Annotation of /trunk/kernel-magellan/patches-4.6/0103-4.6.4-all-fixes.patch
Parent Directory | Revision Log
Revision 2818 -
(hide annotations)
(download)
Thu Aug 4 13:24:47 2016 UTC (8 years, 1 month ago) by niro
File size: 33248 byte(s)
Thu Aug 4 13:24:47 2016 UTC (8 years, 1 month ago) by niro
File size: 33248 byte(s)
-linux-4.6.4
1 | niro | 2818 | diff --git a/Makefile b/Makefile |
2 | index c62b531d5a85..cd374426114a 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 4 | ||
7 | PATCHLEVEL = 6 | ||
8 | -SUBLEVEL = 3 | ||
9 | +SUBLEVEL = 4 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Charred Weasel | ||
12 | |||
13 | diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c | ||
14 | index 43fe85f20d57..7097a3395b25 100644 | ||
15 | --- a/crypto/crypto_user.c | ||
16 | +++ b/crypto/crypto_user.c | ||
17 | @@ -455,6 +455,7 @@ static const int crypto_msg_min[CRYPTO_NR_MSGTYPES] = { | ||
18 | [CRYPTO_MSG_NEWALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), | ||
19 | [CRYPTO_MSG_DELALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), | ||
20 | [CRYPTO_MSG_UPDATEALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), | ||
21 | + [CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), | ||
22 | [CRYPTO_MSG_DELRNG - CRYPTO_MSG_BASE] = 0, | ||
23 | }; | ||
24 | |||
25 | diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c | ||
26 | index 574e87c7f2b8..9acccad26928 100644 | ||
27 | --- a/drivers/crypto/ux500/hash/hash_core.c | ||
28 | +++ b/drivers/crypto/ux500/hash/hash_core.c | ||
29 | @@ -781,7 +781,7 @@ static int hash_process_data(struct hash_device_data *device_data, | ||
30 | &device_data->state); | ||
31 | memmove(req_ctx->state.buffer, | ||
32 | device_data->state.buffer, | ||
33 | - HASH_BLOCK_SIZE / sizeof(u32)); | ||
34 | + HASH_BLOCK_SIZE); | ||
35 | if (ret) { | ||
36 | dev_err(device_data->dev, | ||
37 | "%s: hash_resume_state() failed!\n", | ||
38 | @@ -832,7 +832,7 @@ static int hash_process_data(struct hash_device_data *device_data, | ||
39 | |||
40 | memmove(device_data->state.buffer, | ||
41 | req_ctx->state.buffer, | ||
42 | - HASH_BLOCK_SIZE / sizeof(u32)); | ||
43 | + HASH_BLOCK_SIZE); | ||
44 | if (ret) { | ||
45 | dev_err(device_data->dev, "%s: hash_save_state() failed!\n", | ||
46 | __func__); | ||
47 | diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c | ||
48 | index 495577b6d31b..94ad5c0adbcb 100644 | ||
49 | --- a/drivers/crypto/vmx/aes_cbc.c | ||
50 | +++ b/drivers/crypto/vmx/aes_cbc.c | ||
51 | @@ -182,7 +182,7 @@ struct crypto_alg p8_aes_cbc_alg = { | ||
52 | .cra_name = "cbc(aes)", | ||
53 | .cra_driver_name = "p8_aes_cbc", | ||
54 | .cra_module = THIS_MODULE, | ||
55 | - .cra_priority = 1000, | ||
56 | + .cra_priority = 2000, | ||
57 | .cra_type = &crypto_blkcipher_type, | ||
58 | .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK, | ||
59 | .cra_alignmask = 0, | ||
60 | diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c | ||
61 | index 0a3c1b04cf3c..38ed10d761d0 100644 | ||
62 | --- a/drivers/crypto/vmx/aes_ctr.c | ||
63 | +++ b/drivers/crypto/vmx/aes_ctr.c | ||
64 | @@ -166,7 +166,7 @@ struct crypto_alg p8_aes_ctr_alg = { | ||
65 | .cra_name = "ctr(aes)", | ||
66 | .cra_driver_name = "p8_aes_ctr", | ||
67 | .cra_module = THIS_MODULE, | ||
68 | - .cra_priority = 1000, | ||
69 | + .cra_priority = 2000, | ||
70 | .cra_type = &crypto_blkcipher_type, | ||
71 | .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK, | ||
72 | .cra_alignmask = 0, | ||
73 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c | ||
74 | index 6dc810bce295..944a6dca0fcb 100644 | ||
75 | --- a/drivers/usb/core/quirks.c | ||
76 | +++ b/drivers/usb/core/quirks.c | ||
77 | @@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = { | ||
78 | /* Creative SB Audigy 2 NX */ | ||
79 | { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
80 | |||
81 | + /* USB3503 */ | ||
82 | + { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
83 | + | ||
84 | /* Microsoft Wireless Laser Mouse 6000 Receiver */ | ||
85 | { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
86 | |||
87 | @@ -173,6 +176,10 @@ static const struct usb_device_id usb_quirk_list[] = { | ||
88 | /* MAYA44USB sound device */ | ||
89 | { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
90 | |||
91 | + /* ASUS Base Station(T100) */ | ||
92 | + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = | ||
93 | + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, | ||
94 | + | ||
95 | /* Action Semiconductor flash disk */ | ||
96 | { USB_DEVICE(0x10d6, 0x2200), .driver_info = | ||
97 | USB_QUIRK_STRING_FETCH_255 }, | ||
98 | @@ -188,26 +195,22 @@ static const struct usb_device_id usb_quirk_list[] = { | ||
99 | { USB_DEVICE(0x1908, 0x1315), .driver_info = | ||
100 | USB_QUIRK_HONOR_BNUMINTERFACES }, | ||
101 | |||
102 | - /* INTEL VALUE SSD */ | ||
103 | - { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
104 | - | ||
105 | - /* USB3503 */ | ||
106 | - { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
107 | - | ||
108 | - /* ASUS Base Station(T100) */ | ||
109 | - { USB_DEVICE(0x0b05, 0x17e0), .driver_info = | ||
110 | - USB_QUIRK_IGNORE_REMOTE_WAKEUP }, | ||
111 | - | ||
112 | /* Protocol and OTG Electrical Test Device */ | ||
113 | { USB_DEVICE(0x1a0a, 0x0200), .driver_info = | ||
114 | USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, | ||
115 | |||
116 | + /* Acer C120 LED Projector */ | ||
117 | + { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM }, | ||
118 | + | ||
119 | /* Blackmagic Design Intensity Shuttle */ | ||
120 | { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM }, | ||
121 | |||
122 | /* Blackmagic Design UltraStudio SDI */ | ||
123 | { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, | ||
124 | |||
125 | + /* INTEL VALUE SSD */ | ||
126 | + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
127 | + | ||
128 | { } /* terminating entry must be last */ | ||
129 | }; | ||
130 | |||
131 | diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c | ||
132 | index dd5cb5577dca..2f1fb7e7aa54 100644 | ||
133 | --- a/drivers/usb/dwc3/dwc3-exynos.c | ||
134 | +++ b/drivers/usb/dwc3/dwc3-exynos.c | ||
135 | @@ -128,12 +128,6 @@ static int dwc3_exynos_probe(struct platform_device *pdev) | ||
136 | |||
137 | platform_set_drvdata(pdev, exynos); | ||
138 | |||
139 | - ret = dwc3_exynos_register_phys(exynos); | ||
140 | - if (ret) { | ||
141 | - dev_err(dev, "couldn't register PHYs\n"); | ||
142 | - return ret; | ||
143 | - } | ||
144 | - | ||
145 | exynos->dev = dev; | ||
146 | |||
147 | exynos->clk = devm_clk_get(dev, "usbdrd30"); | ||
148 | @@ -183,20 +177,29 @@ static int dwc3_exynos_probe(struct platform_device *pdev) | ||
149 | goto err3; | ||
150 | } | ||
151 | |||
152 | + ret = dwc3_exynos_register_phys(exynos); | ||
153 | + if (ret) { | ||
154 | + dev_err(dev, "couldn't register PHYs\n"); | ||
155 | + goto err4; | ||
156 | + } | ||
157 | + | ||
158 | if (node) { | ||
159 | ret = of_platform_populate(node, NULL, NULL, dev); | ||
160 | if (ret) { | ||
161 | dev_err(dev, "failed to add dwc3 core\n"); | ||
162 | - goto err4; | ||
163 | + goto err5; | ||
164 | } | ||
165 | } else { | ||
166 | dev_err(dev, "no device node, failed to add dwc3 core\n"); | ||
167 | ret = -ENODEV; | ||
168 | - goto err4; | ||
169 | + goto err5; | ||
170 | } | ||
171 | |||
172 | return 0; | ||
173 | |||
174 | +err5: | ||
175 | + platform_device_unregister(exynos->usb2_phy); | ||
176 | + platform_device_unregister(exynos->usb3_phy); | ||
177 | err4: | ||
178 | regulator_disable(exynos->vdd10); | ||
179 | err3: | ||
180 | diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c | ||
181 | index e64479f882a5..aa3707bdebb4 100644 | ||
182 | --- a/drivers/usb/gadget/legacy/inode.c | ||
183 | +++ b/drivers/usb/gadget/legacy/inode.c | ||
184 | @@ -938,8 +938,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) | ||
185 | struct usb_ep *ep = dev->gadget->ep0; | ||
186 | struct usb_request *req = dev->req; | ||
187 | |||
188 | - if ((retval = setup_req (ep, req, 0)) == 0) | ||
189 | - retval = usb_ep_queue (ep, req, GFP_ATOMIC); | ||
190 | + if ((retval = setup_req (ep, req, 0)) == 0) { | ||
191 | + spin_unlock_irq (&dev->lock); | ||
192 | + retval = usb_ep_queue (ep, req, GFP_KERNEL); | ||
193 | + spin_lock_irq (&dev->lock); | ||
194 | + } | ||
195 | dev->state = STATE_DEV_CONNECTED; | ||
196 | |||
197 | /* assume that was SET_CONFIGURATION */ | ||
198 | @@ -1457,8 +1460,11 @@ delegate: | ||
199 | w_length); | ||
200 | if (value < 0) | ||
201 | break; | ||
202 | + | ||
203 | + spin_unlock (&dev->lock); | ||
204 | value = usb_ep_queue (gadget->ep0, dev->req, | ||
205 | - GFP_ATOMIC); | ||
206 | + GFP_KERNEL); | ||
207 | + spin_lock (&dev->lock); | ||
208 | if (value < 0) { | ||
209 | clean_req (gadget->ep0, dev->req); | ||
210 | break; | ||
211 | @@ -1481,11 +1487,14 @@ delegate: | ||
212 | if (value >= 0 && dev->state != STATE_DEV_SETUP) { | ||
213 | req->length = value; | ||
214 | req->zero = value < w_length; | ||
215 | - value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC); | ||
216 | + | ||
217 | + spin_unlock (&dev->lock); | ||
218 | + value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); | ||
219 | if (value < 0) { | ||
220 | DBG (dev, "ep_queue --> %d\n", value); | ||
221 | req->status = 0; | ||
222 | } | ||
223 | + return value; | ||
224 | } | ||
225 | |||
226 | /* device stalls when value < 0 */ | ||
227 | diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c | ||
228 | index 4031b372008e..c1c1024a054c 100644 | ||
229 | --- a/drivers/usb/host/ehci-tegra.c | ||
230 | +++ b/drivers/usb/host/ehci-tegra.c | ||
231 | @@ -89,7 +89,7 @@ static int tegra_reset_usb_controller(struct platform_device *pdev) | ||
232 | if (!usb1_reset_attempted) { | ||
233 | struct reset_control *usb1_reset; | ||
234 | |||
235 | - usb1_reset = of_reset_control_get(phy_np, "usb"); | ||
236 | + usb1_reset = of_reset_control_get(phy_np, "utmi-pads"); | ||
237 | if (IS_ERR(usb1_reset)) { | ||
238 | dev_warn(&pdev->dev, | ||
239 | "can't get utmi-pads reset from the PHY\n"); | ||
240 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c | ||
241 | index 48672fac7ff3..c10972fcc8e4 100644 | ||
242 | --- a/drivers/usb/host/xhci-pci.c | ||
243 | +++ b/drivers/usb/host/xhci-pci.c | ||
244 | @@ -37,6 +37,7 @@ | ||
245 | /* Device for a quirk */ | ||
246 | #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 | ||
247 | #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000 | ||
248 | +#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009 | ||
249 | #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400 | ||
250 | |||
251 | #define PCI_VENDOR_ID_ETRON 0x1b6f | ||
252 | @@ -114,6 +115,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) | ||
253 | xhci->quirks |= XHCI_TRUST_TX_LENGTH; | ||
254 | } | ||
255 | |||
256 | + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && | ||
257 | + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009) | ||
258 | + xhci->quirks |= XHCI_BROKEN_STREAMS; | ||
259 | + | ||
260 | if (pdev->vendor == PCI_VENDOR_ID_NEC) | ||
261 | xhci->quirks |= XHCI_NEC_HOST; | ||
262 | |||
263 | diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c | ||
264 | index 474b5fa14900..d6e2b2751e50 100644 | ||
265 | --- a/drivers/usb/host/xhci-plat.c | ||
266 | +++ b/drivers/usb/host/xhci-plat.c | ||
267 | @@ -194,6 +194,9 @@ static int xhci_plat_probe(struct platform_device *pdev) | ||
268 | ret = clk_prepare_enable(clk); | ||
269 | if (ret) | ||
270 | goto put_hcd; | ||
271 | + } else if (PTR_ERR(clk) == -EPROBE_DEFER) { | ||
272 | + ret = -EPROBE_DEFER; | ||
273 | + goto put_hcd; | ||
274 | } | ||
275 | |||
276 | xhci = hcd_to_xhci(hcd); | ||
277 | diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c | ||
278 | index 99b4ff42f7a0..8b5b2aca277d 100644 | ||
279 | --- a/drivers/usb/host/xhci-ring.c | ||
280 | +++ b/drivers/usb/host/xhci-ring.c | ||
281 | @@ -290,6 +290,14 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci) | ||
282 | |||
283 | temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring); | ||
284 | xhci->cmd_ring_state = CMD_RING_STATE_ABORTED; | ||
285 | + | ||
286 | + /* | ||
287 | + * Writing the CMD_RING_ABORT bit should cause a cmd completion event, | ||
288 | + * however on some host hw the CMD_RING_RUNNING bit is correctly cleared | ||
289 | + * but the completion event in never sent. Use the cmd timeout timer to | ||
290 | + * handle those cases. Use twice the time to cover the bit polling retry | ||
291 | + */ | ||
292 | + mod_timer(&xhci->cmd_timer, jiffies + (2 * XHCI_CMD_DEFAULT_TIMEOUT)); | ||
293 | xhci_write_64(xhci, temp_64 | CMD_RING_ABORT, | ||
294 | &xhci->op_regs->cmd_ring); | ||
295 | |||
296 | @@ -314,6 +322,7 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci) | ||
297 | |||
298 | xhci_err(xhci, "Stopped the command ring failed, " | ||
299 | "maybe the host is dead\n"); | ||
300 | + del_timer(&xhci->cmd_timer); | ||
301 | xhci->xhc_state |= XHCI_STATE_DYING; | ||
302 | xhci_quiesce(xhci); | ||
303 | xhci_halt(xhci); | ||
304 | @@ -1253,22 +1262,21 @@ void xhci_handle_command_timeout(unsigned long data) | ||
305 | int ret; | ||
306 | unsigned long flags; | ||
307 | u64 hw_ring_state; | ||
308 | - struct xhci_command *cur_cmd = NULL; | ||
309 | + bool second_timeout = false; | ||
310 | xhci = (struct xhci_hcd *) data; | ||
311 | |||
312 | /* mark this command to be cancelled */ | ||
313 | spin_lock_irqsave(&xhci->lock, flags); | ||
314 | if (xhci->current_cmd) { | ||
315 | - cur_cmd = xhci->current_cmd; | ||
316 | - cur_cmd->status = COMP_CMD_ABORT; | ||
317 | + if (xhci->current_cmd->status == COMP_CMD_ABORT) | ||
318 | + second_timeout = true; | ||
319 | + xhci->current_cmd->status = COMP_CMD_ABORT; | ||
320 | } | ||
321 | |||
322 | - | ||
323 | /* Make sure command ring is running before aborting it */ | ||
324 | hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring); | ||
325 | if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) && | ||
326 | (hw_ring_state & CMD_RING_RUNNING)) { | ||
327 | - | ||
328 | spin_unlock_irqrestore(&xhci->lock, flags); | ||
329 | xhci_dbg(xhci, "Command timeout\n"); | ||
330 | ret = xhci_abort_cmd_ring(xhci); | ||
331 | @@ -1280,6 +1288,15 @@ void xhci_handle_command_timeout(unsigned long data) | ||
332 | } | ||
333 | return; | ||
334 | } | ||
335 | + | ||
336 | + /* command ring failed to restart, or host removed. Bail out */ | ||
337 | + if (second_timeout || xhci->xhc_state & XHCI_STATE_REMOVING) { | ||
338 | + spin_unlock_irqrestore(&xhci->lock, flags); | ||
339 | + xhci_dbg(xhci, "command timed out twice, ring start fail?\n"); | ||
340 | + xhci_cleanup_command_queue(xhci); | ||
341 | + return; | ||
342 | + } | ||
343 | + | ||
344 | /* command timeout on stopped ring, ring can't be aborted */ | ||
345 | xhci_dbg(xhci, "Command timeout on stopped ring\n"); | ||
346 | xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd); | ||
347 | @@ -2728,7 +2745,8 @@ hw_died: | ||
348 | writel(irq_pending, &xhci->ir_set->irq_pending); | ||
349 | } | ||
350 | |||
351 | - if (xhci->xhc_state & XHCI_STATE_DYING) { | ||
352 | + if (xhci->xhc_state & XHCI_STATE_DYING || | ||
353 | + xhci->xhc_state & XHCI_STATE_HALTED) { | ||
354 | xhci_dbg(xhci, "xHCI dying, ignoring interrupt. " | ||
355 | "Shouldn't IRQs be disabled?\n"); | ||
356 | /* Clear the event handler busy flag (RW1C); | ||
357 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c | ||
358 | index 9e71c96ad74a..327280535848 100644 | ||
359 | --- a/drivers/usb/host/xhci.c | ||
360 | +++ b/drivers/usb/host/xhci.c | ||
361 | @@ -685,20 +685,23 @@ void xhci_stop(struct usb_hcd *hcd) | ||
362 | u32 temp; | ||
363 | struct xhci_hcd *xhci = hcd_to_xhci(hcd); | ||
364 | |||
365 | - if (xhci->xhc_state & XHCI_STATE_HALTED) | ||
366 | - return; | ||
367 | - | ||
368 | mutex_lock(&xhci->mutex); | ||
369 | - spin_lock_irq(&xhci->lock); | ||
370 | - xhci->xhc_state |= XHCI_STATE_HALTED; | ||
371 | - xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; | ||
372 | |||
373 | - /* Make sure the xHC is halted for a USB3 roothub | ||
374 | - * (xhci_stop() could be called as part of failed init). | ||
375 | - */ | ||
376 | - xhci_halt(xhci); | ||
377 | - xhci_reset(xhci); | ||
378 | - spin_unlock_irq(&xhci->lock); | ||
379 | + if (!(xhci->xhc_state & XHCI_STATE_HALTED)) { | ||
380 | + spin_lock_irq(&xhci->lock); | ||
381 | + | ||
382 | + xhci->xhc_state |= XHCI_STATE_HALTED; | ||
383 | + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; | ||
384 | + xhci_halt(xhci); | ||
385 | + xhci_reset(xhci); | ||
386 | + | ||
387 | + spin_unlock_irq(&xhci->lock); | ||
388 | + } | ||
389 | + | ||
390 | + if (!usb_hcd_is_primary_hcd(hcd)) { | ||
391 | + mutex_unlock(&xhci->mutex); | ||
392 | + return; | ||
393 | + } | ||
394 | |||
395 | xhci_cleanup_msix(xhci); | ||
396 | |||
397 | diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c | ||
398 | index 39fd95833eb8..c84f4d0816e5 100644 | ||
399 | --- a/drivers/usb/musb/musb_core.c | ||
400 | +++ b/drivers/usb/musb/musb_core.c | ||
401 | @@ -2429,7 +2429,8 @@ static void musb_restore_context(struct musb *musb) | ||
402 | musb_writew(musb_base, MUSB_INTRTXE, musb->intrtxe); | ||
403 | musb_writew(musb_base, MUSB_INTRRXE, musb->intrrxe); | ||
404 | musb_writeb(musb_base, MUSB_INTRUSBE, musb->context.intrusbe); | ||
405 | - musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl); | ||
406 | + if (musb->context.devctl & MUSB_DEVCTL_SESSION) | ||
407 | + musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl); | ||
408 | |||
409 | for (i = 0; i < musb->config->num_eps; ++i) { | ||
410 | struct musb_hw_ep *hw_ep; | ||
411 | diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c | ||
412 | index 2f8ad7f1f482..8ff03228540a 100644 | ||
413 | --- a/drivers/usb/musb/musb_host.c | ||
414 | +++ b/drivers/usb/musb/musb_host.c | ||
415 | @@ -594,14 +594,13 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, u8 epnum) | ||
416 | musb_writew(ep->regs, MUSB_TXCSR, 0); | ||
417 | |||
418 | /* scrub all previous state, clearing toggle */ | ||
419 | - } else { | ||
420 | - csr = musb_readw(ep->regs, MUSB_RXCSR); | ||
421 | - if (csr & MUSB_RXCSR_RXPKTRDY) | ||
422 | - WARNING("rx%d, packet/%d ready?\n", ep->epnum, | ||
423 | - musb_readw(ep->regs, MUSB_RXCOUNT)); | ||
424 | - | ||
425 | - musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG); | ||
426 | } | ||
427 | + csr = musb_readw(ep->regs, MUSB_RXCSR); | ||
428 | + if (csr & MUSB_RXCSR_RXPKTRDY) | ||
429 | + WARNING("rx%d, packet/%d ready?\n", ep->epnum, | ||
430 | + musb_readw(ep->regs, MUSB_RXCOUNT)); | ||
431 | + | ||
432 | + musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG); | ||
433 | |||
434 | /* target addr and (for multipoint) hub addr/port */ | ||
435 | if (musb->is_multipoint) { | ||
436 | @@ -995,9 +994,15 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep, | ||
437 | if (is_in) { | ||
438 | dma = is_dma_capable() ? ep->rx_channel : NULL; | ||
439 | |||
440 | - /* clear nak timeout bit */ | ||
441 | + /* | ||
442 | + * Need to stop the transaction by clearing REQPKT first | ||
443 | + * then the NAK Timeout bit ref MUSBMHDRC USB 2.0 HIGH-SPEED | ||
444 | + * DUAL-ROLE CONTROLLER Programmer's Guide, section 9.2.2 | ||
445 | + */ | ||
446 | rx_csr = musb_readw(epio, MUSB_RXCSR); | ||
447 | rx_csr |= MUSB_RXCSR_H_WZC_BITS; | ||
448 | + rx_csr &= ~MUSB_RXCSR_H_REQPKT; | ||
449 | + musb_writew(epio, MUSB_RXCSR, rx_csr); | ||
450 | rx_csr &= ~MUSB_RXCSR_DATAERROR; | ||
451 | musb_writew(epio, MUSB_RXCSR, rx_csr); | ||
452 | |||
453 | @@ -1551,7 +1556,7 @@ static int musb_rx_dma_iso_cppi41(struct dma_controller *dma, | ||
454 | struct urb *urb, | ||
455 | size_t len) | ||
456 | { | ||
457 | - struct dma_channel *channel = hw_ep->tx_channel; | ||
458 | + struct dma_channel *channel = hw_ep->rx_channel; | ||
459 | void __iomem *epio = hw_ep->regs; | ||
460 | dma_addr_t *buf; | ||
461 | u32 length, res; | ||
462 | diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c | ||
463 | index 2eddbe538cda..5608af4a369d 100644 | ||
464 | --- a/drivers/usb/serial/mos7720.c | ||
465 | +++ b/drivers/usb/serial/mos7720.c | ||
466 | @@ -2007,6 +2007,7 @@ static void mos7720_release(struct usb_serial *serial) | ||
467 | urblist_entry) | ||
468 | usb_unlink_urb(urbtrack->urb); | ||
469 | spin_unlock_irqrestore(&mos_parport->listlock, flags); | ||
470 | + parport_del_port(mos_parport->pp); | ||
471 | |||
472 | kref_put(&mos_parport->ref_count, destroy_mos_parport); | ||
473 | } | ||
474 | diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c | ||
475 | index 16bc679dc2fc..ecc7d4b1dfa3 100644 | ||
476 | --- a/drivers/usb/storage/uas.c | ||
477 | +++ b/drivers/usb/storage/uas.c | ||
478 | @@ -835,6 +835,7 @@ static int uas_slave_configure(struct scsi_device *sdev) | ||
479 | if (devinfo->flags & US_FL_BROKEN_FUA) | ||
480 | sdev->broken_fua = 1; | ||
481 | |||
482 | + scsi_change_queue_depth(sdev, devinfo->qdepth - 2); | ||
483 | return 0; | ||
484 | } | ||
485 | |||
486 | diff --git a/include/linux/bpf.h b/include/linux/bpf.h | ||
487 | index f1d5c5acc8dd..ca80d5830bfd 100644 | ||
488 | --- a/include/linux/bpf.h | ||
489 | +++ b/include/linux/bpf.h | ||
490 | @@ -229,6 +229,10 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd) | ||
491 | static inline void bpf_prog_put(struct bpf_prog *prog) | ||
492 | { | ||
493 | } | ||
494 | + | ||
495 | +static inline void bpf_prog_put_rcu(struct bpf_prog *prog) | ||
496 | +{ | ||
497 | +} | ||
498 | #endif /* CONFIG_BPF_SYSCALL */ | ||
499 | |||
500 | /* verifier prototypes for helper functions called from eBPF programs */ | ||
501 | diff --git a/include/linux/net.h b/include/linux/net.h | ||
502 | index f840d77c6c31..9d90efe6a708 100644 | ||
503 | --- a/include/linux/net.h | ||
504 | +++ b/include/linux/net.h | ||
505 | @@ -252,7 +252,8 @@ do { \ | ||
506 | DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \ | ||
507 | if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) && \ | ||
508 | net_ratelimit()) \ | ||
509 | - __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__); \ | ||
510 | + __dynamic_pr_debug(&descriptor, pr_fmt(fmt), \ | ||
511 | + ##__VA_ARGS__); \ | ||
512 | } while (0) | ||
513 | #elif defined(DEBUG) | ||
514 | #define net_dbg_ratelimited(fmt, ...) \ | ||
515 | diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h | ||
516 | index 4018b48f2b3b..a0596ca0e80a 100644 | ||
517 | --- a/include/linux/sock_diag.h | ||
518 | +++ b/include/linux/sock_diag.h | ||
519 | @@ -36,6 +36,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk) | ||
520 | { | ||
521 | switch (sk->sk_family) { | ||
522 | case AF_INET: | ||
523 | + if (sk->sk_type == SOCK_RAW) | ||
524 | + return SKNLGRP_NONE; | ||
525 | + | ||
526 | switch (sk->sk_protocol) { | ||
527 | case IPPROTO_TCP: | ||
528 | return SKNLGRP_INET_TCP_DESTROY; | ||
529 | @@ -45,6 +48,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk) | ||
530 | return SKNLGRP_NONE; | ||
531 | } | ||
532 | case AF_INET6: | ||
533 | + if (sk->sk_type == SOCK_RAW) | ||
534 | + return SKNLGRP_NONE; | ||
535 | + | ||
536 | switch (sk->sk_protocol) { | ||
537 | case IPPROTO_TCP: | ||
538 | return SKNLGRP_INET6_TCP_DESTROY; | ||
539 | diff --git a/kernel/events/core.c b/kernel/events/core.c | ||
540 | index c0ded2416615..a69c90cea05d 100644 | ||
541 | --- a/kernel/events/core.c | ||
542 | +++ b/kernel/events/core.c | ||
543 | @@ -7143,7 +7143,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) | ||
544 | prog = event->tp_event->prog; | ||
545 | if (prog) { | ||
546 | event->tp_event->prog = NULL; | ||
547 | - bpf_prog_put(prog); | ||
548 | + bpf_prog_put_rcu(prog); | ||
549 | } | ||
550 | } | ||
551 | |||
552 | diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c | ||
553 | index fbd0acf80b13..2fdebabbfacd 100644 | ||
554 | --- a/net/ax25/af_ax25.c | ||
555 | +++ b/net/ax25/af_ax25.c | ||
556 | @@ -976,7 +976,8 @@ static int ax25_release(struct socket *sock) | ||
557 | release_sock(sk); | ||
558 | ax25_disconnect(ax25, 0); | ||
559 | lock_sock(sk); | ||
560 | - ax25_destroy_socket(ax25); | ||
561 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) | ||
562 | + ax25_destroy_socket(ax25); | ||
563 | break; | ||
564 | |||
565 | case AX25_STATE_3: | ||
566 | diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c | ||
567 | index 951cd57bb07d..5237dff6941d 100644 | ||
568 | --- a/net/ax25/ax25_ds_timer.c | ||
569 | +++ b/net/ax25/ax25_ds_timer.c | ||
570 | @@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25) | ||
571 | switch (ax25->state) { | ||
572 | |||
573 | case AX25_STATE_0: | ||
574 | + case AX25_STATE_2: | ||
575 | /* Magic here: If we listen() and a new link dies before it | ||
576 | is accepted() it isn't 'dead' so doesn't get removed. */ | ||
577 | if (!sk || sock_flag(sk, SOCK_DESTROY) || | ||
578 | @@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25) | ||
579 | sock_hold(sk); | ||
580 | ax25_destroy_socket(ax25); | ||
581 | bh_unlock_sock(sk); | ||
582 | + /* Ungrab socket and destroy it */ | ||
583 | sock_put(sk); | ||
584 | } else | ||
585 | ax25_destroy_socket(ax25); | ||
586 | @@ -213,7 +215,8 @@ void ax25_ds_t1_timeout(ax25_cb *ax25) | ||
587 | case AX25_STATE_2: | ||
588 | if (ax25->n2count == ax25->n2) { | ||
589 | ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND); | ||
590 | - ax25_disconnect(ax25, ETIMEDOUT); | ||
591 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) | ||
592 | + ax25_disconnect(ax25, ETIMEDOUT); | ||
593 | return; | ||
594 | } else { | ||
595 | ax25->n2count++; | ||
596 | diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c | ||
597 | index 004467c9e6e1..2c0d6ef66f9d 100644 | ||
598 | --- a/net/ax25/ax25_std_timer.c | ||
599 | +++ b/net/ax25/ax25_std_timer.c | ||
600 | @@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25) | ||
601 | |||
602 | switch (ax25->state) { | ||
603 | case AX25_STATE_0: | ||
604 | + case AX25_STATE_2: | ||
605 | /* Magic here: If we listen() and a new link dies before it | ||
606 | is accepted() it isn't 'dead' so doesn't get removed. */ | ||
607 | if (!sk || sock_flag(sk, SOCK_DESTROY) || | ||
608 | @@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25) | ||
609 | sock_hold(sk); | ||
610 | ax25_destroy_socket(ax25); | ||
611 | bh_unlock_sock(sk); | ||
612 | + /* Ungrab socket and destroy it */ | ||
613 | sock_put(sk); | ||
614 | } else | ||
615 | ax25_destroy_socket(ax25); | ||
616 | @@ -144,7 +146,8 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25) | ||
617 | case AX25_STATE_2: | ||
618 | if (ax25->n2count == ax25->n2) { | ||
619 | ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND); | ||
620 | - ax25_disconnect(ax25, ETIMEDOUT); | ||
621 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) | ||
622 | + ax25_disconnect(ax25, ETIMEDOUT); | ||
623 | return; | ||
624 | } else { | ||
625 | ax25->n2count++; | ||
626 | diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c | ||
627 | index 3b78e8473a01..655a7d4c96e1 100644 | ||
628 | --- a/net/ax25/ax25_subr.c | ||
629 | +++ b/net/ax25/ax25_subr.c | ||
630 | @@ -264,7 +264,8 @@ void ax25_disconnect(ax25_cb *ax25, int reason) | ||
631 | { | ||
632 | ax25_clear_queues(ax25); | ||
633 | |||
634 | - ax25_stop_heartbeat(ax25); | ||
635 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) | ||
636 | + ax25_stop_heartbeat(ax25); | ||
637 | ax25_stop_t1timer(ax25); | ||
638 | ax25_stop_t2timer(ax25); | ||
639 | ax25_stop_t3timer(ax25); | ||
640 | diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c | ||
641 | index 6852f3c7009c..43844144c9c4 100644 | ||
642 | --- a/net/bridge/br_multicast.c | ||
643 | +++ b/net/bridge/br_multicast.c | ||
644 | @@ -464,8 +464,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br, | ||
645 | if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, | ||
646 | &ip6h->saddr)) { | ||
647 | kfree_skb(skb); | ||
648 | + br->has_ipv6_addr = 0; | ||
649 | return NULL; | ||
650 | } | ||
651 | + | ||
652 | + br->has_ipv6_addr = 1; | ||
653 | ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); | ||
654 | |||
655 | hopopt = (u8 *)(ip6h + 1); | ||
656 | @@ -1745,6 +1748,7 @@ void br_multicast_init(struct net_bridge *br) | ||
657 | br->ip6_other_query.delay_time = 0; | ||
658 | br->ip6_querier.port = NULL; | ||
659 | #endif | ||
660 | + br->has_ipv6_addr = 1; | ||
661 | |||
662 | spin_lock_init(&br->multicast_lock); | ||
663 | setup_timer(&br->multicast_router_timer, | ||
664 | diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h | ||
665 | index d9da857182ef..f516c53bafb6 100644 | ||
666 | --- a/net/bridge/br_private.h | ||
667 | +++ b/net/bridge/br_private.h | ||
668 | @@ -304,6 +304,7 @@ struct net_bridge | ||
669 | u8 multicast_disabled:1; | ||
670 | u8 multicast_querier:1; | ||
671 | u8 multicast_query_use_ifaddr:1; | ||
672 | + u8 has_ipv6_addr:1; | ||
673 | |||
674 | u32 hash_elasticity; | ||
675 | u32 hash_max; | ||
676 | @@ -577,10 +578,22 @@ static inline bool br_multicast_is_router(struct net_bridge *br) | ||
677 | |||
678 | static inline bool | ||
679 | __br_multicast_querier_exists(struct net_bridge *br, | ||
680 | - struct bridge_mcast_other_query *querier) | ||
681 | + struct bridge_mcast_other_query *querier, | ||
682 | + const bool is_ipv6) | ||
683 | { | ||
684 | + bool own_querier_enabled; | ||
685 | + | ||
686 | + if (br->multicast_querier) { | ||
687 | + if (is_ipv6 && !br->has_ipv6_addr) | ||
688 | + own_querier_enabled = false; | ||
689 | + else | ||
690 | + own_querier_enabled = true; | ||
691 | + } else { | ||
692 | + own_querier_enabled = false; | ||
693 | + } | ||
694 | + | ||
695 | return time_is_before_jiffies(querier->delay_time) && | ||
696 | - (br->multicast_querier || timer_pending(&querier->timer)); | ||
697 | + (own_querier_enabled || timer_pending(&querier->timer)); | ||
698 | } | ||
699 | |||
700 | static inline bool br_multicast_querier_exists(struct net_bridge *br, | ||
701 | @@ -588,10 +601,12 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br, | ||
702 | { | ||
703 | switch (eth->h_proto) { | ||
704 | case (htons(ETH_P_IP)): | ||
705 | - return __br_multicast_querier_exists(br, &br->ip4_other_query); | ||
706 | + return __br_multicast_querier_exists(br, | ||
707 | + &br->ip4_other_query, false); | ||
708 | #if IS_ENABLED(CONFIG_IPV6) | ||
709 | case (htons(ETH_P_IPV6)): | ||
710 | - return __br_multicast_querier_exists(br, &br->ip6_other_query); | ||
711 | + return __br_multicast_querier_exists(br, | ||
712 | + &br->ip6_other_query, true); | ||
713 | #endif | ||
714 | default: | ||
715 | return false; | ||
716 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c | ||
717 | index f18ae91b652e..769cece9b00b 100644 | ||
718 | --- a/net/core/neighbour.c | ||
719 | +++ b/net/core/neighbour.c | ||
720 | @@ -2467,13 +2467,17 @@ int neigh_xmit(int index, struct net_device *dev, | ||
721 | tbl = neigh_tables[index]; | ||
722 | if (!tbl) | ||
723 | goto out; | ||
724 | + rcu_read_lock_bh(); | ||
725 | neigh = __neigh_lookup_noref(tbl, addr, dev); | ||
726 | if (!neigh) | ||
727 | neigh = __neigh_create(tbl, addr, dev, false); | ||
728 | err = PTR_ERR(neigh); | ||
729 | - if (IS_ERR(neigh)) | ||
730 | + if (IS_ERR(neigh)) { | ||
731 | + rcu_read_unlock_bh(); | ||
732 | goto out_kfree_skb; | ||
733 | + } | ||
734 | err = neigh->output(neigh, skb); | ||
735 | + rcu_read_unlock_bh(); | ||
736 | } | ||
737 | else if (index == NEIGH_LINK_TABLE) { | ||
738 | err = dev_hard_header(skb, dev, ntohs(skb->protocol), | ||
739 | diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c | ||
740 | index 477937465a20..d95631d09248 100644 | ||
741 | --- a/net/ipv4/esp4.c | ||
742 | +++ b/net/ipv4/esp4.c | ||
743 | @@ -23,6 +23,11 @@ struct esp_skb_cb { | ||
744 | void *tmp; | ||
745 | }; | ||
746 | |||
747 | +struct esp_output_extra { | ||
748 | + __be32 seqhi; | ||
749 | + u32 esphoff; | ||
750 | +}; | ||
751 | + | ||
752 | #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0])) | ||
753 | |||
754 | static u32 esp4_get_mtu(struct xfrm_state *x, int mtu); | ||
755 | @@ -35,11 +40,11 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu); | ||
756 | * | ||
757 | * TODO: Use spare space in skb for this where possible. | ||
758 | */ | ||
759 | -static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen) | ||
760 | +static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int extralen) | ||
761 | { | ||
762 | unsigned int len; | ||
763 | |||
764 | - len = seqhilen; | ||
765 | + len = extralen; | ||
766 | |||
767 | len += crypto_aead_ivsize(aead); | ||
768 | |||
769 | @@ -57,15 +62,16 @@ static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen) | ||
770 | return kmalloc(len, GFP_ATOMIC); | ||
771 | } | ||
772 | |||
773 | -static inline __be32 *esp_tmp_seqhi(void *tmp) | ||
774 | +static inline void *esp_tmp_extra(void *tmp) | ||
775 | { | ||
776 | - return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32)); | ||
777 | + return PTR_ALIGN(tmp, __alignof__(struct esp_output_extra)); | ||
778 | } | ||
779 | -static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen) | ||
780 | + | ||
781 | +static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int extralen) | ||
782 | { | ||
783 | return crypto_aead_ivsize(aead) ? | ||
784 | - PTR_ALIGN((u8 *)tmp + seqhilen, | ||
785 | - crypto_aead_alignmask(aead) + 1) : tmp + seqhilen; | ||
786 | + PTR_ALIGN((u8 *)tmp + extralen, | ||
787 | + crypto_aead_alignmask(aead) + 1) : tmp + extralen; | ||
788 | } | ||
789 | |||
790 | static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv) | ||
791 | @@ -99,7 +105,7 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset) | ||
792 | { | ||
793 | struct ip_esp_hdr *esph = (void *)(skb->data + offset); | ||
794 | void *tmp = ESP_SKB_CB(skb)->tmp; | ||
795 | - __be32 *seqhi = esp_tmp_seqhi(tmp); | ||
796 | + __be32 *seqhi = esp_tmp_extra(tmp); | ||
797 | |||
798 | esph->seq_no = esph->spi; | ||
799 | esph->spi = *seqhi; | ||
800 | @@ -107,7 +113,11 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset) | ||
801 | |||
802 | static void esp_output_restore_header(struct sk_buff *skb) | ||
803 | { | ||
804 | - esp_restore_header(skb, skb_transport_offset(skb) - sizeof(__be32)); | ||
805 | + void *tmp = ESP_SKB_CB(skb)->tmp; | ||
806 | + struct esp_output_extra *extra = esp_tmp_extra(tmp); | ||
807 | + | ||
808 | + esp_restore_header(skb, skb_transport_offset(skb) + extra->esphoff - | ||
809 | + sizeof(__be32)); | ||
810 | } | ||
811 | |||
812 | static void esp_output_done_esn(struct crypto_async_request *base, int err) | ||
813 | @@ -121,6 +131,7 @@ static void esp_output_done_esn(struct crypto_async_request *base, int err) | ||
814 | static int esp_output(struct xfrm_state *x, struct sk_buff *skb) | ||
815 | { | ||
816 | int err; | ||
817 | + struct esp_output_extra *extra; | ||
818 | struct ip_esp_hdr *esph; | ||
819 | struct crypto_aead *aead; | ||
820 | struct aead_request *req; | ||
821 | @@ -137,8 +148,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) | ||
822 | int tfclen; | ||
823 | int nfrags; | ||
824 | int assoclen; | ||
825 | - int seqhilen; | ||
826 | - __be32 *seqhi; | ||
827 | + int extralen; | ||
828 | __be64 seqno; | ||
829 | |||
830 | /* skb is pure payload to encrypt */ | ||
831 | @@ -166,21 +176,21 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) | ||
832 | nfrags = err; | ||
833 | |||
834 | assoclen = sizeof(*esph); | ||
835 | - seqhilen = 0; | ||
836 | + extralen = 0; | ||
837 | |||
838 | if (x->props.flags & XFRM_STATE_ESN) { | ||
839 | - seqhilen += sizeof(__be32); | ||
840 | - assoclen += seqhilen; | ||
841 | + extralen += sizeof(*extra); | ||
842 | + assoclen += sizeof(__be32); | ||
843 | } | ||
844 | |||
845 | - tmp = esp_alloc_tmp(aead, nfrags, seqhilen); | ||
846 | + tmp = esp_alloc_tmp(aead, nfrags, extralen); | ||
847 | if (!tmp) { | ||
848 | err = -ENOMEM; | ||
849 | goto error; | ||
850 | } | ||
851 | |||
852 | - seqhi = esp_tmp_seqhi(tmp); | ||
853 | - iv = esp_tmp_iv(aead, tmp, seqhilen); | ||
854 | + extra = esp_tmp_extra(tmp); | ||
855 | + iv = esp_tmp_iv(aead, tmp, extralen); | ||
856 | req = esp_tmp_req(aead, iv); | ||
857 | sg = esp_req_sg(aead, req); | ||
858 | |||
859 | @@ -247,8 +257,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) | ||
860 | * encryption. | ||
861 | */ | ||
862 | if ((x->props.flags & XFRM_STATE_ESN)) { | ||
863 | - esph = (void *)(skb_transport_header(skb) - sizeof(__be32)); | ||
864 | - *seqhi = esph->spi; | ||
865 | + extra->esphoff = (unsigned char *)esph - | ||
866 | + skb_transport_header(skb); | ||
867 | + esph = (struct ip_esp_hdr *)((unsigned char *)esph - 4); | ||
868 | + extra->seqhi = esph->spi; | ||
869 | esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.hi); | ||
870 | aead_request_set_callback(req, 0, esp_output_done_esn, skb); | ||
871 | } | ||
872 | @@ -445,7 +457,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) | ||
873 | goto out; | ||
874 | |||
875 | ESP_SKB_CB(skb)->tmp = tmp; | ||
876 | - seqhi = esp_tmp_seqhi(tmp); | ||
877 | + seqhi = esp_tmp_extra(tmp); | ||
878 | iv = esp_tmp_iv(aead, tmp, seqhilen); | ||
879 | req = esp_tmp_req(aead, iv); | ||
880 | sg = esp_req_sg(aead, req); | ||
881 | diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c | ||
882 | index 395e2814a46d..a42dd8021b6b 100644 | ||
883 | --- a/net/ipv4/ipmr.c | ||
884 | +++ b/net/ipv4/ipmr.c | ||
885 | @@ -891,8 +891,10 @@ static struct mfc_cache *ipmr_cache_alloc(void) | ||
886 | { | ||
887 | struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL); | ||
888 | |||
889 | - if (c) | ||
890 | + if (c) { | ||
891 | + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1; | ||
892 | c->mfc_un.res.minvif = MAXVIFS; | ||
893 | + } | ||
894 | return c; | ||
895 | } | ||
896 | |||
897 | diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c | ||
898 | index a10e77103c88..e207cb2468da 100644 | ||
899 | --- a/net/ipv6/ip6mr.c | ||
900 | +++ b/net/ipv6/ip6mr.c | ||
901 | @@ -1074,6 +1074,7 @@ static struct mfc6_cache *ip6mr_cache_alloc(void) | ||
902 | struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL); | ||
903 | if (!c) | ||
904 | return NULL; | ||
905 | + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1; | ||
906 | c->mfc_un.res.minvif = MAXMIFS; | ||
907 | return c; | ||
908 | } | ||
909 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c | ||
910 | index 83384308d032..6c53e4eb0f09 100644 | ||
911 | --- a/net/ipv6/sit.c | ||
912 | +++ b/net/ipv6/sit.c | ||
913 | @@ -560,13 +560,13 @@ static int ipip6_err(struct sk_buff *skb, u32 info) | ||
914 | |||
915 | if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { | ||
916 | ipv4_update_pmtu(skb, dev_net(skb->dev), info, | ||
917 | - t->parms.link, 0, IPPROTO_IPV6, 0); | ||
918 | + t->parms.link, 0, iph->protocol, 0); | ||
919 | err = 0; | ||
920 | goto out; | ||
921 | } | ||
922 | if (type == ICMP_REDIRECT) { | ||
923 | ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, | ||
924 | - IPPROTO_IPV6, 0); | ||
925 | + iph->protocol, 0); | ||
926 | err = 0; | ||
927 | goto out; | ||
928 | } | ||
929 | diff --git a/net/kcm/kcmproc.c b/net/kcm/kcmproc.c | ||
930 | index 738008726cc6..fda7f4715c58 100644 | ||
931 | --- a/net/kcm/kcmproc.c | ||
932 | +++ b/net/kcm/kcmproc.c | ||
933 | @@ -241,6 +241,7 @@ static const struct file_operations kcm_seq_fops = { | ||
934 | .open = kcm_seq_open, | ||
935 | .read = seq_read, | ||
936 | .llseek = seq_lseek, | ||
937 | + .release = seq_release_net, | ||
938 | }; | ||
939 | |||
940 | static struct kcm_seq_muxinfo kcm_seq_muxinfo = { | ||
941 | diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c | ||
942 | index 8b5270008a6e..606323339e1f 100644 | ||
943 | --- a/net/sched/act_ipt.c | ||
944 | +++ b/net/sched/act_ipt.c | ||
945 | @@ -121,10 +121,13 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla, | ||
946 | } | ||
947 | |||
948 | td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]); | ||
949 | - if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) | ||
950 | + if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) { | ||
951 | + if (exists) | ||
952 | + tcf_hash_release(a, bind); | ||
953 | return -EINVAL; | ||
954 | + } | ||
955 | |||
956 | - if (!tcf_hash_check(tn, index, a, bind)) { | ||
957 | + if (!exists) { | ||
958 | ret = tcf_hash_create(tn, index, est, a, sizeof(*ipt), bind, | ||
959 | false); | ||
960 | if (ret) | ||
961 | diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c | ||
962 | index 2177eac0a61e..2e4bd2c0a50c 100644 | ||
963 | --- a/net/sched/sch_fifo.c | ||
964 | +++ b/net/sched/sch_fifo.c | ||
965 | @@ -37,14 +37,18 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch) | ||
966 | |||
967 | static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch) | ||
968 | { | ||
969 | + unsigned int prev_backlog; | ||
970 | + | ||
971 | if (likely(skb_queue_len(&sch->q) < sch->limit)) | ||
972 | return qdisc_enqueue_tail(skb, sch); | ||
973 | |||
974 | + prev_backlog = sch->qstats.backlog; | ||
975 | /* queue full, remove one skb to fulfill the limit */ | ||
976 | __qdisc_queue_drop_head(sch, &sch->q); | ||
977 | qdisc_qstats_drop(sch); | ||
978 | qdisc_enqueue_tail(skb, sch); | ||
979 | |||
980 | + qdisc_tree_reduce_backlog(sch, 0, prev_backlog - sch->qstats.backlog); | ||
981 | return NET_XMIT_CN; | ||
982 | } | ||
983 | |||
984 | diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c | ||
985 | index 4befe97a9034..b7c29d5b6f04 100644 | ||
986 | --- a/net/sched/sch_netem.c | ||
987 | +++ b/net/sched/sch_netem.c | ||
988 | @@ -650,14 +650,14 @@ deliver: | ||
989 | #endif | ||
990 | |||
991 | if (q->qdisc) { | ||
992 | + unsigned int pkt_len = qdisc_pkt_len(skb); | ||
993 | int err = qdisc_enqueue(skb, q->qdisc); | ||
994 | |||
995 | - if (unlikely(err != NET_XMIT_SUCCESS)) { | ||
996 | - if (net_xmit_drop_count(err)) { | ||
997 | - qdisc_qstats_drop(sch); | ||
998 | - qdisc_tree_reduce_backlog(sch, 1, | ||
999 | - qdisc_pkt_len(skb)); | ||
1000 | - } | ||
1001 | + if (err != NET_XMIT_SUCCESS && | ||
1002 | + net_xmit_drop_count(err)) { | ||
1003 | + qdisc_qstats_drop(sch); | ||
1004 | + qdisc_tree_reduce_backlog(sch, 1, | ||
1005 | + pkt_len); | ||
1006 | } | ||
1007 | goto tfifo_dequeue; | ||
1008 | } |