5 files changed, 93 insertions, 63 deletions

diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index 155c55d8db5f..4e53be8bc590 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -598,21 +598,31 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit,
                 if ((edit->segment_cache[ASSOC_ARRAY_FAN_OUT] ^ base_seg) == 0)
                         goto all_leaves_cluster_together;
 
-                /* Otherwise we can just insert a new node ahead of the old
-                 * one.
+                /* Otherwise all the old leaves cluster in the same slot, but
+                 * the new leaf wants to go into a different slot - so we
+                 * create a new node (n0) to hold the new leaf and a pointer to
+                 * a new node (n1) holding all the old leaves.
+                 *
+                 * This can be done by falling through to the node splitting
+                 * path.
                  */
-                goto present_leaves_cluster_but_not_new_leaf;
+                pr_devel("present leaves cluster but not new leaf\n");
         }
 
 split_node:
         pr_devel("split node\n");
 
-        /* We need to split the current node; we know that the node doesn't
-         * simply contain a full set of leaves that cluster together (it
-         * contains meta pointers and/or non-clustering leaves).
+        /* We need to split the current node.  The node must contain anything
+         * from a single leaf (in the one leaf case, this leaf will cluster
+         * with the new leaf) and the rest meta-pointers, to all leaves, some
+         * of which may cluster.
+         *
+         * It won't contain the case in which all the current leaves plus the
+         * new leaves want to cluster in the same slot.
          *
          * We need to expel at least two leaves out of a set consisting of the
-         * leaves in the node and the new leaf.
+         * leaves in the node and the new leaf.  The current meta pointers can
+         * just be copied as they shouldn't cluster with any of the leaves.
          *
          * We need a new node (n0) to replace the current one and a new node to
          * take the expelled nodes (n1).
@@ -717,33 +727,6 @@ found_slot_for_multiple_occupancy:
         pr_devel("<--%s() = ok [split node]\n", __func__);
         return true;
 
-present_leaves_cluster_but_not_new_leaf:
-        /* All the old leaves cluster in the same slot, but the new leaf wants
-         * to go into a different slot, so we create a new node to hold the new
-         * leaf and a pointer to a new node holding all the old leaves.
-         */
-        pr_devel("present leaves cluster but not new leaf\n");
-
-        new_n0->back_pointer = node->back_pointer;
-        new_n0->parent_slot = node->parent_slot;
-        new_n0->nr_leaves_on_branch = node->nr_leaves_on_branch;
-        new_n1->back_pointer = assoc_array_node_to_ptr(new_n0);
-        new_n1->parent_slot = edit->segment_cache[0];
-        new_n1->nr_leaves_on_branch = node->nr_leaves_on_branch;
-        edit->adjust_count_on = new_n0;
-
-        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++)
-                new_n1->slots[i] = node->slots[i];
-
-        new_n0->slots[edit->segment_cache[0]] = assoc_array_node_to_ptr(new_n0);
-        edit->leaf_p = &new_n0->slots[edit->segment_cache[ASSOC_ARRAY_FAN_OUT]];
-
-        edit->set[0].ptr = &assoc_array_ptr_to_node(node->back_pointer)->slots[node->parent_slot];
-        edit->set[0].to = assoc_array_node_to_ptr(new_n0);
-        edit->excised_meta[0] = assoc_array_node_to_ptr(node);
-        pr_devel("<--%s() = ok [insert node before]\n", __func__);
-        return true;
-
 all_leaves_cluster_together:
         /* All the leaves, new and old, want to cluster together in this node
          * in the same slot, so we have to replace this node with a shortcut to
diff --git a/lib/digsig.c b/lib/digsig.c
index 03d7c63837ae..6ba6fcd92dd1 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -87,6 +87,12 @@ static int digsig_verify_rsa(struct key *key,
         down_read(&key->sem);
         ukp = user_key_payload_locked(key);
 
+        if (!ukp) {
+                /* key was revoked before we acquired its semaphore */
+                err = -EKEYREVOKED;
+                goto err1;
+        }
+
         if (ukp->datalen < sizeof(*pkh))
                 goto err1;
 
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index be7b4dd6b68d..7c1c55f7daaa 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -370,41 +370,49 @@ int sg_alloc_table(struct sg_table *table, unsigned int nents, gfp_t gfp_mask)
 EXPORT_SYMBOL(sg_alloc_table);
 
 /**
- * sg_alloc_table_from_pages - Allocate and initialize an sg table from
- *                             an array of pages
- * @sgt:        The sg table header to use
- * @pages:      Pointer to an array of page pointers
- * @n_pages:    Number of pages in the pages array
- * @offset:     Offset from start of the first page to the start of a buffer
- * @size:       Number of valid bytes in the buffer (after offset)
- * @gfp_mask:   GFP allocation mask
+ * __sg_alloc_table_from_pages - Allocate and initialize an sg table from
+ *                               an array of pages
+ * @sgt:         The sg table header to use
+ * @pages:       Pointer to an array of page pointers
+ * @n_pages:     Number of pages in the pages array
+ * @offset:      Offset from start of the first page to the start of a buffer
+ * @size:        Number of valid bytes in the buffer (after offset)
+ * @max_segment: Maximum size of a scatterlist node in bytes (page aligned)
+ * @gfp_mask:    GFP allocation mask
  *
  *  Description:
  *    Allocate and initialize an sg table from a list of pages. Contiguous
- *    ranges of the pages are squashed into a single scatterlist node. A user
- *    may provide an offset at a start and a size of valid data in a buffer
- *    specified by the page array. The returned sg table is released by
- *    sg_free_table.
+ *    ranges of the pages are squashed into a single scatterlist node up to the
+ *    maximum size specified in @max_segment. An user may provide an offset at a
+ *    start and a size of valid data in a buffer specified by the page array.
+ *    The returned sg table is released by sg_free_table.
  *
  * Returns:
  *   0 on success, negative error on failure
  */
-int sg_alloc_table_from_pages(struct sg_table *sgt,
-        struct page **pages, unsigned int n_pages,
-        unsigned long offset, unsigned long size,
-        gfp_t gfp_mask)
+int __sg_alloc_table_from_pages(struct sg_table *sgt, struct page **pages,
+                                unsigned int n_pages, unsigned int offset,
+                                unsigned long size, unsigned int max_segment,
+                                gfp_t gfp_mask)
 {
-        unsigned int chunks;
-        unsigned int i;
-        unsigned int cur_page;
+        unsigned int chunks, cur_page, seg_len, i;
         int ret;
         struct scatterlist *s;
 
+        if (WARN_ON(!max_segment || offset_in_page(max_segment)))
+                return -EINVAL;
+
         /* compute number of contiguous chunks */
         chunks = 1;
-        for (i = 1; i < n_pages; ++i)
-                if (page_to_pfn(pages[i]) != page_to_pfn(pages[i - 1]) + 1)
-                        ++chunks;
+        seg_len = 0;
+        for (i = 1; i < n_pages; i++) {
+                seg_len += PAGE_SIZE;
+                if (seg_len >= max_segment ||
+                    page_to_pfn(pages[i]) != page_to_pfn(pages[i - 1]) + 1) {
+                        chunks++;
+                        seg_len = 0;
+                }
+        }
 
         ret = sg_alloc_table(sgt, chunks, gfp_mask);
         if (unlikely(ret))
@@ -413,17 +421,21 @@ int sg_alloc_table_from_pages(struct sg_table *sgt,
         /* merging chunks and putting them into the scatterlist */
         cur_page = 0;
         for_each_sg(sgt->sgl, s, sgt->orig_nents, i) {
-                unsigned long chunk_size;
-                unsigned int j;
+                unsigned int j, chunk_size;
 
                 /* look for the end of the current chunk */
-                for (j = cur_page + 1; j < n_pages; ++j)
-                        if (page_to_pfn(pages[j]) !=
+                seg_len = 0;
+                for (j = cur_page + 1; j < n_pages; j++) {
+                        seg_len += PAGE_SIZE;
+                        if (seg_len >= max_segment ||
+                            page_to_pfn(pages[j]) !=
                             page_to_pfn(pages[j - 1]) + 1)
                                 break;
+                }
 
                 chunk_size = ((j - cur_page) << PAGE_SHIFT) - offset;
-                sg_set_page(s, pages[cur_page], min(size, chunk_size), offset);
+                sg_set_page(s, pages[cur_page],
+                            min_t(unsigned long, size, chunk_size), offset);
                 size -= chunk_size;
                 offset = 0;
                 cur_page = j;
@@ -431,6 +443,35 @@ int sg_alloc_table_from_pages(struct sg_table *sgt,
 
         return 0;
 }
+EXPORT_SYMBOL(__sg_alloc_table_from_pages);
+
+/**
+ * sg_alloc_table_from_pages - Allocate and initialize an sg table from
+ *                             an array of pages
+ * @sgt:         The sg table header to use
+ * @pages:       Pointer to an array of page pointers
+ * @n_pages:     Number of pages in the pages array
+ * @offset:      Offset from start of the first page to the start of a buffer
+ * @size:        Number of valid bytes in the buffer (after offset)
+ * @gfp_mask:    GFP allocation mask
+ *
+ *  Description:
+ *    Allocate and initialize an sg table from a list of pages. Contiguous
+ *    ranges of the pages are squashed into a single scatterlist node. A user
+ *    may provide an offset at a start and a size of valid data in a buffer
+ *    specified by the page array. The returned sg table is released by
+ *    sg_free_table.
+ *
+ * Returns:
+ *   0 on success, negative error on failure
+ */
+int sg_alloc_table_from_pages(struct sg_table *sgt, struct page **pages,
+                              unsigned int n_pages, unsigned int offset,
+                              unsigned long size, gfp_t gfp_mask)
+{
+        return __sg_alloc_table_from_pages(sgt, pages, n_pages, offset, size,
+                                           SCATTERLIST_MAX_SEGMENT, gfp_mask);
+}
 EXPORT_SYMBOL(sg_alloc_table_from_pages);
 
 void __sg_page_iter_start(struct sg_page_iter *piter,
diff --git a/lib/ts_fsm.c b/lib/ts_fsm.c
index 5696a35184e4..69557c74ef9f 100644
--- a/lib/ts_fsm.c
+++ b/lib/ts_fsm.c
@@ -11,7 +11,7 @@
  * ==========================================================================
  *
  *   A finite state machine consists of n states (struct ts_fsm_token)
- *   representing the pattern as a finite automation. The data is read
+ *   representing the pattern as a finite automaton. The data is read
  *   sequentially on an octet basis. Every state token specifies the number
  *   of recurrences and the type of value accepted which can be either a
  *   specific character or ctype based set of characters. The available
diff --git a/lib/ts_kmp.c b/lib/ts_kmp.c
index 632f783e65f1..ffbe66cbb0ed 100644
--- a/lib/ts_kmp.c
+++ b/lib/ts_kmp.c
@@ -27,7 +27,7 @@
  *
  *   [1] Cormen, Leiserson, Rivest, Stein
  *       Introdcution to Algorithms, 2nd Edition, MIT Press
- *   [2] See finite automation theory
+ *   [2] See finite automaton theory
  */
 
 #include <linux/module.h>