diff --git a/.elts/config.yaml b/.elts/config.yaml index 90612c7fd1db..dde8bf91c918 100644 --- a/.elts/config.yaml +++ b/.elts/config.yaml @@ -1,5 +1,5 @@ upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git upstream_base: 4.19.304 base: 4.14.336 -upstream_version: 4.19.317 -version: 4.14.350 +upstream_version: 4.19.318 +version: 4.14.351 diff --git a/.elts/meta/4.14.351.yaml b/.elts/meta/4.14.351.yaml new file mode 100644 index 000000000000..5e5da4d4ddfe --- /dev/null +++ b/.elts/meta/4.14.351.yaml @@ -0,0 +1,222 @@ +a29d61e7e8e578fd6bc893e3fc566de319821ca5: + title: 'media: dvb: as102-fe: Fix as10x_register_addr packing' + mainline: 309422d280748c74f57f471559980268ac27732a + upstream: 86b769452b39428807f287ff5bb5aaf6fbfb7e9c +763d3cd7f083891a68cf5158c5bab81bb5e8be0f: + title: 'media: dvb-usb: dib0700_devices: Add missing release_firmware()' + mainline: 4b267c23ee064bd24c6933df0588ad1b6e111145 + upstream: 213375679632f6ed1e4eb98b78a8f600977b9b34 +f3829e3d794cad5ddb6c88e0ff1b27b6435d224b: + title: 'IB/core: Implement a limit on UMAD receive List' + mainline: ca0b44e20a6f3032224599f02e7c8fb49525c894 + upstream: 1288cf1cceb0e6df276e182f5412370fb4169bcb +8fb8547e74c70ef7ed9af6d75f8b27186d6c1d88: + title: 'media: dw2102: Don''t translate i2c read into write' + mainline: 0e148a522b8453115038193e19ec7bea71403e4a + upstream: 74eb7ec7afe976a499484f56e8af020c3260a559 +fca275dacc79b9d77ec45e208a68284a19515d5f: + title: 'sctp: prefer struct_size over open coded arithmetic' + mainline: e5c5f3596de224422561d48eba6ece5210d967b3 + upstream: 03f37e56305156bd25c5c237d1cc7f5c75495ef2 +b0f4f0d200c9bcb8c14b1f09a288dc89d026fdc3: + title: 'firmware: dmi: Stop decoding on broken entry' + mainline: 0ef11f604503b1862a21597436283f158114d77e + upstream: c2a350a3fa622a174e3704691d05989cdfde4d51 +d2b33d0a14125c60fb7fc2fe60e7305ef606bc7f: + title: 'Input: ff-core - prefer struct_size over open coded arithmetic' + mainline: a08b8f8557ad88ffdff8905e5da972afe52e3307 + upstream: e52cfcf68df0b52565be68106e9f65ab8077b48a +9c1cb2b6cbf9a9e1ee2e9702637c71adc476e874: + title: 'net: dsa: mv88e6xxx: Correct check for empty list' + mainline: 4c7f3950a9fd53a62b156c0fe7c3a2c43b0ba19b + upstream: 47d28dde172696031c880c5778633cdca30394ee +a65c17e8b9fe25ecae58373ddbea9fe06135f193: + title: 'media: dvb-frontends: tda18271c2dd: Remove casting during div' + mainline: e9a844632630e18ed0671a7e3467431bd719952e + upstream: 2401cbc0f5d4bd1e327d247548cc6ee57bc76c53 +909138842fcc6194732efcd7e9d6ab4b9b715600: + title: 'media: s2255: Use refcount_t instead of atomic_t for num_channels' + mainline: 6cff72f6bcee89228a662435b7c47e21a391c8d0 + upstream: 32f2f5385eefa73aaebefda419147ac8599ba9e6 +cf654f32bbef8fd9d7d57d91a3378370a975e85f: + title: 'media: dvb-frontends: tda10048: Fix integer overflow' + mainline: 1aa1329a67cc214c3b7bd2a14d1301a795760b07 + upstream: 8167e4d7dc086d4f7ca7897dcff3827e4d22c99a +f5a529216e877313cde4f8a3fc637c816642e861: + title: 'i2c: i801: Annotate apanel_addr as __ro_after_init' + mainline: 355b1513b1e97b6cef84b786c6480325dfd3753d + upstream: 1a1f7053437d0f27534ecc9ec7e5d441c082b81c +af94a2ea5b6eb5ead8c016a196311449e0e145ac: + title: 'powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n' + mainline: be140f1732b523947425aaafbe2e37b41b622d96 + upstream: 85cc3ecb0b1256d539bb6a58a5f995c802a331c4 +b490b0a094cb6b1e6dc7c79ef9c76213480e03e8: + title: 'orangefs: fix out-of-bounds fsid access' + mainline: 53e4efa470d5fc6a96662d2d3322cfc925818517 + upstream: b90176a9553775e23966650e445b1866e62e4924 +48d99fb324e4d263c533ae24712372138c5cb664: + title: 'powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"' + mainline: 8873aab8646194a4446117bb617cc71bddda2dee + upstream: 04b90b8d0b6929d7427551215b71901959c8e098 +7523a69d10eba34a5bf215bbbf73b02932303c2b: + title: 'jffs2: Fix potential illegal address access in jffs2_free_inode' + mainline: af9a8730ddb6a4b2edd779ccc0aceb994d616830 + upstream: b6c8b3e31eb88c85094d848a0bd8b4bafe67e4d8 +d232297f0376ff857296774d047ced0731895562: + title: 's390/pkey: Wipe sensitive data on failure' + mainline: 1d8c270de5eb74245d72325d285894a577a945d9 + upstream: 6e2e374403bf73140d0efc9541cb1b3bea55ac02 +f1bac5dbfa7aaf5cee717a604ed1c94b363a9883: + title: 'UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()' + mainline: a6458ab7fd4f427d4f6f54380453ad255b7fde83 + upstream: 8b5fd51b3040ce2596d22a72767c66d7435853b6 +f8f32610dabb5c07608475f3cfe4915aa4cd15e5: + title: 'tcp_metrics: validate source addr length' + mainline: 66be40e622e177316ae81717aa30057ba9e61dff + upstream: 19d997b59fa1fd7a02e770ee0881c0652b9c32c9 +ea462f7627ecabdd4263965f5a8864f0ab86d08b: + title: 'bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()' + mainline: e271ff53807e8f2c628758290f0e499dbe51cb3d + upstream: 6a8a4fd082c439e19fede027e80c79bc4c84bb8e +a8987b87ffb8455fddf7b29734f043256d589a34: + title: 'selftests/net: reap zerocopy completions passed up as ancillary data.' +c75d2712b73df3ce9a145395882cee0d56f8916f: + title: 'selftests: fix OOM in msg_zerocopy selftest' + mainline: af2b7e5b741aaae9ffbba2c660def434e07aa241 + upstream: d6ab0198fb470e1a9948d08c610a94601a1fdb2c +3688bfa238e9ea94bff46c0dc030f412f239a08c: + title: 'selftests: make order checking verbose in msg_zerocopy selftest' + mainline: 7d6d8f0c8b700c9493f2839abccb6d29028b4219 + upstream: b1cb48187a6edc2ab72f5b3e6b4af7a232730d64 +600edf70c16cb29b82c9fd1e830398168eea7bca: + title: 'inet_diag: Initialize pad field in struct inet_diag_req_v2' + mainline: 61cf1c739f08190a4cbf047b9fbb192a94d87e3f + upstream: 7094a5fd20ab66028f1da7f06e0f2692d70346f9 +72ae23ea4ee2e943e8d58ad302c6a843dbf80ad0: + title: 'nilfs2: fix inode number range checks' + mainline: e2fec219a36e0993642844be0f345513507031f4 + upstream: 57235c3c88bb430043728d0d02f44a4efe386476 +ba6206b639aa6f1d9ade9cb55831ebc1f7268594: + title: 'nilfs2: add missing check for inode numbers on directory entries' + mainline: bb76c6c274683c8570ad788f79d4b875bde0e458 + upstream: c33c2b0d92aa1c2262d999b2598ad6fbd53bd479 +34096341954fed86e3b510d1c0617470f21bb41d: + title: 'mm: optimize the redundant loop of mm_update_owner_next()' + mainline: cf3f9a593dab87a032d2b6a6fb205e7f3de4f0a1 + upstream: 2890a7faf552dd3e4e40e343610ba3e0ba5b788e +1cbdc455dc33b76a9efdf4694308b2b1c8ea5a21: + title: 'Bluetooth: Fix incorrect pointer arithmatic in ext_adv_report_evt' + mainline: cd9151b618da4723877bd94eae952f2e50acbc0e + upstream: b162f19e6603571061b19dbb604a9883f0fa4ecc +73f492747cfcd09e43ef25970d26c8943ab830ec: + title: 'fsnotify: Do not generate events for O_PATH file descriptors' + mainline: 702eb71fd6501b3566283f8c96d7ccc6ddd662e9 + upstream: b7421cad1d8725831a98b339d7ecbb284dd1c5de +6949c5283758b9d0847b1ce1d461e9c7d2730fa1: + title: 'Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"' + mainline: 30139c702048f1097342a31302cbd3d478f50c63 + upstream: 253f9ea7e8e53a5176bd80ceb174907b10724c1a +c300d28e4079a0046e79ff18bdffb48c7dee3861: + title: 'drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes' + mainline: 80bec6825b19d95ccdfd3393cf8ec15ff2a749b4 + upstream: 9baf60323efa992b7c915094529f0a1882c34e7e +27967cf8362a84f47938fe7ff0ff57c991c858cc: + title: 'drm/amdgpu/atomfirmware: silence UBSAN warning' + mainline: d0417264437a8fa05f894cabba5a26715b32d78e + upstream: 385b615c95df14df68ca8322245c13a9389392f6 +a64eeaefb325e45890fca958151be84cfa53b633: + title: 'bnx2x: Fix multiple UBSAN array-index-out-of-bounds' + mainline: 134061163ee5ca4759de5c24ca3bd71608891ba7 + upstream: cfb04472ce33bee2579caf4dc9f4242522f6e26e +9c6553444512bcd2fdaf2b4153835f19f684f2c4: + title: 'media: dw2102: fix a potential buffer overflow' + mainline: 1c73d0b29d04bf4082e7beb6a508895e118ee30d + upstream: 39fb2a0c2e78d9b2de726be119e6d06e38aa4ed4 +900ede664c5f6c4194cc6a86558c291918c285dd: + title: 'i2c: pnx: move header into the driver' +82043a1a1450176d4a5c5664b05ab1e7bfeed0ee: + title: 'i2c/busses: Convert timers to use timer_setup()' +1921a68ba39c00e508c2b6fdd571d6fdeb6268e4: + title: 'i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr' + mainline: f63b94be6942ba82c55343e196bd09b53227618e + upstream: a349e5ab4dc9954746e836cd10b407ce48f9b2f6 +75fb795f98517dbdb2973414465cffa685d9cd8a: + title: 'nilfs2: fix incorrect inode allocation from reserved inodes' + mainline: 93aef9eda1cea9e84ab2453fcceb8addad0e46f1 + upstream: de9d81daaca2b7b3c853bf2ff729353e84f06b18 +852460760459aec08d18bc7780f254f6f256606d: + title: 'tcp: fix incorrect undo caused by DSACK of TLP retransmit' + mainline: 0ec986ed7bab6801faed1440e8839dcc710331ff + upstream: 83f5eb01c4beb9741bc1600bcd8b6e94a1774abe +95139b5d59c4b6d6c56f39c2b4b4f26e22330000: + title: 'net: lantiq_etop: add blank line after declaration' + mainline: 4c46625bb586a741b8d0e6bdbddbcb2549fa1d36 + upstream: 12d204b835dd85c7fe6501be6ee1aaa1e5315ff9 +ae3b644b836cdcca258294db2569189af4ef7ff3: + title: 'net: ethernet: lantiq_etop: fix double free in detach' + mainline: e1533b6319ab9c3a97dad314dd88b3783bc41b69 + upstream: 1a2db00a554cfda57c397cce79b2804bf9633fec +84f3c0bb96cd91096079828b24b51af408265abe: + title: 'ppp: reject claimed-as-LCP but actually malformed packets' + mainline: f2aeb7306a898e1cbd03963d376f4b6656ca2b55 + upstream: 97d1efd8be26615ff680cdde86937d5943138f37 +4e591539244c71973243bd4315024d601991ee3a: + title: 'ARM: davinci: Convert comma to semicolon' + mainline: acc3815db1a02d654fbc19726ceaadca0d7dd81c + upstream: f9ace6a3278a613d22abbd7d69e13d481b800622 +400d7f0eceb6a1993c04f36ee766abff02f975b8: + title: 'USB: serial: option: add Telit generic core-dump composition' + mainline: 4298e400dbdbf259549d69c349e060652ad53611 + upstream: a88697c3871ade2c9d03437d170af77ec92d2982 +4094a8160b0626b4fc428b2770adcd99652a9117: + title: 'USB: serial: option: add Telit FN912 rmnet compositions' + mainline: 9a590ff283421b71560deded2110dbdcbe1f7d1d + upstream: 908bc2cb55f8affc7a90bb8d17fd4323088e2a19 +01b762bc1225b0a0ffb18638161627cb185ce408: + title: 'USB: serial: option: add Fibocom FM350-GL' + mainline: 2604e08ff251dba330e16b65e80074c9c540aad7 + upstream: de307ab87774c96700fa1831f78f5085255c35f8 +4dd077fc35bd45cb3763b56b29397495aa60e832: + title: 'USB: serial: option: add support for Foxconn T99W651' + mainline: 3c841d54b63e4446383de3238399a3910e47d8e2 + upstream: 9fde2ddfed4787728a20aefea6a625c6b2b32fc4 +e8c421c3e622eec18fb2a723b3801e041094e76b: + title: 'USB: serial: option: add Netprisma LCUK54 series modules' + mainline: dc6dbe3ed28795b01c712ad8f567728f9c14b01d + upstream: 038d9a89fac14fd9855383b2ae990ee755e36bd0 +bb8ef9c34dbad9828e35221d9b93887f81fedf61: + title: 'USB: serial: option: add Rolling RW350-GL variants' + mainline: ae420771551bd9f04347c59744dd062332bdec3e + upstream: 5bc1f4bee4d84245a3479f53aef38f82b99a19f0 +af79b0b19953f31e510d5330cb6d3bb246b096a2: + title: 'USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k' + mainline: 3859e85de30815a20bce7db712ce3d94d40a682d + upstream: 1d1f3d602971bbb8de654e7bbe78bf6c2ebd06c1 +4a1cba1a65533b8f9ece63c774c0bd1d265e14bf: + title: 'usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()' + mainline: 6d3c721e686ea6c59e18289b400cc95c76e927e0 + upstream: a444c3fc264119801575ab086e03fb4952f23fd0 +d60eb2fd2445dd07125d1e450aa4c310d5baf190: + title: 'USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor' + mainline: a368ecde8a5055b627749b09c6218ef793043e47 + upstream: d8418fd083d1b90a6c007cf8dcf81aeae274727b +a43cf7b341011779151d27dd5bc52387d5f5f835: + title: 'hpet: Support 32-bit userspace' + mainline: 4e60131d0d36af65ab9c9144f4f163fe97ae36e8 + upstream: e2cb94465de92f6a840bc7eface420b30cc64aa0 +c618a1f6d3ecaa97aaf0283d9b89824e651bc013: + title: 'libceph: fix race between delayed_work() and ceph_monc_stop()' + mainline: 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883 + upstream: 1177afeca833174ba83504688eec898c6214f4bf +bd19e77de5e3d3c721c8dc55e0d7f1b6a0117279: + title: 'tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()' + mainline: 36534d3c54537bf098224a32dc31397793d4594d + upstream: 0fe6516462392ffe355a45a1ada8d264a783430f +2a8372159bc037d3c15b66659a35ca18a0a61d98: + title: 'nilfs2: fix kernel bug on rename operation of broken directory' + mainline: a9e1ddc09ca55746079cc479aa3eb6411f0d99d4 + upstream: ff9767ba2cb949701e45e6e4287f8af82986b703 +e0aa415e86deeac3ffde591fc5fd5e4a13e9ff23: + title: 'i2c: rcar: bring hardware to known state when probing' + mainline: 4e36c0f20cb1c74c7bd7ea31ba432c1c4a989031 + upstream: a291702b35433e4948476b79c034a21fd2b5ebc8 diff --git a/.elts/upstream/4.19.318.yaml b/.elts/upstream/4.19.318.yaml new file mode 100644 index 000000000000..5a69986912ac --- /dev/null +++ b/.elts/upstream/4.19.318.yaml @@ -0,0 +1,264 @@ +a8a223aa3fb7790168fbf777a8db5bcef011b4dc: + title: 'asm-generic: Move common compat types to asm-generic/compat.h' + mainline: fb3739759474d150a9927b920a80ea2afb4c2a51 + skipped: not stable material +86b769452b39428807f287ff5bb5aaf6fbfb7e9c: + title: 'media: dvb: as102-fe: Fix as10x_register_addr packing' + mainline: 309422d280748c74f57f471559980268ac27732a + backport: a29d61e7e8e578fd6bc893e3fc566de319821ca5 +213375679632f6ed1e4eb98b78a8f600977b9b34: + title: 'media: dvb-usb: dib0700_devices: Add missing release_firmware()' + mainline: 4b267c23ee064bd24c6933df0588ad1b6e111145 + backport: 763d3cd7f083891a68cf5158c5bab81bb5e8be0f +1288cf1cceb0e6df276e182f5412370fb4169bcb: + title: 'IB/core: Implement a limit on UMAD receive List' + mainline: ca0b44e20a6f3032224599f02e7c8fb49525c894 + backport: f3829e3d794cad5ddb6c88e0ff1b27b6435d224b +9eb4db08a808e3a3ba59193aeb84a57a6dc4d8c9: + title: 'drm/amd/display: Skip finding free audio for unknown engine_id' + mainline: 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 + skipped: patched file is not in 4.14.y +74eb7ec7afe976a499484f56e8af020c3260a559: + title: 'media: dw2102: Don''t translate i2c read into write' + mainline: 0e148a522b8453115038193e19ec7bea71403e4a + backport: 8fb8547e74c70ef7ed9af6d75f8b27186d6c1d88 +03f37e56305156bd25c5c237d1cc7f5c75495ef2: + title: 'sctp: prefer struct_size over open coded arithmetic' + mainline: e5c5f3596de224422561d48eba6ece5210d967b3 + backport: fca275dacc79b9d77ec45e208a68284a19515d5f +c2a350a3fa622a174e3704691d05989cdfde4d51: + title: 'firmware: dmi: Stop decoding on broken entry' + mainline: 0ef11f604503b1862a21597436283f158114d77e + backport: b0f4f0d200c9bcb8c14b1f09a288dc89d026fdc3 +e52cfcf68df0b52565be68106e9f65ab8077b48a: + title: 'Input: ff-core - prefer struct_size over open coded arithmetic' + mainline: a08b8f8557ad88ffdff8905e5da972afe52e3307 + backport: d2b33d0a14125c60fb7fc2fe60e7305ef606bc7f +47d28dde172696031c880c5778633cdca30394ee: + title: 'net: dsa: mv88e6xxx: Correct check for empty list' + mainline: 4c7f3950a9fd53a62b156c0fe7c3a2c43b0ba19b + backport: 9c1cb2b6cbf9a9e1ee2e9702637c71adc476e874 +2401cbc0f5d4bd1e327d247548cc6ee57bc76c53: + title: 'media: dvb-frontends: tda18271c2dd: Remove casting during div' + mainline: e9a844632630e18ed0671a7e3467431bd719952e + backport: a65c17e8b9fe25ecae58373ddbea9fe06135f193 +32f2f5385eefa73aaebefda419147ac8599ba9e6: + title: 'media: s2255: Use refcount_t instead of atomic_t for num_channels' + mainline: 6cff72f6bcee89228a662435b7c47e21a391c8d0 + backport: 909138842fcc6194732efcd7e9d6ab4b9b715600 +8167e4d7dc086d4f7ca7897dcff3827e4d22c99a: + title: 'media: dvb-frontends: tda10048: Fix integer overflow' + mainline: 1aa1329a67cc214c3b7bd2a14d1301a795760b07 + backport: cf654f32bbef8fd9d7d57d91a3378370a975e85f +1a1f7053437d0f27534ecc9ec7e5d441c082b81c: + title: 'i2c: i801: Annotate apanel_addr as __ro_after_init' + mainline: 355b1513b1e97b6cef84b786c6480325dfd3753d + backport: f5a529216e877313cde4f8a3fc637c816642e861 +85cc3ecb0b1256d539bb6a58a5f995c802a331c4: + title: 'powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n' + mainline: be140f1732b523947425aaafbe2e37b41b622d96 + backport: af94a2ea5b6eb5ead8c016a196311449e0e145ac +b90176a9553775e23966650e445b1866e62e4924: + title: 'orangefs: fix out-of-bounds fsid access' + mainline: 53e4efa470d5fc6a96662d2d3322cfc925818517 + backport: b490b0a094cb6b1e6dc7c79ef9c76213480e03e8 +04b90b8d0b6929d7427551215b71901959c8e098: + title: 'powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"' + mainline: 8873aab8646194a4446117bb617cc71bddda2dee + backport: 48d99fb324e4d263c533ae24712372138c5cb664 +b6c8b3e31eb88c85094d848a0bd8b4bafe67e4d8: + title: 'jffs2: Fix potential illegal address access in jffs2_free_inode' + mainline: af9a8730ddb6a4b2edd779ccc0aceb994d616830 + backport: 7523a69d10eba34a5bf215bbbf73b02932303c2b +6e2e374403bf73140d0efc9541cb1b3bea55ac02: + title: 's390/pkey: Wipe sensitive data on failure' + mainline: 1d8c270de5eb74245d72325d285894a577a945d9 + backport: d232297f0376ff857296774d047ced0731895562 +0cb018bf9217805f97740fe83261e18199fc2773: + title: 'tcp: take care of compressed acks in tcp_add_reno_sack()' + mainline: 19119f298bb1f2af3bb1093f5f2a1fed8da94e37 + skipped: commit did not cherry-pick cleanly +552970cb728120695820ef9decb0933b3f9ce774: + title: 'tcp: tcp_mark_head_lost is only valid for sack-tcp' + mainline: 636ef28d6e4d174e424102466caf572b0406fb0e + skipped: commit did not cherry-pick cleanly +57a672a35020884512ae64fbbcb5c70149424781: + title: 'tcp: add ece_ack flag to reno sack functions' + mainline: c634e34f6ebfb75259e6ce467523fd3adf30d3d2 + skipped: commit did not cherry-pick cleanly +550968385e2f0df8e29c6431ab2dc0961499acb0: + title: 'net: tcp better handling of reordering then loss cases' + mainline: a29cb6914681a55667436a9eb7a42e28da8cf387 + skipped: commit did not cherry-pick cleanly +8b5fd51b3040ce2596d22a72767c66d7435853b6: + title: 'UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()' + mainline: a6458ab7fd4f427d4f6f54380453ad255b7fde83 + backport: f1bac5dbfa7aaf5cee717a604ed1c94b363a9883 +19d997b59fa1fd7a02e770ee0881c0652b9c32c9: + title: 'tcp_metrics: validate source addr length' + mainline: 66be40e622e177316ae81717aa30057ba9e61dff + backport: f8f32610dabb5c07608475f3cfe4915aa4cd15e5 +6a8a4fd082c439e19fede027e80c79bc4c84bb8e: + title: 'bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()' + mainline: e271ff53807e8f2c628758290f0e499dbe51cb3d + backport: ea462f7627ecabdd4263965f5a8864f0ab86d08b +d6ab0198fb470e1a9948d08c610a94601a1fdb2c: + title: 'selftests: fix OOM in msg_zerocopy selftest' + mainline: af2b7e5b741aaae9ffbba2c660def434e07aa241 + backport: c75d2712b73df3ce9a145395882cee0d56f8916f +b1cb48187a6edc2ab72f5b3e6b4af7a232730d64: + title: 'selftests: make order checking verbose in msg_zerocopy selftest' + mainline: 7d6d8f0c8b700c9493f2839abccb6d29028b4219 + backport: 3688bfa238e9ea94bff46c0dc030f412f239a08c +7094a5fd20ab66028f1da7f06e0f2692d70346f9: + title: 'inet_diag: Initialize pad field in struct inet_diag_req_v2' + mainline: 61cf1c739f08190a4cbf047b9fbb192a94d87e3f + backport: 600edf70c16cb29b82c9fd1e830398168eea7bca +57235c3c88bb430043728d0d02f44a4efe386476: + title: 'nilfs2: fix inode number range checks' + mainline: e2fec219a36e0993642844be0f345513507031f4 + backport: 72ae23ea4ee2e943e8d58ad302c6a843dbf80ad0 +c33c2b0d92aa1c2262d999b2598ad6fbd53bd479: + title: 'nilfs2: add missing check for inode numbers on directory entries' + mainline: bb76c6c274683c8570ad788f79d4b875bde0e458 + backport: ba6206b639aa6f1d9ade9cb55831ebc1f7268594 +2890a7faf552dd3e4e40e343610ba3e0ba5b788e: + title: 'mm: optimize the redundant loop of mm_update_owner_next()' + mainline: cf3f9a593dab87a032d2b6a6fb205e7f3de4f0a1 + backport: 34096341954fed86e3b510d1c0617470f21bb41d +b162f19e6603571061b19dbb604a9883f0fa4ecc: + title: 'Bluetooth: Fix incorrect pointer arithmatic in ext_adv_report_evt' + mainline: cd9151b618da4723877bd94eae952f2e50acbc0e + backport: 1cbdc455dc33b76a9efdf4694308b2b1c8ea5a21 +a7428ec9d7911f1a74da20359063ff265081832a: + title: 'can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct' + mainline: 19d5b2698c35b2132a355c67b4d429053804f8cc + skipped: fixes patch not in branch +b7421cad1d8725831a98b339d7ecbb284dd1c5de: + title: 'fsnotify: Do not generate events for O_PATH file descriptors' + mainline: 702eb71fd6501b3566283f8c96d7ccc6ddd662e9 + backport: 73f492747cfcd09e43ef25970d26c8943ab830ec +253f9ea7e8e53a5176bd80ceb174907b10724c1a: + title: 'Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"' + mainline: 30139c702048f1097342a31302cbd3d478f50c63 + backport: 6949c5283758b9d0847b1ce1d461e9c7d2730fa1 +9baf60323efa992b7c915094529f0a1882c34e7e: + title: 'drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes' + mainline: 80bec6825b19d95ccdfd3393cf8ec15ff2a749b4 + backport: c300d28e4079a0046e79ff18bdffb48c7dee3861 +385b615c95df14df68ca8322245c13a9389392f6: + title: 'drm/amdgpu/atomfirmware: silence UBSAN warning' + mainline: d0417264437a8fa05f894cabba5a26715b32d78e + backport: 27967cf8362a84f47938fe7ff0ff57c991c858cc +cfb04472ce33bee2579caf4dc9f4242522f6e26e: + title: 'bnx2x: Fix multiple UBSAN array-index-out-of-bounds' + mainline: 134061163ee5ca4759de5c24ca3bd71608891ba7 + backport: a64eeaefb325e45890fca958151be84cfa53b633 +39fb2a0c2e78d9b2de726be119e6d06e38aa4ed4: + title: 'media: dw2102: fix a potential buffer overflow' + mainline: 1c73d0b29d04bf4082e7beb6a508895e118ee30d + backport: 9c6553444512bcd2fdaf2b4153835f19f684f2c4 +a349e5ab4dc9954746e836cd10b407ce48f9b2f6: + title: 'i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr' + mainline: f63b94be6942ba82c55343e196bd09b53227618e + backport: 1921a68ba39c00e508c2b6fdd571d6fdeb6268e4 +de9d81daaca2b7b3c853bf2ff729353e84f06b18: + title: 'nilfs2: fix incorrect inode allocation from reserved inodes' + mainline: 93aef9eda1cea9e84ab2453fcceb8addad0e46f1 + backport: 75fb795f98517dbdb2973414465cffa685d9cd8a +f0d7f98ff88c26698296f62fe91d7e7141fe4a47: + title: 'drm/i915: make find_fw_domain work on intel_uncore' + mainline: cb7ee69015aaba5e1091af94e73bc72483c08e37 + skipped: fixes new functionality not in 4.14 +83f5eb01c4beb9741bc1600bcd8b6e94a1774abe: + title: 'tcp: fix incorrect undo caused by DSACK of TLP retransmit' + mainline: 0ec986ed7bab6801faed1440e8839dcc710331ff + backport: 852460760459aec08d18bc7780f254f6f256606d +12d204b835dd85c7fe6501be6ee1aaa1e5315ff9: + title: 'net: lantiq_etop: add blank line after declaration' + mainline: 4c46625bb586a741b8d0e6bdbddbcb2549fa1d36 + backport: 95139b5d59c4b6d6c56f39c2b4b4f26e22330000 +1a2db00a554cfda57c397cce79b2804bf9633fec: + title: 'net: ethernet: lantiq_etop: fix double free in detach' + mainline: e1533b6319ab9c3a97dad314dd88b3783bc41b69 + backport: ae3b644b836cdcca258294db2569189af4ef7ff3 +97d1efd8be26615ff680cdde86937d5943138f37: + title: 'ppp: reject claimed-as-LCP but actually malformed packets' + mainline: f2aeb7306a898e1cbd03963d376f4b6656ca2b55 + backport: 84f3c0bb96cd91096079828b24b51af408265abe +f9ace6a3278a613d22abbd7d69e13d481b800622: + title: 'ARM: davinci: Convert comma to semicolon' + mainline: acc3815db1a02d654fbc19726ceaadca0d7dd81c + backport: 4e591539244c71973243bd4315024d601991ee3a +a88697c3871ade2c9d03437d170af77ec92d2982: + title: 'USB: serial: option: add Telit generic core-dump composition' + mainline: 4298e400dbdbf259549d69c349e060652ad53611 + backport: 400d7f0eceb6a1993c04f36ee766abff02f975b8 +908bc2cb55f8affc7a90bb8d17fd4323088e2a19: + title: 'USB: serial: option: add Telit FN912 rmnet compositions' + mainline: 9a590ff283421b71560deded2110dbdcbe1f7d1d + backport: 4094a8160b0626b4fc428b2770adcd99652a9117 +de307ab87774c96700fa1831f78f5085255c35f8: + title: 'USB: serial: option: add Fibocom FM350-GL' + mainline: 2604e08ff251dba330e16b65e80074c9c540aad7 + backport: 01b762bc1225b0a0ffb18638161627cb185ce408 +9fde2ddfed4787728a20aefea6a625c6b2b32fc4: + title: 'USB: serial: option: add support for Foxconn T99W651' + mainline: 3c841d54b63e4446383de3238399a3910e47d8e2 + backport: 4dd077fc35bd45cb3763b56b29397495aa60e832 +038d9a89fac14fd9855383b2ae990ee755e36bd0: + title: 'USB: serial: option: add Netprisma LCUK54 series modules' + mainline: dc6dbe3ed28795b01c712ad8f567728f9c14b01d + backport: e8c421c3e622eec18fb2a723b3801e041094e76b +5bc1f4bee4d84245a3479f53aef38f82b99a19f0: + title: 'USB: serial: option: add Rolling RW350-GL variants' + mainline: ae420771551bd9f04347c59744dd062332bdec3e + backport: bb8ef9c34dbad9828e35221d9b93887f81fedf61 +1d1f3d602971bbb8de654e7bbe78bf6c2ebd06c1: + title: 'USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k' + mainline: 3859e85de30815a20bce7db712ce3d94d40a682d + backport: af79b0b19953f31e510d5330cb6d3bb246b096a2 +a444c3fc264119801575ab086e03fb4952f23fd0: + title: 'usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()' + mainline: 6d3c721e686ea6c59e18289b400cc95c76e927e0 + backport: 4a1cba1a65533b8f9ece63c774c0bd1d265e14bf +d8418fd083d1b90a6c007cf8dcf81aeae274727b: + title: 'USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor' + mainline: a368ecde8a5055b627749b09c6218ef793043e47 + backport: d60eb2fd2445dd07125d1e450aa4c310d5baf190 +e2cb94465de92f6a840bc7eface420b30cc64aa0: + title: 'hpet: Support 32-bit userspace' + mainline: 4e60131d0d36af65ab9c9144f4f163fe97ae36e8 + backport: a43cf7b341011779151d27dd5bc52387d5f5f835 +1177afeca833174ba83504688eec898c6214f4bf: + title: 'libceph: fix race between delayed_work() and ceph_monc_stop()' + mainline: 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883 + backport: c618a1f6d3ecaa97aaf0283d9b89824e651bc013 +e5a1f7427f97bde4bda73c02106c3bde87696f8f: + title: 'tcp: refactor tcp_retransmit_timer()' + mainline: 0d580fbd2db084a5c96ee9c00492236a279d5e0f + skipped: squashed into 6d9175b95504d28045909631514d06660b4b1a9a +faa0a1fc2a0bb510b2381a5c7aa5b46e9a83d64a: + title: 'net: tcp: fix unexcepted socket die when snd_wnd is 0' + mainline: e89688e3e97868451a5d05b38a9d2633d6785cd4 + skipped: commit is already present in branch +0fe6516462392ffe355a45a1ada8d264a783430f: + title: 'tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()' + mainline: 36534d3c54537bf098224a32dc31397793d4594d + backport: bd19e77de5e3d3c721c8dc55e0d7f1b6a0117279 +7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4: + title: 'tcp: avoid too many retransmit packets' + mainline: 97a9063518f198ec0adb2ecb89789de342bb8283 + skipped: fixes patch not in branch +17866066b8ac1cc38fb449670bc15dc9fee4b40a: + title: 'SUNRPC: Fix RPC client cleaned up the freed pipefs dentries' + mainline: bfca5fb4e97c46503ddfc582335917b0cc228264 + skipped: commit is already present in branch +ff9767ba2cb949701e45e6e4287f8af82986b703: + title: 'nilfs2: fix kernel bug on rename operation of broken directory' + mainline: a9e1ddc09ca55746079cc479aa3eb6411f0d99d4 + backport: 2a8372159bc037d3c15b66659a35ca18a0a61d98 +a291702b35433e4948476b79c034a21fd2b5ebc8: + title: 'i2c: rcar: bring hardware to known state when probing' + mainline: 4e36c0f20cb1c74c7bd7ea31ba432c1c4a989031 + backport: e0aa415e86deeac3ffde591fc5fd5e4a13e9ff23 diff --git a/Makefile b/Makefile index 3d74348fc8bc..afa323f6ee29 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 14 -SUBLEVEL = 350 +SUBLEVEL = 351 EXTRAVERSION = -openela NAME = Petit Gorille diff --git a/arch/arm/mach-davinci/pm.c b/arch/arm/mach-davinci/pm.c index b5cc05dc2cb2..ef078ce01db7 100644 --- a/arch/arm/mach-davinci/pm.c +++ b/arch/arm/mach-davinci/pm.c @@ -65,7 +65,7 @@ static void davinci_pm_suspend(void) /* Configure sleep count in deep sleep register */ val = __raw_readl(pm_config.deepsleep_reg); - val &= ~DEEPSLEEP_SLEEPCOUNT_MASK, + val &= ~DEEPSLEEP_SLEEPCOUNT_MASK; val |= pm_config.sleepcount; __raw_writel(val, pm_config.deepsleep_reg); diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h index e057e0236843..eaaaf54e095f 100644 --- a/arch/powerpc/include/asm/io.h +++ b/arch/powerpc/include/asm/io.h @@ -49,7 +49,7 @@ extern struct pci_dev *isa_bridge_pcidev; * define properly based on the platform */ #ifndef CONFIG_PCI -#define _IO_BASE 0 +#define _IO_BASE POISON_POINTER_DELTA #define _ISA_MEM_BASE 0 #define PCI_DRAM_OFFSET 0 #elif defined(CONFIG_PPC32) diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c index 0885993b2fb4..fe3351c65da9 100644 --- a/arch/powerpc/xmon/xmon.c +++ b/arch/powerpc/xmon/xmon.c @@ -1119,7 +1119,7 @@ static int cpu_cmd(void) unsigned long cpu, first_cpu, last_cpu; int timeout; - if (!scanhex(&cpu)) { + if (!scanhex(&cpu) || cpu >= num_possible_cpus()) { /* print cpus waiting or in xmon */ printf("cpus stopped:"); last_cpu = first_cpu = NR_CPUS; @@ -2426,7 +2426,7 @@ static void dump_pacas(void) termch = c; /* Put c back, it wasn't 'a' */ - if (scanhex(&num)) + if (scanhex(&num) && num < num_possible_cpus()) dump_one_paca(num); else dump_one_paca(xmon_owner); @@ -2509,7 +2509,7 @@ static void dump_xives(void) termch = c; /* Put c back, it wasn't 'a' */ - if (scanhex(&num)) + if (scanhex(&num) && num < num_possible_cpus()) dump_one_xive(num); else dump_one_xive(xmon_owner); diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c index b9935675085c..63f643cc8dc4 100644 --- a/drivers/char/hpet.c +++ b/drivers/char/hpet.c @@ -307,8 +307,13 @@ hpet_read(struct file *file, char __user *buf, size_t count, loff_t * ppos) if (!devp->hd_ireqfreq) return -EIO; - if (count < sizeof(unsigned long)) - return -EINVAL; + if (in_compat_syscall()) { + if (count < sizeof(compat_ulong_t)) + return -EINVAL; + } else { + if (count < sizeof(unsigned long)) + return -EINVAL; + } add_wait_queue(&devp->hd_waitqueue, &wait); @@ -332,9 +337,16 @@ hpet_read(struct file *file, char __user *buf, size_t count, loff_t * ppos) schedule(); } - retval = put_user(data, (unsigned long __user *)buf); - if (!retval) - retval = sizeof(unsigned long); + if (in_compat_syscall()) { + retval = put_user(data, (compat_ulong_t __user *)buf); + if (!retval) + retval = sizeof(compat_ulong_t); + } else { + retval = put_user(data, (unsigned long __user *)buf); + if (!retval) + retval = sizeof(unsigned long); + } + out: __set_current_state(TASK_RUNNING); remove_wait_queue(&devp->hd_waitqueue, &wait); @@ -691,12 +703,24 @@ struct compat_hpet_info { unsigned short hi_timer; }; +/* 32-bit types would lead to different command codes which should be + * translated into 64-bit ones before passed to hpet_ioctl_common + */ +#define COMPAT_HPET_INFO _IOR('h', 0x03, struct compat_hpet_info) +#define COMPAT_HPET_IRQFREQ _IOW('h', 0x6, compat_ulong_t) + static long hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { struct hpet_info info; int err; + if (cmd == COMPAT_HPET_INFO) + cmd = HPET_INFO; + + if (cmd == COMPAT_HPET_IRQFREQ) + cmd = HPET_IRQFREQ; + mutex_lock(&hpet_mutex); err = hpet_ioctl_common(file->private_data, cmd, arg, &info); mutex_unlock(&hpet_mutex); diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c index 4d5a1f6451eb..982c833bd9ec 100644 --- a/drivers/firmware/dmi_scan.c +++ b/drivers/firmware/dmi_scan.c @@ -99,6 +99,17 @@ static void dmi_decode_table(u8 *buf, (data - buf + sizeof(struct dmi_header)) <= dmi_len) { const struct dmi_header *dm = (const struct dmi_header *)data; + /* + * If a short entry is found (less than 4 bytes), not only it + * is invalid, but we cannot reliably locate the next entry. + */ + if (dm->length < sizeof(struct dmi_header)) { + pr_warn(FW_BUG + "Corrupted DMI table, offset %zd (only %d entries processed)\n", + data - buf, i); + break; + } + /* * We want to know the total length (formatted area and * strings) before decoding to make sure we won't run off the diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h index 837296db9628..50a1fb8c1c5a 100644 --- a/drivers/gpu/drm/amd/include/atomfirmware.h +++ b/drivers/gpu/drm/amd/include/atomfirmware.h @@ -594,7 +594,7 @@ struct atom_gpio_pin_lut_v2_1 { struct atom_common_table_header table_header; /*the real number of this included in the structure is calcualted by using the (whole structure size - the header size)/size of atom_gpio_pin_lut */ - struct atom_gpio_pin_assignment gpio_pin[8]; + struct atom_gpio_pin_assignment gpio_pin[]; }; diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c index ce0985993f09..8fccc209f507 100644 --- a/drivers/gpu/drm/nouveau/nouveau_connector.c +++ b/drivers/gpu/drm/nouveau/nouveau_connector.c @@ -958,6 +958,9 @@ nouveau_connector_get_modes(struct drm_connector *connector) struct drm_display_mode *mode; mode = drm_mode_duplicate(dev, nv_connector->native_mode); + if (!mode) + return 0; + drm_mode_probed_add(connector, mode); ret = 1; } diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c index 12f23962ce0e..d2c6da8cfc4e 100644 --- a/drivers/i2c/busses/i2c-i801.c +++ b/drivers/i2c/busses/i2c-i801.c @@ -1032,7 +1032,7 @@ static const struct pci_device_id i801_ids[] = { MODULE_DEVICE_TABLE(pci, i801_ids); #if defined CONFIG_X86 && defined CONFIG_DMI -static unsigned char apanel_addr; +static unsigned char apanel_addr __ro_after_init; /* Scan the system ROM for the signature "FJKEYINF" */ static __init const void __iomem *bios_signature(const void __iomem *bios) diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c index eb1d91b986fd..823b0b33b2cb 100644 --- a/drivers/i2c/busses/i2c-img-scb.c +++ b/drivers/i2c/busses/i2c-img-scb.c @@ -826,9 +826,9 @@ static unsigned int img_i2c_atomic(struct img_i2c *i2c, * Timer function to check if something has gone wrong in automatic mode (so we * don't have to handle so many interrupts just to catch an exception). */ -static void img_i2c_check_timer(unsigned long arg) +static void img_i2c_check_timer(struct timer_list *t) { - struct img_i2c *i2c = (struct img_i2c *)arg; + struct img_i2c *i2c = from_timer(i2c, t, check_timer); unsigned long flags; unsigned int line_status; @@ -1362,8 +1362,7 @@ static int img_i2c_probe(struct platform_device *pdev) } /* Set up the exception check timer */ - setup_timer(&i2c->check_timer, img_i2c_check_timer, - (unsigned long)i2c); + timer_setup(&i2c->check_timer, img_i2c_check_timer, 0); i2c->bitrate = timings[0].max_bitrate; if (!of_property_read_u32(node, "clock-frequency", &val)) diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c index 42d6b3a226f8..4d09665a72e5 100644 --- a/drivers/i2c/busses/i2c-pnx.c +++ b/drivers/i2c/busses/i2c-pnx.c @@ -15,10 +15,8 @@ #include #include #include -#include #include #include -#include #include #include #include @@ -29,6 +27,25 @@ #define I2C_PNX_SPEED_KHZ_DEFAULT 100 #define I2C_PNX_REGION_SIZE 0x100 +struct i2c_pnx_mif { + int ret; /* Return value */ + int mode; /* Interface mode */ + struct completion complete; /* I/O completion */ + u8 * buf; /* Data buffer */ + int len; /* Length of data buffer */ + int order; /* RX Bytes to order via TX */ +}; + +struct i2c_pnx_algo_data { + void __iomem *ioaddr; + struct i2c_pnx_mif mif; + int last; + struct clk *clk; + struct i2c_adapter adapter; + int irq; + u32 timeout; +}; + enum { mstatus_tdi = 0x00000001, mstatus_afi = 0x00000002, @@ -98,25 +115,6 @@ static inline int wait_reset(struct i2c_pnx_algo_data *data) return (timeout <= 0); } -static inline void i2c_pnx_arm_timer(struct i2c_pnx_algo_data *alg_data) -{ - struct timer_list *timer = &alg_data->mif.timer; - unsigned long expires = msecs_to_jiffies(alg_data->timeout); - - if (expires <= 1) - expires = 2; - - del_timer_sync(timer); - - dev_dbg(&alg_data->adapter.dev, "Timer armed at %lu plus %lu jiffies.\n", - jiffies, expires); - - timer->expires = jiffies + expires; - timer->data = (unsigned long)alg_data; - - add_timer(timer); -} - /** * i2c_pnx_start - start a device * @slave_addr: slave address @@ -241,8 +239,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data) ~(mcntrl_afie | mcntrl_naie | mcntrl_drmie), I2C_REG_CTL(alg_data)); - del_timer_sync(&alg_data->mif.timer); - dev_dbg(&alg_data->adapter.dev, "%s(): Waking up xfer routine.\n", __func__); @@ -258,8 +254,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data) ~(mcntrl_afie | mcntrl_naie | mcntrl_drmie), I2C_REG_CTL(alg_data)); - /* Stop timer. */ - del_timer_sync(&alg_data->mif.timer); dev_dbg(&alg_data->adapter.dev, "%s(): Waking up xfer routine after zero-xfer.\n", __func__); @@ -346,8 +340,6 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data) mcntrl_drmie | mcntrl_daie); iowrite32(ctl, I2C_REG_CTL(alg_data)); - /* Kill timer. */ - del_timer_sync(&alg_data->mif.timer); complete(&alg_data->mif.complete); } } @@ -382,8 +374,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id) mcntrl_drmie); iowrite32(ctl, I2C_REG_CTL(alg_data)); - /* Stop timer, to prevent timeout. */ - del_timer_sync(&alg_data->mif.timer); complete(&alg_data->mif.complete); } else if (stat & mstatus_nai) { /* Slave did not acknowledge, generate a STOP */ @@ -401,8 +391,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id) /* Our return value. */ alg_data->mif.ret = -EIO; - /* Stop timer, to prevent timeout. */ - del_timer_sync(&alg_data->mif.timer); complete(&alg_data->mif.complete); } else { /* @@ -435,9 +423,8 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id) return IRQ_HANDLED; } -static void i2c_pnx_timeout(unsigned long data) +static void i2c_pnx_timeout(struct i2c_pnx_algo_data *alg_data) { - struct i2c_pnx_algo_data *alg_data = (struct i2c_pnx_algo_data *)data; u32 ctl; dev_err(&alg_data->adapter.dev, @@ -454,7 +441,6 @@ static void i2c_pnx_timeout(unsigned long data) iowrite32(ctl, I2C_REG_CTL(alg_data)); wait_reset(alg_data); alg_data->mif.ret = -EIO; - complete(&alg_data->mif.complete); } static inline void bus_reset_if_active(struct i2c_pnx_algo_data *alg_data) @@ -496,6 +482,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) struct i2c_msg *pmsg; int rc = 0, completed = 0, i; struct i2c_pnx_algo_data *alg_data = adap->algo_data; + unsigned long time_left; u32 stat; dev_dbg(&alg_data->adapter.dev, @@ -530,7 +517,6 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) dev_dbg(&alg_data->adapter.dev, "%s(): mode %d, %d bytes\n", __func__, alg_data->mif.mode, alg_data->mif.len); - i2c_pnx_arm_timer(alg_data); /* initialize the completion var */ init_completion(&alg_data->mif.complete); @@ -546,7 +532,10 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) break; /* Wait for completion */ - wait_for_completion(&alg_data->mif.complete); + time_left = wait_for_completion_timeout(&alg_data->mif.complete, + alg_data->timeout); + if (time_left == 0) + i2c_pnx_timeout(alg_data); if (!(rc = alg_data->mif.ret)) completed++; @@ -639,7 +628,10 @@ static int i2c_pnx_probe(struct platform_device *pdev) alg_data->adapter.algo_data = alg_data; alg_data->adapter.nr = pdev->id; - alg_data->timeout = I2C_PNX_TIMEOUT_DEFAULT; + alg_data->timeout = msecs_to_jiffies(I2C_PNX_TIMEOUT_DEFAULT); + if (alg_data->timeout <= 1) + alg_data->timeout = 2; + #ifdef CONFIG_OF alg_data->adapter.dev.of_node = of_node_get(pdev->dev.of_node); if (pdev->dev.of_node) { @@ -659,9 +651,6 @@ static int i2c_pnx_probe(struct platform_device *pdev) if (IS_ERR(alg_data->clk)) return PTR_ERR(alg_data->clk); - setup_timer(&alg_data->mif.timer, i2c_pnx_timeout, - (unsigned long)alg_data); - snprintf(alg_data->adapter.name, sizeof(alg_data->adapter.name), "%s", pdev->name); diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c index d5d0809a6283..682f9b0731f8 100644 --- a/drivers/i2c/busses/i2c-rcar.c +++ b/drivers/i2c/busses/i2c-rcar.c @@ -173,6 +173,14 @@ static void rcar_i2c_init(struct rcar_i2c_priv *priv) rcar_i2c_write(priv, ICCCR, priv->icccr); } +static void rcar_i2c_reset_slave(struct rcar_i2c_priv *priv) +{ + rcar_i2c_write(priv, ICSIER, 0); + rcar_i2c_write(priv, ICSSR, 0); + rcar_i2c_write(priv, ICSCR, SDBS); + rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ +} + static int rcar_i2c_bus_barrier(struct rcar_i2c_priv *priv) { int i; @@ -818,11 +826,8 @@ static int rcar_unreg_slave(struct i2c_client *slave) /* ensure no irq is running before clearing ptr */ disable_irq(priv->irq); - rcar_i2c_write(priv, ICSIER, 0); - rcar_i2c_write(priv, ICSSR, 0); + rcar_i2c_reset_slave(priv); enable_irq(priv->irq); - rcar_i2c_write(priv, ICSCR, SDBS); - rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ priv->slave = NULL; @@ -919,7 +924,9 @@ static int rcar_i2c_probe(struct platform_device *pdev) if (ret < 0) goto out_pm_put; - rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ + /* Bring hardware to known state */ + rcar_i2c_init(priv); + rcar_i2c_reset_slave(priv); if (priv->devtype == I2C_RCAR_GEN3) { priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c index a3aab7d55ad4..6fe02f350b04 100644 --- a/drivers/infiniband/core/user_mad.c +++ b/drivers/infiniband/core/user_mad.c @@ -60,6 +60,8 @@ MODULE_AUTHOR("Roland Dreier"); MODULE_DESCRIPTION("InfiniBand userspace MAD packet access"); MODULE_LICENSE("Dual BSD/GPL"); +#define MAX_UMAD_RECV_LIST_SIZE 200000 + enum { IB_UMAD_MAX_PORTS = 64, IB_UMAD_MAX_AGENTS = 32, @@ -108,6 +110,7 @@ struct ib_umad_file { struct mutex mutex; struct ib_umad_port *port; struct list_head recv_list; + atomic_t recv_list_size; struct list_head send_list; struct list_head port_list; spinlock_t send_lock; @@ -160,24 +163,28 @@ static struct ib_mad_agent *__get_agent(struct ib_umad_file *file, int id) return file->agents_dead ? NULL : file->agent[id]; } -static int queue_packet(struct ib_umad_file *file, - struct ib_mad_agent *agent, - struct ib_umad_packet *packet) +static int queue_packet(struct ib_umad_file *file, struct ib_mad_agent *agent, + struct ib_umad_packet *packet, bool is_recv_mad) { int ret = 1; mutex_lock(&file->mutex); + if (is_recv_mad && + atomic_read(&file->recv_list_size) > MAX_UMAD_RECV_LIST_SIZE) + goto unlock; + for (packet->mad.hdr.id = 0; packet->mad.hdr.id < IB_UMAD_MAX_AGENTS; packet->mad.hdr.id++) if (agent == __get_agent(file, packet->mad.hdr.id)) { list_add_tail(&packet->list, &file->recv_list); + atomic_inc(&file->recv_list_size); wake_up_interruptible(&file->recv_wait); ret = 0; break; } - +unlock: mutex_unlock(&file->mutex); return ret; @@ -204,7 +211,7 @@ static void send_handler(struct ib_mad_agent *agent, if (send_wc->status == IB_WC_RESP_TIMEOUT_ERR) { packet->length = IB_MGMT_MAD_HDR; packet->mad.hdr.status = ETIMEDOUT; - if (!queue_packet(file, agent, packet)) + if (!queue_packet(file, agent, packet, false)) return; } kfree(packet); @@ -260,7 +267,7 @@ static void recv_handler(struct ib_mad_agent *agent, packet->mad.hdr.flow_label = cpu_to_be32(grh->flow_label); } - if (queue_packet(file, agent, packet)) + if (queue_packet(file, agent, packet, true)) goto err2; return; @@ -374,6 +381,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf, packet = list_entry(file->recv_list.next, struct ib_umad_packet, list); list_del(&packet->list); + atomic_dec(&file->recv_list_size); mutex_unlock(&file->mutex); @@ -386,6 +394,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf, /* Requeue packet */ mutex_lock(&file->mutex); list_add(&packet->list, &file->recv_list); + atomic_inc(&file->recv_list_size); mutex_unlock(&file->mutex); } else { if (packet->recv_wc) diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c index 66a46c84e28f..7d83de2c536d 100644 --- a/drivers/input/ff-core.c +++ b/drivers/input/ff-core.c @@ -24,8 +24,10 @@ /* #define DEBUG */ #include +#include #include #include +#include #include #include @@ -330,9 +332,8 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects) return -EINVAL; } - ff_dev_size = sizeof(struct ff_device) + - max_effects * sizeof(struct file *); - if (ff_dev_size < max_effects) /* overflow */ + ff_dev_size = struct_size(ff, effect_owners, max_effects); + if (ff_dev_size == SIZE_MAX) /* overflow */ return -EINVAL; ff = kzalloc(ff_dev_size, GFP_KERNEL); diff --git a/drivers/media/dvb-frontends/as102_fe_types.h b/drivers/media/dvb-frontends/as102_fe_types.h index 80a5398b580f..661d7574a6c7 100644 --- a/drivers/media/dvb-frontends/as102_fe_types.h +++ b/drivers/media/dvb-frontends/as102_fe_types.h @@ -183,6 +183,6 @@ struct as10x_register_addr { uint32_t addr; /* register mode access */ uint8_t mode; -}; +} __packed; #endif diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c index a75f86ca5318..8ad7fb4a77cf 100644 --- a/drivers/media/dvb-frontends/tda10048.c +++ b/drivers/media/dvb-frontends/tda10048.c @@ -422,6 +422,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) struct tda10048_config *config = &state->config; int i; u32 if_freq_khz; + u64 sample_freq; dprintk(1, "%s(bw = %d)\n", __func__, bw); @@ -463,9 +464,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor); /* Calculate the sample frequency */ - state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45); - state->sample_freq /= (state->pll_nfactor + 1); - state->sample_freq /= (state->pll_pfactor + 4); + sample_freq = state->xtal_hz; + sample_freq *= state->pll_mfactor + 45; + do_div(sample_freq, state->pll_nfactor + 1); + do_div(sample_freq, state->pll_pfactor + 4); + state->sample_freq = sample_freq; dprintk(1, "- sample_freq = %d\n", state->sample_freq); /* Update the I/F */ diff --git a/drivers/media/dvb-frontends/tda18271c2dd.c b/drivers/media/dvb-frontends/tda18271c2dd.c index 2d2778be2d2f..eedea109b6dc 100644 --- a/drivers/media/dvb-frontends/tda18271c2dd.c +++ b/drivers/media/dvb-frontends/tda18271c2dd.c @@ -345,7 +345,7 @@ static int CalcMainPLL(struct tda_state *state, u32 freq) OscFreq = (u64) freq * (u64) Div; OscFreq *= (u64) 16384; - do_div(OscFreq, (u64)16000000); + do_div(OscFreq, 16000000); MainDiv = OscFreq; state->m_Regs[MPD] = PostDiv & 0x77; @@ -369,7 +369,7 @@ static int CalcCalPLL(struct tda_state *state, u32 freq) OscFreq = (u64)freq * (u64)Div; /* CalDiv = u32( OscFreq * 16384 / 16000000 ); */ OscFreq *= (u64)16384; - do_div(OscFreq, (u64)16000000); + do_div(OscFreq, 16000000); CalDiv = OscFreq; state->m_Regs[CPD] = PostDiv; diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c index 969358f57d91..0a65884cefe3 100644 --- a/drivers/media/usb/dvb-usb/dib0700_devices.c +++ b/drivers/media/usb/dvb-usb/dib0700_devices.c @@ -2423,7 +2423,12 @@ static int stk9090m_frontend_attach(struct dvb_usb_adapter *adap) adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &stk9090m_config); - return adap->fe_adap[0].fe == NULL ? -ENODEV : 0; + if (!adap->fe_adap[0].fe) { + release_firmware(state->frontend_firmware); + return -ENODEV; + } + + return 0; } static int dib9090_tuner_attach(struct dvb_usb_adapter *adap) @@ -2496,8 +2501,10 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap) dib9000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, 0x80); adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &nim9090md_config[0]); - if (adap->fe_adap[0].fe == NULL) + if (!adap->fe_adap[0].fe) { + release_firmware(state->frontend_firmware); return -ENODEV; + } i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_3_4, 0); dib9000_i2c_enumeration(i2c, 1, 0x12, 0x82); @@ -2505,7 +2512,12 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap) fe_slave = dvb_attach(dib9000_attach, i2c, 0x82, &nim9090md_config[1]); dib9000_set_slave_frontend(adap->fe_adap[0].fe, fe_slave); - return fe_slave == NULL ? -ENODEV : 0; + if (!fe_slave) { + release_firmware(state->frontend_firmware); + return -ENODEV; + } + + return 0; } static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap) diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c index ef2218810471..0e9b9e25f032 100644 --- a/drivers/media/usb/dvb-usb/dw2102.c +++ b/drivers/media/usb/dvb-usb/dw2102.c @@ -721,6 +721,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], { struct dvb_usb_device *d = i2c_get_adapdata(adap); struct dw2102_state *state; + int j; if (!d) return -ENODEV; @@ -734,11 +735,11 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], return -EAGAIN; } - switch (num) { - case 1: - switch (msg[0].addr) { + j = 0; + while (j < num) { + switch (msg[j].addr) { case SU3000_STREAM_CTRL: - state->data[0] = msg[0].buf[0] + 0x36; + state->data[0] = msg[j].buf[0] + 0x36; state->data[1] = 3; state->data[2] = 0; if (dvb_usb_generic_rw(d, state->data, 3, @@ -750,61 +751,86 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], if (dvb_usb_generic_rw(d, state->data, 1, state->data, 2, 0) < 0) err("i2c transfer failed."); - msg[0].buf[1] = state->data[0]; - msg[0].buf[0] = state->data[1]; + msg[j].buf[1] = state->data[0]; + msg[j].buf[0] = state->data[1]; break; default: - if (3 + msg[0].len > sizeof(state->data)) { - warn("i2c wr: len=%d is too big!\n", - msg[0].len); + /* if the current write msg is followed by a another + * read msg to/from the same address + */ + if ((j+1 < num) && (msg[j+1].flags & I2C_M_RD) && + (msg[j].addr == msg[j+1].addr)) { + /* join both i2c msgs to one usb read command */ + if (4 + msg[j].len > sizeof(state->data)) { + warn("i2c combined wr/rd: write len=%d is too big!\n", + msg[j].len); + num = -EOPNOTSUPP; + break; + } + if (1 + msg[j+1].len > sizeof(state->data)) { + warn("i2c combined wr/rd: read len=%d is too big!\n", + msg[j+1].len); + num = -EOPNOTSUPP; + break; + } + + state->data[0] = 0x09; + state->data[1] = msg[j].len; + state->data[2] = msg[j+1].len; + state->data[3] = msg[j].addr; + memcpy(&state->data[4], msg[j].buf, msg[j].len); + + if (dvb_usb_generic_rw(d, state->data, msg[j].len + 4, + state->data, msg[j+1].len + 1, 0) < 0) + err("i2c transfer failed."); + + memcpy(msg[j+1].buf, &state->data[1], msg[j+1].len); + j++; + break; + } + + if (msg[j].flags & I2C_M_RD) { + /* single read */ + if (4 + msg[j].len > sizeof(state->data)) { + warn("i2c rd: len=%d is too big!\n", msg[j].len); + num = -EOPNOTSUPP; + break; + } + + state->data[0] = 0x09; + state->data[1] = 0; + state->data[2] = msg[j].len; + state->data[3] = msg[j].addr; + memcpy(&state->data[4], msg[j].buf, msg[j].len); + + if (dvb_usb_generic_rw(d, state->data, 4, + state->data, msg[j].len + 1, 0) < 0) + err("i2c transfer failed."); + + memcpy(msg[j].buf, &state->data[1], msg[j].len); + break; + } + + /* single write */ + if (3 + msg[j].len > sizeof(state->data)) { + warn("i2c wr: len=%d is too big!\n", msg[j].len); num = -EOPNOTSUPP; break; } - /* always i2c write*/ state->data[0] = 0x08; - state->data[1] = msg[0].addr; - state->data[2] = msg[0].len; + state->data[1] = msg[j].addr; + state->data[2] = msg[j].len; - memcpy(&state->data[3], msg[0].buf, msg[0].len); + memcpy(&state->data[3], msg[j].buf, msg[j].len); - if (dvb_usb_generic_rw(d, state->data, msg[0].len + 3, + if (dvb_usb_generic_rw(d, state->data, msg[j].len + 3, state->data, 1, 0) < 0) err("i2c transfer failed."); + } // switch + j++; - } - break; - case 2: - /* always i2c read */ - if (4 + msg[0].len > sizeof(state->data)) { - warn("i2c rd: len=%d is too big!\n", - msg[0].len); - num = -EOPNOTSUPP; - break; - } - if (1 + msg[1].len > sizeof(state->data)) { - warn("i2c rd: len=%d is too big!\n", - msg[1].len); - num = -EOPNOTSUPP; - break; - } - - state->data[0] = 0x09; - state->data[1] = msg[0].len; - state->data[2] = msg[1].len; - state->data[3] = msg[0].addr; - memcpy(&state->data[4], msg[0].buf, msg[0].len); - - if (dvb_usb_generic_rw(d, state->data, msg[0].len + 4, - state->data, msg[1].len + 1, 0) < 0) - err("i2c transfer failed."); - - memcpy(msg[1].buf, &state->data[1], msg[1].len); - break; - default: - warn("more than 2 i2c messages at a time is not handled yet."); - break; - } + } // while mutex_unlock(&d->data_mutex); mutex_unlock(&d->i2c_mutex); return num; diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c index 08106d3866b4..b7fedf0e6f9e 100644 --- a/drivers/media/usb/s2255/s2255drv.c +++ b/drivers/media/usb/s2255/s2255drv.c @@ -256,7 +256,7 @@ struct s2255_vc { struct s2255_dev { struct s2255_vc vc[MAX_CHANNELS]; struct v4l2_device v4l2_dev; - atomic_t num_channels; + refcount_t num_channels; int frames; struct mutex lock; /* channels[].vdev.lock */ struct mutex cmdlock; /* protects cmdbuf */ @@ -1581,11 +1581,11 @@ static void s2255_video_device_release(struct video_device *vdev) container_of(vdev, struct s2255_vc, vdev); dprintk(dev, 4, "%s, chnls: %d\n", __func__, - atomic_read(&dev->num_channels)); + refcount_read(&dev->num_channels)); v4l2_ctrl_handler_free(&vc->hdl); - if (atomic_dec_and_test(&dev->num_channels)) + if (refcount_dec_and_test(&dev->num_channels)) s2255_destroy(dev); return; } @@ -1688,7 +1688,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev) "failed to register video device!\n"); break; } - atomic_inc(&dev->num_channels); + refcount_inc(&dev->num_channels); v4l2_info(&dev->v4l2_dev, "V4L2 device registered as %s\n", video_device_node_name(&vc->vdev)); @@ -1696,11 +1696,11 @@ static int s2255_probe_v4l(struct s2255_dev *dev) pr_info("Sensoray 2255 V4L driver Revision: %s\n", S2255_VERSION); /* if no channels registered, return error and probe will fail*/ - if (atomic_read(&dev->num_channels) == 0) { + if (refcount_read(&dev->num_channels) == 0) { v4l2_device_unregister(&dev->v4l2_dev); return ret; } - if (atomic_read(&dev->num_channels) != MAX_CHANNELS) + if (refcount_read(&dev->num_channels) != MAX_CHANNELS) pr_warn("s2255: Not all channels available.\n"); return 0; } @@ -2250,7 +2250,7 @@ static int s2255_probe(struct usb_interface *interface, goto errorFWDATA1; } - atomic_set(&dev->num_channels, 0); + refcount_set(&dev->num_channels, 0); dev->pid = id->idProduct; dev->fw_data = kzalloc(sizeof(struct s2255_fw), GFP_KERNEL); if (!dev->fw_data) @@ -2370,12 +2370,12 @@ static void s2255_disconnect(struct usb_interface *interface) { struct s2255_dev *dev = to_s2255_dev(usb_get_intfdata(interface)); int i; - int channels = atomic_read(&dev->num_channels); + int channels = refcount_read(&dev->num_channels); mutex_lock(&dev->lock); v4l2_device_disconnect(&dev->v4l2_dev); mutex_unlock(&dev->lock); /*see comments in the uvc_driver.c usb disconnect function */ - atomic_inc(&dev->num_channels); + refcount_inc(&dev->num_channels); /* unregister each video device. */ for (i = 0; i < channels; i++) video_unregister_device(&dev->vc[i].vdev); @@ -2388,7 +2388,7 @@ static void s2255_disconnect(struct usb_interface *interface) dev->vc[i].vidstatus_ready = 1; wake_up(&dev->vc[i].wait_vidstatus); } - if (atomic_dec_and_test(&dev->num_channels)) + if (refcount_dec_and_test(&dev->num_channels)) s2255_destroy(dev); dev_info(&interface->dev, "%s\n", __func__); } diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c index 1e81b1cafae3..d7dbbe356ab7 100644 --- a/drivers/net/bonding/bond_options.c +++ b/drivers/net/bonding/bond_options.c @@ -1074,9 +1074,9 @@ static int bond_option_arp_ip_targets_set(struct bonding *bond, __be32 target; if (newval->string) { - if (!in4_pton(newval->string+1, -1, (u8 *)&target, -1, NULL)) { - netdev_err(bond->dev, "invalid ARP target %pI4 specified\n", - &target); + if (strlen(newval->string) < 1 || + !in4_pton(newval->string + 1, -1, (u8 *)&target, -1, NULL)) { + netdev_err(bond->dev, "invalid ARP target specified\n"); return ret; } if (newval->string[0] == '+') diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 0f64fc3759f3..863b25fe11aa 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -227,8 +227,8 @@ struct mii_bus *mv88e6xxx_default_mdio_bus(struct mv88e6xxx_chip *chip) { struct mv88e6xxx_mdio_bus *mdio_bus; - mdio_bus = list_first_entry(&chip->mdios, struct mv88e6xxx_mdio_bus, - list); + mdio_bus = list_first_entry_or_null(&chip->mdios, + struct mv88e6xxx_mdio_bus, list); if (!mdio_bus) return NULL; diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h index d17a5c911524..554e97183d58 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h @@ -1252,7 +1252,7 @@ enum { struct bnx2x_fw_stats_req { struct stats_query_header hdr; - struct stats_query_entry query[FP_SB_MAX_E1x+ + struct stats_query_entry query[FP_SB_MAX_E2 + BNX2X_FIRST_QUEUE_QUERY_IDX]; }; diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c index 2a14520e4798..17a59919f000 100644 --- a/drivers/net/ethernet/lantiq_etop.c +++ b/drivers/net/ethernet/lantiq_etop.c @@ -221,8 +221,9 @@ ltq_etop_free_channel(struct net_device *dev, struct ltq_etop_chan *ch) if (ch->dma.irq) free_irq(ch->dma.irq, priv); if (IS_RX(ch->idx)) { - int desc; - for (desc = 0; desc < LTQ_DESC_NUM; desc++) + struct ltq_dma_channel *dma = &ch->dma; + + for (dma->desc = 0; dma->desc < LTQ_DESC_NUM; dma->desc++) dev_kfree_skb_any(ch->skb[ch->dma.desc]); } } diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c index e8e2826af5b2..aea154ef45e2 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -73,6 +73,7 @@ #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */ #define PPP_PROTO_LEN 2 +#define PPP_LCP_HDRLEN 4 /* * An instance of /dev/ppp can be associated with either a ppp @@ -494,6 +495,15 @@ static ssize_t ppp_read(struct file *file, char __user *buf, return ret; } +static bool ppp_check_packet(struct sk_buff *skb, size_t count) +{ + /* LCP packets must include LCP header which 4 bytes long: + * 1-byte code, 1-byte identifier, and 2-byte length. + */ + return get_unaligned_be16(skb->data) != PPP_LCP || + count >= PPP_PROTO_LEN + PPP_LCP_HDRLEN; +} + static ssize_t ppp_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { @@ -516,6 +526,11 @@ static ssize_t ppp_write(struct file *file, const char __user *buf, kfree_skb(skb); goto out; } + ret = -EINVAL; + if (unlikely(!ppp_check_packet(skb, count))) { + kfree_skb(skb); + goto out; + } switch (pf->kind) { case INTERFACE: diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index bd0376dc7e1e..5b6ad4f295e9 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1088,7 +1088,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucs, &kcs, sizeof(kcs))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcs, sizeof(kcs)); break; } @@ -1119,7 +1119,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucp, &kcp, sizeof(kcp))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcp, sizeof(kcp)); break; } diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 73c8546c194f..146d733ded7e 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -291,6 +291,20 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, if (ifp->desc.bNumEndpoints >= num_ep) goto skip_to_next_endpoint_or_interface_descriptor; + /* Save a copy of the descriptor and use it instead of the original */ + endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; + memcpy(&endpoint->desc, d, n); + d = &endpoint->desc; + + /* Clear the reserved bits in bEndpointAddress */ + i = d->bEndpointAddress & + (USB_ENDPOINT_DIR_MASK | USB_ENDPOINT_NUMBER_MASK); + if (i != d->bEndpointAddress) { + dev_notice(ddev, "config %d interface %d altsetting %d has an endpoint descriptor with address 0x%X, changing to 0x%X\n", + cfgno, inum, asnum, d->bEndpointAddress, i); + endpoint->desc.bEndpointAddress = i; + } + /* Check for duplicate endpoint addresses */ if (config_endpoint_is_duplicate(config, inum, asnum, d)) { dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", @@ -308,10 +322,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, } } - endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; + /* Accept this endpoint */ ++ifp->desc.bNumEndpoints; - - memcpy(&endpoint->desc, d, n); INIT_LIST_HEAD(&endpoint->urb_list); /* diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c index 158adcee0e8e..5f7089a06c8c 100644 --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -313,6 +313,9 @@ static const struct usb_device_id usb_quirk_list[] = { { USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT | USB_QUIRK_DELAY_CTRL_MSG }, + /* START BP-850k Printer */ + { USB_DEVICE(0x1bc3, 0x0003), .driver_info = USB_QUIRK_NO_SET_INTF }, + /* MIDI keyboard WORLDE MINI */ { USB_DEVICE(0x1c75, 0x0204), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index db9088c70958..42b58a3fb984 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -156,9 +156,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > USB_MAX_STRING_LEN) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; if (copy) { str = copy; diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index 69d367f29f1f..d058580cd5c2 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1428,6 +1428,10 @@ static const struct usb_device_id option_ids[] = { .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ .driver_info = NCTRL(0) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3000, 0xff), /* Telit FN912 */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3001, 0xff), /* Telit FN912 */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff), /* Telit LE910-S1 (RNDIS) */ .driver_info = NCTRL(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */ @@ -1436,6 +1440,8 @@ static const struct usb_device_id option_ids[] = { .driver_info = NCTRL(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */ .driver_info = NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x9000, 0xff), /* Telit generic core-dump device */ + .driver_info = NCTRL(0) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ .driver_info = NCTRL(0) | ZLP }, { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ @@ -2227,6 +2233,10 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7126, 0xff, 0x00, 0x00), + .driver_info = NCTRL(2) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00), + .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) }, { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), .driver_info = RSVD(1) | RSVD(4) }, @@ -2286,6 +2296,8 @@ static const struct usb_device_id option_ids[] = { .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ + .driver_info = RSVD(5) | RSVD(6) }, { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ @@ -2323,6 +2335,32 @@ static const struct usb_device_id option_ids[] = { .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for Global SKU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for China SKU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for SA */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for EU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for NA */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for China EDU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Golbal EDU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) }, diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c index 9a9f30eddbbb..93a533c4b15e 100644 --- a/fs/jffs2/super.c +++ b/fs/jffs2/super.c @@ -63,6 +63,7 @@ static void jffs2_i_init_once(void *foo) struct jffs2_inode_info *f = foo; mutex_init(&f->sem); + f->target = NULL; inode_init_once(&f->vfs_inode); } diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c index 459575a1e56d..40cdd0f96798 100644 --- a/fs/nilfs2/alloc.c +++ b/fs/nilfs2/alloc.c @@ -386,11 +386,12 @@ void *nilfs_palloc_block_get_entry(const struct inode *inode, __u64 nr, * @target: offset number of an entry in the group (start point) * @bsize: size in bits * @lock: spin lock protecting @bitmap + * @wrap: whether to wrap around */ static int nilfs_palloc_find_available_slot(unsigned char *bitmap, unsigned long target, unsigned int bsize, - spinlock_t *lock) + spinlock_t *lock, bool wrap) { int pos, end = bsize; @@ -406,6 +407,8 @@ static int nilfs_palloc_find_available_slot(unsigned char *bitmap, end = target; } + if (!wrap) + return -ENOSPC; /* wrap around */ for (pos = 0; pos < end; pos++) { @@ -504,9 +507,10 @@ int nilfs_palloc_count_max_entries(struct inode *inode, u64 nused, u64 *nmaxp) * nilfs_palloc_prepare_alloc_entry - prepare to allocate a persistent object * @inode: inode of metadata file using this allocator * @req: nilfs_palloc_req structure exchanged for the allocation + * @wrap: whether to wrap around */ int nilfs_palloc_prepare_alloc_entry(struct inode *inode, - struct nilfs_palloc_req *req) + struct nilfs_palloc_req *req, bool wrap) { struct buffer_head *desc_bh, *bitmap_bh; struct nilfs_palloc_group_desc *desc; @@ -525,7 +529,7 @@ int nilfs_palloc_prepare_alloc_entry(struct inode *inode, entries_per_group = nilfs_palloc_entries_per_group(inode); for (i = 0; i < ngroups; i += n) { - if (group >= ngroups) { + if (group >= ngroups && wrap) { /* wrap around */ group = 0; maxgroup = nilfs_palloc_group(inode, req->pr_entry_nr, @@ -550,7 +554,13 @@ int nilfs_palloc_prepare_alloc_entry(struct inode *inode, bitmap = bitmap_kaddr + bh_offset(bitmap_bh); pos = nilfs_palloc_find_available_slot( bitmap, group_offset, - entries_per_group, lock); + entries_per_group, lock, wrap); + /* + * Since the search for a free slot in the + * second and subsequent bitmap blocks always + * starts from the beginning, the wrap flag + * only has an effect on the first search. + */ if (pos >= 0) { /* found a free entry */ nilfs_palloc_group_desc_add_entries( diff --git a/fs/nilfs2/alloc.h b/fs/nilfs2/alloc.h index 05149e606a78..af2580650346 100644 --- a/fs/nilfs2/alloc.h +++ b/fs/nilfs2/alloc.h @@ -59,8 +59,8 @@ struct nilfs_palloc_req { struct buffer_head *pr_entry_bh; }; -int nilfs_palloc_prepare_alloc_entry(struct inode *, - struct nilfs_palloc_req *); +int nilfs_palloc_prepare_alloc_entry(struct inode *inode, + struct nilfs_palloc_req *req, bool wrap); void nilfs_palloc_commit_alloc_entry(struct inode *, struct nilfs_palloc_req *); void nilfs_palloc_abort_alloc_entry(struct inode *, struct nilfs_palloc_req *); diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c index d2d19274add7..67e799269ccb 100644 --- a/fs/nilfs2/dat.c +++ b/fs/nilfs2/dat.c @@ -84,7 +84,7 @@ int nilfs_dat_prepare_alloc(struct inode *dat, struct nilfs_palloc_req *req) { int ret; - ret = nilfs_palloc_prepare_alloc_entry(dat, req); + ret = nilfs_palloc_prepare_alloc_entry(dat, req, true); if (ret < 0) return ret; diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index eed73d59ec08..34c8412dc86d 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -152,6 +152,9 @@ static bool nilfs_check_page(struct page *page) goto Enamelen; if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1)) goto Espan; + if (unlikely(p->inode && + NILFS_PRIVATE_INODE(le64_to_cpu(p->inode)))) + goto Einumber; } if (offs != limit) goto Eend; @@ -177,6 +180,9 @@ static bool nilfs_check_page(struct page *page) goto bad_entry; Espan: error = "directory entry across blocks"; + goto bad_entry; +Einumber: + error = "disallowed inode number"; bad_entry: nilfs_error(sb, "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d", @@ -399,11 +405,39 @@ nilfs_find_entry(struct inode *dir, const struct qstr *qstr, struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p) { - struct nilfs_dir_entry *de = nilfs_get_page(dir, 0, p); + struct page *page; + struct nilfs_dir_entry *de, *next_de; + size_t limit; + char *msg; + de = nilfs_get_page(dir, 0, &page); if (IS_ERR(de)) return NULL; - return nilfs_next_entry(de); + + limit = nilfs_last_byte(dir, 0); /* is a multiple of chunk size */ + if (unlikely(!limit || le64_to_cpu(de->inode) != dir->i_ino || + !nilfs_match(1, ".", de))) { + msg = "missing '.'"; + goto fail; + } + + next_de = nilfs_next_entry(de); + /* + * If "next_de" has not reached the end of the chunk, there is + * at least one more record. Check whether it matches "..". + */ + if (unlikely((char *)next_de == (char *)de + nilfs_chunk_size(dir) || + !nilfs_match(2, "..", next_de))) { + msg = "missing '..'"; + goto fail; + } + *p = page; + return next_de; + +fail: + nilfs_error(dir->i_sb, "directory #%lu %s", dir->i_ino, msg); + nilfs_put_page(page); + return NULL; } ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr) diff --git a/fs/nilfs2/ifile.c b/fs/nilfs2/ifile.c index 7efaac75d983..16011cb34163 100644 --- a/fs/nilfs2/ifile.c +++ b/fs/nilfs2/ifile.c @@ -64,13 +64,10 @@ int nilfs_ifile_create_inode(struct inode *ifile, ino_t *out_ino, struct nilfs_palloc_req req; int ret; - req.pr_entry_nr = 0; /* - * 0 says find free inode from beginning - * of a group. dull code!! - */ + req.pr_entry_nr = NILFS_FIRST_INO(ifile->i_sb); req.pr_entry_bh = NULL; - ret = nilfs_palloc_prepare_alloc_entry(ifile, &req); + ret = nilfs_palloc_prepare_alloc_entry(ifile, &req, false); if (!ret) { ret = nilfs_palloc_get_entry_block(ifile, req.pr_entry_nr, 1, &req.pr_entry_bh); diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h index c68eb8d2ca03..028b872375b7 100644 --- a/fs/nilfs2/nilfs.h +++ b/fs/nilfs2/nilfs.h @@ -125,9 +125,15 @@ enum { #define NILFS_FIRST_INO(sb) (((struct the_nilfs *)sb->s_fs_info)->ns_first_ino) #define NILFS_MDT_INODE(sb, ino) \ - ((ino) < NILFS_FIRST_INO(sb) && (NILFS_MDT_INO_BITS & BIT(ino))) + ((ino) < NILFS_USER_INO && (NILFS_MDT_INO_BITS & BIT(ino))) #define NILFS_VALID_INODE(sb, ino) \ - ((ino) >= NILFS_FIRST_INO(sb) || (NILFS_SYS_INO_BITS & BIT(ino))) + ((ino) >= NILFS_FIRST_INO(sb) || \ + ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino)))) + +#define NILFS_PRIVATE_INODE(ino) ({ \ + ino_t __ino = (ino); \ + ((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO && \ + (__ino) != NILFS_SKETCH_INO); }) /** * struct nilfs_transaction_info: context information for synchronization diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c index e0a887e98c36..906a21579030 100644 --- a/fs/nilfs2/the_nilfs.c +++ b/fs/nilfs2/the_nilfs.c @@ -429,6 +429,12 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs, } nilfs->ns_first_ino = le32_to_cpu(sbp->s_first_ino); + if (nilfs->ns_first_ino < NILFS_USER_INO) { + nilfs_err(nilfs->ns_sb, + "too small lower limit for non-reserved inode numbers: %u", + nilfs->ns_first_ino); + return -EINVAL; + } nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment); if (nilfs->ns_blocks_per_segment < NILFS_SEG_MIN_BLOCKS) { diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h index 6db4943fd05b..e6adb1229cdb 100644 --- a/fs/nilfs2/the_nilfs.h +++ b/fs/nilfs2/the_nilfs.h @@ -190,7 +190,7 @@ struct the_nilfs { unsigned long ns_nrsvsegs; unsigned long ns_first_data_block; int ns_inode_size; - int ns_first_ino; + unsigned int ns_first_ino; u32 ns_crc_seed; /* /sys/fs// */ diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c index e5f7df28793d..3bd2d2c825ef 100644 --- a/fs/orangefs/super.c +++ b/fs/orangefs/super.c @@ -188,7 +188,8 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf) (long)new_op->downcall.resp.statfs.files_avail); buf->f_type = sb->s_magic; - memcpy(&buf->f_fsid, &ORANGEFS_SB(sb)->fs_id, sizeof(buf->f_fsid)); + buf->f_fsid.val[0] = ORANGEFS_SB(sb)->fs_id; + buf->f_fsid.val[1] = ORANGEFS_SB(sb)->id; buf->f_bsize = new_op->downcall.resp.statfs.block_size; buf->f_namelen = ORANGEFS_NAME_MAX; diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h index 4636b8f8893e..fd6187121d9b 100644 --- a/include/linux/fsnotify.h +++ b/include/linux/fsnotify.h @@ -38,7 +38,13 @@ static inline int fsnotify_perm(struct file *file, int mask) __u32 fsnotify_mask = 0; int ret; - if (file->f_mode & FMODE_NONOTIFY) + /* + * FMODE_NONOTIFY are fds generated by fanotify itself which should not + * generate new events. We also don't want to generate events for + * FMODE_PATH fds (involves open & close events) as they are just + * handle creation / destruction events and not "real" file events. + */ + if (file->f_mode & (FMODE_NONOTIFY | FMODE_PATH)) return 0; if (!(mask & (MAY_READ | MAY_OPEN))) return 0; diff --git a/include/linux/i2c-pnx.h b/include/linux/i2c-pnx.h deleted file mode 100644 index 5388326fbbff..000000000000 --- a/include/linux/i2c-pnx.h +++ /dev/null @@ -1,38 +0,0 @@ -/* - * Header file for I2C support on PNX010x/4008. - * - * Author: Dennis Kovalev - * - * 2004-2006 (c) MontaVista Software, Inc. This file is licensed under - * the terms of the GNU General Public License version 2. This program - * is licensed "as is" without any warranty of any kind, whether express - * or implied. - */ - -#ifndef __I2C_PNX_H__ -#define __I2C_PNX_H__ - -struct platform_device; -struct clk; - -struct i2c_pnx_mif { - int ret; /* Return value */ - int mode; /* Interface mode */ - struct completion complete; /* I/O completion */ - struct timer_list timer; /* Timeout */ - u8 * buf; /* Data buffer */ - int len; /* Length of data buffer */ - int order; /* RX Bytes to order via TX */ -}; - -struct i2c_pnx_algo_data { - void __iomem *ioaddr; - struct i2c_pnx_mif mif; - int last; - struct clk *clk; - struct i2c_adapter adapter; - int irq; - u32 timeout; -}; - -#endif /* __I2C_PNX_H__ */ diff --git a/kernel/exit.c b/kernel/exit.c index c95694cc5098..2556cc1ff3df 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -501,6 +501,8 @@ void mm_update_next_owner(struct mm_struct *mm) * Search through everything else, we should not get here often. */ for_each_process(g) { + if (atomic_read(&mm->mm_users) <= 1) + break; if (g->flags & PF_KTHREAD) continue; for_each_thread(g, c) { diff --git a/mm/page-writeback.c b/mm/page-writeback.c index 92ac0809b297..fd4459f9ba2e 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1531,7 +1531,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index f012db539831..fb89b128751a 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -5024,7 +5024,7 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) bt_dev_err(hdev, "Dropping invalid advertising data"); } - ptr += sizeof(*ev) + ev->length + 1; + ptr += sizeof(*ev) + ev->length; } hci_dev_unlock(hdev); diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c index daca0af59942..12c00a7d0b56 100644 --- a/net/ceph/mon_client.c +++ b/net/ceph/mon_client.c @@ -963,13 +963,19 @@ static void delayed_work(struct work_struct *work) struct ceph_mon_client *monc = container_of(work, struct ceph_mon_client, delayed_work.work); - dout("monc delayed_work\n"); mutex_lock(&monc->mutex); + dout("%s mon%d\n", __func__, monc->cur_mon); + if (monc->cur_mon < 0) { + goto out; + } + if (monc->hunting) { dout("%s continuing hunt\n", __func__); reopen_session(monc); } else { int is_auth = ceph_auth_is_authenticated(monc->auth); + + dout("%s is_authed %d\n", __func__, is_auth); if (ceph_con_keepalive_expired(&monc->con, CEPH_MONC_PING_TIMEOUT)) { dout("monc keepalive timeout\n"); @@ -994,6 +1000,8 @@ static void delayed_work(struct work_struct *work) } } __schedule_delayed(monc); + +out: mutex_unlock(&monc->mutex); } @@ -1107,13 +1115,15 @@ EXPORT_SYMBOL(ceph_monc_init); void ceph_monc_stop(struct ceph_mon_client *monc) { dout("stop\n"); - cancel_delayed_work_sync(&monc->delayed_work); mutex_lock(&monc->mutex); __close_session(monc); + monc->hunting = false; monc->cur_mon = -1; mutex_unlock(&monc->mutex); + cancel_delayed_work_sync(&monc->delayed_work); + /* * flush msgr queue before we destroy ourselves to ensure that: * - any work that references our embedded con is finished. diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c index a3335815e981..462f85c76edd 100644 --- a/net/ipv4/inet_diag.c +++ b/net/ipv4/inet_diag.c @@ -1089,6 +1089,7 @@ static int inet_diag_dump_compat(struct sk_buff *skb, req.sdiag_family = AF_UNSPEC; /* compatibility */ req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type); req.idiag_ext = rc->idiag_ext; + req.pad = 0; req.idiag_states = rc->idiag_states; req.id = rc->id; @@ -1107,6 +1108,7 @@ static int inet_diag_get_exact_compat(struct sk_buff *in_skb, req.sdiag_family = rc->idiag_family; req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type); req.idiag_ext = rc->idiag_ext; + req.pad = 0; req.idiag_states = rc->idiag_states; req.id = rc->id; diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 50af6970da11..53c798e4d4e3 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -1952,8 +1952,16 @@ void tcp_clear_retrans(struct tcp_sock *tp) static inline void tcp_init_undo(struct tcp_sock *tp) { tp->undo_marker = tp->snd_una; + /* Retransmission still in flight may cause DSACKs later. */ - tp->undo_retrans = tp->retrans_out ? : -1; + /* First, account for regular retransmits in flight: */ + tp->undo_retrans = tp->retrans_out; + /* Next, account for TLP retransmits in flight: */ + if (tp->tlp_high_seq && tp->tlp_retrans) + tp->undo_retrans++; + /* Finally, avoid 0, because undo_retrans==0 means "can undo now": */ + if (!tp->undo_retrans) + tp->undo_retrans = -1; } /* Enter Loss state. If we detect SACK reneging, forget all SACK information @@ -2027,6 +2035,7 @@ void tcp_enter_loss(struct sock *sk) net->ipv4.sysctl_tcp_reordering); tcp_set_ca_state(sk, TCP_CA_Loss); tp->high_seq = tp->snd_nxt; + tp->tlp_high_seq = 0; tcp_ecn_queue_cwr(tp); /* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous @@ -2894,7 +2903,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked, tcp_fackets_out(tp) > tp->reordering; } if (tcp_try_undo_dsack(sk)) { - tcp_try_keep_open(sk); + tcp_try_to_open(sk, flag); return; } tcp_rack_identify_loss(sk, ack_flag); diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c index e9cd8c95eaa5..e433b222368c 100644 --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -630,6 +630,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] = [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr), }, + [TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, }, /* Following attributes are not received for GET/DEL, * we keep them for reference */ diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index 98aa8f3b6a80..67c5789ef71d 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -433,8 +433,13 @@ static bool tcp_rtx_probe0_timed_out(const struct sock *sk, { const struct tcp_sock *tp = tcp_sk(sk); const int timeout = TCP_RTO_MAX * 2; - u32 rcv_delta, rtx_delta; + u32 rtx_delta; + s32 rcv_delta; + /* Note: timer interrupt might have been delayed by at least one jiffy, + * and tp->rcv_tstamp might very well have been written recently. + * rcv_delta can thus be negative. + */ rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp; if (rcv_delta <= timeout) return false; @@ -480,8 +485,6 @@ void tcp_retransmit_timer(struct sock *sk) if (WARN_ON_ONCE(!skb)) return; - tp->tlp_high_seq = 0; - if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) && !((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) { /* Receiver dastardly shrinks window. Our retransmits diff --git a/net/sctp/socket.c b/net/sctp/socket.c index fe26395690f3..7d7d28a477a4 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -66,6 +66,7 @@ #include #include #include +#include #include #include @@ -6407,6 +6408,7 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len, struct sctp_sock *sp = sctp_sk(sk); struct sctp_association *asoc; struct sctp_assoc_ids *ids; + size_t ids_size; u32 num = 0; if (sctp_style(sk, TCP)) @@ -6419,11 +6421,11 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len, num++; } - if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num) + ids_size = struct_size(ids, gaids_assoc_id, num); + if (len < ids_size) return -EINVAL; - len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num; - + len = ids_size; ids = kmalloc(len, GFP_USER | __GFP_NOWARN); if (unlikely(!ids)) return -ENOMEM; diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c index 6184d2a4c4a6..7cfc7713ca7f 100644 --- a/tools/testing/selftests/net/msg_zerocopy.c +++ b/tools/testing/selftests/net/msg_zerocopy.c @@ -81,6 +81,7 @@ static bool cfg_rx; static int cfg_runtime_ms = 4200; static int cfg_verbose; static int cfg_waittime_ms = 500; +static int cfg_notification_limit = 32; static bool cfg_zerocopy; static socklen_t cfg_alen; @@ -91,6 +92,7 @@ static char payload[IP_MAXPACKET]; static long packets, bytes, completions, expected_completions; static int zerocopied = -1; static uint32_t next_completion; +static uint32_t sends_since_notify; static unsigned long gettimeofday_ms(void) { @@ -182,6 +184,7 @@ static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy) error(1, errno, "send"); if (cfg_verbose && ret != len) fprintf(stderr, "send: ret=%u != %u\n", ret, len); + sends_since_notify++; if (len) { packets++; @@ -306,7 +309,53 @@ static int do_setup_tx(int domain, int type, int protocol) return fd; } -static bool do_recv_completion(int fd) +static uint32_t do_process_zerocopy_cookies(struct rds_zcopy_cookies *ck) +{ + int i; + + if (ck->num > RDS_MAX_ZCOOKIES) + error(1, 0, "Returned %d cookies, max expected %d\n", + ck->num, RDS_MAX_ZCOOKIES); + for (i = 0; i < ck->num; i++) + if (cfg_verbose >= 2) + fprintf(stderr, "%d\n", ck->cookies[i]); + return ck->num; +} + +static bool do_recvmsg_completion(int fd) +{ + char cmsgbuf[CMSG_SPACE(sizeof(struct rds_zcopy_cookies))]; + struct rds_zcopy_cookies *ck; + struct cmsghdr *cmsg; + struct msghdr msg; + bool ret = false; + + memset(&msg, 0, sizeof(msg)); + msg.msg_control = cmsgbuf; + msg.msg_controllen = sizeof(cmsgbuf); + + if (recvmsg(fd, &msg, MSG_DONTWAIT)) + return ret; + + if (msg.msg_flags & MSG_CTRUNC) + error(1, errno, "recvmsg notification: truncated"); + + for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) { + if (cmsg->cmsg_level == SOL_RDS && + cmsg->cmsg_type == RDS_CMSG_ZCOPY_COMPLETION) { + + ck = (struct rds_zcopy_cookies *)CMSG_DATA(cmsg); + completions += do_process_zerocopy_cookies(ck); + ret = true; + break; + } + error(0, 0, "ignoring cmsg at level %d type %d\n", + cmsg->cmsg_level, cmsg->cmsg_type); + } + return ret; +} + +static bool do_recv_completion(int fd, int domain) { struct sock_extended_err *serr; struct msghdr msg = {}; @@ -315,6 +364,9 @@ static bool do_recv_completion(int fd) int ret, zerocopy; char control[100]; + if (domain == PF_RDS) + return do_recvmsg_completion(fd); + msg.msg_control = control; msg.msg_controllen = sizeof(control); @@ -348,7 +400,7 @@ static bool do_recv_completion(int fd) /* Detect notification gaps. These should not happen often, if at all. * Gaps can occur due to drops, reordering and retransmissions. */ - if (lo != next_completion) + if (cfg_verbose && lo != next_completion) fprintf(stderr, "gap: %u..%u does not append to %u\n", lo, hi, next_completion); next_completion = hi + 1; @@ -370,20 +422,21 @@ static bool do_recv_completion(int fd) } /* Read all outstanding messages on the errqueue */ -static void do_recv_completions(int fd) +static void do_recv_completions(int fd, int domain) { - while (do_recv_completion(fd)) {} + while (do_recv_completion(fd, domain)) {} + sends_since_notify = 0; } /* Wait for all remaining completions on the errqueue */ -static void do_recv_remaining_completions(int fd) +static void do_recv_remaining_completions(int fd, int domain) { int64_t tstop = gettimeofday_ms() + cfg_waittime_ms; while (completions < expected_completions && gettimeofday_ms() < tstop) { - if (do_poll(fd, POLLERR)) - do_recv_completions(fd); + if (do_poll(fd, domain == PF_RDS ? POLLIN : POLLERR)) + do_recv_completions(fd, domain); } if (completions < expected_completions) @@ -455,15 +508,18 @@ static void do_tx(int domain, int type, int protocol) else do_sendmsg(fd, &msg, cfg_zerocopy); + if (cfg_zerocopy && sends_since_notify >= cfg_notification_limit) + do_recv_completions(fd, domain); + while (!do_poll(fd, POLLOUT)) { if (cfg_zerocopy) - do_recv_completions(fd); + do_recv_completions(fd, domain); } } while (gettimeofday_ms() < tstop); if (cfg_zerocopy) - do_recv_remaining_completions(fd); + do_recv_remaining_completions(fd, domain); if (close(fd)) error(1, errno, "close"); @@ -612,7 +668,7 @@ static void parse_opts(int argc, char **argv) cfg_payload_len = max_payload_len; - while ((c = getopt(argc, argv, "46c:C:D:i:mp:rs:S:t:vz")) != -1) { + while ((c = getopt(argc, argv, "46c:C:D:i:l:mp:rs:S:t:vz")) != -1) { switch (c) { case '4': if (cfg_family != PF_UNSPEC) @@ -640,6 +696,9 @@ static void parse_opts(int argc, char **argv) if (cfg_ifindex == 0) error(1, errno, "invalid iface: %s", optarg); break; + case 'l': + cfg_notification_limit = strtoul(optarg, NULL, 0); + break; case 'm': cfg_cork_mixed = true; break;