malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

This is the 4.14.351 OpenELA-Extended LTS stable release

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEERFwmR4yFob14UDOYC8702P6YulgFAmbJhFAZHHZlZ2FyZC5u
 b3NzdW1Ab3JhY2xlLmNvbQAKCRALzvTY/pi6WM9AD/9T4mE7CXds1QYHF3wzFinF
 t4oHyXvOiY4Mrsdy20A4FIvYfrYi5PyZ39E7G38e2FH2jG7qwHTyHXOjh94cL9gV
 5zlU7+jxWQenDKTl6LV3veYP/QNp9Yh9iQn0sgwC3HTUeq+zNd8rxvBjcAfDNiIM
 taC98s63QjtjZtQPzAaS461LH/U14dKFChuPEC36dei/M4T2UDTHZqvRdFBWB8h2
 fC/dJgtuohXTFexpGgk8p6GKNpFjyE62hBI3Xc+/k24j88r0cFqLLp6NhgF6JIpc
 6L6zGUKeyLXaIR/xoshK3MdgJ/XbocqKlRexJOFxCYmAEreAnQelS8v7QG3j6j33
 8AiUasZfpDPFNEH1CNJC0BiNs76NByFCJny+QUYlq0O9ZjfYQt+PvZZXSCx8jIn6
 A75ryAXLERNlXvh5XuEXlNJsOrN3enWnhgeJXMJOfKxtOfn7CRLmfSvpiS2/SfT3
 sxU4aNQNenbYoWwPQRPLXfNO4UvkmLfk6I6+AqRiHdykYQswhZRnpWxsPRSUwrhI
 6mErDGIXmryid/p+P/eMuviH3AO+KEpjoDzLFMFJWMpLQouTDl5qCwGu3QwVjybS
 /MOlfhi5z1so1e5qBIUmY498jZfVbZ5VMC76bOdhtC2USmvotcBSu611x5JtPaZo
 Cv3jKYl+/S0DVIZdEMPA8g==
 =wFNA
 -----END PGP SIGNATURE-----

Merge tag 'v4.14.351-openela' of https://github.com/openela/kernel-lts

This is the 4.14.351 OpenELA-Extended LTS stable release

* tag 'v4.14.351-openela' of https://github.com/openela/kernel-lts: (58 commits)
  LTS: Update to 4.14.351
  i2c: rcar: bring hardware to known state when probing
  nilfs2: fix kernel bug on rename operation of broken directory
  tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  libceph: fix race between delayed_work() and ceph_monc_stop()
  hpet: Support 32-bit userspace
  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
  USB: serial: option: add Rolling RW350-GL variants
  USB: serial: option: add Netprisma LCUK54 series modules
  USB: serial: option: add support for Foxconn T99W651
  USB: serial: option: add Fibocom FM350-GL
  USB: serial: option: add Telit FN912 rmnet compositions
  USB: serial: option: add Telit generic core-dump composition
  ARM: davinci: Convert comma to semicolon
  ppp: reject claimed-as-LCP but actually malformed packets
  net: ethernet: lantiq_etop: fix double free in detach
  net: lantiq_etop: add blank line after declaration
  tcp: fix incorrect undo caused by DSACK of TLP retransmit
  ...

Change-Id: I8bb6496007a068b83dd95a991e2f3afb0e18da82
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
This commit is contained in:
Richard Raya 2024-08-25 23:41:30 -03:00
commit 59448bba68
55 changed files with 984 additions and 231 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.elts/config.yaml
View File

@ -1,5 +1,5 @@
upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
upstream_base: 4.19.304 upstream_base: 4.19.304
base: 4.14.336 base: 4.14.336
upstream_version: 4.19.317 upstream_version: 4.19.318
version: 4.14.350 version: 4.14.351

222
.elts/meta/4.14.351.yaml Normal file
View File

@ -0,0 +1,222 @@
a29d61e7e8e578fd6bc893e3fc566de319821ca5:
title: 'media: dvb: as102-fe: Fix as10x_register_addr packing'
mainline: 309422d280748c74f57f471559980268ac27732a
upstream: 86b769452b39428807f287ff5bb5aaf6fbfb7e9c
763d3cd7f083891a68cf5158c5bab81bb5e8be0f:
title: 'media: dvb-usb: dib0700_devices: Add missing release_firmware()'
mainline: 4b267c23ee064bd24c6933df0588ad1b6e111145
upstream: 213375679632f6ed1e4eb98b78a8f600977b9b34
f3829e3d794cad5ddb6c88e0ff1b27b6435d224b:
title: 'IB/core: Implement a limit on UMAD receive List'
mainline: ca0b44e20a6f3032224599f02e7c8fb49525c894
upstream: 1288cf1cceb0e6df276e182f5412370fb4169bcb
8fb8547e74c70ef7ed9af6d75f8b27186d6c1d88:
title: 'media: dw2102: Don''t translate i2c read into write'
mainline: 0e148a522b8453115038193e19ec7bea71403e4a
upstream: 74eb7ec7afe976a499484f56e8af020c3260a559
fca275dacc79b9d77ec45e208a68284a19515d5f:
title: 'sctp: prefer struct_size over open coded arithmetic'
mainline: e5c5f3596de224422561d48eba6ece5210d967b3
upstream: 03f37e56305156bd25c5c237d1cc7f5c75495ef2
b0f4f0d200c9bcb8c14b1f09a288dc89d026fdc3:
title: 'firmware: dmi: Stop decoding on broken entry'
mainline: 0ef11f604503b1862a21597436283f158114d77e
upstream: c2a350a3fa622a174e3704691d05989cdfde4d51
d2b33d0a14125c60fb7fc2fe60e7305ef606bc7f:
title: 'Input: ff-core - prefer struct_size over open coded arithmetic'
mainline: a08b8f8557ad88ffdff8905e5da972afe52e3307
upstream: e52cfcf68df0b52565be68106e9f65ab8077b48a
9c1cb2b6cbf9a9e1ee2e9702637c71adc476e874:
title: 'net: dsa: mv88e6xxx: Correct check for empty list'
mainline: 4c7f3950a9fd53a62b156c0fe7c3a2c43b0ba19b
upstream: 47d28dde172696031c880c5778633cdca30394ee
a65c17e8b9fe25ecae58373ddbea9fe06135f193:
title: 'media: dvb-frontends: tda18271c2dd: Remove casting during div'
mainline: e9a844632630e18ed0671a7e3467431bd719952e
upstream: 2401cbc0f5d4bd1e327d247548cc6ee57bc76c53
909138842fcc6194732efcd7e9d6ab4b9b715600:
title: 'media: s2255: Use refcount_t instead of atomic_t for num_channels'
mainline: 6cff72f6bcee89228a662435b7c47e21a391c8d0
upstream: 32f2f5385eefa73aaebefda419147ac8599ba9e6
cf654f32bbef8fd9d7d57d91a3378370a975e85f:
title: 'media: dvb-frontends: tda10048: Fix integer overflow'
mainline: 1aa1329a67cc214c3b7bd2a14d1301a795760b07
upstream: 8167e4d7dc086d4f7ca7897dcff3827e4d22c99a
f5a529216e877313cde4f8a3fc637c816642e861:
title: 'i2c: i801: Annotate apanel_addr as __ro_after_init'
mainline: 355b1513b1e97b6cef84b786c6480325dfd3753d
upstream: 1a1f7053437d0f27534ecc9ec7e5d441c082b81c
af94a2ea5b6eb5ead8c016a196311449e0e145ac:
title: 'powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n'
mainline: be140f1732b523947425aaafbe2e37b41b622d96
upstream: 85cc3ecb0b1256d539bb6a58a5f995c802a331c4
b490b0a094cb6b1e6dc7c79ef9c76213480e03e8:
title: 'orangefs: fix out-of-bounds fsid access'
mainline: 53e4efa470d5fc6a96662d2d3322cfc925818517
upstream: b90176a9553775e23966650e445b1866e62e4924
48d99fb324e4d263c533ae24712372138c5cb664:
title: 'powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"'
mainline: 8873aab8646194a4446117bb617cc71bddda2dee
upstream: 04b90b8d0b6929d7427551215b71901959c8e098
7523a69d10eba34a5bf215bbbf73b02932303c2b:
title: 'jffs2: Fix potential illegal address access in jffs2_free_inode'
mainline: af9a8730ddb6a4b2edd779ccc0aceb994d616830
upstream: b6c8b3e31eb88c85094d848a0bd8b4bafe67e4d8
d232297f0376ff857296774d047ced0731895562:
title: 's390/pkey: Wipe sensitive data on failure'
mainline: 1d8c270de5eb74245d72325d285894a577a945d9
upstream: 6e2e374403bf73140d0efc9541cb1b3bea55ac02
f1bac5dbfa7aaf5cee717a604ed1c94b363a9883:
title: 'UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()'
mainline: a6458ab7fd4f427d4f6f54380453ad255b7fde83
upstream: 8b5fd51b3040ce2596d22a72767c66d7435853b6
f8f32610dabb5c07608475f3cfe4915aa4cd15e5:
title: 'tcp_metrics: validate source addr length'
mainline: 66be40e622e177316ae81717aa30057ba9e61dff
upstream: 19d997b59fa1fd7a02e770ee0881c0652b9c32c9
ea462f7627ecabdd4263965f5a8864f0ab86d08b:
title: 'bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()'
mainline: e271ff53807e8f2c628758290f0e499dbe51cb3d
upstream: 6a8a4fd082c439e19fede027e80c79bc4c84bb8e
a8987b87ffb8455fddf7b29734f043256d589a34:
title: 'selftests/net: reap zerocopy completions passed up as ancillary data.'
c75d2712b73df3ce9a145395882cee0d56f8916f:
title: 'selftests: fix OOM in msg_zerocopy selftest'
mainline: af2b7e5b741aaae9ffbba2c660def434e07aa241
upstream: d6ab0198fb470e1a9948d08c610a94601a1fdb2c
3688bfa238e9ea94bff46c0dc030f412f239a08c:
title: 'selftests: make order checking verbose in msg_zerocopy selftest'
mainline: 7d6d8f0c8b700c9493f2839abccb6d29028b4219
upstream: b1cb48187a6edc2ab72f5b3e6b4af7a232730d64
600edf70c16cb29b82c9fd1e830398168eea7bca:
title: 'inet_diag: Initialize pad field in struct inet_diag_req_v2'
mainline: 61cf1c739f08190a4cbf047b9fbb192a94d87e3f
upstream: 7094a5fd20ab66028f1da7f06e0f2692d70346f9
72ae23ea4ee2e943e8d58ad302c6a843dbf80ad0:
title: 'nilfs2: fix inode number range checks'
mainline: e2fec219a36e0993642844be0f345513507031f4
upstream: 57235c3c88bb430043728d0d02f44a4efe386476
ba6206b639aa6f1d9ade9cb55831ebc1f7268594:
title: 'nilfs2: add missing check for inode numbers on directory entries'
mainline: bb76c6c274683c8570ad788f79d4b875bde0e458
upstream: c33c2b0d92aa1c2262d999b2598ad6fbd53bd479
34096341954fed86e3b510d1c0617470f21bb41d:
title: 'mm: optimize the redundant loop of mm_update_owner_next()'
mainline: cf3f9a593dab87a032d2b6a6fb205e7f3de4f0a1
upstream: 2890a7faf552dd3e4e40e343610ba3e0ba5b788e
1cbdc455dc33b76a9efdf4694308b2b1c8ea5a21:
title: 'Bluetooth: Fix incorrect pointer arithmatic in ext_adv_report_evt'
mainline: cd9151b618da4723877bd94eae952f2e50acbc0e
upstream: b162f19e6603571061b19dbb604a9883f0fa4ecc
73f492747cfcd09e43ef25970d26c8943ab830ec:
title: 'fsnotify: Do not generate events for O_PATH file descriptors'
mainline: 702eb71fd6501b3566283f8c96d7ccc6ddd662e9
upstream: b7421cad1d8725831a98b339d7ecbb284dd1c5de
6949c5283758b9d0847b1ce1d461e9c7d2730fa1:
title: 'Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"'
mainline: 30139c702048f1097342a31302cbd3d478f50c63
upstream: 253f9ea7e8e53a5176bd80ceb174907b10724c1a
c300d28e4079a0046e79ff18bdffb48c7dee3861:
title: 'drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes'
mainline: 80bec6825b19d95ccdfd3393cf8ec15ff2a749b4
upstream: 9baf60323efa992b7c915094529f0a1882c34e7e
27967cf8362a84f47938fe7ff0ff57c991c858cc:
title: 'drm/amdgpu/atomfirmware: silence UBSAN warning'
mainline: d0417264437a8fa05f894cabba5a26715b32d78e
upstream: 385b615c95df14df68ca8322245c13a9389392f6
a64eeaefb325e45890fca958151be84cfa53b633:
title: 'bnx2x: Fix multiple UBSAN array-index-out-of-bounds'
mainline: 134061163ee5ca4759de5c24ca3bd71608891ba7
upstream: cfb04472ce33bee2579caf4dc9f4242522f6e26e
9c6553444512bcd2fdaf2b4153835f19f684f2c4:
title: 'media: dw2102: fix a potential buffer overflow'
mainline: 1c73d0b29d04bf4082e7beb6a508895e118ee30d
upstream: 39fb2a0c2e78d9b2de726be119e6d06e38aa4ed4
900ede664c5f6c4194cc6a86558c291918c285dd:
title: 'i2c: pnx: move header into the driver'
82043a1a1450176d4a5c5664b05ab1e7bfeed0ee:
title: 'i2c/busses: Convert timers to use timer_setup()'
1921a68ba39c00e508c2b6fdd571d6fdeb6268e4:
title: 'i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr'
mainline: f63b94be6942ba82c55343e196bd09b53227618e
upstream: a349e5ab4dc9954746e836cd10b407ce48f9b2f6
75fb795f98517dbdb2973414465cffa685d9cd8a:
title: 'nilfs2: fix incorrect inode allocation from reserved inodes'
mainline: 93aef9eda1cea9e84ab2453fcceb8addad0e46f1
upstream: de9d81daaca2b7b3c853bf2ff729353e84f06b18
852460760459aec08d18bc7780f254f6f256606d:
title: 'tcp: fix incorrect undo caused by DSACK of TLP retransmit'
mainline: 0ec986ed7bab6801faed1440e8839dcc710331ff
upstream: 83f5eb01c4beb9741bc1600bcd8b6e94a1774abe
95139b5d59c4b6d6c56f39c2b4b4f26e22330000:
title: 'net: lantiq_etop: add blank line after declaration'
mainline: 4c46625bb586a741b8d0e6bdbddbcb2549fa1d36
upstream: 12d204b835dd85c7fe6501be6ee1aaa1e5315ff9
ae3b644b836cdcca258294db2569189af4ef7ff3:
title: 'net: ethernet: lantiq_etop: fix double free in detach'
mainline: e1533b6319ab9c3a97dad314dd88b3783bc41b69
upstream: 1a2db00a554cfda57c397cce79b2804bf9633fec
84f3c0bb96cd91096079828b24b51af408265abe:
title: 'ppp: reject claimed-as-LCP but actually malformed packets'
mainline: f2aeb7306a898e1cbd03963d376f4b6656ca2b55
upstream: 97d1efd8be26615ff680cdde86937d5943138f37
4e591539244c71973243bd4315024d601991ee3a:
title: 'ARM: davinci: Convert comma to semicolon'
mainline: acc3815db1a02d654fbc19726ceaadca0d7dd81c
upstream: f9ace6a3278a613d22abbd7d69e13d481b800622
400d7f0eceb6a1993c04f36ee766abff02f975b8:
title: 'USB: serial: option: add Telit generic core-dump composition'
mainline: 4298e400dbdbf259549d69c349e060652ad53611
upstream: a88697c3871ade2c9d03437d170af77ec92d2982
4094a8160b0626b4fc428b2770adcd99652a9117:
title: 'USB: serial: option: add Telit FN912 rmnet compositions'
mainline: 9a590ff283421b71560deded2110dbdcbe1f7d1d
upstream: 908bc2cb55f8affc7a90bb8d17fd4323088e2a19
01b762bc1225b0a0ffb18638161627cb185ce408:
title: 'USB: serial: option: add Fibocom FM350-GL'
mainline: 2604e08ff251dba330e16b65e80074c9c540aad7
upstream: de307ab87774c96700fa1831f78f5085255c35f8
4dd077fc35bd45cb3763b56b29397495aa60e832:
title: 'USB: serial: option: add support for Foxconn T99W651'
mainline: 3c841d54b63e4446383de3238399a3910e47d8e2
upstream: 9fde2ddfed4787728a20aefea6a625c6b2b32fc4
e8c421c3e622eec18fb2a723b3801e041094e76b:
title: 'USB: serial: option: add Netprisma LCUK54 series modules'
mainline: dc6dbe3ed28795b01c712ad8f567728f9c14b01d
upstream: 038d9a89fac14fd9855383b2ae990ee755e36bd0
bb8ef9c34dbad9828e35221d9b93887f81fedf61:
title: 'USB: serial: option: add Rolling RW350-GL variants'
mainline: ae420771551bd9f04347c59744dd062332bdec3e
upstream: 5bc1f4bee4d84245a3479f53aef38f82b99a19f0
af79b0b19953f31e510d5330cb6d3bb246b096a2:
title: 'USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k'
mainline: 3859e85de30815a20bce7db712ce3d94d40a682d
upstream: 1d1f3d602971bbb8de654e7bbe78bf6c2ebd06c1
4a1cba1a65533b8f9ece63c774c0bd1d265e14bf:
title: 'usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()'
mainline: 6d3c721e686ea6c59e18289b400cc95c76e927e0
upstream: a444c3fc264119801575ab086e03fb4952f23fd0
d60eb2fd2445dd07125d1e450aa4c310d5baf190:
title: 'USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor'
mainline: a368ecde8a5055b627749b09c6218ef793043e47
upstream: d8418fd083d1b90a6c007cf8dcf81aeae274727b
a43cf7b341011779151d27dd5bc52387d5f5f835:
title: 'hpet: Support 32-bit userspace'
mainline: 4e60131d0d36af65ab9c9144f4f163fe97ae36e8
upstream: e2cb94465de92f6a840bc7eface420b30cc64aa0
c618a1f6d3ecaa97aaf0283d9b89824e651bc013:
title: 'libceph: fix race between delayed_work() and ceph_monc_stop()'
mainline: 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883
upstream: 1177afeca833174ba83504688eec898c6214f4bf
bd19e77de5e3d3c721c8dc55e0d7f1b6a0117279:
title: 'tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()'
mainline: 36534d3c54537bf098224a32dc31397793d4594d
upstream: 0fe6516462392ffe355a45a1ada8d264a783430f
2a8372159bc037d3c15b66659a35ca18a0a61d98:
title: 'nilfs2: fix kernel bug on rename operation of broken directory'
mainline: a9e1ddc09ca55746079cc479aa3eb6411f0d99d4
upstream: ff9767ba2cb949701e45e6e4287f8af82986b703
e0aa415e86deeac3ffde591fc5fd5e4a13e9ff23:
title: 'i2c: rcar: bring hardware to known state when probing'
mainline: 4e36c0f20cb1c74c7bd7ea31ba432c1c4a989031
upstream: a291702b35433e4948476b79c034a21fd2b5ebc8

264
.elts/upstream/4.19.318.yaml Normal file
View File

@ -0,0 +1,264 @@
a8a223aa3fb7790168fbf777a8db5bcef011b4dc:
title: 'asm-generic: Move common compat types to asm-generic/compat.h'
mainline: fb3739759474d150a9927b920a80ea2afb4c2a51
skipped: not stable material
86b769452b39428807f287ff5bb5aaf6fbfb7e9c:
title: 'media: dvb: as102-fe: Fix as10x_register_addr packing'
mainline: 309422d280748c74f57f471559980268ac27732a
backport: a29d61e7e8e578fd6bc893e3fc566de319821ca5
213375679632f6ed1e4eb98b78a8f600977b9b34:
title: 'media: dvb-usb: dib0700_devices: Add missing release_firmware()'
mainline: 4b267c23ee064bd24c6933df0588ad1b6e111145
backport: 763d3cd7f083891a68cf5158c5bab81bb5e8be0f
1288cf1cceb0e6df276e182f5412370fb4169bcb:
title: 'IB/core: Implement a limit on UMAD receive List'
mainline: ca0b44e20a6f3032224599f02e7c8fb49525c894
backport: f3829e3d794cad5ddb6c88e0ff1b27b6435d224b
9eb4db08a808e3a3ba59193aeb84a57a6dc4d8c9:
title: 'drm/amd/display: Skip finding free audio for unknown engine_id'
mainline: 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3
skipped: patched file is not in 4.14.y
74eb7ec7afe976a499484f56e8af020c3260a559:
title: 'media: dw2102: Don''t translate i2c read into write'
mainline: 0e148a522b8453115038193e19ec7bea71403e4a
backport: 8fb8547e74c70ef7ed9af6d75f8b27186d6c1d88
03f37e56305156bd25c5c237d1cc7f5c75495ef2:
title: 'sctp: prefer struct_size over open coded arithmetic'
mainline: e5c5f3596de224422561d48eba6ece5210d967b3
backport: fca275dacc79b9d77ec45e208a68284a19515d5f
c2a350a3fa622a174e3704691d05989cdfde4d51:
title: 'firmware: dmi: Stop decoding on broken entry'
mainline: 0ef11f604503b1862a21597436283f158114d77e
backport: b0f4f0d200c9bcb8c14b1f09a288dc89d026fdc3
e52cfcf68df0b52565be68106e9f65ab8077b48a:
title: 'Input: ff-core - prefer struct_size over open coded arithmetic'
mainline: a08b8f8557ad88ffdff8905e5da972afe52e3307
backport: d2b33d0a14125c60fb7fc2fe60e7305ef606bc7f
47d28dde172696031c880c5778633cdca30394ee:
title: 'net: dsa: mv88e6xxx: Correct check for empty list'
mainline: 4c7f3950a9fd53a62b156c0fe7c3a2c43b0ba19b
backport: 9c1cb2b6cbf9a9e1ee2e9702637c71adc476e874
2401cbc0f5d4bd1e327d247548cc6ee57bc76c53:
title: 'media: dvb-frontends: tda18271c2dd: Remove casting during div'
mainline: e9a844632630e18ed0671a7e3467431bd719952e
backport: a65c17e8b9fe25ecae58373ddbea9fe06135f193
32f2f5385eefa73aaebefda419147ac8599ba9e6:
title: 'media: s2255: Use refcount_t instead of atomic_t for num_channels'
mainline: 6cff72f6bcee89228a662435b7c47e21a391c8d0
backport: 909138842fcc6194732efcd7e9d6ab4b9b715600
8167e4d7dc086d4f7ca7897dcff3827e4d22c99a:
title: 'media: dvb-frontends: tda10048: Fix integer overflow'
mainline: 1aa1329a67cc214c3b7bd2a14d1301a795760b07
backport: cf654f32bbef8fd9d7d57d91a3378370a975e85f
1a1f7053437d0f27534ecc9ec7e5d441c082b81c:
title: 'i2c: i801: Annotate apanel_addr as __ro_after_init'
mainline: 355b1513b1e97b6cef84b786c6480325dfd3753d
backport: f5a529216e877313cde4f8a3fc637c816642e861
85cc3ecb0b1256d539bb6a58a5f995c802a331c4:
title: 'powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n'
mainline: be140f1732b523947425aaafbe2e37b41b622d96
backport: af94a2ea5b6eb5ead8c016a196311449e0e145ac
b90176a9553775e23966650e445b1866e62e4924:
title: 'orangefs: fix out-of-bounds fsid access'
mainline: 53e4efa470d5fc6a96662d2d3322cfc925818517
backport: b490b0a094cb6b1e6dc7c79ef9c76213480e03e8
04b90b8d0b6929d7427551215b71901959c8e098:
title: 'powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"'
mainline: 8873aab8646194a4446117bb617cc71bddda2dee
backport: 48d99fb324e4d263c533ae24712372138c5cb664
b6c8b3e31eb88c85094d848a0bd8b4bafe67e4d8:
title: 'jffs2: Fix potential illegal address access in jffs2_free_inode'
mainline: af9a8730ddb6a4b2edd779ccc0aceb994d616830
backport: 7523a69d10eba34a5bf215bbbf73b02932303c2b
6e2e374403bf73140d0efc9541cb1b3bea55ac02:
title: 's390/pkey: Wipe sensitive data on failure'
mainline: 1d8c270de5eb74245d72325d285894a577a945d9
backport: d232297f0376ff857296774d047ced0731895562
0cb018bf9217805f97740fe83261e18199fc2773:
title: 'tcp: take care of compressed acks in tcp_add_reno_sack()'
mainline: 19119f298bb1f2af3bb1093f5f2a1fed8da94e37
skipped: commit did not cherry-pick cleanly
552970cb728120695820ef9decb0933b3f9ce774:
title: 'tcp: tcp_mark_head_lost is only valid for sack-tcp'
mainline: 636ef28d6e4d174e424102466caf572b0406fb0e
skipped: commit did not cherry-pick cleanly
57a672a35020884512ae64fbbcb5c70149424781:
title: 'tcp: add ece_ack flag to reno sack functions'
mainline: c634e34f6ebfb75259e6ce467523fd3adf30d3d2
skipped: commit did not cherry-pick cleanly
550968385e2f0df8e29c6431ab2dc0961499acb0:
title: 'net: tcp better handling of reordering then loss cases'
mainline: a29cb6914681a55667436a9eb7a42e28da8cf387
skipped: commit did not cherry-pick cleanly
8b5fd51b3040ce2596d22a72767c66d7435853b6:
title: 'UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()'
mainline: a6458ab7fd4f427d4f6f54380453ad255b7fde83
backport: f1bac5dbfa7aaf5cee717a604ed1c94b363a9883
19d997b59fa1fd7a02e770ee0881c0652b9c32c9:
title: 'tcp_metrics: validate source addr length'
mainline: 66be40e622e177316ae81717aa30057ba9e61dff
backport: f8f32610dabb5c07608475f3cfe4915aa4cd15e5
6a8a4fd082c439e19fede027e80c79bc4c84bb8e:
title: 'bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()'
mainline: e271ff53807e8f2c628758290f0e499dbe51cb3d
backport: ea462f7627ecabdd4263965f5a8864f0ab86d08b
d6ab0198fb470e1a9948d08c610a94601a1fdb2c:
title: 'selftests: fix OOM in msg_zerocopy selftest'
mainline: af2b7e5b741aaae9ffbba2c660def434e07aa241
backport: c75d2712b73df3ce9a145395882cee0d56f8916f
b1cb48187a6edc2ab72f5b3e6b4af7a232730d64:
title: 'selftests: make order checking verbose in msg_zerocopy selftest'
mainline: 7d6d8f0c8b700c9493f2839abccb6d29028b4219
backport: 3688bfa238e9ea94bff46c0dc030f412f239a08c
7094a5fd20ab66028f1da7f06e0f2692d70346f9:
title: 'inet_diag: Initialize pad field in struct inet_diag_req_v2'
mainline: 61cf1c739f08190a4cbf047b9fbb192a94d87e3f
backport: 600edf70c16cb29b82c9fd1e830398168eea7bca
57235c3c88bb430043728d0d02f44a4efe386476:
title: 'nilfs2: fix inode number range checks'
mainline: e2fec219a36e0993642844be0f345513507031f4
backport: 72ae23ea4ee2e943e8d58ad302c6a843dbf80ad0
c33c2b0d92aa1c2262d999b2598ad6fbd53bd479:
title: 'nilfs2: add missing check for inode numbers on directory entries'
mainline: bb76c6c274683c8570ad788f79d4b875bde0e458
backport: ba6206b639aa6f1d9ade9cb55831ebc1f7268594
2890a7faf552dd3e4e40e343610ba3e0ba5b788e:
title: 'mm: optimize the redundant loop of mm_update_owner_next()'
mainline: cf3f9a593dab87a032d2b6a6fb205e7f3de4f0a1
backport: 34096341954fed86e3b510d1c0617470f21bb41d
b162f19e6603571061b19dbb604a9883f0fa4ecc:
title: 'Bluetooth: Fix incorrect pointer arithmatic in ext_adv_report_evt'
mainline: cd9151b618da4723877bd94eae952f2e50acbc0e
backport: 1cbdc455dc33b76a9efdf4694308b2b1c8ea5a21
a7428ec9d7911f1a74da20359063ff265081832a:
title: 'can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct'
mainline: 19d5b2698c35b2132a355c67b4d429053804f8cc
skipped: fixes patch not in branch
b7421cad1d8725831a98b339d7ecbb284dd1c5de:
title: 'fsnotify: Do not generate events for O_PATH file descriptors'
mainline: 702eb71fd6501b3566283f8c96d7ccc6ddd662e9
backport: 73f492747cfcd09e43ef25970d26c8943ab830ec
253f9ea7e8e53a5176bd80ceb174907b10724c1a:
title: 'Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"'
mainline: 30139c702048f1097342a31302cbd3d478f50c63
backport: 6949c5283758b9d0847b1ce1d461e9c7d2730fa1
9baf60323efa992b7c915094529f0a1882c34e7e:
title: 'drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes'
mainline: 80bec6825b19d95ccdfd3393cf8ec15ff2a749b4
backport: c300d28e4079a0046e79ff18bdffb48c7dee3861
385b615c95df14df68ca8322245c13a9389392f6:
title: 'drm/amdgpu/atomfirmware: silence UBSAN warning'
mainline: d0417264437a8fa05f894cabba5a26715b32d78e
backport: 27967cf8362a84f47938fe7ff0ff57c991c858cc
cfb04472ce33bee2579caf4dc9f4242522f6e26e:
title: 'bnx2x: Fix multiple UBSAN array-index-out-of-bounds'
mainline: 134061163ee5ca4759de5c24ca3bd71608891ba7
backport: a64eeaefb325e45890fca958151be84cfa53b633
39fb2a0c2e78d9b2de726be119e6d06e38aa4ed4:
title: 'media: dw2102: fix a potential buffer overflow'
mainline: 1c73d0b29d04bf4082e7beb6a508895e118ee30d
backport: 9c6553444512bcd2fdaf2b4153835f19f684f2c4
a349e5ab4dc9954746e836cd10b407ce48f9b2f6:
title: 'i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr'
mainline: f63b94be6942ba82c55343e196bd09b53227618e
backport: 1921a68ba39c00e508c2b6fdd571d6fdeb6268e4
de9d81daaca2b7b3c853bf2ff729353e84f06b18:
title: 'nilfs2: fix incorrect inode allocation from reserved inodes'
mainline: 93aef9eda1cea9e84ab2453fcceb8addad0e46f1
backport: 75fb795f98517dbdb2973414465cffa685d9cd8a
f0d7f98ff88c26698296f62fe91d7e7141fe4a47:
title: 'drm/i915: make find_fw_domain work on intel_uncore'
mainline: cb7ee69015aaba5e1091af94e73bc72483c08e37
skipped: fixes new functionality not in 4.14
83f5eb01c4beb9741bc1600bcd8b6e94a1774abe:
title: 'tcp: fix incorrect undo caused by DSACK of TLP retransmit'
mainline: 0ec986ed7bab6801faed1440e8839dcc710331ff
backport: 852460760459aec08d18bc7780f254f6f256606d
12d204b835dd85c7fe6501be6ee1aaa1e5315ff9:
title: 'net: lantiq_etop: add blank line after declaration'
mainline: 4c46625bb586a741b8d0e6bdbddbcb2549fa1d36
backport: 95139b5d59c4b6d6c56f39c2b4b4f26e22330000
1a2db00a554cfda57c397cce79b2804bf9633fec:
title: 'net: ethernet: lantiq_etop: fix double free in detach'
mainline: e1533b6319ab9c3a97dad314dd88b3783bc41b69
backport: ae3b644b836cdcca258294db2569189af4ef7ff3
97d1efd8be26615ff680cdde86937d5943138f37:
title: 'ppp: reject claimed-as-LCP but actually malformed packets'
mainline: f2aeb7306a898e1cbd03963d376f4b6656ca2b55
backport: 84f3c0bb96cd91096079828b24b51af408265abe
f9ace6a3278a613d22abbd7d69e13d481b800622:
title: 'ARM: davinci: Convert comma to semicolon'
mainline: acc3815db1a02d654fbc19726ceaadca0d7dd81c
backport: 4e591539244c71973243bd4315024d601991ee3a
a88697c3871ade2c9d03437d170af77ec92d2982:
title: 'USB: serial: option: add Telit generic core-dump composition'
mainline: 4298e400dbdbf259549d69c349e060652ad53611
backport: 400d7f0eceb6a1993c04f36ee766abff02f975b8
908bc2cb55f8affc7a90bb8d17fd4323088e2a19:
title: 'USB: serial: option: add Telit FN912 rmnet compositions'
mainline: 9a590ff283421b71560deded2110dbdcbe1f7d1d
backport: 4094a8160b0626b4fc428b2770adcd99652a9117
de307ab87774c96700fa1831f78f5085255c35f8:
title: 'USB: serial: option: add Fibocom FM350-GL'
mainline: 2604e08ff251dba330e16b65e80074c9c540aad7
backport: 01b762bc1225b0a0ffb18638161627cb185ce408
9fde2ddfed4787728a20aefea6a625c6b2b32fc4:
title: 'USB: serial: option: add support for Foxconn T99W651'
mainline: 3c841d54b63e4446383de3238399a3910e47d8e2
backport: 4dd077fc35bd45cb3763b56b29397495aa60e832
038d9a89fac14fd9855383b2ae990ee755e36bd0:
title: 'USB: serial: option: add Netprisma LCUK54 series modules'
mainline: dc6dbe3ed28795b01c712ad8f567728f9c14b01d
backport: e8c421c3e622eec18fb2a723b3801e041094e76b
5bc1f4bee4d84245a3479f53aef38f82b99a19f0:
title: 'USB: serial: option: add Rolling RW350-GL variants'
mainline: ae420771551bd9f04347c59744dd062332bdec3e
backport: bb8ef9c34dbad9828e35221d9b93887f81fedf61
1d1f3d602971bbb8de654e7bbe78bf6c2ebd06c1:
title: 'USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k'
mainline: 3859e85de30815a20bce7db712ce3d94d40a682d
backport: af79b0b19953f31e510d5330cb6d3bb246b096a2
a444c3fc264119801575ab086e03fb4952f23fd0:
title: 'usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()'
mainline: 6d3c721e686ea6c59e18289b400cc95c76e927e0
backport: 4a1cba1a65533b8f9ece63c774c0bd1d265e14bf
d8418fd083d1b90a6c007cf8dcf81aeae274727b:
title: 'USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor'
mainline: a368ecde8a5055b627749b09c6218ef793043e47
backport: d60eb2fd2445dd07125d1e450aa4c310d5baf190
e2cb94465de92f6a840bc7eface420b30cc64aa0:
title: 'hpet: Support 32-bit userspace'
mainline: 4e60131d0d36af65ab9c9144f4f163fe97ae36e8
backport: a43cf7b341011779151d27dd5bc52387d5f5f835
1177afeca833174ba83504688eec898c6214f4bf:
title: 'libceph: fix race between delayed_work() and ceph_monc_stop()'
mainline: 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883
backport: c618a1f6d3ecaa97aaf0283d9b89824e651bc013
e5a1f7427f97bde4bda73c02106c3bde87696f8f:
title: 'tcp: refactor tcp_retransmit_timer()'
mainline: 0d580fbd2db084a5c96ee9c00492236a279d5e0f
skipped: squashed into 6d9175b95504d28045909631514d06660b4b1a9a
faa0a1fc2a0bb510b2381a5c7aa5b46e9a83d64a:
title: 'net: tcp: fix unexcepted socket die when snd_wnd is 0'
mainline: e89688e3e97868451a5d05b38a9d2633d6785cd4
skipped: commit is already present in branch
0fe6516462392ffe355a45a1ada8d264a783430f:
title: 'tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()'
mainline: 36534d3c54537bf098224a32dc31397793d4594d
backport: bd19e77de5e3d3c721c8dc55e0d7f1b6a0117279
7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4:
title: 'tcp: avoid too many retransmit packets'
mainline: 97a9063518f198ec0adb2ecb89789de342bb8283
skipped: fixes patch not in branch
17866066b8ac1cc38fb449670bc15dc9fee4b40a:
title: 'SUNRPC: Fix RPC client cleaned up the freed pipefs dentries'
mainline: bfca5fb4e97c46503ddfc582335917b0cc228264
skipped: commit is already present in branch
ff9767ba2cb949701e45e6e4287f8af82986b703:
title: 'nilfs2: fix kernel bug on rename operation of broken directory'
mainline: a9e1ddc09ca55746079cc479aa3eb6411f0d99d4
backport: 2a8372159bc037d3c15b66659a35ca18a0a61d98
a291702b35433e4948476b79c034a21fd2b5ebc8:
title: 'i2c: rcar: bring hardware to known state when probing'
mainline: 4e36c0f20cb1c74c7bd7ea31ba432c1c4a989031
backport: e0aa415e86deeac3ffde591fc5fd5e4a13e9ff23

2
Makefile
View File

@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0 # SPDX-License-Identifier: GPL-2.0
VERSION = 4 VERSION = 4
PATCHLEVEL = 14 PATCHLEVEL = 14
SUBLEVEL = 350 SUBLEVEL = 351
EXTRAVERSION = -openela EXTRAVERSION = -openela
NAME = Petit Gorille NAME = Petit Gorille

2
arch/arm/mach-davinci/pm.c
View File

@ -65,7 +65,7 @@ static void davinci_pm_suspend(void)
/* Configure sleep count in deep sleep register */ /* Configure sleep count in deep sleep register */
val = __raw_readl(pm_config.deepsleep_reg); val = __raw_readl(pm_config.deepsleep_reg);
val &= ~DEEPSLEEP_SLEEPCOUNT_MASK, val &= ~DEEPSLEEP_SLEEPCOUNT_MASK;
val |= pm_config.sleepcount; val |= pm_config.sleepcount;
__raw_writel(val, pm_config.deepsleep_reg); __raw_writel(val, pm_config.deepsleep_reg);

2
arch/powerpc/include/asm/io.h
View File

@ -49,7 +49,7 @@ extern struct pci_dev *isa_bridge_pcidev;
* define properly based on the platform * define properly based on the platform
*/ */
#ifndef CONFIG_PCI #ifndef CONFIG_PCI
#define _IO_BASE 0 #define _IO_BASE POISON_POINTER_DELTA
#define _ISA_MEM_BASE 0 #define _ISA_MEM_BASE 0
#define PCI_DRAM_OFFSET 0 #define PCI_DRAM_OFFSET 0
#elif defined(CONFIG_PPC32) #elif defined(CONFIG_PPC32)

6
arch/powerpc/xmon/xmon.c
View File

@ -1119,7 +1119,7 @@ static int cpu_cmd(void)
unsigned long cpu, first_cpu, last_cpu; unsigned long cpu, first_cpu, last_cpu;
int timeout; int timeout;
if (!scanhex(&cpu)) { if (!scanhex(&cpu) || cpu >= num_possible_cpus()) {
/* print cpus waiting or in xmon */ /* print cpus waiting or in xmon */
printf("cpus stopped:"); printf("cpus stopped:");
last_cpu = first_cpu = NR_CPUS; last_cpu = first_cpu = NR_CPUS;
@ -2426,7 +2426,7 @@ static void dump_pacas(void)
termch = c; /* Put c back, it wasn't 'a' */ termch = c; /* Put c back, it wasn't 'a' */
if (scanhex(&num)) if (scanhex(&num) && num < num_possible_cpus())
dump_one_paca(num); dump_one_paca(num);
else else
dump_one_paca(xmon_owner); dump_one_paca(xmon_owner);
@ -2509,7 +2509,7 @@ static void dump_xives(void)
termch = c; /* Put c back, it wasn't 'a' */ termch = c; /* Put c back, it wasn't 'a' */
if (scanhex(&num)) if (scanhex(&num) && num < num_possible_cpus())
dump_one_xive(num); dump_one_xive(num);
else else
dump_one_xive(xmon_owner); dump_one_xive(xmon_owner);

34
drivers/char/hpet.c
View File

@ -307,8 +307,13 @@ hpet_read(struct file *file, char __user *buf, size_t count, loff_t * ppos)
if (!devp->hd_ireqfreq) if (!devp->hd_ireqfreq)
return -EIO; return -EIO;
if (count < sizeof(unsigned long)) if (in_compat_syscall()) {
return -EINVAL; if (count < sizeof(compat_ulong_t))
return -EINVAL;
} else {
if (count < sizeof(unsigned long))
return -EINVAL;
}
add_wait_queue(&devp->hd_waitqueue, &wait); add_wait_queue(&devp->hd_waitqueue, &wait);
@ -332,9 +337,16 @@ hpet_read(struct file *file, char __user *buf, size_t count, loff_t * ppos)
schedule(); schedule();
} }
retval = put_user(data, (unsigned long __user *)buf); if (in_compat_syscall()) {
if (!retval) retval = put_user(data, (compat_ulong_t __user *)buf);
retval = sizeof(unsigned long); if (!retval)
retval = sizeof(compat_ulong_t);
} else {
retval = put_user(data, (unsigned long __user *)buf);
if (!retval)
retval = sizeof(unsigned long);
}
out: out:
__set_current_state(TASK_RUNNING); __set_current_state(TASK_RUNNING);
remove_wait_queue(&devp->hd_waitqueue, &wait); remove_wait_queue(&devp->hd_waitqueue, &wait);
@ -691,12 +703,24 @@ struct compat_hpet_info {
unsigned short hi_timer; unsigned short hi_timer;
}; };
/* 32-bit types would lead to different command codes which should be
* translated into 64-bit ones before passed to hpet_ioctl_common
*/
#define COMPAT_HPET_INFO _IOR('h', 0x03, struct compat_hpet_info)
#define COMPAT_HPET_IRQFREQ _IOW('h', 0x6, compat_ulong_t)
static long static long
hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{ {
struct hpet_info info; struct hpet_info info;
int err; int err;
if (cmd == COMPAT_HPET_INFO)
cmd = HPET_INFO;
if (cmd == COMPAT_HPET_IRQFREQ)
cmd = HPET_IRQFREQ;
mutex_lock(&hpet_mutex); mutex_lock(&hpet_mutex);
err = hpet_ioctl_common(file->private_data, cmd, arg, &info); err = hpet_ioctl_common(file->private_data, cmd, arg, &info);
mutex_unlock(&hpet_mutex); mutex_unlock(&hpet_mutex);

11
drivers/firmware/dmi_scan.c
View File

@ -99,6 +99,17 @@ static void dmi_decode_table(u8 *buf,
(data - buf + sizeof(struct dmi_header)) <= dmi_len) { (data - buf + sizeof(struct dmi_header)) <= dmi_len) {
const struct dmi_header *dm = (const struct dmi_header *)data; const struct dmi_header *dm = (const struct dmi_header *)data;
/*
* If a short entry is found (less than 4 bytes), not only it
* is invalid, but we cannot reliably locate the next entry.
*/
if (dm->length < sizeof(struct dmi_header)) {
pr_warn(FW_BUG
"Corrupted DMI table, offset %zd (only %d entries processed)\n",
data - buf, i);
break;
}
/* /*
* We want to know the total length (formatted area and * We want to know the total length (formatted area and
* strings) before decoding to make sure we won't run off the * strings) before decoding to make sure we won't run off the

2
drivers/gpu/drm/amd/include/atomfirmware.h
View File

@ -594,7 +594,7 @@ struct atom_gpio_pin_lut_v2_1
{ {
struct atom_common_table_header table_header; struct atom_common_table_header table_header;
/*the real number of this included in the structure is calcualted by using the (whole structure size - the header size)/size of atom_gpio_pin_lut */ /*the real number of this included in the structure is calcualted by using the (whole structure size - the header size)/size of atom_gpio_pin_lut */
struct atom_gpio_pin_assignment gpio_pin[8]; struct atom_gpio_pin_assignment gpio_pin[];
}; };

3
drivers/gpu/drm/nouveau/nouveau_connector.c
View File

@ -958,6 +958,9 @@ nouveau_connector_get_modes(struct drm_connector *connector)
struct drm_display_mode *mode; struct drm_display_mode *mode;
mode = drm_mode_duplicate(dev, nv_connector->native_mode); mode = drm_mode_duplicate(dev, nv_connector->native_mode);
if (!mode)
return 0;
drm_mode_probed_add(connector, mode); drm_mode_probed_add(connector, mode);
ret = 1; ret = 1;
} }

2
drivers/i2c/busses/i2c-i801.c
View File

@ -1032,7 +1032,7 @@ static const struct pci_device_id i801_ids[] = {
MODULE_DEVICE_TABLE(pci, i801_ids); MODULE_DEVICE_TABLE(pci, i801_ids);
#if defined CONFIG_X86 && defined CONFIG_DMI #if defined CONFIG_X86 && defined CONFIG_DMI
static unsigned char apanel_addr; static unsigned char apanel_addr __ro_after_init;
/* Scan the system ROM for the signature "FJKEYINF" */ /* Scan the system ROM for the signature "FJKEYINF" */
static __init const void __iomem *bios_signature(const void __iomem *bios) static __init const void __iomem *bios_signature(const void __iomem *bios)

7
drivers/i2c/busses/i2c-img-scb.c
View File

@ -826,9 +826,9 @@ next_atomic_cmd:
* Timer function to check if something has gone wrong in automatic mode (so we * Timer function to check if something has gone wrong in automatic mode (so we
* don't have to handle so many interrupts just to catch an exception). * don't have to handle so many interrupts just to catch an exception).
*/ */
static void img_i2c_check_timer(unsigned long arg) static void img_i2c_check_timer(struct timer_list *t)
{ {
struct img_i2c *i2c = (struct img_i2c *)arg; struct img_i2c *i2c = from_timer(i2c, t, check_timer);
unsigned long flags; unsigned long flags;
unsigned int line_status; unsigned int line_status;
@ -1362,8 +1362,7 @@ static int img_i2c_probe(struct platform_device *pdev)
} }
/* Set up the exception check timer */ /* Set up the exception check timer */
setup_timer(&i2c->check_timer, img_i2c_check_timer, timer_setup(&i2c->check_timer, img_i2c_check_timer, 0);
(unsigned long)i2c);
i2c->bitrate = timings[0].max_bitrate; i2c->bitrate = timings[0].max_bitrate;
if (!of_property_read_u32(node, "clock-frequency", &val)) if (!of_property_read_u32(node, "clock-frequency", &val))

69
drivers/i2c/busses/i2c-pnx.c
View File

@ -15,10 +15,8 @@
#include <linux/ioport.h> #include <linux/ioport.h>
#include <linux/delay.h> #include <linux/delay.h>
#include <linux/i2c.h> #include <linux/i2c.h>
#include <linux/timer.h>
#include <linux/completion.h> #include <linux/completion.h>
#include <linux/platform_device.h> #include <linux/platform_device.h>
#include <linux/i2c-pnx.h>
#include <linux/io.h> #include <linux/io.h>
#include <linux/err.h> #include <linux/err.h>
#include <linux/clk.h> #include <linux/clk.h>
@ -29,6 +27,25 @@
#define I2C_PNX_SPEED_KHZ_DEFAULT 100 #define I2C_PNX_SPEED_KHZ_DEFAULT 100
#define I2C_PNX_REGION_SIZE 0x100 #define I2C_PNX_REGION_SIZE 0x100
struct i2c_pnx_mif {
int ret; /* Return value */
int mode; /* Interface mode */
struct completion complete; /* I/O completion */
u8 * buf; /* Data buffer */
int len; /* Length of data buffer */
int order; /* RX Bytes to order via TX */
};
struct i2c_pnx_algo_data {
void __iomem *ioaddr;
struct i2c_pnx_mif mif;
int last;
struct clk *clk;
struct i2c_adapter adapter;
int irq;
u32 timeout;
};
enum { enum {
mstatus_tdi = 0x00000001, mstatus_tdi = 0x00000001,
mstatus_afi = 0x00000002, mstatus_afi = 0x00000002,
@ -98,25 +115,6 @@ static inline int wait_reset(struct i2c_pnx_algo_data *data)
return (timeout <= 0); return (timeout <= 0);
} }
static inline void i2c_pnx_arm_timer(struct i2c_pnx_algo_data *alg_data)
{
struct timer_list *timer = &alg_data->mif.timer;
unsigned long expires = msecs_to_jiffies(alg_data->timeout);
if (expires <= 1)
expires = 2;
del_timer_sync(timer);
dev_dbg(&alg_data->adapter.dev, "Timer armed at %lu plus %lu jiffies.\n",
jiffies, expires);
timer->expires = jiffies + expires;
timer->data = (unsigned long)alg_data;
add_timer(timer);
}
/** /**
* i2c_pnx_start - start a device * i2c_pnx_start - start a device
* @slave_addr: slave address * @slave_addr: slave address
@ -241,8 +239,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data)
~(mcntrl_afie | mcntrl_naie | mcntrl_drmie), ~(mcntrl_afie | mcntrl_naie | mcntrl_drmie),
I2C_REG_CTL(alg_data)); I2C_REG_CTL(alg_data));
del_timer_sync(&alg_data->mif.timer);
dev_dbg(&alg_data->adapter.dev, dev_dbg(&alg_data->adapter.dev,
"%s(): Waking up xfer routine.\n", "%s(): Waking up xfer routine.\n",
__func__); __func__);
@ -258,8 +254,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data)
~(mcntrl_afie | mcntrl_naie | mcntrl_drmie), ~(mcntrl_afie | mcntrl_naie | mcntrl_drmie),
I2C_REG_CTL(alg_data)); I2C_REG_CTL(alg_data));
/* Stop timer. */
del_timer_sync(&alg_data->mif.timer);
dev_dbg(&alg_data->adapter.dev, dev_dbg(&alg_data->adapter.dev,
"%s(): Waking up xfer routine after zero-xfer.\n", "%s(): Waking up xfer routine after zero-xfer.\n",
__func__); __func__);
@ -346,8 +340,6 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data)
mcntrl_drmie | mcntrl_daie); mcntrl_drmie | mcntrl_daie);
iowrite32(ctl, I2C_REG_CTL(alg_data)); iowrite32(ctl, I2C_REG_CTL(alg_data));
/* Kill timer. */
del_timer_sync(&alg_data->mif.timer);
complete(&alg_data->mif.complete); complete(&alg_data->mif.complete);
} }
} }
@ -382,8 +374,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id)
mcntrl_drmie); mcntrl_drmie);
iowrite32(ctl, I2C_REG_CTL(alg_data)); iowrite32(ctl, I2C_REG_CTL(alg_data));
/* Stop timer, to prevent timeout. */
del_timer_sync(&alg_data->mif.timer);
complete(&alg_data->mif.complete); complete(&alg_data->mif.complete);
} else if (stat & mstatus_nai) { } else if (stat & mstatus_nai) {
/* Slave did not acknowledge, generate a STOP */ /* Slave did not acknowledge, generate a STOP */
@ -401,8 +391,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id)
/* Our return value. */ /* Our return value. */
alg_data->mif.ret = -EIO; alg_data->mif.ret = -EIO;
/* Stop timer, to prevent timeout. */
del_timer_sync(&alg_data->mif.timer);
complete(&alg_data->mif.complete); complete(&alg_data->mif.complete);
} else { } else {
/* /*
@ -435,9 +423,8 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id)
return IRQ_HANDLED; return IRQ_HANDLED;
} }
static void i2c_pnx_timeout(unsigned long data) static void i2c_pnx_timeout(struct i2c_pnx_algo_data *alg_data)
{ {
struct i2c_pnx_algo_data *alg_data = (struct i2c_pnx_algo_data *)data;
u32 ctl; u32 ctl;
dev_err(&alg_data->adapter.dev, dev_err(&alg_data->adapter.dev,
@ -454,7 +441,6 @@ static void i2c_pnx_timeout(unsigned long data)
iowrite32(ctl, I2C_REG_CTL(alg_data)); iowrite32(ctl, I2C_REG_CTL(alg_data));
wait_reset(alg_data); wait_reset(alg_data);
alg_data->mif.ret = -EIO; alg_data->mif.ret = -EIO;
complete(&alg_data->mif.complete);
} }
static inline void bus_reset_if_active(struct i2c_pnx_algo_data *alg_data) static inline void bus_reset_if_active(struct i2c_pnx_algo_data *alg_data)
@ -496,6 +482,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
struct i2c_msg *pmsg; struct i2c_msg *pmsg;
int rc = 0, completed = 0, i; int rc = 0, completed = 0, i;
struct i2c_pnx_algo_data *alg_data = adap->algo_data; struct i2c_pnx_algo_data *alg_data = adap->algo_data;
unsigned long time_left;
u32 stat; u32 stat;
dev_dbg(&alg_data->adapter.dev, dev_dbg(&alg_data->adapter.dev,
@ -530,7 +517,6 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
dev_dbg(&alg_data->adapter.dev, "%s(): mode %d, %d bytes\n", dev_dbg(&alg_data->adapter.dev, "%s(): mode %d, %d bytes\n",
__func__, alg_data->mif.mode, alg_data->mif.len); __func__, alg_data->mif.mode, alg_data->mif.len);
i2c_pnx_arm_timer(alg_data);
/* initialize the completion var */ /* initialize the completion var */
init_completion(&alg_data->mif.complete); init_completion(&alg_data->mif.complete);
@ -546,7 +532,10 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
break; break;
/* Wait for completion */ /* Wait for completion */
wait_for_completion(&alg_data->mif.complete); time_left = wait_for_completion_timeout(&alg_data->mif.complete,
alg_data->timeout);
if (time_left == 0)
i2c_pnx_timeout(alg_data);
if (!(rc = alg_data->mif.ret)) if (!(rc = alg_data->mif.ret))
completed++; completed++;
@ -639,7 +628,10 @@ static int i2c_pnx_probe(struct platform_device *pdev)
alg_data->adapter.algo_data = alg_data; alg_data->adapter.algo_data = alg_data;
alg_data->adapter.nr = pdev->id; alg_data->adapter.nr = pdev->id;
alg_data->timeout = I2C_PNX_TIMEOUT_DEFAULT; alg_data->timeout = msecs_to_jiffies(I2C_PNX_TIMEOUT_DEFAULT);
if (alg_data->timeout <= 1)
alg_data->timeout = 2;
#ifdef CONFIG_OF #ifdef CONFIG_OF
alg_data->adapter.dev.of_node = of_node_get(pdev->dev.of_node); alg_data->adapter.dev.of_node = of_node_get(pdev->dev.of_node);
if (pdev->dev.of_node) { if (pdev->dev.of_node) {
@ -659,9 +651,6 @@ static int i2c_pnx_probe(struct platform_device *pdev)
if (IS_ERR(alg_data->clk)) if (IS_ERR(alg_data->clk))
return PTR_ERR(alg_data->clk); return PTR_ERR(alg_data->clk);
setup_timer(&alg_data->mif.timer, i2c_pnx_timeout,
(unsigned long)alg_data);
snprintf(alg_data->adapter.name, sizeof(alg_data->adapter.name), snprintf(alg_data->adapter.name, sizeof(alg_data->adapter.name),
"%s", pdev->name); "%s", pdev->name);

17
drivers/i2c/busses/i2c-rcar.c
View File

@ -173,6 +173,14 @@ static void rcar_i2c_init(struct rcar_i2c_priv *priv)
rcar_i2c_write(priv, ICCCR, priv->icccr); rcar_i2c_write(priv, ICCCR, priv->icccr);
} }
static void rcar_i2c_reset_slave(struct rcar_i2c_priv *priv)
{
rcar_i2c_write(priv, ICSIER, 0);
rcar_i2c_write(priv, ICSSR, 0);
rcar_i2c_write(priv, ICSCR, SDBS);
rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
}
static int rcar_i2c_bus_barrier(struct rcar_i2c_priv *priv) static int rcar_i2c_bus_barrier(struct rcar_i2c_priv *priv)
{ {
int i; int i;
@ -818,11 +826,8 @@ static int rcar_unreg_slave(struct i2c_client *slave)
/* ensure no irq is running before clearing ptr */ /* ensure no irq is running before clearing ptr */
disable_irq(priv->irq); disable_irq(priv->irq);
rcar_i2c_write(priv, ICSIER, 0); rcar_i2c_reset_slave(priv);
rcar_i2c_write(priv, ICSSR, 0);
enable_irq(priv->irq); enable_irq(priv->irq);
rcar_i2c_write(priv, ICSCR, SDBS);
rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
priv->slave = NULL; priv->slave = NULL;
@ -919,7 +924,9 @@ static int rcar_i2c_probe(struct platform_device *pdev)
if (ret < 0) if (ret < 0)
goto out_pm_put; goto out_pm_put;
rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ /* Bring hardware to known state */
rcar_i2c_init(priv);
rcar_i2c_reset_slave(priv);
if (priv->devtype == I2C_RCAR_GEN3) { if (priv->devtype == I2C_RCAR_GEN3) {
priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);

21
drivers/infiniband/core/user_mad.c
View File

@ -60,6 +60,8 @@ MODULE_AUTHOR("Roland Dreier");
MODULE_DESCRIPTION("InfiniBand userspace MAD packet access"); MODULE_DESCRIPTION("InfiniBand userspace MAD packet access");
MODULE_LICENSE("Dual BSD/GPL"); MODULE_LICENSE("Dual BSD/GPL");
#define MAX_UMAD_RECV_LIST_SIZE 200000
enum { enum {
IB_UMAD_MAX_PORTS = 64, IB_UMAD_MAX_PORTS = 64,
IB_UMAD_MAX_AGENTS = 32, IB_UMAD_MAX_AGENTS = 32,
@ -108,6 +110,7 @@ struct ib_umad_file {
struct mutex mutex; struct mutex mutex;
struct ib_umad_port *port; struct ib_umad_port *port;
struct list_head recv_list; struct list_head recv_list;
atomic_t recv_list_size;
struct list_head send_list; struct list_head send_list;
struct list_head port_list; struct list_head port_list;
spinlock_t send_lock; spinlock_t send_lock;
@ -160,24 +163,28 @@ static struct ib_mad_agent *__get_agent(struct ib_umad_file *file, int id)
return file->agents_dead ? NULL : file->agent[id]; return file->agents_dead ? NULL : file->agent[id];
} }
static int queue_packet(struct ib_umad_file *file, static int queue_packet(struct ib_umad_file *file, struct ib_mad_agent *agent,
struct ib_mad_agent *agent, struct ib_umad_packet *packet, bool is_recv_mad)
struct ib_umad_packet *packet)
{ {
int ret = 1; int ret = 1;
mutex_lock(&file->mutex); mutex_lock(&file->mutex);
if (is_recv_mad &&
atomic_read(&file->recv_list_size) > MAX_UMAD_RECV_LIST_SIZE)
goto unlock;
for (packet->mad.hdr.id = 0; for (packet->mad.hdr.id = 0;
packet->mad.hdr.id < IB_UMAD_MAX_AGENTS; packet->mad.hdr.id < IB_UMAD_MAX_AGENTS;
packet->mad.hdr.id++) packet->mad.hdr.id++)
if (agent == __get_agent(file, packet->mad.hdr.id)) { if (agent == __get_agent(file, packet->mad.hdr.id)) {
list_add_tail(&packet->list, &file->recv_list); list_add_tail(&packet->list, &file->recv_list);
atomic_inc(&file->recv_list_size);
wake_up_interruptible(&file->recv_wait); wake_up_interruptible(&file->recv_wait);
ret = 0; ret = 0;
break; break;
} }
unlock:
mutex_unlock(&file->mutex); mutex_unlock(&file->mutex);
return ret; return ret;
@ -204,7 +211,7 @@ static void send_handler(struct ib_mad_agent *agent,
if (send_wc->status == IB_WC_RESP_TIMEOUT_ERR) { if (send_wc->status == IB_WC_RESP_TIMEOUT_ERR) {
packet->length = IB_MGMT_MAD_HDR; packet->length = IB_MGMT_MAD_HDR;
packet->mad.hdr.status = ETIMEDOUT; packet->mad.hdr.status = ETIMEDOUT;
if (!queue_packet(file, agent, packet)) if (!queue_packet(file, agent, packet, false))
return; return;
} }
kfree(packet); kfree(packet);
@ -260,7 +267,7 @@ static void recv_handler(struct ib_mad_agent *agent,
packet->mad.hdr.flow_label = cpu_to_be32(grh->flow_label); packet->mad.hdr.flow_label = cpu_to_be32(grh->flow_label);
} }
if (queue_packet(file, agent, packet)) if (queue_packet(file, agent, packet, true))
goto err2; goto err2;
return; return;
@ -374,6 +381,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
packet = list_entry(file->recv_list.next, struct ib_umad_packet, list); packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);
list_del(&packet->list); list_del(&packet->list);
atomic_dec(&file->recv_list_size);
mutex_unlock(&file->mutex); mutex_unlock(&file->mutex);
@ -386,6 +394,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
/* Requeue packet */ /* Requeue packet */
mutex_lock(&file->mutex); mutex_lock(&file->mutex);
list_add(&packet->list, &file->recv_list); list_add(&packet->list, &file->recv_list);
atomic_inc(&file->recv_list_size);
mutex_unlock(&file->mutex); mutex_unlock(&file->mutex);
} else { } else {
if (packet->recv_wc) if (packet->recv_wc)

7
drivers/input/ff-core.c
View File

@ -24,8 +24,10 @@
/* #define DEBUG */ /* #define DEBUG */
#include <linux/input.h> #include <linux/input.h>
#include <linux/limits.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/mutex.h> #include <linux/mutex.h>
#include <linux/overflow.h>
#include <linux/sched.h> #include <linux/sched.h>
#include <linux/slab.h> #include <linux/slab.h>
@ -330,9 +332,8 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects)
return -EINVAL; return -EINVAL;
} }
ff_dev_size = sizeof(struct ff_device) + ff_dev_size = struct_size(ff, effect_owners, max_effects);
max_effects * sizeof(struct file *); if (ff_dev_size == SIZE_MAX) /* overflow */
if (ff_dev_size < max_effects) /* overflow */
return -EINVAL; return -EINVAL;
ff = kzalloc(ff_dev_size, GFP_KERNEL); ff = kzalloc(ff_dev_size, GFP_KERNEL);

2
drivers/media/dvb-frontends/as102_fe_types.h
View File

@ -183,6 +183,6 @@ struct as10x_register_addr {
uint32_t addr; uint32_t addr;
/* register mode access */ /* register mode access */
uint8_t mode; uint8_t mode;
}; } __packed;
#endif #endif

9
drivers/media/dvb-frontends/tda10048.c
View File

@ -422,6 +422,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)
struct tda10048_config *config = &state->config; struct tda10048_config *config = &state->config;
int i; int i;
u32 if_freq_khz; u32 if_freq_khz;
u64 sample_freq;
dprintk(1, "%s(bw = %d)\n", __func__, bw); dprintk(1, "%s(bw = %d)\n", __func__, bw);
@ -463,9 +464,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)
dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor); dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor);
/* Calculate the sample frequency */ /* Calculate the sample frequency */
state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45); sample_freq = state->xtal_hz;
state->sample_freq /= (state->pll_nfactor + 1); sample_freq *= state->pll_mfactor + 45;
state->sample_freq /= (state->pll_pfactor + 4); do_div(sample_freq, state->pll_nfactor + 1);
do_div(sample_freq, state->pll_pfactor + 4);
state->sample_freq = sample_freq;
dprintk(1, "- sample_freq = %d\n", state->sample_freq); dprintk(1, "- sample_freq = %d\n", state->sample_freq);
/* Update the I/F */ /* Update the I/F */

4
drivers/media/dvb-frontends/tda18271c2dd.c
View File

@ -345,7 +345,7 @@ static int CalcMainPLL(struct tda_state *state, u32 freq)
OscFreq = (u64) freq * (u64) Div; OscFreq = (u64) freq * (u64) Div;
OscFreq *= (u64) 16384; OscFreq *= (u64) 16384;
do_div(OscFreq, (u64)16000000); do_div(OscFreq, 16000000);
MainDiv = OscFreq; MainDiv = OscFreq;
state->m_Regs[MPD] = PostDiv & 0x77; state->m_Regs[MPD] = PostDiv & 0x77;
@ -369,7 +369,7 @@ static int CalcCalPLL(struct tda_state *state, u32 freq)
OscFreq = (u64)freq * (u64)Div; OscFreq = (u64)freq * (u64)Div;
/* CalDiv = u32( OscFreq * 16384 / 16000000 ); */ /* CalDiv = u32( OscFreq * 16384 / 16000000 ); */
OscFreq *= (u64)16384; OscFreq *= (u64)16384;
do_div(OscFreq, (u64)16000000); do_div(OscFreq, 16000000);
CalDiv = OscFreq; CalDiv = OscFreq;
state->m_Regs[CPD] = PostDiv; state->m_Regs[CPD] = PostDiv;

18
drivers/media/usb/dvb-usb/dib0700_devices.c
View File

@ -2423,7 +2423,12 @@ static int stk9090m_frontend_attach(struct dvb_usb_adapter *adap)
adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &stk9090m_config); adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &stk9090m_config);
return adap->fe_adap[0].fe == NULL ? -ENODEV : 0; if (!adap->fe_adap[0].fe) {
release_firmware(state->frontend_firmware);
return -ENODEV;
}
return 0;
} }
static int dib9090_tuner_attach(struct dvb_usb_adapter *adap) static int dib9090_tuner_attach(struct dvb_usb_adapter *adap)
@ -2496,8 +2501,10 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap)
dib9000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, 0x80); dib9000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, 0x80);
adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &nim9090md_config[0]); adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &nim9090md_config[0]);
if (adap->fe_adap[0].fe == NULL) if (!adap->fe_adap[0].fe) {
release_firmware(state->frontend_firmware);
return -ENODEV; return -ENODEV;
}
i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_3_4, 0); i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_3_4, 0);
dib9000_i2c_enumeration(i2c, 1, 0x12, 0x82); dib9000_i2c_enumeration(i2c, 1, 0x12, 0x82);
@ -2505,7 +2512,12 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap)
fe_slave = dvb_attach(dib9000_attach, i2c, 0x82, &nim9090md_config[1]); fe_slave = dvb_attach(dib9000_attach, i2c, 0x82, &nim9090md_config[1]);
dib9000_set_slave_frontend(adap->fe_adap[0].fe, fe_slave); dib9000_set_slave_frontend(adap->fe_adap[0].fe, fe_slave);
return fe_slave == NULL ? -ENODEV : 0; if (!fe_slave) {
release_firmware(state->frontend_firmware);
return -ENODEV;
}
return 0;
} }
static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap) static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap)

120
drivers/media/usb/dvb-usb/dw2102.c
View File

@ -721,6 +721,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
{ {
struct dvb_usb_device *d = i2c_get_adapdata(adap); struct dvb_usb_device *d = i2c_get_adapdata(adap);
struct dw2102_state *state; struct dw2102_state *state;
int j;
if (!d) if (!d)
return -ENODEV; return -ENODEV;
@ -734,11 +735,11 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
return -EAGAIN; return -EAGAIN;
} }
switch (num) { j = 0;
case 1: while (j < num) {
switch (msg[0].addr) { switch (msg[j].addr) {
case SU3000_STREAM_CTRL: case SU3000_STREAM_CTRL:
state->data[0] = msg[0].buf[0] + 0x36; state->data[0] = msg[j].buf[0] + 0x36;
state->data[1] = 3; state->data[1] = 3;
state->data[2] = 0; state->data[2] = 0;
if (dvb_usb_generic_rw(d, state->data, 3, if (dvb_usb_generic_rw(d, state->data, 3,
@ -750,61 +751,86 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
if (dvb_usb_generic_rw(d, state->data, 1, if (dvb_usb_generic_rw(d, state->data, 1,
state->data, 2, 0) < 0) state->data, 2, 0) < 0)
err("i2c transfer failed."); err("i2c transfer failed.");
msg[0].buf[1] = state->data[0]; msg[j].buf[1] = state->data[0];
msg[0].buf[0] = state->data[1]; msg[j].buf[0] = state->data[1];
break; break;
default: default:
if (3 + msg[0].len > sizeof(state->data)) { /* if the current write msg is followed by a another
warn("i2c wr: len=%d is too big!\n", * read msg to/from the same address
msg[0].len); */
if ((j+1 < num) && (msg[j+1].flags & I2C_M_RD) &&
(msg[j].addr == msg[j+1].addr)) {
/* join both i2c msgs to one usb read command */
if (4 + msg[j].len > sizeof(state->data)) {
warn("i2c combined wr/rd: write len=%d is too big!\n",
msg[j].len);
num = -EOPNOTSUPP;
break;
}
if (1 + msg[j+1].len > sizeof(state->data)) {
warn("i2c combined wr/rd: read len=%d is too big!\n",
msg[j+1].len);
num = -EOPNOTSUPP;
break;
}
state->data[0] = 0x09;
state->data[1] = msg[j].len;
state->data[2] = msg[j+1].len;
state->data[3] = msg[j].addr;
memcpy(&state->data[4], msg[j].buf, msg[j].len);
if (dvb_usb_generic_rw(d, state->data, msg[j].len + 4,
state->data, msg[j+1].len + 1, 0) < 0)
err("i2c transfer failed.");
memcpy(msg[j+1].buf, &state->data[1], msg[j+1].len);
j++;
break;
}
if (msg[j].flags & I2C_M_RD) {
/* single read */
if (4 + msg[j].len > sizeof(state->data)) {
warn("i2c rd: len=%d is too big!\n", msg[j].len);
num = -EOPNOTSUPP;
break;
}
state->data[0] = 0x09;
state->data[1] = 0;
state->data[2] = msg[j].len;
state->data[3] = msg[j].addr;
memcpy(&state->data[4], msg[j].buf, msg[j].len);
if (dvb_usb_generic_rw(d, state->data, 4,
state->data, msg[j].len + 1, 0) < 0)
err("i2c transfer failed.");
memcpy(msg[j].buf, &state->data[1], msg[j].len);
break;
}
/* single write */
if (3 + msg[j].len > sizeof(state->data)) {
warn("i2c wr: len=%d is too big!\n", msg[j].len);
num = -EOPNOTSUPP; num = -EOPNOTSUPP;
break; break;
} }
/* always i2c write*/
state->data[0] = 0x08; state->data[0] = 0x08;
state->data[1] = msg[0].addr; state->data[1] = msg[j].addr;
state->data[2] = msg[0].len; state->data[2] = msg[j].len;
memcpy(&state->data[3], msg[0].buf, msg[0].len); memcpy(&state->data[3], msg[j].buf, msg[j].len);
if (dvb_usb_generic_rw(d, state->data, msg[0].len + 3, if (dvb_usb_generic_rw(d, state->data, msg[j].len + 3,
state->data, 1, 0) < 0) state->data, 1, 0) < 0)
err("i2c transfer failed."); err("i2c transfer failed.");
} // switch
j++;
} } // while
break;
case 2:
/* always i2c read */
if (4 + msg[0].len > sizeof(state->data)) {
warn("i2c rd: len=%d is too big!\n",
msg[0].len);
num = -EOPNOTSUPP;
break;
}
if (1 + msg[1].len > sizeof(state->data)) {
warn("i2c rd: len=%d is too big!\n",
msg[1].len);
num = -EOPNOTSUPP;
break;
}
state->data[0] = 0x09;
state->data[1] = msg[0].len;
state->data[2] = msg[1].len;
state->data[3] = msg[0].addr;
memcpy(&state->data[4], msg[0].buf, msg[0].len);
if (dvb_usb_generic_rw(d, state->data, msg[0].len + 4,
state->data, msg[1].len + 1, 0) < 0)
err("i2c transfer failed.");
memcpy(msg[1].buf, &state->data[1], msg[1].len);
break;
default:
warn("more than 2 i2c messages at a time is not handled yet.");
break;
}
mutex_unlock(&d->data_mutex); mutex_unlock(&d->data_mutex);
mutex_unlock(&d->i2c_mutex); mutex_unlock(&d->i2c_mutex);
return num; return num;

20
drivers/media/usb/s2255/s2255drv.c
View File

@ -256,7 +256,7 @@ struct s2255_vc {
struct s2255_dev { struct s2255_dev {
struct s2255_vc vc[MAX_CHANNELS]; struct s2255_vc vc[MAX_CHANNELS];
struct v4l2_device v4l2_dev; struct v4l2_device v4l2_dev;
atomic_t num_channels; refcount_t num_channels;
int frames; int frames;
struct mutex lock; /* channels[].vdev.lock */ struct mutex lock; /* channels[].vdev.lock */
struct mutex cmdlock; /* protects cmdbuf */ struct mutex cmdlock; /* protects cmdbuf */
@ -1581,11 +1581,11 @@ static void s2255_video_device_release(struct video_device *vdev)
container_of(vdev, struct s2255_vc, vdev); container_of(vdev, struct s2255_vc, vdev);
dprintk(dev, 4, "%s, chnls: %d\n", __func__, dprintk(dev, 4, "%s, chnls: %d\n", __func__,
atomic_read(&dev->num_channels)); refcount_read(&dev->num_channels));
v4l2_ctrl_handler_free(&vc->hdl); v4l2_ctrl_handler_free(&vc->hdl);
if (atomic_dec_and_test(&dev->num_channels)) if (refcount_dec_and_test(&dev->num_channels))
s2255_destroy(dev); s2255_destroy(dev);
return; return;
} }
@ -1688,7 +1688,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
"failed to register video device!\n"); "failed to register video device!\n");
break; break;
} }
atomic_inc(&dev->num_channels); refcount_inc(&dev->num_channels);
v4l2_info(&dev->v4l2_dev, "V4L2 device registered as %s\n", v4l2_info(&dev->v4l2_dev, "V4L2 device registered as %s\n",
video_device_node_name(&vc->vdev)); video_device_node_name(&vc->vdev));
@ -1696,11 +1696,11 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
pr_info("Sensoray 2255 V4L driver Revision: %s\n", pr_info("Sensoray 2255 V4L driver Revision: %s\n",
S2255_VERSION); S2255_VERSION);
/* if no channels registered, return error and probe will fail*/ /* if no channels registered, return error and probe will fail*/
if (atomic_read(&dev->num_channels) == 0) { if (refcount_read(&dev->num_channels) == 0) {
v4l2_device_unregister(&dev->v4l2_dev); v4l2_device_unregister(&dev->v4l2_dev);
return ret; return ret;
} }
if (atomic_read(&dev->num_channels) != MAX_CHANNELS) if (refcount_read(&dev->num_channels) != MAX_CHANNELS)
pr_warn("s2255: Not all channels available.\n"); pr_warn("s2255: Not all channels available.\n");
return 0; return 0;
} }
@ -2250,7 +2250,7 @@ static int s2255_probe(struct usb_interface *interface,
goto errorFWDATA1; goto errorFWDATA1;
} }
atomic_set(&dev->num_channels, 0); refcount_set(&dev->num_channels, 0);
dev->pid = id->idProduct; dev->pid = id->idProduct;
dev->fw_data = kzalloc(sizeof(struct s2255_fw), GFP_KERNEL); dev->fw_data = kzalloc(sizeof(struct s2255_fw), GFP_KERNEL);
if (!dev->fw_data) if (!dev->fw_data)
@ -2370,12 +2370,12 @@ static void s2255_disconnect(struct usb_interface *interface)
{ {
struct s2255_dev *dev = to_s2255_dev(usb_get_intfdata(interface)); struct s2255_dev *dev = to_s2255_dev(usb_get_intfdata(interface));
int i; int i;
int channels = atomic_read(&dev->num_channels); int channels = refcount_read(&dev->num_channels);
mutex_lock(&dev->lock); mutex_lock(&dev->lock);
v4l2_device_disconnect(&dev->v4l2_dev); v4l2_device_disconnect(&dev->v4l2_dev);
mutex_unlock(&dev->lock); mutex_unlock(&dev->lock);
/*see comments in the uvc_driver.c usb disconnect function */ /*see comments in the uvc_driver.c usb disconnect function */
atomic_inc(&dev->num_channels); refcount_inc(&dev->num_channels);
/* unregister each video device. */ /* unregister each video device. */
for (i = 0; i < channels; i++) for (i = 0; i < channels; i++)
video_unregister_device(&dev->vc[i].vdev); video_unregister_device(&dev->vc[i].vdev);
@ -2388,7 +2388,7 @@ static void s2255_disconnect(struct usb_interface *interface)
dev->vc[i].vidstatus_ready = 1; dev->vc[i].vidstatus_ready = 1;
wake_up(&dev->vc[i].wait_vidstatus); wake_up(&dev->vc[i].wait_vidstatus);
} }
if (atomic_dec_and_test(&dev->num_channels)) if (refcount_dec_and_test(&dev->num_channels))
s2255_destroy(dev); s2255_destroy(dev);
dev_info(&interface->dev, "%s\n", __func__); dev_info(&interface->dev, "%s\n", __func__);
} }

6
drivers/net/bonding/bond_options.c
View File

@ -1074,9 +1074,9 @@ static int bond_option_arp_ip_targets_set(struct bonding *bond,
__be32 target; __be32 target;
if (newval->string) { if (newval->string) {
if (!in4_pton(newval->string+1, -1, (u8 *)&target, -1, NULL)) { if (strlen(newval->string) < 1 ||
netdev_err(bond->dev, "invalid ARP target %pI4 specified\n", !in4_pton(newval->string + 1, -1, (u8 *)&target, -1, NULL)) {
&target); netdev_err(bond->dev, "invalid ARP target specified\n");
return ret; return ret;
} }
if (newval->string[0] == '+') if (newval->string[0] == '+')

4
drivers/net/dsa/mv88e6xxx/chip.c
View File

@ -227,8 +227,8 @@ struct mii_bus *mv88e6xxx_default_mdio_bus(struct mv88e6xxx_chip *chip)
{ {
struct mv88e6xxx_mdio_bus *mdio_bus; struct mv88e6xxx_mdio_bus *mdio_bus;
mdio_bus = list_first_entry(&chip->mdios, struct mv88e6xxx_mdio_bus, mdio_bus = list_first_entry_or_null(&chip->mdios,
list); struct mv88e6xxx_mdio_bus, list);
if (!mdio_bus) if (!mdio_bus)
return NULL; return NULL;

2
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
View File

@ -1252,7 +1252,7 @@ enum {
struct bnx2x_fw_stats_req { struct bnx2x_fw_stats_req {
struct stats_query_header hdr; struct stats_query_header hdr;
struct stats_query_entry query[FP_SB_MAX_E1x+ struct stats_query_entry query[FP_SB_MAX_E2 +
BNX2X_FIRST_QUEUE_QUERY_IDX]; BNX2X_FIRST_QUEUE_QUERY_IDX];
}; };

5
drivers/net/ethernet/lantiq_etop.c
View File

@ -221,8 +221,9 @@ ltq_etop_free_channel(struct net_device *dev, struct ltq_etop_chan *ch)
if (ch->dma.irq) if (ch->dma.irq)
free_irq(ch->dma.irq, priv); free_irq(ch->dma.irq, priv);
if (IS_RX(ch->idx)) { if (IS_RX(ch->idx)) {
int desc; struct ltq_dma_channel *dma = &ch->dma;
for (desc = 0; desc < LTQ_DESC_NUM; desc++)
for (dma->desc = 0; dma->desc < LTQ_DESC_NUM; dma->desc++)
dev_kfree_skb_any(ch->skb[ch->dma.desc]); dev_kfree_skb_any(ch->skb[ch->dma.desc]);
} }
} }

15
drivers/net/ppp/ppp_generic.c
View File

@ -73,6 +73,7 @@
#define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */ #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */
#define PPP_PROTO_LEN 2 #define PPP_PROTO_LEN 2
#define PPP_LCP_HDRLEN 4
/* /*
* An instance of /dev/ppp can be associated with either a ppp * An instance of /dev/ppp can be associated with either a ppp
@ -494,6 +495,15 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
return ret; return ret;
} }
static bool ppp_check_packet(struct sk_buff *skb, size_t count)
{
/* LCP packets must include LCP header which 4 bytes long:
* 1-byte code, 1-byte identifier, and 2-byte length.
*/
return get_unaligned_be16(skb->data) != PPP_LCP ||
count >= PPP_PROTO_LEN + PPP_LCP_HDRLEN;
}
static ssize_t ppp_write(struct file *file, const char __user *buf, static ssize_t ppp_write(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
@ -516,6 +526,11 @@ static ssize_t ppp_write(struct file *file, const char __user *buf,
kfree_skb(skb); kfree_skb(skb);
goto out; goto out;
} }
ret = -EINVAL;
if (unlikely(!ppp_check_packet(skb, count))) {
kfree_skb(skb);
goto out;
}
switch (pf->kind) { switch (pf->kind) {
case INTERFACE: case INTERFACE:

4
drivers/s390/crypto/pkey_api.c
View File

@ -1088,7 +1088,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
if (rc) if (rc)
break; break;
if (copy_to_user(ucs, &kcs, sizeof(kcs))) if (copy_to_user(ucs, &kcs, sizeof(kcs)))
return -EFAULT; rc = -EFAULT;
memzero_explicit(&kcs, sizeof(kcs)); memzero_explicit(&kcs, sizeof(kcs));
break; break;
} }
@ -1119,7 +1119,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
if (rc) if (rc)
break; break;
if (copy_to_user(ucp, &kcp, sizeof(kcp))) if (copy_to_user(ucp, &kcp, sizeof(kcp)))
return -EFAULT; rc = -EFAULT;
memzero_explicit(&kcp, sizeof(kcp)); memzero_explicit(&kcp, sizeof(kcp));
break; break;
} }

18
drivers/usb/core/config.c
View File

@ -291,6 +291,20 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
if (ifp->desc.bNumEndpoints >= num_ep) if (ifp->desc.bNumEndpoints >= num_ep)
goto skip_to_next_endpoint_or_interface_descriptor; goto skip_to_next_endpoint_or_interface_descriptor;
/* Save a copy of the descriptor and use it instead of the original */
endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
memcpy(&endpoint->desc, d, n);
d = &endpoint->desc;
/* Clear the reserved bits in bEndpointAddress */
i = d->bEndpointAddress &
(USB_ENDPOINT_DIR_MASK | USB_ENDPOINT_NUMBER_MASK);
if (i != d->bEndpointAddress) {
dev_notice(ddev, "config %d interface %d altsetting %d has an endpoint descriptor with address 0x%X, changing to 0x%X\n",
cfgno, inum, asnum, d->bEndpointAddress, i);
endpoint->desc.bEndpointAddress = i;
}
/* Check for duplicate endpoint addresses */ /* Check for duplicate endpoint addresses */
if (config_endpoint_is_duplicate(config, inum, asnum, d)) { if (config_endpoint_is_duplicate(config, inum, asnum, d)) {
dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
@ -308,10 +322,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
} }
} }
endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; /* Accept this endpoint */
++ifp->desc.bNumEndpoints; ++ifp->desc.bNumEndpoints;
memcpy(&endpoint->desc, d, n);
INIT_LIST_HEAD(&endpoint->urb_list); INIT_LIST_HEAD(&endpoint->urb_list);
/* /*

3
drivers/usb/core/quirks.c
View File

@ -313,6 +313,9 @@ static const struct usb_device_id usb_quirk_list[] = {
{ USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT | { USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT |
USB_QUIRK_DELAY_CTRL_MSG }, USB_QUIRK_DELAY_CTRL_MSG },
/* START BP-850k Printer */
{ USB_DEVICE(0x1bc3, 0x0003), .driver_info = USB_QUIRK_NO_SET_INTF },
/* MIDI keyboard WORLDE MINI */ /* MIDI keyboard WORLDE MINI */
{ USB_DEVICE(0x1c75, 0x0204), .driver_info = { USB_DEVICE(0x1c75, 0x0204), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS }, USB_QUIRK_CONFIG_INTF_STRINGS },

3
drivers/usb/gadget/configfs.c
View File

@ -155,9 +155,12 @@ static int usb_string_copy(const char *s, char **s_copy)
int ret; int ret;
char *str; char *str;
char *copy = *s_copy; char *copy = *s_copy;
ret = strlen(s); ret = strlen(s);
if (ret > USB_MAX_STRING_LEN) if (ret > USB_MAX_STRING_LEN)
return -EOVERFLOW; return -EOVERFLOW;
if (ret < 1)
return -EINVAL;
if (copy) { if (copy) {
str = copy; str = copy;

38
drivers/usb/serial/option.c
View File

@ -1428,6 +1428,10 @@ static const struct usb_device_id option_ids[] = {
.driver_info = NCTRL(0) | RSVD(1) }, .driver_info = NCTRL(0) | RSVD(1) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
.driver_info = NCTRL(0) }, .driver_info = NCTRL(0) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3000, 0xff), /* Telit FN912 */
.driver_info = RSVD(0) | NCTRL(3) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3001, 0xff), /* Telit FN912 */
.driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff), /* Telit LE910-S1 (RNDIS) */ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff), /* Telit LE910-S1 (RNDIS) */
.driver_info = NCTRL(2) }, .driver_info = NCTRL(2) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */
@ -1436,6 +1440,8 @@ static const struct usb_device_id option_ids[] = {
.driver_info = NCTRL(2) }, .driver_info = NCTRL(2) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */
.driver_info = NCTRL(2) }, .driver_info = NCTRL(2) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x9000, 0xff), /* Telit generic core-dump device */
.driver_info = NCTRL(0) },
{ USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */
.driver_info = NCTRL(0) | ZLP }, .driver_info = NCTRL(0) | ZLP },
{ USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */
@ -2227,6 +2233,10 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7126, 0xff, 0x00, 0x00),
.driver_info = NCTRL(2) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00),
.driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) },
{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200),
.driver_info = RSVD(1) | RSVD(4) }, .driver_info = RSVD(1) | RSVD(4) },
@ -2286,6 +2296,8 @@ static const struct usb_device_id option_ids[] = {
.driver_info = RSVD(3) }, .driver_info = RSVD(3) },
{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */
.driver_info = RSVD(3) }, .driver_info = RSVD(3) },
{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */
.driver_info = RSVD(5) | RSVD(6) },
{ USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
.driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
{ USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
@ -2323,6 +2335,32 @@ static const struct usb_device_id option_ids[] = {
.driver_info = RSVD(4) }, .driver_info = RSVD(4) },
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */
.driver_info = RSVD(5) }, .driver_info = RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */
.driver_info = RSVD(5) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for Global SKU */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for China SKU */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for SA */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for EU */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for NA */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for China EDU */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Golbal EDU */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },

1
fs/jffs2/super.c
View File

@ -63,6 +63,7 @@ static void jffs2_i_init_once(void *foo)
struct jffs2_inode_info *f = foo; struct jffs2_inode_info *f = foo;
mutex_init(&f->sem); mutex_init(&f->sem);
f->target = NULL;
inode_init_once(&f->vfs_inode); inode_init_once(&f->vfs_inode);
} }

18
fs/nilfs2/alloc.c
View File

@ -386,11 +386,12 @@ void *nilfs_palloc_block_get_entry(const struct inode *inode, __u64 nr,
* @target: offset number of an entry in the group (start point) * @target: offset number of an entry in the group (start point)
* @bsize: size in bits * @bsize: size in bits
* @lock: spin lock protecting @bitmap * @lock: spin lock protecting @bitmap
* @wrap: whether to wrap around
*/ */
static int nilfs_palloc_find_available_slot(unsigned char *bitmap, static int nilfs_palloc_find_available_slot(unsigned char *bitmap,
unsigned long target, unsigned long target,
unsigned int bsize, unsigned int bsize,
spinlock_t *lock) spinlock_t *lock, bool wrap)
{ {
int pos, end = bsize; int pos, end = bsize;
@ -406,6 +407,8 @@ static int nilfs_palloc_find_available_slot(unsigned char *bitmap,
end = target; end = target;
} }
if (!wrap)
return -ENOSPC;
/* wrap around */ /* wrap around */
for (pos = 0; pos < end; pos++) { for (pos = 0; pos < end; pos++) {
@ -504,9 +507,10 @@ int nilfs_palloc_count_max_entries(struct inode *inode, u64 nused, u64 *nmaxp)
* nilfs_palloc_prepare_alloc_entry - prepare to allocate a persistent object * nilfs_palloc_prepare_alloc_entry - prepare to allocate a persistent object
* @inode: inode of metadata file using this allocator * @inode: inode of metadata file using this allocator
* @req: nilfs_palloc_req structure exchanged for the allocation * @req: nilfs_palloc_req structure exchanged for the allocation
* @wrap: whether to wrap around
*/ */
int nilfs_palloc_prepare_alloc_entry(struct inode *inode, int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
struct nilfs_palloc_req *req) struct nilfs_palloc_req *req, bool wrap)
{ {
struct buffer_head *desc_bh, *bitmap_bh; struct buffer_head *desc_bh, *bitmap_bh;
struct nilfs_palloc_group_desc *desc; struct nilfs_palloc_group_desc *desc;
@ -525,7 +529,7 @@ int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
entries_per_group = nilfs_palloc_entries_per_group(inode); entries_per_group = nilfs_palloc_entries_per_group(inode);
for (i = 0; i < ngroups; i += n) { for (i = 0; i < ngroups; i += n) {
if (group >= ngroups) { if (group >= ngroups && wrap) {
/* wrap around */ /* wrap around */
group = 0; group = 0;
maxgroup = nilfs_palloc_group(inode, req->pr_entry_nr, maxgroup = nilfs_palloc_group(inode, req->pr_entry_nr,
@ -550,7 +554,13 @@ int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
bitmap = bitmap_kaddr + bh_offset(bitmap_bh); bitmap = bitmap_kaddr + bh_offset(bitmap_bh);
pos = nilfs_palloc_find_available_slot( pos = nilfs_palloc_find_available_slot(
bitmap, group_offset, bitmap, group_offset,
entries_per_group, lock); entries_per_group, lock, wrap);
/*
* Since the search for a free slot in the
* second and subsequent bitmap blocks always
* starts from the beginning, the wrap flag
* only has an effect on the first search.
*/
if (pos >= 0) { if (pos >= 0) {
/* found a free entry */ /* found a free entry */
nilfs_palloc_group_desc_add_entries( nilfs_palloc_group_desc_add_entries(

4
fs/nilfs2/alloc.h
View File

@ -59,8 +59,8 @@ struct nilfs_palloc_req {
struct buffer_head *pr_entry_bh; struct buffer_head *pr_entry_bh;
}; };
int nilfs_palloc_prepare_alloc_entry(struct inode *, int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
struct nilfs_palloc_req *); struct nilfs_palloc_req *req, bool wrap);
void nilfs_palloc_commit_alloc_entry(struct inode *, void nilfs_palloc_commit_alloc_entry(struct inode *,
struct nilfs_palloc_req *); struct nilfs_palloc_req *);
void nilfs_palloc_abort_alloc_entry(struct inode *, struct nilfs_palloc_req *); void nilfs_palloc_abort_alloc_entry(struct inode *, struct nilfs_palloc_req *);

2
fs/nilfs2/dat.c
View File

@ -84,7 +84,7 @@ int nilfs_dat_prepare_alloc(struct inode *dat, struct nilfs_palloc_req *req)
{ {
int ret; int ret;
ret = nilfs_palloc_prepare_alloc_entry(dat, req); ret = nilfs_palloc_prepare_alloc_entry(dat, req, true);
if (ret < 0) if (ret < 0)
return ret; return ret;

38
fs/nilfs2/dir.c
View File

@ -152,6 +152,9 @@ static bool nilfs_check_page(struct page *page)
goto Enamelen; goto Enamelen;
if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1)) if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1))
goto Espan; goto Espan;
if (unlikely(p->inode &&
NILFS_PRIVATE_INODE(le64_to_cpu(p->inode))))
goto Einumber;
} }
if (offs != limit) if (offs != limit)
goto Eend; goto Eend;
@ -177,6 +180,9 @@ Enamelen:
goto bad_entry; goto bad_entry;
Espan: Espan:
error = "directory entry across blocks"; error = "directory entry across blocks";
goto bad_entry;
Einumber:
error = "disallowed inode number";
bad_entry: bad_entry:
nilfs_error(sb, nilfs_error(sb,
"bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d", "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d",
@ -399,11 +405,39 @@ found:
struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p) struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p)
{ {
struct nilfs_dir_entry *de = nilfs_get_page(dir, 0, p); struct page *page;
struct nilfs_dir_entry *de, *next_de;
size_t limit;
char *msg;
de = nilfs_get_page(dir, 0, &page);
if (IS_ERR(de)) if (IS_ERR(de))
return NULL; return NULL;
return nilfs_next_entry(de);
limit = nilfs_last_byte(dir, 0); /* is a multiple of chunk size */
if (unlikely(!limit || le64_to_cpu(de->inode) != dir->i_ino ||
!nilfs_match(1, ".", de))) {
msg = "missing '.'";
goto fail;
}
next_de = nilfs_next_entry(de);
/*
* If "next_de" has not reached the end of the chunk, there is
* at least one more record. Check whether it matches "..".
*/
if (unlikely((char *)next_de == (char *)de + nilfs_chunk_size(dir) ||
!nilfs_match(2, "..", next_de))) {
msg = "missing '..'";
goto fail;
}
*p = page;
return next_de;
fail:
nilfs_error(dir->i_sb, "directory #%lu %s", dir->i_ino, msg);
nilfs_put_page(page);
return NULL;
} }
ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr) ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr)

7
fs/nilfs2/ifile.c
View File

@ -64,13 +64,10 @@ int nilfs_ifile_create_inode(struct inode *ifile, ino_t *out_ino,
struct nilfs_palloc_req req; struct nilfs_palloc_req req;
int ret; int ret;
req.pr_entry_nr = 0; /* req.pr_entry_nr = NILFS_FIRST_INO(ifile->i_sb);
* 0 says find free inode from beginning
* of a group. dull code!!
*/
req.pr_entry_bh = NULL; req.pr_entry_bh = NULL;
ret = nilfs_palloc_prepare_alloc_entry(ifile, &req); ret = nilfs_palloc_prepare_alloc_entry(ifile, &req, false);
if (!ret) { if (!ret) {
ret = nilfs_palloc_get_entry_block(ifile, req.pr_entry_nr, 1, ret = nilfs_palloc_get_entry_block(ifile, req.pr_entry_nr, 1,
&req.pr_entry_bh); &req.pr_entry_bh);

10
fs/nilfs2/nilfs.h
View File

@ -125,9 +125,15 @@ enum {
#define NILFS_FIRST_INO(sb) (((struct the_nilfs *)sb->s_fs_info)->ns_first_ino) #define NILFS_FIRST_INO(sb) (((struct the_nilfs *)sb->s_fs_info)->ns_first_ino)
#define NILFS_MDT_INODE(sb, ino) \ #define NILFS_MDT_INODE(sb, ino) \
((ino) < NILFS_FIRST_INO(sb) && (NILFS_MDT_INO_BITS & BIT(ino))) ((ino) < NILFS_USER_INO && (NILFS_MDT_INO_BITS & BIT(ino)))
#define NILFS_VALID_INODE(sb, ino) \ #define NILFS_VALID_INODE(sb, ino) \
((ino) >= NILFS_FIRST_INO(sb) || (NILFS_SYS_INO_BITS & BIT(ino))) ((ino) >= NILFS_FIRST_INO(sb) || \
((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino))))
#define NILFS_PRIVATE_INODE(ino) ({ \
ino_t __ino = (ino); \
((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO && \
(__ino) != NILFS_SKETCH_INO); })
/** /**
* struct nilfs_transaction_info: context information for synchronization * struct nilfs_transaction_info: context information for synchronization

6
fs/nilfs2/the_nilfs.c
View File

@ -429,6 +429,12 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
} }
nilfs->ns_first_ino = le32_to_cpu(sbp->s_first_ino); nilfs->ns_first_ino = le32_to_cpu(sbp->s_first_ino);
if (nilfs->ns_first_ino < NILFS_USER_INO) {
nilfs_err(nilfs->ns_sb,
"too small lower limit for non-reserved inode numbers: %u",
nilfs->ns_first_ino);
return -EINVAL;
}
nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment); nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment);
if (nilfs->ns_blocks_per_segment < NILFS_SEG_MIN_BLOCKS) { if (nilfs->ns_blocks_per_segment < NILFS_SEG_MIN_BLOCKS) {

2
fs/nilfs2/the_nilfs.h
View File

@ -190,7 +190,7 @@ struct the_nilfs {
unsigned long ns_nrsvsegs; unsigned long ns_nrsvsegs;
unsigned long ns_first_data_block; unsigned long ns_first_data_block;
int ns_inode_size; int ns_inode_size;
int ns_first_ino; unsigned int ns_first_ino;
u32 ns_crc_seed; u32 ns_crc_seed;
/* /sys/fs/<nilfs>/<device> */ /* /sys/fs/<nilfs>/<device> */

3
fs/orangefs/super.c
View File

@ -188,7 +188,8 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf)
(long)new_op->downcall.resp.statfs.files_avail); (long)new_op->downcall.resp.statfs.files_avail);
buf->f_type = sb->s_magic; buf->f_type = sb->s_magic;
memcpy(&buf->f_fsid, &ORANGEFS_SB(sb)->fs_id, sizeof(buf->f_fsid)); buf->f_fsid.val[0] = ORANGEFS_SB(sb)->fs_id;
buf->f_fsid.val[1] = ORANGEFS_SB(sb)->id;
buf->f_bsize = new_op->downcall.resp.statfs.block_size; buf->f_bsize = new_op->downcall.resp.statfs.block_size;
buf->f_namelen = ORANGEFS_NAME_MAX; buf->f_namelen = ORANGEFS_NAME_MAX;

8
include/linux/fsnotify.h
View File

@ -38,7 +38,13 @@ static inline int fsnotify_perm(struct file *file, int mask)
__u32 fsnotify_mask = 0; __u32 fsnotify_mask = 0;
int ret; int ret;
if (file->f_mode & FMODE_NONOTIFY) /*
* FMODE_NONOTIFY are fds generated by fanotify itself which should not
* generate new events. We also don't want to generate events for
* FMODE_PATH fds (involves open & close events) as they are just
* handle creation / destruction events and not "real" file events.
*/
if (file->f_mode & (FMODE_NONOTIFY | FMODE_PATH))
return 0; return 0;
if (!(mask & (MAY_READ | MAY_OPEN))) if (!(mask & (MAY_READ | MAY_OPEN)))
return 0; return 0;

38
include/linux/i2c-pnx.h
View File

@ -1,38 +0,0 @@
/*
* Header file for I2C support on PNX010x/4008.
*
* Author: Dennis Kovalev <dkovalev@ru.mvista.com>
*
* 2004-2006 (c) MontaVista Software, Inc. This file is licensed under
* the terms of the GNU General Public License version 2. This program
* is licensed "as is" without any warranty of any kind, whether express
* or implied.
*/
#ifndef __I2C_PNX_H__
#define __I2C_PNX_H__
struct platform_device;
struct clk;
struct i2c_pnx_mif {
int ret; /* Return value */
int mode; /* Interface mode */
struct completion complete; /* I/O completion */
struct timer_list timer; /* Timeout */
u8 * buf; /* Data buffer */
int len; /* Length of data buffer */
int order; /* RX Bytes to order via TX */
};
struct i2c_pnx_algo_data {
void __iomem *ioaddr;
struct i2c_pnx_mif mif;
int last;
struct clk *clk;
struct i2c_adapter adapter;
int irq;
u32 timeout;
};
#endif /* __I2C_PNX_H__ */

2
kernel/exit.c
View File

@ -426,6 +426,8 @@ retry:
* Search through everything else, we should not get here often. * Search through everything else, we should not get here often.
*/ */
for_each_process(g) { for_each_process(g) {
if (atomic_read(&mm->mm_users) <= 1)
break;
if (g->flags & PF_KTHREAD) if (g->flags & PF_KTHREAD)
continue; continue;
for_each_thread(g, c) { for_each_thread(g, c) {

2
mm/page-writeback.c
View File

@ -1531,7 +1531,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc)
*/ */
dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_thresh = __wb_calc_thresh(dtc);
dtc->wb_bg_thresh = dtc->thresh ? dtc->wb_bg_thresh = dtc->thresh ?
div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
/* /*
* In order to avoid the stacked BDI deadlock we need * In order to avoid the stacked BDI deadlock we need

2
net/bluetooth/hci_event.c
View File

@ -5024,7 +5024,7 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
bt_dev_err(hdev, "Dropping invalid advertising data"); bt_dev_err(hdev, "Dropping invalid advertising data");
} }
ptr += sizeof(*ev) + ev->length + 1; ptr += sizeof(*ev) + ev->length;
} }
hci_dev_unlock(hdev); hci_dev_unlock(hdev);

14
net/ceph/mon_client.c
View File

@ -963,13 +963,19 @@ static void delayed_work(struct work_struct *work)
struct ceph_mon_client *monc = struct ceph_mon_client *monc =
container_of(work, struct ceph_mon_client, delayed_work.work); container_of(work, struct ceph_mon_client, delayed_work.work);
dout("monc delayed_work\n");
mutex_lock(&monc->mutex); mutex_lock(&monc->mutex);
dout("%s mon%d\n", __func__, monc->cur_mon);
if (monc->cur_mon < 0) {
goto out;
}
if (monc->hunting) { if (monc->hunting) {
dout("%s continuing hunt\n", __func__); dout("%s continuing hunt\n", __func__);
reopen_session(monc); reopen_session(monc);
} else { } else {
int is_auth = ceph_auth_is_authenticated(monc->auth); int is_auth = ceph_auth_is_authenticated(monc->auth);
dout("%s is_authed %d\n", __func__, is_auth);
if (ceph_con_keepalive_expired(&monc->con, if (ceph_con_keepalive_expired(&monc->con,
CEPH_MONC_PING_TIMEOUT)) { CEPH_MONC_PING_TIMEOUT)) {
dout("monc keepalive timeout\n"); dout("monc keepalive timeout\n");
@ -994,6 +1000,8 @@ static void delayed_work(struct work_struct *work)
} }
} }
__schedule_delayed(monc); __schedule_delayed(monc);
out:
mutex_unlock(&monc->mutex); mutex_unlock(&monc->mutex);
} }
@ -1107,13 +1115,15 @@ EXPORT_SYMBOL(ceph_monc_init);
void ceph_monc_stop(struct ceph_mon_client *monc) void ceph_monc_stop(struct ceph_mon_client *monc)
{ {
dout("stop\n"); dout("stop\n");
cancel_delayed_work_sync(&monc->delayed_work);
mutex_lock(&monc->mutex); mutex_lock(&monc->mutex);
__close_session(monc); __close_session(monc);
monc->hunting = false;
monc->cur_mon = -1; monc->cur_mon = -1;
mutex_unlock(&monc->mutex); mutex_unlock(&monc->mutex);
cancel_delayed_work_sync(&monc->delayed_work);
/* /*
* flush msgr queue before we destroy ourselves to ensure that: * flush msgr queue before we destroy ourselves to ensure that:
* - any work that references our embedded con is finished. * - any work that references our embedded con is finished.

2
net/ipv4/inet_diag.c
View File

@ -1089,6 +1089,7 @@ static int inet_diag_dump_compat(struct sk_buff *skb,
req.sdiag_family = AF_UNSPEC; /* compatibility */ req.sdiag_family = AF_UNSPEC; /* compatibility */
req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type); req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type);
req.idiag_ext = rc->idiag_ext; req.idiag_ext = rc->idiag_ext;
req.pad = 0;
req.idiag_states = rc->idiag_states; req.idiag_states = rc->idiag_states;
req.id = rc->id; req.id = rc->id;
@ -1107,6 +1108,7 @@ static int inet_diag_get_exact_compat(struct sk_buff *in_skb,
req.sdiag_family = rc->idiag_family; req.sdiag_family = rc->idiag_family;
req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type); req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type);
req.idiag_ext = rc->idiag_ext; req.idiag_ext = rc->idiag_ext;
req.pad = 0;
req.idiag_states = rc->idiag_states; req.idiag_states = rc->idiag_states;
req.id = rc->id; req.id = rc->id;

13
net/ipv4/tcp_input.c
View File

@ -1990,8 +1990,16 @@ void tcp_clear_retrans(struct tcp_sock *tp)
static inline void tcp_init_undo(struct tcp_sock *tp) static inline void tcp_init_undo(struct tcp_sock *tp)
{ {
tp->undo_marker = tp->snd_una; tp->undo_marker = tp->snd_una;
/* Retransmission still in flight may cause DSACKs later. */ /* Retransmission still in flight may cause DSACKs later. */
tp->undo_retrans = tp->retrans_out ? : -1; /* First, account for regular retransmits in flight: */
tp->undo_retrans = tp->retrans_out;
/* Next, account for TLP retransmits in flight: */
if (tp->tlp_high_seq && tp->tlp_retrans)
tp->undo_retrans++;
/* Finally, avoid 0, because undo_retrans==0 means "can undo now": */
if (!tp->undo_retrans)
tp->undo_retrans = -1;
} }
/* Enter Loss state. If we detect SACK reneging, forget all SACK information /* Enter Loss state. If we detect SACK reneging, forget all SACK information
@ -2065,6 +2073,7 @@ void tcp_enter_loss(struct sock *sk)
net->ipv4.sysctl_tcp_reordering); net->ipv4.sysctl_tcp_reordering);
tcp_set_ca_state(sk, TCP_CA_Loss); tcp_set_ca_state(sk, TCP_CA_Loss);
tp->high_seq = tp->snd_nxt; tp->high_seq = tp->snd_nxt;
tp->tlp_high_seq = 0;
tcp_ecn_queue_cwr(tp); tcp_ecn_queue_cwr(tp);
/* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous /* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
@ -2932,7 +2941,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
tcp_fackets_out(tp) > tp->reordering; tcp_fackets_out(tp) > tp->reordering;
} }
if (tcp_try_undo_dsack(sk)) { if (tcp_try_undo_dsack(sk)) {
tcp_try_keep_open(sk); tcp_try_to_open(sk, flag);
return; return;
} }
tcp_rack_identify_loss(sk, ack_flag); tcp_rack_identify_loss(sk, ack_flag);

1
net/ipv4/tcp_metrics.c
View File

@ -630,6 +630,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] =
[TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, },
[TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY,
.len = sizeof(struct in6_addr), }, .len = sizeof(struct in6_addr), },
[TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, },
/* Following attributes are not received for GET/DEL, /* Following attributes are not received for GET/DEL,
* we keep them for reference * we keep them for reference
*/ */

9
net/ipv4/tcp_timer.c
View File

@ -433,8 +433,13 @@ static bool tcp_rtx_probe0_timed_out(const struct sock *sk,
{ {
const struct tcp_sock *tp = tcp_sk(sk); const struct tcp_sock *tp = tcp_sk(sk);
const int timeout = TCP_RTO_MAX * 2; const int timeout = TCP_RTO_MAX * 2;
u32 rcv_delta, rtx_delta; u32 rtx_delta;
s32 rcv_delta;
/* Note: timer interrupt might have been delayed by at least one jiffy,
* and tp->rcv_tstamp might very well have been written recently.
* rcv_delta can thus be negative.
*/
rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp; rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;
if (rcv_delta <= timeout) if (rcv_delta <= timeout)
return false; return false;
@ -480,8 +485,6 @@ void tcp_retransmit_timer(struct sock *sk)
if (WARN_ON_ONCE(!skb)) if (WARN_ON_ONCE(!skb))
return; return;
tp->tlp_high_seq = 0;
if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) && if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
!((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) { !((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) {
/* Receiver dastardly shrinks window. Our retransmits /* Receiver dastardly shrinks window. Our retransmits

8
net/sctp/socket.c
View File

@ -66,6 +66,7 @@
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/file.h> #include <linux/file.h>
#include <linux/compat.h> #include <linux/compat.h>
#include <linux/overflow.h>
#include <net/ip.h> #include <net/ip.h>
#include <net/icmp.h> #include <net/icmp.h>
@ -6407,6 +6408,7 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
struct sctp_sock *sp = sctp_sk(sk); struct sctp_sock *sp = sctp_sk(sk);
struct sctp_association *asoc; struct sctp_association *asoc;
struct sctp_assoc_ids *ids; struct sctp_assoc_ids *ids;
size_t ids_size;
u32 num = 0; u32 num = 0;
if (sctp_style(sk, TCP)) if (sctp_style(sk, TCP))
@ -6419,11 +6421,11 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
num++; num++;
} }
if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num) ids_size = struct_size(ids, gaids_assoc_id, num);
if (len < ids_size)
return -EINVAL; return -EINVAL;
len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num; len = ids_size;
ids = kmalloc(len, GFP_USER | __GFP_NOWARN); ids = kmalloc(len, GFP_USER | __GFP_NOWARN);
if (unlikely(!ids)) if (unlikely(!ids))
return -ENOMEM; return -ENOMEM;

79
tools/testing/selftests/net/msg_zerocopy.c
View File

@ -81,6 +81,7 @@ static bool cfg_rx;
static int cfg_runtime_ms = 4200; static int cfg_runtime_ms = 4200;
static int cfg_verbose; static int cfg_verbose;
static int cfg_waittime_ms = 500; static int cfg_waittime_ms = 500;
static int cfg_notification_limit = 32;
static bool cfg_zerocopy; static bool cfg_zerocopy;
static socklen_t cfg_alen; static socklen_t cfg_alen;
@ -91,6 +92,7 @@ static char payload[IP_MAXPACKET];
static long packets, bytes, completions, expected_completions; static long packets, bytes, completions, expected_completions;
static int zerocopied = -1; static int zerocopied = -1;
static uint32_t next_completion; static uint32_t next_completion;
static uint32_t sends_since_notify;
static unsigned long gettimeofday_ms(void) static unsigned long gettimeofday_ms(void)
{ {
@ -182,6 +184,7 @@ static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy)
error(1, errno, "send"); error(1, errno, "send");
if (cfg_verbose && ret != len) if (cfg_verbose && ret != len)
fprintf(stderr, "send: ret=%u != %u\n", ret, len); fprintf(stderr, "send: ret=%u != %u\n", ret, len);
sends_since_notify++;
if (len) { if (len) {
packets++; packets++;
@ -306,7 +309,53 @@ static int do_setup_tx(int domain, int type, int protocol)
return fd; return fd;
} }
static bool do_recv_completion(int fd) static uint32_t do_process_zerocopy_cookies(struct rds_zcopy_cookies *ck)
{
int i;
if (ck->num > RDS_MAX_ZCOOKIES)
error(1, 0, "Returned %d cookies, max expected %d\n",
ck->num, RDS_MAX_ZCOOKIES);
for (i = 0; i < ck->num; i++)
if (cfg_verbose >= 2)
fprintf(stderr, "%d\n", ck->cookies[i]);
return ck->num;
}
static bool do_recvmsg_completion(int fd)
{
char cmsgbuf[CMSG_SPACE(sizeof(struct rds_zcopy_cookies))];
struct rds_zcopy_cookies *ck;
struct cmsghdr *cmsg;
struct msghdr msg;
bool ret = false;
memset(&msg, 0, sizeof(msg));
msg.msg_control = cmsgbuf;
msg.msg_controllen = sizeof(cmsgbuf);
if (recvmsg(fd, &msg, MSG_DONTWAIT))
return ret;
if (msg.msg_flags & MSG_CTRUNC)
error(1, errno, "recvmsg notification: truncated");
for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
if (cmsg->cmsg_level == SOL_RDS &&
cmsg->cmsg_type == RDS_CMSG_ZCOPY_COMPLETION) {
ck = (struct rds_zcopy_cookies *)CMSG_DATA(cmsg);
completions += do_process_zerocopy_cookies(ck);
ret = true;
break;
}
error(0, 0, "ignoring cmsg at level %d type %d\n",
cmsg->cmsg_level, cmsg->cmsg_type);
}
return ret;
}
static bool do_recv_completion(int fd, int domain)
{ {
struct sock_extended_err *serr; struct sock_extended_err *serr;
struct msghdr msg = {}; struct msghdr msg = {};
@ -315,6 +364,9 @@ static bool do_recv_completion(int fd)
int ret, zerocopy; int ret, zerocopy;
char control[100]; char control[100];
if (domain == PF_RDS)
return do_recvmsg_completion(fd);
msg.msg_control = control; msg.msg_control = control;
msg.msg_controllen = sizeof(control); msg.msg_controllen = sizeof(control);
@ -348,7 +400,7 @@ static bool do_recv_completion(int fd)
/* Detect notification gaps. These should not happen often, if at all. /* Detect notification gaps. These should not happen often, if at all.
* Gaps can occur due to drops, reordering and retransmissions. * Gaps can occur due to drops, reordering and retransmissions.
*/ */
if (lo != next_completion) if (cfg_verbose && lo != next_completion)
fprintf(stderr, "gap: %u..%u does not append to %u\n", fprintf(stderr, "gap: %u..%u does not append to %u\n",
lo, hi, next_completion); lo, hi, next_completion);
next_completion = hi + 1; next_completion = hi + 1;
@ -370,20 +422,21 @@ static bool do_recv_completion(int fd)
} }
/* Read all outstanding messages on the errqueue */ /* Read all outstanding messages on the errqueue */
static void do_recv_completions(int fd) static void do_recv_completions(int fd, int domain)
{ {
while (do_recv_completion(fd)) {} while (do_recv_completion(fd, domain)) {}
sends_since_notify = 0;
} }
/* Wait for all remaining completions on the errqueue */ /* Wait for all remaining completions on the errqueue */
static void do_recv_remaining_completions(int fd) static void do_recv_remaining_completions(int fd, int domain)
{ {
int64_t tstop = gettimeofday_ms() + cfg_waittime_ms; int64_t tstop = gettimeofday_ms() + cfg_waittime_ms;
while (completions < expected_completions && while (completions < expected_completions &&
gettimeofday_ms() < tstop) { gettimeofday_ms() < tstop) {
if (do_poll(fd, POLLERR)) if (do_poll(fd, domain == PF_RDS ? POLLIN : POLLERR))
do_recv_completions(fd); do_recv_completions(fd, domain);
} }
if (completions < expected_completions) if (completions < expected_completions)
@ -455,15 +508,18 @@ static void do_tx(int domain, int type, int protocol)
else else
do_sendmsg(fd, &msg, cfg_zerocopy); do_sendmsg(fd, &msg, cfg_zerocopy);
if (cfg_zerocopy && sends_since_notify >= cfg_notification_limit)
do_recv_completions(fd, domain);
while (!do_poll(fd, POLLOUT)) { while (!do_poll(fd, POLLOUT)) {
if (cfg_zerocopy) if (cfg_zerocopy)
do_recv_completions(fd); do_recv_completions(fd, domain);
} }
} while (gettimeofday_ms() < tstop); } while (gettimeofday_ms() < tstop);
if (cfg_zerocopy) if (cfg_zerocopy)
do_recv_remaining_completions(fd); do_recv_remaining_completions(fd, domain);
if (close(fd)) if (close(fd))
error(1, errno, "close"); error(1, errno, "close");
@ -612,7 +668,7 @@ static void parse_opts(int argc, char **argv)
cfg_payload_len = max_payload_len; cfg_payload_len = max_payload_len;
while ((c = getopt(argc, argv, "46c:C:D:i:mp:rs:S:t:vz")) != -1) { while ((c = getopt(argc, argv, "46c:C:D:i:l:mp:rs:S:t:vz")) != -1) {
switch (c) { switch (c) {
case '4': case '4':
if (cfg_family != PF_UNSPEC) if (cfg_family != PF_UNSPEC)
@ -640,6 +696,9 @@ static void parse_opts(int argc, char **argv)
if (cfg_ifindex == 0) if (cfg_ifindex == 0)
error(1, errno, "invalid iface: %s", optarg); error(1, errno, "invalid iface: %s", optarg);
break; break;
case 'l':
cfg_notification_limit = strtoul(optarg, NULL, 0);
break;
case 'm': case 'm':
cfg_cork_mixed = true; cfg_cork_mixed = true;
break; break;