Contents of /trunk/kernel-magellan/patches-4.8/0114-4.8.15-all-fixes.patch
Parent Directory | Revision Log
Revision 2854 -
(show annotations)
(download)
Fri Jan 6 09:45:27 2017 UTC (7 years, 8 months ago) by niro
File size: 34840 byte(s)
Fri Jan 6 09:45:27 2017 UTC (7 years, 8 months ago) by niro
File size: 34840 byte(s)
-linux-4.8.15
1 | diff --git a/Makefile b/Makefile |
2 | index 6a7492473a0d..c7f0e798ca34 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 8 |
8 | -SUBLEVEL = 14 |
9 | +SUBLEVEL = 15 |
10 | EXTRAVERSION = |
11 | NAME = Psychotic Stoned Sheep |
12 | |
13 | diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi |
14 | index 1e90bdbe3a6e..fb307de5422c 100644 |
15 | --- a/arch/arm/boot/dts/imx7s.dtsi |
16 | +++ b/arch/arm/boot/dts/imx7s.dtsi |
17 | @@ -640,9 +640,8 @@ |
18 | reg = <0x30730000 0x10000>; |
19 | interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>; |
20 | clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>, |
21 | - <&clks IMX7D_CLK_DUMMY>, |
22 | - <&clks IMX7D_CLK_DUMMY>; |
23 | - clock-names = "pix", "axi", "disp_axi"; |
24 | + <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>; |
25 | + clock-names = "pix", "axi"; |
26 | status = "disabled"; |
27 | }; |
28 | }; |
29 | diff --git a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts |
30 | index 1cf644bfd7ea..51dc734cd5b9 100644 |
31 | --- a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts |
32 | +++ b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts |
33 | @@ -82,6 +82,10 @@ |
34 | gpios = <&gpio0 9 GPIO_ACTIVE_HIGH>; |
35 | }; |
36 | |
37 | +&sata { |
38 | + nr-ports = <2>; |
39 | +}; |
40 | + |
41 | &ehci1 { |
42 | status = "okay"; |
43 | }; |
44 | diff --git a/arch/m68k/include/asm/delay.h b/arch/m68k/include/asm/delay.h |
45 | index d28fa8fe26fe..c598d847d56b 100644 |
46 | --- a/arch/m68k/include/asm/delay.h |
47 | +++ b/arch/m68k/include/asm/delay.h |
48 | @@ -114,6 +114,6 @@ static inline void __udelay(unsigned long usecs) |
49 | */ |
50 | #define HZSCALE (268435456 / (1000000 / HZ)) |
51 | |
52 | -#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000)); |
53 | +#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000)) |
54 | |
55 | #endif /* defined(_M68K_DELAY_H) */ |
56 | diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h |
57 | index c2c43f714684..3a4ed9f91d57 100644 |
58 | --- a/arch/parisc/include/asm/pgtable.h |
59 | +++ b/arch/parisc/include/asm/pgtable.h |
60 | @@ -65,9 +65,9 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr) |
61 | unsigned long flags; \ |
62 | spin_lock_irqsave(&pa_tlb_lock, flags); \ |
63 | old_pte = *ptep; \ |
64 | - set_pte(ptep, pteval); \ |
65 | if (pte_inserted(old_pte)) \ |
66 | purge_tlb_entries(mm, addr); \ |
67 | + set_pte(ptep, pteval); \ |
68 | spin_unlock_irqrestore(&pa_tlb_lock, flags); \ |
69 | } while (0) |
70 | |
71 | @@ -478,8 +478,8 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned |
72 | spin_unlock_irqrestore(&pa_tlb_lock, flags); |
73 | return 0; |
74 | } |
75 | - set_pte(ptep, pte_mkold(pte)); |
76 | purge_tlb_entries(vma->vm_mm, addr); |
77 | + set_pte(ptep, pte_mkold(pte)); |
78 | spin_unlock_irqrestore(&pa_tlb_lock, flags); |
79 | return 1; |
80 | } |
81 | @@ -492,9 +492,9 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, |
82 | |
83 | spin_lock_irqsave(&pa_tlb_lock, flags); |
84 | old_pte = *ptep; |
85 | - set_pte(ptep, __pte(0)); |
86 | if (pte_inserted(old_pte)) |
87 | purge_tlb_entries(mm, addr); |
88 | + set_pte(ptep, __pte(0)); |
89 | spin_unlock_irqrestore(&pa_tlb_lock, flags); |
90 | |
91 | return old_pte; |
92 | @@ -504,8 +504,8 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, |
93 | { |
94 | unsigned long flags; |
95 | spin_lock_irqsave(&pa_tlb_lock, flags); |
96 | - set_pte(ptep, pte_wrprotect(*ptep)); |
97 | purge_tlb_entries(mm, addr); |
98 | + set_pte(ptep, pte_wrprotect(*ptep)); |
99 | spin_unlock_irqrestore(&pa_tlb_lock, flags); |
100 | } |
101 | |
102 | diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c |
103 | index c2259d4a3c33..bbb314eb7027 100644 |
104 | --- a/arch/parisc/kernel/cache.c |
105 | +++ b/arch/parisc/kernel/cache.c |
106 | @@ -393,6 +393,15 @@ void __init parisc_setup_cache_timing(void) |
107 | |
108 | /* calculate TLB flush threshold */ |
109 | |
110 | + /* On SMP machines, skip the TLB measure of kernel text which |
111 | + * has been mapped as huge pages. */ |
112 | + if (num_online_cpus() > 1 && !parisc_requires_coherency()) { |
113 | + threshold = max(cache_info.it_size, cache_info.dt_size); |
114 | + threshold *= PAGE_SIZE; |
115 | + threshold /= num_online_cpus(); |
116 | + goto set_tlb_threshold; |
117 | + } |
118 | + |
119 | alltime = mfctl(16); |
120 | flush_tlb_all(); |
121 | alltime = mfctl(16) - alltime; |
122 | @@ -411,6 +420,8 @@ void __init parisc_setup_cache_timing(void) |
123 | alltime, size, rangetime); |
124 | |
125 | threshold = PAGE_ALIGN(num_online_cpus() * size * alltime / rangetime); |
126 | + |
127 | +set_tlb_threshold: |
128 | if (threshold) |
129 | parisc_tlb_flush_threshold = threshold; |
130 | printk(KERN_INFO "TLB flush threshold set to %lu KiB\n", |
131 | diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S |
132 | index 675521919229..a4761b772406 100644 |
133 | --- a/arch/parisc/kernel/pacache.S |
134 | +++ b/arch/parisc/kernel/pacache.S |
135 | @@ -886,19 +886,10 @@ ENTRY(flush_dcache_page_asm) |
136 | fdc,m r31(%r28) |
137 | fdc,m r31(%r28) |
138 | fdc,m r31(%r28) |
139 | - cmpb,COND(<<) %r28, %r25,1b |
140 | + cmpb,COND(<<) %r28, %r25,1b |
141 | fdc,m r31(%r28) |
142 | |
143 | sync |
144 | - |
145 | -#ifdef CONFIG_PA20 |
146 | - pdtlb,l %r0(%r25) |
147 | -#else |
148 | - tlb_lock %r20,%r21,%r22 |
149 | - pdtlb %r0(%r25) |
150 | - tlb_unlock %r20,%r21,%r22 |
151 | -#endif |
152 | - |
153 | bv %r0(%r2) |
154 | nop |
155 | .exit |
156 | @@ -973,17 +964,6 @@ ENTRY(flush_icache_page_asm) |
157 | fic,m %r31(%sr4,%r28) |
158 | |
159 | sync |
160 | - |
161 | -#ifdef CONFIG_PA20 |
162 | - pdtlb,l %r0(%r28) |
163 | - pitlb,l %r0(%sr4,%r25) |
164 | -#else |
165 | - tlb_lock %r20,%r21,%r22 |
166 | - pdtlb %r0(%r28) |
167 | - pitlb %r0(%sr4,%r25) |
168 | - tlb_unlock %r20,%r21,%r22 |
169 | -#endif |
170 | - |
171 | bv %r0(%r2) |
172 | nop |
173 | .exit |
174 | diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile |
175 | index 1a2a6e8dc40d..1894beb2c208 100644 |
176 | --- a/arch/powerpc/boot/Makefile |
177 | +++ b/arch/powerpc/boot/Makefile |
178 | @@ -78,7 +78,8 @@ src-wlib-y := string.S crt0.S crtsavres.S stdio.c main.c \ |
179 | ns16550.c serial.c simple_alloc.c div64.S util.S \ |
180 | gunzip_util.c elf_util.c $(zlib) devtree.c stdlib.c \ |
181 | oflib.c ofconsole.c cuboot.c mpsc.c cpm-serial.c \ |
182 | - uartlite.c mpc52xx-psc.c opal.c opal-calls.S |
183 | + uartlite.c mpc52xx-psc.c opal.c |
184 | +src-wlib-$(CONFIG_PPC64_BOOT_WRAPPER) += opal-calls.S |
185 | src-wlib-$(CONFIG_40x) += 4xx.c planetcore.c |
186 | src-wlib-$(CONFIG_44x) += 4xx.c ebony.c bamboo.c |
187 | src-wlib-$(CONFIG_8xx) += mpc8xx.c planetcore.c fsl-soc.c |
188 | diff --git a/arch/powerpc/boot/opal.c b/arch/powerpc/boot/opal.c |
189 | index d7b4fd47eb44..0272570d02de 100644 |
190 | --- a/arch/powerpc/boot/opal.c |
191 | +++ b/arch/powerpc/boot/opal.c |
192 | @@ -13,7 +13,7 @@ |
193 | #include <libfdt.h> |
194 | #include "../include/asm/opal-api.h" |
195 | |
196 | -#ifdef __powerpc64__ |
197 | +#ifdef CONFIG_PPC64_BOOT_WRAPPER |
198 | |
199 | /* Global OPAL struct used by opal-call.S */ |
200 | struct opal { |
201 | diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c |
202 | index 29aa8d1ce273..248f28bc4641 100644 |
203 | --- a/arch/powerpc/kernel/eeh_driver.c |
204 | +++ b/arch/powerpc/kernel/eeh_driver.c |
205 | @@ -671,8 +671,10 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus, |
206 | |
207 | /* Clear frozen state */ |
208 | rc = eeh_clear_pe_frozen_state(pe, false); |
209 | - if (rc) |
210 | + if (rc) { |
211 | + pci_unlock_rescan_remove(); |
212 | return rc; |
213 | + } |
214 | |
215 | /* Give the system 5 seconds to finish running the user-space |
216 | * hotplug shutdown scripts, e.g. ifdown for ethernet. Yes, |
217 | diff --git a/arch/powerpc/mm/hash64_4k.c b/arch/powerpc/mm/hash64_4k.c |
218 | index 42c702b3be1f..6fa450c12d6d 100644 |
219 | --- a/arch/powerpc/mm/hash64_4k.c |
220 | +++ b/arch/powerpc/mm/hash64_4k.c |
221 | @@ -55,7 +55,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid, |
222 | */ |
223 | rflags = htab_convert_pte_flags(new_pte); |
224 | |
225 | - if (!cpu_has_feature(CPU_FTR_NOEXECUTE) && |
226 | + if (cpu_has_feature(CPU_FTR_NOEXECUTE) && |
227 | !cpu_has_feature(CPU_FTR_COHERENT_ICACHE)) |
228 | rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap); |
229 | |
230 | diff --git a/arch/powerpc/mm/hash64_64k.c b/arch/powerpc/mm/hash64_64k.c |
231 | index 3bbbea07378c..1a68cb19b0e3 100644 |
232 | --- a/arch/powerpc/mm/hash64_64k.c |
233 | +++ b/arch/powerpc/mm/hash64_64k.c |
234 | @@ -87,7 +87,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid, |
235 | subpg_pte = new_pte & ~subpg_prot; |
236 | rflags = htab_convert_pte_flags(subpg_pte); |
237 | |
238 | - if (!cpu_has_feature(CPU_FTR_NOEXECUTE) && |
239 | + if (cpu_has_feature(CPU_FTR_NOEXECUTE) && |
240 | !cpu_has_feature(CPU_FTR_COHERENT_ICACHE)) { |
241 | |
242 | /* |
243 | @@ -258,7 +258,7 @@ int __hash_page_64K(unsigned long ea, unsigned long access, |
244 | |
245 | rflags = htab_convert_pte_flags(new_pte); |
246 | |
247 | - if (!cpu_has_feature(CPU_FTR_NOEXECUTE) && |
248 | + if (cpu_has_feature(CPU_FTR_NOEXECUTE) && |
249 | !cpu_has_feature(CPU_FTR_COHERENT_ICACHE)) |
250 | rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap); |
251 | |
252 | diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c |
253 | index a4e070a51584..8c925ecaf534 100644 |
254 | --- a/arch/x86/events/core.c |
255 | +++ b/arch/x86/events/core.c |
256 | @@ -68,7 +68,7 @@ u64 x86_perf_event_update(struct perf_event *event) |
257 | int shift = 64 - x86_pmu.cntval_bits; |
258 | u64 prev_raw_count, new_raw_count; |
259 | int idx = hwc->idx; |
260 | - s64 delta; |
261 | + u64 delta; |
262 | |
263 | if (idx == INTEL_PMC_IDX_FIXED_BTS) |
264 | return 0; |
265 | diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c |
266 | index 4c9a79b9cd69..3ef34c6e63ca 100644 |
267 | --- a/arch/x86/events/intel/core.c |
268 | +++ b/arch/x86/events/intel/core.c |
269 | @@ -4024,7 +4024,7 @@ __init int intel_pmu_init(void) |
270 | |
271 | /* Support full width counters using alternative MSR range */ |
272 | if (x86_pmu.intel_cap.full_width_write) { |
273 | - x86_pmu.max_period = x86_pmu.cntval_mask; |
274 | + x86_pmu.max_period = x86_pmu.cntval_mask >> 1; |
275 | x86_pmu.perfctr = MSR_IA32_PMC0; |
276 | pr_cont("full-width counters, "); |
277 | } |
278 | diff --git a/crypto/Makefile b/crypto/Makefile |
279 | index 99cc64ac70ef..bd6a029094e6 100644 |
280 | --- a/crypto/Makefile |
281 | +++ b/crypto/Makefile |
282 | @@ -40,6 +40,7 @@ obj-$(CONFIG_CRYPTO_ECDH) += ecdh_generic.o |
283 | |
284 | $(obj)/rsapubkey-asn1.o: $(obj)/rsapubkey-asn1.c $(obj)/rsapubkey-asn1.h |
285 | $(obj)/rsaprivkey-asn1.o: $(obj)/rsaprivkey-asn1.c $(obj)/rsaprivkey-asn1.h |
286 | +$(obj)/rsa_helper.o: $(obj)/rsapubkey-asn1.h $(obj)/rsaprivkey-asn1.h |
287 | clean-files += rsapubkey-asn1.c rsapubkey-asn1.h |
288 | clean-files += rsaprivkey-asn1.c rsaprivkey-asn1.h |
289 | |
290 | diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c |
291 | index 86fb59b109a9..c6e992082259 100644 |
292 | --- a/crypto/mcryptd.c |
293 | +++ b/crypto/mcryptd.c |
294 | @@ -254,18 +254,22 @@ out_free_inst: |
295 | goto out; |
296 | } |
297 | |
298 | -static inline void mcryptd_check_internal(struct rtattr **tb, u32 *type, |
299 | +static inline bool mcryptd_check_internal(struct rtattr **tb, u32 *type, |
300 | u32 *mask) |
301 | { |
302 | struct crypto_attr_type *algt; |
303 | |
304 | algt = crypto_get_attr_type(tb); |
305 | if (IS_ERR(algt)) |
306 | - return; |
307 | - if ((algt->type & CRYPTO_ALG_INTERNAL)) |
308 | - *type |= CRYPTO_ALG_INTERNAL; |
309 | - if ((algt->mask & CRYPTO_ALG_INTERNAL)) |
310 | - *mask |= CRYPTO_ALG_INTERNAL; |
311 | + return false; |
312 | + |
313 | + *type |= algt->type & CRYPTO_ALG_INTERNAL; |
314 | + *mask |= algt->mask & CRYPTO_ALG_INTERNAL; |
315 | + |
316 | + if (*type & *mask & CRYPTO_ALG_INTERNAL) |
317 | + return true; |
318 | + else |
319 | + return false; |
320 | } |
321 | |
322 | static int mcryptd_hash_init_tfm(struct crypto_tfm *tfm) |
323 | @@ -492,7 +496,8 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, |
324 | u32 mask = 0; |
325 | int err; |
326 | |
327 | - mcryptd_check_internal(tb, &type, &mask); |
328 | + if (!mcryptd_check_internal(tb, &type, &mask)) |
329 | + return -EINVAL; |
330 | |
331 | halg = ahash_attr_alg(tb[1], type, mask); |
332 | if (IS_ERR(halg)) |
333 | diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c |
334 | index 2accf784534e..93e0d8333a20 100644 |
335 | --- a/drivers/acpi/nfit/core.c |
336 | +++ b/drivers/acpi/nfit/core.c |
337 | @@ -94,7 +94,7 @@ static struct acpi_device *to_acpi_dev(struct acpi_nfit_desc *acpi_desc) |
338 | return to_acpi_device(acpi_desc->dev); |
339 | } |
340 | |
341 | -static int xlat_status(void *buf, unsigned int cmd, u32 status) |
342 | +static int xlat_bus_status(void *buf, unsigned int cmd, u32 status) |
343 | { |
344 | struct nd_cmd_clear_error *clear_err; |
345 | struct nd_cmd_ars_status *ars_status; |
346 | @@ -113,7 +113,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status) |
347 | flags = ND_ARS_PERSISTENT | ND_ARS_VOLATILE; |
348 | if ((status >> 16 & flags) == 0) |
349 | return -ENOTTY; |
350 | - break; |
351 | + return 0; |
352 | case ND_CMD_ARS_START: |
353 | /* ARS is in progress */ |
354 | if ((status & 0xffff) == NFIT_ARS_START_BUSY) |
355 | @@ -122,7 +122,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status) |
356 | /* Command failed */ |
357 | if (status & 0xffff) |
358 | return -EIO; |
359 | - break; |
360 | + return 0; |
361 | case ND_CMD_ARS_STATUS: |
362 | ars_status = buf; |
363 | /* Command failed */ |
364 | @@ -146,7 +146,8 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status) |
365 | * then just continue with the returned results. |
366 | */ |
367 | if (status == NFIT_ARS_STATUS_INTR) { |
368 | - if (ars_status->flags & NFIT_ARS_F_OVERFLOW) |
369 | + if (ars_status->out_length >= 40 && (ars_status->flags |
370 | + & NFIT_ARS_F_OVERFLOW)) |
371 | return -ENOSPC; |
372 | return 0; |
373 | } |
374 | @@ -154,7 +155,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status) |
375 | /* Unknown status */ |
376 | if (status >> 16) |
377 | return -EIO; |
378 | - break; |
379 | + return 0; |
380 | case ND_CMD_CLEAR_ERROR: |
381 | clear_err = buf; |
382 | if (status & 0xffff) |
383 | @@ -163,7 +164,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status) |
384 | return -EIO; |
385 | if (clear_err->length > clear_err->cleared) |
386 | return clear_err->cleared; |
387 | - break; |
388 | + return 0; |
389 | default: |
390 | break; |
391 | } |
392 | @@ -174,6 +175,16 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status) |
393 | return 0; |
394 | } |
395 | |
396 | +static int xlat_status(struct nvdimm *nvdimm, void *buf, unsigned int cmd, |
397 | + u32 status) |
398 | +{ |
399 | + if (!nvdimm) |
400 | + return xlat_bus_status(buf, cmd, status); |
401 | + if (status) |
402 | + return -EIO; |
403 | + return 0; |
404 | +} |
405 | + |
406 | static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, |
407 | struct nvdimm *nvdimm, unsigned int cmd, void *buf, |
408 | unsigned int buf_len, int *cmd_rc) |
409 | @@ -298,7 +309,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, |
410 | |
411 | for (i = 0, offset = 0; i < desc->out_num; i++) { |
412 | u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, buf, |
413 | - (u32 *) out_obj->buffer.pointer); |
414 | + (u32 *) out_obj->buffer.pointer, |
415 | + out_obj->buffer.length - offset); |
416 | |
417 | if (offset + out_size > out_obj->buffer.length) { |
418 | dev_dbg(dev, "%s:%s output object underflow cmd: %s field: %d\n", |
419 | @@ -333,7 +345,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, |
420 | */ |
421 | rc = buf_len - offset - in_buf.buffer.length; |
422 | if (cmd_rc) |
423 | - *cmd_rc = xlat_status(buf, cmd, fw_status); |
424 | + *cmd_rc = xlat_status(nvdimm, buf, cmd, |
425 | + fw_status); |
426 | } else { |
427 | dev_err(dev, "%s:%s underrun cmd: %s buf_len: %d out_len: %d\n", |
428 | __func__, dimm_name, cmd_name, buf_len, |
429 | @@ -343,7 +356,7 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, |
430 | } else { |
431 | rc = 0; |
432 | if (cmd_rc) |
433 | - *cmd_rc = xlat_status(buf, cmd, fw_status); |
434 | + *cmd_rc = xlat_status(nvdimm, buf, cmd, fw_status); |
435 | } |
436 | |
437 | out: |
438 | @@ -1857,19 +1870,32 @@ static int ars_get_status(struct acpi_nfit_desc *acpi_desc) |
439 | return cmd_rc; |
440 | } |
441 | |
442 | -static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus, |
443 | +static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc, |
444 | struct nd_cmd_ars_status *ars_status) |
445 | { |
446 | + struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus; |
447 | int rc; |
448 | u32 i; |
449 | |
450 | + /* |
451 | + * First record starts at 44 byte offset from the start of the |
452 | + * payload. |
453 | + */ |
454 | + if (ars_status->out_length < 44) |
455 | + return 0; |
456 | for (i = 0; i < ars_status->num_records; i++) { |
457 | + /* only process full records */ |
458 | + if (ars_status->out_length |
459 | + < 44 + sizeof(struct nd_ars_record) * (i + 1)) |
460 | + break; |
461 | rc = nvdimm_bus_add_poison(nvdimm_bus, |
462 | ars_status->records[i].err_address, |
463 | ars_status->records[i].length); |
464 | if (rc) |
465 | return rc; |
466 | } |
467 | + if (i < ars_status->num_records) |
468 | + dev_warn(acpi_desc->dev, "detected truncated ars results\n"); |
469 | |
470 | return 0; |
471 | } |
472 | @@ -2122,8 +2148,7 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc, |
473 | if (rc < 0 && rc != -ENOSPC) |
474 | return rc; |
475 | |
476 | - if (ars_status_process_records(acpi_desc->nvdimm_bus, |
477 | - acpi_desc->ars_status)) |
478 | + if (ars_status_process_records(acpi_desc, acpi_desc->ars_status)) |
479 | return -ENOMEM; |
480 | |
481 | return 0; |
482 | diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c |
483 | index 2b38c1bb0446..7a2e4d45b266 100644 |
484 | --- a/drivers/acpi/sleep.c |
485 | +++ b/drivers/acpi/sleep.c |
486 | @@ -47,32 +47,15 @@ static void acpi_sleep_tts_switch(u32 acpi_state) |
487 | } |
488 | } |
489 | |
490 | -static void acpi_sleep_pts_switch(u32 acpi_state) |
491 | -{ |
492 | - acpi_status status; |
493 | - |
494 | - status = acpi_execute_simple_method(NULL, "\\_PTS", acpi_state); |
495 | - if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) { |
496 | - /* |
497 | - * OS can't evaluate the _PTS object correctly. Some warning |
498 | - * message will be printed. But it won't break anything. |
499 | - */ |
500 | - printk(KERN_NOTICE "Failure in evaluating _PTS object\n"); |
501 | - } |
502 | -} |
503 | - |
504 | -static int sleep_notify_reboot(struct notifier_block *this, |
505 | +static int tts_notify_reboot(struct notifier_block *this, |
506 | unsigned long code, void *x) |
507 | { |
508 | acpi_sleep_tts_switch(ACPI_STATE_S5); |
509 | - |
510 | - acpi_sleep_pts_switch(ACPI_STATE_S5); |
511 | - |
512 | return NOTIFY_DONE; |
513 | } |
514 | |
515 | -static struct notifier_block sleep_notifier = { |
516 | - .notifier_call = sleep_notify_reboot, |
517 | +static struct notifier_block tts_notifier = { |
518 | + .notifier_call = tts_notify_reboot, |
519 | .next = NULL, |
520 | .priority = 0, |
521 | }; |
522 | @@ -916,9 +899,9 @@ int __init acpi_sleep_init(void) |
523 | pr_info(PREFIX "(supports%s)\n", supported); |
524 | |
525 | /* |
526 | - * Register the sleep_notifier to reboot notifier list so that the _TTS |
527 | - * and _PTS object can also be evaluated when the system enters S5. |
528 | + * Register the tts_notifier to reboot notifier list so that the _TTS |
529 | + * object can also be evaluated when the system enters S5. |
530 | */ |
531 | - register_reboot_notifier(&sleep_notifier); |
532 | + register_reboot_notifier(&tts_notifier); |
533 | return 0; |
534 | } |
535 | diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c |
536 | index 5163c8f918cb..5497f7fc44d0 100644 |
537 | --- a/drivers/block/zram/zram_drv.c |
538 | +++ b/drivers/block/zram/zram_drv.c |
539 | @@ -1413,8 +1413,14 @@ static ssize_t hot_remove_store(struct class *class, |
540 | return ret ? ret : count; |
541 | } |
542 | |
543 | +/* |
544 | + * NOTE: hot_add attribute is not the usual read-only sysfs attribute. In a |
545 | + * sense that reading from this file does alter the state of your system -- it |
546 | + * creates a new un-initialized zram device and returns back this device's |
547 | + * device_id (or an error code if it fails to create a new device). |
548 | + */ |
549 | static struct class_attribute zram_control_class_attrs[] = { |
550 | - __ATTR_RO(hot_add), |
551 | + __ATTR(hot_add, 0400, hot_add_show, NULL), |
552 | __ATTR_WO(hot_remove), |
553 | __ATTR_NULL, |
554 | }; |
555 | diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c |
556 | index 0ec112ee5204..2341f3799591 100644 |
557 | --- a/drivers/crypto/caam/ctrl.c |
558 | +++ b/drivers/crypto/caam/ctrl.c |
559 | @@ -557,8 +557,9 @@ static int caam_probe(struct platform_device *pdev) |
560 | * Enable DECO watchdogs and, if this is a PHYS_ADDR_T_64BIT kernel, |
561 | * long pointers in master configuration register |
562 | */ |
563 | - clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK, MCFGR_AWCACHE_CACH | |
564 | - MCFGR_AWCACHE_BUFF | MCFGR_WDENABLE | MCFGR_LARGE_BURST | |
565 | + clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK | MCFGR_LONG_PTR, |
566 | + MCFGR_AWCACHE_CACH | MCFGR_AWCACHE_BUFF | |
567 | + MCFGR_WDENABLE | MCFGR_LARGE_BURST | |
568 | (sizeof(dma_addr_t) == sizeof(u64) ? MCFGR_LONG_PTR : 0)); |
569 | |
570 | /* |
571 | diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c |
572 | index b111e14bac1e..13e89afdbb87 100644 |
573 | --- a/drivers/crypto/marvell/hash.c |
574 | +++ b/drivers/crypto/marvell/hash.c |
575 | @@ -168,12 +168,11 @@ static void mv_cesa_ahash_std_step(struct ahash_request *req) |
576 | mv_cesa_adjust_op(engine, &creq->op_tmpl); |
577 | memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl)); |
578 | |
579 | - digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req)); |
580 | - for (i = 0; i < digsize / 4; i++) |
581 | - writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i)); |
582 | - |
583 | - mv_cesa_adjust_op(engine, &creq->op_tmpl); |
584 | - memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl)); |
585 | + if (!sreq->offset) { |
586 | + digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req)); |
587 | + for (i = 0; i < digsize / 4; i++) |
588 | + writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i)); |
589 | + } |
590 | |
591 | if (creq->cache_ptr) |
592 | memcpy_toio(engine->sram + CESA_SA_DATA_SRAM_OFFSET, |
593 | diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c |
594 | index ff64313770bd..4894199cebab 100644 |
595 | --- a/drivers/dax/dax.c |
596 | +++ b/drivers/dax/dax.c |
597 | @@ -324,7 +324,7 @@ static int check_vma(struct dax_dev *dax_dev, struct vm_area_struct *vma, |
598 | return -ENXIO; |
599 | |
600 | /* prevent private mappings from being established */ |
601 | - if ((vma->vm_flags & VM_SHARED) != VM_SHARED) { |
602 | + if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) { |
603 | dev_info(dev, "%s: %s: fail, attempted private mapping\n", |
604 | current->comm, func); |
605 | return -EINVAL; |
606 | diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c |
607 | index bfb91d8fa460..1006af40481d 100644 |
608 | --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c |
609 | +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c |
610 | @@ -872,23 +872,25 @@ lbl_free_candev: |
611 | static void peak_usb_disconnect(struct usb_interface *intf) |
612 | { |
613 | struct peak_usb_device *dev; |
614 | + struct peak_usb_device *dev_prev_siblings; |
615 | |
616 | /* unregister as many netdev devices as siblings */ |
617 | - for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) { |
618 | + for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) { |
619 | struct net_device *netdev = dev->netdev; |
620 | char name[IFNAMSIZ]; |
621 | |
622 | + dev_prev_siblings = dev->prev_siblings; |
623 | dev->state &= ~PCAN_USB_STATE_CONNECTED; |
624 | strncpy(name, netdev->name, IFNAMSIZ); |
625 | |
626 | unregister_netdev(netdev); |
627 | - free_candev(netdev); |
628 | |
629 | kfree(dev->cmd_buf); |
630 | dev->next_siblings = NULL; |
631 | if (dev->adapter->dev_free) |
632 | dev->adapter->dev_free(dev); |
633 | |
634 | + free_candev(netdev); |
635 | dev_info(&intf->dev, "%s removed\n", name); |
636 | } |
637 | |
638 | diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c |
639 | index a8b6949a8778..23d4a1728cdf 100644 |
640 | --- a/drivers/nvdimm/bus.c |
641 | +++ b/drivers/nvdimm/bus.c |
642 | @@ -715,7 +715,7 @@ EXPORT_SYMBOL_GPL(nd_cmd_in_size); |
643 | |
644 | u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd, |
645 | const struct nd_cmd_desc *desc, int idx, const u32 *in_field, |
646 | - const u32 *out_field) |
647 | + const u32 *out_field, unsigned long remainder) |
648 | { |
649 | if (idx >= desc->out_num) |
650 | return UINT_MAX; |
651 | @@ -727,9 +727,24 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd, |
652 | return in_field[1]; |
653 | else if (nvdimm && cmd == ND_CMD_VENDOR && idx == 2) |
654 | return out_field[1]; |
655 | - else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2) |
656 | - return out_field[1] - 8; |
657 | - else if (cmd == ND_CMD_CALL) { |
658 | + else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2) { |
659 | + /* |
660 | + * Per table 9-276 ARS Data in ACPI 6.1, out_field[1] is |
661 | + * "Size of Output Buffer in bytes, including this |
662 | + * field." |
663 | + */ |
664 | + if (out_field[1] < 4) |
665 | + return 0; |
666 | + /* |
667 | + * ACPI 6.1 is ambiguous if 'status' is included in the |
668 | + * output size. If we encounter an output size that |
669 | + * overshoots the remainder by 4 bytes, assume it was |
670 | + * including 'status'. |
671 | + */ |
672 | + if (out_field[1] - 8 == remainder) |
673 | + return remainder; |
674 | + return out_field[1] - 4; |
675 | + } else if (cmd == ND_CMD_CALL) { |
676 | struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field; |
677 | |
678 | return pkg->nd_size_out; |
679 | @@ -876,7 +891,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, |
680 | /* process an output envelope */ |
681 | for (i = 0; i < desc->out_num; i++) { |
682 | u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, |
683 | - (u32 *) in_env, (u32 *) out_env); |
684 | + (u32 *) in_env, (u32 *) out_env, 0); |
685 | u32 copy; |
686 | |
687 | if (out_size == UINT_MAX) { |
688 | diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c |
689 | index 7080ce2920fd..8214ebae9d50 100644 |
690 | --- a/drivers/scsi/lpfc/lpfc_sli.c |
691 | +++ b/drivers/scsi/lpfc/lpfc_sli.c |
692 | @@ -1323,18 +1323,20 @@ lpfc_sli_ringtxcmpl_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, |
693 | { |
694 | lockdep_assert_held(&phba->hbalock); |
695 | |
696 | - BUG_ON(!piocb || !piocb->vport); |
697 | + BUG_ON(!piocb); |
698 | |
699 | list_add_tail(&piocb->list, &pring->txcmplq); |
700 | piocb->iocb_flag |= LPFC_IO_ON_TXCMPLQ; |
701 | |
702 | if ((unlikely(pring->ringno == LPFC_ELS_RING)) && |
703 | (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) && |
704 | - (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN) && |
705 | - (!(piocb->vport->load_flag & FC_UNLOADING))) |
706 | - mod_timer(&piocb->vport->els_tmofunc, |
707 | - jiffies + |
708 | - msecs_to_jiffies(1000 * (phba->fc_ratov << 1))); |
709 | + (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN)) { |
710 | + BUG_ON(!piocb->vport); |
711 | + if (!(piocb->vport->load_flag & FC_UNLOADING)) |
712 | + mod_timer(&piocb->vport->els_tmofunc, |
713 | + jiffies + |
714 | + msecs_to_jiffies(1000 * (phba->fc_ratov << 1))); |
715 | + } |
716 | |
717 | return 0; |
718 | } |
719 | diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c |
720 | index e3b30ea9ece5..a504e2e003da 100644 |
721 | --- a/drivers/vhost/vsock.c |
722 | +++ b/drivers/vhost/vsock.c |
723 | @@ -506,7 +506,7 @@ static void vhost_vsock_reset_orphans(struct sock *sk) |
724 | * executing. |
725 | */ |
726 | |
727 | - if (!vhost_vsock_get(vsk->local_addr.svm_cid)) { |
728 | + if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) { |
729 | sock_set_flag(sk, SOCK_DONE); |
730 | vsk->peer_shutdown = SHUTDOWN_MASK; |
731 | sk->sk_state = SS_UNCONNECTED; |
732 | diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c |
733 | index df4b3e6fa563..93142bfe6112 100644 |
734 | --- a/fs/ceph/dir.c |
735 | +++ b/fs/ceph/dir.c |
736 | @@ -1257,26 +1257,30 @@ static int ceph_d_revalidate(struct dentry *dentry, unsigned int flags) |
737 | return -ECHILD; |
738 | |
739 | op = ceph_snap(dir) == CEPH_SNAPDIR ? |
740 | - CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_LOOKUP; |
741 | + CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_GETATTR; |
742 | req = ceph_mdsc_create_request(mdsc, op, USE_ANY_MDS); |
743 | if (!IS_ERR(req)) { |
744 | req->r_dentry = dget(dentry); |
745 | - req->r_num_caps = 2; |
746 | + req->r_num_caps = op == CEPH_MDS_OP_GETATTR ? 1 : 2; |
747 | |
748 | mask = CEPH_STAT_CAP_INODE | CEPH_CAP_AUTH_SHARED; |
749 | if (ceph_security_xattr_wanted(dir)) |
750 | mask |= CEPH_CAP_XATTR_SHARED; |
751 | req->r_args.getattr.mask = mask; |
752 | |
753 | - req->r_locked_dir = dir; |
754 | err = ceph_mdsc_do_request(mdsc, NULL, req); |
755 | - if (err == 0 || err == -ENOENT) { |
756 | - if (dentry == req->r_dentry) { |
757 | - valid = !d_unhashed(dentry); |
758 | - } else { |
759 | - d_invalidate(req->r_dentry); |
760 | - err = -EAGAIN; |
761 | - } |
762 | + switch (err) { |
763 | + case 0: |
764 | + if (d_really_is_positive(dentry) && |
765 | + d_inode(dentry) == req->r_target_inode) |
766 | + valid = 1; |
767 | + break; |
768 | + case -ENOENT: |
769 | + if (d_really_is_negative(dentry)) |
770 | + valid = 1; |
771 | + /* Fallthrough */ |
772 | + default: |
773 | + break; |
774 | } |
775 | ceph_mdsc_put_request(req); |
776 | dout("d_revalidate %p lookup result=%d\n", |
777 | diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c |
778 | index 4ff9251e9d3a..eb5373a026e3 100644 |
779 | --- a/fs/fuse/dir.c |
780 | +++ b/fs/fuse/dir.c |
781 | @@ -1709,8 +1709,6 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr) |
782 | return -EACCES; |
783 | |
784 | if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) { |
785 | - int kill; |
786 | - |
787 | attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | |
788 | ATTR_MODE); |
789 | /* |
790 | @@ -1722,12 +1720,11 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr) |
791 | return ret; |
792 | |
793 | attr->ia_mode = inode->i_mode; |
794 | - kill = should_remove_suid(entry); |
795 | - if (kill & ATTR_KILL_SUID) { |
796 | + if (inode->i_mode & S_ISUID) { |
797 | attr->ia_valid |= ATTR_MODE; |
798 | attr->ia_mode &= ~S_ISUID; |
799 | } |
800 | - if (kill & ATTR_KILL_SGID) { |
801 | + if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { |
802 | attr->ia_valid |= ATTR_MODE; |
803 | attr->ia_mode &= ~S_ISGID; |
804 | } |
805 | diff --git a/include/linux/cpu.h b/include/linux/cpu.h |
806 | index 797d9c8e9a1b..c8938eb21e34 100644 |
807 | --- a/include/linux/cpu.h |
808 | +++ b/include/linux/cpu.h |
809 | @@ -105,22 +105,16 @@ extern bool cpuhp_tasks_frozen; |
810 | { .notifier_call = fn, .priority = pri }; \ |
811 | __register_cpu_notifier(&fn##_nb); \ |
812 | } |
813 | -#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */ |
814 | -#define cpu_notifier(fn, pri) do { (void)(fn); } while (0) |
815 | -#define __cpu_notifier(fn, pri) do { (void)(fn); } while (0) |
816 | -#endif /* #else #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */ |
817 | |
818 | -#ifdef CONFIG_HOTPLUG_CPU |
819 | extern int register_cpu_notifier(struct notifier_block *nb); |
820 | extern int __register_cpu_notifier(struct notifier_block *nb); |
821 | extern void unregister_cpu_notifier(struct notifier_block *nb); |
822 | extern void __unregister_cpu_notifier(struct notifier_block *nb); |
823 | -#else |
824 | |
825 | -#ifndef MODULE |
826 | -extern int register_cpu_notifier(struct notifier_block *nb); |
827 | -extern int __register_cpu_notifier(struct notifier_block *nb); |
828 | -#else |
829 | +#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */ |
830 | +#define cpu_notifier(fn, pri) do { (void)(fn); } while (0) |
831 | +#define __cpu_notifier(fn, pri) do { (void)(fn); } while (0) |
832 | + |
833 | static inline int register_cpu_notifier(struct notifier_block *nb) |
834 | { |
835 | return 0; |
836 | @@ -130,7 +124,6 @@ static inline int __register_cpu_notifier(struct notifier_block *nb) |
837 | { |
838 | return 0; |
839 | } |
840 | -#endif |
841 | |
842 | static inline void unregister_cpu_notifier(struct notifier_block *nb) |
843 | { |
844 | diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h |
845 | index bbfce62a0bd7..d02d65dfe2d0 100644 |
846 | --- a/include/linux/libnvdimm.h |
847 | +++ b/include/linux/libnvdimm.h |
848 | @@ -153,7 +153,7 @@ u32 nd_cmd_in_size(struct nvdimm *nvdimm, int cmd, |
849 | const struct nd_cmd_desc *desc, int idx, void *buf); |
850 | u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd, |
851 | const struct nd_cmd_desc *desc, int idx, const u32 *in_field, |
852 | - const u32 *out_field); |
853 | + const u32 *out_field, unsigned long remainder); |
854 | int nvdimm_bus_check_dimm_count(struct nvdimm_bus *nvdimm_bus, int dimm_count); |
855 | struct nd_region *nvdimm_pmem_region_create(struct nvdimm_bus *nvdimm_bus, |
856 | struct nd_region_desc *ndr_desc); |
857 | diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h |
858 | index 9692cda5f8fc..c48d93a28d1a 100644 |
859 | --- a/include/uapi/linux/can.h |
860 | +++ b/include/uapi/linux/can.h |
861 | @@ -196,5 +196,6 @@ struct can_filter { |
862 | }; |
863 | |
864 | #define CAN_INV_FILTER 0x20000000U /* to be set in can_filter.can_id */ |
865 | +#define CAN_RAW_FILTER_MAX 512 /* maximum number of can_filter set via setsockopt() */ |
866 | |
867 | #endif /* !_UAPI_CAN_H */ |
868 | diff --git a/kernel/cpu.c b/kernel/cpu.c |
869 | index 341bf80f80bd..73fb59fda809 100644 |
870 | --- a/kernel/cpu.c |
871 | +++ b/kernel/cpu.c |
872 | @@ -578,7 +578,6 @@ void __init cpuhp_threads_init(void) |
873 | kthread_unpark(this_cpu_read(cpuhp_state.thread)); |
874 | } |
875 | |
876 | -#ifdef CONFIG_HOTPLUG_CPU |
877 | EXPORT_SYMBOL(register_cpu_notifier); |
878 | EXPORT_SYMBOL(__register_cpu_notifier); |
879 | void unregister_cpu_notifier(struct notifier_block *nb) |
880 | @@ -595,6 +594,7 @@ void __unregister_cpu_notifier(struct notifier_block *nb) |
881 | } |
882 | EXPORT_SYMBOL(__unregister_cpu_notifier); |
883 | |
884 | +#ifdef CONFIG_HOTPLUG_CPU |
885 | /** |
886 | * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU |
887 | * @cpu: a CPU id |
888 | diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c |
889 | index 1ec0f48962b3..2c49d76f96c3 100644 |
890 | --- a/kernel/locking/rtmutex.c |
891 | +++ b/kernel/locking/rtmutex.c |
892 | @@ -65,8 +65,72 @@ static inline void clear_rt_mutex_waiters(struct rt_mutex *lock) |
893 | |
894 | static void fixup_rt_mutex_waiters(struct rt_mutex *lock) |
895 | { |
896 | - if (!rt_mutex_has_waiters(lock)) |
897 | - clear_rt_mutex_waiters(lock); |
898 | + unsigned long owner, *p = (unsigned long *) &lock->owner; |
899 | + |
900 | + if (rt_mutex_has_waiters(lock)) |
901 | + return; |
902 | + |
903 | + /* |
904 | + * The rbtree has no waiters enqueued, now make sure that the |
905 | + * lock->owner still has the waiters bit set, otherwise the |
906 | + * following can happen: |
907 | + * |
908 | + * CPU 0 CPU 1 CPU2 |
909 | + * l->owner=T1 |
910 | + * rt_mutex_lock(l) |
911 | + * lock(l->lock) |
912 | + * l->owner = T1 | HAS_WAITERS; |
913 | + * enqueue(T2) |
914 | + * boost() |
915 | + * unlock(l->lock) |
916 | + * block() |
917 | + * |
918 | + * rt_mutex_lock(l) |
919 | + * lock(l->lock) |
920 | + * l->owner = T1 | HAS_WAITERS; |
921 | + * enqueue(T3) |
922 | + * boost() |
923 | + * unlock(l->lock) |
924 | + * block() |
925 | + * signal(->T2) signal(->T3) |
926 | + * lock(l->lock) |
927 | + * dequeue(T2) |
928 | + * deboost() |
929 | + * unlock(l->lock) |
930 | + * lock(l->lock) |
931 | + * dequeue(T3) |
932 | + * ==> wait list is empty |
933 | + * deboost() |
934 | + * unlock(l->lock) |
935 | + * lock(l->lock) |
936 | + * fixup_rt_mutex_waiters() |
937 | + * if (wait_list_empty(l) { |
938 | + * l->owner = owner |
939 | + * owner = l->owner & ~HAS_WAITERS; |
940 | + * ==> l->owner = T1 |
941 | + * } |
942 | + * lock(l->lock) |
943 | + * rt_mutex_unlock(l) fixup_rt_mutex_waiters() |
944 | + * if (wait_list_empty(l) { |
945 | + * owner = l->owner & ~HAS_WAITERS; |
946 | + * cmpxchg(l->owner, T1, NULL) |
947 | + * ===> Success (l->owner = NULL) |
948 | + * |
949 | + * l->owner = owner |
950 | + * ==> l->owner = T1 |
951 | + * } |
952 | + * |
953 | + * With the check for the waiter bit in place T3 on CPU2 will not |
954 | + * overwrite. All tasks fiddling with the waiters bit are |
955 | + * serialized by l->lock, so nothing else can modify the waiters |
956 | + * bit. If the bit is set then nothing can change l->owner either |
957 | + * so the simple RMW is safe. The cmpxchg() will simply fail if it |
958 | + * happens in the middle of the RMW because the waiters bit is |
959 | + * still set. |
960 | + */ |
961 | + owner = READ_ONCE(*p); |
962 | + if (owner & RT_MUTEX_HAS_WAITERS) |
963 | + WRITE_ONCE(*p, owner & ~RT_MUTEX_HAS_WAITERS); |
964 | } |
965 | |
966 | /* |
967 | diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h |
968 | index 4f5f83c7d2d3..e317e1cbb3eb 100644 |
969 | --- a/kernel/locking/rtmutex_common.h |
970 | +++ b/kernel/locking/rtmutex_common.h |
971 | @@ -75,8 +75,9 @@ task_top_pi_waiter(struct task_struct *p) |
972 | |
973 | static inline struct task_struct *rt_mutex_owner(struct rt_mutex *lock) |
974 | { |
975 | - return (struct task_struct *) |
976 | - ((unsigned long)lock->owner & ~RT_MUTEX_OWNER_MASKALL); |
977 | + unsigned long owner = (unsigned long) READ_ONCE(lock->owner); |
978 | + |
979 | + return (struct task_struct *) (owner & ~RT_MUTEX_OWNER_MASKALL); |
980 | } |
981 | |
982 | /* |
983 | diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c |
984 | index a5d966cb8891..418d9b6276a3 100644 |
985 | --- a/kernel/sched/auto_group.c |
986 | +++ b/kernel/sched/auto_group.c |
987 | @@ -192,6 +192,7 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice) |
988 | { |
989 | static unsigned long next = INITIAL_JIFFIES; |
990 | struct autogroup *ag; |
991 | + unsigned long shares; |
992 | int err; |
993 | |
994 | if (nice < MIN_NICE || nice > MAX_NICE) |
995 | @@ -210,9 +211,10 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice) |
996 | |
997 | next = HZ / 10 + jiffies; |
998 | ag = autogroup_task_get(p); |
999 | + shares = scale_load(sched_prio_to_weight[nice + 20]); |
1000 | |
1001 | down_write(&ag->lock); |
1002 | - err = sched_group_set_shares(ag->tg, sched_prio_to_weight[nice + 20]); |
1003 | + err = sched_group_set_shares(ag->tg, shares); |
1004 | if (!err) |
1005 | ag->nice = nice; |
1006 | up_write(&ag->lock); |
1007 | diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c |
1008 | index 7e6df7a4964a..67f8fa9fc15a 100644 |
1009 | --- a/net/batman-adv/translation-table.c |
1010 | +++ b/net/batman-adv/translation-table.c |
1011 | @@ -2849,7 +2849,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv, |
1012 | &tvlv_tt_data, |
1013 | &tt_change, |
1014 | &tt_len); |
1015 | - if (!tt_len) |
1016 | + if (!tt_len || !tvlv_len) |
1017 | goto unlock; |
1018 | |
1019 | /* Copy the last orig_node's OGM buffer */ |
1020 | @@ -2867,7 +2867,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv, |
1021 | &tvlv_tt_data, |
1022 | &tt_change, |
1023 | &tt_len); |
1024 | - if (!tt_len) |
1025 | + if (!tt_len || !tvlv_len) |
1026 | goto out; |
1027 | |
1028 | /* fill the rest of the tvlv with the real TT entries */ |
1029 | diff --git a/net/can/raw.c b/net/can/raw.c |
1030 | index 972c187d40ab..b075f028d7e2 100644 |
1031 | --- a/net/can/raw.c |
1032 | +++ b/net/can/raw.c |
1033 | @@ -499,6 +499,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, |
1034 | if (optlen % sizeof(struct can_filter) != 0) |
1035 | return -EINVAL; |
1036 | |
1037 | + if (optlen > CAN_RAW_FILTER_MAX * sizeof(struct can_filter)) |
1038 | + return -EINVAL; |
1039 | + |
1040 | count = optlen / sizeof(struct can_filter); |
1041 | |
1042 | if (count > 1) { |