1 |
commit: cdb85d4d78a0451f681097fc42d09baea36e6b60 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Tue May 5 17:39:28 2020 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Tue May 5 17:39:28 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cdb85d4d |
7 |
|
8 |
Linux patch 4.9.222 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1221_linux-4.9.222.patch | 632 +++++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 636 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index 68ee429..e92c377 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -927,6 +927,10 @@ Patch: 1220_linux-4.9.221.patch |
21 |
From: http://www.kernel.org |
22 |
Desc: Linux 4.9.221 |
23 |
|
24 |
+Patch: 1221_linux-4.9.222.patch |
25 |
+From: http://www.kernel.org |
26 |
+Desc: Linux 4.9.222 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1221_linux-4.9.222.patch b/1221_linux-4.9.222.patch |
33 |
new file mode 100644 |
34 |
index 0000000..7257105 |
35 |
--- /dev/null |
36 |
+++ b/1221_linux-4.9.222.patch |
37 |
@@ -0,0 +1,632 @@ |
38 |
+diff --git a/Makefile b/Makefile |
39 |
+index b919a66788b5..67c9106594be 100644 |
40 |
+--- a/Makefile |
41 |
++++ b/Makefile |
42 |
+@@ -1,6 +1,6 @@ |
43 |
+ VERSION = 4 |
44 |
+ PATCHLEVEL = 9 |
45 |
+-SUBLEVEL = 221 |
46 |
++SUBLEVEL = 222 |
47 |
+ EXTRAVERSION = |
48 |
+ NAME = Roaring Lionus |
49 |
+ |
50 |
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c |
51 |
+index c76e4527620c..245bcdb44c64 100644 |
52 |
+--- a/drivers/acpi/device_pm.c |
53 |
++++ b/drivers/acpi/device_pm.c |
54 |
+@@ -226,13 +226,13 @@ int acpi_device_set_power(struct acpi_device *device, int state) |
55 |
+ end: |
56 |
+ if (result) { |
57 |
+ dev_warn(&device->dev, "Failed to change power state to %s\n", |
58 |
+- acpi_power_state_string(state)); |
59 |
++ acpi_power_state_string(target_state)); |
60 |
+ } else { |
61 |
+ device->power.state = target_state; |
62 |
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO, |
63 |
+ "Device [%s] transitioned to %s\n", |
64 |
+ device->pnp.bus_id, |
65 |
+- acpi_power_state_string(state))); |
66 |
++ acpi_power_state_string(target_state))); |
67 |
+ } |
68 |
+ |
69 |
+ return result; |
70 |
+diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c |
71 |
+index 7dd46cf5ed84..7a028b57a7ef 100644 |
72 |
+--- a/drivers/dma/dmatest.c |
73 |
++++ b/drivers/dma/dmatest.c |
74 |
+@@ -505,8 +505,8 @@ static int dmatest_func(void *data) |
75 |
+ flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT; |
76 |
+ |
77 |
+ ktime = ktime_get(); |
78 |
+- while (!kthread_should_stop() |
79 |
+- && !(params->iterations && total_tests >= params->iterations)) { |
80 |
++ while (!(kthread_should_stop() || |
81 |
++ (params->iterations && total_tests >= params->iterations))) { |
82 |
+ struct dma_async_tx_descriptor *tx = NULL; |
83 |
+ struct dmaengine_unmap_data *um; |
84 |
+ dma_addr_t srcs[src_cnt]; |
85 |
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c |
86 |
+index a9bf02ea0a3b..5b5970f0e91d 100644 |
87 |
+--- a/drivers/gpu/drm/drm_edid.c |
88 |
++++ b/drivers/gpu/drm/drm_edid.c |
89 |
+@@ -3970,7 +3970,7 @@ static struct drm_display_mode *drm_mode_displayid_detailed(struct drm_device *d |
90 |
+ struct drm_display_mode *mode; |
91 |
+ unsigned pixel_clock = (timings->pixel_clock[0] | |
92 |
+ (timings->pixel_clock[1] << 8) | |
93 |
+- (timings->pixel_clock[2] << 16)); |
94 |
++ (timings->pixel_clock[2] << 16)) + 1; |
95 |
+ unsigned hactive = (timings->hactive[0] | timings->hactive[1] << 8) + 1; |
96 |
+ unsigned hblank = (timings->hblank[0] | timings->hblank[1] << 8) + 1; |
97 |
+ unsigned hsync = (timings->hsync[0] | (timings->hsync[1] & 0x7f) << 8) + 1; |
98 |
+diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c |
99 |
+index 04270f5d110c..3e6fd393da15 100644 |
100 |
+--- a/drivers/gpu/drm/qxl/qxl_cmd.c |
101 |
++++ b/drivers/gpu/drm/qxl/qxl_cmd.c |
102 |
+@@ -500,9 +500,10 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, |
103 |
+ return ret; |
104 |
+ |
105 |
+ ret = qxl_release_reserve_list(release, true); |
106 |
+- if (ret) |
107 |
++ if (ret) { |
108 |
++ qxl_release_free(qdev, release); |
109 |
+ return ret; |
110 |
+- |
111 |
++ } |
112 |
+ cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release); |
113 |
+ cmd->type = QXL_SURFACE_CMD_CREATE; |
114 |
+ cmd->flags = QXL_SURF_FLAG_KEEP_DATA; |
115 |
+@@ -528,8 +529,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, |
116 |
+ /* no need to add a release to the fence for this surface bo, |
117 |
+ since it is only released when we ask to destroy the surface |
118 |
+ and it would never signal otherwise */ |
119 |
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); |
120 |
+ qxl_release_fence_buffer_objects(release); |
121 |
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); |
122 |
+ |
123 |
+ surf->hw_surf_alloc = true; |
124 |
+ spin_lock(&qdev->surf_id_idr_lock); |
125 |
+@@ -571,9 +572,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev, |
126 |
+ cmd->surface_id = id; |
127 |
+ qxl_release_unmap(qdev, release, &cmd->release_info); |
128 |
+ |
129 |
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); |
130 |
+- |
131 |
+ qxl_release_fence_buffer_objects(release); |
132 |
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); |
133 |
+ |
134 |
+ return 0; |
135 |
+ } |
136 |
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c |
137 |
+index a61c0d460ec2..f8a1f84c8838 100644 |
138 |
+--- a/drivers/gpu/drm/qxl/qxl_display.c |
139 |
++++ b/drivers/gpu/drm/qxl/qxl_display.c |
140 |
+@@ -292,8 +292,8 @@ qxl_hide_cursor(struct qxl_device *qdev) |
141 |
+ cmd->type = QXL_CURSOR_HIDE; |
142 |
+ qxl_release_unmap(qdev, release, &cmd->release_info); |
143 |
+ |
144 |
+- qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); |
145 |
+ qxl_release_fence_buffer_objects(release); |
146 |
++ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); |
147 |
+ return 0; |
148 |
+ } |
149 |
+ |
150 |
+@@ -333,8 +333,8 @@ static int qxl_crtc_apply_cursor(struct drm_crtc *crtc) |
151 |
+ cmd->u.set.visible = 1; |
152 |
+ qxl_release_unmap(qdev, release, &cmd->release_info); |
153 |
+ |
154 |
+- qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); |
155 |
+ qxl_release_fence_buffer_objects(release); |
156 |
++ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); |
157 |
+ |
158 |
+ return ret; |
159 |
+ |
160 |
+@@ -436,8 +436,8 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc, |
161 |
+ cmd->u.set.visible = 1; |
162 |
+ qxl_release_unmap(qdev, release, &cmd->release_info); |
163 |
+ |
164 |
+- qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); |
165 |
+ qxl_release_fence_buffer_objects(release); |
166 |
++ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); |
167 |
+ |
168 |
+ /* finish with the userspace bo */ |
169 |
+ ret = qxl_bo_reserve(user_bo, false); |
170 |
+@@ -497,8 +497,8 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc, |
171 |
+ cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; |
172 |
+ qxl_release_unmap(qdev, release, &cmd->release_info); |
173 |
+ |
174 |
+- qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); |
175 |
+ qxl_release_fence_buffer_objects(release); |
176 |
++ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); |
177 |
+ |
178 |
+ return 0; |
179 |
+ } |
180 |
+diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c |
181 |
+index 9b728edf1b49..d1407d162877 100644 |
182 |
+--- a/drivers/gpu/drm/qxl/qxl_draw.c |
183 |
++++ b/drivers/gpu/drm/qxl/qxl_draw.c |
184 |
+@@ -241,8 +241,8 @@ void qxl_draw_opaque_fb(const struct qxl_fb_image *qxl_fb_image, |
185 |
+ qxl_bo_physical_address(qdev, dimage->bo, 0); |
186 |
+ qxl_release_unmap(qdev, release, &drawable->release_info); |
187 |
+ |
188 |
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); |
189 |
+ qxl_release_fence_buffer_objects(release); |
190 |
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); |
191 |
+ |
192 |
+ out_free_palette: |
193 |
+ if (palette_bo) |
194 |
+@@ -348,9 +348,10 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, |
195 |
+ goto out_release_backoff; |
196 |
+ |
197 |
+ rects = drawable_set_clipping(qdev, num_clips, clips_bo); |
198 |
+- if (!rects) |
199 |
++ if (!rects) { |
200 |
++ ret = -EINVAL; |
201 |
+ goto out_release_backoff; |
202 |
+- |
203 |
++ } |
204 |
+ drawable = (struct qxl_drawable *)qxl_release_map(qdev, release); |
205 |
+ |
206 |
+ drawable->clip.type = SPICE_CLIP_TYPE_RECTS; |
207 |
+@@ -381,8 +382,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, |
208 |
+ } |
209 |
+ qxl_bo_kunmap(clips_bo); |
210 |
+ |
211 |
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); |
212 |
+ qxl_release_fence_buffer_objects(release); |
213 |
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); |
214 |
+ |
215 |
+ out_release_backoff: |
216 |
+ if (ret) |
217 |
+@@ -432,8 +433,8 @@ void qxl_draw_copyarea(struct qxl_device *qdev, |
218 |
+ drawable->u.copy_bits.src_pos.y = sy; |
219 |
+ qxl_release_unmap(qdev, release, &drawable->release_info); |
220 |
+ |
221 |
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); |
222 |
+ qxl_release_fence_buffer_objects(release); |
223 |
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); |
224 |
+ |
225 |
+ out_free_release: |
226 |
+ if (ret) |
227 |
+@@ -476,8 +477,8 @@ void qxl_draw_fill(struct qxl_draw_fill *qxl_draw_fill_rec) |
228 |
+ |
229 |
+ qxl_release_unmap(qdev, release, &drawable->release_info); |
230 |
+ |
231 |
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); |
232 |
+ qxl_release_fence_buffer_objects(release); |
233 |
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); |
234 |
+ |
235 |
+ out_free_release: |
236 |
+ if (ret) |
237 |
+diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c |
238 |
+index 5a4c8c492683..db0afb0613c9 100644 |
239 |
+--- a/drivers/gpu/drm/qxl/qxl_ioctl.c |
240 |
++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c |
241 |
+@@ -256,11 +256,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, |
242 |
+ apply_surf_reloc(qdev, &reloc_info[i]); |
243 |
+ } |
244 |
+ |
245 |
++ qxl_release_fence_buffer_objects(release); |
246 |
+ ret = qxl_push_command_ring_release(qdev, release, cmd->type, true); |
247 |
+- if (ret) |
248 |
+- qxl_release_backoff_reserve_list(release); |
249 |
+- else |
250 |
+- qxl_release_fence_buffer_objects(release); |
251 |
+ |
252 |
+ out_free_bos: |
253 |
+ out_free_release: |
254 |
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c |
255 |
+index adc46b809ef2..0555c939c948 100644 |
256 |
+--- a/drivers/infiniband/hw/mlx4/main.c |
257 |
++++ b/drivers/infiniband/hw/mlx4/main.c |
258 |
+@@ -1589,8 +1589,9 @@ static int __mlx4_ib_create_default_rules( |
259 |
+ int i; |
260 |
+ |
261 |
+ for (i = 0; i < ARRAY_SIZE(pdefault_rules->rules_create_list); i++) { |
262 |
++ union ib_flow_spec ib_spec = {}; |
263 |
+ int ret; |
264 |
+- union ib_flow_spec ib_spec; |
265 |
++ |
266 |
+ switch (pdefault_rules->rules_create_list[i]) { |
267 |
+ case 0: |
268 |
+ /* no rule */ |
269 |
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c |
270 |
+index c113e46fdc3a..e6ae8d123984 100644 |
271 |
+--- a/drivers/iommu/amd_iommu_init.c |
272 |
++++ b/drivers/iommu/amd_iommu_init.c |
273 |
+@@ -2574,7 +2574,7 @@ static int __init parse_amd_iommu_intr(char *str) |
274 |
+ { |
275 |
+ for (; *str; ++str) { |
276 |
+ if (strncmp(str, "legacy", 6) == 0) { |
277 |
+- amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY; |
278 |
++ amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY_GA; |
279 |
+ break; |
280 |
+ } |
281 |
+ if (strncmp(str, "vapic", 5) == 0) { |
282 |
+diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c |
283 |
+index 8f9957d31a3e..1640298d90fd 100644 |
284 |
+--- a/drivers/md/dm-verity-fec.c |
285 |
++++ b/drivers/md/dm-verity-fec.c |
286 |
+@@ -447,7 +447,7 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io, |
287 |
+ fio->level++; |
288 |
+ |
289 |
+ if (type == DM_VERITY_BLOCK_TYPE_METADATA) |
290 |
+- block += v->data_blocks; |
291 |
++ block = block - v->hash_start + v->data_blocks; |
292 |
+ |
293 |
+ /* |
294 |
+ * For RS(M, N), the continuous FEC data is divided into blocks of N |
295 |
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c |
296 |
+index 0d5b667c0e65..a9f58f3867f0 100644 |
297 |
+--- a/drivers/vfio/vfio_iommu_type1.c |
298 |
++++ b/drivers/vfio/vfio_iommu_type1.c |
299 |
+@@ -229,8 +229,8 @@ static int vaddr_get_pfn(unsigned long vaddr, int prot, unsigned long *pfn) |
300 |
+ vma = find_vma_intersection(current->mm, vaddr, vaddr + 1); |
301 |
+ |
302 |
+ if (vma && vma->vm_flags & VM_PFNMAP) { |
303 |
+- *pfn = ((vaddr - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; |
304 |
+- if (is_invalid_reserved_pfn(*pfn)) |
305 |
++ if (!follow_pfn(vma, vaddr, pfn) && |
306 |
++ is_invalid_reserved_pfn(*pfn)) |
307 |
+ ret = 0; |
308 |
+ } |
309 |
+ |
310 |
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c |
311 |
+index 538f378eea52..a83f353e4418 100644 |
312 |
+--- a/fs/btrfs/extent-tree.c |
313 |
++++ b/fs/btrfs/extent-tree.c |
314 |
+@@ -10645,7 +10645,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, |
315 |
+ path = btrfs_alloc_path(); |
316 |
+ if (!path) { |
317 |
+ ret = -ENOMEM; |
318 |
+- goto out; |
319 |
++ goto out_put_group; |
320 |
+ } |
321 |
+ |
322 |
+ /* |
323 |
+@@ -10684,7 +10684,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, |
324 |
+ ret = btrfs_orphan_add(trans, inode); |
325 |
+ if (ret) { |
326 |
+ btrfs_add_delayed_iput(inode); |
327 |
+- goto out; |
328 |
++ goto out_put_group; |
329 |
+ } |
330 |
+ clear_nlink(inode); |
331 |
+ /* One for the block groups ref */ |
332 |
+@@ -10707,13 +10707,13 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, |
333 |
+ |
334 |
+ ret = btrfs_search_slot(trans, tree_root, &key, path, -1, 1); |
335 |
+ if (ret < 0) |
336 |
+- goto out; |
337 |
++ goto out_put_group; |
338 |
+ if (ret > 0) |
339 |
+ btrfs_release_path(path); |
340 |
+ if (ret == 0) { |
341 |
+ ret = btrfs_del_item(trans, tree_root, path); |
342 |
+ if (ret) |
343 |
+- goto out; |
344 |
++ goto out_put_group; |
345 |
+ btrfs_release_path(path); |
346 |
+ } |
347 |
+ |
348 |
+@@ -10871,9 +10871,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, |
349 |
+ |
350 |
+ ret = remove_block_group_free_space(trans, root->fs_info, block_group); |
351 |
+ if (ret) |
352 |
+- goto out; |
353 |
++ goto out_put_group; |
354 |
+ |
355 |
+- btrfs_put_block_group(block_group); |
356 |
++ /* Once for the block groups rbtree */ |
357 |
+ btrfs_put_block_group(block_group); |
358 |
+ |
359 |
+ ret = btrfs_search_slot(trans, root, &key, path, -1, 1); |
360 |
+@@ -10883,6 +10883,10 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, |
361 |
+ goto out; |
362 |
+ |
363 |
+ ret = btrfs_del_item(trans, root, path); |
364 |
++ |
365 |
++out_put_group: |
366 |
++ /* Once for the lookup reference */ |
367 |
++ btrfs_put_block_group(block_group); |
368 |
+ out: |
369 |
+ btrfs_free_path(path); |
370 |
+ return ret; |
371 |
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c |
372 |
+index e049dc682e57..d8780e04aaf0 100644 |
373 |
+--- a/fs/ext4/inode.c |
374 |
++++ b/fs/ext4/inode.c |
375 |
+@@ -4494,7 +4494,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, |
376 |
+ gid_t i_gid; |
377 |
+ projid_t i_projid; |
378 |
+ |
379 |
+- if (((flags & EXT4_IGET_NORMAL) && |
380 |
++ if ((!(flags & EXT4_IGET_SPECIAL) && |
381 |
+ (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) || |
382 |
+ (ino < EXT4_ROOT_INO) || |
383 |
+ (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) { |
384 |
+diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c |
385 |
+index 720d92f5abfb..6c378435fa29 100644 |
386 |
+--- a/fs/nfs/nfs3acl.c |
387 |
++++ b/fs/nfs/nfs3acl.c |
388 |
+@@ -252,37 +252,45 @@ int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl, |
389 |
+ |
390 |
+ int nfs3_set_acl(struct inode *inode, struct posix_acl *acl, int type) |
391 |
+ { |
392 |
+- struct posix_acl *alloc = NULL, *dfacl = NULL; |
393 |
++ struct posix_acl *orig = acl, *dfacl = NULL, *alloc; |
394 |
+ int status; |
395 |
+ |
396 |
+ if (S_ISDIR(inode->i_mode)) { |
397 |
+ switch(type) { |
398 |
+ case ACL_TYPE_ACCESS: |
399 |
+- alloc = dfacl = get_acl(inode, ACL_TYPE_DEFAULT); |
400 |
++ alloc = get_acl(inode, ACL_TYPE_DEFAULT); |
401 |
+ if (IS_ERR(alloc)) |
402 |
+ goto fail; |
403 |
++ dfacl = alloc; |
404 |
+ break; |
405 |
+ |
406 |
+ case ACL_TYPE_DEFAULT: |
407 |
+- dfacl = acl; |
408 |
+- alloc = acl = get_acl(inode, ACL_TYPE_ACCESS); |
409 |
++ alloc = get_acl(inode, ACL_TYPE_ACCESS); |
410 |
+ if (IS_ERR(alloc)) |
411 |
+ goto fail; |
412 |
++ dfacl = acl; |
413 |
++ acl = alloc; |
414 |
+ break; |
415 |
+ } |
416 |
+ } |
417 |
+ |
418 |
+ if (acl == NULL) { |
419 |
+- alloc = acl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL); |
420 |
++ alloc = posix_acl_from_mode(inode->i_mode, GFP_KERNEL); |
421 |
+ if (IS_ERR(alloc)) |
422 |
+ goto fail; |
423 |
++ acl = alloc; |
424 |
+ } |
425 |
+ status = __nfs3_proc_setacls(inode, acl, dfacl); |
426 |
+- posix_acl_release(alloc); |
427 |
++out: |
428 |
++ if (acl != orig) |
429 |
++ posix_acl_release(acl); |
430 |
++ if (dfacl != orig) |
431 |
++ posix_acl_release(dfacl); |
432 |
+ return status; |
433 |
+ |
434 |
+ fail: |
435 |
+- return PTR_ERR(alloc); |
436 |
++ status = PTR_ERR(alloc); |
437 |
++ goto out; |
438 |
+ } |
439 |
+ |
440 |
+ const struct xattr_handler *nfs3_xattr_handlers[] = { |
441 |
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c |
442 |
+index 81695a492ebe..3c775d6b7317 100644 |
443 |
+--- a/kernel/power/hibernate.c |
444 |
++++ b/kernel/power/hibernate.c |
445 |
+@@ -892,6 +892,13 @@ static int software_resume(void) |
446 |
+ error = freeze_processes(); |
447 |
+ if (error) |
448 |
+ goto Close_Finish; |
449 |
++ |
450 |
++ error = freeze_kernel_threads(); |
451 |
++ if (error) { |
452 |
++ thaw_processes(); |
453 |
++ goto Close_Finish; |
454 |
++ } |
455 |
++ |
456 |
+ error = load_image_and_restore(); |
457 |
+ thaw_processes(); |
458 |
+ Finish: |
459 |
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c |
460 |
+index 772df402c495..a2b63a6a33c7 100644 |
461 |
+--- a/security/selinux/hooks.c |
462 |
++++ b/security/selinux/hooks.c |
463 |
+@@ -5002,39 +5002,59 @@ static int selinux_tun_dev_open(void *security) |
464 |
+ |
465 |
+ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) |
466 |
+ { |
467 |
+- int err = 0; |
468 |
+- u32 perm; |
469 |
++ int rc = 0; |
470 |
++ unsigned int msg_len; |
471 |
++ unsigned int data_len = skb->len; |
472 |
++ unsigned char *data = skb->data; |
473 |
+ struct nlmsghdr *nlh; |
474 |
+ struct sk_security_struct *sksec = sk->sk_security; |
475 |
++ u16 sclass = sksec->sclass; |
476 |
++ u32 perm; |
477 |
+ |
478 |
+- if (skb->len < NLMSG_HDRLEN) { |
479 |
+- err = -EINVAL; |
480 |
+- goto out; |
481 |
+- } |
482 |
+- nlh = nlmsg_hdr(skb); |
483 |
++ while (data_len >= nlmsg_total_size(0)) { |
484 |
++ nlh = (struct nlmsghdr *)data; |
485 |
+ |
486 |
+- err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm); |
487 |
+- if (err) { |
488 |
+- if (err == -EINVAL) { |
489 |
++ /* NOTE: the nlmsg_len field isn't reliably set by some netlink |
490 |
++ * users which means we can't reject skb's with bogus |
491 |
++ * length fields; our solution is to follow what |
492 |
++ * netlink_rcv_skb() does and simply skip processing at |
493 |
++ * messages with length fields that are clearly junk |
494 |
++ */ |
495 |
++ if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len) |
496 |
++ return 0; |
497 |
++ |
498 |
++ rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm); |
499 |
++ if (rc == 0) { |
500 |
++ rc = sock_has_perm(current, sk, perm); |
501 |
++ if (rc) |
502 |
++ return rc; |
503 |
++ } else if (rc == -EINVAL) { |
504 |
++ /* -EINVAL is a missing msg/perm mapping */ |
505 |
+ pr_warn_ratelimited("SELinux: unrecognized netlink" |
506 |
+- " message: protocol=%hu nlmsg_type=%hu sclass=%s" |
507 |
+- " pig=%d comm=%s\n", |
508 |
+- sk->sk_protocol, nlh->nlmsg_type, |
509 |
+- secclass_map[sksec->sclass - 1].name, |
510 |
+- task_pid_nr(current), current->comm); |
511 |
+- if (!selinux_enforcing || security_get_allow_unknown()) |
512 |
+- err = 0; |
513 |
++ " message: protocol=%hu nlmsg_type=%hu sclass=%s" |
514 |
++ " pid=%d comm=%s\n", |
515 |
++ sk->sk_protocol, nlh->nlmsg_type, |
516 |
++ secclass_map[sclass - 1].name, |
517 |
++ task_pid_nr(current), current->comm); |
518 |
++ if (selinux_enforcing && !security_get_allow_unknown()) |
519 |
++ return rc; |
520 |
++ rc = 0; |
521 |
++ } else if (rc == -ENOENT) { |
522 |
++ /* -ENOENT is a missing socket/class mapping, ignore */ |
523 |
++ rc = 0; |
524 |
++ } else { |
525 |
++ return rc; |
526 |
+ } |
527 |
+ |
528 |
+- /* Ignore */ |
529 |
+- if (err == -ENOENT) |
530 |
+- err = 0; |
531 |
+- goto out; |
532 |
++ /* move to the next message after applying netlink padding */ |
533 |
++ msg_len = NLMSG_ALIGN(nlh->nlmsg_len); |
534 |
++ if (msg_len >= data_len) |
535 |
++ return 0; |
536 |
++ data_len -= msg_len; |
537 |
++ data += msg_len; |
538 |
+ } |
539 |
+ |
540 |
+- err = sock_has_perm(current, sk, perm); |
541 |
+-out: |
542 |
+- return err; |
543 |
++ return rc; |
544 |
+ } |
545 |
+ |
546 |
+ #ifdef CONFIG_NETFILTER |
547 |
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c |
548 |
+index 7c5d124d538c..6a7cbad90222 100644 |
549 |
+--- a/sound/core/oss/pcm_plugin.c |
550 |
++++ b/sound/core/oss/pcm_plugin.c |
551 |
+@@ -211,21 +211,23 @@ static snd_pcm_sframes_t plug_client_size(struct snd_pcm_substream *plug, |
552 |
+ if (stream == SNDRV_PCM_STREAM_PLAYBACK) { |
553 |
+ plugin = snd_pcm_plug_last(plug); |
554 |
+ while (plugin && drv_frames > 0) { |
555 |
+- if (check_size && drv_frames > plugin->buf_frames) |
556 |
+- drv_frames = plugin->buf_frames; |
557 |
+ plugin_prev = plugin->prev; |
558 |
+ if (plugin->src_frames) |
559 |
+ drv_frames = plugin->src_frames(plugin, drv_frames); |
560 |
++ if (check_size && plugin->buf_frames && |
561 |
++ drv_frames > plugin->buf_frames) |
562 |
++ drv_frames = plugin->buf_frames; |
563 |
+ plugin = plugin_prev; |
564 |
+ } |
565 |
+ } else if (stream == SNDRV_PCM_STREAM_CAPTURE) { |
566 |
+ plugin = snd_pcm_plug_first(plug); |
567 |
+ while (plugin && drv_frames > 0) { |
568 |
+ plugin_next = plugin->next; |
569 |
++ if (check_size && plugin->buf_frames && |
570 |
++ drv_frames > plugin->buf_frames) |
571 |
++ drv_frames = plugin->buf_frames; |
572 |
+ if (plugin->dst_frames) |
573 |
+ drv_frames = plugin->dst_frames(plugin, drv_frames); |
574 |
+- if (check_size && drv_frames > plugin->buf_frames) |
575 |
+- drv_frames = plugin->buf_frames; |
576 |
+ plugin = plugin_next; |
577 |
+ } |
578 |
+ } else |
579 |
+@@ -251,26 +253,28 @@ static snd_pcm_sframes_t plug_slave_size(struct snd_pcm_substream *plug, |
580 |
+ plugin = snd_pcm_plug_first(plug); |
581 |
+ while (plugin && frames > 0) { |
582 |
+ plugin_next = plugin->next; |
583 |
++ if (check_size && plugin->buf_frames && |
584 |
++ frames > plugin->buf_frames) |
585 |
++ frames = plugin->buf_frames; |
586 |
+ if (plugin->dst_frames) { |
587 |
+ frames = plugin->dst_frames(plugin, frames); |
588 |
+ if (frames < 0) |
589 |
+ return frames; |
590 |
+ } |
591 |
+- if (check_size && frames > plugin->buf_frames) |
592 |
+- frames = plugin->buf_frames; |
593 |
+ plugin = plugin_next; |
594 |
+ } |
595 |
+ } else if (stream == SNDRV_PCM_STREAM_CAPTURE) { |
596 |
+ plugin = snd_pcm_plug_last(plug); |
597 |
+ while (plugin) { |
598 |
+- if (check_size && frames > plugin->buf_frames) |
599 |
+- frames = plugin->buf_frames; |
600 |
+ plugin_prev = plugin->prev; |
601 |
+ if (plugin->src_frames) { |
602 |
+ frames = plugin->src_frames(plugin, frames); |
603 |
+ if (frames < 0) |
604 |
+ return frames; |
605 |
+ } |
606 |
++ if (check_size && plugin->buf_frames && |
607 |
++ frames > plugin->buf_frames) |
608 |
++ frames = plugin->buf_frames; |
609 |
+ plugin = plugin_prev; |
610 |
+ } |
611 |
+ } else |
612 |
+diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c |
613 |
+index 3a9067db1a84..7fbac24607bc 100644 |
614 |
+--- a/sound/isa/opti9xx/miro.c |
615 |
++++ b/sound/isa/opti9xx/miro.c |
616 |
+@@ -875,10 +875,13 @@ static void snd_miro_write(struct snd_miro *chip, unsigned char reg, |
617 |
+ spin_unlock_irqrestore(&chip->lock, flags); |
618 |
+ } |
619 |
+ |
620 |
++static inline void snd_miro_write_mask(struct snd_miro *chip, |
621 |
++ unsigned char reg, unsigned char value, unsigned char mask) |
622 |
++{ |
623 |
++ unsigned char oldval = snd_miro_read(chip, reg); |
624 |
+ |
625 |
+-#define snd_miro_write_mask(chip, reg, value, mask) \ |
626 |
+- snd_miro_write(chip, reg, \ |
627 |
+- (snd_miro_read(chip, reg) & ~(mask)) | ((value) & (mask))) |
628 |
++ snd_miro_write(chip, reg, (oldval & ~mask) | (value & mask)); |
629 |
++} |
630 |
+ |
631 |
+ /* |
632 |
+ * Proc Interface |
633 |
+diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c |
634 |
+index 0a5266003786..6777ae84b59e 100644 |
635 |
+--- a/sound/isa/opti9xx/opti92x-ad1848.c |
636 |
++++ b/sound/isa/opti9xx/opti92x-ad1848.c |
637 |
+@@ -327,10 +327,13 @@ static void snd_opti9xx_write(struct snd_opti9xx *chip, unsigned char reg, |
638 |
+ } |
639 |
+ |
640 |
+ |
641 |
+-#define snd_opti9xx_write_mask(chip, reg, value, mask) \ |
642 |
+- snd_opti9xx_write(chip, reg, \ |
643 |
+- (snd_opti9xx_read(chip, reg) & ~(mask)) | ((value) & (mask))) |
644 |
++static inline void snd_opti9xx_write_mask(struct snd_opti9xx *chip, |
645 |
++ unsigned char reg, unsigned char value, unsigned char mask) |
646 |
++{ |
647 |
++ unsigned char oldval = snd_opti9xx_read(chip, reg); |
648 |
+ |
649 |
++ snd_opti9xx_write(chip, reg, (oldval & ~mask) | (value & mask)); |
650 |
++} |
651 |
+ |
652 |
+ static int snd_opti9xx_configure(struct snd_opti9xx *chip, |
653 |
+ long port, |
654 |
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c |
655 |
+index 7a2943a338bf..e19f447e27ae 100644 |
656 |
+--- a/sound/pci/hda/patch_hdmi.c |
657 |
++++ b/sound/pci/hda/patch_hdmi.c |
658 |
+@@ -1699,8 +1699,10 @@ static bool check_non_pcm_per_cvt(struct hda_codec *codec, hda_nid_t cvt_nid) |
659 |
+ /* Add sanity check to pass klockwork check. |
660 |
+ * This should never happen. |
661 |
+ */ |
662 |
+- if (WARN_ON(spdif == NULL)) |
663 |
++ if (WARN_ON(spdif == NULL)) { |
664 |
++ mutex_unlock(&codec->spdif_mutex); |
665 |
+ return true; |
666 |
++ } |
667 |
+ non_pcm = !!(spdif->status & IEC958_AES0_NONAUDIO); |
668 |
+ mutex_unlock(&codec->spdif_mutex); |
669 |
+ return non_pcm; |