1 |
commit: 3c99d5ac3d09450f9e5c7392b5173804107a827e |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sat Nov 10 21:33:13 2018 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Nov 14 11:36:28 2018 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3c99d5ac |
7 |
|
8 |
Linux patch 4.18.18 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1017_linux-4.18.18.patch | 1206 ++++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 1210 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index fcd301e..6774045 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -111,6 +111,10 @@ Patch: 1016_linux-4.18.17.patch |
21 |
From: http://www.kernel.org |
22 |
Desc: Linux 4.18.17 |
23 |
|
24 |
+Patch: 1017_linux-4.18.18.patch |
25 |
+From: http://www.kernel.org |
26 |
+Desc: Linux 4.18.18 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1017_linux-4.18.18.patch b/1017_linux-4.18.18.patch |
33 |
new file mode 100644 |
34 |
index 0000000..093fbfc |
35 |
--- /dev/null |
36 |
+++ b/1017_linux-4.18.18.patch |
37 |
@@ -0,0 +1,1206 @@ |
38 |
+diff --git a/Makefile b/Makefile |
39 |
+index c051db0ca5a0..7b35c1ec0427 100644 |
40 |
+--- a/Makefile |
41 |
++++ b/Makefile |
42 |
+@@ -1,7 +1,7 @@ |
43 |
+ # SPDX-License-Identifier: GPL-2.0 |
44 |
+ VERSION = 4 |
45 |
+ PATCHLEVEL = 18 |
46 |
+-SUBLEVEL = 17 |
47 |
++SUBLEVEL = 18 |
48 |
+ EXTRAVERSION = |
49 |
+ NAME = Merciless Moray |
50 |
+ |
51 |
+diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h |
52 |
+index a38bf5a1e37a..69dcdf195b61 100644 |
53 |
+--- a/arch/x86/include/asm/fpu/internal.h |
54 |
++++ b/arch/x86/include/asm/fpu/internal.h |
55 |
+@@ -528,7 +528,7 @@ static inline void fpregs_activate(struct fpu *fpu) |
56 |
+ static inline void |
57 |
+ switch_fpu_prepare(struct fpu *old_fpu, int cpu) |
58 |
+ { |
59 |
+- if (old_fpu->initialized) { |
60 |
++ if (static_cpu_has(X86_FEATURE_FPU) && old_fpu->initialized) { |
61 |
+ if (!copy_fpregs_to_fpstate(old_fpu)) |
62 |
+ old_fpu->last_cpu = -1; |
63 |
+ else |
64 |
+diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h |
65 |
+index a06b07399d17..6abf3af96fc8 100644 |
66 |
+--- a/arch/x86/include/asm/percpu.h |
67 |
++++ b/arch/x86/include/asm/percpu.h |
68 |
+@@ -185,22 +185,22 @@ do { \ |
69 |
+ typeof(var) pfo_ret__; \ |
70 |
+ switch (sizeof(var)) { \ |
71 |
+ case 1: \ |
72 |
+- asm(op "b "__percpu_arg(1)",%0" \ |
73 |
++ asm volatile(op "b "__percpu_arg(1)",%0"\ |
74 |
+ : "=q" (pfo_ret__) \ |
75 |
+ : "m" (var)); \ |
76 |
+ break; \ |
77 |
+ case 2: \ |
78 |
+- asm(op "w "__percpu_arg(1)",%0" \ |
79 |
++ asm volatile(op "w "__percpu_arg(1)",%0"\ |
80 |
+ : "=r" (pfo_ret__) \ |
81 |
+ : "m" (var)); \ |
82 |
+ break; \ |
83 |
+ case 4: \ |
84 |
+- asm(op "l "__percpu_arg(1)",%0" \ |
85 |
++ asm volatile(op "l "__percpu_arg(1)",%0"\ |
86 |
+ : "=r" (pfo_ret__) \ |
87 |
+ : "m" (var)); \ |
88 |
+ break; \ |
89 |
+ case 8: \ |
90 |
+- asm(op "q "__percpu_arg(1)",%0" \ |
91 |
++ asm volatile(op "q "__percpu_arg(1)",%0"\ |
92 |
+ : "=r" (pfo_ret__) \ |
93 |
+ : "m" (var)); \ |
94 |
+ break; \ |
95 |
+diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c |
96 |
+index 661583662430..71c0b01d93b1 100644 |
97 |
+--- a/arch/x86/kernel/pci-swiotlb.c |
98 |
++++ b/arch/x86/kernel/pci-swiotlb.c |
99 |
+@@ -42,10 +42,8 @@ IOMMU_INIT_FINISH(pci_swiotlb_detect_override, |
100 |
+ int __init pci_swiotlb_detect_4gb(void) |
101 |
+ { |
102 |
+ /* don't initialize swiotlb if iommu=off (no_iommu=1) */ |
103 |
+-#ifdef CONFIG_X86_64 |
104 |
+ if (!no_iommu && max_possible_pfn > MAX_DMA32_PFN) |
105 |
+ swiotlb = 1; |
106 |
+-#endif |
107 |
+ |
108 |
+ /* |
109 |
+ * If SME is active then swiotlb will be set to 1 so that bounce |
110 |
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c |
111 |
+index 74b4472ba0a6..f32472acf66c 100644 |
112 |
+--- a/arch/x86/kernel/setup.c |
113 |
++++ b/arch/x86/kernel/setup.c |
114 |
+@@ -1258,7 +1258,7 @@ void __init setup_arch(char **cmdline_p) |
115 |
+ x86_init.hyper.guest_late_init(); |
116 |
+ |
117 |
+ e820__reserve_resources(); |
118 |
+- e820__register_nosave_regions(max_low_pfn); |
119 |
++ e820__register_nosave_regions(max_pfn); |
120 |
+ |
121 |
+ x86_init.resources.reserve_resources(); |
122 |
+ |
123 |
+diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c |
124 |
+index be01328eb755..fddaefc51fb6 100644 |
125 |
+--- a/arch/x86/kernel/time.c |
126 |
++++ b/arch/x86/kernel/time.c |
127 |
+@@ -25,7 +25,7 @@ |
128 |
+ #include <asm/time.h> |
129 |
+ |
130 |
+ #ifdef CONFIG_X86_64 |
131 |
+-__visible volatile unsigned long jiffies __cacheline_aligned = INITIAL_JIFFIES; |
132 |
++__visible volatile unsigned long jiffies __cacheline_aligned_in_smp = INITIAL_JIFFIES; |
133 |
+ #endif |
134 |
+ |
135 |
+ unsigned long profile_pc(struct pt_regs *regs) |
136 |
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c |
137 |
+index a10481656d82..2f4af9598f62 100644 |
138 |
+--- a/arch/x86/kernel/tsc.c |
139 |
++++ b/arch/x86/kernel/tsc.c |
140 |
+@@ -60,7 +60,7 @@ struct cyc2ns { |
141 |
+ |
142 |
+ static DEFINE_PER_CPU_ALIGNED(struct cyc2ns, cyc2ns); |
143 |
+ |
144 |
+-void cyc2ns_read_begin(struct cyc2ns_data *data) |
145 |
++void __always_inline cyc2ns_read_begin(struct cyc2ns_data *data) |
146 |
+ { |
147 |
+ int seq, idx; |
148 |
+ |
149 |
+@@ -77,7 +77,7 @@ void cyc2ns_read_begin(struct cyc2ns_data *data) |
150 |
+ } while (unlikely(seq != this_cpu_read(cyc2ns.seq.sequence))); |
151 |
+ } |
152 |
+ |
153 |
+-void cyc2ns_read_end(void) |
154 |
++void __always_inline cyc2ns_read_end(void) |
155 |
+ { |
156 |
+ preempt_enable_notrace(); |
157 |
+ } |
158 |
+@@ -123,7 +123,7 @@ static void __init cyc2ns_init(int cpu) |
159 |
+ seqcount_init(&c2n->seq); |
160 |
+ } |
161 |
+ |
162 |
+-static inline unsigned long long cycles_2_ns(unsigned long long cyc) |
163 |
++static __always_inline unsigned long long cycles_2_ns(unsigned long long cyc) |
164 |
+ { |
165 |
+ struct cyc2ns_data data; |
166 |
+ unsigned long long ns; |
167 |
+diff --git a/drivers/clk/sunxi-ng/ccu-sun4i-a10.c b/drivers/clk/sunxi-ng/ccu-sun4i-a10.c |
168 |
+index ffa5dac221e4..129ebd2588fd 100644 |
169 |
+--- a/drivers/clk/sunxi-ng/ccu-sun4i-a10.c |
170 |
++++ b/drivers/clk/sunxi-ng/ccu-sun4i-a10.c |
171 |
+@@ -1434,8 +1434,16 @@ static void __init sun4i_ccu_init(struct device_node *node, |
172 |
+ return; |
173 |
+ } |
174 |
+ |
175 |
+- /* Force the PLL-Audio-1x divider to 1 */ |
176 |
+ val = readl(reg + SUN4I_PLL_AUDIO_REG); |
177 |
++ |
178 |
++ /* |
179 |
++ * Force VCO and PLL bias current to lowest setting. Higher |
180 |
++ * settings interfere with sigma-delta modulation and result |
181 |
++ * in audible noise and distortions when using SPDIF or I2S. |
182 |
++ */ |
183 |
++ val &= ~GENMASK(25, 16); |
184 |
++ |
185 |
++ /* Force the PLL-Audio-1x divider to 1 */ |
186 |
+ val &= ~GENMASK(29, 26); |
187 |
+ writel(val | (1 << 26), reg + SUN4I_PLL_AUDIO_REG); |
188 |
+ |
189 |
+diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c |
190 |
+index e2831ee70cdc..deb539b3316b 100644 |
191 |
+--- a/drivers/gpio/gpio-mxs.c |
192 |
++++ b/drivers/gpio/gpio-mxs.c |
193 |
+@@ -18,8 +18,6 @@ |
194 |
+ #include <linux/platform_device.h> |
195 |
+ #include <linux/slab.h> |
196 |
+ #include <linux/gpio/driver.h> |
197 |
+-/* FIXME: for gpio_get_value(), replace this by direct register read */ |
198 |
+-#include <linux/gpio.h> |
199 |
+ #include <linux/module.h> |
200 |
+ |
201 |
+ #define MXS_SET 0x4 |
202 |
+@@ -86,7 +84,7 @@ static int mxs_gpio_set_irq_type(struct irq_data *d, unsigned int type) |
203 |
+ port->both_edges &= ~pin_mask; |
204 |
+ switch (type) { |
205 |
+ case IRQ_TYPE_EDGE_BOTH: |
206 |
+- val = gpio_get_value(port->gc.base + d->hwirq); |
207 |
++ val = port->gc.get(&port->gc, d->hwirq); |
208 |
+ if (val) |
209 |
+ edge = GPIO_INT_FALL_EDGE; |
210 |
+ else |
211 |
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c |
212 |
+index c7b4481c90d7..d74d9a8cde2a 100644 |
213 |
+--- a/drivers/gpu/drm/drm_edid.c |
214 |
++++ b/drivers/gpu/drm/drm_edid.c |
215 |
+@@ -113,6 +113,9 @@ static const struct edid_quirk { |
216 |
+ /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */ |
217 |
+ { "AEO", 0, EDID_QUIRK_FORCE_6BPC }, |
218 |
+ |
219 |
++ /* BOE model on HP Pavilion 15-n233sl reports 8 bpc, but is a 6 bpc panel */ |
220 |
++ { "BOE", 0x78b, EDID_QUIRK_FORCE_6BPC }, |
221 |
++ |
222 |
+ /* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */ |
223 |
+ { "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC }, |
224 |
+ |
225 |
+@@ -4279,7 +4282,7 @@ static void drm_parse_ycbcr420_deep_color_info(struct drm_connector *connector, |
226 |
+ struct drm_hdmi_info *hdmi = &connector->display_info.hdmi; |
227 |
+ |
228 |
+ dc_mask = db[7] & DRM_EDID_YCBCR420_DC_MASK; |
229 |
+- hdmi->y420_dc_modes |= dc_mask; |
230 |
++ hdmi->y420_dc_modes = dc_mask; |
231 |
+ } |
232 |
+ |
233 |
+ static void drm_parse_hdmi_forum_vsdb(struct drm_connector *connector, |
234 |
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c |
235 |
+index 2ee1eaa66188..1ebac724fe7b 100644 |
236 |
+--- a/drivers/gpu/drm/drm_fb_helper.c |
237 |
++++ b/drivers/gpu/drm/drm_fb_helper.c |
238 |
+@@ -1561,6 +1561,25 @@ unlock: |
239 |
+ } |
240 |
+ EXPORT_SYMBOL(drm_fb_helper_ioctl); |
241 |
+ |
242 |
++static bool drm_fb_pixel_format_equal(const struct fb_var_screeninfo *var_1, |
243 |
++ const struct fb_var_screeninfo *var_2) |
244 |
++{ |
245 |
++ return var_1->bits_per_pixel == var_2->bits_per_pixel && |
246 |
++ var_1->grayscale == var_2->grayscale && |
247 |
++ var_1->red.offset == var_2->red.offset && |
248 |
++ var_1->red.length == var_2->red.length && |
249 |
++ var_1->red.msb_right == var_2->red.msb_right && |
250 |
++ var_1->green.offset == var_2->green.offset && |
251 |
++ var_1->green.length == var_2->green.length && |
252 |
++ var_1->green.msb_right == var_2->green.msb_right && |
253 |
++ var_1->blue.offset == var_2->blue.offset && |
254 |
++ var_1->blue.length == var_2->blue.length && |
255 |
++ var_1->blue.msb_right == var_2->blue.msb_right && |
256 |
++ var_1->transp.offset == var_2->transp.offset && |
257 |
++ var_1->transp.length == var_2->transp.length && |
258 |
++ var_1->transp.msb_right == var_2->transp.msb_right; |
259 |
++} |
260 |
++ |
261 |
+ /** |
262 |
+ * drm_fb_helper_check_var - implementation for &fb_ops.fb_check_var |
263 |
+ * @var: screeninfo to check |
264 |
+@@ -1571,7 +1590,6 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, |
265 |
+ { |
266 |
+ struct drm_fb_helper *fb_helper = info->par; |
267 |
+ struct drm_framebuffer *fb = fb_helper->fb; |
268 |
+- int depth; |
269 |
+ |
270 |
+ if (var->pixclock != 0 || in_dbg_master()) |
271 |
+ return -EINVAL; |
272 |
+@@ -1591,72 +1609,15 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, |
273 |
+ return -EINVAL; |
274 |
+ } |
275 |
+ |
276 |
+- switch (var->bits_per_pixel) { |
277 |
+- case 16: |
278 |
+- depth = (var->green.length == 6) ? 16 : 15; |
279 |
+- break; |
280 |
+- case 32: |
281 |
+- depth = (var->transp.length > 0) ? 32 : 24; |
282 |
+- break; |
283 |
+- default: |
284 |
+- depth = var->bits_per_pixel; |
285 |
+- break; |
286 |
+- } |
287 |
+- |
288 |
+- switch (depth) { |
289 |
+- case 8: |
290 |
+- var->red.offset = 0; |
291 |
+- var->green.offset = 0; |
292 |
+- var->blue.offset = 0; |
293 |
+- var->red.length = 8; |
294 |
+- var->green.length = 8; |
295 |
+- var->blue.length = 8; |
296 |
+- var->transp.length = 0; |
297 |
+- var->transp.offset = 0; |
298 |
+- break; |
299 |
+- case 15: |
300 |
+- var->red.offset = 10; |
301 |
+- var->green.offset = 5; |
302 |
+- var->blue.offset = 0; |
303 |
+- var->red.length = 5; |
304 |
+- var->green.length = 5; |
305 |
+- var->blue.length = 5; |
306 |
+- var->transp.length = 1; |
307 |
+- var->transp.offset = 15; |
308 |
+- break; |
309 |
+- case 16: |
310 |
+- var->red.offset = 11; |
311 |
+- var->green.offset = 5; |
312 |
+- var->blue.offset = 0; |
313 |
+- var->red.length = 5; |
314 |
+- var->green.length = 6; |
315 |
+- var->blue.length = 5; |
316 |
+- var->transp.length = 0; |
317 |
+- var->transp.offset = 0; |
318 |
+- break; |
319 |
+- case 24: |
320 |
+- var->red.offset = 16; |
321 |
+- var->green.offset = 8; |
322 |
+- var->blue.offset = 0; |
323 |
+- var->red.length = 8; |
324 |
+- var->green.length = 8; |
325 |
+- var->blue.length = 8; |
326 |
+- var->transp.length = 0; |
327 |
+- var->transp.offset = 0; |
328 |
+- break; |
329 |
+- case 32: |
330 |
+- var->red.offset = 16; |
331 |
+- var->green.offset = 8; |
332 |
+- var->blue.offset = 0; |
333 |
+- var->red.length = 8; |
334 |
+- var->green.length = 8; |
335 |
+- var->blue.length = 8; |
336 |
+- var->transp.length = 8; |
337 |
+- var->transp.offset = 24; |
338 |
+- break; |
339 |
+- default: |
340 |
++ /* |
341 |
++ * drm fbdev emulation doesn't support changing the pixel format at all, |
342 |
++ * so reject all pixel format changing requests. |
343 |
++ */ |
344 |
++ if (!drm_fb_pixel_format_equal(var, &info->var)) { |
345 |
++ DRM_DEBUG("fbdev emulation doesn't support changing the pixel format\n"); |
346 |
+ return -EINVAL; |
347 |
+ } |
348 |
++ |
349 |
+ return 0; |
350 |
+ } |
351 |
+ EXPORT_SYMBOL(drm_fb_helper_check_var); |
352 |
+diff --git a/drivers/gpu/drm/sun4i/sun4i_dotclock.c b/drivers/gpu/drm/sun4i/sun4i_dotclock.c |
353 |
+index e36004fbe453..2a15f2f9271e 100644 |
354 |
+--- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c |
355 |
++++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c |
356 |
+@@ -81,9 +81,19 @@ static long sun4i_dclk_round_rate(struct clk_hw *hw, unsigned long rate, |
357 |
+ int i; |
358 |
+ |
359 |
+ for (i = tcon->dclk_min_div; i <= tcon->dclk_max_div; i++) { |
360 |
+- unsigned long ideal = rate * i; |
361 |
++ u64 ideal = (u64)rate * i; |
362 |
+ unsigned long rounded; |
363 |
+ |
364 |
++ /* |
365 |
++ * ideal has overflowed the max value that can be stored in an |
366 |
++ * unsigned long, and every clk operation we might do on a |
367 |
++ * truncated u64 value will give us incorrect results. |
368 |
++ * Let's just stop there since bigger dividers will result in |
369 |
++ * the same overflow issue. |
370 |
++ */ |
371 |
++ if (ideal > ULONG_MAX) |
372 |
++ goto out; |
373 |
++ |
374 |
+ rounded = clk_hw_round_rate(clk_hw_get_parent(hw), |
375 |
+ ideal); |
376 |
+ |
377 |
+diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c |
378 |
+index 9eef96dacbd7..d93a719d25c1 100644 |
379 |
+--- a/drivers/infiniband/core/ucm.c |
380 |
++++ b/drivers/infiniband/core/ucm.c |
381 |
+@@ -46,6 +46,8 @@ |
382 |
+ #include <linux/mutex.h> |
383 |
+ #include <linux/slab.h> |
384 |
+ |
385 |
++#include <linux/nospec.h> |
386 |
++ |
387 |
+ #include <linux/uaccess.h> |
388 |
+ |
389 |
+ #include <rdma/ib.h> |
390 |
+@@ -1123,6 +1125,7 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, |
391 |
+ |
392 |
+ if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table)) |
393 |
+ return -EINVAL; |
394 |
++ hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucm_cmd_table)); |
395 |
+ |
396 |
+ if (hdr.in + sizeof(hdr) > len) |
397 |
+ return -EINVAL; |
398 |
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c |
399 |
+index 21863ddde63e..01d68ed46c1b 100644 |
400 |
+--- a/drivers/infiniband/core/ucma.c |
401 |
++++ b/drivers/infiniband/core/ucma.c |
402 |
+@@ -44,6 +44,8 @@ |
403 |
+ #include <linux/module.h> |
404 |
+ #include <linux/nsproxy.h> |
405 |
+ |
406 |
++#include <linux/nospec.h> |
407 |
++ |
408 |
+ #include <rdma/rdma_user_cm.h> |
409 |
+ #include <rdma/ib_marshall.h> |
410 |
+ #include <rdma/rdma_cm.h> |
411 |
+@@ -1676,6 +1678,7 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, |
412 |
+ |
413 |
+ if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table)) |
414 |
+ return -EINVAL; |
415 |
++ hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucma_cmd_table)); |
416 |
+ |
417 |
+ if (hdr.in + sizeof(hdr) > len) |
418 |
+ return -EINVAL; |
419 |
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c |
420 |
+index f5ae24865355..b0f9d19b3410 100644 |
421 |
+--- a/drivers/input/mouse/elan_i2c_core.c |
422 |
++++ b/drivers/input/mouse/elan_i2c_core.c |
423 |
+@@ -1346,6 +1346,7 @@ static const struct acpi_device_id elan_acpi_id[] = { |
424 |
+ { "ELAN0611", 0 }, |
425 |
+ { "ELAN0612", 0 }, |
426 |
+ { "ELAN0618", 0 }, |
427 |
++ { "ELAN061C", 0 }, |
428 |
+ { "ELAN061D", 0 }, |
429 |
+ { "ELAN0622", 0 }, |
430 |
+ { "ELAN1000", 0 }, |
431 |
+diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c |
432 |
+index f5cc517d1131..7e50e1d6f58c 100644 |
433 |
+--- a/drivers/misc/eeprom/at24.c |
434 |
++++ b/drivers/misc/eeprom/at24.c |
435 |
+@@ -478,6 +478,23 @@ static void at24_properties_to_pdata(struct device *dev, |
436 |
+ if (device_property_present(dev, "no-read-rollover")) |
437 |
+ chip->flags |= AT24_FLAG_NO_RDROL; |
438 |
+ |
439 |
++ err = device_property_read_u32(dev, "address-width", &val); |
440 |
++ if (!err) { |
441 |
++ switch (val) { |
442 |
++ case 8: |
443 |
++ if (chip->flags & AT24_FLAG_ADDR16) |
444 |
++ dev_warn(dev, "Override address width to be 8, while default is 16\n"); |
445 |
++ chip->flags &= ~AT24_FLAG_ADDR16; |
446 |
++ break; |
447 |
++ case 16: |
448 |
++ chip->flags |= AT24_FLAG_ADDR16; |
449 |
++ break; |
450 |
++ default: |
451 |
++ dev_warn(dev, "Bad \"address-width\" property: %u\n", |
452 |
++ val); |
453 |
++ } |
454 |
++ } |
455 |
++ |
456 |
+ err = device_property_read_u32(dev, "size", &val); |
457 |
+ if (!err) |
458 |
+ chip->byte_len = val; |
459 |
+diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c |
460 |
+index 01b0e2bb3319..2012551d93e0 100644 |
461 |
+--- a/drivers/ptp/ptp_chardev.c |
462 |
++++ b/drivers/ptp/ptp_chardev.c |
463 |
+@@ -24,6 +24,8 @@ |
464 |
+ #include <linux/slab.h> |
465 |
+ #include <linux/timekeeping.h> |
466 |
+ |
467 |
++#include <linux/nospec.h> |
468 |
++ |
469 |
+ #include "ptp_private.h" |
470 |
+ |
471 |
+ static int ptp_disable_pinfunc(struct ptp_clock_info *ops, |
472 |
+@@ -248,6 +250,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) |
473 |
+ err = -EINVAL; |
474 |
+ break; |
475 |
+ } |
476 |
++ pin_index = array_index_nospec(pin_index, ops->n_pins); |
477 |
+ if (mutex_lock_interruptible(&ptp->pincfg_mux)) |
478 |
+ return -ERESTARTSYS; |
479 |
+ pd = ops->pin_config[pin_index]; |
480 |
+@@ -266,6 +269,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) |
481 |
+ err = -EINVAL; |
482 |
+ break; |
483 |
+ } |
484 |
++ pin_index = array_index_nospec(pin_index, ops->n_pins); |
485 |
+ if (mutex_lock_interruptible(&ptp->pincfg_mux)) |
486 |
+ return -ERESTARTSYS; |
487 |
+ err = ptp_set_pinfunc(ptp, pin_index, pd.func, pd.chan); |
488 |
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
489 |
+index 84f52774810a..b61d101894ef 100644 |
490 |
+--- a/drivers/usb/class/cdc-acm.c |
491 |
++++ b/drivers/usb/class/cdc-acm.c |
492 |
+@@ -309,17 +309,17 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf) |
493 |
+ |
494 |
+ if (difference & ACM_CTRL_DSR) |
495 |
+ acm->iocount.dsr++; |
496 |
+- if (difference & ACM_CTRL_BRK) |
497 |
+- acm->iocount.brk++; |
498 |
+- if (difference & ACM_CTRL_RI) |
499 |
+- acm->iocount.rng++; |
500 |
+ if (difference & ACM_CTRL_DCD) |
501 |
+ acm->iocount.dcd++; |
502 |
+- if (difference & ACM_CTRL_FRAMING) |
503 |
++ if (newctrl & ACM_CTRL_BRK) |
504 |
++ acm->iocount.brk++; |
505 |
++ if (newctrl & ACM_CTRL_RI) |
506 |
++ acm->iocount.rng++; |
507 |
++ if (newctrl & ACM_CTRL_FRAMING) |
508 |
+ acm->iocount.frame++; |
509 |
+- if (difference & ACM_CTRL_PARITY) |
510 |
++ if (newctrl & ACM_CTRL_PARITY) |
511 |
+ acm->iocount.parity++; |
512 |
+- if (difference & ACM_CTRL_OVERRUN) |
513 |
++ if (newctrl & ACM_CTRL_OVERRUN) |
514 |
+ acm->iocount.overrun++; |
515 |
+ spin_unlock(&acm->read_lock); |
516 |
+ |
517 |
+@@ -354,7 +354,6 @@ static void acm_ctrl_irq(struct urb *urb) |
518 |
+ case -ENOENT: |
519 |
+ case -ESHUTDOWN: |
520 |
+ /* this urb is terminated, clean up */ |
521 |
+- acm->nb_index = 0; |
522 |
+ dev_dbg(&acm->control->dev, |
523 |
+ "%s - urb shutting down with status: %d\n", |
524 |
+ __func__, status); |
525 |
+@@ -1642,6 +1641,7 @@ static int acm_pre_reset(struct usb_interface *intf) |
526 |
+ struct acm *acm = usb_get_intfdata(intf); |
527 |
+ |
528 |
+ clear_bit(EVENT_RX_STALL, &acm->flags); |
529 |
++ acm->nb_index = 0; /* pending control transfers are lost */ |
530 |
+ |
531 |
+ return 0; |
532 |
+ } |
533 |
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c |
534 |
+index e1e0c90ce569..2e66711dac9c 100644 |
535 |
+--- a/drivers/usb/core/devio.c |
536 |
++++ b/drivers/usb/core/devio.c |
537 |
+@@ -1473,8 +1473,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb |
538 |
+ u = 0; |
539 |
+ switch (uurb->type) { |
540 |
+ case USBDEVFS_URB_TYPE_CONTROL: |
541 |
+- if (is_in) |
542 |
+- allow_short = true; |
543 |
+ if (!usb_endpoint_xfer_control(&ep->desc)) |
544 |
+ return -EINVAL; |
545 |
+ /* min 8 byte setup packet */ |
546 |
+@@ -1504,6 +1502,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb |
547 |
+ is_in = 0; |
548 |
+ uurb->endpoint &= ~USB_DIR_IN; |
549 |
+ } |
550 |
++ if (is_in) |
551 |
++ allow_short = true; |
552 |
+ snoop(&ps->dev->dev, "control urb: bRequestType=%02x " |
553 |
+ "bRequest=%02x wValue=%04x " |
554 |
+ "wIndex=%04x wLength=%04x\n", |
555 |
+diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c |
556 |
+index acecd13dcbd9..b29620e5df83 100644 |
557 |
+--- a/drivers/usb/gadget/function/f_mass_storage.c |
558 |
++++ b/drivers/usb/gadget/function/f_mass_storage.c |
559 |
+@@ -222,6 +222,8 @@ |
560 |
+ #include <linux/usb/gadget.h> |
561 |
+ #include <linux/usb/composite.h> |
562 |
+ |
563 |
++#include <linux/nospec.h> |
564 |
++ |
565 |
+ #include "configfs.h" |
566 |
+ |
567 |
+ |
568 |
+@@ -3171,6 +3173,7 @@ static struct config_group *fsg_lun_make(struct config_group *group, |
569 |
+ fsg_opts = to_fsg_opts(&group->cg_item); |
570 |
+ if (num >= FSG_MAX_LUNS) |
571 |
+ return ERR_PTR(-ERANGE); |
572 |
++ num = array_index_nospec(num, FSG_MAX_LUNS); |
573 |
+ |
574 |
+ mutex_lock(&fsg_opts->lock); |
575 |
+ if (fsg_opts->refcnt || fsg_opts->common->luns[num]) { |
576 |
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c |
577 |
+index 722860eb5a91..51dd8e00c4f8 100644 |
578 |
+--- a/drivers/usb/host/xhci-pci.c |
579 |
++++ b/drivers/usb/host/xhci-pci.c |
580 |
+@@ -179,10 +179,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) |
581 |
+ xhci->quirks |= XHCI_PME_STUCK_QUIRK; |
582 |
+ } |
583 |
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL && |
584 |
+- pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) { |
585 |
++ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) |
586 |
+ xhci->quirks |= XHCI_SSIC_PORT_UNUSED; |
587 |
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL && |
588 |
++ (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || |
589 |
++ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) |
590 |
+ xhci->quirks |= XHCI_INTEL_USB_ROLE_SW; |
591 |
+- } |
592 |
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL && |
593 |
+ (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || |
594 |
+ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || |
595 |
+diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c |
596 |
+index 1fb3dd0f1dfa..277de96181f9 100644 |
597 |
+--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c |
598 |
++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c |
599 |
+@@ -161,6 +161,8 @@ static int intel_xhci_usb_remove(struct platform_device *pdev) |
600 |
+ { |
601 |
+ struct intel_xhci_usb_data *data = platform_get_drvdata(pdev); |
602 |
+ |
603 |
++ pm_runtime_disable(&pdev->dev); |
604 |
++ |
605 |
+ usb_role_switch_unregister(data->role_sw); |
606 |
+ return 0; |
607 |
+ } |
608 |
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c |
609 |
+index d11f3f8dad40..1e592ec94ba4 100644 |
610 |
+--- a/drivers/usb/usbip/vhci_hcd.c |
611 |
++++ b/drivers/usb/usbip/vhci_hcd.c |
612 |
+@@ -318,8 +318,9 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
613 |
+ struct vhci_hcd *vhci_hcd; |
614 |
+ struct vhci *vhci; |
615 |
+ int retval = 0; |
616 |
+- int rhport; |
617 |
++ int rhport = -1; |
618 |
+ unsigned long flags; |
619 |
++ bool invalid_rhport = false; |
620 |
+ |
621 |
+ u32 prev_port_status[VHCI_HC_PORTS]; |
622 |
+ |
623 |
+@@ -334,9 +335,19 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
624 |
+ usbip_dbg_vhci_rh("typeReq %x wValue %x wIndex %x\n", typeReq, wValue, |
625 |
+ wIndex); |
626 |
+ |
627 |
+- if (wIndex > VHCI_HC_PORTS) |
628 |
+- pr_err("invalid port number %d\n", wIndex); |
629 |
+- rhport = wIndex - 1; |
630 |
++ /* |
631 |
++ * wIndex can be 0 for some request types (typeReq). rhport is |
632 |
++ * in valid range when wIndex >= 1 and < VHCI_HC_PORTS. |
633 |
++ * |
634 |
++ * Reference port_status[] only with valid rhport when |
635 |
++ * invalid_rhport is false. |
636 |
++ */ |
637 |
++ if (wIndex < 1 || wIndex > VHCI_HC_PORTS) { |
638 |
++ invalid_rhport = true; |
639 |
++ if (wIndex > VHCI_HC_PORTS) |
640 |
++ pr_err("invalid port number %d\n", wIndex); |
641 |
++ } else |
642 |
++ rhport = wIndex - 1; |
643 |
+ |
644 |
+ vhci_hcd = hcd_to_vhci_hcd(hcd); |
645 |
+ vhci = vhci_hcd->vhci; |
646 |
+@@ -345,8 +356,9 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
647 |
+ |
648 |
+ /* store old status and compare now and old later */ |
649 |
+ if (usbip_dbg_flag_vhci_rh) { |
650 |
+- memcpy(prev_port_status, vhci_hcd->port_status, |
651 |
+- sizeof(prev_port_status)); |
652 |
++ if (!invalid_rhport) |
653 |
++ memcpy(prev_port_status, vhci_hcd->port_status, |
654 |
++ sizeof(prev_port_status)); |
655 |
+ } |
656 |
+ |
657 |
+ switch (typeReq) { |
658 |
+@@ -354,8 +366,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
659 |
+ usbip_dbg_vhci_rh(" ClearHubFeature\n"); |
660 |
+ break; |
661 |
+ case ClearPortFeature: |
662 |
+- if (rhport < 0) |
663 |
++ if (invalid_rhport) { |
664 |
++ pr_err("invalid port number %d\n", wIndex); |
665 |
+ goto error; |
666 |
++ } |
667 |
+ switch (wValue) { |
668 |
+ case USB_PORT_FEAT_SUSPEND: |
669 |
+ if (hcd->speed == HCD_USB3) { |
670 |
+@@ -415,9 +429,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
671 |
+ break; |
672 |
+ case GetPortStatus: |
673 |
+ usbip_dbg_vhci_rh(" GetPortStatus port %x\n", wIndex); |
674 |
+- if (wIndex < 1) { |
675 |
++ if (invalid_rhport) { |
676 |
+ pr_err("invalid port number %d\n", wIndex); |
677 |
+ retval = -EPIPE; |
678 |
++ goto error; |
679 |
+ } |
680 |
+ |
681 |
+ /* we do not care about resume. */ |
682 |
+@@ -513,16 +528,20 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
683 |
+ goto error; |
684 |
+ } |
685 |
+ |
686 |
+- if (rhport < 0) |
687 |
++ if (invalid_rhport) { |
688 |
++ pr_err("invalid port number %d\n", wIndex); |
689 |
+ goto error; |
690 |
++ } |
691 |
+ |
692 |
+ vhci_hcd->port_status[rhport] |= USB_PORT_STAT_SUSPEND; |
693 |
+ break; |
694 |
+ case USB_PORT_FEAT_POWER: |
695 |
+ usbip_dbg_vhci_rh( |
696 |
+ " SetPortFeature: USB_PORT_FEAT_POWER\n"); |
697 |
+- if (rhport < 0) |
698 |
++ if (invalid_rhport) { |
699 |
++ pr_err("invalid port number %d\n", wIndex); |
700 |
+ goto error; |
701 |
++ } |
702 |
+ if (hcd->speed == HCD_USB3) |
703 |
+ vhci_hcd->port_status[rhport] |= USB_SS_PORT_STAT_POWER; |
704 |
+ else |
705 |
+@@ -531,8 +550,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
706 |
+ case USB_PORT_FEAT_BH_PORT_RESET: |
707 |
+ usbip_dbg_vhci_rh( |
708 |
+ " SetPortFeature: USB_PORT_FEAT_BH_PORT_RESET\n"); |
709 |
+- if (rhport < 0) |
710 |
++ if (invalid_rhport) { |
711 |
++ pr_err("invalid port number %d\n", wIndex); |
712 |
+ goto error; |
713 |
++ } |
714 |
+ /* Applicable only for USB3.0 hub */ |
715 |
+ if (hcd->speed != HCD_USB3) { |
716 |
+ pr_err("USB_PORT_FEAT_BH_PORT_RESET req not " |
717 |
+@@ -543,8 +564,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
718 |
+ case USB_PORT_FEAT_RESET: |
719 |
+ usbip_dbg_vhci_rh( |
720 |
+ " SetPortFeature: USB_PORT_FEAT_RESET\n"); |
721 |
+- if (rhport < 0) |
722 |
++ if (invalid_rhport) { |
723 |
++ pr_err("invalid port number %d\n", wIndex); |
724 |
+ goto error; |
725 |
++ } |
726 |
+ /* if it's already enabled, disable */ |
727 |
+ if (hcd->speed == HCD_USB3) { |
728 |
+ vhci_hcd->port_status[rhport] = 0; |
729 |
+@@ -565,8 +588,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
730 |
+ default: |
731 |
+ usbip_dbg_vhci_rh(" SetPortFeature: default %d\n", |
732 |
+ wValue); |
733 |
+- if (rhport < 0) |
734 |
++ if (invalid_rhport) { |
735 |
++ pr_err("invalid port number %d\n", wIndex); |
736 |
+ goto error; |
737 |
++ } |
738 |
+ if (hcd->speed == HCD_USB3) { |
739 |
+ if ((vhci_hcd->port_status[rhport] & |
740 |
+ USB_SS_PORT_STAT_POWER) != 0) { |
741 |
+@@ -608,7 +633,7 @@ error: |
742 |
+ if (usbip_dbg_flag_vhci_rh) { |
743 |
+ pr_debug("port %d\n", rhport); |
744 |
+ /* Only dump valid port status */ |
745 |
+- if (rhport >= 0) { |
746 |
++ if (!invalid_rhport) { |
747 |
+ dump_port_status_diff(prev_port_status[rhport], |
748 |
+ vhci_hcd->port_status[rhport], |
749 |
+ hcd->speed == HCD_USB3); |
750 |
+@@ -618,8 +643,10 @@ error: |
751 |
+ |
752 |
+ spin_unlock_irqrestore(&vhci->lock, flags); |
753 |
+ |
754 |
+- if ((vhci_hcd->port_status[rhport] & PORT_C_MASK) != 0) |
755 |
++ if (!invalid_rhport && |
756 |
++ (vhci_hcd->port_status[rhport] & PORT_C_MASK) != 0) { |
757 |
+ usb_hcd_poll_rh_status(hcd); |
758 |
++ } |
759 |
+ |
760 |
+ return retval; |
761 |
+ } |
762 |
+diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c |
763 |
+index af2b17b21b94..95983c744164 100644 |
764 |
+--- a/fs/cachefiles/namei.c |
765 |
++++ b/fs/cachefiles/namei.c |
766 |
+@@ -343,7 +343,7 @@ try_again: |
767 |
+ trap = lock_rename(cache->graveyard, dir); |
768 |
+ |
769 |
+ /* do some checks before getting the grave dentry */ |
770 |
+- if (rep->d_parent != dir) { |
771 |
++ if (rep->d_parent != dir || IS_DEADDIR(d_inode(rep))) { |
772 |
+ /* the entry was probably culled when we dropped the parent dir |
773 |
+ * lock */ |
774 |
+ unlock_rename(cache->graveyard, dir); |
775 |
+diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c |
776 |
+index 83bfe04456b6..c550512ce335 100644 |
777 |
+--- a/fs/fscache/cookie.c |
778 |
++++ b/fs/fscache/cookie.c |
779 |
+@@ -70,20 +70,7 @@ void fscache_free_cookie(struct fscache_cookie *cookie) |
780 |
+ } |
781 |
+ |
782 |
+ /* |
783 |
+- * initialise an cookie jar slab element prior to any use |
784 |
+- */ |
785 |
+-void fscache_cookie_init_once(void *_cookie) |
786 |
+-{ |
787 |
+- struct fscache_cookie *cookie = _cookie; |
788 |
+- |
789 |
+- memset(cookie, 0, sizeof(*cookie)); |
790 |
+- spin_lock_init(&cookie->lock); |
791 |
+- spin_lock_init(&cookie->stores_lock); |
792 |
+- INIT_HLIST_HEAD(&cookie->backing_objects); |
793 |
+-} |
794 |
+- |
795 |
+-/* |
796 |
+- * Set the index key in a cookie. The cookie struct has space for a 12-byte |
797 |
++ * Set the index key in a cookie. The cookie struct has space for a 16-byte |
798 |
+ * key plus length and hash, but if that's not big enough, it's instead a |
799 |
+ * pointer to a buffer containing 3 bytes of hash, 1 byte of length and then |
800 |
+ * the key data. |
801 |
+@@ -93,20 +80,18 @@ static int fscache_set_key(struct fscache_cookie *cookie, |
802 |
+ { |
803 |
+ unsigned long long h; |
804 |
+ u32 *buf; |
805 |
++ int bufs; |
806 |
+ int i; |
807 |
+ |
808 |
+- cookie->key_len = index_key_len; |
809 |
++ bufs = DIV_ROUND_UP(index_key_len, sizeof(*buf)); |
810 |
+ |
811 |
+ if (index_key_len > sizeof(cookie->inline_key)) { |
812 |
+- buf = kzalloc(index_key_len, GFP_KERNEL); |
813 |
++ buf = kcalloc(bufs, sizeof(*buf), GFP_KERNEL); |
814 |
+ if (!buf) |
815 |
+ return -ENOMEM; |
816 |
+ cookie->key = buf; |
817 |
+ } else { |
818 |
+ buf = (u32 *)cookie->inline_key; |
819 |
+- buf[0] = 0; |
820 |
+- buf[1] = 0; |
821 |
+- buf[2] = 0; |
822 |
+ } |
823 |
+ |
824 |
+ memcpy(buf, index_key, index_key_len); |
825 |
+@@ -116,7 +101,8 @@ static int fscache_set_key(struct fscache_cookie *cookie, |
826 |
+ */ |
827 |
+ h = (unsigned long)cookie->parent; |
828 |
+ h += index_key_len + cookie->type; |
829 |
+- for (i = 0; i < (index_key_len + sizeof(u32) - 1) / sizeof(u32); i++) |
830 |
++ |
831 |
++ for (i = 0; i < bufs; i++) |
832 |
+ h += buf[i]; |
833 |
+ |
834 |
+ cookie->key_hash = h ^ (h >> 32); |
835 |
+@@ -161,7 +147,7 @@ struct fscache_cookie *fscache_alloc_cookie( |
836 |
+ struct fscache_cookie *cookie; |
837 |
+ |
838 |
+ /* allocate and initialise a cookie */ |
839 |
+- cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL); |
840 |
++ cookie = kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL); |
841 |
+ if (!cookie) |
842 |
+ return NULL; |
843 |
+ |
844 |
+@@ -192,6 +178,9 @@ struct fscache_cookie *fscache_alloc_cookie( |
845 |
+ cookie->netfs_data = netfs_data; |
846 |
+ cookie->flags = (1 << FSCACHE_COOKIE_NO_DATA_YET); |
847 |
+ cookie->type = def->type; |
848 |
++ spin_lock_init(&cookie->lock); |
849 |
++ spin_lock_init(&cookie->stores_lock); |
850 |
++ INIT_HLIST_HEAD(&cookie->backing_objects); |
851 |
+ |
852 |
+ /* radix tree insertion won't use the preallocation pool unless it's |
853 |
+ * told it may not wait */ |
854 |
+diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h |
855 |
+index f83328a7f048..d6209022e965 100644 |
856 |
+--- a/fs/fscache/internal.h |
857 |
++++ b/fs/fscache/internal.h |
858 |
+@@ -51,7 +51,6 @@ extern struct fscache_cache *fscache_select_cache_for_object( |
859 |
+ extern struct kmem_cache *fscache_cookie_jar; |
860 |
+ |
861 |
+ extern void fscache_free_cookie(struct fscache_cookie *); |
862 |
+-extern void fscache_cookie_init_once(void *); |
863 |
+ extern struct fscache_cookie *fscache_alloc_cookie(struct fscache_cookie *, |
864 |
+ const struct fscache_cookie_def *, |
865 |
+ const void *, size_t, |
866 |
+diff --git a/fs/fscache/main.c b/fs/fscache/main.c |
867 |
+index 7dce110bf17d..30ad89db1efc 100644 |
868 |
+--- a/fs/fscache/main.c |
869 |
++++ b/fs/fscache/main.c |
870 |
+@@ -143,9 +143,7 @@ static int __init fscache_init(void) |
871 |
+ |
872 |
+ fscache_cookie_jar = kmem_cache_create("fscache_cookie_jar", |
873 |
+ sizeof(struct fscache_cookie), |
874 |
+- 0, |
875 |
+- 0, |
876 |
+- fscache_cookie_init_once); |
877 |
++ 0, 0, NULL); |
878 |
+ if (!fscache_cookie_jar) { |
879 |
+ pr_notice("Failed to allocate a cookie jar\n"); |
880 |
+ ret = -ENOMEM; |
881 |
+diff --git a/fs/ioctl.c b/fs/ioctl.c |
882 |
+index b445b13fc59b..5444fec607ce 100644 |
883 |
+--- a/fs/ioctl.c |
884 |
++++ b/fs/ioctl.c |
885 |
+@@ -229,7 +229,7 @@ static long ioctl_file_clone(struct file *dst_file, unsigned long srcfd, |
886 |
+ ret = -EXDEV; |
887 |
+ if (src_file.file->f_path.mnt != dst_file->f_path.mnt) |
888 |
+ goto fdput; |
889 |
+- ret = do_clone_file_range(src_file.file, off, dst_file, destoff, olen); |
890 |
++ ret = vfs_clone_file_range(src_file.file, off, dst_file, destoff, olen); |
891 |
+ fdput: |
892 |
+ fdput(src_file); |
893 |
+ return ret; |
894 |
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c |
895 |
+index b0555d7d8200..613d2fe2dddd 100644 |
896 |
+--- a/fs/nfsd/vfs.c |
897 |
++++ b/fs/nfsd/vfs.c |
898 |
+@@ -541,7 +541,8 @@ __be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp, |
899 |
+ __be32 nfsd4_clone_file_range(struct file *src, u64 src_pos, struct file *dst, |
900 |
+ u64 dst_pos, u64 count) |
901 |
+ { |
902 |
+- return nfserrno(do_clone_file_range(src, src_pos, dst, dst_pos, count)); |
903 |
++ return nfserrno(vfs_clone_file_range(src, src_pos, dst, dst_pos, |
904 |
++ count)); |
905 |
+ } |
906 |
+ |
907 |
+ ssize_t nfsd_copy_file_range(struct file *src, u64 src_pos, struct file *dst, |
908 |
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c |
909 |
+index ddaddb4ce4c3..26b477f2538d 100644 |
910 |
+--- a/fs/overlayfs/copy_up.c |
911 |
++++ b/fs/overlayfs/copy_up.c |
912 |
+@@ -156,7 +156,7 @@ static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len) |
913 |
+ } |
914 |
+ |
915 |
+ /* Try to use clone_file_range to clone up within the same fs */ |
916 |
+- error = vfs_clone_file_range(old_file, 0, new_file, 0, len); |
917 |
++ error = do_clone_file_range(old_file, 0, new_file, 0, len); |
918 |
+ if (!error) |
919 |
+ goto out; |
920 |
+ /* Couldn't clone, so now we try to copy the data */ |
921 |
+diff --git a/fs/read_write.c b/fs/read_write.c |
922 |
+index 153f8f690490..c9d489684335 100644 |
923 |
+--- a/fs/read_write.c |
924 |
++++ b/fs/read_write.c |
925 |
+@@ -1818,8 +1818,8 @@ int vfs_clone_file_prep_inodes(struct inode *inode_in, loff_t pos_in, |
926 |
+ } |
927 |
+ EXPORT_SYMBOL(vfs_clone_file_prep_inodes); |
928 |
+ |
929 |
+-int vfs_clone_file_range(struct file *file_in, loff_t pos_in, |
930 |
+- struct file *file_out, loff_t pos_out, u64 len) |
931 |
++int do_clone_file_range(struct file *file_in, loff_t pos_in, |
932 |
++ struct file *file_out, loff_t pos_out, u64 len) |
933 |
+ { |
934 |
+ struct inode *inode_in = file_inode(file_in); |
935 |
+ struct inode *inode_out = file_inode(file_out); |
936 |
+@@ -1866,6 +1866,19 @@ int vfs_clone_file_range(struct file *file_in, loff_t pos_in, |
937 |
+ |
938 |
+ return ret; |
939 |
+ } |
940 |
++EXPORT_SYMBOL(do_clone_file_range); |
941 |
++ |
942 |
++int vfs_clone_file_range(struct file *file_in, loff_t pos_in, |
943 |
++ struct file *file_out, loff_t pos_out, u64 len) |
944 |
++{ |
945 |
++ int ret; |
946 |
++ |
947 |
++ file_start_write(file_out); |
948 |
++ ret = do_clone_file_range(file_in, pos_in, file_out, pos_out, len); |
949 |
++ file_end_write(file_out); |
950 |
++ |
951 |
++ return ret; |
952 |
++} |
953 |
+ EXPORT_SYMBOL(vfs_clone_file_range); |
954 |
+ |
955 |
+ /* |
956 |
+diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h |
957 |
+index b25d12ef120a..e3c404833115 100644 |
958 |
+--- a/include/drm/drm_edid.h |
959 |
++++ b/include/drm/drm_edid.h |
960 |
+@@ -214,9 +214,9 @@ struct detailed_timing { |
961 |
+ #define DRM_EDID_HDMI_DC_Y444 (1 << 3) |
962 |
+ |
963 |
+ /* YCBCR 420 deep color modes */ |
964 |
+-#define DRM_EDID_YCBCR420_DC_48 (1 << 6) |
965 |
+-#define DRM_EDID_YCBCR420_DC_36 (1 << 5) |
966 |
+-#define DRM_EDID_YCBCR420_DC_30 (1 << 4) |
967 |
++#define DRM_EDID_YCBCR420_DC_48 (1 << 2) |
968 |
++#define DRM_EDID_YCBCR420_DC_36 (1 << 1) |
969 |
++#define DRM_EDID_YCBCR420_DC_30 (1 << 0) |
970 |
+ #define DRM_EDID_YCBCR420_DC_MASK (DRM_EDID_YCBCR420_DC_48 | \ |
971 |
+ DRM_EDID_YCBCR420_DC_36 | \ |
972 |
+ DRM_EDID_YCBCR420_DC_30) |
973 |
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h |
974 |
+index 38b04f559ad3..1fd6fa822d2c 100644 |
975 |
+--- a/include/linux/bpf_verifier.h |
976 |
++++ b/include/linux/bpf_verifier.h |
977 |
+@@ -50,6 +50,9 @@ struct bpf_reg_state { |
978 |
+ * PTR_TO_MAP_VALUE_OR_NULL |
979 |
+ */ |
980 |
+ struct bpf_map *map_ptr; |
981 |
++ |
982 |
++ /* Max size from any of the above. */ |
983 |
++ unsigned long raw; |
984 |
+ }; |
985 |
+ /* Fixed part of pointer offset, pointer types only */ |
986 |
+ s32 off; |
987 |
+diff --git a/include/linux/fs.h b/include/linux/fs.h |
988 |
+index a3afa50bb79f..e73363bd8646 100644 |
989 |
+--- a/include/linux/fs.h |
990 |
++++ b/include/linux/fs.h |
991 |
+@@ -1813,8 +1813,10 @@ extern ssize_t vfs_copy_file_range(struct file *, loff_t , struct file *, |
992 |
+ extern int vfs_clone_file_prep_inodes(struct inode *inode_in, loff_t pos_in, |
993 |
+ struct inode *inode_out, loff_t pos_out, |
994 |
+ u64 *len, bool is_dedupe); |
995 |
++extern int do_clone_file_range(struct file *file_in, loff_t pos_in, |
996 |
++ struct file *file_out, loff_t pos_out, u64 len); |
997 |
+ extern int vfs_clone_file_range(struct file *file_in, loff_t pos_in, |
998 |
+- struct file *file_out, loff_t pos_out, u64 len); |
999 |
++ struct file *file_out, loff_t pos_out, u64 len); |
1000 |
+ extern int vfs_dedupe_file_range_compare(struct inode *src, loff_t srcoff, |
1001 |
+ struct inode *dest, loff_t destoff, |
1002 |
+ loff_t len, bool *is_same); |
1003 |
+@@ -2755,19 +2757,6 @@ static inline void file_end_write(struct file *file) |
1004 |
+ __sb_end_write(file_inode(file)->i_sb, SB_FREEZE_WRITE); |
1005 |
+ } |
1006 |
+ |
1007 |
+-static inline int do_clone_file_range(struct file *file_in, loff_t pos_in, |
1008 |
+- struct file *file_out, loff_t pos_out, |
1009 |
+- u64 len) |
1010 |
+-{ |
1011 |
+- int ret; |
1012 |
+- |
1013 |
+- file_start_write(file_out); |
1014 |
+- ret = vfs_clone_file_range(file_in, pos_in, file_out, pos_out, len); |
1015 |
+- file_end_write(file_out); |
1016 |
+- |
1017 |
+- return ret; |
1018 |
+-} |
1019 |
+- |
1020 |
+ /* |
1021 |
+ * get_write_access() gets write permission for a file. |
1022 |
+ * put_write_access() releases this write permission. |
1023 |
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c |
1024 |
+index 82e8edef6ea0..b000686fa1a1 100644 |
1025 |
+--- a/kernel/bpf/verifier.c |
1026 |
++++ b/kernel/bpf/verifier.c |
1027 |
+@@ -2731,7 +2731,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, |
1028 |
+ dst_reg->umax_value = umax_ptr; |
1029 |
+ dst_reg->var_off = ptr_reg->var_off; |
1030 |
+ dst_reg->off = ptr_reg->off + smin_val; |
1031 |
+- dst_reg->range = ptr_reg->range; |
1032 |
++ dst_reg->raw = ptr_reg->raw; |
1033 |
+ break; |
1034 |
+ } |
1035 |
+ /* A new variable offset is created. Note that off_reg->off |
1036 |
+@@ -2761,10 +2761,11 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, |
1037 |
+ } |
1038 |
+ dst_reg->var_off = tnum_add(ptr_reg->var_off, off_reg->var_off); |
1039 |
+ dst_reg->off = ptr_reg->off; |
1040 |
++ dst_reg->raw = ptr_reg->raw; |
1041 |
+ if (reg_is_pkt_pointer(ptr_reg)) { |
1042 |
+ dst_reg->id = ++env->id_gen; |
1043 |
+ /* something was added to pkt_ptr, set range to zero */ |
1044 |
+- dst_reg->range = 0; |
1045 |
++ dst_reg->raw = 0; |
1046 |
+ } |
1047 |
+ break; |
1048 |
+ case BPF_SUB: |
1049 |
+@@ -2793,7 +2794,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, |
1050 |
+ dst_reg->var_off = ptr_reg->var_off; |
1051 |
+ dst_reg->id = ptr_reg->id; |
1052 |
+ dst_reg->off = ptr_reg->off - smin_val; |
1053 |
+- dst_reg->range = ptr_reg->range; |
1054 |
++ dst_reg->raw = ptr_reg->raw; |
1055 |
+ break; |
1056 |
+ } |
1057 |
+ /* A new variable offset is created. If the subtrahend is known |
1058 |
+@@ -2819,11 +2820,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, |
1059 |
+ } |
1060 |
+ dst_reg->var_off = tnum_sub(ptr_reg->var_off, off_reg->var_off); |
1061 |
+ dst_reg->off = ptr_reg->off; |
1062 |
++ dst_reg->raw = ptr_reg->raw; |
1063 |
+ if (reg_is_pkt_pointer(ptr_reg)) { |
1064 |
+ dst_reg->id = ++env->id_gen; |
1065 |
+ /* something was added to pkt_ptr, set range to zero */ |
1066 |
+ if (smin_val < 0) |
1067 |
+- dst_reg->range = 0; |
1068 |
++ dst_reg->raw = 0; |
1069 |
+ } |
1070 |
+ break; |
1071 |
+ case BPF_AND: |
1072 |
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c |
1073 |
+index 26526fc41f0d..b27b9509ea89 100644 |
1074 |
+--- a/kernel/sched/fair.c |
1075 |
++++ b/kernel/sched/fair.c |
1076 |
+@@ -4797,9 +4797,13 @@ static void throttle_cfs_rq(struct cfs_rq *cfs_rq) |
1077 |
+ |
1078 |
+ /* |
1079 |
+ * Add to the _head_ of the list, so that an already-started |
1080 |
+- * distribute_cfs_runtime will not see us |
1081 |
++ * distribute_cfs_runtime will not see us. If disribute_cfs_runtime is |
1082 |
++ * not running add to the tail so that later runqueues don't get starved. |
1083 |
+ */ |
1084 |
+- list_add_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); |
1085 |
++ if (cfs_b->distribute_running) |
1086 |
++ list_add_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); |
1087 |
++ else |
1088 |
++ list_add_tail_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); |
1089 |
+ |
1090 |
+ /* |
1091 |
+ * If we're the first throttled task, make sure the bandwidth |
1092 |
+@@ -4943,14 +4947,16 @@ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun) |
1093 |
+ * in us over-using our runtime if it is all used during this loop, but |
1094 |
+ * only by limited amounts in that extreme case. |
1095 |
+ */ |
1096 |
+- while (throttled && cfs_b->runtime > 0) { |
1097 |
++ while (throttled && cfs_b->runtime > 0 && !cfs_b->distribute_running) { |
1098 |
+ runtime = cfs_b->runtime; |
1099 |
++ cfs_b->distribute_running = 1; |
1100 |
+ raw_spin_unlock(&cfs_b->lock); |
1101 |
+ /* we can't nest cfs_b->lock while distributing bandwidth */ |
1102 |
+ runtime = distribute_cfs_runtime(cfs_b, runtime, |
1103 |
+ runtime_expires); |
1104 |
+ raw_spin_lock(&cfs_b->lock); |
1105 |
+ |
1106 |
++ cfs_b->distribute_running = 0; |
1107 |
+ throttled = !list_empty(&cfs_b->throttled_cfs_rq); |
1108 |
+ |
1109 |
+ cfs_b->runtime -= min(runtime, cfs_b->runtime); |
1110 |
+@@ -5061,6 +5067,11 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) |
1111 |
+ |
1112 |
+ /* confirm we're still not at a refresh boundary */ |
1113 |
+ raw_spin_lock(&cfs_b->lock); |
1114 |
++ if (cfs_b->distribute_running) { |
1115 |
++ raw_spin_unlock(&cfs_b->lock); |
1116 |
++ return; |
1117 |
++ } |
1118 |
++ |
1119 |
+ if (runtime_refresh_within(cfs_b, min_bandwidth_expiration)) { |
1120 |
+ raw_spin_unlock(&cfs_b->lock); |
1121 |
+ return; |
1122 |
+@@ -5070,6 +5081,9 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) |
1123 |
+ runtime = cfs_b->runtime; |
1124 |
+ |
1125 |
+ expires = cfs_b->runtime_expires; |
1126 |
++ if (runtime) |
1127 |
++ cfs_b->distribute_running = 1; |
1128 |
++ |
1129 |
+ raw_spin_unlock(&cfs_b->lock); |
1130 |
+ |
1131 |
+ if (!runtime) |
1132 |
+@@ -5080,6 +5094,7 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) |
1133 |
+ raw_spin_lock(&cfs_b->lock); |
1134 |
+ if (expires == cfs_b->runtime_expires) |
1135 |
+ cfs_b->runtime -= min(runtime, cfs_b->runtime); |
1136 |
++ cfs_b->distribute_running = 0; |
1137 |
+ raw_spin_unlock(&cfs_b->lock); |
1138 |
+ } |
1139 |
+ |
1140 |
+@@ -5188,6 +5203,7 @@ void init_cfs_bandwidth(struct cfs_bandwidth *cfs_b) |
1141 |
+ cfs_b->period_timer.function = sched_cfs_period_timer; |
1142 |
+ hrtimer_init(&cfs_b->slack_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); |
1143 |
+ cfs_b->slack_timer.function = sched_cfs_slack_timer; |
1144 |
++ cfs_b->distribute_running = 0; |
1145 |
+ } |
1146 |
+ |
1147 |
+ static void init_cfs_rq_runtime(struct cfs_rq *cfs_rq) |
1148 |
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h |
1149 |
+index c7742dcc136c..4565c3f9ecc5 100644 |
1150 |
+--- a/kernel/sched/sched.h |
1151 |
++++ b/kernel/sched/sched.h |
1152 |
+@@ -346,6 +346,8 @@ struct cfs_bandwidth { |
1153 |
+ int nr_periods; |
1154 |
+ int nr_throttled; |
1155 |
+ u64 throttled_time; |
1156 |
++ |
1157 |
++ bool distribute_running; |
1158 |
+ #endif |
1159 |
+ }; |
1160 |
+ |
1161 |
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c |
1162 |
+index aae18af94c94..6c78bc2b7fff 100644 |
1163 |
+--- a/kernel/trace/trace_events_hist.c |
1164 |
++++ b/kernel/trace/trace_events_hist.c |
1165 |
+@@ -747,16 +747,30 @@ static void free_synth_field(struct synth_field *field) |
1166 |
+ kfree(field); |
1167 |
+ } |
1168 |
+ |
1169 |
+-static struct synth_field *parse_synth_field(char *field_type, |
1170 |
+- char *field_name) |
1171 |
++static struct synth_field *parse_synth_field(int argc, char **argv, |
1172 |
++ int *consumed) |
1173 |
+ { |
1174 |
+ struct synth_field *field; |
1175 |
++ const char *prefix = NULL; |
1176 |
++ char *field_type = argv[0], *field_name; |
1177 |
+ int len, ret = 0; |
1178 |
+ char *array; |
1179 |
+ |
1180 |
+ if (field_type[0] == ';') |
1181 |
+ field_type++; |
1182 |
+ |
1183 |
++ if (!strcmp(field_type, "unsigned")) { |
1184 |
++ if (argc < 3) |
1185 |
++ return ERR_PTR(-EINVAL); |
1186 |
++ prefix = "unsigned "; |
1187 |
++ field_type = argv[1]; |
1188 |
++ field_name = argv[2]; |
1189 |
++ *consumed = 3; |
1190 |
++ } else { |
1191 |
++ field_name = argv[1]; |
1192 |
++ *consumed = 2; |
1193 |
++ } |
1194 |
++ |
1195 |
+ len = strlen(field_name); |
1196 |
+ if (field_name[len - 1] == ';') |
1197 |
+ field_name[len - 1] = '\0'; |
1198 |
+@@ -769,11 +783,15 @@ static struct synth_field *parse_synth_field(char *field_type, |
1199 |
+ array = strchr(field_name, '['); |
1200 |
+ if (array) |
1201 |
+ len += strlen(array); |
1202 |
++ if (prefix) |
1203 |
++ len += strlen(prefix); |
1204 |
+ field->type = kzalloc(len, GFP_KERNEL); |
1205 |
+ if (!field->type) { |
1206 |
+ ret = -ENOMEM; |
1207 |
+ goto free; |
1208 |
+ } |
1209 |
++ if (prefix) |
1210 |
++ strcat(field->type, prefix); |
1211 |
+ strcat(field->type, field_type); |
1212 |
+ if (array) { |
1213 |
+ strcat(field->type, array); |
1214 |
+@@ -1018,7 +1036,7 @@ static int create_synth_event(int argc, char **argv) |
1215 |
+ struct synth_field *field, *fields[SYNTH_FIELDS_MAX]; |
1216 |
+ struct synth_event *event = NULL; |
1217 |
+ bool delete_event = false; |
1218 |
+- int i, n_fields = 0, ret = 0; |
1219 |
++ int i, consumed = 0, n_fields = 0, ret = 0; |
1220 |
+ char *name; |
1221 |
+ |
1222 |
+ mutex_lock(&synth_event_mutex); |
1223 |
+@@ -1070,16 +1088,16 @@ static int create_synth_event(int argc, char **argv) |
1224 |
+ goto err; |
1225 |
+ } |
1226 |
+ |
1227 |
+- field = parse_synth_field(argv[i], argv[i + 1]); |
1228 |
++ field = parse_synth_field(argc - i, &argv[i], &consumed); |
1229 |
+ if (IS_ERR(field)) { |
1230 |
+ ret = PTR_ERR(field); |
1231 |
+ goto err; |
1232 |
+ } |
1233 |
+- fields[n_fields] = field; |
1234 |
+- i++; n_fields++; |
1235 |
++ fields[n_fields++] = field; |
1236 |
++ i += consumed - 1; |
1237 |
+ } |
1238 |
+ |
1239 |
+- if (i < argc) { |
1240 |
++ if (i < argc && strcmp(argv[i], ";") != 0) { |
1241 |
+ ret = -EINVAL; |
1242 |
+ goto err; |
1243 |
+ } |