[linux-next] LinuxNextTracking branch, master, updated. next-20171219

The following commit has been merged in the master branch: commit 6c47e82bc85ff5387a97155b54b98c15b183e088 Merge: 15f2c2745af6b44262ff9f8b6026daacc40575f8 b75cfa1913c2890afc90d8d34ba8a63d1b4ba2af Author: Stephen Rothwell sfr@canb.auug.org.au Date: Tue Dec 19 10:33:46 2017 +1100

Merge remote-tracking branch 'vfs/for-next'

diff --combined arch/alpha/include/uapi/asm/Kbuild index 14a2e9af97e9,574fe90c8b58..9afaba5e5503 --- a/arch/alpha/include/uapi/asm/Kbuild +++ b/arch/alpha/include/uapi/asm/Kbuild @@@ -1,4 -1,4 +1,5 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h diff --combined arch/ia64/include/uapi/asm/Kbuild index f5c6967a93bb,4c9825edd4a3..c0527cfc48f0 --- a/arch/ia64/include/uapi/asm/Kbuild +++ b/arch/ia64/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generic-y += kvm_para.h + generic-y += poll.h diff --combined arch/m32r/include/uapi/asm/Kbuild index 451bf6071c6e,21f241553a2e..c3df55aeefe7 --- a/arch/m32r/include/uapi/asm/Kbuild +++ b/arch/m32r/include/uapi/asm/Kbuild @@@ -1,6 -1,6 +1,7 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generic-y += kvm_para.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/mn10300/include/uapi/asm/Kbuild index 81271d3af47c,162fbdbb5fd5..b04fd1632051 --- a/arch/mn10300/include/uapi/asm/Kbuild +++ b/arch/mn10300/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/score/include/uapi/asm/Kbuild index 81271d3af47c,162fbdbb5fd5..b04fd1632051 --- a/arch/score/include/uapi/asm/Kbuild +++ b/arch/score/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/x86/include/uapi/asm/Kbuild index 1e901e421f2d,e9f6b8e332bd..322681622d1e --- a/arch/x86/include/uapi/asm/Kbuild +++ b/arch/x86/include/uapi/asm/Kbuild @@@ -1,7 -1,7 +1,8 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generated-y += unistd_32.h generated-y += unistd_64.h generated-y += unistd_x32.h + generic-y += poll.h diff --combined crypto/af_alg.c index 444a387df219,a00a8171b4f6..05b084e216ac --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@@ -672,15 -672,14 +672,15 @@@ void af_alg_free_areq_sgls(struct af_al }

tsgl = areq->tsgl; - for_each_sg(tsgl, sg, areq->tsgl_entries, i) { - if (!sg_page(sg)) - continue; - put_page(sg_page(sg)); - } + if (tsgl) { + for_each_sg(tsgl, sg, areq->tsgl_entries, i) { + if (!sg_page(sg)) + continue; + put_page(sg_page(sg)); + }

- if (areq->tsgl && areq->tsgl_entries) sock_kfree_s(sk, tsgl, areq->tsgl_entries * sizeof(*tsgl)); + } } EXPORT_SYMBOL_GPL(af_alg_free_areq_sgls);

@@@ -1022,18 -1021,6 +1022,18 @@@ unlock EXPORT_SYMBOL_GPL(af_alg_sendpage);

/** + * af_alg_free_resources - release resources required for crypto request + */ +void af_alg_free_resources(struct af_alg_async_req *areq) +{ + struct sock *sk = areq->sk; + + af_alg_free_areq_sgls(areq); + sock_kfree_s(sk, areq, areq->areqlen); +} +EXPORT_SYMBOL_GPL(af_alg_free_resources); + +/** * af_alg_async_cb - AIO callback handler * * This handler cleans up the struct af_alg_async_req upon completion of the @@@ -1049,26 -1036,31 +1049,26 @@@ void af_alg_async_cb(struct crypto_asyn struct kiocb *iocb = areq->iocb; unsigned int resultlen;

- lock_sock(sk); - /* Buffer size written by crypto operation. */ resultlen = areq->outlen;

- af_alg_free_areq_sgls(areq); - sock_kfree_s(sk, areq, areq->areqlen); - __sock_put(sk); + af_alg_free_resources(areq); + sock_put(sk);

iocb->ki_complete(iocb, err ? err : resultlen, 0); - - release_sock(sk); } EXPORT_SYMBOL_GPL(af_alg_async_cb);

/** * af_alg_poll - poll system call handler */ - unsigned int af_alg_poll(struct file *file, struct socket *sock, + __poll_t af_alg_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct alg_sock *ask = alg_sk(sk); struct af_alg_ctx *ctx = ask->private; - unsigned int mask; + __poll_t mask;

sock_poll_wait(file, sk_sleep(sk), wait); mask = 0; @@@ -1138,6 -1130,12 +1138,6 @@@ int af_alg_get_rsgl(struct sock *sk, st if (!af_alg_readable(sk)) break;

- if (!ctx->used) { - err = af_alg_wait_for_data(sk, flags); - if (err) - return err; - } - seglen = min_t(size_t, (maxsize - len), msg_data_left(msg));

diff --combined crypto/algif_skcipher.c index baef9bfccdda,c86207f267e2..494c99cbe48f --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@@ -72,12 -72,6 +72,12 @@@ static int _skcipher_recvmsg(struct soc int err = 0; size_t len = 0;

+ if (!ctx->used) { + err = af_alg_wait_for_data(sk, flags); + if (err) + return err; + } + /* Allocate cipher request for current operation. */ areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) + crypto_skcipher_reqsize(tfm)); @@@ -123,24 -117,13 +123,24 @@@

if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) { /* AIO operation */ + sock_hold(sk); areq->iocb = msg->msg_iocb; + + /* Remember output size that will be generated. */ + areq->outlen = len; + skcipher_request_set_callback(&areq->cra_u.skcipher_req, CRYPTO_TFM_REQ_MAY_SLEEP, af_alg_async_cb, areq); err = ctx->enc ? crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) : crypto_skcipher_decrypt(&areq->cra_u.skcipher_req); + + /* AIO operation in progress */ + if (err == -EINPROGRESS || err == -EBUSY) + return -EIOCBQUEUED; + + sock_put(sk); } else { /* Synchronous operation */ skcipher_request_set_callback(&areq->cra_u.skcipher_req, @@@ -153,9 -136,19 +153,9 @@@ &ctx->wait); }

- /* AIO operation in progress */ - if (err == -EINPROGRESS) { - sock_hold(sk); - - /* Remember output size that will be generated. */ - areq->outlen = len; - - return -EIOCBQUEUED; - }

free: - af_alg_free_areq_sgls(areq); - sock_kfree_s(sk, areq, areq->areqlen); + af_alg_free_resources(areq);

return err ? err : len; } @@@ -193,7 -186,6 +193,6 @@@ out return ret; }

- static struct proto_ops algif_skcipher_ops = { .family = PF_ALG,

diff --combined drivers/android/binder.c index a7ecfde66b7b,fdc951083b07..cc89d0d2b965 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@@ -482,8 -482,7 +482,8 @@@ enum binder_deferred_state * @tsk task_struct for group_leader of process * (invariant after initialized) * @files files_struct for process - * (invariant after initialized) + * (protected by @files_lock) + * @files_lock mutex to protect @files * @deferred_work_node: element for binder_deferred_list * (protected by binder_deferred_lock) * @deferred_work: bitmap of deferred work to perform @@@ -531,7 -530,6 +531,7 @@@ struct binder_proc int pid; struct task_struct *tsk; struct files_struct *files; + struct mutex files_lock; struct hlist_node deferred_work_node; int deferred_work; bool is_dead; @@@ -879,26 -877,20 +879,26 @@@ static void binder_inc_node_tmpref_iloc

static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) { - struct files_struct *files = proc->files; unsigned long rlim_cur; unsigned long irqs; + int ret;

- if (files == NULL) - return -ESRCH; - - if (!lock_task_sighand(proc->tsk, &irqs)) - return -EMFILE; - + mutex_lock(&proc->files_lock); + if (proc->files == NULL) { + ret = -ESRCH; + goto err; + } + if (!lock_task_sighand(proc->tsk, &irqs)) { + ret = -EMFILE; + goto err; + } rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); unlock_task_sighand(proc->tsk, &irqs);

- return __alloc_fd(files, 0, rlim_cur, flags); + ret = __alloc_fd(proc->files, 0, rlim_cur, flags); +err: + mutex_unlock(&proc->files_lock); + return ret; }

/* @@@ -907,10 -899,8 +907,10 @@@ static void task_fd_install( struct binder_proc *proc, unsigned int fd, struct file *file) { + mutex_lock(&proc->files_lock); if (proc->files) __fd_install(proc->files, fd, file); + mutex_unlock(&proc->files_lock); }

/* @@@ -920,11 -910,9 +920,11 @@@ static long task_close_fd(struct binder { int retval;

- if (proc->files == NULL) - return -ESRCH; - + mutex_lock(&proc->files_lock); + if (proc->files == NULL) { + retval = -ESRCH; + goto err; + } retval = __close_fd(proc->files, fd); /* can't restart close syscall because file table entry was cleared */ if (unlikely(retval == -ERESTARTSYS || @@@ -932,8 -920,7 +932,8 @@@ retval == -ERESTARTNOHAND || retval == -ERESTART_RESTARTBLOCK)) retval = -EINTR; - +err: + mutex_unlock(&proc->files_lock); return retval; }

@@@ -1961,26 -1948,6 +1961,26 @@@ static void binder_send_failed_reply(st }

/** + * binder_cleanup_transaction() - cleans up undelivered transaction + * @t: transaction that needs to be cleaned up + * @reason: reason the transaction wasn't delivered + * @error_code: error to return to caller (if synchronous call) + */ +static void binder_cleanup_transaction(struct binder_transaction *t, + const char *reason, + uint32_t error_code) +{ + if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) { + binder_send_failed_reply(t, error_code); + } else { + binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, + "undelivered transaction %d, %s\n", + t->debug_id, reason); + binder_free_transaction(t); + } +} + +/** * binder_validate_object() - checks for a valid metadata object in a buffer. * @buffer: binder_buffer that we're parsing. * @offset: offset in the buffer at which to validate an object. @@@ -4048,20 -4015,12 +4048,20 @@@ retry if (put_user(cmd, (uint32_t __user *)ptr)) { if (t_from) binder_thread_dec_tmpref(t_from); + + binder_cleanup_transaction(t, "put_user failed", + BR_FAILED_REPLY); + return -EFAULT; } ptr += sizeof(uint32_t); if (copy_to_user(ptr, &tr, sizeof(tr))) { if (t_from) binder_thread_dec_tmpref(t_from); + + binder_cleanup_transaction(t, "copy_to_user failed", + BR_FAILED_REPLY); + return -EFAULT; } ptr += sizeof(tr); @@@ -4131,9 -4090,15 +4131,9 @@@ static void binder_release_work(struct struct binder_transaction *t;

t = container_of(w, struct binder_transaction, work); - if (t->buffer->target_node && - !(t->flags & TF_ONE_WAY)) { - binder_send_failed_reply(t, BR_DEAD_REPLY); - } else { - binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, - "undelivered transaction %d\n", - t->debug_id); - binder_free_transaction(t); - } + + binder_cleanup_transaction(t, "process died.", + BR_DEAD_REPLY); } break; case BINDER_WORK_RETURN_ERROR: { struct binder_error *e = container_of( @@@ -4311,7 -4276,7 +4311,7 @@@ static int binder_thread_release(struc return active_transactions; }

- static unsigned int binder_poll(struct file *filp, + static __poll_t binder_poll(struct file *filp, struct poll_table_struct *wait) { struct binder_proc *proc = filp->private_data; @@@ -4640,9 -4605,7 +4640,9 @@@ static int binder_mmap(struct file *fil ret = binder_alloc_mmap_handler(&proc->alloc, vma); if (ret) return ret; + mutex_lock(&proc->files_lock); proc->files = get_files_struct(current); + mutex_unlock(&proc->files_lock); return 0;

err_bad_arg: @@@ -4666,7 -4629,6 +4666,7 @@@ static int binder_open(struct inode *no spin_lock_init(&proc->outer_lock); get_task_struct(current->group_leader); proc->tsk = current->group_leader; + mutex_init(&proc->files_lock); INIT_LIST_HEAD(&proc->todo); proc->default_priority = task_nice(current); binder_dev = container_of(filp->private_data, struct binder_device, @@@ -4919,11 -4881,9 +4919,11 @@@ static void binder_deferred_func(struc

files = NULL; if (defer & BINDER_DEFERRED_PUT_FILES) { + mutex_lock(&proc->files_lock); files = proc->files; if (files) proc->files = NULL; + mutex_unlock(&proc->files_lock); }

if (defer & BINDER_DEFERRED_FLUSH) diff --combined drivers/md/md.c index 4e4dee0ec2de,e638d7199bd4..cb1476214f3f --- a/drivers/md/md.c +++ b/drivers/md/md.c @@@ -7605,9 -7605,7 +7605,9 @@@ static int status_resync(struct seq_fil if (test_bit(MD_RECOVERY_DONE, &mddev->recovery)) /* Still cleaning up */ resync = max_sectors; - } else + } else if (resync > max_sectors) + resync = max_sectors; + else resync -= atomic_read(&mddev->recovery_active);

if (resync == 0) { @@@ -7871,10 -7869,10 +7871,10 @@@ static int md_seq_open(struct inode *in }

static int md_unloading; - static unsigned int mdstat_poll(struct file *filp, poll_table *wait) + static __poll_t mdstat_poll(struct file *filp, poll_table *wait) { struct seq_file *seq = filp->private_data; - int mask; + __poll_t mask;

if (md_unloading) return POLLIN|POLLRDNORM|POLLERR|POLLPRI; diff --combined drivers/media/dvb-core/dvb_ca_en50221.c index d48b61eb01f4,dbb527a2befc..3f6c8bd8f869 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@@ -206,7 -206,7 +206,7 @@@ static int dvb_ca_en50221_write_data(st * @hlen: Number of bytes in haystack. * @needle: Buffer to find. * @nlen: Number of bytes in needle. - * @return Pointer into haystack needle was found at, or NULL if not found. + * return: Pointer into haystack needle was found at, or NULL if not found. */ static char *findstr(char *haystack, int hlen, char *needle, int nlen) { @@@ -226,7 -226,7 +226,7 @@@ /* ************************************************************************** */ /* EN50221 physical interface functions */

-/** +/* * dvb_ca_en50221_check_camstatus - Check CAM status. */ static int dvb_ca_en50221_check_camstatus(struct dvb_ca_private *ca, int slot) @@@ -275,9 -275,9 +275,9 @@@ * @ca: CA instance. * @slot: Slot on interface. * @waitfor: Flags to wait for. - * @timeout_ms: Timeout in milliseconds. + * @timeout_hz: Timeout in milliseconds. * - * @return 0 on success, nonzero on error. + * return: 0 on success, nonzero on error. */ static int dvb_ca_en50221_wait_if_status(struct dvb_ca_private *ca, int slot, u8 waitfor, int timeout_hz) @@@ -325,7 -325,7 +325,7 @@@ * @ca: CA instance. * @slot: Slot id. * - * @return 0 on success, nonzero on failure. + * return: 0 on success, nonzero on failure. */ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot) { @@@ -397,11 -397,11 +397,11 @@@ * @ca: CA instance. * @slot: Slot id. * @address: Address to read from. Updated. - * @tupleType: Tuple id byte. Updated. - * @tupleLength: Tuple length. Updated. + * @tuple_type: Tuple id byte. Updated. + * @tuple_length: Tuple length. Updated. * @tuple: Dest buffer for tuple (must be 256 bytes). Updated. * - * @return 0 on success, nonzero on error. + * return: 0 on success, nonzero on error. */ static int dvb_ca_en50221_read_tuple(struct dvb_ca_private *ca, int slot, int *address, int *tuple_type, @@@ -455,7 -455,7 +455,7 @@@ * @ca: CA instance. * @slot: Slot id. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_parse_attributes(struct dvb_ca_private *ca, int slot) { @@@ -632,11 -632,10 +632,11 @@@ static int dvb_ca_en50221_set_configopt * @ca: CA instance. * @slot: Slot to read from. * @ebuf: If non-NULL, the data will be written to this buffer. If NULL, - * the data will be added into the buffering system as a normal fragment. + * the data will be added into the buffering system as a normal + * fragment. * @ecount: Size of ebuf. Ignored if ebuf is NULL. * - * @return Number of bytes read, or < 0 on error + * return: Number of bytes read, or < 0 on error */ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 *ebuf, int ecount) @@@ -785,11 -784,11 +785,11 @@@ exit * * @ca: CA instance. * @slot: Slot to write to. - * @ebuf: The data in this buffer is treated as a complete link-level packet to - * be written. - * @count: Size of ebuf. + * @buf: The data in this buffer is treated as a complete link-level packet to + * be written. + * @bytes_write: Size of ebuf. * - * @return Number of bytes written, or < 0 on error. + * return: Number of bytes written, or < 0 on error. */ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 *buf, int bytes_write) @@@ -934,7 -933,7 +934,7 @@@ static int dvb_ca_en50221_slot_shutdown /** * dvb_ca_en50221_camchange_irq - A CAMCHANGE IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. * @change_type: One of the DVB_CA_CAMCHANGE_* values. */ @@@ -964,7 -963,7 +964,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_camchange_ /** * dvb_ca_en50221_camready_irq - A CAMREADY IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. */ void dvb_ca_en50221_camready_irq(struct dvb_ca_en50221 *pubca, int slot) @@@ -984,7 -983,7 +984,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_camready_i /** * dvb_ca_en50221_frda_irq - An FR or DA IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. */ void dvb_ca_en50221_frda_irq(struct dvb_ca_en50221 *pubca, int slot) @@@ -1092,7 -1091,7 +1092,7 @@@ static void dvb_ca_en50221_thread_updat * * @ca: CA instance. * @slot: Slot to process. - * @return: 0 .. no change + * return:: 0 .. no change * 1 .. CAM state changed */

@@@ -1297,7 -1296,7 +1297,7 @@@ static void dvb_ca_en50221_thread_state mutex_unlock(&sl->slot_lock); }

-/** +/* * Kernel thread which monitors CA slots for CAM changes, and performs data * transfers. */ @@@ -1337,11 -1336,12 +1337,11 @@@ static int dvb_ca_en50221_thread(void * * Real ioctl implementation. * NOTE: CA_SEND_MSG/CA_GET_MSG ioctls have userspace buffers passed to them. * - * @inode: Inode concerned. * @file: File concerned. * @cmd: IOCTL command. - * @arg: Associated argument. + * @parg: Associated argument. * - * @return 0 on success, <0 on error. + * return: 0 on success, <0 on error. */ static int dvb_ca_en50221_io_do_ioctl(struct file *file, unsigned int cmd, void *parg) @@@ -1420,11 -1420,12 +1420,11 @@@ out_unlock /** * Wrapper for ioctl implementation. * - * @inode: Inode concerned. * @file: File concerned. * @cmd: IOCTL command. * @arg: Associated argument. * - * @return 0 on success, <0 on error. + * return: 0 on success, <0 on error. */ static long dvb_ca_en50221_io_ioctl(struct file *file, unsigned int cmd, unsigned long arg) @@@ -1440,7 -1441,7 +1440,7 @@@ * @count: Size of source buffer. * @ppos: Position in file (ignored). * - * @return Number of bytes read, or <0 on error. + * return: Number of bytes read, or <0 on error. */ static ssize_t dvb_ca_en50221_io_write(struct file *file, const char __user *buf, size_t count, @@@ -1535,7 -1536,7 +1535,7 @@@ exit return status; }

-/** +/* * Condition for waking up in dvb_ca_en50221_io_read_condition */ static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private *ca, @@@ -1592,7 -1593,7 +1592,7 @@@ nextslot * @count: Size of destination buffer. * @ppos: Position in file (ignored). * - * @return Number of bytes read, or <0 on error. + * return: Number of bytes read, or <0 on error. */ static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) @@@ -1701,7 -1702,7 +1701,7 @@@ exit * @inode: Inode concerned. * @file: File concerned. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) { @@@ -1751,7 -1752,7 +1751,7 @@@ * @inode: Inode concerned. * @file: File concerned. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) { @@@ -1780,13 -1781,13 +1780,13 @@@ * @file: File concerned. * @wait: poll wait table. * - * @return Standard poll mask. + * return: Standard poll mask. */ - static unsigned int dvb_ca_en50221_io_poll(struct file *file, poll_table *wait) + static __poll_t dvb_ca_en50221_io_poll(struct file *file, poll_table *wait) { struct dvb_device *dvbdev = file->private_data; struct dvb_ca_private *ca = dvbdev->priv; - unsigned int mask = 0; + __poll_t mask = 0; int slot; int result = 0;

@@@ -1837,11 -1838,11 +1837,11 @@@ static const struct dvb_device dvbdev_c * Initialise a new DVB CA EN50221 interface device. * * @dvb_adapter: DVB adapter to attach the new CA device to. - * @ca: The dvb_ca instance. + * @pubca: The dvb_ca instance. * @flags: Flags describing the CA device (DVB_CA_FLAG_*). * @slot_count: Number of slots supported. * - * @return 0 on success, nonzero on failure + * return: 0 on success, nonzero on failure */ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, struct dvb_ca_en50221 *pubca, int flags, int slot_count) @@@ -1928,7 -1929,8 +1928,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_init) /** * Release a DVB CA EN50221 interface device. * - * @ca_dev: The dvb_device_t instance for the CA device. - * @ca: The associated dvb_ca instance. + * @pubca: The associated dvb_ca instance. */ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) { diff --combined drivers/media/dvb-core/dvb_frontend.c index 2afaa8226342,92e2433415f0..48e16fd003a7 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@@ -369,14 -369,11 +369,14 @@@ static void dvb_frontend_swzigzag_updat }

/** - * Performs automatic twiddling of frontend parameters. + * dvb_frontend_swzigzag_autotune - Performs automatic twiddling of frontend + * parameters. * - * @param fe The frontend concerned. - * @param check_wrapped Checks if an iteration has completed. DO NOT SET ON THE FIRST ATTEMPT - * @returns Number of complete iterations that have been performed. + * @fe: The frontend concerned. + * @check_wrapped: Checks if an iteration has completed. + * DO NOT SET ON THE FIRST ATTEMPT. + * + * return: Number of complete iterations that have been performed. */ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wrapped) { @@@ -1256,7 -1253,7 +1256,7 @@@ dtv_property_legacy_params_sync(struct * dtv_get_frontend - calls a callback for retrieving DTV parameters * @fe: struct dvb_frontend pointer * @c: struct dtv_frontend_properties pointer (DVBv5 cache) - * @p_out struct dvb_frontend_parameters pointer (DVBv3 FE struct) + * @p_out: struct dvb_frontend_parameters pointer (DVBv3 FE struct) * * This routine calls either the DVBv3 or DVBv5 get_frontend call. * If c is not null, it will update the DVBv5 cache struct pointed by it. @@@ -2470,7 -2467,7 +2470,7 @@@ static int dvb_frontend_handle_ioctl(st }

- static unsigned int dvb_frontend_poll(struct file *file, struct poll_table_struct *wait) + static __poll_t dvb_frontend_poll(struct file *file, struct poll_table_struct *wait) { struct dvb_device *dvbdev = file->private_data; struct dvb_frontend *fe = dvbdev->priv; diff --combined drivers/media/platform/sh_veu.c index dedc1b024f6f,15cf51f5d280..976ea0bb5b6c --- a/drivers/media/platform/sh_veu.c +++ b/drivers/media/platform/sh_veu.c @@@ -267,7 -267,7 +267,7 @@@ static void sh_veu_process(struct sh_ve sh_veu_reg_write(veu, VEU_EIER, 1); /* enable interrupt in VEU */ }

-/** +/* * sh_veu_device_run() - prepares and starts the device * * This will be called by the framework when it decides to schedule a particular @@@ -1016,7 -1016,7 +1016,7 @@@ static int sh_veu_release(struct file * return 0; }

- static unsigned int sh_veu_poll(struct file *file, + static __poll_t sh_veu_poll(struct file *file, struct poll_table_struct *wait) { struct sh_veu_file *veu_file = file->private_data; diff --combined drivers/media/radio/radio-si476x.c index 540ac887a63c,248bd0ffc978..49293dd707b9 --- a/drivers/media/radio/radio-si476x.c +++ b/drivers/media/radio/radio-si476x.c @@@ -158,7 -158,7 +158,7 @@@ enum si476x_ctrl_idx }; static struct v4l2_ctrl_config si476x_ctrls[] = {

- /** + /* * SI476X during its station seeking(or tuning) process uses several * parameters to detrmine if "the station" is valid: * @@@ -197,7 -197,7 +197,7 @@@ .step = 2, },

- /** + /* * #V4L2_CID_SI476X_HARMONICS_COUNT -- number of harmonics * built-in power-line noise supression filter is to reject * during AM-mode operation. @@@ -213,7 -213,7 +213,7 @@@ .step = 1, },

- /** + /* * #V4L2_CID_SI476X_DIVERSITY_MODE -- configuration which * two tuners working in diversity mode are to work in. * @@@ -237,7 -237,7 +237,7 @@@ .max = ARRAY_SIZE(phase_diversity_modes) - 1, },

- /** + /* * #V4L2_CID_SI476X_INTERCHIP_LINK -- inter-chip link in * diversity mode indicator. Allows user to determine if two * chips working in diversity mode have established a link @@@ -296,15 -296,11 +296,15 @@@ struct si476x_radio_ops /** * struct si476x_radio - radio device * - * @core: Pointer to underlying core device + * @v4l2dev: Pointer to V4L2 device created by V4L2 subsystem * @videodev: Pointer to video device created by V4L2 subsystem + * @ctrl_handler: V4L2 controls handler + * @core: Pointer to underlying core device * @ops: Vtable of functions. See struct si476x_radio_ops for details - * @kref: Reference counter - * @core_lock: An r/w semaphore to brebvent the deletion of underlying + * @debugfs: pointer to &strucd dentry for debugfs + * @audmode: audio mode, as defined for the rxsubchans field + * at videodev2.h + * * core structure is the radio device is being used */ struct si476x_radio { @@@ -1153,12 -1149,12 +1153,12 @@@ static ssize_t si476x_radio_fops_read(s return rval; }

- static unsigned int si476x_radio_fops_poll(struct file *file, + static __poll_t si476x_radio_fops_poll(struct file *file, struct poll_table_struct *pts) { struct si476x_radio *radio = video_drvdata(file); - unsigned long req_events = poll_requested_events(pts); - unsigned int err = v4l2_ctrl_poll(file, pts); + __poll_t req_events = poll_requested_events(pts); + __poll_t err = v4l2_ctrl_poll(file, pts);

if (req_events & (POLLIN | POLLRDNORM)) { if (atomic_read(&radio->core->is_alive)) diff --combined drivers/media/radio/radio-wl1273.c index 3cbdc085c65d,4cd4241fc7be..f92b0f9241a9 --- a/drivers/media/radio/radio-wl1273.c +++ b/drivers/media/radio/radio-wl1273.c @@@ -1089,7 -1089,7 +1089,7 @@@ out return r; }

- static unsigned int wl1273_fm_fops_poll(struct file *file, + static __poll_t wl1273_fm_fops_poll(struct file *file, struct poll_table_struct *pts) { struct wl1273_device *radio = video_get_drvdata(video_devdata(file)); @@@ -1330,7 -1330,7 +1330,7 @@@ static int wl1273_fm_vidioc_s_input(str

/** * wl1273_fm_set_tx_power() - Set the transmission power value. - * @core: A pointer to the device struct. + * @radio: A pointer to the device struct. * @power: The new power value. */ static int wl1273_fm_set_tx_power(struct wl1273_device *radio, u16 power) diff --combined drivers/media/v4l2-core/v4l2-mem2mem.c index bc580fbe18fa,a879d11866bd..186156f8952a --- a/drivers/media/v4l2-core/v4l2-mem2mem.c +++ b/drivers/media/v4l2-core/v4l2-mem2mem.c @@@ -183,7 -183,6 +183,7 @@@ EXPORT_SYMBOL(v4l2_m2m_get_curr_priv)

/** * v4l2_m2m_try_run() - select next job to perform and run it if possible + * @m2m_dev: per-device context * * Get next transaction (if present) from the waiting jobs list and run it. */ @@@ -282,7 -281,6 +282,7 @@@ EXPORT_SYMBOL_GPL(v4l2_m2m_try_schedule

/** * v4l2_m2m_cancel_job() - cancel pending jobs for the context + * @m2m_ctx: m2m context with jobs to be canceled * * In case of streamoff or release called on any context, * 1] If the context is currently running, then abort job will be called @@@ -500,14 -498,14 +500,14 @@@ int v4l2_m2m_streamoff(struct file *fil } EXPORT_SYMBOL_GPL(v4l2_m2m_streamoff);

- unsigned int v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, + __poll_t v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, struct poll_table_struct *wait) { struct video_device *vfd = video_devdata(file); - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct vb2_queue *src_q, *dst_q; struct vb2_buffer *src_vb = NULL, *dst_vb = NULL; - unsigned int rc = 0; + __poll_t rc = 0; unsigned long flags;

if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) { @@@ -794,11 -792,11 +794,11 @@@ int v4l2_m2m_fop_mmap(struct file *file } EXPORT_SYMBOL_GPL(v4l2_m2m_fop_mmap);

- unsigned int v4l2_m2m_fop_poll(struct file *file, poll_table *wait) + __poll_t v4l2_m2m_fop_poll(struct file *file, poll_table *wait) { struct v4l2_fh *fh = file->private_data; struct v4l2_m2m_ctx *m2m_ctx = fh->m2m_ctx; - unsigned int ret; + __poll_t ret;

if (m2m_ctx->q_lock) mutex_lock(m2m_ctx->q_lock); diff --combined drivers/media/v4l2-core/videobuf-core.c index e87fb13b22dc,0c5b12b8bb52..9a89d3ae170f --- a/drivers/media/v4l2-core/videobuf-core.c +++ b/drivers/media/v4l2-core/videobuf-core.c @@@ -222,7 -222,7 +222,7 @@@ int videobuf_queue_is_busy(struct video } EXPORT_SYMBOL_GPL(videobuf_queue_is_busy);

-/** +/* * __videobuf_free() - free all the buffers and their control structures * * This function can only be called if streaming/reading is off, i.e. no buffers @@@ -1118,13 -1118,13 +1118,13 @@@ done } EXPORT_SYMBOL_GPL(videobuf_read_stream);

- unsigned int videobuf_poll_stream(struct file *file, + __poll_t videobuf_poll_stream(struct file *file, struct videobuf_queue *q, poll_table *wait) { - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct videobuf_buffer *buf = NULL; - unsigned int rc = 0; + __poll_t rc = 0;

videobuf_queue_lock(q); if (q->streaming) { diff --combined drivers/media/v4l2-core/videobuf2-core.c index a8589d96ef72,dc1f683c3b71..0d9f772d6d03 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@@ -188,7 -188,7 +188,7 @@@ module_param(debug, int, 0644) static void __vb2_queue_cancel(struct vb2_queue *q); static void __enqueue_in_driver(struct vb2_buffer *vb);

-/** +/* * __vb2_buf_mem_alloc() - allocate video memory for the given buffer */ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb) @@@ -229,7 -229,7 +229,7 @@@ free return ret; }

-/** +/* * __vb2_buf_mem_free() - free memory of the given buffer */ static void __vb2_buf_mem_free(struct vb2_buffer *vb) @@@ -243,7 -243,7 +243,7 @@@ } }

-/** +/* * __vb2_buf_userptr_put() - release userspace memory associated with * a USERPTR buffer */ @@@ -258,7 -258,7 +258,7 @@@ static void __vb2_buf_userptr_put(struc } }

-/** +/* * __vb2_plane_dmabuf_put() - release memory associated with * a DMABUF shared plane */ @@@ -277,7 -277,7 +277,7 @@@ static void __vb2_plane_dmabuf_put(stru p->dbuf_mapped = 0; }

-/** +/* * __vb2_buf_dmabuf_put() - release memory associated with * a DMABUF shared buffer */ @@@ -289,7 -289,7 +289,7 @@@ static void __vb2_buf_dmabuf_put(struc __vb2_plane_dmabuf_put(vb, &vb->planes[plane]); }

-/** +/* * __setup_offsets() - setup unique offsets ("cookies") for every plane in * the buffer. */ @@@ -317,7 -317,7 +317,7 @@@ static void __setup_offsets(struct vb2_ } }

-/** +/* * __vb2_queue_alloc() - allocate videobuf buffer structures and (for MMAP type) * video buffer memory for all buffers/planes on the queue and initializes the * queue @@@ -386,7 -386,7 +386,7 @@@ static int __vb2_queue_alloc(struct vb2 return buffer; }

-/** +/* * __vb2_free_mem() - release all video buffer memory for a given queue */ static void __vb2_free_mem(struct vb2_queue *q, unsigned int buffers) @@@ -410,7 -410,7 +410,7 @@@ } }

-/** +/* * __vb2_queue_free() - free buffers at the end of the queue - video memory and * related information, if no buffers are left return the queue to an * uninitialized state. Might be called even if the queue has already been freed. @@@ -544,7 -544,7 +544,7 @@@ bool vb2_buffer_in_use(struct vb2_queu } EXPORT_SYMBOL(vb2_buffer_in_use);

-/** +/* * __buffers_in_use() - return true if any buffers on the queue are in use and * the queue cannot be freed (by the means of REQBUFS(0)) call */ @@@ -564,7 -564,7 +564,7 @@@ void vb2_core_querybuf(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_core_querybuf);

-/** +/* * __verify_userptr_ops() - verify that all memory operations required for * USERPTR queue type have been provided */ @@@ -577,7 -577,7 +577,7 @@@ static int __verify_userptr_ops(struct return 0; }

-/** +/* * __verify_mmap_ops() - verify that all memory operations required for * MMAP queue type have been provided */ @@@ -590,7 -590,7 +590,7 @@@ static int __verify_mmap_ops(struct vb2 return 0; }

-/** +/* * __verify_dmabuf_ops() - verify that all memory operations required for * DMABUF queue type have been provided */ @@@ -953,7 -953,7 +953,7 @@@ void vb2_discard_done(struct vb2_queue } EXPORT_SYMBOL_GPL(vb2_discard_done);

-/** +/* * __prepare_mmap() - prepare an MMAP buffer */ static int __prepare_mmap(struct vb2_buffer *vb, const void *pb) @@@ -966,7 -966,7 +966,7 @@@ return ret ? ret : call_vb_qop(vb, buf_prepare, vb); }

-/** +/* * __prepare_userptr() - prepare a USERPTR buffer */ static int __prepare_userptr(struct vb2_buffer *vb, const void *pb) @@@ -1082,7 -1082,7 +1082,7 @@@ err return ret; }

-/** +/* * __prepare_dmabuf() - prepare a DMABUF buffer */ static int __prepare_dmabuf(struct vb2_buffer *vb, const void *pb) @@@ -1215,7 -1215,7 +1215,7 @@@ err return ret; }

-/** +/* * __enqueue_in_driver() - enqueue a vb2_buffer in driver for processing */ static void __enqueue_in_driver(struct vb2_buffer *vb) @@@ -1298,7 -1298,7 +1298,7 @@@ int vb2_core_prepare_buf(struct vb2_que } EXPORT_SYMBOL_GPL(vb2_core_prepare_buf);

-/** +/* * vb2_start_streaming() - Attempt to start streaming. * @q: videobuf2 queue * @@@ -1427,7 -1427,7 +1427,7 @@@ int vb2_core_qbuf(struct vb2_queue *q, } EXPORT_SYMBOL_GPL(vb2_core_qbuf);

-/** +/* * __vb2_wait_for_done_vb() - wait for a buffer to become available * for dequeuing * @@@ -1502,7 -1502,7 +1502,7 @@@ static int __vb2_wait_for_done_vb(struc return 0; }

-/** +/* * __vb2_get_done_vb() - get a buffer ready for dequeuing * * Will sleep if required for nonblocking == false. @@@ -1553,7 -1553,7 +1553,7 @@@ int vb2_wait_for_all_buffers(struct vb2 } EXPORT_SYMBOL_GPL(vb2_wait_for_all_buffers);

-/** +/* * __vb2_dqbuf() - bring back the buffer to the DEQUEUED state */ static void __vb2_dqbuf(struct vb2_buffer *vb) @@@ -1625,7 -1625,7 +1625,7 @@@ int vb2_core_dqbuf(struct vb2_queue *q } EXPORT_SYMBOL_GPL(vb2_core_dqbuf);

-/** +/* * __vb2_queue_cancel() - cancel and stop (pause) streaming * * Removes all queued buffers from driver's queue and all buffers queued by @@@ -1773,7 -1773,7 +1773,7 @@@ int vb2_core_streamoff(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_core_streamoff);

-/** +/* * __find_plane_by_offset() - find plane associated with the given offset off */ static int __find_plane_by_offset(struct vb2_queue *q, unsigned long off, @@@ -2018,10 -2018,10 +2018,10 @@@ void vb2_core_queue_release(struct vb2_ } EXPORT_SYMBOL_GPL(vb2_core_queue_release);

- unsigned int vb2_core_poll(struct vb2_queue *q, struct file *file, + __poll_t vb2_core_poll(struct vb2_queue *q, struct file *file, poll_table *wait) { - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct vb2_buffer *vb = NULL; unsigned long flags;

@@@ -2104,7 -2104,7 +2104,7 @@@ } EXPORT_SYMBOL_GPL(vb2_core_poll);

-/** +/* * struct vb2_fileio_buf - buffer context used by file io emulator * * vb2 provides a compatibility layer and emulator of file io (read and @@@ -2118,7 -2118,7 +2118,7 @@@ struct vb2_fileio_buf unsigned int queued:1; };

-/** +/* * struct vb2_fileio_data - queue context used by file io emulator * * @cur_index: the index of the buffer currently being read from or @@@ -2155,7 -2155,7 +2155,7 @@@ struct vb2_fileio_data unsigned write_immediately:1; };

-/** +/* * __vb2_init_fileio() - initialize file io emulator * @q: videobuf2 queue * @read: mode selector (1 means read, 0 means write) @@@ -2274,7 -2274,7 +2274,7 @@@ err_kfree return ret; }

-/** +/* * __vb2_cleanup_fileio() - free resourced used by file io emulator * @q: videobuf2 queue */ @@@ -2293,7 -2293,7 +2293,7 @@@ static int __vb2_cleanup_fileio(struct return 0; }

-/** +/* * __vb2_perform_fileio() - perform a single file io (read or write) operation * @q: videobuf2 queue * @data: pointed to target userspace buffer diff --combined drivers/media/v4l2-core/videobuf2-v4l2.c index 4075314a6989,d2b3a74d14fd..a49f7eb98c2e --- a/drivers/media/v4l2-core/videobuf2-v4l2.c +++ b/drivers/media/v4l2-core/videobuf2-v4l2.c @@@ -49,7 -49,7 +49,7 @@@ module_param(debug, int, 0644) #define V4L2_BUFFER_OUT_FLAGS (V4L2_BUF_FLAG_PFRAME | V4L2_BUF_FLAG_BFRAME | \ V4L2_BUF_FLAG_KEYFRAME | V4L2_BUF_FLAG_TIMECODE)

-/** +/* * __verify_planes_array() - verify that the planes array passed in struct * v4l2_buffer from userspace can be safely used */ @@@ -78,7 -78,7 +78,7 @@@ static int __verify_planes_array_core(s return __verify_planes_array(vb, pb); }

-/** +/* * __verify_length() - Verify that the bytesused value for each plane fits in * the plane length and that the data offset doesn't exceed the bytesused value. */ @@@ -181,7 -181,7 +181,7 @@@ static int vb2_queue_or_prepare_buf(str return __verify_planes_array(q->bufs[b->index], b); }

-/** +/* * __fill_v4l2_buffer() - fill in a struct v4l2_buffer with information to be * returned to userspace */ @@@ -286,7 -286,7 +286,7 @@@ static void __fill_v4l2_buffer(struct v q->last_buffer_dequeued = true; }

-/** +/* * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a * v4l2_buffer by the userspace. It also verifies that struct * v4l2_buffer has a valid number of planes. @@@ -446,7 -446,7 +446,7 @@@ static const struct vb2_buf_ops v4l2_bu .copy_timestamp = __copy_timestamp, };

-/** +/* * vb2_querybuf() - query video buffer information * @q: videobuf queue * @b: buffer struct passed from userspace to vidioc_querybuf handler @@@ -671,11 -671,11 +671,11 @@@ void vb2_queue_release(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_queue_release);

- unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait) + __poll_t vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait) { struct video_device *vfd = video_devdata(file); - unsigned long req_events = poll_requested_events(wait); - unsigned int res = 0; + __poll_t req_events = poll_requested_events(wait); + __poll_t res = 0;

if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) { struct v4l2_fh *fh = file->private_data; @@@ -904,12 -904,12 +904,12 @@@ exit } EXPORT_SYMBOL_GPL(vb2_fop_read);

- unsigned int vb2_fop_poll(struct file *file, poll_table *wait) + __poll_t vb2_fop_poll(struct file *file, poll_table *wait) { struct video_device *vdev = video_devdata(file); struct vb2_queue *q = vdev->queue; struct mutex *lock = q->lock ? q->lock : vdev->lock; - unsigned res; + __poll_t res; void *fileio;

/* diff --combined drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index d7250539d0bd,0a7ae94b5e00..0616aa01e497 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@@ -2533,7 -2533,7 +2533,7 @@@ static int stmmac_hw_setup(struct net_d }

if (priv->hw->pcs && priv->hw->mac->pcs_ctrl_ane) - priv->hw->mac->pcs_ctrl_ane(priv->hw, 1, priv->hw->ps, 0); + priv->hw->mac->pcs_ctrl_ane(priv->ioaddr, 1, priv->hw->ps, 0);

/* set TX and RX rings length */ stmmac_set_rings_length(priv); @@@ -2588,7 -2588,6 +2588,7 @@@ static int stmmac_open(struct net_devic

priv->dma_buf_sz = STMMAC_ALIGN(buf_sz); priv->rx_copybreak = STMMAC_RX_COPYBREAK; + priv->mss = 0;

ret = alloc_dma_desc_resources(priv); if (ret < 0) { diff --combined drivers/net/ethernet/via/via-rhine.c index 33949248c829,4a70091c16b7..f1fde0b7cda3 --- a/drivers/net/ethernet/via/via-rhine.c +++ b/drivers/net/ethernet/via/via-rhine.c @@@ -995,7 -995,7 +995,7 @@@ static int rhine_init_one_common(struc else name = "Rhine III";

- netdev_info(dev, "VIA %s at 0x%p, %pM, IRQ %d\n", + netdev_info(dev, "VIA %s at %p, %pM, IRQ %d\n", name, ioaddr, dev->dev_addr, rp->irq);

dev_set_drvdata(hwdev, dev); @@@ -1150,7 -1150,7 +1150,7 @@@ static int rhine_init_one_platform(stru return -EINVAL;

return rhine_init_one_common(&pdev->dev, *quirks, - (long)ioaddr, ioaddr, irq); + (unsigned long)ioaddr, ioaddr, irq); }

static int alloc_ring(struct net_device* dev) diff --combined drivers/net/tap.c index 0a886fda0129,c4e91c73568e..f39c6f876e67 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@@ -572,10 -572,10 +572,10 @@@ static int tap_release(struct inode *in return 0; }

- static unsigned int tap_poll(struct file *file, poll_table *wait) + static __poll_t tap_poll(struct file *file, poll_table *wait) { struct tap_queue *q = file->private_data; - unsigned int mask = POLLERR; + __poll_t mask = POLLERR;

if (!q) goto out; @@@ -829,11 -829,8 +829,11 @@@ static ssize_t tap_do_read(struct tap_q DEFINE_WAIT(wait); ssize_t ret = 0;

- if (!iov_iter_count(to)) + if (!iov_iter_count(to)) { + if (skb) + kfree_skb(skb); return 0; + }

if (skb) goto put; @@@ -1157,14 -1154,11 +1157,14 @@@ static int tap_recvmsg(struct socket *s size_t total_len, int flags) { struct tap_queue *q = container_of(sock, struct tap_queue, sock); + struct sk_buff *skb = m->msg_control; int ret; - if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) + if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) { + if (skb) + kfree_skb(skb); return -EINVAL; - ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, - m->msg_control); + } + ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, skb); if (ret > total_len) { m->msg_flags |= MSG_TRUNC; ret = flags & MSG_TRUNC ? ret : total_len; diff --combined drivers/net/tun.c index 4f4a842a1c9c,130b049ac3da..2ffe5dba7e09 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@@ -1248,12 -1248,12 +1248,12 @@@ static void tun_net_init(struct net_dev /* Character device part */

/* Poll */ - static unsigned int tun_chr_poll(struct file *file, poll_table *wait) + static __poll_t tun_chr_poll(struct file *file, poll_table *wait) { struct tun_file *tfile = file->private_data; struct tun_struct *tun = tun_get(tfile); struct sock *sk; - unsigned int mask = 0; + __poll_t mask = 0;

if (!tun) return POLLERR; @@@ -1952,11 -1952,8 +1952,11 @@@ static ssize_t tun_do_read(struct tun_s

tun_debug(KERN_INFO, tun, "tun_do_read\n");

- if (!iov_iter_count(to)) + if (!iov_iter_count(to)) { + if (skb) + kfree_skb(skb); return 0; + }

if (!skb) { /* Read frames from ring */ @@@ -2072,24 -2069,22 +2072,24 @@@ static int tun_recvmsg(struct socket *s { struct tun_file *tfile = container_of(sock, struct tun_file, socket); struct tun_struct *tun = tun_get(tfile); + struct sk_buff *skb = m->msg_control; int ret;

- if (!tun) - return -EBADFD; + if (!tun) { + ret = -EBADFD; + goto out_free_skb; + }

if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) { ret = -EINVAL; - goto out; + goto out_put_tun; } if (flags & MSG_ERRQUEUE) { ret = sock_recv_errqueue(sock->sk, m, total_len, SOL_PACKET, TUN_TX_TIMESTAMP); goto out; } - ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, - m->msg_control); + ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, skb); if (ret > (ssize_t)total_len) { m->msg_flags |= MSG_TRUNC; ret = flags & MSG_TRUNC ? ret : total_len; @@@ -2097,13 -2092,6 +2097,13 @@@ out: tun_put(tun); return ret; + +out_put_tun: + tun_put(tun); +out_free_skb: + if (skb) + kfree_skb(skb); + return ret; }

static int tun_peek_len(struct socket *sock) diff --combined drivers/s390/char/monreader.c index bf4ab4efed73,de7b169004a2..956f662908a6 --- a/drivers/s390/char/monreader.c +++ b/drivers/s390/char/monreader.c @@@ -1,4 -1,3 +1,4 @@@ +// SPDX-License-Identifier: GPL-2.0 /* * Character device driver for reading z/VM *MONITOR service records. * @@@ -429,7 -428,7 +429,7 @@@ out_copy return count; }

- static unsigned int mon_poll(struct file *filp, struct poll_table_struct *p) + static __poll_t mon_poll(struct file *filp, struct poll_table_struct *p) { struct mon_private *monpriv = filp->private_data;

diff --combined drivers/staging/lustre/lnet/lnet/lib-socket.c index 7d49d4865298,984d76843b19..ed46aaca0ba3 --- a/drivers/staging/lustre/lnet/lnet/lib-socket.c +++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c @@@ -71,12 -71,16 +71,12 @@@ lnet_sock_ioctl(int cmd, unsigned long }

sock_filp = sock_alloc_file(sock, 0, NULL); - if (IS_ERR(sock_filp)) { - sock_release(sock); - rc = PTR_ERR(sock_filp); - goto out; - } + if (IS_ERR(sock_filp)) + return PTR_ERR(sock_filp);

rc = kernel_sock_unlocked_ioctl(sock_filp, cmd, arg);

fput(sock_filp); -out: return rc; }

@@@ -314,19 -318,20 +314,20 @@@ lnet_sock_read(struct socket *sock, voi long jiffies_left = timeout * msecs_to_jiffies(MSEC_PER_SEC); unsigned long then; struct timeval tv; + struct kvec iov = { + .iov_base = buffer, + .iov_len = nob + }; + struct msghdr msg = { + .msg_flags = 0 + };

LASSERT(nob > 0); LASSERT(jiffies_left > 0);

- for (;;) { - struct kvec iov = { - .iov_base = buffer, - .iov_len = nob - }; - struct msghdr msg = { - .msg_flags = 0 - }; + iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, nob);

+ for (;;) { /* Set receive timeout to remaining time */ jiffies_to_timeval(jiffies_left, &tv); rc = kernel_setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, @@@ -338,7 -343,7 +339,7 @@@ }

then = jiffies; - rc = kernel_recvmsg(sock, &msg, &iov, 1, nob, 0); + rc = sock_recvmsg(sock, &msg, 0); jiffies_left -= jiffies - then;

if (rc < 0) @@@ -347,10 -352,7 +348,7 @@@ if (!rc) return -ECONNRESET;

- buffer = ((char *)buffer) + rc; - nob -= rc; - - if (!nob) + if (!msg_data_left(&msg)) return 0;

if (jiffies_left <= 0) diff --combined drivers/usb/core/devio.c index a3fad4ec9870,929a7380be66..31404fc93d99 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@@ -1442,18 -1442,14 +1442,18 @@@ static int proc_do_submiturb(struct usb int number_of_packets = 0; unsigned int stream_id = 0; void *buf; - - if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP | - USBDEVFS_URB_SHORT_NOT_OK | + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | USBDEVFS_URB_BULK_CONTINUATION | USBDEVFS_URB_NO_FSBR | USBDEVFS_URB_ZERO_PACKET | - USBDEVFS_URB_NO_INTERRUPT)) - return -EINVAL; + USBDEVFS_URB_NO_INTERRUPT; + /* USBDEVFS_URB_ISO_ASAP is a special case */ + if (uurb->type == USBDEVFS_URB_TYPE_ISO) + mask |= USBDEVFS_URB_ISO_ASAP; + + if (uurb->flags & ~mask) + return -EINVAL; + if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX) return -EINVAL; if (uurb->buffer_length > 0 && !uurb->buffer) @@@ -2572,11 -2568,11 +2572,11 @@@ static long usbdev_compat_ioctl(struct #endif

/* No kernel lock - fine */ - static unsigned int usbdev_poll(struct file *file, + static __poll_t usbdev_poll(struct file *file, struct poll_table_struct *wait) { struct usb_dev_state *ps = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &ps->wait, wait); if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed)) diff --combined drivers/usb/gadget/function/f_fs.c index b6cf5ab5a0a1,17efadd6b395..b540935891af --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@@ -638,10 -638,10 +638,10 @@@ static long ffs_ep0_ioctl(struct file * return ret; }

- static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait) + static __poll_t ffs_ep0_poll(struct file *file, poll_table *wait) { struct ffs_data *ffs = file->private_data; - unsigned int mask = POLLWRNORM; + __poll_t mask = POLLWRNORM; int ret;

poll_wait(file, &ffs->ev.waitq, wait); @@@ -1012,7 -1012,7 +1012,7 @@@ static ssize_t ffs_epfile_io(struct fil else ret = ep->status; goto error_mutex; - } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) { + } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) { ret = -ENOMEM; } else { req->buf = data; @@@ -2282,18 -2282,9 +2282,18 @@@ static int __ffs_data_do_os_desc(enum f int i;

if (len < sizeof(*d) || - d->bFirstInterfaceNumber >= ffs->interfaces_count || - !d->Reserved1) + d->bFirstInterfaceNumber >= ffs->interfaces_count) return -EINVAL; + if (d->Reserved1 != 1) { + /* + * According to the spec, Reserved1 must be set to 1 + * but older kernels incorrectly rejected non-zero + * values. We fix it here to avoid returning EINVAL + * in response to values we used to accept. + */ + pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n"); + d->Reserved1 = 1; + } for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) if (d->Reserved2[i]) return -EINVAL; diff --combined drivers/vhost/net.c index c7bdeb655646,0ed445a17c54..9524ee16878a --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@@ -778,6 -778,16 +778,6 @@@ static void handle_rx(struct vhost_net /* On error, stop handling until the next kick. */ if (unlikely(headcount < 0)) goto out; - if (nvq->rx_array) - msg.msg_control = vhost_net_buf_consume(&nvq->rxq); - /* On overrun, truncate and discard */ - if (unlikely(headcount > UIO_MAXIOV)) { - iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1); - err = sock->ops->recvmsg(sock, &msg, - 1, MSG_DONTWAIT | MSG_TRUNC); - pr_debug("Discarded rx packet: len %zd\n", sock_len); - continue; - } /* OK, now we need to know about added descriptors. */ if (!headcount) { if (unlikely(vhost_enable_notify(&net->dev, vq))) { @@@ -790,16 -800,6 +790,16 @@@ * they refilled. */ goto out; } + if (nvq->rx_array) + msg.msg_control = vhost_net_buf_consume(&nvq->rxq); + /* On overrun, truncate and discard */ + if (unlikely(headcount > UIO_MAXIOV)) { + iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1); + err = sock->ops->recvmsg(sock, &msg, + 1, MSG_DONTWAIT | MSG_TRUNC); + pr_debug("Discarded rx packet: len %zd\n", sock_len); + continue; + } /* We don't need to be notified again. */ iov_iter_init(&msg.msg_iter, READ, vq->iov, in, vhost_len); fixup = msg.msg_iter; @@@ -1353,7 -1353,7 +1353,7 @@@ static ssize_t vhost_net_chr_write_iter return vhost_chr_write_iter(dev, from); }

- static unsigned int vhost_net_chr_poll(struct file *file, poll_table *wait) + static __poll_t vhost_net_chr_poll(struct file *file, poll_table *wait) { struct vhost_net *n = file->private_data; struct vhost_dev *dev = &n->dev; diff --combined drivers/xen/pvcalls-front.c index d1e1d8d2b9d5,74c854955a6b..59fdd347561c --- a/drivers/xen/pvcalls-front.c +++ b/drivers/xen/pvcalls-front.c @@@ -878,7 -878,7 +878,7 @@@ received return ret; }

- static unsigned int pvcalls_front_poll_passive(struct file *file, + static __poll_t pvcalls_front_poll_passive(struct file *file, struct pvcalls_bedata *bedata, struct sock_mapping *map, poll_table *wait) @@@ -935,12 -935,12 +935,12 @@@ return 0; }

- static unsigned int pvcalls_front_poll_active(struct file *file, + static __poll_t pvcalls_front_poll_active(struct file *file, struct pvcalls_bedata *bedata, struct sock_mapping *map, poll_table *wait) { - unsigned int mask = 0; + __poll_t mask = 0; int32_t in_error, out_error; struct pvcalls_data_intf *intf = map->active.ring;

@@@ -958,12 -958,12 +958,12 @@@ return mask; }

- unsigned int pvcalls_front_poll(struct file *file, struct socket *sock, + __poll_t pvcalls_front_poll(struct file *file, struct socket *sock, poll_table *wait) { struct pvcalls_bedata *bedata; struct sock_mapping *map; - int ret; + __poll_t ret;

pvcalls_enter(); if (!pvcalls_front_dev) { @@@ -1103,7 -1103,7 +1103,7 @@@ static int pvcalls_front_remove(struct kfree(map); } } - if (bedata->ref >= 0) + if (bedata->ref != -1) gnttab_end_foreign_access(bedata->ref, 0, 0); kfree(bedata->ring.sring); kfree(bedata); @@@ -1128,8 -1128,6 +1128,8 @@@ static int pvcalls_front_probe(struct x }

versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len); + if (IS_ERR(versions)) + return PTR_ERR(versions); if (!len) return -EINVAL; if (strcmp(versions, "1")) { diff --combined fs/namei.c index 9cc91fb7f156,bc8f76fb5513..1c0fb97c9425 --- a/fs/namei.c +++ b/fs/namei.c @@@ -1129,9 -1129,18 +1129,9 @@@ static int follow_automount(struct pat * of the daemon to instantiate them before they can be used. */ if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | - LOOKUP_OPEN | LOOKUP_CREATE | - LOOKUP_AUTOMOUNT))) { - /* Positive dentry that isn't meant to trigger an - * automount, EISDIR will allow it to be used, - * otherwise there's no mount here "now" so return - * ENOENT. - */ - if (path->dentry->d_inode) - return -EISDIR; - else - return -ENOENT; - } + LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && + path->dentry->d_inode) + return -EISDIR;

if (path->dentry->d_sb->s_user_ns != &init_user_ns) return -EACCES; @@@ -2898,6 -2907,27 +2898,27 @@@ int vfs_create(struct inode *dir, struc } EXPORT_SYMBOL(vfs_create);

+ int vfs_mkobj(struct dentry *dentry, umode_t mode, + int (*f)(struct dentry *, umode_t, void *), + void *arg) + { + struct inode *dir = dentry->d_parent->d_inode; + int error = may_create(dir, dentry); + if (error) + return error; + + mode &= S_IALLUGO; + mode |= S_IFREG; + error = security_inode_create(dir, dentry, mode); + if (error) + return error; + error = f(dentry, mode, arg); + if (!error) + fsnotify_create(dir, dentry); + return error; + } + EXPORT_SYMBOL(vfs_mkobj); + bool may_open_dev(const struct path *path) { return !(path->mnt->mnt_flags & MNT_NODEV) && diff --combined fs/proc/inode.c index dd0f82622427,5e6f160d96a2..8dacaabb9f37 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@@ -234,11 -234,11 +234,11 @@@ static ssize_t proc_reg_write(struct fi return rv; }

- static unsigned int proc_reg_poll(struct file *file, struct poll_table_struct *pts) + static __poll_t proc_reg_poll(struct file *file, struct poll_table_struct *pts) { struct proc_dir_entry *pde = PDE(file_inode(file)); - unsigned int rv = DEFAULT_POLLMASK; - unsigned int (*poll)(struct file *, struct poll_table_struct *); + __poll_t rv = DEFAULT_POLLMASK; + __poll_t (*poll)(struct file *, struct poll_table_struct *); if (use_pde(pde)) { poll = pde->proc_fops->poll; if (poll) @@@ -483,7 -483,7 +483,7 @@@ int proc_fill_super(struct super_block

/* User space would break if executables or devices appear on proc */ s->s_iflags |= SB_I_USERNS_VISIBLE | SB_I_NOEXEC | SB_I_NODEV; - s->s_flags |= MS_NODIRATIME | MS_NOSUID | MS_NOEXEC; + s->s_flags |= SB_NODIRATIME | SB_NOSUID | SB_NOEXEC; s->s_blocksize = 1024; s->s_blocksize_bits = 10; s->s_magic = PROC_SUPER_MAGIC; diff --combined fs/proc_namespace.c index b786840facd9,7a3d0ff9b7a8..c8528d587e09 --- a/fs/proc_namespace.c +++ b/fs/proc_namespace.c @@@ -18,12 -18,12 +18,12 @@@ #include "pnode.h" #include "internal.h"

- static unsigned mounts_poll(struct file *file, poll_table *wait) + static __poll_t mounts_poll(struct file *file, poll_table *wait) { struct seq_file *m = file->private_data; struct proc_mounts *p = m->private; struct mnt_namespace *ns = p->ns; - unsigned res = POLLIN | POLLRDNORM; + __poll_t res = POLLIN | POLLRDNORM; int event;

poll_wait(file, &p->ns->poll, wait); @@@ -45,10 -45,10 +45,10 @@@ struct proc_fs_info static int show_sb_opts(struct seq_file *m, struct super_block *sb) { static const struct proc_fs_info fs_info[] = { - { MS_SYNCHRONOUS, ",sync" }, - { MS_DIRSYNC, ",dirsync" }, - { MS_MANDLOCK, ",mand" }, - { MS_LAZYTIME, ",lazytime" }, + { SB_SYNCHRONOUS, ",sync" }, + { SB_DIRSYNC, ",dirsync" }, + { SB_MANDLOCK, ",mand" }, + { SB_LAZYTIME, ",lazytime" }, { 0, NULL } }; const struct proc_fs_info *fs_infop; diff --combined include/crypto/if_alg.h index 38d9c5861ed8,c670b30e405a..a50bdb9d7cfd --- a/include/crypto/if_alg.h +++ b/include/crypto/if_alg.h @@@ -242,9 -242,8 +242,9 @@@ int af_alg_sendmsg(struct socket *sock unsigned int ivsize); ssize_t af_alg_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags); +void af_alg_free_resources(struct af_alg_async_req *areq); void af_alg_async_cb(struct crypto_async_request *_req, int err); - unsigned int af_alg_poll(struct file *file, struct socket *sock, + __poll_t af_alg_poll(struct file *file, struct socket *sock, poll_table *wait); struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk, unsigned int areqlen); diff --combined include/linux/fs.h index 511fbaabf624,c9072b4c3a0a..f63808e803e6 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@@ -1608,6 -1608,10 +1608,10 @@@ extern int vfs_whiteout(struct inode * extern struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag);

+ int vfs_mkobj(struct dentry *, umode_t, + int (*f)(struct dentry *, umode_t, void *), + void *); + /* * VFS file helper functions. */ @@@ -1698,7 -1702,7 +1702,7 @@@ struct file_operations ssize_t (*write_iter) (struct kiocb *, struct iov_iter *); int (*iterate) (struct file *, struct dir_context *); int (*iterate_shared) (struct file *, struct dir_context *); - unsigned int (*poll) (struct file *, struct poll_table_struct *); + __poll_t (*poll) (struct file *, struct poll_table_struct *); long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long); long (*compat_ioctl) (struct file *, unsigned int, unsigned long); int (*mmap) (struct file *, struct vm_area_struct *); @@@ -1872,7 -1876,7 +1876,7 @@@ struct super_operations */ #define __IS_FLG(inode, flg) ((inode)->i_sb->s_flags & (flg))

-static inline bool sb_rdonly(const struct super_block *sb) { return sb->s_flags & MS_RDONLY; } +static inline bool sb_rdonly(const struct super_block *sb) { return sb->s_flags & SB_RDONLY; } #define IS_RDONLY(inode) sb_rdonly((inode)->i_sb) #define IS_SYNC(inode) (__IS_FLG(inode, SB_SYNCHRONOUS) || \ ((inode)->i_flags & S_SYNC)) @@@ -3088,8 -3092,7 +3092,8 @@@ static inline int vfs_lstat(const char static inline int vfs_fstatat(int dfd, const char __user *filename, struct kstat *stat, int flags) { - return vfs_statx(dfd, filename, flags, stat, STATX_BASIC_STATS); + return vfs_statx(dfd, filename, flags | AT_NO_AUTOMOUNT, + stat, STATX_BASIC_STATS); } static inline int vfs_fstat(int fd, struct kstat *stat) { @@@ -3195,20 -3198,6 +3199,20 @@@ static inline bool vma_is_dax(struct vm return vma->vm_file && IS_DAX(vma->vm_file->f_mapping->host); }

+static inline bool vma_is_fsdax(struct vm_area_struct *vma) +{ + struct inode *inode; + + if (!vma->vm_file) + return false; + if (!vma_is_dax(vma)) + return false; + inode = file_inode(vma->vm_file); + if (inode->i_mode == S_IFCHR) + return false; /* device-dax */ + return true; +} + static inline int iocb_flags(struct file *file) { int res = 0; diff --combined include/linux/skbuff.h index a38c80e9f91e,07564bb28c1f..a87e43d16f44 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@@ -1406,7 -1406,8 +1406,7 @@@ static inline struct sk_buff *skb_get(s }

/* - * If users == 1, we are the only owner and are can avoid redundant - * atomic change. + * If users == 1, we are the only owner and can avoid redundant atomic changes. */

/** @@@ -3241,7 -3242,7 +3241,7 @@@ struct sk_buff *__skb_recv_datagram(str int *peeked, int *off, int *err); struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock, int *err); - unsigned int datagram_poll(struct file *file, struct socket *sock, + __poll_t datagram_poll(struct file *file, struct socket *sock, struct poll_table_struct *wait); int skb_copy_datagram_iter(const struct sk_buff *from, int offset, struct iov_iter *to, int size); diff --combined include/net/sctp/sctp.h index 906a9c0efa71,6b765de288d8..608d123ef25f --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h @@@ -107,7 -107,7 +107,7 @@@ int sctp_backlog_rcv(struct sock *sk, s int sctp_inet_listen(struct socket *sock, int backlog); void sctp_write_space(struct sock *sk); void sctp_data_ready(struct sock *sk); - unsigned int sctp_poll(struct file *file, struct socket *sock, + __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait); void sctp_sock_rfree(struct sk_buff *skb); void sctp_copy_sock(struct sock *newsk, struct sock *sk, @@@ -195,11 -195,6 +195,11 @@@ void sctp_remaddr_proc_exit(struct net int sctp_offload_init(void);

/* + * sctp/stream_sched.c + */ +void sctp_sched_ops_init(void); + +/* * sctp/stream.c */ int sctp_send_reset_streams(struct sctp_association *asoc, diff --combined include/net/sock.h index 9155da422692,b33078333518..f90685441143 --- a/include/net/sock.h +++ b/include/net/sock.h @@@ -685,7 -685,11 +685,7 @@@ static inline void sk_add_node_rcu(stru

static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) { - if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport && - sk->sk_family == AF_INET6) - hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list); - else - hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); + hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); }

static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) @@@ -1578,7 -1582,7 +1578,7 @@@ int sock_no_connect(struct socket *, st int sock_no_socketpair(struct socket *, struct socket *); int sock_no_accept(struct socket *, struct socket *, int, bool); int sock_no_getname(struct socket *, struct sockaddr *, int *, int); - unsigned int sock_no_poll(struct file *, struct socket *, + __poll_t sock_no_poll(struct file *, struct socket *, struct poll_table_struct *); int sock_no_ioctl(struct socket *, unsigned int, unsigned long); int sock_no_listen(struct socket *, int); diff --combined include/net/tcp.h index 6da880d2f022,a6343271c629..50b21a49d870 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@@ -387,7 -387,7 +387,7 @@@ bool tcp_peer_is_proven(struct request_ void tcp_close(struct sock *sk, long timeout); void tcp_init_sock(struct sock *sk); void tcp_init_transfer(struct sock *sk, int bpf_op); - unsigned int tcp_poll(struct file *file, struct socket *sock, + __poll_t tcp_poll(struct file *file, struct socket *sock, struct poll_table_struct *wait); int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval, int __user *optlen); @@@ -844,11 -844,12 +844,11 @@@ static inline int tcp_v6_sdif(const str } #endif

-/* TCP_SKB_CB reference means this can not be used from early demux */ static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb) { #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV) if (!net->ipv4.sysctl_tcp_l3mdev_accept && - skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags)) + skb && ipv4_l3mdev_skb(IPCB(skb)->flags)) return true; #endif return false; @@@ -1055,7 -1056,7 +1055,7 @@@ void tcp_rate_skb_sent(struct sock *sk void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, struct rate_sample *rs); void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost, - struct rate_sample *rs); + bool is_sack_reneg, struct rate_sample *rs); void tcp_rate_check_app_limited(struct sock *sk);

/* These functions determine how the current flow behaves in respect of SACK diff --combined ipc/mqueue.c index 9649ecd8a73a,10b82338415b..67a8701bca2c --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@@ -270,13 -270,30 +270,30 @@@ static struct inode *mqueue_get_inode(s * that means the min(mq_maxmsg, max_priorities) * struct * posix_msg_tree_node. */ + + ret = -EINVAL; + if (info->attr.mq_maxmsg <= 0 || info->attr.mq_msgsize <= 0) + goto out_inode; + if (capable(CAP_SYS_RESOURCE)) { + if (info->attr.mq_maxmsg > HARD_MSGMAX || + info->attr.mq_msgsize > HARD_MSGSIZEMAX) + goto out_inode; + } else { + if (info->attr.mq_maxmsg > ipc_ns->mq_msg_max || + info->attr.mq_msgsize > ipc_ns->mq_msgsize_max) + goto out_inode; + } + ret = -EOVERFLOW; + /* check for overflow */ + if (info->attr.mq_msgsize > ULONG_MAX/info->attr.mq_maxmsg) + goto out_inode; mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) + min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) * sizeof(struct posix_msg_tree_node); - - mq_bytes = mq_treesize + (info->attr.mq_maxmsg * - info->attr.mq_msgsize); - + mq_bytes = info->attr.mq_maxmsg * info->attr.mq_msgsize; + if (mq_bytes + mq_treesize < mq_bytes) + goto out_inode; + mq_bytes += mq_treesize; spin_lock(&mq_lock); if (u->mq_bytes + mq_bytes < u->mq_bytes || u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) { @@@ -331,7 -348,7 +348,7 @@@ static struct dentry *mqueue_mount(stru void *data) { struct ipc_namespace *ns; - if (flags & MS_KERNMOUNT) { + if (flags & SB_KERNMOUNT) { ns = data; data = NULL; } else { @@@ -416,11 -433,11 +433,11 @@@ static void mqueue_evict_inode(struct i put_ipc_ns(ipc_ns); }

- static int mqueue_create(struct inode *dir, struct dentry *dentry, - umode_t mode, bool excl) + static int mqueue_create_attr(struct dentry *dentry, umode_t mode, void *arg) { + struct inode *dir = dentry->d_parent->d_inode; struct inode *inode; - struct mq_attr *attr = dentry->d_fsdata; + struct mq_attr *attr = arg; int error; struct ipc_namespace *ipc_ns;

@@@ -461,6 -478,12 +478,12 @@@ out_unlock return error; }

+ static int mqueue_create(struct inode *dir, struct dentry *dentry, + umode_t mode, bool excl) + { + return mqueue_create_attr(dentry, mode, NULL); + } + static int mqueue_unlink(struct inode *dir, struct dentry *dentry) { struct inode *inode = d_inode(dentry); @@@ -519,10 -542,10 +542,10 @@@ static int mqueue_flush_file(struct fil return 0; }

- static unsigned int mqueue_poll_file(struct file *filp, struct poll_table_struct *poll_tab) + static __poll_t mqueue_poll_file(struct file *filp, struct poll_table_struct *poll_tab) { struct mqueue_inode_info *info = MQUEUE_I(file_inode(filp)); - int retval = 0; + __poll_t retval = 0;

poll_wait(filp, &info->wait_q, poll_tab);

@@@ -690,94 -713,41 +713,41 @@@ static void remove_notification(struct info->notify_user_ns = NULL; }

- static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr) - { - int mq_treesize; - unsigned long total_size; - - if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0) - return -EINVAL; - if (capable(CAP_SYS_RESOURCE)) { - if (attr->mq_maxmsg > HARD_MSGMAX || - attr->mq_msgsize > HARD_MSGSIZEMAX) - return -EINVAL; - } else { - if (attr->mq_maxmsg > ipc_ns->mq_msg_max || - attr->mq_msgsize > ipc_ns->mq_msgsize_max) - return -EINVAL; - } - /* check for overflow */ - if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg) - return -EOVERFLOW; - mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) + - min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) * - sizeof(struct posix_msg_tree_node); - total_size = attr->mq_maxmsg * attr->mq_msgsize; - if (total_size + mq_treesize < total_size) - return -EOVERFLOW; - return 0; - } - - /* - * Invoked when creating a new queue via sys_mq_open - */ - static struct file *do_create(struct ipc_namespace *ipc_ns, struct inode *dir, - struct path *path, int oflag, umode_t mode, + static int prepare_open(struct dentry *dentry, int oflag, int ro, + umode_t mode, struct filename *name, struct mq_attr *attr) { - const struct cred *cred = current_cred(); - int ret; - - if (attr) { - ret = mq_attr_ok(ipc_ns, attr); - if (ret) - return ERR_PTR(ret); - /* store for use during create */ - path->dentry->d_fsdata = attr; - } else { - struct mq_attr def_attr; - - def_attr.mq_maxmsg = min(ipc_ns->mq_msg_max, - ipc_ns->mq_msg_default); - def_attr.mq_msgsize = min(ipc_ns->mq_msgsize_max, - ipc_ns->mq_msgsize_default); - ret = mq_attr_ok(ipc_ns, &def_attr); - if (ret) - return ERR_PTR(ret); - } - - mode &= ~current_umask(); - ret = vfs_create(dir, path->dentry, mode, true); - path->dentry->d_fsdata = NULL; - if (ret) - return ERR_PTR(ret); - return dentry_open(path, oflag, cred); - } - - /* Opens existing queue */ - static struct file *do_open(struct path *path, int oflag) - { static const int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE, MAY_READ | MAY_WRITE }; int acc; + + if (d_really_is_negative(dentry)) { + if (!(oflag & O_CREAT)) + return -ENOENT; + if (ro) + return ro; + audit_inode_parent_hidden(name, dentry->d_parent); + return vfs_mkobj(dentry, mode & ~current_umask(), + mqueue_create_attr, attr); + } + /* it already existed */ + audit_inode(name, dentry, 0); + if ((oflag & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL)) + return -EEXIST; if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) - return ERR_PTR(-EINVAL); + return -EINVAL; acc = oflag2acc[oflag & O_ACCMODE]; - if (inode_permission(d_inode(path->dentry), acc)) - return ERR_PTR(-EACCES); - return dentry_open(path, oflag, current_cred()); + return inode_permission(d_inode(dentry), acc); }

static int do_mq_open(const char __user *u_name, int oflag, umode_t mode, struct mq_attr *attr) { - struct path path; - struct file *filp; + struct vfsmount *mnt = current->nsproxy->ipc_ns->mq_mnt; + struct dentry *root = mnt->mnt_root; struct filename *name; + struct path path; int fd, error; - struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns; - struct vfsmount *mnt = ipc_ns->mq_mnt; - struct dentry *root = mnt->mnt_root; int ro;

audit_mq_open(oflag, mode, attr); @@@ -790,7 -760,6 +760,6 @@@ goto out_putname;

ro = mnt_want_write(mnt); /* we'll drop it in any case */ - error = 0; inode_lock(d_inode(root)); path.dentry = lookup_one_len(name->name, root, strlen(name->name)); if (IS_ERR(path.dentry)) { @@@ -798,38 -767,14 +767,14 @@@ goto out_putfd; } path.mnt = mntget(mnt); - - if (oflag & O_CREAT) { - if (d_really_is_positive(path.dentry)) { /* entry already exists */ - audit_inode(name, path.dentry, 0); - if (oflag & O_EXCL) { - error = -EEXIST; - goto out; - } - filp = do_open(&path, oflag); - } else { - if (ro) { - error = ro; - goto out; - } - audit_inode_parent_hidden(name, root); - filp = do_create(ipc_ns, d_inode(root), &path, - oflag, mode, attr); - } - } else { - if (d_really_is_negative(path.dentry)) { - error = -ENOENT; - goto out; - } - audit_inode(name, path.dentry, 0); - filp = do_open(&path, oflag); + error = prepare_open(path.dentry, oflag, ro, mode, name, attr); + if (!error) { + struct file *file = dentry_open(&path, oflag, current_cred()); + if (!IS_ERR(file)) + fd_install(fd, file); + else + error = PTR_ERR(file); } - - if (!IS_ERR(filp)) - fd_install(fd, filp); - else - error = PTR_ERR(filp); - out: path_put(&path); out_putfd: if (error) { diff --combined kernel/events/core.c index 4df5b695bf0d,857c40d98d2c..4dd0e1ea876d --- a/kernel/events/core.c +++ b/kernel/events/core.c @@@ -4511,11 -4511,11 +4511,11 @@@ perf_read(struct file *file, char __use return ret; }

- static unsigned int perf_poll(struct file *file, poll_table *wait) + static __poll_t perf_poll(struct file *file, poll_table *wait) { struct perf_event *event = file->private_data; struct ring_buffer *rb; - unsigned int events = POLLHUP; + __poll_t events = POLLHUP;

poll_wait(file, &event->waitq, wait);

@@@ -6639,7 -6639,6 +6639,7 @@@ static void perf_event_namespaces_outpu struct perf_namespaces_event *namespaces_event = data; struct perf_output_handle handle; struct perf_sample_data sample; + u16 header_size = namespaces_event->event_id.header.size; int ret;

if (!perf_event_namespaces_match(event)) @@@ -6650,7 -6649,7 +6650,7 @@@ ret = perf_output_begin(&handle, event, namespaces_event->event_id.header.size); if (ret) - return; + goto out;

namespaces_event->event_id.pid = perf_event_pid(event, namespaces_event->task); @@@ -6662,8 -6661,6 +6662,8 @@@ perf_event__output_id_sample(event, &handle, &sample);

perf_output_end(&handle); +out: + namespaces_event->event_id.header.size = header_size; }

static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info, @@@ -7990,11 -7987,11 +7990,11 @@@ static void bpf_overflow_handler(struc { struct bpf_perf_event_data_kern ctx = { .data = data, - .regs = regs, .event = event, }; int ret = 0;

+ ctx.regs = perf_arch_bpf_user_pt_regs(regs); preempt_disable(); if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) goto out; diff --combined kernel/printk/printk.c index b9006617710f,8aa27be96012..c2e713f6ae2e --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@@ -920,10 -920,10 +920,10 @@@ static loff_t devkmsg_llseek(struct fil return ret; }

- static unsigned int devkmsg_poll(struct file *file, poll_table *wait) + static __poll_t devkmsg_poll(struct file *file, poll_table *wait) { struct devkmsg_user *user = file->private_data; - int ret = 0; + __poll_t ret = 0;

if (!user) return POLLERR|POLLNVAL; @@@ -3141,6 -3141,9 +3141,6 @@@ void dump_stack_print_info(const char * void show_regs_print_info(const char *log_lvl) { dump_stack_print_info(log_lvl); - - printk("%stask: %p task.stack: %p\n", - log_lvl, current, task_stack_page(current)); }

#endif diff --combined kernel/trace/ring_buffer.c index c87766c1c204,d24d48713ef3..1f005db816be --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@@ -626,7 -626,7 +626,7 @@@ int ring_buffer_wait(struct ring_buffe * Returns POLLIN | POLLRDNORM if data exists in the buffers, * zero otherwise. */ - int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, + __poll_t ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, struct file *filp, poll_table *poll_table) { struct ring_buffer_per_cpu *cpu_buffer; @@@ -1799,6 -1799,12 +1799,6 @@@ void ring_buffer_change_overwrite(struc } EXPORT_SYMBOL_GPL(ring_buffer_change_overwrite);

-static __always_inline void * -__rb_data_page_index(struct buffer_data_page *bpage, unsigned index) -{ - return bpage->data + index; -} - static __always_inline void *__rb_page_index(struct buffer_page *bpage, unsigned index) { return bpage->page->data + index; diff --combined kernel/trace/trace.c index 59518b8126d0,1e2a45e87b93..9eb7210d432c --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@@ -362,7 -362,7 +362,7 @@@ trace_ignore_this_task(struct trace_pid }

/** - * trace_pid_filter_add_remove - Add or remove a task from a pid_list + * trace_pid_filter_add_remove_task - Add or remove a task from a pid_list * @pid_list: The list to modify * @self: The current task for fork or NULL for exit * @task: The task to add or remove @@@ -925,7 -925,7 +925,7 @@@ static void tracing_snapshot_instance(s }

/** - * trace_snapshot - take a snapshot of the current buffer. + * tracing_snapshot - take a snapshot of the current buffer. * * This causes a swap between the snapshot buffer and the current live * tracing buffer. You can use this to take snapshots of the live @@@ -1004,9 -1004,9 +1004,9 @@@ int tracing_alloc_snapshot(void EXPORT_SYMBOL_GPL(tracing_alloc_snapshot);

/** - * trace_snapshot_alloc - allocate and take a snapshot of the current buffer. + * tracing_snapshot_alloc - allocate and take a snapshot of the current buffer. * - * This is similar to trace_snapshot(), but it will allocate the + * This is similar to tracing_snapshot(), but it will allocate the * snapshot buffer if it isn't already allocated. Use this only * where it is safe to sleep, as the allocation may sleep. * @@@ -1303,7 -1303,7 +1303,7 @@@ unsigned long __read_mostly tracing_thr /* * Copy the new maximum trace into the separate maximum-trace * structure. (this way the maximum trace is permanently saved, - * for later retrieval via /sys/kernel/debug/tracing/latency_trace) + * for later retrieval via /sys/kernel/tracing/tracing_max_latency) */ static void __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu) @@@ -2415,7 -2415,7 +2415,7 @@@ trace_process_export(struct trace_expor

entry = ring_buffer_event_data(event); size = ring_buffer_event_length(event); - export->write(entry, size); + export->write(export, entry, size); }

static DEFINE_MUTEX(ftrace_export_lock); @@@ -4178,30 -4178,37 +4178,30 @@@ static const struct file_operations sho .llseek = seq_lseek, };

-/* - * The tracer itself will not take this lock, but still we want - * to provide a consistent cpumask to user-space: - */ -static DEFINE_MUTEX(tracing_cpumask_update_lock); - -/* - * Temporary storage for the character representation of the - * CPU bitmask (and one more byte for the newline): - */ -static char mask_str[NR_CPUS + 1]; - static ssize_t tracing_cpumask_read(struct file *filp, char __user *ubuf, size_t count, loff_t *ppos) { struct trace_array *tr = file_inode(filp)->i_private; + char *mask_str; int len;

- mutex_lock(&tracing_cpumask_update_lock); + len = snprintf(NULL, 0, "%*pb\n", + cpumask_pr_args(tr->tracing_cpumask)) + 1; + mask_str = kmalloc(len, GFP_KERNEL); + if (!mask_str) + return -ENOMEM;

- len = snprintf(mask_str, count, "%*pb\n", + len = snprintf(mask_str, len, "%*pb\n", cpumask_pr_args(tr->tracing_cpumask)); if (len >= count) { count = -EINVAL; goto out_err; } - count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1); + count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len);

out_err: - mutex_unlock(&tracing_cpumask_update_lock); + kfree(mask_str);

return count; } @@@ -4221,6 -4228,8 +4221,6 @@@ tracing_cpumask_write(struct file *filp if (err) goto err_unlock;

- mutex_lock(&tracing_cpumask_update_lock); - local_irq_disable(); arch_spin_lock(&tr->max_lock); for_each_tracing_cpu(cpu) { @@@ -4243,6 -4252,8 +4243,6 @@@ local_irq_enable();

cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new); - - mutex_unlock(&tracing_cpumask_update_lock); free_cpumask_var(tracing_cpumask_new);

return count; @@@ -5621,7 -5632,7 +5621,7 @@@ static int tracing_release_pipe(struct return 0; }

- static unsigned int + static __poll_t trace_poll(struct trace_iterator *iter, struct file *filp, poll_table *poll_table) { struct trace_array *tr = iter->tr; @@@ -5640,7 -5651,7 +5640,7 @@@ filp, poll_table); }

- static unsigned int + static __poll_t tracing_poll_pipe(struct file *filp, poll_table *poll_table) { struct trace_iterator *iter = filp->private_data; @@@ -6594,7 -6605,7 +6594,7 @@@ static int tracing_buffers_open(struct return ret; }

- static unsigned int + static __poll_t tracing_buffers_poll(struct file *filp, poll_table *poll_table) { struct ftrace_buffer_info *info = filp->private_data; diff --combined mm/gup.c index e0d82b6706d7,61015793f952..9e17d8db2d6b --- a/mm/gup.c +++ b/mm/gup.c @@@ -848,7 -848,7 +848,7 @@@ static __always_inline long __get_user_ unsigned long nr_pages, struct page **pages, struct vm_area_struct **vmas, - int *locked, bool notify_drop, + int *locked, unsigned int flags) { long ret, pages_done; @@@ -922,7 -922,7 +922,7 @@@ pages++; start += PAGE_SIZE; } - if (notify_drop && lock_dropped && *locked) { + if (lock_dropped && *locked) { /* * We must let the caller know we temporarily dropped the lock * and so the critical section protected by it was lost. @@@ -959,36 -959,12 +959,12 @@@ long get_user_pages_locked(unsigned lon int *locked) { return __get_user_pages_locked(current, current->mm, start, nr_pages, - pages, NULL, locked, true, + pages, NULL, locked, gup_flags | FOLL_TOUCH); } EXPORT_SYMBOL(get_user_pages_locked);

/* - * Same as get_user_pages_unlocked(...., FOLL_TOUCH) but it allows for - * tsk, mm to be specified. - * - * NOTE: here FOLL_TOUCH is not set implicitly and must be set by the - * caller if required (just like with __get_user_pages). "FOLL_GET" - * is set implicitly if "pages" is non-NULL. - */ - static __always_inline long __get_user_pages_unlocked(struct task_struct *tsk, - struct mm_struct *mm, unsigned long start, - unsigned long nr_pages, struct page **pages, - unsigned int gup_flags) - { - long ret; - int locked = 1; - - down_read(&mm->mmap_sem); - ret = __get_user_pages_locked(tsk, mm, start, nr_pages, pages, NULL, - &locked, false, gup_flags); - if (locked) - up_read(&mm->mmap_sem); - return ret; - } - - /* * get_user_pages_unlocked() is suitable to replace the form: * * down_read(&mm->mmap_sem); @@@ -1006,8 -982,16 +982,16 @@@ long get_user_pages_unlocked(unsigned long start, unsigned long nr_pages, struct page **pages, unsigned int gup_flags) { - return __get_user_pages_unlocked(current, current->mm, start, nr_pages, - pages, gup_flags | FOLL_TOUCH); + struct mm_struct *mm = current->mm; + int locked = 1; + long ret; + + down_read(&mm->mmap_sem); + ret = __get_user_pages_locked(current, mm, start, nr_pages, pages, NULL, + &locked, gup_flags | FOLL_TOUCH); + if (locked) + up_read(&mm->mmap_sem); + return ret; } EXPORT_SYMBOL(get_user_pages_unlocked);

@@@ -1073,7 -1057,7 +1057,7 @@@ long get_user_pages_remote(struct task_ struct vm_area_struct **vmas, int *locked) { return __get_user_pages_locked(tsk, mm, start, nr_pages, pages, vmas, - locked, true, + locked, gup_flags | FOLL_TOUCH | FOLL_REMOTE); } EXPORT_SYMBOL(get_user_pages_remote); @@@ -1090,75 -1074,11 +1074,75 @@@ long get_user_pages(unsigned long start struct vm_area_struct **vmas) { return __get_user_pages_locked(current, current->mm, start, nr_pages, - pages, vmas, NULL, false, + pages, vmas, NULL, gup_flags | FOLL_TOUCH); } EXPORT_SYMBOL(get_user_pages);

+#ifdef CONFIG_FS_DAX +/* + * This is the same as get_user_pages() in that it assumes we are + * operating on the current task's mm, but it goes further to validate + * that the vmas associated with the address range are suitable for + * longterm elevated page reference counts. For example, filesystem-dax + * mappings are subject to the lifetime enforced by the filesystem and + * we need guarantees that longterm users like RDMA and V4L2 only + * establish mappings that have a kernel enforced revocation mechanism. + * + * "longterm" == userspace controlled elevated page count lifetime. + * Contrast this to iov_iter_get_pages() usages which are transient. + */ +long get_user_pages_longterm(unsigned long start, unsigned long nr_pages, + unsigned int gup_flags, struct page **pages, + struct vm_area_struct **vmas_arg) +{ + struct vm_area_struct **vmas = vmas_arg; + struct vm_area_struct *vma_prev = NULL; + long rc, i; + + if (!pages) + return -EINVAL; + + if (!vmas) { + vmas = kcalloc(nr_pages, sizeof(struct vm_area_struct *), + GFP_KERNEL); + if (!vmas) + return -ENOMEM; + } + + rc = get_user_pages(start, nr_pages, gup_flags, pages, vmas); + + for (i = 0; i < rc; i++) { + struct vm_area_struct *vma = vmas[i]; + + if (vma == vma_prev) + continue; + + vma_prev = vma; + + if (vma_is_fsdax(vma)) + break; + } + + /* + * Either get_user_pages() failed, or the vma validation + * succeeded, in either case we don't need to put_page() before + * returning. + */ + if (i >= rc) + goto out; + + for (i = 0; i < rc; i++) + put_page(pages[i]); + rc = -EOPNOTSUPP; +out: + if (vmas != vmas_arg) + kfree(vmas); + return rc; +} +EXPORT_SYMBOL(get_user_pages_longterm); +#endif /* CONFIG_FS_DAX */ + /** * populate_vma_page_range() - populate a range of pages in the vma. * @vma: target vma diff --combined mm/memcontrol.c index ac2ffd5e02b9,006aa27f4fb4..9011997d8a5c --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@@ -3777,7 -3777,7 +3777,7 @@@ static int memcg_event_wake(wait_queue_ struct mem_cgroup_event *event = container_of(wait, struct mem_cgroup_event, wait); struct mem_cgroup *memcg = event->memcg; - unsigned long flags = (unsigned long)key; + __poll_t flags = key_to_poll(key);

if (flags & POLLHUP) { /* @@@ -6044,7 -6044,7 +6044,7 @@@ void mem_cgroup_swapout(struct page *pa memcg_check_events(memcg, page);

if (!mem_cgroup_is_root(memcg)) - css_put(&memcg->css); + css_put_many(&memcg->css, nr_entries); }

/** diff --combined net/9p/trans_fd.c index 80f5c79053a4,439014113a5c..d6f7f7cb79c4 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@@ -228,32 -228,31 +228,31 @@@ static void p9_conn_cancel(struct p9_co } }

- static int - p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt) + static __poll_t + p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt, int *err) { - int ret, n; + __poll_t ret, n; struct p9_trans_fd *ts = NULL;

if (client && client->status == Connected) ts = client->trans;

- if (!ts) - return -EREMOTEIO; + if (!ts) { + if (err) + *err = -EREMOTEIO; + return POLLERR; + }

if (!ts->rd->f_op->poll) - return -EIO; - - if (!ts->wr->f_op->poll) - return -EIO; - - ret = ts->rd->f_op->poll(ts->rd, pt); - if (ret < 0) - return ret; + ret = DEFAULT_POLLMASK; + else + ret = ts->rd->f_op->poll(ts->rd, pt);

if (ts->rd != ts->wr) { - n = ts->wr->f_op->poll(ts->wr, pt); - if (n < 0) - return n; + if (!ts->wr->f_op->poll) + n = DEFAULT_POLLMASK; + else + n = ts->wr->f_op->poll(ts->wr, pt); ret = (ret & ~POLLOUT) | (n & ~POLLIN); }

@@@ -298,7 -297,8 +297,8 @@@ static int p9_fd_read(struct p9_client

static void p9_read_work(struct work_struct *work) { - int n, err; + __poll_t n; + int err; struct p9_conn *m; int status = REQ_STATUS_ERROR;

@@@ -398,7 -398,7 +398,7 @@@ end_clear if (test_and_clear_bit(Rpending, &m->wsched)) n = POLLIN; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if ((n & POLLIN) && !test_and_set_bit(Rworksched, &m->wsched)) { p9_debug(P9_DEBUG_TRANS, "sched read work %p\n", m); @@@ -448,7 -448,8 +448,8 @@@ static int p9_fd_write(struct p9_clien

static void p9_write_work(struct work_struct *work) { - int n, err; + __poll_t n; + int err; struct p9_conn *m; struct p9_req_t *req;

@@@ -506,7 -507,7 +507,7 @@@ end_clear if (test_and_clear_bit(Wpending, &m->wsched)) n = POLLOUT; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if ((n & POLLOUT) && !test_and_set_bit(Wworksched, &m->wsched)) { @@@ -581,7 -582,7 +582,7 @@@ p9_pollwait(struct file *filp, wait_que

static void p9_conn_create(struct p9_client *client) { - int n; + __poll_t n; struct p9_trans_fd *ts = client->trans; struct p9_conn *m = &ts->conn;

@@@ -597,7 -598,7 +598,7 @@@ INIT_LIST_HEAD(&m->poll_pending_link); init_poll_funcptr(&m->pt, p9_pollwait);

- n = p9_fd_poll(client, &m->pt); + n = p9_fd_poll(client, &m->pt, NULL); if (n & POLLIN) { p9_debug(P9_DEBUG_TRANS, "mux %p can read\n", m); set_bit(Rpending, &m->wsched); @@@ -617,17 -618,16 +618,16 @@@

static void p9_poll_mux(struct p9_conn *m) { - int n; + __poll_t n; + int err = -ECONNRESET;

if (m->err < 0) return;

- n = p9_fd_poll(m->client, NULL); - if (n < 0 || n & (POLLERR | POLLHUP | POLLNVAL)) { + n = p9_fd_poll(m->client, NULL, &err); + if (n & (POLLERR | POLLHUP | POLLNVAL)) { p9_debug(P9_DEBUG_TRANS, "error mux %p err %d\n", m, n); - if (n >= 0) - n = -ECONNRESET; - p9_conn_cancel(m, n); + p9_conn_cancel(m, err); }

if (n & POLLIN) { @@@ -663,7 -663,7 +663,7 @@@

static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) { - int n; + __poll_t n; struct p9_trans_fd *ts = client->trans; struct p9_conn *m = &ts->conn;

@@@ -680,7 -680,7 +680,7 @@@ if (test_and_clear_bit(Wpending, &m->wsched)) n = POLLOUT; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if (n & POLLOUT && !test_and_set_bit(Wworksched, &m->wsched)) schedule_work(&m->wq); @@@ -839,6 -839,7 +839,6 @@@ static int p9_socket_open(struct p9_cli if (IS_ERR(file)) { pr_err("%s (%d): failed to map fd\n", __func__, task_pid_nr(current)); - sock_release(csocket); kfree(p); return PTR_ERR(file); } diff --combined net/dccp/proto.c index 9d43c1f40274,cfa9ca9939ce..8b8db3d481bd --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@@ -259,7 -259,6 +259,7 @@@ int dccp_disconnect(struct sock *sk, in { struct inet_connection_sock *icsk = inet_csk(sk); struct inet_sock *inet = inet_sk(sk); + struct dccp_sock *dp = dccp_sk(sk); int err = 0; const int old_state = sk->sk_state;

@@@ -279,10 -278,6 +279,10 @@@ sk->sk_err = ECONNRESET;

dccp_clear_xmit_timers(sk); + ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); + ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_rx_ccid = NULL; + dp->dccps_hc_tx_ccid = NULL;

__skb_queue_purge(&sk->sk_receive_queue); __skb_queue_purge(&sk->sk_write_queue); @@@ -318,10 -313,10 +318,10 @@@ EXPORT_SYMBOL_GPL(dccp_disconnect) * take care of normal races (between the test and the event) and we don't * go look at any of the socket buffers directly. */ - unsigned int dccp_poll(struct file *file, struct socket *sock, + __poll_t dccp_poll(struct file *file, struct socket *sock, poll_table *wait) { - unsigned int mask; + __poll_t mask; struct sock *sk = sock->sk;

sock_poll_wait(file, sk_sleep(sk), wait); diff --combined net/ipv4/tcp.c index f08eebe60446,0b8ca689353b..c4a7ee7f6721 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@@ -493,9 -493,9 +493,9 @@@ static void tcp_tx_timestamp(struct soc * take care of normal races (between the test and the event) and we don't * go look at any of the socket buffers directly. */ - unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait) + __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) { - unsigned int mask; + __poll_t mask; struct sock *sk = sock->sk; const struct tcp_sock *tp = tcp_sk(sk); int state; @@@ -2412,7 -2412,6 +2412,7 @@@ int tcp_disconnect(struct sock *sk, in tp->snd_cwnd_cnt = 0; tp->window_clamp = 0; tcp_set_ca_state(sk, TCP_CA_Open); + tp->is_sack_reneg = 0; tcp_clear_retrans(tp); inet_csk_delack_init(sk); /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0 diff --combined net/netfilter/xt_bpf.c index 1f7fbd3c7e5a,fa2ca0a13619..39809253a670 --- a/net/netfilter/xt_bpf.c +++ b/net/netfilter/xt_bpf.c @@@ -27,9 -27,6 +27,9 @@@ static int __bpf_mt_check_bytecode(stru { struct sock_fprog_kern program;

+ if (len > XT_BPF_MAX_NUM_INSTR) + return -EINVAL; + program.len = len; program.filter = insns;

@@@ -55,21 -52,8 +55,8 @@@ static int __bpf_mt_check_fd(int fd, st

static int __bpf_mt_check_path(const char *path, struct bpf_prog **ret) { - mm_segment_t oldfs = get_fs(); - int retval, fd; - - if (strnlen(path, XT_BPF_PATH_MAX) == XT_BPF_PATH_MAX) - return -EINVAL; - - set_fs(KERNEL_DS); - fd = bpf_obj_get_user(path, 0); - set_fs(oldfs); - if (fd < 0) - return fd; - - retval = __bpf_mt_check_fd(fd, ret); - sys_close(fd); - return retval; + *ret = bpf_prog_get_type_path(path, BPF_PROG_TYPE_SOCKET_FILTER); + return PTR_ERR_OR_ZERO(*ret); }

static int bpf_mt_check(const struct xt_mtchk_param *par) diff --combined net/packet/af_packet.c index da215e5c1399,ef6340e2406a..3b4d6a3cf190 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@@ -1687,6 -1687,7 +1687,6 @@@ static int fanout_add(struct sock *sk, atomic_long_set(&rollover->num, 0); atomic_long_set(&rollover->num_huge, 0); atomic_long_set(&rollover->num_failed, 0); - po->rollover = rollover; }

if (type_flags & PACKET_FANOUT_FLAG_UNIQUEID) { @@@ -1744,8 -1745,6 +1744,8 @@@ if (refcount_read(&match->sk_ref) < PACKET_FANOUT_MAX) { __dev_remove_pack(&po->prot_hook); po->fanout = match; + po->rollover = rollover; + rollover = NULL; refcount_set(&match->sk_ref, refcount_read(&match->sk_ref) + 1); __fanout_link(sk, po); err = 0; @@@ -1759,7 -1758,10 +1759,7 @@@ }

out: - if (err && rollover) { - kfree_rcu(rollover, rcu); - po->rollover = NULL; - } + kfree(rollover); mutex_unlock(&fanout_mutex); return err; } @@@ -1783,6 -1785,11 +1783,6 @@@ static struct packet_fanout *fanout_rel list_del(&f->list); else f = NULL; - - if (po->rollover) { - kfree_rcu(po->rollover, rcu); - po->rollover = NULL; - } } mutex_unlock(&fanout_mutex);

@@@ -3022,7 -3029,6 +3022,7 @@@ static int packet_release(struct socke synchronize_net();

if (f) { + kfree(po->rollover); fanout_release_data(f); kfree(f); } @@@ -3091,10 -3097,6 +3091,10 @@@ static int packet_do_bind(struct sock * if (need_rehook) { if (po->running) { rcu_read_unlock(); + /* prevents packet_notifier() from calling + * register_prot_hook() + */ + po->num = 0; __unregister_prot_hook(sk, true); rcu_read_lock(); dev_curr = po->prot_hook.dev; @@@ -3103,7 -3105,6 +3103,7 @@@ dev->ifindex); }

+ BUG_ON(po->running); po->num = proto; po->prot_hook.type = proto;

@@@ -3842,6 -3843,7 +3842,6 @@@ static int packet_getsockopt(struct soc void *data = &val; union tpacket_stats_u st; struct tpacket_rollover_stats rstats; - struct packet_rollover *rollover;

if (level != SOL_PACKET) return -ENOPROTOOPT; @@@ -3920,13 -3922,18 +3920,13 @@@ 0); break; case PACKET_ROLLOVER_STATS: - rcu_read_lock(); - rollover = rcu_dereference(po->rollover); - if (rollover) { - rstats.tp_all = atomic_long_read(&rollover->num); - rstats.tp_huge = atomic_long_read(&rollover->num_huge); - rstats.tp_failed = atomic_long_read(&rollover->num_failed); - data = &rstats; - lv = sizeof(rstats); - } - rcu_read_unlock(); - if (!rollover) + if (!po->rollover) return -EINVAL; + rstats.tp_all = atomic_long_read(&po->rollover->num); + rstats.tp_huge = atomic_long_read(&po->rollover->num_huge); + rstats.tp_failed = atomic_long_read(&po->rollover->num_failed); + data = &rstats; + lv = sizeof(rstats); break; case PACKET_TX_HAS_OFF: val = po->tp_tx_has_off; @@@ -4073,12 -4080,12 +4073,12 @@@ static int packet_ioctl(struct socket * return 0; }

- static unsigned int packet_poll(struct file *file, struct socket *sock, + static __poll_t packet_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct packet_sock *po = pkt_sk(sk); - unsigned int mask = datagram_poll(file, sock, wait); + __poll_t mask = datagram_poll(file, sock, wait);

spin_lock_bh(&sk->sk_receive_queue.lock); if (po->rx_ring.pg_vec) { diff --combined net/rxrpc/af_rxrpc.c index dcd818fa837e,f8c8953d9295..21ad6a3a465c --- a/net/rxrpc/af_rxrpc.c +++ b/net/rxrpc/af_rxrpc.c @@@ -285,7 -285,6 +285,7 @@@ struct rxrpc_call *rxrpc_kernel_begin_c bool upgrade) { struct rxrpc_conn_parameters cp; + struct rxrpc_call_params p; struct rxrpc_call *call; struct rxrpc_sock *rx = rxrpc_sk(sock->sk); int ret; @@@ -303,10 -302,6 +303,10 @@@ if (key && !key->payload.data[0]) key = NULL; /* a no-security key */

+ memset(&p, 0, sizeof(p)); + p.user_call_ID = user_call_ID; + p.tx_total_len = tx_total_len; + memset(&cp, 0, sizeof(cp)); cp.local = rx->local; cp.key = key; @@@ -314,7 -309,8 +314,7 @@@ cp.exclusive = false; cp.upgrade = upgrade; cp.service_id = srx->srx_service; - call = rxrpc_new_client_call(rx, &cp, srx, user_call_ID, tx_total_len, - gfp); + call = rxrpc_new_client_call(rx, &cp, srx, &p, gfp); /* The socket has been unlocked. */ if (!IS_ERR(call)) { call->notify_rx = notify_rx; @@@ -729,12 -725,12 +729,12 @@@ static int rxrpc_getsockopt(struct sock /* * permit an RxRPC socket to be polled */ - static unsigned int rxrpc_poll(struct file *file, struct socket *sock, + static __poll_t rxrpc_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct rxrpc_sock *rx = rxrpc_sk(sk); - unsigned int mask; + __poll_t mask;

sock_poll_wait(file, sk_sleep(sk), wait); mask = 0; @@@ -860,7 -856,6 +860,7 @@@ static void rxrpc_sock_destructor(struc static int rxrpc_release_sock(struct sock *sk) { struct rxrpc_sock *rx = rxrpc_sk(sk); + struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));

_enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));

@@@ -868,19 -863,6 +868,19 @@@ sock_orphan(sk); sk->sk_shutdown = SHUTDOWN_MASK;

+ /* We want to kill off all connections from a service socket + * as fast as possible because we can't share these; client + * sockets, on the other hand, can share an endpoint. + */ + switch (sk->sk_state) { + case RXRPC_SERVER_BOUND: + case RXRPC_SERVER_BOUND2: + case RXRPC_SERVER_LISTENING: + case RXRPC_SERVER_LISTEN_DISABLED: + rx->local->service_closed = true; + break; + } + spin_lock_bh(&sk->sk_receive_queue.lock); sk->sk_state = RXRPC_CLOSE; spin_unlock_bh(&sk->sk_receive_queue.lock); @@@ -896,8 -878,6 +896,8 @@@ rxrpc_release_calls_on_socket(rx); flush_workqueue(rxrpc_workqueue); rxrpc_purge_queue(&sk->sk_receive_queue); + rxrpc_queue_work(&rxnet->service_conn_reaper); + rxrpc_queue_work(&rxnet->client_conn_reaper);

rxrpc_put_local(rx->local); rx->local = NULL; diff --combined net/sctp/socket.c index 3253f724a995,8d3ac79f82e5..03d9d24b38ba --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@@ -188,13 -188,13 +188,13 @@@ static void sctp_for_each_tx_datachunk( list_for_each_entry(chunk, &t->transmitted, transmitted_list) cb(chunk);

- list_for_each_entry(chunk, &q->retransmit, list) + list_for_each_entry(chunk, &q->retransmit, transmitted_list) cb(chunk);

- list_for_each_entry(chunk, &q->sacked, list) + list_for_each_entry(chunk, &q->sacked, transmitted_list) cb(chunk);

- list_for_each_entry(chunk, &q->abandoned, list) + list_for_each_entry(chunk, &q->abandoned, transmitted_list) cb(chunk);

list_for_each_entry(chunk, &q->out_chunk_list, list) @@@ -3891,17 -3891,13 +3891,17 @@@ static int sctp_setsockopt_reset_stream struct sctp_association *asoc; int retval = -EINVAL;

- if (optlen < sizeof(struct sctp_reset_streams)) + if (optlen < sizeof(*params)) return -EINVAL;

params = memdup_user(optval, optlen); if (IS_ERR(params)) return PTR_ERR(params);

+ if (params->srs_number_streams * sizeof(__u16) > + optlen - sizeof(*params)) + goto out; + asoc = sctp_id2assoc(sk, params->srs_assoc_id); if (!asoc) goto out; @@@ -5084,6 -5080,7 +5084,6 @@@ static int sctp_getsockopt_peeloff_comm *newfile = sock_alloc_file(newsock, 0, NULL); if (IS_ERR(*newfile)) { put_unused_fd(retval); - sock_release(newsock); retval = PTR_ERR(*newfile); *newfile = NULL; return retval; @@@ -7500,11 -7497,11 +7500,11 @@@ out * here, again, by modeling the current TCP/UDP code. We don't have * a good way to test with it yet. */ - unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait) + __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct sctp_sock *sp = sctp_sk(sk); - unsigned int mask; + __poll_t mask;

poll_wait(file, sk_sleep(sk), wait);

diff --combined net/socket.c index 05f361faec45,3e5e4f13046c..092baa464afc --- a/net/socket.c +++ b/net/socket.c @@@ -118,7 -118,7 +118,7 @@@ static ssize_t sock_write_iter(struct k static int sock_mmap(struct file *file, struct vm_area_struct *vma);

static int sock_close(struct inode *inode, struct file *file); - static unsigned int sock_poll(struct file *file, + static __poll_t sock_poll(struct file *file, struct poll_table_struct *wait); static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg); #ifdef CONFIG_COMPAT @@@ -406,10 -406,8 +406,10 @@@ struct file *sock_alloc_file(struct soc name.len = strlen(name.name); } path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name); - if (unlikely(!path.dentry)) + if (unlikely(!path.dentry)) { + sock_release(sock); return ERR_PTR(-ENOMEM); + } path.mnt = mntget(sock_mnt);

d_instantiate(path.dentry, SOCK_INODE(sock)); @@@ -417,11 -415,9 +417,11 @@@ file = alloc_file(&path, FMODE_READ | FMODE_WRITE, &socket_file_ops); if (IS_ERR(file)) { - /* drop dentry, keep inode */ + /* drop dentry, keep inode for a bit */ ihold(d_inode(path.dentry)); path_put(&path); + /* ... and now kill it properly */ + sock_release(sock); return file; }

@@@ -1095,9 -1091,9 +1095,9 @@@ out_release EXPORT_SYMBOL(sock_create_lite);

/* No kernel lock held - perfect */ - static unsigned int sock_poll(struct file *file, poll_table *wait) + static __poll_t sock_poll(struct file *file, poll_table *wait) { - unsigned int busy_flag = 0; + __poll_t busy_flag = 0; struct socket *sock;

/* @@@ -1334,9 -1330,19 +1334,9 @@@ SYSCALL_DEFINE3(socket, int, family, in

retval = sock_create(family, type, protocol, &sock); if (retval < 0) - goto out; - - retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK)); - if (retval < 0) - goto out_release; - -out: - /* It may be already another descriptor 8) Not kernel problem. */ - return retval; + return retval;

-out_release: - sock_release(sock); - return retval; + return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK)); }

/* @@@ -1360,72 -1366,87 +1360,72 @@@ SYSCALL_DEFINE4(socketpair, int, family flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

/* + * reserve descriptors and make sure we won't fail + * to return them to userland. + */ + fd1 = get_unused_fd_flags(flags); + if (unlikely(fd1 < 0)) + return fd1; + + fd2 = get_unused_fd_flags(flags); + if (unlikely(fd2 < 0)) { + put_unused_fd(fd1); + return fd2; + } + + err = put_user(fd1, &usockvec[0]); + if (err) + goto out; + + err = put_user(fd2, &usockvec[1]); + if (err) + goto out; + + /* * Obtain the first socket and check if the underlying protocol * supports the socketpair call. */

err = sock_create(family, type, protocol, &sock1); - if (err < 0) + if (unlikely(err < 0)) goto out;

err = sock_create(family, type, protocol, &sock2); - if (err < 0) - goto out_release_1; - - err = sock1->ops->socketpair(sock1, sock2); - if (err < 0) - goto out_release_both; - - fd1 = get_unused_fd_flags(flags); - if (unlikely(fd1 < 0)) { - err = fd1; - goto out_release_both; + if (unlikely(err < 0)) { + sock_release(sock1); + goto out; }

- fd2 = get_unused_fd_flags(flags); - if (unlikely(fd2 < 0)) { - err = fd2; - goto out_put_unused_1; + err = sock1->ops->socketpair(sock1, sock2); + if (unlikely(err < 0)) { + sock_release(sock2); + sock_release(sock1); + goto out; }

newfile1 = sock_alloc_file(sock1, flags, NULL); if (IS_ERR(newfile1)) { err = PTR_ERR(newfile1); - goto out_put_unused_both; + sock_release(sock2); + goto out; }

newfile2 = sock_alloc_file(sock2, flags, NULL); if (IS_ERR(newfile2)) { err = PTR_ERR(newfile2); - goto out_fput_1; + fput(newfile1); + goto out; }

- err = put_user(fd1, &usockvec[0]); - if (err) - goto out_fput_both; - - err = put_user(fd2, &usockvec[1]); - if (err) - goto out_fput_both; - audit_fd_pair(fd1, fd2);

fd_install(fd1, newfile1); fd_install(fd2, newfile2); - /* fd1 and fd2 may be already another descriptors. - * Not kernel problem. - */ - return 0;

-out_fput_both: - fput(newfile2); - fput(newfile1); - put_unused_fd(fd2); - put_unused_fd(fd1); - goto out; - -out_fput_1: - fput(newfile1); - put_unused_fd(fd2); - put_unused_fd(fd1); - sock_release(sock2); - goto out; - -out_put_unused_both: +out: put_unused_fd(fd2); -out_put_unused_1: put_unused_fd(fd1); -out_release_both: - sock_release(sock2); -out_release_1: - sock_release(sock1); -out: return err; }

@@@ -1541,6 -1562,7 +1541,6 @@@ SYSCALL_DEFINE4(accept4, int, fd, struc if (IS_ERR(newfile)) { err = PTR_ERR(newfile); put_unused_fd(newfd); - sock_release(newsock); goto out_put; }

diff --combined net/sunrpc/cache.c index e68943895be4,c20ac7af7a4c..aa36dad32db1 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@@ -930,10 -930,10 +930,10 @@@ out

static DECLARE_WAIT_QUEUE_HEAD(queue_wait);

- static unsigned int cache_poll(struct file *filp, poll_table *wait, + static __poll_t cache_poll(struct file *filp, poll_table *wait, struct cache_detail *cd) { - unsigned int mask; + __poll_t mask; struct cache_reader *rp = filp->private_data; struct cache_queue *cq;

@@@ -1501,7 -1501,7 +1501,7 @@@ static ssize_t cache_write_procfs(struc return cache_write(filp, buf, count, ppos, cd); }

- static unsigned int cache_poll_procfs(struct file *filp, poll_table *wait) + static __poll_t cache_poll_procfs(struct file *filp, poll_table *wait) { struct cache_detail *cd = PDE_DATA(file_inode(filp));

@@@ -1674,7 -1674,7 +1674,7 @@@ void cache_unregister_net(struct cache_ } EXPORT_SYMBOL_GPL(cache_unregister_net);

-struct cache_detail *cache_create_net(struct cache_detail *tmpl, struct net *net) +struct cache_detail *cache_create_net(const struct cache_detail *tmpl, struct net *net) { struct cache_detail *cd; int i; @@@ -1720,7 -1720,7 +1720,7 @@@ static ssize_t cache_write_pipefs(struc return cache_write(filp, buf, count, ppos, cd); }

- static unsigned int cache_poll_pipefs(struct file *filp, poll_table *wait) + static __poll_t cache_poll_pipefs(struct file *filp, poll_table *wait) { struct cache_detail *cd = RPC_I(file_inode(filp))->private;

diff --combined net/tipc/server.c index d60c30342327,0c3b74d1e722..78a292a84afc --- a/net/tipc/server.c +++ b/net/tipc/server.c @@@ -264,8 -264,8 +264,8 @@@ static int tipc_receive_from_sock(struc iov.iov_base = buf; iov.iov_len = s->max_rcvbuf_size; msg.msg_name = &addr; - ret = kernel_recvmsg(con->sock, &msg, &iov, 1, iov.iov_len, - MSG_DONTWAIT); + iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, iov.iov_len); + ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT); if (ret <= 0) { kmem_cache_free(s->rcvbuf_cache, buf); goto out_close; @@@ -314,7 -314,6 +314,7 @@@ static int tipc_accept_from_sock(struc newcon->usr_data = s->tipc_conn_new(newcon->conid); if (!newcon->usr_data) { sock_release(newsock); + conn_put(newcon); return -ENOMEM; }

@@@ -512,7 -511,7 +512,7 @@@ bool tipc_topsrv_kern_subscr(struct ne s = con->server; scbr = s->tipc_conn_new(*conid); if (!scbr) { - tipc_close_conn(con); + conn_put(con); return false; }

diff --combined net/tipc/socket.c index 41127d0b925e,d94d25855190..fcbd6489a8b5 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@@ -710,13 -710,13 +710,13 @@@ static int tipc_getname(struct socket * * imply that the operation will succeed, merely that it should be performed * and will not block. */ - static unsigned int tipc_poll(struct file *file, struct socket *sock, + static __poll_t tipc_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct tipc_sock *tsk = tipc_sk(sk); struct tipc_group *grp = tsk->group; - u32 revents = 0; + __poll_t revents = 0;

sock_poll_wait(file, sk_sleep(sk), wait);

@@@ -1140,7 -1140,7 +1140,7 @@@ void tipc_sk_mcast_rcv(struct net *net __skb_dequeue(arrvq); __skb_queue_tail(inputq, skb); } - refcount_dec(&skb->users); + kfree_skb(skb); spin_unlock_bh(&inputq->lock); continue; } diff --combined security/apparmor/apparmorfs.c index d4fa04d91439,77d30a821b85..4d202b73a0e1 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@@ -571,10 -571,10 +571,10 @@@ static int ns_revision_open(struct inod return 0; }

- static unsigned int ns_revision_poll(struct file *file, poll_table *pt) + static __poll_t ns_revision_poll(struct file *file, poll_table *pt) { struct aa_revision *rev = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

if (rev) { mutex_lock_nested(&rev->ns->lock, rev->ns->level); @@@ -2451,7 -2451,7 +2451,7 @@@ static int __init aa_create_aafs(void aafs_mnt = kern_mount(&aafs_ops); if (IS_ERR(aafs_mnt)) panic("can't set apparmorfs up\n"); - aafs_mnt->mnt_sb->s_flags &= ~MS_NOUSER; + aafs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;

/* Populate fs tree. */ error = entry_create_dir(&aa_sfs_entry, NULL); diff --combined sound/core/rawmidi.c index f055ca10bbc1,e7e4930732a3..fae21311723f --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@@ -579,14 -579,15 +579,14 @@@ static int snd_rawmidi_info_user(struc return 0; }

-int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info) +static int __snd_rawmidi_info_select(struct snd_card *card, + struct snd_rawmidi_info *info) { struct snd_rawmidi *rmidi; struct snd_rawmidi_str *pstr; struct snd_rawmidi_substream *substream;

- mutex_lock(&register_mutex); rmidi = snd_rawmidi_search(card, info->device); - mutex_unlock(&register_mutex); if (!rmidi) return -ENXIO; if (info->stream < 0 || info->stream > 1) @@@ -602,16 -603,6 +602,16 @@@ } return -ENXIO; } + +int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info) +{ + int ret; + + mutex_lock(&register_mutex); + ret = __snd_rawmidi_info_select(card, info); + mutex_unlock(&register_mutex); + return ret; +} EXPORT_SYMBOL(snd_rawmidi_info_select);

static int snd_rawmidi_info_select_user(struct snd_card *card, @@@ -1366,11 -1357,11 +1366,11 @@@ static ssize_t snd_rawmidi_write(struc return result; }

- static unsigned int snd_rawmidi_poll(struct file *file, poll_table * wait) + static __poll_t snd_rawmidi_poll(struct file *file, poll_table * wait) { struct snd_rawmidi_file *rfile; struct snd_rawmidi_runtime *runtime; - unsigned int mask; + __poll_t mask;

rfile = file->private_data; if (rfile->input != NULL) { diff --combined virt/kvm/kvm_main.c index 210bf820385a,ae4985bc8a8a..d6b9370806f8 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@@ -135,11 -135,6 +135,11 @@@ static void kvm_uevent_notify_change(un static unsigned long long kvm_createvm_count; static unsigned long long kvm_active_vms;

+__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, + unsigned long start, unsigned long end) +{ +} + bool kvm_is_reserved_pfn(kvm_pfn_t pfn) { if (pfn_valid(pfn)) @@@ -365,9 -360,6 +365,9 @@@ static void kvm_mmu_notifier_invalidate kvm_flush_remote_tlbs(kvm);

spin_unlock(&kvm->mmu_lock); + + kvm_arch_mmu_notifier_invalidate_range(kvm, start, end); + srcu_read_unlock(&kvm->srcu, idx); }

@@@ -1322,17 -1314,6 +1322,6 @@@ unsigned long kvm_vcpu_gfn_to_hva_prot( return gfn_to_hva_memslot_prot(slot, gfn, writable); }

- static int get_user_page_nowait(unsigned long start, int write, - struct page **page) - { - int flags = FOLL_NOWAIT | FOLL_HWPOISON; - - if (write) - flags |= FOLL_WRITE; - - return get_user_pages(start, 1, flags, page, NULL); - } - static inline int check_user_page_hwpoison(unsigned long addr) { int rc, flags = FOLL_HWPOISON | FOLL_WRITE; @@@ -1381,7 -1362,8 +1370,8 @@@ static bool hva_to_pfn_fast(unsigned lo static int hva_to_pfn_slow(unsigned long addr, bool *async, bool write_fault, bool *writable, kvm_pfn_t *pfn) { - struct page *page[1]; + unsigned int flags = FOLL_HWPOISON; + struct page *page; int npages = 0;

might_sleep(); @@@ -1389,35 -1371,26 +1379,26 @@@ if (writable) *writable = write_fault;

- if (async) { - down_read(&current->mm->mmap_sem); - npages = get_user_page_nowait(addr, write_fault, page); - up_read(&current->mm->mmap_sem); - } else { - unsigned int flags = FOLL_HWPOISON; - - if (write_fault) - flags |= FOLL_WRITE; + if (write_fault) + flags |= FOLL_WRITE; + if (async) + flags |= FOLL_NOWAIT;

- npages = get_user_pages_unlocked(addr, 1, page, flags); - } + npages = get_user_pages_unlocked(addr, 1, &page, flags); if (npages != 1) return npages;

/* map read fault as writable if possible */ if (unlikely(!write_fault) && writable) { - struct page *wpage[1]; + struct page *wpage;

- npages = __get_user_pages_fast(addr, 1, 1, wpage); - if (npages == 1) { + if (__get_user_pages_fast(addr, 1, 1, &wpage) == 1) { *writable = true; - put_page(page[0]); - page[0] = wpage[0]; + put_page(page); + page = wpage; } - - npages = 1; } - *pfn = page_to_pfn(page[0]); + *pfn = page_to_pfn(page); return npages; }

@@@ -2073,29 -2046,6 +2054,29 @@@ void kvm_vcpu_mark_page_dirty(struct kv } EXPORT_SYMBOL_GPL(kvm_vcpu_mark_page_dirty);

+void kvm_sigset_activate(struct kvm_vcpu *vcpu) +{ + if (!vcpu->sigset_active) + return; + + /* + * This does a lockless modification of ->real_blocked, which is fine + * because, only current can change ->real_blocked and all readers of + * ->real_blocked don't care as long ->real_blocked is always a subset + * of ->blocked. + */ + sigprocmask(SIG_SETMASK, &vcpu->sigset, &current->real_blocked); +} + +void kvm_sigset_deactivate(struct kvm_vcpu *vcpu) +{ + if (!vcpu->sigset_active) + return; + + sigprocmask(SIG_SETMASK, &current->real_blocked, NULL); + sigemptyset(&current->real_blocked); +} + static void grow_halt_poll_ns(struct kvm_vcpu *vcpu) { unsigned int old, val, grow;