diff --git a/config/kernel/linux-odroidxu4-legacy.config b/config/kernel/linux-odroidxu4-legacy.config index 642972ab66..12a8e8799c 100644 --- a/config/kernel/linux-odroidxu4-legacy.config +++ b/config/kernel/linux-odroidxu4-legacy.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.14.175 Kernel Configuration +# Linux/arm 4.14.176 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.173-174.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.173-174.patch deleted file mode 100644 index bfe0e9e014..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.173-174.patch +++ /dev/null @@ -1,3145 +0,0 @@ -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 7e0a4be3503d..ae51b1b7b67f 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -137,6 +137,10 @@ - dynamic table installation which will install SSDT - tables to /sys/firmware/acpi/tables/dynamic. - -+ acpi_no_watchdog [HW,ACPI,WDT] -+ Ignore the ACPI-based watchdog interface (WDAT) and let -+ a native driver control the watchdog device instead. -+ - acpi_rsdp= [ACPI,EFI,KEXEC] - Pass the RSDP address to the kernel, mostly used - on machines running EFI runtime service to boot the -diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting -index 93e0a2404532..c757c1c3cb81 100644 ---- a/Documentation/filesystems/porting -+++ b/Documentation/filesystems/porting -@@ -606,3 +606,10 @@ in your dentry operations instead. - dentry separately, and it now has request_mask and query_flags arguments - to specify the fields and sync type requested by statx. Filesystems not - supporting any statx-specific features may ignore the new arguments. -+-- -+[mandatory] -+ -+ [should've been added in 2016] stale comment in finish_open() -+ nonwithstanding, failure exits in ->atomic_open() instances should -+ *NOT* fput() the file, no matter what. Everything is handled by the -+ caller. -diff --git a/Makefile b/Makefile -index 9a524b5c1d55..edc6b62bd892 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 173 -+SUBLEVEL = 174 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h -index b29f1a9fd6f7..07c8e1a6c56e 100644 ---- a/arch/arc/include/asm/linkage.h -+++ b/arch/arc/include/asm/linkage.h -@@ -14,6 +14,8 @@ - #ifdef __ASSEMBLY__ - - #define ASM_NL ` /* use '`' to mark new line in macro */ -+#define __ALIGN .align 4 -+#define __ALIGN_STR __stringify(__ALIGN) - - /* annotation for data we want in DCCM - if enabled in .config */ - .macro ARCFP_DATA nm -diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c -index f4dd7f9663c1..0001742c131d 100644 ---- a/arch/arm/kernel/vdso.c -+++ b/arch/arm/kernel/vdso.c -@@ -103,6 +103,8 @@ static bool __init cntvct_functional(void) - * this. - */ - np = of_find_compatible_node(NULL, NULL, "arm,armv7-timer"); -+ if (!np) -+ np = of_find_compatible_node(NULL, NULL, "arm,armv8-timer"); - if (!np) - goto out_put; - -diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S -index 6709a8d33963..f1e34f16cfab 100644 ---- a/arch/arm/lib/copy_from_user.S -+++ b/arch/arm/lib/copy_from_user.S -@@ -100,7 +100,7 @@ ENTRY(arm_copy_from_user) - - ENDPROC(arm_copy_from_user) - -- .pushsection .fixup,"ax" -+ .pushsection .text.fixup,"ax" - .align 0 - copy_abort_preamble - ldmfd sp!, {r1, r2, r3} -diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c -index baa7e36073f9..604a8558752d 100644 ---- a/arch/x86/events/amd/uncore.c -+++ b/arch/x86/events/amd/uncore.c -@@ -193,20 +193,18 @@ static int amd_uncore_event_init(struct perf_event *event) - - /* - * NB and Last level cache counters (MSRs) are shared across all cores -- * that share the same NB / Last level cache. Interrupts can be directed -- * to a single target core, however, event counts generated by processes -- * running on other cores cannot be masked out. So we do not support -- * sampling and per-thread events. -+ * that share the same NB / Last level cache. On family 16h and below, -+ * Interrupts can be directed to a single target core, however, event -+ * counts generated by processes running on other cores cannot be masked -+ * out. So we do not support sampling and per-thread events via -+ * CAP_NO_INTERRUPT, and we do not enable counter overflow interrupts: - */ -- if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK) -- return -EINVAL; - - /* NB and Last level cache counters do not have usr/os/guest/host bits */ - if (event->attr.exclude_user || event->attr.exclude_kernel || - event->attr.exclude_host || event->attr.exclude_guest) - return -EINVAL; - -- /* and we do not enable counter overflow interrupts */ - hwc->config = event->attr.config & AMD64_RAW_EVENT_MASK_NB; - hwc->idx = -1; - -@@ -314,6 +312,7 @@ static struct pmu amd_nb_pmu = { - .start = amd_uncore_start, - .stop = amd_uncore_stop, - .read = amd_uncore_read, -+ .capabilities = PERF_PMU_CAP_NO_INTERRUPT, - }; - - static struct pmu amd_llc_pmu = { -@@ -324,6 +323,7 @@ static struct pmu amd_llc_pmu = { - .start = amd_uncore_start, - .stop = amd_uncore_stop, - .read = amd_uncore_read, -+ .capabilities = PERF_PMU_CAP_NO_INTERRUPT, - }; - - static struct amd_uncore *amd_uncore_alloc(unsigned int cpu) -diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel.c b/arch/x86/kernel/cpu/mcheck/mce_intel.c -index d05be307d081..1d87b85150db 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce_intel.c -+++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c -@@ -489,17 +489,18 @@ static void intel_ppin_init(struct cpuinfo_x86 *c) - return; - - if ((val & 3UL) == 1UL) { -- /* PPIN available but disabled: */ -+ /* PPIN locked in disabled mode */ - return; - } - -- /* If PPIN is disabled, but not locked, try to enable: */ -- if (!(val & 3UL)) { -+ /* If PPIN is disabled, try to enable */ -+ if (!(val & 2UL)) { - wrmsrl_safe(MSR_PPIN_CTL, val | 2UL); - rdmsrl_safe(MSR_PPIN_CTL, &val); - } - -- if ((val & 3UL) == 2UL) -+ /* Is the enable bit set? */ -+ if (val & 2UL) - set_cpu_cap(c, X86_FEATURE_INTEL_PPIN); - } - } -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 70f3636aff11..4cc8a4a6f1d0 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -5062,6 +5062,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) - ctxt->fetch.ptr = ctxt->fetch.data; - ctxt->fetch.end = ctxt->fetch.data + insn_len; - ctxt->opcode_len = 1; -+ ctxt->intercept = x86_intercept_none; - if (insn_len > 0) - memcpy(ctxt->fetch.data, insn, insn_len); - else { -diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c -index 23cde3d8e8fb..0bd1899a287f 100644 ---- a/drivers/acpi/acpi_watchdog.c -+++ b/drivers/acpi/acpi_watchdog.c -@@ -58,12 +58,14 @@ static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat) - } - #endif - -+static bool acpi_no_watchdog; -+ - static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void) - { - const struct acpi_table_wdat *wdat = NULL; - acpi_status status; - -- if (acpi_disabled) -+ if (acpi_disabled || acpi_no_watchdog) - return NULL; - - status = acpi_get_table(ACPI_SIG_WDAT, 0, -@@ -91,6 +93,14 @@ bool acpi_has_watchdog(void) - } - EXPORT_SYMBOL_GPL(acpi_has_watchdog); - -+/* ACPI watchdog can be disabled on boot command line */ -+static int __init disable_acpi_watchdog(char *str) -+{ -+ acpi_no_watchdog = true; -+ return 1; -+} -+__setup("acpi_no_watchdog", disable_acpi_watchdog); -+ - void __init acpi_watchdog_init(void) - { - const struct acpi_wdat_entry *entries; -diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c -index 8767401f75e0..19d226ff15ef 100644 ---- a/drivers/block/virtio_blk.c -+++ b/drivers/block/virtio_blk.c -@@ -271,10 +271,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx, - err = virtblk_add_req(vblk->vqs[qid].vq, vbr, vbr->sg, num); - if (err) { - virtqueue_kick(vblk->vqs[qid].vq); -- blk_mq_stop_hw_queue(hctx); -+ /* Don't stop the queue if -ENOMEM: we may have failed to -+ * bounce the buffer due to global resource outage. -+ */ -+ if (err == -ENOSPC) -+ blk_mq_stop_hw_queue(hctx); - spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags); -- /* Out of mem doesn't actually happen, since we fall back -- * to direct descriptors */ - if (err == -ENOMEM || err == -ENOSPC) - return BLK_STS_RESOURCE; - return BLK_STS_IOERR; -diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c -index 3e626fd9bd4e..1c65f5ac4368 100644 ---- a/drivers/firmware/efi/efivars.c -+++ b/drivers/firmware/efi/efivars.c -@@ -139,13 +139,16 @@ static ssize_t - efivar_attr_read(struct efivar_entry *entry, char *buf) - { - struct efi_variable *var = &entry->var; -+ unsigned long size = sizeof(var->Data); - char *str = buf; -+ int ret; - - if (!entry || !buf) - return -EINVAL; - -- var->DataSize = 1024; -- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) -+ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); -+ var->DataSize = size; -+ if (ret) - return -EIO; - - if (var->Attributes & EFI_VARIABLE_NON_VOLATILE) -@@ -172,13 +175,16 @@ static ssize_t - efivar_size_read(struct efivar_entry *entry, char *buf) - { - struct efi_variable *var = &entry->var; -+ unsigned long size = sizeof(var->Data); - char *str = buf; -+ int ret; - - if (!entry || !buf) - return -EINVAL; - -- var->DataSize = 1024; -- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) -+ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); -+ var->DataSize = size; -+ if (ret) - return -EIO; - - str += sprintf(str, "0x%lx\n", var->DataSize); -@@ -189,12 +195,15 @@ static ssize_t - efivar_data_read(struct efivar_entry *entry, char *buf) - { - struct efi_variable *var = &entry->var; -+ unsigned long size = sizeof(var->Data); -+ int ret; - - if (!entry || !buf) - return -EINVAL; - -- var->DataSize = 1024; -- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) -+ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); -+ var->DataSize = size; -+ if (ret) - return -EIO; - - memcpy(buf, var->Data, var->DataSize); -@@ -263,6 +272,9 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count) - u8 *data; - int err; - -+ if (!entry || !buf) -+ return -EINVAL; -+ - if (is_compat()) { - struct compat_efi_variable *compat; - -@@ -314,14 +326,16 @@ efivar_show_raw(struct efivar_entry *entry, char *buf) - { - struct efi_variable *var = &entry->var; - struct compat_efi_variable *compat; -+ unsigned long datasize = sizeof(var->Data); - size_t size; -+ int ret; - - if (!entry || !buf) - return 0; - -- var->DataSize = 1024; -- if (efivar_entry_get(entry, &entry->var.Attributes, -- &entry->var.DataSize, entry->var.Data)) -+ ret = efivar_entry_get(entry, &var->Attributes, &datasize, var->Data); -+ var->DataSize = datasize; -+ if (ret) - return -EIO; - - if (is_compat()) { -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -index 4779740421a8..2153f19e59cc 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -@@ -363,8 +363,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device * - router.ddc_valid = false; - router.cd_valid = false; - for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) { -- uint8_t grph_obj_type= -- grph_obj_type = -+ uint8_t grph_obj_type = - (le16_to_cpu(path->usGraphicObjIds[j]) & - OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT; - -diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c -index d0a81a03ddbd..8ab8f2350bbc 100644 ---- a/drivers/hid/hid-apple.c -+++ b/drivers/hid/hid-apple.c -@@ -343,7 +343,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, - unsigned long **bit, int *max) - { - if (usage->hid == (HID_UP_CUSTOM | 0x0003) || -- usage->hid == (HID_UP_MSVENDOR | 0x0003)) { -+ usage->hid == (HID_UP_MSVENDOR | 0x0003) || -+ usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) { - /* The fn key on Apple USB keyboards */ - set_bit(EV_REP, hi->input->evbit); - hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN); -diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c -index 10af8585c820..95052373a828 100644 ---- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c -+++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c -@@ -341,6 +341,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { - }, - .driver_data = (void *)&sipodev_desc - }, -+ { -+ .ident = "Trekstor SURFBOOK E11B", -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TREKSTOR"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SURFBOOK E11B"), -+ }, -+ .driver_data = (void *)&sipodev_desc -+ }, - { - .ident = "Direkt-Tek DTLAPY116-2", - .matches = { -diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c -index df9800aaeac7..0d4d5dcf94f3 100644 ---- a/drivers/i2c/i2c-core-acpi.c -+++ b/drivers/i2c/i2c-core-acpi.c -@@ -352,10 +352,18 @@ static struct i2c_adapter *i2c_acpi_find_adapter_by_handle(acpi_handle handle) - static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev) - { - struct device *dev; -+ struct i2c_client *client; - - dev = bus_find_device(&i2c_bus_type, NULL, adev, - i2c_acpi_find_match_device); -- return dev ? i2c_verify_client(dev) : NULL; -+ if (!dev) -+ return NULL; -+ -+ client = i2c_verify_client(dev); -+ if (!client) -+ put_device(dev); -+ -+ return client; - } - - static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, -diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c -index c87764a4e212..8000b798e6e6 100644 ---- a/drivers/iommu/dma-iommu.c -+++ b/drivers/iommu/dma-iommu.c -@@ -208,15 +208,15 @@ static int cookie_init_hw_msi_region(struct iommu_dma_cookie *cookie, - start -= iova_offset(iovad, start); - num_pages = iova_align(iovad, end - start) >> iova_shift(iovad); - -- msi_page = kcalloc(num_pages, sizeof(*msi_page), GFP_KERNEL); -- if (!msi_page) -- return -ENOMEM; -- - for (i = 0; i < num_pages; i++) { -- msi_page[i].phys = start; -- msi_page[i].iova = start; -- INIT_LIST_HEAD(&msi_page[i].list); -- list_add(&msi_page[i].list, &cookie->msi_page_list); -+ msi_page = kmalloc(sizeof(*msi_page), GFP_KERNEL); -+ if (!msi_page) -+ return -ENOMEM; -+ -+ msi_page->phys = start; -+ msi_page->iova = start; -+ INIT_LIST_HEAD(&msi_page->list); -+ list_add(&msi_page->list, &cookie->msi_page_list); - start += iovad->granule; - } - -diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c -index 38d0128b8135..1f527ca60955 100644 ---- a/drivers/iommu/dmar.c -+++ b/drivers/iommu/dmar.c -@@ -39,6 +39,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -139,6 +140,13 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event) - - BUG_ON(dev->is_virtfn); - -+ /* -+ * Ignore devices that have a domain number higher than what can -+ * be looked up in DMAR, e.g. VMD subdevices with domain 0x10000 -+ */ -+ if (pci_domain_nr(dev->bus) > U16_MAX) -+ return NULL; -+ - /* Only generate path[] for device addition event */ - if (event == BUS_NOTIFY_ADD_DEVICE) - for (tmp = dev; tmp; tmp = tmp->bus->self) -@@ -451,12 +459,13 @@ static int __init dmar_parse_one_andd(struct acpi_dmar_header *header, - - /* Check for NUL termination within the designated length */ - if (strnlen(andd->device_name, header->length - 8) == header->length - 8) { -- WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND, -+ pr_warn(FW_BUG - "Your BIOS is broken; ANDD object name is not NUL-terminated\n" - "BIOS vendor: %s; Ver: %s; Product Version: %s\n", - dmi_get_system_info(DMI_BIOS_VENDOR), - dmi_get_system_info(DMI_BIOS_VERSION), - dmi_get_system_info(DMI_PRODUCT_VERSION)); -+ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); - return -EINVAL; - } - pr_info("ANDD device: %x name: %s\n", andd->device_number, -@@ -482,14 +491,14 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg) - return 0; - } - } -- WARN_TAINT( -- 1, TAINT_FIRMWARE_WORKAROUND, -+ pr_warn(FW_BUG - "Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n" - "BIOS vendor: %s; Ver: %s; Product Version: %s\n", -- drhd->reg_base_addr, -+ rhsa->base_address, - dmi_get_system_info(DMI_BIOS_VENDOR), - dmi_get_system_info(DMI_BIOS_VERSION), - dmi_get_system_info(DMI_PRODUCT_VERSION)); -+ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); - - return 0; - } -@@ -835,14 +844,14 @@ int __init dmar_table_init(void) - - static void warn_invalid_dmar(u64 addr, const char *message) - { -- WARN_TAINT_ONCE( -- 1, TAINT_FIRMWARE_WORKAROUND, -+ pr_warn_once(FW_BUG - "Your BIOS is broken; DMAR reported at address %llx%s!\n" - "BIOS vendor: %s; Ver: %s; Product Version: %s\n", - addr, message, - dmi_get_system_info(DMI_BIOS_VENDOR), - dmi_get_system_info(DMI_BIOS_VERSION), - dmi_get_system_info(DMI_PRODUCT_VERSION)); -+ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); - } - - static int __ref -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index b48666849dbe..db1b546134f5 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -3984,10 +3984,11 @@ static void quirk_ioat_snb_local_iommu(struct pci_dev *pdev) - - /* we know that the this iommu should be at offset 0xa000 from vtbar */ - drhd = dmar_find_matched_drhd_unit(pdev); -- if (WARN_TAINT_ONCE(!drhd || drhd->reg_base_addr - vtbar != 0xa000, -- TAINT_FIRMWARE_WORKAROUND, -- "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n")) -+ if (!drhd || drhd->reg_base_addr - vtbar != 0xa000) { -+ pr_warn_once(FW_BUG "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n"); -+ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); - pdev->dev.archdata.iommu = DUMMY_DEVICE_DOMAIN_INFO; -+ } - } - DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_SNB, quirk_ioat_snb_local_iommu); - -@@ -5123,8 +5124,10 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain, - u64 phys = 0; - - pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level); -- if (pte) -- phys = dma_pte_addr(pte); -+ if (pte && dma_pte_present(pte)) -+ phys = dma_pte_addr(pte) + -+ (iova & (BIT_MASK(level_to_offset_bits(level) + -+ VTD_PAGE_SHIFT) - 1)); - - return phys; - } -diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c -index 755d588bbcb1..0b79ddec15b7 100644 ---- a/drivers/net/bonding/bond_alb.c -+++ b/drivers/net/bonding/bond_alb.c -@@ -71,11 +71,6 @@ struct arp_pkt { - }; - #pragma pack() - --static inline struct arp_pkt *arp_pkt(const struct sk_buff *skb) --{ -- return (struct arp_pkt *)skb_network_header(skb); --} -- - /* Forward declaration */ - static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[], - bool strict_match); -@@ -574,10 +569,11 @@ static void rlb_req_update_subnet_clients(struct bonding *bond, __be32 src_ip) - spin_unlock(&bond->mode_lock); - } - --static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bond) -+static struct slave *rlb_choose_channel(struct sk_buff *skb, -+ struct bonding *bond, -+ const struct arp_pkt *arp) - { - struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond)); -- struct arp_pkt *arp = arp_pkt(skb); - struct slave *assigned_slave, *curr_active_slave; - struct rlb_client_info *client_info; - u32 hash_index = 0; -@@ -674,8 +670,12 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon - */ - static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) - { -- struct arp_pkt *arp = arp_pkt(skb); - struct slave *tx_slave = NULL; -+ struct arp_pkt *arp; -+ -+ if (!pskb_network_may_pull(skb, sizeof(*arp))) -+ return NULL; -+ arp = (struct arp_pkt *)skb_network_header(skb); - - /* Don't modify or load balance ARPs that do not originate locally - * (e.g.,arrive via a bridge). -@@ -685,7 +685,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) - - if (arp->op_code == htons(ARPOP_REPLY)) { - /* the arp must be sent on the selected rx channel */ -- tx_slave = rlb_choose_channel(skb, bond); -+ tx_slave = rlb_choose_channel(skb, bond, arp); - if (tx_slave) - bond_hw_addr_copy(arp->mac_src, tx_slave->dev->dev_addr, - tx_slave->dev->addr_len); -@@ -696,7 +696,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) - * When the arp reply is received the entry will be updated - * with the correct unicast address of the client. - */ -- rlb_choose_channel(skb, bond); -+ rlb_choose_channel(skb, bond, arp); - - /* The ARP reply packets must be delayed so that - * they can cancel out the influence of the ARP request. -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index d92113db4fb9..05ad5ed145a3 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -867,6 +867,7 @@ static const struct nla_policy can_policy[IFLA_CAN_MAX + 1] = { - = { .len = sizeof(struct can_bittiming) }, - [IFLA_CAN_DATA_BITTIMING_CONST] - = { .len = sizeof(struct can_bittiming_const) }, -+ [IFLA_CAN_TERMINATION] = { .type = NLA_U16 }, - }; - - static int can_validate(struct nlattr *tb[], struct nlattr *data[], -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 41bc7820d2dd..5163da01e54f 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -7310,13 +7310,13 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu) - struct bnxt *bp = netdev_priv(dev); - - if (netif_running(dev)) -- bnxt_close_nic(bp, false, false); -+ bnxt_close_nic(bp, true, false); - - dev->mtu = new_mtu; - bnxt_set_ring_params(bp); - - if (netif_running(dev)) -- return bnxt_open_nic(bp, false, false); -+ return bnxt_open_nic(bp, true, false); - - return 0; - } -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 62bc19bedb06..8ba915cc4c2e 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -2478,15 +2478,15 @@ fec_enet_set_coalesce(struct net_device *ndev, struct ethtool_coalesce *ec) - return -EINVAL; - } - -- cycle = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr); -+ cycle = fec_enet_us_to_itr_clock(ndev, ec->rx_coalesce_usecs); - if (cycle > 0xFFFF) { - pr_err("Rx coalesced usec exceed hardware limitation\n"); - return -EINVAL; - } - -- cycle = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr); -+ cycle = fec_enet_us_to_itr_clock(ndev, ec->tx_coalesce_usecs); - if (cycle > 0xFFFF) { -- pr_err("Rx coalesced usec exceed hardware limitation\n"); -+ pr_err("Tx coalesced usec exceed hardware limitation\n"); - return -EINVAL; - } - -diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c -index 79b567447084..46aba02b8672 100644 ---- a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c -+++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c -@@ -312,6 +312,7 @@ static int set_hw_ioctxt(struct hinic_hwdev *hwdev, unsigned int rq_depth, - } - - hw_ioctxt.func_idx = HINIC_HWIF_FUNC_IDX(hwif); -+ hw_ioctxt.ppf_idx = HINIC_HWIF_PPF_IDX(hwif); - - hw_ioctxt.set_cmdq_depth = HW_IOCTXT_SET_CMDQ_DEPTH_DEFAULT; - hw_ioctxt.cmdq_depth = 0; -diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h -index 0f5563f3b779..a011fd2d2627 100644 ---- a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h -+++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h -@@ -104,8 +104,8 @@ struct hinic_cmd_hw_ioctxt { - - u8 rsvd2; - u8 rsvd3; -+ u8 ppf_idx; - u8 rsvd4; -- u8 rsvd5; - - u16 rq_depth; - u16 rx_buf_sz_idx; -diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h b/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h -index 5b4760c0e9f5..f683ccbdfca0 100644 ---- a/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h -+++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h -@@ -146,6 +146,7 @@ - #define HINIC_HWIF_FUNC_IDX(hwif) ((hwif)->attr.func_idx) - #define HINIC_HWIF_PCI_INTF(hwif) ((hwif)->attr.pci_intf_idx) - #define HINIC_HWIF_PF_IDX(hwif) ((hwif)->attr.pf_idx) -+#define HINIC_HWIF_PPF_IDX(hwif) ((hwif)->attr.ppf_idx) - - #define HINIC_FUNC_TYPE(hwif) ((hwif)->attr.func_type) - #define HINIC_IS_PF(hwif) (HINIC_FUNC_TYPE(hwif) == HINIC_PF) -diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c -index 799154d7c047..c699a779757e 100644 ---- a/drivers/net/ethernet/micrel/ks8851_mll.c -+++ b/drivers/net/ethernet/micrel/ks8851_mll.c -@@ -831,14 +831,17 @@ static irqreturn_t ks_irq(int irq, void *pw) - { - struct net_device *netdev = pw; - struct ks_net *ks = netdev_priv(netdev); -+ unsigned long flags; - u16 status; - -+ spin_lock_irqsave(&ks->statelock, flags); - /*this should be the first in IRQ handler */ - ks_save_cmd_reg(ks); - - status = ks_rdreg16(ks, KS_ISR); - if (unlikely(!status)) { - ks_restore_cmd_reg(ks); -+ spin_unlock_irqrestore(&ks->statelock, flags); - return IRQ_NONE; - } - -@@ -864,6 +867,7 @@ static irqreturn_t ks_irq(int irq, void *pw) - ks->netdev->stats.rx_over_errors++; - /* this should be the last in IRQ handler*/ - ks_restore_cmd_reg(ks); -+ spin_unlock_irqrestore(&ks->statelock, flags); - return IRQ_HANDLED; - } - -@@ -933,6 +937,7 @@ static int ks_net_stop(struct net_device *netdev) - - /* shutdown RX/TX QMU */ - ks_disable_qmu(ks); -+ ks_disable_int(ks); - - /* set powermode to soft power down to save power */ - ks_set_powermode(ks, PMECR_PM_SOFTDOWN); -@@ -989,10 +994,9 @@ static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) - { - netdev_tx_t retv = NETDEV_TX_OK; - struct ks_net *ks = netdev_priv(netdev); -+ unsigned long flags; - -- disable_irq(netdev->irq); -- ks_disable_int(ks); -- spin_lock(&ks->statelock); -+ spin_lock_irqsave(&ks->statelock, flags); - - /* Extra space are required: - * 4 byte for alignment, 4 for status/length, 4 for CRC -@@ -1006,9 +1010,7 @@ static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) - dev_kfree_skb(skb); - } else - retv = NETDEV_TX_BUSY; -- spin_unlock(&ks->statelock); -- ks_enable_int(ks); -- enable_irq(netdev->irq); -+ spin_unlock_irqrestore(&ks->statelock, flags); - return retv; - } - -diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -index 7d8303e45f09..b7df8c1121e3 100644 ---- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -@@ -157,6 +157,11 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev, - int err = 0; - u16 mux_id; - -+ if (!tb[IFLA_LINK]) { -+ NL_SET_ERR_MSG_MOD(extack, "link not specified"); -+ return -EINVAL; -+ } -+ - real_dev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK])); - if (!real_dev || !dev) - return -ENODEV; -diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c -index b9cb697b2818..e0d4c1e850cf 100644 ---- a/drivers/net/ethernet/sfc/efx.c -+++ b/drivers/net/ethernet/sfc/efx.c -@@ -505,6 +505,7 @@ efx_copy_channel(const struct efx_channel *old_channel) - if (tx_queue->channel) - tx_queue->channel = channel; - tx_queue->buffer = NULL; -+ tx_queue->cb_page = NULL; - memset(&tx_queue->txd, 0, sizeof(tx_queue->txd)); - } - -diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c -index 71ff6bd4be9f..baf8aab59f82 100644 ---- a/drivers/net/ipvlan/ipvlan_core.c -+++ b/drivers/net/ipvlan/ipvlan_core.c -@@ -256,6 +256,7 @@ void ipvlan_process_multicast(struct work_struct *work) - } - if (dev) - dev_put(dev); -+ cond_resched(); - } - } - -@@ -448,19 +449,21 @@ static int ipvlan_process_outbound(struct sk_buff *skb) - struct ethhdr *ethh = eth_hdr(skb); - int ret = NET_XMIT_DROP; - -- /* In this mode we dont care about multicast and broadcast traffic */ -- if (is_multicast_ether_addr(ethh->h_dest)) { -- pr_warn_ratelimited("Dropped {multi|broad}cast of type= [%x]\n", -- ntohs(skb->protocol)); -- kfree_skb(skb); -- goto out; -- } -- - /* The ipvlan is a pseudo-L2 device, so the packets that we receive - * will have L2; which need to discarded and processed further - * in the net-ns of the main-device. - */ - if (skb_mac_header_was_set(skb)) { -+ /* In this mode we dont care about -+ * multicast and broadcast traffic */ -+ if (is_multicast_ether_addr(ethh->h_dest)) { -+ pr_debug_ratelimited( -+ "Dropped {multi|broad}cast of type=[%x]\n", -+ ntohs(skb->protocol)); -+ kfree_skb(skb); -+ goto out; -+ } -+ - skb_pull(skb, sizeof(*ethh)); - skb->mac_header = (typeof(skb->mac_header))~0U; - skb_reset_network_header(skb); -diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c -index 09f6795cce53..cd32d6623f6a 100644 ---- a/drivers/net/ipvlan/ipvlan_main.c -+++ b/drivers/net/ipvlan/ipvlan_main.c -@@ -236,7 +236,6 @@ static void ipvlan_uninit(struct net_device *dev) - static int ipvlan_open(struct net_device *dev) - { - struct ipvl_dev *ipvlan = netdev_priv(dev); -- struct net_device *phy_dev = ipvlan->phy_dev; - struct ipvl_addr *addr; - - if (ipvlan->port->mode == IPVLAN_MODE_L3 || -@@ -248,7 +247,7 @@ static int ipvlan_open(struct net_device *dev) - list_for_each_entry(addr, &ipvlan->addrs, anode) - ipvlan_ht_addr_add(ipvlan, addr); - -- return dev_uc_add(phy_dev, phy_dev->dev_addr); -+ return 0; - } - - static int ipvlan_stop(struct net_device *dev) -@@ -260,8 +259,6 @@ static int ipvlan_stop(struct net_device *dev) - dev_uc_unsync(phy_dev, dev); - dev_mc_unsync(phy_dev, dev); - -- dev_uc_del(phy_dev, phy_dev->dev_addr); -- - list_for_each_entry(addr, &ipvlan->addrs, anode) - ipvlan_ht_addr_del(addr); - -diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c -index 9bb65e0af7dd..c2c3ce5653db 100644 ---- a/drivers/net/macsec.c -+++ b/drivers/net/macsec.c -@@ -2871,6 +2871,11 @@ static void macsec_dev_set_rx_mode(struct net_device *dev) - dev_uc_sync(real_dev, dev); - } - -+static sci_t dev_to_sci(struct net_device *dev, __be16 port) -+{ -+ return make_sci(dev->dev_addr, port); -+} -+ - static int macsec_set_mac_address(struct net_device *dev, void *p) - { - struct macsec_dev *macsec = macsec_priv(dev); -@@ -2892,6 +2897,7 @@ static int macsec_set_mac_address(struct net_device *dev, void *p) - - out: - ether_addr_copy(dev->dev_addr, addr->sa_data); -+ macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES); - return 0; - } - -@@ -2974,6 +2980,7 @@ static const struct device_type macsec_type = { - - static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = { - [IFLA_MACSEC_SCI] = { .type = NLA_U64 }, -+ [IFLA_MACSEC_PORT] = { .type = NLA_U16 }, - [IFLA_MACSEC_ICV_LEN] = { .type = NLA_U8 }, - [IFLA_MACSEC_CIPHER_SUITE] = { .type = NLA_U64 }, - [IFLA_MACSEC_WINDOW] = { .type = NLA_U32 }, -@@ -3159,11 +3166,6 @@ static bool sci_exists(struct net_device *dev, sci_t sci) - return false; - } - --static sci_t dev_to_sci(struct net_device *dev, __be16 port) --{ -- return make_sci(dev->dev_addr, port); --} -- - static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len) - { - struct macsec_dev *macsec = macsec_priv(dev); -diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index ab539136d5bf..6989e84670e5 100644 ---- a/drivers/net/macvlan.c -+++ b/drivers/net/macvlan.c -@@ -338,6 +338,8 @@ static void macvlan_process_broadcast(struct work_struct *w) - if (src) - dev_put(src->dev); - kfree_skb(skb); -+ -+ cond_resched(); - } - } - -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 99dae55cd334..27f1f0b5b8f6 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list); - static DEFINE_MUTEX(phy_fixup_lock); - - #ifdef CONFIG_PM --static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) -+static bool mdio_bus_phy_may_suspend(struct phy_device *phydev) - { - struct device_driver *drv = phydev->mdio.dev.driver; - struct phy_driver *phydrv = to_phy_driver(drv); -@@ -88,11 +88,10 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) - /* PHY not attached? May suspend if the PHY has not already been - * suspended as part of a prior call to phy_disconnect() -> - * phy_detach() -> phy_suspend() because the parent netdev might be the -- * MDIO bus driver and clock gated at this point. Also may resume if -- * PHY is not attached. -+ * MDIO bus driver and clock gated at this point. - */ - if (!netdev) -- return suspend ? !phydev->suspended : phydev->suspended; -+ goto out; - - /* Don't suspend PHY if the attached netdev parent may wakeup. - * The parent may point to a PCI device, as in tg3 driver. -@@ -107,7 +106,8 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) - if (device_may_wakeup(&netdev->dev)) - return false; - -- return true; -+out: -+ return !phydev->suspended; - } - - static int mdio_bus_phy_suspend(struct device *dev) -@@ -122,9 +122,11 @@ static int mdio_bus_phy_suspend(struct device *dev) - if (phydev->attached_dev && phydev->adjust_link) - phy_stop_machine(phydev); - -- if (!mdio_bus_phy_may_suspend(phydev, true)) -+ if (!mdio_bus_phy_may_suspend(phydev)) - return 0; - -+ phydev->suspended_by_mdio_bus = true; -+ - return phy_suspend(phydev); - } - -@@ -133,9 +135,11 @@ static int mdio_bus_phy_resume(struct device *dev) - struct phy_device *phydev = to_phy_device(dev); - int ret; - -- if (!mdio_bus_phy_may_suspend(phydev, false)) -+ if (!phydev->suspended_by_mdio_bus) - goto no_resume; - -+ phydev->suspended_by_mdio_bus = false; -+ - ret = phy_resume(phydev); - if (ret < 0) - return ret; -diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c -index ea90db3c7705..01334aeac577 100644 ---- a/drivers/net/slip/slhc.c -+++ b/drivers/net/slip/slhc.c -@@ -232,7 +232,7 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, - register struct cstate *cs = lcs->next; - register unsigned long deltaS, deltaA; - register short changes = 0; -- int hlen; -+ int nlen, hlen; - unsigned char new_seq[16]; - register unsigned char *cp = new_seq; - struct iphdr *ip; -@@ -248,6 +248,8 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, - return isize; - - ip = (struct iphdr *) icp; -+ if (ip->version != 4 || ip->ihl < 5) -+ return isize; - - /* Bail if this packet isn't TCP, or is an IP fragment */ - if (ip->protocol != IPPROTO_TCP || (ntohs(ip->frag_off) & 0x3fff)) { -@@ -258,10 +260,14 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, - comp->sls_o_tcp++; - return isize; - } -- /* Extract TCP header */ -+ nlen = ip->ihl * 4; -+ if (isize < nlen + sizeof(*th)) -+ return isize; - -- th = (struct tcphdr *)(((unsigned char *)ip) + ip->ihl*4); -- hlen = ip->ihl*4 + th->doff*4; -+ th = (struct tcphdr *)(icp + nlen); -+ if (th->doff < sizeof(struct tcphdr) / 4) -+ return isize; -+ hlen = nlen + th->doff * 4; - - /* Bail if the TCP packet isn't `compressible' (i.e., ACK isn't set or - * some other control bit is set). Also uncompressible if -diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c -index b07f367abd91..d7882b548b79 100644 ---- a/drivers/net/slip/slip.c -+++ b/drivers/net/slip/slip.c -@@ -867,7 +867,10 @@ err_free_chan: - tty->disc_data = NULL; - clear_bit(SLF_INUSE, &sl->flags); - sl_free_netdev(sl->dev); -+ /* do not call free_netdev before rtnl_unlock */ -+ rtnl_unlock(); - free_netdev(sl->dev); -+ return err; - - err_exit: - rtnl_unlock(); -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index f1aabf8a16c2..3dba58fa3433 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -2207,6 +2207,8 @@ team_nl_option_policy[TEAM_ATTR_OPTION_MAX + 1] = { - [TEAM_ATTR_OPTION_CHANGED] = { .type = NLA_FLAG }, - [TEAM_ATTR_OPTION_TYPE] = { .type = NLA_U8 }, - [TEAM_ATTR_OPTION_DATA] = { .type = NLA_BINARY }, -+ [TEAM_ATTR_OPTION_PORT_IFINDEX] = { .type = NLA_U32 }, -+ [TEAM_ATTR_OPTION_ARRAY_INDEX] = { .type = NLA_U32 }, - }; - - static int team_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info) -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 189715438328..a8d5561afc7d 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -274,6 +274,9 @@ static void qmi_wwan_netdev_setup(struct net_device *net) - netdev_dbg(net, "mode: raw IP\n"); - } else if (!net->header_ops) { /* don't bother if already set */ - ether_setup(net); -+ /* Restoring min/max mtu values set originally by usbnet */ -+ net->min_mtu = 0; -+ net->max_mtu = ETH_MAX_MTU; - clear_bit(EVENT_NO_IP_ALIGN, &dev->flags); - netdev_dbg(net, "mode: Ethernet\n"); - } -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index a7f9c1886bd4..cadf5ded45a9 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -2696,6 +2696,8 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) - } - - msleep(20); -+ if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ break; - } - - return data; -@@ -4055,7 +4057,10 @@ static void r8153_init(struct r8152 *tp) - if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & - AUTOLOAD_DONE) - break; -+ - msleep(20); -+ if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ break; - } - - data = r8153_phy_status(tp, 0); -@@ -4170,7 +4175,10 @@ static void r8153b_init(struct r8152 *tp) - if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & - AUTOLOAD_DONE) - break; -+ - msleep(20); -+ if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ break; - } - - data = r8153_phy_status(tp, 0); -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c -index 8f3032b7174d..b2e393c4fab5 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c -@@ -326,7 +326,8 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm) - } - - /* PHY_SKU section is mandatory in B0 */ -- if (!mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) { -+ if (mvm->trans->cfg->nvm_type == IWL_NVM_EXT && -+ !mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) { - IWL_ERR(mvm, - "Can't parse phy_sku in B0, empty sections\n"); - return NULL; -diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c -index c55517312485..08ea74177de2 100644 ---- a/drivers/pinctrl/core.c -+++ b/drivers/pinctrl/core.c -@@ -2031,7 +2031,6 @@ static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev) - return PTR_ERR(pctldev->p); - } - -- kref_get(&pctldev->p->users); - pctldev->hog_default = - pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT); - if (IS_ERR(pctldev->hog_default)) { -diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c -index 36c14b85fc7c..8db182067ecb 100644 ---- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c -+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c -@@ -158,8 +158,8 @@ static const unsigned int sdio_d0_pins[] = { PIN(GPIOX_0, EE_OFF) }; - static const unsigned int sdio_d1_pins[] = { PIN(GPIOX_1, EE_OFF) }; - static const unsigned int sdio_d2_pins[] = { PIN(GPIOX_2, EE_OFF) }; - static const unsigned int sdio_d3_pins[] = { PIN(GPIOX_3, EE_OFF) }; --static const unsigned int sdio_cmd_pins[] = { PIN(GPIOX_4, EE_OFF) }; --static const unsigned int sdio_clk_pins[] = { PIN(GPIOX_5, EE_OFF) }; -+static const unsigned int sdio_clk_pins[] = { PIN(GPIOX_4, EE_OFF) }; -+static const unsigned int sdio_cmd_pins[] = { PIN(GPIOX_5, EE_OFF) }; - static const unsigned int sdio_irq_pins[] = { PIN(GPIOX_7, EE_OFF) }; - - static const unsigned int nand_ce0_pins[] = { PIN(BOOT_8, EE_OFF) }; -diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c -index bb9c1c016643..28b50ab2fbb0 100644 ---- a/drivers/scsi/libfc/fc_disc.c -+++ b/drivers/scsi/libfc/fc_disc.c -@@ -652,6 +652,8 @@ redisc: - } - out: - kref_put(&rdata->kref, fc_rport_destroy); -+ if (!IS_ERR(fp)) -+ fc_frame_free(fp); - } - - /** -diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c -index f00a7ce3eb6e..03293e543c07 100644 ---- a/fs/cifs/dir.c -+++ b/fs/cifs/dir.c -@@ -562,7 +562,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, - if (server->ops->close) - server->ops->close(xid, tcon, &fid); - cifs_del_pending_open(&open); -- fput(file); - rc = -ENOMEM; - } - -diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c -index c850579ae5a4..6c6401084d3d 100644 ---- a/fs/gfs2/inode.c -+++ b/fs/gfs2/inode.c -@@ -1255,7 +1255,7 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry, - if (!(*opened & FILE_OPENED)) - return finish_no_open(file, d); - dput(d); -- return 0; -+ return excl && (flags & O_CREAT) ? -EEXIST : 0; - } - - BUG_ON(d != NULL); -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index f2ff141a4479..a355ca418e78 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -1050,8 +1050,8 @@ static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh, - /* For undo access buffer must have data copied */ - if (undo && !jh->b_committed_data) - goto out; -- if (jh->b_transaction != handle->h_transaction && -- jh->b_next_transaction != handle->h_transaction) -+ if (READ_ONCE(jh->b_transaction) != handle->h_transaction && -+ READ_ONCE(jh->b_next_transaction) != handle->h_transaction) - goto out; - /* - * There are two reasons for the barrier here: -@@ -2466,8 +2466,8 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh) - * our jh reference and thus __jbd2_journal_file_buffer() must not - * take a new one. - */ -- jh->b_transaction = jh->b_next_transaction; -- jh->b_next_transaction = NULL; -+ WRITE_ONCE(jh->b_transaction, jh->b_next_transaction); -+ WRITE_ONCE(jh->b_next_transaction, NULL); - if (buffer_freed(bh)) - jlist = BJ_Forget; - else if (jh->b_modified) -diff --git a/fs/open.c b/fs/open.c -index 29a2cdcbcb17..49fd070be0ec 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -824,9 +824,6 @@ cleanup_file: - * the return value of d_splice_alias(), then the caller needs to perform dput() - * on it after finish_open(). - * -- * On successful return @file is a fully instantiated open file. After this, if -- * an error occurs in ->atomic_open(), it needs to clean up with fput(). -- * - * Returns zero on success or -errno if the open failed. - */ - int finish_open(struct file *file, struct dentry *dentry, -diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h -index 0e21619f1c03..61ab21c34866 100644 ---- a/include/linux/cgroup.h -+++ b/include/linux/cgroup.h -@@ -61,6 +61,7 @@ struct css_task_iter { - struct list_head *mg_tasks_head; - struct list_head *dying_tasks_head; - -+ struct list_head *cur_tasks_head; - struct css_set *cur_cset; - struct css_set *cur_dcset; - struct task_struct *cur_task; -diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h -index 39faaaf843e1..c91cf2dee12a 100644 ---- a/include/linux/inet_diag.h -+++ b/include/linux/inet_diag.h -@@ -2,15 +2,10 @@ - #ifndef _INET_DIAG_H_ - #define _INET_DIAG_H_ 1 - -+#include - #include - --struct net; --struct sock; - struct inet_hashinfo; --struct nlattr; --struct nlmsghdr; --struct sk_buff; --struct netlink_callback; - - struct inet_diag_handler { - void (*dump)(struct sk_buff *skb, -@@ -62,6 +57,17 @@ int inet_diag_bc_sk(const struct nlattr *_bc, struct sock *sk); - - void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk); - -+static inline size_t inet_diag_msg_attrs_size(void) -+{ -+ return nla_total_size(1) /* INET_DIAG_SHUTDOWN */ -+ + nla_total_size(1) /* INET_DIAG_TOS */ -+#if IS_ENABLED(CONFIG_IPV6) -+ + nla_total_size(1) /* INET_DIAG_TCLASS */ -+ + nla_total_size(1) /* INET_DIAG_SKV6ONLY */ -+#endif -+ + nla_total_size(4) /* INET_DIAG_MARK */ -+ + nla_total_size(4); /* INET_DIAG_CLASS_ID */ -+} - int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb, - struct inet_diag_msg *r, int ext, - struct user_namespace *user_ns, bool net_admin); -diff --git a/include/linux/phy.h b/include/linux/phy.h -index efc04c2d92c9..8b6850707e62 100644 ---- a/include/linux/phy.h -+++ b/include/linux/phy.h -@@ -372,6 +372,7 @@ struct phy_c45_device_ids { - * is_pseudo_fixed_link: Set to true if this phy is an Ethernet switch, etc. - * has_fixups: Set to true if this phy has fixups/quirks. - * suspended: Set to true if this phy has been suspended successfully. -+ * suspended_by_mdio_bus: Set to true if this phy was suspended by MDIO bus. - * sysfs_links: Internal boolean tracking sysfs symbolic links setup/removal. - * loopback_enabled: Set true if this phy has been loopbacked successfully. - * state: state of the PHY for management purposes -@@ -410,6 +411,7 @@ struct phy_device { - bool is_pseudo_fixed_link; - bool has_fixups; - bool suspended; -+ bool suspended_by_mdio_bus; - bool sysfs_links; - bool loopback_enabled; - -diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h -index 648caf90ec07..b8fd023ba625 100644 ---- a/include/net/fib_rules.h -+++ b/include/net/fib_rules.h -@@ -102,6 +102,7 @@ struct fib_rule_notifier_info { - [FRA_OIFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \ - [FRA_PRIORITY] = { .type = NLA_U32 }, \ - [FRA_FWMARK] = { .type = NLA_U32 }, \ -+ [FRA_TUN_ID] = { .type = NLA_U64 }, \ - [FRA_FWMASK] = { .type = NLA_U32 }, \ - [FRA_TABLE] = { .type = NLA_U32 }, \ - [FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \ -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index 829943aad7be..2b3f2ea6a8a3 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -4051,12 +4051,16 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it) - } - } while (!css_set_populated(cset) && list_empty(&cset->dying_tasks)); - -- if (!list_empty(&cset->tasks)) -+ if (!list_empty(&cset->tasks)) { - it->task_pos = cset->tasks.next; -- else if (!list_empty(&cset->mg_tasks)) -+ it->cur_tasks_head = &cset->tasks; -+ } else if (!list_empty(&cset->mg_tasks)) { - it->task_pos = cset->mg_tasks.next; -- else -+ it->cur_tasks_head = &cset->mg_tasks; -+ } else { - it->task_pos = cset->dying_tasks.next; -+ it->cur_tasks_head = &cset->dying_tasks; -+ } - - it->tasks_head = &cset->tasks; - it->mg_tasks_head = &cset->mg_tasks; -@@ -4114,10 +4118,14 @@ repeat: - else - it->task_pos = it->task_pos->next; - -- if (it->task_pos == it->tasks_head) -+ if (it->task_pos == it->tasks_head) { - it->task_pos = it->mg_tasks_head->next; -- if (it->task_pos == it->mg_tasks_head) -+ it->cur_tasks_head = it->mg_tasks_head; -+ } -+ if (it->task_pos == it->mg_tasks_head) { - it->task_pos = it->dying_tasks_head->next; -+ it->cur_tasks_head = it->dying_tasks_head; -+ } - if (it->task_pos == it->dying_tasks_head) - css_task_iter_advance_css_set(it); - } else { -@@ -4136,11 +4144,12 @@ repeat: - goto repeat; - - /* and dying leaders w/o live member threads */ -- if (!atomic_read(&task->signal->live)) -+ if (it->cur_tasks_head == it->dying_tasks_head && -+ !atomic_read(&task->signal->live)) - goto repeat; - } else { - /* skip all dying ones */ -- if (task->flags & PF_EXITING) -+ if (it->cur_tasks_head == it->dying_tasks_head) - goto repeat; - } - } -@@ -4249,6 +4258,9 @@ static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos) - struct kernfs_open_file *of = s->private; - struct css_task_iter *it = of->priv; - -+ if (pos) -+ (*pos)++; -+ - return css_task_iter_next(it); - } - -@@ -4264,7 +4276,7 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, - * from position 0, so we can simply keep iterating on !0 *pos. - */ - if (!it) { -- if (WARN_ON_ONCE((*pos)++)) -+ if (WARN_ON_ONCE((*pos))) - return ERR_PTR(-EINVAL); - - it = kzalloc(sizeof(*it), GFP_KERNEL); -@@ -4272,10 +4284,11 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, - return ERR_PTR(-ENOMEM); - of->priv = it; - css_task_iter_start(&cgrp->self, iter_flags, it); -- } else if (!(*pos)++) { -+ } else if (!(*pos)) { - css_task_iter_end(it); - css_task_iter_start(&cgrp->self, iter_flags, it); -- } -+ } else -+ return it->cur_task; - - return cgroup_procs_next(s, NULL, NULL); - } -@@ -5799,6 +5812,10 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd) - return; - } - -+ /* Don't associate the sock with unrelated interrupted task's cgroup. */ -+ if (in_interrupt()) -+ return; -+ - rcu_read_lock(); - - while (true) { -diff --git a/kernel/signal.c b/kernel/signal.c -index 8fee1f2eba2f..c066168f8854 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -379,27 +379,32 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi - { - struct sigqueue *q = NULL; - struct user_struct *user; -+ int sigpending; - - /* - * Protect access to @t credentials. This can go away when all - * callers hold rcu read lock. -+ * -+ * NOTE! A pending signal will hold on to the user refcount, -+ * and we get/put the refcount only when the sigpending count -+ * changes from/to zero. - */ - rcu_read_lock(); -- user = get_uid(__task_cred(t)->user); -- atomic_inc(&user->sigpending); -+ user = __task_cred(t)->user; -+ sigpending = atomic_inc_return(&user->sigpending); -+ if (sigpending == 1) -+ get_uid(user); - rcu_read_unlock(); - -- if (override_rlimit || -- atomic_read(&user->sigpending) <= -- task_rlimit(t, RLIMIT_SIGPENDING)) { -+ if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) { - q = kmem_cache_alloc(sigqueue_cachep, flags); - } else { - print_dropped_signal(sig); - } - - if (unlikely(q == NULL)) { -- atomic_dec(&user->sigpending); -- free_uid(user); -+ if (atomic_dec_and_test(&user->sigpending)) -+ free_uid(user); - } else { - INIT_LIST_HEAD(&q->list); - q->flags = 0; -@@ -413,8 +418,8 @@ static void __sigqueue_free(struct sigqueue *q) - { - if (q->flags & SIGQUEUE_PREALLOC) - return; -- atomic_dec(&q->user->sigpending); -- free_uid(q->user); -+ if (atomic_dec_and_test(&q->user->sigpending)) -+ free_uid(q->user); - kmem_cache_free(sigqueue_cachep, q); - } - -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index a37f5dc7cb39..18fae55713b0 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -1386,14 +1386,16 @@ static void __queue_work(int cpu, struct workqueue_struct *wq, - WARN_ON_ONCE(!is_chained_work(wq))) - return; - retry: -- if (req_cpu == WORK_CPU_UNBOUND) -- cpu = wq_select_unbound_cpu(raw_smp_processor_id()); -- - /* pwq which will be used unless @work is executing elsewhere */ -- if (!(wq->flags & WQ_UNBOUND)) -- pwq = per_cpu_ptr(wq->cpu_pwqs, cpu); -- else -+ if (wq->flags & WQ_UNBOUND) { -+ if (req_cpu == WORK_CPU_UNBOUND) -+ cpu = wq_select_unbound_cpu(raw_smp_processor_id()); - pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu)); -+ } else { -+ if (req_cpu == WORK_CPU_UNBOUND) -+ cpu = raw_smp_processor_id(); -+ pwq = per_cpu_ptr(wq->cpu_pwqs, cpu); -+ } - - /* - * If @work was previously on a different pool, it might still be -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 326525a97c47..5d6ebd1449f0 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -5867,19 +5867,9 @@ void mem_cgroup_sk_alloc(struct sock *sk) - if (!mem_cgroup_sockets_enabled) - return; - -- /* -- * Socket cloning can throw us here with sk_memcg already -- * filled. It won't however, necessarily happen from -- * process context. So the test for root memcg given -- * the current task's memcg won't help us in this case. -- * -- * Respecting the original socket's memcg is a better -- * decision in this case. -- */ -- if (sk->sk_memcg) { -- css_get(&sk->sk_memcg->css); -+ /* Do not associate the sock with unrelated interrupted task's memcg. */ -+ if (in_interrupt()) - return; -- } - - rcu_read_lock(); - memcg = mem_cgroup_from_task(current); -diff --git a/mm/slub.c b/mm/slub.c -index 07aeb129f3f8..099c7a85ede0 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -3122,6 +3122,15 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size, - void *object = c->freelist; - - if (unlikely(!object)) { -+ /* -+ * We may have removed an object from c->freelist using -+ * the fastpath in the previous iteration; in that case, -+ * c->tid has not been bumped yet. -+ * Since ___slab_alloc() may reenable interrupts while -+ * allocating memory, we should bump c->tid now. -+ */ -+ c->tid = next_tid(c->tid); -+ - /* - * Invoking slow path likely have side-effect - * of re-populating per CPU c->freelist -diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c -index 8b3f9441b3a0..7a723e124dbb 100644 ---- a/net/batman-adv/bat_iv_ogm.c -+++ b/net/batman-adv/bat_iv_ogm.c -@@ -34,6 +34,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -149,7 +150,7 @@ static void batadv_iv_ogm_orig_free(struct batadv_orig_node *orig_node) - * Return: 0 on success, a negative error code otherwise. - */ - static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node, -- int max_if_num) -+ unsigned int max_if_num) - { - void *data_ptr; - size_t old_size; -@@ -193,7 +194,8 @@ unlock: - */ - static void - batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node, -- int max_if_num, int del_if_num) -+ unsigned int max_if_num, -+ unsigned int del_if_num) - { - size_t chunk_size; - size_t if_offset; -@@ -231,7 +233,8 @@ batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node, - */ - static void - batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node, -- int max_if_num, int del_if_num) -+ unsigned int max_if_num, -+ unsigned int del_if_num) - { - size_t if_offset; - void *data_ptr; -@@ -268,7 +271,8 @@ batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node, - * Return: 0 on success, a negative error code otherwise. - */ - static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node, -- int max_if_num, int del_if_num) -+ unsigned int max_if_num, -+ unsigned int del_if_num) - { - spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock); - -@@ -302,7 +306,8 @@ static struct batadv_orig_node * - batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const u8 *addr) - { - struct batadv_orig_node *orig_node; -- int size, hash_added; -+ int hash_added; -+ size_t size; - - orig_node = batadv_orig_hash_find(bat_priv, addr); - if (orig_node) -@@ -366,14 +371,18 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface) - unsigned char *ogm_buff; - u32 random_seqno; - -+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); -+ - /* randomize initial seqno to avoid collision */ - get_random_bytes(&random_seqno, sizeof(random_seqno)); - atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno); - - hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN; - ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC); -- if (!ogm_buff) -+ if (!ogm_buff) { -+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); - return -ENOMEM; -+ } - - hard_iface->bat_iv.ogm_buff = ogm_buff; - -@@ -385,35 +394,59 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface) - batadv_ogm_packet->reserved = 0; - batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE; - -+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); -+ - return 0; - } - - static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface) - { -+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); -+ - kfree(hard_iface->bat_iv.ogm_buff); - hard_iface->bat_iv.ogm_buff = NULL; -+ -+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); - } - - static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface) - { - struct batadv_ogm_packet *batadv_ogm_packet; -- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; -+ void *ogm_buff; - -- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; -+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); -+ -+ ogm_buff = hard_iface->bat_iv.ogm_buff; -+ if (!ogm_buff) -+ goto unlock; -+ -+ batadv_ogm_packet = ogm_buff; - ether_addr_copy(batadv_ogm_packet->orig, - hard_iface->net_dev->dev_addr); - ether_addr_copy(batadv_ogm_packet->prev_sender, - hard_iface->net_dev->dev_addr); -+ -+unlock: -+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); - } - - static void - batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface) - { - struct batadv_ogm_packet *batadv_ogm_packet; -- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; -+ void *ogm_buff; - -- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; -+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); -+ -+ ogm_buff = hard_iface->bat_iv.ogm_buff; -+ if (!ogm_buff) -+ goto unlock; -+ -+ batadv_ogm_packet = ogm_buff; - batadv_ogm_packet->ttl = BATADV_TTL; -+ -+unlock: -+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); - } - - /* when do we schedule our own ogm to be sent */ -@@ -890,7 +923,7 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface) - u32 i; - size_t word_index; - u8 *w; -- int if_num; -+ unsigned int if_num; - - for (i = 0; i < hash->size; i++) { - head = &hash->table[i]; -@@ -911,7 +944,11 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface) - } - } - --static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) -+/** -+ * batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer -+ * @hard_iface: interface whose ogm buffer should be transmitted -+ */ -+static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface) - { - struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); - unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff; -@@ -922,8 +959,10 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) - u16 tvlv_len = 0; - unsigned long send_time; - -- if ((hard_iface->if_status == BATADV_IF_NOT_IN_USE) || -- (hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)) -+ lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex); -+ -+ /* interface already disabled by batadv_iv_ogm_iface_disable */ -+ if (!*ogm_buff) - return; - - /* the interface gets activated here to avoid race conditions between -@@ -992,6 +1031,17 @@ out: - batadv_hardif_put(primary_if); - } - -+static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) -+{ -+ if (hard_iface->if_status == BATADV_IF_NOT_IN_USE || -+ hard_iface->if_status == BATADV_IF_TO_BE_REMOVED) -+ return; -+ -+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); -+ batadv_iv_ogm_schedule_buff(hard_iface); -+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); -+} -+ - /** - * batadv_iv_ogm_orig_update - use OGM to update corresponding data in an - * originator -@@ -1020,7 +1070,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv, - struct batadv_neigh_node *tmp_neigh_node = NULL; - struct batadv_neigh_node *router = NULL; - struct batadv_orig_node *orig_node_tmp; -- int if_num; -+ unsigned int if_num; - u8 sum_orig, sum_neigh; - u8 *neigh_addr; - u8 tq_avg; -@@ -1179,7 +1229,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node, - u8 total_count; - u8 orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own; - unsigned int neigh_rq_inv_cube, neigh_rq_max_cube; -- int if_num; -+ unsigned int if_num; - unsigned int tq_asym_penalty, inv_asym_penalty; - unsigned int combined_tq; - unsigned int tq_iface_penalty; -@@ -1220,7 +1270,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node, - orig_node->last_seen = jiffies; - - /* find packet count of corresponding one hop neighbor */ -- spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock); -+ spin_lock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock); - if_num = if_incoming->if_num; - orig_eq_count = orig_neigh_node->bat_iv.bcast_own_sum[if_num]; - neigh_ifinfo = batadv_neigh_ifinfo_new(neigh_node, if_outgoing); -@@ -1230,7 +1280,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node, - } else { - neigh_rq_count = 0; - } -- spin_unlock_bh(&orig_node->bat_iv.ogm_cnt_lock); -+ spin_unlock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock); - - /* pay attention to not get a value bigger than 100 % */ - if (orig_eq_count > neigh_rq_count) -@@ -1698,9 +1748,9 @@ static void batadv_iv_ogm_process(const struct sk_buff *skb, int ogm_offset, - - if (is_my_orig) { - unsigned long *word; -- int offset; -+ size_t offset; - s32 bit_pos; -- s16 if_num; -+ unsigned int if_num; - u8 *weight; - - orig_neigh_node = batadv_iv_ogm_orig_get(bat_priv, -@@ -2477,7 +2527,7 @@ batadv_iv_ogm_neigh_is_sob(struct batadv_neigh_node *neigh1, - return ret; - } - --static void batadv_iv_iface_activate(struct batadv_hard_iface *hard_iface) -+static void batadv_iv_iface_enabled(struct batadv_hard_iface *hard_iface) - { - /* begin scheduling originator messages on that interface */ - batadv_iv_ogm_schedule(hard_iface); -@@ -2817,8 +2867,8 @@ unlock: - static struct batadv_algo_ops batadv_batman_iv __read_mostly = { - .name = "BATMAN_IV", - .iface = { -- .activate = batadv_iv_iface_activate, - .enable = batadv_iv_ogm_iface_enable, -+ .enabled = batadv_iv_iface_enabled, - .disable = batadv_iv_ogm_iface_disable, - .update_mac = batadv_iv_ogm_iface_update_mac, - .primary_set = batadv_iv_ogm_primary_iface_set, -diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c -index 371a1f1651b4..eb8cec14b854 100644 ---- a/net/batman-adv/bat_v.c -+++ b/net/batman-adv/bat_v.c -@@ -19,7 +19,6 @@ - #include "main.h" - - #include --#include - #include - #include - #include -@@ -623,11 +622,11 @@ static int batadv_v_neigh_cmp(struct batadv_neigh_node *neigh1, - int ret = 0; - - ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1); -- if (WARN_ON(!ifinfo1)) -+ if (!ifinfo1) - goto err_ifinfo1; - - ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2); -- if (WARN_ON(!ifinfo2)) -+ if (!ifinfo2) - goto err_ifinfo2; - - ret = ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput; -@@ -649,11 +648,11 @@ static bool batadv_v_neigh_is_sob(struct batadv_neigh_node *neigh1, - bool ret = false; - - ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1); -- if (WARN_ON(!ifinfo1)) -+ if (!ifinfo1) - goto err_ifinfo1; - - ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2); -- if (WARN_ON(!ifinfo2)) -+ if (!ifinfo2) - goto err_ifinfo2; - - threshold = ifinfo1->bat_v.throughput / 4; -@@ -815,7 +814,7 @@ static bool batadv_v_gw_is_eligible(struct batadv_priv *bat_priv, - } - - orig_gw = batadv_gw_node_get(bat_priv, orig_node); -- if (!orig_node) -+ if (!orig_gw) - goto out; - - if (batadv_v_gw_throughput_get(orig_gw, &orig_throughput) < 0) -diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c -index e07f636160b6..cec31769bb3f 100644 ---- a/net/batman-adv/bat_v_ogm.c -+++ b/net/batman-adv/bat_v_ogm.c -@@ -28,6 +28,8 @@ - #include - #include - #include -+#include -+#include - #include - #include - #include -@@ -127,14 +129,12 @@ static void batadv_v_ogm_send_to_if(struct sk_buff *skb, - } - - /** -- * batadv_v_ogm_send - periodic worker broadcasting the own OGM -- * @work: work queue item -+ * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM -+ * @bat_priv: the bat priv with all the soft interface information - */ --static void batadv_v_ogm_send(struct work_struct *work) -+static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv) - { - struct batadv_hard_iface *hard_iface; -- struct batadv_priv_bat_v *bat_v; -- struct batadv_priv *bat_priv; - struct batadv_ogm2_packet *ogm_packet; - struct sk_buff *skb, *skb_tmp; - unsigned char *ogm_buff; -@@ -142,8 +142,7 @@ static void batadv_v_ogm_send(struct work_struct *work) - u16 tvlv_len = 0; - int ret; - -- bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); -- bat_priv = container_of(bat_v, struct batadv_priv, bat_v); -+ lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex); - - if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING) - goto out; -@@ -234,6 +233,23 @@ out: - return; - } - -+/** -+ * batadv_v_ogm_send() - periodic worker broadcasting the own OGM -+ * @work: work queue item -+ */ -+static void batadv_v_ogm_send(struct work_struct *work) -+{ -+ struct batadv_priv_bat_v *bat_v; -+ struct batadv_priv *bat_priv; -+ -+ bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); -+ bat_priv = container_of(bat_v, struct batadv_priv, bat_v); -+ -+ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); -+ batadv_v_ogm_send_softif(bat_priv); -+ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); -+} -+ - /** - * batadv_v_ogm_iface_enable - prepare an interface for B.A.T.M.A.N. V - * @hard_iface: the interface to prepare -@@ -260,11 +276,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface) - struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface); - struct batadv_ogm2_packet *ogm_packet; - -+ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); - if (!bat_priv->bat_v.ogm_buff) -- return; -+ goto unlock; - - ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff; - ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr); -+ -+unlock: -+ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); - } - - /** -@@ -886,6 +906,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv) - atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno); - INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send); - -+ mutex_init(&bat_priv->bat_v.ogm_buff_mutex); -+ - return 0; - } - -@@ -897,7 +919,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv) - { - cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq); - -+ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); -+ - kfree(bat_priv->bat_v.ogm_buff); - bat_priv->bat_v.ogm_buff = NULL; - bat_priv->bat_v.ogm_buff_len = 0; -+ -+ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); - } -diff --git a/net/batman-adv/debugfs.c b/net/batman-adv/debugfs.c -index e32ad47c6efd..4957d4824437 100644 ---- a/net/batman-adv/debugfs.c -+++ b/net/batman-adv/debugfs.c -@@ -18,6 +18,7 @@ - #include "debugfs.h" - #include "main.h" - -+#include - #include - #include - #include -@@ -338,7 +339,26 @@ out: - } - - /** -- * batadv_debugfs_del_hardif - delete the base directory for a hard interface -+ * batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif -+ * @hard_iface: hard interface which was renamed -+ */ -+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface) -+{ -+ const char *name = hard_iface->net_dev->name; -+ struct dentry *dir; -+ struct dentry *d; -+ -+ dir = hard_iface->debug_dir; -+ if (!dir) -+ return; -+ -+ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name); -+ if (!d) -+ pr_err("Can't rename debugfs dir to %s\n", name); -+} -+ -+/** -+ * batadv_debugfs_del_hardif() - delete the base directory for a hard interface - * in debugfs. - * @hard_iface: hard interface which is deleted. - */ -@@ -401,6 +421,30 @@ out: - return -ENOMEM; - } - -+/** -+ * batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif -+ * @dev: net_device which was renamed -+ */ -+void batadv_debugfs_rename_meshif(struct net_device *dev) -+{ -+ struct batadv_priv *bat_priv = netdev_priv(dev); -+ const char *name = dev->name; -+ struct dentry *dir; -+ struct dentry *d; -+ -+ dir = bat_priv->debug_dir; -+ if (!dir) -+ return; -+ -+ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name); -+ if (!d) -+ pr_err("Can't rename debugfs dir to %s\n", name); -+} -+ -+/** -+ * batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries -+ * @dev: netdev struct of the soft interface -+ */ - void batadv_debugfs_del_meshif(struct net_device *dev) - { - struct batadv_priv *bat_priv = netdev_priv(dev); -diff --git a/net/batman-adv/debugfs.h b/net/batman-adv/debugfs.h -index 9c5d4a65b98c..901bbc357bf4 100644 ---- a/net/batman-adv/debugfs.h -+++ b/net/batman-adv/debugfs.h -@@ -29,8 +29,10 @@ struct net_device; - void batadv_debugfs_init(void); - void batadv_debugfs_destroy(void); - int batadv_debugfs_add_meshif(struct net_device *dev); -+void batadv_debugfs_rename_meshif(struct net_device *dev); - void batadv_debugfs_del_meshif(struct net_device *dev); - int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface); -+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface); - void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface); - - #else -@@ -48,6 +50,10 @@ static inline int batadv_debugfs_add_meshif(struct net_device *dev) - return 0; - } - -+static inline void batadv_debugfs_rename_meshif(struct net_device *dev) -+{ -+} -+ - static inline void batadv_debugfs_del_meshif(struct net_device *dev) - { - } -@@ -58,6 +64,11 @@ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface) - return 0; - } - -+static inline -+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface) -+{ -+} -+ - static inline - void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface) - { -diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c -index c6d37d22bd12..788d62073964 100644 ---- a/net/batman-adv/fragmentation.c -+++ b/net/batman-adv/fragmentation.c -@@ -500,6 +500,8 @@ int batadv_frag_send_packet(struct sk_buff *skb, - */ - if (skb->priority >= 256 && skb->priority <= 263) - frag_header.priority = skb->priority - 256; -+ else -+ frag_header.priority = 0; - - ether_addr_copy(frag_header.orig, primary_if->net_dev->dev_addr); - ether_addr_copy(frag_header.dest, orig_node->orig); -diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c -index 2e1a084b0bd2..9fdfa9984f02 100644 ---- a/net/batman-adv/hard-interface.c -+++ b/net/batman-adv/hard-interface.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -738,6 +739,11 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface, - hard_iface->soft_iface = soft_iface; - bat_priv = netdev_priv(hard_iface->soft_iface); - -+ if (bat_priv->num_ifaces >= UINT_MAX) { -+ ret = -ENOSPC; -+ goto err_dev; -+ } -+ - ret = netdev_master_upper_dev_link(hard_iface->net_dev, - soft_iface, NULL, NULL); - if (ret) -@@ -790,6 +796,9 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface, - - batadv_hardif_recalc_extra_skbroom(soft_iface); - -+ if (bat_priv->algo_ops->iface.enabled) -+ bat_priv->algo_ops->iface.enabled(hard_iface); -+ - out: - return 0; - -@@ -845,7 +854,7 @@ void batadv_hardif_disable_interface(struct batadv_hard_iface *hard_iface, - batadv_hardif_recalc_extra_skbroom(hard_iface->soft_iface); - - /* nobody uses this interface anymore */ -- if (!bat_priv->num_ifaces) { -+ if (bat_priv->num_ifaces == 0) { - batadv_gw_check_client_stop(bat_priv); - - if (autodel == BATADV_IF_CLEANUP_AUTO) -@@ -881,7 +890,7 @@ batadv_hardif_add_interface(struct net_device *net_dev) - if (ret) - goto free_if; - -- hard_iface->if_num = -1; -+ hard_iface->if_num = 0; - hard_iface->net_dev = net_dev; - hard_iface->soft_iface = NULL; - hard_iface->if_status = BATADV_IF_NOT_IN_USE; -@@ -893,6 +902,7 @@ batadv_hardif_add_interface(struct net_device *net_dev) - INIT_LIST_HEAD(&hard_iface->list); - INIT_HLIST_HEAD(&hard_iface->neigh_list); - -+ mutex_init(&hard_iface->bat_iv.ogm_buff_mutex); - spin_lock_init(&hard_iface->neigh_list_lock); - kref_init(&hard_iface->refcount); - -@@ -950,6 +960,32 @@ void batadv_hardif_remove_interfaces(void) - rtnl_unlock(); - } - -+/** -+ * batadv_hard_if_event_softif() - Handle events for soft interfaces -+ * @event: NETDEV_* event to handle -+ * @net_dev: net_device which generated an event -+ * -+ * Return: NOTIFY_* result -+ */ -+static int batadv_hard_if_event_softif(unsigned long event, -+ struct net_device *net_dev) -+{ -+ struct batadv_priv *bat_priv; -+ -+ switch (event) { -+ case NETDEV_REGISTER: -+ batadv_sysfs_add_meshif(net_dev); -+ bat_priv = netdev_priv(net_dev); -+ batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS); -+ break; -+ case NETDEV_CHANGENAME: -+ batadv_debugfs_rename_meshif(net_dev); -+ break; -+ } -+ -+ return NOTIFY_DONE; -+} -+ - static int batadv_hard_if_event(struct notifier_block *this, - unsigned long event, void *ptr) - { -@@ -958,12 +994,8 @@ static int batadv_hard_if_event(struct notifier_block *this, - struct batadv_hard_iface *primary_if = NULL; - struct batadv_priv *bat_priv; - -- if (batadv_softif_is_valid(net_dev) && event == NETDEV_REGISTER) { -- batadv_sysfs_add_meshif(net_dev); -- bat_priv = netdev_priv(net_dev); -- batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS); -- return NOTIFY_DONE; -- } -+ if (batadv_softif_is_valid(net_dev)) -+ return batadv_hard_if_event_softif(event, net_dev); - - hard_iface = batadv_hardif_get_by_netdev(net_dev); - if (!hard_iface && (event == NETDEV_REGISTER || -@@ -1012,6 +1044,9 @@ static int batadv_hard_if_event(struct notifier_block *this, - if (batadv_is_wifi_hardif(hard_iface)) - hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS; - break; -+ case NETDEV_CHANGENAME: -+ batadv_debugfs_rename_hardif(hard_iface); -+ break; - default: - break; - } -diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c -index 8e2a4b205257..653eaadcfefb 100644 ---- a/net/batman-adv/originator.c -+++ b/net/batman-adv/originator.c -@@ -1500,7 +1500,7 @@ int batadv_orig_dump(struct sk_buff *msg, struct netlink_callback *cb) - } - - int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface, -- int max_if_num) -+ unsigned int max_if_num) - { - struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); - struct batadv_algo_ops *bao = bat_priv->algo_ops; -@@ -1535,7 +1535,7 @@ err: - } - - int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface, -- int max_if_num) -+ unsigned int max_if_num) - { - struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); - struct batadv_hashtable *hash = bat_priv->orig_hash; -diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h -index d94220a6d21a..d6ca52220ec0 100644 ---- a/net/batman-adv/originator.h -+++ b/net/batman-adv/originator.h -@@ -78,9 +78,9 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset); - int batadv_orig_dump(struct sk_buff *msg, struct netlink_callback *cb); - int batadv_orig_hardif_seq_print_text(struct seq_file *seq, void *offset); - int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface, -- int max_if_num); -+ unsigned int max_if_num); - int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface, -- int max_if_num); -+ unsigned int max_if_num); - struct batadv_orig_node_vlan * - batadv_orig_node_vlan_new(struct batadv_orig_node *orig_node, - unsigned short vid); -diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c -index cd82cff716c7..f59aac06733e 100644 ---- a/net/batman-adv/routing.c -+++ b/net/batman-adv/routing.c -@@ -950,14 +950,10 @@ int batadv_recv_unicast_packet(struct sk_buff *skb, - struct batadv_orig_node *orig_node = NULL, *orig_node_gw = NULL; - int check, hdr_size = sizeof(*unicast_packet); - enum batadv_subtype subtype; -- struct ethhdr *ethhdr; - int ret = NET_RX_DROP; - bool is4addr, is_gw; - - unicast_packet = (struct batadv_unicast_packet *)skb->data; -- unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data; -- ethhdr = eth_hdr(skb); -- - is4addr = unicast_packet->packet_type == BATADV_UNICAST_4ADDR; - /* the caller function should have already pulled 2 bytes */ - if (is4addr) -@@ -977,12 +973,14 @@ int batadv_recv_unicast_packet(struct sk_buff *skb, - if (!batadv_check_unicast_ttvn(bat_priv, skb, hdr_size)) - goto free_skb; - -+ unicast_packet = (struct batadv_unicast_packet *)skb->data; -+ - /* packet for me */ - if (batadv_is_my_mac(bat_priv, unicast_packet->dest)) { - /* If this is a unicast packet from another backgone gw, - * drop it. - */ -- orig_addr_gw = ethhdr->h_source; -+ orig_addr_gw = eth_hdr(skb)->h_source; - orig_node_gw = batadv_orig_hash_find(bat_priv, orig_addr_gw); - if (orig_node_gw) { - is_gw = batadv_bla_is_backbone_gw(skb, orig_node_gw, -@@ -997,6 +995,8 @@ int batadv_recv_unicast_packet(struct sk_buff *skb, - } - - if (is4addr) { -+ unicast_4addr_packet = -+ (struct batadv_unicast_4addr_packet *)skb->data; - subtype = unicast_4addr_packet->subtype; - batadv_dat_inc_counter(bat_priv, subtype); - -diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c -index 2c2670b85fa9..dbc516824175 100644 ---- a/net/batman-adv/translation-table.c -+++ b/net/batman-adv/translation-table.c -@@ -872,7 +872,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, - struct batadv_orig_node_vlan *vlan; - u8 *tt_change_ptr; - -- rcu_read_lock(); -+ spin_lock_bh(&orig_node->vlan_list_lock); - hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) { - num_vlan++; - num_entries += atomic_read(&vlan->tt.num_entries); -@@ -910,7 +910,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, - *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr; - - out: -- rcu_read_unlock(); -+ spin_unlock_bh(&orig_node->vlan_list_lock); - return tvlv_len; - } - -@@ -941,15 +941,20 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, - struct batadv_tvlv_tt_vlan_data *tt_vlan; - struct batadv_softif_vlan *vlan; - u16 num_vlan = 0; -- u16 num_entries = 0; -+ u16 vlan_entries = 0; -+ u16 total_entries = 0; - u16 tvlv_len; - u8 *tt_change_ptr; - int change_offset; - -- rcu_read_lock(); -+ spin_lock_bh(&bat_priv->softif_vlan_list_lock); - hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { -+ vlan_entries = atomic_read(&vlan->tt.num_entries); -+ if (vlan_entries < 1) -+ continue; -+ - num_vlan++; -- num_entries += atomic_read(&vlan->tt.num_entries); -+ total_entries += vlan_entries; - } - - change_offset = sizeof(**tt_data); -@@ -957,7 +962,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, - - /* if tt_len is negative, allocate the space needed by the full table */ - if (*tt_len < 0) -- *tt_len = batadv_tt_len(num_entries); -+ *tt_len = batadv_tt_len(total_entries); - - tvlv_len = *tt_len; - tvlv_len += change_offset; -@@ -974,6 +979,10 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, - - tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(*tt_data + 1); - hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { -+ vlan_entries = atomic_read(&vlan->tt.num_entries); -+ if (vlan_entries < 1) -+ continue; -+ - tt_vlan->vid = htons(vlan->vid); - tt_vlan->crc = htonl(vlan->tt.crc); - -@@ -984,7 +993,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, - *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr; - - out: -- rcu_read_unlock(); -+ spin_unlock_bh(&bat_priv->softif_vlan_list_lock); - return tvlv_len; - } - -@@ -1544,6 +1553,8 @@ batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry, - * by a given originator - * @entry: the TT global entry to check - * @orig_node: the originator to search in the list -+ * @flags: a pointer to store TT flags for the given @entry received -+ * from @orig_node - * - * find out if an orig_node is already in the list of a tt_global_entry. - * -@@ -1551,7 +1562,8 @@ batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry, - */ - static bool - batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry, -- const struct batadv_orig_node *orig_node) -+ const struct batadv_orig_node *orig_node, -+ u8 *flags) - { - struct batadv_tt_orig_list_entry *orig_entry; - bool found = false; -@@ -1559,6 +1571,10 @@ batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry, - orig_entry = batadv_tt_global_orig_entry_find(entry, orig_node); - if (orig_entry) { - found = true; -+ -+ if (flags) -+ *flags = orig_entry->flags; -+ - batadv_tt_orig_list_entry_put(orig_entry); - } - -@@ -1741,7 +1757,7 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv, - if (!(common->flags & BATADV_TT_CLIENT_TEMP)) - goto out; - if (batadv_tt_global_entry_has_orig(tt_global_entry, -- orig_node)) -+ orig_node, NULL)) - goto out_remove; - batadv_tt_global_del_orig_list(tt_global_entry); - goto add_orig_entry; -@@ -2884,23 +2900,46 @@ unlock: - } - - /** -- * batadv_tt_local_valid - verify that given tt entry is a valid one -+ * batadv_tt_local_valid() - verify local tt entry and get flags - * @entry_ptr: to be checked local tt entry - * @data_ptr: not used but definition required to satisfy the callback prototype -+ * @flags: a pointer to store TT flags for this client to -+ * -+ * Checks the validity of the given local TT entry. If it is, then the provided -+ * flags pointer is updated. - * - * Return: true if the entry is a valid, false otherwise. - */ --static bool batadv_tt_local_valid(const void *entry_ptr, const void *data_ptr) -+static bool batadv_tt_local_valid(const void *entry_ptr, -+ const void *data_ptr, -+ u8 *flags) - { - const struct batadv_tt_common_entry *tt_common_entry = entry_ptr; - - if (tt_common_entry->flags & BATADV_TT_CLIENT_NEW) - return false; -+ -+ if (flags) -+ *flags = tt_common_entry->flags; -+ - return true; - } - -+/** -+ * batadv_tt_global_valid() - verify global tt entry and get flags -+ * @entry_ptr: to be checked global tt entry -+ * @data_ptr: an orig_node object (may be NULL) -+ * @flags: a pointer to store TT flags for this client to -+ * -+ * Checks the validity of the given global TT entry. If it is, then the provided -+ * flags pointer is updated either with the common (summed) TT flags if data_ptr -+ * is NULL or the specific, per originator TT flags otherwise. -+ * -+ * Return: true if the entry is a valid, false otherwise. -+ */ - static bool batadv_tt_global_valid(const void *entry_ptr, -- const void *data_ptr) -+ const void *data_ptr, -+ u8 *flags) - { - const struct batadv_tt_common_entry *tt_common_entry = entry_ptr; - const struct batadv_tt_global_entry *tt_global_entry; -@@ -2914,7 +2953,8 @@ static bool batadv_tt_global_valid(const void *entry_ptr, - struct batadv_tt_global_entry, - common); - -- return batadv_tt_global_entry_has_orig(tt_global_entry, orig_node); -+ return batadv_tt_global_entry_has_orig(tt_global_entry, orig_node, -+ flags); - } - - /** -@@ -2924,25 +2964,34 @@ static bool batadv_tt_global_valid(const void *entry_ptr, - * @hash: hash table containing the tt entries - * @tt_len: expected tvlv tt data buffer length in number of bytes - * @tvlv_buff: pointer to the buffer to fill with the TT data -- * @valid_cb: function to filter tt change entries -+ * @valid_cb: function to filter tt change entries and to return TT flags - * @cb_data: data passed to the filter function as argument -+ * -+ * Fills the tvlv buff with the tt entries from the specified hash. If valid_cb -+ * is not provided then this becomes a no-op. - */ - static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv, - struct batadv_hashtable *hash, - void *tvlv_buff, u16 tt_len, - bool (*valid_cb)(const void *, -- const void *), -+ const void *, -+ u8 *flags), - void *cb_data) - { - struct batadv_tt_common_entry *tt_common_entry; - struct batadv_tvlv_tt_change *tt_change; - struct hlist_head *head; - u16 tt_tot, tt_num_entries = 0; -+ u8 flags; -+ bool ret; - u32 i; - - tt_tot = batadv_tt_entries(tt_len); - tt_change = (struct batadv_tvlv_tt_change *)tvlv_buff; - -+ if (!valid_cb) -+ return; -+ - rcu_read_lock(); - for (i = 0; i < hash->size; i++) { - head = &hash->table[i]; -@@ -2952,11 +3001,12 @@ static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv, - if (tt_tot == tt_num_entries) - break; - -- if ((valid_cb) && (!valid_cb(tt_common_entry, cb_data))) -+ ret = valid_cb(tt_common_entry, cb_data, &flags); -+ if (!ret) - continue; - - ether_addr_copy(tt_change->addr, tt_common_entry->addr); -- tt_change->flags = tt_common_entry->flags; -+ tt_change->flags = flags; - tt_change->vid = htons(tt_common_entry->vid); - memset(tt_change->reserved, 0, - sizeof(tt_change->reserved)); -diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h -index d5e3968619b8..540a9c5c2270 100644 ---- a/net/batman-adv/types.h -+++ b/net/batman-adv/types.h -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - #include - #include - #include /* for linux/wait.h */ -@@ -81,11 +82,13 @@ enum batadv_dhcp_recipient { - * @ogm_buff: buffer holding the OGM packet - * @ogm_buff_len: length of the OGM packet buffer - * @ogm_seqno: OGM sequence number - used to identify each OGM -+ * @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len - */ - struct batadv_hard_iface_bat_iv { - unsigned char *ogm_buff; - int ogm_buff_len; - atomic_t ogm_seqno; -+ struct mutex ogm_buff_mutex; - }; - - /** -@@ -155,7 +158,7 @@ enum batadv_hard_iface_wifi_flags { - */ - struct batadv_hard_iface { - struct list_head list; -- s16 if_num; -+ unsigned int if_num; - char if_status; - u8 num_bcasts; - u32 wifi_flags; -@@ -989,12 +992,14 @@ struct batadv_softif_vlan { - * @ogm_buff: buffer holding the OGM packet - * @ogm_buff_len: length of the OGM packet buffer - * @ogm_seqno: OGM sequence number - used to identify each OGM -+ * @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len - * @ogm_wq: workqueue used to schedule OGM transmissions - */ - struct batadv_priv_bat_v { - unsigned char *ogm_buff; - int ogm_buff_len; - atomic_t ogm_seqno; -+ struct mutex ogm_buff_mutex; - struct delayed_work ogm_wq; - }; - -@@ -1081,7 +1086,7 @@ struct batadv_priv { - atomic_t bcast_seqno; - atomic_t bcast_queue_left; - atomic_t batman_queue_left; -- char num_ifaces; -+ unsigned int num_ifaces; - struct kobject *mesh_obj; - struct dentry *debug_dir; - struct hlist_head forw_bat_list; -@@ -1424,6 +1429,7 @@ struct batadv_forw_packet { - * @activate: start routing mechanisms when hard-interface is brought up - * (optional) - * @enable: init routing info when hard-interface is enabled -+ * @enabled: notification when hard-interface was enabled (optional) - * @disable: de-init routing info when hard-interface is disabled - * @update_mac: (re-)init mac addresses of the protocol information - * belonging to this hard-interface -@@ -1432,6 +1438,7 @@ struct batadv_forw_packet { - struct batadv_algo_iface_ops { - void (*activate)(struct batadv_hard_iface *hard_iface); - int (*enable)(struct batadv_hard_iface *hard_iface); -+ void (*enabled)(struct batadv_hard_iface *hard_iface); - void (*disable)(struct batadv_hard_iface *hard_iface); - void (*update_mac)(struct batadv_hard_iface *hard_iface); - void (*primary_set)(struct batadv_hard_iface *hard_iface); -@@ -1479,9 +1486,10 @@ struct batadv_algo_neigh_ops { - */ - struct batadv_algo_orig_ops { - void (*free)(struct batadv_orig_node *orig_node); -- int (*add_if)(struct batadv_orig_node *orig_node, int max_if_num); -- int (*del_if)(struct batadv_orig_node *orig_node, int max_if_num, -- int del_if_num); -+ int (*add_if)(struct batadv_orig_node *orig_node, -+ unsigned int max_if_num); -+ int (*del_if)(struct batadv_orig_node *orig_node, -+ unsigned int max_if_num, unsigned int del_if_num); - #ifdef CONFIG_BATMAN_ADV_DEBUGFS - void (*print)(struct batadv_priv *priv, struct seq_file *seq, - struct batadv_hard_iface *hard_iface); -diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c -index 7bf833598615..67feeb207dad 100644 ---- a/net/core/netclassid_cgroup.c -+++ b/net/core/netclassid_cgroup.c -@@ -57,30 +57,60 @@ static void cgrp_css_free(struct cgroup_subsys_state *css) - kfree(css_cls_state(css)); - } - -+/* -+ * To avoid freezing of sockets creation for tasks with big number of threads -+ * and opened sockets lets release file_lock every 1000 iterated descriptors. -+ * New sockets will already have been created with new classid. -+ */ -+ -+struct update_classid_context { -+ u32 classid; -+ unsigned int batch; -+}; -+ -+#define UPDATE_CLASSID_BATCH 1000 -+ - static int update_classid_sock(const void *v, struct file *file, unsigned n) - { - int err; -+ struct update_classid_context *ctx = (void *)v; - struct socket *sock = sock_from_file(file, &err); - - if (sock) { - spin_lock(&cgroup_sk_update_lock); -- sock_cgroup_set_classid(&sock->sk->sk_cgrp_data, -- (unsigned long)v); -+ sock_cgroup_set_classid(&sock->sk->sk_cgrp_data, ctx->classid); - spin_unlock(&cgroup_sk_update_lock); - } -+ if (--ctx->batch == 0) { -+ ctx->batch = UPDATE_CLASSID_BATCH; -+ return n + 1; -+ } - return 0; - } - -+static void update_classid_task(struct task_struct *p, u32 classid) -+{ -+ struct update_classid_context ctx = { -+ .classid = classid, -+ .batch = UPDATE_CLASSID_BATCH -+ }; -+ unsigned int fd = 0; -+ -+ do { -+ task_lock(p); -+ fd = iterate_fd(p->files, fd, update_classid_sock, &ctx); -+ task_unlock(p); -+ cond_resched(); -+ } while (fd); -+} -+ - static void cgrp_attach(struct cgroup_taskset *tset) - { - struct cgroup_subsys_state *css; - struct task_struct *p; - - cgroup_taskset_for_each(p, css, tset) { -- task_lock(p); -- iterate_fd(p->files, 0, update_classid_sock, -- (void *)(unsigned long)css_cls_state(css)->classid); -- task_unlock(p); -+ update_classid_task(p, css_cls_state(css)->classid); - } - } - -@@ -102,10 +132,7 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft, - - css_task_iter_start(css, 0, &it); - while ((p = css_task_iter_next(&it))) { -- task_lock(p); -- iterate_fd(p->files, 0, update_classid_sock, -- (void *)(unsigned long)cs->classid); -- task_unlock(p); -+ update_classid_task(p, cs->classid); - cond_resched(); - } - css_task_iter_end(&it); -diff --git a/net/core/sock.c b/net/core/sock.c -index 03ca2f638eb4..d2cb2051d045 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1684,7 +1684,10 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) - atomic_set(&newsk->sk_zckey, 0); - - sock_reset_flag(newsk, SOCK_DONE); -- mem_cgroup_sk_alloc(newsk); -+ -+ /* sk->sk_memcg will be populated at accept() time */ -+ newsk->sk_memcg = NULL; -+ - cgroup_sk_alloc(&newsk->sk_cgrp_data); - - rcu_read_lock(); -diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c -index 35c432668454..040983fc15da 100644 ---- a/net/ieee802154/nl_policy.c -+++ b/net/ieee802154/nl_policy.c -@@ -30,7 +30,13 @@ const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = { - [IEEE802154_ATTR_HW_ADDR] = { .type = NLA_HW_ADDR, }, - [IEEE802154_ATTR_PAN_ID] = { .type = NLA_U16, }, - [IEEE802154_ATTR_CHANNEL] = { .type = NLA_U8, }, -+ [IEEE802154_ATTR_BCN_ORD] = { .type = NLA_U8, }, -+ [IEEE802154_ATTR_SF_ORD] = { .type = NLA_U8, }, -+ [IEEE802154_ATTR_PAN_COORD] = { .type = NLA_U8, }, -+ [IEEE802154_ATTR_BAT_EXT] = { .type = NLA_U8, }, -+ [IEEE802154_ATTR_COORD_REALIGN] = { .type = NLA_U8, }, - [IEEE802154_ATTR_PAGE] = { .type = NLA_U8, }, -+ [IEEE802154_ATTR_DEV_TYPE] = { .type = NLA_U8, }, - [IEEE802154_ATTR_COORD_SHORT_ADDR] = { .type = NLA_U16, }, - [IEEE802154_ATTR_COORD_HW_ADDR] = { .type = NLA_HW_ADDR, }, - [IEEE802154_ATTR_COORD_PAN_ID] = { .type = NLA_U16, }, -diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c -index f0165c5f376b..1c21dc5d6dd4 100644 ---- a/net/ipv4/cipso_ipv4.c -+++ b/net/ipv4/cipso_ipv4.c -@@ -1738,6 +1738,7 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) - { - unsigned char optbuf[sizeof(struct ip_options) + 40]; - struct ip_options *opt = (struct ip_options *)optbuf; -+ int res; - - if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES) - return; -@@ -1749,7 +1750,11 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) - - memset(opt, 0, sizeof(struct ip_options)); - opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); -- if (__ip_options_compile(dev_net(skb->dev), opt, skb, NULL)) -+ rcu_read_lock(); -+ res = __ip_options_compile(dev_net(skb->dev), opt, skb, NULL); -+ rcu_read_unlock(); -+ -+ if (res) - return; - - if (gateway) -diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c -index 7efe740c06eb..4a5e55e94a9e 100644 ---- a/net/ipv4/gre_demux.c -+++ b/net/ipv4/gre_demux.c -@@ -60,7 +60,9 @@ int gre_del_protocol(const struct gre_protocol *proto, u8 version) - } - EXPORT_SYMBOL_GPL(gre_del_protocol); - --/* Fills in tpi and returns header length to be pulled. */ -+/* Fills in tpi and returns header length to be pulled. -+ * Note that caller must use pskb_may_pull() before pulling GRE header. -+ */ - int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, - bool *csum_err, __be16 proto, int nhs) - { -@@ -114,8 +116,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, - * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header - */ - if (greh->flags == 0 && tpi->proto == htons(ETH_P_WCCP)) { -+ u8 _val, *val; -+ -+ val = skb_header_pointer(skb, nhs + hdr_len, -+ sizeof(_val), &_val); -+ if (!val) -+ return -EINVAL; - tpi->proto = proto; -- if ((*(u8 *)options & 0xF0) != 0x40) -+ if ((*val & 0xF0) != 0x40) - hdr_len += 4; - } - tpi->hdr_len = hdr_len; -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index da55ce62fe50..7826fba34b14 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -475,8 +475,28 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern) - } - spin_unlock_bh(&queue->fastopenq.lock); - } -+ - out: - release_sock(sk); -+ if (newsk && mem_cgroup_sockets_enabled) { -+ int amt; -+ -+ /* atomically get the memory usage, set and charge the -+ * newsk->sk_memcg. -+ */ -+ lock_sock(newsk); -+ -+ /* The socket has not been accepted yet, no need to look at -+ * newsk->sk_wmem_queued. -+ */ -+ amt = sk_mem_pages(newsk->sk_forward_alloc + -+ atomic_read(&newsk->sk_rmem_alloc)); -+ mem_cgroup_sk_alloc(newsk); -+ if (newsk->sk_memcg && amt) -+ mem_cgroup_charge_skmem(newsk->sk_memcg, amt); -+ -+ release_sock(newsk); -+ } - if (req) - reqsk_put(req); - return newsk; -diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c -index eb158badebc4..7ba013d6c00a 100644 ---- a/net/ipv4/inet_diag.c -+++ b/net/ipv4/inet_diag.c -@@ -105,13 +105,9 @@ static size_t inet_sk_attr_size(struct sock *sk, - aux = handler->idiag_get_aux_size(sk, net_admin); - - return nla_total_size(sizeof(struct tcp_info)) -- + nla_total_size(1) /* INET_DIAG_SHUTDOWN */ -- + nla_total_size(1) /* INET_DIAG_TOS */ -- + nla_total_size(1) /* INET_DIAG_TCLASS */ -- + nla_total_size(4) /* INET_DIAG_MARK */ -- + nla_total_size(4) /* INET_DIAG_CLASS_ID */ -- + nla_total_size(sizeof(struct inet_diag_meminfo)) - + nla_total_size(sizeof(struct inet_diag_msg)) -+ + inet_diag_msg_attrs_size() -+ + nla_total_size(sizeof(struct inet_diag_meminfo)) - + nla_total_size(SK_MEMINFO_VARS * sizeof(u32)) - + nla_total_size(TCP_CA_NAME_MAX) - + nla_total_size(sizeof(struct tcpvegas_info)) -@@ -152,6 +148,24 @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb, - if (net_admin && nla_put_u32(skb, INET_DIAG_MARK, sk->sk_mark)) - goto errout; - -+ if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) || -+ ext & (1 << (INET_DIAG_TCLASS - 1))) { -+ u32 classid = 0; -+ -+#ifdef CONFIG_SOCK_CGROUP_DATA -+ classid = sock_cgroup_classid(&sk->sk_cgrp_data); -+#endif -+ /* Fallback to socket priority if class id isn't set. -+ * Classful qdiscs use it as direct reference to class. -+ * For cgroup2 classid is always zero. -+ */ -+ if (!classid) -+ classid = sk->sk_priority; -+ -+ if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid)) -+ goto errout; -+ } -+ - r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk)); - r->idiag_inode = sock_i_ino(sk); - -@@ -289,24 +303,6 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk, - goto errout; - } - -- if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) || -- ext & (1 << (INET_DIAG_TCLASS - 1))) { -- u32 classid = 0; -- --#ifdef CONFIG_SOCK_CGROUP_DATA -- classid = sock_cgroup_classid(&sk->sk_cgrp_data); --#endif -- /* Fallback to socket priority if class id isn't set. -- * Classful qdiscs use it as direct reference to class. -- * For cgroup2 classid is always zero. -- */ -- if (!classid) -- classid = sk->sk_priority; -- -- if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid)) -- goto errout; -- } -- - out: - nlmsg_end(skb, nlh); - return 0; -diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c -index 6367ecdf76c4..1d84b02ec765 100644 ---- a/net/ipv4/raw_diag.c -+++ b/net/ipv4/raw_diag.c -@@ -99,8 +99,9 @@ static int raw_diag_dump_one(struct sk_buff *in_skb, - if (IS_ERR(sk)) - return PTR_ERR(sk); - -- rep = nlmsg_new(sizeof(struct inet_diag_msg) + -- sizeof(struct inet_diag_meminfo) + 64, -+ rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) + -+ inet_diag_msg_attrs_size() + -+ nla_total_size(sizeof(struct inet_diag_meminfo)) + 64, - GFP_KERNEL); - if (!rep) { - sock_put(sk); -diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c -index d9ad986c7b2c..cc3f6da306c6 100644 ---- a/net/ipv4/udp_diag.c -+++ b/net/ipv4/udp_diag.c -@@ -67,8 +67,9 @@ static int udp_dump_one(struct udp_table *tbl, struct sk_buff *in_skb, - goto out; - - err = -ENOMEM; -- rep = nlmsg_new(sizeof(struct inet_diag_msg) + -- sizeof(struct inet_diag_meminfo) + 64, -+ rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) + -+ inet_diag_msg_attrs_size() + -+ nla_total_size(sizeof(struct inet_diag_meminfo)) + 64, - GFP_KERNEL); - if (!rep) - goto out; -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index a81201dd3a1a..092e72d6a61d 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3223,6 +3223,10 @@ static void addrconf_dev_config(struct net_device *dev) - (dev->type != ARPHRD_TUNNEL) && - (dev->type != ARPHRD_NONE)) { - /* Alas, we support only Ethernet autoconfiguration. */ -+ idev = __in6_dev_get(dev); -+ if (!IS_ERR_OR_NULL(idev) && dev->flags & IFF_UP && -+ dev->flags & IFF_MULTICAST) -+ ipv6_mc_up(idev); - return; - } - -diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c -index 5c91b05c8d8f..8c492471b0da 100644 ---- a/net/ipv6/ipv6_sockglue.c -+++ b/net/ipv6/ipv6_sockglue.c -@@ -185,9 +185,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, - retv = -EBUSY; - break; - } -- } else if (sk->sk_protocol != IPPROTO_TCP) -+ } else if (sk->sk_protocol == IPPROTO_TCP) { -+ if (sk->sk_prot != &tcpv6_prot) { -+ retv = -EBUSY; -+ break; -+ } - break; -- -+ } else { -+ break; -+ } - if (sk->sk_state != TCP_ESTABLISHED) { - retv = -ENOTCONN; - break; -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 31000622376d..7c92b1471c34 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -3862,7 +3862,7 @@ void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) - - lockdep_assert_held(&local->sta_mtx); - -- list_for_each_entry_rcu(sta, &local->sta_list, list) { -+ list_for_each_entry(sta, &local->sta_list, list) { - if (sdata != sta->sdata && - (!sta->sdata->bss || sta->sdata->bss != sdata->bss)) - continue; -diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c -index d33ce6d5ebce..dd1030f5dd5e 100644 ---- a/net/netfilter/nfnetlink_cthelper.c -+++ b/net/netfilter/nfnetlink_cthelper.c -@@ -733,6 +733,8 @@ static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = { - [NFCTH_NAME] = { .type = NLA_NUL_STRING, - .len = NF_CT_HELPER_NAME_LEN-1 }, - [NFCTH_QUEUE_NUM] = { .type = NLA_U32, }, -+ [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, }, -+ [NFCTH_STATUS] = { .type = NLA_U32, }, - }; - - static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = { -diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c -index e110b0ebbf58..19446a89a2a8 100644 ---- a/net/netfilter/nft_payload.c -+++ b/net/netfilter/nft_payload.c -@@ -121,6 +121,7 @@ static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = { - [NFTA_PAYLOAD_LEN] = { .type = NLA_U32 }, - [NFTA_PAYLOAD_CSUM_TYPE] = { .type = NLA_U32 }, - [NFTA_PAYLOAD_CSUM_OFFSET] = { .type = NLA_U32 }, -+ [NFTA_PAYLOAD_CSUM_FLAGS] = { .type = NLA_U32 }, - }; - - static int nft_payload_init(const struct nft_ctx *ctx, -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 07924559cb10..3e4e07559272 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -2389,7 +2389,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err, - in_skb->len)) - WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS, - (u8 *)extack->bad_attr - -- in_skb->data)); -+ (u8 *)nlh)); - } else { - if (extack->cookie_len) - WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE, -diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c -index 6bf14f4f4b42..ae315dbd3732 100644 ---- a/net/nfc/hci/core.c -+++ b/net/nfc/hci/core.c -@@ -193,13 +193,20 @@ exit: - void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, - struct sk_buff *skb) - { -- u8 gate = hdev->pipes[pipe].gate; - u8 status = NFC_HCI_ANY_OK; - struct hci_create_pipe_resp *create_info; - struct hci_delete_pipe_noti *delete_info; - struct hci_all_pipe_cleared_noti *cleared_info; -+ u8 gate; - -- pr_debug("from gate %x pipe %x cmd %x\n", gate, pipe, cmd); -+ pr_debug("from pipe %x cmd %x\n", pipe, cmd); -+ -+ if (pipe >= NFC_HCI_MAX_PIPES) { -+ status = NFC_HCI_ANY_E_NOK; -+ goto exit; -+ } -+ -+ gate = hdev->pipes[pipe].gate; - - switch (cmd) { - case NFC_HCI_ADM_NOTIFY_PIPE_CREATED: -@@ -387,8 +394,14 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event, - struct sk_buff *skb) - { - int r = 0; -- u8 gate = hdev->pipes[pipe].gate; -+ u8 gate; -+ -+ if (pipe >= NFC_HCI_MAX_PIPES) { -+ pr_err("Discarded event %x to invalid pipe %x\n", event, pipe); -+ goto exit; -+ } - -+ gate = hdev->pipes[pipe].gate; - if (gate == NFC_HCI_INVALID_GATE) { - pr_err("Discarded event %x to unopened pipe %x\n", event, pipe); - goto exit; -diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c -index 7b8d4d235a3a..6199f4334fbd 100644 ---- a/net/nfc/netlink.c -+++ b/net/nfc/netlink.c -@@ -55,7 +55,10 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = { - [NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED }, - [NFC_ATTR_FIRMWARE_NAME] = { .type = NLA_STRING, - .len = NFC_FIRMWARE_NAME_MAXSIZE }, -+ [NFC_ATTR_SE_INDEX] = { .type = NLA_U32 }, - [NFC_ATTR_SE_APDU] = { .type = NLA_BINARY }, -+ [NFC_ATTR_VENDOR_ID] = { .type = NLA_U32 }, -+ [NFC_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, - [NFC_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, - - }; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 46b7fac82775..387589a4a340 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2299,6 +2299,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - TP_STATUS_KERNEL, (macoff+snaplen)); - if (!h.raw) - goto drop_n_account; -+ -+ if (do_vnet && -+ virtio_net_hdr_from_skb(skb, h.raw + macoff - -+ sizeof(struct virtio_net_hdr), -+ vio_le(), true, 0)) -+ goto drop_n_account; -+ - if (po->tp_version <= TPACKET_V2) { - packet_increment_rx_head(po, &po->rx_ring); - /* -@@ -2311,12 +2318,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - status |= TP_STATUS_LOSING; - } - -- if (do_vnet && -- virtio_net_hdr_from_skb(skb, h.raw + macoff - -- sizeof(struct virtio_net_hdr), -- vio_le(), true, 0)) -- goto drop_n_account; -- - po->stats.stats1.tp_packets++; - if (copy_skb) { - status |= TP_STATUS_COPY; -diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c -index 7a944f508cae..66f1d40b910a 100644 ---- a/net/sched/sch_fq.c -+++ b/net/sched/sch_fq.c -@@ -695,6 +695,7 @@ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = { - [TCA_FQ_FLOW_MAX_RATE] = { .type = NLA_U32 }, - [TCA_FQ_BUCKETS_LOG] = { .type = NLA_U32 }, - [TCA_FQ_FLOW_REFILL_DELAY] = { .type = NLA_U32 }, -+ [TCA_FQ_ORPHAN_MASK] = { .type = NLA_U32 }, - [TCA_FQ_LOW_RATE_THRESHOLD] = { .type = NLA_U32 }, - }; - -diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c -index 75274a60b77a..6a5a3dfa6c8d 100644 ---- a/net/sctp/sctp_diag.c -+++ b/net/sctp/sctp_diag.c -@@ -221,15 +221,11 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc) - addrcnt++; - - return nla_total_size(sizeof(struct sctp_info)) -- + nla_total_size(1) /* INET_DIAG_SHUTDOWN */ -- + nla_total_size(1) /* INET_DIAG_TOS */ -- + nla_total_size(1) /* INET_DIAG_TCLASS */ -- + nla_total_size(4) /* INET_DIAG_MARK */ -- + nla_total_size(4) /* INET_DIAG_CLASS_ID */ - + nla_total_size(addrlen * asoc->peer.transport_count) - + nla_total_size(addrlen * addrcnt) -- + nla_total_size(sizeof(struct inet_diag_meminfo)) - + nla_total_size(sizeof(struct inet_diag_msg)) -+ + inet_diag_msg_attrs_size() -+ + nla_total_size(sizeof(struct inet_diag_meminfo)) - + 64; - } - -diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c -index 4410d0071515..7d89b0584944 100644 ---- a/net/smc/smc_ib.c -+++ b/net/smc/smc_ib.c -@@ -513,6 +513,8 @@ static void smc_ib_remove_dev(struct ib_device *ibdev, void *client_data) - struct smc_ib_device *smcibdev; - - smcibdev = ib_get_client_data(ibdev, &smc_ib_client); -+ if (!smcibdev || smcibdev->ibdev != ibdev) -+ return; - ib_set_client_data(ibdev, &smc_ib_client, NULL); - spin_lock(&smc_ib_devices.lock); - list_del_init(&smcibdev->list); /* remove from smc_ib_devices */ -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index b248578aeb7b..d0b75781e6f7 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -347,6 +347,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { - [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, - [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, - [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 }, -+ [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, -+ [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, - [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, - [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, - [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, -@@ -395,6 +397,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { - [NL80211_ATTR_MDID] = { .type = NLA_U16 }, - [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, - .len = IEEE80211_MAX_DATA_LEN }, -+ [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, -+ [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = { .type = NLA_U16 }, - [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 }, - [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, - [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, -@@ -420,6 +424,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { - [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 }, - [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, - [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, -+ [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, - [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, - [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, - [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index a520f433d476..b95d1c2bdef7 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -1733,7 +1733,7 @@ static void handle_channel_custom(struct wiphy *wiphy, - break; - } - -- if (IS_ERR(reg_rule)) { -+ if (IS_ERR_OR_NULL(reg_rule)) { - pr_debug("Disabling freq %d MHz as custom regd has no rule that fits it\n", - chan->center_freq); - if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) { -diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl -index 0c8b61f8398e..3bdd6a463819 100755 ---- a/tools/testing/ktest/ktest.pl -+++ b/tools/testing/ktest/ktest.pl -@@ -1345,7 +1345,7 @@ sub reboot { - - } else { - # Make sure everything has been written to disk -- run_ssh("sync"); -+ run_ssh("sync", 10); - - if (defined($time)) { - start_monitor; diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.174-175.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.174-175.patch deleted file mode 100644 index ba46f78bb1..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.174-175.patch +++ /dev/null @@ -1,4354 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/net/fsl-fman.txt b/Documentation/devicetree/bindings/net/fsl-fman.txt -index df873d1f3b7c..2aaae210317b 100644 ---- a/Documentation/devicetree/bindings/net/fsl-fman.txt -+++ b/Documentation/devicetree/bindings/net/fsl-fman.txt -@@ -110,6 +110,13 @@ PROPERTIES - Usage: required - Definition: See soc/fsl/qman.txt and soc/fsl/bman.txt - -+- fsl,erratum-a050385 -+ Usage: optional -+ Value type: boolean -+ Definition: A boolean property. Indicates the presence of the -+ erratum A050385 which indicates that DMA transactions that are -+ split can result in a FMan lock. -+ - ============================================================================= - FMan MURAM Node - -diff --git a/Makefile b/Makefile -index edc6b62bd892..3b792208fbc2 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 174 -+SUBLEVEL = 175 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts -index b8565fc33eea..e5f2cca86f04 100644 ---- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts -+++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts -@@ -118,6 +118,7 @@ - &sdhci { - #address-cells = <1>; - #size-cells = <0>; -+ pinctrl-names = "default"; - pinctrl-0 = <&emmc_gpio34 &gpclk2_gpio43>; - mmc-pwrseq = <&wifi_pwrseq>; - non-removable; -diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi -index fec965009b9f..f271c564d57d 100644 ---- a/arch/arm/boot/dts/dra7.dtsi -+++ b/arch/arm/boot/dts/dra7.dtsi -@@ -137,6 +137,7 @@ - #address-cells = <1>; - #size-cells = <1>; - ranges = <0x0 0x0 0x0 0xc0000000>; -+ dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>; - ti,hwmods = "l3_main_1", "l3_main_2"; - reg = <0x0 0x44000000 0x0 0x1000000>, - <0x0 0x45000000 0x0 0x1000>; -@@ -302,6 +303,7 @@ - device_type = "pci"; - ranges = <0x81000000 0 0 0x03000 0 0x00010000 - 0x82000000 0 0x20013000 0x13000 0 0xffed000>; -+ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; - bus-range = <0x00 0xff>; - #interrupt-cells = <1>; - num-lanes = <1>; -@@ -356,6 +358,7 @@ - device_type = "pci"; - ranges = <0x81000000 0 0 0x03000 0 0x00010000 - 0x82000000 0 0x30013000 0x13000 0 0xffed000>; -+ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; - bus-range = <0x00 0xff>; - #interrupt-cells = <1>; - num-lanes = <1>; -diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi -index eaff2a5751dd..bc3f53c79e9d 100644 ---- a/arch/arm/boot/dts/omap5.dtsi -+++ b/arch/arm/boot/dts/omap5.dtsi -@@ -131,6 +131,7 @@ - #address-cells = <1>; - #size-cells = <1>; - ranges = <0 0 0 0xc0000000>; -+ dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>; - ti,hwmods = "l3_main_1", "l3_main_2", "l3_main_3"; - reg = <0 0x44000000 0 0x2000>, - <0 0x44800000 0 0x3000>, -diff --git a/arch/arm/boot/dts/ox810se.dtsi b/arch/arm/boot/dts/ox810se.dtsi -index 46aa6db8353a..3d2f91234f1a 100644 ---- a/arch/arm/boot/dts/ox810se.dtsi -+++ b/arch/arm/boot/dts/ox810se.dtsi -@@ -322,8 +322,8 @@ - interrupt-controller; - reg = <0 0x200>; - #interrupt-cells = <1>; -- valid-mask = <0xFFFFFFFF>; -- clear-mask = <0>; -+ valid-mask = <0xffffffff>; -+ clear-mask = <0xffffffff>; - }; - - timer0: timer@200 { -diff --git a/arch/arm/boot/dts/ox820.dtsi b/arch/arm/boot/dts/ox820.dtsi -index 459207536a46..8355cb034525 100644 ---- a/arch/arm/boot/dts/ox820.dtsi -+++ b/arch/arm/boot/dts/ox820.dtsi -@@ -239,8 +239,8 @@ - reg = <0 0x200>; - interrupts = ; - #interrupt-cells = <1>; -- valid-mask = <0xFFFFFFFF>; -- clear-mask = <0>; -+ valid-mask = <0xffffffff>; -+ clear-mask = <0xffffffff>; - }; - - timer0: timer@200 { -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi -index 169e171407a6..acd205ef329f 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi -@@ -21,6 +21,8 @@ - }; - - &fman0 { -+ fsl,erratum-a050385; -+ - /* these aliases provide the FMan ports mapping */ - enet0: ethernet@e0000 { - }; -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1043a-rdb.dts -index 3dc0c8e9663d..3aead63e5475 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1043a-rdb.dts -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a-rdb.dts -@@ -155,12 +155,12 @@ - - ethernet@e4000 { - phy-handle = <&rgmii_phy1>; -- phy-connection-type = "rgmii-txid"; -+ phy-connection-type = "rgmii-id"; - }; - - ethernet@e6000 { - phy-handle = <&rgmii_phy2>; -- phy-connection-type = "rgmii-txid"; -+ phy-connection-type = "rgmii-id"; - }; - - ethernet@e8000 { -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts -index 5dc2782e2a58..e775e59d0370 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts -@@ -162,12 +162,12 @@ - &fman0 { - ethernet@e4000 { - phy-handle = <&rgmii_phy1>; -- phy-connection-type = "rgmii"; -+ phy-connection-type = "rgmii-id"; - }; - - ethernet@e6000 { - phy-handle = <&rgmii_phy2>; -- phy-connection-type = "rgmii"; -+ phy-connection-type = "rgmii-id"; - }; - - ethernet@e8000 { -diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h -index 4cd4a793dc32..4ed869845a23 100644 ---- a/arch/arm64/include/asm/alternative.h -+++ b/arch/arm64/include/asm/alternative.h -@@ -216,7 +216,7 @@ alternative_endif - - .macro user_alt, label, oldinstr, newinstr, cond - 9999: alternative_insn "\oldinstr", "\newinstr", \cond -- _ASM_EXTABLE 9999b, \label -+ _asm_extable 9999b, \label - .endm - - /* -diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c -index e230b4dff960..e8574b95bda8 100644 ---- a/arch/arm64/kernel/ptrace.c -+++ b/arch/arm64/kernel/ptrace.c -@@ -833,6 +833,7 @@ static int compat_gpr_get(struct task_struct *target, - break; - case 16: - reg = task_pt_regs(target)->pstate; -+ reg = pstate_to_compat_psr(reg); - break; - case 17: - reg = task_pt_regs(target)->orig_x0; -@@ -900,6 +901,7 @@ static int compat_gpr_set(struct task_struct *target, - newregs.pc = reg; - break; - case 16: -+ reg = compat_psr_to_pstate(reg); - newregs.pstate = reg; - break; - case 17: -diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c -index e09bf5d15606..3832750cee8b 100644 ---- a/arch/arm64/kernel/signal32.c -+++ b/arch/arm64/kernel/signal32.c -@@ -321,6 +321,7 @@ static int compat_restore_sigframe(struct pt_regs *regs, - int err; - sigset_t set; - struct compat_aux_sigframe __user *aux; -+ unsigned long psr; - - err = get_sigset_t(&set, &sf->uc.uc_sigmask); - if (err == 0) { -@@ -344,7 +345,9 @@ static int compat_restore_sigframe(struct pt_regs *regs, - __get_user_error(regs->compat_sp, &sf->uc.uc_mcontext.arm_sp, err); - __get_user_error(regs->compat_lr, &sf->uc.uc_mcontext.arm_lr, err); - __get_user_error(regs->pc, &sf->uc.uc_mcontext.arm_pc, err); -- __get_user_error(regs->pstate, &sf->uc.uc_mcontext.arm_cpsr, err); -+ __get_user_error(psr, &sf->uc.uc_mcontext.arm_cpsr, err); -+ -+ regs->pstate = compat_psr_to_pstate(psr); - - /* - * Avoid compat_sys_sigreturn() restarting. -@@ -500,6 +503,7 @@ static int compat_setup_sigframe(struct compat_sigframe __user *sf, - struct pt_regs *regs, sigset_t *set) - { - struct compat_aux_sigframe __user *aux; -+ unsigned long psr = pstate_to_compat_psr(regs->pstate); - int err = 0; - - __put_user_error(regs->regs[0], &sf->uc.uc_mcontext.arm_r0, err); -@@ -518,7 +522,7 @@ static int compat_setup_sigframe(struct compat_sigframe __user *sf, - __put_user_error(regs->compat_sp, &sf->uc.uc_mcontext.arm_sp, err); - __put_user_error(regs->compat_lr, &sf->uc.uc_mcontext.arm_lr, err); - __put_user_error(regs->pc, &sf->uc.uc_mcontext.arm_pc, err); -- __put_user_error(regs->pstate, &sf->uc.uc_mcontext.arm_cpsr, err); -+ __put_user_error(psr, &sf->uc.uc_mcontext.arm_cpsr, err); - - __put_user_error((compat_ulong_t)0, &sf->uc.uc_mcontext.trap_no, err); - /* set the compat FSR WnR */ -diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c -index 909bf3926fd2..cfb5a6ad7865 100644 ---- a/arch/arm64/kernel/smp.c -+++ b/arch/arm64/kernel/smp.c -@@ -913,11 +913,22 @@ void tick_broadcast(const struct cpumask *mask) - } - #endif - -+/* -+ * The number of CPUs online, not counting this CPU (which may not be -+ * fully online and so not counted in num_online_cpus()). -+ */ -+static inline unsigned int num_other_online_cpus(void) -+{ -+ unsigned int this_cpu_online = cpu_online(smp_processor_id()); -+ -+ return num_online_cpus() - this_cpu_online; -+} -+ - void smp_send_stop(void) - { - unsigned long timeout; - -- if (num_online_cpus() > 1) { -+ if (num_other_online_cpus()) { - cpumask_t mask; - - cpumask_copy(&mask, cpu_online_mask); -@@ -930,10 +941,10 @@ void smp_send_stop(void) - - /* Wait up to one second for other CPUs to stop */ - timeout = USEC_PER_SEC; -- while (num_online_cpus() > 1 && timeout--) -+ while (num_other_online_cpus() && timeout--) - udelay(1); - -- if (num_online_cpus() > 1) -+ if (num_other_online_cpus()) - pr_warning("SMP: failed to stop secondary CPUs %*pbl\n", - cpumask_pr_args(cpu_online_mask)); - } -@@ -954,13 +965,17 @@ void crash_smp_send_stop(void) - - cpus_stopped = 1; - -- if (num_online_cpus() == 1) -+ /* -+ * If this cpu is the only one alive at this point in time, online or -+ * not, there are no stop messages to be sent around, so just back out. -+ */ -+ if (num_other_online_cpus() == 0) - return; - - cpumask_copy(&mask, cpu_online_mask); - cpumask_clear_cpu(smp_processor_id(), &mask); - -- atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); -+ atomic_set(&waiting_for_crash_ipi, num_other_online_cpus()); - - pr_crit("SMP: stopping secondary CPUs\n"); - smp_cross_call(&mask, IPI_CPU_CRASH_STOP); -diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S -index b0cf4af7ba84..e4da937d6cf9 100644 ---- a/arch/powerpc/kernel/vmlinux.lds.S -+++ b/arch/powerpc/kernel/vmlinux.lds.S -@@ -317,6 +317,12 @@ SECTIONS - *(.branch_lt) - } - -+#ifdef CONFIG_DEBUG_INFO_BTF -+ .BTF : AT(ADDR(.BTF) - LOAD_OFFSET) { -+ *(.BTF) -+ } -+#endif -+ - .opd : AT(ADDR(.opd) - LOAD_OFFSET) { - *(.opd) - } -diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c -index ccc2b9d2956a..387340b1f6db 100644 ---- a/arch/x86/kernel/ftrace.c -+++ b/arch/x86/kernel/ftrace.c -@@ -36,6 +36,7 @@ - #ifdef CONFIG_DYNAMIC_FTRACE - - int ftrace_arch_code_modify_prepare(void) -+ __acquires(&text_mutex) - { - mutex_lock(&text_mutex); - set_kernel_text_rw(); -@@ -44,6 +45,7 @@ int ftrace_arch_code_modify_prepare(void) - } - - int ftrace_arch_code_modify_post_process(void) -+ __releases(&text_mutex) - { - set_all_modules_text_ro(); - set_kernel_text_ro(); -diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c -index 27cab342a0b2..1789626cf95e 100644 ---- a/arch/x86/mm/fault.c -+++ b/arch/x86/mm/fault.c -@@ -272,7 +272,7 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address) - return pmd_k; - } - --void vmalloc_sync_all(void) -+static void vmalloc_sync(void) - { - unsigned long address; - -@@ -299,6 +299,16 @@ void vmalloc_sync_all(void) - } - } - -+void vmalloc_sync_mappings(void) -+{ -+ vmalloc_sync(); -+} -+ -+void vmalloc_sync_unmappings(void) -+{ -+ vmalloc_sync(); -+} -+ - /* - * 32-bit: - * -@@ -401,11 +411,23 @@ out: - - #else /* CONFIG_X86_64: */ - --void vmalloc_sync_all(void) -+void vmalloc_sync_mappings(void) - { -+ /* -+ * 64-bit mappings might allocate new p4d/pud pages -+ * that need to be propagated to all tasks' PGDs. -+ */ - sync_global_pgds(VMALLOC_START & PGDIR_MASK, VMALLOC_END); - } - -+void vmalloc_sync_unmappings(void) -+{ -+ /* -+ * Unmappings never allocate or free p4d/pud pages. -+ * No work is required here. -+ */ -+} -+ - /* - * 64-bit: - * -diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c -index afbbe5750a1f..7d7aee024ece 100644 ---- a/block/bfq-cgroup.c -+++ b/block/bfq-cgroup.c -@@ -499,12 +499,13 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd, - */ - entity = &bfqg->entity; - for_each_entity(entity) { -- bfqg = container_of(entity, struct bfq_group, entity); -- if (bfqg != bfqd->root_group) { -- parent = bfqg_parent(bfqg); -+ struct bfq_group *curr_bfqg = container_of(entity, -+ struct bfq_group, entity); -+ if (curr_bfqg != bfqd->root_group) { -+ parent = bfqg_parent(curr_bfqg); - if (!parent) - parent = bfqd->root_group; -- bfq_group_set_parent(bfqg, parent); -+ bfq_group_set_parent(curr_bfqg, parent); - } - } - -diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c -index cd6fae6ad4c2..3f9f286088fa 100644 ---- a/drivers/acpi/apei/ghes.c -+++ b/drivers/acpi/apei/ghes.c -@@ -201,7 +201,7 @@ static int ghes_estatus_pool_expand(unsigned long len) - * New allocation must be visible in all pgd before it can be found by - * an NMI allocating from the pool. - */ -- vmalloc_sync_all(); -+ vmalloc_sync_mappings(); - - return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1); - } -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index c7b9125c8ec2..7c06f4541c5d 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -24,18 +24,21 @@ - - #include "gpiolib.h" - --#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l --#define QUIRK_NO_WAKEUP 0x02l -- - static int run_edge_events_on_boot = -1; - module_param(run_edge_events_on_boot, int, 0444); - MODULE_PARM_DESC(run_edge_events_on_boot, - "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto"); - --static int honor_wakeup = -1; --module_param(honor_wakeup, int, 0444); --MODULE_PARM_DESC(honor_wakeup, -- "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto"); -+static char *ignore_wake; -+module_param(ignore_wake, charp, 0444); -+MODULE_PARM_DESC(ignore_wake, -+ "controller@pin combos on which to ignore the ACPI wake flag " -+ "ignore_wake=controller@pin[,controller@pin[,...]]"); -+ -+struct acpi_gpiolib_dmi_quirk { -+ bool no_edge_events_on_boot; -+ char *ignore_wake; -+}; - - /** - * struct acpi_gpio_event - ACPI GPIO event handler data -@@ -262,6 +265,57 @@ static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio) - acpi_gpiochip_request_irq(acpi_gpio, event); - } - -+static bool acpi_gpio_in_ignore_list(const char *controller_in, int pin_in) -+{ -+ const char *controller, *pin_str; -+ int len, pin; -+ char *endp; -+ -+ controller = ignore_wake; -+ while (controller) { -+ pin_str = strchr(controller, '@'); -+ if (!pin_str) -+ goto err; -+ -+ len = pin_str - controller; -+ if (len == strlen(controller_in) && -+ strncmp(controller, controller_in, len) == 0) { -+ pin = simple_strtoul(pin_str + 1, &endp, 10); -+ if (*endp != 0 && *endp != ',') -+ goto err; -+ -+ if (pin == pin_in) -+ return true; -+ } -+ -+ controller = strchr(controller, ','); -+ if (controller) -+ controller++; -+ } -+ -+ return false; -+err: -+ pr_err_once("Error invalid value for gpiolib_acpi.ignore_wake: %s\n", -+ ignore_wake); -+ return false; -+} -+ -+static bool acpi_gpio_irq_is_wake(struct device *parent, -+ struct acpi_resource_gpio *agpio) -+{ -+ int pin = agpio->pin_table[0]; -+ -+ if (agpio->wake_capable != ACPI_WAKE_CAPABLE) -+ return false; -+ -+ if (acpi_gpio_in_ignore_list(dev_name(parent), pin)) { -+ dev_info(parent, "Ignoring wakeup on pin %d\n", pin); -+ return false; -+ } -+ -+ return true; -+} -+ - static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, - void *context) - { -@@ -347,7 +401,7 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, - event->handle = evt_handle; - event->handler = handler; - event->irq = irq; -- event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE; -+ event->irq_is_wake = acpi_gpio_irq_is_wake(chip->parent, agpio); - event->pin = pin; - event->desc = desc; - -@@ -1331,7 +1385,9 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = { - DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), - DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), - }, -- .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, -+ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { -+ .no_edge_events_on_boot = true, -+ }, - }, - { - /* -@@ -1344,16 +1400,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = { - DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"), - DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), - }, -- .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, -+ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { -+ .no_edge_events_on_boot = true, -+ }, - }, - { - /* -- * Various HP X2 10 Cherry Trail models use an external -- * embedded-controller connected via I2C + an ACPI GPIO -- * event handler. The embedded controller generates various -- * spurious wakeup events when suspended. So disable wakeup -- * for its handler (it uses the only ACPI GPIO event handler). -- * This breaks wakeup when opening the lid, the user needs -+ * HP X2 10 models with Cherry Trail SoC + TI PMIC use an -+ * external embedded-controller connected via I2C + an ACPI GPIO -+ * event handler on INT33FF:01 pin 0, causing spurious wakeups. -+ * When suspending by closing the LID, the power to the USB -+ * keyboard is turned off, causing INT0002 ACPI events to -+ * trigger once the XHCI controller notices the keyboard is -+ * gone. So INT0002 events cause spurious wakeups too. Ignoring -+ * EC wakes breaks wakeup when opening the lid, the user needs - * to press the power-button to wakeup the system. The - * alternative is suspend simply not working, which is worse. - */ -@@ -1361,33 +1421,61 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = { - DMI_MATCH(DMI_SYS_VENDOR, "HP"), - DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), - }, -- .driver_data = (void *)QUIRK_NO_WAKEUP, -+ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { -+ .ignore_wake = "INT33FF:01@0,INT0002:00@2", -+ }, -+ }, -+ { -+ /* -+ * HP X2 10 models with Bay Trail SoC + AXP288 PMIC use an -+ * external embedded-controller connected via I2C + an ACPI GPIO -+ * event handler on INT33FC:02 pin 28, causing spurious wakeups. -+ */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"), -+ DMI_MATCH(DMI_BOARD_NAME, "815D"), -+ }, -+ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { -+ .ignore_wake = "INT33FC:02@28", -+ }, -+ }, -+ { -+ /* -+ * HP X2 10 models with Cherry Trail SoC + AXP288 PMIC use an -+ * external embedded-controller connected via I2C + an ACPI GPIO -+ * event handler on INT33FF:01 pin 0, causing spurious wakeups. -+ */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "HP"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"), -+ DMI_MATCH(DMI_BOARD_NAME, "813E"), -+ }, -+ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { -+ .ignore_wake = "INT33FF:01@0", -+ }, - }, - {} /* Terminating entry */ - }; - - static int acpi_gpio_setup_params(void) - { -+ const struct acpi_gpiolib_dmi_quirk *quirk = NULL; - const struct dmi_system_id *id; -- long quirks = 0; - - id = dmi_first_match(gpiolib_acpi_quirks); - if (id) -- quirks = (long)id->driver_data; -+ quirk = id->driver_data; - - if (run_edge_events_on_boot < 0) { -- if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT) -+ if (quirk && quirk->no_edge_events_on_boot) - run_edge_events_on_boot = 0; - else - run_edge_events_on_boot = 1; - } - -- if (honor_wakeup < 0) { -- if (quirks & QUIRK_NO_WAKEUP) -- honor_wakeup = 0; -- else -- honor_wakeup = 1; -- } -+ if (ignore_wake == NULL && quirk && quirk->ignore_wake) -+ ignore_wake = quirk->ignore_wake; - - return 0; - } -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index cc1094f90125..96cf64d0ee82 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -1348,28 +1348,34 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - frame.colorspace = HDMI_COLORSPACE_RGB; - - /* Set up colorimetry */ -- switch (hdmi->hdmi_data.enc_out_encoding) { -- case V4L2_YCBCR_ENC_601: -- if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) -- frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; -- else -+ if (!hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) { -+ switch (hdmi->hdmi_data.enc_out_encoding) { -+ case V4L2_YCBCR_ENC_601: -+ if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) -+ frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; -+ else -+ frame.colorimetry = HDMI_COLORIMETRY_ITU_601; -+ frame.extended_colorimetry = -+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -+ break; -+ case V4L2_YCBCR_ENC_709: -+ if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) -+ frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; -+ else -+ frame.colorimetry = HDMI_COLORIMETRY_ITU_709; -+ frame.extended_colorimetry = -+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; -+ break; -+ default: /* Carries no data */ - frame.colorimetry = HDMI_COLORIMETRY_ITU_601; -+ frame.extended_colorimetry = -+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -+ break; -+ } -+ } else { -+ frame.colorimetry = HDMI_COLORIMETRY_NONE; - frame.extended_colorimetry = -- HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -- break; -- case V4L2_YCBCR_ENC_709: -- if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) -- frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; -- else -- frame.colorimetry = HDMI_COLORIMETRY_ITU_709; -- frame.extended_colorimetry = -- HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; -- break; -- default: /* Carries no data */ -- frame.colorimetry = HDMI_COLORIMETRY_ITU_601; -- frame.extended_colorimetry = -- HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -- break; -+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; - } - - frame.scan_mode = HDMI_SCAN_MODE_NONE; -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 9d94c306c8ca..c8c83f84aced 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -982,20 +982,9 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_ - static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port) - { - struct drm_dp_mst_port *rport = NULL; -- - mutex_lock(&mgr->lock); -- /* -- * Port may or may not be 'valid' but we don't care about that when -- * destroying the port and we are guaranteed that the port pointer -- * will be valid until we've finished -- */ -- if (current_work() == &mgr->destroy_connector_work) { -- kref_get(&port->kref); -- rport = port; -- } else if (mgr->mst_primary) { -- rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, -- port); -- } -+ if (mgr->mst_primary) -+ rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port); - mutex_unlock(&mgr->lock); - return rport; - } -diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c -index 7904ffa9abfb..366c975cde5b 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c -@@ -1739,8 +1739,9 @@ static int exynos_dsi_probe(struct platform_device *pdev) - ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(dsi->supplies), - dsi->supplies); - if (ret) { -- dev_info(dev, "failed to get regulators: %d\n", ret); -- return -EPROBE_DEFER; -+ if (ret != -EPROBE_DEFER) -+ dev_info(dev, "failed to get regulators: %d\n", ret); -+ return ret; - } - - dsi->clks = devm_kzalloc(dev, -@@ -1753,9 +1754,10 @@ static int exynos_dsi_probe(struct platform_device *pdev) - dsi->clks[i] = devm_clk_get(dev, clk_names[i]); - if (IS_ERR(dsi->clks[i])) { - if (strcmp(clk_names[i], "sclk_mipi") == 0) { -- strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME); -- i--; -- continue; -+ dsi->clks[i] = devm_clk_get(dev, -+ OLD_SCLK_MIPI_CLK_NAME); -+ if (!IS_ERR(dsi->clks[i])) -+ continue; - } - - dev_info(dev, "failed to get the clock: %s\n", -diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c -index 6ebf6a2edb33..ca2717137ad2 100644 ---- a/drivers/hwtracing/intel_th/msu.c -+++ b/drivers/hwtracing/intel_th/msu.c -@@ -499,7 +499,7 @@ static int msc_configure(struct msc *msc) - lockdep_assert_held(&msc->buf_mutex); - - if (msc->mode > MSC_MODE_MULTI) -- return -ENOTSUPP; -+ return -EINVAL; - - if (msc->mode == MSC_MODE_MULTI) - msc_buffer_clear_hw_header(msc); -@@ -950,7 +950,7 @@ static int msc_buffer_alloc(struct msc *msc, unsigned long *nr_pages, - } else if (msc->mode == MSC_MODE_MULTI) { - ret = msc_buffer_multi_alloc(msc, nr_pages, nr_wins); - } else { -- ret = -ENOTSUPP; -+ ret = -EINVAL; - } - - if (!ret) { -@@ -1173,7 +1173,7 @@ static ssize_t intel_th_msc_read(struct file *file, char __user *buf, - if (ret >= 0) - *ppos = iter->offset; - } else { -- ret = -ENOTSUPP; -+ ret = -EINVAL; - } - - put_count: -diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c -index fc371444407d..b8cbd26b60e1 100644 ---- a/drivers/hwtracing/intel_th/pci.c -+++ b/drivers/hwtracing/intel_th/pci.c -@@ -218,6 +218,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6), - .driver_data = (kernel_ulong_t)&intel_th_2x, - }, -+ { -+ /* Elkhart Lake CPU */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4529), -+ .driver_data = (kernel_ulong_t)&intel_th_2x, -+ }, - { - /* Elkhart Lake */ - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26), -diff --git a/drivers/i2c/busses/i2c-hix5hd2.c b/drivers/i2c/busses/i2c-hix5hd2.c -index bb68957d3da5..aa5c55bd8b11 100644 ---- a/drivers/i2c/busses/i2c-hix5hd2.c -+++ b/drivers/i2c/busses/i2c-hix5hd2.c -@@ -498,6 +498,7 @@ static int hix5hd2_i2c_remove(struct platform_device *pdev) - i2c_del_adapter(&priv->adap); - pm_runtime_disable(priv->dev); - pm_runtime_set_suspended(priv->dev); -+ clk_disable_unprepare(priv->clk); - - return 0; - } -diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c -index a70ef7fec95f..34639ee2d2ce 100644 ---- a/drivers/iio/adc/at91-sama5d2_adc.c -+++ b/drivers/iio/adc/at91-sama5d2_adc.c -@@ -300,6 +300,27 @@ static const struct iio_chan_spec at91_adc_channels[] = { - + AT91_SAMA5D2_DIFF_CHAN_CNT + 1), - }; - -+static int at91_adc_chan_xlate(struct iio_dev *indio_dev, int chan) -+{ -+ int i; -+ -+ for (i = 0; i < indio_dev->num_channels; i++) { -+ if (indio_dev->channels[i].scan_index == chan) -+ return i; -+ } -+ return -EINVAL; -+} -+ -+static inline struct iio_chan_spec const * -+at91_adc_chan_get(struct iio_dev *indio_dev, int chan) -+{ -+ int index = at91_adc_chan_xlate(indio_dev, chan); -+ -+ if (index < 0) -+ return NULL; -+ return indio_dev->channels + index; -+} -+ - static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) - { - struct iio_dev *indio = iio_trigger_get_drvdata(trig); -@@ -317,7 +338,24 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) - at91_adc_writel(st, AT91_SAMA5D2_TRGR, status); - - for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) { -- struct iio_chan_spec const *chan = indio->channels + bit; -+ struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit); -+ u32 cor; -+ -+ if (!chan) -+ continue; -+ if (state) { -+ cor = at91_adc_readl(st, AT91_SAMA5D2_COR); -+ -+ if (chan->differential) -+ cor |= (BIT(chan->channel) | -+ BIT(chan->channel2)) << -+ AT91_SAMA5D2_COR_DIFF_OFFSET; -+ else -+ cor &= ~(BIT(chan->channel) << -+ AT91_SAMA5D2_COR_DIFF_OFFSET); -+ -+ at91_adc_writel(st, AT91_SAMA5D2_COR, cor); -+ } - - if (state) { - at91_adc_writel(st, AT91_SAMA5D2_CHER, -@@ -398,8 +436,11 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p) - u8 bit; - - for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) { -- struct iio_chan_spec const *chan = indio->channels + bit; -+ struct iio_chan_spec const *chan = -+ at91_adc_chan_get(indio, bit); - -+ if (!chan) -+ continue; - st->buffer[i] = at91_adc_readl(st, chan->address); - i++; - } -diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c -index 0bff76e96950..283ecd4ea800 100644 ---- a/drivers/iio/magnetometer/ak8974.c -+++ b/drivers/iio/magnetometer/ak8974.c -@@ -563,7 +563,7 @@ static int ak8974_read_raw(struct iio_dev *indio_dev, - * We read all axes and discard all but one, for optimized - * reading, use the triggered buffer. - */ -- *val = le16_to_cpu(hw_values[chan->address]); -+ *val = (s16)le16_to_cpu(hw_values[chan->address]); - - ret = IIO_VAL_INT; - } -diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c -index eb212f8c8879..0e4da570f22f 100644 ---- a/drivers/iio/trigger/stm32-timer-trigger.c -+++ b/drivers/iio/trigger/stm32-timer-trigger.c -@@ -161,7 +161,8 @@ static int stm32_timer_start(struct stm32_timer_trigger *priv, - return 0; - } - --static void stm32_timer_stop(struct stm32_timer_trigger *priv) -+static void stm32_timer_stop(struct stm32_timer_trigger *priv, -+ struct iio_trigger *trig) - { - u32 ccer, cr1; - -@@ -179,6 +180,12 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv) - regmap_write(priv->regmap, TIM_PSC, 0); - regmap_write(priv->regmap, TIM_ARR, 0); - -+ /* Force disable master mode */ -+ if (stm32_timer_is_trgo2_name(trig->name)) -+ regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS2, 0); -+ else -+ regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS, 0); -+ - /* Make sure that registers are updated */ - regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG); - } -@@ -197,7 +204,7 @@ static ssize_t stm32_tt_store_frequency(struct device *dev, - return ret; - - if (freq == 0) { -- stm32_timer_stop(priv); -+ stm32_timer_stop(priv, trig); - } else { - ret = stm32_timer_start(priv, trig, freq); - if (ret) -diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c -index ce8e3009344a..f4770601e6bf 100644 ---- a/drivers/infiniband/core/security.c -+++ b/drivers/infiniband/core/security.c -@@ -348,16 +348,11 @@ static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp, - else if (qp_pps) - new_pps->main.pkey_index = qp_pps->main.pkey_index; - -- if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) -+ if (((qp_attr_mask & IB_QP_PKEY_INDEX) && -+ (qp_attr_mask & IB_QP_PORT)) || -+ (qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)) - new_pps->main.state = IB_PORT_PKEY_VALID; - -- if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) { -- new_pps->main.port_num = qp_pps->main.port_num; -- new_pps->main.pkey_index = qp_pps->main.pkey_index; -- if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) -- new_pps->main.state = IB_PORT_PKEY_VALID; -- } -- - if (qp_attr_mask & IB_QP_ALT_PATH) { - new_pps->alt.port_num = qp_attr->alt_port_num; - new_pps->alt.pkey_index = qp_attr->alt_pkey_index; -diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c -index 84c962820aa2..0cb60072c82f 100644 ---- a/drivers/infiniband/hw/mlx5/qp.c -+++ b/drivers/infiniband/hw/mlx5/qp.c -@@ -4896,6 +4896,10 @@ struct ib_wq *mlx5_ib_create_wq(struct ib_pd *pd, - if (udata->outlen && udata->outlen < min_resp_len) - return ERR_PTR(-EINVAL); - -+ if (!capable(CAP_SYS_RAWIO) && -+ init_attr->create_flags & IB_WQ_FLAGS_DELAY_DROP) -+ return ERR_PTR(-EPERM); -+ - dev = to_mdev(pd->device); - switch (init_attr->wq_type) { - case IB_WQT_RQ: -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index 5f764e0993a4..2bca84f4c2b2 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -189,6 +189,7 @@ static const char * const smbus_pnp_ids[] = { - "SYN3052", /* HP EliteBook 840 G4 */ - "SYN3221", /* HP 15-ay000 */ - "SYN323d", /* HP Spectre X360 13-w013dx */ -+ "SYN3257", /* HP Envy 13-ad105ng */ - NULL - }; - -diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c -index 4f1d3fd5d412..7da44956555e 100644 ---- a/drivers/input/touchscreen/raydium_i2c_ts.c -+++ b/drivers/input/touchscreen/raydium_i2c_ts.c -@@ -441,7 +441,7 @@ static int raydium_i2c_write_object(struct i2c_client *client, - return 0; - } - --static bool raydium_i2c_boot_trigger(struct i2c_client *client) -+static int raydium_i2c_boot_trigger(struct i2c_client *client) - { - static const u8 cmd[7][6] = { - { 0x08, 0x0C, 0x09, 0x00, 0x50, 0xD7 }, -@@ -469,7 +469,7 @@ static bool raydium_i2c_boot_trigger(struct i2c_client *client) - return 0; - } - --static bool raydium_i2c_fw_trigger(struct i2c_client *client) -+static int raydium_i2c_fw_trigger(struct i2c_client *client) - { - static const u8 cmd[5][11] = { - { 0, 0x09, 0x71, 0x0C, 0x09, 0x00, 0x50, 0xD7, 0, 0, 0 }, -diff --git a/drivers/md/dm-bio-record.h b/drivers/md/dm-bio-record.h -index c82578af56a5..2ea0360108e1 100644 ---- a/drivers/md/dm-bio-record.h -+++ b/drivers/md/dm-bio-record.h -@@ -20,8 +20,13 @@ - struct dm_bio_details { - struct gendisk *bi_disk; - u8 bi_partno; -+ int __bi_remaining; - unsigned long bi_flags; - struct bvec_iter bi_iter; -+ bio_end_io_t *bi_end_io; -+#if defined(CONFIG_BLK_DEV_INTEGRITY) -+ struct bio_integrity_payload *bi_integrity; -+#endif - }; - - static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio) -@@ -30,6 +35,11 @@ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio) - bd->bi_partno = bio->bi_partno; - bd->bi_flags = bio->bi_flags; - bd->bi_iter = bio->bi_iter; -+ bd->__bi_remaining = atomic_read(&bio->__bi_remaining); -+ bd->bi_end_io = bio->bi_end_io; -+#if defined(CONFIG_BLK_DEV_INTEGRITY) -+ bd->bi_integrity = bio_integrity(bio); -+#endif - } - - static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio) -@@ -38,6 +48,11 @@ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio) - bio->bi_partno = bd->bi_partno; - bio->bi_flags = bd->bi_flags; - bio->bi_iter = bd->bi_iter; -+ atomic_set(&bio->__bi_remaining, bd->__bi_remaining); -+ bio->bi_end_io = bd->bi_end_io; -+#if defined(CONFIG_BLK_DEV_INTEGRITY) -+ bio->bi_integrity = bd->bi_integrity; -+#endif - } - - #endif -diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c -index 427cda457af6..5104678f29b7 100644 ---- a/drivers/media/usb/b2c2/flexcop-usb.c -+++ b/drivers/media/usb/b2c2/flexcop-usb.c -@@ -510,6 +510,9 @@ static int flexcop_usb_init(struct flexcop_usb *fc_usb) - return ret; - } - -+ if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - switch (fc_usb->udev->speed) { - case USB_SPEED_LOW: - err("cannot handle USB speed because it is too slow."); -@@ -543,9 +546,6 @@ static int flexcop_usb_probe(struct usb_interface *intf, - struct flexcop_device *fc = NULL; - int ret; - -- if (intf->cur_altsetting->desc.bNumEndpoints < 1) -- return -ENODEV; -- - if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) { - err("out of memory\n"); - return -ENOMEM; -diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c -index 1ee7ec558293..33dd54c8fa04 100644 ---- a/drivers/media/usb/dvb-usb/dib0700_core.c -+++ b/drivers/media/usb/dvb-usb/dib0700_core.c -@@ -821,7 +821,7 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf) - - /* Starting in firmware 1.20, the RC info is provided on a bulk pipe */ - -- if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1) -+ if (intf->cur_altsetting->desc.bNumEndpoints < rc_ep + 1) - return -ENODEV; - - purb = usb_alloc_urb(0, GFP_KERNEL); -@@ -841,7 +841,7 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf) - * Some devices like the Hauppauge NovaTD model 52009 use an interrupt - * endpoint, while others use a bulk one. - */ -- e = &intf->altsetting[0].endpoint[rc_ep].desc; -+ e = &intf->cur_altsetting->endpoint[rc_ep].desc; - if (usb_endpoint_dir_in(e)) { - if (usb_endpoint_xfer_bulk(e)) { - pipe = usb_rcvbulkpipe(d->udev, rc_ep); -diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c -index 8106a47a0dd0..b51d2de1aca8 100644 ---- a/drivers/media/usb/gspca/ov519.c -+++ b/drivers/media/usb/gspca/ov519.c -@@ -3478,6 +3478,11 @@ static void ov511_mode_init_regs(struct sd *sd) - return; - } - -+ if (alt->desc.bNumEndpoints < 1) { -+ sd->gspca_dev.usb_err = -ENODEV; -+ return; -+ } -+ - packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); - reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5); - -@@ -3604,6 +3609,11 @@ static void ov518_mode_init_regs(struct sd *sd) - return; - } - -+ if (alt->desc.bNumEndpoints < 1) { -+ sd->gspca_dev.usb_err = -ENODEV; -+ return; -+ } -+ - packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); - ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2); - -diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx.c b/drivers/media/usb/gspca/stv06xx/stv06xx.c -index e72c3e1ab9ff..9caa5ef9d9e0 100644 ---- a/drivers/media/usb/gspca/stv06xx/stv06xx.c -+++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c -@@ -289,6 +289,9 @@ static int stv06xx_start(struct gspca_dev *gspca_dev) - return -EIO; - } - -+ if (alt->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); - err = stv06xx_write_bridge(sd, STV_ISO_SIZE_L, packet_size); - if (err < 0) -@@ -313,11 +316,21 @@ out: - - static int stv06xx_isoc_init(struct gspca_dev *gspca_dev) - { -+ struct usb_interface_cache *intfc; - struct usb_host_interface *alt; - struct sd *sd = (struct sd *) gspca_dev; - -+ intfc = gspca_dev->dev->actconfig->intf_cache[0]; -+ -+ if (intfc->num_altsetting < 2) -+ return -ENODEV; -+ -+ alt = &intfc->altsetting[1]; -+ -+ if (alt->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - /* Start isoc bandwidth "negotiation" at max isoc bandwidth */ -- alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; - alt->endpoint[0].desc.wMaxPacketSize = - cpu_to_le16(sd->sensor->max_packet_size[gspca_dev->curr_mode]); - -@@ -330,6 +343,10 @@ static int stv06xx_isoc_nego(struct gspca_dev *gspca_dev) - struct usb_host_interface *alt; - struct sd *sd = (struct sd *) gspca_dev; - -+ /* -+ * Existence of altsetting and endpoint was verified in -+ * stv06xx_isoc_init() -+ */ - alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; - packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); - min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode]; -diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c b/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c -index e1ce96e9405f..8d855b2756ba 100644 ---- a/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c -+++ b/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c -@@ -194,6 +194,10 @@ static int pb0100_start(struct sd *sd) - alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt); - if (!alt) - return -ENODEV; -+ -+ if (alt->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); - - /* If we don't have enough bandwidth use a lower framerate */ -diff --git a/drivers/media/usb/gspca/xirlink_cit.c b/drivers/media/usb/gspca/xirlink_cit.c -index 68656e7986c7..765a5d03e7cc 100644 ---- a/drivers/media/usb/gspca/xirlink_cit.c -+++ b/drivers/media/usb/gspca/xirlink_cit.c -@@ -1451,6 +1451,9 @@ static int cit_get_packet_size(struct gspca_dev *gspca_dev) - return -EIO; - } - -+ if (alt->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - return le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); - } - -@@ -2634,6 +2637,7 @@ static int sd_start(struct gspca_dev *gspca_dev) - - static int sd_isoc_init(struct gspca_dev *gspca_dev) - { -+ struct usb_interface_cache *intfc; - struct usb_host_interface *alt; - int max_packet_size; - -@@ -2649,8 +2653,17 @@ static int sd_isoc_init(struct gspca_dev *gspca_dev) - break; - } - -+ intfc = gspca_dev->dev->actconfig->intf_cache[0]; -+ -+ if (intfc->num_altsetting < 2) -+ return -ENODEV; -+ -+ alt = &intfc->altsetting[1]; -+ -+ if (alt->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - /* Start isoc bandwidth "negotiation" at max isoc bandwidth */ -- alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; - alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(max_packet_size); - - return 0; -@@ -2673,6 +2686,9 @@ static int sd_isoc_nego(struct gspca_dev *gspca_dev) - break; - } - -+ /* -+ * Existence of altsetting and endpoint was verified in sd_isoc_init() -+ */ - alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; - packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); - if (packet_size <= min_packet_size) -diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c -index 68df16b3ce72..50a61143898b 100644 ---- a/drivers/media/usb/usbtv/usbtv-core.c -+++ b/drivers/media/usb/usbtv/usbtv-core.c -@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv, const u16 regs[][2], int size) - - ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- value, index, NULL, 0, 0); -+ value, index, NULL, 0, USB_CTRL_GET_TIMEOUT); - if (ret < 0) - return ret; - } -diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c -index 3668a04359e8..7c23d82313a8 100644 ---- a/drivers/media/usb/usbtv/usbtv-video.c -+++ b/drivers/media/usb/usbtv/usbtv-video.c -@@ -720,7 +720,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl) - ret = usb_control_msg(usbtv->udev, - usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG, - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- 0, USBTV_BASE + 0x0244, (void *)data, 3, 0); -+ 0, USBTV_BASE + 0x0244, (void *)data, 3, -+ USB_CTRL_GET_TIMEOUT); - if (ret < 0) - goto error; - } -@@ -771,7 +772,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl) - ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0), - USBTV_CONTROL_REG, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- 0, index, (void *)data, size, 0); -+ 0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT); - - error: - if (ret < 0) -diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c -index 494e263daa74..b7ee8043a133 100644 ---- a/drivers/misc/altera-stapl/altera.c -+++ b/drivers/misc/altera-stapl/altera.c -@@ -2126,8 +2126,8 @@ exit_done: - return status; - } - --static int altera_get_note(u8 *p, s32 program_size, -- s32 *offset, char *key, char *value, int length) -+static int altera_get_note(u8 *p, s32 program_size, s32 *offset, -+ char *key, char *value, int keylen, int vallen) - /* - * Gets key and value of NOTE fields in the JBC file. - * Can be called in two modes: if offset pointer is NULL, -@@ -2184,7 +2184,7 @@ static int altera_get_note(u8 *p, s32 program_size, - &p[note_table + (8 * i) + 4])]; - - if (value != NULL) -- strlcpy(value, value_ptr, length); -+ strlcpy(value, value_ptr, vallen); - - } - } -@@ -2203,13 +2203,13 @@ static int altera_get_note(u8 *p, s32 program_size, - strlcpy(key, &p[note_strings + - get_unaligned_be32( - &p[note_table + (8 * i)])], -- length); -+ keylen); - - if (value != NULL) - strlcpy(value, &p[note_strings + - get_unaligned_be32( - &p[note_table + (8 * i) + 4])], -- length); -+ vallen); - - *offset = i + 1; - } -@@ -2463,7 +2463,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw) - __func__, (format_version == 2) ? "Jam STAPL" : - "pre-standardized Jam 1.1"); - while (altera_get_note((u8 *)fw->data, fw->size, -- &offset, key, value, 256) == 0) -+ &offset, key, value, 32, 256) == 0) - printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n", - __func__, key, value); - } -diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c -index 1dadd460cc8f..78c9ac33b562 100644 ---- a/drivers/mmc/host/sdhci-of-at91.c -+++ b/drivers/mmc/host/sdhci-of-at91.c -@@ -125,7 +125,8 @@ static void sdhci_at91_reset(struct sdhci_host *host, u8 mask) - { - sdhci_reset(host, mask); - -- if (host->mmc->caps & MMC_CAP_NONREMOVABLE) -+ if ((host->mmc->caps & MMC_CAP_NONREMOVABLE) -+ || mmc_gpio_get_cd(host->mmc) >= 0) - sdhci_at91_set_force_card_detect(host); - } - -@@ -404,8 +405,11 @@ static int sdhci_at91_probe(struct platform_device *pdev) - * detection procedure using the SDMCC_CD signal is bypassed. - * This bit is reset when a software reset for all command is performed - * so we need to implement our own reset function to set back this bit. -+ * -+ * WA: SAMA5D2 doesn't drive CMD if using CD GPIO line. - */ -- if (host->mmc->caps & MMC_CAP_NONREMOVABLE) -+ if ((host->mmc->caps & MMC_CAP_NONREMOVABLE) -+ || mmc_gpio_get_cd(host->mmc) >= 0) - sdhci_at91_set_force_card_detect(host); - - pm_runtime_put_autosuspend(&pdev->dev); -diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c -index 35564a9561b7..7c37b96ff22a 100644 ---- a/drivers/net/can/slcan.c -+++ b/drivers/net/can/slcan.c -@@ -621,7 +621,10 @@ err_free_chan: - tty->disc_data = NULL; - clear_bit(SLF_INUSE, &sl->flags); - slc_free_netdev(sl->dev); -+ /* do not call free_netdev before rtnl_unlock */ -+ rtnl_unlock(); - free_netdev(sl->dev); -+ return err; - - err_exit: - rtnl_unlock(); -diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c -index 3b073e152237..58c16aa00a70 100644 ---- a/drivers/net/dsa/mt7530.c -+++ b/drivers/net/dsa/mt7530.c -@@ -549,7 +549,7 @@ mt7530_mib_reset(struct dsa_switch *ds) - static void - mt7530_port_set_status(struct mt7530_priv *priv, int port, int enable) - { -- u32 mask = PMCR_TX_EN | PMCR_RX_EN; -+ u32 mask = PMCR_TX_EN | PMCR_RX_EN | PMCR_FORCE_LNK; - - if (enable) - mt7530_set(priv, MT7530_PMCR_P(port), mask); -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c -index fed37cd9ae1d..125e22ffe2ae 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c -@@ -387,24 +387,26 @@ static int bnxt_dcbnl_ieee_getets(struct net_device *dev, struct ieee_ets *ets) - { - struct bnxt *bp = netdev_priv(dev); - struct ieee_ets *my_ets = bp->ieee_ets; -+ int rc; - - ets->ets_cap = bp->max_tc; - - if (!my_ets) { -- int rc; -- - if (bp->dcbx_cap & DCB_CAP_DCBX_HOST) - return 0; - - my_ets = kzalloc(sizeof(*my_ets), GFP_KERNEL); - if (!my_ets) -- return 0; -+ return -ENOMEM; - rc = bnxt_hwrm_queue_cos2bw_qcfg(bp, my_ets); - if (rc) -- return 0; -+ goto error; - rc = bnxt_hwrm_queue_pri2cos_qcfg(bp, my_ets); - if (rc) -- return 0; -+ goto error; -+ -+ /* cache result */ -+ bp->ieee_ets = my_ets; - } - - ets->cbs = my_ets->cbs; -@@ -413,6 +415,9 @@ static int bnxt_dcbnl_ieee_getets(struct net_device *dev, struct ieee_ets *ets) - memcpy(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa)); - memcpy(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc)); - return 0; -+error: -+ kfree(my_ets); -+ return rc; - } - - static int bnxt_dcbnl_ieee_setets(struct net_device *dev, struct ieee_ets *ets) -diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c -index 39b8b6730e77..67246d42c3d9 100644 ---- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c -+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c -@@ -2646,9 +2646,7 @@ static inline u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl) - headroom = (u16)(bl->priv_data_size + DPAA_PARSE_RESULTS_SIZE + - DPAA_TIME_STAMP_SIZE + DPAA_HASH_RESULTS_SIZE); - -- return DPAA_FD_DATA_ALIGNMENT ? ALIGN(headroom, -- DPAA_FD_DATA_ALIGNMENT) : -- headroom; -+ return ALIGN(headroom, DPAA_FD_DATA_ALIGNMENT); - } - - static int dpaa_eth_probe(struct platform_device *pdev) -diff --git a/drivers/net/ethernet/freescale/fman/Kconfig b/drivers/net/ethernet/freescale/fman/Kconfig -index 8870a9a798ca..91437b94bfcb 100644 ---- a/drivers/net/ethernet/freescale/fman/Kconfig -+++ b/drivers/net/ethernet/freescale/fman/Kconfig -@@ -8,3 +8,31 @@ config FSL_FMAN - help - Freescale Data-Path Acceleration Architecture Frame Manager - (FMan) support -+ -+config DPAA_ERRATUM_A050385 -+ bool -+ depends on ARM64 && FSL_DPAA -+ default y -+ help -+ DPAA FMan erratum A050385 software workaround implementation: -+ align buffers, data start, SG fragment length to avoid FMan DMA -+ splits. -+ FMAN DMA read or writes under heavy traffic load may cause FMAN -+ internal resource leak thus stopping further packet processing. -+ The FMAN internal queue can overflow when FMAN splits single -+ read or write transactions into multiple smaller transactions -+ such that more than 17 AXI transactions are in flight from FMAN -+ to interconnect. When the FMAN internal queue overflows, it can -+ stall further packet processing. The issue can occur with any -+ one of the following three conditions: -+ 1. FMAN AXI transaction crosses 4K address boundary (Errata -+ A010022) -+ 2. FMAN DMA address for an AXI transaction is not 16 byte -+ aligned, i.e. the last 4 bits of an address are non-zero -+ 3. Scatter Gather (SG) frames have more than one SG buffer in -+ the SG list and any one of the buffers, except the last -+ buffer in the SG list has data size that is not a multiple -+ of 16 bytes, i.e., other than 16, 32, 48, 64, etc. -+ With any one of the above three conditions present, there is -+ likelihood of stalled FMAN packet processing, especially under -+ stress with multiple ports injecting line-rate traffic. -diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c -index 97425d94e280..9080d2332d03 100644 ---- a/drivers/net/ethernet/freescale/fman/fman.c -+++ b/drivers/net/ethernet/freescale/fman/fman.c -@@ -1,5 +1,6 @@ - /* - * Copyright 2008-2015 Freescale Semiconductor Inc. -+ * Copyright 2020 NXP - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: -@@ -566,6 +567,10 @@ struct fman_cfg { - u32 qmi_def_tnums_thresh; - }; - -+#ifdef CONFIG_DPAA_ERRATUM_A050385 -+static bool fman_has_err_a050385; -+#endif -+ - static irqreturn_t fman_exceptions(struct fman *fman, - enum fman_exceptions exception) - { -@@ -2517,6 +2522,14 @@ struct fman *fman_bind(struct device *fm_dev) - } - EXPORT_SYMBOL(fman_bind); - -+#ifdef CONFIG_DPAA_ERRATUM_A050385 -+bool fman_has_errata_a050385(void) -+{ -+ return fman_has_err_a050385; -+} -+EXPORT_SYMBOL(fman_has_errata_a050385); -+#endif -+ - static irqreturn_t fman_err_irq(int irq, void *handle) - { - struct fman *fman = (struct fman *)handle; -@@ -2843,6 +2856,11 @@ static struct fman *read_dts_node(struct platform_device *of_dev) - goto fman_free; - } - -+#ifdef CONFIG_DPAA_ERRATUM_A050385 -+ fman_has_err_a050385 = -+ of_property_read_bool(fm_node, "fsl,erratum-a050385"); -+#endif -+ - return fman; - - fman_node_put: -diff --git a/drivers/net/ethernet/freescale/fman/fman.h b/drivers/net/ethernet/freescale/fman/fman.h -index bfa02e0014ae..693401994fa2 100644 ---- a/drivers/net/ethernet/freescale/fman/fman.h -+++ b/drivers/net/ethernet/freescale/fman/fman.h -@@ -1,5 +1,6 @@ - /* - * Copyright 2008-2015 Freescale Semiconductor Inc. -+ * Copyright 2020 NXP - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: -@@ -397,6 +398,10 @@ u16 fman_get_max_frm(void); - - int fman_get_rx_extra_headroom(void); - -+#ifdef CONFIG_DPAA_ERRATUM_A050385 -+bool fman_has_errata_a050385(void); -+#endif -+ - struct fman *fman_bind(struct device *dev); - - #endif /* __FM_H */ -diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c -index a0c64b30f81a..a115e51dc211 100644 ---- a/drivers/net/ethernet/marvell/mvneta.c -+++ b/drivers/net/ethernet/marvell/mvneta.c -@@ -2759,11 +2759,10 @@ static int mvneta_poll(struct napi_struct *napi, int budget) - /* For the case where the last mvneta_poll did not process all - * RX packets - */ -- rx_queue = fls(((cause_rx_tx >> 8) & 0xff)); -- - cause_rx_tx |= pp->neta_armada3700 ? pp->cause_rx_tx : - port->cause_rx_tx; - -+ rx_queue = fls(((cause_rx_tx >> 8) & 0xff)); - if (rx_queue) { - rx_queue = rx_queue - 1; - if (pp->bm_priv) -diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c -index c699a779757e..1b0e1fc7825f 100644 ---- a/drivers/net/ethernet/micrel/ks8851_mll.c -+++ b/drivers/net/ethernet/micrel/ks8851_mll.c -@@ -474,6 +474,50 @@ static int msg_enable; - * chip is busy transferring packet data (RX/TX FIFO accesses). - */ - -+/** -+ * ks_check_endian - Check whether endianness of the bus is correct -+ * @ks : The chip information -+ * -+ * The KS8851-16MLL EESK pin allows selecting the endianness of the 16bit -+ * bus. To maintain optimum performance, the bus endianness should be set -+ * such that it matches the endianness of the CPU. -+ */ -+ -+static int ks_check_endian(struct ks_net *ks) -+{ -+ u16 cider; -+ -+ /* -+ * Read CIDER register first, however read it the "wrong" way around. -+ * If the endian strap on the KS8851-16MLL in incorrect and the chip -+ * is operating in different endianness than the CPU, then the meaning -+ * of BE[3:0] byte-enable bits is also swapped such that: -+ * BE[3,2,1,0] becomes BE[1,0,3,2] -+ * -+ * Luckily for us, the byte-enable bits are the top four MSbits of -+ * the address register and the CIDER register is at offset 0xc0. -+ * Hence, by reading address 0xc0c0, which is not impacted by endian -+ * swapping, we assert either BE[3:2] or BE[1:0] while reading the -+ * CIDER register. -+ * -+ * If the bus configuration is correct, reading 0xc0c0 asserts -+ * BE[3:2] and this read returns 0x0000, because to read register -+ * with bottom two LSbits of address set to 0, BE[1:0] must be -+ * asserted. -+ * -+ * If the bus configuration is NOT correct, reading 0xc0c0 asserts -+ * BE[1:0] and this read returns non-zero 0x8872 value. -+ */ -+ iowrite16(BE3 | BE2 | KS_CIDER, ks->hw_addr_cmd); -+ cider = ioread16(ks->hw_addr); -+ if (!cider) -+ return 0; -+ -+ netdev_err(ks->netdev, "incorrect EESK endian strap setting\n"); -+ -+ return -EINVAL; -+} -+ - /** - * ks_rdreg16 - read 16 bit register from device - * @ks : The chip information -@@ -484,7 +528,7 @@ static int msg_enable; - - static u16 ks_rdreg16(struct ks_net *ks, int offset) - { -- ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02)); -+ ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02)); - iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd); - return ioread16(ks->hw_addr); - } -@@ -499,7 +543,7 @@ static u16 ks_rdreg16(struct ks_net *ks, int offset) - - static void ks_wrreg16(struct ks_net *ks, int offset, u16 value) - { -- ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02)); -+ ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02)); - iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd); - iowrite16(value, ks->hw_addr); - } -@@ -515,7 +559,7 @@ static inline void ks_inblk(struct ks_net *ks, u16 *wptr, u32 len) - { - len >>= 1; - while (len--) -- *wptr++ = be16_to_cpu(ioread16(ks->hw_addr)); -+ *wptr++ = (u16)ioread16(ks->hw_addr); - } - - /** -@@ -529,7 +573,7 @@ static inline void ks_outblk(struct ks_net *ks, u16 *wptr, u32 len) - { - len >>= 1; - while (len--) -- iowrite16(cpu_to_be16(*wptr++), ks->hw_addr); -+ iowrite16(*wptr++, ks->hw_addr); - } - - static void ks_disable_int(struct ks_net *ks) -@@ -1539,6 +1583,10 @@ static int ks8851_probe(struct platform_device *pdev) - goto err_free; - } - -+ err = ks_check_endian(ks); -+ if (err) -+ goto err_free; -+ - netdev->irq = platform_get_irq(pdev, 0); - - if ((int)netdev->irq < 0) { -diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -index 89831adb8eb7..6d27eec85fce 100644 ---- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -@@ -2284,7 +2284,7 @@ static int __init sxgbe_cmdline_opt(char *str) - if (!str || !*str) - return -EINVAL; - while ((opt = strsep(&str, ",")) != NULL) { -- if (!strncmp(opt, "eee_timer:", 6)) { -+ if (!strncmp(opt, "eee_timer:", 10)) { - if (kstrtoint(opt + 10, 0, &eee_timer)) - goto err; - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -index 712b5eb3507a..4156cf007b53 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -@@ -1362,7 +1362,7 @@ static int rk_gmac_probe(struct platform_device *pdev) - - ret = rk_gmac_clk_init(plat_dat); - if (ret) -- return ret; -+ goto err_remove_config_dt; - - ret = rk_gmac_powerup(plat_dat->bsp_priv); - if (ret) -diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c -index c2c3ce5653db..5959e8817a1b 100644 ---- a/drivers/net/macsec.c -+++ b/drivers/net/macsec.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - - #include - -@@ -3219,6 +3220,8 @@ static int macsec_newlink(struct net *net, struct net_device *dev, - real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK])); - if (!real_dev) - return -ENODEV; -+ if (real_dev->type != ARPHRD_ETHER) -+ return -EINVAL; - - dev->priv_flags |= IFF_MACSEC; - -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index a8d5561afc7d..e028e03765a5 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -1139,6 +1139,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x1435, 0xd181, 4)}, /* Wistron NeWeb D18Q1 */ - {QMI_FIXED_INTF(0x1435, 0xd181, 5)}, /* Wistron NeWeb D18Q1 */ - {QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)}, /* Fibocom NL668 series */ -+ {QMI_FIXED_INTF(0x1690, 0x7588, 4)}, /* ASKEY WWHC050 */ - {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */ - {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */ - {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */ -diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c -index e0cea5c05f0e..03e4fcdfeab7 100644 ---- a/drivers/net/vrf.c -+++ b/drivers/net/vrf.c -@@ -996,23 +996,24 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev, - struct sk_buff *skb) - { - int orig_iif = skb->skb_iif; -- bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr); -- bool is_ndisc = ipv6_ndisc_frame(skb); -+ bool need_strict; - -- /* loopback, multicast & non-ND link-local traffic; do not push through -- * packet taps again. Reset pkt_type for upper layers to process skb -+ /* loopback traffic; do not push through packet taps again. -+ * Reset pkt_type for upper layers to process skb - */ -- if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) { -+ if (skb->pkt_type == PACKET_LOOPBACK) { - skb->dev = vrf_dev; - skb->skb_iif = vrf_dev->ifindex; - IP6CB(skb)->flags |= IP6SKB_L3SLAVE; -- if (skb->pkt_type == PACKET_LOOPBACK) -- skb->pkt_type = PACKET_HOST; -+ skb->pkt_type = PACKET_HOST; - goto out; - } - -- /* if packet is NDISC then keep the ingress interface */ -- if (!is_ndisc) { -+ /* if packet is NDISC or addressed to multicast or link-local -+ * then keep the ingress interface -+ */ -+ need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr); -+ if (!ipv6_ndisc_frame(skb) && !need_strict) { - vrf_rx_stats(vrf_dev, skb->len); - skb->dev = vrf_dev; - skb->skb_iif = vrf_dev->ifindex; -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 4d97a7b5fe3c..927d62c76a60 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -2454,10 +2454,19 @@ static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan, - /* Setup stats when device is created */ - static int vxlan_init(struct net_device *dev) - { -+ struct vxlan_dev *vxlan = netdev_priv(dev); -+ int err; -+ - dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); - if (!dev->tstats) - return -ENOMEM; - -+ err = gro_cells_init(&vxlan->gro_cells, dev); -+ if (err) { -+ free_percpu(dev->tstats); -+ return err; -+ } -+ - return 0; - } - -@@ -2717,8 +2726,6 @@ static void vxlan_setup(struct net_device *dev) - - vxlan->dev = dev; - -- gro_cells_init(&vxlan->gro_cells, dev); -- - for (h = 0; h < FDB_HASH_SIZE; ++h) - INIT_HLIST_HEAD(&vxlan->fdb_head[h]); - } -diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c -index ec50027b0d8b..3195bae1685f 100644 ---- a/drivers/nfc/fdp/fdp.c -+++ b/drivers/nfc/fdp/fdp.c -@@ -192,7 +192,7 @@ static int fdp_nci_send_patch(struct nci_dev *ndev, u8 conn_id, u8 type) - const struct firmware *fw; - struct sk_buff *skb; - unsigned long len; -- u8 max_size, payload_size; -+ int max_size, payload_size; - int rc = 0; - - if ((type == NCI_PATCH_TYPE_OTP && !info->otp_patch) || -@@ -215,8 +215,7 @@ static int fdp_nci_send_patch(struct nci_dev *ndev, u8 conn_id, u8 type) - - while (len) { - -- payload_size = min_t(unsigned long, (unsigned long) max_size, -- len); -+ payload_size = min_t(unsigned long, max_size, len); - - skb = nci_skb_alloc(ndev, (NCI_CTRL_HDR_SIZE + payload_size), - GFP_KERNEL); -diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c -index fe26697d3bd7..69da2f6896da 100644 ---- a/drivers/of/of_mdio.c -+++ b/drivers/of/of_mdio.c -@@ -259,6 +259,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) - rc = of_mdiobus_register_phy(mdio, child, addr); - if (rc && rc != -ENODEV) - goto unregister; -+ break; - } - } - } -diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c -index 3303dd8d8eb5..604e549a9a47 100644 ---- a/drivers/perf/arm_pmu_acpi.c -+++ b/drivers/perf/arm_pmu_acpi.c -@@ -25,8 +25,6 @@ static int arm_pmu_acpi_register_irq(int cpu) - int gsi, trigger; - - gicc = acpi_cpu_get_madt_gicc(cpu); -- if (WARN_ON(!gicc)) -- return -EINVAL; - - gsi = gicc->performance_interrupt; - -@@ -65,11 +63,10 @@ static void arm_pmu_acpi_unregister_irq(int cpu) - int gsi; - - gicc = acpi_cpu_get_madt_gicc(cpu); -- if (!gicc) -- return; - - gsi = gicc->performance_interrupt; -- acpi_unregister_gsi(gsi); -+ if (gsi) -+ acpi_unregister_gsi(gsi); - } - - static int arm_pmu_acpi_parse_irqs(void) -diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c -index 74997194fd88..92205b90c25c 100644 ---- a/drivers/platform/x86/pmc_atom.c -+++ b/drivers/platform/x86/pmc_atom.c -@@ -443,6 +443,14 @@ static const struct dmi_system_id critclk_systems[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "3I380D"), - }, - }, -+ { -+ /* pmc_plt_clk* - are used for ethernet controllers */ -+ .ident = "Lex 2I385SW", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Lex BayTrail"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "2I385SW"), -+ }, -+ }, - { - /* pmc_plt_clk* - are used for ethernet controllers */ - .ident = "Beckhoff CB3163", -diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig -index e0e58f3b1420..68b76e6ddc1e 100644 ---- a/drivers/rtc/Kconfig -+++ b/drivers/rtc/Kconfig -@@ -323,6 +323,7 @@ config RTC_DRV_MAX6900 - config RTC_DRV_MAX8907 - tristate "Maxim MAX8907" - depends on MFD_MAX8907 || COMPILE_TEST -+ select REGMAP_IRQ - help - If you say yes here you will get support for the - RTC of Maxim MAX8907 PMIC. -diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c -index 35d54ee1c5c7..b172f0a02083 100644 ---- a/drivers/scsi/ipr.c -+++ b/drivers/scsi/ipr.c -@@ -9962,6 +9962,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg, - ioa_cfg->max_devs_supported = ipr_max_devs; - - if (ioa_cfg->sis64) { -+ host->max_channel = IPR_MAX_SIS64_BUSES; - host->max_id = IPR_MAX_SIS64_TARGETS_PER_BUS; - host->max_lun = IPR_MAX_SIS64_LUNS_PER_TARGET; - if (ipr_max_devs > IPR_MAX_SIS64_DEVS) -@@ -9970,6 +9971,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg, - + ((sizeof(struct ipr_config_table_entry64) - * ioa_cfg->max_devs_supported))); - } else { -+ host->max_channel = IPR_VSET_BUS; - host->max_id = IPR_MAX_NUM_TARGETS_PER_BUS; - host->max_lun = IPR_MAX_NUM_LUNS_PER_TARGET; - if (ipr_max_devs > IPR_MAX_PHYSICAL_DEVS) -@@ -9979,7 +9981,6 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg, - * ioa_cfg->max_devs_supported))); - } - -- host->max_channel = IPR_VSET_BUS; - host->unique_id = host->host_no; - host->max_cmd_len = IPR_MAX_CDB_LEN; - host->can_queue = ioa_cfg->max_cmds; -diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h -index 085e6c90f9e6..89b36987ff30 100644 ---- a/drivers/scsi/ipr.h -+++ b/drivers/scsi/ipr.h -@@ -1306,6 +1306,7 @@ struct ipr_resource_entry { - #define IPR_ARRAY_VIRTUAL_BUS 0x1 - #define IPR_VSET_VIRTUAL_BUS 0x2 - #define IPR_IOAFP_VIRTUAL_BUS 0x3 -+#define IPR_MAX_SIS64_BUSES 0x4 - - #define IPR_GET_RES_PHYS_LOC(res) \ - (((res)->bus << 24) | ((res)->target << 8) | (res)->lun) -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index e8c2afbb82e9..49d0720a0b7d 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -3212,9 +3212,11 @@ static int sd_revalidate_disk(struct gendisk *disk) - if (sd_validate_opt_xfer_size(sdkp, dev_max)) { - q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks); - rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks); -- } else -+ } else { -+ q->limits.io_opt = 0; - rw_max = min_not_zero(logical_to_sectors(sdp, dev_max), - (sector_t)BLK_DEF_MAX_SECTORS); -+ } - - /* Do not exceed controller limit */ - rw_max = min(rw_max, queue_max_hw_sectors(q)); -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index b2245cdce230..5160e16d3a98 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -76,6 +76,10 @@ MODULE_ALIAS("platform:pxa2xx-spi"); - #define LPSS_CAPS_CS_EN_SHIFT 9 - #define LPSS_CAPS_CS_EN_MASK (0xf << LPSS_CAPS_CS_EN_SHIFT) - -+#define LPSS_PRIV_CLOCK_GATE 0x38 -+#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK 0x3 -+#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON 0x3 -+ - struct lpss_config { - /* LPSS offset from drv_data->ioaddr */ - unsigned offset; -@@ -92,6 +96,8 @@ struct lpss_config { - unsigned cs_sel_shift; - unsigned cs_sel_mask; - unsigned cs_num; -+ /* Quirks */ -+ unsigned cs_clk_stays_gated : 1; - }; - - /* Keep these sorted with enum pxa_ssp_type */ -@@ -162,6 +168,7 @@ static const struct lpss_config lpss_platforms[] = { - .tx_threshold_hi = 56, - .cs_sel_shift = 8, - .cs_sel_mask = 3 << 8, -+ .cs_clk_stays_gated = true, - }, - }; - -@@ -385,6 +392,22 @@ static void lpss_ssp_cs_control(struct driver_data *drv_data, bool enable) - else - value |= LPSS_CS_CONTROL_CS_HIGH; - __lpss_ssp_write_priv(drv_data, config->reg_cs_ctrl, value); -+ if (config->cs_clk_stays_gated) { -+ u32 clkgate; -+ -+ /* -+ * Changing CS alone when dynamic clock gating is on won't -+ * actually flip CS at that time. This ruins SPI transfers -+ * that specify delays, or have no data. Toggle the clock mode -+ * to force on briefly to poke the CS pin to move. -+ */ -+ clkgate = __lpss_ssp_read_priv(drv_data, LPSS_PRIV_CLOCK_GATE); -+ value = (clkgate & ~LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK) | -+ LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON; -+ -+ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, value); -+ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, clkgate); -+ } - } - - static void cs_assert(struct driver_data *drv_data) -diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c -index 974a8ce58b68..cb74fd1af205 100644 ---- a/drivers/spi/spi-qup.c -+++ b/drivers/spi/spi-qup.c -@@ -1190,6 +1190,11 @@ static int spi_qup_suspend(struct device *device) - struct spi_qup *controller = spi_master_get_devdata(master); - int ret; - -+ if (pm_runtime_suspended(device)) { -+ ret = spi_qup_pm_resume_runtime(device); -+ if (ret) -+ return ret; -+ } - ret = spi_master_suspend(master); - if (ret) - return ret; -@@ -1198,10 +1203,8 @@ static int spi_qup_suspend(struct device *device) - if (ret) - return ret; - -- if (!pm_runtime_suspended(device)) { -- clk_disable_unprepare(controller->cclk); -- clk_disable_unprepare(controller->iclk); -- } -+ clk_disable_unprepare(controller->cclk); -+ clk_disable_unprepare(controller->iclk); - return 0; - } - -diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c -index 18aeaceee286..d26c0eda2d9e 100644 ---- a/drivers/spi/spi-zynqmp-gqspi.c -+++ b/drivers/spi/spi-zynqmp-gqspi.c -@@ -415,9 +415,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high) - - zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, genfifoentry); - -- /* Dummy generic FIFO entry */ -- zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, 0x0); -- - /* Manually start the generic FIFO command */ - zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, - zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) | -diff --git a/drivers/staging/greybus/tools/loopback_test.c b/drivers/staging/greybus/tools/loopback_test.c -index fbe589fca840..b6aa70b94f33 100644 ---- a/drivers/staging/greybus/tools/loopback_test.c -+++ b/drivers/staging/greybus/tools/loopback_test.c -@@ -20,6 +20,7 @@ - #include - - #define MAX_NUM_DEVICES 10 -+#define MAX_SYSFS_PREFIX 0x80 - #define MAX_SYSFS_PATH 0x200 - #define CSV_MAX_LINE 0x1000 - #define SYSFS_MAX_INT 0x20 -@@ -68,7 +69,7 @@ struct loopback_results { - }; - - struct loopback_device { -- char name[MAX_SYSFS_PATH]; -+ char name[MAX_STR_LEN]; - char sysfs_entry[MAX_SYSFS_PATH]; - char debugfs_entry[MAX_SYSFS_PATH]; - struct loopback_results results; -@@ -94,8 +95,8 @@ struct loopback_test { - int stop_all; - int poll_count; - char test_name[MAX_STR_LEN]; -- char sysfs_prefix[MAX_SYSFS_PATH]; -- char debugfs_prefix[MAX_SYSFS_PATH]; -+ char sysfs_prefix[MAX_SYSFS_PREFIX]; -+ char debugfs_prefix[MAX_SYSFS_PREFIX]; - struct timespec poll_timeout; - struct loopback_device devices[MAX_NUM_DEVICES]; - struct loopback_results aggregate_results; -@@ -644,7 +645,7 @@ baddir: - static int open_poll_files(struct loopback_test *t) - { - struct loopback_device *dev; -- char buf[MAX_STR_LEN]; -+ char buf[MAX_SYSFS_PATH + MAX_STR_LEN]; - char dummy; - int fds_idx = 0; - int i; -@@ -914,10 +915,10 @@ int main(int argc, char *argv[]) - t.iteration_max = atoi(optarg); - break; - case 'S': -- snprintf(t.sysfs_prefix, MAX_SYSFS_PATH, "%s", optarg); -+ snprintf(t.sysfs_prefix, MAX_SYSFS_PREFIX, "%s", optarg); - break; - case 'D': -- snprintf(t.debugfs_prefix, MAX_SYSFS_PATH, "%s", optarg); -+ snprintf(t.debugfs_prefix, MAX_SYSFS_PREFIX, "%s", optarg); - break; - case 'm': - t.mask = atol(optarg); -@@ -968,10 +969,10 @@ int main(int argc, char *argv[]) - } - - if (!strcmp(t.sysfs_prefix, "")) -- snprintf(t.sysfs_prefix, MAX_SYSFS_PATH, "%s", sysfs_prefix); -+ snprintf(t.sysfs_prefix, MAX_SYSFS_PREFIX, "%s", sysfs_prefix); - - if (!strcmp(t.debugfs_prefix, "")) -- snprintf(t.debugfs_prefix, MAX_SYSFS_PATH, "%s", debugfs_prefix); -+ snprintf(t.debugfs_prefix, MAX_SYSFS_PREFIX, "%s", debugfs_prefix); - - ret = find_loopback_devices(&t); - if (ret) -diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -index 536453358568..30615b8fb657 100644 ---- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c -+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -@@ -40,12 +40,14 @@ static const struct usb_device_id rtw_usb_id_tbl[] = { - /****** 8188EUS ********/ - {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */ - {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */ -+ {USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */ - {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ - {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ - {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ - {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ - {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ - {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ -+ {USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */ - {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ - {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ - {} /* Terminating entry */ -diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c -index 56f7be6af1f6..a27f5e9a1ae1 100644 ---- a/drivers/staging/speakup/main.c -+++ b/drivers/staging/speakup/main.c -@@ -567,7 +567,7 @@ static u_long get_word(struct vc_data *vc) - return 0; - } else if (tmpx < vc->vc_cols - 2 && - (ch == SPACE || ch == 0 || (ch < 0x100 && IS_WDLM(ch))) && -- get_char(vc, (u_short *)&tmp_pos + 1, &temp) > SPACE) { -+ get_char(vc, (u_short *)tmp_pos + 1, &temp) > SPACE) { - tmp_pos += 2; - tmpx++; - } else -diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c -index 2a22e448a2b3..fb1a76c4c927 100644 ---- a/drivers/staging/wlan-ng/hfa384x_usb.c -+++ b/drivers/staging/wlan-ng/hfa384x_usb.c -@@ -3495,6 +3495,8 @@ static void hfa384x_int_rxmonitor(struct wlandevice *wlandev, - WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) { - pr_debug("overlen frm: len=%zd\n", - skblen - sizeof(struct p80211_caphdr)); -+ -+ return; - } - - skb = dev_alloc_skb(skblen); -diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c -index b5ba176004c1..d8d86761b790 100644 ---- a/drivers/staging/wlan-ng/prism2usb.c -+++ b/drivers/staging/wlan-ng/prism2usb.c -@@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(struct usb_interface *interface) - - cancel_work_sync(&hw->link_bh); - cancel_work_sync(&hw->commsqual_bh); -+ cancel_work_sync(&hw->usb_work); - - /* Now we complete any outstanding commands - * and tell everyone who is waiting for their -diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c -index 91ffe3f2b8a0..8687b17f6cf0 100644 ---- a/drivers/tty/vt/selection.c -+++ b/drivers/tty/vt/selection.c -@@ -83,6 +83,11 @@ void clear_selection(void) - } - } - -+bool vc_is_sel(struct vc_data *vc) -+{ -+ return vc == sel_cons; -+} -+ - /* - * User settable table: what characters are to be considered alphabetic? - * 128 bits. Locked by the console lock. -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 826433af4bdd..46defa3be9a4 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -584,8 +584,9 @@ static void hide_softcursor(struct vc_data *vc) - - static void hide_cursor(struct vc_data *vc) - { -- if (vc == sel_cons) -+ if (vc_is_sel(vc)) - clear_selection(); -+ - vc->vc_sw->con_cursor(vc, CM_ERASE); - hide_softcursor(vc); - } -@@ -595,7 +596,7 @@ static void set_cursor(struct vc_data *vc) - if (!con_is_fg(vc) || console_blanked || vc->vc_mode == KD_GRAPHICS) - return; - if (vc->vc_deccm) { -- if (vc == sel_cons) -+ if (vc_is_sel(vc)) - clear_selection(); - add_softcursor(vc); - if ((vc->vc_cursor_type & 0x0f) != 1) -@@ -750,6 +751,17 @@ static void visual_init(struct vc_data *vc, int num, int init) - vc->vc_screenbuf_size = vc->vc_rows * vc->vc_size_row; - } - -+static void vc_port_destruct(struct tty_port *port) -+{ -+ struct vc_data *vc = container_of(port, struct vc_data, port); -+ -+ kfree(vc); -+} -+ -+static const struct tty_port_operations vc_port_ops = { -+ .destruct = vc_port_destruct, -+}; -+ - int vc_allocate(unsigned int currcons) /* return 0 on success */ - { - struct vt_notifier_param param; -@@ -775,6 +787,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */ - - vc_cons[currcons].d = vc; - tty_port_init(&vc->port); -+ vc->port.ops = &vc_port_ops; - INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); - - visual_init(vc, currcons, 1); -@@ -873,7 +886,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, - if (!newscreen) - return -ENOMEM; - -- if (vc == sel_cons) -+ if (vc_is_sel(vc)) - clear_selection(); - - old_rows = vc->vc_rows; -@@ -2894,6 +2907,7 @@ static int con_install(struct tty_driver *driver, struct tty_struct *tty) - - tty->driver_data = vc; - vc->port.tty = tty; -+ tty_port_get(&vc->port); - - if (!tty->winsize.ws_row && !tty->winsize.ws_col) { - tty->winsize.ws_row = vc_cons[currcons].d->vc_rows; -@@ -2929,6 +2943,13 @@ static void con_shutdown(struct tty_struct *tty) - console_unlock(); - } - -+static void con_cleanup(struct tty_struct *tty) -+{ -+ struct vc_data *vc = tty->driver_data; -+ -+ tty_port_put(&vc->port); -+} -+ - static int default_color = 7; /* white */ - static int default_italic_color = 2; // green (ASCII) - static int default_underline_color = 3; // cyan (ASCII) -@@ -3053,7 +3074,8 @@ static const struct tty_operations con_ops = { - .throttle = con_throttle, - .unthrottle = con_unthrottle, - .resize = vt_resize, -- .shutdown = con_shutdown -+ .shutdown = con_shutdown, -+ .cleanup = con_cleanup, - }; - - static struct cdev vc0_cdev; -diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index c320fefab360..699ad55e3ec6 100644 ---- a/drivers/tty/vt/vt_ioctl.c -+++ b/drivers/tty/vt/vt_ioctl.c -@@ -39,11 +39,32 @@ - #include - #include - --char vt_dont_switch; --extern struct tty_driver *console_driver; -+bool vt_dont_switch; - --#define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count) --#define VT_BUSY(i) (VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons) -+static inline bool vt_in_use(unsigned int i) -+{ -+ const struct vc_data *vc = vc_cons[i].d; -+ -+ /* -+ * console_lock must be held to prevent the vc from being deallocated -+ * while we're checking whether it's in-use. -+ */ -+ WARN_CONSOLE_UNLOCKED(); -+ -+ return vc && kref_read(&vc->port.kref) > 1; -+} -+ -+static inline bool vt_busy(int i) -+{ -+ if (vt_in_use(i)) -+ return true; -+ if (i == fg_console) -+ return true; -+ if (vc_is_sel(vc_cons[i].d)) -+ return true; -+ -+ return false; -+} - - /* - * Console (vt and kd) routines, as defined by USL SVR4 manual, and by -@@ -289,16 +310,14 @@ static int vt_disallocate(unsigned int vc_num) - int ret = 0; - - console_lock(); -- if (VT_BUSY(vc_num)) -+ if (vt_busy(vc_num)) - ret = -EBUSY; - else if (vc_num) - vc = vc_deallocate(vc_num); - console_unlock(); - -- if (vc && vc_num >= MIN_NR_CONSOLES) { -- tty_port_destroy(&vc->port); -- kfree(vc); -- } -+ if (vc && vc_num >= MIN_NR_CONSOLES) -+ tty_port_put(&vc->port); - - return ret; - } -@@ -311,17 +330,15 @@ static void vt_disallocate_all(void) - - console_lock(); - for (i = 1; i < MAX_NR_CONSOLES; i++) -- if (!VT_BUSY(i)) -+ if (!vt_busy(i)) - vc[i] = vc_deallocate(i); - else - vc[i] = NULL; - console_unlock(); - - for (i = 1; i < MAX_NR_CONSOLES; i++) { -- if (vc[i] && i >= MIN_NR_CONSOLES) { -- tty_port_destroy(&vc[i]->port); -- kfree(vc[i]); -- } -+ if (vc[i] && i >= MIN_NR_CONSOLES) -+ tty_port_put(&vc[i]->port); - } - } - -@@ -335,22 +352,13 @@ int vt_ioctl(struct tty_struct *tty, - { - struct vc_data *vc = tty->driver_data; - struct console_font_op op; /* used in multiple places here */ -- unsigned int console; -+ unsigned int console = vc->vc_num; - unsigned char ucval; - unsigned int uival; - void __user *up = (void __user *)arg; - int i, perm; - int ret = 0; - -- console = vc->vc_num; -- -- -- if (!vc_cons_allocated(console)) { /* impossible? */ -- ret = -ENOIOCTLCMD; -- goto out; -- } -- -- - /* - * To have permissions to do most of the vt ioctls, we either have - * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG. -@@ -641,15 +649,16 @@ int vt_ioctl(struct tty_struct *tty, - struct vt_stat __user *vtstat = up; - unsigned short state, mask; - -- /* Review: FIXME: Console lock ? */ - if (put_user(fg_console + 1, &vtstat->v_active)) - ret = -EFAULT; - else { - state = 1; /* /dev/tty0 is always open */ -+ console_lock(); /* required by vt_in_use() */ - for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask; - ++i, mask <<= 1) -- if (VT_IS_IN_USE(i)) -+ if (vt_in_use(i)) - state |= mask; -+ console_unlock(); - ret = put_user(state, &vtstat->v_state); - } - break; -@@ -659,10 +668,11 @@ int vt_ioctl(struct tty_struct *tty, - * Returns the first available (non-opened) console. - */ - case VT_OPENQRY: -- /* FIXME: locking ? - but then this is a stupid API */ -+ console_lock(); /* required by vt_in_use() */ - for (i = 0; i < MAX_NR_CONSOLES; ++i) -- if (! VT_IS_IN_USE(i)) -+ if (!vt_in_use(i)) - break; -+ console_unlock(); - uival = i < MAX_NR_CONSOLES ? (i+1) : -1; - goto setint; - -@@ -1011,12 +1021,12 @@ int vt_ioctl(struct tty_struct *tty, - case VT_LOCKSWITCH: - if (!capable(CAP_SYS_TTY_CONFIG)) - return -EPERM; -- vt_dont_switch = 1; -+ vt_dont_switch = true; - break; - case VT_UNLOCKSWITCH: - if (!capable(CAP_SYS_TTY_CONFIG)) - return -EPERM; -- vt_dont_switch = 0; -+ vt_dont_switch = false; - break; - case VT_GETHIFONTMASK: - ret = put_user(vc->vc_hi_font_mask, -@@ -1180,18 +1190,10 @@ long vt_compat_ioctl(struct tty_struct *tty, - { - struct vc_data *vc = tty->driver_data; - struct console_font_op op; /* used in multiple places here */ -- unsigned int console; - void __user *up = (void __user *)arg; - int perm; - int ret = 0; - -- console = vc->vc_num; -- -- if (!vc_cons_allocated(console)) { /* impossible? */ -- ret = -ENOIOCTLCMD; -- goto out; -- } -- - /* - * To have permissions to do most of the vt ioctls, we either have - * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG. -@@ -1251,7 +1253,7 @@ long vt_compat_ioctl(struct tty_struct *tty, - arg = (unsigned long)compat_ptr(arg); - goto fallback; - } --out: -+ - return ret; - - fallback: -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 0453f0eb1178..5e171e45c685 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -926,10 +926,10 @@ static int get_serial_info(struct acm *acm, struct serial_struct __user *info) - memset(&tmp, 0, sizeof(tmp)); - tmp.xmit_fifo_size = acm->writesize; - tmp.baud_base = le32_to_cpu(acm->line.dwDTERate); -- tmp.close_delay = acm->port.close_delay / 10; -+ tmp.close_delay = jiffies_to_msecs(acm->port.close_delay) / 10; - tmp.closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? - ASYNC_CLOSING_WAIT_NONE : -- acm->port.closing_wait / 10; -+ jiffies_to_msecs(acm->port.closing_wait) / 10; - - if (copy_to_user(info, &tmp, sizeof(tmp))) - return -EFAULT; -@@ -942,20 +942,28 @@ static int set_serial_info(struct acm *acm, - { - struct serial_struct new_serial; - unsigned int closing_wait, close_delay; -+ unsigned int old_closing_wait, old_close_delay; - int retval = 0; - - if (copy_from_user(&new_serial, newinfo, sizeof(new_serial))) - return -EFAULT; - -- close_delay = new_serial.close_delay * 10; -+ close_delay = msecs_to_jiffies(new_serial.close_delay * 10); - closing_wait = new_serial.closing_wait == ASYNC_CLOSING_WAIT_NONE ? -- ASYNC_CLOSING_WAIT_NONE : new_serial.closing_wait * 10; -+ ASYNC_CLOSING_WAIT_NONE : -+ msecs_to_jiffies(new_serial.closing_wait * 10); -+ -+ /* we must redo the rounding here, so that the values match */ -+ old_close_delay = jiffies_to_msecs(acm->port.close_delay) / 10; -+ old_closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? -+ ASYNC_CLOSING_WAIT_NONE : -+ jiffies_to_msecs(acm->port.closing_wait) / 10; - - mutex_lock(&acm->port.mutex); - - if (!capable(CAP_SYS_ADMIN)) { -- if ((close_delay != acm->port.close_delay) || -- (closing_wait != acm->port.closing_wait)) -+ if ((new_serial.close_delay != old_close_delay) || -+ (new_serial.closing_wait != old_closing_wait)) - retval = -EPERM; - else - retval = -EOPNOTSUPP; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 64c03e871f2d..6c4bb47922ac 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -229,6 +229,12 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x0b05, 0x17e0), .driver_info = - USB_QUIRK_IGNORE_REMOTE_WAKEUP }, - -+ /* Realtek hub in Dell WD19 (Type-C) */ -+ { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, -+ -+ /* Generic RTL8153 based ethernet adapters */ -+ { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Action Semiconductor flash disk */ - { USB_DEVICE(0x10d6, 0x2200), .driver_info = - USB_QUIRK_STRING_FETCH_255 }, -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 908496ed3254..c01a0d1e8b5c 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -140,7 +140,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - xhci->quirks |= XHCI_AMD_PLL_FIX; - - if (pdev->vendor == PCI_VENDOR_ID_AMD && -- (pdev->device == 0x15e0 || -+ (pdev->device == 0x145c || -+ pdev->device == 0x15e0 || - pdev->device == 0x15e1 || - pdev->device == 0x43bb)) - xhci->quirks |= XHCI_SUSPEND_DELAY; -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index 108a212294bf..a7feb6338d97 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -416,6 +416,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match); - static struct platform_driver usb_xhci_driver = { - .probe = xhci_plat_probe, - .remove = xhci_plat_remove, -+ .shutdown = usb_hcd_platform_shutdown, - .driver = { - .name = "xhci-hcd", - .pm = &xhci_plat_pm_ops, -diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h -index 02a1164ca599..a350c46d01e8 100644 ---- a/drivers/usb/host/xhci-trace.h -+++ b/drivers/usb/host/xhci-trace.h -@@ -276,23 +276,12 @@ DECLARE_EVENT_CLASS(xhci_log_urb, - ), - TP_printk("ep%d%s-%s: urb %p pipe %u slot %d length %d/%d sgs %d/%d stream %d flags %08x", - __entry->epnum, __entry->dir_in ? "in" : "out", -- ({ char *s; -- switch (__entry->type) { -- case USB_ENDPOINT_XFER_INT: -- s = "intr"; -- break; -- case USB_ENDPOINT_XFER_CONTROL: -- s = "control"; -- break; -- case USB_ENDPOINT_XFER_BULK: -- s = "bulk"; -- break; -- case USB_ENDPOINT_XFER_ISOC: -- s = "isoc"; -- break; -- default: -- s = "UNKNOWN"; -- } s; }), __entry->urb, __entry->pipe, __entry->slot_id, -+ __print_symbolic(__entry->type, -+ { USB_ENDPOINT_XFER_INT, "intr" }, -+ { USB_ENDPOINT_XFER_CONTROL, "control" }, -+ { USB_ENDPOINT_XFER_BULK, "bulk" }, -+ { USB_ENDPOINT_XFER_ISOC, "isoc" }), -+ __entry->urb, __entry->pipe, __entry->slot_id, - __entry->actual, __entry->length, __entry->num_mapped_sgs, - __entry->num_sgs, __entry->stream, __entry->flags - ) -diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c -index 802388bb42ba..3ec0752e67ac 100644 ---- a/drivers/usb/musb/musb_host.c -+++ b/drivers/usb/musb/musb_host.c -@@ -1494,10 +1494,7 @@ done: - * We need to map sg if the transfer_buffer is - * NULL. - */ -- if (!urb->transfer_buffer) -- qh->use_sg = true; -- -- if (qh->use_sg) { -+ if (!urb->transfer_buffer) { - /* sg_miter_start is already done in musb_ep_program */ - if (!sg_miter_next(&qh->sg_miter)) { - dev_err(musb->controller, "error: sg list empty\n"); -@@ -1505,9 +1502,8 @@ done: - status = -EINVAL; - goto done; - } -- urb->transfer_buffer = qh->sg_miter.addr; - length = min_t(u32, length, qh->sg_miter.length); -- musb_write_fifo(hw_ep, length, urb->transfer_buffer); -+ musb_write_fifo(hw_ep, length, qh->sg_miter.addr); - qh->sg_miter.consumed = length; - sg_miter_stop(&qh->sg_miter); - } else { -@@ -1516,11 +1512,6 @@ done: - - qh->segsize = length; - -- if (qh->use_sg) { -- if (offset + length >= urb->transfer_buffer_length) -- qh->use_sg = false; -- } -- - musb_ep_select(mbase, epnum); - musb_writew(epio, MUSB_TXCSR, - MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY); -@@ -2038,8 +2029,10 @@ finish: - urb->actual_length += xfer_len; - qh->offset += xfer_len; - if (done) { -- if (qh->use_sg) -+ if (qh->use_sg) { - qh->use_sg = false; -+ urb->transfer_buffer = NULL; -+ } - - if (urb->status == -EINPROGRESS) - urb->status = status; -diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c -index 3705b64ab948..45d5e5c899e1 100644 ---- a/drivers/usb/serial/io_edgeport.c -+++ b/drivers/usb/serial/io_edgeport.c -@@ -714,7 +714,7 @@ static void edge_interrupt_callback(struct urb *urb) - /* grab the txcredits for the ports if available */ - position = 2; - portNumber = 0; -- while ((position < length) && -+ while ((position < length - 1) && - (portNumber < edge_serial->serial->num_ports)) { - txCredits = data[position] | (data[position+1] << 8); - if (txCredits) { -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index eff353de47cd..3621bde2a0ed 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1186,6 +1186,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */ - .driver_info = NCTRL(0) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110b, 0xff), /* Telit ME910G1 (ECM) */ -+ .driver_info = NCTRL(0) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), -@@ -1992,8 +1994,14 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ -+ { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */ -+ .driver_info = RSVD(1) | RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ -+ .driver_info = RSVD(1) | RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ - .driver_info = RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff), /* BroadMobi BM806U */ -+ .driver_info = RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ - .driver_info = RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 1c4d3dbd4635..5051b1dad09e 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -96,6 +96,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) }, -+ { USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index fcc2cfc1da28..f0a9eeb6272d 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -129,6 +129,7 @@ - #define HP_LM920_PRODUCT_ID 0x026b - #define HP_TD620_PRODUCT_ID 0x0956 - #define HP_LD960_PRODUCT_ID 0x0b39 -+#define HP_LD381_PRODUCT_ID 0x0f7f - #define HP_LCM220_PRODUCT_ID 0x3139 - #define HP_LCM960_PRODUCT_ID 0x3239 - #define HP_LD220_PRODUCT_ID 0x3524 -diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c -index d239fc3c5e3d..eb5151fc8efa 100644 ---- a/drivers/xen/xenbus/xenbus_comms.c -+++ b/drivers/xen/xenbus/xenbus_comms.c -@@ -313,6 +313,8 @@ static int process_msg(void) - req->msg.type = state.msg.type; - req->msg.len = state.msg.len; - req->body = state.body; -+ /* write body, then update state */ -+ virt_wmb(); - req->state = xb_req_state_got_reply; - req->cb(req); - } else -@@ -395,6 +397,8 @@ static int process_writes(void) - if (state.req->state == xb_req_state_aborted) - kfree(state.req); - else { -+ /* write err, then update state */ -+ virt_wmb(); - state.req->state = xb_req_state_got_reply; - wake_up(&state.req->wq); - } -diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c -index 3f3b29398ab8..b609c6e08796 100644 ---- a/drivers/xen/xenbus/xenbus_xs.c -+++ b/drivers/xen/xenbus/xenbus_xs.c -@@ -188,8 +188,11 @@ static bool xenbus_ok(void) - - static bool test_reply(struct xb_req_data *req) - { -- if (req->state == xb_req_state_got_reply || !xenbus_ok()) -+ if (req->state == xb_req_state_got_reply || !xenbus_ok()) { -+ /* read req->state before all other fields */ -+ virt_rmb(); - return true; -+ } - - /* Make sure to reread req->state each time. */ - barrier(); -@@ -199,7 +202,7 @@ static bool test_reply(struct xb_req_data *req) - - static void *read_reply(struct xb_req_data *req) - { -- while (req->state != xb_req_state_got_reply) { -+ do { - wait_event(req->wq, test_reply(req)); - - if (!xenbus_ok()) -@@ -213,7 +216,7 @@ static void *read_reply(struct xb_req_data *req) - if (req->err) - return ERR_PTR(req->err); - -- } -+ } while (req->state != xb_req_state_got_reply); - - return req->body; - } -diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c -index ccc9c708a860..7dc9c78a1c31 100644 ---- a/fs/afs/rxrpc.c -+++ b/fs/afs/rxrpc.c -@@ -173,7 +173,7 @@ void afs_put_call(struct afs_call *call) - int n = atomic_dec_return(&call->usage); - int o = atomic_read(&afs_outstanding_calls); - -- trace_afs_call(call, afs_call_trace_put, n + 1, o, -+ trace_afs_call(call, afs_call_trace_put, n, o, - __builtin_return_address(0)); - - ASSERTCMP(n, >=, 0); -@@ -619,7 +619,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, - - u = __atomic_add_unless(&call->usage, 1, 0); - if (u != 0) { -- trace_afs_call(call, afs_call_trace_wake, u, -+ trace_afs_call(call, afs_call_trace_wake, u + 1, - atomic_read(&afs_outstanding_calls), - __builtin_return_address(0)); - -diff --git a/fs/inode.c b/fs/inode.c -index d2a700c5efce..17172b616d22 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -135,6 +135,7 @@ int inode_init_always(struct super_block *sb, struct inode *inode) - inode->i_sb = sb; - inode->i_blkbits = sb->s_blocksize_bits; - inode->i_flags = 0; -+ atomic64_set(&inode->i_sequence, 0); - atomic_set(&inode->i_count, 1); - inode->i_op = &empty_iops; - inode->i_fop = &no_open_fops; -diff --git a/fs/libfs.c b/fs/libfs.c -index 49623301e5f0..cb9310b091f5 100644 ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -802,7 +802,7 @@ int simple_attr_open(struct inode *inode, struct file *file, - { - struct simple_attr *attr; - -- attr = kmalloc(sizeof(*attr), GFP_KERNEL); -+ attr = kzalloc(sizeof(*attr), GFP_KERNEL); - if (!attr) - return -ENOMEM; - -@@ -842,9 +842,11 @@ ssize_t simple_attr_read(struct file *file, char __user *buf, - if (ret) - return ret; - -- if (*ppos) { /* continued read */ -+ if (*ppos && attr->get_buf[0]) { -+ /* continued read */ - size = strlen(attr->get_buf); -- } else { /* first read */ -+ } else { -+ /* first read */ - u64 val; - ret = attr->get(attr->data, &val); - if (ret) -diff --git a/include/linux/fs.h b/include/linux/fs.h -index f0fddf4ea828..a94642fcf93b 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -645,6 +645,7 @@ struct inode { - struct rcu_head i_rcu; - }; - u64 i_version; -+ atomic64_t i_sequence; /* see futex */ - atomic_t i_count; - atomic_t i_dio_count; - atomic_t i_writecount; -diff --git a/include/linux/futex.h b/include/linux/futex.h -index a4b6cba699bf..6adb1ccac603 100644 ---- a/include/linux/futex.h -+++ b/include/linux/futex.h -@@ -34,23 +34,26 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, - - union futex_key { - struct { -+ u64 i_seq; - unsigned long pgoff; -- struct inode *inode; -- int offset; -+ unsigned int offset; - } shared; - struct { -+ union { -+ struct mm_struct *mm; -+ u64 __tmp; -+ }; - unsigned long address; -- struct mm_struct *mm; -- int offset; -+ unsigned int offset; - } private; - struct { -+ u64 ptr; - unsigned long word; -- void *ptr; -- int offset; -+ unsigned int offset; - } both; - }; - --#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } } -+#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } } - - #ifdef CONFIG_FUTEX - enum { -diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h -index 5f966c94732b..7cbd8195ffb3 100644 ---- a/include/linux/page-flags.h -+++ b/include/linux/page-flags.h -@@ -264,7 +264,7 @@ static inline int TestClearPage##uname(struct page *page) { return 0; } - - __PAGEFLAG(Locked, locked, PF_NO_TAIL) - PAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) __CLEARPAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) --PAGEFLAG(Error, error, PF_NO_COMPOUND) TESTCLEARFLAG(Error, error, PF_NO_COMPOUND) -+PAGEFLAG(Error, error, PF_NO_TAIL) TESTCLEARFLAG(Error, error, PF_NO_TAIL) - PAGEFLAG(Referenced, referenced, PF_HEAD) - TESTCLEARFLAG(Referenced, referenced, PF_HEAD) - __SETPAGEFLAG(Referenced, referenced, PF_HEAD) -diff --git a/include/linux/selection.h b/include/linux/selection.h -index 5b278ce99d8d..35937a61da06 100644 ---- a/include/linux/selection.h -+++ b/include/linux/selection.h -@@ -13,8 +13,8 @@ - - struct tty_struct; - --extern struct vc_data *sel_cons; - struct tty_struct; -+struct vc_data; - - extern void clear_selection(void); - extern int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *tty); -@@ -23,6 +23,8 @@ extern int sel_loadlut(char __user *p); - extern int mouse_reporting(void); - extern void mouse_report(struct tty_struct * tty, int butt, int mrx, int mry); - -+bool vc_is_sel(struct vc_data *vc); -+ - extern int console_blanked; - - extern const unsigned char color_table[]; -diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h -index 1e5d8c392f15..29ef33498cb6 100644 ---- a/include/linux/vmalloc.h -+++ b/include/linux/vmalloc.h -@@ -106,8 +106,9 @@ extern int remap_vmalloc_range_partial(struct vm_area_struct *vma, - - extern int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, - unsigned long pgoff); --void vmalloc_sync_all(void); -- -+void vmalloc_sync_mappings(void); -+void vmalloc_sync_unmappings(void); -+ - /* - * Lowlevel-APIs (not for driver use!) - */ -diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h -index 3fd07912909c..a3de234d3350 100644 ---- a/include/linux/vt_kern.h -+++ b/include/linux/vt_kern.h -@@ -142,7 +142,7 @@ static inline bool vt_force_oops_output(struct vc_data *vc) - return false; - } - --extern char vt_dont_switch; -+extern bool vt_dont_switch; - extern int default_utf8; - extern int global_cursor_default; - -diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h -index 8b95c16b7045..0978bdae2243 100644 ---- a/include/trace/events/afs.h -+++ b/include/trace/events/afs.h -@@ -40,7 +40,7 @@ enum afs_call_trace { - EM(afs_call_trace_free, "FREE ") \ - EM(afs_call_trace_put, "PUT ") \ - EM(afs_call_trace_wake, "WAKE ") \ -- E_(afs_call_trace_work, "WORK ") -+ E_(afs_call_trace_work, "QUEUE") - - /* - * Export enum symbols via userspace. -diff --git a/include/uapi/linux/serio.h b/include/uapi/linux/serio.h -index a0cac1d8670d..1937915be413 100644 ---- a/include/uapi/linux/serio.h -+++ b/include/uapi/linux/serio.h -@@ -9,7 +9,7 @@ - #ifndef _UAPI_SERIO_H - #define _UAPI_SERIO_H - -- -+#include - #include - - #define SPIOCSTYPE _IOW('q', 0x01, unsigned long) -@@ -18,10 +18,10 @@ - /* - * bit masks for use in "interrupt" flags (3rd argument) - */ --#define SERIO_TIMEOUT BIT(0) --#define SERIO_PARITY BIT(1) --#define SERIO_FRAME BIT(2) --#define SERIO_OOB_DATA BIT(3) -+#define SERIO_TIMEOUT _BITUL(0) -+#define SERIO_PARITY _BITUL(1) -+#define SERIO_FRAME _BITUL(2) -+#define SERIO_OOB_DATA _BITUL(3) - - /* - * Serio types -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index f5c1d5479ba3..21073682061d 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -1364,7 +1364,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, - union bpf_attr __user *uattr) - { - struct bpf_prog_info __user *uinfo = u64_to_user_ptr(attr->info.info); -- struct bpf_prog_info info = {}; -+ struct bpf_prog_info info; - u32 info_len = attr->info.info_len; - char __user *uinsns; - u32 ulen; -@@ -1375,6 +1375,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, - return err; - info_len = min_t(u32, sizeof(info), info_len); - -+ memset(&info, 0, sizeof(info)); - if (copy_from_user(&info, uinfo, info_len)) - return -EFAULT; - -@@ -1420,7 +1421,7 @@ static int bpf_map_get_info_by_fd(struct bpf_map *map, - union bpf_attr __user *uattr) - { - struct bpf_map_info __user *uinfo = u64_to_user_ptr(attr->info.info); -- struct bpf_map_info info = {}; -+ struct bpf_map_info info; - u32 info_len = attr->info.info_len; - int err; - -@@ -1429,6 +1430,7 @@ static int bpf_map_get_info_by_fd(struct bpf_map *map, - return err; - info_len = min_t(u32, sizeof(info), info_len); - -+ memset(&info, 0, sizeof(info)); - info.type = map->map_type; - info.id = map->id; - info.key_size = map->key_size; -@@ -1474,7 +1476,7 @@ static int bpf_obj_get_info_by_fd(const union bpf_attr *attr, - - SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size) - { -- union bpf_attr attr = {}; -+ union bpf_attr attr; - int err; - - if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) -@@ -1486,6 +1488,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz - size = min_t(u32, size, sizeof(attr)); - - /* copy attributes from user space, may be less than sizeof(bpf_attr) */ -+ memset(&attr, 0, sizeof(attr)); - if (copy_from_user(&attr, uattr, size) != 0) - return -EFAULT; - -diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c -index a2c05d2476ac..545f29c5268d 100644 ---- a/kernel/cgroup/cgroup-v1.c -+++ b/kernel/cgroup/cgroup-v1.c -@@ -501,6 +501,7 @@ static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos) - */ - p++; - if (p >= end) { -+ (*pos)++; - return NULL; - } else { - *pos = *p; -@@ -823,7 +824,7 @@ void cgroup1_release_agent(struct work_struct *work) - - pathbuf = kmalloc(PATH_MAX, GFP_KERNEL); - agentbuf = kstrdup(cgrp->root->release_agent_path, GFP_KERNEL); -- if (!pathbuf || !agentbuf) -+ if (!pathbuf || !agentbuf || !strlen(agentbuf)) - goto out; - - spin_lock_irq(&css_set_lock); -diff --git a/kernel/futex.c b/kernel/futex.c -index f5aae14c247b..2921ebaa1467 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -401,9 +401,9 @@ static inline int hb_waiters_pending(struct futex_hash_bucket *hb) - */ - static struct futex_hash_bucket *hash_futex(union futex_key *key) - { -- u32 hash = jhash2((u32*)&key->both.word, -- (sizeof(key->both.word)+sizeof(key->both.ptr))/4, -+ u32 hash = jhash2((u32 *)key, offsetof(typeof(*key), both.offset) / 4, - key->both.offset); -+ - return &futex_queues[hash & (futex_hashsize - 1)]; - } - -@@ -445,7 +445,7 @@ static void get_futex_key_refs(union futex_key *key) - - switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) { - case FUT_OFF_INODE: -- ihold(key->shared.inode); /* implies smp_mb(); (B) */ -+ smp_mb(); /* explicit smp_mb(); (B) */ - break; - case FUT_OFF_MMSHARED: - futex_get_mm(key); /* implies smp_mb(); (B) */ -@@ -479,7 +479,6 @@ static void drop_futex_key_refs(union futex_key *key) - - switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) { - case FUT_OFF_INODE: -- iput(key->shared.inode); - break; - case FUT_OFF_MMSHARED: - mmdrop(key->private.mm); -@@ -487,6 +486,46 @@ static void drop_futex_key_refs(union futex_key *key) - } - } - -+/* -+ * Generate a machine wide unique identifier for this inode. -+ * -+ * This relies on u64 not wrapping in the life-time of the machine; which with -+ * 1ns resolution means almost 585 years. -+ * -+ * This further relies on the fact that a well formed program will not unmap -+ * the file while it has a (shared) futex waiting on it. This mapping will have -+ * a file reference which pins the mount and inode. -+ * -+ * If for some reason an inode gets evicted and read back in again, it will get -+ * a new sequence number and will _NOT_ match, even though it is the exact same -+ * file. -+ * -+ * It is important that match_futex() will never have a false-positive, esp. -+ * for PI futexes that can mess up the state. The above argues that false-negatives -+ * are only possible for malformed programs. -+ */ -+static u64 get_inode_sequence_number(struct inode *inode) -+{ -+ static atomic64_t i_seq; -+ u64 old; -+ -+ /* Does the inode already have a sequence number? */ -+ old = atomic64_read(&inode->i_sequence); -+ if (likely(old)) -+ return old; -+ -+ for (;;) { -+ u64 new = atomic64_add_return(1, &i_seq); -+ if (WARN_ON_ONCE(!new)) -+ continue; -+ -+ old = atomic64_cmpxchg_relaxed(&inode->i_sequence, 0, new); -+ if (old) -+ return old; -+ return new; -+ } -+} -+ - /** - * get_futex_key() - Get parameters which are the keys for a futex - * @uaddr: virtual address of the futex -@@ -499,9 +538,15 @@ static void drop_futex_key_refs(union futex_key *key) - * - * The key words are stored in @key on success. - * -- * For shared mappings, it's (page->index, file_inode(vma->vm_file), -- * offset_within_page). For private mappings, it's (uaddr, current->mm). -- * We can usually work out the index without swapping in the page. -+ * For shared mappings (when @fshared), the key is: -+ * ( inode->i_sequence, page->index, offset_within_page ) -+ * [ also see get_inode_sequence_number() ] -+ * -+ * For private mappings (or when !@fshared), the key is: -+ * ( current->mm, address, 0 ) -+ * -+ * This allows (cross process, where applicable) identification of the futex -+ * without keeping the page pinned for the duration of the FUTEX_WAIT. - * - * lock_page() might sleep, the caller should not hold a spinlock. - */ -@@ -641,8 +686,6 @@ again: - key->private.mm = mm; - key->private.address = address; - -- get_futex_key_refs(key); /* implies smp_mb(); (B) */ -- - } else { - struct inode *inode; - -@@ -674,40 +717,14 @@ again: - goto again; - } - -- /* -- * Take a reference unless it is about to be freed. Previously -- * this reference was taken by ihold under the page lock -- * pinning the inode in place so i_lock was unnecessary. The -- * only way for this check to fail is if the inode was -- * truncated in parallel which is almost certainly an -- * application bug. In such a case, just retry. -- * -- * We are not calling into get_futex_key_refs() in file-backed -- * cases, therefore a successful atomic_inc return below will -- * guarantee that get_futex_key() will still imply smp_mb(); (B). -- */ -- if (!atomic_inc_not_zero(&inode->i_count)) { -- rcu_read_unlock(); -- put_page(page); -- -- goto again; -- } -- -- /* Should be impossible but lets be paranoid for now */ -- if (WARN_ON_ONCE(inode->i_mapping != mapping)) { -- err = -EFAULT; -- rcu_read_unlock(); -- iput(inode); -- -- goto out; -- } -- - key->both.offset |= FUT_OFF_INODE; /* inode-based key */ -- key->shared.inode = inode; -+ key->shared.i_seq = get_inode_sequence_number(inode); - key->shared.pgoff = basepage_index(tail); - rcu_read_unlock(); - } - -+ get_futex_key_refs(key); /* implies smp_mb(); (B) */ -+ - out: - put_page(page); - return err; -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index 037e8fc1b008..5277949e82e0 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -224,7 +224,11 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask, - - if (desc->affinity_notify) { - kref_get(&desc->affinity_notify->kref); -- schedule_work(&desc->affinity_notify->work); -+ if (!schedule_work(&desc->affinity_notify->work)) { -+ /* Work was already scheduled, drop our extra ref */ -+ kref_put(&desc->affinity_notify->kref, -+ desc->affinity_notify->release); -+ } - } - irqd_set(data, IRQD_AFFINITY_SET); - -@@ -324,7 +328,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify) - raw_spin_unlock_irqrestore(&desc->lock, flags); - - if (old_notify) { -- cancel_work_sync(&old_notify->work); -+ if (cancel_work_sync(&old_notify->work)) { -+ /* Pending work had a ref, put that one too */ -+ kref_put(&old_notify->kref, old_notify->release); -+ } - kref_put(&old_notify->kref, old_notify->release); - } - -diff --git a/kernel/notifier.c b/kernel/notifier.c -index 6196af8a8223..59a1e9b48a6a 100644 ---- a/kernel/notifier.c -+++ b/kernel/notifier.c -@@ -552,7 +552,7 @@ NOKPROBE_SYMBOL(notify_die); - - int register_die_notifier(struct notifier_block *nb) - { -- vmalloc_sync_all(); -+ vmalloc_sync_mappings(); - return atomic_notifier_chain_register(&die_chain, nb); - } - EXPORT_SYMBOL_GPL(register_die_notifier); -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 5d6ebd1449f0..d8df500e0eea 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -3518,7 +3518,7 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg, - struct mem_cgroup_thresholds *thresholds; - struct mem_cgroup_threshold_ary *new; - unsigned long usage; -- int i, j, size; -+ int i, j, size, entries; - - mutex_lock(&memcg->thresholds_lock); - -@@ -3538,14 +3538,20 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg, - __mem_cgroup_threshold(memcg, type == _MEMSWAP); - - /* Calculate new number of threshold */ -- size = 0; -+ size = entries = 0; - for (i = 0; i < thresholds->primary->size; i++) { - if (thresholds->primary->entries[i].eventfd != eventfd) - size++; -+ else -+ entries++; - } - - new = thresholds->spare; - -+ /* If no items related to eventfd have been cleared, nothing to do */ -+ if (!entries) -+ goto unlock; -+ - /* Set thresholds array to NULL if we don't have thresholds */ - if (!size) { - kfree(new); -diff --git a/mm/nommu.c b/mm/nommu.c -index 17c00d93de2e..13fc62d97544 100644 ---- a/mm/nommu.c -+++ b/mm/nommu.c -@@ -450,10 +450,14 @@ void vm_unmap_aliases(void) - EXPORT_SYMBOL_GPL(vm_unmap_aliases); - - /* -- * Implement a stub for vmalloc_sync_all() if the architecture chose not to -- * have one. -+ * Implement a stub for vmalloc_sync_[un]mapping() if the architecture -+ * chose not to have one. - */ --void __weak vmalloc_sync_all(void) -+void __weak vmalloc_sync_mappings(void) -+{ -+} -+ -+void __weak vmalloc_sync_unmappings(void) - { - } - -diff --git a/mm/slub.c b/mm/slub.c -index 099c7a85ede0..958a8f7a3c25 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -1923,8 +1923,6 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node, - - if (node == NUMA_NO_NODE) - searchnode = numa_mem_id(); -- else if (!node_present_pages(node)) -- searchnode = node_to_mem_node(node); - - object = get_partial_node(s, get_node(s, searchnode), c, flags); - if (object || node != NUMA_NO_NODE) -@@ -2521,17 +2519,27 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, - struct page *page; - - page = c->page; -- if (!page) -+ if (!page) { -+ /* -+ * if the node is not online or has no normal memory, just -+ * ignore the node constraint -+ */ -+ if (unlikely(node != NUMA_NO_NODE && -+ !node_state(node, N_NORMAL_MEMORY))) -+ node = NUMA_NO_NODE; - goto new_slab; -+ } - redo: - - if (unlikely(!node_match(page, node))) { -- int searchnode = node; -- -- if (node != NUMA_NO_NODE && !node_present_pages(node)) -- searchnode = node_to_mem_node(node); -- -- if (unlikely(!node_match(page, searchnode))) { -+ /* -+ * same as above but node_match() being false already -+ * implies node != NUMA_NO_NODE -+ */ -+ if (!node_state(node, N_NORMAL_MEMORY)) { -+ node = NUMA_NO_NODE; -+ goto redo; -+ } else { - stat(s, ALLOC_NODE_MISMATCH); - deactivate_slab(s, page, c->freelist, c); - goto new_slab; -@@ -2943,11 +2951,13 @@ redo: - barrier(); - - if (likely(page == c->page)) { -- set_freepointer(s, tail_obj, c->freelist); -+ void **freelist = READ_ONCE(c->freelist); -+ -+ set_freepointer(s, tail_obj, freelist); - - if (unlikely(!this_cpu_cmpxchg_double( - s->cpu_slab->freelist, s->cpu_slab->tid, -- c->freelist, tid, -+ freelist, tid, - head, next_tid(tid)))) { - - note_cmpxchg_failure("slab_free", s, tid); -diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index 0b8852d80f44..d00961ba0c42 100644 ---- a/mm/vmalloc.c -+++ b/mm/vmalloc.c -@@ -1769,7 +1769,7 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, - * First make sure the mappings are removed from all page-tables - * before they are freed. - */ -- vmalloc_sync_all(); -+ vmalloc_sync_unmappings(); - - /* - * In this function, newly allocated vm_struct has VM_UNINITIALIZED -@@ -2318,16 +2318,19 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, - EXPORT_SYMBOL(remap_vmalloc_range); - - /* -- * Implement a stub for vmalloc_sync_all() if the architecture chose not to -- * have one. -+ * Implement stubs for vmalloc_sync_[un]mappings () if the architecture chose -+ * not to have one. - * - * The purpose of this function is to make sure the vmalloc area - * mappings are identical in all page-tables in the system. - */ --void __weak vmalloc_sync_all(void) -+void __weak vmalloc_sync_mappings(void) - { - } - -+void __weak vmalloc_sync_unmappings(void) -+{ -+} - - static int f(pte_t *pte, pgtable_t table, unsigned long addr, void *data) - { -diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c -index de92fc1fc3be..b3b918afd212 100644 ---- a/net/dsa/tag_brcm.c -+++ b/net/dsa/tag_brcm.c -@@ -134,6 +134,8 @@ static struct sk_buff *brcm_tag_rcv(struct sk_buff *skb, struct net_device *dev, - - skb->dev = ds->ports[source_port].netdev; - -+ skb->offload_fwd_mark = 1; -+ - return skb; - } - -diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c -index 6705420b3111..d7206581145d 100644 ---- a/net/hsr/hsr_framereg.c -+++ b/net/hsr/hsr_framereg.c -@@ -468,13 +468,9 @@ int hsr_get_node_data(struct hsr_priv *hsr, - struct hsr_port *port; - unsigned long tdiff; - -- -- rcu_read_lock(); - node = find_node_by_AddrA(&hsr->node_db, addr); -- if (!node) { -- rcu_read_unlock(); -- return -ENOENT; /* No such entry */ -- } -+ if (!node) -+ return -ENOENT; - - ether_addr_copy(addr_b, node->MacAddressB); - -@@ -509,7 +505,5 @@ int hsr_get_node_data(struct hsr_priv *hsr, - *addr_b_ifindex = -1; - } - -- rcu_read_unlock(); -- - return 0; - } -diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c -index b9cce0fd5696..37708dabebd1 100644 ---- a/net/hsr/hsr_netlink.c -+++ b/net/hsr/hsr_netlink.c -@@ -259,17 +259,16 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info) - if (!na) - goto invalid; - -- hsr_dev = __dev_get_by_index(genl_info_net(info), -- nla_get_u32(info->attrs[HSR_A_IFINDEX])); -+ rcu_read_lock(); -+ hsr_dev = dev_get_by_index_rcu(genl_info_net(info), -+ nla_get_u32(info->attrs[HSR_A_IFINDEX])); - if (!hsr_dev) -- goto invalid; -+ goto rcu_unlock; - if (!is_hsr_master(hsr_dev)) -- goto invalid; -- -+ goto rcu_unlock; - - /* Send reply */ -- -- skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); -+ skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); - if (!skb_out) { - res = -ENOMEM; - goto fail; -@@ -321,12 +320,10 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info) - res = nla_put_u16(skb_out, HSR_A_IF1_SEQ, hsr_node_if1_seq); - if (res < 0) - goto nla_put_failure; -- rcu_read_lock(); - port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_A); - if (port) - res = nla_put_u32(skb_out, HSR_A_IF1_IFINDEX, - port->dev->ifindex); -- rcu_read_unlock(); - if (res < 0) - goto nla_put_failure; - -@@ -336,20 +333,22 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info) - res = nla_put_u16(skb_out, HSR_A_IF2_SEQ, hsr_node_if2_seq); - if (res < 0) - goto nla_put_failure; -- rcu_read_lock(); - port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_B); - if (port) - res = nla_put_u32(skb_out, HSR_A_IF2_IFINDEX, - port->dev->ifindex); -- rcu_read_unlock(); - if (res < 0) - goto nla_put_failure; - -+ rcu_read_unlock(); -+ - genlmsg_end(skb_out, msg_head); - genlmsg_unicast(genl_info_net(info), skb_out, info->snd_portid); - - return 0; - -+rcu_unlock: -+ rcu_read_unlock(); - invalid: - netlink_ack(skb_in, nlmsg_hdr(skb_in), -EINVAL, NULL); - return 0; -@@ -359,6 +358,7 @@ nla_put_failure: - /* Fall through */ - - fail: -+ rcu_read_unlock(); - return res; - } - -@@ -366,16 +366,14 @@ fail: - */ - static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info) - { -- /* For receiving */ -- struct nlattr *na; -+ unsigned char addr[ETH_ALEN]; - struct net_device *hsr_dev; -- -- /* For sending */ - struct sk_buff *skb_out; -- void *msg_head; - struct hsr_priv *hsr; -- void *pos; -- unsigned char addr[ETH_ALEN]; -+ bool restart = false; -+ struct nlattr *na; -+ void *pos = NULL; -+ void *msg_head; - int res; - - if (!info) -@@ -385,17 +383,17 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info) - if (!na) - goto invalid; - -- hsr_dev = __dev_get_by_index(genl_info_net(info), -- nla_get_u32(info->attrs[HSR_A_IFINDEX])); -+ rcu_read_lock(); -+ hsr_dev = dev_get_by_index_rcu(genl_info_net(info), -+ nla_get_u32(info->attrs[HSR_A_IFINDEX])); - if (!hsr_dev) -- goto invalid; -+ goto rcu_unlock; - if (!is_hsr_master(hsr_dev)) -- goto invalid; -- -+ goto rcu_unlock; - -+restart: - /* Send reply */ -- -- skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); -+ skb_out = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC); - if (!skb_out) { - res = -ENOMEM; - goto fail; -@@ -409,18 +407,26 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info) - goto nla_put_failure; - } - -- res = nla_put_u32(skb_out, HSR_A_IFINDEX, hsr_dev->ifindex); -- if (res < 0) -- goto nla_put_failure; -+ if (!restart) { -+ res = nla_put_u32(skb_out, HSR_A_IFINDEX, hsr_dev->ifindex); -+ if (res < 0) -+ goto nla_put_failure; -+ } - - hsr = netdev_priv(hsr_dev); - -- rcu_read_lock(); -- pos = hsr_get_next_node(hsr, NULL, addr); -+ if (!pos) -+ pos = hsr_get_next_node(hsr, NULL, addr); - while (pos) { - res = nla_put(skb_out, HSR_A_NODE_ADDR, ETH_ALEN, addr); - if (res < 0) { -- rcu_read_unlock(); -+ if (res == -EMSGSIZE) { -+ genlmsg_end(skb_out, msg_head); -+ genlmsg_unicast(genl_info_net(info), skb_out, -+ info->snd_portid); -+ restart = true; -+ goto restart; -+ } - goto nla_put_failure; - } - pos = hsr_get_next_node(hsr, pos, addr); -@@ -432,15 +438,18 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info) - - return 0; - -+rcu_unlock: -+ rcu_read_unlock(); - invalid: - netlink_ack(skb_in, nlmsg_hdr(skb_in), -EINVAL, NULL); - return 0; - - nla_put_failure: -- kfree_skb(skb_out); -+ nlmsg_free(skb_out); - /* Fall through */ - - fail: -+ rcu_read_unlock(); - return res; - } - -@@ -467,6 +476,7 @@ static struct genl_family hsr_genl_family __ro_after_init = { - .name = "HSR", - .version = 1, - .maxattr = HSR_A_MAX, -+ .netnsok = true, - .module = THIS_MODULE, - .ops = hsr_ops, - .n_ops = ARRAY_SIZE(hsr_ops), -diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c -index 5fee6ec7c93d..b215df0bce0e 100644 ---- a/net/hsr/hsr_slave.c -+++ b/net/hsr/hsr_slave.c -@@ -152,16 +152,16 @@ int hsr_add_port(struct hsr_priv *hsr, struct net_device *dev, - if (port == NULL) - return -ENOMEM; - -+ port->hsr = hsr; -+ port->dev = dev; -+ port->type = type; -+ - if (type != HSR_PT_MASTER) { - res = hsr_portdev_setup(dev, port); - if (res) - goto fail_dev_setup; - } - -- port->hsr = hsr; -- port->dev = dev; -- port->type = type; -- - list_add_tail_rcu(&port->port_list, &hsr->ports); - synchronize_rcu(); - -diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig -index f48fe6fc7e8c..4abc4ba733bf 100644 ---- a/net/ipv4/Kconfig -+++ b/net/ipv4/Kconfig -@@ -297,6 +297,7 @@ config SYN_COOKIES - - config NET_IPVTI - tristate "Virtual (secure) IP: tunneling" -+ depends on IPV6 || IPV6=n - select INET_TUNNEL - select NET_IP_TUNNEL - depends on INET_XFRM_MODE_TUNNEL -diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c -index 59384ffe89f7..b930ab5cf140 100644 ---- a/net/ipv4/ip_vti.c -+++ b/net/ipv4/ip_vti.c -@@ -208,17 +208,39 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, - int mtu; - - if (!dst) { -- struct rtable *rt; -- -- fl->u.ip4.flowi4_oif = dev->ifindex; -- fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC; -- rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4); -- if (IS_ERR(rt)) { -+ switch (skb->protocol) { -+ case htons(ETH_P_IP): { -+ struct rtable *rt; -+ -+ fl->u.ip4.flowi4_oif = dev->ifindex; -+ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC; -+ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4); -+ if (IS_ERR(rt)) { -+ dev->stats.tx_carrier_errors++; -+ goto tx_error_icmp; -+ } -+ dst = &rt->dst; -+ skb_dst_set(skb, dst); -+ break; -+ } -+#if IS_ENABLED(CONFIG_IPV6) -+ case htons(ETH_P_IPV6): -+ fl->u.ip6.flowi6_oif = dev->ifindex; -+ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; -+ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6); -+ if (dst->error) { -+ dst_release(dst); -+ dst = NULL; -+ dev->stats.tx_carrier_errors++; -+ goto tx_error_icmp; -+ } -+ skb_dst_set(skb, dst); -+ break; -+#endif -+ default: - dev->stats.tx_carrier_errors++; - goto tx_error_icmp; - } -- dst = &rt->dst; -- skb_dst_set(skb, dst); - } - - dst_hold(dst); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 8b855d3eec9e..05fe1d007544 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1014,21 +1014,22 @@ out: kfree_skb(skb); - static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) - { - struct dst_entry *dst = &rt->dst; -+ u32 old_mtu = ipv4_mtu(dst); - struct fib_result res; - bool lock = false; - - if (ip_mtu_locked(dst)) - return; - -- if (ipv4_mtu(dst) < mtu) -+ if (old_mtu < mtu) - return; - - if (mtu < ip_rt_min_pmtu) { - lock = true; -- mtu = ip_rt_min_pmtu; -+ mtu = min(old_mtu, ip_rt_min_pmtu); - } - -- if (rt->rt_pmtu == mtu && -+ if (rt->rt_pmtu == mtu && !lock && - time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2)) - return; - -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 396a0f61f5f8..207bf342e995 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -315,7 +315,7 @@ static int vti6_rcv(struct sk_buff *skb) - - if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { - rcu_read_unlock(); -- return 0; -+ goto discard; - } - - ipv6h = ipv6_hdr(skb); -@@ -454,15 +454,33 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) - int mtu; - - if (!dst) { -- fl->u.ip6.flowi6_oif = dev->ifindex; -- fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; -- dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6); -- if (dst->error) { -- dst_release(dst); -- dst = NULL; -+ switch (skb->protocol) { -+ case htons(ETH_P_IP): { -+ struct rtable *rt; -+ -+ fl->u.ip4.flowi4_oif = dev->ifindex; -+ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC; -+ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4); -+ if (IS_ERR(rt)) -+ goto tx_err_link_failure; -+ dst = &rt->dst; -+ skb_dst_set(skb, dst); -+ break; -+ } -+ case htons(ETH_P_IPV6): -+ fl->u.ip6.flowi6_oif = dev->ifindex; -+ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; -+ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6); -+ if (dst->error) { -+ dst_release(dst); -+ dst = NULL; -+ goto tx_err_link_failure; -+ } -+ skb_dst_set(skb, dst); -+ break; -+ default: - goto tx_err_link_failure; - } -- skb_dst_set(skb, dst); - } - - dst_hold(dst); -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 5ec73cf386df..7b4ce3f9e2f4 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -718,7 +718,6 @@ static void tcp_v6_init_req(struct request_sock *req, - const struct sock *sk_listener, - struct sk_buff *skb) - { -- bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags); - struct inet_request_sock *ireq = inet_rsk(req); - const struct ipv6_pinfo *np = inet6_sk(sk_listener); - -@@ -726,7 +725,7 @@ static void tcp_v6_init_req(struct request_sock *req, - ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr; - - /* So that link locals have meaning */ -- if ((!sk_listener->sk_bound_dev_if || l3_slave) && -+ if (!sk_listener->sk_bound_dev_if && - ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL) - ireq->ir_iif = tcp_v6_iif(skb); - -diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c -index 994dde6e5f9d..986e9b6b961d 100644 ---- a/net/mac80211/mesh_hwmp.c -+++ b/net/mac80211/mesh_hwmp.c -@@ -1137,7 +1137,8 @@ int mesh_nexthop_resolve(struct ieee80211_sub_if_data *sdata, - } - } - -- if (!(mpath->flags & MESH_PATH_RESOLVING)) -+ if (!(mpath->flags & MESH_PATH_RESOLVING) && -+ mesh_path_sel_is_hwmp(sdata)) - mesh_queue_preq(mpath, PREQ_Q_F_START); - - if (skb_queue_len(&mpath->frame_queue) >= MESH_FRAME_QUEUE_LEN) -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index 627dc642f894..77ab9cc1a230 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -3,6 +3,7 @@ - * Copyright 2006-2007 Jiri Benc - * Copyright 2013-2014 Intel Mobile Communications GmbH - * Copyright (C) 2015 - 2017 Intel Deutschland GmbH -+ * Copyright (C) 2018-2020 Intel Corporation - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -951,6 +952,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta) - might_sleep(); - lockdep_assert_held(&local->sta_mtx); - -+ while (sta->sta_state == IEEE80211_STA_AUTHORIZED) { -+ ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC); -+ WARN_ON_ONCE(ret); -+ } -+ - /* now keys can no longer be reached */ - ieee80211_free_sta_keys(local, sta); - -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index 09c7aa519ca8..513d071ccac7 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -3451,8 +3451,26 @@ begin: - tx.skb = skb; - tx.sdata = vif_to_sdata(info->control.vif); - -- if (txq->sta) -+ if (txq->sta) { - tx.sta = container_of(txq->sta, struct sta_info, sta); -+ /* -+ * Drop unicast frames to unauthorised stations unless they are -+ * EAPOL frames from the local station. -+ */ -+ if (unlikely(ieee80211_is_data(hdr->frame_control) && -+ !ieee80211_vif_is_mesh(&tx.sdata->vif) && -+ tx.sdata->vif.type != NL80211_IFTYPE_OCB && -+ !is_multicast_ether_addr(hdr->addr1) && -+ !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) && -+ (!(info->control.flags & -+ IEEE80211_TX_CTRL_PORT_CTRL_PROTO) || -+ !ether_addr_equal(tx.sdata->vif.addr, -+ hdr->addr2)))) { -+ I802_DEBUG_INC(local->tx_handlers_drop_unauth_port); -+ ieee80211_free_txskb(&local->hw, skb); -+ goto begin; -+ } -+ } - - /* - * The key can be removed while the packet was queued, so need to call -diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c -index ce13a50b9189..ee190fa4dc34 100644 ---- a/net/netfilter/nft_fwd_netdev.c -+++ b/net/netfilter/nft_fwd_netdev.c -@@ -62,6 +62,13 @@ nla_put_failure: - return -1; - } - -+static int nft_fwd_validate(const struct nft_ctx *ctx, -+ const struct nft_expr *expr, -+ const struct nft_data **data) -+{ -+ return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS)); -+} -+ - static struct nft_expr_type nft_fwd_netdev_type; - static const struct nft_expr_ops nft_fwd_netdev_ops = { - .type = &nft_fwd_netdev_type, -@@ -69,6 +76,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = { - .eval = nft_fwd_netdev_eval, - .init = nft_fwd_netdev_init, - .dump = nft_fwd_netdev_dump, -+ .validate = nft_fwd_validate, - }; - - static struct nft_expr_type nft_fwd_netdev_type __read_mostly = { -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 387589a4a340..102750bd751c 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2204,6 +2204,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - struct timespec ts; - __u32 ts_status; - bool is_drop_n_account = false; -+ unsigned int slot_id = 0; - bool do_vnet = false; - - /* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT. -@@ -2300,6 +2301,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - if (!h.raw) - goto drop_n_account; - -+ if (po->tp_version <= TPACKET_V2) { -+ slot_id = po->rx_ring.head; -+ if (test_bit(slot_id, po->rx_ring.rx_owner_map)) -+ goto drop_n_account; -+ __set_bit(slot_id, po->rx_ring.rx_owner_map); -+ } -+ - if (do_vnet && - virtio_net_hdr_from_skb(skb, h.raw + macoff - - sizeof(struct virtio_net_hdr), -@@ -2405,7 +2413,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - #endif - - if (po->tp_version <= TPACKET_V2) { -+ spin_lock(&sk->sk_receive_queue.lock); - __packet_set_status(po, h.raw, status); -+ __clear_bit(slot_id, po->rx_ring.rx_owner_map); -+ spin_unlock(&sk->sk_receive_queue.lock); - sk->sk_data_ready(sk); - } else { - prb_clear_blk_fill_status(&po->rx_ring); -@@ -4298,6 +4309,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - { - struct pgv *pg_vec = NULL; - struct packet_sock *po = pkt_sk(sk); -+ unsigned long *rx_owner_map = NULL; - int was_running, order = 0; - struct packet_ring_buffer *rb; - struct sk_buff_head *rb_queue; -@@ -4383,6 +4395,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - } - break; - default: -+ if (!tx_ring) { -+ rx_owner_map = bitmap_alloc(req->tp_frame_nr, -+ GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO); -+ if (!rx_owner_map) -+ goto out_free_pg_vec; -+ } - break; - } - } -@@ -4412,6 +4430,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - err = 0; - spin_lock_bh(&rb_queue->lock); - swap(rb->pg_vec, pg_vec); -+ if (po->tp_version <= TPACKET_V2) -+ swap(rb->rx_owner_map, rx_owner_map); - rb->frame_max = (req->tp_frame_nr - 1); - rb->head = 0; - rb->frame_size = req->tp_frame_size; -@@ -4443,6 +4463,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - } - - out_free_pg_vec: -+ bitmap_free(rx_owner_map); - if (pg_vec) - free_pg_vec(pg_vec, order, req->tp_block_nr); - out: -diff --git a/net/packet/internal.h b/net/packet/internal.h -index c70a2794456f..f10294800aaf 100644 ---- a/net/packet/internal.h -+++ b/net/packet/internal.h -@@ -70,7 +70,10 @@ struct packet_ring_buffer { - - unsigned int __percpu *pending_refcnt; - -- struct tpacket_kbdq_core prb_bdqc; -+ union { -+ unsigned long *rx_owner_map; -+ struct tpacket_kbdq_core prb_bdqc; -+ }; - }; - - extern struct mutex fanout_mutex; -diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c -index ac9a5b8825b9..4f133faa9e60 100644 ---- a/net/sched/cls_route.c -+++ b/net/sched/cls_route.c -@@ -539,8 +539,8 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, - fp = &b->ht[h]; - for (pfp = rtnl_dereference(*fp); pfp; - fp = &pfp->next, pfp = rtnl_dereference(*fp)) { -- if (pfp == f) { -- *fp = f->next; -+ if (pfp == fold) { -+ rcu_assign_pointer(*fp, fold->next); - break; - } - } -diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c -index 796b4e1beb12..c2d2c054a4e4 100644 ---- a/net/sched/cls_tcindex.c -+++ b/net/sched/cls_tcindex.c -@@ -375,6 +375,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, - - if (tcindex_alloc_perfect_hash(cp) < 0) - goto errout; -+ cp->alloc_hash = cp->hash; - for (i = 0; i < min(cp->hash, p->hash); i++) - cp->perfect[i].res = p->perfect[i].res; - balloc = 1; -diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c -index 4e458fd9236a..c58557193527 100644 ---- a/net/xfrm/xfrm_device.c -+++ b/net/xfrm/xfrm_device.c -@@ -187,6 +187,7 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void - return xfrm_dev_feat_change(dev); - - case NETDEV_DOWN: -+ case NETDEV_UNREGISTER: - return xfrm_dev_down(dev); - } - return NOTIFY_DONE; -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index b5006a091fd6..f76bb5237df3 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -301,7 +301,9 @@ EXPORT_SYMBOL(xfrm_policy_destroy); - - static void xfrm_policy_kill(struct xfrm_policy *policy) - { -+ write_lock_bh(&policy->lock); - policy->walk.dead = 1; -+ write_unlock_bh(&policy->lock); - - atomic_inc(&policy->genid); - -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 339a070da597..86084086a472 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -109,7 +109,8 @@ static inline int verify_sec_ctx_len(struct nlattr **attrs) - return 0; - - uctx = nla_data(rt); -- if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)) -+ if (uctx->len > nla_len(rt) || -+ uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)) - return -EINVAL; - - return 0; -@@ -2211,6 +2212,9 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, - xfrm_mark_get(attrs, &mark); - - err = verify_newpolicy_info(&ua->policy); -+ if (err) -+ goto free_state; -+ err = verify_sec_ctx_len(attrs); - if (err) - goto free_state; - -diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn -index 8d5357053f86..486e135d3e30 100644 ---- a/scripts/Makefile.extrawarn -+++ b/scripts/Makefile.extrawarn -@@ -72,5 +72,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format) - KBUILD_CFLAGS += $(call cc-disable-warning, sign-compare) - KBUILD_CFLAGS += $(call cc-disable-warning, format-zero-length) - KBUILD_CFLAGS += $(call cc-disable-warning, uninitialized) -+KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) - endif - endif -diff --git a/scripts/dtc/dtc-lexer.l b/scripts/dtc/dtc-lexer.l -index fd825ebba69c..24af54997758 100644 ---- a/scripts/dtc/dtc-lexer.l -+++ b/scripts/dtc/dtc-lexer.l -@@ -38,7 +38,6 @@ LINECOMMENT "//".*\n - #include "srcpos.h" - #include "dtc-parser.tab.h" - --YYLTYPE yylloc; - extern bool treesource_error; - - /* CAUTION: this will stop working if we ever use yyless() or yyunput() */ -diff --git a/scripts/dtc/dtc-lexer.lex.c_shipped b/scripts/dtc/dtc-lexer.lex.c_shipped -index 64c243772398..9db3a409c507 100644 ---- a/scripts/dtc/dtc-lexer.lex.c_shipped -+++ b/scripts/dtc/dtc-lexer.lex.c_shipped -@@ -631,7 +631,6 @@ char *yytext; - #include "srcpos.h" - #include "dtc-parser.tab.h" - --YYLTYPE yylloc; - extern bool treesource_error; - - /* CAUTION: this will stop working if we ever use yyless() or yyunput() */ -diff --git a/scripts/parse-maintainers.pl b/scripts/parse-maintainers.pl -old mode 100644 -new mode 100755 -diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c -index b8ab46b8298d..40d2d39151bf 100644 ---- a/sound/core/oss/pcm_plugin.c -+++ b/sound/core/oss/pcm_plugin.c -@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames) - while (plugin->next) { - if (plugin->dst_frames) - frames = plugin->dst_frames(plugin, frames); -- if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) -+ if ((snd_pcm_sframes_t)frames <= 0) - return -ENXIO; - plugin = plugin->next; - err = snd_pcm_plugin_alloc(plugin, frames); -@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames) - while (plugin->prev) { - if (plugin->src_frames) - frames = plugin->src_frames(plugin, frames); -- if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) -+ if ((snd_pcm_sframes_t)frames <= 0) - return -ENXIO; - plugin = plugin->prev; - err = snd_pcm_plugin_alloc(plugin, frames); -@@ -209,6 +209,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p - if (stream == SNDRV_PCM_STREAM_PLAYBACK) { - plugin = snd_pcm_plug_last(plug); - while (plugin && drv_frames > 0) { -+ if (drv_frames > plugin->buf_frames) -+ drv_frames = plugin->buf_frames; - plugin_prev = plugin->prev; - if (plugin->src_frames) - drv_frames = plugin->src_frames(plugin, drv_frames); -@@ -220,6 +222,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p - plugin_next = plugin->next; - if (plugin->dst_frames) - drv_frames = plugin->dst_frames(plugin, drv_frames); -+ if (drv_frames > plugin->buf_frames) -+ drv_frames = plugin->buf_frames; - plugin = plugin_next; - } - } else -@@ -248,11 +252,15 @@ snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pc - if (frames < 0) - return frames; - } -+ if (frames > plugin->buf_frames) -+ frames = plugin->buf_frames; - plugin = plugin_next; - } - } else if (stream == SNDRV_PCM_STREAM_CAPTURE) { - plugin = snd_pcm_plug_last(plug); - while (plugin) { -+ if (frames > plugin->buf_frames) -+ frames = plugin->buf_frames; - plugin_prev = plugin->prev; - if (plugin->src_frames) { - frames = plugin->src_frames(plugin, frames); -diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c -index 9debd1b8fd28..cdfb8f92d554 100644 ---- a/sound/core/seq/oss/seq_oss_midi.c -+++ b/sound/core/seq/oss/seq_oss_midi.c -@@ -615,6 +615,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq - len = snd_seq_oss_timer_start(dp->timer); - if (ev->type == SNDRV_SEQ_EVENT_SYSEX) { - snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev); -+ snd_midi_event_reset_decode(mdev->coder); - } else { - len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev); - if (len > 0) -diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c -index 8ebbca554e99..dd958d76ca5d 100644 ---- a/sound/core/seq/seq_virmidi.c -+++ b/sound/core/seq/seq_virmidi.c -@@ -95,6 +95,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev, - if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE) - continue; - snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream); -+ snd_midi_event_reset_decode(vmidi->parser); - } else { - len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev); - if (len > 0) -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 5a7afbeb612d..b500dad33ea9 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4687,6 +4687,8 @@ static void alc_determine_headset_type(struct hda_codec *codec) - is_ctia = (val & 0x1c02) == 0x1c02; - break; - case 0x10ec0225: -+ codec->power_save_node = 1; -+ /* fall through */ - case 0x10ec0295: - case 0x10ec0299: - alc_process_coef_fw(codec, alc225_pre_hsmode); -diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c -index b223de3defc4..bf4eacc53a7d 100644 ---- a/sound/usb/line6/driver.c -+++ b/sound/usb/line6/driver.c -@@ -313,7 +313,7 @@ static void line6_data_received(struct urb *urb) - line6_midibuf_read(mb, line6->buffer_message, - LINE6_MIDI_MESSAGE_MAXLEN); - -- if (done == 0) -+ if (done <= 0) - break; - - line6->message_length = done; -diff --git a/sound/usb/line6/midibuf.c b/sound/usb/line6/midibuf.c -index 36a610ba342e..c931d48801eb 100644 ---- a/sound/usb/line6/midibuf.c -+++ b/sound/usb/line6/midibuf.c -@@ -163,7 +163,7 @@ int line6_midibuf_read(struct midi_buffer *this, unsigned char *data, - int midi_length_prev = - midibuf_message_length(this->command_prev); - -- if (midi_length_prev > 0) { -+ if (midi_length_prev > 1) { - midi_length = midi_length_prev - 1; - repeat = 1; - } else -diff --git a/tools/perf/Makefile b/tools/perf/Makefile -index 7902a5681fc8..b8fc7d972be9 100644 ---- a/tools/perf/Makefile -+++ b/tools/perf/Makefile -@@ -35,7 +35,7 @@ endif - # Only pass canonical directory names as the output directory: - # - ifneq ($(O),) -- FULL_O := $(shell readlink -f $(O) || echo $(O)) -+ FULL_O := $(shell cd $(PWD); readlink -f $(O) || echo $(O)) - endif - - # -diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c -index 63db9872c880..a49f27aa0c95 100644 ---- a/tools/perf/util/map.c -+++ b/tools/perf/util/map.c -@@ -90,7 +90,7 @@ static inline bool replace_android_lib(const char *filename, char *newfilename) - return true; - } - -- if (!strncmp(filename, "/system/lib/", 11)) { -+ if (!strncmp(filename, "/system/lib/", 12)) { - char *ndk, *app; - const char *arch; - size_t ndk_length; -diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c -index 893193bd28c1..ae0feea4e8b5 100644 ---- a/tools/perf/util/probe-finder.c -+++ b/tools/perf/util/probe-finder.c -@@ -626,14 +626,19 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwfl_Module *mod, - return -EINVAL; - } - -- /* Try to get actual symbol name from symtab */ -- symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL); -+ if (dwarf_entrypc(sp_die, &eaddr) == 0) { -+ /* If the DIE has entrypc, use it. */ -+ symbol = dwarf_diename(sp_die); -+ } else { -+ /* Try to get actual symbol name and address from symtab */ -+ symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL); -+ eaddr = sym.st_value; -+ } - if (!symbol) { - pr_warning("Failed to find symbol at 0x%lx\n", - (unsigned long)paddr); - return -ENOENT; - } -- eaddr = sym.st_value; - - tp->offset = (unsigned long)(paddr - eaddr); - tp->address = (unsigned long)paddr; -diff --git a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c -index 2116df9ad832..c097a3748674 100644 ---- a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c -+++ b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c -@@ -83,7 +83,7 @@ static struct pci_access *pci_acc; - static struct pci_dev *amd_fam14h_pci_dev; - static int nbp1_entered; - --struct timespec start_time; -+static struct timespec start_time; - static unsigned long long timediff; - - #ifdef DEBUG -diff --git a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c -index 5b3205f16217..5277df27191f 100644 ---- a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c -+++ b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c -@@ -21,7 +21,7 @@ struct cpuidle_monitor cpuidle_sysfs_monitor; - - static unsigned long long **previous_count; - static unsigned long long **current_count; --struct timespec start_time; -+static struct timespec start_time; - static unsigned long long timediff; - - static int cpuidle_get_count_percent(unsigned int id, double *percent, -diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c -index 05f953f0f0a0..80a21cb67d94 100644 ---- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c -+++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c -@@ -29,6 +29,8 @@ struct cpuidle_monitor *all_monitors[] = { - 0 - }; - -+int cpu_count; -+ - static struct cpuidle_monitor *monitors[MONITORS_MAX]; - static unsigned int avail_monitors; - -diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h -index 9e43f3371fbc..3558bbae2b5d 100644 ---- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h -+++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h -@@ -18,7 +18,7 @@ - #define CSTATE_NAME_LEN 5 - #define CSTATE_DESC_LEN 60 - --int cpu_count; -+extern int cpu_count; - - /* Hard to define the right names ...: */ - enum power_range_e { -diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include -index 71dc7efc7efa..df247f39d7c5 100644 ---- a/tools/scripts/Makefile.include -+++ b/tools/scripts/Makefile.include -@@ -1,8 +1,8 @@ - # SPDX-License-Identifier: GPL-2.0 - ifneq ($(O),) - ifeq ($(origin O), command line) -- dummy := $(if $(shell test -d $(O) || echo $(O)),$(error O=$(O) does not exist),) -- ABSOLUTE_O := $(shell cd $(O) ; pwd) -+ dummy := $(if $(shell cd $(PWD); test -d $(O) || echo $(O)),$(error O=$(O) does not exist),) -+ ABSOLUTE_O := $(shell cd $(PWD); cd $(O) ; pwd) - OUTPUT := $(ABSOLUTE_O)/$(if $(subdir),$(subdir)/) - COMMAND_O := O=$(ABSOLUTE_O) - ifeq ($(objtree),)