1 |
commit: dadcce23d781a274174c9b0651ea614a170cb057 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Oct 6 11:33:23 2021 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Oct 6 11:33:23 2021 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dadcce23 |
7 |
|
8 |
Linux patch 4.4.286 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1285_linux-4.4.286.patch | 1021 ++++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 1025 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index bd19b36..9700d52 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -1183,6 +1183,10 @@ Patch: 1284_linux-4.4.285.patch |
21 |
From: http://www.kernel.org |
22 |
Desc: Linux 4.4.285 |
23 |
|
24 |
+Patch: 1285_linux-4.4.286.patch |
25 |
+From: http://www.kernel.org |
26 |
+Desc: Linux 4.4.286 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1285_linux-4.4.286.patch b/1285_linux-4.4.286.patch |
33 |
new file mode 100644 |
34 |
index 0000000..58f6c0f |
35 |
--- /dev/null |
36 |
+++ b/1285_linux-4.4.286.patch |
37 |
@@ -0,0 +1,1021 @@ |
38 |
+diff --git a/Makefile b/Makefile |
39 |
+index 96cb7da465043..34ad8ef93d409 100644 |
40 |
+--- a/Makefile |
41 |
++++ b/Makefile |
42 |
+@@ -1,6 +1,6 @@ |
43 |
+ VERSION = 4 |
44 |
+ PATCHLEVEL = 4 |
45 |
+-SUBLEVEL = 285 |
46 |
++SUBLEVEL = 286 |
47 |
+ EXTRAVERSION = |
48 |
+ NAME = Blurry Fish Butt |
49 |
+ |
50 |
+diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h |
51 |
+index 355aec0867f4d..e55a5e6ab4608 100644 |
52 |
+--- a/arch/alpha/include/asm/io.h |
53 |
++++ b/arch/alpha/include/asm/io.h |
54 |
+@@ -60,7 +60,7 @@ extern inline void set_hae(unsigned long new_hae) |
55 |
+ * Change virtual addresses to physical addresses and vv. |
56 |
+ */ |
57 |
+ #ifdef USE_48_BIT_KSEG |
58 |
+-static inline unsigned long virt_to_phys(void *address) |
59 |
++static inline unsigned long virt_to_phys(volatile void *address) |
60 |
+ { |
61 |
+ return (unsigned long)address - IDENT_ADDR; |
62 |
+ } |
63 |
+@@ -70,7 +70,7 @@ static inline void * phys_to_virt(unsigned long address) |
64 |
+ return (void *) (address + IDENT_ADDR); |
65 |
+ } |
66 |
+ #else |
67 |
+-static inline unsigned long virt_to_phys(void *address) |
68 |
++static inline unsigned long virt_to_phys(volatile void *address) |
69 |
+ { |
70 |
+ unsigned long phys = (unsigned long)address; |
71 |
+ |
72 |
+@@ -111,7 +111,7 @@ static inline dma_addr_t __deprecated isa_page_to_bus(struct page *page) |
73 |
+ extern unsigned long __direct_map_base; |
74 |
+ extern unsigned long __direct_map_size; |
75 |
+ |
76 |
+-static inline unsigned long __deprecated virt_to_bus(void *address) |
77 |
++static inline unsigned long __deprecated virt_to_bus(volatile void *address) |
78 |
+ { |
79 |
+ unsigned long phys = virt_to_phys(address); |
80 |
+ unsigned long bus = phys + __direct_map_base; |
81 |
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig |
82 |
+index 644f4326b3e75..dee4d691bc585 100644 |
83 |
+--- a/arch/arm64/Kconfig |
84 |
++++ b/arch/arm64/Kconfig |
85 |
+@@ -381,7 +381,7 @@ config ARM64_ERRATUM_1024718 |
86 |
+ help |
87 |
+ This option adds work around for Arm Cortex-A55 Erratum 1024718. |
88 |
+ |
89 |
+- Affected Cortex-A55 cores (r0p0, r0p1, r1p0) could cause incorrect |
90 |
++ Affected Cortex-A55 cores (all revisions) could cause incorrect |
91 |
+ update of the hardware dirty bit when the DBM/AP bits are updated |
92 |
+ without a break-before-make. The work around is to disable the usage |
93 |
+ of hardware DBM locally on the affected cores. CPUs not affected by |
94 |
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c |
95 |
+index 10d6627673cbf..6cd79888944e6 100644 |
96 |
+--- a/arch/arm64/kernel/process.c |
97 |
++++ b/arch/arm64/kernel/process.c |
98 |
+@@ -55,7 +55,7 @@ |
99 |
+ |
100 |
+ #ifdef CONFIG_CC_STACKPROTECTOR |
101 |
+ #include <linux/stackprotector.h> |
102 |
+-unsigned long __stack_chk_guard __read_mostly; |
103 |
++unsigned long __stack_chk_guard __ro_after_init; |
104 |
+ EXPORT_SYMBOL(__stack_chk_guard); |
105 |
+ #endif |
106 |
+ |
107 |
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S |
108 |
+index f096367380075..0b095b75abeb7 100644 |
109 |
+--- a/arch/arm64/mm/proc.S |
110 |
++++ b/arch/arm64/mm/proc.S |
111 |
+@@ -222,8 +222,8 @@ ENTRY(__cpu_setup) |
112 |
+ cmp x9, #2 |
113 |
+ b.lt 1f |
114 |
+ #ifdef CONFIG_ARM64_ERRATUM_1024718 |
115 |
+- /* Disable hardware DBM on Cortex-A55 r0p0, r0p1 & r1p0 */ |
116 |
+- cpu_midr_match MIDR_CORTEX_A55, MIDR_CPU_VAR_REV(0, 0), MIDR_CPU_VAR_REV(1, 0), x1, x2, x3, x4 |
117 |
++ /* Disable hardware DBM on Cortex-A55 all versions */ |
118 |
++ cpu_midr_match MIDR_CORTEX_A55, MIDR_CPU_VAR_REV(0, 0), MIDR_CPU_VAR_REV(0xf, 0xf), x1, x2, x3, x4 |
119 |
+ cbnz x1, 1f |
120 |
+ #endif |
121 |
+ orr x10, x10, #TCR_HD // hardware Dirty flag update |
122 |
+diff --git a/arch/m68k/include/asm/raw_io.h b/arch/m68k/include/asm/raw_io.h |
123 |
+index 932faa35655b1..2238232c360e9 100644 |
124 |
+--- a/arch/m68k/include/asm/raw_io.h |
125 |
++++ b/arch/m68k/include/asm/raw_io.h |
126 |
+@@ -30,21 +30,21 @@ extern void __iounmap(void *addr, unsigned long size); |
127 |
+ * two accesses to memory, which may be undesirable for some devices. |
128 |
+ */ |
129 |
+ #define in_8(addr) \ |
130 |
+- ({ u8 __v = (*(__force volatile u8 *) (addr)); __v; }) |
131 |
++ ({ u8 __v = (*(__force volatile u8 *) (unsigned long)(addr)); __v; }) |
132 |
+ #define in_be16(addr) \ |
133 |
+- ({ u16 __v = (*(__force volatile u16 *) (addr)); __v; }) |
134 |
++ ({ u16 __v = (*(__force volatile u16 *) (unsigned long)(addr)); __v; }) |
135 |
+ #define in_be32(addr) \ |
136 |
+- ({ u32 __v = (*(__force volatile u32 *) (addr)); __v; }) |
137 |
++ ({ u32 __v = (*(__force volatile u32 *) (unsigned long)(addr)); __v; }) |
138 |
+ #define in_le16(addr) \ |
139 |
+- ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (addr)); __v; }) |
140 |
++ ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (unsigned long)(addr)); __v; }) |
141 |
+ #define in_le32(addr) \ |
142 |
+- ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (addr)); __v; }) |
143 |
++ ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (unsigned long)(addr)); __v; }) |
144 |
+ |
145 |
+-#define out_8(addr,b) (void)((*(__force volatile u8 *) (addr)) = (b)) |
146 |
+-#define out_be16(addr,w) (void)((*(__force volatile u16 *) (addr)) = (w)) |
147 |
+-#define out_be32(addr,l) (void)((*(__force volatile u32 *) (addr)) = (l)) |
148 |
+-#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (addr)) = cpu_to_le16(w)) |
149 |
+-#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (addr)) = cpu_to_le32(l)) |
150 |
++#define out_8(addr,b) (void)((*(__force volatile u8 *) (unsigned long)(addr)) = (b)) |
151 |
++#define out_be16(addr,w) (void)((*(__force volatile u16 *) (unsigned long)(addr)) = (w)) |
152 |
++#define out_be32(addr,l) (void)((*(__force volatile u32 *) (unsigned long)(addr)) = (l)) |
153 |
++#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (unsigned long)(addr)) = cpu_to_le16(w)) |
154 |
++#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (unsigned long)(addr)) = cpu_to_le32(l)) |
155 |
+ |
156 |
+ #define raw_inb in_8 |
157 |
+ #define raw_inw in_be16 |
158 |
+diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h |
159 |
+index 80e742a1c162f..088888fcf8df3 100644 |
160 |
+--- a/arch/parisc/include/asm/page.h |
161 |
++++ b/arch/parisc/include/asm/page.h |
162 |
+@@ -174,7 +174,7 @@ extern int npmem_ranges; |
163 |
+ #include <asm-generic/getorder.h> |
164 |
+ #include <asm/pdc.h> |
165 |
+ |
166 |
+-#define PAGE0 ((struct zeropage *)__PAGE_OFFSET) |
167 |
++#define PAGE0 ((struct zeropage *)absolute_pointer(__PAGE_OFFSET)) |
168 |
+ |
169 |
+ /* DEFINITION OF THE ZERO-PAGE (PAG0) */ |
170 |
+ /* based on work by Jason Eckhardt (jason@×××××××.com) */ |
171 |
+diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c |
172 |
+index 6f80936e0eea4..75445ba7e237c 100644 |
173 |
+--- a/arch/sparc/kernel/mdesc.c |
174 |
++++ b/arch/sparc/kernel/mdesc.c |
175 |
+@@ -37,6 +37,7 @@ struct mdesc_hdr { |
176 |
+ u32 node_sz; /* node block size */ |
177 |
+ u32 name_sz; /* name block size */ |
178 |
+ u32 data_sz; /* data block size */ |
179 |
++ char data[]; |
180 |
+ } __attribute__((aligned(16))); |
181 |
+ |
182 |
+ struct mdesc_elem { |
183 |
+@@ -369,7 +370,7 @@ out: |
184 |
+ |
185 |
+ static struct mdesc_elem *node_block(struct mdesc_hdr *mdesc) |
186 |
+ { |
187 |
+- return (struct mdesc_elem *) (mdesc + 1); |
188 |
++ return (struct mdesc_elem *) mdesc->data; |
189 |
+ } |
190 |
+ |
191 |
+ static void *name_block(struct mdesc_hdr *mdesc) |
192 |
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c |
193 |
+index 79aff24eed653..28725a6ed5de0 100644 |
194 |
+--- a/arch/x86/xen/enlighten.c |
195 |
++++ b/arch/x86/xen/enlighten.c |
196 |
+@@ -861,8 +861,8 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g) |
197 |
+ preempt_enable(); |
198 |
+ } |
199 |
+ |
200 |
+-static void xen_convert_trap_info(const struct desc_ptr *desc, |
201 |
+- struct trap_info *traps) |
202 |
++static unsigned xen_convert_trap_info(const struct desc_ptr *desc, |
203 |
++ struct trap_info *traps, bool full) |
204 |
+ { |
205 |
+ unsigned in, out, count; |
206 |
+ |
207 |
+@@ -872,17 +872,18 @@ static void xen_convert_trap_info(const struct desc_ptr *desc, |
208 |
+ for (in = out = 0; in < count; in++) { |
209 |
+ gate_desc *entry = (gate_desc*)(desc->address) + in; |
210 |
+ |
211 |
+- if (cvt_gate_to_trap(in, entry, &traps[out])) |
212 |
++ if (cvt_gate_to_trap(in, entry, &traps[out]) || full) |
213 |
+ out++; |
214 |
+ } |
215 |
+- traps[out].address = 0; |
216 |
++ |
217 |
++ return out; |
218 |
+ } |
219 |
+ |
220 |
+ void xen_copy_trap_info(struct trap_info *traps) |
221 |
+ { |
222 |
+ const struct desc_ptr *desc = this_cpu_ptr(&idt_desc); |
223 |
+ |
224 |
+- xen_convert_trap_info(desc, traps); |
225 |
++ xen_convert_trap_info(desc, traps, true); |
226 |
+ } |
227 |
+ |
228 |
+ /* Load a new IDT into Xen. In principle this can be per-CPU, so we |
229 |
+@@ -892,6 +893,7 @@ static void xen_load_idt(const struct desc_ptr *desc) |
230 |
+ { |
231 |
+ static DEFINE_SPINLOCK(lock); |
232 |
+ static struct trap_info traps[257]; |
233 |
++ unsigned out; |
234 |
+ |
235 |
+ trace_xen_cpu_load_idt(desc); |
236 |
+ |
237 |
+@@ -899,7 +901,8 @@ static void xen_load_idt(const struct desc_ptr *desc) |
238 |
+ |
239 |
+ memcpy(this_cpu_ptr(&idt_desc), desc, sizeof(idt_desc)); |
240 |
+ |
241 |
+- xen_convert_trap_info(desc, traps); |
242 |
++ out = xen_convert_trap_info(desc, traps, false); |
243 |
++ memset(&traps[out], 0, sizeof(traps[0])); |
244 |
+ |
245 |
+ xen_mc_flush(); |
246 |
+ if (HYPERVISOR_set_trap_table(traps)) |
247 |
+diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c |
248 |
+index fc153aea2f6cf..091f03852dcac 100644 |
249 |
+--- a/drivers/edac/synopsys_edac.c |
250 |
++++ b/drivers/edac/synopsys_edac.c |
251 |
+@@ -371,7 +371,7 @@ static int synps_edac_init_csrows(struct mem_ctl_info *mci) |
252 |
+ |
253 |
+ for (j = 0; j < csi->nr_channels; j++) { |
254 |
+ dimm = csi->channels[j]->dimm; |
255 |
+- dimm->edac_mode = EDAC_FLAG_SECDED; |
256 |
++ dimm->edac_mode = EDAC_SECDED; |
257 |
+ dimm->mtype = synps_edac_get_mtype(priv->baseaddr); |
258 |
+ dimm->nr_pages = (size >> PAGE_SHIFT) / csi->nr_channels; |
259 |
+ dimm->grain = SYNPS_EDAC_ERR_GRAIN; |
260 |
+diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c |
261 |
+index 69cfc8dc6af1e..9b60efe6ec441 100644 |
262 |
+--- a/drivers/hid/hid-betopff.c |
263 |
++++ b/drivers/hid/hid-betopff.c |
264 |
+@@ -59,15 +59,22 @@ static int betopff_init(struct hid_device *hid) |
265 |
+ { |
266 |
+ struct betopff_device *betopff; |
267 |
+ struct hid_report *report; |
268 |
+- struct hid_input *hidinput = |
269 |
+- list_first_entry(&hid->inputs, struct hid_input, list); |
270 |
++ struct hid_input *hidinput; |
271 |
+ struct list_head *report_list = |
272 |
+ &hid->report_enum[HID_OUTPUT_REPORT].report_list; |
273 |
+- struct input_dev *dev = hidinput->input; |
274 |
++ struct input_dev *dev; |
275 |
+ int field_count = 0; |
276 |
+ int error; |
277 |
+ int i, j; |
278 |
+ |
279 |
++ if (list_empty(&hid->inputs)) { |
280 |
++ hid_err(hid, "no inputs found\n"); |
281 |
++ return -ENODEV; |
282 |
++ } |
283 |
++ |
284 |
++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); |
285 |
++ dev = hidinput->input; |
286 |
++ |
287 |
+ if (list_empty(report_list)) { |
288 |
+ hid_err(hid, "no output reports found\n"); |
289 |
+ return -ENODEV; |
290 |
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c |
291 |
+index d51fc2be0e10c..c7da6ec4d923d 100644 |
292 |
+--- a/drivers/hid/usbhid/hid-core.c |
293 |
++++ b/drivers/hid/usbhid/hid-core.c |
294 |
+@@ -500,7 +500,7 @@ static void hid_ctrl(struct urb *urb) |
295 |
+ |
296 |
+ if (unplug) { |
297 |
+ usbhid->ctrltail = usbhid->ctrlhead; |
298 |
+- } else { |
299 |
++ } else if (usbhid->ctrlhead != usbhid->ctrltail) { |
300 |
+ usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1); |
301 |
+ |
302 |
+ if (usbhid->ctrlhead != usbhid->ctrltail && |
303 |
+@@ -1185,9 +1185,20 @@ static void usbhid_stop(struct hid_device *hid) |
304 |
+ usbhid->intf->needs_remote_wakeup = 0; |
305 |
+ |
306 |
+ clear_bit(HID_STARTED, &usbhid->iofl); |
307 |
++ |
308 |
+ spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */ |
309 |
+ set_bit(HID_DISCONNECTED, &usbhid->iofl); |
310 |
++ while (usbhid->ctrltail != usbhid->ctrlhead) { |
311 |
++ if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) { |
312 |
++ kfree(usbhid->ctrl[usbhid->ctrltail].raw_report); |
313 |
++ usbhid->ctrl[usbhid->ctrltail].raw_report = NULL; |
314 |
++ } |
315 |
++ |
316 |
++ usbhid->ctrltail = (usbhid->ctrltail + 1) & |
317 |
++ (HID_CONTROL_FIFO_SIZE - 1); |
318 |
++ } |
319 |
+ spin_unlock_irq(&usbhid->lock); |
320 |
++ |
321 |
+ usb_kill_urb(usbhid->urbin); |
322 |
+ usb_kill_urb(usbhid->urbout); |
323 |
+ usb_kill_urb(usbhid->urbctrl); |
324 |
+diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c |
325 |
+index 035d5449227e5..c1175464064be 100644 |
326 |
+--- a/drivers/ipack/devices/ipoctal.c |
327 |
++++ b/drivers/ipack/devices/ipoctal.c |
328 |
+@@ -38,6 +38,7 @@ struct ipoctal_channel { |
329 |
+ unsigned int pointer_read; |
330 |
+ unsigned int pointer_write; |
331 |
+ struct tty_port tty_port; |
332 |
++ bool tty_registered; |
333 |
+ union scc2698_channel __iomem *regs; |
334 |
+ union scc2698_block __iomem *block_regs; |
335 |
+ unsigned int board_id; |
336 |
+@@ -86,22 +87,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty) |
337 |
+ return 0; |
338 |
+ } |
339 |
+ |
340 |
+-static int ipoctal_open(struct tty_struct *tty, struct file *file) |
341 |
++static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty) |
342 |
+ { |
343 |
+ struct ipoctal_channel *channel = dev_get_drvdata(tty->dev); |
344 |
+ struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index); |
345 |
+- int err; |
346 |
+- |
347 |
+- tty->driver_data = channel; |
348 |
++ int res; |
349 |
+ |
350 |
+ if (!ipack_get_carrier(ipoctal->dev)) |
351 |
+ return -EBUSY; |
352 |
+ |
353 |
+- err = tty_port_open(&channel->tty_port, tty, file); |
354 |
+- if (err) |
355 |
+- ipack_put_carrier(ipoctal->dev); |
356 |
++ res = tty_standard_install(driver, tty); |
357 |
++ if (res) |
358 |
++ goto err_put_carrier; |
359 |
++ |
360 |
++ tty->driver_data = channel; |
361 |
++ |
362 |
++ return 0; |
363 |
++ |
364 |
++err_put_carrier: |
365 |
++ ipack_put_carrier(ipoctal->dev); |
366 |
++ |
367 |
++ return res; |
368 |
++} |
369 |
++ |
370 |
++static int ipoctal_open(struct tty_struct *tty, struct file *file) |
371 |
++{ |
372 |
++ struct ipoctal_channel *channel = tty->driver_data; |
373 |
+ |
374 |
+- return err; |
375 |
++ return tty_port_open(&channel->tty_port, tty, file); |
376 |
+ } |
377 |
+ |
378 |
+ static void ipoctal_reset_stats(struct ipoctal_stats *stats) |
379 |
+@@ -269,7 +282,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, |
380 |
+ int res; |
381 |
+ int i; |
382 |
+ struct tty_driver *tty; |
383 |
+- char name[20]; |
384 |
+ struct ipoctal_channel *channel; |
385 |
+ struct ipack_region *region; |
386 |
+ void __iomem *addr; |
387 |
+@@ -360,8 +372,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, |
388 |
+ /* Fill struct tty_driver with ipoctal data */ |
389 |
+ tty->owner = THIS_MODULE; |
390 |
+ tty->driver_name = KBUILD_MODNAME; |
391 |
+- sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot); |
392 |
+- tty->name = name; |
393 |
++ tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot); |
394 |
++ if (!tty->name) { |
395 |
++ res = -ENOMEM; |
396 |
++ goto err_put_driver; |
397 |
++ } |
398 |
+ tty->major = 0; |
399 |
+ |
400 |
+ tty->minor_start = 0; |
401 |
+@@ -377,8 +392,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, |
402 |
+ res = tty_register_driver(tty); |
403 |
+ if (res) { |
404 |
+ dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n"); |
405 |
+- put_tty_driver(tty); |
406 |
+- return res; |
407 |
++ goto err_free_name; |
408 |
+ } |
409 |
+ |
410 |
+ /* Save struct tty_driver for use it when uninstalling the device */ |
411 |
+@@ -389,7 +403,9 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, |
412 |
+ |
413 |
+ channel = &ipoctal->channel[i]; |
414 |
+ tty_port_init(&channel->tty_port); |
415 |
+- tty_port_alloc_xmit_buf(&channel->tty_port); |
416 |
++ res = tty_port_alloc_xmit_buf(&channel->tty_port); |
417 |
++ if (res) |
418 |
++ continue; |
419 |
+ channel->tty_port.ops = &ipoctal_tty_port_ops; |
420 |
+ |
421 |
+ ipoctal_reset_stats(&channel->stats); |
422 |
+@@ -397,13 +413,15 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, |
423 |
+ spin_lock_init(&channel->lock); |
424 |
+ channel->pointer_read = 0; |
425 |
+ channel->pointer_write = 0; |
426 |
+- tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL); |
427 |
++ tty_dev = tty_port_register_device_attr(&channel->tty_port, tty, |
428 |
++ i, NULL, channel, NULL); |
429 |
+ if (IS_ERR(tty_dev)) { |
430 |
+ dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n"); |
431 |
++ tty_port_free_xmit_buf(&channel->tty_port); |
432 |
+ tty_port_destroy(&channel->tty_port); |
433 |
+ continue; |
434 |
+ } |
435 |
+- dev_set_drvdata(tty_dev, channel); |
436 |
++ channel->tty_registered = true; |
437 |
+ } |
438 |
+ |
439 |
+ /* |
440 |
+@@ -415,6 +433,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, |
441 |
+ ipoctal_irq_handler, ipoctal); |
442 |
+ |
443 |
+ return 0; |
444 |
++ |
445 |
++err_free_name: |
446 |
++ kfree(tty->name); |
447 |
++err_put_driver: |
448 |
++ put_tty_driver(tty); |
449 |
++ |
450 |
++ return res; |
451 |
+ } |
452 |
+ |
453 |
+ static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel, |
454 |
+@@ -656,6 +681,7 @@ static void ipoctal_cleanup(struct tty_struct *tty) |
455 |
+ |
456 |
+ static const struct tty_operations ipoctal_fops = { |
457 |
+ .ioctl = NULL, |
458 |
++ .install = ipoctal_install, |
459 |
+ .open = ipoctal_open, |
460 |
+ .close = ipoctal_close, |
461 |
+ .write = ipoctal_write_tty, |
462 |
+@@ -698,12 +724,17 @@ static void __ipoctal_remove(struct ipoctal *ipoctal) |
463 |
+ |
464 |
+ for (i = 0; i < NR_CHANNELS; i++) { |
465 |
+ struct ipoctal_channel *channel = &ipoctal->channel[i]; |
466 |
++ |
467 |
++ if (!channel->tty_registered) |
468 |
++ continue; |
469 |
++ |
470 |
+ tty_unregister_device(ipoctal->tty_drv, i); |
471 |
+ tty_port_free_xmit_buf(&channel->tty_port); |
472 |
+ tty_port_destroy(&channel->tty_port); |
473 |
+ } |
474 |
+ |
475 |
+ tty_unregister_driver(ipoctal->tty_drv); |
476 |
++ kfree(ipoctal->tty_drv->name); |
477 |
+ put_tty_driver(ipoctal->tty_drv); |
478 |
+ kfree(ipoctal); |
479 |
+ } |
480 |
+diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c |
481 |
+index 7ce6379fd1a36..1500027ae18b8 100644 |
482 |
+--- a/drivers/net/ethernet/i825xx/82596.c |
483 |
++++ b/drivers/net/ethernet/i825xx/82596.c |
484 |
+@@ -1155,7 +1155,7 @@ struct net_device * __init i82596_probe(int unit) |
485 |
+ err = -ENODEV; |
486 |
+ goto out; |
487 |
+ } |
488 |
+- memcpy(eth_addr, (void *) 0xfffc1f2c, ETH_ALEN); /* YUCK! Get addr from NOVRAM */ |
489 |
++ memcpy(eth_addr, absolute_pointer(0xfffc1f2c), ETH_ALEN); /* YUCK! Get addr from NOVRAM */ |
490 |
+ dev->base_addr = MVME_I596_BASE; |
491 |
+ dev->irq = (unsigned) MVME16x_IRQ_I596; |
492 |
+ goto found; |
493 |
+diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c |
494 |
+index 9035cb5fc70d3..aa556e4f9051e 100644 |
495 |
+--- a/drivers/net/ethernet/intel/e100.c |
496 |
++++ b/drivers/net/ethernet/intel/e100.c |
497 |
+@@ -2462,11 +2462,15 @@ static void e100_get_drvinfo(struct net_device *netdev, |
498 |
+ sizeof(info->bus_info)); |
499 |
+ } |
500 |
+ |
501 |
+-#define E100_PHY_REGS 0x1C |
502 |
++#define E100_PHY_REGS 0x1D |
503 |
+ static int e100_get_regs_len(struct net_device *netdev) |
504 |
+ { |
505 |
+ struct nic *nic = netdev_priv(netdev); |
506 |
+- return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf); |
507 |
++ |
508 |
++ /* We know the number of registers, and the size of the dump buffer. |
509 |
++ * Calculate the total size in bytes. |
510 |
++ */ |
511 |
++ return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf); |
512 |
+ } |
513 |
+ |
514 |
+ static void e100_get_regs(struct net_device *netdev, |
515 |
+@@ -2480,14 +2484,18 @@ static void e100_get_regs(struct net_device *netdev, |
516 |
+ buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 | |
517 |
+ ioread8(&nic->csr->scb.cmd_lo) << 16 | |
518 |
+ ioread16(&nic->csr->scb.status); |
519 |
+- for (i = E100_PHY_REGS; i >= 0; i--) |
520 |
+- buff[1 + E100_PHY_REGS - i] = |
521 |
+- mdio_read(netdev, nic->mii.phy_id, i); |
522 |
++ for (i = 0; i < E100_PHY_REGS; i++) |
523 |
++ /* Note that we read the registers in reverse order. This |
524 |
++ * ordering is the ABI apparently used by ethtool and other |
525 |
++ * applications. |
526 |
++ */ |
527 |
++ buff[1 + i] = mdio_read(netdev, nic->mii.phy_id, |
528 |
++ E100_PHY_REGS - 1 - i); |
529 |
+ memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf)); |
530 |
+ e100_exec_cb(nic, NULL, e100_dump); |
531 |
+ msleep(10); |
532 |
+- memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf, |
533 |
+- sizeof(nic->mem->dump_buf)); |
534 |
++ memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf, |
535 |
++ sizeof(nic->mem->dump_buf)); |
536 |
+ } |
537 |
+ |
538 |
+ static void e100_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol) |
539 |
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c |
540 |
+index 112ce16717cda..b9014ec73b67c 100644 |
541 |
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c |
542 |
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c |
543 |
+@@ -311,6 +311,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb, |
544 |
+ int nhoff = skb_network_offset(skb); |
545 |
+ int ret = 0; |
546 |
+ |
547 |
++ if (skb->encapsulation) |
548 |
++ return -EPROTONOSUPPORT; |
549 |
++ |
550 |
+ if (skb->protocol != htons(ETH_P_IP)) |
551 |
+ return -EPROTONOSUPPORT; |
552 |
+ |
553 |
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c |
554 |
+index cce901add6542..908de9e453944 100644 |
555 |
+--- a/drivers/net/hamradio/6pack.c |
556 |
++++ b/drivers/net/hamradio/6pack.c |
557 |
+@@ -68,9 +68,9 @@ |
558 |
+ #define SIXP_DAMA_OFF 0 |
559 |
+ |
560 |
+ /* default level 2 parameters */ |
561 |
+-#define SIXP_TXDELAY (HZ/4) /* in 1 s */ |
562 |
++#define SIXP_TXDELAY 25 /* 250 ms */ |
563 |
+ #define SIXP_PERSIST 50 /* in 256ths */ |
564 |
+-#define SIXP_SLOTTIME (HZ/10) /* in 1 s */ |
565 |
++#define SIXP_SLOTTIME 10 /* 100 ms */ |
566 |
+ #define SIXP_INIT_RESYNC_TIMEOUT (3*HZ/2) /* in 1 s */ |
567 |
+ #define SIXP_RESYNC_TIMEOUT 5*HZ /* in 1 s */ |
568 |
+ |
569 |
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c |
570 |
+index 5d988829f7d52..e6f272019da0d 100644 |
571 |
+--- a/drivers/net/usb/hso.c |
572 |
++++ b/drivers/net/usb/hso.c |
573 |
+@@ -2729,14 +2729,14 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, |
574 |
+ |
575 |
+ serial = kzalloc(sizeof(*serial), GFP_KERNEL); |
576 |
+ if (!serial) |
577 |
+- goto exit; |
578 |
++ goto err_free_dev; |
579 |
+ |
580 |
+ hso_dev->port_data.dev_serial = serial; |
581 |
+ serial->parent = hso_dev; |
582 |
+ |
583 |
+ if (hso_serial_common_create |
584 |
+ (serial, 1, CTRL_URB_RX_SIZE, CTRL_URB_TX_SIZE)) |
585 |
+- goto exit; |
586 |
++ goto err_free_serial; |
587 |
+ |
588 |
+ serial->tx_data_length--; |
589 |
+ serial->write_data = hso_mux_serial_write_data; |
590 |
+@@ -2752,11 +2752,9 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, |
591 |
+ /* done, return it */ |
592 |
+ return hso_dev; |
593 |
+ |
594 |
+-exit: |
595 |
+- if (serial) { |
596 |
+- tty_unregister_device(tty_drv, serial->minor); |
597 |
+- kfree(serial); |
598 |
+- } |
599 |
++err_free_serial: |
600 |
++ kfree(serial); |
601 |
++err_free_dev: |
602 |
+ kfree(hso_dev); |
603 |
+ return NULL; |
604 |
+ |
605 |
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c |
606 |
+index 39d03300d3d9a..9906a3b562e93 100644 |
607 |
+--- a/drivers/scsi/scsi_transport_iscsi.c |
608 |
++++ b/drivers/scsi/scsi_transport_iscsi.c |
609 |
+@@ -429,9 +429,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, |
610 |
+ struct iscsi_transport *t = iface->transport; |
611 |
+ int param = -1; |
612 |
+ |
613 |
+- if (attr == &dev_attr_iface_enabled.attr) |
614 |
+- param = ISCSI_NET_PARAM_IFACE_ENABLE; |
615 |
+- else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) |
616 |
++ if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) |
617 |
+ param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO; |
618 |
+ else if (attr == &dev_attr_iface_header_digest.attr) |
619 |
+ param = ISCSI_IFACE_PARAM_HDRDGST_EN; |
620 |
+@@ -471,7 +469,9 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, |
621 |
+ if (param != -1) |
622 |
+ return t->attr_is_visible(ISCSI_IFACE_PARAM, param); |
623 |
+ |
624 |
+- if (attr == &dev_attr_iface_vlan_id.attr) |
625 |
++ if (attr == &dev_attr_iface_enabled.attr) |
626 |
++ param = ISCSI_NET_PARAM_IFACE_ENABLE; |
627 |
++ else if (attr == &dev_attr_iface_vlan_id.attr) |
628 |
+ param = ISCSI_NET_PARAM_VLAN_ID; |
629 |
+ else if (attr == &dev_attr_iface_vlan_priority.attr) |
630 |
+ param = ISCSI_NET_PARAM_VLAN_PRIORITY; |
631 |
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c |
632 |
+index 9f14560686b68..88bfe7682a9eb 100644 |
633 |
+--- a/drivers/spi/spi-tegra20-slink.c |
634 |
++++ b/drivers/spi/spi-tegra20-slink.c |
635 |
+@@ -1210,7 +1210,7 @@ static int tegra_slink_resume(struct device *dev) |
636 |
+ } |
637 |
+ #endif |
638 |
+ |
639 |
+-static int tegra_slink_runtime_suspend(struct device *dev) |
640 |
++static int __maybe_unused tegra_slink_runtime_suspend(struct device *dev) |
641 |
+ { |
642 |
+ struct spi_master *master = dev_get_drvdata(dev); |
643 |
+ struct tegra_slink_data *tspi = spi_master_get_devdata(master); |
644 |
+@@ -1222,7 +1222,7 @@ static int tegra_slink_runtime_suspend(struct device *dev) |
645 |
+ return 0; |
646 |
+ } |
647 |
+ |
648 |
+-static int tegra_slink_runtime_resume(struct device *dev) |
649 |
++static int __maybe_unused tegra_slink_runtime_resume(struct device *dev) |
650 |
+ { |
651 |
+ struct spi_master *master = dev_get_drvdata(dev); |
652 |
+ struct tegra_slink_data *tspi = spi_master_get_devdata(master); |
653 |
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c |
654 |
+index 9f479b4c64919..0fab196a1d90b 100644 |
655 |
+--- a/drivers/tty/vt/vt.c |
656 |
++++ b/drivers/tty/vt/vt.c |
657 |
+@@ -882,8 +882,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, |
658 |
+ new_row_size = new_cols << 1; |
659 |
+ new_screen_size = new_row_size * new_rows; |
660 |
+ |
661 |
+- if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) |
662 |
+- return 0; |
663 |
++ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) { |
664 |
++ /* |
665 |
++ * This function is being called here to cover the case |
666 |
++ * where the userspace calls the FBIOPUT_VSCREENINFO twice, |
667 |
++ * passing the same fb_var_screeninfo containing the fields |
668 |
++ * yres/xres equal to a number non-multiple of vc_font.height |
669 |
++ * and yres_virtual/xres_virtual equal to number lesser than the |
670 |
++ * vc_font.height and yres/xres. |
671 |
++ * In the second call, the struct fb_var_screeninfo isn't |
672 |
++ * being modified by the underlying driver because of the |
673 |
++ * if above, and this causes the fbcon_display->vrows to become |
674 |
++ * negative and it eventually leads to out-of-bound |
675 |
++ * access by the imageblit function. |
676 |
++ * To give the correct values to the struct and to not have |
677 |
++ * to deal with possible errors from the code below, we call |
678 |
++ * the resize_screen here as well. |
679 |
++ */ |
680 |
++ return resize_screen(vc, new_cols, new_rows, user); |
681 |
++ } |
682 |
+ |
683 |
+ if (new_screen_size > (4 << 20)) |
684 |
+ return -EINVAL; |
685 |
+diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c |
686 |
+index 4eb8e181763d1..ffe6cb4c78ffb 100644 |
687 |
+--- a/drivers/usb/gadget/udc/r8a66597-udc.c |
688 |
++++ b/drivers/usb/gadget/udc/r8a66597-udc.c |
689 |
+@@ -1253,7 +1253,7 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl) |
690 |
+ do { |
691 |
+ tmp = r8a66597_read(r8a66597, INTSTS0) & CTSQ; |
692 |
+ udelay(1); |
693 |
+- } while (tmp != CS_IDST || timeout-- > 0); |
694 |
++ } while (tmp != CS_IDST && timeout-- > 0); |
695 |
+ |
696 |
+ if (tmp == CS_IDST) |
697 |
+ r8a66597_bset(r8a66597, |
698 |
+diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c |
699 |
+index df7c9f46be548..85a57385958fd 100644 |
700 |
+--- a/drivers/usb/musb/tusb6010.c |
701 |
++++ b/drivers/usb/musb/tusb6010.c |
702 |
+@@ -193,6 +193,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len) |
703 |
+ } |
704 |
+ if (len > 0) { |
705 |
+ /* Write the rest 1 - 3 bytes to FIFO */ |
706 |
++ val = 0; |
707 |
+ memcpy(&val, buf, len); |
708 |
+ musb_writel(fifo, 0, val); |
709 |
+ } |
710 |
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c |
711 |
+index f039b85d5f57f..0fbdfea7ec2c1 100644 |
712 |
+--- a/drivers/usb/serial/cp210x.c |
713 |
++++ b/drivers/usb/serial/cp210x.c |
714 |
+@@ -230,6 +230,7 @@ static const struct usb_device_id id_table[] = { |
715 |
+ { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ |
716 |
+ { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ |
717 |
+ { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ |
718 |
++ { USB_DEVICE(0x2184, 0x0030) }, /* GW Instek GDM-834x Digital Multimeter */ |
719 |
+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ |
720 |
+ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ |
721 |
+ { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ |
722 |
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c |
723 |
+index 7a9b9542882fd..8a94c85428d9e 100644 |
724 |
+--- a/drivers/usb/serial/mos7840.c |
725 |
++++ b/drivers/usb/serial/mos7840.c |
726 |
+@@ -126,7 +126,6 @@ |
727 |
+ #define BANDB_DEVICE_ID_USOPTL4_2P 0xBC02 |
728 |
+ #define BANDB_DEVICE_ID_USOPTL4_4 0xAC44 |
729 |
+ #define BANDB_DEVICE_ID_USOPTL4_4P 0xBC03 |
730 |
+-#define BANDB_DEVICE_ID_USOPTL2_4 0xAC24 |
731 |
+ |
732 |
+ /* This driver also supports |
733 |
+ * ATEN UC2324 device using Moschip MCS7840 |
734 |
+@@ -207,7 +206,6 @@ static const struct usb_device_id id_table[] = { |
735 |
+ {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2P)}, |
736 |
+ {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)}, |
737 |
+ {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4P)}, |
738 |
+- {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)}, |
739 |
+ {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)}, |
740 |
+ {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)}, |
741 |
+ {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)}, |
742 |
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
743 |
+index 02ded56bcbc6b..ec8ad931f41e3 100644 |
744 |
+--- a/drivers/usb/serial/option.c |
745 |
++++ b/drivers/usb/serial/option.c |
746 |
+@@ -1187,6 +1187,14 @@ static const struct usb_device_id option_ids[] = { |
747 |
+ .driver_info = NCTRL(0) | RSVD(1) }, |
748 |
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ |
749 |
+ .driver_info = NCTRL(2) | RSVD(3) }, |
750 |
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */ |
751 |
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, |
752 |
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */ |
753 |
++ .driver_info = NCTRL(0) | RSVD(1) }, |
754 |
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1062, 0xff), /* Telit LN920 (RNDIS) */ |
755 |
++ .driver_info = NCTRL(2) | RSVD(3) }, |
756 |
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */ |
757 |
++ .driver_info = NCTRL(0) | RSVD(1) }, |
758 |
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), |
759 |
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, |
760 |
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), |
761 |
+@@ -1632,7 +1640,6 @@ static const struct usb_device_id option_ids[] = { |
762 |
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) }, |
763 |
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, |
764 |
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, |
765 |
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) }, |
766 |
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff), |
767 |
+ .driver_info = RSVD(1) }, |
768 |
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff), |
769 |
+@@ -2052,6 +2059,8 @@ static const struct usb_device_id option_ids[] = { |
770 |
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, |
771 |
+ { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ |
772 |
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, |
773 |
++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ |
774 |
++ .driver_info = RSVD(3) }, |
775 |
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ |
776 |
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, |
777 |
+ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ |
778 |
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c |
779 |
+index 71c9ed70aa683..cda22b312a4c1 100644 |
780 |
+--- a/fs/cifs/connect.c |
781 |
++++ b/fs/cifs/connect.c |
782 |
+@@ -2961,9 +2961,10 @@ cifs_match_super(struct super_block *sb, void *data) |
783 |
+ spin_lock(&cifs_tcp_ses_lock); |
784 |
+ cifs_sb = CIFS_SB(sb); |
785 |
+ tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb)); |
786 |
+- if (IS_ERR(tlink)) { |
787 |
++ if (tlink == NULL) { |
788 |
++ /* can not match superblock if tlink were ever null */ |
789 |
+ spin_unlock(&cifs_tcp_ses_lock); |
790 |
+- return rc; |
791 |
++ return 0; |
792 |
+ } |
793 |
+ tcon = tlink_tcon(tlink); |
794 |
+ ses = tcon->ses; |
795 |
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c |
796 |
+index 7b626e942987f..96dc313d6251b 100644 |
797 |
+--- a/fs/ext4/dir.c |
798 |
++++ b/fs/ext4/dir.c |
799 |
+@@ -521,7 +521,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) |
800 |
+ struct dir_private_info *info = file->private_data; |
801 |
+ struct inode *inode = file_inode(file); |
802 |
+ struct fname *fname; |
803 |
+- int ret; |
804 |
++ int ret = 0; |
805 |
+ |
806 |
+ if (!info) { |
807 |
+ info = ext4_htree_create_dir_info(file, ctx->pos); |
808 |
+@@ -569,7 +569,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) |
809 |
+ info->curr_minor_hash, |
810 |
+ &info->next_hash); |
811 |
+ if (ret < 0) |
812 |
+- return ret; |
813 |
++ goto finished; |
814 |
+ if (ret == 0) { |
815 |
+ ctx->pos = ext4_get_htree_eof(file); |
816 |
+ break; |
817 |
+@@ -600,7 +600,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) |
818 |
+ } |
819 |
+ finished: |
820 |
+ info->last_pos = ctx->pos; |
821 |
+- return 0; |
822 |
++ return ret < 0 ? ret : 0; |
823 |
+ } |
824 |
+ |
825 |
+ static int ext4_dir_open(struct inode * inode, struct file * filp) |
826 |
+diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c |
827 |
+index b218f965817bf..613cc38c9efad 100644 |
828 |
+--- a/fs/qnx4/dir.c |
829 |
++++ b/fs/qnx4/dir.c |
830 |
+@@ -14,13 +14,48 @@ |
831 |
+ #include <linux/buffer_head.h> |
832 |
+ #include "qnx4.h" |
833 |
+ |
834 |
++/* |
835 |
++ * A qnx4 directory entry is an inode entry or link info |
836 |
++ * depending on the status field in the last byte. The |
837 |
++ * first byte is where the name start either way, and a |
838 |
++ * zero means it's empty. |
839 |
++ * |
840 |
++ * Also, due to a bug in gcc, we don't want to use the |
841 |
++ * real (differently sized) name arrays in the inode and |
842 |
++ * link entries, but always the 'de_name[]' one in the |
843 |
++ * fake struct entry. |
844 |
++ * |
845 |
++ * See |
846 |
++ * |
847 |
++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6 |
848 |
++ * |
849 |
++ * for details, but basically gcc will take the size of the |
850 |
++ * 'name' array from one of the used union entries randomly. |
851 |
++ * |
852 |
++ * This use of 'de_name[]' (48 bytes) avoids the false positive |
853 |
++ * warnings that would happen if gcc decides to use 'inode.di_name' |
854 |
++ * (16 bytes) even when the pointer and size were to come from |
855 |
++ * 'link.dl_name' (48 bytes). |
856 |
++ * |
857 |
++ * In all cases the actual name pointer itself is the same, it's |
858 |
++ * only the gcc internal 'what is the size of this field' logic |
859 |
++ * that can get confused. |
860 |
++ */ |
861 |
++union qnx4_directory_entry { |
862 |
++ struct { |
863 |
++ const char de_name[48]; |
864 |
++ u8 de_pad[15]; |
865 |
++ u8 de_status; |
866 |
++ }; |
867 |
++ struct qnx4_inode_entry inode; |
868 |
++ struct qnx4_link_info link; |
869 |
++}; |
870 |
++ |
871 |
+ static int qnx4_readdir(struct file *file, struct dir_context *ctx) |
872 |
+ { |
873 |
+ struct inode *inode = file_inode(file); |
874 |
+ unsigned int offset; |
875 |
+ struct buffer_head *bh; |
876 |
+- struct qnx4_inode_entry *de; |
877 |
+- struct qnx4_link_info *le; |
878 |
+ unsigned long blknum; |
879 |
+ int ix, ino; |
880 |
+ int size; |
881 |
+@@ -37,27 +72,27 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx) |
882 |
+ } |
883 |
+ ix = (ctx->pos >> QNX4_DIR_ENTRY_SIZE_BITS) % QNX4_INODES_PER_BLOCK; |
884 |
+ for (; ix < QNX4_INODES_PER_BLOCK; ix++, ctx->pos += QNX4_DIR_ENTRY_SIZE) { |
885 |
++ union qnx4_directory_entry *de; |
886 |
++ |
887 |
+ offset = ix * QNX4_DIR_ENTRY_SIZE; |
888 |
+- de = (struct qnx4_inode_entry *) (bh->b_data + offset); |
889 |
+- if (!de->di_fname[0]) |
890 |
++ de = (union qnx4_directory_entry *) (bh->b_data + offset); |
891 |
++ |
892 |
++ if (!de->de_name[0]) |
893 |
+ continue; |
894 |
+- if (!(de->di_status & (QNX4_FILE_USED|QNX4_FILE_LINK))) |
895 |
++ if (!(de->de_status & (QNX4_FILE_USED|QNX4_FILE_LINK))) |
896 |
+ continue; |
897 |
+- if (!(de->di_status & QNX4_FILE_LINK)) |
898 |
+- size = QNX4_SHORT_NAME_MAX; |
899 |
+- else |
900 |
+- size = QNX4_NAME_MAX; |
901 |
+- size = strnlen(de->di_fname, size); |
902 |
+- QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, de->di_fname)); |
903 |
+- if (!(de->di_status & QNX4_FILE_LINK)) |
904 |
++ if (!(de->de_status & QNX4_FILE_LINK)) { |
905 |
++ size = sizeof(de->inode.di_fname); |
906 |
+ ino = blknum * QNX4_INODES_PER_BLOCK + ix - 1; |
907 |
+- else { |
908 |
+- le = (struct qnx4_link_info*)de; |
909 |
+- ino = ( le32_to_cpu(le->dl_inode_blk) - 1 ) * |
910 |
++ } else { |
911 |
++ size = sizeof(de->link.dl_fname); |
912 |
++ ino = ( le32_to_cpu(de->link.dl_inode_blk) - 1 ) * |
913 |
+ QNX4_INODES_PER_BLOCK + |
914 |
+- le->dl_inode_ndx; |
915 |
++ de->link.dl_inode_ndx; |
916 |
+ } |
917 |
+- if (!dir_emit(ctx, de->di_fname, size, ino, DT_UNKNOWN)) { |
918 |
++ size = strnlen(de->de_name, size); |
919 |
++ QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, name)); |
920 |
++ if (!dir_emit(ctx, de->de_name, size, ino, DT_UNKNOWN)) { |
921 |
+ brelse(bh); |
922 |
+ return 0; |
923 |
+ } |
924 |
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h |
925 |
+index 7cabe0cc86651..bc8077e5e688e 100644 |
926 |
+--- a/include/linux/compiler.h |
927 |
++++ b/include/linux/compiler.h |
928 |
+@@ -208,6 +208,8 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); |
929 |
+ (typeof(ptr)) (__ptr + (off)); }) |
930 |
+ #endif |
931 |
+ |
932 |
++#define absolute_pointer(val) RELOC_HIDE((void *)(val), 0) |
933 |
++ |
934 |
+ #ifndef OPTIMIZER_HIDE_VAR |
935 |
+ #define OPTIMIZER_HIDE_VAR(var) barrier() |
936 |
+ #endif |
937 |
+diff --git a/include/linux/cred.h b/include/linux/cred.h |
938 |
+index d2db1da3036c4..ee2b36cdb80d8 100644 |
939 |
+--- a/include/linux/cred.h |
940 |
++++ b/include/linux/cred.h |
941 |
+@@ -243,7 +243,7 @@ static inline struct cred *get_new_cred(struct cred *cred) |
942 |
+ * @cred: The credentials to reference |
943 |
+ * |
944 |
+ * Get a reference on the specified set of credentials. The caller must |
945 |
+- * release the reference. |
946 |
++ * release the reference. If %NULL is passed, it is returned with no action. |
947 |
+ * |
948 |
+ * This is used to deal with a committed set of credentials. Although the |
949 |
+ * pointer is const, this will temporarily discard the const and increment the |
950 |
+@@ -254,6 +254,8 @@ static inline struct cred *get_new_cred(struct cred *cred) |
951 |
+ static inline const struct cred *get_cred(const struct cred *cred) |
952 |
+ { |
953 |
+ struct cred *nonconst_cred = (struct cred *) cred; |
954 |
++ if (!cred) |
955 |
++ return cred; |
956 |
+ validate_creds(cred); |
957 |
+ nonconst_cred->non_rcu = 0; |
958 |
+ return get_new_cred(nonconst_cred); |
959 |
+@@ -264,7 +266,7 @@ static inline const struct cred *get_cred(const struct cred *cred) |
960 |
+ * @cred: The credentials to release |
961 |
+ * |
962 |
+ * Release a reference to a set of credentials, deleting them when the last ref |
963 |
+- * is released. |
964 |
++ * is released. If %NULL is passed, nothing is done. |
965 |
+ * |
966 |
+ * This takes a const pointer to a set of credentials because the credentials |
967 |
+ * on task_struct are attached by const pointers to prevent accidental |
968 |
+@@ -274,9 +276,11 @@ static inline void put_cred(const struct cred *_cred) |
969 |
+ { |
970 |
+ struct cred *cred = (struct cred *) _cred; |
971 |
+ |
972 |
+- validate_creds(cred); |
973 |
+- if (atomic_dec_and_test(&(cred)->usage)) |
974 |
+- __put_cred(cred); |
975 |
++ if (cred) { |
976 |
++ validate_creds(cred); |
977 |
++ if (atomic_dec_and_test(&(cred)->usage)) |
978 |
++ __put_cred(cred); |
979 |
++ } |
980 |
+ } |
981 |
+ |
982 |
+ /** |
983 |
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c |
984 |
+index 8ac3663e0012d..c142e100840e4 100644 |
985 |
+--- a/kernel/trace/blktrace.c |
986 |
++++ b/kernel/trace/blktrace.c |
987 |
+@@ -1581,6 +1581,14 @@ static int blk_trace_remove_queue(struct request_queue *q) |
988 |
+ if (bt == NULL) |
989 |
+ return -EINVAL; |
990 |
+ |
991 |
++ if (bt->trace_state == Blktrace_running) { |
992 |
++ bt->trace_state = Blktrace_stopped; |
993 |
++ spin_lock_irq(&running_trace_lock); |
994 |
++ list_del_init(&bt->running_list); |
995 |
++ spin_unlock_irq(&running_trace_lock); |
996 |
++ relay_flush(bt->rchan); |
997 |
++ } |
998 |
++ |
999 |
+ put_probe_ref(); |
1000 |
+ synchronize_rcu(); |
1001 |
+ blk_trace_free(bt); |
1002 |
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c |
1003 |
+index 921115327ec8f..3884bb1a59dd0 100644 |
1004 |
+--- a/net/mac80211/wpa.c |
1005 |
++++ b/net/mac80211/wpa.c |
1006 |
+@@ -519,6 +519,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, |
1007 |
+ return RX_DROP_UNUSABLE; |
1008 |
+ } |
1009 |
+ |
1010 |
++ /* reload hdr - skb might have been reallocated */ |
1011 |
++ hdr = (void *)rx->skb->data; |
1012 |
++ |
1013 |
+ data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len; |
1014 |
+ if (!rx->sta || data_len < 0) |
1015 |
+ return RX_DROP_UNUSABLE; |
1016 |
+@@ -751,6 +754,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) |
1017 |
+ return RX_DROP_UNUSABLE; |
1018 |
+ } |
1019 |
+ |
1020 |
++ /* reload hdr - skb might have been reallocated */ |
1021 |
++ hdr = (void *)rx->skb->data; |
1022 |
++ |
1023 |
+ data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len; |
1024 |
+ if (!rx->sta || data_len < 0) |
1025 |
+ return RX_DROP_UNUSABLE; |
1026 |
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h |
1027 |
+index da0aa720da6fd..7b69d1ad8f3eb 100644 |
1028 |
+--- a/net/netfilter/ipset/ip_set_hash_gen.h |
1029 |
++++ b/net/netfilter/ipset/ip_set_hash_gen.h |
1030 |
+@@ -102,11 +102,11 @@ htable_size(u8 hbits) |
1031 |
+ { |
1032 |
+ size_t hsize; |
1033 |
+ |
1034 |
+- /* We must fit both into u32 in jhash and size_t */ |
1035 |
++ /* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */ |
1036 |
+ if (hbits > 31) |
1037 |
+ return 0; |
1038 |
+ hsize = jhash_size(hbits); |
1039 |
+- if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *) |
1040 |
++ if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *) |
1041 |
+ < hsize) |
1042 |
+ return 0; |
1043 |
+ |
1044 |
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c |
1045 |
+index 85ca189bdc3d2..de196dd95dcdf 100644 |
1046 |
+--- a/net/netfilter/ipvs/ip_vs_conn.c |
1047 |
++++ b/net/netfilter/ipvs/ip_vs_conn.c |
1048 |
+@@ -1368,6 +1368,10 @@ int __init ip_vs_conn_init(void) |
1049 |
+ int idx; |
1050 |
+ |
1051 |
+ /* Compute size and mask */ |
1052 |
++ if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) { |
1053 |
++ pr_info("conn_tab_bits not in [8, 20]. Using default value\n"); |
1054 |
++ ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS; |
1055 |
++ } |
1056 |
+ ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits; |
1057 |
+ ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1; |
1058 |
+ |