1 |
commit: 84a342eaf87540ddf324f068b34b168d7ea884e1 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Jun 13 14:54:01 2018 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Jun 13 14:54:01 2018 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=84a342ea |
7 |
|
8 |
Linux patch 4.4.137 |
9 |
|
10 |
0000_README | 4 + |
11 |
1136_linux-4.4.137.patch | 625 +++++++++++++++++++++++++++++++++++++++++++++++ |
12 |
2 files changed, 629 insertions(+) |
13 |
|
14 |
diff --git a/0000_README b/0000_README |
15 |
index be8e302..0416f8a 100644 |
16 |
--- a/0000_README |
17 |
+++ b/0000_README |
18 |
@@ -587,6 +587,10 @@ Patch: 1135_linux-4.4.136.patch |
19 |
From: http://www.kernel.org |
20 |
Desc: Linux 4.4.136 |
21 |
|
22 |
+Patch: 1136_linux-4.4.137.patch |
23 |
+From: http://www.kernel.org |
24 |
+Desc: Linux 4.4.137 |
25 |
+ |
26 |
Patch: 1500_XATTR_USER_PREFIX.patch |
27 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
28 |
Desc: Support for namespace user.pax.* on tmpfs. |
29 |
|
30 |
diff --git a/1136_linux-4.4.137.patch b/1136_linux-4.4.137.patch |
31 |
new file mode 100644 |
32 |
index 0000000..6be9985 |
33 |
--- /dev/null |
34 |
+++ b/1136_linux-4.4.137.patch |
35 |
@@ -0,0 +1,625 @@ |
36 |
+diff --git a/Documentation/networking/netdev-FAQ.txt b/Documentation/networking/netdev-FAQ.txt |
37 |
+index 0fe1c6e0dbcd..bfc6b3e68cc4 100644 |
38 |
+--- a/Documentation/networking/netdev-FAQ.txt |
39 |
++++ b/Documentation/networking/netdev-FAQ.txt |
40 |
+@@ -168,6 +168,15 @@ A: No. See above answer. In short, if you think it really belongs in |
41 |
+ dash marker line as described in Documentation/SubmittingPatches to |
42 |
+ temporarily embed that information into the patch that you send. |
43 |
+ |
44 |
++Q: Are all networking bug fixes backported to all stable releases? |
45 |
++ |
46 |
++A: Due to capacity, Dave could only take care of the backports for the last |
47 |
++ 2 stable releases. For earlier stable releases, each stable branch maintainer |
48 |
++ is supposed to take care of them. If you find any patch is missing from an |
49 |
++ earlier stable branch, please notify stable@×××××××××××.org with either a |
50 |
++ commit ID or a formal patch backported, and CC Dave and other relevant |
51 |
++ networking developers. |
52 |
++ |
53 |
+ Q: Someone said that the comment style and coding convention is different |
54 |
+ for the networking content. Is this true? |
55 |
+ |
56 |
+diff --git a/Makefile b/Makefile |
57 |
+index a05a7a005715..44efd1252ab8 100644 |
58 |
+--- a/Makefile |
59 |
++++ b/Makefile |
60 |
+@@ -1,6 +1,6 @@ |
61 |
+ VERSION = 4 |
62 |
+ PATCHLEVEL = 4 |
63 |
+-SUBLEVEL = 136 |
64 |
++SUBLEVEL = 137 |
65 |
+ EXTRAVERSION = |
66 |
+ NAME = Blurry Fish Butt |
67 |
+ |
68 |
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c |
69 |
+index a0d9ac6b6cc9..e759100e41a7 100644 |
70 |
+--- a/drivers/char/tpm/tpm-chip.c |
71 |
++++ b/drivers/char/tpm/tpm-chip.c |
72 |
+@@ -26,6 +26,7 @@ |
73 |
+ #include <linux/spinlock.h> |
74 |
+ #include <linux/freezer.h> |
75 |
+ #include <linux/major.h> |
76 |
++#include <linux/of.h> |
77 |
+ #include "tpm.h" |
78 |
+ #include "tpm_eventlog.h" |
79 |
+ |
80 |
+@@ -324,8 +325,20 @@ static void tpm1_chip_unregister(struct tpm_chip *chip) |
81 |
+ */ |
82 |
+ int tpm_chip_register(struct tpm_chip *chip) |
83 |
+ { |
84 |
++#ifdef CONFIG_OF |
85 |
++ struct device_node *np; |
86 |
++#endif |
87 |
+ int rc; |
88 |
+ |
89 |
++#ifdef CONFIG_OF |
90 |
++ np = of_find_node_by_name(NULL, "vtpm"); |
91 |
++ if (np) { |
92 |
++ if (of_property_read_bool(np, "powered-while-suspended")) |
93 |
++ chip->flags |= TPM_CHIP_FLAG_ALWAYS_POWERED; |
94 |
++ } |
95 |
++ of_node_put(np); |
96 |
++#endif |
97 |
++ |
98 |
+ rc = tpm1_chip_register(chip); |
99 |
+ if (rc) |
100 |
+ return rc; |
101 |
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c |
102 |
+index 36afc1a21699..95a40ec854ad 100644 |
103 |
+--- a/drivers/char/tpm/tpm-interface.c |
104 |
++++ b/drivers/char/tpm/tpm-interface.c |
105 |
+@@ -787,6 +787,10 @@ int tpm_do_selftest(struct tpm_chip *chip) |
106 |
+ loops = jiffies_to_msecs(duration) / delay_msec; |
107 |
+ |
108 |
+ rc = tpm_continue_selftest(chip); |
109 |
++ if (rc == TPM_ERR_INVALID_POSTINIT) { |
110 |
++ chip->flags |= TPM_CHIP_FLAG_ALWAYS_POWERED; |
111 |
++ dev_info(&chip->dev, "TPM not ready (%d)\n", rc); |
112 |
++ } |
113 |
+ /* This may fail if there was no TPM driver during a suspend/resume |
114 |
+ * cycle; some may return 10 (BAD_ORDINAL), others 28 (FAILEDSELFTEST) |
115 |
+ */ |
116 |
+@@ -931,6 +935,9 @@ int tpm_pm_suspend(struct device *dev) |
117 |
+ if (chip == NULL) |
118 |
+ return -ENODEV; |
119 |
+ |
120 |
++ if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED) |
121 |
++ return 0; |
122 |
++ |
123 |
+ if (chip->flags & TPM_CHIP_FLAG_TPM2) { |
124 |
+ tpm2_shutdown(chip, TPM2_SU_STATE); |
125 |
+ return 0; |
126 |
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h |
127 |
+index 772d99b3a8e4..36e1abda00f9 100644 |
128 |
+--- a/drivers/char/tpm/tpm.h |
129 |
++++ b/drivers/char/tpm/tpm.h |
130 |
+@@ -168,6 +168,7 @@ struct tpm_vendor_specific { |
131 |
+ enum tpm_chip_flags { |
132 |
+ TPM_CHIP_FLAG_REGISTERED = BIT(0), |
133 |
+ TPM_CHIP_FLAG_TPM2 = BIT(1), |
134 |
++ TPM_CHIP_FLAG_ALWAYS_POWERED = BIT(5), |
135 |
+ }; |
136 |
+ |
137 |
+ struct tpm_chip { |
138 |
+diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c |
139 |
+index 6b5625e66119..88ceac091454 100644 |
140 |
+--- a/drivers/gpu/drm/drm_fops.c |
141 |
++++ b/drivers/gpu/drm/drm_fops.c |
142 |
+@@ -209,6 +209,7 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor) |
143 |
+ return -ENOMEM; |
144 |
+ |
145 |
+ filp->private_data = priv; |
146 |
++ filp->f_mode |= FMODE_UNSIGNED_OFFSET; |
147 |
+ priv->filp = filp; |
148 |
+ priv->uid = current_euid(); |
149 |
+ priv->pid = get_pid(task_pid(current)); |
150 |
+diff --git a/drivers/isdn/hardware/eicon/diva.c b/drivers/isdn/hardware/eicon/diva.c |
151 |
+index d91dd580e978..37aaea88a6ad 100644 |
152 |
+--- a/drivers/isdn/hardware/eicon/diva.c |
153 |
++++ b/drivers/isdn/hardware/eicon/diva.c |
154 |
+@@ -387,10 +387,10 @@ void divasa_xdi_driver_unload(void) |
155 |
+ ** Receive and process command from user mode utility |
156 |
+ */ |
157 |
+ void *diva_xdi_open_adapter(void *os_handle, const void __user *src, |
158 |
+- int length, |
159 |
++ int length, void *mptr, |
160 |
+ divas_xdi_copy_from_user_fn_t cp_fn) |
161 |
+ { |
162 |
+- diva_xdi_um_cfg_cmd_t msg; |
163 |
++ diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr; |
164 |
+ diva_os_xdi_adapter_t *a = NULL; |
165 |
+ diva_os_spin_lock_magic_t old_irql; |
166 |
+ struct list_head *tmp; |
167 |
+@@ -400,21 +400,21 @@ void *diva_xdi_open_adapter(void *os_handle, const void __user *src, |
168 |
+ length, sizeof(diva_xdi_um_cfg_cmd_t))) |
169 |
+ return NULL; |
170 |
+ } |
171 |
+- if ((*cp_fn) (os_handle, &msg, src, sizeof(msg)) <= 0) { |
172 |
++ if ((*cp_fn) (os_handle, msg, src, sizeof(*msg)) <= 0) { |
173 |
+ DBG_ERR(("A: A(?) open, write error")) |
174 |
+ return NULL; |
175 |
+ } |
176 |
+ diva_os_enter_spin_lock(&adapter_lock, &old_irql, "open_adapter"); |
177 |
+ list_for_each(tmp, &adapter_queue) { |
178 |
+ a = list_entry(tmp, diva_os_xdi_adapter_t, link); |
179 |
+- if (a->controller == (int)msg.adapter) |
180 |
++ if (a->controller == (int)msg->adapter) |
181 |
+ break; |
182 |
+ a = NULL; |
183 |
+ } |
184 |
+ diva_os_leave_spin_lock(&adapter_lock, &old_irql, "open_adapter"); |
185 |
+ |
186 |
+ if (!a) { |
187 |
+- DBG_ERR(("A: A(%d) open, adapter not found", msg.adapter)) |
188 |
++ DBG_ERR(("A: A(%d) open, adapter not found", msg->adapter)) |
189 |
+ } |
190 |
+ |
191 |
+ return (a); |
192 |
+@@ -436,8 +436,10 @@ void diva_xdi_close_adapter(void *adapter, void *os_handle) |
193 |
+ |
194 |
+ int |
195 |
+ diva_xdi_write(void *adapter, void *os_handle, const void __user *src, |
196 |
+- int length, divas_xdi_copy_from_user_fn_t cp_fn) |
197 |
++ int length, void *mptr, |
198 |
++ divas_xdi_copy_from_user_fn_t cp_fn) |
199 |
+ { |
200 |
++ diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr; |
201 |
+ diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter; |
202 |
+ void *data; |
203 |
+ |
204 |
+@@ -458,7 +460,13 @@ diva_xdi_write(void *adapter, void *os_handle, const void __user *src, |
205 |
+ return (-2); |
206 |
+ } |
207 |
+ |
208 |
+- length = (*cp_fn) (os_handle, data, src, length); |
209 |
++ if (msg) { |
210 |
++ *(diva_xdi_um_cfg_cmd_t *)data = *msg; |
211 |
++ length = (*cp_fn) (os_handle, (char *)data + sizeof(*msg), |
212 |
++ src + sizeof(*msg), length - sizeof(*msg)); |
213 |
++ } else { |
214 |
++ length = (*cp_fn) (os_handle, data, src, length); |
215 |
++ } |
216 |
+ if (length > 0) { |
217 |
+ if ((*(a->interface.cmd_proc)) |
218 |
+ (a, (diva_xdi_um_cfg_cmd_t *) data, length)) { |
219 |
+diff --git a/drivers/isdn/hardware/eicon/diva.h b/drivers/isdn/hardware/eicon/diva.h |
220 |
+index e979085d1b89..a0a607c0c32e 100644 |
221 |
+--- a/drivers/isdn/hardware/eicon/diva.h |
222 |
++++ b/drivers/isdn/hardware/eicon/diva.h |
223 |
+@@ -19,10 +19,11 @@ int diva_xdi_read(void *adapter, void *os_handle, void __user *dst, |
224 |
+ int max_length, divas_xdi_copy_to_user_fn_t cp_fn); |
225 |
+ |
226 |
+ int diva_xdi_write(void *adapter, void *os_handle, const void __user *src, |
227 |
+- int length, divas_xdi_copy_from_user_fn_t cp_fn); |
228 |
++ int length, void *msg, |
229 |
++ divas_xdi_copy_from_user_fn_t cp_fn); |
230 |
+ |
231 |
+ void *diva_xdi_open_adapter(void *os_handle, const void __user *src, |
232 |
+- int length, |
233 |
++ int length, void *msg, |
234 |
+ divas_xdi_copy_from_user_fn_t cp_fn); |
235 |
+ |
236 |
+ void diva_xdi_close_adapter(void *adapter, void *os_handle); |
237 |
+diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c |
238 |
+index a2e0ed6c9a4d..91bd2ba0bdd8 100644 |
239 |
+--- a/drivers/isdn/hardware/eicon/divasmain.c |
240 |
++++ b/drivers/isdn/hardware/eicon/divasmain.c |
241 |
+@@ -591,19 +591,22 @@ static int divas_release(struct inode *inode, struct file *file) |
242 |
+ static ssize_t divas_write(struct file *file, const char __user *buf, |
243 |
+ size_t count, loff_t *ppos) |
244 |
+ { |
245 |
++ diva_xdi_um_cfg_cmd_t msg; |
246 |
+ int ret = -EINVAL; |
247 |
+ |
248 |
+ if (!file->private_data) { |
249 |
+ file->private_data = diva_xdi_open_adapter(file, buf, |
250 |
+- count, |
251 |
++ count, &msg, |
252 |
+ xdi_copy_from_user); |
253 |
+- } |
254 |
+- if (!file->private_data) { |
255 |
+- return (-ENODEV); |
256 |
++ if (!file->private_data) |
257 |
++ return (-ENODEV); |
258 |
++ ret = diva_xdi_write(file->private_data, file, |
259 |
++ buf, count, &msg, xdi_copy_from_user); |
260 |
++ } else { |
261 |
++ ret = diva_xdi_write(file->private_data, file, |
262 |
++ buf, count, NULL, xdi_copy_from_user); |
263 |
+ } |
264 |
+ |
265 |
+- ret = diva_xdi_write(file->private_data, file, |
266 |
+- buf, count, xdi_copy_from_user); |
267 |
+ switch (ret) { |
268 |
+ case -1: /* Message should be removed from rx mailbox first */ |
269 |
+ ret = -EBUSY; |
270 |
+@@ -622,11 +625,12 @@ static ssize_t divas_write(struct file *file, const char __user *buf, |
271 |
+ static ssize_t divas_read(struct file *file, char __user *buf, |
272 |
+ size_t count, loff_t *ppos) |
273 |
+ { |
274 |
++ diva_xdi_um_cfg_cmd_t msg; |
275 |
+ int ret = -EINVAL; |
276 |
+ |
277 |
+ if (!file->private_data) { |
278 |
+ file->private_data = diva_xdi_open_adapter(file, buf, |
279 |
+- count, |
280 |
++ count, &msg, |
281 |
+ xdi_copy_from_user); |
282 |
+ } |
283 |
+ if (!file->private_data) { |
284 |
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c |
285 |
+index d946bba43726..87534c6efd66 100644 |
286 |
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c |
287 |
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c |
288 |
+@@ -594,7 +594,7 @@ static void bnx2x_ets_e3b0_nig_disabled(const struct link_params *params, |
289 |
+ * slots for the highest priority. |
290 |
+ */ |
291 |
+ REG_WR(bp, (port) ? NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS : |
292 |
+- NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100); |
293 |
++ NIG_REG_P0_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100); |
294 |
+ /* Mapping between the CREDIT_WEIGHT registers and actual client |
295 |
+ * numbers |
296 |
+ */ |
297 |
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c |
298 |
+index 0e3b2ebf87f1..029fa5bee520 100644 |
299 |
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c |
300 |
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c |
301 |
+@@ -2543,11 +2543,11 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) |
302 |
+ pci_set_master(pdev); |
303 |
+ |
304 |
+ /* Query PCI controller on system for DMA addressing |
305 |
+- * limitation for the device. Try 64-bit first, and |
306 |
++ * limitation for the device. Try 47-bit first, and |
307 |
+ * fail to 32-bit. |
308 |
+ */ |
309 |
+ |
310 |
+- err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64)); |
311 |
++ err = pci_set_dma_mask(pdev, DMA_BIT_MASK(47)); |
312 |
+ if (err) { |
313 |
+ err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)); |
314 |
+ if (err) { |
315 |
+@@ -2561,10 +2561,10 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) |
316 |
+ goto err_out_release_regions; |
317 |
+ } |
318 |
+ } else { |
319 |
+- err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)); |
320 |
++ err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(47)); |
321 |
+ if (err) { |
322 |
+ dev_err(dev, "Unable to obtain %u-bit DMA " |
323 |
+- "for consistent allocations, aborting\n", 64); |
324 |
++ "for consistent allocations, aborting\n", 47); |
325 |
+ goto err_out_release_regions; |
326 |
+ } |
327 |
+ using_dac = 1; |
328 |
+diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c |
329 |
+index 62f1a3433a62..d6d87dd8a28f 100644 |
330 |
+--- a/drivers/net/ethernet/mellanox/mlx4/qp.c |
331 |
++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c |
332 |
+@@ -386,11 +386,11 @@ struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn) |
333 |
+ struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table; |
334 |
+ struct mlx4_qp *qp; |
335 |
+ |
336 |
+- spin_lock(&qp_table->lock); |
337 |
++ spin_lock_irq(&qp_table->lock); |
338 |
+ |
339 |
+ qp = __mlx4_qp_lookup(dev, qpn); |
340 |
+ |
341 |
+- spin_unlock(&qp_table->lock); |
342 |
++ spin_unlock_irq(&qp_table->lock); |
343 |
+ return qp; |
344 |
+ } |
345 |
+ |
346 |
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c |
347 |
+index 7ccdb46c6764..21e0af2620ee 100644 |
348 |
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c |
349 |
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c |
350 |
+@@ -43,7 +43,7 @@ |
351 |
+ #define ILT_CFG_REG(cli, reg) PSWRQ2_REG_ ## cli ## _ ## reg ## _RT_OFFSET |
352 |
+ |
353 |
+ /* ILT entry structure */ |
354 |
+-#define ILT_ENTRY_PHY_ADDR_MASK 0x000FFFFFFFFFFFULL |
355 |
++#define ILT_ENTRY_PHY_ADDR_MASK (~0ULL >> 12) |
356 |
+ #define ILT_ENTRY_PHY_ADDR_SHIFT 0 |
357 |
+ #define ILT_ENTRY_VALID_MASK 0x1ULL |
358 |
+ #define ILT_ENTRY_VALID_SHIFT 52 |
359 |
+diff --git a/drivers/net/phy/bcm-cygnus.c b/drivers/net/phy/bcm-cygnus.c |
360 |
+index 49bbc6826883..9a7dca2bb618 100644 |
361 |
+--- a/drivers/net/phy/bcm-cygnus.c |
362 |
++++ b/drivers/net/phy/bcm-cygnus.c |
363 |
+@@ -61,17 +61,17 @@ static int bcm_cygnus_afe_config(struct phy_device *phydev) |
364 |
+ return rc; |
365 |
+ |
366 |
+ /* make rcal=100, since rdb default is 000 */ |
367 |
+- rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB1, 0x10); |
368 |
++ rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB1, 0x10); |
369 |
+ if (rc < 0) |
370 |
+ return rc; |
371 |
+ |
372 |
+ /* CORE_EXPB0, Reset R_CAL/RC_CAL Engine */ |
373 |
+- rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x10); |
374 |
++ rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x10); |
375 |
+ if (rc < 0) |
376 |
+ return rc; |
377 |
+ |
378 |
+ /* CORE_EXPB0, Disable Reset R_CAL/RC_CAL Engine */ |
379 |
+- rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x00); |
380 |
++ rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x00); |
381 |
+ |
382 |
+ return 0; |
383 |
+ } |
384 |
+diff --git a/drivers/net/phy/bcm-phy-lib.h b/drivers/net/phy/bcm-phy-lib.h |
385 |
+index b2091c88b44d..ce16b26d49ff 100644 |
386 |
+--- a/drivers/net/phy/bcm-phy-lib.h |
387 |
++++ b/drivers/net/phy/bcm-phy-lib.h |
388 |
+@@ -14,11 +14,18 @@ |
389 |
+ #ifndef _LINUX_BCM_PHY_LIB_H |
390 |
+ #define _LINUX_BCM_PHY_LIB_H |
391 |
+ |
392 |
++#include <linux/brcmphy.h> |
393 |
+ #include <linux/phy.h> |
394 |
+ |
395 |
+ int bcm_phy_write_exp(struct phy_device *phydev, u16 reg, u16 val); |
396 |
+ int bcm_phy_read_exp(struct phy_device *phydev, u16 reg); |
397 |
+ |
398 |
++static inline int bcm_phy_write_exp_sel(struct phy_device *phydev, |
399 |
++ u16 reg, u16 val) |
400 |
++{ |
401 |
++ return bcm_phy_write_exp(phydev, reg | MII_BCM54XX_EXP_SEL_ER, val); |
402 |
++} |
403 |
++ |
404 |
+ int bcm_phy_write_misc(struct phy_device *phydev, |
405 |
+ u16 reg, u16 chl, u16 value); |
406 |
+ int bcm_phy_read_misc(struct phy_device *phydev, |
407 |
+diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c |
408 |
+index 03d4809a9126..bffa70e46202 100644 |
409 |
+--- a/drivers/net/phy/bcm7xxx.c |
410 |
++++ b/drivers/net/phy/bcm7xxx.c |
411 |
+@@ -48,10 +48,10 @@ |
412 |
+ static void r_rc_cal_reset(struct phy_device *phydev) |
413 |
+ { |
414 |
+ /* Reset R_CAL/RC_CAL Engine */ |
415 |
+- bcm_phy_write_exp(phydev, 0x00b0, 0x0010); |
416 |
++ bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0010); |
417 |
+ |
418 |
+ /* Disable Reset R_AL/RC_CAL Engine */ |
419 |
+- bcm_phy_write_exp(phydev, 0x00b0, 0x0000); |
420 |
++ bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0000); |
421 |
+ } |
422 |
+ |
423 |
+ static int bcm7xxx_28nm_b0_afe_config_init(struct phy_device *phydev) |
424 |
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c |
425 |
+index e74709e4b5dd..49174837c2ba 100644 |
426 |
+--- a/drivers/net/team/team.c |
427 |
++++ b/drivers/net/team/team.c |
428 |
+@@ -983,7 +983,8 @@ static void team_port_disable(struct team *team, |
429 |
+ static void ___team_compute_features(struct team *team) |
430 |
+ { |
431 |
+ struct team_port *port; |
432 |
+- u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL; |
433 |
++ netdev_features_t vlan_features = TEAM_VLAN_FEATURES & |
434 |
++ NETIF_F_ALL_FOR_ALL; |
435 |
+ unsigned short max_hard_header_len = ETH_HLEN; |
436 |
+ unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE | |
437 |
+ IFF_XMIT_DST_RELEASE_PERM; |
438 |
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c |
439 |
+index 96a5028621c8..8edbccf06b7b 100644 |
440 |
+--- a/drivers/net/usb/cdc_mbim.c |
441 |
++++ b/drivers/net/usb/cdc_mbim.c |
442 |
+@@ -593,7 +593,7 @@ static const struct driver_info cdc_mbim_info_zlp = { |
443 |
+ */ |
444 |
+ static const struct driver_info cdc_mbim_info_ndp_to_end = { |
445 |
+ .description = "CDC MBIM", |
446 |
+- .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN, |
447 |
++ .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP, |
448 |
+ .bind = cdc_mbim_bind, |
449 |
+ .unbind = cdc_mbim_unbind, |
450 |
+ .manage_power = cdc_mbim_manage_power, |
451 |
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c |
452 |
+index 83e5aa6a9f28..ad35e760ed3f 100644 |
453 |
+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c |
454 |
++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c |
455 |
+@@ -6167,7 +6167,7 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy, |
456 |
+ req->alpha2[0], req->alpha2[1]); |
457 |
+ |
458 |
+ /* ignore non-ISO3166 country codes */ |
459 |
+- for (i = 0; i < sizeof(req->alpha2); i++) |
460 |
++ for (i = 0; i < 2; i++) |
461 |
+ if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') { |
462 |
+ brcmf_err("not a ISO3166 code\n"); |
463 |
+ return; |
464 |
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c |
465 |
+index f52c72a1a06f..73b725f965eb 100644 |
466 |
+--- a/fs/xfs/xfs_log.c |
467 |
++++ b/fs/xfs/xfs_log.c |
468 |
+@@ -3323,8 +3323,6 @@ maybe_sleep: |
469 |
+ */ |
470 |
+ if (iclog->ic_state & XLOG_STATE_IOERROR) |
471 |
+ return -EIO; |
472 |
+- if (log_flushed) |
473 |
+- *log_flushed = 1; |
474 |
+ } else { |
475 |
+ |
476 |
+ no_sleep: |
477 |
+@@ -3432,8 +3430,6 @@ try_again: |
478 |
+ |
479 |
+ xlog_wait(&iclog->ic_prev->ic_write_wait, |
480 |
+ &log->l_icloglock); |
481 |
+- if (log_flushed) |
482 |
+- *log_flushed = 1; |
483 |
+ already_slept = 1; |
484 |
+ goto try_again; |
485 |
+ } |
486 |
+@@ -3467,9 +3463,6 @@ try_again: |
487 |
+ */ |
488 |
+ if (iclog->ic_state & XLOG_STATE_IOERROR) |
489 |
+ return -EIO; |
490 |
+- |
491 |
+- if (log_flushed) |
492 |
+- *log_flushed = 1; |
493 |
+ } else { /* just return */ |
494 |
+ spin_unlock(&log->l_icloglock); |
495 |
+ } |
496 |
+diff --git a/mm/mmap.c b/mm/mmap.c |
497 |
+index cc84b97ca250..39f5fbd07486 100644 |
498 |
+--- a/mm/mmap.c |
499 |
++++ b/mm/mmap.c |
500 |
+@@ -1275,6 +1275,35 @@ static inline int mlock_future_check(struct mm_struct *mm, |
501 |
+ return 0; |
502 |
+ } |
503 |
+ |
504 |
++static inline u64 file_mmap_size_max(struct file *file, struct inode *inode) |
505 |
++{ |
506 |
++ if (S_ISREG(inode->i_mode)) |
507 |
++ return MAX_LFS_FILESIZE; |
508 |
++ |
509 |
++ if (S_ISBLK(inode->i_mode)) |
510 |
++ return MAX_LFS_FILESIZE; |
511 |
++ |
512 |
++ /* Special "we do even unsigned file positions" case */ |
513 |
++ if (file->f_mode & FMODE_UNSIGNED_OFFSET) |
514 |
++ return 0; |
515 |
++ |
516 |
++ /* Yes, random drivers might want more. But I'm tired of buggy drivers */ |
517 |
++ return ULONG_MAX; |
518 |
++} |
519 |
++ |
520 |
++static inline bool file_mmap_ok(struct file *file, struct inode *inode, |
521 |
++ unsigned long pgoff, unsigned long len) |
522 |
++{ |
523 |
++ u64 maxsize = file_mmap_size_max(file, inode); |
524 |
++ |
525 |
++ if (maxsize && len > maxsize) |
526 |
++ return false; |
527 |
++ maxsize -= len; |
528 |
++ if (pgoff > maxsize >> PAGE_SHIFT) |
529 |
++ return false; |
530 |
++ return true; |
531 |
++} |
532 |
++ |
533 |
+ /* |
534 |
+ * The caller must hold down_write(¤t->mm->mmap_sem). |
535 |
+ */ |
536 |
+@@ -1340,6 +1369,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr, |
537 |
+ if (file) { |
538 |
+ struct inode *inode = file_inode(file); |
539 |
+ |
540 |
++ if (!file_mmap_ok(file, inode, pgoff, len)) |
541 |
++ return -EOVERFLOW; |
542 |
++ |
543 |
+ switch (flags & MAP_TYPE) { |
544 |
+ case MAP_SHARED: |
545 |
+ if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE)) |
546 |
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
547 |
+index 5b3d611d8b5f..2017ffa5197a 100644 |
548 |
+--- a/net/core/rtnetlink.c |
549 |
++++ b/net/core/rtnetlink.c |
550 |
+@@ -1691,6 +1691,10 @@ static int do_setlink(const struct sk_buff *skb, |
551 |
+ const struct net_device_ops *ops = dev->netdev_ops; |
552 |
+ int err; |
553 |
+ |
554 |
++ err = validate_linkmsg(dev, tb); |
555 |
++ if (err < 0) |
556 |
++ return err; |
557 |
++ |
558 |
+ if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD]) { |
559 |
+ struct net *net = rtnl_link_get_net(dev_net(dev), tb); |
560 |
+ if (IS_ERR(net)) { |
561 |
+@@ -1982,10 +1986,6 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh) |
562 |
+ goto errout; |
563 |
+ } |
564 |
+ |
565 |
+- err = validate_linkmsg(dev, tb); |
566 |
+- if (err < 0) |
567 |
+- goto errout; |
568 |
+- |
569 |
+ err = do_setlink(skb, dev, ifm, tb, ifname, 0); |
570 |
+ errout: |
571 |
+ return err; |
572 |
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c |
573 |
+index ff3b058cf58c..936dab12f99f 100644 |
574 |
+--- a/net/dccp/proto.c |
575 |
++++ b/net/dccp/proto.c |
576 |
+@@ -280,9 +280,7 @@ int dccp_disconnect(struct sock *sk, int flags) |
577 |
+ |
578 |
+ dccp_clear_xmit_timers(sk); |
579 |
+ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); |
580 |
+- ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); |
581 |
+ dp->dccps_hc_rx_ccid = NULL; |
582 |
+- dp->dccps_hc_tx_ccid = NULL; |
583 |
+ |
584 |
+ __skb_queue_purge(&sk->sk_receive_queue); |
585 |
+ __skb_queue_purge(&sk->sk_write_queue); |
586 |
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c |
587 |
+index 44abc52bae13..9d144cbd4e62 100644 |
588 |
+--- a/net/ipv4/fib_semantics.c |
589 |
++++ b/net/ipv4/fib_semantics.c |
590 |
+@@ -979,6 +979,8 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg) |
591 |
+ if (val == TCP_CA_UNSPEC) |
592 |
+ return -EINVAL; |
593 |
+ } else { |
594 |
++ if (nla_len(nla) != sizeof(u32)) |
595 |
++ return false; |
596 |
+ val = nla_get_u32(nla); |
597 |
+ } |
598 |
+ if (type == RTAX_ADVMSS && val > 65535 - 40) |
599 |
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c |
600 |
+index 1b93ea766916..ce9a7fbb7c5f 100644 |
601 |
+--- a/net/ipv4/ip_sockglue.c |
602 |
++++ b/net/ipv4/ip_sockglue.c |
603 |
+@@ -493,8 +493,6 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) |
604 |
+ int err; |
605 |
+ int copied; |
606 |
+ |
607 |
+- WARN_ON_ONCE(sk->sk_family == AF_INET6); |
608 |
+- |
609 |
+ err = -EAGAIN; |
610 |
+ skb = sock_dequeue_err_skb(sk); |
611 |
+ if (!skb) |
612 |
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c |
613 |
+index e5846d1f9b55..9b92960f024d 100644 |
614 |
+--- a/net/ipv6/ip6mr.c |
615 |
++++ b/net/ipv6/ip6mr.c |
616 |
+@@ -1787,7 +1787,8 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns |
617 |
+ ret = 0; |
618 |
+ if (!ip6mr_new_table(net, v)) |
619 |
+ ret = -ENOMEM; |
620 |
+- raw6_sk(sk)->ip6mr_table = v; |
621 |
++ else |
622 |
++ raw6_sk(sk)->ip6mr_table = v; |
623 |
+ rtnl_unlock(); |
624 |
+ return ret; |
625 |
+ } |
626 |
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
627 |
+index 392d4e2c0a24..3a63f33698d3 100644 |
628 |
+--- a/net/packet/af_packet.c |
629 |
++++ b/net/packet/af_packet.c |
630 |
+@@ -2779,7 +2779,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
631 |
+ if (unlikely(offset < 0)) |
632 |
+ goto out_free; |
633 |
+ } else if (reserve) { |
634 |
+- skb_push(skb, reserve); |
635 |
++ skb_reserve(skb, -reserve); |
636 |
+ } |
637 |
+ |
638 |
+ /* Returns -EFAULT on error */ |
639 |
+@@ -4198,7 +4198,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, |
640 |
+ goto out; |
641 |
+ if (po->tp_version >= TPACKET_V3 && |
642 |
+ req->tp_block_size <= |
643 |
+- BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) |
644 |
++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr)) |
645 |
+ goto out; |
646 |
+ if (unlikely(req->tp_frame_size < po->tp_hdrlen + |
647 |
+ po->tp_reserve)) |
648 |
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c |
649 |
+index dd243d2abd87..138d7f100f7e 100644 |
650 |
+--- a/scripts/kconfig/confdata.c |
651 |
++++ b/scripts/kconfig/confdata.c |
652 |
+@@ -743,7 +743,7 @@ int conf_write(const char *name) |
653 |
+ struct menu *menu; |
654 |
+ const char *basename; |
655 |
+ const char *str; |
656 |
+- char dirname[PATH_MAX+1], tmpname[PATH_MAX+1], newname[PATH_MAX+1]; |
657 |
++ char dirname[PATH_MAX+1], tmpname[PATH_MAX+22], newname[PATH_MAX+8]; |
658 |
+ char *env; |
659 |
+ |
660 |
+ dirname[0] = 0; |