joel16/android_kernel_sony_msm8994_rework
1
0
Fork 0
mirror of https://github.com/joel16/android_kernel_sony_msm8994_rework.git synced 2024-11-23 03:50:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge tag 'v3.10.108' into lineage-15.1

Browse Source 
e7a59c7 Linux 3.10.108
68cbe93 x86/apic: fix build breakage caused by incomplete backport to 3.10
541cbdc can: esd_usb2: Fix can_dlc value for received RTR, frames
4de0e6b scsi: scsi_dh_emc: return success in clariion_std_inquiry()
4021627 usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
49218ad KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
75840f1 IB/qib: fix false-postive maybe-uninitialized warning
f63d10b team: fix memory leaks
9032694 IB/ipoib: rtnl_unlock can not come after free_netdev
827a5cb btrfs: prevent to set invalid default subvolid
7210062 tracing: Erase irqsoff trace with empty write
ec8c69e tracing: Apply trace_clock changes to instance max buffer
c5378d2 scsi: qla2xxx: Fix an integer overflow in sysfs code
92e84b6 crypto: AF_ALG - remove SGL terminator indicator when chaining
6f47a87 ip6_gre: fix endianness errors in ip6gre_err
488ec7b ipv6: fix typo in fib6_net_exit()
4e39d5e ipv6: fix memory leak with multiple tables during netns destruction
dd3e501 qlge: avoid memcpy buffer overflow
71bec91 ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal
136211c ALSA: core: Fix unexpected error at replacing user TLV
b4824101 staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read
fe1fd35 packet: fix tp_reserve race in packet_set_ring
162f50e workqueue: implicit ordered attribute should be overridable
ef6fa3f ipv4: initialize fib_trie prior to register_netdev_notifier call.
50602d3 net/mlx4: Remove BUG_ON from ICM allocation routine
c1327b4 perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
3a7578a udf: Fix deadlock between writeback and udf_setsize()
ad08716 ir-core: fix gcc-7 warning on bool arithmetic
7fb443f crypto: caam - fix signals handling
b569326 mm: fix overflow check in expand_upwards()
9efa3d5 cfg80211: Check if PMKID attribute is of expected size
d474081 cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
fa69abf ipv6: avoid unregistering inet6_dev for loopback
98b9e94 KEYS: Fix an error code in request_master_key()
fe77acc KVM: x86: zero base3 of unusable segments
40cfe45 cpufreq: s3c2416: double free on driver init error path
04d0069 xfrm: Oops on error in pfkey_msg2xfrm_state()
f478b42 xfrm: NULL dereference on allocation failure
6ac502c net: korina: Fix NAPI versus resources freeing
1814420 net: phy: fix marvell phy status reading
2406076 drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
779ec20 usb: r8a66597-hcd: decrease timeout
e1bdf20 usb: r8a66597-hcd: select a different endpoint on timeout
655e5ff pvrusb2: reduce stack usage pvr2_eeprom_analyze()
1e7ae91 mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
e52eca8 x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
12d805b serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
f6b525b net: xilinx_emaclite: fix receive buffer overflow
7e25c93 drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()
a72c279 scsi: qla2xxx: don't disable a not previously enabled PCI device
f7eb769 net: ping: do not abuse udp_poll()
ca58e31 kvm: async_pf: fix rcu_irq_enter() with irqs enabled
28968bc x86/io: Add "memory" clobber to insb/insw/insl/outsb/outsw/outsl
61eea27 net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
bc3eede net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs
78da094 net: Set sk_prot_creator when cloning sockets to the right proto
055ad96 net/packet: check length in getsockopt() called with PACKET_HDRLEN
83fef52 tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0
81d2ec2 tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP
37cb362 tcp: avoid setting cwnd to invalid ssthresh after cwnd reduction states
6f85a88 tcp: reset sk_rx_dst in tcp_disconnect()
72d7b83 netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
946272f tcp: disallow cwnd undo when switching congestion control
08bd34b sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
faa132a sctp: fully initialize the IPv6 address in sctp_v6_to_addr()
2630e5a sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
3cb637d sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
9f75306 ext4: avoid deadlock when expanding inode size
ebb33af ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets
159c95b netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
19cc6d9 wext: handle NULL extra data in iwe_stream_add_point better
7af6952 kernel/extable.c: mark core_kernel_text notrace
4ef4196 net: prevent sign extension in dev_get_stats()
2f34aab ext4: fix SEEK_HOLE
3031776 lib/cmdline.c: fix get_options() overflow while parsing ranges
7719043 md: fix super_offset endianness in super_1_rdev_size_change
634fd95363 md/raid10: submit bio directly to replacement disk
09ab11e netfilter: invoke synchronize_rcu after set the _hook_ to NULL
a77cf1b lib/digsig: fix dereference of NULL user_key_payload
9ac5390 md/bitmap: disable bitmap_resize for file-backed bitmaps.
a45d367 KEYS: encrypted: fix dereference of NULL user_key_payload
e8705c4 KEYS: prevent creating a different user's keyrings
f9e779c MIPS: Fix mips_atomic_set() retry condition
9c66c82 ext4: keep existing extra fields when inode expands
ba85092 FS-Cache: fix dereference of NULL user_key_payload
20d94bc9 KEYS: don't let add_key() update an uninstantiated key
be3e7b1 USB: serial: console: fix use-after-free after failed setup
d75e854 direct-io: Prevent NULL pointer access in submit_page_section
544d7ba iommu/amd: Finish TLB flush in amd_iommu_unmap()
5abdd6e usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
b974ab5 usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
4b106b9 scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response
bb5cf57 scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records
2c7bfb3 scsi: zfcp: fix missing trace records for early returns in TMF eh handlers
e7ab3bd scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path
f609dac scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled
c2ace304 fuse: initialize the flock flag in fuse_file on allocation
003bea4 target: Avoid mappedlun symlink creation during lun shutdown
a6a256f media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
c39dcbd ext4: fix overflow caused by missing cast in ext4_resize_fs()
bdc5fbb ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
ae49cb7 workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
7e20e7b libata: array underflow in ata_find_dev()
4748ac3 MIPS: math-emu: Prevent wrong ISA mode instruction emulation
2121b63 MIPS: Fix unaligned PC interpretation in `compute_return_epc'
6aa23d1 MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
a2555cd usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
ecac824 powerpc/asm: Mark cr0 as clobbered in mftb()
733c88d powerpc: Fix emulation of mfocrf in emulate_step()
8e38d08 powerpc/64: Fix atomic64_inc_not_zero() to return an int
c11c8fc PM / Domains: Fix unsafe iteration over modified list of device links
f9c9c73 crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
1fc0b43 vt: fix unchecked __put_user() in tioclinux ioctls
7136ca7 brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
fe7e554 staging: comedi: fix clean-up of comedi_class in comedi_init()
790d869 powerpc/kprobes: Pause function_graph tracing during jprobes handling
69e0576 cpufreq: conservative: Allow down_threshold to take values from 1 to 10
54fd65c usb: chipidea: debug: check before accessing ci_role
f862c94 KEYS: fix dereferencing NULL payload with nonzero length
e044ff5 serial: ifx6x60: fix use-after-free on module unload
6c17636 MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
3937c2c ALSA: seq: Fix use-after-free at creating a port
44ec968 nl80211: check for the required netlink attributes presence
7571b74 xfrm: policy: check policy direction value
978e42b rxrpc: Fix several cases where a padded len isn't checked in ticket decode
4f54b264 fs/exec.c: account for argv/envp pointers
9a95fe3 usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
b2453bd usb: renesas_usbhs: fix the sequence in xfer_work()
58e47d4 usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle
75894ad leak in O_DIRECT readv past the EOF
7c11e178 mm/page_alloc: Remove kernel address exposure in free_reserved_area()
01c577c tcp: fix xmit timer to only be reset if data ACKed/SACKed
aa923a7 tcp: enable xmit timer fix by having TLP use time when RTO should fire
42a858e tcp: introduce tcp_rto_delta_us() helper for xmit timer fix
ecce864 Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket
b8d57eb Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket
69ddef7b udp: consistently apply ufo or fragmentation
b673e04 Staging: comedi: comedi_fops: Avoid orphaned proc entry
bf98a1b net: skb_needs_check() accepts CHECKSUM_NONE for tx
1bff8a2 net: reduce skb_warn_bad_offload() noise
f0dce90 ipvs: SNAT packet replies only for NATed connections

Signed-off-by: Rk779 <Rahulkrishna585@gmail.com>
This commit is contained in:
Rk779 2018-07-10 18:28:13 +00:00 committed by TARKZiM
parent 4c1dafc453
commit 793e1402b9
129 changed files with 679 additions and 320 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Makefile
View File

@ -1,8 +1,8 @@
VERSION = 3
PATCHLEVEL = 10
SUBLEVEL = 107
SUBLEVEL = 108
EXTRAVERSION =
NAME = TOSSUG Baby Fish
NAME = END-OF-LIFE
# *DOCUMENTATION*
# To see a list of typical targets execute "make help"

5
arch/mips/include/asm/branch.h
View File

@ -44,10 +44,7 @@ static inline int compute_return_epc(struct pt_regs *regs)
return __microMIPS_compute_return_epc(regs);
if (cpu_has_mips16)
return __MIPS16e_compute_return_epc(regs);
return regs->cp0_epc;
}
if (!delay_slot(regs)) {
} else if (!delay_slot(regs)) {
regs->cp0_epc += 4;
return 0;
}

8
arch/mips/kernel/branch.c
View File

@ -200,7 +200,7 @@ int __MIPS16e_compute_return_epc(struct pt_regs *regs)
*
* @regs: Pointer to pt_regs
* @insn: branch instruction to decode
* @returns: -EFAULT on error and forces SIGBUS, and on success
* @returns: -EFAULT on error and forces SIGILL, and on success
* returns 0 or BRANCH_LIKELY_TAKEN as appropriate after
* evaluating the branch.
*/
@ -297,6 +297,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
/*
* These are unconditional and in j_format.
*/
case jalx_op:
case jal_op:
regs->regs[31] = regs->cp0_epc + 8;
case j_op:
@ -436,8 +437,9 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
return ret;
sigill:
printk("%s: DSP branch but not DSP ASE - sending SIGBUS.\n", current->comm);
force_sig(SIGBUS, current);
pr_info("%s: DSP branch but not DSP ASE - sending SIGILL.\n",
current->comm);
force_sig(SIGILL, current);
return -EFAULT;
}
EXPORT_SYMBOL_GPL(__compute_return_epc_for_insn);

2
arch/mips/kernel/syscall.c
View File

@ -140,7 +140,7 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new)
"1: ll %[old], (%[addr]) \n"
" move %[tmp], %[new] \n"
"2: sc %[tmp], (%[addr]) \n"
" bnez %[tmp], 4f \n"
" beqz %[tmp], 4f \n"
"3: \n"
" .subsection 2 \n"
"4: b 1b \n"

38
arch/mips/math-emu/cp1emu.c
View File

@ -2002,6 +2002,35 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
return 0;
}
/*
* Emulate FPU instructions.
*
* If we use FPU hardware, then we have been typically called to handle
* an unimplemented operation, such as where an operand is a NaN or
* denormalized. In that case exit the emulation loop after a single
* iteration so as to let hardware execute any subsequent instructions.
*
* If we have no FPU hardware or it has been disabled, then continue
* emulating floating-point instructions until one of these conditions
* has occurred:
*
* - a non-FPU instruction has been encountered,
*
* - an attempt to emulate has ended with a signal,
*
* - the ISA mode has been switched.
*
* We need to terminate the emulation loop if we got switched to the
* MIPS16 mode, whether supported or not, so that we do not attempt
* to emulate a MIPS16 instruction as a regular MIPS FPU instruction.
* Similarly if we got switched to the microMIPS mode and only the
* regular MIPS mode is supported, so that we do not attempt to emulate
* a microMIPS instruction as a regular MIPS FPU instruction. Or if
* we got switched to the regular MIPS mode and only the microMIPS mode
* is supported, so that we do not attempt to emulate a regular MIPS
* instruction that should cause an Address Error exception instead.
* For simplicity we always terminate upon an ISA mode switch.
*/
int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
int has_fpu, void *__user *fault_addr)
{
@ -2093,6 +2122,15 @@ int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
break;
if (sig)
break;
/*
* We have to check for the ISA bit explicitly here,
* because `get_isa16_mode' may return 0 if support
* for code compression has been globally disabled,
* or otherwise we may produce the wrong signal or
* even proceed successfully where we must not.
*/
if ((xcp->cp0_epc ^ prevepc) & 0x1)
break;
cond_resched();
} while (xcp->cp0_epc > prevepc);

4
arch/powerpc/include/asm/atomic.h
View File

@ -501,7 +501,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
* Atomically increments @v by 1, so long as @v is non-zero.
* Returns non-zero if @v was non-zero, and zero otherwise.
*/
static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
static __inline__ int atomic64_inc_not_zero(atomic64_t *v)
{
long t1, t2;
@ -520,7 +520,7 @@ static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
: "r" (&v->counter)
: "cc", "xer", "memory");
return t1;
return t1 != 0;
}
#endif /* __powerpc64__ */

2
arch/powerpc/include/asm/reg.h
View File

@ -1136,7 +1136,7 @@
" .llong 0\n" \
" .llong 0\n" \
".previous" \
: "=r" (rval) : "i" (CPU_FTR_CELL_TB_BUG)); rval;})
: "=r" (rval) : "i" (CPU_FTR_CELL_TB_BUG) : "cr0"); rval;})
#else
#define mftb() ({unsigned long rval; \
asm volatile("mftb %0" : "=r" (rval)); rval;})

11
arch/powerpc/kernel/kprobes.c
View File

@ -529,6 +529,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
regs->gpr[2] = (unsigned long)(((func_descr_t *)jp->entry)->toc);
#endif
/*
* jprobes use jprobe_return() which skips the normal return
* path of the function, and this messes up the accounting of the
* function graph tracer.
*
* Pause function graph tracing while performing the jprobe function.
*/
pause_graph_tracing();
return 1;
}
@ -551,6 +560,8 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
* saved regs...
*/
memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs));
/* It's OK to start function graph tracing again */
unpause_graph_tracing();
preempt_enable_no_resched();
return 1;
}

13
arch/powerpc/lib/sstep.c
View File

@ -863,6 +863,19 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
goto instr_done;
#endif
case 19: /* mfcr */
if ((instr >> 20) & 1) {
imm = 0xf0000000UL;
for (sh = 0; sh < 8; ++sh) {
if (instr & (0x80000 >> sh)) {
regs->gpr[rd] = regs->ccr & imm;
break;
}
imm >>= 4;
}
goto instr_done;
}
regs->gpr[rd] = regs->ccr;
regs->gpr[rd] &= 0xffffffffUL;
goto instr_done;

4
arch/x86/include/asm/io.h
View File

@ -306,13 +306,13 @@ static inline unsigned type in##bwl##_p(int port) \
static inline void outs##bwl(int port, const void *addr, unsigned long count) \
{ \
asm volatile("rep; outs" #bwl \
: "+S"(addr), "+c"(count) : "d"(port)); \
: "+S"(addr), "+c"(count) : "d"(port) : "memory"); \
} \
\
static inline void ins##bwl(int port, void *addr, unsigned long count) \
{ \
asm volatile("rep; ins" #bwl \
: "+D"(addr), "+c"(count) : "d"(port)); \
: "+D"(addr), "+c"(count) : "d"(port) : "memory"); \
}
BUILDIO(b, b, char)

2
arch/x86/kernel/apic/apic.c
View File

@ -1581,8 +1581,10 @@ void __init enable_IR_x2apic(void)
int ret, x2apic_enabled = 0;
int hardware_init_ret;
#ifdef CONFIG_X86_IO_APIC
if (skip_ioapic_setup)
return;
#endif
/* Make sure irq_remap_ops are initialized */
setup_irq_remapping_ops();

2
arch/x86/kernel/kvm.c
View File

@ -159,8 +159,8 @@ void kvm_async_pf_task_wait(u32 token)
*/
rcu_irq_exit();
native_safe_halt();
rcu_irq_enter();
local_irq_disable();
rcu_irq_enter();
}
}
if (!n.halted)

2
arch/x86/kvm/vmx.c
View File

@ -8014,7 +8014,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
* (KVM doesn't change it)- no reason to call set_cr4_guest_host_mask();
*/
vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
kvm_set_cr4(vcpu, vmcs12->host_cr4);
vmx_set_cr4(vcpu, vmcs12->host_cr4);
/* shadow page tables on either EPT or shadow page tables */
kvm_set_cr3(vcpu, vmcs12->host_cr3);

2
arch/x86/kvm/x86.c
View File

@ -4596,6 +4596,8 @@ static bool emulator_get_segment(struct x86_emulate_ctxt *ctxt, u16 *selector,
if (var.unusable) {
memset(desc, 0, sizeof(*desc));
if (base3)
*base3 = 0;
return false;
}

1
arch/x86/mm/numa_32.c
View File

@ -100,5 +100,6 @@ void __init initmem_init(void)
printk(KERN_DEBUG "High memory starts at vaddr %08lx\n",
(ulong) pfn_to_kaddr(highstart_pfn));
__vmalloc_start_set = true;
setup_bootmem_allocator();
}

4
crypto/algif_skcipher.c
View File

@ -92,8 +92,10 @@ static int skcipher_alloc_sgl(struct sock *sk)
sg_init_table(sgl->sg, MAX_SGL_ENTS + 1);
sgl->cur = 0;
if (sg)
if (sg) {
scatterwalk_sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg);
sg_unmark_end(sg + (MAX_SGL_ENTS - 1));
}
list_add_tail(&sgl->list, &ctx->tsgl);
}

1
drivers/acpi/apei/ghes.c
View File

@ -988,6 +988,7 @@ static int ghes_remove(struct platform_device *ghes_dev)
if (list_empty(&ghes_sci))
unregister_acpi_hed_notifier(&ghes_notifier_sci);
mutex_unlock(&ghes_list_mutex);
synchronize_rcu();
break;
case ACPI_HEST_NOTIFY_NMI:
mutex_lock(&ghes_list_mutex);

6
drivers/ata/libata-scsi.c
View File

@ -2794,10 +2794,12 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
{
if (!sata_pmp_attached(ap)) {
if (likely(devno < ata_link_max_devices(&ap->link)))
if (likely(devno >= 0 &&
devno < ata_link_max_devices(&ap->link)))
return &ap->link.device[devno];
} else {
if (likely(devno < ap->nr_pmp_links))
if (likely(devno >= 0 &&
devno < ap->nr_pmp_links))
return &ap->pmp_link[devno].device[0];
}

4
drivers/base/power/domain.c
View File

@ -1692,7 +1692,7 @@ int pm_genpd_add_subdomain_names(const char *master_name,
int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
struct generic_pm_domain *subdomain)
{
struct gpd_link *link;
struct gpd_link *l, *link;
int ret = -EINVAL;
if (IS_ERR_OR_NULL(genpd) || IS_ERR_OR_NULL(subdomain))
@ -1701,7 +1701,7 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
start:
genpd_acquire_lock(genpd);
list_for_each_entry(link, &genpd->master_links, master_node) {
list_for_each_entry_safe(link, l, &genpd->master_links, master_node) {
if (link->slave != subdomain)
continue;

4
drivers/cpufreq/cpufreq_conservative.c
View File

@ -204,8 +204,8 @@ static ssize_t store_down_threshold(struct dbs_data *dbs_data, const char *buf,
int ret;
ret = sscanf(buf, "%u", &input);
/* cannot be lower than 11 otherwise freq will not fall */
if (ret != 1 || input < 11 || input > 100 ||
/* cannot be lower than 1 otherwise freq will not fall */
if (ret != 1 || input < 1 || input > 100 ||
input >= cs_tuners->up_threshold)
return -EINVAL;

1
drivers/cpufreq/s3c2416-cpufreq.c
View File

@ -421,7 +421,6 @@ static int __init s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
rate = clk_get_rate(s3c_freq->hclk);
if (rate < 133 * 1000 * 1000) {
pr_err("cpufreq: HCLK not at 133MHz\n");
clk_put(s3c_freq->hclk);
ret = -EINVAL;
goto err_armclk;
}

2
drivers/crypto/caam/caamhash.c
View File

@ -476,7 +476,7 @@ static int hash_digest_key(struct caam_hash_ctx *ctx, const u8 *key_in,
ret = caam_jr_enqueue(jrdev, desc, split_key_done, &result);
if (!ret) {
/* in progress */
wait_for_completion_interruptible(&result.completion);
wait_for_completion(&result.completion);
ret = result.err;
#ifdef DEBUG
print_hex_dump(KERN_ERR, "digested key@"xstr(__LINE__)": ",

2
drivers/crypto/caam/key_gen.c
View File

@ -107,7 +107,7 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
ret = caam_jr_enqueue(jrdev, desc, split_key_done, &result);
if (!ret) {
/* in progress */
wait_for_completion_interruptible(&result.completion);
wait_for_completion(&result.completion);
ret = result.err;
#ifdef DEBUG
print_hex_dump(KERN_ERR, "ctx.key@"xstr(__LINE__)": ",

7
drivers/crypto/talitos.c
View File

@ -623,7 +623,7 @@ static void talitos_unregister_rng(struct device *dev)
* crypto alg
*/
#define TALITOS_CRA_PRIORITY 3000
#define TALITOS_MAX_KEY_SIZE 96
#define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA512_BLOCK_SIZE)
#define TALITOS_MAX_IV_LENGTH 16 /* max of AES_BLOCK_SIZE, DES3_EDE_BLOCK_SIZE */
#define MD5_BLOCK_SIZE 64
@ -1380,6 +1380,11 @@ static int ablkcipher_setkey(struct crypto_ablkcipher *cipher,
{
struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
if (keylen > TALITOS_MAX_KEY_SIZE) {
crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_KEY_LEN);
return -EINVAL;
}
memcpy(&ctx->key, key, keylen);
ctx->keylen = keylen;

2
drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
View File

@ -368,6 +368,8 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
return fifo_state->static_buffer;
else {
fifo_state->dynamic_buffer = vmalloc(bytes);
if (!fifo_state->dynamic_buffer)
goto out_err;
return fifo_state->dynamic_buffer;
}
}

2
drivers/infiniband/hw/qib/qib_iba7322.c
View File

@ -6670,7 +6670,7 @@ static void qib_7322_txchk_change(struct qib_devdata *dd, u32 start,
unsigned long flags;
while (wait) {
unsigned long shadow;
unsigned long shadow = 0;
int cstart, previ = -1;
/*

4
drivers/infiniband/ulp/ipoib/ipoib_vlan.c
View File

@ -165,11 +165,11 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
out:
mutex_unlock(&ppriv->vlan_mutex);
rtnl_unlock();
if (result)
free_netdev(priv->dev);
rtnl_unlock();
return result;
}

1
drivers/iommu/amd_iommu.c
View File

@ -3402,6 +3402,7 @@ static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
mutex_unlock(&domain->api_lock);
domain_flush_tlb_pde(domain);
domain_flush_complete(domain);
return unmap_size;
}

5
drivers/md/bitmap.c
View File

@ -1806,6 +1806,11 @@ int bitmap_resize(struct bitmap *bitmap, sector_t blocks,
long pages;
struct bitmap_page *new_bp;
if (bitmap->storage.file && !init) {
pr_info("md: cannot resize file-based bitmap\n");
return -EINVAL;
}
if (chunksize == 0) {
/* If there is enough space, leave the chunk size unchanged,
* else increase by factor of two until there is enough space.

2
drivers/md/md.c
View File

@ -1898,7 +1898,7 @@ super_1_rdev_size_change(struct md_rdev *rdev, sector_t num_sectors)
}
sb = page_address(rdev->sb_page);
sb->data_size = cpu_to_le64(num_sectors);
sb->super_offset = rdev->sb_start;
sb->super_offset = cpu_to_le64(rdev->sb_start);
sb->sb_csum = calc_sb_1_csum(sb);
md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
rdev->sb_page);

19
drivers/md/raid10.c
View File

@ -1569,11 +1569,24 @@ retry_write:
mbio->bi_private = r10_bio;
atomic_inc(&r10_bio->remaining);
cb = blk_check_plugged(raid10_unplug, mddev,
sizeof(*plug));
if (cb)
plug = container_of(cb, struct raid10_plug_cb,
cb);
else
plug = NULL;
spin_lock_irqsave(&conf->device_lock, flags);
bio_list_add(&conf->pending_bio_list, mbio);
conf->pending_count++;
if (plug) {
bio_list_add(&plug->pending, mbio);
plug->pending_cnt++;
} else {
bio_list_add(&conf->pending_bio_list, mbio);
conf->pending_count++;
}
spin_unlock_irqrestore(&conf->device_lock, flags);
if (!mddev_check_plugged(mddev))
if (!plug)
md_wakeup_thread(mddev->thread);
}
}

22
drivers/media/platform/davinci/vpfe_capture.c
View File

@ -1706,27 +1706,9 @@ static long vpfe_param_handler(struct file *file, void *priv,
switch (cmd) {
case VPFE_CMD_S_CCDC_RAW_PARAMS:
ret = -EINVAL;
v4l2_warn(&vpfe_dev->v4l2_dev,
"VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n");
if (ccdc_dev->hw_ops.set_params) {
ret = ccdc_dev->hw_ops.set_params(param);
if (ret) {
v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
"Error setting parameters in CCDC\n");
goto unlock_out;
}
ret = vpfe_get_ccdc_image_format(vpfe_dev,
&vpfe_dev->fmt);
if (ret < 0) {
v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
"Invalid image format at CCDC\n");
goto unlock_out;
}
} else {
ret = -EINVAL;
v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
}
"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
break;
default:
ret = -ENOTTY;

2
drivers/media/rc/imon.c
View File

@ -1530,7 +1530,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
if (kc == KEY_KEYBOARD && !ictx->release_code) {
ictx->last_keycode = kc;
if (!nomouse) {
ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1;
ictx->pad_mouse = !ictx->pad_mouse;
dev_dbg(dev, "toggling to %s mode\n",
ictx->pad_mouse ? "mouse" : "keyboard");
spin_unlock_irqrestore(&ictx->kc_lock, flags);

11
drivers/media/usb/pvrusb2/pvrusb2-eeprom.c
View File

@ -123,15 +123,10 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
memset(&tvdata,0,sizeof(tvdata));
eeprom = pvr2_eeprom_fetch(hdw);
if (!eeprom) return -EINVAL;
if (!eeprom)
return -EINVAL;
{
struct i2c_client fake_client;
/* Newer version expects a useless client interface */
fake_client.addr = hdw->eeprom_addr;
fake_client.adapter = &hdw->i2c_adap;
tveeprom_hauppauge_analog(&fake_client,&tvdata,eeprom);
}
tveeprom_hauppauge_analog(NULL, &tvdata, eeprom);
trace_eeprom("eeprom assumed v4l tveeprom module");
trace_eeprom("eeprom direct call results:");

2
drivers/mfd/omap-usb-tll.c
View File

@ -380,8 +380,8 @@ int omap_tll_init(struct usbhs_omap_platform_data *pdata)
* and use SDR Mode
*/
reg &= ~(OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE
| OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF
| OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE);
reg |= OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF;
} else if (pdata->port_mode[i] ==
OMAP_EHCI_PORT_MODE_HSIC) {
/*

4
drivers/misc/c2port/c2port-duramar2150.c
View File

@ -129,8 +129,8 @@ static int __init duramar2150_c2port_init(void)
duramar2150_c2port_dev = c2port_device_register("uc",
&duramar2150_c2port_ops, NULL);
if (!duramar2150_c2port_dev) {
ret = -ENODEV;
if (IS_ERR(duramar2150_c2port_dev)) {
ret = PTR_ERR(duramar2150_c2port_dev);
goto free_region;
}

2
drivers/net/can/usb/esd_usb2.c
View File

@ -335,7 +335,7 @@ static void esd_usb2_rx_can_msg(struct esd_usb2_net_priv *priv,
}
cf->can_id = id & ESD_IDMASK;
cf->can_dlc = get_can_dlc(msg->msg.rx.dlc);
cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR);
if (id & ESD_EXTID)
cf->can_id |= CAN_EFF_FLAG;

8
drivers/net/ethernet/korina.c
View File

@ -905,10 +905,10 @@ static void korina_restart_task(struct work_struct *work)
DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR,
&lp->rx_dma_regs->dmasm);
korina_free_ring(dev);
napi_disable(&lp->napi);
korina_free_ring(dev);
if (korina_init(dev) < 0) {
printk(KERN_ERR "%s: cannot restart device\n", dev->name);
return;
@ -1069,12 +1069,12 @@ static int korina_close(struct net_device *dev)
tmp = tmp | DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR;
writel(tmp, &lp->rx_dma_regs->dmasm);
korina_free_ring(dev);
napi_disable(&lp->napi);
cancel_work_sync(&lp->restart_task);
korina_free_ring(dev);
free_irq(lp->rx_irq, dev);
free_irq(lp->tx_irq, dev);
free_irq(lp->ovr_irq, dev);

7
drivers/net/ethernet/mellanox/mlx4/icm.c
View File

@ -113,8 +113,13 @@ static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem,
if (!buf)
return -ENOMEM;
if (offset_in_page(buf)) {
dma_free_coherent(dev, PAGE_SIZE << order,
buf, sg_dma_address(mem));
return -ENOMEM;
}
sg_set_buf(mem, buf, PAGE_SIZE << order);
BUG_ON(mem->offset);
sg_dma_len(mem) = PAGE_SIZE << order;
return 0;
}

2
drivers/net/ethernet/mellanox/mlx4/main.c
View File

@ -511,8 +511,6 @@ static int mlx4_slave_cap(struct mlx4_dev *dev)
return -ENOSYS;
}
mlx4_log_num_mgm_entry_size = hca_param.log_mc_entry_sz;
dev->caps.hca_core_clock = hca_param.hca_core_clock;
memset(&dev_cap, 0, sizeof(dev_cap));

2
drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
View File

@ -724,7 +724,7 @@ static void ql_build_coredump_seg_header(
seg_hdr->cookie = MPI_COREDUMP_COOKIE;
seg_hdr->segNum = seg_number;
seg_hdr->segSize = seg_size;
memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
strncpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
}
/*

10
drivers/net/ethernet/xilinx/xilinx_emaclite.c
View File

@ -398,7 +398,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data,
*
* Return: Total number of bytes received
*/
static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data)
static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
{
void __iomem *addr;
u16 length, proto_type;
@ -438,7 +438,7 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data)
/* Check if received ethernet frame is a raw ethernet frame
* or an IP packet or an ARP packet */
if (proto_type > (ETH_FRAME_LEN + ETH_FCS_LEN)) {
if (proto_type > ETH_DATA_LEN) {
if (proto_type == ETH_P_IP) {
length = ((ntohl(in_be32(addr +
@ -446,6 +446,7 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data)
XEL_RXBUFF_OFFSET)) >>
XEL_HEADER_SHIFT) &
XEL_RPLR_LENGTH_MASK);
length = min_t(u16, length, ETH_DATA_LEN);
length += ETH_HLEN + ETH_FCS_LEN;
} else if (proto_type == ETH_P_ARP)
@ -458,6 +459,9 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data)
/* Use the length in the frame, plus the header and trailer */
length = proto_type + ETH_HLEN + ETH_FCS_LEN;
if (WARN_ON(length > maxlen))
length = maxlen;
/* Read from the EmacLite device */
xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET),
data, length);
@ -632,7 +636,7 @@ static void xemaclite_rx_handler(struct net_device *dev)
skb_reserve(skb, 2);
len = xemaclite_recv_data(lp, (u8 *) skb->data);
len = xemaclite_recv_data(lp, (u8 *) skb->data, len);
if (!len) {
dev->stats.rx_errors++;

2
drivers/net/phy/marvell.c
View File

@ -656,8 +656,6 @@ static int marvell_read_status(struct phy_device *phydev)
if (adv < 0)
return adv;
lpa &= adv;
if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
phydev->duplex = DUPLEX_FULL;
else

8
drivers/net/team/team.c
View File

@ -2121,8 +2121,10 @@ start_again:
hdr = genlmsg_put(skb, portid, seq, &team_nl_family, flags | NLM_F_MULTI,
TEAM_CMD_OPTIONS_GET);
if (!hdr)
if (!hdr) {
nlmsg_free(skb);
return -EMSGSIZE;
}
if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
goto nla_put_failure;
@ -2389,8 +2391,10 @@ start_again:
hdr = genlmsg_put(skb, portid, seq, &team_nl_family, flags | NLM_F_MULTI,
TEAM_CMD_PORT_LIST_GET);
if (!hdr)
if (!hdr) {
nlmsg_free(skb);
return -EMSGSIZE;
}
if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
goto nla_put_failure;

5
drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
View File

@ -4019,6 +4019,11 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
GFP_KERNEL);
} else if (ieee80211_is_action(mgmt->frame_control)) {
if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
brcmf_err("invalid action frame length\n");
err = -EINVAL;
goto exit;
}
af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
if (af_params == NULL) {
brcmf_err("unable to allocate frame\n");

21
drivers/s390/scsi/zfcp_dbf.c
View File

@ -556,19 +556,32 @@ void zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd *sc,
if (fsf) {
rec->fsf_req_id = fsf->req_id;
rec->pl_len = FCP_RESP_WITH_EXT;
fcp_rsp = (struct fcp_resp_with_ext *)
&(fsf->qtcb->bottom.io.fcp_rsp);
/* mandatory parts of FCP_RSP IU in this SCSI record */
memcpy(&rec->fcp_rsp, fcp_rsp, FCP_RESP_WITH_EXT);
if (fcp_rsp->resp.fr_flags & FCP_RSP_LEN_VAL) {
fcp_rsp_info = (struct fcp_resp_rsp_info *) &fcp_rsp[1];
rec->fcp_rsp_info = fcp_rsp_info->rsp_code;
rec->pl_len += be32_to_cpu(fcp_rsp->ext.fr_rsp_len);
}
if (fcp_rsp->resp.fr_flags & FCP_SNS_LEN_VAL) {
rec->pl_len = min((u16)SCSI_SENSE_BUFFERSIZE,
(u16)ZFCP_DBF_PAY_MAX_REC);
zfcp_dbf_pl_write(dbf, sc->sense_buffer, rec->pl_len,
"fcp_sns", fsf->req_id);
rec->pl_len += be32_to_cpu(fcp_rsp->ext.fr_sns_len);
}
/* complete FCP_RSP IU in associated PAYload record
* but only if there are optional parts
*/
if (fcp_rsp->resp.fr_flags != 0)
zfcp_dbf_pl_write(
dbf, fcp_rsp,
/* at least one full PAY record
* but not beyond hardware response field
*/
min_t(u16, max_t(u16, rec->pl_len,
ZFCP_DBF_PAY_MAX_REC),
FSF_FCP_RSP_SIZE),
"fcp_riu", fsf->req_id);
}
debug_event(dbf->scsi, level, rec, sizeof(*rec));

6
drivers/s390/scsi/zfcp_dbf.h
View File

@ -323,7 +323,11 @@ void zfcp_dbf_hba_fsf_response(struct zfcp_fsf_req *req)
{
struct fsf_qtcb *qtcb = req->qtcb;
if ((qtcb->prefix.prot_status != FSF_PROT_GOOD) &&
if (unlikely(req->status & (ZFCP_STATUS_FSFREQ_DISMISSED |
ZFCP_STATUS_FSFREQ_ERROR))) {
zfcp_dbf_hba_fsf_resp("fs_rerr", 3, req);
} else if ((qtcb->prefix.prot_status != FSF_PROT_GOOD) &&
(qtcb->prefix.prot_status != FSF_PROT_FSF_STATUS_PRESENTED)) {
zfcp_dbf_hba_fsf_resp("fs_perr", 1, req);

6
drivers/s390/scsi/zfcp_fc.h
View File

@ -4,7 +4,7 @@
* Fibre Channel related definitions and inline functions for the zfcp
* device driver
*
* Copyright IBM Corp. 2009
* Copyright IBM Corp. 2009, 2017
*/
#ifndef ZFCP_FC_H
@ -291,6 +291,10 @@ void zfcp_fc_eval_fcp_rsp(struct fcp_resp_with_ext *fcp_rsp,
!(rsp_flags & FCP_SNS_LEN_VAL) &&
fcp_rsp->resp.fr_status == SAM_STAT_GOOD)
set_host_byte(scsi, DID_ERROR);
} else if (unlikely(rsp_flags & FCP_RESID_OVER)) {
/* FCP_DL was not sufficient for SCSI data length */
if (fcp_rsp->resp.fr_status == SAM_STAT_GOOD)
set_host_byte(scsi, DID_ERROR);
}
}

3
drivers/s390/scsi/zfcp_fsf.c
View File

@ -2286,7 +2286,8 @@ int zfcp_fsf_fcp_cmnd(struct scsi_cmnd *scsi_cmnd)
fcp_cmnd = (struct fcp_cmnd *) &req->qtcb->bottom.io.fcp_cmnd;
zfcp_fc_scsi_to_fcp(fcp_cmnd, scsi_cmnd, 0);
if (scsi_prot_sg_count(scsi_cmnd)) {
if ((scsi_get_prot_op(scsi_cmnd) != SCSI_PROT_NORMAL) &&
scsi_prot_sg_count(scsi_cmnd)) {
zfcp_qdio_set_data_div(qdio, &req->qdio_req,
scsi_prot_sg_count(scsi_cmnd));
retval = zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req,

8
drivers/s390/scsi/zfcp_scsi.c
View File

@ -294,8 +294,10 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
zfcp_erp_wait(adapter);
ret = fc_block_scsi_eh(scpnt);
if (ret)
if (ret) {
zfcp_dbf_scsi_devreset("fiof", scpnt, tm_flags);
return ret;
}
if (!(atomic_read(&adapter->status) &
ZFCP_STATUS_COMMON_RUNNING)) {
@ -303,8 +305,10 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
return SUCCESS;
}
}
if (!fsf_req)
if (!fsf_req) {
zfcp_dbf_scsi_devreset("reqf", scpnt, tm_flags);
return FAILED;
}
wait_for_completion(&fsf_req->completion);

2
drivers/scsi/device_handler/scsi_dh_emc.c
View File

@ -464,7 +464,7 @@ static int clariion_prep_fn(struct scsi_device *sdev, struct request *req)
static int clariion_std_inquiry(struct scsi_device *sdev,
struct clariion_dh_data *csdev)
{
int err;
int err = SCSI_DH_OK;
char *sp_model;
err = send_inquiry_cmd(sdev, 0, csdev);

8
drivers/scsi/qla2xxx/qla_attr.c
View File

@ -299,6 +299,8 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj,
return -EINVAL;
if (start > ha->optrom_size)
return -EINVAL;
if (size > ha->optrom_size - start)
size = ha->optrom_size - start;
switch (val) {
case 0:
@ -320,8 +322,7 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj,
return -EINVAL;
ha->optrom_region_start = start;
ha->optrom_region_size = start + size > ha->optrom_size ?
ha->optrom_size - start : size;
ha->optrom_region_size = start + size;
ha->optrom_state = QLA_SREADING;
ha->optrom_buffer = vmalloc(ha->optrom_region_size);
@ -388,8 +389,7 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj,
}
ha->optrom_region_start = start;
ha->optrom_region_size = start + size > ha->optrom_size ?
ha->optrom_size - start : size;
ha->optrom_region_size = start + size;
ha->optrom_state = QLA_SWRITING;
ha->optrom_buffer = vmalloc(ha->optrom_region_size);

8
drivers/scsi/qla2xxx/qla_os.c
View File

@ -2342,10 +2342,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
if (mem_only) {
if (pci_enable_device_mem(pdev))
goto probe_out;
return ret;
} else {
if (pci_enable_device(pdev))
goto probe_out;
return ret;
}
/* This may fail but that's ok */
@ -2355,7 +2355,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
if (!ha) {
ql_log_pci(ql_log_fatal, pdev, 0x0009,
"Unable to allocate memory for ha.\n");
goto probe_out;
goto disable_device;
}
ql_dbg_pci(ql_dbg_init, pdev, 0x000a,
"Memory allocated for ha=%p.\n", ha);
@ -2899,7 +2899,7 @@ iospace_config_failed:
kfree(ha);
ha = NULL;
probe_out:
disable_device:
pci_disable_device(pdev);
return ret;
}

7
drivers/staging/comedi/comedi_fops.c
View File

@ -2557,15 +2557,13 @@ static int __init comedi_init(void)
comedi_class->dev_attrs = comedi_dev_attrs;
/* XXX requires /proc interface */
comedi_proc_init();
/* create devices files for legacy/manual use */
for (i = 0; i < comedi_num_legacy_minors; i++) {
struct comedi_device *dev;
dev = comedi_alloc_board_minor(NULL);
if (IS_ERR(dev)) {
comedi_cleanup_board_minors();
class_destroy(comedi_class);
cdev_del(&comedi_cdev);
unregister_chrdev_region(MKDEV(COMEDI_MAJOR, 0),
COMEDI_NUM_MINORS);
@ -2576,6 +2574,9 @@ static int __init comedi_init(void)
}
}
/* XXX requires /proc interface */
comedi_proc_init();
return 0;
}
module_init(comedi_init);

2
drivers/staging/iio/resolver/ad2s1210.c
View File

@ -477,7 +477,7 @@ static int ad2s1210_read_raw(struct iio_dev *indio_dev,
long m)
{
struct ad2s1210_state *st = iio_priv(indio_dev);
bool negative;
u16 negative;
int ret = 0;
u16 pos;
s16 vel;

5
drivers/target/target_core_fabric_configfs.c
View File

@ -84,6 +84,11 @@ static int target_fabric_mappedlun_link(
"_tpg does not exist\n");
return -EINVAL;
}
if (lun->lun_shutdown) {
pr_err("Unable to create mappedlun symlink because"
" lun->lun_shutdown=true\n");
return -EINVAL;
}
se_tpg = lun->lun_sep->sep_tpg;
nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item;

3
drivers/target/target_core_tpg.c
View File

@ -839,6 +839,8 @@ static void core_tpg_shutdown_lun(
struct se_portal_group *tpg,
struct se_lun *lun)
{
lun->lun_shutdown = true;
core_clear_lun_from_tpg(lun, tpg);
transport_clear_lun_from_sessions(lun);
}
@ -868,6 +870,7 @@ struct se_lun *core_tpg_pre_dellun(
spin_unlock(&tpg->tpg_lun_lock);
return ERR_PTR(-ENODEV);
}
lun->lun_shutdown = false;
spin_unlock(&tpg->tpg_lun_lock);
return lun;

11
drivers/tty/serial/efm32-uart.c
View File

@ -27,6 +27,7 @@
#define UARTn_FRAME 0x04
#define UARTn_FRAME_DATABITS__MASK 0x000f
#define UARTn_FRAME_DATABITS(n) ((n) - 3)
#define UARTn_FRAME_PARITY__MASK 0x0300
#define UARTn_FRAME_PARITY_NONE 0x0000
#define UARTn_FRAME_PARITY_EVEN 0x0200
#define UARTn_FRAME_PARITY_ODD 0x0300
@ -578,12 +579,16 @@ static void efm32_uart_console_get_options(struct efm32_uart_port *efm_port,
16 * (4 + (clkdiv >> 6)));
frame = efm32_uart_read32(efm_port, UARTn_FRAME);
if (frame & UARTn_FRAME_PARITY_ODD)
switch (frame & UARTn_FRAME_PARITY__MASK) {
case UARTn_FRAME_PARITY_ODD:
*parity = 'o';
else if (frame & UARTn_FRAME_PARITY_EVEN)
break;
case UARTn_FRAME_PARITY_EVEN:
*parity = 'e';
else
break;
default:
*parity = 'n';
}
*bits = (frame & UARTn_FRAME_DATABITS__MASK) -
UARTn_FRAME_DATABITS(4) + 4;

2
drivers/tty/serial/ifx6x60.c
View File

@ -1379,9 +1379,9 @@ static struct spi_driver ifx_spi_driver = {
static void __exit ifx_spi_exit(void)
{
/* unregister */
spi_unregister_driver((void *)&ifx_spi_driver);
tty_unregister_driver(tty_drv);
put_tty_driver(tty_drv);
spi_unregister_driver((void *)&ifx_spi_driver);
unregister_reboot_notifier(&ifx_modem_reboot_notifier_block);
}

6
drivers/tty/vt/vt.c
View File

@ -2601,13 +2601,13 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
* related to the kernel should not use this.
*/
data = vt_get_shift_state();
ret = __put_user(data, p);
ret = put_user(data, p);
break;
case TIOCL_GETMOUSEREPORTING:
console_lock(); /* May be overkill */
data = mouse_reporting();
console_unlock();
ret = __put_user(data, p);
ret = put_user(data, p);
break;
case TIOCL_SETVESABLANK:
console_lock();
@ -2616,7 +2616,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
break;
case TIOCL_GETKMSGREDIRECT:
data = vt_get_kmsg_redirect();
ret = __put_user(data, p);
ret = put_user(data, p);
break;
case TIOCL_SETKMSGREDIRECT:
if (!capable(CAP_SYS_ADMIN)) {

3
drivers/usb/chipidea/debug.c
View File

@ -242,7 +242,8 @@ static int ci_role_show(struct seq_file *s, void *data)
{
struct ci13xxx *ci = s->private;
seq_printf(s, "%s\n", ci_role(ci)->name);
if (ci->role != CI_ROLE_END)
seq_printf(s, "%s\n", ci_role(ci)->name);
return 0;
}

5
drivers/usb/gadget/composite.c
View File

@ -1669,6 +1669,8 @@ static DEVICE_ATTR(suspended, 0444, composite_show_suspended, NULL);
static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
{
struct usb_composite_dev *cdev = get_gadget_data(gadget);
struct usb_gadget_strings *gstr = cdev->driver->strings[0];
struct usb_string *dev_str = gstr->strings;
/* composite_disconnect() must already have been called
* by the underlying peripheral controller driver!
@ -1689,6 +1691,9 @@ static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
composite_dev_cleanup(cdev);
if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer)
dev_str[USB_GADGET_MANUFACTURER_IDX].s = "";
kfree(cdev->def_manufacturer);
kfree(cdev);
set_gadget_data(gadget, NULL);

6
drivers/usb/host/r8a66597-hcd.c
View File

@ -1270,7 +1270,7 @@ static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
time = 30;
break;
default:
time = 300;
time = 50;
break;
}
@ -1786,6 +1786,7 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
pipe = td->pipe;
pipe_stop(r8a66597, pipe);
/* Select a different address or endpoint */
new_td = td;
do {
list_move_tail(&new_td->queue,
@ -1795,7 +1796,8 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
new_td = td;
break;
}
} while (td != new_td && td->address == new_td->address);
} while (td != new_td && td->address == new_td->address &&
td->pipe->info.epnum == new_td->pipe->info.epnum);
start_transfer(r8a66597, new_td);

4
drivers/usb/renesas_usbhs/common.c
View File

@ -600,8 +600,10 @@ static int usbhsc_resume(struct device *dev)
struct usbhs_priv *priv = dev_get_drvdata(dev);
struct platform_device *pdev = usbhs_priv_to_pdev(priv);
if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL))
if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL)) {
usbhsc_power_ctrl(priv, 1);
usbhs_mod_autonomy_mode(priv);
}
usbhs_platform_call(priv, phy_reset, pdev);

50
drivers/usb/renesas_usbhs/fifo.c
View File

@ -261,11 +261,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe,
struct usbhs_fifo *fifo)
{
struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
int ret = 0;
if (!usbhs_pipe_is_dcp(pipe))
usbhsf_fifo_barrier(priv, fifo);
if (!usbhs_pipe_is_dcp(pipe)) {
/*
* This driver checks the pipe condition first to avoid -EBUSY
* from usbhsf_fifo_barrier() with about 10 msec delay in
* the interrupt handler if the pipe is RX direction and empty.
*/
if (usbhs_pipe_is_dir_in(pipe))
ret = usbhs_pipe_is_accessible(pipe);
if (!ret)
ret = usbhsf_fifo_barrier(priv, fifo);
}
usbhs_write(priv, fifo->ctr, BCLR);
/*
* if non-DCP pipe, this driver should set BCLR when
* usbhsf_fifo_barrier() returns 0.
*/
if (!ret)
usbhs_write(priv, fifo->ctr, BCLR);
}
static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv,
@ -545,6 +560,7 @@ static int usbhsf_pio_try_push(struct usbhs_pkt *pkt, int *is_done)
usbhsf_send_terminator(pipe, fifo);
usbhsf_tx_irq_ctrl(pipe, !*is_done);
usbhs_pipe_running(pipe, !*is_done);
usbhs_pipe_enable(pipe);
dev_dbg(dev, " send %d (%d/ %d/ %d/ %d)\n",
@ -571,12 +587,21 @@ usbhs_fifo_write_busy:
* retry in interrupt
*/
usbhsf_tx_irq_ctrl(pipe, 1);
usbhs_pipe_running(pipe, 1);
return ret;
}
static int usbhsf_pio_prepare_push(struct usbhs_pkt *pkt, int *is_done)
{
if (usbhs_pipe_is_running(pkt->pipe))
return 0;
return usbhsf_pio_try_push(pkt, is_done);
}
struct usbhs_pkt_handle usbhs_fifo_pio_push_handler = {
.prepare = usbhsf_pio_try_push,
.prepare = usbhsf_pio_prepare_push,
.try_run = usbhsf_pio_try_push,
};
@ -590,6 +615,9 @@ static int usbhsf_prepare_pop(struct usbhs_pkt *pkt, int *is_done)
if (usbhs_pipe_is_busy(pipe))
return 0;
if (usbhs_pipe_is_running(pipe))
return 0;
/*
* pipe enable to prepare packet receive
*/
@ -598,6 +626,7 @@ static int usbhsf_prepare_pop(struct usbhs_pkt *pkt, int *is_done)
usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->length);
usbhs_pipe_enable(pipe);
usbhs_pipe_running(pipe, 1);
usbhsf_rx_irq_ctrl(pipe, 1);
return 0;
@ -643,6 +672,7 @@ static int usbhsf_pio_try_pop(struct usbhs_pkt *pkt, int *is_done)
(total_len < maxp)) { /* short packet */
*is_done = 1;
usbhsf_rx_irq_ctrl(pipe, 0);
usbhs_pipe_running(pipe, 0);
usbhs_pipe_disable(pipe); /* disable pipe first */
}
@ -798,10 +828,11 @@ static void xfer_work(struct work_struct *work)
dev_dbg(dev, " %s %d (%d/ %d)\n",
fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero);
usbhs_pipe_running(pipe, 1);
usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
usbhs_pipe_enable(pipe);
usbhsf_dma_start(pipe, fifo);
dma_async_issue_pending(chan);
usbhsf_dma_start(pipe, fifo);
usbhs_pipe_enable(pipe);
}
/*
@ -829,6 +860,10 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
if ((uintptr_t)(pkt->buf + pkt->actual) & 0x7) /* 8byte alignment */
goto usbhsf_pio_prepare_push;
/* return at this time if the pipe is running */
if (usbhs_pipe_is_running(pipe))
return 0;
/* get enable DMA fifo */
fifo = usbhsf_get_dma_fifo(priv, pkt);
if (!fifo)
@ -866,6 +901,7 @@ static int usbhsf_dma_push_done(struct usbhs_pkt *pkt, int *is_done)
pkt->actual = pkt->trans;
*is_done = !pkt->zero; /* send zero packet ? */
usbhs_pipe_running(pipe, !*is_done);
usbhsf_dma_stop(pipe, pipe->fifo);
usbhsf_dma_unmap(pkt);
@ -966,8 +1002,10 @@ static int usbhsf_dma_pop_done(struct usbhs_pkt *pkt, int *is_done)
if ((pkt->actual == pkt->length) || /* receive all data */
(pkt->trans < maxp)) { /* short packet */
*is_done = 1;
usbhs_pipe_running(pipe, 0);
} else {
/* re-enable */
usbhs_pipe_running(pipe, 0);
usbhsf_prepare_pop(pkt, is_done);
}

13
drivers/usb/renesas_usbhs/pipe.c
View File

@ -578,6 +578,19 @@ int usbhs_pipe_is_dir_host(struct usbhs_pipe *pipe)
return usbhsp_flags_has(pipe, IS_DIR_HOST);
}
int usbhs_pipe_is_running(struct usbhs_pipe *pipe)
{
return usbhsp_flags_has(pipe, IS_RUNNING);
}
void usbhs_pipe_running(struct usbhs_pipe *pipe, int running)
{
if (running)
usbhsp_flags_set(pipe, IS_RUNNING);
else
usbhsp_flags_clr(pipe, IS_RUNNING);
}
void usbhs_pipe_data_sequence(struct usbhs_pipe *pipe, int sequence)
{
u16 mask = (SQCLR | SQSET);

4
drivers/usb/renesas_usbhs/pipe.h
View File

@ -36,6 +36,7 @@ struct usbhs_pipe {
#define USBHS_PIPE_FLAGS_IS_USED (1 << 0)
#define USBHS_PIPE_FLAGS_IS_DIR_IN (1 << 1)
#define USBHS_PIPE_FLAGS_IS_DIR_HOST (1 << 2)
#define USBHS_PIPE_FLAGS_IS_RUNNING (1 << 3)
struct usbhs_pkt_handle *handler;
@ -79,6 +80,9 @@ int usbhs_pipe_probe(struct usbhs_priv *priv);
void usbhs_pipe_remove(struct usbhs_priv *priv);
int usbhs_pipe_is_dir_in(struct usbhs_pipe *pipe);
int usbhs_pipe_is_dir_host(struct usbhs_pipe *pipe);
int usbhs_pipe_is_running(struct usbhs_pipe *pipe);
void usbhs_pipe_running(struct usbhs_pipe *pipe, int running);
void usbhs_pipe_init(struct usbhs_priv *priv,
int (*dma_map_ctrl)(struct usbhs_pkt *pkt, int map));
int usbhs_pipe_get_maxpacket(struct usbhs_pipe *pipe);

1
drivers/usb/serial/console.c
View File

@ -188,6 +188,7 @@ static int usb_console_setup(struct console *co, char *options)
kfree(tty);
reset_open_count:
port->port.count = 0;
info->port = NULL;
usb_autopm_put_interface(serial->interface);
error_get_interface:
usb_serial_put(serial);

4
fs/btrfs/ioctl.c
View File

@ -2974,6 +2974,10 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
ret = PTR_ERR(new_root);
goto out;
}
if (!is_fstree(new_root->objectid)) {
ret = -ENOENT;
goto out;
}
if (btrfs_root_refs(&new_root->root_item) == 0) {
ret = -ENOENT;

4
fs/direct-io.c
View File

@ -774,7 +774,8 @@ out:
*/
if (sdio->boundary) {
ret = dio_send_cur_page(dio, sdio, map_bh);
dio_bio_submit(dio, sdio);
if (sdio->bio)
dio_bio_submit(dio, sdio);
page_cache_release(sdio->cur_page);
sdio->cur_page = NULL;
}
@ -948,6 +949,7 @@ do_holes:
i_size_aligned >> blkbits) {
/* We hit eof */
page_cache_release(page);
dio_cleanup(dio, sdio);
goto out;
}
zero_user(page, block_in_page << blkbits,

57
fs/ext4/file.c
View File

@ -325,47 +325,27 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
num = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
(pgoff_t)num);
if (nr_pages == 0) {
if (whence == SEEK_DATA)
break;
BUG_ON(whence != SEEK_HOLE);
/*
* If this is the first time to go into the loop and
* offset is not beyond the end offset, it will be a
* hole at this offset
*/
if (lastoff == startoff || lastoff < endoff)
found = 1;
if (nr_pages == 0)
break;
}
/*
* If this is the first time to go into the loop and
* offset is smaller than the first page offset, it will be a
* hole at this offset.
*/
if (lastoff == startoff && whence == SEEK_HOLE &&
lastoff < page_offset(pvec.pages[0])) {
found = 1;
break;
}
for (i = 0; i < nr_pages; i++) {
struct page *page = pvec.pages[i];
struct buffer_head *bh, *head;
/*
* If the current offset is not beyond the end of given
* range, it will be a hole.
* If current offset is smaller than the page offset,
* there is a hole at this offset.
*/
if (lastoff < endoff && whence == SEEK_HOLE &&
page->index > end) {
if (whence == SEEK_HOLE && lastoff < endoff &&
lastoff < page_offset(pvec.pages[i])) {
found = 1;
*offset = lastoff;
goto out;
}
if (page->index > end)
goto out;
lock_page(page);
if (unlikely(page->mapping != inode->i_mapping)) {
@ -382,6 +362,8 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
lastoff = page_offset(page);
bh = head = page_buffers(page);
do {
if (lastoff + bh->b_size <= startoff)
goto next;
if (buffer_uptodate(bh) ||
buffer_unwritten(bh)) {
if (whence == SEEK_DATA)
@ -396,6 +378,7 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
unlock_page(page);
goto out;
}
next:
lastoff += bh->b_size;
bh = bh->b_this_page;
} while (bh != head);
@ -405,20 +388,18 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
unlock_page(page);
}
/*
* The no. of pages is less than our desired, that would be a
* hole in there.
*/
if (nr_pages < num && whence == SEEK_HOLE) {
found = 1;
*offset = lastoff;
/* The no. of pages is less than our desired, we are done. */
if (nr_pages < num)
break;
}
index = pvec.pages[i - 1]->index + 1;
pagevec_release(&pvec);
} while (index <= end);
if (whence == SEEK_HOLE && lastoff < endoff) {
found = 1;
*offset = lastoff;
}
out:
pagevec_release(&pvec);
return found;
@ -440,7 +421,7 @@ static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
mutex_lock(&inode->i_mutex);
isize = i_size_read(inode);
if (offset >= isize) {
if (offset < 0 || offset >= isize) {
mutex_unlock(&inode->i_mutex);
return -ENXIO;
}
@ -523,7 +504,7 @@ static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
mutex_lock(&inode->i_mutex);
isize = i_size_read(inode);
if (offset >= isize) {
if (offset < 0 || offset >= isize) {
mutex_unlock(&inode->i_mutex);
return -ENXIO;
}

7
fs/ext4/inode.c
View File

@ -5061,8 +5061,9 @@ static int ext4_expand_extra_isize(struct inode *inode,
/* No extended attributes present */
if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
new_extra_isize);
memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
EXT4_I(inode)->i_extra_isize, 0,
new_extra_isize - EXT4_I(inode)->i_extra_isize);
EXT4_I(inode)->i_extra_isize = new_extra_isize;
return 0;
}
@ -5113,8 +5114,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
sbi->s_want_extra_isize,
iloc, handle);
if (ret) {
ext4_set_inode_state(inode,
EXT4_STATE_NO_EXPAND);
if (mnt_count !=
le16_to_cpu(sbi->s_es->s_mnt_count)) {
ext4_warning(inode->i_sb,

3
fs/ext4/resize.c
View File

@ -1911,7 +1911,8 @@ retry:
n_desc_blocks = o_desc_blocks +
le16_to_cpu(es->s_reserved_gdt_blocks);
n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb);
n_blocks_count = n_group * EXT4_BLOCKS_PER_GROUP(sb);
n_blocks_count = (ext4_fsblk_t)n_group *
EXT4_BLOCKS_PER_GROUP(sb);
n_group--; /* set to last group number */
}

19
fs/ext4/xattr.c
View File

@ -1258,11 +1258,13 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize);
down_write(&EXT4_I(inode)->xattr_sem);
/*
* Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty
*/
ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
retry:
if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
up_write(&EXT4_I(inode)->xattr_sem);
return 0;
}
if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
goto out;
header = IHDR(inode, raw_inode);
entry = IFIRST(header);
@ -1287,8 +1289,7 @@ retry:
(void *)header, total_ino,
inode->i_sb->s_blocksize);
EXT4_I(inode)->i_extra_isize = new_extra_isize;
error = 0;
goto cleanup;
goto out;
}
/*
@ -1454,6 +1455,8 @@ retry:
kfree(bs);
}
brelse(bh);
out:
ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
up_write(&EXT4_I(inode)->xattr_sem);
return 0;
@ -1465,6 +1468,10 @@ cleanup:
kfree(is);
kfree(bs);
brelse(bh);
/*
* We deliberately leave EXT4_STATE_NO_EXPAND set here since inode
* size expansion failed.
*/
up_write(&EXT4_I(inode)->xattr_sem);
return error;
}

7
fs/fscache/object-list.c
View File

@ -338,6 +338,13 @@ static void fscache_objlist_config(struct fscache_objlist_data *data)
rcu_read_lock();
confkey = key->payload.data;
if (!confkey) {
/* key was revoked */
rcu_read_unlock();
key_put(key);
goto no_config;
}
buf = confkey->data;
for (len = confkey->datalen - 1; len >= 0; len--) {

2
fs/fuse/file.c
View File

@ -65,7 +65,7 @@ struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
{
struct fuse_file *ff;
ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL);
if (unlikely(!ff))
return NULL;

4
fs/udf/inode.c
View File

@ -1237,8 +1237,8 @@ int udf_setsize(struct inode *inode, loff_t newsize)
return err;
}
set_size:
truncate_setsize(inode, newsize);
up_write(&iinfo->i_data_sem);
truncate_setsize(inode, newsize);
} else {
if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
down_write(&iinfo->i_data_sem);
@ -1255,9 +1255,9 @@ set_size:
udf_get_block);
if (err)
return err;
truncate_setsize(inode, newsize);
down_write(&iinfo->i_data_sem);
udf_clear_extent_cache(inode);
truncate_setsize(inode, newsize);
udf_truncate_extents(inode);
up_write(&iinfo->i_data_sem);
}

2
include/linux/key.h
View File

@ -171,6 +171,7 @@ struct key {
#define KEY_FLAG_NEGATIVE 5 /* set if key is negative */
#define KEY_FLAG_ROOT_CAN_CLEAR 6 /* set if key can be cleared by root without permission */
#define KEY_FLAG_INVALIDATED 7 /* set if key has been invalidated */
#define KEY_FLAG_UID_KEYRING 11 /* set if key is a user or user session keyring */
/* the description string
* - this is used to match a key against search criteria
@ -212,6 +213,7 @@ extern struct key *key_alloc(struct key_type *type,
#define KEY_ALLOC_IN_QUOTA 0x0000 /* add to quota, reject if would overrun */
#define KEY_ALLOC_QUOTA_OVERRUN 0x0001 /* add to quota, permit even if overrun */
#define KEY_ALLOC_NOT_IN_QUOTA 0x0002 /* not in quota */
#define KEY_ALLOC_UID_KEYRING 0x0010 /* allocating a user or user session keyring */
extern void key_revoke(struct key *key);
extern void key_invalidate(struct key *key);

4
include/linux/workqueue.h
View File

@ -306,6 +306,7 @@ enum {
__WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */
__WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */
__WQ_ORDERED_EXPLICIT = 1 << 18, /* internal: alloc_ordered_workqueue() */
WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */
WQ_MAX_UNBOUND_PER_CPU = 4, /* 4 * #cpus for unbound wq */
@ -408,7 +409,8 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active,
* Pointer to the allocated workqueue on success, %NULL on failure.
*/
#define alloc_ordered_workqueue(fmt, flags, args...) \
alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | (flags), 1, ##args)
alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | \
__WQ_ORDERED_EXPLICIT | (flags), 1, ##args)
#define create_workqueue(name) \
alloc_workqueue((name), WQ_MEM_RECLAIM, 1)

1
include/net/ipv6.h
View File

@ -849,6 +849,7 @@ extern int inet6_hash_connect(struct inet_timewait_death_row *death_row,
*/
extern const struct proto_ops inet6_stream_ops;
extern const struct proto_ops inet6_dgram_ops;
extern const struct proto_ops inet6_sockraw_ops;
struct group_source_req;
struct group_filter;

3
include/net/iw_handler.h
View File

@ -551,7 +551,8 @@ iwe_stream_add_point(struct iw_request_info *info, char *stream, char *ends,
memcpy(stream + lcp_len,
((char *) &iwe->u) + IW_EV_POINT_OFF,
IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
memcpy(stream + point_len, extra, iwe->u.data.length);
if (iwe->u.data.length && extra)
memcpy(stream + point_len, extra, iwe->u.data.length);
stream += event_len;
}
return stream;

4
include/net/sctp/sctp.h
View File

@ -555,6 +555,8 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
#define _sctp_walk_params(pos, chunk, end, member)\
for (pos.v = chunk->member;\
(pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\
(void *)chunk + end) &&\
pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
pos.v += WORD_ROUND(ntohs(pos.p->length)))
@ -565,6 +567,8 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length))
#define _sctp_walk_errors(err, chunk_hdr, end)\
for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
sizeof(sctp_chunkhdr_t));\
((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\
(void *)chunk_hdr + end) &&\
(void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
ntohs(err->length) >= sizeof(sctp_errhdr_t); \
err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))

6
include/net/sctp/ulpevent.h
View File

@ -143,8 +143,12 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event);
static inline int sctp_ulpevent_type_enabled(__u16 sn_type,
struct sctp_event_subscribe *mask)
{
int offset = sn_type - SCTP_SN_TYPE_BASE;
char *amask = (char *) mask;
return amask[sn_type - SCTP_SN_TYPE_BASE];
if (offset >= sizeof(struct sctp_event_subscribe))
return 0;
return amask[offset];
}
/* Given an event subscription, is this event enabled? */

10
include/net/tcp.h
View File

@ -1611,4 +1611,14 @@ struct tcp_request_sock_ops {
extern void tcp_v4_init(void);
extern void tcp_init(void);
/* At how many jiffies into the future should the RTO fire? */
static inline s32 tcp_rto_delta(const struct sock *sk)
{
const struct sk_buff *skb = tcp_write_queue_head(sk);
const u32 rto = inet_csk(sk)->icsk_rto;
const u32 rto_time_stamp = TCP_SKB_CB(skb)->when + rto;
return (s32)(rto_time_stamp - tcp_time_stamp);
}
#endif /* _TCP_H */

1
include/target/target_core_base.h
View File

@ -729,6 +729,7 @@ struct se_port_stat_grps {
struct se_lun {
#define SE_LUN_LINK_MAGIC 0xffff7771
u32 lun_link_magic;
bool lun_shutdown;
/* See transport_lun_status_table */
enum transport_lun_status_table lun_status;
u32 lun_access;

2
kernel/extable.c
View File

@ -66,7 +66,7 @@ static inline int init_kernel_text(unsigned long addr)
return 0;
}
int core_kernel_text(unsigned long addr)
int notrace core_kernel_text(unsigned long addr)
{
if (addr >= (unsigned long)_stext &&
addr <= (unsigned long)_etext)

12
kernel/trace/trace.c
View File

@ -3068,11 +3068,17 @@ static int tracing_open(struct inode *inode, struct file *file)
/* If this file was open for write, then erase contents */
if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC)) {
int cpu = tracing_get_cpu(inode);
struct trace_buffer *trace_buf = &tr->trace_buffer;
#ifdef CONFIG_TRACER_MAX_TRACE
if (tr->current_trace->print_max)
trace_buf = &tr->max_buffer;
#endif
if (cpu == RING_BUFFER_ALL_CPUS)
tracing_reset_online_cpus(&tr->trace_buffer);
tracing_reset_online_cpus(trace_buf);
else
tracing_reset(&tr->trace_buffer, cpu);
tracing_reset(trace_buf, cpu);
}
if (file->f_mode & FMODE_READ) {
@ -4664,7 +4670,7 @@ static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
tracing_reset_online_cpus(&tr->trace_buffer);
#ifdef CONFIG_TRACER_MAX_TRACE
if (tr->flags & TRACE_ARRAY_FL_GLOBAL && tr->max_buffer.buffer)
if (tr->max_buffer.buffer)
ring_buffer_set_clock(tr->max_buffer.buffer, trace_clocks[i].func);
tracing_reset_online_cpus(&tr->max_buffer);
#endif

23
kernel/workqueue.c
View File

@ -3398,7 +3398,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
* attributes breaks ordering guarantee. Disallow exposing ordered
* workqueues.
*/
if (WARN_ON(wq->flags & __WQ_ORDERED))
if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
return -EINVAL;
wq->wq_dev = wq_dev = kzalloc(sizeof(*wq_dev), GFP_KERNEL);
@ -3963,8 +3963,12 @@ int apply_workqueue_attrs(struct workqueue_struct *wq,
return -EINVAL;
/* creating multiple pwqs breaks ordering guarantee */
if (WARN_ON((wq->flags & __WQ_ORDERED) && !list_empty(&wq->pwqs)))
return -EINVAL;
if (!list_empty(&wq->pwqs)) {
if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
return -EINVAL;
wq->flags &= ~__WQ_ORDERED;
}
pwq_tbl = kzalloc(wq_numa_tbl_len * sizeof(pwq_tbl[0]), GFP_KERNEL);
new_attrs = alloc_workqueue_attrs(GFP_KERNEL);
@ -4212,6 +4216,16 @@ struct workqueue_struct *__alloc_workqueue_key(const char *fmt,
struct workqueue_struct *wq;
struct pool_workqueue *pwq;
/*
* Unbound && max_active == 1 used to imply ordered, which is no
* longer the case on NUMA machines due to per-node pools. While
* alloc_ordered_workqueue() is the right way to create an ordered
* workqueue, keep the previous behavior to avoid subtle breakages
* on NUMA.
*/
if ((flags & WQ_UNBOUND) && max_active == 1)
flags |= __WQ_ORDERED;
/* allocate wq and format name */
if (flags & WQ_UNBOUND)
tbl_size = wq_numa_tbl_len * sizeof(wq->numa_pwq_tbl[0]);
@ -4400,13 +4414,14 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
struct pool_workqueue *pwq;
/* disallow meddling with max_active for ordered workqueues */
if (WARN_ON(wq->flags & __WQ_ORDERED))
if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
return;
max_active = wq_clamp_max_active(max_active, wq->flags, wq->name);
mutex_lock(&wq->mutex);
wq->flags &= ~__WQ_ORDERED;
wq->saved_max_active = max_active;
for_each_pwq(pwq, wq)

6
lib/cmdline.c
View File

@ -22,14 +22,14 @@
* the values[M, M+1, ..., N] into the ints array in get_options.
*/
static int get_range(char **str, int *pint)
static int get_range(char **str, int *pint, int n)
{
int x, inc_counter, upper_range;
(*str)++;
upper_range = simple_strtol((*str), NULL, 0);
inc_counter = upper_range - *pint;
for (x = *pint; x < upper_range; x++)
for (x = *pint; n && x < upper_range; x++, n--)
*pint++ = x;
return inc_counter;
}
@ -95,7 +95,7 @@ char *get_options(const char *str, int nints, int *ints)
break;
if (res == 3) {
int range_nums;
range_nums = get_range((char **)&str, ints + i);
range_nums = get_range((char **)&str, ints + i, nints - i);
if (range_nums < 0)
break;
/*

6
lib/digsig.c
View File

@ -86,6 +86,12 @@ static int digsig_verify_rsa(struct key *key,
down_read(&key->sem);
ukp = key->payload.data;
if (!ukp) {
/* key was revoked before we acquired its semaphore */
err = -EKEYREVOKED;
goto err1;
}
if (ukp->datalen < sizeof(*pkh))
goto err1;

3
net/8021q/vlan.c
View File

@ -274,7 +274,8 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
return 0;
out_free_newdev:
free_netdev(new_dev);
if (new_dev->reg_state == NETREG_UNINITIALIZED)
free_netdev(new_dev);
return err;
}

4
net/bluetooth/bnep/core.c
View File

@ -32,6 +32,7 @@
#include <asm/unaligned.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/l2cap.h>
#include <net/bluetooth/hci_core.h>
#include "bnep.h"
@ -539,6 +540,9 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
BT_DBG("");
if (!l2cap_is_socket(sock))
return -EBADFD;
baswap((void *) dst, &bt_sk(sock->sk)->dst);
baswap((void *) src, &bt_sk(sock->sk)->src);

3
net/bluetooth/cmtp/core.c
View File

@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
BT_DBG("");
if (!l2cap_is_socket(sock))
return -EBADFD;
session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
if (!session)
return -ENOMEM;

21
net/core/dev.c
View File

@ -2342,9 +2342,10 @@ EXPORT_SYMBOL(skb_mac_gso_segment);
static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
{
if (tx_path)
return skb->ip_summed != CHECKSUM_PARTIAL;
else
return skb->ip_summed == CHECKSUM_NONE;
return skb->ip_summed != CHECKSUM_PARTIAL &&
skb->ip_summed != CHECKSUM_NONE;
return skb->ip_summed == CHECKSUM_NONE;
}
/**
@ -2361,11 +2362,12 @@ static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
netdev_features_t features, bool tx_path)
{
struct sk_buff *segs;
if (unlikely(skb_needs_check(skb, tx_path))) {
int err;
skb_warn_bad_offload(skb);
/* We're going to init ->check field in TCP or UDP header */
if (skb_header_cloned(skb) &&
(err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
return ERR_PTR(err);
@ -2375,7 +2377,12 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
skb_reset_mac_header(skb);
skb_reset_mac_len(skb);
return skb_mac_gso_segment(skb, features);
segs = skb_mac_gso_segment(skb, features);
if (unlikely(skb_needs_check(skb, tx_path)))
skb_warn_bad_offload(skb);
return segs;
}
EXPORT_SYMBOL(__skb_gso_segment);
@ -5636,7 +5643,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
} else {
netdev_stats_to_stats64(storage, &dev->stats);
}
storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
storage->rx_dropped += (unsigned long)atomic_long_read(&dev->rx_dropped);
return storage;
}
EXPORT_SYMBOL(dev_get_stats);

2
net/core/sock.c
View File

@ -1492,6 +1492,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
sock_copy(newsk, sk);
newsk->sk_prot_creator = sk->sk_prot;
/* SANITY */
get_net(sock_net(newsk));
sk_node_init(&newsk->sk_node);

2
net/ipv4/af_inet.c
View File

@ -1071,7 +1071,7 @@ static struct inet_protosw inetsw_array[] =
.type = SOCK_DGRAM,
.protocol = IPPROTO_ICMP,
.prot = &ping_prot,
.ops = &inet_dgram_ops,
.ops = &inet_sockraw_ops,
.no_check = UDP_CSUM_DEFAULT,
.flags = INET_PROTOSW_REUSE,
},

9
net/ipv4/fib_frontend.c
View File

@ -1175,13 +1175,14 @@ static struct pernet_operations fib_net_ops = {
void __init ip_fib_init(void)
{
rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
fib_trie_init();
register_pernet_subsys(&fib_net_ops);
register_netdevice_notifier(&fib_netdev_notifier);
register_inetaddr_notifier(&fib_inetaddr_notifier);
fib_trie_init();
rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
}

7
net/ipv4/ip_output.c
View File

@ -846,10 +846,12 @@ static int __ip_append_data(struct sock *sk,
csummode = CHECKSUM_PARTIAL;
cork->length += length;
if (((length > mtu) || (skb && skb_has_frags(skb))) &&
if ((skb && skb_has_frags(skb)) ||
((length > mtu) &&
(skb_queue_len(queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
(sk->sk_type == SOCK_DGRAM)) {
(sk->sk_type == SOCK_DGRAM))) {
err = ip_ufo_append_data(sk, queue, getfrag, from, length,
hh_len, fragheaderlen, transhdrlen,
maxfraglen, flags);
@ -1160,6 +1162,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
cork->length += size;
if ((size + skb->len > mtu) &&
(skb_queue_len(&sk->sk_write_queue) == 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->dst.dev->features & NETIF_F_UFO)) {
skb_shinfo(skb)->gso_size = mtu - fragheaderlen;

1
net/ipv4/netfilter/nf_nat_snmp_basic.c
View File

@ -1305,6 +1305,7 @@ static int __init nf_nat_snmp_basic_init(void)
static void __exit nf_nat_snmp_basic_fini(void)
{
RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
synchronize_rcu();
nf_conntrack_helper_unregister(&snmp_trap_helper);
}

6
net/ipv4/tcp.c
View File

@ -2336,9 +2336,15 @@ int tcp_disconnect(struct sock *sk, int flags)
tcp_set_ca_state(sk, TCP_CA_Open);
tcp_clear_retrans(tp);
inet_csk_delack_init(sk);
/* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
* issue in __tcp_select_window()
*/
icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
tcp_init_send_head(sk);
memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
__sk_dst_reset(sk);
dst_release(sk->sk_rx_dst);
sk->sk_rx_dst = NULL;
WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);

Some files were not shown because too many files have changed in this diff Show More