--- /dev/null
+From 271ef65b5882425d500e969e875c98e47a6b0c86 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 19 Oct 2017 14:33:52 +0200
+Subject: ASoC: Intel: sst: remove redundant variable dma_dev_name
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 271ef65b5882425d500e969e875c98e47a6b0c86 upstream.
+
+The pointer dma_dev_name is assigned but never read, it is redundant
+and can therefore be removed.
+
+Cleans up clang warning:
+sound/soc/intel/common/sst-firmware.c:288:3: warning: Value stored to
+'dma_dev_name' is never read
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/intel/common/sst-firmware.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/sound/soc/intel/common/sst-firmware.c
++++ b/sound/soc/intel/common/sst-firmware.c
+@@ -274,7 +274,6 @@ int sst_dma_new(struct sst_dsp *sst)
+ struct sst_pdata *sst_pdata = sst->pdata;
+ struct sst_dma *dma;
+ struct resource mem;
+- const char *dma_dev_name;
+ int ret = 0;
+
+ if (sst->pdata->resindex_dma_base == -1)
+@@ -285,7 +284,6 @@ int sst_dma_new(struct sst_dsp *sst)
+ * is attached to the ADSP IP. */
+ switch (sst->pdata->dma_engine) {
+ case SST_DMA_TYPE_DW:
+- dma_dev_name = "dw_dmac";
+ break;
+ default:
+ dev_err(sst->dev, "error: invalid DMA engine %d\n",
--- /dev/null
+From 814596495dd2b9d4aab92d8f89cf19060d25d2ea Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 14 May 2018 20:09:24 -0700
+Subject: cfg80211: further limit wiphy names to 64 bytes
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 814596495dd2b9d4aab92d8f89cf19060d25d2ea upstream.
+
+wiphy names were recently limited to 128 bytes by commit a7cfebcb7594
+("cfg80211: limit wiphy names to 128 bytes"). As it turns out though,
+this isn't sufficient because dev_vprintk_emit() needs the syslog header
+string "SUBSYSTEM=ieee80211\0DEVICE=+ieee80211:$devname" to fit into 128
+bytes. This triggered the "device/subsystem name too long" WARN when
+the device name was >= 90 bytes. As before, this was reproduced by
+syzbot by sending an HWSIM_CMD_NEW_RADIO command to the MAC80211_HWSIM
+generic netlink family.
+
+Fix it by further limiting wiphy names to 64 bytes.
+
+Reported-by: syzbot+e64565577af34b3768dc@syzkaller.appspotmail.com
+Fixes: a7cfebcb7594 ("cfg80211: limit wiphy names to 128 bytes")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/uapi/linux/nl80211.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2604,7 +2604,7 @@ enum nl80211_attrs {
+ #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS
+ #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS
+
+-#define NL80211_WIPHY_NAME_MAXLEN 128
++#define NL80211_WIPHY_NAME_MAXLEN 64
+
+ #define NL80211_MAX_SUPP_RATES 32
+ #define NL80211_MAX_SUPP_HT_RATES 77
--- /dev/null
+From 531beb067c6185aceabfdee0965234c6a8fd133b Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 15 Sep 2017 00:05:16 +0100
+Subject: dma-buf: remove redundant initialization of sg_table
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 531beb067c6185aceabfdee0965234c6a8fd133b upstream.
+
+sg_table is being initialized and is never read before it is updated
+again later on, hence making the initialization redundant. Remove
+the initialization.
+
+Detected by clang scan-build:
+"warning: Value stored to 'sg_table' during its initialization is
+never read"
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20170914230516.6056-1-colin.king@canonical.com
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma-buf/dma-buf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -625,7 +625,7 @@ EXPORT_SYMBOL_GPL(dma_buf_detach);
+ struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
+ enum dma_data_direction direction)
+ {
+- struct sg_table *sg_table = ERR_PTR(-EINVAL);
++ struct sg_table *sg_table;
+
+ might_sleep();
+
--- /dev/null
+From 42b5122e828a6ccd9952ad3116343dc032d33efe Mon Sep 17 00:00:00 2001
+From: Matthias Kaehlcke <mka@chromium.org>
+Date: Wed, 7 Feb 2018 10:58:43 -0800
+Subject: drm/amd/powerplay: Fix enum mismatch
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+commit 42b5122e828a6ccd9952ad3116343dc032d33efe upstream.
+
+In several locations the driver uses AMD_CG_STATE_UNGATE (type enum
+amd_clockgating_state) instead of AMD_PG_STATE_UNGATE (type enum
+amd_powergating_stat) and vice versa. Both constants have the same
+value, so this doesn't cause any problems, but we still want to pass
+the correct type.
+
+Fixing the mismatch resolves multiple warnings like this when building
+with clang:
+
+drivers/gpu/drm/amd/amdgpu/../powerplay/hwmgr/cz_clockpowergating.c:169:7:
+ error: implicit conversion from enumeration type 'enum
+ amd_powergating_state' to different enumeration type 'enum
+ amd_clockgating_state' [-Werror,-Wenum-conversion]
+ AMD_PG_STATE_UNGATE);
+
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c | 8 ++++----
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
+@@ -176,10 +176,10 @@ int cz_dpm_powergate_uvd(struct pp_hwmgr
+ cz_dpm_powerup_uvd(hwmgr);
+ cgs_set_clockgating_state(hwmgr->device,
+ AMD_IP_BLOCK_TYPE_UVD,
+- AMD_PG_STATE_UNGATE);
++ AMD_CG_STATE_UNGATE);
+ cgs_set_powergating_state(hwmgr->device,
+ AMD_IP_BLOCK_TYPE_UVD,
+- AMD_CG_STATE_UNGATE);
++ AMD_PG_STATE_UNGATE);
+ cz_dpm_update_uvd_dpm(hwmgr, false);
+ }
+
+@@ -208,11 +208,11 @@ int cz_dpm_powergate_vce(struct pp_hwmgr
+ cgs_set_clockgating_state(
+ hwmgr->device,
+ AMD_IP_BLOCK_TYPE_VCE,
+- AMD_PG_STATE_UNGATE);
++ AMD_CG_STATE_UNGATE);
+ cgs_set_powergating_state(
+ hwmgr->device,
+ AMD_IP_BLOCK_TYPE_VCE,
+- AMD_CG_STATE_UNGATE);
++ AMD_PG_STATE_UNGATE);
+ cz_dpm_update_vce_dpm(hwmgr);
+ cz_enable_disable_vce_dpm(hwmgr, true);
+ return 0;
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c
+@@ -162,7 +162,7 @@ int smu7_powergate_uvd(struct pp_hwmgr *
+ AMD_CG_STATE_UNGATE);
+ cgs_set_powergating_state(hwmgr->device,
+ AMD_IP_BLOCK_TYPE_UVD,
+- AMD_CG_STATE_UNGATE);
++ AMD_PG_STATE_UNGATE);
+ smu7_update_uvd_dpm(hwmgr, false);
+ }
+
--- /dev/null
+From cad9946c2a4375386062131858881cfd30fc1b8f Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Sat, 26 Aug 2017 12:09:33 +0100
+Subject: drm/i915: Always sanity check engine state upon idling
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit cad9946c2a4375386062131858881cfd30fc1b8f upstream.
+
+When we do a locked idle we know that afterwards all requests have been
+completed and the engines have been cleared of tasks. For whatever
+reason, this doesn't always happen and we may go into a suspend with
+ELSP still full, and this causes an issue upon resume as we get very,
+very confused.
+
+If the engines refuse to idle, mark the device as wedged. In the process
+we get rid of the maybe unused open-coded version of wait_for_engines
+reported by Nick Desaulniers and Matthias Kaehlcke.
+
+v2: Suppress the -EIO before suspend, but keep it for seqno wrap.
+
+References: https://bugs.freedesktop.org/show_bug.cgi?id=101891
+References: https://bugs.freedesktop.org/show_bug.cgi?id=102456
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Matthias Kaehlcke <mka@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20170826110935.10237-1-chris@chris-wilson.co.uk
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 27 ++++++++-------------------
+ 1 file changed, 8 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -3378,24 +3378,12 @@ static int wait_for_timeline(struct i915
+ return 0;
+ }
+
+-static int wait_for_engine(struct intel_engine_cs *engine, int timeout_ms)
+-{
+- return wait_for(intel_engine_is_idle(engine), timeout_ms);
+-}
+-
+ static int wait_for_engines(struct drm_i915_private *i915)
+ {
+- struct intel_engine_cs *engine;
+- enum intel_engine_id id;
+-
+- for_each_engine(engine, i915, id) {
+- if (GEM_WARN_ON(wait_for_engine(engine, 50))) {
+- i915_gem_set_wedged(i915);
+- return -EIO;
+- }
+-
+- GEM_BUG_ON(intel_engine_get_seqno(engine) !=
+- intel_engine_last_submit(engine));
++ if (wait_for(intel_engines_are_idle(i915), 50)) {
++ DRM_ERROR("Failed to idle engines, declaring wedged!\n");
++ i915_gem_set_wedged(i915);
++ return -EIO;
+ }
+
+ return 0;
+@@ -4575,7 +4563,7 @@ int i915_gem_suspend(struct drm_i915_pri
+ ret = i915_gem_wait_for_idle(dev_priv,
+ I915_WAIT_INTERRUPTIBLE |
+ I915_WAIT_LOCKED);
+- if (ret)
++ if (ret && ret != -EIO)
+ goto err_unlock;
+
+ assert_kernel_context_is_current(dev_priv);
+@@ -4619,11 +4607,12 @@ int i915_gem_suspend(struct drm_i915_pri
+ * machine in an unusable condition.
+ */
+ i915_gem_sanitize(dev_priv);
+- goto out_rpm_put;
++
++ intel_runtime_pm_put(dev_priv);
++ return 0;
+
+ err_unlock:
+ mutex_unlock(&dev->struct_mutex);
+-out_rpm_put:
+ intel_runtime_pm_put(dev_priv);
+ return ret;
+ }
--- /dev/null
+From 0a5f41767444cc3b4fc5573921ab914b4f78baaa Mon Sep 17 00:00:00 2001
+From: Sodagudi Prasad <psodagud@codeaurora.org>
+Date: Tue, 6 Feb 2018 15:46:51 -0800
+Subject: kbuild: clang: disable unused variable warnings only when constant
+
+From: Sodagudi Prasad <psodagud@codeaurora.org>
+
+commit 0a5f41767444cc3b4fc5573921ab914b4f78baaa upstream.
+
+Currently, GCC disables -Wunused-const-variable, but not
+-Wunused-variable, so warns unused variables if they are
+non-constant.
+
+While, Clang does not warn unused variables at all regardless of
+the const qualifier because -Wno-unused-const-variable is implied
+by the stronger option -Wno-unused-variable.
+
+Disable -Wunused-const-variable instead of -Wunused-variable so that
+GCC and Clang work in the same way.
+
+Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Makefile | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -706,7 +706,6 @@ KBUILD_CFLAGS += $(stackp-flag)
+
+ ifeq ($(cc-name),clang)
+ KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,)
+-KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier)
+ KBUILD_CFLAGS += $(call cc-disable-warning, gnu)
+ KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
+@@ -724,9 +723,9 @@ else
+ # These warnings generated too much noise in a regular build.
+ # Use make W=1 to enable them (see scripts/Makefile.extrawarn)
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+-KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
+ endif
+
++KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
+ ifdef CONFIG_FRAME_POINTER
+ KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
+ else
--- /dev/null
+From df16aaac26e92e97ab7234d3f93c953466adc4b5 Mon Sep 17 00:00:00 2001
+From: Nick Desaulniers <nick.desaulniers@gmail.com>
+Date: Sat, 7 Oct 2017 13:23:23 -0700
+Subject: kbuild: clang: remove crufty HOSTCFLAGS
+
+From: Nick Desaulniers <nick.desaulniers@gmail.com>
+
+commit df16aaac26e92e97ab7234d3f93c953466adc4b5 upstream.
+
+When compiling with `make CC=clang HOSTCC=clang`, I was seeing warnings
+that clang did not recognize -fno-delete-null-pointer-checks for HOSTCC
+targets. These were added in commit 61163efae020 ("kbuild: LLVMLinux:
+Add Kbuild support for building kernel with Clang").
+
+Clang does not support -fno-delete-null-pointer-checks, so adding it to
+HOSTCFLAGS if HOSTCC is clang does not make sense.
+
+It's not clear why the other warnings were disabled, and just for
+HOSTCFLAGS, but I can remove them, add -Werror to HOSTCFLAGS and compile
+with clang just fine.
+
+Suggested-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Nick Desaulniers <nick.desaulniers@gmail.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Makefile | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -369,11 +369,6 @@ HOSTCXXFLAGS := -O2 $(HOST_LFS_CFLAGS)
+ HOSTLDFLAGS := $(HOST_LFS_LDFLAGS)
+ HOST_LOADLIBES := $(HOST_LFS_LIBS)
+
+-ifeq ($(shell $(HOSTCC) -v 2>&1 | grep -c "clang version"), 1)
+-HOSTCFLAGS += -Wno-unused-value -Wno-unused-parameter \
+- -Wno-missing-field-initializers -fno-delete-null-pointer-checks
+-endif
+-
+ # Make variables (CC, etc...)
+ AS = $(CROSS_COMPILE)as
+ LD = $(CROSS_COMPILE)ld
--- /dev/null
+From d3b56c566d4ba8cae688baf3cca94425d57ea783 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 31 Oct 2017 10:27:47 +0000
+Subject: platform/chrome: cros_ec_lpc: remove redundant pointer request
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit d3b56c566d4ba8cae688baf3cca94425d57ea783 upstream.
+
+Pointer request is being assigned but never used, so remove it. Cleans
+up the clang warning:
+
+drivers/platform/chrome/cros_ec_lpc.c:68:2: warning: Value stored to
+'request' is never read
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Benson Leung <bleung@chromium.org>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/chrome/cros_ec_lpc.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/platform/chrome/cros_ec_lpc.c
++++ b/drivers/platform/chrome/cros_ec_lpc.c
+@@ -54,7 +54,6 @@ static int ec_response_timed_out(void)
+ static int cros_ec_pkt_xfer_lpc(struct cros_ec_device *ec,
+ struct cros_ec_command *msg)
+ {
+- struct ec_host_request *request;
+ struct ec_host_response response;
+ u8 sum;
+ int ret = 0;
+@@ -65,8 +64,6 @@ static int cros_ec_pkt_xfer_lpc(struct c
+ /* Write buffer */
+ cros_ec_lpc_write_bytes(EC_LPC_ADDR_HOST_PACKET, ret, ec->dout);
+
+- request = (struct ec_host_request *)ec->dout;
+-
+ /* Here we go */
+ sum = EC_COMMAND_PROTOCOL_3;
+ cros_ec_lpc_write_bytes(EC_LPC_ADDR_HOST_CMD, 1, &sum);
--- /dev/null
+From fb239c1209bb0f0b4830cc72507cc2f2d63fadbd Mon Sep 17 00:00:00 2001
+From: Matthias Kaehlcke <mka@chromium.org>
+Date: Thu, 8 Feb 2018 16:57:12 -0800
+Subject: rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+commit fb239c1209bb0f0b4830cc72507cc2f2d63fadbd upstream.
+
+In _rtl92c_get_txpower_writeval_by_regulatory() the variable writeVal
+is assigned to itself in an if ... else statement, apparently only to
+document that the branch condition is handled and that a previously read
+value should be returned unmodified. The self-assignment causes clang to
+raise the following warning:
+
+drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c:304:13:
+ error: explicitly assigning value of variable of type 'u32'
+ (aka 'unsigned int') to itself [-Werror,-Wself-assign]
+ writeVal = writeVal;
+
+Delete the branch with the self-assignment.
+
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c
+@@ -299,9 +299,6 @@ static void _rtl92c_get_txpower_writeval
+ writeVal = 0x00000000;
+ if (rtlpriv->dm.dynamic_txhighpower_lvl == TXHIGHPWRLEVEL_BT1)
+ writeVal = writeVal - 0x06060606;
+- else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+- TXHIGHPWRLEVEL_BT2)
+- writeVal = writeVal;
+ *(p_outwriteval + rf) = writeVal;
+ }
+ }
tracing-fix-crash-when-freeing-instances-with-event-triggers.patch
tracing-make-the-snapshot-trigger-work-with-instances.patch
selinux-kasan-slab-out-of-bounds-in-xattr_getsecurity.patch
+cfg80211-further-limit-wiphy-names-to-64-bytes.patch
+kbuild-clang-remove-crufty-hostcflags.patch
+drm-i915-always-sanity-check-engine-state-upon-idling.patch
+dma-buf-remove-redundant-initialization-of-sg_table.patch
+drm-amd-powerplay-fix-enum-mismatch.patch
+rtlwifi-rtl8192cu-remove-variable-self-assignment-in-rf.c.patch
+asoc-intel-sst-remove-redundant-variable-dma_dev_name.patch
+platform-chrome-cros_ec_lpc-remove-redundant-pointer-request.patch
+kbuild-clang-disable-unused-variable-warnings-only-when-constant.patch
+tcp-avoid-integer-overflows-in-tcp_rcv_space_adjust.patch
--- /dev/null
+From 607065bad9931e72207b0cac365d7d4abc06bd99 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sun, 10 Dec 2017 17:55:03 -0800
+Subject: tcp: avoid integer overflows in tcp_rcv_space_adjust()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 607065bad9931e72207b0cac365d7d4abc06bd99 upstream.
+
+When using large tcp_rmem[2] values (I did tests with 500 MB),
+I noticed overflows while computing rcvwin.
+
+Lets fix this before the following patch.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Acked-by: Wei Wang <weiwan@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[Backport: sysctl_tcp_rmem is not Namespace-ify'd in older kernels]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/tcp.h | 2 +-
+ net/ipv4/tcp_input.c | 10 ++++++----
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -334,7 +334,7 @@ struct tcp_sock {
+
+ /* Receiver queue space */
+ struct {
+- int space;
++ u32 space;
+ u32 seq;
+ u64 time;
+ } rcvq_space;
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -591,8 +591,8 @@ static inline void tcp_rcv_rtt_measure_t
+ void tcp_rcv_space_adjust(struct sock *sk)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
++ u32 copied;
+ int time;
+- int copied;
+
+ tcp_mstamp_refresh(tp);
+ time = tcp_stamp_us_delta(tp->tcp_mstamp, tp->rcvq_space.time);
+@@ -615,12 +615,13 @@ void tcp_rcv_space_adjust(struct sock *s
+
+ if (sysctl_tcp_moderate_rcvbuf &&
+ !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) {
+- int rcvwin, rcvmem, rcvbuf;
++ int rcvmem, rcvbuf;
++ u64 rcvwin;
+
+ /* minimal window to cope with packet losses, assuming
+ * steady state. Add some cushion because of small variations.
+ */
+- rcvwin = (copied << 1) + 16 * tp->advmss;
++ rcvwin = ((u64)copied << 1) + 16 * tp->advmss;
+
+ /* If rate increased by 25%,
+ * assume slow start, rcvwin = 3 * copied
+@@ -640,7 +641,8 @@ void tcp_rcv_space_adjust(struct sock *s
+ while (tcp_win_from_space(rcvmem) < tp->advmss)
+ rcvmem += 128;
+
+- rcvbuf = min(rcvwin / tp->advmss * rcvmem, sysctl_tcp_rmem[2]);
++ do_div(rcvwin, tp->advmss);
++ rcvbuf = min_t(u64, rcvwin * rcvmem, sysctl_tcp_rmem[2]);
+ if (rcvbuf > sk->sk_rcvbuf) {
+ sk->sk_rcvbuf = rcvbuf;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
