Contents of /trunk/kernel26-alx/patches-3.10/0165-3.10.66-all-fixes.patch
Parent Directory | Revision Log
Revision 2672 -
(show annotations)
(download)
Tue Jul 21 16:46:35 2015 UTC (9 years, 2 months ago) by niro
File size: 50783 byte(s)
Tue Jul 21 16:46:35 2015 UTC (9 years, 2 months ago) by niro
File size: 50783 byte(s)
-3.10.84-alx-r1
1 | diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt |
2 | index 1311a48a7367..98da831a14ba 100644 |
3 | --- a/Documentation/kernel-parameters.txt |
4 | +++ b/Documentation/kernel-parameters.txt |
5 | @@ -1061,6 +1061,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. |
6 | i8042.notimeout [HW] Ignore timeout condition signalled by controller |
7 | i8042.reset [HW] Reset the controller during init and cleanup |
8 | i8042.unlock [HW] Unlock (ignore) the keylock |
9 | + i8042.kbdreset [HW] Reset device connected to KBD port |
10 | |
11 | i810= [HW,DRM] |
12 | |
13 | diff --git a/Makefile b/Makefile |
14 | index 7889b38766db..12ae1ef5437a 100644 |
15 | --- a/Makefile |
16 | +++ b/Makefile |
17 | @@ -1,6 +1,6 @@ |
18 | VERSION = 3 |
19 | PATCHLEVEL = 10 |
20 | -SUBLEVEL = 65 |
21 | +SUBLEVEL = 66 |
22 | EXTRAVERSION = |
23 | NAME = TOSSUG Baby Fish |
24 | |
25 | diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts |
26 | index 398064cef746..4c169d825415 100644 |
27 | --- a/arch/arc/boot/dts/nsimosci.dts |
28 | +++ b/arch/arc/boot/dts/nsimosci.dts |
29 | @@ -20,7 +20,7 @@ |
30 | /* this is for console on PGU */ |
31 | /* bootargs = "console=tty0 consoleblank=0"; */ |
32 | /* this is for console on serial */ |
33 | - bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; |
34 | + bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; |
35 | }; |
36 | |
37 | aliases { |
38 | @@ -46,9 +46,9 @@ |
39 | #interrupt-cells = <1>; |
40 | }; |
41 | |
42 | - uart0: serial@c0000000 { |
43 | + uart0: serial@f0000000 { |
44 | compatible = "ns8250"; |
45 | - reg = <0xc0000000 0x2000>; |
46 | + reg = <0xf0000000 0x2000>; |
47 | interrupts = <11>; |
48 | clock-frequency = <3686400>; |
49 | baud = <115200>; |
50 | @@ -57,21 +57,21 @@ |
51 | no-loopback-test = <1>; |
52 | }; |
53 | |
54 | - pgu0: pgu@c9000000 { |
55 | + pgu0: pgu@f9000000 { |
56 | compatible = "snps,arcpgufb"; |
57 | - reg = <0xc9000000 0x400>; |
58 | + reg = <0xf9000000 0x400>; |
59 | }; |
60 | |
61 | - ps2: ps2@c9001000 { |
62 | + ps2: ps2@f9001000 { |
63 | compatible = "snps,arc_ps2"; |
64 | - reg = <0xc9000400 0x14>; |
65 | + reg = <0xf9000400 0x14>; |
66 | interrupts = <13>; |
67 | interrupt-names = "arc_ps2_irq"; |
68 | }; |
69 | |
70 | - eth0: ethernet@c0003000 { |
71 | + eth0: ethernet@f0003000 { |
72 | compatible = "snps,oscilan"; |
73 | - reg = <0xc0003000 0x44>; |
74 | + reg = <0xf0003000 0x44>; |
75 | interrupts = <7>, <8>; |
76 | interrupt-names = "rx", "tx"; |
77 | }; |
78 | diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi |
79 | index 701153992c69..82897e2d8d5a 100644 |
80 | --- a/arch/arm/boot/dts/imx25.dtsi |
81 | +++ b/arch/arm/boot/dts/imx25.dtsi |
82 | @@ -141,7 +141,7 @@ |
83 | #size-cells = <0>; |
84 | compatible = "fsl,imx25-cspi", "fsl,imx35-cspi"; |
85 | reg = <0x43fa4000 0x4000>; |
86 | - clocks = <&clks 62>, <&clks 62>; |
87 | + clocks = <&clks 78>, <&clks 78>; |
88 | clock-names = "ipg", "per"; |
89 | interrupts = <14>; |
90 | status = "disabled"; |
91 | diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c |
92 | index 0b9e437719bd..2acaded8025d 100644 |
93 | --- a/arch/arm/mach-imx/clk-imx6q.c |
94 | +++ b/arch/arm/mach-imx/clk-imx6q.c |
95 | @@ -301,8 +301,8 @@ int __init mx6q_clocks_init(void) |
96 | post_div_table[1].div = 1; |
97 | post_div_table[2].div = 1; |
98 | video_div_table[1].div = 1; |
99 | - video_div_table[2].div = 1; |
100 | - }; |
101 | + video_div_table[3].div = 1; |
102 | + } |
103 | |
104 | /* type name parent_name base div_mask */ |
105 | clk[pll1_sys] = imx_clk_pllv3(IMX_PLLV3_SYS, "pll1_sys", "osc", base, 0x7f); |
106 | diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c |
107 | index f8b23b8040d9..3f3259e74fd3 100644 |
108 | --- a/arch/arm/mach-omap2/timer.c |
109 | +++ b/arch/arm/mach-omap2/timer.c |
110 | @@ -503,11 +503,11 @@ static void __init realtime_counter_init(void) |
111 | rate = clk_get_rate(sys_clk); |
112 | /* Numerator/denumerator values refer TRM Realtime Counter section */ |
113 | switch (rate) { |
114 | - case 1200000: |
115 | + case 12000000: |
116 | num = 64; |
117 | den = 125; |
118 | break; |
119 | - case 1300000: |
120 | + case 13000000: |
121 | num = 768; |
122 | den = 1625; |
123 | break; |
124 | @@ -515,11 +515,11 @@ static void __init realtime_counter_init(void) |
125 | num = 8; |
126 | den = 25; |
127 | break; |
128 | - case 2600000: |
129 | + case 26000000: |
130 | num = 384; |
131 | den = 1625; |
132 | break; |
133 | - case 2700000: |
134 | + case 27000000: |
135 | num = 256; |
136 | den = 1125; |
137 | break; |
138 | diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c |
139 | index 9696f3646864..ea788c8e32e8 100644 |
140 | --- a/arch/arm/mach-shmobile/setup-sh73a0.c |
141 | +++ b/arch/arm/mach-shmobile/setup-sh73a0.c |
142 | @@ -814,6 +814,7 @@ static struct platform_device ipmmu_device = { |
143 | |
144 | static struct renesas_intc_irqpin_config irqpin0_platform_data = { |
145 | .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */ |
146 | + .control_parent = true, |
147 | }; |
148 | |
149 | static struct resource irqpin0_resources[] = { |
150 | @@ -875,6 +876,7 @@ static struct platform_device irqpin1_device = { |
151 | |
152 | static struct renesas_intc_irqpin_config irqpin2_platform_data = { |
153 | .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */ |
154 | + .control_parent = true, |
155 | }; |
156 | |
157 | static struct resource irqpin2_resources[] = { |
158 | @@ -905,6 +907,7 @@ static struct platform_device irqpin2_device = { |
159 | |
160 | static struct renesas_intc_irqpin_config irqpin3_platform_data = { |
161 | .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */ |
162 | + .control_parent = true, |
163 | }; |
164 | |
165 | static struct resource irqpin3_resources[] = { |
166 | diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common |
167 | index bceee6623b00..d1ff46c0559b 100644 |
168 | --- a/arch/um/Kconfig.common |
169 | +++ b/arch/um/Kconfig.common |
170 | @@ -8,6 +8,7 @@ config UML |
171 | default y |
172 | select HAVE_GENERIC_HARDIRQS |
173 | select HAVE_UID16 |
174 | + select HAVE_FUTEX_CMPXCHG if FUTEX |
175 | select GENERIC_IRQ_SHOW |
176 | select GENERIC_CPU_DEVICES |
177 | select GENERIC_IO |
178 | diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c |
179 | index 211bce445522..0c6c07cea3f7 100644 |
180 | --- a/arch/x86/kernel/kprobes/core.c |
181 | +++ b/arch/x86/kernel/kprobes/core.c |
182 | @@ -1017,6 +1017,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) |
183 | regs->flags &= ~X86_EFLAGS_IF; |
184 | trace_hardirqs_off(); |
185 | regs->ip = (unsigned long)(jp->entry); |
186 | + |
187 | + /* |
188 | + * jprobes use jprobe_return() which skips the normal return |
189 | + * path of the function, and this messes up the accounting of the |
190 | + * function graph tracer to get messed up. |
191 | + * |
192 | + * Pause function graph tracing while performing the jprobe function. |
193 | + */ |
194 | + pause_graph_tracing(); |
195 | return 1; |
196 | } |
197 | |
198 | @@ -1042,24 +1051,25 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) |
199 | struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); |
200 | u8 *addr = (u8 *) (regs->ip - 1); |
201 | struct jprobe *jp = container_of(p, struct jprobe, kp); |
202 | + void *saved_sp = kcb->jprobe_saved_sp; |
203 | |
204 | if ((addr > (u8 *) jprobe_return) && |
205 | (addr < (u8 *) jprobe_return_end)) { |
206 | - if (stack_addr(regs) != kcb->jprobe_saved_sp) { |
207 | + if (stack_addr(regs) != saved_sp) { |
208 | struct pt_regs *saved_regs = &kcb->jprobe_saved_regs; |
209 | printk(KERN_ERR |
210 | "current sp %p does not match saved sp %p\n", |
211 | - stack_addr(regs), kcb->jprobe_saved_sp); |
212 | + stack_addr(regs), saved_sp); |
213 | printk(KERN_ERR "Saved registers for jprobe %p\n", jp); |
214 | show_regs(saved_regs); |
215 | printk(KERN_ERR "Current registers\n"); |
216 | show_regs(regs); |
217 | BUG(); |
218 | } |
219 | + /* It's OK to start function graph tracing again */ |
220 | + unpause_graph_tracing(); |
221 | *regs = kcb->jprobe_saved_regs; |
222 | - memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp), |
223 | - kcb->jprobes_stack, |
224 | - MIN_STACK_SIZE(kcb->jprobe_saved_sp)); |
225 | + memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp)); |
226 | preempt_enable_no_resched(); |
227 | return 1; |
228 | } |
229 | diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c |
230 | index 531d4269e2e3..bd16d6c370ec 100644 |
231 | --- a/arch/x86/um/sys_call_table_32.c |
232 | +++ b/arch/x86/um/sys_call_table_32.c |
233 | @@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void); |
234 | |
235 | extern asmlinkage void sys_ni_syscall(void); |
236 | |
237 | -const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { |
238 | +const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { |
239 | /* |
240 | * Smells like a compiler bug -- it doesn't work |
241 | * when the & below is removed. |
242 | diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c |
243 | index f2f0723070ca..95783087f0d3 100644 |
244 | --- a/arch/x86/um/sys_call_table_64.c |
245 | +++ b/arch/x86/um/sys_call_table_64.c |
246 | @@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void); |
247 | |
248 | extern void sys_ni_syscall(void); |
249 | |
250 | -const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { |
251 | +const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { |
252 | /* |
253 | * Smells like a compiler bug -- it doesn't work |
254 | * when the & below is removed. |
255 | diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c |
256 | index 665f9530c950..af909a20dd70 100644 |
257 | --- a/drivers/gpio/gpiolib-of.c |
258 | +++ b/drivers/gpio/gpiolib-of.c |
259 | @@ -12,6 +12,7 @@ |
260 | */ |
261 | |
262 | #include <linux/device.h> |
263 | +#include <linux/err.h> |
264 | #include <linux/errno.h> |
265 | #include <linux/module.h> |
266 | #include <linux/io.h> |
267 | @@ -42,8 +43,14 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data) |
268 | return false; |
269 | |
270 | ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags); |
271 | - if (ret < 0) |
272 | - return false; |
273 | + if (ret < 0) { |
274 | + /* We've found the gpio chip, but the translation failed. |
275 | + * Return true to stop looking and return the translation |
276 | + * error via out_gpio |
277 | + */ |
278 | + gg_data->out_gpio = ERR_PTR(ret); |
279 | + return true; |
280 | + } |
281 | |
282 | gg_data->out_gpio = ret + gc->base; |
283 | return true; |
284 | diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h |
285 | index 2d90f96c19d0..7695b5dd9d2d 100644 |
286 | --- a/drivers/gpu/drm/i915/i915_reg.h |
287 | +++ b/drivers/gpu/drm/i915/i915_reg.h |
288 | @@ -317,6 +317,7 @@ |
289 | #define PIPE_CONTROL_GLOBAL_GTT_IVB (1<<24) /* gen7+ */ |
290 | #define PIPE_CONTROL_CS_STALL (1<<20) |
291 | #define PIPE_CONTROL_TLB_INVALIDATE (1<<18) |
292 | +#define PIPE_CONTROL_MEDIA_STATE_CLEAR (1<<16) |
293 | #define PIPE_CONTROL_QW_WRITE (1<<14) |
294 | #define PIPE_CONTROL_DEPTH_STALL (1<<13) |
295 | #define PIPE_CONTROL_WRITE_FLUSH (1<<12) |
296 | diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c |
297 | index 4605c3877c95..ef4cde15c15c 100644 |
298 | --- a/drivers/gpu/drm/i915/intel_ringbuffer.c |
299 | +++ b/drivers/gpu/drm/i915/intel_ringbuffer.c |
300 | @@ -314,12 +314,15 @@ gen7_render_ring_flush(struct intel_ring_buffer *ring, |
301 | flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE; |
302 | flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE; |
303 | flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE; |
304 | + flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR; |
305 | /* |
306 | * TLB invalidate requires a post-sync write. |
307 | */ |
308 | flags |= PIPE_CONTROL_QW_WRITE; |
309 | flags |= PIPE_CONTROL_GLOBAL_GTT_IVB; |
310 | |
311 | + flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD; |
312 | + |
313 | /* Workaround: we must issue a pipe_control with CS-stall bit |
314 | * set before a pipe_control command that has the state cache |
315 | * invalidate bit set. */ |
316 | diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c |
317 | index 4c05f2b015cf..d4a5118911fd 100644 |
318 | --- a/drivers/gpu/drm/radeon/atombios_dp.c |
319 | +++ b/drivers/gpu/drm/radeon/atombios_dp.c |
320 | @@ -574,6 +574,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector, |
321 | struct radeon_connector_atom_dig *dig_connector; |
322 | int dp_clock; |
323 | |
324 | + if ((mode->clock > 340000) && |
325 | + (!radeon_connector_is_dp12_capable(connector))) |
326 | + return MODE_CLOCK_HIGH; |
327 | + |
328 | if (!radeon_connector->con_priv) |
329 | return MODE_CLOCK_HIGH; |
330 | dig_connector = radeon_connector->con_priv; |
331 | diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c |
332 | index 6c0ce8915fac..4a14e113369d 100644 |
333 | --- a/drivers/gpu/drm/radeon/radeon_ttm.c |
334 | +++ b/drivers/gpu/drm/radeon/radeon_ttm.c |
335 | @@ -189,7 +189,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo, |
336 | rbo = container_of(bo, struct radeon_bo, tbo); |
337 | switch (bo->mem.mem_type) { |
338 | case TTM_PL_VRAM: |
339 | - if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false) |
340 | + if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false) |
341 | radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU); |
342 | else |
343 | radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT); |
344 | diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c |
345 | index c62d20e8a6f1..ee742f14ddc2 100644 |
346 | --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c |
347 | +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c |
348 | @@ -1049,6 +1049,8 @@ int vmw_event_fence_action_create(struct drm_file *file_priv, |
349 | if (ret != 0) |
350 | goto out_no_queue; |
351 | |
352 | + return 0; |
353 | + |
354 | out_no_queue: |
355 | event->base.destroy(&event->base); |
356 | out_no_event: |
357 | @@ -1123,17 +1125,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, |
358 | |
359 | BUG_ON(fence == NULL); |
360 | |
361 | - if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME) |
362 | - ret = vmw_event_fence_action_create(file_priv, fence, |
363 | - arg->flags, |
364 | - arg->user_data, |
365 | - true); |
366 | - else |
367 | - ret = vmw_event_fence_action_create(file_priv, fence, |
368 | - arg->flags, |
369 | - arg->user_data, |
370 | - true); |
371 | - |
372 | + ret = vmw_event_fence_action_create(file_priv, fence, |
373 | + arg->flags, |
374 | + arg->user_data, |
375 | + true); |
376 | if (unlikely(ret != 0)) { |
377 | if (ret != -ERESTARTSYS) |
378 | DRM_ERROR("Failed to attach event to fence.\n"); |
379 | diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h |
380 | index ce715b1bee46..78227f32d6fa 100644 |
381 | --- a/drivers/input/serio/i8042-x86ia64io.h |
382 | +++ b/drivers/input/serio/i8042-x86ia64io.h |
383 | @@ -408,6 +408,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { |
384 | }, |
385 | }, |
386 | { |
387 | + /* Acer Aspire 7738 */ |
388 | + .matches = { |
389 | + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), |
390 | + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"), |
391 | + }, |
392 | + }, |
393 | + { |
394 | /* Gericom Bellagio */ |
395 | .matches = { |
396 | DMI_MATCH(DMI_SYS_VENDOR, "Gericom"), |
397 | @@ -721,6 +728,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = { |
398 | { } |
399 | }; |
400 | |
401 | +/* |
402 | + * Some laptops need keyboard reset before probing for the trackpad to get |
403 | + * it detected, initialised & finally work. |
404 | + */ |
405 | +static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { |
406 | + { |
407 | + /* Gigabyte P35 v2 - Elantech touchpad */ |
408 | + .matches = { |
409 | + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), |
410 | + DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"), |
411 | + }, |
412 | + }, |
413 | + { |
414 | + /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */ |
415 | + .matches = { |
416 | + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), |
417 | + DMI_MATCH(DMI_PRODUCT_NAME, "X3"), |
418 | + }, |
419 | + }, |
420 | + { |
421 | + /* Gigabyte P34 - Elantech touchpad */ |
422 | + .matches = { |
423 | + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), |
424 | + DMI_MATCH(DMI_PRODUCT_NAME, "P34"), |
425 | + }, |
426 | + }, |
427 | + { } |
428 | +}; |
429 | + |
430 | #endif /* CONFIG_X86 */ |
431 | |
432 | #ifdef CONFIG_PNP |
433 | @@ -1001,6 +1037,9 @@ static int __init i8042_platform_init(void) |
434 | if (dmi_check_system(i8042_dmi_dritek_table)) |
435 | i8042_dritek = true; |
436 | |
437 | + if (dmi_check_system(i8042_dmi_kbdreset_table)) |
438 | + i8042_kbdreset = true; |
439 | + |
440 | /* |
441 | * A20 was already enabled during early kernel init. But some buggy |
442 | * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to |
443 | diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c |
444 | index 78e4de42efaa..9870c540e6fb 100644 |
445 | --- a/drivers/input/serio/i8042.c |
446 | +++ b/drivers/input/serio/i8042.c |
447 | @@ -67,6 +67,10 @@ static bool i8042_notimeout; |
448 | module_param_named(notimeout, i8042_notimeout, bool, 0); |
449 | MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042"); |
450 | |
451 | +static bool i8042_kbdreset; |
452 | +module_param_named(kbdreset, i8042_kbdreset, bool, 0); |
453 | +MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port"); |
454 | + |
455 | #ifdef CONFIG_X86 |
456 | static bool i8042_dritek; |
457 | module_param_named(dritek, i8042_dritek, bool, 0); |
458 | @@ -783,6 +787,16 @@ static int __init i8042_check_aux(void) |
459 | return -1; |
460 | |
461 | /* |
462 | + * Reset keyboard (needed on some laptops to successfully detect |
463 | + * touchpad, e.g., some Gigabyte laptop models with Elantech |
464 | + * touchpads). |
465 | + */ |
466 | + if (i8042_kbdreset) { |
467 | + pr_warn("Attempting to reset device connected to KBD port\n"); |
468 | + i8042_kbd_write(NULL, (unsigned char) 0xff); |
469 | + } |
470 | + |
471 | +/* |
472 | * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and |
473 | * used it for a PCI card or somethig else. |
474 | */ |
475 | diff --git a/drivers/media/i2c/smiapp-pll.c b/drivers/media/i2c/smiapp-pll.c |
476 | index d8d5da7c52db..942305129e15 100644 |
477 | --- a/drivers/media/i2c/smiapp-pll.c |
478 | +++ b/drivers/media/i2c/smiapp-pll.c |
479 | @@ -67,7 +67,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll) |
480 | { |
481 | dev_dbg(dev, "pre_pll_clk_div\t%d\n", pll->pre_pll_clk_div); |
482 | dev_dbg(dev, "pll_multiplier \t%d\n", pll->pll_multiplier); |
483 | - if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) { |
484 | + if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) { |
485 | dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div); |
486 | dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div); |
487 | } |
488 | @@ -77,7 +77,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll) |
489 | dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz); |
490 | dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz); |
491 | dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz); |
492 | - if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) { |
493 | + if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) { |
494 | dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n", |
495 | pll->op_sys_clk_freq_hz); |
496 | dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n", |
497 | diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c |
498 | index b280216de31b..de8bc35d8b0b 100644 |
499 | --- a/drivers/media/i2c/smiapp/smiapp-core.c |
500 | +++ b/drivers/media/i2c/smiapp/smiapp-core.c |
501 | @@ -2629,7 +2629,9 @@ static int smiapp_registered(struct v4l2_subdev *subdev) |
502 | pll->flags |= SMIAPP_PLL_FLAG_OP_PIX_CLOCK_PER_LANE; |
503 | pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN]; |
504 | |
505 | + mutex_lock(&sensor->mutex); |
506 | rval = smiapp_update_mode(sensor); |
507 | + mutex_unlock(&sensor->mutex); |
508 | if (rval) { |
509 | dev_err(&client->dev, "update mode failed\n"); |
510 | goto out_nvm_release; |
511 | diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c |
512 | index af176b6ce738..e6d3561eea47 100644 |
513 | --- a/drivers/media/usb/dvb-usb/af9005.c |
514 | +++ b/drivers/media/usb/dvb-usb/af9005.c |
515 | @@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init(void) |
516 | err("usb_register failed. (%d)", result); |
517 | return result; |
518 | } |
519 | +#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE) |
520 | + /* FIXME: convert to todays kernel IR infrastructure */ |
521 | rc_decode = symbol_request(af9005_rc_decode); |
522 | rc_keys = symbol_request(rc_map_af9005_table); |
523 | rc_keys_size = symbol_request(rc_map_af9005_table_size); |
524 | +#endif |
525 | if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) { |
526 | err("af9005_rc_decode function not found, disabling remote"); |
527 | af9005_properties.rc.legacy.rc_query = NULL; |
528 | diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c |
529 | index 5dbefa68b1d2..363cdbf4ac8d 100644 |
530 | --- a/drivers/media/usb/uvc/uvc_driver.c |
531 | +++ b/drivers/media/usb/uvc/uvc_driver.c |
532 | @@ -1603,12 +1603,12 @@ static void uvc_delete(struct uvc_device *dev) |
533 | { |
534 | struct list_head *p, *n; |
535 | |
536 | - usb_put_intf(dev->intf); |
537 | - usb_put_dev(dev->udev); |
538 | - |
539 | uvc_status_cleanup(dev); |
540 | uvc_ctrl_cleanup_device(dev); |
541 | |
542 | + usb_put_intf(dev->intf); |
543 | + usb_put_dev(dev->udev); |
544 | + |
545 | if (dev->vdev.dev) |
546 | v4l2_device_unregister(&dev->vdev); |
547 | #ifdef CONFIG_MEDIA_CONTROLLER |
548 | diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c |
549 | index 2ea429c27714..836e2ac36a0d 100644 |
550 | --- a/drivers/mmc/host/sdhci.c |
551 | +++ b/drivers/mmc/host/sdhci.c |
552 | @@ -1316,6 +1316,8 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq) |
553 | |
554 | sdhci_runtime_pm_get(host); |
555 | |
556 | + present = mmc_gpio_get_cd(host->mmc); |
557 | + |
558 | spin_lock_irqsave(&host->lock, flags); |
559 | |
560 | WARN_ON(host->mrq != NULL); |
561 | @@ -1344,7 +1346,6 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq) |
562 | * zero: cd-gpio is used, and card is removed |
563 | * one: cd-gpio is used, and card is present |
564 | */ |
565 | - present = mmc_gpio_get_cd(host->mmc); |
566 | if (present < 0) { |
567 | /* If polling, assume that the card is always present. */ |
568 | if (host->quirks & SDHCI_QUIRK_BROKEN_CARD_DETECTION) |
569 | diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c |
570 | index cc3df8aebb87..63fb90b006ba 100644 |
571 | --- a/drivers/net/can/usb/kvaser_usb.c |
572 | +++ b/drivers/net/can/usb/kvaser_usb.c |
573 | @@ -1238,6 +1238,9 @@ static int kvaser_usb_close(struct net_device *netdev) |
574 | if (err) |
575 | netdev_warn(netdev, "Cannot stop device, error %d\n", err); |
576 | |
577 | + /* reset tx contexts */ |
578 | + kvaser_usb_unlink_tx_urbs(priv); |
579 | + |
580 | priv->can.state = CAN_STATE_STOPPED; |
581 | close_candev(priv->netdev); |
582 | |
583 | @@ -1286,12 +1289,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, |
584 | if (!urb) { |
585 | netdev_err(netdev, "No memory left for URBs\n"); |
586 | stats->tx_dropped++; |
587 | - goto nourbmem; |
588 | + dev_kfree_skb(skb); |
589 | + return NETDEV_TX_OK; |
590 | } |
591 | |
592 | buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC); |
593 | if (!buf) { |
594 | stats->tx_dropped++; |
595 | + dev_kfree_skb(skb); |
596 | goto nobufmem; |
597 | } |
598 | |
599 | @@ -1326,6 +1331,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, |
600 | } |
601 | } |
602 | |
603 | + /* This should never happen; it implies a flow control bug */ |
604 | if (!context) { |
605 | netdev_warn(netdev, "cannot find free context\n"); |
606 | ret = NETDEV_TX_BUSY; |
607 | @@ -1356,9 +1362,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, |
608 | if (unlikely(err)) { |
609 | can_free_echo_skb(netdev, context->echo_index); |
610 | |
611 | - skb = NULL; /* set to NULL to avoid double free in |
612 | - * dev_kfree_skb(skb) */ |
613 | - |
614 | atomic_dec(&priv->active_tx_urbs); |
615 | usb_unanchor_urb(urb); |
616 | |
617 | @@ -1380,8 +1383,6 @@ releasebuf: |
618 | kfree(buf); |
619 | nobufmem: |
620 | usb_free_urb(urb); |
621 | -nourbmem: |
622 | - dev_kfree_skb(skb); |
623 | return ret; |
624 | } |
625 | |
626 | @@ -1493,6 +1494,10 @@ static int kvaser_usb_init_one(struct usb_interface *intf, |
627 | struct kvaser_usb_net_priv *priv; |
628 | int i, err; |
629 | |
630 | + err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel); |
631 | + if (err) |
632 | + return err; |
633 | + |
634 | netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS); |
635 | if (!netdev) { |
636 | dev_err(&intf->dev, "Cannot alloc candev\n"); |
637 | @@ -1596,9 +1601,6 @@ static int kvaser_usb_probe(struct usb_interface *intf, |
638 | |
639 | usb_set_intfdata(intf, dev); |
640 | |
641 | - for (i = 0; i < MAX_NET_DEVICES; i++) |
642 | - kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i); |
643 | - |
644 | err = kvaser_usb_get_software_info(dev); |
645 | if (err) { |
646 | dev_err(&intf->dev, |
647 | diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c |
648 | index d30085c2b454..a85a9c2f1385 100644 |
649 | --- a/drivers/net/ethernet/atheros/alx/main.c |
650 | +++ b/drivers/net/ethernet/atheros/alx/main.c |
651 | @@ -184,15 +184,16 @@ static void alx_schedule_reset(struct alx_priv *alx) |
652 | schedule_work(&alx->reset_wk); |
653 | } |
654 | |
655 | -static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) |
656 | +static int alx_clean_rx_irq(struct alx_priv *alx, int budget) |
657 | { |
658 | struct alx_rx_queue *rxq = &alx->rxq; |
659 | struct alx_rrd *rrd; |
660 | struct alx_buffer *rxb; |
661 | struct sk_buff *skb; |
662 | u16 length, rfd_cleaned = 0; |
663 | + int work = 0; |
664 | |
665 | - while (budget > 0) { |
666 | + while (work < budget) { |
667 | rrd = &rxq->rrd[rxq->rrd_read_idx]; |
668 | if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT))) |
669 | break; |
670 | @@ -203,7 +204,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) |
671 | ALX_GET_FIELD(le32_to_cpu(rrd->word0), |
672 | RRD_NOR) != 1) { |
673 | alx_schedule_reset(alx); |
674 | - return 0; |
675 | + return work; |
676 | } |
677 | |
678 | rxb = &rxq->bufs[rxq->read_idx]; |
679 | @@ -243,7 +244,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) |
680 | } |
681 | |
682 | napi_gro_receive(&alx->napi, skb); |
683 | - budget--; |
684 | + work++; |
685 | |
686 | next_pkt: |
687 | if (++rxq->read_idx == alx->rx_ringsz) |
688 | @@ -258,21 +259,22 @@ next_pkt: |
689 | if (rfd_cleaned) |
690 | alx_refill_rx_ring(alx, GFP_ATOMIC); |
691 | |
692 | - return budget > 0; |
693 | + return work; |
694 | } |
695 | |
696 | static int alx_poll(struct napi_struct *napi, int budget) |
697 | { |
698 | struct alx_priv *alx = container_of(napi, struct alx_priv, napi); |
699 | struct alx_hw *hw = &alx->hw; |
700 | - bool complete = true; |
701 | unsigned long flags; |
702 | + bool tx_complete; |
703 | + int work; |
704 | |
705 | - complete = alx_clean_tx_irq(alx) && |
706 | - alx_clean_rx_irq(alx, budget); |
707 | + tx_complete = alx_clean_tx_irq(alx); |
708 | + work = alx_clean_rx_irq(alx, budget); |
709 | |
710 | - if (!complete) |
711 | - return 1; |
712 | + if (!tx_complete || work == budget) |
713 | + return budget; |
714 | |
715 | napi_complete(&alx->napi); |
716 | |
717 | @@ -284,7 +286,7 @@ static int alx_poll(struct napi_struct *napi, int budget) |
718 | |
719 | alx_post_write(hw); |
720 | |
721 | - return 0; |
722 | + return work; |
723 | } |
724 | |
725 | static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr) |
726 | diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c |
727 | index 5501cad30cfa..8c1eab1151b8 100644 |
728 | --- a/drivers/net/ethernet/broadcom/tg3.c |
729 | +++ b/drivers/net/ethernet/broadcom/tg3.c |
730 | @@ -17389,23 +17389,6 @@ static int tg3_init_one(struct pci_dev *pdev, |
731 | goto err_out_apeunmap; |
732 | } |
733 | |
734 | - /* |
735 | - * Reset chip in case UNDI or EFI driver did not shutdown |
736 | - * DMA self test will enable WDMAC and we'll see (spurious) |
737 | - * pending DMA on the PCI bus at that point. |
738 | - */ |
739 | - if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) || |
740 | - (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) { |
741 | - tw32(MEMARB_MODE, MEMARB_MODE_ENABLE); |
742 | - tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); |
743 | - } |
744 | - |
745 | - err = tg3_test_dma(tp); |
746 | - if (err) { |
747 | - dev_err(&pdev->dev, "DMA engine test failed, aborting\n"); |
748 | - goto err_out_apeunmap; |
749 | - } |
750 | - |
751 | intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW; |
752 | rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW; |
753 | sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW; |
754 | @@ -17450,6 +17433,23 @@ static int tg3_init_one(struct pci_dev *pdev, |
755 | sndmbx += 0xc; |
756 | } |
757 | |
758 | + /* |
759 | + * Reset chip in case UNDI or EFI driver did not shutdown |
760 | + * DMA self test will enable WDMAC and we'll see (spurious) |
761 | + * pending DMA on the PCI bus at that point. |
762 | + */ |
763 | + if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) || |
764 | + (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) { |
765 | + tw32(MEMARB_MODE, MEMARB_MODE_ENABLE); |
766 | + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); |
767 | + } |
768 | + |
769 | + err = tg3_test_dma(tp); |
770 | + if (err) { |
771 | + dev_err(&pdev->dev, "DMA engine test failed, aborting\n"); |
772 | + goto err_out_apeunmap; |
773 | + } |
774 | + |
775 | tg3_init_coal(tp); |
776 | |
777 | pci_set_drvdata(pdev, dev); |
778 | diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c |
779 | index 635f55992d7e..8cc0eaa9d6f1 100644 |
780 | --- a/drivers/net/ethernet/cisco/enic/enic_main.c |
781 | +++ b/drivers/net/ethernet/cisco/enic/enic_main.c |
782 | @@ -1294,10 +1294,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq, |
783 | skb_put(skb, bytes_written); |
784 | skb->protocol = eth_type_trans(skb, netdev); |
785 | |
786 | - if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) { |
787 | - skb->csum = htons(checksum); |
788 | - skb->ip_summed = CHECKSUM_COMPLETE; |
789 | - } |
790 | + /* Hardware does not provide whole packet checksum. It only |
791 | + * provides pseudo checksum. Since hw validates the packet |
792 | + * checksum but not provide us the checksum value. use |
793 | + * CHECSUM_UNNECESSARY. |
794 | + */ |
795 | + if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok && |
796 | + ipv4_csum_ok) |
797 | + skb->ip_summed = CHECKSUM_UNNECESSARY; |
798 | |
799 | if (vlan_stripped) |
800 | __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci); |
801 | diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c |
802 | index 0ed96df20162..3458eb6fd491 100644 |
803 | --- a/drivers/platform/x86/hp_accel.c |
804 | +++ b/drivers/platform/x86/hp_accel.c |
805 | @@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = { |
806 | AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap), |
807 | AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap), |
808 | AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted), |
809 | + AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted), |
810 | { NULL, } |
811 | /* Laptop models without axis info (yet): |
812 | * "NC6910" "HP Compaq 6910" |
813 | diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c |
814 | index bb86494e2b7b..19915c5b256f 100644 |
815 | --- a/drivers/s390/char/con3215.c |
816 | +++ b/drivers/s390/char/con3215.c |
817 | @@ -288,12 +288,16 @@ static void raw3215_timeout(unsigned long __data) |
818 | unsigned long flags; |
819 | |
820 | spin_lock_irqsave(get_ccwdev_lock(raw->cdev), flags); |
821 | - if (raw->flags & RAW3215_TIMER_RUNS) { |
822 | - del_timer(&raw->timer); |
823 | - raw->flags &= ~RAW3215_TIMER_RUNS; |
824 | - if (!(raw->port.flags & ASYNC_SUSPENDED)) { |
825 | - raw3215_mk_write_req(raw); |
826 | - raw3215_start_io(raw); |
827 | + raw->flags &= ~RAW3215_TIMER_RUNS; |
828 | + if (!(raw->port.flags & ASYNC_SUSPENDED)) { |
829 | + raw3215_mk_write_req(raw); |
830 | + raw3215_start_io(raw); |
831 | + if ((raw->queued_read || raw->queued_write) && |
832 | + !(raw->flags & RAW3215_WORKING) && |
833 | + !(raw->flags & RAW3215_TIMER_RUNS)) { |
834 | + raw->timer.expires = RAW3215_TIMEOUT + jiffies; |
835 | + add_timer(&raw->timer); |
836 | + raw->flags |= RAW3215_TIMER_RUNS; |
837 | } |
838 | } |
839 | spin_unlock_irqrestore(get_ccwdev_lock(raw->cdev), flags); |
840 | @@ -317,17 +321,15 @@ static inline void raw3215_try_io(struct raw3215_info *raw) |
841 | (raw->flags & RAW3215_FLUSHING)) { |
842 | /* execute write requests bigger than minimum size */ |
843 | raw3215_start_io(raw); |
844 | - if (raw->flags & RAW3215_TIMER_RUNS) { |
845 | - del_timer(&raw->timer); |
846 | - raw->flags &= ~RAW3215_TIMER_RUNS; |
847 | - } |
848 | - } else if (!(raw->flags & RAW3215_TIMER_RUNS)) { |
849 | - /* delay small writes */ |
850 | - raw->timer.expires = RAW3215_TIMEOUT + jiffies; |
851 | - add_timer(&raw->timer); |
852 | - raw->flags |= RAW3215_TIMER_RUNS; |
853 | } |
854 | } |
855 | + if ((raw->queued_read || raw->queued_write) && |
856 | + !(raw->flags & RAW3215_WORKING) && |
857 | + !(raw->flags & RAW3215_TIMER_RUNS)) { |
858 | + raw->timer.expires = RAW3215_TIMEOUT + jiffies; |
859 | + add_timer(&raw->timer); |
860 | + raw->flags |= RAW3215_TIMER_RUNS; |
861 | + } |
862 | } |
863 | |
864 | /* |
865 | @@ -1027,12 +1029,26 @@ static int tty3215_write(struct tty_struct * tty, |
866 | const unsigned char *buf, int count) |
867 | { |
868 | struct raw3215_info *raw; |
869 | + int i, written; |
870 | |
871 | if (!tty) |
872 | return 0; |
873 | raw = (struct raw3215_info *) tty->driver_data; |
874 | - raw3215_write(raw, buf, count); |
875 | - return count; |
876 | + written = count; |
877 | + while (count > 0) { |
878 | + for (i = 0; i < count; i++) |
879 | + if (buf[i] == '\t' || buf[i] == '\n') |
880 | + break; |
881 | + raw3215_write(raw, buf, i); |
882 | + count -= i; |
883 | + buf += i; |
884 | + if (count > 0) { |
885 | + raw3215_putchar(raw, *buf); |
886 | + count--; |
887 | + buf++; |
888 | + } |
889 | + } |
890 | + return written; |
891 | } |
892 | |
893 | /* |
894 | @@ -1180,7 +1196,7 @@ static int __init tty3215_init(void) |
895 | driver->subtype = SYSTEM_TYPE_TTY; |
896 | driver->init_termios = tty_std_termios; |
897 | driver->init_termios.c_iflag = IGNBRK | IGNPAR; |
898 | - driver->init_termios.c_oflag = ONLCR | XTABS; |
899 | + driver->init_termios.c_oflag = ONLCR; |
900 | driver->init_termios.c_lflag = ISIG; |
901 | driver->flags = TTY_DRIVER_REAL_RAW; |
902 | tty_set_operations(driver, &tty3215_ops); |
903 | diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c |
904 | index 87ca72d36d5b..a8990783ba66 100644 |
905 | --- a/drivers/scsi/storvsc_drv.c |
906 | +++ b/drivers/scsi/storvsc_drv.c |
907 | @@ -1439,13 +1439,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) |
908 | if (ret == -EAGAIN) { |
909 | /* no more space */ |
910 | |
911 | - if (cmd_request->bounce_sgl_count) { |
912 | + if (cmd_request->bounce_sgl_count) |
913 | destroy_bounce_buffer(cmd_request->bounce_sgl, |
914 | cmd_request->bounce_sgl_count); |
915 | |
916 | - ret = SCSI_MLQUEUE_DEVICE_BUSY; |
917 | - goto queue_error; |
918 | - } |
919 | + ret = SCSI_MLQUEUE_DEVICE_BUSY; |
920 | + goto queue_error; |
921 | } |
922 | |
923 | return 0; |
924 | diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c |
925 | index c9790f6fdd89..016e882356d6 100644 |
926 | --- a/drivers/target/iscsi/iscsi_target_util.c |
927 | +++ b/drivers/target/iscsi/iscsi_target_util.c |
928 | @@ -1349,15 +1349,15 @@ static int iscsit_do_tx_data( |
929 | struct iscsi_conn *conn, |
930 | struct iscsi_data_count *count) |
931 | { |
932 | - int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len; |
933 | + int ret, iov_len; |
934 | struct kvec *iov_p; |
935 | struct msghdr msg; |
936 | |
937 | if (!conn || !conn->sock || !conn->conn_ops) |
938 | return -1; |
939 | |
940 | - if (data <= 0) { |
941 | - pr_err("Data length is: %d\n", data); |
942 | + if (count->data_length <= 0) { |
943 | + pr_err("Data length is: %d\n", count->data_length); |
944 | return -1; |
945 | } |
946 | |
947 | @@ -1366,20 +1366,16 @@ static int iscsit_do_tx_data( |
948 | iov_p = count->iov; |
949 | iov_len = count->iov_count; |
950 | |
951 | - while (total_tx < data) { |
952 | - tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, |
953 | - (data - total_tx)); |
954 | - if (tx_loop <= 0) { |
955 | - pr_debug("tx_loop: %d total_tx %d\n", |
956 | - tx_loop, total_tx); |
957 | - return tx_loop; |
958 | - } |
959 | - total_tx += tx_loop; |
960 | - pr_debug("tx_loop: %d, total_tx: %d, data: %d\n", |
961 | - tx_loop, total_tx, data); |
962 | + ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, |
963 | + count->data_length); |
964 | + if (ret != count->data_length) { |
965 | + pr_err("Unexpected ret: %d send data %d\n", |
966 | + ret, count->data_length); |
967 | + return -EPIPE; |
968 | } |
969 | + pr_debug("ret: %d, sent data: %d\n", ret, count->data_length); |
970 | |
971 | - return total_tx; |
972 | + return ret; |
973 | } |
974 | |
975 | int rx_data( |
976 | diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c |
977 | index 8f8e75e392de..87f8fc63b3e1 100644 |
978 | --- a/drivers/usb/dwc3/gadget.c |
979 | +++ b/drivers/usb/dwc3/gadget.c |
980 | @@ -907,8 +907,7 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting) |
981 | |
982 | if (i == (request->num_mapped_sgs - 1) || |
983 | sg_is_last(s)) { |
984 | - if (list_is_last(&req->list, |
985 | - &dep->request_list)) |
986 | + if (list_empty(&dep->request_list)) |
987 | last_one = true; |
988 | chain = false; |
989 | } |
990 | @@ -926,6 +925,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting) |
991 | if (last_one) |
992 | break; |
993 | } |
994 | + |
995 | + if (last_one) |
996 | + break; |
997 | } else { |
998 | dma = req->request.dma; |
999 | length = req->request.length; |
1000 | diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c |
1001 | index 9cfe3af3101a..66c905884496 100644 |
1002 | --- a/drivers/usb/host/pci-quirks.c |
1003 | +++ b/drivers/usb/host/pci-quirks.c |
1004 | @@ -470,7 +470,8 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) |
1005 | { |
1006 | void __iomem *base; |
1007 | u32 control; |
1008 | - u32 fminterval; |
1009 | + u32 fminterval = 0; |
1010 | + bool no_fminterval = false; |
1011 | int cnt; |
1012 | |
1013 | if (!mmio_resource_enabled(pdev, 0)) |
1014 | @@ -480,6 +481,13 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) |
1015 | if (base == NULL) |
1016 | return; |
1017 | |
1018 | + /* |
1019 | + * ULi M5237 OHCI controller locks the whole system when accessing |
1020 | + * the OHCI_FMINTERVAL offset. |
1021 | + */ |
1022 | + if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237) |
1023 | + no_fminterval = true; |
1024 | + |
1025 | control = readl(base + OHCI_CONTROL); |
1026 | |
1027 | /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */ |
1028 | @@ -518,7 +526,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) |
1029 | } |
1030 | |
1031 | /* software reset of the controller, preserving HcFmInterval */ |
1032 | - fminterval = readl(base + OHCI_FMINTERVAL); |
1033 | + if (!no_fminterval) |
1034 | + fminterval = readl(base + OHCI_FMINTERVAL); |
1035 | + |
1036 | writel(OHCI_HCR, base + OHCI_CMDSTATUS); |
1037 | |
1038 | /* reset requires max 10 us delay */ |
1039 | @@ -527,7 +537,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) |
1040 | break; |
1041 | udelay(1); |
1042 | } |
1043 | - writel(fminterval, base + OHCI_FMINTERVAL); |
1044 | + |
1045 | + if (!no_fminterval) |
1046 | + writel(fminterval, base + OHCI_FMINTERVAL); |
1047 | |
1048 | /* Now the controller is safely in SUSPEND and nothing can wake it up */ |
1049 | iounmap(base); |
1050 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c |
1051 | index a24714f6f88f..8e15acd204ef 100644 |
1052 | --- a/drivers/usb/serial/cp210x.c |
1053 | +++ b/drivers/usb/serial/cp210x.c |
1054 | @@ -120,10 +120,12 @@ static const struct usb_device_id id_table[] = { |
1055 | { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ |
1056 | { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ |
1057 | { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ |
1058 | - { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */ |
1059 | + { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */ |
1060 | + { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ |
1061 | { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ |
1062 | { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ |
1063 | { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ |
1064 | + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ |
1065 | { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ |
1066 | { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ |
1067 | { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ |
1068 | diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c |
1069 | index f0e65c970d35..cec377b8bb8b 100644 |
1070 | --- a/drivers/usb/serial/keyspan.c |
1071 | +++ b/drivers/usb/serial/keyspan.c |
1072 | @@ -418,6 +418,8 @@ static void usa26_instat_callback(struct urb *urb) |
1073 | } |
1074 | port = serial->port[msg->port]; |
1075 | p_priv = usb_get_serial_port_data(port); |
1076 | + if (!p_priv) |
1077 | + goto resubmit; |
1078 | |
1079 | /* Update handshaking pin state information */ |
1080 | old_dcd_state = p_priv->dcd_state; |
1081 | @@ -428,7 +430,7 @@ static void usa26_instat_callback(struct urb *urb) |
1082 | |
1083 | if (old_dcd_state != p_priv->dcd_state) |
1084 | tty_port_tty_hangup(&port->port, true); |
1085 | - |
1086 | +resubmit: |
1087 | /* Resubmit urb so we continue receiving */ |
1088 | err = usb_submit_urb(urb, GFP_ATOMIC); |
1089 | if (err != 0) |
1090 | @@ -543,6 +545,8 @@ static void usa28_instat_callback(struct urb *urb) |
1091 | } |
1092 | port = serial->port[msg->port]; |
1093 | p_priv = usb_get_serial_port_data(port); |
1094 | + if (!p_priv) |
1095 | + goto resubmit; |
1096 | |
1097 | /* Update handshaking pin state information */ |
1098 | old_dcd_state = p_priv->dcd_state; |
1099 | @@ -553,7 +557,7 @@ static void usa28_instat_callback(struct urb *urb) |
1100 | |
1101 | if (old_dcd_state != p_priv->dcd_state && old_dcd_state) |
1102 | tty_port_tty_hangup(&port->port, true); |
1103 | - |
1104 | +resubmit: |
1105 | /* Resubmit urb so we continue receiving */ |
1106 | err = usb_submit_urb(urb, GFP_ATOMIC); |
1107 | if (err != 0) |
1108 | @@ -630,6 +634,8 @@ static void usa49_instat_callback(struct urb *urb) |
1109 | } |
1110 | port = serial->port[msg->portNumber]; |
1111 | p_priv = usb_get_serial_port_data(port); |
1112 | + if (!p_priv) |
1113 | + goto resubmit; |
1114 | |
1115 | /* Update handshaking pin state information */ |
1116 | old_dcd_state = p_priv->dcd_state; |
1117 | @@ -640,7 +646,7 @@ static void usa49_instat_callback(struct urb *urb) |
1118 | |
1119 | if (old_dcd_state != p_priv->dcd_state && old_dcd_state) |
1120 | tty_port_tty_hangup(&port->port, true); |
1121 | - |
1122 | +resubmit: |
1123 | /* Resubmit urb so we continue receiving */ |
1124 | err = usb_submit_urb(urb, GFP_ATOMIC); |
1125 | if (err != 0) |
1126 | @@ -878,6 +884,8 @@ static void usa90_instat_callback(struct urb *urb) |
1127 | |
1128 | port = serial->port[0]; |
1129 | p_priv = usb_get_serial_port_data(port); |
1130 | + if (!p_priv) |
1131 | + goto resubmit; |
1132 | |
1133 | /* Update handshaking pin state information */ |
1134 | old_dcd_state = p_priv->dcd_state; |
1135 | @@ -888,7 +896,7 @@ static void usa90_instat_callback(struct urb *urb) |
1136 | |
1137 | if (old_dcd_state != p_priv->dcd_state && old_dcd_state) |
1138 | tty_port_tty_hangup(&port->port, true); |
1139 | - |
1140 | +resubmit: |
1141 | /* Resubmit urb so we continue receiving */ |
1142 | err = usb_submit_urb(urb, GFP_ATOMIC); |
1143 | if (err != 0) |
1144 | @@ -949,6 +957,8 @@ static void usa67_instat_callback(struct urb *urb) |
1145 | |
1146 | port = serial->port[msg->port]; |
1147 | p_priv = usb_get_serial_port_data(port); |
1148 | + if (!p_priv) |
1149 | + goto resubmit; |
1150 | |
1151 | /* Update handshaking pin state information */ |
1152 | old_dcd_state = p_priv->dcd_state; |
1153 | @@ -957,7 +967,7 @@ static void usa67_instat_callback(struct urb *urb) |
1154 | |
1155 | if (old_dcd_state != p_priv->dcd_state && old_dcd_state) |
1156 | tty_port_tty_hangup(&port->port, true); |
1157 | - |
1158 | +resubmit: |
1159 | /* Resubmit urb so we continue receiving */ |
1160 | err = usb_submit_urb(urb, GFP_ATOMIC); |
1161 | if (err != 0) |
1162 | diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c |
1163 | index ac3725440d64..dc55bc254c5c 100644 |
1164 | --- a/drivers/vfio/pci/vfio_pci.c |
1165 | +++ b/drivers/vfio/pci/vfio_pci.c |
1166 | @@ -519,13 +519,11 @@ static const struct vfio_device_ops vfio_pci_ops = { |
1167 | |
1168 | static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) |
1169 | { |
1170 | - u8 type; |
1171 | struct vfio_pci_device *vdev; |
1172 | struct iommu_group *group; |
1173 | int ret; |
1174 | |
1175 | - pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type); |
1176 | - if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) |
1177 | + if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL) |
1178 | return -EINVAL; |
1179 | |
1180 | group = iommu_group_get(&pdev->dev); |
1181 | diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c |
1182 | index 080c35b34bbb..cc5dbb5b2f71 100644 |
1183 | --- a/drivers/video/logo/logo.c |
1184 | +++ b/drivers/video/logo/logo.c |
1185 | @@ -25,6 +25,21 @@ static bool nologo; |
1186 | module_param(nologo, bool, 0); |
1187 | MODULE_PARM_DESC(nologo, "Disables startup logo"); |
1188 | |
1189 | +/* |
1190 | + * Logos are located in the initdata, and will be freed in kernel_init. |
1191 | + * Use late_init to mark the logos as freed to prevent any further use. |
1192 | + */ |
1193 | + |
1194 | +static bool logos_freed; |
1195 | + |
1196 | +static int __init fb_logo_late_init(void) |
1197 | +{ |
1198 | + logos_freed = true; |
1199 | + return 0; |
1200 | +} |
1201 | + |
1202 | +late_initcall(fb_logo_late_init); |
1203 | + |
1204 | /* logo's are marked __initdata. Use __init_refok to tell |
1205 | * modpost that it is intended that this function uses data |
1206 | * marked __initdata. |
1207 | @@ -33,7 +48,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth) |
1208 | { |
1209 | const struct linux_logo *logo = NULL; |
1210 | |
1211 | - if (nologo) |
1212 | + if (nologo || logos_freed) |
1213 | return NULL; |
1214 | |
1215 | if (depth >= 1) { |
1216 | diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c |
1217 | index 9c8a5a6d33df..7a318480ab7a 100644 |
1218 | --- a/fs/lockd/svc.c |
1219 | +++ b/fs/lockd/svc.c |
1220 | @@ -137,10 +137,6 @@ lockd(void *vrqstp) |
1221 | |
1222 | dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n"); |
1223 | |
1224 | - if (!nlm_timeout) |
1225 | - nlm_timeout = LOCKD_DFLT_TIMEO; |
1226 | - nlmsvc_timeout = nlm_timeout * HZ; |
1227 | - |
1228 | /* |
1229 | * The main request loop. We don't terminate until the last |
1230 | * NFS mount or NFS daemon has gone away. |
1231 | @@ -346,6 +342,10 @@ static struct svc_serv *lockd_create_svc(void) |
1232 | printk(KERN_WARNING |
1233 | "lockd_up: no pid, %d users??\n", nlmsvc_users); |
1234 | |
1235 | + if (!nlm_timeout) |
1236 | + nlm_timeout = LOCKD_DFLT_TIMEO; |
1237 | + nlmsvc_timeout = nlm_timeout * HZ; |
1238 | + |
1239 | serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, NULL); |
1240 | if (!serv) { |
1241 | printk(KERN_WARNING "lockd_up: create service failed\n"); |
1242 | diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c |
1243 | index cc143ee7a56e..519833d0457e 100644 |
1244 | --- a/fs/nfs/nfs4client.c |
1245 | +++ b/fs/nfs/nfs4client.c |
1246 | @@ -394,20 +394,14 @@ static bool nfs4_match_clientids(struct nfs_client *a, struct nfs_client *b) |
1247 | } |
1248 | |
1249 | /* |
1250 | - * Returns true if the server owners match |
1251 | + * Returns true if the server major ids match |
1252 | */ |
1253 | static bool |
1254 | -nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b) |
1255 | +nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b) |
1256 | { |
1257 | struct nfs41_server_owner *o1 = a->cl_serverowner; |
1258 | struct nfs41_server_owner *o2 = b->cl_serverowner; |
1259 | |
1260 | - if (o1->minor_id != o2->minor_id) { |
1261 | - dprintk("NFS: --> %s server owner minor IDs do not match\n", |
1262 | - __func__); |
1263 | - return false; |
1264 | - } |
1265 | - |
1266 | if (o1->major_id_sz != o2->major_id_sz) |
1267 | goto out_major_mismatch; |
1268 | if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0) |
1269 | @@ -483,7 +477,12 @@ int nfs41_walk_client_list(struct nfs_client *new, |
1270 | if (!nfs4_match_clientids(pos, new)) |
1271 | continue; |
1272 | |
1273 | - if (!nfs4_match_serverowners(pos, new)) |
1274 | + /* |
1275 | + * Note that session trunking is just a special subcase of |
1276 | + * client id trunking. In either case, we want to fall back |
1277 | + * to using the existing nfs_client. |
1278 | + */ |
1279 | + if (!nfs4_check_clientid_trunking(pos, new)) |
1280 | continue; |
1281 | |
1282 | atomic_inc(&pos->cl_count); |
1283 | diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c |
1284 | index 74825be65b7b..fbb9dfb7b1d2 100644 |
1285 | --- a/fs/notify/inode_mark.c |
1286 | +++ b/fs/notify/inode_mark.c |
1287 | @@ -288,20 +288,25 @@ void fsnotify_unmount_inodes(struct list_head *list) |
1288 | spin_unlock(&inode->i_lock); |
1289 | |
1290 | /* In case the dropping of a reference would nuke next_i. */ |
1291 | - if ((&next_i->i_sb_list != list) && |
1292 | - atomic_read(&next_i->i_count)) { |
1293 | + while (&next_i->i_sb_list != list) { |
1294 | spin_lock(&next_i->i_lock); |
1295 | - if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) { |
1296 | + if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) && |
1297 | + atomic_read(&next_i->i_count)) { |
1298 | __iget(next_i); |
1299 | need_iput = next_i; |
1300 | + spin_unlock(&next_i->i_lock); |
1301 | + break; |
1302 | } |
1303 | spin_unlock(&next_i->i_lock); |
1304 | + next_i = list_entry(next_i->i_sb_list.next, |
1305 | + struct inode, i_sb_list); |
1306 | } |
1307 | |
1308 | /* |
1309 | - * We can safely drop inode_sb_list_lock here because we hold |
1310 | - * references on both inode and next_i. Also no new inodes |
1311 | - * will be added since the umount has begun. |
1312 | + * We can safely drop inode_sb_list_lock here because either |
1313 | + * we actually hold references on both inode and next_i or |
1314 | + * end of list. Also no new inodes will be added since the |
1315 | + * umount has begun. |
1316 | */ |
1317 | spin_unlock(&inode_sb_list_lock); |
1318 | |
1319 | diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c |
1320 | index 31c5f7675fbf..f504027d66a8 100644 |
1321 | --- a/lib/decompress_bunzip2.c |
1322 | +++ b/lib/decompress_bunzip2.c |
1323 | @@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd) |
1324 | if (get_bits(bd, 1)) |
1325 | return RETVAL_OBSOLETE_INPUT; |
1326 | origPtr = get_bits(bd, 24); |
1327 | - if (origPtr > dbufSize) |
1328 | + if (origPtr >= dbufSize) |
1329 | return RETVAL_DATA_ERROR; |
1330 | /* mapping table: if some byte values are never used (encoding things |
1331 | like ascii text), the compression code removes the gaps to have fewer |
1332 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
1333 | index 11ef25c9cf43..923146c4f007 100644 |
1334 | --- a/net/ipv4/tcp_output.c |
1335 | +++ b/net/ipv4/tcp_output.c |
1336 | @@ -1862,7 +1862,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, |
1337 | if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now))) |
1338 | break; |
1339 | |
1340 | - if (tso_segs == 1) { |
1341 | + if (tso_segs == 1 || !sk->sk_gso_max_segs) { |
1342 | if (unlikely(!tcp_nagle_test(tp, skb, mss_now, |
1343 | (tcp_skb_is_last(sk, skb) ? |
1344 | nonagle : TCP_NAGLE_PUSH)))) |
1345 | @@ -1899,7 +1899,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, |
1346 | } |
1347 | |
1348 | limit = mss_now; |
1349 | - if (tso_segs > 1 && !tcp_urg_mode(tp)) |
1350 | + if (tso_segs > 1 && sk->sk_gso_max_segs && !tcp_urg_mode(tp)) |
1351 | limit = tcp_mss_split_point(sk, skb, mss_now, |
1352 | min_t(unsigned int, |
1353 | cwnd_quota, |
1354 | diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c |
1355 | index f77139007983..3b04dfd34554 100644 |
1356 | --- a/net/netfilter/ipset/ip_set_core.c |
1357 | +++ b/net/netfilter/ipset/ip_set_core.c |
1358 | @@ -1754,6 +1754,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) |
1359 | if (*op < IP_SET_OP_VERSION) { |
1360 | /* Check the version at the beginning of operations */ |
1361 | struct ip_set_req_version *req_version = data; |
1362 | + |
1363 | + if (*len < sizeof(struct ip_set_req_version)) { |
1364 | + ret = -EINVAL; |
1365 | + goto done; |
1366 | + } |
1367 | + |
1368 | if (req_version->version != IPSET_PROTOCOL) { |
1369 | ret = -EPROTO; |
1370 | goto done; |
1371 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c |
1372 | index afe41178c9fb..f7ad5c630b65 100644 |
1373 | --- a/net/netlink/af_netlink.c |
1374 | +++ b/net/netlink/af_netlink.c |
1375 | @@ -374,14 +374,14 @@ out: |
1376 | return err; |
1377 | } |
1378 | |
1379 | -static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr) |
1380 | +static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len) |
1381 | { |
1382 | #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1 |
1383 | struct page *p_start, *p_end; |
1384 | |
1385 | /* First page is flushed through netlink_{get,set}_status */ |
1386 | p_start = pgvec_to_page(hdr + PAGE_SIZE); |
1387 | - p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1); |
1388 | + p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1); |
1389 | while (p_start <= p_end) { |
1390 | flush_dcache_page(p_start); |
1391 | p_start++; |
1392 | @@ -399,9 +399,9 @@ static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr) |
1393 | static void netlink_set_status(struct nl_mmap_hdr *hdr, |
1394 | enum nl_mmap_status status) |
1395 | { |
1396 | + smp_mb(); |
1397 | hdr->nm_status = status; |
1398 | flush_dcache_page(pgvec_to_page(hdr)); |
1399 | - smp_wmb(); |
1400 | } |
1401 | |
1402 | static struct nl_mmap_hdr * |
1403 | @@ -563,24 +563,16 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, |
1404 | struct nl_mmap_hdr *hdr; |
1405 | struct sk_buff *skb; |
1406 | unsigned int maxlen; |
1407 | - bool excl = true; |
1408 | int err = 0, len = 0; |
1409 | |
1410 | - /* Netlink messages are validated by the receiver before processing. |
1411 | - * In order to avoid userspace changing the contents of the message |
1412 | - * after validation, the socket and the ring may only be used by a |
1413 | - * single process, otherwise we fall back to copying. |
1414 | - */ |
1415 | - if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 || |
1416 | - atomic_read(&nlk->mapped) > 1) |
1417 | - excl = false; |
1418 | - |
1419 | mutex_lock(&nlk->pg_vec_lock); |
1420 | |
1421 | ring = &nlk->tx_ring; |
1422 | maxlen = ring->frame_size - NL_MMAP_HDRLEN; |
1423 | |
1424 | do { |
1425 | + unsigned int nm_len; |
1426 | + |
1427 | hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID); |
1428 | if (hdr == NULL) { |
1429 | if (!(msg->msg_flags & MSG_DONTWAIT) && |
1430 | @@ -588,35 +580,23 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, |
1431 | schedule(); |
1432 | continue; |
1433 | } |
1434 | - if (hdr->nm_len > maxlen) { |
1435 | + |
1436 | + nm_len = ACCESS_ONCE(hdr->nm_len); |
1437 | + if (nm_len > maxlen) { |
1438 | err = -EINVAL; |
1439 | goto out; |
1440 | } |
1441 | |
1442 | - netlink_frame_flush_dcache(hdr); |
1443 | + netlink_frame_flush_dcache(hdr, nm_len); |
1444 | |
1445 | - if (likely(dst_portid == 0 && dst_group == 0 && excl)) { |
1446 | - skb = alloc_skb_head(GFP_KERNEL); |
1447 | - if (skb == NULL) { |
1448 | - err = -ENOBUFS; |
1449 | - goto out; |
1450 | - } |
1451 | - sock_hold(sk); |
1452 | - netlink_ring_setup_skb(skb, sk, ring, hdr); |
1453 | - NETLINK_CB(skb).flags |= NETLINK_SKB_TX; |
1454 | - __skb_put(skb, hdr->nm_len); |
1455 | - netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED); |
1456 | - atomic_inc(&ring->pending); |
1457 | - } else { |
1458 | - skb = alloc_skb(hdr->nm_len, GFP_KERNEL); |
1459 | - if (skb == NULL) { |
1460 | - err = -ENOBUFS; |
1461 | - goto out; |
1462 | - } |
1463 | - __skb_put(skb, hdr->nm_len); |
1464 | - memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len); |
1465 | - netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); |
1466 | + skb = alloc_skb(nm_len, GFP_KERNEL); |
1467 | + if (skb == NULL) { |
1468 | + err = -ENOBUFS; |
1469 | + goto out; |
1470 | } |
1471 | + __skb_put(skb, nm_len); |
1472 | + memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len); |
1473 | + netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); |
1474 | |
1475 | netlink_increment_head(ring); |
1476 | |
1477 | @@ -662,7 +642,7 @@ static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb) |
1478 | hdr->nm_pid = NETLINK_CB(skb).creds.pid; |
1479 | hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); |
1480 | hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); |
1481 | - netlink_frame_flush_dcache(hdr); |
1482 | + netlink_frame_flush_dcache(hdr, hdr->nm_len); |
1483 | netlink_set_status(hdr, NL_MMAP_STATUS_VALID); |
1484 | |
1485 | NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED; |
1486 | diff --git a/net/wireless/chan.c b/net/wireless/chan.c |
1487 | index fd556ac05fdb..e69a17da1e84 100644 |
1488 | --- a/net/wireless/chan.c |
1489 | +++ b/net/wireless/chan.c |
1490 | @@ -338,7 +338,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, |
1491 | { |
1492 | struct ieee80211_sta_ht_cap *ht_cap; |
1493 | struct ieee80211_sta_vht_cap *vht_cap; |
1494 | - u32 width, control_freq; |
1495 | + u32 width, control_freq, cap; |
1496 | |
1497 | if (WARN_ON(!cfg80211_chandef_valid(chandef))) |
1498 | return false; |
1499 | @@ -370,7 +370,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, |
1500 | return false; |
1501 | break; |
1502 | case NL80211_CHAN_WIDTH_80P80: |
1503 | - if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)) |
1504 | + cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK; |
1505 | + if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) |
1506 | return false; |
1507 | case NL80211_CHAN_WIDTH_80: |
1508 | if (!vht_cap->vht_supported) |
1509 | @@ -381,7 +382,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, |
1510 | case NL80211_CHAN_WIDTH_160: |
1511 | if (!vht_cap->vht_supported) |
1512 | return false; |
1513 | - if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ)) |
1514 | + cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK; |
1515 | + if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ && |
1516 | + cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) |
1517 | return false; |
1518 | prohibited_flags |= IEEE80211_CHAN_NO_160MHZ; |
1519 | width = 160; |