diff --git a/config/kernel/linux-odroidxu4-current.config b/config/kernel/linux-odroidxu4-current.config index 838ec624a0..9e5c83d0f9 100644 --- a/config/kernel/linux-odroidxu4-current.config +++ b/config/kernel/linux-odroidxu4-current.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.4.138 Kernel Configuration +# Linux/arm 5.4.144 Kernel Configuration # # @@ -4165,6 +4165,20 @@ CONFIG_DRM_ANALOGIX_DP=y # CONFIG_DRM_LEGACY is not set CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y +# +# ARM GPU Configuration +# +CONFIG_MALI_MIDGARD=m +# CONFIG_MALI_GATOR_SUPPORT is not set +# CONFIG_MALI_MIDGARD_DVFS is not set +# CONFIG_MALI_MIDGARD_ENABLE_TRACE is not set +# CONFIG_MALI_DEVFREQ is not set +# CONFIG_MALI_DMA_FENCE is not set +CONFIG_MALI_PLATFORM_NAME="devicetree" +# CONFIG_MALI_EXPERT is not set +CONFIG_MALI_KUTF=m +# end of ARM GPU Configuration + # # Frame buffer Devices # diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.142-143.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.142-143.patch new file mode 100644 index 0000000000..1936cbdca1 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.142-143.patch @@ -0,0 +1,2381 @@ +diff --git a/Makefile b/Makefile +index ef3adc6ccb871..e99fabc4dfc8c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 142 ++SUBLEVEL = 143 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index a9f191d78b544..d0ea95830d454 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -589,7 +589,7 @@ + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&i2c0_pins>; +- clock-frequency = <400000>; ++ clock-frequency = <100000>; + + tps65218: tps65218@24 { + reg = <0x24>; +diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi +index f78b4eabd68c2..e7178a6db6bef 100644 +--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi ++++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi +@@ -755,14 +755,14 @@ + status = "disabled"; + }; + +- vica: intc@10140000 { ++ vica: interrupt-controller@10140000 { + compatible = "arm,versatile-vic"; + interrupt-controller; + #interrupt-cells = <1>; + reg = <0x10140000 0x20>; + }; + +- vicb: intc@10140020 { ++ vicb: interrupt-controller@10140020 { + compatible = "arm,versatile-vic"; + interrupt-controller; + #interrupt-cells = <1>; +diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h +index a9d1dd82d8208..03b3de491b5e6 100644 +--- a/arch/x86/include/asm/fpu/internal.h ++++ b/arch/x86/include/asm/fpu/internal.h +@@ -204,6 +204,14 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) + asm volatile("fxsaveq %[fx]" : [fx] "=m" (fpu->state.fxsave)); + } + ++static inline void fxsave(struct fxregs_state *fx) ++{ ++ if (IS_ENABLED(CONFIG_X86_32)) ++ asm volatile( "fxsave %[fx]" : [fx] "=m" (*fx)); ++ else ++ asm volatile("fxsaveq %[fx]" : [fx] "=m" (*fx)); ++} ++ + /* These macros all use (%edi)/(%rdi) as the single memory argument. */ + #define XSAVE ".byte " REX_PREFIX "0x0f,0xae,0x27" + #define XSAVEOPT ".byte " REX_PREFIX "0x0f,0xae,0x37" +@@ -272,28 +280,6 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) + : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \ + : "memory") + +-/* +- * This function is called only during boot time when x86 caps are not set +- * up and alternative can not be used yet. +- */ +-static inline void copy_xregs_to_kernel_booting(struct xregs_state *xstate) +-{ +- u64 mask = -1; +- u32 lmask = mask; +- u32 hmask = mask >> 32; +- int err; +- +- WARN_ON(system_state != SYSTEM_BOOTING); +- +- if (boot_cpu_has(X86_FEATURE_XSAVES)) +- XSTATE_OP(XSAVES, xstate, lmask, hmask, err); +- else +- XSTATE_OP(XSAVE, xstate, lmask, hmask, err); +- +- /* We should never fault when copying to a kernel buffer: */ +- WARN_ON_FPU(err); +-} +- + /* + * This function is called only during boot time when x86 caps are not set + * up and alternative can not be used yet. +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index 735d1f1bbabc7..046782df37a6d 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -398,6 +398,24 @@ static void __init print_xstate_offset_size(void) + } + } + ++/* ++ * All supported features have either init state all zeros or are ++ * handled in setup_init_fpu() individually. This is an explicit ++ * feature list and does not use XFEATURE_MASK*SUPPORTED to catch ++ * newly added supported features at build time and make people ++ * actually look at the init state for the new feature. ++ */ ++#define XFEATURES_INIT_FPSTATE_HANDLED \ ++ (XFEATURE_MASK_FP | \ ++ XFEATURE_MASK_SSE | \ ++ XFEATURE_MASK_YMM | \ ++ XFEATURE_MASK_OPMASK | \ ++ XFEATURE_MASK_ZMM_Hi256 | \ ++ XFEATURE_MASK_Hi16_ZMM | \ ++ XFEATURE_MASK_PKRU | \ ++ XFEATURE_MASK_BNDREGS | \ ++ XFEATURE_MASK_BNDCSR) ++ + /* + * setup the xstate image representing the init state + */ +@@ -405,6 +423,8 @@ static void __init setup_init_fpu_buf(void) + { + static int on_boot_cpu __initdata = 1; + ++ BUILD_BUG_ON(XCNTXT_MASK != XFEATURES_INIT_FPSTATE_HANDLED); ++ + WARN_ON_FPU(!on_boot_cpu); + on_boot_cpu = 0; + +@@ -423,10 +443,22 @@ static void __init setup_init_fpu_buf(void) + copy_kernel_to_xregs_booting(&init_fpstate.xsave); + + /* +- * Dump the init state again. This is to identify the init state +- * of any feature which is not represented by all zero's. ++ * All components are now in init state. Read the state back so ++ * that init_fpstate contains all non-zero init state. This only ++ * works with XSAVE, but not with XSAVEOPT and XSAVES because ++ * those use the init optimization which skips writing data for ++ * components in init state. ++ * ++ * XSAVE could be used, but that would require to reshuffle the ++ * data when XSAVES is available because XSAVES uses xstate ++ * compaction. But doing so is a pointless exercise because most ++ * components have an all zeros init state except for the legacy ++ * ones (FP and SSE). Those can be saved with FXSAVE into the ++ * legacy area. Adding new features requires to ensure that init ++ * state is all zeroes or if not to add the necessary handling ++ * here. + */ +- copy_xregs_to_kernel_booting(&init_fpstate.xsave); ++ fxsave(&init_fpstate.fxsave); + } + + static int xfeature_uncompacted_offset(int xfeature_nr) +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index e4782f562e7a9..2de7fd18f66a1 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -102,7 +102,11 @@ struct armada_37xx_dvfs { + }; + + static struct armada_37xx_dvfs armada_37xx_dvfs[] = { +- {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, ++ /* ++ * The cpufreq scaling for 1.2 GHz variant of the SOC is currently ++ * unstable because we do not know how to configure it properly. ++ */ ++ /* {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, */ + {.cpu_freq_max = 1000*1000*1000, .divider = {1, 2, 4, 5} }, + {.cpu_freq_max = 800*1000*1000, .divider = {1, 2, 3, 4} }, + {.cpu_freq_max = 600*1000*1000, .divider = {2, 4, 5, 6} }, +diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c +index 4bbf4172b9bf9..e3f1d4ab8e4f3 100644 +--- a/drivers/dma/of-dma.c ++++ b/drivers/dma/of-dma.c +@@ -65,8 +65,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, + return NULL; + + ofdma_target = of_dma_find_controller(&dma_spec_target); +- if (!ofdma_target) +- return NULL; ++ if (!ofdma_target) { ++ ofdma->dma_router->route_free(ofdma->dma_router->dev, ++ route_data); ++ chan = ERR_PTR(-EPROBE_DEFER); ++ goto err; ++ } + + chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); + if (IS_ERR_OR_NULL(chan)) { +@@ -77,6 +81,7 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, + chan->route_data = route_data; + } + ++err: + /* + * Need to put the node back since the ofdma->of_dma_route_allocate + * has taken it for generating the new, translated dma_spec +diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c +index 8f7ceb698226c..1cc06900153e4 100644 +--- a/drivers/dma/sh/usb-dmac.c ++++ b/drivers/dma/sh/usb-dmac.c +@@ -855,8 +855,8 @@ static int usb_dmac_probe(struct platform_device *pdev) + + error: + of_dma_controller_free(pdev->dev.of_node); +- pm_runtime_put(&pdev->dev); + error_pm: ++ pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + return ret; + } +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 1b5f3e9f43d70..ce18bca45ff27 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -333,6 +333,7 @@ struct xilinx_dma_tx_descriptor { + * @genlock: Support genlock mode + * @err: Channel has errors + * @idle: Check for channel idle ++ * @terminating: Check for channel being synchronized by user + * @tasklet: Cleanup work after irq + * @config: Device configuration info + * @flush_on_fsync: Flush on Frame sync +@@ -370,6 +371,7 @@ struct xilinx_dma_chan { + bool genlock; + bool err; + bool idle; ++ bool terminating; + struct tasklet_struct tasklet; + struct xilinx_vdma_config config; + bool flush_on_fsync; +@@ -844,6 +846,13 @@ static void xilinx_dma_chan_desc_cleanup(struct xilinx_dma_chan *chan) + /* Run any dependencies, then free the descriptor */ + dma_run_dependencies(&desc->async_tx); + xilinx_dma_free_tx_descriptor(chan, desc); ++ ++ /* ++ * While we ran a callback the user called a terminate function, ++ * which takes care of cleaning up any remaining descriptors ++ */ ++ if (chan->terminating) ++ break; + } + + spin_unlock_irqrestore(&chan->lock, flags); +@@ -1618,6 +1627,8 @@ static dma_cookie_t xilinx_dma_tx_submit(struct dma_async_tx_descriptor *tx) + if (desc->cyclic) + chan->cyclic = true; + ++ chan->terminating = false; ++ + spin_unlock_irqrestore(&chan->lock, flags); + + return cookie; +@@ -2074,6 +2085,7 @@ static int xilinx_dma_terminate_all(struct dma_chan *dchan) + } + + /* Remove and free all of the descriptors in the lists */ ++ chan->terminating = true; + xilinx_dma_free_descriptors(chan); + chan->idle = true; + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c +index 8d5cfd5357c75..03e2073339539 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c +@@ -362,7 +362,7 @@ void optc2_lock_doublebuffer_enable(struct timing_generator *optc) + + REG_UPDATE_2(OTG_GLOBAL_CONTROL1, + MASTER_UPDATE_LOCK_DB_X, +- h_blank_start - 200 - 1, ++ (h_blank_start - 200 - 1) / optc1->opp_count, + MASTER_UPDATE_LOCK_DB_Y, + v_blank_start - 1); + } +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 9d7232e26ecf0..c5758fb696cc8 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -775,6 +775,9 @@ void iommu_group_remove_device(struct device *dev) + struct iommu_group *group = dev->iommu_group; + struct group_device *tmp_device, *device = NULL; + ++ if (!group) ++ return; ++ + dev_info(dev, "Removing from iommu group %d\n", group->id); + + /* Pre-notify listeners that a device is being removed. */ +diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c +index b05d6125c787a..46665b1cef85a 100644 +--- a/drivers/ipack/carriers/tpci200.c ++++ b/drivers/ipack/carriers/tpci200.c +@@ -91,16 +91,13 @@ static void tpci200_unregister(struct tpci200_board *tpci200) + free_irq(tpci200->info->pdev->irq, (void *) tpci200); + + pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs); +- pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); + + pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR); + pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR); + pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR); + pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR); +- pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR); + + pci_disable_device(tpci200->info->pdev); +- pci_dev_put(tpci200->info->pdev); + } + + static void tpci200_enable_irq(struct tpci200_board *tpci200, +@@ -259,7 +256,7 @@ static int tpci200_register(struct tpci200_board *tpci200) + "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 2 !", + tpci200->info->pdev->bus->number, + tpci200->info->pdev->devfn); +- goto out_disable_pci; ++ goto err_disable_device; + } + + /* Request IO ID INT space (Bar 3) */ +@@ -271,7 +268,7 @@ static int tpci200_register(struct tpci200_board *tpci200) + "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 3 !", + tpci200->info->pdev->bus->number, + tpci200->info->pdev->devfn); +- goto out_release_ip_space; ++ goto err_ip_interface_bar; + } + + /* Request MEM8 space (Bar 5) */ +@@ -282,7 +279,7 @@ static int tpci200_register(struct tpci200_board *tpci200) + "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 5!", + tpci200->info->pdev->bus->number, + tpci200->info->pdev->devfn); +- goto out_release_ioid_int_space; ++ goto err_io_id_int_spaces_bar; + } + + /* Request MEM16 space (Bar 4) */ +@@ -293,7 +290,7 @@ static int tpci200_register(struct tpci200_board *tpci200) + "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 4!", + tpci200->info->pdev->bus->number, + tpci200->info->pdev->devfn); +- goto out_release_mem8_space; ++ goto err_mem8_space_bar; + } + + /* Map internal tpci200 driver user space */ +@@ -307,7 +304,7 @@ static int tpci200_register(struct tpci200_board *tpci200) + tpci200->info->pdev->bus->number, + tpci200->info->pdev->devfn); + res = -ENOMEM; +- goto out_release_mem8_space; ++ goto err_mem16_space_bar; + } + + /* Initialize lock that protects interface_regs */ +@@ -346,18 +343,22 @@ static int tpci200_register(struct tpci200_board *tpci200) + "(bn 0x%X, sn 0x%X) unable to register IRQ !", + tpci200->info->pdev->bus->number, + tpci200->info->pdev->devfn); +- goto out_release_ioid_int_space; ++ goto err_interface_regs; + } + + return 0; + +-out_release_mem8_space: ++err_interface_regs: ++ pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs); ++err_mem16_space_bar: ++ pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR); ++err_mem8_space_bar: + pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR); +-out_release_ioid_int_space: ++err_io_id_int_spaces_bar: + pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR); +-out_release_ip_space: ++err_ip_interface_bar: + pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR); +-out_disable_pci: ++err_disable_device: + pci_disable_device(tpci200->info->pdev); + return res; + } +@@ -529,7 +530,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + tpci200->info = kzalloc(sizeof(struct tpci200_infos), GFP_KERNEL); + if (!tpci200->info) { + ret = -ENOMEM; +- goto out_err_info; ++ goto err_tpci200; + } + + pci_dev_get(pdev); +@@ -540,7 +541,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + if (ret) { + dev_err(&pdev->dev, "Failed to allocate PCI Configuration Memory"); + ret = -EBUSY; +- goto out_err_pci_request; ++ goto err_tpci200_info; + } + tpci200->info->cfg_regs = ioremap_nocache( + pci_resource_start(pdev, TPCI200_CFG_MEM_BAR), +@@ -548,7 +549,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + if (!tpci200->info->cfg_regs) { + dev_err(&pdev->dev, "Failed to map PCI Configuration Memory"); + ret = -EFAULT; +- goto out_err_ioremap; ++ goto err_request_region; + } + + /* Disable byte swapping for 16 bit IP module access. This will ensure +@@ -571,7 +572,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + if (ret) { + dev_err(&pdev->dev, "error during tpci200 install\n"); + ret = -ENODEV; +- goto out_err_install; ++ goto err_cfg_regs; + } + + /* Register the carrier in the industry pack bus driver */ +@@ -583,7 +584,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, + "error registering the carrier on ipack driver\n"); + ret = -EFAULT; +- goto out_err_bus_register; ++ goto err_tpci200_install; + } + + /* save the bus number given by ipack to logging purpose */ +@@ -594,19 +595,16 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + tpci200_create_device(tpci200, i); + return 0; + +-out_err_bus_register: ++err_tpci200_install: + tpci200_uninstall(tpci200); +- /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */ +- tpci200->info->cfg_regs = NULL; +-out_err_install: +- if (tpci200->info->cfg_regs) +- iounmap(tpci200->info->cfg_regs); +-out_err_ioremap: ++err_cfg_regs: ++ pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); ++err_request_region: + pci_release_region(pdev, TPCI200_CFG_MEM_BAR); +-out_err_pci_request: +- pci_dev_put(pdev); ++err_tpci200_info: + kfree(tpci200->info); +-out_err_info: ++ pci_dev_put(pdev); ++err_tpci200: + kfree(tpci200); + return ret; + } +@@ -616,6 +614,12 @@ static void __tpci200_pci_remove(struct tpci200_board *tpci200) + ipack_bus_unregister(tpci200->info->ipack_bus); + tpci200_uninstall(tpci200); + ++ pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); ++ ++ pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR); ++ ++ pci_dev_put(tpci200->info->pdev); ++ + kfree(tpci200->info); + kfree(tpci200); + } +diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c +index 02458c9cb5dc0..25f16ff6dcc75 100644 +--- a/drivers/media/usb/zr364xx/zr364xx.c ++++ b/drivers/media/usb/zr364xx/zr364xx.c +@@ -1187,15 +1187,11 @@ out: + return err; + } + +-static void zr364xx_release(struct v4l2_device *v4l2_dev) ++static void zr364xx_board_uninit(struct zr364xx_camera *cam) + { +- struct zr364xx_camera *cam = +- container_of(v4l2_dev, struct zr364xx_camera, v4l2_dev); + unsigned long i; + +- v4l2_device_unregister(&cam->v4l2_dev); +- +- videobuf_mmap_free(&cam->vb_vidq); ++ zr364xx_stop_readpipe(cam); + + /* release sys buffers */ + for (i = 0; i < FRAMES; i++) { +@@ -1206,9 +1202,19 @@ static void zr364xx_release(struct v4l2_device *v4l2_dev) + cam->buffer.frame[i].lpvbits = NULL; + } + +- v4l2_ctrl_handler_free(&cam->ctrl_handler); + /* release transfer buffer */ + kfree(cam->pipe->transfer_buffer); ++} ++ ++static void zr364xx_release(struct v4l2_device *v4l2_dev) ++{ ++ struct zr364xx_camera *cam = ++ container_of(v4l2_dev, struct zr364xx_camera, v4l2_dev); ++ ++ videobuf_mmap_free(&cam->vb_vidq); ++ v4l2_ctrl_handler_free(&cam->ctrl_handler); ++ zr364xx_board_uninit(cam); ++ v4l2_device_unregister(&cam->v4l2_dev); + kfree(cam); + } + +@@ -1331,6 +1337,7 @@ static int zr364xx_board_init(struct zr364xx_camera *cam) + { + struct zr364xx_pipeinfo *pipe = cam->pipe; + unsigned long i; ++ int err; + + DBG("board init: %p\n", cam); + memset(pipe, 0, sizeof(*pipe)); +@@ -1363,9 +1370,8 @@ static int zr364xx_board_init(struct zr364xx_camera *cam) + + if (i == 0) { + printk(KERN_INFO KBUILD_MODNAME ": out of memory. Aborting\n"); +- kfree(cam->pipe->transfer_buffer); +- cam->pipe->transfer_buffer = NULL; +- return -ENOMEM; ++ err = -ENOMEM; ++ goto err_free; + } else + cam->buffer.dwFrames = i; + +@@ -1380,9 +1386,20 @@ static int zr364xx_board_init(struct zr364xx_camera *cam) + /*** end create system buffers ***/ + + /* start read pipe */ +- zr364xx_start_readpipe(cam); ++ err = zr364xx_start_readpipe(cam); ++ if (err) ++ goto err_free_frames; ++ + DBG(": board initialized\n"); + return 0; ++ ++err_free_frames: ++ for (i = 0; i < FRAMES; i++) ++ vfree(cam->buffer.frame[i].lpvbits); ++err_free: ++ kfree(cam->pipe->transfer_buffer); ++ cam->pipe->transfer_buffer = NULL; ++ return err; + } + + static int zr364xx_probe(struct usb_interface *intf, +@@ -1407,12 +1424,10 @@ static int zr364xx_probe(struct usb_interface *intf, + if (!cam) + return -ENOMEM; + +- cam->v4l2_dev.release = zr364xx_release; + err = v4l2_device_register(&intf->dev, &cam->v4l2_dev); + if (err < 0) { + dev_err(&udev->dev, "couldn't register v4l2_device\n"); +- kfree(cam); +- return err; ++ goto free_cam; + } + hdl = &cam->ctrl_handler; + v4l2_ctrl_handler_init(hdl, 1); +@@ -1421,7 +1436,7 @@ static int zr364xx_probe(struct usb_interface *intf, + if (hdl->error) { + err = hdl->error; + dev_err(&udev->dev, "couldn't register control\n"); +- goto fail; ++ goto free_hdlr_and_unreg_dev; + } + /* save the init method used by this camera */ + cam->method = id->driver_info; +@@ -1494,7 +1509,7 @@ static int zr364xx_probe(struct usb_interface *intf, + if (!cam->read_endpoint) { + err = -ENOMEM; + dev_err(&intf->dev, "Could not find bulk-in endpoint\n"); +- goto fail; ++ goto free_hdlr_and_unreg_dev; + } + + /* v4l */ +@@ -1505,10 +1520,11 @@ static int zr364xx_probe(struct usb_interface *intf, + + /* load zr364xx board specific */ + err = zr364xx_board_init(cam); +- if (!err) +- err = v4l2_ctrl_handler_setup(hdl); + if (err) +- goto fail; ++ goto free_hdlr_and_unreg_dev; ++ err = v4l2_ctrl_handler_setup(hdl); ++ if (err) ++ goto board_uninit; + + spin_lock_init(&cam->slock); + +@@ -1523,16 +1539,20 @@ static int zr364xx_probe(struct usb_interface *intf, + err = video_register_device(&cam->vdev, VFL_TYPE_GRABBER, -1); + if (err) { + dev_err(&udev->dev, "video_register_device failed\n"); +- goto fail; ++ goto board_uninit; + } ++ cam->v4l2_dev.release = zr364xx_release; + + dev_info(&udev->dev, DRIVER_DESC " controlling device %s\n", + video_device_node_name(&cam->vdev)); + return 0; + +-fail: ++board_uninit: ++ zr364xx_board_uninit(cam); ++free_hdlr_and_unreg_dev: + v4l2_ctrl_handler_free(hdl); + v4l2_device_unregister(&cam->v4l2_dev); ++free_cam: + kfree(cam); + return err; + } +@@ -1579,10 +1599,19 @@ static int zr364xx_resume(struct usb_interface *intf) + if (!cam->was_streaming) + return 0; + +- zr364xx_start_readpipe(cam); ++ res = zr364xx_start_readpipe(cam); ++ if (res) ++ return res; ++ + res = zr364xx_prepare(cam); +- if (!res) +- zr364xx_start_acquire(cam); ++ if (res) ++ goto err_prepare; ++ ++ zr364xx_start_acquire(cam); ++ return 0; ++ ++err_prepare: ++ zr364xx_stop_readpipe(cam); + return res; + } + #endif +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index 79c55c7b4afd9..6ace82028667b 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -2017,8 +2017,8 @@ static void dw_mci_tasklet_func(unsigned long priv) + continue; + } + +- dw_mci_stop_dma(host); + send_stop_abort(host, data); ++ dw_mci_stop_dma(host); + state = STATE_SENDING_STOP; + break; + } +@@ -2042,10 +2042,10 @@ static void dw_mci_tasklet_func(unsigned long priv) + */ + if (test_and_clear_bit(EVENT_DATA_ERROR, + &host->pending_events)) { +- dw_mci_stop_dma(host); + if (!(host->data_status & (SDMMC_INT_DRTO | + SDMMC_INT_EBE))) + send_stop_abort(host, data); ++ dw_mci_stop_dma(host); + state = STATE_DATA_ERROR; + break; + } +@@ -2078,10 +2078,10 @@ static void dw_mci_tasklet_func(unsigned long priv) + */ + if (test_and_clear_bit(EVENT_DATA_ERROR, + &host->pending_events)) { +- dw_mci_stop_dma(host); + if (!(host->data_status & (SDMMC_INT_DRTO | + SDMMC_INT_EBE))) + send_stop_abort(host, data); ++ dw_mci_stop_dma(host); + state = STATE_DATA_ERROR; + break; + } +diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c +index c8b9ab40a1027..9c98ddef0097d 100644 +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -119,7 +119,7 @@ static int cfi_use_status_reg(struct cfi_private *cfi) + struct cfi_pri_amdstd *extp = cfi->cmdset_priv; + u8 poll_mask = CFI_POLL_STATUS_REG | CFI_POLL_DQ; + +- return extp->MinorVersion >= '5' && ++ return extp && extp->MinorVersion >= '5' && + (extp->SoftwareFeatures & poll_mask) == CFI_POLL_STATUS_REG; + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 287ea792922a9..e67f07faca789 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -360,6 +360,26 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb) + return md_dst->u.port_info.port_id; + } + ++static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, ++ struct bnxt_tx_ring_info *txr, ++ struct netdev_queue *txq) ++{ ++ netif_tx_stop_queue(txq); ++ ++ /* netif_tx_stop_queue() must be done before checking ++ * tx index in bnxt_tx_avail() below, because in ++ * bnxt_tx_int(), we update tx index before checking for ++ * netif_tx_queue_stopped(). ++ */ ++ smp_mb(); ++ if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) { ++ netif_tx_wake_queue(txq); ++ return false; ++ } ++ ++ return true; ++} ++ + static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bnxt *bp = netdev_priv(dev); +@@ -387,8 +407,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + free_size = bnxt_tx_avail(bp, txr); + if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) { +- netif_tx_stop_queue(txq); +- return NETDEV_TX_BUSY; ++ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq)) ++ return NETDEV_TX_BUSY; + } + + length = skb->len; +@@ -597,16 +617,7 @@ tx_done: + if (netdev_xmit_more() && !tx_buf->is_push) + bnxt_db_write(bp, &txr->tx_db, prod); + +- netif_tx_stop_queue(txq); +- +- /* netif_tx_stop_queue() must be done before checking +- * tx index in bnxt_tx_avail() below, because in +- * bnxt_tx_int(), we update tx index before checking for +- * netif_tx_queue_stopped(). +- */ +- smp_mb(); +- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) +- netif_tx_wake_queue(txq); ++ bnxt_txr_netif_try_stop_queue(bp, txr, txq); + } + return NETDEV_TX_OK; + +@@ -690,14 +701,9 @@ next_tx_int: + smp_mb(); + + if (unlikely(netif_tx_queue_stopped(txq)) && +- (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) { +- __netif_tx_lock(txq, smp_processor_id()); +- if (netif_tx_queue_stopped(txq) && +- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && +- txr->dev_state != BNXT_DEV_STATE_CLOSING) +- netif_tx_wake_queue(txq); +- __netif_tx_unlock(txq); +- } ++ bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && ++ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING) ++ netif_tx_wake_queue(txq); + } + + static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, +@@ -1718,6 +1724,10 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons)) + return -EBUSY; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + prod = rxr->rx_prod; + + if (cmp_type == CMP_TYPE_RX_L2_TPA_START_CMP) { +@@ -1912,6 +1922,10 @@ static int bnxt_force_rx_discard(struct bnxt *bp, + if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons)) + return -EBUSY; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + cmp_type = RX_CMP_TYPE(rxcmp); + if (cmp_type == CMP_TYPE_RX_L2_CMP) { + rxcmp1->rx_cmp_cfa_code_errors_v2 |= +@@ -2308,6 +2322,10 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget) + if (!TX_CMP_VALID(txcmp, raw_cons)) + break; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) { + tmp_raw_cons = NEXT_RAW_CMP(raw_cons); + cp_cons = RING_CMP(tmp_raw_cons); +@@ -8340,10 +8358,9 @@ static void bnxt_disable_napi(struct bnxt *bp) + for (i = 0; i < bp->cp_nr_rings; i++) { + struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring; + ++ napi_disable(&bp->bnapi[i]->napi); + if (bp->bnapi[i]->rx_ring) + cancel_work_sync(&cpr->dim.work); +- +- napi_disable(&bp->bnapi[i]->napi); + } + } + +@@ -8371,9 +8388,11 @@ void bnxt_tx_disable(struct bnxt *bp) + if (bp->tx_ring) { + for (i = 0; i < bp->tx_nr_rings; i++) { + txr = &bp->tx_ring[i]; +- txr->dev_state = BNXT_DEV_STATE_CLOSING; ++ WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING); + } + } ++ /* Make sure napi polls see @dev_state change */ ++ synchronize_net(); + /* Drop carrier first to prevent TX timeout */ + netif_carrier_off(bp->dev); + /* Stop all TX queues */ +@@ -8387,8 +8406,10 @@ void bnxt_tx_enable(struct bnxt *bp) + + for (i = 0; i < bp->tx_nr_rings; i++) { + txr = &bp->tx_ring[i]; +- txr->dev_state = 0; ++ WRITE_ONCE(txr->dev_state, 0); + } ++ /* Make sure napi polls see @dev_state change */ ++ synchronize_net(); + netif_tx_wake_all_queues(bp->dev); + if (bp->link_info.link_up) + netif_carrier_on(bp->dev); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 8e38c547b53f9..06987913837aa 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -3553,8 +3553,7 @@ u16 i40e_lan_select_queue(struct net_device *netdev, + + /* is DCB enabled at all? */ + if (vsi->tc_config.numtc == 1) +- return i40e_swdcb_skb_tx_hash(netdev, skb, +- netdev->real_num_tx_queues); ++ return netdev_pick_tx(netdev, skb, sb_dev); + + prio = skb->priority; + hw = &vsi->back->hw; +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index 6b9117a350fac..81ca6472937d2 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -134,6 +134,7 @@ struct iavf_q_vector { + struct iavf_mac_filter { + struct list_head list; + u8 macaddr[ETH_ALEN]; ++ bool is_new_mac; /* filter is new, wait for PF decision */ + bool remove; /* filter needs to be removed */ + bool add; /* filter needs to be added */ + }; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index dc902e371c2cf..94a3f000e999b 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -761,6 +761,7 @@ struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter, + + list_add_tail(&f->list, &adapter->mac_filter_list); + f->add = true; ++ f->is_new_mac = true; + adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER; + } else { + f->remove = false; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 9655318803b71..4d471a6f2946f 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -564,6 +564,47 @@ void iavf_del_ether_addrs(struct iavf_adapter *adapter) + kfree(veal); + } + ++/** ++ * iavf_mac_add_ok ++ * @adapter: adapter structure ++ * ++ * Submit list of filters based on PF response. ++ **/ ++static void iavf_mac_add_ok(struct iavf_adapter *adapter) ++{ ++ struct iavf_mac_filter *f, *ftmp; ++ ++ spin_lock_bh(&adapter->mac_vlan_list_lock); ++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) { ++ f->is_new_mac = false; ++ } ++ spin_unlock_bh(&adapter->mac_vlan_list_lock); ++} ++ ++/** ++ * iavf_mac_add_reject ++ * @adapter: adapter structure ++ * ++ * Remove filters from list based on PF response. ++ **/ ++static void iavf_mac_add_reject(struct iavf_adapter *adapter) ++{ ++ struct net_device *netdev = adapter->netdev; ++ struct iavf_mac_filter *f, *ftmp; ++ ++ spin_lock_bh(&adapter->mac_vlan_list_lock); ++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) { ++ if (f->remove && ether_addr_equal(f->macaddr, netdev->dev_addr)) ++ f->remove = false; ++ ++ if (f->is_new_mac) { ++ list_del(&f->list); ++ kfree(f); ++ } ++ } ++ spin_unlock_bh(&adapter->mac_vlan_list_lock); ++} ++ + /** + * iavf_add_vlans + * @adapter: adapter structure +@@ -1316,6 +1357,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + case VIRTCHNL_OP_ADD_ETH_ADDR: + dev_err(&adapter->pdev->dev, "Failed to add MAC filter, error %s\n", + iavf_stat_str(&adapter->hw, v_retval)); ++ iavf_mac_add_reject(adapter); + /* restore administratively set MAC address */ + ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr); + break; +@@ -1385,10 +1427,11 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + } + } + switch (v_opcode) { +- case VIRTCHNL_OP_ADD_ETH_ADDR: { ++ case VIRTCHNL_OP_ADD_ETH_ADDR: ++ if (!v_retval) ++ iavf_mac_add_ok(adapter); + if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr)) + ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr); +- } + break; + case VIRTCHNL_OP_GET_STATS: { + struct iavf_eth_stats *stats = +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index 29b9c728a65e2..f2014c10f7c97 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -3158,8 +3158,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr, + + indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr); + ret = QLCRD32(adapter, indirect_addr, &err); +- if (err == -EIO) ++ if (err == -EIO) { ++ qlcnic_83xx_unlock_flash(adapter); + return err; ++ } + + word = ret; + *(u32 *)p_data = word; +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index 71d6629e65c97..da13683d52d1a 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -839,6 +839,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte) + return; + } + ++ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) { ++ pr_err("6pack: cooked buffer overrun, data loss\n"); ++ sp->rx_count = 0; ++ return; ++ } ++ + buf = sp->raw_buf; + sp->cooked_buf[sp->rx_count_cooked++] = + buf[0] | ((buf[1] << 2) & 0xc0); +diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c +index 6a1d3540210bd..ccb3ee704eb1c 100644 +--- a/drivers/net/phy/mdio-mux.c ++++ b/drivers/net/phy/mdio-mux.c +@@ -82,6 +82,17 @@ out: + + static int parent_count; + ++static void mdio_mux_uninit_children(struct mdio_mux_parent_bus *pb) ++{ ++ struct mdio_mux_child_bus *cb = pb->children; ++ ++ while (cb) { ++ mdiobus_unregister(cb->mii_bus); ++ mdiobus_free(cb->mii_bus); ++ cb = cb->next; ++ } ++} ++ + int mdio_mux_init(struct device *dev, + struct device_node *mux_node, + int (*switch_fn)(int cur, int desired, void *data), +@@ -144,7 +155,7 @@ int mdio_mux_init(struct device *dev, + cb = devm_kzalloc(dev, sizeof(*cb), GFP_KERNEL); + if (!cb) { + ret_val = -ENOMEM; +- continue; ++ goto err_loop; + } + cb->bus_number = v; + cb->parent = pb; +@@ -152,8 +163,7 @@ int mdio_mux_init(struct device *dev, + cb->mii_bus = mdiobus_alloc(); + if (!cb->mii_bus) { + ret_val = -ENOMEM; +- devm_kfree(dev, cb); +- continue; ++ goto err_loop; + } + cb->mii_bus->priv = cb; + +@@ -165,11 +175,15 @@ int mdio_mux_init(struct device *dev, + cb->mii_bus->write = mdio_mux_write; + r = of_mdiobus_register(cb->mii_bus, child_bus_node); + if (r) { ++ mdiobus_free(cb->mii_bus); ++ if (r == -EPROBE_DEFER) { ++ ret_val = r; ++ goto err_loop; ++ } ++ devm_kfree(dev, cb); + dev_err(dev, + "Error: Failed to register MDIO bus for child %pOF\n", + child_bus_node); +- mdiobus_free(cb->mii_bus); +- devm_kfree(dev, cb); + } else { + cb->next = pb->children; + pb->children = cb; +@@ -182,6 +196,10 @@ int mdio_mux_init(struct device *dev, + + dev_err(dev, "Error: No acceptable child buses found\n"); + devm_kfree(dev, pb); ++ ++err_loop: ++ mdio_mux_uninit_children(pb); ++ of_node_put(child_bus_node); + err_pb_kz: + put_device(&parent_bus->dev); + err_parent_bus: +@@ -193,14 +211,8 @@ EXPORT_SYMBOL_GPL(mdio_mux_init); + void mdio_mux_uninit(void *mux_handle) + { + struct mdio_mux_parent_bus *pb = mux_handle; +- struct mdio_mux_child_bus *cb = pb->children; +- +- while (cb) { +- mdiobus_unregister(cb->mii_bus); +- mdiobus_free(cb->mii_bus); +- cb = cb->next; +- } + ++ mdio_mux_uninit_children(pb); + put_device(&pb->mii_bus->dev); + } + EXPORT_SYMBOL_GPL(mdio_mux_uninit); +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 71cc5b63d8ced..92d9d3407b79b 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1159,7 +1159,7 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) + { + struct phy_device *phydev = dev->net->phydev; + struct ethtool_link_ksettings ecmd; +- int ladv, radv, ret; ++ int ladv, radv, ret, link; + u32 buf; + + /* clear LAN78xx interrupt status */ +@@ -1167,9 +1167,12 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) + if (unlikely(ret < 0)) + return -EIO; + ++ mutex_lock(&phydev->lock); + phy_read_status(phydev); ++ link = phydev->link; ++ mutex_unlock(&phydev->lock); + +- if (!phydev->link && dev->link_on) { ++ if (!link && dev->link_on) { + dev->link_on = false; + + /* reset MAC */ +@@ -1182,7 +1185,7 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) + return -EIO; + + del_timer(&dev->stat_monitor); +- } else if (phydev->link && !dev->link_on) { ++ } else if (link && !dev->link_on) { + dev->link_on = true; + + phy_ethtool_ksettings_get(phydev, &ecmd); +@@ -1471,9 +1474,14 @@ static int lan78xx_set_eee(struct net_device *net, struct ethtool_eee *edata) + + static u32 lan78xx_get_link(struct net_device *net) + { ++ u32 link; ++ ++ mutex_lock(&net->phydev->lock); + phy_read_status(net->phydev); ++ link = net->phydev->link; ++ mutex_unlock(&net->phydev->lock); + +- return net->phydev->link; ++ return link; + } + + static void lan78xx_get_drvinfo(struct net_device *net, +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 15453d6fcc232..37c2cecd1e503 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -63,7 +63,7 @@ static const unsigned long guest_offloads[] = { + VIRTIO_NET_F_GUEST_CSUM + }; + +-#define GUEST_OFFLOAD_LRO_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \ ++#define GUEST_OFFLOAD_GRO_HW_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \ + (1ULL << VIRTIO_NET_F_GUEST_TSO6) | \ + (1ULL << VIRTIO_NET_F_GUEST_ECN) | \ + (1ULL << VIRTIO_NET_F_GUEST_UFO)) +@@ -195,6 +195,9 @@ struct virtnet_info { + /* # of XDP queue pairs currently used by the driver */ + u16 xdp_queue_pairs; + ++ /* xdp_queue_pairs may be 0, when xdp is already loaded. So add this. */ ++ bool xdp_enabled; ++ + /* I like... big packets and I cannot lie! */ + bool big_packets; + +@@ -485,12 +488,41 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi, + return 0; + } + +-static struct send_queue *virtnet_xdp_sq(struct virtnet_info *vi) +-{ +- unsigned int qp; +- +- qp = vi->curr_queue_pairs - vi->xdp_queue_pairs + smp_processor_id(); +- return &vi->sq[qp]; ++/* when vi->curr_queue_pairs > nr_cpu_ids, the txq/sq is only used for xdp tx on ++ * the current cpu, so it does not need to be locked. ++ * ++ * Here we use marco instead of inline functions because we have to deal with ++ * three issues at the same time: 1. the choice of sq. 2. judge and execute the ++ * lock/unlock of txq 3. make sparse happy. It is difficult for two inline ++ * functions to perfectly solve these three problems at the same time. ++ */ ++#define virtnet_xdp_get_sq(vi) ({ \ ++ struct netdev_queue *txq; \ ++ typeof(vi) v = (vi); \ ++ unsigned int qp; \ ++ \ ++ if (v->curr_queue_pairs > nr_cpu_ids) { \ ++ qp = v->curr_queue_pairs - v->xdp_queue_pairs; \ ++ qp += smp_processor_id(); \ ++ txq = netdev_get_tx_queue(v->dev, qp); \ ++ __netif_tx_acquire(txq); \ ++ } else { \ ++ qp = smp_processor_id() % v->curr_queue_pairs; \ ++ txq = netdev_get_tx_queue(v->dev, qp); \ ++ __netif_tx_lock(txq, raw_smp_processor_id()); \ ++ } \ ++ v->sq + qp; \ ++}) ++ ++#define virtnet_xdp_put_sq(vi, q) { \ ++ struct netdev_queue *txq; \ ++ typeof(vi) v = (vi); \ ++ \ ++ txq = netdev_get_tx_queue(v->dev, (q) - v->sq); \ ++ if (v->curr_queue_pairs > nr_cpu_ids) \ ++ __netif_tx_release(txq); \ ++ else \ ++ __netif_tx_unlock(txq); \ + } + + static int virtnet_xdp_xmit(struct net_device *dev, +@@ -516,7 +548,7 @@ static int virtnet_xdp_xmit(struct net_device *dev, + if (!xdp_prog) + return -ENXIO; + +- sq = virtnet_xdp_sq(vi); ++ sq = virtnet_xdp_get_sq(vi); + + if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) { + ret = -EINVAL; +@@ -564,12 +596,13 @@ out: + sq->stats.kicks += kicks; + u64_stats_update_end(&sq->stats.syncp); + ++ virtnet_xdp_put_sq(vi, sq); + return ret; + } + + static unsigned int virtnet_get_headroom(struct virtnet_info *vi) + { +- return vi->xdp_queue_pairs ? VIRTIO_XDP_HEADROOM : 0; ++ return vi->xdp_enabled ? VIRTIO_XDP_HEADROOM : 0; + } + + /* We copy the packet for XDP in the following cases: +@@ -1458,12 +1491,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget) + xdp_do_flush_map(); + + if (xdp_xmit & VIRTIO_XDP_TX) { +- sq = virtnet_xdp_sq(vi); ++ sq = virtnet_xdp_get_sq(vi); + if (virtqueue_kick_prepare(sq->vq) && virtqueue_notify(sq->vq)) { + u64_stats_update_begin(&sq->stats.syncp); + sq->stats.kicks++; + u64_stats_update_end(&sq->stats.syncp); + } ++ virtnet_xdp_put_sq(vi, sq); + } + + return received; +@@ -2459,7 +2493,7 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) || + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) || + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) { +- NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first"); ++ NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing GRO_HW/CSUM, disable GRO_HW/CSUM first"); + return -EOPNOTSUPP; + } + +@@ -2480,10 +2514,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + + /* XDP requires extra queues for XDP_TX */ + if (curr_qp + xdp_qp > vi->max_queue_pairs) { +- NL_SET_ERR_MSG_MOD(extack, "Too few free TX rings available"); +- netdev_warn(dev, "request %i queues but max is %i\n", ++ netdev_warn(dev, "XDP request %i queues but max is %i. XDP_TX and XDP_REDIRECT will operate in a slower locked tx mode.\n", + curr_qp + xdp_qp, vi->max_queue_pairs); +- return -ENOMEM; ++ xdp_qp = 0; + } + + old_prog = rtnl_dereference(vi->rq[0].xdp_prog); +@@ -2520,11 +2553,14 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + vi->xdp_queue_pairs = xdp_qp; + + if (prog) { ++ vi->xdp_enabled = true; + for (i = 0; i < vi->max_queue_pairs; i++) { + rcu_assign_pointer(vi->rq[i].xdp_prog, prog); + if (i == 0 && !old_prog) + virtnet_clear_guest_offloads(vi); + } ++ } else { ++ vi->xdp_enabled = false; + } + + for (i = 0; i < vi->max_queue_pairs; i++) { +@@ -2608,15 +2644,15 @@ static int virtnet_set_features(struct net_device *dev, + u64 offloads; + int err; + +- if ((dev->features ^ features) & NETIF_F_LRO) { +- if (vi->xdp_queue_pairs) ++ if ((dev->features ^ features) & NETIF_F_GRO_HW) { ++ if (vi->xdp_enabled) + return -EBUSY; + +- if (features & NETIF_F_LRO) ++ if (features & NETIF_F_GRO_HW) + offloads = vi->guest_offloads_capable; + else + offloads = vi->guest_offloads_capable & +- ~GUEST_OFFLOAD_LRO_MASK; ++ ~GUEST_OFFLOAD_GRO_HW_MASK; + + err = virtnet_set_guest_offloads(vi, offloads); + if (err) +@@ -3092,9 +3128,9 @@ static int virtnet_probe(struct virtio_device *vdev) + dev->features |= NETIF_F_RXCSUM; + if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || + virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6)) +- dev->features |= NETIF_F_LRO; ++ dev->features |= NETIF_F_GRO_HW; + if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) +- dev->hw_features |= NETIF_F_LRO; ++ dev->hw_features |= NETIF_F_GRO_HW; + + dev->vlan_features = dev->features; + +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index f08ed52d51f3f..9b626c169554f 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -1036,6 +1036,8 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev, + bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr); + bool is_ndisc = ipv6_ndisc_frame(skb); + ++ nf_reset_ct(skb); ++ + /* loopback, multicast & non-ND link-local traffic; do not push through + * packet taps again. Reset pkt_type for upper layers to process skb. + * For strict packets with a source LLA, determine the dst using the +@@ -1092,6 +1094,8 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev, + skb->skb_iif = vrf_dev->ifindex; + IPCB(skb)->flags |= IPSKB_L3SLAVE; + ++ nf_reset_ct(skb); ++ + if (ipv4_is_multicast(ip_hdr(skb)->daddr)) + goto out; + +diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h +index 7a364eca46d64..f083fb9038c36 100644 +--- a/drivers/net/wireless/ath/ath.h ++++ b/drivers/net/wireless/ath/ath.h +@@ -197,12 +197,13 @@ struct sk_buff *ath_rxbuf_alloc(struct ath_common *common, + bool ath_is_mybeacon(struct ath_common *common, struct ieee80211_hdr *hdr); + + void ath_hw_setbssidmask(struct ath_common *common); +-void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key); ++void ath_key_delete(struct ath_common *common, u8 hw_key_idx); + int ath_key_config(struct ath_common *common, + struct ieee80211_vif *vif, + struct ieee80211_sta *sta, + struct ieee80211_key_conf *key); + bool ath_hw_keyreset(struct ath_common *common, u16 entry); ++bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac); + void ath_hw_cycle_counters_update(struct ath_common *common); + int32_t ath_hw_get_listen_time(struct ath_common *common); + +diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c +index 5e866a193ed04..d065600791c11 100644 +--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c ++++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c +@@ -521,7 +521,7 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + } + break; + case DISABLE_KEY: +- ath_key_delete(common, key); ++ ath_key_delete(common, key->hw_key_idx); + break; + default: + ret = -EINVAL; +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +index a82ad739ab806..16a7bae62b7d3 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +@@ -1460,7 +1460,7 @@ static int ath9k_htc_set_key(struct ieee80211_hw *hw, + } + break; + case DISABLE_KEY: +- ath_key_delete(common, key); ++ ath_key_delete(common, key->hw_key_idx); + break; + default: + ret = -EINVAL; +diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h +index 2e4489700a859..2842ca205a0a9 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.h ++++ b/drivers/net/wireless/ath/ath9k/hw.h +@@ -819,6 +819,7 @@ struct ath_hw { + struct ath9k_pacal_info pacal_info; + struct ar5416Stats stats; + struct ath9k_tx_queue_info txq[ATH9K_NUM_TX_QUEUES]; ++ DECLARE_BITMAP(pending_del_keymap, ATH_KEYMAX); + + enum ath9k_int imask; + u32 imrs2_reg; +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index d14e01da3c312..28ccdcb197de2 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -823,12 +823,80 @@ exit: + ieee80211_free_txskb(hw, skb); + } + ++static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix) ++{ ++ struct ath_buf *bf; ++ struct ieee80211_tx_info *txinfo; ++ struct ath_frame_info *fi; ++ ++ list_for_each_entry(bf, txq_list, list) { ++ if (bf->bf_state.stale || !bf->bf_mpdu) ++ continue; ++ ++ txinfo = IEEE80211_SKB_CB(bf->bf_mpdu); ++ fi = (struct ath_frame_info *)&txinfo->rate_driver_data[0]; ++ if (fi->keyix == keyix) ++ return true; ++ } ++ ++ return false; ++} ++ ++static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) ++{ ++ struct ath_hw *ah = sc->sc_ah; ++ int i; ++ struct ath_txq *txq; ++ bool key_in_use = false; ++ ++ for (i = 0; !key_in_use && i < ATH9K_NUM_TX_QUEUES; i++) { ++ if (!ATH_TXQ_SETUP(sc, i)) ++ continue; ++ txq = &sc->tx.txq[i]; ++ if (!txq->axq_depth) ++ continue; ++ if (!ath9k_hw_numtxpending(ah, txq->axq_qnum)) ++ continue; ++ ++ ath_txq_lock(sc, txq); ++ key_in_use = ath9k_txq_list_has_key(&txq->axq_q, keyix); ++ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) { ++ int idx = txq->txq_tailidx; ++ ++ while (!key_in_use && ++ !list_empty(&txq->txq_fifo[idx])) { ++ key_in_use = ath9k_txq_list_has_key( ++ &txq->txq_fifo[idx], keyix); ++ INCR(idx, ATH_TXFIFO_DEPTH); ++ } ++ } ++ ath_txq_unlock(sc, txq); ++ } ++ ++ return key_in_use; ++} ++ ++static void ath9k_pending_key_del(struct ath_softc *sc, u8 keyix) ++{ ++ struct ath_hw *ah = sc->sc_ah; ++ struct ath_common *common = ath9k_hw_common(ah); ++ ++ if (!test_bit(keyix, ah->pending_del_keymap) || ++ ath9k_txq_has_key(sc, keyix)) ++ return; ++ ++ /* No more TXQ frames point to this key cache entry, so delete it. */ ++ clear_bit(keyix, ah->pending_del_keymap); ++ ath_key_delete(common, keyix); ++} ++ + static void ath9k_stop(struct ieee80211_hw *hw) + { + struct ath_softc *sc = hw->priv; + struct ath_hw *ah = sc->sc_ah; + struct ath_common *common = ath9k_hw_common(ah); + bool prev_idle; ++ int i; + + ath9k_deinit_channel_context(sc); + +@@ -896,6 +964,14 @@ static void ath9k_stop(struct ieee80211_hw *hw) + + spin_unlock_bh(&sc->sc_pcu_lock); + ++ for (i = 0; i < ATH_KEYMAX; i++) ++ ath9k_pending_key_del(sc, i); ++ ++ /* Clear key cache entries explicitly to get rid of any potentially ++ * remaining keys. ++ */ ++ ath9k_cmn_init_crypto(sc->sc_ah); ++ + ath9k_ps_restore(sc); + + sc->ps_idle = prev_idle; +@@ -1541,12 +1617,11 @@ static void ath9k_del_ps_key(struct ath_softc *sc, + { + struct ath_common *common = ath9k_hw_common(sc->sc_ah); + struct ath_node *an = (struct ath_node *) sta->drv_priv; +- struct ieee80211_key_conf ps_key = { .hw_key_idx = an->ps_key }; + + if (!an->ps_key) + return; + +- ath_key_delete(common, &ps_key); ++ ath_key_delete(common, an->ps_key); + an->ps_key = 0; + an->key_idx[0] = 0; + } +@@ -1708,6 +1783,12 @@ static int ath9k_set_key(struct ieee80211_hw *hw, + if (sta) + an = (struct ath_node *)sta->drv_priv; + ++ /* Delete pending key cache entries if no more frames are pointing to ++ * them in TXQs. ++ */ ++ for (i = 0; i < ATH_KEYMAX; i++) ++ ath9k_pending_key_del(sc, i); ++ + switch (cmd) { + case SET_KEY: + if (sta) +@@ -1737,7 +1818,15 @@ static int ath9k_set_key(struct ieee80211_hw *hw, + } + break; + case DISABLE_KEY: +- ath_key_delete(common, key); ++ if (ath9k_txq_has_key(sc, key->hw_key_idx)) { ++ /* Delay key cache entry deletion until there are no ++ * remaining TXQ frames pointing to this entry. ++ */ ++ set_bit(key->hw_key_idx, sc->sc_ah->pending_del_keymap); ++ ath_hw_keysetmac(common, key->hw_key_idx, NULL); ++ } else { ++ ath_key_delete(common, key->hw_key_idx); ++ } + if (an) { + for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) { + if (an->key_idx[i] != key->hw_key_idx) +diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c +index 1816b4e7dc264..61b59a804e308 100644 +--- a/drivers/net/wireless/ath/key.c ++++ b/drivers/net/wireless/ath/key.c +@@ -84,8 +84,7 @@ bool ath_hw_keyreset(struct ath_common *common, u16 entry) + } + EXPORT_SYMBOL(ath_hw_keyreset); + +-static bool ath_hw_keysetmac(struct ath_common *common, +- u16 entry, const u8 *mac) ++bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac) + { + u32 macHi, macLo; + u32 unicast_flag = AR_KEYTABLE_VALID; +@@ -125,6 +124,7 @@ static bool ath_hw_keysetmac(struct ath_common *common, + + return true; + } ++EXPORT_SYMBOL(ath_hw_keysetmac); + + static bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry, + const struct ath_keyval *k, +@@ -581,29 +581,38 @@ EXPORT_SYMBOL(ath_key_config); + /* + * Delete Key. + */ +-void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key) ++void ath_key_delete(struct ath_common *common, u8 hw_key_idx) + { +- ath_hw_keyreset(common, key->hw_key_idx); +- if (key->hw_key_idx < IEEE80211_WEP_NKID) ++ /* Leave CCMP and TKIP (main key) configured to avoid disabling ++ * encryption for potentially pending frames already in a TXQ with the ++ * keyix pointing to this key entry. Instead, only clear the MAC address ++ * to prevent RX processing from using this key cache entry. ++ */ ++ if (test_bit(hw_key_idx, common->ccmp_keymap) || ++ test_bit(hw_key_idx, common->tkip_keymap)) ++ ath_hw_keysetmac(common, hw_key_idx, NULL); ++ else ++ ath_hw_keyreset(common, hw_key_idx); ++ if (hw_key_idx < IEEE80211_WEP_NKID) + return; + +- clear_bit(key->hw_key_idx, common->keymap); +- clear_bit(key->hw_key_idx, common->ccmp_keymap); +- if (key->cipher != WLAN_CIPHER_SUITE_TKIP) ++ clear_bit(hw_key_idx, common->keymap); ++ clear_bit(hw_key_idx, common->ccmp_keymap); ++ if (!test_bit(hw_key_idx, common->tkip_keymap)) + return; + +- clear_bit(key->hw_key_idx + 64, common->keymap); ++ clear_bit(hw_key_idx + 64, common->keymap); + +- clear_bit(key->hw_key_idx, common->tkip_keymap); +- clear_bit(key->hw_key_idx + 64, common->tkip_keymap); ++ clear_bit(hw_key_idx, common->tkip_keymap); ++ clear_bit(hw_key_idx + 64, common->tkip_keymap); + + if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) { +- ath_hw_keyreset(common, key->hw_key_idx + 32); +- clear_bit(key->hw_key_idx + 32, common->keymap); +- clear_bit(key->hw_key_idx + 64 + 32, common->keymap); ++ ath_hw_keyreset(common, hw_key_idx + 32); ++ clear_bit(hw_key_idx + 32, common->keymap); ++ clear_bit(hw_key_idx + 64 + 32, common->keymap); + +- clear_bit(key->hw_key_idx + 32, common->tkip_keymap); +- clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap); ++ clear_bit(hw_key_idx + 32, common->tkip_keymap); ++ clear_bit(hw_key_idx + 64 + 32, common->tkip_keymap); + } + } + EXPORT_SYMBOL(ath_key_delete); +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 6c1b936a94fac..0241f0dcc093f 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1905,6 +1905,7 @@ static void quirk_ryzen_xhci_d3hot(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e0, quirk_ryzen_xhci_d3hot); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e1, quirk_ryzen_xhci_d3hot); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1639, quirk_ryzen_xhci_d3hot); + + #ifdef CONFIG_X86_IO_APIC + static int dmi_disable_ioapicreroute(const struct dmi_system_id *d) +diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig +index 0517272a268ed..9fb6f7643ea96 100644 +--- a/drivers/ptp/Kconfig ++++ b/drivers/ptp/Kconfig +@@ -92,7 +92,8 @@ config DP83640_PHY + config PTP_1588_CLOCK_PCH + tristate "Intel PCH EG20T as PTP clock" + depends on X86_32 || COMPILE_TEST +- depends on HAS_IOMEM && NET ++ depends on HAS_IOMEM && PCI ++ depends on NET + imply PTP_1588_CLOCK + help + This driver adds support for using the PCH EG20T as a PTP +diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c +index 5efc959493ecd..85a71bafaea76 100644 +--- a/drivers/scsi/device_handler/scsi_dh_rdac.c ++++ b/drivers/scsi/device_handler/scsi_dh_rdac.c +@@ -453,8 +453,8 @@ static int initialize_controller(struct scsi_device *sdev, + if (!h->ctlr) + err = SCSI_DH_RES_TEMP_UNAVAIL; + else { +- list_add_rcu(&h->node, &h->ctlr->dh_list); + h->sdev = sdev; ++ list_add_rcu(&h->node, &h->ctlr->dh_list); + } + spin_unlock(&list_lock); + err = SCSI_DH_OK; +@@ -778,11 +778,11 @@ static void rdac_bus_detach( struct scsi_device *sdev ) + spin_lock(&list_lock); + if (h->ctlr) { + list_del_rcu(&h->node); +- h->sdev = NULL; + kref_put(&h->ctlr->kref, release_controller); + } + spin_unlock(&list_lock); + sdev->handler_data = NULL; ++ synchronize_rcu(); + kfree(h); + } + +diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c +index 59cca898f0882..fcfbf3343b64e 100644 +--- a/drivers/scsi/megaraid/megaraid_mm.c ++++ b/drivers/scsi/megaraid/megaraid_mm.c +@@ -246,7 +246,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) + mimd_t mimd; + uint32_t adapno; + int iterator; +- ++ bool is_found; + + if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) { + *rval = -EFAULT; +@@ -262,12 +262,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) + + adapter = NULL; + iterator = 0; ++ is_found = false; + + list_for_each_entry(adapter, &adapters_list_g, list) { +- if (iterator++ == adapno) break; ++ if (iterator++ == adapno) { ++ is_found = true; ++ break; ++ } + } + +- if (!adapter) { ++ if (!is_found) { + *rval = -ENODEV; + return NULL; + } +@@ -733,6 +737,7 @@ ioctl_done(uioc_t *kioc) + uint32_t adapno; + int iterator; + mraid_mmadp_t* adapter; ++ bool is_found; + + /* + * When the kioc returns from driver, make sure it still doesn't +@@ -755,19 +760,23 @@ ioctl_done(uioc_t *kioc) + iterator = 0; + adapter = NULL; + adapno = kioc->adapno; ++ is_found = false; + + con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed " + "ioctl that was timedout before\n")); + + list_for_each_entry(adapter, &adapters_list_g, list) { +- if (iterator++ == adapno) break; ++ if (iterator++ == adapno) { ++ is_found = true; ++ break; ++ } + } + + kioc->timedout = 0; + +- if (adapter) { ++ if (is_found) + mraid_mm_dealloc_kioc( adapter, kioc ); +- } ++ + } + else { + wake_up(&wait_q); +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 79232cef1af16..3fd109fd9335d 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -454,7 +454,8 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, + error = shost->hostt->target_alloc(starget); + + if(error) { +- dev_printk(KERN_ERR, dev, "target allocation failed, error %d\n", error); ++ if (error != -ENXIO) ++ dev_err(dev, "target allocation failed, error %d\n", error); + /* don't want scsi_target_reap to do the final + * put because it will be under the host lock */ + scsi_target_destroy(starget); +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 6d7362e7367ed..11592ec7b23ea 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -787,11 +787,14 @@ store_state_field(struct device *dev, struct device_attribute *attr, + mutex_lock(&sdev->state_mutex); + ret = scsi_device_set_state(sdev, state); + /* +- * If the device state changes to SDEV_RUNNING, we need to run +- * the queue to avoid I/O hang. ++ * If the device state changes to SDEV_RUNNING, we need to ++ * rescan the device to revalidate it, and run the queue to ++ * avoid I/O hang. + */ +- if (ret == 0 && state == SDEV_RUNNING) ++ if (ret == 0 && state == SDEV_RUNNING) { ++ scsi_rescan_device(dev); + blk_mq_run_hw_queues(sdev->request_queue, true); ++ } + mutex_unlock(&sdev->state_mutex); + + return ret == 0 ? count : -EINVAL; +diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c +index d5879142dbef1..ddf0371ad52b2 100644 +--- a/drivers/slimbus/messaging.c ++++ b/drivers/slimbus/messaging.c +@@ -66,7 +66,7 @@ int slim_alloc_txn_tid(struct slim_controller *ctrl, struct slim_msg_txn *txn) + int ret = 0; + + spin_lock_irqsave(&ctrl->txn_lock, flags); +- ret = idr_alloc_cyclic(&ctrl->tid_idr, txn, 0, ++ ret = idr_alloc_cyclic(&ctrl->tid_idr, txn, 1, + SLIM_MAX_TIDS, GFP_ATOMIC); + if (ret < 0) { + spin_unlock_irqrestore(&ctrl->txn_lock, flags); +@@ -131,7 +131,8 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) + goto slim_xfer_err; + } + } +- ++ /* Initialize tid to invalid value */ ++ txn->tid = 0; + need_tid = slim_tid_txn(txn->mt, txn->mc); + + if (need_tid) { +@@ -163,7 +164,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) + txn->mt, txn->mc, txn->la, ret); + + slim_xfer_err: +- if (!clk_pause_msg && (!need_tid || ret == -ETIMEDOUT)) { ++ if (!clk_pause_msg && (txn->tid == 0 || ret == -ETIMEDOUT)) { + /* + * remove runtime-pm vote if this was TX only, or + * if there was error during this transaction +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index b60541c3f72da..09ecd1fb24ae3 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1061,7 +1061,8 @@ static void qcom_slim_ngd_setup(struct qcom_slim_ngd_ctrl *ctrl) + { + u32 cfg = readl_relaxed(ctrl->ngd->base); + +- if (ctrl->state == QCOM_SLIM_NGD_CTRL_DOWN) ++ if (ctrl->state == QCOM_SLIM_NGD_CTRL_DOWN || ++ ctrl->state == QCOM_SLIM_NGD_CTRL_ASLEEP) + qcom_slim_ngd_init_dma(ctrl); + + /* By default enable message queues */ +@@ -1112,6 +1113,7 @@ static int qcom_slim_ngd_power_up(struct qcom_slim_ngd_ctrl *ctrl) + dev_info(ctrl->dev, "Subsys restart: ADSP active framer\n"); + return 0; + } ++ qcom_slim_ngd_setup(ctrl); + return 0; + } + +@@ -1500,6 +1502,7 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev) + struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev); + int ret = 0; + ++ qcom_slim_ngd_exit_dma(ctrl); + if (!ctrl->qmi.handle) + return 0; + +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 041c68ea329f4..7ca908704777c 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -647,6 +647,9 @@ int usb_get_descriptor(struct usb_device *dev, unsigned char type, + int i; + int result; + ++ if (size <= 0) /* No point in asking for no data */ ++ return -EINVAL; ++ + memset(buf, 0, size); /* Make sure we parse really received data */ + + for (i = 0; i < 3; ++i) { +@@ -695,6 +698,9 @@ static int usb_get_string(struct usb_device *dev, unsigned short langid, + int i; + int result; + ++ if (size <= 0) /* No point in asking for no data */ ++ return -EINVAL; ++ + for (i = 0; i < 3; ++i) { + /* retry on length 0 or stall; some devices are flakey */ + result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index a279ecacbf60a..97be299f0a8dc 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -702,10 +702,16 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz) + (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); + } + ++/* Make sure 64 bit math will not overflow. */ + static bool vhost_overflow(u64 uaddr, u64 size) + { +- /* Make sure 64 bit math will not overflow. */ +- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size; ++ if (uaddr > ULONG_MAX || size > ULONG_MAX) ++ return true; ++ ++ if (!size) ++ return false; ++ ++ return uaddr > ULONG_MAX - size + 1; + } + + /* Caller should have vq mutex and device mutex. */ +diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c +index a977e32a88f2f..59a05f1b81054 100644 +--- a/drivers/virtio/virtio.c ++++ b/drivers/virtio/virtio.c +@@ -342,6 +342,7 @@ int register_virtio_device(struct virtio_device *dev) + virtio_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE); + + INIT_LIST_HEAD(&dev->vqs); ++ spin_lock_init(&dev->vqs_list_lock); + + /* + * device_add() causes the bus infrastructure to look for a matching +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 97e8a195e18f5..f6011c9ed32f1 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1668,7 +1668,9 @@ static struct virtqueue *vring_create_virtqueue_packed( + cpu_to_le16(vq->packed.event_flags_shadow); + } + ++ spin_lock(&vdev->vqs_list_lock); + list_add_tail(&vq->vq.list, &vdev->vqs); ++ spin_unlock(&vdev->vqs_list_lock); + return &vq->vq; + + err_desc_extra: +@@ -2126,7 +2128,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index, + memset(vq->split.desc_state, 0, vring.num * + sizeof(struct vring_desc_state_split)); + ++ spin_lock(&vdev->vqs_list_lock); + list_add_tail(&vq->vq.list, &vdev->vqs); ++ spin_unlock(&vdev->vqs_list_lock); + return &vq->vq; + } + EXPORT_SYMBOL_GPL(__vring_new_virtqueue); +@@ -2210,7 +2214,9 @@ void vring_del_virtqueue(struct virtqueue *_vq) + } + if (!vq->packed_ring) + kfree(vq->split.desc_state); ++ spin_lock(&vq->vq.vdev->vqs_list_lock); + list_del(&_vq->list); ++ spin_unlock(&vq->vq.vdev->vqs_list_lock); + kfree(vq); + } + EXPORT_SYMBOL_GPL(vring_del_virtqueue); +@@ -2274,10 +2280,12 @@ void virtio_break_device(struct virtio_device *dev) + { + struct virtqueue *_vq; + ++ spin_lock(&dev->vqs_list_lock); + list_for_each_entry(_vq, &dev->vqs, list) { + struct vring_virtqueue *vq = to_vvq(_vq); + vq->broken = true; + } ++ spin_unlock(&dev->vqs_list_lock); + } + EXPORT_SYMBOL_GPL(virtio_break_device); + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index b044b1d910dec..54b607a3cc3f2 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9702,8 +9702,14 @@ static int btrfs_rename_exchange(struct inode *old_dir, + bool root_log_pinned = false; + bool dest_log_pinned = false; + +- /* we only allow rename subvolume link between subvolumes */ +- if (old_ino != BTRFS_FIRST_FREE_OBJECTID && root != dest) ++ /* ++ * For non-subvolumes allow exchange only within one subvolume, in the ++ * same inode namespace. Two subvolumes (represented as directory) can ++ * be exchanged as they're a logical link and have a fixed inode number. ++ */ ++ if (root != dest && ++ (old_ino != BTRFS_FIRST_FREE_OBJECTID || ++ new_ino != BTRFS_FIRST_FREE_OBJECTID)) + return -EXDEV; + + /* close the race window with snapshot create/destroy ioctl */ +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index bf3eaa9030335..ae2cb15d95407 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -718,7 +718,7 @@ enum { + #define EXT4_MAX_BLOCK_FILE_PHYS 0xFFFFFFFF + + /* Max logical block we can support */ +-#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFF ++#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFE + + /* + * Structure of an inode on the disk +diff --git a/fs/namespace.c b/fs/namespace.c +index a092611d89e77..5782cd55dfdbb 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1647,8 +1647,12 @@ static inline bool may_mount(void) + } + + #ifdef CONFIG_MANDATORY_FILE_LOCKING +-static inline bool may_mandlock(void) ++static bool may_mandlock(void) + { ++ pr_warn_once("======================================================\n" ++ "WARNING: the mand mount option is being deprecated and\n" ++ " will be removed in v5.15!\n" ++ "======================================================\n"); + return capable(CAP_SYS_ADMIN); + } + #else +diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c +index 7a08a576f7b29..ab5e92897270a 100644 +--- a/fs/overlayfs/file.c ++++ b/fs/overlayfs/file.c +@@ -9,6 +9,9 @@ + #include + #include + #include ++#include ++#include ++#include + #include "overlayfs.h" + + static char ovl_whatisit(struct inode *inode, struct inode *realinode) +@@ -293,6 +296,48 @@ out_unlock: + return ret; + } + ++static ssize_t ovl_splice_read(struct file *in, loff_t *ppos, ++ struct pipe_inode_info *pipe, size_t len, ++ unsigned int flags) ++{ ++ ssize_t ret; ++ struct fd real; ++ const struct cred *old_cred; ++ ++ ret = ovl_real_fdget(in, &real); ++ if (ret) ++ return ret; ++ ++ old_cred = ovl_override_creds(file_inode(in)->i_sb); ++ ret = generic_file_splice_read(real.file, ppos, pipe, len, flags); ++ revert_creds(old_cred); ++ ++ ovl_file_accessed(in); ++ fdput(real); ++ return ret; ++} ++ ++static ssize_t ++ovl_splice_write(struct pipe_inode_info *pipe, struct file *out, ++ loff_t *ppos, size_t len, unsigned int flags) ++{ ++ struct fd real; ++ const struct cred *old_cred; ++ ssize_t ret; ++ ++ ret = ovl_real_fdget(out, &real); ++ if (ret) ++ return ret; ++ ++ old_cred = ovl_override_creds(file_inode(out)->i_sb); ++ ret = iter_file_splice_write(pipe, real.file, ppos, len, flags); ++ revert_creds(old_cred); ++ ++ ovl_file_accessed(out); ++ fdput(real); ++ return ret; ++} ++ + static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync) + { + struct fd real; +@@ -649,6 +694,8 @@ const struct file_operations ovl_file_operations = { + .fadvise = ovl_fadvise, + .unlocked_ioctl = ovl_ioctl, + .compat_ioctl = ovl_compat_ioctl, ++ .splice_read = ovl_splice_read, ++ .splice_write = ovl_splice_write, + + .copy_file_range = ovl_copy_file_range, + .remap_file_range = ovl_remap_file_range, +diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h +index fb5b2a41bd456..b6d0b68f55032 100644 +--- a/include/linux/memcontrol.h ++++ b/include/linux/memcontrol.h +@@ -356,17 +356,54 @@ static inline bool mem_cgroup_disabled(void) + return !cgroup_subsys_enabled(memory_cgrp_subsys); + } + +-static inline unsigned long mem_cgroup_protection(struct mem_cgroup *memcg, +- bool in_low_reclaim) ++static inline void mem_cgroup_protection(struct mem_cgroup *root, ++ struct mem_cgroup *memcg, ++ unsigned long *min, ++ unsigned long *low) + { ++ *min = *low = 0; ++ + if (mem_cgroup_disabled()) +- return 0; ++ return; + +- if (in_low_reclaim) +- return READ_ONCE(memcg->memory.emin); ++ /* ++ * There is no reclaim protection applied to a targeted reclaim. ++ * We are special casing this specific case here because ++ * mem_cgroup_protected calculation is not robust enough to keep ++ * the protection invariant for calculated effective values for ++ * parallel reclaimers with different reclaim target. This is ++ * especially a problem for tail memcgs (as they have pages on LRU) ++ * which would want to have effective values 0 for targeted reclaim ++ * but a different value for external reclaim. ++ * ++ * Example ++ * Let's have global and A's reclaim in parallel: ++ * | ++ * A (low=2G, usage = 3G, max = 3G, children_low_usage = 1.5G) ++ * |\ ++ * | C (low = 1G, usage = 2.5G) ++ * B (low = 1G, usage = 0.5G) ++ * ++ * For the global reclaim ++ * A.elow = A.low ++ * B.elow = min(B.usage, B.low) because children_low_usage <= A.elow ++ * C.elow = min(C.usage, C.low) ++ * ++ * With the effective values resetting we have A reclaim ++ * A.elow = 0 ++ * B.elow = B.low ++ * C.elow = C.low ++ * ++ * If the global reclaim races with A's reclaim then ++ * B.elow = C.elow = 0 because children_low_usage > A.elow) ++ * is possible and reclaiming B would be violating the protection. ++ * ++ */ ++ if (root == memcg) ++ return; + +- return max(READ_ONCE(memcg->memory.emin), +- READ_ONCE(memcg->memory.elow)); ++ *min = READ_ONCE(memcg->memory.emin); ++ *low = READ_ONCE(memcg->memory.elow); + } + + enum mem_cgroup_protection mem_cgroup_protected(struct mem_cgroup *root, +@@ -847,10 +884,12 @@ static inline void memcg_memory_event_mm(struct mm_struct *mm, + { + } + +-static inline unsigned long mem_cgroup_protection(struct mem_cgroup *memcg, +- bool in_low_reclaim) ++static inline void mem_cgroup_protection(struct mem_cgroup *root, ++ struct mem_cgroup *memcg, ++ unsigned long *min, ++ unsigned long *low) + { +- return 0; ++ *min = *low = 0; + } + + static inline enum mem_cgroup_protection mem_cgroup_protected( +diff --git a/include/linux/virtio.h b/include/linux/virtio.h +index 15f906e4a748f..7c075463c7f2b 100644 +--- a/include/linux/virtio.h ++++ b/include/linux/virtio.h +@@ -111,6 +111,7 @@ struct virtio_device { + bool config_enabled; + bool config_change_pending; + spinlock_t config_lock; ++ spinlock_t vqs_list_lock; /* Protects VQs list access */ + struct device dev; + struct virtio_device_id id; + const struct virtio_config_ops *config; +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 52c2b11a0b471..0b5a446ee59c9 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -8586,6 +8586,7 @@ static void sanitize_dead_code(struct bpf_verifier_env *env) + if (aux_data[i].seen) + continue; + memcpy(insn + i, &trap, sizeof(trap)); ++ aux_data[i].zext_dst = false; + } + } + +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index e40712abe089e..f63766366e238 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -4291,6 +4291,8 @@ trace_action_create_field_var(struct hist_trigger_data *hist_data, + event = data->match_data.event; + } + ++ if (!event) ++ goto free; + /* + * At this point, we're looking at a field on another + * event. Because we can't modify a hist trigger on +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 2701497edda5c..6d7fe3589e4a0 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -6446,6 +6446,14 @@ enum mem_cgroup_protection mem_cgroup_protected(struct mem_cgroup *root, + + if (!root) + root = root_mem_cgroup; ++ ++ /* ++ * Effective values of the reclaim targets are ignored so they ++ * can be stale. Have a look at mem_cgroup_protection for more ++ * details. ++ * TODO: calculation should be more robust so that we do not need ++ * that special casing. ++ */ + if (memcg == root) + return MEMCG_PROT_NONE; + +diff --git a/mm/vmscan.c b/mm/vmscan.c +index 10feb872d9a4f..fad9be4703ece 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -89,9 +89,12 @@ struct scan_control { + unsigned int may_swap:1; + + /* +- * Cgroups are not reclaimed below their configured memory.low, +- * unless we threaten to OOM. If any cgroups are skipped due to +- * memory.low and nothing was reclaimed, go back for memory.low. ++ * Cgroup memory below memory.low is protected as long as we ++ * don't threaten to OOM. If any cgroup is reclaimed at ++ * reduced force or passed over entirely due to its memory.low ++ * setting (memcg_low_skipped), and nothing is reclaimed as a ++ * result, then go back for one more cycle that reclaims the protected ++ * memory (memcg_low_reclaim) to avert OOM. + */ + unsigned int memcg_low_reclaim:1; + unsigned int memcg_low_skipped:1; +@@ -2458,14 +2461,14 @@ out: + for_each_evictable_lru(lru) { + int file = is_file_lru(lru); + unsigned long lruvec_size; ++ unsigned long low, min; + unsigned long scan; +- unsigned long protection; + + lruvec_size = lruvec_lru_size(lruvec, lru, sc->reclaim_idx); +- protection = mem_cgroup_protection(memcg, +- sc->memcg_low_reclaim); ++ mem_cgroup_protection(sc->target_mem_cgroup, memcg, ++ &min, &low); + +- if (protection) { ++ if (min || low) { + /* + * Scale a cgroup's reclaim pressure by proportioning + * its current usage to its memory.low or memory.min +@@ -2496,6 +2499,15 @@ out: + * hard protection. + */ + unsigned long cgroup_size = mem_cgroup_size(memcg); ++ unsigned long protection; ++ ++ /* memory.low scaling, make sure we retry before OOM */ ++ if (!sc->memcg_low_reclaim && low > min) { ++ protection = low; ++ sc->memcg_low_skipped = 1; ++ } else { ++ protection = min; ++ } + + /* Avoid TOCTOU with earlier protection check */ + cgroup_size = max(cgroup_size, protection); +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index bef84b95e2c47..ac98e3b37ab47 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -1290,7 +1290,7 @@ static int hidp_session_thread(void *arg) + + /* cleanup runtime environment */ + remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait); +- remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait); ++ remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait); + wake_up_interruptible(&session->report_queue); + hidp_del_timer(session); + +diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h +index 9c3b27c257bbf..cb818617699c3 100644 +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -41,9 +41,9 @@ extern bool dccp_debug; + #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a) + #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a) + #else +-#define dccp_pr_debug(format, a...) +-#define dccp_pr_debug_cat(format, a...) +-#define dccp_debug(format, a...) ++#define dccp_pr_debug(format, a...) do {} while (0) ++#define dccp_pr_debug_cat(format, a...) do {} while (0) ++#define dccp_debug(format, a...) do {} while (0) + #endif + + extern struct inet_hashinfo dccp_hashinfo; +diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c +index 00f4323cfeb87..faa0844c01fb8 100644 +--- a/net/netfilter/nft_exthdr.c ++++ b/net/netfilter/nft_exthdr.c +@@ -231,7 +231,6 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, + unsigned int i, optl, tcphdr_len, offset; + struct tcphdr *tcph; + u8 *opt; +- u32 src; + + tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); + if (!tcph) +@@ -240,7 +239,6 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, + opt = (u8 *)tcph; + for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { + union { +- u8 octet; + __be16 v16; + __be32 v32; + } old, new; +@@ -262,13 +260,13 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, + if (!tcph) + return; + +- src = regs->data[priv->sreg]; + offset = i + priv->offset; + + switch (priv->len) { + case 2: + old.v16 = get_unaligned((u16 *)(opt + offset)); +- new.v16 = src; ++ new.v16 = (__force __be16)nft_reg_load16( ++ ®s->data[priv->sreg]); + + switch (priv->type) { + case TCPOPT_MSS: +@@ -286,7 +284,7 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, + old.v16, new.v16, false); + break; + case 4: +- new.v32 = src; ++ new.v32 = regs->data[priv->sreg]; + old.v32 = get_unaligned((u32 *)(opt + offset)); + + if (old.v32 == new.v32) +diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c +index 3fc38d16c4568..19af0efeb8dc1 100644 +--- a/net/openvswitch/vport.c ++++ b/net/openvswitch/vport.c +@@ -499,6 +499,7 @@ void ovs_vport_send(struct vport *vport, struct sk_buff *skb, u8 mac_proto) + } + + skb->dev = vport->dev; ++ skb->tstamp = 0; + vport->ops->send(skb); + return; + +diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c +index 7ac3f04ca8c00..e92fcb150e57c 100644 +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -3458,7 +3458,7 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol, + struct hda_gen_spec *spec = codec->spec; + const struct hda_input_mux *imux; + struct nid_path *path; +- int i, adc_idx, err = 0; ++ int i, adc_idx, ret, err = 0; + + imux = &spec->input_mux; + adc_idx = kcontrol->id.index; +@@ -3468,9 +3468,13 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol, + if (!path || !path->ctls[type]) + continue; + kcontrol->private_value = path->ctls[type]; +- err = func(kcontrol, ucontrol); +- if (err < 0) ++ ret = func(kcontrol, ucontrol); ++ if (ret < 0) { ++ err = ret; + break; ++ } ++ if (ret > 0) ++ err = 1; + } + mutex_unlock(&codec->control_mutex); + if (err >= 0 && spec->cap_sync_hook) +diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +index 216e88624c5f3..7d59846808b52 100644 +--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c ++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +@@ -127,7 +127,7 @@ static void sst_fill_alloc_params(struct snd_pcm_substream *substream, + snd_pcm_uframes_t period_size; + ssize_t periodbytes; + ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream); +- u32 buffer_addr = substream->runtime->dma_addr; ++ u32 buffer_addr = virt_to_phys(substream->runtime->dma_area); + + channels = substream->runtime->channels; + period_size = substream->runtime->period_size; diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.143-144.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.143-144.patch new file mode 100644 index 0000000000..9bcf3a4e79 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.143-144.patch @@ -0,0 +1,1738 @@ +diff --git a/Makefile b/Makefile +index e99fabc4dfc8c..3c3804197b511 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 143 ++SUBLEVEL = 144 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S +index 6c693a9d29b6d..0391b8293ad85 100644 +--- a/arch/arc/kernel/vmlinux.lds.S ++++ b/arch/arc/kernel/vmlinux.lds.S +@@ -88,6 +88,8 @@ SECTIONS + CPUIDLE_TEXT + LOCK_TEXT + KPROBES_TEXT ++ IRQENTRY_TEXT ++ SOFTIRQENTRY_TEXT + *(.fixup) + *(.gnu.warning) + } +diff --git a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts +index a5f9a6ab512c4..9b989cc30edc8 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts +@@ -30,3 +30,7 @@ + }; + }; + }; ++ ++&msmgpio { ++ gpio-reserved-ranges = <85 4>; ++}; +diff --git a/arch/parisc/include/asm/string.h b/arch/parisc/include/asm/string.h +index 4a0c9dbd62fd0..f6e1132f4e352 100644 +--- a/arch/parisc/include/asm/string.h ++++ b/arch/parisc/include/asm/string.h +@@ -8,19 +8,4 @@ extern void * memset(void *, int, size_t); + #define __HAVE_ARCH_MEMCPY + void * memcpy(void * dest,const void *src,size_t count); + +-#define __HAVE_ARCH_STRLEN +-extern size_t strlen(const char *s); +- +-#define __HAVE_ARCH_STRCPY +-extern char *strcpy(char *dest, const char *src); +- +-#define __HAVE_ARCH_STRNCPY +-extern char *strncpy(char *dest, const char *src, size_t count); +- +-#define __HAVE_ARCH_STRCAT +-extern char *strcat(char *dest, const char *src); +- +-#define __HAVE_ARCH_MEMSET +-extern void *memset(void *, int, size_t); +- + #endif +diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c +index 8ed409ecec933..e8a6a751dfd8e 100644 +--- a/arch/parisc/kernel/parisc_ksyms.c ++++ b/arch/parisc/kernel/parisc_ksyms.c +@@ -17,10 +17,6 @@ + + #include + EXPORT_SYMBOL(memset); +-EXPORT_SYMBOL(strlen); +-EXPORT_SYMBOL(strcpy); +-EXPORT_SYMBOL(strncpy); +-EXPORT_SYMBOL(strcat); + + #include + EXPORT_SYMBOL(__xchg8); +diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile +index 2d7a9974dbaef..7b197667faf6c 100644 +--- a/arch/parisc/lib/Makefile ++++ b/arch/parisc/lib/Makefile +@@ -3,7 +3,7 @@ + # Makefile for parisc-specific library files + # + +-lib-y := lusercopy.o bitops.o checksum.o io.o memcpy.o \ +- ucmpdi2.o delay.o string.o ++lib-y := lusercopy.o bitops.o checksum.o io.o memset.o memcpy.o \ ++ ucmpdi2.o delay.o + + obj-y := iomap.o +diff --git a/arch/parisc/lib/memset.c b/arch/parisc/lib/memset.c +new file mode 100644 +index 0000000000000..133e4809859a3 +--- /dev/null ++++ b/arch/parisc/lib/memset.c +@@ -0,0 +1,72 @@ ++/* SPDX-License-Identifier: GPL-2.0-or-later */ ++#include ++#include ++ ++#define OPSIZ (BITS_PER_LONG/8) ++typedef unsigned long op_t; ++ ++void * ++memset (void *dstpp, int sc, size_t len) ++{ ++ unsigned int c = sc; ++ long int dstp = (long int) dstpp; ++ ++ if (len >= 8) ++ { ++ size_t xlen; ++ op_t cccc; ++ ++ cccc = (unsigned char) c; ++ cccc |= cccc << 8; ++ cccc |= cccc << 16; ++ if (OPSIZ > 4) ++ /* Do the shift in two steps to avoid warning if long has 32 bits. */ ++ cccc |= (cccc << 16) << 16; ++ ++ /* There are at least some bytes to set. ++ No need to test for LEN == 0 in this alignment loop. */ ++ while (dstp % OPSIZ != 0) ++ { ++ ((unsigned char *) dstp)[0] = c; ++ dstp += 1; ++ len -= 1; ++ } ++ ++ /* Write 8 `op_t' per iteration until less than 8 `op_t' remain. */ ++ xlen = len / (OPSIZ * 8); ++ while (xlen > 0) ++ { ++ ((op_t *) dstp)[0] = cccc; ++ ((op_t *) dstp)[1] = cccc; ++ ((op_t *) dstp)[2] = cccc; ++ ((op_t *) dstp)[3] = cccc; ++ ((op_t *) dstp)[4] = cccc; ++ ((op_t *) dstp)[5] = cccc; ++ ((op_t *) dstp)[6] = cccc; ++ ((op_t *) dstp)[7] = cccc; ++ dstp += 8 * OPSIZ; ++ xlen -= 1; ++ } ++ len %= OPSIZ * 8; ++ ++ /* Write 1 `op_t' per iteration until less than OPSIZ bytes remain. */ ++ xlen = len / OPSIZ; ++ while (xlen > 0) ++ { ++ ((op_t *) dstp)[0] = cccc; ++ dstp += OPSIZ; ++ xlen -= 1; ++ } ++ len %= OPSIZ; ++ } ++ ++ /* Write the last few bytes. */ ++ while (len > 0) ++ { ++ ((unsigned char *) dstp)[0] = c; ++ dstp += 1; ++ len -= 1; ++ } ++ ++ return dstpp; ++} +diff --git a/arch/parisc/lib/string.S b/arch/parisc/lib/string.S +deleted file mode 100644 +index 4a64264427a63..0000000000000 +--- a/arch/parisc/lib/string.S ++++ /dev/null +@@ -1,136 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0 +-/* +- * PA-RISC assembly string functions +- * +- * Copyright (C) 2019 Helge Deller +- */ +- +-#include +-#include +- +- .section .text.hot +- .level PA_ASM_LEVEL +- +- t0 = r20 +- t1 = r21 +- t2 = r22 +- +-ENTRY_CFI(strlen, frame=0,no_calls) +- or,COND(<>) arg0,r0,ret0 +- b,l,n .Lstrlen_null_ptr,r0 +- depwi 0,31,2,ret0 +- cmpb,COND(<>) arg0,ret0,.Lstrlen_not_aligned +- ldw,ma 4(ret0),t0 +- cmpib,tr 0,r0,.Lstrlen_loop +- uxor,nbz r0,t0,r0 +-.Lstrlen_not_aligned: +- uaddcm arg0,ret0,t1 +- shladd t1,3,r0,t1 +- mtsar t1 +- depwi -1,%sar,32,t0 +- uxor,nbz r0,t0,r0 +-.Lstrlen_loop: +- b,l,n .Lstrlen_end_loop,r0 +- ldw,ma 4(ret0),t0 +- cmpib,tr 0,r0,.Lstrlen_loop +- uxor,nbz r0,t0,r0 +-.Lstrlen_end_loop: +- extrw,u,<> t0,7,8,r0 +- addib,tr,n -3,ret0,.Lstrlen_out +- extrw,u,<> t0,15,8,r0 +- addib,tr,n -2,ret0,.Lstrlen_out +- extrw,u,<> t0,23,8,r0 +- addi -1,ret0,ret0 +-.Lstrlen_out: +- bv r0(rp) +- uaddcm ret0,arg0,ret0 +-.Lstrlen_null_ptr: +- bv,n r0(rp) +-ENDPROC_CFI(strlen) +- +- +-ENTRY_CFI(strcpy, frame=0,no_calls) +- ldb 0(arg1),t0 +- stb t0,0(arg0) +- ldo 0(arg0),ret0 +- ldo 1(arg1),t1 +- cmpb,= r0,t0,2f +- ldo 1(arg0),t2 +-1: ldb 0(t1),arg1 +- stb arg1,0(t2) +- ldo 1(t1),t1 +- cmpb,<> r0,arg1,1b +- ldo 1(t2),t2 +-2: bv,n r0(rp) +-ENDPROC_CFI(strcpy) +- +- +-ENTRY_CFI(strncpy, frame=0,no_calls) +- ldb 0(arg1),t0 +- stb t0,0(arg0) +- ldo 1(arg1),t1 +- ldo 0(arg0),ret0 +- cmpb,= r0,t0,2f +- ldo 1(arg0),arg1 +-1: ldo -1(arg2),arg2 +- cmpb,COND(=),n r0,arg2,2f +- ldb 0(t1),arg0 +- stb arg0,0(arg1) +- ldo 1(t1),t1 +- cmpb,<> r0,arg0,1b +- ldo 1(arg1),arg1 +-2: bv,n r0(rp) +-ENDPROC_CFI(strncpy) +- +- +-ENTRY_CFI(strcat, frame=0,no_calls) +- ldb 0(arg0),t0 +- cmpb,= t0,r0,2f +- ldo 0(arg0),ret0 +- ldo 1(arg0),arg0 +-1: ldb 0(arg0),t1 +- cmpb,<>,n r0,t1,1b +- ldo 1(arg0),arg0 +-2: ldb 0(arg1),t2 +- stb t2,0(arg0) +- ldo 1(arg0),arg0 +- ldb 0(arg1),t0 +- cmpb,<> r0,t0,2b +- ldo 1(arg1),arg1 +- bv,n r0(rp) +-ENDPROC_CFI(strcat) +- +- +-ENTRY_CFI(memset, frame=0,no_calls) +- copy arg0,ret0 +- cmpb,COND(=) r0,arg0,4f +- copy arg0,t2 +- cmpb,COND(=) r0,arg2,4f +- ldo -1(arg2),arg3 +- subi -1,arg3,t0 +- subi 0,t0,t1 +- cmpiclr,COND(>=) 0,t1,arg2 +- ldo -1(t1),arg2 +- extru arg2,31,2,arg0 +-2: stb arg1,0(t2) +- ldo 1(t2),t2 +- addib,>= -1,arg0,2b +- ldo -1(arg3),arg3 +- cmpiclr,COND(<=) 4,arg2,r0 +- b,l,n 4f,r0 +-#ifdef CONFIG_64BIT +- depd,* r0,63,2,arg2 +-#else +- depw r0,31,2,arg2 +-#endif +- ldo 1(t2),t2 +-3: stb arg1,-1(t2) +- stb arg1,0(t2) +- stb arg1,1(t2) +- stb arg1,2(t2) +- addib,COND(>) -4,arg2,3b +- ldo 4(t2),t2 +-4: bv,n r0(rp) +-ENDPROC_CFI(memset) +- +- .end +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 40751af62dd3d..9096a1693942d 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -4382,7 +4382,7 @@ static void snr_uncore_mmio_init_box(struct intel_uncore_box *box) + return; + + pci_read_config_dword(pdev, SNR_IMC_MMIO_BASE_OFFSET, &pci_dword); +- addr = (pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23; ++ addr = ((resource_size_t)pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23; + + pci_read_config_dword(pdev, SNR_IMC_MMIO_MEM0_OFFSET, &pci_dword); + addr |= (pci_dword & SNR_IMC_MMIO_MEM0_MASK) << 12; +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 260c64c205b8c..d3877dd713aef 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -4666,7 +4666,15 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu, + void + reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context) + { +- bool uses_nx = context->nx || ++ /* ++ * KVM uses NX when TDP is disabled to handle a variety of scenarios, ++ * notably for huge SPTEs if iTLB multi-hit mitigation is enabled and ++ * to generate correct permissions for CR0.WP=0/CR4.SMEP=1/EFER.NX=0. ++ * The iTLB multi-hit workaround can be toggled at any time, so assume ++ * NX can be used by any non-nested shadow MMU to avoid having to reset ++ * MMU contexts. Note, KVM forces EFER.NX=1 when TDP is disabled. ++ */ ++ bool uses_nx = context->nx || !tdp_enabled || + context->mmu_role.base.smep_andnot_wp; + struct rsvd_bits_validate *shadow_zero_check; + int i; +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index 40ea1a425c431..ac97a1e2e5ddc 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -4063,22 +4063,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) + if (UFDCS->rawcmd == 1) + UFDCS->rawcmd = 2; + +- if (mode & (FMODE_READ|FMODE_WRITE)) { +- UDRS->last_checked = 0; +- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); +- check_disk_change(bdev); +- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) +- goto out; +- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) ++ if (!(mode & FMODE_NDELAY)) { ++ if (mode & (FMODE_READ|FMODE_WRITE)) { ++ UDRS->last_checked = 0; ++ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); ++ check_disk_change(bdev); ++ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) ++ goto out; ++ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) ++ goto out; ++ } ++ res = -EROFS; ++ if ((mode & FMODE_WRITE) && ++ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) + goto out; + } +- +- res = -EROFS; +- +- if ((mode & FMODE_WRITE) && +- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) +- goto out; +- + mutex_unlock(&open_lock); + mutex_unlock(&floppy_mutex); + return 0; +diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c +index 2cf053fb8d54b..1c691bdb89141 100644 +--- a/drivers/gpu/drm/drm_ioc32.c ++++ b/drivers/gpu/drm/drm_ioc32.c +@@ -863,8 +863,6 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd, + req.request.sequence = req32.request.sequence; + req.request.signal = req32.request.signal; + err = drm_ioctl_kernel(file, drm_wait_vblank_ioctl, &req, DRM_UNLOCKED); +- if (err) +- return err; + + req32.reply.type = req.reply.type; + req32.reply.sequence = req.reply.sequence; +@@ -873,7 +871,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd, + if (copy_to_user(argp, &req32, sizeof(req32))) + return -EFAULT; + +- return 0; ++ return err; + } + + #if defined(CONFIG_X86) +diff --git a/drivers/gpu/drm/i915/gt/intel_timeline.c b/drivers/gpu/drm/i915/gt/intel_timeline.c +index 9cb01d9828f1d..c970e3deb0085 100644 +--- a/drivers/gpu/drm/i915/gt/intel_timeline.c ++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c +@@ -289,6 +289,14 @@ void intel_timeline_fini(struct intel_timeline *timeline) + i915_gem_object_unpin_map(timeline->hwsp_ggtt->obj); + + i915_vma_put(timeline->hwsp_ggtt); ++ ++ /* ++ * A small race exists between intel_gt_retire_requests_timeout and ++ * intel_timeline_exit which could result in the syncmap not getting ++ * free'd. Rather than work to hard to seal this race, simply cleanup ++ * the syncmap on fini. ++ */ ++ i915_syncmap_free(&timeline->sync); + } + + struct intel_timeline * +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c +index 818d21bd28d31..1d2837c5a8f29 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c +@@ -419,7 +419,7 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps) + return ret; + } + +-static void ++void + nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior) + { + struct nvkm_dp *dp = nvkm_dp(outp); +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h +index 428b3f488f033..e484d0c3b0d42 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h +@@ -32,6 +32,7 @@ struct nvkm_dp { + + int nvkm_dp_new(struct nvkm_disp *, int index, struct dcb_output *, + struct nvkm_outp **); ++void nvkm_dp_disable(struct nvkm_outp *, struct nvkm_ior *); + + /* DPCD Receiver Capabilities */ + #define DPCD_RC00_DPCD_REV 0x00000 +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c +index c62030c96fba0..4b1c72fd8f039 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c +@@ -22,6 +22,7 @@ + * Authors: Ben Skeggs + */ + #include "outp.h" ++#include "dp.h" + #include "ior.h" + + #include +@@ -216,6 +217,14 @@ nvkm_outp_init_route(struct nvkm_outp *outp) + if (!ior->arm.head || ior->arm.proto != proto) { + OUTP_DBG(outp, "no heads (%x %d %d)", ior->arm.head, + ior->arm.proto, proto); ++ ++ /* The EFI GOP driver on Ampere can leave unused DP links routed, ++ * which we don't expect. The DisableLT IED script *should* get ++ * us back to where we need to be. ++ */ ++ if (ior->func->route.get && !ior->arm.head && outp->info.type == DCB_OUTPUT_DP) ++ nvkm_dp_disable(outp, ior); ++ + return; + } + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 58c021648b7c8..a96f9142fe08e 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1404,6 +1404,7 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, + if (nq) + nq->budget++; + atomic_inc(&rdev->srq_count); ++ spin_lock_init(&srq->lock); + + return 0; + +diff --git a/drivers/infiniband/hw/efa/efa_main.c b/drivers/infiniband/hw/efa/efa_main.c +index 83858f7e83d0f..75dfe9d1564c1 100644 +--- a/drivers/infiniband/hw/efa/efa_main.c ++++ b/drivers/infiniband/hw/efa/efa_main.c +@@ -340,6 +340,7 @@ static int efa_enable_msix(struct efa_dev *dev) + } + + if (irq_num != msix_vecs) { ++ efa_disable_msix(dev); + dev_err(&dev->pdev->dev, + "Allocated %d MSI-X (out of %d requested)\n", + irq_num, msix_vecs); +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index c61b6022575e1..248be21acdbed 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -3056,6 +3056,7 @@ static void __sdma_process_event(struct sdma_engine *sde, + static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + { + int i; ++ struct sdma_desc *descp; + + /* Handle last descriptor */ + if (unlikely((tx->num_desc == (MAX_DESC - 1)))) { +@@ -3076,12 +3077,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + if (unlikely(tx->num_desc == MAX_DESC)) + goto enomem; + +- tx->descp = kmalloc_array( +- MAX_DESC, +- sizeof(struct sdma_desc), +- GFP_ATOMIC); +- if (!tx->descp) ++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC); ++ if (!descp) + goto enomem; ++ tx->descp = descp; + + /* reserve last descriptor for coalescing */ + tx->desc_limit = MAX_DESC - 1; +diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c +index 8bed81cf03adc..8ab963055238a 100644 +--- a/drivers/mmc/host/sdhci-msm.c ++++ b/drivers/mmc/host/sdhci-msm.c +@@ -1589,6 +1589,23 @@ out: + __sdhci_msm_set_clock(host, clock); + } + ++static void sdhci_msm_set_timeout(struct sdhci_host *host, struct mmc_command *cmd) ++{ ++ u32 count, start = 15; ++ ++ __sdhci_set_timeout(host, cmd); ++ count = sdhci_readb(host, SDHCI_TIMEOUT_CONTROL); ++ /* ++ * Update software timeout value if its value is less than hardware data ++ * timeout value. Qcom SoC hardware data timeout value was calculated ++ * using 4 * MCLK * 2^(count + 13). where MCLK = 1 / host->clock. ++ */ ++ if (cmd && cmd->data && host->clock > 400000 && ++ host->clock <= 50000000 && ++ ((1 << (count + start)) > (10 * host->clock))) ++ host->data_timeout = 22LL * NSEC_PER_SEC; ++} ++ + /* + * Platform specific register write functions. This is so that, if any + * register write needs to be followed up by platform specific actions, +@@ -1753,6 +1770,7 @@ static const struct sdhci_ops sdhci_msm_ops = { + .set_uhs_signaling = sdhci_msm_set_uhs_signaling, + .write_w = sdhci_msm_writew, + .write_b = sdhci_msm_writeb, ++ .set_timeout = sdhci_msm_set_timeout, + }; + + static const struct sdhci_pltfm_data sdhci_msm_pdata = { +diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c +index 485e20e0dec2c..8847942a8d97e 100644 +--- a/drivers/net/can/usb/esd_usb2.c ++++ b/drivers/net/can/usb/esd_usb2.c +@@ -224,8 +224,8 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, + if (id == ESD_EV_CAN_ERROR_EXT) { + u8 state = msg->msg.rx.data[0]; + u8 ecc = msg->msg.rx.data[1]; +- u8 txerr = msg->msg.rx.data[2]; +- u8 rxerr = msg->msg.rx.data[3]; ++ u8 rxerr = msg->msg.rx.data[2]; ++ u8 txerr = msg->msg.rx.data[3]; + + skb = alloc_can_err_skb(priv->netdev, &cf); + if (skb == NULL) { +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index e1a3c33fdad90..2d8382eb9add3 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -842,11 +842,8 @@ mt7530_port_bridge_leave(struct dsa_switch *ds, int port, + /* Remove this port from the port matrix of the other ports + * in the same bridge. If the port is disabled, port matrix + * is kept and not being setup until the port becomes enabled. +- * And the other port's port matrix cannot be broken when the +- * other port is still a VLAN-aware port. + */ +- if (dsa_is_user_port(ds, i) && i != port && +- !dsa_port_is_vlan_filtering(&ds->ports[i])) { ++ if (dsa_is_user_port(ds, i) && i != port) { + if (dsa_to_port(ds, i)->bridge_dev != bridge) + continue; + if (priv->ports[i].enable) +diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c +index 02b4f3af02b54..848be6bf2fd1f 100644 +--- a/drivers/net/ethernet/apm/xgene-v2/main.c ++++ b/drivers/net/ethernet/apm/xgene-v2/main.c +@@ -677,11 +677,13 @@ static int xge_probe(struct platform_device *pdev) + ret = register_netdev(ndev); + if (ret) { + netdev_err(ndev, "Failed to register netdev\n"); +- goto err; ++ goto err_mdio_remove; + } + + return 0; + ++err_mdio_remove: ++ xge_mdio_remove(ndev); + err: + free_netdev(ndev); + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index e34e0854635c3..d64cded30eeb4 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -257,6 +257,9 @@ enum hclge_opcode_type { + /* Led command */ + HCLGE_OPC_LED_STATUS_CFG = 0xB000, + ++ /* clear hardware resource command */ ++ HCLGE_OPC_CLEAR_HW_RESOURCE = 0x700B, ++ + /* NCL config command */ + HCLGE_OPC_QUERY_NCL_CONFIG = 0x7011, + /* M7 stats command */ +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +index a1790af73096d..d16488bab86f5 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -281,21 +281,12 @@ static int hclge_ieee_getpfc(struct hnae3_handle *h, struct ieee_pfc *pfc) + u64 requests[HNAE3_MAX_TC], indications[HNAE3_MAX_TC]; + struct hclge_vport *vport = hclge_get_vport(h); + struct hclge_dev *hdev = vport->back; +- u8 i, j, pfc_map, *prio_tc; + int ret; ++ u8 i; + + memset(pfc, 0, sizeof(*pfc)); + pfc->pfc_cap = hdev->pfc_max; +- prio_tc = hdev->tm_info.prio_tc; +- pfc_map = hdev->tm_info.hw_pfc_map; +- +- /* Pfc setting is based on TC */ +- for (i = 0; i < hdev->tm_info.num_tc; i++) { +- for (j = 0; j < HNAE3_MAX_USER_PRIO; j++) { +- if ((prio_tc[j] == i) && (pfc_map & BIT(i))) +- pfc->pfc_en |= BIT(j); +- } +- } ++ pfc->pfc_en = hdev->tm_info.pfc_en; + + ret = hclge_pfc_tx_stats_get(hdev, requests); + if (ret) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 93f3865b679bf..aa402e2671212 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -8006,7 +8006,11 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev) + static void hclge_add_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id, + bool writen_to_tbl) + { +- struct hclge_vport_vlan_cfg *vlan; ++ struct hclge_vport_vlan_cfg *vlan, *tmp; ++ ++ list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) ++ if (vlan->vlan_id == vlan_id) ++ return; + + vlan = kzalloc(sizeof(*vlan), GFP_KERNEL); + if (!vlan) +@@ -9165,6 +9169,28 @@ static void hclge_clear_resetting_state(struct hclge_dev *hdev) + } + } + ++static int hclge_clear_hw_resource(struct hclge_dev *hdev) ++{ ++ struct hclge_desc desc; ++ int ret; ++ ++ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CLEAR_HW_RESOURCE, false); ++ ++ ret = hclge_cmd_send(&hdev->hw, &desc, 1); ++ /* This new command is only supported by new firmware, it will ++ * fail with older firmware. Error value -EOPNOSUPP can only be ++ * returned by older firmware running this command, to keep code ++ * backward compatible we will override this value and return ++ * success. ++ */ ++ if (ret && ret != -EOPNOTSUPP) { ++ dev_err(&hdev->pdev->dev, ++ "failed to clear hw resource, ret = %d\n", ret); ++ return ret; ++ } ++ return 0; ++} ++ + static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) + { + struct pci_dev *pdev = ae_dev->pdev; +@@ -9206,6 +9232,10 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) + if (ret) + goto err_cmd_uninit; + ++ ret = hclge_clear_hw_resource(hdev); ++ if (ret) ++ goto err_cmd_uninit; ++ + ret = hclge_get_cap(hdev); + if (ret) { + dev_err(&pdev->dev, "get hw capability error, ret = %d.\n", +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index a1fab77b2096a..58ff747a42ae6 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -995,6 +995,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + { + u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | + link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; ++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ ++ u16 lat_enc_d = 0; /* latency decoded */ + u16 lat_enc = 0; /* latency encoded */ + + if (link) { +@@ -1048,7 +1050,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop); + max_ltr_enc = max_t(u16, max_snoop, max_nosnoop); + +- if (lat_enc > max_ltr_enc) ++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((lat_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ if (lat_enc_d > max_ltr_enc_d) + lat_enc = max_ltr_enc; + } + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index 1502895eb45dd..e757896287eba 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -274,8 +274,11 @@ + + /* Latency Tolerance Reporting */ + #define E1000_LTRV 0x000F8 ++#define E1000_LTRV_VALUE_MASK 0x000003FF + #define E1000_LTRV_SCALE_MAX 5 + #define E1000_LTRV_SCALE_FACTOR 5 ++#define E1000_LTRV_SCALE_SHIFT 10 ++#define E1000_LTRV_SCALE_MASK 0x00001C00 + #define E1000_LTRV_REQ_SHIFT 15 + #define E1000_LTRV_NOSNOOP_SHIFT 16 + #define E1000_LTRV_SEND (1 << 30) +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 7b0543056b101..64aa5510e61a6 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -101,7 +101,7 @@ + #define MVNETA_DESC_SWAP BIT(6) + #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22) + #define MVNETA_PORT_STATUS 0x2444 +-#define MVNETA_TX_IN_PRGRS BIT(1) ++#define MVNETA_TX_IN_PRGRS BIT(0) + #define MVNETA_TX_FIFO_EMPTY BIT(8) + #define MVNETA_RX_MIN_FRAME_SIZE 0x247c + /* Only exists on Armada XP and Armada 370 */ +diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +index 19a1a58d60f89..c449ecc0add23 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +@@ -353,6 +353,9 @@ static int qed_ll2_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie) + unsigned long flags; + int rc = -EINVAL; + ++ if (!p_ll2_conn) ++ return rc; ++ + spin_lock_irqsave(&p_tx->lock, flags); + if (p_tx->b_completing_packet) { + rc = -EBUSY; +@@ -526,7 +529,16 @@ static int qed_ll2_rxq_completion(struct qed_hwfn *p_hwfn, void *cookie) + unsigned long flags = 0; + int rc = 0; + ++ if (!p_ll2_conn) ++ return rc; ++ + spin_lock_irqsave(&p_rx->lock, flags); ++ ++ if (!QED_LL2_RX_REGISTERED(p_ll2_conn)) { ++ spin_unlock_irqrestore(&p_rx->lock, flags); ++ return 0; ++ } ++ + cq_new_idx = le16_to_cpu(*p_rx->p_fw_cons); + cq_old_idx = qed_chain_get_cons_idx(&p_rx->rcq_chain); + +@@ -847,6 +859,9 @@ static int qed_ll2_lb_rxq_completion(struct qed_hwfn *p_hwfn, void *p_cookie) + struct qed_ll2_info *p_ll2_conn = (struct qed_ll2_info *)p_cookie; + int rc; + ++ if (!p_ll2_conn) ++ return 0; ++ + if (!QED_LL2_RX_REGISTERED(p_ll2_conn)) + return 0; + +@@ -870,6 +885,9 @@ static int qed_ll2_lb_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie) + u16 new_idx = 0, num_bds = 0; + int rc; + ++ if (!p_ll2_conn) ++ return 0; ++ + if (!QED_LL2_TX_REGISTERED(p_ll2_conn)) + return 0; + +@@ -1642,6 +1660,8 @@ int qed_ll2_post_rx_buffer(void *cxt, + if (!p_ll2_conn) + return -EINVAL; + p_rx = &p_ll2_conn->rx_queue; ++ if (!p_rx->set_prod_addr) ++ return -EIO; + + spin_lock_irqsave(&p_rx->lock, flags); + if (!list_empty(&p_rx->free_descq)) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +index 38b1f402f7ed2..b291971bcf926 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +@@ -1245,8 +1245,7 @@ qed_rdma_create_qp(void *rdma_cxt, + + if (!rdma_cxt || !in_params || !out_params || + !p_hwfn->p_rdma_info->active) { +- DP_ERR(p_hwfn->cdev, +- "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n", ++ pr_err("qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n", + rdma_cxt, in_params, out_params); + return NULL; + } +diff --git a/drivers/opp/of.c b/drivers/opp/of.c +index 249738e1e0b7a..603c688fe23dc 100644 +--- a/drivers/opp/of.c ++++ b/drivers/opp/of.c +@@ -682,8 +682,9 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table) + } + } + +- /* There should be one of more OPP defined */ +- if (WARN_ON(!count)) { ++ /* There should be one or more OPPs defined */ ++ if (!count) { ++ dev_err(dev, "%s: no supported OPPs", __func__); + ret = -ENOENT; + goto remove_static_opp; + } +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 11592ec7b23ea..6aeb79e744e0b 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -788,12 +788,15 @@ store_state_field(struct device *dev, struct device_attribute *attr, + ret = scsi_device_set_state(sdev, state); + /* + * If the device state changes to SDEV_RUNNING, we need to +- * rescan the device to revalidate it, and run the queue to +- * avoid I/O hang. ++ * run the queue to avoid I/O hang, and rescan the device ++ * to revalidate it. Running the queue first is necessary ++ * because another thread may be waiting inside ++ * blk_mq_freeze_queue_wait() and because that call may be ++ * waiting for pending I/O to finish. + */ + if (ret == 0 && state == SDEV_RUNNING) { +- scsi_rescan_device(dev); + blk_mq_run_hw_queues(sdev->request_queue, true); ++ scsi_rescan_device(dev); + } + mutex_unlock(&sdev->state_mutex); + +diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c +index b5d2ad900ec09..167c72726c5a0 100644 +--- a/drivers/tty/vt/vt_ioctl.c ++++ b/drivers/tty/vt/vt_ioctl.c +@@ -484,16 +484,19 @@ int vt_ioctl(struct tty_struct *tty, + ret = -EINVAL; + goto out; + } +- /* FIXME: this needs the console lock extending */ +- if (vc->vc_mode == (unsigned char) arg) ++ console_lock(); ++ if (vc->vc_mode == (unsigned char) arg) { ++ console_unlock(); + break; ++ } + vc->vc_mode = (unsigned char) arg; +- if (console != fg_console) ++ if (console != fg_console) { ++ console_unlock(); + break; ++ } + /* + * explicitly blank/unblank the screen if switching modes + */ +- console_lock(); + if (arg == KD_TEXT) + do_unblank_screen(1); + else +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 8a3752fcf7b46..39a9ad12cbbc8 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -894,19 +894,19 @@ static struct dwc3_trb *dwc3_ep_prev_trb(struct dwc3_ep *dep, u8 index) + + static u32 dwc3_calc_trbs_left(struct dwc3_ep *dep) + { +- struct dwc3_trb *tmp; + u8 trbs_left; + + /* +- * If enqueue & dequeue are equal than it is either full or empty. +- * +- * One way to know for sure is if the TRB right before us has HWO bit +- * set or not. If it has, then we're definitely full and can't fit any +- * more transfers in our ring. ++ * If the enqueue & dequeue are equal then the TRB ring is either full ++ * or empty. It's considered full when there are DWC3_TRB_NUM-1 of TRBs ++ * pending to be processed by the driver. + */ + if (dep->trb_enqueue == dep->trb_dequeue) { +- tmp = dwc3_ep_prev_trb(dep, dep->trb_enqueue); +- if (tmp->ctrl & DWC3_TRB_CTRL_HWO) ++ /* ++ * If there is any request remained in the started_list at ++ * this point, that means there is no TRB available. ++ */ ++ if (!list_empty(&dep->started_list)) + return 0; + + return DWC3_TRB_NUM - 1; +@@ -2012,10 +2012,8 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + + ret = wait_for_completion_timeout(&dwc->ep0_in_setup, + msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT)); +- if (ret == 0) { +- dev_err(dwc->dev, "timed out waiting for SETUP phase\n"); +- return -ETIMEDOUT; +- } ++ if (ret == 0) ++ dev_warn(dwc->dev, "timed out waiting for SETUP phase\n"); + } + + /* +@@ -2217,6 +2215,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc) + /* begin to receive SETUP packets */ + dwc->ep0state = EP0_SETUP_PHASE; + dwc->link_state = DWC3_LINK_STATE_SS_DIS; ++ dwc->delayed_status = false; + dwc3_ep0_out_start(dwc); + + dwc3_gadget_enable_irq(dwc); +diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c +index 223029fa84459..4e01ba0ab8ecb 100644 +--- a/drivers/usb/gadget/function/u_audio.c ++++ b/drivers/usb/gadget/function/u_audio.c +@@ -349,8 +349,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + if (!prm->ep_enabled) + return; + +- prm->ep_enabled = false; +- + audio_dev = uac->audio_dev; + params = &audio_dev->params; + +@@ -368,11 +366,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + } + } + ++ prm->ep_enabled = false; ++ + if (usb_ep_disable(ep)) + dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__); + } + +- + int u_audio_start_capture(struct g_audio *audio_dev) + { + struct snd_uac_chip *uac = audio_dev->uac; +diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c +index e9c39a41faae9..a82ba9cc0c724 100644 +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -678,7 +678,6 @@ static struct usb_serial_driver ch341_device = { + .owner = THIS_MODULE, + .name = "ch341-uart", + }, +- .bulk_in_size = 512, + .id_table = id_table, + .num_ports = 1, + .open = ch341_open, +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 793530f241ceb..d42ca13569965 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2074,6 +2074,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 026a37ee41777..4653de001e261 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -331,7 +331,7 @@ __vringh_iov(struct vringh *vrh, u16 i, + iov = wiov; + else { + iov = riov; +- if (unlikely(wiov && wiov->i)) { ++ if (unlikely(wiov && wiov->used)) { + vringh_bad("Readable desc %p after writable", + &descs[i]); + err = -EINVAL; +diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c +index 222d630c41fc9..b35bb2d57f62c 100644 +--- a/drivers/virtio/virtio_pci_common.c ++++ b/drivers/virtio/virtio_pci_common.c +@@ -576,6 +576,13 @@ static void virtio_pci_remove(struct pci_dev *pci_dev) + struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev); + struct device *dev = get_device(&vp_dev->vdev.dev); + ++ /* ++ * Device is marked broken on surprise removal so that virtio upper ++ * layers can abort any ongoing operation. ++ */ ++ if (!pci_device_is_present(pci_dev)) ++ virtio_break_device(&vp_dev->vdev); ++ + pci_disable_sriov(pci_dev); + + unregister_virtio_device(&vp_dev->vdev); +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index f6011c9ed32f1..e442d400dbb2e 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -2268,7 +2268,7 @@ bool virtqueue_is_broken(struct virtqueue *_vq) + { + struct vring_virtqueue *vq = to_vvq(_vq); + +- return vq->broken; ++ return READ_ONCE(vq->broken); + } + EXPORT_SYMBOL_GPL(virtqueue_is_broken); + +@@ -2283,7 +2283,9 @@ void virtio_break_device(struct virtio_device *dev) + spin_lock(&dev->vqs_list_lock); + list_for_each_entry(_vq, &dev->vqs, list) { + struct vring_virtqueue *vq = to_vvq(_vq); +- vq->broken = true; ++ ++ /* Pairs with READ_ONCE() in virtqueue_is_broken(). */ ++ WRITE_ONCE(vq->broken, true); + } + spin_unlock(&dev->vqs_list_lock); + } +diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h +index f853835c409c1..f3ff57b931580 100644 +--- a/fs/btrfs/btrfs_inode.h ++++ b/fs/btrfs/btrfs_inode.h +@@ -268,6 +268,21 @@ static inline void btrfs_mod_outstanding_extents(struct btrfs_inode *inode, + mod); + } + ++/* ++ * Called every time after doing a buffered, direct IO or memory mapped write. ++ * ++ * This is to ensure that if we write to a file that was previously fsynced in ++ * the current transaction, then try to fsync it again in the same transaction, ++ * we will know that there were changes in the file and that it needs to be ++ * logged. ++ */ ++static inline void btrfs_set_inode_last_sub_trans(struct btrfs_inode *inode) ++{ ++ spin_lock(&inode->lock); ++ inode->last_sub_trans = inode->root->log_transid; ++ spin_unlock(&inode->lock); ++} ++ + static inline int btrfs_inode_in_log(struct btrfs_inode *inode, u64 generation) + { + int ret = 0; +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 400b0717b9d44..1279359ed172a 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -2004,14 +2004,8 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb, + + inode_unlock(inode); + +- /* +- * We also have to set last_sub_trans to the current log transid, +- * otherwise subsequent syncs to a file that's been synced in this +- * transaction will appear to have already occurred. +- */ +- spin_lock(&BTRFS_I(inode)->lock); +- BTRFS_I(inode)->last_sub_trans = root->log_transid; +- spin_unlock(&BTRFS_I(inode)->lock); ++ btrfs_set_inode_last_sub_trans(BTRFS_I(inode)); ++ + if (num_written > 0) + num_written = generic_write_sync(iocb, num_written); + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 54b607a3cc3f2..29552d4f6845b 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9250,9 +9250,7 @@ again: + set_page_dirty(page); + SetPageUptodate(page); + +- BTRFS_I(inode)->last_trans = fs_info->generation; +- BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid; +- BTRFS_I(inode)->last_log_commit = BTRFS_I(inode)->root->last_log_commit; ++ btrfs_set_inode_last_sub_trans(BTRFS_I(inode)); + + unlock_extent_cached(io_tree, page_start, page_end, &cached_state); + +diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h +index d8a7d460e436a..cbede328bda5b 100644 +--- a/fs/btrfs/transaction.h ++++ b/fs/btrfs/transaction.h +@@ -160,7 +160,7 @@ static inline void btrfs_set_inode_last_trans(struct btrfs_trans_handle *trans, + spin_lock(&BTRFS_I(inode)->lock); + BTRFS_I(inode)->last_trans = trans->transaction->transid; + BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid; +- BTRFS_I(inode)->last_log_commit = BTRFS_I(inode)->root->last_log_commit; ++ BTRFS_I(inode)->last_log_commit = BTRFS_I(inode)->last_sub_trans - 1; + spin_unlock(&BTRFS_I(inode)->lock); + } + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 3e3529c600cb7..e882c790292f9 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -2168,7 +2168,7 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path, + + if (IS_ERR(device)) { + if (PTR_ERR(device) == -ENOENT && +- strcmp(device_path, "missing") == 0) ++ device_path && strcmp(device_path, "missing") == 0) + ret = BTRFS_ERROR_DEV_MISSING_NOT_FOUND; + else + ret = PTR_ERR(device); +diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c +index 11dd8177770df..19574ef174709 100644 +--- a/fs/overlayfs/export.c ++++ b/fs/overlayfs/export.c +@@ -395,6 +395,7 @@ static struct dentry *ovl_lookup_real_one(struct dentry *connected, + */ + take_dentry_name_snapshot(&name, real); + this = lookup_one_len(name.name.name, connected, name.name.len); ++ release_dentry_name_snapshot(&name); + err = PTR_ERR(this); + if (IS_ERR(this)) { + goto fail; +@@ -409,7 +410,6 @@ static struct dentry *ovl_lookup_real_one(struct dentry *connected, + } + + out: +- release_dentry_name_snapshot(&name); + dput(parent); + inode_unlock(dir); + return this; +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 90d2f62a96723..5a187e9b72212 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -549,8 +549,17 @@ static int proc_oom_score(struct seq_file *m, struct pid_namespace *ns, + { + unsigned long totalpages = totalram_pages() + total_swap_pages; + unsigned long points = 0; ++ long badness; ++ ++ badness = oom_badness(task, totalpages); ++ /* ++ * Special case OOM_SCORE_ADJ_MIN for all others scale the ++ * badness value into [0, 2000] range which we have been ++ * exporting for a long time so userspace might depend on it. ++ */ ++ if (badness != LONG_MIN) ++ points = (1000 + badness * 1000 / (long)totalpages) * 2 / 3; + +- points = oom_badness(task, totalpages) * 1000 / totalpages; + seq_printf(m, "%lu\n", points); + + return 0; +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 11a52f2fa35de..ddc66ab8a1def 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3684,6 +3684,10 @@ int netdev_rx_handler_register(struct net_device *dev, + void netdev_rx_handler_unregister(struct net_device *dev); + + bool dev_valid_name(const char *name); ++static inline bool is_socket_ioctl_cmd(unsigned int cmd) ++{ ++ return _IOC_TYPE(cmd) == SOCK_IOC_TYPE; ++} + int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, + bool *need_copyout); + int dev_ifconf(struct net *net, struct ifconf *, int); +diff --git a/include/linux/once.h b/include/linux/once.h +index 9225ee6d96c75..ae6f4eb41cbe7 100644 +--- a/include/linux/once.h ++++ b/include/linux/once.h +@@ -7,7 +7,7 @@ + + bool __do_once_start(bool *done, unsigned long *flags); + void __do_once_done(bool *done, struct static_key_true *once_key, +- unsigned long *flags); ++ unsigned long *flags, struct module *mod); + + /* Call a function exactly once. The idea of DO_ONCE() is to perform + * a function call such as initialization of random seeds, etc, only +@@ -46,7 +46,7 @@ void __do_once_done(bool *done, struct static_key_true *once_key, + if (unlikely(___ret)) { \ + func(__VA_ARGS__); \ + __do_once_done(&___done, &___once_key, \ +- &___flags); \ ++ &___flags, THIS_MODULE); \ + } \ + } \ + ___ret; \ +diff --git a/include/linux/oom.h b/include/linux/oom.h +index b9df34326772c..2db9a14325112 100644 +--- a/include/linux/oom.h ++++ b/include/linux/oom.h +@@ -48,7 +48,7 @@ struct oom_control { + /* Used by oom implementation, do not set */ + unsigned long totalpages; + struct task_struct *chosen; +- unsigned long chosen_points; ++ long chosen_points; + + /* Used to print the constraint info. */ + enum oom_constraint constraint; +@@ -108,7 +108,7 @@ static inline vm_fault_t check_stable_address_space(struct mm_struct *mm) + + bool __oom_reap_task_mm(struct mm_struct *mm); + +-extern unsigned long oom_badness(struct task_struct *p, ++long oom_badness(struct task_struct *p, + unsigned long totalpages); + + extern bool out_of_memory(struct oom_control *oc); +diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c +index e49c912f862d0..9dec6314cd28a 100644 +--- a/kernel/audit_tree.c ++++ b/kernel/audit_tree.c +@@ -595,7 +595,6 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged) + spin_lock(&hash_lock); + } + spin_unlock(&hash_lock); +- put_tree(victim); + } + + /* +@@ -604,6 +603,7 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged) + static void prune_one(struct audit_tree *victim) + { + prune_tree_chunks(victim, false); ++ put_tree(victim); + } + + /* trim the uncommitted chunks from tree */ +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 0b5a446ee59c9..4deaf15b7618b 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -2778,6 +2778,41 @@ static void coerce_reg_to_size(struct bpf_reg_state *reg, int size) + reg->smax_value = reg->umax_value; + } + ++static bool bpf_map_is_rdonly(const struct bpf_map *map) ++{ ++ return (map->map_flags & BPF_F_RDONLY_PROG) && map->frozen; ++} ++ ++static int bpf_map_direct_read(struct bpf_map *map, int off, int size, u64 *val) ++{ ++ void *ptr; ++ u64 addr; ++ int err; ++ ++ err = map->ops->map_direct_value_addr(map, &addr, off); ++ if (err) ++ return err; ++ ptr = (void *)(long)addr + off; ++ ++ switch (size) { ++ case sizeof(u8): ++ *val = (u64)*(u8 *)ptr; ++ break; ++ case sizeof(u16): ++ *val = (u64)*(u16 *)ptr; ++ break; ++ case sizeof(u32): ++ *val = (u64)*(u32 *)ptr; ++ break; ++ case sizeof(u64): ++ *val = *(u64 *)ptr; ++ break; ++ default: ++ return -EINVAL; ++ } ++ return 0; ++} ++ + /* check whether memory at (regno + off) is accessible for t = (read | write) + * if t==write, value_regno is a register which value is stored into memory + * if t==read, value_regno is a register which will receive the value from memory +@@ -2815,9 +2850,27 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn + if (err) + return err; + err = check_map_access(env, regno, off, size, false); +- if (!err && t == BPF_READ && value_regno >= 0) +- mark_reg_unknown(env, regs, value_regno); ++ if (!err && t == BPF_READ && value_regno >= 0) { ++ struct bpf_map *map = reg->map_ptr; ++ ++ /* if map is read-only, track its contents as scalars */ ++ if (tnum_is_const(reg->var_off) && ++ bpf_map_is_rdonly(map) && ++ map->ops->map_direct_value_addr) { ++ int map_off = off + reg->var_off.value; ++ u64 val = 0; + ++ err = bpf_map_direct_read(map, map_off, size, ++ &val); ++ if (err) ++ return err; ++ ++ regs[value_regno].type = SCALAR_VALUE; ++ __mark_reg_known(®s[value_regno], val); ++ } else { ++ mark_reg_unknown(env, regs, value_regno); ++ } ++ } + } else if (reg->type == PTR_TO_CTX) { + enum bpf_reg_type reg_type = SCALAR_VALUE; + +diff --git a/lib/once.c b/lib/once.c +index 8b7d6235217ee..59149bf3bfb4a 100644 +--- a/lib/once.c ++++ b/lib/once.c +@@ -3,10 +3,12 @@ + #include + #include + #include ++#include + + struct once_work { + struct work_struct work; + struct static_key_true *key; ++ struct module *module; + }; + + static void once_deferred(struct work_struct *w) +@@ -16,10 +18,11 @@ static void once_deferred(struct work_struct *w) + work = container_of(w, struct once_work, work); + BUG_ON(!static_key_enabled(work->key)); + static_branch_disable(work->key); ++ module_put(work->module); + kfree(work); + } + +-static void once_disable_jump(struct static_key_true *key) ++static void once_disable_jump(struct static_key_true *key, struct module *mod) + { + struct once_work *w; + +@@ -29,6 +32,8 @@ static void once_disable_jump(struct static_key_true *key) + + INIT_WORK(&w->work, once_deferred); + w->key = key; ++ w->module = mod; ++ __module_get(mod); + schedule_work(&w->work); + } + +@@ -53,11 +58,11 @@ bool __do_once_start(bool *done, unsigned long *flags) + EXPORT_SYMBOL(__do_once_start); + + void __do_once_done(bool *done, struct static_key_true *once_key, +- unsigned long *flags) ++ unsigned long *flags, struct module *mod) + __releases(once_lock) + { + *done = true; + spin_unlock_irqrestore(&once_lock, *flags); +- once_disable_jump(once_key); ++ once_disable_jump(once_key, mod); + } + EXPORT_SYMBOL(__do_once_done); +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 212e718743018..f1b810ddf2327 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -197,17 +197,17 @@ static bool is_dump_unreclaim_slabs(void) + * predictable as possible. The goal is to return the highest value for the + * task consuming the most memory to avoid subsequent oom failures. + */ +-unsigned long oom_badness(struct task_struct *p, unsigned long totalpages) ++long oom_badness(struct task_struct *p, unsigned long totalpages) + { + long points; + long adj; + + if (oom_unkillable_task(p)) +- return 0; ++ return LONG_MIN; + + p = find_lock_task_mm(p); + if (!p) +- return 0; ++ return LONG_MIN; + + /* + * Do not even consider tasks which are explicitly marked oom +@@ -219,7 +219,7 @@ unsigned long oom_badness(struct task_struct *p, unsigned long totalpages) + test_bit(MMF_OOM_SKIP, &p->mm->flags) || + in_vfork(p)) { + task_unlock(p); +- return 0; ++ return LONG_MIN; + } + + /* +@@ -234,11 +234,7 @@ unsigned long oom_badness(struct task_struct *p, unsigned long totalpages) + adj *= totalpages / 1000; + points += adj; + +- /* +- * Never return 0 for an eligible task regardless of the root bonus and +- * oom_score_adj (oom_score_adj can't be OOM_SCORE_ADJ_MIN here). +- */ +- return points > 0 ? points : 1; ++ return points; + } + + static const char * const oom_constraint_text[] = { +@@ -311,7 +307,7 @@ static enum oom_constraint constrained_alloc(struct oom_control *oc) + static int oom_evaluate_task(struct task_struct *task, void *arg) + { + struct oom_control *oc = arg; +- unsigned long points; ++ long points; + + if (oom_unkillable_task(task)) + goto next; +@@ -337,12 +333,12 @@ static int oom_evaluate_task(struct task_struct *task, void *arg) + * killed first if it triggers an oom, then select it. + */ + if (oom_task_origin(task)) { +- points = ULONG_MAX; ++ points = LONG_MAX; + goto select; + } + + points = oom_badness(task, oc->totalpages); +- if (!points || points < oc->chosen_points) ++ if (points == LONG_MIN || points < oc->chosen_points) + goto next; + + select: +@@ -366,6 +362,8 @@ abort: + */ + static void select_bad_process(struct oom_control *oc) + { ++ oc->chosen_points = LONG_MIN; ++ + if (is_memcg_oom(oc)) + mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); + else { +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 0bad5db23129a..6fbc9cb09dc0e 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2414,6 +2414,7 @@ static int do_setlink(const struct sk_buff *skb, + return err; + + if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD] || tb[IFLA_TARGET_NETNSID]) { ++ const char *pat = ifname && ifname[0] ? ifname : NULL; + struct net *net = rtnl_link_get_net_capable(skb, dev_net(dev), + tb, CAP_NET_ADMIN); + if (IS_ERR(net)) { +@@ -2421,7 +2422,7 @@ static int do_setlink(const struct sk_buff *skb, + goto errout; + } + +- err = dev_change_net_namespace(dev, net, ifname); ++ err = dev_change_net_namespace(dev, net, pat); + put_net(net); + if (err) + goto errout; +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index fedad3a3e61b8..fd8298b8b1c52 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -446,6 +446,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + + static int gre_handle_offloads(struct sk_buff *skb, bool csum) + { ++ if (csum && skb_checksum_start(skb) < skb->data) ++ return -EINVAL; + return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); + } + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 4a988ce4264cb..4bcc36e4b2ef0 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -66,22 +66,17 @@ EXPORT_SYMBOL_GPL(nf_conntrack_hash); + + struct conntrack_gc_work { + struct delayed_work dwork; +- u32 last_bucket; ++ u32 next_bucket; + bool exiting; + bool early_drop; +- long next_gc_run; + }; + + static __read_mostly struct kmem_cache *nf_conntrack_cachep; + static DEFINE_SPINLOCK(nf_conntrack_locks_all_lock); + static __read_mostly bool nf_conntrack_locks_all; + +-/* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */ +-#define GC_MAX_BUCKETS_DIV 128u +-/* upper bound of full table scan */ +-#define GC_MAX_SCAN_JIFFIES (16u * HZ) +-/* desired ratio of entries found to be expired */ +-#define GC_EVICT_RATIO 50u ++#define GC_SCAN_INTERVAL (120u * HZ) ++#define GC_SCAN_MAX_DURATION msecs_to_jiffies(10) + + static struct conntrack_gc_work conntrack_gc_work; + +@@ -1226,17 +1221,13 @@ static void nf_ct_offload_timeout(struct nf_conn *ct) + + static void gc_worker(struct work_struct *work) + { +- unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u); +- unsigned int i, goal, buckets = 0, expired_count = 0; +- unsigned int nf_conntrack_max95 = 0; ++ unsigned long end_time = jiffies + GC_SCAN_MAX_DURATION; ++ unsigned int i, hashsz, nf_conntrack_max95 = 0; ++ unsigned long next_run = GC_SCAN_INTERVAL; + struct conntrack_gc_work *gc_work; +- unsigned int ratio, scanned = 0; +- unsigned long next_run; +- + gc_work = container_of(work, struct conntrack_gc_work, dwork.work); + +- goal = nf_conntrack_htable_size / GC_MAX_BUCKETS_DIV; +- i = gc_work->last_bucket; ++ i = gc_work->next_bucket; + if (gc_work->early_drop) + nf_conntrack_max95 = nf_conntrack_max / 100u * 95u; + +@@ -1244,22 +1235,21 @@ static void gc_worker(struct work_struct *work) + struct nf_conntrack_tuple_hash *h; + struct hlist_nulls_head *ct_hash; + struct hlist_nulls_node *n; +- unsigned int hashsz; + struct nf_conn *tmp; + +- i++; + rcu_read_lock(); + + nf_conntrack_get_ht(&ct_hash, &hashsz); +- if (i >= hashsz) +- i = 0; ++ if (i >= hashsz) { ++ rcu_read_unlock(); ++ break; ++ } + + hlist_nulls_for_each_entry_rcu(h, n, &ct_hash[i], hnnode) { + struct net *net; + + tmp = nf_ct_tuplehash_to_ctrack(h); + +- scanned++; + if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) { + nf_ct_offload_timeout(tmp); + continue; +@@ -1267,7 +1257,6 @@ static void gc_worker(struct work_struct *work) + + if (nf_ct_is_expired(tmp)) { + nf_ct_gc_expired(tmp); +- expired_count++; + continue; + } + +@@ -1299,7 +1288,14 @@ static void gc_worker(struct work_struct *work) + */ + rcu_read_unlock(); + cond_resched(); +- } while (++buckets < goal); ++ i++; ++ ++ if (time_after(jiffies, end_time) && i < hashsz) { ++ gc_work->next_bucket = i; ++ next_run = 0; ++ break; ++ } ++ } while (i < hashsz); + + if (gc_work->exiting) + return; +@@ -1310,40 +1306,17 @@ static void gc_worker(struct work_struct *work) + * + * This worker is only here to reap expired entries when system went + * idle after a busy period. +- * +- * The heuristics below are supposed to balance conflicting goals: +- * +- * 1. Minimize time until we notice a stale entry +- * 2. Maximize scan intervals to not waste cycles +- * +- * Normally, expire ratio will be close to 0. +- * +- * As soon as a sizeable fraction of the entries have expired +- * increase scan frequency. + */ +- ratio = scanned ? expired_count * 100 / scanned : 0; +- if (ratio > GC_EVICT_RATIO) { +- gc_work->next_gc_run = min_interval; +- } else { +- unsigned int max = GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV; +- +- BUILD_BUG_ON((GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV) == 0); +- +- gc_work->next_gc_run += min_interval; +- if (gc_work->next_gc_run > max) +- gc_work->next_gc_run = max; ++ if (next_run) { ++ gc_work->early_drop = false; ++ gc_work->next_bucket = 0; + } +- +- next_run = gc_work->next_gc_run; +- gc_work->last_bucket = i; +- gc_work->early_drop = false; + queue_delayed_work(system_power_efficient_wq, &gc_work->dwork, next_run); + } + + static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work) + { + INIT_DEFERRABLE_WORK(&gc_work->dwork, gc_worker); +- gc_work->next_gc_run = HZ; + gc_work->exiting = false; + } + +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index faea2ce125110..b97a786d048cc 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -314,7 +314,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) + goto err; + } + +- if (len != ALIGN(size, 4) + hdrlen) ++ if (!size || len != ALIGN(size, 4) + hdrlen) + goto err; + + if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA) +diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c +index 06ecf9d2d4bf1..ef6acd7211180 100644 +--- a/net/rds/ib_frmr.c ++++ b/net/rds/ib_frmr.c +@@ -131,9 +131,9 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr) + cpu_relax(); + } + +- ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_len, ++ ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len, + &off, PAGE_SIZE); +- if (unlikely(ret != ibmr->sg_len)) ++ if (unlikely(ret != ibmr->sg_dma_len)) + return ret < 0 ? ret : -EINVAL; + + if (cmpxchg(&frmr->fr_state, +diff --git a/net/socket.c b/net/socket.c +index b14917dd811ad..94358566c9d10 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1053,7 +1053,7 @@ static long sock_do_ioctl(struct net *net, struct socket *sock, + rtnl_unlock(); + if (!err && copy_to_user(argp, &ifc, sizeof(struct ifconf))) + err = -EFAULT; +- } else { ++ } else if (is_socket_ioctl_cmd(cmd)) { + struct ifreq ifr; + bool need_copyout; + if (copy_from_user(&ifr, argp, sizeof(struct ifreq))) +@@ -1062,6 +1062,8 @@ static long sock_do_ioctl(struct net *net, struct socket *sock, + if (!err && need_copyout) + if (copy_to_user(argp, &ifr, sizeof(struct ifreq))) + return -EFAULT; ++ } else { ++ err = -ENOTTY; + } + return err; + } +@@ -3228,6 +3230,8 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd, + struct ifreq ifreq; + u32 data32; + ++ if (!is_socket_ioctl_cmd(cmd)) ++ return -ENOTTY; + if (copy_from_user(ifreq.ifr_name, u_ifreq32->ifr_name, IFNAMSIZ)) + return -EFAULT; + if (get_user(data32, &u_ifreq32->ifr_data))