1 |
commit: b9305a6beafce412577420e88ff20213fd71c7f0 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sun Jan 31 23:15:32 2016 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Jan 31 23:15:32 2016 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b9305a6b |
7 |
|
8 |
Linux Patch 3.10.96 |
9 |
|
10 |
0000_README | 4 + |
11 |
1095_linux-3.10.96.patch | 1497 ++++++++++++++++++++++++++++++++++++++++++++++ |
12 |
2 files changed, 1501 insertions(+) |
13 |
|
14 |
diff --git a/0000_README b/0000_README |
15 |
index 0edba9c..19931f8 100644 |
16 |
--- a/0000_README |
17 |
+++ b/0000_README |
18 |
@@ -422,6 +422,10 @@ Patch: 1094_linux-3.10.95.patch |
19 |
From: http://www.kernel.org |
20 |
Desc: Linux 3.10.95 |
21 |
|
22 |
+Patch: 1095_linux-3.10.96.patch |
23 |
+From: http://www.kernel.org |
24 |
+Desc: Linux 3.10.96 |
25 |
+ |
26 |
Patch: 1500_XATTR_USER_PREFIX.patch |
27 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
28 |
Desc: Support for namespace user.pax.* on tmpfs. |
29 |
|
30 |
diff --git a/1095_linux-3.10.96.patch b/1095_linux-3.10.96.patch |
31 |
new file mode 100644 |
32 |
index 0000000..6c35ece |
33 |
--- /dev/null |
34 |
+++ b/1095_linux-3.10.96.patch |
35 |
@@ -0,0 +1,1497 @@ |
36 |
+diff --git a/Makefile b/Makefile |
37 |
+index eb120001bc12..c88ea5d8d19c 100644 |
38 |
+--- a/Makefile |
39 |
++++ b/Makefile |
40 |
+@@ -1,6 +1,6 @@ |
41 |
+ VERSION = 3 |
42 |
+ PATCHLEVEL = 10 |
43 |
+-SUBLEVEL = 95 |
44 |
++SUBLEVEL = 96 |
45 |
+ EXTRAVERSION = |
46 |
+ NAME = TOSSUG Baby Fish |
47 |
+ |
48 |
+diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c |
49 |
+index 33a74fc45959..dfad98fda4f8 100644 |
50 |
+--- a/arch/arm64/kernel/ptrace.c |
51 |
++++ b/arch/arm64/kernel/ptrace.c |
52 |
+@@ -51,6 +51,12 @@ |
53 |
+ */ |
54 |
+ void ptrace_disable(struct task_struct *child) |
55 |
+ { |
56 |
++ /* |
57 |
++ * This would be better off in core code, but PTRACE_DETACH has |
58 |
++ * grown its fair share of arch-specific worts and changing it |
59 |
++ * is likely to cause regressions on obscure architectures. |
60 |
++ */ |
61 |
++ user_disable_single_step(child); |
62 |
+ } |
63 |
+ |
64 |
+ /* |
65 |
+diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c |
66 |
+index ba7477efad5c..5b77586ef0af 100644 |
67 |
+--- a/arch/arm64/mm/mmu.c |
68 |
++++ b/arch/arm64/mm/mmu.c |
69 |
+@@ -348,6 +348,9 @@ void __init paging_init(void) |
70 |
+ |
71 |
+ empty_zero_page = virt_to_page(zero_page); |
72 |
+ |
73 |
++ /* Ensure the zero page is visible to the page table walker */ |
74 |
++ dsb(); |
75 |
++ |
76 |
+ /* |
77 |
+ * TTBR0 is only used for the identity mapping at this stage. Make it |
78 |
+ * point to zero page to avoid speculatively fetching new entries. |
79 |
+diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig |
80 |
+index 428da175d073..31b91602f055 100644 |
81 |
+--- a/arch/mn10300/Kconfig |
82 |
++++ b/arch/mn10300/Kconfig |
83 |
+@@ -2,6 +2,7 @@ config MN10300 |
84 |
+ def_bool y |
85 |
+ select HAVE_OPROFILE |
86 |
+ select HAVE_GENERIC_HARDIRQS |
87 |
++ select HAVE_UID16 |
88 |
+ select GENERIC_IRQ_SHOW |
89 |
+ select ARCH_WANT_IPC_PARSE_VERSION |
90 |
+ select HAVE_ARCH_TRACEHOOK |
91 |
+@@ -37,9 +38,6 @@ config HIGHMEM |
92 |
+ config NUMA |
93 |
+ def_bool n |
94 |
+ |
95 |
+-config UID16 |
96 |
+- def_bool y |
97 |
+- |
98 |
+ config RWSEM_GENERIC_SPINLOCK |
99 |
+ def_bool y |
100 |
+ |
101 |
+diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig |
102 |
+index 1072bfd18c50..f4dd44a7118f 100644 |
103 |
+--- a/arch/openrisc/Kconfig |
104 |
++++ b/arch/openrisc/Kconfig |
105 |
+@@ -17,6 +17,7 @@ config OPENRISC |
106 |
+ select GENERIC_IRQ_SHOW |
107 |
+ select GENERIC_IOMAP |
108 |
+ select GENERIC_CPU_DEVICES |
109 |
++ select HAVE_UID16 |
110 |
+ select GENERIC_ATOMIC64 |
111 |
+ select GENERIC_CLOCKEVENTS |
112 |
+ select GENERIC_STRNCPY_FROM_USER |
113 |
+@@ -29,9 +30,6 @@ config MMU |
114 |
+ config HAVE_DMA_ATTRS |
115 |
+ def_bool y |
116 |
+ |
117 |
+-config UID16 |
118 |
+- def_bool y |
119 |
+- |
120 |
+ config RWSEM_GENERIC_SPINLOCK |
121 |
+ def_bool y |
122 |
+ |
123 |
+diff --git a/arch/powerpc/include/asm/cmpxchg.h b/arch/powerpc/include/asm/cmpxchg.h |
124 |
+index e245aab7f191..95b515113186 100644 |
125 |
+--- a/arch/powerpc/include/asm/cmpxchg.h |
126 |
++++ b/arch/powerpc/include/asm/cmpxchg.h |
127 |
+@@ -18,12 +18,12 @@ __xchg_u32(volatile void *p, unsigned long val) |
128 |
+ unsigned long prev; |
129 |
+ |
130 |
+ __asm__ __volatile__( |
131 |
+- PPC_RELEASE_BARRIER |
132 |
++ PPC_ATOMIC_ENTRY_BARRIER |
133 |
+ "1: lwarx %0,0,%2 \n" |
134 |
+ PPC405_ERR77(0,%2) |
135 |
+ " stwcx. %3,0,%2 \n\ |
136 |
+ bne- 1b" |
137 |
+- PPC_ACQUIRE_BARRIER |
138 |
++ PPC_ATOMIC_EXIT_BARRIER |
139 |
+ : "=&r" (prev), "+m" (*(volatile unsigned int *)p) |
140 |
+ : "r" (p), "r" (val) |
141 |
+ : "cc", "memory"); |
142 |
+@@ -61,12 +61,12 @@ __xchg_u64(volatile void *p, unsigned long val) |
143 |
+ unsigned long prev; |
144 |
+ |
145 |
+ __asm__ __volatile__( |
146 |
+- PPC_RELEASE_BARRIER |
147 |
++ PPC_ATOMIC_ENTRY_BARRIER |
148 |
+ "1: ldarx %0,0,%2 \n" |
149 |
+ PPC405_ERR77(0,%2) |
150 |
+ " stdcx. %3,0,%2 \n\ |
151 |
+ bne- 1b" |
152 |
+- PPC_ACQUIRE_BARRIER |
153 |
++ PPC_ATOMIC_EXIT_BARRIER |
154 |
+ : "=&r" (prev), "+m" (*(volatile unsigned long *)p) |
155 |
+ : "r" (p), "r" (val) |
156 |
+ : "cc", "memory"); |
157 |
+@@ -152,14 +152,14 @@ __cmpxchg_u32(volatile unsigned int *p, unsigned long old, unsigned long new) |
158 |
+ unsigned int prev; |
159 |
+ |
160 |
+ __asm__ __volatile__ ( |
161 |
+- PPC_RELEASE_BARRIER |
162 |
++ PPC_ATOMIC_ENTRY_BARRIER |
163 |
+ "1: lwarx %0,0,%2 # __cmpxchg_u32\n\ |
164 |
+ cmpw 0,%0,%3\n\ |
165 |
+ bne- 2f\n" |
166 |
+ PPC405_ERR77(0,%2) |
167 |
+ " stwcx. %4,0,%2\n\ |
168 |
+ bne- 1b" |
169 |
+- PPC_ACQUIRE_BARRIER |
170 |
++ PPC_ATOMIC_EXIT_BARRIER |
171 |
+ "\n\ |
172 |
+ 2:" |
173 |
+ : "=&r" (prev), "+m" (*p) |
174 |
+@@ -198,13 +198,13 @@ __cmpxchg_u64(volatile unsigned long *p, unsigned long old, unsigned long new) |
175 |
+ unsigned long prev; |
176 |
+ |
177 |
+ __asm__ __volatile__ ( |
178 |
+- PPC_RELEASE_BARRIER |
179 |
++ PPC_ATOMIC_ENTRY_BARRIER |
180 |
+ "1: ldarx %0,0,%2 # __cmpxchg_u64\n\ |
181 |
+ cmpd 0,%0,%3\n\ |
182 |
+ bne- 2f\n\ |
183 |
+ stdcx. %4,0,%2\n\ |
184 |
+ bne- 1b" |
185 |
+- PPC_ACQUIRE_BARRIER |
186 |
++ PPC_ATOMIC_EXIT_BARRIER |
187 |
+ "\n\ |
188 |
+ 2:" |
189 |
+ : "=&r" (prev), "+m" (*p) |
190 |
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h |
191 |
+index 795f67792ea9..60c31698f7d5 100644 |
192 |
+--- a/arch/powerpc/include/asm/reg.h |
193 |
++++ b/arch/powerpc/include/asm/reg.h |
194 |
+@@ -108,6 +108,7 @@ |
195 |
+ #define MSR_TS_T __MASK(MSR_TS_T_LG) /* Transaction Transactional */ |
196 |
+ #define MSR_TS_MASK (MSR_TS_T | MSR_TS_S) /* Transaction State bits */ |
197 |
+ #define MSR_TM_ACTIVE(x) (((x) & MSR_TS_MASK) != 0) /* Transaction active? */ |
198 |
++#define MSR_TM_RESV(x) (((x) & MSR_TS_MASK) == MSR_TS_MASK) /* Reserved */ |
199 |
+ #define MSR_TM_TRANSACTIONAL(x) (((x) & MSR_TS_MASK) == MSR_TS_T) |
200 |
+ #define MSR_TM_SUSPENDED(x) (((x) & MSR_TS_MASK) == MSR_TS_S) |
201 |
+ |
202 |
+diff --git a/arch/powerpc/include/asm/synch.h b/arch/powerpc/include/asm/synch.h |
203 |
+index e682a7143edb..c50868681f9e 100644 |
204 |
+--- a/arch/powerpc/include/asm/synch.h |
205 |
++++ b/arch/powerpc/include/asm/synch.h |
206 |
+@@ -44,7 +44,7 @@ static inline void isync(void) |
207 |
+ MAKE_LWSYNC_SECTION_ENTRY(97, __lwsync_fixup); |
208 |
+ #define PPC_ACQUIRE_BARRIER "\n" stringify_in_c(__PPC_ACQUIRE_BARRIER) |
209 |
+ #define PPC_RELEASE_BARRIER stringify_in_c(LWSYNC) "\n" |
210 |
+-#define PPC_ATOMIC_ENTRY_BARRIER "\n" stringify_in_c(LWSYNC) "\n" |
211 |
++#define PPC_ATOMIC_ENTRY_BARRIER "\n" stringify_in_c(sync) "\n" |
212 |
+ #define PPC_ATOMIC_EXIT_BARRIER "\n" stringify_in_c(sync) "\n" |
213 |
+ #else |
214 |
+ #define PPC_ACQUIRE_BARRIER |
215 |
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c |
216 |
+index d9b673b06757..8220ae86252c 100644 |
217 |
+--- a/arch/powerpc/kernel/signal_32.c |
218 |
++++ b/arch/powerpc/kernel/signal_32.c |
219 |
+@@ -858,6 +858,15 @@ static long restore_tm_user_regs(struct pt_regs *regs, |
220 |
+ return 1; |
221 |
+ #endif /* CONFIG_SPE */ |
222 |
+ |
223 |
++ /* Get the top half of the MSR from the user context */ |
224 |
++ if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR])) |
225 |
++ return 1; |
226 |
++ msr_hi <<= 32; |
227 |
++ /* If TM bits are set to the reserved value, it's an invalid context */ |
228 |
++ if (MSR_TM_RESV(msr_hi)) |
229 |
++ return 1; |
230 |
++ /* Pull in the MSR TM bits from the user context */ |
231 |
++ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK); |
232 |
+ /* Now, recheckpoint. This loads up all of the checkpointed (older) |
233 |
+ * registers, including FP and V[S]Rs. After recheckpointing, the |
234 |
+ * transactional versions should be loaded. |
235 |
+@@ -867,11 +876,6 @@ static long restore_tm_user_regs(struct pt_regs *regs, |
236 |
+ current->thread.tm_texasr |= TEXASR_FS; |
237 |
+ /* This loads the checkpointed FP/VEC state, if used */ |
238 |
+ tm_recheckpoint(¤t->thread, msr); |
239 |
+- /* Get the top half of the MSR */ |
240 |
+- if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR])) |
241 |
+- return 1; |
242 |
+- /* Pull in MSR TM from user context */ |
243 |
+- regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK); |
244 |
+ |
245 |
+ /* This loads the speculative FP/VEC state, if used */ |
246 |
+ if (msr & MSR_FP) { |
247 |
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c |
248 |
+index 74d9615a6bb6..2419c17538e2 100644 |
249 |
+--- a/arch/powerpc/kernel/signal_64.c |
250 |
++++ b/arch/powerpc/kernel/signal_64.c |
251 |
+@@ -416,6 +416,10 @@ static long restore_tm_sigcontexts(struct pt_regs *regs, |
252 |
+ |
253 |
+ /* get MSR separately, transfer the LE bit if doing signal return */ |
254 |
+ err |= __get_user(msr, &sc->gp_regs[PT_MSR]); |
255 |
++ /* Don't allow reserved mode. */ |
256 |
++ if (MSR_TM_RESV(msr)) |
257 |
++ return -EINVAL; |
258 |
++ |
259 |
+ /* pull in MSR TM from user context */ |
260 |
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK); |
261 |
+ |
262 |
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c |
263 |
+index 102ad8a255f3..466fbd54e7f8 100644 |
264 |
+--- a/arch/powerpc/kvm/book3s_hv.c |
265 |
++++ b/arch/powerpc/kvm/book3s_hv.c |
266 |
+@@ -160,6 +160,12 @@ void kvmppc_core_vcpu_put(struct kvm_vcpu *vcpu) |
267 |
+ |
268 |
+ void kvmppc_set_msr(struct kvm_vcpu *vcpu, u64 msr) |
269 |
+ { |
270 |
++ /* |
271 |
++ * Check for illegal transactional state bit combination |
272 |
++ * and if we find it, force the TS field to a safe state. |
273 |
++ */ |
274 |
++ if ((msr & MSR_TS_MASK) == MSR_TS_MASK) |
275 |
++ msr &= ~MSR_TS_MASK; |
276 |
+ vcpu->arch.shregs.msr = msr; |
277 |
+ kvmppc_end_cede(vcpu); |
278 |
+ } |
279 |
+diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h |
280 |
+index 4fa687a47a62..6b8d6e8cd449 100644 |
281 |
+--- a/arch/x86/include/asm/boot.h |
282 |
++++ b/arch/x86/include/asm/boot.h |
283 |
+@@ -27,7 +27,7 @@ |
284 |
+ #define BOOT_HEAP_SIZE 0x400000 |
285 |
+ #else /* !CONFIG_KERNEL_BZIP2 */ |
286 |
+ |
287 |
+-#define BOOT_HEAP_SIZE 0x8000 |
288 |
++#define BOOT_HEAP_SIZE 0x10000 |
289 |
+ |
290 |
+ #endif /* !CONFIG_KERNEL_BZIP2 */ |
291 |
+ |
292 |
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c |
293 |
+index 90fd1195f276..abfc89b3b55a 100644 |
294 |
+--- a/arch/x86/kernel/reboot.c |
295 |
++++ b/arch/x86/kernel/reboot.c |
296 |
+@@ -366,6 +366,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = { |
297 |
+ DMI_MATCH(DMI_BOARD_NAME, "P4S800"), |
298 |
+ }, |
299 |
+ }, |
300 |
++ { /* Handle problems with rebooting on the iMac10,1. */ |
301 |
++ .callback = set_pci_reboot, |
302 |
++ .ident = "Apple iMac10,1", |
303 |
++ .matches = { |
304 |
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), |
305 |
++ DMI_MATCH(DMI_PRODUCT_NAME, "iMac10,1"), |
306 |
++ }, |
307 |
++ }, |
308 |
+ |
309 |
+ { /* Handle reboot issue on Acer Aspire one */ |
310 |
+ .callback = set_kbd_reboot, |
311 |
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c |
312 |
+index 66deef41512f..f11fd597c5b6 100644 |
313 |
+--- a/arch/x86/kernel/signal.c |
314 |
++++ b/arch/x86/kernel/signal.c |
315 |
+@@ -686,12 +686,15 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs) |
316 |
+ signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP)); |
317 |
+ } |
318 |
+ |
319 |
+-#ifdef CONFIG_X86_32 |
320 |
+-#define NR_restart_syscall __NR_restart_syscall |
321 |
+-#else /* !CONFIG_X86_32 */ |
322 |
+-#define NR_restart_syscall \ |
323 |
+- test_thread_flag(TIF_IA32) ? __NR_ia32_restart_syscall : __NR_restart_syscall |
324 |
+-#endif /* CONFIG_X86_32 */ |
325 |
++static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs) |
326 |
++{ |
327 |
++#if defined(CONFIG_X86_32) || !defined(CONFIG_X86_64) |
328 |
++ return __NR_restart_syscall; |
329 |
++#else /* !CONFIG_X86_32 && CONFIG_X86_64 */ |
330 |
++ return test_thread_flag(TIF_IA32) ? __NR_ia32_restart_syscall : |
331 |
++ __NR_restart_syscall | (regs->orig_ax & __X32_SYSCALL_BIT); |
332 |
++#endif /* CONFIG_X86_32 || !CONFIG_X86_64 */ |
333 |
++} |
334 |
+ |
335 |
+ /* |
336 |
+ * Note that 'init' is a special process: it doesn't get signals it doesn't |
337 |
+@@ -720,7 +723,7 @@ static void do_signal(struct pt_regs *regs) |
338 |
+ break; |
339 |
+ |
340 |
+ case -ERESTART_RESTARTBLOCK: |
341 |
+- regs->ax = NR_restart_syscall; |
342 |
++ regs->ax = get_nr_restart_syscall(regs); |
343 |
+ regs->ip -= 2; |
344 |
+ break; |
345 |
+ } |
346 |
+diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c |
347 |
+index 45329c8c226e..39e12c10b931 100644 |
348 |
+--- a/arch/x86/xen/suspend.c |
349 |
++++ b/arch/x86/xen/suspend.c |
350 |
+@@ -30,7 +30,8 @@ void xen_arch_hvm_post_suspend(int suspend_cancelled) |
351 |
+ { |
352 |
+ #ifdef CONFIG_XEN_PVHVM |
353 |
+ int cpu; |
354 |
+- xen_hvm_init_shared_info(); |
355 |
++ if (!suspend_cancelled) |
356 |
++ xen_hvm_init_shared_info(); |
357 |
+ xen_callback_vector(); |
358 |
+ xen_unplug_emulated_devices(); |
359 |
+ if (xen_feature(XENFEAT_hvm_safe_pvclock)) { |
360 |
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c |
361 |
+index 02cc352d8bcc..a67ac2a71155 100644 |
362 |
+--- a/drivers/char/ipmi/ipmi_si_intf.c |
363 |
++++ b/drivers/char/ipmi/ipmi_si_intf.c |
364 |
+@@ -1144,14 +1144,14 @@ static int smi_start_processing(void *send_info, |
365 |
+ |
366 |
+ new_smi->intf = intf; |
367 |
+ |
368 |
+- /* Try to claim any interrupts. */ |
369 |
+- if (new_smi->irq_setup) |
370 |
+- new_smi->irq_setup(new_smi); |
371 |
+- |
372 |
+ /* Set up the timer that drives the interface. */ |
373 |
+ setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi); |
374 |
+ smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES); |
375 |
+ |
376 |
++ /* Try to claim any interrupts. */ |
377 |
++ if (new_smi->irq_setup) |
378 |
++ new_smi->irq_setup(new_smi); |
379 |
++ |
380 |
+ /* |
381 |
+ * Check if the user forcefully enabled the daemon. |
382 |
+ */ |
383 |
+diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c |
384 |
+index 0daa11e418b1..bdbd80415908 100644 |
385 |
+--- a/drivers/connector/connector.c |
386 |
++++ b/drivers/connector/connector.c |
387 |
+@@ -154,26 +154,21 @@ static int cn_call_callback(struct sk_buff *skb) |
388 |
+ * |
389 |
+ * It checks skb, netlink header and msg sizes, and calls callback helper. |
390 |
+ */ |
391 |
+-static void cn_rx_skb(struct sk_buff *__skb) |
392 |
++static void cn_rx_skb(struct sk_buff *skb) |
393 |
+ { |
394 |
+ struct nlmsghdr *nlh; |
395 |
+- struct sk_buff *skb; |
396 |
+ int len, err; |
397 |
+ |
398 |
+- skb = skb_get(__skb); |
399 |
+- |
400 |
+ if (skb->len >= NLMSG_HDRLEN) { |
401 |
+ nlh = nlmsg_hdr(skb); |
402 |
+ len = nlmsg_len(nlh); |
403 |
+ |
404 |
+ if (len < (int)sizeof(struct cn_msg) || |
405 |
+ skb->len < nlh->nlmsg_len || |
406 |
+- len > CONNECTOR_MAX_MSG_SIZE) { |
407 |
+- kfree_skb(skb); |
408 |
++ len > CONNECTOR_MAX_MSG_SIZE) |
409 |
+ return; |
410 |
+- } |
411 |
+ |
412 |
+- err = cn_call_callback(skb); |
413 |
++ err = cn_call_callback(skb_get(skb)); |
414 |
+ if (err < 0) |
415 |
+ kfree_skb(skb); |
416 |
+ } |
417 |
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c |
418 |
+index 2bd798a7d9aa..c1a8cf2d490b 100644 |
419 |
+--- a/drivers/hid/hid-core.c |
420 |
++++ b/drivers/hid/hid-core.c |
421 |
+@@ -1462,7 +1462,7 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask) |
422 |
+ "Multi-Axis Controller" |
423 |
+ }; |
424 |
+ const char *type, *bus; |
425 |
+- char buf[64]; |
426 |
++ char buf[64] = ""; |
427 |
+ unsigned int i; |
428 |
+ int len; |
429 |
+ int ret; |
430 |
+diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c |
431 |
+index 38ceac5053a0..0ed6731396ef 100644 |
432 |
+--- a/drivers/isdn/i4l/isdn_ppp.c |
433 |
++++ b/drivers/isdn/i4l/isdn_ppp.c |
434 |
+@@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file) |
435 |
+ is->compflags = 0; |
436 |
+ |
437 |
+ is->reset = isdn_ppp_ccp_reset_alloc(is); |
438 |
++ if (!is->reset) |
439 |
++ return -ENOMEM; |
440 |
+ |
441 |
+ is->lp = NULL; |
442 |
+ is->mp_seqno = 0; /* MP sequence number */ |
443 |
+@@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file) |
444 |
+ * VJ header compression init |
445 |
+ */ |
446 |
+ is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */ |
447 |
++ if (IS_ERR(is->slcomp)) { |
448 |
++ isdn_ppp_ccp_reset_free(is); |
449 |
++ return PTR_ERR(is->slcomp); |
450 |
++ } |
451 |
+ #endif |
452 |
+ #ifdef CONFIG_IPPP_FILTER |
453 |
+ is->pass_filter = NULL; |
454 |
+@@ -568,10 +574,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg) |
455 |
+ is->maxcid = val; |
456 |
+ #ifdef CONFIG_ISDN_PPP_VJ |
457 |
+ sltmp = slhc_init(16, val); |
458 |
+- if (!sltmp) { |
459 |
+- printk(KERN_ERR "ippp, can't realloc slhc struct\n"); |
460 |
+- return -ENOMEM; |
461 |
+- } |
462 |
++ if (IS_ERR(sltmp)) |
463 |
++ return PTR_ERR(sltmp); |
464 |
+ if (is->slcomp) |
465 |
+ slhc_free(is->slcomp); |
466 |
+ is->slcomp = sltmp; |
467 |
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c |
468 |
+index 5a1897d86e94..a2d7d5f066f1 100644 |
469 |
+--- a/drivers/net/ppp/ppp_generic.c |
470 |
++++ b/drivers/net/ppp/ppp_generic.c |
471 |
+@@ -716,10 +716,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) |
472 |
+ val &= 0xffff; |
473 |
+ } |
474 |
+ vj = slhc_init(val2+1, val+1); |
475 |
+- if (!vj) { |
476 |
+- netdev_err(ppp->dev, |
477 |
+- "PPP: no memory (VJ compressor)\n"); |
478 |
+- err = -ENOMEM; |
479 |
++ if (IS_ERR(vj)) { |
480 |
++ err = PTR_ERR(vj); |
481 |
+ break; |
482 |
+ } |
483 |
+ ppp_lock(ppp); |
484 |
+diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c |
485 |
+index 1252d9c726a7..b52eabc168a0 100644 |
486 |
+--- a/drivers/net/slip/slhc.c |
487 |
++++ b/drivers/net/slip/slhc.c |
488 |
+@@ -84,8 +84,9 @@ static long decode(unsigned char **cpp); |
489 |
+ static unsigned char * put16(unsigned char *cp, unsigned short x); |
490 |
+ static unsigned short pull16(unsigned char **cpp); |
491 |
+ |
492 |
+-/* Initialize compression data structure |
493 |
++/* Allocate compression data structure |
494 |
+ * slots must be in range 0 to 255 (zero meaning no compression) |
495 |
++ * Returns pointer to structure or ERR_PTR() on error. |
496 |
+ */ |
497 |
+ struct slcompress * |
498 |
+ slhc_init(int rslots, int tslots) |
499 |
+@@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots) |
500 |
+ register struct cstate *ts; |
501 |
+ struct slcompress *comp; |
502 |
+ |
503 |
++ if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255) |
504 |
++ return ERR_PTR(-EINVAL); |
505 |
++ |
506 |
+ comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL); |
507 |
+ if (! comp) |
508 |
+ goto out_fail; |
509 |
+ |
510 |
+- if ( rslots > 0 && rslots < 256 ) { |
511 |
++ if (rslots > 0) { |
512 |
+ size_t rsize = rslots * sizeof(struct cstate); |
513 |
+ comp->rstate = kzalloc(rsize, GFP_KERNEL); |
514 |
+ if (! comp->rstate) |
515 |
+@@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots) |
516 |
+ comp->rslot_limit = rslots - 1; |
517 |
+ } |
518 |
+ |
519 |
+- if ( tslots > 0 && tslots < 256 ) { |
520 |
++ if (tslots > 0) { |
521 |
+ size_t tsize = tslots * sizeof(struct cstate); |
522 |
+ comp->tstate = kzalloc(tsize, GFP_KERNEL); |
523 |
+ if (! comp->tstate) |
524 |
+@@ -141,7 +145,7 @@ out_free2: |
525 |
+ out_free: |
526 |
+ kfree(comp); |
527 |
+ out_fail: |
528 |
+- return NULL; |
529 |
++ return ERR_PTR(-ENOMEM); |
530 |
+ } |
531 |
+ |
532 |
+ |
533 |
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c |
534 |
+index a34d6bf5e43b..ca3e73753fb8 100644 |
535 |
+--- a/drivers/net/slip/slip.c |
536 |
++++ b/drivers/net/slip/slip.c |
537 |
+@@ -163,7 +163,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu) |
538 |
+ if (cbuff == NULL) |
539 |
+ goto err_exit; |
540 |
+ slcomp = slhc_init(16, 16); |
541 |
+- if (slcomp == NULL) |
542 |
++ if (IS_ERR(slcomp)) |
543 |
+ goto err_exit; |
544 |
+ #endif |
545 |
+ spin_lock_bh(&sl->lock); |
546 |
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c |
547 |
+index 14179a6593ef..5225d4321e7c 100644 |
548 |
+--- a/drivers/net/team/team.c |
549 |
++++ b/drivers/net/team/team.c |
550 |
+@@ -1636,10 +1636,10 @@ static int team_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid) |
551 |
+ struct team *team = netdev_priv(dev); |
552 |
+ struct team_port *port; |
553 |
+ |
554 |
+- rcu_read_lock(); |
555 |
+- list_for_each_entry_rcu(port, &team->port_list, list) |
556 |
++ mutex_lock(&team->lock); |
557 |
++ list_for_each_entry(port, &team->port_list, list) |
558 |
+ vlan_vid_del(port->dev, proto, vid); |
559 |
+- rcu_read_unlock(); |
560 |
++ mutex_unlock(&team->lock); |
561 |
+ |
562 |
+ return 0; |
563 |
+ } |
564 |
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c |
565 |
+index 177f911f5946..cc6d3f987436 100644 |
566 |
+--- a/drivers/net/veth.c |
567 |
++++ b/drivers/net/veth.c |
568 |
+@@ -116,12 +116,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) |
569 |
+ kfree_skb(skb); |
570 |
+ goto drop; |
571 |
+ } |
572 |
+- /* don't change ip_summed == CHECKSUM_PARTIAL, as that |
573 |
+- * will cause bad checksum on forwarded packets |
574 |
+- */ |
575 |
+- if (skb->ip_summed == CHECKSUM_NONE && |
576 |
+- rcv->features & NETIF_F_RXCSUM) |
577 |
+- skb->ip_summed = CHECKSUM_UNNECESSARY; |
578 |
+ |
579 |
+ if (likely(dev_forward_skb(rcv, skb) == NET_RX_SUCCESS)) { |
580 |
+ struct pcpu_vstats *stats = this_cpu_ptr(dev->vstats); |
581 |
+diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h |
582 |
+index 8c33491b21fe..c6aa38883466 100644 |
583 |
+--- a/drivers/parisc/iommu-helpers.h |
584 |
++++ b/drivers/parisc/iommu-helpers.h |
585 |
+@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev, |
586 |
+ struct scatterlist *contig_sg; /* contig chunk head */ |
587 |
+ unsigned long dma_offset, dma_len; /* start/len of DMA stream */ |
588 |
+ unsigned int n_mappings = 0; |
589 |
+- unsigned int max_seg_size = dma_get_max_seg_size(dev); |
590 |
++ unsigned int max_seg_size = min(dma_get_max_seg_size(dev), |
591 |
++ (unsigned)DMA_CHUNK_SIZE); |
592 |
++ unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1; |
593 |
++ if (max_seg_boundary) /* check if the addition above didn't overflow */ |
594 |
++ max_seg_size = min(max_seg_size, max_seg_boundary); |
595 |
+ |
596 |
+ while (nents > 0) { |
597 |
+ |
598 |
+@@ -139,14 +143,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev, |
599 |
+ |
600 |
+ /* |
601 |
+ ** First make sure current dma stream won't |
602 |
+- ** exceed DMA_CHUNK_SIZE if we coalesce the |
603 |
++ ** exceed max_seg_size if we coalesce the |
604 |
+ ** next entry. |
605 |
+ */ |
606 |
+- if(unlikely(ALIGN(dma_len + dma_offset + startsg->length, |
607 |
+- IOVP_SIZE) > DMA_CHUNK_SIZE)) |
608 |
+- break; |
609 |
+- |
610 |
+- if (startsg->length + dma_len > max_seg_size) |
611 |
++ if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) > |
612 |
++ max_seg_size)) |
613 |
+ break; |
614 |
+ |
615 |
+ /* |
616 |
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c |
617 |
+index a3431e90345f..4dc18615cd0f 100644 |
618 |
+--- a/drivers/usb/host/xhci.c |
619 |
++++ b/drivers/usb/host/xhci.c |
620 |
+@@ -4615,8 +4615,16 @@ int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, |
621 |
+ ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG); |
622 |
+ slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx); |
623 |
+ slot_ctx->dev_info |= cpu_to_le32(DEV_HUB); |
624 |
++ /* |
625 |
++ * refer to section 6.2.2: MTT should be 0 for full speed hub, |
626 |
++ * but it may be already set to 1 when setup an xHCI virtual |
627 |
++ * device, so clear it anyway. |
628 |
++ */ |
629 |
+ if (tt->multi) |
630 |
+ slot_ctx->dev_info |= cpu_to_le32(DEV_MTT); |
631 |
++ else if (hdev->speed == USB_SPEED_FULL) |
632 |
++ slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT); |
633 |
++ |
634 |
+ if (xhci->hci_version > 0x95) { |
635 |
+ xhci_dbg(xhci, "xHCI version %x needs hub " |
636 |
+ "TT think time and number of ports\n", |
637 |
+@@ -4807,6 +4815,10 @@ static int __init xhci_hcd_init(void) |
638 |
+ BUILD_BUG_ON(sizeof(struct xhci_intr_reg) != 8*32/8); |
639 |
+ /* xhci_run_regs has eight fields and embeds 128 xhci_intr_regs */ |
640 |
+ BUILD_BUG_ON(sizeof(struct xhci_run_regs) != (8+8*128)*32/8); |
641 |
++ |
642 |
++ if (usb_disabled()) |
643 |
++ return -ENODEV; |
644 |
++ |
645 |
+ return 0; |
646 |
+ unreg_pci: |
647 |
+ xhci_unregister_pci(); |
648 |
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c |
649 |
+index 25522e98602e..72c14d7d604f 100644 |
650 |
+--- a/drivers/usb/serial/cp210x.c |
651 |
++++ b/drivers/usb/serial/cp210x.c |
652 |
+@@ -160,6 +160,7 @@ static const struct usb_device_id id_table[] = { |
653 |
+ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ |
654 |
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ |
655 |
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ |
656 |
++ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ |
657 |
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ |
658 |
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ |
659 |
+ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ |
660 |
+diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c |
661 |
+index 76c9a847da5d..e03900e8c667 100644 |
662 |
+--- a/drivers/usb/serial/ipaq.c |
663 |
++++ b/drivers/usb/serial/ipaq.c |
664 |
+@@ -532,7 +532,8 @@ static int ipaq_open(struct tty_struct *tty, |
665 |
+ * through. Since this has a reasonably high failure rate, we retry |
666 |
+ * several times. |
667 |
+ */ |
668 |
+- while (retries--) { |
669 |
++ while (retries) { |
670 |
++ retries--; |
671 |
+ result = usb_control_msg(serial->dev, |
672 |
+ usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21, |
673 |
+ 0x1, 0, NULL, 0, 100); |
674 |
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c |
675 |
+index e68205cbc46e..3d8e6098cd40 100644 |
676 |
+--- a/drivers/xen/gntdev.c |
677 |
++++ b/drivers/xen/gntdev.c |
678 |
+@@ -770,7 +770,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) |
679 |
+ |
680 |
+ vma->vm_ops = &gntdev_vmops; |
681 |
+ |
682 |
+- vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP; |
683 |
++ vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_IO; |
684 |
+ |
685 |
+ if (use_ptemod) |
686 |
+ vma->vm_flags |= VM_DONTCOPY; |
687 |
+diff --git a/include/linux/sched.h b/include/linux/sched.h |
688 |
+index 7cf305d036db..4781332f2e11 100644 |
689 |
+--- a/include/linux/sched.h |
690 |
++++ b/include/linux/sched.h |
691 |
+@@ -670,6 +670,7 @@ struct user_struct { |
692 |
+ unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */ |
693 |
+ #endif |
694 |
+ unsigned long locked_shm; /* How many pages of mlocked shm ? */ |
695 |
++ unsigned long unix_inflight; /* How many files in flight in unix sockets */ |
696 |
+ |
697 |
+ #ifdef CONFIG_KEYS |
698 |
+ struct key *uid_keyring; /* UID specific keyring */ |
699 |
+diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h |
700 |
+index 84662ecc7b51..e1bc430133f4 100644 |
701 |
+--- a/include/linux/syscalls.h |
702 |
++++ b/include/linux/syscalls.h |
703 |
+@@ -498,7 +498,7 @@ asmlinkage long sys_chown(const char __user *filename, |
704 |
+ asmlinkage long sys_lchown(const char __user *filename, |
705 |
+ uid_t user, gid_t group); |
706 |
+ asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group); |
707 |
+-#ifdef CONFIG_UID16 |
708 |
++#ifdef CONFIG_HAVE_UID16 |
709 |
+ asmlinkage long sys_chown16(const char __user *filename, |
710 |
+ old_uid_t user, old_gid_t group); |
711 |
+ asmlinkage long sys_lchown16(const char __user *filename, |
712 |
+diff --git a/include/linux/types.h b/include/linux/types.h |
713 |
+index 4d118ba11349..83db8e5974dc 100644 |
714 |
+--- a/include/linux/types.h |
715 |
++++ b/include/linux/types.h |
716 |
+@@ -35,7 +35,7 @@ typedef __kernel_gid16_t gid16_t; |
717 |
+ |
718 |
+ typedef unsigned long uintptr_t; |
719 |
+ |
720 |
+-#ifdef CONFIG_UID16 |
721 |
++#ifdef CONFIG_HAVE_UID16 |
722 |
+ /* This is defined by include/asm-{arch}/posix_types.h */ |
723 |
+ typedef __kernel_old_uid_t old_uid_t; |
724 |
+ typedef __kernel_old_gid_t old_gid_t; |
725 |
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c |
726 |
+index 886f6d6dc48a..3995a66c3e4e 100644 |
727 |
+--- a/net/bridge/br_stp_if.c |
728 |
++++ b/net/bridge/br_stp_if.c |
729 |
+@@ -128,7 +128,10 @@ static void br_stp_start(struct net_bridge *br) |
730 |
+ char *argv[] = { BR_STP_PROG, br->dev->name, "start", NULL }; |
731 |
+ char *envp[] = { NULL }; |
732 |
+ |
733 |
+- r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC); |
734 |
++ if (net_eq(dev_net(br->dev), &init_net)) |
735 |
++ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC); |
736 |
++ else |
737 |
++ r = -ENOENT; |
738 |
+ |
739 |
+ spin_lock_bh(&br->lock); |
740 |
+ |
741 |
+diff --git a/net/core/dst.c b/net/core/dst.c |
742 |
+index 01f9980af86e..1bf6842b89b8 100644 |
743 |
+--- a/net/core/dst.c |
744 |
++++ b/net/core/dst.c |
745 |
+@@ -280,10 +280,11 @@ void dst_release(struct dst_entry *dst) |
746 |
+ { |
747 |
+ if (dst) { |
748 |
+ int newrefcnt; |
749 |
++ unsigned short nocache = dst->flags & DST_NOCACHE; |
750 |
+ |
751 |
+ newrefcnt = atomic_dec_return(&dst->__refcnt); |
752 |
+ WARN_ON(newrefcnt < 0); |
753 |
+- if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) |
754 |
++ if (!newrefcnt && unlikely(nocache)) |
755 |
+ call_rcu(&dst->rcu_head, dst_destroy_rcu); |
756 |
+ } |
757 |
+ } |
758 |
+diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c |
759 |
+index 05c3b6f0e8e1..bf8321d6f2ef 100644 |
760 |
+--- a/net/ipv4/tcp_yeah.c |
761 |
++++ b/net/ipv4/tcp_yeah.c |
762 |
+@@ -222,7 +222,7 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) { |
763 |
+ yeah->fast_count = 0; |
764 |
+ yeah->reno_count = max(yeah->reno_count>>1, 2U); |
765 |
+ |
766 |
+- return tp->snd_cwnd - reduction; |
767 |
++ return max_t(int, tp->snd_cwnd - reduction, 2); |
768 |
+ } |
769 |
+ |
770 |
+ static struct tcp_congestion_ops tcp_yeah __read_mostly = { |
771 |
+diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c |
772 |
+index b30ad3741b46..d5c918975c8c 100644 |
773 |
+--- a/net/ipv6/addrlabel.c |
774 |
++++ b/net/ipv6/addrlabel.c |
775 |
+@@ -558,7 +558,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh) |
776 |
+ |
777 |
+ rcu_read_lock(); |
778 |
+ p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index); |
779 |
+- if (p && ip6addrlbl_hold(p)) |
780 |
++ if (p && !ip6addrlbl_hold(p)) |
781 |
+ p = NULL; |
782 |
+ lseq = ip6addrlbl_table.seq; |
783 |
+ rcu_read_unlock(); |
784 |
+diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c |
785 |
+index 5a940dbd74a3..f0229223bf91 100644 |
786 |
+--- a/net/phonet/af_phonet.c |
787 |
++++ b/net/phonet/af_phonet.c |
788 |
+@@ -377,6 +377,10 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev, |
789 |
+ struct sockaddr_pn sa; |
790 |
+ u16 len; |
791 |
+ |
792 |
++ skb = skb_share_check(skb, GFP_ATOMIC); |
793 |
++ if (!skb) |
794 |
++ return NET_RX_DROP; |
795 |
++ |
796 |
+ /* check we have at least a full Phonet header */ |
797 |
+ if (!pskb_pull(skb, sizeof(struct phonethdr))) |
798 |
+ goto out; |
799 |
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c |
800 |
+index c52763a26297..d9cbecb62aca 100644 |
801 |
+--- a/net/sctp/sm_statefuns.c |
802 |
++++ b/net/sctp/sm_statefuns.c |
803 |
+@@ -4835,7 +4835,8 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort( |
804 |
+ |
805 |
+ retval = SCTP_DISPOSITION_CONSUME; |
806 |
+ |
807 |
+- sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); |
808 |
++ if (abort) |
809 |
++ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); |
810 |
+ |
811 |
+ /* Even if we can't send the ABORT due to low memory delete the |
812 |
+ * TCB. This is a departure from our typical NOMEM handling. |
813 |
+@@ -4972,7 +4973,8 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort( |
814 |
+ SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); |
815 |
+ retval = SCTP_DISPOSITION_CONSUME; |
816 |
+ |
817 |
+- sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); |
818 |
++ if (abort) |
819 |
++ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); |
820 |
+ |
821 |
+ sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, |
822 |
+ SCTP_STATE(SCTP_STATE_CLOSED)); |
823 |
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c |
824 |
+index 80bd61ae5945..bdc3fb66717d 100644 |
825 |
+--- a/net/sctp/socket.c |
826 |
++++ b/net/sctp/socket.c |
827 |
+@@ -1533,8 +1533,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout) |
828 |
+ struct sctp_chunk *chunk; |
829 |
+ |
830 |
+ chunk = sctp_make_abort_user(asoc, NULL, 0); |
831 |
+- if (chunk) |
832 |
+- sctp_primitive_ABORT(net, asoc, chunk); |
833 |
++ sctp_primitive_ABORT(net, asoc, chunk); |
834 |
+ } else |
835 |
+ sctp_primitive_SHUTDOWN(net, asoc, NULL); |
836 |
+ } |
837 |
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c |
838 |
+index f934e7ba5eb8..a673c1f4f638 100644 |
839 |
+--- a/net/unix/af_unix.c |
840 |
++++ b/net/unix/af_unix.c |
841 |
+@@ -1483,6 +1483,21 @@ static void unix_destruct_scm(struct sk_buff *skb) |
842 |
+ sock_wfree(skb); |
843 |
+ } |
844 |
+ |
845 |
++/* |
846 |
++ * The "user->unix_inflight" variable is protected by the garbage |
847 |
++ * collection lock, and we just read it locklessly here. If you go |
848 |
++ * over the limit, there might be a tiny race in actually noticing |
849 |
++ * it across threads. Tough. |
850 |
++ */ |
851 |
++static inline bool too_many_unix_fds(struct task_struct *p) |
852 |
++{ |
853 |
++ struct user_struct *user = current_user(); |
854 |
++ |
855 |
++ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE))) |
856 |
++ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); |
857 |
++ return false; |
858 |
++} |
859 |
++ |
860 |
+ #define MAX_RECURSION_LEVEL 4 |
861 |
+ |
862 |
+ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) |
863 |
+@@ -1491,6 +1506,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) |
864 |
+ unsigned char max_level = 0; |
865 |
+ int unix_sock_count = 0; |
866 |
+ |
867 |
++ if (too_many_unix_fds(current)) |
868 |
++ return -ETOOMANYREFS; |
869 |
++ |
870 |
+ for (i = scm->fp->count - 1; i >= 0; i--) { |
871 |
+ struct sock *sk = unix_get_socket(scm->fp->fp[i]); |
872 |
+ |
873 |
+@@ -1512,10 +1530,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) |
874 |
+ if (!UNIXCB(skb).fp) |
875 |
+ return -ENOMEM; |
876 |
+ |
877 |
+- if (unix_sock_count) { |
878 |
+- for (i = scm->fp->count - 1; i >= 0; i--) |
879 |
+- unix_inflight(scm->fp->fp[i]); |
880 |
+- } |
881 |
++ for (i = scm->fp->count - 1; i >= 0; i--) |
882 |
++ unix_inflight(scm->fp->fp[i]); |
883 |
+ return max_level; |
884 |
+ } |
885 |
+ |
886 |
+@@ -1934,7 +1950,14 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock, |
887 |
+ if (flags&MSG_OOB) |
888 |
+ goto out; |
889 |
+ |
890 |
+- mutex_lock(&u->readlock); |
891 |
++ err = mutex_lock_interruptible(&u->readlock); |
892 |
++ if (unlikely(err)) { |
893 |
++ /* recvmsg() in non blocking mode is supposed to return -EAGAIN |
894 |
++ * sk_rcvtimeo is not honored by mutex_lock_interruptible() |
895 |
++ */ |
896 |
++ err = noblock ? -EAGAIN : -ERESTARTSYS; |
897 |
++ goto out; |
898 |
++ } |
899 |
+ |
900 |
+ skip = sk_peek_offset(sk, flags); |
901 |
+ |
902 |
+@@ -2083,14 +2106,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, |
903 |
+ memset(&tmp_scm, 0, sizeof(tmp_scm)); |
904 |
+ } |
905 |
+ |
906 |
+- err = mutex_lock_interruptible(&u->readlock); |
907 |
+- if (unlikely(err)) { |
908 |
+- /* recvmsg() in non blocking mode is supposed to return -EAGAIN |
909 |
+- * sk_rcvtimeo is not honored by mutex_lock_interruptible() |
910 |
+- */ |
911 |
+- err = noblock ? -EAGAIN : -ERESTARTSYS; |
912 |
+- goto out; |
913 |
+- } |
914 |
++ mutex_lock(&u->readlock); |
915 |
+ |
916 |
+ do { |
917 |
+ int chunk; |
918 |
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c |
919 |
+index 9bc73f87f64a..06730fe6ad9d 100644 |
920 |
+--- a/net/unix/garbage.c |
921 |
++++ b/net/unix/garbage.c |
922 |
+@@ -125,9 +125,12 @@ struct sock *unix_get_socket(struct file *filp) |
923 |
+ void unix_inflight(struct file *fp) |
924 |
+ { |
925 |
+ struct sock *s = unix_get_socket(fp); |
926 |
++ |
927 |
++ spin_lock(&unix_gc_lock); |
928 |
++ |
929 |
+ if (s) { |
930 |
+ struct unix_sock *u = unix_sk(s); |
931 |
+- spin_lock(&unix_gc_lock); |
932 |
++ |
933 |
+ if (atomic_long_inc_return(&u->inflight) == 1) { |
934 |
+ BUG_ON(!list_empty(&u->link)); |
935 |
+ list_add_tail(&u->link, &gc_inflight_list); |
936 |
+@@ -135,22 +138,27 @@ void unix_inflight(struct file *fp) |
937 |
+ BUG_ON(list_empty(&u->link)); |
938 |
+ } |
939 |
+ unix_tot_inflight++; |
940 |
+- spin_unlock(&unix_gc_lock); |
941 |
+ } |
942 |
++ fp->f_cred->user->unix_inflight++; |
943 |
++ spin_unlock(&unix_gc_lock); |
944 |
+ } |
945 |
+ |
946 |
+ void unix_notinflight(struct file *fp) |
947 |
+ { |
948 |
+ struct sock *s = unix_get_socket(fp); |
949 |
++ |
950 |
++ spin_lock(&unix_gc_lock); |
951 |
++ |
952 |
+ if (s) { |
953 |
+ struct unix_sock *u = unix_sk(s); |
954 |
+- spin_lock(&unix_gc_lock); |
955 |
++ |
956 |
+ BUG_ON(list_empty(&u->link)); |
957 |
+ if (atomic_long_dec_and_test(&u->inflight)) |
958 |
+ list_del_init(&u->link); |
959 |
+ unix_tot_inflight--; |
960 |
+- spin_unlock(&unix_gc_lock); |
961 |
+ } |
962 |
++ fp->f_cred->user->unix_inflight--; |
963 |
++ spin_unlock(&unix_gc_lock); |
964 |
+ } |
965 |
+ |
966 |
+ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *), |
967 |
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl |
968 |
+index 679218b56ede..f94f6a2d6988 100755 |
969 |
+--- a/scripts/recordmcount.pl |
970 |
++++ b/scripts/recordmcount.pl |
971 |
+@@ -265,7 +265,8 @@ if ($arch eq "x86_64") { |
972 |
+ |
973 |
+ } elsif ($arch eq "powerpc") { |
974 |
+ $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)"; |
975 |
+- $function_regex = "^([0-9a-fA-F]+)\\s+<(\\.?.*?)>:"; |
976 |
++ # See comment in the sparc64 section for why we use '\w'. |
977 |
++ $function_regex = "^([0-9a-fA-F]+)\\s+<(\\.?\\w*?)>:"; |
978 |
+ $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s\\.?_mcount\$"; |
979 |
+ |
980 |
+ if ($bits == 64) { |
981 |
+diff --git a/sound/core/control.c b/sound/core/control.c |
982 |
+index f2082a35b890..3fcead61f0ef 100644 |
983 |
+--- a/sound/core/control.c |
984 |
++++ b/sound/core/control.c |
985 |
+@@ -1325,6 +1325,8 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file, |
986 |
+ return -EFAULT; |
987 |
+ if (tlv.length < sizeof(unsigned int) * 2) |
988 |
+ return -EINVAL; |
989 |
++ if (!tlv.numid) |
990 |
++ return -EINVAL; |
991 |
+ down_read(&card->controls_rwsem); |
992 |
+ kctl = snd_ctl_find_numid(card, tlv.numid); |
993 |
+ if (kctl == NULL) { |
994 |
+diff --git a/sound/core/hrtimer.c b/sound/core/hrtimer.c |
995 |
+index b8b31c433d64..14d483d6b3b0 100644 |
996 |
+--- a/sound/core/hrtimer.c |
997 |
++++ b/sound/core/hrtimer.c |
998 |
+@@ -90,7 +90,7 @@ static int snd_hrtimer_start(struct snd_timer *t) |
999 |
+ struct snd_hrtimer *stime = t->private_data; |
1000 |
+ |
1001 |
+ atomic_set(&stime->running, 0); |
1002 |
+- hrtimer_cancel(&stime->hrt); |
1003 |
++ hrtimer_try_to_cancel(&stime->hrt); |
1004 |
+ hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution), |
1005 |
+ HRTIMER_MODE_REL); |
1006 |
+ atomic_set(&stime->running, 1); |
1007 |
+@@ -101,6 +101,7 @@ static int snd_hrtimer_stop(struct snd_timer *t) |
1008 |
+ { |
1009 |
+ struct snd_hrtimer *stime = t->private_data; |
1010 |
+ atomic_set(&stime->running, 0); |
1011 |
++ hrtimer_try_to_cancel(&stime->hrt); |
1012 |
+ return 0; |
1013 |
+ } |
1014 |
+ |
1015 |
+diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c |
1016 |
+index c4ac3c1e19af..1bb1a43c7d03 100644 |
1017 |
+--- a/sound/core/pcm_compat.c |
1018 |
++++ b/sound/core/pcm_compat.c |
1019 |
+@@ -236,10 +236,15 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream, |
1020 |
+ if (! (runtime = substream->runtime)) |
1021 |
+ return -ENOTTY; |
1022 |
+ |
1023 |
+- /* only fifo_size is different, so just copy all */ |
1024 |
+- data = memdup_user(data32, sizeof(*data32)); |
1025 |
+- if (IS_ERR(data)) |
1026 |
+- return PTR_ERR(data); |
1027 |
++ data = kmalloc(sizeof(*data), GFP_KERNEL); |
1028 |
++ if (!data) |
1029 |
++ return -ENOMEM; |
1030 |
++ |
1031 |
++ /* only fifo_size (RO from userspace) is different, so just copy all */ |
1032 |
++ if (copy_from_user(data, data32, sizeof(*data32))) { |
1033 |
++ err = -EFAULT; |
1034 |
++ goto error; |
1035 |
++ } |
1036 |
+ |
1037 |
+ if (refine) |
1038 |
+ err = snd_pcm_hw_refine(substream, data); |
1039 |
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c |
1040 |
+index 4dc6bae80e15..ecfbf5f39d38 100644 |
1041 |
+--- a/sound/core/seq/seq_clientmgr.c |
1042 |
++++ b/sound/core/seq/seq_clientmgr.c |
1043 |
+@@ -1950,7 +1950,7 @@ static int snd_seq_ioctl_remove_events(struct snd_seq_client *client, |
1044 |
+ * No restrictions so for a user client we can clear |
1045 |
+ * the whole fifo |
1046 |
+ */ |
1047 |
+- if (client->type == USER_CLIENT) |
1048 |
++ if (client->type == USER_CLIENT && client->data.user.fifo) |
1049 |
+ snd_seq_fifo_clear(client->data.user.fifo); |
1050 |
+ } |
1051 |
+ |
1052 |
+diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c |
1053 |
+index 81f7c109dc46..65175902a68a 100644 |
1054 |
+--- a/sound/core/seq/seq_compat.c |
1055 |
++++ b/sound/core/seq/seq_compat.c |
1056 |
+@@ -49,11 +49,12 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned |
1057 |
+ struct snd_seq_port_info *data; |
1058 |
+ mm_segment_t fs; |
1059 |
+ |
1060 |
+- data = memdup_user(data32, sizeof(*data32)); |
1061 |
+- if (IS_ERR(data)) |
1062 |
+- return PTR_ERR(data); |
1063 |
++ data = kmalloc(sizeof(*data), GFP_KERNEL); |
1064 |
++ if (!data) |
1065 |
++ return -ENOMEM; |
1066 |
+ |
1067 |
+- if (get_user(data->flags, &data32->flags) || |
1068 |
++ if (copy_from_user(data, data32, sizeof(*data32)) || |
1069 |
++ get_user(data->flags, &data32->flags) || |
1070 |
+ get_user(data->time_queue, &data32->time_queue)) |
1071 |
+ goto error; |
1072 |
+ data->kernel = NULL; |
1073 |
+diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c |
1074 |
+index f9077361c119..4c9aa462de9b 100644 |
1075 |
+--- a/sound/core/seq/seq_queue.c |
1076 |
++++ b/sound/core/seq/seq_queue.c |
1077 |
+@@ -144,8 +144,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked) |
1078 |
+ static void queue_delete(struct snd_seq_queue *q) |
1079 |
+ { |
1080 |
+ /* stop and release the timer */ |
1081 |
++ mutex_lock(&q->timer_mutex); |
1082 |
+ snd_seq_timer_stop(q->timer); |
1083 |
+ snd_seq_timer_close(q); |
1084 |
++ mutex_unlock(&q->timer_mutex); |
1085 |
+ /* wait until access free */ |
1086 |
+ snd_use_lock_sync(&q->use_lock); |
1087 |
+ /* release resources... */ |
1088 |
+diff --git a/sound/core/timer.c b/sound/core/timer.c |
1089 |
+index 6ddcf06f52f9..4e436fe53afa 100644 |
1090 |
+--- a/sound/core/timer.c |
1091 |
++++ b/sound/core/timer.c |
1092 |
+@@ -73,7 +73,7 @@ struct snd_timer_user { |
1093 |
+ struct timespec tstamp; /* trigger tstamp */ |
1094 |
+ wait_queue_head_t qchange_sleep; |
1095 |
+ struct fasync_struct *fasync; |
1096 |
+- struct mutex tread_sem; |
1097 |
++ struct mutex ioctl_lock; |
1098 |
+ }; |
1099 |
+ |
1100 |
+ /* list of timers */ |
1101 |
+@@ -215,11 +215,13 @@ static void snd_timer_check_master(struct snd_timer_instance *master) |
1102 |
+ slave->slave_id == master->slave_id) { |
1103 |
+ list_move_tail(&slave->open_list, &master->slave_list_head); |
1104 |
+ spin_lock_irq(&slave_active_lock); |
1105 |
++ spin_lock(&master->timer->lock); |
1106 |
+ slave->master = master; |
1107 |
+ slave->timer = master->timer; |
1108 |
+ if (slave->flags & SNDRV_TIMER_IFLG_RUNNING) |
1109 |
+ list_add_tail(&slave->active_list, |
1110 |
+ &master->slave_active_head); |
1111 |
++ spin_unlock(&master->timer->lock); |
1112 |
+ spin_unlock_irq(&slave_active_lock); |
1113 |
+ } |
1114 |
+ } |
1115 |
+@@ -345,15 +347,18 @@ int snd_timer_close(struct snd_timer_instance *timeri) |
1116 |
+ timer->hw.close) |
1117 |
+ timer->hw.close(timer); |
1118 |
+ /* remove slave links */ |
1119 |
++ spin_lock_irq(&slave_active_lock); |
1120 |
++ spin_lock(&timer->lock); |
1121 |
+ list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head, |
1122 |
+ open_list) { |
1123 |
+- spin_lock_irq(&slave_active_lock); |
1124 |
+- _snd_timer_stop(slave, 1, SNDRV_TIMER_EVENT_RESOLUTION); |
1125 |
+ list_move_tail(&slave->open_list, &snd_timer_slave_list); |
1126 |
+ slave->master = NULL; |
1127 |
+ slave->timer = NULL; |
1128 |
+- spin_unlock_irq(&slave_active_lock); |
1129 |
++ list_del_init(&slave->ack_list); |
1130 |
++ list_del_init(&slave->active_list); |
1131 |
+ } |
1132 |
++ spin_unlock(&timer->lock); |
1133 |
++ spin_unlock_irq(&slave_active_lock); |
1134 |
+ mutex_unlock(®ister_mutex); |
1135 |
+ } |
1136 |
+ out: |
1137 |
+@@ -440,9 +445,12 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri) |
1138 |
+ |
1139 |
+ spin_lock_irqsave(&slave_active_lock, flags); |
1140 |
+ timeri->flags |= SNDRV_TIMER_IFLG_RUNNING; |
1141 |
+- if (timeri->master) |
1142 |
++ if (timeri->master && timeri->timer) { |
1143 |
++ spin_lock(&timeri->timer->lock); |
1144 |
+ list_add_tail(&timeri->active_list, |
1145 |
+ &timeri->master->slave_active_head); |
1146 |
++ spin_unlock(&timeri->timer->lock); |
1147 |
++ } |
1148 |
+ spin_unlock_irqrestore(&slave_active_lock, flags); |
1149 |
+ return 1; /* delayed start */ |
1150 |
+ } |
1151 |
+@@ -488,6 +496,8 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri, |
1152 |
+ if (!keep_flag) { |
1153 |
+ spin_lock_irqsave(&slave_active_lock, flags); |
1154 |
+ timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; |
1155 |
++ list_del_init(&timeri->ack_list); |
1156 |
++ list_del_init(&timeri->active_list); |
1157 |
+ spin_unlock_irqrestore(&slave_active_lock, flags); |
1158 |
+ } |
1159 |
+ goto __end; |
1160 |
+@@ -693,7 +703,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left) |
1161 |
+ } else { |
1162 |
+ ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING; |
1163 |
+ if (--timer->running) |
1164 |
+- list_del(&ti->active_list); |
1165 |
++ list_del_init(&ti->active_list); |
1166 |
+ } |
1167 |
+ if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) || |
1168 |
+ (ti->flags & SNDRV_TIMER_IFLG_FAST)) |
1169 |
+@@ -1256,7 +1266,7 @@ static int snd_timer_user_open(struct inode *inode, struct file *file) |
1170 |
+ return -ENOMEM; |
1171 |
+ spin_lock_init(&tu->qlock); |
1172 |
+ init_waitqueue_head(&tu->qchange_sleep); |
1173 |
+- mutex_init(&tu->tread_sem); |
1174 |
++ mutex_init(&tu->ioctl_lock); |
1175 |
+ tu->ticks = 1; |
1176 |
+ tu->queue_size = 128; |
1177 |
+ tu->queue = kmalloc(tu->queue_size * sizeof(struct snd_timer_read), |
1178 |
+@@ -1276,8 +1286,10 @@ static int snd_timer_user_release(struct inode *inode, struct file *file) |
1179 |
+ if (file->private_data) { |
1180 |
+ tu = file->private_data; |
1181 |
+ file->private_data = NULL; |
1182 |
++ mutex_lock(&tu->ioctl_lock); |
1183 |
+ if (tu->timeri) |
1184 |
+ snd_timer_close(tu->timeri); |
1185 |
++ mutex_unlock(&tu->ioctl_lock); |
1186 |
+ kfree(tu->queue); |
1187 |
+ kfree(tu->tqueue); |
1188 |
+ kfree(tu); |
1189 |
+@@ -1515,7 +1527,6 @@ static int snd_timer_user_tselect(struct file *file, |
1190 |
+ int err = 0; |
1191 |
+ |
1192 |
+ tu = file->private_data; |
1193 |
+- mutex_lock(&tu->tread_sem); |
1194 |
+ if (tu->timeri) { |
1195 |
+ snd_timer_close(tu->timeri); |
1196 |
+ tu->timeri = NULL; |
1197 |
+@@ -1559,7 +1570,6 @@ static int snd_timer_user_tselect(struct file *file, |
1198 |
+ } |
1199 |
+ |
1200 |
+ __err: |
1201 |
+- mutex_unlock(&tu->tread_sem); |
1202 |
+ return err; |
1203 |
+ } |
1204 |
+ |
1205 |
+@@ -1772,7 +1782,7 @@ enum { |
1206 |
+ SNDRV_TIMER_IOCTL_PAUSE_OLD = _IO('T', 0x23), |
1207 |
+ }; |
1208 |
+ |
1209 |
+-static long snd_timer_user_ioctl(struct file *file, unsigned int cmd, |
1210 |
++static long __snd_timer_user_ioctl(struct file *file, unsigned int cmd, |
1211 |
+ unsigned long arg) |
1212 |
+ { |
1213 |
+ struct snd_timer_user *tu; |
1214 |
+@@ -1789,17 +1799,11 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd, |
1215 |
+ { |
1216 |
+ int xarg; |
1217 |
+ |
1218 |
+- mutex_lock(&tu->tread_sem); |
1219 |
+- if (tu->timeri) { /* too late */ |
1220 |
+- mutex_unlock(&tu->tread_sem); |
1221 |
++ if (tu->timeri) /* too late */ |
1222 |
+ return -EBUSY; |
1223 |
+- } |
1224 |
+- if (get_user(xarg, p)) { |
1225 |
+- mutex_unlock(&tu->tread_sem); |
1226 |
++ if (get_user(xarg, p)) |
1227 |
+ return -EFAULT; |
1228 |
+- } |
1229 |
+ tu->tread = xarg ? 1 : 0; |
1230 |
+- mutex_unlock(&tu->tread_sem); |
1231 |
+ return 0; |
1232 |
+ } |
1233 |
+ case SNDRV_TIMER_IOCTL_GINFO: |
1234 |
+@@ -1832,6 +1836,18 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd, |
1235 |
+ return -ENOTTY; |
1236 |
+ } |
1237 |
+ |
1238 |
++static long snd_timer_user_ioctl(struct file *file, unsigned int cmd, |
1239 |
++ unsigned long arg) |
1240 |
++{ |
1241 |
++ struct snd_timer_user *tu = file->private_data; |
1242 |
++ long ret; |
1243 |
++ |
1244 |
++ mutex_lock(&tu->ioctl_lock); |
1245 |
++ ret = __snd_timer_user_ioctl(file, cmd, arg); |
1246 |
++ mutex_unlock(&tu->ioctl_lock); |
1247 |
++ return ret; |
1248 |
++} |
1249 |
++ |
1250 |
+ static int snd_timer_user_fasync(int fd, struct file * file, int on) |
1251 |
+ { |
1252 |
+ struct snd_timer_user *tu; |
1253 |
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c |
1254 |
+index 1800db643a16..57d01f101b04 100644 |
1255 |
+--- a/sound/pci/hda/hda_intel.c |
1256 |
++++ b/sound/pci/hda/hda_intel.c |
1257 |
+@@ -1104,6 +1104,36 @@ static unsigned int azx_get_response(struct hda_bus *bus, |
1258 |
+ return azx_rirb_get_response(bus, addr); |
1259 |
+ } |
1260 |
+ |
1261 |
++#ifdef CONFIG_PM_SLEEP |
1262 |
++/* put codec down to D3 at hibernation for Intel SKL+; |
1263 |
++ * otherwise BIOS may still access the codec and screw up the driver |
1264 |
++ */ |
1265 |
++#define IS_SKL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa170) |
1266 |
++#define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70) |
1267 |
++#define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) |
1268 |
++#define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) |
1269 |
++ |
1270 |
++static int azx_freeze_noirq(struct device *dev) |
1271 |
++{ |
1272 |
++ struct pci_dev *pci = to_pci_dev(dev); |
1273 |
++ |
1274 |
++ if (IS_SKL_PLUS(pci)) |
1275 |
++ pci_set_power_state(pci, PCI_D3hot); |
1276 |
++ |
1277 |
++ return 0; |
1278 |
++} |
1279 |
++ |
1280 |
++static int azx_thaw_noirq(struct device *dev) |
1281 |
++{ |
1282 |
++ struct pci_dev *pci = to_pci_dev(dev); |
1283 |
++ |
1284 |
++ if (IS_SKL_PLUS(pci)) |
1285 |
++ pci_set_power_state(pci, PCI_D0); |
1286 |
++ |
1287 |
++ return 0; |
1288 |
++} |
1289 |
++#endif /* CONFIG_PM_SLEEP */ |
1290 |
++ |
1291 |
+ #ifdef CONFIG_PM |
1292 |
+ static void azx_power_notify(struct hda_bus *bus, bool power_up); |
1293 |
+ #endif |
1294 |
+@@ -2974,6 +3004,10 @@ static int azx_runtime_idle(struct device *dev) |
1295 |
+ #ifdef CONFIG_PM |
1296 |
+ static const struct dev_pm_ops azx_pm = { |
1297 |
+ SET_SYSTEM_SLEEP_PM_OPS(azx_suspend, azx_resume) |
1298 |
++#ifdef CONFIG_PM_SLEEP |
1299 |
++ .freeze_noirq = azx_freeze_noirq, |
1300 |
++ .thaw_noirq = azx_thaw_noirq, |
1301 |
++#endif |
1302 |
+ SET_RUNTIME_PM_OPS(azx_runtime_suspend, azx_runtime_resume, azx_runtime_idle) |
1303 |
+ }; |
1304 |
+ |
1305 |
+@@ -3864,6 +3898,11 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = { |
1306 |
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, |
1307 |
+ { PCI_DEVICE(0x8086, 0x8d21), |
1308 |
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, |
1309 |
++ /* Lewisburg */ |
1310 |
++ { PCI_DEVICE(0x8086, 0xa1f0), |
1311 |
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, |
1312 |
++ { PCI_DEVICE(0x8086, 0xa270), |
1313 |
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, |
1314 |
+ /* Lynx Point-LP */ |
1315 |
+ { PCI_DEVICE(0x8086, 0x9c20), |
1316 |
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, |
1317 |
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
1318 |
+index 183a96ab2533..69a2aafb0b0f 100644 |
1319 |
+--- a/sound/pci/hda/patch_realtek.c |
1320 |
++++ b/sound/pci/hda/patch_realtek.c |
1321 |
+@@ -1768,6 +1768,7 @@ enum { |
1322 |
+ ALC889_FIXUP_MBA11_VREF, |
1323 |
+ ALC889_FIXUP_MBA21_VREF, |
1324 |
+ ALC889_FIXUP_MP11_VREF, |
1325 |
++ ALC889_FIXUP_MP41_VREF, |
1326 |
+ ALC882_FIXUP_INV_DMIC, |
1327 |
+ ALC882_FIXUP_NO_PRIMARY_HP, |
1328 |
+ ALC887_FIXUP_ASUS_BASS, |
1329 |
+@@ -1854,7 +1855,7 @@ static void alc889_fixup_mbp_vref(struct hda_codec *codec, |
1330 |
+ const struct hda_fixup *fix, int action) |
1331 |
+ { |
1332 |
+ struct alc_spec *spec = codec->spec; |
1333 |
+- static hda_nid_t nids[2] = { 0x14, 0x15 }; |
1334 |
++ static hda_nid_t nids[3] = { 0x14, 0x15, 0x19 }; |
1335 |
+ int i; |
1336 |
+ |
1337 |
+ if (action != HDA_FIXUP_ACT_INIT) |
1338 |
+@@ -2128,6 +2129,12 @@ static const struct hda_fixup alc882_fixups[] = { |
1339 |
+ .chained = true, |
1340 |
+ .chain_id = ALC885_FIXUP_MACPRO_GPIO, |
1341 |
+ }, |
1342 |
++ [ALC889_FIXUP_MP41_VREF] = { |
1343 |
++ .type = HDA_FIXUP_FUNC, |
1344 |
++ .v.func = alc889_fixup_mbp_vref, |
1345 |
++ .chained = true, |
1346 |
++ .chain_id = ALC885_FIXUP_MACPRO_GPIO, |
1347 |
++ }, |
1348 |
+ [ALC882_FIXUP_INV_DMIC] = { |
1349 |
+ .type = HDA_FIXUP_FUNC, |
1350 |
+ .v.func = alc_fixup_inv_dmic_0x12, |
1351 |
+@@ -2200,7 +2207,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { |
1352 |
+ SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC889_FIXUP_IMAC91_VREF), |
1353 |
+ SND_PCI_QUIRK(0x106b, 0x4000, "MacbookPro 5,1", ALC889_FIXUP_IMAC91_VREF), |
1354 |
+ SND_PCI_QUIRK(0x106b, 0x4100, "Macmini 3,1", ALC889_FIXUP_IMAC91_VREF), |
1355 |
+- SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 5,1", ALC885_FIXUP_MACPRO_GPIO), |
1356 |
++ SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 4,1/5,1", ALC889_FIXUP_MP41_VREF), |
1357 |
+ SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF), |
1358 |
+ SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF), |
1359 |
+ SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF), |
1360 |
+@@ -4446,6 +4453,7 @@ static const struct hda_fixup alc662_fixups[] = { |
1361 |
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = { |
1362 |
+ SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2), |
1363 |
+ SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC), |
1364 |
++ SND_PCI_QUIRK(0x1025, 0x0241, "Packard Bell DOTS", ALC662_FIXUP_INV_DMIC), |
1365 |
+ SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE), |
1366 |
+ SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE), |
1367 |
+ SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC), |
1368 |
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c |
1369 |
+index 44d3fb95ebba..5ffe7992aaed 100644 |
1370 |
+--- a/sound/pci/hda/patch_sigmatel.c |
1371 |
++++ b/sound/pci/hda/patch_sigmatel.c |
1372 |
+@@ -703,6 +703,7 @@ static bool hp_bnb2011_with_dock(struct hda_codec *codec) |
1373 |
+ static bool hp_blike_system(u32 subsystem_id) |
1374 |
+ { |
1375 |
+ switch (subsystem_id) { |
1376 |
++ case 0x103c1473: /* HP ProBook 6550b */ |
1377 |
+ case 0x103c1520: |
1378 |
+ case 0x103c1521: |
1379 |
+ case 0x103c1523: |
1380 |
+diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c |
1381 |
+index 5fb88ac82aa9..4fdb234d74b4 100644 |
1382 |
+--- a/sound/pci/rme96.c |
1383 |
++++ b/sound/pci/rme96.c |
1384 |
+@@ -703,10 +703,11 @@ snd_rme96_playback_setrate(struct rme96 *rme96, |
1385 |
+ { |
1386 |
+ /* change to/from double-speed: reset the DAC (if available) */ |
1387 |
+ snd_rme96_reset_dac(rme96); |
1388 |
++ return 1; /* need to restore volume */ |
1389 |
+ } else { |
1390 |
+ writel(rme96->wcreg, rme96->iobase + RME96_IO_CONTROL_REGISTER); |
1391 |
++ return 0; |
1392 |
+ } |
1393 |
+- return 0; |
1394 |
+ } |
1395 |
+ |
1396 |
+ static int |
1397 |
+@@ -944,6 +945,7 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream, |
1398 |
+ struct rme96 *rme96 = snd_pcm_substream_chip(substream); |
1399 |
+ struct snd_pcm_runtime *runtime = substream->runtime; |
1400 |
+ int err, rate, dummy; |
1401 |
++ bool apply_dac_volume = false; |
1402 |
+ |
1403 |
+ runtime->dma_area = (void __force *)(rme96->iobase + |
1404 |
+ RME96_IO_PLAY_BUFFER); |
1405 |
+@@ -957,24 +959,26 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream, |
1406 |
+ { |
1407 |
+ /* slave clock */ |
1408 |
+ if ((int)params_rate(params) != rate) { |
1409 |
+- spin_unlock_irq(&rme96->lock); |
1410 |
+- return -EIO; |
1411 |
+- } |
1412 |
+- } else if ((err = snd_rme96_playback_setrate(rme96, params_rate(params))) < 0) { |
1413 |
+- spin_unlock_irq(&rme96->lock); |
1414 |
+- return err; |
1415 |
+- } |
1416 |
+- if ((err = snd_rme96_playback_setformat(rme96, params_format(params))) < 0) { |
1417 |
+- spin_unlock_irq(&rme96->lock); |
1418 |
+- return err; |
1419 |
++ err = -EIO; |
1420 |
++ goto error; |
1421 |
++ } |
1422 |
++ } else { |
1423 |
++ err = snd_rme96_playback_setrate(rme96, params_rate(params)); |
1424 |
++ if (err < 0) |
1425 |
++ goto error; |
1426 |
++ apply_dac_volume = err > 0; /* need to restore volume later? */ |
1427 |
+ } |
1428 |
++ |
1429 |
++ err = snd_rme96_playback_setformat(rme96, params_format(params)); |
1430 |
++ if (err < 0) |
1431 |
++ goto error; |
1432 |
+ snd_rme96_setframelog(rme96, params_channels(params), 1); |
1433 |
+ if (rme96->capture_periodsize != 0) { |
1434 |
+ if (params_period_size(params) << rme96->playback_frlog != |
1435 |
+ rme96->capture_periodsize) |
1436 |
+ { |
1437 |
+- spin_unlock_irq(&rme96->lock); |
1438 |
+- return -EBUSY; |
1439 |
++ err = -EBUSY; |
1440 |
++ goto error; |
1441 |
+ } |
1442 |
+ } |
1443 |
+ rme96->playback_periodsize = |
1444 |
+@@ -985,9 +989,16 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream, |
1445 |
+ rme96->wcreg &= ~(RME96_WCR_PRO | RME96_WCR_DOLBY | RME96_WCR_EMP); |
1446 |
+ writel(rme96->wcreg |= rme96->wcreg_spdif_stream, rme96->iobase + RME96_IO_CONTROL_REGISTER); |
1447 |
+ } |
1448 |
++ |
1449 |
++ err = 0; |
1450 |
++ error: |
1451 |
+ spin_unlock_irq(&rme96->lock); |
1452 |
+- |
1453 |
+- return 0; |
1454 |
++ if (apply_dac_volume) { |
1455 |
++ usleep_range(3000, 10000); |
1456 |
++ snd_rme96_apply_dac_volume(rme96); |
1457 |
++ } |
1458 |
++ |
1459 |
++ return err; |
1460 |
+ } |
1461 |
+ |
1462 |
+ static int |
1463 |
+diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c |
1464 |
+index 663a2a748626..56815af4e00b 100644 |
1465 |
+--- a/sound/soc/codecs/arizona.c |
1466 |
++++ b/sound/soc/codecs/arizona.c |
1467 |
+@@ -1057,7 +1057,7 @@ static int arizona_hw_params(struct snd_pcm_substream *substream, |
1468 |
+ int chan_limit = arizona->pdata.max_channels_clocked[dai->id - 1]; |
1469 |
+ int bclk, lrclk, wl, frame, bclk_target; |
1470 |
+ |
1471 |
+- if (params_rate(params) % 8000) |
1472 |
++ if (params_rate(params) % 4000) |
1473 |
+ rates = &arizona_44k1_bclk_rates[0]; |
1474 |
+ else |
1475 |
+ rates = &arizona_48k_bclk_rates[0]; |
1476 |
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c |
1477 |
+index 1ae1f8bd9c36..305d28dec668 100644 |
1478 |
+--- a/sound/soc/codecs/wm8962.c |
1479 |
++++ b/sound/soc/codecs/wm8962.c |
1480 |
+@@ -363,8 +363,8 @@ static struct reg_default wm8962_reg[] = { |
1481 |
+ { 16924, 0x0059 }, /* R16924 - HDBASS_PG_1 */ |
1482 |
+ { 16925, 0x999A }, /* R16925 - HDBASS_PG_0 */ |
1483 |
+ |
1484 |
+- { 17048, 0x0083 }, /* R17408 - HPF_C_1 */ |
1485 |
+- { 17049, 0x98AD }, /* R17409 - HPF_C_0 */ |
1486 |
++ { 17408, 0x0083 }, /* R17408 - HPF_C_1 */ |
1487 |
++ { 17409, 0x98AD }, /* R17409 - HPF_C_0 */ |
1488 |
+ |
1489 |
+ { 17920, 0x007F }, /* R17920 - ADCL_RETUNE_C1_1 */ |
1490 |
+ { 17921, 0xFFFF }, /* R17921 - ADCL_RETUNE_C1_0 */ |
1491 |
+diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c |
1492 |
+index 06a8000aa07b..2340554981d6 100644 |
1493 |
+--- a/sound/soc/soc-compress.c |
1494 |
++++ b/sound/soc/soc-compress.c |
1495 |
+@@ -384,17 +384,34 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) |
1496 |
+ struct snd_compr *compr; |
1497 |
+ char new_name[64]; |
1498 |
+ int ret = 0, direction = 0; |
1499 |
++ int playback = 0, capture = 0; |
1500 |
+ |
1501 |
+ /* check client and interface hw capabilities */ |
1502 |
+ snprintf(new_name, sizeof(new_name), "%s %s-%d", |
1503 |
+ rtd->dai_link->stream_name, codec_dai->name, num); |
1504 |
+ |
1505 |
+ if (codec_dai->driver->playback.channels_min) |
1506 |
++ playback = 1; |
1507 |
++ if (codec_dai->driver->capture.channels_min) |
1508 |
++ capture = 1; |
1509 |
++ |
1510 |
++ capture = capture && cpu_dai->driver->capture.channels_min; |
1511 |
++ playback = playback && cpu_dai->driver->playback.channels_min; |
1512 |
++ |
1513 |
++ /* |
1514 |
++ * Compress devices are unidirectional so only one of the directions |
1515 |
++ * should be set, check for that (xor) |
1516 |
++ */ |
1517 |
++ if (playback + capture != 1) { |
1518 |
++ dev_err(rtd->card->dev, "Invalid direction for compress P %d, C %d\n", |
1519 |
++ playback, capture); |
1520 |
++ return -EINVAL; |
1521 |
++ } |
1522 |
++ |
1523 |
++ if(playback) |
1524 |
+ direction = SND_COMPRESS_PLAYBACK; |
1525 |
+- else if (codec_dai->driver->capture.channels_min) |
1526 |
+- direction = SND_COMPRESS_CAPTURE; |
1527 |
+ else |
1528 |
+- return -EINVAL; |
1529 |
++ direction = SND_COMPRESS_CAPTURE; |
1530 |
+ |
1531 |
+ compr = kzalloc(sizeof(*compr), GFP_KERNEL); |
1532 |
+ if (compr == NULL) { |