1 |
commit: 76d57db8ac4284bdd3db29f0006317bbb4af219a |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Feb 6 20:51:26 2019 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Feb 6 20:51:26 2019 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=76d57db8 |
7 |
|
8 |
proj/linux-patches: Linux patch 4.4.173 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1172_linux-4.4.173.patch | 1690 ++++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 1694 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index e7ce721..b00cafe 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -731,6 +731,10 @@ Patch: 1171_linux-4.4.172.patch |
21 |
From: http://www.kernel.org |
22 |
Desc: Linux 4.4.172 |
23 |
|
24 |
+Patch: 1172_linux-4.4.173.patch |
25 |
+From: http://www.kernel.org |
26 |
+Desc: Linux 4.4.173 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1172_linux-4.4.173.patch b/1172_linux-4.4.173.patch |
33 |
new file mode 100644 |
34 |
index 0000000..751492b |
35 |
--- /dev/null |
36 |
+++ b/1172_linux-4.4.173.patch |
37 |
@@ -0,0 +1,1690 @@ |
38 |
+diff --git a/Makefile b/Makefile |
39 |
+index 2aa8db459a74..db7665e32da8 100644 |
40 |
+--- a/Makefile |
41 |
++++ b/Makefile |
42 |
+@@ -1,6 +1,6 @@ |
43 |
+ VERSION = 4 |
44 |
+ PATCHLEVEL = 4 |
45 |
+-SUBLEVEL = 172 |
46 |
++SUBLEVEL = 173 |
47 |
+ EXTRAVERSION = |
48 |
+ NAME = Blurry Fish Butt |
49 |
+ |
50 |
+diff --git a/arch/arc/include/asm/perf_event.h b/arch/arc/include/asm/perf_event.h |
51 |
+index 5f071762fb1c..6a2ae61748e4 100644 |
52 |
+--- a/arch/arc/include/asm/perf_event.h |
53 |
++++ b/arch/arc/include/asm/perf_event.h |
54 |
+@@ -103,7 +103,8 @@ static const char * const arc_pmu_ev_hw_map[] = { |
55 |
+ |
56 |
+ /* counts condition */ |
57 |
+ [PERF_COUNT_HW_INSTRUCTIONS] = "iall", |
58 |
+- [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmp", /* Excludes ZOL jumps */ |
59 |
++ /* All jump instructions that are taken */ |
60 |
++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmptak", |
61 |
+ [PERF_COUNT_ARC_BPOK] = "bpok", /* NP-NT, PT-T, PNT-NT */ |
62 |
+ #ifdef CONFIG_ISA_ARCV2 |
63 |
+ [PERF_COUNT_HW_BRANCH_MISSES] = "bpmp", |
64 |
+diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c |
65 |
+index 318394ed5c7a..5e11ad3164e0 100644 |
66 |
+--- a/arch/arm/mach-cns3xxx/pcie.c |
67 |
++++ b/arch/arm/mach-cns3xxx/pcie.c |
68 |
+@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus(struct pci_bus *bus, |
69 |
+ } else /* remote PCI bus */ |
70 |
+ base = cnspci->cfg1_regs + ((busno & 0xf) << 20); |
71 |
+ |
72 |
+- return base + (where & 0xffc) + (devfn << 12); |
73 |
++ return base + where + (devfn << 12); |
74 |
+ } |
75 |
+ |
76 |
+ static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn, |
77 |
+diff --git a/arch/arm64/kernel/hyp-stub.S b/arch/arm64/kernel/hyp-stub.S |
78 |
+index a272f335c289..096e957aecb0 100644 |
79 |
+--- a/arch/arm64/kernel/hyp-stub.S |
80 |
++++ b/arch/arm64/kernel/hyp-stub.S |
81 |
+@@ -26,6 +26,8 @@ |
82 |
+ #include <asm/virt.h> |
83 |
+ |
84 |
+ .text |
85 |
++ .pushsection .hyp.text, "ax" |
86 |
++ |
87 |
+ .align 11 |
88 |
+ |
89 |
+ ENTRY(__hyp_stub_vectors) |
90 |
+diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c |
91 |
+index c26b804015e8..a90615baa529 100644 |
92 |
+--- a/arch/arm64/mm/flush.c |
93 |
++++ b/arch/arm64/mm/flush.c |
94 |
+@@ -70,10 +70,6 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr) |
95 |
+ { |
96 |
+ struct page *page = pte_page(pte); |
97 |
+ |
98 |
+- /* no flushing needed for anonymous pages */ |
99 |
+- if (!page_mapping(page)) |
100 |
+- return; |
101 |
+- |
102 |
+ if (!test_and_set_bit(PG_dcache_clean, &page->flags)) { |
103 |
+ __flush_dcache_area(page_address(page), |
104 |
+ PAGE_SIZE << compound_order(page)); |
105 |
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c |
106 |
+index 8eccead675d4..cc7b450a7766 100644 |
107 |
+--- a/arch/s390/kernel/early.c |
108 |
++++ b/arch/s390/kernel/early.c |
109 |
+@@ -224,10 +224,10 @@ static noinline __init void detect_machine_type(void) |
110 |
+ if (stsi(vmms, 3, 2, 2) || !vmms->count) |
111 |
+ return; |
112 |
+ |
113 |
+- /* Running under KVM? If not we assume z/VM */ |
114 |
++ /* Detect known hypervisors */ |
115 |
+ if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3)) |
116 |
+ S390_lowcore.machine_flags |= MACHINE_FLAG_KVM; |
117 |
+- else |
118 |
++ else if (!memcmp(vmms->vm[0].cpi, "\xa9\x61\xe5\xd4", 4)) |
119 |
+ S390_lowcore.machine_flags |= MACHINE_FLAG_VM; |
120 |
+ } |
121 |
+ |
122 |
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c |
123 |
+index e7a43a30e3ff..47692c78d09c 100644 |
124 |
+--- a/arch/s390/kernel/setup.c |
125 |
++++ b/arch/s390/kernel/setup.c |
126 |
+@@ -833,6 +833,8 @@ void __init setup_arch(char **cmdline_p) |
127 |
+ pr_info("Linux is running under KVM in 64-bit mode\n"); |
128 |
+ else if (MACHINE_IS_LPAR) |
129 |
+ pr_info("Linux is running natively in 64-bit mode\n"); |
130 |
++ else |
131 |
++ pr_info("Linux is running as a guest in 64-bit mode\n"); |
132 |
+ |
133 |
+ /* Have one command line that is parsed and saved in /proc/cmdline */ |
134 |
+ /* boot_command_line has been already set up in early.c */ |
135 |
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c |
136 |
+index 77f4f334a465..29e5409c0d48 100644 |
137 |
+--- a/arch/s390/kernel/smp.c |
138 |
++++ b/arch/s390/kernel/smp.c |
139 |
+@@ -360,9 +360,13 @@ void smp_call_online_cpu(void (*func)(void *), void *data) |
140 |
+ */ |
141 |
+ void smp_call_ipl_cpu(void (*func)(void *), void *data) |
142 |
+ { |
143 |
++ struct _lowcore *lc = pcpu_devices->lowcore; |
144 |
++ |
145 |
++ if (pcpu_devices[0].address == stap()) |
146 |
++ lc = &S390_lowcore; |
147 |
++ |
148 |
+ pcpu_delegate(&pcpu_devices[0], func, data, |
149 |
+- pcpu_devices->lowcore->panic_stack - |
150 |
+- PANIC_FRAME_OFFSET + PAGE_SIZE); |
151 |
++ lc->panic_stack - PANIC_FRAME_OFFSET + PAGE_SIZE); |
152 |
+ } |
153 |
+ |
154 |
+ int smp_find_processor_id(u16 address) |
155 |
+@@ -1152,7 +1156,11 @@ static ssize_t __ref rescan_store(struct device *dev, |
156 |
+ { |
157 |
+ int rc; |
158 |
+ |
159 |
++ rc = lock_device_hotplug_sysfs(); |
160 |
++ if (rc) |
161 |
++ return rc; |
162 |
+ rc = smp_rescan_cpus(); |
163 |
++ unlock_device_hotplug(); |
164 |
+ return rc ? rc : count; |
165 |
+ } |
166 |
+ static DEVICE_ATTR(rescan, 0200, NULL, rescan_store); |
167 |
+diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c |
168 |
+index 31dab2135188..21332b431f10 100644 |
169 |
+--- a/arch/x86/boot/compressed/aslr.c |
170 |
++++ b/arch/x86/boot/compressed/aslr.c |
171 |
+@@ -25,8 +25,8 @@ static inline u16 i8254(void) |
172 |
+ u16 status, timer; |
173 |
+ |
174 |
+ do { |
175 |
+- outb(I8254_PORT_CONTROL, |
176 |
+- I8254_CMD_READBACK | I8254_SELECT_COUNTER0); |
177 |
++ outb(I8254_CMD_READBACK | I8254_SELECT_COUNTER0, |
178 |
++ I8254_PORT_CONTROL); |
179 |
+ status = inb(I8254_PORT_COUNTER0); |
180 |
+ timer = inb(I8254_PORT_COUNTER0); |
181 |
+ timer |= inb(I8254_PORT_COUNTER0) << 8; |
182 |
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c |
183 |
+index 1a934bb8ed1c..758e2b39567d 100644 |
184 |
+--- a/arch/x86/kvm/x86.c |
185 |
++++ b/arch/x86/kvm/x86.c |
186 |
+@@ -5524,8 +5524,7 @@ restart: |
187 |
+ toggle_interruptibility(vcpu, ctxt->interruptibility); |
188 |
+ vcpu->arch.emulate_regs_need_sync_to_vcpu = false; |
189 |
+ kvm_rip_write(vcpu, ctxt->eip); |
190 |
+- if (r == EMULATE_DONE && |
191 |
+- (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP))) |
192 |
++ if (r == EMULATE_DONE && ctxt->tf) |
193 |
+ kvm_vcpu_do_singlestep(vcpu, &r); |
194 |
+ if (!ctxt->have_exception || |
195 |
+ exception_type(ctxt->exception.vector) == EXCPT_TRAP) |
196 |
+diff --git a/drivers/base/core.c b/drivers/base/core.c |
197 |
+index 049ccc070ce5..cb5718d2669e 100644 |
198 |
+--- a/drivers/base/core.c |
199 |
++++ b/drivers/base/core.c |
200 |
+@@ -862,6 +862,8 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) |
201 |
+ return; |
202 |
+ |
203 |
+ mutex_lock(&gdp_mutex); |
204 |
++ if (!kobject_has_children(glue_dir)) |
205 |
++ kobject_del(glue_dir); |
206 |
+ kobject_put(glue_dir); |
207 |
+ mutex_unlock(&gdp_mutex); |
208 |
+ } |
209 |
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c |
210 |
+index b1cf891cb3d9..ae361ee90587 100644 |
211 |
+--- a/drivers/block/loop.c |
212 |
++++ b/drivers/block/loop.c |
213 |
+@@ -81,6 +81,7 @@ |
214 |
+ #include <asm/uaccess.h> |
215 |
+ |
216 |
+ static DEFINE_IDR(loop_index_idr); |
217 |
++static DEFINE_MUTEX(loop_index_mutex); |
218 |
+ static DEFINE_MUTEX(loop_ctl_mutex); |
219 |
+ |
220 |
+ static int max_part; |
221 |
+@@ -1570,11 +1571,9 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, |
222 |
+ static int lo_open(struct block_device *bdev, fmode_t mode) |
223 |
+ { |
224 |
+ struct loop_device *lo; |
225 |
+- int err; |
226 |
++ int err = 0; |
227 |
+ |
228 |
+- err = mutex_lock_killable(&loop_ctl_mutex); |
229 |
+- if (err) |
230 |
+- return err; |
231 |
++ mutex_lock(&loop_index_mutex); |
232 |
+ lo = bdev->bd_disk->private_data; |
233 |
+ if (!lo) { |
234 |
+ err = -ENXIO; |
235 |
+@@ -1583,20 +1582,18 @@ static int lo_open(struct block_device *bdev, fmode_t mode) |
236 |
+ |
237 |
+ atomic_inc(&lo->lo_refcnt); |
238 |
+ out: |
239 |
+- mutex_unlock(&loop_ctl_mutex); |
240 |
++ mutex_unlock(&loop_index_mutex); |
241 |
+ return err; |
242 |
+ } |
243 |
+ |
244 |
+-static void lo_release(struct gendisk *disk, fmode_t mode) |
245 |
++static void __lo_release(struct loop_device *lo) |
246 |
+ { |
247 |
+- struct loop_device *lo; |
248 |
+ int err; |
249 |
+ |
250 |
+- mutex_lock(&loop_ctl_mutex); |
251 |
+- lo = disk->private_data; |
252 |
+ if (atomic_dec_return(&lo->lo_refcnt)) |
253 |
+- goto out_unlock; |
254 |
++ return; |
255 |
+ |
256 |
++ mutex_lock(&loop_ctl_mutex); |
257 |
+ if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) { |
258 |
+ /* |
259 |
+ * In autoclear mode, stop the loop thread |
260 |
+@@ -1613,10 +1610,16 @@ static void lo_release(struct gendisk *disk, fmode_t mode) |
261 |
+ loop_flush(lo); |
262 |
+ } |
263 |
+ |
264 |
+-out_unlock: |
265 |
+ mutex_unlock(&loop_ctl_mutex); |
266 |
+ } |
267 |
+ |
268 |
++static void lo_release(struct gendisk *disk, fmode_t mode) |
269 |
++{ |
270 |
++ mutex_lock(&loop_index_mutex); |
271 |
++ __lo_release(disk->private_data); |
272 |
++ mutex_unlock(&loop_index_mutex); |
273 |
++} |
274 |
++ |
275 |
+ static const struct block_device_operations lo_fops = { |
276 |
+ .owner = THIS_MODULE, |
277 |
+ .open = lo_open, |
278 |
+@@ -1896,7 +1899,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) |
279 |
+ struct kobject *kobj; |
280 |
+ int err; |
281 |
+ |
282 |
+- mutex_lock(&loop_ctl_mutex); |
283 |
++ mutex_lock(&loop_index_mutex); |
284 |
+ err = loop_lookup(&lo, MINOR(dev) >> part_shift); |
285 |
+ if (err < 0) |
286 |
+ err = loop_add(&lo, MINOR(dev) >> part_shift); |
287 |
+@@ -1904,7 +1907,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) |
288 |
+ kobj = NULL; |
289 |
+ else |
290 |
+ kobj = get_disk(lo->lo_disk); |
291 |
+- mutex_unlock(&loop_ctl_mutex); |
292 |
++ mutex_unlock(&loop_index_mutex); |
293 |
+ |
294 |
+ *part = 0; |
295 |
+ return kobj; |
296 |
+@@ -1914,13 +1917,9 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, |
297 |
+ unsigned long parm) |
298 |
+ { |
299 |
+ struct loop_device *lo; |
300 |
+- int ret; |
301 |
+- |
302 |
+- ret = mutex_lock_killable(&loop_ctl_mutex); |
303 |
+- if (ret) |
304 |
+- return ret; |
305 |
++ int ret = -ENOSYS; |
306 |
+ |
307 |
+- ret = -ENOSYS; |
308 |
++ mutex_lock(&loop_index_mutex); |
309 |
+ switch (cmd) { |
310 |
+ case LOOP_CTL_ADD: |
311 |
+ ret = loop_lookup(&lo, parm); |
312 |
+@@ -1934,15 +1933,19 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, |
313 |
+ ret = loop_lookup(&lo, parm); |
314 |
+ if (ret < 0) |
315 |
+ break; |
316 |
++ mutex_lock(&loop_ctl_mutex); |
317 |
+ if (lo->lo_state != Lo_unbound) { |
318 |
+ ret = -EBUSY; |
319 |
++ mutex_unlock(&loop_ctl_mutex); |
320 |
+ break; |
321 |
+ } |
322 |
+ if (atomic_read(&lo->lo_refcnt) > 0) { |
323 |
+ ret = -EBUSY; |
324 |
++ mutex_unlock(&loop_ctl_mutex); |
325 |
+ break; |
326 |
+ } |
327 |
+ lo->lo_disk->private_data = NULL; |
328 |
++ mutex_unlock(&loop_ctl_mutex); |
329 |
+ idr_remove(&loop_index_idr, lo->lo_number); |
330 |
+ loop_remove(lo); |
331 |
+ break; |
332 |
+@@ -1952,7 +1955,7 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, |
333 |
+ break; |
334 |
+ ret = loop_add(&lo, -1); |
335 |
+ } |
336 |
+- mutex_unlock(&loop_ctl_mutex); |
337 |
++ mutex_unlock(&loop_index_mutex); |
338 |
+ |
339 |
+ return ret; |
340 |
+ } |
341 |
+@@ -2035,10 +2038,10 @@ static int __init loop_init(void) |
342 |
+ THIS_MODULE, loop_probe, NULL, NULL); |
343 |
+ |
344 |
+ /* pre-create number of devices given by config or max_loop */ |
345 |
+- mutex_lock(&loop_ctl_mutex); |
346 |
++ mutex_lock(&loop_index_mutex); |
347 |
+ for (i = 0; i < nr; i++) |
348 |
+ loop_add(&lo, i); |
349 |
+- mutex_unlock(&loop_ctl_mutex); |
350 |
++ mutex_unlock(&loop_index_mutex); |
351 |
+ |
352 |
+ printk(KERN_INFO "loop: module loaded\n"); |
353 |
+ return 0; |
354 |
+diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c |
355 |
+index 164544afd680..618f3df6c3b9 100644 |
356 |
+--- a/drivers/char/mwave/mwavedd.c |
357 |
++++ b/drivers/char/mwave/mwavedd.c |
358 |
+@@ -59,6 +59,7 @@ |
359 |
+ #include <linux/mutex.h> |
360 |
+ #include <linux/delay.h> |
361 |
+ #include <linux/serial_8250.h> |
362 |
++#include <linux/nospec.h> |
363 |
+ #include "smapi.h" |
364 |
+ #include "mwavedd.h" |
365 |
+ #include "3780i.h" |
366 |
+@@ -289,6 +290,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd, |
367 |
+ ipcnum); |
368 |
+ return -EINVAL; |
369 |
+ } |
370 |
++ ipcnum = array_index_nospec(ipcnum, |
371 |
++ ARRAY_SIZE(pDrvData->IPCs)); |
372 |
+ PRINTK_3(TRACE_MWAVE, |
373 |
+ "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC" |
374 |
+ " ipcnum %x entry usIntCount %x\n", |
375 |
+@@ -317,6 +320,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd, |
376 |
+ " Invalid ipcnum %x\n", ipcnum); |
377 |
+ return -EINVAL; |
378 |
+ } |
379 |
++ ipcnum = array_index_nospec(ipcnum, |
380 |
++ ARRAY_SIZE(pDrvData->IPCs)); |
381 |
+ PRINTK_3(TRACE_MWAVE, |
382 |
+ "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC" |
383 |
+ " ipcnum %x, usIntCount %x\n", |
384 |
+@@ -383,6 +388,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd, |
385 |
+ ipcnum); |
386 |
+ return -EINVAL; |
387 |
+ } |
388 |
++ ipcnum = array_index_nospec(ipcnum, |
389 |
++ ARRAY_SIZE(pDrvData->IPCs)); |
390 |
+ mutex_lock(&mwave_mutex); |
391 |
+ if (pDrvData->IPCs[ipcnum].bIsEnabled == TRUE) { |
392 |
+ pDrvData->IPCs[ipcnum].bIsEnabled = FALSE; |
393 |
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c |
394 |
+index f55dcdf99bc5..26476a64e663 100644 |
395 |
+--- a/drivers/input/joystick/xpad.c |
396 |
++++ b/drivers/input/joystick/xpad.c |
397 |
+@@ -255,6 +255,8 @@ static const struct xpad_device { |
398 |
+ { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX }, |
399 |
+ { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX }, |
400 |
+ { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX }, |
401 |
++ { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, |
402 |
++ { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, |
403 |
+ { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, |
404 |
+ { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, |
405 |
+ { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 }, |
406 |
+@@ -431,6 +433,7 @@ static const struct usb_device_id xpad_table[] = { |
407 |
+ XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */ |
408 |
+ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */ |
409 |
+ XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ |
410 |
++ XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */ |
411 |
+ XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ |
412 |
+ XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */ |
413 |
+ XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */ |
414 |
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c |
415 |
+index c3d7a1461043..114d5883d497 100644 |
416 |
+--- a/drivers/irqchip/irq-gic-v3-its.c |
417 |
++++ b/drivers/irqchip/irq-gic-v3-its.c |
418 |
+@@ -1230,13 +1230,14 @@ static void its_free_device(struct its_device *its_dev) |
419 |
+ kfree(its_dev); |
420 |
+ } |
421 |
+ |
422 |
+-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq) |
423 |
++static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq) |
424 |
+ { |
425 |
+ int idx; |
426 |
+ |
427 |
+- idx = find_first_zero_bit(dev->event_map.lpi_map, |
428 |
+- dev->event_map.nr_lpis); |
429 |
+- if (idx == dev->event_map.nr_lpis) |
430 |
++ idx = bitmap_find_free_region(dev->event_map.lpi_map, |
431 |
++ dev->event_map.nr_lpis, |
432 |
++ get_count_order(nvecs)); |
433 |
++ if (idx < 0) |
434 |
+ return -ENOSPC; |
435 |
+ |
436 |
+ *hwirq = dev->event_map.lpi_base + idx; |
437 |
+@@ -1317,20 +1318,20 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, |
438 |
+ int err; |
439 |
+ int i; |
440 |
+ |
441 |
+- for (i = 0; i < nr_irqs; i++) { |
442 |
+- err = its_alloc_device_irq(its_dev, &hwirq); |
443 |
+- if (err) |
444 |
+- return err; |
445 |
++ err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq); |
446 |
++ if (err) |
447 |
++ return err; |
448 |
+ |
449 |
+- err = its_irq_gic_domain_alloc(domain, virq + i, hwirq); |
450 |
++ for (i = 0; i < nr_irqs; i++) { |
451 |
++ err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i); |
452 |
+ if (err) |
453 |
+ return err; |
454 |
+ |
455 |
+ irq_domain_set_hwirq_and_chip(domain, virq + i, |
456 |
+- hwirq, &its_irq_chip, its_dev); |
457 |
++ hwirq + i, &its_irq_chip, its_dev); |
458 |
+ pr_debug("ID:%d pID:%d vID:%d\n", |
459 |
+- (int)(hwirq - its_dev->event_map.lpi_base), |
460 |
+- (int) hwirq, virq + i); |
461 |
++ (int)(hwirq + i - its_dev->event_map.lpi_base), |
462 |
++ (int)(hwirq + i), virq + i); |
463 |
+ } |
464 |
+ |
465 |
+ return 0; |
466 |
+diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c |
467 |
+index ffd448149796..4a2ae06d0da4 100644 |
468 |
+--- a/drivers/mmc/host/sdhci-iproc.c |
469 |
++++ b/drivers/mmc/host/sdhci-iproc.c |
470 |
+@@ -217,7 +217,10 @@ static int sdhci_iproc_probe(struct platform_device *pdev) |
471 |
+ |
472 |
+ iproc_host->data = iproc_data; |
473 |
+ |
474 |
+- mmc_of_parse(host->mmc); |
475 |
++ ret = mmc_of_parse(host->mmc); |
476 |
++ if (ret) |
477 |
++ goto err; |
478 |
++ |
479 |
+ sdhci_get_of_property(pdev); |
480 |
+ |
481 |
+ /* Enable EMMC 1/8V DDR capable */ |
482 |
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c |
483 |
+index 1dbee1cb3df9..8b7c6425b681 100644 |
484 |
+--- a/drivers/net/can/dev.c |
485 |
++++ b/drivers/net/can/dev.c |
486 |
+@@ -426,8 +426,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb); |
487 |
+ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr) |
488 |
+ { |
489 |
+ struct can_priv *priv = netdev_priv(dev); |
490 |
+- struct sk_buff *skb = priv->echo_skb[idx]; |
491 |
+- struct canfd_frame *cf; |
492 |
+ |
493 |
+ if (idx >= priv->echo_skb_max) { |
494 |
+ netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", |
495 |
+@@ -435,20 +433,21 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 |
496 |
+ return NULL; |
497 |
+ } |
498 |
+ |
499 |
+- if (!skb) { |
500 |
+- netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n", |
501 |
+- __func__, idx); |
502 |
+- return NULL; |
503 |
+- } |
504 |
++ if (priv->echo_skb[idx]) { |
505 |
++ /* Using "struct canfd_frame::len" for the frame |
506 |
++ * length is supported on both CAN and CANFD frames. |
507 |
++ */ |
508 |
++ struct sk_buff *skb = priv->echo_skb[idx]; |
509 |
++ struct canfd_frame *cf = (struct canfd_frame *)skb->data; |
510 |
++ u8 len = cf->len; |
511 |
++ |
512 |
++ *len_ptr = len; |
513 |
++ priv->echo_skb[idx] = NULL; |
514 |
+ |
515 |
+- /* Using "struct canfd_frame::len" for the frame |
516 |
+- * length is supported on both CAN and CANFD frames. |
517 |
+- */ |
518 |
+- cf = (struct canfd_frame *)skb->data; |
519 |
+- *len_ptr = cf->len; |
520 |
+- priv->echo_skb[idx] = NULL; |
521 |
++ return skb; |
522 |
++ } |
523 |
+ |
524 |
+- return skb; |
525 |
++ return NULL; |
526 |
+ } |
527 |
+ |
528 |
+ /* |
529 |
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c |
530 |
+index 650f7888e32b..55ac00055977 100644 |
531 |
+--- a/drivers/net/ethernet/freescale/ucc_geth.c |
532 |
++++ b/drivers/net/ethernet/freescale/ucc_geth.c |
533 |
+@@ -1888,6 +1888,8 @@ static void ucc_geth_free_tx(struct ucc_geth_private *ugeth) |
534 |
+ u16 i, j; |
535 |
+ u8 __iomem *bd; |
536 |
+ |
537 |
++ netdev_reset_queue(ugeth->ndev); |
538 |
++ |
539 |
+ ug_info = ugeth->ug_info; |
540 |
+ uf_info = &ug_info->uf_info; |
541 |
+ |
542 |
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c |
543 |
+index 90db94e83fde..033f99d2f15c 100644 |
544 |
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c |
545 |
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c |
546 |
+@@ -1906,9 +1906,11 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev, |
547 |
+ { |
548 |
+ struct mlx4_cmd_mailbox *mailbox; |
549 |
+ __be32 *outbox; |
550 |
++ u64 qword_field; |
551 |
+ u32 dword_field; |
552 |
+- int err; |
553 |
++ u16 word_field; |
554 |
+ u8 byte_field; |
555 |
++ int err; |
556 |
+ static const u8 a0_dmfs_query_hw_steering[] = { |
557 |
+ [0] = MLX4_STEERING_DMFS_A0_DEFAULT, |
558 |
+ [1] = MLX4_STEERING_DMFS_A0_DYNAMIC, |
559 |
+@@ -1936,19 +1938,32 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev, |
560 |
+ |
561 |
+ /* QPC/EEC/CQC/EQC/RDMARC attributes */ |
562 |
+ |
563 |
+- MLX4_GET(param->qpc_base, outbox, INIT_HCA_QPC_BASE_OFFSET); |
564 |
+- MLX4_GET(param->log_num_qps, outbox, INIT_HCA_LOG_QP_OFFSET); |
565 |
+- MLX4_GET(param->srqc_base, outbox, INIT_HCA_SRQC_BASE_OFFSET); |
566 |
+- MLX4_GET(param->log_num_srqs, outbox, INIT_HCA_LOG_SRQ_OFFSET); |
567 |
+- MLX4_GET(param->cqc_base, outbox, INIT_HCA_CQC_BASE_OFFSET); |
568 |
+- MLX4_GET(param->log_num_cqs, outbox, INIT_HCA_LOG_CQ_OFFSET); |
569 |
+- MLX4_GET(param->altc_base, outbox, INIT_HCA_ALTC_BASE_OFFSET); |
570 |
+- MLX4_GET(param->auxc_base, outbox, INIT_HCA_AUXC_BASE_OFFSET); |
571 |
+- MLX4_GET(param->eqc_base, outbox, INIT_HCA_EQC_BASE_OFFSET); |
572 |
+- MLX4_GET(param->log_num_eqs, outbox, INIT_HCA_LOG_EQ_OFFSET); |
573 |
+- MLX4_GET(param->num_sys_eqs, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET); |
574 |
+- MLX4_GET(param->rdmarc_base, outbox, INIT_HCA_RDMARC_BASE_OFFSET); |
575 |
+- MLX4_GET(param->log_rd_per_qp, outbox, INIT_HCA_LOG_RD_OFFSET); |
576 |
++ MLX4_GET(qword_field, outbox, INIT_HCA_QPC_BASE_OFFSET); |
577 |
++ param->qpc_base = qword_field & ~((u64)0x1f); |
578 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_QP_OFFSET); |
579 |
++ param->log_num_qps = byte_field & 0x1f; |
580 |
++ MLX4_GET(qword_field, outbox, INIT_HCA_SRQC_BASE_OFFSET); |
581 |
++ param->srqc_base = qword_field & ~((u64)0x1f); |
582 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_SRQ_OFFSET); |
583 |
++ param->log_num_srqs = byte_field & 0x1f; |
584 |
++ MLX4_GET(qword_field, outbox, INIT_HCA_CQC_BASE_OFFSET); |
585 |
++ param->cqc_base = qword_field & ~((u64)0x1f); |
586 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_CQ_OFFSET); |
587 |
++ param->log_num_cqs = byte_field & 0x1f; |
588 |
++ MLX4_GET(qword_field, outbox, INIT_HCA_ALTC_BASE_OFFSET); |
589 |
++ param->altc_base = qword_field; |
590 |
++ MLX4_GET(qword_field, outbox, INIT_HCA_AUXC_BASE_OFFSET); |
591 |
++ param->auxc_base = qword_field; |
592 |
++ MLX4_GET(qword_field, outbox, INIT_HCA_EQC_BASE_OFFSET); |
593 |
++ param->eqc_base = qword_field & ~((u64)0x1f); |
594 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_EQ_OFFSET); |
595 |
++ param->log_num_eqs = byte_field & 0x1f; |
596 |
++ MLX4_GET(word_field, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET); |
597 |
++ param->num_sys_eqs = word_field & 0xfff; |
598 |
++ MLX4_GET(qword_field, outbox, INIT_HCA_RDMARC_BASE_OFFSET); |
599 |
++ param->rdmarc_base = qword_field & ~((u64)0x1f); |
600 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_RD_OFFSET); |
601 |
++ param->log_rd_per_qp = byte_field & 0x7; |
602 |
+ |
603 |
+ MLX4_GET(dword_field, outbox, INIT_HCA_FLAGS_OFFSET); |
604 |
+ if (dword_field & (1 << INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN)) { |
605 |
+@@ -1967,22 +1982,21 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev, |
606 |
+ /* steering attributes */ |
607 |
+ if (param->steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) { |
608 |
+ MLX4_GET(param->mc_base, outbox, INIT_HCA_FS_BASE_OFFSET); |
609 |
+- MLX4_GET(param->log_mc_entry_sz, outbox, |
610 |
+- INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET); |
611 |
+- MLX4_GET(param->log_mc_table_sz, outbox, |
612 |
+- INIT_HCA_FS_LOG_TABLE_SZ_OFFSET); |
613 |
+- MLX4_GET(byte_field, outbox, |
614 |
+- INIT_HCA_FS_A0_OFFSET); |
615 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET); |
616 |
++ param->log_mc_entry_sz = byte_field & 0x1f; |
617 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_TABLE_SZ_OFFSET); |
618 |
++ param->log_mc_table_sz = byte_field & 0x1f; |
619 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_FS_A0_OFFSET); |
620 |
+ param->dmfs_high_steer_mode = |
621 |
+ a0_dmfs_query_hw_steering[(byte_field >> 6) & 3]; |
622 |
+ } else { |
623 |
+ MLX4_GET(param->mc_base, outbox, INIT_HCA_MC_BASE_OFFSET); |
624 |
+- MLX4_GET(param->log_mc_entry_sz, outbox, |
625 |
+- INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET); |
626 |
+- MLX4_GET(param->log_mc_hash_sz, outbox, |
627 |
+- INIT_HCA_LOG_MC_HASH_SZ_OFFSET); |
628 |
+- MLX4_GET(param->log_mc_table_sz, outbox, |
629 |
+- INIT_HCA_LOG_MC_TABLE_SZ_OFFSET); |
630 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET); |
631 |
++ param->log_mc_entry_sz = byte_field & 0x1f; |
632 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_HASH_SZ_OFFSET); |
633 |
++ param->log_mc_hash_sz = byte_field & 0x1f; |
634 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_TABLE_SZ_OFFSET); |
635 |
++ param->log_mc_table_sz = byte_field & 0x1f; |
636 |
+ } |
637 |
+ |
638 |
+ /* CX3 is capable of extending CQEs/EQEs from 32 to 64 bytes */ |
639 |
+@@ -2006,15 +2020,18 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev, |
640 |
+ /* TPT attributes */ |
641 |
+ |
642 |
+ MLX4_GET(param->dmpt_base, outbox, INIT_HCA_DMPT_BASE_OFFSET); |
643 |
+- MLX4_GET(param->mw_enabled, outbox, INIT_HCA_TPT_MW_OFFSET); |
644 |
+- MLX4_GET(param->log_mpt_sz, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET); |
645 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_TPT_MW_OFFSET); |
646 |
++ param->mw_enabled = byte_field >> 7; |
647 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET); |
648 |
++ param->log_mpt_sz = byte_field & 0x3f; |
649 |
+ MLX4_GET(param->mtt_base, outbox, INIT_HCA_MTT_BASE_OFFSET); |
650 |
+ MLX4_GET(param->cmpt_base, outbox, INIT_HCA_CMPT_BASE_OFFSET); |
651 |
+ |
652 |
+ /* UAR attributes */ |
653 |
+ |
654 |
+ MLX4_GET(param->uar_page_sz, outbox, INIT_HCA_UAR_PAGE_SZ_OFFSET); |
655 |
+- MLX4_GET(param->log_uar_sz, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET); |
656 |
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET); |
657 |
++ param->log_uar_sz = byte_field & 0xf; |
658 |
+ |
659 |
+ /* phv_check enable */ |
660 |
+ MLX4_GET(byte_field, outbox, INIT_HCA_CACHELINE_SZ_OFFSET); |
661 |
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c |
662 |
+index 583d50f80b24..02327e6c4819 100644 |
663 |
+--- a/drivers/net/ppp/pppoe.c |
664 |
++++ b/drivers/net/ppp/pppoe.c |
665 |
+@@ -442,6 +442,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, |
666 |
+ if (pskb_trim_rcsum(skb, len)) |
667 |
+ goto drop; |
668 |
+ |
669 |
++ ph = pppoe_hdr(skb); |
670 |
+ pn = pppoe_pernet(dev_net(dev)); |
671 |
+ |
672 |
+ /* Note that get_item does a sock_hold(), so sk_pppox(po) |
673 |
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c |
674 |
+index 852d2de7f69f..a284a2b42bcd 100644 |
675 |
+--- a/drivers/platform/x86/asus-nb-wmi.c |
676 |
++++ b/drivers/platform/x86/asus-nb-wmi.c |
677 |
+@@ -339,8 +339,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { |
678 |
+ { KE_KEY, 0x30, { KEY_VOLUMEUP } }, |
679 |
+ { KE_KEY, 0x31, { KEY_VOLUMEDOWN } }, |
680 |
+ { KE_KEY, 0x32, { KEY_MUTE } }, |
681 |
+- { KE_KEY, 0x33, { KEY_DISPLAYTOGGLE } }, /* LCD on */ |
682 |
+- { KE_KEY, 0x34, { KEY_DISPLAY_OFF } }, /* LCD off */ |
683 |
++ { KE_KEY, 0x35, { KEY_SCREENLOCK } }, |
684 |
+ { KE_KEY, 0x40, { KEY_PREVIOUSSONG } }, |
685 |
+ { KE_KEY, 0x41, { KEY_NEXTSONG } }, |
686 |
+ { KE_KEY, 0x43, { KEY_STOPCD } }, /* Stop/Eject */ |
687 |
+diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c |
688 |
+index 944156207477..dcb949dcfa66 100644 |
689 |
+--- a/drivers/s390/char/sclp_config.c |
690 |
++++ b/drivers/s390/char/sclp_config.c |
691 |
+@@ -43,7 +43,9 @@ static void sclp_cpu_capability_notify(struct work_struct *work) |
692 |
+ |
693 |
+ static void __ref sclp_cpu_change_notify(struct work_struct *work) |
694 |
+ { |
695 |
++ lock_device_hotplug(); |
696 |
+ smp_rescan_cpus(); |
697 |
++ unlock_device_hotplug(); |
698 |
+ } |
699 |
+ |
700 |
+ static void sclp_conf_receiver_fn(struct evbuf_header *evbuf) |
701 |
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c |
702 |
+index c2d2c17550a7..951f22265105 100644 |
703 |
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c |
704 |
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c |
705 |
+@@ -47,6 +47,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { |
706 |
+ {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ |
707 |
+ {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ |
708 |
+ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ |
709 |
++ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ |
710 |
+ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ |
711 |
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ |
712 |
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ |
713 |
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c |
714 |
+index 6d1e2f746ab4..8d6253903f24 100644 |
715 |
+--- a/drivers/tty/n_hdlc.c |
716 |
++++ b/drivers/tty/n_hdlc.c |
717 |
+@@ -598,6 +598,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, |
718 |
+ /* too large for caller's buffer */ |
719 |
+ ret = -EOVERFLOW; |
720 |
+ } else { |
721 |
++ __set_current_state(TASK_RUNNING); |
722 |
+ if (copy_to_user(buf, rbuf->buf, rbuf->count)) |
723 |
+ ret = -EFAULT; |
724 |
+ else |
725 |
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c |
726 |
+index c1cff2b455ae..5b86ebc76a8a 100644 |
727 |
+--- a/drivers/tty/tty_io.c |
728 |
++++ b/drivers/tty/tty_io.c |
729 |
+@@ -2297,7 +2297,8 @@ static int tiocsti(struct tty_struct *tty, char __user *p) |
730 |
+ return -EFAULT; |
731 |
+ tty_audit_tiocsti(tty, ch); |
732 |
+ ld = tty_ldisc_ref_wait(tty); |
733 |
+- ld->ops->receive_buf(tty, &ch, &mbz, 1); |
734 |
++ if (ld->ops->receive_buf) |
735 |
++ ld->ops->receive_buf(tty, &ch, &mbz, 1); |
736 |
+ tty_ldisc_deref(ld); |
737 |
+ return 0; |
738 |
+ } |
739 |
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c |
740 |
+index ff3286fc22d8..6779f733bb83 100644 |
741 |
+--- a/drivers/tty/vt/vt.c |
742 |
++++ b/drivers/tty/vt/vt.c |
743 |
+@@ -958,6 +958,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, |
744 |
+ if (CON_IS_VISIBLE(vc)) |
745 |
+ update_screen(vc); |
746 |
+ vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num); |
747 |
++ notify_update(vc); |
748 |
+ return err; |
749 |
+ } |
750 |
+ |
751 |
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c |
752 |
+index 4966768d3c98..9706d214c409 100644 |
753 |
+--- a/drivers/usb/serial/pl2303.c |
754 |
++++ b/drivers/usb/serial/pl2303.c |
755 |
+@@ -47,6 +47,7 @@ static const struct usb_device_id id_table[] = { |
756 |
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) }, |
757 |
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, |
758 |
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) }, |
759 |
++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) }, |
760 |
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, |
761 |
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, |
762 |
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, |
763 |
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h |
764 |
+index a84f0959ab34..d84c3b3d477b 100644 |
765 |
+--- a/drivers/usb/serial/pl2303.h |
766 |
++++ b/drivers/usb/serial/pl2303.h |
767 |
+@@ -13,6 +13,7 @@ |
768 |
+ |
769 |
+ #define PL2303_VENDOR_ID 0x067b |
770 |
+ #define PL2303_PRODUCT_ID 0x2303 |
771 |
++#define PL2303_PRODUCT_ID_TB 0x2304 |
772 |
+ #define PL2303_PRODUCT_ID_RSAQ2 0x04bb |
773 |
+ #define PL2303_PRODUCT_ID_DCU11 0x1234 |
774 |
+ #define PL2303_PRODUCT_ID_PHAROS 0xaaa0 |
775 |
+@@ -25,6 +26,7 @@ |
776 |
+ #define PL2303_PRODUCT_ID_MOTOROLA 0x0307 |
777 |
+ #define PL2303_PRODUCT_ID_ZTEK 0xe1f1 |
778 |
+ |
779 |
++ |
780 |
+ #define ATEN_VENDOR_ID 0x0557 |
781 |
+ #define ATEN_VENDOR_ID2 0x0547 |
782 |
+ #define ATEN_PRODUCT_ID 0x2008 |
783 |
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c |
784 |
+index 6d6acf2c07c3..511242111403 100644 |
785 |
+--- a/drivers/usb/serial/usb-serial-simple.c |
786 |
++++ b/drivers/usb/serial/usb-serial-simple.c |
787 |
+@@ -88,7 +88,8 @@ DEVICE(moto_modem, MOTO_IDS); |
788 |
+ /* Motorola Tetra driver */ |
789 |
+ #define MOTOROLA_TETRA_IDS() \ |
790 |
+ { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \ |
791 |
+- { USB_DEVICE(0x0cad, 0x9012) } /* MTP6550 */ |
792 |
++ { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \ |
793 |
++ { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ |
794 |
+ DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); |
795 |
+ |
796 |
+ /* Novatel Wireless GPS driver */ |
797 |
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c |
798 |
+index 1eeb4780c3ed..eacf57c24ca9 100644 |
799 |
+--- a/fs/cifs/connect.c |
800 |
++++ b/fs/cifs/connect.c |
801 |
+@@ -48,6 +48,7 @@ |
802 |
+ #include "cifs_unicode.h" |
803 |
+ #include "cifs_debug.h" |
804 |
+ #include "cifs_fs_sb.h" |
805 |
++#include "dns_resolve.h" |
806 |
+ #include "ntlmssp.h" |
807 |
+ #include "nterr.h" |
808 |
+ #include "rfc1002pdu.h" |
809 |
+@@ -303,6 +304,53 @@ static void cifs_prune_tlinks(struct work_struct *work); |
810 |
+ static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data, |
811 |
+ const char *devname); |
812 |
+ |
813 |
++/* |
814 |
++ * Resolve hostname and set ip addr in tcp ses. Useful for hostnames that may |
815 |
++ * get their ip addresses changed at some point. |
816 |
++ * |
817 |
++ * This should be called with server->srv_mutex held. |
818 |
++ */ |
819 |
++#ifdef CONFIG_CIFS_DFS_UPCALL |
820 |
++static int reconn_set_ipaddr(struct TCP_Server_Info *server) |
821 |
++{ |
822 |
++ int rc; |
823 |
++ int len; |
824 |
++ char *unc, *ipaddr = NULL; |
825 |
++ |
826 |
++ if (!server->hostname) |
827 |
++ return -EINVAL; |
828 |
++ |
829 |
++ len = strlen(server->hostname) + 3; |
830 |
++ |
831 |
++ unc = kmalloc(len, GFP_KERNEL); |
832 |
++ if (!unc) { |
833 |
++ cifs_dbg(FYI, "%s: failed to create UNC path\n", __func__); |
834 |
++ return -ENOMEM; |
835 |
++ } |
836 |
++ snprintf(unc, len, "\\\\%s", server->hostname); |
837 |
++ |
838 |
++ rc = dns_resolve_server_name_to_ip(unc, &ipaddr); |
839 |
++ kfree(unc); |
840 |
++ |
841 |
++ if (rc < 0) { |
842 |
++ cifs_dbg(FYI, "%s: failed to resolve server part of %s to IP: %d\n", |
843 |
++ __func__, server->hostname, rc); |
844 |
++ return rc; |
845 |
++ } |
846 |
++ |
847 |
++ rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr, |
848 |
++ strlen(ipaddr)); |
849 |
++ kfree(ipaddr); |
850 |
++ |
851 |
++ return !rc ? -1 : 0; |
852 |
++} |
853 |
++#else |
854 |
++static inline int reconn_set_ipaddr(struct TCP_Server_Info *server) |
855 |
++{ |
856 |
++ return 0; |
857 |
++} |
858 |
++#endif |
859 |
++ |
860 |
+ /* |
861 |
+ * cifs tcp session reconnection |
862 |
+ * |
863 |
+@@ -400,6 +448,11 @@ cifs_reconnect(struct TCP_Server_Info *server) |
864 |
+ rc = generic_ip_connect(server); |
865 |
+ if (rc) { |
866 |
+ cifs_dbg(FYI, "reconnect error %d\n", rc); |
867 |
++ rc = reconn_set_ipaddr(server); |
868 |
++ if (rc) { |
869 |
++ cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n", |
870 |
++ __func__, rc); |
871 |
++ } |
872 |
+ mutex_unlock(&server->srv_mutex); |
873 |
+ msleep(3000); |
874 |
+ } else { |
875 |
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c |
876 |
+index 2725085a3f9f..eae3cdffaf7f 100644 |
877 |
+--- a/fs/cifs/smb2ops.c |
878 |
++++ b/fs/cifs/smb2ops.c |
879 |
+@@ -143,14 +143,14 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size, |
880 |
+ |
881 |
+ scredits = server->credits; |
882 |
+ /* can deadlock with reopen */ |
883 |
+- if (scredits == 1) { |
884 |
++ if (scredits <= 8) { |
885 |
+ *num = SMB2_MAX_BUFFER_SIZE; |
886 |
+ *credits = 0; |
887 |
+ break; |
888 |
+ } |
889 |
+ |
890 |
+- /* leave one credit for a possible reopen */ |
891 |
+- scredits--; |
892 |
++ /* leave some credits for reopen and other ops */ |
893 |
++ scredits -= 8; |
894 |
+ *num = min_t(unsigned int, size, |
895 |
+ scredits * SMB2_MAX_BUFFER_SIZE); |
896 |
+ |
897 |
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c |
898 |
+index f7111bb88ec1..5e21d58c49ef 100644 |
899 |
+--- a/fs/cifs/smb2pdu.c |
900 |
++++ b/fs/cifs/smb2pdu.c |
901 |
+@@ -2523,8 +2523,8 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, |
902 |
+ if (rc == -ENODATA && rsp->hdr.Status == STATUS_NO_MORE_FILES) { |
903 |
+ srch_inf->endOfSearch = true; |
904 |
+ rc = 0; |
905 |
+- } |
906 |
+- cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); |
907 |
++ } else |
908 |
++ cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); |
909 |
+ goto qdir_exit; |
910 |
+ } |
911 |
+ |
912 |
+diff --git a/fs/dcache.c b/fs/dcache.c |
913 |
+index 141651b0c766..9ffe60702299 100644 |
914 |
+--- a/fs/dcache.c |
915 |
++++ b/fs/dcache.c |
916 |
+@@ -1155,15 +1155,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item, |
917 |
+ */ |
918 |
+ void shrink_dcache_sb(struct super_block *sb) |
919 |
+ { |
920 |
+- long freed; |
921 |
+- |
922 |
+ do { |
923 |
+ LIST_HEAD(dispose); |
924 |
+ |
925 |
+- freed = list_lru_walk(&sb->s_dentry_lru, |
926 |
++ list_lru_walk(&sb->s_dentry_lru, |
927 |
+ dentry_lru_isolate_shrink, &dispose, 1024); |
928 |
+- |
929 |
+- this_cpu_sub(nr_dentry_unused, freed); |
930 |
+ shrink_dentry_list(&dispose); |
931 |
+ cond_resched(); |
932 |
+ } while (list_lru_count(&sb->s_dentry_lru) > 0); |
933 |
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c |
934 |
+index 3685fea62333..582373849332 100644 |
935 |
+--- a/fs/f2fs/node.c |
936 |
++++ b/fs/f2fs/node.c |
937 |
+@@ -590,6 +590,7 @@ static void truncate_node(struct dnode_of_data *dn) |
938 |
+ { |
939 |
+ struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode); |
940 |
+ struct node_info ni; |
941 |
++ pgoff_t index; |
942 |
+ |
943 |
+ get_node_info(sbi, dn->nid, &ni); |
944 |
+ if (dn->inode->i_blocks == 0) { |
945 |
+@@ -613,10 +614,11 @@ invalidate: |
946 |
+ clear_node_page_dirty(dn->node_page); |
947 |
+ set_sbi_flag(sbi, SBI_IS_DIRTY); |
948 |
+ |
949 |
++ index = dn->node_page->index; |
950 |
+ f2fs_put_page(dn->node_page, 1); |
951 |
+ |
952 |
+ invalidate_mapping_pages(NODE_MAPPING(sbi), |
953 |
+- dn->node_page->index, dn->node_page->index); |
954 |
++ index, index); |
955 |
+ |
956 |
+ dn->node_page = NULL; |
957 |
+ trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr); |
958 |
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c |
959 |
+index 763fe7737065..ef24894edecc 100644 |
960 |
+--- a/fs/gfs2/rgrp.c |
961 |
++++ b/fs/gfs2/rgrp.c |
962 |
+@@ -1720,9 +1720,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext, |
963 |
+ goto next_iter; |
964 |
+ } |
965 |
+ if (ret == -E2BIG) { |
966 |
+- n += rbm->bii - initial_bii; |
967 |
+ rbm->bii = 0; |
968 |
+ rbm->offset = 0; |
969 |
++ n += (rbm->bii - initial_bii); |
970 |
+ goto res_covered_end_of_rgrp; |
971 |
+ } |
972 |
+ return ret; |
973 |
+diff --git a/fs/read_write.c b/fs/read_write.c |
974 |
+index bfd1a5dddf6e..16e554ba885d 100644 |
975 |
+--- a/fs/read_write.c |
976 |
++++ b/fs/read_write.c |
977 |
+@@ -363,8 +363,10 @@ ssize_t vfs_iter_write(struct file *file, struct iov_iter *iter, loff_t *ppos) |
978 |
+ iter->type |= WRITE; |
979 |
+ ret = file->f_op->write_iter(&kiocb, iter); |
980 |
+ BUG_ON(ret == -EIOCBQUEUED); |
981 |
+- if (ret > 0) |
982 |
++ if (ret > 0) { |
983 |
+ *ppos = kiocb.ki_pos; |
984 |
++ fsnotify_modify(file); |
985 |
++ } |
986 |
+ return ret; |
987 |
+ } |
988 |
+ EXPORT_SYMBOL(vfs_iter_write); |
989 |
+diff --git a/fs/super.c b/fs/super.c |
990 |
+index 09b526a50986..b9cd7982f6e2 100644 |
991 |
+--- a/fs/super.c |
992 |
++++ b/fs/super.c |
993 |
+@@ -118,13 +118,23 @@ static unsigned long super_cache_count(struct shrinker *shrink, |
994 |
+ sb = container_of(shrink, struct super_block, s_shrink); |
995 |
+ |
996 |
+ /* |
997 |
+- * Don't call trylock_super as it is a potential |
998 |
+- * scalability bottleneck. The counts could get updated |
999 |
+- * between super_cache_count and super_cache_scan anyway. |
1000 |
+- * Call to super_cache_count with shrinker_rwsem held |
1001 |
+- * ensures the safety of call to list_lru_shrink_count() and |
1002 |
+- * s_op->nr_cached_objects(). |
1003 |
++ * We don't call trylock_super() here as it is a scalability bottleneck, |
1004 |
++ * so we're exposed to partial setup state. The shrinker rwsem does not |
1005 |
++ * protect filesystem operations backing list_lru_shrink_count() or |
1006 |
++ * s_op->nr_cached_objects(). Counts can change between |
1007 |
++ * super_cache_count and super_cache_scan, so we really don't need locks |
1008 |
++ * here. |
1009 |
++ * |
1010 |
++ * However, if we are currently mounting the superblock, the underlying |
1011 |
++ * filesystem might be in a state of partial construction and hence it |
1012 |
++ * is dangerous to access it. trylock_super() uses a MS_BORN check to |
1013 |
++ * avoid this situation, so do the same here. The memory barrier is |
1014 |
++ * matched with the one in mount_fs() as we don't hold locks here. |
1015 |
+ */ |
1016 |
++ if (!(sb->s_flags & MS_BORN)) |
1017 |
++ return 0; |
1018 |
++ smp_rmb(); |
1019 |
++ |
1020 |
+ if (sb->s_op && sb->s_op->nr_cached_objects) |
1021 |
+ total_objects = sb->s_op->nr_cached_objects(sb, sc); |
1022 |
+ |
1023 |
+@@ -1133,6 +1143,14 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data) |
1024 |
+ sb = root->d_sb; |
1025 |
+ BUG_ON(!sb); |
1026 |
+ WARN_ON(!sb->s_bdi); |
1027 |
++ |
1028 |
++ /* |
1029 |
++ * Write barrier is for super_cache_count(). We place it before setting |
1030 |
++ * MS_BORN as the data dependency between the two functions is the |
1031 |
++ * superblock structure contents that we just set up, not the MS_BORN |
1032 |
++ * flag. |
1033 |
++ */ |
1034 |
++ smp_wmb(); |
1035 |
+ sb->s_flags |= MS_BORN; |
1036 |
+ |
1037 |
+ error = security_sb_kern_mount(sb, flags, secdata); |
1038 |
+diff --git a/include/linux/kobject.h b/include/linux/kobject.h |
1039 |
+index e6284591599e..5957c6a3fd7f 100644 |
1040 |
+--- a/include/linux/kobject.h |
1041 |
++++ b/include/linux/kobject.h |
1042 |
+@@ -113,6 +113,23 @@ extern void kobject_put(struct kobject *kobj); |
1043 |
+ extern const void *kobject_namespace(struct kobject *kobj); |
1044 |
+ extern char *kobject_get_path(struct kobject *kobj, gfp_t flag); |
1045 |
+ |
1046 |
++/** |
1047 |
++ * kobject_has_children - Returns whether a kobject has children. |
1048 |
++ * @kobj: the object to test |
1049 |
++ * |
1050 |
++ * This will return whether a kobject has other kobjects as children. |
1051 |
++ * |
1052 |
++ * It does NOT account for the presence of attribute files, only sub |
1053 |
++ * directories. It also assumes there is no concurrent addition or |
1054 |
++ * removal of such children, and thus relies on external locking. |
1055 |
++ */ |
1056 |
++static inline bool kobject_has_children(struct kobject *kobj) |
1057 |
++{ |
1058 |
++ WARN_ON_ONCE(atomic_read(&kobj->kref.refcount) == 0); |
1059 |
++ |
1060 |
++ return kobj->sd && kobj->sd->dir.subdirs; |
1061 |
++} |
1062 |
++ |
1063 |
+ struct kobj_type { |
1064 |
+ void (*release)(struct kobject *kobj); |
1065 |
+ const struct sysfs_ops *sysfs_ops; |
1066 |
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h |
1067 |
+index a490dd718654..6d39d81d3c38 100644 |
1068 |
+--- a/include/linux/skbuff.h |
1069 |
++++ b/include/linux/skbuff.h |
1070 |
+@@ -2798,6 +2798,7 @@ static inline unsigned char *skb_push_rcsum(struct sk_buff *skb, |
1071 |
+ * |
1072 |
+ * This is exactly the same as pskb_trim except that it ensures the |
1073 |
+ * checksum of received packets are still valid after the operation. |
1074 |
++ * It can change skb pointers. |
1075 |
+ */ |
1076 |
+ |
1077 |
+ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) |
1078 |
+diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h |
1079 |
+index 2a25b53cd427..f6ff83b2ac87 100644 |
1080 |
+--- a/include/net/ip_fib.h |
1081 |
++++ b/include/net/ip_fib.h |
1082 |
+@@ -200,7 +200,7 @@ int fib_table_insert(struct fib_table *, struct fib_config *); |
1083 |
+ int fib_table_delete(struct fib_table *, struct fib_config *); |
1084 |
+ int fib_table_dump(struct fib_table *table, struct sk_buff *skb, |
1085 |
+ struct netlink_callback *cb); |
1086 |
+-int fib_table_flush(struct fib_table *table); |
1087 |
++int fib_table_flush(struct fib_table *table, bool flush_all); |
1088 |
+ struct fib_table *fib_trie_unmerge(struct fib_table *main_tb); |
1089 |
+ void fib_table_flush_external(struct fib_table *table); |
1090 |
+ void fib_free_table(struct fib_table *tb); |
1091 |
+diff --git a/kernel/exit.c b/kernel/exit.c |
1092 |
+index f20e6339761b..03f6722302b5 100644 |
1093 |
+--- a/kernel/exit.c |
1094 |
++++ b/kernel/exit.c |
1095 |
+@@ -450,12 +450,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p) |
1096 |
+ return NULL; |
1097 |
+ } |
1098 |
+ |
1099 |
+-static struct task_struct *find_child_reaper(struct task_struct *father) |
1100 |
++static struct task_struct *find_child_reaper(struct task_struct *father, |
1101 |
++ struct list_head *dead) |
1102 |
+ __releases(&tasklist_lock) |
1103 |
+ __acquires(&tasklist_lock) |
1104 |
+ { |
1105 |
+ struct pid_namespace *pid_ns = task_active_pid_ns(father); |
1106 |
+ struct task_struct *reaper = pid_ns->child_reaper; |
1107 |
++ struct task_struct *p, *n; |
1108 |
+ |
1109 |
+ if (likely(reaper != father)) |
1110 |
+ return reaper; |
1111 |
+@@ -471,6 +473,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father) |
1112 |
+ panic("Attempted to kill init! exitcode=0x%08x\n", |
1113 |
+ father->signal->group_exit_code ?: father->exit_code); |
1114 |
+ } |
1115 |
++ |
1116 |
++ list_for_each_entry_safe(p, n, dead, ptrace_entry) { |
1117 |
++ list_del_init(&p->ptrace_entry); |
1118 |
++ release_task(p); |
1119 |
++ } |
1120 |
++ |
1121 |
+ zap_pid_ns_processes(pid_ns); |
1122 |
+ write_lock_irq(&tasklist_lock); |
1123 |
+ |
1124 |
+@@ -557,7 +565,7 @@ static void forget_original_parent(struct task_struct *father, |
1125 |
+ exit_ptrace(father, dead); |
1126 |
+ |
1127 |
+ /* Can drop and reacquire tasklist_lock */ |
1128 |
+- reaper = find_child_reaper(father); |
1129 |
++ reaper = find_child_reaper(father, dead); |
1130 |
+ if (list_empty(&father->children)) |
1131 |
+ return; |
1132 |
+ |
1133 |
+diff --git a/mm/migrate.c b/mm/migrate.c |
1134 |
+index afedcfab60e2..ce88dff1da98 100644 |
1135 |
+--- a/mm/migrate.c |
1136 |
++++ b/mm/migrate.c |
1137 |
+@@ -936,6 +936,7 @@ static ICE_noinline int unmap_and_move(new_page_t get_new_page, |
1138 |
+ int rc = MIGRATEPAGE_SUCCESS; |
1139 |
+ int *result = NULL; |
1140 |
+ struct page *newpage; |
1141 |
++ bool is_lru = !isolated_balloon_page(page); |
1142 |
+ |
1143 |
+ newpage = get_new_page(page, private, &result); |
1144 |
+ if (!newpage) |
1145 |
+@@ -983,11 +984,13 @@ out: |
1146 |
+ /* |
1147 |
+ * If migration was not successful and there's a freeing callback, use |
1148 |
+ * it. Otherwise, putback_lru_page() will drop the reference grabbed |
1149 |
+- * during isolation. |
1150 |
++ * during isolation. Use the old state of the isolated source page to |
1151 |
++ * determine if we migrated a LRU page. newpage was already unlocked |
1152 |
++ * and possibly modified by its owner - don't rely on the page state. |
1153 |
+ */ |
1154 |
+ if (put_new_page) |
1155 |
+ put_new_page(newpage, private); |
1156 |
+- else if (unlikely(__is_movable_balloon_page(newpage))) { |
1157 |
++ else if (rc == MIGRATEPAGE_SUCCESS && unlikely(!is_lru)) { |
1158 |
+ /* drop our reference, page already in the balloon */ |
1159 |
+ put_page(newpage); |
1160 |
+ } else |
1161 |
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c |
1162 |
+index c12680993ff3..bc781cdc0d04 100644 |
1163 |
+--- a/mm/oom_kill.c |
1164 |
++++ b/mm/oom_kill.c |
1165 |
+@@ -544,6 +544,13 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p, |
1166 |
+ * still freeing memory. |
1167 |
+ */ |
1168 |
+ read_lock(&tasklist_lock); |
1169 |
++ |
1170 |
++ /* |
1171 |
++ * The task 'p' might have already exited before reaching here. The |
1172 |
++ * put_task_struct() will free task_struct 'p' while the loop still try |
1173 |
++ * to access the field of 'p', so, get an extra reference. |
1174 |
++ */ |
1175 |
++ get_task_struct(p); |
1176 |
+ for_each_thread(p, t) { |
1177 |
+ list_for_each_entry(child, &t->children, sibling) { |
1178 |
+ unsigned int child_points; |
1179 |
+@@ -563,6 +570,7 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p, |
1180 |
+ } |
1181 |
+ } |
1182 |
+ } |
1183 |
++ put_task_struct(p); |
1184 |
+ read_unlock(&tasklist_lock); |
1185 |
+ |
1186 |
+ p = find_lock_task_mm(victim); |
1187 |
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c |
1188 |
+index fcdb86dd5a23..c21209aada8c 100644 |
1189 |
+--- a/net/bridge/br_forward.c |
1190 |
++++ b/net/bridge/br_forward.c |
1191 |
+@@ -39,10 +39,10 @@ static inline int should_deliver(const struct net_bridge_port *p, |
1192 |
+ |
1193 |
+ int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb) |
1194 |
+ { |
1195 |
++ skb_push(skb, ETH_HLEN); |
1196 |
+ if (!is_skb_forwardable(skb->dev, skb)) |
1197 |
+ goto drop; |
1198 |
+ |
1199 |
+- skb_push(skb, ETH_HLEN); |
1200 |
+ br_drop_fake_rtable(skb); |
1201 |
+ skb_sender_cpu_clear(skb); |
1202 |
+ |
1203 |
+@@ -88,12 +88,11 @@ static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb) |
1204 |
+ skb->dev = to->dev; |
1205 |
+ |
1206 |
+ if (unlikely(netpoll_tx_running(to->br->dev))) { |
1207 |
++ skb_push(skb, ETH_HLEN); |
1208 |
+ if (!is_skb_forwardable(skb->dev, skb)) |
1209 |
+ kfree_skb(skb); |
1210 |
+- else { |
1211 |
+- skb_push(skb, ETH_HLEN); |
1212 |
++ else |
1213 |
+ br_netpoll_send_skb(to, skb); |
1214 |
+- } |
1215 |
+ return; |
1216 |
+ } |
1217 |
+ |
1218 |
+diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c |
1219 |
+index d61f56efc8dc..69dfd212e50d 100644 |
1220 |
+--- a/net/bridge/br_netfilter_ipv6.c |
1221 |
++++ b/net/bridge/br_netfilter_ipv6.c |
1222 |
+@@ -131,6 +131,7 @@ int br_validate_ipv6(struct net *net, struct sk_buff *skb) |
1223 |
+ IPSTATS_MIB_INDISCARDS); |
1224 |
+ goto drop; |
1225 |
+ } |
1226 |
++ hdr = ipv6_hdr(skb); |
1227 |
+ } |
1228 |
+ if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb)) |
1229 |
+ goto drop; |
1230 |
+diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c |
1231 |
+index fdba3d9fbff3..6e48aa69fa24 100644 |
1232 |
+--- a/net/bridge/netfilter/nft_reject_bridge.c |
1233 |
++++ b/net/bridge/netfilter/nft_reject_bridge.c |
1234 |
+@@ -192,6 +192,7 @@ static bool reject6_br_csum_ok(struct sk_buff *skb, int hook) |
1235 |
+ pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h))) |
1236 |
+ return false; |
1237 |
+ |
1238 |
++ ip6h = ipv6_hdr(skb); |
1239 |
+ thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo); |
1240 |
+ if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0) |
1241 |
+ return false; |
1242 |
+diff --git a/net/can/bcm.c b/net/can/bcm.c |
1243 |
+index 4ccfd356baed..1f15622d3c65 100644 |
1244 |
+--- a/net/can/bcm.c |
1245 |
++++ b/net/can/bcm.c |
1246 |
+@@ -67,6 +67,9 @@ |
1247 |
+ */ |
1248 |
+ #define MAX_NFRAMES 256 |
1249 |
+ |
1250 |
++/* limit timers to 400 days for sending/timeouts */ |
1251 |
++#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60) |
1252 |
++ |
1253 |
+ /* use of last_frames[index].can_dlc */ |
1254 |
+ #define RX_RECV 0x40 /* received data for this element */ |
1255 |
+ #define RX_THR 0x80 /* element not been sent due to throttle feature */ |
1256 |
+@@ -136,6 +139,22 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv) |
1257 |
+ return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC); |
1258 |
+ } |
1259 |
+ |
1260 |
++/* check limitations for timeval provided by user */ |
1261 |
++static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head) |
1262 |
++{ |
1263 |
++ if ((msg_head->ival1.tv_sec < 0) || |
1264 |
++ (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) || |
1265 |
++ (msg_head->ival1.tv_usec < 0) || |
1266 |
++ (msg_head->ival1.tv_usec >= USEC_PER_SEC) || |
1267 |
++ (msg_head->ival2.tv_sec < 0) || |
1268 |
++ (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) || |
1269 |
++ (msg_head->ival2.tv_usec < 0) || |
1270 |
++ (msg_head->ival2.tv_usec >= USEC_PER_SEC)) |
1271 |
++ return true; |
1272 |
++ |
1273 |
++ return false; |
1274 |
++} |
1275 |
++ |
1276 |
+ #define CFSIZ sizeof(struct can_frame) |
1277 |
+ #define OPSIZ sizeof(struct bcm_op) |
1278 |
+ #define MHSIZ sizeof(struct bcm_msg_head) |
1279 |
+@@ -855,6 +874,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, |
1280 |
+ if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES) |
1281 |
+ return -EINVAL; |
1282 |
+ |
1283 |
++ /* check timeval limitations */ |
1284 |
++ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head)) |
1285 |
++ return -EINVAL; |
1286 |
++ |
1287 |
+ /* check the given can_id */ |
1288 |
+ op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex); |
1289 |
+ |
1290 |
+@@ -1020,6 +1043,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, |
1291 |
+ (!(msg_head->can_id & CAN_RTR_FLAG)))) |
1292 |
+ return -EINVAL; |
1293 |
+ |
1294 |
++ /* check timeval limitations */ |
1295 |
++ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head)) |
1296 |
++ return -EINVAL; |
1297 |
++ |
1298 |
+ /* check the given can_id */ |
1299 |
+ op = bcm_find_op(&bo->rx_ops, msg_head->can_id, ifindex); |
1300 |
+ if (op) { |
1301 |
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c |
1302 |
+index ce646572b912..1f7b47ca2243 100644 |
1303 |
+--- a/net/ipv4/fib_frontend.c |
1304 |
++++ b/net/ipv4/fib_frontend.c |
1305 |
+@@ -187,7 +187,7 @@ static void fib_flush(struct net *net) |
1306 |
+ struct fib_table *tb; |
1307 |
+ |
1308 |
+ hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) |
1309 |
+- flushed += fib_table_flush(tb); |
1310 |
++ flushed += fib_table_flush(tb, false); |
1311 |
+ } |
1312 |
+ |
1313 |
+ if (flushed) |
1314 |
+@@ -1277,7 +1277,7 @@ static void ip_fib_net_exit(struct net *net) |
1315 |
+ |
1316 |
+ hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) { |
1317 |
+ hlist_del(&tb->tb_hlist); |
1318 |
+- fib_table_flush(tb); |
1319 |
++ fib_table_flush(tb, true); |
1320 |
+ fib_free_table(tb); |
1321 |
+ } |
1322 |
+ } |
1323 |
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c |
1324 |
+index 5c598f99a500..fdaa905dccdd 100644 |
1325 |
+--- a/net/ipv4/fib_trie.c |
1326 |
++++ b/net/ipv4/fib_trie.c |
1327 |
+@@ -1806,7 +1806,7 @@ void fib_table_flush_external(struct fib_table *tb) |
1328 |
+ } |
1329 |
+ |
1330 |
+ /* Caller must hold RTNL. */ |
1331 |
+-int fib_table_flush(struct fib_table *tb) |
1332 |
++int fib_table_flush(struct fib_table *tb, bool flush_all) |
1333 |
+ { |
1334 |
+ struct trie *t = (struct trie *)tb->tb_data; |
1335 |
+ struct key_vector *pn = t->kv; |
1336 |
+@@ -1850,7 +1850,17 @@ int fib_table_flush(struct fib_table *tb) |
1337 |
+ hlist_for_each_entry_safe(fa, tmp, &n->leaf, fa_list) { |
1338 |
+ struct fib_info *fi = fa->fa_info; |
1339 |
+ |
1340 |
+- if (!fi || !(fi->fib_flags & RTNH_F_DEAD)) { |
1341 |
++ if (!fi || |
1342 |
++ (!(fi->fib_flags & RTNH_F_DEAD) && |
1343 |
++ !fib_props[fa->fa_type].error)) { |
1344 |
++ slen = fa->fa_slen; |
1345 |
++ continue; |
1346 |
++ } |
1347 |
++ |
1348 |
++ /* Do not flush error routes if network namespace is |
1349 |
++ * not being dismantled |
1350 |
++ */ |
1351 |
++ if (!flush_all && fib_props[fa->fa_type].error) { |
1352 |
+ slen = fa->fa_slen; |
1353 |
+ continue; |
1354 |
+ } |
1355 |
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c |
1356 |
+index b1209b63381f..eb1834f2682f 100644 |
1357 |
+--- a/net/ipv4/ip_input.c |
1358 |
++++ b/net/ipv4/ip_input.c |
1359 |
+@@ -444,6 +444,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, |
1360 |
+ goto drop; |
1361 |
+ } |
1362 |
+ |
1363 |
++ iph = ip_hdr(skb); |
1364 |
+ skb->transport_header = skb->network_header + iph->ihl*4; |
1365 |
+ |
1366 |
+ /* Remove any debris in the socket control block */ |
1367 |
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c |
1368 |
+index d6f2dab28d14..f9a4447ca002 100644 |
1369 |
+--- a/net/ipv6/af_inet6.c |
1370 |
++++ b/net/ipv6/af_inet6.c |
1371 |
+@@ -345,6 +345,9 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) |
1372 |
+ err = -EINVAL; |
1373 |
+ goto out_unlock; |
1374 |
+ } |
1375 |
++ } |
1376 |
++ |
1377 |
++ if (sk->sk_bound_dev_if) { |
1378 |
+ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if); |
1379 |
+ if (!dev) { |
1380 |
+ err = -ENODEV; |
1381 |
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c |
1382 |
+index 591d18785285..429dbb064240 100644 |
1383 |
+--- a/net/l2tp/l2tp_core.c |
1384 |
++++ b/net/l2tp/l2tp_core.c |
1385 |
+@@ -83,8 +83,7 @@ |
1386 |
+ #define L2TP_SLFLAG_S 0x40000000 |
1387 |
+ #define L2TP_SL_SEQ_MASK 0x00ffffff |
1388 |
+ |
1389 |
+-#define L2TP_HDR_SIZE_SEQ 10 |
1390 |
+-#define L2TP_HDR_SIZE_NOSEQ 6 |
1391 |
++#define L2TP_HDR_SIZE_MAX 14 |
1392 |
+ |
1393 |
+ /* Default trace flags */ |
1394 |
+ #define L2TP_DEFAULT_DEBUG_FLAGS 0 |
1395 |
+@@ -705,11 +704,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, |
1396 |
+ "%s: recv data ns=%u, session nr=%u\n", |
1397 |
+ session->name, ns, session->nr); |
1398 |
+ } |
1399 |
++ ptr += 4; |
1400 |
+ } |
1401 |
+ |
1402 |
+- /* Advance past L2-specific header, if present */ |
1403 |
+- ptr += session->l2specific_len; |
1404 |
+- |
1405 |
+ if (L2TP_SKB_CB(skb)->has_seq) { |
1406 |
+ /* Received a packet with sequence numbers. If we're the LNS, |
1407 |
+ * check if we sre sending sequence numbers and if not, |
1408 |
+@@ -860,7 +857,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb, |
1409 |
+ __skb_pull(skb, sizeof(struct udphdr)); |
1410 |
+ |
1411 |
+ /* Short packet? */ |
1412 |
+- if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) { |
1413 |
++ if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) { |
1414 |
+ l2tp_info(tunnel, L2TP_MSG_DATA, |
1415 |
+ "%s: recv short packet (len=%d)\n", |
1416 |
+ tunnel->name, skb->len); |
1417 |
+@@ -933,6 +930,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb, |
1418 |
+ goto error; |
1419 |
+ } |
1420 |
+ |
1421 |
++ if (tunnel->version == L2TP_HDR_VER_3 && |
1422 |
++ l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) |
1423 |
++ goto error; |
1424 |
++ |
1425 |
+ l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook); |
1426 |
+ |
1427 |
+ return 0; |
1428 |
+@@ -1031,21 +1032,20 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) |
1429 |
+ memcpy(bufp, &session->cookie[0], session->cookie_len); |
1430 |
+ bufp += session->cookie_len; |
1431 |
+ } |
1432 |
+- if (session->l2specific_len) { |
1433 |
+- if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) { |
1434 |
+- u32 l2h = 0; |
1435 |
+- if (session->send_seq) { |
1436 |
+- l2h = 0x40000000 | session->ns; |
1437 |
+- session->ns++; |
1438 |
+- session->ns &= 0xffffff; |
1439 |
+- l2tp_dbg(session, L2TP_MSG_SEQ, |
1440 |
+- "%s: updated ns to %u\n", |
1441 |
+- session->name, session->ns); |
1442 |
+- } |
1443 |
++ if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) { |
1444 |
++ u32 l2h = 0; |
1445 |
+ |
1446 |
+- *((__be32 *) bufp) = htonl(l2h); |
1447 |
++ if (session->send_seq) { |
1448 |
++ l2h = 0x40000000 | session->ns; |
1449 |
++ session->ns++; |
1450 |
++ session->ns &= 0xffffff; |
1451 |
++ l2tp_dbg(session, L2TP_MSG_SEQ, |
1452 |
++ "%s: updated ns to %u\n", |
1453 |
++ session->name, session->ns); |
1454 |
+ } |
1455 |
+- bufp += session->l2specific_len; |
1456 |
++ |
1457 |
++ *((__be32 *)bufp) = htonl(l2h); |
1458 |
++ bufp += 4; |
1459 |
+ } |
1460 |
+ if (session->offset) |
1461 |
+ bufp += session->offset; |
1462 |
+@@ -1724,7 +1724,7 @@ int l2tp_session_delete(struct l2tp_session *session) |
1463 |
+ EXPORT_SYMBOL_GPL(l2tp_session_delete); |
1464 |
+ |
1465 |
+ /* We come here whenever a session's send_seq, cookie_len or |
1466 |
+- * l2specific_len parameters are set. |
1467 |
++ * l2specific_type parameters are set. |
1468 |
+ */ |
1469 |
+ void l2tp_session_set_header_len(struct l2tp_session *session, int version) |
1470 |
+ { |
1471 |
+@@ -1733,7 +1733,8 @@ void l2tp_session_set_header_len(struct l2tp_session *session, int version) |
1472 |
+ if (session->send_seq) |
1473 |
+ session->hdr_len += 4; |
1474 |
+ } else { |
1475 |
+- session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset; |
1476 |
++ session->hdr_len = 4 + session->cookie_len + session->offset; |
1477 |
++ session->hdr_len += l2tp_get_l2specific_len(session); |
1478 |
+ if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP) |
1479 |
+ session->hdr_len += 4; |
1480 |
+ } |
1481 |
+diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h |
1482 |
+index 9cf546846edb..fad47e9d74bc 100644 |
1483 |
+--- a/net/l2tp/l2tp_core.h |
1484 |
++++ b/net/l2tp/l2tp_core.h |
1485 |
+@@ -313,6 +313,37 @@ do { \ |
1486 |
+ #define l2tp_session_dec_refcount(s) l2tp_session_dec_refcount_1(s) |
1487 |
+ #endif |
1488 |
+ |
1489 |
++static inline int l2tp_get_l2specific_len(struct l2tp_session *session) |
1490 |
++{ |
1491 |
++ switch (session->l2specific_type) { |
1492 |
++ case L2TP_L2SPECTYPE_DEFAULT: |
1493 |
++ return 4; |
1494 |
++ case L2TP_L2SPECTYPE_NONE: |
1495 |
++ default: |
1496 |
++ return 0; |
1497 |
++ } |
1498 |
++} |
1499 |
++ |
1500 |
++static inline int l2tp_v3_ensure_opt_in_linear(struct l2tp_session *session, struct sk_buff *skb, |
1501 |
++ unsigned char **ptr, unsigned char **optr) |
1502 |
++{ |
1503 |
++ int opt_len = session->peer_cookie_len + l2tp_get_l2specific_len(session); |
1504 |
++ |
1505 |
++ if (opt_len > 0) { |
1506 |
++ int off = *ptr - *optr; |
1507 |
++ |
1508 |
++ if (!pskb_may_pull(skb, off + opt_len)) |
1509 |
++ return -1; |
1510 |
++ |
1511 |
++ if (skb->data != *optr) { |
1512 |
++ *optr = skb->data; |
1513 |
++ *ptr = skb->data + off; |
1514 |
++ } |
1515 |
++ } |
1516 |
++ |
1517 |
++ return 0; |
1518 |
++} |
1519 |
++ |
1520 |
+ #define l2tp_printk(ptr, type, func, fmt, ...) \ |
1521 |
+ do { \ |
1522 |
+ if (((ptr)->debug) & (type)) \ |
1523 |
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c |
1524 |
+index af74e3ba0f92..7efb3cadc152 100644 |
1525 |
+--- a/net/l2tp/l2tp_ip.c |
1526 |
++++ b/net/l2tp/l2tp_ip.c |
1527 |
+@@ -163,6 +163,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) |
1528 |
+ print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); |
1529 |
+ } |
1530 |
+ |
1531 |
++ if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) |
1532 |
++ goto discard; |
1533 |
++ |
1534 |
+ l2tp_recv_common(session, skb, ptr, optr, 0, skb->len, tunnel->recv_payload_hook); |
1535 |
+ |
1536 |
+ return 0; |
1537 |
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c |
1538 |
+index 591d308bf63a..e066111b9398 100644 |
1539 |
+--- a/net/l2tp/l2tp_ip6.c |
1540 |
++++ b/net/l2tp/l2tp_ip6.c |
1541 |
+@@ -174,6 +174,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) |
1542 |
+ print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); |
1543 |
+ } |
1544 |
+ |
1545 |
++ if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) |
1546 |
++ goto discard; |
1547 |
++ |
1548 |
+ l2tp_recv_common(session, skb, ptr, optr, 0, skb->len, |
1549 |
+ tunnel->recv_payload_hook); |
1550 |
+ return 0; |
1551 |
+diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c |
1552 |
+index 94d05806a9a2..f0ecaec1ff3d 100644 |
1553 |
+--- a/net/netrom/nr_timer.c |
1554 |
++++ b/net/netrom/nr_timer.c |
1555 |
+@@ -53,21 +53,21 @@ void nr_start_t1timer(struct sock *sk) |
1556 |
+ { |
1557 |
+ struct nr_sock *nr = nr_sk(sk); |
1558 |
+ |
1559 |
+- mod_timer(&nr->t1timer, jiffies + nr->t1); |
1560 |
++ sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1); |
1561 |
+ } |
1562 |
+ |
1563 |
+ void nr_start_t2timer(struct sock *sk) |
1564 |
+ { |
1565 |
+ struct nr_sock *nr = nr_sk(sk); |
1566 |
+ |
1567 |
+- mod_timer(&nr->t2timer, jiffies + nr->t2); |
1568 |
++ sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2); |
1569 |
+ } |
1570 |
+ |
1571 |
+ void nr_start_t4timer(struct sock *sk) |
1572 |
+ { |
1573 |
+ struct nr_sock *nr = nr_sk(sk); |
1574 |
+ |
1575 |
+- mod_timer(&nr->t4timer, jiffies + nr->t4); |
1576 |
++ sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4); |
1577 |
+ } |
1578 |
+ |
1579 |
+ void nr_start_idletimer(struct sock *sk) |
1580 |
+@@ -75,37 +75,37 @@ void nr_start_idletimer(struct sock *sk) |
1581 |
+ struct nr_sock *nr = nr_sk(sk); |
1582 |
+ |
1583 |
+ if (nr->idle > 0) |
1584 |
+- mod_timer(&nr->idletimer, jiffies + nr->idle); |
1585 |
++ sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle); |
1586 |
+ } |
1587 |
+ |
1588 |
+ void nr_start_heartbeat(struct sock *sk) |
1589 |
+ { |
1590 |
+- mod_timer(&sk->sk_timer, jiffies + 5 * HZ); |
1591 |
++ sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ); |
1592 |
+ } |
1593 |
+ |
1594 |
+ void nr_stop_t1timer(struct sock *sk) |
1595 |
+ { |
1596 |
+- del_timer(&nr_sk(sk)->t1timer); |
1597 |
++ sk_stop_timer(sk, &nr_sk(sk)->t1timer); |
1598 |
+ } |
1599 |
+ |
1600 |
+ void nr_stop_t2timer(struct sock *sk) |
1601 |
+ { |
1602 |
+- del_timer(&nr_sk(sk)->t2timer); |
1603 |
++ sk_stop_timer(sk, &nr_sk(sk)->t2timer); |
1604 |
+ } |
1605 |
+ |
1606 |
+ void nr_stop_t4timer(struct sock *sk) |
1607 |
+ { |
1608 |
+- del_timer(&nr_sk(sk)->t4timer); |
1609 |
++ sk_stop_timer(sk, &nr_sk(sk)->t4timer); |
1610 |
+ } |
1611 |
+ |
1612 |
+ void nr_stop_idletimer(struct sock *sk) |
1613 |
+ { |
1614 |
+- del_timer(&nr_sk(sk)->idletimer); |
1615 |
++ sk_stop_timer(sk, &nr_sk(sk)->idletimer); |
1616 |
+ } |
1617 |
+ |
1618 |
+ void nr_stop_heartbeat(struct sock *sk) |
1619 |
+ { |
1620 |
+- del_timer(&sk->sk_timer); |
1621 |
++ sk_stop_timer(sk, &sk->sk_timer); |
1622 |
+ } |
1623 |
+ |
1624 |
+ int nr_t1timer_running(struct sock *sk) |
1625 |
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c |
1626 |
+index 624c4719e404..537917dfa83a 100644 |
1627 |
+--- a/net/openvswitch/flow_netlink.c |
1628 |
++++ b/net/openvswitch/flow_netlink.c |
1629 |
+@@ -409,7 +409,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr, |
1630 |
+ return -EINVAL; |
1631 |
+ } |
1632 |
+ |
1633 |
+- if (!nz || !is_all_zero(nla_data(nla), expected_len)) { |
1634 |
++ if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) { |
1635 |
+ attrs |= 1 << type; |
1636 |
+ a[type] = nla; |
1637 |
+ } |
1638 |
+diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c |
1639 |
+index 0fc76d845103..9f704a7f2a28 100644 |
1640 |
+--- a/net/rose/rose_route.c |
1641 |
++++ b/net/rose/rose_route.c |
1642 |
+@@ -848,6 +848,7 @@ void rose_link_device_down(struct net_device *dev) |
1643 |
+ |
1644 |
+ /* |
1645 |
+ * Route a frame to an appropriate AX.25 connection. |
1646 |
++ * A NULL ax25_cb indicates an internally generated frame. |
1647 |
+ */ |
1648 |
+ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) |
1649 |
+ { |
1650 |
+@@ -865,6 +866,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) |
1651 |
+ |
1652 |
+ if (skb->len < ROSE_MIN_LEN) |
1653 |
+ return res; |
1654 |
++ |
1655 |
++ if (!ax25) |
1656 |
++ return rose_loopback_queue(skb, NULL); |
1657 |
++ |
1658 |
+ frametype = skb->data[2]; |
1659 |
+ lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF); |
1660 |
+ if (frametype == ROSE_CALL_REQUEST && |
1661 |
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c |
1662 |
+index 6d340cd6e2a7..b379c330a338 100644 |
1663 |
+--- a/net/sched/sch_api.c |
1664 |
++++ b/net/sched/sch_api.c |
1665 |
+@@ -1823,7 +1823,6 @@ done: |
1666 |
+ int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp, |
1667 |
+ struct tcf_result *res, bool compat_mode) |
1668 |
+ { |
1669 |
+- __be16 protocol = tc_skb_protocol(skb); |
1670 |
+ #ifdef CONFIG_NET_CLS_ACT |
1671 |
+ const struct tcf_proto *old_tp = tp; |
1672 |
+ int limit = 0; |
1673 |
+@@ -1831,6 +1830,7 @@ int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp, |
1674 |
+ reclassify: |
1675 |
+ #endif |
1676 |
+ for (; tp; tp = rcu_dereference_bh(tp->next)) { |
1677 |
++ __be16 protocol = tc_skb_protocol(skb); |
1678 |
+ int err; |
1679 |
+ |
1680 |
+ if (tp->protocol != protocol && |
1681 |
+@@ -1857,7 +1857,6 @@ reset: |
1682 |
+ } |
1683 |
+ |
1684 |
+ tp = old_tp; |
1685 |
+- protocol = tc_skb_protocol(skb); |
1686 |
+ goto reclassify; |
1687 |
+ #endif |
1688 |
+ } |
1689 |
+diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c |
1690 |
+index 2b96b11fbe71..1d9dfb92b3b4 100644 |
1691 |
+--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c |
1692 |
++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c |
1693 |
+@@ -398,7 +398,13 @@ static int sst_media_hw_params(struct snd_pcm_substream *substream, |
1694 |
+ struct snd_pcm_hw_params *params, |
1695 |
+ struct snd_soc_dai *dai) |
1696 |
+ { |
1697 |
+- snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params)); |
1698 |
++ int ret; |
1699 |
++ |
1700 |
++ ret = |
1701 |
++ snd_pcm_lib_malloc_pages(substream, |
1702 |
++ params_buffer_bytes(params)); |
1703 |
++ if (ret) |
1704 |
++ return ret; |
1705 |
+ memset(substream->runtime->dma_area, 0, params_buffer_bytes(params)); |
1706 |
+ return 0; |
1707 |
+ } |
1708 |
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c |
1709 |
+index 60edec383281..bf5ee8906fb2 100644 |
1710 |
+--- a/tools/perf/util/unwind-libdw.c |
1711 |
++++ b/tools/perf/util/unwind-libdw.c |
1712 |
+@@ -41,13 +41,13 @@ static int __report_module(struct addr_location *al, u64 ip, |
1713 |
+ Dwarf_Addr s; |
1714 |
+ |
1715 |
+ dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL); |
1716 |
+- if (s != al->map->start) |
1717 |
++ if (s != al->map->start - al->map->pgoff) |
1718 |
+ mod = 0; |
1719 |
+ } |
1720 |
+ |
1721 |
+ if (!mod) |
1722 |
+ mod = dwfl_report_elf(ui->dwfl, dso->short_name, |
1723 |
+- dso->long_name, -1, al->map->start, |
1724 |
++ (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff, |
1725 |
+ false); |
1726 |
+ |
1727 |
+ return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1; |