1 |
commit: f58e44bce167ce71ef6281cda184e46028f074c2 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Thu Sep 15 11:09:54 2022 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Thu Sep 15 11:09:54 2022 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f58e44bc |
7 |
|
8 |
Linux patch 4.14.293 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1292_linux-4.14.293.patch | 1558 +++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 1562 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index 0994044d..dbe48b95 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -1215,6 +1215,10 @@ Patch: 1291_linux-4.14.292.patch |
21 |
From: https://www.kernel.org |
22 |
Desc: Linux 4.14.292 |
23 |
|
24 |
+Patch: 1292_linux-4.14.293.patch |
25 |
+From: https://www.kernel.org |
26 |
+Desc: Linux 4.14.293 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1292_linux-4.14.293.patch b/1292_linux-4.14.293.patch |
33 |
new file mode 100644 |
34 |
index 00000000..d96b82fd |
35 |
--- /dev/null |
36 |
+++ b/1292_linux-4.14.293.patch |
37 |
@@ -0,0 +1,1558 @@ |
38 |
+diff --git a/Makefile b/Makefile |
39 |
+index 7fa724cacd233..e1f7e128afb02 100644 |
40 |
+--- a/Makefile |
41 |
++++ b/Makefile |
42 |
+@@ -1,7 +1,7 @@ |
43 |
+ # SPDX-License-Identifier: GPL-2.0 |
44 |
+ VERSION = 4 |
45 |
+ PATCHLEVEL = 14 |
46 |
+-SUBLEVEL = 292 |
47 |
++SUBLEVEL = 293 |
48 |
+ EXTRAVERSION = |
49 |
+ NAME = Petit Gorille |
50 |
+ |
51 |
+diff --git a/arch/mips/loongson32/ls1c/board.c b/arch/mips/loongson32/ls1c/board.c |
52 |
+index eb2d913c694fd..2d9675a6782c3 100644 |
53 |
+--- a/arch/mips/loongson32/ls1c/board.c |
54 |
++++ b/arch/mips/loongson32/ls1c/board.c |
55 |
+@@ -19,7 +19,6 @@ static struct platform_device *ls1c_platform_devices[] __initdata = { |
56 |
+ static int __init ls1c_platform_init(void) |
57 |
+ { |
58 |
+ ls1x_serial_set_uartclk(&ls1x_uart_pdev); |
59 |
+- ls1x_rtc_set_extclk(&ls1x_rtc_pdev); |
60 |
+ |
61 |
+ return platform_add_devices(ls1c_platform_devices, |
62 |
+ ARRAY_SIZE(ls1c_platform_devices)); |
63 |
+diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S |
64 |
+index 9b99eb0712ad1..2f570a5205866 100644 |
65 |
+--- a/arch/parisc/kernel/head.S |
66 |
++++ b/arch/parisc/kernel/head.S |
67 |
+@@ -22,7 +22,7 @@ |
68 |
+ #include <linux/linkage.h> |
69 |
+ #include <linux/init.h> |
70 |
+ |
71 |
+- .level PA_ASM_LEVEL |
72 |
++ .level 1.1 |
73 |
+ |
74 |
+ __INITDATA |
75 |
+ ENTRY(boot_args) |
76 |
+@@ -69,6 +69,47 @@ $bss_loop: |
77 |
+ stw,ma %arg2,4(%r1) |
78 |
+ stw,ma %arg3,4(%r1) |
79 |
+ |
80 |
++#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20) |
81 |
++ /* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU |
82 |
++ * and halt kernel if we detect a PA1.x CPU. */ |
83 |
++ ldi 32,%r10 |
84 |
++ mtctl %r10,%cr11 |
85 |
++ .level 2.0 |
86 |
++ mfctl,w %cr11,%r10 |
87 |
++ .level 1.1 |
88 |
++ comib,<>,n 0,%r10,$cpu_ok |
89 |
++ |
90 |
++ load32 PA(msg1),%arg0 |
91 |
++ ldi msg1_end-msg1,%arg1 |
92 |
++$iodc_panic: |
93 |
++ copy %arg0, %r10 |
94 |
++ copy %arg1, %r11 |
95 |
++ load32 PA(init_stack),%sp |
96 |
++#define MEM_CONS 0x3A0 |
97 |
++ ldw MEM_CONS+32(%r0),%arg0 // HPA |
98 |
++ ldi ENTRY_IO_COUT,%arg1 |
99 |
++ ldw MEM_CONS+36(%r0),%arg2 // SPA |
100 |
++ ldw MEM_CONS+8(%r0),%arg3 // layers |
101 |
++ load32 PA(__bss_start),%r1 |
102 |
++ stw %r1,-52(%sp) // arg4 |
103 |
++ stw %r0,-56(%sp) // arg5 |
104 |
++ stw %r10,-60(%sp) // arg6 = ptr to text |
105 |
++ stw %r11,-64(%sp) // arg7 = len |
106 |
++ stw %r0,-68(%sp) // arg8 |
107 |
++ load32 PA(.iodc_panic_ret), %rp |
108 |
++ ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC |
109 |
++ bv,n (%r1) |
110 |
++.iodc_panic_ret: |
111 |
++ b . /* wait endless with ... */ |
112 |
++ or %r10,%r10,%r10 /* qemu idle sleep */ |
113 |
++msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this machine.\r\n" |
114 |
++msg1_end: |
115 |
++ |
116 |
++$cpu_ok: |
117 |
++#endif |
118 |
++ |
119 |
++ .level PA_ASM_LEVEL |
120 |
++ |
121 |
+ /* Initialize startup VM. Just map first 16/32 MB of memory */ |
122 |
+ load32 PA(swapper_pg_dir),%r4 |
123 |
+ mtctl %r4,%cr24 /* Initialize kernel root pointer */ |
124 |
+diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h |
125 |
+index 9c5fc50204dd6..36cf17d6518eb 100644 |
126 |
+--- a/arch/s390/include/asm/hugetlb.h |
127 |
++++ b/arch/s390/include/asm/hugetlb.h |
128 |
+@@ -30,9 +30,11 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, |
129 |
+ static inline int prepare_hugepage_range(struct file *file, |
130 |
+ unsigned long addr, unsigned long len) |
131 |
+ { |
132 |
+- if (len & ~HPAGE_MASK) |
133 |
++ struct hstate *h = hstate_file(file); |
134 |
++ |
135 |
++ if (len & ~huge_page_mask(h)) |
136 |
+ return -EINVAL; |
137 |
+- if (addr & ~HPAGE_MASK) |
138 |
++ if (addr & ~huge_page_mask(h)) |
139 |
+ return -EINVAL; |
140 |
+ return 0; |
141 |
+ } |
142 |
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S |
143 |
+index 85dd3c7bdd86b..f9516843f839d 100644 |
144 |
+--- a/arch/s390/kernel/vmlinux.lds.S |
145 |
++++ b/arch/s390/kernel/vmlinux.lds.S |
146 |
+@@ -131,6 +131,7 @@ SECTIONS |
147 |
+ /* |
148 |
+ * Table with the patch locations to undo expolines |
149 |
+ */ |
150 |
++ . = ALIGN(4); |
151 |
+ .nospec_call_table : { |
152 |
+ __nospec_call_start = . ; |
153 |
+ *(.s390_indirect*) |
154 |
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c |
155 |
+index 2412e219b7c3a..c07a304af8a38 100644 |
156 |
+--- a/drivers/android/binder.c |
157 |
++++ b/drivers/android/binder.c |
158 |
+@@ -1757,6 +1757,18 @@ static int binder_inc_ref_for_node(struct binder_proc *proc, |
159 |
+ } |
160 |
+ ret = binder_inc_ref_olocked(ref, strong, target_list); |
161 |
+ *rdata = ref->data; |
162 |
++ if (ret && ref == new_ref) { |
163 |
++ /* |
164 |
++ * Cleanup the failed reference here as the target |
165 |
++ * could now be dead and have already released its |
166 |
++ * references by now. Calling on the new reference |
167 |
++ * with strong=0 and a tmp_refs will not decrement |
168 |
++ * the node. The new_ref gets kfree'd below. |
169 |
++ */ |
170 |
++ binder_cleanup_ref_olocked(new_ref); |
171 |
++ ref = NULL; |
172 |
++ } |
173 |
++ |
174 |
+ binder_proc_unlock(proc); |
175 |
+ if (new_ref && ref != new_ref) |
176 |
+ /* |
177 |
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c |
178 |
+index fc27fab62f503..a7bcbb99e8208 100644 |
179 |
+--- a/drivers/base/dd.c |
180 |
++++ b/drivers/base/dd.c |
181 |
+@@ -632,6 +632,11 @@ static int __device_attach_driver(struct device_driver *drv, void *_data) |
182 |
+ } else if (ret == -EPROBE_DEFER) { |
183 |
+ dev_dbg(dev, "Device match requests probe deferral\n"); |
184 |
+ driver_deferred_probe_add(dev); |
185 |
++ /* |
186 |
++ * Device can't match with a driver right now, so don't attempt |
187 |
++ * to match or bind with other drivers on the bus. |
188 |
++ */ |
189 |
++ return ret; |
190 |
+ } else if (ret < 0) { |
191 |
+ dev_dbg(dev, "Bus failed to match device: %d", ret); |
192 |
+ return ret; |
193 |
+@@ -774,6 +779,11 @@ static int __driver_attach(struct device *dev, void *data) |
194 |
+ } else if (ret == -EPROBE_DEFER) { |
195 |
+ dev_dbg(dev, "Device match requests probe deferral\n"); |
196 |
+ driver_deferred_probe_add(dev); |
197 |
++ /* |
198 |
++ * Driver could not match with device, but may match with |
199 |
++ * another device on the bus. |
200 |
++ */ |
201 |
++ return 0; |
202 |
+ } else if (ret < 0) { |
203 |
+ dev_dbg(dev, "Bus failed to match device: %d", ret); |
204 |
+ return ret; |
205 |
+diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c |
206 |
+index 055e2e8f985a3..539825a17959d 100644 |
207 |
+--- a/drivers/firmware/efi/capsule-loader.c |
208 |
++++ b/drivers/firmware/efi/capsule-loader.c |
209 |
+@@ -237,29 +237,6 @@ failed: |
210 |
+ return ret; |
211 |
+ } |
212 |
+ |
213 |
+-/** |
214 |
+- * efi_capsule_flush - called by file close or file flush |
215 |
+- * @file: file pointer |
216 |
+- * @id: not used |
217 |
+- * |
218 |
+- * If a capsule is being partially uploaded then calling this function |
219 |
+- * will be treated as upload termination and will free those completed |
220 |
+- * buffer pages and -ECANCELED will be returned. |
221 |
+- **/ |
222 |
+-static int efi_capsule_flush(struct file *file, fl_owner_t id) |
223 |
+-{ |
224 |
+- int ret = 0; |
225 |
+- struct capsule_info *cap_info = file->private_data; |
226 |
+- |
227 |
+- if (cap_info->index > 0) { |
228 |
+- pr_err("capsule upload not complete\n"); |
229 |
+- efi_free_all_buff_pages(cap_info); |
230 |
+- ret = -ECANCELED; |
231 |
+- } |
232 |
+- |
233 |
+- return ret; |
234 |
+-} |
235 |
+- |
236 |
+ /** |
237 |
+ * efi_capsule_release - called by file close |
238 |
+ * @inode: not used |
239 |
+@@ -272,6 +249,13 @@ static int efi_capsule_release(struct inode *inode, struct file *file) |
240 |
+ { |
241 |
+ struct capsule_info *cap_info = file->private_data; |
242 |
+ |
243 |
++ if (cap_info->index > 0 && |
244 |
++ (cap_info->header.headersize == 0 || |
245 |
++ cap_info->count < cap_info->total_size)) { |
246 |
++ pr_err("capsule upload not complete\n"); |
247 |
++ efi_free_all_buff_pages(cap_info); |
248 |
++ } |
249 |
++ |
250 |
+ kfree(cap_info->pages); |
251 |
+ kfree(cap_info->phys); |
252 |
+ kfree(file->private_data); |
253 |
+@@ -319,7 +303,6 @@ static const struct file_operations efi_capsule_fops = { |
254 |
+ .owner = THIS_MODULE, |
255 |
+ .open = efi_capsule_open, |
256 |
+ .write = efi_capsule_write, |
257 |
+- .flush = efi_capsule_flush, |
258 |
+ .release = efi_capsule_release, |
259 |
+ .llseek = no_llseek, |
260 |
+ }; |
261 |
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c |
262 |
+index 53186c5e1066b..bb0d32b4be74d 100644 |
263 |
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c |
264 |
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c |
265 |
+@@ -1514,7 +1514,8 @@ static void gfx_v9_0_gpu_init(struct amdgpu_device *adev) |
266 |
+ |
267 |
+ gfx_v9_0_tiling_mode_table_init(adev); |
268 |
+ |
269 |
+- gfx_v9_0_setup_rb(adev); |
270 |
++ if (adev->gfx.num_gfx_rings) |
271 |
++ gfx_v9_0_setup_rb(adev); |
272 |
+ gfx_v9_0_get_cu_info(adev, &adev->gfx.cu_info); |
273 |
+ |
274 |
+ /* XXX SH_MEM regs */ |
275 |
+diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c |
276 |
+index a5bed2e71b926..2a6c3004ff6d9 100644 |
277 |
+--- a/drivers/gpu/drm/i915/gvt/handlers.c |
278 |
++++ b/drivers/gpu/drm/i915/gvt/handlers.c |
279 |
+@@ -601,7 +601,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *vgpu, |
280 |
+ else if (FDI_RX_IMR_TO_PIPE(offset) != INVALID_INDEX) |
281 |
+ index = FDI_RX_IMR_TO_PIPE(offset); |
282 |
+ else { |
283 |
+- gvt_vgpu_err("Unsupport registers %x\n", offset); |
284 |
++ gvt_vgpu_err("Unsupported registers %x\n", offset); |
285 |
+ return -EINVAL; |
286 |
+ } |
287 |
+ |
288 |
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c |
289 |
+index a5d75c9b3a737..2b8c39a1f7484 100644 |
290 |
+--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c |
291 |
++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c |
292 |
+@@ -105,7 +105,7 @@ static const char * const dsi_8996_bus_clk_names[] = { |
293 |
+ static const struct msm_dsi_config msm8996_dsi_cfg = { |
294 |
+ .io_offset = DSI_6G_REG_SHIFT, |
295 |
+ .reg_cfg = { |
296 |
+- .num = 2, |
297 |
++ .num = 3, |
298 |
+ .regs = { |
299 |
+ {"vdda", 18160, 1 }, /* 1.25 V */ |
300 |
+ {"vcca", 17000, 32 }, /* 0.925 V */ |
301 |
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c |
302 |
+index 58488eac84627..906547b229a9a 100644 |
303 |
+--- a/drivers/gpu/drm/radeon/radeon_device.c |
304 |
++++ b/drivers/gpu/drm/radeon/radeon_device.c |
305 |
+@@ -1655,6 +1655,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, |
306 |
+ if (r) { |
307 |
+ /* delay GPU reset to resume */ |
308 |
+ radeon_fence_driver_force_completion(rdev, i); |
309 |
++ } else { |
310 |
++ /* finish executing delayed work */ |
311 |
++ flush_delayed_work(&rdev->fence_drv[i].lockup_work); |
312 |
+ } |
313 |
+ } |
314 |
+ |
315 |
+diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c |
316 |
+index 9c355b9d31c57..d1b47d20f2fab 100644 |
317 |
+--- a/drivers/hwmon/gpio-fan.c |
318 |
++++ b/drivers/hwmon/gpio-fan.c |
319 |
+@@ -422,6 +422,9 @@ static int gpio_fan_set_cur_state(struct thermal_cooling_device *cdev, |
320 |
+ if (!fan_data) |
321 |
+ return -EINVAL; |
322 |
+ |
323 |
++ if (state >= fan_data->num_speed) |
324 |
++ return -EINVAL; |
325 |
++ |
326 |
+ set_fan_speed(fan_data, state); |
327 |
+ return 0; |
328 |
+ } |
329 |
+diff --git a/drivers/input/misc/rk805-pwrkey.c b/drivers/input/misc/rk805-pwrkey.c |
330 |
+index 921003963a53c..cdcad5c01e3c0 100644 |
331 |
+--- a/drivers/input/misc/rk805-pwrkey.c |
332 |
++++ b/drivers/input/misc/rk805-pwrkey.c |
333 |
+@@ -106,6 +106,7 @@ static struct platform_driver rk805_pwrkey_driver = { |
334 |
+ }; |
335 |
+ module_platform_driver(rk805_pwrkey_driver); |
336 |
+ |
337 |
++MODULE_ALIAS("platform:rk805-pwrkey"); |
338 |
+ MODULE_AUTHOR("Joseph Chen <chenjh@××××××××××.com>"); |
339 |
+ MODULE_DESCRIPTION("RK805 PMIC Power Key driver"); |
340 |
+ MODULE_LICENSE("GPL"); |
341 |
+diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c |
342 |
+index 0653b70723a34..5dad40257e12e 100644 |
343 |
+--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c |
344 |
++++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c |
345 |
+@@ -1277,7 +1277,7 @@ static int ofdpa_port_ipv4_neigh(struct ofdpa_port *ofdpa_port, |
346 |
+ bool removing; |
347 |
+ int err = 0; |
348 |
+ |
349 |
+- entry = kzalloc(sizeof(*entry), GFP_KERNEL); |
350 |
++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC); |
351 |
+ if (!entry) |
352 |
+ return -ENOMEM; |
353 |
+ |
354 |
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-rs.c b/drivers/net/wireless/intel/iwlegacy/4965-rs.c |
355 |
+index 623ee20b2c198..8992eced46d2e 100644 |
356 |
+--- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c |
357 |
++++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c |
358 |
+@@ -2424,7 +2424,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, |
359 |
+ /* Repeat initial/next rate. |
360 |
+ * For legacy IL_NUMBER_TRY == 1, this loop will not execute. |
361 |
+ * For HT IL_HT_NUMBER_TRY == 3, this executes twice. */ |
362 |
+- while (repeat_rate > 0) { |
363 |
++ while (repeat_rate > 0 && idx < (LINK_QUAL_MAX_RETRY_NUM - 1)) { |
364 |
+ if (is_legacy(tbl_type.lq_type)) { |
365 |
+ if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) |
366 |
+ ant_toggle_cnt++; |
367 |
+@@ -2443,8 +2443,6 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, |
368 |
+ cpu_to_le32(new_rate); |
369 |
+ repeat_rate--; |
370 |
+ idx++; |
371 |
+- if (idx >= LINK_QUAL_MAX_RETRY_NUM) |
372 |
+- goto out; |
373 |
+ } |
374 |
+ |
375 |
+ il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, |
376 |
+@@ -2489,7 +2487,6 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, |
377 |
+ repeat_rate--; |
378 |
+ } |
379 |
+ |
380 |
+-out: |
381 |
+ lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF; |
382 |
+ lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF; |
383 |
+ |
384 |
+diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c |
385 |
+index 224a364097672..cc23b30337c16 100644 |
386 |
+--- a/drivers/parisc/ccio-dma.c |
387 |
++++ b/drivers/parisc/ccio-dma.c |
388 |
+@@ -1416,15 +1416,17 @@ ccio_init_resource(struct resource *res, char *name, void __iomem *ioaddr) |
389 |
+ } |
390 |
+ } |
391 |
+ |
392 |
+-static void __init ccio_init_resources(struct ioc *ioc) |
393 |
++static int __init ccio_init_resources(struct ioc *ioc) |
394 |
+ { |
395 |
+ struct resource *res = ioc->mmio_region; |
396 |
+ char *name = kmalloc(14, GFP_KERNEL); |
397 |
+- |
398 |
++ if (unlikely(!name)) |
399 |
++ return -ENOMEM; |
400 |
+ snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path); |
401 |
+ |
402 |
+ ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low); |
403 |
+ ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv); |
404 |
++ return 0; |
405 |
+ } |
406 |
+ |
407 |
+ static int new_ioc_area(struct resource *res, unsigned long size, |
408 |
+@@ -1578,7 +1580,10 @@ static int __init ccio_probe(struct parisc_device *dev) |
409 |
+ return -ENOMEM; |
410 |
+ } |
411 |
+ ccio_ioc_init(ioc); |
412 |
+- ccio_init_resources(ioc); |
413 |
++ if (ccio_init_resources(ioc)) { |
414 |
++ kfree(ioc); |
415 |
++ return -ENOMEM; |
416 |
++ } |
417 |
+ hppa_dma_ops = &ccio_ops; |
418 |
+ dev->dev.platform_data = kzalloc(sizeof(struct pci_hba_data), GFP_KERNEL); |
419 |
+ |
420 |
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c |
421 |
+index d1d5ec3c0f141..d1f10354c3550 100644 |
422 |
+--- a/drivers/platform/x86/pmc_atom.c |
423 |
++++ b/drivers/platform/x86/pmc_atom.c |
424 |
+@@ -253,7 +253,7 @@ static void pmc_power_off(void) |
425 |
+ pm1_cnt_port = acpi_base_addr + PM1_CNT; |
426 |
+ |
427 |
+ pm1_cnt_value = inl(pm1_cnt_port); |
428 |
+- pm1_cnt_value &= SLEEP_TYPE_MASK; |
429 |
++ pm1_cnt_value &= ~SLEEP_TYPE_MASK; |
430 |
+ pm1_cnt_value |= SLEEP_TYPE_S5; |
431 |
+ pm1_cnt_value |= SLEEP_ENABLE; |
432 |
+ |
433 |
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c |
434 |
+index 79c5a193308f4..8fb7491c5bc02 100644 |
435 |
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c |
436 |
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c |
437 |
+@@ -2804,6 +2804,7 @@ static struct fw_event_work *dequeue_next_fw_event(struct MPT3SAS_ADAPTER *ioc) |
438 |
+ fw_event = list_first_entry(&ioc->fw_event_list, |
439 |
+ struct fw_event_work, list); |
440 |
+ list_del_init(&fw_event->list); |
441 |
++ fw_event_work_put(fw_event); |
442 |
+ } |
443 |
+ spin_unlock_irqrestore(&ioc->fw_event_lock, flags); |
444 |
+ |
445 |
+@@ -2840,7 +2841,6 @@ _scsih_fw_event_cleanup_queue(struct MPT3SAS_ADAPTER *ioc) |
446 |
+ if (cancel_work_sync(&fw_event->work)) |
447 |
+ fw_event_work_put(fw_event); |
448 |
+ |
449 |
+- fw_event_work_put(fw_event); |
450 |
+ } |
451 |
+ } |
452 |
+ |
453 |
+diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c |
454 |
+index ccda04e916c54..43832380ff16b 100644 |
455 |
+--- a/drivers/staging/rtl8712/rtl8712_cmd.c |
456 |
++++ b/drivers/staging/rtl8712/rtl8712_cmd.c |
457 |
+@@ -129,34 +129,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf) |
458 |
+ kfree(pdrvcmd->pbuf); |
459 |
+ } |
460 |
+ |
461 |
+-static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf) |
462 |
+-{ |
463 |
+- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); |
464 |
+- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; |
465 |
+- |
466 |
+- /* invoke cmd->callback function */ |
467 |
+- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; |
468 |
+- if (!pcmd_callback) |
469 |
+- r8712_free_cmd_obj(pcmd); |
470 |
+- else |
471 |
+- pcmd_callback(padapter, pcmd); |
472 |
+- return H2C_SUCCESS; |
473 |
+-} |
474 |
+- |
475 |
+-static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf) |
476 |
+-{ |
477 |
+- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); |
478 |
+- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; |
479 |
+- |
480 |
+- /* invoke cmd->callback function */ |
481 |
+- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; |
482 |
+- if (!pcmd_callback) |
483 |
+- r8712_free_cmd_obj(pcmd); |
484 |
+- else |
485 |
+- pcmd_callback(padapter, pcmd); |
486 |
+- return H2C_SUCCESS; |
487 |
+-} |
488 |
+- |
489 |
+ static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) |
490 |
+ { |
491 |
+ struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; |
492 |
+@@ -225,14 +197,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter, |
493 |
+ pcmd_r = NULL; |
494 |
+ |
495 |
+ switch (pcmd->cmdcode) { |
496 |
+- case GEN_CMD_CODE(_Read_MACREG): |
497 |
+- read_macreg_hdl(padapter, (u8 *)pcmd); |
498 |
+- pcmd_r = pcmd; |
499 |
+- break; |
500 |
+- case GEN_CMD_CODE(_Write_MACREG): |
501 |
+- write_macreg_hdl(padapter, (u8 *)pcmd); |
502 |
+- pcmd_r = pcmd; |
503 |
+- break; |
504 |
+ case GEN_CMD_CODE(_Read_BBREG): |
505 |
+ read_bbreg_hdl(padapter, (u8 *)pcmd); |
506 |
+ break; |
507 |
+diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c |
508 |
+index 423ae231fc6cc..6a1e1744cad37 100644 |
509 |
+--- a/drivers/thunderbolt/ctl.c |
510 |
++++ b/drivers/thunderbolt/ctl.c |
511 |
+@@ -401,7 +401,7 @@ static void tb_ctl_rx_submit(struct ctl_pkg *pkg) |
512 |
+ |
513 |
+ static int tb_async_error(const struct ctl_pkg *pkg) |
514 |
+ { |
515 |
+- const struct cfg_error_pkg *error = (const struct cfg_error_pkg *)pkg; |
516 |
++ const struct cfg_error_pkg *error = pkg->buffer; |
517 |
+ |
518 |
+ if (pkg->frame.eof != TB_CFG_PKG_ERROR) |
519 |
+ return false; |
520 |
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c |
521 |
+index 62d1e46079120..cbbdb94592ce7 100644 |
522 |
+--- a/drivers/tty/serial/fsl_lpuart.c |
523 |
++++ b/drivers/tty/serial/fsl_lpuart.c |
524 |
+@@ -1106,9 +1106,9 @@ static int lpuart_config_rs485(struct uart_port *port, |
525 |
+ * Note: UART is assumed to be active high. |
526 |
+ */ |
527 |
+ if (rs485->flags & SER_RS485_RTS_ON_SEND) |
528 |
+- modem &= ~UARTMODEM_TXRTSPOL; |
529 |
+- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) |
530 |
+ modem |= UARTMODEM_TXRTSPOL; |
531 |
++ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) |
532 |
++ modem &= ~UARTMODEM_TXRTSPOL; |
533 |
+ } |
534 |
+ |
535 |
+ /* Store the new configuration */ |
536 |
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c |
537 |
+index 8ac775852b820..2b84ec26e9304 100644 |
538 |
+--- a/drivers/tty/vt/vt.c |
539 |
++++ b/drivers/tty/vt/vt.c |
540 |
+@@ -4175,9 +4175,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) |
541 |
+ console_lock(); |
542 |
+ if (vc->vc_mode != KD_TEXT) |
543 |
+ rc = -EINVAL; |
544 |
+- else if (vc->vc_sw->con_font_set) |
545 |
++ else if (vc->vc_sw->con_font_set) { |
546 |
++ if (vc_is_sel(vc)) |
547 |
++ clear_selection(); |
548 |
+ rc = vc->vc_sw->con_font_set(vc, &font, op->flags); |
549 |
+- else |
550 |
++ } else |
551 |
+ rc = -ENOSYS; |
552 |
+ console_unlock(); |
553 |
+ kfree(font.data); |
554 |
+@@ -4204,9 +4206,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) |
555 |
+ console_unlock(); |
556 |
+ return -EINVAL; |
557 |
+ } |
558 |
+- if (vc->vc_sw->con_font_default) |
559 |
++ if (vc->vc_sw->con_font_default) { |
560 |
++ if (vc_is_sel(vc)) |
561 |
++ clear_selection(); |
562 |
+ rc = vc->vc_sw->con_font_default(vc, &font, s); |
563 |
+- else |
564 |
++ } else |
565 |
+ rc = -ENOSYS; |
566 |
+ console_unlock(); |
567 |
+ if (!rc) { |
568 |
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
569 |
+index c653635ce5c20..fffd37ba1e62c 100644 |
570 |
+--- a/drivers/usb/class/cdc-acm.c |
571 |
++++ b/drivers/usb/class/cdc-acm.c |
572 |
+@@ -1894,6 +1894,9 @@ static const struct usb_device_id acm_ids[] = { |
573 |
+ { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ |
574 |
+ .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */ |
575 |
+ }, |
576 |
++ { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */ |
577 |
++ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ |
578 |
++ }, |
579 |
+ { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */ |
580 |
+ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ |
581 |
+ }, |
582 |
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c |
583 |
+index 132828b56cf83..93f1a234be4f9 100644 |
584 |
+--- a/drivers/usb/core/hub.c |
585 |
++++ b/drivers/usb/core/hub.c |
586 |
+@@ -5737,6 +5737,11 @@ re_enumerate_no_bos: |
587 |
+ * the reset is over (using their post_reset method). |
588 |
+ * |
589 |
+ * Return: The same as for usb_reset_and_verify_device(). |
590 |
++ * However, if a reset is already in progress (for instance, if a |
591 |
++ * driver doesn't have pre_ or post_reset() callbacks, and while |
592 |
++ * being unbound or re-bound during the ongoing reset its disconnect() |
593 |
++ * or probe() routine tries to perform a second, nested reset), the |
594 |
++ * routine returns -EINPROGRESS. |
595 |
+ * |
596 |
+ * Note: |
597 |
+ * The caller must own the device lock. For example, it's safe to use |
598 |
+@@ -5770,6 +5775,10 @@ int usb_reset_device(struct usb_device *udev) |
599 |
+ return -EISDIR; |
600 |
+ } |
601 |
+ |
602 |
++ if (udev->reset_in_progress) |
603 |
++ return -EINPROGRESS; |
604 |
++ udev->reset_in_progress = 1; |
605 |
++ |
606 |
+ port_dev = hub->ports[udev->portnum - 1]; |
607 |
+ |
608 |
+ /* |
609 |
+@@ -5834,6 +5843,7 @@ int usb_reset_device(struct usb_device *udev) |
610 |
+ |
611 |
+ usb_autosuspend_device(udev); |
612 |
+ memalloc_noio_restore(noio_flag); |
613 |
++ udev->reset_in_progress = 0; |
614 |
+ return ret; |
615 |
+ } |
616 |
+ EXPORT_SYMBOL_GPL(usb_reset_device); |
617 |
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c |
618 |
+index 405dccf92a315..7a52dbc9f6fbd 100644 |
619 |
+--- a/drivers/usb/dwc2/platform.c |
620 |
++++ b/drivers/usb/dwc2/platform.c |
621 |
+@@ -141,9 +141,9 @@ static int __dwc2_lowlevel_hw_enable(struct dwc2_hsotg *hsotg) |
622 |
+ } else if (hsotg->plat && hsotg->plat->phy_init) { |
623 |
+ ret = hsotg->plat->phy_init(pdev, hsotg->plat->phy_type); |
624 |
+ } else { |
625 |
+- ret = phy_power_on(hsotg->phy); |
626 |
++ ret = phy_init(hsotg->phy); |
627 |
+ if (ret == 0) |
628 |
+- ret = phy_init(hsotg->phy); |
629 |
++ ret = phy_power_on(hsotg->phy); |
630 |
+ } |
631 |
+ |
632 |
+ return ret; |
633 |
+@@ -175,9 +175,9 @@ static int __dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg) |
634 |
+ } else if (hsotg->plat && hsotg->plat->phy_exit) { |
635 |
+ ret = hsotg->plat->phy_exit(pdev, hsotg->plat->phy_type); |
636 |
+ } else { |
637 |
+- ret = phy_exit(hsotg->phy); |
638 |
++ ret = phy_power_off(hsotg->phy); |
639 |
+ if (ret == 0) |
640 |
+- ret = phy_power_off(hsotg->phy); |
641 |
++ ret = phy_exit(hsotg->phy); |
642 |
+ } |
643 |
+ if (ret) |
644 |
+ return ret; |
645 |
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c |
646 |
+index 0e179274ba7cd..2e93f633a0b6a 100644 |
647 |
+--- a/drivers/usb/dwc3/core.c |
648 |
++++ b/drivers/usb/dwc3/core.c |
649 |
+@@ -656,15 +656,15 @@ static void dwc3_core_exit(struct dwc3 *dwc) |
650 |
+ { |
651 |
+ dwc3_event_buffers_cleanup(dwc); |
652 |
+ |
653 |
+- usb_phy_shutdown(dwc->usb2_phy); |
654 |
+- usb_phy_shutdown(dwc->usb3_phy); |
655 |
+- phy_exit(dwc->usb2_generic_phy); |
656 |
+- phy_exit(dwc->usb3_generic_phy); |
657 |
+- |
658 |
+ usb_phy_set_suspend(dwc->usb2_phy, 1); |
659 |
+ usb_phy_set_suspend(dwc->usb3_phy, 1); |
660 |
+ phy_power_off(dwc->usb2_generic_phy); |
661 |
+ phy_power_off(dwc->usb3_generic_phy); |
662 |
++ |
663 |
++ usb_phy_shutdown(dwc->usb2_phy); |
664 |
++ usb_phy_shutdown(dwc->usb3_phy); |
665 |
++ phy_exit(dwc->usb2_generic_phy); |
666 |
++ phy_exit(dwc->usb3_generic_phy); |
667 |
+ } |
668 |
+ |
669 |
+ static bool dwc3_core_is_valid(struct dwc3 *dwc) |
670 |
+@@ -1288,16 +1288,16 @@ static int dwc3_probe(struct platform_device *pdev) |
671 |
+ err5: |
672 |
+ dwc3_event_buffers_cleanup(dwc); |
673 |
+ |
674 |
+- usb_phy_shutdown(dwc->usb2_phy); |
675 |
+- usb_phy_shutdown(dwc->usb3_phy); |
676 |
+- phy_exit(dwc->usb2_generic_phy); |
677 |
+- phy_exit(dwc->usb3_generic_phy); |
678 |
+- |
679 |
+ usb_phy_set_suspend(dwc->usb2_phy, 1); |
680 |
+ usb_phy_set_suspend(dwc->usb3_phy, 1); |
681 |
+ phy_power_off(dwc->usb2_generic_phy); |
682 |
+ phy_power_off(dwc->usb3_generic_phy); |
683 |
+ |
684 |
++ usb_phy_shutdown(dwc->usb2_phy); |
685 |
++ usb_phy_shutdown(dwc->usb3_phy); |
686 |
++ phy_exit(dwc->usb2_generic_phy); |
687 |
++ phy_exit(dwc->usb3_generic_phy); |
688 |
++ |
689 |
+ dwc3_ulpi_exit(dwc); |
690 |
+ |
691 |
+ err4: |
692 |
+diff --git a/drivers/usb/gadget/function/storage_common.c b/drivers/usb/gadget/function/storage_common.c |
693 |
+index 8fbf6861690d2..b43c6dbfc6fb3 100644 |
694 |
+--- a/drivers/usb/gadget/function/storage_common.c |
695 |
++++ b/drivers/usb/gadget/function/storage_common.c |
696 |
+@@ -298,8 +298,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub); |
697 |
+ void store_cdrom_address(u8 *dest, int msf, u32 addr) |
698 |
+ { |
699 |
+ if (msf) { |
700 |
+- /* Convert to Minutes-Seconds-Frames */ |
701 |
+- addr >>= 2; /* Convert to 2048-byte frames */ |
702 |
++ /* |
703 |
++ * Convert to Minutes-Seconds-Frames. |
704 |
++ * Sector size is already set to 2048 bytes. |
705 |
++ */ |
706 |
+ addr += 2*75; /* Lead-in occupies 2 seconds */ |
707 |
+ dest[3] = addr % 75; /* Frames */ |
708 |
+ addr /= 75; |
709 |
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c |
710 |
+index b2083dcf3bd2a..24ddbf3653e88 100644 |
711 |
+--- a/drivers/usb/host/xhci-hub.c |
712 |
++++ b/drivers/usb/host/xhci-hub.c |
713 |
+@@ -1455,6 +1455,17 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) |
714 |
+ |
715 |
+ status = bus_state->resuming_ports; |
716 |
+ |
717 |
++ /* |
718 |
++ * SS devices are only visible to roothub after link training completes. |
719 |
++ * Keep polling roothubs for a grace period after xHC start |
720 |
++ */ |
721 |
++ if (xhci->run_graceperiod) { |
722 |
++ if (time_before(jiffies, xhci->run_graceperiod)) |
723 |
++ status = 1; |
724 |
++ else |
725 |
++ xhci->run_graceperiod = 0; |
726 |
++ } |
727 |
++ |
728 |
+ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC; |
729 |
+ |
730 |
+ /* For each port, did anything change? If so, set that bit in buf. */ |
731 |
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c |
732 |
+index 3da9cd3791c64..c41548f08c547 100644 |
733 |
+--- a/drivers/usb/host/xhci.c |
734 |
++++ b/drivers/usb/host/xhci.c |
735 |
+@@ -159,9 +159,11 @@ int xhci_start(struct xhci_hcd *xhci) |
736 |
+ xhci_err(xhci, "Host took too long to start, " |
737 |
+ "waited %u microseconds.\n", |
738 |
+ XHCI_MAX_HALT_USEC); |
739 |
+- if (!ret) |
740 |
++ if (!ret) { |
741 |
+ /* clear state flags. Including dying, halted or removing */ |
742 |
+ xhci->xhc_state = 0; |
743 |
++ xhci->run_graceperiod = jiffies + msecs_to_jiffies(500); |
744 |
++ } |
745 |
+ |
746 |
+ return ret; |
747 |
+ } |
748 |
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h |
749 |
+index 59167d4f98d00..7611fc893a0e1 100644 |
750 |
+--- a/drivers/usb/host/xhci.h |
751 |
++++ b/drivers/usb/host/xhci.h |
752 |
+@@ -1780,7 +1780,7 @@ struct xhci_hcd { |
753 |
+ |
754 |
+ /* Host controller watchdog timer structures */ |
755 |
+ unsigned int xhc_state; |
756 |
+- |
757 |
++ unsigned long run_graceperiod; |
758 |
+ u32 command; |
759 |
+ struct s3_save s3; |
760 |
+ /* Host controller is dying - not responding to commands. "I'm not dead yet!" |
761 |
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c |
762 |
+index 1f6761a4daafd..0397f44f8dd39 100644 |
763 |
+--- a/drivers/usb/serial/ch341.c |
764 |
++++ b/drivers/usb/serial/ch341.c |
765 |
+@@ -99,6 +99,8 @@ struct ch341_private { |
766 |
+ u8 mcr; |
767 |
+ u8 msr; |
768 |
+ u8 lcr; |
769 |
++ |
770 |
++ u8 version; |
771 |
+ }; |
772 |
+ |
773 |
+ static void ch341_set_termios(struct tty_struct *tty, |
774 |
+@@ -177,13 +179,20 @@ static int ch341_set_baudrate_lcr(struct usb_device *dev, |
775 |
+ /* |
776 |
+ * CH341A buffers data until a full endpoint-size packet (32 bytes) |
777 |
+ * has been received unless bit 7 is set. |
778 |
++ * |
779 |
++ * At least one device with version 0x27 appears to have this bit |
780 |
++ * inverted. |
781 |
+ */ |
782 |
+- a |= BIT(7); |
783 |
++ if (priv->version > 0x27) |
784 |
++ a |= BIT(7); |
785 |
+ |
786 |
+ r = ch341_control_out(dev, CH341_REQ_WRITE_REG, 0x1312, a); |
787 |
+ if (r) |
788 |
+ return r; |
789 |
+ |
790 |
++ if (priv->version < 0x30) |
791 |
++ return 0; |
792 |
++ |
793 |
+ r = ch341_control_out(dev, CH341_REQ_WRITE_REG, 0x2518, lcr); |
794 |
+ if (r) |
795 |
+ return r; |
796 |
+@@ -235,7 +244,9 @@ static int ch341_configure(struct usb_device *dev, struct ch341_private *priv) |
797 |
+ r = ch341_control_in(dev, CH341_REQ_READ_VERSION, 0, 0, buffer, size); |
798 |
+ if (r < 0) |
799 |
+ goto out; |
800 |
+- dev_dbg(&dev->dev, "Chip version: 0x%02x\n", buffer[0]); |
801 |
++ |
802 |
++ priv->version = buffer[0]; |
803 |
++ dev_dbg(&dev->dev, "Chip version: 0x%02x\n", priv->version); |
804 |
+ |
805 |
+ r = ch341_control_out(dev, CH341_REQ_SERIAL_INIT, 0, 0); |
806 |
+ if (r < 0) |
807 |
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c |
808 |
+index 2f5874b055413..39779ecd7810f 100644 |
809 |
+--- a/drivers/usb/serial/cp210x.c |
810 |
++++ b/drivers/usb/serial/cp210x.c |
811 |
+@@ -134,6 +134,7 @@ static const struct usb_device_id id_table[] = { |
812 |
+ { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */ |
813 |
+ { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */ |
814 |
+ { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ |
815 |
++ { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */ |
816 |
+ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ |
817 |
+ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ |
818 |
+ { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ |
819 |
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c |
820 |
+index f0a0820e4df10..48a6840a3f55f 100644 |
821 |
+--- a/drivers/usb/serial/ftdi_sio.c |
822 |
++++ b/drivers/usb/serial/ftdi_sio.c |
823 |
+@@ -1040,6 +1040,8 @@ static const struct usb_device_id id_table_combined[] = { |
824 |
+ /* IDS GmbH devices */ |
825 |
+ { USB_DEVICE(IDS_VID, IDS_SI31A_PID) }, |
826 |
+ { USB_DEVICE(IDS_VID, IDS_CM31A_PID) }, |
827 |
++ /* Omron devices */ |
828 |
++ { USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) }, |
829 |
+ /* U-Blox devices */ |
830 |
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, |
831 |
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, |
832 |
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h |
833 |
+index 4e92c165c86bf..31c8ccabbbb78 100644 |
834 |
+--- a/drivers/usb/serial/ftdi_sio_ids.h |
835 |
++++ b/drivers/usb/serial/ftdi_sio_ids.h |
836 |
+@@ -661,6 +661,12 @@ |
837 |
+ #define INFINEON_TRIBOARD_TC1798_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */ |
838 |
+ #define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */ |
839 |
+ |
840 |
++/* |
841 |
++ * Omron corporation (https://www.omron.com) |
842 |
++ */ |
843 |
++ #define OMRON_VID 0x0590 |
844 |
++ #define OMRON_CS1W_CIF31_PID 0x00b2 |
845 |
++ |
846 |
+ /* |
847 |
+ * Acton Research Corp. |
848 |
+ */ |
849 |
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
850 |
+index f613086aa6350..f0c0a4a445e7e 100644 |
851 |
+--- a/drivers/usb/serial/option.c |
852 |
++++ b/drivers/usb/serial/option.c |
853 |
+@@ -256,6 +256,7 @@ static void option_instat_callback(struct urb *urb); |
854 |
+ #define QUECTEL_PRODUCT_BG96 0x0296 |
855 |
+ #define QUECTEL_PRODUCT_EP06 0x0306 |
856 |
+ #define QUECTEL_PRODUCT_EM05G 0x030a |
857 |
++#define QUECTEL_PRODUCT_EM060K 0x030b |
858 |
+ #define QUECTEL_PRODUCT_EM12 0x0512 |
859 |
+ #define QUECTEL_PRODUCT_RM500Q 0x0800 |
860 |
+ #define QUECTEL_PRODUCT_EC200S_CN 0x6002 |
861 |
+@@ -441,6 +442,8 @@ static void option_instat_callback(struct urb *urb); |
862 |
+ #define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9 |
863 |
+ #define CINTERION_PRODUCT_MV32_WA 0x00f1 |
864 |
+ #define CINTERION_PRODUCT_MV32_WB 0x00f2 |
865 |
++#define CINTERION_PRODUCT_MV32_WA_RMNET 0x00f3 |
866 |
++#define CINTERION_PRODUCT_MV32_WB_RMNET 0x00f4 |
867 |
+ |
868 |
+ /* Olivetti products */ |
869 |
+ #define OLIVETTI_VENDOR_ID 0x0b3c |
870 |
+@@ -576,6 +579,10 @@ static void option_instat_callback(struct urb *urb); |
871 |
+ #define WETELECOM_PRODUCT_6802 0x6802 |
872 |
+ #define WETELECOM_PRODUCT_WMD300 0x6803 |
873 |
+ |
874 |
++/* OPPO products */ |
875 |
++#define OPPO_VENDOR_ID 0x22d9 |
876 |
++#define OPPO_PRODUCT_R11 0x276c |
877 |
++ |
878 |
+ |
879 |
+ /* Device flags */ |
880 |
+ |
881 |
+@@ -1141,6 +1148,9 @@ static const struct usb_device_id option_ids[] = { |
882 |
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, |
883 |
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), |
884 |
+ .driver_info = RSVD(6) | ZLP }, |
885 |
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, |
886 |
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) }, |
887 |
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) }, |
888 |
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), |
889 |
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, |
890 |
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, |
891 |
+@@ -1996,8 +2006,12 @@ static const struct usb_device_id option_ids[] = { |
892 |
+ .driver_info = RSVD(0)}, |
893 |
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff), |
894 |
+ .driver_info = RSVD(3)}, |
895 |
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA_RMNET, 0xff), |
896 |
++ .driver_info = RSVD(0) }, |
897 |
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff), |
898 |
+ .driver_info = RSVD(3)}, |
899 |
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB_RMNET, 0xff), |
900 |
++ .driver_info = RSVD(0) }, |
901 |
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), |
902 |
+ .driver_info = RSVD(4) }, |
903 |
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), |
904 |
+@@ -2157,6 +2171,7 @@ static const struct usb_device_id option_ids[] = { |
905 |
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ |
906 |
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ |
907 |
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ |
908 |
++ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, |
909 |
+ { } /* Terminating entry */ |
910 |
+ }; |
911 |
+ MODULE_DEVICE_TABLE(usb, option_ids); |
912 |
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h |
913 |
+index fedf7e2bc8af2..8c186ab5b5f79 100644 |
914 |
+--- a/drivers/usb/storage/unusual_devs.h |
915 |
++++ b/drivers/usb/storage/unusual_devs.h |
916 |
+@@ -2313,6 +2313,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0000, |
917 |
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, |
918 |
+ US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), |
919 |
+ |
920 |
++/* Reported by Witold Lipieta <witold.lipieta@×××××××××.com> */ |
921 |
++UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100, |
922 |
++ "NXP Semiconductors", |
923 |
++ "PN7462AU", |
924 |
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, |
925 |
++ US_FL_IGNORE_RESIDUE ), |
926 |
++ |
927 |
+ /* Supplied with some Castlewood ORB removable drives */ |
928 |
+ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999, |
929 |
+ "Double-H Technology", |
930 |
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c |
931 |
+index 413b465e69d8e..7ca149ab86d20 100644 |
932 |
+--- a/drivers/video/fbdev/chipsfb.c |
933 |
++++ b/drivers/video/fbdev/chipsfb.c |
934 |
+@@ -432,6 +432,7 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent) |
935 |
+ err_release_fb: |
936 |
+ framebuffer_release(p); |
937 |
+ err_disable: |
938 |
++ pci_disable_device(dp); |
939 |
+ err_out: |
940 |
+ return rc; |
941 |
+ } |
942 |
+diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h |
943 |
+index 53ebe53f65fce..ee374e9bf8f83 100644 |
944 |
+--- a/include/linux/buffer_head.h |
945 |
++++ b/include/linux/buffer_head.h |
946 |
+@@ -133,6 +133,17 @@ BUFFER_FNS(Defer_Completion, defer_completion) |
947 |
+ |
948 |
+ static __always_inline void set_buffer_uptodate(struct buffer_head *bh) |
949 |
+ { |
950 |
++ /* |
951 |
++ * If somebody else already set this uptodate, they will |
952 |
++ * have done the memory barrier, and a reader will thus |
953 |
++ * see *some* valid buffer state. |
954 |
++ * |
955 |
++ * Any other serialization (with IO errors or whatever that |
956 |
++ * might clear the bit) has to come from other state (eg BH_Lock). |
957 |
++ */ |
958 |
++ if (test_bit(BH_Uptodate, &bh->b_state)) |
959 |
++ return; |
960 |
++ |
961 |
+ /* |
962 |
+ * make it consistent with folio_mark_uptodate |
963 |
+ * pairs with smp_load_acquire in buffer_uptodate |
964 |
+diff --git a/include/linux/platform_data/x86/pmc_atom.h b/include/linux/platform_data/x86/pmc_atom.h |
965 |
+index e4905fe69c381..e4cfcb6f16633 100644 |
966 |
+--- a/include/linux/platform_data/x86/pmc_atom.h |
967 |
++++ b/include/linux/platform_data/x86/pmc_atom.h |
968 |
+@@ -16,6 +16,8 @@ |
969 |
+ #ifndef PMC_ATOM_H |
970 |
+ #define PMC_ATOM_H |
971 |
+ |
972 |
++#include <linux/bits.h> |
973 |
++ |
974 |
+ /* ValleyView Power Control Unit PCI Device ID */ |
975 |
+ #define PCI_DEVICE_ID_VLV_PMC 0x0F1C |
976 |
+ /* CherryTrail Power Control Unit PCI Device ID */ |
977 |
+@@ -148,9 +150,9 @@ |
978 |
+ #define ACPI_MMIO_REG_LEN 0x100 |
979 |
+ |
980 |
+ #define PM1_CNT 0x4 |
981 |
+-#define SLEEP_TYPE_MASK 0xFFFFECFF |
982 |
++#define SLEEP_TYPE_MASK GENMASK(12, 10) |
983 |
+ #define SLEEP_TYPE_S5 0x1C00 |
984 |
+-#define SLEEP_ENABLE 0x2000 |
985 |
++#define SLEEP_ENABLE BIT(13) |
986 |
+ |
987 |
+ extern int pmc_atom_read(int offset, u32 *value); |
988 |
+ extern int pmc_atom_write(int offset, u32 value); |
989 |
+diff --git a/include/linux/usb.h b/include/linux/usb.h |
990 |
+index a22a3e139e962..b2c35d3b83726 100644 |
991 |
+--- a/include/linux/usb.h |
992 |
++++ b/include/linux/usb.h |
993 |
+@@ -568,6 +568,7 @@ struct usb3_lpm_parameters { |
994 |
+ * @level: number of USB hub ancestors |
995 |
+ * @can_submit: URBs may be submitted |
996 |
+ * @persist_enabled: USB_PERSIST enabled for this device |
997 |
++ * @reset_in_progress: the device is being reset |
998 |
+ * @have_langid: whether string_langid is valid |
999 |
+ * @authorized: policy has said we can use it; |
1000 |
+ * (user space) policy determines if we authorize this device to be |
1001 |
+@@ -646,6 +647,7 @@ struct usb_device { |
1002 |
+ |
1003 |
+ unsigned can_submit:1; |
1004 |
+ unsigned persist_enabled:1; |
1005 |
++ unsigned reset_in_progress:1; |
1006 |
+ unsigned have_langid:1; |
1007 |
+ unsigned authorized:1; |
1008 |
+ unsigned authenticated:1; |
1009 |
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c |
1010 |
+index 08f0588fa832b..e8d9ddd5cb187 100644 |
1011 |
+--- a/kernel/bpf/verifier.c |
1012 |
++++ b/kernel/bpf/verifier.c |
1013 |
+@@ -2739,6 +2739,7 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, |
1014 |
+ coerce_reg_to_size(dst_reg, 4); |
1015 |
+ } |
1016 |
+ |
1017 |
++ __update_reg_bounds(dst_reg); |
1018 |
+ __reg_deduce_bounds(dst_reg); |
1019 |
+ __reg_bound_offset(dst_reg); |
1020 |
+ return 0; |
1021 |
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c |
1022 |
+index 384b083f2a7ef..52058ff3ccbfe 100644 |
1023 |
+--- a/kernel/kprobes.c |
1024 |
++++ b/kernel/kprobes.c |
1025 |
+@@ -1553,6 +1553,7 @@ static int check_kprobe_address_safe(struct kprobe *p, |
1026 |
+ /* Ensure it is not in reserved area nor out of text */ |
1027 |
+ if (!(core_kernel_text((unsigned long) p->addr) || |
1028 |
+ is_module_text_address((unsigned long) p->addr)) || |
1029 |
++ in_gate_area_no_mm((unsigned long) p->addr) || |
1030 |
+ within_kprobe_blacklist((unsigned long) p->addr) || |
1031 |
+ jump_label_text_reserved(p->addr, p->addr) || |
1032 |
+ find_bug((unsigned long)p->addr)) { |
1033 |
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c |
1034 |
+index d279d8be0dca3..0b842160168be 100644 |
1035 |
+--- a/mm/kmemleak.c |
1036 |
++++ b/mm/kmemleak.c |
1037 |
+@@ -1192,7 +1192,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); |
1038 |
+ void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count, |
1039 |
+ gfp_t gfp) |
1040 |
+ { |
1041 |
+- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) |
1042 |
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) |
1043 |
+ kmemleak_alloc(__va(phys), size, min_count, gfp); |
1044 |
+ } |
1045 |
+ EXPORT_SYMBOL(kmemleak_alloc_phys); |
1046 |
+@@ -1203,7 +1203,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); |
1047 |
+ */ |
1048 |
+ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) |
1049 |
+ { |
1050 |
+- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) |
1051 |
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) |
1052 |
+ kmemleak_free_part(__va(phys), size); |
1053 |
+ } |
1054 |
+ EXPORT_SYMBOL(kmemleak_free_part_phys); |
1055 |
+@@ -1214,7 +1214,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); |
1056 |
+ */ |
1057 |
+ void __ref kmemleak_not_leak_phys(phys_addr_t phys) |
1058 |
+ { |
1059 |
+- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) |
1060 |
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) |
1061 |
+ kmemleak_not_leak(__va(phys)); |
1062 |
+ } |
1063 |
+ EXPORT_SYMBOL(kmemleak_not_leak_phys); |
1064 |
+@@ -1225,7 +1225,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); |
1065 |
+ */ |
1066 |
+ void __ref kmemleak_ignore_phys(phys_addr_t phys) |
1067 |
+ { |
1068 |
+- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) |
1069 |
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) |
1070 |
+ kmemleak_ignore(__va(phys)); |
1071 |
+ } |
1072 |
+ EXPORT_SYMBOL(kmemleak_ignore_phys); |
1073 |
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c |
1074 |
+index ee7a03ff89f3a..d229bfaaaba72 100644 |
1075 |
+--- a/net/bridge/br_netfilter_hooks.c |
1076 |
++++ b/net/bridge/br_netfilter_hooks.c |
1077 |
+@@ -382,6 +382,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ |
1078 |
+ /* - Bridged-and-DNAT'ed traffic doesn't |
1079 |
+ * require ip_forwarding. */ |
1080 |
+ if (rt->dst.dev == dev) { |
1081 |
++ skb_dst_drop(skb); |
1082 |
+ skb_dst_set(skb, &rt->dst); |
1083 |
+ goto bridged_dnat; |
1084 |
+ } |
1085 |
+@@ -411,6 +412,7 @@ bridged_dnat: |
1086 |
+ kfree_skb(skb); |
1087 |
+ return 0; |
1088 |
+ } |
1089 |
++ skb_dst_drop(skb); |
1090 |
+ skb_dst_set_noref(skb, &rt->dst); |
1091 |
+ } |
1092 |
+ |
1093 |
+diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c |
1094 |
+index 09d5e0c7b3ba4..995d86777e7cb 100644 |
1095 |
+--- a/net/bridge/br_netfilter_ipv6.c |
1096 |
++++ b/net/bridge/br_netfilter_ipv6.c |
1097 |
+@@ -201,6 +201,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc |
1098 |
+ kfree_skb(skb); |
1099 |
+ return 0; |
1100 |
+ } |
1101 |
++ skb_dst_drop(skb); |
1102 |
+ skb_dst_set_noref(skb, &rt->dst); |
1103 |
+ } |
1104 |
+ |
1105 |
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c |
1106 |
+index 906d26794d007..c6d49ec38a56a 100644 |
1107 |
+--- a/net/ipv4/tcp_input.c |
1108 |
++++ b/net/ipv4/tcp_input.c |
1109 |
+@@ -2425,6 +2425,21 @@ static inline bool tcp_may_undo(const struct tcp_sock *tp) |
1110 |
+ return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp)); |
1111 |
+ } |
1112 |
+ |
1113 |
++static bool tcp_is_non_sack_preventing_reopen(struct sock *sk) |
1114 |
++{ |
1115 |
++ struct tcp_sock *tp = tcp_sk(sk); |
1116 |
++ |
1117 |
++ if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) { |
1118 |
++ /* Hold old state until something *above* high_seq |
1119 |
++ * is ACKed. For Reno it is MUST to prevent false |
1120 |
++ * fast retransmits (RFC2582). SACK TCP is safe. */ |
1121 |
++ if (!tcp_any_retrans_done(sk)) |
1122 |
++ tp->retrans_stamp = 0; |
1123 |
++ return true; |
1124 |
++ } |
1125 |
++ return false; |
1126 |
++} |
1127 |
++ |
1128 |
+ /* People celebrate: "We love our President!" */ |
1129 |
+ static bool tcp_try_undo_recovery(struct sock *sk) |
1130 |
+ { |
1131 |
+@@ -2445,14 +2460,8 @@ static bool tcp_try_undo_recovery(struct sock *sk) |
1132 |
+ |
1133 |
+ NET_INC_STATS(sock_net(sk), mib_idx); |
1134 |
+ } |
1135 |
+- if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) { |
1136 |
+- /* Hold old state until something *above* high_seq |
1137 |
+- * is ACKed. For Reno it is MUST to prevent false |
1138 |
+- * fast retransmits (RFC2582). SACK TCP is safe. */ |
1139 |
+- if (!tcp_any_retrans_done(sk)) |
1140 |
+- tp->retrans_stamp = 0; |
1141 |
++ if (tcp_is_non_sack_preventing_reopen(sk)) |
1142 |
+ return true; |
1143 |
+- } |
1144 |
+ tcp_set_ca_state(sk, TCP_CA_Open); |
1145 |
+ tp->is_sack_reneg = 0; |
1146 |
+ return false; |
1147 |
+@@ -2486,6 +2495,8 @@ static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo) |
1148 |
+ NET_INC_STATS(sock_net(sk), |
1149 |
+ LINUX_MIB_TCPSPURIOUSRTOS); |
1150 |
+ inet_csk(sk)->icsk_retransmits = 0; |
1151 |
++ if (tcp_is_non_sack_preventing_reopen(sk)) |
1152 |
++ return true; |
1153 |
+ if (frto_undo || tcp_is_sack(tp)) { |
1154 |
+ tcp_set_ca_state(sk, TCP_CA_Open); |
1155 |
+ tp->is_sack_reneg = 0; |
1156 |
+diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c |
1157 |
+index fdeb90dd1c824..9c45165fe79bb 100644 |
1158 |
+--- a/net/ipv6/seg6.c |
1159 |
++++ b/net/ipv6/seg6.c |
1160 |
+@@ -129,6 +129,11 @@ static int seg6_genl_sethmac(struct sk_buff *skb, struct genl_info *info) |
1161 |
+ goto out_unlock; |
1162 |
+ } |
1163 |
+ |
1164 |
++ if (slen > nla_len(info->attrs[SEG6_ATTR_SECRET])) { |
1165 |
++ err = -EINVAL; |
1166 |
++ goto out_unlock; |
1167 |
++ } |
1168 |
++ |
1169 |
+ if (hinfo) { |
1170 |
+ err = seg6_hmac_info_del(net, hmackeyid); |
1171 |
+ if (err) |
1172 |
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c |
1173 |
+index 7b4f3f8658617..c364d849e7c3d 100644 |
1174 |
+--- a/net/kcm/kcmsock.c |
1175 |
++++ b/net/kcm/kcmsock.c |
1176 |
+@@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct socket *csock, |
1177 |
+ psock->sk = csk; |
1178 |
+ psock->bpf_prog = prog; |
1179 |
+ |
1180 |
+- err = strp_init(&psock->strp, csk, &cb); |
1181 |
+- if (err) { |
1182 |
+- kmem_cache_free(kcm_psockp, psock); |
1183 |
+- goto out; |
1184 |
+- } |
1185 |
+- |
1186 |
+ write_lock_bh(&csk->sk_callback_lock); |
1187 |
+ |
1188 |
+ /* Check if sk_user_data is aready by KCM or someone else. |
1189 |
+@@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock, |
1190 |
+ */ |
1191 |
+ if (csk->sk_user_data) { |
1192 |
+ write_unlock_bh(&csk->sk_callback_lock); |
1193 |
+- strp_stop(&psock->strp); |
1194 |
+- strp_done(&psock->strp); |
1195 |
+ kmem_cache_free(kcm_psockp, psock); |
1196 |
+ err = -EALREADY; |
1197 |
+ goto out; |
1198 |
+ } |
1199 |
+ |
1200 |
++ err = strp_init(&psock->strp, csk, &cb); |
1201 |
++ if (err) { |
1202 |
++ write_unlock_bh(&csk->sk_callback_lock); |
1203 |
++ kmem_cache_free(kcm_psockp, psock); |
1204 |
++ goto out; |
1205 |
++ } |
1206 |
++ |
1207 |
+ psock->save_data_ready = csk->sk_data_ready; |
1208 |
+ psock->save_write_space = csk->sk_write_space; |
1209 |
+ psock->save_state_change = csk->sk_state_change; |
1210 |
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c |
1211 |
+index e550154b12df6..1aa814a1c3351 100644 |
1212 |
+--- a/net/mac80211/ibss.c |
1213 |
++++ b/net/mac80211/ibss.c |
1214 |
+@@ -544,6 +544,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata) |
1215 |
+ |
1216 |
+ sdata_assert_lock(sdata); |
1217 |
+ |
1218 |
++ /* When not connected/joined, sending CSA doesn't make sense. */ |
1219 |
++ if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) |
1220 |
++ return -ENOLINK; |
1221 |
++ |
1222 |
+ /* update cfg80211 bss information with the new channel */ |
1223 |
+ if (!is_zero_ether_addr(ifibss->bssid)) { |
1224 |
+ cbss = cfg80211_get_bss(sdata->local->hw.wiphy, |
1225 |
+diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c |
1226 |
+index 4dcf6e18563a6..060ccd0e14ce7 100644 |
1227 |
+--- a/net/mac802154/rx.c |
1228 |
++++ b/net/mac802154/rx.c |
1229 |
+@@ -52,7 +52,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata, |
1230 |
+ |
1231 |
+ switch (mac_cb(skb)->dest.mode) { |
1232 |
+ case IEEE802154_ADDR_NONE: |
1233 |
+- if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE) |
1234 |
++ if (hdr->source.mode != IEEE802154_ADDR_NONE) |
1235 |
+ /* FIXME: check if we are PAN coordinator */ |
1236 |
+ skb->pkt_type = PACKET_OTHERHOST; |
1237 |
+ else |
1238 |
+diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c |
1239 |
+index 5523acce9d699..814220f7be676 100644 |
1240 |
+--- a/net/netfilter/nf_conntrack_irc.c |
1241 |
++++ b/net/netfilter/nf_conntrack_irc.c |
1242 |
+@@ -187,8 +187,9 @@ static int help(struct sk_buff *skb, unsigned int protoff, |
1243 |
+ |
1244 |
+ /* dcc_ip can be the internal OR external (NAT'ed) IP */ |
1245 |
+ tuple = &ct->tuplehash[dir].tuple; |
1246 |
+- if (tuple->src.u3.ip != dcc_ip && |
1247 |
+- tuple->dst.u3.ip != dcc_ip) { |
1248 |
++ if ((tuple->src.u3.ip != dcc_ip && |
1249 |
++ ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) || |
1250 |
++ dcc_port == 0) { |
1251 |
+ net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n", |
1252 |
+ &tuple->src.u3.ip, |
1253 |
+ &dcc_ip, dcc_port); |
1254 |
+diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c |
1255 |
+index 04f15e0aeaa8b..9962a49989938 100644 |
1256 |
+--- a/net/sched/sch_sfb.c |
1257 |
++++ b/net/sched/sch_sfb.c |
1258 |
+@@ -139,15 +139,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot, struct sfb_sched_data *q) |
1259 |
+ } |
1260 |
+ } |
1261 |
+ |
1262 |
+-static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_data *q) |
1263 |
++static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_data *q) |
1264 |
+ { |
1265 |
+ u32 sfbhash; |
1266 |
+ |
1267 |
+- sfbhash = sfb_hash(skb, 0); |
1268 |
++ sfbhash = cb->hashes[0]; |
1269 |
+ if (sfbhash) |
1270 |
+ increment_one_qlen(sfbhash, 0, q); |
1271 |
+ |
1272 |
+- sfbhash = sfb_hash(skb, 1); |
1273 |
++ sfbhash = cb->hashes[1]; |
1274 |
+ if (sfbhash) |
1275 |
+ increment_one_qlen(sfbhash, 1, q); |
1276 |
+ } |
1277 |
+@@ -284,8 +284,10 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch, |
1278 |
+ { |
1279 |
+ |
1280 |
+ struct sfb_sched_data *q = qdisc_priv(sch); |
1281 |
++ unsigned int len = qdisc_pkt_len(skb); |
1282 |
+ struct Qdisc *child = q->qdisc; |
1283 |
+ struct tcf_proto *fl; |
1284 |
++ struct sfb_skb_cb cb; |
1285 |
+ int i; |
1286 |
+ u32 p_min = ~0; |
1287 |
+ u32 minqlen = ~0; |
1288 |
+@@ -402,11 +404,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch, |
1289 |
+ } |
1290 |
+ |
1291 |
+ enqueue: |
1292 |
++ memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); |
1293 |
+ ret = qdisc_enqueue(skb, child, to_free); |
1294 |
+ if (likely(ret == NET_XMIT_SUCCESS)) { |
1295 |
+- qdisc_qstats_backlog_inc(sch, skb); |
1296 |
++ sch->qstats.backlog += len; |
1297 |
+ sch->q.qlen++; |
1298 |
+- increment_qlen(skb, q); |
1299 |
++ increment_qlen(&cb, q); |
1300 |
+ } else if (net_xmit_drop_count(ret)) { |
1301 |
+ q->stats.childdrop++; |
1302 |
+ qdisc_qstats_drop(sch); |
1303 |
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c |
1304 |
+index e7d55d63d4f13..7f9b94acf5975 100644 |
1305 |
+--- a/net/sunrpc/xprt.c |
1306 |
++++ b/net/sunrpc/xprt.c |
1307 |
+@@ -1525,9 +1525,9 @@ static void xprt_destroy(struct rpc_xprt *xprt) |
1308 |
+ * is cleared. We use ->transport_lock to ensure the mod_timer() |
1309 |
+ * can only run *before* del_time_sync(), never after. |
1310 |
+ */ |
1311 |
+- spin_lock(&xprt->transport_lock); |
1312 |
++ spin_lock_bh(&xprt->transport_lock); |
1313 |
+ del_timer_sync(&xprt->timer); |
1314 |
+- spin_unlock(&xprt->transport_lock); |
1315 |
++ spin_unlock_bh(&xprt->transport_lock); |
1316 |
+ |
1317 |
+ /* |
1318 |
+ * Destroy sockets etc from the system workqueue so they can |
1319 |
+diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c |
1320 |
+index c6496da9392d7..cf6dd3546c53c 100644 |
1321 |
+--- a/net/tipc/monitor.c |
1322 |
++++ b/net/tipc/monitor.c |
1323 |
+@@ -130,7 +130,7 @@ static void map_set(u64 *up_map, int i, unsigned int v) |
1324 |
+ |
1325 |
+ static int map_get(u64 up_map, int i) |
1326 |
+ { |
1327 |
+- return (up_map & (1 << i)) >> i; |
1328 |
++ return (up_map & (1ULL << i)) >> i; |
1329 |
+ } |
1330 |
+ |
1331 |
+ static struct tipc_peer *peer_prev(struct tipc_peer *peer) |
1332 |
+diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c |
1333 |
+index 30fc6eb352bcc..e6410487e25da 100644 |
1334 |
+--- a/net/wireless/debugfs.c |
1335 |
++++ b/net/wireless/debugfs.c |
1336 |
+@@ -68,9 +68,10 @@ static ssize_t ht40allow_map_read(struct file *file, |
1337 |
+ { |
1338 |
+ struct wiphy *wiphy = file->private_data; |
1339 |
+ char *buf; |
1340 |
+- unsigned int offset = 0, buf_size = PAGE_SIZE, i, r; |
1341 |
++ unsigned int offset = 0, buf_size = PAGE_SIZE, i; |
1342 |
+ enum nl80211_band band; |
1343 |
+ struct ieee80211_supported_band *sband; |
1344 |
++ ssize_t r; |
1345 |
+ |
1346 |
+ buf = kzalloc(buf_size, GFP_KERNEL); |
1347 |
+ if (!buf) |
1348 |
+diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c |
1349 |
+index cdfb8f92d5545..cc8f06638edca 100644 |
1350 |
+--- a/sound/core/seq/oss/seq_oss_midi.c |
1351 |
++++ b/sound/core/seq/oss/seq_oss_midi.c |
1352 |
+@@ -280,7 +280,9 @@ snd_seq_oss_midi_clear_all(void) |
1353 |
+ void |
1354 |
+ snd_seq_oss_midi_setup(struct seq_oss_devinfo *dp) |
1355 |
+ { |
1356 |
++ spin_lock_irq(®ister_lock); |
1357 |
+ dp->max_mididev = max_midi_devs; |
1358 |
++ spin_unlock_irq(®ister_lock); |
1359 |
+ } |
1360 |
+ |
1361 |
+ /* |
1362 |
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c |
1363 |
+index 6fe93d5f6f714..3e9de0baab700 100644 |
1364 |
+--- a/sound/core/seq/seq_clientmgr.c |
1365 |
++++ b/sound/core/seq/seq_clientmgr.c |
1366 |
+@@ -136,13 +136,13 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) |
1367 |
+ spin_unlock_irqrestore(&clients_lock, flags); |
1368 |
+ #ifdef CONFIG_MODULES |
1369 |
+ if (!in_interrupt()) { |
1370 |
+- static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS]; |
1371 |
+- static char card_requested[SNDRV_CARDS]; |
1372 |
++ static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS); |
1373 |
++ static DECLARE_BITMAP(card_requested, SNDRV_CARDS); |
1374 |
++ |
1375 |
+ if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) { |
1376 |
+ int idx; |
1377 |
+ |
1378 |
+- if (!client_requested[clientid]) { |
1379 |
+- client_requested[clientid] = 1; |
1380 |
++ if (!test_and_set_bit(clientid, client_requested)) { |
1381 |
+ for (idx = 0; idx < 15; idx++) { |
1382 |
+ if (seq_client_load[idx] < 0) |
1383 |
+ break; |
1384 |
+@@ -157,10 +157,8 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) |
1385 |
+ int card = (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) / |
1386 |
+ SNDRV_SEQ_CLIENTS_PER_CARD; |
1387 |
+ if (card < snd_ecards_limit) { |
1388 |
+- if (! card_requested[card]) { |
1389 |
+- card_requested[card] = 1; |
1390 |
++ if (!test_and_set_bit(card, card_requested)) |
1391 |
+ snd_request_card(card); |
1392 |
+- } |
1393 |
+ snd_seq_device_load_drivers(); |
1394 |
+ } |
1395 |
+ } |
1396 |
+diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c |
1397 |
+index 8a32a276bd705..1a8a992d8e4a7 100644 |
1398 |
+--- a/sound/drivers/aloop.c |
1399 |
++++ b/sound/drivers/aloop.c |
1400 |
+@@ -477,17 +477,18 @@ static unsigned int loopback_pos_update(struct loopback_cable *cable) |
1401 |
+ cable->streams[SNDRV_PCM_STREAM_PLAYBACK]; |
1402 |
+ struct loopback_pcm *dpcm_capt = |
1403 |
+ cable->streams[SNDRV_PCM_STREAM_CAPTURE]; |
1404 |
+- unsigned long delta_play = 0, delta_capt = 0; |
1405 |
++ unsigned long delta_play = 0, delta_capt = 0, cur_jiffies; |
1406 |
+ unsigned int running, count1, count2; |
1407 |
+ |
1408 |
++ cur_jiffies = jiffies; |
1409 |
+ running = cable->running ^ cable->pause; |
1410 |
+ if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) { |
1411 |
+- delta_play = jiffies - dpcm_play->last_jiffies; |
1412 |
++ delta_play = cur_jiffies - dpcm_play->last_jiffies; |
1413 |
+ dpcm_play->last_jiffies += delta_play; |
1414 |
+ } |
1415 |
+ |
1416 |
+ if (running & (1 << SNDRV_PCM_STREAM_CAPTURE)) { |
1417 |
+- delta_capt = jiffies - dpcm_capt->last_jiffies; |
1418 |
++ delta_capt = cur_jiffies - dpcm_capt->last_jiffies; |
1419 |
+ dpcm_capt->last_jiffies += delta_capt; |
1420 |
+ } |
1421 |
+ |
1422 |
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c |
1423 |
+index 56be1630bd3e6..ee7e4d46e27be 100644 |
1424 |
+--- a/sound/pci/emu10k1/emupcm.c |
1425 |
++++ b/sound/pci/emu10k1/emupcm.c |
1426 |
+@@ -137,7 +137,7 @@ static int snd_emu10k1_pcm_channel_alloc(struct snd_emu10k1_pcm * epcm, int voic |
1427 |
+ epcm->voices[0]->epcm = epcm; |
1428 |
+ if (voices > 1) { |
1429 |
+ for (i = 1; i < voices; i++) { |
1430 |
+- epcm->voices[i] = &epcm->emu->voices[epcm->voices[0]->number + i]; |
1431 |
++ epcm->voices[i] = &epcm->emu->voices[(epcm->voices[0]->number + i) % NUM_G]; |
1432 |
+ epcm->voices[i]->epcm = epcm; |
1433 |
+ } |
1434 |
+ } |
1435 |
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c |
1436 |
+index 7b86bf38f10e7..133a66a7f90e4 100644 |
1437 |
+--- a/sound/usb/stream.c |
1438 |
++++ b/sound/usb/stream.c |
1439 |
+@@ -502,7 +502,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) |
1440 |
+ * Dallas DS4201 workaround: It presents 5 altsettings, but the last |
1441 |
+ * one misses syncpipe, and does not produce any sound. |
1442 |
+ */ |
1443 |
+- if (chip->usb_id == USB_ID(0x04fa, 0x4201)) |
1444 |
++ if (chip->usb_id == USB_ID(0x04fa, 0x4201) && num >= 4) |
1445 |
+ num = 4; |
1446 |
+ |
1447 |
+ for (i = 0; i < num; i++) { |
1448 |
+diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c |
1449 |
+index 5d530c90779e5..6004ae268a800 100644 |
1450 |
+--- a/tools/testing/selftests/bpf/test_align.c |
1451 |
++++ b/tools/testing/selftests/bpf/test_align.c |
1452 |
+@@ -363,15 +363,15 @@ static struct bpf_align_test tests[] = { |
1453 |
+ * is still (4n), fixed offset is not changed. |
1454 |
+ * Also, we create a new reg->id. |
1455 |
+ */ |
1456 |
+- {29, "R5=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"}, |
1457 |
++ {29, "R5=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"}, |
1458 |
+ /* At the time the word size load is performed from R5, |
1459 |
+ * its total fixed offset is NET_IP_ALIGN + reg->off (18) |
1460 |
+ * which is 20. Then the variable offset is (4n), so |
1461 |
+ * the total offset is 4-byte aligned and meets the |
1462 |
+ * load's requirements. |
1463 |
+ */ |
1464 |
+- {33, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc))"}, |
1465 |
+- {33, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc))"}, |
1466 |
++ {33, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"}, |
1467 |
++ {33, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"}, |
1468 |
+ }, |
1469 |
+ }, |
1470 |
+ { |
1471 |
+@@ -414,15 +414,15 @@ static struct bpf_align_test tests[] = { |
1472 |
+ /* Adding 14 makes R6 be (4n+2) */ |
1473 |
+ {9, "R6=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, |
1474 |
+ /* Packet pointer has (4n+2) offset */ |
1475 |
+- {11, "R5=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, |
1476 |
+- {13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, |
1477 |
++ {11, "R5=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"}, |
1478 |
++ {13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"}, |
1479 |
+ /* At the time the word size load is performed from R5, |
1480 |
+ * its total fixed offset is NET_IP_ALIGN + reg->off (0) |
1481 |
+ * which is 2. Then the variable offset is (4n+2), so |
1482 |
+ * the total offset is 4-byte aligned and meets the |
1483 |
+ * load's requirements. |
1484 |
+ */ |
1485 |
+- {15, "R5=pkt(id=1,off=0,r=4,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, |
1486 |
++ {15, "R5=pkt(id=1,off=0,r=4,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"}, |
1487 |
+ /* Newly read value in R6 was shifted left by 2, so has |
1488 |
+ * known alignment of 4. |
1489 |
+ */ |
1490 |
+@@ -430,15 +430,15 @@ static struct bpf_align_test tests[] = { |
1491 |
+ /* Added (4n) to packet pointer's (4n+2) var_off, giving |
1492 |
+ * another (4n+2). |
1493 |
+ */ |
1494 |
+- {19, "R5=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, |
1495 |
+- {21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, |
1496 |
++ {19, "R5=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"}, |
1497 |
++ {21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"}, |
1498 |
+ /* At the time the word size load is performed from R5, |
1499 |
+ * its total fixed offset is NET_IP_ALIGN + reg->off (0) |
1500 |
+ * which is 2. Then the variable offset is (4n+2), so |
1501 |
+ * the total offset is 4-byte aligned and meets the |
1502 |
+ * load's requirements. |
1503 |
+ */ |
1504 |
+- {23, "R5=pkt(id=2,off=0,r=4,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, |
1505 |
++ {23, "R5=pkt(id=2,off=0,r=4,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"}, |
1506 |
+ }, |
1507 |
+ }, |
1508 |
+ { |
1509 |
+@@ -473,11 +473,11 @@ static struct bpf_align_test tests[] = { |
1510 |
+ .matches = { |
1511 |
+ {4, "R5=pkt_end(id=0,off=0,imm=0)"}, |
1512 |
+ /* (ptr - ptr) << 2 == unknown, (4n) */ |
1513 |
+- {6, "R5=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"}, |
1514 |
++ {6, "R5=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc)"}, |
1515 |
+ /* (4n) + 14 == (4n+2). We blow our bounds, because |
1516 |
+ * the add could overflow. |
1517 |
+ */ |
1518 |
+- {7, "R5=inv(id=0,var_off=(0x2; 0xfffffffffffffffc))"}, |
1519 |
++ {7, "R5=inv(id=0,smin_value=-9223372036854775806,smax_value=9223372036854775806,umin_value=2,umax_value=18446744073709551614,var_off=(0x2; 0xfffffffffffffffc)"}, |
1520 |
+ /* Checked s>=0 */ |
1521 |
+ {9, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, |
1522 |
+ /* packet pointer + nonnegative (4n+2) */ |
1523 |
+@@ -532,7 +532,7 @@ static struct bpf_align_test tests[] = { |
1524 |
+ /* New unknown value in R7 is (4n) */ |
1525 |
+ {11, "R7=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, |
1526 |
+ /* Subtracting it from R6 blows our unsigned bounds */ |
1527 |
+- {12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,var_off=(0x2; 0xfffffffffffffffc))"}, |
1528 |
++ {12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,umin_value=2,umax_value=18446744073709551614,var_off=(0x2; 0xfffffffffffffffc)"}, |
1529 |
+ /* Checked s>= 0 */ |
1530 |
+ {14, "R6=inv(id=0,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc))"}, |
1531 |
+ /* At the time the word size load is performed from R5, |
1532 |
+@@ -541,7 +541,8 @@ static struct bpf_align_test tests[] = { |
1533 |
+ * the total offset is 4-byte aligned and meets the |
1534 |
+ * load's requirements. |
1535 |
+ */ |
1536 |
+- {20, "R5=pkt(id=1,off=0,r=4,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc))"}, |
1537 |
++ {20, "R5=pkt(id=1,off=0,r=4,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc)"}, |
1538 |
++ |
1539 |
+ }, |
1540 |
+ }, |
1541 |
+ { |
1542 |
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c |
1543 |
+index 0846345fe1e5c..f7757f7f6d2b9 100644 |
1544 |
+--- a/tools/testing/selftests/bpf/test_verifier.c |
1545 |
++++ b/tools/testing/selftests/bpf/test_verifier.c |
1546 |
+@@ -7438,10 +7438,10 @@ static struct bpf_test tests[] = { |
1547 |
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, |
1548 |
+ offsetof(struct xdp_md, data_end)), |
1549 |
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), |
1550 |
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), |
1551 |
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), |
1552 |
+ BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), |
1553 |
+ BPF_JMP_IMM(BPF_JA, 0, 0, 1), |
1554 |
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), |
1555 |
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), |
1556 |
+ BPF_MOV64_IMM(BPF_REG_0, 0), |
1557 |
+ BPF_EXIT_INSN(), |
1558 |
+ }, |
1559 |
+@@ -7494,10 +7494,10 @@ static struct bpf_test tests[] = { |
1560 |
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, |
1561 |
+ offsetof(struct xdp_md, data_end)), |
1562 |
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), |
1563 |
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), |
1564 |
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), |
1565 |
+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), |
1566 |
+ BPF_JMP_IMM(BPF_JA, 0, 0, 1), |
1567 |
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), |
1568 |
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), |
1569 |
+ BPF_MOV64_IMM(BPF_REG_0, 0), |
1570 |
+ BPF_EXIT_INSN(), |
1571 |
+ }, |
1572 |
+@@ -7603,9 +7603,9 @@ static struct bpf_test tests[] = { |
1573 |
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, |
1574 |
+ offsetof(struct xdp_md, data_end)), |
1575 |
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), |
1576 |
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), |
1577 |
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), |
1578 |
+ BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), |
1579 |
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), |
1580 |
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), |
1581 |
+ BPF_MOV64_IMM(BPF_REG_0, 0), |
1582 |
+ BPF_EXIT_INSN(), |
1583 |
+ }, |
1584 |
+@@ -7770,9 +7770,9 @@ static struct bpf_test tests[] = { |
1585 |
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, |
1586 |
+ offsetof(struct xdp_md, data_end)), |
1587 |
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), |
1588 |
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), |
1589 |
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), |
1590 |
+ BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), |
1591 |
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), |
1592 |
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), |
1593 |
+ BPF_MOV64_IMM(BPF_REG_0, 0), |
1594 |
+ BPF_EXIT_INSN(), |
1595 |
+ }, |