From 740c5f5d391736b105bb8a74374ec26d294a5137 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Mon, 26 Oct 2020 11:10:03 +0100 Subject: [PATCH] Odroid N2 legacy - fix broken patch and add upstream patches --- config/kernel/linux-meson64-legacy.config | 2 +- ...-indication-that-its-a-legacy-kernel.patch | 4 +- .../patch-4.9.238-239-changed.patch | 2076 +++++++++++++++++ .../meson64-legacy/patch-4.9.239-240.patch | 601 +++++ 4 files changed, 2680 insertions(+), 3 deletions(-) create mode 100644 patch/kernel/meson64-legacy/patch-4.9.238-239-changed.patch create mode 100644 patch/kernel/meson64-legacy/patch-4.9.239-240.patch diff --git a/config/kernel/linux-meson64-legacy.config b/config/kernel/linux-meson64-legacy.config index 3271bdaaed..4dfad5b351 100644 --- a/config/kernel/linux-meson64-legacy.config +++ b/config/kernel/linux-meson64-legacy.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.9.238 Kernel Configuration +# Linux/arm64 4.9.240 Kernel Configuration # CONFIG_ARM64=y CONFIG_64BIT=y diff --git a/patch/kernel/meson64-legacy/0002-Bootscript-needs-indication-that-its-a-legacy-kernel.patch b/patch/kernel/meson64-legacy/0002-Bootscript-needs-indication-that-its-a-legacy-kernel.patch index 92607ae7da..ba8408451e 100644 --- a/patch/kernel/meson64-legacy/0002-Bootscript-needs-indication-that-its-a-legacy-kernel.patch +++ b/patch/kernel/meson64-legacy/0002-Bootscript-needs-indication-that-its-a-legacy-kernel.patch @@ -13,9 +13,9 @@ index 8b15a0572..e7d1daa4e 100755 --- a/scripts/package/builddeb +++ b/scripts/package/builddeb @@ -268,7 +268,7 @@ rm -f /$installed_image_path - else + sed -e "s/exit 0//g" -i $tmpdir/DEBIAN/postinst + cat >> $tmpdir/DEBIAN/postinst < /dev/null 2>&1 || mv /$installed_image_path /boot/zImage - fi -touch /boot/.next +rm -f /boot/.next exit 0 diff --git a/patch/kernel/meson64-legacy/patch-4.9.238-239-changed.patch b/patch/kernel/meson64-legacy/patch-4.9.238-239-changed.patch new file mode 100644 index 0000000000..e7d89bac5b --- /dev/null +++ b/patch/kernel/meson64-legacy/patch-4.9.238-239-changed.patch @@ -0,0 +1,2076 @@ +diff --git a/Makefile b/Makefile +index 41a7d6626e354..82bb1b27d2f57 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 238 ++SUBLEVEL = 239 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 854d218ea76ac..ff59a1851cb4d 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -343,7 +343,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) + drv->bus->name, __func__, drv->name, dev_name(dev)); + if (!list_empty(&dev->devres_head)) { + dev_crit(dev, "Resources present before probing\n"); +- return -EBUSY; ++ ret = -EBUSY; ++ goto done; + } + + re_probe: +@@ -446,7 +447,7 @@ pinctrl_bind_failed: + ret = 0; + done: + atomic_dec(&probe_count); +- wake_up(&probe_waitqueue); ++ wake_up_all(&probe_waitqueue); + return ret; + } + +diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c +index 91f9b79e39411..9a9402f568ef6 100644 +--- a/drivers/clk/samsung/clk-exynos4.c ++++ b/drivers/clk/samsung/clk-exynos4.c +@@ -1060,7 +1060,7 @@ static const struct samsung_gate_clock exynos4210_gate_clks[] __initconst = { + GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0), + GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0), + GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0), +- GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0), ++ GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), + GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0, + CLK_IGNORE_UNUSED, 0), + GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0, +@@ -1101,7 +1101,7 @@ static const struct samsung_gate_clock exynos4x12_gate_clks[] __initconst = { + 0), + GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0), + GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0), +- GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0), ++ GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), + GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1, + CLK_IGNORE_UNUSED, 0), + GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0, +diff --git a/drivers/gpio/gpio-tc3589x.c b/drivers/gpio/gpio-tc3589x.c +index d6e21f1a70a9d..6cc7c5d59e460 100644 +--- a/drivers/gpio/gpio-tc3589x.c ++++ b/drivers/gpio/gpio-tc3589x.c +@@ -210,7 +210,7 @@ static void tc3589x_gpio_irq_sync_unlock(struct irq_data *d) + continue; + + tc3589x_gpio->oldregs[i][j] = new; +- tc3589x_reg_write(tc3589x, regmap[i] + j * 8, new); ++ tc3589x_reg_write(tc3589x, regmap[i] + j, new); + } + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index fdf7a18058881..fd97532bf7ebc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -283,7 +283,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set) + take the current one */ + if (active && !adev->have_disp_power_ref) { + adev->have_disp_power_ref = true; +- goto out; ++ return ret; + } + /* if we have no active crtcs, then drop the power ref + we got before */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 05ff98b43c50f..80c60a62d39ef 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -637,6 +637,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm) + + release_sg: + kfree(ttm->sg); ++ ttm->sg = NULL; + return r; + } + +diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c +index d89bde2c5da25..cf285b97a6422 100644 +--- a/drivers/i2c/busses/i2c-cpm.c ++++ b/drivers/i2c/busses/i2c-cpm.c +@@ -74,6 +74,9 @@ struct i2c_ram { + char res1[4]; /* Reserved */ + ushort rpbase; /* Relocation pointer */ + char res2[2]; /* Reserved */ ++ /* The following elements are only for CPM2 */ ++ char res3[4]; /* Reserved */ ++ uint sdmatmp; /* Internal */ + }; + + #define I2COM_START 0x80 +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index e5799639fb544..82ff44637ed78 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -797,6 +797,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = { + DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"), + }, + }, ++ { ++ /* Acer Aspire 5 A515 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"), ++ DMI_MATCH(DMI_BOARD_VENDOR, "PK"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c +index beef59eb94fa7..626b434e7967a 100644 +--- a/drivers/iommu/exynos-iommu.c ++++ b/drivers/iommu/exynos-iommu.c +@@ -1265,13 +1265,17 @@ static int exynos_iommu_of_xlate(struct device *dev, + return -ENODEV; + + data = platform_get_drvdata(sysmmu); +- if (!data) ++ if (!data) { ++ put_device(&sysmmu->dev); + return -ENODEV; ++ } + + if (!owner) { + owner = kzalloc(sizeof(*owner), GFP_KERNEL); +- if (!owner) ++ if (!owner) { ++ put_device(&sysmmu->dev); + return -ENOMEM; ++ } + + INIT_LIST_HEAD(&owner->controllers); + dev->archdata.iommu = owner; +diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c +index ddf3e24cc2898..2cf19372efb90 100644 +--- a/drivers/mtd/nand/sunxi_nand.c ++++ b/drivers/mtd/nand/sunxi_nand.c +@@ -2108,7 +2108,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc, + ret = mtd_device_register(mtd, NULL, 0); + if (ret) { + dev_err(dev, "failed to register mtd device: %d\n", ret); +- nand_release(nand); ++ nand_cleanup(nand); + return ret; + } + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 8322129c3f987..240d7850c8252 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1129,6 +1129,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev, + + bond_dev->type = slave_dev->type; + bond_dev->hard_header_len = slave_dev->hard_header_len; ++ bond_dev->needed_headroom = slave_dev->needed_headroom; + bond_dev->addr_len = slave_dev->addr_len; + + memcpy(bond_dev->broadcast, slave_dev->broadcast, +diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c +index cadcee645f74e..11ce50a057998 100644 +--- a/drivers/net/ethernet/dec/tulip/de2104x.c ++++ b/drivers/net/ethernet/dec/tulip/de2104x.c +@@ -91,7 +91,7 @@ MODULE_PARM_DESC (rx_copybreak, "de2104x Breakpoint at which Rx packets are copi + #define DSL CONFIG_DE2104X_DSL + #endif + +-#define DE_RX_RING_SIZE 64 ++#define DE_RX_RING_SIZE 128 + #define DE_TX_RING_SIZE 64 + #define DE_RING_BYTES \ + ((sizeof(struct de_desc) * DE_RX_RING_SIZE) + \ +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index a5de56bcbac08..93d3152752ff4 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1336,51 +1336,6 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler, + return error; + } + +-/* MDIO bus init function */ +-static int ravb_mdio_init(struct ravb_private *priv) +-{ +- struct platform_device *pdev = priv->pdev; +- struct device *dev = &pdev->dev; +- int error; +- +- /* Bitbang init */ +- priv->mdiobb.ops = &bb_ops; +- +- /* MII controller setting */ +- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); +- if (!priv->mii_bus) +- return -ENOMEM; +- +- /* Hook up MII support for ethtool */ +- priv->mii_bus->name = "ravb_mii"; +- priv->mii_bus->parent = dev; +- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", +- pdev->name, pdev->id); +- +- /* Register MDIO bus */ +- error = of_mdiobus_register(priv->mii_bus, dev->of_node); +- if (error) +- goto out_free_bus; +- +- return 0; +- +-out_free_bus: +- free_mdio_bitbang(priv->mii_bus); +- return error; +-} +- +-/* MDIO bus release function */ +-static int ravb_mdio_release(struct ravb_private *priv) +-{ +- /* Unregister mdio bus */ +- mdiobus_unregister(priv->mii_bus); +- +- /* Free bitbang info */ +- free_mdio_bitbang(priv->mii_bus); +- +- return 0; +-} +- + /* Network device open function for Ethernet AVB */ + static int ravb_open(struct net_device *ndev) + { +@@ -1389,13 +1344,6 @@ static int ravb_open(struct net_device *ndev) + struct device *dev = &pdev->dev; + int error; + +- /* MDIO bus init */ +- error = ravb_mdio_init(priv); +- if (error) { +- netdev_err(ndev, "failed to initialize MDIO\n"); +- return error; +- } +- + napi_enable(&priv->napi[RAVB_BE]); + napi_enable(&priv->napi[RAVB_NC]); + +@@ -1473,7 +1421,6 @@ out_free_irq: + out_napi_off: + napi_disable(&priv->napi[RAVB_NC]); + napi_disable(&priv->napi[RAVB_BE]); +- ravb_mdio_release(priv); + return error; + } + +@@ -1771,8 +1718,6 @@ static int ravb_close(struct net_device *ndev) + ravb_ring_free(ndev, RAVB_BE); + ravb_ring_free(ndev, RAVB_NC); + +- ravb_mdio_release(priv); +- + return 0; + } + +@@ -1875,6 +1820,51 @@ static const struct net_device_ops ravb_netdev_ops = { + .ndo_change_mtu = eth_change_mtu, + }; + ++/* MDIO bus init function */ ++static int ravb_mdio_init(struct ravb_private *priv) ++{ ++ struct platform_device *pdev = priv->pdev; ++ struct device *dev = &pdev->dev; ++ int error; ++ ++ /* Bitbang init */ ++ priv->mdiobb.ops = &bb_ops; ++ ++ /* MII controller setting */ ++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); ++ if (!priv->mii_bus) ++ return -ENOMEM; ++ ++ /* Hook up MII support for ethtool */ ++ priv->mii_bus->name = "ravb_mii"; ++ priv->mii_bus->parent = dev; ++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", ++ pdev->name, pdev->id); ++ ++ /* Register MDIO bus */ ++ error = of_mdiobus_register(priv->mii_bus, dev->of_node); ++ if (error) ++ goto out_free_bus; ++ ++ return 0; ++ ++out_free_bus: ++ free_mdio_bitbang(priv->mii_bus); ++ return error; ++} ++ ++/* MDIO bus release function */ ++static int ravb_mdio_release(struct ravb_private *priv) ++{ ++ /* Unregister mdio bus */ ++ mdiobus_unregister(priv->mii_bus); ++ ++ /* Free bitbang info */ ++ free_mdio_bitbang(priv->mii_bus); ++ ++ return 0; ++} ++ + static const struct of_device_id ravb_match_table[] = { + { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, + { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, +@@ -2079,6 +2069,13 @@ static int ravb_probe(struct platform_device *pdev) + eth_hw_addr_random(ndev); + } + ++ /* MDIO bus init */ ++ error = ravb_mdio_init(priv); ++ if (error) { ++ dev_err(&pdev->dev, "failed to initialize MDIO\n"); ++ goto out_dma_free; ++ } ++ + netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); + netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); + +@@ -2098,6 +2095,8 @@ static int ravb_probe(struct platform_device *pdev) + out_napi_del: + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); ++ ravb_mdio_release(priv); ++out_dma_free: + dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, + priv->desc_bat_dma); + +@@ -2130,6 +2129,7 @@ static int ravb_remove(struct platform_device *pdev) + unregister_netdev(ndev); + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); ++ ravb_mdio_release(priv); + pm_runtime_disable(&pdev->dev); + free_netdev(ndev); + platform_set_drvdata(pdev, NULL); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +index 3519a8a589dda..c8673e231a880 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +@@ -678,23 +678,16 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev, + struct stmmac_priv *priv = netdev_priv(dev); + int ret; + +- if (!edata->eee_enabled) { ++ if (!priv->dma_cap.eee) ++ return -EOPNOTSUPP; ++ ++ if (!edata->eee_enabled) + stmmac_disable_eee_mode(priv); +- } else { +- /* We are asking for enabling the EEE but it is safe +- * to verify all by invoking the eee_init function. +- * In case of failure it will return an error. +- */ +- edata->eee_enabled = stmmac_eee_init(priv); +- if (!edata->eee_enabled) +- return -EOPNOTSUPP; +- } + + ret = phy_ethtool_set_eee(dev->phydev, edata); + if (ret) + return ret; + +- priv->eee_enabled = edata->eee_enabled; + priv->tx_lpi_timer = edata->tx_lpi_timer; + return 0; + } +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 5defa29069ca3..774b9db0c811f 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -1087,6 +1087,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + struct macsec_rx_sa *rx_sa; + struct macsec_rxh_data *rxd; + struct macsec_dev *macsec; ++ unsigned int len; + sci_t sci; + u32 pn; + bool cbit; +@@ -1242,9 +1243,10 @@ deliver: + macsec_rxsc_put(rx_sc); + + skb_orphan(skb); ++ len = skb->len; + ret = gro_cells_receive(&macsec->gro_cells, skb); + if (ret == NET_RX_SUCCESS) +- count_rx(dev, skb->len); ++ count_rx(dev, len); + else + macsec->secy.netdev->stats.rx_dropped++; + +diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig +index 2651c8d8de2f8..032017bd0ced5 100644 +--- a/drivers/net/phy/Kconfig ++++ b/drivers/net/phy/Kconfig +@@ -135,6 +135,7 @@ config MDIO_THUNDER + depends on 64BIT + depends on PCI + select MDIO_CAVIUM ++ select MDIO_DEVRES + help + This driver supports the MDIO interfaces found on Cavium + ThunderX SoCs when the MDIO bus device appears as a PCI +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index cea6d2eabe7e6..001dea7aaba3d 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -299,7 +299,7 @@ inst_rollback: + for (i--; i >= 0; i--) + __team_option_inst_del_option(team, dst_opts[i]); + +- i = option_count - 1; ++ i = option_count; + alloc_rollback: + for (i--; i >= 0; i--) + kfree(dst_opts[i]); +@@ -2085,6 +2085,7 @@ static void team_setup_by_port(struct net_device *dev, + dev->header_ops = port_dev->header_ops; + dev->type = port_dev->type; + dev->hard_header_len = port_dev->hard_header_len; ++ dev->needed_headroom = port_dev->needed_headroom; + dev->addr_len = port_dev->addr_len; + dev->mtu = port_dev->mtu; + memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); +diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c +index 4f4f71b2966ba..9ccbdf1431063 100644 +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -213,7 +213,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen) + dev_dbg(&info->control->dev, + "rndis response error, code %d\n", retval); + } +- msleep(20); ++ msleep(40); + } + dev_dbg(&info->control->dev, "rndis response timeout\n"); + return -ETIMEDOUT; +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index 9504800217edd..4455493723681 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg) + return 1; + } + +-static inline void set_ethernet_addr(rtl8150_t * dev) ++static void set_ethernet_addr(rtl8150_t *dev) + { +- u8 node_id[6]; ++ u8 node_id[ETH_ALEN]; ++ int ret; ++ ++ ret = get_registers(dev, IDR, sizeof(node_id), node_id); + +- get_registers(dev, IDR, sizeof(node_id), node_id); +- memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id)); ++ if (ret == sizeof(node_id)) { ++ ether_addr_copy(dev->netdev->dev_addr, node_id); ++ } else { ++ eth_hw_addr_random(dev->netdev); ++ netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n", ++ dev->netdev->dev_addr); ++ } + } + + static int rtl8150_set_mac_address(struct net_device *netdev, void *p) +diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c +index 7f99fb666f196..1587789ba9343 100644 +--- a/drivers/net/wan/hdlc_cisco.c ++++ b/drivers/net/wan/hdlc_cisco.c +@@ -120,6 +120,7 @@ static void cisco_keepalive_send(struct net_device *dev, u32 type, + skb_put(skb, sizeof(struct cisco_packet)); + skb->priority = TC_PRIO_CONTROL; + skb->dev = dev; ++ skb->protocol = htons(ETH_P_HDLC); + skb_reset_network_header(skb); + + dev_queue_xmit(skb); +diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c +index b6e0cfb095d35..bba19d068207a 100644 +--- a/drivers/net/wan/hdlc_fr.c ++++ b/drivers/net/wan/hdlc_fr.c +@@ -435,6 +435,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev) + if (pvc->state.fecn) /* TX Congestion counter */ + dev->stats.tx_compressed++; + skb->dev = pvc->frad; ++ skb->protocol = htons(ETH_P_HDLC); ++ skb_reset_network_header(skb); + dev_queue_xmit(skb); + return NETDEV_TX_OK; + } +@@ -557,6 +559,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep) + skb_put(skb, i); + skb->priority = TC_PRIO_CONTROL; + skb->dev = dev; ++ skb->protocol = htons(ETH_P_HDLC); + skb_reset_network_header(skb); + + dev_queue_xmit(skb); +diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c +index 63546d1317982..35589ee0cde11 100644 +--- a/drivers/net/wan/hdlc_ppp.c ++++ b/drivers/net/wan/hdlc_ppp.c +@@ -254,6 +254,7 @@ static void ppp_tx_cp(struct net_device *dev, u16 pid, u8 code, + + skb->priority = TC_PRIO_CONTROL; + skb->dev = dev; ++ skb->protocol = htons(ETH_P_HDLC); + skb_reset_network_header(skb); + skb_queue_tail(&tx_queue, skb); + } +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index c6db9a4e7c457..ef746ba74ab4c 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -201,8 +201,6 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) + struct net_device *dev; + int size = skb->len; + +- skb->protocol = htons(ETH_P_X25); +- + ptr = skb_push(skb, 2); + + *ptr++ = size % 256; +@@ -213,6 +211,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) + + skb->dev = dev = lapbeth->ethdev; + ++ skb->protocol = htons(ETH_P_DEC); ++ + skb_reset_network_header(skb); + + dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0); +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index b65ce7519411a..379f9633f78e1 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -2476,7 +2476,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn, + */ + static int hotkey_kthread(void *data) + { +- struct tp_nvram_state s[2]; ++ struct tp_nvram_state s[2] = { 0 }; + u32 poll_mask, event_mask; + unsigned int si, so; + unsigned long t; +@@ -6640,8 +6640,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle) + list_for_each_entry(child, &device->children, node) { + acpi_status status = acpi_evaluate_object(child->handle, "_BCL", + NULL, &buffer); +- if (ACPI_FAILURE(status)) ++ if (ACPI_FAILURE(status)) { ++ buffer.length = ACPI_ALLOCATE_BUFFER; + continue; ++ } + + obj = (union acpi_object *)buffer.pointer; + if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) { +diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c +index b69747367bd75..0061bf130598e 100644 +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -1217,7 +1217,6 @@ static int ncm_unwrap_ntb(struct gether *port, + const struct ndp_parser_opts *opts = ncm->parser_opts; + unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0; + int dgram_counter; +- bool ndp_after_header; + + /* dwSignature */ + if (get_unaligned_le32(tmp) != opts->nth_sign) { +@@ -1244,7 +1243,6 @@ static int ncm_unwrap_ntb(struct gether *port, + } + + ndp_index = get_ncm(&tmp, opts->ndp_index); +- ndp_after_header = false; + + /* Run through all the NDP's in the NTB */ + do { +@@ -1260,8 +1258,6 @@ static int ncm_unwrap_ntb(struct gether *port, + ndp_index); + goto err; + } +- if (ndp_index == opts->nth_size) +- ndp_after_header = true; + + /* + * walk through NDP +@@ -1340,37 +1336,13 @@ static int ncm_unwrap_ntb(struct gether *port, + index2 = get_ncm(&tmp, opts->dgram_item_len); + dg_len2 = get_ncm(&tmp, opts->dgram_item_len); + +- if (index2 == 0 || dg_len2 == 0) +- break; +- + /* wDatagramIndex[1] */ +- if (ndp_after_header) { +- if (index2 < opts->nth_size + opts->ndp_size) { +- INFO(port->func.config->cdev, +- "Bad index: %#X\n", index2); +- goto err; +- } +- } else { +- if (index2 < opts->nth_size + opts->dpe_size) { +- INFO(port->func.config->cdev, +- "Bad index: %#X\n", index2); +- goto err; +- } +- } + if (index2 > block_len - opts->dpe_size) { + INFO(port->func.config->cdev, + "Bad index: %#X\n", index2); + goto err; + } + +- /* wDatagramLength[1] */ +- if ((dg_len2 < 14 + crc_len) || +- (dg_len2 > frame_max)) { +- INFO(port->func.config->cdev, +- "Bad dgram length: %#X\n", dg_len); +- goto err; +- } +- + /* + * Copy the data into a new skb. + * This ensures the truesize is correct +@@ -1387,6 +1359,8 @@ static int ncm_unwrap_ntb(struct gether *port, + ndp_len -= 2 * (opts->dgram_item_len * 2); + + dgram_counter++; ++ if (index2 == 0 || dg_len2 == 0) ++ break; + } while (ndp_len > 2 * (opts->dgram_item_len * 2)); + } while (ndp_index); + +diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c +index 4b7d0f9a820aa..44df6f6fd0636 100644 +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -2234,6 +2234,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + + if (font->width <= 8) { + j = vc->vc_font.height; ++ if (font->charcount * j > FNTSIZE(fontdata)) ++ return -EINVAL; ++ + for (i = 0; i < font->charcount; i++) { + memcpy(data, fontdata, j); + memset(data + j, 0, 32 - j); +@@ -2242,6 +2245,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + } + } else if (font->width <= 16) { + j = vc->vc_font.height * 2; ++ if (font->charcount * j > FNTSIZE(fontdata)) ++ return -EINVAL; ++ + for (i = 0; i < font->charcount; i++) { + memcpy(data, fontdata, j); + memset(data + j, 0, 64 - j); +@@ -2249,6 +2255,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + fontdata += j; + } + } else if (font->width <= 24) { ++ if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata)) ++ return -EINVAL; ++ + for (i = 0; i < font->charcount; i++) { + for (j = 0; j < vc->vc_font.height; j++) { + *data++ = fontdata[0]; +@@ -2261,6 +2270,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + } + } else { + j = vc->vc_font.height * 4; ++ if (font->charcount * j > FNTSIZE(fontdata)) ++ return -EINVAL; ++ + for (i = 0; i < font->charcount; i++) { + memcpy(data, fontdata, j); + memset(data + j, 0, 128 - j); +diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h +index 5ebdccd070eb8..701eecab33171 100644 +--- a/drivers/video/console/fbcon.h ++++ b/drivers/video/console/fbcon.h +@@ -151,13 +151,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc, + #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) + #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) + +-/* Font */ +-#define REFCOUNT(fd) (((int *)(fd))[-1]) +-#define FNTSIZE(fd) (((int *)(fd))[-2]) +-#define FNTCHARCNT(fd) (((int *)(fd))[-3]) +-#define FNTSUM(fd) (((int *)(fd))[-4]) +-#define FONT_EXTRA_WORDS 4 +- + /* + * Scroll Method + */ +diff --git a/drivers/video/console/fbcon_rotate.c b/drivers/video/console/fbcon_rotate.c +index db6528f2d3f29..0e33210819454 100644 +--- a/drivers/video/console/fbcon_rotate.c ++++ b/drivers/video/console/fbcon_rotate.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include "fbcon.h" + #include "fbcon_rotate.h" +diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c +index 33bddf3f30406..1a3a2f1d9817d 100644 +--- a/drivers/video/console/newport_con.c ++++ b/drivers/video/console/newport_con.c +@@ -35,12 +35,6 @@ + + #define FONT_DATA ((unsigned char *)font_vga_8x16.data) + +-/* borrowed from fbcon.c */ +-#define REFCOUNT(fd) (((int *)(fd))[-1]) +-#define FNTSIZE(fd) (((int *)(fd))[-2]) +-#define FNTCHARCNT(fd) (((int *)(fd))[-3]) +-#define FONT_EXTRA_WORDS 3 +- + static unsigned char *font_data[MAX_NR_CONSOLES]; + + static struct newport_regs *npregs; +@@ -522,6 +516,7 @@ static int newport_set_font(int unit, struct console_font *op) + FNTSIZE(new_data) = size; + FNTCHARCNT(new_data) = op->charcount; + REFCOUNT(new_data) = 0; /* usage counter */ ++ FNTSUM(new_data) = 0; + + p = new_data; + for (i = 0; i < op->charcount; i++) { +diff --git a/drivers/video/console/tileblit.c b/drivers/video/console/tileblit.c +index 3c0b242dba5f0..691717276c3e2 100644 +--- a/drivers/video/console/tileblit.c ++++ b/drivers/video/console/tileblit.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include "fbcon.h" + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 8c40d6652a9a9..865afb58266a7 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -222,8 +222,7 @@ struct eventpoll { + struct file *file; + + /* used to optimize loop detection check */ +- int visited; +- struct list_head visited_list_link; ++ u64 gen; + }; + + /* Wait structure used by the poll hooks */ +@@ -267,6 +266,8 @@ static long max_user_watches __read_mostly; + */ + static DEFINE_MUTEX(epmutex); + ++static u64 loop_check_gen = 0; ++ + /* Used to check for epoll file descriptor inclusion loops */ + static struct nested_calls poll_loop_ncalls; + +@@ -282,9 +283,6 @@ static struct kmem_cache *epi_cache __read_mostly; + /* Slab cache used to allocate "struct eppoll_entry" */ + static struct kmem_cache *pwq_cache __read_mostly; + +-/* Visited nodes during ep_loop_check(), so we can unset them when we finish */ +-static LIST_HEAD(visited_list); +- + /* + * List of files with newly added links, where we may need to limit the number + * of emanating paths. Protected by the epmutex. +@@ -1262,7 +1260,7 @@ static int reverse_path_check(void) + + static int ep_create_wakeup_source(struct epitem *epi) + { +- const char *name; ++ struct name_snapshot n; + struct wakeup_source *ws; + + if (!epi->ep->ws) { +@@ -1271,8 +1269,9 @@ static int ep_create_wakeup_source(struct epitem *epi) + return -ENOMEM; + } + +- name = epi->ffd.file->f_path.dentry->d_name.name; +- ws = wakeup_source_register(name); ++ take_dentry_name_snapshot(&n, epi->ffd.file->f_path.dentry); ++ ws = wakeup_source_register(n.name); ++ release_dentry_name_snapshot(&n); + + if (!ws) + return -ENOMEM; +@@ -1332,6 +1331,22 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, + RCU_INIT_POINTER(epi->ws, NULL); + } + ++ /* Add the current item to the list of active epoll hook for this file */ ++ spin_lock(&tfile->f_lock); ++ list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links); ++ spin_unlock(&tfile->f_lock); ++ ++ /* ++ * Add the current item to the RB tree. All RB tree operations are ++ * protected by "mtx", and ep_insert() is called with "mtx" held. ++ */ ++ ep_rbtree_insert(ep, epi); ++ ++ /* now check if we've created too many backpaths */ ++ error = -EINVAL; ++ if (full_check && reverse_path_check()) ++ goto error_remove_epi; ++ + /* Initialize the poll table using the queue callback */ + epq.epi = epi; + init_poll_funcptr(&epq.pt, ep_ptable_queue_proc); +@@ -1354,22 +1369,6 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, + if (epi->nwait < 0) + goto error_unregister; + +- /* Add the current item to the list of active epoll hook for this file */ +- spin_lock(&tfile->f_lock); +- list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links); +- spin_unlock(&tfile->f_lock); +- +- /* +- * Add the current item to the RB tree. All RB tree operations are +- * protected by "mtx", and ep_insert() is called with "mtx" held. +- */ +- ep_rbtree_insert(ep, epi); +- +- /* now check if we've created too many backpaths */ +- error = -EINVAL; +- if (full_check && reverse_path_check()) +- goto error_remove_epi; +- + /* We have to drop the new item inside our item list to keep track of it */ + spin_lock_irqsave(&ep->lock, flags); + +@@ -1395,6 +1394,8 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, + + return 0; + ++error_unregister: ++ ep_unregister_pollwait(ep, epi); + error_remove_epi: + spin_lock(&tfile->f_lock); + list_del_rcu(&epi->fllink); +@@ -1402,9 +1403,6 @@ error_remove_epi: + + rb_erase(&epi->rbn, &ep->rbr); + +-error_unregister: +- ep_unregister_pollwait(ep, epi); +- + /* + * We need to do this because an event could have been arrived on some + * allocated wait queue. Note that we don't care about the ep->ovflist +@@ -1725,13 +1723,12 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + struct epitem *epi; + + mutex_lock_nested(&ep->mtx, call_nests + 1); +- ep->visited = 1; +- list_add(&ep->visited_list_link, &visited_list); ++ ep->gen = loop_check_gen; + for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) { + epi = rb_entry(rbp, struct epitem, rbn); + if (unlikely(is_file_epoll(epi->ffd.file))) { + ep_tovisit = epi->ffd.file->private_data; +- if (ep_tovisit->visited) ++ if (ep_tovisit->gen == loop_check_gen) + continue; + error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, + ep_loop_check_proc, epi->ffd.file, +@@ -1772,18 +1769,8 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + */ + static int ep_loop_check(struct eventpoll *ep, struct file *file) + { +- int ret; +- struct eventpoll *ep_cur, *ep_next; +- +- ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, ++ return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, + ep_loop_check_proc, file, ep, current); +- /* clear visited list */ +- list_for_each_entry_safe(ep_cur, ep_next, &visited_list, +- visited_list_link) { +- ep_cur->visited = 0; +- list_del(&ep_cur->visited_list_link); +- } +- return ret; + } + + static void clear_tfile_check_list(void) +@@ -1940,6 +1927,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + mutex_lock_nested(&ep->mtx, 0); + if (op == EPOLL_CTL_ADD) { + if (!list_empty(&f.file->f_ep_links) || ++ ep->gen == loop_check_gen || + is_file_epoll(tf.file)) { + full_check = 1; + mutex_unlock(&ep->mtx); +@@ -2000,6 +1988,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + error_tgt_fput: + if (full_check) { + clear_tfile_check_list(); ++ loop_check_gen++; + mutex_unlock(&epmutex); + } + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 2517fcd423b68..d405b5a14073a 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -583,6 +583,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en + xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE); + + do { ++ if (entry->label) ++ entry->label->len = NFS4_MAXLABELLEN; ++ + status = xdr_decode(desc, entry, &stream); + if (status != 0) { + if (status == -EAGAIN) +diff --git a/include/linux/font.h b/include/linux/font.h +index d6821769dd1e1..f85e70bd4793e 100644 +--- a/include/linux/font.h ++++ b/include/linux/font.h +@@ -57,4 +57,17 @@ extern const struct font_desc *get_default_font(int xres, int yres, + /* Max. length for the name of a predefined font */ + #define MAX_FONT_NAME 32 + ++/* Extra word getters */ ++#define REFCOUNT(fd) (((int *)(fd))[-1]) ++#define FNTSIZE(fd) (((int *)(fd))[-2]) ++#define FNTCHARCNT(fd) (((int *)(fd))[-3]) ++#define FNTSUM(fd) (((int *)(fd))[-4]) ++ ++#define FONT_EXTRA_WORDS 4 ++ ++struct font_data { ++ unsigned int extra[FONT_EXTRA_WORDS]; ++ const unsigned char data[]; ++} __packed; ++ + #endif /* _VIDEO_FONT_H */ +diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h +index 1e032a1ddb3ea..60af12869ac7f 100644 +--- a/include/linux/khugepaged.h ++++ b/include/linux/khugepaged.h +@@ -13,6 +13,7 @@ extern int __khugepaged_enter(struct mm_struct *mm); + extern void __khugepaged_exit(struct mm_struct *mm); + extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma, + unsigned long vm_flags); ++extern void khugepaged_min_free_kbytes_update(void); + + #define khugepaged_enabled() \ + (transparent_hugepage_flags & \ +@@ -70,6 +71,10 @@ static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma, + { + return 0; + } ++ ++static inline void khugepaged_min_free_kbytes_update(void) ++{ ++} + #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + + #endif /* _LINUX_KHUGEPAGED_H */ +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 9e2f260cbb518..b2a405c93a342 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1726,21 +1726,17 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay + static inline int xfrm_replay_clone(struct xfrm_state *x, + struct xfrm_state *orig) + { +- x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), ++ ++ x->replay_esn = kmemdup(orig->replay_esn, ++ xfrm_replay_state_esn_len(orig->replay_esn), + GFP_KERNEL); + if (!x->replay_esn) + return -ENOMEM; +- +- x->replay_esn->bmp_len = orig->replay_esn->bmp_len; +- x->replay_esn->replay_window = orig->replay_esn->replay_window; +- +- x->preplay_esn = kmemdup(x->replay_esn, +- xfrm_replay_state_esn_len(x->replay_esn), ++ x->preplay_esn = kmemdup(orig->preplay_esn, ++ xfrm_replay_state_esn_len(orig->preplay_esn), + GFP_KERNEL); +- if (!x->preplay_esn) { +- kfree(x->replay_esn); ++ if (!x->preplay_esn) + return -ENOMEM; +- } + + return 0; + } +diff --git a/kernel/events/core.c b/kernel/events/core.c +index b562467d2d498..7aad4d22b4223 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -94,7 +94,7 @@ static void remote_function(void *data) + * retry due to any failures in smp_call_function_single(), such as if the + * task_cpu() goes offline concurrently. + * +- * returns @func return value or -ESRCH when the process isn't running ++ * returns @func return value or -ESRCH or -ENXIO when the process isn't running + */ + static int + task_function_call(struct task_struct *p, remote_function_f func, void *info) +@@ -110,7 +110,8 @@ task_function_call(struct task_struct *p, remote_function_f func, void *info) + for (;;) { + ret = smp_call_function_single(task_cpu(p), remote_function, + &data, 1); +- ret = !ret ? data.ret : -EAGAIN; ++ if (!ret) ++ ret = data.ret; + + if (ret != -EAGAIN) + break; +diff --git a/kernel/kmod.c b/kernel/kmod.c +index e4e5e98002fe3..3f3bbae4cec33 100644 +--- a/kernel/kmod.c ++++ b/kernel/kmod.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -222,6 +223,14 @@ static int call_usermodehelper_exec_async(void *data) + flush_signal_handlers(current, 1); + spin_unlock_irq(¤t->sighand->siglock); + ++ /* ++ * Initial kernel threads share ther FS with init, in order to ++ * get the init root directory. But we've now created a new ++ * thread that is going to execve a user process and has its own ++ * 'struct fs_struct'. Reset umask to the default. ++ */ ++ current->fs->umask = 0022; ++ + /* + * Our parent (unbound workqueue) runs with elevated scheduling + * priority. Avoid propagating that into the userspace child. +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 4d1be82e7011a..51e47e18764e3 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -5334,17 +5334,15 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip, + { + int bit; + +- if ((op->flags & FTRACE_OPS_FL_RCU) && !rcu_is_watching()) +- return; +- + bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX); + if (bit < 0) + return; + + preempt_disable_notrace(); + +- if (!(op->flags & FTRACE_OPS_FL_PER_CPU) || +- !ftrace_function_local_disabled(op)) { ++ if ((!(op->flags & FTRACE_OPS_FL_RCU) || rcu_is_watching()) && ++ (!(op->flags & FTRACE_OPS_FL_PER_CPU) || ++ !ftrace_function_local_disabled(op))) { + op->func(ip, parent_ip, op, regs); + } + +diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c +index 6be72bb218ee4..87e904f550c15 100644 +--- a/lib/fonts/font_10x18.c ++++ b/lib/fonts/font_10x18.c +@@ -7,8 +7,8 @@ + + #define FONTDATAMAX 9216 + +-static const unsigned char fontdata_10x18[FONTDATAMAX] = { +- ++static struct font_data fontdata_10x18 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, 0x00, /* 0000000000 */ + 0x00, 0x00, /* 0000000000 */ +@@ -5128,8 +5128,7 @@ static const unsigned char fontdata_10x18[FONTDATAMAX] = { + 0x00, 0x00, /* 0000000000 */ + 0x00, 0x00, /* 0000000000 */ + 0x00, 0x00, /* 0000000000 */ +- +-}; ++} }; + + + const struct font_desc font_10x18 = { +@@ -5137,7 +5136,7 @@ const struct font_desc font_10x18 = { + .name = "10x18", + .width = 10, + .height = 18, +- .data = fontdata_10x18, ++ .data = fontdata_10x18.data, + #ifdef __sparc__ + .pref = 5, + #else +diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c +index b20620904d314..896ffa987c97b 100644 +--- a/lib/fonts/font_6x10.c ++++ b/lib/fonts/font_6x10.c +@@ -1,7 +1,9 @@ + #include + +-static const unsigned char fontdata_6x10[] = { ++#define FONTDATAMAX 2560 + ++static struct font_data fontdata_6x10 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -3073,14 +3075,13 @@ static const unsigned char fontdata_6x10[] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + const struct font_desc font_6x10 = { + .idx = FONT6x10_IDX, + .name = "6x10", + .width = 6, + .height = 10, +- .data = fontdata_6x10, ++ .data = fontdata_6x10.data, + .pref = 0, + }; +diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c +index 46e86e67aa6aa..eb46a59307d2e 100644 +--- a/lib/fonts/font_6x11.c ++++ b/lib/fonts/font_6x11.c +@@ -8,8 +8,8 @@ + + #define FONTDATAMAX (11*256) + +-static const unsigned char fontdata_6x11[FONTDATAMAX] = { +- ++static struct font_data fontdata_6x11 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -3337,8 +3337,7 @@ static const unsigned char fontdata_6x11[FONTDATAMAX] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + + const struct font_desc font_vga_6x11 = { +@@ -3346,7 +3345,7 @@ const struct font_desc font_vga_6x11 = { + .name = "ProFont6x11", + .width = 6, + .height = 11, +- .data = fontdata_6x11, ++ .data = fontdata_6x11.data, + /* Try avoiding this font if possible unless on MAC */ + .pref = -2000, + }; +diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c +index 3b7dbf9c060b3..c88b3bba001bd 100644 +--- a/lib/fonts/font_7x14.c ++++ b/lib/fonts/font_7x14.c +@@ -7,8 +7,8 @@ + + #define FONTDATAMAX 3584 + +-static const unsigned char fontdata_7x14[FONTDATAMAX] = { +- ++static struct font_data fontdata_7x14 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 0000000 */ + 0x00, /* 0000000 */ +@@ -4104,8 +4104,7 @@ static const unsigned char fontdata_7x14[FONTDATAMAX] = { + 0x00, /* 0000000 */ + 0x00, /* 0000000 */ + 0x00, /* 0000000 */ +- +-}; ++} }; + + + const struct font_desc font_7x14 = { +@@ -4113,6 +4112,6 @@ const struct font_desc font_7x14 = { + .name = "7x14", + .width = 7, + .height = 14, +- .data = fontdata_7x14, ++ .data = fontdata_7x14.data, + .pref = 0, + }; +diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c +index 00a0c67a5c7d0..ba53e2643670b 100644 +--- a/lib/fonts/font_8x16.c ++++ b/lib/fonts/font_8x16.c +@@ -9,8 +9,8 @@ + + #define FONTDATAMAX 4096 + +-static const unsigned char fontdata_8x16[FONTDATAMAX] = { +- ++static struct font_data fontdata_8x16 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -4618,8 +4618,7 @@ static const unsigned char fontdata_8x16[FONTDATAMAX] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + + const struct font_desc font_vga_8x16 = { +@@ -4627,7 +4626,7 @@ const struct font_desc font_vga_8x16 = { + .name = "VGA8x16", + .width = 8, + .height = 16, +- .data = fontdata_8x16, ++ .data = fontdata_8x16.data, + .pref = 0, + }; + EXPORT_SYMBOL(font_vga_8x16); +diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c +index 9f56efe2cee72..4d28b81e8237c 100644 +--- a/lib/fonts/font_8x8.c ++++ b/lib/fonts/font_8x8.c +@@ -8,8 +8,8 @@ + + #define FONTDATAMAX 2048 + +-static const unsigned char fontdata_8x8[FONTDATAMAX] = { +- ++static struct font_data fontdata_8x8 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -2569,8 +2569,7 @@ static const unsigned char fontdata_8x8[FONTDATAMAX] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + + const struct font_desc font_vga_8x8 = { +@@ -2578,6 +2577,6 @@ const struct font_desc font_vga_8x8 = { + .name = "VGA8x8", + .width = 8, + .height = 8, +- .data = fontdata_8x8, ++ .data = fontdata_8x8.data, + .pref = 0, + }; +diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c +index 639e31ae1100a..957398b762d38 100644 +--- a/lib/fonts/font_acorn_8x8.c ++++ b/lib/fonts/font_acorn_8x8.c +@@ -2,7 +2,10 @@ + + #include + +-static const unsigned char acorndata_8x8[] = { ++#define FONTDATAMAX 2048 ++ ++static struct font_data acorndata_8x8 = { ++{ 0, 0, FONTDATAMAX, 0 }, { + /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */ + /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */ + /* 02 */ 0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */ +@@ -259,14 +262,14 @@ static const unsigned char acorndata_8x8[] = { + /* FD */ 0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00, + /* FE */ 0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00, + /* FF */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 +-}; ++} }; + + const struct font_desc font_acorn_8x8 = { + .idx = ACORN8x8_IDX, + .name = "Acorn8x8", + .width = 8, + .height = 8, +- .data = acorndata_8x8, ++ .data = acorndata_8x8.data, + #ifdef CONFIG_ARCH_ACORN + .pref = 20, + #else +diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c +index 838caa1cfef70..1449876c6a270 100644 +--- a/lib/fonts/font_mini_4x6.c ++++ b/lib/fonts/font_mini_4x6.c +@@ -43,8 +43,8 @@ __END__; + + #define FONTDATAMAX 1536 + +-static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = { +- ++static struct font_data fontdata_mini_4x6 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /*{*/ + /* Char 0: ' ' */ + 0xee, /*= [*** ] */ +@@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = { + 0xee, /*= [*** ] */ + 0x00, /*= [ ] */ + /*}*/ +-}; ++} }; + + const struct font_desc font_mini_4x6 = { + .idx = MINI4x6_IDX, + .name = "MINI4x6", + .width = 4, + .height = 6, +- .data = fontdata_mini_4x6, ++ .data = fontdata_mini_4x6.data, + .pref = 3, + }; + +diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c +index dc6ad539ca4e4..4649314333bb0 100644 +--- a/lib/fonts/font_pearl_8x8.c ++++ b/lib/fonts/font_pearl_8x8.c +@@ -13,8 +13,8 @@ + + #define FONTDATAMAX 2048 + +-static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = { +- ++static struct font_data fontdata_pearl8x8 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -2574,14 +2574,13 @@ static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + const struct font_desc font_pearl_8x8 = { + .idx = PEARL8x8_IDX, + .name = "PEARL8x8", + .width = 8, + .height = 8, +- .data = fontdata_pearl8x8, ++ .data = fontdata_pearl8x8.data, + .pref = 2, + }; +diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c +index d3643853c33af..c6967cdf4207b 100644 +--- a/lib/fonts/font_sun12x22.c ++++ b/lib/fonts/font_sun12x22.c +@@ -2,8 +2,8 @@ + + #define FONTDATAMAX 11264 + +-static const unsigned char fontdata_sun12x22[FONTDATAMAX] = { +- ++static struct font_data fontdata_sun12x22 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, 0x00, /* 000000000000 */ + 0x00, 0x00, /* 000000000000 */ +@@ -6147,8 +6147,7 @@ static const unsigned char fontdata_sun12x22[FONTDATAMAX] = { + 0x00, 0x00, /* 000000000000 */ + 0x00, 0x00, /* 000000000000 */ + 0x00, 0x00, /* 000000000000 */ +- +-}; ++} }; + + + const struct font_desc font_sun_12x22 = { +@@ -6156,7 +6155,7 @@ const struct font_desc font_sun_12x22 = { + .name = "SUN12x22", + .width = 12, + .height = 22, +- .data = fontdata_sun12x22, ++ .data = fontdata_sun12x22.data, + #ifdef __sparc__ + .pref = 5, + #else +diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c +index 268151325b83e..7d979e5788999 100644 +--- a/lib/fonts/font_sun8x16.c ++++ b/lib/fonts/font_sun8x16.c +@@ -2,7 +2,8 @@ + + #define FONTDATAMAX 4096 + +-static const unsigned char fontdata_sun8x16[FONTDATAMAX] = { ++static struct font_data fontdata_sun8x16 = { ++{ 0, 0, FONTDATAMAX, 0 }, { + /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00, +@@ -259,14 +260,14 @@ static const unsigned char fontdata_sun8x16[FONTDATAMAX] = { + /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, +-}; ++} }; + + const struct font_desc font_sun_8x16 = { + .idx = SUN8x16_IDX, + .name = "SUN8x16", + .width = 8, + .height = 16, +- .data = fontdata_sun8x16, ++ .data = fontdata_sun8x16.data, + #ifdef __sparc__ + .pref = 10, + #else +diff --git a/lib/random32.c b/lib/random32.c +index 889dab44bd747..d5c3137d93f49 100644 +--- a/lib/random32.c ++++ b/lib/random32.c +@@ -47,7 +47,7 @@ static inline void prandom_state_selftest(void) + } + #endif + +-DEFINE_PER_CPU(struct rnd_state, net_rand_state); ++DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy; + + /** + * prandom_u32_state - seeded pseudo-random number generator. +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 1538e5e5c628a..753b0e2fef368 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -50,6 +50,9 @@ enum scan_result { + #define CREATE_TRACE_POINTS + #include + ++static struct task_struct *khugepaged_thread __read_mostly; ++static DEFINE_MUTEX(khugepaged_mutex); ++ + /* default scan 8*512 pte (or vmas) every 30 second */ + static unsigned int khugepaged_pages_to_scan __read_mostly; + static unsigned int khugepaged_pages_collapsed; +@@ -802,6 +805,18 @@ static struct page *khugepaged_alloc_hugepage(bool *wait) + + static bool khugepaged_prealloc_page(struct page **hpage, bool *wait) + { ++ /* ++ * If the hpage allocated earlier was briefly exposed in page cache ++ * before collapse_file() failed, it is possible that racing lookups ++ * have not yet completed, and would then be unpleasantly surprised by ++ * finding the hpage reused for the same mapping at a different offset. ++ * Just release the previous allocation if there is any danger of that. ++ */ ++ if (*hpage && page_count(*hpage) > 1) { ++ put_page(*hpage); ++ *hpage = NULL; ++ } ++ + if (!*hpage) + *hpage = khugepaged_alloc_hugepage(wait); + +@@ -1936,8 +1951,6 @@ static void set_recommended_min_free_kbytes(void) + + int start_stop_khugepaged(void) + { +- static struct task_struct *khugepaged_thread __read_mostly; +- static DEFINE_MUTEX(khugepaged_mutex); + int err = 0; + + mutex_lock(&khugepaged_mutex); +@@ -1964,3 +1977,11 @@ fail: + mutex_unlock(&khugepaged_mutex); + return err; + } ++ ++void khugepaged_min_free_kbytes_update(void) ++{ ++ mutex_lock(&khugepaged_mutex); ++ if (khugepaged_enabled() && khugepaged_thread) ++ set_recommended_min_free_kbytes(); ++ mutex_unlock(&khugepaged_mutex); ++} +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 458523bc73916..b0c451e3b59f3 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -64,6 +64,7 @@ + #include + #include + #include ++#include + #ifdef CONFIG_AMLOGIC_PAGE_TRACE + #include + #endif /* CONFIG_AMLOGIC_PAGE_TRACE */ +@@ -6785,6 +6786,8 @@ int __meminit init_per_zone_wmark_min(void) + setup_min_slab_ratio(); + #endif + ++ khugepaged_min_free_kbytes_update(); ++ + return 0; + } + postcore_initcall(init_per_zone_wmark_min) +diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c +index 43e45bb660bcd..b1d3fa708e16b 100644 +--- a/net/mac80211/vht.c ++++ b/net/mac80211/vht.c +@@ -170,10 +170,7 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata, + /* take some capabilities as-is */ + cap_info = le32_to_cpu(vht_cap_ie->vht_cap_info); + vht_cap->cap = cap_info; +- vht_cap->cap &= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895 | +- IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 | +- IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 | +- IEEE80211_VHT_CAP_RXLDPC | ++ vht_cap->cap &= IEEE80211_VHT_CAP_RXLDPC | + IEEE80211_VHT_CAP_VHT_TXOP_PS | + IEEE80211_VHT_CAP_HTC_VHT | + IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK | +@@ -182,6 +179,9 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata, + IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN | + IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN; + ++ vht_cap->cap |= min_t(u32, cap_info & IEEE80211_VHT_CAP_MAX_MPDU_MASK, ++ own_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK); ++ + /* and some based on our own capabilities */ + switch (own_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) { + case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ: +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 5e28702c801fd..a25be03f60f59 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -1031,6 +1031,8 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[], + if (!tb[CTA_TUPLE_IP]) + return -EINVAL; + ++ if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6) ++ return -EOPNOTSUPP; + tuple->src.l3num = l3num; + + err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple); +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index beb2897d8ddf5..cff76ffcaac28 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -709,15 +709,19 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + } + err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); + +- if (err == NF_ACCEPT && +- ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { +- if (maniptype == NF_NAT_MANIP_SRC) +- maniptype = NF_NAT_MANIP_DST; +- else +- maniptype = NF_NAT_MANIP_SRC; +- +- err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, +- maniptype); ++ if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { ++ if (ct->status & IPS_SRC_NAT) { ++ if (maniptype == NF_NAT_MANIP_SRC) ++ maniptype = NF_NAT_MANIP_DST; ++ else ++ maniptype = NF_NAT_MANIP_SRC; ++ ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, ++ maniptype); ++ } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, ++ NF_NAT_MANIP_SRC); ++ } + } + + /* Mark NAT done if successful and update the flow key. */ +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index fb643945e4244..b5b79f5015415 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2161,7 +2161,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + int skb_len = skb->len; + unsigned int snaplen, res; + unsigned long status = TP_STATUS_USER; +- unsigned short macoff, netoff, hdrlen; ++ unsigned short macoff, hdrlen; ++ unsigned int netoff; + struct sk_buff *copy_skb = NULL; + struct timespec ts; + __u32 ts_status; +@@ -2223,6 +2224,12 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + } + macoff = netoff - maclen; + } ++ if (netoff > USHRT_MAX) { ++ spin_lock(&sk->sk_receive_queue.lock); ++ po->stats.stats1.tp_drops++; ++ spin_unlock(&sk->sk_receive_queue.lock); ++ goto drop_n_restore; ++ } + if (po->tp_version <= TPACKET_V2) { + if (macoff + snaplen > po->rx_ring.frame_size) { + if (po->copy_thresh && +diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c +index b099b64366f35..ec02dd7c12ef4 100644 +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -309,18 +309,18 @@ static int rxrpc_process_event(struct rxrpc_connection *conn, + return ret; + + spin_lock(&conn->channel_lock); +- spin_lock(&conn->state_lock); ++ spin_lock_bh(&conn->state_lock); + + if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) { + conn->state = RXRPC_CONN_SERVICE; +- spin_unlock(&conn->state_lock); ++ spin_unlock_bh(&conn->state_lock); + for (loop = 0; loop < RXRPC_MAXCALLS; loop++) + rxrpc_call_is_secure( + rcu_dereference_protected( + conn->channels[loop].call, + lockdep_is_held(&conn->channel_lock))); + } else { +- spin_unlock(&conn->state_lock); ++ spin_unlock_bh(&conn->state_lock); + } + + spin_unlock(&conn->channel_lock); +diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c +index 7fc340726d034..fa475b02bdceb 100644 +--- a/net/rxrpc/key.c ++++ b/net/rxrpc/key.c +@@ -899,7 +899,7 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen) + + _enter(""); + +- if (optlen <= 0 || optlen > PAGE_SIZE - 1) ++ if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities) + return -EINVAL; + + description = memdup_user_nul(optval, optlen); +@@ -1104,7 +1104,8 @@ static long rxrpc_read(const struct key *key, + break; + + default: /* we have a ticket we can't encode */ +- BUG(); ++ pr_err("Unsupported key token type (%u)\n", ++ token->security_index); + continue; + } + +@@ -1139,6 +1140,14 @@ static long rxrpc_read(const struct key *key, + goto fault; \ + xdr += (_l + 3) >> 2; \ + } while(0) ++#define ENCODE_BYTES(l, s) \ ++ do { \ ++ u32 _l = (l); \ ++ memcpy(xdr, (s), _l); \ ++ if (_l & 3) \ ++ memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \ ++ xdr += (_l + 3) >> 2; \ ++ } while(0) + #define ENCODE64(x) \ + do { \ + __be64 y = cpu_to_be64(x); \ +@@ -1167,7 +1176,7 @@ static long rxrpc_read(const struct key *key, + case RXRPC_SECURITY_RXKAD: + ENCODE(token->kad->vice_id); + ENCODE(token->kad->kvno); +- ENCODE_DATA(8, token->kad->session_key); ++ ENCODE_BYTES(8, token->kad->session_key); + ENCODE(token->kad->start); + ENCODE(token->kad->expiry); + ENCODE(token->kad->primary_flag); +@@ -1217,7 +1226,6 @@ static long rxrpc_read(const struct key *key, + break; + + default: +- BUG(); + break; + } + +diff --git a/net/sctp/auth.c b/net/sctp/auth.c +index f99d4855d3de3..6ab11ee3d3a56 100644 +--- a/net/sctp/auth.c ++++ b/net/sctp/auth.c +@@ -494,6 +494,7 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp) + out_err: + /* Clean up any successful allocations */ + sctp_auth_destroy_hmacs(ep->auth_hmacs); ++ ep->auth_hmacs = NULL; + return -ENOMEM; + } + +diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c +index 0bd5a60f3bdeb..67aba63b5c96d 100644 +--- a/net/vmw_vsock/virtio_transport.c ++++ b/net/vmw_vsock/virtio_transport.c +@@ -39,6 +39,7 @@ struct virtio_vsock { + * must be accessed with tx_lock held. + */ + struct mutex tx_lock; ++ bool tx_run; + + struct work_struct send_pkt_work; + spinlock_t send_pkt_list_lock; +@@ -50,6 +51,7 @@ struct virtio_vsock { + * must be accessed with rx_lock held. + */ + struct mutex rx_lock; ++ bool rx_run; + int rx_buf_nr; + int rx_buf_max_nr; + +@@ -57,24 +59,28 @@ struct virtio_vsock { + * vqs[VSOCK_VQ_EVENT] must be accessed with event_lock held. + */ + struct mutex event_lock; ++ bool event_run; + struct virtio_vsock_event event_list[8]; + + u32 guest_cid; + }; + +-static struct virtio_vsock *virtio_vsock_get(void) +-{ +- return the_virtio_vsock; +-} +- + static u32 virtio_transport_get_local_cid(void) + { +- struct virtio_vsock *vsock = virtio_vsock_get(); ++ struct virtio_vsock *vsock; ++ u32 ret; + +- if (!vsock) +- return VMADDR_CID_ANY; ++ rcu_read_lock(); ++ vsock = rcu_dereference(the_virtio_vsock); ++ if (!vsock) { ++ ret = VMADDR_CID_ANY; ++ goto out_rcu; ++ } + +- return vsock->guest_cid; ++ ret = vsock->guest_cid; ++out_rcu: ++ rcu_read_unlock(); ++ return ret; + } + + static void +@@ -88,6 +94,9 @@ virtio_transport_send_pkt_work(struct work_struct *work) + + mutex_lock(&vsock->tx_lock); + ++ if (!vsock->tx_run) ++ goto out; ++ + vq = vsock->vqs[VSOCK_VQ_TX]; + + for (;;) { +@@ -144,6 +153,7 @@ virtio_transport_send_pkt_work(struct work_struct *work) + if (added) + virtqueue_kick(vq); + ++out: + mutex_unlock(&vsock->tx_lock); + + if (restart_rx) +@@ -156,10 +166,12 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt) + struct virtio_vsock *vsock; + int len = pkt->len; + +- vsock = virtio_vsock_get(); ++ rcu_read_lock(); ++ vsock = rcu_dereference(the_virtio_vsock); + if (!vsock) { + virtio_transport_free_pkt(pkt); +- return -ENODEV; ++ len = -ENODEV; ++ goto out_rcu; + } + + if (pkt->reply) +@@ -170,6 +182,9 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt) + spin_unlock_bh(&vsock->send_pkt_list_lock); + + queue_work(virtio_vsock_workqueue, &vsock->send_pkt_work); ++ ++out_rcu: ++ rcu_read_unlock(); + return len; + } + +@@ -222,6 +237,10 @@ static void virtio_transport_tx_work(struct work_struct *work) + + vq = vsock->vqs[VSOCK_VQ_TX]; + mutex_lock(&vsock->tx_lock); ++ ++ if (!vsock->tx_run) ++ goto out; ++ + do { + struct virtio_vsock_pkt *pkt; + unsigned int len; +@@ -232,6 +251,8 @@ static void virtio_transport_tx_work(struct work_struct *work) + added = true; + } + } while (!virtqueue_enable_cb(vq)); ++ ++out: + mutex_unlock(&vsock->tx_lock); + + if (added) +@@ -260,6 +281,9 @@ static void virtio_transport_rx_work(struct work_struct *work) + + mutex_lock(&vsock->rx_lock); + ++ if (!vsock->rx_run) ++ goto out; ++ + do { + virtqueue_disable_cb(vq); + for (;;) { +@@ -368,6 +392,9 @@ static void virtio_transport_event_work(struct work_struct *work) + + mutex_lock(&vsock->event_lock); + ++ if (!vsock->event_run) ++ goto out; ++ + do { + struct virtio_vsock_event *event; + unsigned int len; +@@ -382,7 +409,7 @@ static void virtio_transport_event_work(struct work_struct *work) + } while (!virtqueue_enable_cb(vq)); + + virtqueue_kick(vsock->vqs[VSOCK_VQ_EVENT]); +- ++out: + mutex_unlock(&vsock->event_lock); + } + +@@ -478,7 +505,8 @@ static int virtio_vsock_probe(struct virtio_device *vdev) + return ret; + + /* Only one virtio-vsock device per guest is supported */ +- if (the_virtio_vsock) { ++ if (rcu_dereference_protected(the_virtio_vsock, ++ lockdep_is_held(&the_virtio_vsock_mutex))) { + ret = -EBUSY; + goto out; + } +@@ -502,8 +530,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev) + vsock->rx_buf_max_nr = 0; + atomic_set(&vsock->queued_replies, 0); + +- vdev->priv = vsock; +- the_virtio_vsock = vsock; + mutex_init(&vsock->tx_lock); + mutex_init(&vsock->rx_lock); + mutex_init(&vsock->event_lock); +@@ -514,14 +540,23 @@ static int virtio_vsock_probe(struct virtio_device *vdev) + INIT_WORK(&vsock->event_work, virtio_transport_event_work); + INIT_WORK(&vsock->send_pkt_work, virtio_transport_send_pkt_work); + ++ mutex_lock(&vsock->tx_lock); ++ vsock->tx_run = true; ++ mutex_unlock(&vsock->tx_lock); ++ + mutex_lock(&vsock->rx_lock); + virtio_vsock_rx_fill(vsock); ++ vsock->rx_run = true; + mutex_unlock(&vsock->rx_lock); + + mutex_lock(&vsock->event_lock); + virtio_vsock_event_fill(vsock); ++ vsock->event_run = true; + mutex_unlock(&vsock->event_lock); + ++ vdev->priv = vsock; ++ rcu_assign_pointer(the_virtio_vsock, vsock); ++ + mutex_unlock(&the_virtio_vsock_mutex); + return 0; + +@@ -536,6 +571,12 @@ static void virtio_vsock_remove(struct virtio_device *vdev) + struct virtio_vsock *vsock = vdev->priv; + struct virtio_vsock_pkt *pkt; + ++ mutex_lock(&the_virtio_vsock_mutex); ++ ++ vdev->priv = NULL; ++ rcu_assign_pointer(the_virtio_vsock, NULL); ++ synchronize_rcu(); ++ + flush_work(&vsock->rx_work); + flush_work(&vsock->tx_work); + flush_work(&vsock->event_work); +@@ -544,6 +585,24 @@ static void virtio_vsock_remove(struct virtio_device *vdev) + /* Reset all connected sockets when the device disappear */ + vsock_for_each_connected_socket(virtio_vsock_reset_sock); + ++ /* Stop all work handlers to make sure no one is accessing the device, ++ * so we can safely call vdev->config->reset(). ++ */ ++ mutex_lock(&vsock->rx_lock); ++ vsock->rx_run = false; ++ mutex_unlock(&vsock->rx_lock); ++ ++ mutex_lock(&vsock->tx_lock); ++ vsock->tx_run = false; ++ mutex_unlock(&vsock->tx_lock); ++ ++ mutex_lock(&vsock->event_lock); ++ vsock->event_run = false; ++ mutex_unlock(&vsock->event_lock); ++ ++ /* Flush all device writes and interrupts, device will not use any ++ * more buffers. ++ */ + vdev->config->reset(vdev); + + mutex_lock(&vsock->rx_lock); +@@ -565,12 +624,11 @@ static void virtio_vsock_remove(struct virtio_device *vdev) + } + spin_unlock_bh(&vsock->send_pkt_list_lock); + +- mutex_lock(&the_virtio_vsock_mutex); +- the_virtio_vsock = NULL; +- mutex_unlock(&the_virtio_vsock_mutex); +- ++ /* Delete virtqueues and flush outstanding callbacks if any */ + vdev->config->del_vqs(vdev); + ++ mutex_unlock(&the_virtio_vsock_mutex); ++ + kfree(vsock); + } + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index e107754e29a77..1eb77161d5e64 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3283,6 +3283,9 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) + if (err) + return err; + ++ if (key.idx < 0) ++ return -EINVAL; ++ + if (info->attrs[NL80211_ATTR_MAC]) + mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); + +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 3734ad56b456c..0eb85765d35a1 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -761,7 +761,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, + */ + if (x->km.state == XFRM_STATE_VALID) { + if ((x->sel.family && +- !xfrm_selector_match(&x->sel, fl, x->sel.family)) || ++ (x->sel.family != family || ++ !xfrm_selector_match(&x->sel, fl, family))) || + !security_xfrm_state_pol_flow_match(x, pol, fl)) + return; + +@@ -774,7 +775,9 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, + *acq_in_progress = 1; + } else if (x->km.state == XFRM_STATE_ERROR || + x->km.state == XFRM_STATE_EXPIRED) { +- if (xfrm_selector_match(&x->sel, fl, x->sel.family) && ++ if ((!x->sel.family || ++ (x->sel.family == family && ++ xfrm_selector_match(&x->sel, fl, family))) && + security_xfrm_state_pol_flow_match(x, pol, fl)) + *error = -ESRCH; + } +@@ -813,7 +816,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + tmpl->mode == x->props.mode && + tmpl->id.proto == x->id.proto && + (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) +- xfrm_state_look_at(pol, x, fl, encap_family, ++ xfrm_state_look_at(pol, x, fl, family, + &best, &acquire_in_progress, &error); + } + if (best || acquire_in_progress) +@@ -829,7 +832,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + tmpl->mode == x->props.mode && + tmpl->id.proto == x->id.proto && + (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) +- xfrm_state_look_at(pol, x, fl, encap_family, ++ xfrm_state_look_at(pol, x, fl, family, + &best, &acquire_in_progress, &error); + } + +@@ -1244,7 +1247,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig) + x->tfcpad = orig->tfcpad; + x->replay_maxdiff = orig->replay_maxdiff; + x->replay_maxage = orig->replay_maxage; +- x->curlft.add_time = orig->curlft.add_time; ++ memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft)); + x->km.state = orig->km.state; + x->km.seq = orig->km.seq; + x->replay = orig->replay; +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index cd2900ac473fc..280448114add1 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -633,7 +633,9 @@ repeat: + delay_msecs = top->delay_secs * MSEC_PER_SEC; + set_term_quiet_input(&save); + /* trash return*/ +- getc(stdin); ++ clearerr(stdin); ++ if (poll(&stdin_poll, 1, 0) > 0) ++ getc(stdin); + + while (!done) { + perf_top__print_sym_table(top); diff --git a/patch/kernel/meson64-legacy/patch-4.9.239-240.patch b/patch/kernel/meson64-legacy/patch-4.9.239-240.patch new file mode 100644 index 0000000000..b8c2f82e8a --- /dev/null +++ b/patch/kernel/meson64-legacy/patch-4.9.239-240.patch @@ -0,0 +1,601 @@ +diff --git a/Makefile b/Makefile +index 82bb1b27d2f57..a6a9d494dc18f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 239 ++SUBLEVEL = 240 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c +index 20f35df8a01fa..4f4884521a877 100644 +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -822,6 +822,11 @@ static int qat_alg_aead_dec(struct aead_request *areq) + struct icp_qat_fw_la_bulk_req *msg; + int digst_size = crypto_aead_authsize(aead_tfm); + int ret, ctr = 0; ++ u32 cipher_len; ++ ++ cipher_len = areq->cryptlen - digst_size; ++ if (cipher_len % AES_BLOCK_SIZE != 0) ++ return -EINVAL; + + ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); + if (unlikely(ret)) +@@ -836,7 +841,7 @@ static int qat_alg_aead_dec(struct aead_request *areq) + qat_req->req.comn_mid.src_data_addr = qat_req->buf.blp; + qat_req->req.comn_mid.dest_data_addr = qat_req->buf.bloutp; + cipher_param = (void *)&qat_req->req.serv_specif_rqpars; +- cipher_param->cipher_length = areq->cryptlen - digst_size; ++ cipher_param->cipher_length = cipher_len; + cipher_param->cipher_offset = areq->assoclen; + memcpy(cipher_param->u.cipher_IV_array, areq->iv, AES_BLOCK_SIZE); + auth_param = (void *)((uint8_t *)cipher_param + sizeof(*cipher_param)); +@@ -865,6 +870,9 @@ static int qat_alg_aead_enc(struct aead_request *areq) + uint8_t *iv = areq->iv; + int ret, ctr = 0; + ++ if (areq->cryptlen % AES_BLOCK_SIZE != 0) ++ return -EINVAL; ++ + ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); + if (unlikely(ret)) + return ret; +diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c +index d8ce7d75ff187..fcbabd2a41144 100644 +--- a/drivers/media/usb/usbtv/usbtv-core.c ++++ b/drivers/media/usb/usbtv/usbtv-core.c +@@ -110,7 +110,8 @@ static int usbtv_probe(struct usb_interface *intf, + + usbtv_audio_fail: + /* we must not free at this point */ +- usb_get_dev(usbtv->udev); ++ v4l2_device_get(&usbtv->v4l2_dev); ++ /* this will undo the v4l2_device_get() */ + usbtv_video_free(usbtv); + + usbtv_video_fail: +diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c +index 1800eb3ae0176..cdf86284dd047 100644 +--- a/drivers/staging/comedi/drivers/vmk80xx.c ++++ b/drivers/staging/comedi/drivers/vmk80xx.c +@@ -676,6 +676,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev) + if (!devpriv->ep_rx || !devpriv->ep_tx) + return -ENODEV; + ++ if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx)) ++ return -EINVAL; ++ + return 0; + } + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 838123dc390ca..c9f979063af13 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1032,6 +1032,11 @@ static const struct usb_device_id id_table_combined[] = { + /* U-Blox devices */ + { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, + { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, ++ /* FreeCalypso USB adapters */ ++ { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index c33e06752b5f0..f3302516a1e4f 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -38,6 +38,13 @@ + + #define FTDI_LUMEL_PD12_PID 0x6002 + ++/* ++ * Custom USB adapters made by Falconia Partners LLC ++ * for FreeCalypso project, ID codes allocated to Falconia by FTDI. ++ */ ++#define FTDI_FALCONIA_JTAG_BUF_PID 0x7150 ++#define FTDI_FALCONIA_JTAG_UNBUF_PID 0x7151 ++ + /* Sienna Serial Interface by Secyourit GmbH */ + #define FTDI_SIENNA_PID 0x8348 + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 8cff50ef4fd14..5017d37afe392 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -529,6 +529,7 @@ static void option_instat_callback(struct urb *urb); + /* Cellient products */ + #define CELLIENT_VENDOR_ID 0x2692 + #define CELLIENT_PRODUCT_MEN200 0x9005 ++#define CELLIENT_PRODUCT_MPL200 0x9025 + + /* Hyundai Petatel Inc. products */ + #define PETATEL_VENDOR_ID 0x1ff4 +@@ -1171,6 +1172,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff), /* Telit FN980 (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), +@@ -1967,6 +1970,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) }, + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, ++ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), ++ .driver_info = RSVD(1) | RSVD(4) }, + { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) }, + { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) }, + { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */ +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 4fcded2971d1d..bf5533d6d83bd 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -89,6 +89,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LD381GC_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 54d2fb974a418..9d27c076f477e 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -125,6 +125,7 @@ + + /* Hewlett-Packard POS Pole Displays */ + #define HP_VENDOR_ID 0x03f0 ++#define HP_LD381GC_PRODUCT_ID 0x0183 + #define HP_LM920_PRODUCT_ID 0x026b + #define HP_TD620_PRODUCT_ID 0x0956 + #define HP_LD960_PRODUCT_ID 0x0b39 +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index 9531b6c18ac7b..897154e993800 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -1554,11 +1554,7 @@ void reiserfs_read_locked_inode(struct inode *inode, + * set version 1, version 2 could be used too, because stat data + * key is the same in both versions + */ +- key.version = KEY_FORMAT_3_5; +- key.on_disk_key.k_dir_id = dirino; +- key.on_disk_key.k_objectid = inode->i_ino; +- key.on_disk_key.k_offset = 0; +- key.on_disk_key.k_type = 0; ++ _make_cpu_key(&key, KEY_FORMAT_3_5, dirino, inode->i_ino, 0, 0, 3); + + /* look for the object's stat data */ + retval = search_item(inode->i_sb, &key, &path_to_sd); +diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c +index 07900105523f0..645ee1bbd0255 100644 +--- a/fs/reiserfs/xattr.c ++++ b/fs/reiserfs/xattr.c +@@ -664,6 +664,13 @@ reiserfs_xattr_get(struct inode *inode, const char *name, void *buffer, + if (get_inode_sd_version(inode) == STAT_DATA_V1) + return -EOPNOTSUPP; + ++ /* ++ * priv_root needn't be initialized during mount so allow initial ++ * lookups to succeed. ++ */ ++ if (!REISERFS_SB(inode->i_sb)->priv_root) ++ return 0; ++ + dentry = xattr_lookup(inode, name, XATTR_REPLACE); + if (IS_ERR(dentry)) { + err = PTR_ERR(dentry); +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 57a7dba49d298..52b5352e8fe08 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1250,16 +1250,34 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) + conn->security_cfm_cb(conn, status); + } + +-static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status, +- __u8 encrypt) ++static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) + { + struct hci_cb *cb; ++ __u8 encrypt; ++ ++ if (conn->state == BT_CONFIG) { ++ if (!status) ++ conn->state = BT_CONNECTED; + +- if (conn->sec_level == BT_SECURITY_SDP) +- conn->sec_level = BT_SECURITY_LOW; ++ hci_connect_cfm(conn, status); ++ hci_conn_drop(conn); ++ return; ++ } + +- if (conn->pending_sec_level > conn->sec_level) +- conn->sec_level = conn->pending_sec_level; ++ if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) ++ encrypt = 0x00; ++ else if (test_bit(HCI_CONN_AES_CCM, &conn->flags)) ++ encrypt = 0x02; ++ else ++ encrypt = 0x01; ++ ++ if (!status) { ++ if (conn->sec_level == BT_SECURITY_SDP) ++ conn->sec_level = BT_SECURITY_LOW; ++ ++ if (conn->pending_sec_level > conn->sec_level) ++ conn->sec_level = conn->pending_sec_level; ++ } + + mutex_lock(&hci_cb_list_lock); + list_for_each_entry(cb, &hci_cb_list, list) { +diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h +index 5ee3c689c8637..9c50d458ee83b 100644 +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -619,6 +619,8 @@ struct l2cap_ops { + struct sk_buff *(*alloc_skb) (struct l2cap_chan *chan, + unsigned long hdr_len, + unsigned long len, int nb); ++ int (*filter) (struct l2cap_chan * chan, ++ struct sk_buff *skb); + }; + + struct l2cap_conn { +diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c +index 5f123c3320a7b..8f918155685db 100644 +--- a/net/bluetooth/a2mp.c ++++ b/net/bluetooth/a2mp.c +@@ -233,6 +233,9 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_info_req req; + + found = true; ++ ++ memset(&req, 0, sizeof(req)); ++ + req.id = cl->id; + a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr), + sizeof(req), &req); +@@ -312,6 +315,8 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb, + if (!hdev || hdev->dev_type != HCI_AMP) { + struct a2mp_info_rsp rsp; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.id = req->id; + rsp.status = A2MP_STATUS_INVALID_CTRL_ID; + +@@ -355,6 +360,8 @@ static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb, + if (!ctrl) + return -ENOMEM; + ++ memset(&req, 0, sizeof(req)); ++ + req.id = rsp->id; + a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req), + &req); +@@ -383,6 +390,8 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_amp_assoc_rsp rsp; + rsp.id = req->id; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + if (tmp) { + rsp.status = A2MP_STATUS_COLLISION_OCCURED; + amp_mgr_put(tmp); +@@ -471,7 +480,6 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_cmd *hdr) + { + struct a2mp_physlink_req *req = (void *) skb->data; +- + struct a2mp_physlink_rsp rsp; + struct hci_dev *hdev; + struct hci_conn *hcon; +@@ -482,6 +490,8 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + + BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.local_id = req->remote_id; + rsp.remote_id = req->local_id; + +@@ -560,6 +570,8 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + + BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.local_id = req->remote_id; + rsp.remote_id = req->local_id; + rsp.status = A2MP_STATUS_SUCCESS; +@@ -682,6 +694,8 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) + if (err) { + struct a2mp_cmd_rej rej; + ++ memset(&rej, 0, sizeof(rej)); ++ + rej.reason = cpu_to_le16(0); + hdr = (void *) skb->data; + +@@ -905,6 +919,8 @@ void a2mp_send_getinfo_rsp(struct hci_dev *hdev) + + BT_DBG("%s mgr %p", hdev->name, mgr); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.id = hdev->id; + rsp.status = A2MP_STATUS_INVALID_CTRL_ID; + +@@ -1002,6 +1018,8 @@ void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status) + if (!mgr) + return; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT); + if (!hs_hcon) { + rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; +@@ -1034,6 +1052,8 @@ void a2mp_discover_amp(struct l2cap_chan *chan) + + mgr->bredr_chan = chan; + ++ memset(&req, 0, sizeof(req)); ++ + req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); + req.ext_feat = 0; + a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 1d085eed72d0c..e3cd81ce2a7bb 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1163,6 +1163,23 @@ int hci_conn_check_link_mode(struct hci_conn *conn) + return 0; + } + ++ /* AES encryption is required for Level 4: ++ * ++ * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C ++ * page 1319: ++ * ++ * 128-bit equivalent strength for link and encryption keys ++ * required using FIPS approved algorithms (E0 not allowed, ++ * SAFER+ not allowed, and P-192 not allowed; encryption key ++ * not shortened) ++ */ ++ if (conn->sec_level == BT_SECURITY_FIPS && ++ !test_bit(HCI_CONN_AES_CCM, &conn->flags)) { ++ bt_dev_err(conn->hdev, ++ "Invalid security: Missing AES-CCM usage"); ++ return 0; ++ } ++ + if (hci_conn_ssp_enabled(conn) && + !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) + return 0; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index d6da119f5082e..1f5c48d1493c9 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -1133,6 +1133,9 @@ static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr, + { + struct discovery_state *d = &hdev->discovery; + ++ if (len > HCI_MAX_AD_LENGTH) ++ return; ++ + bacpy(&d->last_adv_addr, bdaddr); + d->last_adv_addr_type = bdaddr_type; + d->last_adv_rssi = rssi; +@@ -2490,7 +2493,7 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) + &cp); + } else { + clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); +- hci_encrypt_cfm(conn, ev->status, 0x00); ++ hci_encrypt_cfm(conn, ev->status); + } + } + +@@ -2576,22 +2579,7 @@ static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status, + conn->enc_key_size = rp->key_size; + } + +- if (conn->state == BT_CONFIG) { +- conn->state = BT_CONNECTED; +- hci_connect_cfm(conn, 0); +- hci_conn_drop(conn); +- } else { +- u8 encrypt; +- +- if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) +- encrypt = 0x00; +- else if (test_bit(HCI_CONN_AES_CCM, &conn->flags)) +- encrypt = 0x02; +- else +- encrypt = 0x01; +- +- hci_encrypt_cfm(conn, 0, encrypt); +- } ++ hci_encrypt_cfm(conn, 0); + + unlock: + hci_dev_unlock(hdev); +@@ -2638,27 +2626,23 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb) + + clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); + ++ /* Check link security requirements are met */ ++ if (!hci_conn_check_link_mode(conn)) ++ ev->status = HCI_ERROR_AUTH_FAILURE; ++ + if (ev->status && conn->state == BT_CONNECTED) { + if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING) + set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags); + ++ /* Notify upper layers so they can cleanup before ++ * disconnecting. ++ */ ++ hci_encrypt_cfm(conn, ev->status); + hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE); + hci_conn_drop(conn); + goto unlock; + } + +- /* In Secure Connections Only mode, do not allow any connections +- * that are not encrypted with AES-CCM using a P-256 authenticated +- * combination key. +- */ +- if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && +- (!test_bit(HCI_CONN_AES_CCM, &conn->flags) || +- conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) { +- hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE); +- hci_conn_drop(conn); +- goto unlock; +- } +- + /* Try reading the encryption key size for encrypted ACL links */ + if (!ev->status && ev->encrypt && conn->type == ACL_LINK) { + struct hci_cp_read_enc_key_size cp; +@@ -2688,14 +2672,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb) + } + + notify: +- if (conn->state == BT_CONFIG) { +- if (!ev->status) +- conn->state = BT_CONNECTED; +- +- hci_connect_cfm(conn, ev->status); +- hci_conn_drop(conn); +- } else +- hci_encrypt_cfm(conn, ev->status, ev->encrypt); ++ hci_encrypt_cfm(conn, ev->status); + + unlock: + hci_dev_unlock(hdev); +@@ -4779,6 +4756,11 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + return; + } + ++ if (len > HCI_MAX_AD_LENGTH) { ++ pr_err_ratelimited("legacy adv larger than 31 bytes"); ++ return; ++ } ++ + /* Find the end of the data in case the report contains padded zero + * bytes at the end causing an invalid length value. + * +@@ -4839,7 +4821,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + */ + conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type, + direct_addr); +- if (conn && type == LE_ADV_IND) { ++ if (conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) { + /* Store report for later inclusion by + * mgmt_device_connected + */ +@@ -4964,10 +4946,14 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) + struct hci_ev_le_advertising_info *ev = ptr; + s8 rssi; + +- rssi = ev->data[ev->length]; +- process_adv_report(hdev, ev->evt_type, &ev->bdaddr, +- ev->bdaddr_type, NULL, 0, rssi, +- ev->data, ev->length); ++ if (ev->length <= HCI_MAX_AD_LENGTH) { ++ rssi = ev->data[ev->length]; ++ process_adv_report(hdev, ev->evt_type, &ev->bdaddr, ++ ev->bdaddr_type, NULL, 0, rssi, ++ ev->data, ev->length); ++ } else { ++ bt_dev_err(hdev, "Dropping invalid advertising data"); ++ } + + ptr += sizeof(*ev) + ev->length + 1; + } +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 5e3f5c1ba07d6..b96818cda12da 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6675,9 +6675,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) + goto drop; + } + +- if ((chan->mode == L2CAP_MODE_ERTM || +- chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb)) +- goto drop; ++ if (chan->ops->filter) { ++ if (chan->ops->filter(chan, skb)) ++ goto drop; ++ } + + if (!control->sframe) { + int err; +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index bbf08c6092f4a..ab6b1788dbfc3 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1475,6 +1475,19 @@ static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) + sk->sk_state_change(sk); + } + ++static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) ++{ ++ struct sock *sk = chan->data; ++ ++ switch (chan->mode) { ++ case L2CAP_MODE_ERTM: ++ case L2CAP_MODE_STREAMING: ++ return sk_filter(sk, skb); ++ } ++ ++ return 0; ++} ++ + static const struct l2cap_ops l2cap_chan_ops = { + .name = "L2CAP Socket Interface", + .new_connection = l2cap_sock_new_connection_cb, +@@ -1489,6 +1502,7 @@ static const struct l2cap_ops l2cap_chan_ops = { + .set_shutdown = l2cap_sock_set_shutdown_cb, + .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, + .alloc_skb = l2cap_sock_alloc_skb_cb, ++ .filter = l2cap_sock_filter, + }; + + static void l2cap_sock_destruct(struct sock *sk) +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index ba24f613c0fc1..bca1408f815ff 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -635,7 +635,8 @@ static u32 get_supported_settings(struct hci_dev *hdev) + + if (lmp_ssp_capable(hdev)) { + settings |= MGMT_SETTING_SSP; +- settings |= MGMT_SETTING_HS; ++ if (IS_ENABLED(CONFIG_BT_HS)) ++ settings |= MGMT_SETTING_HS; + } + + if (lmp_sc_capable(hdev)) +@@ -1645,6 +1646,10 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + + BT_DBG("request for %s", hdev->name); + ++ if (!IS_ENABLED(CONFIG_BT_HS)) ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, ++ MGMT_STATUS_NOT_SUPPORTED); ++ + status = mgmt_bredr_support(hdev); + if (status) + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);