Skip to content

Commit f63c6ea

Browse files
author
Alex Shi
committed
Merge tag 'v4.4.65' into linux-linaro-lsk-v4.4
 This is the 4.4.65 stable release
2 parents 832dfd1 + 418b990 commit f63c6ea

26 files changed

Lines changed: 304 additions & 78 deletions

File tree

‎Documentation/sysctl/fs.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,13 @@ aio-nr can grow to.
265265

266266
==============================================================
267267

268+
mount-max:
269+
270+
This denotes the maximum number of mounts that may exist
271+
in a mount namespace.
272+
273+
==============================================================
274+
268275

269276
2. /proc/sys/fs/binfmt_misc
270277
----------------------------------------------------------

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
VERSION = 4
22
PATCHLEVEL = 4
3-
SUBLEVEL = 64
3+
SUBLEVEL = 65
44
EXTRAVERSION =
55
NAME = Blurry Fish Butt
66

‎drivers/media/tuners/tuner-xc2028.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1403,11 +1403,12 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg)
14031403
* in order to avoid troubles during device release.
14041404
*/
14051405
kfree(priv->ctrl.fname);
1406+
priv->ctrl.fname = NULL;
14061407
memcpy(&priv->ctrl, p, sizeof(priv->ctrl));
14071408
if (p->fname) {
14081409
priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL);
14091410
if (priv->ctrl.fname == NULL)
1410-
rc = -ENOMEM;
1411+
return -ENOMEM;
14111412
}
14121413

14131414
/*

‎drivers/net/wireless/hostap/hostap_hw.c‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -836,25 +836,30 @@ static int hfa384x_get_rid(struct net_device *dev, u16 rid, void *buf, int len,
836836
spin_lock_bh(&local->baplock);
837837

838838
res = hfa384x_setup_bap(dev, BAP0, rid, 0);
839-
if (!res)
840-
res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec));
839+
if (res)
840+
goto unlock;
841+
842+
res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec));
843+
if (res)
844+
goto unlock;
841845

842846
if (le16_to_cpu(rec.len) == 0) {
843847
/* RID not available */
844848
res = -ENODATA;
849+
goto unlock;
845850
}
846851

847852
rlen = (le16_to_cpu(rec.len) - 1) * 2;
848-
if (!res && exact_len && rlen != len) {
853+
if (exact_len && rlen != len) {
849854
printk(KERN_DEBUG "%s: hfa384x_get_rid - RID len mismatch: "
850855
"rid=0x%04x, len=%d (expected %d)\n",
851856
dev->name, rid, rlen, len);
852857
res = -ENODATA;
853858
}
854859

855-
if (!res)
856-
res = hfa384x_from_bap(dev, BAP0, buf, len);
860+
res = hfa384x_from_bap(dev, BAP0, buf, len);
857861

862+
unlock:
858863
spin_unlock_bh(&local->baplock);
859864
mutex_unlock(&local->rid_bap_mtx);
860865

‎drivers/staging/android/ion/ion.c‎

Lines changed: 42 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -387,13 +387,22 @@ static void ion_handle_get(struct ion_handle *handle)
387387
kref_get(&handle->ref);
388388
}
389389

390-
static int ion_handle_put(struct ion_handle *handle)
390+
static int ion_handle_put_nolock(struct ion_handle *handle)
391+
{
392+
int ret;
393+
394+
ret = kref_put(&handle->ref, ion_handle_destroy);
395+
396+
return ret;
397+
}
398+
399+
int ion_handle_put(struct ion_handle *handle)
391400
{
392401
struct ion_client *client = handle->client;
393402
int ret;
394403

395404
mutex_lock(&client->lock);
396-
ret = kref_put(&handle->ref, ion_handle_destroy);
405+
ret = ion_handle_put_nolock(handle);
397406
mutex_unlock(&client->lock);
398407

399408
return ret;
@@ -417,20 +426,30 @@ static struct ion_handle *ion_handle_lookup(struct ion_client *client,
417426
return ERR_PTR(-EINVAL);
418427
}
419428

420-
static struct ion_handle *ion_handle_get_by_id(struct ion_client *client,
429+
static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,
421430
int id)
422431
{
423432
struct ion_handle *handle;
424433

425-
mutex_lock(&client->lock);
426434
handle = idr_find(&client->idr, id);
427435
if (handle)
428436
ion_handle_get(handle);
429-
mutex_unlock(&client->lock);
430437

431438
return handle ? handle : ERR_PTR(-EINVAL);
432439
}
433440

441+
struct ion_handle *ion_handle_get_by_id(struct ion_client *client,
442+
int id)
443+
{
444+
struct ion_handle *handle;
445+
446+
mutex_lock(&client->lock);
447+
handle = ion_handle_get_by_id_nolock(client, id);
448+
mutex_unlock(&client->lock);
449+
450+
return handle;
451+
}
452+
434453
static bool ion_handle_validate(struct ion_client *client,
435454
struct ion_handle *handle)
436455
{
@@ -532,22 +551,28 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len,
532551
}
533552
EXPORT_SYMBOL(ion_alloc);
534553

535-
void ion_free(struct ion_client *client, struct ion_handle *handle)
554+
static void ion_free_nolock(struct ion_client *client, struct ion_handle *handle)
536555
{
537556
bool valid_handle;
538557

539558
BUG_ON(client != handle->client);
540559

541-
mutex_lock(&client->lock);
542560
valid_handle = ion_handle_validate(client, handle);
543561

544562
if (!valid_handle) {
545563
WARN(1, "%s: invalid handle passed to free.\n", __func__);
546-
mutex_unlock(&client->lock);
547564
return;
548565
}
566+
ion_handle_put_nolock(handle);
567+
}
568+
569+
void ion_free(struct ion_client *client, struct ion_handle *handle)
570+
{
571+
BUG_ON(client != handle->client);
572+
573+
mutex_lock(&client->lock);
574+
ion_free_nolock(client, handle);
549575
mutex_unlock(&client->lock);
550-
ion_handle_put(handle);
551576
}
552577
EXPORT_SYMBOL(ion_free);
553578

@@ -1283,11 +1308,15 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
12831308
{
12841309
struct ion_handle *handle;
12851310

1286-
handle = ion_handle_get_by_id(client, data.handle.handle);
1287-
if (IS_ERR(handle))
1311+
mutex_lock(&client->lock);
1312+
handle = ion_handle_get_by_id_nolock(client, data.handle.handle);
1313+
if (IS_ERR(handle)) {
1314+
mutex_unlock(&client->lock);
12881315
return PTR_ERR(handle);
1289-
ion_free(client, handle);
1290-
ion_handle_put(handle);
1316+
}
1317+
ion_free_nolock(client, handle);
1318+
ion_handle_put_nolock(handle);
1319+
mutex_unlock(&client->lock);
12911320
break;
12921321
}
12931322
case ION_IOC_SHARE:

‎drivers/tty/nozomi.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -823,7 +823,7 @@ static int receive_data(enum port_type index, struct nozomi *dc)
823823
struct tty_struct *tty = tty_port_tty_get(&port->port);
824824
int i, ret;
825825

826-
read_mem32((u32 *) &size, addr, 4);
826+
size = __le32_to_cpu(readl(addr));
827827
/* DBG1( "%d bytes port: %d", size, index); */
828828

829829
if (tty && test_bit(TTY_THROTTLED, &tty->flags)) {

‎drivers/vfio/pci/vfio_pci.c‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -562,32 +562,41 @@ static long vfio_pci_ioctl(void *device_data,
562562

563563
} else if (cmd == VFIO_DEVICE_SET_IRQS) {
564564
struct vfio_irq_set hdr;
565+
size_t size;
565566
u8 *data = NULL;
566-
int ret = 0;
567+
int max, ret = 0;
567568

568569
minsz = offsetofend(struct vfio_irq_set, count);
569570

570571
if (copy_from_user(&hdr, (void __user *)arg, minsz))
571572
return -EFAULT;
572573

573574
if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS ||
575+
hdr.count >= (U32_MAX - hdr.start) ||
574576
hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK |
575577
VFIO_IRQ_SET_ACTION_TYPE_MASK))
576578
return -EINVAL;
577579

578-
if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
579-
size_t size;
580-
int max = vfio_pci_get_irq_count(vdev, hdr.index);
580+
max = vfio_pci_get_irq_count(vdev, hdr.index);
581+
if (hdr.start >= max || hdr.start + hdr.count > max)
582+
return -EINVAL;
581583

582-
if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
583-
size = sizeof(uint8_t);
584-
else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD)
585-
size = sizeof(int32_t);
586-
else
587-
return -EINVAL;
584+
switch (hdr.flags & VFIO_IRQ_SET_DATA_TYPE_MASK) {
585+
case VFIO_IRQ_SET_DATA_NONE:
586+
size = 0;
587+
break;
588+
case VFIO_IRQ_SET_DATA_BOOL:
589+
size = sizeof(uint8_t);
590+
break;
591+
case VFIO_IRQ_SET_DATA_EVENTFD:
592+
size = sizeof(int32_t);
593+
break;
594+
default:
595+
return -EINVAL;
596+
}
588597

589-
if (hdr.argsz - minsz < hdr.count * size ||
590-
hdr.start >= max || hdr.start + hdr.count > max)
598+
if (size) {
599+
if (hdr.argsz - minsz < hdr.count * size)
591600
return -EINVAL;
592601

593602
data = memdup_user((void __user *)(arg + minsz),

‎drivers/vfio/pci/vfio_pci_intrs.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)
255255
if (!is_irq_none(vdev))
256256
return -EINVAL;
257257

258-
vdev->ctx = kzalloc(nvec * sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
258+
vdev->ctx = kcalloc(nvec, sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
259259
if (!vdev->ctx)
260260
return -ENOMEM;
261261

‎fs/gfs2/dir.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -760,7 +760,7 @@ static int get_first_leaf(struct gfs2_inode *dip, u32 index,
760760
int error;
761761

762762
error = get_leaf_nr(dip, index, &leaf_no);
763-
if (!error)
763+
if (!IS_ERR_VALUE(error))
764764
error = get_leaf(dip, leaf_no, bh_out);
765765

766766
return error;
@@ -976,7 +976,7 @@ static int dir_split_leaf(struct inode *inode, const struct qstr *name)
976976

977977
index = name->hash >> (32 - dip->i_depth);
978978
error = get_leaf_nr(dip, index, &leaf_no);
979-
if (error)
979+
if (IS_ERR_VALUE(error))
980980
return error;
981981

982982
/* Get the old leaf block */

‎fs/mount.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ struct mnt_namespace {
1313
u64 seq; /* Sequence number to prevent loops */
1414
wait_queue_head_t poll;
1515
u64 event;
16+
unsigned int mounts; /* # of mounts in the namespace */
17+
unsigned int pending_mounts;
1618
};
1719

1820
struct mnt_pcp {

0 commit comments

Comments
 (0)