From: Greg Kroah-Hartman Date: Sat, 2 Jun 2018 13:34:35 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.9.106~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1995685028eb18eab0496e5ae2907931193f2d95;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: asoc-intel-sst-remove-redundant-variable-dma_dev_name.patch cfg80211-further-limit-wiphy-names-to-64-bytes.patch dma-buf-remove-redundant-initialization-of-sg_table.patch drm-amd-powerplay-fix-enum-mismatch.patch drm-i915-always-sanity-check-engine-state-upon-idling.patch kbuild-clang-disable-unused-variable-warnings-only-when-constant.patch kbuild-clang-remove-crufty-hostcflags.patch platform-chrome-cros_ec_lpc-remove-redundant-pointer-request.patch rtlwifi-rtl8192cu-remove-variable-self-assignment-in-rf.c.patch tcp-avoid-integer-overflows-in-tcp_rcv_space_adjust.patch --- diff --git a/queue-4.14/asoc-intel-sst-remove-redundant-variable-dma_dev_name.patch b/queue-4.14/asoc-intel-sst-remove-redundant-variable-dma_dev_name.patch new file mode 100644 index 00000000000..58ee5172760 --- /dev/null +++ b/queue-4.14/asoc-intel-sst-remove-redundant-variable-dma_dev_name.patch @@ -0,0 +1,44 @@ +From 271ef65b5882425d500e969e875c98e47a6b0c86 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Thu, 19 Oct 2017 14:33:52 +0200 +Subject: ASoC: Intel: sst: remove redundant variable dma_dev_name + +From: Colin Ian King + +commit 271ef65b5882425d500e969e875c98e47a6b0c86 upstream. + +The pointer dma_dev_name is assigned but never read, it is redundant +and can therefore be removed. + +Cleans up clang warning: +sound/soc/intel/common/sst-firmware.c:288:3: warning: Value stored to +'dma_dev_name' is never read + +Signed-off-by: Colin Ian King +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/common/sst-firmware.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/sound/soc/intel/common/sst-firmware.c ++++ b/sound/soc/intel/common/sst-firmware.c +@@ -274,7 +274,6 @@ int sst_dma_new(struct sst_dsp *sst) + struct sst_pdata *sst_pdata = sst->pdata; + struct sst_dma *dma; + struct resource mem; +- const char *dma_dev_name; + int ret = 0; + + if (sst->pdata->resindex_dma_base == -1) +@@ -285,7 +284,6 @@ int sst_dma_new(struct sst_dsp *sst) + * is attached to the ADSP IP. */ + switch (sst->pdata->dma_engine) { + case SST_DMA_TYPE_DW: +- dma_dev_name = "dw_dmac"; + break; + default: + dev_err(sst->dev, "error: invalid DMA engine %d\n", diff --git a/queue-4.14/cfg80211-further-limit-wiphy-names-to-64-bytes.patch b/queue-4.14/cfg80211-further-limit-wiphy-names-to-64-bytes.patch new file mode 100644 index 00000000000..01dd3afdece --- /dev/null +++ b/queue-4.14/cfg80211-further-limit-wiphy-names-to-64-bytes.patch @@ -0,0 +1,41 @@ +From 814596495dd2b9d4aab92d8f89cf19060d25d2ea Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 14 May 2018 20:09:24 -0700 +Subject: cfg80211: further limit wiphy names to 64 bytes + +From: Eric Biggers + +commit 814596495dd2b9d4aab92d8f89cf19060d25d2ea upstream. + +wiphy names were recently limited to 128 bytes by commit a7cfebcb7594 +("cfg80211: limit wiphy names to 128 bytes"). As it turns out though, +this isn't sufficient because dev_vprintk_emit() needs the syslog header +string "SUBSYSTEM=ieee80211\0DEVICE=+ieee80211:$devname" to fit into 128 +bytes. This triggered the "device/subsystem name too long" WARN when +the device name was >= 90 bytes. As before, this was reproduced by +syzbot by sending an HWSIM_CMD_NEW_RADIO command to the MAC80211_HWSIM +generic netlink family. + +Fix it by further limiting wiphy names to 64 bytes. + +Reported-by: syzbot+e64565577af34b3768dc@syzkaller.appspotmail.com +Fixes: a7cfebcb7594 ("cfg80211: limit wiphy names to 128 bytes") +Signed-off-by: Eric Biggers +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + include/uapi/linux/nl80211.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/uapi/linux/nl80211.h ++++ b/include/uapi/linux/nl80211.h +@@ -2604,7 +2604,7 @@ enum nl80211_attrs { + #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS + #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS + +-#define NL80211_WIPHY_NAME_MAXLEN 128 ++#define NL80211_WIPHY_NAME_MAXLEN 64 + + #define NL80211_MAX_SUPP_RATES 32 + #define NL80211_MAX_SUPP_HT_RATES 77 diff --git a/queue-4.14/dma-buf-remove-redundant-initialization-of-sg_table.patch b/queue-4.14/dma-buf-remove-redundant-initialization-of-sg_table.patch new file mode 100644 index 00000000000..2ac39008a4f --- /dev/null +++ b/queue-4.14/dma-buf-remove-redundant-initialization-of-sg_table.patch @@ -0,0 +1,39 @@ +From 531beb067c6185aceabfdee0965234c6a8fd133b Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 15 Sep 2017 00:05:16 +0100 +Subject: dma-buf: remove redundant initialization of sg_table + +From: Colin Ian King + +commit 531beb067c6185aceabfdee0965234c6a8fd133b upstream. + +sg_table is being initialized and is never read before it is updated +again later on, hence making the initialization redundant. Remove +the initialization. + +Detected by clang scan-build: +"warning: Value stored to 'sg_table' during its initialization is +never read" + +Signed-off-by: Colin Ian King +Reviewed-by: Chris Wilson +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20170914230516.6056-1-colin.king@canonical.com +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma-buf/dma-buf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma-buf/dma-buf.c ++++ b/drivers/dma-buf/dma-buf.c +@@ -625,7 +625,7 @@ EXPORT_SYMBOL_GPL(dma_buf_detach); + struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach, + enum dma_data_direction direction) + { +- struct sg_table *sg_table = ERR_PTR(-EINVAL); ++ struct sg_table *sg_table; + + might_sleep(); + diff --git a/queue-4.14/drm-amd-powerplay-fix-enum-mismatch.patch b/queue-4.14/drm-amd-powerplay-fix-enum-mismatch.patch new file mode 100644 index 00000000000..ac3968cb951 --- /dev/null +++ b/queue-4.14/drm-amd-powerplay-fix-enum-mismatch.patch @@ -0,0 +1,74 @@ +From 42b5122e828a6ccd9952ad3116343dc032d33efe Mon Sep 17 00:00:00 2001 +From: Matthias Kaehlcke +Date: Wed, 7 Feb 2018 10:58:43 -0800 +Subject: drm/amd/powerplay: Fix enum mismatch + +From: Matthias Kaehlcke + +commit 42b5122e828a6ccd9952ad3116343dc032d33efe upstream. + +In several locations the driver uses AMD_CG_STATE_UNGATE (type enum +amd_clockgating_state) instead of AMD_PG_STATE_UNGATE (type enum +amd_powergating_stat) and vice versa. Both constants have the same +value, so this doesn't cause any problems, but we still want to pass +the correct type. + +Fixing the mismatch resolves multiple warnings like this when building +with clang: + +drivers/gpu/drm/amd/amdgpu/../powerplay/hwmgr/cz_clockpowergating.c:169:7: + error: implicit conversion from enumeration type 'enum + amd_powergating_state' to different enumeration type 'enum + amd_clockgating_state' [-Werror,-Wenum-conversion] + AMD_PG_STATE_UNGATE); + +Reviewed-by: Guenter Roeck +Signed-off-by: Matthias Kaehlcke +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c | 8 ++++---- + drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c +@@ -176,10 +176,10 @@ int cz_dpm_powergate_uvd(struct pp_hwmgr + cz_dpm_powerup_uvd(hwmgr); + cgs_set_clockgating_state(hwmgr->device, + AMD_IP_BLOCK_TYPE_UVD, +- AMD_PG_STATE_UNGATE); ++ AMD_CG_STATE_UNGATE); + cgs_set_powergating_state(hwmgr->device, + AMD_IP_BLOCK_TYPE_UVD, +- AMD_CG_STATE_UNGATE); ++ AMD_PG_STATE_UNGATE); + cz_dpm_update_uvd_dpm(hwmgr, false); + } + +@@ -208,11 +208,11 @@ int cz_dpm_powergate_vce(struct pp_hwmgr + cgs_set_clockgating_state( + hwmgr->device, + AMD_IP_BLOCK_TYPE_VCE, +- AMD_PG_STATE_UNGATE); ++ AMD_CG_STATE_UNGATE); + cgs_set_powergating_state( + hwmgr->device, + AMD_IP_BLOCK_TYPE_VCE, +- AMD_CG_STATE_UNGATE); ++ AMD_PG_STATE_UNGATE); + cz_dpm_update_vce_dpm(hwmgr); + cz_enable_disable_vce_dpm(hwmgr, true); + return 0; +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c +@@ -162,7 +162,7 @@ int smu7_powergate_uvd(struct pp_hwmgr * + AMD_CG_STATE_UNGATE); + cgs_set_powergating_state(hwmgr->device, + AMD_IP_BLOCK_TYPE_UVD, +- AMD_CG_STATE_UNGATE); ++ AMD_PG_STATE_UNGATE); + smu7_update_uvd_dpm(hwmgr, false); + } + diff --git a/queue-4.14/drm-i915-always-sanity-check-engine-state-upon-idling.patch b/queue-4.14/drm-i915-always-sanity-check-engine-state-upon-idling.patch new file mode 100644 index 00000000000..db60b180bd0 --- /dev/null +++ b/queue-4.14/drm-i915-always-sanity-check-engine-state-upon-idling.patch @@ -0,0 +1,92 @@ +From cad9946c2a4375386062131858881cfd30fc1b8f Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Sat, 26 Aug 2017 12:09:33 +0100 +Subject: drm/i915: Always sanity check engine state upon idling + +From: Chris Wilson + +commit cad9946c2a4375386062131858881cfd30fc1b8f upstream. + +When we do a locked idle we know that afterwards all requests have been +completed and the engines have been cleared of tasks. For whatever +reason, this doesn't always happen and we may go into a suspend with +ELSP still full, and this causes an issue upon resume as we get very, +very confused. + +If the engines refuse to idle, mark the device as wedged. In the process +we get rid of the maybe unused open-coded version of wait_for_engines +reported by Nick Desaulniers and Matthias Kaehlcke. + +v2: Suppress the -EIO before suspend, but keep it for seqno wrap. + +References: https://bugs.freedesktop.org/show_bug.cgi?id=101891 +References: https://bugs.freedesktop.org/show_bug.cgi?id=102456 +Signed-off-by: Chris Wilson +Cc: Mika Kuoppala +Cc: Joonas Lahtinen +Cc: Matthias Kaehlcke +Link: https://patchwork.freedesktop.org/patch/msgid/20170826110935.10237-1-chris@chris-wilson.co.uk +Reviewed-by: Joonas Lahtinen +Reviewed-by: Mika Kuoppala +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem.c | 27 ++++++++------------------- + 1 file changed, 8 insertions(+), 19 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -3378,24 +3378,12 @@ static int wait_for_timeline(struct i915 + return 0; + } + +-static int wait_for_engine(struct intel_engine_cs *engine, int timeout_ms) +-{ +- return wait_for(intel_engine_is_idle(engine), timeout_ms); +-} +- + static int wait_for_engines(struct drm_i915_private *i915) + { +- struct intel_engine_cs *engine; +- enum intel_engine_id id; +- +- for_each_engine(engine, i915, id) { +- if (GEM_WARN_ON(wait_for_engine(engine, 50))) { +- i915_gem_set_wedged(i915); +- return -EIO; +- } +- +- GEM_BUG_ON(intel_engine_get_seqno(engine) != +- intel_engine_last_submit(engine)); ++ if (wait_for(intel_engines_are_idle(i915), 50)) { ++ DRM_ERROR("Failed to idle engines, declaring wedged!\n"); ++ i915_gem_set_wedged(i915); ++ return -EIO; + } + + return 0; +@@ -4575,7 +4563,7 @@ int i915_gem_suspend(struct drm_i915_pri + ret = i915_gem_wait_for_idle(dev_priv, + I915_WAIT_INTERRUPTIBLE | + I915_WAIT_LOCKED); +- if (ret) ++ if (ret && ret != -EIO) + goto err_unlock; + + assert_kernel_context_is_current(dev_priv); +@@ -4619,11 +4607,12 @@ int i915_gem_suspend(struct drm_i915_pri + * machine in an unusable condition. + */ + i915_gem_sanitize(dev_priv); +- goto out_rpm_put; ++ ++ intel_runtime_pm_put(dev_priv); ++ return 0; + + err_unlock: + mutex_unlock(&dev->struct_mutex); +-out_rpm_put: + intel_runtime_pm_put(dev_priv); + return ret; + } diff --git a/queue-4.14/kbuild-clang-disable-unused-variable-warnings-only-when-constant.patch b/queue-4.14/kbuild-clang-disable-unused-variable-warnings-only-when-constant.patch new file mode 100644 index 00000000000..970e84f3606 --- /dev/null +++ b/queue-4.14/kbuild-clang-disable-unused-variable-warnings-only-when-constant.patch @@ -0,0 +1,50 @@ +From 0a5f41767444cc3b4fc5573921ab914b4f78baaa Mon Sep 17 00:00:00 2001 +From: Sodagudi Prasad +Date: Tue, 6 Feb 2018 15:46:51 -0800 +Subject: kbuild: clang: disable unused variable warnings only when constant + +From: Sodagudi Prasad + +commit 0a5f41767444cc3b4fc5573921ab914b4f78baaa upstream. + +Currently, GCC disables -Wunused-const-variable, but not +-Wunused-variable, so warns unused variables if they are +non-constant. + +While, Clang does not warn unused variables at all regardless of +the const qualifier because -Wno-unused-const-variable is implied +by the stronger option -Wno-unused-variable. + +Disable -Wunused-const-variable instead of -Wunused-variable so that +GCC and Clang work in the same way. + +Signed-off-by: Prasad Sodagudi +Signed-off-by: Masahiro Yamada +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + Makefile | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/Makefile ++++ b/Makefile +@@ -706,7 +706,6 @@ KBUILD_CFLAGS += $(stackp-flag) + + ifeq ($(cc-name),clang) + KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,) +-KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable) + KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier) + KBUILD_CFLAGS += $(call cc-disable-warning, gnu) + KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) +@@ -724,9 +723,9 @@ else + # These warnings generated too much noise in a regular build. + # Use make W=1 to enable them (see scripts/Makefile.extrawarn) + KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable) +-KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) + endif + ++KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) + ifdef CONFIG_FRAME_POINTER + KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls + else diff --git a/queue-4.14/kbuild-clang-remove-crufty-hostcflags.patch b/queue-4.14/kbuild-clang-remove-crufty-hostcflags.patch new file mode 100644 index 00000000000..9c21ad0cdc6 --- /dev/null +++ b/queue-4.14/kbuild-clang-remove-crufty-hostcflags.patch @@ -0,0 +1,45 @@ +From df16aaac26e92e97ab7234d3f93c953466adc4b5 Mon Sep 17 00:00:00 2001 +From: Nick Desaulniers +Date: Sat, 7 Oct 2017 13:23:23 -0700 +Subject: kbuild: clang: remove crufty HOSTCFLAGS + +From: Nick Desaulniers + +commit df16aaac26e92e97ab7234d3f93c953466adc4b5 upstream. + +When compiling with `make CC=clang HOSTCC=clang`, I was seeing warnings +that clang did not recognize -fno-delete-null-pointer-checks for HOSTCC +targets. These were added in commit 61163efae020 ("kbuild: LLVMLinux: +Add Kbuild support for building kernel with Clang"). + +Clang does not support -fno-delete-null-pointer-checks, so adding it to +HOSTCFLAGS if HOSTCC is clang does not make sense. + +It's not clear why the other warnings were disabled, and just for +HOSTCFLAGS, but I can remove them, add -Werror to HOSTCFLAGS and compile +with clang just fine. + +Suggested-by: Masahiro Yamada +Signed-off-by: Nick Desaulniers +Signed-off-by: Masahiro Yamada +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + Makefile | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/Makefile ++++ b/Makefile +@@ -369,11 +369,6 @@ HOSTCXXFLAGS := -O2 $(HOST_LFS_CFLAGS) + HOSTLDFLAGS := $(HOST_LFS_LDFLAGS) + HOST_LOADLIBES := $(HOST_LFS_LIBS) + +-ifeq ($(shell $(HOSTCC) -v 2>&1 | grep -c "clang version"), 1) +-HOSTCFLAGS += -Wno-unused-value -Wno-unused-parameter \ +- -Wno-missing-field-initializers -fno-delete-null-pointer-checks +-endif +- + # Make variables (CC, etc...) + AS = $(CROSS_COMPILE)as + LD = $(CROSS_COMPILE)ld diff --git a/queue-4.14/platform-chrome-cros_ec_lpc-remove-redundant-pointer-request.patch b/queue-4.14/platform-chrome-cros_ec_lpc-remove-redundant-pointer-request.patch new file mode 100644 index 00000000000..07da8c8344a --- /dev/null +++ b/queue-4.14/platform-chrome-cros_ec_lpc-remove-redundant-pointer-request.patch @@ -0,0 +1,43 @@ +From d3b56c566d4ba8cae688baf3cca94425d57ea783 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 31 Oct 2017 10:27:47 +0000 +Subject: platform/chrome: cros_ec_lpc: remove redundant pointer request + +From: Colin Ian King + +commit d3b56c566d4ba8cae688baf3cca94425d57ea783 upstream. + +Pointer request is being assigned but never used, so remove it. Cleans +up the clang warning: + +drivers/platform/chrome/cros_ec_lpc.c:68:2: warning: Value stored to +'request' is never read + +Signed-off-by: Colin Ian King +Signed-off-by: Benson Leung +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/chrome/cros_ec_lpc.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/platform/chrome/cros_ec_lpc.c ++++ b/drivers/platform/chrome/cros_ec_lpc.c +@@ -54,7 +54,6 @@ static int ec_response_timed_out(void) + static int cros_ec_pkt_xfer_lpc(struct cros_ec_device *ec, + struct cros_ec_command *msg) + { +- struct ec_host_request *request; + struct ec_host_response response; + u8 sum; + int ret = 0; +@@ -65,8 +64,6 @@ static int cros_ec_pkt_xfer_lpc(struct c + /* Write buffer */ + cros_ec_lpc_write_bytes(EC_LPC_ADDR_HOST_PACKET, ret, ec->dout); + +- request = (struct ec_host_request *)ec->dout; +- + /* Here we go */ + sum = EC_COMMAND_PROTOCOL_3; + cros_ec_lpc_write_bytes(EC_LPC_ADDR_HOST_CMD, 1, &sum); diff --git a/queue-4.14/rtlwifi-rtl8192cu-remove-variable-self-assignment-in-rf.c.patch b/queue-4.14/rtlwifi-rtl8192cu-remove-variable-self-assignment-in-rf.c.patch new file mode 100644 index 00000000000..70dfa15a225 --- /dev/null +++ b/queue-4.14/rtlwifi-rtl8192cu-remove-variable-self-assignment-in-rf.c.patch @@ -0,0 +1,44 @@ +From fb239c1209bb0f0b4830cc72507cc2f2d63fadbd Mon Sep 17 00:00:00 2001 +From: Matthias Kaehlcke +Date: Thu, 8 Feb 2018 16:57:12 -0800 +Subject: rtlwifi: rtl8192cu: Remove variable self-assignment in rf.c + +From: Matthias Kaehlcke + +commit fb239c1209bb0f0b4830cc72507cc2f2d63fadbd upstream. + +In _rtl92c_get_txpower_writeval_by_regulatory() the variable writeVal +is assigned to itself in an if ... else statement, apparently only to +document that the branch condition is handled and that a previously read +value should be returned unmodified. The self-assignment causes clang to +raise the following warning: + +drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c:304:13: + error: explicitly assigning value of variable of type 'u32' + (aka 'unsigned int') to itself [-Werror,-Wself-assign] + writeVal = writeVal; + +Delete the branch with the self-assignment. + +Signed-off-by: Matthias Kaehlcke +Acked-by: Larry Finger +Reviewed-by: Guenter Roeck +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c +@@ -299,9 +299,6 @@ static void _rtl92c_get_txpower_writeval + writeVal = 0x00000000; + if (rtlpriv->dm.dynamic_txhighpower_lvl == TXHIGHPWRLEVEL_BT1) + writeVal = writeVal - 0x06060606; +- else if (rtlpriv->dm.dynamic_txhighpower_lvl == +- TXHIGHPWRLEVEL_BT2) +- writeVal = writeVal; + *(p_outwriteval + rf) = writeVal; + } + } diff --git a/queue-4.14/series b/queue-4.14/series index f73eb4cfec3..30fbf98a601 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -17,3 +17,13 @@ input-elan_i2c_smbus-fix-corrupted-stack.patch tracing-fix-crash-when-freeing-instances-with-event-triggers.patch tracing-make-the-snapshot-trigger-work-with-instances.patch selinux-kasan-slab-out-of-bounds-in-xattr_getsecurity.patch +cfg80211-further-limit-wiphy-names-to-64-bytes.patch +kbuild-clang-remove-crufty-hostcflags.patch +drm-i915-always-sanity-check-engine-state-upon-idling.patch +dma-buf-remove-redundant-initialization-of-sg_table.patch +drm-amd-powerplay-fix-enum-mismatch.patch +rtlwifi-rtl8192cu-remove-variable-self-assignment-in-rf.c.patch +asoc-intel-sst-remove-redundant-variable-dma_dev_name.patch +platform-chrome-cros_ec_lpc-remove-redundant-pointer-request.patch +kbuild-clang-disable-unused-variable-warnings-only-when-constant.patch +tcp-avoid-integer-overflows-in-tcp_rcv_space_adjust.patch diff --git a/queue-4.14/tcp-avoid-integer-overflows-in-tcp_rcv_space_adjust.patch b/queue-4.14/tcp-avoid-integer-overflows-in-tcp_rcv_space_adjust.patch new file mode 100644 index 00000000000..88fd43297e4 --- /dev/null +++ b/queue-4.14/tcp-avoid-integer-overflows-in-tcp_rcv_space_adjust.patch @@ -0,0 +1,77 @@ +From 607065bad9931e72207b0cac365d7d4abc06bd99 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sun, 10 Dec 2017 17:55:03 -0800 +Subject: tcp: avoid integer overflows in tcp_rcv_space_adjust() + +From: Eric Dumazet + +commit 607065bad9931e72207b0cac365d7d4abc06bd99 upstream. + +When using large tcp_rmem[2] values (I did tests with 500 MB), +I noticed overflows while computing rcvwin. + +Lets fix this before the following patch. + +Signed-off-by: Eric Dumazet +Acked-by: Soheil Hassas Yeganeh +Acked-by: Wei Wang +Acked-by: Neal Cardwell +Signed-off-by: David S. Miller +[Backport: sysctl_tcp_rmem is not Namespace-ify'd in older kernels] +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/tcp.h | 2 +- + net/ipv4/tcp_input.c | 10 ++++++---- + 2 files changed, 7 insertions(+), 5 deletions(-) + +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -334,7 +334,7 @@ struct tcp_sock { + + /* Receiver queue space */ + struct { +- int space; ++ u32 space; + u32 seq; + u64 time; + } rcvq_space; +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -591,8 +591,8 @@ static inline void tcp_rcv_rtt_measure_t + void tcp_rcv_space_adjust(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); ++ u32 copied; + int time; +- int copied; + + tcp_mstamp_refresh(tp); + time = tcp_stamp_us_delta(tp->tcp_mstamp, tp->rcvq_space.time); +@@ -615,12 +615,13 @@ void tcp_rcv_space_adjust(struct sock *s + + if (sysctl_tcp_moderate_rcvbuf && + !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) { +- int rcvwin, rcvmem, rcvbuf; ++ int rcvmem, rcvbuf; ++ u64 rcvwin; + + /* minimal window to cope with packet losses, assuming + * steady state. Add some cushion because of small variations. + */ +- rcvwin = (copied << 1) + 16 * tp->advmss; ++ rcvwin = ((u64)copied << 1) + 16 * tp->advmss; + + /* If rate increased by 25%, + * assume slow start, rcvwin = 3 * copied +@@ -640,7 +641,8 @@ void tcp_rcv_space_adjust(struct sock *s + while (tcp_win_from_space(rcvmem) < tp->advmss) + rcvmem += 128; + +- rcvbuf = min(rcvwin / tp->advmss * rcvmem, sysctl_tcp_rmem[2]); ++ do_div(rcvwin, tp->advmss); ++ rcvbuf = min_t(u64, rcvwin * rcvmem, sysctl_tcp_rmem[2]); + if (rcvbuf > sk->sk_rcvbuf) { + sk->sk_rcvbuf = rcvbuf; +