commit: 66fbfd4088b0685d1d30b30e9485f970555dad6b Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> AuthorDate: Wed Mar 22 12:52:04 2023 +0000 Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> CommitDate: Wed Mar 22 12:52:04 2023 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=66fbfd40
Linux patch 4.14.311 Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org> 0000_README | 4 + 1310_linux-4.14.311.patch | 654 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 658 insertions(+) diff --git a/0000_README b/0000_README index 67b8935b..2519a69a 100644 --- a/0000_README +++ b/0000_README @@ -1283,6 +1283,10 @@ Patch: 1309_linux-4.14.310.patch From: https://www.kernel.org Desc: Linux 4.14.310 +Patch: 1310_linux-4.14.311.patch +From: https://www.kernel.org +Desc: Linux 4.14.311 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1310_linux-4.14.311.patch b/1310_linux-4.14.311.patch new file mode 100644 index 00000000..82f551fe --- /dev/null +++ b/1310_linux-4.14.311.patch @@ -0,0 +1,654 @@ +diff --git a/Makefile b/Makefile +index edd89ca6f9566..8d915cd893427 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 310 ++SUBLEVEL = 311 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c +index ed4d6276e94f3..ebf1e9b7f93b6 100644 +--- a/drivers/block/sunvdc.c ++++ b/drivers/block/sunvdc.c +@@ -940,6 +940,8 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id) + print_version(); + + hp = mdesc_grab(); ++ if (!hp) ++ return -ENODEV; + + err = -ENODEV; + if ((vdev->dev_no << PARTITION_SHIFT) & ~(u64)MINORMASK) { +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c +index 6c7563c1ab5f9..f0b923e037dfd 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -1359,10 +1359,11 @@ static struct i915_vma * + intel_ring_create_vma(struct drm_i915_private *dev_priv, int size) + { + struct i915_address_space *vm = &dev_priv->ggtt.base; +- struct drm_i915_gem_object *obj; ++ struct drm_i915_gem_object *obj = NULL; + struct i915_vma *vma; + +- obj = i915_gem_object_create_stolen(dev_priv, size); ++ if (!HAS_LLC(dev_priv)) ++ obj = i915_gem_object_create_stolen(dev_priv, size); + if (!obj) + obj = i915_gem_object_create_internal(dev_priv, size); + if (IS_ERR(obj)) +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index ab78c1e6f37d8..fe3824a6af5c1 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -245,6 +245,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign + unsigned usages; + unsigned offset; + unsigned i; ++ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE; + + report = hid_register_report(parser->device, report_type, parser->global.report_id); + if (!report) { +@@ -268,8 +269,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign + offset = report->size; + report->size += parser->global.report_size * parser->global.report_count; + ++ if (parser->device->ll_driver->max_buffer_size) ++ max_buffer_size = parser->device->ll_driver->max_buffer_size; ++ + /* Total size check: Allow for possible report index byte */ +- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { ++ if (report->size > (max_buffer_size - 1) << 3) { + hid_err(parser->device, "report is too long\n"); + return -1; + } +@@ -1568,6 +1572,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, + struct hid_report_enum *report_enum = hid->report_enum + type; + struct hid_report *report; + struct hid_driver *hdrv; ++ int max_buffer_size = HID_MAX_BUFFER_SIZE; + unsigned int a; + u32 rsize, csize = size; + u8 *cdata = data; +@@ -1584,10 +1589,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, + + rsize = hid_compute_report_size(report); + +- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE) +- rsize = HID_MAX_BUFFER_SIZE - 1; +- else if (rsize > HID_MAX_BUFFER_SIZE) +- rsize = HID_MAX_BUFFER_SIZE; ++ if (hid->ll_driver->max_buffer_size) ++ max_buffer_size = hid->ll_driver->max_buffer_size; ++ ++ if (report_enum->numbered && rsize >= max_buffer_size) ++ rsize = max_buffer_size - 1; ++ else if (rsize > max_buffer_size) ++ rsize = max_buffer_size; + + if (csize < rsize) { + dbg_hid("report %d is too short, (%d < %d)\n", report->id, +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index 333b6a769189c..b7efc5c055be1 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -399,6 +399,7 @@ struct hid_ll_driver uhid_hid_driver = { + .parse = uhid_hid_parse, + .raw_request = uhid_hid_raw_request, + .output_report = uhid_hid_output_report, ++ .max_buffer_size = UHID_DATA_MAX, + }; + EXPORT_SYMBOL_GPL(uhid_hid_driver); + +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index d7d1f24671009..51bc70e6ec3fe 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -480,10 +480,10 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *attr, + val = (temp - val) / 1000; + + if (sattr->index != 1) { +- data->temp[HYSTERSIS][sattr->index] &= 0xF0; ++ data->temp[HYSTERSIS][sattr->index] &= 0x0F; + data->temp[HYSTERSIS][sattr->index] |= (val & 0xF) << 4; + } else { +- data->temp[HYSTERSIS][sattr->index] &= 0x0F; ++ data->temp[HYSTERSIS][sattr->index] &= 0xF0; + data->temp[HYSTERSIS][sattr->index] |= (val & 0xF); + } + +@@ -549,11 +549,11 @@ static ssize_t show_temp_st(struct device *dev, struct device_attribute *attr, + val = data->enh_acoustics[0] & 0xf; + break; + case 1: +- val = (data->enh_acoustics[1] >> 4) & 0xf; ++ val = data->enh_acoustics[1] & 0xf; + break; + case 2: + default: +- val = data->enh_acoustics[1] & 0xf; ++ val = (data->enh_acoustics[1] >> 4) & 0xf; + break; + } + +diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c +index e1be61095532f..4f0d111ba05b6 100644 +--- a/drivers/hwmon/xgene-hwmon.c ++++ b/drivers/hwmon/xgene-hwmon.c +@@ -751,6 +751,7 @@ static int xgene_hwmon_remove(struct platform_device *pdev) + { + struct xgene_hwmon_dev *ctx = platform_get_drvdata(pdev); + ++ cancel_work_sync(&ctx->workq); + hwmon_device_unregister(ctx->hwmon_dev); + kfifo_free(&ctx->async_msg_fifo); + if (acpi_disabled) +diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c +index 9015ebc843b4e..e86fb73dbf6ab 100644 +--- a/drivers/media/i2c/m5mols/m5mols_core.c ++++ b/drivers/media/i2c/m5mols/m5mols_core.c +@@ -482,7 +482,7 @@ static enum m5mols_restype __find_restype(u32 code) + do { + if (code == m5mols_default_ffmt[type].code) + return type; +- } while (type++ != SIZE_DEFAULT_FFMT); ++ } while (++type != SIZE_DEFAULT_FFMT); + + return 0; + } +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index c8a591d8a3d9e..a09c459d62c6a 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -1857,7 +1857,6 @@ static void atmci_tasklet_func(unsigned long priv) + atmci_writel(host, ATMCI_IER, ATMCI_NOTBUSY); + state = STATE_WAITING_NOTBUSY; + } else if (host->mrq->stop) { +- atmci_writel(host, ATMCI_IER, ATMCI_CMDRDY); + atmci_send_stop_cmd(host, data); + state = STATE_SENDING_STOP; + } else { +@@ -1890,8 +1889,6 @@ static void atmci_tasklet_func(unsigned long priv) + * command to send. + */ + if (host->mrq->stop) { +- atmci_writel(host, ATMCI_IER, +- ATMCI_CMDRDY); + atmci_send_stop_cmd(host, data); + state = STATE_SENDING_STOP; + } else { +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c +index 6024b832b4d95..f713277bc517e 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -3897,6 +3897,11 @@ static int qed_init_wfq_param(struct qed_hwfn *p_hwfn, + + num_vports = p_hwfn->qm_info.num_vports; + ++ if (num_vports < 2) { ++ DP_NOTICE(p_hwfn, "Unexpected num_vports: %d\n", num_vports); ++ return -EINVAL; ++ } ++ + /* Accounting for the vports which are configured for WFQ explicitly */ + for (i = 0; i < num_vports; i++) { + u32 tmp_speed; +diff --git a/drivers/net/ethernet/sun/ldmvsw.c b/drivers/net/ethernet/sun/ldmvsw.c +index e6b96c2989b22..f0a8e3598057e 100644 +--- a/drivers/net/ethernet/sun/ldmvsw.c ++++ b/drivers/net/ethernet/sun/ldmvsw.c +@@ -289,6 +289,9 @@ static int vsw_port_probe(struct vio_dev *vdev, const struct vio_device_id *id) + + hp = mdesc_grab(); + ++ if (!hp) ++ return -ENODEV; ++ + rmac = mdesc_get_property(hp, vdev->mp, remote_macaddr_prop, &len); + err = -ENODEV; + if (!rmac) { +diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c +index 02ebbe74d93de..824f5951ad507 100644 +--- a/drivers/net/ethernet/sun/sunvnet.c ++++ b/drivers/net/ethernet/sun/sunvnet.c +@@ -430,6 +430,9 @@ static int vnet_port_probe(struct vio_dev *vdev, const struct vio_device_id *id) + + hp = mdesc_grab(); + ++ if (!hp) ++ return -ENODEV; ++ + vp = vnet_find_parent(hp, vdev->mp, vdev); + if (IS_ERR(vp)) { + pr_err("Cannot find port parent vnet\n"); +diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c +index 2306bfae057f0..d5d96e728683f 100644 +--- a/drivers/net/phy/smsc.c ++++ b/drivers/net/phy/smsc.c +@@ -112,8 +112,11 @@ static int lan911x_config_init(struct phy_device *phydev) + static int lan87xx_read_status(struct phy_device *phydev) + { + struct smsc_phy_priv *priv = phydev->priv; ++ int err; + +- int err = genphy_read_status(phydev); ++ err = genphy_read_status(phydev); ++ if (err) ++ return err; + + if (!phydev->link && priv->energy_enable) { + int i; +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index 8b9fd4e071f3d..313a4b0edc6b3 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -2213,6 +2213,13 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + size = (rx_cmd_a & RX_CMD_A_LEN) - RXW_PADDING; + align_count = (4 - ((size + RXW_PADDING) % 4)) % 4; + ++ if (unlikely(size > skb->len)) { ++ netif_dbg(dev, rx_err, dev->net, ++ "size err rx_cmd_a=0x%08x\n", ++ rx_cmd_a); ++ return 0; ++ } ++ + if (unlikely(rx_cmd_a & RX_CMD_A_RED)) { + netif_dbg(dev, rx_err, dev->net, + "Error rx_cmd_a=0x%08x\n", rx_cmd_a); +diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c +index c7da364b63584..a2d61d8240246 100644 +--- a/drivers/nfc/pn533/usb.c ++++ b/drivers/nfc/pn533/usb.c +@@ -187,6 +187,7 @@ static int pn533_usb_send_frame(struct pn533 *dev, + print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1, + out->data, out->len, false); + ++ arg.phy = phy; + init_completion(&arg.done); + cntx = phy->out_urb->context; + phy->out_urb->context = &arg; +diff --git a/drivers/nfc/st-nci/ndlc.c b/drivers/nfc/st-nci/ndlc.c +index 9477994cf9753..a3dfb3d120210 100644 +--- a/drivers/nfc/st-nci/ndlc.c ++++ b/drivers/nfc/st-nci/ndlc.c +@@ -302,13 +302,15 @@ EXPORT_SYMBOL(ndlc_probe); + + void ndlc_remove(struct llt_ndlc *ndlc) + { +- st_nci_remove(ndlc->ndev); +- + /* cancel timers */ + del_timer_sync(&ndlc->t1_timer); + del_timer_sync(&ndlc->t2_timer); + ndlc->t2_active = false; + ndlc->t1_active = false; ++ /* cancel work */ ++ cancel_work_sync(&ndlc->sm_work); ++ ++ st_nci_remove(ndlc->ndev); + + skb_queue_purge(&ndlc->rcv_q); + skb_queue_purge(&ndlc->send_q); +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index e02423d7b3b92..3d2dedd118a71 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -418,8 +418,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status) + + void nvmet_req_complete(struct nvmet_req *req, u16 status) + { ++ struct nvmet_sq *sq = req->sq; ++ + __nvmet_req_complete(req, status); +- percpu_ref_put(&req->sq->ref); ++ percpu_ref_put(&sq->ref); + } + EXPORT_SYMBOL_GPL(nvmet_req_complete); + +diff --git a/drivers/tty/serial/8250/8250_em.c b/drivers/tty/serial/8250/8250_em.c +index 0b63812149176..e0abc1fd67306 100644 +--- a/drivers/tty/serial/8250/8250_em.c ++++ b/drivers/tty/serial/8250/8250_em.c +@@ -113,8 +113,8 @@ static int serial8250_em_probe(struct platform_device *pdev) + memset(&up, 0, sizeof(up)); + up.port.mapbase = regs->start; + up.port.irq = irq->start; +- up.port.type = PORT_UNKNOWN; +- up.port.flags = UPF_BOOT_AUTOCONF | UPF_FIXED_PORT | UPF_IOREMAP; ++ up.port.type = PORT_16750; ++ up.port.flags = UPF_FIXED_PORT | UPF_IOREMAP | UPF_FIXED_TYPE; + up.port.dev = &pdev->dev; + up.port.private_data = priv; + +diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c +index 2ff39a8d29232..9313562e739e1 100644 +--- a/drivers/video/fbdev/stifb.c ++++ b/drivers/video/fbdev/stifb.c +@@ -921,6 +921,28 @@ SETUP_HCRX(struct stifb_info *fb) + + /* ------------------- driver specific functions --------------------------- */ + ++static int ++stifb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) ++{ ++ struct stifb_info *fb = container_of(info, struct stifb_info, info); ++ ++ if (var->xres != fb->info.var.xres || ++ var->yres != fb->info.var.yres || ++ var->bits_per_pixel != fb->info.var.bits_per_pixel) ++ return -EINVAL; ++ ++ var->xres_virtual = var->xres; ++ var->yres_virtual = var->yres; ++ var->xoffset = 0; ++ var->yoffset = 0; ++ var->grayscale = fb->info.var.grayscale; ++ var->red.length = fb->info.var.red.length; ++ var->green.length = fb->info.var.green.length; ++ var->blue.length = fb->info.var.blue.length; ++ ++ return 0; ++} ++ + static int + stifb_setcolreg(u_int regno, u_int red, u_int green, + u_int blue, u_int transp, struct fb_info *info) +@@ -1103,6 +1125,7 @@ stifb_init_display(struct stifb_info *fb) + + static struct fb_ops stifb_ops = { + .owner = THIS_MODULE, ++ .fb_check_var = stifb_check_var, + .fb_setcolreg = stifb_setcolreg, + .fb_blank = stifb_blank, + .fb_fillrect = cfb_fillrect, +@@ -1122,6 +1145,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref) + struct stifb_info *fb; + struct fb_info *info; + unsigned long sti_rom_address; ++ char modestr[32]; + char *dev_name; + int bpp, xres, yres; + +@@ -1302,6 +1326,9 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref) + info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA; + info->pseudo_palette = &fb->pseudo_palette; + ++ scnprintf(modestr, sizeof(modestr), "%dx%d-%d", xres, yres, bpp); ++ fb_find_mode(&info->var, info, modestr, NULL, 0, NULL, bpp); ++ + /* This has to be done !!! */ + if (fb_alloc_cmap(&info->cmap, NR_PALETTE, 0)) + goto out_err1; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 9d6d3cb515140..69360b08db736 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4814,13 +4814,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + goto bad_inode; + raw_inode = ext4_raw_inode(&iloc); + +- if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) { +- ext4_error_inode(inode, function, line, 0, +- "iget: root inode unallocated"); +- ret = -EFSCORRUPTED; +- goto bad_inode; +- } +- + if ((flags & EXT4_IGET_HANDLE) && + (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) { + ret = -ESTALE; +@@ -4891,11 +4884,16 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + * NeilBrown 1999oct15 + */ + if (inode->i_nlink == 0) { +- if ((inode->i_mode == 0 || ++ if ((inode->i_mode == 0 || flags & EXT4_IGET_SPECIAL || + !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) && + ino != EXT4_BOOT_LOADER_INO) { +- /* this inode is deleted */ +- ret = -ESTALE; ++ /* this inode is deleted or unallocated */ ++ if (flags & EXT4_IGET_SPECIAL) { ++ ext4_error_inode(inode, function, line, 0, ++ "iget: special inode unallocated"); ++ ret = -EFSCORRUPTED; ++ } else ++ ret = -ESTALE; + goto bad_inode; + } + /* The only unlinked inodes we let through here have +diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c +index 3de933354a08b..bf910f2664690 100644 +--- a/fs/ext4/page-io.c ++++ b/fs/ext4/page-io.c +@@ -388,7 +388,8 @@ static int io_submit_init_bio(struct ext4_io_submit *io, + + static int io_submit_add_bh(struct ext4_io_submit *io, + struct inode *inode, +- struct page *page, ++ struct page *pagecache_page, ++ struct page *bounce_page, + struct buffer_head *bh) + { + int ret; +@@ -403,10 +404,11 @@ submit_and_retry: + return ret; + io->io_bio->bi_write_hint = inode->i_write_hint; + } +- ret = bio_add_page(io->io_bio, page, bh->b_size, bh_offset(bh)); ++ ret = bio_add_page(io->io_bio, bounce_page ?: pagecache_page, ++ bh->b_size, bh_offset(bh)); + if (ret != bh->b_size) + goto submit_and_retry; +- wbc_account_io(io->io_wbc, page, bh->b_size); ++ wbc_account_io(io->io_wbc, pagecache_page, bh->b_size); + io->io_next_block++; + return 0; + } +@@ -514,8 +516,7 @@ int ext4_bio_write_page(struct ext4_io_submit *io, + do { + if (!buffer_async_write(bh)) + continue; +- ret = io_submit_add_bh(io, inode, +- data_page ? data_page : page, bh); ++ ret = io_submit_add_bh(io, inode, page, data_page, bh); + if (ret) { + /* + * We only get here on ENOMEM. Not much else +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index e1b40bd2f4cf2..3ee3e382015ff 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -383,6 +383,17 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino, + struct inode *inode; + int err; + ++ /* ++ * We have to check for this corruption early as otherwise ++ * iget_locked() could wait indefinitely for the state of our ++ * parent inode. ++ */ ++ if (parent->i_ino == ea_ino) { ++ ext4_error(parent->i_sb, ++ "Parent and EA inode have the same ino %lu", ea_ino); ++ return -EFSCORRUPTED; ++ } ++ + inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_NORMAL); + if (IS_ERR(inode)) { + err = PTR_ERR(inode); +diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c +index c41e7f51150fc..cef9a469f73a8 100644 +--- a/fs/sysfs/file.c ++++ b/fs/sysfs/file.c +@@ -592,7 +592,7 @@ int sysfs_emit_at(char *buf, int at, const char *fmt, ...) + va_list args; + int len; + +- if (WARN(!buf || offset_in_page(buf) || at < 0 || at >= PAGE_SIZE, ++ if (WARN(!buf || at < 0 || at >= PAGE_SIZE, + "invalid sysfs_emit_at: buf:%p at:%d\n", buf, at)) + return 0; + +diff --git a/include/linux/hid.h b/include/linux/hid.h +index f2a1f34f41e8f..b5fcc8b0b7ce1 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -770,6 +770,7 @@ struct hid_driver { + * @raw_request: send raw report request to device (e.g. feature report) + * @output_report: send output report to device + * @idle: send idle request to device ++ * @max_buffer_size: over-ride maximum data buffer size (default: HID_MAX_BUFFER_SIZE) + */ + struct hid_ll_driver { + int (*start)(struct hid_device *hdev); +@@ -794,6 +795,8 @@ struct hid_ll_driver { + int (*output_report) (struct hid_device *hdev, __u8 *buf, size_t len); + + int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype); ++ ++ unsigned int max_buffer_size; + }; + + extern struct hid_ll_driver i2c_hid_ll_driver; +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 1edc2af51e038..2cd7eb2b91739 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -258,9 +258,11 @@ struct hh_cache { + * relationship HH alignment <= LL alignment. + */ + #define LL_RESERVED_SPACE(dev) \ +- ((((dev)->hard_header_len+(dev)->needed_headroom)&~(HH_DATA_MOD - 1)) + HH_DATA_MOD) ++ ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom)) \ ++ & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD) + #define LL_RESERVED_SPACE_EXTRA(dev,extra) \ +- ((((dev)->hard_header_len+(dev)->needed_headroom+(extra))&~(HH_DATA_MOD - 1)) + HH_DATA_MOD) ++ ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom) + (extra)) \ ++ & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD) + + struct header_ops { + int (*create) (struct sk_buff *skb, struct net_device *dev, +diff --git a/include/linux/sh_intc.h b/include/linux/sh_intc.h +index c255273b02810..37ad81058d6ae 100644 +--- a/include/linux/sh_intc.h ++++ b/include/linux/sh_intc.h +@@ -97,7 +97,10 @@ struct intc_hw_desc { + unsigned int nr_subgroups; + }; + +-#define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) ++#define _INTC_SIZEOF_OR_ZERO(a) (_Generic(a, \ ++ typeof(NULL): 0, \ ++ default: sizeof(a))) ++#define _INTC_ARRAY(a) a, _INTC_SIZEOF_OR_ZERO(a)/sizeof(*a) + + #define INTC_HW_DESC(vectors, groups, mask_regs, \ + prio_regs, sense_regs, ack_regs) \ +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 4fb355736d35f..d0d33e8b594cc 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1646,7 +1646,8 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) + key.flags = end; /* overload flags, as it is unsigned long */ + + for (pg = ftrace_pages_start; pg; pg = pg->next) { +- if (end < pg->records[0].ip || ++ if (pg->index == 0 || ++ end < pg->records[0].ip || + start >= (pg->records[pg->index - 1].ip + MCOUNT_INSN_SIZE)) + continue; + rec = bsearch(&key, pg->records, pg->index, +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index ee467d744b07d..710f5609b7f4e 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -529,6 +529,9 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt, + cfg->fc_scope = RT_SCOPE_UNIVERSE; + } + ++ if (!cfg->fc_table) ++ cfg->fc_table = RT_TABLE_MAIN; ++ + if (cmd == SIOCDELRT) + return 0; + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index e9cf0d1854595..f0e4b3381258c 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -609,10 +609,10 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto) + else if (skb->protocol == htons(ETH_P_IP)) + df = inner_iph->frag_off & htons(IP_DF); + headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; +- if (headroom > dev->needed_headroom) +- dev->needed_headroom = headroom; ++ if (headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, headroom); + +- if (skb_cow_head(skb, dev->needed_headroom)) { ++ if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + ip_rt_put(rt); + goto tx_dropped; + } +@@ -786,10 +786,10 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + + max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr) + + rt->dst.header_len + ip_encap_hlen(&tunnel->encap); +- if (max_headroom > dev->needed_headroom) +- dev->needed_headroom = max_headroom; ++ if (max_headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, max_headroom); + +- if (skb_cow_head(skb, dev->needed_headroom)) { ++ if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + ip_rt_put(rt); + dev->stats.tx_dropped++; + kfree_skb(skb); +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 2a9e55411ac42..8b2d49120ce23 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3300,7 +3300,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, + th->window = htons(min(req->rsk_rcv_wnd, 65535U)); + tcp_options_write((__be32 *)(th + 1), NULL, &opts); + th->doff = (tcp_header_size >> 2); +- __TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS); ++ TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS); + + #ifdef CONFIG_TCP_MD5SIG + /* Okay, we have all we need - do the md5 hash if needed */ +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 639440032c2b8..d59bf0da29124 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1200,8 +1200,8 @@ route_lookup: + */ + max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) + + dst->header_len + t->hlen; +- if (max_headroom > dev->needed_headroom) +- dev->needed_headroom = max_headroom; ++ if (max_headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, max_headroom); + + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) +diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c +index 8f7ef167c45a7..255a716fa395d 100644 +--- a/net/iucv/iucv.c ++++ b/net/iucv/iucv.c +@@ -119,7 +119,7 @@ struct iucv_irq_data { + u16 ippathid; + u8 ipflags1; + u8 iptype; +- u32 res2[8]; ++ u32 res2[9]; + }; + + struct iucv_irq_list {
