 21 14:52:34 2018 UTC (6 years, 6 months ago) by niro
File size: 48432 byte(s)
Wed Mar 21 14:52:34 2018 UTC (6 years, 6 months ago) by niro
File size: 48432 byte(s)
-linux-4.15.6
1 | diff --git a/Makefile b/Makefile |
2 | index 28c537fbe328..51563c76bdf6 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,7 +1,7 @@ |
6 | # SPDX-License-Identifier: GPL-2.0 |
7 | VERSION = 4 |
8 | PATCHLEVEL = 15 |
9 | -SUBLEVEL = 5 |
10 | +SUBLEVEL = 6 |
11 | EXTRAVERSION = |
12 | NAME = Fearless Coyote |
13 | |
14 | diff --git a/arch/arm/common/bL_switcher_dummy_if.c b/arch/arm/common/bL_switcher_dummy_if.c |
15 | index 4c10c6452678..f4dc1714a79e 100644 |
16 | --- a/arch/arm/common/bL_switcher_dummy_if.c |
17 | +++ b/arch/arm/common/bL_switcher_dummy_if.c |
18 | @@ -57,3 +57,7 @@ static struct miscdevice bL_switcher_device = { |
19 | &bL_switcher_fops |
20 | }; |
21 | module_misc_device(bL_switcher_device); |
22 | + |
23 | +MODULE_AUTHOR("Nicolas Pitre <nico@linaro.org>"); |
24 | +MODULE_LICENSE("GPL v2"); |
25 | +MODULE_DESCRIPTION("big.LITTLE switcher dummy user interface"); |
26 | diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi |
27 | index 26396ef53bde..ea407aff1251 100644 |
28 | --- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi |
29 | +++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi |
30 | @@ -81,6 +81,7 @@ |
31 | reg = <0x000>; |
32 | enable-method = "psci"; |
33 | cpu-idle-states = <&CPU_SLEEP_0>; |
34 | + #cooling-cells = <2>; |
35 | }; |
36 | |
37 | cpu1: cpu@1 { |
38 | @@ -97,6 +98,7 @@ |
39 | reg = <0x100>; |
40 | enable-method = "psci"; |
41 | cpu-idle-states = <&CPU_SLEEP_0>; |
42 | + #cooling-cells = <2>; |
43 | }; |
44 | |
45 | cpu3: cpu@101 { |
46 | diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S |
47 | index 1c3b7ceb36d2..e7273a606a07 100644 |
48 | --- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S |
49 | +++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S |
50 | @@ -55,29 +55,31 @@ |
51 | #define RAB1bl %bl |
52 | #define RAB2bl %cl |
53 | |
54 | +#define CD0 0x0(%rsp) |
55 | +#define CD1 0x8(%rsp) |
56 | +#define CD2 0x10(%rsp) |
57 | + |
58 | +# used only before/after all rounds |
59 | #define RCD0 %r8 |
60 | #define RCD1 %r9 |
61 | #define RCD2 %r10 |
62 | |
63 | -#define RCD0d %r8d |
64 | -#define RCD1d %r9d |
65 | -#define RCD2d %r10d |
66 | - |
67 | -#define RX0 %rbp |
68 | -#define RX1 %r11 |
69 | -#define RX2 %r12 |
70 | +# used only during rounds |
71 | +#define RX0 %r8 |
72 | +#define RX1 %r9 |
73 | +#define RX2 %r10 |
74 | |
75 | -#define RX0d %ebp |
76 | -#define RX1d %r11d |
77 | -#define RX2d %r12d |
78 | +#define RX0d %r8d |
79 | +#define RX1d %r9d |
80 | +#define RX2d %r10d |
81 | |
82 | -#define RY0 %r13 |
83 | -#define RY1 %r14 |
84 | -#define RY2 %r15 |
85 | +#define RY0 %r11 |
86 | +#define RY1 %r12 |
87 | +#define RY2 %r13 |
88 | |
89 | -#define RY0d %r13d |
90 | -#define RY1d %r14d |
91 | -#define RY2d %r15d |
92 | +#define RY0d %r11d |
93 | +#define RY1d %r12d |
94 | +#define RY2d %r13d |
95 | |
96 | #define RT0 %rdx |
97 | #define RT1 %rsi |
98 | @@ -85,6 +87,8 @@ |
99 | #define RT0d %edx |
100 | #define RT1d %esi |
101 | |
102 | +#define RT1bl %sil |
103 | + |
104 | #define do16bit_ror(rot, op1, op2, T0, T1, tmp1, tmp2, ab, dst) \ |
105 | movzbl ab ## bl, tmp2 ## d; \ |
106 | movzbl ab ## bh, tmp1 ## d; \ |
107 | @@ -92,6 +96,11 @@ |
108 | op1##l T0(CTX, tmp2, 4), dst ## d; \ |
109 | op2##l T1(CTX, tmp1, 4), dst ## d; |
110 | |
111 | +#define swap_ab_with_cd(ab, cd, tmp) \ |
112 | + movq cd, tmp; \ |
113 | + movq ab, cd; \ |
114 | + movq tmp, ab; |
115 | + |
116 | /* |
117 | * Combined G1 & G2 function. Reordered with help of rotates to have moves |
118 | * at begining. |
119 | @@ -110,15 +119,15 @@ |
120 | /* G1,2 && G2,2 */ \ |
121 | do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 0, x ## 0); \ |
122 | do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 0, y ## 0); \ |
123 | - xchgq cd ## 0, ab ## 0; \ |
124 | + swap_ab_with_cd(ab ## 0, cd ## 0, RT0); \ |
125 | \ |
126 | do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 1, x ## 1); \ |
127 | do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 1, y ## 1); \ |
128 | - xchgq cd ## 1, ab ## 1; \ |
129 | + swap_ab_with_cd(ab ## 1, cd ## 1, RT0); \ |
130 | \ |
131 | do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 2, x ## 2); \ |
132 | do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 2, y ## 2); \ |
133 | - xchgq cd ## 2, ab ## 2; |
134 | + swap_ab_with_cd(ab ## 2, cd ## 2, RT0); |
135 | |
136 | #define enc_round_end(ab, x, y, n) \ |
137 | addl y ## d, x ## d; \ |
138 | @@ -168,6 +177,16 @@ |
139 | decrypt_round3(ba, dc, (n*2)+1); \ |
140 | decrypt_round3(ba, dc, (n*2)); |
141 | |
142 | +#define push_cd() \ |
143 | + pushq RCD2; \ |
144 | + pushq RCD1; \ |
145 | + pushq RCD0; |
146 | + |
147 | +#define pop_cd() \ |
148 | + popq RCD0; \ |
149 | + popq RCD1; \ |
150 | + popq RCD2; |
151 | + |
152 | #define inpack3(in, n, xy, m) \ |
153 | movq 4*(n)(in), xy ## 0; \ |
154 | xorq w+4*m(CTX), xy ## 0; \ |
155 | @@ -223,11 +242,8 @@ ENTRY(__twofish_enc_blk_3way) |
156 | * %rdx: src, RIO |
157 | * %rcx: bool, if true: xor output |
158 | */ |
159 | - pushq %r15; |
160 | - pushq %r14; |
161 | pushq %r13; |
162 | pushq %r12; |
163 | - pushq %rbp; |
164 | pushq %rbx; |
165 | |
166 | pushq %rcx; /* bool xor */ |
167 | @@ -235,40 +251,36 @@ ENTRY(__twofish_enc_blk_3way) |
168 | |
169 | inpack_enc3(); |
170 | |
171 | - encrypt_cycle3(RAB, RCD, 0); |
172 | - encrypt_cycle3(RAB, RCD, 1); |
173 | - encrypt_cycle3(RAB, RCD, 2); |
174 | - encrypt_cycle3(RAB, RCD, 3); |
175 | - encrypt_cycle3(RAB, RCD, 4); |
176 | - encrypt_cycle3(RAB, RCD, 5); |
177 | - encrypt_cycle3(RAB, RCD, 6); |
178 | - encrypt_cycle3(RAB, RCD, 7); |
179 | + push_cd(); |
180 | + encrypt_cycle3(RAB, CD, 0); |
181 | + encrypt_cycle3(RAB, CD, 1); |
182 | + encrypt_cycle3(RAB, CD, 2); |
183 | + encrypt_cycle3(RAB, CD, 3); |
184 | + encrypt_cycle3(RAB, CD, 4); |
185 | + encrypt_cycle3(RAB, CD, 5); |
186 | + encrypt_cycle3(RAB, CD, 6); |
187 | + encrypt_cycle3(RAB, CD, 7); |
188 | + pop_cd(); |
189 | |
190 | popq RIO; /* dst */ |
191 | - popq %rbp; /* bool xor */ |
192 | + popq RT1; /* bool xor */ |
193 | |
194 | - testb %bpl, %bpl; |
195 | + testb RT1bl, RT1bl; |
196 | jnz .L__enc_xor3; |
197 | |
198 | outunpack_enc3(mov); |
199 | |
200 | popq %rbx; |
201 | - popq %rbp; |
202 | popq %r12; |
203 | popq %r13; |
204 | - popq %r14; |
205 | - popq %r15; |
206 | ret; |
207 | |
208 | .L__enc_xor3: |
209 | outunpack_enc3(xor); |
210 | |
211 | popq %rbx; |
212 | - popq %rbp; |
213 | popq %r12; |
214 | popq %r13; |
215 | - popq %r14; |
216 | - popq %r15; |
217 | ret; |
218 | ENDPROC(__twofish_enc_blk_3way) |
219 | |
220 | @@ -278,35 +290,31 @@ ENTRY(twofish_dec_blk_3way) |
221 | * %rsi: dst |
222 | * %rdx: src, RIO |
223 | */ |
224 | - pushq %r15; |
225 | - pushq %r14; |
226 | pushq %r13; |
227 | pushq %r12; |
228 | - pushq %rbp; |
229 | pushq %rbx; |
230 | |
231 | pushq %rsi; /* dst */ |
232 | |
233 | inpack_dec3(); |
234 | |
235 | - decrypt_cycle3(RAB, RCD, 7); |
236 | - decrypt_cycle3(RAB, RCD, 6); |
237 | - decrypt_cycle3(RAB, RCD, 5); |
238 | - decrypt_cycle3(RAB, RCD, 4); |
239 | - decrypt_cycle3(RAB, RCD, 3); |
240 | - decrypt_cycle3(RAB, RCD, 2); |
241 | - decrypt_cycle3(RAB, RCD, 1); |
242 | - decrypt_cycle3(RAB, RCD, 0); |
243 | + push_cd(); |
244 | + decrypt_cycle3(RAB, CD, 7); |
245 | + decrypt_cycle3(RAB, CD, 6); |
246 | + decrypt_cycle3(RAB, CD, 5); |
247 | + decrypt_cycle3(RAB, CD, 4); |
248 | + decrypt_cycle3(RAB, CD, 3); |
249 | + decrypt_cycle3(RAB, CD, 2); |
250 | + decrypt_cycle3(RAB, CD, 1); |
251 | + decrypt_cycle3(RAB, CD, 0); |
252 | + pop_cd(); |
253 | |
254 | popq RIO; /* dst */ |
255 | |
256 | outunpack_dec3(); |
257 | |
258 | popq %rbx; |
259 | - popq %rbp; |
260 | popq %r12; |
261 | popq %r13; |
262 | - popq %r14; |
263 | - popq %r15; |
264 | ret; |
265 | ENDPROC(twofish_dec_blk_3way) |
266 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c |
267 | index ac381437c291..17f4eca37d22 100644 |
268 | --- a/arch/x86/kvm/x86.c |
269 | +++ b/arch/x86/kvm/x86.c |
270 | @@ -2939,6 +2939,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) |
271 | pagefault_enable(); |
272 | kvm_x86_ops->vcpu_put(vcpu); |
273 | vcpu->arch.last_host_tsc = rdtsc(); |
274 | + /* |
275 | + * If userspace has set any breakpoints or watchpoints, dr6 is restored |
276 | + * on every vmexit, but if not, we might have a stale dr6 from the |
277 | + * guest. do_debug expects dr6 to be cleared after it runs, do the same. |
278 | + */ |
279 | + set_debugreg(0, 6); |
280 | } |
281 | |
282 | static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu, |
283 | diff --git a/block/blk-map.c b/block/blk-map.c |
284 | index d3a94719f03f..db9373bd31ac 100644 |
285 | --- a/block/blk-map.c |
286 | +++ b/block/blk-map.c |
287 | @@ -119,7 +119,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, |
288 | unsigned long align = q->dma_pad_mask | queue_dma_alignment(q); |
289 | struct bio *bio = NULL; |
290 | struct iov_iter i; |
291 | - int ret; |
292 | + int ret = -EINVAL; |
293 | |
294 | if (!iter_is_iovec(iter)) |
295 | goto fail; |
296 | @@ -148,7 +148,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, |
297 | __blk_rq_unmap_user(bio); |
298 | fail: |
299 | rq->bio = NULL; |
300 | - return -EINVAL; |
301 | + return ret; |
302 | } |
303 | EXPORT_SYMBOL(blk_rq_map_user_iov); |
304 | |
305 | diff --git a/drivers/android/binder.c b/drivers/android/binder.c |
306 | index ec0917fb7cca..255eabdca2a4 100644 |
307 | --- a/drivers/android/binder.c |
308 | +++ b/drivers/android/binder.c |
309 | @@ -1933,8 +1933,14 @@ static void binder_send_failed_reply(struct binder_transaction *t, |
310 | &target_thread->todo); |
311 | wake_up_interruptible(&target_thread->wait); |
312 | } else { |
313 | - WARN(1, "Unexpected reply error: %u\n", |
314 | - target_thread->reply_error.cmd); |
315 | + /* |
316 | + * Cannot get here for normal operation, but |
317 | + * we can if multiple synchronous transactions |
318 | + * are sent without blocking for responses. |
319 | + * Just ignore the 2nd error in this case. |
320 | + */ |
321 | + pr_warn("Unexpected reply error: %u\n", |
322 | + target_thread->reply_error.cmd); |
323 | } |
324 | binder_inner_proc_unlock(target_thread->proc); |
325 | binder_thread_dec_tmpref(target_thread); |
326 | @@ -2135,7 +2141,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, |
327 | int debug_id = buffer->debug_id; |
328 | |
329 | binder_debug(BINDER_DEBUG_TRANSACTION, |
330 | - "%d buffer release %d, size %zd-%zd, failed at %p\n", |
331 | + "%d buffer release %d, size %zd-%zd, failed at %pK\n", |
332 | proc->pid, buffer->debug_id, |
333 | buffer->data_size, buffer->offsets_size, failed_at); |
334 | |
335 | @@ -3647,7 +3653,7 @@ static int binder_thread_write(struct binder_proc *proc, |
336 | } |
337 | } |
338 | binder_debug(BINDER_DEBUG_DEAD_BINDER, |
339 | - "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", |
340 | + "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", |
341 | proc->pid, thread->pid, (u64)cookie, |
342 | death); |
343 | if (death == NULL) { |
344 | @@ -4316,6 +4322,15 @@ static int binder_thread_release(struct binder_proc *proc, |
345 | |
346 | binder_inner_proc_unlock(thread->proc); |
347 | |
348 | + /* |
349 | + * This is needed to avoid races between wake_up_poll() above and |
350 | + * and ep_remove_waitqueue() called for other reasons (eg the epoll file |
351 | + * descriptor being closed); ep_remove_waitqueue() holds an RCU read |
352 | + * lock, so we can be sure it's done after calling synchronize_rcu(). |
353 | + */ |
354 | + if (thread->looper & BINDER_LOOPER_STATE_POLL) |
355 | + synchronize_rcu(); |
356 | + |
357 | if (send_reply) |
358 | binder_send_failed_reply(send_reply, BR_DEAD_REPLY); |
359 | binder_release_work(proc, &thread->todo); |
360 | @@ -4331,6 +4346,8 @@ static unsigned int binder_poll(struct file *filp, |
361 | bool wait_for_proc_work; |
362 | |
363 | thread = binder_get_thread(proc); |
364 | + if (!thread) |
365 | + return POLLERR; |
366 | |
367 | binder_inner_proc_lock(thread->proc); |
368 | thread->looper |= BINDER_LOOPER_STATE_POLL; |
369 | @@ -4974,7 +4991,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m, |
370 | spin_lock(&t->lock); |
371 | to_proc = t->to_proc; |
372 | seq_printf(m, |
373 | - "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", |
374 | + "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d", |
375 | prefix, t->debug_id, t, |
376 | t->from ? t->from->proc->pid : 0, |
377 | t->from ? t->from->pid : 0, |
378 | @@ -4998,7 +5015,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m, |
379 | } |
380 | if (buffer->target_node) |
381 | seq_printf(m, " node %d", buffer->target_node->debug_id); |
382 | - seq_printf(m, " size %zd:%zd data %p\n", |
383 | + seq_printf(m, " size %zd:%zd data %pK\n", |
384 | buffer->data_size, buffer->offsets_size, |
385 | buffer->data); |
386 | } |
387 | diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c |
388 | index 142c6020cec7..5c0496d1ed41 100644 |
389 | --- a/drivers/crypto/s5p-sss.c |
390 | +++ b/drivers/crypto/s5p-sss.c |
391 | @@ -1926,15 +1926,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) |
392 | uint32_t aes_control; |
393 | unsigned long flags; |
394 | int err; |
395 | + u8 *iv; |
396 | |
397 | aes_control = SSS_AES_KEY_CHANGE_MODE; |
398 | if (mode & FLAGS_AES_DECRYPT) |
399 | aes_control |= SSS_AES_MODE_DECRYPT; |
400 | |
401 | - if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) |
402 | + if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) { |
403 | aes_control |= SSS_AES_CHAIN_MODE_CBC; |
404 | - else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) |
405 | + iv = req->info; |
406 | + } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) { |
407 | aes_control |= SSS_AES_CHAIN_MODE_CTR; |
408 | + iv = req->info; |
409 | + } else { |
410 | + iv = NULL; /* AES_ECB */ |
411 | + } |
412 | |
413 | if (dev->ctx->keylen == AES_KEYSIZE_192) |
414 | aes_control |= SSS_AES_KEY_SIZE_192; |
415 | @@ -1965,7 +1971,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) |
416 | goto outdata_error; |
417 | |
418 | SSS_AES_WRITE(dev, AES_CONTROL, aes_control); |
419 | - s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen); |
420 | + s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen); |
421 | |
422 | s5p_set_dma_indata(dev, dev->sg_src); |
423 | s5p_set_dma_outdata(dev, dev->sg_dst); |
424 | diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c |
425 | index 8289ee482f49..09bd6c6c176c 100644 |
426 | --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c |
427 | +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c |
428 | @@ -3648,6 +3648,12 @@ static int pvr2_send_request_ex(struct pvr2_hdw *hdw, |
429 | hdw); |
430 | hdw->ctl_write_urb->actual_length = 0; |
431 | hdw->ctl_write_pend_flag = !0; |
432 | + if (usb_urb_ep_type_check(hdw->ctl_write_urb)) { |
433 | + pvr2_trace( |
434 | + PVR2_TRACE_ERROR_LEGS, |
435 | + "Invalid write control endpoint"); |
436 | + return -EINVAL; |
437 | + } |
438 | status = usb_submit_urb(hdw->ctl_write_urb,GFP_KERNEL); |
439 | if (status < 0) { |
440 | pvr2_trace(PVR2_TRACE_ERROR_LEGS, |
441 | @@ -3672,6 +3678,12 @@ status); |
442 | hdw); |
443 | hdw->ctl_read_urb->actual_length = 0; |
444 | hdw->ctl_read_pend_flag = !0; |
445 | + if (usb_urb_ep_type_check(hdw->ctl_read_urb)) { |
446 | + pvr2_trace( |
447 | + PVR2_TRACE_ERROR_LEGS, |
448 | + "Invalid read control endpoint"); |
449 | + return -EINVAL; |
450 | + } |
451 | status = usb_submit_urb(hdw->ctl_read_urb,GFP_KERNEL); |
452 | if (status < 0) { |
453 | pvr2_trace(PVR2_TRACE_ERROR_LEGS, |
454 | diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h |
455 | index 0ccccbaf530d..e4b10b2d1a08 100644 |
456 | --- a/drivers/misc/mei/hw-me-regs.h |
457 | +++ b/drivers/misc/mei/hw-me-regs.h |
458 | @@ -132,6 +132,11 @@ |
459 | #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */ |
460 | #define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */ |
461 | |
462 | +#define MEI_DEV_ID_CNP_LP 0x9DE0 /* Cannon Point LP */ |
463 | +#define MEI_DEV_ID_CNP_LP_4 0x9DE4 /* Cannon Point LP 4 (iTouch) */ |
464 | +#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */ |
465 | +#define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */ |
466 | + |
467 | /* |
468 | * MEI HW Section |
469 | */ |
470 | diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c |
471 | index 4a0ccda4d04b..ea4e152270a3 100644 |
472 | --- a/drivers/misc/mei/pci-me.c |
473 | +++ b/drivers/misc/mei/pci-me.c |
474 | @@ -98,6 +98,11 @@ static const struct pci_device_id mei_me_pci_tbl[] = { |
475 | {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)}, |
476 | {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)}, |
477 | |
478 | + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)}, |
479 | + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)}, |
480 | + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)}, |
481 | + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)}, |
482 | + |
483 | /* required last entry */ |
484 | {0, } |
485 | }; |
486 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c |
487 | index a8ec589d1359..e29cd5c7d39f 100644 |
488 | --- a/drivers/net/tun.c |
489 | +++ b/drivers/net/tun.c |
490 | @@ -1317,27 +1317,23 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile, |
491 | skb->truesize += skb->data_len; |
492 | |
493 | for (i = 1; i < it->nr_segs; i++) { |
494 | + struct page_frag *pfrag = ¤t->task_frag; |
495 | size_t fragsz = it->iov[i].iov_len; |
496 | - unsigned long offset; |
497 | - struct page *page; |
498 | - void *data; |
499 | |
500 | if (fragsz == 0 || fragsz > PAGE_SIZE) { |
501 | err = -EINVAL; |
502 | goto free; |
503 | } |
504 | |
505 | - local_bh_disable(); |
506 | - data = napi_alloc_frag(fragsz); |
507 | - local_bh_enable(); |
508 | - if (!data) { |
509 | + if (!skb_page_frag_refill(fragsz, pfrag, GFP_KERNEL)) { |
510 | err = -ENOMEM; |
511 | goto free; |
512 | } |
513 | |
514 | - page = virt_to_head_page(data); |
515 | - offset = data - page_address(page); |
516 | - skb_fill_page_desc(skb, i - 1, page, offset, fragsz); |
517 | + skb_fill_page_desc(skb, i - 1, pfrag->page, |
518 | + pfrag->offset, fragsz); |
519 | + page_ref_inc(pfrag->page); |
520 | + pfrag->offset += fragsz; |
521 | } |
522 | |
523 | return skb; |
524 | diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c |
525 | index ce35ff748adf..0a43b2e8906f 100644 |
526 | --- a/drivers/soc/qcom/rmtfs_mem.c |
527 | +++ b/drivers/soc/qcom/rmtfs_mem.c |
528 | @@ -267,3 +267,7 @@ static void qcom_rmtfs_mem_exit(void) |
529 | unregister_chrdev_region(qcom_rmtfs_mem_major, QCOM_RMTFS_MEM_DEV_MAX); |
530 | } |
531 | module_exit(qcom_rmtfs_mem_exit); |
532 | + |
533 | +MODULE_AUTHOR("Linaro Ltd"); |
534 | +MODULE_DESCRIPTION("Qualcomm Remote Filesystem memory driver"); |
535 | +MODULE_LICENSE("GPL v2"); |
536 | diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c |
537 | index 372ce9913e6d..e7541dc90473 100644 |
538 | --- a/drivers/staging/android/ashmem.c |
539 | +++ b/drivers/staging/android/ashmem.c |
540 | @@ -710,30 +710,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, |
541 | size_t pgstart, pgend; |
542 | int ret = -EINVAL; |
543 | |
544 | + mutex_lock(&ashmem_mutex); |
545 | + |
546 | if (unlikely(!asma->file)) |
547 | - return -EINVAL; |
548 | + goto out_unlock; |
549 | |
550 | - if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) |
551 | - return -EFAULT; |
552 | + if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) { |
553 | + ret = -EFAULT; |
554 | + goto out_unlock; |
555 | + } |
556 | |
557 | /* per custom, you can pass zero for len to mean "everything onward" */ |
558 | if (!pin.len) |
559 | pin.len = PAGE_ALIGN(asma->size) - pin.offset; |
560 | |
561 | if (unlikely((pin.offset | pin.len) & ~PAGE_MASK)) |
562 | - return -EINVAL; |
563 | + goto out_unlock; |
564 | |
565 | if (unlikely(((__u32)-1) - pin.offset < pin.len)) |
566 | - return -EINVAL; |
567 | + goto out_unlock; |
568 | |
569 | if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len)) |
570 | - return -EINVAL; |
571 | + goto out_unlock; |
572 | |
573 | pgstart = pin.offset / PAGE_SIZE; |
574 | pgend = pgstart + (pin.len / PAGE_SIZE) - 1; |
575 | |
576 | - mutex_lock(&ashmem_mutex); |
577 | - |
578 | switch (cmd) { |
579 | case ASHMEM_PIN: |
580 | ret = ashmem_pin(asma, pgstart, pgend); |
581 | @@ -746,6 +748,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, |
582 | break; |
583 | } |
584 | |
585 | +out_unlock: |
586 | mutex_unlock(&ashmem_mutex); |
587 | |
588 | return ret; |
589 | diff --git a/drivers/staging/android/ion/ion-ioctl.c b/drivers/staging/android/ion/ion-ioctl.c |
590 | index c78989351f9c..6cfed48f376e 100644 |
591 | --- a/drivers/staging/android/ion/ion-ioctl.c |
592 | +++ b/drivers/staging/android/ion/ion-ioctl.c |
593 | @@ -70,8 +70,10 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) |
594 | return -EFAULT; |
595 | |
596 | ret = validate_ioctl_arg(cmd, &data); |
597 | - if (WARN_ON_ONCE(ret)) |
598 | + if (ret) { |
599 | + pr_warn_once("%s: ioctl validate failed\n", __func__); |
600 | return ret; |
601 | + } |
602 | |
603 | if (!(dir & _IOC_WRITE)) |
604 | memset(&data, 0, sizeof(data)); |
605 | diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c |
606 | index 4dc5d7a589c2..b6ece18e6a88 100644 |
607 | --- a/drivers/staging/android/ion/ion_system_heap.c |
608 | +++ b/drivers/staging/android/ion/ion_system_heap.c |
609 | @@ -371,7 +371,7 @@ static int ion_system_contig_heap_allocate(struct ion_heap *heap, |
610 | unsigned long i; |
611 | int ret; |
612 | |
613 | - page = alloc_pages(low_order_gfp_flags, order); |
614 | + page = alloc_pages(low_order_gfp_flags | __GFP_NOWARN, order); |
615 | if (!page) |
616 | return -ENOMEM; |
617 | |
618 | diff --git a/drivers/staging/fsl-mc/bus/Kconfig b/drivers/staging/fsl-mc/bus/Kconfig |
619 | index 504c987447f2..eee1c1b277fa 100644 |
620 | --- a/drivers/staging/fsl-mc/bus/Kconfig |
621 | +++ b/drivers/staging/fsl-mc/bus/Kconfig |
622 | @@ -8,7 +8,7 @@ |
623 | |
624 | config FSL_MC_BUS |
625 | bool "QorIQ DPAA2 fsl-mc bus driver" |
626 | - depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86 || PPC))) |
627 | + depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86_LOCAL_APIC || PPC))) |
628 | select GENERIC_MSI_IRQ_DOMAIN |
629 | help |
630 | Driver to enable the bus infrastructure for the QorIQ DPAA2 |
631 | diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c |
632 | index cadfb96734ed..d4da2807eb55 100644 |
633 | --- a/drivers/staging/iio/adc/ad7192.c |
634 | +++ b/drivers/staging/iio/adc/ad7192.c |
635 | @@ -141,6 +141,8 @@ |
636 | #define AD7192_GPOCON_P1DAT BIT(1) /* P1 state */ |
637 | #define AD7192_GPOCON_P0DAT BIT(0) /* P0 state */ |
638 | |
639 | +#define AD7192_EXT_FREQ_MHZ_MIN 2457600 |
640 | +#define AD7192_EXT_FREQ_MHZ_MAX 5120000 |
641 | #define AD7192_INT_FREQ_MHZ 4915200 |
642 | |
643 | /* NOTE: |
644 | @@ -218,6 +220,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st) |
645 | ARRAY_SIZE(ad7192_calib_arr)); |
646 | } |
647 | |
648 | +static inline bool ad7192_valid_external_frequency(u32 freq) |
649 | +{ |
650 | + return (freq >= AD7192_EXT_FREQ_MHZ_MIN && |
651 | + freq <= AD7192_EXT_FREQ_MHZ_MAX); |
652 | +} |
653 | + |
654 | static int ad7192_setup(struct ad7192_state *st, |
655 | const struct ad7192_platform_data *pdata) |
656 | { |
657 | @@ -243,17 +251,20 @@ static int ad7192_setup(struct ad7192_state *st, |
658 | id); |
659 | |
660 | switch (pdata->clock_source_sel) { |
661 | - case AD7192_CLK_EXT_MCLK1_2: |
662 | - case AD7192_CLK_EXT_MCLK2: |
663 | - st->mclk = AD7192_INT_FREQ_MHZ; |
664 | - break; |
665 | case AD7192_CLK_INT: |
666 | case AD7192_CLK_INT_CO: |
667 | - if (pdata->ext_clk_hz) |
668 | - st->mclk = pdata->ext_clk_hz; |
669 | - else |
670 | - st->mclk = AD7192_INT_FREQ_MHZ; |
671 | + st->mclk = AD7192_INT_FREQ_MHZ; |
672 | break; |
673 | + case AD7192_CLK_EXT_MCLK1_2: |
674 | + case AD7192_CLK_EXT_MCLK2: |
675 | + if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) { |
676 | + st->mclk = pdata->ext_clk_hz; |
677 | + break; |
678 | + } |
679 | + dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n", |
680 | + pdata->ext_clk_hz); |
681 | + ret = -EINVAL; |
682 | + goto out; |
683 | default: |
684 | ret = -EINVAL; |
685 | goto out; |
686 | diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c |
687 | index 2b28fb9c0048..3bcf49466361 100644 |
688 | --- a/drivers/staging/iio/impedance-analyzer/ad5933.c |
689 | +++ b/drivers/staging/iio/impedance-analyzer/ad5933.c |
690 | @@ -648,8 +648,6 @@ static int ad5933_register_ring_funcs_and_init(struct iio_dev *indio_dev) |
691 | /* Ring buffer functions - here trigger setup related */ |
692 | indio_dev->setup_ops = &ad5933_ring_setup_ops; |
693 | |
694 | - indio_dev->modes |= INDIO_BUFFER_HARDWARE; |
695 | - |
696 | return 0; |
697 | } |
698 | |
699 | @@ -762,7 +760,7 @@ static int ad5933_probe(struct i2c_client *client, |
700 | indio_dev->dev.parent = &client->dev; |
701 | indio_dev->info = &ad5933_info; |
702 | indio_dev->name = id->name; |
703 | - indio_dev->modes = INDIO_DIRECT_MODE; |
704 | + indio_dev->modes = (INDIO_BUFFER_SOFTWARE | INDIO_DIRECT_MODE); |
705 | indio_dev->channels = ad5933_channels; |
706 | indio_dev->num_channels = ARRAY_SIZE(ad5933_channels); |
707 | |
708 | diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c |
709 | index e26e685d8a57..5851052d4668 100644 |
710 | --- a/drivers/usb/host/xhci-debugfs.c |
711 | +++ b/drivers/usb/host/xhci-debugfs.c |
712 | @@ -211,7 +211,7 @@ static void xhci_ring_dump_segment(struct seq_file *s, |
713 | static int xhci_ring_trb_show(struct seq_file *s, void *unused) |
714 | { |
715 | int i; |
716 | - struct xhci_ring *ring = s->private; |
717 | + struct xhci_ring *ring = *(struct xhci_ring **)s->private; |
718 | struct xhci_segment *seg = ring->first_seg; |
719 | |
720 | for (i = 0; i < ring->num_segs; i++) { |
721 | @@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci, |
722 | |
723 | snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index); |
724 | epriv->root = xhci_debugfs_create_ring_dir(xhci, |
725 | - &dev->eps[ep_index].new_ring, |
726 | + &dev->eps[ep_index].ring, |
727 | epriv->name, |
728 | spriv->root); |
729 | spriv->eps[ep_index] = epriv; |
730 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c |
731 | index da6dbe3ebd8b..5c1326154e66 100644 |
732 | --- a/drivers/usb/host/xhci.c |
733 | +++ b/drivers/usb/host/xhci.c |
734 | @@ -652,8 +652,6 @@ static void xhci_stop(struct usb_hcd *hcd) |
735 | return; |
736 | } |
737 | |
738 | - xhci_debugfs_exit(xhci); |
739 | - |
740 | spin_lock_irq(&xhci->lock); |
741 | xhci->xhc_state |= XHCI_STATE_HALTED; |
742 | xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; |
743 | @@ -685,6 +683,7 @@ static void xhci_stop(struct usb_hcd *hcd) |
744 | |
745 | xhci_dbg_trace(xhci, trace_xhci_dbg_init, "cleaning up memory"); |
746 | xhci_mem_cleanup(xhci); |
747 | + xhci_debugfs_exit(xhci); |
748 | xhci_dbg_trace(xhci, trace_xhci_dbg_init, |
749 | "xhci_stop completed - status = %x", |
750 | readl(&xhci->op_regs->status)); |
751 | @@ -1018,6 +1017,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) |
752 | |
753 | xhci_dbg(xhci, "cleaning up memory\n"); |
754 | xhci_mem_cleanup(xhci); |
755 | + xhci_debugfs_exit(xhci); |
756 | xhci_dbg(xhci, "xhci_stop completed - status = %x\n", |
757 | readl(&xhci->op_regs->status)); |
758 | |
759 | @@ -3551,12 +3551,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) |
760 | virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING; |
761 | del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); |
762 | } |
763 | - |
764 | + xhci_debugfs_remove_slot(xhci, udev->slot_id); |
765 | ret = xhci_disable_slot(xhci, udev->slot_id); |
766 | - if (ret) { |
767 | - xhci_debugfs_remove_slot(xhci, udev->slot_id); |
768 | + if (ret) |
769 | xhci_free_virt_device(xhci, udev->slot_id); |
770 | - } |
771 | } |
772 | |
773 | int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) |
774 | diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c |
775 | index e31a6f204397..86037e5b1101 100644 |
776 | --- a/drivers/usb/usbip/stub_dev.c |
777 | +++ b/drivers/usb/usbip/stub_dev.c |
778 | @@ -73,6 +73,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr, |
779 | goto err; |
780 | |
781 | sdev->ud.tcp_socket = socket; |
782 | + sdev->ud.sockfd = sockfd; |
783 | |
784 | spin_unlock_irq(&sdev->ud.lock); |
785 | |
786 | @@ -172,6 +173,7 @@ static void stub_shutdown_connection(struct usbip_device *ud) |
787 | if (ud->tcp_socket) { |
788 | sockfd_put(ud->tcp_socket); |
789 | ud->tcp_socket = NULL; |
790 | + ud->sockfd = -1; |
791 | } |
792 | |
793 | /* 3. free used data */ |
794 | @@ -266,6 +268,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev) |
795 | sdev->ud.status = SDEV_ST_AVAILABLE; |
796 | spin_lock_init(&sdev->ud.lock); |
797 | sdev->ud.tcp_socket = NULL; |
798 | + sdev->ud.sockfd = -1; |
799 | |
800 | INIT_LIST_HEAD(&sdev->priv_init); |
801 | INIT_LIST_HEAD(&sdev->priv_tx); |
802 | diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c |
803 | index c3e1008aa491..20e3d4609583 100644 |
804 | --- a/drivers/usb/usbip/vhci_hcd.c |
805 | +++ b/drivers/usb/usbip/vhci_hcd.c |
806 | @@ -984,6 +984,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud) |
807 | if (vdev->ud.tcp_socket) { |
808 | sockfd_put(vdev->ud.tcp_socket); |
809 | vdev->ud.tcp_socket = NULL; |
810 | + vdev->ud.sockfd = -1; |
811 | } |
812 | pr_info("release socket\n"); |
813 | |
814 | @@ -1030,6 +1031,7 @@ static void vhci_device_reset(struct usbip_device *ud) |
815 | if (ud->tcp_socket) { |
816 | sockfd_put(ud->tcp_socket); |
817 | ud->tcp_socket = NULL; |
818 | + ud->sockfd = -1; |
819 | } |
820 | ud->status = VDEV_ST_NULL; |
821 | |
822 | diff --git a/drivers/video/fbdev/mmp/core.c b/drivers/video/fbdev/mmp/core.c |
823 | index a0f496049db7..3a6bb6561ba0 100644 |
824 | --- a/drivers/video/fbdev/mmp/core.c |
825 | +++ b/drivers/video/fbdev/mmp/core.c |
826 | @@ -23,6 +23,7 @@ |
827 | #include <linux/slab.h> |
828 | #include <linux/dma-mapping.h> |
829 | #include <linux/export.h> |
830 | +#include <linux/module.h> |
831 | #include <video/mmp_disp.h> |
832 | |
833 | static struct mmp_overlay *path_get_overlay(struct mmp_path *path, |
834 | @@ -249,3 +250,7 @@ void mmp_unregister_path(struct mmp_path *path) |
835 | mutex_unlock(&disp_lock); |
836 | } |
837 | EXPORT_SYMBOL_GPL(mmp_unregister_path); |
838 | + |
839 | +MODULE_AUTHOR("Zhou Zhu <zzhu3@marvell.com>"); |
840 | +MODULE_DESCRIPTION("Marvell MMP display framework"); |
841 | +MODULE_LICENSE("GPL"); |
842 | diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h |
843 | index d72b2e7dd500..59c77c1388ae 100644 |
844 | --- a/include/linux/ptr_ring.h |
845 | +++ b/include/linux/ptr_ring.h |
846 | @@ -451,9 +451,14 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r, |
847 | __PTR_RING_PEEK_CALL_v; \ |
848 | }) |
849 | |
850 | +/* Not all gfp_t flags (besides GFP_KERNEL) are allowed. See |
851 | + * documentation for vmalloc for which of them are legal. |
852 | + */ |
853 | static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp) |
854 | { |
855 | - return kcalloc(size, sizeof(void *), gfp); |
856 | + if (size * sizeof(void *) > KMALLOC_MAX_SIZE) |
857 | + return NULL; |
858 | + return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO); |
859 | } |
860 | |
861 | static inline void __ptr_ring_set_size(struct ptr_ring *r, int size) |
862 | @@ -586,7 +591,7 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp, |
863 | spin_unlock(&(r)->producer_lock); |
864 | spin_unlock_irqrestore(&(r)->consumer_lock, flags); |
865 | |
866 | - kfree(old); |
867 | + kvfree(old); |
868 | |
869 | return 0; |
870 | } |
871 | @@ -626,7 +631,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, |
872 | } |
873 | |
874 | for (i = 0; i < nrings; ++i) |
875 | - kfree(queues[i]); |
876 | + kvfree(queues[i]); |
877 | |
878 | kfree(queues); |
879 | |
880 | @@ -634,7 +639,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, |
881 | |
882 | nomem: |
883 | while (--i >= 0) |
884 | - kfree(queues[i]); |
885 | + kvfree(queues[i]); |
886 | |
887 | kfree(queues); |
888 | |
889 | @@ -649,7 +654,7 @@ static inline void ptr_ring_cleanup(struct ptr_ring *r, void (*destroy)(void *)) |
890 | if (destroy) |
891 | while ((ptr = ptr_ring_consume(r))) |
892 | destroy(ptr); |
893 | - kfree(r->queue); |
894 | + kvfree(r->queue); |
895 | } |
896 | |
897 | #endif /* _LINUX_PTR_RING_H */ |
898 | diff --git a/kernel/kcov.c b/kernel/kcov.c |
899 | index 7594c033d98a..2c16f1ab5e10 100644 |
900 | --- a/kernel/kcov.c |
901 | +++ b/kernel/kcov.c |
902 | @@ -358,7 +358,8 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd, |
903 | */ |
904 | if (kcov->mode != KCOV_MODE_INIT || !kcov->area) |
905 | return -EINVAL; |
906 | - if (kcov->t != NULL) |
907 | + t = current; |
908 | + if (kcov->t != NULL || t->kcov != NULL) |
909 | return -EBUSY; |
910 | if (arg == KCOV_TRACE_PC) |
911 | kcov->mode = KCOV_MODE_TRACE_PC; |
912 | @@ -370,7 +371,6 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd, |
913 | #endif |
914 | else |
915 | return -EINVAL; |
916 | - t = current; |
917 | /* Cache in task struct for performance. */ |
918 | t->kcov_size = kcov->size; |
919 | t->kcov_area = kcov->area; |
920 | diff --git a/mm/vmalloc.c b/mm/vmalloc.c |
921 | index 673942094328..ebff729cc956 100644 |
922 | --- a/mm/vmalloc.c |
923 | +++ b/mm/vmalloc.c |
924 | @@ -1943,11 +1943,15 @@ void *vmalloc_exec(unsigned long size) |
925 | } |
926 | |
927 | #if defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA32) |
928 | -#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL |
929 | +#define GFP_VMALLOC32 (GFP_DMA32 | GFP_KERNEL) |
930 | #elif defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA) |
931 | -#define GFP_VMALLOC32 GFP_DMA | GFP_KERNEL |
932 | +#define GFP_VMALLOC32 (GFP_DMA | GFP_KERNEL) |
933 | #else |
934 | -#define GFP_VMALLOC32 GFP_KERNEL |
935 | +/* |
936 | + * 64b systems should always have either DMA or DMA32 zones. For others |
937 | + * GFP_DMA32 should do the right thing and use the normal zone. |
938 | + */ |
939 | +#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL |
940 | #endif |
941 | |
942 | /** |
943 | diff --git a/net/core/dev.c b/net/core/dev.c |
944 | index 613fb4066be7..c8c102a3467f 100644 |
945 | --- a/net/core/dev.c |
946 | +++ b/net/core/dev.c |
947 | @@ -2815,7 +2815,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb, |
948 | |
949 | segs = skb_mac_gso_segment(skb, features); |
950 | |
951 | - if (unlikely(skb_needs_check(skb, tx_path))) |
952 | + if (unlikely(skb_needs_check(skb, tx_path) && !IS_ERR(segs))) |
953 | skb_warn_bad_offload(skb); |
954 | |
955 | return segs; |
956 | diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c |
957 | index 9834cfa21b21..0a3f88f08727 100644 |
958 | --- a/net/core/gen_estimator.c |
959 | +++ b/net/core/gen_estimator.c |
960 | @@ -159,7 +159,11 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats, |
961 | est->intvl_log = intvl_log; |
962 | est->cpu_bstats = cpu_bstats; |
963 | |
964 | + if (stats_lock) |
965 | + local_bh_disable(); |
966 | est_fetch_counters(est, &b); |
967 | + if (stats_lock) |
968 | + local_bh_enable(); |
969 | est->last_bytes = b.bytes; |
970 | est->last_packets = b.packets; |
971 | old = rcu_dereference_protected(*rate_est, 1); |
972 | diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c |
973 | index 518cea17b811..ea9b55309483 100644 |
974 | --- a/net/decnet/af_decnet.c |
975 | +++ b/net/decnet/af_decnet.c |
976 | @@ -1338,6 +1338,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use |
977 | lock_sock(sk); |
978 | err = __dn_setsockopt(sock, level, optname, optval, optlen, 0); |
979 | release_sock(sk); |
980 | +#ifdef CONFIG_NETFILTER |
981 | + /* we need to exclude all possible ENOPROTOOPTs except default case */ |
982 | + if (err == -ENOPROTOOPT && optname != DSO_LINKINFO && |
983 | + optname != DSO_STREAM && optname != DSO_SEQPACKET) |
984 | + err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen); |
985 | +#endif |
986 | |
987 | return err; |
988 | } |
989 | @@ -1445,15 +1451,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us |
990 | dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation); |
991 | break; |
992 | |
993 | - default: |
994 | -#ifdef CONFIG_NETFILTER |
995 | - return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen); |
996 | -#endif |
997 | - case DSO_LINKINFO: |
998 | - case DSO_STREAM: |
999 | - case DSO_SEQPACKET: |
1000 | - return -ENOPROTOOPT; |
1001 | - |
1002 | case DSO_MAXWINDOW: |
1003 | if (optlen != sizeof(unsigned long)) |
1004 | return -EINVAL; |
1005 | @@ -1501,6 +1498,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us |
1006 | return -EINVAL; |
1007 | scp->info_loc = u.info; |
1008 | break; |
1009 | + |
1010 | + case DSO_LINKINFO: |
1011 | + case DSO_STREAM: |
1012 | + case DSO_SEQPACKET: |
1013 | + default: |
1014 | + return -ENOPROTOOPT; |
1015 | } |
1016 | |
1017 | return 0; |
1018 | @@ -1514,6 +1517,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use |
1019 | lock_sock(sk); |
1020 | err = __dn_getsockopt(sock, level, optname, optval, optlen, 0); |
1021 | release_sock(sk); |
1022 | +#ifdef CONFIG_NETFILTER |
1023 | + if (err == -ENOPROTOOPT && optname != DSO_STREAM && |
1024 | + optname != DSO_SEQPACKET && optname != DSO_CONACCEPT && |
1025 | + optname != DSO_CONREJECT) { |
1026 | + int len; |
1027 | + |
1028 | + if (get_user(len, optlen)) |
1029 | + return -EFAULT; |
1030 | + |
1031 | + err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len); |
1032 | + if (err >= 0) |
1033 | + err = put_user(len, optlen); |
1034 | + } |
1035 | +#endif |
1036 | |
1037 | return err; |
1038 | } |
1039 | @@ -1579,26 +1596,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us |
1040 | r_data = &link; |
1041 | break; |
1042 | |
1043 | - default: |
1044 | -#ifdef CONFIG_NETFILTER |
1045 | - { |
1046 | - int ret, len; |
1047 | - |
1048 | - if (get_user(len, optlen)) |
1049 | - return -EFAULT; |
1050 | - |
1051 | - ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len); |
1052 | - if (ret >= 0) |
1053 | - ret = put_user(len, optlen); |
1054 | - return ret; |
1055 | - } |
1056 | -#endif |
1057 | - case DSO_STREAM: |
1058 | - case DSO_SEQPACKET: |
1059 | - case DSO_CONACCEPT: |
1060 | - case DSO_CONREJECT: |
1061 | - return -ENOPROTOOPT; |
1062 | - |
1063 | case DSO_MAXWINDOW: |
1064 | if (r_len > sizeof(unsigned long)) |
1065 | r_len = sizeof(unsigned long); |
1066 | @@ -1630,6 +1627,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us |
1067 | r_len = sizeof(unsigned char); |
1068 | r_data = &scp->info_rem; |
1069 | break; |
1070 | + |
1071 | + case DSO_STREAM: |
1072 | + case DSO_SEQPACKET: |
1073 | + case DSO_CONACCEPT: |
1074 | + case DSO_CONREJECT: |
1075 | + default: |
1076 | + return -ENOPROTOOPT; |
1077 | } |
1078 | |
1079 | if (r_data) { |
1080 | diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c |
1081 | index 60fb1eb7d7d8..c7df4969f80a 100644 |
1082 | --- a/net/ipv4/ip_sockglue.c |
1083 | +++ b/net/ipv4/ip_sockglue.c |
1084 | @@ -1251,11 +1251,8 @@ int ip_setsockopt(struct sock *sk, int level, |
1085 | if (err == -ENOPROTOOPT && optname != IP_HDRINCL && |
1086 | optname != IP_IPSEC_POLICY && |
1087 | optname != IP_XFRM_POLICY && |
1088 | - !ip_mroute_opt(optname)) { |
1089 | - lock_sock(sk); |
1090 | + !ip_mroute_opt(optname)) |
1091 | err = nf_setsockopt(sk, PF_INET, optname, optval, optlen); |
1092 | - release_sock(sk); |
1093 | - } |
1094 | #endif |
1095 | return err; |
1096 | } |
1097 | @@ -1280,12 +1277,9 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, |
1098 | if (err == -ENOPROTOOPT && optname != IP_HDRINCL && |
1099 | optname != IP_IPSEC_POLICY && |
1100 | optname != IP_XFRM_POLICY && |
1101 | - !ip_mroute_opt(optname)) { |
1102 | - lock_sock(sk); |
1103 | - err = compat_nf_setsockopt(sk, PF_INET, optname, |
1104 | - optval, optlen); |
1105 | - release_sock(sk); |
1106 | - } |
1107 | + !ip_mroute_opt(optname)) |
1108 | + err = compat_nf_setsockopt(sk, PF_INET, optname, optval, |
1109 | + optlen); |
1110 | #endif |
1111 | return err; |
1112 | } |
1113 | diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c |
1114 | index 69060e3abe85..1e4a7209a3d2 100644 |
1115 | --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c |
1116 | +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c |
1117 | @@ -431,7 +431,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) |
1118 | struct ipt_clusterip_tgt_info *cipinfo = par->targinfo; |
1119 | const struct ipt_entry *e = par->entryinfo; |
1120 | struct clusterip_config *config; |
1121 | - int ret; |
1122 | + int ret, i; |
1123 | |
1124 | if (par->nft_compat) { |
1125 | pr_err("cannot use CLUSTERIP target from nftables compat\n"); |
1126 | @@ -450,8 +450,18 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) |
1127 | pr_info("Please specify destination IP\n"); |
1128 | return -EINVAL; |
1129 | } |
1130 | - |
1131 | - /* FIXME: further sanity checks */ |
1132 | + if (cipinfo->num_local_nodes > ARRAY_SIZE(cipinfo->local_nodes)) { |
1133 | + pr_info("bad num_local_nodes %u\n", cipinfo->num_local_nodes); |
1134 | + return -EINVAL; |
1135 | + } |
1136 | + for (i = 0; i < cipinfo->num_local_nodes; i++) { |
1137 | + if (cipinfo->local_nodes[i] - 1 >= |
1138 | + sizeof(config->local_nodes) * 8) { |
1139 | + pr_info("bad local_nodes[%d] %u\n", |
1140 | + i, cipinfo->local_nodes[i]); |
1141 | + return -EINVAL; |
1142 | + } |
1143 | + } |
1144 | |
1145 | config = clusterip_config_find_get(par->net, e->ip.dst.s_addr, 1); |
1146 | if (!config) { |
1147 | diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |
1148 | index 89af9d88ca21..a5727036a8a8 100644 |
1149 | --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |
1150 | +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |
1151 | @@ -218,15 +218,19 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len) |
1152 | struct nf_conntrack_tuple tuple; |
1153 | |
1154 | memset(&tuple, 0, sizeof(tuple)); |
1155 | + |
1156 | + lock_sock(sk); |
1157 | tuple.src.u3.ip = inet->inet_rcv_saddr; |
1158 | tuple.src.u.tcp.port = inet->inet_sport; |
1159 | tuple.dst.u3.ip = inet->inet_daddr; |
1160 | tuple.dst.u.tcp.port = inet->inet_dport; |
1161 | tuple.src.l3num = PF_INET; |
1162 | tuple.dst.protonum = sk->sk_protocol; |
1163 | + release_sock(sk); |
1164 | |
1165 | /* We only do TCP and SCTP at the moment: is there a better way? */ |
1166 | - if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) { |
1167 | + if (tuple.dst.protonum != IPPROTO_TCP && |
1168 | + tuple.dst.protonum != IPPROTO_SCTP) { |
1169 | pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n"); |
1170 | return -ENOPROTOOPT; |
1171 | } |
1172 | diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c |
1173 | index e8ffb5b5d84e..d78d41fc4b1a 100644 |
1174 | --- a/net/ipv6/ipv6_sockglue.c |
1175 | +++ b/net/ipv6/ipv6_sockglue.c |
1176 | @@ -923,12 +923,8 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname, |
1177 | #ifdef CONFIG_NETFILTER |
1178 | /* we need to exclude all possible ENOPROTOOPTs except default case */ |
1179 | if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY && |
1180 | - optname != IPV6_XFRM_POLICY) { |
1181 | - lock_sock(sk); |
1182 | - err = nf_setsockopt(sk, PF_INET6, optname, optval, |
1183 | - optlen); |
1184 | - release_sock(sk); |
1185 | - } |
1186 | + optname != IPV6_XFRM_POLICY) |
1187 | + err = nf_setsockopt(sk, PF_INET6, optname, optval, optlen); |
1188 | #endif |
1189 | return err; |
1190 | } |
1191 | @@ -958,12 +954,9 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, |
1192 | #ifdef CONFIG_NETFILTER |
1193 | /* we need to exclude all possible ENOPROTOOPTs except default case */ |
1194 | if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY && |
1195 | - optname != IPV6_XFRM_POLICY) { |
1196 | - lock_sock(sk); |
1197 | - err = compat_nf_setsockopt(sk, PF_INET6, optname, |
1198 | - optval, optlen); |
1199 | - release_sock(sk); |
1200 | - } |
1201 | + optname != IPV6_XFRM_POLICY) |
1202 | + err = compat_nf_setsockopt(sk, PF_INET6, optname, optval, |
1203 | + optlen); |
1204 | #endif |
1205 | return err; |
1206 | } |
1207 | diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |
1208 | index 3b80a38f62b8..5863579800c1 100644 |
1209 | --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |
1210 | +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |
1211 | @@ -226,20 +226,27 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = { |
1212 | static int |
1213 | ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len) |
1214 | { |
1215 | - const struct inet_sock *inet = inet_sk(sk); |
1216 | + struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 }; |
1217 | const struct ipv6_pinfo *inet6 = inet6_sk(sk); |
1218 | + const struct inet_sock *inet = inet_sk(sk); |
1219 | const struct nf_conntrack_tuple_hash *h; |
1220 | struct sockaddr_in6 sin6; |
1221 | - struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 }; |
1222 | struct nf_conn *ct; |
1223 | + __be32 flow_label; |
1224 | + int bound_dev_if; |
1225 | |
1226 | + lock_sock(sk); |
1227 | tuple.src.u3.in6 = sk->sk_v6_rcv_saddr; |
1228 | tuple.src.u.tcp.port = inet->inet_sport; |
1229 | tuple.dst.u3.in6 = sk->sk_v6_daddr; |
1230 | tuple.dst.u.tcp.port = inet->inet_dport; |
1231 | tuple.dst.protonum = sk->sk_protocol; |
1232 | + bound_dev_if = sk->sk_bound_dev_if; |
1233 | + flow_label = inet6->flow_label; |
1234 | + release_sock(sk); |
1235 | |
1236 | - if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) |
1237 | + if (tuple.dst.protonum != IPPROTO_TCP && |
1238 | + tuple.dst.protonum != IPPROTO_SCTP) |
1239 | return -ENOPROTOOPT; |
1240 | |
1241 | if (*len < 0 || (unsigned int) *len < sizeof(sin6)) |
1242 | @@ -257,14 +264,13 @@ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len) |
1243 | |
1244 | sin6.sin6_family = AF_INET6; |
1245 | sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port; |
1246 | - sin6.sin6_flowinfo = inet6->flow_label & IPV6_FLOWINFO_MASK; |
1247 | + sin6.sin6_flowinfo = flow_label & IPV6_FLOWINFO_MASK; |
1248 | memcpy(&sin6.sin6_addr, |
1249 | &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6, |
1250 | sizeof(sin6.sin6_addr)); |
1251 | |
1252 | nf_ct_put(ct); |
1253 | - sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, |
1254 | - sk->sk_bound_dev_if); |
1255 | + sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, bound_dev_if); |
1256 | return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0; |
1257 | } |
1258 | |
1259 | diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c |
1260 | index 55802e97f906..d7070d18db20 100644 |
1261 | --- a/net/netfilter/x_tables.c |
1262 | +++ b/net/netfilter/x_tables.c |
1263 | @@ -39,7 +39,6 @@ MODULE_LICENSE("GPL"); |
1264 | MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); |
1265 | MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); |
1266 | |
1267 | -#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) |
1268 | #define XT_PCPU_BLOCK_SIZE 4096 |
1269 | |
1270 | struct compat_delta { |
1271 | @@ -210,6 +209,9 @@ xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision) |
1272 | { |
1273 | struct xt_match *match; |
1274 | |
1275 | + if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN) |
1276 | + return ERR_PTR(-EINVAL); |
1277 | + |
1278 | match = xt_find_match(nfproto, name, revision); |
1279 | if (IS_ERR(match)) { |
1280 | request_module("%st_%s", xt_prefix[nfproto], name); |
1281 | @@ -252,6 +254,9 @@ struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision) |
1282 | { |
1283 | struct xt_target *target; |
1284 | |
1285 | + if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN) |
1286 | + return ERR_PTR(-EINVAL); |
1287 | + |
1288 | target = xt_find_target(af, name, revision); |
1289 | if (IS_ERR(target)) { |
1290 | request_module("%st_%s", xt_prefix[af], name); |
1291 | @@ -1000,7 +1005,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) |
1292 | return NULL; |
1293 | |
1294 | /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ |
1295 | - if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) |
1296 | + if ((size >> PAGE_SHIFT) + 2 > totalram_pages) |
1297 | return NULL; |
1298 | |
1299 | info = kvmalloc(sz, GFP_KERNEL); |
1300 | diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c |
1301 | index 498b54fd04d7..141c295191f6 100644 |
1302 | --- a/net/netfilter/xt_RATEEST.c |
1303 | +++ b/net/netfilter/xt_RATEEST.c |
1304 | @@ -39,23 +39,31 @@ static void xt_rateest_hash_insert(struct xt_rateest *est) |
1305 | hlist_add_head(&est->list, &rateest_hash[h]); |
1306 | } |
1307 | |
1308 | -struct xt_rateest *xt_rateest_lookup(const char *name) |
1309 | +static struct xt_rateest *__xt_rateest_lookup(const char *name) |
1310 | { |
1311 | struct xt_rateest *est; |
1312 | unsigned int h; |
1313 | |
1314 | h = xt_rateest_hash(name); |
1315 | - mutex_lock(&xt_rateest_mutex); |
1316 | hlist_for_each_entry(est, &rateest_hash[h], list) { |
1317 | if (strcmp(est->name, name) == 0) { |
1318 | est->refcnt++; |
1319 | - mutex_unlock(&xt_rateest_mutex); |
1320 | return est; |
1321 | } |
1322 | } |
1323 | - mutex_unlock(&xt_rateest_mutex); |
1324 | + |
1325 | return NULL; |
1326 | } |
1327 | + |
1328 | +struct xt_rateest *xt_rateest_lookup(const char *name) |
1329 | +{ |
1330 | + struct xt_rateest *est; |
1331 | + |
1332 | + mutex_lock(&xt_rateest_mutex); |
1333 | + est = __xt_rateest_lookup(name); |
1334 | + mutex_unlock(&xt_rateest_mutex); |
1335 | + return est; |
1336 | +} |
1337 | EXPORT_SYMBOL_GPL(xt_rateest_lookup); |
1338 | |
1339 | void xt_rateest_put(struct xt_rateest *est) |
1340 | @@ -100,8 +108,10 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) |
1341 | |
1342 | net_get_random_once(&jhash_rnd, sizeof(jhash_rnd)); |
1343 | |
1344 | - est = xt_rateest_lookup(info->name); |
1345 | + mutex_lock(&xt_rateest_mutex); |
1346 | + est = __xt_rateest_lookup(info->name); |
1347 | if (est) { |
1348 | + mutex_unlock(&xt_rateest_mutex); |
1349 | /* |
1350 | * If estimator parameters are specified, they must match the |
1351 | * existing estimator. |
1352 | @@ -139,11 +149,13 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) |
1353 | |
1354 | info->est = est; |
1355 | xt_rateest_hash_insert(est); |
1356 | + mutex_unlock(&xt_rateest_mutex); |
1357 | return 0; |
1358 | |
1359 | err2: |
1360 | kfree(est); |
1361 | err1: |
1362 | + mutex_unlock(&xt_rateest_mutex); |
1363 | return ret; |
1364 | } |
1365 | |
1366 | diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c |
1367 | index 1db1ce59079f..891f4e7e8ea7 100644 |
1368 | --- a/net/netfilter/xt_cgroup.c |
1369 | +++ b/net/netfilter/xt_cgroup.c |
1370 | @@ -52,6 +52,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par) |
1371 | return -EINVAL; |
1372 | } |
1373 | |
1374 | + info->priv = NULL; |
1375 | if (info->has_path) { |
1376 | cgrp = cgroup_get_from_path(info->path); |
1377 | if (IS_ERR(cgrp)) { |
1378 | diff --git a/net/rds/connection.c b/net/rds/connection.c |
1379 | index 7ee2d5d68b78..9efc82c665b5 100644 |
1380 | --- a/net/rds/connection.c |
1381 | +++ b/net/rds/connection.c |
1382 | @@ -366,6 +366,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp) |
1383 | * to the conn hash, so we never trigger a reconnect on this |
1384 | * conn - the reconnect is always triggered by the active peer. */ |
1385 | cancel_delayed_work_sync(&cp->cp_conn_w); |
1386 | + if (conn->c_destroy_in_prog) |
1387 | + return; |
1388 | rcu_read_lock(); |
1389 | if (!hlist_unhashed(&conn->c_hash_node)) { |
1390 | rcu_read_unlock(); |
1391 | @@ -445,7 +447,6 @@ void rds_conn_destroy(struct rds_connection *conn) |
1392 | */ |
1393 | rds_cong_remove_conn(conn); |
1394 | |
1395 | - put_net(conn->c_net); |
1396 | kfree(conn->c_path); |
1397 | kmem_cache_free(rds_conn_slab, conn); |
1398 | |
1399 | diff --git a/net/rds/rds.h b/net/rds/rds.h |
1400 | index c349c71babff..d09f6c1facb4 100644 |
1401 | --- a/net/rds/rds.h |
1402 | +++ b/net/rds/rds.h |
1403 | @@ -150,7 +150,7 @@ struct rds_connection { |
1404 | |
1405 | /* Protocol version */ |
1406 | unsigned int c_version; |
1407 | - struct net *c_net; |
1408 | + possible_net_t c_net; |
1409 | |
1410 | struct list_head c_map_item; |
1411 | unsigned long c_map_queued; |
1412 | @@ -165,13 +165,13 @@ struct rds_connection { |
1413 | static inline |
1414 | struct net *rds_conn_net(struct rds_connection *conn) |
1415 | { |
1416 | - return conn->c_net; |
1417 | + return read_pnet(&conn->c_net); |
1418 | } |
1419 | |
1420 | static inline |
1421 | void rds_conn_net_set(struct rds_connection *conn, struct net *net) |
1422 | { |
1423 | - conn->c_net = get_net(net); |
1424 | + write_pnet(&conn->c_net, net); |
1425 | } |
1426 | |
1427 | #define RDS_FLAG_CONG_BITMAP 0x01 |
1428 | diff --git a/net/rds/tcp.c b/net/rds/tcp.c |
1429 | index ab7356e0ba83..4df21e47d2ab 100644 |
1430 | --- a/net/rds/tcp.c |
1431 | +++ b/net/rds/tcp.c |
1432 | @@ -307,7 +307,8 @@ static void rds_tcp_conn_free(void *arg) |
1433 | rdsdebug("freeing tc %p\n", tc); |
1434 | |
1435 | spin_lock_irqsave(&rds_tcp_conn_lock, flags); |
1436 | - list_del(&tc->t_tcp_node); |
1437 | + if (!tc->t_tcp_node_detached) |
1438 | + list_del(&tc->t_tcp_node); |
1439 | spin_unlock_irqrestore(&rds_tcp_conn_lock, flags); |
1440 | |
1441 | kmem_cache_free(rds_tcp_conn_slab, tc); |
1442 | @@ -528,12 +529,16 @@ static void rds_tcp_kill_sock(struct net *net) |
1443 | rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w); |
1444 | spin_lock_irq(&rds_tcp_conn_lock); |
1445 | list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) { |
1446 | - struct net *c_net = tc->t_cpath->cp_conn->c_net; |
1447 | + struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net); |
1448 | |
1449 | if (net != c_net || !tc->t_sock) |
1450 | continue; |
1451 | - if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) |
1452 | + if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) { |
1453 | list_move_tail(&tc->t_tcp_node, &tmp_list); |
1454 | + } else { |
1455 | + list_del(&tc->t_tcp_node); |
1456 | + tc->t_tcp_node_detached = true; |
1457 | + } |
1458 | } |
1459 | spin_unlock_irq(&rds_tcp_conn_lock); |
1460 | list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) { |
1461 | @@ -587,7 +592,7 @@ static void rds_tcp_sysctl_reset(struct net *net) |
1462 | |
1463 | spin_lock_irq(&rds_tcp_conn_lock); |
1464 | list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) { |
1465 | - struct net *c_net = tc->t_cpath->cp_conn->c_net; |
1466 | + struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net); |
1467 | |
1468 | if (net != c_net || !tc->t_sock) |
1469 | continue; |
1470 | diff --git a/net/rds/tcp.h b/net/rds/tcp.h |
1471 | index 864ca7d8f019..c6fa080e9b6d 100644 |
1472 | --- a/net/rds/tcp.h |
1473 | +++ b/net/rds/tcp.h |
1474 | @@ -12,6 +12,7 @@ struct rds_tcp_incoming { |
1475 | struct rds_tcp_connection { |
1476 | |
1477 | struct list_head t_tcp_node; |
1478 | + bool t_tcp_node_detached; |
1479 | struct rds_conn_path *t_cpath; |
1480 | /* t_conn_path_lock synchronizes the connection establishment between |
1481 | * rds_tcp_accept_one and rds_tcp_conn_path_connect |
1482 | diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c |
1483 | index 33cfe5d3d6cb..8900ea5cbabf 100644 |
1484 | --- a/security/selinux/ss/services.c |
1485 | +++ b/security/selinux/ss/services.c |
1486 | @@ -867,6 +867,9 @@ int security_bounded_transition(u32 old_sid, u32 new_sid) |
1487 | int index; |
1488 | int rc; |
1489 | |
1490 | + if (!ss_initialized) |
1491 | + return 0; |
1492 | + |
1493 | read_lock(&policy_rwlock); |
1494 | |
1495 | rc = -EINVAL; |
1496 | @@ -1413,27 +1416,25 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len, |
1497 | if (!scontext_len) |
1498 | return -EINVAL; |
1499 | |
1500 | + /* Copy the string to allow changes and ensure a NUL terminator */ |
1501 | + scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags); |
1502 | + if (!scontext2) |
1503 | + return -ENOMEM; |
1504 | + |
1505 | if (!ss_initialized) { |
1506 | int i; |
1507 | |
1508 | for (i = 1; i < SECINITSID_NUM; i++) { |
1509 | - if (!strcmp(initial_sid_to_string[i], scontext)) { |
1510 | + if (!strcmp(initial_sid_to_string[i], scontext2)) { |
1511 | *sid = i; |
1512 | - return 0; |
1513 | + goto out; |
1514 | } |
1515 | } |
1516 | *sid = SECINITSID_KERNEL; |
1517 | - return 0; |
1518 | + goto out; |
1519 | } |
1520 | *sid = SECSID_NULL; |
1521 | |
1522 | - /* Copy the string so that we can modify the copy as we parse it. */ |
1523 | - scontext2 = kmalloc(scontext_len + 1, gfp_flags); |
1524 | - if (!scontext2) |
1525 | - return -ENOMEM; |
1526 | - memcpy(scontext2, scontext, scontext_len); |
1527 | - scontext2[scontext_len] = 0; |
1528 | - |
1529 | if (force) { |
1530 | /* Save another copy for storing in uninterpreted form */ |
1531 | rc = -ENOMEM; |
1532 | diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c |
1533 | index 070a6880980e..c60a57797640 100644 |
1534 | --- a/sound/soc/ux500/mop500.c |
1535 | +++ b/sound/soc/ux500/mop500.c |
1536 | @@ -163,3 +163,7 @@ static struct platform_driver snd_soc_mop500_driver = { |
1537 | }; |
1538 | |
1539 | module_platform_driver(snd_soc_mop500_driver); |
1540 | + |
1541 | +MODULE_LICENSE("GPL v2"); |
1542 | +MODULE_DESCRIPTION("ASoC MOP500 board driver"); |
1543 | +MODULE_AUTHOR("Ola Lilja"); |
1544 | diff --git a/sound/soc/ux500/ux500_pcm.c b/sound/soc/ux500/ux500_pcm.c |
1545 | index f12c01dddc8d..d35ba7700f46 100644 |
1546 | --- a/sound/soc/ux500/ux500_pcm.c |
1547 | +++ b/sound/soc/ux500/ux500_pcm.c |
1548 | @@ -165,3 +165,8 @@ int ux500_pcm_unregister_platform(struct platform_device *pdev) |
1549 | return 0; |
1550 | } |
1551 | EXPORT_SYMBOL_GPL(ux500_pcm_unregister_platform); |
1552 | + |
1553 | +MODULE_AUTHOR("Ola Lilja"); |
1554 | +MODULE_AUTHOR("Roger Nilsson"); |
1555 | +MODULE_DESCRIPTION("ASoC UX500 driver"); |
1556 | +MODULE_LICENSE("GPL v2"); |