Magellan Linux

Contents of /trunk/kernel-magellan/patches-4.16/0104-4.16.5-all-fixes.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 3108 - (show annotations) (download)
Wed May 16 14:24:26 2018 UTC (6 years, 5 months ago) by niro
File size: 33982 byte(s)
-linux-4.16.5
1 diff --git a/Makefile b/Makefile
2 index d51175192ac1..6678a90f355b 100644
3 --- a/Makefile
4 +++ b/Makefile
5 @@ -1,7 +1,7 @@
6 # SPDX-License-Identifier: GPL-2.0
7 VERSION = 4
8 PATCHLEVEL = 16
9 -SUBLEVEL = 4
10 +SUBLEVEL = 5
11 EXTRAVERSION =
12 NAME = Fearless Coyote
13
14 diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
15 index 5ee33a6e33bb..9bf2a1a4bd22 100644
16 --- a/arch/x86/kernel/acpi/boot.c
17 +++ b/arch/x86/kernel/acpi/boot.c
18 @@ -215,6 +215,10 @@ acpi_parse_x2apic(struct acpi_subtable_header *header, const unsigned long end)
19 apic_id = processor->local_apic_id;
20 enabled = processor->lapic_flags & ACPI_MADT_ENABLED;
21
22 + /* Ignore invalid ID */
23 + if (apic_id == 0xffffffff)
24 + return 0;
25 +
26 /*
27 * We need to register disabled CPU as well to permit
28 * counting disabled CPUs. This allows us to size
29 diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
30 index fb4302738410..3615c0f255e9 100644
31 --- a/arch/x86/kernel/tsc.c
32 +++ b/arch/x86/kernel/tsc.c
33 @@ -317,7 +317,7 @@ static unsigned long calc_hpet_ref(u64 deltatsc, u64 hpet1, u64 hpet2)
34 hpet2 -= hpet1;
35 tmp = ((u64)hpet2 * hpet_readl(HPET_PERIOD));
36 do_div(tmp, 1000000);
37 - do_div(deltatsc, tmp);
38 + deltatsc = div64_u64(deltatsc, tmp);
39
40 return (unsigned long) deltatsc;
41 }
42 diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
43 index 763bb3bade63..8494dbae41b9 100644
44 --- a/arch/x86/kvm/mmu.c
45 +++ b/arch/x86/kvm/mmu.c
46 @@ -3031,7 +3031,7 @@ static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn)
47 return RET_PF_RETRY;
48 }
49
50 - return RET_PF_EMULATE;
51 + return -EFAULT;
52 }
53
54 static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
55 diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c
56 index 21bffdcb2f20..557ed25b42e3 100644
57 --- a/drivers/clocksource/timer-imx-tpm.c
58 +++ b/drivers/clocksource/timer-imx-tpm.c
59 @@ -105,7 +105,7 @@ static int tpm_set_next_event(unsigned long delta,
60 * of writing CNT registers which may cause the min_delta event got
61 * missed, so we need add a ETIME check here in case it happened.
62 */
63 - return (int)((next - now) <= 0) ? -ETIME : 0;
64 + return (int)(next - now) <= 0 ? -ETIME : 0;
65 }
66
67 static int tpm_set_state_oneshot(struct clock_event_device *evt)
68 diff --git a/drivers/gpu/drm/drm_dp_dual_mode_helper.c b/drivers/gpu/drm/drm_dp_dual_mode_helper.c
69 index 02a50929af67..e7f4fe2848a5 100644
70 --- a/drivers/gpu/drm/drm_dp_dual_mode_helper.c
71 +++ b/drivers/gpu/drm/drm_dp_dual_mode_helper.c
72 @@ -350,19 +350,44 @@ int drm_dp_dual_mode_set_tmds_output(enum drm_dp_dual_mode_type type,
73 {
74 uint8_t tmds_oen = enable ? 0 : DP_DUAL_MODE_TMDS_DISABLE;
75 ssize_t ret;
76 + int retry;
77
78 if (type < DRM_DP_DUAL_MODE_TYPE2_DVI)
79 return 0;
80
81 - ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN,
82 - &tmds_oen, sizeof(tmds_oen));
83 - if (ret) {
84 - DRM_DEBUG_KMS("Failed to %s TMDS output buffers\n",
85 - enable ? "enable" : "disable");
86 - return ret;
87 + /*
88 + * LSPCON adapters in low-power state may ignore the first write, so
89 + * read back and verify the written value a few times.
90 + */
91 + for (retry = 0; retry < 3; retry++) {
92 + uint8_t tmp;
93 +
94 + ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN,
95 + &tmds_oen, sizeof(tmds_oen));
96 + if (ret) {
97 + DRM_DEBUG_KMS("Failed to %s TMDS output buffers (%d attempts)\n",
98 + enable ? "enable" : "disable",
99 + retry + 1);
100 + return ret;
101 + }
102 +
103 + ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_TMDS_OEN,
104 + &tmp, sizeof(tmp));
105 + if (ret) {
106 + DRM_DEBUG_KMS("I2C read failed during TMDS output buffer %s (%d attempts)\n",
107 + enable ? "enabling" : "disabling",
108 + retry + 1);
109 + return ret;
110 + }
111 +
112 + if (tmp == tmds_oen)
113 + return 0;
114 }
115
116 - return 0;
117 + DRM_DEBUG_KMS("I2C write value mismatch during TMDS output buffer %s\n",
118 + enable ? "enabling" : "disabling");
119 +
120 + return -EIO;
121 }
122 EXPORT_SYMBOL(drm_dp_dual_mode_set_tmds_output);
123
124 diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
125 index 2fb7b34ef561..82cd2fbe2cb3 100644
126 --- a/drivers/gpu/drm/i915/gvt/dmabuf.c
127 +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
128 @@ -323,6 +323,7 @@ static void update_fb_info(struct vfio_device_gfx_plane_info *gvt_dmabuf,
129 struct intel_vgpu_fb_info *fb_info)
130 {
131 gvt_dmabuf->drm_format = fb_info->drm_format;
132 + gvt_dmabuf->drm_format_mod = fb_info->drm_format_mod;
133 gvt_dmabuf->width = fb_info->width;
134 gvt_dmabuf->height = fb_info->height;
135 gvt_dmabuf->stride = fb_info->stride;
136 diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
137 index 021f722e2481..f34d7f1e6c4e 100644
138 --- a/drivers/gpu/drm/i915/gvt/kvmgt.c
139 +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
140 @@ -1284,7 +1284,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
141
142 }
143
144 - return 0;
145 + return -ENOTTY;
146 }
147
148 static ssize_t
149 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
150 index 3ab1ace2a6bd..df505868d65a 100644
151 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
152 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
153 @@ -728,7 +728,7 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
154
155 err = radix_tree_insert(handles_vma, handle, vma);
156 if (unlikely(err)) {
157 - kfree(lut);
158 + kmem_cache_free(eb->i915->luts, lut);
159 goto err_obj;
160 }
161
162 diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
163 index 4a01f62a392d..0ef7856d8155 100644
164 --- a/drivers/gpu/drm/i915/intel_audio.c
165 +++ b/drivers/gpu/drm/i915/intel_audio.c
166 @@ -729,7 +729,7 @@ static void i915_audio_component_codec_wake_override(struct device *kdev,
167 struct drm_i915_private *dev_priv = kdev_to_i915(kdev);
168 u32 tmp;
169
170 - if (!IS_GEN9_BC(dev_priv))
171 + if (!IS_GEN9(dev_priv))
172 return;
173
174 i915_audio_component_get_power(kdev);
175 diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
176 index b49a2df44430..9b992e1b5996 100644
177 --- a/drivers/gpu/drm/i915/intel_bios.c
178 +++ b/drivers/gpu/drm/i915/intel_bios.c
179 @@ -1255,7 +1255,6 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
180 return;
181
182 aux_channel = child->aux_channel;
183 - ddc_pin = child->ddc_pin;
184
185 is_dvi = child->device_type & DEVICE_TYPE_TMDS_DVI_SIGNALING;
186 is_dp = child->device_type & DEVICE_TYPE_DISPLAYPORT_OUTPUT;
187 @@ -1302,9 +1301,15 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
188 DRM_DEBUG_KMS("Port %c is internal DP\n", port_name(port));
189
190 if (is_dvi) {
191 - info->alternate_ddc_pin = map_ddc_pin(dev_priv, ddc_pin);
192 -
193 - sanitize_ddc_pin(dev_priv, port);
194 + ddc_pin = map_ddc_pin(dev_priv, child->ddc_pin);
195 + if (intel_gmbus_is_valid_pin(dev_priv, ddc_pin)) {
196 + info->alternate_ddc_pin = ddc_pin;
197 + sanitize_ddc_pin(dev_priv, port);
198 + } else {
199 + DRM_DEBUG_KMS("Port %c has invalid DDC pin %d, "
200 + "sticking to defaults\n",
201 + port_name(port), ddc_pin);
202 + }
203 }
204
205 if (is_dp) {
206 diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
207 index 2decc8e2c79f..add9cc97a3b6 100644
208 --- a/drivers/gpu/drm/vc4/vc4_bo.c
209 +++ b/drivers/gpu/drm/vc4/vc4_bo.c
210 @@ -195,6 +195,7 @@ static void vc4_bo_destroy(struct vc4_bo *bo)
211 vc4_bo_set_label(obj, -1);
212
213 if (bo->validated_shader) {
214 + kfree(bo->validated_shader->uniform_addr_offsets);
215 kfree(bo->validated_shader->texture_samples);
216 kfree(bo->validated_shader);
217 bo->validated_shader = NULL;
218 @@ -591,6 +592,7 @@ void vc4_free_object(struct drm_gem_object *gem_bo)
219 }
220
221 if (bo->validated_shader) {
222 + kfree(bo->validated_shader->uniform_addr_offsets);
223 kfree(bo->validated_shader->texture_samples);
224 kfree(bo->validated_shader);
225 bo->validated_shader = NULL;
226 diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
227 index d3f15bf60900..7cf82b071de2 100644
228 --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
229 +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
230 @@ -942,6 +942,7 @@ vc4_validate_shader(struct drm_gem_cma_object *shader_obj)
231 fail:
232 kfree(validation_state.branch_targets);
233 if (validated_shader) {
234 + kfree(validated_shader->uniform_addr_offsets);
235 kfree(validated_shader->texture_samples);
236 kfree(validated_shader);
237 }
238 diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
239 index a2e1aa86e133..6c424afea25f 100644
240 --- a/drivers/infiniband/hw/mlx5/qp.c
241 +++ b/drivers/infiniband/hw/mlx5/qp.c
242 @@ -3157,7 +3157,8 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
243 * If we moved a kernel QP to RESET, clean up all old CQ
244 * entries and reinitialize the QP.
245 */
246 - if (new_state == IB_QPS_RESET && !ibqp->uobject) {
247 + if (new_state == IB_QPS_RESET &&
248 + !ibqp->uobject && ibqp->qp_type != IB_QPT_XRC_TGT) {
249 mlx5_ib_cq_clean(recv_cq, base->mqp.qpn,
250 ibqp->srq ? to_msrq(ibqp->srq) : NULL);
251 if (send_cq != recv_cq)
252 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
253 index 35b21f8152bb..20af54378cc0 100644
254 --- a/drivers/net/wireless/mac80211_hwsim.c
255 +++ b/drivers/net/wireless/mac80211_hwsim.c
256 @@ -3484,8 +3484,11 @@ static void __net_exit hwsim_exit_net(struct net *net)
257 list_del(&data->list);
258 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
259 hwsim_rht_params);
260 - INIT_WORK(&data->destroy_work, destroy_radio);
261 - queue_work(hwsim_wq, &data->destroy_work);
262 + spin_unlock_bh(&hwsim_radio_lock);
263 + mac80211_hwsim_del_radio(data,
264 + wiphy_name(data->hw->wiphy),
265 + NULL);
266 + spin_lock_bh(&hwsim_radio_lock);
267 }
268 spin_unlock_bh(&hwsim_radio_lock);
269 }
270 diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
271 index 7ab5e0128f0c..1e9a20a4c06c 100644
272 --- a/fs/btrfs/delayed-ref.c
273 +++ b/fs/btrfs/delayed-ref.c
274 @@ -553,8 +553,10 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
275 struct btrfs_delayed_ref_head *head_ref,
276 struct btrfs_qgroup_extent_record *qrecord,
277 u64 bytenr, u64 num_bytes, u64 ref_root, u64 reserved,
278 - int action, int is_data, int *qrecord_inserted_ret,
279 + int action, int is_data, int is_system,
280 + int *qrecord_inserted_ret,
281 int *old_ref_mod, int *new_ref_mod)
282 +
283 {
284 struct btrfs_delayed_ref_head *existing;
285 struct btrfs_delayed_ref_root *delayed_refs;
286 @@ -598,6 +600,7 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
287 head_ref->ref_mod = count_mod;
288 head_ref->must_insert_reserved = must_insert_reserved;
289 head_ref->is_data = is_data;
290 + head_ref->is_system = is_system;
291 head_ref->ref_tree = RB_ROOT;
292 INIT_LIST_HEAD(&head_ref->ref_add_list);
293 RB_CLEAR_NODE(&head_ref->href_node);
294 @@ -785,6 +788,7 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
295 struct btrfs_delayed_ref_root *delayed_refs;
296 struct btrfs_qgroup_extent_record *record = NULL;
297 int qrecord_inserted;
298 + int is_system = (ref_root == BTRFS_CHUNK_TREE_OBJECTID);
299
300 BUG_ON(extent_op && extent_op->is_data);
301 ref = kmem_cache_alloc(btrfs_delayed_tree_ref_cachep, GFP_NOFS);
302 @@ -813,8 +817,8 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
303 */
304 head_ref = add_delayed_ref_head(fs_info, trans, head_ref, record,
305 bytenr, num_bytes, 0, 0, action, 0,
306 - &qrecord_inserted, old_ref_mod,
307 - new_ref_mod);
308 + is_system, &qrecord_inserted,
309 + old_ref_mod, new_ref_mod);
310
311 add_delayed_tree_ref(fs_info, trans, head_ref, &ref->node, bytenr,
312 num_bytes, parent, ref_root, level, action);
313 @@ -881,7 +885,7 @@ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
314 */
315 head_ref = add_delayed_ref_head(fs_info, trans, head_ref, record,
316 bytenr, num_bytes, ref_root, reserved,
317 - action, 1, &qrecord_inserted,
318 + action, 1, 0, &qrecord_inserted,
319 old_ref_mod, new_ref_mod);
320
321 add_delayed_data_ref(fs_info, trans, head_ref, &ref->node, bytenr,
322 @@ -911,9 +915,14 @@ int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
323 delayed_refs = &trans->transaction->delayed_refs;
324 spin_lock(&delayed_refs->lock);
325
326 + /*
327 + * extent_ops just modify the flags of an extent and they don't result
328 + * in ref count changes, hence it's safe to pass false/0 for is_system
329 + * argument
330 + */
331 add_delayed_ref_head(fs_info, trans, head_ref, NULL, bytenr,
332 num_bytes, 0, 0, BTRFS_UPDATE_DELAYED_HEAD,
333 - extent_op->is_data, NULL, NULL, NULL);
334 + extent_op->is_data, 0, NULL, NULL, NULL);
335
336 spin_unlock(&delayed_refs->lock);
337 return 0;
338 diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
339 index c4f625e5a691..ba97d18cc168 100644
340 --- a/fs/btrfs/delayed-ref.h
341 +++ b/fs/btrfs/delayed-ref.h
342 @@ -139,6 +139,7 @@ struct btrfs_delayed_ref_head {
343 */
344 unsigned int must_insert_reserved:1;
345 unsigned int is_data:1;
346 + unsigned int is_system:1;
347 unsigned int processing:1;
348 };
349
350 diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
351 index c1618ab9fecf..16b54b1ff20e 100644
352 --- a/fs/btrfs/extent-tree.c
353 +++ b/fs/btrfs/extent-tree.c
354 @@ -2615,13 +2615,19 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
355 trace_run_delayed_ref_head(fs_info, head, 0);
356
357 if (head->total_ref_mod < 0) {
358 - struct btrfs_block_group_cache *cache;
359 + struct btrfs_space_info *space_info;
360 + u64 flags;
361
362 - cache = btrfs_lookup_block_group(fs_info, head->bytenr);
363 - ASSERT(cache);
364 - percpu_counter_add(&cache->space_info->total_bytes_pinned,
365 + if (head->is_data)
366 + flags = BTRFS_BLOCK_GROUP_DATA;
367 + else if (head->is_system)
368 + flags = BTRFS_BLOCK_GROUP_SYSTEM;
369 + else
370 + flags = BTRFS_BLOCK_GROUP_METADATA;
371 + space_info = __find_space_info(fs_info, flags);
372 + ASSERT(space_info);
373 + percpu_counter_add(&space_info->total_bytes_pinned,
374 -head->num_bytes);
375 - btrfs_put_block_group(cache);
376
377 if (head->is_data) {
378 spin_lock(&delayed_refs->lock);
379 diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
380 index c7b75dd58fad..ef1cf323832a 100644
381 --- a/fs/btrfs/inode.c
382 +++ b/fs/btrfs/inode.c
383 @@ -44,6 +44,7 @@
384 #include <linux/uio.h>
385 #include <linux/magic.h>
386 #include <linux/iversion.h>
387 +#include <asm/unaligned.h>
388 #include "ctree.h"
389 #include "disk-io.h"
390 #include "transaction.h"
391 @@ -5951,11 +5952,13 @@ static int btrfs_filldir(void *addr, int entries, struct dir_context *ctx)
392 struct dir_entry *entry = addr;
393 char *name = (char *)(entry + 1);
394
395 - ctx->pos = entry->offset;
396 - if (!dir_emit(ctx, name, entry->name_len, entry->ino,
397 - entry->type))
398 + ctx->pos = get_unaligned(&entry->offset);
399 + if (!dir_emit(ctx, name, get_unaligned(&entry->name_len),
400 + get_unaligned(&entry->ino),
401 + get_unaligned(&entry->type)))
402 return 1;
403 - addr += sizeof(struct dir_entry) + entry->name_len;
404 + addr += sizeof(struct dir_entry) +
405 + get_unaligned(&entry->name_len);
406 ctx->pos++;
407 }
408 return 0;
409 @@ -6045,14 +6048,15 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
410 }
411
412 entry = addr;
413 - entry->name_len = name_len;
414 + put_unaligned(name_len, &entry->name_len);
415 name_ptr = (char *)(entry + 1);
416 read_extent_buffer(leaf, name_ptr, (unsigned long)(di + 1),
417 name_len);
418 - entry->type = btrfs_filetype_table[btrfs_dir_type(leaf, di)];
419 + put_unaligned(btrfs_filetype_table[btrfs_dir_type(leaf, di)],
420 + &entry->type);
421 btrfs_dir_item_key_to_cpu(leaf, di, &location);
422 - entry->ino = location.objectid;
423 - entry->offset = found_key.offset;
424 + put_unaligned(location.objectid, &entry->ino);
425 + put_unaligned(found_key.offset, &entry->offset);
426 entries++;
427 addr += sizeof(struct dir_entry) + name_len;
428 total_len += sizeof(struct dir_entry) + name_len;
429 diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
430 index 81ba6e0d88d8..925844343038 100644
431 --- a/fs/cifs/dir.c
432 +++ b/fs/cifs/dir.c
433 @@ -684,6 +684,9 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
434 goto mknod_out;
435 }
436
437 + if (!S_ISCHR(mode) && !S_ISBLK(mode))
438 + goto mknod_out;
439 +
440 if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL))
441 goto mknod_out;
442
443 @@ -692,10 +695,8 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
444
445 buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
446 if (buf == NULL) {
447 - kfree(full_path);
448 rc = -ENOMEM;
449 - free_xid(xid);
450 - return rc;
451 + goto mknod_out;
452 }
453
454 if (backup_cred(cifs_sb))
455 @@ -742,7 +743,7 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
456 pdev->minor = cpu_to_le64(MINOR(device_number));
457 rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
458 &bytes_written, iov, 1);
459 - } /* else if (S_ISFIFO) */
460 + }
461 tcon->ses->server->ops->close(xid, tcon, &fid);
462 d_drop(direntry);
463
464 diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
465 index 52cccdbb7e14..34be5c5d027f 100644
466 --- a/fs/cifs/smbdirect.c
467 +++ b/fs/cifs/smbdirect.c
468 @@ -2194,6 +2194,8 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
469 goto done;
470 }
471 i++;
472 + if (i == rqst->rq_nvec)
473 + break;
474 }
475 start = i;
476 buflen = 0;
477 diff --git a/fs/super.c b/fs/super.c
478 index 672538ca9831..afbf4d220c27 100644
479 --- a/fs/super.c
480 +++ b/fs/super.c
481 @@ -166,6 +166,7 @@ static void destroy_unused_super(struct super_block *s)
482 security_sb_free(s);
483 put_user_ns(s->s_user_ns);
484 kfree(s->s_subtype);
485 + free_prealloced_shrinker(&s->s_shrink);
486 /* no delays needed */
487 destroy_super_work(&s->destroy_work);
488 }
489 @@ -251,6 +252,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags,
490 s->s_shrink.count_objects = super_cache_count;
491 s->s_shrink.batch = 1024;
492 s->s_shrink.flags = SHRINKER_NUMA_AWARE | SHRINKER_MEMCG_AWARE;
493 + if (prealloc_shrinker(&s->s_shrink))
494 + goto fail;
495 return s;
496
497 fail:
498 @@ -517,11 +520,7 @@ struct super_block *sget_userns(struct file_system_type *type,
499 hlist_add_head(&s->s_instances, &type->fs_supers);
500 spin_unlock(&sb_lock);
501 get_filesystem(type);
502 - err = register_shrinker(&s->s_shrink);
503 - if (err) {
504 - deactivate_locked_super(s);
505 - s = ERR_PTR(err);
506 - }
507 + register_shrinker_prepared(&s->s_shrink);
508 return s;
509 }
510
511 diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
512 index 14529511c4b8..065d605adea0 100644
513 --- a/include/linux/netfilter/x_tables.h
514 +++ b/include/linux/netfilter/x_tables.h
515 @@ -301,6 +301,7 @@ int xt_data_to_user(void __user *dst, const void *src,
516
517 void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
518 struct xt_counters_info *info, bool compat);
519 +struct xt_counters *xt_counters_alloc(unsigned int counters);
520
521 struct xt_table *xt_register_table(struct net *net,
522 const struct xt_table *table,
523 @@ -509,7 +510,7 @@ void xt_compat_unlock(u_int8_t af);
524
525 int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta);
526 void xt_compat_flush_offsets(u_int8_t af);
527 -void xt_compat_init_offsets(u_int8_t af, unsigned int number);
528 +int xt_compat_init_offsets(u8 af, unsigned int number);
529 int xt_compat_calc_jump(u_int8_t af, unsigned int offset);
530
531 int xt_compat_match_offset(const struct xt_match *match);
532 diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h
533 index 388ff2936a87..6794490f25b2 100644
534 --- a/include/linux/shrinker.h
535 +++ b/include/linux/shrinker.h
536 @@ -75,6 +75,9 @@ struct shrinker {
537 #define SHRINKER_NUMA_AWARE (1 << 0)
538 #define SHRINKER_MEMCG_AWARE (1 << 1)
539
540 -extern int register_shrinker(struct shrinker *);
541 -extern void unregister_shrinker(struct shrinker *);
542 +extern int prealloc_shrinker(struct shrinker *shrinker);
543 +extern void register_shrinker_prepared(struct shrinker *shrinker);
544 +extern int register_shrinker(struct shrinker *shrinker);
545 +extern void unregister_shrinker(struct shrinker *shrinker);
546 +extern void free_prealloced_shrinker(struct shrinker *shrinker);
547 #endif
548 diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
549 index 772a43fea825..73cc26e321de 100644
550 --- a/kernel/events/callchain.c
551 +++ b/kernel/events/callchain.c
552 @@ -119,19 +119,22 @@ int get_callchain_buffers(int event_max_stack)
553 goto exit;
554 }
555
556 + /*
557 + * If requesting per event more than the global cap,
558 + * return a different error to help userspace figure
559 + * this out.
560 + *
561 + * And also do it here so that we have &callchain_mutex held.
562 + */
563 + if (event_max_stack > sysctl_perf_event_max_stack) {
564 + err = -EOVERFLOW;
565 + goto exit;
566 + }
567 +
568 if (count > 1) {
569 /* If the allocation failed, give up */
570 if (!callchain_cpus_entries)
571 err = -ENOMEM;
572 - /*
573 - * If requesting per event more than the global cap,
574 - * return a different error to help userspace figure
575 - * this out.
576 - *
577 - * And also do it here so that we have &callchain_mutex held.
578 - */
579 - if (event_max_stack > sysctl_perf_event_max_stack)
580 - err = -EOVERFLOW;
581 goto exit;
582 }
583
584 diff --git a/kernel/events/core.c b/kernel/events/core.c
585 index b32bc0698a2a..ca7298760c83 100644
586 --- a/kernel/events/core.c
587 +++ b/kernel/events/core.c
588 @@ -9730,9 +9730,9 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
589 * __u16 sample size limit.
590 */
591 if (attr->sample_stack_user >= USHRT_MAX)
592 - ret = -EINVAL;
593 + return -EINVAL;
594 else if (!IS_ALIGNED(attr->sample_stack_user, sizeof(u64)))
595 - ret = -EINVAL;
596 + return -EINVAL;
597 }
598
599 if (attr->sample_type & PERF_SAMPLE_REGS_INTR)
600 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
601 index ec09ce9a6012..639321bf2e39 100644
602 --- a/kernel/time/alarmtimer.c
603 +++ b/kernel/time/alarmtimer.c
604 @@ -326,6 +326,17 @@ static int alarmtimer_resume(struct device *dev)
605 }
606 #endif
607
608 +static void
609 +__alarm_init(struct alarm *alarm, enum alarmtimer_type type,
610 + enum alarmtimer_restart (*function)(struct alarm *, ktime_t))
611 +{
612 + timerqueue_init(&alarm->node);
613 + alarm->timer.function = alarmtimer_fired;
614 + alarm->function = function;
615 + alarm->type = type;
616 + alarm->state = ALARMTIMER_STATE_INACTIVE;
617 +}
618 +
619 /**
620 * alarm_init - Initialize an alarm structure
621 * @alarm: ptr to alarm to be initialized
622 @@ -335,13 +346,9 @@ static int alarmtimer_resume(struct device *dev)
623 void alarm_init(struct alarm *alarm, enum alarmtimer_type type,
624 enum alarmtimer_restart (*function)(struct alarm *, ktime_t))
625 {
626 - timerqueue_init(&alarm->node);
627 hrtimer_init(&alarm->timer, alarm_bases[type].base_clockid,
628 - HRTIMER_MODE_ABS);
629 - alarm->timer.function = alarmtimer_fired;
630 - alarm->function = function;
631 - alarm->type = type;
632 - alarm->state = ALARMTIMER_STATE_INACTIVE;
633 + HRTIMER_MODE_ABS);
634 + __alarm_init(alarm, type, function);
635 }
636 EXPORT_SYMBOL_GPL(alarm_init);
637
638 @@ -719,6 +726,8 @@ static int alarmtimer_do_nsleep(struct alarm *alarm, ktime_t absexp,
639
640 __set_current_state(TASK_RUNNING);
641
642 + destroy_hrtimer_on_stack(&alarm->timer);
643 +
644 if (!alarm->data)
645 return 0;
646
647 @@ -740,6 +749,15 @@ static int alarmtimer_do_nsleep(struct alarm *alarm, ktime_t absexp,
648 return -ERESTART_RESTARTBLOCK;
649 }
650
651 +static void
652 +alarm_init_on_stack(struct alarm *alarm, enum alarmtimer_type type,
653 + enum alarmtimer_restart (*function)(struct alarm *, ktime_t))
654 +{
655 + hrtimer_init_on_stack(&alarm->timer, alarm_bases[type].base_clockid,
656 + HRTIMER_MODE_ABS);
657 + __alarm_init(alarm, type, function);
658 +}
659 +
660 /**
661 * alarm_timer_nsleep_restart - restartblock alarmtimer nsleep
662 * @restart: ptr to restart block
663 @@ -752,7 +770,7 @@ static long __sched alarm_timer_nsleep_restart(struct restart_block *restart)
664 ktime_t exp = restart->nanosleep.expires;
665 struct alarm alarm;
666
667 - alarm_init(&alarm, type, alarmtimer_nsleep_wakeup);
668 + alarm_init_on_stack(&alarm, type, alarmtimer_nsleep_wakeup);
669
670 return alarmtimer_do_nsleep(&alarm, exp, type);
671 }
672 @@ -784,7 +802,7 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
673 if (!capable(CAP_WAKE_ALARM))
674 return -EPERM;
675
676 - alarm_init(&alarm, type, alarmtimer_nsleep_wakeup);
677 + alarm_init_on_stack(&alarm, type, alarmtimer_nsleep_wakeup);
678
679 exp = timespec64_to_ktime(*tsreq);
680 /* Convert (if necessary) to absolute time */
681 diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
682 index 2541bd89f20e..5a6251ac6f7a 100644
683 --- a/kernel/time/posix-cpu-timers.c
684 +++ b/kernel/time/posix-cpu-timers.c
685 @@ -1205,10 +1205,12 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clock_idx,
686 u64 *newval, u64 *oldval)
687 {
688 u64 now;
689 + int ret;
690
691 WARN_ON_ONCE(clock_idx == CPUCLOCK_SCHED);
692 + ret = cpu_timer_sample_group(clock_idx, tsk, &now);
693
694 - if (oldval && cpu_timer_sample_group(clock_idx, tsk, &now) != -EINVAL) {
695 + if (oldval && ret != -EINVAL) {
696 /*
697 * We are setting itimer. The *oldval is absolute and we update
698 * it to be relative, *newval argument is relative and we update
699 diff --git a/mm/vmscan.c b/mm/vmscan.c
700 index cd5dc3faaa57..f6a1587f9f31 100644
701 --- a/mm/vmscan.c
702 +++ b/mm/vmscan.c
703 @@ -258,7 +258,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone
704 /*
705 * Add a shrinker callback to be called from the vm.
706 */
707 -int register_shrinker(struct shrinker *shrinker)
708 +int prealloc_shrinker(struct shrinker *shrinker)
709 {
710 size_t size = sizeof(*shrinker->nr_deferred);
711
712 @@ -268,10 +268,29 @@ int register_shrinker(struct shrinker *shrinker)
713 shrinker->nr_deferred = kzalloc(size, GFP_KERNEL);
714 if (!shrinker->nr_deferred)
715 return -ENOMEM;
716 + return 0;
717 +}
718 +
719 +void free_prealloced_shrinker(struct shrinker *shrinker)
720 +{
721 + kfree(shrinker->nr_deferred);
722 + shrinker->nr_deferred = NULL;
723 +}
724
725 +void register_shrinker_prepared(struct shrinker *shrinker)
726 +{
727 down_write(&shrinker_rwsem);
728 list_add_tail(&shrinker->list, &shrinker_list);
729 up_write(&shrinker_rwsem);
730 +}
731 +
732 +int register_shrinker(struct shrinker *shrinker)
733 +{
734 + int err = prealloc_shrinker(shrinker);
735 +
736 + if (err)
737 + return err;
738 + register_shrinker_prepared(shrinker);
739 return 0;
740 }
741 EXPORT_SYMBOL(register_shrinker);
742 diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
743 index a94d23b0a9af..752112539753 100644
744 --- a/net/bridge/netfilter/ebtables.c
745 +++ b/net/bridge/netfilter/ebtables.c
746 @@ -1821,10 +1821,14 @@ static int compat_table_info(const struct ebt_table_info *info,
747 {
748 unsigned int size = info->entries_size;
749 const void *entries = info->entries;
750 + int ret;
751
752 newinfo->entries_size = size;
753
754 - xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
755 + ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
756 + if (ret)
757 + return ret;
758 +
759 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
760 entries, newinfo);
761 }
762 @@ -2268,7 +2272,9 @@ static int compat_do_replace(struct net *net, void __user *user,
763
764 xt_compat_lock(NFPROTO_BRIDGE);
765
766 - xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
767 + ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
768 + if (ret < 0)
769 + goto out_unlock;
770 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
771 if (ret < 0)
772 goto out_unlock;
773 diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
774 index e3e420f3ba7b..b940d6aaa94f 100644
775 --- a/net/ipv4/netfilter/arp_tables.c
776 +++ b/net/ipv4/netfilter/arp_tables.c
777 @@ -781,7 +781,9 @@ static int compat_table_info(const struct xt_table_info *info,
778 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
779 newinfo->initial_entries = 0;
780 loc_cpu_entry = info->entries;
781 - xt_compat_init_offsets(NFPROTO_ARP, info->number);
782 + ret = xt_compat_init_offsets(NFPROTO_ARP, info->number);
783 + if (ret)
784 + return ret;
785 xt_entry_foreach(iter, loc_cpu_entry, info->size) {
786 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
787 if (ret != 0)
788 @@ -895,7 +897,7 @@ static int __do_replace(struct net *net, const char *name,
789 struct arpt_entry *iter;
790
791 ret = 0;
792 - counters = vzalloc(num_counters * sizeof(struct xt_counters));
793 + counters = xt_counters_alloc(num_counters);
794 if (!counters) {
795 ret = -ENOMEM;
796 goto out;
797 @@ -1167,7 +1169,7 @@ static int translate_compat_table(struct xt_table_info **pinfo,
798 struct compat_arpt_entry *iter0;
799 struct arpt_replace repl;
800 unsigned int size;
801 - int ret = 0;
802 + int ret;
803
804 info = *pinfo;
805 entry0 = *pentry0;
806 @@ -1176,7 +1178,9 @@ static int translate_compat_table(struct xt_table_info **pinfo,
807
808 j = 0;
809 xt_compat_lock(NFPROTO_ARP);
810 - xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries);
811 + ret = xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries);
812 + if (ret)
813 + goto out_unlock;
814 /* Walk through entries, checking offsets. */
815 xt_entry_foreach(iter0, entry0, compatr->size) {
816 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
817 diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
818 index e38395a8dcf2..34f22450da5b 100644
819 --- a/net/ipv4/netfilter/ip_tables.c
820 +++ b/net/ipv4/netfilter/ip_tables.c
821 @@ -945,7 +945,9 @@ static int compat_table_info(const struct xt_table_info *info,
822 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
823 newinfo->initial_entries = 0;
824 loc_cpu_entry = info->entries;
825 - xt_compat_init_offsets(AF_INET, info->number);
826 + ret = xt_compat_init_offsets(AF_INET, info->number);
827 + if (ret)
828 + return ret;
829 xt_entry_foreach(iter, loc_cpu_entry, info->size) {
830 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
831 if (ret != 0)
832 @@ -1057,7 +1059,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
833 struct ipt_entry *iter;
834
835 ret = 0;
836 - counters = vzalloc(num_counters * sizeof(struct xt_counters));
837 + counters = xt_counters_alloc(num_counters);
838 if (!counters) {
839 ret = -ENOMEM;
840 goto out;
841 @@ -1418,7 +1420,9 @@ translate_compat_table(struct net *net,
842
843 j = 0;
844 xt_compat_lock(AF_INET);
845 - xt_compat_init_offsets(AF_INET, compatr->num_entries);
846 + ret = xt_compat_init_offsets(AF_INET, compatr->num_entries);
847 + if (ret)
848 + goto out_unlock;
849 /* Walk through entries, checking offsets. */
850 xt_entry_foreach(iter0, entry0, compatr->size) {
851 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
852 diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
853 index 62358b93bbac..41db3c8f469f 100644
854 --- a/net/ipv6/netfilter/ip6_tables.c
855 +++ b/net/ipv6/netfilter/ip6_tables.c
856 @@ -962,7 +962,9 @@ static int compat_table_info(const struct xt_table_info *info,
857 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
858 newinfo->initial_entries = 0;
859 loc_cpu_entry = info->entries;
860 - xt_compat_init_offsets(AF_INET6, info->number);
861 + ret = xt_compat_init_offsets(AF_INET6, info->number);
862 + if (ret)
863 + return ret;
864 xt_entry_foreach(iter, loc_cpu_entry, info->size) {
865 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
866 if (ret != 0)
867 @@ -1075,7 +1077,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
868 struct ip6t_entry *iter;
869
870 ret = 0;
871 - counters = vzalloc(num_counters * sizeof(struct xt_counters));
872 + counters = xt_counters_alloc(num_counters);
873 if (!counters) {
874 ret = -ENOMEM;
875 goto out;
876 @@ -1425,7 +1427,7 @@ translate_compat_table(struct net *net,
877 struct compat_ip6t_entry *iter0;
878 struct ip6t_replace repl;
879 unsigned int size;
880 - int ret = 0;
881 + int ret;
882
883 info = *pinfo;
884 entry0 = *pentry0;
885 @@ -1434,7 +1436,9 @@ translate_compat_table(struct net *net,
886
887 j = 0;
888 xt_compat_lock(AF_INET6);
889 - xt_compat_init_offsets(AF_INET6, compatr->num_entries);
890 + ret = xt_compat_init_offsets(AF_INET6, compatr->num_entries);
891 + if (ret)
892 + goto out_unlock;
893 /* Walk through entries, checking offsets. */
894 xt_entry_foreach(iter0, entry0, compatr->size) {
895 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
896 diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
897 index 4aa01c90e9d1..a94c0e3cdcf0 100644
898 --- a/net/netfilter/x_tables.c
899 +++ b/net/netfilter/x_tables.c
900 @@ -40,6 +40,7 @@ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
901 MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
902
903 #define XT_PCPU_BLOCK_SIZE 4096
904 +#define XT_MAX_TABLE_SIZE (512 * 1024 * 1024)
905
906 struct compat_delta {
907 unsigned int offset; /* offset in kernel */
908 @@ -553,14 +554,8 @@ int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta)
909 {
910 struct xt_af *xp = &xt[af];
911
912 - if (!xp->compat_tab) {
913 - if (!xp->number)
914 - return -EINVAL;
915 - xp->compat_tab = vmalloc(sizeof(struct compat_delta) * xp->number);
916 - if (!xp->compat_tab)
917 - return -ENOMEM;
918 - xp->cur = 0;
919 - }
920 + if (WARN_ON(!xp->compat_tab))
921 + return -ENOMEM;
922
923 if (xp->cur >= xp->number)
924 return -EINVAL;
925 @@ -603,10 +598,28 @@ int xt_compat_calc_jump(u_int8_t af, unsigned int offset)
926 }
927 EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
928
929 -void xt_compat_init_offsets(u_int8_t af, unsigned int number)
930 +int xt_compat_init_offsets(u8 af, unsigned int number)
931 {
932 + size_t mem;
933 +
934 + if (!number || number > (INT_MAX / sizeof(struct compat_delta)))
935 + return -EINVAL;
936 +
937 + if (WARN_ON(xt[af].compat_tab))
938 + return -EINVAL;
939 +
940 + mem = sizeof(struct compat_delta) * number;
941 + if (mem > XT_MAX_TABLE_SIZE)
942 + return -ENOMEM;
943 +
944 + xt[af].compat_tab = vmalloc(mem);
945 + if (!xt[af].compat_tab)
946 + return -ENOMEM;
947 +
948 xt[af].number = number;
949 xt[af].cur = 0;
950 +
951 + return 0;
952 }
953 EXPORT_SYMBOL(xt_compat_init_offsets);
954
955 @@ -805,6 +818,9 @@ EXPORT_SYMBOL(xt_check_entry_offsets);
956 */
957 unsigned int *xt_alloc_entry_offsets(unsigned int size)
958 {
959 + if (size > XT_MAX_TABLE_SIZE / sizeof(unsigned int))
960 + return NULL;
961 +
962 return kvmalloc_array(size, sizeof(unsigned int), GFP_KERNEL | __GFP_ZERO);
963
964 }
965 @@ -1029,7 +1045,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
966 struct xt_table_info *info = NULL;
967 size_t sz = sizeof(*info) + size;
968
969 - if (sz < sizeof(*info))
970 + if (sz < sizeof(*info) || sz >= XT_MAX_TABLE_SIZE)
971 return NULL;
972
973 /* __GFP_NORETRY is not fully supported by kvmalloc but it should
974 @@ -1198,6 +1214,21 @@ static int xt_jumpstack_alloc(struct xt_table_info *i)
975 return 0;
976 }
977
978 +struct xt_counters *xt_counters_alloc(unsigned int counters)
979 +{
980 + struct xt_counters *mem;
981 +
982 + if (counters == 0 || counters > INT_MAX / sizeof(*mem))
983 + return NULL;
984 +
985 + counters *= sizeof(*mem);
986 + if (counters > XT_MAX_TABLE_SIZE)
987 + return NULL;
988 +
989 + return vzalloc(counters);
990 +}
991 +EXPORT_SYMBOL(xt_counters_alloc);
992 +
993 struct xt_table_info *
994 xt_replace_table(struct xt_table *table,
995 unsigned int num_counters,