The following commit has been merged in the master branch: commit 168fe32a072a4b8dc81a3aebf0e5e588d38e2955 Merge: 13ddd1667e7f01071cdf120132238ffca004a88e c71d227fc4133f949dae620ed5e3a250b43f2415 Author: Linus Torvalds torvalds@linux-foundation.org Date: Tue Jan 30 17:58:07 2018 -0800

Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull poll annotations from Al Viro: "This introduces a __bitwise type for POLL### bitmap, and propagates the annotations through the tree. Most of that stuff is as simple as 'make ->poll() instances return __poll_t and do the same to local variables used to hold the future return value'.

Some of the obvious brainos found in process are fixed (e.g. POLLIN misspelled as POLL_IN). At that point the amount of sparse warnings is low and most of them are for genuine bugs - e.g. ->poll() instance deciding to return -EINVAL instead of a bitmap. I hadn't touched those in this series - it's large enough as it is.

Another problem it has caught was eventpoll() ABI mess; select.c and eventpoll.c assumed that corresponding POLL### and EPOLL### were equal. That's true for some, but not all of them - EPOLL### are arch-independent, but POLL### are not.

The last commit in this series separates userland POLL### values from the (now arch-independent) kernel-side ones, converting between them in the few places where they are copied to/from userland. AFAICS, this is the least disruptive fix preserving poll(2) ABI and making epoll() work on all architectures.

As it is, it's simply broken on sparc - try to give it EPOLLWRNORM and it will trigger only on what would've triggered EPOLLWRBAND on other architectures. EPOLLWRBAND and EPOLLRDHUP, OTOH, are never triggered at all on sparc. With this patch they should work consistently on all architectures"

* 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (37 commits) make kernel-side POLL... arch-independent eventpoll: no need to mask the result of epi_item_poll() again eventpoll: constify struct epoll_event pointers debugging printk in sg_poll() uses %x to print POLL... bitmap annotate poll(2) guts 9p: untangle ->poll() mess ->si_band gets POLL... bitmap stored into a user-visible long field ring_buffer_poll_wait() return value used as return value of ->poll() the rest of drivers/*: annotate ->poll() instances media: annotate ->poll() instances fs: annotate ->poll() instances ipc, kernel, mm: annotate ->poll() instances net: annotate ->poll() instances apparmor: annotate ->poll() instances tomoyo: annotate ->poll() instances sound: annotate ->poll() instances acpi: annotate ->poll() instances crypto: annotate ->poll() instances block: annotate ->poll() instances x86: annotate ->poll() instances ...

diff --combined arch/alpha/include/uapi/asm/Kbuild index 14a2e9af97e9,574fe90c8b58..9afaba5e5503 --- a/arch/alpha/include/uapi/asm/Kbuild +++ b/arch/alpha/include/uapi/asm/Kbuild @@@ -1,4 -1,4 +1,5 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h diff --combined arch/ia64/include/uapi/asm/Kbuild index f5c6967a93bb,4c9825edd4a3..c0527cfc48f0 --- a/arch/ia64/include/uapi/asm/Kbuild +++ b/arch/ia64/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generic-y += kvm_para.h + generic-y += poll.h diff --combined arch/m32r/include/uapi/asm/Kbuild index 451bf6071c6e,21f241553a2e..c3df55aeefe7 --- a/arch/m32r/include/uapi/asm/Kbuild +++ b/arch/m32r/include/uapi/asm/Kbuild @@@ -1,6 -1,6 +1,7 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generic-y += kvm_para.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/mn10300/include/uapi/asm/Kbuild index 81271d3af47c,162fbdbb5fd5..b04fd1632051 --- a/arch/mn10300/include/uapi/asm/Kbuild +++ b/arch/mn10300/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/score/include/uapi/asm/Kbuild index 81271d3af47c,162fbdbb5fd5..b04fd1632051 --- a/arch/score/include/uapi/asm/Kbuild +++ b/arch/score/include/uapi/asm/Kbuild @@@ -1,5 -1,5 +1,6 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h + generic-y += poll.h generic-y += siginfo.h diff --combined arch/x86/include/uapi/asm/Kbuild index 1e901e421f2d,e9f6b8e332bd..322681622d1e --- a/arch/x86/include/uapi/asm/Kbuild +++ b/arch/x86/include/uapi/asm/Kbuild @@@ -1,7 -1,7 +1,8 @@@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm

+generic-y += bpf_perf_event.h generated-y += unistd_32.h generated-y += unistd_64.h generated-y += unistd_x32.h + generic-y += poll.h diff --combined block/bsg.c index a1bcbb6ba50b,636bfcdb5d5f..2e2c1e222209 --- a/block/bsg.c +++ b/block/bsg.c @@@ -32,9 -32,6 +32,9 @@@ #define BSG_DESCRIPTION "Block layer SCSI generic (bsg) driver" #define BSG_VERSION "0.4"

+#define bsg_dbg(bd, fmt, ...) \ + pr_debug("%s: " fmt, (bd)->name, ##__VA_ARGS__) + struct bsg_device { struct request_queue *queue; spinlock_t lock; @@@ -58,6 -55,14 +58,6 @@@ enum #define BSG_DEFAULT_CMDS 64 #define BSG_MAX_DEVS 32768

-#undef BSG_DEBUG - -#ifdef BSG_DEBUG -#define dprintk(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ##args) -#else -#define dprintk(fmt, args...) -#endif - static DEFINE_MUTEX(bsg_mutex); static DEFINE_IDR(bsg_minor_idr);

@@@ -118,7 -123,7 +118,7 @@@ static struct bsg_command *bsg_alloc_co

bc->bd = bd; INIT_LIST_HEAD(&bc->list); - dprintk("%s: returning free cmd %p\n", bd->name, bc); + bsg_dbg(bd, "returning free cmd %p\n", bc); return bc; out: spin_unlock_irq(&bd->lock); @@@ -217,8 -222,7 +217,8 @@@ bsg_map_hdr(struct bsg_device *bd, stru if (!bcd->class_dev) return ERR_PTR(-ENXIO);

- dprintk("map hdr %llx/%u %llx/%u\n", (unsigned long long) hdr->dout_xferp, + bsg_dbg(bd, "map hdr %llx/%u %llx/%u\n", + (unsigned long long) hdr->dout_xferp, hdr->dout_xfer_len, (unsigned long long) hdr->din_xferp, hdr->din_xfer_len);

@@@ -295,8 -299,8 +295,8 @@@ static void bsg_rq_end_io(struct reques struct bsg_device *bd = bc->bd; unsigned long flags;

- dprintk("%s: finished rq %p bc %p, bio %p\n", - bd->name, rq, bc, bc->bio); + bsg_dbg(bd, "finished rq %p bc %p, bio %p\n", + rq, bc, bc->bio);

bc->hdr.duration = jiffies_to_msecs(jiffies - bc->hdr.duration);

@@@ -329,7 -333,7 +329,7 @@@ static void bsg_add_command(struct bsg_ list_add_tail(&bc->list, &bd->busy_list); spin_unlock_irq(&bd->lock);

- dprintk("%s: queueing rq %p, bc %p\n", bd->name, rq, bc); + bsg_dbg(bd, "queueing rq %p, bc %p\n", rq, bc);

rq->end_io_data = bc; blk_execute_rq_nowait(q, NULL, rq, at_head, bsg_rq_end_io); @@@ -375,7 -379,7 +375,7 @@@ static struct bsg_command *bsg_get_done } } while (1);

- dprintk("%s: returning done %p\n", bd->name, bc); + bsg_dbg(bd, "returning done %p\n", bc);

return bc; } @@@ -386,7 -390,7 +386,7 @@@ static int blk_complete_sgv4_hdr_rq(str struct scsi_request *req = scsi_req(rq); int ret = 0;

- dprintk("rq %p bio %p 0x%x\n", rq, bio, req->result); + pr_debug("rq %p bio %p 0x%x\n", rq, bio, req->result); /* * fill in all the output members */ @@@ -465,7 -469,7 +465,7 @@@ static int bsg_complete_all_commands(st struct bsg_command *bc; int ret, tret;

- dprintk("%s: entered\n", bd->name); + bsg_dbg(bd, "entered\n");

/* * wait for all commands to complete @@@ -568,7 -572,7 +568,7 @@@ bsg_read(struct file *file, char __use int ret; ssize_t bytes_read;

- dprintk("%s: read %zd bytes\n", bd->name, count); + bsg_dbg(bd, "read %zd bytes\n", count);

bsg_set_block(bd, file);

@@@ -642,7 -646,7 +642,7 @@@ bsg_write(struct file *file, const cha ssize_t bytes_written; int ret;

- dprintk("%s: write %zd bytes\n", bd->name, count); + bsg_dbg(bd, "write %zd bytes\n", count);

if (unlikely(uaccess_kernel())) return -EINVAL; @@@ -660,7 -664,7 +660,7 @@@ if (!bytes_written || err_block_err(ret)) bytes_written = ret;

- dprintk("%s: returning %zd\n", bd->name, bytes_written); + bsg_dbg(bd, "returning %zd\n", bytes_written); return bytes_written; }

@@@ -713,7 -717,7 +713,7 @@@ static int bsg_put_device(struct bsg_de hlist_del(&bd->dev_list); mutex_unlock(&bsg_mutex);

- dprintk("%s: tearing down\n", bd->name); + bsg_dbg(bd, "tearing down\n");

/* * close can always block @@@ -740,7 -744,9 +740,7 @@@ static struct bsg_device *bsg_add_devic struct file *file) { struct bsg_device *bd; -#ifdef BSG_DEBUG unsigned char buf[32]; -#endif

if (!blk_queue_scsi_passthrough(rq)) { WARN_ONCE(true, "Attempt to register a non-SCSI queue\n"); @@@ -765,7 -771,7 +765,7 @@@ hlist_add_head(&bd->dev_list, bsg_dev_idx_hash(iminor(inode)));

strncpy(bd->name, dev_name(rq->bsg_dev.class_dev), sizeof(bd->name) - 1); - dprintk("bound to <%s>, max queue %d\n", + bsg_dbg(bd, "bound to <%s>, max queue %d\n", format_dev_t(buf, inode->i_rdev), bd->max_queue);

mutex_unlock(&bsg_mutex); @@@ -839,10 -845,10 +839,10 @@@ static int bsg_release(struct inode *in return bsg_put_device(bd); }

- static unsigned int bsg_poll(struct file *file, poll_table *wait) + static __poll_t bsg_poll(struct file *file, poll_table *wait) { struct bsg_device *bd = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &bd->wq_done, wait); poll_wait(file, &bd->wq_free, wait); diff --combined crypto/af_alg.c index 35d4dcea381f,a00a8171b4f6..f41047ab60f5 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@@ -664,7 -664,7 +664,7 @@@ void af_alg_free_areq_sgls(struct af_al unsigned int i;

list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) { - ctx->rcvused -= rsgl->sg_num_bytes; + atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused); af_alg_free_sg(&rsgl->sgl); list_del(&rsgl->list); if (rsgl != &areq->first_rsgl) @@@ -672,15 -672,14 +672,15 @@@ }

tsgl = areq->tsgl; - for_each_sg(tsgl, sg, areq->tsgl_entries, i) { - if (!sg_page(sg)) - continue; - put_page(sg_page(sg)); - } + if (tsgl) { + for_each_sg(tsgl, sg, areq->tsgl_entries, i) { + if (!sg_page(sg)) + continue; + put_page(sg_page(sg)); + }

- if (areq->tsgl && areq->tsgl_entries) sock_kfree_s(sk, tsgl, areq->tsgl_entries * sizeof(*tsgl)); + } } EXPORT_SYMBOL_GPL(af_alg_free_areq_sgls);

@@@ -1022,18 -1021,6 +1022,18 @@@ unlock EXPORT_SYMBOL_GPL(af_alg_sendpage);

/** + * af_alg_free_resources - release resources required for crypto request + */ +void af_alg_free_resources(struct af_alg_async_req *areq) +{ + struct sock *sk = areq->sk; + + af_alg_free_areq_sgls(areq); + sock_kfree_s(sk, areq, areq->areqlen); +} +EXPORT_SYMBOL_GPL(af_alg_free_resources); + +/** * af_alg_async_cb - AIO callback handler * * This handler cleans up the struct af_alg_async_req upon completion of the @@@ -1049,26 -1036,31 +1049,26 @@@ void af_alg_async_cb(struct crypto_asyn struct kiocb *iocb = areq->iocb; unsigned int resultlen;

- lock_sock(sk); - /* Buffer size written by crypto operation. */ resultlen = areq->outlen;

- af_alg_free_areq_sgls(areq); - sock_kfree_s(sk, areq, areq->areqlen); - __sock_put(sk); + af_alg_free_resources(areq); + sock_put(sk);

iocb->ki_complete(iocb, err ? err : resultlen, 0); - - release_sock(sk); } EXPORT_SYMBOL_GPL(af_alg_async_cb);

/** * af_alg_poll - poll system call handler */ - unsigned int af_alg_poll(struct file *file, struct socket *sock, + __poll_t af_alg_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct alg_sock *ask = alg_sk(sk); struct af_alg_ctx *ctx = ask->private; - unsigned int mask; + __poll_t mask;

sock_poll_wait(file, sk_sleep(sk), wait); mask = 0; @@@ -1138,6 -1130,12 +1138,6 @@@ int af_alg_get_rsgl(struct sock *sk, st if (!af_alg_readable(sk)) break;

- if (!ctx->used) { - err = af_alg_wait_for_data(sk, flags); - if (err) - return err; - } - seglen = min_t(size_t, (maxsize - len), msg_data_left(msg));

@@@ -1163,7 -1161,7 +1163,7 @@@

areq->last_rsgl = rsgl; len += err; - ctx->rcvused += err; + atomic_add(err, &ctx->rcvused); rsgl->sg_num_bytes = err; iov_iter_advance(&msg->msg_iter, err); } diff --combined crypto/algif_skcipher.c index c5c47b680152,c86207f267e2..f50907430c92 --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@@ -72,12 -72,6 +72,12 @@@ static int _skcipher_recvmsg(struct soc int err = 0; size_t len = 0;

+ if (!ctx->used) { + err = af_alg_wait_for_data(sk, flags); + if (err) + return err; + } + /* Allocate cipher request for current operation. */ areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) + crypto_skcipher_reqsize(tfm)); @@@ -123,24 -117,13 +123,24 @@@

if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) { /* AIO operation */ + sock_hold(sk); areq->iocb = msg->msg_iocb; + + /* Remember output size that will be generated. */ + areq->outlen = len; + skcipher_request_set_callback(&areq->cra_u.skcipher_req, CRYPTO_TFM_REQ_MAY_SLEEP, af_alg_async_cb, areq); err = ctx->enc ? crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) : crypto_skcipher_decrypt(&areq->cra_u.skcipher_req); + + /* AIO operation in progress */ + if (err == -EINPROGRESS || err == -EBUSY) + return -EIOCBQUEUED; + + sock_put(sk); } else { /* Synchronous operation */ skcipher_request_set_callback(&areq->cra_u.skcipher_req, @@@ -153,9 -136,19 +153,9 @@@ &ctx->wait); }

- /* AIO operation in progress */ - if (err == -EINPROGRESS) { - sock_hold(sk); - - /* Remember output size that will be generated. */ - areq->outlen = len; - - return -EIOCBQUEUED; - }

free: - af_alg_free_areq_sgls(areq); - sock_kfree_s(sk, areq, areq->areqlen); + af_alg_free_resources(areq);

return err ? err : len; } @@@ -193,7 -186,6 +193,6 @@@ out return ret; }

- static struct proto_ops algif_skcipher_ops = { .family = PF_ALG,

@@@ -390,7 -382,7 +389,7 @@@ static int skcipher_accept_parent_nokey INIT_LIST_HEAD(&ctx->tsgl_list); ctx->len = len; ctx->used = 0; - ctx->rcvused = 0; + atomic_set(&ctx->rcvused, 0); ctx->more = 0; ctx->merge = 0; ctx->enc = 0; diff --combined drivers/android/binder.c index a7ecfde66b7b,fdc951083b07..cc89d0d2b965 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@@ -482,8 -482,7 +482,8 @@@ enum binder_deferred_state * @tsk task_struct for group_leader of process * (invariant after initialized) * @files files_struct for process - * (invariant after initialized) + * (protected by @files_lock) + * @files_lock mutex to protect @files * @deferred_work_node: element for binder_deferred_list * (protected by binder_deferred_lock) * @deferred_work: bitmap of deferred work to perform @@@ -531,7 -530,6 +531,7 @@@ struct binder_proc int pid; struct task_struct *tsk; struct files_struct *files; + struct mutex files_lock; struct hlist_node deferred_work_node; int deferred_work; bool is_dead; @@@ -879,26 -877,20 +879,26 @@@ static void binder_inc_node_tmpref_iloc

static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) { - struct files_struct *files = proc->files; unsigned long rlim_cur; unsigned long irqs; + int ret;

- if (files == NULL) - return -ESRCH; - - if (!lock_task_sighand(proc->tsk, &irqs)) - return -EMFILE; - + mutex_lock(&proc->files_lock); + if (proc->files == NULL) { + ret = -ESRCH; + goto err; + } + if (!lock_task_sighand(proc->tsk, &irqs)) { + ret = -EMFILE; + goto err; + } rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); unlock_task_sighand(proc->tsk, &irqs);

- return __alloc_fd(files, 0, rlim_cur, flags); + ret = __alloc_fd(proc->files, 0, rlim_cur, flags); +err: + mutex_unlock(&proc->files_lock); + return ret; }

/* @@@ -907,10 -899,8 +907,10 @@@ static void task_fd_install( struct binder_proc *proc, unsigned int fd, struct file *file) { + mutex_lock(&proc->files_lock); if (proc->files) __fd_install(proc->files, fd, file); + mutex_unlock(&proc->files_lock); }

/* @@@ -920,11 -910,9 +920,11 @@@ static long task_close_fd(struct binder { int retval;

- if (proc->files == NULL) - return -ESRCH; - + mutex_lock(&proc->files_lock); + if (proc->files == NULL) { + retval = -ESRCH; + goto err; + } retval = __close_fd(proc->files, fd); /* can't restart close syscall because file table entry was cleared */ if (unlikely(retval == -ERESTARTSYS || @@@ -932,8 -920,7 +932,8 @@@ retval == -ERESTARTNOHAND || retval == -ERESTART_RESTARTBLOCK)) retval = -EINTR; - +err: + mutex_unlock(&proc->files_lock); return retval; }

@@@ -1961,26 -1948,6 +1961,26 @@@ static void binder_send_failed_reply(st }

/** + * binder_cleanup_transaction() - cleans up undelivered transaction + * @t: transaction that needs to be cleaned up + * @reason: reason the transaction wasn't delivered + * @error_code: error to return to caller (if synchronous call) + */ +static void binder_cleanup_transaction(struct binder_transaction *t, + const char *reason, + uint32_t error_code) +{ + if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) { + binder_send_failed_reply(t, error_code); + } else { + binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, + "undelivered transaction %d, %s\n", + t->debug_id, reason); + binder_free_transaction(t); + } +} + +/** * binder_validate_object() - checks for a valid metadata object in a buffer. * @buffer: binder_buffer that we're parsing. * @offset: offset in the buffer at which to validate an object. @@@ -4048,20 -4015,12 +4048,20 @@@ retry if (put_user(cmd, (uint32_t __user *)ptr)) { if (t_from) binder_thread_dec_tmpref(t_from); + + binder_cleanup_transaction(t, "put_user failed", + BR_FAILED_REPLY); + return -EFAULT; } ptr += sizeof(uint32_t); if (copy_to_user(ptr, &tr, sizeof(tr))) { if (t_from) binder_thread_dec_tmpref(t_from); + + binder_cleanup_transaction(t, "copy_to_user failed", + BR_FAILED_REPLY); + return -EFAULT; } ptr += sizeof(tr); @@@ -4131,9 -4090,15 +4131,9 @@@ static void binder_release_work(struct struct binder_transaction *t;

t = container_of(w, struct binder_transaction, work); - if (t->buffer->target_node && - !(t->flags & TF_ONE_WAY)) { - binder_send_failed_reply(t, BR_DEAD_REPLY); - } else { - binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, - "undelivered transaction %d\n", - t->debug_id); - binder_free_transaction(t); - } + + binder_cleanup_transaction(t, "process died.", + BR_DEAD_REPLY); } break; case BINDER_WORK_RETURN_ERROR: { struct binder_error *e = container_of( @@@ -4311,7 -4276,7 +4311,7 @@@ static int binder_thread_release(struc return active_transactions; }

- static unsigned int binder_poll(struct file *filp, + static __poll_t binder_poll(struct file *filp, struct poll_table_struct *wait) { struct binder_proc *proc = filp->private_data; @@@ -4640,9 -4605,7 +4640,9 @@@ static int binder_mmap(struct file *fil ret = binder_alloc_mmap_handler(&proc->alloc, vma); if (ret) return ret; + mutex_lock(&proc->files_lock); proc->files = get_files_struct(current); + mutex_unlock(&proc->files_lock); return 0;

err_bad_arg: @@@ -4666,7 -4629,6 +4666,7 @@@ static int binder_open(struct inode *no spin_lock_init(&proc->outer_lock); get_task_struct(current->group_leader); proc->tsk = current->group_leader; + mutex_init(&proc->files_lock); INIT_LIST_HEAD(&proc->todo); proc->default_priority = task_nice(current); binder_dev = container_of(filp->private_data, struct binder_device, @@@ -4919,11 -4881,9 +4919,11 @@@ static void binder_deferred_func(struc

files = NULL; if (defer & BINDER_DEFERRED_PUT_FILES) { + mutex_lock(&proc->files_lock); files = proc->files; if (files) proc->files = NULL; + mutex_unlock(&proc->files_lock); }

if (defer & BINDER_DEFERRED_FLUSH) diff --combined drivers/gpio/gpiolib.c index 14532d9576e4,46824c486e1e..5d6e8bb38ac7 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@@ -73,8 -73,7 +73,8 @@@ LIST_HEAD(gpio_devices)

static void gpiochip_free_hogs(struct gpio_chip *chip); static int gpiochip_add_irqchip(struct gpio_chip *gpiochip, - struct lock_class_key *key); + struct lock_class_key *lock_key, + struct lock_class_key *request_key); static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip); static int gpiochip_irqchip_init_valid_mask(struct gpio_chip *gpiochip); static void gpiochip_irqchip_free_valid_mask(struct gpio_chip *gpiochip); @@@ -604,11 -603,11 +604,11 @@@ struct lineevent_state (GPIOEVENT_REQUEST_RISING_EDGE | \ GPIOEVENT_REQUEST_FALLING_EDGE)

- static unsigned int lineevent_poll(struct file *filep, + static __poll_t lineevent_poll(struct file *filep, struct poll_table_struct *wait) { struct lineevent_state *le = filep->private_data; - unsigned int events = 0; + __poll_t events = 0;

poll_wait(filep, &le->wait, wait);

@@@ -1101,8 -1100,7 +1101,8 @@@ static void gpiochip_setup_devs(void }

int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data, - struct lock_class_key *key) + struct lock_class_key *lock_key, + struct lock_class_key *request_key) { unsigned long flags; int status = 0; @@@ -1248,7 -1246,7 +1248,7 @@@ if (status) goto err_remove_from_list;

- status = gpiochip_add_irqchip(chip, key); + status = gpiochip_add_irqchip(chip, lock_key, request_key); if (status) goto err_remove_chip;

@@@ -1634,7 -1632,7 +1634,7 @@@ int gpiochip_irq_map(struct irq_domain * This lock class tells lockdep that GPIO irqs are in a different * category than their parents, so it won't report false recursion. */ - irq_set_lockdep_class(irq, chip->irq.lock_key); + irq_set_lockdep_class(irq, chip->irq.lock_key, chip->irq.request_key); irq_set_chip_and_handler(irq, chip->irq.chip, chip->irq.handler); /* Chips that use nested thread handlers have them marked */ if (chip->irq.threaded) @@@ -1714,12 -1712,10 +1714,12 @@@ static int gpiochip_to_irq(struct gpio_ /** * gpiochip_add_irqchip() - adds an IRQ chip to a GPIO chip * @gpiochip: the GPIO chip to add the IRQ chip to - * @lock_key: lockdep class + * @lock_key: lockdep class for IRQ lock + * @request_key: lockdep class for IRQ request */ static int gpiochip_add_irqchip(struct gpio_chip *gpiochip, - struct lock_class_key *lock_key) + struct lock_class_key *lock_key, + struct lock_class_key *request_key) { struct irq_chip *irqchip = gpiochip->irq.chip; const struct irq_domain_ops *ops; @@@ -1757,7 -1753,6 +1757,7 @@@ gpiochip->to_irq = gpiochip_to_irq; gpiochip->irq.default_type = type; gpiochip->irq.lock_key = lock_key; + gpiochip->irq.request_key = request_key;

if (gpiochip->irq.domain_ops) ops = gpiochip->irq.domain_ops; @@@ -1855,8 -1850,7 +1855,8 @@@ static void gpiochip_irqchip_remove(str * @type: the default type for IRQs on this irqchip, pass IRQ_TYPE_NONE * to have the core avoid setting up any default type in the hardware. * @threaded: whether this irqchip uses a nested thread handler - * @lock_key: lockdep class + * @lock_key: lockdep class for IRQ lock + * @request_key: lockdep class for IRQ request * * This function closely associates a certain irqchip with a certain * gpiochip, providing an irq domain to translate the local IRQs to @@@ -1878,8 -1872,7 +1878,8 @@@ int gpiochip_irqchip_add_key(struct gpi irq_flow_handler_t handler, unsigned int type, bool threaded, - struct lock_class_key *lock_key) + struct lock_class_key *lock_key, + struct lock_class_key *request_key) { struct device_node *of_node;

@@@ -1920,7 -1913,6 +1920,7 @@@ gpiochip->irq.default_type = type; gpiochip->to_irq = gpiochip_to_irq; gpiochip->irq.lock_key = lock_key; + gpiochip->irq.request_key = request_key; gpiochip->irq.domain = irq_domain_add_simple(of_node, gpiochip->ngpio, first_irq, &gpiochip_domain_ops, gpiochip); @@@ -1948,8 -1940,7 +1948,8 @@@ EXPORT_SYMBOL_GPL(gpiochip_irqchip_add_ #else /* CONFIG_GPIOLIB_IRQCHIP */

static inline int gpiochip_add_irqchip(struct gpio_chip *gpiochip, - struct lock_class_key *key) + struct lock_class_key *lock_key, + struct lock_class_key *request_key) { return 0; } @@@ -2893,27 -2884,6 +2893,27 @@@ void gpiod_set_raw_value(struct gpio_de EXPORT_SYMBOL_GPL(gpiod_set_raw_value);

/** + * gpiod_set_value_nocheck() - set a GPIO line value without checking + * @desc: the descriptor to set the value on + * @value: value to set + * + * This sets the value of a GPIO line backing a descriptor, applying + * different semantic quirks like active low and open drain/source + * handling. + */ +static void gpiod_set_value_nocheck(struct gpio_desc *desc, int value) +{ + if (test_bit(FLAG_ACTIVE_LOW, &desc->flags)) + value = !value; + if (test_bit(FLAG_OPEN_DRAIN, &desc->flags)) + gpio_set_open_drain_value_commit(desc, value); + else if (test_bit(FLAG_OPEN_SOURCE, &desc->flags)) + gpio_set_open_source_value_commit(desc, value); + else + gpiod_set_raw_value_commit(desc, value); +} + +/** * gpiod_set_value() - assign a gpio's value * @desc: gpio whose value will be assigned * @value: value to assign @@@ -2927,8 -2897,16 +2927,8 @@@ void gpiod_set_value(struct gpio_desc *desc, int value) { VALIDATE_DESC_VOID(desc); - /* Should be using gpiod_set_value_cansleep() */ WARN_ON(desc->gdev->chip->can_sleep); - if (test_bit(FLAG_ACTIVE_LOW, &desc->flags)) - value = !value; - if (test_bit(FLAG_OPEN_DRAIN, &desc->flags)) - gpio_set_open_drain_value_commit(desc, value); - else if (test_bit(FLAG_OPEN_SOURCE, &desc->flags)) - gpio_set_open_source_value_commit(desc, value); - else - gpiod_set_raw_value_commit(desc, value); + gpiod_set_value_nocheck(desc, value); } EXPORT_SYMBOL_GPL(gpiod_set_value);

@@@ -3256,7 -3234,9 +3256,7 @@@ void gpiod_set_value_cansleep(struct gp { might_sleep_if(extra_checks); VALIDATE_DESC_VOID(desc); - if (test_bit(FLAG_ACTIVE_LOW, &desc->flags)) - value = !value; - gpiod_set_raw_value_commit(desc, value); + gpiod_set_value_nocheck(desc, value); } EXPORT_SYMBOL_GPL(gpiod_set_value_cansleep);

diff --combined drivers/infiniband/hw/hfi1/file_ops.c index 1df7da47f431,82086241aac3..bd6f03cc5ee0 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@@ -74,7 -74,7 +74,7 @@@ static int hfi1_file_open(struct inode *inode, struct file *fp); static int hfi1_file_close(struct inode *inode, struct file *fp); static ssize_t hfi1_write_iter(struct kiocb *kiocb, struct iov_iter *from); - static unsigned int hfi1_poll(struct file *fp, struct poll_table_struct *pt); + static __poll_t hfi1_poll(struct file *fp, struct poll_table_struct *pt); static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma);

static u64 kvirt_to_phys(void *addr); @@@ -102,8 -102,8 +102,8 @@@ static int allocate_ctxt(struct hfi1_fi struct hfi1_user_info *uinfo, struct hfi1_ctxtdata **cd); static void deallocate_ctxt(struct hfi1_ctxtdata *uctxt); - static unsigned int poll_urgent(struct file *fp, struct poll_table_struct *pt); - static unsigned int poll_next(struct file *fp, struct poll_table_struct *pt); + static __poll_t poll_urgent(struct file *fp, struct poll_table_struct *pt); + static __poll_t poll_next(struct file *fp, struct poll_table_struct *pt); static int user_event_ack(struct hfi1_ctxtdata *uctxt, u16 subctxt, unsigned long arg); static int set_ctxt_pkey(struct hfi1_ctxtdata *uctxt, unsigned long arg); @@@ -607,10 -607,10 +607,10 @@@ static int vma_fault(struct vm_fault *v return 0; }

- static unsigned int hfi1_poll(struct file *fp, struct poll_table_struct *pt) + static __poll_t hfi1_poll(struct file *fp, struct poll_table_struct *pt) { struct hfi1_ctxtdata *uctxt; - unsigned pollflag; + __poll_t pollflag;

uctxt = ((struct hfi1_filedata *)fp->private_data)->uctxt; if (!uctxt) @@@ -763,11 -763,11 +763,11 @@@ static int complete_subctxt(struct hfi1 }

if (ret) { - hfi1_rcd_put(fd->uctxt); - fd->uctxt = NULL; spin_lock_irqsave(&fd->dd->uctxt_lock, flags); __clear_bit(fd->subctxt, fd->uctxt->in_use_ctxts); spin_unlock_irqrestore(&fd->dd->uctxt_lock, flags); + hfi1_rcd_put(fd->uctxt); + fd->uctxt = NULL; }

return ret; @@@ -1425,13 -1425,13 +1425,13 @@@ static int user_exp_rcv_invalid(struct return ret; }

- static unsigned int poll_urgent(struct file *fp, + static __poll_t poll_urgent(struct file *fp, struct poll_table_struct *pt) { struct hfi1_filedata *fd = fp->private_data; struct hfi1_ctxtdata *uctxt = fd->uctxt; struct hfi1_devdata *dd = uctxt->dd; - unsigned pollflag; + __poll_t pollflag;

poll_wait(fp, &uctxt->wait, pt);

@@@ -1448,13 -1448,13 +1448,13 @@@ return pollflag; }

- static unsigned int poll_next(struct file *fp, + static __poll_t poll_next(struct file *fp, struct poll_table_struct *pt) { struct hfi1_filedata *fd = fp->private_data; struct hfi1_ctxtdata *uctxt = fd->uctxt; struct hfi1_devdata *dd = uctxt->dd; - unsigned pollflag; + __poll_t pollflag;

poll_wait(fp, &uctxt->wait, pt);

diff --combined drivers/md/md.c index 4e4dee0ec2de,e638d7199bd4..cb1476214f3f --- a/drivers/md/md.c +++ b/drivers/md/md.c @@@ -7605,9 -7605,7 +7605,9 @@@ static int status_resync(struct seq_fil if (test_bit(MD_RECOVERY_DONE, &mddev->recovery)) /* Still cleaning up */ resync = max_sectors; - } else + } else if (resync > max_sectors) + resync = max_sectors; + else resync -= atomic_read(&mddev->recovery_active);

if (resync == 0) { @@@ -7871,10 -7869,10 +7871,10 @@@ static int md_seq_open(struct inode *in }

static int md_unloading; - static unsigned int mdstat_poll(struct file *filp, poll_table *wait) + static __poll_t mdstat_poll(struct file *filp, poll_table *wait) { struct seq_file *seq = filp->private_data; - int mask; + __poll_t mask;

if (md_unloading) return POLLIN|POLLRDNORM|POLLERR|POLLPRI; diff --combined drivers/media/dvb-core/dvb_ca_en50221.c index d48b61eb01f4,dbb527a2befc..3f6c8bd8f869 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@@ -206,7 -206,7 +206,7 @@@ static int dvb_ca_en50221_write_data(st * @hlen: Number of bytes in haystack. * @needle: Buffer to find. * @nlen: Number of bytes in needle. - * @return Pointer into haystack needle was found at, or NULL if not found. + * return: Pointer into haystack needle was found at, or NULL if not found. */ static char *findstr(char *haystack, int hlen, char *needle, int nlen) { @@@ -226,7 -226,7 +226,7 @@@ /* ************************************************************************** */ /* EN50221 physical interface functions */

-/** +/* * dvb_ca_en50221_check_camstatus - Check CAM status. */ static int dvb_ca_en50221_check_camstatus(struct dvb_ca_private *ca, int slot) @@@ -275,9 -275,9 +275,9 @@@ * @ca: CA instance. * @slot: Slot on interface. * @waitfor: Flags to wait for. - * @timeout_ms: Timeout in milliseconds. + * @timeout_hz: Timeout in milliseconds. * - * @return 0 on success, nonzero on error. + * return: 0 on success, nonzero on error. */ static int dvb_ca_en50221_wait_if_status(struct dvb_ca_private *ca, int slot, u8 waitfor, int timeout_hz) @@@ -325,7 -325,7 +325,7 @@@ * @ca: CA instance. * @slot: Slot id. * - * @return 0 on success, nonzero on failure. + * return: 0 on success, nonzero on failure. */ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot) { @@@ -397,11 -397,11 +397,11 @@@ * @ca: CA instance. * @slot: Slot id. * @address: Address to read from. Updated. - * @tupleType: Tuple id byte. Updated. - * @tupleLength: Tuple length. Updated. + * @tuple_type: Tuple id byte. Updated. + * @tuple_length: Tuple length. Updated. * @tuple: Dest buffer for tuple (must be 256 bytes). Updated. * - * @return 0 on success, nonzero on error. + * return: 0 on success, nonzero on error. */ static int dvb_ca_en50221_read_tuple(struct dvb_ca_private *ca, int slot, int *address, int *tuple_type, @@@ -455,7 -455,7 +455,7 @@@ * @ca: CA instance. * @slot: Slot id. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_parse_attributes(struct dvb_ca_private *ca, int slot) { @@@ -632,11 -632,10 +632,11 @@@ static int dvb_ca_en50221_set_configopt * @ca: CA instance. * @slot: Slot to read from. * @ebuf: If non-NULL, the data will be written to this buffer. If NULL, - * the data will be added into the buffering system as a normal fragment. + * the data will be added into the buffering system as a normal + * fragment. * @ecount: Size of ebuf. Ignored if ebuf is NULL. * - * @return Number of bytes read, or < 0 on error + * return: Number of bytes read, or < 0 on error */ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 *ebuf, int ecount) @@@ -785,11 -784,11 +785,11 @@@ exit * * @ca: CA instance. * @slot: Slot to write to. - * @ebuf: The data in this buffer is treated as a complete link-level packet to - * be written. - * @count: Size of ebuf. + * @buf: The data in this buffer is treated as a complete link-level packet to + * be written. + * @bytes_write: Size of ebuf. * - * @return Number of bytes written, or < 0 on error. + * return: Number of bytes written, or < 0 on error. */ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 *buf, int bytes_write) @@@ -934,7 -933,7 +934,7 @@@ static int dvb_ca_en50221_slot_shutdown /** * dvb_ca_en50221_camchange_irq - A CAMCHANGE IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. * @change_type: One of the DVB_CA_CAMCHANGE_* values. */ @@@ -964,7 -963,7 +964,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_camchange_ /** * dvb_ca_en50221_camready_irq - A CAMREADY IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. */ void dvb_ca_en50221_camready_irq(struct dvb_ca_en50221 *pubca, int slot) @@@ -984,7 -983,7 +984,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_camready_i /** * dvb_ca_en50221_frda_irq - An FR or DA IRQ has occurred. * - * @ca: CA instance. + * @pubca: CA instance. * @slot: Slot concerned. */ void dvb_ca_en50221_frda_irq(struct dvb_ca_en50221 *pubca, int slot) @@@ -1092,7 -1091,7 +1092,7 @@@ static void dvb_ca_en50221_thread_updat * * @ca: CA instance. * @slot: Slot to process. - * @return: 0 .. no change + * return:: 0 .. no change * 1 .. CAM state changed */

@@@ -1297,7 -1296,7 +1297,7 @@@ static void dvb_ca_en50221_thread_state mutex_unlock(&sl->slot_lock); }

-/** +/* * Kernel thread which monitors CA slots for CAM changes, and performs data * transfers. */ @@@ -1337,11 -1336,12 +1337,11 @@@ static int dvb_ca_en50221_thread(void * * Real ioctl implementation. * NOTE: CA_SEND_MSG/CA_GET_MSG ioctls have userspace buffers passed to them. * - * @inode: Inode concerned. * @file: File concerned. * @cmd: IOCTL command. - * @arg: Associated argument. + * @parg: Associated argument. * - * @return 0 on success, <0 on error. + * return: 0 on success, <0 on error. */ static int dvb_ca_en50221_io_do_ioctl(struct file *file, unsigned int cmd, void *parg) @@@ -1420,11 -1420,12 +1420,11 @@@ out_unlock /** * Wrapper for ioctl implementation. * - * @inode: Inode concerned. * @file: File concerned. * @cmd: IOCTL command. * @arg: Associated argument. * - * @return 0 on success, <0 on error. + * return: 0 on success, <0 on error. */ static long dvb_ca_en50221_io_ioctl(struct file *file, unsigned int cmd, unsigned long arg) @@@ -1440,7 -1441,7 +1440,7 @@@ * @count: Size of source buffer. * @ppos: Position in file (ignored). * - * @return Number of bytes read, or <0 on error. + * return: Number of bytes read, or <0 on error. */ static ssize_t dvb_ca_en50221_io_write(struct file *file, const char __user *buf, size_t count, @@@ -1535,7 -1536,7 +1535,7 @@@ exit return status; }

-/** +/* * Condition for waking up in dvb_ca_en50221_io_read_condition */ static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private *ca, @@@ -1592,7 -1593,7 +1592,7 @@@ nextslot * @count: Size of destination buffer. * @ppos: Position in file (ignored). * - * @return Number of bytes read, or <0 on error. + * return: Number of bytes read, or <0 on error. */ static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) @@@ -1701,7 -1702,7 +1701,7 @@@ exit * @inode: Inode concerned. * @file: File concerned. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) { @@@ -1751,7 -1752,7 +1751,7 @@@ * @inode: Inode concerned. * @file: File concerned. * - * @return 0 on success, <0 on failure. + * return: 0 on success, <0 on failure. */ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) { @@@ -1780,13 -1781,13 +1780,13 @@@ * @file: File concerned. * @wait: poll wait table. * - * @return Standard poll mask. + * return: Standard poll mask. */ - static unsigned int dvb_ca_en50221_io_poll(struct file *file, poll_table *wait) + static __poll_t dvb_ca_en50221_io_poll(struct file *file, poll_table *wait) { struct dvb_device *dvbdev = file->private_data; struct dvb_ca_private *ca = dvbdev->priv; - unsigned int mask = 0; + __poll_t mask = 0; int slot; int result = 0;

@@@ -1837,11 -1838,11 +1837,11 @@@ static const struct dvb_device dvbdev_c * Initialise a new DVB CA EN50221 interface device. * * @dvb_adapter: DVB adapter to attach the new CA device to. - * @ca: The dvb_ca instance. + * @pubca: The dvb_ca instance. * @flags: Flags describing the CA device (DVB_CA_FLAG_*). * @slot_count: Number of slots supported. * - * @return 0 on success, nonzero on failure + * return: 0 on success, nonzero on failure */ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, struct dvb_ca_en50221 *pubca, int flags, int slot_count) @@@ -1928,7 -1929,8 +1928,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_init) /** * Release a DVB CA EN50221 interface device. * - * @ca_dev: The dvb_device_t instance for the CA device. - * @ca: The associated dvb_ca instance. + * @pubca: The associated dvb_ca instance. */ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) { diff --combined drivers/media/dvb-core/dvb_frontend.c index 2afaa8226342,92e2433415f0..48e16fd003a7 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@@ -369,14 -369,11 +369,14 @@@ static void dvb_frontend_swzigzag_updat }

/** - * Performs automatic twiddling of frontend parameters. + * dvb_frontend_swzigzag_autotune - Performs automatic twiddling of frontend + * parameters. * - * @param fe The frontend concerned. - * @param check_wrapped Checks if an iteration has completed. DO NOT SET ON THE FIRST ATTEMPT - * @returns Number of complete iterations that have been performed. + * @fe: The frontend concerned. + * @check_wrapped: Checks if an iteration has completed. + * DO NOT SET ON THE FIRST ATTEMPT. + * + * return: Number of complete iterations that have been performed. */ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wrapped) { @@@ -1256,7 -1253,7 +1256,7 @@@ dtv_property_legacy_params_sync(struct * dtv_get_frontend - calls a callback for retrieving DTV parameters * @fe: struct dvb_frontend pointer * @c: struct dtv_frontend_properties pointer (DVBv5 cache) - * @p_out struct dvb_frontend_parameters pointer (DVBv3 FE struct) + * @p_out: struct dvb_frontend_parameters pointer (DVBv3 FE struct) * * This routine calls either the DVBv3 or DVBv5 get_frontend call. * If c is not null, it will update the DVBv5 cache struct pointed by it. @@@ -2470,7 -2467,7 +2470,7 @@@ static int dvb_frontend_handle_ioctl(st }

- static unsigned int dvb_frontend_poll(struct file *file, struct poll_table_struct *wait) + static __poll_t dvb_frontend_poll(struct file *file, struct poll_table_struct *wait) { struct dvb_device *dvbdev = file->private_data; struct dvb_frontend *fe = dvbdev->priv; diff --combined drivers/media/platform/sh_veu.c index dedc1b024f6f,15cf51f5d280..976ea0bb5b6c --- a/drivers/media/platform/sh_veu.c +++ b/drivers/media/platform/sh_veu.c @@@ -267,7 -267,7 +267,7 @@@ static void sh_veu_process(struct sh_ve sh_veu_reg_write(veu, VEU_EIER, 1); /* enable interrupt in VEU */ }

-/** +/* * sh_veu_device_run() - prepares and starts the device * * This will be called by the framework when it decides to schedule a particular @@@ -1016,7 -1016,7 +1016,7 @@@ static int sh_veu_release(struct file * return 0; }

- static unsigned int sh_veu_poll(struct file *file, + static __poll_t sh_veu_poll(struct file *file, struct poll_table_struct *wait) { struct sh_veu_file *veu_file = file->private_data; diff --combined drivers/media/radio/radio-si476x.c index 540ac887a63c,248bd0ffc978..49293dd707b9 --- a/drivers/media/radio/radio-si476x.c +++ b/drivers/media/radio/radio-si476x.c @@@ -158,7 -158,7 +158,7 @@@ enum si476x_ctrl_idx }; static struct v4l2_ctrl_config si476x_ctrls[] = {

- /** + /* * SI476X during its station seeking(or tuning) process uses several * parameters to detrmine if "the station" is valid: * @@@ -197,7 -197,7 +197,7 @@@ .step = 2, },

- /** + /* * #V4L2_CID_SI476X_HARMONICS_COUNT -- number of harmonics * built-in power-line noise supression filter is to reject * during AM-mode operation. @@@ -213,7 -213,7 +213,7 @@@ .step = 1, },

- /** + /* * #V4L2_CID_SI476X_DIVERSITY_MODE -- configuration which * two tuners working in diversity mode are to work in. * @@@ -237,7 -237,7 +237,7 @@@ .max = ARRAY_SIZE(phase_diversity_modes) - 1, },

- /** + /* * #V4L2_CID_SI476X_INTERCHIP_LINK -- inter-chip link in * diversity mode indicator. Allows user to determine if two * chips working in diversity mode have established a link @@@ -296,15 -296,11 +296,15 @@@ struct si476x_radio_ops /** * struct si476x_radio - radio device * - * @core: Pointer to underlying core device + * @v4l2dev: Pointer to V4L2 device created by V4L2 subsystem * @videodev: Pointer to video device created by V4L2 subsystem + * @ctrl_handler: V4L2 controls handler + * @core: Pointer to underlying core device * @ops: Vtable of functions. See struct si476x_radio_ops for details - * @kref: Reference counter - * @core_lock: An r/w semaphore to brebvent the deletion of underlying + * @debugfs: pointer to &strucd dentry for debugfs + * @audmode: audio mode, as defined for the rxsubchans field + * at videodev2.h + * * core structure is the radio device is being used */ struct si476x_radio { @@@ -1153,12 -1149,12 +1153,12 @@@ static ssize_t si476x_radio_fops_read(s return rval; }

- static unsigned int si476x_radio_fops_poll(struct file *file, + static __poll_t si476x_radio_fops_poll(struct file *file, struct poll_table_struct *pts) { struct si476x_radio *radio = video_drvdata(file); - unsigned long req_events = poll_requested_events(pts); - unsigned int err = v4l2_ctrl_poll(file, pts); + __poll_t req_events = poll_requested_events(pts); + __poll_t err = v4l2_ctrl_poll(file, pts);

if (req_events & (POLLIN | POLLRDNORM)) { if (atomic_read(&radio->core->is_alive)) diff --combined drivers/media/radio/radio-wl1273.c index 3cbdc085c65d,4cd4241fc7be..f92b0f9241a9 --- a/drivers/media/radio/radio-wl1273.c +++ b/drivers/media/radio/radio-wl1273.c @@@ -1089,7 -1089,7 +1089,7 @@@ out return r; }

- static unsigned int wl1273_fm_fops_poll(struct file *file, + static __poll_t wl1273_fm_fops_poll(struct file *file, struct poll_table_struct *pts) { struct wl1273_device *radio = video_get_drvdata(video_devdata(file)); @@@ -1330,7 -1330,7 +1330,7 @@@ static int wl1273_fm_vidioc_s_input(str

/** * wl1273_fm_set_tx_power() - Set the transmission power value. - * @core: A pointer to the device struct. + * @radio: A pointer to the device struct. * @power: The new power value. */ static int wl1273_fm_set_tx_power(struct wl1273_device *radio, u16 power) diff --combined drivers/media/v4l2-core/v4l2-mem2mem.c index bc580fbe18fa,a879d11866bd..186156f8952a --- a/drivers/media/v4l2-core/v4l2-mem2mem.c +++ b/drivers/media/v4l2-core/v4l2-mem2mem.c @@@ -183,7 -183,6 +183,7 @@@ EXPORT_SYMBOL(v4l2_m2m_get_curr_priv)

/** * v4l2_m2m_try_run() - select next job to perform and run it if possible + * @m2m_dev: per-device context * * Get next transaction (if present) from the waiting jobs list and run it. */ @@@ -282,7 -281,6 +282,7 @@@ EXPORT_SYMBOL_GPL(v4l2_m2m_try_schedule

/** * v4l2_m2m_cancel_job() - cancel pending jobs for the context + * @m2m_ctx: m2m context with jobs to be canceled * * In case of streamoff or release called on any context, * 1] If the context is currently running, then abort job will be called @@@ -500,14 -498,14 +500,14 @@@ int v4l2_m2m_streamoff(struct file *fil } EXPORT_SYMBOL_GPL(v4l2_m2m_streamoff);

- unsigned int v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, + __poll_t v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, struct poll_table_struct *wait) { struct video_device *vfd = video_devdata(file); - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct vb2_queue *src_q, *dst_q; struct vb2_buffer *src_vb = NULL, *dst_vb = NULL; - unsigned int rc = 0; + __poll_t rc = 0; unsigned long flags;

if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) { @@@ -794,11 -792,11 +794,11 @@@ int v4l2_m2m_fop_mmap(struct file *file } EXPORT_SYMBOL_GPL(v4l2_m2m_fop_mmap);

- unsigned int v4l2_m2m_fop_poll(struct file *file, poll_table *wait) + __poll_t v4l2_m2m_fop_poll(struct file *file, poll_table *wait) { struct v4l2_fh *fh = file->private_data; struct v4l2_m2m_ctx *m2m_ctx = fh->m2m_ctx; - unsigned int ret; + __poll_t ret;

if (m2m_ctx->q_lock) mutex_lock(m2m_ctx->q_lock); diff --combined drivers/media/v4l2-core/videobuf-core.c index e87fb13b22dc,0c5b12b8bb52..9a89d3ae170f --- a/drivers/media/v4l2-core/videobuf-core.c +++ b/drivers/media/v4l2-core/videobuf-core.c @@@ -222,7 -222,7 +222,7 @@@ int videobuf_queue_is_busy(struct video } EXPORT_SYMBOL_GPL(videobuf_queue_is_busy);

-/** +/* * __videobuf_free() - free all the buffers and their control structures * * This function can only be called if streaming/reading is off, i.e. no buffers @@@ -1118,13 -1118,13 +1118,13 @@@ done } EXPORT_SYMBOL_GPL(videobuf_read_stream);

- unsigned int videobuf_poll_stream(struct file *file, + __poll_t videobuf_poll_stream(struct file *file, struct videobuf_queue *q, poll_table *wait) { - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct videobuf_buffer *buf = NULL; - unsigned int rc = 0; + __poll_t rc = 0;

videobuf_queue_lock(q); if (q->streaming) { diff --combined drivers/media/v4l2-core/videobuf2-core.c index a8589d96ef72,dc1f683c3b71..0d9f772d6d03 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@@ -188,7 -188,7 +188,7 @@@ module_param(debug, int, 0644) static void __vb2_queue_cancel(struct vb2_queue *q); static void __enqueue_in_driver(struct vb2_buffer *vb);

-/** +/* * __vb2_buf_mem_alloc() - allocate video memory for the given buffer */ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb) @@@ -229,7 -229,7 +229,7 @@@ free return ret; }

-/** +/* * __vb2_buf_mem_free() - free memory of the given buffer */ static void __vb2_buf_mem_free(struct vb2_buffer *vb) @@@ -243,7 -243,7 +243,7 @@@ } }

-/** +/* * __vb2_buf_userptr_put() - release userspace memory associated with * a USERPTR buffer */ @@@ -258,7 -258,7 +258,7 @@@ static void __vb2_buf_userptr_put(struc } }

-/** +/* * __vb2_plane_dmabuf_put() - release memory associated with * a DMABUF shared plane */ @@@ -277,7 -277,7 +277,7 @@@ static void __vb2_plane_dmabuf_put(stru p->dbuf_mapped = 0; }

-/** +/* * __vb2_buf_dmabuf_put() - release memory associated with * a DMABUF shared buffer */ @@@ -289,7 -289,7 +289,7 @@@ static void __vb2_buf_dmabuf_put(struc __vb2_plane_dmabuf_put(vb, &vb->planes[plane]); }

-/** +/* * __setup_offsets() - setup unique offsets ("cookies") for every plane in * the buffer. */ @@@ -317,7 -317,7 +317,7 @@@ static void __setup_offsets(struct vb2_ } }

-/** +/* * __vb2_queue_alloc() - allocate videobuf buffer structures and (for MMAP type) * video buffer memory for all buffers/planes on the queue and initializes the * queue @@@ -386,7 -386,7 +386,7 @@@ static int __vb2_queue_alloc(struct vb2 return buffer; }

-/** +/* * __vb2_free_mem() - release all video buffer memory for a given queue */ static void __vb2_free_mem(struct vb2_queue *q, unsigned int buffers) @@@ -410,7 -410,7 +410,7 @@@ } }

-/** +/* * __vb2_queue_free() - free buffers at the end of the queue - video memory and * related information, if no buffers are left return the queue to an * uninitialized state. Might be called even if the queue has already been freed. @@@ -544,7 -544,7 +544,7 @@@ bool vb2_buffer_in_use(struct vb2_queu } EXPORT_SYMBOL(vb2_buffer_in_use);

-/** +/* * __buffers_in_use() - return true if any buffers on the queue are in use and * the queue cannot be freed (by the means of REQBUFS(0)) call */ @@@ -564,7 -564,7 +564,7 @@@ void vb2_core_querybuf(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_core_querybuf);

-/** +/* * __verify_userptr_ops() - verify that all memory operations required for * USERPTR queue type have been provided */ @@@ -577,7 -577,7 +577,7 @@@ static int __verify_userptr_ops(struct return 0; }

-/** +/* * __verify_mmap_ops() - verify that all memory operations required for * MMAP queue type have been provided */ @@@ -590,7 -590,7 +590,7 @@@ static int __verify_mmap_ops(struct vb2 return 0; }

-/** +/* * __verify_dmabuf_ops() - verify that all memory operations required for * DMABUF queue type have been provided */ @@@ -953,7 -953,7 +953,7 @@@ void vb2_discard_done(struct vb2_queue } EXPORT_SYMBOL_GPL(vb2_discard_done);

-/** +/* * __prepare_mmap() - prepare an MMAP buffer */ static int __prepare_mmap(struct vb2_buffer *vb, const void *pb) @@@ -966,7 -966,7 +966,7 @@@ return ret ? ret : call_vb_qop(vb, buf_prepare, vb); }

-/** +/* * __prepare_userptr() - prepare a USERPTR buffer */ static int __prepare_userptr(struct vb2_buffer *vb, const void *pb) @@@ -1082,7 -1082,7 +1082,7 @@@ err return ret; }

-/** +/* * __prepare_dmabuf() - prepare a DMABUF buffer */ static int __prepare_dmabuf(struct vb2_buffer *vb, const void *pb) @@@ -1215,7 -1215,7 +1215,7 @@@ err return ret; }

-/** +/* * __enqueue_in_driver() - enqueue a vb2_buffer in driver for processing */ static void __enqueue_in_driver(struct vb2_buffer *vb) @@@ -1298,7 -1298,7 +1298,7 @@@ int vb2_core_prepare_buf(struct vb2_que } EXPORT_SYMBOL_GPL(vb2_core_prepare_buf);

-/** +/* * vb2_start_streaming() - Attempt to start streaming. * @q: videobuf2 queue * @@@ -1427,7 -1427,7 +1427,7 @@@ int vb2_core_qbuf(struct vb2_queue *q, } EXPORT_SYMBOL_GPL(vb2_core_qbuf);

-/** +/* * __vb2_wait_for_done_vb() - wait for a buffer to become available * for dequeuing * @@@ -1502,7 -1502,7 +1502,7 @@@ static int __vb2_wait_for_done_vb(struc return 0; }

-/** +/* * __vb2_get_done_vb() - get a buffer ready for dequeuing * * Will sleep if required for nonblocking == false. @@@ -1553,7 -1553,7 +1553,7 @@@ int vb2_wait_for_all_buffers(struct vb2 } EXPORT_SYMBOL_GPL(vb2_wait_for_all_buffers);

-/** +/* * __vb2_dqbuf() - bring back the buffer to the DEQUEUED state */ static void __vb2_dqbuf(struct vb2_buffer *vb) @@@ -1625,7 -1625,7 +1625,7 @@@ int vb2_core_dqbuf(struct vb2_queue *q } EXPORT_SYMBOL_GPL(vb2_core_dqbuf);

-/** +/* * __vb2_queue_cancel() - cancel and stop (pause) streaming * * Removes all queued buffers from driver's queue and all buffers queued by @@@ -1773,7 -1773,7 +1773,7 @@@ int vb2_core_streamoff(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_core_streamoff);

-/** +/* * __find_plane_by_offset() - find plane associated with the given offset off */ static int __find_plane_by_offset(struct vb2_queue *q, unsigned long off, @@@ -2018,10 -2018,10 +2018,10 @@@ void vb2_core_queue_release(struct vb2_ } EXPORT_SYMBOL_GPL(vb2_core_queue_release);

- unsigned int vb2_core_poll(struct vb2_queue *q, struct file *file, + __poll_t vb2_core_poll(struct vb2_queue *q, struct file *file, poll_table *wait) { - unsigned long req_events = poll_requested_events(wait); + __poll_t req_events = poll_requested_events(wait); struct vb2_buffer *vb = NULL; unsigned long flags;

@@@ -2104,7 -2104,7 +2104,7 @@@ } EXPORT_SYMBOL_GPL(vb2_core_poll);

-/** +/* * struct vb2_fileio_buf - buffer context used by file io emulator * * vb2 provides a compatibility layer and emulator of file io (read and @@@ -2118,7 -2118,7 +2118,7 @@@ struct vb2_fileio_buf unsigned int queued:1; };

-/** +/* * struct vb2_fileio_data - queue context used by file io emulator * * @cur_index: the index of the buffer currently being read from or @@@ -2155,7 -2155,7 +2155,7 @@@ struct vb2_fileio_data unsigned write_immediately:1; };

-/** +/* * __vb2_init_fileio() - initialize file io emulator * @q: videobuf2 queue * @read: mode selector (1 means read, 0 means write) @@@ -2274,7 -2274,7 +2274,7 @@@ err_kfree return ret; }

-/** +/* * __vb2_cleanup_fileio() - free resourced used by file io emulator * @q: videobuf2 queue */ @@@ -2293,7 -2293,7 +2293,7 @@@ static int __vb2_cleanup_fileio(struct return 0; }

-/** +/* * __vb2_perform_fileio() - perform a single file io (read or write) operation * @q: videobuf2 queue * @data: pointed to target userspace buffer diff --combined drivers/media/v4l2-core/videobuf2-v4l2.c index 4075314a6989,d2b3a74d14fd..a49f7eb98c2e --- a/drivers/media/v4l2-core/videobuf2-v4l2.c +++ b/drivers/media/v4l2-core/videobuf2-v4l2.c @@@ -49,7 -49,7 +49,7 @@@ module_param(debug, int, 0644) #define V4L2_BUFFER_OUT_FLAGS (V4L2_BUF_FLAG_PFRAME | V4L2_BUF_FLAG_BFRAME | \ V4L2_BUF_FLAG_KEYFRAME | V4L2_BUF_FLAG_TIMECODE)

-/** +/* * __verify_planes_array() - verify that the planes array passed in struct * v4l2_buffer from userspace can be safely used */ @@@ -78,7 -78,7 +78,7 @@@ static int __verify_planes_array_core(s return __verify_planes_array(vb, pb); }

-/** +/* * __verify_length() - Verify that the bytesused value for each plane fits in * the plane length and that the data offset doesn't exceed the bytesused value. */ @@@ -181,7 -181,7 +181,7 @@@ static int vb2_queue_or_prepare_buf(str return __verify_planes_array(q->bufs[b->index], b); }

-/** +/* * __fill_v4l2_buffer() - fill in a struct v4l2_buffer with information to be * returned to userspace */ @@@ -286,7 -286,7 +286,7 @@@ static void __fill_v4l2_buffer(struct v q->last_buffer_dequeued = true; }

-/** +/* * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a * v4l2_buffer by the userspace. It also verifies that struct * v4l2_buffer has a valid number of planes. @@@ -446,7 -446,7 +446,7 @@@ static const struct vb2_buf_ops v4l2_bu .copy_timestamp = __copy_timestamp, };

-/** +/* * vb2_querybuf() - query video buffer information * @q: videobuf queue * @b: buffer struct passed from userspace to vidioc_querybuf handler @@@ -671,11 -671,11 +671,11 @@@ void vb2_queue_release(struct vb2_queu } EXPORT_SYMBOL_GPL(vb2_queue_release);

- unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait) + __poll_t vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait) { struct video_device *vfd = video_devdata(file); - unsigned long req_events = poll_requested_events(wait); - unsigned int res = 0; + __poll_t req_events = poll_requested_events(wait); + __poll_t res = 0;

if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) { struct v4l2_fh *fh = file->private_data; @@@ -904,12 -904,12 +904,12 @@@ exit } EXPORT_SYMBOL_GPL(vb2_fop_read);

- unsigned int vb2_fop_poll(struct file *file, poll_table *wait) + __poll_t vb2_fop_poll(struct file *file, poll_table *wait) { struct video_device *vdev = video_devdata(file); struct vb2_queue *q = vdev->queue; struct mutex *lock = q->lock ? q->lock : vdev->lock; - unsigned res; + __poll_t res; void *fileio;

/* diff --combined drivers/net/ppp/ppp_generic.c index 264d4af0bf69,422723230f8b..ef6b2126b23a --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@@ -531,10 -531,10 +531,10 @@@ static ssize_t ppp_write(struct file *f }

/* No kernel lock - fine */ - static unsigned int ppp_poll(struct file *file, poll_table *wait) + static __poll_t ppp_poll(struct file *file, poll_table *wait) { struct ppp_file *pf = file->private_data; - unsigned int mask; + __poll_t mask;

if (!pf) return 0; @@@ -1006,18 -1006,17 +1006,18 @@@ static int ppp_unit_register(struct pp if (!ifname_is_set) snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ppp->file.index);

+ mutex_unlock(&pn->all_ppp_mutex); + ret = register_netdevice(ppp->dev); if (ret < 0) goto err_unit;

atomic_inc(&ppp_unit_count);

- mutex_unlock(&pn->all_ppp_mutex); - return 0;

err_unit: + mutex_lock(&pn->all_ppp_mutex); unit_put(&pn->units_idr, ppp->file.index); err: mutex_unlock(&pn->all_ppp_mutex); diff --combined drivers/net/tap.c index 0a886fda0129,c4e91c73568e..f39c6f876e67 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@@ -572,10 -572,10 +572,10 @@@ static int tap_release(struct inode *in return 0; }

- static unsigned int tap_poll(struct file *file, poll_table *wait) + static __poll_t tap_poll(struct file *file, poll_table *wait) { struct tap_queue *q = file->private_data; - unsigned int mask = POLLERR; + __poll_t mask = POLLERR;

if (!q) goto out; @@@ -829,11 -829,8 +829,11 @@@ static ssize_t tap_do_read(struct tap_q DEFINE_WAIT(wait); ssize_t ret = 0;

- if (!iov_iter_count(to)) + if (!iov_iter_count(to)) { + if (skb) + kfree_skb(skb); return 0; + }

if (skb) goto put; @@@ -1157,14 -1154,11 +1157,14 @@@ static int tap_recvmsg(struct socket *s size_t total_len, int flags) { struct tap_queue *q = container_of(sock, struct tap_queue, sock); + struct sk_buff *skb = m->msg_control; int ret; - if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) + if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) { + if (skb) + kfree_skb(skb); return -EINVAL; - ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, - m->msg_control); + } + ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, skb); if (ret > total_len) { m->msg_flags |= MSG_TRUNC; ret = flags & MSG_TRUNC ? ret : total_len; diff --combined drivers/net/tun.c index a8ec589d1359,130b049ac3da..7548d8a11bdf --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@@ -611,14 -611,6 +611,14 @@@ static void tun_queue_purge(struct tun_ skb_queue_purge(&tfile->sk.sk_error_queue); }

+static void tun_cleanup_tx_array(struct tun_file *tfile) +{ + if (tfile->tx_array.ring.queue) { + skb_array_cleanup(&tfile->tx_array); + memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + } +} + static void __tun_detach(struct tun_file *tfile, bool clean) { struct tun_file *ntfile; @@@ -665,7 -657,8 +665,7 @@@ tun->dev->reg_state == NETREG_REGISTERED) unregister_netdevice(tun->dev); } - if (tun) - skb_array_cleanup(&tfile->tx_array); + tun_cleanup_tx_array(tfile); sock_put(&tfile->sk); } } @@@ -707,13 -700,11 +707,13 @@@ static void tun_detach_all(struct net_d /* Drop read queue */ tun_queue_purge(tfile); sock_put(&tfile->sk); + tun_cleanup_tx_array(tfile); } list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { tun_enable_queue(tfile); tun_queue_purge(tfile); sock_put(&tfile->sk); + tun_cleanup_tx_array(tfile); } BUG_ON(tun->numdisabled != 0);

@@@ -1257,12 -1248,12 +1257,12 @@@ static void tun_net_init(struct net_dev /* Character device part */

/* Poll */ - static unsigned int tun_chr_poll(struct file *file, poll_table *wait) + static __poll_t tun_chr_poll(struct file *file, poll_table *wait) { struct tun_file *tfile = file->private_data; struct tun_struct *tun = tun_get(tfile); struct sock *sk; - unsigned int mask = 0; + __poll_t mask = 0;

if (!tun) return POLLERR; @@@ -1961,11 -1952,8 +1961,11 @@@ static ssize_t tun_do_read(struct tun_s

tun_debug(KERN_INFO, tun, "tun_do_read\n");

- if (!iov_iter_count(to)) + if (!iov_iter_count(to)) { + if (skb) + kfree_skb(skb); return 0; + }

if (!skb) { /* Read frames from ring */ @@@ -2081,24 -2069,22 +2081,24 @@@ static int tun_recvmsg(struct socket *s { struct tun_file *tfile = container_of(sock, struct tun_file, socket); struct tun_struct *tun = tun_get(tfile); + struct sk_buff *skb = m->msg_control; int ret;

- if (!tun) - return -EBADFD; + if (!tun) { + ret = -EBADFD; + goto out_free_skb; + }

if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) { ret = -EINVAL; - goto out; + goto out_put_tun; } if (flags & MSG_ERRQUEUE) { ret = sock_recv_errqueue(sock->sk, m, total_len, SOL_PACKET, TUN_TX_TIMESTAMP); goto out; } - ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, - m->msg_control); + ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, skb); if (ret > (ssize_t)total_len) { m->msg_flags |= MSG_TRUNC; ret = flags & MSG_TRUNC ? ret : total_len; @@@ -2106,13 -2092,6 +2106,13 @@@ out: tun_put(tun); return ret; + +out_put_tun: + tun_put(tun); +out_free_skb: + if (skb) + kfree_skb(skb); + return ret; }

static int tun_peek_len(struct socket *sock) @@@ -2860,8 -2839,6 +2860,8 @@@ static int tun_chr_open(struct inode *i

sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);

+ memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + return 0; }

diff --combined drivers/platform/chrome/cros_ec_debugfs.c index 98a35d32f9dd,603fa8bd85d3..5473e602f7e0 --- a/drivers/platform/chrome/cros_ec_debugfs.c +++ b/drivers/platform/chrome/cros_ec_debugfs.c @@@ -29,6 -29,9 +29,6 @@@ #include <linux/slab.h> #include <linux/wait.h>

-#include "cros_ec_dev.h" -#include "cros_ec_debugfs.h" - #define LOG_SHIFT 14 #define LOG_SIZE (1 << LOG_SHIFT) #define LOG_POLL_SEC 10 @@@ -188,11 -191,11 +188,11 @@@ error return ret; }

- static unsigned int cros_ec_console_log_poll(struct file *file, + static __poll_t cros_ec_console_log_poll(struct file *file, poll_table *wait) { struct cros_ec_debugfs *debug_info = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &debug_info->log_wq, wait);

@@@ -387,7 -390,6 +387,7 @@@ remove_debugfs debugfs_remove_recursive(debug_info->dir); return ret; } +EXPORT_SYMBOL(cros_ec_debugfs_init);

void cros_ec_debugfs_remove(struct cros_ec_dev *ec) { @@@ -397,4 -399,3 +397,4 @@@ debugfs_remove_recursive(ec->debug_info->dir); cros_ec_cleanup_console_log(ec->debug_info); } +EXPORT_SYMBOL(cros_ec_debugfs_remove); diff --combined drivers/s390/char/monreader.c index bf4ab4efed73,de7b169004a2..956f662908a6 --- a/drivers/s390/char/monreader.c +++ b/drivers/s390/char/monreader.c @@@ -1,4 -1,3 +1,4 @@@ +// SPDX-License-Identifier: GPL-2.0 /* * Character device driver for reading z/VM *MONITOR service records. * @@@ -429,7 -428,7 +429,7 @@@ out_copy return count; }

- static unsigned int mon_poll(struct file *filp, struct poll_table_struct *p) + static __poll_t mon_poll(struct file *filp, struct poll_table_struct *p) { struct mon_private *monpriv = filp->private_data;

diff --combined drivers/tty/n_tty.c index 539b49adb6af,081bbbb7d49c..478a9b40fd03 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@@ -1762,7 -1762,7 +1762,7 @@@ static void n_tty_set_termios(struct tt { struct n_tty_data *ldata = tty->disc_data;

- if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) { + if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) { bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE); ldata->line_start = ldata->read_tail; if (!L_ICANON(tty) || !read_cnt(ldata)) { @@@ -2368,10 -2368,10 +2368,10 @@@ break_out * Called without the kernel lock held - fine */

- static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file, + static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file, poll_table *wait) { - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &tty->read_wait, wait); poll_wait(file, &tty->write_wait, wait); @@@ -2425,7 -2425,7 +2425,7 @@@ static int n_tty_ioctl(struct tty_struc return put_user(tty_chars_in_buffer(tty), (int __user *) arg); case TIOCINQ: down_write(&tty->termios_rwsem); - if (L_ICANON(tty)) + if (L_ICANON(tty) && !L_EXTPROC(tty)) retval = inq_canon(ldata); else retval = read_cnt(ldata); diff --combined drivers/usb/core/devio.c index 3f9bd3e4c373,929a7380be66..5e72bf36aca4 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@@ -595,7 -595,7 +595,7 @@@ static void async_completed(struct urb as->status = urb->status; signr = as->signr; if (signr) { - memset(&sinfo, 0, sizeof(sinfo)); + clear_siginfo(&sinfo); sinfo.si_signo = as->signr; sinfo.si_errno = as->status; sinfo.si_code = SI_ASYNCIO; @@@ -1442,18 -1442,14 +1442,18 @@@ static int proc_do_submiturb(struct usb int number_of_packets = 0; unsigned int stream_id = 0; void *buf; - - if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP | - USBDEVFS_URB_SHORT_NOT_OK | + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | USBDEVFS_URB_BULK_CONTINUATION | USBDEVFS_URB_NO_FSBR | USBDEVFS_URB_ZERO_PACKET | - USBDEVFS_URB_NO_INTERRUPT)) - return -EINVAL; + USBDEVFS_URB_NO_INTERRUPT; + /* USBDEVFS_URB_ISO_ASAP is a special case */ + if (uurb->type == USBDEVFS_URB_TYPE_ISO) + mask |= USBDEVFS_URB_ISO_ASAP; + + if (uurb->flags & ~mask) + return -EINVAL; + if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX) return -EINVAL; if (uurb->buffer_length > 0 && !uurb->buffer) @@@ -2572,11 -2568,11 +2572,11 @@@ static long usbdev_compat_ioctl(struct #endif

/* No kernel lock - fine */ - static unsigned int usbdev_poll(struct file *file, + static __poll_t usbdev_poll(struct file *file, struct poll_table_struct *wait) { struct usb_dev_state *ps = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &ps->wait, wait); if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed)) @@@ -2613,7 -2609,7 +2613,7 @@@ static void usbdev_remove(struct usb_de wake_up_all(&ps->wait); list_del_init(&ps->list); if (ps->discsignr) { - memset(&sinfo, 0, sizeof(sinfo)); + clear_siginfo(&sinfo); sinfo.si_signo = ps->discsignr; sinfo.si_errno = EPIPE; sinfo.si_code = SI_ASYNCIO; diff --combined drivers/usb/gadget/function/f_fs.c index b6cf5ab5a0a1,17efadd6b395..b540935891af --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@@ -638,10 -638,10 +638,10 @@@ static long ffs_ep0_ioctl(struct file * return ret; }

- static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait) + static __poll_t ffs_ep0_poll(struct file *file, poll_table *wait) { struct ffs_data *ffs = file->private_data; - unsigned int mask = POLLWRNORM; + __poll_t mask = POLLWRNORM; int ret;

poll_wait(file, &ffs->ev.waitq, wait); @@@ -1012,7 -1012,7 +1012,7 @@@ static ssize_t ffs_epfile_io(struct fil else ret = ep->status; goto error_mutex; - } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) { + } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) { ret = -ENOMEM; } else { req->buf = data; @@@ -2282,18 -2282,9 +2282,18 @@@ static int __ffs_data_do_os_desc(enum f int i;

if (len < sizeof(*d) || - d->bFirstInterfaceNumber >= ffs->interfaces_count || - !d->Reserved1) + d->bFirstInterfaceNumber >= ffs->interfaces_count) return -EINVAL; + if (d->Reserved1 != 1) { + /* + * According to the spec, Reserved1 must be set to 1 + * but older kernels incorrectly rejected non-zero + * values. We fix it here to avoid returning EINVAL + * in response to values we used to accept. + */ + pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n"); + d->Reserved1 = 1; + } for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) if (d->Reserved2[i]) return -EINVAL; diff --combined drivers/usb/mon/mon_bin.c index f932f40302df,bc6fa666f75a..cc5b296bff3f --- a/drivers/usb/mon/mon_bin.c +++ b/drivers/usb/mon/mon_bin.c @@@ -1004,9 -1004,7 +1004,9 @@@ static long mon_bin_ioctl(struct file * break;

case MON_IOCQ_RING_SIZE: + mutex_lock(&rp->fetch_lock); ret = rp->b_size; + mutex_unlock(&rp->fetch_lock); break;

case MON_IOCT_RING_SIZE: @@@ -1191,11 -1189,11 +1191,11 @@@ static long mon_bin_compat_ioctl(struc } #endif /* CONFIG_COMPAT */

- static unsigned int + static __poll_t mon_bin_poll(struct file *file, struct poll_table_struct *wait) { struct mon_reader_bin *rp = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0; unsigned long flags;

if (file->f_mode & FMODE_READ) @@@ -1233,16 -1231,12 +1233,16 @@@ static int mon_bin_vma_fault(struct vm_ unsigned long offset, chunk_idx; struct page *pageptr;

+ mutex_lock(&rp->fetch_lock); offset = vmf->pgoff << PAGE_SHIFT; - if (offset >= rp->b_size) + if (offset >= rp->b_size) { + mutex_unlock(&rp->fetch_lock); return VM_FAULT_SIGBUS; + } chunk_idx = offset / CHUNK_SIZE; pageptr = rp->b_vec[chunk_idx].pg; get_page(pageptr); + mutex_unlock(&rp->fetch_lock); vmf->page = pageptr; return 0; } diff --combined drivers/vhost/net.c index c7bdeb655646,0ed445a17c54..9524ee16878a --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@@ -778,6 -778,16 +778,6 @@@ static void handle_rx(struct vhost_net /* On error, stop handling until the next kick. */ if (unlikely(headcount < 0)) goto out; - if (nvq->rx_array) - msg.msg_control = vhost_net_buf_consume(&nvq->rxq); - /* On overrun, truncate and discard */ - if (unlikely(headcount > UIO_MAXIOV)) { - iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1); - err = sock->ops->recvmsg(sock, &msg, - 1, MSG_DONTWAIT | MSG_TRUNC); - pr_debug("Discarded rx packet: len %zd\n", sock_len); - continue; - } /* OK, now we need to know about added descriptors. */ if (!headcount) { if (unlikely(vhost_enable_notify(&net->dev, vq))) { @@@ -790,16 -800,6 +790,16 @@@ * they refilled. */ goto out; } + if (nvq->rx_array) + msg.msg_control = vhost_net_buf_consume(&nvq->rxq); + /* On overrun, truncate and discard */ + if (unlikely(headcount > UIO_MAXIOV)) { + iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1); + err = sock->ops->recvmsg(sock, &msg, + 1, MSG_DONTWAIT | MSG_TRUNC); + pr_debug("Discarded rx packet: len %zd\n", sock_len); + continue; + } /* We don't need to be notified again. */ iov_iter_init(&msg.msg_iter, READ, vq->iov, in, vhost_len); fixup = msg.msg_iter; @@@ -1353,7 -1353,7 +1353,7 @@@ static ssize_t vhost_net_chr_write_iter return vhost_chr_write_iter(dev, from); }

- static unsigned int vhost_net_chr_poll(struct file *file, poll_table *wait) + static __poll_t vhost_net_chr_poll(struct file *file, poll_table *wait) { struct vhost_net *n = file->private_data; struct vhost_dev *dev = &n->dev; diff --combined drivers/vhost/vhost.c index e6bb0946d6e9,3bbeabff505a..8d4374606756 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@@ -170,7 -170,7 +170,7 @@@ static int vhost_poll_wakeup(wait_queue { struct vhost_poll *poll = container_of(wait, struct vhost_poll, wait);

- if (!((unsigned long)key & poll->mask)) + if (!(key_to_poll(key) & poll->mask)) return 0;

vhost_poll_queue(poll); @@@ -187,7 -187,7 +187,7 @@@ EXPORT_SYMBOL_GPL(vhost_work_init)

/* Init poll structure */ void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn, - unsigned long mask, struct vhost_dev *dev) + __poll_t mask, struct vhost_dev *dev) { init_waitqueue_func_entry(&poll->wait, vhost_poll_wakeup); init_poll_funcptr(&poll->table, vhost_poll_func); @@@ -203,7 -203,7 +203,7 @@@ EXPORT_SYMBOL_GPL(vhost_poll_init) * keep a reference to a file until after vhost_poll_stop is called. */ int vhost_poll_start(struct vhost_poll *poll, struct file *file) { - unsigned long mask; + __poll_t mask; int ret = 0;

if (poll->wqh) @@@ -211,7 -211,7 +211,7 @@@

mask = file->f_op->poll(file, &poll->table); if (mask) - vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask); + vhost_poll_wakeup(&poll->wait, 0, 0, poll_to_key(mask)); if (mask & POLLERR) { if (poll->wqh) remove_wait_queue(poll->wqh, &poll->wait); @@@ -904,7 -904,7 +904,7 @@@ static void vhost_dev_lock_vqs(struct v { int i = 0; for (i = 0; i < d->nvqs; ++i) - mutex_lock(&d->vqs[i]->mutex); + mutex_lock_nested(&d->vqs[i]->mutex, i); }

static void vhost_dev_unlock_vqs(struct vhost_dev *d) @@@ -1015,10 -1015,6 +1015,10 @@@ static int vhost_process_iotlb_msg(stru vhost_iotlb_notify_vq(dev, msg); break; case VHOST_IOTLB_INVALIDATE: + if (!dev->iotlb) { + ret = -EFAULT; + break; + } vhost_vq_meta_reset(dev); vhost_del_umem_range(dev->iotlb, msg->iova, msg->iova + msg->size - 1); @@@ -1061,10 -1057,10 +1061,10 @@@ done } EXPORT_SYMBOL(vhost_chr_write_iter);

- unsigned int vhost_chr_poll(struct file *file, struct vhost_dev *dev, + __poll_t vhost_chr_poll(struct file *file, struct vhost_dev *dev, poll_table *wait) { - unsigned int mask = 0; + __poll_t mask = 0;

poll_wait(file, &dev->wait, wait);

@@@ -1881,7 -1877,12 +1881,7 @@@ static unsigned next_desc(struct vhost_ return -1U;

/* Check they're not leading us off end of descriptors. */ - next = vhost16_to_cpu(vq, desc->next); - /* Make sure compiler knows to grab that: we don't want it changing! */ - /* We will use the result as an index in an array, so most - * architectures only need a compiler barrier here. */ - read_barrier_depends(); - + next = vhost16_to_cpu(vq, READ_ONCE(desc->next)); return next; }

diff --combined drivers/xen/pvcalls-front.c index 4c789e61554b,74c854955a6b..78804e71f9a6 --- a/drivers/xen/pvcalls-front.c +++ b/drivers/xen/pvcalls-front.c @@@ -805,7 -805,7 +805,7 @@@ int pvcalls_front_accept(struct socket pvcalls_exit(); return ret; } - map2 = kzalloc(sizeof(*map2), GFP_KERNEL); + map2 = kzalloc(sizeof(*map2), GFP_ATOMIC); if (map2 == NULL) { clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags); @@@ -878,7 -878,7 +878,7 @@@ received return ret; }

- static unsigned int pvcalls_front_poll_passive(struct file *file, + static __poll_t pvcalls_front_poll_passive(struct file *file, struct pvcalls_bedata *bedata, struct sock_mapping *map, poll_table *wait) @@@ -935,12 -935,12 +935,12 @@@ return 0; }

- static unsigned int pvcalls_front_poll_active(struct file *file, + static __poll_t pvcalls_front_poll_active(struct file *file, struct pvcalls_bedata *bedata, struct sock_mapping *map, poll_table *wait) { - unsigned int mask = 0; + __poll_t mask = 0; int32_t in_error, out_error; struct pvcalls_data_intf *intf = map->active.ring;

@@@ -958,12 -958,12 +958,12 @@@ return mask; }

- unsigned int pvcalls_front_poll(struct file *file, struct socket *sock, + __poll_t pvcalls_front_poll(struct file *file, struct socket *sock, poll_table *wait) { struct pvcalls_bedata *bedata; struct sock_mapping *map; - int ret; + __poll_t ret;

pvcalls_enter(); if (!pvcalls_front_dev) { @@@ -1103,7 -1103,7 +1103,7 @@@ static int pvcalls_front_remove(struct kfree(map); } } - if (bedata->ref >= 0) + if (bedata->ref != -1) gnttab_end_foreign_access(bedata->ref, 0, 0); kfree(bedata->ring.sring); kfree(bedata); @@@ -1128,8 -1128,6 +1128,8 @@@ static int pvcalls_front_probe(struct x }

versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len); + if (IS_ERR(versions)) + return PTR_ERR(versions); if (!len) return -EINVAL; if (strcmp(versions, "1")) { diff --combined fs/fcntl.c index c17369659f4a,84bab55b4712..c7b9e0948107 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@@ -690,7 -690,7 +690,7 @@@ COMPAT_SYSCALL_DEFINE3(fcntl, unsigned

/* Table to convert sigio signal codes into poll band bitmaps */

- static const long band_table[NSIGPOLL] = { + static const __poll_t band_table[NSIGPOLL] = { POLLIN | POLLRDNORM, /* POLL_IN */ POLLOUT | POLLWRNORM | POLLWRBAND, /* POLL_OUT */ POLLIN | POLLRDNORM | POLLMSG, /* POLL_MSG */ @@@ -737,7 -737,6 +737,7 @@@ static void send_sigio_to_task(struct t delivered even if we can't queue. Failure to queue in this case _should_ be reported; we fall back to SIGIO in that case. --sct */ + clear_siginfo(&si); si.si_signo = signum; si.si_errno = 0; si.si_code = reason; @@@ -759,7 -758,7 +759,7 @@@ if (reason - POLL_IN >= NSIGPOLL) si.si_band = ~0L; else - si.si_band = band_table[reason - POLL_IN]; + si.si_band = mangle_poll(band_table[reason - POLL_IN]); si.si_fd = fd; if (!do_send_sig_info(signum, &si, p, group)) break; diff --combined fs/orangefs/devorangefs-req.c index c584ad8d023c,109fffd6d153..f073cd9e6687 --- a/fs/orangefs/devorangefs-req.c +++ b/fs/orangefs/devorangefs-req.c @@@ -162,7 -162,7 +162,7 @@@ static ssize_t orangefs_devreq_read(str struct orangefs_kernel_op_s *op, *temp; __s32 proto_ver = ORANGEFS_KERNEL_PROTO_VERSION; static __s32 magic = ORANGEFS_DEVREQ_MAGIC; - struct orangefs_kernel_op_s *cur_op = NULL; + struct orangefs_kernel_op_s *cur_op; unsigned long ret;

/* We do not support blocking IO. */ @@@ -186,7 -186,6 +186,7 @@@ return -EAGAIN;

restart: + cur_op = NULL; /* Get next op (if any) from top of list. */ spin_lock(&orangefs_request_list_lock); list_for_each_entry_safe(op, temp, &orangefs_request_list, list) { @@@ -815,15 -814,15 +815,15 @@@ void orangefs_dev_cleanup(void ORANGEFS_REQDEVICE_NAME); }

- static unsigned int orangefs_devreq_poll(struct file *file, + static __poll_t orangefs_devreq_poll(struct file *file, struct poll_table_struct *poll_table) { - int poll_revent_mask = 0; + __poll_t poll_revent_mask = 0;

poll_wait(file, &orangefs_request_list_waitq, poll_table);

if (!list_empty(&orangefs_request_list)) - poll_revent_mask |= POLL_IN; + poll_revent_mask |= POLLIN; return poll_revent_mask; }

diff --combined fs/proc/inode.c index dd0f82622427,5e6f160d96a2..8dacaabb9f37 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@@ -234,11 -234,11 +234,11 @@@ static ssize_t proc_reg_write(struct fi return rv; }

- static unsigned int proc_reg_poll(struct file *file, struct poll_table_struct *pts) + static __poll_t proc_reg_poll(struct file *file, struct poll_table_struct *pts) { struct proc_dir_entry *pde = PDE(file_inode(file)); - unsigned int rv = DEFAULT_POLLMASK; - unsigned int (*poll)(struct file *, struct poll_table_struct *); + __poll_t rv = DEFAULT_POLLMASK; + __poll_t (*poll)(struct file *, struct poll_table_struct *); if (use_pde(pde)) { poll = pde->proc_fops->poll; if (poll) @@@ -483,7 -483,7 +483,7 @@@ int proc_fill_super(struct super_block

/* User space would break if executables or devices appear on proc */ s->s_iflags |= SB_I_USERNS_VISIBLE | SB_I_NOEXEC | SB_I_NODEV; - s->s_flags |= MS_NODIRATIME | MS_NOSUID | MS_NOEXEC; + s->s_flags |= SB_NODIRATIME | SB_NOSUID | SB_NOEXEC; s->s_blocksize = 1024; s->s_blocksize_bits = 10; s->s_magic = PROC_SUPER_MAGIC; diff --combined fs/proc_namespace.c index b786840facd9,7a3d0ff9b7a8..c8528d587e09 --- a/fs/proc_namespace.c +++ b/fs/proc_namespace.c @@@ -18,12 -18,12 +18,12 @@@ #include "pnode.h" #include "internal.h"

- static unsigned mounts_poll(struct file *file, poll_table *wait) + static __poll_t mounts_poll(struct file *file, poll_table *wait) { struct seq_file *m = file->private_data; struct proc_mounts *p = m->private; struct mnt_namespace *ns = p->ns; - unsigned res = POLLIN | POLLRDNORM; + __poll_t res = POLLIN | POLLRDNORM; int event;

poll_wait(file, &p->ns->poll, wait); @@@ -45,10 -45,10 +45,10 @@@ struct proc_fs_info static int show_sb_opts(struct seq_file *m, struct super_block *sb) { static const struct proc_fs_info fs_info[] = { - { MS_SYNCHRONOUS, ",sync" }, - { MS_DIRSYNC, ",dirsync" }, - { MS_MANDLOCK, ",mand" }, - { MS_LAZYTIME, ",lazytime" }, + { SB_SYNCHRONOUS, ",sync" }, + { SB_DIRSYNC, ",dirsync" }, + { SB_MANDLOCK, ",mand" }, + { SB_LAZYTIME, ",lazytime" }, { 0, NULL } }; const struct proc_fs_info *fs_infop; diff --combined fs/userfaultfd.c index 41a75f9f23fd,c0a5d9c47c6d..743eaa646898 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@@ -570,14 -570,11 +570,14 @@@ out static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx, struct userfaultfd_wait_queue *ewq) { + struct userfaultfd_ctx *release_new_ctx; + if (WARN_ON_ONCE(current->flags & PF_EXITING)) goto out;

ewq->ctx = ctx; init_waitqueue_entry(&ewq->wq, current); + release_new_ctx = NULL;

spin_lock(&ctx->event_wqh.lock); /* @@@ -604,7 -601,8 +604,7 @@@ new = (struct userfaultfd_ctx *) (unsigned long) ewq->msg.arg.reserved.reserved1; - - userfaultfd_ctx_put(new); + release_new_ctx = new; } break; } @@@ -619,20 -617,6 +619,20 @@@ __set_current_state(TASK_RUNNING); spin_unlock(&ctx->event_wqh.lock);

+ if (release_new_ctx) { + struct vm_area_struct *vma; + struct mm_struct *mm = release_new_ctx->mm; + + /* the various vma->vm_userfaultfd_ctx still points to it */ + down_write(&mm->mmap_sem); + for (vma = mm->mmap; vma; vma = vma->vm_next) + if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) + vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; + up_write(&mm->mmap_sem); + + userfaultfd_ctx_put(release_new_ctx); + } + /* * ctx may go away after this if the userfault pseudo fd is * already released. @@@ -937,10 -921,10 +937,10 @@@ static inline struct userfaultfd_wait_q return find_userfault_in(&ctx->event_wqh); }

- static unsigned int userfaultfd_poll(struct file *file, poll_table *wait) + static __poll_t userfaultfd_poll(struct file *file, poll_table *wait) { struct userfaultfd_ctx *ctx = file->private_data; - unsigned int ret; + __poll_t ret;

poll_wait(file, &ctx->fd_wqh, wait);

diff --combined include/crypto/if_alg.h index f38227a78eae,c670b30e405a..482461d8931d --- a/include/crypto/if_alg.h +++ b/include/crypto/if_alg.h @@@ -18,7 -18,6 +18,7 @@@ #include <linux/if_alg.h> #include <linux/scatterlist.h> #include <linux/types.h> +#include <linux/atomic.h> #include <net/sock.h>

#include <crypto/aead.h> @@@ -151,7 -150,7 +151,7 @@@ struct af_alg_ctx struct crypto_wait wait;

size_t used; - size_t rcvused; + atomic_t rcvused;

bool more; bool merge; @@@ -216,7 -215,7 +216,7 @@@ static inline int af_alg_rcvbuf(struct struct af_alg_ctx *ctx = ask->private;

return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) - - ctx->rcvused, 0); + atomic_read(&ctx->rcvused), 0); }

/** @@@ -243,9 -242,8 +243,9 @@@ int af_alg_sendmsg(struct socket *sock unsigned int ivsize); ssize_t af_alg_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags); +void af_alg_free_resources(struct af_alg_async_req *areq); void af_alg_async_cb(struct crypto_async_request *_req, int err); - unsigned int af_alg_poll(struct file *file, struct socket *sock, + __poll_t af_alg_poll(struct file *file, struct socket *sock, poll_table *wait); struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk, unsigned int areqlen); diff --combined include/linux/fs.h index 6804d075933e,64695eb07992..569c51d37312 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@@ -639,7 -639,7 +639,7 @@@ struct inode struct hlist_head i_dentry; struct rcu_head i_rcu; }; - u64 i_version; + atomic64_t i_version; atomic_t i_count; atomic_t i_dio_count; atomic_t i_writecount; @@@ -1698,7 -1698,7 +1698,7 @@@ struct file_operations ssize_t (*write_iter) (struct kiocb *, struct iov_iter *); int (*iterate) (struct file *, struct dir_context *); int (*iterate_shared) (struct file *, struct dir_context *); - unsigned int (*poll) (struct file *, struct poll_table_struct *); + __poll_t (*poll) (struct file *, struct poll_table_struct *); long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long); long (*compat_ioctl) (struct file *, unsigned int, unsigned long); int (*mmap) (struct file *, struct vm_area_struct *); @@@ -1872,7 -1872,7 +1872,7 @@@ struct super_operations */ #define __IS_FLG(inode, flg) ((inode)->i_sb->s_flags & (flg))

-static inline bool sb_rdonly(const struct super_block *sb) { return sb->s_flags & MS_RDONLY; } +static inline bool sb_rdonly(const struct super_block *sb) { return sb->s_flags & SB_RDONLY; } #define IS_RDONLY(inode) sb_rdonly((inode)->i_sb) #define IS_SYNC(inode) (__IS_FLG(inode, SB_SYNCHRONOUS) || \ ((inode)->i_flags & S_SYNC)) @@@ -2036,6 -2036,21 +2036,6 @@@ static inline void inode_dec_link_count mark_inode_dirty(inode); }

-/** - * inode_inc_iversion - increments i_version - * @inode: inode that need to be updated - * - * Every time the inode is modified, the i_version field will be incremented. - * The filesystem has to be mounted with i_version flag - */ - -static inline void inode_inc_iversion(struct inode *inode) -{ - spin_lock(&inode->i_lock); - inode->i_version++; - spin_unlock(&inode->i_lock); -} - enum file_time_flags { S_ATIME = 1, S_MTIME = 2, @@@ -3073,8 -3088,7 +3073,8 @@@ static inline int vfs_lstat(const char static inline int vfs_fstatat(int dfd, const char __user *filename, struct kstat *stat, int flags) { - return vfs_statx(dfd, filename, flags, stat, STATX_BASIC_STATS); + return vfs_statx(dfd, filename, flags | AT_NO_AUTOMOUNT, + stat, STATX_BASIC_STATS); } static inline int vfs_fstat(int fd, struct kstat *stat) { @@@ -3180,20 -3194,6 +3180,20 @@@ static inline bool vma_is_dax(struct vm return vma->vm_file && IS_DAX(vma->vm_file->f_mapping->host); }

+static inline bool vma_is_fsdax(struct vm_area_struct *vma) +{ + struct inode *inode; + + if (!vma->vm_file) + return false; + if (!vma_is_dax(vma)) + return false; + inode = file_inode(vma->vm_file); + if (inode->i_mode == S_IFCHR) + return false; /* device-dax */ + return true; +} + static inline int iocb_flags(struct file *file) { int res = 0; diff --combined include/linux/skbuff.h index a38c80e9f91e,07564bb28c1f..a87e43d16f44 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@@ -1406,7 -1406,8 +1406,7 @@@ static inline struct sk_buff *skb_get(s }

/* - * If users == 1, we are the only owner and are can avoid redundant - * atomic change. + * If users == 1, we are the only owner and can avoid redundant atomic changes. */

/** @@@ -3241,7 -3242,7 +3241,7 @@@ struct sk_buff *__skb_recv_datagram(str int *peeked, int *off, int *err); struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock, int *err); - unsigned int datagram_poll(struct file *file, struct socket *sock, + __poll_t datagram_poll(struct file *file, struct socket *sock, struct poll_table_struct *wait); int skb_copy_datagram_iter(const struct sk_buff *from, int offset, struct iov_iter *to, int size); diff --combined include/net/sctp/sctp.h index 906a9c0efa71,6b765de288d8..608d123ef25f --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h @@@ -107,7 -107,7 +107,7 @@@ int sctp_backlog_rcv(struct sock *sk, s int sctp_inet_listen(struct socket *sock, int backlog); void sctp_write_space(struct sock *sk); void sctp_data_ready(struct sock *sk); - unsigned int sctp_poll(struct file *file, struct socket *sock, + __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait); void sctp_sock_rfree(struct sk_buff *skb); void sctp_copy_sock(struct sock *newsk, struct sock *sk, @@@ -195,11 -195,6 +195,11 @@@ void sctp_remaddr_proc_exit(struct net int sctp_offload_init(void);

/* + * sctp/stream_sched.c + */ +void sctp_sched_ops_init(void); + +/* * sctp/stream.c */ int sctp_send_reset_streams(struct sctp_association *asoc, diff --combined include/net/sock.h index c4a424fe6fdd,b33078333518..c47c635c9d19 --- a/include/net/sock.h +++ b/include/net/sock.h @@@ -685,7 -685,11 +685,7 @@@ static inline void sk_add_node_rcu(stru

static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) { - if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport && - sk->sk_family == AF_INET6) - hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list); - else - hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); + hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); }

static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) @@@ -1445,8 -1449,10 +1445,8 @@@ do { } while (0)

#ifdef CONFIG_LOCKDEP -static inline bool lockdep_sock_is_held(const struct sock *csk) +static inline bool lockdep_sock_is_held(const struct sock *sk) { - struct sock *sk = (struct sock *)csk; - return lockdep_is_held(&sk->sk_lock) || lockdep_is_held(&sk->sk_lock.slock); } @@@ -1512,11 -1518,6 +1512,11 @@@ static inline bool sock_owned_by_user(c return sk->sk_lock.owned; }

+static inline bool sock_owned_by_user_nocheck(const struct sock *sk) +{ + return sk->sk_lock.owned; +} + /* no reclassification while locks are held */ static inline bool sock_allow_reclassification(const struct sock *csk) { @@@ -1581,7 -1582,7 +1581,7 @@@ int sock_no_connect(struct socket *, st int sock_no_socketpair(struct socket *, struct socket *); int sock_no_accept(struct socket *, struct socket *, int, bool); int sock_no_getname(struct socket *, struct sockaddr *, int *, int); - unsigned int sock_no_poll(struct file *, struct socket *, + __poll_t sock_no_poll(struct file *, struct socket *, struct poll_table_struct *); int sock_no_ioctl(struct socket *, unsigned int, unsigned long); int sock_no_listen(struct socket *, int); diff --combined include/net/tcp.h index 6da880d2f022,a6343271c629..50b21a49d870 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@@ -387,7 -387,7 +387,7 @@@ bool tcp_peer_is_proven(struct request_ void tcp_close(struct sock *sk, long timeout); void tcp_init_sock(struct sock *sk); void tcp_init_transfer(struct sock *sk, int bpf_op); - unsigned int tcp_poll(struct file *file, struct socket *sock, + __poll_t tcp_poll(struct file *file, struct socket *sock, struct poll_table_struct *wait); int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval, int __user *optlen); @@@ -844,11 -844,12 +844,11 @@@ static inline int tcp_v6_sdif(const str } #endif

-/* TCP_SKB_CB reference means this can not be used from early demux */ static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb) { #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV) if (!net->ipv4.sysctl_tcp_l3mdev_accept && - skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags)) + skb && ipv4_l3mdev_skb(IPCB(skb)->flags)) return true; #endif return false; @@@ -1055,7 -1056,7 +1055,7 @@@ void tcp_rate_skb_sent(struct sock *sk void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, struct rate_sample *rs); void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost, - struct rate_sample *rs); + bool is_sack_reneg, struct rate_sample *rs); void tcp_rate_check_app_limited(struct sock *sk);

/* These functions determine how the current flow behaves in respect of SACK diff --combined ipc/mqueue.c index 17bc8b874d92,2e4d42b6d8ed..3bc5bb7d6827 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@@ -331,7 -331,7 +331,7 @@@ static struct dentry *mqueue_mount(stru void *data) { struct ipc_namespace *ns; - if (flags & MS_KERNMOUNT) { + if (flags & SB_KERNMOUNT) { ns = data; data = NULL; } else { @@@ -519,10 -519,10 +519,10 @@@ static int mqueue_flush_file(struct fil return 0; }

- static unsigned int mqueue_poll_file(struct file *filp, struct poll_table_struct *poll_tab) + static __poll_t mqueue_poll_file(struct file *filp, struct poll_table_struct *poll_tab) { struct mqueue_inode_info *info = MQUEUE_I(file_inode(filp)); - int retval = 0; + __poll_t retval = 0;

poll_wait(filp, &info->wait_q, poll_tab);

@@@ -639,7 -639,6 +639,7 @@@ static void __do_notify(struct mqueue_i case SIGEV_SIGNAL: /* sends signal */

+ clear_siginfo(&sig_i); sig_i.si_signo = info->notify.sigev_signo; sig_i.si_errno = 0; sig_i.si_code = SI_MESGQ; diff --combined kernel/events/core.c index 02f7d6e57d9e,857c40d98d2c..d0d9bfb47d2e --- a/kernel/events/core.c +++ b/kernel/events/core.c @@@ -1231,10 -1231,6 +1231,10 @@@ static void put_ctx(struct perf_event_c * perf_event_context::lock * perf_event::mmap_mutex * mmap_sem + * + * cpu_hotplug_lock + * pmus_lock + * cpuctx->mutex / perf_event_context::mutex */ static struct perf_event_context * perf_event_ctx_lock_nested(struct perf_event *event, int nesting) @@@ -4200,7 -4196,6 +4200,7 @@@ int perf_event_release_kernel(struct pe { struct perf_event_context *ctx = event->ctx; struct perf_event *child, *tmp; + LIST_HEAD(free_list);

/* * If we got here through err_file: fput(event_file); we will not have @@@ -4273,7 -4268,8 +4273,7 @@@ again struct perf_event, child_list); if (tmp == child) { perf_remove_from_context(child, DETACH_GROUP); - list_del(&child->child_list); - free_event(child); + list_move(&child->child_list, &free_list); /* * This matches the refcount bump in inherit_event(); * this can't be the last reference. @@@ -4288,11 -4284,6 +4288,11 @@@ } mutex_unlock(&event->child_mutex);

+ list_for_each_entry_safe(child, tmp, &free_list, child_list) { + list_del(&child->child_list); + free_event(child); + } + no_ctx: put_event(event); /* Must be the 'last' reference */ return 0; @@@ -4520,11 -4511,11 +4520,11 @@@ perf_read(struct file *file, char __use return ret; }

- static unsigned int perf_poll(struct file *file, poll_table *wait) + static __poll_t perf_poll(struct file *file, poll_table *wait) { struct perf_event *event = file->private_data; struct ring_buffer *rb; - unsigned int events = POLLHUP; + __poll_t events = POLLHUP;

poll_wait(file, &event->waitq, wait);

@@@ -4913,7 -4904,6 +4913,7 @@@ void perf_event_update_userpage(struct unlock: rcu_read_unlock(); } +EXPORT_SYMBOL_GPL(perf_event_update_userpage);

static int perf_mmap_fault(struct vm_fault *vmf) { @@@ -5825,11 -5815,19 +5825,11 @@@ void perf_output_sample(struct perf_out perf_output_read(handle, event);

if (sample_type & PERF_SAMPLE_CALLCHAIN) { - if (data->callchain) { - int size = 1; - - if (data->callchain) - size += data->callchain->nr; - - size *= sizeof(u64); + int size = 1;

- __output_copy(handle, data->callchain, size); - } else { - u64 nr = 0; - perf_output_put(handle, nr); - } + size += data->callchain->nr; + size *= sizeof(u64); + __output_copy(handle, data->callchain, size); }

if (sample_type & PERF_SAMPLE_RAW) { @@@ -5982,26 -5980,6 +5982,26 @@@ static u64 perf_virt_to_phys(u64 virt return phys_addr; }

+static struct perf_callchain_entry __empty_callchain = { .nr = 0, }; + +static struct perf_callchain_entry * +perf_callchain(struct perf_event *event, struct pt_regs *regs) +{ + bool kernel = !event->attr.exclude_callchain_kernel; + bool user = !event->attr.exclude_callchain_user; + /* Disallow cross-task user callchains. */ + bool crosstask = event->ctx->task && event->ctx->task != current; + const u32 max_stack = event->attr.sample_max_stack; + struct perf_callchain_entry *callchain; + + if (!kernel && !user) + return &__empty_callchain; + + callchain = get_perf_callchain(regs, 0, kernel, user, + max_stack, crosstask, true); + return callchain ?: &__empty_callchain; +} + void perf_prepare_sample(struct perf_event_header *header, struct perf_sample_data *data, struct perf_event *event, @@@ -6024,7 -6002,9 +6024,7 @@@ int size = 1;

data->callchain = perf_callchain(event, regs); - - if (data->callchain) - size += data->callchain->nr; + size += data->callchain->nr;

header->size += size * sizeof(u64); } @@@ -6659,7 -6639,6 +6659,7 @@@ static void perf_event_namespaces_outpu struct perf_namespaces_event *namespaces_event = data; struct perf_output_handle handle; struct perf_sample_data sample; + u16 header_size = namespaces_event->event_id.header.size; int ret;

if (!perf_event_namespaces_match(event)) @@@ -6670,7 -6649,7 +6670,7 @@@ ret = perf_output_begin(&handle, event, namespaces_event->event_id.header.size); if (ret) - return; + goto out;

namespaces_event->event_id.pid = perf_event_pid(event, namespaces_event->task); @@@ -6682,8 -6661,6 +6682,8 @@@ perf_event__output_id_sample(event, &handle, &sample);

perf_output_end(&handle); +out: + namespaces_event->event_id.header.size = header_size; }

static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info, @@@ -8010,11 -7987,11 +8010,11 @@@ static void bpf_overflow_handler(struc { struct bpf_perf_event_data_kern ctx = { .data = data, - .regs = regs, .event = event, }; int ret = 0;

+ ctx.regs = perf_arch_bpf_user_pt_regs(regs); preempt_disable(); if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) goto out; @@@ -8536,29 -8513,6 +8536,29 @@@ fail_clear_files return ret; }

+static int +perf_tracepoint_set_filter(struct perf_event *event, char *filter_str) +{ + struct perf_event_context *ctx = event->ctx; + int ret; + + /* + * Beware, here be dragons!! + * + * the tracepoint muck will deadlock against ctx->mutex, but the tracepoint + * stuff does not actually need it. So temporarily drop ctx->mutex. As per + * perf_event_ctx_lock() we already have a reference on ctx. + * + * This can result in event getting moved to a different ctx, but that + * does not affect the tracepoint state. + */ + mutex_unlock(&ctx->mutex); + ret = ftrace_profile_set_filter(event, event->attr.config, filter_str); + mutex_lock(&ctx->mutex); + + return ret; +} + static int perf_event_set_filter(struct perf_event *event, void __user *arg) { char *filter_str; @@@ -8575,7 -8529,8 +8575,7 @@@

if (IS_ENABLED(CONFIG_EVENT_TRACING) && event->attr.type == PERF_TYPE_TRACEPOINT) - ret = ftrace_profile_set_filter(event, event->attr.config, - filter_str); + ret = perf_tracepoint_set_filter(event, filter_str); else if (has_addr_filter(event)) ret = perf_event_set_addr_filter(event, filter_str);

@@@ -9210,13 -9165,7 +9210,13 @@@ static int perf_try_init_event(struct p if (!try_module_get(pmu->module)) return -ENODEV;

- if (event->group_leader != event) { + /* + * A number of pmu->event_init() methods iterate the sibling_list to, + * for example, validate if the group fits on the PMU. Therefore, + * if this is a sibling event, acquire the ctx->mutex to protect + * the sibling_list. + */ + if (event->group_leader != event && pmu->task_ctx_nr != perf_sw_context) { /* * This ctx->mutex can nest when we're called through * inheritance. See the perf_event_ctx_lock_nested() comment. @@@ -10751,19 -10700,6 +10751,19 @@@ inherit_event(struct perf_event *parent if (IS_ERR(child_event)) return child_event;

+ + if ((child_event->attach_state & PERF_ATTACH_TASK_DATA) && + !child_ctx->task_ctx_data) { + struct pmu *pmu = child_event->pmu; + + child_ctx->task_ctx_data = kzalloc(pmu->task_ctx_size, + GFP_KERNEL); + if (!child_ctx->task_ctx_data) { + free_event(child_event); + return NULL; + } + } + /* * is_orphaned_event() and list_add_tail(&parent_event->child_list) * must be under the same lock in order to serialize against @@@ -10774,7 -10710,6 +10774,7 @@@ if (is_orphaned_event(parent_event) || !atomic_long_inc_not_zero(&parent_event->refcount)) { mutex_unlock(&parent_event->child_mutex); + /* task_ctx_data is freed with child_ctx */ free_event(child_event); return NULL; } diff --combined kernel/printk/printk.c index b9006617710f,8aa27be96012..c2e713f6ae2e --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@@ -920,10 -920,10 +920,10 @@@ static loff_t devkmsg_llseek(struct fil return ret; }

- static unsigned int devkmsg_poll(struct file *file, poll_table *wait) + static __poll_t devkmsg_poll(struct file *file, poll_table *wait) { struct devkmsg_user *user = file->private_data; - int ret = 0; + __poll_t ret = 0;

if (!user) return POLLERR|POLLNVAL; @@@ -3141,6 -3141,9 +3141,6 @@@ void dump_stack_print_info(const char * void show_regs_print_info(const char *log_lvl) { dump_stack_print_info(log_lvl); - - printk("%stask: %p task.stack: %p\n", - log_lvl, current, task_stack_page(current)); }

#endif diff --combined kernel/time/posix-clock.c index cc91d90abd84,36b04e7fcf62..94ad46d50b56 --- a/kernel/time/posix-clock.c +++ b/kernel/time/posix-clock.c @@@ -68,10 -68,10 +68,10 @@@ static ssize_t posix_clock_read(struct return err; }

- static unsigned int posix_clock_poll(struct file *fp, poll_table *wait) + static __poll_t posix_clock_poll(struct file *fp, poll_table *wait) { struct posix_clock *clk = get_posix_clock(fp); - unsigned int result = 0; + __poll_t result = 0;

if (!clk) return POLLERR; @@@ -216,7 -216,7 +216,7 @@@ struct posix_clock_desc

static int get_clock_desc(const clockid_t id, struct posix_clock_desc *cd) { - struct file *fp = fget(CLOCKID_TO_FD(id)); + struct file *fp = fget(clockid_to_fd(id)); int err = -EINVAL;

if (!fp) diff --combined kernel/trace/ring_buffer.c index 5af2842dea96,d24d48713ef3..ca6930e0d25e --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@@ -280,8 -280,6 +280,8 @@@ EXPORT_SYMBOL_GPL(ring_buffer_event_dat /* Missed count stored at end */ #define RB_MISSED_STORED (1 << 30)

+#define RB_MISSED_FLAGS (RB_MISSED_EVENTS|RB_MISSED_STORED) + struct buffer_data_page { u64 time_stamp; /* page time stamp */ local_t commit; /* write committed index */ @@@ -333,9 -331,7 +333,9 @@@ static void rb_init_page(struct buffer_ */ size_t ring_buffer_page_len(void *page) { - return local_read(&((struct buffer_data_page *)page)->commit) + struct buffer_data_page *bpage = page; + + return (local_read(&bpage->commit) & ~RB_MISSED_FLAGS) + BUF_PAGE_HDR_SIZE; }

@@@ -630,7 -626,7 +630,7 @@@ int ring_buffer_wait(struct ring_buffe * Returns POLLIN | POLLRDNORM if data exists in the buffers, * zero otherwise. */ - int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, + __poll_t ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, struct file *filp, poll_table *poll_table) { struct ring_buffer_per_cpu *cpu_buffer; @@@ -1803,6 -1799,12 +1803,6 @@@ void ring_buffer_change_overwrite(struc } EXPORT_SYMBOL_GPL(ring_buffer_change_overwrite);

-static __always_inline void * -__rb_data_page_index(struct buffer_data_page *bpage, unsigned index) -{ - return bpage->data + index; -} - static __always_inline void *__rb_page_index(struct buffer_page *bpage, unsigned index) { return bpage->page->data + index; @@@ -2534,58 -2536,29 +2534,58 @@@ rb_wakeups(struct ring_buffer *buffer, * The lock and unlock are done within a preempt disable section. * The current_context per_cpu variable can only be modified * by the current task between lock and unlock. But it can - * be modified more than once via an interrupt. There are four - * different contexts that we need to consider. + * be modified more than once via an interrupt. To pass this + * information from the lock to the unlock without having to + * access the 'in_interrupt()' functions again (which do show + * a bit of overhead in something as critical as function tracing, + * we use a bitmask trick. + * + * bit 0 = NMI context + * bit 1 = IRQ context + * bit 2 = SoftIRQ context + * bit 3 = normal context. + * + * This works because this is the order of contexts that can + * preempt other contexts. A SoftIRQ never preempts an IRQ + * context. + * + * When the context is determined, the corresponding bit is + * checked and set (if it was set, then a recursion of that context + * happened). + * + * On unlock, we need to clear this bit. To do so, just subtract + * 1 from the current_context and AND it to itself. * - * Normal context. - * SoftIRQ context - * IRQ context - * NMI context + * (binary) + * 101 - 1 = 100 + * 101 & 100 = 100 (clearing bit zero) * - * If for some reason the ring buffer starts to recurse, we - * only allow that to happen at most 4 times (one for each - * context). If it happens 5 times, then we consider this a - * recusive loop and do not let it go further. + * 1010 - 1 = 1001 + * 1010 & 1001 = 1000 (clearing bit 1) + * + * The least significant bit can be cleared this way, and it + * just so happens that it is the same bit corresponding to + * the current context. */

static __always_inline int trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer) { - if (cpu_buffer->current_context >= 4) + unsigned int val = cpu_buffer->current_context; + unsigned long pc = preempt_count(); + int bit; + + if (!(pc & (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_OFFSET))) + bit = RB_CTX_NORMAL; + else + bit = pc & NMI_MASK ? RB_CTX_NMI : + pc & HARDIRQ_MASK ? RB_CTX_IRQ : RB_CTX_SOFTIRQ; + + if (unlikely(val & (1 << bit))) return 1;

- cpu_buffer->current_context++; - /* Interrupts must see this update */ - barrier(); + val |= (1 << bit); + cpu_buffer->current_context = val;

return 0; } @@@ -2593,7 -2566,9 +2593,7 @@@ static __always_inline void trace_recursive_unlock(struct ring_buffer_per_cpu *cpu_buffer) { - /* Don't let the dec leak out */ - barrier(); - cpu_buffer->current_context--; + cpu_buffer->current_context &= cpu_buffer->current_context - 1; }

/** @@@ -4431,13 -4406,8 +4431,13 @@@ void ring_buffer_free_read_page(struct { struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu]; struct buffer_data_page *bpage = data; + struct page *page = virt_to_page(bpage); unsigned long flags;

+ /* If the page is still in use someplace else, we can't reuse it */ + if (page_ref_count(page) > 1) + goto out; + local_irq_save(flags); arch_spin_lock(&cpu_buffer->lock);

@@@ -4449,7 -4419,6 +4449,7 @@@ arch_spin_unlock(&cpu_buffer->lock); local_irq_restore(flags);

+ out: free_page((unsigned long)bpage); } EXPORT_SYMBOL_GPL(ring_buffer_free_read_page); diff --combined kernel/trace/trace.c index 4f3a8e24b426,1e2a45e87b93..32c069bbf41b --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@@ -362,7 -362,7 +362,7 @@@ trace_ignore_this_task(struct trace_pid }

/** - * trace_pid_filter_add_remove - Add or remove a task from a pid_list + * trace_pid_filter_add_remove_task - Add or remove a task from a pid_list * @pid_list: The list to modify * @self: The current task for fork or NULL for exit * @task: The task to add or remove @@@ -925,7 -925,7 +925,7 @@@ static void tracing_snapshot_instance(s }

/** - * trace_snapshot - take a snapshot of the current buffer. + * tracing_snapshot - take a snapshot of the current buffer. * * This causes a swap between the snapshot buffer and the current live * tracing buffer. You can use this to take snapshots of the live @@@ -1004,9 -1004,9 +1004,9 @@@ int tracing_alloc_snapshot(void EXPORT_SYMBOL_GPL(tracing_alloc_snapshot);

/** - * trace_snapshot_alloc - allocate and take a snapshot of the current buffer. + * tracing_snapshot_alloc - allocate and take a snapshot of the current buffer. * - * This is similar to trace_snapshot(), but it will allocate the + * This is similar to tracing_snapshot(), but it will allocate the * snapshot buffer if it isn't already allocated. Use this only * where it is safe to sleep, as the allocation may sleep. * @@@ -1303,7 -1303,7 +1303,7 @@@ unsigned long __read_mostly tracing_thr /* * Copy the new maximum trace into the separate maximum-trace * structure. (this way the maximum trace is permanently saved, - * for later retrieval via /sys/kernel/debug/tracing/latency_trace) + * for later retrieval via /sys/kernel/tracing/tracing_max_latency) */ static void __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu) @@@ -2374,15 -2374,6 +2374,15 @@@ void trace_event_buffer_commit(struct t } EXPORT_SYMBOL_GPL(trace_event_buffer_commit);

+/* + * Skip 3: + * + * trace_buffer_unlock_commit_regs() + * trace_event_buffer_commit() + * trace_event_raw_event_xxx() +*/ +# define STACK_SKIP 3 + void trace_buffer_unlock_commit_regs(struct trace_array *tr, struct ring_buffer *buffer, struct ring_buffer_event *event, @@@ -2392,12 -2383,16 +2392,12 @@@ __buffer_unlock_commit(buffer, event);

/* - * If regs is not set, then skip the following callers: - * trace_buffer_unlock_commit_regs - * event_trigger_unlock_commit - * trace_event_buffer_commit - * trace_event_raw_event_sched_switch + * If regs is not set, then skip the necessary functions. * Note, we can still get here via blktrace, wakeup tracer * and mmiotrace, but that's ok if they lose a function or - * two. They are that meaningful. + * two. They are not that meaningful. */ - ftrace_trace_stack(tr, buffer, flags, regs ? 0 : 4, pc, regs); + ftrace_trace_stack(tr, buffer, flags, regs ? 0 : STACK_SKIP, pc, regs); ftrace_trace_userstack(buffer, flags, pc); }

@@@ -2420,7 -2415,7 +2420,7 @@@ trace_process_export(struct trace_expor

entry = ring_buffer_event_data(event); size = ring_buffer_event_length(event); - export->write(entry, size); + export->write(export, entry, size); }

static DEFINE_MUTEX(ftrace_export_lock); @@@ -2584,13 -2579,11 +2584,13 @@@ static void __ftrace_trace_stack(struc trace.skip = skip;

/* - * Add two, for this function and the call to save_stack_trace() + * Add one, for this function and the call to save_stack_trace() * If regs is set, then these functions will not be in the way. */ +#ifndef CONFIG_UNWINDER_ORC if (!regs) - trace.skip += 2; + trace.skip++; +#endif

/* * Since events can happen in NMIs there's no safe way to @@@ -2689,6 -2682,17 +2689,6 @@@ void __trace_stack(struct trace_array * if (unlikely(in_nmi())) return;

- /* - * It is possible that a function is being traced in a - * location that RCU is not watching. A call to - * rcu_irq_enter() will make sure that it is, but there's - * a few internal rcu functions that could be traced - * where that wont work either. In those cases, we just - * do nothing. - */ - if (unlikely(rcu_irq_enter_disabled())) - return; - rcu_irq_enter_irqson(); __ftrace_trace_stack(buffer, flags, skip, pc, NULL); rcu_irq_exit_irqson(); @@@ -2707,10 -2711,11 +2707,10 @@@ void trace_dump_stack(int skip

local_save_flags(flags);

- /* - * Skip 3 more, seems to get us at the caller of - * this function. - */ - skip += 3; +#ifndef CONFIG_UNWINDER_ORC + /* Skip 1 to skip this function. */ + skip++; +#endif __ftrace_trace_stack(global_trace.trace_buffer.buffer, flags, skip, preempt_count(), NULL); } @@@ -4173,30 -4178,37 +4173,30 @@@ static const struct file_operations sho .llseek = seq_lseek, };

-/* - * The tracer itself will not take this lock, but still we want - * to provide a consistent cpumask to user-space: - */ -static DEFINE_MUTEX(tracing_cpumask_update_lock); - -/* - * Temporary storage for the character representation of the - * CPU bitmask (and one more byte for the newline): - */ -static char mask_str[NR_CPUS + 1]; - static ssize_t tracing_cpumask_read(struct file *filp, char __user *ubuf, size_t count, loff_t *ppos) { struct trace_array *tr = file_inode(filp)->i_private; + char *mask_str; int len;

- mutex_lock(&tracing_cpumask_update_lock); + len = snprintf(NULL, 0, "%*pb\n", + cpumask_pr_args(tr->tracing_cpumask)) + 1; + mask_str = kmalloc(len, GFP_KERNEL); + if (!mask_str) + return -ENOMEM;

- len = snprintf(mask_str, count, "%*pb\n", + len = snprintf(mask_str, len, "%*pb\n", cpumask_pr_args(tr->tracing_cpumask)); if (len >= count) { count = -EINVAL; goto out_err; } - count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1); + count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len);

out_err: - mutex_unlock(&tracing_cpumask_update_lock); + kfree(mask_str);

return count; } @@@ -4216,6 -4228,8 +4216,6 @@@ tracing_cpumask_write(struct file *filp if (err) goto err_unlock;

- mutex_lock(&tracing_cpumask_update_lock); - local_irq_disable(); arch_spin_lock(&tr->max_lock); for_each_tracing_cpu(cpu) { @@@ -4238,6 -4252,8 +4238,6 @@@ local_irq_enable();

cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new); - - mutex_unlock(&tracing_cpumask_update_lock); free_cpumask_var(tracing_cpumask_new);

return count; @@@ -5616,7 -5632,7 +5616,7 @@@ static int tracing_release_pipe(struct return 0; }

- static unsigned int + static __poll_t trace_poll(struct trace_iterator *iter, struct file *filp, poll_table *poll_table) { struct trace_array *tr = iter->tr; @@@ -5635,7 -5651,7 +5635,7 @@@ filp, poll_table); }

- static unsigned int + static __poll_t tracing_poll_pipe(struct file *filp, poll_table *poll_table) { struct trace_iterator *iter = filp->private_data; @@@ -6589,7 -6605,7 +6589,7 @@@ static int tracing_buffers_open(struct return ret; }

- static unsigned int + static __poll_t tracing_buffers_poll(struct file *filp, poll_table *poll_table) { struct ftrace_buffer_info *info = filp->private_data; @@@ -6764,7 -6780,7 +6764,7 @@@ tracing_buffers_splice_read(struct fil .spd_release = buffer_spd_release, }; struct buffer_ref *ref; - int entries, size, i; + int entries, i; ssize_t ret = 0;

#ifdef CONFIG_TRACER_MAX_TRACE @@@ -6818,6 -6834,14 +6818,6 @@@ break; }

- /* - * zero out any left over data, this is going to - * user land. - */ - size = ring_buffer_page_len(ref->page); - if (size < PAGE_SIZE) - memset(ref->page + size, 0, PAGE_SIZE - size); - page = virt_to_page(ref->page);

spd.pages[i] = page; @@@ -7575,7 -7599,6 +7575,7 @@@ allocate_trace_buffer(struct trace_arra buf->data = alloc_percpu(struct trace_array_cpu); if (!buf->data) { ring_buffer_free(buf->buffer); + buf->buffer = NULL; return -ENOMEM; }

@@@ -7599,9 -7622,7 +7599,9 @@@ static int allocate_trace_buffers(struc allocate_snapshot ? size : 1); if (WARN_ON(ret)) { ring_buffer_free(tr->trace_buffer.buffer); + tr->trace_buffer.buffer = NULL; free_percpu(tr->trace_buffer.data); + tr->trace_buffer.data = NULL; return -ENOMEM; } tr->allocated_snapshot = allocate_snapshot; diff --combined mm/memcontrol.c index ac2ffd5e02b9,006aa27f4fb4..9011997d8a5c --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@@ -3777,7 -3777,7 +3777,7 @@@ static int memcg_event_wake(wait_queue_ struct mem_cgroup_event *event = container_of(wait, struct mem_cgroup_event, wait); struct mem_cgroup *memcg = event->memcg; - unsigned long flags = (unsigned long)key; + __poll_t flags = key_to_poll(key);

if (flags & POLLHUP) { /* @@@ -6044,7 -6044,7 +6044,7 @@@ void mem_cgroup_swapout(struct page *pa memcg_check_events(memcg, page);

if (!mem_cgroup_is_root(memcg)) - css_put(&memcg->css); + css_put_many(&memcg->css, nr_entries); }

/** diff --combined net/9p/trans_fd.c index 80f5c79053a4,439014113a5c..d6f7f7cb79c4 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@@ -228,32 -228,31 +228,31 @@@ static void p9_conn_cancel(struct p9_co } }

- static int - p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt) + static __poll_t + p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt, int *err) { - int ret, n; + __poll_t ret, n; struct p9_trans_fd *ts = NULL;

if (client && client->status == Connected) ts = client->trans;

- if (!ts) - return -EREMOTEIO; + if (!ts) { + if (err) + *err = -EREMOTEIO; + return POLLERR; + }

if (!ts->rd->f_op->poll) - return -EIO; - - if (!ts->wr->f_op->poll) - return -EIO; - - ret = ts->rd->f_op->poll(ts->rd, pt); - if (ret < 0) - return ret; + ret = DEFAULT_POLLMASK; + else + ret = ts->rd->f_op->poll(ts->rd, pt);

if (ts->rd != ts->wr) { - n = ts->wr->f_op->poll(ts->wr, pt); - if (n < 0) - return n; + if (!ts->wr->f_op->poll) + n = DEFAULT_POLLMASK; + else + n = ts->wr->f_op->poll(ts->wr, pt); ret = (ret & ~POLLOUT) | (n & ~POLLIN); }

@@@ -298,7 -297,8 +297,8 @@@ static int p9_fd_read(struct p9_client

static void p9_read_work(struct work_struct *work) { - int n, err; + __poll_t n; + int err; struct p9_conn *m; int status = REQ_STATUS_ERROR;

@@@ -398,7 -398,7 +398,7 @@@ end_clear if (test_and_clear_bit(Rpending, &m->wsched)) n = POLLIN; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if ((n & POLLIN) && !test_and_set_bit(Rworksched, &m->wsched)) { p9_debug(P9_DEBUG_TRANS, "sched read work %p\n", m); @@@ -448,7 -448,8 +448,8 @@@ static int p9_fd_write(struct p9_clien

static void p9_write_work(struct work_struct *work) { - int n, err; + __poll_t n; + int err; struct p9_conn *m; struct p9_req_t *req;

@@@ -506,7 -507,7 +507,7 @@@ end_clear if (test_and_clear_bit(Wpending, &m->wsched)) n = POLLOUT; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if ((n & POLLOUT) && !test_and_set_bit(Wworksched, &m->wsched)) { @@@ -581,7 -582,7 +582,7 @@@ p9_pollwait(struct file *filp, wait_que

static void p9_conn_create(struct p9_client *client) { - int n; + __poll_t n; struct p9_trans_fd *ts = client->trans; struct p9_conn *m = &ts->conn;

@@@ -597,7 -598,7 +598,7 @@@ INIT_LIST_HEAD(&m->poll_pending_link); init_poll_funcptr(&m->pt, p9_pollwait);

- n = p9_fd_poll(client, &m->pt); + n = p9_fd_poll(client, &m->pt, NULL); if (n & POLLIN) { p9_debug(P9_DEBUG_TRANS, "mux %p can read\n", m); set_bit(Rpending, &m->wsched); @@@ -617,17 -618,16 +618,16 @@@

static void p9_poll_mux(struct p9_conn *m) { - int n; + __poll_t n; + int err = -ECONNRESET;

if (m->err < 0) return;

- n = p9_fd_poll(m->client, NULL); - if (n < 0 || n & (POLLERR | POLLHUP | POLLNVAL)) { + n = p9_fd_poll(m->client, NULL, &err); + if (n & (POLLERR | POLLHUP | POLLNVAL)) { p9_debug(P9_DEBUG_TRANS, "error mux %p err %d\n", m, n); - if (n >= 0) - n = -ECONNRESET; - p9_conn_cancel(m, n); + p9_conn_cancel(m, err); }

if (n & POLLIN) { @@@ -663,7 -663,7 +663,7 @@@

static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) { - int n; + __poll_t n; struct p9_trans_fd *ts = client->trans; struct p9_conn *m = &ts->conn;

@@@ -680,7 -680,7 +680,7 @@@ if (test_and_clear_bit(Wpending, &m->wsched)) n = POLLOUT; else - n = p9_fd_poll(m->client, NULL); + n = p9_fd_poll(m->client, NULL, NULL);

if (n & POLLOUT && !test_and_set_bit(Wworksched, &m->wsched)) schedule_work(&m->wq); @@@ -839,6 -839,7 +839,6 @@@ static int p9_socket_open(struct p9_cli if (IS_ERR(file)) { pr_err("%s (%d): failed to map fd\n", __func__, task_pid_nr(current)); - sock_release(csocket); kfree(p); return PTR_ERR(file); } diff --combined net/dccp/proto.c index 9d43c1f40274,cfa9ca9939ce..8b8db3d481bd --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@@ -259,7 -259,6 +259,7 @@@ int dccp_disconnect(struct sock *sk, in { struct inet_connection_sock *icsk = inet_csk(sk); struct inet_sock *inet = inet_sk(sk); + struct dccp_sock *dp = dccp_sk(sk); int err = 0; const int old_state = sk->sk_state;

@@@ -279,10 -278,6 +279,10 @@@ sk->sk_err = ECONNRESET;

dccp_clear_xmit_timers(sk); + ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); + ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_rx_ccid = NULL; + dp->dccps_hc_tx_ccid = NULL;

__skb_queue_purge(&sk->sk_receive_queue); __skb_queue_purge(&sk->sk_write_queue); @@@ -318,10 -313,10 +318,10 @@@ EXPORT_SYMBOL_GPL(dccp_disconnect) * take care of normal races (between the test and the event) and we don't * go look at any of the socket buffers directly. */ - unsigned int dccp_poll(struct file *file, struct socket *sock, + __poll_t dccp_poll(struct file *file, struct socket *sock, poll_table *wait) { - unsigned int mask; + __poll_t mask; struct sock *sk = sock->sk;

sock_poll_wait(file, sk_sleep(sk), wait); diff --combined net/ipv4/tcp.c index 8e053ad7cae2,0b8ca689353b..1b38b4282cc9 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@@ -493,9 -493,9 +493,9 @@@ static void tcp_tx_timestamp(struct soc * take care of normal races (between the test and the event) and we don't * go look at any of the socket buffers directly. */ - unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait) + __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) { - unsigned int mask; + __poll_t mask; struct sock *sk = sock->sk; const struct tcp_sock *tp = tcp_sk(sk); int state; @@@ -2298,9 -2298,6 +2298,9 @@@ adjudge_to_death tcp_send_active_reset(sk, GFP_ATOMIC); __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONMEMORY); + } else if (!check_net(sock_net(sk))) { + /* Not possible to send reset; just close */ + tcp_set_state(sk, TCP_CLOSE); } }

@@@ -2415,7 -2412,6 +2415,7 @@@ int tcp_disconnect(struct sock *sk, in tp->snd_cwnd_cnt = 0; tp->window_clamp = 0; tcp_set_ca_state(sk, TCP_CA_Open); + tp->is_sack_reneg = 0; tcp_clear_retrans(tp); inet_csk_delack_init(sk); /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0 diff --combined net/packet/af_packet.c index da215e5c1399,ef6340e2406a..3b4d6a3cf190 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@@ -1687,6 -1687,7 +1687,6 @@@ static int fanout_add(struct sock *sk, atomic_long_set(&rollover->num, 0); atomic_long_set(&rollover->num_huge, 0); atomic_long_set(&rollover->num_failed, 0); - po->rollover = rollover; }

if (type_flags & PACKET_FANOUT_FLAG_UNIQUEID) { @@@ -1744,8 -1745,6 +1744,8 @@@ if (refcount_read(&match->sk_ref) < PACKET_FANOUT_MAX) { __dev_remove_pack(&po->prot_hook); po->fanout = match; + po->rollover = rollover; + rollover = NULL; refcount_set(&match->sk_ref, refcount_read(&match->sk_ref) + 1); __fanout_link(sk, po); err = 0; @@@ -1759,7 -1758,10 +1759,7 @@@ }

out: - if (err && rollover) { - kfree_rcu(rollover, rcu); - po->rollover = NULL; - } + kfree(rollover); mutex_unlock(&fanout_mutex); return err; } @@@ -1783,6 -1785,11 +1783,6 @@@ static struct packet_fanout *fanout_rel list_del(&f->list); else f = NULL; - - if (po->rollover) { - kfree_rcu(po->rollover, rcu); - po->rollover = NULL; - } } mutex_unlock(&fanout_mutex);

@@@ -3022,7 -3029,6 +3022,7 @@@ static int packet_release(struct socke synchronize_net();

if (f) { + kfree(po->rollover); fanout_release_data(f); kfree(f); } @@@ -3091,10 -3097,6 +3091,10 @@@ static int packet_do_bind(struct sock * if (need_rehook) { if (po->running) { rcu_read_unlock(); + /* prevents packet_notifier() from calling + * register_prot_hook() + */ + po->num = 0; __unregister_prot_hook(sk, true); rcu_read_lock(); dev_curr = po->prot_hook.dev; @@@ -3103,7 -3105,6 +3103,7 @@@ dev->ifindex); }

+ BUG_ON(po->running); po->num = proto; po->prot_hook.type = proto;

@@@ -3842,6 -3843,7 +3842,6 @@@ static int packet_getsockopt(struct soc void *data = &val; union tpacket_stats_u st; struct tpacket_rollover_stats rstats; - struct packet_rollover *rollover;

if (level != SOL_PACKET) return -ENOPROTOOPT; @@@ -3920,13 -3922,18 +3920,13 @@@ 0); break; case PACKET_ROLLOVER_STATS: - rcu_read_lock(); - rollover = rcu_dereference(po->rollover); - if (rollover) { - rstats.tp_all = atomic_long_read(&rollover->num); - rstats.tp_huge = atomic_long_read(&rollover->num_huge); - rstats.tp_failed = atomic_long_read(&rollover->num_failed); - data = &rstats; - lv = sizeof(rstats); - } - rcu_read_unlock(); - if (!rollover) + if (!po->rollover) return -EINVAL; + rstats.tp_all = atomic_long_read(&po->rollover->num); + rstats.tp_huge = atomic_long_read(&po->rollover->num_huge); + rstats.tp_failed = atomic_long_read(&po->rollover->num_failed); + data = &rstats; + lv = sizeof(rstats); break; case PACKET_TX_HAS_OFF: val = po->tp_tx_has_off; @@@ -4073,12 -4080,12 +4073,12 @@@ static int packet_ioctl(struct socket * return 0; }

- static unsigned int packet_poll(struct file *file, struct socket *sock, + static __poll_t packet_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct packet_sock *po = pkt_sk(sk); - unsigned int mask = datagram_poll(file, sock, wait); + __poll_t mask = datagram_poll(file, sock, wait);

spin_lock_bh(&sk->sk_receive_queue.lock); if (po->rx_ring.pg_vec) { diff --combined net/rxrpc/af_rxrpc.c index dcd818fa837e,f8c8953d9295..21ad6a3a465c --- a/net/rxrpc/af_rxrpc.c +++ b/net/rxrpc/af_rxrpc.c @@@ -285,7 -285,6 +285,7 @@@ struct rxrpc_call *rxrpc_kernel_begin_c bool upgrade) { struct rxrpc_conn_parameters cp; + struct rxrpc_call_params p; struct rxrpc_call *call; struct rxrpc_sock *rx = rxrpc_sk(sock->sk); int ret; @@@ -303,10 -302,6 +303,10 @@@ if (key && !key->payload.data[0]) key = NULL; /* a no-security key */

+ memset(&p, 0, sizeof(p)); + p.user_call_ID = user_call_ID; + p.tx_total_len = tx_total_len; + memset(&cp, 0, sizeof(cp)); cp.local = rx->local; cp.key = key; @@@ -314,7 -309,8 +314,7 @@@ cp.exclusive = false; cp.upgrade = upgrade; cp.service_id = srx->srx_service; - call = rxrpc_new_client_call(rx, &cp, srx, user_call_ID, tx_total_len, - gfp); + call = rxrpc_new_client_call(rx, &cp, srx, &p, gfp); /* The socket has been unlocked. */ if (!IS_ERR(call)) { call->notify_rx = notify_rx; @@@ -729,12 -725,12 +729,12 @@@ static int rxrpc_getsockopt(struct sock /* * permit an RxRPC socket to be polled */ - static unsigned int rxrpc_poll(struct file *file, struct socket *sock, + static __poll_t rxrpc_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct rxrpc_sock *rx = rxrpc_sk(sk); - unsigned int mask; + __poll_t mask;

sock_poll_wait(file, sk_sleep(sk), wait); mask = 0; @@@ -860,7 -856,6 +860,7 @@@ static void rxrpc_sock_destructor(struc static int rxrpc_release_sock(struct sock *sk) { struct rxrpc_sock *rx = rxrpc_sk(sk); + struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));

_enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));

@@@ -868,19 -863,6 +868,19 @@@ sock_orphan(sk); sk->sk_shutdown = SHUTDOWN_MASK;

+ /* We want to kill off all connections from a service socket + * as fast as possible because we can't share these; client + * sockets, on the other hand, can share an endpoint. + */ + switch (sk->sk_state) { + case RXRPC_SERVER_BOUND: + case RXRPC_SERVER_BOUND2: + case RXRPC_SERVER_LISTENING: + case RXRPC_SERVER_LISTEN_DISABLED: + rx->local->service_closed = true; + break; + } + spin_lock_bh(&sk->sk_receive_queue.lock); sk->sk_state = RXRPC_CLOSE; spin_unlock_bh(&sk->sk_receive_queue.lock); @@@ -896,8 -878,6 +896,8 @@@ rxrpc_release_calls_on_socket(rx); flush_workqueue(rxrpc_workqueue); rxrpc_purge_queue(&sk->sk_receive_queue); + rxrpc_queue_work(&rxnet->service_conn_reaper); + rxrpc_queue_work(&rxnet->client_conn_reaper);

rxrpc_put_local(rx->local); rx->local = NULL; diff --combined net/sctp/socket.c index 039fcb618c34,8d3ac79f82e5..37382317fba4 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@@ -85,7 -85,7 +85,7 @@@ static int sctp_writeable(struct sock *sk); static void sctp_wfree(struct sk_buff *skb); static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - size_t msg_len, struct sock **orig_sk); + size_t msg_len); static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p); static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p); static int sctp_wait_for_accept(struct sock *sk, long timeo); @@@ -188,13 -188,13 +188,13 @@@ static void sctp_for_each_tx_datachunk( list_for_each_entry(chunk, &t->transmitted, transmitted_list) cb(chunk);

- list_for_each_entry(chunk, &q->retransmit, list) + list_for_each_entry(chunk, &q->retransmit, transmitted_list) cb(chunk);

- list_for_each_entry(chunk, &q->sacked, list) + list_for_each_entry(chunk, &q->sacked, transmitted_list) cb(chunk);

- list_for_each_entry(chunk, &q->abandoned, list) + list_for_each_entry(chunk, &q->abandoned, transmitted_list) cb(chunk);

list_for_each_entry(chunk, &q->out_chunk_list, list) @@@ -335,14 -335,16 +335,14 @@@ static struct sctp_af *sctp_sockaddr_af if (len < sizeof (struct sockaddr)) return NULL;

+ if (!opt->pf->af_supported(addr->sa.sa_family, opt)) + return NULL; + /* V4 mapped address are really of AF_INET family */ if (addr->sa.sa_family == AF_INET6 && - ipv6_addr_v4mapped(&addr->v6.sin6_addr)) { - if (!opt->pf->af_supported(AF_INET, opt)) - return NULL; - } else { - /* Does this PF support this AF? */ - if (!opt->pf->af_supported(addr->sa.sa_family, opt)) - return NULL; - } + ipv6_addr_v4mapped(&addr->v6.sin6_addr) && + !opt->pf->af_supported(AF_INET, opt)) + return NULL;

/* If we get this far, af is valid. */ af = sctp_get_af_specific(addr->sa.sa_family); @@@ -1881,14 -1883,8 +1881,14 @@@ static int sctp_sendmsg(struct sock *sk */ if (sinit) { if (sinit->sinit_num_ostreams) { - asoc->c.sinit_num_ostreams = - sinit->sinit_num_ostreams; + __u16 outcnt = sinit->sinit_num_ostreams; + + asoc->c.sinit_num_ostreams = outcnt; + /* outcnt has been changed, so re-init stream */ + err = sctp_stream_init(&asoc->stream, outcnt, 0, + GFP_KERNEL); + if (err) + goto out_free; } if (sinit->sinit_max_instreams) { asoc->c.sinit_max_instreams = @@@ -1975,7 -1971,7 +1975,7 @@@ timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); if (!sctp_wspace(asoc)) { /* sk can be changed by peel off when waiting for buf. */ - err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk); + err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); if (err) { if (err == -ESRCH) { /* asoc is already dead. */ @@@ -2281,7 -2277,7 +2281,7 @@@ static int sctp_setsockopt_events(struc

if (asoc && sctp_outq_is_empty(&asoc->outqueue)) { event = sctp_ulpevent_make_sender_dry_event(asoc, - GFP_ATOMIC); + GFP_USER | __GFP_NOWARN); if (!event) return -ENOMEM;

@@@ -3502,8 -3498,6 +3502,8 @@@ static int sctp_setsockopt_hmac_ident(s

if (optlen < sizeof(struct sctp_hmacalgo)) return -EINVAL; + optlen = min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) + + SCTP_AUTH_NUM_HMACS * sizeof(u16));

hmacs = memdup_user(optval, optlen); if (IS_ERR(hmacs)) @@@ -3542,11 -3536,6 +3542,11 @@@ static int sctp_setsockopt_auth_key(str

if (optlen <= sizeof(struct sctp_authkey)) return -EINVAL; + /* authkey->sca_keylength is u16, so optlen can't be bigger than + * this. + */ + optlen = min_t(unsigned int, optlen, USHRT_MAX + + sizeof(struct sctp_authkey));

authkey = memdup_user(optval, optlen); if (IS_ERR(authkey)) @@@ -3902,20 -3891,13 +3902,20 @@@ static int sctp_setsockopt_reset_stream struct sctp_association *asoc; int retval = -EINVAL;

- if (optlen < sizeof(struct sctp_reset_streams)) + if (optlen < sizeof(*params)) return -EINVAL; + /* srs_number_streams is u16, so optlen can't be bigger than this. */ + optlen = min_t(unsigned int, optlen, USHRT_MAX + + sizeof(__u16) * sizeof(*params));

params = memdup_user(optval, optlen); if (IS_ERR(params)) return PTR_ERR(params);

+ if (params->srs_number_streams * sizeof(__u16) > + optlen - sizeof(*params)) + goto out; + asoc = sctp_id2assoc(sk, params->srs_assoc_id); if (!asoc) goto out; @@@ -4512,7 -4494,7 +4512,7 @@@ static int sctp_init_sock(struct sock * SCTP_DBG_OBJCNT_INC(sock);

local_bh_disable(); - percpu_counter_inc(&sctp_sockets_allocated); + sk_sockets_allocated_inc(sk); sock_prot_inuse_add(net, sk->sk_prot, 1);

/* Nothing can fail after this block, otherwise @@@ -4556,7 -4538,7 +4556,7 @@@ static void sctp_destroy_sock(struct so } sctp_endpoint_free(sp->ep); local_bh_disable(); - percpu_counter_dec(&sctp_sockets_allocated); + sk_sockets_allocated_dec(sk); sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); local_bh_enable(); } @@@ -5029,7 -5011,7 +5029,7 @@@ static int sctp_getsockopt_autoclose(st len = sizeof(int); if (put_user(len, optlen)) return -EFAULT; - if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int))) + if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len)) return -EFAULT; return 0; } @@@ -5098,6 -5080,7 +5098,6 @@@ static int sctp_getsockopt_peeloff_comm *newfile = sock_alloc_file(newsock, 0, NULL); if (IS_ERR(*newfile)) { put_unused_fd(retval); - sock_release(newsock); retval = PTR_ERR(*newfile); *newfile = NULL; return retval; @@@ -5659,9 -5642,6 +5659,9 @@@ copy_getaddrs err = -EFAULT; goto out; } + /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too, + * but we can't change it anymore. + */ if (put_user(bytes_copied, optlen)) err = -EFAULT; out: @@@ -6098,7 -6078,7 +6098,7 @@@ static int sctp_getsockopt_maxseg(struc params.assoc_id = 0; } else if (len >= sizeof(struct sctp_assoc_value)) { len = sizeof(struct sctp_assoc_value); - if (copy_from_user(&params, optval, sizeof(params))) + if (copy_from_user(&params, optval, len)) return -EFAULT; } else return -EINVAL; @@@ -6268,9 -6248,7 +6268,9 @@@ static int sctp_getsockopt_active_key(s

if (len < sizeof(struct sctp_authkeyid)) return -EINVAL; - if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) + + len = sizeof(struct sctp_authkeyid); + if (copy_from_user(&val, optval, len)) return -EFAULT;

asoc = sctp_id2assoc(sk, val.scact_assoc_id); @@@ -6282,6 -6260,7 +6282,6 @@@ else val.scact_keynumber = ep->active_key_id;

- len = sizeof(struct sctp_authkeyid); if (put_user(len, optlen)) return -EFAULT; if (copy_to_user(optval, &val, len)) @@@ -6307,7 -6286,7 +6307,7 @@@ static int sctp_getsockopt_peer_auth_ch if (len < sizeof(struct sctp_authchunks)) return -EINVAL;

- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) + if (copy_from_user(&val, optval, sizeof(val))) return -EFAULT;

to = p->gauth_chunks; @@@ -6352,7 -6331,7 +6352,7 @@@ static int sctp_getsockopt_local_auth_c if (len < sizeof(struct sctp_authchunks)) return -EINVAL;

- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) + if (copy_from_user(&val, optval, sizeof(val))) return -EFAULT;

to = p->gauth_chunks; @@@ -7518,11 -7497,11 +7518,11 @@@ out * here, again, by modeling the current TCP/UDP code. We don't have * a good way to test with it yet. */ - unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait) + __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct sctp_sock *sp = sctp_sk(sk); - unsigned int mask; + __poll_t mask;

poll_wait(file, sk_sleep(sk), wait);

@@@ -8020,12 -7999,12 +8020,12 @@@ void sctp_sock_rfree(struct sk_buff *sk

/* Helper function to wait for space in the sndbuf. */ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - size_t msg_len, struct sock **orig_sk) + size_t msg_len) { struct sock *sk = asoc->base.sk; - int err = 0; long current_timeo = *timeo_p; DEFINE_WAIT(wait); + int err = 0;

pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc, *timeo_p, msg_len); @@@ -8054,13 -8033,17 +8054,13 @@@ release_sock(sk); current_timeo = schedule_timeout(current_timeo); lock_sock(sk); - if (sk != asoc->base.sk) { - release_sock(sk); - sk = asoc->base.sk; - lock_sock(sk); - } + if (sk != asoc->base.sk) + goto do_error;

*timeo_p = current_timeo; }

out: - *orig_sk = sk; finish_wait(&asoc->wait, &wait);

/* Release the association's refcnt. */ diff --combined net/socket.c index 6f05d5c4bf30,3e5e4f13046c..2f378449bc1b --- a/net/socket.c +++ b/net/socket.c @@@ -118,7 -118,7 +118,7 @@@ static ssize_t sock_write_iter(struct k static int sock_mmap(struct file *file, struct vm_area_struct *vma);

static int sock_close(struct inode *inode, struct file *file); - static unsigned int sock_poll(struct file *file, + static __poll_t sock_poll(struct file *file, struct poll_table_struct *wait); static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg); #ifdef CONFIG_COMPAT @@@ -406,10 -406,8 +406,10 @@@ struct file *sock_alloc_file(struct soc name.len = strlen(name.name); } path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name); - if (unlikely(!path.dentry)) + if (unlikely(!path.dentry)) { + sock_release(sock); return ERR_PTR(-ENOMEM); + } path.mnt = mntget(sock_mnt);

d_instantiate(path.dentry, SOCK_INODE(sock)); @@@ -417,11 -415,9 +417,11 @@@ file = alloc_file(&path, FMODE_READ | FMODE_WRITE, &socket_file_ops); if (IS_ERR(file)) { - /* drop dentry, keep inode */ + /* drop dentry, keep inode for a bit */ ihold(d_inode(path.dentry)); path_put(&path); + /* ... and now kill it properly */ + sock_release(sock); return file; }

@@@ -436,10 -432,8 +436,10 @@@ static int sock_map_fd(struct socket *s { struct file *newfile; int fd = get_unused_fd_flags(flags); - if (unlikely(fd < 0)) + if (unlikely(fd < 0)) { + sock_release(sock); return fd; + }

newfile = sock_alloc_file(sock, flags, NULL); if (likely(!IS_ERR(newfile))) { @@@ -1097,9 -1091,9 +1097,9 @@@ out_release EXPORT_SYMBOL(sock_create_lite);

/* No kernel lock held - perfect */ - static unsigned int sock_poll(struct file *file, poll_table *wait) + static __poll_t sock_poll(struct file *file, poll_table *wait) { - unsigned int busy_flag = 0; + __poll_t busy_flag = 0; struct socket *sock;

/* @@@ -1336,9 -1330,19 +1336,9 @@@ SYSCALL_DEFINE3(socket, int, family, in

retval = sock_create(family, type, protocol, &sock); if (retval < 0) - goto out; - - retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK)); - if (retval < 0) - goto out_release; - -out: - /* It may be already another descriptor 8) Not kernel problem. */ - return retval; + return retval;

-out_release: - sock_release(sock); - return retval; + return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK)); }

/* @@@ -1362,72 -1366,87 +1362,72 @@@ SYSCALL_DEFINE4(socketpair, int, family flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

/* + * reserve descriptors and make sure we won't fail + * to return them to userland. + */ + fd1 = get_unused_fd_flags(flags); + if (unlikely(fd1 < 0)) + return fd1; + + fd2 = get_unused_fd_flags(flags); + if (unlikely(fd2 < 0)) { + put_unused_fd(fd1); + return fd2; + } + + err = put_user(fd1, &usockvec[0]); + if (err) + goto out; + + err = put_user(fd2, &usockvec[1]); + if (err) + goto out; + + /* * Obtain the first socket and check if the underlying protocol * supports the socketpair call. */

err = sock_create(family, type, protocol, &sock1); - if (err < 0) + if (unlikely(err < 0)) goto out;

err = sock_create(family, type, protocol, &sock2); - if (err < 0) - goto out_release_1; - - err = sock1->ops->socketpair(sock1, sock2); - if (err < 0) - goto out_release_both; - - fd1 = get_unused_fd_flags(flags); - if (unlikely(fd1 < 0)) { - err = fd1; - goto out_release_both; + if (unlikely(err < 0)) { + sock_release(sock1); + goto out; }

- fd2 = get_unused_fd_flags(flags); - if (unlikely(fd2 < 0)) { - err = fd2; - goto out_put_unused_1; + err = sock1->ops->socketpair(sock1, sock2); + if (unlikely(err < 0)) { + sock_release(sock2); + sock_release(sock1); + goto out; }

newfile1 = sock_alloc_file(sock1, flags, NULL); if (IS_ERR(newfile1)) { err = PTR_ERR(newfile1); - goto out_put_unused_both; + sock_release(sock2); + goto out; }

newfile2 = sock_alloc_file(sock2, flags, NULL); if (IS_ERR(newfile2)) { err = PTR_ERR(newfile2); - goto out_fput_1; + fput(newfile1); + goto out; }

- err = put_user(fd1, &usockvec[0]); - if (err) - goto out_fput_both; - - err = put_user(fd2, &usockvec[1]); - if (err) - goto out_fput_both; - audit_fd_pair(fd1, fd2);

fd_install(fd1, newfile1); fd_install(fd2, newfile2); - /* fd1 and fd2 may be already another descriptors. - * Not kernel problem. - */ - return 0;

-out_fput_both: - fput(newfile2); - fput(newfile1); - put_unused_fd(fd2); - put_unused_fd(fd1); - goto out; - -out_fput_1: - fput(newfile1); - put_unused_fd(fd2); - put_unused_fd(fd1); - sock_release(sock2); - goto out; - -out_put_unused_both: +out: put_unused_fd(fd2); -out_put_unused_1: put_unused_fd(fd1); -out_release_both: - sock_release(sock2); -out_release_1: - sock_release(sock1); -out: return err; }

@@@ -1543,6 -1562,7 +1543,6 @@@ SYSCALL_DEFINE4(accept4, int, fd, struc if (IS_ERR(newfile)) { err = PTR_ERR(newfile); put_unused_fd(newfd); - sock_release(newsock); goto out_put; }

@@@ -2621,15 -2641,6 +2621,15 @@@ out_fs

core_initcall(sock_init); /* early initcall */

+static int __init jit_init(void) +{ +#ifdef CONFIG_BPF_JIT_ALWAYS_ON + bpf_jit_enable = 1; +#endif + return 0; +} +pure_initcall(jit_init); + #ifdef CONFIG_PROC_FS void socket_seq_show(struct seq_file *seq) { diff --combined net/sunrpc/cache.c index e68943895be4,c20ac7af7a4c..aa36dad32db1 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@@ -930,10 -930,10 +930,10 @@@ out

static DECLARE_WAIT_QUEUE_HEAD(queue_wait);

- static unsigned int cache_poll(struct file *filp, poll_table *wait, + static __poll_t cache_poll(struct file *filp, poll_table *wait, struct cache_detail *cd) { - unsigned int mask; + __poll_t mask; struct cache_reader *rp = filp->private_data; struct cache_queue *cq;

@@@ -1501,7 -1501,7 +1501,7 @@@ static ssize_t cache_write_procfs(struc return cache_write(filp, buf, count, ppos, cd); }

- static unsigned int cache_poll_procfs(struct file *filp, poll_table *wait) + static __poll_t cache_poll_procfs(struct file *filp, poll_table *wait) { struct cache_detail *cd = PDE_DATA(file_inode(filp));

@@@ -1674,7 -1674,7 +1674,7 @@@ void cache_unregister_net(struct cache_ } EXPORT_SYMBOL_GPL(cache_unregister_net);

-struct cache_detail *cache_create_net(struct cache_detail *tmpl, struct net *net) +struct cache_detail *cache_create_net(const struct cache_detail *tmpl, struct net *net) { struct cache_detail *cd; int i; @@@ -1720,7 -1720,7 +1720,7 @@@ static ssize_t cache_write_pipefs(struc return cache_write(filp, buf, count, ppos, cd); }

- static unsigned int cache_poll_pipefs(struct file *filp, poll_table *wait) + static __poll_t cache_poll_pipefs(struct file *filp, poll_table *wait) { struct cache_detail *cd = RPC_I(file_inode(filp))->private;

diff --combined net/tipc/socket.c index 3b4084480377,d94d25855190..2aa46e8cd8fe --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@@ -710,13 -710,13 +710,13 @@@ static int tipc_getname(struct socket * * imply that the operation will succeed, merely that it should be performed * and will not block. */ - static unsigned int tipc_poll(struct file *file, struct socket *sock, + static __poll_t tipc_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk = sock->sk; struct tipc_sock *tsk = tipc_sk(sk); struct tipc_group *grp = tsk->group; - u32 revents = 0; + __poll_t revents = 0;

sock_poll_wait(file, sk_sleep(sk), wait);

@@@ -727,11 -727,11 +727,11 @@@

switch (sk->sk_state) { case TIPC_ESTABLISHED: + case TIPC_CONNECTING: if (!tsk->cong_link_cnt && !tsk_conn_cong(tsk)) revents |= POLLOUT; /* fall thru' */ case TIPC_LISTEN: - case TIPC_CONNECTING: if (!skb_queue_empty(&sk->sk_receive_queue)) revents |= POLLIN | POLLRDNORM; break; @@@ -1140,7 -1140,7 +1140,7 @@@ void tipc_sk_mcast_rcv(struct net *net __skb_dequeue(arrvq); __skb_queue_tail(inputq, skb); } - refcount_dec(&skb->users); + kfree_skb(skb); spin_unlock_bh(&inputq->lock); continue; } diff --combined net/vmw_vsock/af_vsock.c index c9473d698525,bbd97d3bd8fb..9d95e773f4c8 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@@ -850,11 -850,11 +850,11 @@@ static int vsock_shutdown(struct socke return err; }

- static unsigned int vsock_poll(struct file *file, struct socket *sock, + static __poll_t vsock_poll(struct file *file, struct socket *sock, poll_table *wait) { struct sock *sk; - unsigned int mask; + __poll_t mask; struct vsock_sock *vsk;

sk = sock->sk; @@@ -951,7 -951,7 +951,7 @@@ * POLLOUT|POLLWRNORM when peer is closed and nothing to read, * but local send is not shutdown. */ - if (sk->sk_state == TCP_CLOSE) { + if (sk->sk_state == TCP_CLOSE || sk->sk_state == TCP_CLOSING) { if (!(sk->sk_shutdown & SEND_SHUTDOWN)) mask |= POLLOUT | POLLWRNORM;

diff --combined security/apparmor/apparmorfs.c index d4fa04d91439,77d30a821b85..4d202b73a0e1 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@@ -571,10 -571,10 +571,10 @@@ static int ns_revision_open(struct inod return 0; }

- static unsigned int ns_revision_poll(struct file *file, poll_table *pt) + static __poll_t ns_revision_poll(struct file *file, poll_table *pt) { struct aa_revision *rev = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

if (rev) { mutex_lock_nested(&rev->ns->lock, rev->ns->level); @@@ -2451,7 -2451,7 +2451,7 @@@ static int __init aa_create_aafs(void aafs_mnt = kern_mount(&aafs_ops); if (IS_ERR(aafs_mnt)) panic("can't set apparmorfs up\n"); - aafs_mnt->mnt_sb->s_flags &= ~MS_NOUSER; + aafs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;

/* Populate fs tree. */ error = entry_create_dir(&aa_sfs_entry, NULL); diff --combined sound/core/oss/pcm_oss.c index e8b19876c420,caa4d0c949bf..3ebba9c7f86e --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@@ -186,7 -186,7 +186,7 @@@ static int _snd_pcm_hw_param_mask(struc { int changed; changed = snd_mask_refine(hw_param_mask(params, var), val); - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -233,7 -233,7 +233,7 @@@ static int _snd_pcm_hw_param_min(struc val, open); else return -EINVAL; - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -294,7 -294,7 +294,7 @@@ static int _snd_pcm_hw_param_max(struc val, open); else return -EINVAL; - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -455,6 -455,7 +455,6 @@@ static int snd_pcm_hw_param_near(struc v = snd_pcm_hw_param_last(pcm, params, var, dir); else v = snd_pcm_hw_param_first(pcm, params, var, dir); - snd_BUG_ON(v < 0); return v; }

@@@ -499,7 -500,7 +499,7 @@@ static int _snd_pcm_hw_param_set(struc } } else return -EINVAL; - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -539,7 -540,7 +539,7 @@@ static int _snd_pcm_hw_param_setinteger { int changed; changed = snd_interval_setinteger(hw_param_interval(params, var)); - if (changed) { + if (changed > 0) { params->cmask |= 1 << var; params->rmask |= 1 << var; } @@@ -842,7 -843,7 +842,7 @@@ static int snd_pcm_oss_change_params(st if (!(mutex_trylock(&runtime->oss.params_lock))) return -EAGAIN; } else if (mutex_lock_interruptible(&runtime->oss.params_lock)) - return -EINTR; + return -ERESTARTSYS; sw_params = kzalloc(sizeof(*sw_params), GFP_KERNEL); params = kmalloc(sizeof(*params), GFP_KERNEL); sparams = kmalloc(sizeof(*sparams), GFP_KERNEL); @@@ -1334,11 -1335,8 +1334,11 @@@ static ssize_t snd_pcm_oss_write1(struc

if ((tmp = snd_pcm_oss_make_ready(substream)) < 0) return tmp; - mutex_lock(&runtime->oss.params_lock); while (bytes > 0) { + if (mutex_lock_interruptible(&runtime->oss.params_lock)) { + tmp = -ERESTARTSYS; + break; + } if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) { tmp = bytes; if (tmp + runtime->oss.buffer_used > runtime->oss.period_bytes) @@@ -1382,18 -1380,14 +1382,18 @@@ xfer += tmp; if ((substream->f_flags & O_NONBLOCK) != 0 && tmp != runtime->oss.period_bytes) - break; + tmp = -EAGAIN; } - } - mutex_unlock(&runtime->oss.params_lock); - return xfer; - err: - mutex_unlock(&runtime->oss.params_lock); + mutex_unlock(&runtime->oss.params_lock); + if (tmp < 0) + break; + if (signal_pending(current)) { + tmp = -ERESTARTSYS; + break; + } + tmp = 0; + } return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp; }

@@@ -1441,11 -1435,8 +1441,11 @@@ static ssize_t snd_pcm_oss_read1(struc

if ((tmp = snd_pcm_oss_make_ready(substream)) < 0) return tmp; - mutex_lock(&runtime->oss.params_lock); while (bytes > 0) { + if (mutex_lock_interruptible(&runtime->oss.params_lock)) { + tmp = -ERESTARTSYS; + break; + } if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) { if (runtime->oss.buffer_used == 0) { tmp = snd_pcm_oss_read2(substream, runtime->oss.buffer, runtime->oss.period_bytes, 1); @@@ -1476,16 -1467,12 +1476,16 @@@ bytes -= tmp; xfer += tmp; } - } - mutex_unlock(&runtime->oss.params_lock); - return xfer; - err: - mutex_unlock(&runtime->oss.params_lock); + mutex_unlock(&runtime->oss.params_lock); + if (tmp < 0) + break; + if (signal_pending(current)) { + tmp = -ERESTARTSYS; + break; + } + tmp = 0; + } return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp; }

@@@ -2686,10 -2673,10 +2686,10 @@@ static int snd_pcm_oss_capture_ready(st runtime->oss.period_frames; }

- static unsigned int snd_pcm_oss_poll(struct file *file, poll_table * wait) + static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait) { struct snd_pcm_oss_file *pcm_oss_file; - unsigned int mask; + __poll_t mask; struct snd_pcm_substream *psubstream = NULL, *csubstream = NULL; pcm_oss_file = file->private_data; diff --combined sound/core/pcm_native.c index 484a18d96371,6077dd6a0901..51104df924e1 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@@ -2580,7 -2580,7 +2580,7 @@@ static snd_pcm_sframes_t forward_appl_p return ret < 0 ? ret : frames; }

-/* decrease the appl_ptr; returns the processed frames or a negative error */ +/* decrease the appl_ptr; returns the processed frames or zero for error */ static snd_pcm_sframes_t rewind_appl_ptr(struct snd_pcm_substream *substream, snd_pcm_uframes_t frames, snd_pcm_sframes_t avail) @@@ -2597,12 -2597,7 +2597,12 @@@ if (appl_ptr < 0) appl_ptr += runtime->boundary; ret = pcm_lib_apply_appl_ptr(substream, appl_ptr); - return ret < 0 ? ret : frames; + /* NOTE: we return zero for errors because PulseAudio gets depressed + * upon receiving an error from rewind ioctl and stops processing + * any longer. Returning zero means that no rewind is done, so + * it's not absolutely wrong to answer like that. + */ + return ret < 0 ? 0 : frames; }

static snd_pcm_sframes_t snd_pcm_playback_rewind(struct snd_pcm_substream *substream, @@@ -3135,12 -3130,12 +3135,12 @@@ static ssize_t snd_pcm_writev(struct ki return result; }

- static unsigned int snd_pcm_playback_poll(struct file *file, poll_table * wait) + static __poll_t snd_pcm_playback_poll(struct file *file, poll_table * wait) { struct snd_pcm_file *pcm_file; struct snd_pcm_substream *substream; struct snd_pcm_runtime *runtime; - unsigned int mask; + __poll_t mask; snd_pcm_uframes_t avail;

pcm_file = file->private_data; @@@ -3174,12 -3169,12 +3174,12 @@@ return mask; }

- static unsigned int snd_pcm_capture_poll(struct file *file, poll_table * wait) + static __poll_t snd_pcm_capture_poll(struct file *file, poll_table * wait) { struct snd_pcm_file *pcm_file; struct snd_pcm_substream *substream; struct snd_pcm_runtime *runtime; - unsigned int mask; + __poll_t mask; snd_pcm_uframes_t avail;

pcm_file = file->private_data; @@@ -3446,7 -3441,7 +3446,7 @@@ EXPORT_SYMBOL_GPL(snd_pcm_lib_default_m int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_struct *area) { - struct snd_pcm_runtime *runtime = substream->runtime;; + struct snd_pcm_runtime *runtime = substream->runtime;

area->vm_page_prot = pgprot_noncached(area->vm_page_prot); return vm_iomap_memory(area, runtime->dma_addr, runtime->dma_bytes); diff --combined sound/core/rawmidi.c index f055ca10bbc1,e7e4930732a3..fae21311723f --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@@ -579,14 -579,15 +579,14 @@@ static int snd_rawmidi_info_user(struc return 0; }

-int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info) +static int __snd_rawmidi_info_select(struct snd_card *card, + struct snd_rawmidi_info *info) { struct snd_rawmidi *rmidi; struct snd_rawmidi_str *pstr; struct snd_rawmidi_substream *substream;

- mutex_lock(&register_mutex); rmidi = snd_rawmidi_search(card, info->device); - mutex_unlock(&register_mutex); if (!rmidi) return -ENXIO; if (info->stream < 0 || info->stream > 1) @@@ -602,16 -603,6 +602,16 @@@ } return -ENXIO; } + +int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info) +{ + int ret; + + mutex_lock(&register_mutex); + ret = __snd_rawmidi_info_select(card, info); + mutex_unlock(&register_mutex); + return ret; +} EXPORT_SYMBOL(snd_rawmidi_info_select);

static int snd_rawmidi_info_select_user(struct snd_card *card, @@@ -1366,11 -1357,11 +1366,11 @@@ static ssize_t snd_rawmidi_write(struc return result; }

- static unsigned int snd_rawmidi_poll(struct file *file, poll_table * wait) + static __poll_t snd_rawmidi_poll(struct file *file, poll_table * wait) { struct snd_rawmidi_file *rfile; struct snd_rawmidi_runtime *runtime; - unsigned int mask; + __poll_t mask;

rfile = file->private_data; if (rfile->input != NULL) { diff --combined sound/core/seq/seq_clientmgr.c index d01913404581,6d57912a8988..b611deef81f5 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@@ -221,7 -221,6 +221,7 @@@ static struct snd_seq_client *seq_creat rwlock_init(&client->ports_lock); mutex_init(&client->ports_mutex); INIT_LIST_HEAD(&client->ports_list_head); + mutex_init(&client->ioctl_mutex);

/* find free slot in the client table */ spin_lock_irqsave(&clients_lock, flags); @@@ -1087,10 -1086,10 +1087,10 @@@ static ssize_t snd_seq_write(struct fil /* * handle polling */ - static unsigned int snd_seq_poll(struct file *file, poll_table * wait) + static __poll_t snd_seq_poll(struct file *file, poll_table * wait) { struct snd_seq_client *client = file->private_data; - unsigned int mask = 0; + __poll_t mask = 0;

/* check client structures are in place */ if (snd_BUG_ON(!client)) @@@ -2131,9 -2130,7 +2131,9 @@@ static long snd_seq_ioctl(struct file * return -EFAULT; }

+ mutex_lock(&client->ioctl_mutex); err = handler->func(client, &buf); + mutex_unlock(&client->ioctl_mutex); if (err >= 0) { /* Some commands includes a bug in 'dir' field. */ if (handler->cmd == SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT || diff --combined sound/usb/mixer_quirks.c index e6359d341878,bc93242eef8a..05ccc7fdcc09 --- a/sound/usb/mixer_quirks.c +++ b/sound/usb/mixer_quirks.c @@@ -27,7 -27,6 +27,7 @@@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */

+#include <linux/hid.h> #include <linux/init.h> #include <linux/slab.h> #include <linux/usb.h> @@@ -240,7 -239,7 +240,7 @@@ static long snd_usb_sbrc_hwdep_read(str return err < 0 ? err : count; }

- static unsigned int snd_usb_sbrc_hwdep_poll(struct snd_hwdep *hw, struct file *file, + static __poll_t snd_usb_sbrc_hwdep_poll(struct snd_hwdep *hw, struct file *file, poll_table *wait) { struct usb_mixer_interface *mixer = hw->private_data; @@@ -1722,83 -1721,6 +1722,83 @@@ static int snd_microii_controls_create( return 0; }

+/* Creative Sound Blaster E1 */ + +static int snd_soundblaster_e1_switch_get(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) +{ + ucontrol->value.integer.value[0] = kcontrol->private_value; + return 0; +} + +static int snd_soundblaster_e1_switch_update(struct usb_mixer_interface *mixer, + unsigned char state) +{ + struct snd_usb_audio *chip = mixer->chip; + int err; + unsigned char buff[2]; + + buff[0] = 0x02; + buff[1] = state ? 0x02 : 0x00; + + err = snd_usb_lock_shutdown(chip); + if (err < 0) + return err; + err = snd_usb_ctl_msg(chip->dev, + usb_sndctrlpipe(chip->dev, 0), HID_REQ_SET_REPORT, + USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT, + 0x0202, 3, buff, 2); + snd_usb_unlock_shutdown(chip); + return err; +} + +static int snd_soundblaster_e1_switch_put(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) +{ + struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol); + unsigned char value = !!ucontrol->value.integer.value[0]; + int err; + + if (kcontrol->private_value == value) + return 0; + kcontrol->private_value = value; + err = snd_soundblaster_e1_switch_update(list->mixer, value); + return err < 0 ? err : 1; +} + +static int snd_soundblaster_e1_switch_resume(struct usb_mixer_elem_list *list) +{ + return snd_soundblaster_e1_switch_update(list->mixer, + list->kctl->private_value); +} + +static int snd_soundblaster_e1_switch_info(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_info *uinfo) +{ + static const char *const texts[2] = { + "Mic", "Aux" + }; + + return snd_ctl_enum_info(uinfo, 1, ARRAY_SIZE(texts), texts); +} + +static struct snd_kcontrol_new snd_soundblaster_e1_input_switch = { + .iface = SNDRV_CTL_ELEM_IFACE_MIXER, + .name = "Input Source", + .info = snd_soundblaster_e1_switch_info, + .get = snd_soundblaster_e1_switch_get, + .put = snd_soundblaster_e1_switch_put, + .private_value = 0, +}; + +static int snd_soundblaster_e1_switch_create(struct usb_mixer_interface *mixer) +{ + return add_single_ctl_with_resume(mixer, 0, + snd_soundblaster_e1_switch_resume, + &snd_soundblaster_e1_input_switch, + NULL); +} + int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) { int err = 0; @@@ -1880,10 -1802,6 +1880,10 @@@ case USB_ID(0x1235, 0x800c): /* Focusrite Scarlett 18i20 */ err = snd_scarlett_controls_create(mixer); break; + + case USB_ID(0x041e, 0x323b): /* Creative Sound Blaster E1 */ + err = snd_soundblaster_e1_switch_create(mixer); + break; }

return err;