diff options
author | Kevin Hilman <khilman@linaro.org> | 2015-12-10 07:19:16 -0800 |
---|---|---|
committer | Kevin Hilman <khilman@linaro.org> | 2015-12-10 07:19:16 -0800 |
commit | d235b7b42ab59e2e616082a0735b3bcc76685c7b (patch) | |
tree | 2b2275cd21df35e47b2ce4be5ccdce2d6d5e5fae /net | |
parent | de862fe2cd3432b1d1acb0b570a33dbdd02bf4a1 (diff) | |
parent | 03ed106ff4c200d01f3c72f71fa9c5b18da07d9b (diff) |
Merge tag 'v3.10.94' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into linux-linaro-lsk-v3.10lsk-v3.10-15.12linux-linaro-lsk-v3.10
This is the 3.10.94 stable release
# gpg: Signature made Wed Dec 9 10:43:26 2015 PST using RSA key ID 6092693E
# gpg: checking the trustdb
# gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
# gpg: depth: 0 valid: 1 signed: 72 trust: 0-, 0q, 0n, 0m, 0f, 1u
# gpg: depth: 1 valid: 72 signed: 112 trust: 63-, 1q, 0n, 1m, 7f, 0u
# gpg: depth: 2 valid: 49 signed: 64 trust: 49-, 0q, 0n, 0m, 0f, 0u
# gpg: next trustdb check due at 2015-12-15
# gpg: Good signature from "Greg Kroah-Hartman (Linux kernel stable release signing key) <greg@kroah.com>"
* tag 'v3.10.94' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (32 commits)
Linux 3.10.94
ALSA: usb-audio: work around CH345 input SysEx corruption
ALSA: usb-audio: prevent CH345 multiport output SysEx corruption
ALSA: usb-audio: add packet size quirk for the Medeli DD305
USB: option: add XS Stick W100-2 from 4G Systems
USB: serial: option: add support for Novatel MiFi USB620L
usb: musb: core: fix order of arguments to ulpi write callback
usblp: do not set TASK_INTERRUPTIBLE before lock
arm64: Fix compat register mappings
can: sja1000: clear interrupts on start
Bluetooth: hidp: fix device disconnect on idle timeout
staging: rtl8712: Add device ID for Sitecom WLA2100
mwifiex: fix mwifiex_rdeeprom_read()
net: mvneta: Fix CPU_MAP registers initialisation
mac80211: fix driver RSSI event calculations
x86/cpu: Fix SMAP check in PVOPS environments
x86/cpu: Call verify_cpu() after having entered long mode too
x86/setup: Fix low identity map for >= 2GB kernel range
x86/setup: Extend low identity map to cover whole kernel range
ARM: orion: Fix DSA platform device after mvmdio conversion
...
Diffstat (limited to 'net')
-rw-r--r-- | net/bluetooth/hidp/core.c | 14 | ||||
-rw-r--r-- | net/core/dst.c | 2 | ||||
-rw-r--r-- | net/ipv4/ipmr.c | 6 | ||||
-rw-r--r-- | net/irda/irlmp.c | 2 | ||||
-rw-r--r-- | net/mac80211/mlme.c | 2 | ||||
-rw-r--r-- | net/rds/connection.c | 6 | ||||
-rw-r--r-- | net/rds/tcp_recv.c | 11 |
7 files changed, 35 insertions, 8 deletions
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c index de030f50f72b..c60563394cd1 100644 --- a/net/bluetooth/hidp/core.c +++ b/net/bluetooth/hidp/core.c @@ -396,6 +396,20 @@ static void hidp_idle_timeout(unsigned long arg) { struct hidp_session *session = (struct hidp_session *) arg; + /* The HIDP user-space API only contains calls to add and remove + * devices. There is no way to forward events of any kind. Therefore, + * we have to forcefully disconnect a device on idle-timeouts. This is + * unfortunate and weird API design, but it is spec-compliant and + * required for backwards-compatibility. Hence, on idle-timeout, we + * signal driver-detach events, so poll() will be woken up with an + * error-condition on both sockets. + */ + + session->intr_sock->sk->sk_err = EUNATCH; + session->ctrl_sock->sk->sk_err = EUNATCH; + wake_up_interruptible(sk_sleep(session->intr_sock->sk)); + wake_up_interruptible(sk_sleep(session->ctrl_sock->sk)); + hidp_session_terminate(session); } diff --git a/net/core/dst.c b/net/core/dst.c index c0e021871df8..01f9980af86e 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -283,7 +283,7 @@ void dst_release(struct dst_entry *dst) newrefcnt = atomic_dec_return(&dst->__refcnt); WARN_ON(newrefcnt < 0); - if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) + if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) call_rcu(&dst->rcu_head, dst_destroy_rcu); } } diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index 56d079b63ad3..6f5f943ff395 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -1672,8 +1672,8 @@ static inline int ipmr_forward_finish(struct sk_buff *skb) { struct ip_options *opt = &(IPCB(skb)->opt); - IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); - IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); + IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); + IP_ADD_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); if (unlikely(opt->optlen)) ip_forward_options(skb); @@ -1735,7 +1735,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt, * to blackhole. */ - IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS); + IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS); ip_rt_put(rt); goto out_free; } diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c index 98ad6ec4bd3c..8ad149478e19 100644 --- a/net/irda/irlmp.c +++ b/net/irda/irlmp.c @@ -1876,7 +1876,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off) for (element = hashbin_get_first(iter->hashbin); element != NULL; element = hashbin_get_next(iter->hashbin)) { - if (!off || *off-- == 0) { + if (!off || (*off)-- == 0) { /* NB: hashbin left locked */ return element; } diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index e606e4a113e1..952cb336d704 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -3074,7 +3074,7 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold && ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) { - int sig = ifmgd->ave_beacon_signal; + int sig = ifmgd->ave_beacon_signal / 16; int last_sig = ifmgd->last_ave_beacon_signal; /* diff --git a/net/rds/connection.c b/net/rds/connection.c index 642ad42c416b..e88bf3976e54 100644 --- a/net/rds/connection.c +++ b/net/rds/connection.c @@ -177,6 +177,12 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr, } } + if (trans == NULL) { + kmem_cache_free(rds_conn_slab, conn); + conn = ERR_PTR(-ENODEV); + goto out; + } + conn->c_trans = trans; ret = trans->conn_alloc(conn, gfp); diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c index 4fac4f2bb9dc..8b33d9967b56 100644 --- a/net/rds/tcp_recv.c +++ b/net/rds/tcp_recv.c @@ -234,8 +234,15 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb, } to_copy = min(tc->t_tinc_data_rem, left); - pskb_pull(clone, offset); - pskb_trim(clone, to_copy); + if (!pskb_pull(clone, offset) || + pskb_trim(clone, to_copy)) { + pr_warn("rds_tcp_data_recv: pull/trim failed " + "left %zu data_rem %zu skb_len %d\n", + left, tc->t_tinc_data_rem, skb->len); + kfree_skb(clone); + desc->error = -ENOMEM; + goto out; + } skb_queue_tail(&tinc->ti_skb_list, clone); rdsdebug("skb %p data %p len %d off %u to_copy %zu -> " |