tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'char-misc-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
"Here are some small char and misc driver fixes to resolve some
reported issues, as well as a number of binderfs fixups that were
found after auditing the filesystem code by Al Viro. As binderfs
hasn't been in a previous release yet, it's good to get these in now
before the first users show up.

All of these have been in linux-next for a bit with no reported
issues"

* tag 'char-misc-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (26 commits)
i3c: master: Fix an error checking typo in 'cdns_i3c_master_probe()'
binderfs: switch from d_add() to d_instantiate()
binderfs: drop lock in binderfs_binder_ctl_create
binderfs: kill_litter_super() before cleanup
binderfs: rework binderfs_binder_device_create()
binderfs: rework binderfs_fill_super()
binderfs: prevent renaming the control dentry
binderfs: remove outdated comment
binderfs: use __u32 for device numbers
binderfs: use correct include guards in header
misc: pvpanic: fix warning implicit declaration
char/mwave: fix potential Spectre v1 vulnerability
misc: ibmvsm: Fix potential NULL pointer dereference
binderfs: fix error return code in binderfs_fill_super()
mei: me: add denverton innovation engine device IDs
mei: me: mark LBG devices as having dma support
mei: dma: silent the reject message
binderfs: handle !CONFIG_IPC_NS builds
binderfs: reserve devices for initial mount
binderfs: rename header to binderfs.h
...

Linus Torvalds d488bd21 96f18cb8

+271 -201
+151 -131
drivers/android/binderfs.c
··· 11 11 #include <linux/kdev_t.h> 12 12 #include <linux/kernel.h> 13 13 #include <linux/list.h> 14 + #include <linux/namei.h> 14 15 #include <linux/magic.h> 15 16 #include <linux/major.h> 16 17 #include <linux/miscdevice.h> ··· 21 20 #include <linux/parser.h> 22 21 #include <linux/radix-tree.h> 23 22 #include <linux/sched.h> 23 + #include <linux/seq_file.h> 24 24 #include <linux/slab.h> 25 25 #include <linux/spinlock_types.h> 26 26 #include <linux/stddef.h> ··· 32 30 #include <linux/xarray.h> 33 31 #include <uapi/asm-generic/errno-base.h> 34 32 #include <uapi/linux/android/binder.h> 35 - #include <uapi/linux/android/binder_ctl.h> 33 + #include <uapi/linux/android/binderfs.h> 36 34 37 35 #include "binder_internal.h" 38 36 ··· 41 39 #define INODE_OFFSET 3 42 40 #define INTSTRLEN 21 43 41 #define BINDERFS_MAX_MINOR (1U << MINORBITS) 44 - 45 - static struct vfsmount *binderfs_mnt; 42 + /* Ensure that the initial ipc namespace always has devices available. */ 43 + #define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4) 46 44 47 45 static dev_t binderfs_dev; 48 46 static DEFINE_MUTEX(binderfs_minors_mutex); 49 47 static DEFINE_IDA(binderfs_minors); 48 + 49 + /** 50 + * binderfs_mount_opts - mount options for binderfs 51 + * @max: maximum number of allocatable binderfs binder devices 52 + */ 53 + struct binderfs_mount_opts { 54 + int max; 55 + }; 56 + 57 + enum { 58 + Opt_max, 59 + Opt_err 60 + }; 61 + 62 + static const match_table_t tokens = { 63 + { Opt_max, "max=%d" }, 64 + { Opt_err, NULL } 65 + }; 50 66 51 67 /** 52 68 * binderfs_info - information about a binderfs mount ··· 75 55 * created. 76 56 * @root_gid: gid that needs to be used when a new binder device is 77 57 * created. 58 + * @mount_opts: The mount options in use. 59 + * @device_count: The current number of allocated binder devices. 78 60 */ 79 61 struct binderfs_info { 80 62 struct ipc_namespace *ipc_ns; 81 63 struct dentry *control_dentry; 82 64 kuid_t root_uid; 83 65 kgid_t root_gid; 84 - 66 + struct binderfs_mount_opts mount_opts; 67 + int device_count; 85 68 }; 86 69 87 70 static inline struct binderfs_info *BINDERFS_I(const struct inode *inode) ··· 107 84 * @userp: buffer to copy information about new device for userspace to 108 85 * @req: struct binderfs_device as copied from userspace 109 86 * 110 - * This function allocated a new binder_device and reserves a new minor 87 + * This function allocates a new binder_device and reserves a new minor 111 88 * number for it. 112 89 * Minor numbers are limited and tracked globally in binderfs_minors. The 113 90 * function will stash a struct binder_device for the specific binder ··· 123 100 struct binderfs_device *req) 124 101 { 125 102 int minor, ret; 126 - struct dentry *dentry, *dup, *root; 103 + struct dentry *dentry, *root; 127 104 struct binder_device *device; 128 - size_t name_len = BINDERFS_MAX_NAME + 1; 129 105 char *name = NULL; 106 + size_t name_len; 130 107 struct inode *inode = NULL; 131 108 struct super_block *sb = ref_inode->i_sb; 132 109 struct binderfs_info *info = sb->s_fs_info; 110 + #if defined(CONFIG_IPC_NS) 111 + bool use_reserve = (info->ipc_ns == &init_ipc_ns); 112 + #else 113 + bool use_reserve = true; 114 + #endif 133 115 134 116 /* Reserve new minor number for the new device. */ 135 117 mutex_lock(&binderfs_minors_mutex); 136 - minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL); 137 - mutex_unlock(&binderfs_minors_mutex); 138 - if (minor < 0) 118 + if (++info->device_count <= info->mount_opts.max) 119 + minor = ida_alloc_max(&binderfs_minors, 120 + use_reserve ? BINDERFS_MAX_MINOR : 121 + BINDERFS_MAX_MINOR_CAPPED, 122 + GFP_KERNEL); 123 + else 124 + minor = -ENOSPC; 125 + if (minor < 0) { 126 + --info->device_count; 127 + mutex_unlock(&binderfs_minors_mutex); 139 128 return minor; 129 + } 130 + mutex_unlock(&binderfs_minors_mutex); 140 131 141 132 ret = -ENOMEM; 142 133 device = kzalloc(sizeof(*device), GFP_KERNEL); ··· 169 132 inode->i_uid = info->root_uid; 170 133 inode->i_gid = info->root_gid; 171 134 172 - name = kmalloc(name_len, GFP_KERNEL); 135 + req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */ 136 + name_len = strlen(req->name); 137 + /* Make sure to include terminating NUL byte */ 138 + name = kmemdup(req->name, name_len + 1, GFP_KERNEL); 173 139 if (!name) 174 140 goto err; 175 - 176 - strscpy(name, req->name, name_len); 177 141 178 142 device->binderfs_inode = inode; 179 143 device->context.binder_context_mgr_uid = INVALID_UID; ··· 194 156 195 157 root = sb->s_root; 196 158 inode_lock(d_inode(root)); 197 - dentry = d_alloc_name(root, name); 198 - if (!dentry) { 159 + 160 + /* look it up */ 161 + dentry = lookup_one_len(name, root, name_len); 162 + if (IS_ERR(dentry)) { 199 163 inode_unlock(d_inode(root)); 200 - ret = -ENOMEM; 164 + ret = PTR_ERR(dentry); 201 165 goto err; 202 166 } 203 167 204 - /* Verify that the name userspace gave us is not already in use. */ 205 - dup = d_lookup(root, &dentry->d_name); 206 - if (dup) { 207 - if (d_really_is_positive(dup)) { 208 - dput(dup); 209 - dput(dentry); 210 - inode_unlock(d_inode(root)); 211 - ret = -EEXIST; 212 - goto err; 213 - } 214 - dput(dup); 168 + if (d_really_is_positive(dentry)) { 169 + /* already exists */ 170 + dput(dentry); 171 + inode_unlock(d_inode(root)); 172 + ret = -EEXIST; 173 + goto err; 215 174 } 216 175 217 176 inode->i_private = device; 218 - d_add(dentry, inode); 177 + d_instantiate(dentry, inode); 219 178 fsnotify_create(root->d_inode, dentry); 220 179 inode_unlock(d_inode(root)); 221 180 ··· 222 187 kfree(name); 223 188 kfree(device); 224 189 mutex_lock(&binderfs_minors_mutex); 190 + --info->device_count; 225 191 ida_free(&binderfs_minors, minor); 226 192 mutex_unlock(&binderfs_minors_mutex); 227 193 iput(inode); ··· 268 232 static void binderfs_evict_inode(struct inode *inode) 269 233 { 270 234 struct binder_device *device = inode->i_private; 235 + struct binderfs_info *info = BINDERFS_I(inode); 271 236 272 237 clear_inode(inode); 273 238 ··· 276 239 return; 277 240 278 241 mutex_lock(&binderfs_minors_mutex); 242 + --info->device_count; 279 243 ida_free(&binderfs_minors, device->miscdev.minor); 280 244 mutex_unlock(&binderfs_minors_mutex); 281 245 ··· 284 246 kfree(device); 285 247 } 286 248 249 + /** 250 + * binderfs_parse_mount_opts - parse binderfs mount options 251 + * @data: options to set (can be NULL in which case defaults are used) 252 + */ 253 + static int binderfs_parse_mount_opts(char *data, 254 + struct binderfs_mount_opts *opts) 255 + { 256 + char *p; 257 + opts->max = BINDERFS_MAX_MINOR; 258 + 259 + while ((p = strsep(&data, ",")) != NULL) { 260 + substring_t args[MAX_OPT_ARGS]; 261 + int token; 262 + int max_devices; 263 + 264 + if (!*p) 265 + continue; 266 + 267 + token = match_token(p, tokens, args); 268 + switch (token) { 269 + case Opt_max: 270 + if (match_int(&args[0], &max_devices) || 271 + (max_devices < 0 || 272 + (max_devices > BINDERFS_MAX_MINOR))) 273 + return -EINVAL; 274 + 275 + opts->max = max_devices; 276 + break; 277 + default: 278 + pr_err("Invalid mount options\n"); 279 + return -EINVAL; 280 + } 281 + } 282 + 283 + return 0; 284 + } 285 + 286 + static int binderfs_remount(struct super_block *sb, int *flags, char *data) 287 + { 288 + struct binderfs_info *info = sb->s_fs_info; 289 + return binderfs_parse_mount_opts(data, &info->mount_opts); 290 + } 291 + 292 + static int binderfs_show_mount_opts(struct seq_file *seq, struct dentry *root) 293 + { 294 + struct binderfs_info *info; 295 + 296 + info = root->d_sb->s_fs_info; 297 + if (info->mount_opts.max <= BINDERFS_MAX_MINOR) 298 + seq_printf(seq, ",max=%d", info->mount_opts.max); 299 + 300 + return 0; 301 + } 302 + 287 303 static const struct super_operations binderfs_super_ops = { 288 - .statfs = simple_statfs, 289 - .evict_inode = binderfs_evict_inode, 304 + .evict_inode = binderfs_evict_inode, 305 + .remount_fs = binderfs_remount, 306 + .show_options = binderfs_show_mount_opts, 307 + .statfs = simple_statfs, 290 308 }; 309 + 310 + static inline bool is_binderfs_control_device(const struct dentry *dentry) 311 + { 312 + struct binderfs_info *info = dentry->d_sb->s_fs_info; 313 + return info->control_dentry == dentry; 314 + } 291 315 292 316 static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry, 293 317 struct inode *new_dir, struct dentry *new_dentry, 294 318 unsigned int flags) 295 319 { 296 - struct inode *inode = d_inode(old_dentry); 297 - 298 - /* binderfs doesn't support directories. */ 299 - if (d_is_dir(old_dentry)) 320 + if (is_binderfs_control_device(old_dentry) || 321 + is_binderfs_control_device(new_dentry)) 300 322 return -EPERM; 301 323 302 - if (flags & ~RENAME_NOREPLACE) 303 - return -EINVAL; 304 - 305 - if (!simple_empty(new_dentry)) 306 - return -ENOTEMPTY; 307 - 308 - if (d_really_is_positive(new_dentry)) 309 - simple_unlink(new_dir, new_dentry); 310 - 311 - old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime = 312 - new_dir->i_mtime = inode->i_ctime = current_time(old_dir); 313 - 314 - return 0; 324 + return simple_rename(old_dir, old_dentry, new_dir, new_dentry, flags); 315 325 } 316 326 317 327 static int binderfs_unlink(struct inode *dir, struct dentry *dentry) 318 328 { 319 - /* 320 - * The control dentry is only ever touched during mount so checking it 321 - * here should not require us to take lock. 322 - */ 323 - if (BINDERFS_I(dir)->control_dentry == dentry) 329 + if (is_binderfs_control_device(dentry)) 324 330 return -EPERM; 325 331 326 332 return simple_unlink(dir, dentry); ··· 399 317 device = kzalloc(sizeof(*device), GFP_KERNEL); 400 318 if (!device) 401 319 return -ENOMEM; 402 - 403 - inode_lock(d_inode(root)); 404 320 405 321 /* If we have already created a binder-control node, return. */ 406 322 if (info->control_dentry) { ··· 438 358 inode->i_private = device; 439 359 info->control_dentry = dentry; 440 360 d_add(dentry, inode); 441 - inode_unlock(d_inode(root)); 442 361 443 362 return 0; 444 363 445 364 out: 446 - inode_unlock(d_inode(root)); 447 365 kfree(device); 448 366 iput(inode); 449 367 ··· 456 378 457 379 static int binderfs_fill_super(struct super_block *sb, void *data, int silent) 458 380 { 381 + int ret; 459 382 struct binderfs_info *info; 460 - int ret = -ENOMEM; 461 383 struct inode *inode = NULL; 462 - struct ipc_namespace *ipc_ns = sb->s_fs_info; 463 - 464 - get_ipc_ns(ipc_ns); 465 384 466 385 sb->s_blocksize = PAGE_SIZE; 467 386 sb->s_blocksize_bits = PAGE_SHIFT; ··· 480 405 sb->s_op = &binderfs_super_ops; 481 406 sb->s_time_gran = 1; 482 407 483 - info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL); 484 - if (!info) 485 - goto err_without_dentry; 408 + sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL); 409 + if (!sb->s_fs_info) 410 + return -ENOMEM; 411 + info = sb->s_fs_info; 486 412 487 - info->ipc_ns = ipc_ns; 413 + info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns); 414 + 415 + ret = binderfs_parse_mount_opts(data, &info->mount_opts); 416 + if (ret) 417 + return ret; 418 + 488 419 info->root_gid = make_kgid(sb->s_user_ns, 0); 489 420 if (!gid_valid(info->root_gid)) 490 421 info->root_gid = GLOBAL_ROOT_GID; ··· 498 417 if (!uid_valid(info->root_uid)) 499 418 info->root_uid = GLOBAL_ROOT_UID; 500 419 501 - sb->s_fs_info = info; 502 - 503 420 inode = new_inode(sb); 504 421 if (!inode) 505 - goto err_without_dentry; 422 + return -ENOMEM; 506 423 507 424 inode->i_ino = FIRST_INODE; 508 425 inode->i_fop = &simple_dir_operations; ··· 511 432 512 433 sb->s_root = d_make_root(inode); 513 434 if (!sb->s_root) 514 - goto err_without_dentry; 435 + return -ENOMEM; 515 436 516 - ret = binderfs_binder_ctl_create(sb); 517 - if (ret) 518 - goto err_with_dentry; 519 - 520 - return 0; 521 - 522 - err_with_dentry: 523 - dput(sb->s_root); 524 - sb->s_root = NULL; 525 - 526 - err_without_dentry: 527 - put_ipc_ns(ipc_ns); 528 - iput(inode); 529 - kfree(info); 530 - 531 - return ret; 532 - } 533 - 534 - static int binderfs_test_super(struct super_block *sb, void *data) 535 - { 536 - struct binderfs_info *info = sb->s_fs_info; 537 - 538 - if (info) 539 - return info->ipc_ns == data; 540 - 541 - return 0; 542 - } 543 - 544 - static int binderfs_set_super(struct super_block *sb, void *data) 545 - { 546 - sb->s_fs_info = data; 547 - return set_anon_super(sb, NULL); 437 + return binderfs_binder_ctl_create(sb); 548 438 } 549 439 550 440 static struct dentry *binderfs_mount(struct file_system_type *fs_type, 551 441 int flags, const char *dev_name, 552 442 void *data) 553 443 { 554 - struct super_block *sb; 555 - struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns; 556 - 557 - if (!ns_capable(ipc_ns->user_ns, CAP_SYS_ADMIN)) 558 - return ERR_PTR(-EPERM); 559 - 560 - sb = sget_userns(fs_type, binderfs_test_super, binderfs_set_super, 561 - flags, ipc_ns->user_ns, ipc_ns); 562 - if (IS_ERR(sb)) 563 - return ERR_CAST(sb); 564 - 565 - if (!sb->s_root) { 566 - int ret = binderfs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0); 567 - if (ret) { 568 - deactivate_locked_super(sb); 569 - return ERR_PTR(ret); 570 - } 571 - 572 - sb->s_flags |= SB_ACTIVE; 573 - } 574 - 575 - return dget(sb->s_root); 444 + return mount_nodev(fs_type, flags, data, binderfs_fill_super); 576 445 } 577 446 578 447 static void binderfs_kill_super(struct super_block *sb) 579 448 { 580 449 struct binderfs_info *info = sb->s_fs_info; 581 450 451 + kill_litter_super(sb); 452 + 582 453 if (info && info->ipc_ns) 583 454 put_ipc_ns(info->ipc_ns); 584 455 585 456 kfree(info); 586 - kill_litter_super(sb); 587 457 } 588 458 589 459 static struct file_system_type binder_fs_type = { ··· 556 528 if (ret) { 557 529 unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR); 558 530 return ret; 559 - } 560 - 561 - binderfs_mnt = kern_mount(&binder_fs_type); 562 - if (IS_ERR(binderfs_mnt)) { 563 - ret = PTR_ERR(binderfs_mnt); 564 - binderfs_mnt = NULL; 565 - unregister_filesystem(&binder_fs_type); 566 - unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR); 567 531 } 568 532 569 533 return ret;
+7
drivers/char/mwave/mwavedd.c
··· 59 59 #include <linux/mutex.h> 60 60 #include <linux/delay.h> 61 61 #include <linux/serial_8250.h> 62 + #include <linux/nospec.h> 62 63 #include "smapi.h" 63 64 #include "mwavedd.h" 64 65 #include "3780i.h" ··· 290 289 ipcnum); 291 290 return -EINVAL; 292 291 } 292 + ipcnum = array_index_nospec(ipcnum, 293 + ARRAY_SIZE(pDrvData->IPCs)); 293 294 PRINTK_3(TRACE_MWAVE, 294 295 "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC" 295 296 " ipcnum %x entry usIntCount %x\n", ··· 320 317 " Invalid ipcnum %x\n", ipcnum); 321 318 return -EINVAL; 322 319 } 320 + ipcnum = array_index_nospec(ipcnum, 321 + ARRAY_SIZE(pDrvData->IPCs)); 323 322 PRINTK_3(TRACE_MWAVE, 324 323 "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC" 325 324 " ipcnum %x, usIntCount %x\n", ··· 388 383 ipcnum); 389 384 return -EINVAL; 390 385 } 386 + ipcnum = array_index_nospec(ipcnum, 387 + ARRAY_SIZE(pDrvData->IPCs)); 391 388 mutex_lock(&mwave_mutex); 392 389 if (pDrvData->IPCs[ipcnum].bIsEnabled == true) { 393 390 pDrvData->IPCs[ipcnum].bIsEnabled = false;
+1 -8
drivers/hv/channel.c
··· 701 701 int vmbus_disconnect_ring(struct vmbus_channel *channel) 702 702 { 703 703 struct vmbus_channel *cur_channel, *tmp; 704 - unsigned long flags; 705 - LIST_HEAD(list); 706 704 int ret; 707 705 708 706 if (channel->primary_channel != NULL) 709 707 return -EINVAL; 710 708 711 - /* Snapshot the list of subchannels */ 712 - spin_lock_irqsave(&channel->lock, flags); 713 - list_splice_init(&channel->sc_list, &list); 714 - spin_unlock_irqrestore(&channel->lock, flags); 715 - 716 - list_for_each_entry_safe(cur_channel, tmp, &list, sc_list) { 709 + list_for_each_entry_safe(cur_channel, tmp, &channel->sc_list, sc_list) { 717 710 if (cur_channel->rescind) 718 711 wait_for_completion(&cur_channel->rescind_event); 719 712
+6 -4
drivers/hv/hv_balloon.c
··· 888 888 pfn_cnt -= pgs_ol; 889 889 /* 890 890 * Check if the corresponding memory block is already 891 - * online by checking its last previously backed page. 892 - * In case it is we need to bring rest (which was not 893 - * backed previously) online too. 891 + * online. It is possible to observe struct pages still 892 + * being uninitialized here so check section instead. 893 + * In case the section is online we need to bring the 894 + * rest of pfns (which were not backed previously) 895 + * online too. 894 896 */ 895 897 if (start_pfn > has->start_pfn && 896 - !PageReserved(pfn_to_page(start_pfn - 1))) 898 + online_section_nr(pfn_to_section_nr(start_pfn))) 897 899 hv_bring_pgs_online(has, start_pfn, pgs_ol); 898 900 899 901 }
+14 -15
drivers/hv/ring_buffer.c
··· 164 164 } 165 165 166 166 /* Get various debug metrics for the specified ring buffer. */ 167 - void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info, 168 - struct hv_ring_buffer_debug_info *debug_info) 167 + int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info, 168 + struct hv_ring_buffer_debug_info *debug_info) 169 169 { 170 170 u32 bytes_avail_towrite; 171 171 u32 bytes_avail_toread; 172 172 173 - if (ring_info->ring_buffer) { 174 - hv_get_ringbuffer_availbytes(ring_info, 175 - &bytes_avail_toread, 176 - &bytes_avail_towrite); 173 + if (!ring_info->ring_buffer) 174 + return -EINVAL; 177 175 178 - debug_info->bytes_avail_toread = bytes_avail_toread; 179 - debug_info->bytes_avail_towrite = bytes_avail_towrite; 180 - debug_info->current_read_index = 181 - ring_info->ring_buffer->read_index; 182 - debug_info->current_write_index = 183 - ring_info->ring_buffer->write_index; 184 - debug_info->current_interrupt_mask = 185 - ring_info->ring_buffer->interrupt_mask; 186 - } 176 + hv_get_ringbuffer_availbytes(ring_info, 177 + &bytes_avail_toread, 178 + &bytes_avail_towrite); 179 + debug_info->bytes_avail_toread = bytes_avail_toread; 180 + debug_info->bytes_avail_towrite = bytes_avail_towrite; 181 + debug_info->current_read_index = ring_info->ring_buffer->read_index; 182 + debug_info->current_write_index = ring_info->ring_buffer->write_index; 183 + debug_info->current_interrupt_mask 184 + = ring_info->ring_buffer->interrupt_mask; 185 + return 0; 187 186 } 188 187 EXPORT_SYMBOL_GPL(hv_ringbuffer_get_debuginfo); 189 188
+61 -30
drivers/hv/vmbus_drv.c
··· 313 313 { 314 314 struct hv_device *hv_dev = device_to_hv_device(dev); 315 315 struct hv_ring_buffer_debug_info outbound; 316 + int ret; 316 317 317 318 if (!hv_dev->channel) 318 319 return -ENODEV; 319 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 320 - return -EINVAL; 321 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); 320 + 321 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, 322 + &outbound); 323 + if (ret < 0) 324 + return ret; 325 + 322 326 return sprintf(buf, "%d\n", outbound.current_interrupt_mask); 323 327 } 324 328 static DEVICE_ATTR_RO(out_intr_mask); ··· 332 328 { 333 329 struct hv_device *hv_dev = device_to_hv_device(dev); 334 330 struct hv_ring_buffer_debug_info outbound; 331 + int ret; 335 332 336 333 if (!hv_dev->channel) 337 334 return -ENODEV; 338 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 339 - return -EINVAL; 340 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); 335 + 336 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, 337 + &outbound); 338 + if (ret < 0) 339 + return ret; 341 340 return sprintf(buf, "%d\n", outbound.current_read_index); 342 341 } 343 342 static DEVICE_ATTR_RO(out_read_index); ··· 351 344 { 352 345 struct hv_device *hv_dev = device_to_hv_device(dev); 353 346 struct hv_ring_buffer_debug_info outbound; 347 + int ret; 354 348 355 349 if (!hv_dev->channel) 356 350 return -ENODEV; 357 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 358 - return -EINVAL; 359 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); 351 + 352 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, 353 + &outbound); 354 + if (ret < 0) 355 + return ret; 360 356 return sprintf(buf, "%d\n", outbound.current_write_index); 361 357 } 362 358 static DEVICE_ATTR_RO(out_write_index); ··· 370 360 { 371 361 struct hv_device *hv_dev = device_to_hv_device(dev); 372 362 struct hv_ring_buffer_debug_info outbound; 363 + int ret; 373 364 374 365 if (!hv_dev->channel) 375 366 return -ENODEV; 376 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 377 - return -EINVAL; 378 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); 367 + 368 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, 369 + &outbound); 370 + if (ret < 0) 371 + return ret; 379 372 return sprintf(buf, "%d\n", outbound.bytes_avail_toread); 380 373 } 381 374 static DEVICE_ATTR_RO(out_read_bytes_avail); ··· 389 376 { 390 377 struct hv_device *hv_dev = device_to_hv_device(dev); 391 378 struct hv_ring_buffer_debug_info outbound; 379 + int ret; 392 380 393 381 if (!hv_dev->channel) 394 382 return -ENODEV; 395 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 396 - return -EINVAL; 397 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); 383 + 384 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, 385 + &outbound); 386 + if (ret < 0) 387 + return ret; 398 388 return sprintf(buf, "%d\n", outbound.bytes_avail_towrite); 399 389 } 400 390 static DEVICE_ATTR_RO(out_write_bytes_avail); ··· 407 391 { 408 392 struct hv_device *hv_dev = device_to_hv_device(dev); 409 393 struct hv_ring_buffer_debug_info inbound; 394 + int ret; 410 395 411 396 if (!hv_dev->channel) 412 397 return -ENODEV; 413 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 414 - return -EINVAL; 415 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 398 + 399 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 400 + if (ret < 0) 401 + return ret; 402 + 416 403 return sprintf(buf, "%d\n", inbound.current_interrupt_mask); 417 404 } 418 405 static DEVICE_ATTR_RO(in_intr_mask); ··· 425 406 { 426 407 struct hv_device *hv_dev = device_to_hv_device(dev); 427 408 struct hv_ring_buffer_debug_info inbound; 409 + int ret; 428 410 429 411 if (!hv_dev->channel) 430 412 return -ENODEV; 431 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 432 - return -EINVAL; 433 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 413 + 414 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 415 + if (ret < 0) 416 + return ret; 417 + 434 418 return sprintf(buf, "%d\n", inbound.current_read_index); 435 419 } 436 420 static DEVICE_ATTR_RO(in_read_index); ··· 443 421 { 444 422 struct hv_device *hv_dev = device_to_hv_device(dev); 445 423 struct hv_ring_buffer_debug_info inbound; 424 + int ret; 446 425 447 426 if (!hv_dev->channel) 448 427 return -ENODEV; 449 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 450 - return -EINVAL; 451 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 428 + 429 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 430 + if (ret < 0) 431 + return ret; 432 + 452 433 return sprintf(buf, "%d\n", inbound.current_write_index); 453 434 } 454 435 static DEVICE_ATTR_RO(in_write_index); ··· 462 437 { 463 438 struct hv_device *hv_dev = device_to_hv_device(dev); 464 439 struct hv_ring_buffer_debug_info inbound; 440 + int ret; 465 441 466 442 if (!hv_dev->channel) 467 443 return -ENODEV; 468 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 469 - return -EINVAL; 470 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 444 + 445 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 446 + if (ret < 0) 447 + return ret; 448 + 471 449 return sprintf(buf, "%d\n", inbound.bytes_avail_toread); 472 450 } 473 451 static DEVICE_ATTR_RO(in_read_bytes_avail); ··· 481 453 { 482 454 struct hv_device *hv_dev = device_to_hv_device(dev); 483 455 struct hv_ring_buffer_debug_info inbound; 456 + int ret; 484 457 485 458 if (!hv_dev->channel) 486 459 return -ENODEV; 487 - if (hv_dev->channel->state != CHANNEL_OPENED_STATE) 488 - return -EINVAL; 489 - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 460 + 461 + ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); 462 + if (ret < 0) 463 + return ret; 464 + 490 465 return sprintf(buf, "%d\n", inbound.bytes_avail_towrite); 491 466 } 492 467 static DEVICE_ATTR_RO(in_write_bytes_avail);
+5 -2
drivers/misc/ibmvmc.c
··· 820 820 * 821 821 * Return: 822 822 * 0 - Success 823 + * Non-zero - Failure 823 824 */ 824 825 static int ibmvmc_open(struct inode *inode, struct file *file) 825 826 { 826 827 struct ibmvmc_file_session *session; 827 - int rc = 0; 828 828 829 829 pr_debug("%s: inode = 0x%lx, file = 0x%lx, state = 0x%x\n", __func__, 830 830 (unsigned long)inode, (unsigned long)file, 831 831 ibmvmc.state); 832 832 833 833 session = kzalloc(sizeof(*session), GFP_KERNEL); 834 + if (!session) 835 + return -ENOMEM; 836 + 834 837 session->file = file; 835 838 file->private_data = session; 836 839 837 - return rc; 840 + return 0; 838 841 } 839 842 840 843 /**
+9 -3
drivers/misc/mei/hbm.c
··· 1187 1187 dma_setup_res = (struct hbm_dma_setup_response *)mei_msg; 1188 1188 1189 1189 if (dma_setup_res->status) { 1190 - dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n", 1191 - dma_setup_res->status, 1192 - mei_hbm_status_str(dma_setup_res->status)); 1190 + u8 status = dma_setup_res->status; 1191 + 1192 + if (status == MEI_HBMS_NOT_ALLOWED) { 1193 + dev_dbg(dev->dev, "hbm: dma setup not allowed\n"); 1194 + } else { 1195 + dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n", 1196 + status, 1197 + mei_hbm_status_str(status)); 1198 + } 1193 1199 dev->hbm_f_dr_supported = 0; 1194 1200 mei_dmam_ring_free(dev); 1195 1201 }
+2
drivers/misc/mei/hw-me-regs.h
··· 127 127 #define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */ 128 128 #define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */ 129 129 130 + #define MEI_DEV_ID_DNV_IE 0x19E5 /* Denverton IE */ 131 + 130 132 #define MEI_DEV_ID_GLK 0x319A /* Gemini Lake */ 131 133 132 134 #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
+3 -1
drivers/misc/mei/pci-me.c
··· 88 88 {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)}, 89 89 {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)}, 90 90 {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)}, 91 - {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH8_CFG)}, 91 + {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)}, 92 92 93 93 {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)}, 94 94 {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)}, 95 + 96 + {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)}, 95 97 96 98 {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)}, 97 99
+4
drivers/misc/pvpanic.c
··· 70 70 struct resource r; 71 71 72 72 if (acpi_dev_resource_io(res, &r)) { 73 + #ifdef CONFIG_HAS_IOPORT_MAP 73 74 base = ioport_map(r.start, resource_size(&r)); 74 75 return AE_OK; 76 + #else 77 + return AE_ERROR; 78 + #endif 75 79 } else if (acpi_dev_resource_memory(res, &r)) { 76 80 base = ioremap(r.start, resource_size(&r)); 77 81 return AE_OK;
+3 -2
include/linux/hyperv.h
··· 1159 1159 u32 bytes_avail_towrite; 1160 1160 }; 1161 1161 1162 - void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info, 1163 - struct hv_ring_buffer_debug_info *debug_info); 1162 + 1163 + int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info, 1164 + struct hv_ring_buffer_debug_info *debug_info); 1164 1165 1165 1166 /* Vmbus interface */ 1166 1167 #define vmbus_driver_register(driver) \
+5 -5
include/uapi/linux/android/binder_ctl.h include/uapi/linux/android/binderfs.h
··· 4 4 * 5 5 */ 6 6 7 - #ifndef _UAPI_LINUX_BINDER_CTL_H 8 - #define _UAPI_LINUX_BINDER_CTL_H 7 + #ifndef _UAPI_LINUX_BINDERFS_H 8 + #define _UAPI_LINUX_BINDERFS_H 9 9 10 10 #include <linux/android/binder.h> 11 11 #include <linux/types.h> ··· 22 22 */ 23 23 struct binderfs_device { 24 24 char name[BINDERFS_MAX_NAME + 1]; 25 - __u8 major; 26 - __u8 minor; 25 + __u32 major; 26 + __u32 minor; 27 27 }; 28 28 29 29 /** ··· 31 31 */ 32 32 #define BINDER_CTL_ADD _IOWR('b', 1, struct binderfs_device) 33 33 34 - #endif /* _UAPI_LINUX_BINDER_CTL_H */ 34 + #endif /* _UAPI_LINUX_BINDERFS_H */ 35 35