Thanks, a bunch Ben! On 13:33 Wed 10 Jul , Ben Hutchings wrote: >I'm announcing the release of the 3.16.70 kernel. > >All users of the 3.16 kernel series should upgrade. > >The updated 3.16.y git tree can be found at: > https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-3.16.y >and can be browsed at the normal kernel.org git web browser: > https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git > >The diff from 3.16.69 is attached to this message. > >Ben. > >------------ > > Makefile | 2 +- > arch/arm/mach-imx/clk-imx6q.c | 1 + > arch/arm/mach-imx/clk-imx6sx.c | 1 + > arch/arm/mach-imx/clk-vf610.c | 1 + > arch/arm/mach-s3c24xx/mach-osiris-dvs.c | 8 +- > arch/arm64/crypto/aes-ce-ccm-core.S | 5 +- > arch/m68k/Makefile | 5 +- > arch/powerpc/kernel/entry_32.S | 9 + > arch/powerpc/kernel/irq.c | 5 - > arch/powerpc/mm/slice.c | 10 +- > arch/powerpc/platforms/83xx/suspend-asm.S | 34 +- > arch/powerpc/platforms/embedded6xx/wii.c | 4 + > arch/powerpc/platforms/powernv/opal-msglog.c | 2 +- > arch/x86/kvm/x86.h | 7 +- > crypto/ahash.c | 42 ++- > crypto/pcbc.c | 14 +- > crypto/shash.c | 18 +- > crypto/testmgr.c | 14 +- > crypto/tgr192.c | 6 +- > drivers/char/applicom.c | 35 +- > drivers/char/hpet.c | 2 +- > drivers/char/tpm/tpm_eventlog.c | 10 +- > drivers/char/tpm/tpm_i2c_atmel.c | 9 +- > drivers/clk/clk-highbank.c | 1 + > drivers/clk/mvebu/armada-370.c | 4 +- > drivers/clk/mvebu/armada-xp.c | 4 +- > drivers/clk/mvebu/dove.c | 4 +- > drivers/clk/mvebu/kirkwood.c | 5 +- > drivers/clk/samsung/clk-exynos4.c | 1 + > drivers/clk/socfpga/clk-pll.c | 1 + > drivers/clocksource/exynos_mct.c | 14 +- > drivers/cpufreq/pxa2xx-cpufreq.c | 4 +- > drivers/firmware/iscsi_ibft.c | 1 + > drivers/gpu/drm/drm_context.c | 15 +- > drivers/gpu/drm/radeon/evergreen_cs.c | 1 + > drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- > drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +- > drivers/irqchip/irq-brcmstb-l2.c | 10 +- > drivers/leds/leds-lp55xx-common.c | 4 +- > drivers/md/bcache/extents.c | 13 +- > drivers/md/bcache/writeback.h | 3 + > drivers/md/raid10.c | 3 +- > drivers/md/raid5.c | 2 + > drivers/media/i2c/ov7670.c | 16 +- > drivers/media/platform/s5p-jpeg/jpeg-core.c | 21 +- > drivers/media/usb/uvc/uvc_driver.c | 14 +- > drivers/media/usb/uvc/uvc_video.c | 8 + > drivers/mmc/host/omap.c | 2 +- > drivers/mtd/devices/docg3.c | 18 +- > drivers/net/ethernet/mellanox/mlx4/cmd.c | 8 + > .../net/ethernet/mellanox/mlx4/resource_tracker.c | 6 +- > drivers/net/ethernet/renesas/sh_eth.c | 6 +- > drivers/net/ppp/pptp.c | 1 + > drivers/net/vxlan.c | 10 + > drivers/net/wireless/libertas_tf/if_usb.c | 2 - > drivers/net/wireless/mwifiex/ie.c | 30 +- > drivers/net/wireless/mwifiex/scan.c | 19 ++ > drivers/parport/parport_pc.c | 2 +- > drivers/pinctrl/sh-pfc/pfc-r8a7778.c | 6 +- > drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +- > drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 +- > drivers/regulator/wm831x-dcdc.c | 4 +- > drivers/rtc/rtc-88pm80x.c | 21 +- > drivers/rtc/rtc-88pm860x.c | 21 +- > drivers/rtc/rtc-ds1672.c | 3 +- > drivers/rtc/rtc-pm8xxx.c | 6 +- > drivers/s390/kvm/virtio_ccw.c | 4 +- > drivers/scsi/virtio_scsi.c | 2 - > drivers/staging/android/ashmem.c | 42 ++- > drivers/staging/android/binder.c | 28 +- > drivers/staging/iio/addac/adt7316.c | 55 ++-- > drivers/target/iscsi/iscsi_target.c | 4 +- > drivers/tty/ipwireless/hardware.c | 2 + > drivers/tty/serial/8250/8250_pci.c | 141 +++++++- > drivers/tty/serial/of_serial.c | 4 + > drivers/usb/class/cdc-wdm.c | 2 +- > drivers/usb/serial/cp210x.c | 1 + > drivers/usb/serial/ftdi_sio.c | 2 + > drivers/usb/serial/ftdi_sio_ids.h | 6 + > drivers/xen/cpu_hotplug.c | 2 +- > drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +- > fs/9p/v9fs_vfs.h | 23 +- > fs/9p/vfs_file.c | 6 +- > fs/9p/vfs_inode.c | 23 +- > fs/9p/vfs_inode_dotl.c | 27 +- > fs/9p/vfs_super.c | 4 +- > fs/btrfs/extent_io.c | 4 +- > fs/btrfs/scrub.c | 2 +- > fs/cifs/file.c | 12 +- > fs/cifs/smb2misc.c | 17 +- > fs/cifs/smb2ops.c | 13 +- > fs/ext2/super.c | 39 ++- > fs/ext4/ext4.h | 3 + > fs/ext4/ioctl.c | 84 +++-- > fs/ext4/resize.c | 3 +- > fs/fuse/file.c | 4 +- > fs/jbd2/transaction.c | 17 +- > fs/nfs/nfs4proc.c | 15 +- > fs/nfs/super.c | 2 +- > fs/nfsd/nfs3proc.c | 16 +- > fs/nfsd/nfs3xdr.c | 1 + > fs/open.c | 18 + > fs/pipe.c | 14 + > fs/read_write.c | 5 +- > fs/splice.c | 4 + > include/linux/fs.h | 4 + > include/linux/pipe_fs_i.h | 1 + > include/linux/swap.h | 1 + > include/net/gro_cells.h | 12 +- > include/net/net_namespace.h | 2 + > include/net/netns/hash.h | 17 +- > include/uapi/linux/fuse.h | 2 + > kernel/rcu/tree.c | 20 +- > kernel/sysctl.c | 11 +- > lib/devres.c | 4 +- > lib/div64.c | 4 +- > mm/swapfile.c | 83 ++--- > mm/vmalloc.c | 2 +- > net/core/net-sysfs.c | 3 + > net/core/net_namespace.c | 1 + > net/hsr/hsr_device.c | 14 +- > net/ipv4/route.c | 4 + > net/ipv4/tcp_output.c | 2 +- > net/ipv6/ip6mr.c | 8 +- > net/l2tp/l2tp_ip6.c | 4 +- > scripts/coccinelle/api/stream_open.cocci | 363 +++++++++++++++++++++ > security/selinux/avc.c | 44 ++- > security/selinux/hooks.c | 6 +- > security/selinux/include/avc.h | 10 +- > sound/firewire/bebob/bebob.c | 14 +- > sound/soc/fsl/fsl_esai.c | 7 +- > sound/soc/fsl/fsl_ssi.c | 5 +- > sound/soc/fsl/imx-sgtl5000.c | 3 +- > tools/lib/traceevent/event-parse.c | 2 +- > tools/perf/util/header.c | 2 +- > 135 files changed, 1417 insertions(+), 458 deletions(-) > >Aaro Koskinen (1): > mmc: omap: fix the maximum timeout setting > >Aditya Pakki (1): > md: Fix failed allocation of md_register_thread > >Alistair Strachan (1): > media: uvcvideo: Fix 'type' check leading to overflow > >Aneesh Kumar K.V (1): > powerpc/mm/hash: Handle mmap_min_addr correctly in get_unmapped_area topdown search > >Ard Biesheuvel (1): > crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling > >Arnd Bergmann (1): > cpufreq: pxa2xx: remove incorrect __init annotation > >Axel Lin (1): > regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA > >Bart Van Assche (1): > scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock > >Ben Hutchings (2): > binder: Replace "%p" with "%pK" for stable > Linux 3.16.70 > >Buland Singh (1): > hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable > >Christophe Leroy (4): > powerpc/irq: drop arch_early_irq_init() > powerpc/83xx: Also save/restore SPRG4-7 during suspend > powerpc/wii: properly disable use of BATs when requested. > powerpc/32: Clear on-stack exception marker upon exception return > >Colin Ian King (4): > rtc: ds1672: fix unintended sign extension > rtc: 88pm860x: fix unintended sign extension > rtc: 88pm80x: fix unintended sign extension > rtc: pm8xxx: fix unintended sign extension > >Dan Carpenter (1): > xen, cpu_hotplug: Prevent an out of bounds access > >Dan Robertson (1): > btrfs: init csum_list before possible free > >Daniel Axtens (1): > bcache: never writeback a discard operation > >Daniel Jordan (1): > mm, swap: bounds check swap_info array accesses to avoid NULL derefs > >Doug Berger (1): > irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code > >Eric Biggers (5): > crypto: pcbc - remove bogus memcpy()s with src == dest > crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails > crypto: tgr192 - fix unaligned memory access > crypto: testmgr - skip crc32c context test for ahash algorithms > crypto: ahash - fix another early termination in hash walk > >Eric Dumazet (6): > net/hsr: fix possible crash in add_timer() > vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() > gro_cells: make sure device is up in gro_cells_receive() > l2tp: fix infoleak in l2tp_ip6_recvmsg() > tcp: refine memory limit test in tcp_fragment() > netns: provide pure entropy for net_hash_mix() > >Eric W. Biederman (1): > fs/nfs: Fix nfs_parse_devname to not modify it's argument > >Felipe Franciosi (1): > scsi: virtio_scsi: don't send sc payload with tmfs > >Filipe Manana (1): > Btrfs: fix corruption reading shared and compressed extents after hole punching > >Finn Thain (1): > m68k: Add -ffreestanding to CFLAGS > >Gal Pressman (2): > IB/usnic: Fix out of bounds index check in query pkey > RDMA/ocrdma: Fix out of bounds index check in query pkey > >Geert Uytterhoeven (3): > pinctrl: sh-pfc: r8a7778: Fix HSPI pin numbers and names > pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group > pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups > >Gustavo A. R. Silva (4): > ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify > applicom: Fix potential Spectre v1 vulnerabilities > iscsi_ibft: Fix missing break in switch statement > drm/radeon/evergreen_cs: fix missing break in switch statement > >Halil Pasic (1): > s390/virtio: handle find on invalid queue gracefully > >Hou Tao (1): > 9p: use inode->i_lock to protect i_size_write() under 32-bit > >Hugh Dickins (1): > mm: fix potential data race in SyS_swapon > >Ido Schimmel (1): > ip6mr: Do not call __IP6_INC_STATS() from preemptible context > >Ivan Mironov (1): > USB: serial: cp210x: add ID for Ingenico 3070 > >Jack Morgenstein (2): > net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling > net/mlx4_core: Fix qp mtt size calculation > >Jacopo Mondi (1): > media: v4l2: i2c: ov7670: Fix PLL bypass register values > >Jan Kara (2): > ext2: Fix underflow in ext2_max_size() > ext4: fix crash during online resizing > >Jann Horn (1): > splice: don't merge into linked buffers > >Jarkko Sakkinen (1): > tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete > >Jay Dolan (2): > serial: 8250_pci: Fix number of ports for ACCES serial cards > serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup() > >Jeremy Fertic (7): > staging: iio: adt7316: fix register and bit definitions > staging: iio: adt7316: invert the logic of the check for an ldac pin > staging: iio: adt7316: allow adt751x to use internal vref for all dacs > staging: iio: adt7316: fix dac_bits assignment > staging: iio: adt7316: fix handling of dac high resolution option > staging: iio: adt7316: fix the dac read calculation > staging: iio: adt7316: fix the dac write calculation > >Jia Zhang (1): > tpm: Fix off-by-one when reading binary_bios_measurements > >Jiri Olsa (1): > perf header: Fix wrong node write in NUMA_TOPOLOGY feature > >Jordan Niethe (1): > powerpc/powernv: Make opal log only readable by root > >Kangjie Lu (1): > net: sh_eth: fix a missing check of of_get_phy_mode > >Kirill Smelkov (2): > fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock > fuse: Add FOPEN_STREAM to use stream_open() > >Lubomir Rintel (2): > libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer > serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart > >Mans Rullgard (1): > USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485 > >Marek Szyprowski (1): > clocksource/drivers/exynos_mct: Fix error path in timer resources initialization > >Michal Kazior (1): > leds: lp55xx: fix null deref on firmware load failure > >NeilBrown (2): > security/selinux: pass 'flags' arg to avc_audit() and avc_has_perm_flags() > nfsd: fix memory corruption caused by readdir > >Pavel Shilovsky (2): > CIFS: Do not reset lease state to NONE on lease break > CIFS: Fix read after write for files with read caching > >Pawe? Chmiel (2): > media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration > media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL > >QiaoChong (1): > parport_pc: fix find_superio io compare code, should use equal test. > >Richard Weinberger (2): > mtd: docg3: Don't leak docg3->bbt in error path > mtd: docg3: Fix kasprintf() usage > >Roman Penyaev (1): > mm/vmalloc: fix size check for remap_vmalloc_range_partial() > >S.j. Wang (1): > ASoC: fsl_esai: fix register setting issue in RIGHT_J mode > >Sakari Ailus (1): > media: uvcvideo: Avoid NULL pointer dereference at the end of streaming > >Sean Christopherson (1): > KVM: x86/mmu: Do not cache MMIO accesses while memslots are in flux > >Sergei Shtylyov (1): > devres: always use dev_name() in devm_ioremap_resource() > >Stanislaw Gruszka (1): > lib/div64.c: off by one in shift > >Stefan Agner (1): > ASoC: imx-sgtl5000: put of nodes if finding codec fails > >Stephen Smalley (1): > selinux: avoid silent denials in permissive mode under RCU walk > >Takashi Iwai (4): > ASoC: fsl: Fix of-node refcount unbalance in fsl_ssi_probe_from_dt() > mwifiex: Fix possible buffer overflows at parsing bss descriptor > mwifiex: Abort at too short BSS descriptor element > mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() > >Takashi Sakamoto (1): > ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 > >Tang Junhui (1): > bcache: treat stale && dirty keys as bad keys > >Tetsuo Handa (1): > staging: android: ashmem: Avoid range_alloc() allocation with ashmem_mutex held. > >Tony Jones (1): > tools lib traceevent: Fix buffer overflow in arg_eval > >Trond Myklebust (1): > NFSv4.1: Reinitialise sequence results before retransmitting a request > >Xiao Ni (1): > It's wrong to add len to sector_nr in raid10 reshape twice > >Xin Long (2): > route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race > pptp: dst_release sk_dst_cache in pptp_sock_destruct > >Yangtao Li (10): > clk: highbank: fix refcount leak in hb_clk_init() > clk: socfpga: fix refcount leak > clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() > clk: imx6q: fix refcount leak in imx6q_clocks_init() > clk: imx6sx: fix refcount leak in imx6sx_clocks_init() > clk: vf610: fix refcount leak in vf610_clocks_init() > clk: armada-370: fix refcount leak in a370_clk_init() > clk: kirkwood: fix refcount leak in kirkwood_clk_init() > clk: armada-xp: fix refcount leak in axp_clk_init() > clk: dove: fix refcount leak in dove_clk_init() > >YueHaibing (5): > drm: Fix error handling in drm_legacy_addctx > mtd: docg3: Fix passing zero to 'PTR_ERR' warning in doc_probe_device > tty: ipwireless: Fix potential NULL pointer dereference > cdc-wdm: pass return value of recover_from_urb_loss > net-sysfs: Fix mem leak in netdev_register_kobject > >Zev Weiss (1): > kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv > >Zhang, Jun (1): > rcu: Do RCU GP kthread self-wakeup from softirq and interrupt > >yangerkun (3): > ext4: fix check of inode in swap_inode_boot_loader > ext4: update quota information while swapping boot loader inode > ext4: add mask of ext4 flags to swap > >zhangyi (F) (1): > jbd2: clear dirty flag when revoking a buffer from an older transaction > >-- >Ben Hutchings >For every complex problem >there is a solution that is simple, neat, and wrong. > > >diff --git a/Makefile b/Makefile >index e9a1864ac58e..9e2a3acb26cf 100644 >--- a/Makefile >+++ b/Makefile >@@ -1,6 +1,6 @@ > VERSION = 3 > PATCHLEVEL = 16 >-SUBLEVEL = 69 >+SUBLEVEL = 70 > EXTRAVERSION = > NAME = Museum of Fishiegoodies > >diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c >index 032d1b958889..213351ac5e38 100644 >--- a/arch/arm/mach-imx/clk-imx6q.c >+++ b/arch/arm/mach-imx/clk-imx6q.c >@@ -157,6 +157,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) > np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop"); > base = of_iomap(np, 0); > WARN_ON(!base); >+ of_node_put(np); > > /* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */ > if (cpu_is_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) { >diff --git a/arch/arm/mach-imx/clk-imx6sx.c b/arch/arm/mach-imx/clk-imx6sx.c >index ac8ea72f28ab..fe45c1917ce8 100644 >--- a/arch/arm/mach-imx/clk-imx6sx.c >+++ b/arch/arm/mach-imx/clk-imx6sx.c >@@ -143,6 +143,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node) > np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop"); > base = of_iomap(np, 0); > WARN_ON(!base); >+ of_node_put(np); > > /* type name parent_name base div_mask */ > clks[IMX6SX_CLK_PLL1_SYS] = imx_clk_pllv3(IMX_PLLV3_SYS, "pll1_sys", "osc", base, 0x7f); >diff --git a/arch/arm/mach-imx/clk-vf610.c b/arch/arm/mach-imx/clk-vf610.c >index 22dc3ee21fd4..d701e039996f 100644 >--- a/arch/arm/mach-imx/clk-vf610.c >+++ b/arch/arm/mach-imx/clk-vf610.c >@@ -117,6 +117,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node) > np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop"); > anatop_base = of_iomap(np, 0); > BUG_ON(!anatop_base); >+ of_node_put(np); > > np = ccm_node; > ccm_base = of_iomap(np, 0); >diff --git a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c >index 33afb9190091..f6264958bd4f 100644 >--- a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c >+++ b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c >@@ -70,16 +70,16 @@ static int osiris_dvs_notify(struct notifier_block *nb, > > switch (val) { > case CPUFREQ_PRECHANGE: >- if (old_dvs & !new_dvs || >- cur_dvs & !new_dvs) { >+ if ((old_dvs && !new_dvs) || >+ (cur_dvs && !new_dvs)) { > pr_debug("%s: exiting dvs\n", __func__); > cur_dvs = false; > gpio_set_value(OSIRIS_GPIO_DVS, 1); > } > break; > case CPUFREQ_POSTCHANGE: >- if (!old_dvs & new_dvs || >- !cur_dvs & new_dvs) { >+ if ((!old_dvs && new_dvs) || >+ (!cur_dvs && new_dvs)) { > pr_debug("entering dvs\n"); > cur_dvs = true; > gpio_set_value(OSIRIS_GPIO_DVS, 0); >diff --git a/arch/arm64/crypto/aes-ce-ccm-core.S b/arch/arm64/crypto/aes-ce-ccm-core.S >index d04eb27746d2..ed5dc54198c0 100644 >--- a/arch/arm64/crypto/aes-ce-ccm-core.S >+++ b/arch/arm64/crypto/aes-ce-ccm-core.S >@@ -74,12 +74,13 @@ ENTRY(ce_aes_ccm_auth_data) > beq 10f > ext v0.16b, v0.16b, v0.16b, #1 /* rotate out the mac bytes */ > b 7b >-8: mov w7, w8 >+8: cbz w8, 91f >+ mov w7, w8 > add w8, w8, #16 > 9: ext v1.16b, v1.16b, v1.16b, #1 > adds w7, w7, #1 > bne 9b >- eor v0.16b, v0.16b, v1.16b >+91: eor v0.16b, v0.16b, v1.16b > st1 {v0.16b}, [x0] > 10: str w8, [x3] > ret >diff --git a/arch/m68k/Makefile b/arch/m68k/Makefile >index 7f7830f2c5bc..aab46830f0b9 100644 >--- a/arch/m68k/Makefile >+++ b/arch/m68k/Makefile >@@ -59,7 +59,10 @@ cpuflags-$(CONFIG_M5206e) := $(call cc-option,-mcpu=5206e,-m5200) > cpuflags-$(CONFIG_M5206) := $(call cc-option,-mcpu=5206,-m5200) > > KBUILD_AFLAGS += $(cpuflags-y) >-KBUILD_CFLAGS += $(cpuflags-y) -pipe >+KBUILD_CFLAGS += $(cpuflags-y) >+ >+KBUILD_CFLAGS += -pipe -ffreestanding >+ > ifdef CONFIG_MMU > # without -fno-strength-reduce the 53c7xx.c driver fails ;-( > KBUILD_CFLAGS += -fno-strength-reduce -ffixed-a2 >diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S >index 22b45a4955cd..db5575c69792 100644 >--- a/arch/powerpc/kernel/entry_32.S >+++ b/arch/powerpc/kernel/entry_32.S >@@ -757,6 +757,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_SPE) > mtcr r10 > lwz r10,_LINK(r11) > mtlr r10 >+ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ >+ li r10, 0 >+ stw r10, 8(r11) > REST_GPR(10, r11) > mtspr SPRN_SRR1,r9 > mtspr SPRN_SRR0,r12 >@@ -987,6 +990,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX) > mtcrf 0xFF,r10 > mtlr r11 > >+ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ >+ li r10, 0 >+ stw r10, 8(r1) > /* > * Once we put values in SRR0 and SRR1, we are in a state > * where exceptions are not recoverable, since taking an >@@ -1024,6 +1030,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX) > mtlr r11 > lwz r10,_CCR(r1) > mtcrf 0xff,r10 >+ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ >+ li r10, 0 >+ stw r10, 8(r1) > REST_2GPRS(9, r1) > .globl exc_exit_restart > exc_exit_restart: >diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c >index 248ee7e5bebd..856a6cac5c3e 100644 >--- a/arch/powerpc/kernel/irq.c >+++ b/arch/powerpc/kernel/irq.c >@@ -662,11 +662,6 @@ int irq_choose_cpu(const struct cpumask *mask) > } > #endif > >-int arch_early_irq_init(void) >-{ >- return 0; >-} >- > #ifdef CONFIG_PPC64 > static int __init setup_noirqdistrib(char *str) > { >diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c >index 7477de0e6e3c..2753fe609bcb 100644 >--- a/arch/powerpc/mm/slice.c >+++ b/arch/powerpc/mm/slice.c >@@ -30,6 +30,7 @@ > #include > #include > #include >+#include > #include > #include > #include >@@ -313,6 +314,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm, > int pshift = max_t(int, mmu_psize_defs[psize].shift, PAGE_SHIFT); > unsigned long addr, found, prev; > struct vm_unmapped_area_info info; >+ unsigned long min_addr = max(PAGE_SIZE, mmap_min_addr); > > info.flags = VM_UNMAPPED_AREA_TOPDOWN; > info.length = len; >@@ -320,7 +322,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm, > info.align_offset = 0; > > addr = mm->mmap_base; >- while (addr > PAGE_SIZE) { >+ while (addr > min_addr) { > info.high_limit = addr; > if (!slice_scan_available(addr - 1, available, 0, &addr)) > continue; >@@ -332,8 +334,8 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm, > * Check if we need to reduce the range, or if we can > * extend it to cover the previous available slice. > */ >- if (addr < PAGE_SIZE) >- addr = PAGE_SIZE; >+ if (addr < min_addr) >+ addr = min_addr; > else if (slice_scan_available(addr - 1, available, 0, &prev)) { > addr = prev; > goto prev_slice; >@@ -415,7 +417,7 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len, > addr = _ALIGN_UP(addr, 1ul << pshift); > slice_dbg(" aligned addr=%lx\n", addr); > /* Ignore hint if it's too large or overlaps a VMA */ >- if (addr > mm->task_size - len || >+ if (addr > mm->task_size - len || addr < mmap_min_addr || > !slice_area_is_free(mm, addr, len)) > addr = 0; > } >diff --git a/arch/powerpc/platforms/83xx/suspend-asm.S b/arch/powerpc/platforms/83xx/suspend-asm.S >index 3d1ecd211776..8137f77abad5 100644 >--- a/arch/powerpc/platforms/83xx/suspend-asm.S >+++ b/arch/powerpc/platforms/83xx/suspend-asm.S >@@ -26,13 +26,13 @@ > #define SS_MSR 0x74 > #define SS_SDR1 0x78 > #define SS_LR 0x7c >-#define SS_SPRG 0x80 /* 4 SPRGs */ >-#define SS_DBAT 0x90 /* 8 DBATs */ >-#define SS_IBAT 0xd0 /* 8 IBATs */ >-#define SS_TB 0x110 >-#define SS_CR 0x118 >-#define SS_GPREG 0x11c /* r12-r31 */ >-#define STATE_SAVE_SIZE 0x16c >+#define SS_SPRG 0x80 /* 8 SPRGs */ >+#define SS_DBAT 0xa0 /* 8 DBATs */ >+#define SS_IBAT 0xe0 /* 8 IBATs */ >+#define SS_TB 0x120 >+#define SS_CR 0x128 >+#define SS_GPREG 0x12c /* r12-r31 */ >+#define STATE_SAVE_SIZE 0x17c > > .section .data > .align 5 >@@ -103,6 +103,16 @@ _GLOBAL(mpc83xx_enter_deep_sleep) > stw r7, SS_SPRG+12(r3) > stw r8, SS_SDR1(r3) > >+ mfspr r4, SPRN_SPRG4 >+ mfspr r5, SPRN_SPRG5 >+ mfspr r6, SPRN_SPRG6 >+ mfspr r7, SPRN_SPRG7 >+ >+ stw r4, SS_SPRG+16(r3) >+ stw r5, SS_SPRG+20(r3) >+ stw r6, SS_SPRG+24(r3) >+ stw r7, SS_SPRG+28(r3) >+ > mfspr r4, SPRN_DBAT0U > mfspr r5, SPRN_DBAT0L > mfspr r6, SPRN_DBAT1U >@@ -493,6 +503,16 @@ _GLOBAL(mpc83xx_enter_deep_sleep) > mtspr SPRN_IBAT7U, r6 > mtspr SPRN_IBAT7L, r7 > >+ lwz r4, SS_SPRG+16(r3) >+ lwz r5, SS_SPRG+20(r3) >+ lwz r6, SS_SPRG+24(r3) >+ lwz r7, SS_SPRG+28(r3) >+ >+ mtspr SPRN_SPRG4, r4 >+ mtspr SPRN_SPRG5, r5 >+ mtspr SPRN_SPRG6, r6 >+ mtspr SPRN_SPRG7, r7 >+ > lwz r4, SS_SPRG+0(r3) > lwz r5, SS_SPRG+4(r3) > lwz r6, SS_SPRG+8(r3) >diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c >index 6d8dadf19f0b..545affadae05 100644 >--- a/arch/powerpc/platforms/embedded6xx/wii.c >+++ b/arch/powerpc/platforms/embedded6xx/wii.c >@@ -104,6 +104,10 @@ unsigned long __init wii_mmu_mapin_mem2(unsigned long top) > /* MEM2 64MB@0x10000000 */ > delta = wii_hole_start + wii_hole_size; > size = top - delta; >+ >+ if (__map_without_bats) >+ return delta; >+ > for (bl = 128<<10; bl < max_size; bl <<= 1) { > if (bl * 2 > size) > break; >diff --git a/arch/powerpc/platforms/powernv/opal-msglog.c b/arch/powerpc/platforms/powernv/opal-msglog.c >index 44ed78af1a0d..9021b7272889 100644 >--- a/arch/powerpc/platforms/powernv/opal-msglog.c >+++ b/arch/powerpc/platforms/powernv/opal-msglog.c >@@ -92,7 +92,7 @@ static ssize_t opal_msglog_read(struct file *file, struct kobject *kobj, > } > > static struct bin_attribute opal_msglog_attr = { >- .attr = {.name = "msglog", .mode = 0444}, >+ .attr = {.name = "msglog", .mode = 0400}, > .read = opal_msglog_read > }; > >diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h >index 6453f936540a..30a3ebd06f6c 100644 >--- a/arch/x86/kvm/x86.h >+++ b/arch/x86/kvm/x86.h >@@ -75,10 +75,15 @@ static inline u32 bit(int bitno) > static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu, > gva_t gva, gfn_t gfn, unsigned access) > { >+ u64 gen = kvm_memslots(vcpu->kvm)->generation; >+ >+ if (unlikely(gen & 1)) >+ return; >+ > vcpu->arch.mmio_gva = gva & PAGE_MASK; > vcpu->arch.access = access; > vcpu->arch.mmio_gfn = gfn; >- vcpu->arch.mmio_gen = kvm_memslots(vcpu->kvm)->generation; >+ vcpu->arch.mmio_gen = gen; > } > > static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu) >diff --git a/crypto/ahash.c b/crypto/ahash.c >index 8ed4d42f9de5..5e8fff4fd522 100644 >--- a/crypto/ahash.c >+++ b/crypto/ahash.c >@@ -84,17 +84,17 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk) > int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) > { > unsigned int alignmask = walk->alignmask; >- unsigned int nbytes = walk->entrylen; > > walk->data -= walk->offset; > >- if (nbytes && walk->offset & alignmask && !err) { >- walk->offset = ALIGN(walk->offset, alignmask + 1); >- nbytes = min(nbytes, >- ((unsigned int)(PAGE_SIZE)) - walk->offset); >- walk->entrylen -= nbytes; >+ if (walk->entrylen && (walk->offset & alignmask) && !err) { >+ unsigned int nbytes; > >+ walk->offset = ALIGN(walk->offset, alignmask + 1); >+ nbytes = min(walk->entrylen, >+ (unsigned int)(PAGE_SIZE - walk->offset)); > if (nbytes) { >+ walk->entrylen -= nbytes; > walk->data += walk->offset; > return nbytes; > } >@@ -114,7 +114,7 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) > if (err) > return err; > >- if (nbytes) { >+ if (walk->entrylen) { > walk->offset = 0; > walk->pg++; > return hash_walk_next(walk); >@@ -200,6 +200,21 @@ static int ahash_setkey_unaligned(struct crypto_ahash *tfm, const u8 *key, > return ret; > } > >+static int ahash_nosetkey(struct crypto_ahash *tfm, const u8 *key, >+ unsigned int keylen) >+{ >+ return -ENOSYS; >+} >+ >+static void ahash_set_needkey(struct crypto_ahash *tfm) >+{ >+ const struct hash_alg_common *alg = crypto_hash_alg_common(tfm); >+ >+ if (tfm->setkey != ahash_nosetkey && >+ !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY)) >+ crypto_ahash_set_flags(tfm, CRYPTO_TFM_NEED_KEY); >+} >+ > int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key, > unsigned int keylen) > { >@@ -211,20 +226,16 @@ int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key, > else > err = tfm->setkey(tfm, key, keylen); > >- if (err) >+ if (unlikely(err)) { >+ ahash_set_needkey(tfm); > return err; >+ } > > crypto_ahash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY); > return 0; > } > EXPORT_SYMBOL_GPL(crypto_ahash_setkey); > >-static int ahash_nosetkey(struct crypto_ahash *tfm, const u8 *key, >- unsigned int keylen) >-{ >- return -ENOSYS; >-} >- > static inline unsigned int ahash_align_buffer_size(unsigned len, > unsigned long mask) > { >@@ -493,8 +504,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm) > > if (alg->setkey) { > hash->setkey = alg->setkey; >- if (!(alg->halg.base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY)) >- crypto_ahash_set_flags(hash, CRYPTO_TFM_NEED_KEY); >+ ahash_set_needkey(hash); > } > if (alg->export) > hash->export = alg->export; >diff --git a/crypto/pcbc.c b/crypto/pcbc.c >index f654965f0933..de81f716cf26 100644 >--- a/crypto/pcbc.c >+++ b/crypto/pcbc.c >@@ -52,7 +52,7 @@ static int crypto_pcbc_encrypt_segment(struct blkcipher_desc *desc, > unsigned int nbytes = walk->nbytes; > u8 *src = walk->src.virt.addr; > u8 *dst = walk->dst.virt.addr; >- u8 *iv = walk->iv; >+ u8 * const iv = walk->iv; > > do { > crypto_xor(iv, src, bsize); >@@ -76,7 +76,7 @@ static int crypto_pcbc_encrypt_inplace(struct blkcipher_desc *desc, > int bsize = crypto_cipher_blocksize(tfm); > unsigned int nbytes = walk->nbytes; > u8 *src = walk->src.virt.addr; >- u8 *iv = walk->iv; >+ u8 * const iv = walk->iv; > u8 tmpbuf[bsize]; > > do { >@@ -89,8 +89,6 @@ static int crypto_pcbc_encrypt_inplace(struct blkcipher_desc *desc, > src += bsize; > } while ((nbytes -= bsize) >= bsize); > >- memcpy(walk->iv, iv, bsize); >- > return nbytes; > } > >@@ -130,7 +128,7 @@ static int crypto_pcbc_decrypt_segment(struct blkcipher_desc *desc, > unsigned int nbytes = walk->nbytes; > u8 *src = walk->src.virt.addr; > u8 *dst = walk->dst.virt.addr; >- u8 *iv = walk->iv; >+ u8 * const iv = walk->iv; > > do { > fn(crypto_cipher_tfm(tfm), dst, src); >@@ -142,8 +140,6 @@ static int crypto_pcbc_decrypt_segment(struct blkcipher_desc *desc, > dst += bsize; > } while ((nbytes -= bsize) >= bsize); > >- memcpy(walk->iv, iv, bsize); >- > return nbytes; > } > >@@ -156,7 +152,7 @@ static int crypto_pcbc_decrypt_inplace(struct blkcipher_desc *desc, > int bsize = crypto_cipher_blocksize(tfm); > unsigned int nbytes = walk->nbytes; > u8 *src = walk->src.virt.addr; >- u8 *iv = walk->iv; >+ u8 * const iv = walk->iv; > u8 tmpbuf[bsize]; > > do { >@@ -169,8 +165,6 @@ static int crypto_pcbc_decrypt_inplace(struct blkcipher_desc *desc, > src += bsize; > } while ((nbytes -= bsize) >= bsize); > >- memcpy(walk->iv, iv, bsize); >- > return nbytes; > } > >diff --git a/crypto/shash.c b/crypto/shash.c >index 194f7b1ff5cb..00d004c38696 100644 >--- a/crypto/shash.c >+++ b/crypto/shash.c >@@ -52,6 +52,13 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, > return err; > } > >+static void shash_set_needkey(struct crypto_shash *tfm, struct shash_alg *alg) >+{ >+ if (crypto_shash_alg_has_setkey(alg) && >+ !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY)) >+ crypto_shash_set_flags(tfm, CRYPTO_TFM_NEED_KEY); >+} >+ > int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key, > unsigned int keylen) > { >@@ -64,8 +71,10 @@ int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key, > else > err = shash->setkey(tfm, key, keylen); > >- if (err) >+ if (unlikely(err)) { >+ shash_set_needkey(tfm, shash); > return err; >+ } > > crypto_shash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY); > return 0; >@@ -367,7 +376,8 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm) > crt->final = shash_async_final; > crt->finup = shash_async_finup; > crt->digest = shash_async_digest; >- crt->setkey = shash_async_setkey; >+ if (crypto_shash_alg_has_setkey(alg)) >+ crt->setkey = shash_async_setkey; > > crypto_ahash_set_flags(crt, crypto_shash_get_flags(shash) & > CRYPTO_TFM_NEED_KEY); >@@ -534,9 +544,7 @@ static int crypto_shash_init_tfm(struct crypto_tfm *tfm) > > hash->descsize = alg->descsize; > >- if (crypto_shash_alg_has_setkey(alg) && >- !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY)) >- crypto_shash_set_flags(hash, CRYPTO_TFM_NEED_KEY); >+ shash_set_needkey(hash, alg); > > return 0; > } >diff --git a/crypto/testmgr.c b/crypto/testmgr.c >index 498649ac1953..81d3e1b87035 100644 >--- a/crypto/testmgr.c >+++ b/crypto/testmgr.c >@@ -1655,14 +1655,21 @@ static int alg_test_crc32c(const struct alg_test_desc *desc, > > err = alg_test_hash(desc, driver, type, mask); > if (err) >- goto out; >+ return err; > > tfm = crypto_alloc_shash(driver, type, mask); > if (IS_ERR(tfm)) { >+ if (PTR_ERR(tfm) == -ENOENT) { >+ /* >+ * This crc32c implementation is only available through >+ * ahash API, not the shash API, so the remaining part >+ * of the test is not applicable to it. >+ */ >+ return 0; >+ } > printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: " > "%ld\n", driver, PTR_ERR(tfm)); >- err = PTR_ERR(tfm); >- goto out; >+ return PTR_ERR(tfm); > } > > do { >@@ -1691,7 +1698,6 @@ static int alg_test_crc32c(const struct alg_test_desc *desc, > > crypto_free_shash(tfm); > >-out: > return err; > } > >diff --git a/crypto/tgr192.c b/crypto/tgr192.c >index 321bc6ff2a9d..904c8444aa0a 100644 >--- a/crypto/tgr192.c >+++ b/crypto/tgr192.c >@@ -25,8 +25,9 @@ > #include > #include > #include >-#include > #include >+#include >+#include > > #define TGR192_DIGEST_SIZE 24 > #define TGR160_DIGEST_SIZE 20 >@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data) > u64 a, b, c, aa, bb, cc; > u64 x[8]; > int i; >- const __le64 *ptr = (const __le64 *)data; > > for (i = 0; i < 8; i++) >- x[i] = le64_to_cpu(ptr[i]); >+ x[i] = get_unaligned_le64(data + i * sizeof(__le64)); > > /* save */ > a = aa = tctx->a; >diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c >index 14790304b84b..9fcd51095d13 100644 >--- a/drivers/char/applicom.c >+++ b/drivers/char/applicom.c >@@ -32,6 +32,7 @@ > #include > #include > #include >+#include > > #include > #include >@@ -386,7 +387,11 @@ static ssize_t ac_write(struct file *file, const char __user *buf, size_t count, > TicCard = st_loc.tic_des_from_pc; /* tic number to send */ > IndexCard = NumCard - 1; > >- if((NumCard < 1) || (NumCard > MAX_BOARD) || !apbs[IndexCard].RamIO) >+ if (IndexCard >= MAX_BOARD) >+ return -EINVAL; >+ IndexCard = array_index_nospec(IndexCard, MAX_BOARD); >+ >+ if (!apbs[IndexCard].RamIO) > return -EINVAL; > > #ifdef DEBUG >@@ -697,6 +702,7 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) > unsigned char IndexCard; > void __iomem *pmem; > int ret = 0; >+ static int warncount = 10; > volatile unsigned char byte_reset_it; > struct st_ram_io *adgl; > void __user *argp = (void __user *)arg; >@@ -711,16 +717,12 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) > mutex_lock(&ac_mutex); > IndexCard = adgl->num_card-1; > >- if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) { >- static int warncount = 10; >- if (warncount) { >- printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1); >- warncount--; >- } >- kfree(adgl); >- mutex_unlock(&ac_mutex); >- return -EINVAL; >- } >+ if (cmd != 6 && IndexCard >= MAX_BOARD) >+ goto err; >+ IndexCard = array_index_nospec(IndexCard, MAX_BOARD); >+ >+ if (cmd != 6 && !apbs[IndexCard].RamIO) >+ goto err; > > switch (cmd) { > >@@ -838,5 +840,16 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) > kfree(adgl); > mutex_unlock(&ac_mutex); > return 0; >+ >+err: >+ if (warncount) { >+ pr_warn("APPLICOM driver IOCTL, bad board number %d\n", >+ (int)IndexCard + 1); >+ warncount--; >+ } >+ kfree(adgl); >+ mutex_unlock(&ac_mutex); >+ return -EINVAL; >+ > } > >diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c >index d5d4cd82b9f7..978a782f5e30 100644 >--- a/drivers/char/hpet.c >+++ b/drivers/char/hpet.c >@@ -377,7 +377,7 @@ static __init int hpet_mmap_enable(char *str) > pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled"); > return 1; > } >-__setup("hpet_mmap", hpet_mmap_enable); >+__setup("hpet_mmap=", hpet_mmap_enable); > > static int hpet_mmap(struct file *file, struct vm_area_struct *vma) > { >diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c >index 59f7cb28260b..0dddf3299628 100644 >--- a/drivers/char/tpm/tpm_eventlog.c >+++ b/drivers/char/tpm/tpm_eventlog.c >@@ -81,7 +81,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos) > for (i = 0; i < *pos; i++) { > event = addr; > >- if ((addr + sizeof(struct tcpa_event)) < limit) { >+ if ((addr + sizeof(struct tcpa_event)) <= limit) { > if (event->event_type == 0 && event->event_size == 0) > return NULL; > addr += sizeof(struct tcpa_event) + event->event_size; >@@ -89,13 +89,13 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos) > } > > /* now check if current entry is valid */ >- if ((addr + sizeof(struct tcpa_event)) >= limit) >+ if ((addr + sizeof(struct tcpa_event)) > limit) > return NULL; > > event = addr; > > if ((event->event_type == 0 && event->event_size == 0) || >- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit)) >+ ((addr + sizeof(struct tcpa_event) + event->event_size) > limit)) > return NULL; > > return addr; >@@ -111,7 +111,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v, > v += sizeof(struct tcpa_event) + event->event_size; > > /* now check if current entry is valid */ >- if ((v + sizeof(struct tcpa_event)) >= limit) >+ if ((v + sizeof(struct tcpa_event)) > limit) > return NULL; > > event = v; >@@ -120,7 +120,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v, > return NULL; > > if ((event->event_type == 0 && event->event_size == 0) || >- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit)) >+ ((v + sizeof(struct tcpa_event) + event->event_size) > limit)) > return NULL; > > (*pos)++; >diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c >index 503a85ae176c..66c4efa7fca1 100644 >--- a/drivers/char/tpm/tpm_i2c_atmel.c >+++ b/drivers/char/tpm/tpm_i2c_atmel.c >@@ -65,7 +65,14 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len) > dev_dbg(chip->dev, > "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__, > (int)min_t(size_t, 64, len), buf, len, status); >- return status; >+ if (status < 0) >+ return status; >+ >+ /* The upper layer does not support incomplete sends. */ >+ if (status != len) >+ return -E2BIG; >+ >+ return 0; > } > > static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count) >diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c >index 2e7e9d9798cb..d320f8ae5e64 100644 >--- a/drivers/clk/clk-highbank.c >+++ b/drivers/clk/clk-highbank.c >@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk > /* Map system registers */ > srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs"); > hb_clk->reg = of_iomap(srnp, 0); >+ of_node_put(srnp); > BUG_ON(!hb_clk->reg); > hb_clk->reg += reg; > >diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c >index bef198a83863..f9679a4f973a 100644 >--- a/drivers/clk/mvebu/armada-370.c >+++ b/drivers/clk/mvebu/armada-370.c >@@ -168,8 +168,10 @@ static void __init a370_clk_init(struct device_node *np) > > mvebu_coreclk_setup(np, &a370_coreclks); > >- if (cgnp) >+ if (cgnp) { > mvebu_clk_gating_setup(cgnp, a370_gating_desc); >+ of_node_put(cgnp); >+ } > } > CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init); > >diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c >index b3094315a3c0..2fa15a274719 100644 >--- a/drivers/clk/mvebu/armada-xp.c >+++ b/drivers/clk/mvebu/armada-xp.c >@@ -202,7 +202,9 @@ static void __init axp_clk_init(struct device_node *np) > > mvebu_coreclk_setup(np, &axp_coreclks); > >- if (cgnp) >+ if (cgnp) { > mvebu_clk_gating_setup(cgnp, axp_gating_desc); >+ of_node_put(cgnp); >+ } > } > CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init); >diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c >index b8c2424ac926..1320020ca381 100644 >--- a/drivers/clk/mvebu/dove.c >+++ b/drivers/clk/mvebu/dove.c >@@ -187,7 +187,9 @@ static void __init dove_clk_init(struct device_node *np) > > mvebu_coreclk_setup(np, &dove_coreclks); > >- if (cgnp) >+ if (cgnp) { > mvebu_clk_gating_setup(cgnp, dove_gating_desc); >+ of_node_put(cgnp); >+ } > } > CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init); >diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c >index ddb666a86500..8457b48f1395 100644 >--- a/drivers/clk/mvebu/kirkwood.c >+++ b/drivers/clk/mvebu/kirkwood.c >@@ -236,8 +236,11 @@ static void __init kirkwood_clk_init(struct device_node *np) > else > mvebu_coreclk_setup(np, &kirkwood_coreclks); > >- if (cgnp) >+ if (cgnp) { > mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc); >+ >+ of_node_put(cgnp); >+ } > } > CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock", > kirkwood_clk_init); >diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c >index 1a2e2c915f35..672da2916228 100644 >--- a/drivers/clk/samsung/clk-exynos4.c >+++ b/drivers/clk/samsung/clk-exynos4.c >@@ -1032,6 +1032,7 @@ static unsigned long exynos4_get_xom(void) > xom = readl(chipid_base + 8); > > iounmap(chipid_base); >+ of_node_put(np); > } > > return xom; >diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c >index de6da957a09d..f091cb1707a3 100644 >--- a/drivers/clk/socfpga/clk-pll.c >+++ b/drivers/clk/socfpga/clk-pll.c >@@ -102,6 +102,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node, > > clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr"); > clk_mgr_base_addr = of_iomap(clkmgr_np, 0); >+ of_node_put(clkmgr_np); > BUG_ON(!clk_mgr_base_addr); > pll_clk->hw.reg = clk_mgr_base_addr + reg; > >diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c >index 2163a5145518..650ddc984253 100644 >--- a/drivers/clocksource/exynos_mct.c >+++ b/drivers/clocksource/exynos_mct.c >@@ -558,7 +558,19 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem > return; > > out_irq: >- free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick); >+ if (mct_int_type == MCT_INT_PPI) { >+ free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick); >+ } else { >+ for_each_possible_cpu(cpu) { >+ struct mct_clock_event_device *pcpu_mevt = >+ per_cpu_ptr(&percpu_mct_tick, cpu); >+ >+ if (pcpu_mevt->evt.irq != -1) { >+ free_irq(pcpu_mevt->evt.irq, pcpu_mevt); >+ pcpu_mevt->evt.irq = -1; >+ } >+ } >+ } > } > > void __init mct_init(void __iomem *base, int irq_g0, int irq_l0, int irq_l1) >diff --git a/drivers/cpufreq/pxa2xx-cpufreq.c b/drivers/cpufreq/pxa2xx-cpufreq.c >index e24269ab4e9b..aab0d8ff5032 100644 >--- a/drivers/cpufreq/pxa2xx-cpufreq.c >+++ b/drivers/cpufreq/pxa2xx-cpufreq.c >@@ -191,7 +191,7 @@ static int pxa_cpufreq_change_voltage(pxa_freqs_t *pxa_freq) > return ret; > } > >-static void __init pxa_cpufreq_init_voltages(void) >+static void pxa_cpufreq_init_voltages(void) > { > vcc_core = regulator_get(NULL, "vcc_core"); > if (IS_ERR(vcc_core)) { >@@ -207,7 +207,7 @@ static int pxa_cpufreq_change_voltage(pxa_freqs_t *pxa_freq) > return 0; > } > >-static void __init pxa_cpufreq_init_voltages(void) { } >+static void pxa_cpufreq_init_voltages(void) { } > #endif > > static void find_freq_tables(struct cpufreq_frequency_table **freq_table, >diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c >index 071c2c969eec..8f6762bdc315 100644 >--- a/drivers/firmware/iscsi_ibft.c >+++ b/drivers/firmware/iscsi_ibft.c >@@ -503,6 +503,7 @@ static umode_t __init ibft_check_tgt_for(void *data, int type) > case ISCSI_BOOT_TGT_NIC_ASSOC: > case ISCSI_BOOT_TGT_CHAP_TYPE: > rc = S_IRUGO; >+ break; > case ISCSI_BOOT_TGT_NAME: > if (tgt->tgt_name_len) > rc = S_IRUGO; >diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c >index d2376911c541..6e1a8420b3fc 100644 >--- a/drivers/gpu/drm/drm_context.c >+++ b/drivers/gpu/drm/drm_context.c >@@ -309,19 +309,22 @@ int drm_addctx(struct drm_device *dev, void *data, > { > struct drm_ctx_list *ctx_entry; > struct drm_ctx *ctx = data; >+ int tmp_handle; > >- ctx->handle = drm_ctxbitmap_next(dev); >- if (ctx->handle == DRM_KERNEL_CONTEXT) { >+ tmp_handle = drm_ctxbitmap_next(dev); >+ if (tmp_handle == DRM_KERNEL_CONTEXT) { > /* Skip kernel's context and get a new one. */ >- ctx->handle = drm_ctxbitmap_next(dev); >+ tmp_handle = drm_ctxbitmap_next(dev); > } >- DRM_DEBUG("%d\n", ctx->handle); >- if (ctx->handle < 0) { >+ DRM_DEBUG("%d\n", tmp_handle); >+ if (tmp_handle < 0) { > DRM_DEBUG("Not enough free contexts.\n"); > /* Should this return -EBUSY instead? */ >- return -ENOMEM; >+ return tmp_handle; > } > >+ ctx->handle = tmp_handle; >+ > ctx_entry = kmalloc(sizeof(*ctx_entry), GFP_KERNEL); > if (!ctx_entry) { > DRM_DEBUG("out of memory\n"); >diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c >index 5c8b358f9fba..d3d8167c6f80 100644 >--- a/drivers/gpu/drm/radeon/evergreen_cs.c >+++ b/drivers/gpu/drm/radeon/evergreen_cs.c >@@ -1318,6 +1318,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) > return -EINVAL; > } > ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); >+ break; > case CB_TARGET_MASK: > track->cb_target_mask = radeon_get_ib_value(p, idx); > track->cb_dirty = true; >diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c >index 43e6f0572717..fd003efcf9b6 100644 >--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c >+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c >@@ -39,7 +39,7 @@ > > int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey) > { >- if (index > 1) >+ if (index > 0) > return -EINVAL; > > *pkey = 0xffff; >diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c >index 806432ad21bf..b97e123826a1 100644 >--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c >+++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c >@@ -410,7 +410,7 @@ int usnic_ib_query_gid(struct ib_device *ibdev, u8 port, int index, > int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index, > u16 *pkey) > { >- if (index > 1) >+ if (index > 0) > return -EINVAL; > > *pkey = 0xffff; >diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c >index 94a15ae52212..de5c57d23b92 100644 >--- a/drivers/irqchip/irq-brcmstb-l2.c >+++ b/drivers/irqchip/irq-brcmstb-l2.c >@@ -82,8 +82,9 @@ static void brcmstb_l2_intc_suspend(struct irq_data *d) > { > struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); > struct brcmstb_l2_intc_data *b = gc->private; >+ unsigned long flags; > >- irq_gc_lock(gc); >+ irq_gc_lock_irqsave(gc, flags); > /* Save the current mask */ > b->saved_mask = __raw_readl(b->base + CPU_MASK_STATUS); > >@@ -92,22 +93,23 @@ static void brcmstb_l2_intc_suspend(struct irq_data *d) > __raw_writel(~gc->wake_active, b->base + CPU_MASK_SET); > __raw_writel(gc->wake_active, b->base + CPU_MASK_CLEAR); > } >- irq_gc_unlock(gc); >+ irq_gc_unlock_irqrestore(gc, flags); > } > > static void brcmstb_l2_intc_resume(struct irq_data *d) > { > struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); > struct brcmstb_l2_intc_data *b = gc->private; >+ unsigned long flags; > >- irq_gc_lock(gc); >+ irq_gc_lock_irqsave(gc, flags); > /* Clear unmasked non-wakeup interrupts */ > __raw_writel(~b->saved_mask & ~gc->wake_active, b->base + CPU_CLEAR); > > /* Restore the saved mask */ > __raw_writel(b->saved_mask, b->base + CPU_MASK_SET); > __raw_writel(~b->saved_mask, b->base + CPU_MASK_CLEAR); >- irq_gc_unlock(gc); >+ irq_gc_unlock_irqrestore(gc, flags); > } > > int __init brcmstb_l2_intc_of_init(struct device_node *np, >diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c >index 88317b4f7bf3..53be8ac31eed 100644 >--- a/drivers/leds/leds-lp55xx-common.c >+++ b/drivers/leds/leds-lp55xx-common.c >@@ -214,7 +214,7 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context) > > if (!fw) { > dev_err(dev, "firmware request failed\n"); >- goto out; >+ return; > } > > /* handling firmware data is chip dependent */ >@@ -227,9 +227,9 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context) > > mutex_unlock(&chip->lock); > >-out: > /* firmware should be released for other channel use */ > release_firmware(chip->fw); >+ chip->fw = NULL; > } > > static int lp55xx_request_firmware(struct lp55xx_chip *chip) >diff --git a/drivers/md/bcache/extents.c b/drivers/md/bcache/extents.c >index 3a0de4cf9771..9d3ccf1bb749 100644 >--- a/drivers/md/bcache/extents.c >+++ b/drivers/md/bcache/extents.c >@@ -530,6 +530,7 @@ static bool bch_extent_bad(struct btree_keys *bk, const struct bkey *k) > struct btree *b = container_of(bk, struct btree, keys); > struct bucket *g; > unsigned i, stale; >+ char buf[80]; > > if (!KEY_PTRS(k) || > bch_extent_invalid(bk, k)) >@@ -539,20 +540,20 @@ static bool bch_extent_bad(struct btree_keys *bk, const struct bkey *k) > if (!ptr_available(b->c, k, i)) > return true; > >- if (!expensive_debug_checks(b->c) && KEY_DIRTY(k)) >- return false; >- > for (i = 0; i < KEY_PTRS(k); i++) { > g = PTR_BUCKET(b->c, k, i); > stale = ptr_stale(b->c, k, i); > >+ if (stale && KEY_DIRTY(k)) { >+ bch_extent_to_text(buf, sizeof(buf), k); >+ pr_info("stale dirty pointer, stale %u, key: %s", >+ stale, buf); >+ } >+ > btree_bug_on(stale > 96, b, > "key too stale: %i, need_gc %u", > stale, b->c->need_gc); > >- btree_bug_on(stale && KEY_DIRTY(k) && KEY_SIZE(k), >- b, "stale dirty pointer"); >- > if (stale) > return true; > >diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h >index d1ff56aeaeb3..ea0d006414ac 100644 >--- a/drivers/md/bcache/writeback.h >+++ b/drivers/md/bcache/writeback.h >@@ -68,6 +68,9 @@ static inline bool should_writeback(struct cached_dev *dc, struct bio *bio, > in_use > CUTOFF_WRITEBACK_SYNC) > return false; > >+ if (bio->bi_rw & REQ_DISCARD) >+ return false; >+ > if (dc->partial_stripes_expensive && > bcache_dev_stripe_dirty(dc, bio->bi_iter.bi_sector, > bio_sectors(bio))) >diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c >index 18b0c80fc447..cbe36396c371 100644 >--- a/drivers/md/raid10.c >+++ b/drivers/md/raid10.c >@@ -3820,6 +3820,8 @@ static int run(struct mddev *mddev) > set_bit(MD_RECOVERY_RUNNING, &mddev->recovery); > mddev->sync_thread = md_register_thread(md_do_sync, mddev, > "reshape"); >+ if (!mddev->sync_thread) >+ goto out_free_conf; > } > > return 0; >@@ -4506,7 +4508,6 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, > atomic_inc(&r10_bio->remaining); > read_bio->bi_next = NULL; > generic_make_request(read_bio); >- sector_nr += nr_sectors; > sectors_done += nr_sectors; > if (sector_nr <= last) > goto read_more; >diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c >index affe5d3e768b..1dae2b025159 100644 >--- a/drivers/md/raid5.c >+++ b/drivers/md/raid5.c >@@ -6180,6 +6180,8 @@ static int run(struct mddev *mddev) > set_bit(MD_RECOVERY_RUNNING, &mddev->recovery); > mddev->sync_thread = md_register_thread(md_do_sync, mddev, > "reshape"); >+ if (!mddev->sync_thread) >+ goto abort; > } > > >diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c >index cdd7c1b7259b..a94db59c238c 100644 >--- a/drivers/media/i2c/ov7670.c >+++ b/drivers/media/i2c/ov7670.c >@@ -167,10 +167,10 @@ MODULE_PARM_DESC(debug, "Debug level (0-1)"); > #define REG_GFIX 0x69 /* Fix gain control */ > > #define REG_DBLV 0x6b /* PLL control an debugging */ >-#define DBLV_BYPASS 0x00 /* Bypass PLL */ >-#define DBLV_X4 0x01 /* clock x4 */ >-#define DBLV_X6 0x10 /* clock x6 */ >-#define DBLV_X8 0x11 /* clock x8 */ >+#define DBLV_BYPASS 0x0a /* Bypass PLL */ >+#define DBLV_X4 0x4a /* clock x4 */ >+#define DBLV_X6 0x8a /* clock x6 */ >+#define DBLV_X8 0xca /* clock x8 */ > > #define REG_REG76 0x76 /* OV's name */ > #define R76_BLKPCOR 0x80 /* Black pixel correction enable */ >@@ -845,7 +845,7 @@ static int ov7675_set_framerate(struct v4l2_subdev *sd, > if (ret < 0) > return ret; > >- return ov7670_write(sd, REG_DBLV, DBLV_X4); >+ return 0; > } > > static void ov7670_get_framerate_legacy(struct v4l2_subdev *sd, >@@ -1552,11 +1552,7 @@ static int ov7670_probe(struct i2c_client *client, > if (config->clock_speed) > info->clock_speed = config->clock_speed; > >- /* >- * It should be allowed for ov7670 too when it is migrated to >- * the new frame rate formula. >- */ >- if (config->pll_bypass && id->driver_data != MODEL_OV7670) >+ if (config->pll_bypass) > info->pll_bypass = true; > > if (config->pclk_hb_disable) >diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c >index 0dcb796ecad9..78f923ed32f0 100644 >--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c >+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c >@@ -859,13 +859,16 @@ static int s5p_jpeg_querycap(struct file *file, void *priv, > return 0; > } > >-static int enum_fmt(struct s5p_jpeg_fmt *sjpeg_formats, int n, >+static int enum_fmt(struct s5p_jpeg_ctx *ctx, >+ struct s5p_jpeg_fmt *sjpeg_formats, int n, > struct v4l2_fmtdesc *f, u32 type) > { > int i, num = 0; >+ unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag; > > for (i = 0; i < n; ++i) { >- if (sjpeg_formats[i].flags & type) { >+ if (sjpeg_formats[i].flags & type && >+ sjpeg_formats[i].flags & fmt_ver_flag) { > /* index-th format of type type found ? */ > if (num == f->index) > break; >@@ -891,11 +894,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, void *priv, > struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv); > > if (ctx->mode == S5P_JPEG_ENCODE) >- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, >+ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, > SJPEG_FMT_FLAG_ENC_CAPTURE); > >- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, >- SJPEG_FMT_FLAG_DEC_CAPTURE); >+ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, >+ SJPEG_FMT_FLAG_DEC_CAPTURE); > } > > static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv, >@@ -904,11 +907,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv, > struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv); > > if (ctx->mode == S5P_JPEG_ENCODE) >- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, >+ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, > SJPEG_FMT_FLAG_ENC_OUTPUT); > >- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, >- SJPEG_FMT_FLAG_DEC_OUTPUT); >+ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, >+ SJPEG_FMT_FLAG_DEC_OUTPUT); > } > > static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx, >@@ -1360,7 +1363,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx) > > v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops, > V4L2_CID_JPEG_RESTART_INTERVAL, >- 0, 3, 0xffff, 0); >+ 0, 0xffff, 1, 0); > if (ctx->jpeg->variant->version == SJPEG_S5P) > mask = ~0x06; /* 422, 420 */ > } >diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c >index bb002b9120de..3b5f73ffe17a 100644 >--- a/drivers/media/usb/uvc/uvc_driver.c >+++ b/drivers/media/usb/uvc/uvc_driver.c >@@ -977,11 +977,19 @@ static int uvc_parse_standard_control(struct uvc_device *dev, > return -EINVAL; > } > >- /* Make sure the terminal type MSB is not null, otherwise it >- * could be confused with a unit. >+ /* >+ * Reject invalid terminal types that would cause issues: >+ * >+ * - The high byte must be non-zero, otherwise it would be >+ * confused with a unit. >+ * >+ * - Bit 15 must be 0, as we use it internally as a terminal >+ * direction flag. >+ * >+ * Other unknown types are accepted. > */ > type = get_unaligned_le16(&buffer[4]); >- if ((type & 0xff00) == 0) { >+ if ((type & 0x7f00) == 0 || (type & 0x8000) != 0) { > uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " > "interface %d INPUT_TERMINAL %d has invalid " > "type 0x%04x, skipping\n", udev->devnum, >diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c >index 983c24a70ff5..0e2a9d732c2d 100644 >--- a/drivers/media/usb/uvc/uvc_video.c >+++ b/drivers/media/usb/uvc/uvc_video.c >@@ -627,6 +627,14 @@ void uvc_video_clock_update(struct uvc_streaming *stream, > u32 rem; > u64 y; > >+ /* >+ * We will get called from __vb2_queue_cancel() if there are buffers >+ * done but not dequeued by the user, but the sample array has already >+ * been released at that time. Just bail out in that case. >+ */ >+ if (!clock->samples) >+ return; >+ > spin_lock_irqsave(&clock->lock, flags); > > if (clock->count < clock->size) >diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c >index 1996467481e9..40e57398ad56 100644 >--- a/drivers/mmc/host/omap.c >+++ b/drivers/mmc/host/omap.c >@@ -921,7 +921,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host *host, struct mmc_reques > reg &= ~(1 << 5); > OMAP_MMC_WRITE(host, SDIO, reg); > /* Set maximum timeout */ >- OMAP_MMC_WRITE(host, CTO, 0xff); >+ OMAP_MMC_WRITE(host, CTO, 0xfd); > } > > static inline void set_data_timeout(struct mmc_omap_host *host, struct mmc_request *req) >diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c >index 91a169c44b39..a202cf556993 100644 >--- a/drivers/mtd/devices/docg3.c >+++ b/drivers/mtd/devices/docg3.c >@@ -1822,7 +1822,7 @@ static void __exit doc_dbg_unregister(struct docg3 *docg3) > * @chip_id: The chip ID of the supported chip > * @mtd: The structure to fill > */ >-static void __init doc_set_driver_info(int chip_id, struct mtd_info *mtd) >+static int __init doc_set_driver_info(int chip_id, struct mtd_info *mtd) > { > struct docg3 *docg3 = mtd->priv; > int cfg; >@@ -1835,6 +1835,8 @@ static void __init doc_set_driver_info(int chip_id, struct mtd_info *mtd) > case DOC_CHIPID_G3: > mtd->name = kasprintf(GFP_KERNEL, "docg3.%d", > docg3->device_id); >+ if (!mtd->name) >+ return -ENOMEM; > docg3->max_block = 2047; > break; > } >@@ -1857,6 +1859,8 @@ static void __init doc_set_driver_info(int chip_id, struct mtd_info *mtd) > mtd->_block_isbad = doc_block_isbad; > mtd->ecclayout = &docg3_oobinfo; > mtd->ecc_strength = DOC_ECC_BCH_T; >+ >+ return 0; > } > > /** >@@ -1907,7 +1911,7 @@ doc_probe_device(struct docg3_cascade *cascade, int floor, struct device *dev) > > ret = 0; > if (chip_id != (u16)(~chip_id_inv)) { >- goto nomem3; >+ goto nomem4; > } > > switch (chip_id) { >@@ -1917,21 +1921,25 @@ doc_probe_device(struct docg3_cascade *cascade, int floor, struct device *dev) > break; > default: > doc_err("Chip id %04x is not a DiskOnChip G3 chip\n", chip_id); >- goto nomem3; >+ goto nomem4; > } > >- doc_set_driver_info(chip_id, mtd); >+ ret = doc_set_driver_info(chip_id, mtd); >+ if (ret) >+ goto nomem4; > > doc_hamming_ecc_init(docg3, DOC_LAYOUT_OOB_PAGEINFO_SZ); > doc_reload_bbt(docg3); > return mtd; > >+nomem4: >+ kfree(docg3->bbt); > nomem3: > kfree(mtd); > nomem2: > kfree(docg3); > nomem1: >- return ERR_PTR(ret); >+ return ret ? ERR_PTR(ret) : NULL; > } > > /** >diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c >index d38572de8946..e080fd1d927a 100644 >--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c >+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c >@@ -2196,6 +2196,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev) > if (!priv->cmd.context) > return -ENOMEM; > >+ if (mlx4_is_mfunc(dev)) >+ mutex_lock(&priv->cmd.slave_cmd_mutex); > down_write(&priv->cmd.switch_sem); > for (i = 0; i < priv->cmd.max_cmds; ++i) { > priv->cmd.context[i].token = i; >@@ -2217,6 +2219,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev) > down(&priv->cmd.poll_sem); > priv->cmd.use_events = 1; > up_write(&priv->cmd.switch_sem); >+ if (mlx4_is_mfunc(dev)) >+ mutex_unlock(&priv->cmd.slave_cmd_mutex); > > return err; > } >@@ -2229,6 +2233,8 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev) > struct mlx4_priv *priv = mlx4_priv(dev); > int i; > >+ if (mlx4_is_mfunc(dev)) >+ mutex_lock(&priv->cmd.slave_cmd_mutex); > down_write(&priv->cmd.switch_sem); > priv->cmd.use_events = 0; > >@@ -2239,6 +2245,8 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev) > > up(&priv->cmd.poll_sem); > up_write(&priv->cmd.switch_sem); >+ if (mlx4_is_mfunc(dev)) >+ mutex_unlock(&priv->cmd.slave_cmd_mutex); > } > > struct mlx4_cmd_mailbox *mlx4_alloc_cmd_mailbox(struct mlx4_dev *dev) >diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c >index 338c09beecc8..6130dd76e50d 100644 >--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c >+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c >@@ -2460,13 +2460,13 @@ static int qp_get_mtt_size(struct mlx4_qp_context *qpc) > int total_pages; > int total_mem; > int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f; >+ int tot; > > sq_size = 1 << (log_sq_size + log_sq_sride + 4); > rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4)); > total_mem = sq_size + rq_size; >- total_pages = >- roundup_pow_of_two((total_mem + (page_offset << 6)) >> >- page_shift); >+ tot = (total_mem + (page_offset << 6)) >> page_shift; >+ total_pages = !tot ? 1 : roundup_pow_of_two(tot); > > return total_pages; > } >diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c >index b62545b93f3f..07ef09579730 100644 >--- a/drivers/net/ethernet/renesas/sh_eth.c >+++ b/drivers/net/ethernet/renesas/sh_eth.c >@@ -2712,12 +2712,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev) > struct device_node *np = dev->of_node; > struct sh_eth_plat_data *pdata; > const char *mac_addr; >+ int ret; > > pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL); > if (!pdata) > return NULL; > >- pdata->phy_interface = of_get_phy_mode(np); >+ ret = of_get_phy_mode(np); >+ if (ret < 0) >+ return NULL; >+ pdata->phy_interface = ret; > > mac_addr = of_get_mac_address(np); > if (mac_addr) >diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c >index bb1ab1ffbc8b..5dd0fe1635b9 100644 >--- a/drivers/net/ppp/pptp.c >+++ b/drivers/net/ppp/pptp.c >@@ -579,6 +579,7 @@ static void pptp_sock_destruct(struct sock *sk) > pppox_unbind_sock(sk); > } > skb_queue_purge(&sk->sk_receive_queue); >+ dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1)); > } > > static int pptp_create(struct net *net, struct socket *sock) >diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c >index d7e4f83f8bf3..73874090cf42 100644 >--- a/drivers/net/vxlan.c >+++ b/drivers/net/vxlan.c >@@ -1280,6 +1280,14 @@ static void vxlan_rcv(struct vxlan_sock *vs, > } > } > >+ rcu_read_lock(); >+ >+ if (unlikely(!(vxlan->dev->flags & IFF_UP))) { >+ rcu_read_unlock(); >+ atomic_long_inc(&vxlan->dev->rx_dropped); >+ goto drop; >+ } >+ > stats = this_cpu_ptr(vxlan->dev->tstats); > u64_stats_update_begin(&stats->syncp); > stats->rx_packets++; >@@ -1288,6 +1296,8 @@ static void vxlan_rcv(struct vxlan_sock *vs, > > netif_rx(skb); > >+ rcu_read_unlock(); >+ > return; > drop: > /* Consume bad packet */ >diff --git a/drivers/net/wireless/libertas_tf/if_usb.c b/drivers/net/wireless/libertas_tf/if_usb.c >index cdb1afca58b6..eb9bed7edd37 100644 >--- a/drivers/net/wireless/libertas_tf/if_usb.c >+++ b/drivers/net/wireless/libertas_tf/if_usb.c >@@ -440,8 +440,6 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp, > skb_tail_pointer(skb), > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn, cardp); > >- cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET; >- > lbtf_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", > cardp->rx_urb); > ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC); >diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c >index 3bf3d58bbc02..69827b5f96b5 100644 >--- a/drivers/net/wireless/mwifiex/ie.c >+++ b/drivers/net/wireless/mwifiex/ie.c >@@ -328,6 +328,8 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv, > struct ieee_types_header *rsn_ie, *wpa_ie = NULL; > u16 rsn_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0; > const u8 *vendor_ie; >+ unsigned int token_len; >+ int err = 0; > > if (info->tail && info->tail_len) { > gen_ie = kzalloc(sizeof(struct mwifiex_ie), GFP_KERNEL); >@@ -341,8 +343,13 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv, > rsn_ie = (void *)cfg80211_find_ie(WLAN_EID_RSN, > info->tail, info->tail_len); > if (rsn_ie) { >- memcpy(gen_ie->ie_buffer, rsn_ie, rsn_ie->len + 2); >- ie_len = rsn_ie->len + 2; >+ token_len = rsn_ie->len + 2; >+ if (ie_len + token_len > IEEE_MAX_IE_SIZE) { >+ err = -EINVAL; >+ goto out; >+ } >+ memcpy(gen_ie->ie_buffer + ie_len, rsn_ie, token_len); >+ ie_len += token_len; > gen_ie->ie_length = cpu_to_le16(ie_len); > } > >@@ -352,9 +359,15 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv, > info->tail_len); > if (vendor_ie) { > wpa_ie = (struct ieee_types_header *)vendor_ie; >- memcpy(gen_ie->ie_buffer + ie_len, >- wpa_ie, wpa_ie->len + 2); >- ie_len += wpa_ie->len + 2; >+ token_len = wpa_ie->len + 2; >+ if (token_len > >+ info->tail + info->tail_len - (u8 *)wpa_ie || >+ ie_len + token_len > IEEE_MAX_IE_SIZE) { >+ err = -EINVAL; >+ goto out; >+ } >+ memcpy(gen_ie->ie_buffer + ie_len, wpa_ie, token_len); >+ ie_len += token_len; > gen_ie->ie_length = cpu_to_le16(ie_len); > } > >@@ -362,13 +375,16 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv, > if (mwifiex_update_uap_custom_ie(priv, gen_ie, &rsn_idx, > NULL, NULL, > NULL, NULL)) { >- kfree(gen_ie); >- return -1; >+ err = -EINVAL; >+ goto out; > } > priv->rsn_idx = rsn_idx; > } > >+ out: > kfree(gen_ie); >+ if (err) >+ return err; > } > > return mwifiex_set_mgmt_beacon_data_ies(priv, info); >diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c >index 45c5b3450cf5..6d50ecc18839 100644 >--- a/drivers/net/wireless/mwifiex/scan.c >+++ b/drivers/net/wireless/mwifiex/scan.c >@@ -1171,6 +1171,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, > } > switch (element_id) { > case WLAN_EID_SSID: >+ if (element_len > IEEE80211_MAX_SSID_LEN) >+ return -EINVAL; > bss_entry->ssid.ssid_len = element_len; > memcpy(bss_entry->ssid.ssid, (current_ptr + 2), > element_len); >@@ -1180,6 +1182,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, > break; > > case WLAN_EID_SUPP_RATES: >+ if (element_len > MWIFIEX_SUPPORTED_RATES) >+ return -EINVAL; > memcpy(bss_entry->data_rates, current_ptr + 2, > element_len); > memcpy(bss_entry->supported_rates, current_ptr + 2, >@@ -1189,6 +1193,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, > break; > > case WLAN_EID_FH_PARAMS: >+ if (element_len + 2 < sizeof(*fh_param_set)) >+ return -EINVAL; > fh_param_set = > (struct ieee_types_fh_param_set *) current_ptr; > memcpy(&bss_entry->phy_param_set.fh_param_set, >@@ -1197,6 +1203,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, > break; > > case WLAN_EID_DS_PARAMS: >+ if (element_len + 2 < sizeof(*ds_param_set)) >+ return -EINVAL; > ds_param_set = > (struct ieee_types_ds_param_set *) current_ptr; > >@@ -1208,6 +1216,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, > break; > > case WLAN_EID_CF_PARAMS: >+ if (element_len + 2 < sizeof(*cf_param_set)) >+ return -EINVAL; > cf_param_set = > (struct ieee_types_cf_param_set *) current_ptr; > memcpy(&bss_entry->ss_param_set.cf_param_set, >@@ -1216,6 +1226,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, > break; > > case WLAN_EID_IBSS_PARAMS: >+ if (element_len + 2 < sizeof(*ibss_param_set)) >+ return -EINVAL; > ibss_param_set = > (struct ieee_types_ibss_param_set *) > current_ptr; >@@ -1225,10 +1237,14 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, > break; > > case WLAN_EID_ERP_INFO: >+ if (!element_len) >+ return -EINVAL; > bss_entry->erp_flags = *(current_ptr + 2); > break; > > case WLAN_EID_PWR_CONSTRAINT: >+ if (!element_len) >+ return -EINVAL; > bss_entry->local_constraint = *(current_ptr + 2); > bss_entry->sensed_11h = true; > break; >@@ -1268,6 +1284,9 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, > break; > > case WLAN_EID_VENDOR_SPECIFIC: >+ if (element_len + 2 < sizeof(vendor_ie->vend_hdr)) >+ return -EINVAL; >+ > vendor_ie = (struct ieee_types_vendor_specific *) > current_ptr; > >diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c >index 6b9737d392e2..5b6e0e951a85 100644 >--- a/drivers/parport/parport_pc.c >+++ b/drivers/parport/parport_pc.c >@@ -1377,7 +1377,7 @@ static struct superio_struct *find_superio(struct parport *p) > { > int i; > for (i = 0; i < NR_SUPERIOS; i++) >- if (superios[i].io != p->base) >+ if (superios[i].io == p->base) > return &superios[i]; > return NULL; > } >diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7778.c b/drivers/pinctrl/sh-pfc/pfc-r8a7778.c >index c7d610d1f3ef..da13a48065cd 100644 >--- a/drivers/pinctrl/sh-pfc/pfc-r8a7778.c >+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7778.c >@@ -1265,8 +1265,8 @@ static const struct sh_pfc_pin pinmux_pins[] = { > > /* Pins not associated with a GPIO port */ > SH_PFC_PIN_NAMED(3, 20, C20), >- SH_PFC_PIN_NAMED(20, 1, T1), >- SH_PFC_PIN_NAMED(25, 2, Y2), >+ SH_PFC_PIN_NAMED(1, 20, A20), >+ SH_PFC_PIN_NAMED(2, 25, B25), > }; > > /* - macro */ >@@ -1401,7 +1401,7 @@ HSPI_PFC_DAT(hspi1_a, HSPI_CLK1_A, HSPI_CS1_A, > HSPI_RX1_A, HSPI_TX1_A); > > HSPI_PFC_PIN(hspi1_b, RCAR_GP_PIN(0, 27), RCAR_GP_PIN(0, 26), >- PIN_NUMBER(20, 1), PIN_NUMBER(25, 2)); >+ PIN_NUMBER(1, 20), PIN_NUMBER(2, 25)); > HSPI_PFC_DAT(hspi1_b, HSPI_CLK1_B, HSPI_CS1_B, > HSPI_RX1_B, HSPI_TX1_B); > >diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c >index 601a349f9cab..642f94ae39a3 100644 >--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c >+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c >@@ -4433,7 +4433,7 @@ static const char * const scifb2_groups[] = { > "scifb2_data_b", > "scifb2_clk_b", > "scifb2_ctrl_b", >- "scifb0_data_c", >+ "scifb2_data_c", > "scifb2_clk_c", > "scifb2_data_d", > }; >diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c >index 29b7c79915f6..b5743b701ec6 100644 >--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c >+++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c >@@ -2899,7 +2899,8 @@ static const char * const fsic_groups[] = { > "fsic_sclk_out", > "fsic_data_in", > "fsic_data_out", >- "fsic_spdif", >+ "fsic_spdif_0", >+ "fsic_spdif_1", > }; > > static const char * const fsid_groups[] = { >diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c >index 0d88a82ab2a2..544ea6ed465e 100644 >--- a/drivers/regulator/wm831x-dcdc.c >+++ b/drivers/regulator/wm831x-dcdc.c >@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev) > } > > /* Current limit options */ >-static u16 wm831x_dcdc_ilim[] = { >- 125, 250, 375, 500, 625, 750, 875, 1000 >+static const unsigned int wm831x_dcdc_ilim[] = { >+ 125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000 > }; > > static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev, >diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c >index 0916089c7c3e..0302626bee60 100644 >--- a/drivers/rtc/rtc-88pm80x.c >+++ b/drivers/rtc/rtc-88pm80x.c >@@ -116,12 +116,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm) > unsigned char buf[4]; > unsigned long ticks, base, data; > regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4); >- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]); > > /* load 32-bit read-only counter */ > regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4); >- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > ticks = base + data; > dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", > base, data, ticks); >@@ -144,7 +146,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm) > > /* load 32-bit read-only counter */ > regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4); >- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > base = ticks - data; > dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", > base, data, ticks); >@@ -165,11 +168,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) > int ret; > > regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4); >- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]); > > regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4); >- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > ticks = base + data; > dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", > base, data, ticks); >@@ -192,12 +197,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm) > regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0); > > regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4); >- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]); > > /* load 32-bit read-only counter */ > regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4); >- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > ticks = base + data; > dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", > base, data, ticks); >diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c >index 0c6add1a38dc..bb07a9eb0923 100644 >--- a/drivers/rtc/rtc-88pm860x.c >+++ b/drivers/rtc/rtc-88pm860x.c >@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm) > pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf); > dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1], > buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]); >- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7]; >+ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) | >+ (buf[5] << 8) | buf[7]; > > /* load 32-bit read-only counter */ > pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf); >- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > ticks = base + data; > dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", > base, data, ticks); >@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm) > > /* load 32-bit read-only counter */ > pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf); >- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > base = ticks - data; > dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", > base, data, ticks); >@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) > pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf); > dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1], > buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]); >- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7]; >+ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) | >+ (buf[5] << 8) | buf[7]; > > pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf); >- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > ticks = base + data; > dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", > base, data, ticks); >@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm) > pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf); > dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1], > buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]); >- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7]; >+ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) | >+ (buf[5] << 8) | buf[7]; > > /* load 32-bit read-only counter */ > pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf); >- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > ticks = base + data; > dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", > base, data, ticks); >diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c >index a4888dbca2e1..3215869fedbc 100644 >--- a/drivers/rtc/rtc-ds1672.c >+++ b/drivers/rtc/rtc-ds1672.c >@@ -60,7 +60,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm) > "%s: raw read data - counters=%02x,%02x,%02x,%02x\n", > __func__, buf[0], buf[1], buf[2], buf[3]); > >- time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; >+ time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | >+ (buf[1] << 8) | buf[0]; > > rtc_time_to_tm(time, tm); > >diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c >index 197699f358c7..f72459e4fce8 100644 >--- a/drivers/rtc/rtc-pm8xxx.c >+++ b/drivers/rtc/rtc-pm8xxx.c >@@ -175,7 +175,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm) > } > } > >- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24); >+ secs = value[0] | (value[1] << 8) | (value[2] << 16) | >+ ((unsigned long)value[3] << 24); > > rtc_time_to_tm(secs, tm); > >@@ -253,7 +254,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm) > return rc; > } > >- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24); >+ secs = value[0] | (value[1] << 8) | (value[2] << 16) | >+ ((unsigned long)value[3] << 24); > > rtc_time_to_tm(secs, &alarm->time); > >diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/kvm/virtio_ccw.c >index bf6cab931472..85d1ced4ab0e 100644 >--- a/drivers/s390/kvm/virtio_ccw.c >+++ b/drivers/s390/kvm/virtio_ccw.c >@@ -258,6 +258,8 @@ static void virtio_ccw_drop_indicators(struct virtio_ccw_device *vcdev) > { > struct virtio_ccw_vq_info *info; > >+ if (!vcdev->airq_info) >+ return; > list_for_each_entry(info, &vcdev->virtqueues, node) > drop_airq_indicator(info->vq, vcdev->airq_info); > } >@@ -386,7 +388,7 @@ static int virtio_ccw_read_vq_conf(struct virtio_ccw_device *vcdev, > ccw->count = sizeof(struct vq_config_block); > ccw->cda = (__u32)(unsigned long)(vcdev->config_block); > ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_VQ_CONF); >- return vcdev->config_block->num; >+ return vcdev->config_block->num ?: -ENOENT; > } > > static void virtio_ccw_del_vq(struct virtqueue *vq, struct ccw1 *ccw) >diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c >index b8d67f9f9077..b756d671adae 100644 >--- a/drivers/scsi/virtio_scsi.c >+++ b/drivers/scsi/virtio_scsi.c >@@ -631,7 +631,6 @@ static int virtscsi_device_reset(struct scsi_cmnd *sc) > return FAILED; > > memset(cmd, 0, sizeof(*cmd)); >- cmd->sc = sc; > cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){ > .type = VIRTIO_SCSI_T_TMF, > .subtype = VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET, >@@ -654,7 +653,6 @@ static int virtscsi_abort(struct scsi_cmnd *sc) > return FAILED; > > memset(cmd, 0, sizeof(*cmd)); >- cmd->sc = sc; > cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){ > .type = VIRTIO_SCSI_T_TMF, > .subtype = VIRTIO_SCSI_T_TMF_ABORT_TASK, >diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c >index fbca97248f37..031fbd59876b 100644 >--- a/drivers/staging/android/ashmem.c >+++ b/drivers/staging/android/ashmem.c >@@ -158,19 +158,15 @@ static inline void lru_del(struct ashmem_range *range) > * @end: The ending page (inclusive) > * > * This function is protected by ashmem_mutex. >- * >- * Return: 0 if successful, or -ENOMEM if there is an error > */ >-static int range_alloc(struct ashmem_area *asma, >- struct ashmem_range *prev_range, unsigned int purged, >- size_t start, size_t end) >+static void range_alloc(struct ashmem_area *asma, >+ struct ashmem_range *prev_range, unsigned int purged, >+ size_t start, size_t end, >+ struct ashmem_range **new_range) > { >- struct ashmem_range *range; >- >- range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL); >- if (unlikely(!range)) >- return -ENOMEM; >+ struct ashmem_range *range = *new_range; > >+ *new_range = NULL; > range->asma = asma; > range->pgstart = start; > range->pgend = end; >@@ -180,8 +176,6 @@ static int range_alloc(struct ashmem_area *asma, > > if (range_on_lru(range)) > lru_add(range); >- >- return 0; > } > > /** >@@ -576,7 +570,8 @@ static int get_name(struct ashmem_area *asma, void __user *name) > * > * Caller must hold ashmem_mutex. > */ >-static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend) >+static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend, >+ struct ashmem_range **new_range) > { > struct ashmem_range *range, *next; > int ret = ASHMEM_NOT_PURGED; >@@ -628,7 +623,7 @@ static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend) > * second half and adjust the first chunk's endpoint. > */ > range_alloc(asma, range, range->purged, >- pgend + 1, range->pgend); >+ pgend + 1, range->pgend, new_range); > range_shrink(range, range->pgstart, pgstart - 1); > break; > } >@@ -642,7 +637,8 @@ static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend) > * > * Caller must hold ashmem_mutex. > */ >-static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend) >+static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend, >+ struct ashmem_range **new_range) > { > struct ashmem_range *range, *next; > unsigned int purged = ASHMEM_NOT_PURGED; >@@ -668,7 +664,8 @@ static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend) > } > } > >- return range_alloc(asma, range, purged, pgstart, pgend); >+ range_alloc(asma, range, purged, pgstart, pgend, new_range); >+ return 0; > } > > /* >@@ -701,10 +698,17 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, > struct ashmem_pin pin; > size_t pgstart, pgend; > int ret = -EINVAL; >+ struct ashmem_range *range = NULL; > > if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) > return -EFAULT; > >+ if (cmd == ASHMEM_PIN || cmd == ASHMEM_UNPIN) { >+ range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL); >+ if (!range) >+ return -ENOMEM; >+ } >+ > mutex_lock(&ashmem_mutex); > > if (unlikely(!asma->file)) >@@ -728,10 +732,10 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, > > switch (cmd) { > case ASHMEM_PIN: >- ret = ashmem_pin(asma, pgstart, pgend); >+ ret = ashmem_pin(asma, pgstart, pgend, &range); > break; > case ASHMEM_UNPIN: >- ret = ashmem_unpin(asma, pgstart, pgend); >+ ret = ashmem_unpin(asma, pgstart, pgend, &range); > break; > case ASHMEM_GET_PIN_STATUS: > ret = ashmem_get_pin_status(asma, pgstart, pgend); >@@ -740,6 +744,8 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, > > out_unlock: > mutex_unlock(&ashmem_mutex); >+ if (range) >+ kmem_cache_free(ashmem_range_cachep, range); > > return ret; > } >diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c >index 892b91054914..06fbf0b0a3cb 100644 >--- a/drivers/staging/android/binder.c >+++ b/drivers/staging/android/binder.c >@@ -473,7 +473,7 @@ static void binder_insert_free_buffer(struct binder_proc *proc, > new_buffer_size = binder_buffer_size(proc, new_buffer); > > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%d: add free buffer, size %zd, at %p\n", >+ "%d: add free buffer, size %zd, at %pK\n", > proc->pid, new_buffer_size, new_buffer); > > while (*p) { >@@ -552,7 +552,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, > struct mm_struct *mm; > > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%d: %s pages %p-%p\n", proc->pid, >+ "%d: %s pages %pK-%pK\n", proc->pid, > allocate ? "allocate" : "free", start, end); > > if (end <= start) >@@ -593,7 +593,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, > BUG_ON(*page); > *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); > if (*page == NULL) { >- pr_err("%d: binder_alloc_buf failed for page at %p\n", >+ pr_err("%d: binder_alloc_buf failed for page at %pK\n", > proc->pid, page_addr); > goto err_alloc_page_failed; > } >@@ -602,7 +602,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, > page_array_ptr = page; > ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); > if (ret) { >- pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", >+ pr_err("%d: binder_alloc_buf failed to map page at %pK in kernel\n", > proc->pid, page_addr); > goto err_map_kernel_failed; > } >@@ -706,7 +706,7 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, > } > > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", >+ "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n", > proc->pid, size, buffer, buffer_size); > > has_page_addr = >@@ -736,7 +736,7 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, > binder_insert_free_buffer(proc, new_buffer); > } > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%d: binder_alloc_buf size %zd got %p\n", >+ "%d: binder_alloc_buf size %zd got %pK\n", > proc->pid, size, buffer); > buffer->data_size = data_size; > buffer->offsets_size = offsets_size; >@@ -776,7 +776,7 @@ static void binder_delete_free_buffer(struct binder_proc *proc, > if (buffer_end_page(prev) == buffer_end_page(buffer)) > free_page_end = 0; > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%d: merge free, buffer %p share page with %p\n", >+ "%d: merge free, buffer %pK share page with %pK\n", > proc->pid, buffer, prev); > } > >@@ -789,14 +789,14 @@ static void binder_delete_free_buffer(struct binder_proc *proc, > buffer_start_page(buffer)) > free_page_start = 0; > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%d: merge free, buffer %p share page with %p\n", >+ "%d: merge free, buffer %pK share page with %pK\n", > proc->pid, buffer, prev); > } > } > list_del(&buffer->entry); > if (free_page_start || free_page_end) { > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%d: merge free, buffer %p do not share page%s%s with %p or %p\n", >+ "%d: merge free, buffer %pK do not share page%s%s with %pK or %pK\n", > proc->pid, buffer, free_page_start ? "" : " end", > free_page_end ? "" : " start", prev, next); > binder_update_page_range(proc, 0, free_page_start ? >@@ -817,7 +817,7 @@ static void binder_free_buf(struct binder_proc *proc, > ALIGN(buffer->offsets_size, sizeof(void *)); > > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%d: binder_free_buf %p size %zd buffer_size %zd\n", >+ "%d: binder_free_buf %pK size %zd buffer_size %zd\n", > proc->pid, buffer, size, buffer_size); > > BUG_ON(buffer->free); >@@ -2825,7 +2825,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) > #ifdef CONFIG_CPU_CACHE_VIPT > if (cache_is_vipt_aliasing()) { > while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { >- pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); >+ pr_info("binder_mmap: %d %lx-%lx maps %pK bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); > vma->vm_start += PAGE_SIZE; > } > } >@@ -3083,7 +3083,7 @@ static void binder_deferred_release(struct binder_proc *proc) > > page_addr = proc->buffer + i * PAGE_SIZE; > binder_debug(BINDER_DEBUG_BUFFER_ALLOC, >- "%s: %d: page %d at %p not freed\n", >+ "%s: %d: page %d at %pK not freed\n", > __func__, proc->pid, i, page_addr); > unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); > __free_page(proc->pages[i]); >@@ -3184,7 +3184,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix, > static void print_binder_buffer(struct seq_file *m, const char *prefix, > struct binder_buffer *buffer) > { >- seq_printf(m, "%s %d: %p size %zd:%zd %s\n", >+ seq_printf(m, "%s %d: %pK size %zd:%zd %s\n", > prefix, buffer->debug_id, buffer->data, > buffer->data_size, buffer->offsets_size, > buffer->transaction ? "active" : "delivered"); >@@ -3287,7 +3287,7 @@ static void print_binder_node(struct seq_file *m, struct binder_node *node) > > static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) > { >- seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", >+ seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %pK\n", > ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", > ref->node->debug_id, ref->strong, ref->weak, ref->death); > } >diff --git a/drivers/staging/iio/addac/adt7316.c b/drivers/staging/iio/addac/adt7316.c >index 5f1770e6f6c3..f548c1cc0022 100644 >--- a/drivers/staging/iio/addac/adt7316.c >+++ b/drivers/staging/iio/addac/adt7316.c >@@ -47,6 +47,8 @@ > #define ADT7516_MSB_AIN3 0xA > #define ADT7516_MSB_AIN4 0xB > #define ADT7316_DA_DATA_BASE 0x10 >+#define ADT7316_DA_10_BIT_LSB_SHIFT 6 >+#define ADT7316_DA_12_BIT_LSB_SHIFT 4 > #define ADT7316_DA_MSB_DATA_REGS 4 > #define ADT7316_LSB_DAC_A 0x10 > #define ADT7316_MSB_DAC_A 0x11 >@@ -59,8 +61,8 @@ > #define ADT7316_CONFIG1 0x18 > #define ADT7316_CONFIG2 0x19 > #define ADT7316_CONFIG3 0x1A >-#define ADT7316_LDAC_CONFIG 0x1B >-#define ADT7316_DAC_CONFIG 0x1C >+#define ADT7316_DAC_CONFIG 0x1B >+#define ADT7316_LDAC_CONFIG 0x1C > #define ADT7316_INT_MASK1 0x1D > #define ADT7316_INT_MASK2 0x1E > #define ADT7316_IN_TEMP_OFFSET 0x1F >@@ -117,7 +119,7 @@ > */ > #define ADT7316_ADCLK_22_5 0x1 > #define ADT7316_DA_HIGH_RESOLUTION 0x2 >-#define ADT7316_DA_EN_VIA_DAC_LDCA 0x4 >+#define ADT7316_DA_EN_VIA_DAC_LDCA 0x8 > #define ADT7516_AIN_IN_VREF 0x10 > #define ADT7316_EN_IN_TEMP_PROP_DACA 0x20 > #define ADT7316_EN_EX_TEMP_PROP_DACB 0x40 >@@ -635,9 +637,7 @@ static ssize_t adt7316_show_da_high_resolution(struct device *dev, > struct adt7316_chip_info *chip = iio_priv(dev_info); > > if (chip->config3 & ADT7316_DA_HIGH_RESOLUTION) { >- if (chip->id == ID_ADT7316 || chip->id == ID_ADT7516) >- return sprintf(buf, "1 (12 bits)\n"); >- else if (chip->id == ID_ADT7317 || chip->id == ID_ADT7517) >+ if (chip->id != ID_ADT7318 && chip->id != ID_ADT7519) > return sprintf(buf, "1 (10 bits)\n"); > } > >@@ -654,16 +654,12 @@ static ssize_t adt7316_store_da_high_resolution(struct device *dev, > u8 config3; > int ret; > >- chip->dac_bits = 8; >+ if (chip->id == ID_ADT7318 || chip->id == ID_ADT7519) >+ return -EPERM; > >- if (buf[0] == '1') { >- config3 = chip->config3 | ADT7316_DA_HIGH_RESOLUTION; >- if (chip->id == ID_ADT7316 || chip->id == ID_ADT7516) >- chip->dac_bits = 12; >- else if (chip->id == ID_ADT7317 || chip->id == ID_ADT7517) >- chip->dac_bits = 10; >- } else >- config3 = chip->config3 & (~ADT7316_DA_HIGH_RESOLUTION); >+ config3 = chip->config3 & (~ADT7316_DA_HIGH_RESOLUTION); >+ if (buf[0] == '1') >+ config3 |= ADT7316_DA_HIGH_RESOLUTION; > > ret = chip->bus.write(chip->bus.client, ADT7316_CONFIG3, config3); > if (ret) >@@ -1093,7 +1089,7 @@ static ssize_t adt7316_store_DAC_internal_Vref(struct device *dev, > ldac_config = chip->ldac_config & (~ADT7516_DAC_IN_VREF_MASK); > if (data & 0x1) > ldac_config |= ADT7516_DAC_AB_IN_VREF; >- else if (data & 0x2) >+ if (data & 0x2) > ldac_config |= ADT7516_DAC_CD_IN_VREF; > } else { > ret = kstrtou8(buf, 16, &data); >@@ -1415,7 +1411,7 @@ static IIO_DEVICE_ATTR(ex_analog_temp_offset, S_IRUGO | S_IWUSR, > static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, > int channel, char *buf) > { >- u16 data; >+ u16 data = 0; > u8 msb, lsb, offset; > int ret; > >@@ -1440,7 +1436,11 @@ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, > if (ret) > return -EIO; > >- data = (msb << offset) + (lsb & ((1 << offset) - 1)); >+ if (chip->dac_bits == 12) >+ data = lsb >> ADT7316_DA_12_BIT_LSB_SHIFT; >+ else if (chip->dac_bits == 10) >+ data = lsb >> ADT7316_DA_10_BIT_LSB_SHIFT; >+ data |= msb << offset; > > return sprintf(buf, "%d\n", data); > } >@@ -1448,7 +1448,7 @@ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, > static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip, > int channel, const char *buf, size_t len) > { >- u8 msb, lsb, offset; >+ u8 msb, lsb, lsb_reg, offset; > u16 data; > int ret; > >@@ -1466,9 +1466,13 @@ static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip, > return -EINVAL; > > if (chip->dac_bits > 8) { >- lsb = data & (1 << offset); >+ lsb = data & ((1 << offset) - 1); >+ if (chip->dac_bits == 12) >+ lsb_reg = lsb << ADT7316_DA_12_BIT_LSB_SHIFT; >+ else >+ lsb_reg = lsb << ADT7316_DA_10_BIT_LSB_SHIFT; > ret = chip->bus.write(chip->bus.client, >- ADT7316_DA_DATA_BASE + channel * 2, lsb); >+ ADT7316_DA_DATA_BASE + channel * 2, lsb_reg); > if (ret) > return -EIO; > } >@@ -2129,8 +2133,15 @@ int adt7316_probe(struct device *dev, struct adt7316_bus *bus, > else > return -ENODEV; > >+ if (chip->id == ID_ADT7316 || chip->id == ID_ADT7516) >+ chip->dac_bits = 12; >+ else if (chip->id == ID_ADT7317 || chip->id == ID_ADT7517) >+ chip->dac_bits = 10; >+ else >+ chip->dac_bits = 8; >+ > chip->ldac_pin = adt7316_platform_data[1]; >- if (chip->ldac_pin) { >+ if (!chip->ldac_pin) { > chip->config3 |= ADT7316_DA_EN_VIA_DAC_LDCA; > if ((chip->id & ID_FAMILY_MASK) == ID_ADT75XX) > chip->config1 |= ADT7516_SEL_AIN3; >diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c >index f7eab402cd4f..5322dde70448 100644 >--- a/drivers/target/iscsi/iscsi_target.c >+++ b/drivers/target/iscsi/iscsi_target.c >@@ -4201,9 +4201,9 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) > struct se_cmd *se_cmd = &cmd->se_cmd; > > if (se_cmd->se_tfo != NULL) { >- spin_lock(&se_cmd->t_state_lock); >+ spin_lock_irq(&se_cmd->t_state_lock); > se_cmd->transport_state |= CMD_T_FABRIC_STOP; >- spin_unlock(&se_cmd->t_state_lock); >+ spin_unlock_irq(&se_cmd->t_state_lock); > } > } > spin_unlock_bh(&conn->cmd_lock); >diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c >index 2c14842541dd..9d15fb5b038b 100644 >--- a/drivers/tty/ipwireless/hardware.c >+++ b/drivers/tty/ipwireless/hardware.c >@@ -1515,6 +1515,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw) > sizeof(struct ipw_setup_get_version_query_packet), > ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP, > TL_SETUP_SIGNO_GET_VERSION_QRY); >+ if (!ver_packet) >+ return; > ver_packet->header.length = sizeof(struct tl_setup_get_version_qry); > > /* >diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c >index 6ad273e68005..c8f6b57da60a 100644 >--- a/drivers/tty/serial/8250/8250_pci.c >+++ b/drivers/tty/serial/8250/8250_pci.c >@@ -2183,6 +2183,111 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = { > .setup = pci_default_setup, > .exit = pci_plx9050_exit, > }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, >+ { >+ .vendor = PCI_VENDOR_ID_ACCESIO, >+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM, >+ .subvendor = PCI_ANY_ID, >+ .subdevice = PCI_ANY_ID, >+ .setup = pci_pericom_setup, >+ }, > /* > * SBS Technologies, Inc., PMC-OCTALPRO 232 > */ >@@ -4943,10 +5048,10 @@ static struct pci_device_id serial_pci_tbl[] = { > */ > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7954 }, >@@ -4955,10 +5060,10 @@ static struct pci_device_id serial_pci_tbl[] = { > pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7954 }, >@@ -4967,10 +5072,10 @@ static struct pci_device_id serial_pci_tbl[] = { > pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7954 }, >@@ -4979,13 +5084,13 @@ static struct pci_device_id serial_pci_tbl[] = { > pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7951 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7954 }, >@@ -4994,16 +5099,16 @@ static struct pci_device_id serial_pci_tbl[] = { > pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7954 }, >@@ -5012,13 +5117,13 @@ static struct pci_device_id serial_pci_tbl[] = { > pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7954 }, >+ pbn_pericom_PI7C9X7952 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7958 }, >+ pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7958 }, >+ pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7958 }, >@@ -5027,19 +5132,19 @@ static struct pci_device_id serial_pci_tbl[] = { > pbn_pericom_PI7C9X7958 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7958 }, >+ pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7958 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7958 }, >+ pbn_pericom_PI7C9X7954 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, > pbn_pericom_PI7C9X7958 }, > { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM, > PCI_ANY_ID, PCI_ANY_ID, 0, 0, >- pbn_pericom_PI7C9X7958 }, >+ pbn_pericom_PI7C9X7954 }, > /* > * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke) > */ >diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c >index 3197872f307b..0052e4fe09a8 100644 >--- a/drivers/tty/serial/of_serial.c >+++ b/drivers/tty/serial/of_serial.c >@@ -93,6 +93,10 @@ static int of_platform_serial_setup(struct platform_device *ofdev, > if (of_property_read_u32(np, "reg-offset", &prop) == 0) > port->mapbase += prop; > >+ /* Compatibility with the deprecated pxa driver and 8250_pxa drivers. */ >+ if (of_device_is_compatible(np, "mrvl,mmp-uart")) >+ port->regshift = 2; >+ > /* Check for registers offset within the devices address range */ > if (of_property_read_u32(np, "reg-shift", &prop) == 0) > port->regshift = prop; >diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c >index a81f9dd7ee97..cd53568e6e3f 100644 >--- a/drivers/usb/class/cdc-wdm.c >+++ b/drivers/usb/class/cdc-wdm.c >@@ -1089,7 +1089,7 @@ static int wdm_post_reset(struct usb_interface *intf) > rv = recover_from_urb_loss(desc); > mutex_unlock(&desc->wlock); > mutex_unlock(&desc->rlock); >- return 0; >+ return rv; > } > > static struct usb_driver wdm_driver = { >diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c >index 3fd36d115f3a..b60dac48587c 100644 >--- a/drivers/usb/serial/cp210x.c >+++ b/drivers/usb/serial/cp210x.c >@@ -57,6 +57,7 @@ static const struct usb_device_id id_table[] = { > { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ > { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ > { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ >+ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */ > { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ > { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ > { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ >diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c >index d9d4175e01df..aa2bec8687fd 100644 >--- a/drivers/usb/serial/ftdi_sio.c >+++ b/drivers/usb/serial/ftdi_sio.c >@@ -1033,6 +1033,8 @@ static const struct usb_device_id id_table_combined[] = { > { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, > { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, > { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) }, >+ /* EZPrototypes devices */ >+ { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) }, > { } /* Terminating entry */ > }; > >diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h >index 69db398b352e..ecc2424eb8e0 100644 >--- a/drivers/usb/serial/ftdi_sio_ids.h >+++ b/drivers/usb/serial/ftdi_sio_ids.h >@@ -1307,6 +1307,12 @@ > #define IONICS_VID 0x1c0c > #define IONICS_PLUGCOMPUTER_PID 0x0102 > >+/* >+ * EZPrototypes (PID reseller) >+ */ >+#define EZPROTOTYPES_VID 0x1c40 >+#define HJELMSLUND_USB485_ISO_PID 0x0477 >+ > /* > * Dresden Elektronik Sensor Terminal Board > */ >diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c >index cc6513a176b0..3a69af6f0718 100644 >--- a/drivers/xen/cpu_hotplug.c >+++ b/drivers/xen/cpu_hotplug.c >@@ -47,7 +47,7 @@ static int vcpu_online(unsigned int cpu) > } > static void vcpu_hotplug(unsigned int cpu) > { >- if (!cpu_possible(cpu)) >+ if (cpu >= nr_cpu_ids || !cpu_possible(cpu)) > return; > > switch (vcpu_online(cpu)) { >diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c >index 6bd06f9d737d..3126bcafb555 100644 >--- a/drivers/xen/xenbus/xenbus_dev_frontend.c >+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c >@@ -533,7 +533,7 @@ static int xenbus_file_open(struct inode *inode, struct file *filp) > if (xen_store_evtchn == 0) > return -ENOENT; > >- nonseekable_open(inode, filp); >+ stream_open(inode, filp); > > u = kzalloc(sizeof(*u), GFP_KERNEL); > if (u == NULL) >diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h >index b83ebfbf3fdc..92e67bc5b211 100644 >--- a/fs/9p/v9fs_vfs.h >+++ b/fs/9p/v9fs_vfs.h >@@ -40,6 +40,9 @@ > */ > #define P9_LOCK_TIMEOUT (30*HZ) > >+/* flags for v9fs_stat2inode() & v9fs_stat2inode_dotl() */ >+#define V9FS_STAT2INODE_KEEP_ISIZE 1 >+ > extern struct file_system_type v9fs_fs_type; > extern const struct address_space_operations v9fs_addr_operations; > extern const struct file_operations v9fs_file_operations; >@@ -61,8 +64,10 @@ int v9fs_init_inode(struct v9fs_session_info *v9ses, > struct inode *inode, umode_t mode, dev_t); > void v9fs_evict_inode(struct inode *inode); > ino_t v9fs_qid2ino(struct p9_qid *qid); >-void v9fs_stat2inode(struct p9_wstat *, struct inode *, struct super_block *); >-void v9fs_stat2inode_dotl(struct p9_stat_dotl *, struct inode *); >+void v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, >+ struct super_block *sb, unsigned int flags); >+void v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode, >+ unsigned int flags); > int v9fs_dir_release(struct inode *inode, struct file *filp); > int v9fs_file_open(struct inode *inode, struct file *file); > void v9fs_inode2stat(struct inode *inode, struct p9_wstat *stat); >@@ -87,4 +92,18 @@ static inline void v9fs_invalidate_inode_attr(struct inode *inode) > } > > int v9fs_open_to_dotl_flags(int flags); >+ >+static inline void v9fs_i_size_write(struct inode *inode, loff_t i_size) >+{ >+ /* >+ * 32-bit need the lock, concurrent updates could break the >+ * sequences and make i_size_read() loop forever. >+ * 64-bit updates are atomic and can skip the locking. >+ */ >+ if (sizeof(i_size) > sizeof(long)) >+ spin_lock(&inode->i_lock); >+ i_size_write(inode, i_size); >+ if (sizeof(i_size) > sizeof(long)) >+ spin_unlock(&inode->i_lock); >+} > #endif >diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c >index 92580bd45474..71c895bb2a60 100644 >--- a/fs/9p/vfs_file.c >+++ b/fs/9p/vfs_file.c >@@ -484,7 +484,11 @@ v9fs_file_write_internal(struct inode *inode, struct p9_fid *fid, > i_size = i_size_read(inode); > if (*offset > i_size) { > inode_add_bytes(inode, *offset - i_size); >- i_size_write(inode, *offset); >+ /* >+ * Need to serialize against i_size_write() in >+ * v9fs_stat2inode() >+ */ >+ v9fs_i_size_write(inode, *offset); > } > } > if (n < 0) >diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c >index e1f366fa59a2..7a9a71d487bd 100644 >--- a/fs/9p/vfs_inode.c >+++ b/fs/9p/vfs_inode.c >@@ -538,7 +538,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, > if (retval) > goto error; > >- v9fs_stat2inode(st, inode, sb); >+ v9fs_stat2inode(st, inode, sb, 0); > v9fs_cache_inode_get_cookie(inode); > unlock_new_inode(inode); > return inode; >@@ -1074,7 +1074,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, > if (IS_ERR(st)) > return PTR_ERR(st); > >- v9fs_stat2inode(st, dentry->d_inode, dentry->d_inode->i_sb); >+ v9fs_stat2inode(st, dentry->d_inode, dentry->d_inode->i_sb, 0); > generic_fillattr(dentry->d_inode, stat); > > p9stat_free(st); >@@ -1152,12 +1152,13 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr) > * @stat: Plan 9 metadata (mistat) structure > * @inode: inode to populate > * @sb: superblock of filesystem >+ * @flags: control flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) > * > */ > > void > v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, >- struct super_block *sb) >+ struct super_block *sb, unsigned int flags) > { > umode_t mode; > char ext[32]; >@@ -1198,10 +1199,11 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, > mode = p9mode2perm(v9ses, stat); > mode |= inode->i_mode & ~S_IALLUGO; > inode->i_mode = mode; >- i_size_write(inode, stat->length); > >+ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE)) >+ v9fs_i_size_write(inode, stat->length); > /* not real number of blocks, but 512 byte ones ... */ >- inode->i_blocks = (i_size_read(inode) + 512 - 1) >> 9; >+ inode->i_blocks = (stat->length + 512 - 1) >> 9; > v9inode->cache_validity &= ~V9FS_INO_INVALID_ATTR; > } > >@@ -1465,9 +1467,9 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode) > { > int umode; > dev_t rdev; >- loff_t i_size; > struct p9_wstat *st; > struct v9fs_session_info *v9ses; >+ unsigned int flags; > > v9ses = v9fs_inode2v9ses(inode); > st = p9_client_stat(fid); >@@ -1480,16 +1482,13 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode) > if ((inode->i_mode & S_IFMT) != (umode & S_IFMT)) > goto out; > >- spin_lock(&inode->i_lock); > /* > * We don't want to refresh inode->i_size, > * because we may have cached data > */ >- i_size = inode->i_size; >- v9fs_stat2inode(st, inode, inode->i_sb); >- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) >- inode->i_size = i_size; >- spin_unlock(&inode->i_lock); >+ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ? >+ V9FS_STAT2INODE_KEEP_ISIZE : 0; >+ v9fs_stat2inode(st, inode, inode->i_sb, flags); > out: > p9stat_free(st); > kfree(st); >diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c >index 84b611ff4b65..357fa24e35ef 100644 >--- a/fs/9p/vfs_inode_dotl.c >+++ b/fs/9p/vfs_inode_dotl.c >@@ -143,7 +143,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, > if (retval) > goto error; > >- v9fs_stat2inode_dotl(st, inode); >+ v9fs_stat2inode_dotl(st, inode, 0); > v9fs_cache_inode_get_cookie(inode); > retval = v9fs_get_acl(inode, fid); > if (retval) >@@ -498,7 +498,7 @@ v9fs_vfs_getattr_dotl(struct vfsmount *mnt, struct dentry *dentry, > if (IS_ERR(st)) > return PTR_ERR(st); > >- v9fs_stat2inode_dotl(st, dentry->d_inode); >+ v9fs_stat2inode_dotl(st, dentry->d_inode, 0); > generic_fillattr(dentry->d_inode, stat); > /* Change block size to what the server returned */ > stat->blksize = st->st_blksize; >@@ -609,11 +609,13 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr) > * v9fs_stat2inode_dotl - populate an inode structure with stat info > * @stat: stat structure > * @inode: inode to populate >+ * @flags: ctrl flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) > * > */ > > void >-v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) >+v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode, >+ unsigned int flags) > { > umode_t mode; > struct v9fs_inode *v9inode = V9FS_I(inode); >@@ -633,7 +635,8 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) > mode |= inode->i_mode & ~S_IALLUGO; > inode->i_mode = mode; > >- i_size_write(inode, stat->st_size); >+ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE)) >+ v9fs_i_size_write(inode, stat->st_size); > inode->i_blocks = stat->st_blocks; > } else { > if (stat->st_result_mask & P9_STATS_ATIME) { >@@ -663,8 +666,9 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) > } > if (stat->st_result_mask & P9_STATS_RDEV) > inode->i_rdev = new_decode_dev(stat->st_rdev); >- if (stat->st_result_mask & P9_STATS_SIZE) >- i_size_write(inode, stat->st_size); >+ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE) && >+ stat->st_result_mask & P9_STATS_SIZE) >+ v9fs_i_size_write(inode, stat->st_size); > if (stat->st_result_mask & P9_STATS_BLOCKS) > inode->i_blocks = stat->st_blocks; > } >@@ -946,9 +950,9 @@ v9fs_vfs_follow_link_dotl(struct dentry *dentry, struct nameidata *nd) > > int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode) > { >- loff_t i_size; > struct p9_stat_dotl *st; > struct v9fs_session_info *v9ses; >+ unsigned int flags; > > v9ses = v9fs_inode2v9ses(inode); > st = p9_client_getattr_dotl(fid, P9_STATS_ALL); >@@ -960,16 +964,13 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode) > if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT)) > goto out; > >- spin_lock(&inode->i_lock); > /* > * We don't want to refresh inode->i_size, > * because we may have cached data > */ >- i_size = inode->i_size; >- v9fs_stat2inode_dotl(st, inode); >- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) >- inode->i_size = i_size; >- spin_unlock(&inode->i_lock); >+ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ? >+ V9FS_STAT2INODE_KEEP_ISIZE : 0; >+ v9fs_stat2inode_dotl(st, inode, flags); > out: > kfree(st); > return 0; >diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c >index 0afd0382822b..975c3c1eb000 100644 >--- a/fs/9p/vfs_super.c >+++ b/fs/9p/vfs_super.c >@@ -169,7 +169,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags, > goto release_sb; > } > root->d_inode->i_ino = v9fs_qid2ino(&st->qid); >- v9fs_stat2inode_dotl(st, root->d_inode); >+ v9fs_stat2inode_dotl(st, root->d_inode, 0); > kfree(st); > } else { > struct p9_wstat *st = NULL; >@@ -180,7 +180,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags, > } > > root->d_inode->i_ino = v9fs_qid2ino(&st->qid); >- v9fs_stat2inode(st, root->d_inode, sb); >+ v9fs_stat2inode(st, root->d_inode, sb, 0); > > p9stat_free(st); > kfree(st); >diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c >index e987c0d56fd1..604d31e85c82 100644 >--- a/fs/btrfs/extent_io.c >+++ b/fs/btrfs/extent_io.c >@@ -2936,11 +2936,11 @@ static int __do_readpage(struct extent_io_tree *tree, > */ > if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) && > prev_em_start && *prev_em_start != (u64)-1 && >- *prev_em_start != em->orig_start) >+ *prev_em_start != em->start) > force_bio_submit = true; > > if (prev_em_start) >- *prev_em_start = em->orig_start; >+ *prev_em_start = em->start; > > free_extent_map(em); > em = NULL; >diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c >index 8dddedcfa961..70edd60db654 100644 >--- a/fs/btrfs/scrub.c >+++ b/fs/btrfs/scrub.c >@@ -417,6 +417,7 @@ struct scrub_ctx *scrub_setup_ctx(struct btrfs_device *dev, int is_dev_replace) > sctx->pages_per_rd_bio = pages_per_rd_bio; > sctx->curr = -1; > sctx->dev_root = dev->dev_root; >+ INIT_LIST_HEAD(&sctx->csum_list); > for (i = 0; i < SCRUB_BIOS_PER_SCTX; ++i) { > struct scrub_bio *sbio; > >@@ -444,7 +445,6 @@ struct scrub_ctx *scrub_setup_ctx(struct btrfs_device *dev, int is_dev_replace) > atomic_set(&sctx->workers_pending, 0); > atomic_set(&sctx->cancel_req, 0); > sctx->csum_size = btrfs_super_csum_size(fs_info->super_copy); >- INIT_LIST_HEAD(&sctx->csum_list); > > spin_lock_init(&sctx->list_lock); > spin_lock_init(&sctx->stat_lock); >diff --git a/fs/cifs/file.c b/fs/cifs/file.c >index 50c5e3955786..4b8870f889e3 100644 >--- a/fs/cifs/file.c >+++ b/fs/cifs/file.c >@@ -2661,14 +2661,16 @@ cifs_strict_writev(struct kiocb *iocb, struct iov_iter *from) > * these pages but not on the region from pos to ppos+len-1. > */ > written = cifs_user_writev(iocb, from); >- if (written > 0 && CIFS_CACHE_READ(cinode)) { >+ if (CIFS_CACHE_READ(cinode)) { > /* >- * Windows 7 server can delay breaking level2 oplock if a write >- * request comes - break it on the client to prevent reading >- * an old data. >+ * We have read level caching and we have just sent a write >+ * request to the server thus making data in the cache stale. >+ * Zap the cache and set oplock/lease level to NONE to avoid >+ * reading stale data from the cache. All subsequent read >+ * operations will read new data from the server. > */ > cifs_zap_mapping(inode); >- cifs_dbg(FYI, "Set no oplock for inode=%p after a write operation\n", >+ cifs_dbg(FYI, "Set Oplock/Lease to NONE for inode=%p after write\n", > inode); > cinode->oplock = 0; > } >diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c >index ed976a94791c..1485ab8c2d65 100644 >--- a/fs/cifs/smb2misc.c >+++ b/fs/cifs/smb2misc.c >@@ -420,7 +420,6 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, > __u8 lease_state; > struct list_head *tmp; > struct cifsFileInfo *cfile; >- struct TCP_Server_Info *server = tcon->ses->server; > struct cifs_pending_open *open; > struct cifsInodeInfo *cinode; > int ack_req = le32_to_cpu(rsp->Flags & >@@ -440,13 +439,25 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, > cifs_dbg(FYI, "lease key match, lease break 0x%d\n", > le32_to_cpu(rsp->NewLeaseState)); > >- server->ops->set_oplock_level(cinode, lease_state, 0, NULL); >- > if (ack_req) > cfile->oplock_break_cancelled = false; > else > cfile->oplock_break_cancelled = true; > >+ set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags); >+ >+ /* >+ * Set or clear flags depending on the lease state being READ. >+ * HANDLE caching flag should be added when the client starts >+ * to defer closing remote file handles with HANDLE leases. >+ */ >+ if (lease_state & SMB2_LEASE_READ_CACHING_HE) >+ set_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, >+ &cinode->flags); >+ else >+ clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, >+ &cinode->flags); >+ > queue_work(cifsoplockd_wq, &cfile->oplock_break); > kfree(lw); > return true; >diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c >index 46bea6c44ec8..376ccd96127f 100644 >--- a/fs/cifs/smb2ops.c >+++ b/fs/cifs/smb2ops.c >@@ -961,6 +961,15 @@ smb2_downgrade_oplock(struct TCP_Server_Info *server, > server->ops->set_oplock_level(cinode, 0, 0, NULL); > } > >+static void >+smb21_downgrade_oplock(struct TCP_Server_Info *server, >+ struct cifsInodeInfo *cinode, bool set_level2) >+{ >+ server->ops->set_oplock_level(cinode, >+ set_level2 ? SMB2_LEASE_READ_CACHING_HE : >+ 0, 0, NULL); >+} >+ > static void > smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, > unsigned int epoch, bool *purge_cache) >@@ -1253,7 +1262,7 @@ struct smb_version_operations smb21_operations = { > .print_stats = smb2_print_stats, > .is_oplock_break = smb2_is_valid_oplock_break, > .handle_cancelled_mid = smb2_handle_cancelled_mid, >- .downgrade_oplock = smb2_downgrade_oplock, >+ .downgrade_oplock = smb21_downgrade_oplock, > .need_neg = smb2_need_neg, > .negotiate = smb2_negotiate, > .negotiate_wsize = smb2_negotiate_wsize, >@@ -1331,7 +1340,7 @@ struct smb_version_operations smb30_operations = { > .dump_share_caps = smb2_dump_share_caps, > .is_oplock_break = smb2_is_valid_oplock_break, > .handle_cancelled_mid = smb2_handle_cancelled_mid, >- .downgrade_oplock = smb2_downgrade_oplock, >+ .downgrade_oplock = smb21_downgrade_oplock, > .need_neg = smb2_need_neg, > .negotiate = smb2_negotiate, > .negotiate_wsize = smb2_negotiate_wsize, >diff --git a/fs/ext2/super.c b/fs/ext2/super.c >index 3750031cfa2f..ea8c31bb8bcd 100644 >--- a/fs/ext2/super.c >+++ b/fs/ext2/super.c >@@ -701,7 +701,8 @@ static loff_t ext2_max_size(int bits) > { > loff_t res = EXT2_NDIR_BLOCKS; > int meta_blocks; >- loff_t upper_limit; >+ unsigned int upper_limit; >+ unsigned int ppb = 1 << (bits-2); > > /* This is calculated to be the largest file size for a > * dense, file such that the total number of >@@ -715,24 +716,34 @@ static loff_t ext2_max_size(int bits) > /* total blocks in file system block size */ > upper_limit >>= (bits - 9); > >+ /* Compute how many blocks we can address by block tree */ >+ res += 1LL << (bits-2); >+ res += 1LL << (2*(bits-2)); >+ res += 1LL << (3*(bits-2)); >+ /* Does block tree limit file size? */ >+ if (res < upper_limit) >+ goto check_lfs; > >+ res = upper_limit; >+ /* How many metadata blocks are needed for addressing upper_limit? */ >+ upper_limit -= EXT2_NDIR_BLOCKS; > /* indirect blocks */ > meta_blocks = 1; >+ upper_limit -= ppb; > /* double indirect blocks */ >- meta_blocks += 1 + (1LL << (bits-2)); >- /* tripple indirect blocks */ >- meta_blocks += 1 + (1LL << (bits-2)) + (1LL << (2*(bits-2))); >- >- upper_limit -= meta_blocks; >- upper_limit <<= bits; >- >- res += 1LL << (bits-2); >- res += 1LL << (2*(bits-2)); >- res += 1LL << (3*(bits-2)); >+ if (upper_limit < ppb * ppb) { >+ meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb); >+ res -= meta_blocks; >+ goto check_lfs; >+ } >+ meta_blocks += 1 + ppb; >+ upper_limit -= ppb * ppb; >+ /* tripple indirect blocks for the rest */ >+ meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb) + >+ DIV_ROUND_UP(upper_limit, ppb*ppb); >+ res -= meta_blocks; >+check_lfs: > res <<= bits; >- if (res > upper_limit) >- res = upper_limit; >- > if (res > MAX_LFS_FILESIZE) > res = MAX_LFS_FILESIZE; > >diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h >index aa2da07ee7fb..550a1bfe98d1 100644 >--- a/fs/ext4/ext4.h >+++ b/fs/ext4/ext4.h >@@ -405,6 +405,9 @@ struct flex_groups { > /* Flags that are appropriate for non-directories/regular files. */ > #define EXT4_OTHER_FLMASK (EXT4_NODUMP_FL | EXT4_NOATIME_FL) > >+/* The only flags that should be swapped */ >+#define EXT4_FL_SHOULD_SWAP (EXT4_HUGE_FILE_FL | EXT4_EXTENTS_FL) >+ > /* Mask out flags that are inappropriate for the given type of inode. */ > static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags) > { >diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c >index a77035ec6a4d..99bfe22f2a71 100644 >--- a/fs/ext4/ioctl.c >+++ b/fs/ext4/ioctl.c >@@ -14,6 +14,7 @@ > #include > #include > #include >+#include > #include > #include "ext4_jbd2.h" > #include "ext4.h" >@@ -60,20 +61,21 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2) > loff_t isize; > struct ext4_inode_info *ei1; > struct ext4_inode_info *ei2; >+ unsigned long tmp; > > ei1 = EXT4_I(inode1); > ei2 = EXT4_I(inode2); > > memswap(&inode1->i_version, &inode2->i_version, > sizeof(inode1->i_version)); >- memswap(&inode1->i_blocks, &inode2->i_blocks, >- sizeof(inode1->i_blocks)); >- memswap(&inode1->i_bytes, &inode2->i_bytes, sizeof(inode1->i_bytes)); > memswap(&inode1->i_atime, &inode2->i_atime, sizeof(inode1->i_atime)); > memswap(&inode1->i_mtime, &inode2->i_mtime, sizeof(inode1->i_mtime)); > > memswap(ei1->i_data, ei2->i_data, sizeof(ei1->i_data)); >- memswap(&ei1->i_flags, &ei2->i_flags, sizeof(ei1->i_flags)); >+ tmp = ei1->i_flags & EXT4_FL_SHOULD_SWAP; >+ ei1->i_flags = (ei2->i_flags & EXT4_FL_SHOULD_SWAP) | >+ (ei1->i_flags & ~EXT4_FL_SHOULD_SWAP); >+ ei2->i_flags = tmp | (ei2->i_flags & ~EXT4_FL_SHOULD_SWAP); > memswap(&ei1->i_disksize, &ei2->i_disksize, sizeof(ei1->i_disksize)); > ext4_es_remove_extent(inode1, 0, EXT_MAX_BLOCKS); > ext4_es_remove_extent(inode2, 0, EXT_MAX_BLOCKS); >@@ -117,15 +119,9 @@ static long swap_inode_boot_loader(struct super_block *sb, > struct inode *inode_bl; > struct ext4_inode_info *ei_bl; > struct ext4_sb_info *sbi = EXT4_SB(sb); >- >- if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) || >- IS_SWAPFILE(inode) || >- ext4_has_inline_data(inode)) >- return -EINVAL; >- >- if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) || >- !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN)) >- return -EPERM; >+ qsize_t size, size_bl, diff; >+ blkcnt_t blocks; >+ unsigned short bytes; > > inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL); > if (IS_ERR(inode_bl)) >@@ -139,6 +135,19 @@ static long swap_inode_boot_loader(struct super_block *sb, > * that only 1 swap_inode_boot_loader is running. */ > lock_two_nondirectories(inode, inode_bl); > >+ if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) || >+ IS_SWAPFILE(inode) || >+ ext4_has_inline_data(inode)) { >+ err = -EINVAL; >+ goto journal_err_out; >+ } >+ >+ if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) || >+ !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN)) { >+ err = -EPERM; >+ goto journal_err_out; >+ } >+ > /* Wait for all existing dio workers */ > ext4_inode_block_unlocked_dio(inode); > ext4_inode_block_unlocked_dio(inode_bl); >@@ -175,6 +184,11 @@ static long swap_inode_boot_loader(struct super_block *sb, > memset(ei_bl->i_data, 0, sizeof(ei_bl->i_data)); > } > >+ dquot_initialize(inode); >+ >+ size = (qsize_t)(inode->i_blocks) * (1 << 9) + inode->i_bytes; >+ size_bl = (qsize_t)(inode_bl->i_blocks) * (1 << 9) + inode_bl->i_bytes; >+ diff = size - size_bl; > swap_inode_data(inode, inode_bl); > > inode->i_ctime = inode_bl->i_ctime = ext4_current_time(inode); >@@ -190,24 +204,46 @@ static long swap_inode_boot_loader(struct super_block *sb, > > err = ext4_mark_inode_dirty(handle, inode); > if (err < 0) { >+ /* No need to update quota information. */ > ext4_warning(inode->i_sb, > "couldn't mark inode #%lu dirty (err %d)", > inode->i_ino, err); > /* Revert all changes: */ > swap_inode_data(inode, inode_bl); > ext4_mark_inode_dirty(handle, inode); >- } else { >- err = ext4_mark_inode_dirty(handle, inode_bl); >- if (err < 0) { >- ext4_warning(inode_bl->i_sb, >- "couldn't mark inode #%lu dirty (err %d)", >- inode_bl->i_ino, err); >- /* Revert all changes: */ >- swap_inode_data(inode, inode_bl); >- ext4_mark_inode_dirty(handle, inode); >- ext4_mark_inode_dirty(handle, inode_bl); >- } >+ goto err_out1; >+ } >+ >+ blocks = inode_bl->i_blocks; >+ bytes = inode_bl->i_bytes; >+ inode_bl->i_blocks = inode->i_blocks; >+ inode_bl->i_bytes = inode->i_bytes; >+ err = ext4_mark_inode_dirty(handle, inode_bl); >+ if (err < 0) { >+ /* No need to update quota information. */ >+ ext4_warning(inode_bl->i_sb, >+ "couldn't mark inode #%lu dirty (err %d)", >+ inode_bl->i_ino, err); >+ goto revert; > } >+ >+ /* Bootloader inode should not be counted into quota information. */ >+ if (diff > 0) >+ dquot_free_space(inode, diff); >+ else >+ err = dquot_alloc_space(inode, -1 * diff); >+ >+ if (err < 0) { >+revert: >+ /* Revert all changes: */ >+ inode_bl->i_blocks = blocks; >+ inode_bl->i_bytes = bytes; >+ swap_inode_data(inode, inode_bl); >+ ext4_mark_inode_dirty(handle, inode); >+ ext4_mark_inode_dirty(handle, inode_bl); >+ } >+ >+err_out1: > ext4_journal_stop(handle); > ext4_double_up_write_data_sem(inode, inode_bl); > >diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c >index b9d35d52889c..80c3f1ed1afa 100644 >--- a/fs/ext4/resize.c >+++ b/fs/ext4/resize.c >@@ -1931,7 +1931,8 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) > le16_to_cpu(es->s_reserved_gdt_blocks); > n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb); > n_blocks_count = (ext4_fsblk_t)n_group * >- EXT4_BLOCKS_PER_GROUP(sb); >+ EXT4_BLOCKS_PER_GROUP(sb) + >+ le32_to_cpu(es->s_first_data_block); > n_group--; /* set to last group number */ > } > >diff --git a/fs/fuse/file.c b/fs/fuse/file.c >index bc8f5de48fd9..69e471b042a6 100644 >--- a/fs/fuse/file.c >+++ b/fs/fuse/file.c >@@ -214,7 +214,9 @@ void fuse_finish_open(struct inode *inode, struct file *file) > file->f_op = &fuse_direct_io_file_operations; > if (!(ff->open_flags & FOPEN_KEEP_CACHE)) > invalidate_inode_pages2(inode->i_mapping); >- if (ff->open_flags & FOPEN_NONSEEKABLE) >+ if (ff->open_flags & FOPEN_STREAM) >+ stream_open(inode, file); >+ else if (ff->open_flags & FOPEN_NONSEEKABLE) > nonseekable_open(inode, file); > if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) { > struct fuse_inode *fi = get_fuse_inode(inode); >diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c >index 398565726b92..9e02c00cc223 100644 >--- a/fs/jbd2/transaction.c >+++ b/fs/jbd2/transaction.c >@@ -1479,14 +1479,21 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh) > /* However, if the buffer is still owned by a prior > * (committing) transaction, we can't drop it yet... */ > JBUFFER_TRACE(jh, "belongs to older transaction"); >- /* ... but we CAN drop it from the new transaction if we >- * have also modified it since the original commit. */ >+ /* ... but we CAN drop it from the new transaction through >+ * marking the buffer as freed and set j_next_transaction to >+ * the new transaction, so that not only the commit code >+ * knows it should clear dirty bits when it is done with the >+ * buffer, but also the buffer can be checkpointed only >+ * after the new transaction commits. */ > >- if (jh->b_next_transaction) { >- J_ASSERT(jh->b_next_transaction == transaction); >+ set_buffer_freed(bh); >+ >+ if (!jh->b_next_transaction) { > spin_lock(&journal->j_list_lock); >- jh->b_next_transaction = NULL; >+ jh->b_next_transaction = transaction; > spin_unlock(&journal->j_list_lock); >+ } else { >+ J_ASSERT(jh->b_next_transaction == transaction); > > /* > * only drop a reference if this transaction modified >diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c >index 7f9b6f799aa2..c5168c77479a 100644 >--- a/fs/nfs/nfs4proc.c >+++ b/fs/nfs/nfs4proc.c >@@ -694,6 +694,13 @@ static int nfs4_sequence_done(struct rpc_task *task, > return nfs41_sequence_done(task, res); > } > >+static void nfs41_sequence_res_init(struct nfs4_sequence_res *res) >+{ >+ res->sr_timestamp = jiffies; >+ res->sr_status_flags = 0; >+ res->sr_status = 1; >+} >+ > int nfs41_setup_sequence(struct nfs4_session *session, > struct nfs4_sequence_args *args, > struct nfs4_sequence_res *res, >@@ -735,15 +742,9 @@ int nfs41_setup_sequence(struct nfs4_session *session, > slot->slot_nr, slot->seq_nr); > > res->sr_slot = slot; >- res->sr_timestamp = jiffies; >- res->sr_status_flags = 0; >- /* >- * sr_status is only set in decode_sequence, and so will remain >- * set to 1 if an rpc level failure occurs. >- */ >- res->sr_status = 1; > trace_nfs4_setup_sequence(session, args); > out_success: >+ nfs41_sequence_res_init(res); > rpc_call_start(task); > return 0; > out_sleep: >diff --git a/fs/nfs/super.c b/fs/nfs/super.c >index 29ec54a58361..f941584a8111 100644 >--- a/fs/nfs/super.c >+++ b/fs/nfs/super.c >@@ -1893,7 +1893,7 @@ static int nfs_parse_devname(const char *dev_name, > /* kill possible hostname list: not supported */ > comma = strchr(dev_name, ','); > if (comma != NULL && comma < end) >- *comma = 0; >+ len = comma - dev_name; > } > > if (len > maxnamlen) >diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c >index 401289913130..207d112b984b 100644 >--- a/fs/nfsd/nfs3proc.c >+++ b/fs/nfsd/nfs3proc.c >@@ -440,8 +440,19 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp, struct nfsd3_readdirargs *argp, > &resp->common, nfs3svc_encode_entry); > memcpy(resp->verf, argp->verf, 8); > resp->count = resp->buffer - argp->buffer; >- if (resp->offset) >- xdr_encode_hyper(resp->offset, argp->cookie); >+ if (resp->offset) { >+ loff_t offset = argp->cookie; >+ >+ if (unlikely(resp->offset1)) { >+ /* we ended up with offset on a page boundary */ >+ *resp->offset = htonl(offset >> 32); >+ *resp->offset1 = htonl(offset & 0xffffffff); >+ resp->offset1 = NULL; >+ } else { >+ xdr_encode_hyper(resp->offset, offset); >+ } >+ resp->offset = NULL; >+ } > > RETURN_STATUS(nfserr); > } >@@ -501,6 +512,7 @@ nfsd3_proc_readdirplus(struct svc_rqst *rqstp, struct nfsd3_readdirargs *argp, > } else { > xdr_encode_hyper(resp->offset, offset); > } >+ resp->offset = NULL; > } > > RETURN_STATUS(nfserr); >diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c >index d9fa85ebc8ac..68d7b7a0e2a3 100644 >--- a/fs/nfsd/nfs3xdr.c >+++ b/fs/nfsd/nfs3xdr.c >@@ -909,6 +909,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen, > } else { > xdr_encode_hyper(cd->offset, offset64); > } >+ cd->offset = NULL; > } > > /* >diff --git a/fs/open.c b/fs/open.c >index fc44237e4a2e..c4949a39726a 100644 >--- a/fs/open.c >+++ b/fs/open.c >@@ -1104,3 +1104,21 @@ int nonseekable_open(struct inode *inode, struct file *filp) > } > > EXPORT_SYMBOL(nonseekable_open); >+ >+/* >+ * stream_open is used by subsystems that want stream-like file descriptors. >+ * Such file descriptors are not seekable and don't have notion of position >+ * (file.f_pos is always 0). Contrary to file descriptors of other regular >+ * files, .read() and .write() can run simultaneously. >+ * >+ * stream_open never fails and is marked to return int so that it could be >+ * directly used as file_operations.open . >+ */ >+int stream_open(struct inode *inode, struct file *filp) >+{ >+ filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS); >+ filp->f_mode |= FMODE_STREAM; >+ return 0; >+} >+ >+EXPORT_SYMBOL(stream_open); >diff --git a/fs/pipe.c b/fs/pipe.c >index 4de213b5854f..f723b5e99917 100644 >--- a/fs/pipe.c >+++ b/fs/pipe.c >@@ -219,6 +219,14 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = { > .get = generic_pipe_buf_get, > }; > >+static const struct pipe_buf_operations anon_pipe_buf_nomerge_ops = { >+ .can_merge = 0, >+ .confirm = generic_pipe_buf_confirm, >+ .release = anon_pipe_buf_release, >+ .steal = generic_pipe_buf_steal, >+ .get = generic_pipe_buf_get, >+}; >+ > static const struct pipe_buf_operations packet_pipe_buf_ops = { > .can_merge = 0, > .confirm = generic_pipe_buf_confirm, >@@ -227,6 +235,12 @@ static const struct pipe_buf_operations packet_pipe_buf_ops = { > .get = generic_pipe_buf_get, > }; > >+void pipe_buf_mark_unmergeable(struct pipe_buffer *buf) >+{ >+ if (buf->ops == &anon_pipe_buf_ops) >+ buf->ops = &anon_pipe_buf_nomerge_ops; >+} >+ > static ssize_t > pipe_read(struct kiocb *iocb, struct iov_iter *to) > { >diff --git a/fs/read_write.c b/fs/read_write.c >index 07053752c148..c3b99ff5da0d 100644 >--- a/fs/read_write.c >+++ b/fs/read_write.c >@@ -549,12 +549,13 @@ EXPORT_SYMBOL(vfs_write); > > static inline loff_t file_pos_read(struct file *file) > { >- return file->f_pos; >+ return file->f_mode & FMODE_STREAM ? 0 : file->f_pos; > } > > static inline void file_pos_write(struct file *file, loff_t pos) > { >- file->f_pos = pos; >+ if ((file->f_mode & FMODE_STREAM) == 0) >+ file->f_pos = pos; > } > > SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count) >diff --git a/fs/splice.c b/fs/splice.c >index 41f10ce929dd..82577ca2ecf9 100644 >--- a/fs/splice.c >+++ b/fs/splice.c >@@ -1901,6 +1901,8 @@ static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe, > */ > obuf->flags &= ~PIPE_BUF_FLAG_GIFT; > >+ pipe_buf_mark_unmergeable(obuf); >+ > obuf->len = len; > opipe->nrbufs++; > ibuf->offset += obuf->len; >@@ -1975,6 +1977,8 @@ static int link_pipe(struct pipe_inode_info *ipipe, > */ > obuf->flags &= ~PIPE_BUF_FLAG_GIFT; > >+ pipe_buf_mark_unmergeable(obuf); >+ > if (obuf->len > len) > obuf->len = len; > >diff --git a/include/linux/fs.h b/include/linux/fs.h >index 461e82373ebd..49ca7649e5b5 100644 >--- a/include/linux/fs.h >+++ b/include/linux/fs.h >@@ -133,6 +133,9 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset, > /* Has write method(s) */ > #define FMODE_CAN_WRITE ((__force fmode_t)0x40000) > >+/* File is stream-like */ >+#define FMODE_STREAM ((__force fmode_t)0x200000) >+ > /* File was opened by fanotify and shouldn't generate fanotify events */ > #define FMODE_NONOTIFY ((__force fmode_t)0x1000000) > >@@ -2472,6 +2475,7 @@ extern loff_t fixed_size_llseek(struct file *file, loff_t offset, > int whence, loff_t size); > extern int generic_file_open(struct inode * inode, struct file * filp); > extern int nonseekable_open(struct inode * inode, struct file * filp); >+extern int stream_open(struct inode * inode, struct file * filp); > > #ifdef CONFIG_FS_XIP > extern ssize_t xip_file_read(struct file *filp, char __user *buf, size_t len, >diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h >index eed87a0fdc5c..394fb4b71a8d 100644 >--- a/include/linux/pipe_fs_i.h >+++ b/include/linux/pipe_fs_i.h >@@ -140,6 +140,7 @@ void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *); > int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *); > int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *); > void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *); >+void pipe_buf_mark_unmergeable(struct pipe_buffer *buf); > > extern const struct pipe_buf_operations nosteal_pipe_buf_ops; > >diff --git a/include/linux/swap.h b/include/linux/swap.h >index c28e936c8116..7f0a39d83b5d 100644 >--- a/include/linux/swap.h >+++ b/include/linux/swap.h >@@ -451,6 +451,7 @@ extern sector_t map_swap_page(struct page *, struct block_device **); > extern sector_t swapdev_block(int, pgoff_t); > extern int page_swapcount(struct page *); > extern struct swap_info_struct *page_swap_info(struct page *); >+extern struct swap_info_struct *swp_swap_info(swp_entry_t entry); > extern int reuse_swap_page(struct page *); > extern int try_to_free_swap(struct page *); > struct backing_dev_info; >diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h >index 734d9b5f577a..4927c208ec5c 100644 >--- a/include/net/gro_cells.h >+++ b/include/net/gro_cells.h >@@ -20,18 +20,23 @@ static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *s > struct gro_cell *cell = gcells->cells; > struct net_device *dev = skb->dev; > >+ rcu_read_lock(); >+ if (unlikely(!(dev->flags & IFF_UP))) >+ goto drop; >+ > if (!cell || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) { > netif_rx(skb); >- return; >+ goto unlock; > } > > if (skb_rx_queue_recorded(skb)) > cell += skb_get_rx_queue(skb) & gcells->gro_cells_mask; > > if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) { >+drop: > atomic_long_inc(&dev->rx_dropped); > kfree_skb(skb); >- return; >+ goto unlock; > } > > /* We run in BH context */ >@@ -42,6 +47,9 @@ static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *s > napi_schedule(&cell->napi); > > spin_unlock(&cell->napi_skbs.lock); >+ >+unlock: >+ rcu_read_unlock(); > } > > /* called unser BH context */ >diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h >index f772dab65474..b3358ba51504 100644 >--- a/include/net/net_namespace.h >+++ b/include/net/net_namespace.h >@@ -54,6 +54,8 @@ struct net { > #endif > spinlock_t rules_mod_lock; > >+ u32 hash_mix; >+ > struct list_head list; /* list of network namespaces */ > struct list_head cleanup_list; /* namespaces on death row */ > struct list_head exit_list; /* Use only net_mutex */ >diff --git a/include/net/netns/hash.h b/include/net/netns/hash.h >index c06ac58ca107..a347b2f9e748 100644 >--- a/include/net/netns/hash.h >+++ b/include/net/netns/hash.h >@@ -1,21 +1,10 @@ > #ifndef __NET_NS_HASH_H__ > #define __NET_NS_HASH_H__ > >-#include >+#include > >-struct net; >- >-static inline unsigned int net_hash_mix(struct net *net) >+static inline u32 net_hash_mix(const struct net *net) > { >-#ifdef CONFIG_NET_NS >- /* >- * shift this right to eliminate bits, that are >- * always zeroed >- */ >- >- return (unsigned)(((unsigned long)net) >> L1_CACHE_SHIFT); >-#else >- return 0; >-#endif >+ return net->hash_mix; > } > #endif >diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h >index 25084a052a1e..cff91b018953 100644 >--- a/include/uapi/linux/fuse.h >+++ b/include/uapi/linux/fuse.h >@@ -205,10 +205,12 @@ struct fuse_file_lock { > * FOPEN_DIRECT_IO: bypass page cache for this open file > * FOPEN_KEEP_CACHE: don't invalidate the data cache on open > * FOPEN_NONSEEKABLE: the file is not seekable >+ * FOPEN_STREAM: the file is stream-like (no file position at all) > */ > #define FOPEN_DIRECT_IO (1 << 0) > #define FOPEN_KEEP_CACHE (1 << 1) > #define FOPEN_NONSEEKABLE (1 << 2) >+#define FOPEN_STREAM (1 << 4) > > /** > * INIT request/reply flags >diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c >index 627180d3bed4..608747155bda 100644 >--- a/kernel/rcu/tree.c >+++ b/kernel/rcu/tree.c >@@ -1384,15 +1384,23 @@ static int rcu_future_gp_cleanup(struct rcu_state *rsp, struct rcu_node *rnp) > } > > /* >- * Awaken the grace-period kthread for the specified flavor of RCU. >- * Don't do a self-awaken, and don't bother awakening when there is >- * nothing for the grace-period kthread to do (as in several CPUs >- * raced to awaken, and we lost), and finally don't try to awaken >- * a kthread that has not yet been created. >+ * Awaken the grace-period kthread. Don't do a self-awaken (unless in >+ * an interrupt or softirq handler), and don't bother awakening when there >+ * is nothing for the grace-period kthread to do (as in several CPUs raced >+ * to awaken, and we lost), and finally don't try to awaken a kthread that >+ * has not yet been created. If all those checks are passed, track some >+ * debug information and awaken. >+ * >+ * So why do the self-wakeup when in an interrupt or softirq handler >+ * in the grace-period kthread's context? Because the kthread might have >+ * been interrupted just as it was going to sleep, and just after the final >+ * pre-sleep check of the awaken condition. In this case, a wakeup really >+ * is required, and is therefore supplied. > */ > static void rcu_gp_kthread_wake(struct rcu_state *rsp) > { >- if (current == rsp->gp_kthread || >+ if ((current == rsp->gp_kthread && >+ !in_interrupt() && !in_serving_softirq()) || > !ACCESS_ONCE(rsp->gp_flags) || > !rsp->gp_kthread) > return; >diff --git a/kernel/sysctl.c b/kernel/sysctl.c >index e714622b6fa9..6f4e876162f5 100644 >--- a/kernel/sysctl.c >+++ b/kernel/sysctl.c >@@ -2179,7 +2179,16 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp, > { > struct do_proc_dointvec_minmax_conv_param *param = data; > if (write) { >- int val = *negp ? -*lvalp : *lvalp; >+ int val; >+ if (*negp) { >+ if (*lvalp > (unsigned long) INT_MAX + 1) >+ return -EINVAL; >+ val = -*lvalp; >+ } else { >+ if (*lvalp > (unsigned long) INT_MAX) >+ return -EINVAL; >+ val = *lvalp; >+ } > if ((param->min && *param->min > val) || > (param->max && *param->max < val)) > return -EINVAL; >diff --git a/lib/devres.c b/lib/devres.c >index eaa04de41e42..6fa604a28b04 100644 >--- a/lib/devres.c >+++ b/lib/devres.c >@@ -109,7 +109,6 @@ EXPORT_SYMBOL(devm_iounmap); > void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res) > { > resource_size_t size; >- const char *name; > void __iomem *dest_ptr; > > BUG_ON(!dev); >@@ -120,9 +119,8 @@ void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res) > } > > size = resource_size(res); >- name = res->name ?: dev_name(dev); > >- if (!devm_request_mem_region(dev, res->start, size, name)) { >+ if (!devm_request_mem_region(dev, res->start, size, dev_name(dev))) { > dev_err(dev, "can't request region for resource %pR\n", res); > return IOMEM_ERR_PTR(-EBUSY); > } >diff --git a/lib/div64.c b/lib/div64.c >index 4382ad77777e..ce76dc3d674e 100644 >--- a/lib/div64.c >+++ b/lib/div64.c >@@ -100,7 +100,7 @@ u64 div64_u64_rem(u64 dividend, u64 divisor, u64 *remainder) > quot = div_u64_rem(dividend, divisor, &rem32); > *remainder = rem32; > } else { >- int n = 1 + fls(high); >+ int n = fls(high); > quot = div_u64(dividend >> n, divisor >> n); > > if (quot != 0) >@@ -138,7 +138,7 @@ u64 div64_u64(u64 dividend, u64 divisor) > if (high == 0) { > quot = div_u64(dividend, divisor); > } else { >- int n = 1 + fls(high); >+ int n = fls(high); > quot = div_u64(dividend >> n, divisor >> n); > > if (quot != 0) >diff --git a/mm/swapfile.c b/mm/swapfile.c >index 5ee24d70eeca..1fc2d536e2df 100644 >--- a/mm/swapfile.c >+++ b/mm/swapfile.c >@@ -86,6 +86,15 @@ static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait); > /* Activity counter to indicate that a swapon or swapoff has occurred */ > static atomic_t proc_poll_event = ATOMIC_INIT(0); > >+static struct swap_info_struct *swap_type_to_swap_info(int type) >+{ >+ if (type >= ACCESS_ONCE(nr_swapfiles)) >+ return NULL; >+ >+ smp_rmb(); /* Pairs with smp_wmb in alloc_swap_info. */ >+ return ACCESS_ONCE(swap_info[type]); >+} >+ > static inline unsigned char swap_count(unsigned char ent) > { > return ent & ~SWAP_HAS_CACHE; /* may include COUNT_CONTINUED flag */ >@@ -703,12 +712,14 @@ swp_entry_t get_swap_page(void) > /* The only caller of this function is now suspend routine */ > swp_entry_t get_swap_page_of_type(int type) > { >- struct swap_info_struct *si; >+ struct swap_info_struct *si = swap_type_to_swap_info(type); > pgoff_t offset; > >- si = swap_info[type]; >+ if (!si) >+ goto fail; >+ > spin_lock(&si->lock); >- if (si && (si->flags & SWP_WRITEOK)) { >+ if (si->flags & SWP_WRITEOK) { > atomic_long_dec(&nr_swap_pages); > /* This is called for allocating swap entry, not cache */ > offset = scan_swap_map(si, 1); >@@ -719,6 +730,7 @@ swp_entry_t get_swap_page_of_type(int type) > atomic_long_inc(&nr_swap_pages); > } > spin_unlock(&si->lock); >+fail: > return (swp_entry_t) {0}; > } > >@@ -730,9 +742,9 @@ static struct swap_info_struct *swap_info_get(swp_entry_t entry) > if (!entry.val) > goto out; > type = swp_type(entry); >- if (type >= nr_swapfiles) >+ p = swap_type_to_swap_info(type); >+ if (!p) > goto bad_nofile; >- p = swap_info[type]; > if (!(p->flags & SWP_USED)) > goto bad_device; > offset = swp_offset(entry); >@@ -1037,10 +1049,9 @@ int swap_type_of(dev_t device, sector_t offset, struct block_device **bdev_p) > sector_t swapdev_block(int type, pgoff_t offset) > { > struct block_device *bdev; >+ struct swap_info_struct *si = swap_type_to_swap_info(type); > >- if ((unsigned int)type >= nr_swapfiles) >- return 0; >- if (!(swap_info[type]->flags & SWP_WRITEOK)) >+ if (!si || !(si->flags & SWP_WRITEOK)) > return 0; > return map_swap_entry(swp_entry(type, offset), &bdev); > } >@@ -1584,7 +1595,7 @@ static sector_t map_swap_entry(swp_entry_t entry, struct block_device **bdev) > struct swap_extent *se; > pgoff_t offset; > >- sis = swap_info[swp_type(entry)]; >+ sis = swp_swap_info(entry); > *bdev = sis->bdev; > > offset = swp_offset(entry); >@@ -1982,9 +1993,7 @@ static void *swap_start(struct seq_file *swap, loff_t *pos) > if (!l) > return SEQ_START_TOKEN; > >- for (type = 0; type < nr_swapfiles; type++) { >- smp_rmb(); /* read nr_swapfiles before swap_info[type] */ >- si = swap_info[type]; >+ for (type = 0; (si = swap_type_to_swap_info(type)); type++) { > if (!(si->flags & SWP_USED) || !si->swap_map) > continue; > if (!--l) >@@ -2004,9 +2013,7 @@ static void *swap_next(struct seq_file *swap, void *v, loff_t *pos) > else > type = si->type + 1; > >- for (; type < nr_swapfiles; type++) { >- smp_rmb(); /* read nr_swapfiles before swap_info[type] */ >- si = swap_info[type]; >+ for (; (si = swap_type_to_swap_info(type)); type++) { > if (!(si->flags & SWP_USED) || !si->swap_map) > continue; > ++*pos; >@@ -2111,14 +2118,14 @@ static struct swap_info_struct *alloc_swap_info(void) > } > if (type >= nr_swapfiles) { > p->type = type; >- swap_info[type] = p; >+ ACCESS_ONCE(swap_info[type]) = p; > /* > * Write swap_info[type] before nr_swapfiles, in case a > * racing procfs swap_start() or swap_next() is reading them. > * (We never shrink nr_swapfiles, we never free this entry.) > */ > smp_wmb(); >- nr_swapfiles++; >+ ACCESS_ONCE(nr_swapfiles) = nr_swapfiles + 1; > } else { > kfree(p); > p = swap_info[type]; >@@ -2144,11 +2151,10 @@ static int claim_swapfile(struct swap_info_struct *p, struct inode *inode) > if (S_ISBLK(inode->i_mode)) { > p->bdev = bdgrab(I_BDEV(inode)); > error = blkdev_get(p->bdev, >- FMODE_READ | FMODE_WRITE | FMODE_EXCL, >- sys_swapon); >+ FMODE_READ | FMODE_WRITE | FMODE_EXCL, p); > if (error < 0) { > p->bdev = NULL; >- return -EINVAL; >+ return error; > } > p->old_block_size = block_size(p->bdev); > error = set_blocksize(p->bdev, PAGE_SIZE); >@@ -2365,7 +2371,6 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) > struct filename *name; > struct file *swap_file = NULL; > struct address_space *mapping; >- int i; > int prio; > int error; > union swap_header *swap_header; >@@ -2405,19 +2410,8 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) > > p->swap_file = swap_file; > mapping = swap_file->f_mapping; >- >- for (i = 0; i < nr_swapfiles; i++) { >- struct swap_info_struct *q = swap_info[i]; >- >- if (q == p || !q->swap_file) >- continue; >- if (mapping == q->swap_file->f_mapping) { >- error = -EBUSY; >- goto bad_swap; >- } >- } >- > inode = mapping->host; >+ > /* If S_ISREG(inode->i_mode) will do mutex_lock(&inode->i_mutex); */ > error = claim_swapfile(p, inode); > if (unlikely(error)) >@@ -2450,6 +2444,8 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) > goto bad_swap; > } > if (p->bdev && blk_queue_nonrot(bdev_get_queue(p->bdev))) { >+ int cpu; >+ > p->flags |= SWP_SOLIDSTATE; > /* > * select a random position to start with to help wear leveling >@@ -2468,9 +2464,9 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) > error = -ENOMEM; > goto bad_swap; > } >- for_each_possible_cpu(i) { >+ for_each_possible_cpu(cpu) { > struct percpu_cluster *cluster; >- cluster = per_cpu_ptr(p->percpu_cluster, i); >+ cluster = per_cpu_ptr(p->percpu_cluster, cpu); > cluster_set_null(&cluster->index); > } > } >@@ -2609,7 +2605,7 @@ void si_swapinfo(struct sysinfo *val) > static int __swap_duplicate(swp_entry_t entry, unsigned char usage) > { > struct swap_info_struct *p; >- unsigned long offset, type; >+ unsigned long offset; > unsigned char count; > unsigned char has_cache; > int err = -EINVAL; >@@ -2617,10 +2613,10 @@ static int __swap_duplicate(swp_entry_t entry, unsigned char usage) > if (non_swap_entry(entry)) > goto out; > >- type = swp_type(entry); >- if (type >= nr_swapfiles) >+ p = swp_swap_info(entry); >+ if (!p) > goto bad_file; >- p = swap_info[type]; >+ > offset = swp_offset(entry); > > spin_lock(&p->lock); >@@ -2715,11 +2711,16 @@ int swapcache_prepare(swp_entry_t entry) > return __swap_duplicate(entry, SWAP_HAS_CACHE); > } > >+struct swap_info_struct *swp_swap_info(swp_entry_t entry) >+{ >+ return swap_type_to_swap_info(swp_type(entry)); >+} >+ > struct swap_info_struct *page_swap_info(struct page *page) > { >- swp_entry_t swap = { .val = page_private(page) }; >+ swp_entry_t entry = { .val = page_private(page) }; > BUG_ON(!PageSwapCache(page)); >- return swap_info[swp_type(swap)]; >+ return swp_swap_info(entry); > } > > /* >diff --git a/mm/vmalloc.c b/mm/vmalloc.c >index f64632b67196..b9296d0b325c 100644 >--- a/mm/vmalloc.c >+++ b/mm/vmalloc.c >@@ -2141,7 +2141,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr, > if (!(area->flags & VM_USERMAP)) > return -EINVAL; > >- if (kaddr + size > area->addr + area->size) >+ if (kaddr + size > area->addr + get_vm_area_size(area)) > return -EINVAL; > > do { >diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c >index 777ac525ef27..cd332d0fa930 100644 >--- a/net/core/net-sysfs.c >+++ b/net/core/net-sysfs.c >@@ -1219,6 +1219,9 @@ static int register_queue_kobjects(struct net_device *net) > error: > netdev_queue_update_kobjects(net, txq, 0); > net_rx_queue_update_kobjects(net, rxq, 0); >+#ifdef CONFIG_SYSFS >+ kset_unregister(net->queues_kset); >+#endif > return error; > } > >diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c >index 85b62691f4f2..45ebcc039a68 100644 >--- a/net/core/net_namespace.c >+++ b/net/core/net_namespace.c >@@ -156,6 +156,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) > > atomic_set(&net->count, 1); > atomic_set(&net->passive, 1); >+ get_random_bytes(&net->hash_mix, sizeof(u32)); > net->dev_base_seq = 1; > net->user_ns = user_ns; > >diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c >index e5302b7f7ca9..1701afc0530f 100644 >--- a/net/hsr/hsr_device.c >+++ b/net/hsr/hsr_device.c >@@ -78,9 +78,8 @@ void hsr_check_announce(struct net_device *hsr_dev, int old_operstate) > if ((hsr_dev->operstate == IF_OPER_UP) && (old_operstate != IF_OPER_UP)) { > /* Went up */ > hsr_priv->announce_count = 0; >- hsr_priv->announce_timer.expires = jiffies + >- msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); >- add_timer(&hsr_priv->announce_timer); >+ mod_timer(&hsr_priv->announce_timer, >+ jiffies + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL)); > } > > if ((hsr_dev->operstate != IF_OPER_UP) && (old_operstate == IF_OPER_UP)) >@@ -361,6 +360,7 @@ static void send_hsr_supervision_frame(struct net_device *hsr_dev, u8 type) > static void hsr_announce(unsigned long data) > { > struct hsr_priv *hsr_priv; >+ unsigned long interval; > > hsr_priv = (struct hsr_priv *) data; > >@@ -372,14 +372,12 @@ static void hsr_announce(unsigned long data) > } > > if (hsr_priv->announce_count < 3) >- hsr_priv->announce_timer.expires = jiffies + >- msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); >+ interval = msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); > else >- hsr_priv->announce_timer.expires = jiffies + >- msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL); >+ interval = msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL); > > if (is_admin_up(hsr_priv->dev)) >- add_timer(&hsr_priv->announce_timer); >+ mod_timer(&hsr_priv->announce_timer, jiffies + interval); > } > > >diff --git a/net/ipv4/route.c b/net/ipv4/route.c >index e0d59ff394b2..660848116761 100644 >--- a/net/ipv4/route.c >+++ b/net/ipv4/route.c >@@ -1279,6 +1279,10 @@ static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr) > if (fnhe->fnhe_daddr == daddr) { > rcu_assign_pointer(*fnhe_p, rcu_dereference_protected( > fnhe->fnhe_next, lockdep_is_held(&fnhe_lock))); >+ /* set fnhe_daddr to 0 to ensure it won't bind with >+ * new dsts in rt_bind_exception(). >+ */ >+ fnhe->fnhe_daddr = 0; > fnhe_flush_routes(fnhe); > kfree_rcu(fnhe, rcu); > break; >diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c >index 4a64bebd360d..f3e3c36368db 100644 >--- a/net/ipv4/tcp_output.c >+++ b/net/ipv4/tcp_output.c >@@ -1091,7 +1091,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, > if (nsize < 0) > nsize = 0; > >- if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf)) { >+ if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf + 0x20000)) { > NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG); > return -ENOMEM; > } >diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c >index c99860ee0394..42978998534c 100644 >--- a/net/ipv6/ip6mr.c >+++ b/net/ipv6/ip6mr.c >@@ -1984,10 +1984,10 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) > > static inline int ip6mr_forward2_finish(struct sk_buff *skb) > { >- IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)), >- IPSTATS_MIB_OUTFORWDATAGRAMS); >- IP6_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)), >- IPSTATS_MIB_OUTOCTETS, skb->len); >+ IP6_INC_STATS(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)), >+ IPSTATS_MIB_OUTFORWDATAGRAMS); >+ IP6_ADD_STATS(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)), >+ IPSTATS_MIB_OUTOCTETS, skb->len); > return dst_output(skb); > } > >diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c >index c966305cf46c..099c8fe5c8cf 100644 >--- a/net/l2tp/l2tp_ip6.c >+++ b/net/l2tp/l2tp_ip6.c >@@ -664,9 +664,6 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk, > if (flags & MSG_OOB) > goto out; > >- if (addr_len) >- *addr_len = sizeof(*lsa); >- > if (flags & MSG_ERRQUEUE) > return ipv6_recv_error(sk, msg, len, addr_len); > >@@ -696,6 +693,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk, > lsa->l2tp_conn_id = 0; > if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL) > lsa->l2tp_scope_id = IP6CB(skb)->iif; >+ *addr_len = sizeof(*lsa); > } > > if (np->rxopt.all) >diff --git a/scripts/coccinelle/api/stream_open.cocci b/scripts/coccinelle/api/stream_open.cocci >new file mode 100644 >index 000000000000..350145da7669 >--- /dev/null >+++ b/scripts/coccinelle/api/stream_open.cocci >@@ -0,0 +1,363 @@ >+// SPDX-License-Identifier: GPL-2.0 >+// Author: Kirill Smelkov (kirr@nexedi.com) >+// >+// Search for stream-like files that are using nonseekable_open and convert >+// them to stream_open. A stream-like file is a file that does not use ppos in >+// its read and write. Rationale for the conversion is to avoid deadlock in >+// between read and write. >+ >+virtual report >+virtual patch >+virtual explain // explain decisions in the patch (SPFLAGS="-D explain") >+ >+// stream-like reader & writer - ones that do not depend on f_pos. >+@ stream_reader @ >+identifier readstream, ppos; >+identifier f, buf, len; >+type loff_t; >+@@ >+ ssize_t readstream(struct file *f, char *buf, size_t len, loff_t *ppos) >+ { >+ ... when != ppos >+ } >+ >+@ stream_writer @ >+identifier writestream, ppos; >+identifier f, buf, len; >+type loff_t; >+@@ >+ ssize_t writestream(struct file *f, const char *buf, size_t len, loff_t *ppos) >+ { >+ ... when != ppos >+ } >+ >+ >+// a function that blocks >+@ blocks @ >+identifier block_f; >+identifier wait_event =~ "^wait_event_.*"; >+@@ >+ block_f(...) { >+ ... when exists >+ wait_event(...) >+ ... when exists >+ } >+ >+// stream_reader that can block inside. >+// >+// XXX wait_* can be called not directly from current function (e.g. func -> f -> g -> wait()) >+// XXX currently reader_blocks supports only direct and 1-level indirect cases. >+@ reader_blocks_direct @ >+identifier stream_reader.readstream; >+identifier wait_event =~ "^wait_event_.*"; >+@@ >+ readstream(...) >+ { >+ ... when exists >+ wait_event(...) >+ ... when exists >+ } >+ >+@ reader_blocks_1 @ >+identifier stream_reader.readstream; >+identifier blocks.block_f; >+@@ >+ readstream(...) >+ { >+ ... when exists >+ block_f(...) >+ ... when exists >+ } >+ >+@ reader_blocks depends on reader_blocks_direct || reader_blocks_1 @ >+identifier stream_reader.readstream; >+@@ >+ readstream(...) { >+ ... >+ } >+ >+ >+// file_operations + whether they have _any_ .read, .write, .llseek ... at all. >+// >+// XXX add support for file_operations xxx[N] = ... (sound/core/pcm_native.c) >+@ fops0 @ >+identifier fops; >+@@ >+ struct file_operations fops = { >+ ... >+ }; >+ >+@ has_read @ >+identifier fops0.fops; >+identifier read_f; >+@@ >+ struct file_operations fops = { >+ .read = read_f, >+ }; >+ >+@ has_read_iter @ >+identifier fops0.fops; >+identifier read_iter_f; >+@@ >+ struct file_operations fops = { >+ .read_iter = read_iter_f, >+ }; >+ >+@ has_write @ >+identifier fops0.fops; >+identifier write_f; >+@@ >+ struct file_operations fops = { >+ .write = write_f, >+ }; >+ >+@ has_write_iter @ >+identifier fops0.fops; >+identifier write_iter_f; >+@@ >+ struct file_operations fops = { >+ .write_iter = write_iter_f, >+ }; >+ >+@ has_llseek @ >+identifier fops0.fops; >+identifier llseek_f; >+@@ >+ struct file_operations fops = { >+ .llseek = llseek_f, >+ }; >+ >+@ has_no_llseek @ >+identifier fops0.fops; >+@@ >+ struct file_operations fops = { >+ .llseek = no_llseek, >+ }; >+ >+@ has_mmap @ >+identifier fops0.fops; >+identifier mmap_f; >+@@ >+ struct file_operations fops = { >+ .mmap = mmap_f, >+ }; >+ >+@ has_copy_file_range @ >+identifier fops0.fops; >+identifier copy_file_range_f; >+@@ >+ struct file_operations fops = { >+ .copy_file_range = copy_file_range_f, >+ }; >+ >+@ has_remap_file_range @ >+identifier fops0.fops; >+identifier remap_file_range_f; >+@@ >+ struct file_operations fops = { >+ .remap_file_range = remap_file_range_f, >+ }; >+ >+@ has_splice_read @ >+identifier fops0.fops; >+identifier splice_read_f; >+@@ >+ struct file_operations fops = { >+ .splice_read = splice_read_f, >+ }; >+ >+@ has_splice_write @ >+identifier fops0.fops; >+identifier splice_write_f; >+@@ >+ struct file_operations fops = { >+ .splice_write = splice_write_f, >+ }; >+ >+ >+// file_operations that is candidate for stream_open conversion - it does not >+// use mmap and other methods that assume @offset access to file. >+// >+// XXX for simplicity require no .{read/write}_iter and no .splice_{read/write} for now. >+// XXX maybe_steam.fops cannot be used in other rules - it gives "bad rule maybe_stream or bad variable fops". >+@ maybe_stream depends on (!has_llseek || has_no_llseek) && !has_mmap && !has_copy_file_range && !has_remap_file_range && !has_read_iter && !has_write_iter && !has_splice_read && !has_splice_write @ >+identifier fops0.fops; >+@@ >+ struct file_operations fops = { >+ }; >+ >+ >+// ---- conversions ---- >+ >+// XXX .open = nonseekable_open -> .open = stream_open >+// XXX .open = func -> openfunc -> nonseekable_open >+ >+// read & write >+// >+// if both are used in the same file_operations together with an opener - >+// under that conditions we can use stream_open instead of nonseekable_open. >+@ fops_rw depends on maybe_stream @ >+identifier fops0.fops, openfunc; >+identifier stream_reader.readstream; >+identifier stream_writer.writestream; >+@@ >+ struct file_operations fops = { >+ .open = openfunc, >+ .read = readstream, >+ .write = writestream, >+ }; >+ >+@ report_rw depends on report @ >+identifier fops_rw.openfunc; >+position p1; >+@@ >+ openfunc(...) { >+ <... >+ nonseekable_open@p1 >+ ...> >+ } >+ >+@ script:python depends on report && reader_blocks @ >+fops << fops0.fops; >+p << report_rw.p1; >+@@ >+coccilib.report.print_report(p[0], >+ "ERROR: %s: .read() can deadlock .write(); change nonseekable_open -> stream_open to fix." % (fops,)) >+ >+@ script:python depends on report && !reader_blocks @ >+fops << fops0.fops; >+p << report_rw.p1; >+@@ >+coccilib.report.print_report(p[0], >+ "WARNING: %s: .read() and .write() have stream semantic; safe to change nonseekable_open -> stream_open." % (fops,)) >+ >+ >+@ explain_rw_deadlocked depends on explain && reader_blocks @ >+identifier fops_rw.openfunc; >+@@ >+ openfunc(...) { >+ <... >+- nonseekable_open >++ nonseekable_open /* read & write (was deadlock) */ >+ ...> >+ } >+ >+ >+@ explain_rw_nodeadlock depends on explain && !reader_blocks @ >+identifier fops_rw.openfunc; >+@@ >+ openfunc(...) { >+ <... >+- nonseekable_open >++ nonseekable_open /* read & write (no direct deadlock) */ >+ ...> >+ } >+ >+@ patch_rw depends on patch @ >+identifier fops_rw.openfunc; >+@@ >+ openfunc(...) { >+ <... >+- nonseekable_open >++ stream_open >+ ...> >+ } >+ >+ >+// read, but not write >+@ fops_r depends on maybe_stream && !has_write @ >+identifier fops0.fops, openfunc; >+identifier stream_reader.readstream; >+@@ >+ struct file_operations fops = { >+ .open = openfunc, >+ .read = readstream, >+ }; >+ >+@ report_r depends on report @ >+identifier fops_r.openfunc; >+position p1; >+@@ >+ openfunc(...) { >+ <... >+ nonseekable_open@p1 >+ ...> >+ } >+ >+@ script:python depends on report @ >+fops << fops0.fops; >+p << report_r.p1; >+@@ >+coccilib.report.print_report(p[0], >+ "WARNING: %s: .read() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,)) >+ >+@ explain_r depends on explain @ >+identifier fops_r.openfunc; >+@@ >+ openfunc(...) { >+ <... >+- nonseekable_open >++ nonseekable_open /* read only */ >+ ...> >+ } >+ >+@ patch_r depends on patch @ >+identifier fops_r.openfunc; >+@@ >+ openfunc(...) { >+ <... >+- nonseekable_open >++ stream_open >+ ...> >+ } >+ >+ >+// write, but not read >+@ fops_w depends on maybe_stream && !has_read @ >+identifier fops0.fops, openfunc; >+identifier stream_writer.writestream; >+@@ >+ struct file_operations fops = { >+ .open = openfunc, >+ .write = writestream, >+ }; >+ >+@ report_w depends on report @ >+identifier fops_w.openfunc; >+position p1; >+@@ >+ openfunc(...) { >+ <... >+ nonseekable_open@p1 >+ ...> >+ } >+ >+@ script:python depends on report @ >+fops << fops0.fops; >+p << report_w.p1; >+@@ >+coccilib.report.print_report(p[0], >+ "WARNING: %s: .write() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,)) >+ >+@ explain_w depends on explain @ >+identifier fops_w.openfunc; >+@@ >+ openfunc(...) { >+ <... >+- nonseekable_open >++ nonseekable_open /* write only */ >+ ...> >+ } >+ >+@ patch_w depends on patch @ >+identifier fops_w.openfunc; >+@@ >+ openfunc(...) { >+ <... >+- nonseekable_open >++ stream_open >+ ...> >+ } >+ >+ >+// no read, no write - don't change anything >diff --git a/security/selinux/avc.c b/security/selinux/avc.c >index a18f1fa6440b..e0ae18b8df50 100644 >--- a/security/selinux/avc.c >+++ b/security/selinux/avc.c >@@ -528,6 +528,7 @@ static inline int avc_sidcmp(u32 x, u32 y) > * @perms : Permission mask bits > * @ssid,@tsid,@tclass : identifier of an AVC entry > * @seqno : sequence number when decision was made >+ * @flags: the AVC_* flags, e.g. AVC_NONBLOCKING, AVC_EXTENDED_PERMS, or 0. > * > * if a valid AVC entry doesn't exist,this function returns -ENOENT. > * if kmalloc() called internal returns NULL, this function returns -ENOMEM. >@@ -535,7 +536,7 @@ static inline int avc_sidcmp(u32 x, u32 y) > * will release later by RCU. > */ > static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass, >- u32 seqno) >+ u32 seqno, unsigned int flags) > { > int hvalue, rc = 0; > unsigned long flag; >@@ -543,6 +544,23 @@ static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass, > struct hlist_head *head; > spinlock_t *lock; > >+ /* >+ * If we are in a non-blocking code path, e.g. VFS RCU walk, >+ * then we must not add permissions to a cache entry >+ * because we cannot safely audit the denial. Otherwise, >+ * during the subsequent blocking retry (e.g. VFS ref walk), we >+ * will find the permissions already granted in the cache entry >+ * and won't audit anything at all, leading to silent denials in >+ * permissive mode that only appear when in enforcing mode. >+ * >+ * See the corresponding handling in slow_avc_audit(), and the >+ * logic in selinux_inode_follow_link and selinux_inode_permission >+ * for the VFS MAY_NOT_BLOCK flag, which is transliterated into >+ * AVC_NONBLOCKING for avc_has_perm_noaudit(). >+ */ >+ if (flags & AVC_NONBLOCKING) >+ return 0; >+ > node = avc_alloc_node(); > if (!node) { > rc = -ENOMEM; >@@ -690,7 +708,7 @@ static noinline int avc_denied(u32 ssid, u32 tsid, > return -EACCES; > > avc_update_node(AVC_CALLBACK_GRANT, requested, ssid, >- tsid, tclass, avd->seqno); >+ tsid, tclass, avd->seqno, flags); > return 0; > } > >@@ -701,7 +719,7 @@ static noinline int avc_denied(u32 ssid, u32 tsid, > * @tsid: target security identifier > * @tclass: target security class > * @requested: requested permissions, interpreted based on @tclass >- * @flags: AVC_STRICT or 0 >+ * @flags: AVC_STRICT, AVC_NONBLOCKING, or 0 > * @avd: access vector decisions > * > * Check the AVC to determine whether the @requested permissions are granted >@@ -768,7 +786,25 @@ int avc_has_perm(u32 ssid, u32 tsid, u16 tclass, > > rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd); > >- rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata); >+ rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata, 0); >+ if (rc2) >+ return rc2; >+ return rc; >+} >+ >+int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass, >+ u32 requested, struct common_audit_data *auditdata, >+ int flags) >+{ >+ struct av_decision avd; >+ int rc, rc2; >+ >+ rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, >+ (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0, >+ &avd); >+ >+ rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, >+ auditdata, flags); > if (rc2) > return rc2; > return rc; >diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c >index df42cb7a1bbf..60d50812900f 100644 >--- a/security/selinux/hooks.c >+++ b/security/selinux/hooks.c >@@ -1569,7 +1569,7 @@ static int cred_has_capability(const struct cred *cred, > > rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd); > if (audit == SECURITY_CAP_AUDIT) { >- int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad); >+ int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0); > if (rc2) > return rc2; > } >@@ -2818,7 +2818,9 @@ static int selinux_inode_permission(struct inode *inode, int mask) > sid = cred_sid(cred); > isec = inode->i_security; > >- rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd); >+ rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, >+ (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0, >+ &avd); > audited = avc_audit_required(perms, &avd, rc, > from_access ? FILE__AUDIT_ACCESS : 0, > &denied); >diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h >index ddf8eec03f21..d86577934270 100644 >--- a/security/selinux/include/avc.h >+++ b/security/selinux/include/avc.h >@@ -130,7 +130,8 @@ static inline int avc_audit(u32 ssid, u32 tsid, > u16 tclass, u32 requested, > struct av_decision *avd, > int result, >- struct common_audit_data *a) >+ struct common_audit_data *a, >+ int flags) > { > u32 audited, denied; > audited = avc_audit_required(requested, avd, result, 0, &denied); >@@ -138,10 +139,11 @@ static inline int avc_audit(u32 ssid, u32 tsid, > return 0; > return slow_avc_audit(ssid, tsid, tclass, > requested, audited, denied, result, >- a, 0); >+ a, flags); > } > > #define AVC_STRICT 1 /* Ignore permissive mode. */ >+#define AVC_NONBLOCKING 4 /* non blocking */ > int avc_has_perm_noaudit(u32 ssid, u32 tsid, > u16 tclass, u32 requested, > unsigned flags, >@@ -150,6 +152,10 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid, > int avc_has_perm(u32 ssid, u32 tsid, > u16 tclass, u32 requested, > struct common_audit_data *auditdata); >+int avc_has_perm_flags(u32 ssid, u32 tsid, >+ u16 tclass, u32 requested, >+ struct common_audit_data *auditdata, >+ int flags); > > u32 avc_policy_seqno(void); > >diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c >index fc19c99654aa..16ff4e633bf2 100644 >--- a/sound/firewire/bebob/bebob.c >+++ b/sound/firewire/bebob/bebob.c >@@ -396,7 +396,19 @@ static const struct ieee1394_device_id bebob_id_table[] = { > /* Focusrite, SaffirePro 26 I/O */ > SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec), > /* Focusrite, SaffirePro 10 I/O */ >- SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000006, &saffirepro_10_spec), >+ { >+ // The combination of vendor_id and model_id is the same as the >+ // same as the one of Liquid Saffire 56. >+ .match_flags = IEEE1394_MATCH_VENDOR_ID | >+ IEEE1394_MATCH_MODEL_ID | >+ IEEE1394_MATCH_SPECIFIER_ID | >+ IEEE1394_MATCH_VERSION, >+ .vendor_id = VEN_FOCUSRITE, >+ .model_id = 0x000006, >+ .specifier_id = 0x00a02d, >+ .version = 0x010001, >+ .driver_data = (kernel_ulong_t)&saffirepro_10_spec, >+ }, > /* Focusrite, Saffire(no label and LE) */ > SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, MODEL_FOCUSRITE_SAFFIRE_BOTH, > &saffire_spec), >diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c >index cd326bbf9c62..8acac5fd084c 100644 >--- a/sound/soc/fsl/fsl_esai.c >+++ b/sound/soc/fsl/fsl_esai.c >@@ -392,7 +392,8 @@ static int fsl_esai_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt) > break; > case SND_SOC_DAIFMT_RIGHT_J: > /* Data on rising edge of bclk, frame high, right aligned */ >- xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCR_xWA; >+ xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP; >+ xcr |= ESAI_xCR_xWA; > break; > case SND_SOC_DAIFMT_DSP_A: > /* Data on rising edge of bclk, frame high, 1clk before data */ >@@ -449,12 +450,12 @@ static int fsl_esai_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt) > return -EINVAL; > } > >- mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR; >+ mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR | ESAI_xCR_xWA; > regmap_update_bits(esai_priv->regmap, REG_ESAI_TCR, mask, xcr); > regmap_update_bits(esai_priv->regmap, REG_ESAI_RCR, mask, xcr); > > mask = ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCCR_xFSP | >- ESAI_xCCR_xFSD | ESAI_xCCR_xCKD | ESAI_xCR_xWA; >+ ESAI_xCCR_xFSD | ESAI_xCCR_xCKD; > regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR, mask, xccr); > regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR, mask, xccr); > >diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c >index 335e1518be8c..f149c5eb57b3 100644 >--- a/sound/soc/fsl/fsl_ssi.c >+++ b/sound/soc/fsl/fsl_ssi.c >@@ -1229,6 +1229,7 @@ static int fsl_ssi_probe(struct platform_device *pdev) > struct fsl_ssi_private *ssi_private; > int ret = 0; > struct device_node *np = pdev->dev.of_node; >+ struct device_node *root; > const struct of_device_id *of_id; > const char *p, *sprop; > const uint32_t *iprop; >@@ -1373,7 +1374,9 @@ static int fsl_ssi_probe(struct platform_device *pdev) > * device tree. We also pass the address of the CPU DAI driver > * structure. > */ >- sprop = of_get_property(of_find_node_by_path("/"), "compatible", NULL); >+ root = of_find_node_by_path("/"); >+ sprop = of_get_property(root, "compatible", NULL); >+ of_node_put(root); > /* Sometimes the compatible name has a "fsl," prefix, so we strip it. */ > p = strrchr(sprop, ','); > if (p) >diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c >index 1cb22dd034eb..be14200293fc 100644 >--- a/sound/soc/fsl/imx-sgtl5000.c >+++ b/sound/soc/fsl/imx-sgtl5000.c >@@ -118,7 +118,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) > codec_dev = of_find_i2c_device_by_node(codec_np); > if (!codec_dev) { > dev_err(&pdev->dev, "failed to find codec platform device\n"); >- return -EPROBE_DEFER; >+ ret = -EPROBE_DEFER; >+ goto fail; > } > > data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); >diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c >index 6b8769a40acb..95b2df232d71 100644 >--- a/tools/lib/traceevent/event-parse.c >+++ b/tools/lib/traceevent/event-parse.c >@@ -2283,7 +2283,7 @@ static int arg_num_eval(struct print_arg *arg, long long *val) > static char *arg_eval (struct print_arg *arg) > { > long long val; >- static char buf[20]; >+ static char buf[24]; > > switch (arg->type) { > case PRINT_ATOM: >diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c >index 96592f7bfa9f..dc78aba5182e 100644 >--- a/tools/perf/util/header.c >+++ b/tools/perf/util/header.c >@@ -1009,7 +1009,7 @@ static int write_numa_topology(int fd, struct perf_header *h __maybe_unused, > if (ret < 0) > break; > >- ret = write_topo_node(fd, i); >+ ret = write_topo_node(fd, j); > if (ret < 0) > break; > } >