aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLCPD Auto Merger2016-12-29 08:18:19 -0600
committerLCPD Auto Merger2016-12-29 08:18:19 -0600
commitea9d02d53d2e605ef872379e311ceb35fcd3100e (patch)
treee07f8df74574c82f2c7fd0659c1a984e8a58f924 /drivers
parent7f655674db9f3a80c99a8e29c0a6046ec14a7d27 (diff)
parentb56fa3bd73d45ef31478b7e3ab97570a0dd79c44 (diff)
downloadti-linux-kernel-ti-lsk-linux-4.1.y.tar.gz
ti-linux-kernel-ti-lsk-linux-4.1.y.tar.xz
ti-linux-kernel-ti-lsk-linux-4.1.y.zip
Merge branch 'ti-linux-4.1.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel into ti-lsk-linux-4.1.yti-lsk-linux-4.1.y
TI-Feature: ti_linux_base_lsk TI-Tree: git@git.ti.com:ti-linux-kernel/ti-linux-kernel.git TI-Branch: ti-linux-4.1.y * 'ti-linux-4.1.y' of git.ti.com:ti-linux-kernel/ti-linux-kernel: (29 commits) Linux 4.1.37 scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression tipc: check minimum bearer MTU net: ping: check minimum size on ICMP header length packet: fix race condition in packet_set_ring net: add recursion limit to GRO Bluetooth: Fix potential NULL dereference in RFCOMM bind callback ptrace: being capable wrt a process requires mapped uids/gids scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() mnt: Add a per mount namespace limit on the number of mounts posix_acl: Clear SGID bit when setting file permissions fs: Avoid premature clearing of capabilities fs: Give dentry to inode_change_ok() instead of inode nfsd: Disable NFSv2 timestamp workaround for NFSv3+ fuse: Propagate dentry down to inode_change_ok() xfs: Propagate dentry down to inode_change_ok() xattr: Option to disable meta-data block cache tcp: fix use after free in tcp_xmit_retransmit_queue() x86/kexec: add -fno-PIE scripts/has-stack-protector: add -fno-PIE ... Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/bus/arm-ccn.c36
-rw-r--r--drivers/gpu/drm/msm/msm_gem_submit.c27
-rw-r--r--drivers/mtd/nand/davinci_nand.c3
-rw-r--r--drivers/net/can/dev.c27
-rw-r--r--drivers/net/vxlan.c2
-rw-r--r--drivers/scsi/arcmsr/arcmsr_hba.c8
-rw-r--r--drivers/scsi/megaraid/megaraid_sas.h2
-rw-r--r--drivers/staging/lustre/lustre/llite/llite_lib.c2
8 files changed, 85 insertions, 22 deletions
diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
index 27fd0dacad5f..4d523cfe51ce 100644
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -183,6 +183,7 @@ struct arm_ccn {
183 struct arm_ccn_component *xp; 183 struct arm_ccn_component *xp;
184 184
185 struct arm_ccn_dt dt; 185 struct arm_ccn_dt dt;
186 int mn_id;
186}; 187};
187 188
188 189
@@ -322,6 +323,7 @@ struct arm_ccn_pmu_event {
322static ssize_t arm_ccn_pmu_event_show(struct device *dev, 323static ssize_t arm_ccn_pmu_event_show(struct device *dev,
323 struct device_attribute *attr, char *buf) 324 struct device_attribute *attr, char *buf)
324{ 325{
326 struct arm_ccn *ccn = pmu_to_arm_ccn(dev_get_drvdata(dev));
325 struct arm_ccn_pmu_event *event = container_of(attr, 327 struct arm_ccn_pmu_event *event = container_of(attr,
326 struct arm_ccn_pmu_event, attr); 328 struct arm_ccn_pmu_event, attr);
327 ssize_t res; 329 ssize_t res;
@@ -336,6 +338,26 @@ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
336 if (event->mask) 338 if (event->mask)
337 res += snprintf(buf + res, PAGE_SIZE - res, ",mask=0x%x", 339 res += snprintf(buf + res, PAGE_SIZE - res, ",mask=0x%x",
338 event->mask); 340 event->mask);
341
342 /* Arguments required by an event */
343 switch (event->type) {
344 case CCN_TYPE_CYCLES:
345 break;
346 case CCN_TYPE_XP:
347 res += snprintf(buf + res, PAGE_SIZE - res,
348 ",xp=?,port=?,vc=?,dir=?");
349 if (event->event == CCN_EVENT_WATCHPOINT)
350 res += snprintf(buf + res, PAGE_SIZE - res,
351 ",cmp_l=?,cmp_h=?,mask=?");
352 break;
353 case CCN_TYPE_MN:
354 res += snprintf(buf + res, PAGE_SIZE - res, ",node=%d", ccn->mn_id);
355 break;
356 default:
357 res += snprintf(buf + res, PAGE_SIZE - res, ",node=?");
358 break;
359 }
360
339 res += snprintf(buf + res, PAGE_SIZE - res, "\n"); 361 res += snprintf(buf + res, PAGE_SIZE - res, "\n");
340 362
341 return res; 363 return res;
@@ -360,9 +382,9 @@ static umode_t arm_ccn_pmu_events_is_visible(struct kobject *kobj,
360} 382}
361 383
362static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = { 384static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = {
363 CCN_EVENT_MN(eobarrier, "dir=0,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE), 385 CCN_EVENT_MN(eobarrier, "dir=1,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
364 CCN_EVENT_MN(ecbarrier, "dir=0,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE), 386 CCN_EVENT_MN(ecbarrier, "dir=1,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
365 CCN_EVENT_MN(dvmop, "dir=0,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE), 387 CCN_EVENT_MN(dvmop, "dir=1,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
366 CCN_EVENT_HNI(txdatflits, "dir=1,vc=3", CCN_IDX_MASK_ANY), 388 CCN_EVENT_HNI(txdatflits, "dir=1,vc=3", CCN_IDX_MASK_ANY),
367 CCN_EVENT_HNI(rxdatflits, "dir=0,vc=3", CCN_IDX_MASK_ANY), 389 CCN_EVENT_HNI(rxdatflits, "dir=0,vc=3", CCN_IDX_MASK_ANY),
368 CCN_EVENT_HNI(txreqflits, "dir=1,vc=0", CCN_IDX_MASK_ANY), 390 CCN_EVENT_HNI(txreqflits, "dir=1,vc=0", CCN_IDX_MASK_ANY),
@@ -649,6 +671,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
649 671
650 /* Validate node/xp vs topology */ 672 /* Validate node/xp vs topology */
651 switch (type) { 673 switch (type) {
674 case CCN_TYPE_MN:
675 if (node_xp != ccn->mn_id) {
676 dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
677 return -EINVAL;
678 }
679 break;
652 case CCN_TYPE_XP: 680 case CCN_TYPE_XP:
653 if (node_xp >= ccn->num_xps) { 681 if (node_xp >= ccn->num_xps) {
654 dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp); 682 dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
@@ -1214,6 +1242,8 @@ static int arm_ccn_init_nodes(struct arm_ccn *ccn, int region,
1214 1242
1215 switch (type) { 1243 switch (type) {
1216 case CCN_TYPE_MN: 1244 case CCN_TYPE_MN:
1245 ccn->mn_id = id;
1246 return 0;
1217 case CCN_TYPE_DT: 1247 case CCN_TYPE_DT:
1218 return 0; 1248 return 0;
1219 case CCN_TYPE_XP: 1249 case CCN_TYPE_XP:
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index cd0554f68316..4ff8c334e7c8 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -55,6 +55,14 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
55 return submit; 55 return submit;
56} 56}
57 57
58static inline unsigned long __must_check
59copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
60{
61 if (access_ok(VERIFY_READ, from, n))
62 return __copy_from_user_inatomic(to, from, n);
63 return -EFAULT;
64}
65
58static int submit_lookup_objects(struct msm_gem_submit *submit, 66static int submit_lookup_objects(struct msm_gem_submit *submit,
59 struct drm_msm_gem_submit *args, struct drm_file *file) 67 struct drm_msm_gem_submit *args, struct drm_file *file)
60{ 68{
@@ -62,6 +70,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
62 int ret = 0; 70 int ret = 0;
63 71
64 spin_lock(&file->table_lock); 72 spin_lock(&file->table_lock);
73 pagefault_disable();
65 74
66 for (i = 0; i < args->nr_bos; i++) { 75 for (i = 0; i < args->nr_bos; i++) {
67 struct drm_msm_gem_submit_bo submit_bo; 76 struct drm_msm_gem_submit_bo submit_bo;
@@ -70,10 +79,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
70 void __user *userptr = 79 void __user *userptr =
71 to_user_ptr(args->bos + (i * sizeof(submit_bo))); 80 to_user_ptr(args->bos + (i * sizeof(submit_bo)));
72 81
73 ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo)); 82 ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
74 if (ret) { 83 if (unlikely(ret)) {
75 ret = -EFAULT; 84 pagefault_enable();
76 goto out_unlock; 85 spin_unlock(&file->table_lock);
86 ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
87 if (ret)
88 goto out;
89 spin_lock(&file->table_lock);
90 pagefault_disable();
77 } 91 }
78 92
79 if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) { 93 if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
@@ -113,9 +127,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
113 } 127 }
114 128
115out_unlock: 129out_unlock:
116 submit->nr_bos = i; 130 pagefault_enable();
117 spin_unlock(&file->table_lock); 131 spin_unlock(&file->table_lock);
118 132
133out:
134 submit->nr_bos = i;
135
119 return ret; 136 return ret;
120} 137}
121 138
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index 0f88e25123a0..4ead0cc5bac4 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -241,6 +241,9 @@ static void nand_davinci_hwctl_4bit(struct mtd_info *mtd, int mode)
241 unsigned long flags; 241 unsigned long flags;
242 u32 val; 242 u32 val;
243 243
244 /* Reset ECC hardware */
245 davinci_nand_readl(info, NAND_4BIT_ECC1_OFFSET);
246
244 spin_lock_irqsave(&davinci_nand_lock, flags); 247 spin_lock_irqsave(&davinci_nand_lock, flags);
245 248
246 /* Start 4-bit ECC calculation for read/write */ 249 /* Start 4-bit ECC calculation for read/write */
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index ad535a854e5c..eab132778e67 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -21,6 +21,7 @@
21#include <linux/slab.h> 21#include <linux/slab.h>
22#include <linux/netdevice.h> 22#include <linux/netdevice.h>
23#include <linux/if_arp.h> 23#include <linux/if_arp.h>
24#include <linux/workqueue.h>
24#include <linux/can.h> 25#include <linux/can.h>
25#include <linux/can/dev.h> 26#include <linux/can/dev.h>
26#include <linux/can/skb.h> 27#include <linux/can/skb.h>
@@ -471,9 +472,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);
471/* 472/*
472 * CAN device restart for bus-off recovery 473 * CAN device restart for bus-off recovery
473 */ 474 */
474static void can_restart(unsigned long data) 475static void can_restart(struct net_device *dev)
475{ 476{
476 struct net_device *dev = (struct net_device *)data;
477 struct can_priv *priv = netdev_priv(dev); 477 struct can_priv *priv = netdev_priv(dev);
478 struct net_device_stats *stats = &dev->stats; 478 struct net_device_stats *stats = &dev->stats;
479 struct sk_buff *skb; 479 struct sk_buff *skb;
@@ -513,6 +513,14 @@ restart:
513 netdev_err(dev, "Error %d during restart", err); 513 netdev_err(dev, "Error %d during restart", err);
514} 514}
515 515
516static void can_restart_work(struct work_struct *work)
517{
518 struct delayed_work *dwork = to_delayed_work(work);
519 struct can_priv *priv = container_of(dwork, struct can_priv, restart_work);
520
521 can_restart(priv->dev);
522}
523
516int can_restart_now(struct net_device *dev) 524int can_restart_now(struct net_device *dev)
517{ 525{
518 struct can_priv *priv = netdev_priv(dev); 526 struct can_priv *priv = netdev_priv(dev);
@@ -526,8 +534,8 @@ int can_restart_now(struct net_device *dev)
526 if (priv->state != CAN_STATE_BUS_OFF) 534 if (priv->state != CAN_STATE_BUS_OFF)
527 return -EBUSY; 535 return -EBUSY;
528 536
529 /* Runs as soon as possible in the timer context */ 537 cancel_delayed_work_sync(&priv->restart_work);
530 mod_timer(&priv->restart_timer, jiffies); 538 can_restart(dev);
531 539
532 return 0; 540 return 0;
533} 541}
@@ -548,8 +556,8 @@ void can_bus_off(struct net_device *dev)
548 netif_carrier_off(dev); 556 netif_carrier_off(dev);
549 557
550 if (priv->restart_ms) 558 if (priv->restart_ms)
551 mod_timer(&priv->restart_timer, 559 schedule_delayed_work(&priv->restart_work,
552 jiffies + (priv->restart_ms * HZ) / 1000); 560 msecs_to_jiffies(priv->restart_ms));
553} 561}
554EXPORT_SYMBOL_GPL(can_bus_off); 562EXPORT_SYMBOL_GPL(can_bus_off);
555 563
@@ -658,6 +666,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)
658 return NULL; 666 return NULL;
659 667
660 priv = netdev_priv(dev); 668 priv = netdev_priv(dev);
669 priv->dev = dev;
661 670
662 if (echo_skb_max) { 671 if (echo_skb_max) {
663 priv->echo_skb_max = echo_skb_max; 672 priv->echo_skb_max = echo_skb_max;
@@ -667,7 +676,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)
667 676
668 priv->state = CAN_STATE_STOPPED; 677 priv->state = CAN_STATE_STOPPED;
669 678
670 init_timer(&priv->restart_timer); 679 INIT_DELAYED_WORK(&priv->restart_work, can_restart_work);
671 680
672 return dev; 681 return dev;
673} 682}
@@ -748,8 +757,6 @@ int open_candev(struct net_device *dev)
748 if (!netif_carrier_ok(dev)) 757 if (!netif_carrier_ok(dev))
749 netif_carrier_on(dev); 758 netif_carrier_on(dev);
750 759
751 setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
752
753 return 0; 760 return 0;
754} 761}
755EXPORT_SYMBOL_GPL(open_candev); 762EXPORT_SYMBOL_GPL(open_candev);
@@ -764,7 +771,7 @@ void close_candev(struct net_device *dev)
764{ 771{
765 struct can_priv *priv = netdev_priv(dev); 772 struct can_priv *priv = netdev_priv(dev);
766 773
767 del_timer_sync(&priv->restart_timer); 774 cancel_delayed_work_sync(&priv->restart_work);
768 can_flush_echo_skb(dev); 775 can_flush_echo_skb(dev);
769} 776}
770EXPORT_SYMBOL_GPL(close_candev); 777EXPORT_SYMBOL_GPL(close_candev);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 940f78e41993..d9e873c3a273 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -635,7 +635,7 @@ static struct sk_buff **vxlan_gro_receive(struct sk_buff **head,
635 } 635 }
636 } 636 }
637 637
638 pp = eth_gro_receive(head, skb); 638 pp = call_gro_receive(eth_gro_receive, head, skb);
639 639
640out: 640out:
641 skb_gro_remcsum_cleanup(skb, &grc); 641 skb_gro_remcsum_cleanup(skb, &grc);
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 2926295a936d..c9f87cdc85c1 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -2300,7 +2300,8 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
2300 } 2300 }
2301 case ARCMSR_MESSAGE_WRITE_WQBUFFER: { 2301 case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
2302 unsigned char *ver_addr; 2302 unsigned char *ver_addr;
2303 int32_t user_len, cnt2end; 2303 uint32_t user_len;
2304 int32_t cnt2end;
2304 uint8_t *pQbuffer, *ptmpuserbuffer; 2305 uint8_t *pQbuffer, *ptmpuserbuffer;
2305 ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC); 2306 ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC);
2306 if (!ver_addr) { 2307 if (!ver_addr) {
@@ -2309,6 +2310,11 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
2309 } 2310 }
2310 ptmpuserbuffer = ver_addr; 2311 ptmpuserbuffer = ver_addr;
2311 user_len = pcmdmessagefld->cmdmessage.Length; 2312 user_len = pcmdmessagefld->cmdmessage.Length;
2313 if (user_len > ARCMSR_API_DATA_BUFLEN) {
2314 retvalue = ARCMSR_MESSAGE_FAIL;
2315 kfree(ver_addr);
2316 goto message_out;
2317 }
2312 memcpy(ptmpuserbuffer, 2318 memcpy(ptmpuserbuffer,
2313 pcmdmessagefld->messagedatabuffer, user_len); 2319 pcmdmessagefld->messagedatabuffer, user_len);
2314 spin_lock_irqsave(&acb->wqbuffer_lock, flags); 2320 spin_lock_irqsave(&acb->wqbuffer_lock, flags);
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index 14e5c7cea929..1fcd31c6b37b 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -1862,7 +1862,7 @@ struct megasas_instance_template {
1862}; 1862};
1863 1863
1864#define MEGASAS_IS_LOGICAL(scp) \ 1864#define MEGASAS_IS_LOGICAL(scp) \
1865 (scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1 1865 ((scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1)
1866 1866
1867#define MEGASAS_DEV_INDEX(inst, scp) \ 1867#define MEGASAS_DEV_INDEX(inst, scp) \
1868 ((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + \ 1868 ((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + \
diff --git a/drivers/staging/lustre/lustre/llite/llite_lib.c b/drivers/staging/lustre/lustre/llite/llite_lib.c
index a27af7882170..d60425996948 100644
--- a/drivers/staging/lustre/lustre/llite/llite_lib.c
+++ b/drivers/staging/lustre/lustre/llite/llite_lib.c
@@ -1323,7 +1323,7 @@ int ll_setattr_raw(struct dentry *dentry, struct iattr *attr, bool hsm_import)
1323 attr->ia_valid |= ATTR_MTIME | ATTR_CTIME; 1323 attr->ia_valid |= ATTR_MTIME | ATTR_CTIME;
1324 } 1324 }
1325 1325
1326 /* POSIX: check before ATTR_*TIME_SET set (from inode_change_ok) */ 1326 /* POSIX: check before ATTR_*TIME_SET set (from setattr_prepare) */
1327 if (attr->ia_valid & TIMES_SET_FLAGS) { 1327 if (attr->ia_valid & TIMES_SET_FLAGS) {
1328 if ((!uid_eq(current_fsuid(), inode->i_uid)) && 1328 if ((!uid_eq(current_fsuid(), inode->i_uid)) &&
1329 !capable(CFS_CAP_FOWNER)) 1329 !capable(CFS_CAP_FOWNER))