[linux-next] LinuxNextTracking branch, master, updated. next-20180130

The following commit has been merged in the master branch: commit fabe93551663d1ae004ef2e56907a2bba3b3cb8a Merge: 46a1014f9cf3bfb0eeca84714b8e0c5d3ec08f43 27f005e635c62d7e4f6b170aabeea8e6e00ff1aa Author: Stephen Rothwell sfr@canb.auug.org.au Date: Tue Jan 30 09:51:36 2018 +1100

Merge remote-tracking branch 'vfs/for-next'

diff --combined arch/alpha/include/uapi/asm/Kbuild index 14a2e9af97e9,574fe90c8b58..9afaba5e5503 --- a/arch/alpha/include/uapi/asm/Kbuild +++ b/arch/alpha/include/uapi/asm/Kbuild @@@ -1,4 -1,4 +1,5 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h diff --combined arch/ia64/include/uapi/asm/Kbuild index f5c6967a93bb,4c9825edd4a3..c0527cfc48f0 --- a/arch/ia64/include/uapi/asm/Kbuild +++ b/arch/ia64/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generic-y += kvm_para.h + generic-y += poll.h diff --combined arch/m32r/include/uapi/asm/Kbuild index 451bf6071c6e,21f241553a2e..c3df55aeefe7 --- a/arch/m32r/include/uapi/asm/Kbuild +++ b/arch/m32r/include/uapi/asm/Kbuild @@@ -1,6 -1,6 +1,7 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generic-y += kvm_para.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/mn10300/include/uapi/asm/Kbuild index 81271d3af47c,162fbdbb5fd5..b04fd1632051 --- a/arch/mn10300/include/uapi/asm/Kbuild +++ b/arch/mn10300/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/powerpc/kernel/rtasd.c index 7ae4b8ba7fd3,1da8b7d8c6ca..fc600a8b1e77 --- a/arch/powerpc/kernel/rtasd.c +++ b/arch/powerpc/kernel/rtasd.c @@@ -388,7 -388,7 +388,7 @@@ out return error; }

- static unsigned int rtas_log_poll(struct file *file, poll_table * wait) + static __poll_t rtas_log_poll(struct file *file, poll_table * wait) { poll_wait(file, &rtas_log_wait, wait); if (rtas_log_size) @@@ -581,7 -581,7 +581,7 @@@ static int __init rtas_init(void if (!rtas_log_buf) return -ENODEV;

- entry = proc_create("powerpc/rtas/error_log", S_IRUSR, NULL, + entry = proc_create("powerpc/rtas/error_log", 0400, NULL, &proc_rtas_log_operations); if (!entry) printk(KERN_ERR "Failed to create error_log proc entry\n"); diff --combined arch/powerpc/kvm/book3s_xive.c index 0d750d274c4e,8f016ccf5424..6882bc94eba8 --- a/arch/powerpc/kvm/book3s_xive.c +++ b/arch/powerpc/kvm/book3s_xive.c @@@ -16,7 -16,7 +16,7 @@@ #include <linux/delay.h> #include <linux/percpu.h> #include <linux/cpumask.h> - #include <asm/uaccess.h> + #include <linux/uaccess.h> #include <asm/kvm_book3s.h> #include <asm/kvm_ppc.h> #include <asm/hvcall.h> @@@ -725,8 -725,7 +725,8 @@@ u64 kvmppc_xive_get_icp(struct kvm_vcp

/* Return the per-cpu state for state saving/migration */ return (u64)xc->cppr << KVM_REG_PPC_ICP_CPPR_SHIFT | - (u64)xc->mfrr << KVM_REG_PPC_ICP_MFRR_SHIFT; + (u64)xc->mfrr << KVM_REG_PPC_ICP_MFRR_SHIFT | + (u64)0xff << KVM_REG_PPC_ICP_PPRI_SHIFT; }

int kvmppc_xive_set_icp(struct kvm_vcpu *vcpu, u64 icpval) @@@ -1559,7 -1558,7 +1559,7 @@@ static int xive_set_source(struct kvmpp

/* * Restore P and Q. If the interrupt was pending, we - * force both P and Q, which will trigger a resend. + * force Q and !P, which will trigger a resend. * * That means that a guest that had both an interrupt * pending (queued) and Q set will restore with only @@@ -1567,7 -1566,7 +1567,7 @@@ * is perfectly fine as coalescing interrupts that haven't * been presented yet is always allowed. */ - if (val & KVM_XICS_PRESENTED || val & KVM_XICS_PENDING) + if (val & KVM_XICS_PRESENTED && !(val & KVM_XICS_PENDING)) state->old_p = true; if (val & KVM_XICS_QUEUED || val & KVM_XICS_PENDING) state->old_q = true; diff --combined arch/powerpc/platforms/cell/spufs/file.c index 94139135be9c,fc7772c3d068..c1be486da899 --- a/arch/powerpc/platforms/cell/spufs/file.c +++ b/arch/powerpc/platforms/cell/spufs/file.c @@@ -762,10 -762,10 +762,10 @@@ out return count; }

- static unsigned int spufs_ibox_poll(struct file *file, poll_table *wait) + static __poll_t spufs_ibox_poll(struct file *file, poll_table *wait) { struct spu_context *ctx = file->private_data; - unsigned int mask; + __poll_t mask;

poll_wait(file, &ctx->ibox_wq, wait);

@@@ -898,10 -898,10 +898,10 @@@ out return count; }

- static unsigned int spufs_wbox_poll(struct file *file, poll_table *wait) + static __poll_t spufs_wbox_poll(struct file *file, poll_table *wait) { struct spu_context *ctx = file->private_data; - unsigned int mask; + __poll_t mask;

poll_wait(file, &ctx->wbox_wq, wait);

@@@ -1690,11 -1690,11 +1690,11 @@@ out return ret; }

- static unsigned int spufs_mfc_poll(struct file *file,poll_table *wait) + static __poll_t spufs_mfc_poll(struct file *file,poll_table *wait) { struct spu_context *ctx = file->private_data; u32 free_elements, tagstatus; - unsigned int mask; + __poll_t mask;

poll_wait(file, &ctx->mfc_wq, wait);

@@@ -2375,8 -2375,8 +2375,8 @@@ static int switch_log_sprint(struct spu

p = ctx->switch_log->log + ctx->switch_log->tail % SWITCH_LOG_BUFSIZE;

- return snprintf(tbuf, n, "%u.%09u %d %u %u %llu\n", - (unsigned int) p->tstamp.tv_sec, + return snprintf(tbuf, n, "%llu.%09u %d %u %u %llu\n", + (unsigned long long) p->tstamp.tv_sec, (unsigned int) p->tstamp.tv_nsec, p->spu_id, (unsigned int) p->type, @@@ -2455,11 -2455,11 +2455,11 @@@ static ssize_t spufs_switch_log_read(st return cnt == 0 ? error : cnt; }

- static unsigned int spufs_switch_log_poll(struct file *file, poll_table *wait) + static __poll_t spufs_switch_log_poll(struct file *file, poll_table *wait) { struct inode *inode = file_inode(file); struct spu_context *ctx = SPUFS_I(inode)->i_ctx; - unsigned int mask = 0; + __poll_t mask = 0; int rc;

poll_wait(file, &ctx->switch_log->wait, wait); @@@ -2499,7 -2499,7 +2499,7 @@@ void spu_switch_log_notify(struct spu * struct switch_log_entry *p;

p = ctx->switch_log->log + ctx->switch_log->head; - ktime_get_ts(&p->tstamp); + ktime_get_ts64(&p->tstamp); p->timebase = get_tb(); p->spu_id = spu ? spu->number : -1; p->type = type; diff --combined arch/powerpc/platforms/cell/spufs/spufs.h index 5d85c689c2e9,2d0479ad3af4..b5fc1b3fe538 --- a/arch/powerpc/platforms/cell/spufs/spufs.h +++ b/arch/powerpc/platforms/cell/spufs/spufs.h @@@ -69,7 -69,7 +69,7 @@@ struct switch_log unsigned long head; unsigned long tail; struct switch_log_entry { - struct timespec tstamp; + struct timespec64 tstamp; s32 spu_id; u32 type; u32 val; @@@ -185,8 -185,7 +185,7 @@@ struct mfc_dma_command struct spu_context_ops { int (*mbox_read) (struct spu_context * ctx, u32 * data); u32(*mbox_stat_read) (struct spu_context * ctx); - unsigned int (*mbox_stat_poll)(struct spu_context *ctx, - unsigned int events); + __poll_t (*mbox_stat_poll)(struct spu_context *ctx, __poll_t events); int (*ibox_read) (struct spu_context * ctx, u32 * data); int (*wbox_write) (struct spu_context * ctx, u32 data); u32(*signal1_read) (struct spu_context * ctx); diff --combined arch/riscv/kernel/process.c index d74d4adf2d54,b01f71d2233b..d7c6ca7c95ae --- a/arch/riscv/kernel/process.c +++ b/arch/riscv/kernel/process.c @@@ -25,9 -25,9 +25,9 @@@ #include <linux/sched/task_stack.h> #include <linux/tick.h> #include <linux/ptrace.h> + #include <linux/uaccess.h>

#include <asm/unistd.h> - #include <asm/uaccess.h> #include <asm/processor.h> #include <asm/csr.h> #include <asm/string.h> @@@ -76,7 -76,7 +76,7 @@@ void show_regs(struct pt_regs *regs void start_thread(struct pt_regs *regs, unsigned long pc, unsigned long sp) { - regs->sstatus = SR_PIE /* User mode, irqs on */ | SR_FS_INITIAL; + regs->sstatus = SR_SPIE /* User mode, irqs on */ | SR_FS_INITIAL; regs->sepc = pc; regs->sp = sp; set_fs(USER_DS); @@@ -110,7 -110,7 +110,7 @@@ int copy_thread(unsigned long clone_fla const register unsigned long gp __asm__ ("gp"); memset(childregs, 0, sizeof(struct pt_regs)); childregs->gp = gp; - childregs->sstatus = SR_PS | SR_PIE; /* Supervisor, irqs on */ + childregs->sstatus = SR_SPP | SR_SPIE; /* Supervisor, irqs on */

p->thread.ra = (unsigned long)ret_from_kernel_thread; p->thread.s[0] = usp; /* fn */ diff --combined arch/riscv/mm/fault.c index fd2a1d9cc34e,81e8c983d1fb..febf92910592 --- a/arch/riscv/mm/fault.c +++ b/arch/riscv/mm/fault.c @@@ -29,7 -29,6 +29,6 @@@

#include <asm/pgalloc.h> #include <asm/ptrace.h> - #include <asm/uaccess.h>

/* * This routine handles page faults. It determines the address and the @@@ -63,7 -62,7 +62,7 @@@ asmlinkage void do_page_fault(struct pt goto vmalloc_fault;

/* Enable interrupts if they were enabled in the parent context. */ - if (likely(regs->sstatus & SR_PIE)) + if (likely(regs->sstatus & SR_SPIE)) local_irq_enable();

/* @@@ -241,7 -240,7 +240,7 @@@ vmalloc_fault * of a task switch. */ index = pgd_index(addr); - pgd = (pgd_t *)pfn_to_virt(csr_read(sptbr)) + index; + pgd = (pgd_t *)pfn_to_virt(csr_read(satp)) + index; pgd_k = init_mm.pgd + index;

if (!pgd_present(*pgd_k)) diff --combined arch/score/include/uapi/asm/Kbuild index 81271d3af47c,162fbdbb5fd5..b04fd1632051 --- a/arch/score/include/uapi/asm/Kbuild +++ b/arch/score/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/x86/include/uapi/asm/Kbuild index 1e901e421f2d,e9f6b8e332bd..322681622d1e --- a/arch/x86/include/uapi/asm/Kbuild +++ b/arch/x86/include/uapi/asm/Kbuild @@@ -1,7 -1,7 +1,8 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generated-y += unistd_32.h generated-y += unistd_64.h generated-y += unistd_x32.h + generic-y += poll.h diff --combined block/bsg.c index a1bcbb6ba50b,636bfcdb5d5f..2e2c1e222209 --- a/block/bsg.c +++ b/block/bsg.c @@@ -32,9 -32,6 +32,9 @@@ #define BSG_DESCRIPTION "Block layer SCSI generic (bsg) driver" #define BSG_VERSION "0.4"

+#define bsg_dbg(bd, fmt, ...) \ + pr_debug("%s: " fmt, (bd)->name, ##__VA_ARGS__) + struct bsg_device { struct request_queue *queue; spinlock_t lock; @@@ -58,6 -55,14 +58,6 @@@ enum #define BSG_DEFAULT_CMDS 64 #define BSG_MAX_DEVS 32768

-#undef BSG_DEBUG - -#ifdef BSG_DEBUG -#define dprintk(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ##args) -#else -#define dprintk(fmt, args...) -#endif - static DEFINE_MUTEX(bsg_mutex); static DEFINE_IDR(bsg_minor_idr);

@@@ -118,7 -123,7 +118,7 @@@ static struct bsg_command *bsg_alloc_co

bc->bd = bd; INIT_LIST_HEAD(&bc->list); - dprintk("%s: returning free cmd %p\n", bd->name, bc); + bsg_dbg(bd, "returning free cmd %p\n", bc); return bc; out: spin_unlock_irq(&bd->lock); @@@ -217,8 -222,7 +217,8 @@@ bsg_map_hdr(struct bsg_device *bd, stru if (!bcd->class_dev) return ERR_PTR(-ENXIO);

- dprintk("map hdr %llx/%u %llx/%u\n", (unsigned long long) hdr->dout_xferp, + bsg_dbg(bd, "map hdr %llx/%u %llx/%u\n", + (unsigned long long) hdr->dout_xferp, hdr->dout_xfer_len, (unsigned long long) hdr->din_xferp, hdr->din_xfer_len);

@@@ -295,8 -299,8 +295,8 @@@ static void bsg_rq_end_io(struct reques struct bsg_device *bd = bc->bd; unsigned long flags;

- dprintk("%s: finished rq %p bc %p, bio %p\n", - bd->name, rq, bc, bc->bio); + bsg_dbg(bd, "finished rq %p bc %p, bio %p\n", + rq, bc, bc->bio);

bc->hdr.duration = jiffies_to_msecs(jiffies - bc->hdr.duration);

@@@ -329,7 -333,7 +329,7 @@@ static void bsg_add_command(struct bsg_ list_add_tail(&bc->list, &bd->busy_list); spin_unlock_irq(&bd->lock);

- dprintk("%s: queueing rq %p, bc %p\n", bd->name, rq, bc); + bsg_dbg(bd, "queueing rq %p, bc %p\n", rq, bc);

rq->end_io_data = bc; blk_execute_rq_nowait(q, NULL, rq, at_head, bsg_rq_end_io); @@@ -375,7 -379,7 +375,7 @@@ static struct bsg_command *bsg_get_done } } while (1);

- dprintk("%s: returning done %p\n", bd->name, bc); + bsg_dbg(bd, "returning done %p\n", bc);

return bc; } @@@ -386,7 -390,7 +386,7 @@@ static int blk_complete_sgv4_hdr_rq(str struct scsi_request *req = scsi_req(rq); int ret = 0;

- dprintk("rq %p bio %p 0x%x\n", rq, bio, req->result); + pr_debug("rq %p bio %p 0x%x\n", rq, bio, req->result); /* * fill in all the output members */ @@@ -465,7 -469,7 +465,7 @@@ static int bsg_complete_all_commands(st struct bsg_command *bc; int ret, tret;

- dprintk("%s: entered\n", bd->name); + bsg_dbg(bd, "entered\n");

/* * wait for all commands to complete @@@ -568,7 -572,7 +568,7 @@@ bsg_read(struct file *file, char __use int ret; ssize_t bytes_read;

- dprintk("%s: read %zd bytes\n", bd->name, count); + bsg_dbg(bd, "read %zd bytes\n", count);

bsg_set_block(bd, file);

@@@ -642,7 -646,7 +642,7 @@@ bsg_write(struct file *file, const cha ssize_t bytes_written; int ret;

- dprintk("%s: write %zd bytes\n", bd->name, count); + bsg_dbg(bd, "write %zd bytes\n", count);

if (unlikely(uaccess_kernel())) return -EINVAL; @@@ -660,7 -664,7 +660,7 @@@ if (!bytes_written || err_block_err(ret)) bytes_written = ret;

- dprintk("%s: returning %zd\n", bd->name, bytes_written); + bsg_dbg(bd, "returning %zd\n", bytes_written); return bytes_written; }

@@@ -713,7 -717,7 +713,7 @@@ static int bsg_put_device(struct bsg_de hlist_del(&bd->dev_list); mutex_unlock(&bsg_mutex);

- dprintk("%s: tearing down\n", bd->name); + bsg_dbg(bd, "tearing down\n");

/* * close can always block @@@ -740,7 -744,9 +740,7 @@@ static struct bsg_device *bsg_add_devic struct file *file) { struct bsg_device *bd; -#ifdef BSG_DEBUG unsigned char buf[32]; -#endif

if (!blk_queue_scsi_passthrough(rq)) { WARN_ONCE(true, "Attempt to register a non-SCSI queue\n"); @@@ -765,7 -771,7 +765,7 @@@ hlist_add_head(&bd->dev_list, bsg_dev_idx_hash(iminor(inode)));

strncpy(bd->name, dev_name(rq->bsg_dev.class_dev), sizeof(bd->name) - 1); - dprintk("bound to <%s>, max queue %d\n", + bsg_dbg(bd, "bound to <%s>, max queue %d\n", format_dev_t(buf, inode->i_rdev), bd->max_queue);

mutex_unlock(&bsg_mutex); @@@ -839,10 -845,10 +839,10 @@@ static int bsg_release(struct inode *in return bsg_put_device(bd); }

- static unsigned int bsg_poll(struct file *file, poll_table *wait) + static __poll_t bsg_poll(struct file *file, poll_table *wait) { struct bsg_device *bd = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &bd->wq_done, wait); poll_wait(file, &bd->wq_free, wait); diff --combined crypto/af_alg.c index 5231f421ad00,a5748a076ec8..0f8d8d5523c3 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@@ -150,7 -150,7 +150,7 @@@ EXPORT_SYMBOL_GPL(af_alg_release_parent

static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) { - const u32 forbidden = CRYPTO_ALG_INTERNAL; + const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY; struct sock *sk = sock->sk; struct alg_sock *ask = alg_sk(sk); struct sockaddr_alg *sa = (void *)uaddr; @@@ -158,10 -158,6 +158,10 @@@ void *private; int err;

+ /* If caller uses non-allowed flag, return error. */ + if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed)) + return -EINVAL; + if (sock->state == SS_CONNECTED) return -EINVAL;

@@@ -180,7 -176,9 +180,7 @@@ if (IS_ERR(type)) return PTR_ERR(type);

- private = type->bind(sa->salg_name, - sa->salg_feat & ~forbidden, - sa->salg_mask & ~forbidden); + private = type->bind(sa->salg_name, sa->salg_feat, sa->salg_mask); if (IS_ERR(private)) { module_put(type->owner); return PTR_ERR(private); @@@ -666,7 -664,7 +666,7 @@@ void af_alg_free_areq_sgls(struct af_al unsigned int i;

list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) { - ctx->rcvused -= rsgl->sg_num_bytes; + atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused); af_alg_free_sg(&rsgl->sgl); list_del(&rsgl->list); if (rsgl != &areq->first_rsgl) @@@ -674,15 -672,14 +674,15 @@@ }

tsgl = areq->tsgl; - for_each_sg(tsgl, sg, areq->tsgl_entries, i) { - if (!sg_page(sg)) - continue; - put_page(sg_page(sg)); - } + if (tsgl) { + for_each_sg(tsgl, sg, areq->tsgl_entries, i) { + if (!sg_page(sg)) + continue; + put_page(sg_page(sg)); + }

- if (areq->tsgl && areq->tsgl_entries) sock_kfree_s(sk, tsgl, areq->tsgl_entries * sizeof(*tsgl)); + } } EXPORT_SYMBOL_GPL(af_alg_free_areq_sgls);

@@@ -1064,13 -1061,13 +1064,13 @@@ EXPORT_SYMBOL_GPL(af_alg_async_cb) /** * af_alg_poll - poll system call handler */ - unsigned int af_alg_poll(struct file *file, struct socket *sock, + __poll_t af_alg_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct alg_sock *ask = alg_sk(sk); struct af_alg_ctx *ctx = ask->private; - unsigned int mask; + __poll_t mask;

sock_poll_wait(file, sk_sleep(sk), wait); mask = 0; @@@ -1140,6 -1137,12 +1140,6 @@@ int af_alg_get_rsgl(struct sock *sk, st if (!af_alg_readable(sk)) break;

- if (!ctx->used) { - err = af_alg_wait_for_data(sk, flags); - if (err) - return err; - } - seglen = min_t(size_t, (maxsize - len), msg_data_left(msg));

@@@ -1165,7 -1168,7 +1165,7 @@@

areq->last_rsgl = rsgl; len += err; - ctx->rcvused += err; + atomic_add(err, &ctx->rcvused); rsgl->sg_num_bytes = err; iov_iter_advance(&msg->msg_iter, err); } diff --combined crypto/algif_skcipher.c index c88e5e4cd6a6,9ad167d95103..c4e885df4564 --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@@ -38,6 -38,11 +38,6 @@@ #include <linux/net.h> #include <net/sock.h>

-struct skcipher_tfm { - struct crypto_skcipher *skcipher; - bool has_key; -}; - static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) { @@@ -45,7 -50,8 +45,7 @@@ struct alg_sock *ask = alg_sk(sk); struct sock *psk = ask->parent; struct alg_sock *pask = alg_sk(psk); - struct skcipher_tfm *skc = pask->private; - struct crypto_skcipher *tfm = skc->skcipher; + struct crypto_skcipher *tfm = pask->private; unsigned ivsize = crypto_skcipher_ivsize(tfm);

return af_alg_sendmsg(sock, msg, size, ivsize); @@@ -59,18 -65,13 +59,18 @@@ static int _skcipher_recvmsg(struct soc struct sock *psk = ask->parent; struct alg_sock *pask = alg_sk(psk); struct af_alg_ctx *ctx = ask->private; - struct skcipher_tfm *skc = pask->private; - struct crypto_skcipher *tfm = skc->skcipher; + struct crypto_skcipher *tfm = pask->private; unsigned int bs = crypto_skcipher_blocksize(tfm); struct af_alg_async_req *areq; int err = 0; size_t len = 0;

+ if (!ctx->used) { + err = af_alg_wait_for_data(sk, flags); + if (err) + return err; + } + /* Allocate cipher request for current operation. */ areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) + crypto_skcipher_reqsize(tfm)); @@@ -118,10 -119,6 +118,10 @@@ /* AIO operation */ sock_hold(sk); areq->iocb = msg->msg_iocb; + + /* Remember output size that will be generated. */ + areq->outlen = len; + skcipher_request_set_callback(&areq->cra_u.skcipher_req, CRYPTO_TFM_REQ_MAY_SLEEP, af_alg_async_cb, areq); @@@ -130,8 -127,12 +130,8 @@@ crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);

/* AIO operation in progress */ - if (err == -EINPROGRESS || err == -EBUSY) { - /* Remember output size that will be generated. */ - areq->outlen = len; - + if (err == -EINPROGRESS || err == -EBUSY) return -EIOCBQUEUED; - }

sock_put(sk); } else { @@@ -186,7 -187,6 +186,6 @@@ out return ret; }

- static struct proto_ops algif_skcipher_ops = { .family = PF_ALG,

@@@ -214,7 -214,7 +213,7 @@@ static int skcipher_check_key(struct so int err = 0; struct sock *psk; struct alg_sock *pask; - struct skcipher_tfm *tfm; + struct crypto_skcipher *tfm; struct sock *sk = sock->sk; struct alg_sock *ask = alg_sk(sk);

@@@ -228,7 -228,7 +227,7 @@@

err = -ENOKEY; lock_sock_nested(psk, SINGLE_DEPTH_NESTING); - if (!tfm->has_key) + if (crypto_skcipher_get_flags(tfm) & CRYPTO_TFM_NEED_KEY) goto unlock;

if (!pask->refcnt++) @@@ -307,17 -307,41 +306,17 @@@ static struct proto_ops algif_skcipher_

static void *skcipher_bind(const char *name, u32 type, u32 mask) { - struct skcipher_tfm *tfm; - struct crypto_skcipher *skcipher; - - tfm = kzalloc(sizeof(*tfm), GFP_KERNEL); - if (!tfm) - return ERR_PTR(-ENOMEM); - - skcipher = crypto_alloc_skcipher(name, type, mask); - if (IS_ERR(skcipher)) { - kfree(tfm); - return ERR_CAST(skcipher); - } - - tfm->skcipher = skcipher; - - return tfm; + return crypto_alloc_skcipher(name, type, mask); }

static void skcipher_release(void *private) { - struct skcipher_tfm *tfm = private; - - crypto_free_skcipher(tfm->skcipher); - kfree(tfm); + crypto_free_skcipher(private); }

static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen) { - struct skcipher_tfm *tfm = private; - int err; - - err = crypto_skcipher_setkey(tfm->skcipher, key, keylen); - tfm->has_key = !err; - - return err; + return crypto_skcipher_setkey(private, key, keylen); }

static void skcipher_sock_destruct(struct sock *sk) @@@ -326,7 -350,8 +325,7 @@@ struct af_alg_ctx *ctx = ask->private; struct sock *psk = ask->parent; struct alg_sock *pask = alg_sk(psk); - struct skcipher_tfm *skc = pask->private; - struct crypto_skcipher *tfm = skc->skcipher; + struct crypto_skcipher *tfm = pask->private;

af_alg_pull_tsgl(sk, ctx->used, NULL, 0); sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm)); @@@ -338,26 -363,27 +337,26 @@@ static int skcipher_accept_parent_nokey { struct af_alg_ctx *ctx; struct alg_sock *ask = alg_sk(sk); - struct skcipher_tfm *tfm = private; - struct crypto_skcipher *skcipher = tfm->skcipher; + struct crypto_skcipher *tfm = private; unsigned int len = sizeof(*ctx);

ctx = sock_kmalloc(sk, len, GFP_KERNEL); if (!ctx) return -ENOMEM;

- ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(skcipher), + ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), GFP_KERNEL); if (!ctx->iv) { sock_kfree_s(sk, ctx, len); return -ENOMEM; }

- memset(ctx->iv, 0, crypto_skcipher_ivsize(skcipher)); + memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm));

INIT_LIST_HEAD(&ctx->tsgl_list); ctx->len = len; ctx->used = 0; - ctx->rcvused = 0; + atomic_set(&ctx->rcvused, 0); ctx->more = 0; ctx->merge = 0; ctx->enc = 0; @@@ -372,9 -398,9 +371,9 @@@

static int skcipher_accept_parent(void *private, struct sock *sk) { - struct skcipher_tfm *tfm = private; + struct crypto_skcipher *tfm = private;

- if (!tfm->has_key && crypto_skcipher_has_setkey(tfm->skcipher)) + if (crypto_skcipher_get_flags(tfm) & CRYPTO_TFM_NEED_KEY) return -ENOKEY;

return skcipher_accept_parent_nokey(private, sk); diff --combined drivers/android/binder.c index a7ecfde66b7b,fdc951083b07..cc89d0d2b965 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@@ -482,8 -482,7 +482,8 @@@ enum binder_deferred_state * @tsk task_struct for group_leader of process * (invariant after initialized) * @files files_struct for process - * (invariant after initialized) + * (protected by @files_lock) + * @files_lock mutex to protect @files * @deferred_work_node: element for binder_deferred_list * (protected by binder_deferred_lock) * @deferred_work: bitmap of deferred work to perform @@@ -531,7 -530,6 +531,7 @@@ struct binder_proc int pid; struct task_struct *tsk; struct files_struct *files; + struct mutex files_lock; struct hlist_node deferred_work_node; int deferred_work; bool is_dead; @@@ -879,26 -877,20 +879,26 @@@ static void binder_inc_node_tmpref_iloc

static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) { - struct files_struct *files = proc->files; unsigned long rlim_cur; unsigned long irqs; + int ret;

- if (files == NULL) - return -ESRCH; - - if (!lock_task_sighand(proc->tsk, &irqs)) - return -EMFILE; - + mutex_lock(&proc->files_lock); + if (proc->files == NULL) { + ret = -ESRCH; + goto err; + } + if (!lock_task_sighand(proc->tsk, &irqs)) { + ret = -EMFILE; + goto err; + } rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); unlock_task_sighand(proc->tsk, &irqs);

- return __alloc_fd(files, 0, rlim_cur, flags); + ret = __alloc_fd(proc->files, 0, rlim_cur, flags); +err: + mutex_unlock(&proc->files_lock); + return ret; }

/* @@@ -907,10 -899,8 +907,10 @@@ static void task_fd_install( struct binder_proc *proc, unsigned int fd, struct file *file) { + mutex_lock(&proc->files_lock); if (proc->files) __fd_install(proc->files, fd, file); + mutex_unlock(&proc->files_lock); }

/* @@@ -920,11 -910,9 +920,11 @@@ static long task_close_fd(struct binder { int retval;

- if (proc->files == NULL) - return -ESRCH; - + mutex_lock(&proc->files_lock); + if (proc->files == NULL) { + retval = -ESRCH; + goto err; + } retval = __close_fd(proc->files, fd); /* can't restart close syscall because file table entry was cleared */ if (unlikely(retval == -ERESTARTSYS || @@@ -932,8 -920,7 +932,8 @@@ retval == -ERESTARTNOHAND || retval == -ERESTART_RESTARTBLOCK)) retval = -EINTR; - +err: + mutex_unlock(&proc->files_lock); return retval; }

@@@ -1961,26 -1948,6 +1961,26 @@@ static void binder_send_failed_reply(st }

/** + * binder_cleanup_transaction() - cleans up undelivered transaction + * @t: transaction that needs to be cleaned up + * @reason: reason the transaction wasn't delivered + * @error_code: error to return to caller (if synchronous call) + */ +static void binder_cleanup_transaction(struct binder_transaction *t, + const char *reason, + uint32_t error_code) +{ + if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) { + binder_send_failed_reply(t, error_code); + } else { + binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, + "undelivered transaction %d, %s\n", + t->debug_id, reason); + binder_free_transaction(t); + } +} + +/** * binder_validate_object() - checks for a valid metadata object in a buffer. * @buffer: binder_buffer that we're parsing. * @offset: offset in the buffer at which to validate an object. @@@ -4048,20 -4015,12 +4048,20 @@@ retry if (put_user(cmd, (uint32_t __user *)ptr)) { if (t_from) binder_thread_dec_tmpref(t_from); + + binder_cleanup_transaction(t, "put_user failed", + BR_FAILED_REPLY); + return -EFAULT; } ptr += sizeof(uint32_t); if (copy_to_user(ptr, &tr, sizeof(tr))) { if (t_from) binder_thread_dec_tmpref(t_from); + + binder_cleanup_transaction(t, "copy_to_user failed", + BR_FAILED_REPLY); + return -EFAULT; } ptr += sizeof(tr); @@@ -4131,9 -4090,15 +4131,9 @@@ static void binder_release_work(struct struct binder_transaction *t;

t = container_of(w, struct binder_transaction, work); - if (t->buffer->target_node && - !(t->flags & TF_ONE_WAY)) { - binder_send_failed_reply(t, BR_DEAD_REPLY); - } else { - binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, - "undelivered transaction %d\n", - t->debug_id); - binder_free_transaction(t); - } + + binder_cleanup_transaction(t, "process died.", + BR_DEAD_REPLY); } break; case BINDER_WORK_RETURN_ERROR: { struct binder_error *e = container_of( @@@ -4311,7 -4276,7 +4311,7 @@@ static int binder_thread_release(struc return active_transactions; }

- static unsigned int binder_poll(struct file *filp, + static __poll_t binder_poll(struct file *filp, struct poll_table_struct *wait) { struct binder_proc *proc = filp->private_data; @@@ -4640,9 -4605,7 +4640,9 @@@ static int binder_mmap(struct file *fil ret = binder_alloc_mmap_handler(&proc->alloc, vma); if (ret) return ret; + mutex_lock(&proc->files_lock); proc->files = get_files_struct(current); + mutex_unlock(&proc->files_lock); return 0;

err_bad_arg: @@@ -4666,7 -4629,6 +4666,7 @@@ static int binder_open(struct inode *no spin_lock_init(&proc->outer_lock); get_task_struct(current->group_leader); proc->tsk = current->group_leader; + mutex_init(&proc->files_lock); INIT_LIST_HEAD(&proc->todo); proc->default_priority = task_nice(current); binder_dev = container_of(filp->private_data, struct binder_device, @@@ -4919,11 -4881,9 +4919,11 @@@ static void binder_deferred_func(struc

files = NULL; if (defer & BINDER_DEFERRED_PUT_FILES) { + mutex_lock(&proc->files_lock); files = proc->files; if (files) proc->files = NULL; + mutex_unlock(&proc->files_lock); }

if (defer & BINDER_DEFERRED_FLUSH) diff --combined drivers/char/random.c index 11304bbc78cc,64b59562c872..80f2c326db47 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@@ -431,9 -431,9 +431,9 @@@ static int crng_init = 0 static int crng_init_cnt = 0; #define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE) static void _extract_crng(struct crng_state *crng, - __u8 out[CHACHA20_BLOCK_SIZE]); + __u32 out[CHACHA20_BLOCK_WORDS]); static void _crng_backtrack_protect(struct crng_state *crng, - __u8 tmp[CHACHA20_BLOCK_SIZE], int used); + __u32 tmp[CHACHA20_BLOCK_WORDS], int used); static void process_random_ready_list(void); static void _get_random_bytes(void *buf, int nbytes);

@@@ -817,7 -817,7 +817,7 @@@ static void crng_reseed(struct crng_sta unsigned long flags; int i, num; union { - __u8 block[CHACHA20_BLOCK_SIZE]; + __u32 block[CHACHA20_BLOCK_WORDS]; __u32 key[8]; } buf;

@@@ -851,7 -851,7 +851,7 @@@ }

static void _extract_crng(struct crng_state *crng, - __u8 out[CHACHA20_BLOCK_SIZE]) + __u32 out[CHACHA20_BLOCK_WORDS]) { unsigned long v, flags;

@@@ -867,7 -867,7 +867,7 @@@ spin_unlock_irqrestore(&crng->lock, flags); }

-static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE]) +static void extract_crng(__u32 out[CHACHA20_BLOCK_WORDS]) { struct crng_state *crng = NULL;

@@@ -885,7 -885,7 +885,7 @@@ * enough) to mutate the CRNG key to provide backtracking protection. */ static void _crng_backtrack_protect(struct crng_state *crng, - __u8 tmp[CHACHA20_BLOCK_SIZE], int used) + __u32 tmp[CHACHA20_BLOCK_WORDS], int used) { unsigned long flags; __u32 *s, *d; @@@ -897,14 -897,14 +897,14 @@@ used = 0; } spin_lock_irqsave(&crng->lock, flags); - s = (__u32 *) &tmp[used]; + s = &tmp[used / sizeof(__u32)]; d = &crng->state[4]; for (i=0; i < 8; i++) *d++ ^= *s++; spin_unlock_irqrestore(&crng->lock, flags); }

-static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used) +static void crng_backtrack_protect(__u32 tmp[CHACHA20_BLOCK_WORDS], int used) { struct crng_state *crng = NULL;

@@@ -920,7 -920,7 +920,7 @@@ static ssize_t extract_crng_user(void __user *buf, size_t nbytes) { ssize_t ret = 0, i = CHACHA20_BLOCK_SIZE; - __u8 tmp[CHACHA20_BLOCK_SIZE]; + __u32 tmp[CHACHA20_BLOCK_WORDS]; int large_request = (nbytes > 256);

while (nbytes) { @@@ -1507,7 -1507,7 +1507,7 @@@ static void _warn_unseeded_randomness(c */ static void _get_random_bytes(void *buf, int nbytes) { - __u8 tmp[CHACHA20_BLOCK_SIZE]; + __u32 tmp[CHACHA20_BLOCK_WORDS];

trace_get_random_bytes(nbytes, _RET_IP_);

@@@ -1784,10 -1784,10 +1784,10 @@@ urandom_read(struct file *file, char __ return ret; }

- static unsigned int + static __poll_t random_poll(struct file *file, poll_table * wait) { - unsigned int mask; + __poll_t mask;

poll_wait(file, &random_read_wait, wait); poll_wait(file, &random_write_wait, wait); @@@ -2114,7 -2114,7 +2114,7 @@@ u64 get_random_u64(void if (use_lock) read_lock_irqsave(&batched_entropy_reset_lock, flags); if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) { - extract_crng((u8 *)batch->entropy_u64); + extract_crng((__u32 *)batch->entropy_u64); batch->position = 0; } ret = batch->entropy_u64[batch->position++]; @@@ -2144,7 -2144,7 +2144,7 @@@ u32 get_random_u32(void if (use_lock) read_lock_irqsave(&batched_entropy_reset_lock, flags); if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) { - extract_crng((u8 *)batch->entropy_u32); + extract_crng(batch->entropy_u32); batch->position = 0; } ret = batch->entropy_u32[batch->position++]; diff --combined drivers/gpio/gpiolib.c index 14532d9576e4,46824c486e1e..5d6e8bb38ac7 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@@ -73,8 -73,7 +73,8 @@@ LIST_HEAD(gpio_devices)

static void gpiochip_free_hogs(struct gpio_chip *chip); static int gpiochip_add_irqchip(struct gpio_chip *gpiochip, - struct lock_class_key *key); + struct lock_class_key *lock_key, + struct lock_class_key *request_key); static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip); static int gpiochip_irqchip_init_valid_mask(struct gpio_chip *gpiochip); static void gpiochip_irqchip_free_valid_mask(struct gpio_chip *gpiochip); @@@ -604,11 -603,11 +604,11 @@@ struct lineevent_state (GPIOEVENT_REQUEST_RISING_EDGE | \ GPIOEVENT_REQUEST_FALLING_EDGE)

- static unsigned int lineevent_poll(struct file *filep, + static __poll_t lineevent_poll(struct file *filep, struct poll_table_struct *wait) { struct lineevent_state *le = filep->private_data; - unsigned int events = 0; + __poll_t events = 0;

poll_wait(filep, &le->wait, wait);

@@@ -1101,8 -1100,7 +1101,8 @@@ static void gpiochip_setup_devs(void }

int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data, - struct lock_class_key *key) + struct lock_class_key *lock_key, + struct lock_class_key *request_key) { unsigned long flags; int status = 0; @@@ -1248,7 -1246,7 +1248,7 @@@ if (status) goto err_remove_from_list;

- status = gpiochip_add_irqchip(chip, key); + status = gpiochip_add_irqchip(chip, lock_key, request_key); if (status) goto err_remove_chip;

@@@ -1634,7 -1632,7 +1634,7 @@@ int gpiochip_irq_map(struct irq_domain * This lock class tells lockdep that GPIO irqs are in a different * category than their parents, so it won't report false recursion. */ - irq_set_lockdep_class(irq, chip->irq.lock_key); + irq_set_lockdep_class(irq, chip->irq.lock_key, chip->irq.request_key); irq_set_chip_and_handler(irq, chip->irq.chip, chip->irq.handler); /* Chips that use nested thread handlers have them marked */ if (chip->irq.threaded) @@@ -1714,12 -1712,10 +1714,12 @@@ static int gpiochip_to_irq(struct gpio_ /** * gpiochip_add_irqchip() - adds an IRQ chip to a GPIO chip * @gpiochip: the GPIO chip to add the IRQ chip to - * @lock_key: lockdep class + * @lock_key: lockdep class for IRQ lock + * @request_key: lockdep class for IRQ request */ static int gpiochip_add_irqchip(struct gpio_chip *gpiochip, - struct lock_class_key *lock_key) + struct lock_class_key *lock_key, + struct lock_class_key *request_key) { struct irq_chip *irqchip = gpiochip->irq.chip; const struct irq_domain_ops *ops; @@@ -1757,7 -1753,6 +1757,7 @@@ gpiochip->to_irq = gpiochip_to_irq; gpiochip->irq.default_type = type; gpiochip->irq.lock_key = lock_key; + gpiochip->irq.request_key = request_key;

if (gpiochip->irq.domain_ops) ops = gpiochip->irq.domain_ops; @@@ -1855,8 -1850,7 +1855,8 @@@ static void gpiochip_irqchip_remove(str * @type: the default type for IRQs on this irqchip, pass IRQ_TYPE_NONE * to have the core avoid setting up any default type in the hardware. * @threaded: whether this irqchip uses a nested thread handler - * @lock_key: lockdep class + * @lock_key: lockdep class for IRQ lock + * @request_key: lockdep class for IRQ request * * This function closely associates a certain irqchip with a certain * gpiochip, providing an irq domain to translate the local IRQs to @@@ -1878,8 -1872,7 +1878,8 @@@ int gpiochip_irqchip_add_key(struct gpi irq_flow_handler_t handler, unsigned int type, bool threaded, - struct lock_class_key *lock_key) + struct lock_class_key *lock_key, + struct lock_class_key *request_key) { struct device_node *of_node;

@@@ -1920,7 -1913,6 +1920,7 @@@ gpiochip->irq.default_type = type; gpiochip->to_irq = gpiochip_to_irq; gpiochip->irq.lock_key = lock_key; + gpiochip->irq.request_key = request_key; gpiochip->irq.domain = irq_domain_add_simple(of_node, gpiochip->ngpio, first_irq, &gpiochip_domain_ops, gpiochip); @@@ -1948,8 -1940,7 +1948,8 @@@ EXPORT_SYMBOL_GPL(gpiochip_irqchip_add_ #else /* CONFIG_GPIOLIB_IRQCHIP */

static inline int gpiochip_add_irqchip(struct gpio_chip *gpiochip, - struct lock_class_key *key) + struct lock_class_key *lock_key, + struct lock_class_key *request_key) { return 0; } @@@ -2893,27 -2884,6 +2893,27 @@@ void gpiod_set_raw_value(struct gpio_de EXPORT_SYMBOL_GPL(gpiod_set_raw_value);

/** + * gpiod_set_value_nocheck() - set a GPIO line value without checking + * @desc: the descriptor to set the value on + * @value: value to set + * + * This sets the value of a GPIO line backing a descriptor, applying + * different semantic quirks like active low and open drain/source + * handling. + */ +static void gpiod_set_value_nocheck(struct gpio_desc *desc, int value) +{ + if (test_bit(FLAG_ACTIVE_LOW, &desc->flags)) + value = !value; + if (test_bit(FLAG_OPEN_DRAIN, &desc->flags)) + gpio_set_open_drain_value_commit(desc, value); + else if (test_bit(FLAG_OPEN_SOURCE, &desc->flags)) + gpio_set_open_source_value_commit(desc, value); + else + gpiod_set_raw_value_commit(desc, value); +} + +/** * gpiod_set_value() - assign a gpio's value * @desc: gpio whose value will be assigned * @value: value to assign @@@ -2927,8 -2897,16 +2927,8 @@@ void gpiod_set_value(struct gpio_desc *desc, int value) { VALIDATE_DESC_VOID(desc); - /* Should be using gpiod_set_value_cansleep() */ WARN_ON(desc->gdev->chip->can_sleep); - if (test_bit(FLAG_ACTIVE_LOW, &desc->flags)) - value = !value; - if (test_bit(FLAG_OPEN_DRAIN, &desc->flags)) - gpio_set_open_drain_value_commit(desc, value); - else if (test_bit(FLAG_OPEN_SOURCE, &desc->flags)) - gpio_set_open_source_value_commit(desc, value); - else - gpiod_set_raw_value_commit(desc, value); + gpiod_set_value_nocheck(desc, value); } EXPORT_SYMBOL_GPL(gpiod_set_value);

@@@ -3256,7 -3234,9 +3256,7 @@@ void gpiod_set_value_cansleep(struct gp { might_sleep_if(extra_checks); VALIDATE_DESC_VOID(desc); - if (test_bit(FLAG_ACTIVE_LOW, &desc->flags)) - value = !value; - gpiod_set_raw_value_commit(desc, value); + gpiod_set_value_nocheck(desc, value); } EXPORT_SYMBOL_GPL(gpiod_set_value_cansleep);

diff --combined drivers/infiniband/hw/hfi1/file_ops.c index 1df7da47f431,82086241aac3..bd6f03cc5ee0 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@@ -74,7 -74,7 +74,7 @@@ static int hfi1_file_open(struct inode *inode, struct file *fp); static int hfi1_file_close(struct inode *inode, struct file *fp); static ssize_t hfi1_write_iter(struct kiocb *kiocb, struct iov_iter *from); - static unsigned int hfi1_poll(struct file *fp, struct poll_table_struct *pt); + static __poll_t hfi1_poll(struct file *fp, struct poll_table_struct *pt); static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma);

static u64 kvirt_to_phys(void *addr); @@@ -102,8 -102,8 +102,8 @@@ static int allocate_ctxt(struct hfi1_fi struct hfi1_user_info *uinfo, struct hfi1_ctxtdata **cd); static void deallocate_ctxt(struct hfi1_ctxtdata *uctxt); - static unsigned int poll_urgent(struct file *fp, struct poll_table_struct *pt); - static unsigned int poll_next(struct file *fp, struct poll_table_struct *pt); + static __poll_t poll_urgent(struct file *fp, struct poll_table_struct *pt); + static __poll_t poll_next(struct file *fp, struct poll_table_struct *pt); static int user_event_ack(struct hfi1_ctxtdata *uctxt, u16 subctxt, unsigned long arg); static int set_ctxt_pkey(struct hfi1_ctxtdata *uctxt, unsigned long arg); @@@ -607,10 -607,10 +607,10 @@@ static int vma_fault(struct vm_fault *v return 0; }

- static unsigned int hfi1_poll(struct file *fp, struct poll_table_struct *pt) + static __poll_t hfi1_poll(struct file *fp, struct poll_table_struct *pt) { struct hfi1_ctxtdata *uctxt; - unsigned pollflag; + __poll_t pollflag;

uctxt = ((struct hfi1_filedata *)fp->private_data)->uctxt; if (!uctxt) @@@ -763,11 -763,11 +763,11 @@@ static int complete_subctxt(struct hfi1 }

if (ret) { - hfi1_rcd_put(fd->uctxt); - fd->uctxt = NULL; spin_lock_irqsave(&fd->dd->uctxt_lock, flags); __clear_bit(fd->subctxt, fd->uctxt->in_use_ctxts); spin_unlock_irqrestore(&fd->dd->uctxt_lock, flags); + hfi1_rcd_put(fd->uctxt); + fd->uctxt = NULL; }

return ret; @@@ -1425,13 -1425,13 +1425,13 @@@ static int user_exp_rcv_invalid(struct return ret; }

- static unsigned int poll_urgent(struct file *fp, + static __poll_t poll_urgent(struct file *fp, struct poll_table_struct *pt) { struct hfi1_filedata *fd = fp->private_data; struct hfi1_ctxtdata *uctxt = fd->uctxt; struct hfi1_devdata *dd = uctxt->dd; - unsigned pollflag; + __poll_t pollflag;

poll_wait(fp, &uctxt->wait, pt);

@@@ -1448,13 -1448,13 +1448,13 @@@ return pollflag; }

- static unsigned int poll_next(struct file *fp, + static __poll_t poll_next(struct file *fp, struct poll_table_struct *pt) { struct hfi1_filedata *fd = fp->private_data; struct hfi1_ctxtdata *uctxt = fd->uctxt; struct hfi1_devdata *dd = uctxt->dd; - unsigned pollflag; + __poll_t pollflag;

poll_wait(fp, &uctxt->wait, pt);

diff --combined drivers/md/md.c index 4e4dee0ec2de,e638d7199bd4..cb1476214f3f --- a/drivers/md/md.c +++ b/drivers/md/md.c @@@ -7605,9 -7605,7 +7605,9 @@@ static int status_resync(struct seq_fil if (test_bit(MD_RECOVERY_DONE, &mddev->recovery)) /* Still cleaning up */ resync = max_sectors; - } else + } else if (resync > max_sectors) + resync = max_sectors; + else resync -= atomic_read(&mddev->recovery_active);

if (resync == 0) { @@@ -7871,10 -7869,10 +7871,10 @@@ static int md_seq_open(struct inode *in }

static int md_unloading; - static unsigned int mdstat_poll(struct file *filp, poll_table *wait) + static __poll_t mdstat_poll(struct file *filp, poll_table *wait) { struct seq_file *seq = filp->private_data; - int mask; + __poll_t mask;

if (md_unloading) return POLLIN|POLLRDNORM|POLLERR|POLLPRI; diff --combined drivers/media/dvb-core/dvb_ca_en50221.c index d48b61eb01f4,dbb527a2befc..3f6c8bd8f869 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@@ -206,7 -206,7 +206,7 @@@ static int dvb_ca_en50221_write_data(st * @hlen: Number of bytes in haystack. * @needle: Buffer to find. * @nlen: Number of bytes in needle. - * @return Pointer into haystack needle was found at, or NULL if not found. + * return: Pointer into haystack needle was found at, or NULL if not found. */ static char *findstr(char *haystack, int hlen, char *needle, int nlen) { @@@ -226,7 -226,7 +226,7 @@@ /* ************************************************************************** */ /* EN50221 physical interface functions */

-/** +/* * dvb_ca_en50221_check_camstatus - Check CAM status. */ static int dvb_ca_en50221_check_camstatus(struct dvb_ca_private *ca, int slot) @@@ -275,9 -275,9 +275,9 @@@ * @ca: CA instance. * @slot: Slot on interface. * @waitfor: Flags to wait for. - * @timeout_ms: Timeout in milliseconds. + * @timeout_hz: Timeout in milliseconds. * - * @return 0 on success, nonzero on error. + * return: 0 on success, nonzero on error. */ static int dvb_ca_en50221_wait_if_status(struct dvb_ca_private *ca, int slot, u8 waitfor, int timeout_hz) @@@ -325,7 -325,7 +325,7 @@@ * @ca: CA instance. * @slot: Slot id. * - * @return 0 on success, nonzero on failure. + * return: 0 on success, nonzero on failure. */ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot) { @@@ -397,11 -397,11 +397,11 @@@ * @ca: CA instance. * @slot: Slot id. * @address: Address to read from. Updated. - * @tupleType: Tuple id byte. Updated. - * @tupleLength: Tuple length. Updated. + * @tuple_type: Tuple id byte. Updated. + * @tuple_length: Tuple length. Updated. * @tuple: Dest buffer for tuple (must be 256 bytes). Updated. * - * @return 0 on success, nonzero on error. + * return: 0 on success, nonzero on error. */ static int dvb_ca_en50221_read_tuple(struct dvb_ca_private *ca, int slot, int *address, int *tuple_type, @@@ -455,7 -455,7 +455,7 @@@ * @ca: CA instance. * @slot: Slot id. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_parse_attributes(struct dvb_ca_private *ca, int slot) { @@@ -632,11 -632,10 +632,11 @@@ static int dvb_ca_en50221_set_configopt * @ca: CA instance. * @slot: Slot to read from. * @ebuf: If non-NULL, the data will be written to this buffer. If NULL, - * the data will be added into the buffering system as a normal fragment. + * the data will be added into the buffering system as a normal + * fragment. * @ecount: Size of ebuf. Ignored if ebuf is NULL. * - * @return Number of bytes read, or < 0 on error + * return: Number of bytes read, or < 0 on error */ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 *ebuf, int ecount) @@@ -785,11 -784,11 +785,11 @@@ exit * * @ca: CA instance. * @slot: Slot to write to. - * @ebuf: The data in this buffer is treated as a complete link-level packet to - * be written. - * @count: Size of ebuf. + * @buf: The data in this buffer is treated as a complete link-level packet to + * be written. + * @bytes_write: Size of ebuf. * - * @return Number of bytes written, or < 0 on error. + * return: Number of bytes written, or < 0 on error. */ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 *buf, int bytes_write) @@@ -934,7 -933,7 +934,7 @@@ static int dvb_ca_en50221_slot_shutdown /** * dvb_ca_en50221_camchange_irq - A CAMCHANGE IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. * @change_type: One of the DVB_CA_CAMCHANGE_* values. */ @@@ -964,7 -963,7 +964,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_camchange_ /** * dvb_ca_en50221_camready_irq - A CAMREADY IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. */ void dvb_ca_en50221_camready_irq(struct dvb_ca_en50221 *pubca, int slot) @@@ -984,7 -983,7 +984,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_camready_i /** * dvb_ca_en50221_frda_irq - An FR or DA IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. */ void dvb_ca_en50221_frda_irq(struct dvb_ca_en50221 *pubca, int slot) @@@ -1092,7 -1091,7 +1092,7 @@@ static void dvb_ca_en50221_thread_updat * * @ca: CA instance. * @slot: Slot to process. - * @return: 0 .. no change + * return:: 0 .. no change * 1 .. CAM state changed */

@@@ -1297,7 -1296,7 +1297,7 @@@ static void dvb_ca_en50221_thread_state mutex_unlock(&sl->slot_lock); }

-/** +/* * Kernel thread which monitors CA slots for CAM changes, and performs data * transfers. */ @@@ -1337,11 -1336,12 +1337,11 @@@ static int dvb_ca_en50221_thread(void * * Real ioctl implementation. * NOTE: CA_SEND_MSG/CA_GET_MSG ioctls have userspace buffers passed to them. * - * @inode: Inode concerned. * @file: File concerned. * @cmd: IOCTL command. - * @arg: Associated argument. + * @parg: Associated argument. * - * @return 0 on success, <0 on error. + * return: 0 on success, <0 on error. */ static int dvb_ca_en50221_io_do_ioctl(struct file *file, unsigned int cmd, void *parg) @@@ -1420,11 -1420,12 +1420,11 @@@ out_unlock /** * Wrapper for ioctl implementation. * - * @inode: Inode concerned. * @file: File concerned. * @cmd: IOCTL command. * @arg: Associated argument. * - * @return 0 on success, <0 on error. + * return: 0 on success, <0 on error. */ static long dvb_ca_en50221_io_ioctl(struct file *file, unsigned int cmd, unsigned long arg) @@@ -1440,7 -1441,7 +1440,7 @@@ * @count: Size of source buffer. * @ppos: Position in file (ignored). * - * @return Number of bytes read, or <0 on error. + * return: Number of bytes read, or <0 on error. */ static ssize_t dvb_ca_en50221_io_write(struct file *file, const char __user *buf, size_t count, @@@ -1535,7 -1536,7 +1535,7 @@@ exit return status; }

-/** +/* * Condition for waking up in dvb_ca_en50221_io_read_condition */ static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private *ca, @@@ -1592,7 -1593,7 +1592,7 @@@ nextslot * @count: Size of destination buffer. * @ppos: Position in file (ignored). * - * @return Number of bytes read, or <0 on error. + * return: Number of bytes read, or <0 on error. */ static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) @@@ -1701,7 -1702,7 +1701,7 @@@ exit * @inode: Inode concerned. * @file: File concerned. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) { @@@ -1751,7 -1752,7 +1751,7 @@@ * @inode: Inode concerned. * @file: File concerned. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) { @@@ -1780,13 -1781,13 +1780,13 @@@ * @file: File concerned. * @wait: poll wait table. * - * @return Standard poll mask. + * return: Standard poll mask. */ - static unsigned int dvb_ca_en50221_io_poll(struct file *file, poll_table *wait) + static __poll_t dvb_ca_en50221_io_poll(struct file *file, poll_table *wait) { struct dvb_device *dvbdev = file->private_data; struct dvb_ca_private *ca = dvbdev->priv; - unsigned int mask = 0; + __poll_t mask = 0; int slot; int result = 0;

@@@ -1837,11 -1838,11 +1837,11 @@@ static const struct dvb_device dvbdev_c * Initialise a new DVB CA EN50221 interface device. * * @dvb_adapter: DVB adapter to attach the new CA device to. - * @ca: The dvb_ca instance. + * @pubca: The dvb_ca instance. * @flags: Flags describing the CA device (DVB_CA_FLAG_*). * @slot_count: Number of slots supported. * - * @return 0 on success, nonzero on failure + * return: 0 on success, nonzero on failure */ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, struct dvb_ca_en50221 *pubca, int flags, int slot_count) @@@ -1928,7 -1929,8 +1928,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_init) /** * Release a DVB CA EN50221 interface device. * - * @ca_dev: The dvb_device_t instance for the CA device. - * @ca: The associated dvb_ca instance. + * @pubca: The associated dvb_ca instance. */ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) { diff --combined drivers/media/dvb-core/dvb_frontend.c index 2afaa8226342,92e2433415f0..48e16fd003a7 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@@ -369,14 -369,11 +369,14 @@@ static void dvb_frontend_swzigzag_updat }

/** - * Performs automatic twiddling of frontend parameters. + * dvb_frontend_swzigzag_autotune - Performs automatic twiddling of frontend + * parameters. * - * @param fe The frontend concerned. - * @param check_wrapped Checks if an iteration has completed. DO NOT SET ON THE FIRST ATTEMPT - * @returns Number of complete iterations that have been performed. + * @fe: The frontend concerned. + * @check_wrapped: Checks if an iteration has completed. + * DO NOT SET ON THE FIRST ATTEMPT. + * + * return: Number of complete iterations that have been performed. */ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wrapped) { @@@ -1256,7 -1253,7 +1256,7 @@@ dtv_property_legacy_params_sync(struct * dtv_get_frontend - calls a callback for retrieving DTV parameters * @fe: struct dvb_frontend pointer * @c: struct dtv_frontend_properties pointer (DVBv5 cache) - * @p_out struct dvb_frontend_parameters pointer (DVBv3 FE struct) + * @p_out: struct dvb_frontend_parameters pointer (DVBv3 FE struct) * * This routine calls either the DVBv3 or DVBv5 get_frontend call. * If c is not null, it will update the DVBv5 cache struct pointed by it. @@@ -2470,7 -2467,7 +2470,7 @@@ static int dvb_frontend_handle_ioctl(st }

- static unsigned int dvb_frontend_poll(struct file *file, struct poll_table_struct *wait) + static __poll_t dvb_frontend_poll(struct file *file, struct poll_table_struct *wait) { struct dvb_device *dvbdev = file->private_data; struct dvb_frontend *fe = dvbdev->priv; diff --combined drivers/media/platform/sh_veu.c index dedc1b024f6f,15cf51f5d280..976ea0bb5b6c --- a/drivers/media/platform/sh_veu.c +++ b/drivers/media/platform/sh_veu.c @@@ -267,7 -267,7 +267,7 @@@ static void sh_veu_process(struct sh_ve sh_veu_reg_write(veu, VEU_EIER, 1); /* enable interrupt in VEU */ }

-/** +/* * sh_veu_device_run() - prepares and starts the device * * This will be called by the framework when it decides to schedule a particular @@@ -1016,7 -1016,7 +1016,7 @@@ static int sh_veu_release(struct file * return 0; }

- static unsigned int sh_veu_poll(struct file *file, + static __poll_t sh_veu_poll(struct file *file, struct poll_table_struct *wait) { struct sh_veu_file *veu_file = file->private_data; diff --combined drivers/media/radio/radio-si476x.c index 540ac887a63c,248bd0ffc978..49293dd707b9 --- a/drivers/media/radio/radio-si476x.c +++ b/drivers/media/radio/radio-si476x.c @@@ -158,7 -158,7 +158,7 @@@ enum si476x_ctrl_idx }; static struct v4l2_ctrl_config si476x_ctrls[] = {

- /** + /* * SI476X during its station seeking(or tuning) process uses several * parameters to detrmine if "the station" is valid: * @@@ -197,7 -197,7 +197,7 @@@ .step = 2, },

- /** + /* * #V4L2_CID_SI476X_HARMONICS_COUNT -- number of harmonics * built-in power-line noise supression filter is to reject * during AM-mode operation. @@@ -213,7 -213,7 +213,7 @@@ .step = 1, },

- /** + /* * #V4L2_CID_SI476X_DIVERSITY_MODE -- configuration which * two tuners working in diversity mode are to work in. * @@@ -237,7 -237,7 +237,7 @@@ .max = ARRAY_SIZE(phase_diversity_modes) - 1, },

- /** + /* * #V4L2_CID_SI476X_INTERCHIP_LINK -- inter-chip link in * diversity mode indicator. Allows user to determine if two * chips working in diversity mode have established a link @@@ -296,15 -296,11 +296,15 @@@ struct si476x_radio_ops /** * struct si476x_radio - radio device * - * @core: Pointer to underlying core device + * @v4l2dev: Pointer to V4L2 device created by V4L2 subsystem * @videodev: Pointer to video device created by V4L2 subsystem + * @ctrl_handler: V4L2 controls handler + * @core: Pointer to underlying core device * @ops: Vtable of functions. See struct si476x_radio_ops for details - * @kref: Reference counter - * @core_lock: An r/w semaphore to brebvent the deletion of underlying + * @debugfs: pointer to &strucd dentry for debugfs + * @audmode: audio mode, as defined for the rxsubchans field + * at videodev2.h + * * core structure is the radio device is being used */ struct si476x_radio { @@@ -1153,12 -1149,12 +1153,12 @@@ static ssize_t si476x_radio_fops_read(s return rval; }

- static unsigned int si476x_radio_fops_poll(struct file *file, + static __poll_t si476x_radio_fops_poll(struct file *file, struct poll_table_struct *pts) { struct si476x_radio *radio = video_drvdata(file); - unsigned long req_events = poll_requested_events(pts); - unsigned int err = v4l2_ctrl_poll(file, pts); + __poll_t req_events = poll_requested_events(pts); + __poll_t err = v4l2_ctrl_poll(file, pts);

if (req_events & (POLLIN | POLLRDNORM)) { if (atomic_read(&radio->core->is_alive)) diff --combined drivers/media/radio/radio-wl1273.c index 3cbdc085c65d,4cd4241fc7be..f92b0f9241a9 --- a/drivers/media/radio/radio-wl1273.c +++ b/drivers/media/radio/radio-wl1273.c @@@ -1089,7 -1089,7 +1089,7 @@@ out return r; }

- static unsigned int wl1273_fm_fops_poll(struct file *file, + static __poll_t wl1273_fm_fops_poll(struct file *file, struct poll_table_struct *pts) { struct wl1273_device *radio = video_get_drvdata(video_devdata(file)); @@@ -1330,7 -1330,7 +1330,7 @@@ static int wl1273_fm_vidioc_s_input(str

/** * wl1273_fm_set_tx_power() - Set the transmission power value. - * @core: A pointer to the device struct. + * @radio: A pointer to the device struct. * @power: The new power value. */ static int wl1273_fm_set_tx_power(struct wl1273_device *radio, u16 power) diff --combined drivers/media/v4l2-core/v4l2-mem2mem.c index bc580fbe18fa,a879d11866bd..186156f8952a --- a/drivers/media/v4l2-core/v4l2-mem2mem.c +++ b/drivers/media/v4l2-core/v4l2-mem2mem.c @@@ -183,7 -183,6 +183,7 @@@ EXPORT_SYMBOL(v4l2_m2m_get_curr_priv)

/** * v4l2_m2m_try_run() - select next job to perform and run it if possible + * @m2m_dev: per-device context * * Get next transaction (if present) from the waiting jobs list and run it. */ @@@ -282,7 -281,6 +282,7 @@@ EXPORT_SYMBOL_GPL(v4l2_m2m_try_schedule

/** * v4l2_m2m_cancel_job() - cancel pending jobs for the context + * @m2m_ctx: m2m context with jobs to be canceled * * In case of streamoff or release called on any context, * 1] If the context is currently running, then abort job will be called @@@ -500,14 -498,14 +500,14 @@@ int v4l2_m2m_streamoff(struct file *fil } EXPORT_SYMBOL_GPL(v4l2_m2m_streamoff);

- unsigned int v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, + __poll_t v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, struct poll_table_struct *wait) { struct video_device *vfd = video_devdata(file); - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct vb2_queue *src_q, *dst_q; struct vb2_buffer *src_vb = NULL, *dst_vb = NULL; - unsigned int rc = 0; + __poll_t rc = 0; unsigned long flags;

if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) { @@@ -794,11 -792,11 +794,11 @@@ int v4l2_m2m_fop_mmap(struct file *file } EXPORT_SYMBOL_GPL(v4l2_m2m_fop_mmap);

- unsigned int v4l2_m2m_fop_poll(struct file *file, poll_table *wait) + __poll_t v4l2_m2m_fop_poll(struct file *file, poll_table *wait) { struct v4l2_fh *fh = file->private_data; struct v4l2_m2m_ctx *m2m_ctx = fh->m2m_ctx; - unsigned int ret; + __poll_t ret;

if (m2m_ctx->q_lock) mutex_lock(m2m_ctx->q_lock); diff --combined drivers/media/v4l2-core/videobuf-core.c index e87fb13b22dc,0c5b12b8bb52..9a89d3ae170f --- a/drivers/media/v4l2-core/videobuf-core.c +++ b/drivers/media/v4l2-core/videobuf-core.c @@@ -222,7 -222,7 +222,7 @@@ int videobuf_queue_is_busy(struct video } EXPORT_SYMBOL_GPL(videobuf_queue_is_busy);

-/** +/* * __videobuf_free() - free all the buffers and their control structures * * This function can only be called if streaming/reading is off, i.e. no buffers @@@ -1118,13 -1118,13 +1118,13 @@@ done } EXPORT_SYMBOL_GPL(videobuf_read_stream);

- unsigned int videobuf_poll_stream(struct file *file, + __poll_t videobuf_poll_stream(struct file *file, struct videobuf_queue *q, poll_table *wait) { - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct videobuf_buffer *buf = NULL; - unsigned int rc = 0; + __poll_t rc = 0;

videobuf_queue_lock(q); if (q->streaming) { diff --combined drivers/media/v4l2-core/videobuf2-core.c index a8589d96ef72,dc1f683c3b71..0d9f772d6d03 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@@ -188,7 -188,7 +188,7 @@@ module_param(debug, int, 0644) static void __vb2_queue_cancel(struct vb2_queue *q); static void __enqueue_in_driver(struct vb2_buffer *vb);

-/** +/* * __vb2_buf_mem_alloc() - allocate video memory for the given buffer */ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb) @@@ -229,7 -229,7 +229,7 @@@ free return ret; }

-/** +/* * __vb2_buf_mem_free() - free memory of the given buffer */ static void __vb2_buf_mem_free(struct vb2_buffer *vb) @@@ -243,7 -243,7 +243,7 @@@ } }

-/** +/* * __vb2_buf_userptr_put() - release userspace memory associated with * a USERPTR buffer */ @@@ -258,7 -258,7 +258,7 @@@ static void __vb2_buf_userptr_put(struc } }

-/** +/* * __vb2_plane_dmabuf_put() - release memory associated with * a DMABUF shared plane */ @@@ -277,7 -277,7 +277,7 @@@ static void __vb2_plane_dmabuf_put(stru p->dbuf_mapped = 0; }

-/** +/* * __vb2_buf_dmabuf_put() - release memory associated with * a DMABUF shared buffer */ @@@ -289,7 -289,7 +289,7 @@@ static void __vb2_buf_dmabuf_put(struc __vb2_plane_dmabuf_put(vb, &vb->planes[plane]); }

-/** +/* * __setup_offsets() - setup unique offsets ("cookies") for every plane in * the buffer. */ @@@ -317,7 -317,7 +317,7 @@@ static void __setup_offsets(struct vb2_ } }

-/** +/* * __vb2_queue_alloc() - allocate videobuf buffer structures and (for MMAP type) * video buffer memory for all buffers/planes on the queue and initializes the * queue @@@ -386,7 -386,7 +386,7 @@@ static int __vb2_queue_alloc(struct vb2 return buffer; }

-/** +/* * __vb2_free_mem() - release all video buffer memory for a given queue */ static void __vb2_free_mem(struct vb2_queue *q, unsigned int buffers) @@@ -410,7 -410,7 +410,7 @@@ } }

-/** +/* * __vb2_queue_free() - free buffers at the end of the queue - video memory and * related information, if no buffers are left return the queue to an * uninitialized state. Might be called even if the queue has already been freed. @@@ -544,7 -544,7 +544,7 @@@ bool vb2_buffer_in_use(struct vb2_queu } EXPORT_SYMBOL(vb2_buffer_in_use);

-/** +/* * __buffers_in_use() - return true if any buffers on the queue are in use and * the queue cannot be freed (by the means of REQBUFS(0)) call */ @@@ -564,7 -564,7 +564,7 @@@ void vb2_core_querybuf(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_core_querybuf);

-/** +/* * __verify_userptr_ops() - verify that all memory operations required for * USERPTR queue type have been provided */ @@@ -577,7 -577,7 +577,7 @@@ static int __verify_userptr_ops(struct return 0; }

-/** +/* * __verify_mmap_ops() - verify that all memory operations required for * MMAP queue type have been provided */ @@@ -590,7 -590,7 +590,7 @@@ static int __verify_mmap_ops(struct vb2 return 0; }

-/** +/* * __verify_dmabuf_ops() - verify that all memory operations required for * DMABUF queue type have been provided */ @@@ -953,7 -953,7 +953,7 @@@ void vb2_discard_done(struct vb2_queue } EXPORT_SYMBOL_GPL(vb2_discard_done);

-/** +/* * __prepare_mmap() - prepare an MMAP buffer */ static int __prepare_mmap(struct vb2_buffer *vb, const void *pb) @@@ -966,7 -966,7 +966,7 @@@ return ret ? ret : call_vb_qop(vb, buf_prepare, vb); }

-/** +/* * __prepare_userptr() - prepare a USERPTR buffer */ static int __prepare_userptr(struct vb2_buffer *vb, const void *pb) @@@ -1082,7 -1082,7 +1082,7 @@@ err return ret; }

-/** +/* * __prepare_dmabuf() - prepare a DMABUF buffer */ static int __prepare_dmabuf(struct vb2_buffer *vb, const void *pb) @@@ -1215,7 -1215,7 +1215,7 @@@ err return ret; }

-/** +/* * __enqueue_in_driver() - enqueue a vb2_buffer in driver for processing */ static void __enqueue_in_driver(struct vb2_buffer *vb) @@@ -1298,7 -1298,7 +1298,7 @@@ int vb2_core_prepare_buf(struct vb2_que } EXPORT_SYMBOL_GPL(vb2_core_prepare_buf);

-/** +/* * vb2_start_streaming() - Attempt to start streaming. * @q: videobuf2 queue * @@@ -1427,7 -1427,7 +1427,7 @@@ int vb2_core_qbuf(struct vb2_queue *q, } EXPORT_SYMBOL_GPL(vb2_core_qbuf);

-/** +/* * __vb2_wait_for_done_vb() - wait for a buffer to become available * for dequeuing * @@@ -1502,7 -1502,7 +1502,7 @@@ static int __vb2_wait_for_done_vb(struc return 0; }

-/** +/* * __vb2_get_done_vb() - get a buffer ready for dequeuing * * Will sleep if required for nonblocking == false. @@@ -1553,7 -1553,7 +1553,7 @@@ int vb2_wait_for_all_buffers(struct vb2 } EXPORT_SYMBOL_GPL(vb2_wait_for_all_buffers);

-/** +/* * __vb2_dqbuf() - bring back the buffer to the DEQUEUED state */ static void __vb2_dqbuf(struct vb2_buffer *vb) @@@ -1625,7 -1625,7 +1625,7 @@@ int vb2_core_dqbuf(struct vb2_queue *q } EXPORT_SYMBOL_GPL(vb2_core_dqbuf);

-/** +/* * __vb2_queue_cancel() - cancel and stop (pause) streaming * * Removes all queued buffers from driver's queue and all buffers queued by @@@ -1773,7 -1773,7 +1773,7 @@@ int vb2_core_streamoff(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_core_streamoff);

-/** +/* * __find_plane_by_offset() - find plane associated with the given offset off */ static int __find_plane_by_offset(struct vb2_queue *q, unsigned long off, @@@ -2018,10 -2018,10 +2018,10 @@@ void vb2_core_queue_release(struct vb2_ } EXPORT_SYMBOL_GPL(vb2_core_queue_release);

- unsigned int vb2_core_poll(struct vb2_queue *q, struct file *file, + __poll_t vb2_core_poll(struct vb2_queue *q, struct file *file, poll_table *wait) { - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct vb2_buffer *vb = NULL; unsigned long flags;

@@@ -2104,7 -2104,7 +2104,7 @@@ } EXPORT_SYMBOL_GPL(vb2_core_poll);

-/** +/* * struct vb2_fileio_buf - buffer context used by file io emulator * * vb2 provides a compatibility layer and emulator of file io (read and @@@ -2118,7 -2118,7 +2118,7 @@@ struct vb2_fileio_buf unsigned int queued:1; };

-/** +/* * struct vb2_fileio_data - queue context used by file io emulator * * @cur_index: the index of the buffer currently being read from or @@@ -2155,7 -2155,7 +2155,7 @@@ struct vb2_fileio_data unsigned write_immediately:1; };

-/** +/* * __vb2_init_fileio() - initialize file io emulator * @q: videobuf2 queue * @read: mode selector (1 means read, 0 means write) @@@ -2274,7 -2274,7 +2274,7 @@@ err_kfree return ret; }

-/** +/* * __vb2_cleanup_fileio() - free resourced used by file io emulator * @q: videobuf2 queue */ @@@ -2293,7 -2293,7 +2293,7 @@@ static int __vb2_cleanup_fileio(struct return 0; }

-/** +/* * __vb2_perform_fileio() - perform a single file io (read or write) operation * @q: videobuf2 queue * @data: pointed to target userspace buffer diff --combined drivers/media/v4l2-core/videobuf2-v4l2.c index 4075314a6989,d2b3a74d14fd..a49f7eb98c2e --- a/drivers/media/v4l2-core/videobuf2-v4l2.c +++ b/drivers/media/v4l2-core/videobuf2-v4l2.c @@@ -49,7 -49,7 +49,7 @@@ module_param(debug, int, 0644) #define V4L2_BUFFER_OUT_FLAGS (V4L2_BUF_FLAG_PFRAME | V4L2_BUF_FLAG_BFRAME | \ V4L2_BUF_FLAG_KEYFRAME | V4L2_BUF_FLAG_TIMECODE)

-/** +/* * __verify_planes_array() - verify that the planes array passed in struct * v4l2_buffer from userspace can be safely used */ @@@ -78,7 -78,7 +78,7 @@@ static int __verify_planes_array_core(s return __verify_planes_array(vb, pb); }

-/** +/* * __verify_length() - Verify that the bytesused value for each plane fits in * the plane length and that the data offset doesn't exceed the bytesused value. */ @@@ -181,7 -181,7 +181,7 @@@ static int vb2_queue_or_prepare_buf(str return __verify_planes_array(q->bufs[b->index], b); }

-/** +/* * __fill_v4l2_buffer() - fill in a struct v4l2_buffer with information to be * returned to userspace */ @@@ -286,7 -286,7 +286,7 @@@ static void __fill_v4l2_buffer(struct v q->last_buffer_dequeued = true; }

-/** +/* * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a * v4l2_buffer by the userspace. It also verifies that struct * v4l2_buffer has a valid number of planes. @@@ -446,7 -446,7 +446,7 @@@ static const struct vb2_buf_ops v4l2_bu .copy_timestamp = __copy_timestamp, };

-/** +/* * vb2_querybuf() - query video buffer information * @q: videobuf queue * @b: buffer struct passed from userspace to vidioc_querybuf handler @@@ -671,11 -671,11 +671,11 @@@ void vb2_queue_release(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_queue_release);

- unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait) + __poll_t vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait) { struct video_device *vfd = video_devdata(file); - unsigned long req_events = poll_requested_events(wait); - unsigned int res = 0; + __poll_t req_events = poll_requested_events(wait); + __poll_t res = 0;

if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) { struct v4l2_fh *fh = file->private_data; @@@ -904,12 -904,12 +904,12 @@@ exit } EXPORT_SYMBOL_GPL(vb2_fop_read);

- unsigned int vb2_fop_poll(struct file *file, poll_table *wait) + __poll_t vb2_fop_poll(struct file *file, poll_table *wait) { struct video_device *vdev = video_devdata(file); struct vb2_queue *q = vdev->queue; struct mutex *lock = q->lock ? q->lock : vdev->lock; - unsigned res; + __poll_t res; void *fileio;

/* diff --combined drivers/misc/cxl/cxl.h index 53149fbd780e,a798c2ccd67d..4f015da78f28 --- a/drivers/misc/cxl/cxl.h +++ b/drivers/misc/cxl/cxl.h @@@ -630,9 -630,6 +630,9 @@@ struct cxl_context struct list_head extra_irq_contexts;

struct mm_struct *mm; + + u16 tidr; + bool assign_tidr; };

struct cxl_irq_info; @@@ -1084,7 -1081,7 +1084,7 @@@ int afu_open(struct inode *inode, struc int afu_release(struct inode *inode, struct file *file); long afu_ioctl(struct file *file, unsigned int cmd, unsigned long arg); int afu_mmap(struct file *file, struct vm_area_struct *vm); - unsigned int afu_poll(struct file *file, struct poll_table_struct *poll); + __poll_t afu_poll(struct file *file, struct poll_table_struct *poll); ssize_t afu_read(struct file *file, char __user *buf, size_t count, loff_t *off); extern const struct file_operations afu_fops;

diff --combined drivers/misc/cxl/file.c index 93fd381f6484,90341ccda9bd..0162516f5e57 --- a/drivers/misc/cxl/file.c +++ b/drivers/misc/cxl/file.c @@@ -173,7 -173,7 +173,7 @@@ static long afu_ioctl_start_work(struc * flags are set it's invalid */ if (work.reserved1 || work.reserved2 || work.reserved3 || - work.reserved4 || work.reserved5 || work.reserved6 || + work.reserved4 || work.reserved5 || (work.flags & ~CXL_START_WORK_ALL)) { rc = -EINVAL; goto out; @@@ -186,16 -186,12 +186,16 @@@ rc = -EINVAL; goto out; } + if ((rc = afu_register_irqs(ctx, work.num_interrupts))) goto out;

if (work.flags & CXL_START_WORK_AMR) amr = work.amr & mfspr(SPRN_UAMOR);

+ if (work.flags & CXL_START_WORK_TID) + ctx->assign_tidr = true; + ctx->mmio_err_ff = !!(work.flags & CXL_START_WORK_ERR_FF);

/* @@@ -267,15 -263,8 +267,15 @@@ goto out; }

- ctx->status = STARTED; rc = 0; + if (work.flags & CXL_START_WORK_TID) { + work.tid = ctx->tidr; + if (copy_to_user(uwork, &work, sizeof(work))) + rc = -EFAULT; + } + + ctx->status = STARTED; + out: mutex_unlock(&ctx->status_mutex); return rc; @@@ -365,10 -354,10 +365,10 @@@ static inline bool ctx_event_pending(st return false; }

- unsigned int afu_poll(struct file *file, struct poll_table_struct *poll) + __poll_t afu_poll(struct file *file, struct poll_table_struct *poll) { struct cxl_context *ctx = file->private_data; - int mask = 0; + __poll_t mask = 0; unsigned long flags;

diff --combined drivers/net/ethernet/broadcom/tg3.c index 8995cfefbfcf,5bd4a65a45dd..86ff8b49ee57 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@@ -4,13 -4,11 +4,13 @@@ * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com) * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com) * Copyright (C) 2004 Sun Microsystems Inc. - * Copyright (C) 2005-2014 Broadcom Corporation. + * Copyright (C) 2005-2016 Broadcom Corporation. + * Copyright (C) 2016-2017 Broadcom Limited. * * Firmware is: * Derived from proprietary unpublished source code, - * Copyright (C) 2000-2003 Broadcom Corporation. + * Copyright (C) 2000-2016 Broadcom Corporation. + * Copyright (C) 2016-2017 Broadcom Ltd. * * Permission is hereby granted for the distribution of this firmware * data in hexadecimal or equivalent format, provided this copyright @@@ -3744,7 -3742,7 +3744,7 @@@ static int tg3_load_firmware_cpu(struc }

do { - u32 *fw_data = (u32 *)(fw_hdr + 1); + __be32 *fw_data = (__be32 *)(fw_hdr + 1); for (i = 0; i < tg3_fw_data_len(tp, fw_hdr); i++) write_op(tp, cpu_scratch_base + (be32_to_cpu(fw_hdr->base_addr) & 0xffff) + @@@ -10054,16 -10052,6 +10054,16 @@@ static int tg3_reset_hw(struct tg3 *tp

tw32(GRC_MODE, tp->grc_mode | val);

+ /* On one of the AMD platform, MRRS is restricted to 4000 because of + * south bridge limitation. As a workaround, Driver is setting MRRS + * to 2048 instead of default 4096. + */ + if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL && + tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) { + val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK; + tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048); + } + /* Setup the timer prescalar register. Clock is always 66Mhz. */ val = tr32(GRC_MISC_CFG); val &= ~0xff; @@@ -14237,10 -14225,7 +14237,10 @@@ static int tg3_change_mtu(struct net_de /* Reset PHY, otherwise the read DMA engine will be in a mode that * breaks all requests to 256 bytes. */ - if (tg3_asic_rev(tp) == ASIC_REV_57766) + if (tg3_asic_rev(tp) == ASIC_REV_57766 || + tg3_asic_rev(tp) == ASIC_REV_5717 || + tg3_asic_rev(tp) == ASIC_REV_5719 || + tg3_asic_rev(tp) == ASIC_REV_5720) reset_phy = true;

err = tg3_restart_hw(tp, reset_phy); diff --combined drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c index 7e089bf906b4,5532a14de82b..5bbcaf8298f6 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c @@@ -241,12 -241,13 +241,13 @@@ static int dwmac4_rx_check_timestamp(vo u32 own, ctxt; int ret = 1;

- own = p->des3 & RDES3_OWN; - ctxt = ((p->des3 & RDES3_CONTEXT_DESCRIPTOR) + own = le32_to_cpu(p->des3) & RDES3_OWN; + ctxt = ((le32_to_cpu(p->des3) & RDES3_CONTEXT_DESCRIPTOR) >> RDES3_CONTEXT_DESCRIPTOR_SHIFT);

if (likely(!own && ctxt)) { - if ((p->des0 == 0xffffffff) && (p->des1 == 0xffffffff)) + if ((p->des0 == cpu_to_le32(0xffffffff)) && + (p->des1 == cpu_to_le32(0xffffffff))) /* Corrupted value */ ret = -EINVAL; else @@@ -258,20 -259,19 +259,20 @@@ return ret; }

-static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats) +static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc, + u32 ats) { struct dma_desc *p = (struct dma_desc *)desc; int ret = -EINVAL;

/* Get the status from normal w/b descriptor */ - if (likely(p->des3 & TDES3_RS1V)) { + if (likely(p->des3 & cpu_to_le32(TDES3_RS1V))) { if (likely(le32_to_cpu(p->des1) & RDES1_TIMESTAMP_AVAILABLE)) { int i = 0;

/* Check if timestamp is OK from context descriptor */ do { - ret = dwmac4_rx_check_timestamp(desc); + ret = dwmac4_rx_check_timestamp(next_desc); if (ret < 0) goto exit; i++; diff --combined drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index c0af0bc4e714,0a7ae94b5e00..323464576fc0 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@@ -364,15 -364,9 +364,15 @@@ static void stmmac_eee_ctrl_timer(struc bool stmmac_eee_init(struct stmmac_priv *priv) { struct net_device *ndev = priv->dev; + int interface = priv->plat->interface; unsigned long flags; bool ret = false;

+ if ((interface != PHY_INTERFACE_MODE_MII) && + (interface != PHY_INTERFACE_MODE_GMII) && + !phy_interface_mode_is_rgmii(interface)) + goto out; + /* Using PCS we cannot dial with the phy registers at this stage * so we do not support extra feature like EEE. */ @@@ -488,7 -482,7 +488,7 @@@ static void stmmac_get_rx_hwtstamp(stru desc = np;

/* Check if timestamp is available */ - if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) { + if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) { ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts); netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns); shhwtstamp = skb_hwtstamps(skb); @@@ -2539,7 -2533,7 +2539,7 @@@ static int stmmac_hw_setup(struct net_d }

if (priv->hw->pcs && priv->hw->mac->pcs_ctrl_ane) - priv->hw->mac->pcs_ctrl_ane(priv->hw, 1, priv->hw->ps, 0); + priv->hw->mac->pcs_ctrl_ane(priv->ioaddr, 1, priv->hw->ps, 0);

/* set TX and RX rings length */ stmmac_set_rings_length(priv); @@@ -2594,7 -2588,6 +2594,7 @@@ static int stmmac_open(struct net_devic

priv->dma_buf_sz = STMMAC_ALIGN(buf_sz); priv->rx_copybreak = STMMAC_RX_COPYBREAK; + priv->mss = 0;

ret = alloc_dma_desc_resources(priv); if (ret < 0) { diff --combined drivers/net/ppp/ppp_generic.c index 264d4af0bf69,422723230f8b..ef6b2126b23a --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@@ -531,10 -531,10 +531,10 @@@ static ssize_t ppp_write(struct file *f }

/* No kernel lock - fine */ - static unsigned int ppp_poll(struct file *file, poll_table *wait) + static __poll_t ppp_poll(struct file *file, poll_table *wait) { struct ppp_file *pf = file->private_data; - unsigned int mask; + __poll_t mask;

if (!pf) return 0; @@@ -1006,18 -1006,17 +1006,18 @@@ static int ppp_unit_register(struct pp if (!ifname_is_set) snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ppp->file.index);

+ mutex_unlock(&pn->all_ppp_mutex); + ret = register_netdevice(ppp->dev); if (ret < 0) goto err_unit;

atomic_inc(&ppp_unit_count);

- mutex_unlock(&pn->all_ppp_mutex); - return 0;

err_unit: + mutex_lock(&pn->all_ppp_mutex); unit_put(&pn->units_idr, ppp->file.index); err: mutex_unlock(&pn->all_ppp_mutex); diff --combined drivers/net/tap.c index 0a886fda0129,c4e91c73568e..f39c6f876e67 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@@ -572,10 -572,10 +572,10 @@@ static int tap_release(struct inode *in return 0; }

- static unsigned int tap_poll(struct file *file, poll_table *wait) + static __poll_t tap_poll(struct file *file, poll_table *wait) { struct tap_queue *q = file->private_data; - unsigned int mask = POLLERR; + __poll_t mask = POLLERR;

if (!q) goto out; @@@ -829,11 -829,8 +829,11 @@@ static ssize_t tap_do_read(struct tap_q DEFINE_WAIT(wait); ssize_t ret = 0;

- if (!iov_iter_count(to)) + if (!iov_iter_count(to)) { + if (skb) + kfree_skb(skb); return 0; + }

if (skb) goto put; @@@ -1157,14 -1154,11 +1157,14 @@@ static int tap_recvmsg(struct socket *s size_t total_len, int flags) { struct tap_queue *q = container_of(sock, struct tap_queue, sock); + struct sk_buff *skb = m->msg_control; int ret; - if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) + if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) { + if (skb) + kfree_skb(skb); return -EINVAL; - ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, - m->msg_control); + } + ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, skb); if (ret > total_len) { m->msg_flags |= MSG_TRUNC; ret = flags & MSG_TRUNC ? ret : total_len; diff --combined drivers/net/tun.c index a8ec589d1359,130b049ac3da..7548d8a11bdf --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@@ -611,14 -611,6 +611,14 @@@ static void tun_queue_purge(struct tun_ skb_queue_purge(&tfile->sk.sk_error_queue); }

+static void tun_cleanup_tx_array(struct tun_file *tfile) +{ + if (tfile->tx_array.ring.queue) { + skb_array_cleanup(&tfile->tx_array); + memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + } +} + static void __tun_detach(struct tun_file *tfile, bool clean) { struct tun_file *ntfile; @@@ -665,7 -657,8 +665,7 @@@ tun->dev->reg_state == NETREG_REGISTERED) unregister_netdevice(tun->dev); } - if (tun) - skb_array_cleanup(&tfile->tx_array); + tun_cleanup_tx_array(tfile); sock_put(&tfile->sk); } } @@@ -707,13 -700,11 +707,13 @@@ static void tun_detach_all(struct net_d /* Drop read queue */ tun_queue_purge(tfile); sock_put(&tfile->sk); + tun_cleanup_tx_array(tfile); } list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { tun_enable_queue(tfile); tun_queue_purge(tfile); sock_put(&tfile->sk); + tun_cleanup_tx_array(tfile); } BUG_ON(tun->numdisabled != 0);

@@@ -1257,12 -1248,12 +1257,12 @@@ static void tun_net_init(struct net_dev /* Character device part */

/* Poll */ - static unsigned int tun_chr_poll(struct file *file, poll_table *wait) + static __poll_t tun_chr_poll(struct file *file, poll_table *wait) { struct tun_file *tfile = file->private_data; struct tun_struct *tun = tun_get(tfile); struct sock *sk; - unsigned int mask = 0; + __poll_t mask = 0;

if (!tun) return POLLERR; @@@ -1961,11 -1952,8 +1961,11 @@@ static ssize_t tun_do_read(struct tun_s

tun_debug(KERN_INFO, tun, "tun_do_read\n");

- if (!iov_iter_count(to)) + if (!iov_iter_count(to)) { + if (skb) + kfree_skb(skb); return 0; + }

if (!skb) { /* Read frames from ring */ @@@ -2081,24 -2069,22 +2081,24 @@@ static int tun_recvmsg(struct socket *s { struct tun_file *tfile = container_of(sock, struct tun_file, socket); struct tun_struct *tun = tun_get(tfile); + struct sk_buff *skb = m->msg_control; int ret;

- if (!tun) - return -EBADFD; + if (!tun) { + ret = -EBADFD; + goto out_free_skb; + }

if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) { ret = -EINVAL; - goto out; + goto out_put_tun; } if (flags & MSG_ERRQUEUE) { ret = sock_recv_errqueue(sock->sk, m, total_len, SOL_PACKET, TUN_TX_TIMESTAMP); goto out; } - ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, - m->msg_control); + ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, skb); if (ret > (ssize_t)total_len) { m->msg_flags |= MSG_TRUNC; ret = flags & MSG_TRUNC ? ret : total_len; @@@ -2106,13 -2092,6 +2106,13 @@@ out: tun_put(tun); return ret; + +out_put_tun: + tun_put(tun); +out_free_skb: + if (skb) + kfree_skb(skb); + return ret; }

static int tun_peek_len(struct socket *sock) @@@ -2860,8 -2839,6 +2860,8 @@@ static int tun_chr_open(struct inode *i

sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);

+ memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + return 0; }

diff --combined drivers/platform/chrome/cros_ec_debugfs.c index 98a35d32f9dd,603fa8bd85d3..5473e602f7e0 --- a/drivers/platform/chrome/cros_ec_debugfs.c +++ b/drivers/platform/chrome/cros_ec_debugfs.c @@@ -29,6 -29,9 +29,6 @@@ #include <linux/slab.h> #include <linux/wait.h>

-#include "cros_ec_dev.h" -#include "cros_ec_debugfs.h" - #define LOG_SHIFT 14 #define LOG_SIZE (1 << LOG_SHIFT) #define LOG_POLL_SEC 10 @@@ -188,11 -191,11 +188,11 @@@ error return ret; }

- static unsigned int cros_ec_console_log_poll(struct file *file, + static __poll_t cros_ec_console_log_poll(struct file *file, poll_table *wait) { struct cros_ec_debugfs *debug_info = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &debug_info->log_wq, wait);

@@@ -387,7 -390,6 +387,7 @@@ remove_debugfs debugfs_remove_recursive(debug_info->dir); return ret; } +EXPORT_SYMBOL(cros_ec_debugfs_init);

void cros_ec_debugfs_remove(struct cros_ec_dev *ec) { @@@ -397,4 -399,3 +397,4 @@@ debugfs_remove_recursive(ec->debug_info->dir); cros_ec_cleanup_console_log(ec->debug_info); } +EXPORT_SYMBOL(cros_ec_debugfs_remove); diff --combined drivers/staging/lustre/lnet/lnet/lib-socket.c index 7d49d4865298,984d76843b19..ed46aaca0ba3 --- a/drivers/staging/lustre/lnet/lnet/lib-socket.c +++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c @@@ -71,12 -71,16 +71,12 @@@ lnet_sock_ioctl(int cmd, unsigned long }

sock_filp = sock_alloc_file(sock, 0, NULL); - if (IS_ERR(sock_filp)) { - sock_release(sock); - rc = PTR_ERR(sock_filp); - goto out; - } + if (IS_ERR(sock_filp)) + return PTR_ERR(sock_filp);

rc = kernel_sock_unlocked_ioctl(sock_filp, cmd, arg);

fput(sock_filp); -out: return rc; }

@@@ -314,19 -318,20 +314,20 @@@ lnet_sock_read(struct socket *sock, voi long jiffies_left = timeout * msecs_to_jiffies(MSEC_PER_SEC); unsigned long then; struct timeval tv; + struct kvec iov = { + .iov_base = buffer, + .iov_len = nob + }; + struct msghdr msg = { + .msg_flags = 0 + };

LASSERT(nob > 0); LASSERT(jiffies_left > 0);

- for (;;) { - struct kvec iov = { - .iov_base = buffer, - .iov_len = nob - }; - struct msghdr msg = { - .msg_flags = 0 - }; + iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, nob);

+ for (;;) { /* Set receive timeout to remaining time */ jiffies_to_timeval(jiffies_left, &tv); rc = kernel_setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, @@@ -338,7 -343,7 +339,7 @@@ }

then = jiffies; - rc = kernel_recvmsg(sock, &msg, &iov, 1, nob, 0); + rc = sock_recvmsg(sock, &msg, 0); jiffies_left -= jiffies - then;

if (rc < 0) @@@ -347,10 -352,7 +348,7 @@@ if (!rc) return -ECONNRESET;

- buffer = ((char *)buffer) + rc; - nob -= rc; - - if (!nob) + if (!msg_data_left(&msg)) return 0;

if (jiffies_left <= 0) diff --combined drivers/tty/n_tty.c index 539b49adb6af,081bbbb7d49c..478a9b40fd03 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@@ -1762,7 -1762,7 +1762,7 @@@ static void n_tty_set_termios(struct tt { struct n_tty_data *ldata = tty->disc_data;

- if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) { + if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) { bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE); ldata->line_start = ldata->read_tail; if (!L_ICANON(tty) || !read_cnt(ldata)) { @@@ -2368,10 -2368,10 +2368,10 @@@ break_out * Called without the kernel lock held - fine */

- static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file, + static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file, poll_table *wait) { - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &tty->read_wait, wait); poll_wait(file, &tty->write_wait, wait); @@@ -2425,7 -2425,7 +2425,7 @@@ static int n_tty_ioctl(struct tty_struc return put_user(tty_chars_in_buffer(tty), (int __user *) arg); case TIOCINQ: down_write(&tty->termios_rwsem); - if (L_ICANON(tty)) + if (L_ICANON(tty) && !L_EXTPROC(tty)) retval = inq_canon(ldata); else retval = read_cnt(ldata); diff --combined drivers/usb/core/devio.c index a3fad4ec9870,929a7380be66..31404fc93d99 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@@ -1442,18 -1442,14 +1442,18 @@@ static int proc_do_submiturb(struct usb int number_of_packets = 0; unsigned int stream_id = 0; void *buf; - - if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP | - USBDEVFS_URB_SHORT_NOT_OK | + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | USBDEVFS_URB_BULK_CONTINUATION | USBDEVFS_URB_NO_FSBR | USBDEVFS_URB_ZERO_PACKET | - USBDEVFS_URB_NO_INTERRUPT)) - return -EINVAL; + USBDEVFS_URB_NO_INTERRUPT; + /* USBDEVFS_URB_ISO_ASAP is a special case */ + if (uurb->type == USBDEVFS_URB_TYPE_ISO) + mask |= USBDEVFS_URB_ISO_ASAP; + + if (uurb->flags & ~mask) + return -EINVAL; + if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX) return -EINVAL; if (uurb->buffer_length > 0 && !uurb->buffer) @@@ -2572,11 -2568,11 +2572,11 @@@ static long usbdev_compat_ioctl(struct #endif

/* No kernel lock - fine */ - static unsigned int usbdev_poll(struct file *file, + static __poll_t usbdev_poll(struct file *file, struct poll_table_struct *wait) { struct usb_dev_state *ps = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &ps->wait, wait); if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed)) diff --combined drivers/usb/gadget/function/f_fs.c index b6cf5ab5a0a1,17efadd6b395..b540935891af --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@@ -638,10 -638,10 +638,10 @@@ static long ffs_ep0_ioctl(struct file * return ret; }

- static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait) + static __poll_t ffs_ep0_poll(struct file *file, poll_table *wait) { struct ffs_data *ffs = file->private_data; - unsigned int mask = POLLWRNORM; + __poll_t mask = POLLWRNORM; int ret;

poll_wait(file, &ffs->ev.waitq, wait); @@@ -1012,7 -1012,7 +1012,7 @@@ static ssize_t ffs_epfile_io(struct fil else ret = ep->status; goto error_mutex; - } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) { + } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) { ret = -ENOMEM; } else { req->buf = data; @@@ -2282,18 -2282,9 +2282,18 @@@ static int __ffs_data_do_os_desc(enum f int i;

if (len < sizeof(*d) || - d->bFirstInterfaceNumber >= ffs->interfaces_count || - !d->Reserved1) + d->bFirstInterfaceNumber >= ffs->interfaces_count) return -EINVAL; + if (d->Reserved1 != 1) { + /* + * According to the spec, Reserved1 must be set to 1 + * but older kernels incorrectly rejected non-zero + * values. We fix it here to avoid returning EINVAL + * in response to values we used to accept. + */ + pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n"); + d->Reserved1 = 1; + } for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) if (d->Reserved2[i]) return -EINVAL; diff --combined drivers/usb/mon/mon_bin.c index f932f40302df,bc6fa666f75a..cc5b296bff3f --- a/drivers/usb/mon/mon_bin.c +++ b/drivers/usb/mon/mon_bin.c @@@ -1004,9 -1004,7 +1004,9 @@@ static long mon_bin_ioctl(struct file * break;

case MON_IOCQ_RING_SIZE: + mutex_lock(&rp->fetch_lock); ret = rp->b_size; + mutex_unlock(&rp->fetch_lock); break;

case MON_IOCT_RING_SIZE: @@@ -1191,11 -1189,11 +1191,11 @@@ static long mon_bin_compat_ioctl(struc } #endif /* CONFIG_COMPAT */

- static unsigned int + static __poll_t mon_bin_poll(struct file *file, struct poll_table_struct *wait) { struct mon_reader_bin *rp = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0; unsigned long flags;

if (file->f_mode & FMODE_READ) @@@ -1233,16 -1231,12 +1233,16 @@@ static int mon_bin_vma_fault(struct vm_ unsigned long offset, chunk_idx; struct page *pageptr;

+ mutex_lock(&rp->fetch_lock); offset = vmf->pgoff << PAGE_SHIFT; - if (offset >= rp->b_size) + if (offset >= rp->b_size) { + mutex_unlock(&rp->fetch_lock); return VM_FAULT_SIGBUS; + } chunk_idx = offset / CHUNK_SIZE; pageptr = rp->b_vec[chunk_idx].pg; get_page(pageptr); + mutex_unlock(&rp->fetch_lock); vmf->page = pageptr; return 0; } diff --combined drivers/vhost/net.c index c7bdeb655646,0ed445a17c54..9524ee16878a --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@@ -778,6 -778,16 +778,6 @@@ static void handle_rx(struct vhost_net /* On error, stop handling until the next kick. */ if (unlikely(headcount < 0)) goto out; - if (nvq->rx_array) - msg.msg_control = vhost_net_buf_consume(&nvq->rxq); - /* On overrun, truncate and discard */ - if (unlikely(headcount > UIO_MAXIOV)) { - iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1); - err = sock->ops->recvmsg(sock, &msg, - 1, MSG_DONTWAIT | MSG_TRUNC); - pr_debug("Discarded rx packet: len %zd\n", sock_len); - continue; - } /* OK, now we need to know about added descriptors. */ if (!headcount) { if (unlikely(vhost_enable_notify(&net->dev, vq))) { @@@ -790,16 -800,6 +790,16 @@@ * they refilled. */ goto out; } + if (nvq->rx_array) + msg.msg_control = vhost_net_buf_consume(&nvq->rxq); + /* On overrun, truncate and discard */ + if (unlikely(headcount > UIO_MAXIOV)) { + iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1); + err = sock->ops->recvmsg(sock, &msg, + 1, MSG_DONTWAIT | MSG_TRUNC); + pr_debug("Discarded rx packet: len %zd\n", sock_len); + continue; + } /* We don't need to be notified again. */ iov_iter_init(&msg.msg_iter, READ, vq->iov, in, vhost_len); fixup = msg.msg_iter; @@@ -1353,7 -1353,7 +1353,7 @@@ static ssize_t vhost_net_chr_write_iter return vhost_chr_write_iter(dev, from); }

- static unsigned int vhost_net_chr_poll(struct file *file, poll_table *wait) + static __poll_t vhost_net_chr_poll(struct file *file, poll_table *wait) { struct vhost_net *n = file->private_data; struct vhost_dev *dev = &n->dev; diff --combined drivers/vhost/vhost.c index 5727b186b3ca,3bbeabff505a..06fd07804f79 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@@ -170,7 -170,7 +170,7 @@@ static int vhost_poll_wakeup(wait_queue { struct vhost_poll *poll = container_of(wait, struct vhost_poll, wait);

- if (!((unsigned long)key & poll->mask)) + if (!(key_to_poll(key) & poll->mask)) return 0;

vhost_poll_queue(poll); @@@ -187,7 -187,7 +187,7 @@@ EXPORT_SYMBOL_GPL(vhost_work_init)

/* Init poll structure */ void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn, - unsigned long mask, struct vhost_dev *dev) + __poll_t mask, struct vhost_dev *dev) { init_waitqueue_func_entry(&poll->wait, vhost_poll_wakeup); init_poll_funcptr(&poll->table, vhost_poll_func); @@@ -203,7 -203,7 +203,7 @@@ EXPORT_SYMBOL_GPL(vhost_poll_init) * keep a reference to a file until after vhost_poll_stop is called. */ int vhost_poll_start(struct vhost_poll *poll, struct file *file) { - unsigned long mask; + __poll_t mask; int ret = 0;

if (poll->wqh) @@@ -211,7 -211,7 +211,7 @@@

mask = file->f_op->poll(file, &poll->table); if (mask) - vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask); + vhost_poll_wakeup(&poll->wait, 0, 0, poll_to_key(mask)); if (mask & POLLERR) { if (poll->wqh) remove_wait_queue(poll->wqh, &poll->wait); @@@ -904,7 -904,7 +904,7 @@@ static void vhost_dev_lock_vqs(struct v { int i = 0; for (i = 0; i < d->nvqs; ++i) - mutex_lock(&d->vqs[i]->mutex); + mutex_lock_nested(&d->vqs[i]->mutex, i); }

static void vhost_dev_unlock_vqs(struct vhost_dev *d) @@@ -1015,10 -1015,6 +1015,10 @@@ static int vhost_process_iotlb_msg(stru vhost_iotlb_notify_vq(dev, msg); break; case VHOST_IOTLB_INVALIDATE: + if (!dev->iotlb) { + ret = -EFAULT; + break; + } vhost_vq_meta_reset(dev); vhost_del_umem_range(dev->iotlb, msg->iova, msg->iova + msg->size - 1); @@@ -1061,10 -1057,10 +1061,10 @@@ done } EXPORT_SYMBOL(vhost_chr_write_iter);

- unsigned int vhost_chr_poll(struct file *file, struct vhost_dev *dev, + __poll_t vhost_chr_poll(struct file *file, struct vhost_dev *dev, poll_table *wait) { - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &dev->wait, wait);

diff --combined drivers/xen/pvcalls-front.c index 4c789e61554b,74c854955a6b..78804e71f9a6 --- a/drivers/xen/pvcalls-front.c +++ b/drivers/xen/pvcalls-front.c @@@ -805,7 -805,7 +805,7 @@@ int pvcalls_front_accept(struct socket pvcalls_exit(); return ret; } - map2 = kzalloc(sizeof(*map2), GFP_KERNEL); + map2 = kzalloc(sizeof(*map2), GFP_ATOMIC); if (map2 == NULL) { clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags); @@@ -878,7 -878,7 +878,7 @@@ received return ret; }

- static unsigned int pvcalls_front_poll_passive(struct file *file, + static __poll_t pvcalls_front_poll_passive(struct file *file, struct pvcalls_bedata *bedata, struct sock_mapping *map, poll_table *wait) @@@ -935,12 -935,12 +935,12 @@@ return 0; }

- static unsigned int pvcalls_front_poll_active(struct file *file, + static __poll_t pvcalls_front_poll_active(struct file *file, struct pvcalls_bedata *bedata, struct sock_mapping *map, poll_table *wait) { - unsigned int mask = 0; + __poll_t mask = 0; int32_t in_error, out_error; struct pvcalls_data_intf *intf = map->active.ring;

@@@ -958,12 -958,12 +958,12 @@@ return mask; }

- unsigned int pvcalls_front_poll(struct file *file, struct socket *sock, + __poll_t pvcalls_front_poll(struct file *file, struct socket *sock, poll_table *wait) { struct pvcalls_bedata *bedata; struct sock_mapping *map; - int ret; + __poll_t ret;

pvcalls_enter(); if (!pvcalls_front_dev) { @@@ -1103,7 -1103,7 +1103,7 @@@ static int pvcalls_front_remove(struct kfree(map); } } - if (bedata->ref >= 0) + if (bedata->ref != -1) gnttab_end_foreign_access(bedata->ref, 0, 0); kfree(bedata->ring.sring); kfree(bedata); @@@ -1128,8 -1128,6 +1128,8 @@@ static int pvcalls_front_probe(struct x }

versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len); + if (IS_ERR(versions)) + return PTR_ERR(versions); if (!len) return -EINVAL; if (strcmp(versions, "1")) { diff --combined fs/buffer.c index 551b781a7d7b,3091801169ce..3b2b415f1fcd --- a/fs/buffer.c +++ b/fs/buffer.c @@@ -53,13 -53,6 +53,6 @@@ static int submit_bh_wbc(int op, int op

#define BH_ENTRY(list) list_entry((list), struct buffer_head, b_assoc_buffers)

- void init_buffer(struct buffer_head *bh, bh_end_io_t *handler, void *private) - { - bh->b_end_io = handler; - bh->b_private = private; - } - EXPORT_SYMBOL(init_buffer); - inline void touch_buffer(struct buffer_head *bh) { trace_block_touch_buffer(bh); @@@ -922,7 -915,8 +915,8 @@@ init_page_buffers(struct page *page, st

do { if (!buffer_mapped(bh)) { - init_buffer(bh, NULL, NULL); + bh->b_end_io = NULL; + bh->b_private = NULL; bh->b_bdev = bdev; bh->b_blocknr = block; if (uptodate) @@@ -3014,7 -3008,7 +3008,7 @@@ static void end_bio_bh_io_sync(struct b void guard_bio_eod(int op, struct bio *bio) { sector_t maxsector; - struct bio_vec *bvec = &bio->bi_io_vec[bio->bi_vcnt - 1]; + struct bio_vec *bvec = bio_last_bvec_all(bio); unsigned truncated_bytes; struct hd_struct *part;

@@@ -3055,8 -3049,8 +3049,8 @@@ } }

-static int submit_bh_wbc(int op, int op_flags, struct buffer_head *bh, - enum rw_hint write_hint, struct writeback_control *wbc) +struct bio *create_bh_bio(int op, int op_flags, struct buffer_head *bh, + enum rw_hint write_hint) { struct bio *bio;

@@@ -3078,6 -3072,11 +3072,6 @@@ */ bio = bio_alloc(GFP_NOIO, 1);

- if (wbc) { - wbc_init_bio(wbc, bio); - wbc_account_io(wbc, bh->b_page, bh->b_size); - } - bio->bi_iter.bi_sector = bh->b_blocknr * (bh->b_size >> 9); bio_set_dev(bio, bh->b_bdev); bio->bi_write_hint = write_hint; @@@ -3097,44 -3096,13 +3091,44 @@@ op_flags |= REQ_PRIO; bio_set_op_attrs(bio, op, op_flags);

+ return bio; +} + +static int submit_bh_wbc(int op, int op_flags, struct buffer_head *bh, + enum rw_hint write_hint, struct writeback_control *wbc) +{ + struct bio *bio; + + bio = create_bh_bio(op, op_flags, bh, write_hint); + + if (wbc) { + wbc_init_bio(wbc, bio); + wbc_account_io(wbc, bh->b_page, bh->b_size); + } + submit_bio(bio); return 0; }

+int submit_bh_blkcg_css(int op, int op_flags, struct buffer_head *bh, + struct cgroup_subsys_state *blkcg_css) +{ + struct bio *bio; + + bio = create_bh_bio(op, op_flags, bh, 0); + bio_associate_blkcg(bio, blkcg_css); + submit_bio(bio); + return 0; +} +EXPORT_SYMBOL(submit_bh_blkcg_css); + int submit_bh(int op, int op_flags, struct buffer_head *bh) { - return submit_bh_wbc(op, op_flags, bh, 0, NULL); + struct bio *bio; + + bio = create_bh_bio(op, op_flags, bh, 0); + submit_bio(bio); + return 0; } EXPORT_SYMBOL(submit_bh);

diff --combined fs/dcache.c index 99bce0ed0213,ca412ca0d9a7..3ae956d6f373 --- a/fs/dcache.c +++ b/fs/dcache.c @@@ -32,7 -32,6 +32,6 @@@ #include <linux/swap.h> #include <linux/bootmem.h> #include <linux/fs_struct.h> - #include <linux/hardirq.h> #include <linux/bit_spinlock.h> #include <linux/rculist_bl.h> #include <linux/prefetch.h> @@@ -49,8 -48,8 +48,8 @@@ * - i_dentry, d_u.d_alias, d_inode of aliases * dcache_hash_bucket lock protects: * - the dcache hash table - * s_anon bl list spinlock protects: - * - the s_anon list (see __d_drop) + * s_roots bl list spinlock protects: + * - the s_roots list (see __d_drop) * dentry->d_sb->s_dentry_lru_lock protects: * - the dcache lru lists and counters * d_lock protects: @@@ -68,7 -67,7 +67,7 @@@ * dentry->d_lock * dentry->d_sb->s_dentry_lru_lock * dcache_hash_bucket lock - * s_anon lock + * s_roots lock * * If there is an ancestor relationship: * dentry->d_parent->...->d_parent->d_lock @@@ -104,14 -103,13 +103,13 @@@ EXPORT_SYMBOL(slash_name) * information, yet avoid using a prime hash-size or similar. */

- static unsigned int d_hash_mask __read_mostly; static unsigned int d_hash_shift __read_mostly;

static struct hlist_bl_head *dentry_hashtable __read_mostly;

static inline struct hlist_bl_head *d_hash(unsigned int hash) { - return dentry_hashtable + (hash >> (32 - d_hash_shift)); + return dentry_hashtable + (hash >> d_hash_shift); }

#define IN_LOOKUP_SHIFT 10 @@@ -468,30 -466,37 +466,37 @@@ static void dentry_lru_add(struct dentr * d_drop() is used mainly for stuff that wants to invalidate a dentry for some * reason (NFS timeouts or autofs deletes). * - * __d_drop requires dentry->d_lock. + * __d_drop requires dentry->d_lock + * ___d_drop doesn't mark dentry as "unhashed" + * (dentry->d_hash.pprev will be LIST_POISON2, not NULL). */ - void __d_drop(struct dentry *dentry) + static void ___d_drop(struct dentry *dentry) { if (!d_unhashed(dentry)) { struct hlist_bl_head *b; /* * Hashed dentries are normally on the dentry hashtable, * with the exception of those newly allocated by - * d_obtain_alias, which are always IS_ROOT: + * d_obtain_root, which are always IS_ROOT: */ if (unlikely(IS_ROOT(dentry))) - b = &dentry->d_sb->s_anon; + b = &dentry->d_sb->s_roots; else b = d_hash(dentry->d_name.hash);

hlist_bl_lock(b); __hlist_bl_del(&dentry->d_hash); - dentry->d_hash.pprev = NULL; hlist_bl_unlock(b); /* After this call, in-progress rcu-walk path lookup will fail. */ write_seqcount_invalidate(&dentry->d_seq); } } + + void __d_drop(struct dentry *dentry) + { + ___d_drop(dentry); + dentry->d_hash.pprev = NULL; + } EXPORT_SYMBOL(__d_drop);

void d_drop(struct dentry *dentry) @@@ -1500,8 -1505,8 +1505,8 @@@ void shrink_dcache_for_umount(struct su sb->s_root = NULL; do_one_tree(dentry);

- while (!hlist_bl_empty(&sb->s_anon)) { - dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_anon), struct dentry, d_hash)); + while (!hlist_bl_empty(&sb->s_roots)) { + dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_roots), struct dentry, d_hash)); do_one_tree(dentry); } } @@@ -1699,15 -1704,9 +1704,15 @@@ struct dentry *d_alloc(struct dentry * } EXPORT_SYMBOL(d_alloc);

+struct dentry *d_alloc_anon(struct super_block *sb) +{ + return __d_alloc(sb, NULL); +} +EXPORT_SYMBOL(d_alloc_anon); + struct dentry *d_alloc_cursor(struct dentry * parent) { - struct dentry *dentry = __d_alloc(parent->d_sb, NULL); + struct dentry *dentry = d_alloc_anon(parent->d_sb); if (dentry) { dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR; dentry->d_parent = dget(parent); @@@ -1893,7 -1892,7 +1898,7 @@@ struct dentry *d_make_root(struct inod struct dentry *res = NULL;

if (root_inode) { - res = __d_alloc(root_inode->i_sb, NULL); + res = d_alloc_anon(root_inode->i_sb); if (res) d_instantiate(res, root_inode); else @@@ -1932,19 -1931,33 +1937,19 @@@ struct dentry *d_find_any_alias(struct } EXPORT_SYMBOL(d_find_any_alias);

-static struct dentry *__d_obtain_alias(struct inode *inode, int disconnected) +static struct dentry *__d_instantiate_anon(struct dentry *dentry, + struct inode *inode, + bool disconnected) { - struct dentry *tmp; struct dentry *res; unsigned add_flags;

- if (!inode) - return ERR_PTR(-ESTALE); - if (IS_ERR(inode)) - return ERR_CAST(inode); - - res = d_find_any_alias(inode); - if (res) - goto out_iput; - - tmp = __d_alloc(inode->i_sb, NULL); - if (!tmp) { - res = ERR_PTR(-ENOMEM); - goto out_iput; - } - - security_d_instantiate(tmp, inode); + security_d_instantiate(dentry, inode); spin_lock(&inode->i_lock); res = __d_find_any_alias(inode); if (res) { spin_unlock(&inode->i_lock); - dput(tmp); + dput(dentry); goto out_iput; }

@@@ -1954,55 -1967,24 +1959,57 @@@ if (disconnected) add_flags |= DCACHE_DISCONNECTED;

- spin_lock(&tmp->d_lock); - __d_set_inode_and_type(tmp, inode, add_flags); - hlist_add_head(&tmp->d_u.d_alias, &inode->i_dentry); + spin_lock(&dentry->d_lock); + __d_set_inode_and_type(dentry, inode, add_flags); + hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry); - hlist_bl_lock(&dentry->d_sb->s_anon); - hlist_bl_add_head(&dentry->d_hash, &dentry->d_sb->s_anon); - hlist_bl_unlock(&dentry->d_sb->s_anon); + if (!disconnected) { - hlist_bl_lock(&tmp->d_sb->s_roots); - hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_roots); - hlist_bl_unlock(&tmp->d_sb->s_roots); ++ hlist_bl_lock(&dentry->d_sb->s_roots); ++ hlist_bl_add_head(&dentry->d_hash, &dentry->d_sb->s_roots); ++ hlist_bl_unlock(&dentry->d_sb->s_roots); + } - spin_unlock(&tmp->d_lock); + spin_unlock(&dentry->d_lock); spin_unlock(&inode->i_lock);

- return tmp; + return dentry;

out_iput: iput(inode); return res; }

+struct dentry *d_instantiate_anon(struct dentry *dentry, struct inode *inode) +{ + return __d_instantiate_anon(dentry, inode, true); +} +EXPORT_SYMBOL(d_instantiate_anon); + +static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected) +{ + struct dentry *tmp; + struct dentry *res; + + if (!inode) + return ERR_PTR(-ESTALE); + if (IS_ERR(inode)) + return ERR_CAST(inode); + + res = d_find_any_alias(inode); + if (res) + goto out_iput; + + tmp = d_alloc_anon(inode->i_sb); + if (!tmp) { + res = ERR_PTR(-ENOMEM); + goto out_iput; + } + + return __d_instantiate_anon(tmp, inode, disconnected); + +out_iput: + iput(inode); + return res; +} + /** * d_obtain_alias - find or allocate a DISCONNECTED dentry for a given inode * @inode: inode to allocate the dentry for @@@ -2023,7 -2005,7 +2030,7 @@@ */ struct dentry *d_obtain_alias(struct inode *inode) { - return __d_obtain_alias(inode, 1); + return __d_obtain_alias(inode, true); } EXPORT_SYMBOL(d_obtain_alias);

@@@ -2044,7 -2026,7 +2051,7 @@@ */ struct dentry *d_obtain_root(struct inode *inode) { - return __d_obtain_alias(inode, 0); + return __d_obtain_alias(inode, false); } EXPORT_SYMBOL(d_obtain_root);

@@@ -2406,7 -2388,7 +2413,7 @@@ EXPORT_SYMBOL(d_delete) static void __d_rehash(struct dentry *entry) { struct hlist_bl_head *b = d_hash(entry->d_name.hash); - BUG_ON(!d_unhashed(entry)); + hlist_bl_lock(b); hlist_bl_add_head_rcu(&entry->d_hash, b); hlist_bl_unlock(b); @@@ -2841,9 -2823,9 +2848,9 @@@ static void __d_move(struct dentry *den write_seqcount_begin_nested(&target->d_seq, DENTRY_D_LOCK_NESTED);

/* unhash both */ - /* __d_drop does write_seqcount_barrier, but they're OK to nest. */ - __d_drop(dentry); - __d_drop(target); + /* ___d_drop does write_seqcount_barrier, but they're OK to nest. */ + ___d_drop(dentry); + ___d_drop(target);

/* Switch the names.. */ if (exchange) @@@ -2855,6 -2837,8 +2862,8 @@@ __d_rehash(dentry); if (exchange) __d_rehash(target); + else + target->d_hash.pprev = NULL;

/* ... and switch them in the tree */ if (IS_ROOT(dentry)) { @@@ -3552,7 -3536,6 +3561,7 @@@ bool is_subdir(struct dentry *new_dentr

return result; } +EXPORT_SYMBOL(is_subdir);

static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry) { @@@ -3615,9 -3598,10 +3624,10 @@@ static void __init dcache_init_early(vo 13, HASH_EARLY | HASH_ZERO, &d_hash_shift, - &d_hash_mask, + NULL, 0, 0); + d_hash_shift = 32 - d_hash_shift; }

static void __init dcache_init(void) @@@ -3641,9 -3625,10 +3651,10 @@@ 13, HASH_ZERO, &d_hash_shift, - &d_hash_mask, + NULL, 0, 0); + d_hash_shift = 32 - d_hash_shift; }

/* SLAB cache for __getname() consumers */ diff --combined fs/orangefs/devorangefs-req.c index c584ad8d023c,109fffd6d153..f073cd9e6687 --- a/fs/orangefs/devorangefs-req.c +++ b/fs/orangefs/devorangefs-req.c @@@ -162,7 -162,7 +162,7 @@@ static ssize_t orangefs_devreq_read(str struct orangefs_kernel_op_s *op, *temp; __s32 proto_ver = ORANGEFS_KERNEL_PROTO_VERSION; static __s32 magic = ORANGEFS_DEVREQ_MAGIC; - struct orangefs_kernel_op_s *cur_op = NULL; + struct orangefs_kernel_op_s *cur_op; unsigned long ret;

/* We do not support blocking IO. */ @@@ -186,7 -186,6 +186,7 @@@ return -EAGAIN;

restart: + cur_op = NULL; /* Get next op (if any) from top of list. */ spin_lock(&orangefs_request_list_lock); list_for_each_entry_safe(op, temp, &orangefs_request_list, list) { @@@ -815,15 -814,15 +815,15 @@@ void orangefs_dev_cleanup(void ORANGEFS_REQDEVICE_NAME); }

- static unsigned int orangefs_devreq_poll(struct file *file, + static __poll_t orangefs_devreq_poll(struct file *file, struct poll_table_struct *poll_table) { - int poll_revent_mask = 0; + __poll_t poll_revent_mask = 0;

poll_wait(file, &orangefs_request_list_waitq, poll_table);

if (!list_empty(&orangefs_request_list)) - poll_revent_mask |= POLL_IN; + poll_revent_mask |= POLLIN; return poll_revent_mask; }

diff --combined fs/userfaultfd.c index 41a75f9f23fd,c0a5d9c47c6d..743eaa646898 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@@ -570,14 -570,11 +570,14 @@@ out static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx, struct userfaultfd_wait_queue *ewq) { + struct userfaultfd_ctx *release_new_ctx; + if (WARN_ON_ONCE(current->flags & PF_EXITING)) goto out;

ewq->ctx = ctx; init_waitqueue_entry(&ewq->wq, current); + release_new_ctx = NULL;

spin_lock(&ctx->event_wqh.lock); /* @@@ -604,7 -601,8 +604,7 @@@ new = (struct userfaultfd_ctx *) (unsigned long) ewq->msg.arg.reserved.reserved1; - - userfaultfd_ctx_put(new); + release_new_ctx = new; } break; } @@@ -619,20 -617,6 +619,20 @@@ __set_current_state(TASK_RUNNING); spin_unlock(&ctx->event_wqh.lock);

+ if (release_new_ctx) { + struct vm_area_struct *vma; + struct mm_struct *mm = release_new_ctx->mm; + + /* the various vma->vm_userfaultfd_ctx still points to it */ + down_write(&mm->mmap_sem); + for (vma = mm->mmap; vma; vma = vma->vm_next) + if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) + vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; + up_write(&mm->mmap_sem); + + userfaultfd_ctx_put(release_new_ctx); + } + /* * ctx may go away after this if the userfault pseudo fd is * already released. @@@ -937,10 -921,10 +937,10 @@@ static inline struct userfaultfd_wait_q return find_userfault_in(&ctx->event_wqh); }

- static unsigned int userfaultfd_poll(struct file *file, poll_table *wait) + static __poll_t userfaultfd_poll(struct file *file, poll_table *wait) { struct userfaultfd_ctx *ctx = file->private_data; - unsigned int ret; + __poll_t ret;

poll_wait(file, &ctx->fd_wqh, wait);

diff --combined include/crypto/if_alg.h index f38227a78eae,a50bdb9d7cfd..482461d8931d --- a/include/crypto/if_alg.h +++ b/include/crypto/if_alg.h @@@ -18,7 -18,6 +18,7 @@@ #include <linux/if_alg.h> #include <linux/scatterlist.h> #include <linux/types.h> +#include <linux/atomic.h> #include <net/sock.h>

#include <crypto/aead.h> @@@ -151,7 -150,7 +151,7 @@@ struct af_alg_ctx struct crypto_wait wait;

size_t used; - size_t rcvused; + atomic_t rcvused;

bool more; bool merge; @@@ -216,7 -215,7 +216,7 @@@ static inline int af_alg_rcvbuf(struct struct af_alg_ctx *ctx = ask->private;

return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) - - ctx->rcvused, 0); + atomic_read(&ctx->rcvused), 0); }

/** @@@ -245,7 -244,7 +245,7 @@@ ssize_t af_alg_sendpage(struct socket * int offset, size_t size, int flags); void af_alg_free_resources(struct af_alg_async_req *areq); void af_alg_async_cb(struct crypto_async_request *_req, int err); - unsigned int af_alg_poll(struct file *file, struct socket *sock, + __poll_t af_alg_poll(struct file *file, struct socket *sock, poll_table *wait); struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk, unsigned int areqlen); diff --combined include/linux/buffer_head.h index f1aed01479f8,58a82f58e44e..dead50b38776 --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@@ -14,7 -14,6 +14,7 @@@ #include <linux/pagemap.h> #include <linux/wait.h> #include <linux/atomic.h> +#include <linux/cgroup.h>

#ifdef CONFIG_BLOCK

@@@ -152,7 -151,6 +152,6 @@@ void buffer_check_dirty_writeback(struc

void mark_buffer_dirty(struct buffer_head *bh); void mark_buffer_write_io_error(struct buffer_head *bh); - void init_buffer(struct buffer_head *, bh_end_io_t *, void *); void touch_buffer(struct buffer_head *bh); void set_bh_page(struct buffer_head *bh, struct page *page, unsigned long offset); @@@ -199,8 -197,6 +198,8 @@@ void ll_rw_block(int, int, int, struct int sync_dirty_buffer(struct buffer_head *bh); int __sync_dirty_buffer(struct buffer_head *bh, int op_flags); void write_dirty_buffer(struct buffer_head *bh, int op_flags); +int submit_bh_blkcg_css(int op, int op_flags, struct buffer_head *bh, + struct cgroup_subsys_state *blkcg_css); int submit_bh(int, int, struct buffer_head *); void write_boundary_block(struct block_device *bdev, sector_t bblock, unsigned blocksize); diff --combined include/linux/fs.h index bc93dbcb6925,79fec8d39c0e..e5d747f4ecd4 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@@ -748,11 -748,6 +748,11 @@@ static inline void inode_lock_nested(st down_write_nested(&inode->i_rwsem, subclass); }

+static inline void inode_lock_shared_nested(struct inode *inode, unsigned subclass) +{ + down_read_nested(&inode->i_rwsem, subclass); +} + void lock_two_nondirectories(struct inode *, struct inode*); void unlock_two_nondirectories(struct inode *, struct inode*);

@@@ -1314,6 -1309,7 +1314,6 @@@ extern int send_sigurg(struct fown_stru #define UMOUNT_UNUSED 0x80000000 /* Flag guaranteed to be unused */

/* sb->s_iflags */ -#define SB_I_CGROUPWB 0x00000001 /* cgroup-aware writeback enabled */ #define SB_I_NOEXEC 0x00000002 /* Ignore executables on this fs */ #define SB_I_NODEV 0x00000004 /* Ignore devices on this fs */

@@@ -1363,7 -1359,7 +1363,7 @@@ struct super_block

const struct fscrypt_operations *s_cop;

- struct hlist_bl_head s_anon; /* anonymous dentries for (nfs) exporting */ + struct hlist_bl_head s_roots; /* alternate root dentries for NFS */ struct list_head s_mounts; /* list of mounts; _not_ for fs use */ struct block_device *s_bdev; struct backing_dev_info *s_bdi; @@@ -1612,6 -1608,10 +1612,10 @@@ extern int vfs_whiteout(struct inode * extern struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag);

+ int vfs_mkobj(struct dentry *, umode_t, + int (*f)(struct dentry *, umode_t, void *), + void *); + /* * VFS file helper functions. */ @@@ -1702,7 -1702,7 +1706,7 @@@ struct file_operations ssize_t (*write_iter) (struct kiocb *, struct iov_iter *); int (*iterate) (struct file *, struct dir_context *); int (*iterate_shared) (struct file *, struct dir_context *); - unsigned int (*poll) (struct file *, struct poll_table_struct *); + __poll_t (*poll) (struct file *, struct poll_table_struct *); long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long); long (*compat_ioctl) (struct file *, unsigned int, unsigned long); int (*mmap) (struct file *, struct vm_area_struct *); @@@ -1860,7 -1860,6 +1864,7 @@@ struct super_operations #define S_DAX 0 /* Make all the DAX code disappear */ #endif #define S_ENCRYPTED 16384 /* Encrypted file (using fs/crypto/) */ +#define S_CGROUPWB 32768 /* Enable cgroup writeback for this inode */

/* * Note that nosuid etc flags are inode-specific: setting some file-system @@@ -1901,7 -1900,6 +1905,7 @@@ static inline bool sb_rdonly(const stru #define IS_NOSEC(inode) ((inode)->i_flags & S_NOSEC) #define IS_DAX(inode) ((inode)->i_flags & S_DAX) #define IS_ENCRYPTED(inode) ((inode)->i_flags & S_ENCRYPTED) +#define IS_CGROUPWB(inode) ((inode)->i_flags & S_CGROUPWB)

#define IS_WHITEOUT(inode) (S_ISCHR(inode->i_mode) && \ (inode)->i_rdev == WHITEOUT_DEV) @@@ -2705,7 -2703,6 +2709,6 @@@ extern sector_t bmap(struct inode *, se #endif extern int notify_change(struct dentry *, struct iattr *, struct inode **); extern int inode_permission(struct inode *, int); - extern int __inode_permission(struct inode *, int); extern int generic_permission(struct inode *, int); extern int __check_sticky(struct inode *dir, struct inode *inode);

@@@ -2998,7 -2995,6 +3001,7 @@@ enum };

void dio_end_io(struct bio *bio); +void dio_warn_stale_pagecache(struct file *filp);

ssize_t __blockdev_direct_IO(struct kiocb *iocb, struct inode *inode, struct block_device *bdev, struct iov_iter *iter, @@@ -3246,6 -3242,8 +3249,8 @@@ static inline int kiocb_set_rw_flags(st ki->ki_flags |= IOCB_DSYNC; if (flags & RWF_SYNC) ki->ki_flags |= (IOCB_DSYNC | IOCB_SYNC); + if (flags & RWF_APPEND) + ki->ki_flags |= IOCB_APPEND; return 0; }

diff --combined include/linux/skbuff.h index a38c80e9f91e,07564bb28c1f..a87e43d16f44 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@@ -1406,7 -1406,8 +1406,7 @@@ static inline struct sk_buff *skb_get(s }

/* - * If users == 1, we are the only owner and are can avoid redundant - * atomic change. + * If users == 1, we are the only owner and can avoid redundant atomic changes. */

/** @@@ -3241,7 -3242,7 +3241,7 @@@ struct sk_buff *__skb_recv_datagram(str int *peeked, int *off, int *err); struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock, int *err); - unsigned int datagram_poll(struct file *file, struct socket *sock, + __poll_t datagram_poll(struct file *file, struct socket *sock, struct poll_table_struct *wait); int skb_copy_datagram_iter(const struct sk_buff *from, int offset, struct iov_iter *to, int size); diff --combined include/linux/string.h index cfd83eb2f926,12d5429de0c8..50a723b41f10 --- a/include/linux/string.h +++ b/include/linux/string.h @@@ -11,6 -11,7 +11,7 @@@

extern char *strndup_user(const char __user *, long); extern void *memdup_user(const void __user *, size_t); + extern void *vmemdup_user(const void __user *, size_t); extern void *memdup_user_nul(const void __user *, size_t);

/* @@@ -259,10 -260,7 +260,10 @@@ __FORTIFY_INLINE __kernel_size_t strlen { __kernel_size_t ret; size_t p_size = __builtin_object_size(p, 0); - if (p_size == (size_t)-1) + + /* Work around gcc excess stack consumption issue */ + if (p_size == (size_t)-1 || + (__builtin_constant_p(p[p_size - 1]) && p[p_size - 1] == '\0')) return __builtin_strlen(p); ret = strnlen(p, p_size); if (p_size <= ret) diff --combined include/net/sock.h index 7a7b14e9628a,b33078333518..4fd74e0d1bbb --- a/include/net/sock.h +++ b/include/net/sock.h @@@ -685,7 -685,11 +685,7 @@@ static inline void sk_add_node_rcu(stru

static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) { - if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport && - sk->sk_family == AF_INET6) - hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list); - else - hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); + hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); }

static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) @@@ -1514,11 -1518,6 +1514,11 @@@ static inline bool sock_owned_by_user(c return sk->sk_lock.owned; }

+static inline bool sock_owned_by_user_nocheck(const struct sock *sk) +{ + return sk->sk_lock.owned; +} + /* no reclassification while locks are held */ static inline bool sock_allow_reclassification(const struct sock *csk) { @@@ -1583,7 -1582,7 +1583,7 @@@ int sock_no_connect(struct socket *, st int sock_no_socketpair(struct socket *, struct socket *); int sock_no_accept(struct socket *, struct socket *, int, bool); int sock_no_getname(struct socket *, struct sockaddr *, int *, int); - unsigned int sock_no_poll(struct file *, struct socket *, + __poll_t sock_no_poll(struct file *, struct socket *, struct poll_table_struct *); int sock_no_ioctl(struct socket *, unsigned int, unsigned long); int sock_no_listen(struct socket *, int); diff --combined include/net/tcp.h index 6da880d2f022,a6343271c629..50b21a49d870 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@@ -387,7 -387,7 +387,7 @@@ bool tcp_peer_is_proven(struct request_ void tcp_close(struct sock *sk, long timeout); void tcp_init_sock(struct sock *sk); void tcp_init_transfer(struct sock *sk, int bpf_op); - unsigned int tcp_poll(struct file *file, struct socket *sock, + __poll_t tcp_poll(struct file *file, struct socket *sock, struct poll_table_struct *wait); int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval, int __user *optlen); @@@ -844,11 -844,12 +844,11 @@@ static inline int tcp_v6_sdif(const str } #endif

-/* TCP_SKB_CB reference means this can not be used from early demux */ static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb) { #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV) if (!net->ipv4.sysctl_tcp_l3mdev_accept && - skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags)) + skb && ipv4_l3mdev_skb(IPCB(skb)->flags)) return true; #endif return false; @@@ -1055,7 -1056,7 +1055,7 @@@ void tcp_rate_skb_sent(struct sock *sk void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, struct rate_sample *rs); void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost, - struct rate_sample *rs); + bool is_sack_reneg, struct rate_sample *rs); void tcp_rate_check_app_limited(struct sock *sk);

/* These functions determine how the current flow behaves in respect of SACK diff --combined kernel/events/core.c index 2b4e886fedc2,857c40d98d2c..74dcc477216c --- a/kernel/events/core.c +++ b/kernel/events/core.c @@@ -1231,10 -1231,6 +1231,10 @@@ static void put_ctx(struct perf_event_c * perf_event_context::lock * perf_event::mmap_mutex * mmap_sem + * + * cpu_hotplug_lock + * pmus_lock + * cpuctx->mutex / perf_event_context::mutex */ static struct perf_event_context * perf_event_ctx_lock_nested(struct perf_event *event, int nesting) @@@ -4200,7 -4196,6 +4200,7 @@@ int perf_event_release_kernel(struct pe { struct perf_event_context *ctx = event->ctx; struct perf_event *child, *tmp; + LIST_HEAD(free_list);

/* * If we got here through err_file: fput(event_file); we will not have @@@ -4273,7 -4268,8 +4273,7 @@@ again struct perf_event, child_list); if (tmp == child) { perf_remove_from_context(child, DETACH_GROUP); - list_del(&child->child_list); - free_event(child); + list_move(&child->child_list, &free_list); /* * This matches the refcount bump in inherit_event(); * this can't be the last reference. @@@ -4288,11 -4284,6 +4288,11 @@@ } mutex_unlock(&event->child_mutex);

+ list_for_each_entry_safe(child, tmp, &free_list, child_list) { + list_del(&child->child_list); + free_event(child); + } + no_ctx: put_event(event); /* Must be the 'last' reference */ return 0; @@@ -4520,11 -4511,11 +4520,11 @@@ perf_read(struct file *file, char __use return ret; }

- static unsigned int perf_poll(struct file *file, poll_table *wait) + static __poll_t perf_poll(struct file *file, poll_table *wait) { struct perf_event *event = file->private_data; struct ring_buffer *rb; - unsigned int events = POLLHUP; + __poll_t events = POLLHUP;

poll_wait(file, &event->waitq, wait);

@@@ -4913,7 -4904,6 +4913,7 @@@ void perf_event_update_userpage(struct unlock: rcu_read_unlock(); } +EXPORT_SYMBOL_GPL(perf_event_update_userpage);

static int perf_mmap_fault(struct vm_fault *vmf) { @@@ -6649,7 -6639,6 +6649,7 @@@ static void perf_event_namespaces_outpu struct perf_namespaces_event *namespaces_event = data; struct perf_output_handle handle; struct perf_sample_data sample; + u16 header_size = namespaces_event->event_id.header.size; int ret;

if (!perf_event_namespaces_match(event)) @@@ -6660,7 -6649,7 +6660,7 @@@ ret = perf_output_begin(&handle, event, namespaces_event->event_id.header.size); if (ret) - return; + goto out;

namespaces_event->event_id.pid = perf_event_pid(event, namespaces_event->task); @@@ -6672,8 -6661,6 +6672,8 @@@ perf_event__output_id_sample(event, &handle, &sample);

perf_output_end(&handle); +out: + namespaces_event->event_id.header.size = header_size; }

static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info, @@@ -8000,11 -7987,11 +8000,11 @@@ static void bpf_overflow_handler(struc { struct bpf_perf_event_data_kern ctx = { .data = data, - .regs = regs, .event = event, }; int ret = 0;

+ ctx.regs = perf_arch_bpf_user_pt_regs(regs); preempt_disable(); if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) goto out; @@@ -8526,29 -8513,6 +8526,29 @@@ fail_clear_files return ret; }

+static int +perf_tracepoint_set_filter(struct perf_event *event, char *filter_str) +{ + struct perf_event_context *ctx = event->ctx; + int ret; + + /* + * Beware, here be dragons!! + * + * the tracepoint muck will deadlock against ctx->mutex, but the tracepoint + * stuff does not actually need it. So temporarily drop ctx->mutex. As per + * perf_event_ctx_lock() we already have a reference on ctx. + * + * This can result in event getting moved to a different ctx, but that + * does not affect the tracepoint state. + */ + mutex_unlock(&ctx->mutex); + ret = ftrace_profile_set_filter(event, event->attr.config, filter_str); + mutex_lock(&ctx->mutex); + + return ret; +} + static int perf_event_set_filter(struct perf_event *event, void __user *arg) { char *filter_str; @@@ -8565,7 -8529,8 +8565,7 @@@

if (IS_ENABLED(CONFIG_EVENT_TRACING) && event->attr.type == PERF_TYPE_TRACEPOINT) - ret = ftrace_profile_set_filter(event, event->attr.config, - filter_str); + ret = perf_tracepoint_set_filter(event, filter_str); else if (has_addr_filter(event)) ret = perf_event_set_addr_filter(event, filter_str);

@@@ -9200,13 -9165,7 +9200,13 @@@ static int perf_try_init_event(struct p if (!try_module_get(pmu->module)) return -ENODEV;

- if (event->group_leader != event) { + /* + * A number of pmu->event_init() methods iterate the sibling_list to, + * for example, validate if the group fits on the PMU. Therefore, + * if this is a sibling event, acquire the ctx->mutex to protect + * the sibling_list. + */ + if (event->group_leader != event && pmu->task_ctx_nr != perf_sw_context) { /* * This ctx->mutex can nest when we're called through * inheritance. See the perf_event_ctx_lock_nested() comment. diff --combined kernel/printk/printk.c index b9006617710f,8aa27be96012..c2e713f6ae2e --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@@ -920,10 -920,10 +920,10 @@@ static loff_t devkmsg_llseek(struct fil return ret; }

- static unsigned int devkmsg_poll(struct file *file, poll_table *wait) + static __poll_t devkmsg_poll(struct file *file, poll_table *wait) { struct devkmsg_user *user = file->private_data; - int ret = 0; + __poll_t ret = 0;

if (!user) return POLLERR|POLLNVAL; @@@ -3141,6 -3141,9 +3141,6 @@@ void dump_stack_print_info(const char * void show_regs_print_info(const char *log_lvl) { dump_stack_print_info(log_lvl); - - printk("%stask: %p task.stack: %p\n", - log_lvl, current, task_stack_page(current)); }

#endif diff --combined kernel/trace/ring_buffer.c index 5af2842dea96,d24d48713ef3..ca6930e0d25e --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@@ -280,8 -280,6 +280,8 @@@ EXPORT_SYMBOL_GPL(ring_buffer_event_dat /* Missed count stored at end */ #define RB_MISSED_STORED (1 << 30)

+#define RB_MISSED_FLAGS (RB_MISSED_EVENTS|RB_MISSED_STORED) + struct buffer_data_page { u64 time_stamp; /* page time stamp */ local_t commit; /* write committed index */ @@@ -333,9 -331,7 +333,9 @@@ static void rb_init_page(struct buffer_ */ size_t ring_buffer_page_len(void *page) { - return local_read(&((struct buffer_data_page *)page)->commit) + struct buffer_data_page *bpage = page; + + return (local_read(&bpage->commit) & ~RB_MISSED_FLAGS) + BUF_PAGE_HDR_SIZE; }

@@@ -630,7 -626,7 +630,7 @@@ int ring_buffer_wait(struct ring_buffe * Returns POLLIN | POLLRDNORM if data exists in the buffers, * zero otherwise. */ - int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, + __poll_t ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, struct file *filp, poll_table *poll_table) { struct ring_buffer_per_cpu *cpu_buffer; @@@ -1803,6 -1799,12 +1803,6 @@@ void ring_buffer_change_overwrite(struc } EXPORT_SYMBOL_GPL(ring_buffer_change_overwrite);

-static __always_inline void * -__rb_data_page_index(struct buffer_data_page *bpage, unsigned index) -{ - return bpage->data + index; -} - static __always_inline void *__rb_page_index(struct buffer_page *bpage, unsigned index) { return bpage->page->data + index; @@@ -2534,58 -2536,29 +2534,58 @@@ rb_wakeups(struct ring_buffer *buffer, * The lock and unlock are done within a preempt disable section. * The current_context per_cpu variable can only be modified * by the current task between lock and unlock. But it can - * be modified more than once via an interrupt. There are four - * different contexts that we need to consider. + * be modified more than once via an interrupt. To pass this + * information from the lock to the unlock without having to + * access the 'in_interrupt()' functions again (which do show + * a bit of overhead in something as critical as function tracing, + * we use a bitmask trick. + * + * bit 0 = NMI context + * bit 1 = IRQ context + * bit 2 = SoftIRQ context + * bit 3 = normal context. + * + * This works because this is the order of contexts that can + * preempt other contexts. A SoftIRQ never preempts an IRQ + * context. + * + * When the context is determined, the corresponding bit is + * checked and set (if it was set, then a recursion of that context + * happened). + * + * On unlock, we need to clear this bit. To do so, just subtract + * 1 from the current_context and AND it to itself. * - * Normal context. - * SoftIRQ context - * IRQ context - * NMI context + * (binary) + * 101 - 1 = 100 + * 101 & 100 = 100 (clearing bit zero) * - * If for some reason the ring buffer starts to recurse, we - * only allow that to happen at most 4 times (one for each - * context). If it happens 5 times, then we consider this a - * recusive loop and do not let it go further. + * 1010 - 1 = 1001 + * 1010 & 1001 = 1000 (clearing bit 1) + * + * The least significant bit can be cleared this way, and it + * just so happens that it is the same bit corresponding to + * the current context. */

static __always_inline int trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer) { - if (cpu_buffer->current_context >= 4) + unsigned int val = cpu_buffer->current_context; + unsigned long pc = preempt_count(); + int bit; + + if (!(pc & (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_OFFSET))) + bit = RB_CTX_NORMAL; + else + bit = pc & NMI_MASK ? RB_CTX_NMI : + pc & HARDIRQ_MASK ? RB_CTX_IRQ : RB_CTX_SOFTIRQ; + + if (unlikely(val & (1 << bit))) return 1;

- cpu_buffer->current_context++; - /* Interrupts must see this update */ - barrier(); + val |= (1 << bit); + cpu_buffer->current_context = val;

return 0; } @@@ -2593,7 -2566,9 +2593,7 @@@ static __always_inline void trace_recursive_unlock(struct ring_buffer_per_cpu *cpu_buffer) { - /* Don't let the dec leak out */ - barrier(); - cpu_buffer->current_context--; + cpu_buffer->current_context &= cpu_buffer->current_context - 1; }

/** @@@ -4431,13 -4406,8 +4431,13 @@@ void ring_buffer_free_read_page(struct { struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu]; struct buffer_data_page *bpage = data; + struct page *page = virt_to_page(bpage); unsigned long flags;

+ /* If the page is still in use someplace else, we can't reuse it */ + if (page_ref_count(page) > 1) + goto out; + local_irq_save(flags); arch_spin_lock(&cpu_buffer->lock);

@@@ -4449,7 -4419,6 +4449,7 @@@ arch_spin_unlock(&cpu_buffer->lock); local_irq_restore(flags);

+ out: free_page((unsigned long)bpage); } EXPORT_SYMBOL_GPL(ring_buffer_free_read_page); diff --combined kernel/trace/trace.c index 8e3f20a18a06,1e2a45e87b93..5ee0bc7309ba --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@@ -362,7 -362,7 +362,7 @@@ trace_ignore_this_task(struct trace_pid }

/** - * trace_pid_filter_add_remove - Add or remove a task from a pid_list + * trace_pid_filter_add_remove_task - Add or remove a task from a pid_list * @pid_list: The list to modify * @self: The current task for fork or NULL for exit * @task: The task to add or remove @@@ -925,7 -925,7 +925,7 @@@ static void tracing_snapshot_instance(s }

/** - * trace_snapshot - take a snapshot of the current buffer. + * tracing_snapshot - take a snapshot of the current buffer. * * This causes a swap between the snapshot buffer and the current live * tracing buffer. You can use this to take snapshots of the live @@@ -1004,9 -1004,9 +1004,9 @@@ int tracing_alloc_snapshot(void EXPORT_SYMBOL_GPL(tracing_alloc_snapshot);

/** - * trace_snapshot_alloc - allocate and take a snapshot of the current buffer. + * tracing_snapshot_alloc - allocate and take a snapshot of the current buffer. * - * This is similar to trace_snapshot(), but it will allocate the + * This is similar to tracing_snapshot(), but it will allocate the * snapshot buffer if it isn't already allocated. Use this only * where it is safe to sleep, as the allocation may sleep. * @@@ -1303,7 -1303,7 +1303,7 @@@ unsigned long __read_mostly tracing_thr /* * Copy the new maximum trace into the separate maximum-trace * structure. (this way the maximum trace is permanently saved, - * for later retrieval via /sys/kernel/debug/tracing/latency_trace) + * for later retrieval via /sys/kernel/tracing/tracing_max_latency) */ static void __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu) @@@ -2374,15 -2374,6 +2374,15 @@@ void trace_event_buffer_commit(struct t } EXPORT_SYMBOL_GPL(trace_event_buffer_commit);

+/* + * Skip 3: + * + * trace_buffer_unlock_commit_regs() + * trace_event_buffer_commit() + * trace_event_raw_event_xxx() +*/ +# define STACK_SKIP 3 + void trace_buffer_unlock_commit_regs(struct trace_array *tr, struct ring_buffer *buffer, struct ring_buffer_event *event, @@@ -2392,12 -2383,16 +2392,12 @@@ __buffer_unlock_commit(buffer, event);

/* - * If regs is not set, then skip the following callers: - * trace_buffer_unlock_commit_regs - * event_trigger_unlock_commit - * trace_event_buffer_commit - * trace_event_raw_event_sched_switch + * If regs is not set, then skip the necessary functions. * Note, we can still get here via blktrace, wakeup tracer * and mmiotrace, but that's ok if they lose a function or - * two. They are that meaningful. + * two. They are not that meaningful. */ - ftrace_trace_stack(tr, buffer, flags, regs ? 0 : 4, pc, regs); + ftrace_trace_stack(tr, buffer, flags, regs ? 0 : STACK_SKIP, pc, regs); ftrace_trace_userstack(buffer, flags, pc); }

@@@ -2420,7 -2415,7 +2420,7 @@@ trace_process_export(struct trace_expor

entry = ring_buffer_event_data(event); size = ring_buffer_event_length(event); - export->write(entry, size); + export->write(export, entry, size); }

static DEFINE_MUTEX(ftrace_export_lock); @@@ -2584,13 -2579,11 +2584,13 @@@ static void __ftrace_trace_stack(struc trace.skip = skip;

/* - * Add two, for this function and the call to save_stack_trace() + * Add one, for this function and the call to save_stack_trace() * If regs is set, then these functions will not be in the way. */ +#ifndef CONFIG_UNWINDER_ORC if (!regs) - trace.skip += 2; + trace.skip++; +#endif

/* * Since events can happen in NMIs there's no safe way to @@@ -2718,10 -2711,11 +2718,10 @@@ void trace_dump_stack(int skip

local_save_flags(flags);

- /* - * Skip 3 more, seems to get us at the caller of - * this function. - */ - skip += 3; +#ifndef CONFIG_UNWINDER_ORC + /* Skip 1 to skip this function. */ + skip++; +#endif __ftrace_trace_stack(global_trace.trace_buffer.buffer, flags, skip, preempt_count(), NULL); } @@@ -4184,30 -4178,37 +4184,30 @@@ static const struct file_operations sho .llseek = seq_lseek, };

-/* - * The tracer itself will not take this lock, but still we want - * to provide a consistent cpumask to user-space: - */ -static DEFINE_MUTEX(tracing_cpumask_update_lock); - -/* - * Temporary storage for the character representation of the - * CPU bitmask (and one more byte for the newline): - */ -static char mask_str[NR_CPUS + 1]; - static ssize_t tracing_cpumask_read(struct file *filp, char __user *ubuf, size_t count, loff_t *ppos) { struct trace_array *tr = file_inode(filp)->i_private; + char *mask_str; int len;

- mutex_lock(&tracing_cpumask_update_lock); + len = snprintf(NULL, 0, "%*pb\n", + cpumask_pr_args(tr->tracing_cpumask)) + 1; + mask_str = kmalloc(len, GFP_KERNEL); + if (!mask_str) + return -ENOMEM;

- len = snprintf(mask_str, count, "%*pb\n", + len = snprintf(mask_str, len, "%*pb\n", cpumask_pr_args(tr->tracing_cpumask)); if (len >= count) { count = -EINVAL; goto out_err; } - count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1); + count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len);

out_err: - mutex_unlock(&tracing_cpumask_update_lock); + kfree(mask_str);

return count; } @@@ -4227,6 -4228,8 +4227,6 @@@ tracing_cpumask_write(struct file *filp if (err) goto err_unlock;

- mutex_lock(&tracing_cpumask_update_lock); - local_irq_disable(); arch_spin_lock(&tr->max_lock); for_each_tracing_cpu(cpu) { @@@ -4249,6 -4252,8 +4249,6 @@@ local_irq_enable();

cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new); - - mutex_unlock(&tracing_cpumask_update_lock); free_cpumask_var(tracing_cpumask_new);

return count; @@@ -5627,7 -5632,7 +5627,7 @@@ static int tracing_release_pipe(struct return 0; }

- static unsigned int + static __poll_t trace_poll(struct trace_iterator *iter, struct file *filp, poll_table *poll_table) { struct trace_array *tr = iter->tr; @@@ -5646,7 -5651,7 +5646,7 @@@ filp, poll_table); }

- static unsigned int + static __poll_t tracing_poll_pipe(struct file *filp, poll_table *poll_table) { struct trace_iterator *iter = filp->private_data; @@@ -6600,7 -6605,7 +6600,7 @@@ static int tracing_buffers_open(struct return ret; }

- static unsigned int + static __poll_t tracing_buffers_poll(struct file *filp, poll_table *poll_table) { struct ftrace_buffer_info *info = filp->private_data; @@@ -6775,7 -6780,7 +6775,7 @@@ tracing_buffers_splice_read(struct fil .spd_release = buffer_spd_release, }; struct buffer_ref *ref; - int entries, size, i; + int entries, i; ssize_t ret = 0;

#ifdef CONFIG_TRACER_MAX_TRACE @@@ -6829,6 -6834,14 +6829,6 @@@ break; }

- /* - * zero out any left over data, this is going to - * user land. - */ - size = ring_buffer_page_len(ref->page); - if (size < PAGE_SIZE) - memset(ref->page + size, 0, PAGE_SIZE - size); - page = virt_to_page(ref->page);

spd.pages[i] = page; @@@ -7586,7 -7599,6 +7586,7 @@@ allocate_trace_buffer(struct trace_arra buf->data = alloc_percpu(struct trace_array_cpu); if (!buf->data) { ring_buffer_free(buf->buffer); + buf->buffer = NULL; return -ENOMEM; }

@@@ -7610,9 -7622,7 +7610,9 @@@ static int allocate_trace_buffers(struc allocate_snapshot ? size : 1); if (WARN_ON(ret)) { ring_buffer_free(tr->trace_buffer.buffer); + tr->trace_buffer.buffer = NULL; free_percpu(tr->trace_buffer.data); + tr->trace_buffer.data = NULL; return -ENOMEM; } tr->allocated_snapshot = allocate_snapshot; diff --combined mm/gup.c index e0d82b6706d7,17ee7a18aa11..9e17d8db2d6b --- a/mm/gup.c +++ b/mm/gup.c @@@ -66,7 -66,7 +66,7 @@@ static int follow_pfn_pte(struct vm_are */ static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) { - return pte_access_permitted(pte, WRITE) || + return pte_write(pte) || ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); }

@@@ -848,7 -848,7 +848,7 @@@ static __always_inline long __get_user_ unsigned long nr_pages, struct page **pages, struct vm_area_struct **vmas, - int *locked, bool notify_drop, + int *locked, unsigned int flags) { long ret, pages_done; @@@ -922,7 -922,7 +922,7 @@@ pages++; start += PAGE_SIZE; } - if (notify_drop && lock_dropped && *locked) { + if (lock_dropped && *locked) { /* * We must let the caller know we temporarily dropped the lock * and so the critical section protected by it was lost. @@@ -959,36 -959,12 +959,12 @@@ long get_user_pages_locked(unsigned lon int *locked) { return __get_user_pages_locked(current, current->mm, start, nr_pages, - pages, NULL, locked, true, + pages, NULL, locked, gup_flags | FOLL_TOUCH); } EXPORT_SYMBOL(get_user_pages_locked);

/* - * Same as get_user_pages_unlocked(...., FOLL_TOUCH) but it allows for - * tsk, mm to be specified. - * - * NOTE: here FOLL_TOUCH is not set implicitly and must be set by the - * caller if required (just like with __get_user_pages). "FOLL_GET" - * is set implicitly if "pages" is non-NULL. - */ - static __always_inline long __get_user_pages_unlocked(struct task_struct *tsk, - struct mm_struct *mm, unsigned long start, - unsigned long nr_pages, struct page **pages, - unsigned int gup_flags) - { - long ret; - int locked = 1; - - down_read(&mm->mmap_sem); - ret = __get_user_pages_locked(tsk, mm, start, nr_pages, pages, NULL, - &locked, false, gup_flags); - if (locked) - up_read(&mm->mmap_sem); - return ret; - } - - /* * get_user_pages_unlocked() is suitable to replace the form: * * down_read(&mm->mmap_sem); @@@ -1006,8 -982,16 +982,16 @@@ long get_user_pages_unlocked(unsigned long start, unsigned long nr_pages, struct page **pages, unsigned int gup_flags) { - return __get_user_pages_unlocked(current, current->mm, start, nr_pages, - pages, gup_flags | FOLL_TOUCH); + struct mm_struct *mm = current->mm; + int locked = 1; + long ret; + + down_read(&mm->mmap_sem); + ret = __get_user_pages_locked(current, mm, start, nr_pages, pages, NULL, + &locked, gup_flags | FOLL_TOUCH); + if (locked) + up_read(&mm->mmap_sem); + return ret; } EXPORT_SYMBOL(get_user_pages_unlocked);

@@@ -1073,7 -1057,7 +1057,7 @@@ long get_user_pages_remote(struct task_ struct vm_area_struct **vmas, int *locked) { return __get_user_pages_locked(tsk, mm, start, nr_pages, pages, vmas, - locked, true, + locked, gup_flags | FOLL_TOUCH | FOLL_REMOTE); } EXPORT_SYMBOL(get_user_pages_remote); @@@ -1090,7 -1074,7 +1074,7 @@@ long get_user_pages(unsigned long start struct vm_area_struct **vmas) { return __get_user_pages_locked(current, current->mm, start, nr_pages, - pages, vmas, NULL, false, + pages, vmas, NULL, gup_flags | FOLL_TOUCH); } EXPORT_SYMBOL(get_user_pages); diff --combined net/9p/trans_fd.c index 80f5c79053a4,439014113a5c..d6f7f7cb79c4 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@@ -228,32 -228,31 +228,31 @@@ static void p9_conn_cancel(struct p9_co } }

- static int - p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt) + static __poll_t + p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt, int *err) { - int ret, n; + __poll_t ret, n; struct p9_trans_fd *ts = NULL;

if (client && client->status == Connected) ts = client->trans;

- if (!ts) - return -EREMOTEIO; + if (!ts) { + if (err) + *err = -EREMOTEIO; + return POLLERR; + }

if (!ts->rd->f_op->poll) - return -EIO; - - if (!ts->wr->f_op->poll) - return -EIO; - - ret = ts->rd->f_op->poll(ts->rd, pt); - if (ret < 0) - return ret; + ret = DEFAULT_POLLMASK; + else + ret = ts->rd->f_op->poll(ts->rd, pt);

if (ts->rd != ts->wr) { - n = ts->wr->f_op->poll(ts->wr, pt); - if (n < 0) - return n; + if (!ts->wr->f_op->poll) + n = DEFAULT_POLLMASK; + else + n = ts->wr->f_op->poll(ts->wr, pt); ret = (ret & ~POLLOUT) | (n & ~POLLIN); }

@@@ -298,7 -297,8 +297,8 @@@ static int p9_fd_read(struct p9_client

static void p9_read_work(struct work_struct *work) { - int n, err; + __poll_t n; + int err; struct p9_conn *m; int status = REQ_STATUS_ERROR;

@@@ -398,7 -398,7 +398,7 @@@ end_clear if (test_and_clear_bit(Rpending, &m->wsched)) n = POLLIN; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if ((n & POLLIN) && !test_and_set_bit(Rworksched, &m->wsched)) { p9_debug(P9_DEBUG_TRANS, "sched read work %p\n", m); @@@ -448,7 -448,8 +448,8 @@@ static int p9_fd_write(struct p9_clien

static void p9_write_work(struct work_struct *work) { - int n, err; + __poll_t n; + int err; struct p9_conn *m; struct p9_req_t *req;

@@@ -506,7 -507,7 +507,7 @@@ end_clear if (test_and_clear_bit(Wpending, &m->wsched)) n = POLLOUT; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if ((n & POLLOUT) && !test_and_set_bit(Wworksched, &m->wsched)) { @@@ -581,7 -582,7 +582,7 @@@ p9_pollwait(struct file *filp, wait_que

static void p9_conn_create(struct p9_client *client) { - int n; + __poll_t n; struct p9_trans_fd *ts = client->trans; struct p9_conn *m = &ts->conn;

@@@ -597,7 -598,7 +598,7 @@@ INIT_LIST_HEAD(&m->poll_pending_link); init_poll_funcptr(&m->pt, p9_pollwait);

- n = p9_fd_poll(client, &m->pt); + n = p9_fd_poll(client, &m->pt, NULL); if (n & POLLIN) { p9_debug(P9_DEBUG_TRANS, "mux %p can read\n", m); set_bit(Rpending, &m->wsched); @@@ -617,17 -618,16 +618,16 @@@

static void p9_poll_mux(struct p9_conn *m) { - int n; + __poll_t n; + int err = -ECONNRESET;

if (m->err < 0) return;

- n = p9_fd_poll(m->client, NULL); - if (n < 0 || n & (POLLERR | POLLHUP | POLLNVAL)) { + n = p9_fd_poll(m->client, NULL, &err); + if (n & (POLLERR | POLLHUP | POLLNVAL)) { p9_debug(P9_DEBUG_TRANS, "error mux %p err %d\n", m, n); - if (n >= 0) - n = -ECONNRESET; - p9_conn_cancel(m, n); + p9_conn_cancel(m, err); }

if (n & POLLIN) { @@@ -663,7 -663,7 +663,7 @@@

static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) { - int n; + __poll_t n; struct p9_trans_fd *ts = client->trans; struct p9_conn *m = &ts->conn;

@@@ -680,7 -680,7 +680,7 @@@ if (test_and_clear_bit(Wpending, &m->wsched)) n = POLLOUT; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if (n & POLLOUT && !test_and_set_bit(Wworksched, &m->wsched)) schedule_work(&m->wq); @@@ -839,6 -839,7 +839,6 @@@ static int p9_socket_open(struct p9_cli if (IS_ERR(file)) { pr_err("%s (%d): failed to map fd\n", __func__, task_pid_nr(current)); - sock_release(csocket); kfree(p); return PTR_ERR(file); } diff --combined net/dccp/proto.c index 9d43c1f40274,cfa9ca9939ce..8b8db3d481bd --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@@ -259,7 -259,6 +259,7 @@@ int dccp_disconnect(struct sock *sk, in { struct inet_connection_sock *icsk = inet_csk(sk); struct inet_sock *inet = inet_sk(sk); + struct dccp_sock *dp = dccp_sk(sk); int err = 0; const int old_state = sk->sk_state;

@@@ -279,10 -278,6 +279,10 @@@ sk->sk_err = ECONNRESET;

dccp_clear_xmit_timers(sk); + ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); + ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_rx_ccid = NULL; + dp->dccps_hc_tx_ccid = NULL;

__skb_queue_purge(&sk->sk_receive_queue); __skb_queue_purge(&sk->sk_write_queue); @@@ -318,10 -313,10 +318,10 @@@ EXPORT_SYMBOL_GPL(dccp_disconnect) * take care of normal races (between the test and the event) and we don't * go look at any of the socket buffers directly. */ - unsigned int dccp_poll(struct file *file, struct socket *sock, + __poll_t dccp_poll(struct file *file, struct socket *sock, poll_table *wait) { - unsigned int mask; + __poll_t mask; struct sock *sk = sock->sk;

sock_poll_wait(file, sk_sleep(sk), wait); diff --combined net/ipv4/tcp.c index 8e053ad7cae2,0b8ca689353b..1b38b4282cc9 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@@ -493,9 -493,9 +493,9 @@@ static void tcp_tx_timestamp(struct soc * take care of normal races (between the test and the event) and we don't * go look at any of the socket buffers directly. */ - unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait) + __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) { - unsigned int mask; + __poll_t mask; struct sock *sk = sock->sk; const struct tcp_sock *tp = tcp_sk(sk); int state; @@@ -2298,9 -2298,6 +2298,9 @@@ adjudge_to_death tcp_send_active_reset(sk, GFP_ATOMIC); __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONMEMORY); + } else if (!check_net(sock_net(sk))) { + /* Not possible to send reset; just close */ + tcp_set_state(sk, TCP_CLOSE); } }

@@@ -2415,7 -2412,6 +2415,7 @@@ int tcp_disconnect(struct sock *sk, in tp->snd_cwnd_cnt = 0; tp->window_clamp = 0; tcp_set_ca_state(sk, TCP_CA_Open); + tp->is_sack_reneg = 0; tcp_clear_retrans(tp); inet_csk_delack_init(sk); /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0 diff --combined net/rxrpc/af_rxrpc.c index dcd818fa837e,50ae1e2557fe..21ad6a3a465c --- a/net/rxrpc/af_rxrpc.c +++ b/net/rxrpc/af_rxrpc.c @@@ -729,12 -729,12 +729,12 @@@ static int rxrpc_getsockopt(struct sock /* * permit an RxRPC socket to be polled */ - static unsigned int rxrpc_poll(struct file *file, struct socket *sock, + static __poll_t rxrpc_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct rxrpc_sock *rx = rxrpc_sk(sk); - unsigned int mask; + __poll_t mask;

sock_poll_wait(file, sk_sleep(sk), wait); mask = 0; @@@ -860,7 -860,6 +860,7 @@@ static void rxrpc_sock_destructor(struc static int rxrpc_release_sock(struct sock *sk) { struct rxrpc_sock *rx = rxrpc_sk(sk); + struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));

_enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));

@@@ -896,8 -895,8 +896,8 @@@ rxrpc_release_calls_on_socket(rx); flush_workqueue(rxrpc_workqueue); rxrpc_purge_queue(&sk->sk_receive_queue); - rxrpc_queue_work(&rx->local->rxnet->service_conn_reaper); - rxrpc_queue_work(&rx->local->rxnet->client_conn_reaper); + rxrpc_queue_work(&rxnet->service_conn_reaper); + rxrpc_queue_work(&rxnet->client_conn_reaper);

rxrpc_put_local(rx->local); rx->local = NULL; diff --combined net/sctp/socket.c index 039fcb618c34,11d5b19479cf..737e551fbf67 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@@ -85,7 -85,7 +85,7 @@@ static int sctp_writeable(struct sock *sk); static void sctp_wfree(struct sk_buff *skb); static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - size_t msg_len, struct sock **orig_sk); + size_t msg_len); static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p); static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p); static int sctp_wait_for_accept(struct sock *sk, long timeo); @@@ -335,14 -335,16 +335,14 @@@ static struct sctp_af *sctp_sockaddr_af if (len < sizeof (struct sockaddr)) return NULL;

+ if (!opt->pf->af_supported(addr->sa.sa_family, opt)) + return NULL; + /* V4 mapped address are really of AF_INET family */ if (addr->sa.sa_family == AF_INET6 && - ipv6_addr_v4mapped(&addr->v6.sin6_addr)) { - if (!opt->pf->af_supported(AF_INET, opt)) - return NULL; - } else { - /* Does this PF support this AF? */ - if (!opt->pf->af_supported(addr->sa.sa_family, opt)) - return NULL; - } + ipv6_addr_v4mapped(&addr->v6.sin6_addr) && + !opt->pf->af_supported(AF_INET, opt)) + return NULL;

/* If we get this far, af is valid. */ af = sctp_get_af_specific(addr->sa.sa_family); @@@ -968,13 -970,6 +968,6 @@@ int sctp_asconf_mgmt(struct sctp_sock * * This is used for tunneling the sctp_bindx() request through sctp_setsockopt() * from userspace. * - * We don't use copy_from_user() for optimization: we first do the - * sanity checks (buffer size -fast- and access check-healthy - * pointer); if all of those succeed, then we can alloc the memory - * (expensive operation) needed to copy the data to kernel. Then we do - * the copying without checking the user space area - * (__copy_from_user()). - * * On exit there is no need to do sockfd_put(), sys_setsockopt() does * it. * @@@ -1004,25 -999,15 +997,15 @@@ static int sctp_setsockopt_bindx(struc if (unlikely(addrs_size <= 0)) return -EINVAL;

- /* Check the user passed a healthy pointer. */ - if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size))) - return -EFAULT; - - /* Alloc space for the address array in kernel memory. */ - kaddrs = kmalloc(addrs_size, GFP_USER | __GFP_NOWARN); - if (unlikely(!kaddrs)) - return -ENOMEM; - - if (__copy_from_user(kaddrs, addrs, addrs_size)) { - kfree(kaddrs); - return -EFAULT; - } + kaddrs = vmemdup_user(addrs, addrs_size); + if (unlikely(IS_ERR(kaddrs))) + return PTR_ERR(kaddrs);

/* Walk through the addrs buffer and count the number of addresses. */ addr_buf = kaddrs; while (walk_size < addrs_size) { if (walk_size + sizeof(sa_family_t) > addrs_size) { - kfree(kaddrs); + kvfree(kaddrs); return -EINVAL; }

@@@ -1033,7 -1018,7 +1016,7 @@@ * causes the address buffer to overflow return EINVAL. */ if (!af || (walk_size + af->sockaddr_len) > addrs_size) { - kfree(kaddrs); + kvfree(kaddrs); return -EINVAL; } addrcnt++; @@@ -1063,7 -1048,7 +1046,7 @@@ }

out: - kfree(kaddrs); + kvfree(kaddrs);

return err; } @@@ -1321,13 -1306,6 +1304,6 @@@ out_free * land and invoking either sctp_connectx(). This is used for tunneling * the sctp_connectx() request through sctp_setsockopt() from userspace. * - * We don't use copy_from_user() for optimization: we first do the - * sanity checks (buffer size -fast- and access check-healthy - * pointer); if all of those succeed, then we can alloc the memory - * (expensive operation) needed to copy the data to kernel. Then we do - * the copying without checking the user space area - * (__copy_from_user()). - * * On exit there is no need to do sockfd_put(), sys_setsockopt() does * it. * @@@ -1343,7 -1321,6 +1319,6 @@@ static int __sctp_setsockopt_connectx(s sctp_assoc_t *assoc_id) { struct sockaddr *kaddrs; - gfp_t gfp = GFP_KERNEL; int err = 0;

pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n", @@@ -1352,24 -1329,12 +1327,12 @@@ if (unlikely(addrs_size <= 0)) return -EINVAL;

- /* Check the user passed a healthy pointer. */ - if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size))) - return -EFAULT; - - /* Alloc space for the address array in kernel memory. */ - if (sk->sk_socket->file) - gfp = GFP_USER | __GFP_NOWARN; - kaddrs = kmalloc(addrs_size, gfp); - if (unlikely(!kaddrs)) - return -ENOMEM; - - if (__copy_from_user(kaddrs, addrs, addrs_size)) { - err = -EFAULT; - } else { - err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id); - } + kaddrs = vmemdup_user(addrs, addrs_size); + if (unlikely(IS_ERR(kaddrs))) + return PTR_ERR(kaddrs);

- kfree(kaddrs); + err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id); + kvfree(kaddrs);

return err; } @@@ -1881,14 -1846,8 +1844,14 @@@ static int sctp_sendmsg(struct sock *sk */ if (sinit) { if (sinit->sinit_num_ostreams) { - asoc->c.sinit_num_ostreams = - sinit->sinit_num_ostreams; + __u16 outcnt = sinit->sinit_num_ostreams; + + asoc->c.sinit_num_ostreams = outcnt; + /* outcnt has been changed, so re-init stream */ + err = sctp_stream_init(&asoc->stream, outcnt, 0, + GFP_KERNEL); + if (err) + goto out_free; } if (sinit->sinit_max_instreams) { asoc->c.sinit_max_instreams = @@@ -1975,7 -1934,7 +1938,7 @@@ timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); if (!sctp_wspace(asoc)) { /* sk can be changed by peel off when waiting for buf. */ - err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk); + err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); if (err) { if (err == -ESRCH) { /* asoc is already dead. */ @@@ -2281,7 -2240,7 +2244,7 @@@ static int sctp_setsockopt_events(struc

if (asoc && sctp_outq_is_empty(&asoc->outqueue)) { event = sctp_ulpevent_make_sender_dry_event(asoc, - GFP_ATOMIC); + GFP_USER | __GFP_NOWARN); if (!event) return -ENOMEM;

@@@ -3502,8 -3461,6 +3465,8 @@@ static int sctp_setsockopt_hmac_ident(s

if (optlen < sizeof(struct sctp_hmacalgo)) return -EINVAL; + optlen = min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) + + SCTP_AUTH_NUM_HMACS * sizeof(u16));

hmacs = memdup_user(optval, optlen); if (IS_ERR(hmacs)) @@@ -3542,11 -3499,6 +3505,11 @@@ static int sctp_setsockopt_auth_key(str

if (optlen <= sizeof(struct sctp_authkey)) return -EINVAL; + /* authkey->sca_keylength is u16, so optlen can't be bigger than + * this. + */ + optlen = min_t(unsigned int, optlen, USHRT_MAX + + sizeof(struct sctp_authkey));

authkey = memdup_user(optval, optlen); if (IS_ERR(authkey)) @@@ -3902,20 -3854,13 +3865,20 @@@ static int sctp_setsockopt_reset_stream struct sctp_association *asoc; int retval = -EINVAL;

- if (optlen < sizeof(struct sctp_reset_streams)) + if (optlen < sizeof(*params)) return -EINVAL; + /* srs_number_streams is u16, so optlen can't be bigger than this. */ + optlen = min_t(unsigned int, optlen, USHRT_MAX + + sizeof(__u16) * sizeof(*params));

params = memdup_user(optval, optlen); if (IS_ERR(params)) return PTR_ERR(params);

+ if (params->srs_number_streams * sizeof(__u16) > + optlen - sizeof(*params)) + goto out; + asoc = sctp_id2assoc(sk, params->srs_assoc_id); if (!asoc) goto out; @@@ -4512,7 -4457,7 +4475,7 @@@ static int sctp_init_sock(struct sock * SCTP_DBG_OBJCNT_INC(sock);

local_bh_disable(); - percpu_counter_inc(&sctp_sockets_allocated); + sk_sockets_allocated_inc(sk); sock_prot_inuse_add(net, sk->sk_prot, 1);

/* Nothing can fail after this block, otherwise @@@ -4556,7 -4501,7 +4519,7 @@@ static void sctp_destroy_sock(struct so } sctp_endpoint_free(sp->ep); local_bh_disable(); - percpu_counter_dec(&sctp_sockets_allocated); + sk_sockets_allocated_dec(sk); sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); local_bh_enable(); } @@@ -5029,7 -4974,7 +4992,7 @@@ static int sctp_getsockopt_autoclose(st len = sizeof(int); if (put_user(len, optlen)) return -EFAULT; - if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int))) + if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len)) return -EFAULT; return 0; } @@@ -5098,6 -5043,7 +5061,6 @@@ static int sctp_getsockopt_peeloff_comm *newfile = sock_alloc_file(newsock, 0, NULL); if (IS_ERR(*newfile)) { put_unused_fd(retval); - sock_release(newsock); retval = PTR_ERR(*newfile); *newfile = NULL; return retval; @@@ -5659,9 -5605,6 +5622,9 @@@ copy_getaddrs err = -EFAULT; goto out; } + /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too, + * but we can't change it anymore. + */ if (put_user(bytes_copied, optlen)) err = -EFAULT; out: @@@ -6098,7 -6041,7 +6061,7 @@@ static int sctp_getsockopt_maxseg(struc params.assoc_id = 0; } else if (len >= sizeof(struct sctp_assoc_value)) { len = sizeof(struct sctp_assoc_value); - if (copy_from_user(&params, optval, sizeof(params))) + if (copy_from_user(&params, optval, len)) return -EFAULT; } else return -EINVAL; @@@ -6268,9 -6211,7 +6231,9 @@@ static int sctp_getsockopt_active_key(s

if (len < sizeof(struct sctp_authkeyid)) return -EINVAL; - if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) + + len = sizeof(struct sctp_authkeyid); + if (copy_from_user(&val, optval, len)) return -EFAULT;

asoc = sctp_id2assoc(sk, val.scact_assoc_id); @@@ -6282,6 -6223,7 +6245,6 @@@ else val.scact_keynumber = ep->active_key_id;

- len = sizeof(struct sctp_authkeyid); if (put_user(len, optlen)) return -EFAULT; if (copy_to_user(optval, &val, len)) @@@ -6307,7 -6249,7 +6270,7 @@@ static int sctp_getsockopt_peer_auth_ch if (len < sizeof(struct sctp_authchunks)) return -EINVAL;

- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) + if (copy_from_user(&val, optval, sizeof(val))) return -EFAULT;

to = p->gauth_chunks; @@@ -6352,7 -6294,7 +6315,7 @@@ static int sctp_getsockopt_local_auth_c if (len < sizeof(struct sctp_authchunks)) return -EINVAL;

- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) + if (copy_from_user(&val, optval, sizeof(val))) return -EFAULT;

to = p->gauth_chunks; @@@ -7518,11 -7460,11 +7481,11 @@@ out * here, again, by modeling the current TCP/UDP code. We don't have * a good way to test with it yet. */ - unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait) + __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct sctp_sock *sp = sctp_sk(sk); - unsigned int mask; + __poll_t mask;

poll_wait(file, sk_sleep(sk), wait);

@@@ -8020,12 -7962,12 +7983,12 @@@ void sctp_sock_rfree(struct sk_buff *sk

/* Helper function to wait for space in the sndbuf. */ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - size_t msg_len, struct sock **orig_sk) + size_t msg_len) { struct sock *sk = asoc->base.sk; - int err = 0; long current_timeo = *timeo_p; DEFINE_WAIT(wait); + int err = 0;

pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc, *timeo_p, msg_len); @@@ -8054,13 -7996,17 +8017,13 @@@ release_sock(sk); current_timeo = schedule_timeout(current_timeo); lock_sock(sk); - if (sk != asoc->base.sk) { - release_sock(sk); - sk = asoc->base.sk; - lock_sock(sk); - } + if (sk != asoc->base.sk) + goto do_error;

*timeo_p = current_timeo; }

out: - *orig_sk = sk; finish_wait(&asoc->wait, &wait);

/* Release the association's refcnt. */ diff --combined net/socket.c index 6f05d5c4bf30,96ac77bbc9b4..2f378449bc1b --- a/net/socket.c +++ b/net/socket.c @@@ -118,7 -118,7 +118,7 @@@ static ssize_t sock_write_iter(struct k static int sock_mmap(struct file *file, struct vm_area_struct *vma);

static int sock_close(struct inode *inode, struct file *file); - static unsigned int sock_poll(struct file *file, + static __poll_t sock_poll(struct file *file, struct poll_table_struct *wait); static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg); #ifdef CONFIG_COMPAT @@@ -406,10 -406,8 +406,10 @@@ struct file *sock_alloc_file(struct soc name.len = strlen(name.name); } path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name); - if (unlikely(!path.dentry)) + if (unlikely(!path.dentry)) { + sock_release(sock); return ERR_PTR(-ENOMEM); + } path.mnt = mntget(sock_mnt);

d_instantiate(path.dentry, SOCK_INODE(sock)); @@@ -417,11 -415,9 +417,11 @@@ file = alloc_file(&path, FMODE_READ | FMODE_WRITE, &socket_file_ops); if (IS_ERR(file)) { - /* drop dentry, keep inode */ + /* drop dentry, keep inode for a bit */ ihold(d_inode(path.dentry)); path_put(&path); + /* ... and now kill it properly */ + sock_release(sock); return file; }

@@@ -1097,9 -1093,9 +1097,9 @@@ out_release EXPORT_SYMBOL(sock_create_lite);

/* No kernel lock held - perfect */ - static unsigned int sock_poll(struct file *file, poll_table *wait) + static __poll_t sock_poll(struct file *file, poll_table *wait) { - unsigned int busy_flag = 0; + __poll_t busy_flag = 0; struct socket *sock;

/* @@@ -1336,9 -1332,19 +1336,9 @@@ SYSCALL_DEFINE3(socket, int, family, in

retval = sock_create(family, type, protocol, &sock); if (retval < 0) - goto out; - - retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK)); - if (retval < 0) - goto out_release; - -out: - /* It may be already another descriptor 8) Not kernel problem. */ - return retval; + return retval;

-out_release: - sock_release(sock); - return retval; + return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK)); }

/* @@@ -1362,72 -1368,87 +1362,72 @@@ SYSCALL_DEFINE4(socketpair, int, family flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

/* + * reserve descriptors and make sure we won't fail + * to return them to userland. + */ + fd1 = get_unused_fd_flags(flags); + if (unlikely(fd1 < 0)) + return fd1; + + fd2 = get_unused_fd_flags(flags); + if (unlikely(fd2 < 0)) { + put_unused_fd(fd1); + return fd2; + } + + err = put_user(fd1, &usockvec[0]); + if (err) + goto out; + + err = put_user(fd2, &usockvec[1]); + if (err) + goto out; + + /* * Obtain the first socket and check if the underlying protocol * supports the socketpair call. */

err = sock_create(family, type, protocol, &sock1); - if (err < 0) + if (unlikely(err < 0)) goto out;

err = sock_create(family, type, protocol, &sock2); - if (err < 0) - goto out_release_1; - - err = sock1->ops->socketpair(sock1, sock2); - if (err < 0) - goto out_release_both; - - fd1 = get_unused_fd_flags(flags); - if (unlikely(fd1 < 0)) { - err = fd1; - goto out_release_both; + if (unlikely(err < 0)) { + sock_release(sock1); + goto out; }

- fd2 = get_unused_fd_flags(flags); - if (unlikely(fd2 < 0)) { - err = fd2; - goto out_put_unused_1; + err = sock1->ops->socketpair(sock1, sock2); + if (unlikely(err < 0)) { + sock_release(sock2); + sock_release(sock1); + goto out; }

newfile1 = sock_alloc_file(sock1, flags, NULL); if (IS_ERR(newfile1)) { err = PTR_ERR(newfile1); - goto out_put_unused_both; + sock_release(sock2); + goto out; }

newfile2 = sock_alloc_file(sock2, flags, NULL); if (IS_ERR(newfile2)) { err = PTR_ERR(newfile2); - goto out_fput_1; + fput(newfile1); + goto out; }

- err = put_user(fd1, &usockvec[0]); - if (err) - goto out_fput_both; - - err = put_user(fd2, &usockvec[1]); - if (err) - goto out_fput_both; - audit_fd_pair(fd1, fd2);

fd_install(fd1, newfile1); fd_install(fd2, newfile2); - /* fd1 and fd2 may be already another descriptors. - * Not kernel problem. - */ - return 0;

-out_fput_both: - fput(newfile2); - fput(newfile1); - put_unused_fd(fd2); - put_unused_fd(fd1); - goto out; - -out_fput_1: - fput(newfile1); - put_unused_fd(fd2); - put_unused_fd(fd1); - sock_release(sock2); - goto out; - -out_put_unused_both: +out: put_unused_fd(fd2); -out_put_unused_1: put_unused_fd(fd1); -out_release_both: - sock_release(sock2); -out_release_1: - sock_release(sock1); -out: return err; }

@@@ -1543,6 -1564,7 +1543,6 @@@ SYSCALL_DEFINE4(accept4, int, fd, struc if (IS_ERR(newfile)) { err = PTR_ERR(newfile); put_unused_fd(newfd); - sock_release(newsock); goto out_put; }

@@@ -2621,15 -2643,6 +2621,15 @@@ out_fs

core_initcall(sock_init); /* early initcall */

+static int __init jit_init(void) +{ +#ifdef CONFIG_BPF_JIT_ALWAYS_ON + bpf_jit_enable = 1; +#endif + return 0; +} +pure_initcall(jit_init); + #ifdef CONFIG_PROC_FS void socket_seq_show(struct seq_file *seq) { diff --combined net/sunrpc/svcsock.c index 5884583f93a4,5570719e4787..943f2a745cd5 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@@ -338,8 -338,8 +338,8 @@@ static int svc_recvfrom(struct svc_rqs rqstp->rq_xprt_hlen = 0;

clear_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags); - len = kernel_recvmsg(svsk->sk_sock, &msg, iov, nr, buflen, - msg.msg_flags); + iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, iov, nr, buflen); + len = sock_recvmsg(svsk->sk_sock, &msg, msg.msg_flags); /* If we read a full record, then assume there may be more * data to read (stream based sockets only!) */ @@@ -384,11 -384,25 +384,11 @@@ static int svc_partial_recvfrom(struct static void svc_sock_setbufsize(struct socket *sock, unsigned int snd, unsigned int rcv) { -#if 0 - mm_segment_t oldfs; - oldfs = get_fs(); set_fs(KERNEL_DS); - sock_setsockopt(sock, SOL_SOCKET, SO_SNDBUF, - (char*)&snd, sizeof(snd)); - sock_setsockopt(sock, SOL_SOCKET, SO_RCVBUF, - (char*)&rcv, sizeof(rcv)); -#else - /* sock_setsockopt limits use to sysctl_?mem_max, - * which isn't acceptable. Until that is made conditional - * on not having CAP_SYS_RESOURCE or similar, we go direct... - * DaveM said I could! - */ lock_sock(sock->sk); sock->sk->sk_sndbuf = snd * 2; sock->sk->sk_rcvbuf = rcv * 2; sock->sk->sk_write_space(sock->sk); release_sock(sock->sk); -#endif }

static int svc_sock_secure_port(struct svc_rqst *rqstp) diff --combined net/tipc/server.c index d60c30342327,0c3b74d1e722..78a292a84afc --- a/net/tipc/server.c +++ b/net/tipc/server.c @@@ -264,8 -264,8 +264,8 @@@ static int tipc_receive_from_sock(struc iov.iov_base = buf; iov.iov_len = s->max_rcvbuf_size; msg.msg_name = &addr; - ret = kernel_recvmsg(con->sock, &msg, &iov, 1, iov.iov_len, - MSG_DONTWAIT); + iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, iov.iov_len); + ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT); if (ret <= 0) { kmem_cache_free(s->rcvbuf_cache, buf); goto out_close; @@@ -314,7 -314,6 +314,7 @@@ static int tipc_accept_from_sock(struc newcon->usr_data = s->tipc_conn_new(newcon->conid); if (!newcon->usr_data) { sock_release(newsock); + conn_put(newcon); return -ENOMEM; }

@@@ -512,7 -511,7 +512,7 @@@ bool tipc_topsrv_kern_subscr(struct ne s = con->server; scbr = s->tipc_conn_new(*conid); if (!scbr) { - tipc_close_conn(con); + conn_put(con); return false; }

diff --combined net/tipc/socket.c index 3b4084480377,d94d25855190..2aa46e8cd8fe --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@@ -710,13 -710,13 +710,13 @@@ static int tipc_getname(struct socket * * imply that the operation will succeed, merely that it should be performed * and will not block. */ - static unsigned int tipc_poll(struct file *file, struct socket *sock, + static __poll_t tipc_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct tipc_sock *tsk = tipc_sk(sk); struct tipc_group *grp = tsk->group; - u32 revents = 0; + __poll_t revents = 0;

sock_poll_wait(file, sk_sleep(sk), wait);

@@@ -727,11 -727,11 +727,11 @@@

switch (sk->sk_state) { case TIPC_ESTABLISHED: + case TIPC_CONNECTING: if (!tsk->cong_link_cnt && !tsk_conn_cong(tsk)) revents |= POLLOUT; /* fall thru' */ case TIPC_LISTEN: - case TIPC_CONNECTING: if (!skb_queue_empty(&sk->sk_receive_queue)) revents |= POLLIN | POLLRDNORM; break; @@@ -1140,7 -1140,7 +1140,7 @@@ void tipc_sk_mcast_rcv(struct net *net __skb_dequeue(arrvq); __skb_queue_tail(inputq, skb); } - refcount_dec(&skb->users); + kfree_skb(skb); spin_unlock_bh(&inputq->lock); continue; } diff --combined net/vmw_vsock/af_vsock.c index c9473d698525,bbd97d3bd8fb..9d95e773f4c8 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@@ -850,11 -850,11 +850,11 @@@ static int vsock_shutdown(struct socke return err; }

- static unsigned int vsock_poll(struct file *file, struct socket *sock, + static __poll_t vsock_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk; - unsigned int mask; + __poll_t mask; struct vsock_sock *vsk;

sk = sock->sk; @@@ -951,7 -951,7 +951,7 @@@ * POLLOUT|POLLWRNORM when peer is closed and nothing to read, * but local send is not shutdown. */ - if (sk->sk_state == TCP_CLOSE) { + if (sk->sk_state == TCP_CLOSE || sk->sk_state == TCP_CLOSING) { if (!(sk->sk_shutdown & SEND_SHUTDOWN)) mask |= POLLOUT | POLLWRNORM;

diff --combined sound/core/oss/pcm_oss.c index e8b19876c420,caa4d0c949bf..3ebba9c7f86e --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@@ -186,7 -186,7 +186,7 @@@ static int _snd_pcm_hw_param_mask(struc { int changed; changed = snd_mask_refine(hw_param_mask(params, var), val); - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -233,7 -233,7 +233,7 @@@ static int _snd_pcm_hw_param_min(struc val, open); else return -EINVAL; - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -294,7 -294,7 +294,7 @@@ static int _snd_pcm_hw_param_max(struc val, open); else return -EINVAL; - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -455,6 -455,7 +455,6 @@@ static int snd_pcm_hw_param_near(struc v = snd_pcm_hw_param_last(pcm, params, var, dir); else v = snd_pcm_hw_param_first(pcm, params, var, dir); - snd_BUG_ON(v < 0); return v; }

@@@ -499,7 -500,7 +499,7 @@@ static int _snd_pcm_hw_param_set(struc } } else return -EINVAL; - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -539,7 -540,7 +539,7 @@@ static int _snd_pcm_hw_param_setinteger { int changed; changed = snd_interval_setinteger(hw_param_interval(params, var)); - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -842,7 -843,7 +842,7 @@@ static int snd_pcm_oss_change_params(st if (!(mutex_trylock(&runtime->oss.params_lock))) return -EAGAIN; } else if (mutex_lock_interruptible(&runtime->oss.params_lock)) - return -EINTR; + return -ERESTARTSYS; sw_params = kzalloc(sizeof(*sw_params), GFP_KERNEL); params = kmalloc(sizeof(*params), GFP_KERNEL); sparams = kmalloc(sizeof(*sparams), GFP_KERNEL); @@@ -1334,11 -1335,8 +1334,11 @@@ static ssize_t snd_pcm_oss_write1(struc

if ((tmp = snd_pcm_oss_make_ready(substream)) < 0) return tmp; - mutex_lock(&runtime->oss.params_lock); while (bytes > 0) { + if (mutex_lock_interruptible(&runtime->oss.params_lock)) { + tmp = -ERESTARTSYS; + break; + } if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) { tmp = bytes; if (tmp + runtime->oss.buffer_used > runtime->oss.period_bytes) @@@ -1382,18 -1380,14 +1382,18 @@@ xfer += tmp; if ((substream->f_flags & O_NONBLOCK) != 0 && tmp != runtime->oss.period_bytes) - break; + tmp = -EAGAIN; } - } - mutex_unlock(&runtime->oss.params_lock); - return xfer; - err: - mutex_unlock(&runtime->oss.params_lock); + mutex_unlock(&runtime->oss.params_lock); + if (tmp < 0) + break; + if (signal_pending(current)) { + tmp = -ERESTARTSYS; + break; + } + tmp = 0; + } return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp; }

@@@ -1441,11 -1435,8 +1441,11 @@@ static ssize_t snd_pcm_oss_read1(struc

if ((tmp = snd_pcm_oss_make_ready(substream)) < 0) return tmp; - mutex_lock(&runtime->oss.params_lock); while (bytes > 0) { + if (mutex_lock_interruptible(&runtime->oss.params_lock)) { + tmp = -ERESTARTSYS; + break; + } if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) { if (runtime->oss.buffer_used == 0) { tmp = snd_pcm_oss_read2(substream, runtime->oss.buffer, runtime->oss.period_bytes, 1); @@@ -1476,16 -1467,12 +1476,16 @@@ bytes -= tmp; xfer += tmp; } - } - mutex_unlock(&runtime->oss.params_lock); - return xfer; - err: - mutex_unlock(&runtime->oss.params_lock); + mutex_unlock(&runtime->oss.params_lock); + if (tmp < 0) + break; + if (signal_pending(current)) { + tmp = -ERESTARTSYS; + break; + } + tmp = 0; + } return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp; }

@@@ -2686,10 -2673,10 +2686,10 @@@ static int snd_pcm_oss_capture_ready(st runtime->oss.period_frames; }

- static unsigned int snd_pcm_oss_poll(struct file *file, poll_table * wait) + static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait) { struct snd_pcm_oss_file *pcm_oss_file; - unsigned int mask; + __poll_t mask; struct snd_pcm_substream *psubstream = NULL, *csubstream = NULL; pcm_oss_file = file->private_data; diff --combined sound/core/pcm_native.c index 484a18d96371,6077dd6a0901..51104df924e1 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@@ -2580,7 -2580,7 +2580,7 @@@ static snd_pcm_sframes_t forward_appl_p return ret < 0 ? ret : frames; }

-/* decrease the appl_ptr; returns the processed frames or a negative error */ +/* decrease the appl_ptr; returns the processed frames or zero for error */ static snd_pcm_sframes_t rewind_appl_ptr(struct snd_pcm_substream *substream, snd_pcm_uframes_t frames, snd_pcm_sframes_t avail) @@@ -2597,12 -2597,7 +2597,12 @@@ if (appl_ptr < 0) appl_ptr += runtime->boundary; ret = pcm_lib_apply_appl_ptr(substream, appl_ptr); - return ret < 0 ? ret : frames; + /* NOTE: we return zero for errors because PulseAudio gets depressed + * upon receiving an error from rewind ioctl and stops processing + * any longer. Returning zero means that no rewind is done, so + * it's not absolutely wrong to answer like that. + */ + return ret < 0 ? 0 : frames; }

static snd_pcm_sframes_t snd_pcm_playback_rewind(struct snd_pcm_substream *substream, @@@ -3135,12 -3130,12 +3135,12 @@@ static ssize_t snd_pcm_writev(struct ki return result; }

- static unsigned int snd_pcm_playback_poll(struct file *file, poll_table * wait) + static __poll_t snd_pcm_playback_poll(struct file *file, poll_table * wait) { struct snd_pcm_file *pcm_file; struct snd_pcm_substream *substream; struct snd_pcm_runtime *runtime; - unsigned int mask; + __poll_t mask; snd_pcm_uframes_t avail;

pcm_file = file->private_data; @@@ -3174,12 -3169,12 +3174,12 @@@ return mask; }

- static unsigned int snd_pcm_capture_poll(struct file *file, poll_table * wait) + static __poll_t snd_pcm_capture_poll(struct file *file, poll_table * wait) { struct snd_pcm_file *pcm_file; struct snd_pcm_substream *substream; struct snd_pcm_runtime *runtime; - unsigned int mask; + __poll_t mask; snd_pcm_uframes_t avail;

pcm_file = file->private_data; @@@ -3446,7 -3441,7 +3446,7 @@@ EXPORT_SYMBOL_GPL(snd_pcm_lib_default_m int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_struct *area) { - struct snd_pcm_runtime *runtime = substream->runtime;; + struct snd_pcm_runtime *runtime = substream->runtime;

area->vm_page_prot = pgprot_noncached(area->vm_page_prot); return vm_iomap_memory(area, runtime->dma_addr, runtime->dma_bytes); diff --combined sound/core/rawmidi.c index f055ca10bbc1,e7e4930732a3..fae21311723f --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@@ -579,14 -579,15 +579,14 @@@ static int snd_rawmidi_info_user(struc return 0; }

-int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info) +static int __snd_rawmidi_info_select(struct snd_card *card, + struct snd_rawmidi_info *info) { struct snd_rawmidi *rmidi; struct snd_rawmidi_str *pstr; struct snd_rawmidi_substream *substream;

- mutex_lock(&register_mutex); rmidi = snd_rawmidi_search(card, info->device); - mutex_unlock(&register_mutex); if (!rmidi) return -ENXIO; if (info->stream < 0 || info->stream > 1) @@@ -602,16 -603,6 +602,16 @@@ } return -ENXIO; } + +int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info) +{ + int ret; + + mutex_lock(&register_mutex); + ret = __snd_rawmidi_info_select(card, info); + mutex_unlock(&register_mutex); + return ret; +} EXPORT_SYMBOL(snd_rawmidi_info_select);

static int snd_rawmidi_info_select_user(struct snd_card *card, @@@ -1366,11 -1357,11 +1366,11 @@@ static ssize_t snd_rawmidi_write(struc return result; }

- static unsigned int snd_rawmidi_poll(struct file *file, poll_table * wait) + static __poll_t snd_rawmidi_poll(struct file *file, poll_table * wait) { struct snd_rawmidi_file *rfile; struct snd_rawmidi_runtime *runtime; - unsigned int mask; + __poll_t mask;

rfile = file->private_data; if (rfile->input != NULL) { diff --combined sound/core/seq/seq_clientmgr.c index d01913404581,6d57912a8988..b611deef81f5 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@@ -221,7 -221,6 +221,7 @@@ static struct snd_seq_client *seq_creat rwlock_init(&client->ports_lock); mutex_init(&client->ports_mutex); INIT_LIST_HEAD(&client->ports_list_head); + mutex_init(&client->ioctl_mutex);

/* find free slot in the client table */ spin_lock_irqsave(&clients_lock, flags); @@@ -1087,10 -1086,10 +1087,10 @@@ static ssize_t snd_seq_write(struct fil /* * handle polling */ - static unsigned int snd_seq_poll(struct file *file, poll_table * wait) + static __poll_t snd_seq_poll(struct file *file, poll_table * wait) { struct snd_seq_client *client = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

/* check client structures are in place */ if (snd_BUG_ON(!client)) @@@ -2131,9 -2130,7 +2131,9 @@@ static long snd_seq_ioctl(struct file * return -EFAULT; }

+ mutex_lock(&client->ioctl_mutex); err = handler->func(client, &buf); + mutex_unlock(&client->ioctl_mutex); if (err >= 0) { /* Some commands includes a bug in 'dir' field. */ if (handler->cmd == SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT || diff --combined sound/usb/mixer_quirks.c index e6359d341878,bc93242eef8a..05ccc7fdcc09 --- a/sound/usb/mixer_quirks.c +++ b/sound/usb/mixer_quirks.c @@@ -27,7 -27,6 +27,7 @@@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */

+#include <linux/hid.h> #include <linux/init.h> #include <linux/slab.h> #include <linux/usb.h> @@@ -240,7 -239,7 +240,7 @@@ static long snd_usb_sbrc_hwdep_read(str return err < 0 ? err : count; }

- static unsigned int snd_usb_sbrc_hwdep_poll(struct snd_hwdep *hw, struct file *file, + static __poll_t snd_usb_sbrc_hwdep_poll(struct snd_hwdep *hw, struct file *file, poll_table *wait) { struct usb_mixer_interface *mixer = hw->private_data; @@@ -1722,83 -1721,6 +1722,83 @@@ static int snd_microii_controls_create( return 0; }

+/* Creative Sound Blaster E1 */ + +static int snd_soundblaster_e1_switch_get(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) +{ + ucontrol->value.integer.value[0] = kcontrol->private_value; + return 0; +} + +static int snd_soundblaster_e1_switch_update(struct usb_mixer_interface *mixer, + unsigned char state) +{ + struct snd_usb_audio *chip = mixer->chip; + int err; + unsigned char buff[2]; + + buff[0] = 0x02; + buff[1] = state ? 0x02 : 0x00; + + err = snd_usb_lock_shutdown(chip); + if (err < 0) + return err; + err = snd_usb_ctl_msg(chip->dev, + usb_sndctrlpipe(chip->dev, 0), HID_REQ_SET_REPORT, + USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT, + 0x0202, 3, buff, 2); + snd_usb_unlock_shutdown(chip); + return err; +} + +static int snd_soundblaster_e1_switch_put(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) +{ + struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol); + unsigned char value = !!ucontrol->value.integer.value[0]; + int err; + + if (kcontrol->private_value == value) + return 0; + kcontrol->private_value = value; + err = snd_soundblaster_e1_switch_update(list->mixer, value); + return err < 0 ? err : 1; +} + +static int snd_soundblaster_e1_switch_resume(struct usb_mixer_elem_list *list) +{ + return snd_soundblaster_e1_switch_update(list->mixer, + list->kctl->private_value); +} + +static int snd_soundblaster_e1_switch_info(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_info *uinfo) +{ + static const char *const texts[2] = { + "Mic", "Aux" + }; + + return snd_ctl_enum_info(uinfo, 1, ARRAY_SIZE(texts), texts); +} + +static struct snd_kcontrol_new snd_soundblaster_e1_input_switch = { + .iface = SNDRV_CTL_ELEM_IFACE_MIXER, + .name = "Input Source", + .info = snd_soundblaster_e1_switch_info, + .get = snd_soundblaster_e1_switch_get, + .put = snd_soundblaster_e1_switch_put, + .private_value = 0, +}; + +static int snd_soundblaster_e1_switch_create(struct usb_mixer_interface *mixer) +{ + return add_single_ctl_with_resume(mixer, 0, + snd_soundblaster_e1_switch_resume, + &snd_soundblaster_e1_input_switch, + NULL); +} + int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) { int err = 0; @@@ -1880,10 -1802,6 +1880,10 @@@ case USB_ID(0x1235, 0x800c): /* Focusrite Scarlett 18i20 */ err = snd_scarlett_controls_create(mixer); break; + + case USB_ID(0x041e, 0x323b): /* Creative Sound Blaster E1 */ + err = snd_soundblaster_e1_switch_create(mixer); + break; }

return err; diff --combined virt/kvm/kvm_main.c index 210bf820385a,7b4d46432c85..d6b9370806f8 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@@ -135,11 -135,6 +135,11 @@@ static void kvm_uevent_notify_change(un static unsigned long long kvm_createvm_count; static unsigned long long kvm_active_vms;

+__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, + unsigned long start, unsigned long end) +{ +} + bool kvm_is_reserved_pfn(kvm_pfn_t pfn) { if (pfn_valid(pfn)) @@@ -365,9 -360,6 +365,9 @@@ static void kvm_mmu_notifier_invalidate kvm_flush_remote_tlbs(kvm);

spin_unlock(&kvm->mmu_lock); + + kvm_arch_mmu_notifier_invalidate_range(kvm, start, end); + srcu_read_unlock(&kvm->srcu, idx); }

@@@ -1322,17 -1314,6 +1322,6 @@@ unsigned long kvm_vcpu_gfn_to_hva_prot( return gfn_to_hva_memslot_prot(slot, gfn, writable); }

- static int get_user_page_nowait(unsigned long start, int write, - struct page **page) - { - int flags = FOLL_NOWAIT | FOLL_HWPOISON; - - if (write) - flags |= FOLL_WRITE; - - return get_user_pages(start, 1, flags, page, NULL); - } - static inline int check_user_page_hwpoison(unsigned long addr) { int rc, flags = FOLL_HWPOISON | FOLL_WRITE; @@@ -1381,7 -1362,8 +1370,8 @@@ static bool hva_to_pfn_fast(unsigned lo static int hva_to_pfn_slow(unsigned long addr, bool *async, bool write_fault, bool *writable, kvm_pfn_t *pfn) { - struct page *page[1]; + unsigned int flags = FOLL_HWPOISON; + struct page *page; int npages = 0;

might_sleep(); @@@ -1389,35 -1371,26 +1379,26 @@@ if (writable) *writable = write_fault;

- if (async) { - down_read(&current->mm->mmap_sem); - npages = get_user_page_nowait(addr, write_fault, page); - up_read(&current->mm->mmap_sem); - } else { - unsigned int flags = FOLL_HWPOISON; - - if (write_fault) - flags |= FOLL_WRITE; + if (write_fault) + flags |= FOLL_WRITE; + if (async) + flags |= FOLL_NOWAIT;

- npages = get_user_pages_unlocked(addr, 1, page, flags); - } + npages = get_user_pages_unlocked(addr, 1, &page, flags); if (npages != 1) return npages;

/* map read fault as writable if possible */ if (unlikely(!write_fault) && writable) { - struct page *wpage[1]; + struct page *wpage;

- npages = __get_user_pages_fast(addr, 1, 1, wpage); - if (npages == 1) { + if (__get_user_pages_fast(addr, 1, 1, &wpage) == 1) { *writable = true; - put_page(page[0]); - page[0] = wpage[0]; + put_page(page); + page = wpage; } - - npages = 1; } - *pfn = page_to_pfn(page[0]); + *pfn = page_to_pfn(page); return npages; }