1 |
commit: f0242eaa0eed2447119f316e38a8949bdcb03e26 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Jun 30 14:25:14 2021 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Jun 30 14:25:14 2021 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f0242eaa |
7 |
|
8 |
Linux patch 4.19.196 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1195_linux-4.19.196.patch | 3617 +++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 3621 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index 3d05639..2009bef 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -819,6 +819,10 @@ Patch: 1194_linux-4.19.195.patch |
21 |
From: https://www.kernel.org |
22 |
Desc: Linux 4.19.195 |
23 |
|
24 |
+Patch: 1195_linux-4.19.196.patch |
25 |
+From: https://www.kernel.org |
26 |
+Desc: Linux 4.19.196 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1195_linux-4.19.196.patch b/1195_linux-4.19.196.patch |
33 |
new file mode 100644 |
34 |
index 0000000..ad359a6 |
35 |
--- /dev/null |
36 |
+++ b/1195_linux-4.19.196.patch |
37 |
@@ -0,0 +1,3617 @@ |
38 |
+diff --git a/Documentation/vm/slub.rst b/Documentation/vm/slub.rst |
39 |
+index 3a775fd64e2db..3602959d5f92b 100644 |
40 |
+--- a/Documentation/vm/slub.rst |
41 |
++++ b/Documentation/vm/slub.rst |
42 |
+@@ -154,7 +154,7 @@ SLUB Debug output |
43 |
+ Here is a sample of slub debug output:: |
44 |
+ |
45 |
+ ==================================================================== |
46 |
+- BUG kmalloc-8: Redzone overwritten |
47 |
++ BUG kmalloc-8: Right Redzone overwritten |
48 |
+ -------------------------------------------------------------------- |
49 |
+ |
50 |
+ INFO: 0xc90f6d28-0xc90f6d2b. First byte 0x00 instead of 0xcc |
51 |
+@@ -162,10 +162,10 @@ Here is a sample of slub debug output:: |
52 |
+ INFO: Object 0xc90f6d20 @offset=3360 fp=0xc90f6d58 |
53 |
+ INFO: Allocated in get_modalias+0x61/0xf5 age=53 cpu=1 pid=554 |
54 |
+ |
55 |
+- Bytes b4 0xc90f6d10: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ |
56 |
+- Object 0xc90f6d20: 31 30 31 39 2e 30 30 35 1019.005 |
57 |
+- Redzone 0xc90f6d28: 00 cc cc cc . |
58 |
+- Padding 0xc90f6d50: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ |
59 |
++ Bytes b4 (0xc90f6d10): 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ |
60 |
++ Object (0xc90f6d20): 31 30 31 39 2e 30 30 35 1019.005 |
61 |
++ Redzone (0xc90f6d28): 00 cc cc cc . |
62 |
++ Padding (0xc90f6d50): 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ |
63 |
+ |
64 |
+ [<c010523d>] dump_trace+0x63/0x1eb |
65 |
+ [<c01053df>] show_trace_log_lvl+0x1a/0x2f |
66 |
+diff --git a/Makefile b/Makefile |
67 |
+index 9ff7a4b7b8cbd..63b0bc92a0fa6 100644 |
68 |
+--- a/Makefile |
69 |
++++ b/Makefile |
70 |
+@@ -1,7 +1,7 @@ |
71 |
+ # SPDX-License-Identifier: GPL-2.0 |
72 |
+ VERSION = 4 |
73 |
+ PATCHLEVEL = 19 |
74 |
+-SUBLEVEL = 195 |
75 |
++SUBLEVEL = 196 |
76 |
+ EXTRAVERSION = |
77 |
+ NAME = "People's Front" |
78 |
+ |
79 |
+@@ -716,12 +716,11 @@ KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare) |
80 |
+ # See modpost pattern 2 |
81 |
+ KBUILD_CFLAGS += $(call cc-option, -mno-global-merge,) |
82 |
+ KBUILD_CFLAGS += $(call cc-option, -fcatch-undefined-behavior) |
83 |
+-else |
84 |
++endif |
85 |
+ |
86 |
+ # These warnings generated too much noise in a regular build. |
87 |
+ # Use make W=1 to enable them (see scripts/Makefile.extrawarn) |
88 |
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable) |
89 |
+-endif |
90 |
+ |
91 |
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) |
92 |
+ ifdef CONFIG_FRAME_POINTER |
93 |
+diff --git a/arch/arc/include/uapi/asm/sigcontext.h b/arch/arc/include/uapi/asm/sigcontext.h |
94 |
+index 95f8a4380e110..7a5449dfcb290 100644 |
95 |
+--- a/arch/arc/include/uapi/asm/sigcontext.h |
96 |
++++ b/arch/arc/include/uapi/asm/sigcontext.h |
97 |
+@@ -18,6 +18,7 @@ |
98 |
+ */ |
99 |
+ struct sigcontext { |
100 |
+ struct user_regs_struct regs; |
101 |
++ struct user_regs_arcv2 v2abi; |
102 |
+ }; |
103 |
+ |
104 |
+ #endif /* _ASM_ARC_SIGCONTEXT_H */ |
105 |
+diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c |
106 |
+index da243420bcb58..68901f6f18bab 100644 |
107 |
+--- a/arch/arc/kernel/signal.c |
108 |
++++ b/arch/arc/kernel/signal.c |
109 |
+@@ -64,6 +64,41 @@ struct rt_sigframe { |
110 |
+ unsigned int sigret_magic; |
111 |
+ }; |
112 |
+ |
113 |
++static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) |
114 |
++{ |
115 |
++ int err = 0; |
116 |
++#ifndef CONFIG_ISA_ARCOMPACT |
117 |
++ struct user_regs_arcv2 v2abi; |
118 |
++ |
119 |
++ v2abi.r30 = regs->r30; |
120 |
++#ifdef CONFIG_ARC_HAS_ACCL_REGS |
121 |
++ v2abi.r58 = regs->r58; |
122 |
++ v2abi.r59 = regs->r59; |
123 |
++#else |
124 |
++ v2abi.r58 = v2abi.r59 = 0; |
125 |
++#endif |
126 |
++ err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi)); |
127 |
++#endif |
128 |
++ return err; |
129 |
++} |
130 |
++ |
131 |
++static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) |
132 |
++{ |
133 |
++ int err = 0; |
134 |
++#ifndef CONFIG_ISA_ARCOMPACT |
135 |
++ struct user_regs_arcv2 v2abi; |
136 |
++ |
137 |
++ err = __copy_from_user(&v2abi, &mctx->v2abi, sizeof(v2abi)); |
138 |
++ |
139 |
++ regs->r30 = v2abi.r30; |
140 |
++#ifdef CONFIG_ARC_HAS_ACCL_REGS |
141 |
++ regs->r58 = v2abi.r58; |
142 |
++ regs->r59 = v2abi.r59; |
143 |
++#endif |
144 |
++#endif |
145 |
++ return err; |
146 |
++} |
147 |
++ |
148 |
+ static int |
149 |
+ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs, |
150 |
+ sigset_t *set) |
151 |
+@@ -97,6 +132,10 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs, |
152 |
+ |
153 |
+ err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), &uregs.scratch, |
154 |
+ sizeof(sf->uc.uc_mcontext.regs.scratch)); |
155 |
++ |
156 |
++ if (is_isa_arcv2()) |
157 |
++ err |= save_arcv2_regs(&(sf->uc.uc_mcontext), regs); |
158 |
++ |
159 |
+ err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t)); |
160 |
+ |
161 |
+ return err ? -EFAULT : 0; |
162 |
+@@ -112,6 +151,10 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf) |
163 |
+ err |= __copy_from_user(&uregs.scratch, |
164 |
+ &(sf->uc.uc_mcontext.regs.scratch), |
165 |
+ sizeof(sf->uc.uc_mcontext.regs.scratch)); |
166 |
++ |
167 |
++ if (is_isa_arcv2()) |
168 |
++ err |= restore_arcv2_regs(&(sf->uc.uc_mcontext), regs); |
169 |
++ |
170 |
+ if (err) |
171 |
+ return -EFAULT; |
172 |
+ |
173 |
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c |
174 |
+index 7bbaa293a38ce..95db057ed2fab 100644 |
175 |
+--- a/arch/arm/kernel/setup.c |
176 |
++++ b/arch/arm/kernel/setup.c |
177 |
+@@ -547,9 +547,11 @@ void notrace cpu_init(void) |
178 |
+ * In Thumb-2, msr with an immediate value is not allowed. |
179 |
+ */ |
180 |
+ #ifdef CONFIG_THUMB2_KERNEL |
181 |
+-#define PLC "r" |
182 |
++#define PLC_l "l" |
183 |
++#define PLC_r "r" |
184 |
+ #else |
185 |
+-#define PLC "I" |
186 |
++#define PLC_l "I" |
187 |
++#define PLC_r "I" |
188 |
+ #endif |
189 |
+ |
190 |
+ /* |
191 |
+@@ -571,15 +573,15 @@ void notrace cpu_init(void) |
192 |
+ "msr cpsr_c, %9" |
193 |
+ : |
194 |
+ : "r" (stk), |
195 |
+- PLC (PSR_F_BIT | PSR_I_BIT | IRQ_MODE), |
196 |
++ PLC_r (PSR_F_BIT | PSR_I_BIT | IRQ_MODE), |
197 |
+ "I" (offsetof(struct stack, irq[0])), |
198 |
+- PLC (PSR_F_BIT | PSR_I_BIT | ABT_MODE), |
199 |
++ PLC_r (PSR_F_BIT | PSR_I_BIT | ABT_MODE), |
200 |
+ "I" (offsetof(struct stack, abt[0])), |
201 |
+- PLC (PSR_F_BIT | PSR_I_BIT | UND_MODE), |
202 |
++ PLC_r (PSR_F_BIT | PSR_I_BIT | UND_MODE), |
203 |
+ "I" (offsetof(struct stack, und[0])), |
204 |
+- PLC (PSR_F_BIT | PSR_I_BIT | FIQ_MODE), |
205 |
++ PLC_r (PSR_F_BIT | PSR_I_BIT | FIQ_MODE), |
206 |
+ "I" (offsetof(struct stack, fiq[0])), |
207 |
+- PLC (PSR_F_BIT | PSR_I_BIT | SVC_MODE) |
208 |
++ PLC_l (PSR_F_BIT | PSR_I_BIT | SVC_MODE) |
209 |
+ : "r14"); |
210 |
+ #endif |
211 |
+ } |
212 |
+diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c |
213 |
+index 75bc18646df66..902e9df9b8bbb 100644 |
214 |
+--- a/arch/arm/mach-omap2/board-n8x0.c |
215 |
++++ b/arch/arm/mach-omap2/board-n8x0.c |
216 |
+@@ -325,6 +325,7 @@ static int n8x0_mmc_get_cover_state(struct device *dev, int slot) |
217 |
+ |
218 |
+ static void n8x0_mmc_callback(void *data, u8 card_mask) |
219 |
+ { |
220 |
++#ifdef CONFIG_MMC_OMAP |
221 |
+ int bit, *openp, index; |
222 |
+ |
223 |
+ if (board_is_n800()) { |
224 |
+@@ -342,7 +343,6 @@ static void n8x0_mmc_callback(void *data, u8 card_mask) |
225 |
+ else |
226 |
+ *openp = 0; |
227 |
+ |
228 |
+-#ifdef CONFIG_MMC_OMAP |
229 |
+ omap_mmc_notify_cover_event(mmc_device, index, *openp); |
230 |
+ #else |
231 |
+ pr_warn("MMC: notify cover event not available\n"); |
232 |
+diff --git a/arch/mips/generic/board-boston.its.S b/arch/mips/generic/board-boston.its.S |
233 |
+index a7f51f97b9102..c45ad27594218 100644 |
234 |
+--- a/arch/mips/generic/board-boston.its.S |
235 |
++++ b/arch/mips/generic/board-boston.its.S |
236 |
+@@ -1,22 +1,22 @@ |
237 |
+ / { |
238 |
+ images { |
239 |
+- fdt@boston { |
240 |
++ fdt-boston { |
241 |
+ description = "img,boston Device Tree"; |
242 |
+ data = /incbin/("boot/dts/img/boston.dtb"); |
243 |
+ type = "flat_dt"; |
244 |
+ arch = "mips"; |
245 |
+ compression = "none"; |
246 |
+- hash@0 { |
247 |
++ hash { |
248 |
+ algo = "sha1"; |
249 |
+ }; |
250 |
+ }; |
251 |
+ }; |
252 |
+ |
253 |
+ configurations { |
254 |
+- conf@boston { |
255 |
++ conf-boston { |
256 |
+ description = "Boston Linux kernel"; |
257 |
+- kernel = "kernel@0"; |
258 |
+- fdt = "fdt@boston"; |
259 |
++ kernel = "kernel"; |
260 |
++ fdt = "fdt-boston"; |
261 |
+ }; |
262 |
+ }; |
263 |
+ }; |
264 |
+diff --git a/arch/mips/generic/board-ni169445.its.S b/arch/mips/generic/board-ni169445.its.S |
265 |
+index e4cb4f95a8cc1..0a2e8f7a8526f 100644 |
266 |
+--- a/arch/mips/generic/board-ni169445.its.S |
267 |
++++ b/arch/mips/generic/board-ni169445.its.S |
268 |
+@@ -1,22 +1,22 @@ |
269 |
+ / { |
270 |
+ images { |
271 |
+- fdt@ni169445 { |
272 |
++ fdt-ni169445 { |
273 |
+ description = "NI 169445 device tree"; |
274 |
+ data = /incbin/("boot/dts/ni/169445.dtb"); |
275 |
+ type = "flat_dt"; |
276 |
+ arch = "mips"; |
277 |
+ compression = "none"; |
278 |
+- hash@0 { |
279 |
++ hash { |
280 |
+ algo = "sha1"; |
281 |
+ }; |
282 |
+ }; |
283 |
+ }; |
284 |
+ |
285 |
+ configurations { |
286 |
+- conf@ni169445 { |
287 |
++ conf-ni169445 { |
288 |
+ description = "NI 169445 Linux Kernel"; |
289 |
+- kernel = "kernel@0"; |
290 |
+- fdt = "fdt@ni169445"; |
291 |
++ kernel = "kernel"; |
292 |
++ fdt = "fdt-ni169445"; |
293 |
+ }; |
294 |
+ }; |
295 |
+ }; |
296 |
+diff --git a/arch/mips/generic/board-xilfpga.its.S b/arch/mips/generic/board-xilfpga.its.S |
297 |
+index a2e773d3f14f4..08c1e900eb4ed 100644 |
298 |
+--- a/arch/mips/generic/board-xilfpga.its.S |
299 |
++++ b/arch/mips/generic/board-xilfpga.its.S |
300 |
+@@ -1,22 +1,22 @@ |
301 |
+ / { |
302 |
+ images { |
303 |
+- fdt@xilfpga { |
304 |
++ fdt-xilfpga { |
305 |
+ description = "MIPSfpga (xilfpga) Device Tree"; |
306 |
+ data = /incbin/("boot/dts/xilfpga/nexys4ddr.dtb"); |
307 |
+ type = "flat_dt"; |
308 |
+ arch = "mips"; |
309 |
+ compression = "none"; |
310 |
+- hash@0 { |
311 |
++ hash { |
312 |
+ algo = "sha1"; |
313 |
+ }; |
314 |
+ }; |
315 |
+ }; |
316 |
+ |
317 |
+ configurations { |
318 |
+- conf@xilfpga { |
319 |
++ conf-xilfpga { |
320 |
+ description = "MIPSfpga Linux kernel"; |
321 |
+- kernel = "kernel@0"; |
322 |
+- fdt = "fdt@xilfpga"; |
323 |
++ kernel = "kernel"; |
324 |
++ fdt = "fdt-xilfpga"; |
325 |
+ }; |
326 |
+ }; |
327 |
+ }; |
328 |
+diff --git a/arch/mips/generic/vmlinux.its.S b/arch/mips/generic/vmlinux.its.S |
329 |
+index 1a08438fd8930..3e254676540f4 100644 |
330 |
+--- a/arch/mips/generic/vmlinux.its.S |
331 |
++++ b/arch/mips/generic/vmlinux.its.S |
332 |
+@@ -6,7 +6,7 @@ |
333 |
+ #address-cells = <ADDR_CELLS>; |
334 |
+ |
335 |
+ images { |
336 |
+- kernel@0 { |
337 |
++ kernel { |
338 |
+ description = KERNEL_NAME; |
339 |
+ data = /incbin/(VMLINUX_BINARY); |
340 |
+ type = "kernel"; |
341 |
+@@ -15,18 +15,18 @@ |
342 |
+ compression = VMLINUX_COMPRESSION; |
343 |
+ load = /bits/ ADDR_BITS <VMLINUX_LOAD_ADDRESS>; |
344 |
+ entry = /bits/ ADDR_BITS <VMLINUX_ENTRY_ADDRESS>; |
345 |
+- hash@0 { |
346 |
++ hash { |
347 |
+ algo = "sha1"; |
348 |
+ }; |
349 |
+ }; |
350 |
+ }; |
351 |
+ |
352 |
+ configurations { |
353 |
+- default = "conf@default"; |
354 |
++ default = "conf-default"; |
355 |
+ |
356 |
+- conf@default { |
357 |
++ conf-default { |
358 |
+ description = "Generic Linux kernel"; |
359 |
+- kernel = "kernel@0"; |
360 |
++ kernel = "kernel"; |
361 |
+ }; |
362 |
+ }; |
363 |
+ }; |
364 |
+diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c |
365 |
+index d99a8ee9e185e..86a231338bbfe 100644 |
366 |
+--- a/arch/x86/kernel/fpu/signal.c |
367 |
++++ b/arch/x86/kernel/fpu/signal.c |
368 |
+@@ -272,6 +272,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) |
369 |
+ int state_size = fpu_kernel_xstate_size; |
370 |
+ u64 xfeatures = 0; |
371 |
+ int fx_only = 0; |
372 |
++ int ret = 0; |
373 |
+ |
374 |
+ ia32_fxstate &= (IS_ENABLED(CONFIG_X86_32) || |
375 |
+ IS_ENABLED(CONFIG_IA32_EMULATION)); |
376 |
+@@ -281,15 +282,21 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) |
377 |
+ return 0; |
378 |
+ } |
379 |
+ |
380 |
+- if (!access_ok(VERIFY_READ, buf, size)) |
381 |
+- return -EACCES; |
382 |
++ if (!access_ok(VERIFY_READ, buf, size)) { |
383 |
++ ret = -EACCES; |
384 |
++ goto out_err; |
385 |
++ } |
386 |
+ |
387 |
+ fpu__initialize(fpu); |
388 |
+ |
389 |
+- if (!static_cpu_has(X86_FEATURE_FPU)) |
390 |
+- return fpregs_soft_set(current, NULL, |
391 |
+- 0, sizeof(struct user_i387_ia32_struct), |
392 |
+- NULL, buf) != 0; |
393 |
++ if (!static_cpu_has(X86_FEATURE_FPU)) { |
394 |
++ ret = fpregs_soft_set(current, NULL, |
395 |
++ 0, sizeof(struct user_i387_ia32_struct), |
396 |
++ NULL, buf) != 0; |
397 |
++ if (ret) |
398 |
++ goto out_err; |
399 |
++ return 0; |
400 |
++ } |
401 |
+ |
402 |
+ if (use_xsave()) { |
403 |
+ struct _fpx_sw_bytes fx_sw_user; |
404 |
+@@ -349,6 +356,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) |
405 |
+ fpu__restore(fpu); |
406 |
+ local_bh_enable(); |
407 |
+ |
408 |
++ /* Failure is already handled */ |
409 |
+ return err; |
410 |
+ } else { |
411 |
+ /* |
412 |
+@@ -356,13 +364,14 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) |
413 |
+ * state to the registers directly (with exceptions handled). |
414 |
+ */ |
415 |
+ user_fpu_begin(); |
416 |
+- if (copy_user_to_fpregs_zeroing(buf_fx, xfeatures, fx_only)) { |
417 |
+- fpu__clear(fpu); |
418 |
+- return -1; |
419 |
+- } |
420 |
++ if (!copy_user_to_fpregs_zeroing(buf_fx, xfeatures, fx_only)) |
421 |
++ return 0; |
422 |
++ ret = -1; |
423 |
+ } |
424 |
+ |
425 |
+- return 0; |
426 |
++out_err: |
427 |
++ fpu__clear(fpu); |
428 |
++ return ret; |
429 |
+ } |
430 |
+ |
431 |
+ static inline int xstate_sigframe_size(void) |
432 |
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c |
433 |
+index 0c67a5a94de30..76959a7d88c82 100644 |
434 |
+--- a/arch/x86/pci/fixup.c |
435 |
++++ b/arch/x86/pci/fixup.c |
436 |
+@@ -779,4 +779,48 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar); |
437 |
+ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar); |
438 |
+ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar); |
439 |
+ |
440 |
++#define RS690_LOWER_TOP_OF_DRAM2 0x30 |
441 |
++#define RS690_LOWER_TOP_OF_DRAM2_VALID 0x1 |
442 |
++#define RS690_UPPER_TOP_OF_DRAM2 0x31 |
443 |
++#define RS690_HTIU_NB_INDEX 0xA8 |
444 |
++#define RS690_HTIU_NB_INDEX_WR_ENABLE 0x100 |
445 |
++#define RS690_HTIU_NB_DATA 0xAC |
446 |
++ |
447 |
++/* |
448 |
++ * Some BIOS implementations support RAM above 4GB, but do not configure the |
449 |
++ * PCI host to respond to bus master accesses for these addresses. These |
450 |
++ * implementations set the TOP_OF_DRAM_SLOT1 register correctly, so PCI DMA |
451 |
++ * works as expected for addresses below 4GB. |
452 |
++ * |
453 |
++ * Reference: "AMD RS690 ASIC Family Register Reference Guide" (pg. 2-57) |
454 |
++ * https://www.amd.com/system/files/TechDocs/43372_rs690_rrg_3.00o.pdf |
455 |
++ */ |
456 |
++static void rs690_fix_64bit_dma(struct pci_dev *pdev) |
457 |
++{ |
458 |
++ u32 val = 0; |
459 |
++ phys_addr_t top_of_dram = __pa(high_memory - 1) + 1; |
460 |
++ |
461 |
++ if (top_of_dram <= (1ULL << 32)) |
462 |
++ return; |
463 |
++ |
464 |
++ pci_write_config_dword(pdev, RS690_HTIU_NB_INDEX, |
465 |
++ RS690_LOWER_TOP_OF_DRAM2); |
466 |
++ pci_read_config_dword(pdev, RS690_HTIU_NB_DATA, &val); |
467 |
++ |
468 |
++ if (val) |
469 |
++ return; |
470 |
++ |
471 |
++ pci_info(pdev, "Adjusting top of DRAM to %pa for 64-bit DMA support\n", &top_of_dram); |
472 |
++ |
473 |
++ pci_write_config_dword(pdev, RS690_HTIU_NB_INDEX, |
474 |
++ RS690_UPPER_TOP_OF_DRAM2 | RS690_HTIU_NB_INDEX_WR_ENABLE); |
475 |
++ pci_write_config_dword(pdev, RS690_HTIU_NB_DATA, top_of_dram >> 32); |
476 |
++ |
477 |
++ pci_write_config_dword(pdev, RS690_HTIU_NB_INDEX, |
478 |
++ RS690_LOWER_TOP_OF_DRAM2 | RS690_HTIU_NB_INDEX_WR_ENABLE); |
479 |
++ pci_write_config_dword(pdev, RS690_HTIU_NB_DATA, |
480 |
++ top_of_dram | RS690_LOWER_TOP_OF_DRAM2_VALID); |
481 |
++} |
482 |
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7910, rs690_fix_64bit_dma); |
483 |
++ |
484 |
+ #endif |
485 |
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig |
486 |
+index a4f95574eb9ad..52dd4bd7c2098 100644 |
487 |
+--- a/drivers/dma/Kconfig |
488 |
++++ b/drivers/dma/Kconfig |
489 |
+@@ -58,6 +58,7 @@ config DMA_OF |
490 |
+ #devices |
491 |
+ config ALTERA_MSGDMA |
492 |
+ tristate "Altera / Intel mSGDMA Engine" |
493 |
++ depends on HAS_IOMEM |
494 |
+ select DMA_ENGINE |
495 |
+ help |
496 |
+ Enable support for Altera / Intel mSGDMA controller. |
497 |
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c |
498 |
+index 15b30d2d8f7ed..8166305052946 100644 |
499 |
+--- a/drivers/dma/pl330.c |
500 |
++++ b/drivers/dma/pl330.c |
501 |
+@@ -2671,13 +2671,15 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( |
502 |
+ for (i = 0; i < len / period_len; i++) { |
503 |
+ desc = pl330_get_desc(pch); |
504 |
+ if (!desc) { |
505 |
++ unsigned long iflags; |
506 |
++ |
507 |
+ dev_err(pch->dmac->ddma.dev, "%s:%d Unable to fetch desc\n", |
508 |
+ __func__, __LINE__); |
509 |
+ |
510 |
+ if (!first) |
511 |
+ return NULL; |
512 |
+ |
513 |
+- spin_lock_irqsave(&pl330->pool_lock, flags); |
514 |
++ spin_lock_irqsave(&pl330->pool_lock, iflags); |
515 |
+ |
516 |
+ while (!list_empty(&first->node)) { |
517 |
+ desc = list_entry(first->node.next, |
518 |
+@@ -2687,7 +2689,7 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( |
519 |
+ |
520 |
+ list_move_tail(&first->node, &pl330->desc_pool); |
521 |
+ |
522 |
+- spin_unlock_irqrestore(&pl330->pool_lock, flags); |
523 |
++ spin_unlock_irqrestore(&pl330->pool_lock, iflags); |
524 |
+ |
525 |
+ return NULL; |
526 |
+ } |
527 |
+diff --git a/drivers/dma/qcom/Kconfig b/drivers/dma/qcom/Kconfig |
528 |
+index a7761c4025f41..a97c7123d913c 100644 |
529 |
+--- a/drivers/dma/qcom/Kconfig |
530 |
++++ b/drivers/dma/qcom/Kconfig |
531 |
+@@ -9,6 +9,7 @@ config QCOM_BAM_DMA |
532 |
+ |
533 |
+ config QCOM_HIDMA_MGMT |
534 |
+ tristate "Qualcomm Technologies HIDMA Management support" |
535 |
++ depends on HAS_IOMEM |
536 |
+ select DMA_ENGINE |
537 |
+ help |
538 |
+ Enable support for the Qualcomm Technologies HIDMA Management. |
539 |
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c |
540 |
+index 3d55405c49cac..e588dc5daaa80 100644 |
541 |
+--- a/drivers/dma/ste_dma40.c |
542 |
++++ b/drivers/dma/ste_dma40.c |
543 |
+@@ -3663,6 +3663,9 @@ static int __init d40_probe(struct platform_device *pdev) |
544 |
+ |
545 |
+ kfree(base->lcla_pool.base_unaligned); |
546 |
+ |
547 |
++ if (base->lcpa_base) |
548 |
++ iounmap(base->lcpa_base); |
549 |
++ |
550 |
+ if (base->phy_lcpa) |
551 |
+ release_mem_region(base->phy_lcpa, |
552 |
+ base->lcpa_size); |
553 |
+diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c |
554 |
+index 1fefc93af1d78..bbfce7b9d03e1 100644 |
555 |
+--- a/drivers/gpu/drm/nouveau/nouveau_prime.c |
556 |
++++ b/drivers/gpu/drm/nouveau/nouveau_prime.c |
557 |
+@@ -98,7 +98,22 @@ int nouveau_gem_prime_pin(struct drm_gem_object *obj) |
558 |
+ if (ret) |
559 |
+ return -EINVAL; |
560 |
+ |
561 |
+- return 0; |
562 |
++ ret = ttm_bo_reserve(&nvbo->bo, false, false, NULL); |
563 |
++ if (ret) |
564 |
++ goto error; |
565 |
++ |
566 |
++ if (nvbo->bo.moving) |
567 |
++ ret = dma_fence_wait(nvbo->bo.moving, true); |
568 |
++ |
569 |
++ ttm_bo_unreserve(&nvbo->bo); |
570 |
++ if (ret) |
571 |
++ goto error; |
572 |
++ |
573 |
++ return ret; |
574 |
++ |
575 |
++error: |
576 |
++ nouveau_bo_unpin(nvbo); |
577 |
++ return ret; |
578 |
+ } |
579 |
+ |
580 |
+ void nouveau_gem_prime_unpin(struct drm_gem_object *obj) |
581 |
+diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c |
582 |
+index 7110d403322c4..c138e07f51a3e 100644 |
583 |
+--- a/drivers/gpu/drm/radeon/radeon_prime.c |
584 |
++++ b/drivers/gpu/drm/radeon/radeon_prime.c |
585 |
+@@ -92,9 +92,19 @@ int radeon_gem_prime_pin(struct drm_gem_object *obj) |
586 |
+ |
587 |
+ /* pin buffer into GTT */ |
588 |
+ ret = radeon_bo_pin(bo, RADEON_GEM_DOMAIN_GTT, NULL); |
589 |
+- if (likely(ret == 0)) |
590 |
+- bo->prime_shared_count++; |
591 |
+- |
592 |
++ if (unlikely(ret)) |
593 |
++ goto error; |
594 |
++ |
595 |
++ if (bo->tbo.moving) { |
596 |
++ ret = dma_fence_wait(bo->tbo.moving, false); |
597 |
++ if (unlikely(ret)) { |
598 |
++ radeon_bo_unpin(bo); |
599 |
++ goto error; |
600 |
++ } |
601 |
++ } |
602 |
++ |
603 |
++ bo->prime_shared_count++; |
604 |
++error: |
605 |
+ radeon_bo_unreserve(bo); |
606 |
+ return ret; |
607 |
+ } |
608 |
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c |
609 |
+index 95f4db70dd223..fde9c69ecc869 100644 |
610 |
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c |
611 |
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c |
612 |
+@@ -286,7 +286,7 @@ int radeon_uvd_resume(struct radeon_device *rdev) |
613 |
+ if (rdev->uvd.vcpu_bo == NULL) |
614 |
+ return -EINVAL; |
615 |
+ |
616 |
+- memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size); |
617 |
++ memcpy_toio((void __iomem *)rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size); |
618 |
+ |
619 |
+ size = radeon_bo_size(rdev->uvd.vcpu_bo); |
620 |
+ size -= rdev->uvd_fw->size; |
621 |
+@@ -294,7 +294,7 @@ int radeon_uvd_resume(struct radeon_device *rdev) |
622 |
+ ptr = rdev->uvd.cpu_addr; |
623 |
+ ptr += rdev->uvd_fw->size; |
624 |
+ |
625 |
+- memset(ptr, 0, size); |
626 |
++ memset_io((void __iomem *)ptr, 0, size); |
627 |
+ |
628 |
+ return 0; |
629 |
+ } |
630 |
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c |
631 |
+index 9b66eb1d42c2d..acbbc21e62338 100644 |
632 |
+--- a/drivers/hid/hid-core.c |
633 |
++++ b/drivers/hid/hid-core.c |
634 |
+@@ -1823,6 +1823,9 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask) |
635 |
+ case BUS_I2C: |
636 |
+ bus = "I2C"; |
637 |
+ break; |
638 |
++ case BUS_VIRTUAL: |
639 |
++ bus = "VIRTUAL"; |
640 |
++ break; |
641 |
+ default: |
642 |
+ bus = "<UNKNOWN>"; |
643 |
+ } |
644 |
+diff --git a/drivers/hid/hid-gt683r.c b/drivers/hid/hid-gt683r.c |
645 |
+index a298fbd8db6b9..8ca4c1baeda89 100644 |
646 |
+--- a/drivers/hid/hid-gt683r.c |
647 |
++++ b/drivers/hid/hid-gt683r.c |
648 |
+@@ -64,6 +64,7 @@ static const struct hid_device_id gt683r_led_id[] = { |
649 |
+ { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) }, |
650 |
+ { } |
651 |
+ }; |
652 |
++MODULE_DEVICE_TABLE(hid, gt683r_led_id); |
653 |
+ |
654 |
+ static void gt683r_brightness_set(struct led_classdev *led_cdev, |
655 |
+ enum led_brightness brightness) |
656 |
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h |
657 |
+index 75342f3dfb863..ee5dce862a215 100644 |
658 |
+--- a/drivers/hid/hid-ids.h |
659 |
++++ b/drivers/hid/hid-ids.h |
660 |
+@@ -999,6 +999,7 @@ |
661 |
+ #define USB_DEVICE_ID_SAITEK_X52 0x075c |
662 |
+ #define USB_DEVICE_ID_SAITEK_X52_2 0x0255 |
663 |
+ #define USB_DEVICE_ID_SAITEK_X52_PRO 0x0762 |
664 |
++#define USB_DEVICE_ID_SAITEK_X65 0x0b6a |
665 |
+ |
666 |
+ #define USB_VENDOR_ID_SAMSUNG 0x0419 |
667 |
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001 |
668 |
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c |
669 |
+index 8fbe7b9cd84a3..48e9761d4ace9 100644 |
670 |
+--- a/drivers/hid/hid-quirks.c |
671 |
++++ b/drivers/hid/hid-quirks.c |
672 |
+@@ -155,6 +155,7 @@ static const struct hid_device_id hid_quirks[] = { |
673 |
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, |
674 |
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, |
675 |
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_PRO), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, |
676 |
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X65), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, |
677 |
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS }, |
678 |
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS }, |
679 |
+ { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET }, |
680 |
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c |
681 |
+index 21fbdcde1faa1..ef62f36ebcf90 100644 |
682 |
+--- a/drivers/hid/hid-sensor-hub.c |
683 |
++++ b/drivers/hid/hid-sensor-hub.c |
684 |
+@@ -223,16 +223,21 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id, |
685 |
+ buffer_size = buffer_size / sizeof(__s32); |
686 |
+ if (buffer_size) { |
687 |
+ for (i = 0; i < buffer_size; ++i) { |
688 |
+- hid_set_field(report->field[field_index], i, |
689 |
+- (__force __s32)cpu_to_le32(*buf32)); |
690 |
++ ret = hid_set_field(report->field[field_index], i, |
691 |
++ (__force __s32)cpu_to_le32(*buf32)); |
692 |
++ if (ret) |
693 |
++ goto done_proc; |
694 |
++ |
695 |
+ ++buf32; |
696 |
+ } |
697 |
+ } |
698 |
+ if (remaining_bytes) { |
699 |
+ value = 0; |
700 |
+ memcpy(&value, (u8 *)buf32, remaining_bytes); |
701 |
+- hid_set_field(report->field[field_index], i, |
702 |
+- (__force __s32)cpu_to_le32(value)); |
703 |
++ ret = hid_set_field(report->field[field_index], i, |
704 |
++ (__force __s32)cpu_to_le32(value)); |
705 |
++ if (ret) |
706 |
++ goto done_proc; |
707 |
+ } |
708 |
+ hid_hw_request(hsdev->hdev, report, HID_REQ_SET_REPORT); |
709 |
+ hid_hw_wait(hsdev->hdev); |
710 |
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c |
711 |
+index 1e6f8b0d00fb6..6b6db57b49d69 100644 |
712 |
+--- a/drivers/hid/usbhid/hid-core.c |
713 |
++++ b/drivers/hid/usbhid/hid-core.c |
714 |
+@@ -377,7 +377,7 @@ static int hid_submit_ctrl(struct hid_device *hid) |
715 |
+ raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report; |
716 |
+ dir = usbhid->ctrl[usbhid->ctrltail].dir; |
717 |
+ |
718 |
+- len = ((report->size - 1) >> 3) + 1 + (report->id > 0); |
719 |
++ len = hid_report_len(report); |
720 |
+ if (dir == USB_DIR_OUT) { |
721 |
+ usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0); |
722 |
+ usbhid->urbctrl->transfer_buffer_length = len; |
723 |
+diff --git a/drivers/hwmon/scpi-hwmon.c b/drivers/hwmon/scpi-hwmon.c |
724 |
+index 7e49da50bc69b..562f3e287297a 100644 |
725 |
+--- a/drivers/hwmon/scpi-hwmon.c |
726 |
++++ b/drivers/hwmon/scpi-hwmon.c |
727 |
+@@ -107,6 +107,15 @@ scpi_show_sensor(struct device *dev, struct device_attribute *attr, char *buf) |
728 |
+ |
729 |
+ scpi_scale_reading(&value, sensor); |
730 |
+ |
731 |
++ /* |
732 |
++ * Temperature sensor values are treated as signed values based on |
733 |
++ * observation even though that is not explicitly specified, and |
734 |
++ * because an unsigned u64 temperature does not really make practical |
735 |
++ * sense especially when the temperature is below zero degrees Celsius. |
736 |
++ */ |
737 |
++ if (sensor->info.class == TEMPERATURE) |
738 |
++ return sprintf(buf, "%lld\n", (s64)value); |
739 |
++ |
740 |
+ return sprintf(buf, "%llu\n", value); |
741 |
+ } |
742 |
+ |
743 |
+diff --git a/drivers/i2c/busses/i2c-robotfuzz-osif.c b/drivers/i2c/busses/i2c-robotfuzz-osif.c |
744 |
+index d848cf5152349..3fe21397a4f6b 100644 |
745 |
+--- a/drivers/i2c/busses/i2c-robotfuzz-osif.c |
746 |
++++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c |
747 |
+@@ -86,7 +86,7 @@ static int osif_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, |
748 |
+ } |
749 |
+ } |
750 |
+ |
751 |
+- ret = osif_usb_read(adapter, OSIFI2C_STOP, 0, 0, NULL, 0); |
752 |
++ ret = osif_usb_write(adapter, OSIFI2C_STOP, 0, 0, NULL, 0); |
753 |
+ if (ret) { |
754 |
+ dev_err(&adapter->dev, "failure sending STOP\n"); |
755 |
+ return -EREMOTEIO; |
756 |
+@@ -156,7 +156,7 @@ static int osif_probe(struct usb_interface *interface, |
757 |
+ * Set bus frequency. The frequency is: |
758 |
+ * 120,000,000 / ( 16 + 2 * div * 4^prescale). |
759 |
+ * Using dev = 52, prescale = 0 give 100KHz */ |
760 |
+- ret = osif_usb_read(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0, |
761 |
++ ret = osif_usb_write(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0, |
762 |
+ NULL, 0); |
763 |
+ if (ret) { |
764 |
+ dev_err(&interface->dev, "failure sending bit rate"); |
765 |
+diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c |
766 |
+index 94d5ce9419ca6..81ec17b9c49cf 100644 |
767 |
+--- a/drivers/net/caif/caif_serial.c |
768 |
++++ b/drivers/net/caif/caif_serial.c |
769 |
+@@ -360,6 +360,7 @@ static int ldisc_open(struct tty_struct *tty) |
770 |
+ rtnl_lock(); |
771 |
+ result = register_netdevice(dev); |
772 |
+ if (result) { |
773 |
++ tty_kref_put(tty); |
774 |
+ rtnl_unlock(); |
775 |
+ free_netdev(dev); |
776 |
+ return -ENODEV; |
777 |
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c |
778 |
+index 896f5b0227295..3215ba69a9e75 100644 |
779 |
+--- a/drivers/net/can/usb/mcba_usb.c |
780 |
++++ b/drivers/net/can/usb/mcba_usb.c |
781 |
+@@ -93,6 +93,8 @@ struct mcba_priv { |
782 |
+ bool can_ka_first_pass; |
783 |
+ bool can_speed_check; |
784 |
+ atomic_t free_ctx_cnt; |
785 |
++ void *rxbuf[MCBA_MAX_RX_URBS]; |
786 |
++ dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS]; |
787 |
+ }; |
788 |
+ |
789 |
+ /* CAN frame */ |
790 |
+@@ -644,6 +646,7 @@ static int mcba_usb_start(struct mcba_priv *priv) |
791 |
+ for (i = 0; i < MCBA_MAX_RX_URBS; i++) { |
792 |
+ struct urb *urb = NULL; |
793 |
+ u8 *buf; |
794 |
++ dma_addr_t buf_dma; |
795 |
+ |
796 |
+ /* create a URB, and a buffer for it */ |
797 |
+ urb = usb_alloc_urb(0, GFP_KERNEL); |
798 |
+@@ -653,7 +656,7 @@ static int mcba_usb_start(struct mcba_priv *priv) |
799 |
+ } |
800 |
+ |
801 |
+ buf = usb_alloc_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE, |
802 |
+- GFP_KERNEL, &urb->transfer_dma); |
803 |
++ GFP_KERNEL, &buf_dma); |
804 |
+ if (!buf) { |
805 |
+ netdev_err(netdev, "No memory left for USB buffer\n"); |
806 |
+ usb_free_urb(urb); |
807 |
+@@ -672,11 +675,14 @@ static int mcba_usb_start(struct mcba_priv *priv) |
808 |
+ if (err) { |
809 |
+ usb_unanchor_urb(urb); |
810 |
+ usb_free_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE, |
811 |
+- buf, urb->transfer_dma); |
812 |
++ buf, buf_dma); |
813 |
+ usb_free_urb(urb); |
814 |
+ break; |
815 |
+ } |
816 |
+ |
817 |
++ priv->rxbuf[i] = buf; |
818 |
++ priv->rxbuf_dma[i] = buf_dma; |
819 |
++ |
820 |
+ /* Drop reference, USB core will take care of freeing it */ |
821 |
+ usb_free_urb(urb); |
822 |
+ } |
823 |
+@@ -719,7 +725,14 @@ static int mcba_usb_open(struct net_device *netdev) |
824 |
+ |
825 |
+ static void mcba_urb_unlink(struct mcba_priv *priv) |
826 |
+ { |
827 |
++ int i; |
828 |
++ |
829 |
+ usb_kill_anchored_urbs(&priv->rx_submitted); |
830 |
++ |
831 |
++ for (i = 0; i < MCBA_MAX_RX_URBS; ++i) |
832 |
++ usb_free_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE, |
833 |
++ priv->rxbuf[i], priv->rxbuf_dma[i]); |
834 |
++ |
835 |
+ usb_kill_anchored_urbs(&priv->tx_submitted); |
836 |
+ } |
837 |
+ |
838 |
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c |
839 |
+index d83ad06bf1991..54bfe9d84ecd1 100644 |
840 |
+--- a/drivers/net/ethernet/atheros/alx/main.c |
841 |
++++ b/drivers/net/ethernet/atheros/alx/main.c |
842 |
+@@ -1855,6 +1855,7 @@ out_free_netdev: |
843 |
+ free_netdev(netdev); |
844 |
+ out_pci_release: |
845 |
+ pci_release_mem_regions(pdev); |
846 |
++ pci_disable_pcie_error_reporting(pdev); |
847 |
+ out_pci_disable: |
848 |
+ pci_disable_device(pdev); |
849 |
+ return err; |
850 |
+diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c |
851 |
+index d71cba0842c5a..59dc20020c738 100644 |
852 |
+--- a/drivers/net/ethernet/ec_bhf.c |
853 |
++++ b/drivers/net/ethernet/ec_bhf.c |
854 |
+@@ -585,10 +585,12 @@ static void ec_bhf_remove(struct pci_dev *dev) |
855 |
+ struct ec_bhf_priv *priv = netdev_priv(net_dev); |
856 |
+ |
857 |
+ unregister_netdev(net_dev); |
858 |
+- free_netdev(net_dev); |
859 |
+ |
860 |
+ pci_iounmap(dev, priv->dma_io); |
861 |
+ pci_iounmap(dev, priv->io); |
862 |
++ |
863 |
++ free_netdev(net_dev); |
864 |
++ |
865 |
+ pci_release_regions(dev); |
866 |
+ pci_clear_master(dev); |
867 |
+ pci_disable_device(dev); |
868 |
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c |
869 |
+index 3fe6a28027fe1..05cb2f7cc35c3 100644 |
870 |
+--- a/drivers/net/ethernet/emulex/benet/be_main.c |
871 |
++++ b/drivers/net/ethernet/emulex/benet/be_main.c |
872 |
+@@ -6029,6 +6029,7 @@ drv_cleanup: |
873 |
+ unmap_bars: |
874 |
+ be_unmap_pci_bars(adapter); |
875 |
+ free_netdev: |
876 |
++ pci_disable_pcie_error_reporting(pdev); |
877 |
+ free_netdev(netdev); |
878 |
+ rel_reg: |
879 |
+ pci_release_regions(pdev); |
880 |
+diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c |
881 |
+index 09a762eb4f09e..52a811f913846 100644 |
882 |
+--- a/drivers/net/ethernet/freescale/fec_ptp.c |
883 |
++++ b/drivers/net/ethernet/freescale/fec_ptp.c |
884 |
+@@ -220,15 +220,13 @@ static u64 fec_ptp_read(const struct cyclecounter *cc) |
885 |
+ { |
886 |
+ struct fec_enet_private *fep = |
887 |
+ container_of(cc, struct fec_enet_private, cc); |
888 |
+- const struct platform_device_id *id_entry = |
889 |
+- platform_get_device_id(fep->pdev); |
890 |
+ u32 tempval; |
891 |
+ |
892 |
+ tempval = readl(fep->hwp + FEC_ATIME_CTRL); |
893 |
+ tempval |= FEC_T_CTRL_CAPTURE; |
894 |
+ writel(tempval, fep->hwp + FEC_ATIME_CTRL); |
895 |
+ |
896 |
+- if (id_entry->driver_data & FEC_QUIRK_BUG_CAPTURE) |
897 |
++ if (fep->quirks & FEC_QUIRK_BUG_CAPTURE) |
898 |
+ udelay(1); |
899 |
+ |
900 |
+ return readl(fep->hwp + FEC_ATIME); |
901 |
+@@ -599,6 +597,10 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx) |
902 |
+ fep->ptp_caps.enable = fec_ptp_enable; |
903 |
+ |
904 |
+ fep->cycle_speed = clk_get_rate(fep->clk_ptp); |
905 |
++ if (!fep->cycle_speed) { |
906 |
++ fep->cycle_speed = NSEC_PER_SEC; |
907 |
++ dev_err(&fep->pdev->dev, "clk_ptp clock rate is zero\n"); |
908 |
++ } |
909 |
+ fep->ptp_inc = NSEC_PER_SEC / fep->cycle_speed; |
910 |
+ |
911 |
+ spin_lock_init(&fep->tmreg_lock); |
912 |
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c |
913 |
+index cf58c96379047..c467f5e981f61 100644 |
914 |
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c |
915 |
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c |
916 |
+@@ -515,9 +515,6 @@ void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv) |
917 |
+ struct mlx5_core_dev *mdev = priv->mdev; |
918 |
+ struct net_device *netdev = priv->netdev; |
919 |
+ |
920 |
+- if (!priv->ipsec) |
921 |
+- return; |
922 |
+- |
923 |
+ if (!(mlx5_accel_ipsec_device_caps(mdev) & MLX5_ACCEL_IPSEC_CAP_ESP) || |
924 |
+ !MLX5_CAP_ETH(mdev, swp)) { |
925 |
+ mlx5_core_dbg(mdev, "mlx5e: ESP and SWP offload not supported\n"); |
926 |
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c |
927 |
+index 51edc507b7b5d..9003702892cda 100644 |
928 |
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c |
929 |
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c |
930 |
+@@ -4679,11 +4679,8 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) |
931 |
+ } |
932 |
+ |
933 |
+ if (mlx5_vxlan_allowed(mdev->vxlan)) { |
934 |
+- netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL | |
935 |
+- NETIF_F_GSO_UDP_TUNNEL_CSUM; |
936 |
+- netdev->hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL | |
937 |
+- NETIF_F_GSO_UDP_TUNNEL_CSUM; |
938 |
+- netdev->gso_partial_features = NETIF_F_GSO_UDP_TUNNEL_CSUM; |
939 |
++ netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL; |
940 |
++ netdev->hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL; |
941 |
+ } |
942 |
+ |
943 |
+ if (MLX5_CAP_ETH(mdev, tunnel_stateless_gre)) { |
944 |
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c |
945 |
+index 6789eed78ff70..3bc570c46f81c 100644 |
946 |
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c |
947 |
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c |
948 |
+@@ -3853,6 +3853,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent) |
949 |
+ dev_err(&pdev->dev, |
950 |
+ "invalid sram_size %dB or board span %ldB\n", |
951 |
+ mgp->sram_size, mgp->board_span); |
952 |
++ status = -EINVAL; |
953 |
+ goto abort_with_ioremap; |
954 |
+ } |
955 |
+ memcpy_fromio(mgp->eeprom_strings, |
956 |
+diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c |
957 |
+index 42b99b1826163..a331ad406e7ab 100644 |
958 |
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c |
959 |
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c |
960 |
+@@ -1618,6 +1618,8 @@ err_out_free_netdev: |
961 |
+ free_netdev(netdev); |
962 |
+ |
963 |
+ err_out_free_res: |
964 |
++ if (NX_IS_REVISION_P3(pdev->revision)) |
965 |
++ pci_disable_pcie_error_reporting(pdev); |
966 |
+ pci_release_regions(pdev); |
967 |
+ |
968 |
+ err_out_disable_pdev: |
969 |
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c |
970 |
+index 5900a506bf8df..ff8a7750d3c0d 100644 |
971 |
+--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c |
972 |
++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c |
973 |
+@@ -1294,9 +1294,11 @@ int qed_dcbx_get_config_params(struct qed_hwfn *p_hwfn, |
974 |
+ p_hwfn->p_dcbx_info->set.ver_num |= DCBX_CONFIG_VERSION_STATIC; |
975 |
+ |
976 |
+ p_hwfn->p_dcbx_info->set.enabled = dcbx_info->operational.enabled; |
977 |
++ BUILD_BUG_ON(sizeof(dcbx_info->operational.params) != |
978 |
++ sizeof(p_hwfn->p_dcbx_info->set.config.params)); |
979 |
+ memcpy(&p_hwfn->p_dcbx_info->set.config.params, |
980 |
+ &dcbx_info->operational.params, |
981 |
+- sizeof(struct qed_dcbx_admin_params)); |
982 |
++ sizeof(p_hwfn->p_dcbx_info->set.config.params)); |
983 |
+ p_hwfn->p_dcbx_info->set.config.valid = true; |
984 |
+ |
985 |
+ memcpy(params, &p_hwfn->p_dcbx_info->set, sizeof(struct qed_dcbx_set)); |
986 |
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c |
987 |
+index ed34b7d1a9e11..43920374beae2 100644 |
988 |
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c |
989 |
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c |
990 |
+@@ -2708,6 +2708,7 @@ err_out_free_hw_res: |
991 |
+ kfree(ahw); |
992 |
+ |
993 |
+ err_out_free_res: |
994 |
++ pci_disable_pcie_error_reporting(pdev); |
995 |
+ pci_release_regions(pdev); |
996 |
+ |
997 |
+ err_out_disable_pdev: |
998 |
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c |
999 |
+index 0c9e6cb0e3418..523626f2ffbeb 100644 |
1000 |
+--- a/drivers/net/ethernet/realtek/r8169.c |
1001 |
++++ b/drivers/net/ethernet/realtek/r8169.c |
1002 |
+@@ -1823,7 +1823,7 @@ static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data) |
1003 |
+ { |
1004 |
+ switch(stringset) { |
1005 |
+ case ETH_SS_STATS: |
1006 |
+- memcpy(data, *rtl8169_gstrings, sizeof(rtl8169_gstrings)); |
1007 |
++ memcpy(data, rtl8169_gstrings, sizeof(rtl8169_gstrings)); |
1008 |
+ break; |
1009 |
+ } |
1010 |
+ } |
1011 |
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c |
1012 |
+index 24638cb157ca2..394ab9cdfe2c7 100644 |
1013 |
+--- a/drivers/net/ethernet/renesas/sh_eth.c |
1014 |
++++ b/drivers/net/ethernet/renesas/sh_eth.c |
1015 |
+@@ -2302,7 +2302,7 @@ static void sh_eth_get_strings(struct net_device *ndev, u32 stringset, u8 *data) |
1016 |
+ { |
1017 |
+ switch (stringset) { |
1018 |
+ case ETH_SS_STATS: |
1019 |
+- memcpy(data, *sh_eth_gstrings_stats, |
1020 |
++ memcpy(data, sh_eth_gstrings_stats, |
1021 |
+ sizeof(sh_eth_gstrings_stats)); |
1022 |
+ break; |
1023 |
+ } |
1024 |
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h |
1025 |
+index 184ca13c8f790..1a84cf459e400 100644 |
1026 |
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h |
1027 |
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h |
1028 |
+@@ -86,10 +86,10 @@ enum power_event { |
1029 |
+ #define LPI_CTRL_STATUS_TLPIEN 0x00000001 /* Transmit LPI Entry */ |
1030 |
+ |
1031 |
+ /* GMAC HW ADDR regs */ |
1032 |
+-#define GMAC_ADDR_HIGH(reg) (((reg > 15) ? 0x00000800 : 0x00000040) + \ |
1033 |
+- (reg * 8)) |
1034 |
+-#define GMAC_ADDR_LOW(reg) (((reg > 15) ? 0x00000804 : 0x00000044) + \ |
1035 |
+- (reg * 8)) |
1036 |
++#define GMAC_ADDR_HIGH(reg) ((reg > 15) ? 0x00000800 + (reg - 16) * 8 : \ |
1037 |
++ 0x00000040 + (reg * 8)) |
1038 |
++#define GMAC_ADDR_LOW(reg) ((reg > 15) ? 0x00000804 + (reg - 16) * 8 : \ |
1039 |
++ 0x00000044 + (reg * 8)) |
1040 |
+ #define GMAC_MAX_PERFECT_ADDRESSES 1 |
1041 |
+ |
1042 |
+ #define GMAC_PCS_BASE 0x000000c0 /* PCS register base */ |
1043 |
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c |
1044 |
+index 2241f98970926..939de185bc6b8 100644 |
1045 |
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c |
1046 |
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c |
1047 |
+@@ -736,6 +736,11 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) |
1048 |
+ /* Kick off the transfer */ |
1049 |
+ lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */ |
1050 |
+ |
1051 |
++ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) { |
1052 |
++ netdev_info(ndev, "%s -> netif_stop_queue\n", __func__); |
1053 |
++ netif_stop_queue(ndev); |
1054 |
++ } |
1055 |
++ |
1056 |
+ return NETDEV_TX_OK; |
1057 |
+ } |
1058 |
+ |
1059 |
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c |
1060 |
+index 3b14e6e281d43..940aa7a19f50b 100644 |
1061 |
+--- a/drivers/net/hamradio/mkiss.c |
1062 |
++++ b/drivers/net/hamradio/mkiss.c |
1063 |
+@@ -810,6 +810,7 @@ static void mkiss_close(struct tty_struct *tty) |
1064 |
+ ax->tty = NULL; |
1065 |
+ |
1066 |
+ unregister_netdev(ax->dev); |
1067 |
++ free_netdev(ax->dev); |
1068 |
+ } |
1069 |
+ |
1070 |
+ /* Perform I/O control on an active ax25 channel. */ |
1071 |
+diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c |
1072 |
+index 61ea4eaace5d0..e3f108080af12 100644 |
1073 |
+--- a/drivers/net/usb/cdc_eem.c |
1074 |
++++ b/drivers/net/usb/cdc_eem.c |
1075 |
+@@ -135,10 +135,10 @@ static struct sk_buff *eem_tx_fixup(struct usbnet *dev, struct sk_buff *skb, |
1076 |
+ } |
1077 |
+ |
1078 |
+ skb2 = skb_copy_expand(skb, EEM_HEAD, ETH_FCS_LEN + padlen, flags); |
1079 |
++ dev_kfree_skb_any(skb); |
1080 |
+ if (!skb2) |
1081 |
+ return NULL; |
1082 |
+ |
1083 |
+- dev_kfree_skb_any(skb); |
1084 |
+ skb = skb2; |
1085 |
+ |
1086 |
+ done: |
1087 |
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c |
1088 |
+index 82ec00a7370d4..f3f78ccdb274c 100644 |
1089 |
+--- a/drivers/net/usb/cdc_ncm.c |
1090 |
++++ b/drivers/net/usb/cdc_ncm.c |
1091 |
+@@ -1666,7 +1666,7 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) |
1092 |
+ static const struct driver_info cdc_ncm_info = { |
1093 |
+ .description = "CDC NCM", |
1094 |
+ .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET |
1095 |
+- | FLAG_LINK_INTR, |
1096 |
++ | FLAG_LINK_INTR | FLAG_ETHER, |
1097 |
+ .bind = cdc_ncm_bind, |
1098 |
+ .unbind = cdc_ncm_unbind, |
1099 |
+ .manage_power = usbnet_manage_power, |
1100 |
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c |
1101 |
+index a27ea04cfa6c3..726fb5561a0fb 100644 |
1102 |
+--- a/drivers/net/usb/r8152.c |
1103 |
++++ b/drivers/net/usb/r8152.c |
1104 |
+@@ -4649,7 +4649,7 @@ static void rtl8152_get_strings(struct net_device *dev, u32 stringset, u8 *data) |
1105 |
+ { |
1106 |
+ switch (stringset) { |
1107 |
+ case ETH_SS_STATS: |
1108 |
+- memcpy(data, *rtl8152_gstrings, sizeof(rtl8152_gstrings)); |
1109 |
++ memcpy(data, rtl8152_gstrings, sizeof(rtl8152_gstrings)); |
1110 |
+ break; |
1111 |
+ } |
1112 |
+ } |
1113 |
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c |
1114 |
+index 62f2862c9775e..8b9fd4e071f3d 100644 |
1115 |
+--- a/drivers/net/usb/smsc75xx.c |
1116 |
++++ b/drivers/net/usb/smsc75xx.c |
1117 |
+@@ -1495,7 +1495,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) |
1118 |
+ ret = smsc75xx_wait_ready(dev, 0); |
1119 |
+ if (ret < 0) { |
1120 |
+ netdev_warn(dev->net, "device not ready in smsc75xx_bind\n"); |
1121 |
+- goto err; |
1122 |
++ goto free_pdata; |
1123 |
+ } |
1124 |
+ |
1125 |
+ smsc75xx_init_mac_address(dev); |
1126 |
+@@ -1504,7 +1504,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) |
1127 |
+ ret = smsc75xx_reset(dev); |
1128 |
+ if (ret < 0) { |
1129 |
+ netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret); |
1130 |
+- goto err; |
1131 |
++ goto cancel_work; |
1132 |
+ } |
1133 |
+ |
1134 |
+ dev->net->netdev_ops = &smsc75xx_netdev_ops; |
1135 |
+@@ -1515,8 +1515,11 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) |
1136 |
+ dev->net->max_mtu = MAX_SINGLE_PACKET_SIZE; |
1137 |
+ return 0; |
1138 |
+ |
1139 |
+-err: |
1140 |
++cancel_work: |
1141 |
++ cancel_work_sync(&pdata->set_multicast); |
1142 |
++free_pdata: |
1143 |
+ kfree(pdata); |
1144 |
++ dev->data[0] = 0; |
1145 |
+ return ret; |
1146 |
+ } |
1147 |
+ |
1148 |
+@@ -1527,7 +1530,6 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) |
1149 |
+ cancel_work_sync(&pdata->set_multicast); |
1150 |
+ netif_dbg(dev, ifdown, dev->net, "free pdata\n"); |
1151 |
+ kfree(pdata); |
1152 |
+- pdata = NULL; |
1153 |
+ dev->data[0] = 0; |
1154 |
+ } |
1155 |
+ } |
1156 |
+diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c |
1157 |
+index 137a27fa369cb..08b52f3ed0c30 100644 |
1158 |
+--- a/drivers/nvme/target/loop.c |
1159 |
++++ b/drivers/nvme/target/loop.c |
1160 |
+@@ -274,7 +274,8 @@ static const struct blk_mq_ops nvme_loop_admin_mq_ops = { |
1161 |
+ |
1162 |
+ static void nvme_loop_destroy_admin_queue(struct nvme_loop_ctrl *ctrl) |
1163 |
+ { |
1164 |
+- clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[0].flags); |
1165 |
++ if (!test_and_clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[0].flags)) |
1166 |
++ return; |
1167 |
+ nvmet_sq_destroy(&ctrl->queues[0].nvme_sq); |
1168 |
+ blk_cleanup_queue(ctrl->ctrl.admin_q); |
1169 |
+ blk_mq_free_tag_set(&ctrl->admin_tag_set); |
1170 |
+@@ -309,6 +310,7 @@ static void nvme_loop_destroy_io_queues(struct nvme_loop_ctrl *ctrl) |
1171 |
+ clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[i].flags); |
1172 |
+ nvmet_sq_destroy(&ctrl->queues[i].nvme_sq); |
1173 |
+ } |
1174 |
++ ctrl->ctrl.queue_count = 1; |
1175 |
+ } |
1176 |
+ |
1177 |
+ static int nvme_loop_init_io_queues(struct nvme_loop_ctrl *ctrl) |
1178 |
+@@ -417,6 +419,7 @@ static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl) |
1179 |
+ return 0; |
1180 |
+ |
1181 |
+ out_cleanup_queue: |
1182 |
++ clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[0].flags); |
1183 |
+ blk_cleanup_queue(ctrl->ctrl.admin_q); |
1184 |
+ out_free_tagset: |
1185 |
+ blk_mq_free_tag_set(&ctrl->admin_tag_set); |
1186 |
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c |
1187 |
+index 3d59bbe4a5d56..9ebf32de85757 100644 |
1188 |
+--- a/drivers/pci/pci.c |
1189 |
++++ b/drivers/pci/pci.c |
1190 |
+@@ -1585,11 +1585,21 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags) |
1191 |
+ int err; |
1192 |
+ int i, bars = 0; |
1193 |
+ |
1194 |
+- if (atomic_inc_return(&dev->enable_cnt) > 1) { |
1195 |
+- pci_update_current_state(dev, dev->current_state); |
1196 |
+- return 0; /* already enabled */ |
1197 |
++ /* |
1198 |
++ * Power state could be unknown at this point, either due to a fresh |
1199 |
++ * boot or a device removal call. So get the current power state |
1200 |
++ * so that things like MSI message writing will behave as expected |
1201 |
++ * (e.g. if the device really is in D0 at enable time). |
1202 |
++ */ |
1203 |
++ if (dev->pm_cap) { |
1204 |
++ u16 pmcsr; |
1205 |
++ pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr); |
1206 |
++ dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK); |
1207 |
+ } |
1208 |
+ |
1209 |
++ if (atomic_inc_return(&dev->enable_cnt) > 1) |
1210 |
++ return 0; /* already enabled */ |
1211 |
++ |
1212 |
+ bridge = pci_upstream_bridge(dev); |
1213 |
+ if (bridge) |
1214 |
+ pci_enable_bridge(bridge); |
1215 |
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c |
1216 |
+index 70f05595da60d..576b5bb6b95f2 100644 |
1217 |
+--- a/drivers/pci/quirks.c |
1218 |
++++ b/drivers/pci/quirks.c |
1219 |
+@@ -3463,6 +3463,18 @@ static void quirk_no_bus_reset(struct pci_dev *dev) |
1220 |
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; |
1221 |
+ } |
1222 |
+ |
1223 |
++/* |
1224 |
++ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be |
1225 |
++ * prevented for those affected devices. |
1226 |
++ */ |
1227 |
++static void quirk_nvidia_no_bus_reset(struct pci_dev *dev) |
1228 |
++{ |
1229 |
++ if ((dev->device & 0xffc0) == 0x2340) |
1230 |
++ quirk_no_bus_reset(dev); |
1231 |
++} |
1232 |
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, |
1233 |
++ quirk_nvidia_no_bus_reset); |
1234 |
++ |
1235 |
+ /* |
1236 |
+ * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset. |
1237 |
+ * The device will throw a Link Down error on AER-capable systems and |
1238 |
+@@ -3483,6 +3495,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset); |
1239 |
+ */ |
1240 |
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset); |
1241 |
+ |
1242 |
++/* |
1243 |
++ * Some TI KeyStone C667X devices do not support bus/hot reset. The PCIESS |
1244 |
++ * automatically disables LTSSM when Secondary Bus Reset is received and |
1245 |
++ * the device stops working. Prevent bus reset for these devices. With |
1246 |
++ * this change, the device can be assigned to VMs with VFIO, but it will |
1247 |
++ * leak state between VMs. Reference |
1248 |
++ * https://e2e.ti.com/support/processors/f/791/t/954382 |
1249 |
++ */ |
1250 |
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); |
1251 |
++ |
1252 |
+ static void quirk_no_pm_reset(struct pci_dev *dev) |
1253 |
+ { |
1254 |
+ /* |
1255 |
+@@ -3875,6 +3897,69 @@ static int delay_250ms_after_flr(struct pci_dev *dev, int probe) |
1256 |
+ return 0; |
1257 |
+ } |
1258 |
+ |
1259 |
++#define PCI_DEVICE_ID_HINIC_VF 0x375E |
1260 |
++#define HINIC_VF_FLR_TYPE 0x1000 |
1261 |
++#define HINIC_VF_FLR_CAP_BIT (1UL << 30) |
1262 |
++#define HINIC_VF_OP 0xE80 |
1263 |
++#define HINIC_VF_FLR_PROC_BIT (1UL << 18) |
1264 |
++#define HINIC_OPERATION_TIMEOUT 15000 /* 15 seconds */ |
1265 |
++ |
1266 |
++/* Device-specific reset method for Huawei Intelligent NIC virtual functions */ |
1267 |
++static int reset_hinic_vf_dev(struct pci_dev *pdev, int probe) |
1268 |
++{ |
1269 |
++ unsigned long timeout; |
1270 |
++ void __iomem *bar; |
1271 |
++ u32 val; |
1272 |
++ |
1273 |
++ if (probe) |
1274 |
++ return 0; |
1275 |
++ |
1276 |
++ bar = pci_iomap(pdev, 0, 0); |
1277 |
++ if (!bar) |
1278 |
++ return -ENOTTY; |
1279 |
++ |
1280 |
++ /* Get and check firmware capabilities */ |
1281 |
++ val = ioread32be(bar + HINIC_VF_FLR_TYPE); |
1282 |
++ if (!(val & HINIC_VF_FLR_CAP_BIT)) { |
1283 |
++ pci_iounmap(pdev, bar); |
1284 |
++ return -ENOTTY; |
1285 |
++ } |
1286 |
++ |
1287 |
++ /* Set HINIC_VF_FLR_PROC_BIT for the start of FLR */ |
1288 |
++ val = ioread32be(bar + HINIC_VF_OP); |
1289 |
++ val = val | HINIC_VF_FLR_PROC_BIT; |
1290 |
++ iowrite32be(val, bar + HINIC_VF_OP); |
1291 |
++ |
1292 |
++ pcie_flr(pdev); |
1293 |
++ |
1294 |
++ /* |
1295 |
++ * The device must recapture its Bus and Device Numbers after FLR |
1296 |
++ * in order generate Completions. Issue a config write to let the |
1297 |
++ * device capture this information. |
1298 |
++ */ |
1299 |
++ pci_write_config_word(pdev, PCI_VENDOR_ID, 0); |
1300 |
++ |
1301 |
++ /* Firmware clears HINIC_VF_FLR_PROC_BIT when reset is complete */ |
1302 |
++ timeout = jiffies + msecs_to_jiffies(HINIC_OPERATION_TIMEOUT); |
1303 |
++ do { |
1304 |
++ val = ioread32be(bar + HINIC_VF_OP); |
1305 |
++ if (!(val & HINIC_VF_FLR_PROC_BIT)) |
1306 |
++ goto reset_complete; |
1307 |
++ msleep(20); |
1308 |
++ } while (time_before(jiffies, timeout)); |
1309 |
++ |
1310 |
++ val = ioread32be(bar + HINIC_VF_OP); |
1311 |
++ if (!(val & HINIC_VF_FLR_PROC_BIT)) |
1312 |
++ goto reset_complete; |
1313 |
++ |
1314 |
++ pci_warn(pdev, "Reset dev timeout, FLR ack reg: %#010x\n", val); |
1315 |
++ |
1316 |
++reset_complete: |
1317 |
++ pci_iounmap(pdev, bar); |
1318 |
++ |
1319 |
++ return 0; |
1320 |
++} |
1321 |
++ |
1322 |
+ static const struct pci_dev_reset_methods pci_dev_reset_methods[] = { |
1323 |
+ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82599_SFP_VF, |
1324 |
+ reset_intel_82599_sfp_virtfn }, |
1325 |
+@@ -3886,6 +3971,8 @@ static const struct pci_dev_reset_methods pci_dev_reset_methods[] = { |
1326 |
+ { PCI_VENDOR_ID_INTEL, 0x0953, delay_250ms_after_flr }, |
1327 |
+ { PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID, |
1328 |
+ reset_chelsio_generic_dev }, |
1329 |
++ { PCI_VENDOR_ID_HUAWEI, PCI_DEVICE_ID_HINIC_VF, |
1330 |
++ reset_hinic_vf_dev }, |
1331 |
+ { 0 } |
1332 |
+ }; |
1333 |
+ |
1334 |
+@@ -4689,6 +4776,8 @@ static const struct pci_dev_acs_enabled { |
1335 |
+ { PCI_VENDOR_ID_AMPERE, 0xE00A, pci_quirk_xgene_acs }, |
1336 |
+ { PCI_VENDOR_ID_AMPERE, 0xE00B, pci_quirk_xgene_acs }, |
1337 |
+ { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, |
1338 |
++ /* Broadcom multi-function device */ |
1339 |
++ { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs }, |
1340 |
+ { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, |
1341 |
+ { 0 } |
1342 |
+ }; |
1343 |
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c |
1344 |
+index 14dfbbd6c1c37..4e17728f29375 100644 |
1345 |
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c |
1346 |
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c |
1347 |
+@@ -978,7 +978,7 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, |
1348 |
+ struct resource res; |
1349 |
+ struct reset_control *rstc; |
1350 |
+ int npins = STM32_GPIO_PINS_PER_BANK; |
1351 |
+- int bank_nr, err; |
1352 |
++ int bank_nr, err, i = 0; |
1353 |
+ |
1354 |
+ rstc = of_reset_control_get_exclusive(np, NULL); |
1355 |
+ if (!IS_ERR(rstc)) |
1356 |
+@@ -1007,9 +1007,14 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, |
1357 |
+ |
1358 |
+ of_property_read_string(np, "st,bank-name", &bank->gpio_chip.label); |
1359 |
+ |
1360 |
+- if (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, 0, &args)) { |
1361 |
++ if (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, i, &args)) { |
1362 |
+ bank_nr = args.args[1] / STM32_GPIO_PINS_PER_BANK; |
1363 |
+ bank->gpio_chip.base = args.args[1]; |
1364 |
++ |
1365 |
++ npins = args.args[2]; |
1366 |
++ while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, |
1367 |
++ ++i, &args)) |
1368 |
++ npins += args.args[2]; |
1369 |
+ } else { |
1370 |
+ bank_nr = pctl->nbanks; |
1371 |
+ bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK; |
1372 |
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c |
1373 |
+index e232233beb8f2..89632cc9c28fc 100644 |
1374 |
+--- a/drivers/ptp/ptp_clock.c |
1375 |
++++ b/drivers/ptp/ptp_clock.c |
1376 |
+@@ -76,7 +76,7 @@ static void enqueue_external_timestamp(struct timestamp_event_queue *queue, |
1377 |
+ spin_unlock_irqrestore(&queue->lock, flags); |
1378 |
+ } |
1379 |
+ |
1380 |
+-static s32 scaled_ppm_to_ppb(long ppm) |
1381 |
++long scaled_ppm_to_ppb(long ppm) |
1382 |
+ { |
1383 |
+ /* |
1384 |
+ * The 'freq' field in the 'struct timex' is in parts per |
1385 |
+@@ -93,8 +93,9 @@ static s32 scaled_ppm_to_ppb(long ppm) |
1386 |
+ s64 ppb = 1 + ppm; |
1387 |
+ ppb *= 125; |
1388 |
+ ppb >>= 13; |
1389 |
+- return (s32) ppb; |
1390 |
++ return (long) ppb; |
1391 |
+ } |
1392 |
++EXPORT_SYMBOL(scaled_ppm_to_ppb); |
1393 |
+ |
1394 |
+ /* posix clock implementation */ |
1395 |
+ |
1396 |
+@@ -147,7 +148,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct timex *tx) |
1397 |
+ delta = ktime_to_ns(kt); |
1398 |
+ err = ops->adjtime(ops, delta); |
1399 |
+ } else if (tx->modes & ADJ_FREQUENCY) { |
1400 |
+- s32 ppb = scaled_ppm_to_ppb(tx->freq); |
1401 |
++ long ppb = scaled_ppm_to_ppb(tx->freq); |
1402 |
+ if (ppb > ops->max_adj || ppb < -ops->max_adj) |
1403 |
+ return -ERANGE; |
1404 |
+ if (ops->adjfine) |
1405 |
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c |
1406 |
+index a08ff3bd63105..6a2a413cc97e0 100644 |
1407 |
+--- a/drivers/scsi/scsi_devinfo.c |
1408 |
++++ b/drivers/scsi/scsi_devinfo.c |
1409 |
+@@ -184,6 +184,7 @@ static struct { |
1410 |
+ {"HP", "C3323-300", "4269", BLIST_NOTQ}, |
1411 |
+ {"HP", "C5713A", NULL, BLIST_NOREPORTLUN}, |
1412 |
+ {"HP", "DISK-SUBSYSTEM", "*", BLIST_REPORTLUN2}, |
1413 |
++ {"HPE", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, |
1414 |
+ {"IBM", "AuSaV1S2", NULL, BLIST_FORCELUN}, |
1415 |
+ {"IBM", "ProFibre 4000R", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, |
1416 |
+ {"IBM", "2105", NULL, BLIST_RETRY_HWERROR}, |
1417 |
+diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c |
1418 |
+index 80e7067cfb797..ad811c0438cc7 100644 |
1419 |
+--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c |
1420 |
++++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c |
1421 |
+@@ -127,7 +127,7 @@ static int rt2880_pmx_group_enable(struct pinctrl_dev *pctrldev, |
1422 |
+ if (p->groups[group].enabled) { |
1423 |
+ dev_err(p->dev, "%s is already enabled\n", |
1424 |
+ p->groups[group].name); |
1425 |
+- return -EBUSY; |
1426 |
++ return 0; |
1427 |
+ } |
1428 |
+ |
1429 |
+ p->groups[group].enabled = 1; |
1430 |
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c |
1431 |
+index bdada97cd4fe2..9c60a090cfd17 100644 |
1432 |
+--- a/drivers/target/target_core_transport.c |
1433 |
++++ b/drivers/target/target_core_transport.c |
1434 |
+@@ -2982,9 +2982,7 @@ __transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop, |
1435 |
+ __releases(&cmd->t_state_lock) |
1436 |
+ __acquires(&cmd->t_state_lock) |
1437 |
+ { |
1438 |
+- |
1439 |
+- assert_spin_locked(&cmd->t_state_lock); |
1440 |
+- WARN_ON_ONCE(!irqs_disabled()); |
1441 |
++ lockdep_assert_held(&cmd->t_state_lock); |
1442 |
+ |
1443 |
+ if (fabric_stop) |
1444 |
+ cmd->transport_state |= CMD_T_FABRIC_STOP; |
1445 |
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c |
1446 |
+index 0ddc2e30065f5..a7f16dbfffdfa 100644 |
1447 |
+--- a/drivers/usb/core/hub.c |
1448 |
++++ b/drivers/usb/core/hub.c |
1449 |
+@@ -38,6 +38,8 @@ |
1450 |
+ #define USB_VENDOR_GENESYS_LOGIC 0x05e3 |
1451 |
+ #define USB_VENDOR_SMSC 0x0424 |
1452 |
+ #define USB_PRODUCT_USB5534B 0x5534 |
1453 |
++#define USB_VENDOR_CYPRESS 0x04b4 |
1454 |
++#define USB_PRODUCT_CY7C65632 0x6570 |
1455 |
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01 |
1456 |
+ #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02 |
1457 |
+ |
1458 |
+@@ -5442,6 +5444,11 @@ static const struct usb_device_id hub_id_table[] = { |
1459 |
+ .idProduct = USB_PRODUCT_USB5534B, |
1460 |
+ .bInterfaceClass = USB_CLASS_HUB, |
1461 |
+ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND}, |
1462 |
++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
1463 |
++ | USB_DEVICE_ID_MATCH_PRODUCT, |
1464 |
++ .idVendor = USB_VENDOR_CYPRESS, |
1465 |
++ .idProduct = USB_PRODUCT_CY7C65632, |
1466 |
++ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND}, |
1467 |
+ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
1468 |
+ | USB_DEVICE_ID_MATCH_INT_CLASS, |
1469 |
+ .idVendor = USB_VENDOR_GENESYS_LOGIC, |
1470 |
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c |
1471 |
+index e890c26b6c826..e223502eafca6 100644 |
1472 |
+--- a/drivers/usb/dwc3/core.c |
1473 |
++++ b/drivers/usb/dwc3/core.c |
1474 |
+@@ -1550,8 +1550,8 @@ static int dwc3_remove(struct platform_device *pdev) |
1475 |
+ |
1476 |
+ pm_runtime_get_sync(&pdev->dev); |
1477 |
+ |
1478 |
+- dwc3_debugfs_exit(dwc); |
1479 |
+ dwc3_core_exit_mode(dwc); |
1480 |
++ dwc3_debugfs_exit(dwc); |
1481 |
+ |
1482 |
+ dwc3_core_exit(dwc); |
1483 |
+ dwc3_ulpi_exit(dwc); |
1484 |
+diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h |
1485 |
+index 4f75ab3505b77..069db13f3a10a 100644 |
1486 |
+--- a/drivers/usb/dwc3/debug.h |
1487 |
++++ b/drivers/usb/dwc3/debug.h |
1488 |
+@@ -653,9 +653,12 @@ static inline const char *dwc3_gadget_generic_cmd_status_string(int status) |
1489 |
+ |
1490 |
+ |
1491 |
+ #ifdef CONFIG_DEBUG_FS |
1492 |
++extern void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep); |
1493 |
+ extern void dwc3_debugfs_init(struct dwc3 *); |
1494 |
+ extern void dwc3_debugfs_exit(struct dwc3 *); |
1495 |
+ #else |
1496 |
++static inline void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep) |
1497 |
++{ } |
1498 |
+ static inline void dwc3_debugfs_init(struct dwc3 *d) |
1499 |
+ { } |
1500 |
+ static inline void dwc3_debugfs_exit(struct dwc3 *d) |
1501 |
+diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c |
1502 |
+index 04ce7c01a09e6..58a2479d8e6a3 100644 |
1503 |
+--- a/drivers/usb/dwc3/debugfs.c |
1504 |
++++ b/drivers/usb/dwc3/debugfs.c |
1505 |
+@@ -725,30 +725,14 @@ static void dwc3_debugfs_create_endpoint_files(struct dwc3_ep *dep, |
1506 |
+ } |
1507 |
+ } |
1508 |
+ |
1509 |
+-static void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep, |
1510 |
+- struct dentry *parent) |
1511 |
++void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep) |
1512 |
+ { |
1513 |
+ struct dentry *dir; |
1514 |
+ |
1515 |
+- dir = debugfs_create_dir(dep->name, parent); |
1516 |
++ dir = debugfs_create_dir(dep->name, dep->dwc->root); |
1517 |
+ dwc3_debugfs_create_endpoint_files(dep, dir); |
1518 |
+ } |
1519 |
+ |
1520 |
+-static void dwc3_debugfs_create_endpoint_dirs(struct dwc3 *dwc, |
1521 |
+- struct dentry *parent) |
1522 |
+-{ |
1523 |
+- int i; |
1524 |
+- |
1525 |
+- for (i = 0; i < dwc->num_eps; i++) { |
1526 |
+- struct dwc3_ep *dep = dwc->eps[i]; |
1527 |
+- |
1528 |
+- if (!dep) |
1529 |
+- continue; |
1530 |
+- |
1531 |
+- dwc3_debugfs_create_endpoint_dir(dep, parent); |
1532 |
+- } |
1533 |
+-} |
1534 |
+- |
1535 |
+ void dwc3_debugfs_init(struct dwc3 *dwc) |
1536 |
+ { |
1537 |
+ struct dentry *root; |
1538 |
+@@ -777,7 +761,6 @@ void dwc3_debugfs_init(struct dwc3 *dwc) |
1539 |
+ &dwc3_testmode_fops); |
1540 |
+ debugfs_create_file("link_state", S_IRUGO | S_IWUSR, root, dwc, |
1541 |
+ &dwc3_link_state_fops); |
1542 |
+- dwc3_debugfs_create_endpoint_dirs(dwc, root); |
1543 |
+ } |
1544 |
+ } |
1545 |
+ |
1546 |
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c |
1547 |
+index 1396ee5297923..c93bed41d988a 100644 |
1548 |
+--- a/drivers/usb/dwc3/gadget.c |
1549 |
++++ b/drivers/usb/dwc3/gadget.c |
1550 |
+@@ -2255,6 +2255,8 @@ static int dwc3_gadget_init_endpoint(struct dwc3 *dwc, u8 epnum) |
1551 |
+ INIT_LIST_HEAD(&dep->started_list); |
1552 |
+ INIT_LIST_HEAD(&dep->cancelled_list); |
1553 |
+ |
1554 |
++ dwc3_debugfs_create_endpoint_dir(dep); |
1555 |
++ |
1556 |
+ return 0; |
1557 |
+ } |
1558 |
+ |
1559 |
+@@ -2298,6 +2300,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc) |
1560 |
+ list_del(&dep->endpoint.ep_list); |
1561 |
+ } |
1562 |
+ |
1563 |
++ debugfs_remove_recursive(debugfs_lookup(dep->name, dwc->root)); |
1564 |
+ kfree(dep); |
1565 |
+ } |
1566 |
+ } |
1567 |
+diff --git a/fs/afs/main.c b/fs/afs/main.c |
1568 |
+index 8ecb127be63f9..2eecb2c0a3c0e 100644 |
1569 |
+--- a/fs/afs/main.c |
1570 |
++++ b/fs/afs/main.c |
1571 |
+@@ -200,8 +200,8 @@ static int __init afs_init(void) |
1572 |
+ goto error_fs; |
1573 |
+ |
1574 |
+ afs_proc_symlink = proc_symlink("fs/afs", NULL, "../self/net/afs"); |
1575 |
+- if (IS_ERR(afs_proc_symlink)) { |
1576 |
+- ret = PTR_ERR(afs_proc_symlink); |
1577 |
++ if (!afs_proc_symlink) { |
1578 |
++ ret = -ENOMEM; |
1579 |
+ goto error_proc; |
1580 |
+ } |
1581 |
+ |
1582 |
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c |
1583 |
+index 143e7d518c5d5..7c69486d556fe 100644 |
1584 |
+--- a/fs/gfs2/file.c |
1585 |
++++ b/fs/gfs2/file.c |
1586 |
+@@ -822,8 +822,11 @@ static ssize_t gfs2_file_write_iter(struct kiocb *iocb, struct iov_iter *from) |
1587 |
+ current->backing_dev_info = inode_to_bdi(inode); |
1588 |
+ buffered = iomap_file_buffered_write(iocb, from, &gfs2_iomap_ops); |
1589 |
+ current->backing_dev_info = NULL; |
1590 |
+- if (unlikely(buffered <= 0)) |
1591 |
++ if (unlikely(buffered <= 0)) { |
1592 |
++ if (!ret) |
1593 |
++ ret = buffered; |
1594 |
+ goto out_unlock; |
1595 |
++ } |
1596 |
+ |
1597 |
+ /* |
1598 |
+ * We need to ensure that the page cache pages are written to |
1599 |
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c |
1600 |
+index c20d71d86812a..14d11ccda868d 100644 |
1601 |
+--- a/fs/gfs2/glock.c |
1602 |
++++ b/fs/gfs2/glock.c |
1603 |
+@@ -1457,6 +1457,7 @@ __acquires(&lru_lock) |
1604 |
+ while(!list_empty(list)) { |
1605 |
+ gl = list_entry(list->next, struct gfs2_glock, gl_lru); |
1606 |
+ list_del_init(&gl->gl_lru); |
1607 |
++ clear_bit(GLF_LRU, &gl->gl_flags); |
1608 |
+ if (!spin_trylock(&gl->gl_lockref.lock)) { |
1609 |
+ add_back_to_lru: |
1610 |
+ list_add(&gl->gl_lru, &lru_list); |
1611 |
+@@ -1502,7 +1503,6 @@ static long gfs2_scan_glock_lru(int nr) |
1612 |
+ if (!test_bit(GLF_LOCK, &gl->gl_flags)) { |
1613 |
+ list_move(&gl->gl_lru, &dispose); |
1614 |
+ atomic_dec(&lru_count); |
1615 |
+- clear_bit(GLF_LRU, &gl->gl_flags); |
1616 |
+ freed++; |
1617 |
+ continue; |
1618 |
+ } |
1619 |
+diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c |
1620 |
+index e60be7bb55b0b..c6c8a33c81d5e 100644 |
1621 |
+--- a/fs/nilfs2/sysfs.c |
1622 |
++++ b/fs/nilfs2/sysfs.c |
1623 |
+@@ -1054,6 +1054,7 @@ void nilfs_sysfs_delete_device_group(struct the_nilfs *nilfs) |
1624 |
+ nilfs_sysfs_delete_superblock_group(nilfs); |
1625 |
+ nilfs_sysfs_delete_segctor_group(nilfs); |
1626 |
+ kobject_del(&nilfs->ns_dev_kobj); |
1627 |
++ kobject_put(&nilfs->ns_dev_kobj); |
1628 |
+ kfree(nilfs->ns_dev_subgroups); |
1629 |
+ } |
1630 |
+ |
1631 |
+diff --git a/include/linux/hid.h b/include/linux/hid.h |
1632 |
+index 4dcce83ca3784..c833948aade05 100644 |
1633 |
+--- a/include/linux/hid.h |
1634 |
++++ b/include/linux/hid.h |
1635 |
+@@ -1151,8 +1151,7 @@ static inline void hid_hw_wait(struct hid_device *hdev) |
1636 |
+ */ |
1637 |
+ static inline u32 hid_report_len(struct hid_report *report) |
1638 |
+ { |
1639 |
+- /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */ |
1640 |
+- return ((report->size - 1) >> 3) + 1 + (report->id > 0); |
1641 |
++ return DIV_ROUND_UP(report->size, 8) + (report->id > 0); |
1642 |
+ } |
1643 |
+ |
1644 |
+ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, |
1645 |
+diff --git a/include/linux/net.h b/include/linux/net.h |
1646 |
+index e0930678c8bf6..41dc703b261cd 100644 |
1647 |
+--- a/include/linux/net.h |
1648 |
++++ b/include/linux/net.h |
1649 |
+@@ -83,6 +83,12 @@ enum sock_type { |
1650 |
+ |
1651 |
+ #endif /* ARCH_HAS_SOCKET_TYPES */ |
1652 |
+ |
1653 |
++/** |
1654 |
++ * enum sock_shutdown_cmd - Shutdown types |
1655 |
++ * @SHUT_RD: shutdown receptions |
1656 |
++ * @SHUT_WR: shutdown transmissions |
1657 |
++ * @SHUT_RDWR: shutdown receptions/transmissions |
1658 |
++ */ |
1659 |
+ enum sock_shutdown_cmd { |
1660 |
+ SHUT_RD, |
1661 |
+ SHUT_WR, |
1662 |
+diff --git a/include/linux/ptp_clock_kernel.h b/include/linux/ptp_clock_kernel.h |
1663 |
+index 51349d124ee5d..99c3f4ee938e9 100644 |
1664 |
+--- a/include/linux/ptp_clock_kernel.h |
1665 |
++++ b/include/linux/ptp_clock_kernel.h |
1666 |
+@@ -204,6 +204,14 @@ extern void ptp_clock_event(struct ptp_clock *ptp, |
1667 |
+ |
1668 |
+ extern int ptp_clock_index(struct ptp_clock *ptp); |
1669 |
+ |
1670 |
++/** |
1671 |
++ * scaled_ppm_to_ppb() - convert scaled ppm to ppb |
1672 |
++ * |
1673 |
++ * @ppm: Parts per million, but with a 16 bit binary fractional field |
1674 |
++ */ |
1675 |
++ |
1676 |
++extern long scaled_ppm_to_ppb(long ppm); |
1677 |
++ |
1678 |
+ /** |
1679 |
+ * ptp_find_pin() - obtain the pin index of a given auxiliary function |
1680 |
+ * |
1681 |
+diff --git a/include/linux/socket.h b/include/linux/socket.h |
1682 |
+index 7ed4713d53372..15a7eb24f63c9 100644 |
1683 |
+--- a/include/linux/socket.h |
1684 |
++++ b/include/linux/socket.h |
1685 |
+@@ -26,7 +26,7 @@ typedef __kernel_sa_family_t sa_family_t; |
1686 |
+ /* |
1687 |
+ * 1003.1g requires sa_family_t and that sa_data is char. |
1688 |
+ */ |
1689 |
+- |
1690 |
++ |
1691 |
+ struct sockaddr { |
1692 |
+ sa_family_t sa_family; /* address family, AF_xxx */ |
1693 |
+ char sa_data[14]; /* 14 bytes of protocol address */ |
1694 |
+@@ -44,7 +44,7 @@ struct linger { |
1695 |
+ * system, not 4.3. Thus msg_accrights(len) are now missing. They |
1696 |
+ * belong in an obscure libc emulation or the bin. |
1697 |
+ */ |
1698 |
+- |
1699 |
++ |
1700 |
+ struct msghdr { |
1701 |
+ void *msg_name; /* ptr to socket address structure */ |
1702 |
+ int msg_namelen; /* size of socket address structure */ |
1703 |
+@@ -54,7 +54,7 @@ struct msghdr { |
1704 |
+ unsigned int msg_flags; /* flags on received message */ |
1705 |
+ struct kiocb *msg_iocb; /* ptr to iocb for async requests */ |
1706 |
+ }; |
1707 |
+- |
1708 |
++ |
1709 |
+ struct user_msghdr { |
1710 |
+ void __user *msg_name; /* ptr to socket address structure */ |
1711 |
+ int msg_namelen; /* size of socket address structure */ |
1712 |
+@@ -122,7 +122,7 @@ struct cmsghdr { |
1713 |
+ * inside range, given by msg->msg_controllen before using |
1714 |
+ * ancillary object DATA. --ANK (980731) |
1715 |
+ */ |
1716 |
+- |
1717 |
++ |
1718 |
+ static inline struct cmsghdr * __cmsg_nxthdr(void *__ctl, __kernel_size_t __size, |
1719 |
+ struct cmsghdr *__cmsg) |
1720 |
+ { |
1721 |
+@@ -264,10 +264,10 @@ struct ucred { |
1722 |
+ /* Maximum queue length specifiable by listen. */ |
1723 |
+ #define SOMAXCONN 128 |
1724 |
+ |
1725 |
+-/* Flags we can use with send/ and recv. |
1726 |
++/* Flags we can use with send/ and recv. |
1727 |
+ Added those for 1003.1g not all are supported yet |
1728 |
+ */ |
1729 |
+- |
1730 |
++ |
1731 |
+ #define MSG_OOB 1 |
1732 |
+ #define MSG_PEEK 2 |
1733 |
+ #define MSG_DONTROUTE 4 |
1734 |
+@@ -384,6 +384,4 @@ extern int __sys_getpeername(int fd, struct sockaddr __user *usockaddr, |
1735 |
+ extern int __sys_socketpair(int family, int type, int protocol, |
1736 |
+ int __user *usockvec); |
1737 |
+ extern int __sys_shutdown(int fd, int how); |
1738 |
+- |
1739 |
+-extern struct ns_common *get_net_ns(struct ns_common *ns); |
1740 |
+ #endif /* _LINUX_SOCKET_H */ |
1741 |
+diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h |
1742 |
+index 5007eaba207d5..bc88ac6c2e1d7 100644 |
1743 |
+--- a/include/net/net_namespace.h |
1744 |
++++ b/include/net/net_namespace.h |
1745 |
+@@ -175,6 +175,8 @@ struct net *copy_net_ns(unsigned long flags, struct user_namespace *user_ns, |
1746 |
+ void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid); |
1747 |
+ |
1748 |
+ void net_ns_barrier(void); |
1749 |
++ |
1750 |
++struct ns_common *get_net_ns(struct ns_common *ns); |
1751 |
+ #else /* CONFIG_NET_NS */ |
1752 |
+ #include <linux/sched.h> |
1753 |
+ #include <linux/nsproxy.h> |
1754 |
+@@ -194,6 +196,11 @@ static inline void net_ns_get_ownership(const struct net *net, |
1755 |
+ } |
1756 |
+ |
1757 |
+ static inline void net_ns_barrier(void) {} |
1758 |
++ |
1759 |
++static inline struct ns_common *get_net_ns(struct ns_common *ns) |
1760 |
++{ |
1761 |
++ return ERR_PTR(-EINVAL); |
1762 |
++} |
1763 |
+ #endif /* CONFIG_NET_NS */ |
1764 |
+ |
1765 |
+ |
1766 |
+diff --git a/include/net/sock.h b/include/net/sock.h |
1767 |
+index bc752237dff3f..351749c694ce6 100644 |
1768 |
+--- a/include/net/sock.h |
1769 |
++++ b/include/net/sock.h |
1770 |
+@@ -1832,7 +1832,8 @@ static inline u32 net_tx_rndhash(void) |
1771 |
+ |
1772 |
+ static inline void sk_set_txhash(struct sock *sk) |
1773 |
+ { |
1774 |
+- sk->sk_txhash = net_tx_rndhash(); |
1775 |
++ /* This pairs with READ_ONCE() in skb_set_hash_from_sk() */ |
1776 |
++ WRITE_ONCE(sk->sk_txhash, net_tx_rndhash()); |
1777 |
+ } |
1778 |
+ |
1779 |
+ static inline void sk_rethink_txhash(struct sock *sk) |
1780 |
+@@ -2103,9 +2104,12 @@ static inline void sock_poll_wait(struct file *filp, struct socket *sock, |
1781 |
+ |
1782 |
+ static inline void skb_set_hash_from_sk(struct sk_buff *skb, struct sock *sk) |
1783 |
+ { |
1784 |
+- if (sk->sk_txhash) { |
1785 |
++ /* This pairs with WRITE_ONCE() in sk_set_txhash() */ |
1786 |
++ u32 txhash = READ_ONCE(sk->sk_txhash); |
1787 |
++ |
1788 |
++ if (txhash) { |
1789 |
+ skb->l4_hash = 1; |
1790 |
+- skb->hash = sk->sk_txhash; |
1791 |
++ skb->hash = txhash; |
1792 |
+ } |
1793 |
+ } |
1794 |
+ |
1795 |
+diff --git a/include/uapi/linux/in.h b/include/uapi/linux/in.h |
1796 |
+index 48e8a225b985a..2a66ab49f14dd 100644 |
1797 |
+--- a/include/uapi/linux/in.h |
1798 |
++++ b/include/uapi/linux/in.h |
1799 |
+@@ -280,6 +280,9 @@ struct sockaddr_in { |
1800 |
+ /* Address indicating an error return. */ |
1801 |
+ #define INADDR_NONE ((unsigned long int) 0xffffffff) |
1802 |
+ |
1803 |
++/* Dummy address for src of ICMP replies if no real address is set (RFC7600). */ |
1804 |
++#define INADDR_DUMMY ((unsigned long int) 0xc0000008) |
1805 |
++ |
1806 |
+ /* Network number for local host loopback. */ |
1807 |
+ #define IN_LOOPBACKNET 127 |
1808 |
+ |
1809 |
+diff --git a/kernel/module.c b/kernel/module.c |
1810 |
+index 92d8610742c7d..68637e661d75c 100644 |
1811 |
+--- a/kernel/module.c |
1812 |
++++ b/kernel/module.c |
1813 |
+@@ -268,9 +268,18 @@ static void module_assert_mutex_or_preempt(void) |
1814 |
+ #endif |
1815 |
+ } |
1816 |
+ |
1817 |
++#ifdef CONFIG_MODULE_SIG |
1818 |
+ static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE); |
1819 |
+ module_param(sig_enforce, bool_enable_only, 0644); |
1820 |
+ |
1821 |
++void set_module_sig_enforced(void) |
1822 |
++{ |
1823 |
++ sig_enforce = true; |
1824 |
++} |
1825 |
++#else |
1826 |
++#define sig_enforce false |
1827 |
++#endif |
1828 |
++ |
1829 |
+ /* |
1830 |
+ * Export sig_enforce kernel cmdline parameter to allow other subsystems rely |
1831 |
+ * on that instead of directly to CONFIG_MODULE_SIG_FORCE config. |
1832 |
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c |
1833 |
+index f8aaa7879d7d6..71bc808fe03a2 100644 |
1834 |
+--- a/kernel/trace/trace.c |
1835 |
++++ b/kernel/trace/trace.c |
1836 |
+@@ -1743,9 +1743,6 @@ struct saved_cmdlines_buffer { |
1837 |
+ }; |
1838 |
+ static struct saved_cmdlines_buffer *savedcmd; |
1839 |
+ |
1840 |
+-/* temporary disable recording */ |
1841 |
+-static atomic_t trace_record_taskinfo_disabled __read_mostly; |
1842 |
+- |
1843 |
+ static inline char *get_saved_cmdlines(int idx) |
1844 |
+ { |
1845 |
+ return &savedcmd->saved_cmdlines[idx * TASK_COMM_LEN]; |
1846 |
+@@ -2031,8 +2028,6 @@ static bool tracing_record_taskinfo_skip(int flags) |
1847 |
+ { |
1848 |
+ if (unlikely(!(flags & (TRACE_RECORD_CMDLINE | TRACE_RECORD_TGID)))) |
1849 |
+ return true; |
1850 |
+- if (atomic_read(&trace_record_taskinfo_disabled) || !tracing_is_on()) |
1851 |
+- return true; |
1852 |
+ if (!__this_cpu_read(trace_taskinfo_save)) |
1853 |
+ return true; |
1854 |
+ return false; |
1855 |
+@@ -3261,9 +3256,6 @@ static void *s_start(struct seq_file *m, loff_t *pos) |
1856 |
+ return ERR_PTR(-EBUSY); |
1857 |
+ #endif |
1858 |
+ |
1859 |
+- if (!iter->snapshot) |
1860 |
+- atomic_inc(&trace_record_taskinfo_disabled); |
1861 |
+- |
1862 |
+ if (*pos != iter->pos) { |
1863 |
+ iter->ent = NULL; |
1864 |
+ iter->cpu = 0; |
1865 |
+@@ -3306,9 +3298,6 @@ static void s_stop(struct seq_file *m, void *p) |
1866 |
+ return; |
1867 |
+ #endif |
1868 |
+ |
1869 |
+- if (!iter->snapshot) |
1870 |
+- atomic_dec(&trace_record_taskinfo_disabled); |
1871 |
+- |
1872 |
+ trace_access_unlock(iter->cpu_file); |
1873 |
+ trace_event_read_unlock(); |
1874 |
+ } |
1875 |
+diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c |
1876 |
+index c1637f90c8a38..4702efb00ff21 100644 |
1877 |
+--- a/kernel/trace/trace_clock.c |
1878 |
++++ b/kernel/trace/trace_clock.c |
1879 |
+@@ -115,9 +115,9 @@ u64 notrace trace_clock_global(void) |
1880 |
+ prev_time = READ_ONCE(trace_clock_struct.prev_time); |
1881 |
+ now = sched_clock_cpu(this_cpu); |
1882 |
+ |
1883 |
+- /* Make sure that now is always greater than prev_time */ |
1884 |
++ /* Make sure that now is always greater than or equal to prev_time */ |
1885 |
+ if ((s64)(now - prev_time) < 0) |
1886 |
+- now = prev_time + 1; |
1887 |
++ now = prev_time; |
1888 |
+ |
1889 |
+ /* |
1890 |
+ * If in an NMI context then dont risk lockups and simply return |
1891 |
+@@ -131,7 +131,7 @@ u64 notrace trace_clock_global(void) |
1892 |
+ /* Reread prev_time in case it was already updated */ |
1893 |
+ prev_time = READ_ONCE(trace_clock_struct.prev_time); |
1894 |
+ if ((s64)(now - prev_time) < 0) |
1895 |
+- now = prev_time + 1; |
1896 |
++ now = prev_time; |
1897 |
+ |
1898 |
+ trace_clock_struct.prev_time = now; |
1899 |
+ |
1900 |
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c |
1901 |
+index 034607a68ccb3..3da3c63dccd1a 100644 |
1902 |
+--- a/mm/memory-failure.c |
1903 |
++++ b/mm/memory-failure.c |
1904 |
+@@ -1387,7 +1387,12 @@ int memory_failure(unsigned long pfn, int flags) |
1905 |
+ return 0; |
1906 |
+ } |
1907 |
+ |
1908 |
+- if (!PageTransTail(p) && !PageLRU(p)) |
1909 |
++ /* |
1910 |
++ * __munlock_pagevec may clear a writeback page's LRU flag without |
1911 |
++ * page_lock. We need wait writeback completion for this page or it |
1912 |
++ * may trigger vfs BUG while evict inode. |
1913 |
++ */ |
1914 |
++ if (!PageTransTail(p) && !PageLRU(p) && !PageWriteback(p)) |
1915 |
+ goto identify_page_state; |
1916 |
+ |
1917 |
+ /* |
1918 |
+diff --git a/mm/slub.c b/mm/slub.c |
1919 |
+index da141e5974f2b..b6c5c8fd265d2 100644 |
1920 |
+--- a/mm/slub.c |
1921 |
++++ b/mm/slub.c |
1922 |
+@@ -15,6 +15,7 @@ |
1923 |
+ #include <linux/module.h> |
1924 |
+ #include <linux/bit_spinlock.h> |
1925 |
+ #include <linux/interrupt.h> |
1926 |
++#include <linux/swab.h> |
1927 |
+ #include <linux/bitops.h> |
1928 |
+ #include <linux/slab.h> |
1929 |
+ #include "slab.h" |
1930 |
+@@ -672,15 +673,15 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p) |
1931 |
+ p, p - addr, get_freepointer(s, p)); |
1932 |
+ |
1933 |
+ if (s->flags & SLAB_RED_ZONE) |
1934 |
+- print_section(KERN_ERR, "Redzone ", p - s->red_left_pad, |
1935 |
++ print_section(KERN_ERR, "Redzone ", p - s->red_left_pad, |
1936 |
+ s->red_left_pad); |
1937 |
+ else if (p > addr + 16) |
1938 |
+ print_section(KERN_ERR, "Bytes b4 ", p - 16, 16); |
1939 |
+ |
1940 |
+- print_section(KERN_ERR, "Object ", p, |
1941 |
++ print_section(KERN_ERR, "Object ", p, |
1942 |
+ min_t(unsigned int, s->object_size, PAGE_SIZE)); |
1943 |
+ if (s->flags & SLAB_RED_ZONE) |
1944 |
+- print_section(KERN_ERR, "Redzone ", p + s->object_size, |
1945 |
++ print_section(KERN_ERR, "Redzone ", p + s->object_size, |
1946 |
+ s->inuse - s->object_size); |
1947 |
+ |
1948 |
+ if (s->offset) |
1949 |
+@@ -695,7 +696,7 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p) |
1950 |
+ |
1951 |
+ if (off != size_from_object(s)) |
1952 |
+ /* Beginning of the filler is the free pointer */ |
1953 |
+- print_section(KERN_ERR, "Padding ", p + off, |
1954 |
++ print_section(KERN_ERR, "Padding ", p + off, |
1955 |
+ size_from_object(s) - off); |
1956 |
+ |
1957 |
+ dump_stack(); |
1958 |
+@@ -873,11 +874,11 @@ static int check_object(struct kmem_cache *s, struct page *page, |
1959 |
+ u8 *endobject = object + s->object_size; |
1960 |
+ |
1961 |
+ if (s->flags & SLAB_RED_ZONE) { |
1962 |
+- if (!check_bytes_and_report(s, page, object, "Redzone", |
1963 |
++ if (!check_bytes_and_report(s, page, object, "Left Redzone", |
1964 |
+ object - s->red_left_pad, val, s->red_left_pad)) |
1965 |
+ return 0; |
1966 |
+ |
1967 |
+- if (!check_bytes_and_report(s, page, object, "Redzone", |
1968 |
++ if (!check_bytes_and_report(s, page, object, "Right Redzone", |
1969 |
+ endobject, val, s->inuse - s->object_size)) |
1970 |
+ return 0; |
1971 |
+ } else { |
1972 |
+@@ -892,7 +893,7 @@ static int check_object(struct kmem_cache *s, struct page *page, |
1973 |
+ if (val != SLUB_RED_ACTIVE && (s->flags & __OBJECT_POISON) && |
1974 |
+ (!check_bytes_and_report(s, page, p, "Poison", p, |
1975 |
+ POISON_FREE, s->object_size - 1) || |
1976 |
+- !check_bytes_and_report(s, page, p, "Poison", |
1977 |
++ !check_bytes_and_report(s, page, p, "End Poison", |
1978 |
+ p + s->object_size - 1, POISON_END, 1))) |
1979 |
+ return 0; |
1980 |
+ /* |
1981 |
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c |
1982 |
+index 0b052ff51bdeb..cede6826e5b36 100644 |
1983 |
+--- a/net/batman-adv/bat_iv_ogm.c |
1984 |
++++ b/net/batman-adv/bat_iv_ogm.c |
1985 |
+@@ -594,8 +594,10 @@ static void batadv_iv_ogm_emit(struct batadv_forw_packet *forw_packet) |
1986 |
+ if (WARN_ON(!forw_packet->if_outgoing)) |
1987 |
+ return; |
1988 |
+ |
1989 |
+- if (WARN_ON(forw_packet->if_outgoing->soft_iface != soft_iface)) |
1990 |
++ if (forw_packet->if_outgoing->soft_iface != soft_iface) { |
1991 |
++ pr_warn("%s: soft interface switch for queued OGM\n", __func__); |
1992 |
+ return; |
1993 |
++ } |
1994 |
+ |
1995 |
+ if (forw_packet->if_incoming->if_status != BATADV_IF_ACTIVE) |
1996 |
+ return; |
1997 |
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h |
1998 |
+index 33b8222db75c4..7ca3b469242e4 100644 |
1999 |
+--- a/net/bridge/br_private.h |
2000 |
++++ b/net/bridge/br_private.h |
2001 |
+@@ -100,8 +100,8 @@ struct br_vlan_stats { |
2002 |
+ }; |
2003 |
+ |
2004 |
+ struct br_tunnel_info { |
2005 |
+- __be64 tunnel_id; |
2006 |
+- struct metadata_dst *tunnel_dst; |
2007 |
++ __be64 tunnel_id; |
2008 |
++ struct metadata_dst __rcu *tunnel_dst; |
2009 |
+ }; |
2010 |
+ |
2011 |
+ /** |
2012 |
+diff --git a/net/bridge/br_vlan_tunnel.c b/net/bridge/br_vlan_tunnel.c |
2013 |
+index 6d2c4eed2dc89..adb6845ceba46 100644 |
2014 |
+--- a/net/bridge/br_vlan_tunnel.c |
2015 |
++++ b/net/bridge/br_vlan_tunnel.c |
2016 |
+@@ -46,26 +46,33 @@ static struct net_bridge_vlan *br_vlan_tunnel_lookup(struct rhashtable *tbl, |
2017 |
+ br_vlan_tunnel_rht_params); |
2018 |
+ } |
2019 |
+ |
2020 |
++static void vlan_tunnel_info_release(struct net_bridge_vlan *vlan) |
2021 |
++{ |
2022 |
++ struct metadata_dst *tdst = rtnl_dereference(vlan->tinfo.tunnel_dst); |
2023 |
++ |
2024 |
++ WRITE_ONCE(vlan->tinfo.tunnel_id, 0); |
2025 |
++ RCU_INIT_POINTER(vlan->tinfo.tunnel_dst, NULL); |
2026 |
++ dst_release(&tdst->dst); |
2027 |
++} |
2028 |
++ |
2029 |
+ void vlan_tunnel_info_del(struct net_bridge_vlan_group *vg, |
2030 |
+ struct net_bridge_vlan *vlan) |
2031 |
+ { |
2032 |
+- if (!vlan->tinfo.tunnel_dst) |
2033 |
++ if (!rcu_access_pointer(vlan->tinfo.tunnel_dst)) |
2034 |
+ return; |
2035 |
+ rhashtable_remove_fast(&vg->tunnel_hash, &vlan->tnode, |
2036 |
+ br_vlan_tunnel_rht_params); |
2037 |
+- vlan->tinfo.tunnel_id = 0; |
2038 |
+- dst_release(&vlan->tinfo.tunnel_dst->dst); |
2039 |
+- vlan->tinfo.tunnel_dst = NULL; |
2040 |
++ vlan_tunnel_info_release(vlan); |
2041 |
+ } |
2042 |
+ |
2043 |
+ static int __vlan_tunnel_info_add(struct net_bridge_vlan_group *vg, |
2044 |
+ struct net_bridge_vlan *vlan, u32 tun_id) |
2045 |
+ { |
2046 |
+- struct metadata_dst *metadata = NULL; |
2047 |
++ struct metadata_dst *metadata = rtnl_dereference(vlan->tinfo.tunnel_dst); |
2048 |
+ __be64 key = key32_to_tunnel_id(cpu_to_be32(tun_id)); |
2049 |
+ int err; |
2050 |
+ |
2051 |
+- if (vlan->tinfo.tunnel_dst) |
2052 |
++ if (metadata) |
2053 |
+ return -EEXIST; |
2054 |
+ |
2055 |
+ metadata = __ip_tun_set_dst(0, 0, 0, 0, 0, TUNNEL_KEY, |
2056 |
+@@ -74,8 +81,8 @@ static int __vlan_tunnel_info_add(struct net_bridge_vlan_group *vg, |
2057 |
+ return -EINVAL; |
2058 |
+ |
2059 |
+ metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX | IP_TUNNEL_INFO_BRIDGE; |
2060 |
+- vlan->tinfo.tunnel_dst = metadata; |
2061 |
+- vlan->tinfo.tunnel_id = key; |
2062 |
++ rcu_assign_pointer(vlan->tinfo.tunnel_dst, metadata); |
2063 |
++ WRITE_ONCE(vlan->tinfo.tunnel_id, key); |
2064 |
+ |
2065 |
+ err = rhashtable_lookup_insert_fast(&vg->tunnel_hash, &vlan->tnode, |
2066 |
+ br_vlan_tunnel_rht_params); |
2067 |
+@@ -84,9 +91,7 @@ static int __vlan_tunnel_info_add(struct net_bridge_vlan_group *vg, |
2068 |
+ |
2069 |
+ return 0; |
2070 |
+ out: |
2071 |
+- dst_release(&vlan->tinfo.tunnel_dst->dst); |
2072 |
+- vlan->tinfo.tunnel_dst = NULL; |
2073 |
+- vlan->tinfo.tunnel_id = 0; |
2074 |
++ vlan_tunnel_info_release(vlan); |
2075 |
+ |
2076 |
+ return err; |
2077 |
+ } |
2078 |
+@@ -186,12 +191,15 @@ int br_handle_ingress_vlan_tunnel(struct sk_buff *skb, |
2079 |
+ int br_handle_egress_vlan_tunnel(struct sk_buff *skb, |
2080 |
+ struct net_bridge_vlan *vlan) |
2081 |
+ { |
2082 |
++ struct metadata_dst *tunnel_dst; |
2083 |
++ __be64 tunnel_id; |
2084 |
+ int err; |
2085 |
+ |
2086 |
+- if (!vlan || !vlan->tinfo.tunnel_id) |
2087 |
++ if (!vlan) |
2088 |
+ return 0; |
2089 |
+ |
2090 |
+- if (unlikely(!skb_vlan_tag_present(skb))) |
2091 |
++ tunnel_id = READ_ONCE(vlan->tinfo.tunnel_id); |
2092 |
++ if (!tunnel_id || unlikely(!skb_vlan_tag_present(skb))) |
2093 |
+ return 0; |
2094 |
+ |
2095 |
+ skb_dst_drop(skb); |
2096 |
+@@ -199,7 +207,9 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb, |
2097 |
+ if (err) |
2098 |
+ return err; |
2099 |
+ |
2100 |
+- skb_dst_set(skb, dst_clone(&vlan->tinfo.tunnel_dst->dst)); |
2101 |
++ tunnel_dst = rcu_dereference(vlan->tinfo.tunnel_dst); |
2102 |
++ if (tunnel_dst && dst_hold_safe(&tunnel_dst->dst)) |
2103 |
++ skb_dst_set(skb, &tunnel_dst->dst); |
2104 |
+ |
2105 |
+ return 0; |
2106 |
+ } |
2107 |
+diff --git a/net/can/bcm.c b/net/can/bcm.c |
2108 |
+index 79bb8afa9c0c0..9f30d7b4389a8 100644 |
2109 |
+--- a/net/can/bcm.c |
2110 |
++++ b/net/can/bcm.c |
2111 |
+@@ -125,7 +125,7 @@ struct bcm_sock { |
2112 |
+ struct sock sk; |
2113 |
+ int bound; |
2114 |
+ int ifindex; |
2115 |
+- struct notifier_block notifier; |
2116 |
++ struct list_head notifier; |
2117 |
+ struct list_head rx_ops; |
2118 |
+ struct list_head tx_ops; |
2119 |
+ unsigned long dropped_usr_msgs; |
2120 |
+@@ -133,6 +133,10 @@ struct bcm_sock { |
2121 |
+ char procname [32]; /* inode number in decimal with \0 */ |
2122 |
+ }; |
2123 |
+ |
2124 |
++static LIST_HEAD(bcm_notifier_list); |
2125 |
++static DEFINE_SPINLOCK(bcm_notifier_lock); |
2126 |
++static struct bcm_sock *bcm_busy_notifier; |
2127 |
++ |
2128 |
+ static inline struct bcm_sock *bcm_sk(const struct sock *sk) |
2129 |
+ { |
2130 |
+ return (struct bcm_sock *)sk; |
2131 |
+@@ -393,6 +397,7 @@ static void bcm_tx_timeout_tsklet(unsigned long data) |
2132 |
+ if (!op->count && (op->flags & TX_COUNTEVT)) { |
2133 |
+ |
2134 |
+ /* create notification to user */ |
2135 |
++ memset(&msg_head, 0, sizeof(msg_head)); |
2136 |
+ msg_head.opcode = TX_EXPIRED; |
2137 |
+ msg_head.flags = op->flags; |
2138 |
+ msg_head.count = op->count; |
2139 |
+@@ -440,6 +445,7 @@ static void bcm_rx_changed(struct bcm_op *op, struct canfd_frame *data) |
2140 |
+ /* this element is not throttled anymore */ |
2141 |
+ data->flags &= (BCM_CAN_FLAGS_MASK|RX_RECV); |
2142 |
+ |
2143 |
++ memset(&head, 0, sizeof(head)); |
2144 |
+ head.opcode = RX_CHANGED; |
2145 |
+ head.flags = op->flags; |
2146 |
+ head.count = op->count; |
2147 |
+@@ -554,6 +560,7 @@ static void bcm_rx_timeout_tsklet(unsigned long data) |
2148 |
+ struct bcm_msg_head msg_head; |
2149 |
+ |
2150 |
+ /* create notification to user */ |
2151 |
++ memset(&msg_head, 0, sizeof(msg_head)); |
2152 |
+ msg_head.opcode = RX_TIMEOUT; |
2153 |
+ msg_head.flags = op->flags; |
2154 |
+ msg_head.count = op->count; |
2155 |
+@@ -1429,20 +1436,15 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) |
2156 |
+ /* |
2157 |
+ * notification handler for netdevice status changes |
2158 |
+ */ |
2159 |
+-static int bcm_notifier(struct notifier_block *nb, unsigned long msg, |
2160 |
+- void *ptr) |
2161 |
++static void bcm_notify(struct bcm_sock *bo, unsigned long msg, |
2162 |
++ struct net_device *dev) |
2163 |
+ { |
2164 |
+- struct net_device *dev = netdev_notifier_info_to_dev(ptr); |
2165 |
+- struct bcm_sock *bo = container_of(nb, struct bcm_sock, notifier); |
2166 |
+ struct sock *sk = &bo->sk; |
2167 |
+ struct bcm_op *op; |
2168 |
+ int notify_enodev = 0; |
2169 |
+ |
2170 |
+ if (!net_eq(dev_net(dev), sock_net(sk))) |
2171 |
+- return NOTIFY_DONE; |
2172 |
+- |
2173 |
+- if (dev->type != ARPHRD_CAN) |
2174 |
+- return NOTIFY_DONE; |
2175 |
++ return; |
2176 |
+ |
2177 |
+ switch (msg) { |
2178 |
+ |
2179 |
+@@ -1477,7 +1479,28 @@ static int bcm_notifier(struct notifier_block *nb, unsigned long msg, |
2180 |
+ sk->sk_error_report(sk); |
2181 |
+ } |
2182 |
+ } |
2183 |
++} |
2184 |
+ |
2185 |
++static int bcm_notifier(struct notifier_block *nb, unsigned long msg, |
2186 |
++ void *ptr) |
2187 |
++{ |
2188 |
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr); |
2189 |
++ |
2190 |
++ if (dev->type != ARPHRD_CAN) |
2191 |
++ return NOTIFY_DONE; |
2192 |
++ if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) |
2193 |
++ return NOTIFY_DONE; |
2194 |
++ if (unlikely(bcm_busy_notifier)) /* Check for reentrant bug. */ |
2195 |
++ return NOTIFY_DONE; |
2196 |
++ |
2197 |
++ spin_lock(&bcm_notifier_lock); |
2198 |
++ list_for_each_entry(bcm_busy_notifier, &bcm_notifier_list, notifier) { |
2199 |
++ spin_unlock(&bcm_notifier_lock); |
2200 |
++ bcm_notify(bcm_busy_notifier, msg, dev); |
2201 |
++ spin_lock(&bcm_notifier_lock); |
2202 |
++ } |
2203 |
++ bcm_busy_notifier = NULL; |
2204 |
++ spin_unlock(&bcm_notifier_lock); |
2205 |
+ return NOTIFY_DONE; |
2206 |
+ } |
2207 |
+ |
2208 |
+@@ -1497,9 +1520,9 @@ static int bcm_init(struct sock *sk) |
2209 |
+ INIT_LIST_HEAD(&bo->rx_ops); |
2210 |
+ |
2211 |
+ /* set notifier */ |
2212 |
+- bo->notifier.notifier_call = bcm_notifier; |
2213 |
+- |
2214 |
+- register_netdevice_notifier(&bo->notifier); |
2215 |
++ spin_lock(&bcm_notifier_lock); |
2216 |
++ list_add_tail(&bo->notifier, &bcm_notifier_list); |
2217 |
++ spin_unlock(&bcm_notifier_lock); |
2218 |
+ |
2219 |
+ return 0; |
2220 |
+ } |
2221 |
+@@ -1522,7 +1545,14 @@ static int bcm_release(struct socket *sock) |
2222 |
+ |
2223 |
+ /* remove bcm_ops, timer, rx_unregister(), etc. */ |
2224 |
+ |
2225 |
+- unregister_netdevice_notifier(&bo->notifier); |
2226 |
++ spin_lock(&bcm_notifier_lock); |
2227 |
++ while (bcm_busy_notifier == bo) { |
2228 |
++ spin_unlock(&bcm_notifier_lock); |
2229 |
++ schedule_timeout_uninterruptible(1); |
2230 |
++ spin_lock(&bcm_notifier_lock); |
2231 |
++ } |
2232 |
++ list_del(&bo->notifier); |
2233 |
++ spin_unlock(&bcm_notifier_lock); |
2234 |
+ |
2235 |
+ lock_sock(sk); |
2236 |
+ |
2237 |
+@@ -1737,6 +1767,10 @@ static struct pernet_operations canbcm_pernet_ops __read_mostly = { |
2238 |
+ .exit = canbcm_pernet_exit, |
2239 |
+ }; |
2240 |
+ |
2241 |
++static struct notifier_block canbcm_notifier = { |
2242 |
++ .notifier_call = bcm_notifier |
2243 |
++}; |
2244 |
++ |
2245 |
+ static int __init bcm_module_init(void) |
2246 |
+ { |
2247 |
+ int err; |
2248 |
+@@ -1750,12 +1784,14 @@ static int __init bcm_module_init(void) |
2249 |
+ } |
2250 |
+ |
2251 |
+ register_pernet_subsys(&canbcm_pernet_ops); |
2252 |
++ register_netdevice_notifier(&canbcm_notifier); |
2253 |
+ return 0; |
2254 |
+ } |
2255 |
+ |
2256 |
+ static void __exit bcm_module_exit(void) |
2257 |
+ { |
2258 |
+ can_proto_unregister(&bcm_can_proto); |
2259 |
++ unregister_netdevice_notifier(&canbcm_notifier); |
2260 |
+ unregister_pernet_subsys(&canbcm_pernet_ops); |
2261 |
+ } |
2262 |
+ |
2263 |
+diff --git a/net/can/raw.c b/net/can/raw.c |
2264 |
+index 3aab7664933fd..296a11a922e09 100644 |
2265 |
+--- a/net/can/raw.c |
2266 |
++++ b/net/can/raw.c |
2267 |
+@@ -84,7 +84,7 @@ struct raw_sock { |
2268 |
+ struct sock sk; |
2269 |
+ int bound; |
2270 |
+ int ifindex; |
2271 |
+- struct notifier_block notifier; |
2272 |
++ struct list_head notifier; |
2273 |
+ int loopback; |
2274 |
+ int recv_own_msgs; |
2275 |
+ int fd_frames; |
2276 |
+@@ -96,6 +96,10 @@ struct raw_sock { |
2277 |
+ struct uniqframe __percpu *uniq; |
2278 |
+ }; |
2279 |
+ |
2280 |
++static LIST_HEAD(raw_notifier_list); |
2281 |
++static DEFINE_SPINLOCK(raw_notifier_lock); |
2282 |
++static struct raw_sock *raw_busy_notifier; |
2283 |
++ |
2284 |
+ /* |
2285 |
+ * Return pointer to store the extra msg flags for raw_recvmsg(). |
2286 |
+ * We use the space of one unsigned int beyond the 'struct sockaddr_can' |
2287 |
+@@ -266,21 +270,16 @@ static int raw_enable_allfilters(struct net *net, struct net_device *dev, |
2288 |
+ return err; |
2289 |
+ } |
2290 |
+ |
2291 |
+-static int raw_notifier(struct notifier_block *nb, |
2292 |
+- unsigned long msg, void *ptr) |
2293 |
++static void raw_notify(struct raw_sock *ro, unsigned long msg, |
2294 |
++ struct net_device *dev) |
2295 |
+ { |
2296 |
+- struct net_device *dev = netdev_notifier_info_to_dev(ptr); |
2297 |
+- struct raw_sock *ro = container_of(nb, struct raw_sock, notifier); |
2298 |
+ struct sock *sk = &ro->sk; |
2299 |
+ |
2300 |
+ if (!net_eq(dev_net(dev), sock_net(sk))) |
2301 |
+- return NOTIFY_DONE; |
2302 |
+- |
2303 |
+- if (dev->type != ARPHRD_CAN) |
2304 |
+- return NOTIFY_DONE; |
2305 |
++ return; |
2306 |
+ |
2307 |
+ if (ro->ifindex != dev->ifindex) |
2308 |
+- return NOTIFY_DONE; |
2309 |
++ return; |
2310 |
+ |
2311 |
+ switch (msg) { |
2312 |
+ |
2313 |
+@@ -309,7 +308,28 @@ static int raw_notifier(struct notifier_block *nb, |
2314 |
+ sk->sk_error_report(sk); |
2315 |
+ break; |
2316 |
+ } |
2317 |
++} |
2318 |
++ |
2319 |
++static int raw_notifier(struct notifier_block *nb, unsigned long msg, |
2320 |
++ void *ptr) |
2321 |
++{ |
2322 |
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr); |
2323 |
++ |
2324 |
++ if (dev->type != ARPHRD_CAN) |
2325 |
++ return NOTIFY_DONE; |
2326 |
++ if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) |
2327 |
++ return NOTIFY_DONE; |
2328 |
++ if (unlikely(raw_busy_notifier)) /* Check for reentrant bug. */ |
2329 |
++ return NOTIFY_DONE; |
2330 |
+ |
2331 |
++ spin_lock(&raw_notifier_lock); |
2332 |
++ list_for_each_entry(raw_busy_notifier, &raw_notifier_list, notifier) { |
2333 |
++ spin_unlock(&raw_notifier_lock); |
2334 |
++ raw_notify(raw_busy_notifier, msg, dev); |
2335 |
++ spin_lock(&raw_notifier_lock); |
2336 |
++ } |
2337 |
++ raw_busy_notifier = NULL; |
2338 |
++ spin_unlock(&raw_notifier_lock); |
2339 |
+ return NOTIFY_DONE; |
2340 |
+ } |
2341 |
+ |
2342 |
+@@ -338,9 +358,9 @@ static int raw_init(struct sock *sk) |
2343 |
+ return -ENOMEM; |
2344 |
+ |
2345 |
+ /* set notifier */ |
2346 |
+- ro->notifier.notifier_call = raw_notifier; |
2347 |
+- |
2348 |
+- register_netdevice_notifier(&ro->notifier); |
2349 |
++ spin_lock(&raw_notifier_lock); |
2350 |
++ list_add_tail(&ro->notifier, &raw_notifier_list); |
2351 |
++ spin_unlock(&raw_notifier_lock); |
2352 |
+ |
2353 |
+ return 0; |
2354 |
+ } |
2355 |
+@@ -355,7 +375,14 @@ static int raw_release(struct socket *sock) |
2356 |
+ |
2357 |
+ ro = raw_sk(sk); |
2358 |
+ |
2359 |
+- unregister_netdevice_notifier(&ro->notifier); |
2360 |
++ spin_lock(&raw_notifier_lock); |
2361 |
++ while (raw_busy_notifier == ro) { |
2362 |
++ spin_unlock(&raw_notifier_lock); |
2363 |
++ schedule_timeout_uninterruptible(1); |
2364 |
++ spin_lock(&raw_notifier_lock); |
2365 |
++ } |
2366 |
++ list_del(&ro->notifier); |
2367 |
++ spin_unlock(&raw_notifier_lock); |
2368 |
+ |
2369 |
+ lock_sock(sk); |
2370 |
+ |
2371 |
+@@ -870,6 +897,10 @@ static const struct can_proto raw_can_proto = { |
2372 |
+ .prot = &raw_proto, |
2373 |
+ }; |
2374 |
+ |
2375 |
++static struct notifier_block canraw_notifier = { |
2376 |
++ .notifier_call = raw_notifier |
2377 |
++}; |
2378 |
++ |
2379 |
+ static __init int raw_module_init(void) |
2380 |
+ { |
2381 |
+ int err; |
2382 |
+@@ -879,6 +910,8 @@ static __init int raw_module_init(void) |
2383 |
+ err = can_proto_register(&raw_can_proto); |
2384 |
+ if (err < 0) |
2385 |
+ printk(KERN_ERR "can: registration of raw protocol failed\n"); |
2386 |
++ else |
2387 |
++ register_netdevice_notifier(&canraw_notifier); |
2388 |
+ |
2389 |
+ return err; |
2390 |
+ } |
2391 |
+@@ -886,6 +919,7 @@ static __init int raw_module_init(void) |
2392 |
+ static __exit void raw_module_exit(void) |
2393 |
+ { |
2394 |
+ can_proto_unregister(&raw_can_proto); |
2395 |
++ unregister_netdevice_notifier(&canraw_notifier); |
2396 |
+ } |
2397 |
+ |
2398 |
+ module_init(raw_module_init); |
2399 |
+diff --git a/net/compat.c b/net/compat.c |
2400 |
+index 2a8c7cb5f06a8..2778a236e0917 100644 |
2401 |
+--- a/net/compat.c |
2402 |
++++ b/net/compat.c |
2403 |
+@@ -158,7 +158,7 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk, |
2404 |
+ if (kcmlen > stackbuf_size) |
2405 |
+ kcmsg_base = kcmsg = sock_kmalloc(sk, kcmlen, GFP_KERNEL); |
2406 |
+ if (kcmsg == NULL) |
2407 |
+- return -ENOBUFS; |
2408 |
++ return -ENOMEM; |
2409 |
+ |
2410 |
+ /* Now copy them over neatly. */ |
2411 |
+ memset(kcmsg, 0, kcmlen); |
2412 |
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c |
2413 |
+index 83028017c26dd..4db9512feba83 100644 |
2414 |
+--- a/net/core/ethtool.c |
2415 |
++++ b/net/core/ethtool.c |
2416 |
+@@ -1594,7 +1594,7 @@ static int ethtool_get_any_eeprom(struct net_device *dev, void __user *useraddr, |
2417 |
+ if (eeprom.offset + eeprom.len > total_len) |
2418 |
+ return -EINVAL; |
2419 |
+ |
2420 |
+- data = kmalloc(PAGE_SIZE, GFP_USER); |
2421 |
++ data = kzalloc(PAGE_SIZE, GFP_USER); |
2422 |
+ if (!data) |
2423 |
+ return -ENOMEM; |
2424 |
+ |
2425 |
+@@ -1659,7 +1659,7 @@ static int ethtool_set_eeprom(struct net_device *dev, void __user *useraddr) |
2426 |
+ if (eeprom.offset + eeprom.len > ops->get_eeprom_len(dev)) |
2427 |
+ return -EINVAL; |
2428 |
+ |
2429 |
+- data = kmalloc(PAGE_SIZE, GFP_USER); |
2430 |
++ data = kzalloc(PAGE_SIZE, GFP_USER); |
2431 |
+ if (!data) |
2432 |
+ return -ENOMEM; |
2433 |
+ |
2434 |
+@@ -1840,7 +1840,7 @@ static int ethtool_self_test(struct net_device *dev, char __user *useraddr) |
2435 |
+ return -EFAULT; |
2436 |
+ |
2437 |
+ test.len = test_len; |
2438 |
+- data = kmalloc_array(test_len, sizeof(u64), GFP_USER); |
2439 |
++ data = kcalloc(test_len, sizeof(u64), GFP_USER); |
2440 |
+ if (!data) |
2441 |
+ return -ENOMEM; |
2442 |
+ |
2443 |
+@@ -2372,7 +2372,7 @@ static int ethtool_get_tunable(struct net_device *dev, void __user *useraddr) |
2444 |
+ ret = ethtool_tunable_valid(&tuna); |
2445 |
+ if (ret) |
2446 |
+ return ret; |
2447 |
+- data = kmalloc(tuna.len, GFP_USER); |
2448 |
++ data = kzalloc(tuna.len, GFP_USER); |
2449 |
+ if (!data) |
2450 |
+ return -ENOMEM; |
2451 |
+ ret = ops->get_tunable(dev, &tuna, data); |
2452 |
+@@ -2552,7 +2552,7 @@ static int get_phy_tunable(struct net_device *dev, void __user *useraddr) |
2453 |
+ ret = ethtool_phy_tunable_valid(&tuna); |
2454 |
+ if (ret) |
2455 |
+ return ret; |
2456 |
+- data = kmalloc(tuna.len, GFP_USER); |
2457 |
++ data = kzalloc(tuna.len, GFP_USER); |
2458 |
+ if (!data) |
2459 |
+ return -ENOMEM; |
2460 |
+ mutex_lock(&phydev->lock); |
2461 |
+diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c |
2462 |
+index 8916c5d9b3b3a..46a13ed15c4e8 100644 |
2463 |
+--- a/net/core/fib_rules.c |
2464 |
++++ b/net/core/fib_rules.c |
2465 |
+@@ -1105,7 +1105,7 @@ static void notify_rule_change(int event, struct fib_rule *rule, |
2466 |
+ { |
2467 |
+ struct net *net; |
2468 |
+ struct sk_buff *skb; |
2469 |
+- int err = -ENOBUFS; |
2470 |
++ int err = -ENOMEM; |
2471 |
+ |
2472 |
+ net = ops->fro_net; |
2473 |
+ skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL); |
2474 |
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c |
2475 |
+index c60123dff8039..939d8a31eb82a 100644 |
2476 |
+--- a/net/core/net_namespace.c |
2477 |
++++ b/net/core/net_namespace.c |
2478 |
+@@ -598,6 +598,18 @@ void __put_net(struct net *net) |
2479 |
+ } |
2480 |
+ EXPORT_SYMBOL_GPL(__put_net); |
2481 |
+ |
2482 |
++/** |
2483 |
++ * get_net_ns - increment the refcount of the network namespace |
2484 |
++ * @ns: common namespace (net) |
2485 |
++ * |
2486 |
++ * Returns the net's common namespace. |
2487 |
++ */ |
2488 |
++struct ns_common *get_net_ns(struct ns_common *ns) |
2489 |
++{ |
2490 |
++ return &get_net(container_of(ns, struct net, ns))->ns; |
2491 |
++} |
2492 |
++EXPORT_SYMBOL_GPL(get_net_ns); |
2493 |
++ |
2494 |
+ struct net *get_net_ns_by_fd(int fd) |
2495 |
+ { |
2496 |
+ struct file *file; |
2497 |
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
2498 |
+index 935053ee7765d..055fd09ac1114 100644 |
2499 |
+--- a/net/core/rtnetlink.c |
2500 |
++++ b/net/core/rtnetlink.c |
2501 |
+@@ -4102,6 +4102,10 @@ static int rtnl_bridge_notify(struct net_device *dev) |
2502 |
+ if (err < 0) |
2503 |
+ goto errout; |
2504 |
+ |
2505 |
++ /* Notification info is only filled for bridge ports, not the bridge |
2506 |
++ * device itself. Therefore, a zero notification length is valid and |
2507 |
++ * should not result in an error. |
2508 |
++ */ |
2509 |
+ if (!skb->len) |
2510 |
+ goto errout; |
2511 |
+ |
2512 |
+diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c |
2513 |
+index b1c55db737648..6d4c71a52b6b2 100644 |
2514 |
+--- a/net/ieee802154/nl802154.c |
2515 |
++++ b/net/ieee802154/nl802154.c |
2516 |
+@@ -1315,19 +1315,20 @@ ieee802154_llsec_parse_dev_addr(struct nlattr *nla, |
2517 |
+ nl802154_dev_addr_policy, NULL)) |
2518 |
+ return -EINVAL; |
2519 |
+ |
2520 |
+- if (!attrs[NL802154_DEV_ADDR_ATTR_PAN_ID] || |
2521 |
+- !attrs[NL802154_DEV_ADDR_ATTR_MODE] || |
2522 |
+- !(attrs[NL802154_DEV_ADDR_ATTR_SHORT] || |
2523 |
+- attrs[NL802154_DEV_ADDR_ATTR_EXTENDED])) |
2524 |
++ if (!attrs[NL802154_DEV_ADDR_ATTR_PAN_ID] || !attrs[NL802154_DEV_ADDR_ATTR_MODE]) |
2525 |
+ return -EINVAL; |
2526 |
+ |
2527 |
+ addr->pan_id = nla_get_le16(attrs[NL802154_DEV_ADDR_ATTR_PAN_ID]); |
2528 |
+ addr->mode = nla_get_u32(attrs[NL802154_DEV_ADDR_ATTR_MODE]); |
2529 |
+ switch (addr->mode) { |
2530 |
+ case NL802154_DEV_ADDR_SHORT: |
2531 |
++ if (!attrs[NL802154_DEV_ADDR_ATTR_SHORT]) |
2532 |
++ return -EINVAL; |
2533 |
+ addr->short_addr = nla_get_le16(attrs[NL802154_DEV_ADDR_ATTR_SHORT]); |
2534 |
+ break; |
2535 |
+ case NL802154_DEV_ADDR_EXTENDED: |
2536 |
++ if (!attrs[NL802154_DEV_ADDR_ATTR_EXTENDED]) |
2537 |
++ return -EINVAL; |
2538 |
+ addr->extended_addr = nla_get_le64(attrs[NL802154_DEV_ADDR_ATTR_EXTENDED]); |
2539 |
+ break; |
2540 |
+ default: |
2541 |
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c |
2542 |
+index 6a1b52b34e205..e8b8dd1cb1576 100644 |
2543 |
+--- a/net/ipv4/cipso_ipv4.c |
2544 |
++++ b/net/ipv4/cipso_ipv4.c |
2545 |
+@@ -486,6 +486,7 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def) |
2546 |
+ kfree(doi_def->map.std->lvl.local); |
2547 |
+ kfree(doi_def->map.std->cat.cipso); |
2548 |
+ kfree(doi_def->map.std->cat.local); |
2549 |
++ kfree(doi_def->map.std); |
2550 |
+ break; |
2551 |
+ } |
2552 |
+ kfree(doi_def); |
2553 |
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c |
2554 |
+index b048125ea0994..dde6cf82e9f0a 100644 |
2555 |
+--- a/net/ipv4/icmp.c |
2556 |
++++ b/net/ipv4/icmp.c |
2557 |
+@@ -744,6 +744,13 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, |
2558 |
+ icmp_param.data_len = room; |
2559 |
+ icmp_param.head_len = sizeof(struct icmphdr); |
2560 |
+ |
2561 |
++ /* if we don't have a source address at this point, fall back to the |
2562 |
++ * dummy address instead of sending out a packet with a source address |
2563 |
++ * of 0.0.0.0 |
2564 |
++ */ |
2565 |
++ if (!fl4.saddr) |
2566 |
++ fl4.saddr = htonl(INADDR_DUMMY); |
2567 |
++ |
2568 |
+ icmp_push_reply(&icmp_param, &fl4, &ipc, &rt); |
2569 |
+ ende: |
2570 |
+ ip_rt_put(rt); |
2571 |
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c |
2572 |
+index 523d26f5e22e2..ffa847fc96194 100644 |
2573 |
+--- a/net/ipv4/igmp.c |
2574 |
++++ b/net/ipv4/igmp.c |
2575 |
+@@ -1816,6 +1816,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev) |
2576 |
+ while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) { |
2577 |
+ in_dev->mc_list = i->next_rcu; |
2578 |
+ in_dev->mc_count--; |
2579 |
++ ip_mc_clear_src(i); |
2580 |
+ ip_ma_put(i); |
2581 |
+ } |
2582 |
+ } |
2583 |
+diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c |
2584 |
+index 88212615bf4ce..58719b9635d90 100644 |
2585 |
+--- a/net/ipv4/ipconfig.c |
2586 |
++++ b/net/ipv4/ipconfig.c |
2587 |
+@@ -866,7 +866,7 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d |
2588 |
+ |
2589 |
+ |
2590 |
+ /* |
2591 |
+- * Copy BOOTP-supplied string if not already set. |
2592 |
++ * Copy BOOTP-supplied string |
2593 |
+ */ |
2594 |
+ static int __init ic_bootp_string(char *dest, char *src, int len, int max) |
2595 |
+ { |
2596 |
+@@ -915,12 +915,15 @@ static void __init ic_do_bootp_ext(u8 *ext) |
2597 |
+ } |
2598 |
+ break; |
2599 |
+ case 12: /* Host name */ |
2600 |
+- ic_bootp_string(utsname()->nodename, ext+1, *ext, |
2601 |
+- __NEW_UTS_LEN); |
2602 |
+- ic_host_name_set = 1; |
2603 |
++ if (!ic_host_name_set) { |
2604 |
++ ic_bootp_string(utsname()->nodename, ext+1, *ext, |
2605 |
++ __NEW_UTS_LEN); |
2606 |
++ ic_host_name_set = 1; |
2607 |
++ } |
2608 |
+ break; |
2609 |
+ case 15: /* Domain name (DNS) */ |
2610 |
+- ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain)); |
2611 |
++ if (!ic_domain[0]) |
2612 |
++ ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain)); |
2613 |
+ break; |
2614 |
+ case 17: /* Root path */ |
2615 |
+ if (!root_server_path[0]) |
2616 |
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c |
2617 |
+index c59144502ee88..862744c285482 100644 |
2618 |
+--- a/net/ipv4/ping.c |
2619 |
++++ b/net/ipv4/ping.c |
2620 |
+@@ -968,6 +968,7 @@ bool ping_rcv(struct sk_buff *skb) |
2621 |
+ struct sock *sk; |
2622 |
+ struct net *net = dev_net(skb->dev); |
2623 |
+ struct icmphdr *icmph = icmp_hdr(skb); |
2624 |
++ bool rc = false; |
2625 |
+ |
2626 |
+ /* We assume the packet has already been checked by icmp_rcv */ |
2627 |
+ |
2628 |
+@@ -982,14 +983,15 @@ bool ping_rcv(struct sk_buff *skb) |
2629 |
+ struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC); |
2630 |
+ |
2631 |
+ pr_debug("rcv on socket %p\n", sk); |
2632 |
+- if (skb2) |
2633 |
+- ping_queue_rcv_skb(sk, skb2); |
2634 |
++ if (skb2 && !ping_queue_rcv_skb(sk, skb2)) |
2635 |
++ rc = true; |
2636 |
+ sock_put(sk); |
2637 |
+- return true; |
2638 |
+ } |
2639 |
+- pr_debug("no socket, dropping\n"); |
2640 |
+ |
2641 |
+- return false; |
2642 |
++ if (!rc) |
2643 |
++ pr_debug("no socket, dropping\n"); |
2644 |
++ |
2645 |
++ return rc; |
2646 |
+ } |
2647 |
+ EXPORT_SYMBOL_GPL(ping_rcv); |
2648 |
+ |
2649 |
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c |
2650 |
+index 2fe50f6f876d4..484bd646df5fa 100644 |
2651 |
+--- a/net/ipv4/route.c |
2652 |
++++ b/net/ipv4/route.c |
2653 |
+@@ -70,6 +70,7 @@ |
2654 |
+ #include <linux/types.h> |
2655 |
+ #include <linux/kernel.h> |
2656 |
+ #include <linux/mm.h> |
2657 |
++#include <linux/bootmem.h> |
2658 |
+ #include <linux/string.h> |
2659 |
+ #include <linux/socket.h> |
2660 |
+ #include <linux/sockios.h> |
2661 |
+@@ -470,8 +471,10 @@ static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr) |
2662 |
+ __ipv4_confirm_neigh(dev, *(__force u32 *)pkey); |
2663 |
+ } |
2664 |
+ |
2665 |
+-#define IP_IDENTS_SZ 2048u |
2666 |
+- |
2667 |
++/* Hash tables of size 2048..262144 depending on RAM size. |
2668 |
++ * Each bucket uses 8 bytes. |
2669 |
++ */ |
2670 |
++static u32 ip_idents_mask __read_mostly; |
2671 |
+ static atomic_t *ip_idents __read_mostly; |
2672 |
+ static u32 *ip_tstamps __read_mostly; |
2673 |
+ |
2674 |
+@@ -481,12 +484,16 @@ static u32 *ip_tstamps __read_mostly; |
2675 |
+ */ |
2676 |
+ u32 ip_idents_reserve(u32 hash, int segs) |
2677 |
+ { |
2678 |
+- u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ; |
2679 |
+- atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ; |
2680 |
+- u32 old = READ_ONCE(*p_tstamp); |
2681 |
+- u32 now = (u32)jiffies; |
2682 |
++ u32 bucket, old, now = (u32)jiffies; |
2683 |
++ atomic_t *p_id; |
2684 |
++ u32 *p_tstamp; |
2685 |
+ u32 delta = 0; |
2686 |
+ |
2687 |
++ bucket = hash & ip_idents_mask; |
2688 |
++ p_tstamp = ip_tstamps + bucket; |
2689 |
++ p_id = ip_idents + bucket; |
2690 |
++ old = READ_ONCE(*p_tstamp); |
2691 |
++ |
2692 |
+ if (old != now && cmpxchg(p_tstamp, old, now) == old) |
2693 |
+ delta = prandom_u32_max(now - old); |
2694 |
+ |
2695 |
+@@ -3197,18 +3204,25 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly; |
2696 |
+ |
2697 |
+ int __init ip_rt_init(void) |
2698 |
+ { |
2699 |
++ void *idents_hash; |
2700 |
+ int cpu; |
2701 |
+ |
2702 |
+- ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents), |
2703 |
+- GFP_KERNEL); |
2704 |
+- if (!ip_idents) |
2705 |
+- panic("IP: failed to allocate ip_idents\n"); |
2706 |
++ /* For modern hosts, this will use 2 MB of memory */ |
2707 |
++ idents_hash = alloc_large_system_hash("IP idents", |
2708 |
++ sizeof(*ip_idents) + sizeof(*ip_tstamps), |
2709 |
++ 0, |
2710 |
++ 16, /* one bucket per 64 KB */ |
2711 |
++ HASH_ZERO, |
2712 |
++ NULL, |
2713 |
++ &ip_idents_mask, |
2714 |
++ 2048, |
2715 |
++ 256*1024); |
2716 |
++ |
2717 |
++ ip_idents = idents_hash; |
2718 |
+ |
2719 |
+- prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents)); |
2720 |
++ prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents)); |
2721 |
+ |
2722 |
+- ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL); |
2723 |
+- if (!ip_tstamps) |
2724 |
+- panic("IP: failed to allocate ip_tstamps\n"); |
2725 |
++ ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents); |
2726 |
+ |
2727 |
+ for_each_possible_cpu(cpu) { |
2728 |
+ struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu); |
2729 |
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
2730 |
+index 110af0e7dc7b6..2ff9f774d4463 100644 |
2731 |
+--- a/net/ipv4/udp.c |
2732 |
++++ b/net/ipv4/udp.c |
2733 |
+@@ -2432,6 +2432,9 @@ void udp_destroy_sock(struct sock *sk) |
2734 |
+ { |
2735 |
+ struct udp_sock *up = udp_sk(sk); |
2736 |
+ bool slow = lock_sock_fast(sk); |
2737 |
++ |
2738 |
++ /* protects from races with udp_abort() */ |
2739 |
++ sock_set_flag(sk, SOCK_DEAD); |
2740 |
+ udp_flush_pending_frames(sk); |
2741 |
+ unlock_sock_fast(sk, slow); |
2742 |
+ if (static_branch_unlikely(&udp_encap_needed_key) && up->encap_type) { |
2743 |
+@@ -2673,10 +2676,17 @@ int udp_abort(struct sock *sk, int err) |
2744 |
+ { |
2745 |
+ lock_sock(sk); |
2746 |
+ |
2747 |
++ /* udp{v6}_destroy_sock() sets it under the sk lock, avoid racing |
2748 |
++ * with close() |
2749 |
++ */ |
2750 |
++ if (sock_flag(sk, SOCK_DEAD)) |
2751 |
++ goto out; |
2752 |
++ |
2753 |
+ sk->sk_err = err; |
2754 |
+ sk->sk_error_report(sk); |
2755 |
+ __udp_disconnect(sk, 0); |
2756 |
+ |
2757 |
++out: |
2758 |
+ release_sock(sk); |
2759 |
+ |
2760 |
+ return 0; |
2761 |
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c |
2762 |
+index 6799ad462be30..c4a76c6af205d 100644 |
2763 |
+--- a/net/ipv6/udp.c |
2764 |
++++ b/net/ipv6/udp.c |
2765 |
+@@ -1476,6 +1476,9 @@ void udpv6_destroy_sock(struct sock *sk) |
2766 |
+ { |
2767 |
+ struct udp_sock *up = udp_sk(sk); |
2768 |
+ lock_sock(sk); |
2769 |
++ |
2770 |
++ /* protects from races with udp_abort() */ |
2771 |
++ sock_set_flag(sk, SOCK_DEAD); |
2772 |
+ udp_v6_flush_pending_frames(sk); |
2773 |
+ release_sock(sk); |
2774 |
+ |
2775 |
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h |
2776 |
+index 6c9d9c94983ba..dea48696f994d 100644 |
2777 |
+--- a/net/mac80211/ieee80211_i.h |
2778 |
++++ b/net/mac80211/ieee80211_i.h |
2779 |
+@@ -1398,7 +1398,7 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata) |
2780 |
+ rcu_read_lock(); |
2781 |
+ chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); |
2782 |
+ |
2783 |
+- if (WARN_ON_ONCE(!chanctx_conf)) { |
2784 |
++ if (!chanctx_conf) { |
2785 |
+ rcu_read_unlock(); |
2786 |
+ return NULL; |
2787 |
+ } |
2788 |
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c |
2789 |
+index 2ba19decb1261..012697efafc35 100644 |
2790 |
+--- a/net/mac80211/rx.c |
2791 |
++++ b/net/mac80211/rx.c |
2792 |
+@@ -2124,17 +2124,15 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) |
2793 |
+ sc = le16_to_cpu(hdr->seq_ctrl); |
2794 |
+ frag = sc & IEEE80211_SCTL_FRAG; |
2795 |
+ |
2796 |
+- if (is_multicast_ether_addr(hdr->addr1)) { |
2797 |
+- I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount); |
2798 |
+- goto out_no_led; |
2799 |
+- } |
2800 |
+- |
2801 |
+ if (rx->sta) |
2802 |
+ cache = &rx->sta->frags; |
2803 |
+ |
2804 |
+ if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) |
2805 |
+ goto out; |
2806 |
+ |
2807 |
++ if (is_multicast_ether_addr(hdr->addr1)) |
2808 |
++ return RX_DROP_MONITOR; |
2809 |
++ |
2810 |
+ I802_DEBUG_INC(rx->local->rx_handlers_fragments); |
2811 |
+ |
2812 |
+ if (skb_linearize(rx->skb)) |
2813 |
+@@ -2260,7 +2258,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) |
2814 |
+ |
2815 |
+ out: |
2816 |
+ ieee80211_led_rx(rx->local); |
2817 |
+- out_no_led: |
2818 |
+ if (rx->sta) |
2819 |
+ rx->sta->rx_stats.packets++; |
2820 |
+ return RX_CONTINUE; |
2821 |
+diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c |
2822 |
+index 353a2aa80c3cc..04b07b63c5408 100644 |
2823 |
+--- a/net/netfilter/nf_synproxy_core.c |
2824 |
++++ b/net/netfilter/nf_synproxy_core.c |
2825 |
+@@ -34,6 +34,9 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff, |
2826 |
+ int length = (th->doff * 4) - sizeof(*th); |
2827 |
+ u8 buf[40], *ptr; |
2828 |
+ |
2829 |
++ if (unlikely(length < 0)) |
2830 |
++ return false; |
2831 |
++ |
2832 |
+ ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf); |
2833 |
+ if (ptr == NULL) |
2834 |
+ return false; |
2835 |
+@@ -50,6 +53,8 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff, |
2836 |
+ length--; |
2837 |
+ continue; |
2838 |
+ default: |
2839 |
++ if (length < 2) |
2840 |
++ return true; |
2841 |
+ opsize = *ptr++; |
2842 |
+ if (opsize < 2) |
2843 |
+ return true; |
2844 |
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
2845 |
+index 16b745d254fea..8d9005019ef78 100644 |
2846 |
+--- a/net/packet/af_packet.c |
2847 |
++++ b/net/packet/af_packet.c |
2848 |
+@@ -2656,7 +2656,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) |
2849 |
+ } |
2850 |
+ if (likely(saddr == NULL)) { |
2851 |
+ dev = packet_cached_dev_get(po); |
2852 |
+- proto = po->num; |
2853 |
++ proto = READ_ONCE(po->num); |
2854 |
+ } else { |
2855 |
+ err = -EINVAL; |
2856 |
+ if (msg->msg_namelen < sizeof(struct sockaddr_ll)) |
2857 |
+@@ -2869,7 +2869,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) |
2858 |
+ |
2859 |
+ if (likely(saddr == NULL)) { |
2860 |
+ dev = packet_cached_dev_get(po); |
2861 |
+- proto = po->num; |
2862 |
++ proto = READ_ONCE(po->num); |
2863 |
+ } else { |
2864 |
+ err = -EINVAL; |
2865 |
+ if (msg->msg_namelen < sizeof(struct sockaddr_ll)) |
2866 |
+@@ -3141,7 +3141,7 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, |
2867 |
+ /* prevents packet_notifier() from calling |
2868 |
+ * register_prot_hook() |
2869 |
+ */ |
2870 |
+- po->num = 0; |
2871 |
++ WRITE_ONCE(po->num, 0); |
2872 |
+ __unregister_prot_hook(sk, true); |
2873 |
+ rcu_read_lock(); |
2874 |
+ dev_curr = po->prot_hook.dev; |
2875 |
+@@ -3151,17 +3151,17 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, |
2876 |
+ } |
2877 |
+ |
2878 |
+ BUG_ON(po->running); |
2879 |
+- po->num = proto; |
2880 |
++ WRITE_ONCE(po->num, proto); |
2881 |
+ po->prot_hook.type = proto; |
2882 |
+ |
2883 |
+ if (unlikely(unlisted)) { |
2884 |
+ dev_put(dev); |
2885 |
+ po->prot_hook.dev = NULL; |
2886 |
+- po->ifindex = -1; |
2887 |
++ WRITE_ONCE(po->ifindex, -1); |
2888 |
+ packet_cached_dev_reset(po); |
2889 |
+ } else { |
2890 |
+ po->prot_hook.dev = dev; |
2891 |
+- po->ifindex = dev ? dev->ifindex : 0; |
2892 |
++ WRITE_ONCE(po->ifindex, dev ? dev->ifindex : 0); |
2893 |
+ packet_cached_dev_assign(po, dev); |
2894 |
+ } |
2895 |
+ } |
2896 |
+@@ -3476,7 +3476,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, |
2897 |
+ uaddr->sa_family = AF_PACKET; |
2898 |
+ memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data)); |
2899 |
+ rcu_read_lock(); |
2900 |
+- dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); |
2901 |
++ dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex)); |
2902 |
+ if (dev) |
2903 |
+ strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data)); |
2904 |
+ rcu_read_unlock(); |
2905 |
+@@ -3491,16 +3491,18 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr, |
2906 |
+ struct sock *sk = sock->sk; |
2907 |
+ struct packet_sock *po = pkt_sk(sk); |
2908 |
+ DECLARE_SOCKADDR(struct sockaddr_ll *, sll, uaddr); |
2909 |
++ int ifindex; |
2910 |
+ |
2911 |
+ if (peer) |
2912 |
+ return -EOPNOTSUPP; |
2913 |
+ |
2914 |
++ ifindex = READ_ONCE(po->ifindex); |
2915 |
+ sll->sll_family = AF_PACKET; |
2916 |
+- sll->sll_ifindex = po->ifindex; |
2917 |
+- sll->sll_protocol = po->num; |
2918 |
++ sll->sll_ifindex = ifindex; |
2919 |
++ sll->sll_protocol = READ_ONCE(po->num); |
2920 |
+ sll->sll_pkttype = 0; |
2921 |
+ rcu_read_lock(); |
2922 |
+- dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex); |
2923 |
++ dev = dev_get_by_index_rcu(sock_net(sk), ifindex); |
2924 |
+ if (dev) { |
2925 |
+ sll->sll_hatype = dev->type; |
2926 |
+ sll->sll_halen = dev->addr_len; |
2927 |
+@@ -4079,7 +4081,7 @@ static int packet_notifier(struct notifier_block *this, |
2928 |
+ } |
2929 |
+ if (msg == NETDEV_UNREGISTER) { |
2930 |
+ packet_cached_dev_reset(po); |
2931 |
+- po->ifindex = -1; |
2932 |
++ WRITE_ONCE(po->ifindex, -1); |
2933 |
+ if (po->prot_hook.dev) |
2934 |
+ dev_put(po->prot_hook.dev); |
2935 |
+ po->prot_hook.dev = NULL; |
2936 |
+@@ -4391,7 +4393,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, |
2937 |
+ was_running = po->running; |
2938 |
+ num = po->num; |
2939 |
+ if (was_running) { |
2940 |
+- po->num = 0; |
2941 |
++ WRITE_ONCE(po->num, 0); |
2942 |
+ __unregister_prot_hook(sk, false); |
2943 |
+ } |
2944 |
+ spin_unlock(&po->bind_lock); |
2945 |
+@@ -4426,7 +4428,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, |
2946 |
+ |
2947 |
+ spin_lock(&po->bind_lock); |
2948 |
+ if (was_running) { |
2949 |
+- po->num = num; |
2950 |
++ WRITE_ONCE(po->num, num); |
2951 |
+ register_prot_hook(sk); |
2952 |
+ } |
2953 |
+ spin_unlock(&po->bind_lock); |
2954 |
+@@ -4597,8 +4599,8 @@ static int packet_seq_show(struct seq_file *seq, void *v) |
2955 |
+ s, |
2956 |
+ refcount_read(&s->sk_refcnt), |
2957 |
+ s->sk_type, |
2958 |
+- ntohs(po->num), |
2959 |
+- po->ifindex, |
2960 |
++ ntohs(READ_ONCE(po->num)), |
2961 |
++ READ_ONCE(po->ifindex), |
2962 |
+ po->running, |
2963 |
+ atomic_read(&s->sk_rmem_alloc), |
2964 |
+ from_kuid_munged(seq_user_ns(seq), sock_i_uid(s)), |
2965 |
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c |
2966 |
+index 43f63d0606ec1..1e2772913957d 100644 |
2967 |
+--- a/net/qrtr/qrtr.c |
2968 |
++++ b/net/qrtr/qrtr.c |
2969 |
+@@ -264,7 +264,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) |
2970 |
+ const struct qrtr_hdr_v2 *v2; |
2971 |
+ struct sk_buff *skb; |
2972 |
+ struct qrtr_cb *cb; |
2973 |
+- unsigned int size; |
2974 |
++ size_t size; |
2975 |
+ unsigned int ver; |
2976 |
+ size_t hdrlen; |
2977 |
+ |
2978 |
+diff --git a/net/rds/recv.c b/net/rds/recv.c |
2979 |
+index 3ca278988b529..ccf0bf283002c 100644 |
2980 |
+--- a/net/rds/recv.c |
2981 |
++++ b/net/rds/recv.c |
2982 |
+@@ -705,7 +705,7 @@ int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, |
2983 |
+ |
2984 |
+ if (rds_cmsg_recv(inc, msg, rs)) { |
2985 |
+ ret = -EFAULT; |
2986 |
+- goto out; |
2987 |
++ break; |
2988 |
+ } |
2989 |
+ rds_recvmsg_zcookie(rs, msg); |
2990 |
+ |
2991 |
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c |
2992 |
+index 32712e7dcbdc2..2025f0f559deb 100644 |
2993 |
+--- a/net/sched/sch_cake.c |
2994 |
++++ b/net/sched/sch_cake.c |
2995 |
+@@ -900,7 +900,7 @@ static struct tcphdr *cake_get_tcphdr(const struct sk_buff *skb, |
2996 |
+ } |
2997 |
+ |
2998 |
+ tcph = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); |
2999 |
+- if (!tcph) |
3000 |
++ if (!tcph || tcph->doff < 5) |
3001 |
+ return NULL; |
3002 |
+ |
3003 |
+ return skb_header_pointer(skb, offset, |
3004 |
+@@ -924,6 +924,8 @@ static const void *cake_get_tcpopt(const struct tcphdr *tcph, |
3005 |
+ length--; |
3006 |
+ continue; |
3007 |
+ } |
3008 |
++ if (length < 2) |
3009 |
++ break; |
3010 |
+ opsize = *ptr++; |
3011 |
+ if (opsize < 2 || opsize > length) |
3012 |
+ break; |
3013 |
+@@ -1061,6 +1063,8 @@ static bool cake_tcph_may_drop(const struct tcphdr *tcph, |
3014 |
+ length--; |
3015 |
+ continue; |
3016 |
+ } |
3017 |
++ if (length < 2) |
3018 |
++ break; |
3019 |
+ opsize = *ptr++; |
3020 |
+ if (opsize < 2 || opsize > length) |
3021 |
+ break; |
3022 |
+diff --git a/net/socket.c b/net/socket.c |
3023 |
+index 29169045dcfe5..f14bca00ff010 100644 |
3024 |
+--- a/net/socket.c |
3025 |
++++ b/net/socket.c |
3026 |
+@@ -384,6 +384,18 @@ static struct file_system_type sock_fs_type = { |
3027 |
+ * but we take care of internal coherence yet. |
3028 |
+ */ |
3029 |
+ |
3030 |
++/** |
3031 |
++ * sock_alloc_file - Bind a &socket to a &file |
3032 |
++ * @sock: socket |
3033 |
++ * @flags: file status flags |
3034 |
++ * @dname: protocol name |
3035 |
++ * |
3036 |
++ * Returns the &file bound with @sock, implicitly storing it |
3037 |
++ * in sock->file. If dname is %NULL, sets to "". |
3038 |
++ * On failure the return is a ERR pointer (see linux/err.h). |
3039 |
++ * This function uses GFP_KERNEL internally. |
3040 |
++ */ |
3041 |
++ |
3042 |
+ struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname) |
3043 |
+ { |
3044 |
+ struct file *file; |
3045 |
+@@ -424,6 +436,14 @@ static int sock_map_fd(struct socket *sock, int flags) |
3046 |
+ return PTR_ERR(newfile); |
3047 |
+ } |
3048 |
+ |
3049 |
++/** |
3050 |
++ * sock_from_file - Return the &socket bounded to @file. |
3051 |
++ * @file: file |
3052 |
++ * @err: pointer to an error code return |
3053 |
++ * |
3054 |
++ * On failure returns %NULL and assigns -ENOTSOCK to @err. |
3055 |
++ */ |
3056 |
++ |
3057 |
+ struct socket *sock_from_file(struct file *file, int *err) |
3058 |
+ { |
3059 |
+ if (file->f_op == &socket_file_ops) |
3060 |
+@@ -532,11 +552,11 @@ static const struct inode_operations sockfs_inode_ops = { |
3061 |
+ }; |
3062 |
+ |
3063 |
+ /** |
3064 |
+- * sock_alloc - allocate a socket |
3065 |
++ * sock_alloc - allocate a socket |
3066 |
+ * |
3067 |
+ * Allocate a new inode and socket object. The two are bound together |
3068 |
+ * and initialised. The socket is then returned. If we are out of inodes |
3069 |
+- * NULL is returned. |
3070 |
++ * NULL is returned. This functions uses GFP_KERNEL internally. |
3071 |
+ */ |
3072 |
+ |
3073 |
+ struct socket *sock_alloc(void) |
3074 |
+@@ -561,7 +581,7 @@ struct socket *sock_alloc(void) |
3075 |
+ EXPORT_SYMBOL(sock_alloc); |
3076 |
+ |
3077 |
+ /** |
3078 |
+- * sock_release - close a socket |
3079 |
++ * sock_release - close a socket |
3080 |
+ * @sock: socket to close |
3081 |
+ * |
3082 |
+ * The socket is released from the protocol stack if it has a release |
3083 |
+@@ -617,6 +637,15 @@ void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags) |
3084 |
+ } |
3085 |
+ EXPORT_SYMBOL(__sock_tx_timestamp); |
3086 |
+ |
3087 |
++/** |
3088 |
++ * sock_sendmsg - send a message through @sock |
3089 |
++ * @sock: socket |
3090 |
++ * @msg: message to send |
3091 |
++ * |
3092 |
++ * Sends @msg through @sock, passing through LSM. |
3093 |
++ * Returns the number of bytes sent, or an error code. |
3094 |
++ */ |
3095 |
++ |
3096 |
+ static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg) |
3097 |
+ { |
3098 |
+ int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg)); |
3099 |
+@@ -633,6 +662,18 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg) |
3100 |
+ } |
3101 |
+ EXPORT_SYMBOL(sock_sendmsg); |
3102 |
+ |
3103 |
++/** |
3104 |
++ * kernel_sendmsg - send a message through @sock (kernel-space) |
3105 |
++ * @sock: socket |
3106 |
++ * @msg: message header |
3107 |
++ * @vec: kernel vec |
3108 |
++ * @num: vec array length |
3109 |
++ * @size: total message data size |
3110 |
++ * |
3111 |
++ * Builds the message data with @vec and sends it through @sock. |
3112 |
++ * Returns the number of bytes sent, or an error code. |
3113 |
++ */ |
3114 |
++ |
3115 |
+ int kernel_sendmsg(struct socket *sock, struct msghdr *msg, |
3116 |
+ struct kvec *vec, size_t num, size_t size) |
3117 |
+ { |
3118 |
+@@ -641,6 +682,19 @@ int kernel_sendmsg(struct socket *sock, struct msghdr *msg, |
3119 |
+ } |
3120 |
+ EXPORT_SYMBOL(kernel_sendmsg); |
3121 |
+ |
3122 |
++/** |
3123 |
++ * kernel_sendmsg_locked - send a message through @sock (kernel-space) |
3124 |
++ * @sk: sock |
3125 |
++ * @msg: message header |
3126 |
++ * @vec: output s/g array |
3127 |
++ * @num: output s/g array length |
3128 |
++ * @size: total message data size |
3129 |
++ * |
3130 |
++ * Builds the message data with @vec and sends it through @sock. |
3131 |
++ * Returns the number of bytes sent, or an error code. |
3132 |
++ * Caller must hold @sk. |
3133 |
++ */ |
3134 |
++ |
3135 |
+ int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg, |
3136 |
+ struct kvec *vec, size_t num, size_t size) |
3137 |
+ { |
3138 |
+@@ -789,6 +843,16 @@ void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk, |
3139 |
+ } |
3140 |
+ EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops); |
3141 |
+ |
3142 |
++/** |
3143 |
++ * sock_recvmsg - receive a message from @sock |
3144 |
++ * @sock: socket |
3145 |
++ * @msg: message to receive |
3146 |
++ * @flags: message flags |
3147 |
++ * |
3148 |
++ * Receives @msg from @sock, passing through LSM. Returns the total number |
3149 |
++ * of bytes received, or an error. |
3150 |
++ */ |
3151 |
++ |
3152 |
+ static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg, |
3153 |
+ int flags) |
3154 |
+ { |
3155 |
+@@ -804,20 +868,21 @@ int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags) |
3156 |
+ EXPORT_SYMBOL(sock_recvmsg); |
3157 |
+ |
3158 |
+ /** |
3159 |
+- * kernel_recvmsg - Receive a message from a socket (kernel space) |
3160 |
+- * @sock: The socket to receive the message from |
3161 |
+- * @msg: Received message |
3162 |
+- * @vec: Input s/g array for message data |
3163 |
+- * @num: Size of input s/g array |
3164 |
+- * @size: Number of bytes to read |
3165 |
+- * @flags: Message flags (MSG_DONTWAIT, etc...) |
3166 |
++ * kernel_recvmsg - Receive a message from a socket (kernel space) |
3167 |
++ * @sock: The socket to receive the message from |
3168 |
++ * @msg: Received message |
3169 |
++ * @vec: Input s/g array for message data |
3170 |
++ * @num: Size of input s/g array |
3171 |
++ * @size: Number of bytes to read |
3172 |
++ * @flags: Message flags (MSG_DONTWAIT, etc...) |
3173 |
+ * |
3174 |
+- * On return the msg structure contains the scatter/gather array passed in the |
3175 |
+- * vec argument. The array is modified so that it consists of the unfilled |
3176 |
+- * portion of the original array. |
3177 |
++ * On return the msg structure contains the scatter/gather array passed in the |
3178 |
++ * vec argument. The array is modified so that it consists of the unfilled |
3179 |
++ * portion of the original array. |
3180 |
+ * |
3181 |
+- * The returned value is the total number of bytes received, or an error. |
3182 |
++ * The returned value is the total number of bytes received, or an error. |
3183 |
+ */ |
3184 |
++ |
3185 |
+ int kernel_recvmsg(struct socket *sock, struct msghdr *msg, |
3186 |
+ struct kvec *vec, size_t num, size_t size, int flags) |
3187 |
+ { |
3188 |
+@@ -983,12 +1048,6 @@ static long sock_do_ioctl(struct net *net, struct socket *sock, |
3189 |
+ * what to do with it - that's up to the protocol still. |
3190 |
+ */ |
3191 |
+ |
3192 |
+-struct ns_common *get_net_ns(struct ns_common *ns) |
3193 |
+-{ |
3194 |
+- return &get_net(container_of(ns, struct net, ns))->ns; |
3195 |
+-} |
3196 |
+-EXPORT_SYMBOL_GPL(get_net_ns); |
3197 |
+- |
3198 |
+ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg) |
3199 |
+ { |
3200 |
+ struct socket *sock; |
3201 |
+@@ -1077,6 +1136,19 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg) |
3202 |
+ return err; |
3203 |
+ } |
3204 |
+ |
3205 |
++/** |
3206 |
++ * sock_create_lite - creates a socket |
3207 |
++ * @family: protocol family (AF_INET, ...) |
3208 |
++ * @type: communication type (SOCK_STREAM, ...) |
3209 |
++ * @protocol: protocol (0, ...) |
3210 |
++ * @res: new socket |
3211 |
++ * |
3212 |
++ * Creates a new socket and assigns it to @res, passing through LSM. |
3213 |
++ * The new socket initialization is not complete, see kernel_accept(). |
3214 |
++ * Returns 0 or an error. On failure @res is set to %NULL. |
3215 |
++ * This function internally uses GFP_KERNEL. |
3216 |
++ */ |
3217 |
++ |
3218 |
+ int sock_create_lite(int family, int type, int protocol, struct socket **res) |
3219 |
+ { |
3220 |
+ int err; |
3221 |
+@@ -1202,6 +1274,21 @@ call_kill: |
3222 |
+ } |
3223 |
+ EXPORT_SYMBOL(sock_wake_async); |
3224 |
+ |
3225 |
++/** |
3226 |
++ * __sock_create - creates a socket |
3227 |
++ * @net: net namespace |
3228 |
++ * @family: protocol family (AF_INET, ...) |
3229 |
++ * @type: communication type (SOCK_STREAM, ...) |
3230 |
++ * @protocol: protocol (0, ...) |
3231 |
++ * @res: new socket |
3232 |
++ * @kern: boolean for kernel space sockets |
3233 |
++ * |
3234 |
++ * Creates a new socket and assigns it to @res, passing through LSM. |
3235 |
++ * Returns 0 or an error. On failure @res is set to %NULL. @kern must |
3236 |
++ * be set to true if the socket resides in kernel space. |
3237 |
++ * This function internally uses GFP_KERNEL. |
3238 |
++ */ |
3239 |
++ |
3240 |
+ int __sock_create(struct net *net, int family, int type, int protocol, |
3241 |
+ struct socket **res, int kern) |
3242 |
+ { |
3243 |
+@@ -1311,12 +1398,35 @@ out_release: |
3244 |
+ } |
3245 |
+ EXPORT_SYMBOL(__sock_create); |
3246 |
+ |
3247 |
++/** |
3248 |
++ * sock_create - creates a socket |
3249 |
++ * @family: protocol family (AF_INET, ...) |
3250 |
++ * @type: communication type (SOCK_STREAM, ...) |
3251 |
++ * @protocol: protocol (0, ...) |
3252 |
++ * @res: new socket |
3253 |
++ * |
3254 |
++ * A wrapper around __sock_create(). |
3255 |
++ * Returns 0 or an error. This function internally uses GFP_KERNEL. |
3256 |
++ */ |
3257 |
++ |
3258 |
+ int sock_create(int family, int type, int protocol, struct socket **res) |
3259 |
+ { |
3260 |
+ return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0); |
3261 |
+ } |
3262 |
+ EXPORT_SYMBOL(sock_create); |
3263 |
+ |
3264 |
++/** |
3265 |
++ * sock_create_kern - creates a socket (kernel space) |
3266 |
++ * @net: net namespace |
3267 |
++ * @family: protocol family (AF_INET, ...) |
3268 |
++ * @type: communication type (SOCK_STREAM, ...) |
3269 |
++ * @protocol: protocol (0, ...) |
3270 |
++ * @res: new socket |
3271 |
++ * |
3272 |
++ * A wrapper around __sock_create(). |
3273 |
++ * Returns 0 or an error. This function internally uses GFP_KERNEL. |
3274 |
++ */ |
3275 |
++ |
3276 |
+ int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res) |
3277 |
+ { |
3278 |
+ return __sock_create(net, family, type, protocol, res, 1); |
3279 |
+@@ -3273,18 +3383,46 @@ static long compat_sock_ioctl(struct file *file, unsigned int cmd, |
3280 |
+ } |
3281 |
+ #endif |
3282 |
+ |
3283 |
++/** |
3284 |
++ * kernel_bind - bind an address to a socket (kernel space) |
3285 |
++ * @sock: socket |
3286 |
++ * @addr: address |
3287 |
++ * @addrlen: length of address |
3288 |
++ * |
3289 |
++ * Returns 0 or an error. |
3290 |
++ */ |
3291 |
++ |
3292 |
+ int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen) |
3293 |
+ { |
3294 |
+ return sock->ops->bind(sock, addr, addrlen); |
3295 |
+ } |
3296 |
+ EXPORT_SYMBOL(kernel_bind); |
3297 |
+ |
3298 |
++/** |
3299 |
++ * kernel_listen - move socket to listening state (kernel space) |
3300 |
++ * @sock: socket |
3301 |
++ * @backlog: pending connections queue size |
3302 |
++ * |
3303 |
++ * Returns 0 or an error. |
3304 |
++ */ |
3305 |
++ |
3306 |
+ int kernel_listen(struct socket *sock, int backlog) |
3307 |
+ { |
3308 |
+ return sock->ops->listen(sock, backlog); |
3309 |
+ } |
3310 |
+ EXPORT_SYMBOL(kernel_listen); |
3311 |
+ |
3312 |
++/** |
3313 |
++ * kernel_accept - accept a connection (kernel space) |
3314 |
++ * @sock: listening socket |
3315 |
++ * @newsock: new connected socket |
3316 |
++ * @flags: flags |
3317 |
++ * |
3318 |
++ * @flags must be SOCK_CLOEXEC, SOCK_NONBLOCK or 0. |
3319 |
++ * If it fails, @newsock is guaranteed to be %NULL. |
3320 |
++ * Returns 0 or an error. |
3321 |
++ */ |
3322 |
++ |
3323 |
+ int kernel_accept(struct socket *sock, struct socket **newsock, int flags) |
3324 |
+ { |
3325 |
+ struct sock *sk = sock->sk; |
3326 |
+@@ -3310,6 +3448,19 @@ done: |
3327 |
+ } |
3328 |
+ EXPORT_SYMBOL(kernel_accept); |
3329 |
+ |
3330 |
++/** |
3331 |
++ * kernel_connect - connect a socket (kernel space) |
3332 |
++ * @sock: socket |
3333 |
++ * @addr: address |
3334 |
++ * @addrlen: address length |
3335 |
++ * @flags: flags (O_NONBLOCK, ...) |
3336 |
++ * |
3337 |
++ * For datagram sockets, @addr is the addres to which datagrams are sent |
3338 |
++ * by default, and the only address from which datagrams are received. |
3339 |
++ * For stream sockets, attempts to connect to @addr. |
3340 |
++ * Returns 0 or an error code. |
3341 |
++ */ |
3342 |
++ |
3343 |
+ int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen, |
3344 |
+ int flags) |
3345 |
+ { |
3346 |
+@@ -3317,18 +3468,48 @@ int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen, |
3347 |
+ } |
3348 |
+ EXPORT_SYMBOL(kernel_connect); |
3349 |
+ |
3350 |
++/** |
3351 |
++ * kernel_getsockname - get the address which the socket is bound (kernel space) |
3352 |
++ * @sock: socket |
3353 |
++ * @addr: address holder |
3354 |
++ * |
3355 |
++ * Fills the @addr pointer with the address which the socket is bound. |
3356 |
++ * Returns 0 or an error code. |
3357 |
++ */ |
3358 |
++ |
3359 |
+ int kernel_getsockname(struct socket *sock, struct sockaddr *addr) |
3360 |
+ { |
3361 |
+ return sock->ops->getname(sock, addr, 0); |
3362 |
+ } |
3363 |
+ EXPORT_SYMBOL(kernel_getsockname); |
3364 |
+ |
3365 |
++/** |
3366 |
++ * kernel_peername - get the address which the socket is connected (kernel space) |
3367 |
++ * @sock: socket |
3368 |
++ * @addr: address holder |
3369 |
++ * |
3370 |
++ * Fills the @addr pointer with the address which the socket is connected. |
3371 |
++ * Returns 0 or an error code. |
3372 |
++ */ |
3373 |
++ |
3374 |
+ int kernel_getpeername(struct socket *sock, struct sockaddr *addr) |
3375 |
+ { |
3376 |
+ return sock->ops->getname(sock, addr, 1); |
3377 |
+ } |
3378 |
+ EXPORT_SYMBOL(kernel_getpeername); |
3379 |
+ |
3380 |
++/** |
3381 |
++ * kernel_getsockopt - get a socket option (kernel space) |
3382 |
++ * @sock: socket |
3383 |
++ * @level: API level (SOL_SOCKET, ...) |
3384 |
++ * @optname: option tag |
3385 |
++ * @optval: option value |
3386 |
++ * @optlen: option length |
3387 |
++ * |
3388 |
++ * Assigns the option length to @optlen. |
3389 |
++ * Returns 0 or an error. |
3390 |
++ */ |
3391 |
++ |
3392 |
+ int kernel_getsockopt(struct socket *sock, int level, int optname, |
3393 |
+ char *optval, int *optlen) |
3394 |
+ { |
3395 |
+@@ -3351,6 +3532,17 @@ int kernel_getsockopt(struct socket *sock, int level, int optname, |
3396 |
+ } |
3397 |
+ EXPORT_SYMBOL(kernel_getsockopt); |
3398 |
+ |
3399 |
++/** |
3400 |
++ * kernel_setsockopt - set a socket option (kernel space) |
3401 |
++ * @sock: socket |
3402 |
++ * @level: API level (SOL_SOCKET, ...) |
3403 |
++ * @optname: option tag |
3404 |
++ * @optval: option value |
3405 |
++ * @optlen: option length |
3406 |
++ * |
3407 |
++ * Returns 0 or an error. |
3408 |
++ */ |
3409 |
++ |
3410 |
+ int kernel_setsockopt(struct socket *sock, int level, int optname, |
3411 |
+ char *optval, unsigned int optlen) |
3412 |
+ { |
3413 |
+@@ -3371,6 +3563,17 @@ int kernel_setsockopt(struct socket *sock, int level, int optname, |
3414 |
+ } |
3415 |
+ EXPORT_SYMBOL(kernel_setsockopt); |
3416 |
+ |
3417 |
++/** |
3418 |
++ * kernel_sendpage - send a &page through a socket (kernel space) |
3419 |
++ * @sock: socket |
3420 |
++ * @page: page |
3421 |
++ * @offset: page offset |
3422 |
++ * @size: total size in bytes |
3423 |
++ * @flags: flags (MSG_DONTWAIT, ...) |
3424 |
++ * |
3425 |
++ * Returns the total amount sent in bytes or an error. |
3426 |
++ */ |
3427 |
++ |
3428 |
+ int kernel_sendpage(struct socket *sock, struct page *page, int offset, |
3429 |
+ size_t size, int flags) |
3430 |
+ { |
3431 |
+@@ -3381,6 +3584,18 @@ int kernel_sendpage(struct socket *sock, struct page *page, int offset, |
3432 |
+ } |
3433 |
+ EXPORT_SYMBOL(kernel_sendpage); |
3434 |
+ |
3435 |
++/** |
3436 |
++ * kernel_sendpage_locked - send a &page through the locked sock (kernel space) |
3437 |
++ * @sk: sock |
3438 |
++ * @page: page |
3439 |
++ * @offset: page offset |
3440 |
++ * @size: total size in bytes |
3441 |
++ * @flags: flags (MSG_DONTWAIT, ...) |
3442 |
++ * |
3443 |
++ * Returns the total amount sent in bytes or an error. |
3444 |
++ * Caller must hold @sk. |
3445 |
++ */ |
3446 |
++ |
3447 |
+ int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset, |
3448 |
+ size_t size, int flags) |
3449 |
+ { |
3450 |
+@@ -3394,17 +3609,30 @@ int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset, |
3451 |
+ } |
3452 |
+ EXPORT_SYMBOL(kernel_sendpage_locked); |
3453 |
+ |
3454 |
++/** |
3455 |
++ * kernel_shutdown - shut down part of a full-duplex connection (kernel space) |
3456 |
++ * @sock: socket |
3457 |
++ * @how: connection part |
3458 |
++ * |
3459 |
++ * Returns 0 or an error. |
3460 |
++ */ |
3461 |
++ |
3462 |
+ int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how) |
3463 |
+ { |
3464 |
+ return sock->ops->shutdown(sock, how); |
3465 |
+ } |
3466 |
+ EXPORT_SYMBOL(kernel_sock_shutdown); |
3467 |
+ |
3468 |
+-/* This routine returns the IP overhead imposed by a socket i.e. |
3469 |
+- * the length of the underlying IP header, depending on whether |
3470 |
+- * this is an IPv4 or IPv6 socket and the length from IP options turned |
3471 |
+- * on at the socket. Assumes that the caller has a lock on the socket. |
3472 |
++/** |
3473 |
++ * kernel_sock_ip_overhead - returns the IP overhead imposed by a socket |
3474 |
++ * @sk: socket |
3475 |
++ * |
3476 |
++ * This routine returns the IP overhead imposed by a socket i.e. |
3477 |
++ * the length of the underlying IP header, depending on whether |
3478 |
++ * this is an IPv4 or IPv6 socket and the length from IP options turned |
3479 |
++ * on at the socket. Assumes that the caller has a lock on the socket. |
3480 |
+ */ |
3481 |
++ |
3482 |
+ u32 kernel_sock_ip_overhead(struct sock *sk) |
3483 |
+ { |
3484 |
+ struct inet_sock *inet; |
3485 |
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c |
3486 |
+index 2020306468af4..53fe5ada5a83a 100644 |
3487 |
+--- a/net/unix/af_unix.c |
3488 |
++++ b/net/unix/af_unix.c |
3489 |
+@@ -540,12 +540,14 @@ static void unix_release_sock(struct sock *sk, int embrion) |
3490 |
+ u->path.mnt = NULL; |
3491 |
+ state = sk->sk_state; |
3492 |
+ sk->sk_state = TCP_CLOSE; |
3493 |
++ |
3494 |
++ skpair = unix_peer(sk); |
3495 |
++ unix_peer(sk) = NULL; |
3496 |
++ |
3497 |
+ unix_state_unlock(sk); |
3498 |
+ |
3499 |
+ wake_up_interruptible_all(&u->peer_wait); |
3500 |
+ |
3501 |
+- skpair = unix_peer(sk); |
3502 |
+- |
3503 |
+ if (skpair != NULL) { |
3504 |
+ if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) { |
3505 |
+ unix_state_lock(skpair); |
3506 |
+@@ -560,7 +562,6 @@ static void unix_release_sock(struct sock *sk, int embrion) |
3507 |
+ |
3508 |
+ unix_dgram_peer_wake_disconnect(sk, skpair); |
3509 |
+ sock_put(skpair); /* It may now die */ |
3510 |
+- unix_peer(sk) = NULL; |
3511 |
+ } |
3512 |
+ |
3513 |
+ /* Try to flush out this socket. Throw out buffers at least */ |
3514 |
+diff --git a/net/wireless/Makefile b/net/wireless/Makefile |
3515 |
+index 8158b375d1700..4500ad5f2a616 100644 |
3516 |
+--- a/net/wireless/Makefile |
3517 |
++++ b/net/wireless/Makefile |
3518 |
+@@ -27,7 +27,7 @@ $(obj)/shipped-certs.c: $(wildcard $(srctree)/$(src)/certs/*.hex) |
3519 |
+ @$(kecho) " GEN $@" |
3520 |
+ @(echo '#include "reg.h"'; \ |
3521 |
+ echo 'const u8 shipped_regdb_certs[] = {'; \ |
3522 |
+- cat $^ ; \ |
3523 |
++ echo | cat - $^ ; \ |
3524 |
+ echo '};'; \ |
3525 |
+ echo 'unsigned int shipped_regdb_certs_len = sizeof(shipped_regdb_certs);'; \ |
3526 |
+ ) > $@ |
3527 |
+diff --git a/net/wireless/util.c b/net/wireless/util.c |
3528 |
+index c4536468dfbea..e7be500b64525 100644 |
3529 |
+--- a/net/wireless/util.c |
3530 |
++++ b/net/wireless/util.c |
3531 |
+@@ -965,6 +965,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, |
3532 |
+ case NL80211_IFTYPE_MESH_POINT: |
3533 |
+ /* mesh should be handled? */ |
3534 |
+ break; |
3535 |
++ case NL80211_IFTYPE_OCB: |
3536 |
++ cfg80211_leave_ocb(rdev, dev); |
3537 |
++ break; |
3538 |
+ default: |
3539 |
+ break; |
3540 |
+ } |
3541 |
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c |
3542 |
+index f43d037ea8520..f870027928363 100644 |
3543 |
+--- a/net/x25/af_x25.c |
3544 |
++++ b/net/x25/af_x25.c |
3545 |
+@@ -551,7 +551,7 @@ static int x25_create(struct net *net, struct socket *sock, int protocol, |
3546 |
+ if (protocol) |
3547 |
+ goto out; |
3548 |
+ |
3549 |
+- rc = -ENOBUFS; |
3550 |
++ rc = -ENOMEM; |
3551 |
+ if ((sk = x25_alloc_socket(net, kern)) == NULL) |
3552 |
+ goto out; |
3553 |
+ |
3554 |
+diff --git a/sound/soc/codecs/rt5659.c b/sound/soc/codecs/rt5659.c |
3555 |
+index b331b3ba61a9b..ab73f84b59709 100644 |
3556 |
+--- a/sound/soc/codecs/rt5659.c |
3557 |
++++ b/sound/soc/codecs/rt5659.c |
3558 |
+@@ -2473,13 +2473,18 @@ static int set_dmic_power(struct snd_soc_dapm_widget *w, |
3559 |
+ return 0; |
3560 |
+ } |
3561 |
+ |
3562 |
+-static const struct snd_soc_dapm_widget rt5659_dapm_widgets[] = { |
3563 |
++static const struct snd_soc_dapm_widget rt5659_particular_dapm_widgets[] = { |
3564 |
+ SND_SOC_DAPM_SUPPLY("LDO2", RT5659_PWR_ANLG_3, RT5659_PWR_LDO2_BIT, 0, |
3565 |
+ NULL, 0), |
3566 |
+- SND_SOC_DAPM_SUPPLY("PLL", RT5659_PWR_ANLG_3, RT5659_PWR_PLL_BIT, 0, |
3567 |
+- NULL, 0), |
3568 |
++ SND_SOC_DAPM_SUPPLY("MICBIAS1", RT5659_PWR_ANLG_2, RT5659_PWR_MB1_BIT, |
3569 |
++ 0, NULL, 0), |
3570 |
+ SND_SOC_DAPM_SUPPLY("Mic Det Power", RT5659_PWR_VOL, |
3571 |
+ RT5659_PWR_MIC_DET_BIT, 0, NULL, 0), |
3572 |
++}; |
3573 |
++ |
3574 |
++static const struct snd_soc_dapm_widget rt5659_dapm_widgets[] = { |
3575 |
++ SND_SOC_DAPM_SUPPLY("PLL", RT5659_PWR_ANLG_3, RT5659_PWR_PLL_BIT, 0, |
3576 |
++ NULL, 0), |
3577 |
+ SND_SOC_DAPM_SUPPLY("Mono Vref", RT5659_PWR_ANLG_1, |
3578 |
+ RT5659_PWR_VREF3_BIT, 0, NULL, 0), |
3579 |
+ |
3580 |
+@@ -2504,8 +2509,6 @@ static const struct snd_soc_dapm_widget rt5659_dapm_widgets[] = { |
3581 |
+ RT5659_ADC_MONO_R_ASRC_SFT, 0, NULL, 0), |
3582 |
+ |
3583 |
+ /* Input Side */ |
3584 |
+- SND_SOC_DAPM_SUPPLY("MICBIAS1", RT5659_PWR_ANLG_2, RT5659_PWR_MB1_BIT, |
3585 |
+- 0, NULL, 0), |
3586 |
+ SND_SOC_DAPM_SUPPLY("MICBIAS2", RT5659_PWR_ANLG_2, RT5659_PWR_MB2_BIT, |
3587 |
+ 0, NULL, 0), |
3588 |
+ SND_SOC_DAPM_SUPPLY("MICBIAS3", RT5659_PWR_ANLG_2, RT5659_PWR_MB3_BIT, |
3589 |
+@@ -3700,10 +3703,23 @@ static int rt5659_set_bias_level(struct snd_soc_component *component, |
3590 |
+ |
3591 |
+ static int rt5659_probe(struct snd_soc_component *component) |
3592 |
+ { |
3593 |
++ struct snd_soc_dapm_context *dapm = |
3594 |
++ snd_soc_component_get_dapm(component); |
3595 |
+ struct rt5659_priv *rt5659 = snd_soc_component_get_drvdata(component); |
3596 |
+ |
3597 |
+ rt5659->component = component; |
3598 |
+ |
3599 |
++ switch (rt5659->pdata.jd_src) { |
3600 |
++ case RT5659_JD_HDA_HEADER: |
3601 |
++ break; |
3602 |
++ |
3603 |
++ default: |
3604 |
++ snd_soc_dapm_new_controls(dapm, |
3605 |
++ rt5659_particular_dapm_widgets, |
3606 |
++ ARRAY_SIZE(rt5659_particular_dapm_widgets)); |
3607 |
++ break; |
3608 |
++ } |
3609 |
++ |
3610 |
+ return 0; |
3611 |
+ } |
3612 |
+ |
3613 |
+diff --git a/tools/include/uapi/linux/in.h b/tools/include/uapi/linux/in.h |
3614 |
+index 48e8a225b985a..2a66ab49f14dd 100644 |
3615 |
+--- a/tools/include/uapi/linux/in.h |
3616 |
++++ b/tools/include/uapi/linux/in.h |
3617 |
+@@ -280,6 +280,9 @@ struct sockaddr_in { |
3618 |
+ /* Address indicating an error return. */ |
3619 |
+ #define INADDR_NONE ((unsigned long int) 0xffffffff) |
3620 |
+ |
3621 |
++/* Dummy address for src of ICMP replies if no real address is set (RFC7600). */ |
3622 |
++#define INADDR_DUMMY ((unsigned long int) 0xc0000008) |
3623 |
++ |
3624 |
+ /* Network number for local host loopback. */ |
3625 |
+ #define IN_LOOPBACKNET 127 |
3626 |
+ |
3627 |
+diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c |
3628 |
+index fb5d2d1e0c048..b138fd5e4620a 100644 |
3629 |
+--- a/tools/testing/selftests/kvm/lib/kvm_util.c |
3630 |
++++ b/tools/testing/selftests/kvm/lib/kvm_util.c |
3631 |
+@@ -55,7 +55,7 @@ int kvm_check_cap(long cap) |
3632 |
+ exit(KSFT_SKIP); |
3633 |
+ |
3634 |
+ ret = ioctl(kvm_fd, KVM_CHECK_EXTENSION, cap); |
3635 |
+- TEST_ASSERT(ret != -1, "KVM_CHECK_EXTENSION IOCTL failed,\n" |
3636 |
++ TEST_ASSERT(ret >= 0, "KVM_CHECK_EXTENSION IOCTL failed,\n" |
3637 |
+ " rc: %i errno: %i", ret, errno); |
3638 |
+ |
3639 |
+ close(kvm_fd); |
3640 |
+diff --git a/virt/kvm/arm/vgic/vgic-kvm-device.c b/virt/kvm/arm/vgic/vgic-kvm-device.c |
3641 |
+index 6ada2432e37c7..71d92096776e9 100644 |
3642 |
+--- a/virt/kvm/arm/vgic/vgic-kvm-device.c |
3643 |
++++ b/virt/kvm/arm/vgic/vgic-kvm-device.c |
3644 |
+@@ -95,8 +95,8 @@ int kvm_vgic_addr(struct kvm *kvm, unsigned long type, u64 *addr, bool write) |
3645 |
+ r = vgic_v3_set_redist_base(kvm, 0, *addr, 0); |
3646 |
+ goto out; |
3647 |
+ } |
3648 |
+- rdreg = list_first_entry(&vgic->rd_regions, |
3649 |
+- struct vgic_redist_region, list); |
3650 |
++ rdreg = list_first_entry_or_null(&vgic->rd_regions, |
3651 |
++ struct vgic_redist_region, list); |
3652 |
+ if (!rdreg) |
3653 |
+ addr_ptr = &undef_value; |
3654 |
+ else |