[packages/kernel/LINUX_4_1] - 4.1.49
baggins
baggins at pld-linux.org
Wed Jan 24 08:35:03 CET 2018
commit 52178c4968d3525ceb0a8c032b018236b797b9a8
Author: Jan Rękorajski <baggins at pld-linux.org>
Date: Wed Jan 24 08:34:50 2018 +0100
- 4.1.49
kernel-small_fixes.patch | 766 -----------------------------------------------
kernel.spec | 6 +-
2 files changed, 3 insertions(+), 769 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index d8c0cc04..58ff0466 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -71,9 +71,9 @@
%define have_pcmcia 0
%endif
-%define rel 4
+%define rel 1
%define basever 4.1
-%define postver .48
+%define postver .49
# define this to '-%{basever}' for longterm branch
%define versuffix -%{basever}
@@ -122,7 +122,7 @@ Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{basever}.tar.xz
# Source0-md5: fe9dc0f6729f36400ea81aa41d614c37
%if "%{postver}" != ".0"
Patch0: http://www.kernel.org/pub/linux/kernel/v4.x/patch-%{version}.xz
-# Patch0-md5: 32ebfc309853cf4f1f23481b46434b5e
+# Patch0-md5: 37c6eb2f7648fe67a91e4ab252ab41ad
%endif
Source1: kernel.sysconfig
diff --git a/kernel-small_fixes.patch b/kernel-small_fixes.patch
index bd50c9d0..b28b80e7 100644
--- a/kernel-small_fixes.patch
+++ b/kernel-small_fixes.patch
@@ -1234,155 +1234,6 @@ index 6a06a3d0f28c..6b3d4eeda568 100644
--
2.12.0
-patches.fixes/packet-fix-races-in-fanout_add.patch
-From: Eric Dumazet <edumazet at google.com>
-Date: Tue, 14 Feb 2017 09:03:51 -0800
-Subject: packet: fix races in fanout_add()
-Patch-mainline: v4.10
-Git-commit: d199fab63c11998a602205f7ee7ff7c05c97164b
-References: CVE-2017-6346 bsc#1027189
-
-Multiple threads can call fanout_add() at the same time.
-
-We need to grab fanout_mutex earlier to avoid races that could
-lead to one thread freeing po->rollover that was set by another thread.
-
-Do the same in fanout_release(), for peace of mind, and to help us
-finding lockdep issues earlier.
-
-Fixes: dc99f600698d ("packet: Add fanout support.")
-Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state")
-Signed-off-by: Eric Dumazet <edumazet at google.com>
-Cc: Willem de Bruijn <willemb at google.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
-Signed-off-by: Michal Kubecek <mkubecek at suse.cz>
-
-openSUSE-42.1: no rollover stuff from commit 0648ab70afe6 ("packet:
-rollover prepare: per-socket state"); only extend the area covered by
-fanout_mutex.
-
----
- net/packet/af_packet.c | 27 +++++++++++++++------------
- 1 file changed, 15 insertions(+), 12 deletions(-)
-
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index b9d1baaa8bdc..3d6b2e111a55 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1447,13 +1447,16 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
- return -EINVAL;
- }
-
-+ mutex_lock(&fanout_mutex);
-+
-+ err = -EINVAL;
- if (!po->running)
-- return -EINVAL;
-+ goto out;
-
-+ err = -EALREADY;
- if (po->fanout)
-- return -EALREADY;
-+ goto out;
-
-- mutex_lock(&fanout_mutex);
- match = NULL;
- list_for_each_entry(f, &fanout_list, list) {
- if (f->id == id &&
-@@ -1509,18 +1512,18 @@ static void fanout_release(struct sock *sk)
- struct packet_sock *po = pkt_sk(sk);
- struct packet_fanout *f;
-
-- f = po->fanout;
-- if (!f)
-- return;
--
- mutex_lock(&fanout_mutex);
-- po->fanout = NULL;
-+ f = po->fanout;
-+ if (f) {
-+ po->fanout = NULL;
-
-- if (atomic_dec_and_test(&f->sk_ref)) {
-- list_del(&f->list);
-- dev_remove_pack(&f->prot_hook);
-- kfree(f);
-+ if (atomic_dec_and_test(&f->sk_ref)) {
-+ list_del(&f->list);
-+ dev_remove_pack(&f->prot_hook);
-+ kfree(f);
-+ }
- }
-+
- mutex_unlock(&fanout_mutex);
- }
-
---
-2.12.0
-
-patches.fixes/net-llc-avoid-BUG_ON-in-skb_orphan.patch
-From: Eric Dumazet <edumazet at google.com>
-Date: Sun, 12 Feb 2017 14:03:52 -0800
-Subject: net/llc: avoid BUG_ON() in skb_orphan()
-Patch-mainline: v4.10
-Git-commit: 8b74d439e1697110c5e5c600643e823eb1dd0762
-References: CVE-2017-6345 bsc#1027190
-
-It seems nobody used LLC since linux-3.12.
-
-Fortunately fuzzers like syzkaller still know how to run this code,
-otherwise it would be no fun.
-
-Setting skb->sk without skb->destructor leads to all kinds of
-bugs, we now prefer to be very strict about it.
-
-Ideally here we would use skb_set_owner() but this helper does not exist yet,
-only CAN seems to have a private helper for that.
-
-Fixes: 376c7311bdb6 ("net: add a temporary sanity check in skb_orphan()")
-Signed-off-by: Eric Dumazet <edumazet at google.com>
-Reported-by: Andrey Konovalov <andreyknvl at google.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
-Acked-by: Michal Kubecek <mkubecek at suse.cz>
-
----
- net/llc/llc_conn.c | 3 +++
- net/llc/llc_sap.c | 3 +++
- 2 files changed, 6 insertions(+)
-
-diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
-index 81a61fce3afb..841026e02ce8 100644
---- a/net/llc/llc_conn.c
-+++ b/net/llc/llc_conn.c
-@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
- * another trick required to cope with how the PROCOM state
- * machine works. -acme
- */
-+ skb_orphan(skb);
-+ sock_hold(sk);
- skb->sk = sk;
-+ skb->destructor = sock_efree;
- }
- if (!sock_owned_by_user(sk))
- llc_conn_rcv(sk, skb);
-diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
-index d0e1e804ebd7..5404d0d195cc 100644
---- a/net/llc/llc_sap.c
-+++ b/net/llc/llc_sap.c
-@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
-
- ev->type = LLC_SAP_EV_TYPE_PDU;
- ev->reason = 0;
-+ skb_orphan(skb);
-+ sock_hold(sk);
- skb->sk = sk;
-+ skb->destructor = sock_efree;
- llc_sap_state_process(sap, skb);
- }
-
---
-2.12.0
-
patches.fixes/l2tp-fix-racy-SOCK_ZAPPED-flag-check-in-l2tp_ip-6-_b.patch
From: Guillaume Nault <g.nault at alphalink.fr>
Date: Fri, 18 Nov 2016 22:13:00 +0100
@@ -1608,100 +1459,6 @@ index 2091664295ba..1c1b9ed94719 100644
--
2.12.2
-patches.fixes/xfrm_user-validate-XFRM_MSG_NEWAE-incoming-ESN-size-.patch
-From: Andy Whitcroft <apw at canonical.com>
-Date: Thu, 23 Mar 2017 07:45:44 +0000
-Subject: xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
-Patch-mainline: v4.11-rc5
-Git-commit: f843ee6dd019bcece3e74e76ad9df0155655d0df
-References: CVE-2017-7184 bsc#1030573
-
-Kees Cook has pointed out that xfrm_replay_state_esn_len() is subject to
-wrapping issues. To ensure we are correctly ensuring that the two ESN
-structures are the same size compare both the overall size as reported
-by xfrm_replay_state_esn_len() and the internal length are the same.
-
-CVE-2017-7184
-Signed-off-by: Andy Whitcroft <apw at canonical.com>
-Acked-by: Steffen Klassert <steffen.klassert at secunet.com>
-Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
-Acked-by: Michal Kubecek <mkubecek at suse.cz>
-
----
- net/xfrm/xfrm_user.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
-index 1c1b9ed94719..2dc882637cdf 100644
---- a/net/xfrm/xfrm_user.c
-+++ b/net/xfrm/xfrm_user.c
-@@ -386,7 +386,11 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
- up = nla_data(rp);
- ulen = xfrm_replay_state_esn_len(up);
-
-- if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
-+ /* Check the overall length and the internal bitmap length to avoid
-+ * potential overflow. */
-+ if (nla_len(rp) < ulen ||
-+ xfrm_replay_state_esn_len(replay_esn) != ulen ||
-+ replay_esn->bmp_len != up->bmp_len)
- return -EINVAL;
-
- if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
---
-2.12.2
-
-patches.fixes/net-socket-fix-recvmmsg-not-returning-error-from-soc.patch
-From: Maxime Jayat <maxime.jayat at mobile-devices.fr>
-Date: Tue, 21 Feb 2017 18:35:51 +0100
-Subject: net: socket: fix recvmmsg not returning error from sock_error
-Patch-mainline: v4.11-rc1
-Git-commit: e623a9e9dec29ae811d11f83d0074ba254aba374
-References: CVE-2016-7117 bsc#1003077
-
-Commit 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path"),
-changed the exit path of recvmmsg to always return the datagrams
-variable and modified the error paths to set the variable to the error
-code returned by recvmsg if necessary.
-
-However in the case sock_error returned an error, the error code was
-then ignored, and recvmmsg returned 0.
-
-Change the error path of recvmmsg to correctly return the error code
-of sock_error.
-
-The bug was triggered by using recvmmsg on a CAN interface which was
-not up. Linux 4.6 and later return 0 in this case while earlier
-releases returned -ENETDOWN.
-
-Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path")
-Signed-off-by: Maxime Jayat <maxime.jayat at mobile-devices.fr>
-Signed-off-by: David S. Miller <davem at davemloft.net>
-Acked-by: Michal Kubecek <mkubecek at suse.cz>
-
----
- net/socket.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/net/socket.c b/net/socket.c
-index e66e4f357506..8327df0448f4 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -2192,8 +2192,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
- return err;
-
- err = sock_error(sock->sk);
-- if (err)
-+ if (err) {
-+ datagrams = err;
- goto out_put;
-+ }
-
- entry = mmsg;
- compat_entry = (struct compat_mmsghdr __user *)mmsg;
---
-2.12.2
-
patches.fixes/netfilter-nfnetlink-correctly-validate-length-of-bat.patch
From: Michal Kubecek <mkubecek at suse.cz>
Date: Tue, 3 Jan 2017 11:25:59 +0100
@@ -2086,95 +1843,6 @@ Acked-by: Johannes Thumshirn <jthumshirn at suse.de>
iov_for_each(iov, i, *iter) {
unsigned long uaddr = (unsigned long) iov.iov_base;
-patches.fixes/irda-fix-lockdep-annotations-in-hashbin_delete.patch
-From: "David S. Miller" <davem at davemloft.net>
-Date: Fri, 17 Feb 2017 16:19:39 -0500
-Subject: irda: Fix lockdep annotations in hashbin_delete().
-Git-commit: 4c03b862b12f980456f9de92db6d508a4999b788
-Patch-mainline: v4.10
-References: bsc#1027178, CVE-2017-6348
-
-A nested lock depth was added to the hasbin_delete() code but it
-doesn't actually work some well and results in tons of lockdep splats.
-
-Fix the code instead to properly drop the lock around the operation
-and just keep peeking the head of the hashbin queue.
-
-Reported-by: Dmitry Vyukov <dvyukov at google.com>
-Tested-by: Dmitry Vyukov <dvyukov at google.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
-Acked-by: Borislav Petkov <bp at suse.de>
----
- net/irda/irqueue.c | 34 ++++++++++++++++------------------
- 1 file changed, 16 insertions(+), 18 deletions(-)
-
-diff --git a/net/irda/irqueue.c b/net/irda/irqueue.c
-index acbe61c7e683..160dc89335e2 100644
---- a/net/irda/irqueue.c
-+++ b/net/irda/irqueue.c
-@@ -383,9 +383,6 @@ hashbin_t *hashbin_new(int type)
- * for deallocating this structure if it's complex. If not the user can
- * just supply kfree, which should take care of the job.
- */
--#ifdef CONFIG_LOCKDEP
--static int hashbin_lock_depth = 0;
--#endif
- int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
- {
- irda_queue_t* queue;
-@@ -396,22 +393,27 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
- IRDA_ASSERT(hashbin->magic == HB_MAGIC, return -1;);
-
- /* Synchronize */
-- if ( hashbin->hb_type & HB_LOCK ) {
-- spin_lock_irqsave_nested(&hashbin->hb_spinlock, flags,
-- hashbin_lock_depth++);
-- }
-+ if (hashbin->hb_type & HB_LOCK)
-+ spin_lock_irqsave(&hashbin->hb_spinlock, flags);
-
- /*
- * Free the entries in the hashbin, TODO: use hashbin_clear when
- * it has been shown to work
- */
- for (i = 0; i < HASHBIN_SIZE; i ++ ) {
-- queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]);
-- while (queue ) {
-- if (free_func)
-- (*free_func)(queue);
-- queue = dequeue_first(
-- (irda_queue_t**) &hashbin->hb_queue[i]);
-+ while (1) {
-+ queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]);
-+
-+ if (!queue)
-+ break;
-+
-+ if (free_func) {
-+ if (hashbin->hb_type & HB_LOCK)
-+ spin_unlock_irqrestore(&hashbin->hb_spinlock, flags);
-+ free_func(queue);
-+ if (hashbin->hb_type & HB_LOCK)
-+ spin_lock_irqsave(&hashbin->hb_spinlock, flags);
-+ }
- }
- }
-
-@@ -420,12 +422,8 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
- hashbin->magic = ~HB_MAGIC;
-
- /* Release lock */
-- if ( hashbin->hb_type & HB_LOCK) {
-+ if (hashbin->hb_type & HB_LOCK)
- spin_unlock_irqrestore(&hashbin->hb_spinlock, flags);
--#ifdef CONFIG_LOCKDEP
-- hashbin_lock_depth--;
--#endif
-- }
-
- /*
- * Free the hashbin structure
-
patches.fixes/brcmfmac-avoid-potential-stack-overflow-in-brcmf_cfg.patch
From: Arend Van Spriel <arend.vanspriel at broadcom.com>
Date: Mon, 5 Sep 2016 10:45:47 +0100
@@ -2289,319 +1957,6 @@ Signed-off-by: Jiri Slaby <jslaby at suse.cz>
}
/**
-patches.fixes/tty-n_hdlc-get-rid-of-racy-n_hdlc.tbuf.patch
-From: Alexander Popov <alex.popov at linux.com>
-Date: Tue, 28 Feb 2017 19:54:40 +0300
-Subject: tty: n_hdlc: get rid of racy n_hdlc.tbuf
-Patch-mainline: v4.11-rc2
-Git-commit: 82f2341c94d270421f383641b7cd670e474db56b
-Git-tree: https://git.kernel.org/cgit/linux/kernel/git/gregkh/tty.git
-References: bnc#1027565 CVE-2017-2636
-
-Currently N_HDLC line discipline uses a self-made singly linked list for
-data buffers and has n_hdlc.tbuf pointer for buffer retransmitting after
-an error.
-
-The commit be10eb7589337e5defbe214dae038a53dd21add8
-("tty: n_hdlc add buffer flushing") introduced racy access to n_hdlc.tbuf.
-After tx error concurrent flush_tx_queue() and n_hdlc_send_frames() can put
-one data buffer to tx_free_buf_list twice. That causes double free in
-n_hdlc_release().
-
-Let's use standard kernel linked list and get rid of n_hdlc.tbuf:
-in case of tx error put current data buffer after the head of tx_buf_list.
-
-Signed-off-by: Alexander Popov <alex.popov at linux.com>
-Cc: stable <stable at vger.kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
-Signed-off-by: Jiri Slaby <jslaby at suse.cz>
----
- drivers/tty/n_hdlc.c | 132 ++++++++++++++++++++++++++-------------------------
- 1 file changed, 69 insertions(+), 63 deletions(-)
-
---- a/drivers/tty/n_hdlc.c
-+++ b/drivers/tty/n_hdlc.c
-@@ -114,7 +114,7 @@
- #define DEFAULT_TX_BUF_COUNT 3
-
- struct n_hdlc_buf {
-- struct n_hdlc_buf *link;
-+ struct list_head list_item;
- int count;
- char buf[1];
- };
-@@ -122,8 +122,7 @@ struct n_hdlc_buf {
- #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe)
-
- struct n_hdlc_buf_list {
-- struct n_hdlc_buf *head;
-- struct n_hdlc_buf *tail;
-+ struct list_head list;
- int count;
- spinlock_t spinlock;
- };
-@@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
- * @backup_tty - TTY to use if tty gets closed
- * @tbusy - reentrancy flag for tx wakeup code
- * @woke_up - FIXME: describe this field
-- * @tbuf - currently transmitting tx buffer
- * @tx_buf_list - list of pending transmit frame buffers
- * @rx_buf_list - list of received frame buffers
- * @tx_free_buf_list - list unused transmit frame buffers
-@@ -149,7 +147,6 @@ struct n_hdlc {
- struct tty_struct *backup_tty;
- int tbusy;
- int woke_up;
-- struct n_hdlc_buf *tbuf;
- struct n_hdlc_buf_list tx_buf_list;
- struct n_hdlc_buf_list rx_buf_list;
- struct n_hdlc_buf_list tx_free_buf_list;
-@@ -159,6 +156,8 @@ struct n_hdlc {
- /*
- * HDLC buffer list manipulation functions
- */
-+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
-+ struct n_hdlc_buf *buf);
- static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list);
- static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
- struct n_hdlc_buf *buf);
-@@ -209,16 +208,9 @@ static void flush_tx_queue(struct tty_st
- {
- struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
- struct n_hdlc_buf *buf;
-- unsigned long flags;
-
- while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
-- spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
-- if (n_hdlc->tbuf) {
-- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
-- n_hdlc->tbuf = NULL;
-- }
-- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
- }
-
- static struct tty_ldisc_ops n_hdlc_ldisc = {
-@@ -284,7 +276,6 @@ static void n_hdlc_release(struct n_hdlc
- } else
- break;
- }
-- kfree(n_hdlc->tbuf);
- kfree(n_hdlc);
-
- } /* end of n_hdlc_release() */
-@@ -403,13 +394,7 @@ static void n_hdlc_send_frames(struct n_
- n_hdlc->woke_up = 0;
- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
-
-- /* get current transmit buffer or get new transmit */
-- /* buffer from list of pending transmit buffers */
--
-- tbuf = n_hdlc->tbuf;
-- if (!tbuf)
-- tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
--
-+ tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
- while (tbuf) {
- if (debuglevel >= DEBUG_LEVEL_INFO)
- printk("%s(%d)sending frame %p, count=%d\n",
-@@ -421,7 +406,7 @@ static void n_hdlc_send_frames(struct n_
-
- /* rollback was possible and has been done */
- if (actual == -ERESTARTSYS) {
-- n_hdlc->tbuf = tbuf;
-+ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
- break;
- }
- /* if transmit error, throw frame away by */
-@@ -436,10 +421,7 @@ static void n_hdlc_send_frames(struct n_
-
- /* free current transmit buffer */
- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
--
-- /* this tx buffer is done */
-- n_hdlc->tbuf = NULL;
--
-+
- /* wait up sleeping writers */
- wake_up_interruptible(&tty->write_wait);
-
-@@ -449,10 +431,12 @@ static void n_hdlc_send_frames(struct n_
- if (debuglevel >= DEBUG_LEVEL_INFO)
- printk("%s(%d)frame %p pending\n",
- __FILE__,__LINE__,tbuf);
--
-- /* buffer not accepted by driver */
-- /* set this buffer as pending buffer */
-- n_hdlc->tbuf = tbuf;
-+
-+ /*
-+ * the buffer was not accepted by driver,
-+ * return it back into tx queue
-+ */
-+ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
- break;
- }
- }
-@@ -750,7 +734,8 @@ static int n_hdlc_tty_ioctl(struct tty_s
- int error = 0;
- int count;
- unsigned long flags;
--
-+ struct n_hdlc_buf *buf = NULL;
-+
- if (debuglevel >= DEBUG_LEVEL_INFO)
- printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
- __FILE__,__LINE__,cmd);
-@@ -764,8 +749,10 @@ static int n_hdlc_tty_ioctl(struct tty_s
- /* report count of read data available */
- /* in next available frame (if any) */
- spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
-- if (n_hdlc->rx_buf_list.head)
-- count = n_hdlc->rx_buf_list.head->count;
-+ buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
-+ struct n_hdlc_buf, list_item);
-+ if (buf)
-+ count = buf->count;
- else
- count = 0;
- spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
-@@ -777,8 +764,10 @@ static int n_hdlc_tty_ioctl(struct tty_s
- count = tty_chars_in_buffer(tty);
- /* add size of next output frame in queue */
- spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
-- if (n_hdlc->tx_buf_list.head)
-- count += n_hdlc->tx_buf_list.head->count;
-+ buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
-+ struct n_hdlc_buf, list_item);
-+ if (buf)
-+ count += buf->count;
- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
- error = put_user(count, (int __user *)arg);
- break;
-@@ -826,14 +815,14 @@ static unsigned int n_hdlc_tty_poll(stru
- poll_wait(filp, &tty->write_wait, wait);
-
- /* set bits for operations that won't block */
-- if (n_hdlc->rx_buf_list.head)
-+ if (!list_empty(&n_hdlc->rx_buf_list.list))
- mask |= POLLIN | POLLRDNORM; /* readable */
- if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
- mask |= POLLHUP;
- if (tty_hung_up_p(filp))
- mask |= POLLHUP;
- if (!tty_is_writelocked(tty) &&
-- n_hdlc->tx_free_buf_list.head)
-+ !list_empty(&n_hdlc->tx_free_buf_list.list))
- mask |= POLLOUT | POLLWRNORM; /* writable */
- }
- return mask;
-@@ -857,7 +846,12 @@ static struct n_hdlc *n_hdlc_alloc(void)
- n_hdlc_buf_list_init(&n_hdlc->tx_free_buf_list);
- n_hdlc_buf_list_init(&n_hdlc->rx_buf_list);
- n_hdlc_buf_list_init(&n_hdlc->tx_buf_list);
--
-+
-+ INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
-+ INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
-+ INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
-+ INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
-+
- /* allocate free rx buffer list */
- for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
- buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
-@@ -895,53 +889,65 @@ static void n_hdlc_buf_list_init(struct
- } /* end of n_hdlc_buf_list_init() */
-
- /**
-+ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
-+ * @buf_list - pointer to the buffer list
-+ * @buf - pointer to the buffer
-+ */
-+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
-+ struct n_hdlc_buf *buf)
-+{
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+ list_add(&buf->list_item, &buf_list->list);
-+ buf_list->count++;
-+
-+ spin_unlock_irqrestore(&buf_list->spinlock, flags);
-+}
-+
-+/**
- * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
-- * @list - pointer to buffer list
-+ * @buf_list - pointer to buffer list
- * @buf - pointer to buffer
- */
--static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
-+static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
- struct n_hdlc_buf *buf)
- {
- unsigned long flags;
-- spin_lock_irqsave(&list->spinlock,flags);
--
-- buf->link=NULL;
-- if (list->tail)
-- list->tail->link = buf;
-- else
-- list->head = buf;
-- list->tail = buf;
-- (list->count)++;
--
-- spin_unlock_irqrestore(&list->spinlock,flags);
--
-+
-+ spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+ list_add_tail(&buf->list_item, &buf_list->list);
-+ buf_list->count++;
-+
-+ spin_unlock_irqrestore(&buf_list->spinlock, flags);
- } /* end of n_hdlc_buf_put() */
-
- /**
- * n_hdlc_buf_get - remove and return an HDLC buffer from list
-- * @list - pointer to HDLC buffer list
-+ * @buf_list - pointer to HDLC buffer list
- *
- * Remove and return an HDLC buffer from the head of the specified HDLC buffer
- * list.
- * Returns a pointer to HDLC buffer if available, otherwise %NULL.
- */
--static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
-+static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
- {
- unsigned long flags;
- struct n_hdlc_buf *buf;
-- spin_lock_irqsave(&list->spinlock,flags);
--
-- buf = list->head;
-+
-+ spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+ buf = list_first_entry_or_null(&buf_list->list,
-+ struct n_hdlc_buf, list_item);
- if (buf) {
-- list->head = buf->link;
-- (list->count)--;
-+ list_del(&buf->list_item);
-+ buf_list->count--;
- }
-- if (!list->head)
-- list->tail = NULL;
--
-- spin_unlock_irqrestore(&list->spinlock,flags);
-+
-+ spin_unlock_irqrestore(&buf_list->spinlock, flags);
- return buf;
--
- } /* end of n_hdlc_buf_get() */
-
- static char hdlc_banner[] __initdata =
patches.fixes/keys-don-t-permit-request_key-to-construct-a-new-keyring
From: David Howells <dhowells at redhat.com>
Date: Mon, 19 Oct 2015 11:20:28 +0100
@@ -3520,124 +2875,3 @@ Acked-by: Joerg Roedel <jroedel at suse.de>
X86_TRANSFER_NONE, NULL);
}
-commit 474c90156c8dcc2fa815e6716cc9394d7930cb9c
-Author: Linus Torvalds <torvalds at linux-foundation.org>
-Date: Thu Mar 2 12:17:22 2017 -0800
-
- give up on gcc ilog2() constant optimizations
-
- gcc-7 has an "optimization" pass that completely screws up, and
- generates the code expansion for the (impossible) case of calling
- ilog2() with a zero constant, even when the code gcc compiles does not
- actually have a zero constant.
-
- And we try to generate a compile-time error for anybody doing ilog2() on
- a constant where that doesn't make sense (be it zero or negative). So
- now gcc7 will fail the build due to our sanity checking, because it
- created that constant-zero case that didn't actually exist in the source
- code.
-
- There's a whole long discussion on the kernel mailing about how to work
- around this gcc bug. The gcc people themselevs have discussed their
- "feature" in
-
- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785
-
- but it's all water under the bridge, because while it looked at one
- point like it would be solved by the time gcc7 was released, that was
- not to be.
-
- So now we have to deal with this compiler braindamage.
-
- And the only simple approach seems to be to just delete the code that
- tries to warn about bad uses of ilog2().
-
- So now "ilog2()" will just return 0 not just for the value 1, but for
- any non-positive value too.
-
- It's not like I can recall anybody having ever actually tried to use
- this function on any invalid value, but maybe the sanity check just
- meant that such code never made it out in public.
-
- Reported-by: Laura Abbott <labbott at redhat.com>
- Cc: John Stultz <john.stultz at linaro.org>,
- Cc: Thomas Gleixner <tglx at linutronix.de>
- Cc: Ard Biesheuvel <ard.biesheuvel at linaro.org>
- Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
-
-diff --git a/include/linux/log2.h b/include/linux/log2.h
-index ef3d4f67118c..c373295f359f 100644
---- a/include/linux/log2.h
-+++ b/include/linux/log2.h
-@@ -15,12 +15,6 @@
- #include <linux/types.h>
- #include <linux/bitops.h>
-
--/*
-- * deal with unrepresentable constant logarithms
-- */
--extern __attribute__((const, noreturn))
--int ____ilog2_NaN(void);
--
- /*
- * non-constant log of base 2 calculators
- * - the arch may override these in asm/bitops.h if they can be implemented
-@@ -85,7 +79,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
- #define ilog2(n) \
- ( \
- __builtin_constant_p(n) ? ( \
-- (n) < 1 ? ____ilog2_NaN() : \
-+ (n) < 2 ? 0 : \
- (n) & (1ULL << 63) ? 63 : \
- (n) & (1ULL << 62) ? 62 : \
- (n) & (1ULL << 61) ? 61 : \
-@@ -148,10 +142,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
- (n) & (1ULL << 4) ? 4 : \
- (n) & (1ULL << 3) ? 3 : \
- (n) & (1ULL << 2) ? 2 : \
-- (n) & (1ULL << 1) ? 1 : \
-- (n) & (1ULL << 0) ? 0 : \
-- ____ilog2_NaN() \
-- ) : \
-+ 1 ) : \
- (sizeof(n) <= 4) ? \
- __ilog2_u32(n) : \
- __ilog2_u64(n) \
-diff --git a/tools/include/linux/log2.h b/tools/include/linux/log2.h
-index 41446668ccce..d5677d39c1e4 100644
---- a/tools/include/linux/log2.h
-+++ b/tools/include/linux/log2.h
-@@ -12,12 +12,6 @@
- #ifndef _TOOLS_LINUX_LOG2_H
- #define _TOOLS_LINUX_LOG2_H
-
--/*
-- * deal with unrepresentable constant logarithms
-- */
--extern __attribute__((const, noreturn))
--int ____ilog2_NaN(void);
--
- /*
- * non-constant log of base 2 calculators
- * - the arch may override these in asm/bitops.h if they can be implemented
-@@ -78,7 +72,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
- #define ilog2(n) \
- ( \
- __builtin_constant_p(n) ? ( \
-- (n) < 1 ? ____ilog2_NaN() : \
-+ (n) < 2 ? 0 : \
- (n) & (1ULL << 63) ? 63 : \
- (n) & (1ULL << 62) ? 62 : \
- (n) & (1ULL << 61) ? 61 : \
-@@ -141,10 +135,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
- (n) & (1ULL << 4) ? 4 : \
- (n) & (1ULL << 3) ? 3 : \
- (n) & (1ULL << 2) ? 2 : \
-- (n) & (1ULL << 1) ? 1 : \
-- (n) & (1ULL << 0) ? 0 : \
-- ____ilog2_NaN() \
-- ) : \
-+ 1 ) : \
- (sizeof(n) <= 4) ? \
- __ilog2_u32(n) : \
- __ilog2_u64(n) \
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/kernel.git/commitdiff/52178c4968d3525ceb0a8c032b018236b797b9a8
More information about the pld-cvs-commit
mailing list