evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

This is the 4.4.121 stable release

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlqlSRUACgkQONu9yGCS
 aT4pDQ//Y4lGqfzLeZpwhm4wWFL3ZiC0IY4WEFP0Mb4N6LPtDqhmZoW1nFT5l5sS
 uJaKU/7w49GB9jjgYIlYu5+aiX/PMgTbHD7NRRIoWtRDKxgVBuP4iIhUDdB9u61f
 t3W49sRHnGoc8apEOzp7zeNZMhJB+RXJnhvPkzOX1ctXsoL50aSQXhSDQUXt5g8U
 yey0bvKs1aWW2f1sjpQJIDRtzFbZP+hLlfwoiz5T5d/50zovaqt2yhw6ke5vBMbi
 eP8i+g/91t5+MT6Bc7SUpsYBxMyrcZvnEHb/HSMxez2twueK6O6TXbQWGxAcHYSQ
 WF6W8xOKAl7z92MsDuVM4wy1Hamwc0R3jF+KTriYNboGThfuNZDD4OlUrmWfafoY
 Uaoa6wI7fiYvPBq5zvLkOc7ufE+ECqRq9pC2VXZp+G4veEgcc4ftZ57blhULryKS
 Nl0E25BXEpyix9m0Racl26OLFx3DUI3wSfPb1aqJx4EP13FYBAGJIVMcZfSEjN7/
 zpfPZExelkF1Q5P+OWbRrg5bi/DQoy/EGmZMA0LvpQl8rSFBilLdUjhGGPvmVwBE
 P9qElRjdSqeoOiDUyDmARO3iWm42s2cBqAwgxlgP8LUcyzxUperkvnbM25pvkHfn
 hh+QV9zOFUlI+rVj7pwu4DLmdOteRw7+7mTY4jgBVlZcAMBBLd0=
 =KZem
 -----END PGP SIGNATURE-----

Merge 4.4.121 into android-4.4

Changes in 4.4.121
	tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
	tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
	tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
	ALSA: usb-audio: Add a quirck for B&W PX headphones
	ALSA: hda: Add a power_save blacklist
	cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
	media: m88ds3103: don't call a non-initalized function
	nospec: Allow index argument to have const-qualified type
	ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
	KVM: mmu: Fix overlap between public and private memslots
	x86/syscall: Sanitize syscall table de-references under speculation fix
	btrfs: Don't clear SGID when inheriting ACLs
	ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
	x86/apic/vector: Handle legacy irq data correctly
	leds: do not overflow sysfs buffer in led_trigger_show
	x86/spectre: Fix an error message
	Revert "led: core: Fix brightness setting when setting delay_off=0"
	bridge: check brport attr show in brport_show
	fib_semantics: Don't match route with mismatching tclassid
	hdlc_ppp: carrier detect ok, don't turn off negotiation
	ipv6 sit: work around bogus gcc-8 -Wrestrict warning
	net: fix race on decreasing number of TX queues
	net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
	netlink: ensure to loop over all netns in genlmsg_multicast_allns()
	ppp: prevent unregistered channels from connecting to PPP units
	udplite: fix partial checksum initialization
	sctp: fix dst refcnt leak in sctp_v4_get_dst
	sctp: fix dst refcnt leak in sctp_v6_get_dst()
	s390/qeth: fix SETIP command handling
	s390/qeth: fix IPA command submission race
	sctp: verify size of a new chunk in _sctp_make_chunk()
	net: mpls: Pull common label check into helper
	mpls, nospec: Sanitize array index in mpls_label_ok()
	dm io: fix duplicate bio completion due to missing ref count
	bpf, x64: implement retpoline for tail call
	btrfs: preserve i_mode if __btrfs_set_acl() fails
	Linux 4.4.121

Change-Id: Ifc1f73c407f35cc1815e6f69bbed838c8ca60bc2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman 2018-03-11 17:40:30 +01:00
commit 2b1843d7d0
38 changed files with 320 additions and 100 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Makefile
View file

@ -1,6 +1,6 @@
VERSION = 4
PATCHLEVEL = 4
SUBLEVEL = 120
SUBLEVEL = 121
EXTRAVERSION =
NAME = Blurry Fish Butt

8
arch/arm/boot/dts/logicpd-torpedo-som.dtsi
View file

@ -90,6 +90,8 @@
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <2600000>;
twl: twl@48 {
@ -146,6 +148,12 @@
OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_cmd */
>;
};
i2c1_pins: pinmux_i2c1_pins {
pinctrl-single,pins = <
OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */
OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */
>;
};
};
#include "twl4030.dtsi"

4
arch/arm/mach-mvebu/Kconfig
View file

@ -37,7 +37,7 @@ config MACH_ARMADA_370
config MACH_ARMADA_375
bool "Marvell Armada 375 boards" if ARCH_MULTI_V7
select ARM_ERRATA_720789
select ARM_ERRATA_753970
select PL310_ERRATA_753970
select ARM_GIC
select ARMADA_375_CLK
select HAVE_ARM_SCU
@ -52,7 +52,7 @@ config MACH_ARMADA_375
config MACH_ARMADA_38X
bool "Marvell Armada 380/385 boards" if ARCH_MULTI_V7
select ARM_ERRATA_720789
select ARM_ERRATA_753970
select PL310_ERRATA_753970
select ARM_GIC
select ARMADA_38X_CLK
select HAVE_ARM_SCU

16
arch/x86/entry/entry_64.S
View file

@ -178,12 +178,14 @@ GLOBAL(entry_SYSCALL_64_after_swapgs)
jnz tracesys
entry_SYSCALL_64_fastpath:
#if __SYSCALL_MASK == ~0
cmpq $__NR_syscall_max, %rax
cmpq $NR_syscalls, %rax
#else
andl $__SYSCALL_MASK, %eax
cmpl $__NR_syscall_max, %eax
cmpl $NR_syscalls, %eax
#endif
ja 1f /* return -ENOSYS (already in pt_regs->ax) */
jae 1f /* return -ENOSYS (already in pt_regs->ax) */
sbb %rcx, %rcx /* array_index_mask_nospec() */
and %rcx, %rax
movq %r10, %rcx
#ifdef CONFIG_RETPOLINE
movq sys_call_table(, %rax, 8), %rax
@ -276,12 +278,14 @@ tracesys_phase2:
RESTORE_C_REGS_EXCEPT_RAX
RESTORE_EXTRA_REGS
#if __SYSCALL_MASK == ~0
cmpq $__NR_syscall_max, %rax
cmpq $NR_syscalls, %rax
#else
andl $__SYSCALL_MASK, %eax
cmpl $__NR_syscall_max, %eax
cmpl $NR_syscalls, %eax
#endif
ja 1f /* return -ENOSYS (already in pt_regs->ax) */
jae 1f /* return -ENOSYS (already in pt_regs->ax) */
sbb %rcx, %rcx /* array_index_mask_nospec() */
and %rcx, %rax
movq %r10, %rcx /* fixup for C */
#ifdef CONFIG_RETPOLINE
movq sys_call_table(, %rax, 8), %rax

37
arch/x86/include/asm/nospec-branch.h
View file

@ -195,4 +195,41 @@ static inline void vmexit_fill_RSB(void)
}
#endif /* __ASSEMBLY__ */
/*
* Below is used in the eBPF JIT compiler and emits the byte sequence
* for the following assembly:
*
* With retpolines configured:
*
* callq do_rop
* spec_trap:
* pause
* lfence
* jmp spec_trap
* do_rop:
* mov %rax,(%rsp)
* retq
*
* Without retpolines configured:
*
* jmp *%rax
*/
#ifdef CONFIG_RETPOLINE
# define RETPOLINE_RAX_BPF_JIT_SIZE 17
# define RETPOLINE_RAX_BPF_JIT() \
EMIT1_off32(0xE8, 7); /* callq do_rop */ \
/* spec_trap: */ \
EMIT2(0xF3, 0x90); /* pause */ \
EMIT3(0x0F, 0xAE, 0xE8); /* lfence */ \
EMIT2(0xEB, 0xF9); /* jmp spec_trap */ \
/* do_rop: */ \
EMIT4(0x48, 0x89, 0x04, 0x24); /* mov %rax,(%rsp) */ \
EMIT1(0xC3); /* retq */
#else
# define RETPOLINE_RAX_BPF_JIT_SIZE 2
# define RETPOLINE_RAX_BPF_JIT() \
EMIT2(0xFF, 0xE0); /* jmp *%rax */
#endif
#endif /* _ASM_X86_NOSPEC_BRANCH_H_ */

14
arch/x86/kernel/apic/vector.c
View file

@ -91,8 +91,12 @@ out_data:
return NULL;
}
static void free_apic_chip_data(struct apic_chip_data *data)
static void free_apic_chip_data(unsigned int virq, struct apic_chip_data *data)
{
#ifdef CONFIG_X86_IO_APIC
if (virq < nr_legacy_irqs())
legacy_irq_data[virq] = NULL;
#endif
if (data) {
free_cpumask_var(data->domain);
free_cpumask_var(data->old_domain);
@ -316,11 +320,7 @@ static void x86_vector_free_irqs(struct irq_domain *domain,
apic_data = irq_data->chip_data;
irq_domain_reset_irq_data(irq_data);
raw_spin_unlock_irqrestore(&vector_lock, flags);
free_apic_chip_data(apic_data);
#ifdef CONFIG_X86_IO_APIC
if (virq + i < nr_legacy_irqs())
legacy_irq_data[virq + i] = NULL;
#endif
free_apic_chip_data(virq + i, apic_data);
}
}
}
@ -361,7 +361,7 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq,
err = assign_irq_vector_policy(virq + i, node, data, info);
if (err) {
irq_data->chip_data = NULL;
free_apic_chip_data(data);
free_apic_chip_data(virq + i, data);
goto error;
}
}

3
arch/x86/kernel/cpu/bugs.c
View file

@ -175,8 +175,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
}
if (i >= ARRAY_SIZE(mitigation_options)) {
pr_err("unknown option (%s). Switching to AUTO select\n",
mitigation_options[i].option);
pr_err("unknown option (%s). Switching to AUTO select\n", arg);
return SPECTRE_V2_CMD_AUTO;
}
}

9
arch/x86/net/bpf_jit_comp.c
View file

@ -12,6 +12,7 @@
#include <linux/filter.h>
#include <linux/if_vlan.h>
#include <asm/cacheflush.h>
#include <asm/nospec-branch.h>
#include <linux/bpf.h>
int bpf_jit_enable __read_mostly;
@ -269,7 +270,7 @@ static void emit_bpf_tail_call(u8 **pprog)
EMIT2(0x89, 0xD2); /* mov edx, edx */
EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */
offsetof(struct bpf_array, map.max_entries));
#define OFFSET1 43 /* number of bytes to jump */
#define OFFSET1 (41 + RETPOLINE_RAX_BPF_JIT_SIZE) /* number of bytes to jump */
EMIT2(X86_JBE, OFFSET1); /* jbe out */
label1 = cnt;
@ -278,7 +279,7 @@ static void emit_bpf_tail_call(u8 **pprog)
*/
EMIT2_off32(0x8B, 0x85, -STACKSIZE + 36); /* mov eax, dword ptr [rbp - 516] */
EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT); /* cmp eax, MAX_TAIL_CALL_CNT */
#define OFFSET2 32
#define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE)
EMIT2(X86_JA, OFFSET2); /* ja out */
label2 = cnt;
EMIT3(0x83, 0xC0, 0x01); /* add eax, 1 */
@ -292,7 +293,7 @@ static void emit_bpf_tail_call(u8 **pprog)
* goto out;
*/
EMIT3(0x48, 0x85, 0xC0); /* test rax,rax */
#define OFFSET3 10
#define OFFSET3 (8 + RETPOLINE_RAX_BPF_JIT_SIZE)
EMIT2(X86_JE, OFFSET3); /* je out */
label3 = cnt;
@ -305,7 +306,7 @@ static void emit_bpf_tail_call(u8 **pprog)
* rdi == ctx (1st arg)
* rax == prog->bpf_func + prologue_size
*/
EMIT2(0xFF, 0xE0); /* jmp rax */
RETPOLINE_RAX_BPF_JIT();
/* out: */
BUILD_BUG_ON(cnt - label1 != OFFSET1);

4
drivers/char/tpm/st33zp24/st33zp24.c
View file

@ -485,7 +485,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf,
size_t count)
{
int size = 0;
int expected;
u32 expected;
if (!chip)
return -EBUSY;
@ -502,7 +502,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf,
}
expected = be32_to_cpu(*(__be32 *)(buf + 2));
if (expected > count) {
if (expected > count || expected < TPM_HEADER_SIZE) {
size = -EIO;
goto out;
}

5
drivers/char/tpm/tpm_i2c_infineon.c
View file

@ -436,7 +436,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
{
int size = 0;
int expected, status;
int status;
u32 expected;
if (count < TPM_HEADER_SIZE) {
size = -EIO;
@ -451,7 +452,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
}
expected = be32_to_cpu(*(__be32 *)(buf + 2));
if ((size_t) expected > count) {
if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) {
size = -EIO;
goto out;
}

8
drivers/char/tpm/tpm_i2c_nuvoton.c
View file

@ -267,7 +267,11 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count)
struct device *dev = chip->dev.parent;
struct i2c_client *client = to_i2c_client(dev);
s32 rc;
int expected, status, burst_count, retries, size = 0;
int status;
int burst_count;
int retries;
int size = 0;
u32 expected;
if (count < TPM_HEADER_SIZE) {
i2c_nuvoton_ready(chip); /* return to idle */
@ -309,7 +313,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count)
* to machine native
*/
expected = be32_to_cpu(*(__be32 *) (buf + 2));
if (expected > count) {
if (expected > count || expected < size) {
dev_err(dev, "%s() expected > count\n", __func__);
size = -EIO;
continue;

8
drivers/cpufreq/s3c24xx-cpufreq.c
View file

@ -364,7 +364,13 @@ struct clk *s3c_cpufreq_clk_get(struct device *dev, const char *name)
static int s3c_cpufreq_init(struct cpufreq_policy *policy)
{
policy->clk = clk_arm;
return cpufreq_generic_init(policy, ftab, cpu_cur.info->latency);
policy->cpuinfo.transition_latency = cpu_cur.info->latency;
if (ftab)
return cpufreq_table_validate_and_show(policy, ftab);
return 0;
}
static int __init s3c_cpufreq_initclks(void)

2
drivers/leds/led-core.c
View file

@ -149,7 +149,7 @@ void led_blink_set(struct led_classdev *led_cdev,
unsigned long *delay_on,
unsigned long *delay_off)
{
led_stop_software_blink(led_cdev);
del_timer_sync(&led_cdev->blink_timer);
led_cdev->flags &= ~LED_BLINK_ONESHOT;
led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP;

12
drivers/leds/led-triggers.c
View file

@ -88,21 +88,23 @@ ssize_t led_trigger_show(struct device *dev, struct device_attribute *attr,
down_read(&led_cdev->trigger_lock);
if (!led_cdev->trigger)
len += sprintf(buf+len, "[none] ");
len += scnprintf(buf+len, PAGE_SIZE - len, "[none] ");
else
len += sprintf(buf+len, "none ");
len += scnprintf(buf+len, PAGE_SIZE - len, "none ");
list_for_each_entry(trig, &trigger_list, next_trig) {
if (led_cdev->trigger && !strcmp(led_cdev->trigger->name,
trig->name))
len += sprintf(buf+len, "[%s] ", trig->name);
len += scnprintf(buf+len, PAGE_SIZE - len, "[%s] ",
trig->name);
else
len += sprintf(buf+len, "%s ", trig->name);
len += scnprintf(buf+len, PAGE_SIZE - len, "%s ",
trig->name);
}
up_read(&led_cdev->trigger_lock);
up_read(&triggers_list_lock);
len += sprintf(len+buf, "\n");
len += scnprintf(len+buf, PAGE_SIZE - len, "\n");
return len;
}
EXPORT_SYMBOL_GPL(led_trigger_show);

1
drivers/md/dm-io.c
View file

@ -300,6 +300,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
else if (rw & REQ_WRITE_SAME)
special_cmd_max_sectors = q->limits.max_write_same_sectors;
if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
atomic_inc(&io->count);
dec_count(io, region, -EOPNOTSUPP);
return;
}

7
drivers/media/dvb-frontends/m88ds3103.c
View file

@ -1281,11 +1281,12 @@ static int m88ds3103_select(struct i2c_adapter *adap, void *mux_priv, u32 chan)
* New users must use I2C client binding directly!
*/
struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg,
struct i2c_adapter *i2c, struct i2c_adapter **tuner_i2c_adapter)
struct i2c_adapter *i2c,
struct i2c_adapter **tuner_i2c_adapter)
{
struct i2c_client *client;
struct i2c_board_info board_info;
struct m88ds3103_platform_data pdata;
struct m88ds3103_platform_data pdata = {};
pdata.clk = cfg->clock;
pdata.i2c_wr_max = cfg->i2c_wr_max;
@ -1428,6 +1429,8 @@ static int m88ds3103_probe(struct i2c_client *client,
case M88DS3103_CHIP_ID:
break;
default:
ret = -ENODEV;
dev_err(&client->dev, "Unknown device. Chip_id=%02x\n", dev->chip_id);
goto err_kfree;
}

9
drivers/net/ppp/ppp_generic.c
View file

@ -2952,6 +2952,15 @@ ppp_connect_channel(struct channel *pch, int unit)
goto outl;
ppp_lock(ppp);
spin_lock_bh(&pch->downl);
if (!pch->chan) {
/* Don't connect unregistered channels */
spin_unlock_bh(&pch->downl);
ppp_unlock(ppp);
ret = -ENOTCONN;
goto outl;
}
spin_unlock_bh(&pch->downl);
if (pch->file.hdrlen > ppp->file.hdrlen)
ppp->file.hdrlen = pch->file.hdrlen;
hdrlen = pch->file.hdrlen + 2; /* for protocol bytes */

5
drivers/net/wan/hdlc_ppp.c
View file

@ -574,7 +574,10 @@ static void ppp_timer(unsigned long arg)
ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0,
0, NULL);
proto->restart_counter--;
} else
} else if (netif_carrier_ok(proto->dev))
ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0,
0, NULL);
else
ppp_cp_event(proto->dev, proto->pid, TO_BAD, 0, 0,
0, NULL);
break;

5
drivers/s390/net/qeth_core.h
View file

@ -591,6 +591,11 @@ struct qeth_cmd_buffer {
void (*callback) (struct qeth_channel *, struct qeth_cmd_buffer *);
};
static inline struct qeth_ipa_cmd *__ipa_cmd(struct qeth_cmd_buffer *iob)
{
return (struct qeth_ipa_cmd *)(iob->data + IPA_PDU_HEADER_SIZE);
}
/**
* definition of a qeth channel, used for read and write
*/

35
drivers/s390/net/qeth_core_main.c
View file

@ -2054,7 +2054,7 @@ int qeth_send_control_data(struct qeth_card *card, int len,
unsigned long flags;
struct qeth_reply *reply = NULL;
unsigned long timeout, event_timeout;
struct qeth_ipa_cmd *cmd;
struct qeth_ipa_cmd *cmd = NULL;
QETH_CARD_TEXT(card, 2, "sendctl");
@ -2068,23 +2068,27 @@ int qeth_send_control_data(struct qeth_card *card, int len,
}
reply->callback = reply_cb;
reply->param = reply_param;
if (card->state == CARD_STATE_DOWN)
reply->seqno = QETH_IDX_COMMAND_SEQNO;
else
reply->seqno = card->seqno.ipa++;
init_waitqueue_head(&reply->wait_q);
spin_lock_irqsave(&card->lock, flags);
list_add_tail(&reply->list, &card->cmd_waiter_list);
spin_unlock_irqrestore(&card->lock, flags);
QETH_DBF_HEX(CTRL, 2, iob->data, QETH_DBF_CTRL_LEN);
while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ;
if (IS_IPA(iob->data)) {
cmd = __ipa_cmd(iob);
cmd->hdr.seqno = card->seqno.ipa++;
reply->seqno = cmd->hdr.seqno;
event_timeout = QETH_IPA_TIMEOUT;
} else {
reply->seqno = QETH_IDX_COMMAND_SEQNO;
event_timeout = QETH_TIMEOUT;
}
qeth_prepare_control_data(card, len, iob);
if (IS_IPA(iob->data))
event_timeout = QETH_IPA_TIMEOUT;
else
event_timeout = QETH_TIMEOUT;
spin_lock_irqsave(&card->lock, flags);
list_add_tail(&reply->list, &card->cmd_waiter_list);
spin_unlock_irqrestore(&card->lock, flags);
timeout = jiffies + event_timeout;
QETH_CARD_TEXT(card, 6, "noirqpnd");
@ -2109,9 +2113,8 @@ int qeth_send_control_data(struct qeth_card *card, int len,
/* we have only one long running ipassist, since we can ensure
process context of this command we can sleep */
cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
if ((cmd->hdr.command == IPA_CMD_SETIP) &&
(cmd->hdr.prot_version == QETH_PROT_IPV4)) {
if (cmd && cmd->hdr.command == IPA_CMD_SETIP &&
cmd->hdr.prot_version == QETH_PROT_IPV4) {
if (!wait_event_timeout(reply->wait_q,
atomic_read(&reply->received), event_timeout))
goto time_err;
@ -2877,7 +2880,7 @@ static void qeth_fill_ipacmd_header(struct qeth_card *card,
memset(cmd, 0, sizeof(struct qeth_ipa_cmd));
cmd->hdr.command = command;
cmd->hdr.initiator = IPA_CMD_INITIATOR_HOST;
cmd->hdr.seqno = card->seqno.ipa;
/* cmd->hdr.seqno is set by qeth_send_control_data() */
cmd->hdr.adapter_type = qeth_get_ipa_adp_type(card->info.link_type);
cmd->hdr.rel_adapter_no = (__u8) card->info.portno;
if (card->options.layer2)

19
fs/btrfs/acl.c
View file

@ -82,12 +82,6 @@ static int __btrfs_set_acl(struct btrfs_trans_handle *trans,
switch (type) {
case ACL_TYPE_ACCESS:
name = POSIX_ACL_XATTR_ACCESS;
if (acl) {
ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
if (ret)
return ret;
}
ret = 0;
break;
case ACL_TYPE_DEFAULT:
if (!S_ISDIR(inode->i_mode))
@ -123,7 +117,18 @@ out:
int btrfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
{
return __btrfs_set_acl(NULL, inode, acl, type);
int ret;
umode_t old_mode = inode->i_mode;
if (type == ACL_TYPE_ACCESS && acl) {
ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
if (ret)
return ret;
}
ret = __btrfs_set_acl(NULL, inode, acl, type);
if (ret)
inode->i_mode = old_mode;
return ret;
}
/*

3
include/linux/nospec.h
View file

@ -66,7 +66,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \
BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \
\
_i &= _mask; \
_i; \
(typeof(_i)) (_i & _mask); \
})
#endif /* _LINUX_NOSPEC_H */

1
include/net/udplite.h
View file

@ -62,6 +62,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
UDP_SKB_CB(skb)->cscov = cscov;
if (skb->ip_summed == CHECKSUM_COMPLETE)
skb->ip_summed = CHECKSUM_NONE;
skb->csum_valid = 0;
}
return 0;

3
net/bridge/br_sysfs_if.c
View file

@ -229,6 +229,9 @@ static ssize_t brport_show(struct kobject *kobj,
struct brport_attribute *brport_attr = to_brport_attr(attr);
struct net_bridge_port *p = to_brport(kobj);
if (!brport_attr->show)
return -EINVAL;
return brport_attr->show(p, buf);
}

11
net/core/dev.c
View file

@ -2183,8 +2183,11 @@ EXPORT_SYMBOL(netif_set_xps_queue);
*/
int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
{
bool disabling;
int rc;
disabling = txq < dev->real_num_tx_queues;
if (txq < 1 || txq > dev->num_tx_queues)
return -EINVAL;
@ -2200,15 +2203,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
if (dev->num_tc)
netif_setup_tc(dev, txq);
if (txq < dev->real_num_tx_queues) {
dev->real_num_tx_queues = txq;
if (disabling) {
synchronize_net();
qdisc_reset_all_tx_gt(dev, txq);
#ifdef CONFIG_XPS
netif_reset_xps_queues_gt(dev, txq);
#endif
}
} else {
dev->real_num_tx_queues = txq;
}
dev->real_num_tx_queues = txq;
return 0;
}
EXPORT_SYMBOL(netif_set_real_num_tx_queues);

5
net/ipv4/fib_semantics.c
View file

@ -640,6 +640,11 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi)
fi->fib_nh, cfg))
return 1;
}
#ifdef CONFIG_IP_ROUTE_CLASSID
if (cfg->fc_flow &&
cfg->fc_flow != fi->fib_nh->nh_tclassid)
return 1;
#endif
if ((!cfg->fc_oif || cfg->fc_oif == fi->fib_nh->nh_oif) &&
(!cfg->fc_gw || cfg->fc_gw == fi->fib_nh->nh_gw))
return 0;

8
net/ipv4/route.c
View file

@ -126,10 +126,13 @@ static int ip_rt_redirect_silence __read_mostly = ((HZ / 50) << (9 + 1));
static int ip_rt_error_cost __read_mostly = HZ;
static int ip_rt_error_burst __read_mostly = 5 * HZ;
static int ip_rt_mtu_expires __read_mostly = 10 * 60 * HZ;
static int ip_rt_min_pmtu __read_mostly = 512 + 20 + 20;
static u32 ip_rt_min_pmtu __read_mostly = 512 + 20 + 20;
static int ip_rt_min_advmss __read_mostly = 256;
static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT;
static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU;
/*
* Interface to generic destination cache.
*/
@ -2782,7 +2785,8 @@ static struct ctl_table ipv4_route_table[] = {
.data = &ip_rt_min_pmtu,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
.proc_handler = proc_dointvec_minmax,
.extra1 = &ip_min_valid_pmtu,
},
{
.procname = "min_adv_mss",

5
net/ipv4/udp.c
View file

@ -1745,6 +1745,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
err = udplite_checksum_init(skb, uh);
if (err)
return err;
if (UDP_SKB_CB(skb)->partial_cov) {
skb->csum = inet_compute_pseudo(skb, proto);
return 0;
}
}
return skb_checksum_init_zero_check(skb, proto, uh->check,

5
net/ipv6/ip6_checksum.c
View file

@ -73,6 +73,11 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
err = udplite_checksum_init(skb, uh);
if (err)
return err;
if (UDP_SKB_CB(skb)->partial_cov) {
skb->csum = ip6_compute_pseudo(skb, proto);
return 0;
}
}
/* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels)

2
net/ipv6/sit.c
View file

@ -176,7 +176,7 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
#ifdef CONFIG_IPV6_SIT_6RD
struct ip_tunnel *t = netdev_priv(dev);
if (t->dev == sitn->fb_tunnel_dev) {
if (dev == sitn->fb_tunnel_dev) {
ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
t->ip6rd.relay_prefix = 0;
t->ip6rd.prefixlen = 16;

36
net/mpls/af_mpls.c
View file

@ -7,6 +7,7 @@
#include <linux/if_arp.h>
#include <linux/ipv6.h>
#include <linux/mpls.h>
#include <linux/nospec.h>
#include <linux/vmalloc.h>
#include <net/ip.h>
#include <net/dst.h>
@ -714,6 +715,22 @@ errout:
return err;
}
static bool mpls_label_ok(struct net *net, unsigned int *index)
{
bool is_ok = true;
/* Reserved labels may not be set */
if (*index < MPLS_LABEL_FIRST_UNRESERVED)
is_ok = false;
/* The full 20 bit range may not be supported. */
if (is_ok && *index >= net->mpls.platform_labels)
is_ok = false;
*index = array_index_nospec(*index, net->mpls.platform_labels);
return is_ok;
}
static int mpls_route_add(struct mpls_route_config *cfg)
{
struct mpls_route __rcu **platform_label;
@ -732,12 +749,7 @@ static int mpls_route_add(struct mpls_route_config *cfg)
index = find_free_label(net);
}
/* Reserved labels may not be set */
if (index < MPLS_LABEL_FIRST_UNRESERVED)
goto errout;
/* The full 20 bit range may not be supported. */
if (index >= net->mpls.platform_labels)
if (!mpls_label_ok(net, &index))
goto errout;
/* Append makes no sense with mpls */
@ -798,12 +810,7 @@ static int mpls_route_del(struct mpls_route_config *cfg)
index = cfg->rc_label;
/* Reserved labels may not be removed */
if (index < MPLS_LABEL_FIRST_UNRESERVED)
goto errout;
/* The full 20 bit range may not be supported */
if (index >= net->mpls.platform_labels)
if (!mpls_label_ok(net, &index))
goto errout;
mpls_route_update(net, index, NULL, &cfg->rc_nlinfo);
@ -1162,10 +1169,9 @@ static int rtm_to_route_config(struct sk_buff *skb, struct nlmsghdr *nlh,
&cfg->rc_label))
goto errout;
/* Reserved labels may not be set */
if (cfg->rc_label < MPLS_LABEL_FIRST_UNRESERVED)
if (!mpls_label_ok(cfg->rc_nlinfo.nl_net,
&cfg->rc_label))
goto errout;
break;
}
case RTA_VIA:

12
net/netlink/genetlink.c
View file

@ -1118,6 +1118,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
{
struct sk_buff *tmp;
struct net *net, *prev = NULL;
bool delivered = false;
int err;
for_each_net_rcu(net) {
@ -1129,14 +1130,21 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
}
err = nlmsg_multicast(prev->genl_sock, tmp,
portid, group, flags);
if (err)
if (!err)
delivered = true;
else if (err != -ESRCH)
goto error;
}
prev = net;
}
return nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
if (!err)
delivered = true;
else if (err != -ESRCH)
goto error;
return delivered ? 0 : -ESRCH;
error:
kfree_skb(skb);
return err;

10
net/sctp/ipv6.c
View file

@ -323,8 +323,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
bdst = ip6_dst_lookup_flow(sk, fl6, final_p);
if (!IS_ERR(bdst) &&
ipv6_chk_addr(dev_net(bdst->dev),
if (IS_ERR(bdst))
continue;
if (ipv6_chk_addr(dev_net(bdst->dev),
&laddr->a.v6.sin6_addr, bdst->dev, 1)) {
if (!IS_ERR_OR_NULL(dst))
dst_release(dst);
@ -333,8 +335,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
}
bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
if (matchlen > bmatchlen)
if (matchlen > bmatchlen) {
dst_release(bdst);
continue;
}
if (!IS_ERR_OR_NULL(dst))
dst_release(dst);

10
net/sctp/protocol.c
View file

@ -508,22 +508,20 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
if (IS_ERR(rt))
continue;
if (!dst)
dst = &rt->dst;
/* Ensure the src address belongs to the output
* interface.
*/
odev = __ip_dev_find(sock_net(sk), laddr->a.v4.sin_addr.s_addr,
false);
if (!odev || odev->ifindex != fl4->flowi4_oif) {
if (&rt->dst != dst)
if (!dst)
dst = &rt->dst;
else
dst_release(&rt->dst);
continue;
}
if (dst != &rt->dst)
dst_release(dst);
dst_release(dst);
dst = &rt->dst;
break;
}

8
net/sctp/sm_make_chunk.c
View file

@ -1367,10 +1367,14 @@ static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc,
sctp_chunkhdr_t *chunk_hdr;
struct sk_buff *skb;
struct sock *sk;
int chunklen;
chunklen = sizeof(*chunk_hdr) + paylen;
if (chunklen > SCTP_MAX_CHUNK_LEN)
goto nodata;
/* No need to allocate LL here, as this is only a chunk. */
skb = alloc_skb(WORD_ROUND(sizeof(sctp_chunkhdr_t) + paylen),
GFP_ATOMIC);
skb = alloc_skb(chunklen, GFP_ATOMIC);
if (!skb)
goto nodata;

38
sound/pci/hda/hda_intel.c
View file

@ -179,7 +179,7 @@ static const struct kernel_param_ops param_ops_xint = {
};
#define param_check_xint param_check_int
static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT;
static int power_save = -1;
module_param(power_save, xint, 0644);
MODULE_PARM_DESC(power_save, "Automatic power-saving timeout "
"(in second, 0 = disable).");
@ -2055,6 +2055,24 @@ out_free:
return err;
}
#ifdef CONFIG_PM
/* On some boards setting power_save to a non 0 value leads to clicking /
* popping sounds when ever we enter/leave powersaving mode. Ideally we would
* figure out how to avoid these sounds, but that is not always feasible.
* So we keep a list of devices where we disable powersaving as its known
* to causes problems on these devices.
*/
static struct snd_pci_quirk power_save_blacklist[] = {
/* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
SND_PCI_QUIRK(0x1849, 0x0c0c, "Asrock B85M-ITX", 0),
/* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0),
/* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */
SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0),
{}
};
#endif /* CONFIG_PM */
/* number of codec slots for each chipset: 0 = default slots (i.e. 4) */
static unsigned int azx_max_codecs[AZX_NUM_DRIVERS] = {
[AZX_DRIVER_NVIDIA] = 8,
@ -2067,6 +2085,7 @@ static int azx_probe_continue(struct azx *chip)
struct hdac_bus *bus = azx_bus(chip);
struct pci_dev *pci = chip->pci;
int dev = chip->dev_index;
int val;
int err;
hda->probe_continued = 1;
@ -2142,7 +2161,22 @@ static int azx_probe_continue(struct azx *chip)
chip->running = 1;
azx_add_card_list(chip);
snd_hda_set_power_save(&chip->bus, power_save * 1000);
val = power_save;
#ifdef CONFIG_PM
if (val == -1) {
const struct snd_pci_quirk *q;
val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT;
q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist);
if (q && val) {
dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n",
q->subvendor, q->subdevice);
val = 0;
}
}
#endif /* CONFIG_PM */
snd_hda_set_power_save(&chip->bus, val * 1000);
if (azx_has_pm_runtime(chip) || hda->use_vga_switcheroo)
pm_runtime_put_noidle(&pci->dev);

47
sound/usb/quirks-table.h
View file

@ -3277,4 +3277,51 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
}
},
{
/*
* Bower's & Wilkins PX headphones only support the 48 kHz sample rate
* even though it advertises more. The capture interface doesn't work
* even on windows.
*/
USB_DEVICE(0x19b5, 0x0021),
.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
.ifnum = QUIRK_ANY_INTERFACE,
.type = QUIRK_COMPOSITE,
.data = (const struct snd_usb_audio_quirk[]) {
{
.ifnum = 0,
.type = QUIRK_AUDIO_STANDARD_MIXER,
},
/* Capture */
{
.ifnum = 1,
.type = QUIRK_IGNORE_INTERFACE,
},
/* Playback */
{
.ifnum = 2,
.type = QUIRK_AUDIO_FIXED_ENDPOINT,
.data = &(const struct audioformat) {
.formats = SNDRV_PCM_FMTBIT_S16_LE,
.channels = 2,
.iface = 2,
.altsetting = 1,
.altset_idx = 1,
.attributes = UAC_EP_CS_ATTR_FILL_MAX |
UAC_EP_CS_ATTR_SAMPLE_RATE,
.endpoint = 0x03,
.ep_attr = USB_ENDPOINT_XFER_ISOC,
.rates = SNDRV_PCM_RATE_48000,
.rate_min = 48000,
.rate_max = 48000,
.nr_rates = 1,
.rate_table = (unsigned int[]) {
48000
}
}
},
}
}
},
#undef USB_DEVICE_VENDOR_SPEC

3
virt/kvm/kvm_main.c
View file

@ -902,8 +902,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
/* Check for overlaps */
r = -EEXIST;
kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) {
if ((slot->id >= KVM_USER_MEM_SLOTS) ||
(slot->id == id))
if (slot->id == id)
continue;
if (!((base_gfn + npages <= slot->base_gfn) ||
(base_gfn >= slot->base_gfn + slot->npages)))