1 |
commit: 6803a1f4a0b85e26474b56a4aa58be6e35f47ef6 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Fri Jul 29 15:24:55 2022 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Fri Jul 29 15:24:55 2022 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6803a1f4 |
7 |
|
8 |
Linux patch 4.9.325 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1324_linux-4.9.325.patch | 1177 ++++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 1181 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index 637684d9..d8d1692c 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -1339,6 +1339,10 @@ Patch: 1323_linux-4.9.324.patch |
21 |
From: http://www.kernel.org |
22 |
Desc: Linux 4.9.324 |
23 |
|
24 |
+Patch: 1324_linux-4.9.325.patch |
25 |
+From: http://www.kernel.org |
26 |
+Desc: Linux 4.9.325 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1324_linux-4.9.325.patch b/1324_linux-4.9.325.patch |
33 |
new file mode 100644 |
34 |
index 00000000..2d5a1d69 |
35 |
--- /dev/null |
36 |
+++ b/1324_linux-4.9.325.patch |
37 |
@@ -0,0 +1,1177 @@ |
38 |
+diff --git a/Makefile b/Makefile |
39 |
+index 3168f1c122213..6042ded263475 100644 |
40 |
+--- a/Makefile |
41 |
++++ b/Makefile |
42 |
+@@ -1,6 +1,6 @@ |
43 |
+ VERSION = 4 |
44 |
+ PATCHLEVEL = 9 |
45 |
+-SUBLEVEL = 324 |
46 |
++SUBLEVEL = 325 |
47 |
+ EXTRAVERSION = |
48 |
+ NAME = Roaring Lionus |
49 |
+ |
50 |
+diff --git a/arch/alpha/kernel/srmcons.c b/arch/alpha/kernel/srmcons.c |
51 |
+index 72b59511e59aa..bfeafff14c092 100644 |
52 |
+--- a/arch/alpha/kernel/srmcons.c |
53 |
++++ b/arch/alpha/kernel/srmcons.c |
54 |
+@@ -58,7 +58,7 @@ srmcons_do_receive_chars(struct tty_port *port) |
55 |
+ } while((result.bits.status & 1) && (++loops < 10)); |
56 |
+ |
57 |
+ if (count) |
58 |
+- tty_schedule_flip(port); |
59 |
++ tty_flip_buffer_push(port); |
60 |
+ |
61 |
+ return count; |
62 |
+ } |
63 |
+diff --git a/drivers/char/random.c b/drivers/char/random.c |
64 |
+index 38591c53ea571..1cbc33ee5a5f2 100644 |
65 |
+--- a/drivers/char/random.c |
66 |
++++ b/drivers/char/random.c |
67 |
+@@ -184,8 +184,8 @@ static void __cold process_random_ready_list(void) |
68 |
+ |
69 |
+ #define warn_unseeded_randomness() \ |
70 |
+ if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \ |
71 |
+- pr_notice("%s called from %pS with crng_init=%d\n", \ |
72 |
+- __func__, (void *)_RET_IP_, crng_init) |
73 |
++ printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", \ |
74 |
++ __func__, (void *)_RET_IP_, crng_init) |
75 |
+ |
76 |
+ |
77 |
+ /********************************************************************* |
78 |
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c |
79 |
+index 9ab056bb834d9..fce1906e7df18 100644 |
80 |
+--- a/drivers/i2c/busses/i2c-cadence.c |
81 |
++++ b/drivers/i2c/busses/i2c-cadence.c |
82 |
+@@ -203,9 +203,9 @@ static inline bool cdns_is_holdquirk(struct cdns_i2c *id, bool hold_wrkaround) |
83 |
+ */ |
84 |
+ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) |
85 |
+ { |
86 |
+- unsigned int isr_status, avail_bytes, updatetx; |
87 |
++ unsigned int isr_status, avail_bytes; |
88 |
+ unsigned int bytes_to_send; |
89 |
+- bool hold_quirk; |
90 |
++ bool updatetx; |
91 |
+ struct cdns_i2c *id = ptr; |
92 |
+ /* Signal completion only after everything is updated */ |
93 |
+ int done_flag = 0; |
94 |
+@@ -224,11 +224,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) |
95 |
+ * Check if transfer size register needs to be updated again for a |
96 |
+ * large data receive operation. |
97 |
+ */ |
98 |
+- updatetx = 0; |
99 |
+- if (id->recv_count > id->curr_recv_count) |
100 |
+- updatetx = 1; |
101 |
+- |
102 |
+- hold_quirk = (id->quirks & CDNS_I2C_BROKEN_HOLD_BIT) && updatetx; |
103 |
++ updatetx = id->recv_count > id->curr_recv_count; |
104 |
+ |
105 |
+ /* When receiving, handle data interrupt and completion interrupt */ |
106 |
+ if (id->p_recv_buf && |
107 |
+@@ -251,7 +247,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) |
108 |
+ id->recv_count--; |
109 |
+ id->curr_recv_count--; |
110 |
+ |
111 |
+- if (cdns_is_holdquirk(id, hold_quirk)) |
112 |
++ if (cdns_is_holdquirk(id, updatetx)) |
113 |
+ break; |
114 |
+ } |
115 |
+ |
116 |
+@@ -262,7 +258,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) |
117 |
+ * maintain transfer size non-zero while performing a large |
118 |
+ * receive operation. |
119 |
+ */ |
120 |
+- if (cdns_is_holdquirk(id, hold_quirk)) { |
121 |
++ if (cdns_is_holdquirk(id, updatetx)) { |
122 |
+ /* wait while fifo is full */ |
123 |
+ while (cdns_i2c_readreg(CDNS_I2C_XFER_SIZE_OFFSET) != |
124 |
+ (id->curr_recv_count - CDNS_I2C_FIFO_DEPTH)) |
125 |
+@@ -284,22 +280,6 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) |
126 |
+ CDNS_I2C_XFER_SIZE_OFFSET); |
127 |
+ id->curr_recv_count = id->recv_count; |
128 |
+ } |
129 |
+- } else if (id->recv_count && !hold_quirk && |
130 |
+- !id->curr_recv_count) { |
131 |
+- |
132 |
+- /* Set the slave address in address register*/ |
133 |
+- cdns_i2c_writereg(id->p_msg->addr & CDNS_I2C_ADDR_MASK, |
134 |
+- CDNS_I2C_ADDR_OFFSET); |
135 |
+- |
136 |
+- if (id->recv_count > CDNS_I2C_TRANSFER_SIZE) { |
137 |
+- cdns_i2c_writereg(CDNS_I2C_TRANSFER_SIZE, |
138 |
+- CDNS_I2C_XFER_SIZE_OFFSET); |
139 |
+- id->curr_recv_count = CDNS_I2C_TRANSFER_SIZE; |
140 |
+- } else { |
141 |
+- cdns_i2c_writereg(id->recv_count, |
142 |
+- CDNS_I2C_XFER_SIZE_OFFSET); |
143 |
+- id->curr_recv_count = id->recv_count; |
144 |
+- } |
145 |
+ } |
146 |
+ |
147 |
+ /* Clear hold (if not repeated start) and signal completion */ |
148 |
+diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c |
149 |
+index e94f855eac155..fd859a7872a6d 100644 |
150 |
+--- a/drivers/mfd/rtsx_usb.c |
151 |
++++ b/drivers/mfd/rtsx_usb.c |
152 |
+@@ -642,16 +642,20 @@ static int rtsx_usb_probe(struct usb_interface *intf, |
153 |
+ |
154 |
+ ucr->pusb_dev = usb_dev; |
155 |
+ |
156 |
+- ucr->iobuf = usb_alloc_coherent(ucr->pusb_dev, IOBUF_SIZE, |
157 |
+- GFP_KERNEL, &ucr->iobuf_dma); |
158 |
+- if (!ucr->iobuf) |
159 |
++ ucr->cmd_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL); |
160 |
++ if (!ucr->cmd_buf) |
161 |
+ return -ENOMEM; |
162 |
+ |
163 |
++ ucr->rsp_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL); |
164 |
++ if (!ucr->rsp_buf) { |
165 |
++ ret = -ENOMEM; |
166 |
++ goto out_free_cmd_buf; |
167 |
++ } |
168 |
++ |
169 |
+ usb_set_intfdata(intf, ucr); |
170 |
+ |
171 |
+ ucr->vendor_id = id->idVendor; |
172 |
+ ucr->product_id = id->idProduct; |
173 |
+- ucr->cmd_buf = ucr->rsp_buf = ucr->iobuf; |
174 |
+ |
175 |
+ mutex_init(&ucr->dev_mutex); |
176 |
+ |
177 |
+@@ -679,8 +683,11 @@ static int rtsx_usb_probe(struct usb_interface *intf, |
178 |
+ |
179 |
+ out_init_fail: |
180 |
+ usb_set_intfdata(ucr->pusb_intf, NULL); |
181 |
+- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf, |
182 |
+- ucr->iobuf_dma); |
183 |
++ kfree(ucr->rsp_buf); |
184 |
++ ucr->rsp_buf = NULL; |
185 |
++out_free_cmd_buf: |
186 |
++ kfree(ucr->cmd_buf); |
187 |
++ ucr->cmd_buf = NULL; |
188 |
+ return ret; |
189 |
+ } |
190 |
+ |
191 |
+@@ -693,8 +700,12 @@ static void rtsx_usb_disconnect(struct usb_interface *intf) |
192 |
+ mfd_remove_devices(&intf->dev); |
193 |
+ |
194 |
+ usb_set_intfdata(ucr->pusb_intf, NULL); |
195 |
+- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf, |
196 |
+- ucr->iobuf_dma); |
197 |
++ |
198 |
++ kfree(ucr->cmd_buf); |
199 |
++ ucr->cmd_buf = NULL; |
200 |
++ |
201 |
++ kfree(ucr->rsp_buf); |
202 |
++ ucr->rsp_buf = NULL; |
203 |
+ } |
204 |
+ |
205 |
+ #ifdef CONFIG_PM |
206 |
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c |
207 |
+index 8887dd3abed71..619cc13ffb550 100644 |
208 |
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.c |
209 |
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c |
210 |
+@@ -2291,7 +2291,7 @@ err: |
211 |
+ |
212 |
+ /* Uses sync mcc */ |
213 |
+ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, |
214 |
+- u8 page_num, u8 *data) |
215 |
++ u8 page_num, u32 off, u32 len, u8 *data) |
216 |
+ { |
217 |
+ struct be_dma_mem cmd; |
218 |
+ struct be_mcc_wrb *wrb; |
219 |
+@@ -2325,10 +2325,10 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, |
220 |
+ req->port = cpu_to_le32(adapter->hba_port_num); |
221 |
+ req->page_num = cpu_to_le32(page_num); |
222 |
+ status = be_mcc_notify_wait(adapter); |
223 |
+- if (!status) { |
224 |
++ if (!status && len > 0) { |
225 |
+ struct be_cmd_resp_port_type *resp = cmd.va; |
226 |
+ |
227 |
+- memcpy(data, resp->page_data, PAGE_DATA_LEN); |
228 |
++ memcpy(data, resp->page_data + off, len); |
229 |
+ } |
230 |
+ err: |
231 |
+ mutex_unlock(&adapter->mcc_lock); |
232 |
+@@ -2419,7 +2419,7 @@ int be_cmd_query_cable_type(struct be_adapter *adapter) |
233 |
+ int status; |
234 |
+ |
235 |
+ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, |
236 |
+- page_data); |
237 |
++ 0, PAGE_DATA_LEN, page_data); |
238 |
+ if (!status) { |
239 |
+ switch (adapter->phy.interface_type) { |
240 |
+ case PHY_TYPE_QSFP: |
241 |
+@@ -2444,7 +2444,7 @@ int be_cmd_query_sfp_info(struct be_adapter *adapter) |
242 |
+ int status; |
243 |
+ |
244 |
+ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, |
245 |
+- page_data); |
246 |
++ 0, PAGE_DATA_LEN, page_data); |
247 |
+ if (!status) { |
248 |
+ strlcpy(adapter->phy.vendor_name, page_data + |
249 |
+ SFP_VENDOR_NAME_OFFSET, SFP_VENDOR_NAME_LEN - 1); |
250 |
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h |
251 |
+index 09da2d82c2f0d..8af11a5e49fe2 100644 |
252 |
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.h |
253 |
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.h |
254 |
+@@ -2431,7 +2431,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, u8 beacon, |
255 |
+ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, |
256 |
+ u32 *state); |
257 |
+ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, |
258 |
+- u8 page_num, u8 *data); |
259 |
++ u8 page_num, u32 off, u32 len, u8 *data); |
260 |
+ int be_cmd_query_cable_type(struct be_adapter *adapter); |
261 |
+ int be_cmd_query_sfp_info(struct be_adapter *adapter); |
262 |
+ int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd, |
263 |
+diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c |
264 |
+index 56db37d929374..ca7750f483f98 100644 |
265 |
+--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c |
266 |
++++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c |
267 |
+@@ -1345,7 +1345,7 @@ static int be_get_module_info(struct net_device *netdev, |
268 |
+ return -EOPNOTSUPP; |
269 |
+ |
270 |
+ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, |
271 |
+- page_data); |
272 |
++ 0, PAGE_DATA_LEN, page_data); |
273 |
+ if (!status) { |
274 |
+ if (!page_data[SFP_PLUS_SFF_8472_COMP]) { |
275 |
+ modinfo->type = ETH_MODULE_SFF_8079; |
276 |
+@@ -1363,25 +1363,32 @@ static int be_get_module_eeprom(struct net_device *netdev, |
277 |
+ { |
278 |
+ struct be_adapter *adapter = netdev_priv(netdev); |
279 |
+ int status; |
280 |
++ u32 begin, end; |
281 |
+ |
282 |
+ if (!check_privilege(adapter, MAX_PRIVILEGES)) |
283 |
+ return -EOPNOTSUPP; |
284 |
+ |
285 |
+- status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, |
286 |
+- data); |
287 |
+- if (status) |
288 |
+- goto err; |
289 |
++ begin = eeprom->offset; |
290 |
++ end = eeprom->offset + eeprom->len; |
291 |
++ |
292 |
++ if (begin < PAGE_DATA_LEN) { |
293 |
++ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, begin, |
294 |
++ min_t(u32, end, PAGE_DATA_LEN) - begin, |
295 |
++ data); |
296 |
++ if (status) |
297 |
++ goto err; |
298 |
++ |
299 |
++ data += PAGE_DATA_LEN - begin; |
300 |
++ begin = PAGE_DATA_LEN; |
301 |
++ } |
302 |
+ |
303 |
+- if (eeprom->offset + eeprom->len > PAGE_DATA_LEN) { |
304 |
+- status = be_cmd_read_port_transceiver_data(adapter, |
305 |
+- TR_PAGE_A2, |
306 |
+- data + |
307 |
+- PAGE_DATA_LEN); |
308 |
++ if (end > PAGE_DATA_LEN) { |
309 |
++ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A2, |
310 |
++ begin - PAGE_DATA_LEN, |
311 |
++ end - begin, data); |
312 |
+ if (status) |
313 |
+ goto err; |
314 |
+ } |
315 |
+- if (eeprom->offset) |
316 |
+- memcpy(data, data + eeprom->offset, eeprom->len); |
317 |
+ err: |
318 |
+ return be_cmd_status(status); |
319 |
+ } |
320 |
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c |
321 |
+index 48938d00ff7e8..460a0294ea97e 100644 |
322 |
+--- a/drivers/net/usb/ax88179_178a.c |
323 |
++++ b/drivers/net/usb/ax88179_178a.c |
324 |
+@@ -1703,7 +1703,7 @@ static const struct driver_info ax88179_info = { |
325 |
+ .link_reset = ax88179_link_reset, |
326 |
+ .reset = ax88179_reset, |
327 |
+ .stop = ax88179_stop, |
328 |
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX, |
329 |
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, |
330 |
+ .rx_fixup = ax88179_rx_fixup, |
331 |
+ .tx_fixup = ax88179_tx_fixup, |
332 |
+ }; |
333 |
+@@ -1716,7 +1716,7 @@ static const struct driver_info ax88178a_info = { |
334 |
+ .link_reset = ax88179_link_reset, |
335 |
+ .reset = ax88179_reset, |
336 |
+ .stop = ax88179_stop, |
337 |
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX, |
338 |
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, |
339 |
+ .rx_fixup = ax88179_rx_fixup, |
340 |
+ .tx_fixup = ax88179_tx_fixup, |
341 |
+ }; |
342 |
+@@ -1729,7 +1729,7 @@ static const struct driver_info cypress_GX3_info = { |
343 |
+ .link_reset = ax88179_link_reset, |
344 |
+ .reset = ax88179_reset, |
345 |
+ .stop = ax88179_stop, |
346 |
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX, |
347 |
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, |
348 |
+ .rx_fixup = ax88179_rx_fixup, |
349 |
+ .tx_fixup = ax88179_tx_fixup, |
350 |
+ }; |
351 |
+@@ -1742,7 +1742,7 @@ static const struct driver_info dlink_dub1312_info = { |
352 |
+ .link_reset = ax88179_link_reset, |
353 |
+ .reset = ax88179_reset, |
354 |
+ .stop = ax88179_stop, |
355 |
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX, |
356 |
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, |
357 |
+ .rx_fixup = ax88179_rx_fixup, |
358 |
+ .tx_fixup = ax88179_tx_fixup, |
359 |
+ }; |
360 |
+@@ -1755,7 +1755,7 @@ static const struct driver_info sitecom_info = { |
361 |
+ .link_reset = ax88179_link_reset, |
362 |
+ .reset = ax88179_reset, |
363 |
+ .stop = ax88179_stop, |
364 |
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX, |
365 |
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, |
366 |
+ .rx_fixup = ax88179_rx_fixup, |
367 |
+ .tx_fixup = ax88179_tx_fixup, |
368 |
+ }; |
369 |
+@@ -1768,7 +1768,7 @@ static const struct driver_info samsung_info = { |
370 |
+ .link_reset = ax88179_link_reset, |
371 |
+ .reset = ax88179_reset, |
372 |
+ .stop = ax88179_stop, |
373 |
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX, |
374 |
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, |
375 |
+ .rx_fixup = ax88179_rx_fixup, |
376 |
+ .tx_fixup = ax88179_tx_fixup, |
377 |
+ }; |
378 |
+@@ -1781,7 +1781,7 @@ static const struct driver_info lenovo_info = { |
379 |
+ .link_reset = ax88179_link_reset, |
380 |
+ .reset = ax88179_reset, |
381 |
+ .stop = ax88179_stop, |
382 |
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX, |
383 |
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, |
384 |
+ .rx_fixup = ax88179_rx_fixup, |
385 |
+ .tx_fixup = ax88179_tx_fixup, |
386 |
+ }; |
387 |
+diff --git a/drivers/power/reset/arm-versatile-reboot.c b/drivers/power/reset/arm-versatile-reboot.c |
388 |
+index 06d34ab47df53..8022c782f6ff3 100644 |
389 |
+--- a/drivers/power/reset/arm-versatile-reboot.c |
390 |
++++ b/drivers/power/reset/arm-versatile-reboot.c |
391 |
+@@ -150,6 +150,7 @@ static int __init versatile_reboot_probe(void) |
392 |
+ versatile_reboot_type = (enum versatile_reboot)reboot_id->data; |
393 |
+ |
394 |
+ syscon_regmap = syscon_node_to_regmap(np); |
395 |
++ of_node_put(np); |
396 |
+ if (IS_ERR(syscon_regmap)) |
397 |
+ return PTR_ERR(syscon_regmap); |
398 |
+ |
399 |
+diff --git a/drivers/s390/char/keyboard.h b/drivers/s390/char/keyboard.h |
400 |
+index a31f339211d58..b3172908f18c3 100644 |
401 |
+--- a/drivers/s390/char/keyboard.h |
402 |
++++ b/drivers/s390/char/keyboard.h |
403 |
+@@ -44,7 +44,7 @@ static inline void |
404 |
+ kbd_put_queue(struct tty_port *port, int ch) |
405 |
+ { |
406 |
+ tty_insert_flip_char(port, ch, 0); |
407 |
+- tty_schedule_flip(port); |
408 |
++ tty_flip_buffer_push(port); |
409 |
+ } |
410 |
+ |
411 |
+ static inline void |
412 |
+@@ -52,5 +52,5 @@ kbd_puts_queue(struct tty_port *port, char *cp) |
413 |
+ { |
414 |
+ while (*cp) |
415 |
+ tty_insert_flip_char(port, *cp++, 0); |
416 |
+- tty_schedule_flip(port); |
417 |
++ tty_flip_buffer_push(port); |
418 |
+ } |
419 |
+diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c |
420 |
+index 5e4fa92068615..3e1d03a1b8e5a 100644 |
421 |
+--- a/drivers/tty/cyclades.c |
422 |
++++ b/drivers/tty/cyclades.c |
423 |
+@@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_card *cinfo, int chip, |
424 |
+ } |
425 |
+ info->idle_stats.recv_idle = jiffies; |
426 |
+ } |
427 |
+- tty_schedule_flip(port); |
428 |
++ tty_flip_buffer_push(port); |
429 |
+ |
430 |
+ /* end of service */ |
431 |
+ cyy_writeb(info, CyRIR, save_xir & 0x3f); |
432 |
+@@ -998,7 +998,7 @@ static void cyz_handle_rx(struct cyclades_port *info) |
433 |
+ jiffies + 1); |
434 |
+ #endif |
435 |
+ info->idle_stats.recv_idle = jiffies; |
436 |
+- tty_schedule_flip(&info->port); |
437 |
++ tty_flip_buffer_push(&info->port); |
438 |
+ |
439 |
+ /* Update rx_get */ |
440 |
+ cy_writel(&buf_ctrl->rx_get, new_rx_get); |
441 |
+@@ -1174,7 +1174,7 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo) |
442 |
+ if (delta_count) |
443 |
+ wake_up_interruptible(&info->port.delta_msr_wait); |
444 |
+ if (special_count) |
445 |
+- tty_schedule_flip(&info->port); |
446 |
++ tty_flip_buffer_push(&info->port); |
447 |
+ } |
448 |
+ } |
449 |
+ |
450 |
+diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c |
451 |
+index 996bd473dd03e..5c075c3808af1 100644 |
452 |
+--- a/drivers/tty/goldfish.c |
453 |
++++ b/drivers/tty/goldfish.c |
454 |
+@@ -85,7 +85,7 @@ static irqreturn_t goldfish_tty_interrupt(int irq, void *dev_id) |
455 |
+ writel(count, base + GOLDFISH_TTY_DATA_LEN); |
456 |
+ writel(GOLDFISH_TTY_CMD_READ_BUFFER, base + GOLDFISH_TTY_CMD); |
457 |
+ spin_unlock_irqrestore(&qtty->lock, irq_flags); |
458 |
+- tty_schedule_flip(&qtty->port); |
459 |
++ tty_flip_buffer_push(&qtty->port); |
460 |
+ return IRQ_HANDLED; |
461 |
+ } |
462 |
+ |
463 |
+diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c |
464 |
+index 60d37b225589c..0a17abf484d47 100644 |
465 |
+--- a/drivers/tty/moxa.c |
466 |
++++ b/drivers/tty/moxa.c |
467 |
+@@ -1397,7 +1397,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, |
468 |
+ if (inited && !tty_throttled(tty) && |
469 |
+ MoxaPortRxQueue(p) > 0) { /* RX */ |
470 |
+ MoxaPortReadData(p); |
471 |
+- tty_schedule_flip(&p->port); |
472 |
++ tty_flip_buffer_push(&p->port); |
473 |
+ } |
474 |
+ } else { |
475 |
+ clear_bit(EMPTYWAIT, &p->statusflags); |
476 |
+@@ -1422,7 +1422,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, |
477 |
+ |
478 |
+ if (tty && (intr & IntrBreak) && !I_IGNBRK(tty)) { /* BREAK */ |
479 |
+ tty_insert_flip_char(&p->port, 0, TTY_BREAK); |
480 |
+- tty_schedule_flip(&p->port); |
481 |
++ tty_flip_buffer_push(&p->port); |
482 |
+ } |
483 |
+ |
484 |
+ if (intr & IntrLine) |
485 |
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c |
486 |
+index 8a063a036bc08..f13f2535cc85b 100644 |
487 |
+--- a/drivers/tty/pty.c |
488 |
++++ b/drivers/tty/pty.c |
489 |
+@@ -106,21 +106,11 @@ static void pty_unthrottle(struct tty_struct *tty) |
490 |
+ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) |
491 |
+ { |
492 |
+ struct tty_struct *to = tty->link; |
493 |
+- unsigned long flags; |
494 |
+ |
495 |
+- if (tty->stopped) |
496 |
++ if (tty->stopped || !c) |
497 |
+ return 0; |
498 |
+ |
499 |
+- if (c > 0) { |
500 |
+- spin_lock_irqsave(&to->port->lock, flags); |
501 |
+- /* Stuff the data into the input queue of the other end */ |
502 |
+- c = tty_insert_flip_string(to->port, buf, c); |
503 |
+- spin_unlock_irqrestore(&to->port->lock, flags); |
504 |
+- /* And shovel */ |
505 |
+- if (c) |
506 |
+- tty_flip_buffer_push(to->port); |
507 |
+- } |
508 |
+- return c; |
509 |
++ return tty_insert_flip_string_and_push_buffer(to->port, buf, c); |
510 |
+ } |
511 |
+ |
512 |
+ /** |
513 |
+diff --git a/drivers/tty/serial/lpc32xx_hs.c b/drivers/tty/serial/lpc32xx_hs.c |
514 |
+index 7eb04ae71cc87..c74b30fa7bea0 100644 |
515 |
+--- a/drivers/tty/serial/lpc32xx_hs.c |
516 |
++++ b/drivers/tty/serial/lpc32xx_hs.c |
517 |
+@@ -350,7 +350,7 @@ static irqreturn_t serial_lpc32xx_interrupt(int irq, void *dev_id) |
518 |
+ LPC32XX_HSUART_IIR(port->membase)); |
519 |
+ port->icount.overrun++; |
520 |
+ tty_insert_flip_char(tport, 0, TTY_OVERRUN); |
521 |
+- tty_schedule_flip(tport); |
522 |
++ tty_flip_buffer_push(tport); |
523 |
+ } |
524 |
+ |
525 |
+ /* Data received? */ |
526 |
+diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c |
527 |
+index e65faa98146ef..17ccfc33dc3d6 100644 |
528 |
+--- a/drivers/tty/tty_buffer.c |
529 |
++++ b/drivers/tty/tty_buffer.c |
530 |
+@@ -388,27 +388,6 @@ int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag) |
531 |
+ } |
532 |
+ EXPORT_SYMBOL(__tty_insert_flip_char); |
533 |
+ |
534 |
+-/** |
535 |
+- * tty_schedule_flip - push characters to ldisc |
536 |
+- * @port: tty port to push from |
537 |
+- * |
538 |
+- * Takes any pending buffers and transfers their ownership to the |
539 |
+- * ldisc side of the queue. It then schedules those characters for |
540 |
+- * processing by the line discipline. |
541 |
+- */ |
542 |
+- |
543 |
+-void tty_schedule_flip(struct tty_port *port) |
544 |
+-{ |
545 |
+- struct tty_bufhead *buf = &port->buf; |
546 |
+- |
547 |
+- /* paired w/ acquire in flush_to_ldisc(); ensures |
548 |
+- * flush_to_ldisc() sees buffer data. |
549 |
+- */ |
550 |
+- smp_store_release(&buf->tail->commit, buf->tail->used); |
551 |
+- queue_work(system_unbound_wq, &buf->work); |
552 |
+-} |
553 |
+-EXPORT_SYMBOL(tty_schedule_flip); |
554 |
+- |
555 |
+ /** |
556 |
+ * tty_prepare_flip_string - make room for characters |
557 |
+ * @port: tty port |
558 |
+@@ -547,6 +526,15 @@ static void flush_to_ldisc(struct work_struct *work) |
559 |
+ tty_ldisc_deref(disc); |
560 |
+ } |
561 |
+ |
562 |
++static inline void tty_flip_buffer_commit(struct tty_buffer *tail) |
563 |
++{ |
564 |
++ /* |
565 |
++ * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees |
566 |
++ * buffer data. |
567 |
++ */ |
568 |
++ smp_store_release(&tail->commit, tail->used); |
569 |
++} |
570 |
++ |
571 |
+ /** |
572 |
+ * tty_flip_buffer_push - terminal |
573 |
+ * @port: tty port to push |
574 |
+@@ -560,10 +548,44 @@ static void flush_to_ldisc(struct work_struct *work) |
575 |
+ |
576 |
+ void tty_flip_buffer_push(struct tty_port *port) |
577 |
+ { |
578 |
+- tty_schedule_flip(port); |
579 |
++ struct tty_bufhead *buf = &port->buf; |
580 |
++ |
581 |
++ tty_flip_buffer_commit(buf->tail); |
582 |
++ queue_work(system_unbound_wq, &buf->work); |
583 |
+ } |
584 |
+ EXPORT_SYMBOL(tty_flip_buffer_push); |
585 |
+ |
586 |
++/** |
587 |
++ * tty_insert_flip_string_and_push_buffer - add characters to the tty buffer and |
588 |
++ * push |
589 |
++ * @port: tty port |
590 |
++ * @chars: characters |
591 |
++ * @size: size |
592 |
++ * |
593 |
++ * The function combines tty_insert_flip_string() and tty_flip_buffer_push() |
594 |
++ * with the exception of properly holding the @port->lock. |
595 |
++ * |
596 |
++ * To be used only internally (by pty currently). |
597 |
++ * |
598 |
++ * Returns: the number added. |
599 |
++ */ |
600 |
++int tty_insert_flip_string_and_push_buffer(struct tty_port *port, |
601 |
++ const unsigned char *chars, size_t size) |
602 |
++{ |
603 |
++ struct tty_bufhead *buf = &port->buf; |
604 |
++ unsigned long flags; |
605 |
++ |
606 |
++ spin_lock_irqsave(&port->lock, flags); |
607 |
++ size = tty_insert_flip_string(port, chars, size); |
608 |
++ if (size) |
609 |
++ tty_flip_buffer_commit(buf->tail); |
610 |
++ spin_unlock_irqrestore(&port->lock, flags); |
611 |
++ |
612 |
++ queue_work(system_unbound_wq, &buf->work); |
613 |
++ |
614 |
++ return size; |
615 |
++} |
616 |
++ |
617 |
+ /** |
618 |
+ * tty_buffer_init - prepare a tty buffer structure |
619 |
+ * @tty: tty to initialise |
620 |
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c |
621 |
+index 4bc6261ef3c1a..1d20abd7d3c6f 100644 |
622 |
+--- a/drivers/tty/vt/keyboard.c |
623 |
++++ b/drivers/tty/vt/keyboard.c |
624 |
+@@ -308,7 +308,7 @@ int kbd_rate(struct kbd_repeat *rpt) |
625 |
+ static void put_queue(struct vc_data *vc, int ch) |
626 |
+ { |
627 |
+ tty_insert_flip_char(&vc->port, ch, 0); |
628 |
+- tty_schedule_flip(&vc->port); |
629 |
++ tty_flip_buffer_push(&vc->port); |
630 |
+ } |
631 |
+ |
632 |
+ static void puts_queue(struct vc_data *vc, char *cp) |
633 |
+@@ -317,7 +317,7 @@ static void puts_queue(struct vc_data *vc, char *cp) |
634 |
+ tty_insert_flip_char(&vc->port, *cp, 0); |
635 |
+ cp++; |
636 |
+ } |
637 |
+- tty_schedule_flip(&vc->port); |
638 |
++ tty_flip_buffer_push(&vc->port); |
639 |
+ } |
640 |
+ |
641 |
+ static void applkey(struct vc_data *vc, int key, char mode) |
642 |
+@@ -562,7 +562,7 @@ static void fn_inc_console(struct vc_data *vc) |
643 |
+ static void fn_send_intr(struct vc_data *vc) |
644 |
+ { |
645 |
+ tty_insert_flip_char(&vc->port, 0, TTY_BREAK); |
646 |
+- tty_schedule_flip(&vc->port); |
647 |
++ tty_flip_buffer_push(&vc->port); |
648 |
+ } |
649 |
+ |
650 |
+ static void fn_scroll_forw(struct vc_data *vc) |
651 |
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c |
652 |
+index f7a035fa9a97a..29037322d047c 100644 |
653 |
+--- a/drivers/tty/vt/vt.c |
654 |
++++ b/drivers/tty/vt/vt.c |
655 |
+@@ -1484,7 +1484,7 @@ static void respond_string(const char *p, struct tty_port *port) |
656 |
+ tty_insert_flip_char(port, *p, 0); |
657 |
+ p++; |
658 |
+ } |
659 |
+- tty_schedule_flip(port); |
660 |
++ tty_flip_buffer_push(port); |
661 |
+ } |
662 |
+ |
663 |
+ static void cursor_report(struct vc_data *vc, struct tty_struct *tty) |
664 |
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c |
665 |
+index 2c3248e71e9c1..a6585854a85fc 100644 |
666 |
+--- a/drivers/xen/gntdev.c |
667 |
++++ b/drivers/xen/gntdev.c |
668 |
+@@ -390,7 +390,8 @@ static void __unmap_grant_pages_done(int result, |
669 |
+ unsigned int offset = data->unmap_ops - map->unmap_ops; |
670 |
+ |
671 |
+ for (i = 0; i < data->count; i++) { |
672 |
+- WARN_ON(map->unmap_ops[offset+i].status); |
673 |
++ WARN_ON(map->unmap_ops[offset+i].status && |
674 |
++ map->unmap_ops[offset+i].handle != -1); |
675 |
+ pr_debug("unmap handle=%d st=%d\n", |
676 |
+ map->unmap_ops[offset+i].handle, |
677 |
+ map->unmap_ops[offset+i].status); |
678 |
+diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h |
679 |
+index 53ac461f342bb..491385a8a69d9 100644 |
680 |
+--- a/include/linux/lsm_hooks.h |
681 |
++++ b/include/linux/lsm_hooks.h |
682 |
+@@ -666,11 +666,6 @@ |
683 |
+ * @sig contains the signal value. |
684 |
+ * @secid contains the sid of the process where the signal originated |
685 |
+ * Return 0 if permission is granted. |
686 |
+- * @task_wait: |
687 |
+- * Check permission before allowing a process to reap a child process @p |
688 |
+- * and collect its status information. |
689 |
+- * @p contains the task_struct for process. |
690 |
+- * Return 0 if permission is granted. |
691 |
+ * @task_prctl: |
692 |
+ * Check permission before performing a process control operation on the |
693 |
+ * current process. |
694 |
+@@ -1507,7 +1502,6 @@ union security_list_options { |
695 |
+ int (*task_movememory)(struct task_struct *p); |
696 |
+ int (*task_kill)(struct task_struct *p, struct siginfo *info, |
697 |
+ int sig, u32 secid); |
698 |
+- int (*task_wait)(struct task_struct *p); |
699 |
+ int (*task_prctl)(int option, unsigned long arg2, unsigned long arg3, |
700 |
+ unsigned long arg4, unsigned long arg5); |
701 |
+ void (*task_to_inode)(struct task_struct *p, struct inode *inode); |
702 |
+@@ -1768,7 +1762,6 @@ struct security_hook_heads { |
703 |
+ struct list_head task_getscheduler; |
704 |
+ struct list_head task_movememory; |
705 |
+ struct list_head task_kill; |
706 |
+- struct list_head task_wait; |
707 |
+ struct list_head task_prctl; |
708 |
+ struct list_head task_to_inode; |
709 |
+ struct list_head ipc_permission; |
710 |
+diff --git a/include/linux/mfd/rtsx_usb.h b/include/linux/mfd/rtsx_usb.h |
711 |
+index c446e4fd6b5cc..09b08ff08830c 100644 |
712 |
+--- a/include/linux/mfd/rtsx_usb.h |
713 |
++++ b/include/linux/mfd/rtsx_usb.h |
714 |
+@@ -65,8 +65,6 @@ struct rtsx_ucr { |
715 |
+ struct usb_device *pusb_dev; |
716 |
+ struct usb_interface *pusb_intf; |
717 |
+ struct usb_sg_request current_sg; |
718 |
+- unsigned char *iobuf; |
719 |
+- dma_addr_t iobuf_dma; |
720 |
+ |
721 |
+ struct timer_list sg_timer; |
722 |
+ struct mutex dev_mutex; |
723 |
+diff --git a/include/linux/security.h b/include/linux/security.h |
724 |
+index 2f5d282bd3eca..472822a1e02bf 100644 |
725 |
+--- a/include/linux/security.h |
726 |
++++ b/include/linux/security.h |
727 |
+@@ -332,7 +332,6 @@ int security_task_getscheduler(struct task_struct *p); |
728 |
+ int security_task_movememory(struct task_struct *p); |
729 |
+ int security_task_kill(struct task_struct *p, struct siginfo *info, |
730 |
+ int sig, u32 secid); |
731 |
+-int security_task_wait(struct task_struct *p); |
732 |
+ int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, |
733 |
+ unsigned long arg4, unsigned long arg5); |
734 |
+ void security_task_to_inode(struct task_struct *p, struct inode *inode); |
735 |
+@@ -980,11 +979,6 @@ static inline int security_task_kill(struct task_struct *p, |
736 |
+ return 0; |
737 |
+ } |
738 |
+ |
739 |
+-static inline int security_task_wait(struct task_struct *p) |
740 |
+-{ |
741 |
+- return 0; |
742 |
+-} |
743 |
+- |
744 |
+ static inline int security_task_prctl(int option, unsigned long arg2, |
745 |
+ unsigned long arg3, |
746 |
+ unsigned long arg4, |
747 |
+diff --git a/include/linux/tty_flip.h b/include/linux/tty_flip.h |
748 |
+index d43837f2ce3ae..67ccce8be5fba 100644 |
749 |
+--- a/include/linux/tty_flip.h |
750 |
++++ b/include/linux/tty_flip.h |
751 |
+@@ -11,7 +11,6 @@ extern int tty_insert_flip_string_fixed_flag(struct tty_port *port, |
752 |
+ extern int tty_prepare_flip_string(struct tty_port *port, |
753 |
+ unsigned char **chars, size_t size); |
754 |
+ extern void tty_flip_buffer_push(struct tty_port *port); |
755 |
+-void tty_schedule_flip(struct tty_port *port); |
756 |
+ int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag); |
757 |
+ |
758 |
+ static inline int tty_insert_flip_char(struct tty_port *port, |
759 |
+@@ -39,4 +38,7 @@ static inline int tty_insert_flip_string(struct tty_port *port, |
760 |
+ extern void tty_buffer_lock_exclusive(struct tty_port *port); |
761 |
+ extern void tty_buffer_unlock_exclusive(struct tty_port *port); |
762 |
+ |
763 |
++int tty_insert_flip_string_and_push_buffer(struct tty_port *port, |
764 |
++ const unsigned char *chars, size_t cnt); |
765 |
++ |
766 |
+ #endif /* _LINUX_TTY_FLIP_H */ |
767 |
+diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h |
768 |
+index 6213a90a8cecb..f5dbee53fb859 100644 |
769 |
+--- a/include/net/inet_sock.h |
770 |
++++ b/include/net/inet_sock.h |
771 |
+@@ -113,7 +113,8 @@ static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk) |
772 |
+ |
773 |
+ static inline u32 inet_request_mark(const struct sock *sk, struct sk_buff *skb) |
774 |
+ { |
775 |
+- if (!sk->sk_mark && sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept) |
776 |
++ if (!sk->sk_mark && |
777 |
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept)) |
778 |
+ return skb->mark; |
779 |
+ |
780 |
+ return sk->sk_mark; |
781 |
+diff --git a/include/net/ip.h b/include/net/ip.h |
782 |
+index c762fd047ef4c..f0e13a2565820 100644 |
783 |
+--- a/include/net/ip.h |
784 |
++++ b/include/net/ip.h |
785 |
+@@ -283,7 +283,7 @@ void ipfrag_init(void); |
786 |
+ void ip_static_sysctl_init(void); |
787 |
+ |
788 |
+ #define IP4_REPLY_MARK(net, mark) \ |
789 |
+- ((net)->ipv4.sysctl_fwmark_reflect ? (mark) : 0) |
790 |
++ (READ_ONCE((net)->ipv4.sysctl_fwmark_reflect) ? (mark) : 0) |
791 |
+ |
792 |
+ static inline bool ip_is_fragment(const struct iphdr *iph) |
793 |
+ { |
794 |
+diff --git a/include/net/tcp.h b/include/net/tcp.h |
795 |
+index 97df2f6fcbd79..164dc4f04d0f1 100644 |
796 |
+--- a/include/net/tcp.h |
797 |
++++ b/include/net/tcp.h |
798 |
+@@ -1788,7 +1788,7 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr); |
799 |
+ static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp) |
800 |
+ { |
801 |
+ struct net *net = sock_net((struct sock *)tp); |
802 |
+- return tp->notsent_lowat ?: net->ipv4.sysctl_tcp_notsent_lowat; |
803 |
++ return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat); |
804 |
+ } |
805 |
+ |
806 |
+ static inline bool tcp_stream_memory_free(const struct sock *sk) |
807 |
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c |
808 |
+index 3ce69c0276c09..9976703f2dbfa 100644 |
809 |
+--- a/kernel/bpf/core.c |
810 |
++++ b/kernel/bpf/core.c |
811 |
+@@ -60,11 +60,13 @@ void *bpf_internal_load_pointer_neg_helper(const struct sk_buff *skb, int k, uns |
812 |
+ { |
813 |
+ u8 *ptr = NULL; |
814 |
+ |
815 |
+- if (k >= SKF_NET_OFF) |
816 |
++ if (k >= SKF_NET_OFF) { |
817 |
+ ptr = skb_network_header(skb) + k - SKF_NET_OFF; |
818 |
+- else if (k >= SKF_LL_OFF) |
819 |
++ } else if (k >= SKF_LL_OFF) { |
820 |
++ if (unlikely(!skb_mac_header_was_set(skb))) |
821 |
++ return NULL; |
822 |
+ ptr = skb_mac_header(skb) + k - SKF_LL_OFF; |
823 |
+- |
824 |
++ } |
825 |
+ if (ptr >= skb->head && ptr + size <= skb_tail_pointer(skb)) |
826 |
+ return ptr; |
827 |
+ |
828 |
+diff --git a/kernel/events/core.c b/kernel/events/core.c |
829 |
+index 2466e2ae54dc1..58ef731d52c76 100644 |
830 |
+--- a/kernel/events/core.c |
831 |
++++ b/kernel/events/core.c |
832 |
+@@ -5291,10 +5291,10 @@ again: |
833 |
+ |
834 |
+ if (!atomic_inc_not_zero(&event->rb->mmap_count)) { |
835 |
+ /* |
836 |
+- * Raced against perf_mmap_close() through |
837 |
+- * perf_event_set_output(). Try again, hope for better |
838 |
+- * luck. |
839 |
++ * Raced against perf_mmap_close(); remove the |
840 |
++ * event and try again. |
841 |
+ */ |
842 |
++ ring_buffer_attach(event, NULL); |
843 |
+ mutex_unlock(&event->mmap_mutex); |
844 |
+ goto again; |
845 |
+ } |
846 |
+@@ -9542,14 +9542,25 @@ err_size: |
847 |
+ goto out; |
848 |
+ } |
849 |
+ |
850 |
++static void mutex_lock_double(struct mutex *a, struct mutex *b) |
851 |
++{ |
852 |
++ if (b < a) |
853 |
++ swap(a, b); |
854 |
++ |
855 |
++ mutex_lock(a); |
856 |
++ mutex_lock_nested(b, SINGLE_DEPTH_NESTING); |
857 |
++} |
858 |
++ |
859 |
+ static int |
860 |
+ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) |
861 |
+ { |
862 |
+ struct ring_buffer *rb = NULL; |
863 |
+ int ret = -EINVAL; |
864 |
+ |
865 |
+- if (!output_event) |
866 |
++ if (!output_event) { |
867 |
++ mutex_lock(&event->mmap_mutex); |
868 |
+ goto set; |
869 |
++ } |
870 |
+ |
871 |
+ /* don't allow circular references */ |
872 |
+ if (event == output_event) |
873 |
+@@ -9587,8 +9598,15 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) |
874 |
+ event->pmu != output_event->pmu) |
875 |
+ goto out; |
876 |
+ |
877 |
++ /* |
878 |
++ * Hold both mmap_mutex to serialize against perf_mmap_close(). Since |
879 |
++ * output_event is already on rb->event_list, and the list iteration |
880 |
++ * restarts after every removal, it is guaranteed this new event is |
881 |
++ * observed *OR* if output_event is already removed, it's guaranteed we |
882 |
++ * observe !rb->mmap_count. |
883 |
++ */ |
884 |
++ mutex_lock_double(&event->mmap_mutex, &output_event->mmap_mutex); |
885 |
+ set: |
886 |
+- mutex_lock(&event->mmap_mutex); |
887 |
+ /* Can't redirect output if we've got an active mmap() */ |
888 |
+ if (atomic_read(&event->mmap_count)) |
889 |
+ goto unlock; |
890 |
+@@ -9598,6 +9616,12 @@ set: |
891 |
+ rb = ring_buffer_get(output_event); |
892 |
+ if (!rb) |
893 |
+ goto unlock; |
894 |
++ |
895 |
++ /* did we race against perf_mmap_close() */ |
896 |
++ if (!atomic_read(&rb->mmap_count)) { |
897 |
++ ring_buffer_put(rb); |
898 |
++ goto unlock; |
899 |
++ } |
900 |
+ } |
901 |
+ |
902 |
+ ring_buffer_attach(event, rb); |
903 |
+@@ -9605,20 +9629,13 @@ set: |
904 |
+ ret = 0; |
905 |
+ unlock: |
906 |
+ mutex_unlock(&event->mmap_mutex); |
907 |
++ if (output_event) |
908 |
++ mutex_unlock(&output_event->mmap_mutex); |
909 |
+ |
910 |
+ out: |
911 |
+ return ret; |
912 |
+ } |
913 |
+ |
914 |
+-static void mutex_lock_double(struct mutex *a, struct mutex *b) |
915 |
+-{ |
916 |
+- if (b < a) |
917 |
+- swap(a, b); |
918 |
+- |
919 |
+- mutex_lock(a); |
920 |
+- mutex_lock_nested(b, SINGLE_DEPTH_NESTING); |
921 |
+-} |
922 |
+- |
923 |
+ static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id) |
924 |
+ { |
925 |
+ bool nmi_safe = false; |
926 |
+diff --git a/kernel/exit.c b/kernel/exit.c |
927 |
+index 8716f0780fe3d..e0db254a405bb 100644 |
928 |
+--- a/kernel/exit.c |
929 |
++++ b/kernel/exit.c |
930 |
+@@ -14,7 +14,6 @@ |
931 |
+ #include <linux/tty.h> |
932 |
+ #include <linux/iocontext.h> |
933 |
+ #include <linux/key.h> |
934 |
+-#include <linux/security.h> |
935 |
+ #include <linux/cpu.h> |
936 |
+ #include <linux/acct.h> |
937 |
+ #include <linux/tsacct_kern.h> |
938 |
+@@ -1342,7 +1341,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) |
939 |
+ * Returns nonzero for a final return, when we have unlocked tasklist_lock. |
940 |
+ * Returns zero if the search for a child should continue; |
941 |
+ * then ->notask_error is 0 if @p is an eligible child, |
942 |
+- * or another error from security_task_wait(), or still -ECHILD. |
943 |
++ * or still -ECHILD. |
944 |
+ */ |
945 |
+ static int wait_consider_task(struct wait_opts *wo, int ptrace, |
946 |
+ struct task_struct *p) |
947 |
+@@ -1362,20 +1361,6 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace, |
948 |
+ if (!ret) |
949 |
+ return ret; |
950 |
+ |
951 |
+- ret = security_task_wait(p); |
952 |
+- if (unlikely(ret < 0)) { |
953 |
+- /* |
954 |
+- * If we have not yet seen any eligible child, |
955 |
+- * then let this error code replace -ECHILD. |
956 |
+- * A permission error will give the user a clue |
957 |
+- * to look for security policy problems, rather |
958 |
+- * than for mysterious wait bugs. |
959 |
+- */ |
960 |
+- if (wo->notask_error) |
961 |
+- wo->notask_error = ret; |
962 |
+- return 0; |
963 |
+- } |
964 |
+- |
965 |
+ if (unlikely(exit_state == EXIT_TRACE)) { |
966 |
+ /* |
967 |
+ * ptrace == 0 means we are the natural parent. In this case |
968 |
+@@ -1468,7 +1453,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace, |
969 |
+ * Returns nonzero for a final return, when we have unlocked tasklist_lock. |
970 |
+ * Returns zero if the search for a child should continue; then |
971 |
+ * ->notask_error is 0 if there were any eligible children, |
972 |
+- * or another error from security_task_wait(), or still -ECHILD. |
973 |
++ * or still -ECHILD. |
974 |
+ */ |
975 |
+ static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk) |
976 |
+ { |
977 |
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c |
978 |
+index 6059f85546fe9..2990a05777bde 100644 |
979 |
+--- a/mm/mempolicy.c |
980 |
++++ b/mm/mempolicy.c |
981 |
+@@ -396,7 +396,7 @@ static void mpol_rebind_preferred(struct mempolicy *pol, |
982 |
+ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask, |
983 |
+ enum mpol_rebind_step step) |
984 |
+ { |
985 |
+- if (!pol) |
986 |
++ if (!pol || pol->mode == MPOL_LOCAL) |
987 |
+ return; |
988 |
+ if (!mpol_store_user_nodemask(pol) && step == MPOL_REBIND_ONCE && |
989 |
+ nodes_equal(pol->w.cpuset_mems_allowed, *newmask)) |
990 |
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c |
991 |
+index 75f961425639e..3c09bee931b7a 100644 |
992 |
+--- a/net/ipv4/igmp.c |
993 |
++++ b/net/ipv4/igmp.c |
994 |
+@@ -474,7 +474,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, |
995 |
+ |
996 |
+ if (pmc->multiaddr == IGMP_ALL_HOSTS) |
997 |
+ return skb; |
998 |
+- if (ipv4_is_local_multicast(pmc->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) |
999 |
++ if (ipv4_is_local_multicast(pmc->multiaddr) && |
1000 |
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) |
1001 |
+ return skb; |
1002 |
+ |
1003 |
+ mtu = READ_ONCE(dev->mtu); |
1004 |
+@@ -600,7 +601,7 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc) |
1005 |
+ if (pmc->multiaddr == IGMP_ALL_HOSTS) |
1006 |
+ continue; |
1007 |
+ if (ipv4_is_local_multicast(pmc->multiaddr) && |
1008 |
+- !net->ipv4.sysctl_igmp_llm_reports) |
1009 |
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) |
1010 |
+ continue; |
1011 |
+ spin_lock_bh(&pmc->lock); |
1012 |
+ if (pmc->sfcount[MCAST_EXCLUDE]) |
1013 |
+@@ -743,7 +744,8 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc, |
1014 |
+ if (type == IGMPV3_HOST_MEMBERSHIP_REPORT) |
1015 |
+ return igmpv3_send_report(in_dev, pmc); |
1016 |
+ |
1017 |
+- if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports) |
1018 |
++ if (ipv4_is_local_multicast(group) && |
1019 |
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) |
1020 |
+ return 0; |
1021 |
+ |
1022 |
+ if (type == IGMP_HOST_LEAVE_MESSAGE) |
1023 |
+@@ -921,7 +923,8 @@ static bool igmp_heard_report(struct in_device *in_dev, __be32 group) |
1024 |
+ |
1025 |
+ if (group == IGMP_ALL_HOSTS) |
1026 |
+ return false; |
1027 |
+- if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports) |
1028 |
++ if (ipv4_is_local_multicast(group) && |
1029 |
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) |
1030 |
+ return false; |
1031 |
+ |
1032 |
+ rcu_read_lock(); |
1033 |
+@@ -1031,7 +1034,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb, |
1034 |
+ if (im->multiaddr == IGMP_ALL_HOSTS) |
1035 |
+ continue; |
1036 |
+ if (ipv4_is_local_multicast(im->multiaddr) && |
1037 |
+- !net->ipv4.sysctl_igmp_llm_reports) |
1038 |
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) |
1039 |
+ continue; |
1040 |
+ spin_lock_bh(&im->lock); |
1041 |
+ if (im->tm_running) |
1042 |
+@@ -1272,7 +1275,8 @@ static void igmp_group_dropped(struct ip_mc_list *im) |
1043 |
+ #ifdef CONFIG_IP_MULTICAST |
1044 |
+ if (im->multiaddr == IGMP_ALL_HOSTS) |
1045 |
+ return; |
1046 |
+- if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) |
1047 |
++ if (ipv4_is_local_multicast(im->multiaddr) && |
1048 |
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) |
1049 |
+ return; |
1050 |
+ |
1051 |
+ reporter = im->reporter; |
1052 |
+@@ -1309,7 +1313,8 @@ static void igmp_group_added(struct ip_mc_list *im) |
1053 |
+ #ifdef CONFIG_IP_MULTICAST |
1054 |
+ if (im->multiaddr == IGMP_ALL_HOSTS) |
1055 |
+ return; |
1056 |
+- if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) |
1057 |
++ if (ipv4_is_local_multicast(im->multiaddr) && |
1058 |
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) |
1059 |
+ return; |
1060 |
+ |
1061 |
+ if (in_dev->dead) |
1062 |
+@@ -1621,7 +1626,7 @@ static void ip_mc_rejoin_groups(struct in_device *in_dev) |
1063 |
+ if (im->multiaddr == IGMP_ALL_HOSTS) |
1064 |
+ continue; |
1065 |
+ if (ipv4_is_local_multicast(im->multiaddr) && |
1066 |
+- !net->ipv4.sysctl_igmp_llm_reports) |
1067 |
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) |
1068 |
+ continue; |
1069 |
+ |
1070 |
+ /* a failover is happening and switches |
1071 |
+@@ -2166,7 +2171,7 @@ int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr) |
1072 |
+ count++; |
1073 |
+ } |
1074 |
+ err = -ENOBUFS; |
1075 |
+- if (count >= net->ipv4.sysctl_igmp_max_memberships) |
1076 |
++ if (count >= READ_ONCE(net->ipv4.sysctl_igmp_max_memberships)) |
1077 |
+ goto done; |
1078 |
+ iml = sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL); |
1079 |
+ if (!iml) |
1080 |
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
1081 |
+index e0009cd69da75..5b6d935a028c2 100644 |
1082 |
+--- a/net/ipv4/tcp_output.c |
1083 |
++++ b/net/ipv4/tcp_output.c |
1084 |
+@@ -2005,7 +2005,7 @@ static int tcp_mtu_probe(struct sock *sk) |
1085 |
+ * probing process by not resetting search range to its orignal. |
1086 |
+ */ |
1087 |
+ if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high) || |
1088 |
+- interval < net->ipv4.sysctl_tcp_probe_threshold) { |
1089 |
++ interval < READ_ONCE(net->ipv4.sysctl_tcp_probe_threshold)) { |
1090 |
+ /* Check whether enough time has elaplased for |
1091 |
+ * another round of probing. |
1092 |
+ */ |
1093 |
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c |
1094 |
+index 9179b47e8b61f..0894108f561cb 100644 |
1095 |
+--- a/net/xfrm/xfrm_policy.c |
1096 |
++++ b/net/xfrm/xfrm_policy.c |
1097 |
+@@ -1819,8 +1819,10 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, |
1098 |
+ *num_xfrms = 0; |
1099 |
+ return 0; |
1100 |
+ } |
1101 |
+- if (IS_ERR(pols[0])) |
1102 |
++ if (IS_ERR(pols[0])) { |
1103 |
++ *num_pols = 0; |
1104 |
+ return PTR_ERR(pols[0]); |
1105 |
++ } |
1106 |
+ |
1107 |
+ *num_xfrms = pols[0]->xfrm_nr; |
1108 |
+ |
1109 |
+@@ -1834,6 +1836,7 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, |
1110 |
+ if (pols[1]) { |
1111 |
+ if (IS_ERR(pols[1])) { |
1112 |
+ xfrm_pols_put(pols, *num_pols); |
1113 |
++ *num_pols = 0; |
1114 |
+ return PTR_ERR(pols[1]); |
1115 |
+ } |
1116 |
+ (*num_pols)++; |
1117 |
+diff --git a/security/security.c b/security/security.c |
1118 |
+index 9a13d72a64465..5171c3cd1d304 100644 |
1119 |
+--- a/security/security.c |
1120 |
++++ b/security/security.c |
1121 |
+@@ -1032,11 +1032,6 @@ int security_task_kill(struct task_struct *p, struct siginfo *info, |
1122 |
+ return call_int_hook(task_kill, 0, p, info, sig, secid); |
1123 |
+ } |
1124 |
+ |
1125 |
+-int security_task_wait(struct task_struct *p) |
1126 |
+-{ |
1127 |
+- return call_int_hook(task_wait, 0, p); |
1128 |
+-} |
1129 |
+- |
1130 |
+ int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, |
1131 |
+ unsigned long arg4, unsigned long arg5) |
1132 |
+ { |
1133 |
+@@ -1776,7 +1771,6 @@ struct security_hook_heads security_hook_heads = { |
1134 |
+ .task_movememory = |
1135 |
+ LIST_HEAD_INIT(security_hook_heads.task_movememory), |
1136 |
+ .task_kill = LIST_HEAD_INIT(security_hook_heads.task_kill), |
1137 |
+- .task_wait = LIST_HEAD_INIT(security_hook_heads.task_wait), |
1138 |
+ .task_prctl = LIST_HEAD_INIT(security_hook_heads.task_prctl), |
1139 |
+ .task_to_inode = |
1140 |
+ LIST_HEAD_INIT(security_hook_heads.task_to_inode), |
1141 |
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c |
1142 |
+index eb9e2b4e81d92..eb503eccbacc8 100644 |
1143 |
+--- a/security/selinux/hooks.c |
1144 |
++++ b/security/selinux/hooks.c |
1145 |
+@@ -3951,11 +3951,6 @@ static int selinux_task_kill(struct task_struct *p, struct siginfo *info, |
1146 |
+ return rc; |
1147 |
+ } |
1148 |
+ |
1149 |
+-static int selinux_task_wait(struct task_struct *p) |
1150 |
+-{ |
1151 |
+- return task_has_perm(p, current, PROCESS__SIGCHLD); |
1152 |
+-} |
1153 |
+- |
1154 |
+ static void selinux_task_to_inode(struct task_struct *p, |
1155 |
+ struct inode *inode) |
1156 |
+ { |
1157 |
+@@ -6220,7 +6215,6 @@ static struct security_hook_list selinux_hooks[] = { |
1158 |
+ LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler), |
1159 |
+ LSM_HOOK_INIT(task_movememory, selinux_task_movememory), |
1160 |
+ LSM_HOOK_INIT(task_kill, selinux_task_kill), |
1161 |
+- LSM_HOOK_INIT(task_wait, selinux_task_wait), |
1162 |
+ LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode), |
1163 |
+ |
1164 |
+ LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission), |
1165 |
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c |
1166 |
+index 84ed47195cdd2..f01b69ead47ec 100644 |
1167 |
+--- a/security/smack/smack_lsm.c |
1168 |
++++ b/security/smack/smack_lsm.c |
1169 |
+@@ -2276,25 +2276,6 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, |
1170 |
+ return rc; |
1171 |
+ } |
1172 |
+ |
1173 |
+-/** |
1174 |
+- * smack_task_wait - Smack access check for waiting |
1175 |
+- * @p: task to wait for |
1176 |
+- * |
1177 |
+- * Returns 0 |
1178 |
+- */ |
1179 |
+-static int smack_task_wait(struct task_struct *p) |
1180 |
+-{ |
1181 |
+- /* |
1182 |
+- * Allow the operation to succeed. |
1183 |
+- * Zombies are bad. |
1184 |
+- * In userless environments (e.g. phones) programs |
1185 |
+- * get marked with SMACK64EXEC and even if the parent |
1186 |
+- * and child shouldn't be talking the parent still |
1187 |
+- * may expect to know when the child exits. |
1188 |
+- */ |
1189 |
+- return 0; |
1190 |
+-} |
1191 |
+- |
1192 |
+ /** |
1193 |
+ * smack_task_to_inode - copy task smack into the inode blob |
1194 |
+ * @p: task to copy from |
1195 |
+@@ -4686,7 +4667,6 @@ static struct security_hook_list smack_hooks[] = { |
1196 |
+ LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler), |
1197 |
+ LSM_HOOK_INIT(task_movememory, smack_task_movememory), |
1198 |
+ LSM_HOOK_INIT(task_kill, smack_task_kill), |
1199 |
+- LSM_HOOK_INIT(task_wait, smack_task_wait), |
1200 |
+ LSM_HOOK_INIT(task_to_inode, smack_task_to_inode), |
1201 |
+ |
1202 |
+ LSM_HOOK_INIT(ipc_permission, smack_ipc_permission), |
1203 |
+diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c |
1204 |
+index 78ffe445d7757..a67fbcabfa67d 100644 |
1205 |
+--- a/sound/core/memalloc.c |
1206 |
++++ b/sound/core/memalloc.c |
1207 |
+@@ -177,6 +177,7 @@ int snd_dma_alloc_pages(int type, struct device *device, size_t size, |
1208 |
+ if (WARN_ON(!dmab)) |
1209 |
+ return -ENXIO; |
1210 |
+ |
1211 |
++ size = PAGE_ALIGN(size); |
1212 |
+ dmab->dev.type = type; |
1213 |
+ dmab->dev.dev = device; |
1214 |
+ dmab->bytes = 0; |