4 files changed, 66 insertions, 34 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 7cfcc1b8e101..7a638aa3545b 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -930,7 +930,7 @@ config LOCKDEP
         bool
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
         select STACKTRACE
-        select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 && !MICROBLAZE && !ARC
+        select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 && !MICROBLAZE && !ARC && !SCORE
         select KALLSYMS
         select KALLSYMS_ALL
 
@@ -1408,7 +1408,7 @@ config FAULT_INJECTION_STACKTRACE_FILTER
         depends on FAULT_INJECTION_DEBUG_FS && STACKTRACE_SUPPORT
         depends on !X86_64
         select STACKTRACE
-        select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC
+        select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC && !SCORE
         help
           Provide stacktrace filter for fault-injection capabilities
 
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index df6839e3ce08..b74da447e81e 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                         len = *ip++;
                         for (; len == 255; length += 255)
                                 len = *ip++;
+                        if (unlikely(length > (size_t)(length + len)))
+                                goto _output_error;
                         length += len;
                 }
 
@@ -106,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                 if (length == ML_MASK) {
                         for (; *ip == 255; length += 255)
                                 ip++;
+                        if (unlikely(length > (size_t)(length + *ip)))
+                                goto _output_error;
                         length += *ip++;
                 }
 
@@ -155,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
 
         /* write overflow error detected */
 _output_error:
-        return (int) (-(((char *)ip) - source));
+        return -1;
 }
 
 static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
index 569985d522d5..8563081e8da3 100644
--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -19,11 +19,31 @@
 #include <linux/lzo.h>
 #include "lzodefs.h"
 
-#define HAVE_IP(x)      ((size_t)(ip_end - ip) >= (size_t)(x))
-#define HAVE_OP(x)      ((size_t)(op_end - op) >= (size_t)(x))
-#define NEED_IP(x)      if (!HAVE_IP(x)) goto input_overrun
-#define NEED_OP(x)      if (!HAVE_OP(x)) goto output_overrun
-#define TEST_LB(m_pos)  if ((m_pos) < out) goto lookbehind_overrun
+#define HAVE_IP(t, x)                                   \
+        (((size_t)(ip_end - ip) >= (size_t)(t + x)) &&  \
+         (((t + x) >= t) && ((t + x) >= x)))
+
+#define HAVE_OP(t, x)                                   \
+        (((size_t)(op_end - op) >= (size_t)(t + x)) &&  \
+         (((t + x) >= t) && ((t + x) >= x)))
+
+#define NEED_IP(t, x)                                   \
+        do {                                            \
+                if (!HAVE_IP(t, x))                     \
+                        goto input_overrun;             \
+        } while (0)
+
+#define NEED_OP(t, x)                                   \
+        do {                                            \
+                if (!HAVE_OP(t, x))                     \
+                        goto output_overrun;            \
+        } while (0)
+
+#define TEST_LB(m_pos)                                  \
+        do {                                            \
+                if ((m_pos) < out)                      \
+                        goto lookbehind_overrun;        \
+        } while (0)
 
 int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
                           unsigned char *out, size_t *out_len)
@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
                                         while (unlikely(*ip == 0)) {
                                                 t += 255;
                                                 ip++;
-                                                NEED_IP(1);
+                                                NEED_IP(1, 0);
                                         }
                                         t += 15 + *ip++;
                                 }
                                 t += 3;
 copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-                                if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
+                                if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
                                         const unsigned char *ie = ip + t;
                                         unsigned char *oe = op + t;
                                         do {
@@ -81,8 +101,8 @@ copy_literal_run:
                                 } else
 #endif
                                 {
-                                        NEED_OP(t);
-                                        NEED_IP(t + 3);
+                                        NEED_OP(t, 0);
+                                        NEED_IP(t, 3);
                                         do {
                                                 *op++ = *ip++;
                                         } while (--t > 0);
@@ -95,7 +115,7 @@ copy_literal_run:
                                 m_pos -= t >> 2;
                                 m_pos -= *ip++ << 2;
                                 TEST_LB(m_pos);
-                                NEED_OP(2);
+                                NEED_OP(2, 0);
                                 op[0] = m_pos[0];
                                 op[1] = m_pos[1];
                                 op += 2;
@@ -119,10 +139,10 @@ copy_literal_run:
                                 while (unlikely(*ip == 0)) {
                                         t += 255;
                                         ip++;
-                                        NEED_IP(1);
+                                        NEED_IP(1, 0);
                                 }
                                 t += 31 + *ip++;
-                                NEED_IP(2);
+                                NEED_IP(2, 0);
                         }
                         m_pos = op - 1;
                         next = get_unaligned_le16(ip);
@@ -137,10 +157,10 @@ copy_literal_run:
                                 while (unlikely(*ip == 0)) {
                                         t += 255;
                                         ip++;
-                                        NEED_IP(1);
+                                        NEED_IP(1, 0);
                                 }
                                 t += 7 + *ip++;
-                                NEED_IP(2);
+                                NEED_IP(2, 0);
                         }
                         next = get_unaligned_le16(ip);
                         ip += 2;
@@ -154,7 +174,7 @@ copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
                 if (op - m_pos >= 8) {
                         unsigned char *oe = op + t;
-                        if (likely(HAVE_OP(t + 15))) {
+                        if (likely(HAVE_OP(t, 15))) {
                                 do {
                                         COPY8(op, m_pos);
                                         op += 8;
@@ -164,7 +184,7 @@ copy_literal_run:
                                         m_pos += 8;
                                 } while (op < oe);
                                 op = oe;
-                                if (HAVE_IP(6)) {
+                                if (HAVE_IP(6, 0)) {
                                         state = next;
                                         COPY4(op, ip);
                                         op += next;
@@ -172,7 +192,7 @@ copy_literal_run:
                                         continue;
                                 }
                         } else {
-                                NEED_OP(t);
+                                NEED_OP(t, 0);
                                 do {
                                         *op++ = *m_pos++;
                                 } while (op < oe);
@@ -181,7 +201,7 @@ copy_literal_run:
 #endif
                 {
                         unsigned char *oe = op + t;
-                        NEED_OP(t);
+                        NEED_OP(t, 0);
                         op[0] = m_pos[0];
                         op[1] = m_pos[1];
                         op += 2;
@@ -194,15 +214,15 @@ match_next:
                 state = next;
                 t = next;
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-                if (likely(HAVE_IP(6) && HAVE_OP(4))) {
+                if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
                         COPY4(op, ip);
                         op += t;
                         ip += t;
                 } else
 #endif
                 {
-                        NEED_IP(t + 3);
-                        NEED_OP(t);
+                        NEED_IP(t, 3);
+                        NEED_OP(t, 0);
                         while (t > 0) {
                                 *op++ = *ip++;
                                 t--;
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 649d097853a1..4abda074ea45 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -86,6 +86,7 @@ static unsigned int io_tlb_index;
  * We need to save away the original address corresponding to a mapped entry
  * for the sync operations.
  */
+#define INVALID_PHYS_ADDR (~(phys_addr_t)0)
 static phys_addr_t *io_tlb_orig_addr;
 
 /*
@@ -188,12 +189,14 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
         io_tlb_list = memblock_virt_alloc(
                                 PAGE_ALIGN(io_tlb_nslabs * sizeof(int)),
                                 PAGE_SIZE);
-        for (i = 0; i < io_tlb_nslabs; i++)
-                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
-        io_tlb_index = 0;
         io_tlb_orig_addr = memblock_virt_alloc(
                                 PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)),
                                 PAGE_SIZE);
+        for (i = 0; i < io_tlb_nslabs; i++) {
+                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
+                io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+        }
+        io_tlb_index = 0;
 
         if (verbose)
                 swiotlb_print_info();
@@ -313,10 +316,6 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!io_tlb_list)
                 goto cleanup3;
 
-        for (i = 0; i < io_tlb_nslabs; i++)
-                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
-        io_tlb_index = 0;
-
         io_tlb_orig_addr = (phys_addr_t *)
                 __get_free_pages(GFP_KERNEL,
                                  get_order(io_tlb_nslabs *
@@ -324,7 +323,11 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!io_tlb_orig_addr)
                 goto cleanup4;
 
-        memset(io_tlb_orig_addr, 0, io_tlb_nslabs * sizeof(phys_addr_t));
+        for (i = 0; i < io_tlb_nslabs; i++) {
+                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
+                io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+        }
+        io_tlb_index = 0;
 
         swiotlb_print_info();
 
@@ -556,7 +559,8 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr,
         /*
          * First, sync the memory before unmapping the entry
          */
-        if (orig_addr && ((dir == DMA_FROM_DEVICE) || (dir == DMA_BIDIRECTIONAL)))
+        if (orig_addr != INVALID_PHYS_ADDR &&
+            ((dir == DMA_FROM_DEVICE) || (dir == DMA_BIDIRECTIONAL)))
                 swiotlb_bounce(orig_addr, tlb_addr, size, DMA_FROM_DEVICE);
 
         /*
@@ -573,8 +577,10 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr,
                  * Step 1: return the slots to the free list, merging the
                  * slots with superceeding slots
                  */
-                for (i = index + nslots - 1; i >= index; i--)
+                for (i = index + nslots - 1; i >= index; i--) {
                         io_tlb_list[i] = ++count;
+                        io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+                }
                 /*
                  * Step 2: merge the returned slots with the preceding slots,
                  * if available (non zero)
@@ -593,6 +599,8 @@ void swiotlb_tbl_sync_single(struct device *hwdev, phys_addr_t tlb_addr,
         int index = (tlb_addr - io_tlb_start) >> IO_TLB_SHIFT;
         phys_addr_t orig_addr = io_tlb_orig_addr[index];
 
+        if (orig_addr == INVALID_PHYS_ADDR)
+                return;
         orig_addr += (unsigned long)tlb_addr & ((1 << IO_TLB_SHIFT) - 1);
 
         switch (target) {