Contents of /trunk/kernel-magellan/patches-4.6/0103-4.6.4-all-fixes.patch
Parent Directory | Revision Log
Revision 2818 -
(show annotations)
(download)
Thu Aug 4 13:24:47 2016 UTC (8 years, 1 month ago) by niro
File size: 33248 byte(s)
Thu Aug 4 13:24:47 2016 UTC (8 years, 1 month ago) by niro
File size: 33248 byte(s)
-linux-4.6.4
1 | diff --git a/Makefile b/Makefile |
2 | index c62b531d5a85..cd374426114a 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 6 |
8 | -SUBLEVEL = 3 |
9 | +SUBLEVEL = 4 |
10 | EXTRAVERSION = |
11 | NAME = Charred Weasel |
12 | |
13 | diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c |
14 | index 43fe85f20d57..7097a3395b25 100644 |
15 | --- a/crypto/crypto_user.c |
16 | +++ b/crypto/crypto_user.c |
17 | @@ -455,6 +455,7 @@ static const int crypto_msg_min[CRYPTO_NR_MSGTYPES] = { |
18 | [CRYPTO_MSG_NEWALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), |
19 | [CRYPTO_MSG_DELALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), |
20 | [CRYPTO_MSG_UPDATEALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), |
21 | + [CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), |
22 | [CRYPTO_MSG_DELRNG - CRYPTO_MSG_BASE] = 0, |
23 | }; |
24 | |
25 | diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c |
26 | index 574e87c7f2b8..9acccad26928 100644 |
27 | --- a/drivers/crypto/ux500/hash/hash_core.c |
28 | +++ b/drivers/crypto/ux500/hash/hash_core.c |
29 | @@ -781,7 +781,7 @@ static int hash_process_data(struct hash_device_data *device_data, |
30 | &device_data->state); |
31 | memmove(req_ctx->state.buffer, |
32 | device_data->state.buffer, |
33 | - HASH_BLOCK_SIZE / sizeof(u32)); |
34 | + HASH_BLOCK_SIZE); |
35 | if (ret) { |
36 | dev_err(device_data->dev, |
37 | "%s: hash_resume_state() failed!\n", |
38 | @@ -832,7 +832,7 @@ static int hash_process_data(struct hash_device_data *device_data, |
39 | |
40 | memmove(device_data->state.buffer, |
41 | req_ctx->state.buffer, |
42 | - HASH_BLOCK_SIZE / sizeof(u32)); |
43 | + HASH_BLOCK_SIZE); |
44 | if (ret) { |
45 | dev_err(device_data->dev, "%s: hash_save_state() failed!\n", |
46 | __func__); |
47 | diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c |
48 | index 495577b6d31b..94ad5c0adbcb 100644 |
49 | --- a/drivers/crypto/vmx/aes_cbc.c |
50 | +++ b/drivers/crypto/vmx/aes_cbc.c |
51 | @@ -182,7 +182,7 @@ struct crypto_alg p8_aes_cbc_alg = { |
52 | .cra_name = "cbc(aes)", |
53 | .cra_driver_name = "p8_aes_cbc", |
54 | .cra_module = THIS_MODULE, |
55 | - .cra_priority = 1000, |
56 | + .cra_priority = 2000, |
57 | .cra_type = &crypto_blkcipher_type, |
58 | .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK, |
59 | .cra_alignmask = 0, |
60 | diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c |
61 | index 0a3c1b04cf3c..38ed10d761d0 100644 |
62 | --- a/drivers/crypto/vmx/aes_ctr.c |
63 | +++ b/drivers/crypto/vmx/aes_ctr.c |
64 | @@ -166,7 +166,7 @@ struct crypto_alg p8_aes_ctr_alg = { |
65 | .cra_name = "ctr(aes)", |
66 | .cra_driver_name = "p8_aes_ctr", |
67 | .cra_module = THIS_MODULE, |
68 | - .cra_priority = 1000, |
69 | + .cra_priority = 2000, |
70 | .cra_type = &crypto_blkcipher_type, |
71 | .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK, |
72 | .cra_alignmask = 0, |
73 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c |
74 | index 6dc810bce295..944a6dca0fcb 100644 |
75 | --- a/drivers/usb/core/quirks.c |
76 | +++ b/drivers/usb/core/quirks.c |
77 | @@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = { |
78 | /* Creative SB Audigy 2 NX */ |
79 | { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME }, |
80 | |
81 | + /* USB3503 */ |
82 | + { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME }, |
83 | + |
84 | /* Microsoft Wireless Laser Mouse 6000 Receiver */ |
85 | { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME }, |
86 | |
87 | @@ -173,6 +176,10 @@ static const struct usb_device_id usb_quirk_list[] = { |
88 | /* MAYA44USB sound device */ |
89 | { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME }, |
90 | |
91 | + /* ASUS Base Station(T100) */ |
92 | + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = |
93 | + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, |
94 | + |
95 | /* Action Semiconductor flash disk */ |
96 | { USB_DEVICE(0x10d6, 0x2200), .driver_info = |
97 | USB_QUIRK_STRING_FETCH_255 }, |
98 | @@ -188,26 +195,22 @@ static const struct usb_device_id usb_quirk_list[] = { |
99 | { USB_DEVICE(0x1908, 0x1315), .driver_info = |
100 | USB_QUIRK_HONOR_BNUMINTERFACES }, |
101 | |
102 | - /* INTEL VALUE SSD */ |
103 | - { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, |
104 | - |
105 | - /* USB3503 */ |
106 | - { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME }, |
107 | - |
108 | - /* ASUS Base Station(T100) */ |
109 | - { USB_DEVICE(0x0b05, 0x17e0), .driver_info = |
110 | - USB_QUIRK_IGNORE_REMOTE_WAKEUP }, |
111 | - |
112 | /* Protocol and OTG Electrical Test Device */ |
113 | { USB_DEVICE(0x1a0a, 0x0200), .driver_info = |
114 | USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, |
115 | |
116 | + /* Acer C120 LED Projector */ |
117 | + { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM }, |
118 | + |
119 | /* Blackmagic Design Intensity Shuttle */ |
120 | { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM }, |
121 | |
122 | /* Blackmagic Design UltraStudio SDI */ |
123 | { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, |
124 | |
125 | + /* INTEL VALUE SSD */ |
126 | + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, |
127 | + |
128 | { } /* terminating entry must be last */ |
129 | }; |
130 | |
131 | diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c |
132 | index dd5cb5577dca..2f1fb7e7aa54 100644 |
133 | --- a/drivers/usb/dwc3/dwc3-exynos.c |
134 | +++ b/drivers/usb/dwc3/dwc3-exynos.c |
135 | @@ -128,12 +128,6 @@ static int dwc3_exynos_probe(struct platform_device *pdev) |
136 | |
137 | platform_set_drvdata(pdev, exynos); |
138 | |
139 | - ret = dwc3_exynos_register_phys(exynos); |
140 | - if (ret) { |
141 | - dev_err(dev, "couldn't register PHYs\n"); |
142 | - return ret; |
143 | - } |
144 | - |
145 | exynos->dev = dev; |
146 | |
147 | exynos->clk = devm_clk_get(dev, "usbdrd30"); |
148 | @@ -183,20 +177,29 @@ static int dwc3_exynos_probe(struct platform_device *pdev) |
149 | goto err3; |
150 | } |
151 | |
152 | + ret = dwc3_exynos_register_phys(exynos); |
153 | + if (ret) { |
154 | + dev_err(dev, "couldn't register PHYs\n"); |
155 | + goto err4; |
156 | + } |
157 | + |
158 | if (node) { |
159 | ret = of_platform_populate(node, NULL, NULL, dev); |
160 | if (ret) { |
161 | dev_err(dev, "failed to add dwc3 core\n"); |
162 | - goto err4; |
163 | + goto err5; |
164 | } |
165 | } else { |
166 | dev_err(dev, "no device node, failed to add dwc3 core\n"); |
167 | ret = -ENODEV; |
168 | - goto err4; |
169 | + goto err5; |
170 | } |
171 | |
172 | return 0; |
173 | |
174 | +err5: |
175 | + platform_device_unregister(exynos->usb2_phy); |
176 | + platform_device_unregister(exynos->usb3_phy); |
177 | err4: |
178 | regulator_disable(exynos->vdd10); |
179 | err3: |
180 | diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c |
181 | index e64479f882a5..aa3707bdebb4 100644 |
182 | --- a/drivers/usb/gadget/legacy/inode.c |
183 | +++ b/drivers/usb/gadget/legacy/inode.c |
184 | @@ -938,8 +938,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) |
185 | struct usb_ep *ep = dev->gadget->ep0; |
186 | struct usb_request *req = dev->req; |
187 | |
188 | - if ((retval = setup_req (ep, req, 0)) == 0) |
189 | - retval = usb_ep_queue (ep, req, GFP_ATOMIC); |
190 | + if ((retval = setup_req (ep, req, 0)) == 0) { |
191 | + spin_unlock_irq (&dev->lock); |
192 | + retval = usb_ep_queue (ep, req, GFP_KERNEL); |
193 | + spin_lock_irq (&dev->lock); |
194 | + } |
195 | dev->state = STATE_DEV_CONNECTED; |
196 | |
197 | /* assume that was SET_CONFIGURATION */ |
198 | @@ -1457,8 +1460,11 @@ delegate: |
199 | w_length); |
200 | if (value < 0) |
201 | break; |
202 | + |
203 | + spin_unlock (&dev->lock); |
204 | value = usb_ep_queue (gadget->ep0, dev->req, |
205 | - GFP_ATOMIC); |
206 | + GFP_KERNEL); |
207 | + spin_lock (&dev->lock); |
208 | if (value < 0) { |
209 | clean_req (gadget->ep0, dev->req); |
210 | break; |
211 | @@ -1481,11 +1487,14 @@ delegate: |
212 | if (value >= 0 && dev->state != STATE_DEV_SETUP) { |
213 | req->length = value; |
214 | req->zero = value < w_length; |
215 | - value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC); |
216 | + |
217 | + spin_unlock (&dev->lock); |
218 | + value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); |
219 | if (value < 0) { |
220 | DBG (dev, "ep_queue --> %d\n", value); |
221 | req->status = 0; |
222 | } |
223 | + return value; |
224 | } |
225 | |
226 | /* device stalls when value < 0 */ |
227 | diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c |
228 | index 4031b372008e..c1c1024a054c 100644 |
229 | --- a/drivers/usb/host/ehci-tegra.c |
230 | +++ b/drivers/usb/host/ehci-tegra.c |
231 | @@ -89,7 +89,7 @@ static int tegra_reset_usb_controller(struct platform_device *pdev) |
232 | if (!usb1_reset_attempted) { |
233 | struct reset_control *usb1_reset; |
234 | |
235 | - usb1_reset = of_reset_control_get(phy_np, "usb"); |
236 | + usb1_reset = of_reset_control_get(phy_np, "utmi-pads"); |
237 | if (IS_ERR(usb1_reset)) { |
238 | dev_warn(&pdev->dev, |
239 | "can't get utmi-pads reset from the PHY\n"); |
240 | diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c |
241 | index 48672fac7ff3..c10972fcc8e4 100644 |
242 | --- a/drivers/usb/host/xhci-pci.c |
243 | +++ b/drivers/usb/host/xhci-pci.c |
244 | @@ -37,6 +37,7 @@ |
245 | /* Device for a quirk */ |
246 | #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 |
247 | #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000 |
248 | +#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009 |
249 | #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400 |
250 | |
251 | #define PCI_VENDOR_ID_ETRON 0x1b6f |
252 | @@ -114,6 +115,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
253 | xhci->quirks |= XHCI_TRUST_TX_LENGTH; |
254 | } |
255 | |
256 | + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && |
257 | + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009) |
258 | + xhci->quirks |= XHCI_BROKEN_STREAMS; |
259 | + |
260 | if (pdev->vendor == PCI_VENDOR_ID_NEC) |
261 | xhci->quirks |= XHCI_NEC_HOST; |
262 | |
263 | diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c |
264 | index 474b5fa14900..d6e2b2751e50 100644 |
265 | --- a/drivers/usb/host/xhci-plat.c |
266 | +++ b/drivers/usb/host/xhci-plat.c |
267 | @@ -194,6 +194,9 @@ static int xhci_plat_probe(struct platform_device *pdev) |
268 | ret = clk_prepare_enable(clk); |
269 | if (ret) |
270 | goto put_hcd; |
271 | + } else if (PTR_ERR(clk) == -EPROBE_DEFER) { |
272 | + ret = -EPROBE_DEFER; |
273 | + goto put_hcd; |
274 | } |
275 | |
276 | xhci = hcd_to_xhci(hcd); |
277 | diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c |
278 | index 99b4ff42f7a0..8b5b2aca277d 100644 |
279 | --- a/drivers/usb/host/xhci-ring.c |
280 | +++ b/drivers/usb/host/xhci-ring.c |
281 | @@ -290,6 +290,14 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci) |
282 | |
283 | temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring); |
284 | xhci->cmd_ring_state = CMD_RING_STATE_ABORTED; |
285 | + |
286 | + /* |
287 | + * Writing the CMD_RING_ABORT bit should cause a cmd completion event, |
288 | + * however on some host hw the CMD_RING_RUNNING bit is correctly cleared |
289 | + * but the completion event in never sent. Use the cmd timeout timer to |
290 | + * handle those cases. Use twice the time to cover the bit polling retry |
291 | + */ |
292 | + mod_timer(&xhci->cmd_timer, jiffies + (2 * XHCI_CMD_DEFAULT_TIMEOUT)); |
293 | xhci_write_64(xhci, temp_64 | CMD_RING_ABORT, |
294 | &xhci->op_regs->cmd_ring); |
295 | |
296 | @@ -314,6 +322,7 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci) |
297 | |
298 | xhci_err(xhci, "Stopped the command ring failed, " |
299 | "maybe the host is dead\n"); |
300 | + del_timer(&xhci->cmd_timer); |
301 | xhci->xhc_state |= XHCI_STATE_DYING; |
302 | xhci_quiesce(xhci); |
303 | xhci_halt(xhci); |
304 | @@ -1253,22 +1262,21 @@ void xhci_handle_command_timeout(unsigned long data) |
305 | int ret; |
306 | unsigned long flags; |
307 | u64 hw_ring_state; |
308 | - struct xhci_command *cur_cmd = NULL; |
309 | + bool second_timeout = false; |
310 | xhci = (struct xhci_hcd *) data; |
311 | |
312 | /* mark this command to be cancelled */ |
313 | spin_lock_irqsave(&xhci->lock, flags); |
314 | if (xhci->current_cmd) { |
315 | - cur_cmd = xhci->current_cmd; |
316 | - cur_cmd->status = COMP_CMD_ABORT; |
317 | + if (xhci->current_cmd->status == COMP_CMD_ABORT) |
318 | + second_timeout = true; |
319 | + xhci->current_cmd->status = COMP_CMD_ABORT; |
320 | } |
321 | |
322 | - |
323 | /* Make sure command ring is running before aborting it */ |
324 | hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring); |
325 | if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) && |
326 | (hw_ring_state & CMD_RING_RUNNING)) { |
327 | - |
328 | spin_unlock_irqrestore(&xhci->lock, flags); |
329 | xhci_dbg(xhci, "Command timeout\n"); |
330 | ret = xhci_abort_cmd_ring(xhci); |
331 | @@ -1280,6 +1288,15 @@ void xhci_handle_command_timeout(unsigned long data) |
332 | } |
333 | return; |
334 | } |
335 | + |
336 | + /* command ring failed to restart, or host removed. Bail out */ |
337 | + if (second_timeout || xhci->xhc_state & XHCI_STATE_REMOVING) { |
338 | + spin_unlock_irqrestore(&xhci->lock, flags); |
339 | + xhci_dbg(xhci, "command timed out twice, ring start fail?\n"); |
340 | + xhci_cleanup_command_queue(xhci); |
341 | + return; |
342 | + } |
343 | + |
344 | /* command timeout on stopped ring, ring can't be aborted */ |
345 | xhci_dbg(xhci, "Command timeout on stopped ring\n"); |
346 | xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd); |
347 | @@ -2728,7 +2745,8 @@ hw_died: |
348 | writel(irq_pending, &xhci->ir_set->irq_pending); |
349 | } |
350 | |
351 | - if (xhci->xhc_state & XHCI_STATE_DYING) { |
352 | + if (xhci->xhc_state & XHCI_STATE_DYING || |
353 | + xhci->xhc_state & XHCI_STATE_HALTED) { |
354 | xhci_dbg(xhci, "xHCI dying, ignoring interrupt. " |
355 | "Shouldn't IRQs be disabled?\n"); |
356 | /* Clear the event handler busy flag (RW1C); |
357 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c |
358 | index 9e71c96ad74a..327280535848 100644 |
359 | --- a/drivers/usb/host/xhci.c |
360 | +++ b/drivers/usb/host/xhci.c |
361 | @@ -685,20 +685,23 @@ void xhci_stop(struct usb_hcd *hcd) |
362 | u32 temp; |
363 | struct xhci_hcd *xhci = hcd_to_xhci(hcd); |
364 | |
365 | - if (xhci->xhc_state & XHCI_STATE_HALTED) |
366 | - return; |
367 | - |
368 | mutex_lock(&xhci->mutex); |
369 | - spin_lock_irq(&xhci->lock); |
370 | - xhci->xhc_state |= XHCI_STATE_HALTED; |
371 | - xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; |
372 | |
373 | - /* Make sure the xHC is halted for a USB3 roothub |
374 | - * (xhci_stop() could be called as part of failed init). |
375 | - */ |
376 | - xhci_halt(xhci); |
377 | - xhci_reset(xhci); |
378 | - spin_unlock_irq(&xhci->lock); |
379 | + if (!(xhci->xhc_state & XHCI_STATE_HALTED)) { |
380 | + spin_lock_irq(&xhci->lock); |
381 | + |
382 | + xhci->xhc_state |= XHCI_STATE_HALTED; |
383 | + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; |
384 | + xhci_halt(xhci); |
385 | + xhci_reset(xhci); |
386 | + |
387 | + spin_unlock_irq(&xhci->lock); |
388 | + } |
389 | + |
390 | + if (!usb_hcd_is_primary_hcd(hcd)) { |
391 | + mutex_unlock(&xhci->mutex); |
392 | + return; |
393 | + } |
394 | |
395 | xhci_cleanup_msix(xhci); |
396 | |
397 | diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c |
398 | index 39fd95833eb8..c84f4d0816e5 100644 |
399 | --- a/drivers/usb/musb/musb_core.c |
400 | +++ b/drivers/usb/musb/musb_core.c |
401 | @@ -2429,7 +2429,8 @@ static void musb_restore_context(struct musb *musb) |
402 | musb_writew(musb_base, MUSB_INTRTXE, musb->intrtxe); |
403 | musb_writew(musb_base, MUSB_INTRRXE, musb->intrrxe); |
404 | musb_writeb(musb_base, MUSB_INTRUSBE, musb->context.intrusbe); |
405 | - musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl); |
406 | + if (musb->context.devctl & MUSB_DEVCTL_SESSION) |
407 | + musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl); |
408 | |
409 | for (i = 0; i < musb->config->num_eps; ++i) { |
410 | struct musb_hw_ep *hw_ep; |
411 | diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c |
412 | index 2f8ad7f1f482..8ff03228540a 100644 |
413 | --- a/drivers/usb/musb/musb_host.c |
414 | +++ b/drivers/usb/musb/musb_host.c |
415 | @@ -594,14 +594,13 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, u8 epnum) |
416 | musb_writew(ep->regs, MUSB_TXCSR, 0); |
417 | |
418 | /* scrub all previous state, clearing toggle */ |
419 | - } else { |
420 | - csr = musb_readw(ep->regs, MUSB_RXCSR); |
421 | - if (csr & MUSB_RXCSR_RXPKTRDY) |
422 | - WARNING("rx%d, packet/%d ready?\n", ep->epnum, |
423 | - musb_readw(ep->regs, MUSB_RXCOUNT)); |
424 | - |
425 | - musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG); |
426 | } |
427 | + csr = musb_readw(ep->regs, MUSB_RXCSR); |
428 | + if (csr & MUSB_RXCSR_RXPKTRDY) |
429 | + WARNING("rx%d, packet/%d ready?\n", ep->epnum, |
430 | + musb_readw(ep->regs, MUSB_RXCOUNT)); |
431 | + |
432 | + musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG); |
433 | |
434 | /* target addr and (for multipoint) hub addr/port */ |
435 | if (musb->is_multipoint) { |
436 | @@ -995,9 +994,15 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep, |
437 | if (is_in) { |
438 | dma = is_dma_capable() ? ep->rx_channel : NULL; |
439 | |
440 | - /* clear nak timeout bit */ |
441 | + /* |
442 | + * Need to stop the transaction by clearing REQPKT first |
443 | + * then the NAK Timeout bit ref MUSBMHDRC USB 2.0 HIGH-SPEED |
444 | + * DUAL-ROLE CONTROLLER Programmer's Guide, section 9.2.2 |
445 | + */ |
446 | rx_csr = musb_readw(epio, MUSB_RXCSR); |
447 | rx_csr |= MUSB_RXCSR_H_WZC_BITS; |
448 | + rx_csr &= ~MUSB_RXCSR_H_REQPKT; |
449 | + musb_writew(epio, MUSB_RXCSR, rx_csr); |
450 | rx_csr &= ~MUSB_RXCSR_DATAERROR; |
451 | musb_writew(epio, MUSB_RXCSR, rx_csr); |
452 | |
453 | @@ -1551,7 +1556,7 @@ static int musb_rx_dma_iso_cppi41(struct dma_controller *dma, |
454 | struct urb *urb, |
455 | size_t len) |
456 | { |
457 | - struct dma_channel *channel = hw_ep->tx_channel; |
458 | + struct dma_channel *channel = hw_ep->rx_channel; |
459 | void __iomem *epio = hw_ep->regs; |
460 | dma_addr_t *buf; |
461 | u32 length, res; |
462 | diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c |
463 | index 2eddbe538cda..5608af4a369d 100644 |
464 | --- a/drivers/usb/serial/mos7720.c |
465 | +++ b/drivers/usb/serial/mos7720.c |
466 | @@ -2007,6 +2007,7 @@ static void mos7720_release(struct usb_serial *serial) |
467 | urblist_entry) |
468 | usb_unlink_urb(urbtrack->urb); |
469 | spin_unlock_irqrestore(&mos_parport->listlock, flags); |
470 | + parport_del_port(mos_parport->pp); |
471 | |
472 | kref_put(&mos_parport->ref_count, destroy_mos_parport); |
473 | } |
474 | diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c |
475 | index 16bc679dc2fc..ecc7d4b1dfa3 100644 |
476 | --- a/drivers/usb/storage/uas.c |
477 | +++ b/drivers/usb/storage/uas.c |
478 | @@ -835,6 +835,7 @@ static int uas_slave_configure(struct scsi_device *sdev) |
479 | if (devinfo->flags & US_FL_BROKEN_FUA) |
480 | sdev->broken_fua = 1; |
481 | |
482 | + scsi_change_queue_depth(sdev, devinfo->qdepth - 2); |
483 | return 0; |
484 | } |
485 | |
486 | diff --git a/include/linux/bpf.h b/include/linux/bpf.h |
487 | index f1d5c5acc8dd..ca80d5830bfd 100644 |
488 | --- a/include/linux/bpf.h |
489 | +++ b/include/linux/bpf.h |
490 | @@ -229,6 +229,10 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd) |
491 | static inline void bpf_prog_put(struct bpf_prog *prog) |
492 | { |
493 | } |
494 | + |
495 | +static inline void bpf_prog_put_rcu(struct bpf_prog *prog) |
496 | +{ |
497 | +} |
498 | #endif /* CONFIG_BPF_SYSCALL */ |
499 | |
500 | /* verifier prototypes for helper functions called from eBPF programs */ |
501 | diff --git a/include/linux/net.h b/include/linux/net.h |
502 | index f840d77c6c31..9d90efe6a708 100644 |
503 | --- a/include/linux/net.h |
504 | +++ b/include/linux/net.h |
505 | @@ -252,7 +252,8 @@ do { \ |
506 | DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \ |
507 | if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) && \ |
508 | net_ratelimit()) \ |
509 | - __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__); \ |
510 | + __dynamic_pr_debug(&descriptor, pr_fmt(fmt), \ |
511 | + ##__VA_ARGS__); \ |
512 | } while (0) |
513 | #elif defined(DEBUG) |
514 | #define net_dbg_ratelimited(fmt, ...) \ |
515 | diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h |
516 | index 4018b48f2b3b..a0596ca0e80a 100644 |
517 | --- a/include/linux/sock_diag.h |
518 | +++ b/include/linux/sock_diag.h |
519 | @@ -36,6 +36,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk) |
520 | { |
521 | switch (sk->sk_family) { |
522 | case AF_INET: |
523 | + if (sk->sk_type == SOCK_RAW) |
524 | + return SKNLGRP_NONE; |
525 | + |
526 | switch (sk->sk_protocol) { |
527 | case IPPROTO_TCP: |
528 | return SKNLGRP_INET_TCP_DESTROY; |
529 | @@ -45,6 +48,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk) |
530 | return SKNLGRP_NONE; |
531 | } |
532 | case AF_INET6: |
533 | + if (sk->sk_type == SOCK_RAW) |
534 | + return SKNLGRP_NONE; |
535 | + |
536 | switch (sk->sk_protocol) { |
537 | case IPPROTO_TCP: |
538 | return SKNLGRP_INET6_TCP_DESTROY; |
539 | diff --git a/kernel/events/core.c b/kernel/events/core.c |
540 | index c0ded2416615..a69c90cea05d 100644 |
541 | --- a/kernel/events/core.c |
542 | +++ b/kernel/events/core.c |
543 | @@ -7143,7 +7143,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) |
544 | prog = event->tp_event->prog; |
545 | if (prog) { |
546 | event->tp_event->prog = NULL; |
547 | - bpf_prog_put(prog); |
548 | + bpf_prog_put_rcu(prog); |
549 | } |
550 | } |
551 | |
552 | diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c |
553 | index fbd0acf80b13..2fdebabbfacd 100644 |
554 | --- a/net/ax25/af_ax25.c |
555 | +++ b/net/ax25/af_ax25.c |
556 | @@ -976,7 +976,8 @@ static int ax25_release(struct socket *sock) |
557 | release_sock(sk); |
558 | ax25_disconnect(ax25, 0); |
559 | lock_sock(sk); |
560 | - ax25_destroy_socket(ax25); |
561 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) |
562 | + ax25_destroy_socket(ax25); |
563 | break; |
564 | |
565 | case AX25_STATE_3: |
566 | diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c |
567 | index 951cd57bb07d..5237dff6941d 100644 |
568 | --- a/net/ax25/ax25_ds_timer.c |
569 | +++ b/net/ax25/ax25_ds_timer.c |
570 | @@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25) |
571 | switch (ax25->state) { |
572 | |
573 | case AX25_STATE_0: |
574 | + case AX25_STATE_2: |
575 | /* Magic here: If we listen() and a new link dies before it |
576 | is accepted() it isn't 'dead' so doesn't get removed. */ |
577 | if (!sk || sock_flag(sk, SOCK_DESTROY) || |
578 | @@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25) |
579 | sock_hold(sk); |
580 | ax25_destroy_socket(ax25); |
581 | bh_unlock_sock(sk); |
582 | + /* Ungrab socket and destroy it */ |
583 | sock_put(sk); |
584 | } else |
585 | ax25_destroy_socket(ax25); |
586 | @@ -213,7 +215,8 @@ void ax25_ds_t1_timeout(ax25_cb *ax25) |
587 | case AX25_STATE_2: |
588 | if (ax25->n2count == ax25->n2) { |
589 | ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND); |
590 | - ax25_disconnect(ax25, ETIMEDOUT); |
591 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) |
592 | + ax25_disconnect(ax25, ETIMEDOUT); |
593 | return; |
594 | } else { |
595 | ax25->n2count++; |
596 | diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c |
597 | index 004467c9e6e1..2c0d6ef66f9d 100644 |
598 | --- a/net/ax25/ax25_std_timer.c |
599 | +++ b/net/ax25/ax25_std_timer.c |
600 | @@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25) |
601 | |
602 | switch (ax25->state) { |
603 | case AX25_STATE_0: |
604 | + case AX25_STATE_2: |
605 | /* Magic here: If we listen() and a new link dies before it |
606 | is accepted() it isn't 'dead' so doesn't get removed. */ |
607 | if (!sk || sock_flag(sk, SOCK_DESTROY) || |
608 | @@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25) |
609 | sock_hold(sk); |
610 | ax25_destroy_socket(ax25); |
611 | bh_unlock_sock(sk); |
612 | + /* Ungrab socket and destroy it */ |
613 | sock_put(sk); |
614 | } else |
615 | ax25_destroy_socket(ax25); |
616 | @@ -144,7 +146,8 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25) |
617 | case AX25_STATE_2: |
618 | if (ax25->n2count == ax25->n2) { |
619 | ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND); |
620 | - ax25_disconnect(ax25, ETIMEDOUT); |
621 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) |
622 | + ax25_disconnect(ax25, ETIMEDOUT); |
623 | return; |
624 | } else { |
625 | ax25->n2count++; |
626 | diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c |
627 | index 3b78e8473a01..655a7d4c96e1 100644 |
628 | --- a/net/ax25/ax25_subr.c |
629 | +++ b/net/ax25/ax25_subr.c |
630 | @@ -264,7 +264,8 @@ void ax25_disconnect(ax25_cb *ax25, int reason) |
631 | { |
632 | ax25_clear_queues(ax25); |
633 | |
634 | - ax25_stop_heartbeat(ax25); |
635 | + if (!sock_flag(ax25->sk, SOCK_DESTROY)) |
636 | + ax25_stop_heartbeat(ax25); |
637 | ax25_stop_t1timer(ax25); |
638 | ax25_stop_t2timer(ax25); |
639 | ax25_stop_t3timer(ax25); |
640 | diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c |
641 | index 6852f3c7009c..43844144c9c4 100644 |
642 | --- a/net/bridge/br_multicast.c |
643 | +++ b/net/bridge/br_multicast.c |
644 | @@ -464,8 +464,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br, |
645 | if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, |
646 | &ip6h->saddr)) { |
647 | kfree_skb(skb); |
648 | + br->has_ipv6_addr = 0; |
649 | return NULL; |
650 | } |
651 | + |
652 | + br->has_ipv6_addr = 1; |
653 | ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); |
654 | |
655 | hopopt = (u8 *)(ip6h + 1); |
656 | @@ -1745,6 +1748,7 @@ void br_multicast_init(struct net_bridge *br) |
657 | br->ip6_other_query.delay_time = 0; |
658 | br->ip6_querier.port = NULL; |
659 | #endif |
660 | + br->has_ipv6_addr = 1; |
661 | |
662 | spin_lock_init(&br->multicast_lock); |
663 | setup_timer(&br->multicast_router_timer, |
664 | diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h |
665 | index d9da857182ef..f516c53bafb6 100644 |
666 | --- a/net/bridge/br_private.h |
667 | +++ b/net/bridge/br_private.h |
668 | @@ -304,6 +304,7 @@ struct net_bridge |
669 | u8 multicast_disabled:1; |
670 | u8 multicast_querier:1; |
671 | u8 multicast_query_use_ifaddr:1; |
672 | + u8 has_ipv6_addr:1; |
673 | |
674 | u32 hash_elasticity; |
675 | u32 hash_max; |
676 | @@ -577,10 +578,22 @@ static inline bool br_multicast_is_router(struct net_bridge *br) |
677 | |
678 | static inline bool |
679 | __br_multicast_querier_exists(struct net_bridge *br, |
680 | - struct bridge_mcast_other_query *querier) |
681 | + struct bridge_mcast_other_query *querier, |
682 | + const bool is_ipv6) |
683 | { |
684 | + bool own_querier_enabled; |
685 | + |
686 | + if (br->multicast_querier) { |
687 | + if (is_ipv6 && !br->has_ipv6_addr) |
688 | + own_querier_enabled = false; |
689 | + else |
690 | + own_querier_enabled = true; |
691 | + } else { |
692 | + own_querier_enabled = false; |
693 | + } |
694 | + |
695 | return time_is_before_jiffies(querier->delay_time) && |
696 | - (br->multicast_querier || timer_pending(&querier->timer)); |
697 | + (own_querier_enabled || timer_pending(&querier->timer)); |
698 | } |
699 | |
700 | static inline bool br_multicast_querier_exists(struct net_bridge *br, |
701 | @@ -588,10 +601,12 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br, |
702 | { |
703 | switch (eth->h_proto) { |
704 | case (htons(ETH_P_IP)): |
705 | - return __br_multicast_querier_exists(br, &br->ip4_other_query); |
706 | + return __br_multicast_querier_exists(br, |
707 | + &br->ip4_other_query, false); |
708 | #if IS_ENABLED(CONFIG_IPV6) |
709 | case (htons(ETH_P_IPV6)): |
710 | - return __br_multicast_querier_exists(br, &br->ip6_other_query); |
711 | + return __br_multicast_querier_exists(br, |
712 | + &br->ip6_other_query, true); |
713 | #endif |
714 | default: |
715 | return false; |
716 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c |
717 | index f18ae91b652e..769cece9b00b 100644 |
718 | --- a/net/core/neighbour.c |
719 | +++ b/net/core/neighbour.c |
720 | @@ -2467,13 +2467,17 @@ int neigh_xmit(int index, struct net_device *dev, |
721 | tbl = neigh_tables[index]; |
722 | if (!tbl) |
723 | goto out; |
724 | + rcu_read_lock_bh(); |
725 | neigh = __neigh_lookup_noref(tbl, addr, dev); |
726 | if (!neigh) |
727 | neigh = __neigh_create(tbl, addr, dev, false); |
728 | err = PTR_ERR(neigh); |
729 | - if (IS_ERR(neigh)) |
730 | + if (IS_ERR(neigh)) { |
731 | + rcu_read_unlock_bh(); |
732 | goto out_kfree_skb; |
733 | + } |
734 | err = neigh->output(neigh, skb); |
735 | + rcu_read_unlock_bh(); |
736 | } |
737 | else if (index == NEIGH_LINK_TABLE) { |
738 | err = dev_hard_header(skb, dev, ntohs(skb->protocol), |
739 | diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c |
740 | index 477937465a20..d95631d09248 100644 |
741 | --- a/net/ipv4/esp4.c |
742 | +++ b/net/ipv4/esp4.c |
743 | @@ -23,6 +23,11 @@ struct esp_skb_cb { |
744 | void *tmp; |
745 | }; |
746 | |
747 | +struct esp_output_extra { |
748 | + __be32 seqhi; |
749 | + u32 esphoff; |
750 | +}; |
751 | + |
752 | #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0])) |
753 | |
754 | static u32 esp4_get_mtu(struct xfrm_state *x, int mtu); |
755 | @@ -35,11 +40,11 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu); |
756 | * |
757 | * TODO: Use spare space in skb for this where possible. |
758 | */ |
759 | -static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen) |
760 | +static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int extralen) |
761 | { |
762 | unsigned int len; |
763 | |
764 | - len = seqhilen; |
765 | + len = extralen; |
766 | |
767 | len += crypto_aead_ivsize(aead); |
768 | |
769 | @@ -57,15 +62,16 @@ static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen) |
770 | return kmalloc(len, GFP_ATOMIC); |
771 | } |
772 | |
773 | -static inline __be32 *esp_tmp_seqhi(void *tmp) |
774 | +static inline void *esp_tmp_extra(void *tmp) |
775 | { |
776 | - return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32)); |
777 | + return PTR_ALIGN(tmp, __alignof__(struct esp_output_extra)); |
778 | } |
779 | -static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen) |
780 | + |
781 | +static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int extralen) |
782 | { |
783 | return crypto_aead_ivsize(aead) ? |
784 | - PTR_ALIGN((u8 *)tmp + seqhilen, |
785 | - crypto_aead_alignmask(aead) + 1) : tmp + seqhilen; |
786 | + PTR_ALIGN((u8 *)tmp + extralen, |
787 | + crypto_aead_alignmask(aead) + 1) : tmp + extralen; |
788 | } |
789 | |
790 | static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv) |
791 | @@ -99,7 +105,7 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset) |
792 | { |
793 | struct ip_esp_hdr *esph = (void *)(skb->data + offset); |
794 | void *tmp = ESP_SKB_CB(skb)->tmp; |
795 | - __be32 *seqhi = esp_tmp_seqhi(tmp); |
796 | + __be32 *seqhi = esp_tmp_extra(tmp); |
797 | |
798 | esph->seq_no = esph->spi; |
799 | esph->spi = *seqhi; |
800 | @@ -107,7 +113,11 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset) |
801 | |
802 | static void esp_output_restore_header(struct sk_buff *skb) |
803 | { |
804 | - esp_restore_header(skb, skb_transport_offset(skb) - sizeof(__be32)); |
805 | + void *tmp = ESP_SKB_CB(skb)->tmp; |
806 | + struct esp_output_extra *extra = esp_tmp_extra(tmp); |
807 | + |
808 | + esp_restore_header(skb, skb_transport_offset(skb) + extra->esphoff - |
809 | + sizeof(__be32)); |
810 | } |
811 | |
812 | static void esp_output_done_esn(struct crypto_async_request *base, int err) |
813 | @@ -121,6 +131,7 @@ static void esp_output_done_esn(struct crypto_async_request *base, int err) |
814 | static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
815 | { |
816 | int err; |
817 | + struct esp_output_extra *extra; |
818 | struct ip_esp_hdr *esph; |
819 | struct crypto_aead *aead; |
820 | struct aead_request *req; |
821 | @@ -137,8 +148,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
822 | int tfclen; |
823 | int nfrags; |
824 | int assoclen; |
825 | - int seqhilen; |
826 | - __be32 *seqhi; |
827 | + int extralen; |
828 | __be64 seqno; |
829 | |
830 | /* skb is pure payload to encrypt */ |
831 | @@ -166,21 +176,21 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
832 | nfrags = err; |
833 | |
834 | assoclen = sizeof(*esph); |
835 | - seqhilen = 0; |
836 | + extralen = 0; |
837 | |
838 | if (x->props.flags & XFRM_STATE_ESN) { |
839 | - seqhilen += sizeof(__be32); |
840 | - assoclen += seqhilen; |
841 | + extralen += sizeof(*extra); |
842 | + assoclen += sizeof(__be32); |
843 | } |
844 | |
845 | - tmp = esp_alloc_tmp(aead, nfrags, seqhilen); |
846 | + tmp = esp_alloc_tmp(aead, nfrags, extralen); |
847 | if (!tmp) { |
848 | err = -ENOMEM; |
849 | goto error; |
850 | } |
851 | |
852 | - seqhi = esp_tmp_seqhi(tmp); |
853 | - iv = esp_tmp_iv(aead, tmp, seqhilen); |
854 | + extra = esp_tmp_extra(tmp); |
855 | + iv = esp_tmp_iv(aead, tmp, extralen); |
856 | req = esp_tmp_req(aead, iv); |
857 | sg = esp_req_sg(aead, req); |
858 | |
859 | @@ -247,8 +257,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
860 | * encryption. |
861 | */ |
862 | if ((x->props.flags & XFRM_STATE_ESN)) { |
863 | - esph = (void *)(skb_transport_header(skb) - sizeof(__be32)); |
864 | - *seqhi = esph->spi; |
865 | + extra->esphoff = (unsigned char *)esph - |
866 | + skb_transport_header(skb); |
867 | + esph = (struct ip_esp_hdr *)((unsigned char *)esph - 4); |
868 | + extra->seqhi = esph->spi; |
869 | esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.hi); |
870 | aead_request_set_callback(req, 0, esp_output_done_esn, skb); |
871 | } |
872 | @@ -445,7 +457,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) |
873 | goto out; |
874 | |
875 | ESP_SKB_CB(skb)->tmp = tmp; |
876 | - seqhi = esp_tmp_seqhi(tmp); |
877 | + seqhi = esp_tmp_extra(tmp); |
878 | iv = esp_tmp_iv(aead, tmp, seqhilen); |
879 | req = esp_tmp_req(aead, iv); |
880 | sg = esp_req_sg(aead, req); |
881 | diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c |
882 | index 395e2814a46d..a42dd8021b6b 100644 |
883 | --- a/net/ipv4/ipmr.c |
884 | +++ b/net/ipv4/ipmr.c |
885 | @@ -891,8 +891,10 @@ static struct mfc_cache *ipmr_cache_alloc(void) |
886 | { |
887 | struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL); |
888 | |
889 | - if (c) |
890 | + if (c) { |
891 | + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1; |
892 | c->mfc_un.res.minvif = MAXVIFS; |
893 | + } |
894 | return c; |
895 | } |
896 | |
897 | diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c |
898 | index a10e77103c88..e207cb2468da 100644 |
899 | --- a/net/ipv6/ip6mr.c |
900 | +++ b/net/ipv6/ip6mr.c |
901 | @@ -1074,6 +1074,7 @@ static struct mfc6_cache *ip6mr_cache_alloc(void) |
902 | struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL); |
903 | if (!c) |
904 | return NULL; |
905 | + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1; |
906 | c->mfc_un.res.minvif = MAXMIFS; |
907 | return c; |
908 | } |
909 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c |
910 | index 83384308d032..6c53e4eb0f09 100644 |
911 | --- a/net/ipv6/sit.c |
912 | +++ b/net/ipv6/sit.c |
913 | @@ -560,13 +560,13 @@ static int ipip6_err(struct sk_buff *skb, u32 info) |
914 | |
915 | if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { |
916 | ipv4_update_pmtu(skb, dev_net(skb->dev), info, |
917 | - t->parms.link, 0, IPPROTO_IPV6, 0); |
918 | + t->parms.link, 0, iph->protocol, 0); |
919 | err = 0; |
920 | goto out; |
921 | } |
922 | if (type == ICMP_REDIRECT) { |
923 | ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, |
924 | - IPPROTO_IPV6, 0); |
925 | + iph->protocol, 0); |
926 | err = 0; |
927 | goto out; |
928 | } |
929 | diff --git a/net/kcm/kcmproc.c b/net/kcm/kcmproc.c |
930 | index 738008726cc6..fda7f4715c58 100644 |
931 | --- a/net/kcm/kcmproc.c |
932 | +++ b/net/kcm/kcmproc.c |
933 | @@ -241,6 +241,7 @@ static const struct file_operations kcm_seq_fops = { |
934 | .open = kcm_seq_open, |
935 | .read = seq_read, |
936 | .llseek = seq_lseek, |
937 | + .release = seq_release_net, |
938 | }; |
939 | |
940 | static struct kcm_seq_muxinfo kcm_seq_muxinfo = { |
941 | diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c |
942 | index 8b5270008a6e..606323339e1f 100644 |
943 | --- a/net/sched/act_ipt.c |
944 | +++ b/net/sched/act_ipt.c |
945 | @@ -121,10 +121,13 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla, |
946 | } |
947 | |
948 | td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]); |
949 | - if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) |
950 | + if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) { |
951 | + if (exists) |
952 | + tcf_hash_release(a, bind); |
953 | return -EINVAL; |
954 | + } |
955 | |
956 | - if (!tcf_hash_check(tn, index, a, bind)) { |
957 | + if (!exists) { |
958 | ret = tcf_hash_create(tn, index, est, a, sizeof(*ipt), bind, |
959 | false); |
960 | if (ret) |
961 | diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c |
962 | index 2177eac0a61e..2e4bd2c0a50c 100644 |
963 | --- a/net/sched/sch_fifo.c |
964 | +++ b/net/sched/sch_fifo.c |
965 | @@ -37,14 +37,18 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch) |
966 | |
967 | static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch) |
968 | { |
969 | + unsigned int prev_backlog; |
970 | + |
971 | if (likely(skb_queue_len(&sch->q) < sch->limit)) |
972 | return qdisc_enqueue_tail(skb, sch); |
973 | |
974 | + prev_backlog = sch->qstats.backlog; |
975 | /* queue full, remove one skb to fulfill the limit */ |
976 | __qdisc_queue_drop_head(sch, &sch->q); |
977 | qdisc_qstats_drop(sch); |
978 | qdisc_enqueue_tail(skb, sch); |
979 | |
980 | + qdisc_tree_reduce_backlog(sch, 0, prev_backlog - sch->qstats.backlog); |
981 | return NET_XMIT_CN; |
982 | } |
983 | |
984 | diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c |
985 | index 4befe97a9034..b7c29d5b6f04 100644 |
986 | --- a/net/sched/sch_netem.c |
987 | +++ b/net/sched/sch_netem.c |
988 | @@ -650,14 +650,14 @@ deliver: |
989 | #endif |
990 | |
991 | if (q->qdisc) { |
992 | + unsigned int pkt_len = qdisc_pkt_len(skb); |
993 | int err = qdisc_enqueue(skb, q->qdisc); |
994 | |
995 | - if (unlikely(err != NET_XMIT_SUCCESS)) { |
996 | - if (net_xmit_drop_count(err)) { |
997 | - qdisc_qstats_drop(sch); |
998 | - qdisc_tree_reduce_backlog(sch, 1, |
999 | - qdisc_pkt_len(skb)); |
1000 | - } |
1001 | + if (err != NET_XMIT_SUCCESS && |
1002 | + net_xmit_drop_count(err)) { |
1003 | + qdisc_qstats_drop(sch); |
1004 | + qdisc_tree_reduce_backlog(sch, 1, |
1005 | + pkt_len); |
1006 | } |
1007 | goto tfifo_dequeue; |
1008 | } |