4 files changed, 86 insertions, 13 deletions

diff --git a/lib/cpumask.c b/lib/cpumask.c
index c101230658eb..b6513a9f2892 100644
--- a/lib/cpumask.c
+++ b/lib/cpumask.c
@@ -191,7 +191,7 @@ int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp)
 
         i %= num_online_cpus();
 
-        if (!cpumask_of_node(numa_node)) {
+        if (numa_node == -1 || !cpumask_of_node(numa_node)) {
                 /* Use all online cpu's for non numa aware system */
                 cpumask_copy(mask, cpu_online_mask);
         } else {
diff --git a/lib/iovec.c b/lib/iovec.c
index 454baa88bf27..df3abd1eaa4a 100644
--- a/lib/iovec.c
+++ b/lib/iovec.c
@@ -51,3 +51,62 @@ int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len)
         return 0;
 }
 EXPORT_SYMBOL(memcpy_toiovec);
+
+/*
+ *      Copy kernel to iovec. Returns -EFAULT on error.
+ */
+
+int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
+                      int offset, int len)
+{
+        int copy;
+        for (; len > 0; ++iov) {
+                /* Skip over the finished iovecs */
+                if (unlikely(offset >= iov->iov_len)) {
+                        offset -= iov->iov_len;
+                        continue;
+                }
+                copy = min_t(unsigned int, iov->iov_len - offset, len);
+                if (copy_to_user(iov->iov_base + offset, kdata, copy))
+                        return -EFAULT;
+                offset = 0;
+                kdata += copy;
+                len -= copy;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(memcpy_toiovecend);
+
+/*
+ *      Copy iovec to kernel. Returns -EFAULT on error.
+ */
+
+int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                        int offset, int len)
+{
+        /* No data? Done! */
+        if (len == 0)
+                return 0;
+
+        /* Skip over the finished iovecs */
+        while (offset >= iov->iov_len) {
+                offset -= iov->iov_len;
+                iov++;
+        }
+
+        while (len > 0) {
+                u8 __user *base = iov->iov_base + offset;
+                int copy = min_t(unsigned int, len, iov->iov_len - offset);
+
+                offset = 0;
+                if (copy_from_user(kdata, base, copy))
+                        return -EFAULT;
+                len -= copy;
+                kdata += copy;
+                iov++;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(memcpy_fromiovecend);
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 99a03acb7d47..7a85967060a5 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                 if (length == ML_MASK) {
                         for (; *ip == 255; length += 255)
                                 ip++;
+                        if (unlikely(length > (size_t)(length + *ip)))
+                                goto _output_error;
                         length += *ip++;
                 }
 
@@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
 
         /* write overflow error detected */
 _output_error:
-        return (int) (-(((char *)ip) - source));
+        return -1;
 }
 
 static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
@@ -190,6 +192,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
                         int s = 255;
                         while ((ip < iend) && (s == 255)) {
                                 s = *ip++;
+                                if (unlikely(length > (size_t)(length + s)))
+                                        goto _output_error;
                                 length += s;
                         }
                 }
@@ -230,6 +234,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
                 if (length == ML_MASK) {
                         while (ip < iend) {
                                 int s = *ip++;
+                                if (unlikely(length > (size_t)(length + s)))
+                                        goto _output_error;
                                 length += s;
                                 if (s == 255)
                                         continue;
@@ -282,7 +288,7 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
 
         /* write overflow error detected */
 _output_error:
-        return (int) (-(((char *) ip) - source));
+        return -1;
 }
 
 int lz4_decompress(const unsigned char *src, size_t *src_len,
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 649d097853a1..4abda074ea45 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -86,6 +86,7 @@ static unsigned int io_tlb_index;
  * We need to save away the original address corresponding to a mapped entry
  * for the sync operations.
  */
+#define INVALID_PHYS_ADDR (~(phys_addr_t)0)
 static phys_addr_t *io_tlb_orig_addr;
 
 /*
@@ -188,12 +189,14 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
         io_tlb_list = memblock_virt_alloc(
                                 PAGE_ALIGN(io_tlb_nslabs * sizeof(int)),
                                 PAGE_SIZE);
-        for (i = 0; i < io_tlb_nslabs; i++)
-                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
-        io_tlb_index = 0;
         io_tlb_orig_addr = memblock_virt_alloc(
                                 PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)),
                                 PAGE_SIZE);
+        for (i = 0; i < io_tlb_nslabs; i++) {
+                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
+                io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+        }
+        io_tlb_index = 0;
 
         if (verbose)
                 swiotlb_print_info();
@@ -313,10 +316,6 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!io_tlb_list)
                 goto cleanup3;
 
-        for (i = 0; i < io_tlb_nslabs; i++)
-                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
-        io_tlb_index = 0;
-
         io_tlb_orig_addr = (phys_addr_t *)
                 __get_free_pages(GFP_KERNEL,
                                  get_order(io_tlb_nslabs *
@@ -324,7 +323,11 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!io_tlb_orig_addr)
                 goto cleanup4;
 
-        memset(io_tlb_orig_addr, 0, io_tlb_nslabs * sizeof(phys_addr_t));
+        for (i = 0; i < io_tlb_nslabs; i++) {
+                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
+                io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+        }
+        io_tlb_index = 0;
 
         swiotlb_print_info();
 
@@ -556,7 +559,8 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr,
         /*
          * First, sync the memory before unmapping the entry
          */
-        if (orig_addr && ((dir == DMA_FROM_DEVICE) || (dir == DMA_BIDIRECTIONAL)))
+        if (orig_addr != INVALID_PHYS_ADDR &&
+            ((dir == DMA_FROM_DEVICE) || (dir == DMA_BIDIRECTIONAL)))
                 swiotlb_bounce(orig_addr, tlb_addr, size, DMA_FROM_DEVICE);
 
         /*
@@ -573,8 +577,10 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr,
                  * Step 1: return the slots to the free list, merging the
                  * slots with superceeding slots
                  */
-                for (i = index + nslots - 1; i >= index; i--)
+                for (i = index + nslots - 1; i >= index; i--) {
                         io_tlb_list[i] = ++count;
+                        io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+                }
                 /*
                  * Step 2: merge the returned slots with the preceding slots,
                  * if available (non zero)
@@ -593,6 +599,8 @@ void swiotlb_tbl_sync_single(struct device *hwdev, phys_addr_t tlb_addr,
         int index = (tlb_addr - io_tlb_start) >> IO_TLB_SHIFT;
         phys_addr_t orig_addr = io_tlb_orig_addr[index];
 
+        if (orig_addr == INVALID_PHYS_ADDR)
+                return;
         orig_addr += (unsigned long)tlb_addr & ((1 << IO_TLB_SHIFT) - 1);
 
         switch (target) {