Linux 4.19.272
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.19.272 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/testing/sysfs-kernel-oops_count | 6 + Documentation/ABI/testing/sysfs-kernel-warn_count | 6 + Documentation/sysctl/kernel.txt | 20 +++ Makefile | 2 arch/alpha/kernel/traps.c | 6 - arch/alpha/mm/fault.c | 2 arch/arm/boot/dts/imx53-ppd.dts | 2 arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 1 arch/arm/kernel/traps.c | 2 arch/arm/mm/fault.c | 2 arch/arm/mm/nommu.c | 2 arch/arm64/kernel/traps.c | 2 arch/arm64/mm/fault.c | 2 arch/h8300/kernel/traps.c | 3 arch/h8300/mm/fault.c | 2 arch/hexagon/kernel/traps.c | 2 arch/ia64/Kconfig | 2 arch/ia64/kernel/mca_drv.c | 3 arch/ia64/kernel/traps.c | 2 arch/ia64/mm/fault.c | 2 arch/m68k/kernel/traps.c | 2 arch/m68k/mm/fault.c | 2 arch/microblaze/kernel/exceptions.c | 4 arch/mips/kernel/traps.c | 2 arch/nds32/kernel/traps.c | 8 - arch/nios2/kernel/traps.c | 4 arch/openrisc/kernel/traps.c | 2 arch/parisc/kernel/traps.c | 2 arch/powerpc/kernel/traps.c | 2 arch/riscv/kernel/traps.c | 2 arch/riscv/mm/fault.c | 2 arch/s390/kernel/dumpstack.c | 2 arch/s390/kernel/nmi.c | 2 arch/sh/kernel/traps.c | 2 arch/sparc/kernel/traps_32.c | 4 arch/sparc/kernel/traps_64.c | 4 arch/x86/entry/entry_32.S | 6 - arch/x86/entry/entry_64.S | 8 - arch/x86/kernel/dumpstack.c | 4 arch/x86/kernel/i8259.c | 1 arch/x86/kernel/irqinit.c | 4 arch/x86/lib/iomap_copy_64.S | 2 arch/xtensa/kernel/traps.c | 2 block/blk-core.c | 5 drivers/dma/dmaengine.c | 7 - drivers/dma/imx-sdma.c | 4 drivers/dma/xilinx/xilinx_dma.c | 78 +++++++++++--- drivers/edac/edac_device.c | 15 +- drivers/edac/highbank_mc_edac.c | 7 - drivers/gpu/drm/i915/intel_dp.c | 13 ++ drivers/hid/hid-betopff.c | 17 +-- drivers/hid/hid-core.c | 4 drivers/hid/intel-ish-hid/ishtp/dma-if.c | 10 + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 101 +++++++++++-------- drivers/input/mouse/synaptics.c | 1 drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 23 ++-- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 24 ++++ drivers/net/ethernet/amd/xgbe/xgbe.h | 2 drivers/net/ethernet/broadcom/tg3.c | 8 - drivers/net/ethernet/cadence/macb_main.c | 9 - drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 - drivers/net/ethernet/renesas/ravb_main.c | 4 drivers/net/phy/mdio_bus.c | 7 + drivers/net/usb/sr9700.c | 2 drivers/net/wireless/rndis_wlan.c | 19 +-- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 4 drivers/scsi/hpsa.c | 2 drivers/usb/gadget/function/f_fs.c | 7 + drivers/usb/host/xhci-plat.c | 2 drivers/w1/w1.c | 6 - drivers/w1/w1_int.c | 5 fs/affs/file.c | 2 fs/cifs/connect.c | 9 - fs/cifs/smbdirect.c | 115 ++++++++++++++++++---- fs/cifs/smbdirect.h | 5 fs/proc/proc_sysctl.c | 33 ++++++ fs/reiserfs/super.c | 6 - include/linux/kernel.h | 1 include/linux/sched/task.h | 1 include/linux/sysctl.h | 3 kernel/bpf/verifier.c | 4 kernel/exit.c | 72 +++++++++++++ kernel/module.c | 26 ++++ kernel/panic.c | 75 ++++++++++++-- kernel/sched/core.c | 3 kernel/trace/trace.c | 2 kernel/trace/trace.h | 1 kernel/trace/trace_events_hist.c | 2 kernel/trace/trace_output.c | 3 mm/kasan/report.c | 3 net/bluetooth/hci_core.c | 1 net/core/net_namespace.c | 2 net/ipv4/inet_hashtables.c | 17 ++- net/ipv4/inet_timewait_sock.c | 8 - net/ipv4/metrics.c | 2 net/ipv6/ip6_gre.c | 12 +- net/ipv6/ip6_tunnel.c | 10 + net/ipv6/sit.c | 8 - net/netfilter/nf_conntrack_proto_sctp.c | 25 +++- net/netfilter/nf_conntrack_proto_tcp.c | 10 + net/netfilter/nft_set_rbtree.c | 16 ++- net/netlink/af_netlink.c | 41 ++++--- net/netrom/nr_timer.c | 1 net/nfc/llcp_core.c | 1 net/sctp/bind_addr.c | 6 + security/tomoyo/Makefile | 2 tools/objtool/check.c | 3 tools/perf/util/env.c | 4 108 files changed, 772 insertions(+), 301 deletions(-)
Alexander Potapenko (1):
affs: initialize fsdata in affs_truncate()
Alexey V. Vissarionov (1):
scsi: hpsa: Fix allocation size for scsi_host_alloc()
Andrea Merello (1):
dmaengine: xilinx_dma: commonize DMA copy size calculation
Archie Pusaka (1):
Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
Arnaldo Carvalho de Melo (1):
perf env: Do not return pointers to local variables
Christoph Hellwig (1):
block: fix and cleanup bio_check_ro
David Christensen (1):
net/tg3: resolve deadlock in tg3_reset_task() during EEH
David Howells (1):
cifs: Fix oops due to uncleared server->smbd_conn in reconnect
Dean Luick (3):
IB/hfi1: Reject a zero-length user expected buffer IB/hfi1: Reserve user expected TIDs
IB/hfi1: Fix expected receive setup error exit issues
Dmitry Torokhov (1):
Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
Dongliang Mu (1):
fs: reiserfs: remove useless new_opts in reiserfs_remount
Eric Dumazet (5):
netlink: annotate data races around nlk->portid
netlink: annotate data races around dst_portid and dst_group
netlink: annotate data races around sk_state
ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
ipv6: ensure sane device mtu in tunnels
Eric W. Biederman (2):
exit: Add and use make_task_dead.
objtool: Add a missing comma to avoid string concatenation
Fabio Estevam (1):
ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
Florian Westphal (1):
netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
Geert Uytterhoeven (1):
ARM: dts: imx: Fix pca9547 i2c-mux node name
Giulio Benetti (1):
ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
Greg Kroah-Hartman (1):
Linux 4.19.272
Heiner Kallweit (1):
net: mdio: validate parameter addr in mdiobus_get_phy()
Hui Wang (1):
dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
Jan Beulich (1):
x86/entry/64: Add instruction suffix to SYSRET
Jann Horn (1):
exit: Put an upper limit on how often we can oops
Jason Xing (1):
tcp: avoid the lookup process failing to get sk in ehash table
Jiasheng Jiang (1):
HID: intel_ish-hid: Add check for ishtp_dma_tx_map
Jisoo Jang (1):
net: nfc: Fix use-after-free in local_cleanup()
Kees Cook (7):
exit: Expose "oops_count" to sysfs
exit: Allow oops_limit to be disabled
panic: Consolidate open-coded panic_on_warn checks
panic: Introduce warn_limit
panic: Expose "warn_count" to sysfs
docs: Fix path paste-o for /sys/kernel/warn_count
exit: Use READ_ONCE() for all oops/warn limit reads
Koba Ko (1):
dmaengine: Fix double increment of client_count in dma_chan_get()
Kuniyuki Iwashima (1):
netrom: Fix use-after-free of a listening socket.
Li RongQing (1):
netlink: remove hash::nelems check in netlink_insert
Linus Torvalds (1):
drm/i915/display: fix compiler warning about array overrun
Liu Shixin (1):
dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
Long Li (1):
smbd: Make upper layer decide when to destroy the transport
Luis Gerhorst (1):
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
Manivannan Sadhasivam (1):
EDAC/device: Respect any driver-supplied workqueue polling value
Marcelo Ricardo Leitner (1):
sctp: fail if no bound addresses can be used for a given scope
Masahiro Yamada (1):
tomoyo: fix broken dependency on *.conf.default
Miaoqian Lin (1):
EDAC/highbank: Fix memory leak in highbank_mc_probe()
Mikulas Patocka (1):
x86/asm: Fix an assembler warning with current binutils
Natalia Petrova (1):
trace_events_hist: add check for return value of 'create_hist_field'
Nathan Chancellor (2):
hexagon: Fix function name in die()
h8300: Fix build errors from do_exit() to make_task_dead() transition
Pablo Neira Ayuso (1):
netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
Paolo Abeni (1):
net: fix UaF in netns ops registration error path
Peter Chen (1):
usb: host: xhci-plat: add wakeup entry at sysfs
Petr Pavlu (1):
module: Don't wait for GOING modules
Pietro Borrello (2):
HID: check empty report_list in hid_validate_values()
HID: betop: check shape of output reports
Radhey Shyam Pandey (1):
dmaengine: xilinx_dma: program hardware supported buffer length
Raju Rangoju (2):
amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
amd-xgbe: Delay AN timeout during KR training
Randy Dunlap (2):
net: mlx5: eliminate anonymous module_init & module_exit
ia64: make IA64_MCA_RECOVERY bool instead of tristate
Robert Hancock (1):
net: macb: fix PTP TX timestamp failure due to packet padding
Shang XiaoJing (1):
phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
Sriram Yagnaraman (1):
netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
Steven Rostedt (Google) (1):
tracing: Make sure trace_printk() can output as soon as it can be used
Swati Agarwal (1):
dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
Szymon Heidrich (2):
wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
net: usb: sr9700: Handle negative len
Thomas Gleixner (1):
x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
Tiezhu Yang (1):
panic: unset panic_on_warn inside panic()
Udipto Goswami (2):
usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
Xiaoming Ni (1):
sysctl: add a new register_sysctl_init() interface
Yang Yingliang (2):
w1: fix deadloop in __w1_remove_master_device()
w1: fix WARNING after calling w1_process()
Yoshihiro Shimoda (1):
net: ravb: Fix possible hang if RIS2_QFF1 happen
Greg Kroah-Hartman
maintainerDocumentation/ABI/testing/sysfs-kernel-oops_count new file +6 -0
@@ -0,0 +1,6 @@ +What: /sys/kernel/oops_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List <[email protected]> +Description: + Shows how many times the system has Oopsed since last boot.
Documentation/ABI/testing/sysfs-kernel-warn_count new file +6 -0
@@ -0,0 +1,6 @@ +What: /sys/kernel/warn_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List <[email protected]> +Description: + Shows how many times the system has Warned since last boot.
Documentation/sysctl/kernel.txt +20 -0
@@ -51,6 +51,7 @@ show up in /proc/sys/kernel: - msgmnb - msgmni - nmi_watchdog +- oops_limit - osrelease - ostype - overflowgid
@@ -96,6 +97,7 @@ show up in /proc/sys/kernel: - threads-max - unprivileged_bpf_disabled - unknown_nmi_panic +- warn_limit - watchdog - watchdog_thresh - version
@@ -555,6 +557,15 @@ scanned for a given scan. ============================================================== +oops_limit: + +Number of kernel oopses after which the kernel should panic when +``panic_on_oops`` is not set. Setting this to 0 disables checking +the count. Setting this to 1 has the same effect as setting +``panic_on_oops=1``. The default value is 10000. + +============================================================== + osrelease, ostype & version: # cat osrelease
@@ -1104,6 +1115,15 @@ example. If a system hangs up, try pressing the NMI switch. ============================================================== +warn_limit: + +Number of kernel warnings after which the kernel should panic when +``panic_on_warn`` is not set. Setting this to 0 disables checking +the warning count. Setting this to 1 has the same effect as setting +``panic_on_warn=1``. The default value is 0. + +============================================================== + watchdog: This parameter can be used to disable or enable the soft lockup detector
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 19 -SUBLEVEL = 271 +SUBLEVEL = 272 EXTRAVERSION = NAME = "People's Front"
arch/alpha/kernel/traps.c +3 -3
@@ -192,7 +192,7 @@ die_if_kernel(char * str, struct pt_regs *regs, long err, unsigned long *r9_15)local_irq_enable ();while (1 ); } -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }#ifndef CONFIG_MATHEMU
@@ -577,7 +577,7 @@ do_entUna(void * va, unsigned long opcode, unsigned long reg,printk ("Bad unaligned kernel access at %016lx: %p %lx %lu\n" , pc, va, opcode, reg); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); got_exception:/* Ok, we caught the exception, but we don't want it. Is there
@@ -632,7 +632,7 @@ do_entUna(void * va, unsigned long opcode, unsigned long reg,local_irq_enable ();while (1 ); } -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }/*
arch/alpha/mm/fault.c +1 -1
@@ -206,7 +206,7 @@ do_page_fault(unsigned long address, unsigned long mmcsr,printk (KERN_ALERT "Unable to handle kernel paging request at " "virtual address %016lx\n" , address);die_if_kernel ("Oops" , regs, cause, (unsigned long *)regs -16 ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL );/* We ran out of memory, or some other thing happened to us that made us unable to handle the page fault gracefully. */
arch/arm/boot/dts/imx53-ppd.dts +1 -1
@@ -462,7 +462,7 @@ scl-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>; status = "okay"; - i2c-switch@70 { + i2c-mux@70 { compatible = "nxp,pca9547"; #address-cells = <1>; #size-cells = <0>;
arch/arm/boot/dts/imx6qdl-gw560x.dtsi +0 -1
@@ -463,7 +463,6 @@ &uart1 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_uart1>; - uart-has-rtscts; rts-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>; status = "okay"; };
arch/arm/kernel/traps.c +1 -1
@@ -344,7 +344,7 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, int signr)if (panic_on_oops)panic ("Fatal exception" );if (signr) -do_exit (signr); +make_task_dead (signr); }/*
arch/arm/mm/fault.c +1 -1
@@ -149,7 +149,7 @@ __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,show_pte (mm, addr);die ("Oops" , regs, fsr);bust_spinlocks (0 ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL ); }/*
arch/arm/mm/nommu.c +1 -1
@@ -160,7 +160,7 @@ void __init paging_init(const struct machine_desc *mdesc)mpu_setup ();/* allocate the zero page. */ - zero_page =memblock_alloc (PAGE_SIZE ,PAGE_SIZE ); + zero_page = (void *)memblock_alloc (PAGE_SIZE ,PAGE_SIZE );if (!zero_page)panic ("%s: Failed to allocate %lu bytes align=0x%lx\n" , __func__,PAGE_SIZE ,PAGE_SIZE );
arch/arm64/kernel/traps.c +1 -1
@@ -224,7 +224,7 @@ void die(const char *str, struct pt_regs *regs, int err)raw_spin_unlock_irqrestore (&die_lock, flags);if (ret !=NOTIFY_STOP ) -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }static bool show_unhandled_signals_ratelimited (void )
arch/arm64/mm/fault.c +1 -1
@@ -268,7 +268,7 @@ static void die_kernel_fault(const char *msg, unsigned long addr,show_pte (addr);die ("Oops" , regs, esr);bust_spinlocks (0 ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL ); } static void __do_kernel_fault(unsigned long addr, unsigned int esr,
arch/h8300/kernel/traps.c +2 -1
@@ -17,6 +17,7 @@#include <linux/types.h> #include <linux/sched.h> #include <linux/sched/debug.h> +#include <linux/sched/task.h> #include <linux/mm_types.h> #include <linux/kernel.h> #include <linux/errno.h>
@@ -110,7 +111,7 @@ void die(const char *str, struct pt_regs *fp, unsigned long err)dump (fp);spin_unlock_irq (&die_lock); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }static int kstack_depth_to_print =24 ;
arch/h8300/mm/fault.c +1 -1
@@ -52,7 +52,7 @@ asmlinkage int do_page_fault(struct pt_regs *regs, unsigned long address,printk (" at virtual address %08lx\n" , address);if (!user_mode (regs))die ("Oops" , regs, error_code); -do_exit (SIGKILL ); +make_task_dead (SIGKILL );return 1 ; }
arch/hexagon/kernel/traps.c +1 -1
@@ -234,7 +234,7 @@ int die(const char *str, struct pt_regs *regs, long err)panic ("Fatal exception" );oops_exit (); -do_exit (err); +make_task_dead (err);return 0 ; }
arch/ia64/Kconfig +1 -1
@@ -445,7 +445,7 @@ config ARCH_PROC_KCORE_TEXT depends on PROC_KCORE config IA64_MCA_RECOVERY - tristate "MCA recovery from errors other than TLB." + bool "MCA recovery from errors other than TLB." config PERFMON bool "Performance monitor support"
arch/ia64/kernel/mca_drv.c +2 -1
@@ -11,6 +11,7 @@#include <linux/types.h> #include <linux/init.h> #include <linux/sched.h> +#include <linux/sched/task.h> #include <linux/interrupt.h> #include <linux/irq.h> #include <linux/kallsyms.h>
@@ -176,7 +177,7 @@ mca_handler_bh(unsigned long paddr, void *iip, unsigned long ipsr)spin_unlock (&mca_bh_lock);/* This process is about to be killed itself */ -do_exit (SIGKILL ); +make_task_dead (SIGKILL ); }/**
arch/ia64/kernel/traps.c +1 -1
@@ -85,7 +85,7 @@ die (const char *str, struct pt_regs *regs, long err)if (panic_on_oops)panic ("Fatal exception" ); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV );return 0 ; }
arch/ia64/mm/fault.c +1 -1
@@ -302,7 +302,7 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re regs =NULL ;bust_spinlocks (0 );if (regs) -do_exit (SIGKILL ); +make_task_dead (SIGKILL );return ; out_of_memory:
arch/m68k/kernel/traps.c +1 -1
@@ -1139,7 +1139,7 @@ void die_if_kernel (char *str, struct pt_regs *fp, int nr)pr_crit ("%s: %08x\n" , str, nr);show_registers (fp);add_taint (TAINT_DIE ,LOCKDEP_NOW_UNRELIABLE ); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); } asmlinkage void set_esp0(unsigned long ssp)
arch/m68k/mm/fault.c +1 -1
@@ -48,7 +48,7 @@ int send_fault_sig(struct pt_regs *regs)pr_alert ("Unable to handle kernel access" );pr_cont (" at virtual address %p\n" , addr);die_if_kernel ("Oops" , regs,0 /*error_code*/ ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL ); }return 1 ;
arch/microblaze/kernel/exceptions.c +2 -2
@@ -44,10 +44,10 @@ void die(const char *str, struct pt_regs *fp, long err)pr_warn ("Oops: %s, sig: %ld\n" , str, err);show_regs (fp);spin_unlock_irq (&die_lock); -/* do_exit() should take care of panic'ing from an interrupt +/* make_task_dead() should take care of panic'ing from an interrupt * context so we don't handle it here */ -do_exit (err); +make_task_dead (err); }/* for user application debugging */
arch/mips/kernel/traps.c +1 -1
@@ -412,7 +412,7 @@ void __noreturn die(const char *str, struct pt_regs *regs)if (regs &&kexec_should_crash (current))crash_kexec (regs); -do_exit (sig); +make_task_dead (sig); }extern struct exception_table_entry __start___dbe_table[];
arch/nds32/kernel/traps.c +4 -4
@@ -183,7 +183,7 @@ void die(const char *str, struct pt_regs *regs, int err)bust_spinlocks (0 );spin_unlock_irq (&die_lock); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }EXPORT_SYMBOL (die);
@@ -286,7 +286,7 @@ void unhandled_interruption(struct pt_regs *regs)pr_emerg ("unhandled_interruption\n" );show_regs (regs);if (!user_mode (regs)) -do_exit (SIGKILL ); +make_task_dead (SIGKILL );force_sig (SIGKILL , current); }
@@ -297,7 +297,7 @@ void unhandled_exceptions(unsigned long entry, unsigned long addr, addr, type);show_regs (regs);if (!user_mode (regs)) -do_exit (SIGKILL ); +make_task_dead (SIGKILL );force_sig (SIGKILL , current); }
@@ -324,7 +324,7 @@ void do_revinsn(struct pt_regs *regs)pr_emerg ("Reserved Instruction\n" );show_regs (regs);if (!user_mode (regs)) -do_exit (SIGILL ); +make_task_dead (SIGILL );force_sig (SIGILL , current); }
arch/nios2/kernel/traps.c +2 -2
@@ -37,10 +37,10 @@ void die(const char *str, struct pt_regs *regs, long err)show_regs (regs);spin_unlock_irq (&die_lock);/* -* do_exit() should take care of panic'ing from an interrupt +* make_task_dead() should take care of panic'ing from an interrupt * context so we don't handle it here */ -do_exit (err); +make_task_dead (err); }void _exception (int signo,struct pt_regs *regs,int code,unsigned long addr)
arch/openrisc/kernel/traps.c +1 -1
@@ -224,7 +224,7 @@ void die(const char *str, struct pt_regs *regs, long err) __asm__ __volatile__("l.nop 1" );do {}while (1 );#endif -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }/* This is normally the 'Oops' routine */
arch/parisc/kernel/traps.c +1 -1
@@ -265,7 +265,7 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)panic ("Fatal exception" );oops_exit (); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }/* gdb uses break 4,8 */
arch/powerpc/kernel/traps.c +1 -1
@@ -251,7 +251,7 @@ static void oops_end(unsigned long flags, struct pt_regs *regs,panic ("Fatal exception in interrupt" );if (panic_on_oops)panic ("Fatal exception" ); -do_exit (signr); +make_task_dead (signr); }NOKPROBE_SYMBOL (oops_end);
arch/riscv/kernel/traps.c +1 -1
@@ -64,7 +64,7 @@ void die(struct pt_regs *regs, const char *str)if (panic_on_oops)panic ("Fatal exception" );if (ret !=NOTIFY_STOP ) -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); } void do_trap(struct pt_regs *regs, int signo, int code,
arch/riscv/mm/fault.c +1 -1
@@ -200,7 +200,7 @@ asmlinkage void do_page_fault(struct pt_regs *regs) (addr <PAGE_SIZE ) ?"NULL pointer dereference" : "paging request", addr);die (regs,"Oops" ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL );/* * We ran out of memory, call the OOM killer, and return the userspace
arch/s390/kernel/dumpstack.c +1 -1
@@ -187,5 +187,5 @@ void die(struct pt_regs *regs, const char *str)if (panic_on_oops)panic ("Fatal exception: panic_on_oops" );oops_exit (); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }
arch/s390/kernel/nmi.c +1 -1
@@ -179,7 +179,7 @@ void s390_handle_mcck(void) "malfunction (code 0x%016lx).\n", mcck.mcck_code);printk (KERN_EMERG "mcck: task: %s, pid: %d.\n" , current->comm, current->pid); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); } }EXPORT_SYMBOL_GPL (s390_handle_mcck);
arch/sh/kernel/traps.c +1 -1
@@ -57,7 +57,7 @@ void die(const char *str, struct pt_regs *regs, long err)if (panic_on_oops)panic ("Fatal exception" ); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }void die_if_kernel (const char *str,struct pt_regs *regs,long err)
arch/sparc/kernel/traps_32.c +1 -3
@@ -86,9 +86,7 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs) }printk ("Instruction DUMP:" );instruction_dump ((unsigned long *) regs->pc); -if (regs->psr &PSR_PS ) -do_exit (SIGKILL ); -do_exit (SIGSEGV ); +make_task_dead ((regs->psr &PSR_PS ) ?SIGKILL :SIGSEGV ); }void do_hw_interrupt (struct pt_regs *regs,unsigned long type)
arch/sparc/kernel/traps_64.c +1 -3
@@ -2565,9 +2565,7 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs) }if (panic_on_oops)panic ("Fatal exception" ); -if (regs->tstate &TSTATE_PRIV ) -do_exit (SIGKILL ); -do_exit (SIGSEGV ); +make_task_dead ((regs->tstate &TSTATE_PRIV )?SIGKILL :SIGSEGV ); }EXPORT_SYMBOL (die_if_kernel);
arch/x86/entry/entry_32.S +3 -3
@@ -1500,13 +1500,13 @@ ENTRY(async_page_fault) END(async_page_fault) #endif -ENTRY(rewind_stack_do_exit) +ENTRY(rewind_stack_and_make_dead) /* Prevent any naive code from trying to unwind to our caller. */ xorl %ebp, %ebp movl PER_CPU_VAR(cpu_current_top_of_stack), %esi leal -TOP_OF_KERNEL_STACK_PADDING-PTREGS_SIZE(%esi), %esp - call do_exit + call make_task_dead 1: jmp 1b -END(rewind_stack_do_exit) +END(rewind_stack_and_make_dead)
arch/x86/entry/entry_64.S +4 -4
@@ -1759,10 +1759,10 @@ END(nmi) ENTRY(ignore_sysret) UNWIND_HINT_EMPTY mov $-ENOSYS, %eax - sysret + sysretl END(ignore_sysret) -ENTRY(rewind_stack_do_exit) +ENTRY(rewind_stack_and_make_dead) UNWIND_HINT_FUNC /* Prevent any naive code from trying to unwind to our caller. */ xorl %ebp, %ebp
@@ -1771,5 +1771,5 @@ ENTRY(rewind_stack_do_exit) leaq -PTREGS_SIZE(%rax), %rsp UNWIND_HINT_REGS - call do_exit -END(rewind_stack_do_exit) + call make_task_dead +END(rewind_stack_and_make_dead)
arch/x86/kernel/dumpstack.c +2 -2
@@ -326,7 +326,7 @@ unsigned long oops_begin(void) }NOKPROBE_SYMBOL (oops_begin); -void __noreturn rewind_stack_do_exit (int signr); +void __noreturn rewind_stack_and_make_dead (int signr);void oops_end (unsigned long flags,struct pt_regs *regs,int signr) {
@@ -361,7 +361,7 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)* reuse the task stack and that existing poisons are invalid. */ kasan_unpoison_task_stack (current); -rewind_stack_do_exit (signr); +rewind_stack_and_make_dead (signr); }NOKPROBE_SYMBOL (oops_end);
arch/x86/kernel/i8259.c +1 -0
@@ -114,6 +114,7 @@ static void make_8259A_irq(unsigned int irq)disable_irq_nosync (irq); io_apic_irqs &= ~(1 <<irq);irq_set_chip_and_handler (irq, &i8259A_chip, handle_level_irq); +irq_set_status_flags (irq,IRQ_LEVEL );enable_irq (irq);lapic_assign_legacy_vector (irq, true); }
arch/x86/kernel/irqinit.c +3 -1
@@ -72,8 +72,10 @@ void __init init_ISA_irqs(void) legacy_pic->init (0 ); -for (i =0 ; i <nr_legacy_irqs (); i++) +for (i =0 ; i <nr_legacy_irqs (); i++) {irq_set_chip_and_handler (i, chip, handle_level_irq); +irq_set_status_flags (i,IRQ_LEVEL ); + } }void __init init_IRQ (void )
arch/x86/lib/iomap_copy_64.S +1 -1
@@ -22,6 +22,6 @@ */ ENTRY(__iowrite32_copy) movl %edx,%ecx - rep movsd + rep movsl ret ENDPROC(__iowrite32_copy)
arch/xtensa/kernel/traps.c +1 -1
@@ -542,5 +542,5 @@ void die(const char * str, struct pt_regs * regs, long err)if (panic_on_oops)panic ("Fatal exception" ); -do_exit (err); +make_task_dead (err); }
block/blk-core.c +1 -4
@@ -2179,10 +2179,7 @@ static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)if (op_is_flush (bio->bi_opf) && !bio_sectors (bio))return false; - -WARN_ONCE (1 , -"generic_make_request: Trying to write " -"to read-only block-device %s (partno %d)\n" , +pr_warn ("Trying to write to read-only block-device %s (partno %d)\n" ,bio_devname (bio, b), part->partno);/* Older lvm-tools actually trigger this */ return false;
drivers/dma/dmaengine.c +4 -3
@@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan)/* The channel is already in use, update client count */ if (chan->client_count) {__module_get (owner); - goto out; + chan->client_count++; +return 0 ; }if (!try_module_get (owner))
@@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; +if (!dma_has_cap (DMA_PRIVATE , chan->device->cap_mask))balance_ref_count (chan); -out: - chan->client_count++;return 0 ; err_out:
drivers/dma/imx-sdma.c +3 -1
@@ -1347,10 +1347,12 @@ static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac,sdma_config_ownership (sdmac, false, true, false);if (sdma_load_context (sdmac)) - goto err_desc_out; + goto err_bd_out;return desc; +err_bd_out: +sdma_free_bd (desc); err_desc_out:kfree (desc); err_out:
drivers/dma/xilinx/xilinx_dma.c +60 -18
169 lines not on this page · raw message
drivers/edac/edac_device.c +7 -8
@@ -34,6 +34,9 @@static DEFINE_MUTEX (device_ctls_mutex);static LIST_HEAD (edac_device_list); +/* Default workqueue processing interval on this instance, in msecs */ +#define DEFAULT_POLL_INTERVAL 1000 +#ifdef CONFIG_EDAC_DEBUG static void edac_device_dump_device (struct edac_device_ctl_info *edac_dev) {
@@ -366,7 +369,7 @@ static void edac_device_workq_function(struct work_struct *work_req)* whole one second to save timers firing all over the period * between integral seconds */ -if (edac_dev->poll_msec ==1000 ) +if (edac_dev->poll_msec ==DEFAULT_POLL_INTERVAL )edac_queue_work (&edac_dev->work,round_jiffies_relative (edac_dev->delay));else edac_queue_work (&edac_dev->work, edac_dev->delay);
@@ -396,7 +399,7 @@ static void edac_device_workq_setup(struct edac_device_ctl_info *edac_dev,* timers firing on sub-second basis, while they are happy * to fire together on the 1 second exactly */ -if (edac_dev->poll_msec ==1000 ) +if (edac_dev->poll_msec ==DEFAULT_POLL_INTERVAL )edac_queue_work (&edac_dev->work,round_jiffies_relative (edac_dev->delay));else edac_queue_work (&edac_dev->work, edac_dev->delay);
@@ -430,7 +433,7 @@ void edac_device_reset_delay_period(struct edac_device_ctl_info *edac_dev, edac_dev->delay =msecs_to_jiffies (msec);/* See comment in edac_device_workq_setup() above */ -if (edac_dev->poll_msec ==1000 ) +if (edac_dev->poll_msec ==DEFAULT_POLL_INTERVAL )edac_mod_work (&edac_dev->work,round_jiffies_relative (edac_dev->delay));else edac_mod_work (&edac_dev->work, edac_dev->delay);
@@ -472,11 +475,7 @@ int edac_device_add_device(struct edac_device_ctl_info *edac_dev)/* This instance is NOW RUNNING */ edac_dev->op_state =OP_RUNNING_POLL ; -/* -* enable workq processing on this instance, -* default = 1000 msec -*/ -edac_device_workq_setup (edac_dev,1000 ); +edac_device_workq_setup (edac_dev, edac_dev->poll_msec ?:DEFAULT_POLL_INTERVAL ); }else { edac_dev->op_state =OP_RUNNING_INTERRUPT ; }
drivers/edac/highbank_mc_edac.c +5 -2
@@ -185,8 +185,10 @@ static int highbank_mc_probe(struct platform_device *pdev) drvdata = mci->pvt_info;platform_set_drvdata (pdev, mci); -if (!devres_open_group (&pdev->dev,NULL ,GFP_KERNEL )) -return -ENOMEM ; +if (!devres_open_group (&pdev->dev,NULL ,GFP_KERNEL )) { + res = -ENOMEM ; + goto free; + } r =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!r) {
@@ -254,6 +256,7 @@ static int highbank_mc_probe(struct platform_device *pdev)edac_mc_del_mc (&pdev->dev); err:devres_release_group (&pdev->dev,NULL ); +free:edac_mc_free (mci);return res; }
drivers/gpu/drm/i915/intel_dp.c +12 -1
@@ -4116,7 +4116,18 @@ intel_dp_check_mst_status(struct intel_dp *intel_dp)bool bret;if (intel_dp->is_mst) { -u8 esi[DP_DPRX_ESI_LEN ] = {0 }; +/* +* The +2 is because DP_DPRX_ESI_LEN is 14, but we then +* pass in "esi+10" to drm_dp_channel_eq_ok(), which +* takes a 6-byte array. So we actually need 16 bytes +* here. +* +* Somebody who knows what the limits actually are +* should check this, but for now this is at least +* harmless and avoids a valid compiler warning about +* using more of the array than we have allocated. +*/ +u8 esi[DP_DPRX_ESI_LEN +2 ] = {0 };int ret =0 ;int retry;bool handled;
drivers/hid/hid-betopff.c +9 -8
@@ -63,7 +63,6 @@ static int betopff_init(struct hid_device *hid)struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT ].report_list;struct input_dev *dev; -int field_count =0 ;int error;int i, j;
@@ -89,19 +88,21 @@ static int betopff_init(struct hid_device *hid)* ----------------------------------------- * Do init them with default value. */ +if (report->maxfield <4 ) { +hid_err (hid,"not enough fields in the report: %d\n" , + report->maxfield); +return -ENODEV ; + }for (i =0 ; i < report->maxfield; i++) { +if (report->field[i]->report_count <1 ) { +hid_err (hid,"no values in the field\n" ); +return -ENODEV ; + }for (j =0 ; j < report->field[i]->report_count; j++) { report->field[i]->value[j] =0x00 ; - field_count++; } } -if (field_count <4 ) { -hid_err (hid,"not enough fields in the report: %d\n" , - field_count); -return -ENODEV ; - } - betopff =kzalloc (sizeof (*betopff),GFP_KERNEL );if (!betopff)return -ENOMEM ;
drivers/hid/hid-core.c +2 -2
@@ -980,8 +980,8 @@ struct hid_report *hid_validate_values(struct hid_device *hid,* Validating on id 0 means we should examine the first * report in the list. */ - report =list_entry ( - hid->report_enum[type].report_list.next, + report =list_first_entry_or_null ( + &hid->report_enum[type].report_list, struct hid_report, list); }else { report = hid->report_enum[type].report_id_hash[id];
drivers/hid/intel-ish-hid/ishtp/dma-if.c +10 -0
@@ -113,6 +113,11 @@ void *ishtp_cl_get_dma_send_buf(struct ishtp_device *dev,int required_slots = (size /DMA_SLOT_SIZE ) +1 * (size %DMA_SLOT_SIZE !=0 ); +if (!dev->ishtp_dma_tx_map) { +dev_err (dev->devc,"Fail to allocate Tx map\n" ); +return NULL ; + } +spin_lock_irqsave (&dev->ishtp_dma_tx_lock, flags);for (i =0 ; i <= (dev->ishtp_dma_num_slots - required_slots); i++) { free =1 ;
@@ -159,6 +164,11 @@ void ishtp_cl_release_dma_acked_mem(struct ishtp_device *dev,return ; } +if (!dev->ishtp_dma_tx_map) { +dev_err (dev->devc,"Fail to allocate Tx map\n" ); +return ; + } + i = (msg_addr - dev->ishtp_host_dma_tx_buf) /DMA_SLOT_SIZE ;spin_lock_irqsave (&dev->ishtp_dma_tx_lock, flags);for (j =0 ; j < acked_slots; j++) {
drivers/infiniband/hw/hfi1/user_exp_rcv.c +59 -42
148 lines not on this page · raw message
drivers/input/mouse/synaptics.c +0 -1
@@ -192,7 +192,6 @@ static const char * const smbus_pnp_ids[] = {"SYN3221" ,/* HP 15-ay000 */ "SYN323d" ,/* HP Spectre X360 13-w013dx */ "SYN3257" ,/* HP Envy 13-ad105ng */ -"SYN3286" ,/* HP Laptop 15-da3001TU */ NULL };
drivers/net/ethernet/amd/xgbe/xgbe-dev.c +15 -8
@@ -524,19 +524,28 @@ static void xgbe_disable_vxlan(struct xgbe_prv_data *pdata)netif_dbg (pdata, drv, pdata->netdev,"VXLAN acceleration disabled\n" ); } +static unsigned int xgbe_get_fc_queue_count (struct xgbe_prv_data *pdata) +{ +unsigned int max_q_count =XGMAC_MAX_FLOW_CONTROL_QUEUES ; + +/* From MAC ver 30H the TFCR is per priority, instead of per queue */ +if (XGMAC_GET_BITS (pdata->hw_feat.version,MAC_VR ,SNPSVER ) >=0x30 ) +return max_q_count; +else + return min_t(unsigned int, pdata->tx_q_count, max_q_count); +} +static int xgbe_disable_tx_flow_control (struct xgbe_prv_data *pdata) { -unsigned int max_q_count, q_count;unsigned int reg, reg_val; -unsigned int i; +unsigned int i, q_count;/* Clear MTL flow control */ for (i =0 ; i < pdata->rx_q_count; i++)XGMAC_MTL_IOWRITE_BITS (pdata, i,MTL_Q_RQOMR ,EHFC ,0 );/* Clear MAC flow control */ - max_q_count =XGMAC_MAX_FLOW_CONTROL_QUEUES ; - q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count); + q_count =xgbe_get_fc_queue_count (pdata); reg =MAC_Q0TFCR ;for (i =0 ; i < q_count; i++) { reg_val =XGMAC_IOREAD (pdata, reg);
@@ -553,9 +562,8 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata) {struct ieee_pfc *pfc = pdata->pfc;struct ieee_ets *ets = pdata->ets; -unsigned int max_q_count, q_count;unsigned int reg, reg_val; -unsigned int i; +unsigned int i, q_count;/* Set MTL flow control */ for (i =0 ; i < pdata->rx_q_count; i++) {
@@ -579,8 +587,7 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata) }/* Set MAC flow control */ - max_q_count =XGMAC_MAX_FLOW_CONTROL_QUEUES ; - q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count); + q_count =xgbe_get_fc_queue_count (pdata); reg =MAC_Q0TFCR ;for (i =0 ; i < q_count; i++) { reg_val =XGMAC_IOREAD (pdata, reg);
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +24 -0
@@ -496,6 +496,7 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata, reg |=XGBE_KR_TRAINING_ENABLE ; reg |=XGBE_KR_TRAINING_START ;XMDIO_WRITE (pdata,MDIO_MMD_PMAPMD ,MDIO_PMA_10GBR_PMD_CTRL , reg); + pdata->kr_start_time = jiffies;netif_dbg (pdata, link, pdata->netdev,"KR training initiated\n" );
@@ -632,6 +633,8 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata)xgbe_switch_mode (pdata); + pdata->an_result =XGBE_AN_READY ; +xgbe_an_restart (pdata);return XGBE_AN_INCOMPAT_LINK ;
@@ -1275,9 +1278,30 @@ static bool xgbe_phy_aneg_done(struct xgbe_prv_data *pdata)static void xgbe_check_link_timeout (struct xgbe_prv_data *pdata) {unsigned long link_timeout; +unsigned long kr_time; +int wait; link_timeout = pdata->link_check + (XGBE_LINK_TIMEOUT *HZ );if (time_after (jiffies, link_timeout)) { +if ((xgbe_cur_mode (pdata) ==XGBE_MODE_KR ) && + pdata->phy.autoneg ==AUTONEG_ENABLE ) { +/* AN restart should not happen while KR training is in progress. +* The while loop ensures no AN restart during KR training, +* waits up to 500ms and AN restart is triggered only if KR +* training is failed. +*/ + wait =XGBE_KR_TRAINING_WAIT_ITER ; +while (wait--) { + kr_time = pdata->kr_start_time + +msecs_to_jiffies (XGBE_AN_MS_TIMEOUT ); +if (time_after (jiffies, kr_time)) +break ; +/* AN restart is not required, if AN result is COMPLETE */ +if (pdata->an_result ==XGBE_AN_COMPLETE ) +return ; +usleep_range (10000 ,11000 ); + } + }netif_dbg (pdata, link, pdata->netdev,"AN link timeout\n" );xgbe_phy_config_aneg (pdata); }
drivers/net/ethernet/amd/xgbe/xgbe.h +2 -0
@@ -290,6 +290,7 @@/* Auto-negotiation */ #define XGBE_AN_MS_TIMEOUT 500#define XGBE_LINK_TIMEOUT 5 +#define XGBE_KR_TRAINING_WAIT_ITER 50#define XGBE_SGMII_AN_LINK_STATUS BIT(1)#define XGBE_SGMII_AN_LINK_SPEED (BIT(2) | BIT(3))
@@ -1266,6 +1267,7 @@ struct xgbe_prv_data {unsigned int parallel_detect;unsigned int fec_ability;unsigned long an_start; +unsigned long kr_start_time;enum xgbe_an_mode an_mode;/* I2C support */
drivers/net/ethernet/broadcom/tg3.c +4 -4
@@ -11189,7 +11189,7 @@ static void tg3_reset_task(struct work_struct *work)rtnl_lock ();tg3_full_lock (tp,0 ); -if (!netif_running (tp->dev)) { +if (tp->pcierr_recovery || !netif_running (tp->dev)) {tg3_flag_clear (tp,RESET_TASK_PENDING );tg3_full_unlock (tp);rtnl_unlock ();
@@ -18240,6 +18240,9 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,netdev_info (netdev,"PCI I/O error detected\n" ); +/* Want to make sure that the reset task doesn't run */ +tg3_reset_task_cancel (tp); +rtnl_lock ();/* Could be second call or maybe we don't have netdev yet */
@@ -18256,9 +18259,6 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,tg3_timer_stop (tp); -/* Want to make sure that the reset task doesn't run */ -tg3_reset_task_cancel (tp); -netif_device_detach (netdev);/* Clean up software state, even if MMIO is blocked */
drivers/net/ethernet/cadence/macb_main.c +1 -8
@@ -1738,7 +1738,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)bool cloned =skb_cloned (*skb) ||skb_header_cloned (*skb) ||skb_is_nonlinear (*skb);int padlen =ETH_ZLEN - (*skb)->len; -int headroom =skb_headroom (*skb);int tailroom =skb_tailroom (*skb);struct sk_buff *nskb;u32 fcs;
@@ -1752,9 +1751,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)/* FCS could be appeded to tailroom. */ if (tailroom >=ETH_FCS_LEN ) goto add_fcs; -/* FCS could be appeded by moving data to headroom. */ -else if (!cloned && headroom + tailroom >=ETH_FCS_LEN ) - padlen =0 ;/* No room for FCS, need to reallocate skb. */ else padlen =ETH_FCS_LEN ;
@@ -1763,10 +1759,7 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) padlen +=ETH_FCS_LEN ; } -if (!cloned && headroom + tailroom >= padlen) { - (*skb)->data =memmove ((*skb)->head, (*skb)->data, (*skb)->len); -skb_set_tail_pointer (*skb, (*skb)->len); - }else { +if (cloned || tailroom < padlen) { nskb =skb_copy_expand (*skb,0 , padlen,GFP_ATOMIC );if (!nskb)return -ENOMEM ;
drivers/net/ethernet/mellanox/mlx5/core/main.c +4 -4
@@ -1683,7 +1683,7 @@ static void mlx5_core_verify_params(void) } } -static int __init init (void ) +static int __init mlx5_init (void ) {int err;
@@ -1708,7 +1708,7 @@ static int __init init(void)return err; } -static void __exit cleanup(void) +static void __exit mlx5_cleanup(void) {#ifdef CONFIG_MLX5_CORE_EN mlx5e_cleanup ();
@@ -1717,5 +1717,5 @@ static void __exit cleanup(void)mlx5_unregister_debugfs (); } -module_init (init); -module_exit (cleanup); +module_init (mlx5_init); +module_exit (mlx5_cleanup);
drivers/net/ethernet/renesas/ravb_main.c +2 -2
@@ -738,14 +738,14 @@ static void ravb_error_interrupt(struct net_device *ndev)ravb_write (ndev, ~(EIS_QFS |EIS_RESERVED ),EIS );if (eis &EIS_QFS ) { ris2 =ravb_read (ndev,RIS2 ); -ravb_write (ndev, ~(RIS2_QFF0 |RIS2_RFFF |RIS2_RESERVED ), +ravb_write (ndev, ~(RIS2_QFF0 |RIS2_QFF1 |RIS2_RFFF |RIS2_RESERVED ),RIS2 );/* Receive Descriptor Empty int */ if (ris2 &RIS2_QFF0 ) priv->stats[RAVB_BE ].rx_over_errors++; -/* Receive Descriptor Empty int */ +/* Receive Descriptor Empty int */ if (ris2 &RIS2_QFF1 ) priv->stats[RAVB_NC ].rx_over_errors++;
drivers/net/phy/mdio_bus.c +6 -1
@@ -103,7 +103,12 @@ EXPORT_SYMBOL(mdiobus_unregister_device);struct phy_device *mdiobus_get_phy (struct mii_bus *bus,int addr) { -struct mdio_device *mdiodev = bus->mdio_map[addr]; +struct mdio_device *mdiodev; + +if (addr <0 || addr >=ARRAY_SIZE (bus->mdio_map)) +return NULL ; + + mdiodev = bus->mdio_map[addr];if (!mdiodev)return NULL ;
drivers/net/usb/sr9700.c +1 -1
@@ -410,7 +410,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)/* ignore the CRC length */ len = (skb->data[1 ] | (skb->data[2 ] <<8 )) -4 ; -if (len >ETH_FRAME_LEN || len > skb->len) +if (len >ETH_FRAME_LEN || len > skb->len || len <0 )return 0 ;/* the last packet of current skb */
drivers/net/wireless/rndis_wlan.c +6 -13
@@ -712,8 +712,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len)struct rndis_query *get;struct rndis_query_c *get_c; } u; -int ret, buflen; -int resplen, respoffs, copylen; +int ret; +size_t buflen, resplen, respoffs, copylen; buflen = *len +sizeof (*u.get);if (buflen <CONTROL_BUFFER_SIZE )
@@ -748,22 +748,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len)if (respoffs > buflen) {/* Device returned data offset outside buffer, error. */ -netdev_dbg (dev->net,"%s(%s): received invalid " -"data offset: %d > %d\n" , __func__, -oid_to_string (oid), respoffs, buflen); +netdev_dbg (dev->net, +"%s(%s): received invalid data offset: %zu > %zu\n" , + __func__,oid_to_string (oid), respoffs, buflen); ret = -EINVAL ; goto exit_unlock; } -if ((resplen + respoffs) > buflen) { -/* Device would have returned more data if buffer would -* have been big enough. Copy just the bits that we got. -*/ - copylen = buflen - respoffs; - }else { - copylen = resplen; - } + copylen =min (resplen, buflen - respoffs);if (copylen > *len) copylen = *len;
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +3 -1
@@ -477,8 +477,10 @@ static int rockchip_usb2phy_power_on(struct phy *phy)return ret; ret =property_enable (base, &rport->port_cfg->phy_sus, false); -if (ret) +if (ret) { +clk_disable_unprepare (rphy->clk480m);return ret; + }/* waiting for the utmi_clk to become stable */ usleep_range (1500 ,2000 );
drivers/scsi/hpsa.c +1 -1
@@ -5771,7 +5771,7 @@ static int hpsa_scsi_host_alloc(struct ctlr_info *h) {struct Scsi_Host *sh; - sh =scsi_host_alloc (&hpsa_driver_template,sizeof (h)); + sh =scsi_host_alloc (&hpsa_driver_template,sizeof (struct ctlr_info ));if (sh ==NULL ) {dev_err (&h->pdev->dev,"scsi_host_alloc failed\n" );return -ENOMEM ;
drivers/usb/gadget/function/f_fs.c +7 -0
@@ -271,6 +271,9 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)struct usb_request *req = ffs->ep0req;int ret; +if (!req) +return -EINVAL ; + req->zero = len <le16_to_cpu (ffs->ev.setup.wLength);spin_unlock_irq (&ffs->ev.waitq.lock);
@@ -1807,10 +1810,14 @@ static void functionfs_unbind(struct ffs_data *ffs)ENTER ();if (!WARN_ON (!ffs->gadget)) { +/* dequeue before freeing ep0req */ +usb_ep_dequeue (ffs->gadget->ep0, ffs->ep0req); +mutex_lock (&ffs->mutex);usb_ep_free_request (ffs->gadget->ep0, ffs->ep0req); ffs->ep0req =NULL ; ffs->gadget =NULL ;clear_bit (FFS_FL_BOUND , &ffs->flags); +mutex_unlock (&ffs->mutex);ffs_data_put (ffs); } }
drivers/usb/host/xhci-plat.c +1 -1
@@ -261,7 +261,7 @@ static int xhci_plat_probe(struct platform_device *pdev) *priv = *priv_match; } -device_wakeup_enable (hcd->self.controller); +device_set_wakeup_capable (&pdev->dev, true); xhci->clk = clk; xhci->reg_clk = reg_clk;
drivers/w1/w1.c +5 -1
@@ -1140,6 +1140,8 @@ int w1_process(void *data)/* remainder if it woke up early */ unsigned long jremain =0 ; +atomic_inc (&dev->refcnt); +for (;;) {if (!jremain && dev->search_count) {
@@ -1167,8 +1169,10 @@ int w1_process(void *data)*/ mutex_unlock (&dev->list_mutex); -if (kthread_should_stop ()) +if (kthread_should_stop ()) { +__set_current_state (TASK_RUNNING );break ; + }/* Only sleep when the search is active. */ if (dev->search_count) {
drivers/w1/w1_int.c +2 -3
@@ -60,10 +60,9 @@ static struct w1_master *w1_alloc_dev(u32 id, int slave_count, int slave_ttl, dev->search_count = w1_search_count; dev->enable_pullup = w1_enable_pullup; -/* 1 for w1_process to decrement -* 1 for __w1_remove_master_device to decrement +/* For __w1_remove_master_device to decrement */ -atomic_set (&dev->refcnt,2 ); +atomic_set (&dev->refcnt,1 );INIT_LIST_HEAD (&dev->slist);INIT_LIST_HEAD (&dev->async_list);
fs/affs/file.c +1 -1
@@ -878,7 +878,7 @@ affs_truncate(struct inode *inode)if (inode->i_size >AFFS_I (inode)->mmu_private) {struct address_space *mapping = inode->i_mapping;struct page *page; -void *fsdata; +void *fsdata =NULL ;loff_t isize = inode->i_size;int res;
fs/cifs/connect.c +4 -5
@@ -429,7 +429,8 @@ cifs_reconnect(struct TCP_Server_Info *server) server->ssocket->state, server->ssocket->flags);sock_release (server->ssocket); server->ssocket =NULL ; - } + }else if (cifs_rdma_enabled (server)) +smbd_destroy (server); server->sequence_number =0 ; server->session_estab = false;kfree (server->session_key.response);
@@ -799,10 +800,8 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server)wake_up_all (&server->request_q);/* give those requests time to exit */ msleep (125 ); -if (cifs_rdma_enabled (server) && server->smbd_conn) { -smbd_destroy (server->smbd_conn); - server->smbd_conn =NULL ; - } +if (cifs_rdma_enabled (server)) +smbd_destroy (server);if (server->ssocket) {sock_release (server->ssocket); server->ssocket =NULL ;
fs/cifs/smbdirect.c +95 -20
166 lines not on this page · raw message
fs/cifs/smbdirect.h +3 -2
@@ -71,6 +71,7 @@ struct smbd_connection {struct completion ri_done;wait_queue_head_t conn_wait;wait_queue_head_t wait_destroy; +wait_queue_head_t disconn_wait;struct completion negotiate_completion;bool negotiate_done;
@@ -288,7 +289,7 @@ struct smbd_connection *smbd_get_connection(/* Reconnect SMBDirect session */ int smbd_reconnect (struct TCP_Server_Info *server);/* Destroy SMBDirect session */ -void smbd_destroy (struct smbd_connection *info); +void smbd_destroy (struct TCP_Server_Info *server);/* Interface for carrying upper layer I/O through send/recv */ int smbd_recv (struct smbd_connection *info,struct msghdr *msg);
@@ -331,7 +332,7 @@ struct smbd_connection {};static inline void *smbd_get_connection (struct TCP_Server_Info *server,struct sockaddr *dstaddr) {return NULL ;}static inline int smbd_reconnect (struct TCP_Server_Info *server) {return -1 ; } -static inline void smbd_destroy (struct smbd_connection *info) {} +static inline void smbd_destroy (struct TCP_Server_Info *server) {}static inline int smbd_recv (struct smbd_connection *info,struct msghdr *msg) {return -1 ; }static inline int smbd_send (struct TCP_Server_Info *server,int num_rqst,struct smb_rqst *rqst) {return -1 ; }#endif
fs/proc/proc_sysctl.c +33 -0
@@ -13,6 +13,7 @@#include <linux/namei.h> #include <linux/mm.h> #include <linux/module.h> +#include <linux/kmemleak.h> #include "internal.h" static const struct dentry_operations proc_sys_dentry_operations;
@@ -1376,6 +1377,38 @@ struct ctl_table_header *register_sysctl(const char *path, struct ctl_table *tab }EXPORT_SYMBOL (register_sysctl); +/** +* __register_sysctl_init() - register sysctl table to path +* @path: path name for sysctl base +* @table: This is the sysctl table that needs to be registered to the path +* @table_name: The name of sysctl table, only used for log printing when +* registration fails +* +* The sysctl interface is used by userspace to query or modify at runtime +* a predefined value set on a variable. These variables however have default +* values pre-set. Code which depends on these variables will always work even +* if register_sysctl() fails. If register_sysctl() fails you'd just loose the +* ability to query or modify the sysctls dynamically at run time. Chances of +* register_sysctl() failing on init are extremely low, and so for both reasons +* this function does not return any error as it is used by initialization code. +* +* Context: Can only be called after your respective sysctl base path has been +* registered. So for instance, most base directories are registered early on +* init before init levels are processed through proc_sys_init() and +* sysctl_init(). +*/ +void __init __register_sysctl_init (const char *path,struct ctl_table *table, +const char *table_name) +{ +struct ctl_table_header *hdr =register_sysctl (path, table); + +if (unlikely (!hdr)) { +pr_err ("failed when register_sysctl %s to %s\n" , table_name, path); +return ; + } +kmemleak_not_leak (hdr); +} +static char *append_path (const char *path,char *pos,const char *name) {int namelen;
fs/reiserfs/super.c +0 -6
@@ -1443,7 +1443,6 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)unsigned long safe_mask =0 ;unsigned int commit_max_age = (unsigned int )-1 ;struct reiserfs_journal *journal =SB_JOURNAL (s); -char *new_opts;int err;char *qf_names[REISERFS_MAXQUOTAS ];unsigned int qfmt =0 ;
@@ -1451,10 +1450,6 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)int i;#endif - new_opts =kstrdup (arg,GFP_KERNEL ); -if (arg && !new_opts) -return -ENOMEM ; -sync_filesystem (s);reiserfs_write_lock (s);
@@ -1605,7 +1600,6 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg) out_err_unlock:reiserfs_write_unlock (s); out_err: -kfree (new_opts);return err; }
include/linux/kernel.h +1 -0
@@ -327,6 +327,7 @@ extern long (*panic_blink)(int state); __printf(1, 2)void panic (const char *fmt, ...)__noreturn __cold ;void nmi_panic (struct pt_regs *regs,const char *msg); +void check_panic_on_warn (const char *origin);extern void oops_enter (void );extern void oops_exit (void );void print_oops_end_marker (void );
include/linux/sched/task.h +1 -0
@@ -36,6 +36,7 @@ extern int sched_fork(unsigned long clone_flags, struct task_struct *p);extern void sched_dead (struct task_struct *p);void __noreturn do_task_dead (void ); +void __noreturn make_task_dead (int signr);extern void proc_caches_init (void );
include/linux/sysctl.h +3 -0
@@ -198,6 +198,9 @@ struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path,void unregister_sysctl_table (struct ctl_table_header * table);extern int sysctl_init (void ); +extern void __register_sysctl_init (const char *path,struct ctl_table *table, +const char *table_name); +#define register_sysctl_init (path, table) __register_sysctl_init(path, table, #table)extern struct ctl_table sysctl_mount_point[];
kernel/bpf/verifier.c +3 -1
@@ -1012,7 +1012,9 @@ static int check_stack_write(struct bpf_verifier_env *env,bool sanitize = reg &&is_spillable_regtype (reg->type);for (i =0 ; i < size; i++) { -if (state->stack[spi].slot_type[i] ==STACK_INVALID ) { +u8 type = state->stack[spi].slot_type[i]; + +if (type !=STACK_MISC && type !=STACK_ZERO ) { sanitize = true;break ; }
kernel/exit.c +72 -0
90 lines not on this page · raw message
kernel/module.c +21 -5
@@ -3478,7 +3478,8 @@ static bool finished_loading(const char *name)sched_annotate_sleep ();mutex_lock (&module_mutex); mod =find_module_all (name,strlen (name), true); - ret = !mod || mod->state ==MODULE_STATE_LIVE ; + ret = !mod || mod->state ==MODULE_STATE_LIVE + || mod->state ==MODULE_STATE_GOING ;mutex_unlock (&module_mutex);return ret;
@@ -3632,20 +3633,35 @@ static int add_unformed_module(struct module *mod) mod->state =MODULE_STATE_UNFORMED ; -again:mutex_lock (&module_mutex); old =find_module_all (mod->name,strlen (mod->name), true);if (old !=NULL ) { -if (old->state !=MODULE_STATE_LIVE ) { +if (old->state ==MODULE_STATE_COMING + || old->state ==MODULE_STATE_UNFORMED ) {/* Wait in case it fails to load. */ mutex_unlock (&module_mutex); err =wait_event_interruptible (module_wq,finished_loading (mod->name));if (err) goto out_unlocked; - goto again; + +/* The module might have gone in the meantime. */ +mutex_lock (&module_mutex); + old =find_module_all (mod->name,strlen (mod->name), + true); } - err = -EEXIST ; + +/* +* We are here only when the same module was being loaded. Do +* not try to load it again right now. It prevents long delays +* caused by serialized module load failures. It might happen +* when more devices of the same type trigger load of +* a particular module. +*/ +if (old && old->state ==MODULE_STATE_LIVE ) + err = -EEXIST ; +else + err = -EBUSY ; goto out; }mod_update_bounds (mod);
kernel/panic.c +65 -10
111 lines not on this page · raw message
kernel/sched/core.c +1 -2
@@ -3316,8 +3316,7 @@ static noinline void __schedule_bug(struct task_struct *prev)print_ip_sym (preempt_disable_ip);pr_cont ("\n" ); } -if (panic_on_warn) -panic ("scheduling while atomic\n" ); +check_panic_on_warn ("scheduling while atomic" );dump_stack ();add_taint (TAINT_WARN ,LOCKDEP_STILL_OK );
kernel/trace/trace.c +2 -0
@@ -8674,6 +8674,8 @@ void __init early_trace_init(void)static_key_enable (&tracepoint_printk_key.key); }tracer_alloc_buffers (); + +init_events (); }void __init trace_init (void )
kernel/trace/trace.h +1 -0
@@ -1530,6 +1530,7 @@ extern void trace_event_enable_cmd_record(bool enable);extern void trace_event_enable_tgid_record (bool enable);extern int event_trace_init (void ); +extern int init_events (void );extern int event_trace_add_tracer (struct dentry *parent,struct trace_array *tr);extern int event_trace_del_tracer (struct trace_array *tr);
kernel/trace/trace_events_hist.c +2 -0
@@ -2314,6 +2314,8 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data,unsigned long fl = flags & ~HIST_FIELD_FL_LOG2 ; hist_field->fn = hist_field_log2; hist_field->operands[0 ] =create_hist_field (hist_data, field, fl,NULL ); +if (!hist_field->operands[0 ]) + goto free; hist_field->size = hist_field->operands[0 ]->size; hist_field->type =kstrdup (hist_field->operands[0 ]->type,GFP_KERNEL );if (!hist_field->type)
kernel/trace/trace_output.c +1 -2
@@ -1395,7 +1395,7 @@ static struct trace_event *events[] __initdata = { NULL }; -__init static int init_events (void ) +__init int init_events (void ) {struct trace_event *event;int i, ret;
@@ -1413,4 +1413,3 @@ __init static int init_events(void)return 0 ; } -early_initcall (init_events);
mm/kasan/report.c +1 -2
@@ -176,8 +176,7 @@ static void kasan_end_report(unsigned long *flags)pr_err ("==================================================================\n" );add_taint (TAINT_BAD_PAGE ,LOCKDEP_NOW_UNRELIABLE );spin_unlock_irqrestore (&report_lock, *flags); -if (panic_on_warn) -panic ("panic_on_warn set ...\n" ); +check_panic_on_warn ("KASAN" );kasan_enable_current (); }
net/bluetooth/hci_core.c +1 -0
@@ -1519,6 +1519,7 @@ static int hci_dev_do_open(struct hci_dev *hdev) hdev->flush (hdev);if (hdev->sent_cmd) { +cancel_delayed_work_sync (&hdev->cmd_timer);kfree_skb (hdev->sent_cmd); hdev->sent_cmd =NULL ; }
net/core/net_namespace.c +1 -1
@@ -132,12 +132,12 @@ static int ops_init(const struct pernet_operations *ops, struct net *net)return 0 ;if (ops->id && ops->size) { -cleanup: ng =rcu_dereference_protected (net->gen,lockdep_is_held (&pernet_ops_rwsem)); ng->ptr[*ops->id] =NULL ; } +cleanup:kfree (data); out:
net/ipv4/inet_hashtables.c +15 -2
@@ -579,8 +579,20 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)spin_lock (lock);if (osk) {WARN_ON_ONCE (sk->sk_hash != osk->sk_hash); - ret =sk_nulls_del_node_init_rcu (osk); - }else if (found_dup_sk) { + ret =sk_hashed (osk); +if (ret) { +/* Before deleting the node, we insert a new one to make +* sure that the look-up-sk process would not miss either +* of them and that at least one node would exist in ehash +* table all the time. Otherwise there's a tiny chance +* that lookup process could find nothing in ehash table. +*/ +__sk_nulls_add_node_tail_rcu (sk, list); +sk_nulls_del_node_init_rcu (osk); + } + goto unlock; + } +if (found_dup_sk) { *found_dup_sk =inet_ehash_lookup_by_sk (sk, list);if (*found_dup_sk) ret = false;
@@ -589,6 +601,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)if (ret)__sk_nulls_add_node_rcu (sk, list); +unlock:spin_unlock (lock);return ret;
net/ipv4/inet_timewait_sock.c +4 -4
@@ -80,10 +80,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw) }EXPORT_SYMBOL_GPL (inet_twsk_put); -static void inet_twsk_add_node_rcu (struct inet_timewait_sock *tw, -struct hlist_nulls_head *list) +static void inet_twsk_add_node_tail_rcu (struct inet_timewait_sock *tw, +struct hlist_nulls_head *list) { -hlist_nulls_add_head_rcu (&tw->tw_node, list); +hlist_nulls_add_tail_rcu (&tw->tw_node, list); } static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,
@@ -119,7 +119,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,spin_lock (lock); -inet_twsk_add_node_rcu (tw, &ehead->chain); +inet_twsk_add_node_tail_rcu (tw, &ehead->chain);/* Step 3: Remove SK from hash chain */ if (__sk_nulls_del_node_init_rcu (sk))
net/ipv4/metrics.c +2 -0
@@ -1,4 +1,5 @@#include <linux/netlink.h> +#include <linux/nospec.h> #include <linux/rtnetlink.h> #include <linux/types.h> #include <net/ip.h>
@@ -24,6 +25,7 @@ int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, int fc_mx_len,if (type >RTAX_MAX )return -EINVAL ; + type =array_index_nospec (type,RTAX_MAX +1 );if (type ==RTAX_CC_ALGO ) {char tmp[TCP_CA_NAME_MAX ];
net/ipv6/ip6_gre.c +7 -5
@@ -1154,14 +1154,16 @@ static void ip6gre_tnl_link_config_route(struct ip6_tnl *t, int set_mtu, dev->needed_headroom = dst_len;if (set_mtu) { - dev->mtu = rt->dst.dev->mtu - t_hlen; +int mtu = rt->dst.dev->mtu - t_hlen; +if (!(t->parms.flags &IP6_TNL_F_IGN_ENCAP_LIMIT )) - dev->mtu -=8 ; + mtu -=8 ;if (dev->type ==ARPHRD_ETHER ) - dev->mtu -=ETH_HLEN ; + mtu -=ETH_HLEN ; -if (dev->mtu <IPV6_MIN_MTU ) - dev->mtu =IPV6_MIN_MTU ; +if (mtu <IPV6_MIN_MTU ) + mtu =IPV6_MIN_MTU ; +WRITE_ONCE (dev->mtu, mtu); } }ip6_rt_put (rt);
net/ipv6/ip6_tunnel.c +6 -4
@@ -1435,6 +1435,7 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)struct __ip6_tnl_parm *p = &t->parms;struct flowi6 *fl6 = &t->fl.u.ip6;int t_hlen; +int mtu;memcpy (dev->dev_addr, &p->laddr,sizeof (struct in6_addr ));memcpy (dev->broadcast, &p->raddr,sizeof (struct in6_addr ));
@@ -1477,12 +1478,13 @@ static void ip6_tnl_link_config(struct ip6_tnl *t) dev->hard_header_len = rt->dst.dev->hard_header_len + t_hlen; - dev->mtu = rt->dst.dev->mtu - t_hlen; + mtu = rt->dst.dev->mtu - t_hlen;if (!(t->parms.flags &IP6_TNL_F_IGN_ENCAP_LIMIT )) - dev->mtu -=8 ; + mtu -=8 ; -if (dev->mtu <IPV6_MIN_MTU ) - dev->mtu =IPV6_MIN_MTU ; +if (mtu <IPV6_MIN_MTU ) + mtu =IPV6_MIN_MTU ; +WRITE_ONCE (dev->mtu, mtu); }ip6_rt_put (rt); }
net/ipv6/sit.c +5 -3
@@ -1082,10 +1082,12 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)if (tdev && !netif_is_l3_master (tdev)) {int t_hlen = tunnel->hlen +sizeof (struct iphdr ); +int mtu; - dev->mtu = tdev->mtu - t_hlen; -if (dev->mtu <IPV6_MIN_MTU ) - dev->mtu =IPV6_MIN_MTU ; + mtu = tdev->mtu - t_hlen; +if (mtu <IPV6_MIN_MTU ) + mtu =IPV6_MIN_MTU ; +WRITE_ONCE (dev->mtu, mtu); } }
net/netfilter/nf_conntrack_proto_sctp.c +16 -9
@@ -317,22 +317,29 @@ static int sctp_packet(struct nf_conn *ct, for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {/* Special cases of Verification tag check (Sec 8.5.1) */ if (sch->type ==SCTP_CID_INIT ) { -/* Sec 8.5.1 (A) */ +/* (A) vtag MUST be zero */ if (sh->vtag !=0 ) goto out_unlock; }else if (sch->type ==SCTP_CID_ABORT ) { -/* Sec 8.5.1 (B) */ -if (sh->vtag != ct->proto.sctp.vtag[dir] && - sh->vtag != ct->proto.sctp.vtag[!dir]) +/* (B) vtag MUST match own vtag if T flag is unset OR +* MUST match peer's vtag if T flag is set +*/ +if ((!(sch->flags &SCTP_CHUNK_FLAG_T ) && + sh->vtag != ct->proto.sctp.vtag[dir]) || + ((sch->flags &SCTP_CHUNK_FLAG_T ) && + sh->vtag != ct->proto.sctp.vtag[!dir])) goto out_unlock; }else if (sch->type ==SCTP_CID_SHUTDOWN_COMPLETE ) { -/* Sec 8.5.1 (C) */ -if (sh->vtag != ct->proto.sctp.vtag[dir] && - sh->vtag != ct->proto.sctp.vtag[!dir] && - sch->flags &SCTP_CHUNK_FLAG_T ) +/* (C) vtag MUST match own vtag if T flag is unset OR +* MUST match peer's vtag if T flag is set +*/ +if ((!(sch->flags &SCTP_CHUNK_FLAG_T ) && + sh->vtag != ct->proto.sctp.vtag[dir]) || + ((sch->flags &SCTP_CHUNK_FLAG_T ) && + sh->vtag != ct->proto.sctp.vtag[!dir])) goto out_unlock; }else if (sch->type ==SCTP_CID_COOKIE_ECHO ) { -/* Sec 8.5.1 (D) */ +/* (D) vtag must be same as init_vtag as found in INIT_ACK */ if (sh->vtag != ct->proto.sctp.vtag[dir]) goto out_unlock; }else if (sch->type ==SCTP_CID_HEARTBEAT ) {
net/netfilter/nf_conntrack_proto_tcp.c +10 -0
@@ -1094,6 +1094,16 @@ static int tcp_packet(struct nf_conn *ct,nf_ct_kill_acct (ct, ctinfo, skb);return NF_ACCEPT ; } + +if (index ==TCP_SYN_SET && old_state ==TCP_CONNTRACK_SYN_SENT ) { +/* do not renew timeout on SYN retransmit. +* +* Else port reuse by client or NAT middlebox can keep +* entry alive indefinitely (including nat info). +*/ +return NF_ACCEPT ; + } +/* ESTABLISHED without SEEN_REPLY, i.e. mid-connection * pickup with loose=1. Avoid large ESTABLISHED timeout. */
net/netfilter/nft_set_rbtree.c +15 -1
@@ -375,23 +375,37 @@ static void nft_rbtree_gc(struct work_struct *work)struct nft_rbtree *priv;struct rb_node *node;struct nft_set *set; +struct net *net; +u8 genmask; priv = container_of(work, struct nft_rbtree, gc_work.work); set =nft_set_container_of (priv); + net =read_pnet (&set->net); + genmask =nft_genmask_cur (net);write_lock_bh (&priv->lock);write_seqcount_begin (&priv->count);for (node =rb_first (&priv->root); node !=NULL ; node =rb_next (node)) { rbe = rb_entry(node, struct nft_rbtree_elem, node); +if (!nft_set_elem_active (&rbe->ext, genmask)) +continue ; + +/* elements are reversed in the rbtree for historical reasons, +* from highest to lowest value, that is why end element is +* always visited before the start element. +*/ if (nft_rbtree_interval_end (rbe)) { rbe_end = rbe;continue ; }if (!nft_set_elem_expired (&rbe->ext))continue ; -if (nft_set_elem_mark_busy (&rbe->ext)) + +if (nft_set_elem_mark_busy (&rbe->ext)) { + rbe_end =NULL ;continue ; + }if (rbe_prev) {rb_erase (&rbe_prev->node, &priv->root);
net/netlink/af_netlink.c +23 -18
79 lines not on this page · raw message
net/netrom/nr_timer.c +1 -0
@@ -124,6 +124,7 @@ static void nr_heartbeat_expiry(struct timer_list *t)is accepted() it isn't 'dead' so doesn't get removed. */ if (sock_flag (sk,SOCK_DESTROY ) || (sk->sk_state ==TCP_LISTEN &&sock_flag (sk,SOCK_DEAD ))) { +sock_hold (sk);bh_unlock_sock (sk);nr_destroy_socket (sk); goto out;
net/nfc/llcp_core.c +1 -0
@@ -171,6 +171,7 @@ static void local_cleanup(struct nfc_llcp_local *local)cancel_work_sync (&local->rx_work);cancel_work_sync (&local->timeout_work);kfree_skb (local->rx_pending); + local->rx_pending =NULL ;del_timer_sync (&local->sdreq_timer);cancel_work_sync (&local->sdreq_timeout_work);nfc_llcp_free_sdp_tlv_list (&local->pending_sdreqs);
net/sctp/bind_addr.c +6 -0
@@ -88,6 +88,12 @@ int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest, } } +/* If somehow no addresses were found that can be used with this +* scope, it's an error. +*/ +if (list_empty (&dest->address_list)) + error = -ENETUNREACH ; + out:if (error)sctp_bind_addr_clean (dest);
security/tomoyo/Makefile +1 -1
@@ -10,7 +10,7 @@ endef quiet_cmd_policy = POLICY $@ cmd_policy = ($(call do_policy,profile); $(call do_policy,exception_policy); $(call do_policy,domain_policy); $(call do_policy,manager); $(call do_policy,stat)) >$@ -$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(src)/policy/*.conf.default) FORCE +$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(srctree)/$(src)/policy/*.conf.default) FORCE $(call if_changed,policy) $(obj)/common.o: $(obj)/builtin-policy.h
tools/objtool/check.c +2 -1
@@ -159,6 +159,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,"panic" ,"do_exit" ,"do_task_dead" , +"make_task_dead" ,"__module_put_and_exit" ,"complete_and_exit" , "kvm_spurious_fault",
@@ -167,7 +168,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,"fortify_panic" ,"usercopy_abort" ,"machine_real_restart" , - "rewind_stack_do_exit", + "rewind_stack_and_make_dead", };if (func->bind ==STB_WEAK )
tools/perf/util/env.c +2 -2
@@ -163,11 +163,11 @@ static const char *normalize_arch(char *arch)const char *perf_env__arch (struct perf_env *env) { -struct utsname uts;char *arch_name;if (!env || !env->arch) {/* Assume local operation */ -if (uname (&uts) <0 ) +static struct utsname uts = { .machine[0 ] ='\0' , }; +if (uts.machine[0 ] =='\0' &&uname (&uts) <0 )return NULL ; arch_name = uts.machine; }else