799 lines
28 KiB
Diff
799 lines
28 KiB
Diff
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
|
|
index ffab8b5caa603..30ba179392d81 100644
|
|
--- a/Documentation/sysctl/kernel.txt
|
|
+++ b/Documentation/sysctl/kernel.txt
|
|
@@ -90,6 +90,7 @@ show up in /proc/sys/kernel:
|
|
- sysctl_writes_strict
|
|
- tainted
|
|
- threads-max
|
|
+- unprivileged_bpf_disabled
|
|
- unknown_nmi_panic
|
|
- watchdog
|
|
- watchdog_thresh
|
|
@@ -995,6 +996,26 @@ available RAM pages threads-max is reduced accordingly.
|
|
|
|
==============================================================
|
|
|
|
+unprivileged_bpf_disabled:
|
|
+
|
|
+Writing 1 to this entry will disable unprivileged calls to bpf();
|
|
+once disabled, calling bpf() without CAP_SYS_ADMIN will return
|
|
+-EPERM. Once set to 1, this can't be cleared from the running kernel
|
|
+anymore.
|
|
+
|
|
+Writing 2 to this entry will also disable unprivileged calls to bpf(),
|
|
+however, an admin can still change this setting later on, if needed, by
|
|
+writing 0 or 1 to this entry.
|
|
+
|
|
+If BPF_UNPRIV_DEFAULT_OFF is enabled in the kernel config, then this
|
|
+entry will default to 2 instead of 0.
|
|
+
|
|
+ 0 - Unprivileged calls to bpf() are enabled
|
|
+ 1 - Unprivileged calls to bpf() are disabled without recovery
|
|
+ 2 - Unprivileged calls to bpf() are disabled
|
|
+
|
|
+==============================================================
|
|
+
|
|
unknown_nmi_panic:
|
|
|
|
The value in this file affects behavior of handling NMI. When the
|
|
diff --git a/Makefile b/Makefile
|
|
index 776408b6c56e7..d2a09d4a37082 100644
|
|
--- a/Makefile
|
|
+++ b/Makefile
|
|
@@ -1,6 +1,6 @@
|
|
VERSION = 4
|
|
PATCHLEVEL = 9
|
|
-SUBLEVEL = 301
|
|
+SUBLEVEL = 302
|
|
EXTRAVERSION =
|
|
NAME = Roaring Lionus
|
|
|
|
diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts
|
|
index 57e29977ba06c..acaa3a7c2fc65 100644
|
|
--- a/arch/arm/boot/dts/imx23-evk.dts
|
|
+++ b/arch/arm/boot/dts/imx23-evk.dts
|
|
@@ -48,7 +48,6 @@
|
|
MX23_PAD_LCD_RESET__GPIO_1_18
|
|
MX23_PAD_PWM3__GPIO_1_29
|
|
MX23_PAD_PWM4__GPIO_1_30
|
|
- MX23_PAD_SSP1_DETECT__SSP1_DETECT
|
|
>;
|
|
fsl,drive-strength = <MXS_DRIVE_4mA>;
|
|
fsl,voltage = <MXS_VOLTAGE_HIGH>;
|
|
diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
|
|
index fc4ae2e423bd7..b0fdcae66ead3 100644
|
|
--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
|
|
+++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
|
|
@@ -9,6 +9,8 @@
|
|
*
|
|
*/
|
|
|
|
+#include <dt-bindings/gpio/gpio.h>
|
|
+
|
|
/ {
|
|
aliases {
|
|
backlight = &backlight;
|
|
@@ -201,6 +203,7 @@
|
|
MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
|
|
MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
|
|
MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
|
|
+ MX6QDL_PAD_SD3_DAT5__GPIO7_IO00 0x1b0b0
|
|
>;
|
|
};
|
|
|
|
@@ -267,7 +270,7 @@
|
|
&usdhc3 {
|
|
pinctrl-names = "default";
|
|
pinctrl-0 = <&pinctrl_usdhc3>;
|
|
- non-removable;
|
|
+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
|
|
status = "okay";
|
|
};
|
|
|
|
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
|
|
index da9813f09d7d7..2b5ae00f8df25 100644
|
|
--- a/drivers/hid/Kconfig
|
|
+++ b/drivers/hid/Kconfig
|
|
@@ -865,7 +865,7 @@ config THRUSTMASTER_FF
|
|
|
|
config HID_WACOM
|
|
tristate "Wacom Intuos/Graphire tablet support (USB)"
|
|
- depends on HID
|
|
+ depends on USB_HID
|
|
select POWER_SUPPLY
|
|
select NEW_LEDS
|
|
select LEDS_CLASS
|
|
diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
|
|
index d19ad92eede95..b7d7f40885689 100644
|
|
--- a/drivers/hwmon/dell-smm-hwmon.c
|
|
+++ b/drivers/hwmon/dell-smm-hwmon.c
|
|
@@ -294,7 +294,7 @@ static int i8k_get_fan_nominal_speed(int fan, int speed)
|
|
}
|
|
|
|
/*
|
|
- * Set the fan speed (off, low, high). Returns the new fan status.
|
|
+ * Set the fan speed (off, low, high, ...).
|
|
*/
|
|
static int i8k_set_fan(int fan, int speed)
|
|
{
|
|
@@ -303,7 +303,7 @@ static int i8k_set_fan(int fan, int speed)
|
|
speed = (speed < 0) ? 0 : ((speed > i8k_fan_max) ? i8k_fan_max : speed);
|
|
regs.ebx = (fan & 0xff) | (speed << 8);
|
|
|
|
- return i8k_smm(®s) ? : i8k_get_fan_status(fan);
|
|
+ return i8k_smm(®s);
|
|
}
|
|
|
|
static int i8k_get_temp_type(int sensor)
|
|
@@ -417,7 +417,7 @@ static int
|
|
i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
|
|
{
|
|
int val = 0;
|
|
- int speed;
|
|
+ int speed, err;
|
|
unsigned char buff[16];
|
|
int __user *argp = (int __user *)arg;
|
|
|
|
@@ -478,7 +478,11 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
|
|
if (copy_from_user(&speed, argp + 1, sizeof(int)))
|
|
return -EFAULT;
|
|
|
|
- val = i8k_set_fan(val, speed);
|
|
+ err = i8k_set_fan(val, speed);
|
|
+ if (err < 0)
|
|
+ return err;
|
|
+
|
|
+ val = i8k_get_fan_status(val);
|
|
break;
|
|
|
|
default:
|
|
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
|
|
index 323b86b38b3a3..6cd2ae95e21ed 100644
|
|
--- a/drivers/input/serio/i8042-x86ia64io.h
|
|
+++ b/drivers/input/serio/i8042-x86ia64io.h
|
|
@@ -586,11 +586,6 @@ static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = {
|
|
DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
|
|
DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
|
|
},
|
|
- }, {
|
|
- .matches = {
|
|
- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
|
|
- DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
|
|
- },
|
|
},
|
|
{ }
|
|
};
|
|
@@ -677,6 +672,12 @@ static const struct dmi_system_id i8042_dmi_noselftest_table[] = {
|
|
DMI_MATCH(DMI_PRODUCT_NAME, "Z450LA"),
|
|
},
|
|
},
|
|
+ {
|
|
+ .matches = {
|
|
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
|
|
+ DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
|
|
+ },
|
|
+ },
|
|
{ }
|
|
};
|
|
static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
|
|
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
|
|
index 1e2ee97b92406..578d8e12e2d21 100644
|
|
--- a/drivers/net/bonding/bond_3ad.c
|
|
+++ b/drivers/net/bonding/bond_3ad.c
|
|
@@ -971,8 +971,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
|
|
if (port->aggregator &&
|
|
port->aggregator->is_active &&
|
|
!__port_is_enabled(port)) {
|
|
-
|
|
__enable_port(port);
|
|
+ *update_slave_arr = true;
|
|
}
|
|
}
|
|
break;
|
|
@@ -1724,6 +1724,7 @@ static void ad_agg_selection_logic(struct aggregator *agg,
|
|
port = port->next_port_in_aggregator) {
|
|
__enable_port(port);
|
|
}
|
|
+ *update_slave_arr = true;
|
|
}
|
|
}
|
|
|
|
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
|
|
index 46998a58e3d96..467dc0c60759f 100644
|
|
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
|
|
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
|
|
@@ -278,16 +278,6 @@ static int axienet_dma_bd_init(struct net_device *ndev)
|
|
axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET,
|
|
cr | XAXIDMA_CR_RUNSTOP_MASK);
|
|
|
|
- /* Wait for PhyRstCmplt bit to be set, indicating the PHY reset has finished */
|
|
- ret = read_poll_timeout(axienet_ior, value,
|
|
- value & XAE_INT_PHYRSTCMPLT_MASK,
|
|
- DELAY_OF_ONE_MILLISEC, 50000, false, lp,
|
|
- XAE_IS_OFFSET);
|
|
- if (ret) {
|
|
- dev_err(lp->dev, "%s: timeout waiting for PhyRstCmplt\n", __func__);
|
|
- return ret;
|
|
- }
|
|
-
|
|
return 0;
|
|
out:
|
|
axienet_dma_bd_release(ndev);
|
|
diff --git a/drivers/staging/fbtft/fbtft.h b/drivers/staging/fbtft/fbtft.h
|
|
index 0275319906748..a76723a4219a6 100644
|
|
--- a/drivers/staging/fbtft/fbtft.h
|
|
+++ b/drivers/staging/fbtft/fbtft.h
|
|
@@ -343,7 +343,10 @@ static int __init fbtft_driver_module_init(void) \
|
|
ret = spi_register_driver(&fbtft_driver_spi_driver); \
|
|
if (ret < 0) \
|
|
return ret; \
|
|
- return platform_driver_register(&fbtft_driver_platform_driver); \
|
|
+ ret = platform_driver_register(&fbtft_driver_platform_driver); \
|
|
+ if (ret < 0) \
|
|
+ spi_unregister_driver(&fbtft_driver_spi_driver); \
|
|
+ return ret; \
|
|
} \
|
|
\
|
|
static void __exit fbtft_driver_module_exit(void) \
|
|
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
|
|
index 761b065a40bb3..b2a76ecb5789c 100644
|
|
--- a/drivers/target/iscsi/iscsi_target_tpg.c
|
|
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
|
|
@@ -452,6 +452,9 @@ static bool iscsit_tpg_check_network_portal(
|
|
break;
|
|
}
|
|
spin_unlock(&tpg->tpg_np_lock);
|
|
+
|
|
+ if (match)
|
|
+ break;
|
|
}
|
|
spin_unlock(&tiqn->tiqn_tpg_lock);
|
|
|
|
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
|
|
index 8214b0326b3a1..690cb5a63f9a0 100644
|
|
--- a/drivers/tty/n_tty.c
|
|
+++ b/drivers/tty/n_tty.c
|
|
@@ -1377,7 +1377,7 @@ handle_newline:
|
|
put_tty_queue(c, ldata);
|
|
smp_store_release(&ldata->canon_head, ldata->read_head);
|
|
kill_fasync(&tty->fasync, SIGIO, POLL_IN);
|
|
- wake_up_interruptible_poll(&tty->read_wait, POLLIN);
|
|
+ wake_up_interruptible_poll(&tty->read_wait, POLLIN | POLLRDNORM);
|
|
return 0;
|
|
}
|
|
}
|
|
@@ -1658,7 +1658,7 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
|
|
|
|
if (read_cnt(ldata)) {
|
|
kill_fasync(&tty->fasync, SIGIO, POLL_IN);
|
|
- wake_up_interruptible_poll(&tty->read_wait, POLLIN);
|
|
+ wake_up_interruptible_poll(&tty->read_wait, POLLIN | POLLRDNORM);
|
|
}
|
|
}
|
|
|
|
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
|
|
index b4f528d26bf1a..5c6243a31166a 100644
|
|
--- a/drivers/tty/serial/sh-sci.c
|
|
+++ b/drivers/tty/serial/sh-sci.c
|
|
@@ -2377,6 +2377,10 @@ done:
|
|
|
|
serial_port_out(port, SCFCR, ctrl);
|
|
}
|
|
+ if (port->flags & UPF_HARD_FLOW) {
|
|
+ /* Refresh (Auto) RTS */
|
|
+ sci_set_mctrl(port, port->mctrl);
|
|
+ }
|
|
|
|
scr_val |= s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0);
|
|
dev_dbg(port->dev, "SCSCR 0x%x\n", scr_val);
|
|
@@ -2391,10 +2395,6 @@ done:
|
|
*/
|
|
udelay(DIV_ROUND_UP(10 * 1000000, baud));
|
|
}
|
|
- if (port->flags & UPF_HARD_FLOW) {
|
|
- /* Refresh (Auto) RTS */
|
|
- sci_set_mctrl(port, port->mctrl);
|
|
- }
|
|
|
|
#ifdef CONFIG_SERIAL_SH_SCI_DMA
|
|
/*
|
|
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
|
|
index e1c1627a3356b..e785a8a7f1c22 100644
|
|
--- a/drivers/tty/vt/vt_ioctl.c
|
|
+++ b/drivers/tty/vt/vt_ioctl.c
|
|
@@ -694,6 +694,7 @@ int vt_ioctl(struct tty_struct *tty,
|
|
ret = -ENXIO;
|
|
else {
|
|
arg--;
|
|
+ arg = array_index_nospec(arg, MAX_NR_CONSOLES);
|
|
console_lock();
|
|
ret = vc_allocate(arg);
|
|
console_unlock();
|
|
@@ -718,9 +719,9 @@ int vt_ioctl(struct tty_struct *tty,
|
|
if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
|
|
ret = -ENXIO;
|
|
else {
|
|
- vsa.console = array_index_nospec(vsa.console,
|
|
- MAX_NR_CONSOLES + 1);
|
|
vsa.console--;
|
|
+ vsa.console = array_index_nospec(vsa.console,
|
|
+ MAX_NR_CONSOLES);
|
|
console_lock();
|
|
ret = vc_allocate(vsa.console);
|
|
if (ret == 0) {
|
|
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
|
|
index e7ad3ae4ea6bd..65bcbbad6d545 100644
|
|
--- a/drivers/usb/dwc2/gadget.c
|
|
+++ b/drivers/usb/dwc2/gadget.c
|
|
@@ -3979,7 +3979,7 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg)
|
|
hsotg->gadget.speed = USB_SPEED_UNKNOWN;
|
|
spin_unlock_irqrestore(&hsotg->lock, flags);
|
|
|
|
- for (ep = 0; ep < hsotg->num_of_eps; ep++) {
|
|
+ for (ep = 1; ep < hsotg->num_of_eps; ep++) {
|
|
if (hsotg->eps_in[ep])
|
|
dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
|
|
if (hsotg->eps_out[ep])
|
|
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
|
|
index e340ef67321e5..58c4b745eae13 100644
|
|
--- a/drivers/usb/dwc3/gadget.c
|
|
+++ b/drivers/usb/dwc3/gadget.c
|
|
@@ -902,6 +902,19 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
|
|
if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable)
|
|
trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(req->request.stream_id);
|
|
|
|
+ /*
|
|
+ * As per data book 4.2.3.2TRB Control Bit Rules section
|
|
+ *
|
|
+ * The controller autonomously checks the HWO field of a TRB to determine if the
|
|
+ * entire TRB is valid. Therefore, software must ensure that the rest of the TRB
|
|
+ * is valid before setting the HWO field to '1'. In most systems, this means that
|
|
+ * software must update the fourth DWORD of a TRB last.
|
|
+ *
|
|
+ * However there is a possibility of CPU re-ordering here which can cause
|
|
+ * controller to observe the HWO bit set prematurely.
|
|
+ * Add a write memory barrier to prevent CPU re-ordering.
|
|
+ */
|
|
+ wmb();
|
|
trb->ctrl |= DWC3_TRB_CTRL_HWO;
|
|
|
|
trace_dwc3_prepare_trb(dep, trb);
|
|
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
|
|
index a7c44a3cb2d25..3b8a8e2d34848 100644
|
|
--- a/drivers/usb/gadget/composite.c
|
|
+++ b/drivers/usb/gadget/composite.c
|
|
@@ -1932,6 +1932,9 @@ unknown:
|
|
if (w_index != 0x5 || (w_value >> 8))
|
|
break;
|
|
interface = w_value & 0xFF;
|
|
+ if (interface >= MAX_CONFIG_INTERFACES ||
|
|
+ !os_desc_cfg->interface[interface])
|
|
+ break;
|
|
buf[6] = w_index;
|
|
if (w_length == 0x0A) {
|
|
count = count_ext_prop(os_desc_cfg,
|
|
diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
|
|
index ab6ac1b74ac0f..a912b6b9153fd 100644
|
|
--- a/drivers/usb/gadget/function/rndis.c
|
|
+++ b/drivers/usb/gadget/function/rndis.c
|
|
@@ -642,14 +642,17 @@ static int rndis_set_response(struct rndis_params *params,
|
|
rndis_set_cmplt_type *resp;
|
|
rndis_resp_t *r;
|
|
|
|
+ BufLength = le32_to_cpu(buf->InformationBufferLength);
|
|
+ BufOffset = le32_to_cpu(buf->InformationBufferOffset);
|
|
+ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
|
|
+ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
|
|
+ return -EINVAL;
|
|
+
|
|
r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
|
|
if (!r)
|
|
return -ENOMEM;
|
|
resp = (rndis_set_cmplt_type *)r->buf;
|
|
|
|
- BufLength = le32_to_cpu(buf->InformationBufferLength);
|
|
- BufOffset = le32_to_cpu(buf->InformationBufferOffset);
|
|
-
|
|
#ifdef VERBOSE_DEBUG
|
|
pr_debug("%s: Length: %d\n", __func__, BufLength);
|
|
pr_debug("%s: Offset: %d\n", __func__, BufOffset);
|
|
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
|
|
index c6ff79360302f..a8573da2717a1 100644
|
|
--- a/drivers/usb/serial/ch341.c
|
|
+++ b/drivers/usb/serial/ch341.c
|
|
@@ -74,6 +74,7 @@ static const struct usb_device_id id_table[] = {
|
|
{ USB_DEVICE(0x1a86, 0x5523) },
|
|
{ USB_DEVICE(0x1a86, 0x7522) },
|
|
{ USB_DEVICE(0x1a86, 0x7523) },
|
|
+ { USB_DEVICE(0x2184, 0x0057) },
|
|
{ USB_DEVICE(0x4348, 0x5523) },
|
|
{ USB_DEVICE(0x9986, 0x7523) },
|
|
{ },
|
|
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
|
|
index dde28ede396bf..ddee42e44a33b 100644
|
|
--- a/drivers/usb/serial/cp210x.c
|
|
+++ b/drivers/usb/serial/cp210x.c
|
|
@@ -49,6 +49,7 @@ static int cp210x_port_remove(struct usb_serial_port *);
|
|
static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
|
|
|
|
static const struct usb_device_id id_table[] = {
|
|
+ { USB_DEVICE(0x0404, 0x034C) }, /* NCR Retail IO Box */
|
|
{ USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */
|
|
{ USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
|
|
{ USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
|
|
@@ -66,6 +67,7 @@ static const struct usb_device_id id_table[] = {
|
|
{ USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
|
|
{ USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
|
|
{ USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */
|
|
+ { USB_DEVICE(0x106F, 0x0003) }, /* CPI / Money Controls Bulk Coin Recycler */
|
|
{ USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
|
|
{ USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
|
|
{ USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
|
|
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
|
|
index fe6b32c2ff1cb..5c4fa4fcb1e88 100644
|
|
--- a/drivers/usb/serial/ftdi_sio.c
|
|
+++ b/drivers/usb/serial/ftdi_sio.c
|
|
@@ -964,6 +964,7 @@ static const struct usb_device_id id_table_combined[] = {
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
|
|
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_159_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
|
|
@@ -972,12 +973,14 @@ static const struct usb_device_id id_table_combined[] = {
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
|
|
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_235_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
|
|
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_320_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
|
|
{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
|
|
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
|
|
index 3b7cea8df446c..006e92d26baba 100644
|
|
--- a/drivers/usb/serial/ftdi_sio_ids.h
|
|
+++ b/drivers/usb/serial/ftdi_sio_ids.h
|
|
@@ -1505,6 +1505,9 @@
|
|
#define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
|
|
#define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
|
|
#define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */
|
|
+#define BRAINBOXES_US_159_PID 0x1021 /* US-159 1xRS232 */
|
|
+#define BRAINBOXES_US_235_PID 0x1017 /* US-235 1xRS232 */
|
|
+#define BRAINBOXES_US_320_PID 0x1019 /* US-320 1xRS422/485 */
|
|
#define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */
|
|
#define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
|
|
#define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
|
|
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
|
|
index 9479abb9eaaaf..4c3ff0706554f 100644
|
|
--- a/drivers/usb/serial/option.c
|
|
+++ b/drivers/usb/serial/option.c
|
|
@@ -1625,6 +1625,8 @@ static const struct usb_device_id option_ids[] = {
|
|
.driver_info = RSVD(2) },
|
|
{ USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
|
|
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */
|
|
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff), /* ZTE MF286D */
|
|
+ .driver_info = RSVD(5) },
|
|
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
|
|
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
|
|
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
|
|
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
|
|
index d322ed5cbc1ca..6386875d0a33a 100644
|
|
--- a/fs/nfs/client.c
|
|
+++ b/fs/nfs/client.c
|
|
@@ -179,6 +179,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init)
|
|
INIT_LIST_HEAD(&clp->cl_superblocks);
|
|
clp->cl_rpcclient = ERR_PTR(-EINVAL);
|
|
|
|
+ clp->cl_flags = cl_init->init_flags;
|
|
clp->cl_proto = cl_init->proto;
|
|
clp->cl_net = get_net(cl_init->net);
|
|
|
|
@@ -400,7 +401,6 @@ nfs_get_client(const struct nfs_client_initdata *cl_init,
|
|
list_add_tail(&new->cl_share_link,
|
|
&nn->nfs_client_list);
|
|
spin_unlock(&nn->nfs_client_lock);
|
|
- new->cl_flags = cl_init->init_flags;
|
|
return rpc_ops->init_client(new, cl_init);
|
|
}
|
|
|
|
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
|
|
index 2fb4633897084..48baa92846e5f 100644
|
|
--- a/fs/nfs/nfs4client.c
|
|
+++ b/fs/nfs/nfs4client.c
|
|
@@ -1329,8 +1329,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
|
|
goto out;
|
|
}
|
|
|
|
- if (server->nfs_client->cl_hostname == NULL)
|
|
+ if (server->nfs_client->cl_hostname == NULL) {
|
|
server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL);
|
|
+ if (server->nfs_client->cl_hostname == NULL)
|
|
+ return -ENOMEM;
|
|
+ }
|
|
nfs_server_insert_lists(server);
|
|
|
|
error = nfs_probe_destination(server);
|
|
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
|
|
index 4e63daeef6339..466c07bd06295 100644
|
|
--- a/fs/nfs/nfs4state.c
|
|
+++ b/fs/nfs/nfs4state.c
|
|
@@ -1985,6 +1985,9 @@ static int nfs4_try_migration(struct nfs_server *server, struct rpc_cred *cred)
|
|
}
|
|
|
|
result = -NFS4ERR_NXIO;
|
|
+ if (!locations->nlocations)
|
|
+ goto out;
|
|
+
|
|
if (!(locations->fattr.valid & NFS_ATTR_FATTR_V4_LOCATIONS)) {
|
|
dprintk("<-- %s: No fs_locations data, migration skipped\n",
|
|
__func__);
|
|
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
|
|
index 0a7c4e30a385e..b50c97c6aecb3 100644
|
|
--- a/fs/nfs/nfs4xdr.c
|
|
+++ b/fs/nfs/nfs4xdr.c
|
|
@@ -3633,8 +3633,6 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st
|
|
if (unlikely(!p))
|
|
goto out_overflow;
|
|
n = be32_to_cpup(p);
|
|
- if (n <= 0)
|
|
- goto out_eio;
|
|
for (res->nlocations = 0; res->nlocations < n; res->nlocations++) {
|
|
u32 m;
|
|
struct nfs4_fs_location *loc;
|
|
@@ -4177,10 +4175,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
|
|
} else
|
|
printk(KERN_WARNING "%s: label too long (%u)!\n",
|
|
__func__, len);
|
|
+ if (label && label->label)
|
|
+ dprintk("%s: label=%.*s, len=%d, PI=%d, LFS=%d\n",
|
|
+ __func__, label->len, (char *)label->label,
|
|
+ label->len, label->pi, label->lfs);
|
|
}
|
|
- if (label && label->label)
|
|
- dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__,
|
|
- (char *)label->label, label->len, label->pi, label->lfs);
|
|
return status;
|
|
|
|
out_overflow:
|
|
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
|
|
index 00b472fe77c19..1bf2e1c47cbfd 100644
|
|
--- a/fs/nfsd/nfs3proc.c
|
|
+++ b/fs/nfsd/nfs3proc.c
|
|
@@ -191,6 +191,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp, struct nfsd3_writeargs *argp,
|
|
(unsigned long long) argp->offset,
|
|
argp->stable? " stable" : "");
|
|
|
|
+ resp->status = nfserr_fbig;
|
|
+ if (argp->offset > (u64)OFFSET_MAX ||
|
|
+ argp->offset + argp->len > (u64)OFFSET_MAX)
|
|
+ return rpc_success;
|
|
+
|
|
fh_copy(&resp->fh, &argp->fh);
|
|
resp->committed = argp->stable;
|
|
nfserr = nfsd_write(rqstp, &resp->fh, NULL,
|
|
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
|
|
index 66985a6a7047b..d029decd87e3d 100644
|
|
--- a/fs/nfsd/nfs4proc.c
|
|
+++ b/fs/nfsd/nfs4proc.c
|
|
@@ -982,8 +982,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
|
|
unsigned long cnt;
|
|
int nvecs;
|
|
|
|
- if (write->wr_offset >= OFFSET_MAX)
|
|
- return nfserr_inval;
|
|
+ if (write->wr_offset > (u64)OFFSET_MAX ||
|
|
+ write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX)
|
|
+ return nfserr_fbig;
|
|
|
|
status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->current_fh,
|
|
stateid, WR_STATE, &filp, NULL);
|
|
diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
|
|
index 5a23535a5018d..6a6f1d3bf8538 100644
|
|
--- a/include/net/dst_metadata.h
|
|
+++ b/include/net/dst_metadata.h
|
|
@@ -97,8 +97,20 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb)
|
|
|
|
memcpy(&new_md->u.tun_info, &md_dst->u.tun_info,
|
|
sizeof(struct ip_tunnel_info) + md_size);
|
|
+#ifdef CONFIG_DST_CACHE
|
|
+ /* Unclone the dst cache if there is one */
|
|
+ if (new_md->u.tun_info.dst_cache.cache) {
|
|
+ int ret;
|
|
+
|
|
+ ret = dst_cache_init(&new_md->u.tun_info.dst_cache, GFP_ATOMIC);
|
|
+ if (ret) {
|
|
+ metadata_dst_free(new_md);
|
|
+ return ERR_PTR(ret);
|
|
+ }
|
|
+ }
|
|
+#endif
|
|
+
|
|
skb_dst_drop(skb);
|
|
- dst_hold(&new_md->dst);
|
|
skb_dst_set(skb, &new_md->dst);
|
|
return new_md;
|
|
}
|
|
diff --git a/init/Kconfig b/init/Kconfig
|
|
index 07570008e2fd9..7e09227b976fa 100644
|
|
--- a/init/Kconfig
|
|
+++ b/init/Kconfig
|
|
@@ -1645,6 +1645,16 @@ config ADVISE_SYSCALLS
|
|
applications use these syscalls, you can disable this option to save
|
|
space.
|
|
|
|
+config BPF_UNPRIV_DEFAULT_OFF
|
|
+ bool "Disable unprivileged BPF by default"
|
|
+ depends on BPF_SYSCALL
|
|
+ help
|
|
+ Disables unprivileged BPF by default by setting the corresponding
|
|
+ /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
|
|
+ still reenable it by setting it to 0 later on, or permanently
|
|
+ disable it by setting it to 1 (from which no other transition to
|
|
+ 0 is possible anymore).
|
|
+
|
|
config USERFAULTFD
|
|
bool "Enable userfaultfd() system call"
|
|
select ANON_INODES
|
|
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
|
|
index e10314223cbfe..e30ad1be68412 100644
|
|
--- a/kernel/bpf/syscall.c
|
|
+++ b/kernel/bpf/syscall.c
|
|
@@ -22,7 +22,8 @@
|
|
|
|
DEFINE_PER_CPU(int, bpf_prog_active);
|
|
|
|
-int sysctl_unprivileged_bpf_disabled __read_mostly;
|
|
+int sysctl_unprivileged_bpf_disabled __read_mostly =
|
|
+ IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0;
|
|
|
|
static LIST_HEAD(bpf_map_types);
|
|
|
|
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
|
|
index 513e6da318c47..78b445562b81e 100644
|
|
--- a/kernel/sysctl.c
|
|
+++ b/kernel/sysctl.c
|
|
@@ -221,6 +221,28 @@ static int sysrq_sysctl_handler(struct ctl_table *table, int write,
|
|
|
|
#endif
|
|
|
|
+#ifdef CONFIG_BPF_SYSCALL
|
|
+static int bpf_unpriv_handler(struct ctl_table *table, int write,
|
|
+ void *buffer, size_t *lenp, loff_t *ppos)
|
|
+{
|
|
+ int ret, unpriv_enable = *(int *)table->data;
|
|
+ bool locked_state = unpriv_enable == 1;
|
|
+ struct ctl_table tmp = *table;
|
|
+
|
|
+ if (write && !capable(CAP_SYS_ADMIN))
|
|
+ return -EPERM;
|
|
+
|
|
+ tmp.data = &unpriv_enable;
|
|
+ ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
|
|
+ if (write && !ret) {
|
|
+ if (locked_state && unpriv_enable != 1)
|
|
+ return -EPERM;
|
|
+ *(int *)table->data = unpriv_enable;
|
|
+ }
|
|
+ return ret;
|
|
+}
|
|
+#endif
|
|
+
|
|
static struct ctl_table kern_table[];
|
|
static struct ctl_table vm_table[];
|
|
static struct ctl_table fs_table[];
|
|
@@ -1202,10 +1224,9 @@ static struct ctl_table kern_table[] = {
|
|
.data = &sysctl_unprivileged_bpf_disabled,
|
|
.maxlen = sizeof(sysctl_unprivileged_bpf_disabled),
|
|
.mode = 0644,
|
|
- /* only handle a transition from default "0" to "1" */
|
|
- .proc_handler = proc_dointvec_minmax,
|
|
- .extra1 = &one,
|
|
- .extra2 = &one,
|
|
+ .proc_handler = bpf_unpriv_handler,
|
|
+ .extra1 = &zero,
|
|
+ .extra2 = &two,
|
|
},
|
|
#endif
|
|
#if defined(CONFIG_TREE_RCU) || defined(CONFIG_PREEMPT_RCU)
|
|
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
|
|
index 354926e61f067..58c0ab8894c70 100644
|
|
--- a/net/ipv4/ipmr.c
|
|
+++ b/net/ipv4/ipmr.c
|
|
@@ -242,7 +242,9 @@ static int __net_init ipmr_rules_init(struct net *net)
|
|
return 0;
|
|
|
|
err2:
|
|
+ rtnl_lock();
|
|
ipmr_free_table(mrt);
|
|
+ rtnl_unlock();
|
|
err1:
|
|
fib_rules_unregister(ops);
|
|
return err;
|
|
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
|
|
index f38b22f54c093..3dce62ec37ed4 100644
|
|
--- a/net/ipv6/ip6mr.c
|
|
+++ b/net/ipv6/ip6mr.c
|
|
@@ -251,7 +251,9 @@ static int __net_init ip6mr_rules_init(struct net *net)
|
|
return 0;
|
|
|
|
err2:
|
|
+ rtnl_lock();
|
|
ip6mr_free_table(mrt);
|
|
+ rtnl_unlock();
|
|
err1:
|
|
fib_rules_unregister(ops);
|
|
return err;
|
|
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
|
|
index 7ebcaff8c1c4f..963f607b34999 100644
|
|
--- a/net/tipc/name_distr.c
|
|
+++ b/net/tipc/name_distr.c
|
|
@@ -288,7 +288,7 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i,
|
|
return true;
|
|
}
|
|
} else {
|
|
- pr_warn("Unrecognized name table message received\n");
|
|
+ pr_warn_ratelimited("Unknown name table message received\n");
|
|
}
|
|
return false;
|
|
}
|
|
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
|
|
index 853a7d2333b3e..51d2fef7cd677 100644
|
|
--- a/security/integrity/ima/ima_fs.c
|
|
+++ b/security/integrity/ima/ima_fs.c
|
|
@@ -477,11 +477,11 @@ int __init ima_fs_init(void)
|
|
|
|
return 0;
|
|
out:
|
|
+ securityfs_remove(ima_policy);
|
|
securityfs_remove(violations);
|
|
securityfs_remove(runtime_measurements_count);
|
|
securityfs_remove(ascii_runtime_measurements);
|
|
securityfs_remove(binary_runtime_measurements);
|
|
securityfs_remove(ima_dir);
|
|
- securityfs_remove(ima_policy);
|
|
return -1;
|
|
}
|
|
diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c
|
|
index 90987d15b6fe6..6c415667ba67f 100644
|
|
--- a/security/integrity/integrity_audit.c
|
|
+++ b/security/integrity/integrity_audit.c
|
|
@@ -39,6 +39,8 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
|
|
return;
|
|
|
|
ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);
|
|
+ if (!ab)
|
|
+ return;
|
|
audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u",
|
|
task_pid_nr(current),
|
|
from_kuid(&init_user_ns, current_cred()->uid),
|
|
diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
|
|
index 7133c36f99b6c..b3abc4cf7eb0a 100644
|
|
--- a/sound/usb/line6/podhd.c
|
|
+++ b/sound/usb/line6/podhd.c
|
|
@@ -385,7 +385,7 @@ static const struct line6_properties podhd_properties_table[] = {
|
|
.name = "POD HD500",
|
|
.capabilities = LINE6_CAP_PCM
|
|
| LINE6_CAP_HWMON,
|
|
- .altsetting = 0,
|
|
+ .altsetting = 1,
|
|
.ep_ctrl_r = 0x81,
|
|
.ep_ctrl_w = 0x01,
|
|
.ep_audio_r = 0x86,
|
|
@@ -396,7 +396,7 @@ static const struct line6_properties podhd_properties_table[] = {
|
|
.name = "POD HD500",
|
|
.capabilities = LINE6_CAP_PCM
|
|
| LINE6_CAP_HWMON,
|
|
- .altsetting = 1,
|
|
+ .altsetting = 0,
|
|
.ep_ctrl_r = 0x81,
|
|
.ep_ctrl_w = 0x01,
|
|
.ep_audio_r = 0x86,
|